@wrongstack/core 0.297.0 → 0.298.0

package/dist/defaults/index.js

@@ -295,7 +295,7 @@ var InMemoryAgentBridge = class {
       });
     }
     this.inflightGuards.add(correlationId);
-    return new Promise((resolve16, reject) => {
+    return new Promise((resolve17, reject) => {
       const timer = setTimeout(() => {
         this.inflightGuards.delete(correlationId);
         this.pendingRequests.delete(correlationId);
@@ -314,7 +314,7 @@ var InMemoryAgentBridge = class {
         return;
       }
       this.pendingRequests.set(correlationId, {
-        resolve: resolve16,
+        resolve: resolve17,
         reject,
         timer
       });
@@ -663,13 +663,13 @@ var SubagentBudget = class _SubagentBudget {
     if (!bus?.hasListenerFor("budget.threshold_reached")) {
       return Promise.resolve("stop");
     }
-    return new Promise((resolve16) => {
+    return new Promise((resolve17) => {
       let resolved = false;
       const respond = (d) => {
         if (resolved) return;
         resolved = true;
         clearTimeout(fallback);
-        resolve16(d);
+        resolve17(d);
       };
       const fallback = setTimeout(() => respond("stop"), _SubagentBudget.DECISION_TIMEOUT_MS);
       const sessionId = this.currentSessionId();
@@ -808,7 +808,26 @@ var SubagentBudget = class _SubagentBudget {
 var ToolCapabilities = {
   /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
   SHELL_ARBITRARY: "shell.arbitrary",
-  /** Can execute a restricted set of commands (the `exec` tool). */
+  /**
+   * Can execute the `exec` tool's allowlisted commands.
+   *
+   * "Restricted" describes the command NAME check, not the resulting power.
+   * Treat this as equivalent to {@link SHELL_ARBITRARY} when deciding what to
+   * grant: the allowlist includes general-purpose interpreters (`node`,
+   * `python`, `perl`, `ruby`) and, on Windows, the platform shells (`cmd`,
+   * `powershell`, `pwsh`) — deliberately, since without them `exec` cannot run
+   * `dir`/`type`/any cmdlet. `node -e …` or `cmd /c …` therefore reaches
+   * arbitrary execution, and per-argument denylisting cannot close that while
+   * the shells remain (blocking `node -e` still leaves `cmd /c node -e`).
+   *
+   * What actually bounds this is downstream, not the name check: the permission
+   * policy reconstructs the full command line and runs it through the
+   * destructive classifier, so destructive calls still require confirmation.
+   *
+   * Granting `shell.restricted` while withholding `shell.arbitrary` therefore
+   * buys no meaningful reduction in blast radius. Documented rather than
+   * silently implied, because the two read as a narrow/wide pair (WS-083).
+   */
   SHELL_RESTRICTED: "shell.restricted",
   /** Can run a restricted project formatter/linter-style command. */
   SHELL_EXEC: "shell.exec",
@@ -5284,7 +5303,7 @@ function createDelegateTool(opts) {
   };
 }
 async function awaitDelegateAttempt(director, subagentId, taskId, timeoutMs, abortSignal) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     let settled = false;
     let timer;
     let offAbort = () => {
@@ -5297,7 +5316,7 @@ async function awaitDelegateAttempt(director, subagentId, taskId, timeoutMs, abo
       offIter();
       offProgress();
       offAbort();
-      resolve16(value);
+      resolve17(value);
     };
     const arm = () => {
       if (timer) clearTimeout(timer);
@@ -7151,10 +7170,10 @@ var DirectorTaskRegistry = class _DirectorTaskRegistry {
         pending: taskIds.filter((id) => !done.has(id))
       });
     }
-    return new Promise((resolve16) => {
+    return new Promise((resolve17) => {
       const entry = {
         ids: new Set(taskIds),
-        resolve: (result) => resolve16({
+        resolve: (result) => resolve17({
           completed: [result],
           pending: taskIds.filter((id) => id !== result.taskId)
         })
@@ -7162,7 +7181,7 @@ var DirectorTaskRegistry = class _DirectorTaskRegistry {
       if (opts?.timeoutMs !== void 0) {
         entry.timer = setTimeout(() => {
           this.anyWaiters.delete(entry);
-          resolve16({ completed: [], pending: [...taskIds], timedOut: true });
+          resolve17({ completed: [], pending: [...taskIds], timedOut: true });
         }, opts.timeoutMs);
       }
       this.anyWaiters.add(entry);
@@ -7236,6 +7255,25 @@ ${JSON.stringify(result.result, null, 2)}
       this.descriptions.delete(taskId);
     }
   }
+  /**
+   * Remove every task owned by `subagentId` from the descriptions/owners
+   * indexes and return the removed task ids. Director.remove() calls this so
+   * per-task state is reclaimed on the default FleetManager path too, where
+   * the Director's manifestEntries map is never populated (fleet-spawn.ts:289
+   * fills it only when !host.fleetManager) and the manifest-gated removeTasks
+   * call would otherwise be skipped — leaking one description (a full task
+   * brief, KB-scale) plus one owner entry per assigned task for the Director's
+   * lifetime. The owners index is populated on every path (assign/retarget),
+   * so this works with or without a FleetManager. Idempotent with removeTasks.
+   */
+  removeTasksOwnedBy(subagentId) {
+    const removed = [];
+    for (const [taskId, owner] of this.owners) {
+      if (owner === subagentId) removed.push(taskId);
+    }
+    this.removeTasks(removed);
+    return removed;
+  }
   resolveWaitersOnShutdown() {
     for (const entry of [...this.anyWaiters]) {
       if (entry.timer) clearTimeout(entry.timer);
@@ -7261,11 +7299,11 @@ ${JSON.stringify(result.result, null, 2)}
         this.makeStoppedResult(taskId, "director", `Unknown task id "${taskId}" \u2014 never assigned`)
       );
     }
-    let resolve16;
+    let resolve17;
     const promise = new Promise((done) => {
-      resolve16 = done;
+      resolve17 = done;
     });
-    this.taskWaiters.set(taskId, { promise, resolve: resolve16 });
+    this.taskWaiters.set(taskId, { promise, resolve: resolve17 });
     return promise;
   }
   recordAssignment(task) {
@@ -7431,12 +7469,13 @@ function rosterSummaryFromConfigs(roster) {
 // src/coordination/director-tools.ts
 import { randomUUID as randomUUID8 } from "node:crypto";
 import {
-  claimReadyTask,
-  finalizeTaskCompletion,
+  completeKanbanDispatch,
+  failKanbanDispatch,
   getBoard,
   heartbeatTaskAssignment,
   listReadyTasks,
-  transitionTask,
+  reserveKanbanDispatch,
+  startKanbanDispatch,
   updateTaskAssignment
 } from "@wrongstack/kanban";
 
@@ -8577,9 +8616,6 @@ function makeFleetTool(director) {
 }
 
 // src/coordination/director-tools.ts
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
 function makeSpawnTool(director, roster) {
   const dispatchCatalog = () => {
     if (!roster) return void 0;
@@ -8809,13 +8845,6 @@ function makeKanbanQueueTool(director, roster) {
         i.heartbeatIntervalMs ?? Math.floor(leaseTtlMs / 2)
       );
       const effectiveLeaseTtlMs = Math.max(leaseTtlMs, heartbeatIntervalMs * 2);
-      const claimedAt = nowIso();
-      const leaseSeeding = {
-        leaseId: randomUUID8(),
-        claimedAt,
-        heartbeatAt: claimedAt,
-        leaseExpiresAt: new Date(Date.now() + effectiveLeaseTtlMs).toISOString()
-      };
       const candidateTaskIds = i.taskId !== void 0 ? [i.taskId] : i.query ? (await listReadyTasks(projectRoot, {
         ...i.boardId !== void 0 ? { boardId: i.boardId } : {}
       })).filter((candidate) => matchesKanbanQueueQuery(candidate.task, i.query ?? "")).slice(0, maxTasks).map((candidate) => candidate.task.id) : void 0;
@@ -8827,24 +8856,28 @@ function makeKanbanQueueTool(director, roster) {
         const candidateTaskId = candidateTaskIds?.[index];
         if (candidateTaskIds && !candidateTaskId) break;
         if (candidateTaskId && budgetRejectedTaskIds.has(candidateTaskId)) continue;
-        const claim = await claimReadyTask(projectRoot, {
+        const reserved = await reserveKanbanDispatch(projectRoot, {
           ...i.boardId !== void 0 ? { boardId: i.boardId } : {},
           ...candidateTaskId !== void 0 ? { taskId: candidateTaskId } : {},
-          ...i.agentId !== void 0 ? { agentId: i.agentId } : {},
-          ...i.name !== void 0 ? { name: i.name } : {},
-          ...i.role !== void 0 ? { role: i.role } : {},
-          ...i.provider !== void 0 ? { provider: i.provider } : {},
-          ...i.model !== void 0 ? { model: i.model } : {},
-          ...i.fallbackModels !== void 0 ? { fallbackModels: i.fallbackModels } : {},
-          ...i.tools !== void 0 ? { tools: i.tools } : {},
-          ...i.allowedCapabilities !== void 0 ? { allowedCapabilities: i.allowedCapabilities } : {},
-          ...leaseSeeding !== void 0 ? leaseSeeding : {},
-          status: "queued"
+          routing: {
+            ...i.agentId !== void 0 ? { agentId: i.agentId } : {},
+            ...i.name !== void 0 ? { name: i.name } : {},
+            ...i.role !== void 0 ? { role: i.role } : {},
+            ...i.provider !== void 0 ? { provider: i.provider } : {},
+            ...i.model !== void 0 ? { model: i.model } : {},
+            ...i.fallbackModels !== void 0 ? { fallbackModels: i.fallbackModels } : {},
+            ...i.tools !== void 0 ? { tools: i.tools } : {},
+            ...i.allowedCapabilities !== void 0 ? { allowedCapabilities: i.allowedCapabilities } : {}
+          },
+          leaseTtlMs: effectiveLeaseTtlMs,
+          heartbeatIntervalMs
         });
-        if (!claim) {
+        if (!reserved) {
           if (candidateTaskIds) continue;
           break;
         }
+        const ourLeaseId = reserved.lease.leaseId;
+        const claim = reserved;
         let subagentId;
         let runTaskId;
         const costCeiling = claim.task.assignment?.costCeilingUsd;
@@ -8862,7 +8895,7 @@ function makeKanbanQueueTool(director, roster) {
                 status: "failed",
                 error: budgetError
               },
-              { expectedLeaseId: leaseSeeding.leaseId }
+              { expectedLeaseId: ourLeaseId }
             );
             errors.push({
               taskId: claim.task.id,
@@ -8888,8 +8921,8 @@ function makeKanbanQueueTool(director, roster) {
               // 10s lease, letting the lease expire before its first renewal.
               heartbeatIntervalMs,
               leaseTtlMs: effectiveLeaseTtlMs,
-              leaseId: leaseSeeding.leaseId,
-              leaseExpiresAt: leaseSeeding.leaseExpiresAt
+              leaseId: ourLeaseId,
+              leaseExpiresAt: reserved.lease.leaseExpiresAt
             }),
             ...i.maxToolCalls !== void 0 ? { maxToolCalls: i.maxToolCalls } : {},
             ...i.timeoutMs !== void 0 ? { timeoutMs: i.timeoutMs } : {},
@@ -8900,33 +8933,19 @@ function makeKanbanQueueTool(director, roster) {
                 taskId: claim.task.id,
                 origin: claim.task.origin,
                 projectRoot,
-                leaseId: leaseSeeding.leaseId
+                leaseId: ourLeaseId
               }
             }
           };
-          let dispatched = await updateTaskAssignment(
-            projectRoot,
-            claim.board.id,
-            claim.task.id,
-            {
-              ...claim.task.assignment ?? {},
-              status: "running",
-              subagentId,
-              runTaskId: dispatchTaskId,
-              // Renew the lease from the actual dispatch moment, not from claim
-              // time. The claim-time lease starts before spawn + queueing, so
-              // `timeoutMs + 60_000` can expire while the worker is still
-              // queued or running, letting recover_stale reclaim and duplicate
-              // the assignment (see auto-extend.ts: timeout extensions can push
-              // execution well past the original timeoutMs). Both heartbeatAt
-              // and leaseExpiresAt are stamped from now so the worker has a
-              // full lease window from the moment it was actually dispatched.
-              heartbeatAt: (/* @__PURE__ */ new Date()).toISOString(),
-              leaseExpiresAt: new Date(Date.now() + effectiveLeaseTtlMs).toISOString()
-            },
-            { expectedLeaseId: leaseSeeding.leaseId }
-          );
-          if (dispatched === null) {
+          const started = await startKanbanDispatch(projectRoot, {
+            boardId: claim.board.id,
+            taskId: claim.task.id,
+            leaseId: ourLeaseId,
+            actor: i.agentId ?? "director-agent",
+            subagentId,
+            runTaskId: dispatchTaskId
+          });
+          if (started === null) {
             try {
               await director.terminate(subagentId);
             } catch (cleanupErr) {
@@ -8942,27 +8961,6 @@ function makeKanbanQueueTool(director, roster) {
             });
             continue;
           }
-          if (dispatched?.lifecycle?.mode === "managed") {
-            const mTask = dispatched.tasks.find(
-              (candidate) => candidate.id === claim.task.id
-            );
-            if (mTask?.lifecycle?.currentStage === "todo") {
-              try {
-                const tr = await transitionTask(
-                  projectRoot,
-                  claim.board.id,
-                  claim.task.id,
-                  {
-                    to: "running",
-                    actor: i.agentId ?? "director-agent",
-                    comment: "Dispatched by kanban_queue."
-                  }
-                );
-                if (tr) dispatched = tr.board;
-              } catch {
-              }
-            }
-          }
           await director.assign(taskSpec);
           runTaskId = dispatchTaskId;
           dispatches.push({
@@ -8971,6 +8969,7 @@ function makeKanbanQueueTool(director, roster) {
             title: claim.task.title,
             subagentId,
             runTaskId,
+            leaseId: ourLeaseId,
             ...config.provider !== void 0 ? { provider: config.provider } : {},
             ...config.model !== void 0 ? { model: config.model } : {}
           });
@@ -8983,24 +8982,17 @@ function makeKanbanQueueTool(director, roster) {
               message = `${message}; cleanup failed for spawned subagent ${subagentId}: ${toErrorMessage(cleanupErr)}`;
             }
           }
-          await updateTaskAssignment(
-            projectRoot,
-            claim.board.id,
-            claim.task.id,
-            {
-              ...claim.task.assignment ?? {},
-              status: "failed",
-              ...subagentId !== void 0 ? { subagentId } : {},
-              ...runTaskId !== void 0 ? { runTaskId } : {},
-              error: message
-            },
-            { expectedLeaseId: leaseSeeding.leaseId }
-          );
+          await failKanbanDispatch(projectRoot, {
+            boardId: claim.board.id,
+            taskId: claim.task.id,
+            leaseId: ourLeaseId,
+            actor: "kanban-queue",
+            error: message
+          });
           errors.push({ taskId: claim.task.id, error: message });
         }
       }
       if (!i.awaitCompletion && dispatches.length > 0 && typeof director.fleet?.subscribe === "function") {
-        const ourLeaseId = leaseSeeding.leaseId;
         const disposers = /* @__PURE__ */ new Map();
         const renewalStartedAt = Date.now();
         const maxRenewalWindowMs = 24 * 60 * 6e4;
@@ -9023,7 +9015,7 @@ function makeKanbanQueueTool(director, roster) {
               taskId: dispatch.taskId,
               subagentId: dispatch.subagentId,
               runTaskId: dispatch.runTaskId,
-              ourLeaseId,
+              ourLeaseId: dispatch.leaseId,
               refreshedExpiry,
               director,
               disposers
@@ -9044,7 +9036,6 @@ function makeKanbanQueueTool(director, roster) {
       }
       let results;
       if (i.awaitCompletion && dispatches.length > 0) {
-        const ourLeaseId = leaseSeeding.leaseId;
         const runTaskIds = new Set(dispatches.map((dispatch) => dispatch.runTaskId));
         let heartbeatRunning = false;
         let heartbeatInFlight = Promise.resolve();
@@ -9056,7 +9047,7 @@ function makeKanbanQueueTool(director, roster) {
               const board = await getBoard(projectRoot, dispatch.boardId);
               const liveTask = board?.tasks.find((t) => t.id === dispatch.taskId);
               const liveLeaseId = liveTask?.assignment?.leaseId;
-              if (liveLeaseId !== void 0 && liveLeaseId !== ourLeaseId) {
+              if (liveLeaseId !== void 0 && liveLeaseId !== dispatch.leaseId) {
                 await director.terminate(dispatch.subagentId).catch(() => {
                 });
                 runTaskIds.delete(dispatch.runTaskId);
@@ -9067,7 +9058,7 @@ function makeKanbanQueueTool(director, roster) {
             try {
               await heartbeatTaskAssignment(projectRoot, dispatch.boardId, dispatch.taskId, {
                 leaseExpiresAt: refreshedExpiry,
-                expectedLeaseId: ourLeaseId
+                expectedLeaseId: dispatch.leaseId
               });
             } catch {
             }
@@ -9090,29 +9081,36 @@ function makeKanbanQueueTool(director, roster) {
           const dispatch = dispatches.find((candidate) => candidate.runTaskId === result.taskId);
           if (!dispatch) continue;
           runTaskIds.delete(dispatch.runTaskId);
-          const terminalWrite = await updateTaskAssignment(
-            projectRoot,
-            dispatch.boardId,
-            dispatch.taskId,
-            {
-              status: result.status === "success" ? "completed" : "failed",
-              subagentId: result.subagentId,
-              runTaskId: result.taskId,
-              ...result.status === "success" ? { lastResult: resultToText(result) } : { error: resultErrorText(result) }
-            },
-            { expectedLeaseId: ourLeaseId }
-          );
-          if (result.status === "success" && terminalWrite) {
-            try {
-              await finalizeTaskCompletion(projectRoot, dispatch.boardId, dispatch.taskId, {
-                eventContext: { actor: "kanban-queue" }
+          if (result.status === "success") {
+            const completed = await completeKanbanDispatch(projectRoot, {
+              boardId: dispatch.boardId,
+              taskId: dispatch.taskId,
+              leaseId: dispatch.leaseId,
+              actor: "kanban-queue",
+              result: resultToText(result)
+            });
+            if (!completed) {
+              resultFailures.push({
+                taskId: dispatch.taskId,
+                runTaskId: result.taskId,
+                status: "failed",
+                error: "Lease lost during completion write (reassigned by recovery)."
               });
-            } catch (error2) {
+            }
+          } else {
+            const failed = await failKanbanDispatch(projectRoot, {
+              boardId: dispatch.boardId,
+              taskId: dispatch.taskId,
+              leaseId: dispatch.leaseId,
+              actor: "kanban-queue",
+              error: resultErrorText(result)
+            });
+            if (!failed) {
               resultFailures.push({
                 taskId: dispatch.taskId,
                 runTaskId: result.taskId,
                 status: "failed",
-                error: `completion gate failed: ${toErrorMessage(error2)}`
+                error: "Lease lost during failure write (reassigned by recovery)."
               });
             }
           }
@@ -11475,12 +11473,12 @@ async function executeSubagentWithTimeout({
           }
           return new Promise((resolveDecision) => {
             let settled = false;
-            const resolve16 = (d) => {
+            const resolve17 = (d) => {
               if (settled) return;
               settled = true;
               resolveDecision(d);
             };
-            const fallback = setTimeout(() => resolve16("stop"), DECISION_TIMEOUT_MS);
+            const fallback = setTimeout(() => resolve17("stop"), DECISION_TIMEOUT_MS);
             const sessionId = currentSessionId();
             budget._events?.emit("budget.threshold_reached", {
               ...sessionId ? { sessionId } : {},
@@ -11490,11 +11488,11 @@ async function executeSubagentWithTimeout({
               timeoutMs: DECISION_TIMEOUT_MS,
               extend: (extra) => {
                 clearTimeout(fallback);
-                queueMicrotask(() => resolve16({ extend: extra }));
+                queueMicrotask(() => resolve17({ extend: extra }));
               },
               deny: () => {
                 clearTimeout(fallback);
-                resolve16("stop");
+                resolve17("stop");
               }
             });
           });
@@ -11881,7 +11879,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       taskIds.map((id) => {
         const cached = this.completedResults.find((r) => r.taskId === id);
         if (cached) return cached;
-        return new Promise((resolve16, reject) => {
+        return new Promise((resolve17, reject) => {
           const timeout = setTimeout(() => {
             this.off("task.completed", handler);
             reject(new Error(`awaitTasks timed out waiting for task "${id}"`));
@@ -11890,7 +11888,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
             if (result.taskId === id) {
               clearTimeout(timeout);
               this.off("task.completed", handler);
-              resolve16(result);
+              resolve17(result);
             }
           };
           this.on("task.completed", handler);
@@ -11915,13 +11913,13 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       const done = new Set(completed.map((r) => r.taskId));
       return { completed, pending: taskIds.filter((id) => !done.has(id)) };
     }
-    return new Promise((resolve16) => {
+    return new Promise((resolve17) => {
       let timer;
       const handler = ({ result }) => {
         if (!ids.has(result.taskId)) return;
         if (timer) clearTimeout(timer);
         this.off("task.completed", handler);
-        resolve16({
+        resolve17({
           completed: [result],
           pending: taskIds.filter((id) => id !== result.taskId)
         });
@@ -11929,7 +11927,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       if (opts?.timeoutMs !== void 0) {
         timer = setTimeout(() => {
           this.off("task.completed", handler);
-          resolve16({ completed: [], pending: [...taskIds], timedOut: true });
+          resolve17({ completed: [], pending: [...taskIds], timedOut: true });
         }, opts.timeoutMs);
       }
       this.on("task.completed", handler);
@@ -12497,67 +12495,118 @@ import * as path21 from "node:path";
 import * as fsp17 from "node:fs/promises";
 import * as path20 from "node:path";
 
+// src/security/file-permissions.ts
+import { chmod } from "node:fs/promises";
+var SECRET_FILE_MODE = 384;
+async function restrictFilePermissions(filePath, opts) {
+  const label = opts?.label ?? "file-permissions";
+  const warn = opts?.warn ?? ((msg) => console.warn(msg));
+  if (process.platform === "win32") {
+    try {
+      const { execFile: execFile2 } = await import("node:child_process");
+      const { promisify: promisify2 } = await import("node:util");
+      const execFileAsync = promisify2(execFile2);
+      const user = windowsAccountName();
+      if (!user) {
+        warn(
+          `[${label}] Could not determine the current Windows user for ${filePath}; skipping icacls hardening.`
+        );
+        return;
+      }
+      await execFileAsync("icacls", [filePath, "/inheritance:r", "/grant:r", `${user}:(F)`], {
+        windowsHide: true
+      });
+    } catch {
+      warn(
+        `[${label}] Could not restrict permissions on ${filePath} \u2014 it may be readable by other users on this system.`
+      );
+    }
+  } else {
+    try {
+      await chmod(filePath, SECRET_FILE_MODE);
+    } catch {
+    }
+  }
+}
+function windowsAccountName() {
+  const username = process.env.USERNAME || process.env.USER;
+  if (!username || username.includes("\0")) return void 0;
+  const domain = process.env.USERDOMAIN;
+  if (domain && !domain.includes("\0")) return `${domain}\\${username}`;
+  return username;
+}
+
 // src/security/secret-scrubber.ts
 var PATTERNS = [
   // Anchored at the start where possible so partial matches inside larger
   // strings don't trigger false positives.
   {
     type: "anthropic_key",
-    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g,
+    anchor: "sk-ant-"
   },
-  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g },
-  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g },
-  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g },
-  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g },
-  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g },
-  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g },
+  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
+  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
+  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
+  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g, anchor: "AIza" },
+  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g, anchor: "xox" },
   {
     type: "stripe_key",
-    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g,
+    anchor: "sk_"
   },
   {
     type: "twilio_sid",
-    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g,
+    anchor: "AC"
   },
   {
     type: "telegram_bot_token",
     // Telegram tokens are of the form  bot<digits>:<alphanum>  in URL paths
-    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "/bot"
   },
   {
     type: "jwt",
     // Anchored: look for literal "eyJ" which is unambiguous for JWT header
-    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g
+    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g,
+    anchor: "eyJ"
   },
   {
     type: "private_key",
     // Anchored: start must be BEGIN, end must be END with no extra dashes after END
-    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g
+    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g,
+    anchor: "-----BEGIN"
   },
-  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g },
-  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g },
-  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g },
-  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g },
+  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g, anchor: "mongodb" },
+  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g, anchor: "postgres" },
+  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g, anchor: "mysql://" },
+  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g, anchor: "redis://" },
   // AI/ML provider keys — modern LLM services with well-known prefixes
   {
     type: "huggingface_token",
     // HuggingFace tokens: hf_ followed by 34 alphanumeric chars
-    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g,
+    anchor: "hf_"
   },
   {
     type: "replicate_token",
     // Replicate tokens: r8_ followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "r8_"
   },
   {
     type: "perplexity_key",
     // Perplexity API keys: pplx- followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "pplx-"
   },
   {
     type: "groq_key",
     // Groq API keys: gsk_ followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "gsk_"
   },
   {
     type: "bearer_token",
@@ -12570,7 +12619,8 @@ var PATTERNS = [
     // tokens sharing a single delimiter (`Bearer a… Bearer b…`) must both be
     // redacted. A consuming trailing delimiter would eat the separator the
     // next match needs for its leading anchor, leaking the second token.
-    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g
+    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g,
+    anchor: "Bearer"
   },
   {
     type: "high_entropy_env",
@@ -12586,7 +12636,89 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+  },
+  // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
+  // The plugin runtime carried 37 patterns while this scrubber — the one that
+  // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
+  // audit — carried 22. The plugin side already had a parity test; it just did
+  // not cover core. Most consequential: WrongStack mints `gho_` tokens itself
+  // in the Copilot OAuth flow, and `gh[ousr]_` was absent here.
+  {
+    type: "github_oauth_token",
+    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g,
+    anchor: ["gho_", "ghu_", "ghs_", "ghr_"]
+  },
+  {
+    type: "gitlab_pat",
+    regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "glpat-"
+  },
+  {
+    type: "gitlab_runner_token",
+    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "glrt-"
+  },
+  {
+    type: "npm_token",
+    regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g,
+    anchor: "npm_"
+  },
+  {
+    type: "slack_app_token",
+    regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
+    anchor: "xapp-"
+  },
+  {
+    type: "slack_webhook",
+    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g,
+    anchor: "hooks.slack.com"
+  },
+  {
+    type: "sendgrid_key",
+    regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "SG."
+  },
+  {
+    type: "digitalocean_token",
+    regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g,
+    anchor: "dop_v1_"
+  },
+  {
+    type: "doppler_token",
+    regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "dp."
+  },
+  {
+    type: "shopify_token",
+    regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g,
+    anchor: "shp"
+  },
+  {
+    type: "docker_pat",
+    regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "dckr_pat_"
+  },
+  {
+    type: "linear_key",
+    regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "lin_api_"
+  },
+  {
+    type: "atlassian_token",
+    regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g,
+    anchor: "ATATT3"
+  },
+  {
+    type: "square_token",
+    regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: ["sq0atp-", "sq0csp-", "EAAA"]
+  },
+  {
+    type: "google_oauth_client_secret",
+    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "GOCSPX-"
   }
 ];
 var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
@@ -12595,32 +12727,32 @@ var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").reg
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PATTERN_ANCHORS = [
+  ...new Set(
+    PATTERNS.flatMap(
+      (pattern) => typeof pattern.anchor === "string" ? [pattern.anchor] : [...pattern.anchor]
+    )
+  )
+];
+var JSON_KEY_ANCHORS = [
+  '"apiKey"',
+  '"api_key"',
+  '"token"',
+  '"secret"',
+  '"password"',
+  '"authorization"',
+  '"bearer"',
+  '"private_key"',
+  '"access_token"',
+  '"refresh_token"',
+  '"client_secret"'
+];
+var ALL_ANCHORS = [...PATTERN_ANCHORS, ...JSON_KEY_ANCHORS];
 function hasCredentialAnchors(text) {
-  return text.includes("-----BEGIN") || // Private keys (most unique → cheap reject)
-  text.includes("sk-") || // Anthropic + OpenAI keys
-  text.includes("sk_") || // Stripe live/test keys
-  text.includes("ghp_") || // GitHub PAT v1
-  text.includes("github_pat_") || // GitHub PAT v2
-  text.includes("eyJ") || // JWT
-  text.includes("AKIA") || // AWS access key
-  text.includes("AIza") || // GCP service key
-  text.includes("xox") || // Slack token (xoxa/xoxb/xoxp/xoxo/xoxs)
-  text.includes("Bearer ") || // Bearer token (space suffix reduces false positives)
-  text.includes("/bot") || // Telegram bot token (URL path pattern)
-  text.includes("hf_") || // HuggingFace token
-  text.includes("r8_") || // Replicate token
-  text.includes("pplx-") || // Perplexity API key
-  text.includes("gsk_") || // Groq API key
-  text.includes("_KEY=") || // High-entropy env vars: API_KEY=, SECRET_KEY=, ...
-  text.includes("_TOKEN=") || // ACCESS_TOKEN=, AUTH_TOKEN=, ...
-  text.includes("_SECRET=") || // API_SECRET=, CLIENT_SECRET=, ...
-  text.includes("_PASSWORD=") || // DB_PASSWORD=, ROOT_PASSWORD=, ...
-  text.includes("mongodb://") || text.includes("mongodb+srv://") || text.includes("postgres://") || text.includes("postgresql://") || text.includes("mysql://") || text.includes("redis://") || // JSON-style credential keys: tool outputs often serialise objects as
-  // raw JSON strings rather than parsed objects. The value may not start
-  // with a recognisable prefix (sk-, ghp_, etc.), so we anchor on common
-  // key names. The `"` prefix avoids matching prose that happens to mention
-  // these words — JSON serialisation always quotes string keys.
-  text.includes('"apiKey"') || text.includes('"api_key"') || text.includes('"token"') || text.includes('"secret"') || text.includes('"password"') || text.includes('"authorization"') || text.includes('"bearer"') || text.includes('"private_key"') || text.includes('"access_token"') || text.includes('"refresh_token"') || text.includes('"client_secret"');
+  for (const anchor of ALL_ANCHORS) {
+    if (text.includes(anchor)) return true;
+  }
+  return false;
 }
 var DefaultSecretScrubber = class {
   scrub(text) {
@@ -12736,6 +12868,11 @@ var SECRET_NAME_PARTS = [
   "SECRET",
   "PASSWORD",
   "PASSWD",
+  // WRONGSTACK_VAULT_PASSPHRASE is the vault KEK. Without this entry it matched
+  // no rule here and fell through to the `WRONGSTACK_` prefix allow-rule, so the
+  // key that protects the credential vault was forwarded to every child process
+  // — including the agent's own exec/bash tools and MCP stdio servers (WS-033).
+  "PASSPHRASE",
   "AUTH",
   "CRED",
   "BEARER",
@@ -12922,6 +13059,65 @@ async function backupConfigFile(filePath, paths) {
   }
 }
 
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+function isPrimitiveArray(a) {
+  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
+}
+function deepMerge(base, patch, options = {}) {
+  const {
+    conflictResolution = "prefer-patch",
+    arrayMode = "replace",
+    protectProto = true,
+    onNonPrimitiveArrayReplace
+  } = options;
+  if (typeof base !== "object" || base === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (typeof patch !== "object" || patch === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
+      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+    }
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) || Array.isArray(patch)) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  const baseObj = base;
+  const patchObj = patch;
+  const out = { ...baseObj };
+  for (const [k, v] of Object.entries(patchObj)) {
+    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v, options);
+    } else if (Array.isArray(v) && Array.isArray(existing)) {
+      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
+        onNonPrimitiveArrayReplace(k, existing.length, v.length);
+      }
+      out[k] = deepMerge(existing, v, options);
+    } else if (v !== void 0) {
+      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
+        const existingLen = Array.isArray(existing) ? existing.length : 0;
+        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+      }
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
 // src/utils/message-invariants.ts
 function repairToolUseAdjacency(messages) {
   const removedToolUses = [];
@@ -13072,6 +13268,14 @@ var SKILL_LIMITS = {
    * Consumer: `downloadGitHubTarball`.
    */
   MAX_TARBALL_SIZE: 50 * 1024 * 1024,
+  /**
+   * Maximum size of a GitHub skill tarball after gzip decompression. The
+   * compressed download limit alone does not protect against highly
+   * compressible archives expanding until the process runs out of memory.
+   *
+   * Consumer: `downloadGitHubTarball`.
+   */
+  MAX_UNCOMPRESSED_TARBALL_SIZE: 64 * 1024 * 1024,
   /**
    * Default total char budget for skill bodies injected in eager mode when
    * `config.skills.eagerMaxChars` is unset. ~6k tokens. Skills are injected
@@ -13083,6 +13287,17 @@ var SKILL_LIMITS = {
    * `skillEagerMaxChars`).
    */
   EAGER_DEFAULT_MAX_CHARS: 24e3,
+  /**
+   * Default total char budget for compact (token-saving) skill bodies injected
+   * by `buildCompactSkillBodiesText`. Mirrors the eager ceiling so compact mode
+   * can never inject more total skill text than eager mode. Before this bound
+   * existed, compact mode injected EVERY skill's compact body with no cap, so
+   * the section grew linearly with the number of installed skills. Skills past
+   * the budget overflow to a name list the agent loads via the `skill` tool.
+   *
+   * Consumer: `buildCompactSkillBodiesText` (default for its `budget` param).
+   */
+  COMPACT_DEFAULT_MAX_CHARS: 24e3,
   /**
    * Auto-compact body limits (the token-saving fallback used when a skill has
    * no hand-crafted `SKILL.save.md`). The Overview and Rules sections are
@@ -13111,74 +13326,104 @@ var SKILL_LIMITS = {
   SKILL_BODY_LINE_LIMIT: 500
 };
 
-// src/utils/deep-merge.ts
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function isPrimitiveArray(a) {
-  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
+// src/skills/frontmatter.ts
+var SCALAR_KEYS = /* @__PURE__ */ new Set(["name", "description", "trigger", "version", "license", "compatibility"]);
+function parseSkillFrontmatter(raw) {
+  const text = normalizeLineEndings(raw);
+  if (!text.startsWith("---")) return {};
+  const end = text.indexOf("\n---", 4);
+  if (end === -1) return {};
+  return parseFrontmatterBlock(text.slice(4, end));
 }
-function deepMerge(base, patch, options = {}) {
-  const {
-    conflictResolution = "prefer-patch",
-    arrayMode = "replace",
-    protectProto = true,
-    onNonPrimitiveArrayReplace
-  } = options;
-  if (typeof base !== "object" || base === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (typeof patch !== "object" || patch === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) && Array.isArray(patch)) {
-    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
-      return [.../* @__PURE__ */ new Set([...base, ...patch])];
-    }
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) || Array.isArray(patch)) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  const baseObj = base;
-  const patchObj = patch;
-  const out = { ...baseObj };
-  for (const [k, v] of Object.entries(patchObj)) {
-    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v, options);
-    } else if (Array.isArray(v) && Array.isArray(existing)) {
-      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
-        onNonPrimitiveArrayReplace(k, existing.length, v.length);
-      }
-      out[k] = deepMerge(existing, v, options);
-    } else if (v !== void 0) {
-      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
-        const existingLen = Array.isArray(existing) ? existing.length : 0;
-        onNonPrimitiveArrayReplace(k, existingLen, v.length);
-      }
-      out[k] = v;
-    }
-  }
-  return out;
+function stripFrontmatter(raw) {
+  const text = normalizeLineEndings(raw);
+  if (!text.startsWith("---")) return text;
+  const end = text.indexOf("\n---", 4);
+  if (end === -1) return text;
+  let body = text.slice(end + 4);
+  if (body.startsWith("\n")) body = body.slice(1);
+  return body;
 }
-
-// src/utils/glob-match.ts
-function escapeRegex(s) {
-  return s.replace(/[.+^${}()|\\]/g, "\\$&");
+function normalizeLineEndings(s) {
+  return s.replace(/\r\n?/g, "\n");
 }
-var COMPILED_GLOB_CACHE = /* @__PURE__ */ new Map();
-var CACHE_MAX_SIZE = 2e3;
-var NEVER_MATCH = /[^\s\S]/;
-function getCachedGlob(pattern) {
-  const cached = COMPILED_GLOB_CACHE.get(pattern);
+function parseFrontmatterBlock(block) {
+  const out = {};
+  const lines = block.split("\n");
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i] ?? "";
+    const m = /^([a-zA-Z][a-zA-Z0-9_-]*):\s*(.*)$/.exec(line);
+    if (!m) {
+      i++;
+      continue;
+    }
+    const key = m[1] ?? "";
+    const rest = (m[2] ?? "").trim();
+    if (key === "metadata") {
+      const map = {};
+      i++;
+      while (i < lines.length) {
+        const sub = lines[i] ?? "";
+        const sm = /^\s+([a-zA-Z0-9_.-]+):\s*(.*)$/.exec(sub);
+        if (!sm) break;
+        map[sm[1] ?? ""] = unquote((sm[2] ?? "").trim());
+        i++;
+      }
+      if (Object.keys(map).length > 0) out.metadata = map;
+      continue;
+    }
+    if (rest === "|" || rest === ">") {
+      const collected = [];
+      i++;
+      while (i < lines.length) {
+        const sub = lines[i] ?? "";
+        if (sub === "" || sub.startsWith(" ") || sub.startsWith("	")) {
+          collected.push(sub.replace(/^\s+/, ""));
+          i++;
+        } else break;
+      }
+      out[normalizeKey(key)] = collected.join("\n").trim();
+      continue;
+    }
+    if (key === "allowed-tools" || key === "allowedTools") {
+      out.allowedTools = rest.split(/[\s,]+/).filter(Boolean);
+      i++;
+      continue;
+    }
+    if (SCALAR_KEYS.has(key)) {
+      out[key] = unquote(rest);
+      i++;
+      continue;
+    }
+    i++;
+  }
+  return out;
+}
+function normalizeKey(key) {
+  return key === "allowed-tools" ? "allowedTools" : key;
+}
+function unquote(s) {
+  if (s.length >= 2 && (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'"))) {
+    return s.slice(1, -1);
+  }
+  return s;
+}
+function isValidSkillNameFormat(name) {
+  return name.length >= 1 && name.length <= 64 && /^[a-z0-9]+(-[a-z0-9]+)*$/.test(name);
+}
+
+// src/utils/glob-match.ts
+function escapeRegex(s) {
+  return s.replace(/[.+^${}()|\\]/g, "\\$&");
+}
+var COMPILED_GLOB_CACHE = /* @__PURE__ */ new Map();
+var CACHE_MAX_SIZE = 2e3;
+var NEVER_MATCH = /[^\s\S]/;
+var COMMAND_WILDCARD_STOP = ";&|\\n\\r`$<>";
+function getCachedGlob(pattern, commandSubject = false) {
+  const cacheKey = commandSubject ? `cmd\0${pattern}` : pattern;
+  const cached = COMPILED_GLOB_CACHE.get(cacheKey);
   if (cached) return cached;
   if (COMPILED_GLOB_CACHE.size >= CACHE_MAX_SIZE) {
     const keys = [...COMPILED_GLOB_CACHE.keys()];
@@ -13188,33 +13433,35 @@ function getCachedGlob(pattern) {
   }
   let re;
   try {
-    re = compileGlob(pattern);
+    re = compileGlob(pattern, commandSubject);
   } catch {
     re = NEVER_MATCH;
   }
-  COMPILED_GLOB_CACHE.set(pattern, re);
+  COMPILED_GLOB_CACHE.set(cacheKey, re);
   return re;
 }
 var MAX_GLOB_PATTERN_LEN = 1024;
-function compileGlob(pattern) {
+function compileGlob(pattern, commandSubject = false) {
   if (pattern.length > MAX_GLOB_PATTERN_LEN) {
     throw new Error(`Glob pattern exceeds ${MAX_GLOB_PATTERN_LEN} characters`);
   }
+  const star = commandSubject ? `[^/${COMMAND_WILDCARD_STOP}]*` : "[^/]*";
+  const question = commandSubject ? `[^/${COMMAND_WILDCARD_STOP}]` : "[^/]";
   let i = 0;
   let re = "^";
   while (i < pattern.length) {
     const c = pattern[i];
     if (c === "*") {
       if (pattern[i + 1] === "*") {
-        re += ".*";
+        re += commandSubject ? `[^${COMMAND_WILDCARD_STOP}]*` : ".*";
         i += 2;
         if (pattern[i] === "/") i++;
       } else {
-        re += "[^/]*";
+        re += star;
         i++;
       }
     } else if (c === "?") {
-      re += "[^/]";
+      re += question;
       i++;
     } else if (c === "[") {
       let cls = "[";
@@ -13251,6 +13498,12 @@ function matchGlob(pattern, input) {
 function matchAny(patterns, input) {
   return patterns.some((p) => matchGlob(p, input));
 }
+function matchCommandGlob(pattern, input) {
+  return getCachedGlob(pattern, true).test(input);
+}
+function matchAnyCommand(patterns, input) {
+  return patterns.some((p) => matchCommandGlob(p, input));
+}
 
 // src/utils/json-repair.ts
 function completePartialObject(s) {
@@ -13351,10 +13604,10 @@ function validateAgainstSchema(value, schema) {
   return { ok: errors.length === 0, errors };
 }
 var MAX_SCHEMA_DEPTH = 64;
-function walk(value, schema, path39, errors, depth) {
+function walk(value, schema, path40, errors, depth) {
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path39 || "<root>",
+      path: path40 || "<root>",
       message: `schema nesting exceeds maximum depth (${MAX_SCHEMA_DEPTH})`
     });
     return;
@@ -13362,7 +13615,7 @@ function walk(value, schema, path39, errors, depth) {
   if (schema.enum !== void 0) {
     if (!enumIncludes(schema.enum, value)) {
       errors.push({
-        path: path39 || "<root>",
+        path: path40 || "<root>",
         message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
       });
       return;
@@ -13371,7 +13624,7 @@ function walk(value, schema, path39, errors, depth) {
   if (typeof schema.type === "string") {
     if (!checkType(value, schema.type)) {
       errors.push({
-        path: path39 || "<root>",
+        path: path40 || "<root>",
         message: `expected ${schema.type}, got ${describeType(value)} (${previewValue(value)})`
       });
       return;
@@ -13383,7 +13636,7 @@ function walk(value, schema, path39, errors, depth) {
       if (!(req in obj)) {
         const expected = schema.properties?.[req]?.type;
         errors.push({
-          path: joinPath(path39, req),
+          path: joinPath(path40, req),
           message: `required property missing${typeof expected === "string" ? ` (expected ${expected})` : ""}`
         });
       }
@@ -13391,14 +13644,14 @@ function walk(value, schema, path39, errors, depth) {
     if (schema.properties) {
       for (const [key, subSchema] of Object.entries(schema.properties)) {
         if (key in obj) {
-          walk(obj[key], subSchema, joinPath(path39, key), errors, depth + 1);
+          walk(obj[key], subSchema, joinPath(path40, key), errors, depth + 1);
         }
       }
     }
   }
   if (schema.type === "array" && Array.isArray(value) && schema.items) {
     for (let i = 0; i < value.length; i++) {
-      walk(value[i], schema.items, `${path39}[${i}]`, errors, depth + 1);
+      walk(value[i], schema.items, `${path40}[${i}]`, errors, depth + 1);
     }
   }
 }
@@ -13694,7 +13947,7 @@ function invalid(sessionId) {
 
 // src/utils/sleep.ts
 function sleep(ms) {
-  return new Promise((resolve16) => setTimeout(resolve16, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 
 // src/utils/slug.ts
@@ -13759,12 +14012,38 @@ function createToolOutputSerializer(opts = {}) {
       return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
     }
     const half = Math.floor(available / 2);
-    const first = text.slice(0, half);
-    const second = text.slice(text.length - half);
+    const first = utf8Prefix(text, half);
+    const second = utf8Suffix(text, available - Buffer.byteLength(first, "utf8"));
     return { text: `${first}${marker}${second}`, newBudget: 0 };
   }
   return { serialize, enforceCap, capBytes };
 }
+function utf8Prefix(text, maxBytes) {
+  if (maxBytes <= 0) return "";
+  let low = 0;
+  let high = text.length;
+  while (low < high) {
+    const mid = Math.ceil((low + high) / 2);
+    if (Buffer.byteLength(text.slice(0, mid), "utf8") <= maxBytes) low = mid;
+    else high = mid - 1;
+  }
+  let end = low;
+  if (end > 0 && /[\uD800-\uDBFF]/.test(text[end - 1])) end--;
+  return text.slice(0, end);
+}
+function utf8Suffix(text, maxBytes) {
+  if (maxBytes <= 0) return "";
+  let low = 0;
+  let high = text.length;
+  while (low < high) {
+    const chars = Math.ceil((low + high) / 2);
+    if (Buffer.byteLength(text.slice(text.length - chars), "utf8") <= maxBytes) low = chars;
+    else high = chars - 1;
+  }
+  let start = text.length - low;
+  if (start < text.length && /[\uDC00-\uDFFF]/.test(text[start])) start++;
+  return text.slice(start);
+}
 function renderToolObject(toolName, obj, input) {
   if (toolName === "read" && typeof obj["text"] === "string") {
     return joinSections([
@@ -14389,13 +14668,43 @@ function normalizePathSubject(value) {
 function isPathSubjectKey(subjectKey) {
   return subjectKey === "path" || subjectKey === "file" || subjectKey === "files";
 }
+function renderCommandLine(command, args) {
+  if (!Array.isArray(args) || args.length === 0) return command;
+  const rendered = args.map((arg) => {
+    const str = String(arg);
+    return /\s/.test(str) ? `"${str.replace(/"/g, '\\"')}"` : str;
+  });
+  return [command, ...rendered].join(" ");
+}
 function subjectForToolInput(toolName, input, subjectKey) {
   if (!input || typeof input !== "object") return void 0;
   const obj = input;
   if (subjectKey) {
     const value = obj[subjectKey];
     if (typeof value === "string") {
-      return isPathSubjectKey(subjectKey) ? normalizePathSubject(value) : escapeGlobSubject(value);
+      if (isPathSubjectKey(subjectKey)) {
+        const normalized = normalizePathSubject(value);
+        if (subjectKey === "files" && obj["check"] === true) return `${normalized}:check`;
+        if (subjectKey === "files" && obj["dry_run"] === true) return `${normalized}:dry-run`;
+        return normalized;
+      }
+      if (subjectKey === "command") {
+        const rendered = renderCommandLine(value, obj["args"]);
+        if (value === "commit" && obj["dry_run"] === true) {
+          return `${escapeGlobSubject(rendered)}:dry-run`;
+        }
+        return escapeGlobSubject(rendered);
+      }
+      if (subjectKey === "directory" && obj["dry_run"] === true) {
+        return `${escapeGlobSubject(value)}:dry-run`;
+      }
+      if (subjectKey === "packages" && obj["dry_run"] === true) {
+        return `${escapeGlobSubject(value)}:dry-run`;
+      }
+      if (subjectKey === "name" && obj["dry_run"] === true) {
+        return `${escapeGlobSubject(value)}:dry-run`;
+      }
+      return escapeGlobSubject(value);
     }
   }
   if (toolName === "bash" && typeof obj.command === "string") {
@@ -14419,6 +14728,23 @@ import * as fsp7 from "node:fs/promises";
 import * as path12 from "node:path";
 import { createInterface } from "node:readline";
 
+// src/storage/session-workspace-checkpoints.ts
+function requiredCheckpointCas(checkpointCas, operation) {
+  if (!checkpointCas) {
+    throw new Error(`Workspace checkpoint ${operation} requires a projectRoot-aware session store`);
+  }
+  return checkpointCas;
+}
+function captureCheckpoint(checkpointCas, sessionId, promptIndex) {
+  return requiredCheckpointCas(checkpointCas, "capture").capture(sessionId, promptIndex);
+}
+function materializeCheckpoint(checkpointCas, checkpoint, targetRoot) {
+  return requiredCheckpointCas(checkpointCas, "materialization").materialize(
+    checkpoint,
+    targetRoot
+  );
+}
+
 // src/storage/session-helpers.ts
 function consumeControlString(value, start) {
   let index = start;
@@ -15394,7 +15720,8 @@ var FileSessionWriter = class _FileSessionWriter {
       promptIndex,
       promptPreview,
       ts: (/* @__PURE__ */ new Date()).toISOString(),
-      fileCount
+      fileCount,
+      ...workspaceCheckpoint ? { workspaceCheckpoint } : {}
     });
   }
   async writeFileSnapshot(promptIndex, files) {
@@ -15587,8 +15914,8 @@ function sha256(content) {
   return createHash2("sha256").update(content).digest("hex");
 }
 function isInside(root, target) {
-  const relative7 = path13.relative(root, target);
-  return relative7 === "" || !relative7.startsWith("..") && !path13.isAbsolute(relative7);
+  const relative8 = path13.relative(root, target);
+  return relative8 === "" || !relative8.startsWith("..") && !path13.isAbsolute(relative8);
 }
 function normalizeRelative(input) {
   if (!input || path13.isAbsolute(input)) return null;
@@ -15600,8 +15927,8 @@ function normalizeRelative(input) {
 function parseNulPaths(output) {
   return output.split("\0").map(normalizeRelative).filter((value) => value !== null);
 }
-function isWrongStackWorktreePath(relative7) {
-  return relative7 === ".wrongstack/worktrees" || relative7.startsWith(".wrongstack/worktrees/");
+function isWrongStackWorktreePath(relative8) {
+  return relative8 === ".wrongstack/worktrees" || relative8.startsWith(".wrongstack/worktrees/");
 }
 var SessionCheckpointCas = class {
   rootDir;
@@ -15627,16 +15954,16 @@ var SessionCheckpointCas = class {
     }
     const relativePaths = [
       .../* @__PURE__ */ new Set([...parseNulPaths(tracked.stdout), ...parseNulPaths(untracked.stdout)])
-    ].filter((relative7) => !isWrongStackWorktreePath(relative7)).sort();
+    ].filter((relative8) => !isWrongStackWorktreePath(relative8)).sort();
     const unresolved = [];
     let scheduledBytes = 0;
     const captured = await mapWithConcurrency(
       relativePaths,
       CAPTURE_CONCURRENCY,
-      async (relative7) => {
-        const absolute = path13.resolve(this.projectRoot, ...relative7.split("/"));
+      async (relative8) => {
+        const absolute = path13.resolve(this.projectRoot, ...relative8.split("/"));
         if (!isInside(this.projectRoot, absolute)) {
-          unresolved.push({ path: relative7, reason: "path escapes project root" });
+          unresolved.push({ path: relative8, reason: "path escapes project root" });
           return null;
         }
         try {
@@ -15646,27 +15973,27 @@ var SessionCheckpointCas = class {
             const resolvedLink = path13.resolve(path13.dirname(absolute), linkTarget);
             if (path13.isAbsolute(linkTarget) || !isInside(this.projectRoot, resolvedLink)) {
               unresolved.push({
-                path: relative7,
+                path: relative8,
                 reason: "symlink target escapes project root"
               });
               return null;
             }
-            return { path: relative7, state: "symlink", linkTarget };
+            return { path: relative8, state: "symlink", linkTarget };
           }
           if (!stat15.isFile()) {
-            unresolved.push({ path: relative7, reason: "changed path is not a regular file" });
+            unresolved.push({ path: relative8, reason: "changed path is not a regular file" });
             return null;
           }
           if (stat15.size > MAX_BLOB_BYTES) {
             unresolved.push({
-              path: relative7,
+              path: relative8,
               reason: `file exceeds ${MAX_BLOB_BYTES}-byte checkpoint blob limit`
             });
             return null;
           }
           if (scheduledBytes + stat15.size > MAX_CHECKPOINT_BYTES) {
             unresolved.push({
-              path: relative7,
+              path: relative8,
               reason: `checkpoint exceeds ${MAX_CHECKPOINT_BYTES}-byte aggregate blob limit`
             });
             return null;
@@ -15675,12 +16002,12 @@ var SessionCheckpointCas = class {
           const content = await fsp8.readFile(absolute);
           const blobHash = sha256(content);
           await this.putBlob(blobHash, content);
-          return { path: relative7, state: "file", blobHash, mode: stat15.mode & 511 };
+          return { path: relative8, state: "file", blobHash, mode: stat15.mode & 511 };
         } catch (err) {
           if (err.code === "ENOENT") {
-            return { path: relative7, state: "absent" };
+            return { path: relative8, state: "absent" };
           }
-          unresolved.push({ path: relative7, reason: toErrorMessage(err) });
+          unresolved.push({ path: relative8, reason: toErrorMessage(err) });
           return null;
         }
       }
@@ -15870,8 +16197,8 @@ var SessionCheckpointCas = class {
     }
     return parsed;
   }
-  async safeOutputPath(target, realTarget, relative7) {
-    const normalized = normalizeRelative(relative7);
+  async safeOutputPath(target, realTarget, relative8) {
+    const normalized = normalizeRelative(relative8);
     if (!normalized) throw new Error("invalid relative path");
     const output = path13.resolve(target, ...normalized.split("/"));
     if (!isInside(target, output)) throw new Error("path escapes checkpoint target");
@@ -15891,7 +16218,7 @@ var SessionCheckpointCas = class {
   }
 };
 function defaultRunGit(args, cwd) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const stdoutChunks = [];
     const stderrChunks = [];
     let stdoutBytes = 0;
@@ -15934,8 +16261,8 @@ function defaultRunGit(args, cwd) {
       stdoutTruncated,
       stderrTruncated
     });
-    child.on("error", (err) => resolve16(result(1, err.message)));
-    child.on("close", (code) => resolve16(result(code ?? 1)));
+    child.on("error", (err) => resolve17(result(1, err.message)));
+    child.on("close", (code) => resolve17(result(code ?? 1)));
   });
 }
 
@@ -16012,8 +16339,8 @@ var MAX_REVALIDATE_BYTES = 5 * 1024 * 1024;
 var VALIDATION_CONCURRENCY = 8;
 var NOTICE_PATH_LIMIT = 20;
 function isInside2(root, target) {
-  const relative7 = path15.relative(root, target);
-  return relative7 === "" || !relative7.startsWith("..") && !path15.isAbsolute(relative7);
+  const relative8 = path15.relative(root, target);
+  return relative8 === "" || !relative8.startsWith("..") && !path15.isAbsolute(relative8);
 }
 function errno(err) {
   return err && typeof err === "object" && "code" in err ? String(err.code) : void 0;
@@ -16100,8 +16427,8 @@ function formatResumeValidationNotice(validation, projectRoot) {
   if (validation.staleFiles.length === 0) return null;
   const root = path15.resolve(projectRoot);
   const shown = validation.staleFiles.slice(0, NOTICE_PATH_LIMIT).map((entry) => {
-    const relative7 = path15.relative(root, entry.path);
-    const display = isInside2(root, entry.path) ? relative7 || "." : entry.path;
+    const relative8 = path15.relative(root, entry.path);
+    const display = isInside2(root, entry.path) ? relative8 || "." : entry.path;
     return `- ${JSON.stringify(display)} [${entry.status}]`;
   });
   const omitted = validation.staleFiles.length - shown.length;
@@ -16123,57 +16450,82 @@ function formatInterruptedToolNotice(pendingToolUseCount) {
   ].join("\n");
 }
 
-// src/storage/session-store/index-reader.ts
+// src/storage/session-store/delete-session-artifacts.ts
 import * as fsp10 from "node:fs/promises";
-function applySessionIndexLines(raw, byId, deleted) {
-  for (const line of raw.split("\n")) {
-    if (!line.trim()) continue;
-    try {
-      const entry = JSON.parse(line);
-      if (entry.action === "delete" && entry.id) {
-        deleted.add(entry.id);
-        byId.delete(entry.id);
-        continue;
-      }
-      if (entry.id && !deleted.has(entry.id)) {
-        byId.set(entry.id, entry);
-      }
-    } catch {
+import * as path17 from "node:path";
+
+// src/storage/session-store/paths.ts
+import * as path16 from "node:path";
+function sessionPath(storeDir, id, ext) {
+  return sessionScopedPath(storeDir, id, ext);
+}
+function shardManifestPath(storeDir, shardKey) {
+  return shardKey ? path16.join(storeDir, shardKey, "_manifest.json") : path16.join(storeDir, "_manifest.json");
+}
+function shardKeyForSessionId(id) {
+  const dirName = path16.dirname(id);
+  return dirName === "." ? "" : dirName;
+}
+async function ensureShardDir(storeDir, id) {
+  const dirPath = path16.dirname(sessionScopedPath(storeDir, id, ""));
+  await ensureDir(dirPath);
+  return dirPath;
+}
+
+// src/storage/session-store/delete-session-artifacts.ts
+async function deleteSessionArtifacts({
+  rootDir,
+  id,
+  jsonlPath
+}) {
+  const shardDir = path17.dirname(jsonlPath);
+  const base = path17.basename(id);
+  const sessDir = path17.join(shardDir, base);
+  const deletions = [
+    fsp10.unlink(jsonlPath),
+    fsp10.unlink(sessionPath(rootDir, id, ".summary.json")),
+    fsp10.unlink(sessionPath(rootDir, id, ".plan.json")),
+    fsp10.unlink(sessionPath(rootDir, id, ".tasks.json")),
+    fsp10.unlink(sessionPath(rootDir, id, ".todos.json"))
+  ];
+  const results = await Promise.allSettled(deletions);
+  for (const result of results) {
+    if (result.status === "rejected") {
+      warnDeleteFailure(id, result.reason);
     }
   }
+  await fsp10.rm(sessDir, { recursive: true, force: true }).catch((err) => {
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "session_store.rmdir_failed",
+        sessionId: id,
+        message: toErrorMessage(err),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  });
 }
-async function readFileRange(file, start, end) {
-  const length = end - start;
-  if (length <= 0) return { raw: "", end: start };
-  const buffer = Buffer.allocUnsafe(length);
-  let offset = 0;
-  let handle;
-  try {
-    handle = await fsp10.open(file, "r");
-    while (offset < length) {
-      const { bytesRead } = await handle.read(buffer, offset, length - offset, start + offset);
-      if (bytesRead === 0) return null;
-      offset += bytesRead;
-    }
-    let completeLength = buffer.length;
-    if (buffer.at(-1) !== 10) {
-      const lastNewline = buffer.lastIndexOf(10);
-      const trailing = buffer.subarray(lastNewline + 1).toString("utf8").trim();
-      try {
-        if (trailing) JSON.parse(trailing);
-        else completeLength = lastNewline + 1;
-      } catch {
-        completeLength = lastNewline + 1;
-      }
-    }
-    return {
-      raw: buffer.subarray(0, completeLength).toString("utf8"),
-      end: start + completeLength
-    };
-  } catch {
-    return null;
-  } finally {
-    await handle?.close().catch(() => void 0);
+function warnDeleteFailure(id, reason) {
+  const msg = reason instanceof Error ? reason.message : String(reason);
+  if (reason?.code === "ENOENT") return;
+  console.warn(
+    JSON.stringify({
+      level: "warn",
+      event: "session_store.delete_failed",
+      sessionId: id,
+      message: msg,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    })
+  );
+}
+
+// src/storage/session-store/delete-session-guards.ts
+async function assertSessionCanBeDeleted(sessionId, isSessionInUse) {
+  if (!isSessionInUse) return;
+  const reason = await isSessionInUse(sessionId);
+  if (reason) {
+    throw new Error(`Session ${sessionId} is in use (${reason}) and cannot be deleted.`);
   }
 }
 
@@ -16187,7 +16539,7 @@ function isSessionJsonlFileName(name) {
 
 // src/storage/session-store/directory-session-files.ts
 import * as fsp11 from "node:fs/promises";
-import * as path16 from "node:path";
+import * as path18 from "node:path";
 function sessionIdForFile(prefix, name) {
   const base = name.replace(/\.jsonl$/, "");
   return prefix ? `${prefix}/${base}` : base;
@@ -16209,12 +16561,12 @@ async function collectSessionFiles(dir, prefix = "", depth = 0) {
     if (entry.isDirectory()) {
       dirEntries.push(entry);
     } else if (entry.isFile() && isSessionJsonlFileName(entry.name)) {
-      files.push({ id: sessionIdForFile(prefix, entry.name), filePath: path16.join(dir, entry.name) });
+      files.push({ id: sessionIdForFile(prefix, entry.name), filePath: path18.join(dir, entry.name) });
     }
   }
   const childFileArrays = await Promise.all(
     dirEntries.map(
-      (entry) => collectSessionFiles(path16.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
+      (entry) => collectSessionFiles(path18.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
     )
   );
   return [...childFileArrays.flat(), ...files];
@@ -16238,210 +16590,35 @@ async function collectSessionIds(dir, prefix = "", depth = 0) {
   }
   const childIdArrays = await Promise.all(
     dirEntries.map(
-      (entry) => collectSessionIds(path16.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
+      (entry) => collectSessionIds(path18.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
     )
   );
   return [...childIdArrays.flat(), ...fileIds];
 }
 
-// src/storage/session-store/delete-session-artifacts.ts
-import * as fsp12 from "node:fs/promises";
-import * as path18 from "node:path";
-
-// src/storage/session-store/paths.ts
-import * as path17 from "node:path";
-function sessionPath(storeDir, id, ext) {
-  return sessionScopedPath(storeDir, id, ext);
-}
-function shardManifestPath(storeDir, shardKey) {
-  return shardKey ? path17.join(storeDir, shardKey, "_manifest.json") : path17.join(storeDir, "_manifest.json");
+// src/storage/session-store/events.ts
+function emitSessionStoreRead(events, sessionId, filePath, operation, outcome, durationMs, error2) {
+  events?.emit("storage.read", {
+    sessionId,
+    store: "session",
+    filePath,
+    operation,
+    outcome,
+    durationMs,
+    ...error2 !== void 0 ? { error: error2 } : {}
+  });
 }
-function shardKeyForSessionId(id) {
-  const dirName = path17.dirname(id);
-  return dirName === "." ? "" : dirName;
-}
-async function ensureShardDir(storeDir, id) {
-  const dirPath = path17.dirname(sessionScopedPath(storeDir, id, ""));
-  await ensureDir(dirPath);
-  return dirPath;
-}
-
-// src/storage/session-store/delete-session-artifacts.ts
-async function deleteSessionArtifacts({
-  rootDir,
-  id,
-  jsonlPath
-}) {
-  const shardDir = path18.dirname(jsonlPath);
-  const base = path18.basename(id);
-  const sessDir = path18.join(shardDir, base);
-  const deletions = [
-    fsp12.unlink(jsonlPath),
-    fsp12.unlink(sessionPath(rootDir, id, ".summary.json")),
-    fsp12.unlink(sessionPath(rootDir, id, ".plan.json")),
-    fsp12.unlink(sessionPath(rootDir, id, ".tasks.json")),
-    fsp12.unlink(sessionPath(rootDir, id, ".todos.json"))
-  ];
-  const results = await Promise.allSettled(deletions);
-  for (const result of results) {
-    if (result.status === "rejected") {
-      warnDeleteFailure(id, result.reason);
-    }
-  }
-  await fsp12.rm(sessDir, { recursive: true, force: true }).catch((err) => {
-    console.warn(
-      JSON.stringify({
-        level: "warn",
-        event: "session_store.rmdir_failed",
-        sessionId: id,
-        message: toErrorMessage(err),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
-  });
-}
-function warnDeleteFailure(id, reason) {
-  const msg = reason instanceof Error ? reason.message : String(reason);
-  if (reason?.code === "ENOENT") return;
-  console.warn(
-    JSON.stringify({
-      level: "warn",
-      event: "session_store.delete_failed",
-      sessionId: id,
-      message: msg,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    })
-  );
-}
-
-// src/storage/session-store/delete-session-guards.ts
-async function assertSessionCanBeDeleted(sessionId, isSessionInUse) {
-  if (!isSessionInUse) return;
-  const reason = await isSessionInUse(sessionId);
-  if (reason) {
-    throw new Error(`Session ${sessionId} is in use (${reason}) and cannot be deleted.`);
-  }
-}
-
-// src/storage/session-store/load-cache.ts
-var LOAD_CACHE_MAX_ENTRIES = 50;
-var LOAD_CACHE_MAX_BYTES = 64 * 1024 * 1024;
-var SessionLoadCache = class {
-  constructor(entries = /* @__PURE__ */ new Map()) {
-    this.entries = entries;
-  }
-  entries;
-  bytes = 0;
-  clear(sessionId) {
-    if (sessionId !== void 0) {
-      this.delete(sessionId);
-      return;
-    }
-    this.entries.clear();
-    this.bytes = 0;
-  }
-  getFresh(id, stat15, full) {
-    const cached = this.entries.get(id);
-    if (!cached || cached.mtimeMs !== stat15.mtimeMs || cached.size !== stat15.size) {
-      return null;
-    }
-    this.entries.delete(id);
-    this.entries.set(id, cached);
-    if (full) return cached.data;
-    return { ...cached.data, messages: [] };
-  }
-  set(id, stat15, data) {
-    this.delete(id);
-    while (stat15.size <= LOAD_CACHE_MAX_BYTES && (this.entries.size >= LOAD_CACHE_MAX_ENTRIES || this.bytes + stat15.size > LOAD_CACHE_MAX_BYTES)) {
-      const oldest = this.entries.keys().next().value;
-      if (oldest === void 0) break;
-      this.delete(oldest);
-    }
-    if (stat15.size <= LOAD_CACHE_MAX_BYTES) {
-      this.entries.set(id, { mtimeMs: stat15.mtimeMs, size: stat15.size, data });
-      this.bytes += stat15.size;
-    }
-  }
-  delete(sessionId) {
-    const cached = this.entries.get(sessionId);
-    if (cached) this.bytes = Math.max(0, this.bytes - cached.size);
-    this.entries.delete(sessionId);
-  }
-};
-
-// src/storage/session-store/prune-helpers.ts
-import * as fsp13 from "node:fs/promises";
-import * as path19 from "node:path";
-function isPrunableSessionJsonl(name) {
-  return name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
-}
-async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
-  const cutoff = Date.now() - maxAgeDays * 864e5;
-  let deleted = 0;
-  const pruneFile = async (dir, name, prefix) => {
-    const jsonlPath = path19.join(dir, name);
-    try {
-      const stat15 = await fsp13.stat(jsonlPath);
-      if (stat15.mtimeMs >= cutoff) return;
-    } catch {
-      return;
-    }
-    const base = name.replace(/\.jsonl$/, "");
-    const id = prefix ? `${prefix}/${base}` : base;
-    await deleteSession(id);
-    deleted++;
-  };
-  const entries = await fsp13.readdir(storeDir, { withFileTypes: true }).catch(() => []);
-  for (const entry of entries) {
-    if (entry.isFile()) {
-      if (isPrunableSessionJsonl(entry.name)) await pruneFile(storeDir, entry.name, "");
-      continue;
-    }
-    if (!entry.isDirectory()) continue;
-    const dateDir = path19.join(storeDir, entry.name);
-    const files = await fsp13.readdir(dateDir, { withFileTypes: true }).catch(() => []);
-    for (const file of files) {
-      if (!file.isFile() || !isPrunableSessionJsonl(file.name)) continue;
-      await pruneFile(dateDir, file.name, entry.name);
-    }
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const dateDir = path19.join(storeDir, entry.name);
-    try {
-      const remaining = await fsp13.readdir(dateDir);
-      if (remaining.length === 0) {
-        await fsp13.rmdir(dateDir).catch(() => void 0);
-      }
-    } catch {
-    }
-  }
-  return deleted;
-}
-
-// src/storage/session-store/events.ts
-function emitSessionStoreRead(events, sessionId, filePath, operation, outcome, durationMs, error2) {
-  events?.emit("storage.read", {
-    sessionId,
-    store: "session",
-    filePath,
-    operation,
-    outcome,
-    durationMs,
-    ...error2 !== void 0 ? { error: error2 } : {}
-  });
-}
-function emitSessionStoreWrite(events, sessionId, filePath, operation, outcome, durationMs, eventCount, error2) {
-  events?.emit("storage.write", {
-    sessionId,
-    store: "session",
-    filePath,
-    operation,
-    outcome,
-    durationMs,
-    ...eventCount !== void 0 ? { eventCount } : {},
-    ...error2 !== void 0 ? { error: error2 } : {}
-  });
+function emitSessionStoreWrite(events, sessionId, filePath, operation, outcome, durationMs, eventCount, error2) {
+  events?.emit("storage.write", {
+    sessionId,
+    store: "session",
+    filePath,
+    operation,
+    outcome,
+    durationMs,
+    ...eventCount !== void 0 ? { eventCount } : {},
+    ...error2 !== void 0 ? { error: error2 } : {}
+  });
 }
 function emitSessionStoreError(events, sessionId, filePath, operation, error2, recoverable) {
   events?.emit("storage.error", {
@@ -16568,6 +16745,106 @@ async function forkSession(host, id, opts = {}) {
   }
 }
 
+// src/storage/session-store/index-reader.ts
+import * as fsp12 from "node:fs/promises";
+function applySessionIndexLines(raw, byId, deleted) {
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (entry.action === "delete" && entry.id) {
+        deleted.add(entry.id);
+        byId.delete(entry.id);
+        continue;
+      }
+      if (entry.id && !deleted.has(entry.id)) {
+        byId.set(entry.id, entry);
+      }
+    } catch {
+    }
+  }
+}
+async function readFileRange(file, start, end) {
+  const length = end - start;
+  if (length <= 0) return { raw: "", end: start };
+  const buffer = Buffer.allocUnsafe(length);
+  let offset = 0;
+  let handle;
+  try {
+    handle = await fsp12.open(file, "r");
+    while (offset < length) {
+      const { bytesRead } = await handle.read(buffer, offset, length - offset, start + offset);
+      if (bytesRead === 0) return null;
+      offset += bytesRead;
+    }
+    let completeLength = buffer.length;
+    if (buffer.at(-1) !== 10) {
+      const lastNewline = buffer.lastIndexOf(10);
+      const trailing = buffer.subarray(lastNewline + 1).toString("utf8").trim();
+      try {
+        if (trailing) JSON.parse(trailing);
+        else completeLength = lastNewline + 1;
+      } catch {
+        completeLength = lastNewline + 1;
+      }
+    }
+    return {
+      raw: buffer.subarray(0, completeLength).toString("utf8"),
+      end: start + completeLength
+    };
+  } catch {
+    return null;
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+
+// src/storage/session-store/load-cache.ts
+var LOAD_CACHE_MAX_ENTRIES = 50;
+var LOAD_CACHE_MAX_BYTES = 64 * 1024 * 1024;
+var SessionLoadCache = class {
+  constructor(entries = /* @__PURE__ */ new Map()) {
+    this.entries = entries;
+  }
+  entries;
+  bytes = 0;
+  clear(sessionId) {
+    if (sessionId !== void 0) {
+      this.delete(sessionId);
+      return;
+    }
+    this.entries.clear();
+    this.bytes = 0;
+  }
+  getFresh(id, stat15, full) {
+    const cached = this.entries.get(id);
+    if (!cached || cached.mtimeMs !== stat15.mtimeMs || cached.size !== stat15.size) {
+      return null;
+    }
+    this.entries.delete(id);
+    this.entries.set(id, cached);
+    if (full) return cached.data;
+    return { ...cached.data, messages: [] };
+  }
+  set(id, stat15, data) {
+    this.delete(id);
+    while (stat15.size <= LOAD_CACHE_MAX_BYTES && (this.entries.size >= LOAD_CACHE_MAX_ENTRIES || this.bytes + stat15.size > LOAD_CACHE_MAX_BYTES)) {
+      const oldest = this.entries.keys().next().value;
+      if (oldest === void 0) break;
+      this.delete(oldest);
+    }
+    if (stat15.size <= LOAD_CACHE_MAX_BYTES) {
+      this.entries.set(id, { mtimeMs: stat15.mtimeMs, size: stat15.size, data });
+      this.bytes += stat15.size;
+    }
+  }
+  delete(sessionId) {
+    const cached = this.entries.get(sessionId);
+    if (cached) this.bytes = Math.max(0, this.bytes - cached.size);
+    this.entries.delete(sessionId);
+  }
+};
+
 // src/storage/session-store/load-session-data.ts
 import { createReadStream as createReadStream2 } from "node:fs";
 import { createInterface as createInterface2 } from "node:readline";
@@ -16822,6 +17099,178 @@ function emitDamaged(params, detail) {
   });
 }
 
+// src/storage/session-store/prune-helpers.ts
+import * as fsp13 from "node:fs/promises";
+import * as path19 from "node:path";
+function isPrunableSessionJsonl(name) {
+  return name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
+}
+async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
+  const cutoff = Date.now() - maxAgeDays * 864e5;
+  let deleted = 0;
+  const pruneFile = async (dir, name, prefix) => {
+    const jsonlPath = path19.join(dir, name);
+    try {
+      const stat15 = await fsp13.stat(jsonlPath);
+      if (stat15.mtimeMs >= cutoff) return;
+    } catch {
+      return;
+    }
+    const base = name.replace(/\.jsonl$/, "");
+    const id = prefix ? `${prefix}/${base}` : base;
+    await deleteSession(id);
+    deleted++;
+  };
+  const entries = await fsp13.readdir(storeDir, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (entry.isFile()) {
+      if (isPrunableSessionJsonl(entry.name)) await pruneFile(storeDir, entry.name, "");
+      continue;
+    }
+    if (!entry.isDirectory()) continue;
+    const dateDir = path19.join(storeDir, entry.name);
+    const files = await fsp13.readdir(dateDir, { withFileTypes: true }).catch(() => []);
+    for (const file of files) {
+      if (!file.isFile() || !isPrunableSessionJsonl(file.name)) continue;
+      await pruneFile(dateDir, file.name, entry.name);
+    }
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const dateDir = path19.join(storeDir, entry.name);
+    try {
+      const remaining = await fsp13.readdir(dateDir);
+      if (remaining.length === 0) {
+        await fsp13.rmdir(dateDir).catch(() => void 0);
+      }
+    } catch {
+    }
+  }
+  return deleted;
+}
+
+// src/storage/session-store/search-events.ts
+import * as fsp14 from "node:fs/promises";
+async function searchSessionEvents(args) {
+  const { file, secretScrubber, predicate, limit, signal } = args;
+  const out = [];
+  let stat15;
+  try {
+    stat15 = await fsp14.stat(file);
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  if (stat15.size === 0) return [];
+  let fh;
+  try {
+    fh = await fsp14.open(file, "r");
+    const CHUNK = 64 * 1024;
+    const buf = Buffer.alloc(CHUNK);
+    let leftover = "";
+    let eventIndex = 0;
+    for (let position = 0; ; position += buf.byteLength) {
+      if (signal?.aborted) {
+        const reason = signal.reason ?? new DOMException("Aborted", "AbortError");
+        throw reason;
+      }
+      const { bytesRead } = await fh.read(buf, 0, CHUNK, position);
+      if (bytesRead === 0) break;
+      const text = leftover + buf.subarray(0, bytesRead).toString("utf8");
+      const parts = text.split("\n");
+      leftover = parts.pop() ?? "";
+      for (const line of parts) {
+        if (!line) continue;
+        const ev = parseSessionEventLine(line, secretScrubber);
+        if (!ev) continue;
+        if (predicate(ev, eventIndex, ev.ts)) {
+          out.push({ event: ev, eventIndex, ts: ev.ts });
+          if (limit !== void 0 && out.length >= limit) return out;
+        }
+        eventIndex++;
+      }
+    }
+    const trailing = parseSessionEventLine(leftover.trim() ? leftover : "", secretScrubber);
+    if (trailing && predicate(trailing, eventIndex, trailing.ts)) {
+      out.push({ event: trailing, eventIndex, ts: trailing.ts });
+    }
+    return out;
+  } finally {
+    if (fh) await fh.close().catch(() => void 0);
+  }
+}
+function parseSessionEventLine(line, secretScrubber) {
+  if (!line) return null;
+  try {
+    const parsed = JSON.parse(line);
+    if (parsed === null || typeof parsed !== "object" || typeof parsed.type !== "string" || typeof parsed.ts !== "string") {
+      return null;
+    }
+    return scrubPersistedSessionEvent(parsed, secretScrubber);
+  } catch {
+    return null;
+  }
+}
+
+// src/storage/session-store/shard-manifest.ts
+import * as fsp15 from "node:fs/promises";
+
+// src/storage/session-summary.ts
+function compareSessionSummaries(a, b) {
+  const aActivity = a.lastActivityAt ?? a.endedAt ?? a.startedAt;
+  const bActivity = b.lastActivityAt ?? b.endedAt ?? b.startedAt;
+  if (aActivity < bActivity) return 1;
+  if (aActivity > bActivity) return -1;
+  if (a.startedAt < b.startedAt) return 1;
+  if (a.startedAt > b.startedAt) return -1;
+  return a.id.localeCompare(b.id);
+}
+function matchesSessionFilter(summary, criteria) {
+  if (criteria.since && summary.startedAt < criteria.since) return false;
+  if (criteria.until && summary.startedAt > criteria.until) return false;
+  if (criteria.provider && summary.provider !== criteria.provider) return false;
+  if (criteria.model && summary.model !== criteria.model) return false;
+  if (criteria.minTokens !== void 0 && summary.tokenTotal < criteria.minTokens) return false;
+  if (criteria.titleContains) {
+    const needle = criteria.titleContains.toLocaleLowerCase();
+    if (!summary.title.toLocaleLowerCase().includes(needle)) return false;
+  }
+  return true;
+}
+
+// src/storage/session-store/shard-manifest.ts
+async function readOrBuildShardManifestEntry(opts) {
+  try {
+    const raw = await fsp15.readFile(opts.manifestPath, "utf8");
+    const parsed = JSON.parse(raw);
+    return {
+      summaries: Array.isArray(parsed.summaries) ? parsed.summaries : [],
+      ids: Array.isArray(parsed.ids) ? parsed.ids : []
+    };
+  } catch {
+  }
+  const refs = await opts.collectSessionFilesInShard(opts.shardKey);
+  const candidates = await mapWithConcurrency(
+    refs,
+    opts.concurrency,
+    async (ref) => {
+      const manifest = await opts.readSummaryManifest(ref.id);
+      if (manifest) return { summary: manifest, needsBackfill: false };
+      const summary = await opts.summaryHeaderFor(ref);
+      if (!summary) return null;
+      const hydrated = await opts.summaryFor(summary.id).catch(() => summary);
+      return { summary: hydrated, needsBackfill: false };
+    }
+  );
+  const summaries = candidates.filter((candidate) => candidate !== null).map((candidate) => candidate.summary);
+  summaries.sort(compareSessionSummaries);
+  const entry = { summaries, ids: summaries.map((summary) => summary.id) };
+  await atomicWrite(opts.manifestPath, JSON.stringify(entry), { mode: 384 }).catch(
+    () => void 0
+  );
+  return entry;
+}
+
 // src/storage/session-store/summary-builder.ts
 import { createReadStream as createReadStream3 } from "node:fs";
 import { createInterface as createInterface3 } from "node:readline";
@@ -16961,11 +17410,11 @@ async function* iterateSessionEvents(file, secretScrubber) {
 }
 
 // src/storage/session-store/summary-header.ts
-import * as fsp14 from "node:fs/promises";
+import * as fsp16 from "node:fs/promises";
 async function readSessionSummaryHeader(ref, secretScrubber) {
   let mtime = (/* @__PURE__ */ new Date(0)).toISOString();
   try {
-    const stat15 = await fsp14.stat(ref.filePath);
+    const stat15 = await fsp16.stat(ref.filePath);
     if (!stat15.isFile()) return damagedSummary(ref.id, stat15.mtime.toISOString());
     mtime = stat15.mtime.toISOString();
   } catch {
@@ -17010,128 +17459,6 @@ function damagedSummary(id, startedAt) {
   };
 }
 
-// src/storage/session-store/shard-manifest.ts
-import * as fsp15 from "node:fs/promises";
-
-// src/storage/session-summary.ts
-function compareSessionSummaries(a, b) {
-  const aActivity = a.lastActivityAt ?? a.endedAt ?? a.startedAt;
-  const bActivity = b.lastActivityAt ?? b.endedAt ?? b.startedAt;
-  if (aActivity < bActivity) return 1;
-  if (aActivity > bActivity) return -1;
-  if (a.startedAt < b.startedAt) return 1;
-  if (a.startedAt > b.startedAt) return -1;
-  return a.id.localeCompare(b.id);
-}
-function matchesSessionFilter(summary, criteria) {
-  if (criteria.since && summary.startedAt < criteria.since) return false;
-  if (criteria.until && summary.startedAt > criteria.until) return false;
-  if (criteria.provider && summary.provider !== criteria.provider) return false;
-  if (criteria.model && summary.model !== criteria.model) return false;
-  if (criteria.minTokens !== void 0 && summary.tokenTotal < criteria.minTokens) return false;
-  if (criteria.titleContains) {
-    const needle = criteria.titleContains.toLocaleLowerCase();
-    if (!summary.title.toLocaleLowerCase().includes(needle)) return false;
-  }
-  return true;
-}
-
-// src/storage/session-store/shard-manifest.ts
-async function readOrBuildShardManifestEntry(opts) {
-  try {
-    const raw = await fsp15.readFile(opts.manifestPath, "utf8");
-    const parsed = JSON.parse(raw);
-    return {
-      summaries: Array.isArray(parsed.summaries) ? parsed.summaries : [],
-      ids: Array.isArray(parsed.ids) ? parsed.ids : []
-    };
-  } catch {
-  }
-  const refs = await opts.collectSessionFilesInShard(opts.shardKey);
-  const candidates = await mapWithConcurrency(
-    refs,
-    opts.concurrency,
-    async (ref) => {
-      const manifest = await opts.readSummaryManifest(ref.id);
-      if (manifest) return { summary: manifest, needsBackfill: false };
-      const summary = await opts.summaryHeaderFor(ref);
-      if (!summary) return null;
-      const hydrated = await opts.summaryFor(summary.id).catch(() => summary);
-      return { summary: hydrated, needsBackfill: false };
-    }
-  );
-  const summaries = candidates.filter((candidate) => candidate !== null).map((candidate) => candidate.summary);
-  summaries.sort(compareSessionSummaries);
-  const entry = { summaries, ids: summaries.map((summary) => summary.id) };
-  await atomicWrite(opts.manifestPath, JSON.stringify(entry), { mode: 384 }).catch(
-    () => void 0
-  );
-  return entry;
-}
-
-// src/storage/session-store/search-events.ts
-import * as fsp16 from "node:fs/promises";
-async function searchSessionEvents(args) {
-  const { file, secretScrubber, predicate, limit, signal } = args;
-  const out = [];
-  let stat15;
-  try {
-    stat15 = await fsp16.stat(file);
-  } catch (err) {
-    if (err.code === "ENOENT") return [];
-    throw err;
-  }
-  if (stat15.size === 0) return [];
-  let fh;
-  try {
-    fh = await fsp16.open(file, "r");
-    const CHUNK = 64 * 1024;
-    const buf = Buffer.alloc(CHUNK);
-    let leftover = "";
-    let eventIndex = 0;
-    for (let position = 0; ; position += buf.byteLength) {
-      if (signal?.aborted) {
-        const reason = signal.reason ?? new DOMException("Aborted", "AbortError");
-        throw reason;
-      }
-      const { bytesRead } = await fh.read(buf, 0, CHUNK, position);
-      if (bytesRead === 0) break;
-      const text = leftover + buf.subarray(0, bytesRead).toString("utf8");
-      const parts = text.split("\n");
-      leftover = parts.pop() ?? "";
-      for (const line of parts) {
-        if (!line) continue;
-        const ev = parseSessionEventLine(line, secretScrubber);
-        if (!ev) continue;
-        if (predicate(ev, eventIndex, ev.ts)) {
-          out.push({ event: ev, eventIndex, ts: ev.ts });
-          if (limit !== void 0 && out.length >= limit) return out;
-        }
-        eventIndex++;
-      }
-    }
-    const trailing = parseSessionEventLine(leftover.trim() ? leftover : "", secretScrubber);
-    if (trailing && predicate(trailing, eventIndex, trailing.ts)) {
-      out.push({ event: trailing, eventIndex, ts: trailing.ts });
-    }
-    return out;
-  } finally {
-    if (fh) await fh.close().catch(() => void 0);
-  }
-}
-function parseSessionEventLine(line, secretScrubber) {
-  if (!line) return null;
-  try {
-    const parsed = JSON.parse(line);
-    if (parsed === null || typeof parsed !== "object" || typeof parsed.type !== "string" || typeof parsed.ts !== "string") {
-      return null;
-    }
-    return scrubPersistedSessionEvent(parsed, secretScrubber);
-  } catch {
-    return null;
-  }
-}
-
 // src/storage/session-store.ts
 var DefaultSessionStore = class _DefaultSessionStore {
   dir;
@@ -17272,13 +17599,17 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async fork(id, opts = {}) {
     return forkSession(this, id, opts);
   }
+  /**
+   * Capture the deterministic post-tool workspace identity through the store-owned CAS.
+   */
+  async captureWorkspaceCheckpoint(sessionId, promptIndex) {
+    return captureCheckpoint(this.checkpointCas, sessionId, promptIndex);
+  }
+  /**
+   * Materialize a store-owned checkpoint into an already isolated workspace.
+   */
   async materializeWorkspaceCheckpoint(checkpoint, targetRoot) {
-    if (!this.checkpointCas) {
-      throw new Error(
-        "Workspace checkpoint materialization requires a projectRoot-aware session store"
-      );
-    }
-    return this.checkpointCas.materialize(checkpoint, targetRoot);
+    return materializeCheckpoint(this.checkpointCas, checkpoint, targetRoot);
   }
   async resolveId(query) {
     const normalized = query.trim();
@@ -17363,9 +17694,12 @@ var DefaultSessionStore = class _DefaultSessionStore {
       handle = await fsp17.open(file, "a", 384);
     } catch (err) {
       emitSessionStoreError(this.events, canonicalId, file, "resume", toErrorMessage(err), false);
-      throw new Error(`Failed to open session "${canonicalId}" for append: ${toErrorMessage(err)}`, {
-        cause: err
-      });
+      throw new Error(
+        `Failed to open session "${canonicalId}" for append: ${toErrorMessage(err)}`,
+        {
+          cause: err
+        }
+      );
     }
     try {
       const writer = new FileSessionWriter(
@@ -17562,7 +17896,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     await withFileLock(this.indexFile, async () => {
       await this.invalidateShardManifestBySessionId(summary.id);
       const line = JSON.stringify(summary) + "\n";
-      await fsp17.appendFile(this.indexFile, line, "utf8");
+      await fsp17.appendFile(this.indexFile, line, { encoding: "utf8", mode: SECRET_FILE_MODE });
       this._indexCache = null;
       this.indexAppendCount++;
       if (this.indexAppendCount >= _DefaultSessionStore.COMPACT_EVERY) {
@@ -17585,7 +17919,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
       await ensureDir(this.dir);
       await withFileLock(this.indexFile, async () => {
         const line = JSON.stringify({ action: "delete", id }) + "\n";
-        await fsp17.appendFile(this.indexFile, line, "utf8");
+        await fsp17.appendFile(this.indexFile, line, { encoding: "utf8", mode: SECRET_FILE_MODE });
         this._indexCache = null;
         await this.invalidateShardManifestBySessionId(id);
         this.indexAppendCount++;
@@ -17793,12 +18127,28 @@ var DefaultSessionStore = class _DefaultSessionStore {
       });
       outcome = "failure";
       errorMsg = "summary fallback \xE2\u20AC\u201D manifest rebuilt";
-      emitSessionStoreRead(this.events, id, manifest, "summary", outcome, Date.now() - t0, errorMsg);
+      emitSessionStoreRead(
+        this.events,
+        id,
+        manifest,
+        "summary",
+        outcome,
+        Date.now() - t0,
+        errorMsg
+      );
       return summary;
     } catch (err) {
       outcome = "failure";
       errorMsg = toErrorMessage(err);
-      emitSessionStoreRead(this.events, id, manifest, "summary", outcome, Date.now() - t0, errorMsg);
+      emitSessionStoreRead(
+        this.events,
+        id,
+        manifest,
+        "summary",
+        outcome,
+        Date.now() - t0,
+        errorMsg
+      );
       return {
         id,
         title: "(damaged)",
@@ -17813,14 +18163,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const manifest = this.sessionPath(id, ".summary.json");
     try {
       const raw = await fsp17.readFile(manifest, "utf8");
-      emitSessionStoreRead(
-        this.events,
-        id,
-        manifest,
-        "summary",
-        "success",
-        Date.now() - startTime
-      );
+      emitSessionStoreRead(this.events, id, manifest, "summary", "success", Date.now() - startTime);
       return JSON.parse(raw);
     } catch {
       return null;
@@ -18502,6 +18845,10 @@ var Director = class _Director {
         this.taskWorktrees.delete(tid);
       }
     }
+    this.tasks.removeTasksOwnedBy(subagentId);
+    for (const [taskId, update] of this.taskWorktrees) {
+      if (update.subagentId === subagentId) this.taskWorktrees.delete(taskId);
+    }
     this.budgetPolicy.removeSubagent(subagentId);
     this.manifestEntries.delete(subagentId);
     const meta = this.subagentMeta.get(subagentId);
@@ -20050,7 +20397,7 @@ var DefaultLogger = class _DefaultLogger {
         root.pendingFileWrites += 1;
         root.pendingFileBytes += bytes;
         this.enqueueRotate(this.file);
-        this._tail = this._tail.then(() => fsp20.appendFile(this.file, line)).catch(() => void 0).finally(() => {
+        this._tail = this._tail.then(() => fsp20.appendFile(this.file, line, { mode: 384 })).catch(() => void 0).finally(() => {
           root.pendingFileWrites = Math.max(0, root.pendingFileWrites - 1);
           root.pendingFileBytes = Math.max(0, root.pendingFileBytes - bytes);
         });
@@ -20725,14 +21072,6 @@ import { fileURLToPath as fileURLToPath3 } from "node:url";
 var KIT_FILE = "KIT.md";
 var TOKENS_FILE = "tokens.json";
 var FOUNDATIONS_ID = "_foundations";
-function stripFrontmatter(raw) {
-  if (!raw.startsWith("---")) return raw;
-  const end = raw.indexOf("\n---", 4);
-  if (end === -1) return raw;
-  let body = raw.slice(end + 4);
-  if (body.startsWith("\n")) body = body.slice(1);
-  return body;
-}
 function parseList(value) {
   const trimmed = value.trim();
   const inner = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
@@ -21281,12 +21620,12 @@ function verifyFiles(tokens, files) {
   const violations = [];
   let onPalette = 0;
   let offPalette = 0;
-  for (const { path: path39, text } of files) {
+  for (const { path: path40, text } of files) {
     const lines = text.split("\n");
     lines.forEach((lineText, i) => {
       const lineNo = i + 1;
       const flag = (snippet, reason, axis = "color") => {
-        violations.push({ file: path39, line: lineNo, snippet: snippet.slice(0, 80), reason, axis });
+        violations.push({ file: path40, line: lineNo, snippet: snippet.slice(0, 80), reason, axis });
       };
       for (const re of [HEX_RE, FUNC_COLOR_RE]) {
         re.lastIndex = 0;
@@ -21969,20 +22308,23 @@ function buildRecoveryStrategies(opts) {
         const delayMs = err.body?.retryAfterMs ?? 5e3;
         const delay = Math.min(6e4, Math.max(1e3, delayMs));
         if (ctx?.signal) {
-          await new Promise((resolve16) => {
+          await new Promise((resolve17) => {
             if (ctx.signal.aborted) {
-              resolve16();
+              resolve17();
               return;
             }
-            const timer = setTimeout(resolve16, delay);
-            ctx.signal.addEventListener(
-              "abort",
-              () => {
-                clearTimeout(timer);
-                resolve16();
-              },
-              { once: true }
-            );
+            let settled = false;
+            let timer;
+            const onAbort = () => finish();
+            const finish = () => {
+              if (settled) return;
+              settled = true;
+              if (timer !== void 0) clearTimeout(timer);
+              ctx.signal.removeEventListener("abort", onAbort);
+              resolve17();
+            };
+            timer = setTimeout(finish, delay);
+            ctx.signal.addEventListener("abort", onAbort, { once: true });
           });
         } else {
           await new Promise((r) => setTimeout(r, delay));
@@ -24172,8 +24514,8 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
         });
         await Promise.race([
           drainPromise,
-          new Promise((resolve16) => {
-            drainTimer = setTimeout(resolve16, STREAM_DRAIN_TIMEOUT_MS);
+          new Promise((resolve17) => {
+            drainTimer = setTimeout(resolve17, STREAM_DRAIN_TIMEOUT_MS);
           })
         ]);
       } finally {
@@ -24470,7 +24812,7 @@ async function runProviderWithRetry(opts) {
         status: isProviderErr ? err.status : 0,
         description
       });
-      await new Promise((resolve16, reject) => {
+      await new Promise((resolve17, reject) => {
         let settled = false;
         const cleanup = () => {
           clearTimeout(t);
@@ -24486,7 +24828,7 @@ async function runProviderWithRetry(opts) {
           if (settled) return;
           settled = true;
           cleanup();
-          resolve16();
+          resolve17();
         }, delay);
         if (signal.aborted) {
           onAbort();
@@ -25140,101 +25482,15 @@ function resolveForeignToolIdsWithWarnings(opt) {
     const ids = [];
     const unknownIds = [];
     for (const id of opt) {
-      if (KNOWN_FOREIGN_IDS.has(id)) ids.push(id);
-      else unknownIds.push(id);
-    }
-    return { ids, unknownIds };
-  }
-  return { ids: FOREIGN_SKILL_TOOLS.map((t) => t.id), unknownIds: [] };
-}
-
-// src/skills/frontmatter.ts
-var SCALAR_KEYS = /* @__PURE__ */ new Set(["name", "description", "version", "license", "compatibility"]);
-function parseSkillFrontmatter(raw) {
-  const text = normalizeLineEndings(raw);
-  if (!text.startsWith("---")) return {};
-  const end = text.indexOf("\n---", 4);
-  if (end === -1) return {};
-  return parseFrontmatterBlock(text.slice(4, end));
-}
-function normalizeLineEndings(s) {
-  return s.replace(/\r\n?/g, "\n");
-}
-function parseFrontmatterBlock(block) {
-  const out = {};
-  const lines = block.split("\n");
-  let i = 0;
-  while (i < lines.length) {
-    const line = lines[i] ?? "";
-    const m = /^([a-zA-Z][a-zA-Z0-9_-]*):\s*(.*)$/.exec(line);
-    if (!m) {
-      i++;
-      continue;
-    }
-    const key = m[1] ?? "";
-    const rest = (m[2] ?? "").trim();
-    if (key === "metadata") {
-      const map = {};
-      i++;
-      while (i < lines.length) {
-        const sub = lines[i] ?? "";
-        const sm = /^\s+([a-zA-Z0-9_.-]+):\s*(.*)$/.exec(sub);
-        if (!sm) break;
-        map[sm[1] ?? ""] = unquote((sm[2] ?? "").trim());
-        i++;
-      }
-      if (Object.keys(map).length > 0) out.metadata = map;
-      continue;
-    }
-    if (rest === "|" || rest === ">") {
-      const collected = [];
-      i++;
-      while (i < lines.length) {
-        const sub = lines[i] ?? "";
-        if (sub === "" || sub.startsWith(" ") || sub.startsWith("	")) {
-          collected.push(sub.replace(/^\s+/, ""));
-          i++;
-        } else break;
-      }
-      out[normalizeKey(key)] = collected.join("\n").trim();
-      continue;
-    }
-    if (key === "allowed-tools" || key === "allowedTools") {
-      out.allowedTools = rest.split(/[\s,]+/).filter(Boolean);
-      i++;
-      continue;
-    }
-    if (SCALAR_KEYS.has(key)) {
-      out[key] = unquote(rest);
-      i++;
-      continue;
-    }
-    i++;
-  }
-  return out;
-}
-function normalizeKey(key) {
-  return key === "allowed-tools" ? "allowedTools" : key;
-}
-function unquote(s) {
-  if (s.length >= 2 && (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'"))) {
-    return s.slice(1, -1);
+      if (KNOWN_FOREIGN_IDS.has(id)) ids.push(id);
+      else unknownIds.push(id);
+    }
+    return { ids, unknownIds };
   }
-  return s;
-}
-function isValidSkillNameFormat(name) {
-  return name.length >= 1 && name.length <= 64 && /^[a-z0-9]+(-[a-z0-9]+)*$/.test(name);
+  return { ids: FOREIGN_SKILL_TOOLS.map((t) => t.id), unknownIds: [] };
 }
 
 // src/execution/skill-loader.ts
-function stripFrontmatter2(raw) {
-  if (!raw.startsWith("---")) return raw;
-  const end = raw.indexOf("\n---", 4);
-  if (end === -1) return raw;
-  let body = raw.slice(end + 4);
-  if (body.startsWith("\n")) body = body.slice(1);
-  return body;
-}
 function compactSkillBody(body) {
   const sections = [];
   const overviewMatch = body.match(/##\s*Overview\s*\n([\s\S]*?)(?=\n##|\n$|$)/i);
@@ -25273,6 +25529,9 @@ var DefaultSkillLoader = class {
   cache;
   entriesCache;
   bodyCache = /* @__PURE__ */ new Map();
+  /** Load-time diagnostics from the most recent full `list()` scan. */
+  skipped = [];
+  shadowed = [];
   constructor(opts) {
     const readClaude = opts.readClaudeSkills !== false;
     const foreignIds = resolveForeignToolIds(opts.foreignSources);
@@ -25302,6 +25561,9 @@ var DefaultSkillLoader = class {
     if (this.cache) return this.cache;
     const found = [];
     const seen = /* @__PURE__ */ new Set();
+    const claimedBy = /* @__PURE__ */ new Map();
+    this.skipped = [];
+    this.shadowed = [];
     for (const { dir, source, originTool } of this.dirs) {
       try {
         const entries = (await fs5.readdir(dir, { withFileTypes: true })).sort(
@@ -25310,27 +25572,61 @@ var DefaultSkillLoader = class {
         for (const e of entries) {
           if (!await entryIsDirectory(dir, e)) continue;
           const skillFile = path25.join(dir, e.name, "SKILL.md");
+          let raw;
           try {
-            const raw = await fs5.readFile(skillFile, "utf8");
-            const fm = parseSkillFrontmatter(raw);
-            if (!fm.name || !fm.description) continue;
-            if (!isValidSkillNameFormat(fm.name)) continue;
-            if (seen.has(fm.name)) continue;
-            seen.add(fm.name);
-            found.push({
+            raw = await fs5.readFile(skillFile, "utf8");
+          } catch {
+            continue;
+          }
+          const fm = parseSkillFrontmatter(raw);
+          if (!fm.name) {
+            this.skipped.push({ dir, entry: e.name, reason: "missing-name" });
+            continue;
+          }
+          if (!fm.description) {
+            this.skipped.push({
+              dir,
+              entry: e.name,
+              reason: "missing-description",
+              name: fm.name
+            });
+            continue;
+          }
+          if (!isValidSkillNameFormat(fm.name)) {
+            this.skipped.push({
+              dir,
+              entry: e.name,
+              reason: "invalid-name-format",
+              name: fm.name
+            });
+            continue;
+          }
+          if (seen.has(fm.name)) {
+            const claimant = claimedBy.get(fm.name);
+            this.shadowed.push({
               name: fm.name,
-              description: fm.description,
-              version: fm.version,
-              license: fm.license,
-              compatibility: fm.compatibility,
-              metadata: fm.metadata,
-              allowedTools: fm.allowedTools,
-              path: skillFile,
               source,
-              originTool
+              path: skillFile,
+              shadowedBy: claimant?.source ?? "unknown",
+              shadowedByPath: claimant?.path
             });
-          } catch {
+            continue;
           }
+          seen.add(fm.name);
+          claimedBy.set(fm.name, { source, path: skillFile });
+          found.push({
+            name: fm.name,
+            description: fm.description,
+            trigger: fm.trigger,
+            version: fm.version,
+            license: fm.license,
+            compatibility: fm.compatibility,
+            metadata: fm.metadata,
+            allowedTools: fm.allowedTools,
+            path: skillFile,
+            source,
+            originTool
+          });
         }
       } catch {
       }
@@ -25359,11 +25655,12 @@ var DefaultSkillLoader = class {
     const skills = await this.list();
     const entries = [];
     for (const s of skills) {
-      const { trigger, scope } = parseDescriptionFromText(s.description ?? "");
+      const parsed = parseDescriptionFromText(s.description ?? "");
+      const trigger = s.trigger?.trim() || parsed.trigger;
       entries.push({
         name: s.name,
         trigger,
-        scope,
+        scope: parsed.scope,
         source: s.source,
         originTool: s.originTool,
         path: s.path
@@ -25376,6 +25673,16 @@ var DefaultSkillLoader = class {
     this.cache = void 0;
     this.entriesCache = void 0;
     this.bodyCache.clear();
+    this.skipped = [];
+    this.shadowed = [];
+  }
+  /**
+   * Load-time diagnostics from the most recent full `list()` scan: skills
+   * skipped as malformed and skills shadowed by a higher-priority layer.
+   * Returns copies so callers cannot mutate internal state.
+   */
+  diagnostics() {
+    return { skipped: [...this.skipped], shadowed: [...this.shadowed] };
   }
   async readBody(name) {
     const key = name.toLowerCase();
@@ -25399,7 +25706,7 @@ var DefaultSkillLoader = class {
       result = await fs5.readFile(savePath, "utf8");
     } catch {
       const full = await fs5.readFile(m.path, "utf8");
-      const body = stripFrontmatter2(full);
+      const body = stripFrontmatter(full);
       const compact = compactSkillBody(body);
       if (compact) {
         result = `## Overview
@@ -25935,6 +26242,9 @@ function readPolicy(ctx) {
 
 // src/execution/tool-executor.ts
 import { randomUUID as randomUUID16 } from "node:crypto";
+import * as fs9 from "node:fs/promises";
+import * as path30 from "node:path";
+import { isDeepStrictEqual } from "node:util";
 
 // src/observability/process-telemetry.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
@@ -25943,11 +26253,6 @@ function runWithProcessTelemetry(context, run) {
   return storage2.run(context, run);
 }
 
-// src/execution/tool-executor.ts
-import { isDeepStrictEqual } from "node:util";
-import * as fs9 from "node:fs/promises";
-import * as path30 from "node:path";
-
 // src/security/kanban-boundary.ts
 import { realpath as realpath3 } from "node:fs/promises";
 import * as path28 from "node:path";
@@ -26101,8 +26406,8 @@ function resolveInputPath(value, ctx) {
   return relativeToProject(absolute, ctx.projectRoot);
 }
 function relativeToProject(absolute, projectRoot) {
-  const relative7 = path28.relative(projectRoot, absolute).replace(/\\/g, "/");
-  return relative7.startsWith("../") || path28.isAbsolute(relative7) ? absolute : relative7 || ".";
+  const relative8 = path28.relative(projectRoot, absolute).replace(/\\/g, "/");
+  return relative8.startsWith("../") || path28.isAbsolute(relative8) ? absolute : relative8 || ".";
 }
 function extractPatchTargets(patchText, strip) {
   const targets = [];
@@ -26315,47 +26620,6 @@ function sliceUtf8Suffix(text, maxBytes) {
   return text.slice(start);
 }
 
-// src/execution/tool-executor-results.ts
-function unknownToolResult(use, listFns) {
-  return {
-    type: "tool_result",
-    tool_use_id: use.id,
-    content: `Tool "${use.name}" is not registered. Available tools: ${listFns().join(", ")}`,
-    is_error: true
-  };
-}
-function malformedInputResult(use, raw) {
-  let content = `Tool "${use.name}" received arguments that were not a valid JSON object, so they could not be parsed. Re-issue the call with the arguments encoded as a single well-formed JSON object matching the tool's input schema.`;
-  if (raw) {
-    const max = 800;
-    const excerpt2 = raw.length > max ? `${raw.slice(0, max)}\u2026 (truncated, ${raw.length} chars total)` : raw;
-    content += ` Common cause: a string field (e.g. code in old_string/new_string) contains literal newlines, quotes, or backslashes that must be JSON-escaped, or the payload was cut off mid-stream. The raw arguments received were:
-${excerpt2}`;
-  }
-  return {
-    type: "tool_result",
-    tool_use_id: use.id,
-    content,
-    is_error: true
-  };
-}
-function deniedResult(use, reason) {
-  return {
-    type: "tool_result",
-    tool_use_id: use.id,
-    content: `Tool "${use.name}" denied: ${reason ?? "policy"}`,
-    is_error: true
-  };
-}
-function blockedByHookResult(use, reason) {
-  return {
-    type: "tool_result",
-    tool_use_id: use.id,
-    content: `Tool "${use.name}" was blocked by a PreToolUse hook: ${reason ?? "no reason given"}`,
-    is_error: true
-  };
-}
-
 // src/execution/tool-executor-logging.ts
 function toolLogBase(ctx, use, toolName, durationMs) {
   return {
@@ -26420,6 +26684,82 @@ function logToolFailure(opts, ctx, use, toolName, durationMs, err) {
   });
 }
 
+// src/execution/tool-executor-results.ts
+function unknownToolResult(use, listFns) {
+  return {
+    type: "tool_result",
+    tool_use_id: use.id,
+    content: `Tool "${use.name}" is not registered. Available tools: ${listFns().join(", ")}`,
+    is_error: true
+  };
+}
+function malformedInputResult(use, raw) {
+  let content = `Tool "${use.name}" received arguments that were not a valid JSON object, so they could not be parsed. Re-issue the call with the arguments encoded as a single well-formed JSON object matching the tool's input schema.`;
+  if (raw) {
+    const max = 800;
+    const excerpt2 = raw.length > max ? `${raw.slice(0, max)}\u2026 (truncated, ${raw.length} chars total)` : raw;
+    content += ` Common cause: a string field (e.g. code in old_string/new_string) contains literal newlines, quotes, or backslashes that must be JSON-escaped, or the payload was cut off mid-stream. The raw arguments received were:
+${excerpt2}`;
+  }
+  return {
+    type: "tool_result",
+    tool_use_id: use.id,
+    content,
+    is_error: true
+  };
+}
+function deniedResult(use, reason) {
+  return {
+    type: "tool_result",
+    tool_use_id: use.id,
+    content: `Tool "${use.name}" denied: ${reason ?? "policy"}`,
+    is_error: true
+  };
+}
+function blockedByHookResult(use, reason) {
+  return {
+    type: "tool_result",
+    tool_use_id: use.id,
+    content: `Tool "${use.name}" was blocked by a PreToolUse hook: ${reason ?? "no reason given"}`,
+    is_error: true
+  };
+}
+
+// src/execution/tool-error-taxonomy.ts
+function toolErrorResult(use, err, opts = {}) {
+  const { category, retryable, detail } = classifyToolError(err);
+  const rawMessage = err instanceof Error ? err.message : typeof err === "string" ? err : "Unknown error";
+  const userMessage = opts.scrubber ? opts.scrubber(rawMessage) : rawMessage;
+  const info = {
+    category,
+    retryable,
+    userMessage,
+    ...detail !== void 0 ? { detail } : {}
+  };
+  const prefix = formatErrorPrefix(category, retryable);
+  const detailSuffix = detail ? ` [${detail}]` : "";
+  return {
+    type: "tool_result",
+    tool_use_id: use.id,
+    content: `${prefix}: ${userMessage}${detailSuffix}`,
+    is_error: true,
+    // Attach structured info for programmatic consumers (retry logic,
+    // audit log, observability).
+    _toolErrorInfo: info
+  };
+}
+function formatErrorPrefix(category, retryable) {
+  const label = CATEGORY_LABELS[category] ?? "Error";
+  return retryable ? `${label} (retryable)` : label;
+}
+var CATEGORY_LABELS = {
+  ["transient" /* TRANSIENT */]: "Transient error",
+  ["not_found" /* NOT_FOUND */]: "Not found",
+  ["permission" /* PERMISSION */]: "Permission denied",
+  ["validation" /* VALIDATION */]: "Validation error",
+  ["fatal" /* FATAL */]: "Error"
+};
+
 // src/execution/tool-executor-stream.ts
 async function executeStreamedTool({
   tool,
@@ -26520,12 +26860,27 @@ ${progressTail}` : progressTail;
 }
 
 // src/execution/tool-executor.ts
+async function mapWithConcurrency2(items, limit, run) {
+  if (items.length === 0) return [];
+  const results = new Array(items.length);
+  let nextIndex = 0;
+  const worker = async () => {
+    while (nextIndex < items.length) {
+      const index = nextIndex++;
+      results[index] = await run(items[index]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, () => worker()));
+  return results;
+}
 var ToolExecutor = class _ToolExecutor {
   constructor(registry, opts) {
     this.registry = registry;
     this.opts = opts;
     this.iterationTimeoutMs = opts.iterationTimeoutMs ?? 3e5;
     this.maxToolTimeoutMs = opts.maxToolTimeoutMs ?? 3e5;
+    const requestedParallelism = opts.maxParallelTools ?? 4;
+    this.maxParallelTools = Number.isFinite(requestedParallelism) ? Math.max(1, Math.min(16, Math.floor(requestedParallelism))) : 4;
     this.serializer = createToolOutputSerializer({
       perIterationOutputCapBytes: opts.perIterationOutputCapBytes ?? 1e5
     });
@@ -26541,6 +26896,7 @@ var ToolExecutor = class _ToolExecutor {
   serializer;
   iterationTimeoutMs;
   maxToolTimeoutMs;
+  maxParallelTools;
   /**
    * Clear the interactive confirm awaiter so the executor returns
    * `ToolConfirmPendingResult` instead of blocking on stdin. Used by
@@ -26734,18 +27090,18 @@ ${errorDetails}`,
         if (this.opts.confirmAwaiter) {
           const awaiter = this.opts.confirmAwaiter;
           const choice = await new Promise(
-            (resolve16, reject) => {
+            (resolve17, reject) => {
               const signal = ctx.signal;
-              const onAbort = () => resolve16("abort");
+              const onAbort = () => resolve17("abort");
               if (signal.aborted) {
-                resolve16("abort");
+                resolve17("abort");
                 return;
               }
               signal.addEventListener("abort", onAbort, { once: true });
               awaiter(tool, use.input, use.id, suggestedPattern).then(
                 (c) => {
                   signal.removeEventListener("abort", onAbort);
-                  resolve16(c);
+                  resolve17(c);
                 },
                 (e) => {
                   signal.removeEventListener("abort", onAbort);
@@ -26868,12 +27224,9 @@ ${post.additionalContext}`;
         const { category, retryable, detail } = classifyToolError(err);
         this.hintRenderMode(tool.name);
         this.opts.renderer?.writeToolResult(tool.name, scrubbed, true);
-        const result = {
-          type: "tool_result",
-          tool_use_id: use.id,
-          content: `Tool "${tool.name}" threw: ${scrubbed}`,
-          is_error: true
-        };
+        const result = toolErrorResult(use, err, {
+          scrubber: (s) => this.opts.secretScrubber.scrub(s)
+        });
         budget = this.budgetForString(result.content, budget);
         if (err instanceof Error) span?.recordError(err);
         span?.setAttribute("tool.is_error", true);
@@ -26893,21 +27246,17 @@ ${post.additionalContext}`;
         const isStructured = isWrongStackError(err);
         const msg = isStructured ? err.describe() : toErrorMessage(err);
         const scrubbed = this.opts.secretScrubber.scrub(msg);
-        const { category, retryable, detail } = classifyToolError(err);
         const tool = this.registry.get(use.name);
         const toolName = tool?.name ?? use.name;
         this.hintRenderMode(toolName);
         this.opts.renderer?.writeToolResult(toolName, scrubbed, true);
-        const result = {
-          type: "tool_result",
-          tool_use_id: use.id,
-          content: isStructured ? scrubbed : `Tool "${use.name}" execution failed: ${scrubbed}`,
-          is_error: true
-        };
+        const result = toolErrorResult(use, err, {
+          scrubber: (s) => this.opts.secretScrubber.scrub(s)
+        });
+        if (isStructured) {
+          result.content = scrubbed;
+        }
         budget = this.budgetForString(result.content, budget);
-        void category;
-        void retryable;
-        void detail;
         return { result, tool, durationMs: 0 };
       }
     };
@@ -26919,7 +27268,7 @@ ${post.additionalContext}`;
       return { outputs, remainingBudget: budget };
     }
     if (strategy === "parallel") {
-      const outputs = await Promise.all(toolUses.map((use) => safeRun(use)));
+      const outputs = await mapWithConcurrency2(toolUses, this.maxParallelTools, safeRun);
       return { outputs, remainingBudget: budget };
     }
     const nonMutating = [];
@@ -26930,7 +27279,7 @@ ${post.additionalContext}`;
       if (tool?.mutating) mutating.push(use);
       else nonMutating.push(use);
     }
-    const firstPass = await Promise.all(nonMutating.map((use) => safeRun(use)));
+    const firstPass = await mapWithConcurrency2(nonMutating, this.maxParallelTools, safeRun);
     const secondPass = [];
     for (const use of mutating) {
       secondPass.push(await safeRun(use));
@@ -27065,29 +27414,32 @@ ${post.additionalContext}`;
     let output;
     const execute = () => typeof tool.executeStream === "function" ? this.runStreamedTool(tool, input, ctx, combined, toolUseId) : (async () => tool.execute(input, ctx, { signal: combined }))();
     const telemetryToolCallId = toolUseId ?? `nested-${randomUUID16()}`;
-    const toolPromise = this.opts.events ? runWithNetworkTelemetry({
-      events: this.opts.events,
-      sessionId: resolveEventSessionId(ctx),
-      ...ctx.traceId ? { traceId: ctx.traceId } : {},
-      ...ctx.agentId ? { agentId: ctx.agentId } : {},
-      toolCallId: telemetryToolCallId,
-      initiator: "tool",
-      operationName: tool.name
-    }, () => runWithProcessTelemetry(
+    const toolPromise = this.opts.events ? runWithNetworkTelemetry(
       {
         events: this.opts.events,
         sessionId: resolveEventSessionId(ctx),
         ...ctx.traceId ? { traceId: ctx.traceId } : {},
         ...ctx.agentId ? { agentId: ctx.agentId } : {},
         toolCallId: telemetryToolCallId,
-        toolName: tool.name
+        initiator: "tool",
+        operationName: tool.name
       },
-      execute
-    )) : execute();
+      () => runWithProcessTelemetry(
+        {
+          events: this.opts.events,
+          sessionId: resolveEventSessionId(ctx),
+          ...ctx.traceId ? { traceId: ctx.traceId } : {},
+          ...ctx.agentId ? { agentId: ctx.agentId } : {},
+          toolCallId: telemetryToolCallId,
+          toolName: tool.name
+        },
+        execute
+      )
+    ) : execute();
     toolPromise.catch(() => {
     });
     try {
-      output = await new Promise((resolve16, reject) => {
+      output = await new Promise((resolve17, reject) => {
         const onAbort = () => {
           setTimeout(() => reject(abortReasonToError(combined.reason)), 0);
         };
@@ -27095,7 +27447,7 @@ ${post.additionalContext}`;
         toolPromise.then(
           (v) => {
             combined.removeEventListener("abort", onAbort);
-            resolve16(v);
+            resolve17(v);
           },
           (e) => {
             combined.removeEventListener("abort", onAbort);
@@ -28627,9 +28979,9 @@ var DefaultHealthRegistry = class {
   }
   async runOne(check) {
     let timer = null;
-    const timeout = new Promise((resolve16) => {
+    const timeout = new Promise((resolve17) => {
       timer = setTimeout(
-        () => resolve16({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
+        () => resolve17({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
         this.timeoutMs
       );
     });
@@ -28753,6 +29105,7 @@ function metricToolName(name) {
 }
 
 // src/observability/prometheus.ts
+import { timingSafeEqual } from "node:crypto";
 var NUMBER_FORMAT_INFINITY = "NaN";
 function escapeLabelValue(v) {
   return v.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/"/g, '\\"');
@@ -28809,21 +29162,47 @@ function renderPrometheus(snapshot) {
   return lines.join("\n") + "\n";
 }
 var PROMETHEUS_CONTENT_TYPE = "text/plain; version=0.0.4; charset=utf-8";
+function isLoopbackBindHost(host) {
+  const h = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  return h === "127.0.0.1" || h === "localhost" || h === "::1" || h.startsWith("127.");
+}
+function bearerMatches(header, token) {
+  if (!header) return false;
+  const prefix = "bearer ";
+  if (!header.toLowerCase().startsWith(prefix)) return false;
+  const supplied = Buffer.from(header.slice(prefix.length).trim(), "utf8");
+  const expected = Buffer.from(token, "utf8");
+  if (supplied.length !== expected.length) return false;
+  return timingSafeEqual(supplied, expected);
+}
 async function startMetricsServer(opts) {
   const tls = opts.tls;
   const useHttps = !!(tls?.cert && tls?.key);
   const host = opts.host ?? "127.0.0.1";
-  const path39 = opts.path ?? "/metrics";
+  const path40 = opts.path ?? "/metrics";
   const healthPath = opts.healthPath ?? "/healthz";
   const healthRegistry = opts.healthRegistry;
+  const token = opts.token;
+  if (!isLoopbackBindHost(host) && !token) {
+    throw new Error(
+      `startMetricsServer: refusing to bind to non-loopback host "${host}" without a token \u2014 pass a token to expose metrics to the network, or bind to 127.0.0.1.`
+    );
+  }
   const listener = (req, res) => {
     if (!req.url || req.method !== "GET") {
       res.statusCode = req.url ? 405 : 400;
       res.end();
       return;
     }
+    if (token && !bearerMatches(req.headers.authorization, token)) {
+      res.statusCode = 401;
+      res.setHeader("www-authenticate", "Bearer");
+      res.setHeader("content-type", "text/plain; charset=utf-8");
+      res.end("Unauthorized");
+      return;
+    }
     const url = req.url.split("?")[0];
-    if (url === path39) {
+    if (url === path40) {
       let body;
       try {
         body = renderPrometheus(opts.sink.snapshot());
@@ -28869,14 +29248,14 @@ async function startMetricsServer(opts) {
     const { createServer } = await import("node:http");
     server = createServer(listener);
   }
-  await new Promise((resolve16, reject) => {
+  await new Promise((resolve17, reject) => {
     const onError = (err) => {
       server.off("listening", onListening);
       reject(err);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve16();
+      resolve17();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -28887,9 +29266,9 @@ async function startMetricsServer(opts) {
   const protocol = useHttps ? "https" : "http";
   return {
     port: boundPort,
-    url: `${protocol}://${host}:${boundPort}${path39}`,
-    close: () => new Promise((resolve16, reject) => {
-      server.close((err) => err ? reject(err) : resolve16());
+    url: `${protocol}://${host}:${boundPort}${path40}`,
+    close: () => new Promise((resolve17, reject) => {
+      server.close((err) => err ? reject(err) : resolve17());
     })
   };
 }
@@ -29204,19 +29583,19 @@ var UNSAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set(["__proto__", "prototype", "
 function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function error(diagnostics, code, path39, message) {
-  diagnostics.push({ severity: "error", code, path: path39, message });
+function error(diagnostics, code, path40, message) {
+  diagnostics.push({ severity: "error", code, path: path40, message });
 }
-function validatePatterns(value, path39, diagnostics) {
+function validatePatterns(value, path40, diagnostics) {
   if (!Array.isArray(value)) {
-    error(diagnostics, "invalid_pattern_list", path39, "must be an array of strings");
+    error(diagnostics, "invalid_pattern_list", path40, "must be an array of strings");
     return void 0;
   }
   if (value.length > TRUST_POLICY_LIMITS.maxPatternsPerRule) {
     error(
       diagnostics,
       "too_many_patterns",
-      path39,
+      path40,
       `must contain at most ${TRUST_POLICY_LIMITS.maxPatternsPerRule} patterns`
     );
     return void 0;
@@ -29224,7 +29603,7 @@ function validatePatterns(value, path39, diagnostics) {
   const patterns = [];
   const seen = /* @__PURE__ */ new Set();
   for (const [index, pattern] of value.entries()) {
-    const itemPath = `${path39}[${index}]`;
+    const itemPath = `${path40}[${index}]`;
     if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > TRUST_POLICY_LIMITS.maxPatternChars) {
       error(
         diagnostics,
@@ -29307,37 +29686,304 @@ function validateTrustPolicy(value) {
         );
       }
     }
-    const rule = {};
-    for (const field of ["allow", "deny"]) {
-      if (rawRule[field] === void 0) continue;
-      const patterns = validatePatterns(rawRule[field], `${toolPath}.${field}`, diagnostics);
-      if (patterns) rule[field] = patterns;
+    const rule = {};
+    for (const field of ["allow", "deny"]) {
+      if (rawRule[field] === void 0) continue;
+      const patterns = validatePatterns(rawRule[field], `${toolPath}.${field}`, diagnostics);
+      if (patterns) rule[field] = patterns;
+    }
+    for (const field of ["auto", "trustWorkdir", "denyPrivate"]) {
+      const setting = rawRule[field];
+      if (setting === void 0) continue;
+      if (typeof setting !== "boolean") {
+        error(diagnostics, "invalid_boolean", `${toolPath}.${field}`, "must be a boolean");
+      } else {
+        rule[field] = setting;
+      }
+    }
+    policy[toolName] = rule;
+  }
+  return diagnostics.some((diagnostic) => diagnostic.severity === "error") ? { ok: false, diagnostics } : { ok: true, policy, diagnostics };
+}
+
+// src/security/yolo-risk.ts
+import * as path34 from "node:path";
+var CATASTROPHIC_PATTERNS = [
+  /\b(?:mkfs(?:\.[a-z0-9]+)?|mke2fs|newfs)\b/i,
+  // make a filesystem — wipes a partition
+  /\bformat\s+[A-Za-z]:/i,
+  // format C: — wipes a Windows volume
+  /\bdiskpart\b/i,
+  // Windows partition editor
+  /\bdd\b[^|]*\bof=(?:\/dev\/|\\\\[.?]\\)/i,
+  // dd writing straight to a raw device
+  />\s*\/dev\/(?:sd|hd|nvme|disk|mapper|vd)/i,
+  // redirect into a raw block device
+  /:\(\)\s*\{\s*:\|:&\s*\}\s*;/
+  // classic fork bomb
+];
+var HIGH_IMPACT_PATTERNS = [
+  /\b(?:curl|wget|fetch|httpie|http|irm|iwr|Invoke-WebRequest|Invoke-RestMethod)\b[\s\S]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash|zsh|fish|pwsh|powershell|iex|Invoke-Expression)\b/i,
+  /\b(?:powershell|pwsh)(?:\.exe)?\b[\s\S]{0,120}-(?:enc|encodedcommand)\b/i,
+  /\b(?:shutdown|reboot)\b/i
+];
+var CATASTROPHIC_POSIX_ROOTS = /* @__PURE__ */ new Set([
+  "/etc",
+  "/usr",
+  "/bin",
+  "/sbin",
+  "/lib",
+  "/lib64",
+  "/var",
+  "/boot",
+  "/dev",
+  "/sys",
+  "/proc",
+  "/opt",
+  "/root",
+  "/home",
+  "/srv",
+  "/run",
+  "/system",
+  "/library",
+  "/applications",
+  "/users"
+]);
+var CATASTROPHIC_WIN_SUBDIRS = /* @__PURE__ */ new Set([
+  "windows",
+  "system32",
+  "winnt",
+  "program files",
+  "program files (x86)",
+  "programdata",
+  "users"
+]);
+var SHELL_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", "|", ";", ">", ">>", "<", "2>", "2>>"]);
+function getInputString(input, key) {
+  if (!input || typeof input !== "object") return void 0;
+  const value = input[key];
+  return typeof value === "string" ? value : void 0;
+}
+function pathLooksInsideProject(rawPath, projectRoot) {
+  if (!projectRoot) return false;
+  if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
+  const resolved = path34.resolve(projectRoot, rawPath);
+  const relative8 = path34.relative(projectRoot, resolved);
+  return !!relative8 && !relative8.startsWith("..") && !path34.isAbsolute(relative8);
+}
+function tokenizeShell(command) {
+  return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
+}
+function commandSegment(tokens, start) {
+  const out = [];
+  for (let i = start; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (token === void 0 || SHELL_OPERATORS.has(token)) break;
+    out.push(token);
+  }
+  return out;
+}
+function hasShortFlag(args, letters) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const arg of args) {
+    if (!arg.startsWith("-") || arg.startsWith("--")) continue;
+    for (const ch of arg.replace(/^-+/, "")) seen.add(ch.toLowerCase());
+  }
+  return letters.split("").every((letter) => seen.has(letter));
+}
+function hasRecursiveForceDelete(command, projectRoot) {
+  const tokens = tokenizeShell(command);
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i]?.toLowerCase();
+    if (!token) continue;
+    if (token === "rm" || token === "rmdir") {
+      const args = commandSegment(tokens, i + 1);
+      const recursiveForce = hasShortFlag(args, "rf") || args.some((arg) => arg === "--recursive") && args.some((arg) => arg === "--force");
+      if (recursiveForce) {
+        const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
+        if (targets.length > 0 && targets.every((target) => target.trim().length === 0)) {
+          continue;
+        }
+        if (targets.length === 0) return true;
+        if (targets.some(isCatastrophicDeleteTarget)) return true;
+        if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
+      }
+    }
+    if (token === "remove-item" || token === "ri") {
+      const args = commandSegment(tokens, i + 1).map((arg) => arg.toLowerCase());
+      const recurse = args.some((arg) => arg === "-recurse" || arg === "-r");
+      const force = args.some((arg) => arg === "-force" || arg === "-f");
+      if (recurse && force && !args.includes("-whatif")) {
+        const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
+        if (targets.length === 0) return true;
+        if (targets.some(isCatastrophicDeleteTarget)) return true;
+        if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
+      }
+    }
+    if (token === "rd" || token === "rmdir") {
+      const args = commandSegment(tokens, i + 1).map((arg) => arg.toLowerCase());
+      if (args.includes("/s")) {
+        const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+        if (targets.length === 0) return true;
+        if (targets.some(isCatastrophicDeleteTarget)) return true;
+        if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
+      }
+    }
+  }
+  return false;
+}
+function hasGitHistoryRewrite(command) {
+  const tokens = tokenizeShell(command).map((token) => token.toLowerCase());
+  for (let i = 0; i < tokens.length; i++) {
+    if (tokens[i] !== "git") continue;
+    const args = commandSegment(tokens, i + 1);
+    if (args.includes("reset") && args.some((arg) => arg === "--hard" || arg.startsWith("--hard="))) {
+      return true;
+    }
+    const cleanIdx = args.indexOf("clean");
+    if (cleanIdx >= 0) {
+      const cleanArgs = args.slice(cleanIdx + 1);
+      if (cleanArgs.some((arg) => arg === "-f" || arg === "--force" || /^-[a-z]*f[a-z]*$/i.test(arg))) {
+        return true;
+      }
+    }
+    const pushIdx = args.indexOf("push");
+    if (pushIdx >= 0) {
+      const pushArgs = args.slice(pushIdx + 1);
+      if (pushArgs.some(
+        (arg) => arg === "-f" || arg === "--force" || arg === "--force-with-lease" || arg.startsWith("--force=") || arg.startsWith("--force-with-lease=")
+      )) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function hasExternalPublish(command) {
+  const tokens = tokenizeShell(command).map((token) => token.toLowerCase());
+  for (let i = 0; i < tokens.length; i++) {
+    const cmd = tokens[i];
+    if (!cmd) continue;
+    const args = commandSegment(tokens, i + 1);
+    if (["npm", "pnpm", "yarn", "bun"].includes(cmd) && (args.includes("publish") || args.includes("deploy"))) {
+      return true;
+    }
+    if (cmd === "cargo" && (args.includes("publish") || args.includes("yank"))) return true;
+    if ((cmd === "docker" || cmd === "podman") && args.includes("push")) return true;
+    if (cmd === "kubectl") {
+      const deleteIdx = args.indexOf("delete");
+      if (deleteIdx >= 0 && (args[deleteIdx + 1] === "namespace" || args[deleteIdx + 1] === "ns")) {
+        return true;
+      }
+      if (args.includes("drain")) return true;
+    }
+  }
+  return false;
+}
+function hasFindExec(command) {
+  const tokens = tokenizeShell(command).map((token) => token.toLowerCase());
+  for (let i = 0; i < tokens.length; i++) {
+    if (tokens[i] !== "find") continue;
+    const args = commandSegment(tokens, i + 1);
+    if (args.some((arg) => arg === "-exec" || arg === "-ok" || arg === "-execdir")) return true;
+  }
+  return false;
+}
+function isCatastrophicDeleteTarget(rawTarget) {
+  const t = rawTarget.replace(/^['"]|['"]$/g, "").trim();
+  if (!t) return false;
+  if (t === "*" || t === "." || t === "./" || t === ".\\" || t === "./*" || t === ".\\*") return true;
+  const s = t.replace(/[\\/]\*+$/, "").replace(/[\\/]+$/, "");
+  if (s === "") return true;
+  if (s === "~" || /^\$HOME$/i.test(s) || /^%USERPROFILE%$/i.test(s)) return true;
+  if (/^[A-Za-z]:$/.test(s)) return true;
+  const norm = s.toLowerCase().replace(/\\/g, "/");
+  if (CATASTROPHIC_POSIX_ROOTS.has(norm)) return true;
+  const win = norm.match(/^[a-z]:\/([^/]+)$/);
+  if (win?.[1] && CATASTROPHIC_WIN_SUBDIRS.has(win[1])) return true;
+  return false;
+}
+function hasCatastrophicDelete(command) {
+  const tokens = tokenizeShell(command);
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i]?.toLowerCase();
+    if (!token) continue;
+    if (token === "rm") {
+      const args = tokens.slice(i + 1);
+      const recursiveOrForce = args.some(
+        (arg) => /^-[^-]*[rf]/i.test(arg) || arg === "--recursive" || arg === "--force" || arg === "--no-preserve-root"
+      );
+      if (!recursiveOrForce) continue;
+      const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
+      if (targets.length === 0) return true;
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
+    }
+    if (token === "remove-item" || token === "ri") {
+      const args = tokens.slice(i + 1);
+      const recursive = args.some((arg) => {
+        const a = arg.toLowerCase();
+        return a === "-recurse" || a === "-force";
+      });
+      if (!recursive) continue;
+      const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
+    }
+    if (token === "rmdir" || token === "rd") {
+      const args = tokens.slice(i + 1);
+      const recursive = args.some((arg) => arg.toLowerCase() === "/s");
+      if (!recursive) continue;
+      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
-    for (const field of ["auto", "trustWorkdir", "denyPrivate"]) {
-      const setting = rawRule[field];
-      if (setting === void 0) continue;
-      if (typeof setting !== "boolean") {
-        error(diagnostics, "invalid_boolean", `${toolPath}.${field}`, "must be a boolean");
-      } else {
-        rule[field] = setting;
-      }
+    if (token === "del" || token === "erase") {
+      const args = tokens.slice(i + 1);
+      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
-    policy[toolName] = rule;
   }
-  return diagnostics.some((diagnostic) => diagnostic.severity === "error") ? { ok: false, diagnostics } : { ok: true, policy, diagnostics };
+  return false;
 }
-
-// src/security/yolo-risk.ts
-function getInputString(input, key) {
-  if (!input || typeof input !== "object") return void 0;
-  const value = input[key];
-  return typeof value === "string" ? value : void 0;
+function isClearlyDestructiveBashCommand(command, projectRoot) {
+  const trimmed = command.trim();
+  if (!trimmed) return false;
+  if (hasRecursiveForceDelete(trimmed, projectRoot)) return true;
+  if (hasGitHistoryRewrite(trimmed)) return true;
+  if (hasExternalPublish(trimmed)) return true;
+  if (hasFindExec(trimmed)) return true;
+  if (hasCatastrophicDelete(trimmed)) return true;
+  if (CATASTROPHIC_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
+  if (HIGH_IMPACT_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
+  return false;
 }
 
 // src/security/permission-policy.ts
 function matchesTrust(patterns, subject) {
   return patterns.includes(subject) || matchAny(patterns, subject);
 }
+function matchesCommandTrust(patterns, subject) {
+  return patterns.includes(subject) || matchAnyCommand(patterns, subject);
+}
+function hasShellSubject(tool) {
+  return tool.name === "bash" || tool.name === "shell" || tool.name === "exec" || hasCapability(tool, [
+    ToolCapabilities.SHELL_ARBITRARY,
+    ToolCapabilities.SHELL_RESTRICTED,
+    ToolCapabilities.SHELL_EXEC
+  ]);
+}
+function alwaysAllowUnavailableReason(tool, input) {
+  const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
+  if (subject !== void 0) return void 0;
+  return `"always allow" needs a subject to remember, and ${tool.name} calls do not carry one (no subjectKey, and no path/url/name input). Recording it would store a rule that can never match. Approve this call, or set a trust rule for ${tool.name} explicitly.`;
+}
+function permissionFingerprint(tool) {
+  const caps = [...tool.capabilities ?? []].sort();
+  return JSON.stringify([
+    tool.permission ?? "",
+    tool.riskTier ?? "",
+    tool.mutating ? "m" : "",
+    caps
+  ]);
+}
 function shellCommandLineFromInput(input) {
   const command = getInputString(input, "command") ?? getInputString(input, "cmd") ?? getInputString(input, "script");
   if (!command) return void 0;
@@ -29441,9 +30087,13 @@ var DefaultPermissionPolicy = class {
   /** Pre-compiled wildcard patterns — rebuilt on reload for O(1) lookup. */
   wildcardEntries = [];
   /**
-   * Evaluate-result cache. Keyed by `tool.name::subject` so repeated calls
-   * with the same tool+input skip namespace matching, subject computation,
-   * and pattern matching (matchAny).
+   * Evaluate-result cache. Keyed by `tool.name::subject::permissionFingerprint`
+   * so repeated calls with the same tool+input skip namespace matching,
+   * subject computation, and pattern matching (matchAny). The fingerprint
+   * suffix covers the `Tool` fields `evaluate()` reads (`permission`,
+   * `riskTier`, `mutating`, `capabilities`), so a tool redefined via
+   * `ToolRegistry.wrap()` misses the cache instead of inheriting a stale
+   * verdict.
    *
    * Cleared on any state change (reload, trust, deny, yolo toggle) because
    * the result depends on the full policy state. The write-tool smart-bypass
@@ -29459,11 +30109,46 @@ var DefaultPermissionPolicy = class {
   _evalCache = new LruCache(500);
   policyDiagnostics = [];
   policyInvalid = false;
+  /**
+   * When true, YOLO also auto-approves clearly destructive shell commands.
+   *
+   * WS-008: `isClearlyDestructiveBashCommand` was exported and heavily tested
+   * but called from zero production modules, so YOLO returned `auto` for
+   * everything — including `rm -rf`, git history rewrites, and external
+   * publishes. The `'yolo_destructive'` decision source, the getter/setter on
+   * PermissionPolicy, and the TUI branch that reads it all existed; only the
+   * gate itself was missing. Defaults to false: destructive commands still ask,
+   * even in YOLO.
+   */
+  yoloDestructive;
   constructor(opts) {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
+    this.yoloDestructive = opts.yoloDestructive ?? false;
     this.promptDelegate = opts.promptDelegate;
   }
+  /** Allow YOLO to cover destructive shell commands too (off by default). */
+  setYoloDestructive(enabled) {
+    if (this.yoloDestructive !== enabled) this._evalCache.clear();
+    this.yoloDestructive = enabled;
+  }
+  /** Whether YOLO currently extends to destructive shell commands. */
+  getYoloDestructive() {
+    return this.yoloDestructive;
+  }
+  /**
+   * True when YOLO is on but this specific call is a destructive shell command
+   * the user has not opted to auto-approve. Shared by `evaluate()` and the
+   * explain/trace path so the two cannot drift.
+   */
+  yoloBlockedAsDestructive(tool, input, ctx) {
+    if (!this.yolo || this.yoloDestructive) return false;
+    const isShellSurface = tool.name === "bash" || tool.name === "exec" || (tool.capabilities ?? []).includes("shell.arbitrary");
+    if (!isShellSurface) return false;
+    const command = getInputString(input, "command") ?? shellCommandLineFromInput(input);
+    if (!command) return false;
+    return isClearlyDestructiveBashCommand(command, ctx.projectRoot);
+  }
   /**
    * Replace (or clear) the interactive prompt delegate at runtime.
    * Used by the CLI to switch from inline prompts (REPL) to event-driven
@@ -29537,15 +30222,17 @@ var DefaultPermissionPolicy = class {
     this.loaded = true;
   }
   _logDeny(tool, subject, reason) {
-    console.warn(JSON.stringify({
-      level: "warn",
-      event: "permission.denied",
-      message: `Permission denied: ${tool}${subject ? ` (subject: ${subject})` : ""} \u2014 ${reason}`,
-      tool,
-      subject,
-      reason,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    }));
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "permission.denied",
+        message: `Permission denied: ${tool}${subject ? ` (subject: ${subject})` : ""} \u2014 ${reason}`,
+        tool,
+        subject,
+        reason,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
   }
   async evaluate(tool, input, ctx) {
     if (!this.loaded) await this.reload();
@@ -29561,14 +30248,19 @@ var DefaultPermissionPolicy = class {
     const entry = this.policy[tool.name] ?? namespaceEntry;
     const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
     const cacheKey = `${tool.name}::${subject ?? tool.name}`;
+    const evalKey = `${cacheKey}::${permissionFingerprint(tool)}`;
     if (tool.name !== "write") {
-      const cached = this._evalCache.get(cacheKey);
+      const cached = this._evalCache.get(evalKey);
       if (cached !== void 0) return cached;
     }
     if (this.sessionDenied.has(cacheKey)) {
       this._logDeny(tool.name, subject, "session soft deny (user pressed no)");
-      const decision = { permission: "deny", source: "deny", reason: "session soft deny (user pressed no)" };
-      this._evalCache.set(cacheKey, decision);
+      const decision = {
+        permission: "deny",
+        source: "deny",
+        reason: "session soft deny (user pressed no)"
+      };
+      this._evalCache.set(evalKey, decision);
       return decision;
     }
     if (this.sessionAllowed.has(cacheKey)) {
@@ -29582,31 +30274,51 @@ var DefaultPermissionPolicy = class {
     }
     if (entry?.deny && subject && matchesTrust(entry.deny, subject)) {
       this._logDeny(tool.name, subject, "matched deny pattern");
-      const decision = { permission: "deny", source: "deny", reason: "matched deny pattern" };
-      this._evalCache.set(cacheKey, decision);
+      const decision = {
+        permission: "deny",
+        source: "deny",
+        reason: "matched deny pattern"
+      };
+      this._evalCache.set(evalKey, decision);
       return decision;
     }
     if (tool.permission === "deny") {
       this._logDeny(tool.name, subject, "tool default deny");
-      const decision = { permission: "deny", source: "default", reason: "tool default deny" };
-      this._evalCache.set(cacheKey, decision);
+      const decision = {
+        permission: "deny",
+        source: "default",
+        reason: "tool default deny"
+      };
+      this._evalCache.set(evalKey, decision);
       return decision;
     }
-    if (entry?.allow && subject && matchesTrust(entry.allow, subject)) {
-      const decision = { permission: "auto", source: "trust", reason: "matched allow pattern" };
-      this._evalCache.set(cacheKey, decision);
+    const allowMatches = hasShellSubject(tool) ? matchesCommandTrust : matchesTrust;
+    if (entry?.allow && subject && allowMatches(entry.allow, subject)) {
+      const decision = {
+        permission: "auto",
+        source: "trust",
+        reason: "matched allow pattern"
+      };
+      this._evalCache.set(evalKey, decision);
       return decision;
     }
     if (entry?.auto) {
       const decision = { permission: "auto", source: "trust" };
-      this._evalCache.set(cacheKey, decision);
+      this._evalCache.set(evalKey, decision);
       return decision;
     }
     if (!this.yolo && this.isSensitiveReadCall(tool, input)) {
       if (this.promptDelegate) {
         const userDecision = await this.promptDelegate(tool, input, subject ?? tool.name);
         if (userDecision === "always") {
-          await this.trust({ tool: tool.name, pattern: subject ?? tool.name });
+          if (subject === void 0) {
+            return {
+              permission: "auto",
+              source: "user",
+              reason: `approved once \u2014 ${alwaysAllowUnavailableReason(tool, input)}`
+            };
+          }
+          await this.trust({ tool: tool.name, pattern: subject });
           return {
             permission: "auto",
             source: "user",
@@ -29632,8 +30344,16 @@ var DefaultPermissionPolicy = class {
       };
     }
     if (this.yolo) {
+      if (this.yoloBlockedAsDestructive(tool, input, ctx)) {
+        return {
+          permission: "confirm",
+          source: "yolo_destructive",
+          riskTier: "destructive",
+          reason: "destructive command needs explicit approval even in YOLO mode"
+        };
+      }
       const decision = { permission: "auto", source: "yolo" };
-      this._evalCache.set(cacheKey, decision);
+      this._evalCache.set(evalKey, decision);
       return decision;
     }
     if (tool.name === "write" && subject) {
@@ -29657,13 +30377,20 @@ var DefaultPermissionPolicy = class {
     const isMutating = tool.mutating || hasWriteCap || hasShellCap || hasInstallCap || hasConfigCap || hasSubagentCap;
     if (tool.permission === "auto" && !isMutating) {
       const decision = { permission: "auto", source: "default" };
-      this._evalCache.set(cacheKey, decision);
+      this._evalCache.set(evalKey, decision);
       return decision;
     }
     if (this.promptDelegate) {
       const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
       if (decision === "always") {
-        await this.trust({ tool: tool.name, pattern: subject ?? tool.name });
+        if (subject === void 0) {
+          return {
+            permission: "auto",
+            source: "user",
+            reason: `approved once \u2014 ${alwaysAllowUnavailableReason(tool, input)}`
+          };
+        }
+        await this.trust({ tool: tool.name, pattern: subject });
         return { permission: "auto", source: "user", reason: "user always-allowed" };
       }
       if (decision === "deny") {
@@ -29756,7 +30483,13 @@ var DefaultPermissionPolicy = class {
     if (this.policyInvalid) {
       add("policy invalid", true, "deny", "deny", "trust policy is invalid; all tools are denied");
       winnerIndex = 0;
-      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "deny", source: "deny", reason: "trust policy is invalid" } };
+      return {
+        toolName: tool.name,
+        subject,
+        steps,
+        winnerIndex,
+        decision: { permission: "deny", source: "deny", reason: "trust policy is invalid" }
+      };
     }
     add("policy valid", false, "auto", "default", "trust policy loaded successfully");
     const namespaceEntry = this.findNamespaceEntry(tool.name);
@@ -29764,39 +30497,143 @@ var DefaultPermissionPolicy = class {
     const namespaceSource = namespaceEntry ? `wildcard entry matched (${Object.keys(this.policy).find((k) => k.includes("*") && matchGlob(k, tool.name))})` : "no namespace match";
     const cacheKey = `${tool.name}::${subject ?? tool.name}`;
     if (this.sessionDenied.has(cacheKey)) {
-      add("session soft deny", true, "deny", "deny", 'user pressed "no" earlier in this session \u2014 blocked until reload');
+      add(
+        "session soft deny",
+        true,
+        "deny",
+        "deny",
+        'user pressed "no" earlier in this session \u2014 blocked until reload'
+      );
       winnerIndex = steps.length - 1;
-      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "deny", source: "deny", reason: "session soft deny (user pressed no)" } };
+      return {
+        toolName: tool.name,
+        subject,
+        steps,
+        winnerIndex,
+        decision: {
+          permission: "deny",
+          source: "deny",
+          reason: "session soft deny (user pressed no)"
+        }
+      };
     }
-    add("session soft deny", false, "deny", "deny", "no session-level soft deny for this tool+subject");
+    add(
+      "session soft deny",
+      false,
+      "deny",
+      "deny",
+      "no session-level soft deny for this tool+subject"
+    );
     if (this.sessionAllowed.has(cacheKey)) {
-      add("session soft allow", true, "auto", "trust", 'user pressed "yes" in current session \u2014 one-shot auto-approve (consumed)');
+      add(
+        "session soft allow",
+        true,
+        "auto",
+        "trust",
+        'user pressed "yes" in current session \u2014 one-shot auto-approve (consumed)'
+      );
       winnerIndex = steps.length - 1;
-      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "auto", source: "trust", reason: "session one-shot allow (user pressed yes)" } };
+      return {
+        toolName: tool.name,
+        subject,
+        steps,
+        winnerIndex,
+        decision: {
+          permission: "auto",
+          source: "trust",
+          reason: "session one-shot allow (user pressed yes)"
+        }
+      };
     }
-    add("session soft allow", false, "auto", "trust", "no session-level one-shot allow for this tool+subject");
+    add(
+      "session soft allow",
+      false,
+      "auto",
+      "trust",
+      "no session-level one-shot allow for this tool+subject"
+    );
     if (entry?.deny && subject && matchesTrust(entry.deny, subject)) {
-      add("trust deny", true, "deny", "deny", `subject "${subject}" matched a deny pattern in trust file`);
+      add(
+        "trust deny",
+        true,
+        "deny",
+        "deny",
+        `subject "${subject}" matched a deny pattern in trust file`
+      );
       winnerIndex = steps.length - 1;
-      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "deny", source: "deny", reason: "matched deny pattern" } };
+      return {
+        toolName: tool.name,
+        subject,
+        steps,
+        winnerIndex,
+        decision: { permission: "deny", source: "deny", reason: "matched deny pattern" }
+      };
     }
-    add("trust deny", false, "deny", "deny", `no deny pattern matched (namespace: ${namespaceSource})`);
+    add(
+      "trust deny",
+      false,
+      "deny",
+      "deny",
+      `no deny pattern matched (namespace: ${namespaceSource})`
+    );
     if (tool.permission === "deny") {
-      add("tool default deny", true, "deny", "default", `tool "${tool.name}" has permission: deny by default`);
+      add(
+        "tool default deny",
+        true,
+        "deny",
+        "default",
+        `tool "${tool.name}" has permission: deny by default`
+      );
       winnerIndex = steps.length - 1;
-      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "deny", source: "default", reason: "tool default deny" } };
+      return {
+        toolName: tool.name,
+        subject,
+        steps,
+        winnerIndex,
+        decision: { permission: "deny", source: "default", reason: "tool default deny" }
+      };
     }
-    add("tool default deny", false, "deny", "default", `tool "${tool.name}" has permission: "${tool.permission}"`);
+    add(
+      "tool default deny",
+      false,
+      "deny",
+      "default",
+      `tool "${tool.name}" has permission: "${tool.permission}"`
+    );
     if (entry?.allow && subject && matchesTrust(entry.allow, subject)) {
-      add("trust allow", true, "auto", "trust", `subject "${subject}" matched an allow pattern in trust file`);
+      add(
+        "trust allow",
+        true,
+        "auto",
+        "trust",
+        `subject "${subject}" matched an allow pattern in trust file`
+      );
       winnerIndex = steps.length - 1;
-      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "auto", source: "trust", reason: "matched allow pattern" } };
+      return {
+        toolName: tool.name,
+        subject,
+        steps,
+        winnerIndex,
+        decision: { permission: "auto", source: "trust", reason: "matched allow pattern" }
+      };
     }
-    add("trust allow", false, "auto", "trust", `no allow pattern matched (namespace: ${namespaceSource})`);
+    add(
+      "trust allow",
+      false,
+      "auto",
+      "trust",
+      `no allow pattern matched (namespace: ${namespaceSource})`
+    );
     if (entry?.auto) {
       add("trust auto", true, "auto", "trust", `trust file has auto: true for "${tool.name}"`);
       winnerIndex = steps.length - 1;
-      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "auto", source: "trust", reason: "trust auto" } };
+      return {
+        toolName: tool.name,
+        subject,
+        steps,
+        winnerIndex,
+        decision: { permission: "auto", source: "trust", reason: "trust auto" }
+      };
     }
     add("trust auto", false, "auto", "trust", `no auto flag for "${tool.name}" in trust file`);
     if (!this.yolo && this.isSensitiveReadCall(tool, input)) {
@@ -29809,13 +30646,64 @@ var DefaultPermissionPolicy = class {
         hasDelegate2 ? "sensitive file read detected \u2014 would prompt user for approval" : "sensitive file read detected \u2014 returns confirm (no prompt delegate)"
       );
       winnerIndex = steps.length - 1;
-      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "confirm", source: "default", riskTier: "standard", reason: "sensitive file read needs explicit approval" } };
+      return {
+        toolName: tool.name,
+        subject,
+        steps,
+        winnerIndex,
+        decision: {
+          permission: "confirm",
+          source: "default",
+          riskTier: "standard",
+          reason: "sensitive file read needs explicit approval"
+        }
+      };
     }
-    add("sensitive read", false, "confirm", "default", "not a sensitive read call (or YOLO bypasses this check)");
+    add(
+      "sensitive read",
+      false,
+      "confirm",
+      "default",
+      "not a sensitive read call (or YOLO bypasses this check)"
+    );
     if (this.yolo) {
-      add("yolo", true, "auto", "yolo", "YOLO mode is active \u2014 auto-approving every non-denied call");
+      if (this.yoloBlockedAsDestructive(tool, input, ctx)) {
+        add(
+          "yolo destructive gate",
+          true,
+          "confirm",
+          "yolo_destructive",
+          "YOLO is active but this is a clearly destructive command \u2014 still asking"
+        );
+        winnerIndex = steps.length - 1;
+        return {
+          toolName: tool.name,
+          subject,
+          steps,
+          winnerIndex,
+          decision: {
+            permission: "confirm",
+            source: "yolo_destructive",
+            riskTier: "destructive",
+            reason: "destructive command needs explicit approval even in YOLO mode"
+          }
+        };
+      }
+      add(
+        "yolo",
+        true,
+        "auto",
+        "yolo",
+        "YOLO mode is active \u2014 auto-approving every non-denied call"
+      );
       winnerIndex = steps.length - 1;
-      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "auto", source: "yolo" } };
+      return {
+        toolName: tool.name,
+        subject,
+        steps,
+        winnerIndex,
+        decision: { permission: "auto", source: "yolo" }
+      };
     }
     add("yolo", false, "auto", "yolo", "YOLO mode is not active");
     if (tool.name === "write" && subject) {
@@ -29829,10 +30717,26 @@ var DefaultPermissionPolicy = class {
       );
       if (hasRead) {
         winnerIndex = steps.length - 1;
-        return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "auto", source: "context", reason: "file already read in this session" } };
+        return {
+          toolName: tool.name,
+          subject,
+          steps,
+          winnerIndex,
+          decision: {
+            permission: "auto",
+            source: "context",
+            reason: "file already read in this session"
+          }
+        };
       }
     } else {
-      add("write smart bypass", false, "auto", "context", 'tool is not "write" or has no subject \u2014 bypass does not apply');
+      add(
+        "write smart bypass",
+        false,
+        "auto",
+        "context",
+        'tool is not "write" or has no subject \u2014 bypass does not apply'
+      );
     }
     const hasWriteCap = hasCapability(tool, ToolCapabilities.FS_WRITE);
     const hasShellCap = hasCapability(tool, [
@@ -29845,9 +30749,21 @@ var DefaultPermissionPolicy = class {
     const hasSubagentCap = hasCapability(tool, ToolCapabilities.SUBAGENT_SPAWN);
     const isMutating = tool.mutating || hasWriteCap || hasShellCap || hasInstallCap || hasConfigCap || hasSubagentCap;
     if (tool.permission === "auto" && !isMutating) {
-      add("safe default auto", true, "auto", "default", `tool "${tool.name}" has auto permission and is not mutating \u2014 safe to auto-approve`);
+      add(
+        "safe default auto",
+        true,
+        "auto",
+        "default",
+        `tool "${tool.name}" has auto permission and is not mutating \u2014 safe to auto-approve`
+      );
       winnerIndex = steps.length - 1;
-      return { toolName: tool.name, subject, steps, winnerIndex, decision: { permission: "auto", source: "default" } };
+      return {
+        toolName: tool.name,
+        subject,
+        steps,
+        winnerIndex,
+        decision: { permission: "auto", source: "default" }
+      };
     }
     add(
       "mutating default confirm",
@@ -29941,7 +30857,7 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, scryptSync } from "node:crypto";
 import * as fs13 from "node:fs";
 import * as fsp22 from "node:fs/promises";
-import * as path34 from "node:path";
+import * as path35 from "node:path";
 
 // src/types/secret-vault.ts
 var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
@@ -30084,8 +31000,12 @@ function checkKeyFilePermissions(keyFile, opts) {
     const stat15 = fs13.statSync(keyFile);
     const actualMode = stat15.mode & 511;
     if (actualMode !== KEY_FILE_MODE) {
+      void restrictFilePermissions(keyFile, {
+        label: "secret-vault",
+        warn
+      }).catch(() => void 0);
       warn(
-        `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Run: chmod ${KEY_FILE_MODE.toString(8)} ${keyFile}`
+        `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Hardening\u2026`
       );
     }
   } catch {
@@ -30118,6 +31038,14 @@ var DefaultSecretVault = class {
   logger;
   key;
   _keyVersion = 1;
+  /**
+   * Pending key-file hardening promises (Windows ACL restrictions via icacls).
+   * Tracked so async callers can `flushHardening()` before returning, ensuring
+   * a short-lived CLI process does not exit before the hardening resolves.
+   * Sync-only callers (encrypt/decrypt lazy-load) leave these pending —
+   * hardening remains best-effort in that case.
+   */
+  pendingHardening = [];
   constructor(opts) {
     this.keyFile = opts.keyFile;
     this.logger = opts.logger;
@@ -30134,6 +31062,26 @@ var DefaultSecretVault = class {
       console.warn(JSON.stringify({ ...ctx, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
     }
   }
+  /**
+   * Schedule best-effort key-file hardening and track the promise so async
+   * callers can await it via `flushHardening()` before returning. Rejections
+   * are swallowed here (the helper already warns on failure) so a rejection
+   * can never become an unhandled one.
+   */
+  scheduleKeyHardening() {
+    const p = restrictFilePermissions(this.keyFile, {
+      label: "secret-vault-key",
+      warn: (msg) => this.logWarn(msg)
+    }).catch(() => void 0);
+    this.pendingHardening.push(p);
+  }
+  /** Flush all pending key-file hardening promises. */
+  flushHardening() {
+    if (this.pendingHardening.length === 0) return Promise.resolve();
+    const all = Promise.all(this.pendingHardening).then(() => void 0);
+    this.pendingHardening = [];
+    return all;
+  }
   /** Current key version. Starts at 1; incremented by rotateKey(). */
   get keyVersion() {
     if (!this.key) this.loadOrCreateKey();
@@ -30175,16 +31123,18 @@ var DefaultSecretVault = class {
     const iv = Buffer.from(ivB64, "base64");
     const tag = Buffer.from(tagB64, "base64");
     const ct = Buffer.from(ctB64, "base64");
-    if (iv.length !== IV_BYTES) throw new ConfigError({
-      message: "SecretVault: bad IV length",
-      code: ERROR_CODES.CONFIG_PARSE_FAILED,
-      context: { expected: IV_BYTES, actual: iv.length }
-    });
-    if (tag.length !== TAG_BYTES) throw new ConfigError({
-      message: "SecretVault: bad tag length",
-      code: ERROR_CODES.CONFIG_PARSE_FAILED,
-      context: { expected: TAG_BYTES, actual: tag.length }
-    });
+    if (iv.length !== IV_BYTES)
+      throw new ConfigError({
+        message: "SecretVault: bad IV length",
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { expected: IV_BYTES, actual: iv.length }
+      });
+    if (tag.length !== TAG_BYTES)
+      throw new ConfigError({
+        message: "SecretVault: bad tag length",
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { expected: TAG_BYTES, actual: tag.length }
+      });
     const key = this.loadOrCreateKey();
     const decipher = createDecipheriv(ALGO, key, iv);
     decipher.setAuthTag(tag);
@@ -30200,7 +31150,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes3(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs13.mkdirSync(path34.dirname(this.keyFile), { recursive: true });
+    fs13.mkdirSync(path35.dirname(this.keyFile), { recursive: true });
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
@@ -30211,6 +31161,7 @@ var DefaultSecretVault = class {
       newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
       writeKeyFileAtomicSync(this.keyFile, keyFileBuf);
     }
+    this.scheduleKeyHardening();
     checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
     this.key = newKey;
     this._keyVersion = newVersion;
@@ -30227,7 +31178,11 @@ var DefaultSecretVault = class {
     const passphrase = getVaultPassphrase();
     if (!passphrase || !this.key) return;
     try {
-      writeKeyFileAtomicSync(this.keyFile, wrapDataKey(this.key, this._keyVersion, passphrase));
+      writeKeyFileAtomicSync(
+        this.keyFile,
+        wrapDataKey(this.key, this._keyVersion, passphrase)
+      );
+      this.scheduleKeyHardening();
       checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
     } catch {
     }
@@ -30282,14 +31237,16 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs13.mkdirSync(path34.dirname(this.keyFile), { recursive: true });
+    fs13.mkdirSync(path35.dirname(this.keyFile), { recursive: true });
     const key = randomBytes3(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
     try {
       fs13.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
+      this.scheduleKeyHardening();
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
+      this.scheduleKeyHardening();
       const buf = fs13.readFileSync(this.keyFile);
       if (isWrappedKeyFile(buf)) {
         const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
@@ -30340,9 +31297,10 @@ async function rewriteConfigEncrypted(configPath, vault, patch) {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp22.mkdir(path34.dirname(configPath), { recursive: true });
+  await fsp22.mkdir(path35.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
-  await restrictFilePermissions(configPath);
+  await restrictFilePermissions2(configPath);
+  await vault.flushHardening?.();
 }
 async function migratePlaintextSecrets(configPath, vault, logger) {
   let raw;
@@ -30361,45 +31319,15 @@ async function migratePlaintextSecrets(configPath, vault, logger) {
   const migrated = walkCount(parsed, vault, counter);
   if (counter.n === 0) return { migrated: 0, file: configPath };
   await atomicWrite(configPath, JSON.stringify(migrated, null, 2), { mode: 384 });
-  await restrictFilePermissions(
+  await restrictFilePermissions2(
     configPath,
     logger ? { warn: (msg) => logger.warn(msg) } : void 0
   );
+  await vault.flushHardening?.();
   return { migrated: counter.n, file: configPath };
 }
-async function restrictFilePermissions(filePath, opts) {
-  const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  if (process.platform === "win32") {
-    try {
-      const { execFile: execFile2 } = await import("node:child_process");
-      const { promisify: promisify2 } = await import("node:util");
-      const execFileAsync = promisify2(execFile2);
-      const user = windowsAccountName();
-      if (!user) {
-        warn(
-          `[secret-vault] Could not determine the current Windows user for ${filePath}; skipping icacls hardening.`
-        );
-        return;
-      }
-      await execFileAsync("icacls", [filePath, "/inheritance:r", "/grant:r", `${user}:(F)`]);
-    } catch {
-      warn(
-        `[secret-vault] Could not restrict permissions on ${filePath} \u2014 config file may be readable by other users on this system.`
-      );
-    }
-  } else {
-    try {
-      await fsp22.chmod(filePath, 384);
-    } catch {
-    }
-  }
-}
-function windowsAccountName() {
-  const username = process.env.USERNAME || process.env.USER;
-  if (!username || username.includes("\0")) return void 0;
-  const domain = process.env.USERDOMAIN;
-  if (domain && !domain.includes("\0")) return `${domain}\\${username}`;
-  return username;
+async function restrictFilePermissions2(filePath, opts) {
+  await restrictFilePermissions(filePath, { label: "secret-vault", warn: opts?.warn });
 }
 function walkCount(node, vault, counter) {
   if (node === null || node === void 0) return node;
@@ -30424,7 +31352,7 @@ function walkCount(node, vault, counter) {
 // src/storage/attachment-store.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import * as fsp23 from "node:fs/promises";
-import * as path35 from "node:path";
+import * as path36 from "node:path";
 var DEFAULT_SPOOL_THRESHOLD = 256 * 1024;
 var PLACEHOLDER_RE = /\[(pasted|image|file) #(\d+)[^\]]*\]|\[file:([^\]]+)\]/g;
 var DefaultAttachmentStore = class {
@@ -30445,7 +31373,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp23.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path35.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path36.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -30614,7 +31542,13 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
     // models still get cost savings without capability loss. Explicit tiers
     // are respected verbatim.
     tokenSavingMode: "auto",
-    allowOutsideProjectRoot: true
+    // Derived, never written by hand: this and `tools.restrictToProjectRoot`
+    // (line 41) are the two halves of one switch, and they used to be declared
+    // independently in this same object — one `true`, one `true` — with
+    // session.ts resolving the contradiction via `??` in favour of the
+    // permissive half. The confinement guard therefore shipped disabled on a
+    // fresh install even though the other half asked for it (WS-075).
+    allowOutsideProjectRoot: !DEFAULT_TOOLS_CONFIG.restrictToProjectRoot
   },
   Sage: {
     enabled: true,
@@ -30693,7 +31627,9 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
     enhance: true,
     enhanceDelayMs: 6e4,
     enhanceLanguage: "original",
-    statuslineMode: "detailed",
+    // Product-wide statusline density default. Mirrored by the TUI's
+    // DEFAULT_STATUSLINE_MODE (packages/tui/src/components/settings-picker-model.ts).
+    statuslineMode: "minimum",
     thinkingWord: DEFAULT_TUI_THINKING_WORD,
     showAgentSwarmPanel: true
   },
@@ -30822,6 +31758,7 @@ var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "maxConcurrent",
   "uiLocale",
   "fallbackModels",
+  "fallbackBridge",
   "fallbackProfiles",
   "favoriteModels",
   "favoriteModelsOnly",
@@ -30884,6 +31821,7 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "tools",
   "mcpServers",
   "fallbackModels",
+  "fallbackBridge",
   "fallbackProfiles",
   "favoriteModels",
   "favoriteModelsOnly",
@@ -30918,6 +31856,75 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "brain",
   "git"
 ]);
+var IN_PROJECT_DENIED_PATHS = [
+  {
+    path: "tools.exec.allow",
+    reason: "Extends the exec allow-list; a repo could authorise its own binaries."
+  },
+  { path: "tools.exec.danger", reason: "Weakens the destructive-command banner." },
+  { path: "skills.extraDirs", reason: "Loads skill definitions from repo-chosen directories." },
+  { path: "skills.registryUrl", reason: "Redirects skill installs to a repo-chosen host." },
+  // Deliberately NOT denied: skills.mode and skills.eagerMaxChars. The audit
+  // suggested stripping both, but config-loader-extra.test.ts classifies `mode`
+  // as a safe preference with a stated rationale, and a repo can only use these
+  // to move injection volume in either direction — the trust problem was that
+  // repo-supplied skill bodies were indistinguishable from the user's own, which
+  // the provenance tag in system-prompt-skill-bodies.ts now fixes. Re-classifying
+  // them is a product call.
+  { path: "Sage.storage.directory", reason: "Redirects memory storage outside the profile." },
+  {
+    path: "autonomy.yolo",
+    reason: "Alias for the denied top-level `yolo`, and it wins over the user setting \u2014 a repo-committed config could disable every permission prompt."
+  },
+  {
+    path: "autonomy.defaultMode",
+    reason: "Sets the startup autonomy mode; autonomy is user-owned, never repo-owned."
+  },
+  // Deliberately NOT denied: autonomy.autoProceedDelayMs and
+  // autoProceedMaxIterations. They tune a mode the user has already switched on
+  // rather than granting it, and config-loader-extra.test.ts classifies the
+  // delay as a benign project preference. Re-classifying them is a product call.
+  {
+    path: "launch.autonomy",
+    reason: "Launch-time autonomy mode; same user-owned boundary as autonomy.defaultMode."
+  },
+  {
+    path: "features.allowOutsideProjectRoot",
+    reason: "Short-circuits both the project-root containment check and the symlink realpath check in the file tools."
+  },
+  {
+    path: "tools.restrictToProjectRoot",
+    reason: "The other half of the filesystem confinement switch."
+  }
+];
+function deleteNestedPath(target, path40) {
+  const segments = path40.split(".");
+  const last = segments[segments.length - 1];
+  if (last === void 0) return false;
+  let cursor = target;
+  const chain = [];
+  for (const segment of segments.slice(0, -1)) {
+    const next = cursor[segment];
+    if (!next || typeof next !== "object" || Array.isArray(next)) return false;
+    chain.push({ parent: cursor, key: segment });
+    cursor = next;
+  }
+  if (!(last in cursor)) return false;
+  const clonedLeaf = { ...cursor };
+  delete clonedLeaf[last];
+  let replacement = clonedLeaf;
+  for (let i = chain.length - 1; i >= 0; i--) {
+    const link2 = chain[i];
+    if (!link2) continue;
+    replacement = { ...link2.parent, [link2.key]: replacement };
+    if (i === 0) {
+      for (const [k, v] of Object.entries(replacement)) target[k] = v;
+      return true;
+    }
+  }
+  for (const [k, v] of Object.entries(replacement)) target[k] = v;
+  return true;
+}
 function assertInProjectAllowListComplete() {
   const missingFromBoth = [];
   for (const key of KNOWN_CONFIG_TOP_LEVEL_KEYS) {
@@ -30947,6 +31954,22 @@ function assertInProjectAllowListComplete() {
       `field(s) appear in BOTH IN_PROJECT_ALLOWED_KEYS and KNOWN_DENIED_IN_PROJECT: ` + duplicate.join(", ") + ". The allow-list wins at runtime; remove from one of the two."
     );
   }
+  const orphanedPaths = IN_PROJECT_DENIED_PATHS.filter(
+    ({ path: path40 }) => !IN_PROJECT_ALLOWED_KEYS.has(path40.split(".")[0] ?? "")
+  ).map(({ path: path40 }) => path40);
+  if (orphanedPaths.length > 0) {
+    problems.push(
+      `IN_PROJECT_DENIED_PATHS entr(ies) whose top-level parent is not allowed: ` + orphanedPaths.join(", ") + ". The parent is already stripped wholesale, so the nested denial is dead \u2014 remove it."
+    );
+  }
+  const malformedPaths = IN_PROJECT_DENIED_PATHS.filter(
+    ({ path: path40 }) => path40.split(".").length < 2 || path40.split(".").some((s) => s.length === 0)
+  ).map(({ path: path40 }) => path40);
+  if (malformedPaths.length > 0) {
+    problems.push(
+      `IN_PROJECT_DENIED_PATHS entr(ies) are not dotted nested paths: ` + malformedPaths.join(", ") + ". Top-level keys belong in KNOWN_DENIED_IN_PROJECT instead."
+    );
+  }
   if (problems.length > 0) {
     throw new Error(
       `stripUnsafeInProjectFields drift check failed:
@@ -30969,58 +31992,8 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
     }
     stripped.push(k);
   }
-  const outTools = out["tools"];
-  if (outTools && typeof outTools === "object") {
-    const execCfg = outTools["exec"];
-    if (execCfg && typeof execCfg === "object") {
-      const hasAllow = "allow" in execCfg;
-      const hasDanger = "danger" in execCfg;
-      if (hasAllow || hasDanger) {
-        const clonedExec = { ...execCfg };
-        if (hasAllow) {
-          delete clonedExec["allow"];
-          stripped.push("tools.exec.allow");
-        }
-        if (hasDanger) {
-          delete clonedExec["danger"];
-          stripped.push("tools.exec.danger");
-        }
-        out["tools"] = {
-          ...outTools,
-          exec: clonedExec
-        };
-      }
-    }
-  }
-  const outSkills = out["skills"];
-  if (outSkills && typeof outSkills === "object") {
-    const skillsRec = outSkills;
-    const needsClone = "extraDirs" in skillsRec || "registryUrl" in skillsRec;
-    if (needsClone) {
-      const clonedSkills = { ...skillsRec };
-      if ("extraDirs" in clonedSkills) {
-        delete clonedSkills["extraDirs"];
-        stripped.push("skills.extraDirs");
-      }
-      if ("registryUrl" in clonedSkills) {
-        delete clonedSkills["registryUrl"];
-        stripped.push("skills.registryUrl");
-      }
-      out["skills"] = clonedSkills;
-    }
-  }
-  const outSage = out["Sage"];
-  if (outSage && typeof outSage === "object") {
-    const storage3 = outSage["storage"];
-    if (storage3 && typeof storage3 === "object" && "directory" in storage3) {
-      const clonedStorage = { ...storage3 };
-      delete clonedStorage["directory"];
-      out["Sage"] = {
-        ...outSage,
-        storage: clonedStorage
-      };
-      stripped.push("Sage.storage.directory");
-    }
+  for (const { path: path40 } of IN_PROJECT_DENIED_PATHS) {
+    if (deleteNestedPath(out, path40)) stripped.push(path40);
   }
   if (stripped.length > 0) {
     warn(
@@ -31190,10 +32163,10 @@ function removeLegacySageEngine(config) {
 }
 
 // src/storage/config-loader/path-identity.ts
-import * as path36 from "node:path";
+import * as path37 from "node:path";
 function samePath(a, b) {
-  let ra = path36.resolve(a);
-  let rb = path36.resolve(b);
+  let ra = path37.resolve(a);
+  let rb = path37.resolve(b);
   if (process.platform === "win32" || process.platform === "darwin") {
     ra = ra.toLowerCase();
     rb = rb.toLowerCase();
@@ -32174,7 +33147,7 @@ ${cat}:`);
 
 // src/storage/queue-store.ts
 import * as fsp25 from "node:fs/promises";
-import * as path37 from "node:path";
+import * as path38 from "node:path";
 var QUEUE_MAX_ITEMS = 100;
 var QUEUE_MAX_BYTES = 16 * 1024 * 1024;
 var QUEUE_MAX_ITEM_BYTES = 8 * 1024 * 1024;
@@ -32207,7 +33180,7 @@ var QueueStore = class {
   traceId;
   logger;
   constructor(opts) {
-    this.file = path37.join(opts.dir, "queue.json");
+    this.file = path38.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
     this.logger = opts.logger;
@@ -32423,7 +33396,7 @@ function isPersistedQueueItem(v) {
 // src/storage/recovery-lock.ts
 import * as fsp26 from "node:fs/promises";
 import * as os2 from "node:os";
-import * as path38 from "node:path";
+import * as path39 from "node:path";
 var LOCK_FILE = "active.json";
 var DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var RecoveryLock = class {
@@ -32434,7 +33407,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path38.join(opts.dir, LOCK_FILE);
+    this.file = path39.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os2.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -32508,7 +33481,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path38.dirname(this.file));
+    await ensureDir(path39.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -32756,6 +33729,9 @@ function createSessionEventBridge(writer, level = "standard", options = {}) {
     async append(event) {
       const target = resolveWriter();
       if (!target) return;
+      if (event.type === "tool_call_end") {
+        progressCounters.delete(event.id);
+      }
       if (!isAllowed(event.type, currentLevel)) return;
       if (!shouldSample(event)) return;
       try {
@@ -32766,6 +33742,9 @@ function createSessionEventBridge(writer, level = "standard", options = {}) {
     async appendBatch(events) {
       const target = resolveWriter();
       if (!target || events.length === 0) return;
+      for (const e of events) {
+        if (e.type === "tool_call_end") progressCounters.delete(e.id);
+      }
       const allowed = events.filter((e) => isAllowed(e.type, currentLevel) && shouldSample(e));
       if (allowed.length === 0) return;
       try {