@wrongstack/core 0.275.1 → 0.276.3

package/dist/defaults/index.js

@@ -2,11 +2,11 @@ import * as crypto2 from 'crypto';
 import { randomBytes, randomUUID, createCipheriv, createDecipheriv, createHash, scryptSync } from 'crypto';
 import * as fsp7 from 'fs/promises';
 import { readFile, writeFile, mkdir } from 'fs/promises';
-import * as path3 from 'path';
+import * as path4 from 'path';
 import { isAbsolute, join, resolve, sep } from 'path';
 import * as os from 'os';
 import { hostname } from 'os';
-import * as fs11 from 'fs';
+import * as fs12 from 'fs';
 import { readFileSync, statSync, createReadStream, existsSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { EventEmitter } from 'events';
@@ -29,6 +29,19 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/utils/assert-never.ts
+function assertNever(x, message) {
+  const err = new Error(
+    `Unhandled case: ${JSON.stringify(x)}`
+  );
+  err.name = "AssertNeverError";
+  throw err;
+}
+var init_assert_never = __esm({
+  "src/utils/assert-never.ts"() {
+  }
+});
+
 // src/utils/atomic-write.ts
 var atomic_write_exports = {};
 __export(atomic_write_exports, {
@@ -37,9 +50,9 @@ __export(atomic_write_exports, {
   withFileLock: () => withFileLock
 });
 async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path3.dirname(targetPath);
+  const dir = path4.dirname(targetPath);
   await fsp7.mkdir(dir, { recursive: true });
-  const tmp = path3.join(dir, `.${path3.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const tmp = path4.join(dir, `.${path4.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
       await fsp7.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
@@ -57,8 +70,8 @@ async function atomicWrite(targetPath, content, opts = {}) {
     }
     let mode;
     try {
-      const stat9 = await fsp7.stat(targetPath);
-      mode = stat9.mode & 511;
+      const stat10 = await fsp7.stat(targetPath);
+      mode = stat10.mode & 511;
     } catch {
       mode = opts.mode;
     }
@@ -84,9 +97,9 @@ async function ensureDir(dir) {
   await fsp7.mkdir(dir, { recursive: true });
 }
 async function withFileLock(targetPath, fn, opts = {}) {
-  const dir = path3.dirname(targetPath);
+  const dir = path4.dirname(targetPath);
   await fsp7.mkdir(dir, { recursive: true });
-  const lockPath = path3.join(dir, `.${path3.basename(targetPath)}.lock`);
+  const lockPath = path4.join(dir, `.${path4.basename(targetPath)}.lock`);
   const timeoutMs = opts.timeoutMs ?? 5e3;
   const staleMs = opts.staleMs ?? 3e4;
   const started = Date.now();
@@ -104,8 +117,8 @@ async function withFileLock(targetPath, fn, opts = {}) {
       }
       if (code !== "EEXIST") throw err;
       try {
-        const stat9 = await fsp7.stat(lockPath);
-        if (Date.now() - stat9.mtimeMs > staleMs) {
+        const stat10 = await fsp7.stat(lockPath);
+        if (Date.now() - stat10.mtimeMs > staleMs) {
           await fsp7.unlink(lockPath);
           continue;
         }
@@ -113,9 +126,14 @@ async function withFileLock(targetPath, fn, opts = {}) {
         continue;
       }
       if (Date.now() - started >= timeoutMs) {
-        throw new Error(`Timed out waiting for file lock: ${targetPath}`);
+        throw new FsError({
+          message: `Timed out waiting for file lock: ${targetPath}`,
+          code: "FS_ATOMIC_WRITE_FAILED",
+          path: targetPath,
+          context: { timeoutMs }
+        });
       }
-      await new Promise((resolve11) => setTimeout(resolve11, 25));
+      await new Promise((resolve12) => setTimeout(resolve12, 25));
     }
   }
   try {
@@ -148,7 +166,7 @@ async function renameWithRetry(from, to) {
       if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
         throw err;
       }
-      await new Promise((resolve11) => setTimeout(resolve11, delays[i]));
+      await new Promise((resolve12) => setTimeout(resolve12, delays[i]));
     }
   }
   throw lastErr;
@@ -156,64 +174,12 @@ async function renameWithRetry(from, to) {
 var TRANSIENT_RENAME_CODES;
 var init_atomic_write = __esm({
   "src/utils/atomic-write.ts"() {
+    init_errors();
     TRANSIENT_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES", "ENOTEMPTY"]);
   }
 });
 
-// src/utils/assert-never.ts
-function assertNever(x, message) {
-  const err = new Error(
-    `Unhandled case: ${JSON.stringify(x)}`
-  );
-  err.name = "AssertNeverError";
-  throw err;
-}
-
-// src/utils/index.ts
-init_atomic_write();
-
 // src/utils/child-env.ts
-var ALLOWED_KEYS = /* @__PURE__ */ new Set([
-  "PATH",
-  "HOME",
-  "USER",
-  "USERNAME",
-  "LOGNAME",
-  "SHELL",
-  "LANG",
-  "LC_ALL",
-  "LC_CTYPE",
-  "TERM",
-  "TZ",
-  "TMPDIR",
-  "TEMP",
-  "TMP",
-  "PWD",
-  "OLDPWD",
-  "COMSPEC",
-  "SYSTEMROOT",
-  "SYSTEMDRIVE",
-  "WINDIR",
-  "PROGRAMFILES",
-  "PROGRAMFILES(X86)",
-  "PROGRAMDATA",
-  "APPDATA",
-  "LOCALAPPDATA",
-  "USERPROFILE",
-  "PUBLIC",
-  "PATHEXT"
-]);
-var SECRET_NAME_PARTS = [
-  "TOKEN",
-  "SECRET",
-  "PASSWORD",
-  "PASSWD",
-  "AUTH",
-  "CRED",
-  "BEARER",
-  "COOKIE",
-  "PRIVATE"
-];
 function looksSecret(name) {
   const upper = name.toUpperCase();
   for (const p of SECRET_NAME_PARTS) {
@@ -230,8 +196,6 @@ function looksSecret(name) {
 function valueHasEmbeddedCredential(value) {
   return /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:@]*:[^/\s@]+@/i.test(value);
 }
-var NODE_OPTIONS_INJECTION_FLAG = /^(?:--require|-r|--import|--loader|--experimental-loader)$/;
-var NODE_OPTIONS_INJECTION_FLAG_EQ = /^(?:--require|-r|--import|--loader|--experimental-loader)=/;
 function sanitizeNodeOptions(value) {
   const tokens = value.split(/\s+/).filter(Boolean);
   const kept = [];
@@ -291,55 +255,123 @@ function buildChildEnv(optsOrSessionId) {
   if (opts.sessionId) out["WRONGSTACK_SESSION_ID"] = opts.sessionId;
   return out;
 }
+var ALLOWED_KEYS, SECRET_NAME_PARTS, NODE_OPTIONS_INJECTION_FLAG, NODE_OPTIONS_INJECTION_FLAG_EQ;
+var init_child_env = __esm({
+  "src/utils/child-env.ts"() {
+    ALLOWED_KEYS = /* @__PURE__ */ new Set([
+      "PATH",
+      "HOME",
+      "USER",
+      "USERNAME",
+      "LOGNAME",
+      "SHELL",
+      "LANG",
+      "LC_ALL",
+      "LC_CTYPE",
+      "TERM",
+      "TZ",
+      "TMPDIR",
+      "TEMP",
+      "TMP",
+      "PWD",
+      "OLDPWD",
+      "COMSPEC",
+      "SYSTEMROOT",
+      "SYSTEMDRIVE",
+      "WINDIR",
+      "PROGRAMFILES",
+      "PROGRAMFILES(X86)",
+      "PROGRAMDATA",
+      "APPDATA",
+      "LOCALAPPDATA",
+      "USERPROFILE",
+      "PUBLIC",
+      "PATHEXT"
+    ]);
+    SECRET_NAME_PARTS = [
+      "TOKEN",
+      "SECRET",
+      "PASSWORD",
+      "PASSWD",
+      "AUTH",
+      "CRED",
+      "BEARER",
+      "COOKIE",
+      "PRIVATE"
+    ];
+    NODE_OPTIONS_INJECTION_FLAG = /^(?:--require|-r|--import|--loader|--experimental-loader)$/;
+    NODE_OPTIONS_INJECTION_FLAG_EQ = /^(?:--require|-r|--import|--loader|--experimental-loader)=/;
+  }
+});
 
 // src/utils/term.ts
-var hasStdout = () => typeof process !== "undefined" && !!process.stdout;
 function isStdoutTTY() {
   return hasStdout() && Boolean(process.stdout.isTTY);
 }
 function writeTo(s, stream) {
   if (!stream || typeof stream.write !== "function") return false;
-  {
+  const guard = activeOutputGuard;
+  if (!guard) {
     stream.write(s);
     return true;
   }
+  guard.suspend();
+  stream.write(s);
+  guard.resume();
+  return true;
 }
 function writeErr(s, stream = process.stderr) {
   return writeTo(s, stream);
 }
+var hasStdout, activeOutputGuard;
+var init_term = __esm({
+  "src/utils/term.ts"() {
+    hasStdout = () => typeof process !== "undefined" && !!process.stdout;
+    activeOutputGuard = null;
+  }
+});
 
 // src/utils/color.ts
-var isColorTty = () => {
-  if (envFlag(process.env.NO_COLOR)) return false;
-  if (envFlag(process.env.FORCE_COLOR)) return true;
-  return isStdoutTTY();
-};
 function envFlag(value) {
   if (value === void 0) return false;
   if (value.trim() === "") return false;
   return !/^(0|false|no|off)$/i.test(value.trim());
 }
-var COLOR = isColorTty();
-var wrap = (open4, close) => (s) => COLOR ? `\x1B[${open4}m${s}\x1B[${close}m` : s;
-var color = {
-  reset: wrap("0", "0"),
-  bold: wrap("1", "22"),
-  dim: wrap("2", "22"),
-  italic: wrap("3", "23"),
-  underline: wrap("4", "24"),
-  red: wrap("31", "39"),
-  green: wrap("32", "39"),
-  yellow: wrap("33", "39"),
-  blue: wrap("34", "39"),
-  magenta: wrap("35", "39"),
-  cyan: wrap("36", "39"),
-  gray: wrap("90", "39"),
-  amber: wrap("38;5;214", "39"),
-  pink: wrap("38;5;205", "39"),
-  bgRed: wrap("41", "49"),
-  bgGreen: wrap("42", "49")
-};
-var MAX_DIGEST_CHARS = 4e3;
+var isColorTty, COLOR, wrap, color;
+var init_color = __esm({
+  "src/utils/color.ts"() {
+    init_term();
+    isColorTty = () => {
+      if (envFlag(process.env.NO_COLOR)) return false;
+      if (envFlag(process.env.FORCE_COLOR)) return true;
+      return isStdoutTTY();
+    };
+    COLOR = isColorTty();
+    wrap = (open4, close) => (s) => COLOR ? `\x1B[${open4}m${s}\x1B[${close}m` : s;
+    color = {
+      reset: wrap("0", "0"),
+      bold: wrap("1", "22"),
+      dim: wrap("2", "22"),
+      italic: wrap("3", "23"),
+      underline: wrap("4", "24"),
+      red: wrap("31", "39"),
+      green: wrap("32", "39"),
+      yellow: wrap("33", "39"),
+      blue: wrap("34", "39"),
+      magenta: wrap("35", "39"),
+      cyan: wrap("36", "39"),
+      gray: wrap("90", "39"),
+      amber: wrap("38;5;214", "39"),
+      pink: wrap("38;5;205", "39"),
+      bgRed: wrap("41", "49"),
+      bgGreen: wrap("42", "49")
+    };
+  }
+});
+var init_config_json = __esm({
+  "src/utils/config-json.ts"() {
+  }
+});
 function createContextEvidenceState() {
   return {
     sessionGoals: [],
@@ -412,17 +444,14 @@ function ensureEvidence(ctx) {
   }
   return ctx.contextEvidence;
 }
+var MAX_DIGEST_CHARS;
+var init_context_evidence = __esm({
+  "src/utils/context-evidence.ts"() {
+    MAX_DIGEST_CHARS = 4e3;
+  }
+});
 
 // src/utils/deep-merge.ts
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
 function isPrimitiveArray(a) {
   return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
 }
@@ -471,11 +500,35 @@ function deepMerge(base, patch, options = {}) {
   }
   return out;
 }
+var FORBIDDEN_PROTO_KEYS;
+var init_deep_merge = __esm({
+  "src/utils/deep-merge.ts"() {
+    FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+      "__proto__",
+      "constructor",
+      "prototype",
+      "__defineGetter__",
+      "__defineSetter__",
+      "__lookupGetter__",
+      "__lookupSetter__"
+    ]);
+  }
+});
+
+// src/utils/diff.ts
+var init_diff = __esm({
+  "src/utils/diff.ts"() {
+  }
+});
 
 // src/utils/error.ts
 function toErrorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
+var init_error = __esm({
+  "src/utils/error.ts"() {
+  }
+});
 
 // src/utils/expect-defined.ts
 function expectDefined(value, label) {
@@ -486,9 +539,10 @@ function expectDefined(value, label) {
   }
   return value;
 }
-var GLOB_CHARS = /* @__PURE__ */ new Set(["*", "?", "["]);
-var IS_WINDOWS = process.platform === "win32";
-var SEP = IS_WINDOWS ? "\\" : "/";
+var init_expect_defined = __esm({
+  "src/utils/expect-defined.ts"() {
+  }
+});
 function isGlob(p) {
   for (const c of p) {
     if (GLOB_CHARS.has(c)) return true;
@@ -573,8 +627,8 @@ async function expandGlob(pattern) {
       for (const e of entries) {
         const full = `${dir}${SEP}${e}`;
         try {
-          const stat9 = await fsp7.stat(full);
-          if (stat9.isDirectory()) await walk3(full, rest);
+          const stat10 = await fsp7.stat(full);
+          if (stat10.isDirectory()) await walk3(full, rest);
         } catch {
         }
       }
@@ -591,8 +645,8 @@ async function expandGlob(pattern) {
       if (entries.includes(seg)) {
         const full = `${dir}${SEP}${seg}`;
         try {
-          const stat9 = await fsp7.stat(full);
-          if (stat9.isDirectory()) await walk3(full, rest);
+          const stat10 = await fsp7.stat(full);
+          if (stat10.isDirectory()) await walk3(full, rest);
         } catch {
         }
       }
@@ -601,14 +655,20 @@ async function expandGlob(pattern) {
   await walk3(base === "." ? "." : base, relPat);
   return [...results];
 }
+var GLOB_CHARS, IS_WINDOWS, SEP;
+var init_glob_expand = __esm({
+  "src/utils/glob-expand.ts"() {
+    init_expect_defined();
+    GLOB_CHARS = /* @__PURE__ */ new Set(["*", "?", "["]);
+    IS_WINDOWS = process.platform === "win32";
+    SEP = IS_WINDOWS ? "\\" : "/";
+  }
+});
 
 // src/utils/glob-match.ts
 function escapeRegex(s) {
   return s.replace(/[.+^${}()|\\]/g, "\\$&");
 }
-var COMPILED_GLOB_CACHE = /* @__PURE__ */ new Map();
-var CACHE_MAX_SIZE = 2e3;
-var NEVER_MATCH = /[^\s\S]/;
 function getCachedGlob(pattern) {
   const cached = COMPILED_GLOB_CACHE.get(pattern);
   if (cached) return cached;
@@ -627,7 +687,6 @@ function getCachedGlob(pattern) {
   COMPILED_GLOB_CACHE.set(pattern, re);
   return re;
 }
-var MAX_GLOB_PATTERN_LEN = 1024;
 function compileGlob(pattern) {
   if (pattern.length > MAX_GLOB_PATTERN_LEN) {
     throw new Error(`Glob pattern exceeds ${MAX_GLOB_PATTERN_LEN} characters`);
@@ -683,6 +742,16 @@ function matchGlob(pattern, input) {
 function matchAny(patterns, input) {
   return patterns.some((p) => matchGlob(p, input));
 }
+var COMPILED_GLOB_CACHE, CACHE_MAX_SIZE, NEVER_MATCH, MAX_GLOB_PATTERN_LEN;
+var init_glob_match = __esm({
+  "src/utils/glob-match.ts"() {
+    init_expect_defined();
+    COMPILED_GLOB_CACHE = /* @__PURE__ */ new Map();
+    CACHE_MAX_SIZE = 2e3;
+    NEVER_MATCH = /[^\s\S]/;
+    MAX_GLOB_PATTERN_LEN = 1024;
+  }
+});
 
 // src/utils/json-repair.ts
 function completePartialObject(s) {
@@ -759,7 +828,6 @@ function repairTruncated(s) {
   }
   return result;
 }
-var VALID_ESCAPE = /* @__PURE__ */ new Set(['"', "\\", "/", "b", "f", "n", "r", "t", "u"]);
 function endsWithInvalidEscape(str) {
   const last = str[str.length - 1];
   if (str[str.length - 2] !== "\\" || last === void 0) return false;
@@ -775,6 +843,13 @@ function tryParse(s) {
     return { ok: false };
   }
 }
+var VALID_ESCAPE;
+var init_json_repair = __esm({
+  "src/utils/json-repair.ts"() {
+    init_expect_defined();
+    VALID_ESCAPE = /* @__PURE__ */ new Set(['"', "\\", "/", "b", "f", "n", "r", "t", "u"]);
+  }
+});
 
 // src/utils/json-schema-validate.ts
 function validateAgainstSchema(value, schema) {
@@ -782,7 +857,6 @@ function validateAgainstSchema(value, schema) {
   walk(value, schema, "", errors, 0);
   return { ok: errors.length === 0, errors };
 }
-var MAX_SCHEMA_DEPTH = 64;
 function walk(value, schema, path32, errors, depth) {
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
@@ -879,6 +953,12 @@ function deepEqual(a, b) {
   }
   return false;
 }
+var MAX_SCHEMA_DEPTH;
+var init_json_schema_validate = __esm({
+  "src/utils/json-schema-validate.ts"() {
+    MAX_SCHEMA_DEPTH = 64;
+  }
+});
 
 // src/utils/merge-models-payload.ts
 function mergeModelsPayload(base, overlay) {
@@ -942,6 +1022,10 @@ function stripUndefined(obj) {
   }
   return out;
 }
+var init_merge_models_payload = __esm({
+  "src/utils/merge-models-payload.ts"() {
+  }
+});
 
 // src/utils/message-invariants.ts
 function repairToolUseAdjacency(messages) {
@@ -1034,15 +1118,19 @@ function isEmptyMessage(msg) {
   if (typeof msg.content === "string") return msg.content.trim().length === 0;
   return msg.content.length === 0;
 }
+var init_message_invariants = __esm({
+  "src/utils/message-invariants.ts"() {
+    init_expect_defined();
+  }
+});
+
+// src/utils/newline-normalize.ts
+var init_newline_normalize = __esm({
+  "src/utils/newline-normalize.ts"() {
+  }
+});
 
 // src/utils/regex-guard.ts
-var MAX_PATTERN_LEN = 512;
-var DANGEROUS_PATTERNS = [
-  /(\([^)]*[+*][^)]*\))[+*]/,
-  // (a+)+, (.*)+, etc
-  /(\(\?:[^)]*[+*][^)]*\))[+*]/
-  // same, with non-capturing group
-];
 function compileUserRegex(pattern, flags) {
   if (typeof pattern !== "string") {
     return { ok: false, reason: "pattern must be a string" };
@@ -1070,6 +1158,18 @@ function compileUserRegex(pattern, flags) {
     };
   }
 }
+var MAX_PATTERN_LEN, DANGEROUS_PATTERNS;
+var init_regex_guard = __esm({
+  "src/utils/regex-guard.ts"() {
+    MAX_PATTERN_LEN = 512;
+    DANGEROUS_PATTERNS = [
+      /(\([^)]*[+*][^)]*\))[+*]/,
+      // (a+)+, (.*)+, etc
+      /(\(\?:[^)]*[+*][^)]*\))[+*]/
+      // same, with non-capturing group
+    ];
+  }
+});
 
 // src/utils/safe-json.ts
 function safeParse(input, maxBytes = 5e6) {
@@ -1085,15 +1185,44 @@ function safeParse(input, maxBytes = 5e6) {
     };
   }
 }
+var init_safe_json = __esm({
+  "src/utils/safe-json.ts"() {
+    init_error();
+  }
+});
+function sessionScopedPath(dir, sessionId, suffix) {
+  if (!sessionId || sessionId.includes("\\") || sessionId.includes("..")) {
+    throw invalid(sessionId);
+  }
+  const resolved = path4.resolve(dir, `${sessionId}${suffix}`);
+  const rel = path4.relative(path4.resolve(dir), resolved);
+  if (rel.startsWith("..") || path4.isAbsolute(rel)) {
+    throw invalid(sessionId);
+  }
+  return resolved;
+}
+function invalid(sessionId) {
+  return new FsError({
+    message: `Invalid sessionId: ${sessionId}`,
+    code: ERROR_CODES.FS_DELETE_FAILED,
+    path: sessionId,
+    context: { reason: "path_traversal" }
+  });
+}
+var init_session_scoped_path = __esm({
+  "src/utils/session-scoped-path.ts"() {
+    init_errors();
+  }
+});
 
 // src/utils/slug.ts
 function slugify(name, fallback = "prompt", maxLen = 64) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, maxLen).replace(/-+$/g, "") || fallback;
 }
-var ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-var ENCODING_LEN = ENCODING.length;
-var TIME_LEN = 10;
-var RANDOM_LEN = 16;
+var init_slug = __esm({
+  "src/utils/slug.ts"() {
+  }
+});
 function encodeTime(now, len) {
   let mod;
   let str = "";
@@ -1115,19 +1244,47 @@ function encodeRandom(len) {
 function ulid(seedTime = Date.now()) {
   return encodeTime(seedTime, TIME_LEN) + encodeRandom(RANDOM_LEN);
 }
+var ENCODING, ENCODING_LEN, TIME_LEN, RANDOM_LEN;
+var init_ulid = __esm({
+  "src/utils/ulid.ts"() {
+    ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+    ENCODING_LEN = ENCODING.length;
+    TIME_LEN = 10;
+    RANDOM_LEN = 16;
+  }
+});
 
 // src/utils/sleep.ts
 function sleep(ms) {
-  return new Promise((resolve11) => setTimeout(resolve11, ms));
+  return new Promise((resolve12) => setTimeout(resolve12, ms));
 }
+var init_sleep = __esm({
+  "src/utils/sleep.ts"() {
+  }
+});
 
 // src/utils/string.ts
 function truncate(s, max) {
   return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
 }
+var init_string = __esm({
+  "src/utils/string.ts"() {
+  }
+});
+
+// src/utils/task-format.ts
+var init_task_format = __esm({
+  "src/utils/task-format.ts"() {
+  }
+});
+
+// src/utils/todos-format.ts
+var init_todos_format = __esm({
+  "src/utils/todos-format.ts"() {
+  }
+});
 
 // src/utils/tool-subject.ts
-var GLOB_METACHARACTERS = /[*?[\]]/g;
 function escapeGlobSubject(value) {
   return value.replace(GLOB_METACHARACTERS, (char) => `\\${char}`);
 }
@@ -1160,11 +1317,14 @@ function subjectForToolInput(toolName, input, subjectKey) {
   }
   return void 0;
 }
+var GLOB_METACHARACTERS;
+var init_tool_subject = __esm({
+  "src/utils/tool-subject.ts"() {
+    GLOB_METACHARACTERS = /[*?[\]]/g;
+  }
+});
 
 // src/utils/tool-wire-compact.ts
-var TOOL_DESCRIPTION_MAX_CHARS = 640;
-var SCHEMA_DESCRIPTION_MAX_CHARS = 180;
-var compactCache = /* @__PURE__ */ new WeakMap();
 function compactToolDefinitionForWire(tool, opts = {}) {
   const useDefaultOptions = opts.descriptionMaxChars === void 0 && opts.schemaDescriptionMaxChars === void 0;
   if (useDefaultOptions && typeof tool === "object" && tool !== null) {
@@ -1230,11 +1390,16 @@ function findSemanticBoundary(text, limit) {
 function isRecord(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
+var TOOL_DESCRIPTION_MAX_CHARS, SCHEMA_DESCRIPTION_MAX_CHARS, compactCache;
+var init_tool_wire_compact = __esm({
+  "src/utils/tool-wire-compact.ts"() {
+    TOOL_DESCRIPTION_MAX_CHARS = 640;
+    SCHEMA_DESCRIPTION_MAX_CHARS = 180;
+    compactCache = /* @__PURE__ */ new WeakMap();
+  }
+});
 
 // src/utils/token-estimate.ts
-var RoughTokenEstimate = (text, charsPerToken = 3.5) => Math.max(1, Math.ceil(text.length / charsPerToken));
-var CALIBRATION_GLOBAL_KEY = "__global__";
-var _cals = /* @__PURE__ */ new Map();
 function calState(key) {
   let state = _cals.get(key);
   if (!state) {
@@ -1243,21 +1408,6 @@ function calState(key) {
   }
   return state;
 }
-var MIN_SAMPLES_FOR_CALIBRATION = 3;
-var MODEL_FAMILY_RATIO = {
-  // Anthropic: ~3.8-4.0 chars/token depending on model
-  claude: 3.8,
-  // OpenAI: ~4.0 chars/token
-  "gpt-4": 4,
-  "gpt-3.5": 4,
-  // Google: ~3.5 chars/token
-  gemini: 3.5,
-  // DeepSeek: ~3.5 chars/token
-  deepseek: 3.5
-};
-var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
-var _estimateCacheOrder = [];
-var ESTIMATE_CACHE_MAX_SIZE = 5e4;
 function getCachedEstimate(key, compute) {
   const existing = ESTIMATE_CACHE.get(key);
   if (existing !== void 0) return existing;
@@ -1404,17 +1554,32 @@ function getModelFamilyRatio(calibrationKey) {
   }
   return null;
 }
+var RoughTokenEstimate, CALIBRATION_GLOBAL_KEY, _cals, MIN_SAMPLES_FOR_CALIBRATION, MODEL_FAMILY_RATIO, ESTIMATE_CACHE, _estimateCacheOrder, ESTIMATE_CACHE_MAX_SIZE;
+var init_token_estimate = __esm({
+  "src/utils/token-estimate.ts"() {
+    init_tool_wire_compact();
+    RoughTokenEstimate = (text, charsPerToken = 3.5) => Math.max(1, Math.ceil(text.length / charsPerToken));
+    CALIBRATION_GLOBAL_KEY = "__global__";
+    _cals = /* @__PURE__ */ new Map();
+    MIN_SAMPLES_FOR_CALIBRATION = 3;
+    MODEL_FAMILY_RATIO = {
+      // Anthropic: ~3.8-4.0 chars/token depending on model
+      claude: 3.8,
+      // OpenAI: ~4.0 chars/token
+      "gpt-4": 4,
+      "gpt-3.5": 4,
+      // Google: ~3.5 chars/token
+      gemini: 3.5,
+      // DeepSeek: ~3.5 chars/token
+      deepseek: 3.5
+    };
+    ESTIMATE_CACHE = /* @__PURE__ */ new Map();
+    _estimateCacheOrder = [];
+    ESTIMATE_CACHE_MAX_SIZE = 5e4;
+  }
+});
 
 // src/utils/tool-output-serializer.ts
-var DEFAULT_LIST_LIMIT = 500;
-var LOG_ENTRY_LIMIT = 200;
-var INLINE_LIMIT = 240;
-var GREP_FILE_LIMIT = 80;
-var GREP_MATCHES_PER_FILE = 3;
-var DIFF_INLINE_LINE_LIMIT = 260;
-var DIFF_HUNK_LIMIT = 8;
-var DIFF_HUNK_CONTEXT = 14;
-var GREP_LINE_RE = /^(.+?):(\d+):(.*)$/;
 function createToolOutputSerializer(opts = {}) {
   const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
   function serialize(value, context = {}) {
@@ -2062,9 +2227,22 @@ function isRecord2(value) {
 function isScalar(value) {
   return value === null || ["string", "number", "boolean"].includes(typeof value);
 }
+var DEFAULT_LIST_LIMIT, LOG_ENTRY_LIMIT, INLINE_LIMIT, GREP_FILE_LIMIT, GREP_MATCHES_PER_FILE, DIFF_INLINE_LINE_LIMIT, DIFF_HUNK_LIMIT, DIFF_HUNK_CONTEXT, GREP_LINE_RE;
+var init_tool_output_serializer = __esm({
+  "src/utils/tool-output-serializer.ts"() {
+    DEFAULT_LIST_LIMIT = 500;
+    LOG_ENTRY_LIMIT = 200;
+    INLINE_LIMIT = 240;
+    GREP_FILE_LIMIT = 80;
+    GREP_MATCHES_PER_FILE = 3;
+    DIFF_INLINE_LINE_LIMIT = 260;
+    DIFF_HUNK_LIMIT = 8;
+    DIFF_HUNK_CONTEXT = 14;
+    GREP_LINE_RE = /^(.+?):(\d+):(.*)$/;
+  }
+});
 
 // src/utils/tool-result-render-mode.ts
-var DEFAULT_TOOL_RESULT_RENDER_MODE = "extend";
 function normalizeToolResultRenderMode(value) {
   if (typeof value !== "string") return void 0;
   const raw = value.trim().toLowerCase();
@@ -2075,12 +2253,18 @@ function normalizeToolResultRenderMode(value) {
 function resolveToolResultRenderMode(modes, toolName) {
   return normalizeToolResultRenderMode(modes?.[toolName]) ?? DEFAULT_TOOL_RESULT_RENDER_MODE;
 }
+var DEFAULT_TOOL_RESULT_RENDER_MODE;
+var init_tool_result_render_mode = __esm({
+  "src/utils/tool-result-render-mode.ts"() {
+    DEFAULT_TOOL_RESULT_RENDER_MODE = "extend";
+  }
+});
 function projectHash(absRoot) {
-  return createHash("sha256").update(path3.resolve(absRoot)).digest("hex").slice(0, 12);
+  return createHash("sha256").update(path4.resolve(absRoot)).digest("hex").slice(0, 12);
 }
 function projectSlug(absRoot) {
-  const base = slugify2(path3.basename(absRoot));
-  const hash = createHash("sha256").update(path3.resolve(absRoot)).digest("hex").slice(0, 6);
+  const base = slugify2(path4.basename(absRoot));
+  const hash = createHash("sha256").update(path4.resolve(absRoot)).digest("hex").slice(0, 6);
   return `${base}-${hash}`;
 }
 function slugify2(name) {
@@ -2088,170 +2272,91 @@ function slugify2(name) {
 }
 function wstackGlobalRoot() {
   const fromEnv = process.env["WRONGSTACK_HOME"];
-  if (fromEnv && fromEnv.trim().length > 0) return path3.resolve(fromEnv);
-  return path3.join(os.homedir(), ".wrongstack");
+  if (fromEnv && fromEnv.trim().length > 0) return path4.resolve(fromEnv);
+  return path4.join(os.homedir(), ".wrongstack");
 }
 function resolveWstackPaths(opts) {
-  const globalRoot = opts.globalRoot ?? (opts.userHome ? path3.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
+  const globalRoot = opts.globalRoot ?? (opts.userHome ? path4.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
   const hash = projectHash(opts.projectRoot);
   const slug = projectSlug(opts.projectRoot);
-  const projectDir = path3.join(globalRoot, "projects", slug);
+  const projectDir = path4.join(globalRoot, "projects", slug);
   return {
     globalRoot,
     configDir: globalRoot,
-    globalConfig: path3.join(globalRoot, "config.json"),
-    secretsKey: path3.join(globalRoot, ".key"),
-    globalMemory: path3.join(globalRoot, "memory.md"),
-    globalSkills: path3.join(globalRoot, "skills"),
-    globalDesignKits: path3.join(globalRoot, "design-kits"),
-    globalPrompts: path3.join(globalRoot, "prompts"),
-    globalInstructions: path3.join(globalRoot, "instructions"),
-    promptUsage: path3.join(globalRoot, "prompt-usage.json"),
-    cacheDir: path3.join(globalRoot, "cache"),
-    modelsCache: path3.join(globalRoot, "cache", "models.dev.json"),
-    modelsOverlayCache: path3.join(globalRoot, "cache", "models-overlay.json"),
-    historyFile: path3.join(globalRoot, "history"),
-    logFile: path3.join(globalRoot, "logs", "wrongstack.log"),
+    globalConfig: path4.join(globalRoot, "config.json"),
+    secretsKey: path4.join(globalRoot, ".key"),
+    globalMemory: path4.join(globalRoot, "memory.md"),
+    globalSkills: path4.join(globalRoot, "skills"),
+    globalDesignKits: path4.join(globalRoot, "design-kits"),
+    globalPrompts: path4.join(globalRoot, "prompts"),
+    globalInstructions: path4.join(globalRoot, "instructions"),
+    promptUsage: path4.join(globalRoot, "prompt-usage.json"),
+    cacheDir: path4.join(globalRoot, "cache"),
+    modelsCache: path4.join(globalRoot, "cache", "models.dev.json"),
+    modelsOverlayCache: path4.join(globalRoot, "cache", "models-overlay.json"),
+    historyFile: path4.join(globalRoot, "history"),
+    logFile: path4.join(globalRoot, "logs", "wrongstack.log"),
     projectDir,
-    projectCodebaseIndex: path3.join(projectDir, "codebase-index"),
-    projectMemory: path3.join(projectDir, "memory.md"),
-    projectSessions: path3.join(projectDir, "sessions"),
-    projectTrust: path3.join(projectDir, "trust.json"),
-    projectMeta: path3.join(projectDir, "meta.json"),
-    projectLocalConfig: path3.join(projectDir, "config.local.json"),
-    inProjectConfig: path3.join(opts.projectRoot, ".wrongstack", "config.json"),
-    inProjectAgentsFile: path3.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
-    inProjectSkills: path3.join(opts.projectRoot, ".wrongstack", "skills"),
-    inProjectPrompts: path3.join(opts.projectRoot, ".wrongstack", "prompts"),
-    inProjectInstructions: path3.join(opts.projectRoot, ".wrongstack", "instructions"),
-    inProjectDesignKits: path3.join(opts.projectRoot, ".wrongstack", "design-kits"),
-    inProjectWorktrees: path3.join(opts.projectRoot, ".wrongstack", "worktrees"),
+    projectCodebaseIndex: path4.join(projectDir, "codebase-index"),
+    projectMemory: path4.join(projectDir, "memory.md"),
+    projectSessions: path4.join(projectDir, "sessions"),
+    projectTrust: path4.join(projectDir, "trust.json"),
+    projectMeta: path4.join(projectDir, "meta.json"),
+    projectLocalConfig: path4.join(projectDir, "config.local.json"),
+    inProjectConfig: path4.join(opts.projectRoot, ".wrongstack", "config.json"),
+    inProjectAgentsFile: path4.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
+    inProjectSkills: path4.join(opts.projectRoot, ".wrongstack", "skills"),
+    inProjectPrompts: path4.join(opts.projectRoot, ".wrongstack", "prompts"),
+    inProjectInstructions: path4.join(opts.projectRoot, ".wrongstack", "instructions"),
+    inProjectDesignKits: path4.join(opts.projectRoot, ".wrongstack", "design-kits"),
+    inProjectWorktrees: path4.join(opts.projectRoot, ".wrongstack", "worktrees"),
     projectHash: hash,
     projectSlug: slug,
-    projectGoal: path3.join(projectDir, "goal.json"),
-    projectSpecs: path3.join(projectDir, "specs"),
-    projectTaskGraphs: path3.join(projectDir, "task-graphs"),
-    projectSddSession: path3.join(projectDir, "sdd-session.json"),
-    projectPlan: path3.join(projectDir, "plan.json"),
-    projectAutophase: path3.join(projectDir, "autophase"),
-    projectSddBoards: path3.join(projectDir, "sdd-boards"),
-    syncConfig: path3.join(globalRoot, "sync.json"),
-    projectStatus: (projectHash2) => path3.join(globalRoot, "projects", projectHash2, "status.json")
+    projectGoal: path4.join(projectDir, "goal.json"),
+    projectSpecs: path4.join(projectDir, "specs"),
+    projectTaskGraphs: path4.join(projectDir, "task-graphs"),
+    projectSddSession: path4.join(projectDir, "sdd-session.json"),
+    projectPlan: path4.join(projectDir, "plan.json"),
+    projectAutophase: path4.join(projectDir, "autophase"),
+    projectSddBoards: path4.join(projectDir, "sdd-boards"),
+    syncConfig: path4.join(globalRoot, "sync.json"),
+    projectStatus: (projectHash2) => path4.join(globalRoot, "projects", projectHash2, "status.json")
   };
 }
-
-// src/types/errors.ts
-var ERROR_CODES = {
-  // Provider
-  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
-  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
-  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
-  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
-  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
-  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
-  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
-  // Tool
-  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
-  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
-  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
-  TOOL_TIMEOUT: "TOOL_TIMEOUT",
-  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
-  // Config
-  CONFIG_INVALID: "CONFIG_INVALID",
-  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
-  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
-  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
-  // Plugin
-  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
-  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
-  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
-  // Agent
-  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
-  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
-  AGENT_ABORTED: "AGENT_ABORTED",
-  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
-  // Session
-  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
-  SESSION_CORRUPTED: "SESSION_CORRUPTED",
-  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
-  // Container / Registry
-  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
-  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
-  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
-  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
-  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
-  REGISTRY_INVALID: "REGISTRY_INVALID",
-  // File system
-  FS_READ_FAILED: "FS_READ_FAILED",
-  FS_WRITE_FAILED: "FS_WRITE_FAILED",
-  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
-  FS_DELETE_FAILED: "FS_DELETE_FAILED",
-  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
-  // SDD (Spec-Driven Development)
-  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
-  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
-  SDD_INVALID_STATE: "SDD_INVALID_STATE",
-  SDD_NOT_READY: "SDD_NOT_READY",
-  // General
-  VALIDATION_ERROR: "VALIDATION_ERROR",
-  UNKNOWN: "UNKNOWN"
-};
-var WrongStackError = class extends Error {
-  code;
-  subsystem;
-  severity;
-  recoverable;
-  context;
-  constructor(opts) {
-    super(opts.message, { cause: opts.cause });
-    this.name = "WrongStackError";
-    this.code = opts.code;
-    this.subsystem = opts.subsystem;
-    this.severity = opts.severity ?? "error";
-    this.recoverable = opts.recoverable ?? false;
-    this.context = opts.context;
+var init_wstack_paths = __esm({
+  "src/utils/wstack-paths.ts"() {
   }
-  /**
-   * Render a one-line user-facing description.
-   * Subclasses should override for domain-specific formatting.
-   */
-  describe() {
-    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
-    return `${this.code}: ${this.message}${ctx}`;
+});
+
+// src/utils/index.ts
+var init_utils = __esm({
+  "src/utils/index.ts"() {
+    init_assert_never();
+    init_atomic_write();
+    init_child_env();
+    init_color();
+    init_config_json();
+    init_diff();
+    init_error();
+    init_expect_defined();
+    init_glob_match();
+    init_newline_normalize();
+    init_safe_json();
+    init_sleep();
+    init_string();
+    init_task_format();
+    init_term();
+    init_todos_format();
+    init_tool_subject();
+    init_wstack_paths();
   }
-};
+});
+
+// src/types/errors.ts
 function formatContext(ctx) {
   const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
   return parts.length > 0 ? `[${parts.join(" ")}]` : "";
 }
-var ConfigError = class extends WrongStackError {
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "config",
-      severity: "fatal",
-      recoverable: false,
-      context: opts.context,
-      cause: opts.cause
-    });
-    this.name = "ConfigError";
-  }
-};
-var AgentError = class extends WrongStackError {
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "agent",
-      severity: opts.code === ERROR_CODES.AGENT_ABORTED ? "warning" : "error",
-      recoverable: opts.recoverable ?? opts.code === ERROR_CODES.AGENT_ITERATION_LIMIT,
-      context: opts.context,
-      cause: opts.cause
-    });
-    this.name = "AgentError";
-  }
-};
 function toWrongStackError(err, code = ERROR_CODES.AGENT_RUN_FAILED) {
   if (err instanceof WrongStackError) return err;
   const message = toErrorMessage(err);
@@ -2261,66 +2366,201 @@ function toWrongStackError(err, code = ERROR_CODES.AGENT_RUN_FAILED) {
     cause: err
   });
 }
-var SddError = class extends WrongStackError {
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "sdd",
-      severity: opts.code === ERROR_CODES.SDD_PARSE_FAILED ? "warning" : "error",
-      recoverable: opts.code === ERROR_CODES.SDD_NOT_READY,
-      context: opts.context,
-      cause: opts.cause
-    });
-    this.name = "SddError";
-  }
-};
-var FsError = class extends WrongStackError {
-  path;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "fs",
-      severity: "error",
-      recoverable: opts.code !== ERROR_CODES.FS_READ_FAILED,
-      context: { path: opts.path, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "FsError";
-    this.path = opts.path;
-  }
-};
-var FetchError = class extends WrongStackError {
-  status;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: ERROR_CODES.VALIDATION_ERROR,
-      subsystem: "general",
-      severity: "error",
-      recoverable: opts.status === 429 || opts.status >= 500,
-      context: { status: opts.status, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "FetchError";
-    this.status = opts.status;
-  }
-};
-var ToolValidationError = class extends WrongStackError {
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: ERROR_CODES.VALIDATION_ERROR,
-      subsystem: "general",
-      severity: "error",
-      recoverable: false,
-      context: { field: opts.field, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "ToolValidationError";
+function isWrongStackError(err) {
+  return err instanceof WrongStackError;
+}
+var ERROR_CODES, WrongStackError, ToolError, ConfigError, AgentError, SddError, FsError, FetchError, ToolValidationError;
+var init_errors = __esm({
+  "src/types/errors.ts"() {
+    init_utils();
+    ERROR_CODES = {
+      // Provider
+      PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
+      PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
+      PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
+      PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
+      PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
+      PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
+      PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
+      // Tool
+      TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
+      TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
+      TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
+      TOOL_TIMEOUT: "TOOL_TIMEOUT",
+      TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
+      // Config
+      CONFIG_INVALID: "CONFIG_INVALID",
+      CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
+      CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
+      CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
+      // Plugin
+      PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
+      PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
+      PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
+      // Agent
+      AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
+      AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
+      AGENT_ABORTED: "AGENT_ABORTED",
+      AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
+      // Session
+      SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
+      SESSION_CORRUPTED: "SESSION_CORRUPTED",
+      SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
+      // Container / Registry
+      CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
+      CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
+      CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
+      REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
+      REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
+      REGISTRY_INVALID: "REGISTRY_INVALID",
+      // File system
+      FS_READ_FAILED: "FS_READ_FAILED",
+      FS_WRITE_FAILED: "FS_WRITE_FAILED",
+      FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
+      FS_DELETE_FAILED: "FS_DELETE_FAILED",
+      FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
+      // SDD (Spec-Driven Development)
+      SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
+      SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
+      SDD_INVALID_STATE: "SDD_INVALID_STATE",
+      SDD_NOT_READY: "SDD_NOT_READY",
+      // General
+      VALIDATION_ERROR: "VALIDATION_ERROR",
+      PARSE_FAILED: "PARSE_FAILED",
+      UNKNOWN: "UNKNOWN"
+    };
+    WrongStackError = class extends Error {
+      code;
+      subsystem;
+      severity;
+      recoverable;
+      context;
+      constructor(opts) {
+        super(opts.message, { cause: opts.cause });
+        this.name = "WrongStackError";
+        this.code = opts.code;
+        this.subsystem = opts.subsystem;
+        this.severity = opts.severity ?? "error";
+        this.recoverable = opts.recoverable ?? false;
+        this.context = opts.context;
+      }
+      /**
+       * Render a one-line user-facing description.
+       * Subclasses should override for domain-specific formatting.
+       */
+      describe() {
+        const ctx = this.context ? ` ${formatContext(this.context)}` : "";
+        return `${this.code}: ${this.message}${ctx}`;
+      }
+    };
+    ToolError = class extends WrongStackError {
+      toolName;
+      constructor(opts) {
+        super({
+          message: opts.message,
+          code: opts.code,
+          subsystem: "tool",
+          recoverable: opts.recoverable,
+          context: { tool: opts.toolName, ...opts.context },
+          cause: opts.cause
+        });
+        this.name = "ToolError";
+        this.toolName = opts.toolName;
+      }
+    };
+    ConfigError = class extends WrongStackError {
+      constructor(opts) {
+        super({
+          message: opts.message,
+          code: opts.code,
+          subsystem: "config",
+          severity: "fatal",
+          recoverable: false,
+          context: opts.context,
+          cause: opts.cause
+        });
+        this.name = "ConfigError";
+      }
+    };
+    AgentError = class extends WrongStackError {
+      constructor(opts) {
+        super({
+          message: opts.message,
+          code: opts.code,
+          subsystem: "agent",
+          severity: opts.code === ERROR_CODES.AGENT_ABORTED ? "warning" : "error",
+          recoverable: opts.recoverable ?? opts.code === ERROR_CODES.AGENT_ITERATION_LIMIT,
+          context: opts.context,
+          cause: opts.cause
+        });
+        this.name = "AgentError";
+      }
+    };
+    SddError = class extends WrongStackError {
+      constructor(opts) {
+        super({
+          message: opts.message,
+          code: opts.code,
+          subsystem: "sdd",
+          severity: opts.code === ERROR_CODES.SDD_PARSE_FAILED ? "warning" : "error",
+          recoverable: opts.code === ERROR_CODES.SDD_NOT_READY,
+          context: opts.context,
+          cause: opts.cause
+        });
+        this.name = "SddError";
+      }
+    };
+    FsError = class extends WrongStackError {
+      path;
+      constructor(opts) {
+        super({
+          message: opts.message,
+          code: opts.code,
+          subsystem: "fs",
+          severity: "error",
+          recoverable: opts.code !== ERROR_CODES.FS_READ_FAILED,
+          context: { path: opts.path, ...opts.context },
+          cause: opts.cause
+        });
+        this.name = "FsError";
+        this.path = opts.path;
+      }
+    };
+    FetchError = class extends WrongStackError {
+      status;
+      constructor(opts) {
+        super({
+          message: opts.message,
+          code: ERROR_CODES.VALIDATION_ERROR,
+          subsystem: "general",
+          severity: "error",
+          recoverable: opts.status === 429 || opts.status >= 500,
+          context: { status: opts.status, ...opts.context },
+          cause: opts.cause
+        });
+        this.name = "FetchError";
+        this.status = opts.status;
+      }
+    };
+    ToolValidationError = class extends WrongStackError {
+      constructor(opts) {
+        super({
+          message: opts.message,
+          code: ERROR_CODES.VALIDATION_ERROR,
+          subsystem: "general",
+          severity: "error",
+          recoverable: false,
+          context: { field: opts.field, ...opts.context },
+          cause: opts.cause
+        });
+        this.name = "ToolValidationError";
+      }
+    };
   }
-};
+});
+
+// src/coordination/agent-bridge.ts
+init_errors();
 
 // src/coordination/in-memory-transport.ts
 var InMemoryBridgeTransport = class {
@@ -2424,7 +2664,7 @@ var InMemoryAgentBridge = class {
       });
     }
     this.inflightGuards.add(correlationId);
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       const timer = setTimeout(() => {
         this.inflightGuards.delete(correlationId);
         this.pendingRequests.delete(correlationId);
@@ -2443,7 +2683,7 @@ var InMemoryAgentBridge = class {
         return;
       }
       this.pendingRequests.set(correlationId, {
-        resolve: resolve11,
+        resolve: resolve12,
         reject,
         timer
       });
@@ -2485,6 +2725,9 @@ function createMessage(type, from, payload, to) {
   };
 }
 
+// src/coordination/agent-subagent-runner.ts
+init_errors();
+
 // src/coordination/subagent-budget.ts
 var TIMEOUT_PREEMPT_FRACTION = 0.85;
 var DECISION_TIMEOUT_MS = 6e4;
@@ -2556,6 +2799,7 @@ var SubagentBudget = class _SubagentBudget {
    */
   lastActivityTime = null;
   _onThreshold;
+  _sessionId;
   /**
    * Hard cap on how long `_negotiateExtension` waits for the coordinator to
    * respond before defaulting to 'stop'. Without this fallback an absent
@@ -2624,10 +2868,15 @@ var SubagentBudget = class _SubagentBudget {
   get mode() {
     return this._mode;
   }
-  constructor(limits = {}, mode = "auto") {
+  constructor(limits = {}, mode = "auto", options = {}) {
     this._mode = mode;
+    this._sessionId = options.sessionId;
     this.limits = { ...limits };
   }
+  currentSessionId() {
+    const value = typeof this._sessionId === "function" ? this._sessionId() : this._sessionId;
+    return typeof value === "string" && value.length > 0 ? value : void 0;
+  }
   start() {
     this.startTime = Date.now();
     this.lastActivityTime = this.startTime;
@@ -2786,16 +3035,18 @@ var SubagentBudget = class _SubagentBudget {
     if (!bus?.hasListenerFor("budget.threshold_reached")) {
       return Promise.resolve("stop");
     }
-    return new Promise((resolve11) => {
+    return new Promise((resolve12) => {
       let resolved = false;
       const respond = (d) => {
         if (resolved) return;
         resolved = true;
         clearTimeout(fallback);
-        resolve11(d);
+        resolve12(d);
       };
       const fallback = setTimeout(() => respond("stop"), _SubagentBudget.DECISION_TIMEOUT_MS);
+      const sessionId = this.currentSessionId();
       bus.emit("budget.threshold_reached", {
+        ...sessionId ? { sessionId } : {},
         kind: entry.kind,
         used: entry.used,
         limit: entry.limit,
@@ -3194,24 +3445,24 @@ function agentPrompt(id) {
   const fileName = `${id}.md`;
   for (const dir of agentPromptDirCandidates()) {
     try {
-      return readFileSync(path3.join(dir, fileName), "utf8").trimEnd();
+      return readFileSync(path4.join(dir, fileName), "utf8").trimEnd();
     } catch {
     }
   }
   return "";
 }
 function agentPromptDirCandidates() {
-  const here = path3.dirname(fileURLToPath(import.meta.url));
+  const here = path4.dirname(fileURLToPath(import.meta.url));
   const explicitDir = process.env["WRONGSTACK_AGENT_INSTRUCTIONS_DIR"];
-  const globalRoot = process.env["WRONGSTACK_HOME"] || path3.join(os.homedir(), ".wrongstack");
+  const globalRoot = process.env["WRONGSTACK_HOME"] || path4.join(os.homedir(), ".wrongstack");
   const candidates = [
-    ...explicitDir ? [path3.resolve(explicitDir)] : [],
-    path3.join(globalRoot, "instructions", "agents"),
-    path3.resolve(here, "../../../../instructions/agents"),
-    path3.resolve(here, "../../../instructions/agents"),
-    path3.resolve(here, "../../instructions/agents"),
-    path3.resolve(here, "../instructions/agents"),
-    path3.resolve(here, "instructions/agents")
+    ...explicitDir ? [path4.resolve(explicitDir)] : [],
+    path4.join(globalRoot, "instructions", "agents"),
+    path4.resolve(here, "../../../../instructions/agents"),
+    path4.resolve(here, "../../../instructions/agents"),
+    path4.resolve(here, "../../instructions/agents"),
+    path4.resolve(here, "../instructions/agents"),
+    path4.resolve(here, "instructions/agents")
   ];
   return candidates.sort((a, b) => Number(!isDirectory(a)) - Number(!isDirectory(b)));
 }
@@ -4874,6 +5125,8 @@ FLEET_ROSTER_BUDGETS["goose"] = { timeoutMs: 10 * 60 * 60 * 1e3, maxIterations:
 });
 
 // src/coordination/delegate-tool.ts
+init_safe_json();
+init_error();
 function createDelegateTool(opts) {
   const defaultTimeoutMs = opts.defaultTimeoutMs ?? 30 * 60 * 1e3;
   const rosterIds = opts.roster ? Object.keys(opts.roster) : [];
@@ -4946,6 +5199,7 @@ function createDelegateTool(opts) {
     mutating: false,
     inputSchema,
     async execute(input) {
+      const sessionId = opts.directorRunId;
       const i = input ?? {};
       if (typeof i.task !== "string" || !i.task.trim()) {
         return { ok: false, error: "`task` is required." };
@@ -5011,7 +5265,7 @@ function createDelegateTool(opts) {
         if (!cfg.timeoutMs) {
           cfg.timeoutMs = Math.max(3e4, timeoutMs - SUBAGENT_TIMEOUT_BUFFER_MS);
         }
-        opts.events?.emit("delegate.started", { target, task: i.task });
+        opts.events?.emit("delegate.started", { sessionId, target, task: i.task });
         const subagentId = await director.spawn(cfg);
         const taskId = await director.assign({
           id: `${randomUUID()}`,
@@ -5019,7 +5273,7 @@ function createDelegateTool(opts) {
           subagentId
         });
         const dir = director;
-        const result = await new Promise((resolve11) => {
+        const result = await new Promise((resolve12) => {
           let settled = false;
           let timer;
           const finish = (value) => {
@@ -5029,7 +5283,7 @@ function createDelegateTool(opts) {
             offTool();
             offIter();
             offProgress();
-            resolve11(value);
+            resolve12(value);
           };
           const arm = () => {
             if (timer) clearTimeout(timer);
@@ -5047,6 +5301,7 @@ function createDelegateTool(opts) {
         if ("__timeout" in result) {
           const partial2 = await readSubagentPartial(opts, subagentId);
           opts.events?.emit("delegate.completed", {
+            sessionId,
             target,
             task: i.task,
             ok: false,
@@ -5070,6 +5325,7 @@ function createDelegateTool(opts) {
         if ("__emptyResult" in result) {
           const partial2 = await readSubagentPartial(opts, subagentId);
           opts.events?.emit("delegate.completed", {
+            sessionId,
             target,
             task: i.task,
             ok: false,
@@ -5103,6 +5359,7 @@ function createDelegateTool(opts) {
           costUsd = void 0;
         }
         opts.events?.emit("delegate.completed", {
+          sessionId,
           target,
           task: i.task,
           ok: result.status === "success",
@@ -5137,6 +5394,7 @@ function createDelegateTool(opts) {
       } catch (err) {
         const message = toErrorMessage(err);
         opts.events?.emit("delegate.completed", {
+          sessionId,
           target,
           task: i.task,
           ok: false,
@@ -5236,13 +5494,13 @@ async function readSubagentPartial(opts, subagentId) {
   if (!opts.sessionsRoot) return void 0;
   const candidates = [];
   if (opts.directorRunId) {
-    candidates.push(path3.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
+    candidates.push(path4.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
   } else {
     try {
       const entries = await fsp7.readdir(opts.sessionsRoot, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
-          candidates.push(path3.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
+          candidates.push(path4.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
         }
       }
     } catch {
@@ -5288,6 +5546,7 @@ async function readSubagentPartial(opts, subagentId) {
 
 // src/storage/director-state.ts
 init_atomic_write();
+init_error();
 async function loadDirectorState(filePath) {
   let raw;
   try {
@@ -5469,6 +5728,11 @@ var DirectorStateCheckpoint = class {
 
 // src/coordination/director.ts
 init_atomic_write();
+init_error();
+init_safe_json();
+
+// src/coordination/collab-debug.ts
+init_glob_expand();
 var DEFAULT_MAX_TARGET_FILES = 30;
 var CollabSession = class extends EventEmitter {
   sessionId;
@@ -5557,7 +5821,7 @@ var CollabSession = class extends EventEmitter {
     }
     for (const filePath of allFiles) {
       try {
-        const [content, stat9] = await Promise.all([
+        const [content, stat10] = await Promise.all([
           fsp7.readFile(filePath, "utf8"),
           fsp7.stat(filePath)
         ]);
@@ -5567,8 +5831,8 @@ var CollabSession = class extends EventEmitter {
           path: filePath,
           content,
           language,
-          snapshotMtimeMs: stat9.mtimeMs,
-          snapshotSizeBytes: stat9.size
+          snapshotMtimeMs: stat10.mtimeMs,
+          snapshotSizeBytes: stat10.size
         });
       } catch {
         this.snapshot.files.push({ path: filePath, content: "", language: void 0 });
@@ -5724,7 +5988,7 @@ var CollabSession = class extends EventEmitter {
       id: `${role}-${this.sessionId}`,
       name: role,
       role,
-      tools: ["fleet_emit", "fleet_status", "read", "grep", "glob", "bash", "write"],
+      tools: ["fleet_emit", "fleet", "read", "grep", "glob", "bash", "write"],
       maxIterations: budget.maxIterations,
       maxToolCalls: budget.maxToolCalls,
       timeoutMs: budget.timeoutMs
@@ -5981,9 +6245,9 @@ Emit each evaluation immediately. Do not wait until you have read all reports.`;
     for (const file of this.snapshot.files) {
       if (file.snapshotMtimeMs === void 0 && file.snapshotSizeBytes === void 0) continue;
       try {
-        const stat9 = await fsp7.stat(file.path);
-        const mtimeChanged = file.snapshotMtimeMs !== void 0 && stat9.mtimeMs > file.snapshotMtimeMs + 1;
-        const sizeChanged = file.snapshotSizeBytes !== void 0 && stat9.size !== file.snapshotSizeBytes;
+        const stat10 = await fsp7.stat(file.path);
+        const mtimeChanged = file.snapshotMtimeMs !== void 0 && stat10.mtimeMs > file.snapshotMtimeMs + 1;
+        const sizeChanged = file.snapshotSizeBytes !== void 0 && stat10.size !== file.snapshotSizeBytes;
         if (mtimeChanged || sizeChanged) {
           warnings.push(`${file.path} changed after the collab snapshot was captured.`);
         }
@@ -6060,7 +6324,7 @@ Emit each evaluation immediately. Do not wait until you have read all reports.`;
 function readBundledInstructionText(relativePath) {
   for (const root of instructionRootCandidates()) {
     try {
-      return readFileSync(path3.join(root, relativePath), "utf8").trimEnd();
+      return readFileSync(path4.join(root, relativePath), "utf8").trimEnd();
     } catch {
     }
   }
@@ -6073,11 +6337,11 @@ function renderInstructionTemplate(template, values) {
   );
 }
 function instructionRootCandidates() {
-  const here = path3.dirname(fileURLToPath(import.meta.url));
+  const here = path4.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path3.resolve(here, "../../instructions"),
-    path3.resolve(here, "../instructions"),
-    path3.resolve(here, "instructions")
+    path4.resolve(here, "../../instructions"),
+    path4.resolve(here, "../instructions"),
+    path4.resolve(here, "instructions")
   ];
   return candidates.sort((a, b) => Number(!isDirectory2(a)) - Number(!isDirectory2(b)));
 }
@@ -6151,6 +6415,7 @@ function rosterSummaryFromConfigs(roster) {
 }
 
 // src/coordination/dispatcher.ts
+init_safe_json();
 var DEFAULT_DISPATCH_ROLE = "executor";
 var FALLBACK_DEFINITION = {
   config: { role: "unknown", name: "Unknown Agent" },
@@ -6272,6 +6537,9 @@ function makeLLMClassifier(complete) {
   };
 }
 
+// src/coordination/director-tools.ts
+init_error();
+
 // src/security/capabilities.ts
 var ToolCapabilities = {
   /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
@@ -6574,96 +6842,91 @@ function makeTerminateAllTool(director) {
     }
   };
 }
-function makeFleetStatusTool(director) {
-  return {
-    name: "fleet_status",
-    description: "Snapshot of the fleet \u2014 every subagent's current status, coordinator counts (total/running/idle/stopped), pending task descriptions, and usage rollup.",
-    permission: "auto",
-    mutating: false,
-    capabilities: [ToolCapabilities.COORDINATION_FLEET_READ],
-    inputSchema: { type: "object", properties: {}, required: [] },
-    async execute() {
-      const base = director.status();
-      const fm = director.fleetManager;
-      const stats = fm?.getFleetStats();
-      const fleetStatus = fm?.getFleetStatus();
-      return {
-        subagents: base.subagents,
-        coordinatorStats: stats ? { total: stats.total, running: stats.running, idle: stats.idle, stopped: stats.stopped } : void 0,
-        pending: fleetStatus?.pending ?? [],
-        usage: fm?.snapshot()
-      };
-    }
-  };
-}
-function makeFleetUsageTool(director) {
+function makeFleetTool(director) {
   return {
-    name: "fleet_usage",
-    description: "Token + cost breakdown across the fleet, per-subagent and totals.",
-    permission: "auto",
-    mutating: false,
-    capabilities: [ToolCapabilities.COORDINATION_FLEET_READ],
-    inputSchema: { type: "object", properties: {}, required: [] },
-    async execute() {
-      return director.snapshot();
-    }
-  };
-}
-function makeFleetSessionTool(director) {
-  return {
-    name: "fleet_session",
-    description: "Read a subagent's JSONL transcript and extract its last assistant text, stop reason, and tool-use count. Use this to see what a running or timed-out subagent actually produced.",
+    name: "fleet",
+    description: 'Fleet observation tool. Use `action` to select what you need: "status" \u2014 snapshot of all subagents + coordinator counts + pending tasks; "usage" \u2014 token + cost breakdown per subagent and totals; "health" \u2014 per-subagent budget pressure, last activity, and status; "session" \u2014 read a subagent\'s JSONL transcript (requires subagentId).',
+    usageHint: 'action: "status" (default) | "usage" | "health" | "session".\nFor "session", pass subagentId (required) and optional tail (trailing JSONL lines).',
     permission: "auto",
     mutating: false,
     capabilities: [ToolCapabilities.COORDINATION_FLEET_READ],
     inputSchema: {
       type: "object",
       properties: {
-        subagentId: { type: "string", description: "Subagent id to read the transcript of." },
-        tail: { type: "number", description: "Number of trailing JSONL lines to return. Omit for the full transcript." }
-      },
-      required: ["subagentId"]
+        action: {
+          type: "string",
+          enum: ["status", "usage", "health", "session"],
+          description: "Observation to retrieve (default: status)."
+        },
+        subagentId: {
+          type: "string",
+          description: 'Subagent id (required for action: "session").'
+        },
+        tail: {
+          type: "number",
+          description: 'Number of trailing JSONL lines (action: "session" only). Omit for the full transcript.'
+        }
+      }
     },
     async execute(input) {
-      const i = input;
-      const result = await director.readSession(i.subagentId, i.tail);
-      if (!result) {
-        return {
-          error: `fleet_session: transcript unavailable for "${i.subagentId}". Is sessionsRoot configured?`
-        };
-      }
-      return result;
-    }
-  };
-}
-function makeFleetHealthTool(director) {
-  return {
-    name: "fleet_health",
-    description: "Per-subagent health report: budget pressure (pct of limits consumed), last activity timestamp, and current status. Use to decide whether to assign more work to a subagent or spawn a fresh one.",
-    permission: "auto",
-    mutating: false,
-    capabilities: [ToolCapabilities.COORDINATION_FLEET_READ],
-    inputSchema: { type: "object", properties: {}, required: [] },
-    async execute() {
-      const status = director.status();
-      const snapshot = director.snapshot();
-      const subagents = status.subagents ?? [];
-      const perSubagent = snapshot.perSubagent ?? {};
-      return {
-        subagents: subagents.map((s) => {
-          const usage = perSubagent[s.id];
+      const i = input ?? {};
+      const action = i.action ?? "status";
+      switch (action) {
+        case "status": {
+          const base = director.status();
+          const fm = director.fleetManager;
+          const stats = fm?.getFleetStats();
+          const fleetStatus = fm?.getFleetStatus();
           return {
-            id: s.id,
-            status: s.status,
-            lastEventAt: usage?.lastEventAt,
-            budgetPressure: {
-              iterations: usage?.iterations,
-              toolCalls: usage?.toolCalls,
-              costUsd: usage?.cost
-            }
+            action: "status",
+            subagents: base.subagents,
+            coordinatorStats: stats ? { total: stats.total, running: stats.running, idle: stats.idle, stopped: stats.stopped } : void 0,
+            pending: fleetStatus?.pending ?? [],
+            usage: fm?.snapshot()
           };
-        })
-      };
+        }
+        case "usage": {
+          return { action: "usage", ...director.snapshot() };
+        }
+        case "health": {
+          const status = director.status();
+          const snapshot = director.snapshot();
+          const subagents = status.subagents ?? [];
+          const perSubagent = snapshot.perSubagent ?? {};
+          return {
+            action: "health",
+            subagents: subagents.map((s) => {
+              const usage = perSubagent[s.id];
+              return {
+                id: s.id,
+                status: s.status,
+                lastEventAt: usage?.lastEventAt,
+                budgetPressure: {
+                  iterations: usage?.iterations,
+                  toolCalls: usage?.toolCalls,
+                  costUsd: usage?.cost
+                }
+              };
+            })
+          };
+        }
+        case "session": {
+          const subagentId = i.subagentId;
+          if (!subagentId) {
+            return { action: "session", error: 'fleet: subagentId is required for action: "session"' };
+          }
+          const result = await director.readSession(subagentId, i.tail);
+          if (!result) {
+            return {
+              action: "session",
+              error: `fleet: transcript unavailable for "${subagentId}". Is sessionsRoot configured?`
+            };
+          }
+          return { action: "session", ...result };
+        }
+        default:
+          return { error: `fleet: unknown action "${action}". Valid: status, usage, health, session.` };
+      }
     }
   };
 }
@@ -7039,6 +7302,8 @@ function hashStr(s) {
 }
 
 // src/types/provider.ts
+init_errors();
+init_string();
 var ProviderError = class extends WrongStackError {
   status;
   retryable;
@@ -7146,6 +7411,8 @@ function resolveModelMatrix(matrix, role) {
 }
 
 // src/coordination/coordinator/error-classifier.ts
+init_errors();
+init_error();
 function classifySubagentError(err, hints = {}) {
   if (err instanceof AgentError && err.cause) {
     return classifySubagentError(err.cause, hints);
@@ -7332,6 +7599,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
   coordinatorId;
   config;
   runner;
+  sessionId;
   fleetBus;
   subagents = /* @__PURE__ */ new Map();
   /**
@@ -7366,6 +7634,11 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
     this.coordinatorId = config.coordinatorId;
     this.config = config;
     this.runner = options.runner;
+    this.sessionId = options.sessionId;
+  }
+  currentSessionId() {
+    const value = typeof this.sessionId === "function" ? this.sessionId() : this.sessionId;
+    return typeof value === "string" && value.length > 0 ? value : void 0;
   }
   /**
    * Replace the runner after construction. Used when the runner depends
@@ -7524,11 +7797,16 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       status: s.status,
       assigned: s.context.parentBridge !== null
     }));
+    const sessionId = this.currentSessionId();
     this.fleetBus?.emit({
       subagentId: this.coordinatorId,
       ts: Date.now(),
       type: "coordinator.stats",
-      payload: { ...stats, subagentStatuses }
+      payload: {
+        ...sessionId ? { sessionId } : {},
+        ...stats,
+        subagentStatuses
+      }
     });
   }
   getStatus() {
@@ -7560,7 +7838,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       taskIds.map((id) => {
         const cached = this.completedResults.find((r) => r.taskId === id);
         if (cached) return cached;
-        return new Promise((resolve11, reject) => {
+        return new Promise((resolve12, reject) => {
           const timeout = setTimeout(() => {
             this.off("task.completed", handler);
             reject(new Error(`awaitTasks timed out waiting for task "${id}"`));
@@ -7569,7 +7847,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
             if (result.taskId === id) {
               clearTimeout(timeout);
               this.off("task.completed", handler);
-              resolve11(result);
+              resolve12(result);
             }
           };
           this.on("task.completed", handler);
@@ -7731,16 +8009,20 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
     const rawTimeoutMs = subagent.config.timeoutMs;
     const rawIdleTimeoutMs = subagent.config.idleTimeoutMs;
     const configWithRosterDefaults = applyRosterBudget(subagent.config);
-    const budget = new SubagentBudget({
-      maxIterations: rawMaxIterations ?? this.config.defaultBudget?.maxIterations ?? configWithRosterDefaults.maxIterations,
-      maxToolCalls: rawMaxToolCalls ?? this.config.defaultBudget?.maxToolCalls ?? configWithRosterDefaults.maxToolCalls,
-      maxTokens: rawMaxTokens ?? this.config.defaultBudget?.maxTokens ?? configWithRosterDefaults.maxTokens,
-      maxCostUsd: rawMaxCostUsd ?? this.config.defaultBudget?.maxCostUsd ?? configWithRosterDefaults.maxCostUsd,
-      // Wall-clock cap is opt-in (explicit config / defaultBudget only); the
-      // roster no longer supplies one. Idle is the default reaper.
-      timeoutMs: rawTimeoutMs ?? this.config.defaultBudget?.timeoutMs ?? configWithRosterDefaults.timeoutMs,
-      idleTimeoutMs: rawIdleTimeoutMs ?? this.config.defaultBudget?.idleTimeoutMs ?? configWithRosterDefaults.idleTimeoutMs
-    });
+    const budget = new SubagentBudget(
+      {
+        maxIterations: rawMaxIterations ?? this.config.defaultBudget?.maxIterations ?? configWithRosterDefaults.maxIterations,
+        maxToolCalls: rawMaxToolCalls ?? this.config.defaultBudget?.maxToolCalls ?? configWithRosterDefaults.maxToolCalls,
+        maxTokens: rawMaxTokens ?? this.config.defaultBudget?.maxTokens ?? configWithRosterDefaults.maxTokens,
+        maxCostUsd: rawMaxCostUsd ?? this.config.defaultBudget?.maxCostUsd ?? configWithRosterDefaults.maxCostUsd,
+        // Wall-clock cap is opt-in (explicit config / defaultBudget only); the
+        // roster no longer supplies one. Idle is the default reaper.
+        timeoutMs: rawTimeoutMs ?? this.config.defaultBudget?.timeoutMs ?? configWithRosterDefaults.timeoutMs,
+        idleTimeoutMs: rawIdleTimeoutMs ?? this.config.defaultBudget?.idleTimeoutMs ?? configWithRosterDefaults.idleTimeoutMs
+      },
+      "auto",
+      { sessionId: () => this.currentSessionId() }
+    );
     subagent.activeBudget = budget;
     if (!this.runner) {
       return;
@@ -7837,13 +8119,15 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
             }
             return new Promise((resolveDecision) => {
               let settled = false;
-              const resolve11 = (d) => {
+              const resolve12 = (d) => {
                 if (settled) return;
                 settled = true;
                 resolveDecision(d);
               };
-              const fallback = setTimeout(() => resolve11("stop"), DECISION_TIMEOUT_MS);
+              const fallback = setTimeout(() => resolve12("stop"), DECISION_TIMEOUT_MS);
+              const sessionId = this.currentSessionId();
               budget._events?.emit("budget.threshold_reached", {
+                ...sessionId ? { sessionId } : {},
                 kind: "timeout",
                 used,
                 limit,
@@ -7858,11 +8142,11 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
                 // disagreeing, resolves as a stop). Async grants still resolve.
                 extend: (extra) => {
                   clearTimeout(fallback);
-                  queueMicrotask(() => resolve11({ extend: extra }));
+                  queueMicrotask(() => resolve12({ extend: extra }));
                 },
                 deny: () => {
                   clearTimeout(fallback);
-                  resolve11("stop");
+                  resolve12("stop");
                 }
               });
             });
@@ -7877,7 +8161,9 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
         const wallExceeded = wallLimit !== void 0 && elapsed >= wallLimit;
         const idleExceeded = idleLimit !== void 0 && budget.idleMs() >= idleLimit;
         if (idleExceeded && !wallExceeded) {
+          const sessionId = this.currentSessionId();
           budget._events?.emit("budget.threshold_reached", {
+            ...sessionId ? { sessionId } : {},
             kind: "idle_timeout",
             used: budget.idleMs(),
             limit: idleLimit ?? 0,
@@ -8168,6 +8454,10 @@ var Director = class _Director {
     const resolved = typeof this.maxContext === "function" ? this.maxContext() : this.maxContext;
     return resolved && resolved > 0 ? resolved : 128e3;
   }
+  currentSessionId() {
+    const value = typeof this.sessionIdSource === "function" ? this.sessionIdSource() : this.sessionIdSource;
+    return typeof value === "string" && value.length > 0 ? value : void 0;
+  }
   /** Optional Brain arbiter for director-level policy decisions. */
   brain;
   /**
@@ -8227,6 +8517,7 @@ var Director = class _Director {
   stateCheckpoint;
   /** Optional session writer for emitting task_* / agent_* lifecycle events. */
   sessionWriter;
+  sessionIdSource;
   /** Debounce timer for periodic manifest writes. */
   manifestTimer = null;
   manifestDebounceMs;
@@ -8234,7 +8525,7 @@ var Director = class _Director {
   maxFleetCostUsd;
   /** Max auto-extensions per subagent per budget kind before denying. */
   maxBudgetExtensions;
-  /** Sessions root for direct subagent JSONL reads (fleet_session tool). */
+  /** Sessions root for direct subagent JSONL reads (fleet tool, action: session). */
   sessionsRoot;
   /** Director run id for JSONL path resolution. */
   directorRunId;
@@ -8310,6 +8601,7 @@ var Director = class _Director {
     this.maxSpawnDepth = opts.maxSpawnDepth ?? 2;
     this.spawnDepth = opts.spawnDepth ?? 0;
     this.sessionWriter = opts.sessionWriter ?? null;
+    this.sessionIdSource = opts.sessionId ?? (() => opts.sessionWriter?.id);
     this.manifestDebounceMs = opts.manifestDebounceMs ?? 2e3;
     this.dispatchClassifier = opts.dispatchClassifier;
     this.maxFleetCostUsd = opts.directorBudget?.maxCostUsd ?? Number.POSITIVE_INFINITY;
@@ -8356,7 +8648,7 @@ var Director = class _Director {
     }
     this.coordinator = new DefaultMultiAgentCoordinator(
       { ...opts.config, coordinatorId: this.id },
-      { runner: opts.runner }
+      { runner: opts.runner, sessionId: () => this.currentSessionId() }
     );
     this.coordinator.setFleetBus(this.fleet);
     this.fleetManager?.setCoordinator(this.coordinator);
@@ -8484,6 +8776,7 @@ var Director = class _Director {
       if (this.brain) {
         void this.brain.decide({
           id: `director-budget-${e.subagentId}-${payload.kind}`,
+          sessionId: this.currentSessionId(),
           source: "director",
           question: `Should the director extend the ${payload.kind} budget for subagent ${e.subagentId}?`,
           context: [
@@ -8933,7 +9226,7 @@ var Director = class _Director {
       })),
       usage: this.usage.snapshot()
     };
-    await fsp7.mkdir(path3.dirname(this.manifestPath), { recursive: true });
+    await fsp7.mkdir(path4.dirname(this.manifestPath), { recursive: true });
     await atomicWrite(this.manifestPath, JSON.stringify(manifest, null, 2), { mode: 384 });
     return this.manifestPath;
   }
@@ -9077,11 +9370,11 @@ var Director = class _Director {
         if (cached) return cached;
         const existing = this.taskWaiters.get(id);
         if (existing) return existing.promise;
-        let resolve11;
+        let resolve12;
         const promise = new Promise((res) => {
-          resolve11 = res;
+          resolve12 = res;
         });
-        this.taskWaiters.set(id, { promise, resolve: resolve11 });
+        this.taskWaiters.set(id, { promise, resolve: resolve12 });
         return promise;
       })
     );
@@ -9164,7 +9457,7 @@ var Director = class _Director {
    */
   async readSession(subagentId, tail) {
     if (!this.sessionsRoot) return null;
-    const filePath = path3.join(this.sessionsRoot, this.directorRunId, `${subagentId}.jsonl`);
+    const filePath = path4.join(this.sessionsRoot, this.directorRunId, `${subagentId}.jsonl`);
     let raw;
     try {
       raw = await fsp7.readFile(filePath, "utf8");
@@ -9280,10 +9573,7 @@ var Director = class _Director {
       makeRollUpTool(this),
       makeTerminateTool(this),
       makeTerminateAllTool(this),
-      makeFleetStatusTool(this),
-      makeFleetUsageTool(this),
-      makeFleetSessionTool(this),
-      makeFleetHealthTool(this),
+      makeFleetTool(this),
       makeCollabDebugTool(this),
       makeFleetEmitTool(this),
       makeWorkCompleteTool(this)
@@ -9335,9 +9625,13 @@ var Director = class _Director {
 
 // src/storage/session-store.ts
 init_atomic_write();
+init_message_invariants();
+init_utils();
+init_session_scoped_path();
 
 // src/storage/file-session-writer.ts
 init_atomic_write();
+init_utils();
 
 // src/storage/session-helpers.ts
 function userInputTitle(content) {
@@ -9354,7 +9648,7 @@ var FileSessionWriter = class _FileSessionWriter {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path3.join(opts.dir, `${path3.basename(id)}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path4.join(opts.dir, `${path4.basename(id)}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.onCloseCb = opts.onClose;
@@ -9723,6 +10017,7 @@ var FileSessionWriter = class _FileSessionWriter {
       promptPreview
     });
     this.events?.emit("checkpoint.written", {
+      sessionId: this.id,
       promptIndex,
       promptPreview,
       ts: (/* @__PURE__ */ new Date()).toISOString(),
@@ -9892,6 +10187,7 @@ var FileSessionWriter = class _FileSessionWriter {
       revertedFiles: []
     });
     this.events?.emit("session.rewound", {
+      sessionId: this.id,
       toPromptIndex: targetPromptIndex,
       revertedFiles: [],
       removedEvents: removedCount
@@ -9931,7 +10227,7 @@ var FileSessionWriter = class _FileSessionWriter {
       ts: (/* @__PURE__ */ new Date()).toISOString(),
       context
     });
-    this.events?.emit("in_flight.started", { context, ts: (/* @__PURE__ */ new Date()).toISOString() });
+    this.events?.emit("in_flight.started", { sessionId: this.id, context, ts: (/* @__PURE__ */ new Date()).toISOString() });
   }
   /**
    * Close the in-flight marker. Idempotent in spirit
@@ -9946,18 +10242,16 @@ var FileSessionWriter = class _FileSessionWriter {
       ts: (/* @__PURE__ */ new Date()).toISOString(),
       reason
     });
-    this.events?.emit("in_flight.ended", { reason, ts: (/* @__PURE__ */ new Date()).toISOString() });
+    this.events?.emit("in_flight.ended", { sessionId: this.id, reason, ts: (/* @__PURE__ */ new Date()).toISOString() });
   }
 };
-function sanitizeModel(model) {
-  return model.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 40);
-}
-function generateSessionId(startedAt, model) {
+
+// src/storage/session-id.ts
+init_ulid();
+function generateSessionId(startedAt, _model) {
   const date = startedAt.slice(0, 10);
-  const time = startedAt.slice(11, 19).replace(/:/g, "-");
-  const suffix = randomBytes(2).toString("hex");
-  const modelPart = model ? `_${sanitizeModel(model)}` : "";
-  return `${date}/${time}Z${modelPart}_${suffix}`;
+  const seedTime = Number.isNaN(Date.parse(startedAt)) ? Date.now() : Date.parse(startedAt);
+  return `${date}/sess_${ulid(seedTime)}`;
 }
 
 // src/storage/session-summary.ts
@@ -10088,17 +10382,17 @@ var DefaultSessionStore = class _DefaultSessionStore {
   }
   /** Absolute path to the session index file. */
   get indexFile() {
-    return path3.join(this.dir, "_index.jsonl");
+    return path4.join(this.dir, "_index.jsonl");
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
-    return path3.join(this.dir, `${id}${ext}`);
+    return sessionScopedPath(this.dir, id, ext);
   }
   shardManifestPath(shardKey) {
-    return shardKey ? path3.join(this.dir, shardKey, "_manifest.json") : path3.join(this.dir, "_manifest.json");
+    return shardKey ? path4.join(this.dir, shardKey, "_manifest.json") : path4.join(this.dir, "_manifest.json");
   }
   shardKeyForSessionId(id) {
-    const dirName = path3.dirname(id);
+    const dirName = path4.dirname(id);
     return dirName === "." ? "" : dirName;
   }
   invalidateShardManifestBySessionId(id) {
@@ -10110,15 +10404,15 @@ var DefaultSessionStore = class _DefaultSessionStore {
    * subdirectory so sessions group naturally by day.
    */
   async ensureShardDir(id) {
-    const dirPath = path3.dirname(path3.join(this.dir, id));
+    const dirPath = path4.dirname(sessionScopedPath(this.dir, id, ""));
     await ensureDir(dirPath);
     return dirPath;
   }
   async create(meta) {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const id = meta.id && meta.id.length > 0 ? meta.id : generateSessionId(startedAt, meta.model ?? meta.provider);
+    const id = meta.id && meta.id.length > 0 ? meta.id : generateSessionId(startedAt);
     const shardDir = await this.ensureShardDir(id);
-    const file = path3.join(shardDir, `${path3.basename(id)}.jsonl`);
+    const file = this.sessionPath(id, ".jsonl");
     const t0 = Date.now();
     let handle;
     try {
@@ -10180,7 +10474,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
           // Shard directory (sessions/<date>/) — must match create() so the
           // .summary.json sidecar lands next to the JSONL instead of the
           // sessions root (where summaryFor() would never find it).
-          dir: path3.dirname(file),
+          dir: path4.dirname(file),
           filePath: file,
           secretScrubber: this.secretScrubber,
           onClose: (s) => this.appendToIndex(s)
@@ -10200,6 +10494,26 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
   }
   async load(id) {
+    return this.loadInternal(id, { full: true });
+  }
+  /**
+   * Fast-path loader that skips message reconstruction and adjacency repair.
+   *
+   * Use this for callers that only need the raw event stream + session
+   * metadata — e.g. session listers, analytics, audit, and the TUI's
+   * "events only" views. It avoids the message array build and
+   * repairToolUseAdjacency cost on large session files (a long agent
+   * run can have 50k+ events; rebuilding messages is O(events) and
+   * allocates per-block, so skipping it is a meaningful win).
+   *
+   * The returned data.messages is an empty array; data.toolCallEnds
+   * is computed from the raw events. usage is the sum across all
+   * llm_response events — same as full load().
+   */
+  async loadEventsOnly(id) {
+    return this.loadInternal(id, { full: false });
+  }
+  async loadInternal(id, mode) {
     const file = this.sessionPath(id, ".jsonl");
     const t0 = Date.now();
     let outcome = "success";
@@ -10207,93 +10521,113 @@ var DefaultSessionStore = class _DefaultSessionStore {
     let cacheHit = false;
     try {
       const s = await fsp7.stat(file);
-      const stat9 = { mtimeMs: s.mtimeMs, size: s.size };
+      const stat10 = { mtimeMs: s.mtimeMs, size: s.size };
       const cached = this._loadCache.get(id);
-      if (cached && cached.mtimeMs === stat9.mtimeMs && cached.size === stat9.size) {
+      if (cached && cached.mtimeMs === stat10.mtimeMs && cached.size === stat10.size) {
         cacheHit = true;
         this._loadCache.delete(id);
         this._loadCache.set(id, cached);
-        return cached.data;
+        if (mode.full) return cached.data;
+        return { ...cached.data, messages: [] };
       }
-      const raw = await fsp7.readFile(file, "utf8");
-      const lines = raw.split("\n").filter((l) => l.trim());
       const events = [];
       let sessionStartEvent;
       let sessionEndEvent;
       let sessionModel;
       let sessionProvider;
       let sessionPendingToolUses;
-      const messages = [];
-      const openToolUses = /* @__PURE__ */ new Set();
+      const messages = mode.full ? [] : void 0;
+      const openToolUses = mode.full ? /* @__PURE__ */ new Set() : void 0;
       let usage = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
-      for (const line of lines) {
-        try {
-          const parsed = JSON.parse(line);
-          if (parsed !== null && typeof parsed === "object" && typeof parsed.type === "string" && typeof parsed.ts === "string") {
-            const ev = parsed;
-            events.push(ev);
-            if (ev.type === "session_start" && !sessionStartEvent) {
-              sessionStartEvent = ev;
-              sessionModel = ev.model;
-              sessionProvider = ev.provider;
-            }
-            if (ev.type === "session_end") {
-              sessionEndEvent = ev;
-              sessionPendingToolUses = ev.pendingToolUses;
-            }
-            if (ev.type === "user_input") {
-              openToolUses.clear();
-              messages.push({ role: "user", content: ev.content, ts: ev.ts });
-            } else if (ev.type === "llm_response") {
-              messages.push({ role: "assistant", content: ev.content, ts: ev.ts });
-              for (const b of ev.content) {
-                if (b.type === "tool_use") openToolUses.add(b.id);
+      const stream = createReadStream(file, { encoding: "utf8" });
+      const rl = createInterface({ input: stream, crlfDelay: Infinity });
+      try {
+        for await (const line of rl) {
+          if (!line.trim()) continue;
+          try {
+            const parsed = JSON.parse(line);
+            if (parsed !== null && typeof parsed === "object" && typeof parsed.type === "string" && typeof parsed.ts === "string") {
+              const ev = parsed;
+              events.push(ev);
+              if (ev.type === "session_start" && !sessionStartEvent) {
+                sessionStartEvent = ev;
+                sessionModel = ev.model;
+                sessionProvider = ev.provider;
               }
-              usage = {
-                input: usage.input + (ev.usage.input ?? 0),
-                output: usage.output + (ev.usage.output ?? 0),
-                cacheRead: (usage.cacheRead ?? 0) + (ev.usage.cacheRead ?? 0),
-                cacheWrite: (usage.cacheWrite ?? 0) + (ev.usage.cacheWrite ?? 0)
-              };
-            } else if (ev.type === "tool_result") {
-              if (!openToolUses.has(ev.id)) {
-                this.events?.emit("session.damaged", {
-                  sessionId: id,
-                  detail: `Orphan tool_result "${ev.id}" has no matching tool_use`
-                });
-                continue;
+              if (ev.type === "session_end") {
+                sessionEndEvent = ev;
+                sessionPendingToolUses = ev.pendingToolUses;
               }
-              openToolUses.delete(ev.id);
-              const resultBlock = {
-                type: "tool_result",
-                tool_use_id: ev.id,
-                content: typeof ev.content === "string" ? ev.content : JSON.stringify(ev.content),
-                is_error: ev.isError
-              };
-              const last = messages[messages.length - 1];
-              const lastIsToolResultUser = last?.role === "user" && Array.isArray(last.content) && last.content.every((b) => b.type === "tool_result");
-              if (lastIsToolResultUser && Array.isArray(last.content)) {
-                last.content.push(resultBlock);
-              } else {
-                messages.push({ role: "user", content: [resultBlock], ts: ev.ts });
+              if (mode.full && messages !== void 0 && openToolUses !== void 0) {
+                if (ev.type === "user_input") {
+                  openToolUses.clear();
+                  messages.push({ role: "user", content: ev.content, ts: ev.ts });
+                } else if (ev.type === "llm_response") {
+                  messages.push({ role: "assistant", content: ev.content, ts: ev.ts });
+                  for (const b of ev.content) {
+                    if (b.type === "tool_use") openToolUses.add(b.id);
+                  }
+                  usage = {
+                    input: usage.input + (ev.usage.input ?? 0),
+                    output: usage.output + (ev.usage.output ?? 0),
+                    cacheRead: (usage.cacheRead ?? 0) + (ev.usage.cacheRead ?? 0),
+                    cacheWrite: (usage.cacheWrite ?? 0) + (ev.usage.cacheWrite ?? 0)
+                  };
+                } else if (ev.type === "tool_result") {
+                  if (!openToolUses.has(ev.id)) {
+                    this.events?.emit("session.damaged", {
+                      sessionId: id,
+                      detail: `Orphan tool_result "${ev.id}" has no matching tool_use`
+                    });
+                    continue;
+                  }
+                  openToolUses.delete(ev.id);
+                  const resultBlock = {
+                    type: "tool_result",
+                    tool_use_id: ev.id,
+                    content: typeof ev.content === "string" ? ev.content : JSON.stringify(ev.content),
+                    is_error: ev.isError
+                  };
+                  const last = messages[messages.length - 1];
+                  const lastIsToolResultUser = last?.role === "user" && Array.isArray(last.content) && last.content.every((b) => b.type === "tool_result");
+                  if (lastIsToolResultUser && Array.isArray(last.content)) {
+                    last.content.push(resultBlock);
+                  } else {
+                    messages.push({ role: "user", content: [resultBlock], ts: ev.ts });
+                  }
+                }
+              } else if (ev.type === "llm_response") {
+                usage = {
+                  input: usage.input + (ev.usage.input ?? 0),
+                  output: usage.output + (ev.usage.output ?? 0),
+                  cacheRead: (usage.cacheRead ?? 0) + (ev.usage.cacheRead ?? 0),
+                  cacheWrite: (usage.cacheWrite ?? 0) + (ev.usage.cacheWrite ?? 0)
+                };
               }
             }
+          } catch {
           }
-        } catch {
         }
+      } finally {
+        rl.close();
+        stream.close();
       }
-      if (openToolUses.size > 0) {
-        this.events?.emit("session.damaged", {
-          sessionId: id,
-          detail: `${openToolUses.size} tool_use blocks without matching results - replay repaired`
-        });
-      }
-      const repaired = repairToolUseAdjacency(messages);
-      if (repaired.report.changed) {
-        this.events?.emit("session.damaged", {
-          sessionId: id,
-          detail: `Repaired replay adjacency: removed ${repaired.report.removedToolUses.length} tool_use, ${repaired.report.removedToolResults.length} tool_result, ${repaired.report.removedMessages} empty messages`
-        });
+      let finalMessages = [];
+      if (mode.full && messages !== void 0 && openToolUses !== void 0) {
+        if (openToolUses.size > 0) {
+          this.events?.emit("session.damaged", {
+            sessionId: id,
+            detail: `${openToolUses.size} tool_use blocks without matching results - replay repaired`
+          });
+        }
+        const repaired = repairToolUseAdjacency(messages);
+        if (repaired.report.changed) {
+          this.events?.emit("session.damaged", {
+            sessionId: id,
+            detail: `Repaired replay adjacency: removed ${repaired.report.removedToolUses.length} tool_use, ${repaired.report.removedToolResults.length} tool_result, ${repaired.report.removedMessages} empty messages`
+          });
+        }
+        finalMessages = repaired.messages;
       }
       const meta = {
         id,
@@ -10304,27 +10638,29 @@ var DefaultSessionStore = class _DefaultSessionStore {
         pendingToolUses: sessionPendingToolUses
       };
       const toolCallEnds = extractToolCallEnds(events);
-      const data = { metadata: meta, events, messages: repaired.messages, usage, toolCallEnds };
-      if (this._loadCache.size >= _DefaultSessionStore.LOAD_CACHE_MAX_ENTRIES) {
-        const oldest = this._loadCache.keys().next().value;
-        if (oldest !== void 0) {
-          this._loadCache.delete(oldest);
+      const data = { metadata: meta, events, messages: finalMessages, usage, toolCallEnds };
+      if (mode.full) {
+        if (this._loadCache.size >= _DefaultSessionStore.LOAD_CACHE_MAX_ENTRIES) {
+          const oldest = this._loadCache.keys().next().value;
+          if (oldest !== void 0) {
+            this._loadCache.delete(oldest);
+          }
         }
+        this._loadCache.set(id, { mtimeMs: stat10.mtimeMs, size: stat10.size, data });
       }
-      this._loadCache.set(id, { mtimeMs: stat9.mtimeMs, size: stat9.size, data });
       return data;
     } catch (err) {
       outcome = "failure";
       errorMsg = toErrorMessage(err);
       throw err;
     } finally {
-      this.emitRead(id, file, "load", outcome, Date.now() - t0, errorMsg);
+      this.emitRead(id, file, mode.full ? "load" : "load_events_only", outcome, Date.now() - t0, errorMsg);
       if (cacheHit) {
         this.events?.emit("storage.cache_hit", {
           sessionId: id,
           store: "session",
           filePath: file,
-          operation: "load",
+          operation: mode.full ? "load" : "load_events_only",
           durationMs: Date.now() - t0
         });
       }
@@ -10352,14 +10688,14 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const limit = opts?.limit;
     const signal = opts?.signal;
     const out = [];
-    let stat9;
+    let stat10;
     try {
-      stat9 = await fsp7.stat(file);
+      stat10 = await fsp7.stat(file);
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw err;
     }
-    if (stat9.size === 0) return [];
+    if (stat10.size === 0) return [];
     let fh;
     try {
       fh = await fsp7.open(file, "r");
@@ -10472,14 +10808,20 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async appendToIndex(summary) {
     try {
       await ensureDir(this.dir);
-      const line = JSON.stringify(summary) + "\n";
-      await fsp7.appendFile(this.indexFile, line, "utf8");
-      this._indexCache = null;
-      this.invalidateShardManifestBySessionId(summary.id);
-      this.indexAppendCount++;
-      if (this.indexAppendCount >= _DefaultSessionStore.COMPACT_EVERY) {
-        await this.compactIndex();
-        this.indexAppendCount = 0;
+      let shouldCompact = false;
+      await withFileLock(this.indexFile, async () => {
+        const line = JSON.stringify(summary) + "\n";
+        await fsp7.appendFile(this.indexFile, line, "utf8");
+        this._indexCache = null;
+        this.invalidateShardManifestBySessionId(summary.id);
+        this.indexAppendCount++;
+        if (this.indexAppendCount >= _DefaultSessionStore.COMPACT_EVERY) {
+          shouldCompact = true;
+          this.indexAppendCount = 0;
+        }
+      });
+      if (shouldCompact) {
+        await withFileLock(this.indexFile, () => this.compactIndexInner());
       }
     } catch {
     }
@@ -10488,30 +10830,28 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async writeTombstone(id) {
     try {
       await ensureDir(this.dir);
-      const line = JSON.stringify({ action: "delete", id }) + "\n";
-      await fsp7.appendFile(this.indexFile, line, "utf8");
-      this._indexCache = null;
-      this.invalidateShardManifestBySessionId(id);
-      this.indexAppendCount++;
+      await withFileLock(this.indexFile, async () => {
+        const line = JSON.stringify({ action: "delete", id }) + "\n";
+        await fsp7.appendFile(this.indexFile, line, "utf8");
+        this._indexCache = null;
+        this.invalidateShardManifestBySessionId(id);
+        this.indexAppendCount++;
+      });
     } catch {
     }
   }
   /**
    * Compact the index: read all entries, drop tombstones, deduplicate
-   * (keep latest per session), and rewrite. Atomic via temp+rename.
+   * (keep latest per session), and rewrite atomically. Acquires the index
+   * file lock so a concurrent append (this process or another wstack in the
+   * same project) can't be overwritten by the rewrite.
    */
   async compactIndex() {
     const t0 = Date.now();
     let outcome = "success";
     let errorMsg;
     try {
-      const entries = await this.readIndex();
-      if (entries.length === 0) return;
-      const tmp = `${this.indexFile}.compact.tmp`;
-      const lines = entries.map((s) => JSON.stringify(s)).join("\n") + "\n";
-      await fsp7.writeFile(tmp, lines, "utf8");
-      await fsp7.rename(tmp, this.indexFile);
-      this._indexCache = null;
+      await withFileLock(this.indexFile, () => this.compactIndexInner());
     } catch (err) {
       outcome = "failure";
       errorMsg = toErrorMessage(err);
@@ -10519,21 +10859,34 @@ var DefaultSessionStore = class _DefaultSessionStore {
       this.emitWrite("~compact~", this.indexFile, "compact", outcome, Date.now() - t0, void 0, errorMsg);
     }
   }
+  /**
+   * Lock-free compaction body. The caller MUST already hold the index file
+   * lock (via withFileLock(this.indexFile, ...)). Uses atomicWrite for the
+   * rewrite so the temp file gets a random suffix (no collision between two
+   * compactions) and the Windows transient-EPERM rename retry.
+   */
+  async compactIndexInner() {
+    const entries = await this.readIndex();
+    if (entries.length === 0) return;
+    const lines = entries.map((s) => JSON.stringify(s)).join("\n") + "\n";
+    await atomicWrite(this.indexFile, lines, { mode: 384 });
+    this._indexCache = null;
+  }
   /**
    * Read the index file and return deduplicated session summaries.
    * Entries with a matching tombstone are filtered out.
    * Returns empty array when the index doesn't exist or is corrupt.
    */
   async readIndex() {
-    let stat9;
+    let stat10;
     try {
       const s = await fsp7.stat(this.indexFile);
-      stat9 = { mtimeMs: s.mtimeMs, size: s.size };
+      stat10 = { mtimeMs: s.mtimeMs, size: s.size };
     } catch {
       this._indexCache = null;
       return [];
     }
-    if (this._indexCache !== null && this._indexCache.mtimeMs === stat9.mtimeMs && this._indexCache.size === stat9.size) {
+    if (this._indexCache !== null && this._indexCache.mtimeMs === stat10.mtimeMs && this._indexCache.size === stat10.size) {
       return [...this._indexCache.summaries];
     }
     let raw;
@@ -10566,7 +10919,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
       if (a.startedAt > b.startedAt) return -1;
       return a.id.localeCompare(b.id);
     });
-    this._indexCache = { ...stat9, summaries };
+    this._indexCache = { ...stat10, summaries };
     return [...summaries];
   }
   /**
@@ -10577,11 +10930,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const ids = await this.collectSessionIds(this.dir);
     const summaries = await Promise.all(ids.map((id) => this.summaryFor(id).catch(() => null)));
     const valid = summaries.filter((s) => s !== null);
-    const tmp = `${this.indexFile}.tmp`;
     const lines = valid.map((s) => JSON.stringify(s)).join("\n") + "\n";
-    await fsp7.writeFile(tmp, lines, "utf8");
-    await fsp7.rename(tmp, this.indexFile);
-    this._indexCache = null;
+    await withFileLock(this.indexFile, async () => {
+      await atomicWrite(this.indexFile, lines, { mode: 384 });
+      this._indexCache = null;
+    });
     return valid.length;
   }
   async listFromDirectoryScan(limit) {
@@ -10657,7 +11010,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     return entry;
   }
   async collectSessionFilesInShard(shardKey) {
-    const dir = shardKey ? path3.join(this.dir, shardKey) : this.dir;
+    const dir = shardKey ? path4.join(this.dir, shardKey) : this.dir;
     const entries = await this.collectSessionFiles(dir, shardKey);
     return shardKey ? entries.filter((entry) => entry.id.startsWith(`${shardKey}/`)) : entries.filter((entry) => !entry.id.includes("/"));
   }
@@ -10680,13 +11033,13 @@ var DefaultSessionStore = class _DefaultSessionStore {
         if (entry.name === "_index.jsonl") continue;
         const base = entry.name.replace(/\.jsonl$/, "");
         const id = prefix ? `${prefix}/${base}` : base;
-        files.push({ id, filePath: path3.join(dir, entry.name) });
+        files.push({ id, filePath: path4.join(dir, entry.name) });
       }
     }
     const childFileArrays = await Promise.all(
       dirEntries.map((entry) => {
         const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        return this.collectSessionFiles(path3.join(dir, entry.name), childPrefix, depth + 1);
+        return this.collectSessionFiles(path4.join(dir, entry.name), childPrefix, depth + 1);
       })
     );
     return [...childFileArrays.flat(), ...files];
@@ -10719,7 +11072,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const childIdArrays = await Promise.all(
       dirEntries.map((entry) => {
         const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        return this.collectSessionIds(path3.join(dir, entry.name), childPrefix, depth + 1);
+        return this.collectSessionIds(path4.join(dir, entry.name), childPrefix, depth + 1);
       })
     );
     return [...childIdArrays.flat(), ...fileIds];
@@ -10733,8 +11086,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
     if (fromManifest) return fromManifest;
     try {
       const full = this.sessionPath(id, ".jsonl");
-      const stat9 = await fsp7.stat(full);
-      const summary = await this.summarize(id, stat9.mtime.toISOString());
+      const stat10 = await fsp7.stat(full);
+      const summary = await this.summarize(id, stat10.mtime.toISOString());
       await atomicWrite(manifest, JSON.stringify(summary), { mode: 384 }).catch((err) => {
         const msg = toErrorMessage(err);
         this.emitError(id, manifest, "summary_fallback", msg, true);
@@ -10777,18 +11130,18 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async summaryHeaderFor(ref) {
     let mtime = (/* @__PURE__ */ new Date(0)).toISOString();
     try {
-      const stat9 = await fsp7.stat(ref.filePath);
-      if (!stat9.isFile()) {
+      const stat10 = await fsp7.stat(ref.filePath);
+      if (!stat10.isFile()) {
         return {
           id: ref.id,
           title: "(damaged)",
-          startedAt: stat9.mtime.toISOString(),
+          startedAt: stat10.mtime.toISOString(),
           model: "unknown",
           provider: "unknown",
           tokenTotal: 0
         };
       }
-      mtime = stat9.mtime.toISOString();
+      mtime = stat10.mtime.toISOString();
     } catch {
       return null;
     }
@@ -10836,14 +11189,15 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async deleteSession(id) {
     const jsonlPath = this.sessionPath(id, ".jsonl");
     const summaryPath = this.sessionPath(id, ".summary.json");
-    const shardDir = path3.dirname(path3.join(this.dir, id));
-    const base = path3.basename(id);
-    const sessDir = path3.join(shardDir, base);
+    const shardDir = path4.dirname(jsonlPath);
+    const base = path4.basename(id);
+    const sessDir = path4.join(shardDir, base);
     const deletions = [
       fsp7.unlink(jsonlPath),
       fsp7.unlink(summaryPath),
-      fsp7.unlink(path3.join(shardDir, `${base}.plan.json`)),
-      fsp7.unlink(path3.join(shardDir, `${base}.todos.json`))
+      fsp7.unlink(sessionScopedPath(this.dir, id, ".plan.json")),
+      fsp7.unlink(sessionScopedPath(this.dir, id, ".tasks.json")),
+      fsp7.unlink(sessionScopedPath(this.dir, id, ".todos.json"))
     ];
     const results = await Promise.allSettled(deletions);
     for (const r of results) {
@@ -10879,17 +11233,17 @@ var DefaultSessionStore = class _DefaultSessionStore {
     let deleted = 0;
     let activeSessionId = null;
     try {
-      const raw = await fsp7.readFile(path3.join(this.dir, "active.json"), "utf8");
+      const raw = await fsp7.readFile(path4.join(this.dir, "active.json"), "utf8");
       const active = JSON.parse(raw);
       activeSessionId = active.sessionId ?? null;
     } catch {
     }
     const isPrunableJsonl = (name) => name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
     const pruneFile = async (dir, name, prefix) => {
-      const jsonlPath = path3.join(dir, name);
+      const jsonlPath = path4.join(dir, name);
       try {
-        const stat9 = await fsp7.stat(jsonlPath);
-        if (stat9.mtimeMs >= cutoff) return;
+        const stat10 = await fsp7.stat(jsonlPath);
+        if (stat10.mtimeMs >= cutoff) return;
       } catch {
         return;
       }
@@ -10906,7 +11260,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         continue;
       }
       if (!entry.isDirectory()) continue;
-      const dateDir = path3.join(this.dir, entry.name);
+      const dateDir = path4.join(this.dir, entry.name);
       const files = await fsp7.readdir(dateDir, { withFileTypes: true }).catch(() => []);
       for (const file of files) {
         if (!file.isFile() || !isPrunableJsonl(file.name)) continue;
@@ -10918,7 +11272,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const dateDir = path3.join(this.dir, entry.name);
+      const dateDir = path4.join(this.dir, entry.name);
       try {
         const remaining = await fsp7.readdir(dateDir);
         if (remaining.length === 0) {
@@ -11049,9 +11403,9 @@ function makeDirectorSessionFactory(opts) {
   let dir;
   if (opts.store) {
     store = opts.store;
-    dir = opts.sessionsRoot ? path3.join(opts.sessionsRoot, runId) : "(caller-managed)";
+    dir = opts.sessionsRoot ? path4.join(opts.sessionsRoot, runId) : "(caller-managed)";
   } else if (opts.sessionsRoot) {
-    dir = path3.join(opts.sessionsRoot, runId);
+    dir = path4.join(opts.sessionsRoot, runId);
     store = new DefaultSessionStore({ dir });
   } else {
     throw new Error("makeDirectorSessionFactory requires either `store` or `sessionsRoot`");
@@ -11078,6 +11432,9 @@ function makeDirectorSessionFactory(opts) {
 var NULL_FLEET_BUS = new FleetBus();
 
 // src/execution/auto-compaction-middleware.ts
+init_errors();
+init_token_estimate();
+init_context_evidence();
 var LEVEL_RANK = { warn: 0, soft: 1, hard: 2 };
 var MAX_DIGEST_LOG_CHARS = 4e3;
 function truncateDigest(digest) {
@@ -11274,6 +11631,7 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
       const report = await this.compactor.compact(ctx, { aggressive });
       this.recordAttempt(pressure.level, pressure.tokens, report);
       this.events?.emit("compaction.fired", {
+        sessionId: ctx.session.id,
         level: pressure.level,
         tokens: pressure.tokens,
         load: pressure.load,
@@ -11308,6 +11666,7 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
           `Auto-compaction left context above the hard threshold after ${pressure.level} compaction`
         );
         this.events?.emit("compaction.failed", {
+          sessionId: ctx.session.id,
           err: error,
           aggressive,
           level: pressure.level,
@@ -11335,6 +11694,7 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
       const error = err instanceof Error ? err : new Error(String(err));
       const fatal = this.failureMode === "throw" || this.failureMode === "throw_on_hard" && pressure.level === "hard";
       this.events?.emit("compaction.failed", {
+        sessionId: ctx.session.id,
         err: error,
         aggressive,
         level: pressure.level,
@@ -11395,6 +11755,9 @@ function adaptThresholdsForSignals(thresholds, signals) {
 }
 
 // src/execution/autonomous-runner.ts
+init_errors();
+init_assert_never();
+init_regex_guard();
 var DoneConditionChecker = class {
   constructor(condition) {
     this.condition = condition;
@@ -11573,6 +11936,9 @@ var AutonomousRunner = class {
 
 // src/storage/goal-store.ts
 init_atomic_write();
+init_error();
+init_wstack_paths();
+init_errors();
 var MAX_JOURNAL_ENTRIES = 500;
 function goalFilePath(projectRoot) {
   return resolveWstackPaths({ projectRoot }).projectGoal;
@@ -11769,12 +12135,30 @@ ${journalTail.join("\n")}` : "Recent journal: (none \u2014 this is the first ite
   };
 }
 
+// src/execution/compactor.ts
+init_token_estimate();
+init_message_invariants();
+init_context_evidence();
+
 // src/types/blocks.ts
 function isTextBlock(b) {
   return b.type === "text";
 }
 
 // src/execution/compaction-core.ts
+init_token_estimate();
+var FAILURE_PATTERN = /(error|fail|exception|timeout|enonet|eacces|eperm|enoent|abort)/i;
+var CORRECTION_PATTERN = /\b(wrong|no\b|stop\b|don'?t\b|actually|fix that|undo|revert|forget|ignore|skip)\b/i;
+var ERROR_LANG_PATTERN = /\b(error|exception|fatal|critical|crash|panic|abort|segfault|core dump|undefined is not|null pointer|typeerror|referenceerror|syntaxerror)\b/i;
+var SECURITY_PATTERN = /\b(security|vulnerability|injection|xss|csrf|secret|apikey|api.key|hardcoded|leak|exploit|cve)\b/i;
+var ARCHITECTURE_PATTERN = /\b(architecture|design|approach|strategy|pattern|refactor|migrate|restructure|decision|trade.?off)\b/i;
+var BOILERPLATE_PATTERN = /\b(files_with_matches|count|found \d+ match|directory tree|\.\.\. and \d+ more)\b/i;
+var PATH_HINT_PATTERN = /(?:(?:[A-Za-z]:)?[./\\]?[\w@.-]+(?:[\\/][\w@(). -]+)+\.[A-Za-z0-9]{1,12})/g;
+var PATH_BACKSLASH_PATTERN = /\\/g;
+var PATH_TRIM_PATTERN = /^["'`]+|["'`),;:]+$/g;
+var ERROR_LINE_PATTERN = /\b(error|exception|failed|failure|fatal|panic|timeout|denied|enoent|eacces|eperm)\b/i;
+var NEWLINE_SPLIT_PATTERN = /\r?\n/;
+var WHITESPACE_COLLAPSE_PATTERN = /\s+/g;
 function compactionDebugEnabled() {
   return process.env["NODE_ENV"] === "development" || process.env["WRONGSTACK_DEBUG"] === "1";
 }
@@ -12010,9 +12394,8 @@ function summarizeToolResultElision(block, tokens) {
 function extractPathHints(content) {
   const text = typeof content === "string" ? content : JSON.stringify(content);
   const out = /* @__PURE__ */ new Set();
-  const re = /(?:(?:[A-Za-z]:)?[./\\]?[\w@.-]+(?:[\\/][\w@(). -]+)+\.[A-Za-z0-9]{1,12})/g;
-  for (const match of text.matchAll(re)) {
-    const clean = match[0]?.replace(/\\/g, "/").replace(/^["'`]+|["'`),;:]+$/g, "");
+  for (const match of text.matchAll(PATH_HINT_PATTERN)) {
+    const clean = match[0]?.replace(PATH_BACKSLASH_PATTERN, "/").replace(PATH_TRIM_PATTERN, "");
     if (clean && clean.length <= 220) out.add(clean);
     if (out.size >= 5) break;
   }
@@ -12020,12 +12403,9 @@ function extractPathHints(content) {
 }
 function firstErrorLine(content) {
   const text = typeof content === "string" ? content : JSON.stringify(content);
-  for (const line of text.split(/\r?\n/)) {
-    if (!/\b(error|exception|failed|failure|fatal|panic|timeout|denied|enoent|eacces|eperm)\b/i.test(
-      line
-    ))
-      continue;
-    const trimmed = line.replace(/\s+/g, " ").trim();
+  for (const line of text.split(NEWLINE_SPLIT_PATTERN)) {
+    if (!ERROR_LINE_PATTERN.test(line)) continue;
+    const trimmed = line.replace(WHITESPACE_COLLAPSE_PATTERN, " ").trim();
     if (trimmed) return trimmed.slice(0, 180);
   }
   return void 0;
@@ -12072,9 +12452,9 @@ function scoreMessage(m, context) {
     if (hasToolUse2(m) || hasResult) return 0;
   }
   if (context?.failureCounts && m.role === "user" && hasToolUse2(m) === false) {
-    const isFailure = /error|fail|exception|timeout|enonet|eacces|eperm|enoent|abort/i.test(text);
-    if (isFailure) {
-      const errKey = /(error|fail|exception|timeout|enonet|eacces|eperm|enoent|abort)/i.exec(text)?.[0]?.toLowerCase() ?? "error";
+    const failureMatch = FAILURE_PATTERN.exec(text);
+    if (failureMatch) {
+      const errKey = failureMatch[0]?.toLowerCase() ?? "error";
       const count = (context.failureCounts.get(errKey) ?? 0) + 1;
       context.failureCounts.set(errKey, count);
       if (count >= 5) return 0;
@@ -12082,29 +12462,21 @@ function scoreMessage(m, context) {
     }
   }
   if (m.role === "user") {
-    if (/\b(wrong|no\b|stop\b|don'?t\b|actually|fix that|undo|revert|forget|ignore|skip)\b/i.test(
-      text
-    )) {
+    if (CORRECTION_PATTERN.test(text)) {
       return 5;
     }
   }
-  if (/\b(error|exception|fatal|critical|crash|panic|abort|segfault|core dump|undefined is not|null pointer|typeerror|referenceerror|syntaxerror)\b/i.test(
-    text
-  )) {
+  if (ERROR_LANG_PATTERN.test(text)) {
     return 5;
   }
-  if (/\b(security|vulnerability|injection|xss|csrf|secret|apikey|api.key|hardcoded|leak|exploit|cve)\b/i.test(
-    text
-  )) {
+  if (SECURITY_PATTERN.test(text)) {
     return 5;
   }
-  if (m.role === "assistant" && /\b(architecture|design|approach|strategy|pattern|refactor|migrate|restructure|decision|trade.?off)\b/i.test(
-    text
-  )) {
+  if (m.role === "assistant" && ARCHITECTURE_PATTERN.test(text)) {
     return 5;
   }
   if (hasLargeToolResult(m)) return 1;
-  if (m.role === "user" && !hasToolUse2(m) && /\b(files_with_matches|count|found \d+ match|directory tree|\.\.\. and \d+ more)\b/i.test(text)) {
+  if (m.role === "user" && !hasToolUse2(m) && BOILERPLATE_PATTERN.test(text)) {
     return 1;
   }
   return 3;
@@ -12114,6 +12486,11 @@ function buildSmartDigest(messages) {
   const failureCounts = /* @__PURE__ */ new Map();
   let noiseCount = 0;
   for (const m of messages) {
+    const isPureToolIO = Array.isArray(m.content) && m.content.length > 0 && !hasToolUse2(m) && m.content.every((b) => b.type === "tool_result");
+    if (isPureToolIO) {
+      noiseCount++;
+      continue;
+    }
     const score = scoreMessage(m, { failureCounts });
     const text = extractText(m);
     const toolCount = countToolBlocks(m);
@@ -12370,6 +12747,7 @@ var DESIGN_STACKS = ["web", "react-native", "flutter", "swiftui", "compose"];
 function isDesignStack(v) {
   return DESIGN_STACKS.includes(v);
 }
+init_wstack_paths();
 var KIT_FILE = "KIT.md";
 var TOKENS_FILE = "tokens.json";
 var FOUNDATIONS_ID = "_foundations";
@@ -12482,7 +12860,7 @@ var DefaultDesignKitLoader = class {
       }
       for (const e of entries) {
         if (!e.isDirectory()) continue;
-        const kitFile = path3.join(dir, e.name, KIT_FILE);
+        const kitFile = path4.join(dir, e.name, KIT_FILE);
         try {
           const raw = await fsp7.readFile(kitFile, "utf8");
           const fm = parseKitFrontmatter(raw);
@@ -12556,7 +12934,7 @@ var DefaultDesignKitLoader = class {
     const m = await this.find(id);
     let tokens;
     if (m) {
-      const tokensPath = path3.join(path3.dirname(m.path), TOKENS_FILE);
+      const tokensPath = path4.join(path4.dirname(m.path), TOKENS_FILE);
       try {
         const raw = await fsp7.readFile(tokensPath, "utf8");
         const parsed = JSON.parse(raw);
@@ -12583,12 +12961,12 @@ var DefaultDesignKitLoader = class {
 };
 function resolveBundledDesignKitsDir() {
   try {
-    const here = path3.dirname(fileURLToPath(import.meta.url));
+    const here = path4.dirname(fileURLToPath(import.meta.url));
     const candidates = [
-      path3.join(here, "design-kits"),
-      path3.join(here, "..", "design-kits"),
-      path3.join(here, "..", "..", "design-kits"),
-      path3.join(here, "..", "..", "..", "design-kits")
+      path4.join(here, "design-kits"),
+      path4.join(here, "..", "design-kits"),
+      path4.join(here, "..", "..", "design-kits"),
+      path4.join(here, "..", "..", "..", "design-kits")
     ];
     for (const c of candidates) {
       if (existsSync(c)) return c;
@@ -12615,7 +12993,7 @@ function _resetDesignKitLoaderMemo() {
 }
 var DESIGN_DIR = ".design";
 function designProjectDir(projectRoot) {
-  return path3.join(projectRoot, DESIGN_DIR);
+  return path4.join(projectRoot, DESIGN_DIR);
 }
 var RULE_FILES = ["rules.md", "RULES.md", "design.md"];
 var rulesCache = /* @__PURE__ */ new Map();
@@ -12624,7 +13002,7 @@ async function loadProjectDesignRules(projectRoot) {
   let rules;
   for (const name of RULE_FILES) {
     try {
-      const txt = await fsp7.readFile(path3.join(designProjectDir(projectRoot), name), "utf8");
+      const txt = await fsp7.readFile(path4.join(designProjectDir(projectRoot), name), "utf8");
       if (txt.trim()) {
         rules = txt.trim();
         break;
@@ -12645,7 +13023,7 @@ function parseOverrides(value) {
 }
 async function loadActiveKit(projectRoot) {
   try {
-    const raw = await fsp7.readFile(path3.join(designProjectDir(projectRoot), "active.json"), "utf8");
+    const raw = await fsp7.readFile(path4.join(designProjectDir(projectRoot), "active.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed.kit === "string") {
       return {
@@ -12679,7 +13057,7 @@ function applyTokenOverrides(tokens, overrides) {
 async function ensureDesignDir(projectRoot) {
   const dir = designProjectDir(projectRoot);
   await fsp7.mkdir(dir, { recursive: true });
-  const gi = path3.join(dir, ".gitignore");
+  const gi = path4.join(dir, ".gitignore");
   if (!existsSync(gi)) {
     try {
       await fsp7.writeFile(gi, "*\n");
@@ -12693,11 +13071,11 @@ async function recordKitChoice(projectRoot, kit, stack, source, isoTime, overrid
     const dir = await ensureDesignDir(projectRoot);
     const record = { kit, stack: stack ?? null };
     if (overrides && Object.keys(overrides).length > 0) record.overrides = overrides;
-    await fsp7.writeFile(path3.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
+    await fsp7.writeFile(path4.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
 `);
     const line = `- ${isoTime} \xB7 kit=${kit}${stack ? ` stack=${stack}` : ""} \xB7 via=${source}
 `;
-    await fsp7.appendFile(path3.join(dir, "decisions.md"), line);
+    await fsp7.appendFile(path4.join(dir, "decisions.md"), line);
   } catch {
   }
 }
@@ -12713,11 +13091,11 @@ async function recordOverrides(projectRoot, patch, isoTime) {
     const dir = await ensureDesignDir(projectRoot);
     const record = { kit: active.kit, stack: active.stack ?? null };
     if (Object.keys(merged).length > 0) record.overrides = merged;
-    await fsp7.writeFile(path3.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
+    await fsp7.writeFile(path4.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
 `);
     const keys = Object.keys(patch).join(",");
     await fsp7.appendFile(
-      path3.join(dir, "decisions.md"),
+      path4.join(dir, "decisions.md"),
       `- ${isoTime} \xB7 kit=${active.kit} \xB7 override=${keys} \xB7 via=set
 `
     );
@@ -12727,7 +13105,7 @@ async function recordOverrides(projectRoot, patch, isoTime) {
 }
 async function clearPersistedActiveKit(projectRoot) {
   try {
-    await fsp7.rm(path3.join(designProjectDir(projectRoot), "active.json"), { force: true });
+    await fsp7.rm(path4.join(designProjectDir(projectRoot), "active.json"), { force: true });
   } catch {
   }
 }
@@ -12900,14 +13278,14 @@ var SKIP_DIR = /* @__PURE__ */ new Set([
   ".design"
 ]);
 async function walkUiFiles(root, max = 200) {
-  const { default: fs15 } = await import('fs/promises');
+  const { default: fs16 } = await import('fs/promises');
   const { default: nodePath } = await import('path');
   const found = [];
   async function rec(dir, depth) {
     if (found.length >= max || depth > 8) return;
     let entries;
     try {
-      entries = await fs15.readdir(dir, { withFileTypes: true });
+      entries = await fs16.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -12925,13 +13303,13 @@ async function walkUiFiles(root, max = 200) {
   return found;
 }
 async function runDesignVerify(projectRoot, tokens, explicitFiles) {
-  const { default: fs15 } = await import('fs/promises');
+  const { default: fs16 } = await import('fs/promises');
   const { default: nodePath } = await import('path');
   const abs = explicitFiles && explicitFiles.length > 0 ? explicitFiles.map((f) => nodePath.isAbsolute(f) ? f : nodePath.join(projectRoot, f)) : await walkUiFiles(projectRoot);
   const files = [];
   for (const a of abs) {
     try {
-      files.push({ path: nodePath.relative(projectRoot, a), text: await fs15.readFile(a, "utf8") });
+      files.push({ path: nodePath.relative(projectRoot, a), text: await fs16.readFile(a, "utf8") });
     } catch {
     }
   }
@@ -13062,10 +13440,10 @@ function makeDesignVerifyToolCallMiddleware() {
         const p = typeof input?.path === "string" ? input.path : "";
         if (!p || !detectFrontendFile(p)) return out;
         const ctx = out.ctx;
-        const { default: fs15 } = await import('fs/promises');
+        const { default: fs16 } = await import('fs/promises');
         const { default: nodePath } = await import('path');
         const abs = nodePath.isAbsolute(p) ? p : nodePath.join(ctx.projectRoot, p);
-        const text = await fs15.readFile(abs, "utf8").catch(() => "");
+        const text = await fs16.readFile(abs, "utf8").catch(() => "");
         if (!text) return out;
         const loader = getDesignKitLoader(ctx.projectRoot);
         const rawTokens = await loader.readTokens(state.activeKit);
@@ -13365,7 +13743,7 @@ function buildRecoveryStrategies(opts) {
       label: "downgrade_model",
       async attempt(err, ctx) {
         if (!(err instanceof ProviderError)) return null;
-        if (err.status !== 429 && err.status !== 529 && err.status < 500) return null;
+        if (err.status !== 529 && err.status < 500) return null;
         return null;
       }
     }
@@ -13414,6 +13792,8 @@ var DefaultErrorHandler = class {
     return null;
   }
 };
+init_sleep();
+init_error();
 
 // src/execution/autonomy-brain.ts
 function formatDecisionSummary(decision, request) {
@@ -14044,6 +14424,7 @@ Deliverables: ${goal.deliverables.length} total, progress ${goal.progress ?? "un
     try {
       const decision = await this.opts.brain.decide({
         id: `goal-done-${goal.iterations}`,
+        sessionId: this.opts.agent.ctx.session?.id,
         source: "system",
         question: `Brainstorm returned DONE ${this.consecutiveBrainstormDone}x. Is the goal truly complete?`,
         context: [
@@ -14119,6 +14500,8 @@ function buildGoalPreamble(goal, deliverables) {
 }
 
 // src/execution/intelligent-compactor.ts
+init_token_estimate();
+init_message_invariants();
 var IntelligentCompactor = class {
   provider;
   warnThreshold;
@@ -14253,6 +14636,11 @@ var IntelligentCompactor = class {
     return [{ type: "text", text: lines.join("\n") }];
   }
 };
+
+// src/execution/parallel-eternal-engine.ts
+init_expect_defined();
+init_error();
+init_sleep();
 var GOAL_COMPLETE_MARKER2 = /^\s*\[goal[_\s-]?complete\]\s*$/im;
 var ParallelEternalEngine = class {
   constructor(opts) {
@@ -14678,6 +15066,12 @@ ${lastFew}` : "No prior iterations.",
     await saveGoal(this.goalPath, { ...current, engineState: state }, this.opts.events);
   }
 };
+
+// src/core/provider-runner.ts
+init_errors();
+
+// src/core/streaming-response-builder.ts
+init_json_repair();
 var STREAM_DRAIN_TIMEOUT_MS = 500;
 function buildResponse(state) {
   const content = [];
@@ -14823,13 +15217,14 @@ function handleMessageStop(state, ev) {
 }
 async function streamProviderToResponse(provider, req, signal, ctx, events, logger) {
   const state = createStreamingState(req.model);
+  const sessionId = ctx.session?.id;
   logger.debug("Stream started", { providerId: provider.id, model: req.model });
   const TEXT_BATCH_SIZE = 4;
   let pendingText = "";
   let pendingCount = 0;
   const flushText = () => {
     if (pendingCount > 0) {
-      events.emit("provider.text_delta", { ctx, text: pendingText });
+      events.emit("provider.text_delta", { sessionId, ctx, text: pendingText });
       pendingText = "";
       pendingCount = 0;
     }
@@ -14862,7 +15257,7 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
             const idVal = ev.id;
             const nameVal = ev.name;
             handleToolUseStart(state, { id: idVal, name: nameVal });
-            const emittedPayload = { ctx, id: idVal ?? "unknown", name: nameVal ?? "unknown" };
+            const emittedPayload = { sessionId, ctx, id: idVal ?? "unknown", name: nameVal ?? "unknown" };
             events.emit("provider.tool_use_start", emittedPayload);
             break;
           }
@@ -14873,7 +15268,7 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
             flushText();
             const stoppedName = state.tools.get(ev.id)?.name ?? "unknown";
             handleToolUseStop(state, ev);
-            events.emit("provider.tool_use_stop", { ctx, id: ev.id, name: stoppedName });
+            events.emit("provider.tool_use_stop", { sessionId, ctx, id: ev.id, name: stoppedName });
             break;
           }
           case "thinking_start":
@@ -14882,7 +15277,7 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
           case "thinking_delta":
             flushText();
             handleThinkingDelta(state, ev.text);
-            events.emit("provider.thinking_delta", { ctx, text: ev.text });
+            events.emit("provider.thinking_delta", { sessionId, ctx, text: ev.text });
             break;
           case "thinking_signature":
             handleThinkingSignature(state, ev.signature);
@@ -14914,6 +15309,7 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
         });
         flushText();
         events.emit("provider.stream_error", {
+          sessionId,
           ctx,
           eventType: String(evAny.type),
           msg: errMsg
@@ -14942,8 +15338,8 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
         });
         await Promise.race([
           drainPromise,
-          new Promise((resolve11) => {
-            drainTimer = setTimeout(resolve11, STREAM_DRAIN_TIMEOUT_MS);
+          new Promise((resolve12) => {
+            drainTimer = setTimeout(resolve12, STREAM_DRAIN_TIMEOUT_MS);
           })
         ]);
       } finally {
@@ -15014,6 +15410,7 @@ async function runProviderWithRetry(opts) {
       if (!canRetry) {
         if (isProviderErr) {
           events.emit("provider.error", {
+            sessionId: ctx.session.id,
             providerId: err.providerId,
             status: err.status,
             description,
@@ -15043,6 +15440,7 @@ async function runProviderWithRetry(opts) {
       });
       if (isProviderErr) {
         events.emit("provider.retry", {
+          sessionId: ctx.session.id,
           providerId: err.providerId,
           attempt: attemptNum,
           delayMs: delay,
@@ -15050,7 +15448,7 @@ async function runProviderWithRetry(opts) {
           description
         });
       }
-      await new Promise((resolve11, reject) => {
+      await new Promise((resolve12, reject) => {
         let settled = false;
         const cleanup = () => {
           clearTimeout(t);
@@ -15066,7 +15464,7 @@ async function runProviderWithRetry(opts) {
           if (settled) return;
           settled = true;
           cleanup();
-          resolve11();
+          resolve12();
         }, delay);
         if (signal.aborted) {
           onAbort();
@@ -15117,6 +15515,8 @@ var DefaultRetryPolicy = class {
 };
 
 // src/models/llm-selector.ts
+init_expect_defined();
+init_token_estimate();
 var DEFAULT_SYSTEM_PROMPT = readBundledInstructionText("llm/llm-selector.md");
 function formatMessages(messages, maxTokens = 2048) {
   const lines = [];
@@ -15287,6 +15687,8 @@ IMPORTANT: Total conversation (${totalTokens} tokens) exceeds budget (${effectiv
 };
 
 // src/execution/selective-compactor.ts
+init_token_estimate();
+init_message_invariants();
 var SelectiveCompactor = class {
   provider;
   selector;
@@ -15549,7 +15951,7 @@ var DefaultSkillLoader = class {
         const entries = await fsp7.readdir(dir, { withFileTypes: true });
         for (const e of entries) {
           if (!e.isDirectory()) continue;
-          const skillFile = path3.join(dir, e.name, "SKILL.md");
+          const skillFile = path4.join(dir, e.name, "SKILL.md");
           try {
             const raw = await fsp7.readFile(skillFile, "utf8");
             const meta = parseFrontmatter(raw);
@@ -15620,7 +16022,7 @@ var DefaultSkillLoader = class {
     if (cached !== void 0) return cached;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
-    const savePath = path3.join(path3.dirname(m.path), "SKILL.save.md");
+    const savePath = path4.join(path4.dirname(m.path), "SKILL.save.md");
     let result;
     try {
       result = await fsp7.readFile(savePath, "utf8");
@@ -15690,6 +16092,8 @@ function parseDescriptionFromText(desc) {
 
 // src/storage/prompt-store.ts
 init_atomic_write();
+init_slug();
+init_ulid();
 var SCHEMA_VERSION = 2;
 function migratePromptEntry(raw) {
   if (!raw || typeof raw !== "object") return null;
@@ -15755,7 +16159,7 @@ var DefaultPromptStore = class {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fsp7.readFile(path3.join(this.dir, file), "utf8")
+            await fsp7.readFile(path4.join(this.dir, file), "utf8")
           );
           const migrated = migratePromptEntry(raw.entry);
           if (migrated) entries.push(migrated);
@@ -15769,7 +16173,7 @@ var DefaultPromptStore = class {
     );
   }
   async get(id) {
-    const file = path3.join(this.dir, `${id}.json`);
+    const file = path4.join(this.dir, `${id}.json`);
     try {
       const raw = JSON.parse(await fsp7.readFile(file, "utf8"));
       return migratePromptEntry(raw.entry);
@@ -15779,12 +16183,12 @@ var DefaultPromptStore = class {
   }
   async save(entry) {
     await ensureDir(this.dir);
-    const file = path3.join(this.dir, `${entry.id}.json`);
+    const file = path4.join(this.dir, `${entry.id}.json`);
     const raw = { version: SCHEMA_VERSION, entry };
     await atomicWrite(file, JSON.stringify(raw, null, 2));
   }
   async delete(id) {
-    const file = path3.join(this.dir, `${id}.json`);
+    const file = path4.join(this.dir, `${id}.json`);
     try {
       await fsp7.unlink(file);
       return true;
@@ -15873,7 +16277,7 @@ var DefaultPromptLoader = class {
   constructor(opts) {
     this.projectStore = typeof opts.paths.inProjectPrompts === "string" ? new DefaultPromptStore(opts.paths.inProjectPrompts) : void 0;
     this.userStore = typeof opts.paths.globalPrompts === "string" ? new DefaultPromptStore(opts.paths.globalPrompts) : void 0;
-    this.builtinDir = opts.bundledDir ? path3.join(opts.bundledDir, "prompts") : void 0;
+    this.builtinDir = opts.bundledDir ? path4.join(opts.bundledDir, "prompts") : void 0;
   }
   async list() {
     if (this.cache) return this.cache;
@@ -16005,7 +16409,7 @@ async function walkJson(dir) {
     return out;
   }
   for (const e of entries) {
-    const full = path3.join(dir, e.name);
+    const full = path4.join(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkJson(full));
     } else if (e.name.endsWith(".json") && e.name !== "index.json" && e.name !== "schema.json") {
@@ -16051,7 +16455,7 @@ function isSubsequence(needle, hay) {
 function renderPrompt(entry, values = {}) {
   const declared = new Map((entry.variables ?? []).map((v) => [v.name, v]));
   const missing = [];
-  const invalid = [];
+  const invalid2 = [];
   const text = entry.content.replace(/\{\{\s*([\w.-]+)\s*\}\}/g, (whole, rawName) => {
     const name = rawName.trim();
     if (Object.hasOwn(values, name) && values[name] !== void 0) {
@@ -16069,10 +16473,10 @@ function renderPrompt(entry, values = {}) {
       }
     }
     if (v.enum && v.enum.length > 0 && Object.hasOwn(values, v.name) && values[v.name] !== void 0 && values[v.name] !== "" && !v.enum.includes(values[v.name])) {
-      invalid.push(v.name);
+      invalid2.push(v.name);
     }
   }
-  return { text, missing, invalid };
+  return { text, missing, invalid: invalid2 };
 }
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -16146,11 +16550,19 @@ function readPolicy(ctx) {
   if (typeof candidate.preserveK !== "number" || !candidate.thresholds) return null;
   return candidate;
 }
+init_error();
+init_expect_defined();
+init_json_schema_validate();
+init_tool_subject();
+init_tool_output_serializer();
+init_wstack_paths();
+init_errors();
 
 // src/types/tool-markers.ts
 var MALFORMED_ARG_MARKERS = ["__raw", "__raw_arguments", "_raw"];
 
 // src/execution/tool-executor.ts
+init_tool_result_render_mode();
 var ToolExecutor = class _ToolExecutor {
   constructor(registry, opts) {
     this.registry = registry;
@@ -16200,6 +16612,64 @@ var ToolExecutor = class _ToolExecutor {
     const mode = resolveToolResultRenderMode(modes, toolName);
     renderer.setResultRenderMode(toolName, mode);
   }
+  toolLogBase(ctx, use, toolName, durationMs) {
+    return {
+      event: "tool.execution",
+      traceId: ctx.traceId,
+      sessionId: ctx.session.id,
+      agentId: ctx.agentId ?? "<unknown>",
+      toolName,
+      toolUseId: use.id,
+      durationMs
+    };
+  }
+  logToolSuccess(ctx, use, toolName, durationMs, outputChars) {
+    this.opts.events?.emit("tool.completed", {
+      name: toolName,
+      id: use.id,
+      sessionId: ctx.session.id,
+      ...ctx.traceId ? { traceId: ctx.traceId } : {},
+      agentId: ctx.agentId ?? "<unknown>",
+      durationMs,
+      outputChars
+    });
+    this.opts.logger?.info("tool execution completed", {
+      ...this.toolLogBase(ctx, use, toolName, durationMs),
+      outcome: "success",
+      isError: false,
+      outputChars
+    });
+  }
+  logToolFailure(ctx, use, toolName, durationMs, err) {
+    const { category, retryable, detail } = classifyToolError(err);
+    const structured = isWrongStackError(err);
+    const structuredError = structured ? {
+      errorCode: err.code,
+      errorSubsystem: err.subsystem,
+      errorSeverity: err.severity
+    } : {};
+    this.opts.events?.emit("tool.failed", {
+      name: toolName,
+      id: use.id,
+      sessionId: ctx.session.id,
+      ...ctx.traceId ? { traceId: ctx.traceId } : {},
+      agentId: ctx.agentId ?? "<unknown>",
+      durationMs,
+      category,
+      retryable,
+      ...detail ? { detail } : {},
+      ...structuredError
+    });
+    this.opts.logger?.warn("tool execution failed", {
+      ...this.toolLogBase(ctx, use, toolName, durationMs),
+      outcome: "failure",
+      isError: true,
+      errorCategory: category,
+      retryable,
+      errorDetail: detail,
+      ...structuredError
+    });
+  }
   /**
    * Execute a batch of tool uses using the configured strategy.
    * Returns the execution results and the remaining output budget.
@@ -16330,7 +16800,8 @@ ${errorDetails}`,
         "tool.has_dangerous_capabilities": toolCapsForAudit.length > 0
       });
       try {
-        let { block: result, bytes } = await this.executeTool(tool, use, ctx, budget);
+        const producedText = await this.produceToolOutput(tool, use, ctx, budget);
+        let { block: result, bytes } = this.settleToolOutput(tool, use, producedText, budget);
         budget -= bytes;
         if (this.opts.hookRunner?.has("PostToolUse")) {
           const post = await this.opts.hookRunner.postToolUse(
@@ -16347,13 +16818,18 @@ ${post.additionalContext}`;
             budget = Math.max(0, budget - Buffer.byteLength(appended, "utf8"));
           }
         }
+        const outputChars = typeof result.content === "string" ? result.content.length : 0;
         span?.setAttribute("tool.is_error", !!result.is_error);
-        span?.setAttribute(
-          "tool.output_bytes",
-          typeof result.content === "string" ? result.content.length : 0
-        );
+        span?.setAttribute("tool.output_bytes", outputChars);
+        this.logToolSuccess(ctx, use, tool.name, Date.now() - start, outputChars);
         return { result, tool, durationMs: Date.now() - start };
       } catch (err) {
+        if (isWrongStackError(err)) {
+          if (err instanceof Error) span?.recordError(err);
+          span?.setAttribute("tool.is_error", true);
+          this.logToolFailure(ctx, use, tool.name, Date.now() - start, err);
+          throw err;
+        }
         const msg = toErrorMessage(err);
         const scrubbed = this.opts.secretScrubber.scrub(msg);
         const { category, retryable, detail } = classifyToolError(err);
@@ -16371,6 +16847,7 @@ ${post.additionalContext}`;
         span?.setAttribute("tool.error_category", category);
         span?.setAttribute("tool.error_retryable", retryable);
         if (detail) span?.setAttribute("tool.error_detail", detail);
+        this.logToolFailure(ctx, use, tool.name, Date.now() - start, err);
         return { result, tool, durationMs: Date.now() - start };
       } finally {
         span?.end();
@@ -16380,7 +16857,8 @@ ${post.additionalContext}`;
       try {
         return await runOne(use);
       } catch (err) {
-        const msg = toErrorMessage(err);
+        const isStructured = isWrongStackError(err);
+        const msg = isStructured ? err.describe() : toErrorMessage(err);
         const scrubbed = this.opts.secretScrubber.scrub(msg);
         const { category, retryable, detail } = classifyToolError(err);
         const tool = this.registry.get(use.name);
@@ -16390,7 +16868,7 @@ ${post.additionalContext}`;
         const result = {
           type: "tool_result",
           tool_use_id: use.id,
-          content: `Tool "${use.name}" execution failed: ${scrubbed}`,
+          content: isStructured ? scrubbed : `Tool "${use.name}" execution failed: ${scrubbed}`,
           is_error: true
         };
         budget = this.budgetForString(result.content, budget);
@@ -16433,7 +16911,23 @@ ${post.additionalContext}`;
    * to call a tool" and "tool.executed".
    */
   async executeTool(tool, use, ctx, budget) {
+    const text = await this.produceToolOutput(tool, use, ctx, budget);
+    return this.settleToolOutput(tool, use, text, budget);
+  }
+  /**
+   * Async "produce" phase: run the tool, serialize, scrub, and spill an
+   * oversized output to a disk artifact. Returns the pre-cap text. This is
+   * the long-running, concurrency-safe part — it touches NO shared budget
+   * state, so multiple invocations can run in parallel without racing.
+   *
+   * The `budgetHint` only gates the disk-spill threshold (a heuristic for
+   * "is this output large enough to persist"); it is NOT the output cap.
+   * The authoritative cap is applied synchronously in settleToolOutput()
+   * against the live budget.
+   */
+  async produceToolOutput(tool, use, ctx, budgetHint) {
     this.opts.events?.emit("tool.started", {
+      sessionId: ctx.session.id,
       name: tool.name,
       id: use.id,
       input: use.input
@@ -16442,8 +16936,20 @@ ${post.additionalContext}`;
     const output = await this.runWithTimeout(tool, use.input, ctx.signal, ctx, use.id);
     const text = this.serializer.serialize(output, { toolName: tool.name, input: use.input, tool });
     const scrubbed = this.opts.secretScrubber.scrub(text);
-    const withArtifact = await maybePersistLargeToolOutput(tool.name, scrubbed, budget);
-    const { text: capped, newBudget } = this.serializer.enforceCap(withArtifact, budget);
+    return maybePersistLargeToolOutput(tool.name, scrubbed, budgetHint);
+  }
+  /**
+   * Synchronous "settle" phase: enforce the output cap against the CURRENT
+   * budget, render, and build the result block. This MUST stay synchronous
+   * (no awaits) so that, in the parallel/smart strategies, two tools settling
+   * one after another against the shared closure budget can't interleave a
+   * stale read with a write. The first to settle consumes its bytes; the next
+   * settles against the reduced budget; once the budget hits 0, enforceCap
+   * truncates — making the per-iteration cap genuinely CUMULATIVE across
+   * parallel tools instead of degrading into a per-tool cap.
+   */
+  settleToolOutput(tool, use, text, budget) {
+    const { text: capped, newBudget } = this.serializer.enforceCap(text, budget);
     this.hintRenderMode(tool.name);
     this.opts.renderer?.writeToolResult(tool.name, capped, false);
     return {
@@ -16496,7 +17002,12 @@ ${post.additionalContext}`;
     let finalOutput;
     let sawFinal = false;
     if (!tool.executeStream) {
-      throw new Error(`Tool "${tool.name}" does not support streaming execution`);
+      throw new ToolError({
+        message: `Tool "${tool.name}" does not support streaming execution`,
+        code: "TOOL_EXECUTION_FAILED",
+        toolName: tool.name,
+        context: { reason: "streaming_not_supported" }
+      });
     }
     const stream = tool.executeStream(input, ctx, { signal });
     const iter = stream[Symbol.asyncIterator]();
@@ -16506,6 +17017,7 @@ ${post.additionalContext}`;
     let lastProgressEmitAt = 0;
     const emitProgress = (ev) => {
       this.opts.events?.emit("tool.progress", {
+        sessionId: ctx.session.id,
         name: tool.name,
         id: toolUseId ?? "<unknown>",
         event: ev
@@ -16561,7 +17073,12 @@ ${progressTail}`;
       await iter.return?.(void 0);
     }
     if (!sawFinal) {
-      throw new Error(`tool "${tool.name}" executeStream completed without a 'final' event`);
+      throw new ToolError({
+        message: `tool "${tool.name}" executeStream completed without a 'final' event`,
+        code: "TOOL_EXECUTION_FAILED",
+        toolName: tool.name,
+        context: { reason: "missing_final_event" }
+      });
     }
     return finalOutput;
   }
@@ -16685,6 +17202,15 @@ function classifyToolError(err) {
   if (err instanceof Error && err.message.includes("validation")) {
     return { category: "validation" /* VALIDATION */, retryable: false, detail: "validation" };
   }
+  if (err instanceof WrongStackError) {
+    const wse = err;
+    const category = wse.severity === "warning" ? "transient" /* TRANSIENT */ : "fatal" /* FATAL */;
+    return {
+      category,
+      retryable: wse.recoverable,
+      detail: `${wse.code} [${wse.subsystem}]`
+    };
+  }
   return {
     category: "fatal" /* FATAL */,
     retryable: false,
@@ -16712,11 +17238,11 @@ async function maybePersistLargeToolOutput(toolName, content, budget) {
     return content;
   }
   try {
-    const dir = path3.join(wstackGlobalRoot(), "tool-output");
+    const dir = path4.join(wstackGlobalRoot(), "tool-output");
     await fsp7.mkdir(dir, { recursive: true });
     const safeTool = toolName.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    const filePath = path3.join(dir, `${stamp}-${safeTool}-${randomUUID()}.log`);
+    const filePath = path4.join(dir, `${stamp}-${safeTool}-${randomUUID()}.log`);
     await fsp7.writeFile(filePath, content, "utf8");
     return content + `
 [full tool output: ${bytes} bytes at ${filePath}; read/grep that file selectively instead of re-running or requesting more output]`;
@@ -16726,6 +17252,8 @@ async function maybePersistLargeToolOutput(toolName, content, budget) {
 }
 
 // src/infrastructure/context-manager.ts
+init_message_invariants();
+init_token_estimate();
 var CONTEXT_MANAGER_TOOL_NAME = "context_manager";
 function roughEstimate(messages) {
   return estimateMessageTokens(messages);
@@ -16981,6 +17509,10 @@ function createContextManagerTool(opts = {}) {
   };
 }
 var contextManagerTool = createContextManagerTool();
+
+// src/infrastructure/logger.ts
+init_color();
+init_term();
 var LEVEL_RANK2 = {
   error: 0,
   warn: 1,
@@ -17044,7 +17576,7 @@ var DefaultLogger = class _DefaultLogger {
     this.stderr = opts.stderr !== false;
     this.maxFileBytes = opts.maxFileBytes ?? 10 * 1024 * 1024;
     if (this.file) {
-      const dir = path3.dirname(this.file);
+      const dir = path4.dirname(this.file);
       this._tail = this._tail.then(async () => {
         await fsp7.mkdir(dir, { recursive: true });
       }).catch(() => void 0);
@@ -17346,18 +17878,18 @@ init_atomic_write();
 function modePrompt(id) {
   for (const dir of modePromptDirCandidates()) {
     try {
-      return readFileSync(path3.join(dir, `${id}.md`), "utf8").trimEnd();
+      return readFileSync(path4.join(dir, `${id}.md`), "utf8").trimEnd();
     } catch {
     }
   }
   return "";
 }
 function modePromptDirCandidates() {
-  const here = path3.dirname(fileURLToPath(import.meta.url));
+  const here = path4.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path3.resolve(here, "../../instructions/modes"),
-    path3.resolve(here, "../instructions/modes"),
-    path3.resolve(here, "instructions/modes")
+    path4.resolve(here, "../../instructions/modes"),
+    path4.resolve(here, "../instructions/modes"),
+    path4.resolve(here, "instructions/modes")
   ];
   return candidates.sort((a, b) => Number(!isDirectory3(a)) - Number(!isDirectory3(b)));
 }
@@ -17474,7 +18006,7 @@ var DEFAULT_MODES = [
     description: "Current-data research \u2014 search web, verify, inject findings into context",
     prompt: modePrompt("research-web"),
     tags: ["research", "web", "current-data", "up-to-date"],
-    toolPreferences: ["web_search", "web_fetch", "search", "fetch", "context_manager"],
+    toolPreferences: ["search/fetch", "search/fetch", "search", "fetch", "context_manager"],
     suggestedSkills: ["research-web", "tech-stack", "node-modern", "security-scanner", "react-modern"]
   }
 ];
@@ -17526,7 +18058,7 @@ var DefaultModeStore = class {
   }
   async loadActiveMode() {
     try {
-      const configPath = path3.join(this.configDir, "mode.json");
+      const configPath = path4.join(this.configDir, "mode.json");
       const content = await fsp7.readFile(configPath, "utf8");
       const data = JSON.parse(content);
       this.activeModeId = data.activeMode ?? null;
@@ -17537,7 +18069,7 @@ var DefaultModeStore = class {
   async saveActiveMode() {
     try {
       await fsp7.mkdir(this.configDir, { recursive: true });
-      const configPath = path3.join(this.configDir, "mode.json");
+      const configPath = path4.join(this.configDir, "mode.json");
       await atomicWrite(
         configPath,
         JSON.stringify({ activeMode: this.activeModeId }, null, 2)
@@ -17552,11 +18084,11 @@ async function loadProjectModes(modesDir) {
     const entries = await fsp7.readdir(modesDir);
     for (const entry of entries) {
       if (!entry.endsWith(".md") && !entry.endsWith(".txt")) continue;
-      const filePath = path3.join(modesDir, entry);
-      const stat9 = await fsp7.stat(filePath);
-      if (!stat9.isFile()) continue;
+      const filePath = path4.join(modesDir, entry);
+      const stat10 = await fsp7.stat(filePath);
+      if (!stat10.isFile()) continue;
       const content = await fsp7.readFile(filePath, "utf8");
-      const id = path3.basename(entry, path3.extname(entry));
+      const id = path4.basename(entry, path4.extname(entry));
       modes.push({
         id,
         name: id.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()),
@@ -17572,7 +18104,7 @@ async function loadProjectModes(modesDir) {
 async function loadUserModes(modesDir) {
   const modes = [];
   try {
-    const manifestPath = path3.join(modesDir, "modes.json");
+    const manifestPath = path4.join(modesDir, "modes.json");
     const content = await fsp7.readFile(manifestPath, "utf8");
     const manifest = JSON.parse(content);
     for (const mode of manifest.modes) {
@@ -17585,6 +18117,9 @@ async function loadUserModes(modesDir) {
 
 // src/models/models-registry.ts
 init_atomic_write();
+init_error();
+init_merge_models_payload();
+init_errors();
 var DEFAULT_URL = "https://models.dev/api.json";
 var ENV_URL_KEY = "WRONGSTACK_MODELS_DEV_URL";
 var DEFAULT_TTL_SECONDS = 24 * 3600;
@@ -17618,6 +18153,14 @@ var DefaultModelsRegistry = class {
   payload;
   /** Memoised overlay payload (in-memory / fetched / file). */
   overlayPayload;
+  /**
+   * Extra providers injected at runtime via `mergeOverlay()` — e.g. an
+   * openai-compatible server (omniroute, LiteLLM, …) auto-discovered from its
+   * `/v1/models` endpoint at boot. Applied LAST (on top of base + curated
+   * overlay) and re-applied across `refresh()` so the discovered catalog
+   * survives a models.dev refetch.
+   */
+  extraOverlay;
   fetchedAt;
   cacheFile;
   url;
@@ -17642,7 +18185,7 @@ var DefaultModelsRegistry = class {
     this.overlay = opts.overlay;
     this.overlayUrl = opts.overlayUrl;
     this.overlayFile = opts.overlayFile;
-    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path3.join(path3.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
+    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path4.join(path4.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
   }
   async load(opts = {}) {
     if (this.payload && !opts.force) return this.payload;
@@ -17653,9 +18196,22 @@ var DefaultModelsRegistry = class {
     }
     const overlay = await this.loadOverlay(opts);
     const base = await this.loadBase(opts, Object.keys(overlay).length > 0);
-    this.payload = mergeModelsPayload(base, overlay);
+    this.payload = this.withExtraOverlay(mergeModelsPayload(base, overlay));
     return this.payload;
   }
+  /**
+   * Merge an additional provider payload on top of the resolved catalog. Used
+   * for runtime-discovered openai-compatible providers. Remembered so it is
+   * re-applied across `refresh()`. A no-op for an empty payload.
+   */
+  mergeOverlay(payload) {
+    if (!hasEntries(payload)) return;
+    this.extraOverlay = this.extraOverlay ? mergeModelsPayload(this.extraOverlay, payload) : payload;
+    if (this.payload) this.payload = mergeModelsPayload(this.payload, this.extraOverlay);
+  }
+  withExtraOverlay(payload) {
+    return this.extraOverlay ? mergeModelsPayload(payload, this.extraOverlay) : payload;
+  }
   /**
    * Load the models.dev base payload: fresh cache → network → stale cache.
    * On total failure, degrade to `{}` (so a non-empty overlay still drives
@@ -17704,7 +18260,11 @@ var DefaultModelsRegistry = class {
       });
       clearTimeout(timeout);
       if (!res.ok) {
-        throw new Error(`ModelsRegistry: HTTP ${res.status} fetching ${this.url}`);
+        throw new FetchError({
+          message: `ModelsRegistry: HTTP ${res.status} fetching ${this.url}`,
+          status: res.status,
+          context: { url: this.url, op: "refreshModels" }
+        });
       }
       const json = await res.json();
       this.fetchedAt = /* @__PURE__ */ new Date();
@@ -17718,7 +18278,11 @@ var DefaultModelsRegistry = class {
     } catch (err) {
       clearTimeout(timeout);
       if (err instanceof Error && err.name === "AbortError") {
-        throw new Error(`ModelsRegistry: fetch timed out after ${this.refreshTimeoutMs}ms`);
+        throw new FetchError({
+          message: `ModelsRegistry: fetch timed out after ${this.refreshTimeoutMs}ms`,
+          status: 408,
+          context: { url: this.url, op: "refreshModels", timedOut: true }
+        });
       }
       throw err;
     }
@@ -17754,7 +18318,11 @@ var DefaultModelsRegistry = class {
         method: "GET",
         headers: { accept: "application/json" }
       });
-      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      if (!res.ok) throw new FetchError({
+        message: `HTTP ${res.status}`,
+        status: res.status,
+        context: { url: this.url, op: "refreshModels" }
+      });
       const json = await res.json();
       const envelope = {
         fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -17788,7 +18356,7 @@ var DefaultModelsRegistry = class {
   async refresh() {
     const base = await this.refreshBase();
     const overlay = await this.loadOverlay({ force: true });
-    this.payload = mergeModelsPayload(base, overlay);
+    this.payload = this.withExtraOverlay(mergeModelsPayload(base, overlay));
     return this.payload;
   }
   async listProviders() {
@@ -17866,7 +18434,7 @@ var DefaultModelsRegistry = class {
   }
   /** Used by `wstack models refresh` to expose where the cache lives. */
   cacheLocation() {
-    return path3.resolve(this.cacheFile);
+    return path4.resolve(this.cacheFile);
   }
 };
 function formatAge(seconds) {
@@ -18048,6 +18616,7 @@ var NoopMetricsSink = class {
 };
 
 // src/observability/health.ts
+init_error();
 var SEVERITY = {
   healthy: 0,
   degraded: 1,
@@ -18080,9 +18649,9 @@ var DefaultHealthRegistry = class {
   }
   async runOne(check) {
     let timer = null;
-    const timeout = new Promise((resolve11) => {
+    const timeout = new Promise((resolve12) => {
       timer = setTimeout(
-        () => resolve11({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
+        () => resolve12({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
         this.timeoutMs
       );
     });
@@ -18205,6 +18774,7 @@ function wireMetricsToEvents(events, sink) {
 }
 
 // src/observability/prometheus.ts
+init_error();
 var NUMBER_FORMAT_INFINITY = "NaN";
 function escapeLabelValue(v) {
   return v.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/"/g, '\\"');
@@ -18321,14 +18891,14 @@ async function startMetricsServer(opts) {
     const { createServer } = await import('http');
     server = createServer(listener);
   }
-  await new Promise((resolve11, reject) => {
+  await new Promise((resolve12, reject) => {
     const onError = (err) => {
       server.off("listening", onListening);
       reject(err);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve11();
+      resolve12();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -18340,8 +18910,8 @@ async function startMetricsServer(opts) {
   return {
     port: boundPort,
     url: `${protocol}://${host}:${boundPort}${path32}`,
-    close: () => new Promise((resolve11, reject) => {
-      server.close((err) => err ? reject(err) : resolve11());
+    close: () => new Promise((resolve12, reject) => {
+      server.close((err) => err ? reject(err) : resolve12());
     })
   };
 }
@@ -18607,6 +19177,9 @@ function startOtlpTraceExporter(opts) {
   };
 }
 
+// src/sdd/critical-path.ts
+init_expect_defined();
+
 // src/types/task-graph.ts
 function computeTaskProgress(graph) {
   let completed = 0;
@@ -19518,13 +20091,22 @@ var SddBoardProjector = class _SddBoardProjector {
       this.timer = null;
     }
     const snap = this.build();
-    this.o.events.emit("sdd.board.snapshot", { runId: this.o.runId, snapshot: snap });
+    const sessionId = this.currentSessionId();
+    this.o.events.emit("sdd.board.snapshot", {
+      ...sessionId ? { sessionId } : {},
+      runId: this.o.runId,
+      snapshot: snap
+    });
     if (this.o.store) {
       const store = this.o.store;
       this.lastSave = this.lastSave.then(() => store.saveSnapshot(snap)).catch(() => {
       });
     }
   }
+  currentSessionId() {
+    const value = typeof this.o.sessionId === "function" ? this.o.sessionId() : this.o.sessionId;
+    return typeof value === "string" && value.length > 0 ? value : void 0;
+  }
 };
 
 // src/sdd/sdd-board-store.ts
@@ -19534,16 +20116,16 @@ var SddBoardStore = class {
   indexPath;
   constructor(opts) {
     this.baseDir = opts.baseDir;
-    this.indexPath = path3.join(this.baseDir, "_index.json");
+    this.indexPath = path4.join(this.baseDir, "_index.json");
   }
   snapshotPath(runId) {
-    return path3.join(this.baseDir, `${this.safe(runId)}.json`);
+    return path4.join(this.baseDir, `${this.safe(runId)}.json`);
   }
   eventsPath(runId) {
-    return path3.join(this.baseDir, `${this.safe(runId)}.events.jsonl`);
+    return path4.join(this.baseDir, `${this.safe(runId)}.events.jsonl`);
   }
   controlPath(runId) {
-    return path3.join(this.baseDir, `${this.safe(runId)}.control.jsonl`);
+    return path4.join(this.baseDir, `${this.safe(runId)}.control.jsonl`);
   }
   async saveSnapshot(snapshot) {
     await ensureDir(this.baseDir);
@@ -19649,6 +20231,9 @@ var SddBoardStore = class {
 };
 
 // src/sdd/spec-builder.ts
+init_expect_defined();
+init_error();
+init_errors();
 function buildQuestioningPrompt(session, min, max) {
   const answered = session.answers.length;
   const remaining = Math.max(0, min - answered);
@@ -20202,6 +20787,8 @@ var AISpecBuilder = class {
 };
 
 // src/sdd/task-tracker.ts
+init_errors();
+init_error();
 var TaskTracker = class {
   constructor(opts) {
     this.opts = opts;
@@ -21026,10 +21613,15 @@ function isExplanatoryText(text) {
   const lower = text.toLowerCase();
   return lower.startsWith("i'") || lower.startsWith("i will") || lower.startsWith("let me") || lower.startsWith("here's my") || lower.startsWith("here is my") || lower.startsWith("i'm going to") || lower.startsWith("first, let me") || lower.startsWith("sure") || lower.startsWith("of course") || lower.startsWith("okay") || lower.startsWith("ok,") || lower.startsWith("sounds good") || lower.startsWith("no problem") || text.split("\n").length < 3 && !text.includes(".");
 }
+
+// src/worktree/worktree-manager.ts
+init_child_env();
+init_error();
 var MAX_SLUG = 40;
 var WorktreeManager = class {
   projectRoot;
   events;
+  sessionIdSource;
   gitBin;
   runGit;
   /** Keyed by ownerId. */
@@ -21038,6 +21630,7 @@ var WorktreeManager = class {
   constructor(opts) {
     this.projectRoot = resolve(opts.projectRoot);
     this.events = opts.events;
+    this.sessionIdSource = opts.sessionId;
     this.gitBin = opts.gitBin ?? "git";
     this.runGit = opts.run ?? ((args, cwd) => this.defaultRun(args, cwd));
   }
@@ -21631,7 +22224,15 @@ ${check.stderr}`);
     if (patch) Object.assign(handle, patch);
   }
   emit(event, payload) {
-    this.events?.emit(event, payload);
+    const sessionId = this.currentSessionId();
+    this.events?.emit(
+      event,
+      sessionId && payload && typeof payload === "object" ? { ...payload, sessionId } : payload
+    );
+  }
+  currentSessionId() {
+    const value = typeof this.sessionIdSource === "function" ? this.sessionIdSource() : this.sessionIdSource;
+    return typeof value === "string" && value.length > 0 ? value : void 0;
   }
   defaultRun(args, cwd) {
     return new Promise((res) => {
@@ -21784,6 +22385,10 @@ async function applySddLifecycle(op, opts) {
   }
 }
 
+// src/sdd/sdd-parallel-run.ts
+init_expect_defined();
+init_errors();
+
 // src/sdd/sdd-task-decomposer.ts
 var SddTaskDecomposer = class {
   constructor(tracker, _graph, opts = {}) {
@@ -21902,6 +22507,7 @@ var SddParallelRun = class {
     this.maxFailedSweeps = Math.max(0, opts.maxFailedRetrySweeps ?? 2);
     this.runId = opts.runId ?? `sdd-${randomUUID().slice(0, 8)}`;
     this.events = opts.events;
+    this.sessionIdSource = opts.sessionId;
     this.maxTotalWaves = opts.maxTotalWaves ?? opts.graph.nodes.size * (this.maxRetries + 2) + 10;
     this.maxWallClockMs = opts.maxWallClockMs;
     this.maxRecoveryRounds = Math.max(0, opts.maxRecoveryRounds ?? 0);
@@ -21930,6 +22536,7 @@ var SddParallelRun = class {
   retryMap = /* @__PURE__ */ new Map();
   runId;
   events;
+  sessionIdSource;
   maxTotalWaves;
   maxWallClockMs;
   maxRecoveryRounds;
@@ -21962,7 +22569,15 @@ var SddParallelRun = class {
   round = 0;
   /** Type-safe emit on the optional EventBus (no-op when unwired). */
   emit(event, payload) {
-    this.events?.emit(event, payload);
+    const sessionId = this.currentSessionId();
+    this.events?.emit(
+      event,
+      sessionId ? { ...payload, sessionId } : payload
+    );
+  }
+  currentSessionId() {
+    const value = typeof this.sessionIdSource === "function" ? this.sessionIdSource() : this.sessionIdSource;
+    return typeof value === "string" && value.length > 0 ? value : void 0;
   }
   // -------------------------------------------------------------------
   // Public API
@@ -23094,7 +23709,7 @@ var SpecStore = class {
   indexPath;
   constructor(opts) {
     this.baseDir = opts.baseDir;
-    this.indexPath = path3.join(this.baseDir, "_index.json");
+    this.indexPath = path4.join(this.baseDir, "_index.json");
   }
   async save(spec) {
     await ensureDir(this.baseDir);
@@ -23163,7 +23778,7 @@ var SpecStore = class {
     return updated;
   }
   filePath(id) {
-    return path3.join(this.baseDir, `${id}.json`);
+    return path4.join(this.baseDir, `${id}.json`);
   }
   async readIndex() {
     try {
@@ -23316,6 +23931,7 @@ function templateToMarkdown(template, title) {
 }
 
 // src/sdd/spec-versioning.ts
+init_assert_never();
 var SpecVersioning = class {
   versions = /* @__PURE__ */ new Map();
   /** Record a new version of a spec. */
@@ -23487,6 +24103,7 @@ function startSddRun(opts) {
     graph: opts.graph,
     agent: opts.agent,
     projectRoot: opts.projectRoot,
+    sessionId: opts.sessionId,
     parallelSlots: opts.parallelSlots,
     taskTimeoutMs: opts.taskTimeoutMs,
     taskIdleTimeoutMs: opts.taskIdleTimeoutMs,
@@ -23509,6 +24126,7 @@ function startSddRun(opts) {
     tracker: opts.tracker,
     events: opts.events,
     store: opts.boardStore,
+    sessionId: opts.sessionId,
     specId: opts.graph.specId,
     defaultModel: opts.defaultModel,
     defaultProvider: opts.defaultProvider,
@@ -23585,6 +24203,7 @@ function startSddRun(opts) {
 }
 
 // src/sdd/task-flow.ts
+init_errors();
 var TaskFlow = class {
   constructor(opts) {
     this.opts = opts;
@@ -23793,7 +24412,7 @@ var TaskGraphStore = class {
   indexPath;
   constructor(opts) {
     this.baseDir = opts.baseDir;
-    this.indexPath = path3.join(this.baseDir, "_index.json");
+    this.indexPath = path4.join(this.baseDir, "_index.json");
   }
   async save(graph) {
     await ensureDir(this.baseDir);
@@ -23831,7 +24450,7 @@ var TaskGraphStore = class {
     }
   }
   filePath(id) {
-    return path3.join(this.baseDir, `${id}.json`);
+    return path4.join(this.baseDir, `${id}.json`);
   }
   async readIndex() {
     try {
@@ -23872,6 +24491,7 @@ var TaskGraphStore = class {
 };
 
 // src/sdd/task-visualizer.ts
+init_string();
 var STATUS_ICON = {
   pending: "\u25CB",
   in_progress: "\u25D0",
@@ -24027,7 +24647,7 @@ function makeCommandVerifier(options = {}) {
   return async function verifyTask(info) {
     const cmd = info.task.metadata?.[metadataKey];
     if (typeof cmd !== "string" || !cmd.trim()) return { ok: true };
-    return await new Promise((resolve11) => {
+    return await new Promise((resolve12) => {
       const isWindows = process.platform === "win32";
       const [shell, ...shellArgs] = isWindows ? ["cmd", "/d", "/c"] : ["sh", "-c"];
       const child = spawn(shell, [...shellArgs, cmd], {
@@ -24040,24 +24660,25 @@ function makeCommandVerifier(options = {}) {
       const timer = setTimeout(() => {
         timedOut = true;
         child.kill();
-        resolve11({ ok: false, reason: `verification timed out: ${cmd}` });
+        resolve12({ ok: false, reason: `verification timed out: ${cmd}` });
       }, timeoutMs);
       child.on("exit", (code) => {
         clearTimeout(timer);
         if (timedOut) return;
-        resolve11(
+        resolve12(
           code === 0 ? { ok: true } : { ok: false, reason: `verification failed (exit ${code}): ${cmd}` }
         );
       });
       child.on("error", (err) => {
         clearTimeout(timer);
         if (timedOut) return;
-        resolve11({ ok: false, reason: `verification spawn error: ${String(err)}` });
+        resolve12({ ok: false, reason: `verification spawn error: ${String(err)}` });
       });
     });
   };
 }
 init_atomic_write();
+init_glob_match();
 
 // src/utils/lru-cache.ts
 var LruCache = class {
@@ -24093,6 +24714,10 @@ var LruCache = class {
     return this.store.size;
   }
 };
+
+// src/security/permission-policy.ts
+init_safe_json();
+init_tool_subject();
 var DESTRUCTIVE_BASH_PATTERNS = [
   /\bgit\s+(?:clean\s+-[^\s]*[xdf]|reset\s+--hard)\b/i,
   /\b(?:drop|truncate)\s+(?:table|database|schema)\b/i,
@@ -24115,9 +24740,9 @@ function getInputString(input, key) {
 function pathLooksInsideProject(rawPath, projectRoot) {
   if (!projectRoot) return false;
   if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path3.resolve(projectRoot, rawPath);
-  const relative3 = path3.relative(projectRoot, resolved);
-  return !!relative3 && !relative3.startsWith("..") && !path3.isAbsolute(relative3);
+  const resolved = path4.resolve(projectRoot, rawPath);
+  const relative4 = path4.relative(projectRoot, resolved);
+  return !!relative4 && !relative4.startsWith("..") && !path4.isAbsolute(relative4);
 }
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
@@ -24127,7 +24752,7 @@ function pathTokenIsOutsideProject(token, projectRoot) {
   if (token === "/" || token === "~" || token === "." || token === "..") return token !== ".";
   if (token.includes("*")) return true;
   if (token.startsWith("..") || token.includes("../") || token.includes("..\\")) return true;
-  if (path3.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
+  if (path4.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
   return false;
 }
 function hasDangerousDeleteTarget(tokens, start, projectRoot) {
@@ -24597,13 +25222,27 @@ var PATTERNS = [
     // Min 12 chars: some OAuth providers issue shorter-lived tokens (< 20
     // chars). A 12-char base64 string has ~71 bits of entropy — above the
     // threshold where random strings are unlikely to produce false matches.
-    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?:$|[^A-Za-z0-9_.~+/-])/g
+    // The trailing boundary is a NON-consuming lookahead: two adjacent bearer
+    // tokens sharing a single delimiter (`Bearer a… Bearer b…`) must both be
+    // redacted. A consuming trailing delimiter would eat the separator the
+    // next match needs for its leading anchor, leaking the second token.
+    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g
   },
   {
     type: "high_entropy_env",
     // Anchored with alternation instead of lookbehind to avoid backtracking.
     // Value bounded at 512 chars.
-    regex: /(?:^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?:\s|$)/g
+    // The trailing boundary is a NON-consuming lookahead so two secrets
+    // separated by a single delimiter (one space OR one newline, e.g.
+    // `printenv` / `.env` dumps: `API_KEY=… \n SESSION_TOKEN=…`) are BOTH
+    // redacted. A consuming trailing `\s` would swallow the separator the
+    // next match needs for its leading anchor, so every other secret would
+    // leak in plaintext.
+    // The leading delimiter is CAPTURED (group 1) and re-emitted by the
+    // replacement so the separator between adjacent secrets is preserved
+    // rather than collapsed. Capture groups are therefore: 1=leading
+    // delimiter, 2=key name, 3=value.
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g
   }
 ];
 var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
@@ -24611,6 +25250,7 @@ var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`
 var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
+var SCRUB_OVERLAP_BYTES = 1024;
 function hasCredentialAnchors(text) {
   return text.includes("-----BEGIN") || // Private keys (most unique → cheap reject)
   text.includes("sk-") || // Anthropic + OpenAI keys
@@ -24645,8 +25285,16 @@ var DefaultSecretScrubber = class {
     while (i < text.length) {
       let end = Math.min(i + SCRUB_CHUNK_BYTES, text.length);
       if (end < text.length) {
-        const nl = text.lastIndexOf("\n", end);
-        if (nl > i + SCRUB_CHUNK_BYTES / 2) end = nl + 1;
+        const limit = Math.min(end + SCRUB_OVERLAP_BYTES, text.length);
+        let safe = -1;
+        for (let j = end; j < limit; j++) {
+          const ch = text.charCodeAt(j);
+          if (ch === 32 || ch === 9 || ch === 10 || ch === 13) {
+            safe = j;
+            break;
+          }
+        }
+        end = safe === -1 ? end : safe + 1;
       }
       out.push(this.scrubOne(text.slice(i, end)));
       i = end;
@@ -24664,8 +25312,8 @@ var DefaultSecretScrubber = class {
         return replacement !== void 0 ? replacement : match;
       }
     );
-    out = out.replace(HIGH_ENTROPY_REGEX, (_match, group1, _group2) => {
-      return `${group1}=[REDACTED:high_entropy_env]`;
+    out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
+      return `${lead}${key}=[REDACTED:high_entropy_env]`;
     });
     return out;
   }
@@ -24694,6 +25342,9 @@ var DefaultSecretScrubber = class {
   }
 };
 
+// src/security/secret-vault.ts
+init_errors();
+
 // src/types/secret-vault.ts
 var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
 function encryptedPrefixForVersion(version) {
@@ -24702,6 +25353,7 @@ function encryptedPrefixForVersion(version) {
 
 // src/security/secret-vault.ts
 init_atomic_write();
+init_deep_merge();
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
 var TAG_BYTES = 16;
@@ -24789,8 +25441,8 @@ function unwrapDataKey(buf, keyFile) {
 function checkKeyFilePermissions(keyFile) {
   if (process.platform === "win32") return;
   try {
-    const stat9 = fs11.statSync(keyFile);
-    const actualMode = stat9.mode & 511;
+    const stat10 = fs12.statSync(keyFile);
+    const actualMode = stat10.mode & 511;
     if (actualMode !== KEY_FILE_MODE) {
       console.warn(JSON.stringify({
         level: "warn",
@@ -24878,16 +25530,16 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs11.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    fs12.mkdirSync(path4.dirname(this.keyFile), { recursive: true });
     const passphrase = getVaultPassphrase();
     if (passphrase) {
-      fs11.writeFileSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase), { mode: 384 });
+      fs12.writeFileSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase), { mode: 384 });
     } else {
       const keyFileBuf = Buffer.alloc(VERSIONED_KEY_FILE_SIZE);
       KEY_FILE_MAGIC.copy(keyFileBuf, 0);
       keyFileBuf[KEY_FILE_MAGIC.length] = newVersion;
       newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
-      fs11.writeFileSync(this.keyFile, keyFileBuf, { mode: 384 });
+      fs12.writeFileSync(this.keyFile, keyFileBuf, { mode: 384 });
     }
     checkKeyFilePermissions(this.keyFile);
     this.key = newKey;
@@ -24905,7 +25557,7 @@ var DefaultSecretVault = class {
     const passphrase = getVaultPassphrase();
     if (!passphrase || !this.key) return;
     try {
-      fs11.writeFileSync(this.keyFile, wrapDataKey(this.key, this._keyVersion, passphrase), {
+      fs12.writeFileSync(this.keyFile, wrapDataKey(this.key, this._keyVersion, passphrase), {
         mode: 384
       });
       checkKeyFilePermissions(this.keyFile);
@@ -24915,7 +25567,7 @@ var DefaultSecretVault = class {
   loadOrCreateKey() {
     if (this.key) return this.key;
     try {
-      const buf = fs11.readFileSync(this.keyFile);
+      const buf = fs12.readFileSync(this.keyFile);
       if (isWrappedKeyFile(buf)) {
         const { key: key2, version } = unwrapDataKey(buf, this.keyFile);
         this.key = key2;
@@ -24962,15 +25614,15 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs11.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    fs12.mkdirSync(path4.dirname(this.keyFile), { recursive: true });
     const key = randomBytes(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
     try {
-      fs11.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
+      fs12.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
-      const buf = fs11.readFileSync(this.keyFile);
+      const buf = fs12.readFileSync(this.keyFile);
       if (isWrappedKeyFile(buf)) {
         const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
         this.key = winnerKey;
@@ -25061,7 +25713,7 @@ async function rewriteConfigEncrypted(configPath, vault, patch) {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp7.mkdir(path3.dirname(configPath), { recursive: true });
+  await fsp7.mkdir(path4.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions(configPath);
 }
@@ -25164,7 +25816,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp7.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path3.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path4.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -25282,6 +25934,7 @@ function mergeAdjacentText(blocks) {
   return out;
 }
 init_atomic_write();
+init_error();
 
 // src/types/context-window.ts
 var DEFAULT_CONTEXT_WINDOW_MODE_ID = "balanced";
@@ -25338,6 +25991,9 @@ function isContextWindowModeId(id) {
 var DEFAULT_TUI_THINKING_WORD = "thinking";
 
 // src/storage/config-loader.ts
+init_errors();
+init_safe_json();
+init_deep_merge();
 function storageErrorString(err) {
   if (err instanceof Error) {
     const code = err.code;
@@ -25656,8 +26312,8 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
   return out;
 }
 function samePath(a, b) {
-  let ra = path3.resolve(a);
-  let rb = path3.resolve(b);
+  let ra = path4.resolve(a);
+  let rb = path4.resolve(b);
   if (process.platform === "win32" || process.platform === "darwin") {
     ra = ra.toLowerCase();
     rb = rb.toLowerCase();
@@ -25944,8 +26600,8 @@ var DefaultConfigLoader = class {
     const t0 = Date.now();
     let mtimeMs = null;
     try {
-      const stat9 = await fsp7.stat(file);
-      mtimeMs = stat9.mtimeMs;
+      const stat10 = await fsp7.stat(file);
+      mtimeMs = stat10.mtimeMs;
       const cached = this.jsonCache.get(file);
       if (cached && cached.mtimeMs === mtimeMs) {
         return structuredClone(cached.value);
@@ -26138,6 +26794,8 @@ function runConfigMigrations(input, targetVersion, migrations) {
 var DEFAULT_CONFIG_MIGRATIONS = [];
 
 // src/storage/config-store.ts
+init_errors();
+init_error();
 function stripEphemeralFields(cfg) {
   const env = cfg._envSource;
   if (!env?.size) return cfg;
@@ -26208,6 +26866,9 @@ function deepFreeze(obj) {
   return Object.freeze(obj);
 }
 
+// src/storage/memory-store.ts
+init_error();
+
 // src/types/memory.ts
 var MEMORY_TYPE_LABELS = {
   fact: "Fact",
@@ -26288,9 +26949,80 @@ function isMemoryType(s) {
 function isPriority(s) {
   return s === "critical" || s === "high" || s === "medium" || s === "low";
 }
+function buildInvertedIndex(entries) {
+  const wordMap = /* @__PURE__ */ new Map();
+  const tagMap = /* @__PURE__ */ new Map();
+  const indexed = new Array(entries.length);
+  for (let i = 0; i < entries.length; i++) {
+    const e = entries[i];
+    const words = e.text.toLowerCase().split(/\s+/).filter((w) => w.length > 0);
+    const tags = (e.tags ?? []).map((t) => t.toLowerCase());
+    indexed[i] = { entry: e, words, tags };
+    for (const w of words) {
+      const arr = wordMap.get(w);
+      if (arr) arr.push(i);
+      else wordMap.set(w, [i]);
+    }
+    for (const t of tags) {
+      const arr = tagMap.get(t);
+      if (arr) arr.push(i);
+      else tagMap.set(t, [i]);
+    }
+  }
+  return { wordMap, tagMap, entries: indexed, mtimeMs: 0 };
+}
+var MIN_SUBSTRING_NEEDLE_LEN = 3;
+function searchIndex(index, query, limit) {
+  const needles = query.toLowerCase().split(/\s+/).filter((n) => n.length > 0);
+  if (needles.length === 0) return [];
+  const scores = /* @__PURE__ */ new Map();
+  for (const n of needles) {
+    let matched = false;
+    const wordExact = index.wordMap.get(n);
+    if (wordExact) {
+      for (const idx of wordExact) scores.set(idx, (scores.get(idx) ?? 0) + 1);
+      matched = true;
+    }
+    const tagExact = index.tagMap.get(n);
+    if (tagExact) {
+      for (const idx of tagExact) scores.set(idx, (scores.get(idx) ?? 0) + 2);
+      matched = true;
+    }
+    if (matched || n.length < MIN_SUBSTRING_NEEDLE_LEN) continue;
+    for (const [word, indices] of index.wordMap) {
+      if (word.includes(n) || n.includes(word)) {
+        for (const idx of indices) {
+          scores.set(idx, (scores.get(idx) ?? 0) + 1);
+        }
+      }
+    }
+    for (const [tag, indices] of index.tagMap) {
+      if (tag.includes(n) || n.includes(tag)) {
+        for (const idx of indices) {
+          scores.set(idx, (scores.get(idx) ?? 0) + 2);
+        }
+      }
+    }
+  }
+  if (scores.size === 0) return [];
+  const scored = Array.from(scores.entries());
+  scored.sort((a, b) => b[1] - a[1]);
+  const result = [];
+  const max = limit ? Math.min(limit, scored.length) : scored.length;
+  for (let i = 0; i < max; i++) {
+    result.push(index.entries[scored[i][0]].entry);
+  }
+  return result;
+}
 var FileMemoryBackend = class {
   kind = "file";
   files;
+  /** Cache of parsed entries per file path. */
+  entryCache = /* @__PURE__ */ new Map();
+  /** Inverted index per file path. */
+  indexCache = /* @__PURE__ */ new Map();
+  /** File mtime cache for invalidation. */
+  mtimeCache = /* @__PURE__ */ new Map();
   constructor(opts) {
     this.files = {
       "project-agents": opts.paths.inProjectAgentsFile,
@@ -26301,9 +27033,56 @@ var FileMemoryBackend = class {
   resolveFile(filePath, scope) {
     return filePath || this.files[scope];
   }
+  async getMtime(file) {
+    try {
+      const stat10 = await fsp7.stat(file);
+      return stat10.mtimeMs;
+    } catch {
+      return 0;
+    }
+  }
+  invalidateCache(file) {
+    this.entryCache.delete(file);
+    this.indexCache.delete(file);
+    this.mtimeCache.delete(file);
+  }
+  /**
+   * Load (and cache) the parsed entries for a file. Callers that have already
+   * stat'd the file this tick (e.g. `getIndex`) can pass the known `mtime` to
+   * avoid a redundant `fs.stat` — otherwise it's fetched here.
+   */
+  async loadEntries(file, scope, mtime) {
+    const resolvedMtime = mtime ?? await this.getMtime(file);
+    const cachedMtime = this.mtimeCache.get(file);
+    if (cachedMtime === resolvedMtime && this.entryCache.has(file)) {
+      return this.entryCache.get(file);
+    }
+    const raw = await this.readAll(scope, file);
+    if (!raw.trim()) {
+      this.entryCache.set(file, []);
+      this.mtimeCache.set(file, resolvedMtime);
+      return [];
+    }
+    const entries = parseEntries(raw, scope);
+    this.entryCache.set(file, entries);
+    this.mtimeCache.set(file, resolvedMtime);
+    return entries;
+  }
+  async getIndex(file, scope) {
+    const mtime = await this.getMtime(file);
+    const cached = this.indexCache.get(file);
+    if (cached && cached.mtimeMs === mtime) {
+      return cached;
+    }
+    const entries = await this.loadEntries(file, scope, mtime);
+    const index = buildInvertedIndex(entries);
+    index.mtimeMs = mtime;
+    this.indexCache.set(file, index);
+    return index;
+  }
   async remember(scope, entry, filePath) {
     const file = this.resolveFile(filePath, scope);
-    await ensureDir(path3.dirname(file));
+    await ensureDir(path4.dirname(file));
     let existing = "";
     try {
       existing = await fsp7.readFile(file, "utf8");
@@ -26317,6 +27096,7 @@ var FileMemoryBackend = class {
     const next = existing.trim() ? existing.replace(/\n+$/, "") + line : `# Agent Memory
 ${line}`;
     await atomicWrite(file, next);
+    this.invalidateCache(file);
   }
   async forget(scope, query, filePath) {
     const file = this.resolveFile(filePath, scope);
@@ -26353,6 +27133,7 @@ ${line}`;
           await atomicWrite(file, lines.join("\n"));
         }
       }
+      this.invalidateCache(file);
       return removed;
     });
   }
@@ -26365,30 +27146,19 @@ ${line}`;
     }
   }
   async list(scope, filePath, limit) {
-    const raw = await this.readAll(scope, filePath);
-    if (!raw.trim()) return [];
-    const entries = parseEntries(raw, scope);
+    const file = this.resolveFile(filePath, scope);
+    const entries = await this.loadEntries(file, scope);
     return limit ? entries.slice(0, limit) : entries;
   }
   async search(scope, query, filePath, limit) {
-    const entries = await this.list(scope, filePath);
-    const needle = query.toLowerCase().split(/\s+/);
-    const scored = entries.map((e) => {
-      const words = e.text.toLowerCase().split(/\s+/);
-      let score = 0;
-      for (const n of needle) {
-        if (words.some((w) => w.includes(n))) score += 1;
-        if (e.tags?.some((t) => t.toLowerCase().includes(n))) score += 2;
-      }
-      return { entry: e, score };
-    });
-    scored.sort((a, b) => b.score - a.score);
-    const matched = scored.filter((s) => s.score > 0).map((s) => s.entry);
-    return limit ? matched.slice(0, limit) : matched;
+    const file = this.resolveFile(filePath, scope);
+    const index = await this.getIndex(file, scope);
+    return searchIndex(index, query, limit);
   }
   async clear(scope, filePath) {
     const file = this.resolveFile(filePath, scope);
     await atomicWrite(file, "");
+    this.invalidateCache(file);
   }
   async consolidate(scope, filePath) {
     const file = this.resolveFile(filePath, scope);
@@ -26423,18 +27193,19 @@ ${line}`;
     } catch {
       return 0;
     }
+    this.invalidateCache(file);
     return removed;
   }
 };
 async function pruneConsolidateBackups(file) {
-  const dir = path3.dirname(file);
-  const base = path3.basename(file);
+  const dir = path4.dirname(file);
+  const base = path4.basename(file);
   const prefix = `${base}.bak.`;
   const backups = (await fsp7.readdir(dir)).filter((name) => name.startsWith(prefix)).sort().reverse();
   await Promise.all(
     backups.slice(MAX_MEMORY_CONSOLIDATE_BACKUPS).map(async (name) => {
       try {
-        await fsp7.unlink(path3.join(dir, name));
+        await fsp7.unlink(path4.join(dir, name));
       } catch {
       }
     })
@@ -26489,9 +27260,10 @@ var DefaultMemoryStore = class {
   /** Result cache for scoreRelevant() — keyed by scope + context hash, TTL 30s. */
   _scoreCache = /* @__PURE__ */ new Map();
   /**
-   * Per-entry cached lowercase strings — computed once per scoreRelevant() call,
-   * stored here so repeated scoring of the same entries avoids re-computation.
-   * Cleared on every mutation (remember/forget/consolidate/clear).
+   * Per-entry cached lowercase strings — lazily allocated once and reused
+   * across scoreRelevant() calls so repeated scoring of the same entries skips
+   * re-lowercasing. Keyed by entry object identity; cleared (set to null) on
+   * every mutation (remember/forget/consolidate/clear) via invalidateScoreCaches().
    */
   _cachedLower = null;
   constructor(opts) {
@@ -26641,7 +27413,7 @@ ${body.trim()}`);
       const t0 = Date.now();
       try {
         await this.backend.remember(scope, entry, filePath);
-        this._scoreCache.clear();
+        this.invalidateScoreCaches();
         const dur = Date.now() - t0;
         this.events?.emit("storage.write", {
           sessionId: "~memory~",
@@ -26692,6 +27464,15 @@ ${body.trim()}`);
       });
     });
   }
+  /**
+   * Drop the relevance caches after a mutation. Both the per-context score
+   * cache and the per-entry lowercase cache are keyed on entry objects that a
+   * mutation invalidates, so they must be cleared together when entries change.
+   */
+  invalidateScoreCaches() {
+    this._scoreCache.clear();
+    this._cachedLower = null;
+  }
   /**
    * Score and rank memories by relevance to the current context.
    * Returns entries with score >= MIN_RELEVANCE_SCORE, sorted highest first.
@@ -26709,18 +27490,19 @@ ${body.trim()}`);
     const taskWords = ctx.currentTask.toLowerCase().split(/\s+/).filter((w) => w.length > 2);
     const skillWords = (ctx.activeSkills ?? []).flatMap((s) => s.split("-"));
     const toolWords = (ctx.toolNames ?? []).flatMap((t) => t.toLowerCase().split("_"));
-    this._cachedLower = /* @__PURE__ */ new WeakMap();
+    this._cachedLower ??= /* @__PURE__ */ new WeakMap();
+    const lowerCache = this._cachedLower;
     const scored = [];
     for (const entry of all) {
       let score = 0;
       const reasons = [];
-      let cachedLower = this._cachedLower.get(entry);
+      let cachedLower = lowerCache.get(entry);
       if (!cachedLower) {
         cachedLower = {
           textLower: entry.text.toLowerCase(),
           tagsLower: (entry.tags ?? []).map((t) => t.toLowerCase())
         };
-        this._cachedLower.set(entry, cachedLower);
+        lowerCache.set(entry, cachedLower);
       }
       const { textLower, tagsLower } = cachedLower;
       let taskHits = 0;
@@ -26818,7 +27600,7 @@ ${body.trim()}`);
       let removed = 0;
       try {
         removed = await this.backend.forget(scope, query, filePath);
-        this._scoreCache.clear();
+        this.invalidateScoreCaches();
         const dur = Date.now() - t0;
         this.events?.emit("storage.write", {
           sessionId: "~memory~",
@@ -26862,7 +27644,7 @@ ${body.trim()}`);
       let removed = 0;
       try {
         removed = await this.backend.consolidate(scope, filePath);
-        this._scoreCache.clear();
+        this.invalidateScoreCaches();
         const dur = Date.now() - t0;
         this.events?.emit("storage.write", {
           sessionId: "~memory~",
@@ -26904,7 +27686,7 @@ ${body.trim()}`);
         const t0 = Date.now();
         try {
           await this.backend.clear(scope, filePath);
-          this._scoreCache.clear();
+          this.invalidateScoreCaches();
           const dur = Date.now() - t0;
           this.events?.emit("storage.write", {
             sessionId: "~memory~",
@@ -26971,6 +27753,7 @@ ${body.trim()}`);
         })
       )
     );
+    this.invalidateScoreCaches();
   }
   /**
    * Return a new MemoryStore proxy that carries `traceId` on every storage
@@ -27009,6 +27792,7 @@ function labelOf(scope) {
 
 // src/storage/plan-store.ts
 init_atomic_write();
+init_error();
 async function loadPlan(filePath, events) {
   const t0 = Date.now();
   let raw;
@@ -27304,6 +28088,7 @@ ${cat}:`);
 
 // src/storage/queue-store.ts
 init_atomic_write();
+init_error();
 var QueueStore = class {
   file;
   // Use `| undefined` (not `?`) so exactOptionalPropertyTypes doesn't
@@ -27311,7 +28096,7 @@ var QueueStore = class {
   events;
   traceId;
   constructor(opts) {
-    this.file = path3.join(opts.dir, "queue.json");
+    this.file = path4.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
   }
@@ -27488,7 +28273,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path3.join(opts.dir, LOCK_FILE);
+    this.file = path4.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -27549,7 +28334,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path3.dirname(this.file));
+    await ensureDir(path4.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -27829,6 +28614,11 @@ function resolveSessionLoggingConfig(cfg) {
     }
   };
 }
+
+// src/storage/session-reader.ts
+init_expect_defined();
+init_regex_guard();
+init_session_scoped_path();
 var DefaultSessionReader = class _DefaultSessionReader {
   store;
   eventCache = /* @__PURE__ */ new Map();
@@ -27843,11 +28633,11 @@ var DefaultSessionReader = class _DefaultSessionReader {
     if (!rootDir) {
       return await this.store.load(sessionId);
     }
-    const sessionPath = path3.join(rootDir, `${sessionId}.jsonl`);
+    const sessionPath = sessionScopedPath(rootDir, sessionId, ".jsonl");
     let mtimeMs = null;
     try {
-      const stat9 = await fsp7.stat(sessionPath);
-      mtimeMs = stat9.mtimeMs;
+      const stat10 = await fsp7.stat(sessionPath);
+      mtimeMs = stat10.mtimeMs;
     } catch {
       this.eventCache.delete(sessionId);
       this.eventCacheMtimes.delete(sessionId);
@@ -28206,6 +28996,7 @@ function renderPlainText(meta, events) {
 
 // src/storage/todos-checkpoint.ts
 init_atomic_write();
+init_error();
 async function loadTodosCheckpoint(filePath, events, traceId) {
   const t0 = Date.now();
   let raw;
@@ -28346,6 +29137,6 @@ function attachTodosCheckpoint(state, filePath, sessionId, events, traceId) {
   };
 }
 
-export { AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, CODEX_MODELS, ConfigMigrationError, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultDesignKitLoader, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultPromptLoader, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorStateCheckpoint, DoneConditionChecker, EternalAutonomyEngine, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FleetBus, FleetSpawnBudgetError, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, SddBoardProjector, SddBoardStore, SddInterviewDriver, SddParallelRun, SddRunRegistry, SddSupervisor, SddTaskDecomposer, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, ToolExecutor, _resetDesignKitLoaderMemo, _resetDesignRulesCache, activateDesign, addPlanItem, allServers, analyzeCriticalPath, applyRosterBudget, applySddLifecycle, applyTokenOverrides, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildBoardSnapshot, buildBoardTasks, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, cleanupSddWorktrees, cleanupStaleSddWorktrees, clearActiveKit, clearPersistedActiveKit, clearPlan, codexModelMeta, colorToHex, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createAutoExecutor, createContextManagerTool, createDelegateTool, createMessage, createSessionEventBridge, createStrategyCompactor, decryptConfigSecrets, deriveTodosFromPlanItem, describeCatalogModel, designProjectDir, destroySddProject, detectFrontendFile, detectFrontendIntent, dispatchAgent, emptyPlan, encryptConfigSecrets, everArtServer, extractVerificationCommand, filesystemServer, formatPlan, formatPlanTemplates, getAgentDefinition, getDesignKitLoader, getDesignState, getPlanTemplate, getTemplate, githubServer, googleMapsServer, hasConflictMarkers, installDesignStudioMiddleware, isColorToken, isExplanatoryText, listPlanTemplates, listTemplates, loadActiveKit, loadDirectorState, loadPlan, loadProjectDesignRules, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeCommandVerifier, makeDesignDetectToolCallMiddleware, makeDesignDetectUserInputMiddleware, makeDesignStudioRequestMiddleware, makeDesignVerifyToolCallMiddleware, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeLlmConflictResolver, makeLlmSubtaskGenerator, makePreferSideConflictResolver, makeRollUpTool, makeSpawnTool, makeTerminateTool, materializeTokens, migratePlaintextSecrets, miniMaxVisionServer, oklchToHex, parseOklch, playwrightServer, recordKitChoice, recordOverrides, removePlanItem, renderProgress, renderPrometheus, renderPrompt, renderSpecAnalysis, renderTaskGraph, renderTaskList, resolveAuditLevel, resolveBundledDesignKitsDir, resolveConflictText, resolveProviderModelList, resolveSessionLoggingConfig, rewriteConfigEncrypted, rollbackSddRunFromDisk, rosterSummaryFromConfigs, runConfigMigrations, runDesignVerify, savePlan, saveTodosCheckpoint, scoreAgents, sentinelServer, setActiveKit, setDesignOverrides, setPlanItemStatus, shortIdMap, slackServer, sshManagerServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, startSddRun, templateToMarkdown, verifyFiles, wireMetricsToEvents, zaiVisionServer };
+export { AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, CODEX_MODELS, ConfigMigrationError, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultDesignKitLoader, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultPromptLoader, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorStateCheckpoint, DoneConditionChecker, EternalAutonomyEngine, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FleetBus, FleetSpawnBudgetError, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, SddBoardProjector, SddBoardStore, SddInterviewDriver, SddParallelRun, SddRunRegistry, SddSupervisor, SddTaskDecomposer, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, ToolExecutor, _resetDesignKitLoaderMemo, _resetDesignRulesCache, activateDesign, addPlanItem, allServers, analyzeCriticalPath, applyRosterBudget, applySddLifecycle, applyTokenOverrides, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildBoardSnapshot, buildBoardTasks, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, cleanupSddWorktrees, cleanupStaleSddWorktrees, clearActiveKit, clearPersistedActiveKit, clearPlan, codexModelMeta, colorToHex, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createAutoExecutor, createContextManagerTool, createDelegateTool, createMessage, createSessionEventBridge, createStrategyCompactor, decryptConfigSecrets, deriveTodosFromPlanItem, describeCatalogModel, designProjectDir, destroySddProject, detectFrontendFile, detectFrontendIntent, dispatchAgent, emptyPlan, encryptConfigSecrets, everArtServer, extractVerificationCommand, filesystemServer, formatPlan, formatPlanTemplates, getAgentDefinition, getDesignKitLoader, getDesignState, getPlanTemplate, getTemplate, githubServer, googleMapsServer, hasConflictMarkers, installDesignStudioMiddleware, isColorToken, isExplanatoryText, listPlanTemplates, listTemplates, loadActiveKit, loadDirectorState, loadPlan, loadProjectDesignRules, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeCommandVerifier, makeDesignDetectToolCallMiddleware, makeDesignDetectUserInputMiddleware, makeDesignStudioRequestMiddleware, makeDesignVerifyToolCallMiddleware, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetTool, makeLLMClassifier, makeLlmConflictResolver, makeLlmSubtaskGenerator, makePreferSideConflictResolver, makeRollUpTool, makeSpawnTool, makeTerminateTool, materializeTokens, migratePlaintextSecrets, miniMaxVisionServer, oklchToHex, parseOklch, playwrightServer, recordKitChoice, recordOverrides, removePlanItem, renderProgress, renderPrometheus, renderPrompt, renderSpecAnalysis, renderTaskGraph, renderTaskList, resolveAuditLevel, resolveBundledDesignKitsDir, resolveConflictText, resolveProviderModelList, resolveSessionLoggingConfig, rewriteConfigEncrypted, rollbackSddRunFromDisk, rosterSummaryFromConfigs, runConfigMigrations, runDesignVerify, savePlan, saveTodosCheckpoint, scoreAgents, sentinelServer, setActiveKit, setDesignOverrides, setPlanItemStatus, shortIdMap, slackServer, sshManagerServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, startSddRun, templateToMarkdown, verifyFiles, wireMetricsToEvents, zaiVisionServer };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map