@wrongstack/core 0.265.1 → 0.268.0

package/dist/defaults/index.js

@@ -1,7 +1,7 @@
 import * as crypto2 from 'crypto';
 import { randomBytes, createCipheriv, createDecipheriv, randomUUID, createHash } from 'crypto';
 import * as fsp2 from 'fs/promises';
-import * as path3 from 'path';
+import * as path4 from 'path';
 import { isAbsolute, resolve } from 'path';
 import * as fs4 from 'fs';
 import * as os from 'os';
@@ -33,9 +33,9 @@ __export(atomic_write_exports, {
   withFileLock: () => withFileLock
 });
 async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path3.dirname(targetPath);
+  const dir = path4.dirname(targetPath);
   await fsp2.mkdir(dir, { recursive: true });
-  const tmp = path3.join(dir, `.${path3.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const tmp = path4.join(dir, `.${path4.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
       await fsp2.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
@@ -74,9 +74,9 @@ async function ensureDir(dir) {
   await fsp2.mkdir(dir, { recursive: true });
 }
 async function withFileLock(targetPath, fn, opts = {}) {
-  const dir = path3.dirname(targetPath);
+  const dir = path4.dirname(targetPath);
   await fsp2.mkdir(dir, { recursive: true });
-  const lockPath = path3.join(dir, `.${path3.basename(targetPath)}.lock`);
+  const lockPath = path4.join(dir, `.${path4.basename(targetPath)}.lock`);
   const timeoutMs = opts.timeoutMs ?? 5e3;
   const staleMs = opts.staleMs ?? 3e4;
   const started = Date.now();
@@ -105,7 +105,7 @@ async function withFileLock(targetPath, fn, opts = {}) {
       if (Date.now() - started >= timeoutMs) {
         throw new Error(`Timed out waiting for file lock: ${targetPath}`);
       }
-      await new Promise((resolve5) => setTimeout(resolve5, 25));
+      await new Promise((resolve6) => setTimeout(resolve6, 25));
     }
   }
   try {
@@ -138,7 +138,7 @@ async function renameWithRetry(from, to) {
       if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
         throw err;
       }
-      await new Promise((resolve5) => setTimeout(resolve5, delays[i]));
+      await new Promise((resolve6) => setTimeout(resolve6, delays[i]));
     }
   }
   throw lastErr;
@@ -234,7 +234,7 @@ var DefaultLogger = class _DefaultLogger {
     this.maxFileBytes = opts.maxFileBytes ?? 10 * 1024 * 1024;
     if (this.file) {
       try {
-        fs4.mkdirSync(path3.dirname(this.file), { recursive: true });
+        fs4.mkdirSync(path4.dirname(this.file), { recursive: true });
       } catch {
       }
     }
@@ -436,32 +436,268 @@ function isEmptyMessage(msg) {
   return msg.content.length === 0;
 }
 
+// src/utils/assert-never.ts
+function assertNever(x, message) {
+  const err = new Error(
+    `Unhandled case: ${JSON.stringify(x)}`
+  );
+  err.name = "AssertNeverError";
+  throw err;
+}
+
 // src/utils/index.ts
 init_atomic_write();
+var MAX_DIGEST_CHARS = 4e3;
+function createContextEvidenceState() {
+  return {
+    sessionGoals: [],
+    implicitFacts: [],
+    activeErrors: [],
+    toolCalls: [],
+    fileGraph: {},
+    repeatedReads: [],
+    updatedAt: Date.now()
+  };
+}
+function buildContextEvidenceDigest(ctx) {
+  const state = ensureEvidence(ctx);
+  const lines = [];
+  if (state.currentIntent?.text) {
+    lines.push(`intent: ${state.currentIntent.text}`);
+  }
+  const goals = state.sessionGoals.slice(-3);
+  if (goals.length > 0) {
+    lines.push("session_goals:");
+    for (const goal of goals) lines.push(`- ${goal}`);
+  }
+  const activeErrors = state.activeErrors.slice(-5);
+  if (activeErrors.length > 0) {
+    lines.push("active_errors:");
+    for (const err of activeErrors) lines.push(`- ${err}`);
+  }
+  const files = Object.values(state.fileGraph).sort((a, b) => b.writes - a.writes || b.reads - a.reads || a.path.localeCompare(b.path)).slice(0, 12);
+  if (files.length > 0) {
+    lines.push("dependency_graph:");
+    for (const file of files) {
+      const actions = [
+        file.reads > 0 ? `read ${file.reads}x` : "",
+        file.writes > 0 ? `write ${file.writes}x` : ""
+      ].filter(Boolean).join(", ");
+      const refs = file.referenced ? "; referenced by assistant" : "";
+      const via = file.lastToolUseId ? `; last via ${file.lastToolUseId}` : "";
+      lines.push(`- ${file.path} (${actions || "seen"}${refs}${via})`);
+    }
+  }
+  const referenced = state.toolCalls.filter((tool) => tool.status === "referenced").slice(-10);
+  const recentSeen = state.toolCalls.filter((tool) => tool.status === "seen").slice(-5);
+  const trail = [...referenced, ...recentSeen];
+  if (trail.length > 0) {
+    lines.push("tool_trail:");
+    for (const tool of trail) {
+      const size = tool.outputTokens ? `; ~${tool.outputTokens} tokens` : "";
+      const filesText = tool.files.length > 0 ? `; files=${tool.files.slice(0, 4).join(", ")}` : "";
+      const symbolsText = tool.symbols.length > 0 ? `; symbols=${tool.symbols.slice(0, 4).join(", ")}` : "";
+      lines.push(
+        `- ${tool.toolUseId} ${tool.toolName} ${tool.status}: ${tool.summary}${filesText}${symbolsText}${size}`
+      );
+    }
+  }
+  const facts = state.implicitFacts.slice(-8);
+  if (facts.length > 0) {
+    lines.push("implicit_facts:");
+    for (const fact of facts) lines.push(`- ${fact}`);
+  }
+  const digest = lines.join("\n");
+  if (digest.length <= MAX_DIGEST_CHARS) return digest;
+  return `${digest.slice(0, MAX_DIGEST_CHARS)}... [+${digest.length - MAX_DIGEST_CHARS} chars]`;
+}
+function repeatedReadPressure(ctx) {
+  return ensureEvidence(ctx).repeatedReads.reduce((max, item) => Math.max(max, item.count), 0);
+}
+function ensureEvidence(ctx) {
+  if (!ctx.contextEvidence) {
+    ctx.contextEvidence = createContextEvidenceState();
+  }
+  return ctx.contextEvidence;
+}
+
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+function isPrimitiveArray(a) {
+  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
+}
+function deepMerge(base, patch, options = {}) {
+  const {
+    conflictResolution = "prefer-patch",
+    arrayMode = "replace",
+    protectProto = true,
+    onNonPrimitiveArrayReplace
+  } = options;
+  if (typeof base !== "object" || base === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (typeof patch !== "object" || patch === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
+      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+    }
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) || Array.isArray(patch)) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  const baseObj = base;
+  const patchObj = patch;
+  const out = { ...baseObj };
+  for (const [k, v] of Object.entries(patchObj)) {
+    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v, options);
+    } else if (Array.isArray(v) && Array.isArray(existing)) {
+      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
+        onNonPrimitiveArrayReplace(k, existing.length, v.length);
+      }
+      out[k] = deepMerge(existing, v, options);
+    } else if (v !== void 0) {
+      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
+        const existingLen = Array.isArray(existing) ? existing.length : 0;
+        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+      }
+      out[k] = v;
+    }
+  }
+  return out;
+}
 
 // src/utils/error.ts
 function toErrorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
-
-// src/utils/safe-json.ts
-function safeParse(input, maxBytes = 5e6) {
-  if (input.length > maxBytes) {
-    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
+var GLOB_CHARS = /* @__PURE__ */ new Set(["*", "?", "["]);
+var IS_WINDOWS = process.platform === "win32";
+var SEP = IS_WINDOWS ? "\\" : "/";
+function isGlob(p) {
+  for (const c of p) {
+    if (GLOB_CHARS.has(c)) return true;
   }
-  try {
-    return { ok: true, value: JSON.parse(input) };
-  } catch (err) {
-    return {
-      ok: false,
-      error: toErrorMessage(err)
-    };
+  return false;
+}
+function globToRegex(pat) {
+  let i = 0;
+  let re = "^";
+  while (i < pat.length) {
+    const c = expectDefined(pat[i]);
+    if (c === "*") {
+      if (pat[i + 1] === "*") {
+        re += ".*";
+        i += 2;
+        if (pat[i] === "/") i++;
+      } else {
+        re += "[^/\\\\]*";
+        i++;
+      }
+    } else if (c === "?") {
+      re += "[^/\\\\]";
+      i++;
+    } else if (c === "[") {
+      let cls = "[";
+      i++;
+      if (pat[i] === "!" || pat[i] === "^") {
+        cls += "^";
+        i++;
+      }
+      while (i < pat.length && pat[i] !== "]") {
+        const ch = pat[i] ?? "";
+        if (ch === "\\") cls += "\\\\";
+        else if (ch === "]" || ch === "^") cls += `\\${ch}`;
+        else cls += ch;
+        i++;
+      }
+      cls += "]";
+      re += cls;
+      i++;
+    } else {
+      re += c.replace(/[.+^${}()|\\]/g, "\\$&");
+      i++;
+    }
   }
+  return new RegExp(re + "$");
 }
-
-// src/utils/string.ts
-function truncate(s, max) {
-  return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
+function baseDir(pat) {
+  let i = pat.length - 1;
+  while (i >= 0 && !GLOB_CHARS.has(expectDefined(pat[i])) && pat[i] !== SEP && pat[i] !== "/") i--;
+  const cut = i >= 0 ? pat.lastIndexOf(SEP, i) : pat.lastIndexOf("/", i);
+  return cut < 0 ? "." : pat.slice(0, cut);
+}
+async function expandGlob(pattern) {
+  if (!isGlob(pattern)) return [pattern];
+  const results = /* @__PURE__ */ new Set();
+  const abs = isAbsolute(pattern);
+  const base = abs ? baseDir(pattern) : baseDir(pattern);
+  const relPat = base === "." ? pattern : pattern.slice(base.length + 1);
+  async function walk3(dir, pat) {
+    let entries;
+    try {
+      entries = await fsp2.readdir(dir);
+    } catch {
+      return;
+    }
+    const firstGlob = pat.search(/[*?[[]/);
+    if (firstGlob < 0) {
+      const re = globToRegex(pat);
+      for (const e of entries) {
+        if (re.test(e)) {
+          const full = `${dir}${SEP}${e}`;
+          results.add(abs ? resolve(full) : full);
+        }
+      }
+      return;
+    }
+    const before = pat.slice(0, firstGlob);
+    const rest = pat.slice(firstGlob);
+    if (before.endsWith("**")) {
+      await walk3(dir, rest);
+      for (const e of entries) {
+        const full = `${dir}${SEP}${e}`;
+        try {
+          const stat6 = await fsp2.stat(full);
+          if (stat6.isDirectory()) await walk3(full, rest);
+        } catch {
+        }
+      }
+    } else if (before === "") {
+      const re = globToRegex(rest);
+      for (const e of entries) {
+        if (re.test(e)) {
+          const full = `${dir}${SEP}${e}`;
+          results.add(abs ? resolve(full) : full);
+        }
+      }
+    } else {
+      const seg = before.replace(/[*?[\]]/g, "").replace(/\/$/, "");
+      if (entries.includes(seg)) {
+        const full = `${dir}${SEP}${seg}`;
+        try {
+          const stat6 = await fsp2.stat(full);
+          if (stat6.isDirectory()) await walk3(full, rest);
+        } catch {
+        }
+      }
+    }
+  }
+  await walk3(base === "." ? "." : base, relPat);
+  return [...results];
 }
 
 // src/utils/glob-match.ts
@@ -539,232 +775,475 @@ function matchGlob(pattern, input) {
 function matchAny(patterns, input) {
   return patterns.some((p) => matchGlob(p, input));
 }
-function projectHash(absRoot) {
-  return createHash("sha256").update(path3.resolve(absRoot)).digest("hex").slice(0, 12);
-}
-function projectSlug(absRoot) {
-  const base = slugify(path3.basename(absRoot));
-  const hash = createHash("sha256").update(path3.resolve(absRoot)).digest("hex").slice(0, 6);
-  return `${base}-${hash}`;
-}
-function slugify(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
-}
-function wstackGlobalRoot() {
-  const fromEnv = process.env["WRONGSTACK_HOME"];
-  if (fromEnv && fromEnv.trim().length > 0) return path3.resolve(fromEnv);
-  return path3.join(os.homedir(), ".wrongstack");
-}
-function resolveWstackPaths(opts) {
-  const globalRoot = opts.globalRoot ?? (opts.userHome ? path3.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
-  const hash = projectHash(opts.projectRoot);
-  const slug = projectSlug(opts.projectRoot);
-  const projectDir = path3.join(globalRoot, "projects", slug);
-  return {
-    globalRoot,
-    configDir: globalRoot,
-    globalConfig: path3.join(globalRoot, "config.json"),
-    secretsKey: path3.join(globalRoot, ".key"),
-    globalMemory: path3.join(globalRoot, "memory.md"),
-    globalSkills: path3.join(globalRoot, "skills"),
-    globalPrompts: path3.join(globalRoot, "prompts"),
-    cacheDir: path3.join(globalRoot, "cache"),
-    modelsCache: path3.join(globalRoot, "cache", "models.dev.json"),
-    modelsOverlayCache: path3.join(globalRoot, "cache", "models-overlay.json"),
-    historyFile: path3.join(globalRoot, "history"),
-    logFile: path3.join(globalRoot, "logs", "wrongstack.log"),
-    projectDir,
-    projectCodebaseIndex: path3.join(projectDir, "codebase-index"),
-    projectMemory: path3.join(projectDir, "memory.md"),
-    projectSessions: path3.join(projectDir, "sessions"),
-    projectTrust: path3.join(projectDir, "trust.json"),
-    projectMeta: path3.join(projectDir, "meta.json"),
-    projectLocalConfig: path3.join(projectDir, "config.local.json"),
-    inProjectConfig: path3.join(opts.projectRoot, ".wrongstack", "config.json"),
-    inProjectAgentsFile: path3.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
-    inProjectSkills: path3.join(opts.projectRoot, ".wrongstack", "skills"),
-    inProjectWorktrees: path3.join(opts.projectRoot, ".wrongstack", "worktrees"),
-    projectHash: hash,
-    projectSlug: slug,
-    projectGoal: path3.join(projectDir, "goal.json"),
-    projectSpecs: path3.join(projectDir, "specs"),
-    projectTaskGraphs: path3.join(projectDir, "task-graphs"),
-    projectSddSession: path3.join(projectDir, "sdd-session.json"),
-    projectPlan: path3.join(projectDir, "plan.json"),
-    projectAutophase: path3.join(projectDir, "autophase"),
-    syncConfig: path3.join(globalRoot, "sync.json"),
-    projectStatus: (projectHash2) => path3.join(globalRoot, "projects", projectHash2, "status.json")
-  };
-}
-
-// src/utils/sleep.ts
-function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
-}
 
-// src/utils/assert-never.ts
-function assertNever(x, message) {
-  const err = new Error(
-    `Unhandled case: ${JSON.stringify(x)}`
-  );
-  err.name = "AssertNeverError";
-  throw err;
+// src/utils/json-repair.ts
+function completePartialObject(s) {
+  if (!s.trim().startsWith("{")) return s;
+  if (tryParse(s).ok) return s;
+  return repairTruncated(s);
 }
-
-// src/utils/deep-merge.ts
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function isPrimitiveArray(a) {
-  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
-}
-function deepMerge(base, patch, options = {}) {
-  const {
-    conflictResolution = "prefer-patch",
-    arrayMode = "replace",
-    protectProto = true,
-    onNonPrimitiveArrayReplace
-  } = options;
-  if (typeof base !== "object" || base === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (typeof patch !== "object" || patch === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
+function repairTruncated(s) {
+  const stack = [];
+  let inString = false;
+  let escaped = false;
+  let sawKey = false;
+  let prevSig = "";
+  let contentEnd = 0;
+  let stringBraceDepth = 0;
+  for (let i = 0; i < s.length; i++) {
+    const ch = expectDefined(s[i]);
+    if (inString) {
+      contentEnd = i + 1;
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (ch === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (ch === '"') {
+        inString = false;
+        prevSig = '"';
+        stringBraceDepth = 0;
+        continue;
+      }
+      if (ch === "{") stringBraceDepth++;
+      else if (ch === "}" && stringBraceDepth > 0) stringBraceDepth--;
+      continue;
+    }
+    if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") continue;
+    contentEnd = i + 1;
+    if (ch === '"') {
+      inString = true;
+      sawKey = true;
+      stringBraceDepth = 0;
+      prevSig = '"';
+    } else if (ch === "{" || ch === "[") {
+      stack.push(ch);
+      prevSig = ch;
+    } else if (ch === "}" || ch === "]") {
+      stack.pop();
+      prevSig = ch;
+    } else {
+      prevSig = ch;
+    }
   }
-  if (Array.isArray(base) && Array.isArray(patch)) {
-    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
-      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+  if (!sawKey && !inString) return s;
+  let result = s.slice(0, contentEnd);
+  if (inString) {
+    if (escaped) {
+      result = result.slice(0, -1);
+    } else if (endsWithInvalidEscape(result)) {
+      result = result.slice(0, -2);
     }
-    return conflictResolution === "prefer-patch" ? patch : base;
+    if (stringBraceDepth > 0) result += "}".repeat(stringBraceDepth);
+    result += '"';
+  } else if (prevSig === ":") {
+    result += "null";
   }
-  if (Array.isArray(base) || Array.isArray(patch)) {
-    return conflictResolution === "prefer-patch" ? patch : base;
+  for (let k = stack.length - 1; k >= 0; k--) {
+    result += stack[k] === "{" ? "}" : "]";
   }
-  const baseObj = base;
-  const patchObj = patch;
-  const out = { ...baseObj };
-  for (const [k, v] of Object.entries(patchObj)) {
-    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v, options);
-    } else if (Array.isArray(v) && Array.isArray(existing)) {
-      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
-        onNonPrimitiveArrayReplace(k, existing.length, v.length);
-      }
-      out[k] = deepMerge(existing, v, options);
-    } else if (v !== void 0) {
-      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
-        const existingLen = Array.isArray(existing) ? existing.length : 0;
-        onNonPrimitiveArrayReplace(k, existingLen, v.length);
-      }
-      out[k] = v;
-    }
+  if (!tryParse(result).ok) {
+    const patched = result.replace(/:(\s*)([}\]])/g, ":null$2");
+    if (tryParse(patched).ok) result = patched;
+  }
+  return result;
+}
+var VALID_ESCAPE = /* @__PURE__ */ new Set(['"', "\\", "/", "b", "f", "n", "r", "t", "u"]);
+function endsWithInvalidEscape(str) {
+  const last = str[str.length - 1];
+  if (str[str.length - 2] !== "\\" || last === void 0) return false;
+  if (VALID_ESCAPE.has(last)) return false;
+  let backslashes = 0;
+  for (let k = str.length - 2; k >= 0 && str[k] === "\\"; k--) backslashes++;
+  return backslashes % 2 === 1;
+}
+function tryParse(s) {
+  try {
+    return { ok: true, value: JSON.parse(s) };
+  } catch {
+    return { ok: false };
   }
-  return out;
 }
 
-// src/utils/tool-output-serializer.ts
-function createToolOutputSerializer(opts = {}) {
-  const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
-  function serialize(value) {
-    if (typeof value === "string") return value;
-    if (value === null || value === void 0) return "";
-    if (typeof value === "object") {
-      if (Array.isArray(value)) return value.map(serialize).join("\n");
-      if ("text" in value) {
-        const t = value.text;
-        return typeof t === "string" ? t : JSON.stringify(value, null, 2);
-      }
-      try {
-        return JSON.stringify(value, null, 2);
-      } catch {
-        return String(value);
-      }
+// src/utils/json-schema-validate.ts
+function validateAgainstSchema(value, schema) {
+  const errors = [];
+  walk(value, schema, "", errors);
+  return { ok: errors.length === 0, errors };
+}
+function walk(value, schema, path21, errors) {
+  if (schema.enum !== void 0) {
+    if (!schema.enum.some((e) => deepEqual(e, value))) {
+      errors.push({
+        path: path21 || "<root>",
+        message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
+      });
+      return;
     }
-    return String(value);
   }
-  function enforceCap(text, remainingBudget) {
-    if (remainingBudget <= 0) {
-      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
+  if (typeof schema.type === "string") {
+    if (!checkType(value, schema.type)) {
+      errors.push({
+        path: path21 || "<root>",
+        message: `expected ${schema.type}, got ${describeType(value)}`
+      });
+      return;
     }
-    const textBytes = Buffer.byteLength(text, "utf8");
-    if (textBytes <= remainingBudget) {
-      return { text, newBudget: remainingBudget - textBytes };
+  }
+  if (schema.type === "object" && isPlainObject(value)) {
+    const obj = value;
+    for (const req of schema.required ?? []) {
+      if (!(req in obj)) {
+        errors.push({ path: joinPath(path21, req), message: "required property missing" });
+      }
     }
-    const marker = `
-\u2026[truncated ${textBytes - remainingBudget} bytes]\u2026
-`;
-    const markerBytes = Buffer.byteLength(marker, "utf8");
-    const available = remainingBudget - markerBytes;
-    if (available <= 0) {
-      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
+    if (schema.properties) {
+      for (const [key, subSchema] of Object.entries(schema.properties)) {
+        if (key in obj) {
+          walk(obj[key], subSchema, joinPath(path21, key), errors);
+        }
+      }
     }
-    const half = Math.floor(available / 2);
-    const first = text.slice(0, half);
-    const second = text.slice(text.length - half);
-    return { text: `${first}${marker}${second}`, newBudget: 0 };
-  }
-  return { serialize, enforceCap, capBytes };
-}
-
-// src/utils/token-estimate.ts
-var RoughTokenEstimate = (text, charsPerToken = 3.5) => Math.max(1, Math.ceil(text.length / charsPerToken));
-var CALIBRATION_GLOBAL_KEY = "__global__";
-var _cals = /* @__PURE__ */ new Map();
-function calState(key) {
-  let state = _cals.get(key);
-  if (!state) {
-    state = { ratio: 1, count: 0, prevEst: 0 };
-    _cals.set(key, state);
   }
-  return state;
-}
-var MIN_SAMPLES_FOR_CALIBRATION = 3;
-var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
-var ESTIMATE_CACHE_MAX_SIZE = 1e4;
-function getCachedEstimate(key, compute) {
-  const existing = ESTIMATE_CACHE.get(key);
-  if (existing !== void 0) return existing;
-  if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
-    for (const k of ESTIMATE_CACHE.keys()) {
-      if (ESTIMATE_CACHE.size <= Math.floor(ESTIMATE_CACHE_MAX_SIZE / 2)) break;
-      ESTIMATE_CACHE.delete(k);
+  if (schema.type === "array" && Array.isArray(value) && schema.items) {
+    for (let i = 0; i < value.length; i++) {
+      walk(value[i], schema.items, `${path21}[${i}]`, errors);
     }
   }
-  const estimate = compute(key);
-  ESTIMATE_CACHE.set(key, estimate);
-  return estimate;
 }
-function estimateToolInputTokens(input) {
-  if (typeof input === "string") return RoughTokenEstimate(input);
-  if (input === null || typeof input !== "object") {
-    return RoughTokenEstimate(String(input));
+function checkType(value, type) {
+  switch (type) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number" && !Number.isNaN(value);
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "boolean":
+      return typeof value === "boolean";
+    case "null":
+      return value === null;
+    case "array":
+      return Array.isArray(value);
+    case "object":
+      return isPlainObject(value);
+    default:
+      return true;
   }
-  return getCachedEstimate(JSON.stringify(input), (key) => RoughTokenEstimate(key));
 }
-function estimateToolResultTokens(content) {
-  if (typeof content === "string") return RoughTokenEstimate(content);
-  return getCachedEstimate(JSON.stringify(content), (key) => RoughTokenEstimate(key));
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-function estimateTextTokens(text) {
-  return RoughTokenEstimate(text);
+function describeType(v) {
+  if (v === null) return "null";
+  if (Array.isArray(v)) return "array";
+  return typeof v;
 }
-function computeMessageTokens(msg) {
-  if (typeof msg.content === "string") return estimateTextTokens(msg.content);
-  let total = 0;
-  for (const b of msg.content) {
-    if (b.type === "text") total += estimateTextTokens(b.text);
-    else if (b.type === "tool_use") total += estimateToolInputTokens(b.input);
-    else if (b.type === "tool_result") total += estimateToolResultTokens(b.content);
-    else total += RoughTokenEstimate(JSON.stringify(b));
-  }
+function joinPath(parent, key) {
+  if (!parent) return key;
+  return `${parent}.${key}`;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b) return false;
+  if (a === null || b === null) return a === b;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
+  }
+  if (typeof a === "object" && typeof b === "object") {
+    const ak = Object.keys(a);
+    const bk = Object.keys(b);
+    if (ak.length !== bk.length) return false;
+    return ak.every(
+      (k) => deepEqual(a[k], b[k])
+    );
+  }
+  return false;
+}
+
+// src/utils/merge-models-payload.ts
+function mergeModelsPayload(base, overlay) {
+  const out = {};
+  for (const [id, provider] of Object.entries(base)) {
+    out[id] = cloneProvider(provider);
+  }
+  for (const [id, ovProvider] of Object.entries(overlay)) {
+    const existing = out[id];
+    out[id] = existing ? mergeProvider(existing, ovProvider) : cloneProvider(ovProvider);
+  }
+  return out;
+}
+function mergeProvider(base, overlay) {
+  const models = {};
+  for (const [mid, m] of Object.entries(base.models ?? {})) {
+    models[mid] = { ...m };
+  }
+  for (const [mid, ovModel] of Object.entries(overlay.models ?? {})) {
+    const existing = models[mid];
+    models[mid] = existing ? mergeModel(existing, ovModel) : { ...ovModel };
+  }
+  return {
+    ...base,
+    // Overlay scalar fields win when explicitly provided; otherwise keep base.
+    ...stripUndefined({
+      id: overlay.id,
+      name: overlay.name,
+      npm: overlay.npm,
+      api: overlay.api,
+      env: overlay.env,
+      doc: overlay.doc
+    }),
+    models
+  };
+}
+function mergeModel(base, overlay) {
+  const merged = { ...base, ...overlay };
+  if (base.limit || overlay.limit) {
+    merged.limit = { ...base.limit, ...overlay.limit };
+  }
+  if (base.cost || overlay.cost) {
+    merged.cost = { ...base.cost, ...overlay.cost };
+  }
+  if (base.modalities || overlay.modalities) {
+    merged.modalities = { ...base.modalities, ...overlay.modalities };
+  }
+  return merged;
+}
+function cloneProvider(p) {
+  const models = {};
+  for (const [mid, m] of Object.entries(p.models ?? {})) {
+    models[mid] = { ...m };
+  }
+  return { ...p, models };
+}
+function stripUndefined(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+
+// src/utils/regex-guard.ts
+var MAX_PATTERN_LEN = 512;
+var DANGEROUS_PATTERNS = [
+  /(\([^)]*[+*][^)]*\))[+*]/,
+  // (a+)+, (.*)+, etc
+  /(\(\?:[^)]*[+*][^)]*\))[+*]/
+  // same, with non-capturing group
+];
+function compileUserRegex(pattern, flags) {
+  if (typeof pattern !== "string") {
+    return { ok: false, reason: "pattern must be a string" };
+  }
+  if (pattern.length === 0) {
+    return { ok: false, reason: "pattern is empty" };
+  }
+  if (pattern.length > MAX_PATTERN_LEN) {
+    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
+  }
+  for (const rx of DANGEROUS_PATTERNS) {
+    if (rx.test(pattern)) {
+      return {
+        ok: false,
+        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
+      };
+    }
+  }
+  try {
+    return { ok: true, regex: new RegExp(pattern, flags) };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: err instanceof Error ? err.message : "invalid regex"
+    };
+  }
+}
+
+// src/utils/safe-json.ts
+function safeParse(input, maxBytes = 5e6) {
+  if (input.length > maxBytes) {
+    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
+  }
+  try {
+    return { ok: true, value: JSON.parse(input) };
+  } catch (err) {
+    return {
+      ok: false,
+      error: toErrorMessage(err)
+    };
+  }
+}
+
+// src/utils/sleep.ts
+function sleep(ms) {
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
+}
+
+// src/utils/string.ts
+function truncate(s, max) {
+  return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
+}
+
+// src/utils/tool-subject.ts
+var GLOB_METACHARACTERS = /[*?[\]]/g;
+function escapeGlobSubject(value) {
+  return value.replace(GLOB_METACHARACTERS, (char) => `\\${char}`);
+}
+function normalizePathSubject(value) {
+  return escapeGlobSubject(value.replace(/\\/g, "/"));
+}
+function isPathSubjectKey(subjectKey) {
+  return subjectKey === "path" || subjectKey === "file" || subjectKey === "files";
+}
+function subjectForToolInput(toolName, input, subjectKey) {
+  if (!input || typeof input !== "object") return void 0;
+  const obj = input;
+  if (subjectKey) {
+    const value = obj[subjectKey];
+    if (typeof value === "string") {
+      return isPathSubjectKey(subjectKey) ? normalizePathSubject(value) : escapeGlobSubject(value);
+    }
+  }
+  if (toolName === "bash" && typeof obj.command === "string") {
+    return escapeGlobSubject(obj.command);
+  }
+  if (typeof obj.path === "string") {
+    return normalizePathSubject(obj.path);
+  }
+  if (typeof obj.url === "string") {
+    return escapeGlobSubject(obj.url);
+  }
+  if (typeof obj.name === "string") {
+    return escapeGlobSubject(obj.name);
+  }
+  return void 0;
+}
+
+// src/utils/tool-wire-compact.ts
+var TOOL_DESCRIPTION_MAX_CHARS = 640;
+var SCHEMA_DESCRIPTION_MAX_CHARS = 180;
+var compactCache = /* @__PURE__ */ new WeakMap();
+function compactToolDefinitionForWire(tool, opts = {}) {
+  const useDefaultOptions = opts.descriptionMaxChars === void 0 && opts.schemaDescriptionMaxChars === void 0;
+  if (useDefaultOptions && typeof tool === "object" && tool !== null) {
+    const cached = compactCache.get(tool);
+    if (cached) return cached;
+  }
+  const compact = {
+    name: tool.name,
+    description: compactDescription(
+      tool.description ?? "",
+      opts.descriptionMaxChars ?? TOOL_DESCRIPTION_MAX_CHARS
+    ),
+    inputSchema: compactSchemaDescriptions(
+      tool.inputSchema,
+      opts.schemaDescriptionMaxChars ?? SCHEMA_DESCRIPTION_MAX_CHARS
+    )
+  };
+  if (useDefaultOptions && typeof tool === "object" && tool !== null) {
+    compactCache.set(tool, compact);
+  }
+  return compact;
+}
+function compactSchemaDescriptions(schema, maxDescriptionChars = SCHEMA_DESCRIPTION_MAX_CHARS) {
+  const compact = compactSchemaNode(schema, maxDescriptionChars);
+  return isRecord(compact) ? compact : { type: "object", properties: {} };
+}
+function compactSchemaNode(node, maxDescriptionChars) {
+  if (Array.isArray(node)) {
+    return node.map((item) => compactSchemaNode(item, maxDescriptionChars));
+  }
+  if (!isRecord(node)) return node;
+  const out = {};
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "description" && typeof value === "string") {
+      out[key] = compactDescription(value, maxDescriptionChars);
+    } else {
+      out[key] = compactSchemaNode(value, maxDescriptionChars);
+    }
+  }
+  return out;
+}
+function compactDescription(text, maxChars) {
+  const normalized = text.replace(/\s+/g, " ").trim();
+  if (normalized.length <= maxChars) return normalized;
+  if (maxChars <= 20) return normalized.slice(0, maxChars);
+  const hardLimit = maxChars - 12;
+  const boundary = findSemanticBoundary(normalized, hardLimit);
+  const head = normalized.slice(0, boundary > 0 ? boundary : hardLimit).trimEnd();
+  return `${head} ...`;
+}
+function findSemanticBoundary(text, limit) {
+  const punctuation = Math.max(
+    text.lastIndexOf(". ", limit),
+    text.lastIndexOf("; ", limit),
+    text.lastIndexOf(": ", limit)
+  );
+  if (punctuation >= Math.floor(limit * 0.45)) return punctuation + 1;
+  const comma = text.lastIndexOf(", ", limit);
+  if (comma >= Math.floor(limit * 0.6)) return comma + 1;
+  const space = text.lastIndexOf(" ", limit);
+  return space >= Math.floor(limit * 0.6) ? space : limit;
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/utils/token-estimate.ts
+var RoughTokenEstimate = (text, charsPerToken = 3.5) => Math.max(1, Math.ceil(text.length / charsPerToken));
+var CALIBRATION_GLOBAL_KEY = "__global__";
+var _cals = /* @__PURE__ */ new Map();
+function calState(key) {
+  let state = _cals.get(key);
+  if (!state) {
+    state = { ratio: 1, count: 0, prevEst: 0 };
+    _cals.set(key, state);
+  }
+  return state;
+}
+var MIN_SAMPLES_FOR_CALIBRATION = 3;
+var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
+var ESTIMATE_CACHE_MAX_SIZE = 1e4;
+function getCachedEstimate(key, compute) {
+  const existing = ESTIMATE_CACHE.get(key);
+  if (existing !== void 0) return existing;
+  if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
+    for (const k of ESTIMATE_CACHE.keys()) {
+      if (ESTIMATE_CACHE.size <= Math.floor(ESTIMATE_CACHE_MAX_SIZE / 2)) break;
+      ESTIMATE_CACHE.delete(k);
+    }
+  }
+  const estimate = compute(key);
+  ESTIMATE_CACHE.set(key, estimate);
+  return estimate;
+}
+function estimateToolInputTokens(input) {
+  if (typeof input === "string") return RoughTokenEstimate(input);
+  if (input === null || typeof input !== "object") {
+    return RoughTokenEstimate(String(input));
+  }
+  return getCachedEstimate(JSON.stringify(input), (key) => RoughTokenEstimate(key));
+}
+function estimateToolResultTokens(content) {
+  if (typeof content === "string") return RoughTokenEstimate(content);
+  return getCachedEstimate(JSON.stringify(content), (key) => RoughTokenEstimate(key));
+}
+function estimateTextTokens(text) {
+  return RoughTokenEstimate(text);
+}
+function computeMessageTokens(msg) {
+  if (typeof msg.content === "string") return estimateTextTokens(msg.content);
+  let total = 0;
+  for (const b of msg.content) {
+    if (b.type === "text") total += estimateTextTokens(b.text);
+    else if (b.type === "tool_use") total += estimateToolInputTokens(b.input);
+    else if (b.type === "tool_result") total += estimateToolResultTokens(b.content);
+    else total += RoughTokenEstimate(JSON.stringify(b));
+  }
   return total;
 }
 function estimateMessageTokens(messages) {
@@ -781,7 +1260,8 @@ function estimateMessageTokens(messages) {
 function estimateToolDefTokens(tool) {
   const cached = tool._estDefTokens;
   if (typeof cached === "number" && cached > 0) return cached;
-  return RoughTokenEstimate(tool.name) + RoughTokenEstimate(tool.description ?? "") + RoughTokenEstimate(JSON.stringify(tool.inputSchema));
+  const compact = compactToolDefinitionForWire(tool);
+  return RoughTokenEstimate(tool.name) + RoughTokenEstimate(compact.description) + RoughTokenEstimate(JSON.stringify(compact.inputSchema));
 }
 function estimateRequestTokens(messages, systemPrompt, tools, calibrationKey = CALIBRATION_GLOBAL_KEY) {
   let messagesTokens = 0;
@@ -858,406 +1338,702 @@ function estimateRequestTokensCalibrated(messages, systemPrompt, tools, calibrat
   return result;
 }
 
-// src/utils/json-schema-validate.ts
-function validateAgainstSchema(value, schema) {
-  const errors = [];
-  walk(value, schema, "", errors);
-  return { ok: errors.length === 0, errors };
-}
-function walk(value, schema, path19, errors) {
-  if (schema.enum !== void 0) {
-    if (!schema.enum.some((e) => deepEqual(e, value))) {
-      errors.push({
-        path: path19 || "<root>",
-        message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
-      });
-      return;
+// src/utils/tool-output-serializer.ts
+var DEFAULT_LIST_LIMIT = 500;
+var LOG_ENTRY_LIMIT = 200;
+var INLINE_LIMIT = 240;
+var GREP_FILE_LIMIT = 80;
+var GREP_MATCHES_PER_FILE = 3;
+var DIFF_INLINE_LINE_LIMIT = 260;
+var DIFF_HUNK_LIMIT = 8;
+var DIFF_HUNK_CONTEXT = 14;
+function createToolOutputSerializer(opts = {}) {
+  const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
+  function serialize(value, context = {}) {
+    if (typeof value === "string") return value;
+    if (value === null || value === void 0) return "";
+    if (typeof value === "object") {
+      if (Array.isArray(value)) return value.map((item) => serialize(item)).join("\n");
+      if (context.toolName) {
+        const compact = renderToolObject(context.toolName, value, context.input);
+        if (compact !== void 0) return compact;
+        return renderGenericToolObject(context.toolName, value);
+      }
+      if ("text" in value) {
+        const t = value.text;
+        return typeof t === "string" ? t : JSON.stringify(value, null, 2);
+      }
+      try {
+        return JSON.stringify(value, null, 2);
+      } catch {
+        return String(value);
+      }
     }
+    return String(value);
   }
-  if (typeof schema.type === "string") {
-    if (!checkType(value, schema.type)) {
-      errors.push({
-        path: path19 || "<root>",
-        message: `expected ${schema.type}, got ${describeType(value)}`
-      });
-      return;
-    }
-  }
-  if (schema.type === "object" && isPlainObject(value)) {
-    const obj = value;
-    for (const req of schema.required ?? []) {
-      if (!(req in obj)) {
-        errors.push({ path: joinPath(path19, req), message: "required property missing" });
-      }
+  function enforceCap(text, remainingBudget) {
+    if (remainingBudget <= 0) {
+      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
     }
-    if (schema.properties) {
-      for (const [key, subSchema] of Object.entries(schema.properties)) {
-        if (key in obj) {
-          walk(obj[key], subSchema, joinPath(path19, key), errors);
-        }
-      }
+    const textBytes = Buffer.byteLength(text, "utf8");
+    if (textBytes <= remainingBudget) {
+      return { text, newBudget: remainingBudget - textBytes };
     }
-  }
-  if (schema.type === "array" && Array.isArray(value) && schema.items) {
-    for (let i = 0; i < value.length; i++) {
-      walk(value[i], schema.items, `${path19}[${i}]`, errors);
+    const marker = `
+\u2026[truncated ${textBytes - remainingBudget} bytes]\u2026
+`;
+    const markerBytes = Buffer.byteLength(marker, "utf8");
+    const available = remainingBudget - markerBytes;
+    if (available <= 0) {
+      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
     }
+    const half = Math.floor(available / 2);
+    const first = text.slice(0, half);
+    const second = text.slice(text.length - half);
+    return { text: `${first}${marker}${second}`, newBudget: 0 };
   }
+  return { serialize, enforceCap, capBytes };
 }
-function checkType(value, type) {
-  switch (type) {
-    case "string":
-      return typeof value === "string";
-    case "number":
-      return typeof value === "number" && !Number.isNaN(value);
-    case "integer":
-      return typeof value === "number" && Number.isInteger(value);
-    case "boolean":
-      return typeof value === "boolean";
-    case "null":
-      return value === null;
-    case "array":
-      return Array.isArray(value);
-    case "object":
-      return isPlainObject(value);
-    default:
-      return true;
-  }
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function describeType(v) {
-  if (v === null) return "null";
-  if (Array.isArray(v)) return "array";
-  return typeof v;
-}
-function joinPath(parent, key) {
-  if (!parent) return key;
-  return `${parent}.${key}`;
-}
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (typeof a !== typeof b) return false;
-  if (a === null || b === null) return a === b;
-  if (Array.isArray(a) && Array.isArray(b)) {
-    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
-  }
-  if (typeof a === "object" && typeof b === "object") {
-    const ak = Object.keys(a);
-    const bk = Object.keys(b);
-    if (ak.length !== bk.length) return false;
-    return ak.every(
-      (k) => deepEqual(a[k], b[k])
-    );
-  }
-  return false;
-}
-
-// src/utils/regex-guard.ts
-var MAX_PATTERN_LEN = 512;
-var DANGEROUS_PATTERNS = [
-  /(\([^)]*[+*][^)]*\))[+*]/,
-  // (a+)+, (.*)+, etc
-  /(\(\?:[^)]*[+*][^)]*\))[+*]/
-  // same, with non-capturing group
-];
-function compileUserRegex(pattern, flags) {
-  if (typeof pattern !== "string") {
-    return { ok: false, reason: "pattern must be a string" };
-  }
-  if (pattern.length === 0) {
-    return { ok: false, reason: "pattern is empty" };
-  }
-  if (pattern.length > MAX_PATTERN_LEN) {
-    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
-  }
-  for (const rx of DANGEROUS_PATTERNS) {
-    if (rx.test(pattern)) {
-      return {
-        ok: false,
-        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
-      };
-    }
-  }
-  try {
-    return { ok: true, regex: new RegExp(pattern, flags) };
-  } catch (err) {
-    return {
-      ok: false,
-      reason: err instanceof Error ? err.message : "invalid regex"
-    };
+function renderToolObject(toolName, obj, input) {
+  if (toolName === "read" && typeof obj["text"] === "string") {
+    return joinSections([
+      renderHeader(
+        `read: ${stringFromInput(input, "path") ?? stringField(obj, "path") ?? "<unknown>"}`,
+        {
+          offset: numberFromInput(input, "offset"),
+          limit: numberFromInput(input, "limit"),
+          total_lines: obj["total_lines"],
+          encoding: obj["encoding"],
+          truncated: obj["truncated"],
+          cached: obj["cached"],
+          note: obj["note"]
+        }
+      ),
+      obj["text"]
+    ]);
   }
-}
-var GLOB_CHARS = /* @__PURE__ */ new Set(["*", "?", "["]);
-var IS_WINDOWS = process.platform === "win32";
-var SEP = IS_WINDOWS ? "\\" : "/";
-function isGlob(p) {
-  for (const c of p) {
-    if (GLOB_CHARS.has(c)) return true;
+  if (toolName === "grep" && Array.isArray(obj["matches"])) {
+    const matches = stringArrayField(obj, "matches");
+    return joinSections([
+      renderHeader(`grep: ${stringFromInput(input, "pattern") ?? "<pattern>"}`, {
+        path: stringFromInput(input, "path"),
+        glob: stringFromInput(input, "glob"),
+        mode: stringFromInput(input, "output_mode"),
+        count: obj["count"],
+        shown: matches.length,
+        truncated: obj["truncated"],
+        used: obj["used"]
+      }),
+      renderGrepMatches(matches, stringFromInput(input, "output_mode"))
+    ]);
   }
-  return false;
-}
-function globToRegex(pat) {
-  let i = 0;
-  let re = "^";
-  while (i < pat.length) {
-    const c = expectDefined(pat[i]);
-    if (c === "*") {
-      if (pat[i + 1] === "*") {
-        re += ".*";
-        i += 2;
-        if (pat[i] === "/") i++;
-      } else {
-        re += "[^/\\\\]*";
-        i++;
-      }
-    } else if (c === "?") {
-      re += "[^/\\\\]";
-      i++;
-    } else if (c === "[") {
-      let cls = "[";
-      i++;
-      if (pat[i] === "!" || pat[i] === "^") {
-        cls += "^";
-        i++;
-      }
-      while (i < pat.length && pat[i] !== "]") {
-        const ch = pat[i] ?? "";
-        if (ch === "\\") cls += "\\\\";
-        else if (ch === "]" || ch === "^") cls += `\\${ch}`;
-        else cls += ch;
-        i++;
-      }
-      cls += "]";
-      re += cls;
-      i++;
-    } else {
-      re += c.replace(/[.+^${}()|\\]/g, "\\$&");
-      i++;
-    }
+  if (toolName === "patch" && Array.isArray(obj["files"])) {
+    const files = stringArrayField(obj, "files");
+    return joinSections([
+      renderHeader("patch", {
+        applied: obj["applied"],
+        rejected: obj["rejected"],
+        files: files.length,
+        dry_run: obj["dry_run"]
+      }),
+      typeof obj["message"] === "string" ? `message:
+${obj["message"]}` : void 0,
+      files.length > 0 ? `files:
+${renderStringList(files)}` : void 0
+    ]);
   }
-  return new RegExp(re + "$");
-}
-function baseDir(pat) {
-  let i = pat.length - 1;
-  while (i >= 0 && !GLOB_CHARS.has(expectDefined(pat[i])) && pat[i] !== SEP && pat[i] !== "/") i--;
-  const cut = i >= 0 ? pat.lastIndexOf(SEP, i) : pat.lastIndexOf("/", i);
-  return cut < 0 ? "." : pat.slice(0, cut);
-}
-async function expandGlob(pattern) {
-  if (!isGlob(pattern)) return [pattern];
-  const results = /* @__PURE__ */ new Set();
-  const abs = isAbsolute(pattern);
-  const base = abs ? baseDir(pattern) : baseDir(pattern);
-  const relPat = base === "." ? pattern : pattern.slice(base.length + 1);
-  async function walk3(dir, pat) {
-    let entries;
-    try {
-      entries = await fsp2.readdir(dir);
-    } catch {
-      return;
-    }
-    const firstGlob = pat.search(/[*?[[]/);
-    if (firstGlob < 0) {
-      const re = globToRegex(pat);
-      for (const e of entries) {
-        if (re.test(e)) {
-          const full = `${dir}${SEP}${e}`;
-          results.add(abs ? resolve(full) : full);
-        }
-      }
-      return;
-    }
-    const before = pat.slice(0, firstGlob);
-    const rest = pat.slice(firstGlob);
-    if (before.endsWith("**")) {
-      await walk3(dir, rest);
-      for (const e of entries) {
-        const full = `${dir}${SEP}${e}`;
-        try {
-          const stat6 = await fsp2.stat(full);
-          if (stat6.isDirectory()) await walk3(full, rest);
-        } catch {
+  if (toolName === "glob" && Array.isArray(obj["files"])) {
+    const files = stringArrayField(obj, "files");
+    return joinSections([
+      renderHeader(
+        `${toolName}: ${stringFromInput(input, "pattern") ?? stringFromInput(input, "files") ?? stringFromInput(input, "path") ?? ""}`.trim(),
+        {
+          path: stringFromInput(input, "path"),
+          files: files.length,
+          truncated: obj["truncated"]
         }
-      }
-    } else if (before === "") {
-      const re = globToRegex(rest);
-      for (const e of entries) {
-        if (re.test(e)) {
-          const full = `${dir}${SEP}${e}`;
-          results.add(abs ? resolve(full) : full);
+      ),
+      renderStringList(files, "(no files)")
+    ]);
+  }
+  if (toolName === "tree" && typeof obj["tree"] === "string") {
+    return joinSections([
+      renderHeader(
+        `tree: ${stringField(obj, "path") ?? stringFromInput(input, "path") ?? "<cwd>"}`,
+        {
+          total_files: obj["total_files"],
+          total_dirs: obj["total_dirs"],
+          truncated: obj["truncated"]
         }
-      }
-    } else {
-      const seg = before.replace(/[*?[\]]/g, "").replace(/\/$/, "");
-      if (entries.includes(seg)) {
-        const full = `${dir}${SEP}${seg}`;
-        try {
-          const stat6 = await fsp2.stat(full);
-          if (stat6.isDirectory()) await walk3(full, rest);
-        } catch {
+      ),
+      obj["tree"]
+    ]);
+  }
+  if (toolName === "fetch" && typeof obj["content"] === "string") {
+    return joinSections([
+      renderHeader(
+        `fetch: ${stringField(obj, "url") ?? stringFromInput(input, "url") ?? "<url>"}`,
+        {
+          status: obj["status"],
+          content_type: obj["content_type"]
         }
-      }
-    }
+      ),
+      obj["content"]
+    ]);
   }
-  await walk3(base === "." ? "." : base, relPat);
-  return [...results];
-}
-
-// src/utils/json-repair.ts
-function completePartialObject(s) {
-  if (!s.trim().startsWith("{")) return s;
-  if (tryParse(s).ok) return s;
-  return repairTruncated(s);
-}
-function repairTruncated(s) {
-  const stack = [];
-  let inString = false;
-  let escaped = false;
-  let sawKey = false;
-  let prevSig = "";
-  let contentEnd = 0;
-  let stringBraceDepth = 0;
-  for (let i = 0; i < s.length; i++) {
-    const ch = expectDefined(s[i]);
-    if (inString) {
-      contentEnd = i + 1;
-      if (escaped) {
-        escaped = false;
-        continue;
-      }
-      if (ch === "\\") {
-        escaped = true;
-        continue;
-      }
-      if (ch === '"') {
-        inString = false;
-        prevSig = '"';
-        stringBraceDepth = 0;
-        continue;
-      }
-      if (ch === "{") stringBraceDepth++;
-      else if (ch === "}" && stringBraceDepth > 0) stringBraceDepth--;
-      continue;
-    }
-    if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") continue;
-    contentEnd = i + 1;
-    if (ch === '"') {
-      inString = true;
-      sawKey = true;
-      stringBraceDepth = 0;
-      prevSig = '"';
-    } else if (ch === "{" || ch === "[") {
-      stack.push(ch);
-      prevSig = ch;
-    } else if (ch === "}" || ch === "]") {
-      stack.pop();
-      prevSig = ch;
-    } else {
-      prevSig = ch;
+  if (toolName === "replace" && Array.isArray(obj["results"])) {
+    const results = obj["results"].filter(isRecord2);
+    const sections = [
+      renderHeader("replace", {
+        files_modified: obj["files_modified"],
+        total_replacements: obj["total_replacements"],
+        dry_run: obj["dry_run"]
+      })
+    ];
+    for (const r of results.slice(0, DEFAULT_LIST_LIMIT)) {
+      sections.push(
+        joinSections([
+          renderHeader(`file: ${stringField(r, "path") ?? "<unknown>"}`, {
+            replacements: r["replacements"]
+          }),
+          typeof r["diff"] === "string" ? r["diff"] : void 0
+        ])
+      );
     }
+    if (results.length > DEFAULT_LIST_LIMIT) {
+      sections.push(`[serializer omitted ${results.length - DEFAULT_LIST_LIMIT} result item(s)]`);
+    }
+    return joinSections(sections);
+  }
+  if (typeof obj["diff"] === "string") {
+    const diff = obj["diff"];
+    return joinSections([
+      renderHeader(toolName, {
+        path: obj["path"],
+        replacements: obj["replacements"],
+        bytes_written: obj["bytes_written"],
+        created: obj["created"],
+        note: obj["note"],
+        files: Array.isArray(obj["files"]) ? obj["files"].length : void 0,
+        truncated: obj["truncated"],
+        mode: obj["mode"]
+      }),
+      compactDiff(diff)
+    ]);
   }
-  if (!sawKey && !inString) return s;
-  let result = s.slice(0, contentEnd);
-  if (inString) {
-    if (escaped) {
-      result = result.slice(0, -1);
-    } else if (endsWithInvalidEscape(result)) {
-      result = result.slice(0, -2);
-    }
-    if (stringBraceDepth > 0) result += "}".repeat(stringBraceDepth);
-    result += '"';
-  } else if (prevSig === ":") {
-    result += "null";
+  if (toolName === "test" && typeof obj["output"] === "string") {
+    return renderTestOutput(obj, input);
   }
-  for (let k = stack.length - 1; k >= 0; k--) {
-    result += stack[k] === "{" ? "}" : "]";
+  if ((toolName === "typecheck" || toolName === "lint" || toolName === "format") && typeof obj["output"] === "string") {
+    return renderVerifierOutput(toolName, obj, input);
   }
-  if (!tryParse(result).ok) {
-    const patched = result.replace(/:(\s*)([}\]])/g, ":null$2");
-    if (tryParse(patched).ok) result = patched;
+  if (hasCommandOutputShape(obj)) {
+    return renderCommandOutput(toolName, obj, input);
   }
-  return result;
-}
-var VALID_ESCAPE = /* @__PURE__ */ new Set(['"', "\\", "/", "b", "f", "n", "r", "t", "u"]);
-function endsWithInvalidEscape(str) {
-  const last = str[str.length - 1];
-  if (str[str.length - 2] !== "\\" || last === void 0) return false;
-  if (VALID_ESCAPE.has(last)) return false;
-  let backslashes = 0;
-  for (let k = str.length - 2; k >= 0 && str[k] === "\\"; k--) backslashes++;
-  return backslashes % 2 === 1;
-}
-function tryParse(s) {
-  try {
-    return { ok: true, value: JSON.parse(s) };
-  } catch {
-    return { ok: false };
+  if (toolName === "json" && typeof obj["formatted"] === "string") {
+    return joinSections([
+      renderHeader("json", {
+        type: obj["type"],
+        keys: Array.isArray(obj["keys"]) ? obj["keys"].length : void 0,
+        query: stringFromInput(input, "query"),
+        error: obj["error"]
+      }),
+      obj["formatted"]
+    ]);
   }
-}
-
-// src/utils/merge-models-payload.ts
-function mergeModelsPayload(base, overlay) {
-  const out = {};
-  for (const [id, provider] of Object.entries(base)) {
-    out[id] = cloneProvider(provider);
+  if (toolName === "logs" && Array.isArray(obj["entries"])) {
+    const entries = obj["entries"].filter(isRecord2);
+    const lines = entries.slice(0, LOG_ENTRY_LIMIT).map((entry) => {
+      const ts = stringField(entry, "timestamp") ?? "";
+      const level = stringField(entry, "level") ?? "info";
+      const message = stringField(entry, "message") ?? "";
+      const source = stringField(entry, "source");
+      return [ts, level, source, message].filter(Boolean).join(" ");
+    });
+    if (entries.length > LOG_ENTRY_LIMIT) {
+      lines.push(`[serializer omitted ${entries.length - LOG_ENTRY_LIMIT} log entry item(s)]`);
+    }
+    return joinSections([
+      renderHeader(`logs: ${stringField(obj, "source") ?? "<source>"}`, {
+        total: obj["total"],
+        shown: Math.min(entries.length, LOG_ENTRY_LIMIT),
+        truncated: obj["truncated"],
+        stream_mode: obj["stream_mode"]
+      }),
+      lines.length > 0 ? lines.join("\n") : "(no log entries)"
+    ]);
   }
-  for (const [id, ovProvider] of Object.entries(overlay)) {
-    const existing = out[id];
-    out[id] = existing ? mergeProvider(existing, ovProvider) : cloneProvider(ovProvider);
+  if (toolName === "audit" && Array.isArray(obj["vulnerabilities"])) {
+    const vulns = obj["vulnerabilities"].filter(isRecord2);
+    const lines = vulns.slice(0, DEFAULT_LIST_LIMIT).map((v) => {
+      const severity = stringField(v, "severity") ?? "unknown";
+      const pkg = stringField(v, "package") ?? "<package>";
+      const title = stringField(v, "title") ?? "";
+      const url = stringField(v, "url");
+      return [severity, pkg, title, url].filter(Boolean).join(" | ");
+    });
+    if (vulns.length > DEFAULT_LIST_LIMIT) {
+      lines.push(`[serializer omitted ${vulns.length - DEFAULT_LIST_LIMIT} vulnerability item(s)]`);
+    }
+    return joinSections([
+      renderHeader("audit", {
+        exit_code: obj["exit_code"],
+        total: obj["total"],
+        summary: obj["summary"],
+        truncated: obj["truncated"]
+      }),
+      lines.length > 0 ? lines.join("\n") : stringField(obj, "output")
+    ]);
   }
-  return out;
+  if (toolName === "outdated" && Array.isArray(obj["packages"])) {
+    const packages = obj["packages"].filter(isRecord2);
+    const lines = packages.slice(0, DEFAULT_LIST_LIMIT).map(
+      (p) => [
+        stringField(p, "name") ?? "<package>",
+        `current=${stringField(p, "current") ?? "unknown"}`,
+        `wanted=${stringField(p, "wanted") ?? "unknown"}`,
+        `latest=${stringField(p, "latest") ?? "unknown"}`,
+        stringField(p, "type")
+      ].filter(Boolean).join(" | ")
+    );
+    if (packages.length > DEFAULT_LIST_LIMIT) {
+      lines.push(`[serializer omitted ${packages.length - DEFAULT_LIST_LIMIT} package item(s)]`);
+    }
+    return joinSections([
+      renderHeader("outdated", {
+        exit_code: obj["exit_code"],
+        total: obj["total"],
+        truncated: obj["truncated"]
+      }),
+      lines.length > 0 ? lines.join("\n") : stringField(obj, "output")
+    ]);
+  }
+  return void 0;
 }
-function mergeProvider(base, overlay) {
-  const models = {};
-  for (const [mid, m] of Object.entries(base.models ?? {})) {
-    models[mid] = { ...m };
+function renderTestOutput(obj, input) {
+  const exitCode = numberField(obj, "exit_code") ?? 0;
+  const failed = numberField(obj, "failed") ?? 0;
+  const output = stringField(obj, "output") ?? "";
+  const header = renderHeader(`test: ${stringField(obj, "runner") ?? "runner"}`, {
+    exit_code: obj["exit_code"],
+    tests_run: obj["tests_run"],
+    passed: obj["passed"],
+    failed: obj["failed"],
+    duration_ms: obj["duration_ms"],
+    truncated: obj["truncated"],
+    files: inputListSummary(input, "files"),
+    grep: stringFromInput(input, "grep")
+  });
+  if (exitCode === 0 && failed === 0) {
+    return joinSections([
+      header,
+      joinSections([
+        "report:",
+        `status=passed`,
+        `tests_run=${obj["tests_run"] ?? 0}`,
+        `passed=${obj["passed"] ?? 0}`,
+        `failed=${obj["failed"] ?? 0}`,
+        `duration_ms=${obj["duration_ms"] ?? 0}`,
+        extractSpoolNote(output)
+      ])
+    ]);
   }
-  for (const [mid, ovModel] of Object.entries(overlay.models ?? {})) {
-    const existing = models[mid];
-    models[mid] = existing ? mergeModel(existing, ovModel) : { ...ovModel };
+  return joinSections([
+    header,
+    `error_context:
+${compactFailureOutput(output || "(no runner output)")}`
+  ]);
+}
+function renderVerifierOutput(toolName, obj, input) {
+  const exitCode = numberField(obj, "exit_code") ?? 0;
+  const errors = numberField(obj, "errors") ?? 0;
+  const warnings = numberField(obj, "warnings") ?? 0;
+  const output = stringField(obj, "output") ?? "";
+  const changed = numberField(obj, "files_changed") ?? 0;
+  const header = renderHeader(toolName, {
+    exit_code: obj["exit_code"],
+    errors: obj["errors"],
+    warnings: obj["warnings"],
+    files_checked: obj["files_checked"],
+    files_changed: obj["files_changed"],
+    fix_applied: obj["fix_applied"],
+    fixer: obj["fixer"],
+    linter: obj["linter"],
+    project: obj["project"],
+    truncated: obj["truncated"],
+    files: inputListSummary(input, "files"),
+    cwd: stringFromInput(input, "cwd")
+  });
+  if (exitCode === 0 && errors === 0 && (toolName !== "format" || changed === 0)) {
+    return joinSections([
+      header,
+      joinSections([
+        "report:",
+        "status=passed",
+        `errors=${errors}`,
+        `warnings=${warnings}`,
+        toolName === "format" ? `files_changed=${changed}` : void 0,
+        extractSpoolNote(output)
+      ])
+    ]);
   }
-  return {
-    ...base,
-    // Overlay scalar fields win when explicitly provided; otherwise keep base.
-    ...stripUndefined({
-      id: overlay.id,
-      name: overlay.name,
-      npm: overlay.npm,
-      api: overlay.api,
-      env: overlay.env,
-      doc: overlay.doc
-    }),
-    models
-  };
+  if (exitCode === 0 && toolName === "format") {
+    return joinSections([
+      header,
+      joinSections([
+        "report:",
+        "status=changed",
+        `files_changed=${changed}`,
+        extractSpoolNote(output)
+      ])
+    ]);
+  }
+  return joinSections([
+    header,
+    `error_context:
+${compactFailureOutput(output || "(no verifier output)")}`
+  ]);
 }
-function mergeModel(base, overlay) {
-  const merged = { ...base, ...overlay };
-  if (base.limit || overlay.limit) {
-    merged.limit = { ...base.limit, ...overlay.limit };
+function renderGrepMatches(matches, mode) {
+  if (matches.length === 0) return "(no matches)";
+  if (mode === "files_with_matches") return renderStringList(matches, "(no files)");
+  if (mode === "count") return renderStringList(matches, "(no counts)");
+  const groups = /* @__PURE__ */ new Map();
+  const passthrough = [];
+  for (const match of matches) {
+    const parsed = parseGrepContentLine(match);
+    if (!parsed) {
+      passthrough.push(match);
+      continue;
+    }
+    const list = groups.get(parsed.file) ?? [];
+    list.push(`${parsed.line}:${parsed.text}`);
+    groups.set(parsed.file, list);
   }
-  if (base.cost || overlay.cost) {
-    merged.cost = { ...base.cost, ...overlay.cost };
+  if (groups.size === 0) return renderStringList(matches, "(no matches)");
+  const sections = [];
+  let fileIndex = 0;
+  for (const [file, lines] of groups) {
+    fileIndex++;
+    if (fileIndex > GREP_FILE_LIMIT) break;
+    const shown = lines.slice(0, GREP_MATCHES_PER_FILE);
+    sections.push(
+      `${file} (${lines.length} match(es), showing ${shown.length})
+${shown.join("\n")}`
+    );
   }
-  if (base.modalities || overlay.modalities) {
-    merged.modalities = { ...base.modalities, ...overlay.modalities };
+  if (groups.size > GREP_FILE_LIMIT) {
+    sections.push(`[serializer omitted ${groups.size - GREP_FILE_LIMIT} file group(s)]`);
+  }
+  if (passthrough.length > 0) {
+    sections.push(`ungrouped:
+${renderStringList(passthrough, "", 50)}`);
+  }
+  return sections.join("\n");
+}
+function parseGrepContentLine(line) {
+  const match = /^(.+?):(\d+):(.*)$/.exec(line);
+  if (!match?.[1] || !match[2]) return void 0;
+  return { file: match[1], line: match[2], text: match[3] ?? "" };
+}
+function compactDiff(diff) {
+  const lines = diff.split(/\r?\n/);
+  if (lines.length <= DIFF_INLINE_LINE_LIMIT) return diff;
+  const fileCount = Math.max(
+    new Set(
+      lines.map(
+        (line) => /^diff --git\s+a\/(.+?)\s+b\//.exec(line)?.[1] ?? /^---\s+(.+)/.exec(line)?.[1]
+      ).filter(Boolean)
+    ).size,
+    0
+  );
+  const hunks = lines.filter((line) => line.startsWith("@@")).length;
+  const added = lines.filter((line) => line.startsWith("+") && !line.startsWith("+++")).length;
+  const removed = lines.filter((line) => line.startsWith("-") && !line.startsWith("---")).length;
+  const selected = /* @__PURE__ */ new Set();
+  let hunkCount = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    if (line.startsWith("diff --git") || line.startsWith("--- ") || line.startsWith("+++ ")) {
+      selected.add(i);
+      continue;
+    }
+    if (!line.startsWith("@@")) continue;
+    if (hunkCount >= DIFF_HUNK_LIMIT) continue;
+    hunkCount++;
+    for (let j = i; j <= Math.min(lines.length - 1, i + DIFF_HUNK_CONTEXT); j++) {
+      selected.add(j);
+    }
+  }
+  if (selected.size === 0) {
+    return joinSections([
+      renderHeader("diff_summary", {
+        files: fileCount,
+        hunks,
+        added,
+        removed,
+        lines: lines.length
+      }),
+      lines.slice(0, DIFF_INLINE_LINE_LIMIT).join("\n"),
+      `[serializer omitted ${Math.max(0, lines.length - DIFF_INLINE_LINE_LIMIT)} diff line(s)]`
+    ]);
   }
-  return merged;
-}
-function cloneProvider(p) {
-  const models = {};
-  for (const [mid, m] of Object.entries(p.models ?? {})) {
-    models[mid] = { ...m };
+  const excerpt = [];
+  let previous = -1;
+  for (const index of [...selected].sort((a, b) => a - b)) {
+    if (index > previous + 1) {
+      const omitted = previous === -1 ? index : index - previous - 1;
+      excerpt.push(`[serializer omitted ${omitted} diff line(s)]`);
+    }
+    excerpt.push(lines[index] ?? "");
+    previous = index;
+  }
+  const trailing = lines.length - previous - 1;
+  if (trailing > 0) excerpt.push(`[serializer omitted ${trailing} trailing diff line(s)]`);
+  return joinSections([
+    renderHeader("diff_summary", {
+      files: fileCount,
+      hunks,
+      shown_hunks: Math.min(hunks, DIFF_HUNK_LIMIT),
+      added,
+      removed,
+      lines: lines.length
+    }),
+    excerpt.join("\n")
+  ]);
+}
+function compactFailureOutput(output) {
+  const lines = output.split(/\r?\n/);
+  if (lines.length <= 260) return output.trimEnd();
+  const selected = /* @__PURE__ */ new Set();
+  const marker = /\b(fail|failed|failure|error|exception|assertionerror|expected|received|actual|timeout|stack)\b/i;
+  let markerHits = 0;
+  for (let i = 0; i < lines.length; i++) {
+    if (!marker.test(lines[i] ?? "")) continue;
+    markerHits++;
+    for (let j = Math.max(0, i - 4); j <= Math.min(lines.length - 1, i + 10); j++) {
+      selected.add(j);
+    }
+  }
+  if (markerHits === 0) {
+    return lines.slice(-220).join("\n").trimEnd();
+  }
+  const ordered = [...selected].sort((a, b) => a - b);
+  const out = [];
+  let previous = -1;
+  for (const index of ordered) {
+    if (index > previous + 1) {
+      const omitted = previous === -1 ? index : index - previous - 1;
+      out.push(`[serializer omitted ${omitted} line(s)]`);
+    }
+    out.push(lines[index] ?? "");
+    previous = index;
+  }
+  return out.join("\n").trimEnd();
+}
+function extractSpoolNote(output) {
+  return output.split(/\r?\n/).find((line) => line.startsWith("[output truncated") && line.includes("full"));
+}
+function hasCommandOutputShape(obj) {
+  return typeof obj["stdout"] === "string" || typeof obj["stderr"] === "string" || typeof obj["output"] === "string" || typeof obj["exitCode"] === "number" || typeof obj["exit_code"] === "number";
+}
+function renderCommandOutput(toolName, obj, input) {
+  const command = stringField(obj, "command") ?? stringFromInput(input, "command");
+  const args = stringArrayField(obj, "args");
+  const commandLine = command ? [command, ...args].join(" ") : void 0;
+  const output = stringField(obj, "output");
+  const stdout = stringField(obj, "stdout");
+  const stderr = stringField(obj, "stderr");
+  return joinSections([
+    renderHeader(commandLine ? `${toolName}: ${commandLine}` : toolName, {
+      exit_code: obj["exit_code"] ?? obj["exitCode"],
+      timed_out: obj["timed_out"],
+      pid: obj["pid"],
+      allowed: obj["allowed"],
+      truncated: obj["truncated"],
+      runner: obj["runner"],
+      linter: obj["linter"],
+      fixer: obj["fixer"],
+      project: obj["project"],
+      tests_run: obj["tests_run"],
+      passed: obj["passed"],
+      failed: obj["failed"],
+      duration_ms: obj["duration_ms"],
+      errors: obj["errors"],
+      warnings: obj["warnings"],
+      files_checked: obj["files_checked"],
+      files_changed: obj["files_changed"],
+      fix_applied: obj["fix_applied"]
+    }),
+    stringField(obj, "error") ? `error:
+${stringField(obj, "error")}` : void 0,
+    output ? `output:
+${output}` : void 0,
+    stdout ? `stdout:
+${stdout}` : void 0,
+    stderr ? `stderr:
+${stderr}` : void 0
+  ]);
+}
+function renderGenericToolObject(toolName, obj) {
+  const scalars = {};
+  const blocks = [];
+  for (const [key, value] of Object.entries(obj)) {
+    if (value === void 0) continue;
+    if (isScalar(value)) {
+      const inline = String(value);
+      if (inline.length <= INLINE_LIMIT && !inline.includes("\n")) {
+        scalars[key] = value;
+      } else {
+        blocks.push(`${key}:
+${inline}`);
+      }
+      continue;
+    }
+    if (Array.isArray(value)) {
+      if (value.every((item) => typeof item === "string")) {
+        blocks.push(`${key}:
+${renderStringList(value)}`);
+      } else {
+        blocks.push(`${key}:
+${renderUnknownList(value)}`);
+      }
+      continue;
+    }
+    blocks.push(`${key}: ${clipInline(oneLineJson(value))}`);
   }
-  return { ...p, models };
+  return joinSections([renderHeader(toolName, scalars), ...blocks]);
 }
-function stripUndefined(obj) {
-  const out = {};
-  for (const [k, v] of Object.entries(obj)) {
-    if (v !== void 0) out[k] = v;
+function renderHeader(label, fields) {
+  const parts = Object.entries(fields).filter(([, value]) => value !== void 0 && value !== null && value !== "").map(([key, value]) => `${key}=${clipInline(formatInlineValue(value))}`);
+  return parts.length > 0 ? `${label} (${parts.join(" ")})` : label;
+}
+function renderStringList(items, empty = "", limit = DEFAULT_LIST_LIMIT) {
+  if (items.length === 0) return empty;
+  const shown = items.slice(0, limit);
+  const omitted = items.length - shown.length;
+  return [
+    ...shown,
+    ...omitted > 0 ? [`[serializer omitted ${omitted} item(s); narrow the request for more]`] : []
+  ].join("\n");
+}
+function renderUnknownList(items, limit = DEFAULT_LIST_LIMIT) {
+  const shown = items.slice(0, limit).map((item) => clipInline(oneLineJson(item), 1e3));
+  const omitted = items.length - shown.length;
+  if (omitted > 0)
+    shown.push(`[serializer omitted ${omitted} item(s); narrow the request for more]`);
+  return shown.join("\n");
+}
+function joinSections(sections) {
+  return sections.map((section) => typeof section === "string" ? section.trimEnd() : void 0).filter((section) => !!section).join("\n");
+}
+function formatInlineValue(value) {
+  if (Array.isArray(value)) return `[${value.map(formatInlineValue).join(",")}]`;
+  if (isScalar(value)) return String(value);
+  return oneLineJson(value);
+}
+function clipInline(value, max = INLINE_LIMIT) {
+  const compact = value.replace(/\s+/g, " ").trim();
+  return compact.length <= max ? compact : `${compact.slice(0, max - 15)}...(${compact.length} chars)`;
+}
+function oneLineJson(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
   }
-  return out;
+}
+function stringField(obj, key) {
+  const value = obj[key];
+  return typeof value === "string" ? value : void 0;
+}
+function numberField(obj, key) {
+  const value = obj[key];
+  return typeof value === "number" ? value : void 0;
+}
+function stringArrayField(obj, key) {
+  const value = obj[key];
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function stringFromInput(input, key) {
+  if (!isRecord2(input)) return void 0;
+  const value = input[key];
+  return typeof value === "string" ? value : void 0;
+}
+function numberFromInput(input, key) {
+  if (!isRecord2(input)) return void 0;
+  const value = input[key];
+  return typeof value === "number" ? value : void 0;
+}
+function inputListSummary(input, key) {
+  if (!isRecord2(input)) return void 0;
+  const value = input[key];
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value.filter((item) => typeof item === "string").join(",");
+  return void 0;
+}
+function isRecord2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isScalar(value) {
+  return value === null || ["string", "number", "boolean"].includes(typeof value);
+}
+function projectHash(absRoot) {
+  return createHash("sha256").update(path4.resolve(absRoot)).digest("hex").slice(0, 12);
+}
+function projectSlug(absRoot) {
+  const base = slugify(path4.basename(absRoot));
+  const hash = createHash("sha256").update(path4.resolve(absRoot)).digest("hex").slice(0, 6);
+  return `${base}-${hash}`;
+}
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
+}
+function wstackGlobalRoot() {
+  const fromEnv = process.env["WRONGSTACK_HOME"];
+  if (fromEnv && fromEnv.trim().length > 0) return path4.resolve(fromEnv);
+  return path4.join(os.homedir(), ".wrongstack");
+}
+function resolveWstackPaths(opts) {
+  const globalRoot = opts.globalRoot ?? (opts.userHome ? path4.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
+  const hash = projectHash(opts.projectRoot);
+  const slug = projectSlug(opts.projectRoot);
+  const projectDir = path4.join(globalRoot, "projects", slug);
+  return {
+    globalRoot,
+    configDir: globalRoot,
+    globalConfig: path4.join(globalRoot, "config.json"),
+    secretsKey: path4.join(globalRoot, ".key"),
+    globalMemory: path4.join(globalRoot, "memory.md"),
+    globalSkills: path4.join(globalRoot, "skills"),
+    globalPrompts: path4.join(globalRoot, "prompts"),
+    cacheDir: path4.join(globalRoot, "cache"),
+    modelsCache: path4.join(globalRoot, "cache", "models.dev.json"),
+    modelsOverlayCache: path4.join(globalRoot, "cache", "models-overlay.json"),
+    historyFile: path4.join(globalRoot, "history"),
+    logFile: path4.join(globalRoot, "logs", "wrongstack.log"),
+    projectDir,
+    projectCodebaseIndex: path4.join(projectDir, "codebase-index"),
+    projectMemory: path4.join(projectDir, "memory.md"),
+    projectSessions: path4.join(projectDir, "sessions"),
+    projectTrust: path4.join(projectDir, "trust.json"),
+    projectMeta: path4.join(projectDir, "meta.json"),
+    projectLocalConfig: path4.join(projectDir, "config.local.json"),
+    inProjectConfig: path4.join(opts.projectRoot, ".wrongstack", "config.json"),
+    inProjectAgentsFile: path4.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
+    inProjectSkills: path4.join(opts.projectRoot, ".wrongstack", "skills"),
+    inProjectWorktrees: path4.join(opts.projectRoot, ".wrongstack", "worktrees"),
+    projectHash: hash,
+    projectSlug: slug,
+    projectGoal: path4.join(projectDir, "goal.json"),
+    projectSpecs: path4.join(projectDir, "specs"),
+    projectTaskGraphs: path4.join(projectDir, "task-graphs"),
+    projectSddSession: path4.join(projectDir, "sdd-session.json"),
+    projectPlan: path4.join(projectDir, "plan.json"),
+    projectAutophase: path4.join(projectDir, "autophase"),
+    syncConfig: path4.join(globalRoot, "sync.json"),
+    projectStatus: (projectHash2) => path4.join(globalRoot, "projects", projectHash2, "status.json")
+  };
 }
 
 // src/storage/session-store.ts
@@ -1339,11 +2115,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
   }
   /** Absolute path to the session index file. */
   get indexFile() {
-    return path3.join(this.dir, "_index.jsonl");
+    return path4.join(this.dir, "_index.jsonl");
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
-    return path3.join(this.dir, `${id}${ext}`);
+    return path4.join(this.dir, `${id}${ext}`);
   }
   /**
    * Ensure the directory implied by the session ID exists. When the ID
@@ -1351,7 +2127,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
    * subdirectory so sessions group naturally by day.
    */
   async ensureShardDir(id) {
-    const dirPath = path3.dirname(path3.join(this.dir, id));
+    const dirPath = path4.dirname(path4.join(this.dir, id));
     await ensureDir(dirPath);
     return dirPath;
   }
@@ -1359,7 +2135,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const id = meta.id && meta.id.length > 0 ? meta.id : generateSessionId(startedAt, meta.model ?? meta.provider);
     const shardDir = await this.ensureShardDir(id);
-    const file = path3.join(shardDir, `${path3.basename(id)}.jsonl`);
+    const file = path4.join(shardDir, `${path4.basename(id)}.jsonl`);
     const t0 = Date.now();
     let handle;
     try {
@@ -1421,7 +2197,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
           // Shard directory (sessions/<date>/) — must match create() so the
           // .summary.json sidecar lands next to the JSONL instead of the
           // sessions root (where summaryFor() would never find it).
-          dir: path3.dirname(file),
+          dir: path4.dirname(file),
           filePath: file,
           secretScrubber: this.secretScrubber,
           onClose: (s) => this.appendToIndex(s)
@@ -1457,6 +2233,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
       const cached = this._loadCache.get(id);
       if (cached && cached.mtimeMs === stat6.mtimeMs && cached.size === stat6.size) {
         cacheHit = true;
+        this._loadCache.delete(id);
+        this._loadCache.set(id, cached);
         return cached.data;
       }
       const raw = await fsp2.readFile(file, "utf8");
@@ -1645,7 +2423,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         continue;
       if (entry.isDirectory()) {
         const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        ids.push(...await this.collectSessionIds(path3.join(dir, entry.name), childPrefix, depth + 1));
+        ids.push(...await this.collectSessionIds(path4.join(dir, entry.name), childPrefix, depth + 1));
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
         if (entry.name === "_index.jsonl") continue;
         const base = entry.name.replace(/\.jsonl$/, "");
@@ -1696,14 +2474,14 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async deleteSession(id) {
     const jsonlPath = this.sessionPath(id, ".jsonl");
     const summaryPath = this.sessionPath(id, ".summary.json");
-    const shardDir = path3.dirname(path3.join(this.dir, id));
-    const base = path3.basename(id);
-    const sessDir = path3.join(shardDir, base);
+    const shardDir = path4.dirname(path4.join(this.dir, id));
+    const base = path4.basename(id);
+    const sessDir = path4.join(shardDir, base);
     const deletions = [
       fsp2.unlink(jsonlPath),
       fsp2.unlink(summaryPath),
-      fsp2.unlink(path3.join(shardDir, `${base}.plan.json`)),
-      fsp2.unlink(path3.join(shardDir, `${base}.todos.json`))
+      fsp2.unlink(path4.join(shardDir, `${base}.plan.json`)),
+      fsp2.unlink(path4.join(shardDir, `${base}.todos.json`))
     ];
     const results = await Promise.allSettled(deletions);
     for (const r of results) {
@@ -1739,14 +2517,14 @@ var DefaultSessionStore = class _DefaultSessionStore {
     let deleted = 0;
     let activeSessionId = null;
     try {
-      const raw = await fsp2.readFile(path3.join(this.dir, "active.json"), "utf8");
+      const raw = await fsp2.readFile(path4.join(this.dir, "active.json"), "utf8");
       const active = JSON.parse(raw);
       activeSessionId = active.sessionId ?? null;
     } catch {
     }
     const isPrunableJsonl = (name) => name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
     const pruneFile = async (dir, name, prefix) => {
-      const jsonlPath = path3.join(dir, name);
+      const jsonlPath = path4.join(dir, name);
       try {
         const stat6 = await fsp2.stat(jsonlPath);
         if (stat6.mtimeMs >= cutoff) return;
@@ -1766,7 +2544,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         continue;
       }
       if (!entry.isDirectory()) continue;
-      const dateDir = path3.join(this.dir, entry.name);
+      const dateDir = path4.join(this.dir, entry.name);
       const files = await fsp2.readdir(dateDir, { withFileTypes: true }).catch(() => []);
       for (const file of files) {
         if (!file.isFile() || !isPrunableJsonl(file.name)) continue;
@@ -1778,7 +2556,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const dateDir = path3.join(this.dir, entry.name);
+      const dateDir = path4.join(this.dir, entry.name);
       try {
         const remaining = await fsp2.readdir(dateDir);
         if (remaining.length === 0) {
@@ -1953,7 +2731,7 @@ var FileSessionWriter = class _FileSessionWriter {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path3.join(opts.dir, `${path3.basename(id)}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path4.join(opts.dir, `${path4.basename(id)}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.onCloseCb = opts.onClose;
@@ -2457,7 +3235,7 @@ var QueueStore = class {
   events;
   traceId;
   constructor(opts) {
-    this.file = path3.join(opts.dir, "queue.json");
+    this.file = path4.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
   }
@@ -2644,7 +3422,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp2.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path3.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path4.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -2856,7 +3634,7 @@ var FileMemoryBackend = class {
   }
   async remember(scope, entry, filePath) {
     const file = this.resolveFile(filePath, scope);
-    await ensureDir(path3.dirname(file));
+    await ensureDir(path4.dirname(file));
     let existing = "";
     try {
       existing = await fsp2.readFile(file, "utf8");
@@ -3472,9 +4250,9 @@ ${body.trim()}`);
     if (!this.persistBackup || scope === "project-agents") return;
     try {
       const content = await this.backend.readAll(scope, this.files[scope]);
-      const { writeFile: writeFile4, mkdir: mkdir6 } = await import('fs/promises');
-      await mkdir6(this.backupDir, { recursive: true });
-      await writeFile4(`${this.backupDir}/${scope}.md`, content, "utf8");
+      const { writeFile: writeFile5, mkdir: mkdir7 } = await import('fs/promises');
+      await mkdir7(this.backupDir, { recursive: true });
+      await writeFile5(`${this.backupDir}/${scope}.md`, content, "utf8");
     } catch {
     }
   }
@@ -3824,7 +4602,7 @@ var DefaultSecretVault = class {
     KEY_FILE_MAGIC.copy(keyFileBuf, 0);
     keyFileBuf[KEY_FILE_MAGIC.length] = newVersion;
     newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
-    fs4.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    fs4.mkdirSync(path4.dirname(this.keyFile), { recursive: true });
     fs4.writeFileSync(this.keyFile, keyFileBuf, { mode: 384 });
     checkKeyFilePermissions(this.keyFile);
     this.key = newKey;
@@ -3872,7 +4650,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs4.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    fs4.mkdirSync(path4.dirname(this.keyFile), { recursive: true });
     const key = randomBytes(KEY_BYTES);
     try {
       fs4.writeFileSync(this.keyFile, key, { mode: 384, flag: "wx" });
@@ -3962,7 +4740,7 @@ async function rewriteConfigEncrypted(configPath, vault, patch) {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp2.mkdir(path3.dirname(configPath), { recursive: true });
+  await fsp2.mkdir(path4.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions(configPath);
 }
@@ -4159,6 +4937,7 @@ var BEHAVIOR_DEFAULTS = {
     modelsRegistry: true,
     skills: true
   },
+  mcpServers: {},
   indexing: {
     onSessionStart: true,
     onEdit: true,
@@ -4592,7 +5371,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path3.join(opts.dir, LOCK_FILE);
+    this.file = path4.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -4653,7 +5432,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path3.dirname(this.file));
+    await ensureDir(path4.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -6073,9 +6852,9 @@ function getInputString(input, key) {
 function pathLooksInsideProject(rawPath, projectRoot) {
   if (!projectRoot) return false;
   if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path3.resolve(projectRoot, rawPath);
-  const relative2 = path3.relative(projectRoot, resolved);
-  return !!relative2 && !relative2.startsWith("..") && !path3.isAbsolute(relative2);
+  const resolved = path4.resolve(projectRoot, rawPath);
+  const relative3 = path4.relative(projectRoot, resolved);
+  return !!relative3 && !relative3.startsWith("..") && !path4.isAbsolute(relative3);
 }
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
@@ -6085,7 +6864,7 @@ function pathTokenIsOutsideProject(token, projectRoot) {
   if (token === "/" || token === "~" || token === "." || token === "..") return token !== ".";
   if (token.includes("*")) return true;
   if (token.startsWith("..") || token.includes("../") || token.includes("..\\")) return true;
-  if (path3.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
+  if (path4.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
   return false;
 }
 function hasDangerousDeleteTarget(tokens, start, projectRoot) {
@@ -6250,7 +7029,7 @@ var DefaultPermissionPolicy = class {
     if (!this.loaded) await this.reload();
     const namespaceEntry = this.findNamespaceEntry(tool.name);
     const entry = this.policy[tool.name] ?? namespaceEntry;
-    const subject = this.subjectFor(tool.name, input, tool.subjectKey);
+    const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
     const cacheKey = `${tool.name}::${subject ?? tool.name}`;
     if (tool.name !== "write") {
       const cached = this._evalCache.get(cacheKey);
@@ -6432,32 +7211,6 @@ var DefaultPermissionPolicy = class {
     this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();
   }
-  subjectFor(toolName, input, subjectKey) {
-    if (!input || typeof input !== "object") return void 0;
-    const obj = input;
-    const globChars = /[*?[\]]/g;
-    const escapeGlob = (s) => s.replace(globChars, (c) => `\\${c}`);
-    const normalizePath = (s) => escapeGlob(s.replace(/\\/g, "/"));
-    if (subjectKey) {
-      const v = obj[subjectKey];
-      if (typeof v === "string") {
-        return subjectKey === "path" || subjectKey === "file" || subjectKey === "files" ? normalizePath(v) : escapeGlob(v);
-      }
-    }
-    if (toolName === "bash" && typeof obj.command === "string") {
-      return escapeGlob(obj.command);
-    }
-    if (typeof obj.path === "string") {
-      return normalizePath(obj.path);
-    }
-    if (typeof obj.url === "string") {
-      return escapeGlob(obj.url);
-    }
-    if (typeof obj.name === "string") {
-      return escapeGlob(obj.name);
-    }
-    return void 0;
-  }
   findNamespaceEntry(toolName) {
     for (const { pattern, value } of this.wildcardEntries) {
       if (matchGlob(pattern, toolName)) return value;
@@ -6480,9 +7233,13 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
     const caps = tool.capabilities ?? [];
     const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
     const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
-    const blocked = tool.permission === "deny" || isMcp || !hasAllowedCap;
+    const mcpProxyAllowed = this.allowedCapabilities.includes(ToolCapabilities.MCP_PROXY);
+    const dangerousNotAllowed = getDangerousCapabilities(tool).filter(
+      (c) => !this.allowedCapabilities.includes(c)
+    );
+    const blocked = tool.permission === "deny" || isMcp && !mcpProxyAllowed || !hasAllowedCap || dangerousNotAllowed.length > 0;
     if (blocked) {
-      const reason = isMcp ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow it explicitly` : tool.permission === "deny" ? "tool default deny" : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
+      const reason = isMcp && !mcpProxyAllowed ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow mcp.proxy explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
       return {
         permission: "deny",
         source: "subagent_guard",
@@ -6742,7 +7499,7 @@ var DefaultSkillLoader = class {
         const entries = await fsp2.readdir(dir, { withFileTypes: true });
         for (const e of entries) {
           if (!e.isDirectory()) continue;
-          const skillFile = path3.join(dir, e.name, "SKILL.md");
+          const skillFile = path4.join(dir, e.name, "SKILL.md");
           try {
             const raw = await fsp2.readFile(skillFile, "utf8");
             const meta = parseFrontmatter(raw);
@@ -6813,7 +7570,7 @@ var DefaultSkillLoader = class {
     if (cached !== void 0) return cached;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
-    const savePath = path3.join(path3.dirname(m.path), "SKILL.save.md");
+    const savePath = path4.join(path4.dirname(m.path), "SKILL.save.md");
     let result;
     try {
       result = await fsp2.readFile(savePath, "utf8");
@@ -7127,8 +7884,8 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
         });
         await Promise.race([
           drainPromise,
-          new Promise((resolve5) => {
-            drainTimer = setTimeout(resolve5, STREAM_DRAIN_TIMEOUT_MS);
+          new Promise((resolve6) => {
+            drainTimer = setTimeout(resolve6, STREAM_DRAIN_TIMEOUT_MS);
           })
         ]);
       } finally {
@@ -7234,26 +7991,29 @@ async function runProviderWithRetry(opts) {
           description
         });
       }
-      await new Promise((resolve5, reject) => {
+      await new Promise((resolve6, reject) => {
         let settled = false;
+        const cleanup = () => {
+          clearTimeout(t);
+          signal.removeEventListener("abort", onAbort);
+        };
         const onAbort = () => {
           if (settled) return;
           settled = true;
-          clearTimeout(t);
+          cleanup();
           reject(new Error("aborted"));
         };
         const t = setTimeout(() => {
           if (settled) return;
           settled = true;
-          clearTimeout(t);
-          signal.removeEventListener("abort", onAbort);
-          resolve5();
+          cleanup();
+          resolve6();
         }, delay);
         if (signal.aborted) {
           onAbort();
           return;
         }
-        signal.addEventListener("abort", onAbort, { once: true });
+        signal.addEventListener("abort", onAbort);
       });
       attempt++;
     }
@@ -7312,25 +8072,26 @@ function findPreserveStart(messages, preserveK) {
       preserveStart = i;
     }
   }
-  let forwardWalkIterations = 0;
-  let forwardWalkInnerIterations = 0;
-  for (let i = preserveStart; i < messages.length; i++) {
-    forwardWalkIterations++;
-    const m = messages[i];
-    if (!m || typeof m.content === "string" || !Array.isArray(m.content)) continue;
-    const hasToolUse3 = m.content.some((b) => {
-      forwardWalkInnerIterations++;
-      return b.type === "tool_use";
+  let pairRepairIterations = 0;
+  let pairRepairInnerIterations = 0;
+  while (preserveStart > 0) {
+    pairRepairIterations++;
+    const first = messages[preserveStart];
+    const prev = messages[preserveStart - 1];
+    if (!first || !prev || first.role !== "user" || prev.role !== "assistant") break;
+    if (typeof first.content === "string" || typeof prev.content === "string") break;
+    const resultIds = /* @__PURE__ */ new Set();
+    for (const block of first.content) {
+      pairRepairInnerIterations++;
+      if (block.type === "tool_result") resultIds.add(block.tool_use_id);
+    }
+    if (resultIds.size === 0) break;
+    const hasMatchingUse = prev.content.some((block) => {
+      pairRepairInnerIterations++;
+      return block.type === "tool_use" && resultIds.has(block.id);
     });
-    if (hasToolUse3 && i + 1 < messages.length) {
-      const next = messages[i + 1];
-      if (next && next.role === "user" && typeof next.content !== "string" && Array.isArray(next.content) && next.content.some((b) => {
-        forwardWalkInnerIterations++;
-        return b.type === "tool_result";
-      })) {
-        preserveStart = i + 1;
-      }
-    }
+    if (!hasMatchingUse) break;
+    preserveStart--;
   }
   if (compactionDebugEnabled()) {
     console.log(
@@ -7340,9 +8101,9 @@ function findPreserveStart(messages, preserveK) {
         messageCount: messages.length,
         preserveK,
         preserveStart,
-        forwardWalkIterations,
-        forwardWalkInnerIterations,
-        forwardWalkInnerPerOuter: forwardWalkIterations > 0 ? forwardWalkInnerIterations / forwardWalkIterations : 0
+        pairRepairIterations,
+        pairRepairInnerIterations,
+        pairRepairInnerPerOuter: pairRepairIterations > 0 ? pairRepairInnerIterations / pairRepairIterations : 0
       })
     );
   }
@@ -7359,7 +8120,8 @@ function eliseOldToolResults(messages, opts) {
     if (!msg || !Array.isArray(msg.content)) continue;
     for (const b of msg.content) {
       fastPathInnerIterations++;
-      if (b.type === "tool_result" && estimateToolResultTokens(b.content) >= opts.eliseThreshold) {
+      const oversized = b.type === "tool_result" && estimateToolResultTokens(b.content) >= opts.eliseThreshold || b.type === "tool_use" && estimateToolInputTokens(b.input) >= opts.eliseThreshold;
+      if (oversized) {
         hasOversized = true;
         break;
       }
@@ -7393,6 +8155,13 @@ function eliseOldToolResults(messages, opts) {
     }
     const original = msg.content;
     const newContent = original.map((b) => {
+      if (b.type === "tool_use") {
+        const tokens2 = estimateToolInputTokens(b.input);
+        if (tokens2 < opts.eliseThreshold) return b;
+        const elidedInput = summarizeToolUseInputElision(b, tokens2);
+        saved += Math.max(0, tokens2 - estimateToolInputTokens(elidedInput));
+        return { ...b, input: elidedInput };
+      }
       if (b.type !== "tool_result") return b;
       const tokens = estimateToolResultTokens(b.content);
       if (tokens < opts.eliseThreshold) return b;
@@ -7400,7 +8169,7 @@ function eliseOldToolResults(messages, opts) {
       const elided = {
         type: "tool_result",
         tool_use_id: b.tool_use_id,
-        content: `[elided: ~${tokens} tokens]`,
+        content: summarizeToolResultElision(b, tokens),
         is_error: b.is_error
       };
       return elided;
@@ -7440,6 +8209,65 @@ function eliseOldToolResults(messages, opts) {
   });
   return { messages: changed ? next : messages, saved, changed };
 }
+function summarizeToolUseInputElision(block, tokens) {
+  const fields = {};
+  for (const [key, value] of Object.entries(block.input ?? {})) {
+    fields[key] = summarizeToolUseInputValue(value);
+  }
+  return {
+    __elided_tool_input: `~${tokens} tokens; original arguments are in the session log`,
+    tool: block.name,
+    fields
+  };
+}
+function summarizeToolUseInputValue(value) {
+  if (value === null || value === void 0) return value;
+  if (typeof value === "number" || typeof value === "boolean") return value;
+  if (typeof value === "string") {
+    const oneLine = value.replace(/\s+/g, " ").trim();
+    return oneLine.length <= 160 ? oneLine : `${oneLine.slice(0, 120)}...(${oneLine.length} chars)`;
+  }
+  if (Array.isArray(value)) {
+    return `[array:${value.length}]`;
+  }
+  if (typeof value === "object") {
+    const keys = Object.keys(value);
+    return `[object:${keys.slice(0, 8).join(",")}${keys.length > 8 ? ",..." : ""}]`;
+  }
+  return String(value);
+}
+function summarizeToolResultElision(block, tokens) {
+  const parts = [`elided: ~${tokens} tokens`];
+  if (block.name) parts.push(`tool=${block.name}`);
+  const files = extractPathHints(block.content).slice(0, 5);
+  if (files.length > 0) parts.push(`files=${files.join(", ")}`);
+  const error = firstErrorLine(block.content);
+  if (error) parts.push(`error=${error}`);
+  return `[${parts.join("; ")}]`;
+}
+function extractPathHints(content) {
+  const text = typeof content === "string" ? content : JSON.stringify(content);
+  const out = /* @__PURE__ */ new Set();
+  const re = /(?:(?:[A-Za-z]:)?[./\\]?[\w@.-]+(?:[\\/][\w@(). -]+)+\.[A-Za-z0-9]{1,12})/g;
+  for (const match of text.matchAll(re)) {
+    const clean = match[0]?.replace(/\\/g, "/").replace(/^["'`]+|["'`),;:]+$/g, "");
+    if (clean && clean.length <= 220) out.add(clean);
+    if (out.size >= 5) break;
+  }
+  return [...out];
+}
+function firstErrorLine(content) {
+  const text = typeof content === "string" ? content : JSON.stringify(content);
+  for (const line of text.split(/\r?\n/)) {
+    if (!/\b(error|exception|failed|failure|fatal|panic|timeout|denied|enoent|eacces|eperm)\b/i.test(
+      line
+    ))
+      continue;
+    const trimmed = line.replace(/\s+/g, " ").trim();
+    if (trimmed) return trimmed.slice(0, 180);
+  }
+  return void 0;
+}
 function buildLosslessDigest(messages) {
   const lines = [];
   for (const m of messages) {
@@ -7550,15 +8378,15 @@ function buildSmartDigest(messages) {
     lines.push(`[${m.role}]: ${display}${marker}`);
   }
   if (noiseCount > 0) {
-    lines.push(`[system]: ${noiseCount} low-importance turn(s) collapsed (repeated failures / pure tool I/O)`);
+    lines.push(
+      `[system]: ${noiseCount} low-importance turn(s) collapsed (repeated failures / pure tool I/O)`
+    );
   }
   return lines.join("\n");
 }
 function countToolBlocks(m) {
   if (typeof m.content === "string") return 0;
-  return m.content.filter(
-    (b) => b.type === "tool_use" || b.type === "tool_result"
-  ).length;
+  return m.content.filter((b) => b.type === "tool_use" || b.type === "tool_result").length;
 }
 function firstSentence(text) {
   const trimmed = text.trim();
@@ -7627,10 +8455,12 @@ var HybridCompactor = class {
     if (elide.changed) ctx.state.replaceMessages(elide.messages);
     if (elide.saved > 0) reductions.push({ phase: "elision", saved: elide.saved });
     let collapsedDigest;
+    let evidenceDigest;
     if (opts.aggressive) {
       const phase2 = this.collapseAncientTurns(ctx, preserveK);
       if (phase2.saved > 0) reductions.push({ phase: "summary", saved: phase2.saved });
       collapsedDigest = phase2.digest;
+      evidenceDigest = phase2.evidenceDigest;
     }
     const repaired = repairToolUseAdjacency(ctx.messages);
     if (repaired.report.changed) {
@@ -7638,6 +8468,11 @@ var HybridCompactor = class {
     }
     const afterTokens = estimateMessages(ctx.messages);
     const afterFull = this.estimateFullRequest(ctx);
+    const quality = checkCompactionQuality(ctx, {
+      collapsedDigest,
+      evidenceDigest,
+      reduced: beforeTokens > afterTokens || beforeFull > afterFull
+    });
     return {
       before: beforeTokens,
       after: afterTokens,
@@ -7645,6 +8480,8 @@ var HybridCompactor = class {
       fullRequestTokensAfter: afterFull,
       reductions,
       collapsedDigest,
+      evidenceDigest,
+      quality,
       repaired: repaired.report.changed ? {
         removedToolUses: repaired.report.removedToolUses,
         removedToolResults: repaired.report.removedToolResults,
@@ -7686,7 +8523,13 @@ var HybridCompactor = class {
     if (boundary <= 0) return { saved: 0 };
     const removed = messages.slice(0, boundary);
     const removedTokens = estimateMessages(removed);
-    const digest = this.smart ? buildSmartDigest(removed) || `${removed.length} earlier turns (no textual content; tool I/O omitted \u2014 see session log)` : buildLosslessDigest(removed) || `${removed.length} earlier turns (no textual content; tool I/O omitted \u2014 see session log)`;
+    const historyDigest = this.smart ? buildSmartDigest(removed) || `${removed.length} earlier turns (no textual content; tool I/O omitted; see session log)` : buildLosslessDigest(removed) || `${removed.length} earlier turns (no textual content; tool I/O omitted; see session log)`;
+    const evidenceDigest = buildContextEvidenceDigest(ctx);
+    const digest = evidenceDigest ? `[context_state]
+${evidenceDigest}
+
+[prior_history]
+${historyDigest}` : historyDigest;
     const summaryMsg = {
       role: "system",
       content: `[prior_turns_digest: ${digest}]`
@@ -7695,10 +8538,29 @@ var HybridCompactor = class {
     ctx.state.replaceMessages([summaryMsg, ...tail]);
     return {
       saved: Math.max(0, removedTokens - estimateMessages([summaryMsg])),
-      digest
+      digest,
+      evidenceDigest: evidenceDigest || void 0
     };
   }
 };
+function checkCompactionQuality(ctx, opts) {
+  const evidence = ctx.contextEvidence;
+  const digest = `${opts.collapsedDigest ?? ""}
+${opts.evidenceDigest ?? ""}`;
+  const hasIntent = Boolean(evidence?.currentIntent?.text || /\b(intent|goal|session_goals)\b/i.test(digest));
+  const hasPathTrail = Boolean(
+    Object.keys(evidence?.fileGraph ?? {}).length > 0 || (evidence?.toolCalls.length ?? 0) > 0 || /\b(dependency_graph|tool_trail|files=)\b/i.test(digest)
+  );
+  const issues = [];
+  if (opts.reduced && !hasIntent) issues.push("missing intent anchor");
+  if (opts.reduced && !hasPathTrail) issues.push("missing tool/path trail");
+  return {
+    ok: issues.length === 0,
+    hasIntent,
+    hasPathTrail,
+    issues
+  };
+}
 function readContextWindowPolicy(ctx) {
   const policy = ctx.meta?.["contextWindowPolicy"];
   if (!policy || typeof policy !== "object") return null;
@@ -8057,10 +8919,10 @@ var SelectiveCompactor = class {
     this.maxContext = opts.maxContext ?? 128e3;
     this.preserveK = opts.preserveK ?? 4;
     this.eliseThreshold = opts.eliseThreshold ?? 500;
-    this.summarizerModel = opts.summarizerModel ?? opts.selectorModel ?? "unknown";
-    if (this.summarizerModel === "unknown" && (process.env["NODE_ENV"] === "development" || process.env["WRONGSTACK_DEBUG"] === "1")) {
+    this.summarizerModel = opts.summarizerModel ?? opts.selectorModel;
+    if (this.summarizerModel === void 0 && (process.env["NODE_ENV"] === "development" || process.env["WRONGSTACK_DEBUG"] === "1")) {
       console.warn(
-        "[SelectiveCompactor] summarizerModel not set \u2014 will use provider default. Set `summarizerModel` explicitly to silence this warning."
+        "[SelectiveCompactor] summarizerModel not set \u2014 will fall back to ctx.model at summarize time. Set `summarizerModel` explicitly to silence this warning."
       );
     }
     this.summarizerPrompt = opts.summarizerPrompt ?? "You are a context summarizer. Given a list of messages, produce a concise summary that preserves all factual information, decisions, file changes, and state changes. Do not add commentary or opinions.";
@@ -8168,7 +9030,7 @@ var SelectiveCompactor = class {
 Summarize the following message range:`;
     const body = messages.map((m, i) => `[${i}] ${m.role}: ${this.messagePreview(m)}`).join("\n");
     const req = {
-      model: this.summarizerModel,
+      model: this.summarizerModel ?? ctx.model,
       system: [{ type: "text", text: systemText }],
       messages: [{ role: "user", content: body }],
       maxTokens: 512
@@ -8235,27 +9097,16 @@ Summarize the following message range:`;
     if (typeof m.content === "string") return m.content.trim().length > 0;
     return m.content.some((b) => b.type === "text" && b.text.trim().length > 0);
   }
+  /**
+   * Estimate message-array tokens via the shared `estimateMessages` primitive
+   * so SelectiveCompactor's before/after/load figures agree with the
+   * middleware threshold math and the other compactors. Previously this used a
+   * private `ceil(len/3.5)` walk that diverged from the calibrated shared
+   * estimator, causing the selective `load`/`targetBudget` comparison to mix
+   * two incompatible token scales.
+   */
   estimateTokens(messages) {
-    let total = 0;
-    for (const m of messages) {
-      if (typeof m.content === "string") {
-        total += this.roughTokenEstimate(m.content);
-      } else {
-        for (const b of m.content) {
-          if (b.type === "text") total += this.roughTokenEstimate(b.text);
-          else if (b.type === "tool_use") total += this.roughTokenEstimate(JSON.stringify(b.input));
-          else if (b.type === "tool_result") {
-            total += this.roughTokenEstimate(
-              typeof b.content === "string" ? b.content : JSON.stringify(b.content)
-            );
-          }
-        }
-      }
-    }
-    return total;
-  }
-  roughTokenEstimate(text) {
-    return Math.max(1, Math.ceil(text.length / 3.5));
+    return estimateMessages(messages);
   }
 };
 
@@ -8446,15 +9297,20 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         this._cachedMsgCount = msgCount;
         this._cachedToolCount = toolCount;
       }
-      const load = tokens / this._maxContext;
+      const budget = computeContextWindowBudget(ctx, tokens, this._maxContext);
+      const load = budget.load;
       const policy = this.policyProvider?.(ctx);
       const thresholds = policy?.thresholds ?? {
         warn: this.warnThreshold,
         soft: this.softThreshold,
         hard: this.hardThreshold
       };
+      const repetition = repeatedReadPressure(ctx);
+      const adaptiveThresholds = adaptThresholdsForSignals(thresholds, {
+        repeatedReadCount: repetition
+      });
       const aggressiveOn = policy?.aggressiveOn ?? this.aggressiveOn;
-      const level = load >= thresholds.hard ? "hard" : load >= thresholds.soft ? "soft" : load >= thresholds.warn ? "warn" : null;
+      const level = load >= adaptiveThresholds.hard ? "hard" : load >= adaptiveThresholds.soft ? "soft" : load >= adaptiveThresholds.warn ? "warn" : null;
       if (!level) {
         this.lastNoopAttempt = null;
         return next(ctx);
@@ -8463,7 +9319,13 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         return next(ctx);
       }
       const aggressive = level === "hard" ? true : level === "soft" ? aggressiveOn !== "hard" : aggressiveOn === "warn";
-      await this.compact(ctx, aggressive, { level, tokens, load });
+      await this.compact(ctx, aggressive, {
+        level,
+        tokens,
+        load,
+        budget,
+        signals: { repeatedReadCount: repetition }
+      });
       return next(ctx);
     };
   }
@@ -8516,6 +9378,8 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         tokens: pressure.tokens,
         load: pressure.load,
         maxContext: this._maxContext,
+        budget: pressure.budget,
+        signals: pressure.signals,
         report,
         aggressive
       });
@@ -8527,6 +9391,8 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         level: pressure.level,
         aggressive,
         reductions: report.reductions?.map((r) => ({ phase: r.phase, saved: r.saved })),
+        budget: pressure.budget,
+        signals: pressure.signals,
         // Record what was collapsed so the audit trail shows the preserved
         // content, not just token counts. Bounded to keep the log line small;
         // the full original turns are already in the session JSONL.
@@ -8542,6 +9408,8 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         level: pressure.level,
         tokens: pressure.tokens,
         maxContext: this._maxContext,
+        budget: pressure.budget,
+        signals: pressure.signals,
         load: pressure.load,
         fatal
       });
@@ -8561,8 +9429,37 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
     }
   }
 };
-
-// src/execution/tool-executor.ts
+function computeContextWindowBudget(ctx, inputTokens, maxContext) {
+  const reservedOutputTokens = readPositiveMetaNumber(ctx, "contextOutputReserveTokens") ?? Math.floor(Math.min(8192, maxContext * 0.08));
+  const reservedSafetyTokens = readPositiveMetaNumber(ctx, "contextSafetyBufferTokens") ?? Math.floor(Math.min(4096, maxContext * 0.02));
+  const availableInputTokens = Math.max(
+    1,
+    maxContext - reservedOutputTokens - reservedSafetyTokens
+  );
+  const remainingInputTokens = availableInputTokens - inputTokens;
+  return {
+    maxContext,
+    inputTokens,
+    availableInputTokens,
+    remainingInputTokens,
+    reservedOutputTokens,
+    reservedSafetyTokens,
+    load: inputTokens / availableInputTokens,
+    overflowTokens: Math.max(0, -remainingInputTokens)
+  };
+}
+function readPositiveMetaNumber(ctx, key) {
+  const value = ctx.meta?.[key];
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : void 0;
+}
+function adaptThresholdsForSignals(thresholds, signals) {
+  if (signals.repeatedReadCount < 3) return thresholds;
+  return {
+    warn: Math.max(0.25, thresholds.warn - 0.08),
+    soft: Math.max(0.35, thresholds.soft - 0.04),
+    hard: thresholds.hard
+  };
+}
 var ToolExecutor = class _ToolExecutor {
   constructor(registry, opts) {
     this.registry = registry;
@@ -8659,7 +9556,8 @@ ${errorDetails}`,
       let effectivePermission = decision.permission;
       const policy = this.opts.permissionPolicy;
       const yolo = policy.getYolo?.() === true || policy.getYoloDestructive?.() === true;
-      if (toolDangerousCaps.length > 0 && effectivePermission === "auto" && !yolo) {
+      const authoritativeAuto = decision.source === "yolo";
+      if (toolDangerousCaps.length > 0 && effectivePermission === "auto" && !yolo && !authoritativeAuto) {
         effectivePermission = "confirm";
       }
       if (effectivePermission === "deny") {
@@ -8681,7 +9579,7 @@ ${errorDetails}`,
             return { result, tool, durationMs: Date.now() - start };
           }
         } else {
-          const suggestedPattern = this.subjectFor(tool.name, use.input, tool.subjectKey) ?? tool.name;
+          const suggestedPattern = subjectForToolInput(tool.name, use.input, tool.subjectKey) ?? tool.name;
           const pending = {
             type: "tool_confirm_pending",
             toolUseId: use.id,
@@ -8801,9 +9699,10 @@ ${post.additionalContext}`;
     });
     this.opts.renderer?.writeToolCall(tool.name, use.input);
     const output = await this.runWithTimeout(tool, use.input, ctx.signal, ctx, use.id);
-    const text = this.serializer.serialize(output);
+    const text = this.serializer.serialize(output, { toolName: tool.name, input: use.input });
     const scrubbed = this.opts.secretScrubber.scrub(text);
-    const { text: capped, newBudget } = this.serializer.enforceCap(scrubbed, budget);
+    const withArtifact = await maybePersistLargeToolOutput(tool.name, scrubbed, budget);
+    const { text: capped, newBudget } = this.serializer.enforceCap(withArtifact, budget);
     this.opts.renderer?.writeToolResult(tool.name, capped, false);
     return {
       block: {
@@ -8828,38 +9727,27 @@ ${post.additionalContext}`;
       tool.timeoutMs ?? this.iterationTimeoutMs,
       this.maxToolTimeoutMs
     );
-    const ctrl = new AbortController();
-    const timer = setTimeout(() => ctrl.abort(new Error("tool timeout")), timeoutMs);
-    const combined = AbortSignal.any([parentSignal, ctrl.signal]);
-    let cleanupCalled = false;
-    let caught = false;
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    const combined = AbortSignal.any([parentSignal, timeoutSignal]);
+    let output;
     try {
-      if (typeof tool.executeStream === "function") {
-        return await this.runStreamedTool(tool, input, ctx, combined, toolUseId);
-      }
-      return await tool.execute(input, ctx, { signal: combined });
+      output = typeof tool.executeStream === "function" ? await this.runStreamedTool(tool, input, ctx, combined, toolUseId) : await tool.execute(input, ctx, { signal: combined });
     } catch (err) {
-      caught = true;
-      if (combined.aborted && typeof tool.cleanup === "function") {
-        cleanupCalled = true;
-        try {
-          await tool.cleanup(input, ctx);
-        } catch {
-        }
-      }
+      if (combined.aborted) await this.runToolCleanup(tool, input, ctx);
       throw err;
-    } finally {
-      clearTimeout(timer);
-      if (combined.aborted && !caught) {
-        if (!cleanupCalled && typeof tool.cleanup === "function") {
-          try {
-            await tool.cleanup(input, ctx);
-          } catch {
-          }
-        }
-        const reason = combined.reason instanceof Error ? combined.reason : new Error(typeof combined.reason === "string" ? combined.reason : "aborted");
-        throw reason;
-      }
+    }
+    if (combined.aborted) {
+      await this.runToolCleanup(tool, input, ctx);
+      throw combined.reason instanceof Error ? combined.reason : new Error(typeof combined.reason === "string" ? combined.reason : "tool timeout");
+    }
+    return output;
+  }
+  /** Best-effort tool cleanup; never let it mask the original error. */
+  async runToolCleanup(tool, input, ctx) {
+    if (typeof tool.cleanup !== "function") return;
+    try {
+      await tool.cleanup(input, ctx);
+    } catch {
     }
   }
   async runStreamedTool(tool, input, ctx, signal, toolUseId) {
@@ -8970,38 +9858,6 @@ ${excerpt}`;
   budgetForString(content, budget) {
     return Math.max(0, budget - Buffer.byteLength(content, "utf8"));
   }
-  /**
-   * Compute the suggestedPattern string for a tool+input pair.
-   * Matches the logic in DefaultPermissionPolicy so the TUI shows the
-   * same subject that the trust file would use.
-   */
-  subjectFor(toolName, input, subjectKey) {
-    if (!input || typeof input !== "object") return void 0;
-    const obj = input;
-    const globChars = /[*?[\]]/g;
-    const escapeGlob = (s) => s.replace(globChars, (c) => `\\${c}`);
-    const normalizePath = (s) => escapeGlob(s.replace(/\\/g, "/"));
-    if (subjectKey) {
-      const v = obj[subjectKey];
-      if (typeof v === "string") {
-        const isPathKey = subjectKey === "path" || subjectKey === "file" || subjectKey === "files";
-        return isPathKey ? normalizePath(v) : escapeGlob(v);
-      }
-    }
-    if (toolName === "bash" && typeof obj.command === "string") {
-      return escapeGlob(obj.command);
-    }
-    if (typeof obj.path === "string") {
-      return normalizePath(obj.path);
-    }
-    if (typeof obj.url === "string") {
-      return escapeGlob(obj.url);
-    }
-    if (typeof obj.name === "string") {
-      return escapeGlob(obj.name);
-    }
-    return void 0;
-  }
 };
 function clampTimeoutMs(timeoutMs, maxTimeoutMs) {
   const fallback = 3e5;
@@ -9028,6 +9884,25 @@ function extractMalformedRaw(input) {
     return String(value);
   }
 }
+var TOOL_OUTPUT_ARTIFACT_THRESHOLD_BYTES = 64 * 1024;
+async function maybePersistLargeToolOutput(toolName, content, budget) {
+  const bytes = Buffer.byteLength(content, "utf8");
+  if (bytes <= Math.min(TOOL_OUTPUT_ARTIFACT_THRESHOLD_BYTES, Math.max(0, budget))) {
+    return content;
+  }
+  try {
+    const dir = path4.join(wstackGlobalRoot(), "tool-output");
+    await fsp2.mkdir(dir, { recursive: true });
+    const safeTool = toolName.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    const filePath = path4.join(dir, `${stamp}-${safeTool}-${randomUUID()}.log`);
+    await fsp2.writeFile(filePath, content, "utf8");
+    return content + `
+[full tool output: ${bytes} bytes at ${filePath}; read/grep that file selectively instead of re-running or requesting more output]`;
+  } catch {
+    return content;
+  }
+}
 
 // src/execution/autonomous-runner.ts
 var DoneConditionChecker = class {
@@ -10339,13 +11214,13 @@ var SubagentBudget = class _SubagentBudget {
     if (!bus || !bus.hasListenerFor("budget.threshold_reached")) {
       return Promise.resolve("stop");
     }
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       let resolved = false;
       const respond = (d) => {
         if (resolved) return;
         resolved = true;
         clearTimeout(fallback);
-        resolve5(d);
+        resolve6(d);
       };
       const fallback = setTimeout(() => respond("stop"), _SubagentBudget.DECISION_TIMEOUT_MS);
       bus.emit("budget.threshold_reached", {
@@ -12808,7 +13683,27 @@ Working rules:
       id: "devops",
       name: "DevOps",
       role: "devops",
-      tools: [...TOOLS.build],
+      tools: [
+        ...TOOLS.build,
+        "mcp__ssh__ssh_list_servers",
+        "mcp__ssh__ssh_connection_status",
+        "mcp__ssh__ssh_execute",
+        "mcp__ssh__ssh_execute_sudo",
+        "mcp__ssh__ssh_upload",
+        "mcp__ssh__ssh_download",
+        "mcp__ssh__ssh_sync",
+        "mcp__ssh__ssh_deploy",
+        "mcp__ssh__ssh_health_check",
+        "mcp__ssh__ssh_service_status",
+        "mcp__ssh__ssh_process_manager",
+        "mcp__ssh__ssh_tunnel",
+        "mcp__ssh__ssh_backup_create",
+        "mcp__ssh__ssh_backup_list",
+        "mcp__ssh__ssh_backup_restore",
+        "mcp__ssh__ssh_db_list",
+        "mcp__ssh__ssh_db_query",
+        "mcp__ssh__ssh_profile"
+      ],
       prompt: `You are the DevOps agent. Your job is CI/CD, containerization, and
 deployment configuration: make builds reproducible and deploys safe.
 
@@ -12817,6 +13712,7 @@ Scope:
 - Write Dockerfiles/compose and optimize image size and layer caching
 - Configure deployment (env, secrets handling, health checks, rollback)
 - Diagnose flaky/broken pipelines
+- Use optional SSH MCP tools for remote hosts when the 'ssh' MCP server is enabled: list servers, run health checks, inspect services, transfer/deploy files, and open tunnels
 
 Input format you accept:
 { "task": "ci | container | deploy | fix-pipeline", "platform": "github-actions | gitlab | docker | k8s", "target": "<what>" }
@@ -12831,7 +13727,8 @@ Working rules:
 - Never hardcode secrets in config; reference the secret store
 - Pin versions for reproducible builds; avoid floating :latest
 - Every deploy path needs a rollback and a health check
-- Treat CI/CD changes as high-risk \u2014 explain blast radius before applying`
+- Treat CI/CD changes as high-risk \u2014 explain blast radius before applying
+- For remote SSH work, start with ssh_list_servers / ssh_connection_status, prefer read-only checks first, and do not run destructive commands without explicit user approval`
     },
     budget: MEDIUM_BUDGET,
     capability: {
@@ -12848,6 +13745,13 @@ Working rules:
         "kubernetes",
         "k8s",
         "deploy",
+        "ssh",
+        "remote ssh",
+        "remote server",
+        "sftp",
+        "tunnel",
+        "bastion",
+        "jump host",
         "github actions",
         "container"
       ]
@@ -14156,7 +15060,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       taskIds.map((id) => {
         const cached = this.completedResults.find((r) => r.taskId === id);
         if (cached) return cached;
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           const timeout = setTimeout(() => {
             this.off("task.completed", handler);
             reject(new Error(`awaitTasks timed out waiting for task "${id}"`));
@@ -14165,7 +15069,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
             if (result.taskId === id) {
               clearTimeout(timeout);
               this.off("task.completed", handler);
-              resolve5(result);
+              resolve6(result);
             }
           };
           this.on("task.completed", handler);
@@ -14433,12 +15337,12 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
             }
             return new Promise((resolveDecision) => {
               let settled = false;
-              const resolve5 = (d) => {
+              const resolve6 = (d) => {
                 if (settled) return;
                 settled = true;
                 resolveDecision(d);
               };
-              const fallback = setTimeout(() => resolve5("stop"), DECISION_TIMEOUT_MS);
+              const fallback = setTimeout(() => resolve6("stop"), DECISION_TIMEOUT_MS);
               budget._events?.emit("budget.threshold_reached", {
                 kind: "timeout",
                 used,
@@ -14454,11 +15358,11 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
                 // disagreeing, resolves as a stop). Async grants still resolve.
                 extend: (extra) => {
                   clearTimeout(fallback);
-                  queueMicrotask(() => resolve5({ extend: extra }));
+                  queueMicrotask(() => resolve6({ extend: extra }));
                 },
                 deny: () => {
                   clearTimeout(fallback);
-                  resolve5("stop");
+                  resolve6("stop");
                 }
               });
             });
@@ -14619,6 +15523,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
         subagentId: result.subagentId,
         taskId: result.taskId,
         status: result.status,
+        result: result.result,
         iterations: result.iterations,
         toolCalls: result.toolCalls,
         durationMs: result.durationMs
@@ -15346,7 +16251,7 @@ var InMemoryAgentBridge = class {
       });
     }
     this.inflightGuards.add(correlationId);
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const timer = setTimeout(() => {
         this.inflightGuards.delete(correlationId);
         this.pendingRequests.delete(correlationId);
@@ -15365,7 +16270,7 @@ var InMemoryAgentBridge = class {
         return;
       }
       this.pendingRequests.set(correlationId, {
-        resolve: resolve5,
+        resolve: resolve6,
         reject,
         timer
       });
@@ -16037,6 +16942,24 @@ Working rules:
 var DEFAULT_SUBAGENT_BASELINE = `You are a subagent operating under a Director. You were spawned to handle
 a specific slice of a larger plan \u2014 do that slice well and report back.
 
+Capabilities & operating rules:
+  - You have full developer tools for your task: read, write/edit, search,
+    shell + build (lint, format, typecheck, test), and dependency install.
+    Use them directly to finish the task end-to-end. You run non-interactively
+    \u2014 there is no human to approve individual tool calls, so routine work is
+    pre-authorized; do not stop to ask for permission to read, edit, or build.
+  - Stay inside the project root. Do not write files outside the repository,
+    and do not touch machine config, credentials, or global state \u2014 those
+    require an explicit grant you do not have.
+  - Prefer the least-destructive path. Do not run irreversible or destructive
+    commands (e.g. \`rm -rf\`, \`git push --force\`, history rewrites, dropping
+    databases, mass deletes) unless the task explicitly requires it and names
+    the target.
+  - When you change code, verify it: run the relevant build / typecheck / tests
+    and fix what you broke before reporting done.
+  - Make only the changes the task calls for \u2014 don't refactor or reformat
+    unrelated code.
+
 Bridge contract:
   - You have a parent (the Director). You may call \`request\` on the
     parent bridge to ask a clarifying question. Use this sparingly; the
@@ -16994,6 +17917,8 @@ var Director = class _Director {
   sessionsRoot;
   /** Director run id for JSONL path resolution. */
   directorRunId;
+  /** Optional logger for structured logging. Falls back to noop when omitted. */
+  logger;
   /** Resolves task descriptions back from `assign()` so completion events
    *  can also carry a human-readable title. */
   taskDescriptions = /* @__PURE__ */ new Map();
@@ -17082,6 +18007,7 @@ var Director = class _Director {
       opts.checkpointDebounceMs ?? 250
     ) : null;
     this.fleetManager = opts.fleetManager;
+    this.logger = opts.logger;
     if (this.sharedScratchpadPath) {
       void fsp2.mkdir(this.sharedScratchpadPath, { recursive: true }).catch((err) => this.logShutdownError("shared_scratchpad_mkdir", err));
     }
@@ -17381,7 +18307,10 @@ var Director = class _Director {
     entry.session.cancel(reason);
     for (const [_role, subagentId] of entry.session.getSubagentIds()) {
       this.coordinator.stop(subagentId).catch((err) => {
-        console.debug(`[director] stop subagent ${subagentId} failed (may have already completed): ${err}`);
+        this.logger?.debug(`stop subagent ${subagentId} failed (may have already completed)`, {
+          subagentId,
+          err: err instanceof Error ? err.message : String(err)
+        });
       });
     }
   }
@@ -17441,7 +18370,7 @@ var Director = class _Director {
    * Caller-supplied `priceLookup` is optional but recommended — without
    * it the `cost` column in `usage.snapshot()` stays at 0.
    */
-  async spawn(config, priceLookup) {
+  async spawn(callerConfig, priceLookup) {
     if (this.workCompleteFlag) {
       throw new FleetSpawnBudgetError(
         "max_spawns",
@@ -17450,6 +18379,7 @@ var Director = class _Director {
         "workComplete() has been called \u2014 director closed further spawning"
       );
     }
+    const config = { ...callerConfig };
     if (!config.model && this.modelMatrix) {
       const matrix = typeof this.modelMatrix === "function" ? this.modelMatrix() : this.modelMatrix;
       const entry = resolveModelMatrix(matrix, config.role);
@@ -17675,7 +18605,7 @@ var Director = class _Director {
       })),
       usage: this.usage.snapshot()
     };
-    await fsp2.mkdir(path3.dirname(this.manifestPath), { recursive: true });
+    await fsp2.mkdir(path4.dirname(this.manifestPath), { recursive: true });
     await atomicWrite(this.manifestPath, JSON.stringify(manifest, null, 2), { mode: 384 });
     return this.manifestPath;
   }
@@ -17802,11 +18732,11 @@ var Director = class _Director {
         if (cached) return cached;
         const existing = this.taskWaiters.get(id);
         if (existing) return existing.promise;
-        let resolve5;
+        let resolve6;
         const promise = new Promise((res) => {
-          resolve5 = res;
+          resolve6 = res;
         });
-        this.taskWaiters.set(id, { promise, resolve: resolve5 });
+        this.taskWaiters.set(id, { promise, resolve: resolve6 });
         return promise;
       })
     );
@@ -17889,7 +18819,7 @@ var Director = class _Director {
    */
   async readSession(subagentId, tail) {
     if (!this.sessionsRoot) return null;
-    const filePath = path3.join(this.sessionsRoot, this.directorRunId, `${subagentId}.jsonl`);
+    const filePath = path4.join(this.sessionsRoot, this.directorRunId, `${subagentId}.jsonl`);
     let raw;
     try {
       raw = await fsp2.readFile(filePath, "utf8");
@@ -18202,7 +19132,7 @@ function createDelegateTool(opts) {
           subagentId
         });
         const dir = director;
-        const result = await new Promise((resolve5) => {
+        const result = await new Promise((resolve6) => {
           let settled = false;
           let timer;
           const finish = (value) => {
@@ -18212,7 +19142,7 @@ function createDelegateTool(opts) {
             offTool();
             offIter();
             offProgress();
-            resolve5(value);
+            resolve6(value);
           };
           const arm = () => {
             if (timer) clearTimeout(timer);
@@ -18419,13 +19349,13 @@ async function readSubagentPartial(opts, subagentId) {
   if (!opts.sessionsRoot) return void 0;
   const candidates = [];
   if (opts.directorRunId) {
-    candidates.push(path3.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
+    candidates.push(path4.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
   } else {
     try {
       const entries = await fsp2.readdir(opts.sessionsRoot, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
-          candidates.push(path3.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
+          candidates.push(path4.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
         }
       }
     } catch {
@@ -18475,9 +19405,9 @@ function makeDirectorSessionFactory(opts) {
   let dir;
   if (opts.store) {
     store = opts.store;
-    dir = opts.sessionsRoot ? path3.join(opts.sessionsRoot, runId) : "(caller-managed)";
+    dir = opts.sessionsRoot ? path4.join(opts.sessionsRoot, runId) : "(caller-managed)";
   } else if (opts.sessionsRoot) {
-    dir = path3.join(opts.sessionsRoot, runId);
+    dir = path4.join(opts.sessionsRoot, runId);
     store = new DefaultSessionStore({ dir });
   } else {
     throw new Error("makeDirectorSessionFactory requires either `store` or `sessionsRoot`");
@@ -18627,7 +19557,7 @@ var DefaultModelsRegistry = class {
     this.overlay = opts.overlay;
     this.overlayUrl = opts.overlayUrl;
     this.overlayFile = opts.overlayFile;
-    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path3.join(path3.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
+    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path4.join(path4.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
   }
   async load(opts = {}) {
     if (this.payload && !opts.force) return this.payload;
@@ -18786,10 +19716,11 @@ var DefaultModelsRegistry = class {
       capabilities: {
         tools: model.tool_call ?? false,
         vision: Boolean(model.modalities?.input?.includes("image")),
-        reasoning: model.reasoning ?? false,
+        reasoning: model.reasoning ?? model.reasoningConfig !== void 0,
         maxContext: model.limit?.context ?? 0,
         maxOutput: model.limit?.output,
-        knowledge: model.knowledge
+        knowledge: model.knowledge,
+        reasoningConfig: model.reasoningConfig
       },
       cost: model.cost
     };
@@ -18840,7 +19771,7 @@ var DefaultModelsRegistry = class {
   }
   /** Used by `wstack models refresh` to expose where the cache lives. */
   cacheLocation() {
-    return path3.resolve(this.cacheFile);
+    return path4.resolve(this.cacheFile);
   }
 };
 function hasEntries(payload) {
@@ -19207,7 +20138,7 @@ var DefaultModeStore = class {
   }
   async loadActiveMode() {
     try {
-      const configPath = path3.join(this.configDir, "mode.json");
+      const configPath = path4.join(this.configDir, "mode.json");
       const content = await fsp2.readFile(configPath, "utf8");
       const data = JSON.parse(content);
       this.activeModeId = data.activeMode ?? null;
@@ -19218,7 +20149,7 @@ var DefaultModeStore = class {
   async saveActiveMode() {
     try {
       await fsp2.mkdir(this.configDir, { recursive: true });
-      const configPath = path3.join(this.configDir, "mode.json");
+      const configPath = path4.join(this.configDir, "mode.json");
       await atomicWrite(
         configPath,
         JSON.stringify({ activeMode: this.activeModeId }, null, 2)
@@ -19233,11 +20164,11 @@ async function loadProjectModes(modesDir) {
     const entries = await fsp2.readdir(modesDir);
     for (const entry of entries) {
       if (!entry.endsWith(".md") && !entry.endsWith(".txt")) continue;
-      const filePath = path3.join(modesDir, entry);
+      const filePath = path4.join(modesDir, entry);
       const stat6 = await fsp2.stat(filePath);
       if (!stat6.isFile()) continue;
       const content = await fsp2.readFile(filePath, "utf8");
-      const id = path3.basename(entry, path3.extname(entry));
+      const id = path4.basename(entry, path4.extname(entry));
       modes.push({
         id,
         name: id.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()),
@@ -19253,7 +20184,7 @@ async function loadProjectModes(modesDir) {
 async function loadUserModes(modesDir) {
   const modes = [];
   try {
-    const manifestPath = path3.join(modesDir, "modes.json");
+    const manifestPath = path4.join(modesDir, "modes.json");
     const content = await fsp2.readFile(manifestPath, "utf8");
     const manifest = JSON.parse(content);
     for (const mode of manifest.modes) {
@@ -19264,6 +20195,35 @@ async function loadUserModes(modesDir) {
   return modes;
 }
 
+// src/models/provider-model-resolve.ts
+function describeCatalogModel(m) {
+  return {
+    id: m.id,
+    name: m.name,
+    releaseDate: m.release_date,
+    contextWindow: m.limit?.context,
+    inputCost: m.cost?.input,
+    outputCost: m.cost?.output,
+    capabilities: [
+      ...m.tool_call ? ["tools"] : [],
+      ...m.reasoning ? ["reasoning"] : [],
+      ...m.modalities?.input?.includes("image") ? ["vision"] : [],
+      ...m.open_weights ? ["open_weights"] : []
+    ]
+  };
+}
+function resolveProviderModelList(savedModels, catalog) {
+  if (savedModels && savedModels.length > 0) {
+    const byId = new Map((catalog?.models ?? []).map((m) => [m.id, m]));
+    return savedModels.map((id) => {
+      const hit = byId.get(id);
+      return hit ? describeCatalogModel(hit) : { id, name: id, capabilities: [] };
+    });
+  }
+  if (catalog) return catalog.models.map(describeCatalogModel);
+  return [];
+}
+
 // src/sdd/spec-parser.ts
 var SpecParser = class {
   parse(content) {
@@ -20205,7 +21165,7 @@ var SpecStore = class {
   indexPath;
   constructor(opts) {
     this.baseDir = opts.baseDir;
-    this.indexPath = path3.join(this.baseDir, "_index.json");
+    this.indexPath = path4.join(this.baseDir, "_index.json");
   }
   async save(spec) {
     await ensureDir(this.baseDir);
@@ -20274,7 +21234,7 @@ var SpecStore = class {
     return updated;
   }
   filePath(id) {
-    return path3.join(this.baseDir, `${id}.json`);
+    return path4.join(this.baseDir, `${id}.json`);
   }
   async readIndex() {
     try {
@@ -20331,7 +21291,7 @@ var TaskGraphStore = class {
   indexPath;
   constructor(opts) {
     this.baseDir = opts.baseDir;
-    this.indexPath = path3.join(this.baseDir, "_index.json");
+    this.indexPath = path4.join(this.baseDir, "_index.json");
   }
   async save(graph) {
     await ensureDir(this.baseDir);
@@ -20369,7 +21329,7 @@ var TaskGraphStore = class {
     }
   }
   filePath(id) {
-    return path3.join(this.baseDir, `${id}.json`);
+    return path4.join(this.baseDir, `${id}.json`);
   }
   async readIndex() {
     try {
@@ -20614,9 +21574,9 @@ var AISpecBuilder = class {
     if (!this.sessionPath) return;
     try {
       const fsp16 = await import('fs/promises');
-      const path19 = await import('path');
+      const path21 = await import('path');
       const { atomicWrite: atomicWrite2 } = await Promise.resolve().then(() => (init_atomic_write(), atomic_write_exports));
-      await fsp16.mkdir(path19.dirname(this.sessionPath), { recursive: true });
+      await fsp16.mkdir(path21.dirname(this.sessionPath), { recursive: true });
       await atomicWrite2(this.sessionPath, JSON.stringify(this.session, null, 2));
     } catch {
     }
@@ -21343,15 +22303,15 @@ function computeCriticalPath(graph, _topoOrder, blockedByMap) {
       maxId = id;
     }
   }
-  const path19 = [];
+  const path21 = [];
   let current = maxId;
   const visited = /* @__PURE__ */ new Set();
   while (current && !visited.has(current)) {
     visited.add(current);
-    path19.unshift(current);
+    path21.unshift(current);
     current = prev.get(current) ?? null;
   }
-  return path19;
+  return path21;
 }
 function computeParallelGroups(graph, blockedByMap) {
   const groups = [];
@@ -22174,9 +23134,9 @@ var DefaultHealthRegistry = class {
   }
   async runOne(check) {
     let timer = null;
-    const timeout = new Promise((resolve5) => {
+    const timeout = new Promise((resolve6) => {
       timer = setTimeout(
-        () => resolve5({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
+        () => resolve6({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
         this.timeoutMs
       );
     });
@@ -22359,7 +23319,7 @@ async function startMetricsServer(opts) {
   const tls = opts.tls;
   const useHttps = !!(tls?.cert && tls?.key);
   const host = opts.host ?? "127.0.0.1";
-  const path19 = opts.path ?? "/metrics";
+  const path21 = opts.path ?? "/metrics";
   const healthPath = opts.healthPath ?? "/healthz";
   const healthRegistry = opts.healthRegistry;
   const listener = (req, res) => {
@@ -22369,7 +23329,7 @@ async function startMetricsServer(opts) {
       return;
     }
     const url = req.url.split("?")[0];
-    if (url === path19) {
+    if (url === path21) {
       let body;
       try {
         body = renderPrometheus(opts.sink.snapshot());
@@ -22415,14 +23375,14 @@ async function startMetricsServer(opts) {
     const { createServer } = await import('http');
     server = createServer(listener);
   }
-  await new Promise((resolve5, reject) => {
+  await new Promise((resolve6, reject) => {
     const onError = (err) => {
       server.off("listening", onListening);
       reject(err);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve5();
+      resolve6();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -22433,9 +23393,9 @@ async function startMetricsServer(opts) {
   const protocol = useHttps ? "https" : "http";
   return {
     port: boundPort,
-    url: `${protocol}://${host}:${boundPort}${path19}`,
-    close: () => new Promise((resolve5, reject) => {
-      server.close((err) => err ? reject(err) : resolve5());
+    url: `${protocol}://${host}:${boundPort}${path21}`,
+    close: () => new Promise((resolve6, reject) => {
+      server.close((err) => err ? reject(err) : resolve6());
     })
   };
 }
@@ -23077,6 +24037,19 @@ var miniMaxVisionServer = () => ({
   allowedTools: ["understand_image"],
   permission: "auto"
 });
+var sshManagerServer = () => ({
+  name: "ssh",
+  description: "Remote SSH management \u2014 execute commands, transfer files, tunnels, health checks (mcp-ssh-manager)",
+  transport: "stdio",
+  command: "npx",
+  args: ["-y", "mcp-ssh-manager"],
+  env: {
+    MCP_SSH_COMPACT_JSON: "true",
+    MCP_SSH_DEFAULT_TIMEOUT: "120000"
+  },
+  permission: "confirm",
+  requestTimeoutMs: 18e4
+});
 var allServers = () => ({
   filesystem: { ...filesystemServer(), enabled: false },
   github: { ...githubServer(), enabled: false },
@@ -23090,9 +24063,10 @@ var allServers = () => ({
   sentinel: { ...sentinelServer(), enabled: false },
   "zai-vision": { ...zaiVisionServer(), enabled: false },
   "minimax-vision": { ...miniMaxVisionServer(), enabled: false },
-  playwright: { ...playwrightServer(), enabled: false }
+  playwright: { ...playwrightServer(), enabled: false },
+  ssh: { ...sshManagerServer(), enabled: false }
 });
 
-export { AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigMigrationError, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorStateCheckpoint, DoneConditionChecker, EternalAutonomyEngine, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FleetBus, FleetSpawnBudgetError, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, SddParallelRun, SddTaskDecomposer, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, ToolExecutor, addPlanItem, allServers, analyzeCriticalPath, applyRosterBudget, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, clearPlan, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createAutoExecutor, createContextManagerTool, createDelegateTool, createMessage, createSessionEventBridge, createStrategyCompactor, decryptConfigSecrets, deriveTodosFromPlanItem, dispatchAgent, emptyPlan, encryptConfigSecrets, everArtServer, filesystemServer, formatPlan, formatPlanTemplates, getAgentDefinition, getPlanTemplate, getTemplate, githubServer, googleMapsServer, listPlanTemplates, listTemplates, loadDirectorState, loadPlan, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeRollUpTool, makeSpawnTool, makeTerminateTool, migratePlaintextSecrets, miniMaxVisionServer, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, resolveAuditLevel, resolveSessionLoggingConfig, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, savePlan, saveTodosCheckpoint, scoreAgents, sentinelServer, setPlanItemStatus, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, templateToMarkdown, wireMetricsToEvents, zaiVisionServer };
+export { AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigMigrationError, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorStateCheckpoint, DoneConditionChecker, EternalAutonomyEngine, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FleetBus, FleetSpawnBudgetError, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, SddParallelRun, SddTaskDecomposer, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, ToolExecutor, addPlanItem, allServers, analyzeCriticalPath, applyRosterBudget, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, clearPlan, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createAutoExecutor, createContextManagerTool, createDelegateTool, createMessage, createSessionEventBridge, createStrategyCompactor, decryptConfigSecrets, deriveTodosFromPlanItem, describeCatalogModel, dispatchAgent, emptyPlan, encryptConfigSecrets, everArtServer, filesystemServer, formatPlan, formatPlanTemplates, getAgentDefinition, getPlanTemplate, getTemplate, githubServer, googleMapsServer, listPlanTemplates, listTemplates, loadDirectorState, loadPlan, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeRollUpTool, makeSpawnTool, makeTerminateTool, migratePlaintextSecrets, miniMaxVisionServer, playwrightServer, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, resolveAuditLevel, resolveProviderModelList, resolveSessionLoggingConfig, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, savePlan, saveTodosCheckpoint, scoreAgents, sentinelServer, setPlanItemStatus, slackServer, sshManagerServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, templateToMarkdown, wireMetricsToEvents, zaiVisionServer };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map