@wrongstack/core 0.280.0 → 0.281.0

package/dist/defaults/index.js

@@ -1,5 +1,5 @@
 import * as crypto2 from 'crypto';
-import { randomBytes, randomUUID, createCipheriv, createDecipheriv, createHash, scryptSync } from 'crypto';
+import { randomBytes, randomUUID, randomInt, createCipheriv, createDecipheriv, createHash, scryptSync } from 'crypto';
 import * as fsp7 from 'fs/promises';
 import { readFile, writeFile, mkdir } from 'fs/promises';
 import * as path4 from 'path';
@@ -868,7 +868,7 @@ function walk(value, schema, path32, errors, depth) {
     return;
   }
   if (schema.enum !== void 0) {
-    if (!schema.enum.some((e) => deepEqual(e, value))) {
+    if (!enumIncludes(schema.enum, value)) {
       errors.push({
         path: path32 || "<root>",
         message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
@@ -938,6 +938,10 @@ function joinPath(parent, key) {
   if (!parent) return key;
   return `${parent}.${key}`;
 }
+function enumIncludes(values, value) {
+  if (value === null || typeof value !== "object") return values.includes(value);
+  return values.some((candidate) => deepEqual(candidate, value));
+}
 function deepEqual(a, b) {
   if (a === b) return true;
   if (typeof a !== typeof b) return false;
@@ -1187,6 +1191,27 @@ function safeParse(input, maxBytes = 5e6) {
     };
   }
 }
+function safeStringify(value, pretty = false) {
+  const seen = /* @__PURE__ */ new WeakSet();
+  const replacer = (_k, v) => {
+    if (typeof v === "bigint") return v.toString();
+    if (v instanceof Error) {
+      return { name: v.name, message: v.message, stack: v.stack };
+    }
+    if (typeof v === "object" && v !== null) {
+      if (seen.has(v)) return "[Circular]";
+      seen.add(v);
+    }
+    return v;
+  };
+  try {
+    return JSON.stringify(value, replacer, pretty ? 2 : void 0) ?? "null";
+  } catch (err) {
+    return JSON.stringify({
+      __serialization_error: toErrorMessage(err)
+    });
+  }
+}
 var init_safe_json = __esm({
   "src/utils/safe-json.ts"() {
     init_error();
@@ -2320,6 +2345,7 @@ function resolveWstackPaths(opts) {
     projectHash: hash,
     projectSlug: slug,
     projectGoal: path4.join(projectDir, "goal.json"),
+    projectInputHistory: path4.join(projectDir, "input-history.json"),
     projectSpecs: path4.join(projectDir, "specs"),
     projectTaskGraphs: path4.join(projectDir, "task-graphs"),
     projectSddSession: path4.join(projectDir, "sdd-session.json"),
@@ -3448,20 +3474,32 @@ var TOOLS = {
   /** Web research. */
   research: ["read", "grep", "glob", "search", "fetch", "mailbox"]
 };
+var promptCache = /* @__PURE__ */ new Map();
+var candidateCache = /* @__PURE__ */ new Map();
 function agentPrompt(id) {
+  const envDir = process.env["WRONGSTACK_AGENT_INSTRUCTIONS_DIR"] ?? "";
+  const cacheKey = `${envDir}\0${id}`;
+  const cached = promptCache.get(cacheKey);
+  if (cached !== void 0) return cached;
   const fileName = `${id}.md`;
-  for (const dir of agentPromptDirCandidates()) {
+  let resolved = "";
+  for (const dir of agentPromptDirCandidates(envDir)) {
     try {
-      return readFileSync(path4.join(dir, fileName), "utf8").trimEnd();
+      resolved = readFileSync(path4.join(dir, fileName), "utf8").trimEnd();
+      break;
     } catch {
     }
   }
-  return "";
+  promptCache.set(cacheKey, resolved);
+  return resolved;
 }
-function agentPromptDirCandidates() {
-  const here = path4.dirname(fileURLToPath(import.meta.url));
-  const explicitDir = process.env["WRONGSTACK_AGENT_INSTRUCTIONS_DIR"];
+function agentPromptDirCandidates(envDir) {
   const globalRoot = process.env["WRONGSTACK_HOME"] || path4.join(os.homedir(), ".wrongstack");
+  const candKey = `${envDir}\0${globalRoot}`;
+  const cached = candidateCache.get(candKey);
+  if (cached !== void 0) return cached;
+  const here = path4.dirname(fileURLToPath(import.meta.url));
+  const explicitDir = envDir || void 0;
   const candidates = [
     ...explicitDir ? [path4.resolve(explicitDir)] : [],
     path4.join(globalRoot, "instructions", "agents"),
@@ -3471,7 +3509,9 @@ function agentPromptDirCandidates() {
     path4.resolve(here, "../instructions/agents"),
     path4.resolve(here, "instructions/agents")
   ];
-  return candidates.sort((a, b) => Number(!isDirectory(a)) - Number(!isDirectory(b)));
+  const ordered = candidates.sort((a, b) => Number(!isDirectory(a)) - Number(!isDirectory(b)));
+  candidateCache.set(candKey, ordered);
+  return ordered;
 }
 function isDirectory(candidate) {
   try {
@@ -6328,14 +6368,21 @@ Emit each evaluation immediately. Do not wait until you have read all reports.`;
     this.snapshot.files.length = 0;
   }
 };
+var textCache = /* @__PURE__ */ new Map();
+var rootCandidates;
 function readBundledInstructionText(relativePath) {
+  const cached = textCache.get(relativePath);
+  if (cached !== void 0) return cached;
+  let resolved = "";
   for (const root of instructionRootCandidates()) {
     try {
-      return readFileSync(path4.join(root, relativePath), "utf8").trimEnd();
+      resolved = readFileSync(path4.join(root, relativePath), "utf8").trimEnd();
+      break;
     } catch {
     }
   }
-  return "";
+  textCache.set(relativePath, resolved);
+  return resolved;
 }
 function renderInstructionTemplate(template, values) {
   return template.replace(
@@ -6344,13 +6391,15 @@ function renderInstructionTemplate(template, values) {
   );
 }
 function instructionRootCandidates() {
+  if (rootCandidates !== void 0) return rootCandidates;
   const here = path4.dirname(fileURLToPath(import.meta.url));
   const candidates = [
     path4.resolve(here, "../../instructions"),
     path4.resolve(here, "../instructions"),
     path4.resolve(here, "instructions")
   ];
-  return candidates.sort((a, b) => Number(!isDirectory2(a)) - Number(!isDirectory2(b)));
+  rootCandidates = candidates.sort((a, b) => Number(!isDirectory2(a)) - Number(!isDirectory2(b)));
+  return rootCandidates;
 }
 function isDirectory2(candidate) {
   try {
@@ -6734,13 +6783,31 @@ function makeAssignTool(director) {
 function makeAwaitTasksTool(director) {
   return {
     name: "await_tasks",
-    description: "Block until every named task completes. Returns the array of TaskResult.",
+    description: 'Wait for assigned tasks. mode:"all" (default) blocks until EVERY named task completes and returns all results. mode:"any" returns as soon as AT LEAST ONE completes \u2014 use it for independent tasks so you can handle each finisher immediately (reassign work, spawn helpers) instead of idling on the slowest; call again with the returned `pending` ids to pick up the next finisher.',
     permission: "auto",
     mutating: false,
     capabilities: [ToolCapabilities.COORDINATION_FLEET_READ],
-    inputSchema: { type: "object", properties: { taskIds: { type: "array", items: { type: "string" }, description: "One or more task ids returned by `assign_task`." } }, required: ["taskIds"] },
+    inputSchema: {
+      type: "object",
+      properties: {
+        taskIds: { type: "array", items: { type: "string" }, description: "One or more task ids returned by `assign_task`." },
+        mode: { type: "string", enum: ["all", "any"], description: '"all" (default): block until every task completes. "any": return on the first completion with the rest listed as pending.' },
+        timeoutMs: { type: "number", minimum: 1, description: 'mode:"any" only \u2014 return {timedOut:true, completed:[]} if nothing completes within this window instead of blocking.' }
+      },
+      required: ["taskIds"]
+    },
     async execute(input) {
       const i = input;
+      if (i.mode === "any") {
+        const r = await director.awaitTasksAny(i.taskIds, i.timeoutMs !== void 0 ? { timeoutMs: i.timeoutMs } : void 0);
+        return {
+          mode: "any",
+          completed: r.completed,
+          pending: r.pending,
+          ...r.timedOut ? { timedOut: true } : {},
+          ...r.pending.length > 0 ? { hint: 'Handle the completed results now. Re-call await_tasks with the pending ids (mode:"any") for the next finisher \u2014 or assign new work to the now-idle subagent first.' } : {}
+        };
+      }
       const results = await director.awaitTasks(i.taskIds);
       return { results };
     }
@@ -7847,6 +7914,30 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
   results() {
     return this.completedResults;
   }
+  /** Defensive snapshot of the still-queued (not yet dispatched) tasks. */
+  listPendingTasks() {
+    return this.pendingTasks.map((t) => ({ ...t }));
+  }
+  /**
+   * Re-pin a still-PENDING task to a different subagent (`undefined` =
+   * unpin, any idle worker may take it), then try to dispatch. Returns
+   * `false` when the task is not in the pending queue — already
+   * dispatched, completed, or unknown. Running tasks can never be pulled;
+   * they can only be steered or terminated. The mutation is synchronous
+   * (same tick as the check), so it cannot race a concurrent dispatch:
+   * `tryDispatchNext` runs on this same call stack or a later one.
+   *
+   * The task keeps its id, so waiters, the report-back notifier, and
+   * checkpoint bookkeeping resolve unchanged when it eventually completes.
+   */
+  retargetPendingTask(taskId, subagentId) {
+    const task = this.pendingTasks.find((t) => t.id === taskId);
+    if (!task) return false;
+    if (subagentId !== void 0 && !this.subagents.has(subagentId)) return false;
+    task.subagentId = subagentId;
+    this.tryDispatchNext();
+    return true;
+  }
   /**
    * Wait for one or more tasks to complete and return their results.
    * If a task is already done when called, returns immediately.
@@ -7874,6 +7965,43 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       })
     );
   }
+  /**
+   * Wait until AT LEAST ONE of the named tasks completes. Returns every
+   * requested result already available at that moment (drain-what's-done)
+   * plus the ids still outstanding, so callers can loop "handle finishers,
+   * re-await the remainder" instead of blocking on the whole batch.
+   *
+   * Unlike `awaitTasks`, this never rejects and deliberately does NOT
+   * inherit `config.timeoutMs` — a "return whatever is done" call has no
+   * business timing out unless the caller asks for a window explicitly.
+   */
+  async awaitTasksAny(taskIds, opts) {
+    const ids = new Set(taskIds);
+    const completed = this.completedResults.filter((r) => ids.has(r.taskId));
+    if (completed.length > 0 || ids.size === 0) {
+      const done = new Set(completed.map((r) => r.taskId));
+      return { completed, pending: taskIds.filter((id) => !done.has(id)) };
+    }
+    return new Promise((resolve12) => {
+      let timer;
+      const handler = ({ result }) => {
+        if (!ids.has(result.taskId)) return;
+        if (timer) clearTimeout(timer);
+        this.off("task.completed", handler);
+        resolve12({
+          completed: [result],
+          pending: taskIds.filter((id) => id !== result.taskId)
+        });
+      };
+      if (opts?.timeoutMs !== void 0) {
+        timer = setTimeout(() => {
+          this.off("task.completed", handler);
+          resolve12({ completed: [], pending: [...taskIds], timedOut: true });
+        }, opts.timeoutMs);
+      }
+      this.on("task.completed", handler);
+    });
+  }
   /**
    * Manual completion — for callers that drive subagents without a runner
    * (e.g. external orchestrators). When a runner is configured the coordinator
@@ -8498,6 +8626,13 @@ var Director = class _Director {
    *  coordinator emits `task.completed` for a given task id. Each entry
    *  is created lazily on first poll/await and cleared once consumed. */
   taskWaiters = /* @__PURE__ */ new Map();
+  /** First-completion waiters registered by `awaitTasksAny`. Kept separate
+   *  from `taskWaiters` on purpose: a `taskWaiters` entry marks a result as
+   *  "will be delivered in-band" and suppresses the fire-and-forget
+   *  report-back — but an any-await only consumes ONE of its ids, so the
+   *  losers must stay eligible for the mailbox notifier. Entries carry an
+   *  optional timeout timer so `shutdown()` can clear them. */
+  anyWaiters = /* @__PURE__ */ new Set();
   /** Cache of completed results in case the consumer asks AFTER the
    *  coordinator already fired the event — `awaitTasks(['t-1'])` after
    *  t-1 finished should resolve immediately, not hang. */
@@ -8519,6 +8654,8 @@ var Director = class _Director {
   roster;
   directorPreamble;
   subagentBaseline;
+  /** See {@link DirectorOptions.taskResultNotifier}. */
+  taskResultNotifier;
   /** Absolute path to the fleet's shared scratchpad directory, or null
    *  when none was configured. Exposed as a readonly getter for callers
    *  that need to surface the path to the user (e.g. the CLI logging
@@ -8616,6 +8753,7 @@ var Director = class _Director {
     this.roster = opts.roster;
     this.directorPreamble = opts.directorPreamble ?? DEFAULT_DIRECTOR_PREAMBLE;
     this.subagentBaseline = opts.subagentBaseline ?? DEFAULT_SUBAGENT_BASELINE;
+    this.taskResultNotifier = opts.taskResultNotifier;
     this.sharedScratchpadPath = opts.sharedScratchpadPath ?? null;
     this.maxSpawns = opts.maxSpawns ?? Number.POSITIVE_INFINITY;
     this.maxSpawnDepth = opts.maxSpawnDepth ?? 2;
@@ -8688,8 +8826,38 @@ var Director = class _Director {
         waiter.resolve(r);
         this.taskWaiters.delete(r.taskId);
       }
+      let anyConsumed = false;
+      for (const aw of [...this.anyWaiters]) {
+        if (!aw.ids.has(r.taskId)) continue;
+        if (aw.timer) clearTimeout(aw.timer);
+        this.anyWaiters.delete(aw);
+        aw.resolve(r);
+        anyConsumed = true;
+      }
+      const consumedInBand = !!waiter || anyConsumed;
       if (internalTask) return;
       const title = this.taskDescriptions.get(r.taskId) ?? payload.task.description ?? r.taskId;
+      if (!consumedInBand && this.taskResultNotifier) {
+        const resultText = typeof r.result === "string" ? r.result : r.result !== void 0 ? safeStringify(r.result) : void 0;
+        try {
+          void Promise.resolve(
+            this.taskResultNotifier({
+              taskId: r.taskId,
+              title,
+              status: r.status,
+              subagentId: r.subagentId,
+              subagentName: this.manifestEntries.get(r.subagentId)?.name,
+              resultText,
+              errorText: r.error ? `${r.error.kind}: ${r.error.message}` : void 0,
+              iterations: r.iterations,
+              toolCalls: r.toolCalls,
+              durationMs: r.durationMs
+            })
+          ).catch(() => {
+          });
+        } catch {
+        }
+      }
       const failed = r.status !== "success";
       const errorString = r.error ? `${r.error.kind}: ${r.error.message}` : void 0;
       this.stateCheckpoint?.recordTaskStatus(r.taskId, {
@@ -9275,6 +9443,10 @@ var Director = class _Director {
       this.coordinator.off("task.completed", this.taskCompletedListener);
       this.taskCompletedListener = null;
     }
+    for (const aw of this.anyWaiters) {
+      if (aw.timer) clearTimeout(aw.timer);
+    }
+    this.anyWaiters.clear();
     if (this.toolExecFilter) {
       this.toolExecFilter();
       this.toolExecFilter = null;
@@ -9343,6 +9515,12 @@ var Director = class _Director {
         waiter.resolve(synthetic);
         this.taskWaiters.delete(taskWithId.id);
       }
+      for (const aw of [...this.anyWaiters]) {
+        if (!aw.ids.has(taskWithId.id)) continue;
+        if (aw.timer) clearTimeout(aw.timer);
+        this.anyWaiters.delete(aw);
+        aw.resolve(synthetic);
+      }
       return taskWithId.id;
     }
     if (task.subagentId) {
@@ -9413,6 +9591,85 @@ var Director = class _Director {
       })
     );
   }
+  /**
+   * Wait until AT LEAST ONE of the named tasks completes, then return every
+   * requested result already cached plus the still-pending ids. This is the
+   * leader's "handle whichever finishes next" primitive — unlike
+   * `awaitTasks` it never blocks on the slowest sibling, and the siblings
+   * that complete later still reach the leader through the fire-and-forget
+   * report-back (see the consumed-in-band rule in `taskCompletedListener`).
+   *
+   * Deliberately does NOT register `taskWaiters` entries for the pending
+   * ids: a `taskWaiters` entry would mark those results as in-band-consumed
+   * and silence the mailbox notifier for results this caller never receives.
+   *
+   * With `timeoutMs`, resolves (never rejects) `{timedOut: true}` and zero
+   * completions when the window elapses first.
+   */
+  awaitTasksAny(taskIds, opts) {
+    const completed = taskIds.map((id) => this.completed.get(id)).filter((r) => r !== void 0);
+    if (completed.length > 0 || taskIds.length === 0) {
+      const done = new Set(completed.map((r) => r.taskId));
+      return Promise.resolve({
+        completed,
+        pending: taskIds.filter((id) => !done.has(id))
+      });
+    }
+    return new Promise((resolve12) => {
+      const entry = {
+        ids: new Set(taskIds),
+        resolve: (r) => resolve12({
+          completed: [r],
+          pending: taskIds.filter((id) => id !== r.taskId)
+        })
+      };
+      if (opts?.timeoutMs !== void 0) {
+        entry.timer = setTimeout(() => {
+          this.anyWaiters.delete(entry);
+          resolve12({ completed: [], pending: [...taskIds], timedOut: true });
+        }, opts.timeoutMs);
+      }
+      this.anyWaiters.add(entry);
+    });
+  }
+  /** Defensive snapshot of tasks still queued (not yet dispatched). */
+  listPendingTasks() {
+    return this.coordinator.listPendingTasks();
+  }
+  /**
+   * Re-pin a still-pending task to a different subagent (`undefined` =
+   * unpin) — the rebalancing primitive used by the FleetSupervisor and
+   * available to hosts. Only queued tasks can move; a dispatched task
+   * returns `false` (steer or terminate its worker instead). Keeps
+   * ownership bookkeeping (taskOwners, checkpoint, fleet manifest) in
+   * sync with the coordinator's queue.
+   */
+  retargetPendingTask(taskId, subagentId) {
+    const ok = this.coordinator.retargetPendingTask(taskId, subagentId);
+    if (!ok) return false;
+    if (subagentId) {
+      this.taskOwners.set(taskId, subagentId);
+      if (this.fleetManager) {
+        this.fleetManager.addTaskToSubagent(subagentId, taskId);
+      } else {
+        const entry = this.manifestEntries.get(subagentId);
+        if (entry && !entry.taskIds.includes(taskId)) entry.taskIds.push(taskId);
+      }
+    } else {
+      this.taskOwners.delete(taskId);
+    }
+    const description = this.taskDescriptions.get(taskId) ?? taskId;
+    this.fleetManager?.addPendingTask(taskId, subagentId ?? "", description);
+    this.stateCheckpoint?.recordTaskAssigned({
+      taskId,
+      subagentId,
+      description,
+      status: "running",
+      assignedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    this.scheduleManifest();
+    return true;
+  }
   async terminate(subagentId) {
     await this.coordinator.stop(subagentId);
   }
@@ -10349,6 +10606,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
   dir;
   events;
   secretScrubber;
+  isSessionInUse;
   /**
    * In-memory cache for load() results, keyed by session ID. The cache is
    * invalidated when the file's mtimeMs or size changes (indicating the
@@ -10368,6 +10626,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     this.dir = opts.dir;
     this.events = opts.events;
     this.secretScrubber = opts.secretScrubber;
+    this.isSessionInUse = opts.isSessionInUse;
   }
   /**
    * Clear the load() cache. Useful for testing or when the caller knows
@@ -11259,19 +11518,74 @@ var DefaultSessionStore = class _DefaultSessionStore {
     });
     await this.writeTombstone(id);
   }
+  /**
+   * Read the session id currently marked active in `active.json`, or `null`
+   * when the lock is absent/unreadable. Shared by {@link delete} and
+   * {@link prune} to avoid clobbering a session a live process is writing to.
+   */
+  async readActiveSessionId() {
+    try {
+      const raw = await fsp7.readFile(path4.join(this.dir, "active.json"), "utf8");
+      const active = JSON.parse(raw);
+      return active.sessionId ?? null;
+    } catch {
+      return null;
+    }
+  }
   async delete(id) {
+    const activeId = await this.readActiveSessionId();
+    if (activeId && id === activeId) {
+      throw new Error(
+        `Session ${id} is currently active in this project and cannot be deleted. Resume or start another session first.`
+      );
+    }
+    if (this.isSessionInUse) {
+      const reason = await this.isSessionInUse(id);
+      if (reason) {
+        throw new Error(`Session ${id} is in use (${reason}) and cannot be deleted.`);
+      }
+    }
     await this.deleteSession(id);
   }
+  async rename(id, name) {
+    const trimmed = name.trim();
+    const manifest = this.sessionPath(id, ".summary.json");
+    const jsonlPath = this.sessionPath(id, ".jsonl");
+    try {
+      await fsp7.stat(jsonlPath);
+    } catch (err) {
+      const code = err?.code;
+      if (code === "ENOENT") {
+        throw new Error(`Session not found: ${id}`);
+      }
+      throw err;
+    }
+    const summary = await this.summaryFor(id);
+    const { name: _drop, ...rest } = summary;
+    const updated = trimmed ? { ...rest, name: trimmed } : rest;
+    const t0 = Date.now();
+    let outcome = "success";
+    let errorMsg;
+    try {
+      await atomicWrite(manifest, JSON.stringify(updated), { mode: 384 });
+    } catch (err) {
+      outcome = "failure";
+      errorMsg = toErrorMessage(err);
+      this.emitError(id, manifest, "rename", errorMsg, false);
+      throw err;
+    } finally {
+      this.emitWrite(id, manifest, "close", outcome, Date.now() - t0, void 0, errorMsg);
+    }
+    await this.appendToIndex(updated);
+    this.invalidateShardManifestBySessionId(id);
+    this._indexCache = null;
+    this.clearLoadCache(id);
+    return updated;
+  }
   async prune(maxAgeDays = 30) {
     const cutoff = Date.now() - maxAgeDays * 864e5;
     let deleted = 0;
-    let activeSessionId = null;
-    try {
-      const raw = await fsp7.readFile(path4.join(this.dir, "active.json"), "utf8");
-      const active = JSON.parse(raw);
-      activeSessionId = active.sessionId ?? null;
-    } catch {
-    }
+    const activeSessionId = await this.readActiveSessionId();
     const isPrunableJsonl = (name) => name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
     const pruneFile = async (dir, name, prefix) => {
       const jsonlPath = path4.join(dir, name);
@@ -15461,7 +15775,9 @@ async function runProviderWithRetry(opts) {
         });
         throw toWrongStackError(err);
       }
-      const delay = Math.round(retry.delayMs(attempt));
+      const delay = Math.round(
+        retry.delayMs(attempt, isProviderErr ? err : errAsErr)
+      );
       const attemptNum = attempt + 1;
       const maxAttempts = retry.maxAttempts(isProviderErr ? err : errAsErr);
       logger.warn(`Provider retry ${attemptNum}/${maxAttempts} in ${delay}ms \u2014 ${description}`, {
@@ -15517,8 +15833,7 @@ var DefaultProviderRunner = class {
     return runProviderWithRetry(opts);
   }
 };
-
-// src/execution/retry-policy.ts
+var MAX_RETRY_AFTER_MS = 6e4;
 var DefaultRetryPolicy = class {
   shouldRetry(err, attempt) {
     if (err instanceof ProviderError) {
@@ -15540,13 +15855,37 @@ var DefaultRetryPolicy = class {
     }
     return 2;
   }
-  delayMs(attempt) {
+  /**
+   * Compute the retry delay.
+   *
+   * Precedence:
+   *   1. If `err` is a `ProviderError` with a populated
+   *      `body.retryAfterMs`, honour it — clamped into
+   *      [0, MAX_RETRY_AFTER_MS]. The provider told us exactly when
+   *      to come back; we should listen.
+   *   2. Otherwise fall through to the exponential-with-jitter
+   *      schedule (`1000 * 2^attempt + jitter`, capped at 30s).
+   *
+   * `err` is optional for back-compat with the existing interface;
+   * callers should pass it whenever available.
+   */
+  delayMs(attempt, err) {
+    const hint = retryAfterMsFromError(err);
+    if (hint !== void 0) {
+      return Math.max(0, Math.min(hint, MAX_RETRY_AFTER_MS));
+    }
     const base = 1e3;
     const exp = base * 2 ** attempt;
-    const jitter = Math.random() * base;
+    const jitter = randomInt(0, base);
     return Math.min(3e4, exp + jitter);
   }
 };
+function retryAfterMsFromError(err) {
+  if (!err || !(err instanceof ProviderError)) return void 0;
+  const ms = err.body?.retryAfterMs;
+  if (typeof ms !== "number" || !Number.isFinite(ms) || ms <= 0) return void 0;
+  return ms;
+}
 
 // src/models/llm-selector.ts
 init_expect_defined();
@@ -18641,7 +18980,7 @@ function describeCatalogModel(m) {
     ]
   };
 }
-function resolveProviderModelList(savedModels, catalog) {
+function resolveProviderModelList(savedModels, catalog, providerHint) {
   if (savedModels && savedModels.length > 0) {
     const byId = new Map((catalog?.models ?? []).map((m) => [m.id, m]));
     return savedModels.map((id) => {
@@ -18657,7 +18996,15 @@ function resolveProviderModelList(savedModels, catalog) {
       return { id, name: id, capabilities: [] };
     });
   }
-  if (catalog) return catalog.models.map(describeCatalogModel);
+  if (catalog && catalog.models.length > 0) return catalog.models.map(describeCatalogModel);
+  if (providerHint === "openai-codex") {
+    return CODEX_MODELS.map((m) => ({
+      id: m.id,
+      name: m.name,
+      description: m.description,
+      capabilities: []
+    }));
+  }
   return [];
 }
 
@@ -26437,7 +26784,11 @@ var KNOWN_DENIED_IN_PROJECT = [
   { key: "yolo", reason: "Disables all permission confirmation prompts." },
   { key: "extensions", reason: "Per-plugin config can carry command/credential fields." },
   { key: "hq", reason: "Carries HQ client token credential and endpoint URL." },
-  { key: "acp", reason: "Per-agent ACP command/args/env override \u2192 arbitrary command exec (RCE)." }
+  { key: "acp", reason: "Per-agent ACP command/args/env override \u2192 arbitrary command exec (RCE)." },
+  {
+    key: "fleet",
+    reason: "Fleet supervision knobs: a repo-committed config could enable autonomous subagent spawning/steering/termination and mailbox traffic on the victim machine."
+  }
 ];
 var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "version",
@@ -26479,7 +26830,8 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "hq",
   "sync",
   "extensions",
-  "acp"
+  "acp",
+  "fleet"
 ]);
 function assertInProjectAllowListComplete() {
   const missingFromBoth = [];