@wrongstack/core 0.306.2 → 0.306.4

package/dist/index.js

@@ -3884,6 +3884,10 @@ var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "fallbackModels",
   "fallbackBridge",
   "fallbackProfiles",
+  // The profile SELECTOR. No broader than its siblings: a repo that can write
+  // `fallbackModels` and `fallbackProfiles` already controls the chain outright,
+  // and this one can only name a profile the user already defined.
+  "fallbackProfile",
   "favoriteModels",
   "favoriteModelsOnly",
   "modelAvailabilitySchedule",
@@ -3931,6 +3935,10 @@ var KNOWN_DENIED_IN_PROJECT = [
   {
     key: "git",
     reason: "Carries git.identity (GIT_AUTHOR_*/GIT_COMMITTER_* injection): a repo-committed config could spoof the author identity written into the victim's commit history (impersonation)."
+  },
+  {
+    key: "fallbackMaxLastResortCandidates",
+    reason: "Bounds how many of the user's OTHER configured providers may be swept in as last-resort failover. Setting it to 0 from a repo-committed config would silently strip that depth during an outage. It was already stripped in practice (absent from the allow-list) but was missing from the key registry, so this gate never checked it."
   }
 ];
 var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
@@ -3951,11 +3959,13 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "fallbackModels",
   "fallbackBridge",
   "fallbackProfiles",
+  "fallbackProfile",
   "favoriteModels",
   "favoriteModelsOnly",
   "modelAvailabilitySchedule",
   "fallbackAuto",
   "fallbackStickiness",
+  "fallbackMaxLastResortCandidates",
   "hooks",
   "plugins",
   "pluginManager",
@@ -4041,6 +4051,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // operator owns, not the checked-out repository.
     path: "tools.kanbanGovernance",
     reason: "Repo-committed config could disable a Kanban governance gate the operator switched on, letting product mutations run outside any managed card."
+  },
+  {
+    // The bridge spawn path resolves the CLI entry by walking UP from the
+    // project root, so a repo that ships its own `packages/cli/dist/index.js`
+    // gets that file spawned with `process.execPath` on WebUI boot — no
+    // prompt, no banner. Turning the feature on is therefore equivalent to
+    // arbitrary code execution for a hostile checkout, which makes this an
+    // operator-owned switch and never a repo-owned one.
+    // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
+    path: "features.mailboxBridge",
+    reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
   }
 ];
 function deleteNestedPath(target, path124) {
@@ -8622,6 +8643,7 @@ function hasOpenTodos(todos) {
 }
 
 // src/core/context.ts
+import { realpathSync as realpathSync2 } from "node:fs";
 import * as path21 from "node:path";
 
 // src/utils/tool-wire-compact.ts
@@ -9073,12 +9095,15 @@ var ConversationState = class {
    * cap determines the starting index for the sum but does not gate it.
    */
   overflowCount(arr) {
-    let drop = Context.MAX_MESSAGES > 0 ? Math.max(0, arr.length - Context.MAX_MESSAGES) : 0;
-    if (Context.MAX_MESSAGE_TOKENS <= 0) return this.protocolSafeDropCount(arr, drop);
+    const contextClass = this.ctx.constructor;
+    const maxMessages = contextClass.MAX_MESSAGES;
+    const maxMessageTokens = contextClass.MAX_MESSAGE_TOKENS;
+    let drop = maxMessages > 0 ? Math.max(0, arr.length - maxMessages) : 0;
+    if (maxMessageTokens <= 0) return this.protocolSafeDropCount(arr, drop);
     let total = 0;
     for (let i = drop; i < arr.length; i++) total += arr[i]?._estTokens ?? 0;
-    if (total <= Context.MAX_MESSAGE_TOKENS) return this.protocolSafeDropCount(arr, drop);
-    while (drop < arr.length - 1 && total > Context.MAX_MESSAGE_TOKENS) {
+    if (total <= maxMessageTokens) return this.protocolSafeDropCount(arr, drop);
+    while (drop < arr.length - 1 && total > maxMessageTokens) {
       total -= arr[drop]?._estTokens ?? 0;
       drop++;
     }
@@ -9904,6 +9929,19 @@ var Context = class _Context {
       if (rel.startsWith("..") || path21.isAbsolute(rel)) {
         throw new Error(`Working directory "${resolved}" is outside project root "${root}"`);
       }
+      let realTarget = resolved;
+      let realRoot = root;
+      try {
+        realTarget = realpathSync2.native(resolved);
+        realRoot = realpathSync2.native(root);
+      } catch {
+      }
+      const realRel = path21.relative(realRoot, realTarget);
+      if (realRel.startsWith("..") || path21.isAbsolute(realRel)) {
+        throw new Error(
+          `Working directory "${resolved}" resolves to "${realTarget}", outside project root "${realRoot}"`
+        );
+      }
     }
     const old = this.workingDir;
     this.workingDir = resolved;
@@ -10655,26 +10693,41 @@ function stripNextStepsFromMessage(msg) {
   strippedNextStepsCache.set(msg, clone);
   return clone;
 }
-function composeRequestMessages(history, tail) {
+function markCacheBoundary(msg) {
+  if (typeof msg.content === "string") return void 0;
+  const blocks = msg.content.slice();
+  const boundary = blocks[blocks.length - 1];
+  if (!boundary || boundary.type !== "text" && boundary.type !== "tool_result") return void 0;
+  blocks[blocks.length - 1] = { ...boundary, cache_control: { type: "ephemeral" } };
+  return { ...msg, content: blocks };
+}
+function composeRequestMessages(history, tail, previous) {
   if (history.length === 0) return null;
   const out = history.slice();
   const lastIdx = out.length - 1;
   const last = out[lastIdx];
+  if (previous && previous.index < lastIdx && history[previous.index] === previous.message) {
+    const marked2 = markCacheBoundary(previous.message);
+    if (marked2) out[previous.index] = marked2;
+  }
   const blocks = typeof last.content === "string" ? [{ type: "text", text: last.content }] : last.content.slice();
-  const boundary = blocks[blocks.length - 1];
-  if (boundary && (boundary.type === "text" || boundary.type === "tool_result")) {
-    blocks[blocks.length - 1] = { ...boundary, cache_control: { type: "ephemeral" } };
+  const tailBlock = blocks[blocks.length - 1];
+  const marked = tailBlock && (tailBlock.type === "text" || tailBlock.type === "tool_result");
+  if (marked) {
+    blocks[blocks.length - 1] = { ...tailBlock, cache_control: { type: "ephemeral" } };
   }
+  const boundary = marked ? { message: last, index: lastIdx } : void 0;
   if (tail.length === 0 || last.role !== "user") {
     out[lastIdx] = { ...last, content: blocks };
     if (tail.length > 0) out.push({ role: "user", content: [LIVE_CONTEXT_HEADER, ...tail] });
-    return out;
+    return { messages: out, boundary };
   }
   out[lastIdx] = { ...last, content: [...blocks, LIVE_CONTEXT_HEADER, ...tail] };
-  return out;
+  return { messages: out, boundary };
 }
 function createAgentResponseHandler(a) {
   const stabilizedPromptEpochs = /* @__PURE__ */ new WeakSet();
+  let previousBoundary;
   function stabilizePromptEpoch() {
     const prompt = a.ctx.systemPrompt;
     if (stabilizedPromptEpochs.has(prompt)) return;
@@ -10715,7 +10768,9 @@ function createAgentResponseHandler(a) {
       ...memoryEvidence
     ].filter((block) => block !== void 0);
     const requestHistory = stripDeliveredNextSteps(a.ctx.messages);
-    const composedMessages = composeRequestMessages(requestHistory, liveContextTail);
+    const composed = composeRequestMessages(requestHistory, liveContextTail, previousBoundary);
+    if (composed) previousBoundary = composed.boundary;
+    const composedMessages = composed?.messages ?? null;
     const system = composedMessages ? stableSystem : liveContextTail.length > 0 ? [...stableSystem, ...liveContextTail] : stableSystem;
     await a.ctx.waitForModelTransition();
     const provider = a.ctx.provider;
@@ -27608,6 +27663,24 @@ import { createInterface as createInterface4 } from "node:readline";
 import { homedir as homedir5 } from "node:os";
 
 // src/security/secret-scrubber.ts
+var JSON_CREDENTIAL_KEY_ANCHORS = [
+  'Key"',
+  'key"',
+  'KEY"',
+  'token"',
+  'Token"',
+  'TOKEN"',
+  'secret"',
+  'Secret"',
+  'SECRET"',
+  'password"',
+  'Password"',
+  'PASSWORD"',
+  'authorization"',
+  'Authorization"',
+  'bearer"',
+  'Bearer"'
+];
 var PATTERNS = [
   // Anchored at the start where possible so partial matches inside larger
   // strings don't trigger false positives.
@@ -27710,6 +27783,30 @@ var PATTERNS = [
     regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
     anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
   },
+  {
+    type: "json_credential_key",
+    // The JSON counterpart to `high_entropy_env`, and the pattern that the
+    // now-deleted `JSON_KEY_ANCHORS` list was written for. Without it those
+    // anchors only widened the cheap pre-scan — `hasCredentialAnchors` said
+    // "this text may hold a secret", every pattern then declined to match, and
+    // the value went out verbatim. `high_entropy_env` cannot cover these: it
+    // requires an UPPERCASE unquoted key (`API_KEY=…`), so `{"apiKey":"…"}`
+    // never matched.
+    //
+    // Tool results are routinely serialised as JSON, and a credential with no
+    // recognisable prefix (Azure, self-hosted gateways, Anthropic/Codex OAuth)
+    // has no other pattern that can catch it — this is the only thing standing
+    // between such a value and the session JSONL, chronicle, HQ broadcast and
+    // the model's own context.
+    //
+    // The key may carry a prefix (`"anthropicApiKey"`), but the credential word
+    // must END the key: `"tokenCount"` and `"maxTokens"` do not match, because
+    // the closing quote has to follow the word immediately.
+    // Value floor of 8 chars keeps enum-ish values (`"authorization":"none"`)
+    // out. Capture groups: 1=key + punctuation, 2=value, 3=closing quote.
+    regex: /("[A-Za-z0-9_]*(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s*:\s*")([^"\\]{8,512})(")/gi,
+    anchor: JSON_CREDENTIAL_KEY_ANCHORS
+  },
   // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
   // The plugin runtime carried 37 patterns while this scrubber — the one that
   // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
@@ -27792,9 +27889,12 @@ var PATTERNS = [
     anchor: "GOCSPX-"
   }
 ];
-var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
+var SIMPLE_PATTERNS = PATTERNS.filter(
+  (p) => p.type !== "high_entropy_env" && p.type !== "json_credential_key"
+);
 var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
 var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
+var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key").regex;
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
@@ -27805,20 +27905,7 @@ var PATTERN_ANCHORS = [
     )
   )
 ];
-var JSON_KEY_ANCHORS = [
-  '"apiKey"',
-  '"api_key"',
-  '"token"',
-  '"secret"',
-  '"password"',
-  '"authorization"',
-  '"bearer"',
-  '"private_key"',
-  '"access_token"',
-  '"refresh_token"',
-  '"client_secret"'
-];
-var ALL_ANCHORS = [...PATTERN_ANCHORS, ...JSON_KEY_ANCHORS];
+var ALL_ANCHORS = PATTERN_ANCHORS;
 function hasCredentialAnchors(text2) {
   for (const anchor of ALL_ANCHORS) {
     if (text2.includes(anchor)) return true;
@@ -27867,6 +27954,9 @@ var DefaultSecretScrubber = class {
     out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
       return `${lead}${key}=[REDACTED:high_entropy_env]`;
     });
+    out = out.replace(JSON_CREDENTIAL_REGEX, (_match, keyPrefix, _value, closingQuote) => {
+      return `${keyPrefix}[REDACTED:json_credential_key]${closingQuote}`;
+    });
     return out;
   }
   /**
@@ -32528,6 +32618,44 @@ function userInputTitle(content) {
   return sessionContentPreview(content, 60);
 }
 
+// src/storage/session-writer-scrubber.ts
+function scrubSessionWriterEvent(event, secretScrubber) {
+  const persistMessage = (message) => {
+    const { _estTokens: _ignored, ...persisted } = message;
+    return {
+      ...persisted,
+      content: typeof persisted.content === "string" ? secretScrubber?.scrub(persisted.content) ?? persisted.content : secretScrubber?.scrubObject(persisted.content) ?? persisted.content
+    };
+  };
+  if (event.type === "context_snapshot" || event.type === "messages_replaced") {
+    return { ...event, messages: event.messages.map(persistMessage) };
+  }
+  if (event.type === "message_appended" || event.type === "message_updated") {
+    return { ...event, message: persistMessage(event.message) };
+  }
+  if (!secretScrubber) return event;
+  if (event.type === "user_input") {
+    return {
+      ...event,
+      content: typeof event.content === "string" ? secretScrubber.scrub(event.content) : secretScrubber.scrubObject(event.content)
+    };
+  }
+  if (event.type === "llm_response") {
+    return { ...event, content: secretScrubber.scrubObject(event.content) };
+  }
+  if (event.type === "file_snapshot") {
+    return {
+      ...event,
+      files: event.files.map((f) => ({
+        ...f,
+        before: f.before !== null ? secretScrubber.scrub(f.before) : null,
+        after: f.after !== null ? secretScrubber.scrub(f.after) : null
+      }))
+    };
+  }
+  return event;
+}
+
 // src/storage/session-writer-truncate.ts
 import * as fsp11 from "node:fs/promises";
 var CHUNK_SIZE = 65536;
@@ -32672,45 +32800,11 @@ async function rewriteSessionToCheckpoint(filePath, checkpointByteOffset) {
   }
 }
 
-// src/storage/session-writer-scrubber.ts
-function scrubSessionWriterEvent(event, secretScrubber) {
-  const persistMessage = (message) => {
-    const { _estTokens: _ignored, ...persisted } = message;
-    return {
-      ...persisted,
-      content: typeof persisted.content === "string" ? secretScrubber?.scrub(persisted.content) ?? persisted.content : secretScrubber?.scrubObject(persisted.content) ?? persisted.content
-    };
-  };
-  if (event.type === "context_snapshot" || event.type === "messages_replaced") {
-    return { ...event, messages: event.messages.map(persistMessage) };
-  }
-  if (event.type === "message_appended" || event.type === "message_updated") {
-    return { ...event, message: persistMessage(event.message) };
-  }
-  if (!secretScrubber) return event;
-  if (event.type === "user_input") {
-    return {
-      ...event,
-      content: typeof event.content === "string" ? secretScrubber.scrub(event.content) : secretScrubber.scrubObject(event.content)
-    };
-  }
-  if (event.type === "llm_response") {
-    return { ...event, content: secretScrubber.scrubObject(event.content) };
-  }
-  if (event.type === "file_snapshot") {
-    return {
-      ...event,
-      files: event.files.map((f) => ({
-        ...f,
-        before: f.before !== null ? secretScrubber.scrub(f.before) : null,
-        after: f.after !== null ? secretScrubber.scrub(f.after) : null
-      }))
-    };
-  }
-  return event;
-}
-
 // src/storage/file-session-writer.ts
+function isClosedHandleError(err) {
+  const code = err?.code;
+  return code === "EBADF" || code === "ERR_CLOSED_RESOURCE" || code === "ERR_INVALID_HANDLE";
+}
 var FileSessionWriter = class _FileSessionWriter {
   constructor(id, handle, startedAt, meta, events, opts = {}, traceId) {
     this.id = id;
@@ -32882,8 +32976,7 @@ var FileSessionWriter = class _FileSessionWriter {
       try {
         return await this.handle.appendFile(data, "utf8");
       } catch (err) {
-        const nodeErr = err;
-        if (nodeErr?.code === "EBADF") {
+        if (isClosedHandleError(err)) {
           this.handle = await fsp12.open(this.filePath, "a", 384);
           return await this.handle.appendFile(data, "utf8");
         }
@@ -32923,8 +33016,8 @@ var FileSessionWriter = class _FileSessionWriter {
   bufferSynchronousEvent(event) {
     if (this.closed) return;
     void this.ensureInit();
-    this.observeForSummary(event);
-    const appendEvent = event.type === "file_snapshot" ? scrubSessionWriterEvent(event, this.secretScrubber) : event;
+    const appendEvent = scrubSessionWriterEvent(event, this.secretScrubber);
+    this.observeForSummary(appendEvent);
     try {
       this._onAppend?.(appendEvent);
     } catch {
@@ -33077,8 +33170,7 @@ var FileSessionWriter = class _FileSessionWriter {
     try {
       await this.handle.datasync();
     } catch (err) {
-      const nodeErr = err;
-      if (nodeErr?.code === "EBADF") {
+      if (isClosedHandleError(err)) {
         this.handle = await fsp12.open(this.filePath, "a", 384);
         return;
       }
@@ -33315,6 +33407,7 @@ var FileSessionWriter = class _FileSessionWriter {
     return this.closePromise;
   }
   async doClose() {
+    await this.ensureInit();
     if (this.pendingFileSnapshots.length > 0) {
       await this.writeFileSnapshot(this.activePromptIndex ?? 0, [...this.pendingFileSnapshots]);
       this.pendingFileSnapshots = [];
@@ -33330,8 +33423,7 @@ var FileSessionWriter = class _FileSessionWriter {
     try {
       await this.handle.datasync();
     } catch (err) {
-      const nodeErr = err;
-      if (nodeErr?.code !== "EBADF") throw err;
+      if (!isClosedHandleError(err)) throw err;
     }
     const endedAt = (/* @__PURE__ */ new Date()).toISOString();
     const observedActivityMs = Date.parse(this.lastActivityAt);
@@ -35033,9 +35125,40 @@ async function readOrBuildShardManifestEntry(opts) {
   return entry;
 }
 
-// src/storage/session-store/summary-builder.ts
+// src/storage/session-store/strict-empty-check.ts
 import { createReadStream as createReadStream7 } from "node:fs";
 import { createInterface as createInterface7 } from "node:readline";
+var EMPTY_SESSION_EVENT_TYPES = /* @__PURE__ */ new Set(["session_start", "session_resumed", "session_end"]);
+async function isStrictlyEmptySessionFile(file) {
+  const input = createReadStream7(file, { encoding: "utf8" });
+  const lines = createInterface7({ input, crlfDelay: Infinity });
+  let sawSessionStart = false;
+  try {
+    for await (const line of lines) {
+      if (!line.trim()) continue;
+      let event;
+      try {
+        event = JSON.parse(line);
+      } catch {
+        return false;
+      }
+      if (event === null || typeof event !== "object" || Array.isArray(event)) return false;
+      const type = event.type;
+      if (typeof type !== "string" || !EMPTY_SESSION_EVENT_TYPES.has(type)) return false;
+      if (type === "session_start") sawSessionStart = true;
+    }
+  } catch {
+    return false;
+  } finally {
+    lines.close();
+    input.destroy();
+  }
+  return sawSessionStart;
+}
+
+// src/storage/session-store/summary-builder.ts
+import { createReadStream as createReadStream8 } from "node:fs";
+import { createInterface as createInterface8 } from "node:readline";
 async function summarizeSessionFile(opts) {
   return summarizeSessionEventSequence({
     id: opts.id,
@@ -35152,8 +35275,8 @@ async function summarizeSessionEventSequence(opts) {
   }
 }
 async function* iterateSessionEvents(file, secretScrubber) {
-  const stream = createReadStream7(file, { encoding: "utf8" });
-  const lines = createInterface7({ input: stream, crlfDelay: Infinity });
+  const stream = createReadStream8(file, { encoding: "utf8" });
+  const lines = createInterface8({ input: stream, crlfDelay: Infinity });
   try {
     for await (const line of lines) {
       if (!line.trim()) continue;
@@ -36049,6 +36172,10 @@ var DefaultSessionStore = class _DefaultSessionStore {
     await deleteSessionArtifacts({ rootDir: this.dir, id, jsonlPath });
     await this.writeTombstone(id);
   }
+  async isEmpty(id) {
+    const canonicalId = await this.resolveId(id);
+    return isStrictlyEmptySessionFile(this.sessionPath(canonicalId, ".jsonl"));
+  }
   async delete(id) {
     if (this.catalogClient) {
       const canonical = await this.resolveId(id);
@@ -36703,6 +36830,12 @@ function normalizeModelRef(ref, defaultProvider) {
 function hasText(value) {
   return typeof value === "string" && value.trim().length > 0;
 }
+function asRefList(value) {
+  return Array.isArray(value) ? value : void 0;
+}
+function asProfileName(value) {
+  return hasText(value) ? value : void 0;
+}
 function providerHasKey(entry) {
   if (!entry) return false;
   if (hasText(entry.apiKey)) return true;
@@ -36713,7 +36846,7 @@ function providerHasKey(entry) {
 }
 function visibleProviderModels(config, providerId, providerModels) {
   const entry = config.providers?.[providerId];
-  return entry?.models !== void 0 ? [...entry.models] : providerModels;
+  return Array.isArray(entry?.models) ? [...entry.models] : providerModels;
 }
 function buildProfiles(config) {
   const entries = /* @__PURE__ */ new Map();
@@ -36750,13 +36883,34 @@ var FallbackProfileManager = class {
   listProfiles() {
     return Object.freeze([...this.profiles.keys()]);
   }
+  /**
+   * The profile the session has selected (`config.fallbackProfile`, set by
+   * `/fallback profile use <name>`), or undefined when none is selected or the
+   * name no longer resolves to a defined profile.
+   *
+   * Consulted by every resolution entry point when the caller does not name a
+   * profile itself. Without this the leader — which passes no profile — could
+   * never use a named profile at all: `config.fallbackProfiles` was reachable
+   * only by copying a chain into `fallbackModels`.
+   */
+  activeProfileName() {
+    const name = asProfileName(this.config.fallbackProfile);
+    return name && this.profiles.has(name) ? name : void 0;
+  }
   // ── Resolution ─────────────────────────────────────────────────────────
   /**
    * Resolve a named fallback profile to a validated, provider-filtered chain.
    *
-   * Returns an empty chain when:
-   * - The profile doesn't exist.
-   * - Every entry's provider is missing, has no key, or has no matching model.
+   * Returns an empty chain when the profile doesn't exist, or when every entry
+   * is excluded, quarantined, or blacked out.
+   *
+   * Filtering is intentionally identical to {@link resolveRefs} (the explicit
+   * `fallbackModels` path): the self-exclusion, the runtime status tracker,
+   * and the availability calendar — nothing else. Anything a named profile
+   * drops, an explicit chain drops too, and vice versa. Profiles used to apply
+   * two extra filters (provider "usability" and the `providers[].models`
+   * snapshot) that the explicit path did not, which silently rerouted roles
+   * pinned to a profile onto a different model than the one configured.
    *
    * @param name - Profile name from config.fallbackProfiles.
    * @param defaultProvider - Used when an entry has no explicit provider.
@@ -36777,13 +36931,9 @@ var FallbackProfileManager = class {
       if (seen.has(key)) continue;
       seen.add(key);
       if (excludeKey && key === excludeKey) continue;
-      const health = this.checkProvider(providerId);
-      if (!health.usable) continue;
       if (this.statusTracker && !this.statusTracker.isAvailable(providerId, parsed.model)) continue;
       if (!evaluateModelCalendar(this.config.modelAvailabilitySchedule, providerId, parsed.model).allowed)
         continue;
-      const allowedModels = this.config.providers?.[providerId]?.models;
-      if (allowedModels && !allowedModels.includes(parsed.model)) continue;
       resolved.push({
         providerId,
         model: parsed.model,
@@ -36801,12 +36951,14 @@ var FallbackProfileManager = class {
   resolveEffective(opts = {}) {
     const bridge = this.resolveBridge(opts.exclude);
     let selected = FREEZER_EMPTY;
-    if (opts.fallbackModels && opts.fallbackModels.length > 0) {
-      const resolved = this.resolveRefs(opts.fallbackModels, opts.exclude);
+    const explicitRefs = asRefList(opts.fallbackModels);
+    const profileName = asProfileName(opts.fallbackProfile) ?? this.activeProfileName();
+    if (explicitRefs && explicitRefs.length > 0) {
+      const resolved = this.resolveRefs(explicitRefs, opts.exclude);
       if (resolved.length > 0) selected = resolved;
     }
-    if (selected.length === 0 && opts.fallbackProfile) {
-      const resolved = this.resolve(opts.fallbackProfile, { exclude: opts.exclude });
+    if (selected.length === 0 && profileName) {
+      const resolved = this.resolve(profileName, { exclude: opts.exclude });
       if (resolved.length > 0) selected = resolved;
     }
     if (selected.length === 0 && opts.fallbackAuto !== false) {
@@ -36882,13 +37034,14 @@ var FallbackProfileManager = class {
     };
     const configFallbackAuto = this.config.fallbackAuto;
     const effectiveFallbackAuto = configFallbackAuto !== void 0 && configFallbackAuto !== null ? configFallbackAuto : !opts.closedWorld;
-    const explicitRefs = opts.fallbackModels ?? this.config.fallbackModels;
+    const explicitRefs = asRefList(opts.fallbackModels) ?? asRefList(this.config.fallbackModels);
+    const profileName = asProfileName(opts.fallbackProfile) ?? this.activeProfileName();
     const explicitUsable = explicitRefs !== void 0 && explicitRefs.length > 0 && this.resolveRefs(explicitRefs, current).length > 0;
-    const profileUsable = opts.fallbackProfile !== void 0 && this.hasProfile(opts.fallbackProfile) && this.resolve(opts.fallbackProfile, { exclude: current }).length > 0;
+    const profileUsable = profileName !== void 0 && this.hasProfile(profileName) && this.resolve(profileName, { exclude: current }).length > 0;
     const fromExplicitSource = explicitUsable || profileUsable;
-    const selectedChain = opts.closedWorld ? explicitRefs && explicitRefs.length > 0 ? this.resolveRefs(explicitRefs, current) : opts.fallbackProfile ? this.resolve(opts.fallbackProfile, { exclude: current }) : FREEZER_EMPTY : this.resolveEffective({
+    const selectedChain = opts.closedWorld ? explicitRefs && explicitRefs.length > 0 ? this.resolveRefs(explicitRefs, current) : profileName ? this.resolve(profileName, { exclude: current }) : FREEZER_EMPTY : this.resolveEffective({
       fallbackModels: explicitRefs,
-      fallbackProfile: opts.fallbackProfile,
+      fallbackProfile: profileName,
       fallbackAuto: effectiveFallbackAuto,
       exclude: current
     });
@@ -36905,7 +37058,7 @@ var FallbackProfileManager = class {
         });
       }
       candidates.push(...selectedChain);
-      if (!fromExplicitSource && effectiveFallbackAuto && opts.fallbackProfile !== "default") {
+      if (!fromExplicitSource && effectiveFallbackAuto && profileName !== "default") {
         candidates.push(...this.resolve("default", { exclude: current }));
       }
       if (!fromExplicitSource && effectiveFallbackAuto) {
@@ -36983,7 +37136,7 @@ var FallbackProfileManager = class {
     const leaderModel = this.config.model;
     const providers = this.config.providers ?? {};
     const favoriteSet = new Set(
-      (this.config.favoriteModels ?? []).map((ref) => {
+      (asRefList(this.config.favoriteModels) ?? []).map((ref) => {
         const p = parseModelRef(ref);
         return `${p.provider ?? leaderProvider}/${p.model}`;
       })
@@ -37094,9 +37247,15 @@ function effectiveFallbackChain(config) {
   const mgr = new FallbackProfileManager(config);
   return mgr.resolveEffective({
     fallbackModels: config.fallbackModels,
+    fallbackProfile: config.fallbackProfile,
     fallbackAuto: config.fallbackAuto
   }).map((e) => `${e.providerId}/${e.model}`);
 }
+function runtimeFallbackChain(config) {
+  const mgr = new FallbackProfileManager(config);
+  const current = primaryTarget(config);
+  return mgr.resolveCandidates(current, {}).map((e) => `${e.providerId}/${e.model}`);
+}
 var DEFAULT_PRIMARY_COOLDOWN_MS = 6e4;
 var DEFAULT_PRIMARY_COOLDOWN_MAX_MS = 10 * 6e4;
 var DEFAULT_PRIMARY_RECOVERY_SUCCESSES = 2;
@@ -37136,7 +37295,11 @@ function createFallbackModelExtension(deps) {
   let blockedPrimary;
   let primaryBlockedUntil = 0;
   const now = () => deps.now?.() ?? Date.now();
-  const cooldownBase = () => Math.max(0, deps.primaryCooldownMs ?? DEFAULT_PRIMARY_COOLDOWN_MS);
+  const liveStickiness = () => deps.getConfig().fallbackStickiness;
+  const cooldownBase = () => Math.max(
+    0,
+    deps.primaryCooldownMs ?? liveStickiness()?.primaryProbeInterval ?? DEFAULT_PRIMARY_COOLDOWN_MS
+  );
   const cooldownMax = () => Math.max(cooldownBase(), deps.primaryCooldownMaxMs ?? DEFAULT_PRIMARY_COOLDOWN_MAX_MS);
   const selectedPrimary = (cfg) => deps.getPrimaryTarget?.() ?? primaryTarget(cfg);
   const primaryInCooldown = (cfg) => sameTarget(blockedPrimary, selectedPrimary(cfg)) && now() < primaryBlockedUntil;
@@ -37155,7 +37318,7 @@ function createFallbackModelExtension(deps) {
     primaryBlockedUntil = now() + Math.min(cooldownMax(), base * multiplier);
   };
   const recoveryTarget = () => Math.max(1, deps.primaryRecoverySuccesses ?? DEFAULT_PRIMARY_RECOVERY_SUCCESSES);
-  const stickyTarget = () => Math.max(0, deps.stickyFallbackTurns ?? 0);
+  const stickyTarget = () => Math.max(0, deps.stickyFallbackTurns ?? liveStickiness()?.stickyFallbackTurns ?? 0);
   const inStickyWindow = () => stickyTurnsElapsed < stickyTarget();
   const onPrimarySuccess = (cfg) => {
     if (!sameTarget(blockedPrimary, selectedPrimary(cfg))) return;
@@ -46891,10 +47054,10 @@ var AdaptiveConcurrencyController = class {
 
 // src/coordination/agent-monitor.ts
 init_file_permissions();
-import { createReadStream as createReadStream8 } from "node:fs";
+import { createReadStream as createReadStream9 } from "node:fs";
 import * as fs28 from "node:fs/promises";
 import * as path69 from "node:path";
-import { createInterface as createInterface8 } from "node:readline";
+import { createInterface as createInterface9 } from "node:readline";
 var AgentMonitorService = class _AgentMonitorService {
   _fleetBus;
   _events;
@@ -47001,8 +47164,8 @@ var AgentMonitorService = class _AgentMonitorService {
     const accessible = await fs28.access(file).then(() => true).catch(() => false);
     if (!accessible) return [];
     const out = [];
-    const input = createReadStream8(file, { encoding: "utf8" });
-    const lines = createInterface8({ input, crlfDelay: Number.POSITIVE_INFINITY });
+    const input = createReadStream9(file, { encoding: "utf8" });
+    const lines = createInterface9({ input, crlfDelay: Number.POSITIVE_INFINITY });
     try {
       for await (const line of lines) {
         const trimmed = line.trim();
@@ -56651,6 +56814,12 @@ function findExchangeStart(messages, userIndex) {
 
 // src/execution/auto-compaction-middleware.ts
 var LEVEL_RANK2 = { warn: 0, soft: 1, hard: 2 };
+function pressureLevelFor(load, thresholds) {
+  if (load >= thresholds.hard) return "hard";
+  if (load >= thresholds.soft) return "soft";
+  if (load >= thresholds.warn) return "warn";
+  return null;
+}
 var MAX_DIGEST_LOG_CHARS = 4e3;
 function truncateDigest(digest2) {
   if (digest2.length <= MAX_DIGEST_LOG_CHARS) return digest2;
@@ -56696,8 +56865,19 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
    * 1 / 2.5 = 0.4.
    */
   static GUARD_GATE_LOAD = 0.4;
+  /**
+   * How much the context must grow between two history-rewriting hygiene
+   * passes, as a fraction of the available input window and as an absolute
+   * floor. Every pass rewrites already-transmitted messages, which forces the
+   * provider to re-cache the whole prompt; spacing the passes out is what lets
+   * the conversation prefix stay cached for the turns in between.
+   */
+  static HYGIENE_GROWTH_RATIO = 0.15;
+  static HYGIENE_MIN_GROWTH_TOKENS = 2e4;
   /** Tracks the most recent no-op attempt so we can avoid re-firing per turn. */
   lastNoopAttempt = null;
+  /** Context size at the last hygiene pass; anchors the growth interval. */
+  lastHygieneTokens = null;
   /**
    * Cached token estimate from the last handler() invocation. When the
    * message count and tool count haven't changed since the last estimate
@@ -56757,55 +56937,9 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
   handler() {
     return async (ctx, next) => {
       if (!this._enabled) return next(ctx);
-      const rawHygiene = eliseAcknowledgedToolResults(ctx.messages, {
-        maxRetainedTokens: this.resolveToolResultRetention(ctx)
-      });
-      const receiptHygiene = collapseAcknowledgedToolReceipts(rawHygiene.messages, {
-        maxPairs: this.resolveToolReceiptRetention(ctx)
-      });
-      if (rawHygiene.changed || receiptHygiene.changed) {
-        ctx.state.replaceMessages(receiptHygiene.messages);
-        ctx.clearFileTracking();
-        this.invalidateTokenCaches(ctx);
-      }
-      const msgCount = ctx.messages.length;
-      const toolCount = (ctx.tools ?? []).length;
-      const revision = ctx.state?.revision ?? -1;
-      let tokens;
-      const anchorAt = typeof ctx.meta?.["realAnchorMsgCount"] === "number" ? ctx.meta["realAnchorMsgCount"] : void 0;
-      const anchored = realAnchoredInputTokens(ctx.messages, ctx.lastRealInputTokens, anchorAt);
-      if (anchored !== null) {
-        tokens = anchored;
-      } else if (this._estimator) {
-        tokens = this._estimator(ctx);
-      } else if (msgCount === this._cachedMsgCount && toolCount === this._cachedToolCount && revision === this._cachedRevision && ctx.systemPrompt === this._cachedSystemRef && ctx.tools === this._cachedToolsRef && this._cachedTokens >= 0) {
-        tokens = this._cachedTokens;
-      } else if (this.tryStashedTokens(ctx, msgCount, toolCount, revision) !== null) {
-        const stashed = this.tryStashedTokens(ctx, msgCount, toolCount, revision);
-        const cal = getCalibrationState(`${ctx.provider?.id ?? "unknown"}/${ctx.model}`);
-        tokens = cal.calibrated ? Math.round(stashed * Math.min(1.5, Math.max(0.5, cal.ratio))) : stashed;
-        this._cachedTokens = tokens;
-        this._cachedMsgCount = msgCount;
-        this._cachedToolCount = toolCount;
-        this._cachedRevision = revision;
-        this._cachedSystemRef = ctx.systemPrompt;
-        this._cachedToolsRef = ctx.tools;
-      } else {
-        tokens = estimateRequestTokensCalibrated(
-          ctx.messages,
-          ctx.systemPrompt,
-          ctx.tools ?? [],
-          `${ctx.provider?.id ?? "unknown"}/${ctx.model}`
-        ).total;
-        this._cachedTokens = tokens;
-        this._cachedMsgCount = msgCount;
-        this._cachedToolCount = toolCount;
-        this._cachedRevision = revision;
-        this._cachedSystemRef = ctx.systemPrompt;
-        this._cachedToolsRef = ctx.tools;
-      }
+      let tokens = this.estimateContextTokens(ctx);
       const runtimeMaxContext = effectiveMaxContext(ctx, this._maxContext);
-      const budget = computeContextWindowBudget(ctx, tokens, runtimeMaxContext);
+      let budget = computeContextWindowBudget(ctx, tokens, runtimeMaxContext);
       const calibratedLoad = budget.load;
       const policy = this.policyProvider?.(ctx);
       const thresholds = policy?.thresholds ?? {
@@ -56819,22 +56953,27 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
       });
       const aggressiveOn = policy?.aggressiveOn ?? this.aggressiveOn;
       const targetLoad = normalizeTargetLoad(policy?.targetLoad, adaptiveThresholds);
-      let load = calibratedLoad;
-      if (calibratedLoad >= _AutoCompactionMiddleware.GUARD_GATE_LOAD) {
-        const guardTotal = estimateRequestTokensUpperBound(
-          ctx.messages,
-          ctx.systemPrompt,
-          ctx.tools ?? [],
-          `${ctx.provider?.id ?? "unknown"}/${ctx.model}`
-        ).total;
-        const guardLoad = guardTotal / budget.availableInputTokens;
-        if (guardLoad > load) load = guardLoad;
-      }
-      const level = load >= adaptiveThresholds.hard ? "hard" : load >= adaptiveThresholds.soft ? "soft" : load >= adaptiveThresholds.warn ? "warn" : null;
+      let load = this.applySendGuard(ctx, calibratedLoad, budget.availableInputTokens);
+      let level = pressureLevelFor(load, adaptiveThresholds);
       if (!level) {
         this.lastNoopAttempt = null;
         return next(ctx);
       }
+      if (this.shouldRunHygiene(level, tokens, budget.availableInputTokens)) {
+        const changed = this.runHistoryHygiene(ctx);
+        tokens = changed ? this.estimateContextTokens(ctx) : tokens;
+        this.lastHygieneTokens = tokens;
+        if (changed) {
+          budget = computeContextWindowBudget(ctx, tokens, runtimeMaxContext);
+          load = this.applySendGuard(ctx, budget.load, budget.availableInputTokens);
+          const relevelled = pressureLevelFor(load, adaptiveThresholds);
+          if (!relevelled) {
+            this.lastNoopAttempt = null;
+            return next(ctx);
+          }
+          level = relevelled;
+        }
+      }
       if (this.shouldSkipNoopRetry(level, tokens)) {
         return next(ctx);
       }
@@ -56851,6 +56990,123 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
       return next(ctx);
     };
   }
+  /**
+   * Full-request token total for the current context.
+   *
+   * Reuses the last estimate when the context hasn't grown since the previous
+   * check — common in autonomous idle loops. The cached value is invalidated
+   * whenever messages or tools change.
+   *
+   * IMPORTANT: the cache is only valid for the deterministic
+   * `estimateRequestTokensCalibrated` path (messages+system+tools → fixed
+   * output). When a custom `_estimator` is provided (e.g. in tests with a
+   * mutable closure, or a dynamic policy provider), always call it fresh — the
+   * estimator owns its own semantics and the middleware cannot safely cache its
+   * result across calls.
+   */
+  estimateContextTokens(ctx) {
+    const msgCount = ctx.messages.length;
+    const toolCount = (ctx.tools ?? []).length;
+    const revision = ctx.state?.revision ?? -1;
+    const anchorAt = typeof ctx.meta?.["realAnchorMsgCount"] === "number" ? ctx.meta["realAnchorMsgCount"] : void 0;
+    const anchored = realAnchoredInputTokens(ctx.messages, ctx.lastRealInputTokens, anchorAt);
+    if (anchored !== null) return anchored;
+    if (this._estimator) return this._estimator(ctx);
+    if (msgCount === this._cachedMsgCount && toolCount === this._cachedToolCount && revision === this._cachedRevision && ctx.systemPrompt === this._cachedSystemRef && ctx.tools === this._cachedToolsRef && this._cachedTokens >= 0) {
+      return this._cachedTokens;
+    }
+    const stashed = this.tryStashedTokens(ctx, msgCount, toolCount, revision);
+    let tokens;
+    if (stashed !== null) {
+      const cal = getCalibrationState(`${ctx.provider?.id ?? "unknown"}/${ctx.model}`);
+      tokens = cal.calibrated ? Math.round(stashed * Math.min(1.5, Math.max(0.5, cal.ratio))) : stashed;
+    } else {
+      tokens = estimateRequestTokensCalibrated(
+        ctx.messages,
+        ctx.systemPrompt,
+        ctx.tools ?? [],
+        `${ctx.provider?.id ?? "unknown"}/${ctx.model}`
+      ).total;
+    }
+    this._cachedTokens = tokens;
+    this._cachedMsgCount = msgCount;
+    this._cachedToolCount = toolCount;
+    this._cachedRevision = revision;
+    this._cachedSystemRef = ctx.systemPrompt;
+    this._cachedToolsRef = ctx.tools;
+    return tokens;
+  }
+  /**
+   * Never-undercount send guard.
+   *
+   * The calibrated estimate can under-count dense content (CJK, base64,
+   * minified) by >1.5×, which would let an over-limit request slip past the
+   * thresholds and reach the provider. Once the calibrated load is high enough
+   * that even the max density factor (2.5×) *could* overflow (load ≥ 1/2.5 =
+   * 0.4), re-check with the upper-bound estimator and escalate to whichever
+   * load is larger. Below 0.4 an overflow is arithmetically impossible, so the
+   * extra scan is skipped.
+   */
+  applySendGuard(ctx, calibratedLoad, availableInputTokens) {
+    if (calibratedLoad < _AutoCompactionMiddleware.GUARD_GATE_LOAD) return calibratedLoad;
+    const guardTotal = estimateRequestTokensUpperBound(
+      ctx.messages,
+      ctx.systemPrompt,
+      ctx.tools ?? [],
+      `${ctx.provider?.id ?? "unknown"}/${ctx.model}`
+    ).total;
+    const guardLoad = guardTotal / availableInputTokens;
+    return guardLoad > calibratedLoad ? guardLoad : calibratedLoad;
+  }
+  /**
+   * Rewrite acknowledged tool protocol in place.
+   *
+   * Tool results are protocol inputs for the immediately following model
+   * response, not unlimited durable prompt memory. Once a later assistant
+   * message proves the provider consumed them, keep a mode-sized raw window and
+   * replace the rest with semantic head/tail receipts, then fold fully-aged
+   * pairs into the history digest.
+   *
+   * Every one of those edits touches a message the provider has already seen,
+   * so each call costs a full prompt re-cache — it belongs behind
+   * {@link shouldRunHygiene}, never on the per-turn path. Content staleness is
+   * not a reason to bypass that gate: the edit/replace tools guard against
+   * acting on an out-of-date read with their own mtime + sha-256 check.
+   *
+   * @returns whether the conversation was rewritten.
+   */
+  runHistoryHygiene(ctx) {
+    const raw = eliseAcknowledgedToolResults(ctx.messages, {
+      maxRetainedTokens: this.resolveToolResultRetention(ctx)
+    });
+    const receipts = collapseAcknowledgedToolReceipts(raw.messages, {
+      maxPairs: this.resolveToolReceiptRetention(ctx)
+    });
+    if (!raw.changed && !receipts.changed) return false;
+    ctx.state.replaceMessages(receipts.messages);
+    ctx.clearFileTracking();
+    this.invalidateTokenCaches(ctx);
+    return true;
+  }
+  /**
+   * Whether the history-rewriting hygiene pass may run this turn.
+   *
+   * Hard pressure always runs it — staying under the window outranks caching.
+   * Otherwise it runs at most once per growth interval, so the conversation
+   * stays append-only (and therefore cacheable by the provider) in between.
+   */
+  shouldRunHygiene(level, tokens, availableInputTokens) {
+    if (level === "hard") return true;
+    const last = this.lastHygieneTokens;
+    if (last === null) return true;
+    const anchor = Math.min(last, tokens);
+    this.lastHygieneTokens = anchor;
+    const interval = Math.max(
+      _AutoCompactionMiddleware.HYGIENE_MIN_GROWTH_TOKENS,
+      Math.floor(availableInputTokens * _AutoCompactionMiddleware.HYGIENE_GROWTH_RATIO)
+    );
+    return tokens - anchor >= interval;
+  }
   /**
    * H1: try to read a pre-computed token total from `ctx.lastRequestTokens`
    * (set by the agent loop's pre-flight or its restash in emitContextPct).
@@ -61663,26 +61919,29 @@ var DefaultProviderRunner = class {
 // src/execution/retry-policy.ts
 import { randomInt } from "node:crypto";
 var MAX_RETRY_AFTER_MS = 6e4;
+var MODEL_RETRIES = 3;
 var MAX_ATTEMPTS_BY_KIND = {
-  rate_limit: 5,
+  rate_limit: MODEL_RETRIES,
+  overloaded: MODEL_RETRIES,
+  server: MODEL_RETRIES,
+  timeout: MODEL_RETRIES,
+  network: MODEL_RETRIES,
+  stream_hang: MODEL_RETRIES,
   quota_exhausted: 0,
-  stream_hang: 2,
-  // proxy-level timeout — retrying 5x wastes ~40s before fallback kicks in
-  overloaded: 3,
-  server: 3,
-  timeout: 2,
-  network: 2,
   auth: 0,
   invalid_request: 0,
   context_overflow: 0,
   content_filter: 0,
   unknown: 0
 };
+var FAILOVER_RETRY_AFTER_MS = 15e3;
 var DefaultRetryPolicy = class {
   shouldRetry(err, attempt) {
     const isProviderErr = err instanceof ProviderError || ProviderError.isProviderError(err);
     if (isProviderErr) {
       if (!err.retryable) return false;
+      const hint = retryAfterMsFromError(err);
+      if (hint !== void 0 && hint >= FAILOVER_RETRY_AFTER_MS) return false;
       return attempt < this.maxAttempts(err);
     }
     const msg = err.message ?? "";
@@ -63237,7 +63496,8 @@ async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
         decision: "block",
         reason: "Active card is not implementation-ready: " + readiness.issues.map((issue) => issue.message).join(" | "),
         boardId: board.id,
-        taskId: task.id
+        taskId: task.id,
+        readinessIssues: readiness.issues
       };
     }
     if (task.lifecycle?.currentStage !== "running" || task.assignment?.status !== "running") {
@@ -64047,7 +64307,8 @@ ${errorDetails}`,
           type: "tool_result",
           tool_use_id: use.id,
           content: `Tool "${tool.name}" blocked by Kanban boundary. ${boundary.reason ?? ""}`.trim(),
-          is_error: true
+          is_error: true,
+          _kanbanBoundary: boundary
         };
         budget = this.budgetForString(result.content, budget);
         return { result, tool, durationMs: Date.now() - start };
@@ -67090,7 +67351,7 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
 };
 
 // src/security/permission-helpers.ts
-import { realpathSync as realpathSync2 } from "node:fs";
+import { realpathSync as realpathSync3 } from "node:fs";
 import * as path86 from "node:path";
 function matchesTrust(patterns, subject2) {
   return patterns.includes(subject2) || matchAny(patterns, subject2);
@@ -67175,7 +67436,7 @@ function realpathOfNearestExisting(p) {
   const tail = [];
   for (; ; ) {
     try {
-      return tail.length === 0 ? realpathSync2(probe2) : path86.join(realpathSync2(probe2), ...tail);
+      return tail.length === 0 ? realpathSync3(probe2) : path86.join(realpathSync3(probe2), ...tail);
     } catch {
       const parent = path86.dirname(probe2);
       if (parent === probe2) return p;
@@ -83344,6 +83605,156 @@ var CLOUD_SYNC_CONTRACT = {
   "extensions.plugins": EXTENSIONS_PLUGINS_TREE
 };
 var CLOUD_SYNC_NAMESPACES = Object.keys(CLOUD_SYNC_CONTRACT);
+var INBOUND_DENIED_PATHS = [
+  // ── Code execution ──────────────────────────────────────────────────────
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.command",
+    reason: "Executable spawned for a stdio MCP server."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.args",
+    reason: "Argv for that executable."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.transport",
+    reason: "Switching transport to stdio selects the spawning code path."
+  },
+  {
+    namespace: "extensions.plugins",
+    path: "plugins",
+    reason: "Plugin list is resolved and `await import`ed."
+  },
+  // `extensions` is deliberately NOT denied: it is per-plugin settings read via
+  // `ConfigStore.getExtension(name)`, not a loader list, so it grants no import.
+  // Syncing it is the feature (`extensions.telegram.notifyChatId` and friends).
+  // Residual risk accepted: a plugin whose own settings include a URL can have
+  // that URL rewritten by the portal. Constrain that in the plugin's
+  // `configSchema`, which is where the loader validates it.
+  // ── Credential redirection / exfiltration ───────────────────────────────
+  {
+    namespace: "providers.catalog",
+    path: "providers.*.baseUrl",
+    reason: "Repoints the provider endpoint; reinjectLocalSecrets keeps the local apiKey, so the real key follows the redirect."
+  },
+  {
+    namespace: "providers.catalog",
+    path: "providers.*.envVars",
+    reason: "Chooses which environment variable is read for the key."
+  },
+  {
+    namespace: "providers.catalog",
+    path: "providers.*.activeKey",
+    reason: "Selects which stored key is sent."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.url",
+    reason: "Remote MCP endpoint; receives whatever the transport carries."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.envVars",
+    reason: "Names of environment variables forwarded to the server process."
+  },
+  // ── Operator-owned safety switches ──────────────────────────────────────
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.permission",
+    reason: "Approval requirement for that server\u2019s tools."
+  },
+  { namespace: "core.runtime", path: "yolo", reason: "Disables every permission prompt." },
+  {
+    namespace: "core.runtime",
+    path: "features.allowOutsideProjectRoot",
+    reason: "Short-circuits project-root containment and the symlink realpath check."
+  },
+  {
+    namespace: "core.runtime",
+    path: "tools.restrictToProjectRoot",
+    reason: "The other half of the filesystem confinement switch."
+  },
+  {
+    namespace: "core.runtime",
+    path: "features.developerMode",
+    reason: "Loosens guardrails; an operator opt-in, not a synced preference."
+  },
+  {
+    namespace: "core.runtime",
+    path: "tools.disabledTools",
+    reason: "Could re-enable a tool the operator deliberately switched off."
+  },
+  {
+    namespace: "ui.preferences",
+    path: "autonomy.defaultMode",
+    reason: "Autonomy is user-owned, never remote-owned."
+  },
+  {
+    namespace: "ui.preferences",
+    path: "autonomy.yolo",
+    reason: "Alias for the denied top-level `yolo`, and it wins over the user setting."
+  },
+  {
+    namespace: "ui.preferences",
+    path: "launch.autonomy",
+    reason: "Launch-time autonomy mode; same user-owned boundary."
+  },
+  {
+    namespace: "models.routing",
+    path: "brain.mode",
+    reason: "Selects the policy/LLM/human decision ladder."
+  },
+  {
+    namespace: "models.routing",
+    path: "brain.maxAutoRisk",
+    reason: "The risk ceiling below which actions proceed without asking."
+  }
+];
+function contractHasPath(tree, segments) {
+  if (segments.length === 0) return true;
+  if (tree === true) return false;
+  const [head, ...rest] = segments;
+  if (head === void 0 || !Object.hasOwn(tree, head)) return false;
+  const child = tree[head];
+  return child === void 0 ? false : contractHasPath(child, rest);
+}
+function pruneContractPath(tree, segments) {
+  if (tree === true || segments.length === 0) return tree;
+  const [head, ...rest] = segments;
+  if (head === void 0 || !Object.hasOwn(tree, head)) return tree;
+  const next = { ...tree };
+  if (rest.length === 0) {
+    delete next[head];
+    return next;
+  }
+  const child = next[head];
+  if (child === void 0) return tree;
+  next[head] = pruneContractPath(child, rest);
+  return next;
+}
+function assertInboundDenyListResolves() {
+  const unresolved = INBOUND_DENIED_PATHS.filter((entry) => {
+    const tree = CLOUD_SYNC_CONTRACT[entry.namespace];
+    return tree === void 0 || !contractHasPath(tree, entry.path.split("."));
+  });
+  if (unresolved.length > 0) {
+    throw new Error(
+      "INBOUND_DENIED_PATHS entr(ies) no longer resolve against CLOUD_SYNC_CONTRACT \u2014 a rename would silently re-open them: " + unresolved.map((entry) => `${entry.namespace}:${entry.path}`).join(", ")
+    );
+  }
+}
+var INBOUND_CONTRACT = (() => {
+  assertInboundDenyListResolves();
+  const out = { ...CLOUD_SYNC_CONTRACT };
+  for (const entry of INBOUND_DENIED_PATHS) {
+    const tree = out[entry.namespace];
+    if (tree === void 0) continue;
+    out[entry.namespace] = pruneContractPath(tree, entry.path.split("."));
+  }
+  return out;
+})();
 var NAMESPACE_SCHEMA_VERSIONS = {
   "core.runtime": 1,
   "ui.preferences": 1,
@@ -83445,7 +83856,7 @@ function mergeAtContract(local, incoming, tree) {
   return base;
 }
 function applyNamespacePayload(config, namespace, payload) {
-  const tree = CLOUD_SYNC_CONTRACT[namespace];
+  const tree = INBOUND_CONTRACT[namespace];
   if (!tree || tree === true) return config;
   const next = { ...config };
   for (const [key, incoming] of Object.entries(payload)) {
@@ -89672,8 +90083,8 @@ var SessionRegistry = class {
           if (id !== entry.sessionId) delete registry2[id];
           continue;
         }
-        const heartbeatAge = now - new Date(existing.lastHeartbeatAt).getTime();
-        if (heartbeatAge > PID_CHECK_AFTER_MS && !pidAlive2(existing.pid)) {
+        const heartbeatAt = Date.parse(existing.lastHeartbeatAt);
+        if (!Number.isFinite(heartbeatAt) || now - heartbeatAt > PID_CHECK_AFTER_MS && !pidAlive2(existing.pid)) {
           delete registry2[id];
         }
       }
@@ -91569,6 +91980,15 @@ async function readProviderSnapshot(configPath, vault, warn) {
     snapshot.fallbackBridge = decrypted.fallbackBridge.trim();
   }
   if (decrypted.fallbackProfiles) snapshot.fallbackProfiles = decrypted.fallbackProfiles;
+  if (typeof decrypted.fallbackProfile === "string" && decrypted.fallbackProfile.trim()) {
+    snapshot.fallbackProfile = decrypted.fallbackProfile.trim();
+  }
+  if (decrypted.fallbackStickiness && typeof decrypted.fallbackStickiness === "object") {
+    snapshot.fallbackStickiness = decrypted.fallbackStickiness;
+  }
+  if (typeof decrypted.fallbackMaxLastResortCandidates === "number" && Number.isFinite(decrypted.fallbackMaxLastResortCandidates)) {
+    snapshot.fallbackMaxLastResortCandidates = decrypted.fallbackMaxLastResortCandidates;
+  }
   if (Array.isArray(decrypted.favoriteModels)) snapshot.favoriteModels = decrypted.favoriteModels;
   if (typeof decrypted.favoriteModelsOnly === "boolean")
     snapshot.favoriteModelsOnly = decrypted.favoriteModelsOnly;
@@ -91587,10 +92007,13 @@ function serializeSnapshot(s) {
     fallbackModels: s.fallbackModels ?? null,
     fallbackBridge: s.fallbackBridge ?? null,
     fallbackProfiles: s.fallbackProfiles ?? null,
+    fallbackProfile: s.fallbackProfile ?? null,
     favoriteModels: s.favoriteModels ?? null,
     favoriteModelsOnly: s.favoriteModelsOnly ?? null,
     modelMatrix: s.modelMatrix ?? null,
     fallbackAuto: s.fallbackAuto ?? null,
+    fallbackStickiness: s.fallbackStickiness ?? null,
+    fallbackMaxLastResortCandidates: s.fallbackMaxLastResortCandidates ?? null,
     modelAvailabilitySchedule: s.modelAvailabilitySchedule ?? null
   });
 }
@@ -92076,10 +92499,10 @@ var ReplayLogStore = class _ReplayLogStore {
 };
 
 // src/storage/session-recovery.ts
-import { createReadStream as createReadStream9 } from "node:fs";
+import { createReadStream as createReadStream10 } from "node:fs";
 import * as fs67 from "node:fs/promises";
 import * as path122 from "node:path";
-import { createInterface as createInterface9 } from "node:readline";
+import { createInterface as createInterface10 } from "node:readline";
 var SessionRecovery = class _SessionRecovery {
   constructor(dir) {
     this.dir = dir;
@@ -92156,8 +92579,8 @@ var SessionRecovery = class _SessionRecovery {
     let lastCheckpoint = null;
     let latestBoundary = null;
     let sawEvent = false;
-    const stream = createReadStream9(fp, { encoding: "utf8" });
-    const lines = createInterface9({ input: stream, crlfDelay: Infinity });
+    const stream = createReadStream10(fp, { encoding: "utf8" });
+    const lines = createInterface10({ input: stream, crlfDelay: Infinity });
     try {
       for await (const line of lines) {
         if (!line.trim()) continue;
@@ -92316,10 +92739,10 @@ async function applyRewindToConversation(opts) {
 init_errors();
 init_atomic_write();
 init_error();
-import { createReadStream as createReadStream10 } from "node:fs";
+import { createReadStream as createReadStream11 } from "node:fs";
 import * as fsp44 from "node:fs/promises";
 import * as path123 from "node:path";
-import { createInterface as createInterface10 } from "node:readline";
+import { createInterface as createInterface11 } from "node:readline";
 var DefaultSessionRewinder = class {
   constructor(sessionsDir, projectRoot) {
     this.sessionsDir = sessionsDir;
@@ -92331,8 +92754,8 @@ var DefaultSessionRewinder = class {
     return sessionScopedPath(this.sessionsDir, sessionId, ".jsonl");
   }
   async *readEvents(file) {
-    const stream = createReadStream10(file, { encoding: "utf8" });
-    const lines = createInterface10({ input: stream, crlfDelay: Infinity });
+    const stream = createReadStream11(file, { encoding: "utf8" });
+    const lines = createInterface11({ input: stream, crlfDelay: Infinity });
     try {
       for await (const line of lines) {
         if (!line.trim()) continue;
@@ -93964,6 +94387,30 @@ var PROVIDER_MANAGE_SCHEMA = {
   required: ["action"],
   additionalProperties: false
 };
+var CREDENTIAL_SELECTOR_FIELDS = ["apiKey", "apiKeys", "activeKey", "envVars"];
+function envVarsClaimedByOtherProviders(providers, exceptProvider) {
+  const claimed = /* @__PURE__ */ new Map();
+  for (const [id, entry] of Object.entries(providers)) {
+    if (id === exceptProvider) continue;
+    const names = entry?.["envVars"];
+    if (!Array.isArray(names)) continue;
+    for (const name of names) {
+      if (typeof name === "string" && !claimed.has(name)) claimed.set(name, id);
+    }
+  }
+  return claimed;
+}
+function rejectBorrowedEnvVars(providers, provider, requested) {
+  if (!requested) return null;
+  const claimed = envVarsClaimedByOtherProviders(providers, provider);
+  for (const name of requested) {
+    const owner = typeof name === "string" ? claimed.get(name) : void 0;
+    if (owner !== void 0) {
+      return `Environment variable "${String(name)}" already supplies the key for provider "${owner}". Reading another provider's credential from "${provider}" is not allowed; use provider_key_set to give "${provider}" its own key.`;
+    }
+  }
+  return null;
+}
 function validateProviderBaseUrl(raw) {
   let url;
   try {
@@ -94034,6 +94481,8 @@ ${msg}`,
           const invalid2 = validateProviderBaseUrl(input.baseUrl);
           if (invalid2) return { status: "error", message: invalid2 };
         }
+        const borrowed = rejectBorrowedEnvVars(providers, input.provider, input.envVars);
+        if (borrowed) return { status: "error", message: borrowed };
         const entry = { type: input.type };
         if (input.models) entry.models = input.models;
         if (input.baseUrl) entry.baseUrl = input.baseUrl;
@@ -94067,14 +94516,22 @@ ${msg}`,
         if (input.autoDiscoverModels !== void 0) entry.autoDiscoverModels = input.autoDiscoverModels;
         if (input.apiKey !== void 0) entry.apiKey = input.apiKey || void 0;
         const endpointChanged = input.baseUrl !== void 0 && (entry.baseUrl ?? void 0) !== (previous.baseUrl ?? void 0);
-        const keyDropped = endpointChanged && input.apiKey === void 0 && previous.apiKey !== void 0;
-        if (keyDropped) entry.apiKey = void 0;
+        const explicitlySupplied = /* @__PURE__ */ new Set([
+          ...input.apiKey !== void 0 ? ["apiKey"] : [],
+          ...input.envVars !== void 0 ? ["envVars"] : []
+        ]);
+        const droppedFields = endpointChanged ? CREDENTIAL_SELECTOR_FIELDS.filter(
+          (field) => !explicitlySupplied.has(field) && previous[field] !== void 0
+        ) : [];
+        for (const field of droppedFields) entry[field] = void 0;
+        const borrowed = rejectBorrowedEnvVars(providers, input.provider, input.envVars);
+        if (borrowed) return { status: "error", message: borrowed };
         providers[input.provider] = entry;
         await opts.updateConfig((cfg) => {
           cfg.providers = providers;
         });
         const updated = Object.keys({ ...entry }).filter((k) => k !== "apiKey").join(", ");
-        const keyNote = keyDropped ? " \u2014 stored API key cleared because the base URL changed; set it again with provider_key_set" : "";
+        const keyNote = droppedFields.length > 0 ? ` \u2014 cleared ${droppedFields.join(", ")} because the base URL changed; set the key again with provider_key_set` : "";
         return { status: "ok", message: `\u2713 Updated ${input.provider}: ${updated}${keyNote}` };
       }
       if (input.action === "remove") {
@@ -97015,6 +97472,7 @@ export {
   runShellHook,
   runWithNetworkTelemetry,
   runWithProcessTelemetry,
+  runtimeFallbackChain,
   safeEmit,
   safeParse,
   safeProfileName,