@wrongstack/core 0.260.0 → 0.264.0

package/dist/defaults/index.js

@@ -1,7 +1,7 @@
 import * as crypto2 from 'crypto';
 import { randomBytes, createCipheriv, createDecipheriv, randomUUID, createHash } from 'crypto';
-import * as fsp from 'fs/promises';
-import * as path11 from 'path';
+import * as fsp2 from 'fs/promises';
+import * as path3 from 'path';
 import { isAbsolute, resolve } from 'path';
 import * as fs from 'fs';
 import * as os from 'os';
@@ -33,17 +33,17 @@ __export(atomic_write_exports, {
   withFileLock: () => withFileLock
 });
 async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path11.dirname(targetPath);
-  await fsp.mkdir(dir, { recursive: true });
-  const tmp = path11.join(dir, `.${path11.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const dir = path3.dirname(targetPath);
+  await fsp2.mkdir(dir, { recursive: true });
+  const tmp = path3.join(dir, `.${path3.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
-      await fsp.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
+      await fsp2.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
     } else {
-      await fsp.writeFile(tmp, content, { flag: "wx" });
+      await fsp2.writeFile(tmp, content, { flag: "wx" });
     }
     try {
-      const fh = await fsp.open(tmp, "r+");
+      const fh = await fsp2.open(tmp, "r+");
       try {
         await fh.sync();
       } finally {
@@ -53,45 +53,50 @@ async function atomicWrite(targetPath, content, opts = {}) {
     }
     let mode;
     try {
-      const stat6 = await fsp.stat(targetPath);
+      const stat6 = await fsp2.stat(targetPath);
       mode = stat6.mode & 511;
     } catch {
       mode = opts.mode;
     }
     if (mode !== void 0) {
-      await fsp.chmod(tmp, mode);
+      await fsp2.chmod(tmp, mode);
     }
     await renameWithRetry(tmp, targetPath);
   } catch (err) {
     try {
-      await fsp.unlink(tmp);
+      await fsp2.unlink(tmp);
     } catch {
     }
     throw err;
   }
 }
 async function ensureDir(dir) {
-  await fsp.mkdir(dir, { recursive: true });
+  await fsp2.mkdir(dir, { recursive: true });
 }
 async function withFileLock(targetPath, fn, opts = {}) {
-  const dir = path11.dirname(targetPath);
-  await fsp.mkdir(dir, { recursive: true });
-  const lockPath = path11.join(dir, `.${path11.basename(targetPath)}.lock`);
+  const dir = path3.dirname(targetPath);
+  await fsp2.mkdir(dir, { recursive: true });
+  const lockPath = path3.join(dir, `.${path3.basename(targetPath)}.lock`);
   const timeoutMs = opts.timeoutMs ?? 5e3;
   const staleMs = opts.staleMs ?? 3e4;
   const started = Date.now();
   let handle;
   for (; ; ) {
     try {
-      handle = await fsp.open(lockPath, "wx");
+      handle = await fsp2.open(lockPath, "wx");
       await handle.writeFile(`${process.pid}:${Date.now()}`);
       break;
     } catch (err) {
-      if (err.code !== "EEXIST") throw err;
+      const code = err.code;
+      if (code === "ENOENT") {
+        await fsp2.mkdir(dir, { recursive: true });
+        continue;
+      }
+      if (code !== "EEXIST") throw err;
       try {
-        const stat6 = await fsp.stat(lockPath);
+        const stat6 = await fsp2.stat(lockPath);
         if (Date.now() - stat6.mtimeMs > staleMs) {
-          await fsp.unlink(lockPath);
+          await fsp2.unlink(lockPath);
           continue;
         }
       } catch {
@@ -111,21 +116,21 @@ async function withFileLock(targetPath, fn, opts = {}) {
     } catch {
     }
     try {
-      await fsp.unlink(lockPath);
+      await fsp2.unlink(lockPath);
     } catch {
     }
   }
 }
 async function renameWithRetry(from, to) {
   if (process.platform !== "win32") {
-    await fsp.rename(from, to);
+    await fsp2.rename(from, to);
     return;
   }
   const delays = [10, 25, 60, 120, 250];
   let lastErr;
   for (let i = 0; i <= delays.length; i++) {
     try {
-      await fsp.rename(from, to);
+      await fsp2.rename(from, to);
       return;
     } catch (err) {
       lastErr = err;
@@ -229,7 +234,7 @@ var DefaultLogger = class _DefaultLogger {
     this.maxFileBytes = opts.maxFileBytes ?? 10 * 1024 * 1024;
     if (this.file) {
       try {
-        fs.mkdirSync(path11.dirname(this.file), { recursive: true });
+        fs.mkdirSync(path3.dirname(this.file), { recursive: true });
       } catch {
       }
     }
@@ -431,203 +436,1029 @@ function isEmptyMessage(msg) {
   return msg.content.length === 0;
 }
 
-// src/storage/session-store.ts
-function sanitizeModel(model) {
-  return model.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 40);
-}
-function generateSessionId(startedAt, model) {
-  const date = startedAt.slice(0, 10);
-  const time = startedAt.slice(11, 19).replace(/:/g, "-");
-  const suffix = randomBytes(2).toString("hex");
-  const modelPart = model ? `_${sanitizeModel(model)}` : "";
-  return `${date}/${time}Z${modelPart}_${suffix}`;
+// src/utils/index.ts
+init_atomic_write();
+
+// src/utils/error.ts
+function toErrorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
 }
-var DefaultSessionStore = class _DefaultSessionStore {
-  dir;
-  events;
-  secretScrubber;
-  constructor(opts) {
-    this.dir = opts.dir;
-    this.events = opts.events;
-    this.secretScrubber = opts.secretScrubber;
-  }
-  // ── Storage event helpers ───────────────────────────────────────────────────
-  emitRead(sessionId, filePath, operation, outcome, durationMs, error) {
-    this.events?.emit("storage.read", {
-      sessionId,
-      store: "session",
-      filePath,
-      operation,
-      outcome,
-      durationMs,
-      ...error !== void 0 ? { error } : {}
-    });
-  }
-  emitWrite(sessionId, filePath, operation, outcome, durationMs, eventCount, error) {
-    this.events?.emit("storage.write", {
-      sessionId,
-      store: "session",
-      filePath,
-      operation,
-      outcome,
-      durationMs,
-      ...eventCount !== void 0 ? { eventCount } : {},
-      ...error !== void 0 ? { error } : {}
-    });
-  }
-  emitError(sessionId, filePath, operation, error, recoverable) {
-    this.events?.emit("storage.error", {
-      sessionId,
-      store: "session",
-      filePath,
-      operation,
-      error,
-      recoverable
-    });
-  }
-  /** Absolute path to the session index file. */
-  get indexFile() {
-    return path11.join(this.dir, "_index.jsonl");
-  }
-  /** Join session ID to its absolute path within the store directory. */
-  sessionPath(id, ext) {
-    return path11.join(this.dir, `${id}${ext}`);
+
+// src/utils/safe-json.ts
+function safeParse(input, maxBytes = 5e6) {
+  if (input.length > maxBytes) {
+    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
   }
-  /**
-   * Ensure the directory implied by the session ID exists. When the ID
-   * contains a date prefix like `2026-06-06/...`, this creates the date
-   * subdirectory so sessions group naturally by day.
-   */
-  async ensureShardDir(id) {
-    const dirPath = path11.dirname(path11.join(this.dir, id));
-    await ensureDir(dirPath);
-    return dirPath;
+  try {
+    return { ok: true, value: JSON.parse(input) };
+  } catch (err) {
+    return {
+      ok: false,
+      error: toErrorMessage(err)
+    };
   }
-  async create(meta) {
-    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const id = meta.id && meta.id.length > 0 ? meta.id : generateSessionId(startedAt, meta.model ?? meta.provider);
-    const shardDir = await this.ensureShardDir(id);
-    const file = path11.join(shardDir, `${path11.basename(id)}.jsonl`);
-    const t0 = Date.now();
-    let handle;
-    try {
-      handle = await fsp.open(file, "a", 384);
-    } catch (err) {
-      this.emitError(id, file, "create", err instanceof Error ? err.message : String(err), false);
-      throw new Error(
-        `Failed to open session file: ${err instanceof Error ? err.message : String(err)}`,
-        { cause: err }
-      );
-    }
-    try {
-      const writer = new FileSessionWriter(id, handle, startedAt, meta, this.events, {
-        dir: shardDir,
-        filePath: file,
-        secretScrubber: this.secretScrubber,
-        onClose: (s) => this.appendToIndex(s)
-      });
-      this.emitWrite(id, file, "create", "success", Date.now() - t0);
-      return writer;
-    } catch (err) {
-      await handle.close().catch((e) => console.warn(JSON.stringify({
-        level: "warn",
-        event: "session_store.handle_close_failed",
-        message: e instanceof Error ? e.message : String(e),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })));
-      this.emitError(id, file, "create", err instanceof Error ? err.message : String(err), true);
-      throw err;
+}
+
+// src/utils/string.ts
+function truncate(s, max) {
+  return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
+}
+
+// src/utils/glob-match.ts
+function escapeRegex(s) {
+  return s.replace(/[.+^${}()|\\]/g, "\\$&");
+}
+var COMPILED_GLOB_CACHE = /* @__PURE__ */ new Map();
+var CACHE_MAX_SIZE = 2e3;
+function getCachedGlob(pattern) {
+  const cached = COMPILED_GLOB_CACHE.get(pattern);
+  if (cached) return cached;
+  if (COMPILED_GLOB_CACHE.size >= CACHE_MAX_SIZE) {
+    const keys = [...COMPILED_GLOB_CACHE.keys()];
+    for (let i = 0; i < Math.floor(CACHE_MAX_SIZE / 4); i++) {
+      COMPILED_GLOB_CACHE.delete(expectDefined(keys[i]));
     }
   }
-  async resume(id) {
-    const file = this.sessionPath(id, ".jsonl");
-    const t0 = Date.now();
-    const data = await this.load(id);
-    let handle;
-    try {
-      handle = await fsp.open(file, "a", 384);
-    } catch (err) {
-      this.emitError(id, file, "resume", err instanceof Error ? err.message : String(err), false);
-      throw new Error(
-        `Failed to open session "${id}" for append: ${err instanceof Error ? err.message : String(err)}`,
-        { cause: err }
-      );
-    }
-    try {
-      const writer = new FileSessionWriter(
-        id,
-        handle,
-        (/* @__PURE__ */ new Date()).toISOString(),
-        {
-          id,
-          model: data.metadata.model,
-          provider: data.metadata.provider
-        },
-        this.events,
-        {
-          resumed: true,
-          // Shard directory (sessions/<date>/) — must match create() so the
-          // .summary.json sidecar lands next to the JSONL instead of the
-          // sessions root (where summaryFor() would never find it).
-          dir: path11.dirname(file),
-          filePath: file,
-          secretScrubber: this.secretScrubber,
-          onClose: (s) => this.appendToIndex(s)
-        }
-      );
-      this.emitWrite(id, file, "resume", "success", Date.now() - t0);
-      return { writer, data };
-    } catch (err) {
-      await handle.close().catch((e) => console.warn(JSON.stringify({
-        level: "warn",
-        event: "session_store.handle_close_failed",
-        message: e instanceof Error ? e.message : String(e),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })));
-      this.emitError(id, file, "resume", err instanceof Error ? err.message : String(err), true);
-      throw err;
-    }
+  const re = compileGlob(pattern);
+  COMPILED_GLOB_CACHE.set(pattern, re);
+  return re;
+}
+var MAX_GLOB_PATTERN_LEN = 1024;
+function compileGlob(pattern) {
+  if (pattern.length > MAX_GLOB_PATTERN_LEN) {
+    throw new Error(`Glob pattern exceeds ${MAX_GLOB_PATTERN_LEN} characters`);
   }
-  async load(id) {
-    const file = this.sessionPath(id, ".jsonl");
-    const t0 = Date.now();
-    let outcome = "success";
-    let errorMsg;
-    try {
-      const raw = await fsp.readFile(file, "utf8");
-      const lines = raw.split("\n").filter((l) => l.trim());
-      const events = [];
-      for (const line of lines) {
-        try {
-          const parsed = JSON.parse(line);
-          if (parsed !== null && typeof parsed === "object" && typeof parsed.type === "string" && typeof parsed.ts === "string") {
-            events.push(parsed);
-          }
-        } catch {
+  let i = 0;
+  let re = "^";
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === "*") {
+      if (pattern[i + 1] === "*") {
+        re += ".*";
+        i += 2;
+        if (pattern[i] === "/") i++;
+      } else {
+        re += "[^/]*";
+        i++;
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+      i++;
+    } else if (c === "[") {
+      let cls = "[";
+      i++;
+      if (pattern[i] === "!" || pattern[i] === "^") {
+        cls += "^";
+        i++;
+      }
+      while (i < pattern.length && pattern[i] !== "]") {
+        const ch = pattern[i] ?? "";
+        if (ch === "\\") {
+          cls += "\\\\";
+        } else if (ch === "]" || ch === "^") {
+          cls += `\\${ch}`;
+        } else {
+          cls += ch;
         }
+        i++;
       }
-      const meta = this.metaFromEvents(id, events);
-      const { messages, usage } = this.replay(events, id);
-      const toolCallEnds = extractToolCallEnds(events);
-      return { metadata: meta, events, messages, usage, toolCallEnds };
-    } catch (err) {
-      outcome = "failure";
-      errorMsg = err instanceof Error ? err.message : String(err);
-      throw err;
-    } finally {
-      this.emitRead(id, file, "load", outcome, Date.now() - t0, errorMsg);
+      cls += "]";
+      re += cls;
+      i++;
+    } else {
+      re += escapeRegex(c ?? "");
+      i++;
     }
   }
-  async list(limit = 20) {
-    try {
-      await ensureDir(this.dir);
-      const indexed = await this.readIndex();
-      if (indexed.length > 0) {
-        indexed.sort((a, b) => {
-          if (a.startedAt < b.startedAt) return 1;
-          if (a.startedAt > b.startedAt) return -1;
-          return a.id.localeCompare(b.id);
-        });
+  re += "$";
+  return new RegExp(re);
+}
+function matchGlob(pattern, input) {
+  return getCachedGlob(pattern).test(input);
+}
+function matchAny(patterns, input) {
+  return patterns.some((p) => matchGlob(p, input));
+}
+function projectHash(absRoot) {
+  return createHash("sha256").update(path3.resolve(absRoot)).digest("hex").slice(0, 12);
+}
+function projectSlug(absRoot) {
+  const base = slugify(path3.basename(absRoot));
+  const hash = createHash("sha256").update(path3.resolve(absRoot)).digest("hex").slice(0, 6);
+  return `${base}-${hash}`;
+}
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
+}
+function wstackGlobalRoot() {
+  const fromEnv = process.env["WRONGSTACK_HOME"];
+  if (fromEnv && fromEnv.trim().length > 0) return path3.resolve(fromEnv);
+  return path3.join(os.homedir(), ".wrongstack");
+}
+function resolveWstackPaths(opts) {
+  const globalRoot = opts.globalRoot ?? (opts.userHome ? path3.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
+  const hash = projectHash(opts.projectRoot);
+  const slug = projectSlug(opts.projectRoot);
+  const projectDir = path3.join(globalRoot, "projects", slug);
+  return {
+    globalRoot,
+    configDir: globalRoot,
+    globalConfig: path3.join(globalRoot, "config.json"),
+    secretsKey: path3.join(globalRoot, ".key"),
+    globalMemory: path3.join(globalRoot, "memory.md"),
+    globalSkills: path3.join(globalRoot, "skills"),
+    globalPrompts: path3.join(globalRoot, "prompts"),
+    cacheDir: path3.join(globalRoot, "cache"),
+    modelsCache: path3.join(globalRoot, "cache", "models.dev.json"),
+    modelsOverlayCache: path3.join(globalRoot, "cache", "models-overlay.json"),
+    historyFile: path3.join(globalRoot, "history"),
+    logFile: path3.join(globalRoot, "logs", "wrongstack.log"),
+    projectDir,
+    projectCodebaseIndex: path3.join(projectDir, "codebase-index"),
+    projectMemory: path3.join(projectDir, "memory.md"),
+    projectSessions: path3.join(projectDir, "sessions"),
+    projectTrust: path3.join(projectDir, "trust.json"),
+    projectMeta: path3.join(projectDir, "meta.json"),
+    projectLocalConfig: path3.join(projectDir, "config.local.json"),
+    inProjectConfig: path3.join(opts.projectRoot, ".wrongstack", "config.json"),
+    inProjectAgentsFile: path3.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
+    inProjectSkills: path3.join(opts.projectRoot, ".wrongstack", "skills"),
+    inProjectWorktrees: path3.join(opts.projectRoot, ".wrongstack", "worktrees"),
+    projectHash: hash,
+    projectSlug: slug,
+    projectGoal: path3.join(projectDir, "goal.json"),
+    projectSpecs: path3.join(projectDir, "specs"),
+    projectTaskGraphs: path3.join(projectDir, "task-graphs"),
+    projectSddSession: path3.join(projectDir, "sdd-session.json"),
+    projectPlan: path3.join(projectDir, "plan.json"),
+    projectAutophase: path3.join(projectDir, "autophase"),
+    syncConfig: path3.join(globalRoot, "sync.json")
+  };
+}
+
+// src/utils/sleep.ts
+function sleep(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
+}
+
+// src/utils/assert-never.ts
+function assertNever(x, message) {
+  const err = new Error(
+    `Unhandled case: ${JSON.stringify(x)}`
+  );
+  err.name = "AssertNeverError";
+  throw err;
+}
+
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+function isPrimitiveArray(a) {
+  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
+}
+function deepMerge(base, patch, options = {}) {
+  const {
+    conflictResolution = "prefer-patch",
+    arrayMode = "replace",
+    protectProto = true,
+    onNonPrimitiveArrayReplace
+  } = options;
+  if (typeof base !== "object" || base === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (typeof patch !== "object" || patch === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
+      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+    }
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) || Array.isArray(patch)) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  const baseObj = base;
+  const patchObj = patch;
+  const out = { ...baseObj };
+  for (const [k, v] of Object.entries(patchObj)) {
+    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v, options);
+    } else if (Array.isArray(v) && Array.isArray(existing)) {
+      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
+        onNonPrimitiveArrayReplace(k, existing.length, v.length);
+      }
+      out[k] = deepMerge(existing, v, options);
+    } else if (v !== void 0) {
+      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
+        const existingLen = Array.isArray(existing) ? existing.length : 0;
+        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+      }
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
+// src/utils/tool-output-serializer.ts
+function createToolOutputSerializer(opts = {}) {
+  const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
+  function serialize(value) {
+    if (typeof value === "string") return value;
+    if (value === null || value === void 0) return "";
+    if (typeof value === "object") {
+      if (Array.isArray(value)) return value.map(serialize).join("\n");
+      if ("text" in value) {
+        const t = value.text;
+        return typeof t === "string" ? t : JSON.stringify(value, null, 2);
+      }
+      try {
+        return JSON.stringify(value, null, 2);
+      } catch {
+        return String(value);
+      }
+    }
+    return String(value);
+  }
+  function enforceCap(text, remainingBudget) {
+    if (remainingBudget <= 0) {
+      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
+    }
+    const textBytes = Buffer.byteLength(text, "utf8");
+    if (textBytes <= remainingBudget) {
+      return { text, newBudget: remainingBudget - textBytes };
+    }
+    const marker = `
+\u2026[truncated ${textBytes - remainingBudget} bytes]\u2026
+`;
+    const markerBytes = Buffer.byteLength(marker, "utf8");
+    const available = remainingBudget - markerBytes;
+    if (available <= 0) {
+      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
+    }
+    const half = Math.floor(available / 2);
+    const first = text.slice(0, half);
+    const second = text.slice(text.length - half);
+    return { text: `${first}${marker}${second}`, newBudget: 0 };
+  }
+  return { serialize, enforceCap, capBytes };
+}
+
+// src/utils/token-estimate.ts
+var RoughTokenEstimate = (text, charsPerToken = 3.5) => Math.max(1, Math.ceil(text.length / charsPerToken));
+var CALIBRATION_GLOBAL_KEY = "__global__";
+var _cals = /* @__PURE__ */ new Map();
+function calState(key) {
+  let state = _cals.get(key);
+  if (!state) {
+    state = { ratio: 1, count: 0, prevEst: 0 };
+    _cals.set(key, state);
+  }
+  return state;
+}
+var MIN_SAMPLES_FOR_CALIBRATION = 3;
+var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
+var ESTIMATE_CACHE_MAX_SIZE = 1e4;
+function getCachedEstimate(key, compute) {
+  const existing = ESTIMATE_CACHE.get(key);
+  if (existing !== void 0) return existing;
+  if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
+    let evicted = 0;
+    const maxEvict = Math.floor(ESTIMATE_CACHE_MAX_SIZE / 4);
+    for (const k of ESTIMATE_CACHE.keys()) {
+      if (evicted >= maxEvict) break;
+      ESTIMATE_CACHE.delete(k);
+      evicted++;
+    }
+  }
+  const estimate = compute(key);
+  ESTIMATE_CACHE.set(key, estimate);
+  return estimate;
+}
+function estimateToolInputTokens(input) {
+  if (typeof input === "string") return RoughTokenEstimate(input);
+  if (input === null || typeof input !== "object") {
+    return RoughTokenEstimate(String(input));
+  }
+  return getCachedEstimate(JSON.stringify(input), (key) => RoughTokenEstimate(key));
+}
+function estimateToolResultTokens(content) {
+  if (typeof content === "string") return RoughTokenEstimate(content);
+  return getCachedEstimate(JSON.stringify(content), (key) => RoughTokenEstimate(key));
+}
+function estimateTextTokens(text) {
+  return RoughTokenEstimate(text);
+}
+function computeMessageTokens(msg) {
+  if (typeof msg.content === "string") return estimateTextTokens(msg.content);
+  let total = 0;
+  for (const b of msg.content) {
+    if (b.type === "text") total += estimateTextTokens(b.text);
+    else if (b.type === "tool_use") total += estimateToolInputTokens(b.input);
+    else if (b.type === "tool_result") total += estimateToolResultTokens(b.content);
+    else total += RoughTokenEstimate(JSON.stringify(b));
+  }
+  return total;
+}
+function estimateMessageTokens(messages) {
+  let total = 0;
+  for (const m of messages) {
+    if (typeof m._estTokens === "number" && m._estTokens > 0) {
+      total += m._estTokens;
+      continue;
+    }
+    total += computeMessageTokens(m);
+  }
+  return total;
+}
+function estimateToolDefTokens(tool) {
+  const cached = tool._estDefTokens;
+  if (typeof cached === "number" && cached > 0) return cached;
+  return RoughTokenEstimate(tool.name) + RoughTokenEstimate(tool.description ?? "") + RoughTokenEstimate(JSON.stringify(tool.inputSchema));
+}
+function estimateRequestTokens(messages, systemPrompt, tools, calibrationKey = CALIBRATION_GLOBAL_KEY) {
+  let messagesTokens = 0;
+  if (typeof messages === "string") {
+    messagesTokens = RoughTokenEstimate(messages);
+  } else if (Array.isArray(messages)) {
+    for (const m of messages) {
+      if (typeof m === "object" && m !== null && "content" in m) {
+        const cached = m._estTokens;
+        if (typeof cached === "number" && cached > 0) {
+          messagesTokens += cached;
+          continue;
+        }
+        const content = m.content;
+        if (typeof content === "string") {
+          messagesTokens += RoughTokenEstimate(content);
+        } else if (Array.isArray(content)) {
+          for (const b of content) {
+            if (typeof b === "object" && b !== null) {
+              if (b.type === "text") {
+                messagesTokens += RoughTokenEstimate(b.text);
+              } else {
+                messagesTokens += RoughTokenEstimate(JSON.stringify(b));
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  let systemTokens = 0;
+  if (typeof systemPrompt === "string") {
+    systemTokens = RoughTokenEstimate(systemPrompt);
+  } else if (Array.isArray(systemPrompt)) {
+    for (const b of systemPrompt) {
+      if (typeof b === "object" && b !== null && b.type === "text") {
+        systemTokens += RoughTokenEstimate(b.text);
+      }
+    }
+  }
+  let toolsTokens = 0;
+  for (const t of tools) {
+    toolsTokens += estimateToolDefTokens(t);
+  }
+  const total = messagesTokens + systemTokens + toolsTokens;
+  calState(calibrationKey).prevEst = total;
+  return {
+    messages: messagesTokens,
+    systemPrompt: systemTokens,
+    tools: toolsTokens,
+    total
+  };
+}
+function getCalibrationState(calibrationKey = CALIBRATION_GLOBAL_KEY) {
+  const cal = calState(calibrationKey);
+  return {
+    ratio: cal.ratio,
+    count: cal.count,
+    calibrated: cal.count >= MIN_SAMPLES_FOR_CALIBRATION
+  };
+}
+function estimateRequestTokensCalibrated(messages, systemPrompt, tools, calibrationKey = CALIBRATION_GLOBAL_KEY) {
+  const result = estimateRequestTokens(messages, systemPrompt, tools, calibrationKey);
+  const cal = calState(calibrationKey);
+  if (cal.count >= MIN_SAMPLES_FOR_CALIBRATION) {
+    const safeRatio = Math.min(1.5, Math.max(0.5, cal.ratio));
+    return {
+      messages: Math.round(result.messages * safeRatio),
+      systemPrompt: Math.round(result.systemPrompt * safeRatio),
+      tools: Math.round(result.tools * safeRatio),
+      total: Math.round(result.total * safeRatio)
+    };
+  }
+  return result;
+}
+
+// src/utils/json-schema-validate.ts
+function validateAgainstSchema(value, schema) {
+  const errors = [];
+  walk(value, schema, "", errors);
+  return { ok: errors.length === 0, errors };
+}
+function walk(value, schema, path19, errors) {
+  if (schema.enum !== void 0) {
+    if (!schema.enum.some((e) => deepEqual(e, value))) {
+      errors.push({
+        path: path19 || "<root>",
+        message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
+      });
+      return;
+    }
+  }
+  if (typeof schema.type === "string") {
+    if (!checkType(value, schema.type)) {
+      errors.push({
+        path: path19 || "<root>",
+        message: `expected ${schema.type}, got ${describeType(value)}`
+      });
+      return;
+    }
+  }
+  if (schema.type === "object" && isPlainObject(value)) {
+    const obj = value;
+    for (const req of schema.required ?? []) {
+      if (!(req in obj)) {
+        errors.push({ path: joinPath(path19, req), message: "required property missing" });
+      }
+    }
+    if (schema.properties) {
+      for (const [key, subSchema] of Object.entries(schema.properties)) {
+        if (key in obj) {
+          walk(obj[key], subSchema, joinPath(path19, key), errors);
+        }
+      }
+    }
+  }
+  if (schema.type === "array" && Array.isArray(value) && schema.items) {
+    for (let i = 0; i < value.length; i++) {
+      walk(value[i], schema.items, `${path19}[${i}]`, errors);
+    }
+  }
+}
+function checkType(value, type) {
+  switch (type) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number" && !Number.isNaN(value);
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "boolean":
+      return typeof value === "boolean";
+    case "null":
+      return value === null;
+    case "array":
+      return Array.isArray(value);
+    case "object":
+      return isPlainObject(value);
+    default:
+      return true;
+  }
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function describeType(v) {
+  if (v === null) return "null";
+  if (Array.isArray(v)) return "array";
+  return typeof v;
+}
+function joinPath(parent, key) {
+  if (!parent) return key;
+  return `${parent}.${key}`;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b) return false;
+  if (a === null || b === null) return a === b;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
+  }
+  if (typeof a === "object" && typeof b === "object") {
+    const ak = Object.keys(a);
+    const bk = Object.keys(b);
+    if (ak.length !== bk.length) return false;
+    return ak.every(
+      (k) => deepEqual(a[k], b[k])
+    );
+  }
+  return false;
+}
+
+// src/utils/regex-guard.ts
+var MAX_PATTERN_LEN = 512;
+var DANGEROUS_PATTERNS = [
+  /(\([^)]*[+*][^)]*\))[+*]/,
+  // (a+)+, (.*)+, etc
+  /(\(\?:[^)]*[+*][^)]*\))[+*]/
+  // same, with non-capturing group
+];
+function compileUserRegex(pattern, flags) {
+  if (typeof pattern !== "string") {
+    return { ok: false, reason: "pattern must be a string" };
+  }
+  if (pattern.length === 0) {
+    return { ok: false, reason: "pattern is empty" };
+  }
+  if (pattern.length > MAX_PATTERN_LEN) {
+    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
+  }
+  for (const rx of DANGEROUS_PATTERNS) {
+    if (rx.test(pattern)) {
+      return {
+        ok: false,
+        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
+      };
+    }
+  }
+  try {
+    return { ok: true, regex: new RegExp(pattern, flags) };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: err instanceof Error ? err.message : "invalid regex"
+    };
+  }
+}
+var GLOB_CHARS = /* @__PURE__ */ new Set(["*", "?", "["]);
+var IS_WINDOWS = process.platform === "win32";
+var SEP = IS_WINDOWS ? "\\" : "/";
+function isGlob(p) {
+  for (const c of p) {
+    if (GLOB_CHARS.has(c)) return true;
+  }
+  return false;
+}
+function globToRegex(pat) {
+  let i = 0;
+  let re = "^";
+  while (i < pat.length) {
+    const c = expectDefined(pat[i]);
+    if (c === "*") {
+      if (pat[i + 1] === "*") {
+        re += ".*";
+        i += 2;
+        if (pat[i] === "/") i++;
+      } else {
+        re += "[^/\\\\]*";
+        i++;
+      }
+    } else if (c === "?") {
+      re += "[^/\\\\]";
+      i++;
+    } else if (c === "[") {
+      let cls = "[";
+      i++;
+      if (pat[i] === "!" || pat[i] === "^") {
+        cls += "^";
+        i++;
+      }
+      while (i < pat.length && pat[i] !== "]") {
+        const ch = pat[i] ?? "";
+        if (ch === "\\") cls += "\\\\";
+        else if (ch === "]" || ch === "^") cls += `\\${ch}`;
+        else cls += ch;
+        i++;
+      }
+      cls += "]";
+      re += cls;
+      i++;
+    } else {
+      re += c.replace(/[.+^${}()|\\]/g, "\\$&");
+      i++;
+    }
+  }
+  return new RegExp(re + "$");
+}
+function baseDir(pat) {
+  let i = pat.length - 1;
+  while (i >= 0 && !GLOB_CHARS.has(expectDefined(pat[i])) && pat[i] !== SEP && pat[i] !== "/") i--;
+  const cut = i >= 0 ? pat.lastIndexOf(SEP, i) : pat.lastIndexOf("/", i);
+  return cut < 0 ? "." : pat.slice(0, cut);
+}
+async function expandGlob(pattern) {
+  if (!isGlob(pattern)) return [pattern];
+  const results = /* @__PURE__ */ new Set();
+  const abs = isAbsolute(pattern);
+  const base = abs ? baseDir(pattern) : baseDir(pattern);
+  const relPat = base === "." ? pattern : pattern.slice(base.length + 1);
+  async function walk3(dir, pat) {
+    let entries;
+    try {
+      entries = await fsp2.readdir(dir);
+    } catch {
+      return;
+    }
+    const firstGlob = pat.search(/[*?[[]/);
+    if (firstGlob < 0) {
+      const re = globToRegex(pat);
+      for (const e of entries) {
+        if (re.test(e)) {
+          const full = `${dir}${SEP}${e}`;
+          results.add(abs ? resolve(full) : full);
+        }
+      }
+      return;
+    }
+    const before = pat.slice(0, firstGlob);
+    const rest = pat.slice(firstGlob);
+    if (before.endsWith("**")) {
+      await walk3(dir, rest);
+      for (const e of entries) {
+        const full = `${dir}${SEP}${e}`;
+        try {
+          const stat6 = await fsp2.stat(full);
+          if (stat6.isDirectory()) await walk3(full, rest);
+        } catch {
+        }
+      }
+    } else if (before === "") {
+      const re = globToRegex(rest);
+      for (const e of entries) {
+        if (re.test(e)) {
+          const full = `${dir}${SEP}${e}`;
+          results.add(abs ? resolve(full) : full);
+        }
+      }
+    } else {
+      const seg = before.replace(/[*?[\]]/g, "").replace(/\/$/, "");
+      if (entries.includes(seg)) {
+        const full = `${dir}${SEP}${seg}`;
+        try {
+          const stat6 = await fsp2.stat(full);
+          if (stat6.isDirectory()) await walk3(full, rest);
+        } catch {
+        }
+      }
+    }
+  }
+  await walk3(base === "." ? "." : base, relPat);
+  return [...results];
+}
+
+// src/utils/json-repair.ts
+function completePartialObject(s) {
+  if (!s.trim().startsWith("{")) return s;
+  if (tryParse(s).ok) return s;
+  return repairTruncated(s);
+}
+function repairTruncated(s) {
+  const stack = [];
+  let inString = false;
+  let escaped = false;
+  let sawKey = false;
+  let prevSig = "";
+  let contentEnd = 0;
+  let stringBraceDepth = 0;
+  for (let i = 0; i < s.length; i++) {
+    const ch = expectDefined(s[i]);
+    if (inString) {
+      contentEnd = i + 1;
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (ch === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (ch === '"') {
+        inString = false;
+        prevSig = '"';
+        stringBraceDepth = 0;
+        continue;
+      }
+      if (ch === "{") stringBraceDepth++;
+      else if (ch === "}" && stringBraceDepth > 0) stringBraceDepth--;
+      continue;
+    }
+    if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") continue;
+    contentEnd = i + 1;
+    if (ch === '"') {
+      inString = true;
+      sawKey = true;
+      stringBraceDepth = 0;
+      prevSig = '"';
+    } else if (ch === "{" || ch === "[") {
+      stack.push(ch);
+      prevSig = ch;
+    } else if (ch === "}" || ch === "]") {
+      stack.pop();
+      prevSig = ch;
+    } else {
+      prevSig = ch;
+    }
+  }
+  if (!sawKey && !inString) return s;
+  let result = s.slice(0, contentEnd);
+  if (inString) {
+    if (escaped) {
+      result = result.slice(0, -1);
+    } else if (endsWithInvalidEscape(result)) {
+      result = result.slice(0, -2);
+    }
+    if (stringBraceDepth > 0) result += "}".repeat(stringBraceDepth);
+    result += '"';
+  } else if (prevSig === ":") {
+    result += "null";
+  }
+  for (let k = stack.length - 1; k >= 0; k--) {
+    result += stack[k] === "{" ? "}" : "]";
+  }
+  if (!tryParse(result).ok) {
+    const patched = result.replace(/:(\s*)([}\]])/g, ":null$2");
+    if (tryParse(patched).ok) result = patched;
+  }
+  return result;
+}
+var VALID_ESCAPE = /* @__PURE__ */ new Set(['"', "\\", "/", "b", "f", "n", "r", "t", "u"]);
+function endsWithInvalidEscape(str) {
+  const last = str[str.length - 1];
+  if (str[str.length - 2] !== "\\" || last === void 0) return false;
+  if (VALID_ESCAPE.has(last)) return false;
+  let backslashes = 0;
+  for (let k = str.length - 2; k >= 0 && str[k] === "\\"; k--) backslashes++;
+  return backslashes % 2 === 1;
+}
+function tryParse(s) {
+  try {
+    return { ok: true, value: JSON.parse(s) };
+  } catch {
+    return { ok: false };
+  }
+}
+
+// src/utils/merge-models-payload.ts
+function mergeModelsPayload(base, overlay) {
+  const out = {};
+  for (const [id, provider] of Object.entries(base)) {
+    out[id] = cloneProvider(provider);
+  }
+  for (const [id, ovProvider] of Object.entries(overlay)) {
+    const existing = out[id];
+    out[id] = existing ? mergeProvider(existing, ovProvider) : cloneProvider(ovProvider);
+  }
+  return out;
+}
+function mergeProvider(base, overlay) {
+  const models = {};
+  for (const [mid, m] of Object.entries(base.models ?? {})) {
+    models[mid] = { ...m };
+  }
+  for (const [mid, ovModel] of Object.entries(overlay.models ?? {})) {
+    const existing = models[mid];
+    models[mid] = existing ? mergeModel(existing, ovModel) : { ...ovModel };
+  }
+  return {
+    ...base,
+    // Overlay scalar fields win when explicitly provided; otherwise keep base.
+    ...stripUndefined({
+      id: overlay.id,
+      name: overlay.name,
+      npm: overlay.npm,
+      api: overlay.api,
+      env: overlay.env,
+      doc: overlay.doc
+    }),
+    models
+  };
+}
+function mergeModel(base, overlay) {
+  const merged = { ...base, ...overlay };
+  if (base.limit || overlay.limit) {
+    merged.limit = { ...base.limit, ...overlay.limit };
+  }
+  if (base.cost || overlay.cost) {
+    merged.cost = { ...base.cost, ...overlay.cost };
+  }
+  if (base.modalities || overlay.modalities) {
+    merged.modalities = { ...base.modalities, ...overlay.modalities };
+  }
+  return merged;
+}
+function cloneProvider(p) {
+  const models = {};
+  for (const [mid, m] of Object.entries(p.models ?? {})) {
+    models[mid] = { ...m };
+  }
+  return { ...p, models };
+}
+function stripUndefined(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+
+// src/storage/session-store.ts
+function sanitizeModel(model) {
+  return model.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 40);
+}
+function generateSessionId(startedAt, model) {
+  const date = startedAt.slice(0, 10);
+  const time = startedAt.slice(11, 19).replace(/:/g, "-");
+  const suffix = randomBytes(2).toString("hex");
+  const modelPart = model ? `_${sanitizeModel(model)}` : "";
+  return `${date}/${time}Z${modelPart}_${suffix}`;
+}
+var DefaultSessionStore = class _DefaultSessionStore {
+  dir;
+  events;
+  secretScrubber;
+  constructor(opts) {
+    this.dir = opts.dir;
+    this.events = opts.events;
+    this.secretScrubber = opts.secretScrubber;
+  }
+  // ── Storage event helpers ───────────────────────────────────────────────────
+  emitRead(sessionId, filePath, operation, outcome, durationMs, error) {
+    this.events?.emit("storage.read", {
+      sessionId,
+      store: "session",
+      filePath,
+      operation,
+      outcome,
+      durationMs,
+      ...error !== void 0 ? { error } : {}
+    });
+  }
+  emitWrite(sessionId, filePath, operation, outcome, durationMs, eventCount, error) {
+    this.events?.emit("storage.write", {
+      sessionId,
+      store: "session",
+      filePath,
+      operation,
+      outcome,
+      durationMs,
+      ...eventCount !== void 0 ? { eventCount } : {},
+      ...error !== void 0 ? { error } : {}
+    });
+  }
+  emitError(sessionId, filePath, operation, error, recoverable) {
+    this.events?.emit("storage.error", {
+      sessionId,
+      store: "session",
+      filePath,
+      operation,
+      error,
+      recoverable
+    });
+  }
+  /** Absolute path to the session index file. */
+  get indexFile() {
+    return path3.join(this.dir, "_index.jsonl");
+  }
+  /** Join session ID to its absolute path within the store directory. */
+  sessionPath(id, ext) {
+    return path3.join(this.dir, `${id}${ext}`);
+  }
+  /**
+   * Ensure the directory implied by the session ID exists. When the ID
+   * contains a date prefix like `2026-06-06/...`, this creates the date
+   * subdirectory so sessions group naturally by day.
+   */
+  async ensureShardDir(id) {
+    const dirPath = path3.dirname(path3.join(this.dir, id));
+    await ensureDir(dirPath);
+    return dirPath;
+  }
+  async create(meta) {
+    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const id = meta.id && meta.id.length > 0 ? meta.id : generateSessionId(startedAt, meta.model ?? meta.provider);
+    const shardDir = await this.ensureShardDir(id);
+    const file = path3.join(shardDir, `${path3.basename(id)}.jsonl`);
+    const t0 = Date.now();
+    let handle;
+    try {
+      handle = await fsp2.open(file, "a", 384);
+    } catch (err) {
+      this.emitError(id, file, "create", toErrorMessage(err), false);
+      throw new Error(
+        `Failed to open session file: ${toErrorMessage(err)}`,
+        { cause: err }
+      );
+    }
+    try {
+      const writer = new FileSessionWriter(id, handle, startedAt, meta, this.events, {
+        dir: shardDir,
+        filePath: file,
+        secretScrubber: this.secretScrubber,
+        onClose: (s) => this.appendToIndex(s)
+      });
+      this.emitWrite(id, file, "create", "success", Date.now() - t0);
+      return writer;
+    } catch (err) {
+      await handle.close().catch((e) => console.warn(JSON.stringify({
+        level: "warn",
+        event: "session_store.handle_close_failed",
+        message: e instanceof Error ? e.message : String(e),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })));
+      this.emitError(id, file, "create", toErrorMessage(err), true);
+      throw err;
+    }
+  }
+  async resume(id) {
+    const file = this.sessionPath(id, ".jsonl");
+    const t0 = Date.now();
+    const data = await this.load(id);
+    let handle;
+    try {
+      handle = await fsp2.open(file, "a", 384);
+    } catch (err) {
+      this.emitError(id, file, "resume", toErrorMessage(err), false);
+      throw new Error(
+        `Failed to open session "${id}" for append: ${toErrorMessage(err)}`,
+        { cause: err }
+      );
+    }
+    try {
+      const writer = new FileSessionWriter(
+        id,
+        handle,
+        (/* @__PURE__ */ new Date()).toISOString(),
+        {
+          id,
+          model: data.metadata.model,
+          provider: data.metadata.provider
+        },
+        this.events,
+        {
+          resumed: true,
+          // Shard directory (sessions/<date>/) — must match create() so the
+          // .summary.json sidecar lands next to the JSONL instead of the
+          // sessions root (where summaryFor() would never find it).
+          dir: path3.dirname(file),
+          filePath: file,
+          secretScrubber: this.secretScrubber,
+          onClose: (s) => this.appendToIndex(s)
+        }
+      );
+      this.emitWrite(id, file, "resume", "success", Date.now() - t0);
+      return { writer, data };
+    } catch (err) {
+      await handle.close().catch((e) => console.warn(JSON.stringify({
+        level: "warn",
+        event: "session_store.handle_close_failed",
+        message: e instanceof Error ? e.message : String(e),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })));
+      this.emitError(id, file, "resume", toErrorMessage(err), true);
+      throw err;
+    }
+  }
+  async load(id) {
+    const file = this.sessionPath(id, ".jsonl");
+    const t0 = Date.now();
+    let outcome = "success";
+    let errorMsg;
+    try {
+      const raw = await fsp2.readFile(file, "utf8");
+      const lines = raw.split("\n").filter((l) => l.trim());
+      const events = [];
+      for (const line of lines) {
+        try {
+          const parsed = JSON.parse(line);
+          if (parsed !== null && typeof parsed === "object" && typeof parsed.type === "string" && typeof parsed.ts === "string") {
+            events.push(parsed);
+          }
+        } catch {
+        }
+      }
+      const meta = this.metaFromEvents(id, events);
+      const { messages, usage } = this.replay(events, id);
+      const toolCallEnds = extractToolCallEnds(events);
+      return { metadata: meta, events, messages, usage, toolCallEnds };
+    } catch (err) {
+      outcome = "failure";
+      errorMsg = toErrorMessage(err);
+      throw err;
+    } finally {
+      this.emitRead(id, file, "load", outcome, Date.now() - t0, errorMsg);
+    }
+  }
+  async list(limit = 20) {
+    try {
+      await ensureDir(this.dir);
+      const indexed = await this.readIndex();
+      if (indexed.length > 0) {
+        indexed.sort((a, b) => {
+          if (a.startedAt < b.startedAt) return 1;
+          if (a.startedAt > b.startedAt) return -1;
+          return a.id.localeCompare(b.id);
+        });
         return indexed.slice(0, limit);
       }
       const ids = await this.collectSessionIds(this.dir);
@@ -659,7 +1490,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     try {
       await ensureDir(this.dir);
       const line = JSON.stringify(summary) + "\n";
-      await fsp.appendFile(this.indexFile, line, "utf8");
+      await fsp2.appendFile(this.indexFile, line, "utf8");
       this.indexAppendCount++;
       if (this.indexAppendCount >= _DefaultSessionStore.COMPACT_EVERY) {
         await this.compactIndex();
@@ -673,7 +1504,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     try {
       await ensureDir(this.dir);
       const line = JSON.stringify({ action: "delete", id }) + "\n";
-      await fsp.appendFile(this.indexFile, line, "utf8");
+      await fsp2.appendFile(this.indexFile, line, "utf8");
       this.indexAppendCount++;
     } catch {
     }
@@ -691,11 +1522,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
       if (entries.length === 0) return;
       const tmp = `${this.indexFile}.compact.tmp`;
       const lines = entries.map((s) => JSON.stringify(s)).join("\n") + "\n";
-      await fsp.writeFile(tmp, lines, "utf8");
-      await fsp.rename(tmp, this.indexFile);
+      await fsp2.writeFile(tmp, lines, "utf8");
+      await fsp2.rename(tmp, this.indexFile);
     } catch (err) {
       outcome = "failure";
-      errorMsg = err instanceof Error ? err.message : String(err);
+      errorMsg = toErrorMessage(err);
     } finally {
       this.emitWrite("~compact~", this.indexFile, "compact", outcome, Date.now() - t0, void 0, errorMsg);
     }
@@ -708,7 +1539,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async readIndex() {
     let raw;
     try {
-      raw = await fsp.readFile(this.indexFile, "utf8");
+      raw = await fsp2.readFile(this.indexFile, "utf8");
     } catch {
       return [];
     }
@@ -741,8 +1572,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const valid = summaries.filter((s) => s !== null);
     const tmp = `${this.indexFile}.tmp`;
     const lines = valid.map((s) => JSON.stringify(s)).join("\n") + "\n";
-    await fsp.writeFile(tmp, lines, "utf8");
-    await fsp.rename(tmp, this.indexFile);
+    await fsp2.writeFile(tmp, lines, "utf8");
+    await fsp2.rename(tmp, this.indexFile);
     return valid.length;
   }
   /** Recursively collect session IDs from date-shard subdirectories.
@@ -753,7 +1584,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const ids = [];
     let entries;
     try {
-      entries = await fsp.readdir(dir, { withFileTypes: true });
+      entries = await fsp2.readdir(dir, { withFileTypes: true });
     } catch {
       return ids;
     }
@@ -763,7 +1594,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         continue;
       if (entry.isDirectory()) {
         const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        ids.push(...await this.collectSessionIds(path11.join(dir, entry.name), childPrefix, depth + 1));
+        ids.push(...await this.collectSessionIds(path3.join(dir, entry.name), childPrefix, depth + 1));
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
         if (entry.name === "_index.jsonl") continue;
         const base = entry.name.replace(/\.jsonl$/, "");
@@ -778,15 +1609,15 @@ var DefaultSessionStore = class _DefaultSessionStore {
     let outcome = "success";
     let errorMsg;
     try {
-      const raw = await fsp.readFile(manifest, "utf8");
+      const raw = await fsp2.readFile(manifest, "utf8");
       this.emitRead(id, manifest, "summary", "success", Date.now() - t0);
       return JSON.parse(raw);
     } catch {
       const full = this.sessionPath(id, ".jsonl");
-      const stat6 = await fsp.stat(full);
+      const stat6 = await fsp2.stat(full);
       const summary = await this.summarize(id, stat6.mtime.toISOString());
       await atomicWrite(manifest, JSON.stringify(summary), { mode: 384 }).catch((err) => {
-        const msg = err instanceof Error ? err.message : String(err);
+        const msg = toErrorMessage(err);
         this.emitError(id, manifest, "summary_fallback", msg, true);
         console.warn(JSON.stringify({
           level: "warn",
@@ -814,14 +1645,14 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async deleteSession(id) {
     const jsonlPath = this.sessionPath(id, ".jsonl");
     const summaryPath = this.sessionPath(id, ".summary.json");
-    const shardDir = path11.dirname(path11.join(this.dir, id));
-    const base = path11.basename(id);
-    const sessDir = path11.join(shardDir, base);
+    const shardDir = path3.dirname(path3.join(this.dir, id));
+    const base = path3.basename(id);
+    const sessDir = path3.join(shardDir, base);
     const deletions = [
-      fsp.unlink(jsonlPath),
-      fsp.unlink(summaryPath),
-      fsp.unlink(path11.join(shardDir, `${base}.plan.json`)),
-      fsp.unlink(path11.join(shardDir, `${base}.todos.json`))
+      fsp2.unlink(jsonlPath),
+      fsp2.unlink(summaryPath),
+      fsp2.unlink(path3.join(shardDir, `${base}.plan.json`)),
+      fsp2.unlink(path3.join(shardDir, `${base}.todos.json`))
     ];
     const results = await Promise.allSettled(deletions);
     for (const r of results) {
@@ -838,12 +1669,12 @@ var DefaultSessionStore = class _DefaultSessionStore {
         }
       }
     }
-    await fsp.rm(sessDir, { recursive: true, force: true }).catch((err) => {
+    await fsp2.rm(sessDir, { recursive: true, force: true }).catch((err) => {
       console.warn(JSON.stringify({
         level: "warn",
         event: "session_store.rmdir_failed",
         sessionId: id,
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
     });
@@ -857,16 +1688,16 @@ var DefaultSessionStore = class _DefaultSessionStore {
     let deleted = 0;
     let activeSessionId = null;
     try {
-      const raw = await fsp.readFile(path11.join(this.dir, "active.json"), "utf8");
+      const raw = await fsp2.readFile(path3.join(this.dir, "active.json"), "utf8");
       const active = JSON.parse(raw);
       activeSessionId = active.sessionId ?? null;
     } catch {
     }
     const isPrunableJsonl = (name) => name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
     const pruneFile = async (dir, name, prefix) => {
-      const jsonlPath = path11.join(dir, name);
+      const jsonlPath = path3.join(dir, name);
       try {
-        const stat6 = await fsp.stat(jsonlPath);
+        const stat6 = await fsp2.stat(jsonlPath);
         if (stat6.mtimeMs >= cutoff) return;
       } catch {
         return;
@@ -877,15 +1708,15 @@ var DefaultSessionStore = class _DefaultSessionStore {
       await this.deleteSession(id);
       deleted++;
     };
-    const entries = await fsp.readdir(this.dir, { withFileTypes: true }).catch(() => []);
+    const entries = await fsp2.readdir(this.dir, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (entry.isFile()) {
         if (isPrunableJsonl(entry.name)) await pruneFile(this.dir, entry.name, "");
         continue;
       }
       if (!entry.isDirectory()) continue;
-      const dateDir = path11.join(this.dir, entry.name);
-      const files = await fsp.readdir(dateDir, { withFileTypes: true }).catch(() => []);
+      const dateDir = path3.join(this.dir, entry.name);
+      const files = await fsp2.readdir(dateDir, { withFileTypes: true }).catch(() => []);
       for (const file of files) {
         if (!file.isFile() || !isPrunableJsonl(file.name)) continue;
         await pruneFile(dateDir, file.name, entry.name);
@@ -896,11 +1727,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const dateDir = path11.join(this.dir, entry.name);
+      const dateDir = path3.join(this.dir, entry.name);
       try {
-        const remaining = await fsp.readdir(dateDir);
+        const remaining = await fsp2.readdir(dateDir);
         if (remaining.length === 0) {
-          await fsp.rmdir(dateDir).catch(() => void 0);
+          await fsp2.rmdir(dateDir).catch(() => void 0);
         }
       } catch {
       }
@@ -919,8 +1750,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
       provider: "unknown"
     })}
 `;
-    await fsp.writeFile(file, record, "utf8");
-    await fsp.unlink(meta).catch(() => void 0);
+    await fsp2.writeFile(file, record, "utf8");
+    await fsp2.unlink(meta).catch(() => void 0);
   }
   async summarize(id, mtime) {
     try {
@@ -1071,7 +1902,7 @@ var FileSessionWriter = class _FileSessionWriter {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path11.join(opts.dir, `${path11.basename(id)}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path3.join(opts.dir, `${path3.basename(id)}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.onCloseCb = opts.onClose;
@@ -1278,7 +2109,7 @@ var FileSessionWriter = class _FileSessionWriter {
       await this.enqueueWrite(batch);
     } catch (err) {
       outcome = "failure";
-      errorMsg = err instanceof Error ? err.message : String(err);
+      errorMsg = toErrorMessage(err);
       this.appendFailCount += eventCount;
       const now = Date.now();
       if (now - this.lastAppendWarnAt > 5e3) {
@@ -1286,7 +2117,7 @@ var FileSessionWriter = class _FileSessionWriter {
         const tail = suppressed > 0 ? ` (+${suppressed} suppressed)` : "";
         console.warn(
           "[session] flush failed:",
-          err instanceof Error ? err.message : String(err),
+          toErrorMessage(err),
           tail
         );
         this.lastAppendWarnAt = now;
@@ -1376,7 +2207,7 @@ var FileSessionWriter = class _FileSessionWriter {
         await atomicWrite(this.manifestFile, JSON.stringify(this.summary), { mode: 384 });
       } catch (err) {
         outcome = "failure";
-        errorMsg = err instanceof Error ? err.message : String(err);
+        errorMsg = toErrorMessage(err);
       } finally {
         this.events?.emit("storage.write", {
           sessionId: this.id,
@@ -1397,7 +2228,7 @@ var FileSessionWriter = class _FileSessionWriter {
       await this.onCloseCb?.(this.summary);
     } catch (err) {
       idxOutcome = "failure";
-      idxError = err instanceof Error ? err.message : String(err);
+      idxError = toErrorMessage(err);
     } finally {
       this.events?.emit("storage.write", {
         sessionId: this.summary.id,
@@ -1450,7 +2281,7 @@ var FileSessionWriter = class _FileSessionWriter {
     }
     await this.flushBuffer();
     await this.writeChain;
-    const raw = await fsp.readFile(this.filePath, "utf8");
+    const raw = await fsp2.readFile(this.filePath, "utf8");
     const lines = raw.split("\n");
     const kept = [];
     let removedCount = 0;
@@ -1488,13 +2319,13 @@ var FileSessionWriter = class _FileSessionWriter {
     }
     const truncated = kept.join("\n");
     const tmpPath = `${this.filePath}.rewind.tmp`;
-    await fsp.writeFile(tmpPath, truncated + "\n", "utf8");
+    await fsp2.writeFile(tmpPath, truncated + "\n", "utf8");
     try {
       await this.handle.close();
-      await fsp.rename(tmpPath, this.filePath);
-      this.handle = await fsp.open(this.filePath, "a", 384);
+      await fsp2.rename(tmpPath, this.filePath);
+      this.handle = await fsp2.open(this.filePath, "a", 384);
     } catch (err) {
-      await fsp.unlink(tmpPath).catch(() => void 0);
+      await fsp2.unlink(tmpPath).catch(() => void 0);
       throw err;
     }
     await this.append({
@@ -1526,7 +2357,7 @@ var FileSessionWriter = class _FileSessionWriter {
       provider: this.meta.provider ?? "unknown"
     })}
 `;
-    await fsp.writeFile(this.filePath, record, "utf8");
+    await fsp2.writeFile(this.filePath, record, "utf8");
   }
   /**
    * Idea #1 — write an in-flight marker. The agent loop should call
@@ -1575,7 +2406,7 @@ var QueueStore = class {
   events;
   traceId;
   constructor(opts) {
-    this.file = path11.join(opts.dir, "queue.json");
+    this.file = path3.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
   }
@@ -1603,7 +2434,7 @@ var QueueStore = class {
         filePath: this.file,
         operation: "write",
         outcome: "failure",
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         recoverable: false,
         ...this.traceId !== void 0 && { traceId: this.traceId }
       });
@@ -1611,7 +2442,7 @@ var QueueStore = class {
         level: "warn",
         event: "queue_store.write_failed",
         path: this.file,
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
     }
@@ -1620,7 +2451,7 @@ var QueueStore = class {
     const t0 = Date.now();
     let raw;
     try {
-      raw = await fsp.readFile(this.file, "utf8");
+      raw = await fsp2.readFile(this.file, "utf8");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
@@ -1641,7 +2472,7 @@ var QueueStore = class {
         filePath: this.file,
         operation: "read",
         outcome: "failure",
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         recoverable: true,
         ...this.traceId !== void 0 && { traceId: this.traceId }
       });
@@ -1649,7 +2480,7 @@ var QueueStore = class {
         level: "warn",
         event: "queue_store.read_failed",
         path: this.file,
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
       return [];
@@ -1701,7 +2532,7 @@ var QueueStore = class {
   async clear() {
     const t0 = Date.now();
     try {
-      await fsp.unlink(this.file);
+      await fsp2.unlink(this.file);
       this.events?.emit("storage.write", {
         sessionId: this.traceId ?? "~boot~",
         store: "queue",
@@ -1720,7 +2551,7 @@ var QueueStore = class {
         filePath: this.file,
         operation: "clear",
         outcome: "failure",
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         recoverable: true,
         ...this.traceId !== void 0 && { traceId: this.traceId }
       });
@@ -1761,8 +2592,8 @@ var DefaultAttachmentStore = class {
     let spooledPath;
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
-      await fsp.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path11.join(this.spoolDir, `${id}.bin`);
+      await fsp2.mkdir(this.spoolDir, { recursive: true });
+      spooledPath = path3.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -1824,7 +2655,7 @@ var DefaultAttachmentStore = class {
       for (const att of this.items.values()) {
         if (att.path) toDelete.push(att.path);
       }
-      await Promise.all(toDelete.map((p) => fsp.unlink(p).catch(() => void 0)));
+      await Promise.all(toDelete.map((p) => fsp2.unlink(p).catch(() => void 0)));
     }
     this.items.clear();
     this.refs.length = 0;
@@ -1832,7 +2663,7 @@ var DefaultAttachmentStore = class {
   }
   async toBlock(att) {
     if (att.kind === "image") {
-      const data = att.data ?? (att.path ? await fsp.readFile(att.path, { encoding: "base64" }) : "");
+      const data = att.data ?? (att.path ? await fsp2.readFile(att.path, { encoding: "base64" }) : "");
       return {
         type: "image",
         source: {
@@ -1842,7 +2673,7 @@ var DefaultAttachmentStore = class {
         }
       };
     }
-    const raw = att.data ?? (att.path ? await fsp.readFile(att.path, "utf8") : "");
+    const raw = att.data ?? (att.path ? await fsp2.readFile(att.path, "utf8") : "");
     const label = att.meta.filename ? `<file path="${att.meta.filename}">` : "<pasted>";
     const close = att.meta.filename ? "</file>" : "</pasted>";
     return { type: "text", text: `${label}
@@ -1974,10 +2805,10 @@ var FileMemoryBackend = class {
   }
   async remember(scope, entry, filePath) {
     const file = this.resolveFile(filePath, scope);
-    await ensureDir(path11.dirname(file));
+    await ensureDir(path3.dirname(file));
     let existing = "";
     try {
-      existing = await fsp.readFile(file, "utf8");
+      existing = await fsp2.readFile(file, "utf8");
     } catch {
     }
     const id = `mem_${Date.now()}_${randomUUID().slice(0, 8)}`;
@@ -1994,7 +2825,7 @@ ${line}`;
     return withFileLock(file, async () => {
       let existing;
       try {
-        existing = await fsp.readFile(file, "utf8");
+        existing = await fsp2.readFile(file, "utf8");
       } catch {
         return 0;
       }
@@ -2030,7 +2861,7 @@ ${line}`;
   async readAll(scope, filePath) {
     const file = this.resolveFile(filePath, scope);
     try {
-      return await fsp.readFile(file, "utf8");
+      return await fsp2.readFile(file, "utf8");
     } catch {
       return "";
     }
@@ -2065,7 +2896,7 @@ ${line}`;
     const file = this.resolveFile(filePath, scope);
     let existing;
     try {
-      existing = await fsp.readFile(file, "utf8");
+      existing = await fsp2.readFile(file, "utf8");
     } catch {
       return 0;
     }
@@ -2085,7 +2916,7 @@ ${line}`;
     const next = lines.join("\n");
     const backup = `${file}.bak.${Date.now()}`;
     try {
-      await fsp.copyFile(file, backup);
+      await fsp2.copyFile(file, backup);
     } catch {
     }
     try {
@@ -2202,7 +3033,7 @@ ${body.trim()}`);
           operation: "readAll",
           outcome: "failure",
           durationMs: dur,
-          error: err instanceof Error ? err.message : String(err),
+          error: toErrorMessage(err),
           ...this.traceId !== void 0 && { traceId: this.traceId }
         });
         throw err;
@@ -2235,7 +3066,7 @@ ${body.trim()}`);
         operation: "read",
         outcome: "failure",
         durationMs: dur,
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         ...this.traceId !== void 0 && { traceId: this.traceId }
       });
       throw err;
@@ -2288,7 +3119,7 @@ ${body.trim()}`);
           operation: "remember",
           outcome: "failure",
           durationMs: dur,
-          error: err instanceof Error ? err.message : String(err),
+          error: toErrorMessage(err),
           ...this.traceId !== void 0 && { traceId: this.traceId }
         });
         throw err;
@@ -2444,7 +3275,7 @@ ${body.trim()}`);
           operation: "forget",
           outcome: "failure",
           durationMs: dur,
-          error: err instanceof Error ? err.message : String(err),
+          error: toErrorMessage(err),
           ...this.traceId !== void 0 && { traceId: this.traceId }
         });
         throw err;
@@ -2486,7 +3317,7 @@ ${body.trim()}`);
           operation: "consolidate",
           outcome: "failure",
           durationMs: dur,
-          error: err instanceof Error ? err.message : String(err),
+          error: toErrorMessage(err),
           ...this.traceId !== void 0 && { traceId: this.traceId }
         });
         throw err;
@@ -2526,7 +3357,7 @@ ${body.trim()}`);
             operation: "clear",
             outcome: "failure",
             durationMs: dur,
-            error: err instanceof Error ? err.message : String(err),
+            error: toErrorMessage(err),
             ...this.traceId !== void 0 && { traceId: this.traceId }
           });
           throw err;
@@ -2562,7 +3393,7 @@ ${body.trim()}`);
               operation: "clear",
               outcome: "failure",
               durationMs: dur,
-              error: err instanceof Error ? err.message : String(err),
+              error: toErrorMessage(err),
               ...this.traceId !== void 0 && { traceId: this.traceId }
             });
             throw err;
@@ -2722,7 +3553,7 @@ var AgentError = class extends WrongStackError {
 };
 function toWrongStackError(err, code = ERROR_CODES.AGENT_RUN_FAILED) {
   if (err instanceof WrongStackError) return err;
-  const message = err instanceof Error ? err.message : String(err);
+  const message = toErrorMessage(err);
   return new AgentError({
     message,
     code: code === "UNKNOWN" ? ERROR_CODES.AGENT_RUN_FAILED : code,
@@ -2798,105 +3629,44 @@ var DefaultConfigStore = class {
       });
     }
     const prev = this.current;
-    this.current = next;
-    for (const w of this.watchers) {
-      try {
-        w(next, prev);
-      } catch (err) {
-        console.error(JSON.stringify({
-          level: "error",
-          event: "config_store.watcher_threw",
-          message: err instanceof Error ? err.message : String(err),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        }));
-      }
-    }
-    return next;
-  }
-  watch(cb) {
-    this.watchers.add(cb);
-    return () => this.watchers.delete(cb);
-  }
-};
-var FROZEN_EMPTY = Object.freeze({});
-function deepFreeze(obj) {
-  if (obj === null || typeof obj !== "object") return obj;
-  if (Object.isFrozen(obj)) return obj;
-  for (const key of Object.keys(obj)) {
-    const v = obj[key];
-    if (v !== null && typeof v === "object" && !Object.isFrozen(v)) {
-      deepFreeze(v);
-    }
-  }
-  return Object.freeze(obj);
-}
-
-// src/types/secret-vault.ts
-var ENCRYPTED_PREFIX = "enc:v1:";
-
-// src/security/secret-vault.ts
-init_atomic_write();
-
-// src/utils/deep-merge.ts
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function isPrimitiveArray(a) {
-  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
-}
-function deepMerge(base, patch, options = {}) {
-  const {
-    conflictResolution = "prefer-patch",
-    arrayMode = "replace",
-    protectProto = true,
-    onNonPrimitiveArrayReplace
-  } = options;
-  if (typeof base !== "object" || base === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (typeof patch !== "object" || patch === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) && Array.isArray(patch)) {
-    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
-      return [.../* @__PURE__ */ new Set([...base, ...patch])];
-    }
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) || Array.isArray(patch)) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  const baseObj = base;
-  const patchObj = patch;
-  const out = { ...baseObj };
-  for (const [k, v] of Object.entries(patchObj)) {
-    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v, options);
-    } else if (Array.isArray(v) && Array.isArray(existing)) {
-      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
-        onNonPrimitiveArrayReplace(k, existing.length, v.length);
-      }
-      out[k] = deepMerge(existing, v, options);
-    } else if (v !== void 0) {
-      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
-        const existingLen = Array.isArray(existing) ? existing.length : 0;
-        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+    this.current = next;
+    for (const w of this.watchers) {
+      try {
+        w(next, prev);
+      } catch (err) {
+        console.error(JSON.stringify({
+          level: "error",
+          event: "config_store.watcher_threw",
+          message: toErrorMessage(err),
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        }));
       }
-      out[k] = v;
     }
+    return next;
   }
-  return out;
+  watch(cb) {
+    this.watchers.add(cb);
+    return () => this.watchers.delete(cb);
+  }
+};
+var FROZEN_EMPTY = Object.freeze({});
+function deepFreeze(obj) {
+  if (obj === null || typeof obj !== "object") return obj;
+  if (Object.isFrozen(obj)) return obj;
+  for (const key of Object.keys(obj)) {
+    const v = obj[key];
+    if (v !== null && typeof v === "object" && !Object.isFrozen(v)) {
+      deepFreeze(v);
+    }
+  }
+  return Object.freeze(obj);
 }
 
+// src/types/secret-vault.ts
+var ENCRYPTED_PREFIX = "enc:v1:";
+
 // src/security/secret-vault.ts
+init_atomic_write();
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
 var TAG_BYTES = 16;
@@ -2987,7 +3757,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs.mkdirSync(path11.dirname(this.keyFile), { recursive: true });
+    fs.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
     const key = randomBytes(KEY_BYTES);
     try {
       fs.writeFileSync(this.keyFile, key, { mode: 384, flag: "wx" });
@@ -3011,7 +3781,7 @@ var DefaultSecretVault = class {
 };
 function decryptConfigSecrets(cfg, vault, opts) {
   const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  return walk(cfg, vault, (v, key) => {
+  return walk2(cfg, vault, (v, key) => {
     try {
       return vault.decrypt(v);
     } catch (err) {
@@ -3023,20 +3793,20 @@ function decryptConfigSecrets(cfg, vault, opts) {
   });
 }
 function encryptConfigSecrets(cfg, vault, _opts) {
-  return walk(cfg, vault, (v) => vault.encrypt(v));
+  return walk2(cfg, vault, (v) => vault.encrypt(v));
 }
-function walk(node, vault, transform) {
+function walk2(node, vault, transform) {
   if (node === null || node === void 0) return node;
   if (typeof node !== "object") return node;
   if (Array.isArray(node)) {
-    return node.map((item) => walk(item, vault, transform));
+    return node.map((item) => walk2(item, vault, transform));
   }
   const out = /* @__PURE__ */ Object.create(null);
   for (const [k, v] of Object.entries(node)) {
     if (typeof v === "string" && isSecretField(k)) {
       out[k] = transform(v, k);
     } else if (typeof v === "object" && v !== null) {
-      out[k] = walk(v, vault, transform);
+      out[k] = walk2(v, vault, transform);
     } else {
       out[k] = v;
     }
@@ -3053,20 +3823,20 @@ function isSecretField(name) {
 async function rewriteConfigEncrypted(configPath, vault, patch) {
   let current = {};
   try {
-    const raw = await fsp.readFile(configPath, "utf8");
+    const raw = await fsp2.readFile(configPath, "utf8");
     current = JSON.parse(raw);
   } catch {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp.mkdir(path11.dirname(configPath), { recursive: true });
+  await fsp2.mkdir(path3.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions(configPath);
 }
 async function migratePlaintextSecrets(configPath, vault, logger) {
   let raw;
   try {
-    raw = await fsp.readFile(configPath, "utf8");
+    raw = await fsp2.readFile(configPath, "utf8");
   } catch {
     return { migrated: 0, file: configPath };
   }
@@ -3108,7 +3878,7 @@ async function restrictFilePermissions(filePath, opts) {
     }
   } else {
     try {
-      await fsp.chmod(filePath, 384);
+      await fsp2.chmod(filePath, 384);
     } catch {
     }
   }
@@ -3194,21 +3964,6 @@ function isContextWindowModeId(id) {
   return CONTEXT_WINDOW_MODES.some((m) => m.id === id);
 }
 
-// src/utils/safe-json.ts
-function safeParse(input, maxBytes = 5e6) {
-  if (input.length > maxBytes) {
-    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
-  }
-  try {
-    return { ok: true, value: JSON.parse(input) };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-
 // src/types/default-config.ts
 var DEFAULT_TOOLS_CONFIG = Object.freeze({
   defaultExecutionStrategy: "smart",
@@ -3384,7 +4139,7 @@ var DefaultConfigLoader = class {
           level: "warn",
           event: "config.source_load_failed",
           source: src.name,
-          message: err instanceof Error ? err.message : String(err),
+          message: toErrorMessage(err),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         }));
       }
@@ -3467,7 +4222,7 @@ var DefaultConfigLoader = class {
     const fp = this.paths.syncConfig;
     const t0 = Date.now();
     try {
-      const raw = await fsp.readFile(fp, "utf8");
+      const raw = await fsp2.readFile(fp, "utf8");
       const parsed = safeParse(raw);
       if (!parsed.ok || !parsed.value) {
         this.events?.emit("storage.read", {
@@ -3521,7 +4276,7 @@ var DefaultConfigLoader = class {
       console.warn(JSON.stringify({
         level: "warn",
         event: "config.sync_load_failed",
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
       return null;
@@ -3531,7 +4286,7 @@ var DefaultConfigLoader = class {
     let raw;
     const t0 = Date.now();
     try {
-      raw = await fsp.readFile(file, "utf8");
+      raw = await fsp2.readFile(file, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         this.events?.emit("storage.read", {
@@ -3548,7 +4303,7 @@ var DefaultConfigLoader = class {
           level: "warn",
           event: "config.read_failed",
           path: file,
-          message: err instanceof Error ? err.message : String(err),
+          message: toErrorMessage(err),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         }));
       }
@@ -3702,7 +4457,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path11.join(opts.dir, LOCK_FILE);
+    this.file = path3.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -3763,7 +4518,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path11.dirname(this.file));
+    await ensureDir(path3.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -3772,7 +4527,7 @@ var RecoveryLock = class {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     try {
-      await fsp.writeFile(this.file, JSON.stringify(lock), { flag: "wx", mode: 384 });
+      await fsp2.writeFile(this.file, JSON.stringify(lock), { flag: "wx", mode: 384 });
     } catch (err) {
       const code = err.code;
       if (code === "EEXIST") {
@@ -3788,7 +4543,7 @@ var RecoveryLock = class {
    */
   async clear() {
     try {
-      await fsp.unlink(this.file);
+      await fsp2.unlink(this.file);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return;
@@ -3798,7 +4553,7 @@ var RecoveryLock = class {
   async readLock() {
     let raw;
     try {
-      raw = await fsp.readFile(this.file, "utf8");
+      raw = await fsp2.readFile(this.file, "utf8");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return null;
@@ -3830,42 +4585,6 @@ function defaultIsPidAlive(pid) {
   }
 }
 
-// src/utils/regex-guard.ts
-var MAX_PATTERN_LEN = 512;
-var DANGEROUS_PATTERNS = [
-  /(\([^)]*[+*][^)]*\))[+*]/,
-  // (a+)+, (.*)+, etc
-  /(\(\?:[^)]*[+*][^)]*\))[+*]/
-  // same, with non-capturing group
-];
-function compileUserRegex(pattern, flags) {
-  if (typeof pattern !== "string") {
-    return { ok: false, reason: "pattern must be a string" };
-  }
-  if (pattern.length === 0) {
-    return { ok: false, reason: "pattern is empty" };
-  }
-  if (pattern.length > MAX_PATTERN_LEN) {
-    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
-  }
-  for (const rx of DANGEROUS_PATTERNS) {
-    if (rx.test(pattern)) {
-      return {
-        ok: false,
-        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
-      };
-    }
-  }
-  try {
-    return { ok: true, regex: new RegExp(pattern, flags) };
-  } catch (err) {
-    return {
-      ok: false,
-      reason: err instanceof Error ? err.message : "invalid regex"
-    };
-  }
-}
-
 // src/storage/session-reader.ts
 var DefaultSessionReader = class {
   store;
@@ -4281,7 +5000,7 @@ function isAllowed(type, level) {
   return true;
 }
 function createSessionEventBridge(writer, level = "standard", options = {}) {
-  const normalizedLevel = level ?? "standard";
+  let currentLevel = level ?? "standard";
   const resolveWriter = typeof writer === "function" ? writer : () => writer;
   const progressCounters = /* @__PURE__ */ new Map();
   const toolProgressConfig = options.sampling?.toolProgress ?? {};
@@ -4302,14 +5021,19 @@ function createSessionEventBridge(writer, level = "standard", options = {}) {
     return true;
   }
   return {
-    level: normalizedLevel,
+    get level() {
+      return currentLevel;
+    },
+    setAuditLevel(next) {
+      currentLevel = next ?? "standard";
+    },
     allows(type) {
-      return isAllowed(type, normalizedLevel);
+      return isAllowed(type, currentLevel);
     },
     async append(event) {
       const target = resolveWriter();
       if (!target) return;
-      if (!isAllowed(event.type, normalizedLevel)) return;
+      if (!isAllowed(event.type, currentLevel)) return;
       if (!shouldSample(event)) return;
       try {
         await target.append(event);
@@ -4320,7 +5044,7 @@ function createSessionEventBridge(writer, level = "standard", options = {}) {
       const target = resolveWriter();
       if (!target || events.length === 0) return;
       const allowed = events.filter(
-        (e) => isAllowed(e.type, normalizedLevel) && shouldSample(e)
+        (e) => isAllowed(e.type, currentLevel) && shouldSample(e)
       );
       if (allowed.length === 0) return;
       try {
@@ -4357,7 +5081,7 @@ async function loadTodosCheckpoint(filePath, events, traceId) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp.readFile(filePath, "utf8");
+    raw = await fsp2.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: traceId ?? "~boot~",
@@ -4365,7 +5089,7 @@ async function loadTodosCheckpoint(filePath, events, traceId) {
       filePath,
       operation: "load",
       outcome: "failure",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: true
     });
     return null;
@@ -4437,13 +5161,13 @@ async function saveTodosCheckpoint(filePath, sessionId, todos, events, traceId)
       filePath,
       operation: "save",
       outcome: "failure",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: false
     });
     console.warn(JSON.stringify({
       level: "warn",
       event: "todos_checkpoint.save_failed",
-      message: err instanceof Error ? err.message : String(err),
+      message: toErrorMessage(err),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     }));
   }
@@ -4454,7 +5178,7 @@ function attachTodosCheckpoint(state, filePath, sessionId, events, traceId) {
   let writeChain = Promise.resolve();
   const enqueueWrite = (todos) => {
     writeChain = writeChain.then(() => saveTodosCheckpoint(filePath, sessionId, todos, events, traceId)).catch((err) => {
-      const msg = err instanceof Error ? err.message : String(err);
+      const msg = toErrorMessage(err);
       console.error(JSON.stringify({
         level: "error",
         event: "todos_checkpoint.write_chain_failed",
@@ -4499,14 +5223,14 @@ async function loadPlan(filePath, events) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp.readFile(filePath, "utf8");
+    raw = await fsp2.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: "~boot~",
       store: "plan",
       filePath,
       operation: "load",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: true
     });
     return null;
@@ -4565,12 +5289,12 @@ async function savePlan(filePath, plan, events) {
       store: "plan",
       filePath,
       operation: "save",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: false
     });
     console.warn(
       "[plan-store] save failed:",
-      err instanceof Error ? err.message : String(err)
+      toErrorMessage(err)
     );
   }
 }
@@ -4791,7 +5515,7 @@ init_atomic_write();
 async function loadDirectorState(filePath) {
   let raw;
   try {
-    raw = await fsp.readFile(filePath, "utf8");
+    raw = await fsp2.readFile(filePath, "utf8");
   } catch {
     return null;
   }
@@ -4806,7 +5530,7 @@ async function loadDirectorState(filePath) {
 async function acquireDirectorStateLock(lockPath, processId = process.pid) {
   let existing;
   try {
-    existing = await fsp.readFile(lockPath, "utf8");
+    existing = await fsp2.readFile(lockPath, "utf8");
   } catch {
   }
   if (existing) {
@@ -4830,7 +5554,7 @@ async function acquireDirectorStateLock(lockPath, processId = process.pid) {
 }
 async function releaseDirectorStateLock(lockPath) {
   try {
-    await fsp.unlink(lockPath);
+    await fsp2.unlink(lockPath);
   } catch {
   }
 }
@@ -4955,7 +5679,7 @@ var DirectorStateCheckpoint = class {
     } catch (err) {
       console.warn(
         "[director-state] checkpoint write failed:",
-        err instanceof Error ? err.message : String(err)
+        toErrorMessage(err)
       );
     } finally {
       this.writing = false;
@@ -5165,82 +5889,6 @@ function getDangerousCapabilities(toolOrCaps) {
 
 // src/security/permission-policy.ts
 init_atomic_write();
-
-// src/utils/glob-match.ts
-function escapeRegex(s) {
-  return s.replace(/[.+^${}()|\\]/g, "\\$&");
-}
-var COMPILED_GLOB_CACHE = /* @__PURE__ */ new Map();
-var CACHE_MAX_SIZE = 2e3;
-function getCachedGlob(pattern) {
-  const cached = COMPILED_GLOB_CACHE.get(pattern);
-  if (cached) return cached;
-  if (COMPILED_GLOB_CACHE.size >= CACHE_MAX_SIZE) {
-    const keys = [...COMPILED_GLOB_CACHE.keys()];
-    for (let i = 0; i < Math.floor(CACHE_MAX_SIZE / 4); i++) {
-      COMPILED_GLOB_CACHE.delete(expectDefined(keys[i]));
-    }
-  }
-  const re = compileGlob(pattern);
-  COMPILED_GLOB_CACHE.set(pattern, re);
-  return re;
-}
-var MAX_GLOB_PATTERN_LEN = 1024;
-function compileGlob(pattern) {
-  if (pattern.length > MAX_GLOB_PATTERN_LEN) {
-    throw new Error(`Glob pattern exceeds ${MAX_GLOB_PATTERN_LEN} characters`);
-  }
-  let i = 0;
-  let re = "^";
-  while (i < pattern.length) {
-    const c = pattern[i];
-    if (c === "*") {
-      if (pattern[i + 1] === "*") {
-        re += ".*";
-        i += 2;
-        if (pattern[i] === "/") i++;
-      } else {
-        re += "[^/]*";
-        i++;
-      }
-    } else if (c === "?") {
-      re += "[^/]";
-      i++;
-    } else if (c === "[") {
-      let cls = "[";
-      i++;
-      if (pattern[i] === "!" || pattern[i] === "^") {
-        cls += "^";
-        i++;
-      }
-      while (i < pattern.length && pattern[i] !== "]") {
-        const ch = pattern[i] ?? "";
-        if (ch === "\\") {
-          cls += "\\\\";
-        } else if (ch === "]" || ch === "^") {
-          cls += `\\${ch}`;
-        } else {
-          cls += ch;
-        }
-        i++;
-      }
-      cls += "]";
-      re += cls;
-      i++;
-    } else {
-      re += escapeRegex(c ?? "");
-      i++;
-    }
-  }
-  re += "$";
-  return new RegExp(re);
-}
-function matchGlob(pattern, input) {
-  return getCachedGlob(pattern).test(input);
-}
-function matchAny(patterns, input) {
-  return patterns.some((p) => matchGlob(p, input));
-}
 var DESTRUCTIVE_BASH_PATTERNS = [
   /\bgit\s+(?:clean\s+-[^\s]*[xdf]|reset\s+--hard)\b/i,
   /\b(?:drop|truncate)\s+(?:table|database|schema)\b/i,
@@ -5263,9 +5911,9 @@ function getInputString(input, key) {
 function pathLooksInsideProject(rawPath, projectRoot) {
   if (!projectRoot) return false;
   if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path11.resolve(projectRoot, rawPath);
-  const relative2 = path11.relative(projectRoot, resolved);
-  return !!relative2 && !relative2.startsWith("..") && !path11.isAbsolute(relative2);
+  const resolved = path3.resolve(projectRoot, rawPath);
+  const relative2 = path3.relative(projectRoot, resolved);
+  return !!relative2 && !relative2.startsWith("..") && !path3.isAbsolute(relative2);
 }
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
@@ -5275,7 +5923,7 @@ function pathTokenIsOutsideProject(token, projectRoot) {
   if (token === "/" || token === "~" || token === "." || token === "..") return token !== ".";
   if (token.includes("*")) return true;
   if (token.startsWith("..") || token.includes("../") || token.includes("..\\")) return true;
-  if (path11.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
+  if (path3.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
   return false;
 }
 function hasDangerousDeleteTarget(tokens, start, projectRoot) {
@@ -5421,7 +6069,7 @@ var DefaultPermissionPolicy = class {
   }
   async reload() {
     try {
-      const raw = await fsp.readFile(this.trustFile, "utf8");
+      const raw = await fsp2.readFile(this.trustFile, "utf8");
       const parsed = safeParse(raw);
       if (parsed.ok && parsed.value) this.policy = parsed.value;
     } catch {
@@ -5693,11 +6341,6 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   }
 };
 
-// src/utils/string.ts
-function truncate(s, max) {
-  return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
-}
-
 // src/types/provider.ts
 var ProviderError = class extends WrongStackError {
   status;
@@ -5934,12 +6577,12 @@ var DefaultSkillLoader = class {
     const seen = /* @__PURE__ */ new Set();
     for (const { dir, source } of this.dirs) {
       try {
-        const entries = await fsp.readdir(dir, { withFileTypes: true });
+        const entries = await fsp2.readdir(dir, { withFileTypes: true });
         for (const e of entries) {
           if (!e.isDirectory()) continue;
-          const skillFile = path11.join(dir, e.name, "SKILL.md");
+          const skillFile = path3.join(dir, e.name, "SKILL.md");
           try {
-            const raw = await fsp.readFile(skillFile, "utf8");
+            const raw = await fsp2.readFile(skillFile, "utf8");
             const meta = parseFrontmatter(raw);
             if (!meta.name || !meta.description) continue;
             if (seen.has(meta.name)) continue;
@@ -5982,7 +6625,7 @@ var DefaultSkillLoader = class {
     const entries = [];
     for (const s of skills) {
       try {
-        const raw = await fsp.readFile(s.path, "utf8");
+        const raw = await fsp2.readFile(s.path, "utf8");
         const { trigger, scope } = parseDescription(raw);
         entries.push({ name: s.name, trigger, scope, source: s.source, path: s.path });
       } catch {
@@ -6001,7 +6644,7 @@ var DefaultSkillLoader = class {
     if (cached !== void 0) return cached;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
-    const body = await fsp.readFile(m.path, "utf8");
+    const body = await fsp2.readFile(m.path, "utf8");
     this.bodyCache.set(name, body);
     return body;
   }
@@ -6011,12 +6654,12 @@ var DefaultSkillLoader = class {
     if (cached !== void 0) return cached;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
-    const savePath = path11.join(path11.dirname(m.path), "SKILL.save.md");
+    const savePath = path3.join(path3.dirname(m.path), "SKILL.save.md");
     let result;
     try {
-      result = await fsp.readFile(savePath, "utf8");
+      result = await fsp2.readFile(savePath, "utf8");
     } catch {
-      const full = await fsp.readFile(m.path, "utf8");
+      const full = await fsp2.readFile(m.path, "utf8");
       const body = stripFrontmatter(full);
       const compact = compactSkillBody(body);
       if (compact) {
@@ -6041,139 +6684,45 @@ function parseFrontmatter(raw) {
   let value = [];
   const flush = () => {
     if (key) {
-      out[key] = value.join("\n").trim();
-    }
-    key = null;
-    value = [];
-  };
-  for (const line of block.split("\n")) {
-    const m = /^([a-zA-Z_]+):\s*(\|?)\s*(.*)$/.exec(line);
-    if (m) {
-      flush();
-      key = m[1] ?? "";
-      const pipe = m[2];
-      const rest = m[3] ?? "";
-      if (pipe === "|") {
-        value = [];
-      } else if (rest) {
-        value = [rest];
-      } else {
-        value = [];
-      }
-    } else if (key) {
-      value.push(line.replace(/^\s+/, ""));
-    }
-  }
-  flush();
-  return out;
-}
-function parseDescription(raw) {
-  const fm = parseFrontmatter(raw);
-  const desc = fm.description ?? "";
-  const firstSentenceEnd = desc.indexOf(". ");
-  const trigger = firstSentenceEnd !== -1 ? desc.slice(0, firstSentenceEnd + 1).trim() : desc.trim().split("\n")[0] ?? "";
-  const scope = [];
-  const coversMatch = /(?:covers|for|including)\s+([^.]+)/i.exec(desc);
-  if (coversMatch) {
-    const items = coversMatch[1] ?? "".replace(/[·•]/g, ",").split(",").map((s) => s.trim()).filter(Boolean);
-    scope.push(...items);
-  }
-  return { trigger, scope };
-}
-
-// src/utils/json-repair.ts
-function completePartialObject(s) {
-  if (!s.trim().startsWith("{")) return s;
-  if (tryParse(s).ok) return s;
-  return repairTruncated(s);
-}
-function repairTruncated(s) {
-  const stack = [];
-  let inString = false;
-  let escaped = false;
-  let sawKey = false;
-  let prevSig = "";
-  let contentEnd = 0;
-  let stringBraceDepth = 0;
-  for (let i = 0; i < s.length; i++) {
-    const ch = expectDefined(s[i]);
-    if (inString) {
-      contentEnd = i + 1;
-      if (escaped) {
-        escaped = false;
-        continue;
-      }
-      if (ch === "\\") {
-        escaped = true;
-        continue;
-      }
-      if (ch === '"') {
-        inString = false;
-        prevSig = '"';
-        stringBraceDepth = 0;
-        continue;
-      }
-      if (ch === "{") stringBraceDepth++;
-      else if (ch === "}" && stringBraceDepth > 0) stringBraceDepth--;
-      continue;
-    }
-    if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") continue;
-    contentEnd = i + 1;
-    if (ch === '"') {
-      inString = true;
-      sawKey = true;
-      stringBraceDepth = 0;
-      prevSig = '"';
-    } else if (ch === "{" || ch === "[") {
-      stack.push(ch);
-      prevSig = ch;
-    } else if (ch === "}" || ch === "]") {
-      stack.pop();
-      prevSig = ch;
-    } else {
-      prevSig = ch;
+      out[key] = value.join("\n").trim();
     }
-  }
-  if (!sawKey && !inString) return s;
-  let result = s.slice(0, contentEnd);
-  if (inString) {
-    if (escaped) {
-      result = result.slice(0, -1);
-    } else if (endsWithInvalidEscape(result)) {
-      result = result.slice(0, -2);
+    key = null;
+    value = [];
+  };
+  for (const line of block.split("\n")) {
+    const m = /^([a-zA-Z_]+):\s*(\|?)\s*(.*)$/.exec(line);
+    if (m) {
+      flush();
+      key = m[1] ?? "";
+      const pipe = m[2];
+      const rest = m[3] ?? "";
+      if (pipe === "|") {
+        value = [];
+      } else if (rest) {
+        value = [rest];
+      } else {
+        value = [];
+      }
+    } else if (key) {
+      value.push(line.replace(/^\s+/, ""));
     }
-    if (stringBraceDepth > 0) result += "}".repeat(stringBraceDepth);
-    result += '"';
-  } else if (prevSig === ":") {
-    result += "null";
   }
-  for (let k = stack.length - 1; k >= 0; k--) {
-    result += stack[k] === "{" ? "}" : "]";
-  }
-  if (!tryParse(result).ok) {
-    const patched = result.replace(/:(\s*)([}\]])/g, ":null$2");
-    if (tryParse(patched).ok) result = patched;
-  }
-  return result;
-}
-var VALID_ESCAPE = /* @__PURE__ */ new Set(['"', "\\", "/", "b", "f", "n", "r", "t", "u"]);
-function endsWithInvalidEscape(str) {
-  const last = str[str.length - 1];
-  if (str[str.length - 2] !== "\\" || last === void 0) return false;
-  if (VALID_ESCAPE.has(last)) return false;
-  let backslashes = 0;
-  for (let k = str.length - 2; k >= 0 && str[k] === "\\"; k--) backslashes++;
-  return backslashes % 2 === 1;
+  flush();
+  return out;
 }
-function tryParse(s) {
-  try {
-    return { ok: true, value: JSON.parse(s) };
-  } catch {
-    return { ok: false };
+function parseDescription(raw) {
+  const fm = parseFrontmatter(raw);
+  const desc = fm.description ?? "";
+  const firstSentenceEnd = desc.indexOf(". ");
+  const trigger = firstSentenceEnd !== -1 ? desc.slice(0, firstSentenceEnd + 1).trim() : desc.trim().split("\n")[0] ?? "";
+  const scope = [];
+  const coversMatch = /(?:covers|for|including)\s+([^.]+)/i.exec(desc);
+  if (coversMatch) {
+    const items = (coversMatch[1] ?? "").replace(/[·•]/g, ",").split(",").map((s) => s.trim()).filter(Boolean);
+    scope.push(...items);
   }
+  return { trigger, scope };
 }
-
-// src/core/streaming-response-builder.ts
 var STREAM_DRAIN_TIMEOUT_MS = 500;
 function buildResponse(state) {
   const content = [];
@@ -6469,244 +7018,97 @@ async function runProviderWithRetry(opts) {
       const res = provider.capabilities.streaming ? await streamProviderToResponse(provider, request, signal, ctx, events, logger) : await provider.complete(request, { signal });
       span?.setAttribute("provider.stopReason", res.stopReason);
       span?.setAttribute("provider.usage_in", res.usage.input);
-      span?.setAttribute("provider.usage_out", res.usage.output);
-      span?.end();
-      logger.debug("Provider call succeeded", {
-        ...providerLogCtx(provider, request),
-        stopReason: res.stopReason,
-        usageInput: res.usage.input,
-        usageOutput: res.usage.output,
-        cacheRead: res.usage.cacheRead,
-        cacheWrite: res.usage.cacheWrite,
-        attempts: attempt + 1
-      });
-      return res;
-    } catch (err) {
-      if (err instanceof Error) span?.recordError(err);
-      span?.end();
-      if (signal.aborted) throw err;
-      const isProviderErr = err instanceof ProviderError;
-      const errAsErr = err instanceof Error ? err : new Error(String(err));
-      const canRetry = retry.shouldRetry(isProviderErr ? err : errAsErr, attempt);
-      const description = isProviderErr ? err.describe() : errAsErr.message;
-      if (!canRetry) {
-        if (isProviderErr) {
-          events.emit("provider.error", {
-            providerId: err.providerId,
-            status: err.status,
-            description,
-            retryable: false
-          });
-        }
-        logger.error(`Provider call failed after ${attempt + 1} attempt(s) \u2014 ${description}`, {
-          ...providerLogCtx(provider, request),
-          attempts: attempt + 1,
-          errorDescription: description,
-          status: isProviderErr ? err.status : void 0,
-          errorName: err instanceof Error ? err.name : void 0,
-          errorStack: err instanceof Error ? err.stack?.split("\n").slice(0, 3).join("\n") : void 0
-        });
-        throw toWrongStackError(err);
-      }
-      const delay = Math.round(retry.delayMs(attempt));
-      const attemptNum = attempt + 1;
-      const maxAttempts = retry.maxAttempts(isProviderErr ? err : errAsErr);
-      logger.warn(`Provider retry ${attemptNum}/${maxAttempts} in ${delay}ms \u2014 ${description}`, {
-        ...providerLogCtx(provider, request),
-        attempt: attemptNum,
-        maxAttempts,
-        delayMs: delay,
-        errorDescription: description,
-        status: isProviderErr ? err.status : void 0
-      });
-      if (isProviderErr) {
-        events.emit("provider.retry", {
-          providerId: err.providerId,
-          attempt: attemptNum,
-          delayMs: delay,
-          status: err.status,
-          description
-        });
-      }
-      await new Promise((resolve5, reject) => {
-        let settled = false;
-        const onAbort = () => {
-          if (settled) return;
-          settled = true;
-          clearTimeout(t);
-          reject(new Error("aborted"));
-        };
-        const t = setTimeout(() => {
-          if (settled) return;
-          settled = true;
-          clearTimeout(t);
-          signal.removeEventListener("abort", onAbort);
-          resolve5();
-        }, delay);
-        if (signal.aborted) {
-          onAbort();
-          return;
-        }
-        signal.addEventListener("abort", onAbort, { once: true });
-      });
-      attempt++;
-    }
-  }
-}
-
-// src/execution/provider-runner-impl.ts
-var DefaultProviderRunner = class {
-  async run(opts) {
-    return runProviderWithRetry(opts);
-  }
-};
-
-// src/utils/token-estimate.ts
-var RoughTokenEstimate = (text, charsPerToken = 3.5) => Math.max(1, Math.ceil(text.length / charsPerToken));
-var CALIBRATION_GLOBAL_KEY = "__global__";
-var _cals = /* @__PURE__ */ new Map();
-function calState(key) {
-  let state = _cals.get(key);
-  if (!state) {
-    state = { ratio: 1, count: 0, prevEst: 0 };
-    _cals.set(key, state);
-  }
-  return state;
-}
-var MIN_SAMPLES_FOR_CALIBRATION = 3;
-var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
-var ESTIMATE_CACHE_MAX_SIZE = 1e4;
-function getCachedEstimate(key, compute) {
-  const existing = ESTIMATE_CACHE.get(key);
-  if (existing !== void 0) return existing;
-  if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
-    let evicted = 0;
-    const maxEvict = Math.floor(ESTIMATE_CACHE_MAX_SIZE / 4);
-    for (const k of ESTIMATE_CACHE.keys()) {
-      if (evicted >= maxEvict) break;
-      ESTIMATE_CACHE.delete(k);
-      evicted++;
-    }
-  }
-  const estimate = compute(key);
-  ESTIMATE_CACHE.set(key, estimate);
-  return estimate;
-}
-function estimateToolInputTokens(input) {
-  if (typeof input === "string") return RoughTokenEstimate(input);
-  if (input === null || typeof input !== "object") {
-    return RoughTokenEstimate(String(input));
-  }
-  return getCachedEstimate(JSON.stringify(input), (key) => RoughTokenEstimate(key));
-}
-function estimateToolResultTokens(content) {
-  if (typeof content === "string") return RoughTokenEstimate(content);
-  return getCachedEstimate(JSON.stringify(content), (key) => RoughTokenEstimate(key));
-}
-function estimateTextTokens(text) {
-  return RoughTokenEstimate(text);
-}
-function computeMessageTokens(msg) {
-  if (typeof msg.content === "string") return estimateTextTokens(msg.content);
-  let total = 0;
-  for (const b of msg.content) {
-    if (b.type === "text") total += estimateTextTokens(b.text);
-    else if (b.type === "tool_use") total += estimateToolInputTokens(b.input);
-    else if (b.type === "tool_result") total += estimateToolResultTokens(b.content);
-    else total += RoughTokenEstimate(JSON.stringify(b));
-  }
-  return total;
-}
-function estimateMessageTokens(messages) {
-  let total = 0;
-  for (const m of messages) {
-    if (typeof m._estTokens === "number" && m._estTokens > 0) {
-      total += m._estTokens;
-      continue;
-    }
-    total += computeMessageTokens(m);
-  }
-  return total;
-}
-function estimateToolDefTokens(tool) {
-  const cached = tool._estDefTokens;
-  if (typeof cached === "number" && cached > 0) return cached;
-  return RoughTokenEstimate(tool.name) + RoughTokenEstimate(tool.description ?? "") + RoughTokenEstimate(JSON.stringify(tool.inputSchema));
-}
-function estimateRequestTokens(messages, systemPrompt, tools, calibrationKey = CALIBRATION_GLOBAL_KEY) {
-  let messagesTokens = 0;
-  if (typeof messages === "string") {
-    messagesTokens = RoughTokenEstimate(messages);
-  } else if (Array.isArray(messages)) {
-    for (const m of messages) {
-      if (typeof m === "object" && m !== null && "content" in m) {
-        const cached = m._estTokens;
-        if (typeof cached === "number" && cached > 0) {
-          messagesTokens += cached;
-          continue;
-        }
-        const content = m.content;
-        if (typeof content === "string") {
-          messagesTokens += RoughTokenEstimate(content);
-        } else if (Array.isArray(content)) {
-          for (const b of content) {
-            if (typeof b === "object" && b !== null) {
-              if (b.type === "text") {
-                messagesTokens += RoughTokenEstimate(b.text);
-              } else {
-                messagesTokens += RoughTokenEstimate(JSON.stringify(b));
-              }
-            }
-          }
+      span?.setAttribute("provider.usage_out", res.usage.output);
+      span?.end();
+      logger.debug("Provider call succeeded", {
+        ...providerLogCtx(provider, request),
+        stopReason: res.stopReason,
+        usageInput: res.usage.input,
+        usageOutput: res.usage.output,
+        cacheRead: res.usage.cacheRead,
+        cacheWrite: res.usage.cacheWrite,
+        attempts: attempt + 1
+      });
+      return res;
+    } catch (err) {
+      if (err instanceof Error) span?.recordError(err);
+      span?.end();
+      if (signal.aborted) throw err;
+      const isProviderErr = err instanceof ProviderError;
+      const errAsErr = err instanceof Error ? err : new Error(String(err));
+      const canRetry = retry.shouldRetry(isProviderErr ? err : errAsErr, attempt);
+      const description = isProviderErr ? err.describe() : errAsErr.message;
+      if (!canRetry) {
+        if (isProviderErr) {
+          events.emit("provider.error", {
+            providerId: err.providerId,
+            status: err.status,
+            description,
+            retryable: false
+          });
         }
+        logger.error(`Provider call failed after ${attempt + 1} attempt(s) \u2014 ${description}`, {
+          ...providerLogCtx(provider, request),
+          attempts: attempt + 1,
+          errorDescription: description,
+          status: isProviderErr ? err.status : void 0,
+          errorName: err instanceof Error ? err.name : void 0,
+          errorStack: err instanceof Error ? err.stack?.split("\n").slice(0, 3).join("\n") : void 0
+        });
+        throw toWrongStackError(err);
       }
-    }
-  }
-  let systemTokens = 0;
-  if (typeof systemPrompt === "string") {
-    systemTokens = RoughTokenEstimate(systemPrompt);
-  } else if (Array.isArray(systemPrompt)) {
-    for (const b of systemPrompt) {
-      if (typeof b === "object" && b !== null && b.type === "text") {
-        systemTokens += RoughTokenEstimate(b.text);
+      const delay = Math.round(retry.delayMs(attempt));
+      const attemptNum = attempt + 1;
+      const maxAttempts = retry.maxAttempts(isProviderErr ? err : errAsErr);
+      logger.warn(`Provider retry ${attemptNum}/${maxAttempts} in ${delay}ms \u2014 ${description}`, {
+        ...providerLogCtx(provider, request),
+        attempt: attemptNum,
+        maxAttempts,
+        delayMs: delay,
+        errorDescription: description,
+        status: isProviderErr ? err.status : void 0
+      });
+      if (isProviderErr) {
+        events.emit("provider.retry", {
+          providerId: err.providerId,
+          attempt: attemptNum,
+          delayMs: delay,
+          status: err.status,
+          description
+        });
       }
+      await new Promise((resolve5, reject) => {
+        let settled = false;
+        const onAbort = () => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(t);
+          reject(new Error("aborted"));
+        };
+        const t = setTimeout(() => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(t);
+          signal.removeEventListener("abort", onAbort);
+          resolve5();
+        }, delay);
+        if (signal.aborted) {
+          onAbort();
+          return;
+        }
+        signal.addEventListener("abort", onAbort, { once: true });
+      });
+      attempt++;
     }
   }
-  let toolsTokens = 0;
-  for (const t of tools) {
-    toolsTokens += estimateToolDefTokens(t);
-  }
-  const total = messagesTokens + systemTokens + toolsTokens;
-  calState(calibrationKey).prevEst = total;
-  return {
-    messages: messagesTokens,
-    systemPrompt: systemTokens,
-    tools: toolsTokens,
-    total
-  };
-}
-function getCalibrationState(calibrationKey = CALIBRATION_GLOBAL_KEY) {
-  const cal = calState(calibrationKey);
-  return {
-    ratio: cal.ratio,
-    count: cal.count,
-    calibrated: cal.count >= MIN_SAMPLES_FOR_CALIBRATION
-  };
 }
-function estimateRequestTokensCalibrated(messages, systemPrompt, tools, calibrationKey = CALIBRATION_GLOBAL_KEY) {
-  const result = estimateRequestTokens(messages, systemPrompt, tools, calibrationKey);
-  const cal = calState(calibrationKey);
-  if (cal.count >= MIN_SAMPLES_FOR_CALIBRATION) {
-    const safeRatio = Math.min(1.5, Math.max(0.5, cal.ratio));
-    return {
-      messages: Math.round(result.messages * safeRatio),
-      systemPrompt: Math.round(result.systemPrompt * safeRatio),
-      tools: Math.round(result.tools * safeRatio),
-      total: Math.round(result.total * safeRatio)
-    };
+
+// src/execution/provider-runner-impl.ts
+var DefaultProviderRunner = class {
+  async run(opts) {
+    return runProviderWithRetry(opts);
   }
-  return result;
-}
+};
 
 // src/types/blocks.ts
 function isTextBlock(b) {
@@ -7721,6 +8123,12 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
   hardThreshold;
   /** Writable so model-switch can update the denominator without re-registering the middleware. */
   _maxContext;
+  /**
+   * Runtime on/off gate. The middleware is always installed in the pipeline so
+   * auto-compaction can be toggled live from the TUI `/settings` picker; when
+   * disabled the handler is a pass-through. Defaults to enabled.
+   */
+  _enabled = true;
   aggressiveOn;
   events;
   failureMode;
@@ -7778,8 +8186,19 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
   setMaxContext(maxContext) {
     this._maxContext = maxContext;
   }
+  /** Whether auto-compaction is currently active. */
+  get enabled() {
+    return this._enabled;
+  }
+  /** Toggle auto-compaction on a live session (TUI `/settings`). When disabled
+   *  the middleware passes every iteration straight through without estimating
+   *  tokens or compacting. */
+  setEnabled(enabled) {
+    this._enabled = enabled;
+  }
   handler() {
     return async (ctx, next) => {
+      if (!this._enabled) return next(ctx);
       const msgCount = ctx.messages.length;
       const toolCount = (ctx.tools ?? []).length;
       let tokens;
@@ -7901,163 +8320,25 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         level: pressure.level,
         tokens: pressure.tokens,
         maxContext: this._maxContext,
-        load: pressure.load,
-        fatal
-      });
-      if (fatal) {
-        throw new AgentError({
-          message: `Auto-compaction failed at ${pressure.level} threshold`,
-          code: ERROR_CODES.AGENT_CONTEXT_OVERFLOW,
-          recoverable: true,
-          context: {
-            level: pressure.level,
-            tokens: pressure.tokens,
-            maxContext: this._maxContext
-          },
-          cause: err
-        });
-      }
-    }
-  }
-};
-
-// src/utils/json-schema-validate.ts
-function validateAgainstSchema(value, schema) {
-  const errors = [];
-  walk2(value, schema, "", errors);
-  return { ok: errors.length === 0, errors };
-}
-function walk2(value, schema, path19, errors) {
-  if (schema.enum !== void 0) {
-    if (!schema.enum.some((e) => deepEqual(e, value))) {
-      errors.push({
-        path: path19 || "<root>",
-        message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
-      });
-      return;
-    }
-  }
-  if (typeof schema.type === "string") {
-    if (!checkType(value, schema.type)) {
-      errors.push({
-        path: path19 || "<root>",
-        message: `expected ${schema.type}, got ${describeType(value)}`
-      });
-      return;
-    }
-  }
-  if (schema.type === "object" && isPlainObject(value)) {
-    const obj = value;
-    for (const req of schema.required ?? []) {
-      if (!(req in obj)) {
-        errors.push({ path: joinPath(path19, req), message: "required property missing" });
-      }
-    }
-    if (schema.properties) {
-      for (const [key, subSchema] of Object.entries(schema.properties)) {
-        if (key in obj) {
-          walk2(obj[key], subSchema, joinPath(path19, key), errors);
-        }
-      }
-    }
-  }
-  if (schema.type === "array" && Array.isArray(value) && schema.items) {
-    value.forEach((item, i) => walk2(item, schema.items, `${path19}[${i}]`, errors));
-  }
-}
-function checkType(value, type) {
-  switch (type) {
-    case "string":
-      return typeof value === "string";
-    case "number":
-      return typeof value === "number" && !Number.isNaN(value);
-    case "integer":
-      return typeof value === "number" && Number.isInteger(value);
-    case "boolean":
-      return typeof value === "boolean";
-    case "null":
-      return value === null;
-    case "array":
-      return Array.isArray(value);
-    case "object":
-      return isPlainObject(value);
-    default:
-      return true;
-  }
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function describeType(v) {
-  if (v === null) return "null";
-  if (Array.isArray(v)) return "array";
-  return typeof v;
-}
-function joinPath(parent, key) {
-  if (!parent) return key;
-  return `${parent}.${key}`;
-}
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (typeof a !== typeof b) return false;
-  if (a === null || b === null) return a === b;
-  if (Array.isArray(a) && Array.isArray(b)) {
-    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
-  }
-  if (typeof a === "object" && typeof b === "object") {
-    const ak = Object.keys(a);
-    const bk = Object.keys(b);
-    if (ak.length !== bk.length) return false;
-    return ak.every(
-      (k) => deepEqual(a[k], b[k])
-    );
-  }
-  return false;
-}
-
-// src/utils/tool-output-serializer.ts
-function createToolOutputSerializer(opts = {}) {
-  const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
-  function serialize(value) {
-    if (typeof value === "string") return value;
-    if (value === null || value === void 0) return "";
-    if (typeof value === "object") {
-      if (Array.isArray(value)) return value.map(serialize).join("\n");
-      if ("text" in value) {
-        const t = value.text;
-        return typeof t === "string" ? t : JSON.stringify(value, null, 2);
-      }
-      try {
-        return JSON.stringify(value, null, 2);
-      } catch {
-        return String(value);
+        load: pressure.load,
+        fatal
+      });
+      if (fatal) {
+        throw new AgentError({
+          message: `Auto-compaction failed at ${pressure.level} threshold`,
+          code: ERROR_CODES.AGENT_CONTEXT_OVERFLOW,
+          recoverable: true,
+          context: {
+            level: pressure.level,
+            tokens: pressure.tokens,
+            maxContext: this._maxContext
+          },
+          cause: err
+        });
       }
     }
-    return String(value);
-  }
-  function enforceCap(text, remainingBudget) {
-    if (remainingBudget <= 0) {
-      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
-    }
-    const textBytes = Buffer.byteLength(text, "utf8");
-    if (textBytes <= remainingBudget) {
-      return { text, newBudget: remainingBudget - textBytes };
-    }
-    const marker = `
-\u2026[truncated ${textBytes - remainingBudget} bytes]\u2026
-`;
-    const markerBytes = Buffer.byteLength(marker, "utf8");
-    const available = remainingBudget - markerBytes;
-    if (available <= 0) {
-      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
-    }
-    const half = Math.floor(available / 2);
-    const first = text.slice(0, half);
-    const second = text.slice(text.length - half);
-    return { text: `${first}${marker}${second}`, newBudget: 0 };
   }
-  return { serialize, enforceCap, capBytes };
-}
+};
 
 // src/execution/tool-executor.ts
 var ToolExecutor = class _ToolExecutor {
@@ -8222,7 +8503,7 @@ ${post.additionalContext}`;
         );
         return { result, tool, durationMs: Date.now() - start };
       } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
+        const msg = toErrorMessage(err);
         const scrubbed = this.opts.secretScrubber.scrub(msg);
         this.opts.renderer?.writeToolResult(tool.name, scrubbed, true);
         const result = {
@@ -8243,7 +8524,7 @@ ${post.additionalContext}`;
       try {
         return await runOne(use);
       } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
+        const msg = toErrorMessage(err);
         const scrubbed = this.opts.secretScrubber.scrub(msg);
         const result = {
           type: "tool_result",
@@ -8526,15 +8807,6 @@ function extractMalformedRaw(input) {
   }
 }
 
-// src/utils/assert-never.ts
-function assertNever(x, message) {
-  const err = new Error(
-    `Unhandled case: ${JSON.stringify(x)}`
-  );
-  err.name = "AssertNeverError";
-  throw err;
-}
-
 // src/execution/autonomous-runner.ts
 var DoneConditionChecker = class {
   constructor(condition) {
@@ -8714,64 +8986,6 @@ var AutonomousRunner = class {
 
 // src/storage/goal-store.ts
 init_atomic_write();
-function projectHash(absRoot) {
-  return createHash("sha256").update(path11.resolve(absRoot)).digest("hex").slice(0, 12);
-}
-function projectSlug(absRoot) {
-  const base = slugify(path11.basename(absRoot));
-  const hash = createHash("sha256").update(path11.resolve(absRoot)).digest("hex").slice(0, 6);
-  return `${base}-${hash}`;
-}
-function slugify(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
-}
-function wstackGlobalRoot() {
-  const fromEnv = process.env["WRONGSTACK_HOME"];
-  if (fromEnv && fromEnv.trim().length > 0) return path11.resolve(fromEnv);
-  return path11.join(os.homedir(), ".wrongstack");
-}
-function resolveWstackPaths(opts) {
-  const globalRoot = opts.globalRoot ?? (opts.userHome ? path11.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
-  const hash = projectHash(opts.projectRoot);
-  const slug = projectSlug(opts.projectRoot);
-  const projectDir = path11.join(globalRoot, "projects", slug);
-  return {
-    globalRoot,
-    configDir: globalRoot,
-    globalConfig: path11.join(globalRoot, "config.json"),
-    secretsKey: path11.join(globalRoot, ".key"),
-    globalMemory: path11.join(globalRoot, "memory.md"),
-    globalSkills: path11.join(globalRoot, "skills"),
-    globalPrompts: path11.join(globalRoot, "prompts"),
-    cacheDir: path11.join(globalRoot, "cache"),
-    modelsCache: path11.join(globalRoot, "cache", "models.dev.json"),
-    modelsOverlayCache: path11.join(globalRoot, "cache", "models-overlay.json"),
-    historyFile: path11.join(globalRoot, "history"),
-    logFile: path11.join(globalRoot, "logs", "wrongstack.log"),
-    projectDir,
-    projectCodebaseIndex: path11.join(projectDir, "codebase-index"),
-    projectMemory: path11.join(projectDir, "memory.md"),
-    projectSessions: path11.join(projectDir, "sessions"),
-    projectTrust: path11.join(projectDir, "trust.json"),
-    projectMeta: path11.join(projectDir, "meta.json"),
-    projectLocalConfig: path11.join(projectDir, "config.local.json"),
-    inProjectConfig: path11.join(opts.projectRoot, ".wrongstack", "config.json"),
-    inProjectAgentsFile: path11.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
-    inProjectSkills: path11.join(opts.projectRoot, ".wrongstack", "skills"),
-    inProjectWorktrees: path11.join(opts.projectRoot, ".wrongstack", "worktrees"),
-    projectHash: hash,
-    projectSlug: slug,
-    projectGoal: path11.join(projectDir, "goal.json"),
-    projectSpecs: path11.join(projectDir, "specs"),
-    projectTaskGraphs: path11.join(projectDir, "task-graphs"),
-    projectSddSession: path11.join(projectDir, "sdd-session.json"),
-    projectPlan: path11.join(projectDir, "plan.json"),
-    projectAutophase: path11.join(projectDir, "autophase"),
-    syncConfig: path11.join(globalRoot, "sync.json")
-  };
-}
-
-// src/storage/goal-store.ts
 var MAX_JOURNAL_ENTRIES = 500;
 function goalFilePath(projectRoot) {
   return resolveWstackPaths({ projectRoot }).projectGoal;
@@ -8780,7 +8994,7 @@ async function loadGoal(filePath, events) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp.readFile(filePath, "utf8");
+    raw = await fsp2.readFile(filePath, "utf8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -8799,7 +9013,7 @@ async function loadGoal(filePath, events) {
       store: "goal",
       filePath,
       operation: "load",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: false
     });
     throw err;
@@ -8872,11 +9086,11 @@ async function saveGoal(filePath, goal, events) {
       store: "goal",
       filePath,
       operation: "save",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: false
     });
     throw new FsError({
-      message: err instanceof Error ? err.message : String(err),
+      message: toErrorMessage(err),
       code: ERROR_CODES.FS_ATOMIC_WRITE_FAILED,
       path: filePath,
       cause: err
@@ -8930,11 +9144,6 @@ function computeTrend(history) {
   return "steady";
 }
 
-// src/utils/sleep.ts
-function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
-}
-
 // src/execution/autonomy-brain.ts
 function formatDecisionSummary(decision, request) {
   const question = request.question.length > 80 ? request.question.slice(0, 77) + "\u2026" : request.question;
@@ -8985,7 +9194,7 @@ var EternalAutonomyEngine = class {
       console.error(JSON.stringify({
         level: "error",
         event: "engine.persist_state_failed",
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         context: { expectedState: "stopped" },
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
@@ -9018,7 +9227,7 @@ var EternalAutonomyEngine = class {
         } catch (err) {
           this.consecutiveFailures++;
           this.opts.onError?.(err instanceof Error ? err : new Error(String(err)), this.consecutiveFailures);
-          await this.appendFailure("engine error", err instanceof Error ? err.message : String(err));
+          await this.appendFailure("engine error", toErrorMessage(err));
         }
         if (iterationOk) {
           this.consecutiveFailures = 0;
@@ -9119,7 +9328,7 @@ var EternalAutonomyEngine = class {
     } catch (err) {
       const isAbort = err instanceof Error && (err.name === "AbortError" || err.message.includes("abort"));
       status = isAbort ? "aborted" : "failure";
-      note = err instanceof Error ? err.message : String(err);
+      note = toErrorMessage(err);
       if (!isAbort && typeof err?.recoverable === "boolean") {
         isTransientFailure = err.recoverable;
       }
@@ -12916,7 +13125,7 @@ function classifySubagentError(err, hints = {}) {
     const baseMessage2 = err.describe();
     return providerErrorToSubagentError(err, baseMessage2, cause);
   }
-  const baseMessage = err instanceof Error ? err.message : String(err);
+  const baseMessage = toErrorMessage(err);
   if (err instanceof BudgetExceededError) {
     const map = {
       iterations: "budget_iterations",
@@ -14111,7 +14320,7 @@ var ParallelEternalEngine = class {
       console.error(JSON.stringify({
         level: "error",
         event: "engine.persist_state_failed",
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         context: { expectedState: "stopped" },
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
@@ -14147,7 +14356,7 @@ var ParallelEternalEngine = class {
           );
           await this.appendFailure(
             "engine error",
-            err instanceof Error ? err.message : String(err)
+            toErrorMessage(err)
           );
         }
         if (this.stopRequested) break;
@@ -14794,123 +15003,6 @@ function createMessage(type, from, payload, to) {
     priority: "normal"
   };
 }
-var GLOB_CHARS = /* @__PURE__ */ new Set(["*", "?", "["]);
-var IS_WINDOWS = process.platform === "win32";
-var SEP = IS_WINDOWS ? "\\" : "/";
-function isGlob(p) {
-  for (const c of p) {
-    if (GLOB_CHARS.has(c)) return true;
-  }
-  return false;
-}
-function globToRegex(pat) {
-  let i = 0;
-  let re = "^";
-  while (i < pat.length) {
-    const c = expectDefined(pat[i]);
-    if (c === "*") {
-      if (pat[i + 1] === "*") {
-        re += ".*";
-        i += 2;
-        if (pat[i] === "/") i++;
-      } else {
-        re += "[^/\\\\]*";
-        i++;
-      }
-    } else if (c === "?") {
-      re += "[^/\\\\]";
-      i++;
-    } else if (c === "[") {
-      let cls = "[";
-      i++;
-      if (pat[i] === "!" || pat[i] === "^") {
-        cls += "^";
-        i++;
-      }
-      while (i < pat.length && pat[i] !== "]") {
-        const ch = pat[i] ?? "";
-        if (ch === "\\") cls += "\\\\";
-        else if (ch === "]" || ch === "^") cls += `\\${ch}`;
-        else cls += ch;
-        i++;
-      }
-      cls += "]";
-      re += cls;
-      i++;
-    } else {
-      re += c.replace(/[.+^${}()|\\]/g, "\\$&");
-      i++;
-    }
-  }
-  return new RegExp(re + "$");
-}
-function baseDir(pat) {
-  let i = pat.length - 1;
-  while (i >= 0 && !GLOB_CHARS.has(expectDefined(pat[i])) && pat[i] !== SEP && pat[i] !== "/") i--;
-  const cut = i >= 0 ? pat.lastIndexOf(SEP, i) : pat.lastIndexOf("/", i);
-  return cut < 0 ? "." : pat.slice(0, cut);
-}
-async function expandGlob(pattern) {
-  if (!isGlob(pattern)) return [pattern];
-  const results = /* @__PURE__ */ new Set();
-  const abs = isAbsolute(pattern);
-  const base = abs ? baseDir(pattern) : baseDir(pattern);
-  const relPat = base === "." ? pattern : pattern.slice(base.length + 1);
-  async function walk3(dir, pat) {
-    let entries;
-    try {
-      entries = await fsp.readdir(dir);
-    } catch {
-      return;
-    }
-    const firstGlob = pat.search(/[*?[[]/);
-    if (firstGlob < 0) {
-      const re = globToRegex(pat);
-      for (const e of entries) {
-        if (re.test(e)) {
-          const full = `${dir}${SEP}${e}`;
-          results.add(abs ? resolve(full) : full);
-        }
-      }
-      return;
-    }
-    const before = pat.slice(0, firstGlob);
-    const rest = pat.slice(firstGlob);
-    if (before.endsWith("**")) {
-      await walk3(dir, rest);
-      for (const e of entries) {
-        const full = `${dir}${SEP}${e}`;
-        try {
-          const stat6 = await fsp.stat(full);
-          if (stat6.isDirectory()) await walk3(full, rest);
-        } catch {
-        }
-      }
-    } else if (before === "") {
-      const re = globToRegex(rest);
-      for (const e of entries) {
-        if (re.test(e)) {
-          const full = `${dir}${SEP}${e}`;
-          results.add(abs ? resolve(full) : full);
-        }
-      }
-    } else {
-      const seg = before.replace(/[*?[\]]/g, "").replace(/\/$/, "");
-      if (entries.includes(seg)) {
-        const full = `${dir}${SEP}${seg}`;
-        try {
-          const stat6 = await fsp.stat(full);
-          if (stat6.isDirectory()) await walk3(full, rest);
-        } catch {
-        }
-      }
-    }
-  }
-  await walk3(base === "." ? "." : base, relPat);
-  return [...results];
-}
-
-// src/coordination/collab-debug.ts
 var DEFAULT_MAX_TARGET_FILES = 30;
 var CollabSession = class extends EventEmitter {
   sessionId;
@@ -15000,8 +15092,8 @@ var CollabSession = class extends EventEmitter {
     for (const filePath of allFiles) {
       try {
         const [content, stat6] = await Promise.all([
-          fsp.readFile(filePath, "utf8"),
-          fsp.stat(filePath)
+          fsp2.readFile(filePath, "utf8"),
+          fsp2.stat(filePath)
         ]);
         const ext = filePath.split(".").pop() ?? "";
         const language = ext === "ts" || ext === "tsx" ? "typescript" : ext === "js" || ext === "jsx" ? "javascript" : ext === "md" ? "markdown" : ext === "json" ? "json" : void 0;
@@ -15423,7 +15515,7 @@ Emit each evaluation immediately. Do not wait until you have read all reports.`;
     for (const file of this.snapshot.files) {
       if (file.snapshotMtimeMs === void 0 && file.snapshotSizeBytes === void 0) continue;
       try {
-        const stat6 = await fsp.stat(file.path);
+        const stat6 = await fsp2.stat(file.path);
         const mtimeChanged = file.snapshotMtimeMs !== void 0 && stat6.mtimeMs > file.snapshotMtimeMs + 1;
         const sizeChanged = file.snapshotSizeBytes !== void 0 && stat6.size !== file.snapshotSizeBytes;
         if (mtimeChanged || sizeChanged) {
@@ -15706,7 +15798,7 @@ function makeSpawnTool(director, roster) {
         if (err instanceof FleetCostCapError) {
           return { error: err.message, kind: err.kind, limit: err.limit, observed: err.observed };
         }
-        return { error: err instanceof Error ? err.message : String(err) };
+        return { error: toErrorMessage(err) };
       }
     }
   };
@@ -15788,7 +15880,7 @@ function makeAskTool(director) {
           _hint: "Response was large and stored. Use ask_result with the key to retrieve it."
         };
       } catch (err) {
-        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+        return { ok: false, error: toErrorMessage(err) };
       }
     }
   };
@@ -16014,7 +16106,7 @@ function makeCollabDebugTool(director) {
           evaluations: report.evaluations
         };
       } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
+        const msg = toErrorMessage(err);
         return { error: "collab_debug failed: " + msg };
       }
     }
@@ -16588,7 +16680,7 @@ var Director = class _Director {
     ) : null;
     this.fleetManager = opts.fleetManager;
     if (this.sharedScratchpadPath) {
-      void fsp.mkdir(this.sharedScratchpadPath, { recursive: true }).catch((err) => this.logShutdownError("shared_scratchpad_mkdir", err));
+      void fsp2.mkdir(this.sharedScratchpadPath, { recursive: true }).catch((err) => this.logShutdownError("shared_scratchpad_mkdir", err));
     }
     this.transport = new InMemoryBridgeTransport();
     this.bridge = new InMemoryAgentBridge(
@@ -17180,7 +17272,7 @@ var Director = class _Director {
       })),
       usage: this.usage.snapshot()
     };
-    await fsp.mkdir(path11.dirname(this.manifestPath), { recursive: true });
+    await fsp2.mkdir(path3.dirname(this.manifestPath), { recursive: true });
     await atomicWrite(this.manifestPath, JSON.stringify(manifest, null, 2), { mode: 384 });
     return this.manifestPath;
   }
@@ -17230,7 +17322,7 @@ var Director = class _Director {
    * listener for structured collection, and never affects exit code.
    */
   logShutdownError(phase, err) {
-    const detail = err instanceof Error ? err.message : String(err);
+    const detail = toErrorMessage(err);
     process.emitWarning(
       `Director shutdown phase "${phase}" failed: ${detail}`,
       "DirectorShutdownWarning"
@@ -17394,10 +17486,10 @@ var Director = class _Director {
    */
   async readSession(subagentId, tail) {
     if (!this.sessionsRoot) return null;
-    const filePath = path11.join(this.sessionsRoot, this.directorRunId, `${subagentId}.jsonl`);
+    const filePath = path3.join(this.sessionsRoot, this.directorRunId, `${subagentId}.jsonl`);
     let raw;
     try {
-      raw = await fsp.readFile(filePath, "utf8");
+      raw = await fsp2.readFile(filePath, "utf8");
     } catch {
       return null;
     }
@@ -17823,7 +17915,7 @@ function createDelegateTool(opts) {
           summary
         };
       } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
+        const message = toErrorMessage(err);
         opts.events?.emit("delegate.completed", {
           target,
           task: i.task,
@@ -17924,13 +18016,13 @@ async function readSubagentPartial(opts, subagentId) {
   if (!opts.sessionsRoot) return void 0;
   const candidates = [];
   if (opts.directorRunId) {
-    candidates.push(path11.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
+    candidates.push(path3.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
   } else {
     try {
-      const entries = await fsp.readdir(opts.sessionsRoot, { withFileTypes: true });
+      const entries = await fsp2.readdir(opts.sessionsRoot, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
-          candidates.push(path11.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
+          candidates.push(path3.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
         }
       }
     } catch {
@@ -17940,7 +18032,7 @@ async function readSubagentPartial(opts, subagentId) {
   for (const file of candidates) {
     let raw;
     try {
-      raw = await fsp.readFile(file, "utf8");
+      raw = await fsp2.readFile(file, "utf8");
     } catch {
       continue;
     }
@@ -17980,9 +18072,9 @@ function makeDirectorSessionFactory(opts) {
   let dir;
   if (opts.store) {
     store = opts.store;
-    dir = opts.sessionsRoot ? path11.join(opts.sessionsRoot, runId) : "(caller-managed)";
+    dir = opts.sessionsRoot ? path3.join(opts.sessionsRoot, runId) : "(caller-managed)";
   } else if (opts.sessionsRoot) {
-    dir = path11.join(opts.sessionsRoot, runId);
+    dir = path3.join(opts.sessionsRoot, runId);
     store = new DefaultSessionStore({ dir });
   } else {
     throw new Error("makeDirectorSessionFactory requires either `store` or `sessionsRoot`");
@@ -18072,71 +18164,6 @@ var NULL_FLEET_BUS = new FleetBus();
 
 // src/models/models-registry.ts
 init_atomic_write();
-
-// src/utils/merge-models-payload.ts
-function mergeModelsPayload(base, overlay) {
-  const out = {};
-  for (const [id, provider] of Object.entries(base)) {
-    out[id] = cloneProvider(provider);
-  }
-  for (const [id, ovProvider] of Object.entries(overlay)) {
-    const existing = out[id];
-    out[id] = existing ? mergeProvider(existing, ovProvider) : cloneProvider(ovProvider);
-  }
-  return out;
-}
-function mergeProvider(base, overlay) {
-  const models = {};
-  for (const [mid, m] of Object.entries(base.models ?? {})) {
-    models[mid] = { ...m };
-  }
-  for (const [mid, ovModel] of Object.entries(overlay.models ?? {})) {
-    const existing = models[mid];
-    models[mid] = existing ? mergeModel(existing, ovModel) : { ...ovModel };
-  }
-  return {
-    ...base,
-    // Overlay scalar fields win when explicitly provided; otherwise keep base.
-    ...stripUndefined({
-      id: overlay.id,
-      name: overlay.name,
-      npm: overlay.npm,
-      api: overlay.api,
-      env: overlay.env,
-      doc: overlay.doc
-    }),
-    models
-  };
-}
-function mergeModel(base, overlay) {
-  const merged = { ...base, ...overlay };
-  if (base.limit || overlay.limit) {
-    merged.limit = { ...base.limit, ...overlay.limit };
-  }
-  if (base.cost || overlay.cost) {
-    merged.cost = { ...base.cost, ...overlay.cost };
-  }
-  if (base.modalities || overlay.modalities) {
-    merged.modalities = { ...base.modalities, ...overlay.modalities };
-  }
-  return merged;
-}
-function cloneProvider(p) {
-  const models = {};
-  for (const [mid, m] of Object.entries(p.models ?? {})) {
-    models[mid] = { ...m };
-  }
-  return { ...p, models };
-}
-function stripUndefined(obj) {
-  const out = {};
-  for (const [k, v] of Object.entries(obj)) {
-    if (v !== void 0) out[k] = v;
-  }
-  return out;
-}
-
-// src/models/models-registry.ts
 var DEFAULT_URL = "https://models.dev/api.json";
 var DEFAULT_TTL_SECONDS = 24 * 3600;
 var DEFAULT_REFRESH_TIMEOUT_MS = 15e3;
@@ -18193,7 +18220,7 @@ var DefaultModelsRegistry = class {
     this.overlay = opts.overlay;
     this.overlayUrl = opts.overlayUrl;
     this.overlayFile = opts.overlayFile;
-    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path11.join(path11.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
+    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path3.join(path3.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
   }
   async load(opts = {}) {
     if (this.payload && !opts.force) return this.payload;
@@ -18232,7 +18259,7 @@ var DefaultModelsRegistry = class {
       }
       if (overlayAvailable) {
         console.warn(
-          `ModelsRegistry: models.dev unavailable (${err instanceof Error ? err.message : String(err)}); serving curated overlay only.`
+          `ModelsRegistry: models.dev unavailable (${toErrorMessage(err)}); serving curated overlay only.`
         );
         return {};
       }
@@ -18320,7 +18347,7 @@ var DefaultModelsRegistry = class {
   async readOverlayFile() {
     if (!this.overlayFile) return void 0;
     try {
-      const raw = await fsp.readFile(this.overlayFile, "utf8");
+      const raw = await fsp2.readFile(this.overlayFile, "utf8");
       return JSON.parse(raw);
     } catch {
       return void 0;
@@ -18398,7 +18425,7 @@ var DefaultModelsRegistry = class {
   }
   async readCacheAt(file) {
     try {
-      const raw = await fsp.readFile(file, "utf8");
+      const raw = await fsp2.readFile(file, "utf8");
       return JSON.parse(raw);
     } catch {
       return void 0;
@@ -18406,7 +18433,7 @@ var DefaultModelsRegistry = class {
   }
   /** Used by `wstack models refresh` to expose where the cache lives. */
   cacheLocation() {
-    return path11.resolve(this.cacheFile);
+    return path3.resolve(this.cacheFile);
   }
 };
 function hasEntries(payload) {
@@ -18773,8 +18800,8 @@ var DefaultModeStore = class {
   }
   async loadActiveMode() {
     try {
-      const configPath = path11.join(this.configDir, "mode.json");
-      const content = await fsp.readFile(configPath, "utf8");
+      const configPath = path3.join(this.configDir, "mode.json");
+      const content = await fsp2.readFile(configPath, "utf8");
       const data = JSON.parse(content);
       this.activeModeId = data.activeMode ?? null;
     } catch {
@@ -18783,8 +18810,8 @@ var DefaultModeStore = class {
   }
   async saveActiveMode() {
     try {
-      await fsp.mkdir(this.configDir, { recursive: true });
-      const configPath = path11.join(this.configDir, "mode.json");
+      await fsp2.mkdir(this.configDir, { recursive: true });
+      const configPath = path3.join(this.configDir, "mode.json");
       await atomicWrite(
         configPath,
         JSON.stringify({ activeMode: this.activeModeId }, null, 2)
@@ -18796,14 +18823,14 @@ var DefaultModeStore = class {
 async function loadProjectModes(modesDir) {
   const modes = [];
   try {
-    const entries = await fsp.readdir(modesDir);
+    const entries = await fsp2.readdir(modesDir);
     for (const entry of entries) {
       if (!entry.endsWith(".md") && !entry.endsWith(".txt")) continue;
-      const filePath = path11.join(modesDir, entry);
-      const stat6 = await fsp.stat(filePath);
+      const filePath = path3.join(modesDir, entry);
+      const stat6 = await fsp2.stat(filePath);
       if (!stat6.isFile()) continue;
-      const content = await fsp.readFile(filePath, "utf8");
-      const id = path11.basename(entry, path11.extname(entry));
+      const content = await fsp2.readFile(filePath, "utf8");
+      const id = path3.basename(entry, path3.extname(entry));
       modes.push({
         id,
         name: id.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()),
@@ -18819,8 +18846,8 @@ async function loadProjectModes(modesDir) {
 async function loadUserModes(modesDir) {
   const modes = [];
   try {
-    const manifestPath = path11.join(modesDir, "modes.json");
-    const content = await fsp.readFile(manifestPath, "utf8");
+    const manifestPath = path3.join(modesDir, "modes.json");
+    const content = await fsp2.readFile(manifestPath, "utf8");
     const manifest = JSON.parse(content);
     for (const mode of manifest.modes) {
       modes.push(mode);
@@ -19546,7 +19573,7 @@ var TaskTracker = class {
       this.opts.onPersistError ? this.opts.onPersistError(err) : console.warn(JSON.stringify({
         level: "warn",
         event: "task_tracker.save_graph_failed",
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
     });
@@ -19771,7 +19798,7 @@ var SpecStore = class {
   indexPath;
   constructor(opts) {
     this.baseDir = opts.baseDir;
-    this.indexPath = path11.join(this.baseDir, "_index.json");
+    this.indexPath = path3.join(this.baseDir, "_index.json");
   }
   async save(spec) {
     await ensureDir(this.baseDir);
@@ -19781,7 +19808,7 @@ var SpecStore = class {
   }
   async load(id) {
     try {
-      const raw = await fsp.readFile(this.filePath(id), "utf8");
+      const raw = await fsp2.readFile(this.filePath(id), "utf8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -19793,7 +19820,7 @@ var SpecStore = class {
   }
   async delete(id) {
     try {
-      await fsp.unlink(this.filePath(id));
+      await fsp2.unlink(this.filePath(id));
       await this.removeFromIndex(id);
       return true;
     } catch {
@@ -19802,7 +19829,7 @@ var SpecStore = class {
   }
   async exists(id) {
     try {
-      await fsp.access(this.filePath(id));
+      await fsp2.access(this.filePath(id));
       return true;
     } catch {
       return false;
@@ -19840,11 +19867,11 @@ var SpecStore = class {
     return updated;
   }
   filePath(id) {
-    return path11.join(this.baseDir, `${id}.json`);
+    return path3.join(this.baseDir, `${id}.json`);
   }
   async readIndex() {
     try {
-      const raw = await fsp.readFile(this.indexPath, "utf8");
+      const raw = await fsp2.readFile(this.indexPath, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed?.version === 1) return parsed;
     } catch {
@@ -19897,7 +19924,7 @@ var TaskGraphStore = class {
   indexPath;
   constructor(opts) {
     this.baseDir = opts.baseDir;
-    this.indexPath = path11.join(this.baseDir, "_index.json");
+    this.indexPath = path3.join(this.baseDir, "_index.json");
   }
   async save(graph) {
     await ensureDir(this.baseDir);
@@ -19907,7 +19934,7 @@ var TaskGraphStore = class {
   }
   async load(id) {
     try {
-      const raw = await fsp.readFile(this.filePath(id), "utf8");
+      const raw = await fsp2.readFile(this.filePath(id), "utf8");
       return graphFromJSON(raw);
     } catch {
       return null;
@@ -19919,7 +19946,7 @@ var TaskGraphStore = class {
   }
   async delete(id) {
     try {
-      await fsp.unlink(this.filePath(id));
+      await fsp2.unlink(this.filePath(id));
       await this.removeFromIndex(id);
       return true;
     } catch {
@@ -19928,18 +19955,18 @@ var TaskGraphStore = class {
   }
   async exists(id) {
     try {
-      await fsp.access(this.filePath(id));
+      await fsp2.access(this.filePath(id));
       return true;
     } catch {
       return false;
     }
   }
   filePath(id) {
-    return path11.join(this.baseDir, `${id}.json`);
+    return path3.join(this.baseDir, `${id}.json`);
   }
   async readIndex() {
     try {
-      const raw = await fsp.readFile(this.indexPath, "utf8");
+      const raw = await fsp2.readFile(this.indexPath, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed?.version === 1) return parsed;
     } catch {
@@ -20216,7 +20243,7 @@ var AISpecBuilder = class {
    *  ENOSPC / EACCES doesn't silently strand session edits in memory. */
   autoSave() {
     this.saveSession().catch((err) => {
-      const detail = err instanceof Error ? err.message : String(err);
+      const detail = toErrorMessage(err);
       process.emitWarning(
         `SpecBuilder autoSave failed: ${detail}`,
         "SpecBuilderWarning"
@@ -21535,7 +21562,7 @@ var SddParallelRun = class {
     const failCount = results.length - successCount;
     for (let i = 0; i < results.length; i++) {
       const result = expectDefined(results[i]);
-      const taskId = expectDefined(taskIds[i]);
+      const taskId = expectDefined(tasks[i]).id;
       if (result.status === "success") {
         this.opts.tracker.updateNodeStatus(taskId, "completed");
         this.retryMap.delete(taskId);
@@ -21749,7 +21776,7 @@ var DefaultHealthRegistry = class {
     try {
       return await Promise.race([check.check(), timeout]);
     } catch (err) {
-      return { status: "unhealthy", detail: err instanceof Error ? err.message : String(err) };
+      return { status: "unhealthy", detail: toErrorMessage(err) };
     } finally {
       if (timer) clearTimeout(timer);
     }
@@ -21942,7 +21969,7 @@ async function startMetricsServer(opts) {
       } catch (err) {
         res.statusCode = 500;
         res.setHeader("content-type", "text/plain; charset=utf-8");
-        res.end(`metrics render failed: ${err instanceof Error ? err.message : String(err)}`);
+        res.end(`metrics render failed: ${toErrorMessage(err)}`);
         return;
       }
       res.statusCode = 200;
@@ -21960,7 +21987,7 @@ async function startMetricsServer(opts) {
         (err) => {
           res.statusCode = 500;
           res.setHeader("content-type", "text/plain; charset=utf-8");
-          res.end(`health run failed: ${err instanceof Error ? err.message : String(err)}`);
+          res.end(`health run failed: ${toErrorMessage(err)}`);
         }
       );
       return;