@wrongstack/core 0.260.0 → 0.265.1

package/dist/types/index.js

@@ -1,7 +1,7 @@
 import { randomBytes, createCipheriv, createDecipheriv, randomUUID } from 'crypto';
-import * as fs2 from 'fs';
 import * as fs from 'fs/promises';
 import * as path4 from 'path';
+import * as fs2 from 'fs';
 import * as os from 'os';
 
 // src/types/blocks.ts
@@ -20,14 +20,654 @@ function isImageBlock(b) {
 function isThinkingBlock(b) {
   return b.type === "thinking";
 }
-
-// src/types/messages.ts
-function asBlocks(content) {
-  return typeof content === "string" ? [{ type: "text", text: content }] : content;
+
+// src/types/messages.ts
+function asBlocks(content) {
+  return typeof content === "string" ? [{ type: "text", text: content }] : content;
+}
+function asText(content) {
+  if (typeof content === "string") return content;
+  return content.filter((b) => b.type === "text").map((b) => b.text).join("");
+}
+async function atomicWrite(targetPath, content, opts = {}) {
+  const dir = path4.dirname(targetPath);
+  await fs.mkdir(dir, { recursive: true });
+  const tmp = path4.join(dir, `.${path4.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  try {
+    if (typeof content === "string") {
+      await fs.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
+    } else {
+      await fs.writeFile(tmp, content, { flag: "wx" });
+    }
+    try {
+      const fh = await fs.open(tmp, "r+");
+      try {
+        await fh.sync();
+      } finally {
+        await fh.close();
+      }
+    } catch {
+    }
+    let mode;
+    try {
+      const stat2 = await fs.stat(targetPath);
+      mode = stat2.mode & 511;
+    } catch {
+      mode = opts.mode;
+    }
+    if (mode !== void 0) {
+      await fs.chmod(tmp, mode);
+    }
+    await renameWithRetry(tmp, targetPath);
+  } catch (err) {
+    try {
+      await fs.unlink(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+var TRANSIENT_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES", "ENOTEMPTY"]);
+async function renameWithRetry(from, to) {
+  if (process.platform !== "win32") {
+    await fs.rename(from, to);
+    return;
+  }
+  const delays = [10, 25, 60, 120, 250];
+  let lastErr;
+  for (let i = 0; i <= delays.length; i++) {
+    try {
+      await fs.rename(from, to);
+      return;
+    } catch (err) {
+      lastErr = err;
+      const code = err?.code;
+      if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
+        throw err;
+      }
+      await new Promise((resolve4) => setTimeout(resolve4, delays[i]));
+    }
+  }
+  throw lastErr;
+}
+
+// src/utils/error.ts
+function toErrorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// src/utils/term.ts
+var hasStdout = () => typeof process !== "undefined" && !!process.stdout;
+function isStdoutTTY() {
+  return hasStdout() && Boolean(process.stdout.isTTY);
+}
+function writeTo(s, stream) {
+  if (!stream || typeof stream.write !== "function") return false;
+  {
+    stream.write(s);
+    return true;
+  }
+}
+function writeErr(s, stream = process.stderr) {
+  return writeTo(s, stream);
+}
+
+// src/utils/color.ts
+var isColorTty = () => {
+  if (envFlag(process.env.NO_COLOR)) return false;
+  if (envFlag(process.env.FORCE_COLOR)) return true;
+  return isStdoutTTY();
+};
+function envFlag(value) {
+  if (value === void 0) return false;
+  if (value.trim() === "") return false;
+  return !/^(0|false|no|off)$/i.test(value.trim());
+}
+var COLOR = isColorTty();
+var wrap = (open2, close) => (s) => COLOR ? `\x1B[${open2}m${s}\x1B[${close}m` : s;
+var color = {
+  reset: wrap("0", "0"),
+  bold: wrap("1", "22"),
+  dim: wrap("2", "22"),
+  italic: wrap("3", "23"),
+  underline: wrap("4", "24"),
+  red: wrap("31", "39"),
+  green: wrap("32", "39"),
+  yellow: wrap("33", "39"),
+  blue: wrap("34", "39"),
+  magenta: wrap("35", "39"),
+  cyan: wrap("36", "39"),
+  gray: wrap("90", "39"),
+  amber: wrap("38;5;214", "39"),
+  pink: wrap("38;5;205", "39"),
+  bgRed: wrap("41", "49"),
+  bgGreen: wrap("42", "49")
+};
+
+// src/utils/string.ts
+function truncate(s, max) {
+  return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
+}
+
+// src/utils/expect-defined.ts
+function expectDefined(value, label) {
+  if (value === null || value === void 0) {
+    const err = new Error("Expected value to be defined");
+    err.name = "ExpectDefinedError";
+    throw err;
+  }
+  return value;
+}
+
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+function isPrimitiveArray(a) {
+  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
+}
+function deepMerge(base, patch, options = {}) {
+  const {
+    conflictResolution = "prefer-patch",
+    arrayMode = "replace",
+    protectProto = true,
+    onNonPrimitiveArrayReplace
+  } = options;
+  if (typeof base !== "object" || base === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (typeof patch !== "object" || patch === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
+      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+    }
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) || Array.isArray(patch)) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  const baseObj = base;
+  const patchObj = patch;
+  const out = { ...baseObj };
+  for (const [k, v] of Object.entries(patchObj)) {
+    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v, options);
+    } else if (Array.isArray(v) && Array.isArray(existing)) {
+      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
+        onNonPrimitiveArrayReplace(k, existing.length, v.length);
+      }
+      out[k] = deepMerge(existing, v, options);
+    } else if (v !== void 0) {
+      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
+        const existingLen = Array.isArray(existing) ? existing.length : 0;
+        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+      }
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
+// src/utils/tool-output-serializer.ts
+function createToolOutputSerializer(opts = {}) {
+  const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
+  function serialize(value) {
+    if (typeof value === "string") return value;
+    if (value === null || value === void 0) return "";
+    if (typeof value === "object") {
+      if (Array.isArray(value)) return value.map(serialize).join("\n");
+      if ("text" in value) {
+        const t = value.text;
+        return typeof t === "string" ? t : JSON.stringify(value, null, 2);
+      }
+      try {
+        return JSON.stringify(value, null, 2);
+      } catch {
+        return String(value);
+      }
+    }
+    return String(value);
+  }
+  function enforceCap(text, remainingBudget) {
+    if (remainingBudget <= 0) {
+      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
+    }
+    const textBytes = Buffer.byteLength(text, "utf8");
+    if (textBytes <= remainingBudget) {
+      return { text, newBudget: remainingBudget - textBytes };
+    }
+    const marker = `
+\u2026[truncated ${textBytes - remainingBudget} bytes]\u2026
+`;
+    const markerBytes = Buffer.byteLength(marker, "utf8");
+    const available = remainingBudget - markerBytes;
+    if (available <= 0) {
+      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
+    }
+    const half = Math.floor(available / 2);
+    const first = text.slice(0, half);
+    const second = text.slice(text.length - half);
+    return { text: `${first}${marker}${second}`, newBudget: 0 };
+  }
+  return { serialize, enforceCap, capBytes };
+}
+
+// src/utils/token-estimate.ts
+var RoughTokenEstimate = (text, charsPerToken = 3.5) => Math.max(1, Math.ceil(text.length / charsPerToken));
+var CALIBRATION_GLOBAL_KEY = "__global__";
+var _cals = /* @__PURE__ */ new Map();
+function calState(key) {
+  let state = _cals.get(key);
+  if (!state) {
+    state = { ratio: 1, count: 0, prevEst: 0 };
+    _cals.set(key, state);
+  }
+  return state;
+}
+var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
+var ESTIMATE_CACHE_MAX_SIZE = 1e4;
+function getCachedEstimate(key, compute) {
+  const existing = ESTIMATE_CACHE.get(key);
+  if (existing !== void 0) return existing;
+  if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
+    for (const k of ESTIMATE_CACHE.keys()) {
+      if (ESTIMATE_CACHE.size <= Math.floor(ESTIMATE_CACHE_MAX_SIZE / 2)) break;
+      ESTIMATE_CACHE.delete(k);
+    }
+  }
+  const estimate = compute(key);
+  ESTIMATE_CACHE.set(key, estimate);
+  return estimate;
+}
+function estimateToolInputTokens(input) {
+  if (typeof input === "string") return RoughTokenEstimate(input);
+  if (input === null || typeof input !== "object") {
+    return RoughTokenEstimate(String(input));
+  }
+  return getCachedEstimate(JSON.stringify(input), (key) => RoughTokenEstimate(key));
+}
+function estimateToolResultTokens(content) {
+  if (typeof content === "string") return RoughTokenEstimate(content);
+  return getCachedEstimate(JSON.stringify(content), (key) => RoughTokenEstimate(key));
+}
+function estimateTextTokens(text) {
+  return RoughTokenEstimate(text);
+}
+function computeMessageTokens(msg) {
+  if (typeof msg.content === "string") return estimateTextTokens(msg.content);
+  let total = 0;
+  for (const b of msg.content) {
+    if (b.type === "text") total += estimateTextTokens(b.text);
+    else if (b.type === "tool_use") total += estimateToolInputTokens(b.input);
+    else if (b.type === "tool_result") total += estimateToolResultTokens(b.content);
+    else total += RoughTokenEstimate(JSON.stringify(b));
+  }
+  return total;
+}
+function estimateMessageTokens(messages) {
+  let total = 0;
+  for (const m of messages) {
+    if (typeof m._estTokens === "number" && m._estTokens > 0) {
+      total += m._estTokens;
+      continue;
+    }
+    total += computeMessageTokens(m);
+  }
+  return total;
+}
+function estimateToolDefTokens(tool) {
+  const cached = tool._estDefTokens;
+  if (typeof cached === "number" && cached > 0) return cached;
+  return RoughTokenEstimate(tool.name) + RoughTokenEstimate(tool.description ?? "") + RoughTokenEstimate(JSON.stringify(tool.inputSchema));
+}
+function estimateRequestTokens(messages, systemPrompt, tools, calibrationKey = CALIBRATION_GLOBAL_KEY) {
+  let messagesTokens = 0;
+  if (typeof messages === "string") {
+    messagesTokens = RoughTokenEstimate(messages);
+  } else if (Array.isArray(messages)) {
+    for (const m of messages) {
+      if (typeof m === "object" && m !== null && "content" in m) {
+        const cached = m._estTokens;
+        if (typeof cached === "number" && cached > 0) {
+          messagesTokens += cached;
+          continue;
+        }
+        const content = m.content;
+        if (typeof content === "string") {
+          messagesTokens += RoughTokenEstimate(content);
+        } else if (Array.isArray(content)) {
+          for (const b of content) {
+            if (typeof b === "object" && b !== null) {
+              if (b.type === "text") {
+                messagesTokens += RoughTokenEstimate(b.text);
+              } else {
+                messagesTokens += RoughTokenEstimate(JSON.stringify(b));
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  let systemTokens = 0;
+  if (typeof systemPrompt === "string") {
+    systemTokens = RoughTokenEstimate(systemPrompt);
+  } else if (Array.isArray(systemPrompt)) {
+    for (const b of systemPrompt) {
+      if (typeof b === "object" && b !== null && b.type === "text") {
+        systemTokens += RoughTokenEstimate(b.text);
+      }
+    }
+  }
+  let toolsTokens = 0;
+  for (const t of tools) {
+    toolsTokens += estimateToolDefTokens(t);
+  }
+  const total = messagesTokens + systemTokens + toolsTokens;
+  calState(calibrationKey).prevEst = total;
+  return {
+    messages: messagesTokens,
+    systemPrompt: systemTokens,
+    tools: toolsTokens,
+    total
+  };
+}
+
+// src/utils/message-invariants.ts
+function repairToolUseAdjacency(messages) {
+  const removedToolUses = [];
+  const removedToolResults = [];
+  let removedMessages = 0;
+  let changed = false;
+  const out = [];
+  for (let i = 0; i < messages.length; i++) {
+    const original = expectDefined(messages[i]);
+    let msg = original;
+    if (hasToolUse(msg)) {
+      const nextIds = toolResultIds(messages[i + 1]);
+      const filtered = mapContent(msg, (blocks) => {
+        const next = [];
+        for (const block of blocks) {
+          if (block.type === "tool_use" && !nextIds.has(block.id)) {
+            removedToolUses.push(block.id);
+            changed = true;
+            continue;
+          }
+          next.push(block);
+        }
+        return next;
+      });
+      msg = filtered ?? msg;
+    }
+    if (hasToolResult(msg)) {
+      const allowed = toolUseIds(out[out.length - 1]);
+      const filtered = mapContent(msg, (blocks) => {
+        const next = [];
+        for (const block of blocks) {
+          if (block.type === "tool_result" && !allowed.has(block.tool_use_id)) {
+            removedToolResults.push(block.tool_use_id);
+            changed = true;
+            continue;
+          }
+          next.push(block);
+        }
+        return next;
+      });
+      msg = filtered ?? msg;
+    }
+    if (isEmptyMessage(msg)) {
+      removedMessages++;
+      changed = true;
+      continue;
+    }
+    out.push(msg);
+  }
+  return {
+    messages: changed ? out : messages,
+    report: { changed, removedToolUses, removedToolResults, removedMessages }
+  };
+}
+function hasToolUse(msg) {
+  return contentBlocks(msg).some((b) => b.type === "tool_use");
+}
+function hasToolResult(msg) {
+  return contentBlocks(msg).some((b) => b.type === "tool_result");
+}
+function toolUseIds(msg) {
+  const ids = /* @__PURE__ */ new Set();
+  if (!msg || msg.role !== "assistant") return ids;
+  for (const block of contentBlocks(msg)) {
+    if (block.type === "tool_use") ids.add(block.id);
+  }
+  return ids;
+}
+function toolResultIds(msg) {
+  const ids = /* @__PURE__ */ new Set();
+  if (!msg || msg.role !== "user") return ids;
+  for (const block of contentBlocks(msg)) {
+    if (block.type === "tool_result") ids.add(block.tool_use_id);
+  }
+  return ids;
+}
+function contentBlocks(msg) {
+  return msg && Array.isArray(msg.content) ? msg.content : [];
+}
+function mapContent(msg, fn) {
+  if (!Array.isArray(msg.content)) return msg;
+  const next = fn(msg.content);
+  if (next.length === msg.content.length && next.every((b, idx) => b === msg.content[idx])) {
+    return msg;
+  }
+  return { ...msg, content: next };
+}
+function isEmptyMessage(msg) {
+  if (typeof msg.content === "string") return msg.content.trim().length === 0;
+  return msg.content.length === 0;
+}
+
+// src/utils/json-schema-validate.ts
+function validateAgainstSchema(value, schema) {
+  const errors = [];
+  walk(value, schema, "", errors);
+  return { ok: errors.length === 0, errors };
+}
+function walk(value, schema, path7, errors) {
+  if (schema.enum !== void 0) {
+    if (!schema.enum.some((e) => deepEqual(e, value))) {
+      errors.push({
+        path: path7 || "<root>",
+        message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
+      });
+      return;
+    }
+  }
+  if (typeof schema.type === "string") {
+    if (!checkType(value, schema.type)) {
+      errors.push({
+        path: path7 || "<root>",
+        message: `expected ${schema.type}, got ${describeType(value)}`
+      });
+      return;
+    }
+  }
+  if (schema.type === "object" && isPlainObject(value)) {
+    const obj = value;
+    for (const req of schema.required ?? []) {
+      if (!(req in obj)) {
+        errors.push({ path: joinPath(path7, req), message: "required property missing" });
+      }
+    }
+    if (schema.properties) {
+      for (const [key, subSchema] of Object.entries(schema.properties)) {
+        if (key in obj) {
+          walk(obj[key], subSchema, joinPath(path7, key), errors);
+        }
+      }
+    }
+  }
+  if (schema.type === "array" && Array.isArray(value) && schema.items) {
+    for (let i = 0; i < value.length; i++) {
+      walk(value[i], schema.items, `${path7}[${i}]`, errors);
+    }
+  }
+}
+function checkType(value, type) {
+  switch (type) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number" && !Number.isNaN(value);
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "boolean":
+      return typeof value === "boolean";
+    case "null":
+      return value === null;
+    case "array":
+      return Array.isArray(value);
+    case "object":
+      return isPlainObject(value);
+    default:
+      return true;
+  }
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function describeType(v) {
+  if (v === null) return "null";
+  if (Array.isArray(v)) return "array";
+  return typeof v;
+}
+function joinPath(parent, key) {
+  if (!parent) return key;
+  return `${parent}.${key}`;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b) return false;
+  if (a === null || b === null) return a === b;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
+  }
+  if (typeof a === "object" && typeof b === "object") {
+    const ak = Object.keys(a);
+    const bk = Object.keys(b);
+    if (ak.length !== bk.length) return false;
+    return ak.every(
+      (k) => deepEqual(a[k], b[k])
+    );
+  }
+  return false;
+}
+
+// src/utils/regex-guard.ts
+var MAX_PATTERN_LEN = 512;
+var DANGEROUS_PATTERNS = [
+  /(\([^)]*[+*][^)]*\))[+*]/,
+  // (a+)+, (.*)+, etc
+  /(\(\?:[^)]*[+*][^)]*\))[+*]/
+  // same, with non-capturing group
+];
+function compileUserRegex(pattern, flags) {
+  if (typeof pattern !== "string") {
+    return { ok: false, reason: "pattern must be a string" };
+  }
+  if (pattern.length === 0) {
+    return { ok: false, reason: "pattern is empty" };
+  }
+  if (pattern.length > MAX_PATTERN_LEN) {
+    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
+  }
+  for (const rx of DANGEROUS_PATTERNS) {
+    if (rx.test(pattern)) {
+      return {
+        ok: false,
+        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
+      };
+    }
+  }
+  try {
+    return { ok: true, regex: new RegExp(pattern, flags) };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: err instanceof Error ? err.message : "invalid regex"
+    };
+  }
+}
+
+// src/utils/merge-models-payload.ts
+function mergeModelsPayload(base, overlay) {
+  const out = {};
+  for (const [id, provider] of Object.entries(base)) {
+    out[id] = cloneProvider(provider);
+  }
+  for (const [id, ovProvider] of Object.entries(overlay)) {
+    const existing = out[id];
+    out[id] = existing ? mergeProvider(existing, ovProvider) : cloneProvider(ovProvider);
+  }
+  return out;
+}
+function mergeProvider(base, overlay) {
+  const models = {};
+  for (const [mid, m] of Object.entries(base.models ?? {})) {
+    models[mid] = { ...m };
+  }
+  for (const [mid, ovModel] of Object.entries(overlay.models ?? {})) {
+    const existing = models[mid];
+    models[mid] = existing ? mergeModel(existing, ovModel) : { ...ovModel };
+  }
+  return {
+    ...base,
+    // Overlay scalar fields win when explicitly provided; otherwise keep base.
+    ...stripUndefined({
+      id: overlay.id,
+      name: overlay.name,
+      npm: overlay.npm,
+      api: overlay.api,
+      env: overlay.env,
+      doc: overlay.doc
+    }),
+    models
+  };
+}
+function mergeModel(base, overlay) {
+  const merged = { ...base, ...overlay };
+  if (base.limit || overlay.limit) {
+    merged.limit = { ...base.limit, ...overlay.limit };
+  }
+  if (base.cost || overlay.cost) {
+    merged.cost = { ...base.cost, ...overlay.cost };
+  }
+  if (base.modalities || overlay.modalities) {
+    merged.modalities = { ...base.modalities, ...overlay.modalities };
+  }
+  return merged;
+}
+function cloneProvider(p) {
+  const models = {};
+  for (const [mid, m] of Object.entries(p.models ?? {})) {
+    models[mid] = { ...m };
+  }
+  return { ...p, models };
 }
-function asText(content) {
-  if (typeof content === "string") return content;
-  return content.filter((b) => b.type === "text").map((b) => b.text).join("");
+function stripUndefined(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
 }
 
 // src/types/errors.ts
@@ -175,7 +815,7 @@ var AgentError = class extends WrongStackError {
 };
 function toWrongStackError(err, code = ERROR_CODES.AGENT_RUN_FAILED) {
   if (err instanceof WrongStackError) return err;
-  const message = err instanceof Error ? err.message : String(err);
+  const message = toErrorMessage(err);
   return new AgentError({
     message,
     code: code === "UNKNOWN" ? ERROR_CODES.AGENT_RUN_FAILED : code,
@@ -253,11 +893,6 @@ function isSddError(err) {
   return err instanceof SddError;
 }
 
-// src/utils/string.ts
-function truncate(s, max) {
-  return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
-}
-
 // src/types/provider.ts
 var ProviderError = class extends WrongStackError {
   status;
@@ -360,6 +995,20 @@ function providerStatusToCode(status, type) {
   return ERROR_CODES.PROVIDER_INVALID_REQUEST;
 }
 
+// src/types/config.ts
+function normalizeTokenSavingTier(val) {
+  if (val === void 0) return "off";
+  if (typeof val === "boolean") return val ? "medium" : "off";
+  const validTiers = /* @__PURE__ */ new Set([
+    "off",
+    "minimal",
+    "light",
+    "medium",
+    "aggressive"
+  ]);
+  return validTiers.has(val) ? val : "off";
+}
+
 // src/types/default-config.ts
 var DEFAULT_TOOLS_CONFIG = Object.freeze({
   defaultExecutionStrategy: "smart",
@@ -367,7 +1016,8 @@ var DEFAULT_TOOLS_CONFIG = Object.freeze({
   iterationTimeoutMs: 3e5,
   sessionTimeoutMs: 18e5,
   perIterationOutputCapBytes: 1e5,
-  autoExtendLimit: true
+  autoExtendLimit: true,
+  restrictToProjectRoot: false
 });
 var DEFAULT_CONTEXT_CONFIG = Object.freeze({
   preserveK: 10,
@@ -376,6 +1026,10 @@ var DEFAULT_CONTEXT_CONFIG = Object.freeze({
 var DEFAULT_AUTONOMY_CONFIG = Object.freeze({
   autoProceedDelayMs: 45e3
 });
+var DEFAULT_CIRCUIT_BREAKER_CONFIG = Object.freeze({
+  enabled: false,
+  autoKillResetMs: 6e4
+});
 var DEFAULT_SESSION_LOGGING_CONFIG = Object.freeze({
   auditLevel: "standard",
   sampling: {
@@ -387,126 +1041,9 @@ var DEFAULT_SESSION_LOGGING_CONFIG = Object.freeze({
 var DEFAULT_SESSION_PRUNE_DAYS = 30;
 
 // src/types/secret-vault.ts
-var ENCRYPTED_PREFIX = "enc:v1:";
-async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path4.dirname(targetPath);
-  await fs.mkdir(dir, { recursive: true });
-  const tmp = path4.join(dir, `.${path4.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
-  try {
-    if (typeof content === "string") {
-      await fs.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
-    } else {
-      await fs.writeFile(tmp, content, { flag: "wx" });
-    }
-    try {
-      const fh = await fs.open(tmp, "r+");
-      try {
-        await fh.sync();
-      } finally {
-        await fh.close();
-      }
-    } catch {
-    }
-    let mode;
-    try {
-      const stat2 = await fs.stat(targetPath);
-      mode = stat2.mode & 511;
-    } catch {
-      mode = opts.mode;
-    }
-    if (mode !== void 0) {
-      await fs.chmod(tmp, mode);
-    }
-    await renameWithRetry(tmp, targetPath);
-  } catch (err) {
-    try {
-      await fs.unlink(tmp);
-    } catch {
-    }
-    throw err;
-  }
-}
-var TRANSIENT_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES", "ENOTEMPTY"]);
-async function renameWithRetry(from, to) {
-  if (process.platform !== "win32") {
-    await fs.rename(from, to);
-    return;
-  }
-  const delays = [10, 25, 60, 120, 250];
-  let lastErr;
-  for (let i = 0; i <= delays.length; i++) {
-    try {
-      await fs.rename(from, to);
-      return;
-    } catch (err) {
-      lastErr = err;
-      const code = err?.code;
-      if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
-        throw err;
-      }
-      await new Promise((resolve4) => setTimeout(resolve4, delays[i]));
-    }
-  }
-  throw lastErr;
-}
-
-// src/utils/deep-merge.ts
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function isPrimitiveArray(a) {
-  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
-}
-function deepMerge(base, patch, options = {}) {
-  const {
-    conflictResolution = "prefer-patch",
-    arrayMode = "replace",
-    protectProto = true,
-    onNonPrimitiveArrayReplace
-  } = options;
-  if (typeof base !== "object" || base === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (typeof patch !== "object" || patch === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) && Array.isArray(patch)) {
-    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
-      return [.../* @__PURE__ */ new Set([...base, ...patch])];
-    }
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) || Array.isArray(patch)) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  const baseObj = base;
-  const patchObj = patch;
-  const out = { ...baseObj };
-  for (const [k, v] of Object.entries(patchObj)) {
-    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v, options);
-    } else if (Array.isArray(v) && Array.isArray(existing)) {
-      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
-        onNonPrimitiveArrayReplace(k, existing.length, v.length);
-      }
-      out[k] = deepMerge(existing, v, options);
-    } else if (v !== void 0) {
-      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
-        const existingLen = Array.isArray(existing) ? existing.length : 0;
-        onNonPrimitiveArrayReplace(k, existingLen, v.length);
-      }
-      out[k] = v;
-    }
-  }
-  return out;
+var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
+function encryptedPrefixForVersion(version) {
+  return `enc:v${version}:`;
 }
 
 // src/security/secret-vault.ts
@@ -515,6 +1052,8 @@ var IV_BYTES = 12;
 var TAG_BYTES = 16;
 var ALGO = "aes-256-gcm";
 var KEY_FILE_MODE = 384;
+var KEY_FILE_MAGIC = Buffer.from("WSKV", "ascii");
+var VERSIONED_KEY_FILE_SIZE = KEY_FILE_MAGIC.length + 1 + KEY_BYTES;
 function checkKeyFilePermissions(keyFile) {
   if (process.platform === "win32") return;
   try {
@@ -537,11 +1076,17 @@ function checkKeyFilePermissions(keyFile) {
 var DefaultSecretVault = class {
   keyFile;
   key;
+  _keyVersion = 1;
   constructor(opts) {
     this.keyFile = opts.keyFile;
   }
+  /** Current key version. Starts at 1; incremented by rotateKey(). */
+  get keyVersion() {
+    if (!this.key) this.loadOrCreateKey();
+    return this._keyVersion;
+  }
   isEncrypted(value) {
-    return typeof value === "string" && value.startsWith(ENCRYPTED_PREFIX);
+    return typeof value === "string" && ENCRYPTED_PREFIX_PATTERN.test(value);
   }
   encrypt(plaintext) {
     if (this.isEncrypted(plaintext)) return plaintext;
@@ -550,11 +1095,20 @@ var DefaultSecretVault = class {
     const cipher = createCipheriv(ALGO, key, iv);
     const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
     const tag = cipher.getAuthTag();
-    return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
+    const prefix = encryptedPrefixForVersion(this._keyVersion);
+    return `${prefix}${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
   }
   decrypt(value) {
     if (!this.isEncrypted(value)) return value;
-    const rest = value.slice(ENCRYPTED_PREFIX.length);
+    const prefixMatch = value.match(ENCRYPTED_PREFIX_PATTERN);
+    if (!prefixMatch) {
+      throw new ConfigError({
+        message: "SecretVault: malformed encrypted value",
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { field: "encrypted_value" }
+      });
+    }
+    const rest = value.slice(prefixMatch[0].length);
     const parts = rest.split(":");
     if (parts.length !== 3) {
       throw new ConfigError({
@@ -583,20 +1137,64 @@ var DefaultSecretVault = class {
     const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
     return pt.toString("utf8");
   }
+  /**
+   * Generate a new encryption key, write it to disk, and increment the key version.
+   * After rotation, encrypt() emits the new version prefix (e.g. enc:v2:).
+   * The caller must re-encrypt existing config values (see rotateConfigKeys()).
+   */
+  rotateKey() {
+    const oldVersion = this._keyVersion;
+    const newKey = randomBytes(KEY_BYTES);
+    const newVersion = oldVersion + 1;
+    const keyFileBuf = Buffer.alloc(VERSIONED_KEY_FILE_SIZE);
+    KEY_FILE_MAGIC.copy(keyFileBuf, 0);
+    keyFileBuf[KEY_FILE_MAGIC.length] = newVersion;
+    newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
+    fs2.mkdirSync(path4.dirname(this.keyFile), { recursive: true });
+    fs2.writeFileSync(this.keyFile, keyFileBuf, { mode: 384 });
+    checkKeyFilePermissions(this.keyFile);
+    this.key = newKey;
+    this._keyVersion = newVersion;
+    return { oldVersion, newVersion };
+  }
   loadOrCreateKey() {
     if (this.key) return this.key;
     try {
       const buf = fs2.readFileSync(this.keyFile);
-      if (buf.length !== KEY_BYTES) {
-        throw new ConfigError({
-          message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES}). Remove it manually to generate a new key.`,
-          code: ERROR_CODES.CONFIG_INVALID,
-          context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
-        });
+      if (buf.length === KEY_BYTES) {
+        this.key = buf;
+        this._keyVersion = 1;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
       }
-      this.key = buf;
-      checkKeyFilePermissions(this.keyFile);
-      return this.key;
+      if (buf.length === VERSIONED_KEY_FILE_SIZE) {
+        const magic = buf.subarray(0, KEY_FILE_MAGIC.length);
+        if (!magic.equals(KEY_FILE_MAGIC)) {
+          throw new ConfigError({
+            message: `SecretVault: key file ${this.keyFile} has invalid magic header`,
+            code: ERROR_CODES.CONFIG_INVALID,
+            context: { keyFile: this.keyFile }
+          });
+        }
+        const version = buf[KEY_FILE_MAGIC.length];
+        const key2 = buf.subarray(KEY_FILE_MAGIC.length + 1);
+        if (key2.length !== KEY_BYTES) {
+          throw new ConfigError({
+            message: `SecretVault: key file ${this.keyFile} has wrong key size (${key2.length} bytes, expected ${KEY_BYTES})`,
+            code: ERROR_CODES.CONFIG_INVALID,
+            context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: key2.length }
+          });
+        }
+        this.key = Buffer.from(key2);
+        this._keyVersion = version;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
+      }
+      throw new ConfigError({
+        message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES} for v1 or ${VERSIONED_KEY_FILE_SIZE} for v2+). Remove it manually to generate a new key.`,
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
+      });
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
@@ -607,24 +1205,42 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
       const buf = fs2.readFileSync(this.keyFile);
-      if (buf.length !== KEY_BYTES) {
-        throw new ConfigError({
-          message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES}). Remove it manually to generate a new key.`,
-          code: ERROR_CODES.CONFIG_INVALID,
-          context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
-        });
+      if (buf.length === KEY_BYTES) {
+        this.key = buf;
+        this._keyVersion = 1;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
       }
-      this.key = buf;
-      checkKeyFilePermissions(this.keyFile);
-      return this.key;
+      if (buf.length === VERSIONED_KEY_FILE_SIZE) {
+        const magic = buf.subarray(0, KEY_FILE_MAGIC.length);
+        if (!magic.equals(KEY_FILE_MAGIC)) {
+          throw new ConfigError({
+            message: `SecretVault: key file ${this.keyFile} has invalid magic header`,
+            code: ERROR_CODES.CONFIG_INVALID,
+            context: { keyFile: this.keyFile }
+          });
+        }
+        const version = buf[KEY_FILE_MAGIC.length];
+        const winnerKey = buf.subarray(KEY_FILE_MAGIC.length + 1);
+        this.key = Buffer.from(winnerKey);
+        this._keyVersion = version;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
+      }
+      throw new ConfigError({
+        message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES} for v1 or ${VERSIONED_KEY_FILE_SIZE} for v2+). Remove it manually to generate a new key.`,
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
+      });
     }
     this.key = key;
+    this._keyVersion = 1;
     return key;
   }
 };
 function decryptConfigSecrets(cfg, vault, opts) {
   const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  return walk(cfg, vault, (v, key) => {
+  return walk2(cfg, vault, (v, key) => {
     try {
       return vault.decrypt(v);
     } catch (err) {
@@ -636,20 +1252,20 @@ function decryptConfigSecrets(cfg, vault, opts) {
   });
 }
 function encryptConfigSecrets(cfg, vault, _opts) {
-  return walk(cfg, vault, (v) => vault.encrypt(v));
+  return walk2(cfg, vault, (v) => vault.encrypt(v));
 }
-function walk(node, vault, transform) {
+function walk2(node, vault, transform) {
   if (node === null || node === void 0) return node;
   if (typeof node !== "object") return node;
   if (Array.isArray(node)) {
-    return node.map((item) => walk(item, vault, transform));
+    return node.map((item) => walk2(item, vault, transform));
   }
   const out = /* @__PURE__ */ Object.create(null);
   for (const [k, v] of Object.entries(node)) {
     if (typeof v === "string" && isSecretField(k)) {
       out[k] = transform(v, k);
     } else if (typeof v === "object" && v !== null) {
-      out[k] = walk(v, vault, transform);
+      out[k] = walk2(v, vault, transform);
     } else {
       out[k] = v;
     }
@@ -699,6 +1315,80 @@ async function migratePlaintextSecrets(configPath, vault, logger) {
   );
   return { migrated: counter.n, file: configPath };
 }
+async function rotateConfigKeys(configPath, vault, logger) {
+  const log = logger?.info ?? (() => {
+  });
+  const warn = logger?.warn ?? ((msg) => console.warn(msg));
+  let raw;
+  try {
+    raw = await fs.readFile(configPath, "utf8");
+  } catch {
+    const { oldVersion: oldVersion2, newVersion: newVersion2 } = vault.rotateKey();
+    log(`[secret-vault] Key rotated (v${oldVersion2} \u2192 v${newVersion2}) \u2014 no config file to re-encrypt`);
+    return { rotated: 0, oldVersion: oldVersion2, newVersion: newVersion2, file: configPath };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    warn(`[secret-vault] Config file ${configPath} is not valid JSON \u2014 skipping rotation`);
+    return { rotated: 0, oldVersion: vault.keyVersion, newVersion: vault.keyVersion, file: configPath };
+  }
+  const counter = { n: 0 };
+  const decrypted = walkDecryptCount(parsed, vault, counter);
+  if (counter.n === 0) {
+    const { oldVersion: oldVersion2, newVersion: newVersion2 } = vault.rotateKey();
+    log(`[secret-vault] Key rotated (v${oldVersion2} \u2192 v${newVersion2}) \u2014 no encrypted fields to re-encrypt`);
+    return { rotated: 0, oldVersion: oldVersion2, newVersion: newVersion2, file: configPath };
+  }
+  const { oldVersion, newVersion } = vault.rotateKey();
+  const reencrypted = walkReencrypt(decrypted, vault);
+  await atomicWrite(configPath, JSON.stringify(reencrypted, null, 2), { mode: 384 });
+  await restrictFilePermissions(configPath, { warn });
+  log(`[secret-vault] Key rotated (v${oldVersion} \u2192 v${newVersion}) \u2014 re-encrypted ${counter.n} field(s)`);
+  return { rotated: counter.n, oldVersion, newVersion, file: configPath };
+}
+function walkDecryptCount(node, vault, counter) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walkDecryptCount(item, vault, counter));
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && vault.isEncrypted(v)) {
+      try {
+        out[k] = vault.decrypt(v);
+        counter.n++;
+      } catch {
+        out[k] = v;
+      }
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walkDecryptCount(v, vault, counter);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+function walkReencrypt(node, vault) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walkReencrypt(item, vault));
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField(k) && v.length > 0 && !vault.isEncrypted(v)) {
+      out[k] = vault.encrypt(v);
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walkReencrypt(v, vault);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
 async function restrictFilePermissions(filePath, opts) {
   const warn = opts?.warn ?? ((msg) => console.warn(msg));
   if (process.platform === "win32") {
@@ -739,69 +1429,19 @@ function walkCount(node, vault, counter) {
   if (Array.isArray(node)) {
     return node.map((item) => walkCount(item, vault, counter));
   }
-  const out = /* @__PURE__ */ Object.create(null);
-  for (const [k, v] of Object.entries(node)) {
-    if (typeof v === "string" && isSecretField(k) && !vault.isEncrypted(v) && v.length > 0) {
-      out[k] = vault.encrypt(v);
-      counter.n++;
-    } else if (typeof v === "object" && v !== null) {
-      out[k] = walkCount(v, vault, counter);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
-
-// src/utils/term.ts
-var hasStdout = () => typeof process !== "undefined" && !!process.stdout;
-function isStdoutTTY() {
-  return hasStdout() && Boolean(process.stdout.isTTY);
-}
-function writeTo(s, stream) {
-  if (!stream || typeof stream.write !== "function") return false;
-  {
-    stream.write(s);
-    return true;
-  }
-}
-function writeErr(s, stream = process.stderr) {
-  return writeTo(s, stream);
-}
-
-// src/utils/color.ts
-var isColorTty = () => {
-  if (envFlag(process.env.NO_COLOR)) return false;
-  if (envFlag(process.env.FORCE_COLOR)) return true;
-  return isStdoutTTY();
-};
-function envFlag(value) {
-  if (value === void 0) return false;
-  if (value.trim() === "") return false;
-  return !/^(0|false|no|off)$/i.test(value.trim());
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField(k) && !vault.isEncrypted(v) && v.length > 0) {
+      out[k] = vault.encrypt(v);
+      counter.n++;
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walkCount(v, vault, counter);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
 }
-var COLOR = isColorTty();
-var wrap = (open2, close) => (s) => COLOR ? `\x1B[${open2}m${s}\x1B[${close}m` : s;
-var color = {
-  reset: wrap("0", "0"),
-  bold: wrap("1", "22"),
-  dim: wrap("2", "22"),
-  italic: wrap("3", "23"),
-  underline: wrap("4", "24"),
-  red: wrap("31", "39"),
-  green: wrap("32", "39"),
-  yellow: wrap("33", "39"),
-  blue: wrap("34", "39"),
-  magenta: wrap("35", "39"),
-  cyan: wrap("36", "39"),
-  gray: wrap("90", "39"),
-  amber: wrap("38;5;214", "39"),
-  pink: wrap("38;5;205", "39"),
-  bgRed: wrap("41", "49"),
-  bgGreen: wrap("42", "49")
-};
-
-// src/infrastructure/logger.ts
 var LEVEL_RANK = {
   error: 0,
   warn: 1,
@@ -1098,234 +1738,12 @@ var MEMORY_TYPE_LABELS = {
   anti_pattern: "Anti-pattern"
 };
 
-// src/utils/token-estimate.ts
-var RoughTokenEstimate = (text, charsPerToken = 3.5) => Math.max(1, Math.ceil(text.length / charsPerToken));
-var CALIBRATION_GLOBAL_KEY = "__global__";
-var _cals = /* @__PURE__ */ new Map();
-function calState(key) {
-  let state = _cals.get(key);
-  if (!state) {
-    state = { ratio: 1, count: 0, prevEst: 0 };
-    _cals.set(key, state);
-  }
-  return state;
-}
-var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
-var ESTIMATE_CACHE_MAX_SIZE = 1e4;
-function getCachedEstimate(key, compute) {
-  const existing = ESTIMATE_CACHE.get(key);
-  if (existing !== void 0) return existing;
-  if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
-    let evicted = 0;
-    const maxEvict = Math.floor(ESTIMATE_CACHE_MAX_SIZE / 4);
-    for (const k of ESTIMATE_CACHE.keys()) {
-      if (evicted >= maxEvict) break;
-      ESTIMATE_CACHE.delete(k);
-      evicted++;
-    }
-  }
-  const estimate = compute(key);
-  ESTIMATE_CACHE.set(key, estimate);
-  return estimate;
-}
-function estimateToolInputTokens(input) {
-  if (typeof input === "string") return RoughTokenEstimate(input);
-  if (input === null || typeof input !== "object") {
-    return RoughTokenEstimate(String(input));
-  }
-  return getCachedEstimate(JSON.stringify(input), (key) => RoughTokenEstimate(key));
-}
-function estimateToolResultTokens(content) {
-  if (typeof content === "string") return RoughTokenEstimate(content);
-  return getCachedEstimate(JSON.stringify(content), (key) => RoughTokenEstimate(key));
-}
-function estimateTextTokens(text) {
-  return RoughTokenEstimate(text);
-}
-function computeMessageTokens(msg) {
-  if (typeof msg.content === "string") return estimateTextTokens(msg.content);
-  let total = 0;
-  for (const b of msg.content) {
-    if (b.type === "text") total += estimateTextTokens(b.text);
-    else if (b.type === "tool_use") total += estimateToolInputTokens(b.input);
-    else if (b.type === "tool_result") total += estimateToolResultTokens(b.content);
-    else total += RoughTokenEstimate(JSON.stringify(b));
-  }
-  return total;
-}
-function estimateMessageTokens(messages) {
-  let total = 0;
-  for (const m of messages) {
-    if (typeof m._estTokens === "number" && m._estTokens > 0) {
-      total += m._estTokens;
-      continue;
-    }
-    total += computeMessageTokens(m);
-  }
-  return total;
-}
-function estimateToolDefTokens(tool) {
-  const cached = tool._estDefTokens;
-  if (typeof cached === "number" && cached > 0) return cached;
-  return RoughTokenEstimate(tool.name) + RoughTokenEstimate(tool.description ?? "") + RoughTokenEstimate(JSON.stringify(tool.inputSchema));
-}
-function estimateRequestTokens(messages, systemPrompt, tools, calibrationKey = CALIBRATION_GLOBAL_KEY) {
-  let messagesTokens = 0;
-  if (typeof messages === "string") {
-    messagesTokens = RoughTokenEstimate(messages);
-  } else if (Array.isArray(messages)) {
-    for (const m of messages) {
-      if (typeof m === "object" && m !== null && "content" in m) {
-        const cached = m._estTokens;
-        if (typeof cached === "number" && cached > 0) {
-          messagesTokens += cached;
-          continue;
-        }
-        const content = m.content;
-        if (typeof content === "string") {
-          messagesTokens += RoughTokenEstimate(content);
-        } else if (Array.isArray(content)) {
-          for (const b of content) {
-            if (typeof b === "object" && b !== null) {
-              if (b.type === "text") {
-                messagesTokens += RoughTokenEstimate(b.text);
-              } else {
-                messagesTokens += RoughTokenEstimate(JSON.stringify(b));
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-  let systemTokens = 0;
-  if (typeof systemPrompt === "string") {
-    systemTokens = RoughTokenEstimate(systemPrompt);
-  } else if (Array.isArray(systemPrompt)) {
-    for (const b of systemPrompt) {
-      if (typeof b === "object" && b !== null && b.type === "text") {
-        systemTokens += RoughTokenEstimate(b.text);
-      }
-    }
-  }
-  let toolsTokens = 0;
-  for (const t of tools) {
-    toolsTokens += estimateToolDefTokens(t);
-  }
-  const total = messagesTokens + systemTokens + toolsTokens;
-  calState(calibrationKey).prevEst = total;
-  return {
-    messages: messagesTokens,
-    systemPrompt: systemTokens,
-    tools: toolsTokens,
-    total
-  };
-}
-
-// src/utils/expect-defined.ts
-function expectDefined(value, label) {
-  if (value === null || value === void 0) {
-    const err = new Error("Expected value to be defined");
-    err.name = "ExpectDefinedError";
-    throw err;
-  }
-  return value;
-}
-
-// src/utils/message-invariants.ts
-function repairToolUseAdjacency(messages) {
-  const removedToolUses = [];
-  const removedToolResults = [];
-  let removedMessages = 0;
-  let changed = false;
-  const out = [];
-  for (let i = 0; i < messages.length; i++) {
-    const original = expectDefined(messages[i]);
-    let msg = original;
-    if (hasToolUse(msg)) {
-      const nextIds = toolResultIds(messages[i + 1]);
-      const filtered = mapContent(msg, (blocks) => {
-        const next = [];
-        for (const block of blocks) {
-          if (block.type === "tool_use" && !nextIds.has(block.id)) {
-            removedToolUses.push(block.id);
-            changed = true;
-            continue;
-          }
-          next.push(block);
-        }
-        return next;
-      });
-      msg = filtered ?? msg;
-    }
-    if (hasToolResult(msg)) {
-      const allowed = toolUseIds(out[out.length - 1]);
-      const filtered = mapContent(msg, (blocks) => {
-        const next = [];
-        for (const block of blocks) {
-          if (block.type === "tool_result" && !allowed.has(block.tool_use_id)) {
-            removedToolResults.push(block.tool_use_id);
-            changed = true;
-            continue;
-          }
-          next.push(block);
-        }
-        return next;
-      });
-      msg = filtered ?? msg;
-    }
-    if (isEmptyMessage(msg)) {
-      removedMessages++;
-      changed = true;
-      continue;
-    }
-    out.push(msg);
-  }
-  return {
-    messages: changed ? out : messages,
-    report: { changed, removedToolUses, removedToolResults, removedMessages }
-  };
-}
-function hasToolUse(msg) {
-  return contentBlocks(msg).some((b) => b.type === "tool_use");
-}
-function hasToolResult(msg) {
-  return contentBlocks(msg).some((b) => b.type === "tool_result");
-}
-function toolUseIds(msg) {
-  const ids = /* @__PURE__ */ new Set();
-  if (!msg || msg.role !== "assistant") return ids;
-  for (const block of contentBlocks(msg)) {
-    if (block.type === "tool_use") ids.add(block.id);
-  }
-  return ids;
-}
-function toolResultIds(msg) {
-  const ids = /* @__PURE__ */ new Set();
-  if (!msg || msg.role !== "user") return ids;
-  for (const block of contentBlocks(msg)) {
-    if (block.type === "tool_result") ids.add(block.tool_use_id);
-  }
-  return ids;
-}
-function contentBlocks(msg) {
-  return msg && Array.isArray(msg.content) ? msg.content : [];
-}
-function mapContent(msg, fn) {
-  if (!Array.isArray(msg.content)) return msg;
-  const next = fn(msg.content);
-  if (next.length === msg.content.length && next.every((b, idx) => b === msg.content[idx])) {
-    return msg;
-  }
-  return { ...msg, content: next };
-}
-function isEmptyMessage(msg) {
-  if (typeof msg.content === "string") return msg.content.trim().length === 0;
-  return msg.content.length === 0;
-}
-
 // src/execution/compaction-core.ts
+function compactionDebugEnabled() {
+  return process.env["NODE_ENV"] === "development" || process.env["WRONGSTACK_DEBUG"] === "1";
+}
 function emitCompactionMetrics(event, metrics) {
+  if (!compactionDebugEnabled()) return;
   console.log(
     JSON.stringify({
       level: "debug",
@@ -1380,18 +1798,20 @@ function findPreserveStart(messages, preserveK) {
       }
     }
   }
-  console.log(
-    JSON.stringify({
-      level: "debug",
-      event: "compaction.find_preserve_start.ended",
-      messageCount: messages.length,
-      preserveK,
-      preserveStart,
-      forwardWalkIterations,
-      forwardWalkInnerIterations,
-      forwardWalkInnerPerOuter: forwardWalkIterations > 0 ? forwardWalkInnerIterations / forwardWalkIterations : 0
-    })
-  );
+  if (compactionDebugEnabled()) {
+    console.log(
+      JSON.stringify({
+        level: "debug",
+        event: "compaction.find_preserve_start.ended",
+        messageCount: messages.length,
+        preserveK,
+        preserveStart,
+        forwardWalkIterations,
+        forwardWalkInnerIterations,
+        forwardWalkInnerPerOuter: forwardWalkIterations > 0 ? forwardWalkInnerIterations / forwardWalkIterations : 0
+      })
+    );
+  }
   return preserveStart;
 }
 function eliseOldToolResults(messages, opts) {
@@ -1458,7 +1878,7 @@ function eliseOldToolResults(messages, opts) {
       changed = true;
     }
     fullPassInnerIterations += original.length;
-    if (process.env["NODE_ENV"] === "development" || process.env["WRONGSTACK_DEBUG"] === "1") {
+    if (compactionDebugEnabled()) {
       const ratio = fullPassInnerIterations / fullPassIterations;
       if (ratio > 10) {
         console.error(
@@ -1992,6 +2412,27 @@ var PATTERNS = [
   { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g },
   { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g },
   { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g },
+  // AI/ML provider keys — modern LLM services with well-known prefixes
+  {
+    type: "huggingface_token",
+    // HuggingFace tokens: hf_ followed by 34 alphanumeric chars
+    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g
+  },
+  {
+    type: "replicate_token",
+    // Replicate tokens: r8_ followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+  },
+  {
+    type: "perplexity_key",
+    // Perplexity API keys: pplx- followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+  },
+  {
+    type: "groq_key",
+    // Groq API keys: gsk_ followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+  },
   {
     type: "bearer_token",
     // Anchored with alternation instead of negative lookahead — avoids V8
@@ -2025,6 +2466,10 @@ function hasCredentialAnchors(text) {
   text.includes("xox") || // Slack token (xoxa/xoxb/xoxp/xoxo/xoxs)
   text.includes("Bearer ") || // Bearer token (space suffix reduces false positives)
   text.includes("/bot") || // Telegram bot token (URL path pattern)
+  text.includes("hf_") || // HuggingFace token
+  text.includes("r8_") || // Replicate token
+  text.includes("pplx-") || // Perplexity API key
+  text.includes("gsk_") || // Groq API key
   text.includes("_KEY=") || // High-entropy env vars: API_KEY=, SECRET_KEY=, ...
   text.includes("_TOKEN=") || // ACCESS_TOKEN=, AUTH_TOKEN=, ...
   text.includes("_SECRET=") || // API_SECRET=, CLIENT_SECRET=, ...
@@ -2091,71 +2536,6 @@ var DefaultSecretScrubber = class {
     return visit(obj);
   }
 };
-
-// src/utils/merge-models-payload.ts
-function mergeModelsPayload(base, overlay) {
-  const out = {};
-  for (const [id, provider] of Object.entries(base)) {
-    out[id] = cloneProvider(provider);
-  }
-  for (const [id, ovProvider] of Object.entries(overlay)) {
-    const existing = out[id];
-    out[id] = existing ? mergeProvider(existing, ovProvider) : cloneProvider(ovProvider);
-  }
-  return out;
-}
-function mergeProvider(base, overlay) {
-  const models = {};
-  for (const [mid, m] of Object.entries(base.models ?? {})) {
-    models[mid] = { ...m };
-  }
-  for (const [mid, ovModel] of Object.entries(overlay.models ?? {})) {
-    const existing = models[mid];
-    models[mid] = existing ? mergeModel(existing, ovModel) : { ...ovModel };
-  }
-  return {
-    ...base,
-    // Overlay scalar fields win when explicitly provided; otherwise keep base.
-    ...stripUndefined({
-      id: overlay.id,
-      name: overlay.name,
-      npm: overlay.npm,
-      api: overlay.api,
-      env: overlay.env,
-      doc: overlay.doc
-    }),
-    models
-  };
-}
-function mergeModel(base, overlay) {
-  const merged = { ...base, ...overlay };
-  if (base.limit || overlay.limit) {
-    merged.limit = { ...base.limit, ...overlay.limit };
-  }
-  if (base.cost || overlay.cost) {
-    merged.cost = { ...base.cost, ...overlay.cost };
-  }
-  if (base.modalities || overlay.modalities) {
-    merged.modalities = { ...base.modalities, ...overlay.modalities };
-  }
-  return merged;
-}
-function cloneProvider(p) {
-  const models = {};
-  for (const [mid, m] of Object.entries(p.models ?? {})) {
-    models[mid] = { ...m };
-  }
-  return { ...p, models };
-}
-function stripUndefined(obj) {
-  const out = {};
-  for (const [k, v] of Object.entries(obj)) {
-    if (v !== void 0) out[k] = v;
-  }
-  return out;
-}
-
-// src/models/models-registry.ts
 var DEFAULT_URL = "https://models.dev/api.json";
 var DEFAULT_TTL_SECONDS = 24 * 3600;
 var DEFAULT_REFRESH_TIMEOUT_MS = 15e3;
@@ -2251,7 +2631,7 @@ var DefaultModelsRegistry = class {
       }
       if (overlayAvailable) {
         console.warn(
-          `ModelsRegistry: models.dev unavailable (${err instanceof Error ? err.message : String(err)}); serving curated overlay only.`
+          `ModelsRegistry: models.dev unavailable (${toErrorMessage(err)}); serving curated overlay only.`
         );
         return {};
       }
@@ -3135,144 +3515,6 @@ function getDangerousCapabilities(toolOrCaps) {
   );
 }
 
-// src/utils/json-schema-validate.ts
-function validateAgainstSchema(value, schema) {
-  const errors = [];
-  walk2(value, schema, "", errors);
-  return { ok: errors.length === 0, errors };
-}
-function walk2(value, schema, path7, errors) {
-  if (schema.enum !== void 0) {
-    if (!schema.enum.some((e) => deepEqual(e, value))) {
-      errors.push({
-        path: path7 || "<root>",
-        message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
-      });
-      return;
-    }
-  }
-  if (typeof schema.type === "string") {
-    if (!checkType(value, schema.type)) {
-      errors.push({
-        path: path7 || "<root>",
-        message: `expected ${schema.type}, got ${describeType(value)}`
-      });
-      return;
-    }
-  }
-  if (schema.type === "object" && isPlainObject(value)) {
-    const obj = value;
-    for (const req of schema.required ?? []) {
-      if (!(req in obj)) {
-        errors.push({ path: joinPath(path7, req), message: "required property missing" });
-      }
-    }
-    if (schema.properties) {
-      for (const [key, subSchema] of Object.entries(schema.properties)) {
-        if (key in obj) {
-          walk2(obj[key], subSchema, joinPath(path7, key), errors);
-        }
-      }
-    }
-  }
-  if (schema.type === "array" && Array.isArray(value) && schema.items) {
-    value.forEach((item, i) => walk2(item, schema.items, `${path7}[${i}]`, errors));
-  }
-}
-function checkType(value, type) {
-  switch (type) {
-    case "string":
-      return typeof value === "string";
-    case "number":
-      return typeof value === "number" && !Number.isNaN(value);
-    case "integer":
-      return typeof value === "number" && Number.isInteger(value);
-    case "boolean":
-      return typeof value === "boolean";
-    case "null":
-      return value === null;
-    case "array":
-      return Array.isArray(value);
-    case "object":
-      return isPlainObject(value);
-    default:
-      return true;
-  }
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function describeType(v) {
-  if (v === null) return "null";
-  if (Array.isArray(v)) return "array";
-  return typeof v;
-}
-function joinPath(parent, key) {
-  if (!parent) return key;
-  return `${parent}.${key}`;
-}
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (typeof a !== typeof b) return false;
-  if (a === null || b === null) return a === b;
-  if (Array.isArray(a) && Array.isArray(b)) {
-    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
-  }
-  if (typeof a === "object" && typeof b === "object") {
-    const ak = Object.keys(a);
-    const bk = Object.keys(b);
-    if (ak.length !== bk.length) return false;
-    return ak.every(
-      (k) => deepEqual(a[k], b[k])
-    );
-  }
-  return false;
-}
-
-// src/utils/tool-output-serializer.ts
-function createToolOutputSerializer(opts = {}) {
-  const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
-  function serialize(value) {
-    if (typeof value === "string") return value;
-    if (value === null || value === void 0) return "";
-    if (typeof value === "object") {
-      if (Array.isArray(value)) return value.map(serialize).join("\n");
-      if ("text" in value) {
-        const t = value.text;
-        return typeof t === "string" ? t : JSON.stringify(value, null, 2);
-      }
-      try {
-        return JSON.stringify(value, null, 2);
-      } catch {
-        return String(value);
-      }
-    }
-    return String(value);
-  }
-  function enforceCap(text, remainingBudget) {
-    if (remainingBudget <= 0) {
-      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
-    }
-    const textBytes = Buffer.byteLength(text, "utf8");
-    if (textBytes <= remainingBudget) {
-      return { text, newBudget: remainingBudget - textBytes };
-    }
-    const marker = `
-\u2026[truncated ${textBytes - remainingBudget} bytes]\u2026
-`;
-    const markerBytes = Buffer.byteLength(marker, "utf8");
-    const available = remainingBudget - markerBytes;
-    if (available <= 0) {
-      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
-    }
-    const half = Math.floor(available / 2);
-    const first = text.slice(0, half);
-    const second = text.slice(text.length - half);
-    return { text: `${first}${marker}${second}`, newBudget: 0 };
-  }
-  return { serialize, enforceCap, capBytes };
-}
-
 // src/execution/tool-executor.ts
 var ToolExecutor = class _ToolExecutor {
   constructor(registry, opts) {
@@ -3436,7 +3678,7 @@ ${post.additionalContext}`;
         );
         return { result, tool, durationMs: Date.now() - start };
       } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
+        const msg = toErrorMessage(err);
         const scrubbed = this.opts.secretScrubber.scrub(msg);
         this.opts.renderer?.writeToolResult(tool.name, scrubbed, true);
         const result = {
@@ -3457,7 +3699,7 @@ ${post.additionalContext}`;
       try {
         return await runOne(use);
       } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
+        const msg = toErrorMessage(err);
         const scrubbed = this.opts.secretScrubber.scrub(msg);
         const result = {
           type: "tool_result",
@@ -3866,6 +4108,13 @@ var Context = class {
   projectRoot;
   /** Mutable working directory — starts as `cwd`. Change via `setWorkingDir()`. */
   workingDir;
+  /**
+   * When true, file tools (via `_util.ts`) and `setWorkingDir()` reject paths
+   * outside `projectRoot`. When false, those boundary checks are bypassed so
+   * tools may reach paths outside the project (still gated by permission
+   * tiers). Mutable so `/settings` can toggle it live on the running session.
+   */
+  allowOutsideProjectRoot;
   model;
   tools = [];
   meta = {};
@@ -3910,11 +4159,13 @@ var Context = class {
     this.cwd = init.cwd;
     this.projectRoot = init.projectRoot;
     this.workingDir = init.workingDir ?? init.cwd;
+    this.allowOutsideProjectRoot = init.allowOutsideProjectRoot ?? false;
     this.model = init.model;
     this.tools = init.tools ?? [];
     this.agentId = init.agentId ?? "unknown";
     this.agentName = init.agentName ?? "Unknown Agent";
     this.traceId = init.traceId;
+    this.allowOutsideProjectRoot = init.allowOutsideProjectRoot ?? false;
     this.session.traceId = init.traceId;
   }
   /**
@@ -3980,12 +4231,14 @@ var Context = class {
    */
   setWorkingDir(dir) {
     const resolved = path4.isAbsolute(dir) ? path4.resolve(dir) : path4.resolve(this.projectRoot, dir);
-    const root = path4.resolve(this.projectRoot);
-    const rel = path4.relative(root, resolved);
-    if (rel.startsWith("..") || path4.isAbsolute(rel)) {
-      throw new Error(
-        `Working directory "${resolved}" is outside project root "${root}"`
-      );
+    if (!this.allowOutsideProjectRoot) {
+      const root = path4.resolve(this.projectRoot);
+      const rel = path4.relative(root, resolved);
+      if (rel.startsWith("..") || path4.isAbsolute(rel)) {
+        throw new Error(
+          `Working directory "${resolved}" is outside project root "${root}"`
+        );
+      }
     }
     const old = this.workingDir;
     this.workingDir = resolved;
@@ -4015,42 +4268,6 @@ var Context = class {
   }
 };
 
-// src/utils/regex-guard.ts
-var MAX_PATTERN_LEN = 512;
-var DANGEROUS_PATTERNS = [
-  /(\([^)]*[+*][^)]*\))[+*]/,
-  // (a+)+, (.*)+, etc
-  /(\(\?:[^)]*[+*][^)]*\))[+*]/
-  // same, with non-capturing group
-];
-function compileUserRegex(pattern, flags) {
-  if (typeof pattern !== "string") {
-    return { ok: false, reason: "pattern must be a string" };
-  }
-  if (pattern.length === 0) {
-    return { ok: false, reason: "pattern is empty" };
-  }
-  if (pattern.length > MAX_PATTERN_LEN) {
-    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
-  }
-  for (const rx of DANGEROUS_PATTERNS) {
-    if (rx.test(pattern)) {
-      return {
-        ok: false,
-        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
-      };
-    }
-  }
-  try {
-    return { ok: true, regex: new RegExp(pattern, flags) };
-  } catch (err) {
-    return {
-      ok: false,
-      reason: err instanceof Error ? err.message : "invalid regex"
-    };
-  }
-}
-
 // src/storage/session-reader.ts
 var DefaultSessionReader = class {
   store;
@@ -4327,6 +4544,6 @@ function renderPlainText(meta, events) {
   return lines.join("\n");
 }
 
-export { AgentError, CONTEXT_WINDOW_MODES, ConfigError, Context, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONTEXT_CONFIG, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEFAULT_MODES, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SESSION_LOGGING_CONFIG, DEFAULT_SESSION_PRUNE_DAYS, DEFAULT_SPEC_TEMPLATE, DEFAULT_TOOLS_CONFIG, DefaultErrorHandler, DefaultLogger, DefaultModelsRegistry, DefaultPathResolver, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultTokenCounter, ERROR_CODES, FsError, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, MEMORY_TYPE_LABELS, PluginError, ProviderError, SddError, SessionError, StreamHangError, ToolError, ToolExecutor, WrongStackError, asBlocks, asText, buildRecoveryStrategies, classifyFamily, computeTaskProgress, createMessage, decryptConfigSecrets, encryptConfigSecrets, findCriticalPath, formatContextWindowModeList, getContextWindowMode, isAgentError, isConfigError, isContextWindowModeId, isFsError, isImageBlock, isPluginError, isSddError, isSecretField, isSessionError, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, listContextWindowModes, migratePlaintextSecrets, noOpLogger, resolveContextWindowPolicy, rewriteConfigEncrypted, toWrongStackError, topologicalSort };
+export { AgentError, CONTEXT_WINDOW_MODES, ConfigError, Context, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CIRCUIT_BREAKER_CONFIG, DEFAULT_CONTEXT_CONFIG, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEFAULT_MODES, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SESSION_LOGGING_CONFIG, DEFAULT_SESSION_PRUNE_DAYS, DEFAULT_SPEC_TEMPLATE, DEFAULT_TOOLS_CONFIG, DefaultErrorHandler, DefaultLogger, DefaultModelsRegistry, DefaultPathResolver, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultTokenCounter, ERROR_CODES, FsError, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, MEMORY_TYPE_LABELS, PluginError, ProviderError, SddError, SessionError, StreamHangError, ToolError, ToolExecutor, WrongStackError, asBlocks, asText, buildRecoveryStrategies, classifyFamily, computeTaskProgress, createMessage, decryptConfigSecrets, encryptConfigSecrets, findCriticalPath, formatContextWindowModeList, getContextWindowMode, isAgentError, isConfigError, isContextWindowModeId, isFsError, isImageBlock, isPluginError, isSddError, isSecretField, isSessionError, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, listContextWindowModes, migratePlaintextSecrets, noOpLogger, normalizeTokenSavingTier, resolveContextWindowPolicy, rewriteConfigEncrypted, rotateConfigKeys, toWrongStackError, topologicalSort };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map