@wrongstack/core 0.3.1 → 0.3.2

package/dist/defaults/index.js

@@ -1,4 +1,4 @@
-import * as fs4 from 'fs';
+import * as fs5 from 'fs';
 import * as path3 from 'path';
 import * as crypto2 from 'crypto';
 import { randomBytes, randomUUID, createCipheriv, createDecipheriv } from 'crypto';
@@ -62,7 +62,7 @@ var DefaultLogger = class _DefaultLogger {
     this.pretty = opts.pretty ?? true;
     if (this.file) {
       try {
-        fs4.mkdirSync(path3.dirname(this.file), { recursive: true });
+        fs5.mkdirSync(path3.dirname(this.file), { recursive: true });
       } catch {
       }
     }
@@ -101,7 +101,7 @@ var DefaultLogger = class _DefaultLogger {
     }
     if (this.file) {
       try {
-        fs4.appendFileSync(this.file, `${JSON.stringify(entry)}
+        fs5.appendFileSync(this.file, `${JSON.stringify(entry)}
 `);
       } catch {
       }
@@ -192,6 +192,98 @@ async function renameWithRetry(from, to) {
   throw lastErr;
 }
 
+// src/utils/message-invariants.ts
+function repairToolUseAdjacency(messages) {
+  const removedToolUses = [];
+  const removedToolResults = [];
+  let removedMessages = 0;
+  let changed = false;
+  const out = [];
+  for (let i = 0; i < messages.length; i++) {
+    const original = messages[i];
+    let msg = original;
+    if (hasToolUse(msg)) {
+      const nextIds = toolResultIds(messages[i + 1]);
+      const filtered = mapContent(msg, (blocks) => {
+        const next = [];
+        for (const block of blocks) {
+          if (block.type === "tool_use" && !nextIds.has(block.id)) {
+            removedToolUses.push(block.id);
+            changed = true;
+            continue;
+          }
+          next.push(block);
+        }
+        return next;
+      });
+      msg = filtered ?? msg;
+    }
+    if (hasToolResult(msg)) {
+      const allowed = toolUseIds(out[out.length - 1]);
+      const filtered = mapContent(msg, (blocks) => {
+        const next = [];
+        for (const block of blocks) {
+          if (block.type === "tool_result" && !allowed.has(block.tool_use_id)) {
+            removedToolResults.push(block.tool_use_id);
+            changed = true;
+            continue;
+          }
+          next.push(block);
+        }
+        return next;
+      });
+      msg = filtered ?? msg;
+    }
+    if (isEmptyMessage(msg)) {
+      removedMessages++;
+      changed = true;
+      continue;
+    }
+    out.push(msg);
+  }
+  return {
+    messages: changed ? out : messages,
+    report: { changed, removedToolUses, removedToolResults, removedMessages }
+  };
+}
+function hasToolUse(msg) {
+  return contentBlocks(msg).some((b) => b.type === "tool_use");
+}
+function hasToolResult(msg) {
+  return contentBlocks(msg).some((b) => b.type === "tool_result");
+}
+function toolUseIds(msg) {
+  const ids = /* @__PURE__ */ new Set();
+  if (!msg || msg.role !== "assistant") return ids;
+  for (const block of contentBlocks(msg)) {
+    if (block.type === "tool_use") ids.add(block.id);
+  }
+  return ids;
+}
+function toolResultIds(msg) {
+  const ids = /* @__PURE__ */ new Set();
+  if (!msg || msg.role !== "user") return ids;
+  for (const block of contentBlocks(msg)) {
+    if (block.type === "tool_result") ids.add(block.tool_use_id);
+  }
+  return ids;
+}
+function contentBlocks(msg) {
+  return msg && Array.isArray(msg.content) ? msg.content : [];
+}
+function mapContent(msg, fn) {
+  if (!Array.isArray(msg.content)) return msg;
+  const next = fn(msg.content);
+  if (next.length === msg.content.length && next.every((b, idx) => b === msg.content[idx])) {
+    return msg;
+  }
+  return { ...msg, content: next };
+}
+function isEmptyMessage(msg) {
+  if (typeof msg.content === "string") return msg.content.trim().length === 0;
+  return msg.content.length === 0;
+}
+
 // src/storage/session-store.ts
 var DefaultSessionStore = class {
   dir;
@@ -394,11 +486,17 @@ var DefaultSessionStore = class {
     if (openToolUses.size > 0) {
       this.events?.emit("session.damaged", {
         sessionId,
-        detail: `${openToolUses.size} tool_use blocks without matching results \u2014 replay truncated`
+        detail: `${openToolUses.size} tool_use blocks without matching results - replay repaired`
+      });
+    }
+    const repaired = repairToolUseAdjacency(messages);
+    if (repaired.report.changed) {
+      this.events?.emit("session.damaged", {
+        sessionId,
+        detail: `Repaired replay adjacency: removed ${repaired.report.removedToolUses.length} tool_use, ${repaired.report.removedToolResults.length} tool_result, ${repaired.report.removedMessages} empty messages`
       });
-      return { messages, usage };
     }
-    return { messages, usage };
+    return { messages: repaired.messages, usage };
   }
 };
 var FileSessionWriter = class {
@@ -424,6 +522,7 @@ var FileSessionWriter = class {
   startedAt;
   meta;
   closed = false;
+  closing = false;
   manifestFile;
   summary;
   tokenIn = 0;
@@ -439,9 +538,7 @@ var FileSessionWriter = class {
   resumed;
   appendFailCount = 0;
   lastAppendWarnAt = 0;
-  async writeSessionStart() {
-    if (this.initDone || this.closed) return;
-    this.initDone = true;
+  async writeSessionStartLazy() {
     const record = `${JSON.stringify({
       type: this.resumed ? "session_resumed" : "session_start",
       ts: this.startedAt,
@@ -460,7 +557,8 @@ var FileSessionWriter = class {
   async append(event) {
     if (this.closed) return;
     if (!this.initDone) {
-      await this.writeSessionStart();
+      this.initDone = true;
+      await this.writeSessionStartLazy();
     }
     this.observeForSummary(event);
     try {
@@ -501,7 +599,8 @@ var FileSessionWriter = class {
     }
   }
   async close() {
-    if (this.closed) return;
+    if (this.closing) return;
+    this.closing = true;
     this.closed = true;
     if (this.manifestFile) {
       try {
@@ -904,80 +1003,7 @@ function deepFreeze(obj) {
   return Object.freeze(obj);
 }
 
-// src/types/secret-vault.ts
-var ENCRYPTED_PREFIX = "enc:v1:";
-
-// src/security/secret-vault.ts
-var KEY_BYTES = 32;
-var IV_BYTES = 12;
-var TAG_BYTES = 16;
-var ALGO = "aes-256-gcm";
-var DefaultSecretVault = class {
-  keyFile;
-  key;
-  constructor(opts) {
-    this.keyFile = opts.keyFile;
-  }
-  isEncrypted(value) {
-    return typeof value === "string" && value.startsWith(ENCRYPTED_PREFIX);
-  }
-  encrypt(plaintext) {
-    if (this.isEncrypted(plaintext)) return plaintext;
-    const key = this.loadOrCreateKey();
-    const iv = randomBytes(IV_BYTES);
-    const cipher = createCipheriv(ALGO, key, iv);
-    const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
-  }
-  decrypt(value) {
-    if (!this.isEncrypted(value)) return value;
-    const rest = value.slice(ENCRYPTED_PREFIX.length);
-    const parts = rest.split(":");
-    if (parts.length !== 3) {
-      throw new Error("SecretVault: malformed encrypted value");
-    }
-    const [ivB64, tagB64, ctB64] = parts;
-    const iv = Buffer.from(ivB64, "base64");
-    const tag = Buffer.from(tagB64, "base64");
-    const ct = Buffer.from(ctB64, "base64");
-    if (iv.length !== IV_BYTES) throw new Error("SecretVault: bad IV length");
-    if (tag.length !== TAG_BYTES) throw new Error("SecretVault: bad tag length");
-    const key = this.loadOrCreateKey();
-    const decipher = createDecipheriv(ALGO, key, iv);
-    decipher.setAuthTag(tag);
-    const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
-    return pt.toString("utf8");
-  }
-  loadOrCreateKey() {
-    if (this.key) return this.key;
-    try {
-      const buf = fs4.readFileSync(this.keyFile);
-      if (buf.length !== KEY_BYTES) {
-        throw new Error(`SecretVault: key file ${this.keyFile} has wrong size`);
-      }
-      this.key = buf;
-      return this.key;
-    } catch (err) {
-      if (err.code !== "ENOENT") throw err;
-    }
-    fs4.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
-    const key = randomBytes(KEY_BYTES);
-    try {
-      fs4.writeFileSync(this.keyFile, key, { mode: 384, flag: "wx" });
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-      const buf = fs4.readFileSync(this.keyFile);
-      if (buf.length !== KEY_BYTES) {
-        throw new Error(`SecretVault: key file ${this.keyFile} has wrong size`);
-      }
-      this.key = buf;
-      return this.key;
-    }
-    this.key = key;
-    return key;
-  }
-};
+// src/security/config-secrets.ts
 function decryptConfigSecrets(cfg, vault) {
   return walk(cfg, vault, (v, key) => {
     try {
@@ -991,9 +1017,6 @@ function decryptConfigSecrets(cfg, vault) {
     }
   });
 }
-function encryptConfigSecrets(cfg, vault) {
-  return walk(cfg, vault, (v) => vault.encrypt(v));
-}
 function walk(node, vault, transform) {
   if (node === null || node === void 0) return node;
   if (typeof node !== "object") return node;
@@ -1019,77 +1042,56 @@ function isSecretField(name) {
   if (NON_SECRET_OVERRIDES.has(lc)) return false;
   return SECRET_KEY_PATTERN.test(lc);
 }
-async function rewriteConfigEncrypted(configPath, vault, patch) {
-  let current = {};
-  try {
-    const raw = await fsp.readFile(configPath, "utf8");
-    current = JSON.parse(raw);
-  } catch {
-  }
-  const merged = deepMerge(current, patch ?? {});
-  const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp.mkdir(path3.dirname(configPath), { recursive: true });
-  await fsp.writeFile(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
-  try {
-    await fsp.chmod(configPath, 384);
-  } catch {
-  }
-}
-async function migratePlaintextSecrets(configPath, vault) {
-  let raw;
-  try {
-    raw = await fsp.readFile(configPath, "utf8");
-  } catch {
-    return { migrated: 0, file: configPath };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return { migrated: 0, file: configPath };
-  }
-  const counter = { n: 0 };
-  const migrated = walkCount(parsed, vault, counter);
-  if (counter.n === 0) return { migrated: 0, file: configPath };
-  await fsp.writeFile(configPath, JSON.stringify(migrated, null, 2), { mode: 384 });
-  try {
-    await fsp.chmod(configPath, 384);
-  } catch {
-  }
-  return { migrated: counter.n, file: configPath };
-}
-function walkCount(node, vault, counter) {
-  if (node === null || node === void 0) return node;
-  if (typeof node !== "object") return node;
-  if (Array.isArray(node)) {
-    return node.map((item) => walkCount(item, vault, counter));
-  }
-  const out = {};
-  for (const [k, v] of Object.entries(node)) {
-    if (typeof v === "string" && isSecretField(k) && !vault.isEncrypted(v) && v.length > 0) {
-      out[k] = vault.encrypt(v);
-      counter.n++;
-    } else if (typeof v === "object" && v !== null) {
-      out[k] = walkCount(v, vault, counter);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function deepMerge(a, b) {
-  const out = { ...a };
-  for (const [k, v] of Object.entries(b)) {
-    if (FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
+
+// src/types/context-window.ts
+var DEFAULT_CONTEXT_WINDOW_MODE_ID = "balanced";
+var CONTEXT_WINDOW_MODES = Object.freeze([
+  {
+    id: "balanced",
+    name: "Balanced",
+    description: "Default rolling compaction: recent work stays verbatim, old tool output is trimmed.",
+    thresholds: { warn: 0.6, soft: 0.75, hard: 0.9 },
+    aggressiveOn: "soft",
+    preserveK: 10,
+    eliseThreshold: 2e3,
+    targetLoad: 0.65
+  },
+  {
+    id: "frugal",
+    name: "Frugal",
+    description: "Token-saver mode: compacts early and keeps a tighter verbatim tail.",
+    thresholds: { warn: 0.45, soft: 0.6, hard: 0.75 },
+    aggressiveOn: "warn",
+    preserveK: 6,
+    eliseThreshold: 700,
+    targetLoad: 0.5
+  },
+  {
+    id: "deep",
+    name: "Deep",
+    description: "Long-reasoning mode: delays compaction and keeps more recent turns intact.",
+    thresholds: { warn: 0.72, soft: 0.86, hard: 0.96 },
+    aggressiveOn: "hard",
+    preserveK: 18,
+    eliseThreshold: 5e3,
+    targetLoad: 0.78
+  },
+  {
+    id: "archival",
+    name: "Archival",
+    description: "Decision-preserving mode: compacts steadily while keeping summaries prominent.",
+    thresholds: { warn: 0.55, soft: 0.7, hard: 0.84 },
+    aggressiveOn: "soft",
+    preserveK: 8,
+    eliseThreshold: 1200,
+    targetLoad: 0.58
+  }
+]);
+function listContextWindowModes() {
+  return CONTEXT_WINDOW_MODES.map((m) => ({ ...m, thresholds: { ...m.thresholds } }));
+}
+function isContextWindowModeId(id) {
+  return CONTEXT_WINDOW_MODES.some((m) => m.id === id);
 }
 
 // src/utils/safe-json.ts
@@ -1111,6 +1113,7 @@ function safeParse(input, maxBytes = 5e6) {
 var BEHAVIOR_DEFAULTS = {
   version: 1,
   context: {
+    mode: DEFAULT_CONTEXT_WINDOW_MODE_ID,
     warnThreshold: 0.6,
     softThreshold: 0.75,
     hardThreshold: 0.9,
@@ -1156,13 +1159,13 @@ var ENV_MAP = {
 function isPrimitiveArray(a) {
   return a.every((v) => v === null || typeof v !== "object");
 }
-var FORBIDDEN_PROTO_KEYS2 = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function deepMerge2(base, patch) {
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function deepMerge(base, patch) {
   if (typeof base !== "object" || base === null) return patch ?? base;
   if (typeof patch !== "object" || patch === null) return base;
   const out = { ...base };
   for (const [k, v] of Object.entries(patch)) {
-    if (FORBIDDEN_PROTO_KEYS2.has(k)) continue;
+    if (FORBIDDEN_PROTO_KEYS.has(k)) continue;
     const existing = out[k];
     if (Array.isArray(v)) {
       if (Array.isArray(existing) && isPrimitiveArray(v) && isPrimitiveArray(existing)) {
@@ -1176,7 +1179,7 @@ function deepMerge2(base, patch) {
         }
       }
     } else if (typeof v === "object" && v !== null && typeof existing === "object" && existing !== null) {
-      out[k] = deepMerge2(existing, v);
+      out[k] = deepMerge(existing, v);
     } else if (v !== void 0) {
       out[k] = v;
     }
@@ -1200,8 +1203,8 @@ var DefaultConfigLoader = class {
       this.readJson(this.paths.globalConfig),
       this.readJson(this.paths.projectLocalConfig)
     ]);
-    cfg = deepMerge2(cfg, global);
-    cfg = deepMerge2(cfg, local);
+    cfg = deepMerge(cfg, global);
+    cfg = deepMerge(cfg, local);
     for (const [key, fn] of Object.entries(ENV_MAP)) {
       const v = process.env[key];
       if (v) fn(cfg, v);
@@ -1215,14 +1218,14 @@ var DefaultConfigLoader = class {
       try {
         const patch = await src.read();
         if (patch && Object.keys(patch).length > 0) {
-          cfg = deepMerge2(cfg, patch);
+          cfg = deepMerge(cfg, patch);
         }
       } catch (err) {
         console.warn(`Config source "${src.name}" failed`, err);
       }
     }
     if (opts.cliFlags) {
-      cfg = deepMerge2(cfg, opts.cliFlags);
+      cfg = deepMerge(cfg, opts.cliFlags);
     }
     if (this.vault) {
       cfg = decryptConfigSecrets(cfg, this.vault);
@@ -1285,6 +1288,10 @@ var DefaultConfigLoader = class {
     if (c.warnThreshold >= c.softThreshold || c.softThreshold >= c.hardThreshold) {
       throw new Error("Config: context thresholds must satisfy warn < soft < hard");
     }
+    if (c.mode !== void 0 && !isContextWindowModeId(c.mode)) {
+      const known = listContextWindowModes().map((m) => m.id).join(", ");
+      throw new Error(`Config: context.mode must be one of: ${known}`);
+    }
   }
   validateIdentity(cfg) {
     if (!cfg.provider) {
@@ -1861,24 +1868,35 @@ async function saveTodosCheckpoint(filePath, sessionId, todos) {
 function attachTodosCheckpoint(state, filePath, sessionId) {
   let timer = null;
   let pending = null;
+  let writeChain = Promise.resolve();
+  const enqueueWrite = (todos) => {
+    writeChain = writeChain.then(() => saveTodosCheckpoint(filePath, sessionId, todos));
+    return writeChain;
+  };
   const flush = () => {
     timer = null;
     if (pending) {
-      void saveTodosCheckpoint(filePath, sessionId, pending);
+      const todos = pending;
       pending = null;
+      return enqueueWrite(todos);
     }
+    return writeChain;
   };
   const unsubscribe = state.onChange((change) => {
     if (change.kind !== "todos_replaced") return;
     pending = change.todos;
     if (timer) clearTimeout(timer);
-    timer = setTimeout(flush, 150);
+    timer = setTimeout(() => {
+      void flush();
+    }, 150);
   });
-  return () => {
+  return async () => {
     unsubscribe();
     if (timer) {
       clearTimeout(timer);
-      flush();
+      await flush();
+    } else {
+      await writeChain;
     }
   };
 }
@@ -2134,56 +2152,244 @@ var PATTERNS = [
     // Value-side word boundary + length gate to avoid matching short random strings
     regex: /\b([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,})['"]?(?!\s*[A-Za-z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))/g
   }
-];
-var SCRUB_CHUNK_BYTES = 64 * 1024;
-var DefaultSecretScrubber = class {
-  scrub(text) {
-    if (!text) return text;
-    if (text.length <= SCRUB_CHUNK_BYTES) {
-      return this.scrubOne(text);
-    }
-    const out = [];
-    let i = 0;
-    while (i < text.length) {
-      let end = Math.min(i + SCRUB_CHUNK_BYTES, text.length);
-      if (end < text.length) {
-        const nl = text.lastIndexOf("\n", end);
-        if (nl > i + SCRUB_CHUNK_BYTES / 2) end = nl + 1;
-      }
-      out.push(this.scrubOne(text.slice(i, end)));
-      i = end;
-    }
-    return out.join("");
+];
+var SCRUB_CHUNK_BYTES = 64 * 1024;
+var DefaultSecretScrubber = class {
+  scrub(text) {
+    if (!text) return text;
+    if (text.length <= SCRUB_CHUNK_BYTES) {
+      return this.scrubOne(text);
+    }
+    const out = [];
+    let i = 0;
+    while (i < text.length) {
+      let end = Math.min(i + SCRUB_CHUNK_BYTES, text.length);
+      if (end < text.length) {
+        const nl = text.lastIndexOf("\n", end);
+        if (nl > i + SCRUB_CHUNK_BYTES / 2) end = nl + 1;
+      }
+      out.push(this.scrubOne(text.slice(i, end)));
+      i = end;
+    }
+    return out.join("");
+  }
+  scrubOne(text) {
+    let out = text;
+    for (const p of PATTERNS) {
+      out = out.replace(p.regex, (_match, group1, group2) => {
+        if (p.type === "high_entropy_env" && group1 && group2) {
+          return `${group1}=[REDACTED:${p.type}]`;
+        }
+        return `[REDACTED:${p.type}]`;
+      });
+    }
+    return out;
+  }
+  scrubObject(obj) {
+    const seen = /* @__PURE__ */ new WeakSet();
+    const visit = (v) => {
+      if (typeof v === "string") return this.scrub(v);
+      if (v === null || typeof v !== "object") return v;
+      if (seen.has(v)) return v;
+      seen.add(v);
+      if (Array.isArray(v)) return v.map(visit);
+      const out = {};
+      for (const [k, val] of Object.entries(v)) {
+        out[k] = visit(val);
+      }
+      return out;
+    };
+    return visit(obj);
+  }
+};
+
+// src/types/secret-vault.ts
+var ENCRYPTED_PREFIX = "enc:v1:";
+
+// src/security/secret-vault.ts
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+var ALGO = "aes-256-gcm";
+var DefaultSecretVault = class {
+  keyFile;
+  key;
+  constructor(opts) {
+    this.keyFile = opts.keyFile;
+  }
+  isEncrypted(value) {
+    return typeof value === "string" && value.startsWith(ENCRYPTED_PREFIX);
+  }
+  encrypt(plaintext) {
+    if (this.isEncrypted(plaintext)) return plaintext;
+    const key = this.loadOrCreateKey();
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv(ALGO, key, iv);
+    const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
+  }
+  decrypt(value) {
+    if (!this.isEncrypted(value)) return value;
+    const rest = value.slice(ENCRYPTED_PREFIX.length);
+    const parts = rest.split(":");
+    if (parts.length !== 3) {
+      throw new Error("SecretVault: malformed encrypted value");
+    }
+    const [ivB64, tagB64, ctB64] = parts;
+    const iv = Buffer.from(ivB64, "base64");
+    const tag = Buffer.from(tagB64, "base64");
+    const ct = Buffer.from(ctB64, "base64");
+    if (iv.length !== IV_BYTES) throw new Error("SecretVault: bad IV length");
+    if (tag.length !== TAG_BYTES) throw new Error("SecretVault: bad tag length");
+    const key = this.loadOrCreateKey();
+    const decipher = createDecipheriv(ALGO, key, iv);
+    decipher.setAuthTag(tag);
+    const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+    return pt.toString("utf8");
+  }
+  loadOrCreateKey() {
+    if (this.key) return this.key;
+    try {
+      const buf = fs5.readFileSync(this.keyFile);
+      if (buf.length !== KEY_BYTES) {
+        throw new Error(`SecretVault: key file ${this.keyFile} has wrong size`);
+      }
+      this.key = buf;
+      return this.key;
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+    fs5.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    const key = randomBytes(KEY_BYTES);
+    try {
+      fs5.writeFileSync(this.keyFile, key, { mode: 384, flag: "wx" });
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      const buf = fs5.readFileSync(this.keyFile);
+      if (buf.length !== KEY_BYTES) {
+        throw new Error(`SecretVault: key file ${this.keyFile} has wrong size`);
+      }
+      this.key = buf;
+      return this.key;
+    }
+    this.key = key;
+    return key;
+  }
+};
+function decryptConfigSecrets2(cfg, vault) {
+  return walk2(cfg, vault, (v, key) => {
+    try {
+      return vault.decrypt(v);
+    } catch (err) {
+      console.warn(
+        `[secret-vault] Failed to decrypt "${key}":`,
+        err instanceof Error ? err.message : err
+      );
+      return "";
+    }
+  });
+}
+function encryptConfigSecrets(cfg, vault) {
+  return walk2(cfg, vault, (v) => vault.encrypt(v));
+}
+function walk2(node, vault, transform) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walk2(item, vault, transform));
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField2(k)) {
+      out[k] = transform(v, k);
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walk2(v, vault, transform);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+var SECRET_KEY_PATTERN2 = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key)/i;
+var NON_SECRET_OVERRIDES2 = /* @__PURE__ */ new Set(["publickey", "public_key"]);
+function isSecretField2(name) {
+  const lc = name.toLowerCase();
+  if (NON_SECRET_OVERRIDES2.has(lc)) return false;
+  return SECRET_KEY_PATTERN2.test(lc);
+}
+async function rewriteConfigEncrypted(configPath, vault, patch) {
+  let current = {};
+  try {
+    const raw = await fsp.readFile(configPath, "utf8");
+    current = JSON.parse(raw);
+  } catch {
+  }
+  const merged = deepMerge2(current, patch ?? {});
+  const encrypted = encryptConfigSecrets(merged, vault);
+  await fsp.mkdir(path3.dirname(configPath), { recursive: true });
+  await fsp.writeFile(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  try {
+    await fsp.chmod(configPath, 384);
+  } catch {
+  }
+}
+async function migratePlaintextSecrets(configPath, vault) {
+  let raw;
+  try {
+    raw = await fsp.readFile(configPath, "utf8");
+  } catch {
+    return { migrated: 0, file: configPath };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { migrated: 0, file: configPath };
+  }
+  const counter = { n: 0 };
+  const migrated = walkCount(parsed, vault, counter);
+  if (counter.n === 0) return { migrated: 0, file: configPath };
+  await fsp.writeFile(configPath, JSON.stringify(migrated, null, 2), { mode: 384 });
+  try {
+    await fsp.chmod(configPath, 384);
+  } catch {
   }
-  scrubOne(text) {
-    let out = text;
-    for (const p of PATTERNS) {
-      out = out.replace(p.regex, (_match, group1, group2) => {
-        if (p.type === "high_entropy_env" && group1 && group2) {
-          return `${group1}=[REDACTED:${p.type}]`;
-        }
-        return `[REDACTED:${p.type}]`;
-      });
+  return { migrated: counter.n, file: configPath };
+}
+function walkCount(node, vault, counter) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walkCount(item, vault, counter));
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField2(k) && !vault.isEncrypted(v) && v.length > 0) {
+      out[k] = vault.encrypt(v);
+      counter.n++;
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walkCount(v, vault, counter);
+    } else {
+      out[k] = v;
     }
-    return out;
   }
-  scrubObject(obj) {
-    const seen = /* @__PURE__ */ new WeakSet();
-    const visit = (v) => {
-      if (typeof v === "string") return this.scrub(v);
-      if (v === null || typeof v !== "object") return v;
-      if (seen.has(v)) return v;
-      seen.add(v);
-      if (Array.isArray(v)) return v.map(visit);
-      const out = {};
-      for (const [k, val] of Object.entries(v)) {
-        out[k] = visit(val);
-      }
-      return out;
-    };
-    return visit(obj);
+  return out;
+}
+var FORBIDDEN_PROTO_KEYS2 = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function deepMerge2(a, b) {
+  const out = { ...a };
+  for (const [k, v] of Object.entries(b)) {
+    if (FORBIDDEN_PROTO_KEYS2.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge2(existing, v);
+    } else {
+      out[k] = v;
+    }
   }
-};
+  return out;
+}
 
 // src/utils/glob-match.ts
 function escapeRegex(s) {
@@ -3084,20 +3290,36 @@ var HybridCompactor = class {
   async compact(ctx, opts = {}) {
     const beforeTokens = this.estimateMessages(ctx.messages);
     const reductions = [];
-    const phase1Saved = this.eliseOldToolResults(ctx);
+    const policy = readContextWindowPolicy(ctx);
+    const preserveK = policy?.preserveK ?? this.preserveK;
+    const eliseThreshold = policy?.eliseThreshold ?? this.eliseThreshold;
+    const phase1Saved = this.eliseOldToolResults(ctx, preserveK, eliseThreshold);
     if (phase1Saved > 0) reductions.push({ phase: "elision", saved: phase1Saved });
     if (opts.aggressive) {
-      const phase2Saved = this.collapseAncientTurns(ctx);
+      const phase2Saved = this.collapseAncientTurns(ctx, preserveK);
       if (phase2Saved > 0) reductions.push({ phase: "summary", saved: phase2Saved });
     }
+    const repaired = repairToolUseAdjacency(ctx.messages);
+    if (repaired.report.changed) {
+      ctx.state.replaceMessages(repaired.messages);
+    }
     const afterTokens = this.estimateMessages(ctx.messages);
-    return { before: beforeTokens, after: afterTokens, reductions };
+    return {
+      before: beforeTokens,
+      after: afterTokens,
+      reductions,
+      repaired: repaired.report.changed ? {
+        removedToolUses: repaired.report.removedToolUses,
+        removedToolResults: repaired.report.removedToolResults,
+        removedMessages: repaired.report.removedMessages
+      } : void 0
+    };
   }
-  eliseOldToolResults(ctx) {
+  eliseOldToolResults(ctx, preserveK = this.preserveK, eliseThreshold = this.eliseThreshold) {
     const messages = ctx.messages;
     let pairCount = 0;
     let preserveStart = messages.length;
-    for (let i = messages.length - 1; i >= 0 && pairCount < this.preserveK; i--) {
+    for (let i = messages.length - 1; i >= 0 && pairCount < preserveK; i--) {
       const m = messages[i];
       if (!m) continue;
       if (m.role === "user" || m.role === "assistant") {
@@ -3121,7 +3343,7 @@ var HybridCompactor = class {
       const newContent = msg.content.map((b) => {
         if (b.type !== "tool_result") return b;
         const tokens = estimateToolResultTokens(b.content);
-        if (tokens < this.eliseThreshold) return b;
+        if (tokens < eliseThreshold) return b;
         saved += tokens;
         const elided = {
           type: "tool_result",
@@ -3141,9 +3363,9 @@ var HybridCompactor = class {
     if (changed) ctx.state.replaceMessages(nextMessages);
     return saved;
   }
-  collapseAncientTurns(ctx) {
+  collapseAncientTurns(ctx, preserveK = this.preserveK) {
     const messages = ctx.messages;
-    const cutTarget = Math.max(0, messages.length - this.preserveK * 2);
+    const cutTarget = Math.max(0, messages.length - preserveK * 2);
     if (cutTarget <= 0) return 0;
     let boundary = -1;
     for (let i = cutTarget; i < messages.length; i++) {
@@ -3184,6 +3406,15 @@ var HybridCompactor = class {
     return total;
   }
 };
+function readContextWindowPolicy(ctx) {
+  const policy = ctx.meta?.["contextWindowPolicy"];
+  if (!policy || typeof policy !== "object") return null;
+  const candidate = policy;
+  if (typeof candidate.preserveK !== "number" || typeof candidate.eliseThreshold !== "number") {
+    return null;
+  }
+  return candidate;
+}
 function hasTextContent(m) {
   if (typeof m.content === "string") return m.content.trim().length > 0;
   return m.content.some((b) => b.type === "text" && b.text.trim().length > 0);
@@ -3230,8 +3461,19 @@ var IntelligentCompactor = class {
       const saved2 = this.lightweightCompact(ctx);
       if (saved2 > 0) reductions.push({ phase: "elision", saved: saved2 });
     }
+    const repaired = repairToolUseAdjacency(ctx.messages);
+    if (repaired.report.changed) ctx.state.replaceMessages(repaired.messages);
     const afterTokens = this.estimateTokens(ctx.messages);
-    return { before: beforeTokens, after: afterTokens, reductions };
+    return {
+      before: beforeTokens,
+      after: afterTokens,
+      reductions,
+      repaired: repaired.report.changed ? {
+        removedToolUses: repaired.report.removedToolUses,
+        removedToolResults: repaired.report.removedToolResults,
+        removedMessages: repaired.report.removedMessages
+      } : void 0
+    };
   }
   async summarizeAncientTurns(ctx) {
     const messages = ctx.messages;
@@ -3271,8 +3513,8 @@ var IntelligentCompactor = class {
       const m = messages[i];
       if (!m) continue;
       if (m.role === "assistant") {
-        const hasToolUse = Array.isArray(m.content) ? m.content.some((b) => b.type === "tool_use") : false;
-        if (!hasToolUse) {
+        const hasToolUse2 = Array.isArray(m.content) ? m.content.some((b) => b.type === "tool_use") : false;
+        if (!hasToolUse2) {
           return i + 1;
         }
       } else if (m.role !== "user") ; else {
@@ -3578,8 +3820,9 @@ var SelectiveCompactor = class {
     if (!shouldCompact) {
       const saved = this.eliseOldToolResults(ctx);
       if (saved > 0) reductions.push({ phase: "elision", saved });
+      const repair2 = this.repairProtocolAdjacency(ctx);
       const afterTokens2 = this.estimateTokens(ctx.messages);
-      return { before: beforeTokens, after: afterTokens2, reductions };
+      return { before: beforeTokens, after: afterTokens2, reductions, repaired: repair2 };
     }
     const savedElision = this.eliseOldToolResults(ctx);
     if (savedElision > 0) reductions.push({ phase: "elision", saved: savedElision });
@@ -3589,8 +3832,18 @@ var SelectiveCompactor = class {
       const savedSelective = await this.runSelector(ctx, targetBudget);
       if (savedSelective > 0) reductions.push({ phase: "selective", saved: savedSelective });
     }
+    const repair = this.repairProtocolAdjacency(ctx);
     const afterTokens = this.estimateTokens(ctx.messages);
-    return { before: beforeTokens, after: afterTokens, reductions };
+    return { before: beforeTokens, after: afterTokens, reductions, repaired: repair };
+  }
+  repairProtocolAdjacency(ctx) {
+    const repaired = repairToolUseAdjacency(ctx.messages);
+    if (repaired.report.changed) ctx.state.replaceMessages(repaired.messages);
+    return repaired.report.changed ? {
+      removedToolUses: repaired.report.removedToolUses,
+      removedToolResults: repaired.report.removedToolResults,
+      removedMessages: repaired.report.removedMessages
+    } : void 0;
   }
   /**
    * Run the LLM selector to decide what to keep vs collapse.
@@ -3778,6 +4031,7 @@ var AutoCompactionMiddleware = class {
   aggressiveOn;
   events;
   failureMode;
+  policyProvider;
   /**
    * @param compactor        Compactor to use for compaction.
    * @param maxContext       Provider's max context window in tokens.
@@ -3800,17 +4054,25 @@ var AutoCompactionMiddleware = class {
     this.aggressiveOn = opts.aggressiveOn ?? "soft";
     this.events = opts.events;
     this.failureMode = opts.failureMode ?? "throw_on_hard";
+    this.policyProvider = opts.policyProvider;
   }
   handler() {
     return async (ctx, next) => {
       const tokens = this.estimator(ctx);
       const load = tokens / this.maxContext;
-      if (load >= this.hardThreshold) {
+      const policy = this.policyProvider?.(ctx);
+      const thresholds = policy?.thresholds ?? {
+        warn: this.warnThreshold,
+        soft: this.softThreshold,
+        hard: this.hardThreshold
+      };
+      const aggressiveOn = policy?.aggressiveOn ?? this.aggressiveOn;
+      if (load >= thresholds.hard) {
         await this.compact(ctx, true, { level: "hard", tokens, load });
-      } else if (load >= this.softThreshold) {
-        await this.compact(ctx, this.aggressiveOn !== "hard", { level: "soft", tokens, load });
-      } else if (load >= this.warnThreshold) {
-        await this.compact(ctx, false, { level: "warn", tokens, load });
+      } else if (load >= thresholds.soft) {
+        await this.compact(ctx, aggressiveOn !== "hard", { level: "soft", tokens, load });
+      } else if (load >= thresholds.warn) {
+        await this.compact(ctx, aggressiveOn === "warn", { level: "warn", tokens, load });
       }
       return next(ctx);
     };
@@ -4413,6 +4675,7 @@ var InMemoryAgentBridge = class {
     this.stopped = true;
     for (const [, p] of this.pendingRequests) {
       clearTimeout(p.timer);
+      p.reject(new Error("Bridge stopped"));
     }
     this.pendingRequests.clear();
     this.inflightGuards.clear();
@@ -5186,41 +5449,214 @@ function classifySubagentError(err, hints = {}) {
     return { kind: "context_overflow", message: baseMessage, retryable: false, cause };
   }
   return {
-    kind: "unknown",
-    message: baseMessage,
-    retryable: false,
-    cause
+    kind: "unknown",
+    message: baseMessage,
+    retryable: false,
+    cause
+  };
+}
+function providerErrorToSubagentError(err, message, cause) {
+  const status = err.status;
+  if (status === 429 || err.body?.type === "rate_limit_error") {
+    return {
+      kind: "provider_rate_limit",
+      message,
+      retryable: true,
+      // Conservative default: 5s. Provider-specific code can override
+      // by emitting an error whose body carries an explicit hint.
+      backoffMs: 5e3,
+      cause
+    };
+  }
+  if (status === 401 || status === 403 || err.body?.type === "authentication_error") {
+    return { kind: "provider_auth", message, retryable: false, cause };
+  }
+  if (status === 408 || status === 0) {
+    return { kind: "provider_timeout", message, retryable: true, cause };
+  }
+  if (status >= 500 && status < 600) {
+    return {
+      kind: "provider_5xx",
+      message,
+      retryable: true,
+      backoffMs: 3e3,
+      cause
+    };
+  }
+  return { kind: "unknown", message, retryable: err.retryable, cause };
+}
+function makeSpawnTool(director, roster) {
+  const inputSchema = {
+    type: "object",
+    properties: {
+      role: { type: "string", description: "Roster role id (preferred). When set, the spawn uses the matching config from the roster and ignores other fields." },
+      name: { type: "string", description: "Display name for the subagent. Required when not using roster." },
+      provider: { type: "string", description: 'Provider id (e.g. "anthropic", "openai"). Defaults to the leader provider when omitted.' },
+      model: { type: "string", description: "Model id within the provider. Defaults to the leader model when omitted." },
+      systemPromptOverride: { type: "string", description: "Extra prompt text appended after the role-base prompt." },
+      maxIterations: { type: "number" },
+      maxToolCalls: { type: "number" },
+      maxCostUsd: { type: "number" }
+    },
+    required: []
+  };
+  return {
+    name: "spawn_subagent",
+    description: "Create a new subagent under this director. Returns the subagent id.",
+    usageHint: "Either pass `role` (matches the roster) OR pass `name` + optional `provider`/`model`. Returns `{ subagentId }`.",
+    permission: "auto",
+    mutating: false,
+    inputSchema,
+    async execute(input) {
+      const i = input ?? {};
+      const role = typeof i.role === "string" ? i.role : void 0;
+      const base = role && roster ? roster[role] : void 0;
+      if (role && !base) {
+        return { error: `unknown role "${role}". roster has: ${roster ? Object.keys(roster).join(", ") : "(empty)"}` };
+      }
+      const cfg = { ...base ?? { name: i.name ?? "subagent" } };
+      if (typeof i.name === "string") cfg.name = i.name;
+      if (typeof i.provider === "string") cfg.provider = i.provider;
+      if (typeof i.model === "string") cfg.model = i.model;
+      if (typeof i.systemPromptOverride === "string") cfg.systemPromptOverride = i.systemPromptOverride;
+      if (typeof i.maxIterations === "number") cfg.maxIterations = i.maxIterations;
+      if (typeof i.maxToolCalls === "number") cfg.maxToolCalls = i.maxToolCalls;
+      if (typeof i.maxCostUsd === "number") cfg.maxCostUsd = i.maxCostUsd;
+      try {
+        const subagentId = await director.spawn(cfg);
+        return { subagentId, provider: cfg.provider, model: cfg.model, name: cfg.name };
+      } catch (err) {
+        if (err instanceof DirectorBudgetError) {
+          return { error: err.message, kind: err.kind, limit: err.limit, observed: err.observed };
+        }
+        return { error: err instanceof Error ? err.message : String(err) };
+      }
+    }
+  };
+}
+function makeAssignTool(director) {
+  const inputSchema = {
+    type: "object",
+    properties: {
+      subagentId: { type: "string", description: "Target subagent id. Required." },
+      description: { type: "string", description: "The task in natural language \u2014 what you want this subagent to do." },
+      maxToolCalls: { type: "number", description: "Optional per-task tool-call budget override." },
+      timeoutMs: { type: "number", description: "Optional per-task timeout in ms." }
+    },
+    required: ["subagentId", "description"]
+  };
+  return {
+    name: "assign_task",
+    description: "Hand a task to a previously spawned subagent. Returns the task id.",
+    permission: "auto",
+    mutating: false,
+    inputSchema,
+    async execute(input) {
+      const i = input;
+      const task = { id: randomUUID(), description: i.description, subagentId: i.subagentId, maxToolCalls: i.maxToolCalls, timeoutMs: i.timeoutMs };
+      const taskId = await director.assign(task);
+      return { taskId, subagentId: i.subagentId };
+    }
+  };
+}
+function makeAwaitTasksTool(director) {
+  return {
+    name: "await_tasks",
+    description: "Block until every named task completes. Returns the array of TaskResult.",
+    permission: "auto",
+    mutating: false,
+    inputSchema: { type: "object", properties: { taskIds: { type: "array", items: { type: "string" }, description: "One or more task ids returned by `assign_task`." } }, required: ["taskIds"] },
+    async execute(input) {
+      const i = input;
+      const results = await director.awaitTasks(i.taskIds);
+      return { results };
+    }
+  };
+}
+function makeAskTool(director) {
+  return {
+    name: "ask_subagent",
+    description: "Synchronously ask a subagent a question. Blocks until the subagent replies via the bridge.",
+    permission: "auto",
+    mutating: false,
+    inputSchema: {
+      type: "object",
+      properties: {
+        subagentId: { type: "string", description: "Subagent to ask. Must be a previously spawned id." },
+        question: { type: "string", description: "The question or instruction." },
+        timeoutMs: { type: "number", description: "Optional timeout in ms (default 30s)." }
+      },
+      required: ["subagentId", "question"]
+    },
+    async execute(input) {
+      const i = input;
+      try {
+        const answer = await director.ask(i.subagentId, { question: i.question }, i.timeoutMs);
+        return { ok: true, answer };
+      } catch (err) {
+        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+      }
+    }
+  };
+}
+function makeRollUpTool(director) {
+  return {
+    name: "roll_up",
+    description: "Aggregate completed task results into a single formatted summary.",
+    permission: "auto",
+    mutating: false,
+    inputSchema: {
+      type: "object",
+      properties: {
+        taskIds: { type: "array", items: { type: "string" }, description: "Completed task ids to aggregate." },
+        style: { type: "string", enum: ["markdown", "json"], description: "Output flavor \u2014 markdown (default) or json." }
+      },
+      required: ["taskIds"]
+    },
+    async execute(input) {
+      const i = input;
+      const summary = director.rollUp(i.taskIds, i.style ?? "markdown");
+      return { summary, count: i.taskIds.length };
+    }
+  };
+}
+function makeTerminateTool(director) {
+  return {
+    name: "terminate_subagent",
+    description: "Forcibly abort a subagent.",
+    permission: "auto",
+    mutating: true,
+    inputSchema: { type: "object", properties: { subagentId: { type: "string", description: "Subagent to abort." } }, required: ["subagentId"] },
+    async execute(input) {
+      const i = input;
+      await director.terminate(i.subagentId);
+      return { ok: true };
+    }
+  };
+}
+function makeFleetStatusTool(director) {
+  return {
+    name: "fleet_status",
+    description: "Snapshot of the fleet \u2014 every subagent's current status, pending vs. completed task counts.",
+    permission: "auto",
+    mutating: false,
+    inputSchema: { type: "object", properties: {}, required: [] },
+    async execute() {
+      return director.status();
+    }
   };
 }
-function providerErrorToSubagentError(err, message, cause) {
-  const status = err.status;
-  if (status === 429 || err.body?.type === "rate_limit_error") {
-    return {
-      kind: "provider_rate_limit",
-      message,
-      retryable: true,
-      // Conservative default: 5s. Provider-specific code can override
-      // by emitting an error whose body carries an explicit hint.
-      backoffMs: 5e3,
-      cause
-    };
-  }
-  if (status === 401 || status === 403 || err.body?.type === "authentication_error") {
-    return { kind: "provider_auth", message, retryable: false, cause };
-  }
-  if (status === 408 || status === 0) {
-    return { kind: "provider_timeout", message, retryable: true, cause };
-  }
-  if (status >= 500 && status < 600) {
-    return {
-      kind: "provider_5xx",
-      message,
-      retryable: true,
-      backoffMs: 3e3,
-      cause
-    };
-  }
-  return { kind: "unknown", message, retryable: err.retryable, cause };
+function makeFleetUsageTool(director) {
+  return {
+    name: "fleet_usage",
+    description: "Token + cost breakdown across the fleet, per-subagent and totals.",
+    permission: "auto",
+    mutating: false,
+    inputSchema: { type: "object", properties: {}, required: [] },
+    async execute() {
+      return director.snapshot();
+    }
+  };
 }
 
 // src/coordination/director.ts
@@ -5780,242 +6216,6 @@ var Director = class {
     return t;
   }
 };
-function makeSpawnTool(director, roster) {
-  const inputSchema = {
-    type: "object",
-    properties: {
-      role: {
-        type: "string",
-        description: "Roster role id (preferred). When set, the spawn uses the matching config from the roster and ignores other fields."
-      },
-      name: {
-        type: "string",
-        description: "Display name for the subagent. Required when not using roster."
-      },
-      provider: {
-        type: "string",
-        description: 'Provider id (e.g. "anthropic", "openai"). Defaults to the leader provider when omitted.'
-      },
-      model: {
-        type: "string",
-        description: "Model id within the provider. Defaults to the leader model when omitted."
-      },
-      systemPromptOverride: {
-        type: "string",
-        description: "Extra prompt text appended after the role-base prompt."
-      },
-      maxIterations: { type: "number" },
-      maxToolCalls: { type: "number" },
-      maxCostUsd: { type: "number" }
-    },
-    required: []
-  };
-  return {
-    name: "spawn_subagent",
-    description: "Create a new subagent under this director. Returns the subagent id. Use this when you need a worker with a specific provider, model, or role to handle a piece of the plan.",
-    usageHint: "Either pass `role` (matches the roster) OR pass `name` + optional `provider`/`model`. Returns `{ subagentId }`.",
-    permission: "auto",
-    mutating: false,
-    inputSchema,
-    async execute(input) {
-      const i = input ?? {};
-      const role = typeof i.role === "string" ? i.role : void 0;
-      const base = role && roster ? roster[role] : void 0;
-      if (role && !base) {
-        return {
-          error: `unknown role "${role}". roster has: ${roster ? Object.keys(roster).join(", ") : "(empty)"}`
-        };
-      }
-      const cfg = {
-        ...base ?? { name: i.name ?? "subagent" }
-      };
-      if (typeof i.name === "string") cfg.name = i.name;
-      if (typeof i.provider === "string") cfg.provider = i.provider;
-      if (typeof i.model === "string") cfg.model = i.model;
-      if (typeof i.systemPromptOverride === "string")
-        cfg.systemPromptOverride = i.systemPromptOverride;
-      if (typeof i.maxIterations === "number") cfg.maxIterations = i.maxIterations;
-      if (typeof i.maxToolCalls === "number") cfg.maxToolCalls = i.maxToolCalls;
-      if (typeof i.maxCostUsd === "number") cfg.maxCostUsd = i.maxCostUsd;
-      try {
-        const subagentId = await director.spawn(cfg);
-        return { subagentId, provider: cfg.provider, model: cfg.model, name: cfg.name };
-      } catch (err) {
-        if (err instanceof DirectorBudgetError) {
-          return { error: err.message, kind: err.kind, limit: err.limit, observed: err.observed };
-        }
-        return { error: err instanceof Error ? err.message : String(err) };
-      }
-    }
-  };
-}
-function makeAssignTool(director) {
-  const inputSchema = {
-    type: "object",
-    properties: {
-      subagentId: { type: "string", description: "Target subagent id. Required." },
-      description: {
-        type: "string",
-        description: "The task in natural language \u2014 what you want this subagent to do."
-      },
-      maxToolCalls: { type: "number", description: "Optional per-task tool-call budget override." },
-      timeoutMs: { type: "number", description: "Optional per-task timeout in ms." }
-    },
-    required: ["subagentId", "description"]
-  };
-  return {
-    name: "assign_task",
-    description: "Hand a task to a previously spawned subagent. Returns the task id \u2014 pass it to `await_tasks` to block on completion.",
-    permission: "auto",
-    mutating: false,
-    inputSchema,
-    async execute(input) {
-      const i = input;
-      const task = {
-        id: randomUUID(),
-        description: i.description,
-        subagentId: i.subagentId,
-        maxToolCalls: i.maxToolCalls,
-        timeoutMs: i.timeoutMs
-      };
-      const taskId = await director.assign(task);
-      return { taskId, subagentId: i.subagentId };
-    }
-  };
-}
-function makeAwaitTasksTool(director) {
-  const inputSchema = {
-    type: "object",
-    properties: {
-      taskIds: {
-        type: "array",
-        items: { type: "string" },
-        description: "One or more task ids returned by `assign_task`. The call blocks until every id resolves."
-      }
-    },
-    required: ["taskIds"]
-  };
-  return {
-    name: "await_tasks",
-    description: "Block until every named task completes. Returns the array of TaskResult \u2014 use this to gather subagent output before deciding the next step.",
-    permission: "auto",
-    mutating: false,
-    inputSchema,
-    async execute(input) {
-      const i = input;
-      const results = await director.awaitTasks(i.taskIds);
-      return { results };
-    }
-  };
-}
-function makeAskTool(director) {
-  const inputSchema = {
-    type: "object",
-    properties: {
-      subagentId: {
-        type: "string",
-        description: "Subagent to ask. Must be a previously spawned id."
-      },
-      question: {
-        type: "string",
-        description: "The question or instruction. Sent as the bridge message payload."
-      },
-      timeoutMs: { type: "number", description: "Optional timeout in ms (default 30s)." }
-    },
-    required: ["subagentId", "question"]
-  };
-  return {
-    name: "ask_subagent",
-    description: "Synchronously ask a subagent a question. Blocks until the subagent replies via the bridge (or the timeout fires). Use this when you need a one-shot answer without spawning a fresh task.",
-    permission: "auto",
-    mutating: false,
-    inputSchema,
-    async execute(input) {
-      const i = input;
-      try {
-        const answer = await director.ask(i.subagentId, { question: i.question }, i.timeoutMs);
-        return { ok: true, answer };
-      } catch (err) {
-        return { ok: false, error: err instanceof Error ? err.message : String(err) };
-      }
-    }
-  };
-}
-function makeRollUpTool(director) {
-  const inputSchema = {
-    type: "object",
-    properties: {
-      taskIds: {
-        type: "array",
-        items: { type: "string" },
-        description: "Completed task ids to aggregate. Pass the ids returned by previous `assign_task` calls."
-      },
-      style: {
-        type: "string",
-        enum: ["markdown", "json"],
-        description: "Output flavor \u2014 markdown (default) for in-prompt summarization, json for structured downstream processing."
-      }
-    },
-    required: ["taskIds"]
-  };
-  return {
-    name: "roll_up",
-    description: "Aggregate completed task results into a single formatted summary. Use this after `await_tasks` to fold subagent outputs back into the director's context before deciding the next step.",
-    permission: "auto",
-    mutating: false,
-    inputSchema,
-    async execute(input) {
-      const i = input;
-      const summary = director.rollUp(i.taskIds, i.style ?? "markdown");
-      return { summary, count: i.taskIds.length };
-    }
-  };
-}
-function makeTerminateTool(director) {
-  const inputSchema = {
-    type: "object",
-    properties: {
-      subagentId: { type: "string", description: "Subagent to abort." }
-    },
-    required: ["subagentId"]
-  };
-  return {
-    name: "terminate_subagent",
-    description: 'Forcibly abort a subagent. Use sparingly \u2014 prefer waiting on the natural budget to expire. The current task (if any) ends with status "stopped".',
-    permission: "auto",
-    mutating: true,
-    inputSchema,
-    async execute(input) {
-      const i = input;
-      await director.terminate(i.subagentId);
-      return { ok: true };
-    }
-  };
-}
-function makeFleetStatusTool(director) {
-  return {
-    name: "fleet_status",
-    description: "Snapshot of the fleet \u2014 every subagent's current status, pending vs. completed task counts, and the running total iteration count. Cheap; call freely.",
-    permission: "auto",
-    mutating: false,
-    inputSchema: { type: "object", properties: {}, required: [] },
-    async execute() {
-      return director.status();
-    }
-  };
-}
-function makeFleetUsageTool(director) {
-  return {
-    name: "fleet_usage",
-    description: "Token + cost breakdown across the fleet, per-subagent and totals. Use this to reason about which workers to assign costly tasks to or when to wrap up to stay within budget.",
-    permission: "auto",
-    mutating: false,
-    inputSchema: { type: "object", properties: {}, required: [] },
-    async execute() {
-      return director.snapshot();
-    }
-  };
-}
 function createDelegateTool(opts) {
   const defaultTimeoutMs = opts.defaultTimeoutMs ?? 4 * 60 * 60 * 1e3;
   const rosterIds = opts.roster ? Object.keys(opts.roster) : [];
@@ -8553,13 +8753,13 @@ function roughEstimate(messages) {
 function createContextManagerTool(opts = {}) {
   return {
     name: CONTEXT_MANAGER_TOOL_NAME,
-    description: 'Inspect or reorganize the conversation context window. Use "check" to see token budget. Use "summary" to collapse a message range into a concise note (provide "text" for custom summary). Use "prune" to remove specific messages by index. Use "add_note" to inject a summary note. Use "compact" to run aggressive compaction.',
+    description: 'Inspect or reorganize the conversation context window. Use "check" to see token budget. Use "summary" to collapse a message range into a concise note (provide "text" for custom summary). Use "prune" to remove specific messages by index. Use "add_note" to inject a summary note. Use "compact" to run aggressive compaction. Use "repair" to remove orphan tool_use/tool_result blocks after manual context surgery.',
     inputSchema: {
       type: "object",
       properties: {
         action: {
           type: "string",
-          enum: ["check", "summary", "prune", "add_note", "compact"],
+          enum: ["check", "summary", "prune", "add_note", "compact", "repair"],
           description: "The context operation to perform."
         },
         from: {
@@ -8587,12 +8787,15 @@ function createContextManagerTool(opts = {}) {
       const messages = ctx.messages;
       const beforeTokens = roughEstimate(messages);
       const applyMessages = (next) => {
+        const repaired = repairToolUseAdjacency(next);
+        const finalMessages = repaired.messages;
         if (ctx.state) {
-          ctx.state.replaceMessages(next);
+          ctx.state.replaceMessages(finalMessages);
         } else {
           messages.length = 0;
-          messages.splice(0, 0, ...next);
+          messages.splice(0, 0, ...finalMessages);
         }
+        return repaired.report;
       };
       switch (input.action) {
         case "check": {
@@ -8609,6 +8812,22 @@ function createContextManagerTool(opts = {}) {
             })
           };
         }
+        case "repair": {
+          const repair = applyMessages([...messages]);
+          const afterTokens = roughEstimate(ctx.messages);
+          return {
+            action: "repair",
+            beforeTokens,
+            afterTokens,
+            messageCount: ctx.messages.length,
+            repaired: repair.changed ? {
+              removedToolUses: repair.removedToolUses,
+              removedToolResults: repair.removedToolResults,
+              removedMessages: repair.removedMessages
+            } : void 0,
+            notes: repair.changed ? "Context tool-call adjacency repaired." : "Context tool-call adjacency already valid."
+          };
+        }
         case "compact": {
           if (!opts.compactor) {
             return {
@@ -8619,11 +8838,19 @@ function createContextManagerTool(opts = {}) {
             };
           }
           const report = await opts.compactor.compact(ctx);
+          const repair = applyMessages([...ctx.messages]);
+          const afterTokens = repair.changed ? roughEstimate(ctx.messages) : report.after;
+          const repaired = report.repaired ?? (repair.changed ? repair : void 0);
           return {
             action: "compact",
             beforeTokens,
-            afterTokens: report.after,
-            messageCount: messages.length
+            afterTokens,
+            messageCount: ctx.messages.length,
+            repaired: repaired ? {
+              removedToolUses: repaired.removedToolUses,
+              removedToolResults: repaired.removedToolResults,
+              removedMessages: repaired.removedMessages
+            } : void 0
           };
         }
         case "prune": {
@@ -8639,14 +8866,19 @@ function createContextManagerTool(opts = {}) {
           }
           const copy = [...messages];
           const removed = copy.splice(from, to - from + 1);
-          applyMessages(copy);
-          const afterTokens = roughEstimate(copy);
+          const repair = applyMessages(copy);
+          const afterTokens = roughEstimate(ctx.messages);
           return {
             action: "prune",
             beforeTokens,
             afterTokens,
-            messageCount: copy.length,
-            removedCount: removed.length
+            messageCount: ctx.messages.length,
+            removedCount: removed.length,
+            repaired: repair.changed ? {
+              removedToolUses: repair.removedToolUses,
+              removedToolResults: repair.removedToolResults,
+              removedMessages: repair.removedMessages
+            } : void 0
           };
         }
         case "add_note": {
@@ -8658,14 +8890,19 @@ function createContextManagerTool(opts = {}) {
           };
           const copy = [...messages];
           copy.splice(afterIdx, 0, noteMsg);
-          applyMessages(copy);
-          const afterTokens = roughEstimate(copy);
+          const repair = applyMessages(copy);
+          const afterTokens = roughEstimate(ctx.messages);
           return {
             action: "add_note",
             beforeTokens,
             afterTokens,
-            messageCount: copy.length,
-            summary: noteText
+            messageCount: ctx.messages.length,
+            summary: noteText,
+            repaired: repair.changed ? {
+              removedToolUses: repair.removedToolUses,
+              removedToolResults: repair.removedToolResults,
+              removedMessages: repair.removedMessages
+            } : void 0
           };
         }
         case "summary": {
@@ -8686,14 +8923,19 @@ function createContextManagerTool(opts = {}) {
           };
           const copy = [...messages];
           copy.splice(from, to - from + 1, summaryMsg);
-          applyMessages(copy);
-          const afterTokens = roughEstimate(copy);
+          const repair = applyMessages(copy);
+          const afterTokens = roughEstimate(ctx.messages);
           return {
             action: "summary",
             beforeTokens,
             afterTokens,
-            messageCount: copy.length,
-            summary: summaryText
+            messageCount: ctx.messages.length,
+            summary: summaryText,
+            repaired: repair.changed ? {
+              removedToolUses: repair.removedToolUses,
+              removedToolResults: repair.removedToolResults,
+              removedMessages: repair.removedMessages
+            } : void 0
           };
         }
         default:
@@ -8797,6 +9039,41 @@ var sentinelServer = () => ({
   permission: "deny"
   // security tool — require explicit confirmation
 });
+var zaiVisionServer = () => ({
+  name: "zai-vision",
+  description: "Z.AI Vision MCP \u2014 image analysis and screenshot understanding",
+  transport: "stdio",
+  command: "npx",
+  args: ["-y", "@z_ai/mcp-server@latest"],
+  env: {
+    Z_AI_API_KEY: process.env.Z_AI_API_KEY ?? "",
+    Z_AI_MODE: process.env.Z_AI_MODE ?? "ZAI"
+  },
+  allowedTools: [
+    "image_analysis",
+    "extract_text_from_screenshot",
+    "diagnose_error_screenshot",
+    "understand_technical_diagram",
+    "analyze_data_visualization",
+    "ui_diff_check"
+  ],
+  permission: "auto"
+});
+var miniMaxVisionServer = () => ({
+  name: "minimax-vision",
+  description: "MiniMax MCP \u2014 image understanding via understand_image",
+  transport: "stdio",
+  command: "uvx",
+  args: ["minimax-coding-plan-mcp", "-y"],
+  env: {
+    MINIMAX_API_KEY: process.env.MINIMAX_API_KEY ?? "",
+    MINIMAX_MCP_BASE_PATH: process.env.MINIMAX_MCP_BASE_PATH ?? "./.wrongstack/minimax-output",
+    MINIMAX_API_HOST: process.env.MINIMAX_API_HOST ?? "https://api.minimax.io",
+    MINIMAX_API_RESOURCE_MODE: process.env.MINIMAX_API_RESOURCE_MODE ?? "url"
+  },
+  allowedTools: ["understand_image"],
+  permission: "auto"
+});
 var allServers = () => ({
   filesystem: { ...filesystemServer(), enabled: false },
   github: { ...githubServer(), enabled: false },
@@ -8807,9 +9084,11 @@ var allServers = () => ({
   slack: { ...slackServer(), enabled: false },
   aws: { ...awsServer(), enabled: false },
   "google-maps": { ...googleMapsServer(), enabled: false },
-  sentinel: { ...sentinelServer(), enabled: false }
+  sentinel: { ...sentinelServer(), enabled: false },
+  "zai-vision": { ...zaiVisionServer(), enabled: false },
+  "minimax-vision": { ...miniMaxVisionServer(), enabled: false }
 });
 
-export { ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigMigrationError, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_SUBAGENT_BASELINE, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorBudgetError, DirectorStateCheckpoint, DoneConditionChecker, FLEET_ROSTER, FleetBus, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SubagentBudget, TaskFlow, TaskGenerator, TaskTracker, ToolExecutor, addPlanItem, allServers, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, clearPlan, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createContextManagerTool, createDelegateTool, createMessage, decryptConfigSecrets, emptyPlan, encryptConfigSecrets, everArtServer, filesystemServer, formatPlan, githubServer, googleMapsServer, loadDirectorState, loadPlan, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeDirectorSessionFactory, migratePlaintextSecrets, removePlanItem, renderPrometheus, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, savePlan, saveTodosCheckpoint, sentinelServer, setPlanItemStatus, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, wireMetricsToEvents };
+export { ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigMigrationError, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_SUBAGENT_BASELINE, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorBudgetError, DirectorStateCheckpoint, DoneConditionChecker, FLEET_ROSTER, FleetBus, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SubagentBudget, TaskFlow, TaskGenerator, TaskTracker, ToolExecutor, addPlanItem, allServers, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, clearPlan, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createContextManagerTool, createDelegateTool, createMessage, decryptConfigSecrets2 as decryptConfigSecrets, emptyPlan, encryptConfigSecrets, everArtServer, filesystemServer, formatPlan, githubServer, googleMapsServer, loadDirectorState, loadPlan, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeDirectorSessionFactory, migratePlaintextSecrets, miniMaxVisionServer, removePlanItem, renderPrometheus, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, savePlan, saveTodosCheckpoint, sentinelServer, setPlanItemStatus, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, wireMetricsToEvents, zaiVisionServer };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map