@wrongstack/core 0.264.0 → 0.267.0

package/dist/defaults/index.js

@@ -1,9 +1,9 @@
 import * as crypto2 from 'crypto';
 import { randomBytes, createCipheriv, createDecipheriv, randomUUID, createHash } from 'crypto';
 import * as fsp2 from 'fs/promises';
-import * as path3 from 'path';
+import * as path4 from 'path';
 import { isAbsolute, resolve } from 'path';
-import * as fs from 'fs';
+import * as fs4 from 'fs';
 import * as os from 'os';
 import { hostname } from 'os';
 import { execFile } from 'child_process';
@@ -33,9 +33,9 @@ __export(atomic_write_exports, {
   withFileLock: () => withFileLock
 });
 async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path3.dirname(targetPath);
+  const dir = path4.dirname(targetPath);
   await fsp2.mkdir(dir, { recursive: true });
-  const tmp = path3.join(dir, `.${path3.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const tmp = path4.join(dir, `.${path4.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
       await fsp2.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
@@ -74,9 +74,9 @@ async function ensureDir(dir) {
   await fsp2.mkdir(dir, { recursive: true });
 }
 async function withFileLock(targetPath, fn, opts = {}) {
-  const dir = path3.dirname(targetPath);
+  const dir = path4.dirname(targetPath);
   await fsp2.mkdir(dir, { recursive: true });
-  const lockPath = path3.join(dir, `.${path3.basename(targetPath)}.lock`);
+  const lockPath = path4.join(dir, `.${path4.basename(targetPath)}.lock`);
   const timeoutMs = opts.timeoutMs ?? 5e3;
   const staleMs = opts.staleMs ?? 3e4;
   const started = Date.now();
@@ -105,7 +105,7 @@ async function withFileLock(targetPath, fn, opts = {}) {
       if (Date.now() - started >= timeoutMs) {
         throw new Error(`Timed out waiting for file lock: ${targetPath}`);
       }
-      await new Promise((resolve5) => setTimeout(resolve5, 25));
+      await new Promise((resolve6) => setTimeout(resolve6, 25));
     }
   }
   try {
@@ -138,7 +138,7 @@ async function renameWithRetry(from, to) {
       if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
         throw err;
       }
-      await new Promise((resolve5) => setTimeout(resolve5, delays[i]));
+      await new Promise((resolve6) => setTimeout(resolve6, delays[i]));
     }
   }
   throw lastErr;
@@ -234,7 +234,7 @@ var DefaultLogger = class _DefaultLogger {
     this.maxFileBytes = opts.maxFileBytes ?? 10 * 1024 * 1024;
     if (this.file) {
       try {
-        fs.mkdirSync(path3.dirname(this.file), { recursive: true });
+        fs4.mkdirSync(path4.dirname(this.file), { recursive: true });
       } catch {
       }
     }
@@ -275,10 +275,10 @@ var DefaultLogger = class _DefaultLogger {
   maybeRotate(file) {
     if (this.writesSinceRotateCheck++ % _DefaultLogger.ROTATE_CHECK_EVERY !== 0) return;
     try {
-      const st = fs.statSync(file);
+      const st = fs4.statSync(file);
       if (st.size < this.maxFileBytes) return;
-      fs.rmSync(`${file}.1`, { force: true });
-      fs.renameSync(file, `${file}.1`);
+      fs4.rmSync(`${file}.1`, { force: true });
+      fs4.renameSync(file, `${file}.1`);
     } catch {
     }
   }
@@ -294,7 +294,7 @@ var DefaultLogger = class _DefaultLogger {
     if (this.file) {
       try {
         this.maybeRotate(this.file);
-        fs.appendFileSync(this.file, `${JSON.stringify(entry)}
+        fs4.appendFileSync(this.file, `${JSON.stringify(entry)}
 `);
       } catch {
       }
@@ -436,32 +436,268 @@ function isEmptyMessage(msg) {
   return msg.content.length === 0;
 }
 
+// src/utils/assert-never.ts
+function assertNever(x, message) {
+  const err = new Error(
+    `Unhandled case: ${JSON.stringify(x)}`
+  );
+  err.name = "AssertNeverError";
+  throw err;
+}
+
 // src/utils/index.ts
 init_atomic_write();
+var MAX_DIGEST_CHARS = 4e3;
+function createContextEvidenceState() {
+  return {
+    sessionGoals: [],
+    implicitFacts: [],
+    activeErrors: [],
+    toolCalls: [],
+    fileGraph: {},
+    repeatedReads: [],
+    updatedAt: Date.now()
+  };
+}
+function buildContextEvidenceDigest(ctx) {
+  const state = ensureEvidence(ctx);
+  const lines = [];
+  if (state.currentIntent?.text) {
+    lines.push(`intent: ${state.currentIntent.text}`);
+  }
+  const goals = state.sessionGoals.slice(-3);
+  if (goals.length > 0) {
+    lines.push("session_goals:");
+    for (const goal of goals) lines.push(`- ${goal}`);
+  }
+  const activeErrors = state.activeErrors.slice(-5);
+  if (activeErrors.length > 0) {
+    lines.push("active_errors:");
+    for (const err of activeErrors) lines.push(`- ${err}`);
+  }
+  const files = Object.values(state.fileGraph).sort((a, b) => b.writes - a.writes || b.reads - a.reads || a.path.localeCompare(b.path)).slice(0, 12);
+  if (files.length > 0) {
+    lines.push("dependency_graph:");
+    for (const file of files) {
+      const actions = [
+        file.reads > 0 ? `read ${file.reads}x` : "",
+        file.writes > 0 ? `write ${file.writes}x` : ""
+      ].filter(Boolean).join(", ");
+      const refs = file.referenced ? "; referenced by assistant" : "";
+      const via = file.lastToolUseId ? `; last via ${file.lastToolUseId}` : "";
+      lines.push(`- ${file.path} (${actions || "seen"}${refs}${via})`);
+    }
+  }
+  const referenced = state.toolCalls.filter((tool) => tool.status === "referenced").slice(-10);
+  const recentSeen = state.toolCalls.filter((tool) => tool.status === "seen").slice(-5);
+  const trail = [...referenced, ...recentSeen];
+  if (trail.length > 0) {
+    lines.push("tool_trail:");
+    for (const tool of trail) {
+      const size = tool.outputTokens ? `; ~${tool.outputTokens} tokens` : "";
+      const filesText = tool.files.length > 0 ? `; files=${tool.files.slice(0, 4).join(", ")}` : "";
+      const symbolsText = tool.symbols.length > 0 ? `; symbols=${tool.symbols.slice(0, 4).join(", ")}` : "";
+      lines.push(
+        `- ${tool.toolUseId} ${tool.toolName} ${tool.status}: ${tool.summary}${filesText}${symbolsText}${size}`
+      );
+    }
+  }
+  const facts = state.implicitFacts.slice(-8);
+  if (facts.length > 0) {
+    lines.push("implicit_facts:");
+    for (const fact of facts) lines.push(`- ${fact}`);
+  }
+  const digest = lines.join("\n");
+  if (digest.length <= MAX_DIGEST_CHARS) return digest;
+  return `${digest.slice(0, MAX_DIGEST_CHARS)}... [+${digest.length - MAX_DIGEST_CHARS} chars]`;
+}
+function repeatedReadPressure(ctx) {
+  return ensureEvidence(ctx).repeatedReads.reduce((max, item) => Math.max(max, item.count), 0);
+}
+function ensureEvidence(ctx) {
+  if (!ctx.contextEvidence) {
+    ctx.contextEvidence = createContextEvidenceState();
+  }
+  return ctx.contextEvidence;
+}
+
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+function isPrimitiveArray(a) {
+  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
+}
+function deepMerge(base, patch, options = {}) {
+  const {
+    conflictResolution = "prefer-patch",
+    arrayMode = "replace",
+    protectProto = true,
+    onNonPrimitiveArrayReplace
+  } = options;
+  if (typeof base !== "object" || base === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (typeof patch !== "object" || patch === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
+      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+    }
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) || Array.isArray(patch)) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  const baseObj = base;
+  const patchObj = patch;
+  const out = { ...baseObj };
+  for (const [k, v] of Object.entries(patchObj)) {
+    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v, options);
+    } else if (Array.isArray(v) && Array.isArray(existing)) {
+      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
+        onNonPrimitiveArrayReplace(k, existing.length, v.length);
+      }
+      out[k] = deepMerge(existing, v, options);
+    } else if (v !== void 0) {
+      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
+        const existingLen = Array.isArray(existing) ? existing.length : 0;
+        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+      }
+      out[k] = v;
+    }
+  }
+  return out;
+}
 
 // src/utils/error.ts
 function toErrorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
-
-// src/utils/safe-json.ts
-function safeParse(input, maxBytes = 5e6) {
-  if (input.length > maxBytes) {
-    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
+var GLOB_CHARS = /* @__PURE__ */ new Set(["*", "?", "["]);
+var IS_WINDOWS = process.platform === "win32";
+var SEP = IS_WINDOWS ? "\\" : "/";
+function isGlob(p) {
+  for (const c of p) {
+    if (GLOB_CHARS.has(c)) return true;
   }
-  try {
-    return { ok: true, value: JSON.parse(input) };
-  } catch (err) {
-    return {
-      ok: false,
-      error: toErrorMessage(err)
-    };
+  return false;
+}
+function globToRegex(pat) {
+  let i = 0;
+  let re = "^";
+  while (i < pat.length) {
+    const c = expectDefined(pat[i]);
+    if (c === "*") {
+      if (pat[i + 1] === "*") {
+        re += ".*";
+        i += 2;
+        if (pat[i] === "/") i++;
+      } else {
+        re += "[^/\\\\]*";
+        i++;
+      }
+    } else if (c === "?") {
+      re += "[^/\\\\]";
+      i++;
+    } else if (c === "[") {
+      let cls = "[";
+      i++;
+      if (pat[i] === "!" || pat[i] === "^") {
+        cls += "^";
+        i++;
+      }
+      while (i < pat.length && pat[i] !== "]") {
+        const ch = pat[i] ?? "";
+        if (ch === "\\") cls += "\\\\";
+        else if (ch === "]" || ch === "^") cls += `\\${ch}`;
+        else cls += ch;
+        i++;
+      }
+      cls += "]";
+      re += cls;
+      i++;
+    } else {
+      re += c.replace(/[.+^${}()|\\]/g, "\\$&");
+      i++;
+    }
   }
+  return new RegExp(re + "$");
 }
-
-// src/utils/string.ts
-function truncate(s, max) {
-  return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
+function baseDir(pat) {
+  let i = pat.length - 1;
+  while (i >= 0 && !GLOB_CHARS.has(expectDefined(pat[i])) && pat[i] !== SEP && pat[i] !== "/") i--;
+  const cut = i >= 0 ? pat.lastIndexOf(SEP, i) : pat.lastIndexOf("/", i);
+  return cut < 0 ? "." : pat.slice(0, cut);
+}
+async function expandGlob(pattern) {
+  if (!isGlob(pattern)) return [pattern];
+  const results = /* @__PURE__ */ new Set();
+  const abs = isAbsolute(pattern);
+  const base = abs ? baseDir(pattern) : baseDir(pattern);
+  const relPat = base === "." ? pattern : pattern.slice(base.length + 1);
+  async function walk3(dir, pat) {
+    let entries;
+    try {
+      entries = await fsp2.readdir(dir);
+    } catch {
+      return;
+    }
+    const firstGlob = pat.search(/[*?[[]/);
+    if (firstGlob < 0) {
+      const re = globToRegex(pat);
+      for (const e of entries) {
+        if (re.test(e)) {
+          const full = `${dir}${SEP}${e}`;
+          results.add(abs ? resolve(full) : full);
+        }
+      }
+      return;
+    }
+    const before = pat.slice(0, firstGlob);
+    const rest = pat.slice(firstGlob);
+    if (before.endsWith("**")) {
+      await walk3(dir, rest);
+      for (const e of entries) {
+        const full = `${dir}${SEP}${e}`;
+        try {
+          const stat6 = await fsp2.stat(full);
+          if (stat6.isDirectory()) await walk3(full, rest);
+        } catch {
+        }
+      }
+    } else if (before === "") {
+      const re = globToRegex(rest);
+      for (const e of entries) {
+        if (re.test(e)) {
+          const full = `${dir}${SEP}${e}`;
+          results.add(abs ? resolve(full) : full);
+        }
+      }
+    } else {
+      const seg = before.replace(/[*?[\]]/g, "").replace(/\/$/, "");
+      if (entries.includes(seg)) {
+        const full = `${dir}${SEP}${seg}`;
+        try {
+          const stat6 = await fsp2.stat(full);
+          if (stat6.isDirectory()) await walk3(full, rest);
+        } catch {
+        }
+      }
+    }
+  }
+  await walk3(base === "." ? "." : base, relPat);
+  return [...results];
 }
 
 // src/utils/glob-match.ts
@@ -539,235 +775,441 @@ function matchGlob(pattern, input) {
 function matchAny(patterns, input) {
   return patterns.some((p) => matchGlob(p, input));
 }
-function projectHash(absRoot) {
-  return createHash("sha256").update(path3.resolve(absRoot)).digest("hex").slice(0, 12);
-}
-function projectSlug(absRoot) {
-  const base = slugify(path3.basename(absRoot));
-  const hash = createHash("sha256").update(path3.resolve(absRoot)).digest("hex").slice(0, 6);
-  return `${base}-${hash}`;
-}
-function slugify(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
-}
-function wstackGlobalRoot() {
-  const fromEnv = process.env["WRONGSTACK_HOME"];
-  if (fromEnv && fromEnv.trim().length > 0) return path3.resolve(fromEnv);
-  return path3.join(os.homedir(), ".wrongstack");
-}
-function resolveWstackPaths(opts) {
-  const globalRoot = opts.globalRoot ?? (opts.userHome ? path3.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
-  const hash = projectHash(opts.projectRoot);
-  const slug = projectSlug(opts.projectRoot);
-  const projectDir = path3.join(globalRoot, "projects", slug);
-  return {
-    globalRoot,
-    configDir: globalRoot,
-    globalConfig: path3.join(globalRoot, "config.json"),
-    secretsKey: path3.join(globalRoot, ".key"),
-    globalMemory: path3.join(globalRoot, "memory.md"),
-    globalSkills: path3.join(globalRoot, "skills"),
-    globalPrompts: path3.join(globalRoot, "prompts"),
-    cacheDir: path3.join(globalRoot, "cache"),
-    modelsCache: path3.join(globalRoot, "cache", "models.dev.json"),
-    modelsOverlayCache: path3.join(globalRoot, "cache", "models-overlay.json"),
-    historyFile: path3.join(globalRoot, "history"),
-    logFile: path3.join(globalRoot, "logs", "wrongstack.log"),
-    projectDir,
-    projectCodebaseIndex: path3.join(projectDir, "codebase-index"),
-    projectMemory: path3.join(projectDir, "memory.md"),
-    projectSessions: path3.join(projectDir, "sessions"),
-    projectTrust: path3.join(projectDir, "trust.json"),
-    projectMeta: path3.join(projectDir, "meta.json"),
-    projectLocalConfig: path3.join(projectDir, "config.local.json"),
-    inProjectConfig: path3.join(opts.projectRoot, ".wrongstack", "config.json"),
-    inProjectAgentsFile: path3.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
-    inProjectSkills: path3.join(opts.projectRoot, ".wrongstack", "skills"),
-    inProjectWorktrees: path3.join(opts.projectRoot, ".wrongstack", "worktrees"),
-    projectHash: hash,
-    projectSlug: slug,
-    projectGoal: path3.join(projectDir, "goal.json"),
-    projectSpecs: path3.join(projectDir, "specs"),
-    projectTaskGraphs: path3.join(projectDir, "task-graphs"),
-    projectSddSession: path3.join(projectDir, "sdd-session.json"),
-    projectPlan: path3.join(projectDir, "plan.json"),
-    projectAutophase: path3.join(projectDir, "autophase"),
-    syncConfig: path3.join(globalRoot, "sync.json")
-  };
-}
-
-// src/utils/sleep.ts
-function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
-}
 
-// src/utils/assert-never.ts
-function assertNever(x, message) {
-  const err = new Error(
-    `Unhandled case: ${JSON.stringify(x)}`
-  );
-  err.name = "AssertNeverError";
-  throw err;
+// src/utils/json-repair.ts
+function completePartialObject(s) {
+  if (!s.trim().startsWith("{")) return s;
+  if (tryParse(s).ok) return s;
+  return repairTruncated(s);
 }
-
-// src/utils/deep-merge.ts
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function isPrimitiveArray(a) {
-  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
-}
-function deepMerge(base, patch, options = {}) {
-  const {
-    conflictResolution = "prefer-patch",
-    arrayMode = "replace",
-    protectProto = true,
-    onNonPrimitiveArrayReplace
-  } = options;
-  if (typeof base !== "object" || base === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (typeof patch !== "object" || patch === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
+function repairTruncated(s) {
+  const stack = [];
+  let inString = false;
+  let escaped = false;
+  let sawKey = false;
+  let prevSig = "";
+  let contentEnd = 0;
+  let stringBraceDepth = 0;
+  for (let i = 0; i < s.length; i++) {
+    const ch = expectDefined(s[i]);
+    if (inString) {
+      contentEnd = i + 1;
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (ch === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (ch === '"') {
+        inString = false;
+        prevSig = '"';
+        stringBraceDepth = 0;
+        continue;
+      }
+      if (ch === "{") stringBraceDepth++;
+      else if (ch === "}" && stringBraceDepth > 0) stringBraceDepth--;
+      continue;
+    }
+    if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") continue;
+    contentEnd = i + 1;
+    if (ch === '"') {
+      inString = true;
+      sawKey = true;
+      stringBraceDepth = 0;
+      prevSig = '"';
+    } else if (ch === "{" || ch === "[") {
+      stack.push(ch);
+      prevSig = ch;
+    } else if (ch === "}" || ch === "]") {
+      stack.pop();
+      prevSig = ch;
+    } else {
+      prevSig = ch;
+    }
   }
-  if (Array.isArray(base) && Array.isArray(patch)) {
-    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
-      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+  if (!sawKey && !inString) return s;
+  let result = s.slice(0, contentEnd);
+  if (inString) {
+    if (escaped) {
+      result = result.slice(0, -1);
+    } else if (endsWithInvalidEscape(result)) {
+      result = result.slice(0, -2);
     }
-    return conflictResolution === "prefer-patch" ? patch : base;
+    if (stringBraceDepth > 0) result += "}".repeat(stringBraceDepth);
+    result += '"';
+  } else if (prevSig === ":") {
+    result += "null";
   }
-  if (Array.isArray(base) || Array.isArray(patch)) {
-    return conflictResolution === "prefer-patch" ? patch : base;
+  for (let k = stack.length - 1; k >= 0; k--) {
+    result += stack[k] === "{" ? "}" : "]";
   }
-  const baseObj = base;
-  const patchObj = patch;
-  const out = { ...baseObj };
-  for (const [k, v] of Object.entries(patchObj)) {
-    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v, options);
-    } else if (Array.isArray(v) && Array.isArray(existing)) {
-      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
-        onNonPrimitiveArrayReplace(k, existing.length, v.length);
-      }
-      out[k] = deepMerge(existing, v, options);
-    } else if (v !== void 0) {
-      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
-        const existingLen = Array.isArray(existing) ? existing.length : 0;
-        onNonPrimitiveArrayReplace(k, existingLen, v.length);
-      }
-      out[k] = v;
-    }
+  if (!tryParse(result).ok) {
+    const patched = result.replace(/:(\s*)([}\]])/g, ":null$2");
+    if (tryParse(patched).ok) result = patched;
+  }
+  return result;
+}
+var VALID_ESCAPE = /* @__PURE__ */ new Set(['"', "\\", "/", "b", "f", "n", "r", "t", "u"]);
+function endsWithInvalidEscape(str) {
+  const last = str[str.length - 1];
+  if (str[str.length - 2] !== "\\" || last === void 0) return false;
+  if (VALID_ESCAPE.has(last)) return false;
+  let backslashes = 0;
+  for (let k = str.length - 2; k >= 0 && str[k] === "\\"; k--) backslashes++;
+  return backslashes % 2 === 1;
+}
+function tryParse(s) {
+  try {
+    return { ok: true, value: JSON.parse(s) };
+  } catch {
+    return { ok: false };
   }
-  return out;
 }
 
-// src/utils/tool-output-serializer.ts
-function createToolOutputSerializer(opts = {}) {
-  const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
-  function serialize(value) {
-    if (typeof value === "string") return value;
-    if (value === null || value === void 0) return "";
-    if (typeof value === "object") {
-      if (Array.isArray(value)) return value.map(serialize).join("\n");
-      if ("text" in value) {
-        const t = value.text;
-        return typeof t === "string" ? t : JSON.stringify(value, null, 2);
-      }
-      try {
-        return JSON.stringify(value, null, 2);
-      } catch {
-        return String(value);
-      }
+// src/utils/json-schema-validate.ts
+function validateAgainstSchema(value, schema) {
+  const errors = [];
+  walk(value, schema, "", errors);
+  return { ok: errors.length === 0, errors };
+}
+function walk(value, schema, path21, errors) {
+  if (schema.enum !== void 0) {
+    if (!schema.enum.some((e) => deepEqual(e, value))) {
+      errors.push({
+        path: path21 || "<root>",
+        message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
+      });
+      return;
     }
-    return String(value);
   }
-  function enforceCap(text, remainingBudget) {
-    if (remainingBudget <= 0) {
-      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
+  if (typeof schema.type === "string") {
+    if (!checkType(value, schema.type)) {
+      errors.push({
+        path: path21 || "<root>",
+        message: `expected ${schema.type}, got ${describeType(value)}`
+      });
+      return;
     }
-    const textBytes = Buffer.byteLength(text, "utf8");
-    if (textBytes <= remainingBudget) {
-      return { text, newBudget: remainingBudget - textBytes };
+  }
+  if (schema.type === "object" && isPlainObject(value)) {
+    const obj = value;
+    for (const req of schema.required ?? []) {
+      if (!(req in obj)) {
+        errors.push({ path: joinPath(path21, req), message: "required property missing" });
+      }
     }
-    const marker = `
-\u2026[truncated ${textBytes - remainingBudget} bytes]\u2026
-`;
-    const markerBytes = Buffer.byteLength(marker, "utf8");
-    const available = remainingBudget - markerBytes;
-    if (available <= 0) {
-      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
+    if (schema.properties) {
+      for (const [key, subSchema] of Object.entries(schema.properties)) {
+        if (key in obj) {
+          walk(obj[key], subSchema, joinPath(path21, key), errors);
+        }
+      }
     }
-    const half = Math.floor(available / 2);
-    const first = text.slice(0, half);
-    const second = text.slice(text.length - half);
-    return { text: `${first}${marker}${second}`, newBudget: 0 };
-  }
-  return { serialize, enforceCap, capBytes };
-}
-
-// src/utils/token-estimate.ts
-var RoughTokenEstimate = (text, charsPerToken = 3.5) => Math.max(1, Math.ceil(text.length / charsPerToken));
-var CALIBRATION_GLOBAL_KEY = "__global__";
-var _cals = /* @__PURE__ */ new Map();
-function calState(key) {
-  let state = _cals.get(key);
-  if (!state) {
-    state = { ratio: 1, count: 0, prevEst: 0 };
-    _cals.set(key, state);
   }
-  return state;
-}
-var MIN_SAMPLES_FOR_CALIBRATION = 3;
-var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
-var ESTIMATE_CACHE_MAX_SIZE = 1e4;
-function getCachedEstimate(key, compute) {
-  const existing = ESTIMATE_CACHE.get(key);
-  if (existing !== void 0) return existing;
-  if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
-    let evicted = 0;
-    const maxEvict = Math.floor(ESTIMATE_CACHE_MAX_SIZE / 4);
-    for (const k of ESTIMATE_CACHE.keys()) {
-      if (evicted >= maxEvict) break;
-      ESTIMATE_CACHE.delete(k);
-      evicted++;
+  if (schema.type === "array" && Array.isArray(value) && schema.items) {
+    for (let i = 0; i < value.length; i++) {
+      walk(value[i], schema.items, `${path21}[${i}]`, errors);
     }
   }
-  const estimate = compute(key);
-  ESTIMATE_CACHE.set(key, estimate);
-  return estimate;
 }
-function estimateToolInputTokens(input) {
-  if (typeof input === "string") return RoughTokenEstimate(input);
-  if (input === null || typeof input !== "object") {
-    return RoughTokenEstimate(String(input));
+function checkType(value, type) {
+  switch (type) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number" && !Number.isNaN(value);
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "boolean":
+      return typeof value === "boolean";
+    case "null":
+      return value === null;
+    case "array":
+      return Array.isArray(value);
+    case "object":
+      return isPlainObject(value);
+    default:
+      return true;
   }
-  return getCachedEstimate(JSON.stringify(input), (key) => RoughTokenEstimate(key));
 }
-function estimateToolResultTokens(content) {
-  if (typeof content === "string") return RoughTokenEstimate(content);
-  return getCachedEstimate(JSON.stringify(content), (key) => RoughTokenEstimate(key));
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-function estimateTextTokens(text) {
-  return RoughTokenEstimate(text);
+function describeType(v) {
+  if (v === null) return "null";
+  if (Array.isArray(v)) return "array";
+  return typeof v;
 }
-function computeMessageTokens(msg) {
-  if (typeof msg.content === "string") return estimateTextTokens(msg.content);
-  let total = 0;
-  for (const b of msg.content) {
-    if (b.type === "text") total += estimateTextTokens(b.text);
-    else if (b.type === "tool_use") total += estimateToolInputTokens(b.input);
-    else if (b.type === "tool_result") total += estimateToolResultTokens(b.content);
-    else total += RoughTokenEstimate(JSON.stringify(b));
-  }
-  return total;
+function joinPath(parent, key) {
+  if (!parent) return key;
+  return `${parent}.${key}`;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b) return false;
+  if (a === null || b === null) return a === b;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
+  }
+  if (typeof a === "object" && typeof b === "object") {
+    const ak = Object.keys(a);
+    const bk = Object.keys(b);
+    if (ak.length !== bk.length) return false;
+    return ak.every(
+      (k) => deepEqual(a[k], b[k])
+    );
+  }
+  return false;
+}
+
+// src/utils/merge-models-payload.ts
+function mergeModelsPayload(base, overlay) {
+  const out = {};
+  for (const [id, provider] of Object.entries(base)) {
+    out[id] = cloneProvider(provider);
+  }
+  for (const [id, ovProvider] of Object.entries(overlay)) {
+    const existing = out[id];
+    out[id] = existing ? mergeProvider(existing, ovProvider) : cloneProvider(ovProvider);
+  }
+  return out;
+}
+function mergeProvider(base, overlay) {
+  const models = {};
+  for (const [mid, m] of Object.entries(base.models ?? {})) {
+    models[mid] = { ...m };
+  }
+  for (const [mid, ovModel] of Object.entries(overlay.models ?? {})) {
+    const existing = models[mid];
+    models[mid] = existing ? mergeModel(existing, ovModel) : { ...ovModel };
+  }
+  return {
+    ...base,
+    // Overlay scalar fields win when explicitly provided; otherwise keep base.
+    ...stripUndefined({
+      id: overlay.id,
+      name: overlay.name,
+      npm: overlay.npm,
+      api: overlay.api,
+      env: overlay.env,
+      doc: overlay.doc
+    }),
+    models
+  };
+}
+function mergeModel(base, overlay) {
+  const merged = { ...base, ...overlay };
+  if (base.limit || overlay.limit) {
+    merged.limit = { ...base.limit, ...overlay.limit };
+  }
+  if (base.cost || overlay.cost) {
+    merged.cost = { ...base.cost, ...overlay.cost };
+  }
+  if (base.modalities || overlay.modalities) {
+    merged.modalities = { ...base.modalities, ...overlay.modalities };
+  }
+  return merged;
+}
+function cloneProvider(p) {
+  const models = {};
+  for (const [mid, m] of Object.entries(p.models ?? {})) {
+    models[mid] = { ...m };
+  }
+  return { ...p, models };
+}
+function stripUndefined(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+
+// src/utils/regex-guard.ts
+var MAX_PATTERN_LEN = 512;
+var DANGEROUS_PATTERNS = [
+  /(\([^)]*[+*][^)]*\))[+*]/,
+  // (a+)+, (.*)+, etc
+  /(\(\?:[^)]*[+*][^)]*\))[+*]/
+  // same, with non-capturing group
+];
+function compileUserRegex(pattern, flags) {
+  if (typeof pattern !== "string") {
+    return { ok: false, reason: "pattern must be a string" };
+  }
+  if (pattern.length === 0) {
+    return { ok: false, reason: "pattern is empty" };
+  }
+  if (pattern.length > MAX_PATTERN_LEN) {
+    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
+  }
+  for (const rx of DANGEROUS_PATTERNS) {
+    if (rx.test(pattern)) {
+      return {
+        ok: false,
+        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
+      };
+    }
+  }
+  try {
+    return { ok: true, regex: new RegExp(pattern, flags) };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: err instanceof Error ? err.message : "invalid regex"
+    };
+  }
+}
+
+// src/utils/safe-json.ts
+function safeParse(input, maxBytes = 5e6) {
+  if (input.length > maxBytes) {
+    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
+  }
+  try {
+    return { ok: true, value: JSON.parse(input) };
+  } catch (err) {
+    return {
+      ok: false,
+      error: toErrorMessage(err)
+    };
+  }
+}
+
+// src/utils/sleep.ts
+function sleep(ms) {
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
+}
+
+// src/utils/string.ts
+function truncate(s, max) {
+  return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
+}
+
+// src/utils/tool-wire-compact.ts
+var TOOL_DESCRIPTION_MAX_CHARS = 640;
+var SCHEMA_DESCRIPTION_MAX_CHARS = 180;
+var compactCache = /* @__PURE__ */ new WeakMap();
+function compactToolDefinitionForWire(tool, opts = {}) {
+  const useDefaultOptions = opts.descriptionMaxChars === void 0 && opts.schemaDescriptionMaxChars === void 0;
+  if (useDefaultOptions && typeof tool === "object" && tool !== null) {
+    const cached = compactCache.get(tool);
+    if (cached) return cached;
+  }
+  const compact = {
+    name: tool.name,
+    description: compactDescription(
+      tool.description ?? "",
+      opts.descriptionMaxChars ?? TOOL_DESCRIPTION_MAX_CHARS
+    ),
+    inputSchema: compactSchemaDescriptions(
+      tool.inputSchema,
+      opts.schemaDescriptionMaxChars ?? SCHEMA_DESCRIPTION_MAX_CHARS
+    )
+  };
+  if (useDefaultOptions && typeof tool === "object" && tool !== null) {
+    compactCache.set(tool, compact);
+  }
+  return compact;
+}
+function compactSchemaDescriptions(schema, maxDescriptionChars = SCHEMA_DESCRIPTION_MAX_CHARS) {
+  const compact = compactSchemaNode(schema, maxDescriptionChars);
+  return isRecord(compact) ? compact : { type: "object", properties: {} };
+}
+function compactSchemaNode(node, maxDescriptionChars) {
+  if (Array.isArray(node)) {
+    return node.map((item) => compactSchemaNode(item, maxDescriptionChars));
+  }
+  if (!isRecord(node)) return node;
+  const out = {};
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "description" && typeof value === "string") {
+      out[key] = compactDescription(value, maxDescriptionChars);
+    } else {
+      out[key] = compactSchemaNode(value, maxDescriptionChars);
+    }
+  }
+  return out;
+}
+function compactDescription(text, maxChars) {
+  const normalized = text.replace(/\s+/g, " ").trim();
+  if (normalized.length <= maxChars) return normalized;
+  if (maxChars <= 20) return normalized.slice(0, maxChars);
+  const hardLimit = maxChars - 12;
+  const boundary = findSemanticBoundary(normalized, hardLimit);
+  const head = normalized.slice(0, boundary > 0 ? boundary : hardLimit).trimEnd();
+  return `${head} ...`;
+}
+function findSemanticBoundary(text, limit) {
+  const punctuation = Math.max(
+    text.lastIndexOf(". ", limit),
+    text.lastIndexOf("; ", limit),
+    text.lastIndexOf(": ", limit)
+  );
+  if (punctuation >= Math.floor(limit * 0.45)) return punctuation + 1;
+  const comma = text.lastIndexOf(", ", limit);
+  if (comma >= Math.floor(limit * 0.6)) return comma + 1;
+  const space = text.lastIndexOf(" ", limit);
+  return space >= Math.floor(limit * 0.6) ? space : limit;
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/utils/token-estimate.ts
+var RoughTokenEstimate = (text, charsPerToken = 3.5) => Math.max(1, Math.ceil(text.length / charsPerToken));
+var CALIBRATION_GLOBAL_KEY = "__global__";
+var _cals = /* @__PURE__ */ new Map();
+function calState(key) {
+  let state = _cals.get(key);
+  if (!state) {
+    state = { ratio: 1, count: 0, prevEst: 0 };
+    _cals.set(key, state);
+  }
+  return state;
+}
+var MIN_SAMPLES_FOR_CALIBRATION = 3;
+var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
+var ESTIMATE_CACHE_MAX_SIZE = 1e4;
+function getCachedEstimate(key, compute) {
+  const existing = ESTIMATE_CACHE.get(key);
+  if (existing !== void 0) return existing;
+  if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
+    for (const k of ESTIMATE_CACHE.keys()) {
+      if (ESTIMATE_CACHE.size <= Math.floor(ESTIMATE_CACHE_MAX_SIZE / 2)) break;
+      ESTIMATE_CACHE.delete(k);
+    }
+  }
+  const estimate = compute(key);
+  ESTIMATE_CACHE.set(key, estimate);
+  return estimate;
+}
+function estimateToolInputTokens(input) {
+  if (typeof input === "string") return RoughTokenEstimate(input);
+  if (input === null || typeof input !== "object") {
+    return RoughTokenEstimate(String(input));
+  }
+  return getCachedEstimate(JSON.stringify(input), (key) => RoughTokenEstimate(key));
+}
+function estimateToolResultTokens(content) {
+  if (typeof content === "string") return RoughTokenEstimate(content);
+  return getCachedEstimate(JSON.stringify(content), (key) => RoughTokenEstimate(key));
+}
+function estimateTextTokens(text) {
+  return RoughTokenEstimate(text);
+}
+function computeMessageTokens(msg) {
+  if (typeof msg.content === "string") return estimateTextTokens(msg.content);
+  let total = 0;
+  for (const b of msg.content) {
+    if (b.type === "text") total += estimateTextTokens(b.text);
+    else if (b.type === "tool_use") total += estimateToolInputTokens(b.input);
+    else if (b.type === "tool_result") total += estimateToolResultTokens(b.content);
+    else total += RoughTokenEstimate(JSON.stringify(b));
+  }
+  return total;
 }
 function estimateMessageTokens(messages) {
   let total = 0;
@@ -783,7 +1225,8 @@ function estimateMessageTokens(messages) {
 function estimateToolDefTokens(tool) {
   const cached = tool._estDefTokens;
   if (typeof cached === "number" && cached > 0) return cached;
-  return RoughTokenEstimate(tool.name) + RoughTokenEstimate(tool.description ?? "") + RoughTokenEstimate(JSON.stringify(tool.inputSchema));
+  const compact = compactToolDefinitionForWire(tool);
+  return RoughTokenEstimate(tool.name) + RoughTokenEstimate(compact.description) + RoughTokenEstimate(JSON.stringify(compact.inputSchema));
 }
 function estimateRequestTokens(messages, systemPrompt, tools, calibrationKey = CALIBRATION_GLOBAL_KEY) {
   let messagesTokens = 0;
@@ -860,406 +1303,702 @@ function estimateRequestTokensCalibrated(messages, systemPrompt, tools, calibrat
   return result;
 }
 
-// src/utils/json-schema-validate.ts
-function validateAgainstSchema(value, schema) {
-  const errors = [];
-  walk(value, schema, "", errors);
-  return { ok: errors.length === 0, errors };
-}
-function walk(value, schema, path19, errors) {
-  if (schema.enum !== void 0) {
-    if (!schema.enum.some((e) => deepEqual(e, value))) {
-      errors.push({
-        path: path19 || "<root>",
-        message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
-      });
-      return;
-    }
-  }
-  if (typeof schema.type === "string") {
-    if (!checkType(value, schema.type)) {
-      errors.push({
-        path: path19 || "<root>",
-        message: `expected ${schema.type}, got ${describeType(value)}`
-      });
-      return;
-    }
-  }
-  if (schema.type === "object" && isPlainObject(value)) {
-    const obj = value;
-    for (const req of schema.required ?? []) {
-      if (!(req in obj)) {
-        errors.push({ path: joinPath(path19, req), message: "required property missing" });
-      }
-    }
-    if (schema.properties) {
-      for (const [key, subSchema] of Object.entries(schema.properties)) {
-        if (key in obj) {
-          walk(obj[key], subSchema, joinPath(path19, key), errors);
-        }
-      }
-    }
-  }
-  if (schema.type === "array" && Array.isArray(value) && schema.items) {
-    for (let i = 0; i < value.length; i++) {
-      walk(value[i], schema.items, `${path19}[${i}]`, errors);
-    }
-  }
-}
-function checkType(value, type) {
-  switch (type) {
-    case "string":
-      return typeof value === "string";
-    case "number":
-      return typeof value === "number" && !Number.isNaN(value);
-    case "integer":
-      return typeof value === "number" && Number.isInteger(value);
-    case "boolean":
-      return typeof value === "boolean";
-    case "null":
-      return value === null;
-    case "array":
-      return Array.isArray(value);
-    case "object":
-      return isPlainObject(value);
-    default:
-      return true;
-  }
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function describeType(v) {
-  if (v === null) return "null";
-  if (Array.isArray(v)) return "array";
-  return typeof v;
-}
-function joinPath(parent, key) {
-  if (!parent) return key;
-  return `${parent}.${key}`;
-}
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (typeof a !== typeof b) return false;
-  if (a === null || b === null) return a === b;
-  if (Array.isArray(a) && Array.isArray(b)) {
-    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
-  }
-  if (typeof a === "object" && typeof b === "object") {
-    const ak = Object.keys(a);
-    const bk = Object.keys(b);
-    if (ak.length !== bk.length) return false;
-    return ak.every(
-      (k) => deepEqual(a[k], b[k])
-    );
-  }
-  return false;
-}
-
-// src/utils/regex-guard.ts
-var MAX_PATTERN_LEN = 512;
-var DANGEROUS_PATTERNS = [
-  /(\([^)]*[+*][^)]*\))[+*]/,
-  // (a+)+, (.*)+, etc
-  /(\(\?:[^)]*[+*][^)]*\))[+*]/
-  // same, with non-capturing group
-];
-function compileUserRegex(pattern, flags) {
-  if (typeof pattern !== "string") {
-    return { ok: false, reason: "pattern must be a string" };
-  }
-  if (pattern.length === 0) {
-    return { ok: false, reason: "pattern is empty" };
-  }
-  if (pattern.length > MAX_PATTERN_LEN) {
-    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
-  }
-  for (const rx of DANGEROUS_PATTERNS) {
-    if (rx.test(pattern)) {
-      return {
-        ok: false,
-        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
-      };
-    }
-  }
-  try {
-    return { ok: true, regex: new RegExp(pattern, flags) };
-  } catch (err) {
-    return {
-      ok: false,
-      reason: err instanceof Error ? err.message : "invalid regex"
-    };
-  }
-}
-var GLOB_CHARS = /* @__PURE__ */ new Set(["*", "?", "["]);
-var IS_WINDOWS = process.platform === "win32";
-var SEP = IS_WINDOWS ? "\\" : "/";
-function isGlob(p) {
-  for (const c of p) {
-    if (GLOB_CHARS.has(c)) return true;
-  }
-  return false;
-}
-function globToRegex(pat) {
-  let i = 0;
-  let re = "^";
-  while (i < pat.length) {
-    const c = expectDefined(pat[i]);
-    if (c === "*") {
-      if (pat[i + 1] === "*") {
-        re += ".*";
-        i += 2;
-        if (pat[i] === "/") i++;
-      } else {
-        re += "[^/\\\\]*";
-        i++;
-      }
-    } else if (c === "?") {
-      re += "[^/\\\\]";
-      i++;
-    } else if (c === "[") {
-      let cls = "[";
-      i++;
-      if (pat[i] === "!" || pat[i] === "^") {
-        cls += "^";
-        i++;
-      }
-      while (i < pat.length && pat[i] !== "]") {
-        const ch = pat[i] ?? "";
-        if (ch === "\\") cls += "\\\\";
-        else if (ch === "]" || ch === "^") cls += `\\${ch}`;
-        else cls += ch;
-        i++;
-      }
-      cls += "]";
-      re += cls;
-      i++;
-    } else {
-      re += c.replace(/[.+^${}()|\\]/g, "\\$&");
-      i++;
-    }
-  }
-  return new RegExp(re + "$");
-}
-function baseDir(pat) {
-  let i = pat.length - 1;
-  while (i >= 0 && !GLOB_CHARS.has(expectDefined(pat[i])) && pat[i] !== SEP && pat[i] !== "/") i--;
-  const cut = i >= 0 ? pat.lastIndexOf(SEP, i) : pat.lastIndexOf("/", i);
-  return cut < 0 ? "." : pat.slice(0, cut);
-}
-async function expandGlob(pattern) {
-  if (!isGlob(pattern)) return [pattern];
-  const results = /* @__PURE__ */ new Set();
-  const abs = isAbsolute(pattern);
-  const base = abs ? baseDir(pattern) : baseDir(pattern);
-  const relPat = base === "." ? pattern : pattern.slice(base.length + 1);
-  async function walk3(dir, pat) {
-    let entries;
-    try {
-      entries = await fsp2.readdir(dir);
-    } catch {
-      return;
-    }
-    const firstGlob = pat.search(/[*?[[]/);
-    if (firstGlob < 0) {
-      const re = globToRegex(pat);
-      for (const e of entries) {
-        if (re.test(e)) {
-          const full = `${dir}${SEP}${e}`;
-          results.add(abs ? resolve(full) : full);
-        }
-      }
-      return;
-    }
-    const before = pat.slice(0, firstGlob);
-    const rest = pat.slice(firstGlob);
-    if (before.endsWith("**")) {
-      await walk3(dir, rest);
-      for (const e of entries) {
-        const full = `${dir}${SEP}${e}`;
-        try {
-          const stat6 = await fsp2.stat(full);
-          if (stat6.isDirectory()) await walk3(full, rest);
-        } catch {
-        }
+// src/utils/tool-output-serializer.ts
+var DEFAULT_LIST_LIMIT = 500;
+var LOG_ENTRY_LIMIT = 200;
+var INLINE_LIMIT = 240;
+var GREP_FILE_LIMIT = 80;
+var GREP_MATCHES_PER_FILE = 3;
+var DIFF_INLINE_LINE_LIMIT = 260;
+var DIFF_HUNK_LIMIT = 8;
+var DIFF_HUNK_CONTEXT = 14;
+function createToolOutputSerializer(opts = {}) {
+  const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
+  function serialize(value, context = {}) {
+    if (typeof value === "string") return value;
+    if (value === null || value === void 0) return "";
+    if (typeof value === "object") {
+      if (Array.isArray(value)) return value.map((item) => serialize(item)).join("\n");
+      if (context.toolName) {
+        const compact = renderToolObject(context.toolName, value, context.input);
+        if (compact !== void 0) return compact;
+        return renderGenericToolObject(context.toolName, value);
       }
-    } else if (before === "") {
-      const re = globToRegex(rest);
-      for (const e of entries) {
-        if (re.test(e)) {
-          const full = `${dir}${SEP}${e}`;
-          results.add(abs ? resolve(full) : full);
-        }
+      if ("text" in value) {
+        const t = value.text;
+        return typeof t === "string" ? t : JSON.stringify(value, null, 2);
       }
-    } else {
-      const seg = before.replace(/[*?[\]]/g, "").replace(/\/$/, "");
-      if (entries.includes(seg)) {
-        const full = `${dir}${SEP}${seg}`;
-        try {
-          const stat6 = await fsp2.stat(full);
-          if (stat6.isDirectory()) await walk3(full, rest);
-        } catch {
-        }
+      try {
+        return JSON.stringify(value, null, 2);
+      } catch {
+        return String(value);
       }
     }
+    return String(value);
   }
-  await walk3(base === "." ? "." : base, relPat);
-  return [...results];
-}
-
-// src/utils/json-repair.ts
-function completePartialObject(s) {
-  if (!s.trim().startsWith("{")) return s;
-  if (tryParse(s).ok) return s;
-  return repairTruncated(s);
-}
-function repairTruncated(s) {
-  const stack = [];
-  let inString = false;
-  let escaped = false;
-  let sawKey = false;
-  let prevSig = "";
-  let contentEnd = 0;
-  let stringBraceDepth = 0;
-  for (let i = 0; i < s.length; i++) {
-    const ch = expectDefined(s[i]);
-    if (inString) {
-      contentEnd = i + 1;
-      if (escaped) {
-        escaped = false;
-        continue;
-      }
-      if (ch === "\\") {
-        escaped = true;
-        continue;
-      }
-      if (ch === '"') {
-        inString = false;
-        prevSig = '"';
-        stringBraceDepth = 0;
-        continue;
-      }
-      if (ch === "{") stringBraceDepth++;
-      else if (ch === "}" && stringBraceDepth > 0) stringBraceDepth--;
-      continue;
+  function enforceCap(text, remainingBudget) {
+    if (remainingBudget <= 0) {
+      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
     }
-    if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") continue;
-    contentEnd = i + 1;
-    if (ch === '"') {
-      inString = true;
-      sawKey = true;
-      stringBraceDepth = 0;
-      prevSig = '"';
-    } else if (ch === "{" || ch === "[") {
-      stack.push(ch);
-      prevSig = ch;
-    } else if (ch === "}" || ch === "]") {
-      stack.pop();
-      prevSig = ch;
-    } else {
-      prevSig = ch;
+    const textBytes = Buffer.byteLength(text, "utf8");
+    if (textBytes <= remainingBudget) {
+      return { text, newBudget: remainingBudget - textBytes };
+    }
+    const marker = `
+\u2026[truncated ${textBytes - remainingBudget} bytes]\u2026
+`;
+    const markerBytes = Buffer.byteLength(marker, "utf8");
+    const available = remainingBudget - markerBytes;
+    if (available <= 0) {
+      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
     }
+    const half = Math.floor(available / 2);
+    const first = text.slice(0, half);
+    const second = text.slice(text.length - half);
+    return { text: `${first}${marker}${second}`, newBudget: 0 };
   }
-  if (!sawKey && !inString) return s;
-  let result = s.slice(0, contentEnd);
-  if (inString) {
-    if (escaped) {
-      result = result.slice(0, -1);
-    } else if (endsWithInvalidEscape(result)) {
-      result = result.slice(0, -2);
+  return { serialize, enforceCap, capBytes };
+}
+function renderToolObject(toolName, obj, input) {
+  if (toolName === "read" && typeof obj["text"] === "string") {
+    return joinSections([
+      renderHeader(
+        `read: ${stringFromInput(input, "path") ?? stringField(obj, "path") ?? "<unknown>"}`,
+        {
+          offset: numberFromInput(input, "offset"),
+          limit: numberFromInput(input, "limit"),
+          total_lines: obj["total_lines"],
+          encoding: obj["encoding"],
+          truncated: obj["truncated"],
+          cached: obj["cached"],
+          note: obj["note"]
+        }
+      ),
+      obj["text"]
+    ]);
+  }
+  if (toolName === "grep" && Array.isArray(obj["matches"])) {
+    const matches = stringArrayField(obj, "matches");
+    return joinSections([
+      renderHeader(`grep: ${stringFromInput(input, "pattern") ?? "<pattern>"}`, {
+        path: stringFromInput(input, "path"),
+        glob: stringFromInput(input, "glob"),
+        mode: stringFromInput(input, "output_mode"),
+        count: obj["count"],
+        shown: matches.length,
+        truncated: obj["truncated"],
+        used: obj["used"]
+      }),
+      renderGrepMatches(matches, stringFromInput(input, "output_mode"))
+    ]);
+  }
+  if (toolName === "patch" && Array.isArray(obj["files"])) {
+    const files = stringArrayField(obj, "files");
+    return joinSections([
+      renderHeader("patch", {
+        applied: obj["applied"],
+        rejected: obj["rejected"],
+        files: files.length,
+        dry_run: obj["dry_run"]
+      }),
+      typeof obj["message"] === "string" ? `message:
+${obj["message"]}` : void 0,
+      files.length > 0 ? `files:
+${renderStringList(files)}` : void 0
+    ]);
+  }
+  if (toolName === "glob" && Array.isArray(obj["files"])) {
+    const files = stringArrayField(obj, "files");
+    return joinSections([
+      renderHeader(
+        `${toolName}: ${stringFromInput(input, "pattern") ?? stringFromInput(input, "files") ?? stringFromInput(input, "path") ?? ""}`.trim(),
+        {
+          path: stringFromInput(input, "path"),
+          files: files.length,
+          truncated: obj["truncated"]
+        }
+      ),
+      renderStringList(files, "(no files)")
+    ]);
+  }
+  if (toolName === "tree" && typeof obj["tree"] === "string") {
+    return joinSections([
+      renderHeader(
+        `tree: ${stringField(obj, "path") ?? stringFromInput(input, "path") ?? "<cwd>"}`,
+        {
+          total_files: obj["total_files"],
+          total_dirs: obj["total_dirs"],
+          truncated: obj["truncated"]
+        }
+      ),
+      obj["tree"]
+    ]);
+  }
+  if (toolName === "fetch" && typeof obj["content"] === "string") {
+    return joinSections([
+      renderHeader(
+        `fetch: ${stringField(obj, "url") ?? stringFromInput(input, "url") ?? "<url>"}`,
+        {
+          status: obj["status"],
+          content_type: obj["content_type"]
+        }
+      ),
+      obj["content"]
+    ]);
+  }
+  if (toolName === "replace" && Array.isArray(obj["results"])) {
+    const results = obj["results"].filter(isRecord2);
+    const sections = [
+      renderHeader("replace", {
+        files_modified: obj["files_modified"],
+        total_replacements: obj["total_replacements"],
+        dry_run: obj["dry_run"]
+      })
+    ];
+    for (const r of results.slice(0, DEFAULT_LIST_LIMIT)) {
+      sections.push(
+        joinSections([
+          renderHeader(`file: ${stringField(r, "path") ?? "<unknown>"}`, {
+            replacements: r["replacements"]
+          }),
+          typeof r["diff"] === "string" ? r["diff"] : void 0
+        ])
+      );
     }
-    if (stringBraceDepth > 0) result += "}".repeat(stringBraceDepth);
-    result += '"';
-  } else if (prevSig === ":") {
-    result += "null";
+    if (results.length > DEFAULT_LIST_LIMIT) {
+      sections.push(`[serializer omitted ${results.length - DEFAULT_LIST_LIMIT} result item(s)]`);
+    }
+    return joinSections(sections);
+  }
+  if (typeof obj["diff"] === "string") {
+    const diff = obj["diff"];
+    return joinSections([
+      renderHeader(toolName, {
+        path: obj["path"],
+        replacements: obj["replacements"],
+        bytes_written: obj["bytes_written"],
+        created: obj["created"],
+        note: obj["note"],
+        files: Array.isArray(obj["files"]) ? obj["files"].length : void 0,
+        truncated: obj["truncated"],
+        mode: obj["mode"]
+      }),
+      compactDiff(diff)
+    ]);
   }
-  for (let k = stack.length - 1; k >= 0; k--) {
-    result += stack[k] === "{" ? "}" : "]";
+  if (toolName === "test" && typeof obj["output"] === "string") {
+    return renderTestOutput(obj, input);
   }
-  if (!tryParse(result).ok) {
-    const patched = result.replace(/:(\s*)([}\]])/g, ":null$2");
-    if (tryParse(patched).ok) result = patched;
+  if ((toolName === "typecheck" || toolName === "lint" || toolName === "format") && typeof obj["output"] === "string") {
+    return renderVerifierOutput(toolName, obj, input);
   }
-  return result;
-}
-var VALID_ESCAPE = /* @__PURE__ */ new Set(['"', "\\", "/", "b", "f", "n", "r", "t", "u"]);
-function endsWithInvalidEscape(str) {
-  const last = str[str.length - 1];
-  if (str[str.length - 2] !== "\\" || last === void 0) return false;
-  if (VALID_ESCAPE.has(last)) return false;
-  let backslashes = 0;
-  for (let k = str.length - 2; k >= 0 && str[k] === "\\"; k--) backslashes++;
-  return backslashes % 2 === 1;
-}
-function tryParse(s) {
-  try {
-    return { ok: true, value: JSON.parse(s) };
-  } catch {
-    return { ok: false };
+  if (hasCommandOutputShape(obj)) {
+    return renderCommandOutput(toolName, obj, input);
   }
-}
-
-// src/utils/merge-models-payload.ts
-function mergeModelsPayload(base, overlay) {
-  const out = {};
-  for (const [id, provider] of Object.entries(base)) {
-    out[id] = cloneProvider(provider);
+  if (toolName === "json" && typeof obj["formatted"] === "string") {
+    return joinSections([
+      renderHeader("json", {
+        type: obj["type"],
+        keys: Array.isArray(obj["keys"]) ? obj["keys"].length : void 0,
+        query: stringFromInput(input, "query"),
+        error: obj["error"]
+      }),
+      obj["formatted"]
+    ]);
   }
-  for (const [id, ovProvider] of Object.entries(overlay)) {
-    const existing = out[id];
-    out[id] = existing ? mergeProvider(existing, ovProvider) : cloneProvider(ovProvider);
+  if (toolName === "logs" && Array.isArray(obj["entries"])) {
+    const entries = obj["entries"].filter(isRecord2);
+    const lines = entries.slice(0, LOG_ENTRY_LIMIT).map((entry) => {
+      const ts = stringField(entry, "timestamp") ?? "";
+      const level = stringField(entry, "level") ?? "info";
+      const message = stringField(entry, "message") ?? "";
+      const source = stringField(entry, "source");
+      return [ts, level, source, message].filter(Boolean).join(" ");
+    });
+    if (entries.length > LOG_ENTRY_LIMIT) {
+      lines.push(`[serializer omitted ${entries.length - LOG_ENTRY_LIMIT} log entry item(s)]`);
+    }
+    return joinSections([
+      renderHeader(`logs: ${stringField(obj, "source") ?? "<source>"}`, {
+        total: obj["total"],
+        shown: Math.min(entries.length, LOG_ENTRY_LIMIT),
+        truncated: obj["truncated"],
+        stream_mode: obj["stream_mode"]
+      }),
+      lines.length > 0 ? lines.join("\n") : "(no log entries)"
+    ]);
   }
-  return out;
-}
-function mergeProvider(base, overlay) {
-  const models = {};
-  for (const [mid, m] of Object.entries(base.models ?? {})) {
-    models[mid] = { ...m };
+  if (toolName === "audit" && Array.isArray(obj["vulnerabilities"])) {
+    const vulns = obj["vulnerabilities"].filter(isRecord2);
+    const lines = vulns.slice(0, DEFAULT_LIST_LIMIT).map((v) => {
+      const severity = stringField(v, "severity") ?? "unknown";
+      const pkg = stringField(v, "package") ?? "<package>";
+      const title = stringField(v, "title") ?? "";
+      const url = stringField(v, "url");
+      return [severity, pkg, title, url].filter(Boolean).join(" | ");
+    });
+    if (vulns.length > DEFAULT_LIST_LIMIT) {
+      lines.push(`[serializer omitted ${vulns.length - DEFAULT_LIST_LIMIT} vulnerability item(s)]`);
+    }
+    return joinSections([
+      renderHeader("audit", {
+        exit_code: obj["exit_code"],
+        total: obj["total"],
+        summary: obj["summary"],
+        truncated: obj["truncated"]
+      }),
+      lines.length > 0 ? lines.join("\n") : stringField(obj, "output")
+    ]);
   }
-  for (const [mid, ovModel] of Object.entries(overlay.models ?? {})) {
-    const existing = models[mid];
-    models[mid] = existing ? mergeModel(existing, ovModel) : { ...ovModel };
+  if (toolName === "outdated" && Array.isArray(obj["packages"])) {
+    const packages = obj["packages"].filter(isRecord2);
+    const lines = packages.slice(0, DEFAULT_LIST_LIMIT).map(
+      (p) => [
+        stringField(p, "name") ?? "<package>",
+        `current=${stringField(p, "current") ?? "unknown"}`,
+        `wanted=${stringField(p, "wanted") ?? "unknown"}`,
+        `latest=${stringField(p, "latest") ?? "unknown"}`,
+        stringField(p, "type")
+      ].filter(Boolean).join(" | ")
+    );
+    if (packages.length > DEFAULT_LIST_LIMIT) {
+      lines.push(`[serializer omitted ${packages.length - DEFAULT_LIST_LIMIT} package item(s)]`);
+    }
+    return joinSections([
+      renderHeader("outdated", {
+        exit_code: obj["exit_code"],
+        total: obj["total"],
+        truncated: obj["truncated"]
+      }),
+      lines.length > 0 ? lines.join("\n") : stringField(obj, "output")
+    ]);
   }
-  return {
-    ...base,
-    // Overlay scalar fields win when explicitly provided; otherwise keep base.
-    ...stripUndefined({
-      id: overlay.id,
-      name: overlay.name,
-      npm: overlay.npm,
-      api: overlay.api,
-      env: overlay.env,
-      doc: overlay.doc
-    }),
-    models
-  };
+  return void 0;
 }
-function mergeModel(base, overlay) {
-  const merged = { ...base, ...overlay };
-  if (base.limit || overlay.limit) {
-    merged.limit = { ...base.limit, ...overlay.limit };
+function renderTestOutput(obj, input) {
+  const exitCode = numberField(obj, "exit_code") ?? 0;
+  const failed = numberField(obj, "failed") ?? 0;
+  const output = stringField(obj, "output") ?? "";
+  const header = renderHeader(`test: ${stringField(obj, "runner") ?? "runner"}`, {
+    exit_code: obj["exit_code"],
+    tests_run: obj["tests_run"],
+    passed: obj["passed"],
+    failed: obj["failed"],
+    duration_ms: obj["duration_ms"],
+    truncated: obj["truncated"],
+    files: inputListSummary(input, "files"),
+    grep: stringFromInput(input, "grep")
+  });
+  if (exitCode === 0 && failed === 0) {
+    return joinSections([
+      header,
+      joinSections([
+        "report:",
+        `status=passed`,
+        `tests_run=${obj["tests_run"] ?? 0}`,
+        `passed=${obj["passed"] ?? 0}`,
+        `failed=${obj["failed"] ?? 0}`,
+        `duration_ms=${obj["duration_ms"] ?? 0}`,
+        extractSpoolNote(output)
+      ])
+    ]);
   }
-  if (base.cost || overlay.cost) {
-    merged.cost = { ...base.cost, ...overlay.cost };
+  return joinSections([
+    header,
+    `error_context:
+${compactFailureOutput(output || "(no runner output)")}`
+  ]);
+}
+function renderVerifierOutput(toolName, obj, input) {
+  const exitCode = numberField(obj, "exit_code") ?? 0;
+  const errors = numberField(obj, "errors") ?? 0;
+  const warnings = numberField(obj, "warnings") ?? 0;
+  const output = stringField(obj, "output") ?? "";
+  const changed = numberField(obj, "files_changed") ?? 0;
+  const header = renderHeader(toolName, {
+    exit_code: obj["exit_code"],
+    errors: obj["errors"],
+    warnings: obj["warnings"],
+    files_checked: obj["files_checked"],
+    files_changed: obj["files_changed"],
+    fix_applied: obj["fix_applied"],
+    fixer: obj["fixer"],
+    linter: obj["linter"],
+    project: obj["project"],
+    truncated: obj["truncated"],
+    files: inputListSummary(input, "files"),
+    cwd: stringFromInput(input, "cwd")
+  });
+  if (exitCode === 0 && errors === 0 && (toolName !== "format" || changed === 0)) {
+    return joinSections([
+      header,
+      joinSections([
+        "report:",
+        "status=passed",
+        `errors=${errors}`,
+        `warnings=${warnings}`,
+        toolName === "format" ? `files_changed=${changed}` : void 0,
+        extractSpoolNote(output)
+      ])
+    ]);
   }
-  if (base.modalities || overlay.modalities) {
-    merged.modalities = { ...base.modalities, ...overlay.modalities };
+  if (exitCode === 0 && toolName === "format") {
+    return joinSections([
+      header,
+      joinSections([
+        "report:",
+        "status=changed",
+        `files_changed=${changed}`,
+        extractSpoolNote(output)
+      ])
+    ]);
   }
-  return merged;
+  return joinSections([
+    header,
+    `error_context:
+${compactFailureOutput(output || "(no verifier output)")}`
+  ]);
 }
-function cloneProvider(p) {
-  const models = {};
-  for (const [mid, m] of Object.entries(p.models ?? {})) {
-    models[mid] = { ...m };
+function renderGrepMatches(matches, mode) {
+  if (matches.length === 0) return "(no matches)";
+  if (mode === "files_with_matches") return renderStringList(matches, "(no files)");
+  if (mode === "count") return renderStringList(matches, "(no counts)");
+  const groups = /* @__PURE__ */ new Map();
+  const passthrough = [];
+  for (const match of matches) {
+    const parsed = parseGrepContentLine(match);
+    if (!parsed) {
+      passthrough.push(match);
+      continue;
+    }
+    const list = groups.get(parsed.file) ?? [];
+    list.push(`${parsed.line}:${parsed.text}`);
+    groups.set(parsed.file, list);
   }
-  return { ...p, models };
+  if (groups.size === 0) return renderStringList(matches, "(no matches)");
+  const sections = [];
+  let fileIndex = 0;
+  for (const [file, lines] of groups) {
+    fileIndex++;
+    if (fileIndex > GREP_FILE_LIMIT) break;
+    const shown = lines.slice(0, GREP_MATCHES_PER_FILE);
+    sections.push(
+      `${file} (${lines.length} match(es), showing ${shown.length})
+${shown.join("\n")}`
+    );
+  }
+  if (groups.size > GREP_FILE_LIMIT) {
+    sections.push(`[serializer omitted ${groups.size - GREP_FILE_LIMIT} file group(s)]`);
+  }
+  if (passthrough.length > 0) {
+    sections.push(`ungrouped:
+${renderStringList(passthrough, "", 50)}`);
+  }
+  return sections.join("\n");
+}
+function parseGrepContentLine(line) {
+  const match = /^(.+?):(\d+):(.*)$/.exec(line);
+  if (!match?.[1] || !match[2]) return void 0;
+  return { file: match[1], line: match[2], text: match[3] ?? "" };
+}
+function compactDiff(diff) {
+  const lines = diff.split(/\r?\n/);
+  if (lines.length <= DIFF_INLINE_LINE_LIMIT) return diff;
+  const fileCount = Math.max(
+    new Set(
+      lines.map(
+        (line) => /^diff --git\s+a\/(.+?)\s+b\//.exec(line)?.[1] ?? /^---\s+(.+)/.exec(line)?.[1]
+      ).filter(Boolean)
+    ).size,
+    0
+  );
+  const hunks = lines.filter((line) => line.startsWith("@@")).length;
+  const added = lines.filter((line) => line.startsWith("+") && !line.startsWith("+++")).length;
+  const removed = lines.filter((line) => line.startsWith("-") && !line.startsWith("---")).length;
+  const selected = /* @__PURE__ */ new Set();
+  let hunkCount = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    if (line.startsWith("diff --git") || line.startsWith("--- ") || line.startsWith("+++ ")) {
+      selected.add(i);
+      continue;
+    }
+    if (!line.startsWith("@@")) continue;
+    if (hunkCount >= DIFF_HUNK_LIMIT) continue;
+    hunkCount++;
+    for (let j = i; j <= Math.min(lines.length - 1, i + DIFF_HUNK_CONTEXT); j++) {
+      selected.add(j);
+    }
+  }
+  if (selected.size === 0) {
+    return joinSections([
+      renderHeader("diff_summary", {
+        files: fileCount,
+        hunks,
+        added,
+        removed,
+        lines: lines.length
+      }),
+      lines.slice(0, DIFF_INLINE_LINE_LIMIT).join("\n"),
+      `[serializer omitted ${Math.max(0, lines.length - DIFF_INLINE_LINE_LIMIT)} diff line(s)]`
+    ]);
+  }
+  const excerpt = [];
+  let previous = -1;
+  for (const index of [...selected].sort((a, b) => a - b)) {
+    if (index > previous + 1) {
+      const omitted = previous === -1 ? index : index - previous - 1;
+      excerpt.push(`[serializer omitted ${omitted} diff line(s)]`);
+    }
+    excerpt.push(lines[index] ?? "");
+    previous = index;
+  }
+  const trailing = lines.length - previous - 1;
+  if (trailing > 0) excerpt.push(`[serializer omitted ${trailing} trailing diff line(s)]`);
+  return joinSections([
+    renderHeader("diff_summary", {
+      files: fileCount,
+      hunks,
+      shown_hunks: Math.min(hunks, DIFF_HUNK_LIMIT),
+      added,
+      removed,
+      lines: lines.length
+    }),
+    excerpt.join("\n")
+  ]);
+}
+function compactFailureOutput(output) {
+  const lines = output.split(/\r?\n/);
+  if (lines.length <= 260) return output.trimEnd();
+  const selected = /* @__PURE__ */ new Set();
+  const marker = /\b(fail|failed|failure|error|exception|assertionerror|expected|received|actual|timeout|stack)\b/i;
+  let markerHits = 0;
+  for (let i = 0; i < lines.length; i++) {
+    if (!marker.test(lines[i] ?? "")) continue;
+    markerHits++;
+    for (let j = Math.max(0, i - 4); j <= Math.min(lines.length - 1, i + 10); j++) {
+      selected.add(j);
+    }
+  }
+  if (markerHits === 0) {
+    return lines.slice(-220).join("\n").trimEnd();
+  }
+  const ordered = [...selected].sort((a, b) => a - b);
+  const out = [];
+  let previous = -1;
+  for (const index of ordered) {
+    if (index > previous + 1) {
+      const omitted = previous === -1 ? index : index - previous - 1;
+      out.push(`[serializer omitted ${omitted} line(s)]`);
+    }
+    out.push(lines[index] ?? "");
+    previous = index;
+  }
+  return out.join("\n").trimEnd();
+}
+function extractSpoolNote(output) {
+  return output.split(/\r?\n/).find((line) => line.startsWith("[output truncated") && line.includes("full"));
+}
+function hasCommandOutputShape(obj) {
+  return typeof obj["stdout"] === "string" || typeof obj["stderr"] === "string" || typeof obj["output"] === "string" || typeof obj["exitCode"] === "number" || typeof obj["exit_code"] === "number";
+}
+function renderCommandOutput(toolName, obj, input) {
+  const command = stringField(obj, "command") ?? stringFromInput(input, "command");
+  const args = stringArrayField(obj, "args");
+  const commandLine = command ? [command, ...args].join(" ") : void 0;
+  const output = stringField(obj, "output");
+  const stdout = stringField(obj, "stdout");
+  const stderr = stringField(obj, "stderr");
+  return joinSections([
+    renderHeader(commandLine ? `${toolName}: ${commandLine}` : toolName, {
+      exit_code: obj["exit_code"] ?? obj["exitCode"],
+      timed_out: obj["timed_out"],
+      pid: obj["pid"],
+      allowed: obj["allowed"],
+      truncated: obj["truncated"],
+      runner: obj["runner"],
+      linter: obj["linter"],
+      fixer: obj["fixer"],
+      project: obj["project"],
+      tests_run: obj["tests_run"],
+      passed: obj["passed"],
+      failed: obj["failed"],
+      duration_ms: obj["duration_ms"],
+      errors: obj["errors"],
+      warnings: obj["warnings"],
+      files_checked: obj["files_checked"],
+      files_changed: obj["files_changed"],
+      fix_applied: obj["fix_applied"]
+    }),
+    stringField(obj, "error") ? `error:
+${stringField(obj, "error")}` : void 0,
+    output ? `output:
+${output}` : void 0,
+    stdout ? `stdout:
+${stdout}` : void 0,
+    stderr ? `stderr:
+${stderr}` : void 0
+  ]);
+}
+function renderGenericToolObject(toolName, obj) {
+  const scalars = {};
+  const blocks = [];
+  for (const [key, value] of Object.entries(obj)) {
+    if (value === void 0) continue;
+    if (isScalar(value)) {
+      const inline = String(value);
+      if (inline.length <= INLINE_LIMIT && !inline.includes("\n")) {
+        scalars[key] = value;
+      } else {
+        blocks.push(`${key}:
+${inline}`);
+      }
+      continue;
+    }
+    if (Array.isArray(value)) {
+      if (value.every((item) => typeof item === "string")) {
+        blocks.push(`${key}:
+${renderStringList(value)}`);
+      } else {
+        blocks.push(`${key}:
+${renderUnknownList(value)}`);
+      }
+      continue;
+    }
+    blocks.push(`${key}: ${clipInline(oneLineJson(value))}`);
+  }
+  return joinSections([renderHeader(toolName, scalars), ...blocks]);
 }
-function stripUndefined(obj) {
-  const out = {};
-  for (const [k, v] of Object.entries(obj)) {
-    if (v !== void 0) out[k] = v;
+function renderHeader(label, fields) {
+  const parts = Object.entries(fields).filter(([, value]) => value !== void 0 && value !== null && value !== "").map(([key, value]) => `${key}=${clipInline(formatInlineValue(value))}`);
+  return parts.length > 0 ? `${label} (${parts.join(" ")})` : label;
+}
+function renderStringList(items, empty = "", limit = DEFAULT_LIST_LIMIT) {
+  if (items.length === 0) return empty;
+  const shown = items.slice(0, limit);
+  const omitted = items.length - shown.length;
+  return [
+    ...shown,
+    ...omitted > 0 ? [`[serializer omitted ${omitted} item(s); narrow the request for more]`] : []
+  ].join("\n");
+}
+function renderUnknownList(items, limit = DEFAULT_LIST_LIMIT) {
+  const shown = items.slice(0, limit).map((item) => clipInline(oneLineJson(item), 1e3));
+  const omitted = items.length - shown.length;
+  if (omitted > 0)
+    shown.push(`[serializer omitted ${omitted} item(s); narrow the request for more]`);
+  return shown.join("\n");
+}
+function joinSections(sections) {
+  return sections.map((section) => typeof section === "string" ? section.trimEnd() : void 0).filter((section) => !!section).join("\n");
+}
+function formatInlineValue(value) {
+  if (Array.isArray(value)) return `[${value.map(formatInlineValue).join(",")}]`;
+  if (isScalar(value)) return String(value);
+  return oneLineJson(value);
+}
+function clipInline(value, max = INLINE_LIMIT) {
+  const compact = value.replace(/\s+/g, " ").trim();
+  return compact.length <= max ? compact : `${compact.slice(0, max - 15)}...(${compact.length} chars)`;
+}
+function oneLineJson(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
   }
-  return out;
+}
+function stringField(obj, key) {
+  const value = obj[key];
+  return typeof value === "string" ? value : void 0;
+}
+function numberField(obj, key) {
+  const value = obj[key];
+  return typeof value === "number" ? value : void 0;
+}
+function stringArrayField(obj, key) {
+  const value = obj[key];
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function stringFromInput(input, key) {
+  if (!isRecord2(input)) return void 0;
+  const value = input[key];
+  return typeof value === "string" ? value : void 0;
+}
+function numberFromInput(input, key) {
+  if (!isRecord2(input)) return void 0;
+  const value = input[key];
+  return typeof value === "number" ? value : void 0;
+}
+function inputListSummary(input, key) {
+  if (!isRecord2(input)) return void 0;
+  const value = input[key];
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value.filter((item) => typeof item === "string").join(",");
+  return void 0;
+}
+function isRecord2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isScalar(value) {
+  return value === null || ["string", "number", "boolean"].includes(typeof value);
+}
+function projectHash(absRoot) {
+  return createHash("sha256").update(path4.resolve(absRoot)).digest("hex").slice(0, 12);
+}
+function projectSlug(absRoot) {
+  const base = slugify(path4.basename(absRoot));
+  const hash = createHash("sha256").update(path4.resolve(absRoot)).digest("hex").slice(0, 6);
+  return `${base}-${hash}`;
+}
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
+}
+function wstackGlobalRoot() {
+  const fromEnv = process.env["WRONGSTACK_HOME"];
+  if (fromEnv && fromEnv.trim().length > 0) return path4.resolve(fromEnv);
+  return path4.join(os.homedir(), ".wrongstack");
+}
+function resolveWstackPaths(opts) {
+  const globalRoot = opts.globalRoot ?? (opts.userHome ? path4.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
+  const hash = projectHash(opts.projectRoot);
+  const slug = projectSlug(opts.projectRoot);
+  const projectDir = path4.join(globalRoot, "projects", slug);
+  return {
+    globalRoot,
+    configDir: globalRoot,
+    globalConfig: path4.join(globalRoot, "config.json"),
+    secretsKey: path4.join(globalRoot, ".key"),
+    globalMemory: path4.join(globalRoot, "memory.md"),
+    globalSkills: path4.join(globalRoot, "skills"),
+    globalPrompts: path4.join(globalRoot, "prompts"),
+    cacheDir: path4.join(globalRoot, "cache"),
+    modelsCache: path4.join(globalRoot, "cache", "models.dev.json"),
+    modelsOverlayCache: path4.join(globalRoot, "cache", "models-overlay.json"),
+    historyFile: path4.join(globalRoot, "history"),
+    logFile: path4.join(globalRoot, "logs", "wrongstack.log"),
+    projectDir,
+    projectCodebaseIndex: path4.join(projectDir, "codebase-index"),
+    projectMemory: path4.join(projectDir, "memory.md"),
+    projectSessions: path4.join(projectDir, "sessions"),
+    projectTrust: path4.join(projectDir, "trust.json"),
+    projectMeta: path4.join(projectDir, "meta.json"),
+    projectLocalConfig: path4.join(projectDir, "config.local.json"),
+    inProjectConfig: path4.join(opts.projectRoot, ".wrongstack", "config.json"),
+    inProjectAgentsFile: path4.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
+    inProjectSkills: path4.join(opts.projectRoot, ".wrongstack", "skills"),
+    inProjectWorktrees: path4.join(opts.projectRoot, ".wrongstack", "worktrees"),
+    projectHash: hash,
+    projectSlug: slug,
+    projectGoal: path4.join(projectDir, "goal.json"),
+    projectSpecs: path4.join(projectDir, "specs"),
+    projectTaskGraphs: path4.join(projectDir, "task-graphs"),
+    projectSddSession: path4.join(projectDir, "sdd-session.json"),
+    projectPlan: path4.join(projectDir, "plan.json"),
+    projectAutophase: path4.join(projectDir, "autophase"),
+    syncConfig: path4.join(globalRoot, "sync.json"),
+    projectStatus: (projectHash2) => path4.join(globalRoot, "projects", projectHash2, "status.json")
+  };
 }
 
 // src/storage/session-store.ts
@@ -1277,11 +2016,34 @@ var DefaultSessionStore = class _DefaultSessionStore {
   dir;
   events;
   secretScrubber;
+  /**
+   * In-memory cache for load() results, keyed by session ID. The cache is
+   * invalidated when the file's mtimeMs or size changes (indicating the
+   * file was written to). This eliminates redundant full-file reads and
+   * JSON parses when the same session is loaded multiple times within the
+   * store's lifetime (e.g., webui session detail views, list() fallbacks).
+   *
+   * Max size is capped to prevent unbounded memory growth in long-running
+   * processes. When the limit is reached, the oldest entry is evicted.
+   */
+  _loadCache = /* @__PURE__ */ new Map();
+  static LOAD_CACHE_MAX_ENTRIES = 50;
   constructor(opts) {
     this.dir = opts.dir;
     this.events = opts.events;
     this.secretScrubber = opts.secretScrubber;
   }
+  /**
+   * Clear the load() cache. Useful for testing or when the caller knows
+   * the file has changed externally (e.g., another process wrote to it).
+   */
+  clearLoadCache(sessionId) {
+    if (sessionId !== void 0) {
+      this._loadCache.delete(sessionId);
+    } else {
+      this._loadCache.clear();
+    }
+  }
   // ── Storage event helpers ───────────────────────────────────────────────────
   emitRead(sessionId, filePath, operation, outcome, durationMs, error) {
     this.events?.emit("storage.read", {
@@ -1318,11 +2080,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
   }
   /** Absolute path to the session index file. */
   get indexFile() {
-    return path3.join(this.dir, "_index.jsonl");
+    return path4.join(this.dir, "_index.jsonl");
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
-    return path3.join(this.dir, `${id}${ext}`);
+    return path4.join(this.dir, `${id}${ext}`);
   }
   /**
    * Ensure the directory implied by the session ID exists. When the ID
@@ -1330,7 +2092,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
    * subdirectory so sessions group naturally by day.
    */
   async ensureShardDir(id) {
-    const dirPath = path3.dirname(path3.join(this.dir, id));
+    const dirPath = path4.dirname(path4.join(this.dir, id));
     await ensureDir(dirPath);
     return dirPath;
   }
@@ -1338,7 +2100,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const id = meta.id && meta.id.length > 0 ? meta.id : generateSessionId(startedAt, meta.model ?? meta.provider);
     const shardDir = await this.ensureShardDir(id);
-    const file = path3.join(shardDir, `${path3.basename(id)}.jsonl`);
+    const file = path4.join(shardDir, `${path4.basename(id)}.jsonl`);
     const t0 = Date.now();
     let handle;
     try {
@@ -1400,7 +2162,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
           // Shard directory (sessions/<date>/) — must match create() so the
           // .summary.json sidecar lands next to the JSONL instead of the
           // sessions root (where summaryFor() would never find it).
-          dir: path3.dirname(file),
+          dir: path4.dirname(file),
           filePath: file,
           secretScrubber: this.secretScrubber,
           onClose: (s) => this.appendToIndex(s)
@@ -1424,7 +2186,20 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const t0 = Date.now();
     let outcome = "success";
     let errorMsg;
+    let cacheHit = false;
     try {
+      let stat6;
+      try {
+        const s = await fsp2.stat(file);
+        stat6 = { mtimeMs: s.mtimeMs, size: s.size };
+      } catch (err) {
+        throw err;
+      }
+      const cached = this._loadCache.get(id);
+      if (cached && cached.mtimeMs === stat6.mtimeMs && cached.size === stat6.size) {
+        cacheHit = true;
+        return cached.data;
+      }
       const raw = await fsp2.readFile(file, "utf8");
       const lines = raw.split("\n").filter((l) => l.trim());
       const events = [];
@@ -1440,13 +2215,30 @@ var DefaultSessionStore = class _DefaultSessionStore {
       const meta = this.metaFromEvents(id, events);
       const { messages, usage } = this.replay(events, id);
       const toolCallEnds = extractToolCallEnds(events);
-      return { metadata: meta, events, messages, usage, toolCallEnds };
+      const data = { metadata: meta, events, messages, usage, toolCallEnds };
+      if (this._loadCache.size >= _DefaultSessionStore.LOAD_CACHE_MAX_ENTRIES) {
+        const oldest = this._loadCache.keys().next().value;
+        if (oldest !== void 0) {
+          this._loadCache.delete(oldest);
+        }
+      }
+      this._loadCache.set(id, { mtimeMs: stat6.mtimeMs, size: stat6.size, data });
+      return data;
     } catch (err) {
       outcome = "failure";
       errorMsg = toErrorMessage(err);
       throw err;
     } finally {
       this.emitRead(id, file, "load", outcome, Date.now() - t0, errorMsg);
+      if (cacheHit) {
+        this.events?.emit("storage.cache_hit", {
+          sessionId: id,
+          store: "session",
+          filePath: file,
+          operation: "load",
+          durationMs: Date.now() - t0
+        });
+      }
     }
   }
   async list(limit = 20) {
@@ -1594,7 +2386,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         continue;
       if (entry.isDirectory()) {
         const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        ids.push(...await this.collectSessionIds(path3.join(dir, entry.name), childPrefix, depth + 1));
+        ids.push(...await this.collectSessionIds(path4.join(dir, entry.name), childPrefix, depth + 1));
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
         if (entry.name === "_index.jsonl") continue;
         const base = entry.name.replace(/\.jsonl$/, "");
@@ -1645,14 +2437,14 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async deleteSession(id) {
     const jsonlPath = this.sessionPath(id, ".jsonl");
     const summaryPath = this.sessionPath(id, ".summary.json");
-    const shardDir = path3.dirname(path3.join(this.dir, id));
-    const base = path3.basename(id);
-    const sessDir = path3.join(shardDir, base);
+    const shardDir = path4.dirname(path4.join(this.dir, id));
+    const base = path4.basename(id);
+    const sessDir = path4.join(shardDir, base);
     const deletions = [
       fsp2.unlink(jsonlPath),
       fsp2.unlink(summaryPath),
-      fsp2.unlink(path3.join(shardDir, `${base}.plan.json`)),
-      fsp2.unlink(path3.join(shardDir, `${base}.todos.json`))
+      fsp2.unlink(path4.join(shardDir, `${base}.plan.json`)),
+      fsp2.unlink(path4.join(shardDir, `${base}.todos.json`))
     ];
     const results = await Promise.allSettled(deletions);
     for (const r of results) {
@@ -1688,14 +2480,14 @@ var DefaultSessionStore = class _DefaultSessionStore {
     let deleted = 0;
     let activeSessionId = null;
     try {
-      const raw = await fsp2.readFile(path3.join(this.dir, "active.json"), "utf8");
+      const raw = await fsp2.readFile(path4.join(this.dir, "active.json"), "utf8");
       const active = JSON.parse(raw);
       activeSessionId = active.sessionId ?? null;
     } catch {
     }
     const isPrunableJsonl = (name) => name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
     const pruneFile = async (dir, name, prefix) => {
-      const jsonlPath = path3.join(dir, name);
+      const jsonlPath = path4.join(dir, name);
       try {
         const stat6 = await fsp2.stat(jsonlPath);
         if (stat6.mtimeMs >= cutoff) return;
@@ -1715,7 +2507,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         continue;
       }
       if (!entry.isDirectory()) continue;
-      const dateDir = path3.join(this.dir, entry.name);
+      const dateDir = path4.join(this.dir, entry.name);
       const files = await fsp2.readdir(dateDir, { withFileTypes: true }).catch(() => []);
       for (const file of files) {
         if (!file.isFile() || !isPrunableJsonl(file.name)) continue;
@@ -1727,7 +2519,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const dateDir = path3.join(this.dir, entry.name);
+      const dateDir = path4.join(this.dir, entry.name);
       try {
         const remaining = await fsp2.readdir(dateDir);
         if (remaining.length === 0) {
@@ -1902,7 +2694,7 @@ var FileSessionWriter = class _FileSessionWriter {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path3.join(opts.dir, `${path3.basename(id)}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path4.join(opts.dir, `${path4.basename(id)}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.onCloseCb = opts.onClose;
@@ -2406,7 +3198,7 @@ var QueueStore = class {
   events;
   traceId;
   constructor(opts) {
-    this.file = path3.join(opts.dir, "queue.json");
+    this.file = path4.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
   }
@@ -2593,7 +3385,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp2.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path3.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path4.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -2805,7 +3597,7 @@ var FileMemoryBackend = class {
   }
   async remember(scope, entry, filePath) {
     const file = this.resolveFile(filePath, scope);
-    await ensureDir(path3.dirname(file));
+    await ensureDir(path4.dirname(file));
     let existing = "";
     try {
       existing = await fsp2.readFile(file, "utf8");
@@ -3421,9 +4213,9 @@ ${body.trim()}`);
     if (!this.persistBackup || scope === "project-agents") return;
     try {
       const content = await this.backend.readAll(scope, this.files[scope]);
-      const { writeFile: writeFile4, mkdir: mkdir6 } = await import('fs/promises');
-      await mkdir6(this.backupDir, { recursive: true });
-      await writeFile4(`${this.backupDir}/${scope}.md`, content, "utf8");
+      const { writeFile: writeFile5, mkdir: mkdir7 } = await import('fs/promises');
+      await mkdir7(this.backupDir, { recursive: true });
+      await writeFile5(`${this.backupDir}/${scope}.md`, content, "utf8");
     } catch {
     }
   }
@@ -3663,7 +4455,10 @@ function deepFreeze(obj) {
 }
 
 // src/types/secret-vault.ts
-var ENCRYPTED_PREFIX = "enc:v1:";
+var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
+function encryptedPrefixForVersion(version) {
+  return `enc:v${version}:`;
+}
 
 // src/security/secret-vault.ts
 init_atomic_write();
@@ -3672,10 +4467,12 @@ var IV_BYTES = 12;
 var TAG_BYTES = 16;
 var ALGO = "aes-256-gcm";
 var KEY_FILE_MODE = 384;
+var KEY_FILE_MAGIC = Buffer.from("WSKV", "ascii");
+var VERSIONED_KEY_FILE_SIZE = KEY_FILE_MAGIC.length + 1 + KEY_BYTES;
 function checkKeyFilePermissions(keyFile) {
   if (process.platform === "win32") return;
   try {
-    const stat6 = fs.statSync(keyFile);
+    const stat6 = fs4.statSync(keyFile);
     const actualMode = stat6.mode & 511;
     if (actualMode !== KEY_FILE_MODE) {
       console.warn(JSON.stringify({
@@ -3694,11 +4491,17 @@ function checkKeyFilePermissions(keyFile) {
 var DefaultSecretVault = class {
   keyFile;
   key;
+  _keyVersion = 1;
   constructor(opts) {
     this.keyFile = opts.keyFile;
   }
+  /** Current key version. Starts at 1; incremented by rotateKey(). */
+  get keyVersion() {
+    if (!this.key) this.loadOrCreateKey();
+    return this._keyVersion;
+  }
   isEncrypted(value) {
-    return typeof value === "string" && value.startsWith(ENCRYPTED_PREFIX);
+    return typeof value === "string" && ENCRYPTED_PREFIX_PATTERN.test(value);
   }
   encrypt(plaintext) {
     if (this.isEncrypted(plaintext)) return plaintext;
@@ -3707,11 +4510,20 @@ var DefaultSecretVault = class {
     const cipher = createCipheriv(ALGO, key, iv);
     const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
     const tag = cipher.getAuthTag();
-    return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
+    const prefix = encryptedPrefixForVersion(this._keyVersion);
+    return `${prefix}${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
   }
   decrypt(value) {
     if (!this.isEncrypted(value)) return value;
-    const rest = value.slice(ENCRYPTED_PREFIX.length);
+    const prefixMatch = value.match(ENCRYPTED_PREFIX_PATTERN);
+    if (!prefixMatch) {
+      throw new ConfigError({
+        message: "SecretVault: malformed encrypted value",
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { field: "encrypted_value" }
+      });
+    }
+    const rest = value.slice(prefixMatch[0].length);
     const parts = rest.split(":");
     if (parts.length !== 3) {
       throw new ConfigError({
@@ -3740,42 +4552,104 @@ var DefaultSecretVault = class {
     const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
     return pt.toString("utf8");
   }
+  /**
+   * Generate a new encryption key, write it to disk, and increment the key version.
+   * After rotation, encrypt() emits the new version prefix (e.g. enc:v2:).
+   * The caller must re-encrypt existing config values (see rotateConfigKeys()).
+   */
+  rotateKey() {
+    const oldVersion = this._keyVersion;
+    const newKey = randomBytes(KEY_BYTES);
+    const newVersion = oldVersion + 1;
+    const keyFileBuf = Buffer.alloc(VERSIONED_KEY_FILE_SIZE);
+    KEY_FILE_MAGIC.copy(keyFileBuf, 0);
+    keyFileBuf[KEY_FILE_MAGIC.length] = newVersion;
+    newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
+    fs4.mkdirSync(path4.dirname(this.keyFile), { recursive: true });
+    fs4.writeFileSync(this.keyFile, keyFileBuf, { mode: 384 });
+    checkKeyFilePermissions(this.keyFile);
+    this.key = newKey;
+    this._keyVersion = newVersion;
+    return { oldVersion, newVersion };
+  }
   loadOrCreateKey() {
     if (this.key) return this.key;
     try {
-      const buf = fs.readFileSync(this.keyFile);
-      if (buf.length !== KEY_BYTES) {
-        throw new ConfigError({
-          message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES}). Remove it manually to generate a new key.`,
-          code: ERROR_CODES.CONFIG_INVALID,
-          context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
-        });
+      const buf = fs4.readFileSync(this.keyFile);
+      if (buf.length === KEY_BYTES) {
+        this.key = buf;
+        this._keyVersion = 1;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
+      }
+      if (buf.length === VERSIONED_KEY_FILE_SIZE) {
+        const magic = buf.subarray(0, KEY_FILE_MAGIC.length);
+        if (!magic.equals(KEY_FILE_MAGIC)) {
+          throw new ConfigError({
+            message: `SecretVault: key file ${this.keyFile} has invalid magic header`,
+            code: ERROR_CODES.CONFIG_INVALID,
+            context: { keyFile: this.keyFile }
+          });
+        }
+        const version = buf[KEY_FILE_MAGIC.length];
+        const key2 = buf.subarray(KEY_FILE_MAGIC.length + 1);
+        if (key2.length !== KEY_BYTES) {
+          throw new ConfigError({
+            message: `SecretVault: key file ${this.keyFile} has wrong key size (${key2.length} bytes, expected ${KEY_BYTES})`,
+            code: ERROR_CODES.CONFIG_INVALID,
+            context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: key2.length }
+          });
+        }
+        this.key = Buffer.from(key2);
+        this._keyVersion = version;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
       }
-      this.key = buf;
-      checkKeyFilePermissions(this.keyFile);
-      return this.key;
+      throw new ConfigError({
+        message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES} for v1 or ${VERSIONED_KEY_FILE_SIZE} for v2+). Remove it manually to generate a new key.`,
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
+      });
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    fs4.mkdirSync(path4.dirname(this.keyFile), { recursive: true });
     const key = randomBytes(KEY_BYTES);
     try {
-      fs.writeFileSync(this.keyFile, key, { mode: 384, flag: "wx" });
+      fs4.writeFileSync(this.keyFile, key, { mode: 384, flag: "wx" });
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
-      const buf = fs.readFileSync(this.keyFile);
-      if (buf.length !== KEY_BYTES) {
-        throw new ConfigError({
-          message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES}). Remove it manually to generate a new key.`,
-          code: ERROR_CODES.CONFIG_INVALID,
-          context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
-        });
+      const buf = fs4.readFileSync(this.keyFile);
+      if (buf.length === KEY_BYTES) {
+        this.key = buf;
+        this._keyVersion = 1;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
+      }
+      if (buf.length === VERSIONED_KEY_FILE_SIZE) {
+        const magic = buf.subarray(0, KEY_FILE_MAGIC.length);
+        if (!magic.equals(KEY_FILE_MAGIC)) {
+          throw new ConfigError({
+            message: `SecretVault: key file ${this.keyFile} has invalid magic header`,
+            code: ERROR_CODES.CONFIG_INVALID,
+            context: { keyFile: this.keyFile }
+          });
+        }
+        const version = buf[KEY_FILE_MAGIC.length];
+        const winnerKey = buf.subarray(KEY_FILE_MAGIC.length + 1);
+        this.key = Buffer.from(winnerKey);
+        this._keyVersion = version;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
       }
-      this.key = buf;
-      checkKeyFilePermissions(this.keyFile);
-      return this.key;
+      throw new ConfigError({
+        message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES} for v1 or ${VERSIONED_KEY_FILE_SIZE} for v2+). Remove it manually to generate a new key.`,
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
+      });
     }
     this.key = key;
+    this._keyVersion = 1;
     return key;
   }
 };
@@ -3829,7 +4703,7 @@ async function rewriteConfigEncrypted(configPath, vault, patch) {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp2.mkdir(path3.dirname(configPath), { recursive: true });
+  await fsp2.mkdir(path4.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions(configPath);
 }
@@ -3971,7 +4845,8 @@ var DEFAULT_TOOLS_CONFIG = Object.freeze({
   iterationTimeoutMs: 3e5,
   sessionTimeoutMs: 18e5,
   perIterationOutputCapBytes: 1e5,
-  autoExtendLimit: true
+  autoExtendLimit: true,
+  restrictToProjectRoot: false
 });
 var DEFAULT_CONTEXT_CONFIG = Object.freeze({
   preserveK: 10,
@@ -4014,7 +4889,8 @@ var BEHAVIOR_DEFAULTS = {
     iterationTimeoutMs: DEFAULT_TOOLS_CONFIG.iterationTimeoutMs,
     sessionTimeoutMs: DEFAULT_TOOLS_CONFIG.sessionTimeoutMs,
     perIterationOutputCapBytes: DEFAULT_TOOLS_CONFIG.perIterationOutputCapBytes,
-    autoExtendLimit: DEFAULT_TOOLS_CONFIG.autoExtendLimit
+    autoExtendLimit: DEFAULT_TOOLS_CONFIG.autoExtendLimit,
+    restrictToProjectRoot: DEFAULT_TOOLS_CONFIG.restrictToProjectRoot
   },
   log: { level: "info" },
   features: {
@@ -4457,7 +5333,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path3.join(opts.dir, LOCK_FILE);
+    this.file = path4.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -4518,7 +5394,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path3.dirname(this.file));
+    await ensureDir(path4.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -5283,6 +6159,7 @@ async function savePlan(filePath, plan, events) {
       outcome: "success",
       durationMs: Date.now() - t0
     });
+    return true;
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: "~boot~",
@@ -5296,6 +6173,7 @@ async function savePlan(filePath, plan, events) {
       "[plan-store] save failed:",
       toErrorMessage(err)
     );
+    return false;
   }
 }
 function emptyPlan(sessionId, title) {
@@ -5732,6 +6610,27 @@ var PATTERNS = [
   { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g },
   { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g },
   { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g },
+  // AI/ML provider keys — modern LLM services with well-known prefixes
+  {
+    type: "huggingface_token",
+    // HuggingFace tokens: hf_ followed by 34 alphanumeric chars
+    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g
+  },
+  {
+    type: "replicate_token",
+    // Replicate tokens: r8_ followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+  },
+  {
+    type: "perplexity_key",
+    // Perplexity API keys: pplx- followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+  },
+  {
+    type: "groq_key",
+    // Groq API keys: gsk_ followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+  },
   {
     type: "bearer_token",
     // Anchored with alternation instead of negative lookahead — avoids V8
@@ -5765,6 +6664,10 @@ function hasCredentialAnchors(text) {
   text.includes("xox") || // Slack token (xoxa/xoxb/xoxp/xoxo/xoxs)
   text.includes("Bearer ") || // Bearer token (space suffix reduces false positives)
   text.includes("/bot") || // Telegram bot token (URL path pattern)
+  text.includes("hf_") || // HuggingFace token
+  text.includes("r8_") || // Replicate token
+  text.includes("pplx-") || // Perplexity API key
+  text.includes("gsk_") || // Groq API key
   text.includes("_KEY=") || // High-entropy env vars: API_KEY=, SECRET_KEY=, ...
   text.includes("_TOKEN=") || // ACCESS_TOKEN=, AUTH_TOKEN=, ...
   text.includes("_SECRET=") || // API_SECRET=, CLIENT_SECRET=, ...
@@ -5911,9 +6814,9 @@ function getInputString(input, key) {
 function pathLooksInsideProject(rawPath, projectRoot) {
   if (!projectRoot) return false;
   if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path3.resolve(projectRoot, rawPath);
-  const relative2 = path3.relative(projectRoot, resolved);
-  return !!relative2 && !relative2.startsWith("..") && !path3.isAbsolute(relative2);
+  const resolved = path4.resolve(projectRoot, rawPath);
+  const relative3 = path4.relative(projectRoot, resolved);
+  return !!relative3 && !relative3.startsWith("..") && !path4.isAbsolute(relative3);
 }
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
@@ -5923,7 +6826,7 @@ function pathTokenIsOutsideProject(token, projectRoot) {
   if (token === "/" || token === "~" || token === "." || token === "..") return token !== ".";
   if (token.includes("*")) return true;
   if (token.startsWith("..") || token.includes("../") || token.includes("..\\")) return true;
-  if (path3.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
+  if (path4.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
   return false;
 }
 function hasDangerousDeleteTarget(tokens, start, projectRoot) {
@@ -6318,9 +7221,12 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
     const caps = tool.capabilities ?? [];
     const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
     const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
-    const blocked = tool.permission === "deny" || isMcp || !hasAllowedCap;
+    const dangerousNotAllowed = getDangerousCapabilities(tool).filter(
+      (c) => !this.allowedCapabilities.includes(c)
+    );
+    const blocked = tool.permission === "deny" || isMcp || !hasAllowedCap || dangerousNotAllowed.length > 0;
     if (blocked) {
-      const reason = isMcp ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow it explicitly` : tool.permission === "deny" ? "tool default deny" : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
+      const reason = isMcp ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow it explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
       return {
         permission: "deny",
         source: "subagent_guard",
@@ -6580,7 +7486,7 @@ var DefaultSkillLoader = class {
         const entries = await fsp2.readdir(dir, { withFileTypes: true });
         for (const e of entries) {
           if (!e.isDirectory()) continue;
-          const skillFile = path3.join(dir, e.name, "SKILL.md");
+          const skillFile = path4.join(dir, e.name, "SKILL.md");
           try {
             const raw = await fsp2.readFile(skillFile, "utf8");
             const meta = parseFrontmatter(raw);
@@ -6605,12 +7511,12 @@ var DefaultSkillLoader = class {
   }
   async find(name) {
     const all = await this.list();
-    return all.find((s) => s.name === name);
+    const lower = name.toLowerCase();
+    return all.find((s) => s.name.toLowerCase() === lower);
   }
   async manifestText() {
-    const skills = await this.list();
-    if (skills.length === 0) return "";
     const entries = await this.listEntries();
+    if (entries.length === 0) return "";
     const lines = ["## Available skills"];
     for (const e of entries) {
       const scopeTag = e.scope.length > 0 ? ` \u2014 ${e.scope.slice(0, 3).join(", ")}` : "";
@@ -6624,12 +7530,8 @@ var DefaultSkillLoader = class {
     const skills = await this.list();
     const entries = [];
     for (const s of skills) {
-      try {
-        const raw = await fsp2.readFile(s.path, "utf8");
-        const { trigger, scope } = parseDescription(raw);
-        entries.push({ name: s.name, trigger, scope, source: s.source, path: s.path });
-      } catch {
-      }
+      const { trigger, scope } = parseDescriptionFromText(s.description ?? "");
+      entries.push({ name: s.name, trigger, scope, source: s.source, path: s.path });
     }
     this.entriesCache = entries;
     return entries;
@@ -6640,21 +7542,22 @@ var DefaultSkillLoader = class {
     this.bodyCache.clear();
   }
   async readBody(name) {
-    const cached = this.bodyCache.get(name);
+    const key = name.toLowerCase();
+    const cached = this.bodyCache.get(key);
     if (cached !== void 0) return cached;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
     const body = await fsp2.readFile(m.path, "utf8");
-    this.bodyCache.set(name, body);
+    this.bodyCache.set(key, body);
     return body;
   }
   async readSaveBody(name) {
-    const key = `save:${name}`;
+    const key = `save:${name.toLowerCase()}`;
     const cached = this.bodyCache.get(key);
     if (cached !== void 0) return cached;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
-    const savePath = path3.join(path3.dirname(m.path), "SKILL.save.md");
+    const savePath = path4.join(path4.dirname(m.path), "SKILL.save.md");
     let result;
     try {
       result = await fsp2.readFile(savePath, "utf8");
@@ -6710,9 +7613,7 @@ function parseFrontmatter(raw) {
   flush();
   return out;
 }
-function parseDescription(raw) {
-  const fm = parseFrontmatter(raw);
-  const desc = fm.description ?? "";
+function parseDescriptionFromText(desc) {
   const firstSentenceEnd = desc.indexOf(". ");
   const trigger = firstSentenceEnd !== -1 ? desc.slice(0, firstSentenceEnd + 1).trim() : desc.trim().split("\n")[0] ?? "";
   const scope = [];
@@ -6970,8 +7871,8 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
         });
         await Promise.race([
           drainPromise,
-          new Promise((resolve5) => {
-            drainTimer = setTimeout(resolve5, STREAM_DRAIN_TIMEOUT_MS);
+          new Promise((resolve6) => {
+            drainTimer = setTimeout(resolve6, STREAM_DRAIN_TIMEOUT_MS);
           })
         ]);
       } finally {
@@ -7077,26 +7978,29 @@ async function runProviderWithRetry(opts) {
           description
         });
       }
-      await new Promise((resolve5, reject) => {
+      await new Promise((resolve6, reject) => {
         let settled = false;
+        const cleanup = () => {
+          clearTimeout(t);
+          signal.removeEventListener("abort", onAbort);
+        };
         const onAbort = () => {
           if (settled) return;
           settled = true;
-          clearTimeout(t);
+          cleanup();
           reject(new Error("aborted"));
         };
         const t = setTimeout(() => {
           if (settled) return;
           settled = true;
-          clearTimeout(t);
-          signal.removeEventListener("abort", onAbort);
-          resolve5();
+          cleanup();
+          resolve6();
         }, delay);
         if (signal.aborted) {
           onAbort();
           return;
         }
-        signal.addEventListener("abort", onAbort, { once: true });
+        signal.addEventListener("abort", onAbort);
       });
       attempt++;
     }
@@ -7116,7 +8020,11 @@ function isTextBlock(b) {
 }
 
 // src/execution/compaction-core.ts
+function compactionDebugEnabled() {
+  return process.env["NODE_ENV"] === "development" || process.env["WRONGSTACK_DEBUG"] === "1";
+}
 function emitCompactionMetrics(event, metrics) {
+  if (!compactionDebugEnabled()) return;
   console.log(
     JSON.stringify({
       level: "debug",
@@ -7151,38 +8059,41 @@ function findPreserveStart(messages, preserveK) {
       preserveStart = i;
     }
   }
-  let forwardWalkIterations = 0;
-  let forwardWalkInnerIterations = 0;
-  for (let i = preserveStart; i < messages.length; i++) {
-    forwardWalkIterations++;
-    const m = messages[i];
-    if (!m || typeof m.content === "string" || !Array.isArray(m.content)) continue;
-    const hasToolUse3 = m.content.some((b) => {
-      forwardWalkInnerIterations++;
-      return b.type === "tool_use";
+  let pairRepairIterations = 0;
+  let pairRepairInnerIterations = 0;
+  while (preserveStart > 0) {
+    pairRepairIterations++;
+    const first = messages[preserveStart];
+    const prev = messages[preserveStart - 1];
+    if (!first || !prev || first.role !== "user" || prev.role !== "assistant") break;
+    if (typeof first.content === "string" || typeof prev.content === "string") break;
+    const resultIds = /* @__PURE__ */ new Set();
+    for (const block of first.content) {
+      pairRepairInnerIterations++;
+      if (block.type === "tool_result") resultIds.add(block.tool_use_id);
+    }
+    if (resultIds.size === 0) break;
+    const hasMatchingUse = prev.content.some((block) => {
+      pairRepairInnerIterations++;
+      return block.type === "tool_use" && resultIds.has(block.id);
     });
-    if (hasToolUse3 && i + 1 < messages.length) {
-      const next = messages[i + 1];
-      if (next && next.role === "user" && typeof next.content !== "string" && Array.isArray(next.content) && next.content.some((b) => {
-        forwardWalkInnerIterations++;
-        return b.type === "tool_result";
-      })) {
-        preserveStart = i + 1;
-      }
-    }
+    if (!hasMatchingUse) break;
+    preserveStart--;
+  }
+  if (compactionDebugEnabled()) {
+    console.log(
+      JSON.stringify({
+        level: "debug",
+        event: "compaction.find_preserve_start.ended",
+        messageCount: messages.length,
+        preserveK,
+        preserveStart,
+        pairRepairIterations,
+        pairRepairInnerIterations,
+        pairRepairInnerPerOuter: pairRepairIterations > 0 ? pairRepairInnerIterations / pairRepairIterations : 0
+      })
+    );
   }
-  console.log(
-    JSON.stringify({
-      level: "debug",
-      event: "compaction.find_preserve_start.ended",
-      messageCount: messages.length,
-      preserveK,
-      preserveStart,
-      forwardWalkIterations,
-      forwardWalkInnerIterations,
-      forwardWalkInnerPerOuter: forwardWalkIterations > 0 ? forwardWalkInnerIterations / forwardWalkIterations : 0
-    })
-  );
   return preserveStart;
 }
 function eliseOldToolResults(messages, opts) {
@@ -7196,7 +8107,8 @@ function eliseOldToolResults(messages, opts) {
     if (!msg || !Array.isArray(msg.content)) continue;
     for (const b of msg.content) {
       fastPathInnerIterations++;
-      if (b.type === "tool_result" && estimateToolResultTokens(b.content) >= opts.eliseThreshold) {
+      const oversized = b.type === "tool_result" && estimateToolResultTokens(b.content) >= opts.eliseThreshold || b.type === "tool_use" && estimateToolInputTokens(b.input) >= opts.eliseThreshold;
+      if (oversized) {
         hasOversized = true;
         break;
       }
@@ -7230,6 +8142,13 @@ function eliseOldToolResults(messages, opts) {
     }
     const original = msg.content;
     const newContent = original.map((b) => {
+      if (b.type === "tool_use") {
+        const tokens2 = estimateToolInputTokens(b.input);
+        if (tokens2 < opts.eliseThreshold) return b;
+        const elidedInput = summarizeToolUseInputElision(b, tokens2);
+        saved += Math.max(0, tokens2 - estimateToolInputTokens(elidedInput));
+        return { ...b, input: elidedInput };
+      }
       if (b.type !== "tool_result") return b;
       const tokens = estimateToolResultTokens(b.content);
       if (tokens < opts.eliseThreshold) return b;
@@ -7237,7 +8156,7 @@ function eliseOldToolResults(messages, opts) {
       const elided = {
         type: "tool_result",
         tool_use_id: b.tool_use_id,
-        content: `[elided: ~${tokens} tokens]`,
+        content: summarizeToolResultElision(b, tokens),
         is_error: b.is_error
       };
       return elided;
@@ -7249,7 +8168,7 @@ function eliseOldToolResults(messages, opts) {
       changed = true;
     }
     fullPassInnerIterations += original.length;
-    if (process.env["NODE_ENV"] === "development" || process.env["WRONGSTACK_DEBUG"] === "1") {
+    if (compactionDebugEnabled()) {
       const ratio = fullPassInnerIterations / fullPassIterations;
       if (ratio > 10) {
         console.error(
@@ -7277,6 +8196,65 @@ function eliseOldToolResults(messages, opts) {
   });
   return { messages: changed ? next : messages, saved, changed };
 }
+function summarizeToolUseInputElision(block, tokens) {
+  const fields = {};
+  for (const [key, value] of Object.entries(block.input ?? {})) {
+    fields[key] = summarizeToolUseInputValue(value);
+  }
+  return {
+    __elided_tool_input: `~${tokens} tokens; original arguments are in the session log`,
+    tool: block.name,
+    fields
+  };
+}
+function summarizeToolUseInputValue(value) {
+  if (value === null || value === void 0) return value;
+  if (typeof value === "number" || typeof value === "boolean") return value;
+  if (typeof value === "string") {
+    const oneLine = value.replace(/\s+/g, " ").trim();
+    return oneLine.length <= 160 ? oneLine : `${oneLine.slice(0, 120)}...(${oneLine.length} chars)`;
+  }
+  if (Array.isArray(value)) {
+    return `[array:${value.length}]`;
+  }
+  if (typeof value === "object") {
+    const keys = Object.keys(value);
+    return `[object:${keys.slice(0, 8).join(",")}${keys.length > 8 ? ",..." : ""}]`;
+  }
+  return String(value);
+}
+function summarizeToolResultElision(block, tokens) {
+  const parts = [`elided: ~${tokens} tokens`];
+  if (block.name) parts.push(`tool=${block.name}`);
+  const files = extractPathHints(block.content).slice(0, 5);
+  if (files.length > 0) parts.push(`files=${files.join(", ")}`);
+  const error = firstErrorLine(block.content);
+  if (error) parts.push(`error=${error}`);
+  return `[${parts.join("; ")}]`;
+}
+function extractPathHints(content) {
+  const text = typeof content === "string" ? content : JSON.stringify(content);
+  const out = /* @__PURE__ */ new Set();
+  const re = /(?:(?:[A-Za-z]:)?[./\\]?[\w@.-]+(?:[\\/][\w@(). -]+)+\.[A-Za-z0-9]{1,12})/g;
+  for (const match of text.matchAll(re)) {
+    const clean = match[0]?.replace(/\\/g, "/").replace(/^["'`]+|["'`),;:]+$/g, "");
+    if (clean && clean.length <= 220) out.add(clean);
+    if (out.size >= 5) break;
+  }
+  return [...out];
+}
+function firstErrorLine(content) {
+  const text = typeof content === "string" ? content : JSON.stringify(content);
+  for (const line of text.split(/\r?\n/)) {
+    if (!/\b(error|exception|failed|failure|fatal|panic|timeout|denied|enoent|eacces|eperm)\b/i.test(
+      line
+    ))
+      continue;
+    const trimmed = line.replace(/\s+/g, " ").trim();
+    if (trimmed) return trimmed.slice(0, 180);
+  }
+  return void 0;
+}
 function buildLosslessDigest(messages) {
   const lines = [];
   for (const m of messages) {
@@ -7387,15 +8365,15 @@ function buildSmartDigest(messages) {
     lines.push(`[${m.role}]: ${display}${marker}`);
   }
   if (noiseCount > 0) {
-    lines.push(`[system]: ${noiseCount} low-importance turn(s) collapsed (repeated failures / pure tool I/O)`);
+    lines.push(
+      `[system]: ${noiseCount} low-importance turn(s) collapsed (repeated failures / pure tool I/O)`
+    );
   }
   return lines.join("\n");
 }
 function countToolBlocks(m) {
   if (typeof m.content === "string") return 0;
-  return m.content.filter(
-    (b) => b.type === "tool_use" || b.type === "tool_result"
-  ).length;
+  return m.content.filter((b) => b.type === "tool_use" || b.type === "tool_result").length;
 }
 function firstSentence(text) {
   const trimmed = text.trim();
@@ -7464,10 +8442,12 @@ var HybridCompactor = class {
     if (elide.changed) ctx.state.replaceMessages(elide.messages);
     if (elide.saved > 0) reductions.push({ phase: "elision", saved: elide.saved });
     let collapsedDigest;
+    let evidenceDigest;
     if (opts.aggressive) {
       const phase2 = this.collapseAncientTurns(ctx, preserveK);
       if (phase2.saved > 0) reductions.push({ phase: "summary", saved: phase2.saved });
       collapsedDigest = phase2.digest;
+      evidenceDigest = phase2.evidenceDigest;
     }
     const repaired = repairToolUseAdjacency(ctx.messages);
     if (repaired.report.changed) {
@@ -7475,6 +8455,11 @@ var HybridCompactor = class {
     }
     const afterTokens = estimateMessages(ctx.messages);
     const afterFull = this.estimateFullRequest(ctx);
+    const quality = checkCompactionQuality(ctx, {
+      collapsedDigest,
+      evidenceDigest,
+      reduced: beforeTokens > afterTokens || beforeFull > afterFull
+    });
     return {
       before: beforeTokens,
       after: afterTokens,
@@ -7482,6 +8467,8 @@ var HybridCompactor = class {
       fullRequestTokensAfter: afterFull,
       reductions,
       collapsedDigest,
+      evidenceDigest,
+      quality,
       repaired: repaired.report.changed ? {
         removedToolUses: repaired.report.removedToolUses,
         removedToolResults: repaired.report.removedToolResults,
@@ -7523,7 +8510,13 @@ var HybridCompactor = class {
     if (boundary <= 0) return { saved: 0 };
     const removed = messages.slice(0, boundary);
     const removedTokens = estimateMessages(removed);
-    const digest = this.smart ? buildSmartDigest(removed) || `${removed.length} earlier turns (no textual content; tool I/O omitted \u2014 see session log)` : buildLosslessDigest(removed) || `${removed.length} earlier turns (no textual content; tool I/O omitted \u2014 see session log)`;
+    const historyDigest = this.smart ? buildSmartDigest(removed) || `${removed.length} earlier turns (no textual content; tool I/O omitted; see session log)` : buildLosslessDigest(removed) || `${removed.length} earlier turns (no textual content; tool I/O omitted; see session log)`;
+    const evidenceDigest = buildContextEvidenceDigest(ctx);
+    const digest = evidenceDigest ? `[context_state]
+${evidenceDigest}
+
+[prior_history]
+${historyDigest}` : historyDigest;
     const summaryMsg = {
       role: "system",
       content: `[prior_turns_digest: ${digest}]`
@@ -7532,10 +8525,29 @@ var HybridCompactor = class {
     ctx.state.replaceMessages([summaryMsg, ...tail]);
     return {
       saved: Math.max(0, removedTokens - estimateMessages([summaryMsg])),
-      digest
+      digest,
+      evidenceDigest: evidenceDigest || void 0
     };
   }
 };
+function checkCompactionQuality(ctx, opts) {
+  const evidence = ctx.contextEvidence;
+  const digest = `${opts.collapsedDigest ?? ""}
+${opts.evidenceDigest ?? ""}`;
+  const hasIntent = Boolean(evidence?.currentIntent?.text || /\b(intent|goal|session_goals)\b/i.test(digest));
+  const hasPathTrail = Boolean(
+    Object.keys(evidence?.fileGraph ?? {}).length > 0 || (evidence?.toolCalls.length ?? 0) > 0 || /\b(dependency_graph|tool_trail|files=)\b/i.test(digest)
+  );
+  const issues = [];
+  if (opts.reduced && !hasIntent) issues.push("missing intent anchor");
+  if (opts.reduced && !hasPathTrail) issues.push("missing tool/path trail");
+  return {
+    ok: issues.length === 0,
+    hasIntent,
+    hasPathTrail,
+    issues
+  };
+}
 function readContextWindowPolicy(ctx) {
   const policy = ctx.meta?.["contextWindowPolicy"];
   if (!policy || typeof policy !== "object") return null;
@@ -7656,7 +8668,12 @@ var IntelligentCompactor = class {
     };
     const ac = ctx.signal ? void 0 : new AbortController();
     const signal = ctx.signal ?? ac?.signal;
-    const res = await this.provider.complete(req, { signal });
+    let res;
+    try {
+      res = await this.provider.complete(req, { signal });
+    } finally {
+      ac?.abort();
+    }
     const textBlocks = res.content.filter(isTextBlock);
     return textBlocks.map((b) => b.text).join("\n").trim() || "(empty summary)";
   }
@@ -7700,9 +8717,9 @@ Rules:
 - If unsure, keep rather than collapse (errors are more costly than waste)
 
 Return ONLY the JSON object, no markdown, no explanation outside the JSON.`;
-function formatMessages(messages, maxChars = 8e3) {
+function formatMessages(messages, maxTokens = 2048) {
   const lines = [];
-  let used = 0;
+  let usedTokens = 0;
   for (let i = 0; i < messages.length; i++) {
     const m = expectDefined(messages[i]);
     const role = m.role.padEnd(10, " ");
@@ -7714,13 +8731,14 @@ function formatMessages(messages, maxChars = 8e3) {
       text = content.filter(isTextBlock).map((b) => b.text).join(" ");
       const toolUses = content.filter((b) => b.type === "tool_use");
       if (toolUses.length > 0) {
-        text += ` [tools: ${toolUses.map((b) => b.name).join(", ")}]`;
+        text += ` [tools: ${toolUses.map((b) => b.name).filter(Boolean).join(", ")}]`;
       }
     }
     const line = `[${i}][${role}]: ${text}`;
-    if (used + line.length > maxChars) break;
+    const lineTokens = estimateTextTokens(line);
+    if (usedTokens + lineTokens > maxTokens) break;
     lines.push(line);
-    used += line.length;
+    usedTokens += lineTokens;
   }
   return lines.join("\n");
 }
@@ -7729,20 +8747,29 @@ var LLMSelector = class {
   model;
   maxContextTokens;
   systemPrompt;
+  maxOutputTokens;
   constructor(opts) {
     this.provider = opts.provider;
     this.model = opts.model ?? "unknown";
+    if (this.model === "unknown" && (process.env["NODE_ENV"] === "development" || process.env["WRONGSTACK_DEBUG"] === "1")) {
+      console.warn(
+        "[LLMSelector] model not set \u2014 selector will use the provider default. Set `model` explicitly in LLMSelectorOptions to silence this warning."
+      );
+    }
     this.maxContextTokens = opts.maxContextTokens ?? 4e4;
     this.systemPrompt = opts.systemPrompt ?? DEFAULT_SYSTEM_PROMPT;
+    this.maxOutputTokens = opts.maxOutputTokens ?? 1024;
   }
   async select(messages, maxToKeep) {
     const effectiveBudget = Math.min(maxToKeep, this.maxContextTokens);
-    const historyText = formatMessages(messages);
     const totalTokens = estimateMessageTokens(messages);
     const systemText = `${this.systemPrompt}
 
 Conversation (${messages.length} messages, ~${totalTokens} tokens, budget: ${effectiveBudget}):
 `;
+    const systemTokens = estimateTextTokens(systemText);
+    const historyBudget = Math.max(512, effectiveBudget - systemTokens - this.maxOutputTokens);
+    const historyText = formatMessages(messages, historyBudget);
     const budgetInstruction = totalTokens > effectiveBudget ? `
 
 IMPORTANT: Total conversation (${totalTokens} tokens) exceeds budget (${effectiveBudget}). You MUST collapse enough to fit. Prefer collapsing older/lower-importance ranges.` : "";
@@ -7750,18 +8777,26 @@ IMPORTANT: Total conversation (${totalTokens} tokens) exceeds budget (${effectiv
       model: this.model,
       system: [{ type: "text", text: systemText + budgetInstruction }],
       messages: [{ role: "user", content: historyText }],
-      maxTokens: 1024
+      maxTokens: this.maxOutputTokens
     };
     let raw;
+    const ac = new AbortController();
     try {
-      const ac = new AbortController();
-      const res = await this.provider.complete(req, { signal: ac.signal });
+      const timeoutSignal = AbortSignal.timeout(3e4);
+      const res = await this.provider.complete(req, {
+        signal: AbortSignal.any([ac.signal, timeoutSignal])
+      });
       const textBlocks = res.content.filter(isTextBlock);
       raw = textBlocks.map((b) => b.text).join("\n").trim();
-    } catch (_err) {
+    } catch (err) {
+      if (err instanceof Error) {
+        console.warn("[LLMSelector] selector call failed, using recency fallback:", err.message);
+      }
       return this.fallbackSelect(messages, effectiveBudget);
+    } finally {
+      ac.abort();
     }
-    return this.parseSelectorOutput(raw, messages.length);
+    return this.parseSelectorOutput(raw, messages);
   }
   fallbackSelect(messages, budget) {
     const toKeep = [];
@@ -7788,34 +8823,63 @@ IMPORTANT: Total conversation (${totalTokens} tokens) exceeds budget (${effectiv
       reasoning: `Fallback: kept last ${messages.length - startIdx} messages within ${budget} token budget`
     };
   }
-  parseSelectorOutput(raw, messageCount) {
+  /**
+   * Parse and validate the raw LLM output into a SelectorResult.
+   * Falls back to recency-based selection if the LLM output is malformed,
+   * out-of-bounds, or internally inconsistent.
+   */
+  parseSelectorOutput(raw, messages) {
+    const messageCount = messages.length;
+    if (messageCount === 0) {
+      return { kept: [], collapsed: [], reasoning: "empty session" };
+    }
     const jsonStart = raw.indexOf("{");
     const jsonEnd = raw.lastIndexOf("}");
     if (jsonStart === -1 || jsonEnd === -1) {
-      return this.fallbackSelect(
-        Array.from({ length: messageCount }, () => ({ role: "user", content: "" })),
-        this.maxContextTokens
-      );
+      return this.fallbackSelect(messages, this.maxContextTokens);
     }
     let parsed;
     try {
       parsed = JSON.parse(raw.slice(jsonStart, jsonEnd + 1));
     } catch {
-      return this.fallbackSelect(
-        Array.from({ length: messageCount }, () => ({ role: "user", content: "" })),
-        this.maxContextTokens
-      );
+      return this.fallbackSelect(messages, this.maxContextTokens);
     }
     const obj = parsed;
-    const kept = obj.kept ?? [];
-    const collapsed = obj.collapsed ?? [];
-    return {
-      kept: kept.map((k) => ({
+    const keptRaw = obj.kept ?? [];
+    const collapsedRaw = obj.collapsed ?? [];
+    const kept = [];
+    for (const k of keptRaw) {
+      if (typeof k.from !== "number" || typeof k.to !== "number" || k.from < 0 || k.to >= messageCount || k.from > k.to) {
+        return this.fallbackSelect(messages, this.maxContextTokens);
+      }
+      kept.push({
         from: k.from,
         to: k.to,
         importance: k.importance ?? "medium"
-      })),
-      collapsed: collapsed.map((c) => ({ from: c.from, to: c.to, summary: c.summary })),
+      });
+    }
+    const collapsed = [];
+    for (const c of collapsedRaw) {
+      if (typeof c.from !== "number" || typeof c.to !== "number" || c.from < 0 || c.to >= messageCount || c.from > c.to) {
+        return this.fallbackSelect(messages, this.maxContextTokens);
+      }
+      collapsed.push({ from: c.from, to: c.to, summary: c.summary });
+    }
+    const allRanges = [...kept, ...collapsed];
+    for (let i = 0; i < allRanges.length; i++) {
+      const a = allRanges[i];
+      if (!a) continue;
+      for (let j = i + 1; j < allRanges.length; j++) {
+        const b = allRanges[j];
+        if (!b) continue;
+        if (a.from <= b.to && a.to >= b.from) {
+          return this.fallbackSelect(messages, this.maxContextTokens);
+        }
+      }
+    }
+    return {
+      kept,
+      collapsed,
       reasoning: typeof obj.reasoning === "string" ? obj.reasoning : ""
     };
   }
@@ -7835,14 +8899,19 @@ var SelectiveCompactor = class {
   summarizerPrompt;
   constructor(opts) {
     this.provider = opts.provider;
-    this.selector = opts.selector ?? new LLMSelector({ provider: opts.provider, model: opts.selectorModel });
+    this.selector = opts.selector ?? new LLMSelector({ provider: opts.provider, model: opts.selectorModel, maxOutputTokens: opts.selectorMaxOutputTokens });
     this.warnThreshold = opts.warnThreshold ?? 0.6;
     this.softThreshold = opts.softThreshold ?? 0.75;
     this.hardThreshold = opts.hardThreshold ?? 0.9;
     this.maxContext = opts.maxContext ?? 128e3;
     this.preserveK = opts.preserveK ?? 4;
     this.eliseThreshold = opts.eliseThreshold ?? 500;
-    this.summarizerModel = opts.summarizerModel ?? opts.selectorModel ?? "unknown";
+    this.summarizerModel = opts.summarizerModel ?? opts.selectorModel;
+    if (this.summarizerModel === void 0 && (process.env["NODE_ENV"] === "development" || process.env["WRONGSTACK_DEBUG"] === "1")) {
+      console.warn(
+        "[SelectiveCompactor] summarizerModel not set \u2014 will fall back to ctx.model at summarize time. Set `summarizerModel` explicitly to silence this warning."
+      );
+    }
     this.summarizerPrompt = opts.summarizerPrompt ?? "You are a context summarizer. Given a list of messages, produce a concise summary that preserves all factual information, decisions, file changes, and state changes. Do not add commentary or opinions.";
   }
   async compact(ctx, opts = {}) {
@@ -7948,14 +9017,15 @@ var SelectiveCompactor = class {
 Summarize the following message range:`;
     const body = messages.map((m, i) => `[${i}] ${m.role}: ${this.messagePreview(m)}`).join("\n");
     const req = {
-      model: this.summarizerModel,
+      model: this.summarizerModel ?? ctx.model,
       system: [{ type: "text", text: systemText }],
       messages: [{ role: "user", content: body }],
       maxTokens: 512
     };
     try {
+      const timeoutSignal = AbortSignal.timeout(3e4);
       const res = await this.provider.complete(req, {
-        signal: ctx.signal ?? new AbortController().signal
+        signal: AbortSignal.any([ctx.signal, timeoutSignal])
       });
       return res.content.filter(isTextBlock).map((b) => b.text).join("\n").trim() || "(empty)";
     } catch {
@@ -8014,27 +9084,16 @@ Summarize the following message range:`;
     if (typeof m.content === "string") return m.content.trim().length > 0;
     return m.content.some((b) => b.type === "text" && b.text.trim().length > 0);
   }
+  /**
+   * Estimate message-array tokens via the shared `estimateMessages` primitive
+   * so SelectiveCompactor's before/after/load figures agree with the
+   * middleware threshold math and the other compactors. Previously this used a
+   * private `ceil(len/3.5)` walk that diverged from the calibrated shared
+   * estimator, causing the selective `load`/`targetBudget` comparison to mix
+   * two incompatible token scales.
+   */
   estimateTokens(messages) {
-    let total = 0;
-    for (const m of messages) {
-      if (typeof m.content === "string") {
-        total += this.roughTokenEstimate(m.content);
-      } else {
-        for (const b of m.content) {
-          if (b.type === "text") total += this.roughTokenEstimate(b.text);
-          else if (b.type === "tool_use") total += this.roughTokenEstimate(JSON.stringify(b.input));
-          else if (b.type === "tool_result") {
-            total += this.roughTokenEstimate(
-              typeof b.content === "string" ? b.content : JSON.stringify(b.content)
-            );
-          }
-        }
-      }
-    }
-    return total;
-  }
-  roughTokenEstimate(text) {
-    return Math.max(1, Math.ceil(text.length / 3.5));
+    return estimateMessages(messages);
   }
 };
 
@@ -8089,6 +9148,7 @@ var ProviderBackedCompactor = class {
       return new SelectiveCompactor({
         ...common,
         selectorModel: this.opts.summarizerModel,
+        selectorMaxOutputTokens: this.opts.selectorMaxOutputTokens,
         summarizerModel: this.opts.summarizerModel
       });
     }
@@ -8224,15 +9284,20 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         this._cachedMsgCount = msgCount;
         this._cachedToolCount = toolCount;
       }
-      const load = tokens / this._maxContext;
+      const budget = computeContextWindowBudget(ctx, tokens, this._maxContext);
+      const load = budget.load;
       const policy = this.policyProvider?.(ctx);
       const thresholds = policy?.thresholds ?? {
         warn: this.warnThreshold,
         soft: this.softThreshold,
         hard: this.hardThreshold
       };
+      const repetition = repeatedReadPressure(ctx);
+      const adaptiveThresholds = adaptThresholdsForSignals(thresholds, {
+        repeatedReadCount: repetition
+      });
       const aggressiveOn = policy?.aggressiveOn ?? this.aggressiveOn;
-      const level = load >= thresholds.hard ? "hard" : load >= thresholds.soft ? "soft" : load >= thresholds.warn ? "warn" : null;
+      const level = load >= adaptiveThresholds.hard ? "hard" : load >= adaptiveThresholds.soft ? "soft" : load >= adaptiveThresholds.warn ? "warn" : null;
       if (!level) {
         this.lastNoopAttempt = null;
         return next(ctx);
@@ -8241,7 +9306,13 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         return next(ctx);
       }
       const aggressive = level === "hard" ? true : level === "soft" ? aggressiveOn !== "hard" : aggressiveOn === "warn";
-      await this.compact(ctx, aggressive, { level, tokens, load });
+      await this.compact(ctx, aggressive, {
+        level,
+        tokens,
+        load,
+        budget,
+        signals: { repeatedReadCount: repetition }
+      });
       return next(ctx);
     };
   }
@@ -8294,6 +9365,8 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         tokens: pressure.tokens,
         load: pressure.load,
         maxContext: this._maxContext,
+        budget: pressure.budget,
+        signals: pressure.signals,
         report,
         aggressive
       });
@@ -8305,6 +9378,8 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         level: pressure.level,
         aggressive,
         reductions: report.reductions?.map((r) => ({ phase: r.phase, saved: r.saved })),
+        budget: pressure.budget,
+        signals: pressure.signals,
         // Record what was collapsed so the audit trail shows the preserved
         // content, not just token counts. Bounded to keep the log line small;
         // the full original turns are already in the session JSONL.
@@ -8320,6 +9395,8 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         level: pressure.level,
         tokens: pressure.tokens,
         maxContext: this._maxContext,
+        budget: pressure.budget,
+        signals: pressure.signals,
         load: pressure.load,
         fatal
       });
@@ -8339,8 +9416,37 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
     }
   }
 };
-
-// src/execution/tool-executor.ts
+function computeContextWindowBudget(ctx, inputTokens, maxContext) {
+  const reservedOutputTokens = readPositiveMetaNumber(ctx, "contextOutputReserveTokens") ?? Math.floor(Math.min(8192, maxContext * 0.08));
+  const reservedSafetyTokens = readPositiveMetaNumber(ctx, "contextSafetyBufferTokens") ?? Math.floor(Math.min(4096, maxContext * 0.02));
+  const availableInputTokens = Math.max(
+    1,
+    maxContext - reservedOutputTokens - reservedSafetyTokens
+  );
+  const remainingInputTokens = availableInputTokens - inputTokens;
+  return {
+    maxContext,
+    inputTokens,
+    availableInputTokens,
+    remainingInputTokens,
+    reservedOutputTokens,
+    reservedSafetyTokens,
+    load: inputTokens / availableInputTokens,
+    overflowTokens: Math.max(0, -remainingInputTokens)
+  };
+}
+function readPositiveMetaNumber(ctx, key) {
+  const value = ctx.meta?.[key];
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : void 0;
+}
+function adaptThresholdsForSignals(thresholds, signals) {
+  if (signals.repeatedReadCount < 3) return thresholds;
+  return {
+    warn: Math.max(0.25, thresholds.warn - 0.08),
+    soft: Math.max(0.35, thresholds.soft - 0.04),
+    hard: thresholds.hard
+  };
+}
 var ToolExecutor = class _ToolExecutor {
   constructor(registry, opts) {
     this.registry = registry;
@@ -8437,7 +9543,8 @@ ${errorDetails}`,
       let effectivePermission = decision.permission;
       const policy = this.opts.permissionPolicy;
       const yolo = policy.getYolo?.() === true || policy.getYoloDestructive?.() === true;
-      if (toolDangerousCaps.length > 0 && effectivePermission === "auto" && !yolo) {
+      const authoritativeAuto = decision.source === "yolo";
+      if (toolDangerousCaps.length > 0 && effectivePermission === "auto" && !yolo && !authoritativeAuto) {
         effectivePermission = "confirm";
       }
       if (effectivePermission === "deny") {
@@ -8579,9 +9686,10 @@ ${post.additionalContext}`;
     });
     this.opts.renderer?.writeToolCall(tool.name, use.input);
     const output = await this.runWithTimeout(tool, use.input, ctx.signal, ctx, use.id);
-    const text = this.serializer.serialize(output);
+    const text = this.serializer.serialize(output, { toolName: tool.name, input: use.input });
     const scrubbed = this.opts.secretScrubber.scrub(text);
-    const { text: capped, newBudget } = this.serializer.enforceCap(scrubbed, budget);
+    const withArtifact = await maybePersistLargeToolOutput(tool.name, scrubbed, budget);
+    const { text: capped, newBudget } = this.serializer.enforceCap(withArtifact, budget);
     this.opts.renderer?.writeToolResult(tool.name, capped, false);
     return {
       block: {
@@ -8606,38 +9714,27 @@ ${post.additionalContext}`;
       tool.timeoutMs ?? this.iterationTimeoutMs,
       this.maxToolTimeoutMs
     );
-    const ctrl = new AbortController();
-    const timer = setTimeout(() => ctrl.abort(new Error("tool timeout")), timeoutMs);
-    const combined = AbortSignal.any([parentSignal, ctrl.signal]);
-    let cleanupCalled = false;
-    let caught = false;
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    const combined = AbortSignal.any([parentSignal, timeoutSignal]);
+    let output;
     try {
-      if (typeof tool.executeStream === "function") {
-        return await this.runStreamedTool(tool, input, ctx, combined, toolUseId);
-      }
-      return await tool.execute(input, ctx, { signal: combined });
+      output = typeof tool.executeStream === "function" ? await this.runStreamedTool(tool, input, ctx, combined, toolUseId) : await tool.execute(input, ctx, { signal: combined });
     } catch (err) {
-      caught = true;
-      if (combined.aborted && typeof tool.cleanup === "function") {
-        cleanupCalled = true;
-        try {
-          await tool.cleanup(input, ctx);
-        } catch {
-        }
-      }
+      if (combined.aborted) await this.runToolCleanup(tool, input, ctx);
       throw err;
-    } finally {
-      clearTimeout(timer);
-      if (combined.aborted && !caught) {
-        if (!cleanupCalled && typeof tool.cleanup === "function") {
-          try {
-            await tool.cleanup(input, ctx);
-          } catch {
-          }
-        }
-        const reason = combined.reason instanceof Error ? combined.reason : new Error(typeof combined.reason === "string" ? combined.reason : "aborted");
-        throw reason;
-      }
+    }
+    if (combined.aborted) {
+      await this.runToolCleanup(tool, input, ctx);
+      throw combined.reason instanceof Error ? combined.reason : new Error(typeof combined.reason === "string" ? combined.reason : "tool timeout");
+    }
+    return output;
+  }
+  /** Best-effort tool cleanup; never let it mask the original error. */
+  async runToolCleanup(tool, input, ctx) {
+    if (typeof tool.cleanup !== "function") return;
+    try {
+      await tool.cleanup(input, ctx);
+    } catch {
     }
   }
   async runStreamedTool(tool, input, ctx, signal, toolUseId) {
@@ -8806,6 +9903,25 @@ function extractMalformedRaw(input) {
     return String(value);
   }
 }
+var TOOL_OUTPUT_ARTIFACT_THRESHOLD_BYTES = 64 * 1024;
+async function maybePersistLargeToolOutput(toolName, content, budget) {
+  const bytes = Buffer.byteLength(content, "utf8");
+  if (bytes <= Math.min(TOOL_OUTPUT_ARTIFACT_THRESHOLD_BYTES, Math.max(0, budget))) {
+    return content;
+  }
+  try {
+    const dir = path4.join(wstackGlobalRoot(), "tool-output");
+    await fsp2.mkdir(dir, { recursive: true });
+    const safeTool = toolName.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    const filePath = path4.join(dir, `${stamp}-${safeTool}-${randomUUID()}.log`);
+    await fsp2.writeFile(filePath, content, "utf8");
+    return content + `
+[full tool output: ${bytes} bytes at ${filePath}; read/grep that file selectively instead of re-running or requesting more output]`;
+  } catch {
+    return content;
+  }
+}
 
 // src/execution/autonomous-runner.ts
 var DoneConditionChecker = class {
@@ -9818,6 +10934,7 @@ ${recentJournal}` : ""
 
 // src/coordination/subagent-budget.ts
 var TIMEOUT_PREEMPT_FRACTION = 0.85;
+var DECISION_TIMEOUT_MS = 6e4;
 var BudgetExceededError = class extends Error {
   kind;
   limit;
@@ -9847,6 +10964,31 @@ var BudgetThresholdSignal = class extends Error {
 };
 var SubagentBudget = class _SubagentBudget {
   limits;
+  /** Patch one or more budget limits in-place after construction.
+   * Used by the coordinator watchdog when granting an extension.
+   * All fields are optional — only provided fields are updated.
+   * This is the single write path for limit mutations so that future
+   * validation or side-effects live in one place (M1). */
+  patchLimits(ext) {
+    if (ext.maxIterations !== void 0) {
+      this.limits.maxIterations = ext.maxIterations;
+    }
+    if (ext.maxToolCalls !== void 0) {
+      this.limits.maxToolCalls = ext.maxToolCalls;
+    }
+    if (ext.maxTokens !== void 0) {
+      this.limits.maxTokens = ext.maxTokens;
+    }
+    if (ext.maxCostUsd !== void 0) {
+      this.limits.maxCostUsd = ext.maxCostUsd;
+    }
+    if (ext.timeoutMs !== void 0) {
+      this.limits.timeoutMs = ext.timeoutMs;
+    }
+    if (ext.idleTimeoutMs !== void 0) {
+      this.limits.idleTimeoutMs = ext.idleTimeoutMs;
+    }
+  }
   iterations = 0;
   toolCalls = 0;
   tokenInput = 0;
@@ -9867,12 +11009,44 @@ var SubagentBudget = class _SubagentBudget {
    * or hung listener (Director not built / event filter detached mid-run)
    * leaves the budget over-limit and never enforces anything.
    */
-  static DECISION_TIMEOUT_MS = 6e4;
+  static DECISION_TIMEOUT_MS = DECISION_TIMEOUT_MS;
   /**
    * Injected by the runner when wiring the budget to its EventBus.
    * Used to emit `budget.threshold_reached` events in `'auto'` mode.
    */
   _events;
+  /**
+   * Guard against dual-path races between the coordinator watchdog
+   * (`executeWithTimeout`) and the budget's own `checkTimeout()`.
+   * Both paths detect `elapsed >= timeoutMs` and can emit
+   * `budget.threshold_reached` for kind `'timeout'` simultaneously.
+   * Set to the current `timeoutMs` ceiling by the coordinator BEFORE
+   * calling `onThreshold`, and cleared after the negotiation resolves.
+   * `checkTimeout()` skips its wall-clock check while this is set so
+   * the coordinator's watchdog is the sole source of wall-clock timeout
+   * events — `checkTimeout()` focuses exclusively on `idle_timeout`.
+   */
+  _watchdogActive;
+  /** Returns the timeout ceiling currently being negotiated by the watchdog,
+   * or `undefined` when no wall-clock negotiation is in flight.
+   * Used by `executeWithTimeout` to detect a stale lock (M3). */
+  get watchdogActive() {
+    return this._watchdogActive;
+  }
+  /** Called by the coordinator watchdog BEFORE calling `onThreshold` so that
+   * `checkTimeout()` skips its wall-clock check for this ceiling. Prevents
+   * the budget's own `checkTimeout()` from emitting a second
+   * `budget.threshold_reached` event while the watchdog is already
+   * negotiating the same wall-clock deadline (C1). */
+  setWatchdogNegotiation(timeoutMs) {
+    this._watchdogActive = timeoutMs;
+  }
+  /** Clears the watchdog guard after negotiation resolves. Called in the
+   * `finally` block of both the pre-empt and deadline branches so it fires
+   * on every exit path: grant, deny, throw, or error. */
+  clearWatchdogNegotiation() {
+    this._watchdogActive = void 0;
+  }
   /**
    * Negotiation mode — controls whether a threshold hit tries to emit
    * `budget.threshold_reached` and wait for a coordinator decision, or
@@ -9973,7 +11147,8 @@ var SubagentBudget = class _SubagentBudget {
       if (this.limits.idleTimeoutMs !== void 0 && idle > this.limits.idleTimeoutMs) {
         exceeded.push({ kind: "idle_timeout", used: idle, limit: this.limits.idleTimeoutMs });
       }
-      if (this.limits.timeoutMs !== void 0 && elapsedMs > this.limits.timeoutMs) {
+      const wallOwnedByWatchdog = this._onThreshold !== void 0 && this._watchdogActive === this.limits.timeoutMs;
+      if (this.limits.timeoutMs !== void 0 && elapsedMs > this.limits.timeoutMs && !wallOwnedByWatchdog) {
         exceeded.push({ kind: "timeout", used: elapsedMs, limit: this.limits.timeoutMs });
       }
     }
@@ -9987,19 +11162,99 @@ var SubagentBudget = class _SubagentBudget {
       throw new BudgetExceededError(first2.kind, first2.limit, first2.used);
     }
     const bus = this._events;
-    if (!bus || !bus.hasListenerFor("budget.threshold_reached")) {
+    if (!bus) {
       const first2 = exceeded[0] ?? { kind: "iterations", limit: 0, used: 0 };
       throw new BudgetExceededError(first2.kind, first2.limit, first2.used);
     }
+    const first = exceeded[0] ?? { kind: "iterations", limit: 0, used: 0 };
+    if (bus.hasListenerFor("budget.threshold_reached")) {
+      for (const entry of exceeded) {
+        if (this._pendingNegotiations.has(entry.kind)) continue;
+        this._pendingNegotiations.set(entry.kind, this._negotiateExtension(entry));
+      }
+      const decision = this._pendingNegotiations.get(first.kind);
+      if (!decision) throw new Error(`No pending negotiation for ${first.kind}`);
+      throw new BudgetThresholdSignal(first.kind, first.limit, first.used, decision);
+    }
+    let hardStop = null;
     for (const entry of exceeded) {
       if (this._pendingNegotiations.has(entry.kind)) continue;
-      const decision2 = this._negotiateExtension(entry.kind, exceeded);
-      this._pendingNegotiations.set(entry.kind, decision2);
+      const marker = Promise.resolve("stop");
+      this._pendingNegotiations.set(entry.kind, marker);
+      void marker.finally(() => this._pendingNegotiations.delete(entry.kind));
+      const sync = this._invokeHandlerSync(entry);
+      if (!sync) hardStop ??= new BudgetExceededError(entry.kind, entry.limit, entry.used);
     }
-    const first = exceeded[0] ?? { kind: "iterations", limit: 0, used: 0 };
-    const decision = this._pendingNegotiations.get(first.kind);
-    if (!decision) throw new Error(`No pending negotiation for ${first.kind}`);
-    throw new BudgetThresholdSignal(first.kind, first.limit, first.used, decision);
+    if (hardStop) throw hardStop;
+    return exceeded;
+  }
+  /**
+   * Invoke `onThreshold` once for `entry` on the NO-LISTENER path and report
+   * whether it decided synchronously. Returns `true` when the handler returned
+   * a synchronous decision (already honored — an `extend` patched the limits),
+   * or `false` when it returned a Promise (async; the caller hard-stops, since
+   * there is no listener to resolve the negotiation). The handler is given the
+   * full info shape (`requestDecision` plus direct `extend`/`deny`) so both
+   * recording handlers and policy handlers work without a wired listener.
+   */
+  _invokeHandlerSync(entry) {
+    const handler = this._onThreshold;
+    if (!handler) return false;
+    let extendArg;
+    const result = handler({
+      kind: entry.kind,
+      used: entry.used,
+      limit: entry.limit,
+      requestDecision: () => this._busRequestDecision(entry),
+      // Direct hooks for synchronous policy/recording handlers.
+      extend: (extra) => {
+        extendArg = extra;
+      },
+      deny: () => {
+      }
+    });
+    if (result && typeof result.then === "function") return false;
+    if (result === "throw") return false;
+    if (result && typeof result === "object" && "extend" in result) {
+      extendArg = result.extend;
+    }
+    if (extendArg) this.patchLimits(extendArg);
+    return true;
+  }
+  /**
+   * Emit `budget.threshold_reached` and resolve to the listener's verdict.
+   * Resolves to `'stop'` immediately when there is no listener (or no bus) so
+   * no negotiation can hang and no fallback timer leaks. Mirrors the
+   * coordinator watchdog's own request path so both agree on the no-listener
+   * default.
+   */
+  _busRequestDecision(entry) {
+    const bus = this._events;
+    if (!bus || !bus.hasListenerFor("budget.threshold_reached")) {
+      return Promise.resolve("stop");
+    }
+    return new Promise((resolve6) => {
+      let resolved = false;
+      const respond = (d) => {
+        if (resolved) return;
+        resolved = true;
+        clearTimeout(fallback);
+        resolve6(d);
+      };
+      const fallback = setTimeout(() => respond("stop"), _SubagentBudget.DECISION_TIMEOUT_MS);
+      bus.emit("budget.threshold_reached", {
+        kind: entry.kind,
+        used: entry.used,
+        limit: entry.limit,
+        timeoutMs: _SubagentBudget.DECISION_TIMEOUT_MS,
+        // deny() wins over a same-dispatch extend(): a listener that both grants
+        // and denies (or two listeners disagreeing) is resolved as a stop. The
+        // grant is deferred a microtask so a synchronous deny in the same emit
+        // pre-empts it; async grants still resolve normally.
+        extend: (extra) => queueMicrotask(() => respond({ extend: extra })),
+        deny: () => respond("stop")
+      });
+    });
   }
   /**
    * Per-kind in-flight negotiation Promises. Each budget kind can have its
@@ -10019,77 +11274,33 @@ var SubagentBudget = class _SubagentBudget {
    * `{ extend: {} }` — keep going without patching; next overrun fires
    * a fresh signal.
    */
-  async _negotiateExtension(kind, exceeded) {
+  async _negotiateExtension(entry) {
     if (!this._onThreshold) {
       return "stop";
     }
     try {
-      const first = exceeded[0] ?? { kind: "iterations", limit: 0, used: 0 };
       const result = this._onThreshold({
-        kind: first.kind,
-        used: first.used,
-        limit: first.limit,
-        requestDecision: () => {
-          const bus = this._events;
-          if (!bus || !bus.hasListenerFor("budget.threshold_reached")) {
-            return Promise.resolve("stop");
-          }
-          return new Promise((resolve5) => {
-            let resolved = false;
-            const respond = (d) => {
-              if (resolved) return;
-              resolved = true;
-              resolve5(d);
-            };
-            const fallback = setTimeout(
-              () => respond("stop"),
-              _SubagentBudget.DECISION_TIMEOUT_MS
-            );
-            for (const { kind: kind2, used, limit } of exceeded) {
-              bus.emit("budget.threshold_reached", {
-                kind: kind2,
-                used,
-                limit,
-                timeoutMs: _SubagentBudget.DECISION_TIMEOUT_MS,
-                extend: (extra) => {
-                  clearTimeout(fallback);
-                  respond({ extend: extra });
-                },
-                deny: () => {
-                  clearTimeout(fallback);
-                  respond("stop");
-                }
-              });
-            }
-          });
+        kind: entry.kind,
+        used: entry.used,
+        limit: entry.limit,
+        // One event for THIS kind only — each exceeded kind has its own
+        // negotiation (and its own resolve), so there is no cross-kind
+        // first-wins drop and no O(N^2) re-emission.
+        requestDecision: () => this._busRequestDecision(entry),
+        extend: (extra) => {
+          this.patchLimits(extra);
+        },
+        deny: () => {
         }
       });
       if (result === "throw") return "stop";
       if (result === "continue") return { extend: {} };
       const decision = await result;
       if (decision === "stop") return "stop";
-      const ext = decision.extend;
-      if (ext.maxIterations !== void 0) {
-        this.limits.maxIterations = ext.maxIterations;
-      }
-      if (ext.maxToolCalls !== void 0) {
-        this.limits.maxToolCalls = ext.maxToolCalls;
-      }
-      if (ext.maxTokens !== void 0) {
-        this.limits.maxTokens = ext.maxTokens;
-      }
-      if (ext.maxCostUsd !== void 0) {
-        this.limits.maxCostUsd = ext.maxCostUsd;
-      }
-      if (ext.timeoutMs !== void 0) {
-        this.limits.timeoutMs = ext.timeoutMs;
-      }
-      if (ext.idleTimeoutMs !== void 0) {
-        this.limits.idleTimeoutMs = ext.idleTimeoutMs;
-      }
+      this.patchLimits(decision.extend);
       return decision;
     } finally {
-      this._pendingNegotiations.delete(kind);
+      this._pendingNegotiations.delete(entry.kind);
     }
   }
   recordIteration() {
@@ -10132,7 +11343,8 @@ var SubagentBudget = class _SubagentBudget {
     const { timeoutMs, idleTimeoutMs } = this.limits;
     if (timeoutMs === void 0 && idleTimeoutMs === void 0) return;
     const elapsed = Date.now() - this.startTime;
-    const wallTripped = timeoutMs !== void 0 && elapsed > timeoutMs;
+    const wallSkipped = this._onThreshold !== void 0 && this._watchdogActive !== void 0 && timeoutMs !== void 0 && this._watchdogActive === timeoutMs;
+    const wallTripped = wallSkipped ? false : timeoutMs !== void 0 && elapsed > timeoutMs;
     const idleTripped = idleTimeoutMs !== void 0 && this.idleMs() > idleTimeoutMs;
     if (!wallTripped && !idleTripped) return;
     void this.checkLimits(elapsed);
@@ -13640,6 +14852,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
   terminating = /* @__PURE__ */ new Set();
   constructor(config, options = {}) {
     super();
+    this.setMaxListeners(0);
     this.coordinatorId = config.coordinatorId;
     this.config = config;
     this.runner = options.runner;
@@ -13837,7 +15050,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       taskIds.map((id) => {
         const cached = this.completedResults.find((r) => r.taskId === id);
         if (cached) return cached;
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           const timeout = setTimeout(() => {
             this.off("task.completed", handler);
             reject(new Error(`awaitTasks timed out waiting for task "${id}"`));
@@ -13846,7 +15059,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
             if (result.taskId === id) {
               clearTimeout(timeout);
               this.off("task.completed", handler);
-              resolve5(result);
+              resolve6(result);
             }
           };
           this.on("task.completed", handler);
@@ -14034,7 +15247,13 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
     let result;
     budget.start();
     try {
-      const outcome = await this.executeWithTimeout(this.runner, task, runCtx, budget);
+      const outcome = await this.executeWithTimeout(
+        this.runner,
+        task,
+        runCtx,
+        budget,
+        subagent.config.preemptFraction
+      );
       result = {
         subagentId,
         taskId: task.id,
@@ -14061,7 +15280,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
     }
     this.recordCompletion(result);
   }
-  async executeWithTimeout(runner, task, ctx, budget) {
+  async executeWithTimeout(runner, task, ctx, budget, preemptFraction = TIMEOUT_PREEMPT_FRACTION) {
     const initialTimeoutMs = budget.limits.timeoutMs;
     const idleLimitMs = budget.limits.idleTimeoutMs;
     if (initialTimeoutMs === void 0 && idleLimitMs === void 0) {
@@ -14069,8 +15288,21 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
     }
     const start = Date.now();
     let timer = null;
-    let preemptedForLimit = null;
+    let PreemptState;
+    ((PreemptState2) => {
+      PreemptState2["ACTIVE"] = "active";
+      PreemptState2["LOCKED"] = "locked";
+    })(PreemptState || (PreemptState = {}));
+    let preemptedCeiling = null;
+    let preemptState = "active" /* ACTIVE */;
+    let lastGrantActivityTs = -1;
     const timeoutPromise = new Promise((_, reject) => {
+      const terminate = (kind, limit, used) => {
+        this.subagents.get(ctx.subagentId)?.abortController.abort();
+        reject(
+          budget._events?.hasListenerFor("budget.threshold_reached") ? new Error(`subagent stopped: budget ${kind} (limit=${limit}, used=${used})`) : new BudgetExceededError(kind, limit, used)
+        );
+      };
       const armFor = (ms) => {
         if (timer) clearTimeout(timer);
         timer = setTimeout(onTick, Math.max(0, ms));
@@ -14079,7 +15311,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
         const wallLimit = budget.limits.timeoutMs ?? initialTimeoutMs;
         const wallRemaining = initialTimeoutMs === void 0 ? Number.POSITIVE_INFINITY : wallLimit - (Date.now() - start);
         const idleRemaining = idleLimitMs === void 0 ? Number.POSITIVE_INFINITY : (budget.limits.idleTimeoutMs ?? idleLimitMs) - budget.idleMs();
-        const preemptRemaining = initialTimeoutMs === void 0 || preemptedForLimit === wallLimit ? Number.POSITIVE_INFINITY : wallLimit * TIMEOUT_PREEMPT_FRACTION - (Date.now() - start);
+        const preemptRemaining = initialTimeoutMs === void 0 || preemptedCeiling === wallLimit ? Number.POSITIVE_INFINITY : wallLimit * preemptFraction - (Date.now() - start);
         armFor(Math.max(25, Math.min(wallRemaining, idleRemaining, preemptRemaining)));
       };
       const negotiateTimeout = async (used, limit) => {
@@ -14089,16 +15321,42 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
           kind: "timeout",
           used,
           limit,
-          requestDecision: () => new Promise((resolveDecision) => {
-            budget._events?.emit("budget.threshold_reached", {
-              kind: "timeout",
-              used,
-              limit,
-              timeoutMs: 6e4,
-              extend: (extra) => resolveDecision({ extend: extra }),
-              deny: () => resolveDecision("stop")
+          requestDecision: () => {
+            if (!budget._events?.hasListenerFor("budget.threshold_reached")) {
+              return Promise.resolve("stop");
+            }
+            return new Promise((resolveDecision) => {
+              let settled = false;
+              const resolve6 = (d) => {
+                if (settled) return;
+                settled = true;
+                resolveDecision(d);
+              };
+              const fallback = setTimeout(() => resolve6("stop"), DECISION_TIMEOUT_MS);
+              budget._events?.emit("budget.threshold_reached", {
+                kind: "timeout",
+                used,
+                limit,
+                // Informational: the budget's own decision deadline. Listeners may use
+                // this to display a countdown. The coordinator does NOT enforce it —
+                // it is the budget's own `setTimeout(fallback)` that races against
+                // the listener's `extend()`/`deny()` call to guarantee progress.
+                timeoutMs: DECISION_TIMEOUT_MS,
+                // deny() wins over a same-dispatch extend(): defer the grant a
+                // microtask so a synchronous deny in the same emit pre-empts it
+                // (a listener that both grants and denies, or two listeners
+                // disagreeing, resolves as a stop). Async grants still resolve.
+                extend: (extra) => {
+                  clearTimeout(fallback);
+                  queueMicrotask(() => resolve6({ extend: extra }));
+                },
+                deny: () => {
+                  clearTimeout(fallback);
+                  resolve6("stop");
+                }
+              });
             });
-          })
+          }
         });
         return typeof result === "string" ? result : await result;
       };
@@ -14109,21 +15367,45 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
         const wallExceeded = wallLimit !== void 0 && elapsed >= wallLimit;
         const idleExceeded = idleLimit !== void 0 && budget.idleMs() >= idleLimit;
         if (idleExceeded && !wallExceeded) {
+          budget._events?.emit("budget.threshold_reached", {
+            kind: "idle_timeout",
+            used: budget.idleMs(),
+            limit: idleLimit ?? 0,
+            timeoutMs: DECISION_TIMEOUT_MS,
+            extend: () => {
+            },
+            deny: () => {
+            }
+          });
           this.subagents.get(ctx.subagentId)?.abortController.abort();
-          reject(new BudgetExceededError("timeout", idleLimit ?? 0, budget.idleMs()));
+          reject(new BudgetExceededError("idle_timeout", idleLimit ?? 0, budget.idleMs()));
           return;
         }
-        if (wallLimit !== void 0 && !wallExceeded && budget.onThreshold && preemptedForLimit !== wallLimit && elapsed >= wallLimit * TIMEOUT_PREEMPT_FRACTION) {
+        if (wallLimit !== void 0 && !wallExceeded && budget.onThreshold && preemptState === "active" /* ACTIVE */ && elapsed >= wallLimit * preemptFraction) {
+          const activityTs = Date.now() - budget.idleMs();
+          if (activityTs <= lastGrantActivityTs) {
+            preemptState = "locked" /* LOCKED */;
+            preemptedCeiling = wallLimit;
+            scheduleNext();
+            return;
+          }
+          budget.setWatchdogNegotiation(wallLimit);
           try {
             const decision = await negotiateTimeout(elapsed, wallLimit);
             if (typeof decision !== "string" && decision.extend.timeoutMs !== void 0) {
-              budget.limits.timeoutMs = decision.extend.timeoutMs;
-              preemptedForLimit = null;
+              budget.patchLimits({ timeoutMs: decision.extend.timeoutMs });
+              lastGrantActivityTs = Date.now() - budget.idleMs();
+              preemptState = "active" /* ACTIVE */;
+              preemptedCeiling = null;
             } else {
-              preemptedForLimit = wallLimit;
+              preemptState = "locked" /* LOCKED */;
+              preemptedCeiling = wallLimit;
             }
           } catch {
-            preemptedForLimit = wallLimit;
+            preemptState = "locked" /* LOCKED */;
+            preemptedCeiling = wallLimit;
+          } finally {
+            budget.clearWatchdogNegotiation();
           }
           scheduleNext();
           return;
@@ -14138,26 +15420,41 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
           reject(new BudgetExceededError("timeout", limit, elapsed));
           return;
         }
+        budget.setWatchdogNegotiation(limit);
         try {
           const decision = await negotiateTimeout(elapsed, limit);
-          if (decision === "continue" || decision === "throw" || decision === "stop") {
-            preemptedForLimit = null;
+          if (decision === "throw") {
+            terminate("timeout", limit, elapsed);
+            return;
+          }
+          if (decision === "continue") {
+            preemptState = "locked" /* LOCKED */;
+            preemptedCeiling = wallLimit;
             armFor(Math.max(1e3, limit));
             return;
           }
+          if (decision === "stop") {
+            terminate("timeout", limit, elapsed);
+            return;
+          }
           if (decision.extend.timeoutMs !== void 0) {
-            budget.limits.timeoutMs = decision.extend.timeoutMs;
-            preemptedForLimit = null;
+            budget.patchLimits({ timeoutMs: decision.extend.timeoutMs });
+            lastGrantActivityTs = Date.now() - budget.idleMs();
+            preemptState = "active" /* ACTIVE */;
+            preemptedCeiling = null;
             scheduleNext();
             return;
           }
-          this.subagents.get(ctx.subagentId)?.abortController.abort();
-          reject(new BudgetExceededError("timeout", limit, elapsed));
+          terminate("timeout", limit, elapsed);
+          return;
         } catch (err) {
           this.subagents.get(ctx.subagentId)?.abortController.abort();
           reject(
             err instanceof BudgetExceededError ? err : new BudgetExceededError("timeout", limit, elapsed)
           );
+          return;
+        } finally {
+          budget.clearWatchdogNegotiation();
         }
       };
       scheduleNext();
@@ -14943,7 +16240,7 @@ var InMemoryAgentBridge = class {
       });
     }
     this.inflightGuards.add(correlationId);
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const timer = setTimeout(() => {
         this.inflightGuards.delete(correlationId);
         this.pendingRequests.delete(correlationId);
@@ -14962,7 +16259,7 @@ var InMemoryAgentBridge = class {
         return;
       }
       this.pendingRequests.set(correlationId, {
-        resolve: resolve5,
+        resolve: resolve6,
         reject,
         timer
       });
@@ -15634,6 +16931,24 @@ Working rules:
 var DEFAULT_SUBAGENT_BASELINE = `You are a subagent operating under a Director. You were spawned to handle
 a specific slice of a larger plan \u2014 do that slice well and report back.
 
+Capabilities & operating rules:
+  - You have full developer tools for your task: read, write/edit, search,
+    shell + build (lint, format, typecheck, test), and dependency install.
+    Use them directly to finish the task end-to-end. You run non-interactively
+    \u2014 there is no human to approve individual tool calls, so routine work is
+    pre-authorized; do not stop to ask for permission to read, edit, or build.
+  - Stay inside the project root. Do not write files outside the repository,
+    and do not touch machine config, credentials, or global state \u2014 those
+    require an explicit grant you do not have.
+  - Prefer the least-destructive path. Do not run irreversible or destructive
+    commands (e.g. \`rm -rf\`, \`git push --force\`, history rewrites, dropping
+    databases, mass deletes) unless the task explicitly requires it and names
+    the target.
+  - When you change code, verify it: run the relevant build / typecheck / tests
+    and fix what you broke before reporting done.
+  - Make only the changes the task calls for \u2014 don't refactor or reformat
+    unrelated code.
+
 Bridge contract:
   - You have a parent (the Director). You may call \`request\` on the
     parent bridge to ask a clarifying question. Use this sparingly; the
@@ -16591,6 +17906,8 @@ var Director = class _Director {
   sessionsRoot;
   /** Director run id for JSONL path resolution. */
   directorRunId;
+  /** Optional logger for structured logging. Falls back to noop when omitted. */
+  logger;
   /** Resolves task descriptions back from `assign()` so completion events
    *  can also carry a human-readable title. */
   taskDescriptions = /* @__PURE__ */ new Map();
@@ -16679,6 +17996,7 @@ var Director = class _Director {
       opts.checkpointDebounceMs ?? 250
     ) : null;
     this.fleetManager = opts.fleetManager;
+    this.logger = opts.logger;
     if (this.sharedScratchpadPath) {
       void fsp2.mkdir(this.sharedScratchpadPath, { recursive: true }).catch((err) => this.logShutdownError("shared_scratchpad_mkdir", err));
     }
@@ -16978,7 +18296,10 @@ var Director = class _Director {
     entry.session.cancel(reason);
     for (const [_role, subagentId] of entry.session.getSubagentIds()) {
       this.coordinator.stop(subagentId).catch((err) => {
-        console.debug(`[director] stop subagent ${subagentId} failed (may have already completed): ${err}`);
+        this.logger?.debug(`stop subagent ${subagentId} failed (may have already completed)`, {
+          subagentId,
+          err: err instanceof Error ? err.message : String(err)
+        });
       });
     }
   }
@@ -17038,7 +18359,7 @@ var Director = class _Director {
    * Caller-supplied `priceLookup` is optional but recommended — without
    * it the `cost` column in `usage.snapshot()` stays at 0.
    */
-  async spawn(config, priceLookup) {
+  async spawn(callerConfig, priceLookup) {
     if (this.workCompleteFlag) {
       throw new FleetSpawnBudgetError(
         "max_spawns",
@@ -17047,6 +18368,7 @@ var Director = class _Director {
         "workComplete() has been called \u2014 director closed further spawning"
       );
     }
+    const config = { ...callerConfig };
     if (!config.model && this.modelMatrix) {
       const matrix = typeof this.modelMatrix === "function" ? this.modelMatrix() : this.modelMatrix;
       const entry = resolveModelMatrix(matrix, config.role);
@@ -17272,7 +18594,7 @@ var Director = class _Director {
       })),
       usage: this.usage.snapshot()
     };
-    await fsp2.mkdir(path3.dirname(this.manifestPath), { recursive: true });
+    await fsp2.mkdir(path4.dirname(this.manifestPath), { recursive: true });
     await atomicWrite(this.manifestPath, JSON.stringify(manifest, null, 2), { mode: 384 });
     return this.manifestPath;
   }
@@ -17399,11 +18721,11 @@ var Director = class _Director {
         if (cached) return cached;
         const existing = this.taskWaiters.get(id);
         if (existing) return existing.promise;
-        let resolve5;
+        let resolve6;
         const promise = new Promise((res) => {
-          resolve5 = res;
+          resolve6 = res;
         });
-        this.taskWaiters.set(id, { promise, resolve: resolve5 });
+        this.taskWaiters.set(id, { promise, resolve: resolve6 });
         return promise;
       })
     );
@@ -17486,7 +18808,7 @@ var Director = class _Director {
    */
   async readSession(subagentId, tail) {
     if (!this.sessionsRoot) return null;
-    const filePath = path3.join(this.sessionsRoot, this.directorRunId, `${subagentId}.jsonl`);
+    const filePath = path4.join(this.sessionsRoot, this.directorRunId, `${subagentId}.jsonl`);
     let raw;
     try {
       raw = await fsp2.readFile(filePath, "utf8");
@@ -17799,7 +19121,7 @@ function createDelegateTool(opts) {
           subagentId
         });
         const dir = director;
-        const result = await new Promise((resolve5) => {
+        const result = await new Promise((resolve6) => {
           let settled = false;
           let timer;
           const finish = (value) => {
@@ -17809,7 +19131,7 @@ function createDelegateTool(opts) {
             offTool();
             offIter();
             offProgress();
-            resolve5(value);
+            resolve6(value);
           };
           const arm = () => {
             if (timer) clearTimeout(timer);
@@ -18016,13 +19338,13 @@ async function readSubagentPartial(opts, subagentId) {
   if (!opts.sessionsRoot) return void 0;
   const candidates = [];
   if (opts.directorRunId) {
-    candidates.push(path3.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
+    candidates.push(path4.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
   } else {
     try {
       const entries = await fsp2.readdir(opts.sessionsRoot, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
-          candidates.push(path3.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
+          candidates.push(path4.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
         }
       }
     } catch {
@@ -18072,9 +19394,9 @@ function makeDirectorSessionFactory(opts) {
   let dir;
   if (opts.store) {
     store = opts.store;
-    dir = opts.sessionsRoot ? path3.join(opts.sessionsRoot, runId) : "(caller-managed)";
+    dir = opts.sessionsRoot ? path4.join(opts.sessionsRoot, runId) : "(caller-managed)";
   } else if (opts.sessionsRoot) {
-    dir = path3.join(opts.sessionsRoot, runId);
+    dir = path4.join(opts.sessionsRoot, runId);
     store = new DefaultSessionStore({ dir });
   } else {
     throw new Error("makeDirectorSessionFactory requires either `store` or `sessionsRoot`");
@@ -18120,6 +19442,7 @@ function attachAutoExtend(events, policy = {}) {
   const extendCounts = /* @__PURE__ */ new Map();
   let progress = 0;
   let lastTimeoutProgress = -1;
+  let lastSeenKey = null;
   const unsubs = [
     events.on("tool.executed", () => {
       progress++;
@@ -18129,6 +19452,9 @@ function attachAutoExtend(events, policy = {}) {
     }),
     events.on("budget.threshold_reached", (e) => {
       const { kind, limit, extend, deny } = e;
+      const key = `${kind}:${limit}`;
+      if (key === lastSeenKey) return;
+      lastSeenKey = key;
       if (kind === "timeout" || kind === "idle_timeout") {
         if (progress > lastTimeoutProgress) {
           lastTimeoutProgress = progress;
@@ -18220,7 +19546,7 @@ var DefaultModelsRegistry = class {
     this.overlay = opts.overlay;
     this.overlayUrl = opts.overlayUrl;
     this.overlayFile = opts.overlayFile;
-    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path3.join(path3.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
+    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path4.join(path4.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
   }
   async load(opts = {}) {
     if (this.payload && !opts.force) return this.payload;
@@ -18433,7 +19759,7 @@ var DefaultModelsRegistry = class {
   }
   /** Used by `wstack models refresh` to expose where the cache lives. */
   cacheLocation() {
-    return path3.resolve(this.cacheFile);
+    return path4.resolve(this.cacheFile);
   }
 };
 function hasEntries(payload) {
@@ -18800,7 +20126,7 @@ var DefaultModeStore = class {
   }
   async loadActiveMode() {
     try {
-      const configPath = path3.join(this.configDir, "mode.json");
+      const configPath = path4.join(this.configDir, "mode.json");
       const content = await fsp2.readFile(configPath, "utf8");
       const data = JSON.parse(content);
       this.activeModeId = data.activeMode ?? null;
@@ -18811,7 +20137,7 @@ var DefaultModeStore = class {
   async saveActiveMode() {
     try {
       await fsp2.mkdir(this.configDir, { recursive: true });
-      const configPath = path3.join(this.configDir, "mode.json");
+      const configPath = path4.join(this.configDir, "mode.json");
       await atomicWrite(
         configPath,
         JSON.stringify({ activeMode: this.activeModeId }, null, 2)
@@ -18826,11 +20152,11 @@ async function loadProjectModes(modesDir) {
     const entries = await fsp2.readdir(modesDir);
     for (const entry of entries) {
       if (!entry.endsWith(".md") && !entry.endsWith(".txt")) continue;
-      const filePath = path3.join(modesDir, entry);
+      const filePath = path4.join(modesDir, entry);
       const stat6 = await fsp2.stat(filePath);
       if (!stat6.isFile()) continue;
       const content = await fsp2.readFile(filePath, "utf8");
-      const id = path3.basename(entry, path3.extname(entry));
+      const id = path4.basename(entry, path4.extname(entry));
       modes.push({
         id,
         name: id.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()),
@@ -18846,7 +20172,7 @@ async function loadProjectModes(modesDir) {
 async function loadUserModes(modesDir) {
   const modes = [];
   try {
-    const manifestPath = path3.join(modesDir, "modes.json");
+    const manifestPath = path4.join(modesDir, "modes.json");
     const content = await fsp2.readFile(manifestPath, "utf8");
     const manifest = JSON.parse(content);
     for (const mode of manifest.modes) {
@@ -18857,6 +20183,35 @@ async function loadUserModes(modesDir) {
   return modes;
 }
 
+// src/models/provider-model-resolve.ts
+function describeCatalogModel(m) {
+  return {
+    id: m.id,
+    name: m.name,
+    releaseDate: m.release_date,
+    contextWindow: m.limit?.context,
+    inputCost: m.cost?.input,
+    outputCost: m.cost?.output,
+    capabilities: [
+      ...m.tool_call ? ["tools"] : [],
+      ...m.reasoning ? ["reasoning"] : [],
+      ...m.modalities?.input?.includes("image") ? ["vision"] : [],
+      ...m.open_weights ? ["open_weights"] : []
+    ]
+  };
+}
+function resolveProviderModelList(savedModels, catalog) {
+  if (savedModels && savedModels.length > 0) {
+    const byId = new Map((catalog?.models ?? []).map((m) => [m.id, m]));
+    return savedModels.map((id) => {
+      const hit = byId.get(id);
+      return hit ? describeCatalogModel(hit) : { id, name: id, capabilities: [] };
+    });
+  }
+  if (catalog) return catalog.models.map(describeCatalogModel);
+  return [];
+}
+
 // src/sdd/spec-parser.ts
 var SpecParser = class {
   parse(content) {
@@ -19798,7 +21153,7 @@ var SpecStore = class {
   indexPath;
   constructor(opts) {
     this.baseDir = opts.baseDir;
-    this.indexPath = path3.join(this.baseDir, "_index.json");
+    this.indexPath = path4.join(this.baseDir, "_index.json");
   }
   async save(spec) {
     await ensureDir(this.baseDir);
@@ -19867,7 +21222,7 @@ var SpecStore = class {
     return updated;
   }
   filePath(id) {
-    return path3.join(this.baseDir, `${id}.json`);
+    return path4.join(this.baseDir, `${id}.json`);
   }
   async readIndex() {
     try {
@@ -19924,7 +21279,7 @@ var TaskGraphStore = class {
   indexPath;
   constructor(opts) {
     this.baseDir = opts.baseDir;
-    this.indexPath = path3.join(this.baseDir, "_index.json");
+    this.indexPath = path4.join(this.baseDir, "_index.json");
   }
   async save(graph) {
     await ensureDir(this.baseDir);
@@ -19962,7 +21317,7 @@ var TaskGraphStore = class {
     }
   }
   filePath(id) {
-    return path3.join(this.baseDir, `${id}.json`);
+    return path4.join(this.baseDir, `${id}.json`);
   }
   async readIndex() {
     try {
@@ -20207,9 +21562,9 @@ var AISpecBuilder = class {
     if (!this.sessionPath) return;
     try {
       const fsp16 = await import('fs/promises');
-      const path19 = await import('path');
+      const path21 = await import('path');
       const { atomicWrite: atomicWrite2 } = await Promise.resolve().then(() => (init_atomic_write(), atomic_write_exports));
-      await fsp16.mkdir(path19.dirname(this.sessionPath), { recursive: true });
+      await fsp16.mkdir(path21.dirname(this.sessionPath), { recursive: true });
       await atomicWrite2(this.sessionPath, JSON.stringify(this.session, null, 2));
     } catch {
     }
@@ -20936,15 +22291,15 @@ function computeCriticalPath(graph, _topoOrder, blockedByMap) {
       maxId = id;
     }
   }
-  const path19 = [];
+  const path21 = [];
   let current = maxId;
   const visited = /* @__PURE__ */ new Set();
   while (current && !visited.has(current)) {
     visited.add(current);
-    path19.unshift(current);
+    path21.unshift(current);
     current = prev.get(current) ?? null;
   }
-  return path19;
+  return path21;
 }
 function computeParallelGroups(graph, blockedByMap) {
   const groups = [];
@@ -21767,9 +23122,9 @@ var DefaultHealthRegistry = class {
   }
   async runOne(check) {
     let timer = null;
-    const timeout = new Promise((resolve5) => {
+    const timeout = new Promise((resolve6) => {
       timer = setTimeout(
-        () => resolve5({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
+        () => resolve6({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
         this.timeoutMs
       );
     });
@@ -21952,7 +23307,7 @@ async function startMetricsServer(opts) {
   const tls = opts.tls;
   const useHttps = !!(tls?.cert && tls?.key);
   const host = opts.host ?? "127.0.0.1";
-  const path19 = opts.path ?? "/metrics";
+  const path21 = opts.path ?? "/metrics";
   const healthPath = opts.healthPath ?? "/healthz";
   const healthRegistry = opts.healthRegistry;
   const listener = (req, res) => {
@@ -21962,7 +23317,7 @@ async function startMetricsServer(opts) {
       return;
     }
     const url = req.url.split("?")[0];
-    if (url === path19) {
+    if (url === path21) {
       let body;
       try {
         body = renderPrometheus(opts.sink.snapshot());
@@ -22008,14 +23363,14 @@ async function startMetricsServer(opts) {
     const { createServer } = await import('http');
     server = createServer(listener);
   }
-  await new Promise((resolve5, reject) => {
+  await new Promise((resolve6, reject) => {
     const onError = (err) => {
       server.off("listening", onListening);
       reject(err);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve5();
+      resolve6();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -22026,9 +23381,9 @@ async function startMetricsServer(opts) {
   const protocol = useHttps ? "https" : "http";
   return {
     port: boundPort,
-    url: `${protocol}://${host}:${boundPort}${path19}`,
-    close: () => new Promise((resolve5, reject) => {
-      server.close((err) => err ? reject(err) : resolve5());
+    url: `${protocol}://${host}:${boundPort}${path21}`,
+    close: () => new Promise((resolve6, reject) => {
+      server.close((err) => err ? reject(err) : resolve6());
     })
   };
 }
@@ -22343,11 +23698,12 @@ function createContextManagerTool(opts = {}) {
       const applyMessages = (next) => {
         const repaired = repairToolUseAdjacency(next);
         const finalMessages = repaired.messages;
+        if (finalMessages === messages) return repaired.report;
         if (ctx.state) {
           ctx.state.replaceMessages(finalMessages);
         } else {
           messages.length = 0;
-          messages.splice(0, 0, ...finalMessages);
+          messages.push(...finalMessages);
         }
         return repaired.report;
       };
@@ -22422,9 +23778,15 @@ function createContextManagerTool(opts = {}) {
           }
           const report = await opts.compactor.compact(ctx);
           ctx.clearFileTracking();
-          const repair = applyMessages([...ctx.messages]);
-          const afterTokens = repair.changed ? roughEstimate(ctx.messages) : report.after;
-          const repaired = report.repaired ?? (repair.changed ? repair : void 0);
+          let repaired = report.repaired;
+          let afterTokens;
+          if (!ctx.state) {
+            const repair = applyMessages([...ctx.messages]);
+            repaired = report.repaired ?? (repair.changed ? repair : void 0);
+            afterTokens = repair.changed ? roughEstimate(ctx.messages) : report.after;
+          } else {
+            afterTokens = report.after;
+          }
           const reduced = report.fullRequestTokensBefore > report.fullRequestTokensAfter;
           const repairedSomething = !!report.repaired;
           if (reduced || repairedSomething) {
@@ -22679,6 +24041,6 @@ var allServers = () => ({
   playwright: { ...playwrightServer(), enabled: false }
 });
 
-export { AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigMigrationError, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorStateCheckpoint, DoneConditionChecker, EternalAutonomyEngine, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FleetBus, FleetSpawnBudgetError, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, SddParallelRun, SddTaskDecomposer, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, ToolExecutor, addPlanItem, allServers, analyzeCriticalPath, applyRosterBudget, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, clearPlan, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createAutoExecutor, createContextManagerTool, createDelegateTool, createMessage, createSessionEventBridge, createStrategyCompactor, decryptConfigSecrets, deriveTodosFromPlanItem, dispatchAgent, emptyPlan, encryptConfigSecrets, everArtServer, filesystemServer, formatPlan, formatPlanTemplates, getAgentDefinition, getPlanTemplate, getTemplate, githubServer, googleMapsServer, listPlanTemplates, listTemplates, loadDirectorState, loadPlan, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeRollUpTool, makeSpawnTool, makeTerminateTool, migratePlaintextSecrets, miniMaxVisionServer, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, resolveAuditLevel, resolveSessionLoggingConfig, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, savePlan, saveTodosCheckpoint, scoreAgents, sentinelServer, setPlanItemStatus, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, templateToMarkdown, wireMetricsToEvents, zaiVisionServer };
+export { AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigMigrationError, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorStateCheckpoint, DoneConditionChecker, EternalAutonomyEngine, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FleetBus, FleetSpawnBudgetError, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, SddParallelRun, SddTaskDecomposer, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, ToolExecutor, addPlanItem, allServers, analyzeCriticalPath, applyRosterBudget, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, clearPlan, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createAutoExecutor, createContextManagerTool, createDelegateTool, createMessage, createSessionEventBridge, createStrategyCompactor, decryptConfigSecrets, deriveTodosFromPlanItem, describeCatalogModel, dispatchAgent, emptyPlan, encryptConfigSecrets, everArtServer, filesystemServer, formatPlan, formatPlanTemplates, getAgentDefinition, getPlanTemplate, getTemplate, githubServer, googleMapsServer, listPlanTemplates, listTemplates, loadDirectorState, loadPlan, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeRollUpTool, makeSpawnTool, makeTerminateTool, migratePlaintextSecrets, miniMaxVisionServer, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, resolveAuditLevel, resolveProviderModelList, resolveSessionLoggingConfig, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, savePlan, saveTodosCheckpoint, scoreAgents, sentinelServer, setPlanItemStatus, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, templateToMarkdown, wireMetricsToEvents, zaiVisionServer };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map