@wrongstack/core 0.298.0 → 0.298.2

package/dist/index.js

@@ -1007,6 +1007,328 @@ var init_session_registry = __esm({
   }
 });
 
+// src/plugins/review-report-types.ts
+function validateReportTransition(from, to) {
+  if (from === to) return;
+  const allowed = REPORT_TRANSITION_MATRIX[from];
+  if (!allowed?.has(to)) {
+    throw new InvalidReportTransitionError(from, to);
+  }
+}
+function reportEventTypeFor(to) {
+  switch (to) {
+    case "actioned":
+      return "actioned";
+    case "completed":
+      return "completed";
+    case "skipped":
+      return "skipped";
+    default:
+      return "reopened";
+  }
+}
+var InvalidReportTransitionError, REPORT_TRANSITION_MATRIX;
+var init_review_report_types = __esm({
+  "src/plugins/review-report-types.ts"() {
+    "use strict";
+    InvalidReportTransitionError = class extends Error {
+      from;
+      to;
+      constructor(from, to, reason) {
+        const msg = reason ?? `Invalid report transition from "${from}" to "${to}"`;
+        super(msg);
+        this.name = "InvalidReportTransitionError";
+        this.from = from;
+        this.to = to;
+      }
+    };
+    REPORT_TRANSITION_MATRIX = {
+      open: /* @__PURE__ */ new Set(["actioned", "completed", "skipped"]),
+      actioned: /* @__PURE__ */ new Set(["completed", "skipped"]),
+      completed: /* @__PURE__ */ new Set(["open"]),
+      skipped: /* @__PURE__ */ new Set(["open"])
+    };
+  }
+});
+
+// src/plugins/review-report-store.ts
+var review_report_store_exports = {};
+__export(review_report_store_exports, {
+  JsonlReportStore: () => JsonlReportStore,
+  REPORT_DEFAULT_PAGE_SIZE: () => REPORT_DEFAULT_PAGE_SIZE,
+  REPORT_RETENTION_MS: () => REPORT_RETENTION_MS,
+  REPORT_STORE_FILE: () => REPORT_STORE_FILE,
+  resolveReportStorePath: () => resolveReportStorePath
+});
+import { randomUUID as randomUUID28 } from "node:crypto";
+import * as fsp28 from "node:fs/promises";
+import * as path67 from "node:path";
+function resolveReportStorePath(projectDir) {
+  return path67.join(projectDir, REPORT_STORE_FILE);
+}
+var REPORT_RETENTION_MS, REPORT_DEFAULT_PAGE_SIZE, NL, REPORT_STORE_FILE, JsonlReportStore;
+var init_review_report_store = __esm({
+  "src/plugins/review-report-store.ts"() {
+    "use strict";
+    init_file_permissions();
+    init_atomic_write();
+    init_review_report_types();
+    REPORT_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
+    REPORT_DEFAULT_PAGE_SIZE = 25;
+    NL = "\n";
+    REPORT_STORE_FILE = "review-reports.jsonl";
+    JsonlReportStore = class {
+      filePath;
+      constructor(projectDir) {
+        this.filePath = resolveReportStorePath(projectDir);
+      }
+      get storePath() {
+        return this.filePath;
+      }
+      // ── Persist (create or reopen) ───────────────────────────────────
+      async persist(input) {
+        return withFileLock(this.filePath, async () => {
+          const existing = await this._findRecord(input.id);
+          if (existing) {
+            const updated = {
+              ...existing,
+              counts: input.counts,
+              totalFindings: input.totalFindings,
+              unparseableCount: input.unparseableCount,
+              durationSeconds: input.durationSeconds ?? existing.durationSeconds,
+              rawText: input.rawText || existing.rawText,
+              files: input.files.length > 0 ? input.files : existing.files
+            };
+            await fsp28.appendFile(this.filePath, JSON.stringify({ __report: 1, data: updated }) + NL, {
+              encoding: "utf8",
+              mode: SECRET_FILE_MODE
+            });
+            return updated;
+          }
+          const report = {
+            id: input.id,
+            reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            sessionId: input.sessionId,
+            agentId: input.agentId,
+            reviewerModel: input.reviewerModel,
+            source: input.source,
+            reviewStatus: input.reviewStatus,
+            lifecycle: "open",
+            files: input.files,
+            counts: input.counts,
+            totalFindings: input.totalFindings,
+            unparseableCount: input.unparseableCount,
+            durationSeconds: input.durationSeconds,
+            rawText: input.rawText,
+            ...input.cascadeDepth !== void 0 ? { cascadeDepth: input.cascadeDepth } : {}
+          };
+          const createdEvent = {
+            id: randomUUID28(),
+            reportId: report.id,
+            eventType: "created",
+            fromLifecycle: null,
+            toLifecycle: "open",
+            actorId: "system",
+            actorKind: "system",
+            timestamp: report.reviewedAt
+          };
+          const lines = JSON.stringify({ __report: 1, data: report }) + NL + JSON.stringify({ __reportEvent: 1, data: createdEvent }) + NL;
+          await fsp28.appendFile(this.filePath, lines, { encoding: "utf8", mode: SECRET_FILE_MODE });
+          return report;
+        });
+      }
+      // ── Lifecycle transitions ────────────────────────────────────────
+      async transition(reportId, to, actor, opts) {
+        return withFileLock(this.filePath, async () => {
+          const all = await this._readAll();
+          const entry = all.find((e) => e.report.id === reportId);
+          if (!entry) throw new Error(`Review report not found: ${reportId}`);
+          const from = this._materialize(entry).lifecycle;
+          validateReportTransition(from, to);
+          const event = {
+            id: randomUUID28(),
+            reportId,
+            eventType: reportEventTypeFor(to),
+            fromLifecycle: from,
+            toLifecycle: to,
+            actorId: actor.id,
+            actorKind: actor.kind,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            reason: opts?.reason
+          };
+          entry.report.lifecycle = to;
+          await fsp28.appendFile(this.filePath, JSON.stringify({ __reportEvent: 1, data: event }) + NL, {
+            encoding: "utf8",
+            mode: SECRET_FILE_MODE
+          });
+          return { ...entry.report };
+        });
+      }
+      async addNote(reportId, actor, note) {
+        return withFileLock(this.filePath, async () => {
+          const all = await this._readAll();
+          const entry = all.find((e) => e.report.id === reportId);
+          if (!entry) throw new Error(`Review report not found: ${reportId}`);
+          const materialized = this._materialize(entry);
+          const event = {
+            id: randomUUID28(),
+            reportId,
+            eventType: "note_added",
+            fromLifecycle: materialized.lifecycle,
+            toLifecycle: materialized.lifecycle,
+            actorId: actor.id,
+            actorKind: actor.kind,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            reason: note
+          };
+          await fsp28.appendFile(this.filePath, JSON.stringify({ __reportEvent: 1, data: event }) + NL, {
+            encoding: "utf8",
+            mode: SECRET_FILE_MODE
+          });
+          return materialized;
+        });
+      }
+      // ── Query ────────────────────────────────────────────────────────
+      async list(opts) {
+        const all = await this._readAll();
+        let reports = all.map((e) => this._materialize(e));
+        if (opts?.statuses && opts.statuses.length > 0) {
+          const set = new Set(opts.statuses);
+          reports = reports.filter((r) => set.has(r.lifecycle));
+        }
+        if (opts?.sources && opts.sources.length > 0) {
+          const set = new Set(opts.sources);
+          reports = reports.filter((r) => set.has(r.source));
+        }
+        reports.sort((a, b) => b.reviewedAt.localeCompare(a.reviewedAt));
+        const limit = opts?.limit ?? REPORT_DEFAULT_PAGE_SIZE;
+        return reports.slice(0, limit);
+      }
+      async get(id) {
+        const all = await this._readAll();
+        const entry = all.find((e) => e.report.id === id);
+        return entry ? this._materialize(entry) : null;
+      }
+      async getEvents(reportId) {
+        const all = await this._readAllLines();
+        const events = [];
+        for (const line of all) {
+          try {
+            const parsed = JSON.parse(line);
+            if (this._isEventRecord(parsed) && parsed.data.reportId === reportId) {
+              events.push(parsed.data);
+            }
+          } catch {
+          }
+        }
+        return events.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+      }
+      // ── Compaction ───────────────────────────────────────────────────
+      async compact(opts) {
+        return withFileLock(this.filePath, async () => {
+          const maxAge = opts?.maxAgeMs ?? REPORT_RETENTION_MS;
+          const now = Date.now();
+          const all = await this._readAll();
+          const kept = [];
+          let removed = 0;
+          let eventsFolded = 0;
+          for (const entry of all) {
+            const age = now - new Date(entry.report.reviewedAt).getTime();
+            const materialized = this._materialize(entry);
+            const isTerminal = materialized.lifecycle === "completed" || materialized.lifecycle === "skipped";
+            if (isTerminal && age > maxAge) {
+              removed++;
+              eventsFolded += entry.events.length;
+              continue;
+            }
+            const oldEvents = entry.events.filter(
+              (ev) => now - new Date(ev.timestamp).getTime() > maxAge
+            );
+            if (oldEvents.length > 1) {
+              eventsFolded += oldEvents.length - 1;
+              const newestOld = oldEvents.sort((a, b) => b.timestamp.localeCompare(a.timestamp))[0];
+              entry.events = [
+                newestOld,
+                ...entry.events.filter((ev) => now - new Date(ev.timestamp).getTime() <= maxAge)
+              ];
+            }
+            kept.push({ record: { __report: 1, data: entry.report }, events: entry.events });
+          }
+          const lines = [];
+          for (const { record, events } of kept) {
+            if (record) lines.push(JSON.stringify(record));
+            for (const ev of events) {
+              lines.push(JSON.stringify({ __reportEvent: 1, data: ev }));
+            }
+          }
+          lines.push(
+            JSON.stringify({
+              __reportCompact: 1,
+              compactedAt: (/* @__PURE__ */ new Date()).toISOString(),
+              removedReports: removed,
+              foldedEvents: eventsFolded
+            })
+          );
+          await atomicWrite(this.filePath, lines.join(NL) + NL, { mode: 384 });
+          return { removed, eventsFolded };
+        });
+      }
+      // ── Private helpers ──────────────────────────────────────────────
+      async _readAllLines() {
+        try {
+          const raw = await fsp28.readFile(this.filePath, "utf8");
+          return raw.split(NL).filter((l) => l.trim().length > 0);
+        } catch (err) {
+          if (err.code === "ENOENT") return [];
+          throw err;
+        }
+      }
+      _isReportRecord(v) {
+        return typeof v === "object" && v !== null && v["__report"] === 1;
+      }
+      _isEventRecord(v) {
+        return typeof v === "object" && v !== null && v["__reportEvent"] === 1;
+      }
+      async _readAll() {
+        const lines = await this._readAllLines();
+        const reports = /* @__PURE__ */ new Map();
+        const eventsMap = /* @__PURE__ */ new Map();
+        for (const line of lines) {
+          try {
+            const parsed = JSON.parse(line);
+            if (this._isReportRecord(parsed)) {
+              reports.set(parsed.data.id, parsed.data);
+              if (!eventsMap.has(parsed.data.id)) eventsMap.set(parsed.data.id, []);
+            } else if (this._isEventRecord(parsed)) {
+              const list = eventsMap.get(parsed.data.reportId);
+              if (list) list.push(parsed.data);
+            }
+          } catch {
+          }
+        }
+        return Array.from(reports.entries()).map(([id, report]) => ({
+          report,
+          events: eventsMap.get(id) ?? []
+        }));
+      }
+      async _findRecord(id) {
+        const all = await this._readAll();
+        const entry = all.find((e) => e.report.id === id);
+        return entry ? this._materialize(entry) : null;
+      }
+      _materialize(entry) {
+        if (entry.events.length === 0) return { ...entry.report };
+        const sorted = [...entry.events].sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+        const latest = sorted[sorted.length - 1];
+        if (latest.eventType !== "note_added") {
+          return { ...entry.report, lifecycle: latest.toLifecycle };
+        }
+        return { ...entry.report };
+      }
+    };
+  }
+});
+
 // src/plugins/review-finding-types.ts
 import { createHash as createHash32 } from "node:crypto";
 function normalizeFingerprintTitle(title) {
@@ -1072,13 +1394,13 @@ __export(review_finding_store_exports, {
   JsonlFindingStore: () => JsonlFindingStore,
   resolveFindingStorePath: () => resolveFindingStorePath
 });
-import { randomUUID as randomUUID35 } from "node:crypto";
-import * as fsp38 from "node:fs/promises";
-import * as path90 from "node:path";
+import { randomUUID as randomUUID36 } from "node:crypto";
+import * as fsp39 from "node:fs/promises";
+import * as path91 from "node:path";
 function resolveFindingStorePath(projectDir) {
-  return path90.join(projectDir, FINDING_STORE_FILE);
+  return path91.join(projectDir, FINDING_STORE_FILE);
 }
-var FINDING_RESOLVED_RETENTION_MS, FINDING_IGNORED_RETENTION_MS, FINDING_DEFAULT_PAGE_SIZE, NL, LINE_SEPARATOR, FINDING_STORE_FILE, JsonlFindingStore;
+var FINDING_RESOLVED_RETENTION_MS, FINDING_IGNORED_RETENTION_MS, FINDING_DEFAULT_PAGE_SIZE, NL2, LINE_SEPARATOR, FINDING_STORE_FILE, JsonlFindingStore;
 var init_review_finding_store = __esm({
   "src/plugins/review-finding-store.ts"() {
     "use strict";
@@ -1088,8 +1410,8 @@ var init_review_finding_store = __esm({
     FINDING_RESOLVED_RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
     FINDING_IGNORED_RETENTION_MS = 14 * 24 * 60 * 60 * 1e3;
     FINDING_DEFAULT_PAGE_SIZE = 50;
-    NL = "\n";
-    LINE_SEPARATOR = NL;
+    NL2 = "\n";
+    LINE_SEPARATOR = NL2;
     FINDING_STORE_FILE = "review-findings.jsonl";
     JsonlFindingStore = class {
       filePath;
@@ -1120,7 +1442,7 @@ var init_review_finding_store = __esm({
                 match.finding.status = "active";
                 match.finding.resolution = void 0;
                 const updatedRecord = { __finding: 1, data: match.finding };
-                await fsp38.appendFile(
+                await fsp39.appendFile(
                   this.filePath,
                   JSON.stringify(updatedRecord) + LINE_SEPARATOR + JSON.stringify({ __findingEvent: 1, data: reopenEvent }) + LINE_SEPARATOR,
                   { encoding: "utf8", mode: SECRET_FILE_MODE }
@@ -1134,7 +1456,7 @@ var init_review_finding_store = __esm({
                   match.finding.status,
                   context
                 );
-                await fsp38.appendFile(
+                await fsp39.appendFile(
                   this.filePath,
                   JSON.stringify({ __findingEvent: 1, data: relinkEvent }) + LINE_SEPARATOR,
                   { encoding: "utf8", mode: SECRET_FILE_MODE }
@@ -1145,7 +1467,7 @@ var init_review_finding_store = __esm({
               const record = { __finding: 1, data: finding };
               const createdEvent = this._makeEvent(finding.id, "created", null, "active", context);
               const lines = JSON.stringify(record) + LINE_SEPARATOR + JSON.stringify({ __findingEvent: 1, data: createdEvent }) + LINE_SEPARATOR;
-              await fsp38.appendFile(this.filePath, lines, { encoding: "utf8", mode: SECRET_FILE_MODE });
+              await fsp39.appendFile(this.filePath, lines, { encoding: "utf8", mode: SECRET_FILE_MODE });
               result.created++;
             }
           }
@@ -1161,7 +1483,7 @@ var init_review_finding_store = __esm({
           validateTransition(from, to);
           validateResolution(to, opts?.outcome);
           const event = {
-            id: randomUUID35(),
+            id: randomUUID36(),
             findingId,
             eventType: to === "resolved" ? "resolved" : to === "ignored" ? "ignored" : this._eventTypeFor(to),
             fromStatus: from,
@@ -1181,7 +1503,7 @@ var init_review_finding_store = __esm({
             };
           }
           const updatedRecord = { __finding: 1, data: entry.finding };
-          await fsp38.appendFile(
+          await fsp39.appendFile(
             this.filePath,
             JSON.stringify(updatedRecord) + LINE_SEPARATOR + JSON.stringify({ __findingEvent: 1, data: event }) + LINE_SEPARATOR,
             { encoding: "utf8", mode: SECRET_FILE_MODE }
@@ -1298,7 +1620,7 @@ var init_review_finding_store = __esm({
       // ── Private helpers ──────────────────────────────────────────────
       async _readAllLines() {
         try {
-          const raw = await fsp38.readFile(this.filePath, "utf8");
+          const raw = await fsp39.readFile(this.filePath, "utf8");
           return raw.split(LINE_SEPARATOR).filter((l) => l.trim().length > 0);
         } catch (err) {
           if (err.code === "ENOENT") return [];
@@ -1345,7 +1667,7 @@ var init_review_finding_store = __esm({
       }
       _makeEvent(findingId, eventType, fromStatus, toStatus, context) {
         return {
-          id: randomUUID35(),
+          id: randomUUID36(),
           findingId,
           eventType,
           fromStatus,
@@ -1376,328 +1698,6 @@ var init_review_finding_store = __esm({
   }
 });
 
-// src/plugins/review-report-types.ts
-function validateReportTransition(from, to) {
-  if (from === to) return;
-  const allowed = REPORT_TRANSITION_MATRIX[from];
-  if (!allowed?.has(to)) {
-    throw new InvalidReportTransitionError(from, to);
-  }
-}
-function reportEventTypeFor(to) {
-  switch (to) {
-    case "actioned":
-      return "actioned";
-    case "completed":
-      return "completed";
-    case "skipped":
-      return "skipped";
-    default:
-      return "reopened";
-  }
-}
-var InvalidReportTransitionError, REPORT_TRANSITION_MATRIX;
-var init_review_report_types = __esm({
-  "src/plugins/review-report-types.ts"() {
-    "use strict";
-    InvalidReportTransitionError = class extends Error {
-      from;
-      to;
-      constructor(from, to, reason) {
-        const msg = reason ?? `Invalid report transition from "${from}" to "${to}"`;
-        super(msg);
-        this.name = "InvalidReportTransitionError";
-        this.from = from;
-        this.to = to;
-      }
-    };
-    REPORT_TRANSITION_MATRIX = {
-      open: /* @__PURE__ */ new Set(["actioned", "completed", "skipped"]),
-      actioned: /* @__PURE__ */ new Set(["completed", "skipped"]),
-      completed: /* @__PURE__ */ new Set(["open"]),
-      skipped: /* @__PURE__ */ new Set(["open"])
-    };
-  }
-});
-
-// src/plugins/review-report-store.ts
-var review_report_store_exports = {};
-__export(review_report_store_exports, {
-  JsonlReportStore: () => JsonlReportStore,
-  REPORT_DEFAULT_PAGE_SIZE: () => REPORT_DEFAULT_PAGE_SIZE,
-  REPORT_RETENTION_MS: () => REPORT_RETENTION_MS,
-  REPORT_STORE_FILE: () => REPORT_STORE_FILE,
-  resolveReportStorePath: () => resolveReportStorePath
-});
-import { randomUUID as randomUUID37 } from "node:crypto";
-import * as fsp39 from "node:fs/promises";
-import * as path91 from "node:path";
-function resolveReportStorePath(projectDir) {
-  return path91.join(projectDir, REPORT_STORE_FILE);
-}
-var REPORT_RETENTION_MS, REPORT_DEFAULT_PAGE_SIZE, NL2, REPORT_STORE_FILE, JsonlReportStore;
-var init_review_report_store = __esm({
-  "src/plugins/review-report-store.ts"() {
-    "use strict";
-    init_file_permissions();
-    init_atomic_write();
-    init_review_report_types();
-    REPORT_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
-    REPORT_DEFAULT_PAGE_SIZE = 25;
-    NL2 = "\n";
-    REPORT_STORE_FILE = "review-reports.jsonl";
-    JsonlReportStore = class {
-      filePath;
-      constructor(projectDir) {
-        this.filePath = resolveReportStorePath(projectDir);
-      }
-      get storePath() {
-        return this.filePath;
-      }
-      // ── Persist (create or reopen) ───────────────────────────────────
-      async persist(input) {
-        return withFileLock(this.filePath, async () => {
-          const existing = await this._findRecord(input.id);
-          if (existing) {
-            const updated = {
-              ...existing,
-              counts: input.counts,
-              totalFindings: input.totalFindings,
-              unparseableCount: input.unparseableCount,
-              durationSeconds: input.durationSeconds ?? existing.durationSeconds,
-              rawText: input.rawText || existing.rawText,
-              files: input.files.length > 0 ? input.files : existing.files
-            };
-            await fsp39.appendFile(this.filePath, JSON.stringify({ __report: 1, data: updated }) + NL2, {
-              encoding: "utf8",
-              mode: SECRET_FILE_MODE
-            });
-            return updated;
-          }
-          const report = {
-            id: input.id,
-            reviewedAt: (/* @__PURE__ */ new Date()).toISOString(),
-            sessionId: input.sessionId,
-            agentId: input.agentId,
-            reviewerModel: input.reviewerModel,
-            source: input.source,
-            reviewStatus: input.reviewStatus,
-            lifecycle: "open",
-            files: input.files,
-            counts: input.counts,
-            totalFindings: input.totalFindings,
-            unparseableCount: input.unparseableCount,
-            durationSeconds: input.durationSeconds,
-            rawText: input.rawText,
-            ...input.cascadeDepth !== void 0 ? { cascadeDepth: input.cascadeDepth } : {}
-          };
-          const createdEvent = {
-            id: randomUUID37(),
-            reportId: report.id,
-            eventType: "created",
-            fromLifecycle: null,
-            toLifecycle: "open",
-            actorId: "system",
-            actorKind: "system",
-            timestamp: report.reviewedAt
-          };
-          const lines = JSON.stringify({ __report: 1, data: report }) + NL2 + JSON.stringify({ __reportEvent: 1, data: createdEvent }) + NL2;
-          await fsp39.appendFile(this.filePath, lines, { encoding: "utf8", mode: SECRET_FILE_MODE });
-          return report;
-        });
-      }
-      // ── Lifecycle transitions ────────────────────────────────────────
-      async transition(reportId, to, actor, opts) {
-        return withFileLock(this.filePath, async () => {
-          const all = await this._readAll();
-          const entry = all.find((e) => e.report.id === reportId);
-          if (!entry) throw new Error(`Review report not found: ${reportId}`);
-          const from = this._materialize(entry).lifecycle;
-          validateReportTransition(from, to);
-          const event = {
-            id: randomUUID37(),
-            reportId,
-            eventType: reportEventTypeFor(to),
-            fromLifecycle: from,
-            toLifecycle: to,
-            actorId: actor.id,
-            actorKind: actor.kind,
-            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-            reason: opts?.reason
-          };
-          entry.report.lifecycle = to;
-          await fsp39.appendFile(this.filePath, JSON.stringify({ __reportEvent: 1, data: event }) + NL2, {
-            encoding: "utf8",
-            mode: SECRET_FILE_MODE
-          });
-          return { ...entry.report };
-        });
-      }
-      async addNote(reportId, actor, note) {
-        return withFileLock(this.filePath, async () => {
-          const all = await this._readAll();
-          const entry = all.find((e) => e.report.id === reportId);
-          if (!entry) throw new Error(`Review report not found: ${reportId}`);
-          const materialized = this._materialize(entry);
-          const event = {
-            id: randomUUID37(),
-            reportId,
-            eventType: "note_added",
-            fromLifecycle: materialized.lifecycle,
-            toLifecycle: materialized.lifecycle,
-            actorId: actor.id,
-            actorKind: actor.kind,
-            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-            reason: note
-          };
-          await fsp39.appendFile(this.filePath, JSON.stringify({ __reportEvent: 1, data: event }) + NL2, {
-            encoding: "utf8",
-            mode: SECRET_FILE_MODE
-          });
-          return materialized;
-        });
-      }
-      // ── Query ────────────────────────────────────────────────────────
-      async list(opts) {
-        const all = await this._readAll();
-        let reports = all.map((e) => this._materialize(e));
-        if (opts?.statuses && opts.statuses.length > 0) {
-          const set = new Set(opts.statuses);
-          reports = reports.filter((r) => set.has(r.lifecycle));
-        }
-        if (opts?.sources && opts.sources.length > 0) {
-          const set = new Set(opts.sources);
-          reports = reports.filter((r) => set.has(r.source));
-        }
-        reports.sort((a, b) => b.reviewedAt.localeCompare(a.reviewedAt));
-        const limit = opts?.limit ?? REPORT_DEFAULT_PAGE_SIZE;
-        return reports.slice(0, limit);
-      }
-      async get(id) {
-        const all = await this._readAll();
-        const entry = all.find((e) => e.report.id === id);
-        return entry ? this._materialize(entry) : null;
-      }
-      async getEvents(reportId) {
-        const all = await this._readAllLines();
-        const events = [];
-        for (const line of all) {
-          try {
-            const parsed = JSON.parse(line);
-            if (this._isEventRecord(parsed) && parsed.data.reportId === reportId) {
-              events.push(parsed.data);
-            }
-          } catch {
-          }
-        }
-        return events.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
-      }
-      // ── Compaction ───────────────────────────────────────────────────
-      async compact(opts) {
-        return withFileLock(this.filePath, async () => {
-          const maxAge = opts?.maxAgeMs ?? REPORT_RETENTION_MS;
-          const now = Date.now();
-          const all = await this._readAll();
-          const kept = [];
-          let removed = 0;
-          let eventsFolded = 0;
-          for (const entry of all) {
-            const age = now - new Date(entry.report.reviewedAt).getTime();
-            const materialized = this._materialize(entry);
-            const isTerminal = materialized.lifecycle === "completed" || materialized.lifecycle === "skipped";
-            if (isTerminal && age > maxAge) {
-              removed++;
-              eventsFolded += entry.events.length;
-              continue;
-            }
-            const oldEvents = entry.events.filter(
-              (ev) => now - new Date(ev.timestamp).getTime() > maxAge
-            );
-            if (oldEvents.length > 1) {
-              eventsFolded += oldEvents.length - 1;
-              const newestOld = oldEvents.sort((a, b) => b.timestamp.localeCompare(a.timestamp))[0];
-              entry.events = [
-                newestOld,
-                ...entry.events.filter((ev) => now - new Date(ev.timestamp).getTime() <= maxAge)
-              ];
-            }
-            kept.push({ record: { __report: 1, data: entry.report }, events: entry.events });
-          }
-          const lines = [];
-          for (const { record, events } of kept) {
-            if (record) lines.push(JSON.stringify(record));
-            for (const ev of events) {
-              lines.push(JSON.stringify({ __reportEvent: 1, data: ev }));
-            }
-          }
-          lines.push(
-            JSON.stringify({
-              __reportCompact: 1,
-              compactedAt: (/* @__PURE__ */ new Date()).toISOString(),
-              removedReports: removed,
-              foldedEvents: eventsFolded
-            })
-          );
-          await atomicWrite(this.filePath, lines.join(NL2) + NL2, { mode: 384 });
-          return { removed, eventsFolded };
-        });
-      }
-      // ── Private helpers ──────────────────────────────────────────────
-      async _readAllLines() {
-        try {
-          const raw = await fsp39.readFile(this.filePath, "utf8");
-          return raw.split(NL2).filter((l) => l.trim().length > 0);
-        } catch (err) {
-          if (err.code === "ENOENT") return [];
-          throw err;
-        }
-      }
-      _isReportRecord(v) {
-        return typeof v === "object" && v !== null && v["__report"] === 1;
-      }
-      _isEventRecord(v) {
-        return typeof v === "object" && v !== null && v["__reportEvent"] === 1;
-      }
-      async _readAll() {
-        const lines = await this._readAllLines();
-        const reports = /* @__PURE__ */ new Map();
-        const eventsMap = /* @__PURE__ */ new Map();
-        for (const line of lines) {
-          try {
-            const parsed = JSON.parse(line);
-            if (this._isReportRecord(parsed)) {
-              reports.set(parsed.data.id, parsed.data);
-              if (!eventsMap.has(parsed.data.id)) eventsMap.set(parsed.data.id, []);
-            } else if (this._isEventRecord(parsed)) {
-              const list = eventsMap.get(parsed.data.reportId);
-              if (list) list.push(parsed.data);
-            }
-          } catch {
-          }
-        }
-        return Array.from(reports.entries()).map(([id, report]) => ({
-          report,
-          events: eventsMap.get(id) ?? []
-        }));
-      }
-      async _findRecord(id) {
-        const all = await this._readAll();
-        const entry = all.find((e) => e.report.id === id);
-        return entry ? this._materialize(entry) : null;
-      }
-      _materialize(entry) {
-        if (entry.events.length === 0) return { ...entry.report };
-        const sorted = [...entry.events].sort((a, b) => a.timestamp.localeCompare(b.timestamp));
-        const latest = sorted[sorted.length - 1];
-        if (latest.eventType !== "note_added") {
-          return { ...entry.report, lifecycle: latest.toLifecycle };
-        }
-        return { ...entry.report };
-      }
-    };
-  }
-});
-
 // src/boot.ts
 import * as fs9 from "node:fs/promises";
 import * as os3 from "node:os";
@@ -3524,7 +3524,7 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
     // DEFAULT_STATUSLINE_MODE (packages/tui/src/components/settings-picker-model.ts).
     statuslineMode: "minimum",
     thinkingWord: DEFAULT_TUI_THINKING_WORD,
-    showAgentSwarmPanel: true
+    showAgentSwarmPanel: "bottom"
   },
   circuitBreaker: { ...DEFAULT_CIRCUIT_BREAKER_CONFIG },
   modelRuntime: {
@@ -4014,13 +4014,32 @@ function inlineDefinition(model) {
   if (maxOutput !== void 0) definition.maxOutput = maxOutput;
   const capabilities = readCapabilities(model);
   if (capabilities) definition.capabilities = capabilities;
+  const { id: _id, ...rest } = model;
+  if (Object.keys(rest).length > 0) {
+    definition.modelsDev = rest;
+  }
   return definition;
 }
 function mergeDefinitions(base, patch) {
+  const mergedModelsDev = (() => {
+    if (!base?.modelsDev && !patch.modelsDev) return void 0;
+    const baseMd = base?.modelsDev ?? {};
+    const patchMd = patch.modelsDev ?? {};
+    const result = { ...baseMd, ...patchMd };
+    for (const nestedKey of ["limit", "cost", "modalities"]) {
+      const bn = baseMd?.[nestedKey];
+      const pn = patchMd?.[nestedKey];
+      if (bn || pn) {
+        result[nestedKey] = { ...bn ?? {}, ...pn ?? {} };
+      }
+    }
+    return result;
+  })();
   return {
     ...base,
     ...patch,
-    ...base?.capabilities || patch.capabilities ? { capabilities: { ...base?.capabilities, ...patch.capabilities } } : {}
+    ...base?.capabilities || patch.capabilities ? { capabilities: { ...base?.capabilities, ...patch.capabilities } } : {},
+    ...mergedModelsDev ? { modelsDev: mergedModelsDev } : {}
   };
 }
 function normalizeInlineProviderModels(config, warn) {
@@ -15021,6 +15040,49 @@ function quoteWin32CmdArg(arg) {
   return `"${arg}"`;
 }
 
+// src/utils/sage-output-block.ts
+var SAGE_INJECTOR_HEADINGS = /* @__PURE__ */ new Set([
+  "--- SAGE: task-aware project knowledge (Memory Injector) ---",
+  "--- SAGE: related project knowledge (Memory Injector) ---"
+]);
+var SAGE_MEMORY_LINE = /^- \[[^\]]+\](?:\[[^\]]+\])* <memory id="[^"]+">.*<\/memory>(?: .*)?$/;
+var SAGE_MEMORY_LINE_TRUNCATED = /^- \[[^\]]+\](?:\[[^\]]+\])* <memory id="[^"]+">.*…$/;
+function splitSageOutputBlock(output) {
+  if (!output.includes("--- SAGE: ")) return { body: output, sageLines: [] };
+  const lines = output.split("\n");
+  for (let sageIdx = lines.length - 1; sageIdx >= 0; sageIdx--) {
+    if (!SAGE_INJECTOR_HEADINGS.has(lines[sageIdx] ?? "")) continue;
+    const candidate = lines.slice(sageIdx);
+    if (candidate.length < 2) continue;
+    const memoryLines = candidate.slice(1).filter((line) => line.trim().length > 0);
+    if (memoryLines.length === 0) continue;
+    const bodyOk = memoryLines.every(
+      (line, index) => SAGE_MEMORY_LINE.test(line) || index === memoryLines.length - 1 && SAGE_MEMORY_LINE_TRUNCATED.test(line)
+    );
+    if (!bodyOk) continue;
+    let end = candidate.length;
+    while (end > 1 && candidate[end - 1].trim().length === 0) end--;
+    return {
+      body: lines.slice(0, sageIdx).join("\n").trimEnd(),
+      sageLines: candidate.slice(0, end)
+    };
+  }
+  return { body: output, sageLines: [] };
+}
+function capSageLines(sageLines, maxChars) {
+  if (sageLines.length < 2) return [];
+  const header = sageLines[0];
+  if (header.length >= maxChars) return [];
+  const out = [header];
+  let used = header.length;
+  for (const line of sageLines.slice(1)) {
+    if (used + 1 + line.length > maxChars) break;
+    out.push(line);
+    used += 1 + line.length;
+  }
+  return out.length > 1 ? out : [];
+}
+
 // src/chronicle/sqlite-query.ts
 var MAX_LIMIT = 1e4;
 function encodeCursor2(cursor) {
@@ -30654,8 +30716,16 @@ function resolveSubagentModelTarget(config, role, opts = {}) {
   const resolution = resolveModelMatrixResolution(config.modelMatrix, role);
   const matrixTarget = resolveModelTargetFromEntry(config, resolution?.entry);
   const implementationTarget = opts.implementationTarget ?? resolveImplementationModelTarget(config);
+  const isAvailable = (providerId, model) => {
+    if (!opts.statusTracker) return true;
+    if (!providerId || !model) return true;
+    return opts.statusTracker.isAvailable(providerId, model);
+  };
+  const matrixEffective = materializeTarget(config, matrixTarget);
+  const matrixIsAvailable = !matrixEffective || isAvailable(matrixEffective.provider, matrixEffective.model);
   if (!roleNeedsIndependentReviewModel(role)) {
     if (!matrixTarget) return void 0;
+    if (!matrixIsAvailable) return void 0;
     return {
       ...matrixTarget,
       source: "matrix",
@@ -30664,16 +30734,27 @@ function resolveSubagentModelTarget(config, role, opts = {}) {
   }
   const matrixRef = materializeTarget(config, matrixTarget);
   if (resolution?.source === "role" || resolution?.source === "phase") {
-    return matrixTarget ? { ...matrixTarget, source: "matrix", matrixSource: resolution.source } : void 0;
+    if (!matrixTarget) return void 0;
+    if (!matrixIsAvailable) return void 0;
+    return {
+      ...matrixTarget,
+      source: "matrix",
+      matrixSource: resolution.source
+    };
   }
   if (matrixRef && !sameModelReference(matrixRef, implementationTarget)) {
+    if (!matrixIsAvailable) return void 0;
     return {
       ...matrixTarget ?? {},
       source: "matrix",
       matrixSource: resolution?.source
     };
   }
-  const diverse = chooseDiverseModelTarget(config, implementationTarget);
+  const diverse = chooseDiverseModelTargetWithTracker(
+    config,
+    implementationTarget,
+    opts.statusTracker
+  );
   if (diverse) {
     return {
       provider: diverse.provider,
@@ -30687,6 +30768,7 @@ function resolveSubagentModelTarget(config, role, opts = {}) {
     };
   }
   if (!matrixTarget) return void 0;
+  if (!matrixIsAvailable) return void 0;
   return {
     ...matrixTarget,
     source: "matrix",
@@ -30723,6 +30805,14 @@ function chooseDiverseModelTarget(config, avoid) {
   candidates.sort((a, b) => modelDiversityScore(b, avoid) - modelDiversityScore(a, avoid));
   return candidates[0];
 }
+function chooseDiverseModelTargetWithTracker(config, avoid, tracker) {
+  if (!tracker) return chooseDiverseModelTarget(config, avoid);
+  const ranked = collectConfiguredModelTargets(config).filter((candidate) => !sameModelReference(candidate, avoid)).sort((a, b) => modelDiversityScore(b, avoid) - modelDiversityScore(a, avoid));
+  for (const candidate of ranked) {
+    if (tracker.isAvailable(candidate.provider, candidate.model)) return candidate;
+  }
+  return void 0;
+}
 function collectConfiguredModelTargets(config) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -37785,6 +37875,36 @@ function isMailboxLeader(agentId, role) {
 function isMailboxMessageVisibleTo(message, agentId, role) {
   return message.audience !== "leaders" || isMailboxLeader(agentId, role);
 }
+function isAffectedBySessionAffinity(message) {
+  return message.sessionAffinity !== void 0;
+}
+async function acceptMailboxMessageForSession(message, currentSessionId, ctx) {
+  if (!isAffectedBySessionAffinity(message)) return true;
+  const affinity = message.sessionAffinity;
+  if (affinity === null || typeof affinity !== "object" || Array.isArray(affinity)) {
+    return false;
+  }
+  if (affinity.sessionId !== void 0 && typeof affinity.sessionId !== "string" || affinity.reportId !== void 0 && typeof affinity.reportId !== "string") {
+    return false;
+  }
+  if (!currentSessionId) {
+    return ctx?.allowUnscoped === true;
+  }
+  if (typeof affinity.sessionId === "string" && affinity.sessionId.length > 0) {
+    if (affinity.sessionId !== currentSessionId) return false;
+    return true;
+  }
+  if (affinity.reportId && ctx?.resolveChimeraReportSessionId) {
+    try {
+      const resolved = await ctx.resolveChimeraReportSessionId(affinity.reportId);
+      if (resolved === currentSessionId) return true;
+      if (resolved !== void 0) return false;
+    } catch {
+    }
+  }
+  if (ctx?.allowUnscoped === true) return true;
+  return false;
+}
 function validateSendType(type, to) {
   if (type === "control") {
     throw new TypeError(
@@ -38409,7 +38529,7 @@ function makeMailboxTool(opts = {}) {
         case "ack":
           return executeAck(mb, callerId, i);
         case "query":
-          return executeQuery(mb, callerId, identity2.role, i);
+          return executeQuery(mb, callerId, callerSessionId, identity2.role, i);
         case "status":
           return executeStatus(mb);
         case "online":
@@ -38438,12 +38558,18 @@ async function executeCheck(mb, agentId, sessionId, aliases, role, i) {
     )
   );
   const seen = /* @__PURE__ */ new Set();
-  const messages = batches.flat().filter((m) => {
+  const candidates = batches.flat().filter((m) => {
     if (seen.has(m.id)) return false;
     if (!isMailboxMessageVisibleTo(m, agentId, role)) return false;
     seen.add(m.id);
     return true;
   });
+  const messages = [];
+  for (const m of candidates) {
+    if (await acceptMailboxMessageForSession(m, sessionId)) {
+      messages.push(m);
+    }
+  }
   const acked = markRead || completed ? await mb.ackMany({
     acks: messages.map((m) => ({
       messageId: m.id,
@@ -38524,7 +38650,7 @@ async function executeAck(mb, agentId, i) {
     summary: `Message ${messageId} acknowledged. Read by ${Object.keys(updated.readBy).length} agent(s), Completed: ${updated.completed}.`
   };
 }
-async function executeQuery(mb, agentId, role, i) {
+async function executeQuery(mb, agentId, sessionId, role, i) {
   const limit = i.limit ?? 50;
   const messages = await mb.query({
     to: i.to,
@@ -38537,7 +38663,12 @@ async function executeQuery(mb, agentId, role, i) {
     sessionId: i.sessionId,
     limit
   });
-  const visible = messages.filter((message) => isMailboxMessageVisibleTo(message, agentId, role));
+  const visible = [];
+  for (const message of messages) {
+    if (isMailboxMessageVisibleTo(message, agentId, role) && await acceptMailboxMessageForSession(message, sessionId)) {
+      visible.push(message);
+    }
+  }
   return { ok: true, count: visible.length, messages: visible, summary: `${visible.length} message(s).` };
 }
 async function executeStatus(mb) {
@@ -39968,6 +40099,14 @@ var SEND_ALLOWED_FIELDS = /* @__PURE__ */ new Set([
   "senderSessionId",
   "ttlMs",
   "taskContext"
+  // 'sessionAffinity' is NOT in the allow-list. The trust-line contract:
+  // session-affinity tokens are stamped ONLY by trusted internal callers
+  // (chimera/auto-review pipelines) that call `mailbox.send()` directly
+  // and never go through this boundary codec. Allowing the field at the
+  // boundary would let any actor with `mail.send.informational` stamp
+  // another session's id and bypass the receiver-side filter. The
+  // receiver trusts the sender-asserted `sessionId`; the boundary must
+  // refuse the field entirely.
 ]);
 var ACK_ALLOWED_FIELDS = /* @__PURE__ */ new Set([
   "messageId",
@@ -40004,7 +40143,15 @@ function parseMailboxSendInput(payload, actor) {
   const priority = validatePriority(rawPriority);
   const audience = validateAudience(payload["audience"]);
   const replyTo = optionalString2(payload, "replyTo", "send");
-  return { to, type: typeResult.type, subject: subject2, body, priority, audience, replyTo };
+  return {
+    to,
+    type: typeResult.type,
+    subject: subject2,
+    body,
+    priority,
+    audience,
+    replyTo
+  };
 }
 function parseMailboxQueryInput(payload, actor) {
   assertCapability(actor, "mail.read.self", "query");
@@ -48740,6 +48887,7 @@ function createHqPublisherFromEnv(options) {
 
 // src/mailbox-attach.ts
 init_error();
+init_review_report_store();
 
 // src/core/mailbox-loop.ts
 init_error();
@@ -49122,9 +49270,43 @@ function attachMailboxCheckerInner(a, source) {
     agentId: () => ensureRegistered(),
     role: () => resolveMailboxIdentity(a.ctx).role,
     aliases: [baseIdOf()],
-    sessionId: () => a.ctx.session.id
+    sessionId: () => a.ctx.session.id,
+    // ACK is deferred to the session-affinity wrapper so messages dropped
+    // by the filter are NOT marked as read by this agent.
+    ack: false
   };
   const checkMailbox2 = createMailboxChecker(mailboxCheckerOptions);
+  const reportStore = new JsonlReportStore(
+    resolveProjectDir(a.ctx.projectRoot, wstackGlobalRoot())
+  );
+  const sessionAffinityCtx = {
+    resolveChimeraReportSessionId: async (reportId) => (await reportStore.get(reportId))?.sessionId
+  };
+  const applySessionAffinityFilter = (checker, ack) => {
+    return async () => {
+      const currentSessionId = a.ctx.session.id;
+      const agentId = ack ? ensureRegistered() : null;
+      const messages = await checker();
+      const filtered = [];
+      for (const m of messages) {
+        if (await acceptMailboxMessageForSession(m, currentSessionId, sessionAffinityCtx)) {
+          filtered.push(m);
+        }
+      }
+      if (ack && filtered.length > 0 && agentId) {
+        void getMailbox().ackMany({
+          acks: filtered.map((m) => ({
+            messageId: m.id,
+            readerId: agentId,
+            read: true
+          }))
+        }).catch(() => {
+        });
+      }
+      return filtered;
+    };
+  };
+  const sessionScopedCheckMailbox = applySessionAffinityFilter(checkMailbox2, true);
   const checkMailboxAwareness = createMailboxChecker({
     ...mailboxCheckerOptions,
     // Exclude out-of-band types (control) from awareness polling.
@@ -49134,6 +49316,7 @@ function attachMailboxCheckerInner(a, source) {
     include: (m) => !MAILBOX_TYPE_PROPERTIES[m.type]?.outOfBand,
     ack: false
   });
+  const sessionScopedCheckMailboxAwareness = applySessionAffinityFilter(checkMailboxAwareness, false);
   const AWARENESS_FALLBACK_INTERVAL_MS = MAILBOX_AWARENESS_INTERVAL_MS;
   const AWARENESS_PUSH_DEBOUNCE_MS = 500;
   let pollInFlight = false;
@@ -49143,7 +49326,7 @@ function attachMailboxCheckerInner(a, source) {
     if (awarenessDisposed || pollInFlight) return;
     pollInFlight = true;
     try {
-      const messages = await checkMailboxAwareness();
+      const messages = await sessionScopedCheckMailboxAwareness();
       if (!awarenessDisposed && messages.length > 0 && a.ctx.meta["coordinationContextMode"] !== "background") {
         setBtwNote(a.ctx, buildMailboxBtwAwarenessBlock(messages).text);
       }
@@ -49176,7 +49359,7 @@ function attachMailboxCheckerInner(a, source) {
     if (pushDebounceTimer !== null) clearTimeout(pushDebounceTimer);
     pushUnsub?.();
   });
-  return checkMailbox2;
+  return sessionScopedCheckMailbox;
 }
 function attachFleetPulse(a, cfg) {
   if (!a.ctx.projectRoot || cfg?.enabled === false) {
@@ -49267,7 +49450,7 @@ function requestLimitExtension(opts) {
 init_errors();
 
 // src/core/streaming-response-builder.ts
-import { randomUUID as randomUUID28 } from "node:crypto";
+import { randomUUID as randomUUID29 } from "node:crypto";
 var STREAM_DRAIN_TIMEOUT_MS = 500;
 function buildResponse(state) {
   const content = [];
@@ -49327,7 +49510,7 @@ function handleContentBlockStart(state, ev) {
     state.textBuffers.push("");
     state.blockOrder.push({ kind: "text", idx: state.currentTextIndex });
   } else if (kind === "tool_use") {
-    const id = ev.id ?? randomUUID28();
+    const id = ev.id ?? randomUUID29();
     state.tools.set(id, { name: ev.name ?? "unknown", partial: "" });
     state.blockOrder.push({ kind: "tool", id });
     state.currentTextIndex = -1;
@@ -49562,7 +49745,7 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
 
 // src/observability/network-telemetry.ts
 import { AsyncLocalStorage } from "node:async_hooks";
-import { createHash as createHash23, randomUUID as randomUUID29 } from "node:crypto";
+import { createHash as createHash23, randomUUID as randomUUID30 } from "node:crypto";
 import { channel } from "node:diagnostics_channel";
 var storage = new AsyncLocalStorage();
 var requests = /* @__PURE__ */ new WeakMap();
@@ -49599,7 +49782,7 @@ function subscribe() {
     const requestBytes = numberField2(request, "contentLength");
     const state = {
       ...context,
-      requestId: randomUUID29(),
+      requestId: randomUUID30(),
       ...target,
       ...requestBytes !== void 0 ? { requestBytes } : {},
       startedAt,
@@ -49734,7 +49917,7 @@ function hash3(value) {
 }
 
 // src/core/provider-runner.ts
-import { randomUUID as randomUUID30 } from "node:crypto";
+import { randomUUID as randomUUID31 } from "node:crypto";
 function providerLogCtx(p, r) {
   return {
     providerId: p.id,
@@ -49746,11 +49929,11 @@ function providerLogCtx(p, r) {
 }
 async function runProviderWithRetry(opts) {
   const { provider, request, signal, ctx, events, retry, logger, tracer } = opts;
-  const logicalRequestId = randomUUID30();
+  const logicalRequestId = randomUUID31();
   const promptManifest = createChroniclePromptManifest(request);
   let attempt = 0;
   for (; ; ) {
-    const attemptId = randomUUID30();
+    const attemptId = randomUUID31();
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const startedNs = process.hrtime.bigint();
     const correlation = {
@@ -50667,51 +50850,6 @@ ${text2}` : text2;
 
 // src/core/agent-tools.ts
 init_error();
-
-// src/utils/sage-output-block.ts
-var SAGE_INJECTOR_HEADINGS = /* @__PURE__ */ new Set([
-  "--- SAGE: task-aware project knowledge (Memory Injector) ---",
-  "--- SAGE: related project knowledge (Memory Injector) ---"
-]);
-var SAGE_MEMORY_LINE = /^- \[[^\]]+\](?:\[[^\]]+\])* <memory id="[^"]+">.*<\/memory>(?: .*)?$/;
-var SAGE_MEMORY_LINE_TRUNCATED = /^- \[[^\]]+\](?:\[[^\]]+\])* <memory id="[^"]+">.*…$/;
-function splitSageOutputBlock(output) {
-  if (!output.includes("--- SAGE: ")) return { body: output, sageLines: [] };
-  const lines = output.split("\n");
-  for (let sageIdx = lines.length - 1; sageIdx >= 0; sageIdx--) {
-    if (!SAGE_INJECTOR_HEADINGS.has(lines[sageIdx] ?? "")) continue;
-    const candidate = lines.slice(sageIdx);
-    if (candidate.length < 2) continue;
-    const memoryLines = candidate.slice(1).filter((line) => line.trim().length > 0);
-    if (memoryLines.length === 0) continue;
-    const bodyOk = memoryLines.every(
-      (line, index) => SAGE_MEMORY_LINE.test(line) || index === memoryLines.length - 1 && SAGE_MEMORY_LINE_TRUNCATED.test(line)
-    );
-    if (!bodyOk) continue;
-    let end = candidate.length;
-    while (end > 1 && candidate[end - 1].trim().length === 0) end--;
-    return {
-      body: lines.slice(0, sageIdx).join("\n").trimEnd(),
-      sageLines: candidate.slice(0, end)
-    };
-  }
-  return { body: output, sageLines: [] };
-}
-function capSageLines(sageLines, maxChars) {
-  if (sageLines.length < 2) return [];
-  const header = sageLines[0];
-  if (header.length >= maxChars) return [];
-  const out = [header];
-  let used = header.length;
-  for (const line of sageLines.slice(1)) {
-    if (used + 1 + line.length > maxChars) break;
-    out.push(line);
-    used += 1 + line.length;
-  }
-  return out.length > 1 ? out : [];
-}
-
-// src/core/agent-tools.ts
 var DIFF_TOOL_NAMES = /* @__PURE__ */ new Set(["edit", "write", "replace", "patch", "diff"]);
 var DIFF_TOOL_EVENT_PREVIEW_MAX = 16e3;
 var SAGE_EVENT_MAX = 2e3;
@@ -53274,7 +53412,7 @@ var AutonomousRunner = class {
 // src/storage/goal-store.ts
 init_atomic_write();
 init_error();
-import * as fsp28 from "node:fs/promises";
+import * as fsp29 from "node:fs/promises";
 init_errors();
 var MAX_JOURNAL_ENTRIES = 500;
 function goalFilePath(projectRoot) {
@@ -53284,7 +53422,7 @@ async function loadGoal(filePath, events, warn) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp28.readFile(filePath, "utf8");
+    raw = await fsp29.readFile(filePath, "utf8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -53593,7 +53731,7 @@ var KNOWN_TOKEN_NAMES = Object.values(KNOWN_TOKEN_GROUPS).flat();
 // src/execution/design-kit-loader.ts
 import { existsSync as existsSync7 } from "node:fs";
 import * as fs28 from "node:fs/promises";
-import * as path67 from "node:path";
+import * as path68 from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 var KIT_FILE = "KIT.md";
 var TOKENS_FILE = "tokens.json";
@@ -53699,7 +53837,7 @@ var DefaultDesignKitLoader = class {
       }
       for (const e of entries) {
         if (!e.isDirectory()) continue;
-        const kitFile = path67.join(dir, e.name, KIT_FILE);
+        const kitFile = path68.join(dir, e.name, KIT_FILE);
         try {
           const raw = await fs28.readFile(kitFile, "utf8");
           const fm = parseKitFrontmatter(raw);
@@ -53774,7 +53912,7 @@ var DefaultDesignKitLoader = class {
     const m = await this.find(id);
     let tokens;
     if (m) {
-      const tokensPath = path67.join(path67.dirname(m.path), TOKENS_FILE);
+      const tokensPath = path68.join(path68.dirname(m.path), TOKENS_FILE);
       try {
         const raw = await fs28.readFile(tokensPath, "utf8");
         tokens = JSON.parse(raw);
@@ -53836,12 +53974,12 @@ function mergeKitTokens(base, own) {
 }
 function resolveBundledDesignKitsDir() {
   try {
-    const here = path67.dirname(fileURLToPath7(import.meta.url));
+    const here = path68.dirname(fileURLToPath7(import.meta.url));
     const candidates = [
-      path67.join(here, "design-kits"),
-      path67.join(here, "..", "design-kits"),
-      path67.join(here, "..", "..", "design-kits"),
-      path67.join(here, "..", "..", "..", "design-kits")
+      path68.join(here, "design-kits"),
+      path68.join(here, "..", "design-kits"),
+      path68.join(here, "..", "..", "design-kits"),
+      path68.join(here, "..", "..", "..", "design-kits")
     ];
     for (const c of candidates) {
       if (existsSync7(c)) return c;
@@ -53880,10 +54018,10 @@ function _resetDesignKitLoaderMemo() {
 // src/execution/design-project-store.ts
 import { existsSync as existsSync8 } from "node:fs";
 import * as fs29 from "node:fs/promises";
-import * as path68 from "node:path";
+import * as path69 from "node:path";
 var DESIGN_DIR = ".design";
 function designProjectDir(projectRoot) {
-  return path68.join(projectRoot, DESIGN_DIR);
+  return path69.join(projectRoot, DESIGN_DIR);
 }
 var RULE_FILES = ["rules.md", "RULES.md", "design.md"];
 var rulesCache = /* @__PURE__ */ new Map();
@@ -53898,7 +54036,7 @@ async function loadProjectDesignRules(projectRoot) {
   let rules;
   for (const name of RULE_FILES) {
     try {
-      const txt = await fs29.readFile(path68.join(designProjectDir(projectRoot), name), "utf8");
+      const txt = await fs29.readFile(path69.join(designProjectDir(projectRoot), name), "utf8");
       if (txt.trim()) {
         rules = txt.trim();
         break;
@@ -53924,7 +54062,7 @@ function parseOverrides(value) {
 }
 async function loadActiveKit(projectRoot) {
   try {
-    const raw = await fs29.readFile(path68.join(designProjectDir(projectRoot), "active.json"), "utf8");
+    const raw = await fs29.readFile(path69.join(designProjectDir(projectRoot), "active.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed.kit === "string") {
       return {
@@ -53958,7 +54096,7 @@ function applyTokenOverrides(tokens, overrides) {
 async function ensureDesignDir(projectRoot) {
   const dir = designProjectDir(projectRoot);
   await fs29.mkdir(dir, { recursive: true });
-  const gi = path68.join(dir, ".gitignore");
+  const gi = path69.join(dir, ".gitignore");
   if (!existsSync8(gi)) {
     try {
       await fs29.writeFile(gi, "*\n");
@@ -53972,11 +54110,11 @@ async function recordKitChoice(projectRoot, kit, stack, source, isoTime, overrid
     const dir = await ensureDesignDir(projectRoot);
     const record = { kit, stack: stack ?? null };
     if (overrides && Object.keys(overrides).length > 0) record.overrides = overrides;
-    await fs29.writeFile(path68.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
+    await fs29.writeFile(path69.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
 `);
     const line = `- ${isoTime} \xB7 kit=${kit}${stack ? ` stack=${stack}` : ""} \xB7 via=${source}
 `;
-    await fs29.appendFile(path68.join(dir, "decisions.md"), line);
+    await fs29.appendFile(path69.join(dir, "decisions.md"), line);
   } catch {
   }
 }
@@ -53992,11 +54130,11 @@ async function recordOverrides(projectRoot, patch, isoTime) {
     const dir = await ensureDesignDir(projectRoot);
     const record = { kit: active.kit, stack: active.stack ?? null };
     if (Object.keys(merged).length > 0) record.overrides = merged;
-    await fs29.writeFile(path68.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
+    await fs29.writeFile(path69.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
 `);
     const keys = Object.keys(patch).join(",");
     await fs29.appendFile(
-      path68.join(dir, "decisions.md"),
+      path69.join(dir, "decisions.md"),
       `- ${isoTime} \xB7 kit=${active.kit} \xB7 override=${keys} \xB7 via=set
 `
     );
@@ -54006,7 +54144,7 @@ async function recordOverrides(projectRoot, patch, isoTime) {
 }
 async function clearPersistedActiveKit(projectRoot) {
   try {
-    await fs29.rm(path68.join(designProjectDir(projectRoot), "active.json"), { force: true });
+    await fs29.rm(path69.join(designProjectDir(projectRoot), "active.json"), { force: true });
   } catch {
   }
 }
@@ -56924,7 +57062,7 @@ ${summaryText}` : summaryText;
 
 // src/execution/parallel-eternal-engine.ts
 init_error();
-import { randomUUID as randomUUID31 } from "node:crypto";
+import { randomUUID as randomUUID32 } from "node:crypto";
 var GOAL_COMPLETE_MARKER2 = /^\s*\[goal[_\s-]?complete\]\s*$/im;
 var ParallelEternalEngine = class {
   constructor(opts) {
@@ -57001,7 +57139,7 @@ var ParallelEternalEngine = class {
     this.state = "running";
     await this.persistState("running");
     const config = {
-      coordinatorId: `parallel-${randomUUID31().slice(0, 8)}`,
+      coordinatorId: `parallel-${randomUUID32().slice(0, 8)}`,
       maxConcurrent: this.slots,
       doneCondition: { type: "all_tasks_done" }
     };
@@ -57055,7 +57193,7 @@ var ParallelEternalEngine = class {
     }
     if (!this.coordinator) {
       const config = {
-        coordinatorId: `parallel-${randomUUID31().slice(0, 8)}`,
+        coordinatorId: `parallel-${randomUUID32().slice(0, 8)}`,
         maxConcurrent: this.slots,
         doneCondition: { type: "all_tasks_done" }
       };
@@ -57141,7 +57279,7 @@ ${recentJournal}` : "No prior iterations.",
       const task = expectDefined(tasks[i]);
       const route = routes[i] ?? null;
       const subagentId = `parallel-${this.iterations}-${i}`;
-      const taskId = randomUUID31();
+      const taskId = randomUUID32();
       const personaLine = route ? `Acting agent: ${route.definition.config.name} \u2014 ${route.definition.capability.summary}
 ` : "";
       const spec = {
@@ -57964,7 +58102,7 @@ Summarize the following message range:`;
 
 // src/execution/skill-loader.ts
 import * as fs30 from "node:fs/promises";
-import * as path69 from "node:path";
+import * as path70 from "node:path";
 
 // src/skills/foreign-sources.ts
 var FOREIGN_SKILL_TOOLS = [
@@ -58034,7 +58172,7 @@ async function entryIsDirectory(dir, entry) {
   if (entry.isDirectory()) return true;
   if (entry.isSymbolicLink()) {
     try {
-      return (await fs30.stat(path69.join(dir, entry.name))).isDirectory();
+      return (await fs30.stat(path70.join(dir, entry.name))).isDirectory();
     } catch {
       return false;
     }
@@ -58058,7 +58196,7 @@ var DefaultSkillLoader = class {
       for (const tool of FOREIGN_SKILL_TOOLS) {
         if (!foreignIds.includes(tool.id)) continue;
         dirs.push({
-          dir: path69.join(root, "." + tool.id, tool.subdir),
+          dir: path70.join(root, "." + tool.id, tool.subdir),
           source: "foreign",
           originTool: tool.id
         });
@@ -58088,7 +58226,7 @@ var DefaultSkillLoader = class {
         );
         for (const e of entries) {
           if (!await entryIsDirectory(dir, e)) continue;
-          const skillFile = path69.join(dir, e.name, "SKILL.md");
+          const skillFile = path70.join(dir, e.name, "SKILL.md");
           let raw;
           try {
             raw = await fs30.readFile(skillFile, "utf8");
@@ -58217,7 +58355,7 @@ var DefaultSkillLoader = class {
     if (cached2 !== void 0) return cached2;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
-    const savePath = path69.join(path69.dirname(m.path), "SKILL.save.md");
+    const savePath = path70.join(path70.dirname(m.path), "SKILL.save.md");
     let result;
     try {
       result = await fs30.readFile(savePath, "utf8");
@@ -58251,13 +58389,13 @@ function parseDescriptionFromText(desc) {
 
 // src/execution/prompt-loader.ts
 import * as fs32 from "node:fs/promises";
-import * as path71 from "node:path";
+import * as path72 from "node:path";
 
 // src/storage/prompt-store.ts
 init_atomic_write();
 import { createHash as createHash26 } from "node:crypto";
 import * as fs31 from "node:fs/promises";
-import * as path70 from "node:path";
+import * as path71 from "node:path";
 var SCHEMA_VERSION3 = 2;
 function promptChecksum(content) {
   return createHash26("sha256").update(content, "utf8").digest("hex");
@@ -58326,7 +58464,7 @@ var DefaultPromptStore = class {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fs31.readFile(path70.join(this.dir, file), "utf8")
+            await fs31.readFile(path71.join(this.dir, file), "utf8")
           );
           const migrated = migratePromptEntry(raw.entry);
           if (migrated) entries.push(migrated);
@@ -58340,7 +58478,7 @@ var DefaultPromptStore = class {
     );
   }
   async get(id) {
-    const file = path70.join(this.dir, `${id}.json`);
+    const file = path71.join(this.dir, `${id}.json`);
     try {
       const raw = JSON.parse(await fs31.readFile(file, "utf8"));
       return migratePromptEntry(raw.entry);
@@ -58350,12 +58488,12 @@ var DefaultPromptStore = class {
   }
   async save(entry) {
     await ensureDir(this.dir);
-    const file = path70.join(this.dir, `${entry.id}.json`);
+    const file = path71.join(this.dir, `${entry.id}.json`);
     const raw = { version: SCHEMA_VERSION3, entry };
     await atomicWrite(file, JSON.stringify(raw, null, 2));
   }
   async delete(id) {
-    const file = path70.join(this.dir, `${id}.json`);
+    const file = path71.join(this.dir, `${id}.json`);
     try {
       await fs31.unlink(file);
       return true;
@@ -58444,7 +58582,7 @@ var DefaultPromptLoader = class {
   constructor(opts) {
     this.projectStore = typeof opts.paths.inProjectPrompts === "string" ? new DefaultPromptStore(opts.paths.inProjectPrompts) : void 0;
     this.userStore = typeof opts.paths.globalPrompts === "string" ? new DefaultPromptStore(opts.paths.globalPrompts) : void 0;
-    this.builtinDir = opts.bundledDir ? path71.join(opts.bundledDir, "prompts") : void 0;
+    this.builtinDir = opts.bundledDir ? path72.join(opts.bundledDir, "prompts") : void 0;
   }
   async list() {
     if (this.cache) return this.cache;
@@ -58576,7 +58714,7 @@ async function walkJson(dir) {
     return out;
   }
   for (const e of entries) {
-    const full = path71.join(dir, e.name);
+    const full = path72.join(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkJson(full));
     } else if (e.name.endsWith(".json") && e.name !== "index.json" && e.name !== "schema.json") {
@@ -58763,9 +58901,9 @@ function readPolicy(ctx) {
 }
 
 // src/execution/tool-executor.ts
-import { randomUUID as randomUUID33 } from "node:crypto";
+import { randomUUID as randomUUID34 } from "node:crypto";
 import * as fs34 from "node:fs/promises";
-import * as path74 from "node:path";
+import * as path75 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 
 // src/observability/process-telemetry.ts
@@ -58857,7 +58995,7 @@ function emit(name, event) {
 
 // src/security/kanban-boundary.ts
 import { realpath as realpath3 } from "node:fs/promises";
-import * as path72 from "node:path";
+import * as path73 from "node:path";
 import {
   evaluateKanbanBoundaryOpaque,
   evaluateKanbanBoundaryPath,
@@ -58946,10 +59084,10 @@ function resolveKanbanIdentity(ctx) {
 async function extractCandidatePaths(toolName, input, ctx) {
   if (toolName === "patch" && typeof input["patch"] === "string") {
     const directoryInput = stringValue(input["directory"]) ?? ctx.workingDir;
-    const directory = path72.isAbsolute(directoryInput) ? directoryInput : path72.resolve(ctx.workingDir, directoryInput);
+    const directory = path73.isAbsolute(directoryInput) ? directoryInput : path73.resolve(ctx.workingDir, directoryInput);
     const strip = Math.max(1, numericValue(input["strip"]) ?? 1);
     const targets = extractPatchTargets(input["patch"], strip).map(
-      (target) => relativeToProject(path72.resolve(directory, target), ctx.projectRoot)
+      (target) => relativeToProject(path73.resolve(directory, target), ctx.projectRoot)
     );
     return Promise.all(targets.map((target) => canonicalizeCandidatePath(target, ctx)));
   }
@@ -58959,7 +59097,7 @@ async function extractCandidatePaths(toolName, input, ctx) {
   collectPathValues(input, values, pathKeys);
   if (toolName === "scaffold" && typeof input["name"] === "string") {
     const cwd = stringValue(input["cwd"]) ?? ctx.workingDir;
-    values.push(path72.join(cwd, input["name"]));
+    values.push(path73.join(cwd, input["name"]));
   }
   const candidates = [
     ...new Set(values.flatMap(splitPathList).map((value) => resolveInputPath(value, ctx)))
@@ -58967,21 +59105,21 @@ async function extractCandidatePaths(toolName, input, ctx) {
   return Promise.all(candidates.map((candidate) => canonicalizeCandidatePath(candidate, ctx)));
 }
 async function canonicalizeCandidatePath(candidate, ctx) {
-  if (path72.isAbsolute(candidate)) return candidate;
-  const absolute = path72.resolve(ctx.projectRoot, candidate);
+  if (path73.isAbsolute(candidate)) return candidate;
+  const absolute = path73.resolve(ctx.projectRoot, candidate);
   const canonicalRoot = await realpath3(ctx.projectRoot).catch(() => ctx.projectRoot);
   let probe2 = absolute;
   const missingSegments = [];
   while (true) {
     try {
-      const canonical = path72.join(await realpath3(probe2), ...missingSegments);
+      const canonical = path73.join(await realpath3(probe2), ...missingSegments);
       return relativeToProject(canonical, canonicalRoot);
     } catch (cause) {
       const code = cause.code;
       if (code !== "ENOENT" && code !== "ENOTDIR") return absolute;
-      const parent = path72.dirname(probe2);
+      const parent = path73.dirname(probe2);
       if (parent === probe2) return absolute;
-      missingSegments.unshift(path72.basename(probe2));
+      missingSegments.unshift(path73.basename(probe2));
       probe2 = parent;
     }
   }
@@ -59004,12 +59142,12 @@ function splitPathList(value) {
   return value.split(",").map((item) => item.trim()).filter(Boolean);
 }
 function resolveInputPath(value, ctx) {
-  const absolute = path72.isAbsolute(value) ? value : path72.resolve(ctx.workingDir, value);
+  const absolute = path73.isAbsolute(value) ? value : path73.resolve(ctx.workingDir, value);
   return relativeToProject(absolute, ctx.projectRoot);
 }
 function relativeToProject(absolute, projectRoot) {
-  const relative19 = path72.relative(projectRoot, absolute).replace(/\\/g, "/");
-  return relative19.startsWith("../") || path72.isAbsolute(relative19) ? absolute : relative19 || ".";
+  const relative19 = path73.relative(projectRoot, absolute).replace(/\\/g, "/");
+  return relative19.startsWith("../") || path73.isAbsolute(relative19) ? absolute : relative19 || ".";
 }
 function extractPatchTargets(patchText, strip) {
   const targets = [];
@@ -59041,9 +59179,9 @@ init_error();
 init_errors();
 
 // src/execution/tool-executor-support.ts
-import { createHash as createHash28, randomUUID as randomUUID32 } from "node:crypto";
+import { createHash as createHash28, randomUUID as randomUUID33 } from "node:crypto";
 import * as fs33 from "node:fs/promises";
-import * as path73 from "node:path";
+import * as path74 from "node:path";
 
 // src/types/tool.ts
 var ToolErrorCategory = /* @__PURE__ */ ((ToolErrorCategory2) => {
@@ -59181,11 +59319,11 @@ async function maybePersistLargeToolOutput(toolName, content, budget) {
     return content;
   }
   try {
-    const dir = path73.join(wstackGlobalRoot(), "tool-output");
+    const dir = path74.join(wstackGlobalRoot(), "tool-output");
     await fs33.mkdir(dir, { recursive: true });
     const safeTool = toolName.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    const filePath = path73.join(dir, `${stamp}-${safeTool}-${randomUUID32()}.log`);
+    const filePath = path74.join(dir, `${stamp}-${safeTool}-${randomUUID33()}.log`);
     await fs33.writeFile(filePath, content, "utf8");
     const marker = `[full tool output: ${bytes} bytes at ${filePath}; read/grep that file selectively instead of re-running or requesting more output]`;
     const fixedBytes = Buffer.byteLength(marker + TOOL_OUTPUT_ARTIFACT_OMISSION, "utf8");
@@ -59771,7 +59909,7 @@ ${errorDetails}`,
         const inputPath = use.input && typeof use.input === "object" ? use.input.path : void 0;
         const caps = tool.capabilities ?? [];
         const hasFileCapability = caps.includes("fs.read") || caps.includes("fs.write");
-        const absPath = hasFileCapability && typeof inputPath === "string" ? path74.isAbsolute(inputPath) ? inputPath : path74.resolve(ctx.projectRoot, inputPath) : void 0;
+        const absPath = hasFileCapability && typeof inputPath === "string" ? path75.isAbsolute(inputPath) ? inputPath : path75.resolve(ctx.projectRoot, inputPath) : void 0;
         let writeTargetExisted;
         if (tool.name === "write" && caps.includes("fs.write") && absPath) {
           writeTargetExisted = await fs34.stat(absPath).then(
@@ -59926,7 +60064,7 @@ ${post.additionalContext}`;
     const bridge = async (toolName, input) => {
       const nestedUse = {
         type: "tool_use",
-        id: `nested-${randomUUID33()}`,
+        id: `nested-${randomUUID34()}`,
         name: toolName,
         input
       };
@@ -60038,7 +60176,7 @@ ${post.additionalContext}`;
     ]);
     let output;
     const execute = () => typeof tool.executeStream === "function" ? this.runStreamedTool(tool, input, ctx, combined, toolUseId) : (async () => tool.execute(input, ctx, { signal: combined }))();
-    const telemetryToolCallId = toolUseId ?? `nested-${randomUUID33()}`;
+    const telemetryToolCallId = toolUseId ?? `nested-${randomUUID34()}`;
     const toolPromise = this.opts.events ? runWithNetworkTelemetry(
       {
         events: this.opts.events,
@@ -60591,27 +60729,27 @@ function codexModelMeta(id) {
 // src/models/mode-store.ts
 init_atomic_write();
 import * as fs35 from "node:fs/promises";
-import * as path76 from "node:path";
+import * as path77 from "node:path";
 
 // src/types/mode-prompts.ts
 import { readFileSync as readFileSync17, statSync as statSync7 } from "node:fs";
-import * as path75 from "node:path";
+import * as path76 from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 function modePrompt(id) {
   for (const dir of modePromptDirCandidates()) {
     try {
-      return readFileSync17(path75.join(dir, `${id}.md`), "utf8").trimEnd();
+      return readFileSync17(path76.join(dir, `${id}.md`), "utf8").trimEnd();
     } catch {
     }
   }
   return "";
 }
 function modePromptDirCandidates() {
-  const here = path75.dirname(fileURLToPath8(import.meta.url));
+  const here = path76.dirname(fileURLToPath8(import.meta.url));
   const candidates = [
-    path75.resolve(here, "../../instructions/modes"),
-    path75.resolve(here, "../instructions/modes"),
-    path75.resolve(here, "instructions/modes")
+    path76.resolve(here, "../../instructions/modes"),
+    path76.resolve(here, "../instructions/modes"),
+    path76.resolve(here, "instructions/modes")
   ];
   return candidates.sort((a, b) => Number(!isDirectory4(a)) - Number(!isDirectory4(b)));
 }
@@ -60843,7 +60981,7 @@ var DefaultModeStore = class {
   }
   async loadActiveMode() {
     try {
-      const configPath = path76.join(this.configDir, "mode.json");
+      const configPath = path77.join(this.configDir, "mode.json");
       const content = await fs35.readFile(configPath, "utf8");
       const data = JSON.parse(content);
       this.activeModeId = data.activeMode ?? null;
@@ -60854,7 +60992,7 @@ var DefaultModeStore = class {
   async saveActiveMode() {
     try {
       await fs35.mkdir(this.configDir, { recursive: true });
-      const configPath = path76.join(this.configDir, "mode.json");
+      const configPath = path77.join(this.configDir, "mode.json");
       await atomicWrite(
         configPath,
         JSON.stringify({ activeMode: this.activeModeId }, null, 2)
@@ -60869,11 +61007,11 @@ async function loadProjectModes(modesDir) {
     const entries = await fs35.readdir(modesDir);
     for (const entry of entries) {
       if (!entry.endsWith(".md") && !entry.endsWith(".txt")) continue;
-      const filePath = path76.join(modesDir, entry);
+      const filePath = path77.join(modesDir, entry);
       const stat33 = await fs35.stat(filePath);
       if (!stat33.isFile()) continue;
       const content = await fs35.readFile(filePath, "utf8");
-      const id = path76.basename(entry, path76.extname(entry));
+      const id = path77.basename(entry, path77.extname(entry));
       modes.push({
         id,
         name: id.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()),
@@ -60889,7 +61027,7 @@ async function loadProjectModes(modesDir) {
 async function loadUserModes(modesDir) {
   const modes = [];
   try {
-    const manifestPath = path76.join(modesDir, "modes.json");
+    const manifestPath = path77.join(modesDir, "modes.json");
     const content = await fs35.readFile(manifestPath, "utf8");
     const manifest = JSON.parse(content);
     for (const mode of manifest.modes) {
@@ -60902,13 +61040,13 @@ async function loadUserModes(modesDir) {
 
 // src/models/models-registry.ts
 import * as fs36 from "node:fs/promises";
-import * as path77 from "node:path";
+import * as path78 from "node:path";
 init_atomic_write();
 init_error();
 init_errors();
 var DEFAULT_URL = "https://models.dev/api.json";
 var ENV_URL_KEY = "WRONGSTACK_MODELS_DEV_URL";
-var DEFAULT_TTL_SECONDS = 24 * 3600;
+var DEFAULT_TTL_SECONDS = 3 * 3600;
 var DEFAULT_REFRESH_TIMEOUT_MS = 15e3;
 var FAMILY_BY_NPM = {
   "@ai-sdk/anthropic": "anthropic",
@@ -60982,7 +61120,7 @@ var DefaultModelsRegistry = class {
     this.overlay = opts.overlay;
     this.overlayUrl = opts.overlayUrl;
     this.overlayFile = opts.overlayFile;
-    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path77.join(path77.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
+    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path78.join(path78.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
     this.logger = opts.logger ?? noOpLogger;
   }
   async load(opts = {}) {
@@ -61257,7 +61395,7 @@ var DefaultModelsRegistry = class {
   }
   /** Used by `wstack models refresh` to expose where the cache lives. */
   cacheLocation() {
-    return path77.resolve(this.cacheFile);
+    return path78.resolve(this.cacheFile);
   }
 };
 var REASONING_EFFORTS = /* @__PURE__ */ new Set([
@@ -62340,7 +62478,7 @@ function validateTrustPolicy(value) {
 }
 
 // src/security/yolo-risk.ts
-import * as path78 from "node:path";
+import * as path79 from "node:path";
 var CATASTROPHIC_PATTERNS = [
   /\b(?:mkfs(?:\.[a-z0-9]+)?|mke2fs|newfs)\b/i,
   // make a filesystem — wipes a partition
@@ -62400,9 +62538,9 @@ function getInputString(input, key) {
 function pathLooksInsideProject(rawPath, projectRoot) {
   if (!projectRoot) return false;
   if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path78.resolve(projectRoot, rawPath);
-  const relative19 = path78.relative(projectRoot, resolved);
-  return !!relative19 && !relative19.startsWith("..") && !path78.isAbsolute(relative19);
+  const resolved = path79.resolve(projectRoot, rawPath);
+  const relative19 = path79.relative(projectRoot, resolved);
+  return !!relative19 && !relative19.startsWith("..") && !path79.isAbsolute(relative19);
 }
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
@@ -62589,7 +62727,68 @@ function isClearlyDestructiveBashCommand(command, projectRoot) {
   return false;
 }
 
-// src/security/permission-policy.ts
+// src/security/auto-approve-policy.ts
+var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
+  allowedCapabilities;
+  constructor(allowedCapabilities) {
+    this.allowedCapabilities = allowedCapabilities ?? [
+      ToolCapabilities.FS_READ,
+      ToolCapabilities.NET_OUTBOUND
+    ];
+  }
+  static isMcpTool(name) {
+    return name.startsWith("mcp__");
+  }
+  async evaluate(tool) {
+    const caps = tool.capabilities ?? [];
+    const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
+    const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
+    const mcpProxyAllowed = this.allowedCapabilities.includes(ToolCapabilities.MCP_PROXY);
+    const dangerousNotAllowed = getDangerousCapabilities(tool).filter(
+      (c) => !this.allowedCapabilities.includes(c)
+    );
+    const blocked = tool.permission === "deny" || isMcp && !mcpProxyAllowed || !hasAllowedCap || dangerousNotAllowed.length > 0;
+    if (blocked) {
+      const reason = isMcp && !mcpProxyAllowed ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow mcp.proxy explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
+      return {
+        permission: "deny",
+        source: "subagent_guard",
+        reason
+      };
+    }
+    return { permission: "auto", source: "yolo" };
+  }
+  async trust() {
+  }
+  async deny() {
+  }
+  denyOnce() {
+  }
+  allowOnce() {
+  }
+  async explain(tool) {
+    const decision = await this.evaluate(tool);
+    return {
+      toolName: tool.name,
+      subject: null,
+      steps: [
+        {
+          rule: "subagent auto",
+          matched: decision.permission === "auto",
+          decision: decision.permission,
+          source: decision.source,
+          detail: decision.reason ?? `subagent policy: ${decision.permission}`
+        }
+      ],
+      winnerIndex: 0,
+      decision
+    };
+  }
+  async reload() {
+  }
+};
+
+// src/security/permission-helpers.ts
 function matchesTrust(patterns, subject2) {
   return patterns.includes(subject2) || matchAny(patterns, subject2);
 }
@@ -62684,6 +62883,8 @@ function shellCommandReadsSensitivePath(command) {
   }
   return false;
 }
+
+// src/security/permission-policy.ts
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -63426,71 +63627,12 @@ var DefaultPermissionPolicy = class {
     return void 0;
   }
 };
-var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
-  allowedCapabilities;
-  constructor(allowedCapabilities) {
-    this.allowedCapabilities = allowedCapabilities ?? [
-      ToolCapabilities.FS_READ,
-      ToolCapabilities.NET_OUTBOUND
-    ];
-  }
-  static isMcpTool(name) {
-    return name.startsWith("mcp__");
-  }
-  async evaluate(tool) {
-    const caps = tool.capabilities ?? [];
-    const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
-    const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
-    const mcpProxyAllowed = this.allowedCapabilities.includes(ToolCapabilities.MCP_PROXY);
-    const dangerousNotAllowed = getDangerousCapabilities(tool).filter(
-      (c) => !this.allowedCapabilities.includes(c)
-    );
-    const blocked = tool.permission === "deny" || isMcp && !mcpProxyAllowed || !hasAllowedCap || dangerousNotAllowed.length > 0;
-    if (blocked) {
-      const reason = isMcp && !mcpProxyAllowed ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow mcp.proxy explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
-      return {
-        permission: "deny",
-        source: "subagent_guard",
-        reason
-      };
-    }
-    return { permission: "auto", source: "yolo" };
-  }
-  async trust() {
-  }
-  async deny() {
-  }
-  denyOnce() {
-  }
-  allowOnce() {
-  }
-  async explain(tool) {
-    const decision = await this.evaluate(tool);
-    return {
-      toolName: tool.name,
-      subject: null,
-      steps: [
-        {
-          rule: "subagent auto",
-          matched: decision.permission === "auto",
-          decision: decision.permission,
-          source: decision.source,
-          detail: decision.reason ?? `subagent policy: ${decision.permission}`
-        }
-      ],
-      winnerIndex: 0,
-      decision
-    };
-  }
-  async reload() {
-  }
-};
 
 // src/storage/attachment-store.ts
 init_atomic_write();
 import { randomBytes as randomBytes6 } from "node:crypto";
-import * as fsp29 from "node:fs/promises";
-import * as path79 from "node:path";
+import * as fsp30 from "node:fs/promises";
+import * as path80 from "node:path";
 var DEFAULT_SPOOL_THRESHOLD = 256 * 1024;
 var PLACEHOLDER_RE = /\[(pasted|image|file) #(\d+)[^\]]*\]|\[file:([^\]]+)\]/g;
 var DefaultAttachmentStore = class {
@@ -63510,8 +63652,8 @@ var DefaultAttachmentStore = class {
     let spooledPath;
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
-      await fsp29.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path79.join(this.spoolDir, `${id}.bin`);
+      await fsp30.mkdir(this.spoolDir, { recursive: true });
+      spooledPath = path80.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -63573,7 +63715,7 @@ var DefaultAttachmentStore = class {
       for (const att of this.items.values()) {
         if (att.path) toDelete.push(att.path);
       }
-      await Promise.all(toDelete.map((p) => fsp29.unlink(p).catch(() => void 0)));
+      await Promise.all(toDelete.map((p) => fsp30.unlink(p).catch(() => void 0)));
     }
     this.items.clear();
     this.refs.length = 0;
@@ -63581,7 +63723,7 @@ var DefaultAttachmentStore = class {
   }
   async toBlock(att) {
     if (att.kind === "image") {
-      const data = att.data ?? (att.path ? await fsp29.readFile(att.path, { encoding: "base64" }) : "");
+      const data = att.data ?? (att.path ? await fsp30.readFile(att.path, { encoding: "base64" }) : "");
       return {
         type: "image",
         source: {
@@ -63591,7 +63733,7 @@ var DefaultAttachmentStore = class {
         }
       };
     }
-    const raw = att.data ?? (att.path ? await fsp29.readFile(att.path, "utf8") : "");
+    const raw = att.data ?? (att.path ? await fsp30.readFile(att.path, "utf8") : "");
     const label = att.meta.filename ? `<file path="${att.meta.filename}">` : "<pasted>";
     const close = att.meta.filename ? "</file>" : "</pasted>";
     return { type: "text", text: `${label}
@@ -63758,13 +63900,13 @@ function deepFreeze(obj) {
 init_atomic_write();
 init_error();
 init_errors();
-import * as fsp30 from "node:fs/promises";
-import { randomUUID as randomUUID34 } from "node:crypto";
+import * as fsp31 from "node:fs/promises";
+import { randomUUID as randomUUID35 } from "node:crypto";
 async function loadPlan(filePath, events) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp30.readFile(filePath, "utf8");
+    raw = await fsp31.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: "~boot~",
@@ -63857,7 +63999,7 @@ function emptyPlan(sessionId, title) {
 function addPlanItem(plan, title, details) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const item = {
-    id: `plan_${Date.now()}_${randomUUID34().slice(0, 6)}`,
+    id: `plan_${Date.now()}_${randomUUID35().slice(0, 6)}`,
     title,
     details,
     status: "open",
@@ -63929,7 +64071,7 @@ function deriveTodosFromPlanItem(plan, idOrIndex, subtasks) {
   if (subtasks && subtasks.length > 0) {
     for (const st of subtasks) {
       todos.push({
-        id: `todo_${Date.now()}_${randomUUID34().slice(0, 6)}`,
+        id: `todo_${Date.now()}_${randomUUID35().slice(0, 6)}`,
         content: st,
         status: "pending",
         promotedFromPlan: item.id
@@ -64074,8 +64216,8 @@ ${cat}:`);
 // src/storage/queue-store.ts
 init_atomic_write();
 init_error();
-import * as fsp31 from "node:fs/promises";
-import * as path80 from "node:path";
+import * as fsp32 from "node:fs/promises";
+import * as path81 from "node:path";
 var QUEUE_MAX_ITEMS = 100;
 var QUEUE_MAX_BYTES = 16 * 1024 * 1024;
 var QUEUE_MAX_ITEM_BYTES = 8 * 1024 * 1024;
@@ -64108,7 +64250,7 @@ var QueueStore = class {
   traceId;
   logger;
   constructor(opts) {
-    this.file = path80.join(opts.dir, "queue.json");
+    this.file = path81.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
     this.logger = opts.logger;
@@ -64177,7 +64319,7 @@ var QueueStore = class {
     const t0 = Date.now();
     let raw;
     try {
-      const stat33 = await fsp31.stat(this.file);
+      const stat33 = await fsp32.stat(this.file);
       if (stat33.size > QUEUE_MAX_BYTES) {
         this.logWarn("Queue file exceeds the safe read budget; ignoring it", {
           event: "queue_store.read_budget_exceeded",
@@ -64197,7 +64339,7 @@ var QueueStore = class {
         });
         return [];
       }
-      raw = await fsp31.readFile(this.file, "utf8");
+      raw = await fsp32.readFile(this.file, "utf8");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
@@ -64284,7 +64426,7 @@ var QueueStore = class {
   async clear() {
     const t0 = Date.now();
     try {
-      await fsp31.unlink(this.file);
+      await fsp32.unlink(this.file);
       this.events?.emit("storage.write", {
         sessionId: this.traceId ?? "~boot~",
         store: "queue",
@@ -64324,9 +64466,9 @@ function isPersistedQueueItem(v) {
 // src/storage/recovery-lock.ts
 init_atomic_write();
 init_pid();
-import * as fsp32 from "node:fs/promises";
+import * as fsp33 from "node:fs/promises";
 import * as os10 from "node:os";
-import * as path81 from "node:path";
+import * as path82 from "node:path";
 var LOCK_FILE = "active.json";
 var DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var RecoveryLock = class {
@@ -64337,7 +64479,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path81.join(opts.dir, LOCK_FILE);
+    this.file = path82.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os10.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -64411,7 +64553,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path81.dirname(this.file));
+    await ensureDir(path82.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -64420,7 +64562,7 @@ var RecoveryLock = class {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     try {
-      await fsp32.writeFile(this.file, JSON.stringify(lock), { flag: "wx", mode: 384 });
+      await fsp33.writeFile(this.file, JSON.stringify(lock), { flag: "wx", mode: 384 });
     } catch (err) {
       const code = err.code;
       if (code === "EEXIST") {
@@ -64436,7 +64578,7 @@ var RecoveryLock = class {
    */
   async clear() {
     try {
-      await fsp32.unlink(this.file);
+      await fsp33.unlink(this.file);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return;
@@ -64446,7 +64588,7 @@ var RecoveryLock = class {
   async readLock() {
     let raw;
     try {
-      raw = await fsp32.readFile(this.file, "utf8");
+      raw = await fsp33.readFile(this.file, "utf8");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return null;
@@ -65058,12 +65200,12 @@ function renderPlainText(meta, events) {
 // src/storage/todos-checkpoint.ts
 init_atomic_write();
 init_error();
-import * as fsp33 from "node:fs/promises";
+import * as fsp34 from "node:fs/promises";
 async function loadTodosCheckpoint(filePath, events, traceId, sessionId) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp33.readFile(filePath, "utf8");
+    raw = await fsp34.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: sessionId ?? "~boot~",
@@ -70427,8 +70569,8 @@ var PHASE_EVENT_NAMES = [
 
 // src/goal/phase-store.ts
 init_atomic_write();
-import * as fsp34 from "node:fs/promises";
-import * as path82 from "node:path";
+import * as fsp35 from "node:fs/promises";
+import * as path83 from "node:path";
 var PHASE_STORE_VERSION = 1;
 var PhaseStore = class {
   baseDir;
@@ -70436,7 +70578,7 @@ var PhaseStore = class {
   constructor(opts) {
     this.baseDir = opts.baseDir;
     this.legacyBaseDirs = (opts.legacyBaseDirs ?? []).filter(
-      (dir) => path82.resolve(dir) !== path82.resolve(this.baseDir)
+      (dir) => path83.resolve(dir) !== path83.resolve(this.baseDir)
     );
   }
   async save(graph) {
@@ -70451,7 +70593,7 @@ var PhaseStore = class {
     const current = await this.loadFromPath(filePath);
     if (current) return current;
     for (const legacyDir of this.legacyBaseDirs) {
-      const legacyPath = path82.join(legacyDir, `${graphId}.json`);
+      const legacyPath = path83.join(legacyDir, `${graphId}.json`);
       const legacy = await this.loadFromPath(legacyPath);
       if (!legacy) continue;
       try {
@@ -70467,19 +70609,19 @@ var PhaseStore = class {
   async delete(graphId) {
     const paths = [
       this.getFilePath(graphId),
-      ...this.legacyBaseDirs.map((dir) => path82.join(dir, `${graphId}.json`))
+      ...this.legacyBaseDirs.map((dir) => path83.join(dir, `${graphId}.json`))
     ];
-    await Promise.all(paths.map((filePath) => fsp34.unlink(filePath).catch(() => void 0)));
+    await Promise.all(paths.map((filePath) => fsp35.unlink(filePath).catch(() => void 0)));
   }
   async list() {
     try {
       await this.migrateLegacyGraphs();
-      const entries = await fsp34.readdir(this.baseDir, { withFileTypes: true });
+      const entries = await fsp35.readdir(this.baseDir, { withFileTypes: true });
       const graphs = [];
       for (const entry of entries) {
         if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
         try {
-          const raw = await fsp34.readFile(path82.join(this.baseDir, entry.name), "utf8");
+          const raw = await fsp35.readFile(path83.join(this.baseDir, entry.name), "utf8");
           const serialized = JSON.parse(raw);
           const done = serialized.completedPhaseIds.length;
           const total = serialized.phases.length;
@@ -70498,11 +70640,11 @@ var PhaseStore = class {
     }
   }
   getFilePath(graphId) {
-    return path82.join(this.baseDir, `${graphId}.json`);
+    return path83.join(this.baseDir, `${graphId}.json`);
   }
   async loadFromPath(filePath) {
     try {
-      const raw = await fsp34.readFile(filePath, "utf8");
+      const raw = await fsp35.readFile(filePath, "utf8");
       const serialized = JSON.parse(raw);
       return this.deserializeGraph(serialized);
     } catch {
@@ -70511,11 +70653,11 @@ var PhaseStore = class {
   }
   async migrateLegacyGraphs() {
     for (const legacyDir of this.legacyBaseDirs) {
-      const entries = await fsp34.readdir(legacyDir, { withFileTypes: true }).catch(() => []);
+      const entries = await fsp35.readdir(legacyDir, { withFileTypes: true }).catch(() => []);
       for (const entry of entries) {
         if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-        const legacyPath = path82.join(legacyDir, entry.name);
-        const currentPath = this.getFilePath(path82.basename(entry.name, ".json"));
+        const legacyPath = path83.join(legacyDir, entry.name);
+        const currentPath = this.getFilePath(path83.basename(entry.name, ".json"));
         if (await this.pathExists(currentPath)) {
           await this.removeMigratedLegacyFile(legacyDir, legacyPath);
           continue;
@@ -70529,15 +70671,15 @@ var PhaseStore = class {
   }
   async pathExists(filePath) {
     try {
-      await fsp34.access(filePath);
+      await fsp35.access(filePath);
       return true;
     } catch {
       return false;
     }
   }
   async removeMigratedLegacyFile(legacyDir, legacyPath) {
-    await fsp34.unlink(legacyPath).catch(() => void 0);
-    await fsp34.rmdir(legacyDir).catch(() => void 0);
+    await fsp35.unlink(legacyPath).catch(() => void 0);
+    await fsp35.rmdir(legacyDir).catch(() => void 0);
   }
   serializeGraph(graph) {
     return {
@@ -70663,8 +70805,8 @@ var PhaseStore = class {
 
 // src/goal/checkpoint.ts
 init_atomic_write();
-import * as fsp35 from "node:fs/promises";
-import * as path83 from "node:path";
+import * as fsp36 from "node:fs/promises";
+import * as path84 from "node:path";
 var CheckpointManager = class {
   store;
   maxCheckpoints;
@@ -70675,10 +70817,10 @@ var CheckpointManager = class {
     this.store = opts.store;
     this.maxCheckpoints = opts.maxCheckpoints ?? 10;
     this.maxCheckpointAgeMs = opts.maxCheckpointAgeMs ?? 7 * 24 * 60 * 60 * 1e3;
-    this.baseDir = opts.baseDir ?? path83.join(opts.store.baseDir, ".checkpoints");
+    this.baseDir = opts.baseDir ?? path84.join(opts.store.baseDir, ".checkpoints");
   }
   async initialize() {
-    await fsp35.mkdir(this.baseDir, { recursive: true });
+    await fsp36.mkdir(this.baseDir, { recursive: true });
     await this.loadFromDisk();
   }
   async saveCheckpoint(graph, label) {
@@ -70741,14 +70883,14 @@ var CheckpointManager = class {
     return true;
   }
   async saveToDisk(checkpoint) {
-    const filePath = path83.join(this.baseDir, `${checkpoint.graphId}.json`);
+    const filePath = path84.join(this.baseDir, `${checkpoint.graphId}.json`);
     const serialized = {
       ...checkpoint
     };
     await withFileLock(filePath, async () => {
       let existing = [];
       try {
-        const raw = await fsp35.readFile(filePath, "utf8");
+        const raw = await fsp36.readFile(filePath, "utf8");
         const parsed = JSON.parse(raw);
         if (Array.isArray(parsed)) {
           existing = parsed;
@@ -70762,23 +70904,23 @@ var CheckpointManager = class {
   async deleteFromDisk(checkpointId) {
     let entries;
     try {
-      entries = await fsp35.readdir(this.baseDir);
+      entries = await fsp36.readdir(this.baseDir);
     } catch {
       return;
     }
     for (const filename of entries) {
       if (!filename.endsWith(".json")) continue;
-      const filePath = path83.join(this.baseDir, filename);
+      const filePath = path84.join(this.baseDir, filename);
       try {
         await withFileLock(filePath, async () => {
-          const raw = await fsp35.readFile(filePath, "utf8");
+          const raw = await fsp36.readFile(filePath, "utf8");
           const parsed = JSON.parse(raw);
           if (!Array.isArray(parsed)) return;
           const existing = parsed;
           const filtered = existing.filter((c) => c.id !== checkpointId);
           if (filtered.length !== existing.length) {
             if (filtered.length === 0) {
-              await fsp35.unlink(filePath);
+              await fsp36.unlink(filePath);
             } else {
               await atomicWrite(filePath, JSON.stringify(filtered, null, 2), { mode: 384 });
             }
@@ -70791,15 +70933,15 @@ var CheckpointManager = class {
   async loadFromDisk() {
     let entries;
     try {
-      entries = await fsp35.readdir(this.baseDir);
+      entries = await fsp36.readdir(this.baseDir);
     } catch {
       return;
     }
     for (const filename of entries) {
       if (!filename.endsWith(".json")) continue;
-      const filePath = path83.join(this.baseDir, filename);
+      const filePath = path84.join(this.baseDir, filename);
       try {
-        const raw = await fsp35.readFile(filePath, "utf8");
+        const raw = await fsp36.readFile(filePath, "utf8");
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) continue;
         const checkpoints = parsed;
@@ -71676,7 +71818,7 @@ function countShellHooks(hooks) {
 
 // src/hq/session-bridge.ts
 import * as fs38 from "node:fs";
-import * as fsp36 from "node:fs/promises";
+import * as fsp37 from "node:fs/promises";
 
 // src/types/session-markers.ts
 var SESSION_MARKER_EVENT_TYPES = /* @__PURE__ */ new Set([
@@ -72134,12 +72276,12 @@ function startSessionTelemetryBridge(opts) {
       if (disposed || tailing) return;
       tailing = true;
       try {
-        const stat33 = await fsp36.stat(sessionFile).catch(() => null);
+        const stat33 = await fsp37.stat(sessionFile).catch(() => null);
         if (disposed) return;
         if (!stat33) return;
         setupWatcher2();
         if (stat33.size <= offset) return;
-        const fd = await fsp36.open(sessionFile, "r");
+        const fd = await fsp37.open(sessionFile, "r");
         try {
           if (disposed) return;
           const len = stat33.size - offset;
@@ -72568,7 +72710,7 @@ function startCostTelemetryBridge(opts) {
 init_atomic_write();
 import { createHash as createHash29 } from "node:crypto";
 import * as fs39 from "node:fs/promises";
-import * as path84 from "node:path";
+import * as path85 from "node:path";
 
 // src/hq/write-queues.ts
 var BestEffortBatchQueue = class _BestEffortBatchQueue {
@@ -72663,7 +72805,7 @@ var HqKanbanStore = class {
   writers = /* @__PURE__ */ new Map();
   mergeChains = /* @__PURE__ */ new Map();
   constructor(dataDir) {
-    this.dirPath = path84.join(dataDir, "kanban");
+    this.dirPath = path85.join(dataDir, "kanban");
   }
   async load(projectId) {
     const cached2 = this.cache.get(projectId);
@@ -72771,7 +72913,7 @@ var HqKanbanStore = class {
   }
   filePath(projectId) {
     const safe = createHash29("sha256").update(projectId).digest("hex");
-    return path84.join(this.dirPath, `${safe}.json`);
+    return path85.join(this.dirPath, `${safe}.json`);
   }
 };
 function emptyKanbanSnapshot(projectId) {
@@ -72790,7 +72932,7 @@ function compareKanbanRecord(a, b) {
 init_file_permissions();
 init_atomic_write();
 import * as fs41 from "node:fs/promises";
-import * as path85 from "node:path";
+import * as path86 from "node:path";
 
 // src/hq/persistence/jsonl-io.ts
 import * as fs40 from "node:fs/promises";
@@ -73012,7 +73154,7 @@ var HqEventLog = class {
   counted = false;
   hydration;
   constructor(opts) {
-    this.filePath = path85.join(opts.dataDir, "events.jsonl");
+    this.filePath = path86.join(opts.dataDir, "events.jsonl");
     this.maxLines = opts.maxLines ?? DEFAULT_EVENT_LOG_MAX_LINES;
     this.rotateKeep = opts.rotateKeep ?? DEFAULT_EVENT_LOG_ROTATE_KEEP;
     this.maxBytes = opts.maxBytes ?? DEFAULT_EVENT_LOG_MAX_BYTES;
@@ -73238,7 +73380,7 @@ async function readRecentEvents(filePath, limit, typeFilter) {
 // src/hq/persistence/simple-log.ts
 init_atomic_write();
 import * as fs42 from "node:fs/promises";
-import * as path86 from "node:path";
+import * as path87 from "node:path";
 var HqSimpleLog = class {
   filePath;
   maxLines;
@@ -73249,7 +73391,7 @@ var HqSimpleLog = class {
   counted = false;
   hydration;
   constructor(opts) {
-    this.filePath = path86.join(opts.dataDir, opts.filename);
+    this.filePath = path87.join(opts.dataDir, opts.filename);
     this.maxLines = opts.maxLines ?? Infinity;
     this.rotateKeep = opts.rotateKeep ?? this.maxLines;
     this.readLimit = opts.readLimit ?? Infinity;
@@ -73320,12 +73462,12 @@ var HqSimpleLog = class {
 // src/hq/persistence/snapshot-store.ts
 init_atomic_write();
 import * as fs43 from "node:fs/promises";
-import * as path87 from "node:path";
+import * as path88 from "node:path";
 var HqSnapshotStore = class {
   filePath;
   writer;
   constructor(opts) {
-    this.filePath = path87.join(opts.dataDir, "snapshot.json");
+    this.filePath = path88.join(opts.dataDir, "snapshot.json");
     this.writer = new BestEffortLatestQueue(
       (snapshot) => atomicWrite(this.filePath, JSON.stringify(snapshot), { mode: 384 })
     );
@@ -73353,7 +73495,7 @@ var HqSnapshotStore = class {
 init_file_permissions();
 init_atomic_write();
 import * as fs44 from "node:fs/promises";
-import * as path88 from "node:path";
+import * as path89 from "node:path";
 var HqTimeseriesStore = class {
   filePath;
   bucketMs;
@@ -73366,7 +73508,7 @@ var HqTimeseriesStore = class {
   loaded = false;
   loadPromise;
   constructor(opts) {
-    this.filePath = path88.join(opts.dataDir, "timeseries.jsonl");
+    this.filePath = path89.join(opts.dataDir, "timeseries.jsonl");
     this.bucketMs = opts.bucketMs ?? 5 * 60 * 1e3;
     this.maxBuckets = opts.maxBuckets ?? 2016;
     this.writer = new BestEffortLatestQueue((snapshot) => this.flushInternal(snapshot));
@@ -75571,8 +75713,8 @@ function definePlugin(metadata, factory) {
 // src/plugins/auto-review-plugin.ts
 import { spawn as spawn9 } from "node:child_process";
 import { createHash as createHash31 } from "node:crypto";
-import * as fsp37 from "node:fs/promises";
-import * as path89 from "node:path";
+import * as fsp38 from "node:fs/promises";
+import * as path90 from "node:path";
 init_error();
 
 // src/plugins/review-claim-registry.ts
@@ -75864,7 +76006,7 @@ function trimKnownFingerprints(map, max) {
     map.delete(oldest);
   }
 }
-function buildReviewerModelPool(provider, model, fallbackModels = []) {
+function buildReviewerModelPool(provider, model, fallbackModels = [], statusTracker) {
   const primaryProvider = provider.trim();
   const primaryModel = model.trim();
   const primaryRef = primaryProvider && primaryModel ? `${primaryProvider}/${primaryModel}` : "";
@@ -75879,12 +76021,20 @@ function buildReviewerModelPool(provider, model, fallbackModels = []) {
     if (seen.has(normalized)) continue;
     seen.add(ref);
     seen.add(normalized);
+    if (statusTracker && !statusTracker.isAvailable(parsed.provider.trim(), parsed.model.trim())) {
+      continue;
+    }
     pool.push(normalized);
   }
   return pool;
 }
-function selectRoundRobinReviewerAssignment(pool, cursor, fallbackProvider = "", fallbackModel = "") {
-  if (pool.length === 0) {
+function selectRoundRobinReviewerAssignment(pool, cursor, fallbackProvider = "", fallbackModel = "", statusTracker) {
+  const filteredPool = statusTracker ? pool.filter((ref) => {
+    const parsed2 = parseModelRef(ref);
+    if (!parsed2.provider?.trim() || !parsed2.model.trim()) return false;
+    return statusTracker.isAvailable(parsed2.provider.trim(), parsed2.model.trim());
+  }) : pool;
+  if (filteredPool.length === 0) {
     return {
       provider: fallbackProvider,
       model: fallbackModel,
@@ -75892,13 +76042,13 @@ function selectRoundRobinReviewerAssignment(pool, cursor, fallbackProvider = "",
       nextCursor: cursor + 1
     };
   }
-  const len = pool.length;
+  const len = filteredPool.length;
   const idx = (cursor % len + len) % len;
-  const primaryRef = pool[idx];
+  const primaryRef = filteredPool[idx];
   const parsed = parseModelRef(primaryRef);
   const provider = parsed.provider?.trim() || fallbackProvider;
   const model = parsed.model.trim() || fallbackModel;
-  const fallbackModels = [...pool.slice(idx + 1), ...pool.slice(0, idx)];
+  const fallbackModels = [...filteredPool.slice(idx + 1), ...filteredPool.slice(0, idx)];
   return {
     provider,
     model,
@@ -75940,57 +76090,49 @@ function parseReviewSeverity(text2) {
   const result = { critical: 0, high: 0, medium: 0 };
   if (!text2) return result;
   for (const level of ["critical", "high", "medium"]) {
-    const countRe = new RegExp(`###\\s*${level}\\s*\\((\\d+)\\)`, "i");
-    const countMatch = text2.match(countRe);
+    const countMatch = text2.match(new RegExp(`###\\s*${level}\\s*\\((\\d+)\\)`, "i"));
     if (countMatch?.[1]) {
       result[level] = Number.parseInt(countMatch[1], 10);
       continue;
     }
-    const sectionRe = new RegExp(`###\\s*${level}[^\\n]*\\n([\\s\\S]*?)(?=###|$)`, "i");
-    const sectionMatch = text2.match(sectionRe);
-    if (sectionMatch?.[1]) {
-      const items = sectionMatch[1].match(/^\s*\d+\.\s/gm);
-      result[level] = items ? items.length : 0;
-    }
+    const section = text2.match(
+      new RegExp(`###\\s*${level}[^\\n]*\\n([\\s\\S]*?)(?=###|$)`, "i")
+    )?.[1];
+    result[level] = section?.match(/^\s*\d+\.\s/gm)?.length ?? 0;
   }
   return result;
 }
-var SECURITY_KEYWORDS = [
-  "injection",
-  "xss",
-  "csrf",
-  "ssrf",
-  "sql",
-  "secret",
-  "credential",
-  "password",
-  "api key",
-  "token",
-  "auth",
-  "shell injection",
-  "command injection",
-  "innerhtml",
-  "deserialization",
-  "path traversal",
-  "hardcoded",
-  "privilege",
-  "owasp"
-];
 function decideCascadeAgents(text2, severities) {
   const agents = /* @__PURE__ */ new Set();
-  if (severities.critical > 0 || severities.high > 0) {
-    agents.add("bug-hunter");
-  }
-  const lower = text2.toLowerCase();
-  const criticalHighRe = /###\s*(?:critical|high)[^\n]*\n([\s\S]*?)(?=###|$)/gi;
-  let section = criticalHighRe.exec(lower);
-  while (section !== null) {
+  if (severities.critical > 0 || severities.high > 0) agents.add("bug-hunter");
+  const securityKeywords = [
+    "injection",
+    "xss",
+    "csrf",
+    "ssrf",
+    "sql",
+    "secret",
+    "credential",
+    "password",
+    "api key",
+    "token",
+    "auth",
+    "shell injection",
+    "command injection",
+    "innerhtml",
+    "deserialization",
+    "path traversal",
+    "hardcoded",
+    "privilege",
+    "owasp"
+  ];
+  const criticalHighSections = text2.toLowerCase().matchAll(/###\s*(?:critical|high)[^\n]*\n([\s\S]*?)(?=###|$)/gi);
+  for (const section of criticalHighSections) {
     const body = section[1] ?? "";
-    if (SECURITY_KEYWORDS.some((kw) => body.includes(kw))) {
+    if (securityKeywords.some((keyword) => body.includes(keyword))) {
       agents.add("security-scanner");
       break;
     }
-    section = criticalHighRe.exec(lower);
   }
   return [...agents];
 }
@@ -76057,9 +76199,9 @@ async function snapshotChangedFiles(cwd) {
     if (file.path.startsWith(".wrongstack/")) continue;
     if (budget <= 0) break;
     try {
-      const stat33 = await fsp37.stat(path89.join(cwd, file.path));
+      const stat33 = await fsp38.stat(path90.join(cwd, file.path));
       if (!stat33.isFile() || stat33.size > MAX_SNAPSHOT_FILE_BYTES) continue;
-      const content = await fsp37.readFile(path89.join(cwd, file.path), "utf8");
+      const content = await fsp38.readFile(path90.join(cwd, file.path), "utf8");
       budget -= content.length;
       snapshots.push({
         ...file,
@@ -76083,9 +76225,8 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
       "Detects git-tracked file edits and dispatches review subagents",
       "with configurable provider/model/fallback.",
       "",
-      "When a review report contains findings at or above the cascadeOn",
-      "threshold, follow-up agents (security-scanner, bug-hunter) are",
-      "automatically spawned to investigate.",
+      "Reports are persisted and shown as passive notifications.",
+      "They never wake the leader or spawn mutating follow-up agents.",
       "",
       "Commands:",
       "  /auto-review           Show current status and config",
@@ -76100,11 +76241,8 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
       "  debounceMs           debounce window (default 15000)",
       "  maxFilesPerBatch     max files per review (default 15)",
       "  maxConcurrentReviews max parallel reviews (default 2)",
-      '  cascadeOn            "off" | "critical" | "high" (default off)',
-      "                       Spawns security-scanner/bug-hunter when",
-      '                       findings reach this severity. "high" fires',
-      '                       on any High+ finding; "critical" only on Critical.',
-      "  maxCascadeDepth      max fix+re-review cycles (default 2, 0=off)"
+      "  cascadeOn            off | critical | high (default off)",
+      "  maxCascadeDepth      max fix+re-review cycles (default 2)"
     ].join("\n"),
     async run(args) {
       const cfg = getConfig();
@@ -76120,7 +76258,6 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
         };
       }
       const inFlight = getInFlightCount();
-      const cascadeDesc = cfg.cascadeOn === "off" ? "disabled" : `on ${cfg.cascadeOn}+ \u2192 spawns security-scanner/bug-hunter`;
       return {
         message: [
           `\u{1F4CB} Auto Review \u2014 ${cfg.enabled ? "\u2705 enabled" : "\u23F8\uFE0F  disabled"}`,
@@ -76131,7 +76268,7 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
           `  Debounce:       ${cfg.debounceMs} ms`,
           `  Max files:      ${cfg.maxFilesPerBatch}`,
           `  Max parallel:   ${cfg.maxConcurrentReviews}`,
-          `  Cascade:        ${cascadeDesc}`,
+          `  Cascade:        ${cfg.cascadeOn === "off" ? "off" : `on ${cfg.cascadeOn}+ \u2192 spawns security-scanner/bug-hunter`}`,
           `  Max depth:      ${cfg.maxCascadeDepth} re-review cycle(s)`,
           `  In-flight:      ${inFlight} review(s)`,
           "",
@@ -76409,7 +76546,7 @@ function createAutoReviewPlugin() {
           for (const f of allChanged) {
             if (f.path.startsWith(".wrongstack/")) continue;
             try {
-              await fsp37.access(path89.join(cwd, f.path));
+              await fsp38.access(path90.join(cwd, f.path));
               existing.push(f);
             } catch {
             }
@@ -76419,8 +76556,8 @@ function createAutoReviewPlugin() {
           const filesWithContent = [];
           for (const f of toReview) {
             try {
-              const absPath = path89.join(cwd, f.path);
-              const content = await fsp37.readFile(absPath, "utf8");
+              const absPath = path90.join(cwd, f.path);
+              const content = await fsp38.readFile(absPath, "utf8");
               filesWithContent.push({ path: f.path, status: f.status, content });
             } catch {
             }
@@ -76526,7 +76663,7 @@ init_review_finding_store();
 
 // src/plugins/review-finding-parser.ts
 init_review_finding_types();
-import { randomUUID as randomUUID36 } from "node:crypto";
+import { randomUUID as randomUUID37 } from "node:crypto";
 var SUGGEST_LINE = /^\s*(?:→|->|=>)\s*(.+)$/;
 var DURATION_LINE = /^Duration:\s*(\d+)s\s*$/im;
 function parseChimeraReviewReport(reportText, context = {}) {
@@ -76534,7 +76671,7 @@ function parseChimeraReviewReport(reportText, context = {}) {
     return { findings: [], unparseableCount: 0 };
   }
   const findings = [];
-  const reportId = context.reportId ?? randomUUID36();
+  const reportId = context.reportId ?? randomUUID37();
   let unparseableCount = 0;
   let durationSeconds;
   let currentSeverity = null;
@@ -76635,7 +76772,7 @@ function parseFindingSegment(segment, severity, context) {
   const fullDesc = suggestions.length > 0 ? cleanDesc + "\n" + suggestions.map((s) => "  \u2192 " + s).join("\n") : cleanDesc;
   const suggestedFix = suggestions.length > 0 ? suggestions.join("\n") : void 0;
   return {
-    id: randomUUID36(),
+    id: randomUUID37(),
     fingerprint: computeFindingFingerprint(file ?? "", line ?? null, title),
     severity,
     source: normalizeFindingSource(context.reviewType),
@@ -76646,7 +76783,7 @@ function parseFindingSegment(segment, severity, context) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     status: "active",
     originReport: {
-      reportId: context.reportId ?? randomUUID36(),
+      reportId: context.reportId ?? randomUUID37(),
       sessionId: context.sessionId ?? "",
       agentId: context.agentId ?? "",
       reviewerModel: context.reviewerModel ?? ""
@@ -77439,7 +77576,9 @@ function createChimeraPlugin() {
             api.log.info("[chimera] skipped \u2014 changed files already have reviews in progress");
             return;
           }
-          api.log.info(`[chimera] emitted review_needed event (${emittedBundle.files.length} files)`);
+          api.log.info(
+            `[chimera] emitted review_needed event (${emittedBundle.files.length} files)`
+          );
         } catch (err) {
           api.log.warn(`[chimera] session.ended handler failed: ${toErrorMessage(err)}`);
         }
@@ -87978,6 +88117,7 @@ export {
   ReplayLogStore,
   ReplayProviderRunner,
   RunController,
+  SAGE_INJECTOR_HEADINGS,
   SECURITY_SCANNER_AGENT,
   SEMANTIC_TUNE_KNOBS,
   SESSION_MARKER_EVENT_TYPES,
@@ -88107,6 +88247,7 @@ export {
   buildWin32CmdShimInvocation,
   canCaptureNewLearned,
   canonicalProjectRoot,
+  capSageLines,
   captureLearnedFromAgentOutput,
   captureLearnedFromAgentOutputDetailed,
   checkConnectivity,
@@ -88688,6 +88829,7 @@ export {
   slugify2 as slugify,
   slugifyProjectAgentRole,
   smartDefaultFallbackChain,
+  splitSageOutputBlock,
   sqliteCachePragmas,
   sshManagerServer,
   stableStringify3 as stableStringify,