@wrongstack/core 0.308.7 → 0.309.1

package/dist/defaults/index.js

@@ -356,6 +356,46 @@ function createMessage(type, from, payload, to) {
   };
 }
 
+// src/core/btw.ts
+var META_KEY = "_btwNotes";
+var MAX_PENDING = 20;
+function readQueue(ctx) {
+  const raw = ctx.meta[META_KEY];
+  return Array.isArray(raw) ? raw : [];
+}
+function setBtwNote(ctx, text) {
+  const trimmed = text.trim();
+  if (!trimmed) return readQueue(ctx).length;
+  const next = [...readQueue(ctx), trimmed].slice(-MAX_PENDING);
+  ctx.meta[META_KEY] = next;
+  return next.length;
+}
+
+// src/coordination/subagent-finish.ts
+var SUBAGENT_FINISH_REQUESTED_EVENT = "subagent.finish_requested";
+var DEFAULT_SUBAGENT_FINISH_GRACE_MS = 12e4;
+function resolveGracefulFinish(config) {
+  const raw = config.gracefulFinish;
+  if (raw === void 0 || raw === false) return void 0;
+  if (raw === true) return { graceMs: DEFAULT_SUBAGENT_FINISH_GRACE_MS };
+  const graceMs = typeof raw.graceMs === "number" && Number.isFinite(raw.graceMs) && raw.graceMs > 0 ? Math.floor(raw.graceMs) : DEFAULT_SUBAGENT_FINISH_GRACE_MS;
+  return { graceMs };
+}
+function buildSubagentFinishNotice(input) {
+  const localTime = new Date(input.deadlineMs).toISOString();
+  const seconds = Math.max(1, Math.round(input.graceMs / 1e3));
+  const timeLeft = input.graceMs > 0 ? `You have roughly ${seconds} seconds (until ${localTime}) of legitimate working time left.` : `Your working-time window is already spent (deadline was ${localTime}) \u2014 finish now.`;
+  return [
+    "[SUBAGENT FINISH] The leader agent has finished its work.",
+    `Reason: ${input.reason}`,
+    timeLeft,
+    "Finish your task now, in this turn: complete the thought you are working on, stop",
+    "starting new tool calls unless one is strictly required to finish, and write your",
+    "final answer or report as your final output, then end your turn.",
+    "Do not restart the task and do not begin new work."
+  ].join("\n");
+}
+
 // src/coordination/subagent-budget.ts
 var TIMEOUT_PREEMPT_FRACTION = 0.85;
 var DECISION_TIMEOUT_MS = 6e4;
@@ -413,6 +453,82 @@ var SubagentBudget = class _SubagentBudget {
       this.limits.idleTimeoutMs = ext.idleTimeoutMs;
     }
   }
+  /**
+   * Graceful-finish state (see coordination/subagent-finish.ts).
+   * `_finishNotified` guards the single in-band emission; `_grace` records a
+   * granted working-time extension past the original wall-clock deadline.
+   * They are separate because the two callers want different semantics:
+   * the watchdog grants grace at the deadline crossing (notify + extend),
+   * while an explicit leader-finished request only notifies — a subagent
+   * well inside its budget keeps its full legitimate working time and simply
+   * accelerates.
+   */
+  _finishNotified = false;
+  _grace = null;
+  /** True once the in-band finish notification has been emitted. */
+  get finishNotified() {
+    return this._finishNotified;
+  }
+  /** True once a grace window has been granted past the original deadline. */
+  get graceGranted() {
+    return this._grace !== null;
+  }
+  /**
+   * Notify the subagent in-band to finish its task in its own turn:
+   * `subagent.finish_requested` is emitted on the wired EventBus and the
+   * agent loop folds the notice into the conversation between tool batches.
+   * Nothing aborts — this is a notification, never an interrupt.
+   *
+   * `opts.graceMs` additionally extends the wall-clock ceiling by that window
+   * (used by the watchdog at a deadline crossing, so the model gets working
+   * time instead of a kill). Omit it to notify without touching the budget —
+   * the subagent keeps its existing time budget and just accelerates.
+   *
+   * Returns `true` when this call did something (emitted the notification
+   * and/or granted grace); `false` when there was nothing to do (already
+   * notified, grace already granted, no EventBus wired, budget not started).
+   */
+  notifyFinish(reason, opts, now = Date.now) {
+    if (!this._events) return false;
+    if (this.startTime === null) return false;
+    const shouldEmit = !this._finishNotified;
+    const rawGrace = opts?.graceMs;
+    const shouldGrant = rawGrace !== void 0 && this._grace === null;
+    if (!shouldEmit && !shouldGrant) return false;
+    let grantedGraceMs = 0;
+    let graceDeadlineMs;
+    if (shouldGrant && rawGrace !== void 0) {
+      grantedGraceMs = Number.isFinite(rawGrace) && rawGrace > 0 ? Math.floor(rawGrace) : DEFAULT_SUBAGENT_FINISH_GRACE_MS;
+      graceDeadlineMs = now() + grantedGraceMs;
+      this._grace = { deadlineMs: graceDeadlineMs, graceMs: grantedGraceMs };
+      this.patchLimits({ timeoutMs: graceDeadlineMs - this.startTime });
+    }
+    if (shouldEmit) {
+      this._finishNotified = true;
+      const effectiveDeadlineMs = graceDeadlineMs ?? (this.limits.timeoutMs !== void 0 ? this.startTime + this.limits.timeoutMs : now() + DEFAULT_SUBAGENT_FINISH_GRACE_MS);
+      const effectiveGraceMs = Math.max(0, effectiveDeadlineMs - now());
+      const subagentId = this._subagentId;
+      this._events.emit(SUBAGENT_FINISH_REQUESTED_EVENT, {
+        // Omitted entirely when the budget was built without an id — an
+        // empty string is an address that matches nothing.
+        ...subagentId !== void 0 ? { subagentId } : {},
+        reason,
+        deadlineMs: effectiveDeadlineMs,
+        graceMs: effectiveGraceMs,
+        notice: buildSubagentFinishNotice({
+          reason,
+          deadlineMs: effectiveDeadlineMs,
+          graceMs: effectiveGraceMs
+        })
+      });
+    }
+    return true;
+  }
+  /** Epoch ms by which the subagent should have produced its final output,
+   *  once a grace window was granted. Undefined before that. */
+  get finishDeadlineMs() {
+    return this._grace?.deadlineMs;
+  }
   iterations = 0;
   toolCalls = 0;
   tokenInput = 0;
@@ -428,6 +544,10 @@ var SubagentBudget = class _SubagentBudget {
   lastActivityTime = null;
   _onThreshold;
   _sessionId;
+  /** Owning subagent id — used to address the graceful-finish event. */
+  _subagentId;
+  /** True when only the coordinator watchdog may enforce wall-clock limits. */
+  _wallClockWatchdogOwned;
   /**
    * Hard cap on how long `_negotiateExtension` waits for the coordinator to
    * respond before defaulting to 'stop'. Without this fallback an absent
@@ -499,6 +619,8 @@ var SubagentBudget = class _SubagentBudget {
   constructor(limits = {}, mode = "auto", options = {}) {
     this._mode = mode;
     this._sessionId = options.sessionId;
+    this._subagentId = options.subagentId;
+    this._wallClockWatchdogOwned = options.wallClockWatchdogOwned === true;
     this.limits = { ...limits };
   }
   currentSessionId() {
@@ -577,7 +699,7 @@ var SubagentBudget = class _SubagentBudget {
       if (this.limits.idleTimeoutMs !== void 0 && idle > this.limits.idleTimeoutMs) {
         exceeded.push({ kind: "idle_timeout", used: idle, limit: this.limits.idleTimeoutMs });
       }
-      const wallOwnedByWatchdog = this._onThreshold !== void 0 && this._watchdogActive === this.limits.timeoutMs;
+      const wallOwnedByWatchdog = this._wallClockWatchdogOwned || this._onThreshold !== void 0 && this._watchdogActive === this.limits.timeoutMs;
       if (this.limits.timeoutMs !== void 0 && elapsedMs2 > this.limits.timeoutMs && !wallOwnedByWatchdog) {
         exceeded.push({ kind: "timeout", used: elapsedMs2, limit: this.limits.timeoutMs });
       }
@@ -776,7 +898,7 @@ var SubagentBudget = class _SubagentBudget {
     if (timeoutMs === void 0 && idleTimeoutMs === void 0) return;
     const elapsed = Date.now() - this.startTime;
     const wallSkipped = this._onThreshold !== void 0 && this._watchdogActive !== void 0 && timeoutMs !== void 0 && this._watchdogActive === timeoutMs;
-    const wallTripped = wallSkipped ? false : timeoutMs !== void 0 && elapsed > timeoutMs;
+    const wallTripped = this._wallClockWatchdogOwned || wallSkipped ? false : timeoutMs !== void 0 && elapsed > timeoutMs;
     const idleTripped = idleTimeoutMs !== void 0 && this.idleMs() > idleTimeoutMs;
     if (!wallTripped && !idleTripped) return;
     void this.checkLimits(elapsed);
@@ -1178,6 +1300,14 @@ function makeAgentSubagentRunner(opts) {
     );
     const onParentAbort = () => aborter.abort();
     ctx.signal.addEventListener("abort", onParentAbort);
+    if (resolveGracefulFinish(ctx.config)) {
+      unsub.push(
+        events.on("subagent.finish_requested", (e) => {
+          if (e.subagentId && e.subagentId !== ctx.subagentId) return;
+          setBtwNote(agent.ctx, e.notice);
+        })
+      );
+    }
     let result;
     try {
       result = await agent.run(format(task, ctx.config), { signal: aborter.signal });
@@ -5440,6 +5570,22 @@ var EXPLORE_COMPANION_AGENT = {
   textStream: "silent",
   toolStream: "silent"
 };
+var CHAOS_MONKEY_AGENT = {
+  ...defineAgent("chaos-monkey", "Chaos Monkey"),
+  tools: [...TOOLS.build],
+  skillNames: ["testing", "typescript-strict"],
+  spawnBudgetExempt: true,
+  // Run in the live checkout: mutation targets are usually freshly
+  // written and uncommitted — a worktree spawned from HEAD would not
+  // contain them and every mutant would drift. The mutation_test tool
+  // honors this value as its default; callers can still override per
+  // call via its `chaosWorktree` input when targets are committed and
+  // isolation is wanted.
+  worktree: "off",
+  // Report travels via submit_result + final text, not the leader's stream.
+  textStream: "silent",
+  toolStream: "silent"
+};
 var CRITIC_AGENT = defineAgent("critic", "Critic");
 var GENERIC_AGENT = defineAgent("generic", "Generic Project Agent");
 function withDispatchMetadata(definition) {
@@ -5459,6 +5605,7 @@ var FLEET_ROSTER = {
   generic: GENERIC_AGENT,
   "shadow-agent": SHADOW_AGENT,
   "explore-companion": EXPLORE_COMPANION_AGENT,
+  "chaos-monkey": CHAOS_MONKEY_AGENT,
   ...Object.fromEntries(
     ALL_AGENT_DEFINITIONS.map((d) => [d.config.role, withDispatchMetadata(d)])
   )
@@ -5489,6 +5636,16 @@ var FLEET_ROSTER_BUDGETS = {
     maxTokens: 96e3,
     maxCostUsd: 0.5
   },
+  "chaos-monkey": {
+    // A mutation pass is many short apply/run/restore cycles — per-mutant
+    // work is tiny, but a large plan (25 mutants/file × N files) needs
+    // headroom. Idle-based reaping covers a stalled pass.
+    idleTimeoutMs: DEFAULT_IDLE_TIMEOUT_MS,
+    maxIterations: 2e3,
+    maxToolCalls: 6e3,
+    maxTokens: 96e3,
+    maxCostUsd: 0.5
+  },
   ...Object.fromEntries(
     ALL_AGENT_DEFINITIONS.map((d) => [d.config.role, d.budget])
   )
@@ -6228,7 +6385,7 @@ async function readSubagentPartial(opts, subagentId) {
 }
 
 // src/coordination/director.ts
-import { randomUUID as randomUUID12 } from "node:crypto";
+import { randomUUID as randomUUID13 } from "node:crypto";
 import * as fsp25 from "node:fs/promises";
 
 // src/core/instruction-template.ts
@@ -8244,7 +8401,7 @@ ${JSON.stringify(result.result, null, 2)}
 };
 
 // src/coordination/director-tools.ts
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 import {
   completeKanbanDispatch,
   failKanbanDispatch,
@@ -9444,6 +9601,626 @@ function excerpt(text, max) {
 ...(truncated)`;
 }
 
+// src/coordination/director-mutation-test-tool.ts
+import { randomUUID as randomUUID8 } from "node:crypto";
+import { readFileSync as readFileSync9 } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join10 } from "node:path";
+
+// src/coordination/mutation-engine.ts
+var TOKEN_PATTERNS = [
+  {
+    kind: "relax-boundary",
+    // `>` not followed by `=` and not part of `=>` or `>>`; require code-ish
+    // context on both sides so generic text (JSX, strings) is not touched.
+    regex: /(?<=[\w\)\]\}'"`])\s*\x20?(?<op>>(?!=|>))/g,
+    replace: () => ">="
+  },
+  {
+    kind: "tighten-boundary",
+    regex: /(?<=[\w\)\]\}'"`])\s*\x20?(?<op>>=)/g,
+    replace: () => ">"
+  },
+  {
+    kind: "arith-plus-to-minus",
+    // `+` between operands (binary), not `++`, unary `+x`, or `+=`.
+    regex: /(?<=[\w\)\]\}'"`])\s*\x20?(?<op>\+(?!\+|=))/g,
+    replace: () => "-"
+  },
+  {
+    kind: "arith-minus-to-plus",
+    // Binary `-` between operands, not `--`, `-=` or negative-number literal.
+    regex: /(?<=[\w\)\]\}'"`])\s*\x20?(?<op>-(?!-|=))/g,
+    replace: () => "+"
+  },
+  {
+    kind: "negate-boolean",
+    // Standalone boolean literals used as values, not property names.
+    regex: /(?<![.\w$])(?<op>true|false)(?![\w$])/g,
+    replace: (m) => m === "true" ? "false" : "true"
+  },
+  {
+    kind: "return-null",
+    // `return <expr>;` where expr is not already null/undefined/void.
+    regex: /(?<indent>\breturn\b)(?<expr>\s+[^;{}\n]+?)\s*;/g,
+    replace: () => "return null;",
+    endpointsInCode: true
+  }
+];
+function planMutations(file, source, opts = {}) {
+  const maxPerFile = opts.maxPerFile ?? 25;
+  const out = [];
+  const lines = source.split("\n");
+  const masks = computeLineMasks(source);
+  for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+    const line = lines[lineIdx];
+    const t = line.trim();
+    if (t.startsWith("//")) continue;
+    const codeRanges = masks[lineIdx];
+    const inCode = (start) => codeRanges.some(([s, e]) => start >= s && start < e);
+    for (const pattern of TOKEN_PATTERNS) {
+      pattern.regex.lastIndex = 0;
+      let m;
+      while ((m = pattern.regex.exec(line)) !== null) {
+        const token = m.groups?.["op"] ?? m[0];
+        const tokenStart = m.index + m[0].indexOf(token);
+        if (!inCode(tokenStart)) continue;
+        if (pattern.endpointsInCode && !inCode(tokenStart + token.length - 1)) continue;
+        const original = line.slice(tokenStart, tokenStart + token.length);
+        const replacement = pattern.replace(token);
+        if (replacement === original) continue;
+        out.push({
+          id: `${pattern.kind}#${lineIdx + 1}#${tokenStart + 1}`,
+          kind: pattern.kind,
+          file,
+          line: lineIdx + 1,
+          column: tokenStart + 1,
+          original,
+          replacement
+        });
+      }
+    }
+    if (out.length >= maxPerFile) break;
+  }
+  return out.slice(0, maxPerFile);
+}
+function computeLineMasks(source) {
+  const lines = source.split("\n");
+  const masks = lines.map(() => []);
+  const stack = [{ kind: "code", depth: 0, parens: [] }];
+  let inBlockComment = false;
+  let lastToken = null;
+  for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+    const line = lines[lineIdx];
+    const ranges = masks[lineIdx];
+    let runStart = null;
+    const closeRun = (end) => {
+      if (runStart !== null && end > runStart) ranges.push([runStart, end]);
+      runStart = null;
+    };
+    let i = 0;
+    if (inBlockComment) {
+      const close = line.indexOf("*/");
+      if (close === -1) continue;
+      inBlockComment = false;
+      i = close + 2;
+    }
+    while (i < line.length) {
+      const top = stack[stack.length - 1];
+      const c = line[i];
+      if (top.kind === "template") {
+        if (c === "\\") {
+          i += 2;
+          continue;
+        }
+        if (c === "`") {
+          stack.pop();
+          lastToken = "`";
+          i++;
+          continue;
+        }
+        if (c === "$" && line[i + 1] === "{") {
+          stack.push({ kind: "code", depth: 0, parens: [] });
+          lastToken = "${";
+          i += 2;
+          continue;
+        }
+        i++;
+        continue;
+      }
+      if (/[\w$]/.test(c)) {
+        let j = i + 1;
+        while (j < line.length && /[\w$]/.test(line[j])) j++;
+        lastToken = line.slice(i, j);
+        if (runStart === null) runStart = i;
+        i = j;
+        continue;
+      }
+      if (c === "'" || c === '"') {
+        closeRun(i);
+        i++;
+        while (i < line.length && line[i] !== c) {
+          if (line[i] === "\\") i++;
+          i++;
+        }
+        i++;
+        lastToken = c;
+        continue;
+      }
+      if (c === "`") {
+        closeRun(i);
+        stack.push({ kind: "template", depth: 0, parens: [] });
+        i++;
+        continue;
+      }
+      if (c === "/" && line[i + 1] === "/") {
+        closeRun(i);
+        break;
+      }
+      if (c === "/" && line[i + 1] === "*") {
+        closeRun(i);
+        const close = line.indexOf("*/", i + 2);
+        if (close === -1) {
+          inBlockComment = true;
+          break;
+        }
+        i = close + 2;
+        continue;
+      }
+      if (c === "/") {
+        if (!tokenCanEndOperand(lastToken)) {
+          closeRun(i);
+          const next = skipRegexLiteral(line, i);
+          lastToken = next > i + 1 ? "regex" : "/";
+          i = next;
+          continue;
+        }
+      }
+      if (c === "(") {
+        top.parens.push(CONTROL_KEYWORDS.has(lastToken ?? "") ? "control" : "expr");
+        lastToken = c;
+      } else if (c === ")") {
+        const kind = top.parens.pop() ?? "expr";
+        lastToken = kind === "control" ? "control-paren-close" : ")";
+      } else if (c === "{") {
+        top.depth++;
+        lastToken = c;
+      } else if (c === "}") {
+        if (top.depth > 0) {
+          top.depth--;
+          lastToken = c;
+        } else if (stack.length > 1) {
+          closeRun(i);
+          stack.pop();
+          i++;
+          continue;
+        } else {
+          lastToken = c;
+        }
+      } else if (c !== " " && c !== "	" && c !== "\r") {
+        lastToken = c;
+      }
+      if (runStart === null) runStart = i;
+      i++;
+    }
+    closeRun(line.length);
+  }
+  return masks;
+}
+var KEYWORDS_BEFORE_REGEX = /* @__PURE__ */ new Set([
+  "return",
+  "typeof",
+  "instanceof",
+  "in",
+  "of",
+  "new",
+  "delete",
+  "void",
+  "throw",
+  "case",
+  "do",
+  "else",
+  "yield",
+  "await"
+]);
+var CONTROL_KEYWORDS = /* @__PURE__ */ new Set(["if", "for", "while", "switch", "catch", "with", "await"]);
+function tokenCanEndOperand(token) {
+  if (token === null) return false;
+  if (/^[\w$]+$/.test(token)) return !KEYWORDS_BEFORE_REGEX.has(token);
+  return token === ")" || token === "]" || token === "." || token === '"' || token === "'" || token === "`";
+}
+function skipRegexLiteral(line, start) {
+  let i = start + 1;
+  let inClass = false;
+  while (i < line.length) {
+    const ch = line[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]") inClass = false;
+      i++;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      i++;
+      continue;
+    }
+    if (ch === "/") {
+      i++;
+      break;
+    }
+    if (ch === "\n" || ch === "\r") return line.length;
+    i++;
+  }
+  while (i < line.length && /[a-z]/.test(line[i])) i++;
+  return i;
+}
+function parseMutationReport(text) {
+  const candidates = [];
+  const fence = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+  if (fence?.[1]) candidates.push(fence[1].trim());
+  const firstBrace = text.indexOf("{");
+  if (firstBrace >= 0) candidates.push(extractBalancedObject(text, firstBrace));
+  for (const candidate of candidates) {
+    if (!candidate) continue;
+    try {
+      const parsed = JSON.parse(candidate);
+      if (!Array.isArray(parsed.mutants)) continue;
+      return {
+        mutants: parsed.mutants.map(normalizeMutantEntry).filter((x) => Boolean(x)),
+        summary: typeof parsed.summary === "string" ? parsed.summary : void 0
+      };
+    } catch {
+    }
+  }
+  return void 0;
+}
+function extractBalancedObject(text, start) {
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let i = start; i < text.length; i++) {
+    const c = text[i];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (c === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (c === '"') inString = !inString;
+    if (inString) continue;
+    if (c === "{") depth++;
+    else if (c === "}") {
+      depth--;
+      if (depth === 0) return text.slice(start, i + 1);
+    }
+  }
+  return text.slice(start);
+}
+function normalizeMutantEntry(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const rec = value;
+  const id = typeof rec["id"] === "string" ? rec["id"] : void 0;
+  const status = rec["status"];
+  if (!id || status !== "killed" && status !== "survived" && status !== "skipped" && status !== "killed-by-hang") {
+    return void 0;
+  }
+  return {
+    id,
+    file: typeof rec["file"] === "string" ? rec["file"] : "",
+    line: typeof rec["line"] === "number" ? rec["line"] : 0,
+    kind: typeof rec["kind"] === "string" ? rec["kind"] : "",
+    status,
+    evidence: typeof rec["evidence"] === "string" ? rec["evidence"] : void 0
+  };
+}
+
+// src/coordination/director-mutation-test-tool.ts
+var DEFAULT_MAX_PER_FILE = 10;
+var DEFAULT_MAX_STRENGTHEN_ATTEMPTS = 2;
+var CHAOS_ROLE = "chaos-monkey";
+function makeMutationTestTool(director, roster, opts = {}) {
+  return {
+    name: "mutation_test",
+    description: "Chaos Monkey mutation testing: deterministically sabotage boundary conditions in the target code (> to >=, + to -, boolean flips, return null), re-run the tests per mutant, and report which mutants were killed. Surviving mutants mean the tests are weak \u2014 optionally loop a strengthen-tests repair until they die.",
+    usageHint: "Use after writing new code AND its tests, before delivering. Pass targets (files) and testCommand. Provide repairSubagentId to auto-strengthen weak tests. Survivors that persist are reported as suspected-equivalent.",
+    permission: "auto",
+    mutating: false,
+    capabilities: [ToolCapabilities.SUBAGENT_SPAWN],
+    inputSchema: {
+      type: "object",
+      properties: {
+        targets: {
+          type: "array",
+          items: { type: "string" },
+          description: "Project-relative (or absolute) source files to mutate. Keep to files changed by the current task."
+        },
+        testCommand: {
+          type: "string",
+          description: 'Exact command that runs the relevant tests, e.g. "pnpm exec vitest run packages/core/tests/coordination/mutation-engine.test.ts".'
+        },
+        cwd: { type: "string", description: "Working directory for the test command." },
+        maxPerFile: {
+          type: "number",
+          minimum: 1,
+          maximum: 25,
+          description: "Mutant cap per file per pass. Default 10."
+        },
+        maxStrengthenAttempts: {
+          type: "number",
+          minimum: 0,
+          maximum: 5,
+          description: "Strengthen\u2192re-verify rounds. Default 2 when repairSubagentId is set, else 0."
+        },
+        repairSubagentId: {
+          type: "string",
+          description: "Subagent that owns the tests. When set and mutants survive, it receives a strengthen-tests task and the survivors are re-verified."
+        },
+        chaosWorktree: {
+          anyOf: [{ type: "boolean" }, { type: "string", enum: ["auto", "required", "off"] }],
+          description: "Worktree override for the chaos agent. Defaults to the roster policy for chaos-monkey ('off'), because mutation targets are usually freshly written and uncommitted \u2014 a worktree from HEAD would not contain them and every mutant would drift to skipped. Only pass 'auto' or 'required' when the targets are committed."
+        },
+        timeoutMs: { type: "number", minimum: 1, description: "Per-task timeout for chaos/strengthen/rerun tasks." },
+        reportOnly: {
+          type: "boolean",
+          description: "Skip the strengthen loop even when survivors exist. Default false."
+        }
+      },
+      required: ["targets", "testCommand"],
+      additionalProperties: false
+    },
+    async execute(input, ctx) {
+      const i = normalizeMutationTestInput(input);
+      const root = opts.projectRoot ?? ctx.projectRoot;
+      const plan = buildPlan(i, root);
+      if (plan.length === 0) {
+        return {
+          verdict: "inconclusive",
+          passed: false,
+          error: "No mutable sites found in the given targets (after comment/string filtering)."
+        };
+      }
+      const chaosBase = roster?.[CHAOS_ROLE];
+      if (!chaosBase) {
+        return {
+          verdict: "inconclusive",
+          passed: false,
+          error: "chaos-monkey role missing from the roster \u2014 refusing to spawn a saboteur without its prompt/tools contract. Build the toolset with a roster that includes 'chaos-monkey' (FLEET_ROSTER does)."
+        };
+      }
+      const chaosSubagentId = await director.spawn(
+        makeChaosConfig(chaosBase, i.chaosWorktree ?? chaosBase.worktree ?? "off")
+      );
+      const chaosTaskId = await director.assign({
+        id: randomUUID8(),
+        subagentId: chaosSubagentId,
+        description: buildChaosTask(plan, i, 1, []),
+        timeoutMs: i.timeoutMs
+      });
+      const [chaosResult] = await director.awaitTasks([chaosTaskId]);
+      const pass1 = collectOutcomes(chaosResult, plan);
+      const survivors = pass1.filter((m) => m.status === "survived");
+      const maxAttempts = clamp(
+        i.maxStrengthenAttempts ?? (i.repairSubagentId && !i.reportOnly ? DEFAULT_MAX_STRENGTHEN_ATTEMPTS : 0),
+        0,
+        5
+      );
+      const attempts = [];
+      let current = survivors;
+      let rerunUnknowns = [];
+      while (current.length > 0 && attempts.length < maxAttempts && i.repairSubagentId) {
+        const attemptNo = attempts.length + 1;
+        const strengthenTaskId = await director.assign({
+          id: randomUUID8(),
+          subagentId: i.repairSubagentId,
+          description: buildStrengthenTask(current, i, attemptNo),
+          timeoutMs: i.timeoutMs
+        });
+        const [strengthenResult] = await director.awaitTasks([strengthenTaskId]);
+        if (strengthenResult?.status !== "success") {
+          attempts.push({
+            attempt: attemptNo,
+            survivorsBefore: current,
+            strengthenResult: strengthenResult ? { taskId: strengthenResult.taskId, status: strengthenResult.status } : void 0,
+            survivorsAfter: current,
+            suspectedEquivalent: []
+          });
+          break;
+        }
+        const survivorPlan = plan.filter((p) => current.some((s) => s.id === p.id));
+        const rerunSubagentId = await director.spawn(
+          makeChaosConfig(chaosBase, i.chaosWorktree ?? chaosBase.worktree ?? "off")
+        );
+        const rerunTaskId = await director.assign({
+          id: randomUUID8(),
+          subagentId: rerunSubagentId,
+          description: buildChaosTask(survivorPlan, i, attemptNo + 1, current),
+          timeoutMs: i.timeoutMs
+        });
+        const [rerunResult] = await director.awaitTasks([rerunTaskId]);
+        const passN = collectOutcomes(rerunResult, survivorPlan);
+        const stillSurviving = passN.filter((m) => !isKill(m.status));
+        rerunUnknowns = passN.filter((m) => m.status === "skipped");
+        attempts.push({
+          attempt: attemptNo,
+          survivorsBefore: current,
+          strengthenResult: { taskId: strengthenResult.taskId, status: strengthenResult.status },
+          rerunResult: { taskId: rerunTaskId, status: rerunResult?.status ?? "unknown" },
+          survivorsAfter: stillSurviving,
+          suspectedEquivalent: stillSurviving.filter((m) => m.status === "survived" && current.some((c) => c.id === m.id)).map((m) => m.id)
+        });
+        current = stillSurviving;
+      }
+      const finalSurvivors = current.filter((m) => m.status === "survived");
+      const verifiedCount = pass1.filter((m) => m.status !== "skipped").length;
+      const skippedCount = pass1.filter((m) => m.status === "skipped").length;
+      const rerunUnknownCount = rerunUnknowns.length;
+      const score = plan.length === 0 ? 0 : pass1.filter((m) => isKill(m.status)).length / plan.length;
+      const verdict = verifiedCount === 0 ? "inconclusive" : finalSurvivors.length === 0 ? skippedCount > 0 || rerunUnknownCount > 0 ? "partial" : "pass" : score >= 0.8 ? "partial" : "fail";
+      return {
+        verdict,
+        passed: verdict === "pass",
+        mutationScore: Number.parseFloat(score.toFixed(3)),
+        planned: plan.length,
+        killed: pass1.filter((m) => isKill(m.status)).length,
+        // Breakout of `killed`: how many kills were detected by the test
+        // command hanging rather than by a failing assertion. A subset of
+        // `killed`, surfaced so a director can distinguish a hang-heavy
+        // suite (mutants breaking termination, not assertions) from an
+        // assertion-strong one. hangHeavy = killedByHang === killed.
+        killedByHang: pass1.filter((m) => m.status === "killed-by-hang").length,
+        survived: pass1.filter((m) => m.status === "survived").length,
+        skipped: pass1.filter((m) => m.status === "skipped").length,
+        finalSurvivors: finalSurvivors.map((m) => ({ id: m.id, file: m.file, kind: m.kind })),
+        suspectedEquivalent: attempts.flatMap((a) => a.suspectedEquivalent),
+        strengthenAttempts: attempts.length,
+        attempts,
+        chaosTaskId,
+        // Unverified leftovers from the strengthen loop: surfaced so the
+        // caller can see WHICH mutants lack kill evidence, and counted by
+        // the verdict gate above.
+        unverifiedFromRerun: rerunUnknowns.map((m) => ({ id: m.id, file: m.file, kind: m.kind })),
+        nextAction: finalSurvivors.length === 0 && rerunUnknownCount === 0 && skippedCount === 0 ? "accept" : attempts.length >= maxAttempts && i.repairSubagentId ? "manual_review_survivors" : "strengthen_tests"
+      };
+    }
+  };
+}
+function normalizeMutationTestInput(input) {
+  const raw = input ?? {};
+  const targets = stringArray2(raw["targets"]) ?? [];
+  const testCommand = typeof raw["testCommand"] === "string" ? raw["testCommand"].trim() : "";
+  return {
+    targets: targets.filter(Boolean),
+    testCommand,
+    cwd: typeof raw["cwd"] === "string" && raw["cwd"].trim() ? raw["cwd"].trim() : void 0,
+    maxPerFile: typeof raw["maxPerFile"] === "number" ? raw["maxPerFile"] : void 0,
+    maxStrengthenAttempts: typeof raw["maxStrengthenAttempts"] === "number" ? raw["maxStrengthenAttempts"] : void 0,
+    repairSubagentId: typeof raw["repairSubagentId"] === "string" && raw["repairSubagentId"].trim() ? raw["repairSubagentId"].trim() : void 0,
+    chaosWorktree: normalizeWorktreeOverride(raw["chaosWorktree"]),
+    timeoutMs: typeof raw["timeoutMs"] === "number" ? raw["timeoutMs"] : void 0,
+    reportOnly: raw["reportOnly"] === true
+  };
+}
+function clamp(n, lo, hi) {
+  return Math.min(hi, Math.max(lo, n));
+}
+function buildPlan(i, projectRoot) {
+  const plan = [];
+  for (const target of i.targets) {
+    const abs = isAbsolute2(target) ? target : join10(projectRoot ?? process.cwd(), target);
+    let source;
+    try {
+      source = readFileSync9(abs, "utf8");
+    } catch {
+      continue;
+    }
+    plan.push(...planMutations(target, source, { maxPerFile: i.maxPerFile ?? DEFAULT_MAX_PER_FILE }));
+  }
+  return plan;
+}
+function makeChaosConfig(base, worktree) {
+  return { ...instantiateRosterConfig2(CHAOS_ROLE, base), worktree };
+}
+function buildChaosTask(plan, i, pass, priorSurvivors) {
+  const mutants = plan.map(
+    (m) => `- ${m.id} | ${m.file}:${m.line}:${m.column} | ${m.kind} | "${m.original}" -> "${m.replacement}"`
+  ).join("\n");
+  const prior = priorSurvivors.length > 0 ? `
+These mutants survived a previous pass (pass ${pass - 1}) \u2014 re-verify them against the STRENGTHENED tests:
+${priorSurvivors.map((s) => `- ${s.id} (${s.kind} @ ${s.file}:${s.line})`).join("\n")}` : "";
+  return [
+    "Execute this deterministic mutation plan against the current checkout.",
+    "",
+    "For each mutant, in order:",
+    "1. Apply ONLY that mutation at its exact (file, line, column).",
+    `2. Run the test command: ${i.testCommand}${i.cwd ? ` (cwd: ${i.cwd})` : ""}`,
+    "3. Record killed (tests failed \u2014 quote first failing assertion), survived (suite green), or killed-by-hang (the test command timed out or was aborted \u2014 the mutation broke the suite by non-termination; record the timeout as evidence, do NOT report it as survived).",
+    "4. Restore the file byte-for-byte before the next mutant.",
+    "",
+    "Mutants:",
+    mutants,
+    prior,
+    "",
+    "Rules: one mutation at a time; never stack; if the anchored token no longer matches, mark skipped with the drift as evidence; do not fix or refactor anything; stay inside the plan.",
+    "Finish with submit_result, then repeat the same JSON as your final text."
+  ].join("\n");
+}
+function buildStrengthenTask(survivors, i, attempt) {
+  const confirmed = survivors.filter((s) => s.status === "survived");
+  const unverified = survivors.filter((s) => s.status === "skipped");
+  const row = (s) => `- ${s.id} | ${s.file}:${s.line} | ${s.kind}${s.evidence ? ` | ${s.evidence}` : ""}`;
+  return [
+    `Strengthen the tests so the mutants below die (attempt ${attempt}).`,
+    "",
+    ...confirmed.length > 0 ? [
+      "CONFIRMED SURVIVORS \u2014 each was a deliberate sabotage of production code that the current suite did NOT catch:",
+      ...confirmed.map(row),
+      ""
+    ] : [],
+    ...unverified.length > 0 ? [
+      "UNVERIFIED \u2014 these mutations were never actually re-tested (the re-verify pass skipped or did not report them). Do NOT assume the suite misses them: first apply each mutation, run the tests, and confirm it really survives; if the tests already fail, report that instead of writing new assertions.",
+      ...unverified.map(row),
+      ""
+    ] : [],
+    `Test command that must fail under each CONFIRMED mutant: ${i.testCommand}`,
+    "",
+    "For each CONFIRMED survivor add or tighten exactly one assertion that pins the sabotaged boundary/behavior. Do not change production code. Do not weaken other tests. Run the suite green on clean code before finishing."
+  ].join("\n");
+}
+function collectOutcomes(result, plan) {
+  const fromText = parseTextOutcomes(result);
+  if (fromText.length > 0) {
+    const remaining = [...plan];
+    const matched = [];
+    for (const m of fromText) {
+      const idx = remaining.findIndex((p) => p.id === m.id);
+      if (idx === -1) continue;
+      remaining.splice(idx, 1);
+      matched.push(m);
+    }
+    if (matched.length > 0) {
+      const missing = remaining.map((p) => ({
+        id: p.id,
+        file: p.file,
+        line: p.line,
+        kind: p.kind,
+        status: "skipped",
+        evidence: "not reported by chaos task"
+      }));
+      return [...matched, ...missing];
+    }
+  }
+  return plan.map((p) => ({
+    id: p.id,
+    file: p.file,
+    line: p.line,
+    kind: p.kind,
+    status: "skipped",
+    evidence: result ? `chaos task ended ${result.status}` : "chaos task produced no result"
+  }));
+}
+function isKill(status) {
+  return status === "killed" || status === "killed-by-hang";
+}
+function parseTextOutcomes(result) {
+  const text = typeof result?.result === "string" ? result.result : void 0;
+  if (!text) return [];
+  const parsed = parseMutationReport(text);
+  if (!parsed) return [];
+  return parsed.mutants.map((m) => ({
+    id: m.id,
+    file: m.file,
+    line: m.line,
+    kind: m.kind,
+    status: m.status,
+    evidence: m.evidence
+  }));
+}
+
 // src/coordination/director-tools.ts
 function makeSpawnTool(director, roster) {
   const dispatchCatalog = () => {
@@ -9736,7 +10513,7 @@ function makeKanbanQueueTool(director, roster) {
         try {
           const config = buildKanbanSubagentConfig(claim.task, i, roster, instantiateRosterConfig2);
           subagentId = await director.spawn(config);
-          const dispatchTaskId = randomUUID8();
+          const dispatchTaskId = randomUUID9();
           const taskSpec = {
             id: dispatchTaskId,
             subagentId,
@@ -10012,6 +10789,7 @@ function buildDirectorToolset(director, roster) {
     makeAskResultTool(director),
     makeRollUpTool(director),
     makeQualityGateTool(director, roster),
+    makeMutationTestTool(director, roster),
     makeTerminateTool(director),
     makeTerminateAllTool(director),
     makeFleetTool(director),
@@ -10098,7 +10876,7 @@ import * as fsp24 from "node:fs/promises";
 import * as path26 from "node:path";
 
 // src/storage/session-store.ts
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 import * as fsp23 from "node:fs/promises";
 import * as path25 from "node:path";
 
@@ -10130,6 +10908,14 @@ var PATTERNS = [
     anchor: "sk-ant-"
   },
   { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
   { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
   { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
   { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
@@ -10220,8 +11006,8 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
   },
   {
     type: "json_credential_key",
@@ -10338,6 +11124,27 @@ var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
+  const head = text.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
 var PATTERN_ANCHORS = [
   ...new Set(
     PATTERNS.flatMap(
@@ -10374,6 +11181,7 @@ var DefaultSecretScrubber = class {
           }
         }
         end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text, i, end);
       }
       out.push(this.scrubOne(text.slice(i, end)));
       i = end;
@@ -14205,9 +15013,21 @@ function renderCommandLine(command, args) {
   });
   return [command, ...rendered].join(" ");
 }
-function subjectForToolInput(toolName, input, subjectKey) {
+function renderSubjectFields(obj, fields) {
+  const parts = [];
+  for (const field of fields) {
+    const value = obj[field];
+    if (value === void 0 || value === null || value === "" || value === false) continue;
+    const str = String(value);
+    parts.push(`${field}=${/\s/.test(str) ? `"${str.replace(/"/g, '\\"')}"` : str}`);
+  }
+  return parts.join(" ");
+}
+function subjectForToolInput(toolName, input, subjectKey, subjectFields) {
   if (!input || typeof input !== "object") return void 0;
   const obj = input;
+  const extra = subjectFields && subjectFields.length > 0 ? renderSubjectFields(obj, subjectFields) : "";
+  const withExtra = (base) => extra ? `${base} ${extra}` : base;
   if (subjectKey) {
     const value = obj[subjectKey];
     if (Array.isArray(value)) {
@@ -14223,9 +15043,9 @@ function subjectForToolInput(toolName, input, subjectKey) {
       if (subjectKey === "command") {
         const rendered = renderCommandLine(value, obj["args"]);
         if (value === "commit" && obj["dry_run"] === true) {
-          return `${escapeGlobSubject(rendered)}:dry-run`;
+          return `${escapeGlobSubject(withExtra(rendered))}:dry-run`;
         }
-        return escapeGlobSubject(rendered);
+        return escapeGlobSubject(withExtra(rendered));
       }
       if (subjectKey === "directory" && obj["dry_run"] === true) {
         return `${escapeGlobSubject(value)}:dry-run`;
@@ -15417,7 +16237,7 @@ var FileSessionWriter = class _FileSessionWriter {
 
 // src/storage/session-checkpoint-cas.ts
 import { spawn as spawn2 } from "node:child_process";
-import { createHash as createHash3, randomUUID as randomUUID9 } from "node:crypto";
+import { createHash as createHash3, randomUUID as randomUUID10 } from "node:crypto";
 import * as fsp10 from "node:fs/promises";
 import * as path17 from "node:path";
 
@@ -15675,7 +16495,7 @@ var SessionCheckpointCas = class {
     }
     const temp = path17.join(
       path17.dirname(target),
-      `.${path17.basename(target)}.${process.pid}.${randomUUID9()}.tmp`
+      `.${path17.basename(target)}.${process.pid}.${randomUUID10()}.tmp`
     );
     let handle;
     try {
@@ -17482,7 +18302,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
   onAppend;
   onAppendBatch;
   catalogClient;
-  maintenanceHolderId = randomUUID10();
+  maintenanceHolderId = randomUUID11();
   _loadCache = /* @__PURE__ */ new Map();
   loadCache = new SessionLoadCache(this._loadCache);
   _indexCache = null;
@@ -18993,7 +19813,7 @@ function hashStr(s) {
 }
 
 // src/coordination/multi-agent-coordinator.ts
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 import { EventEmitter as EventEmitter2 } from "node:events";
 
 // src/coordination/coordinator/error-classifier.ts
@@ -19084,7 +19904,8 @@ async function executeSubagentWithTimeout({
   budget,
   preemptFraction = TIMEOUT_PREEMPT_FRACTION,
   abortSubagent,
-  currentSessionId
+  currentSessionId,
+  gracefulFinish
 }) {
   const initialTimeoutMs = budget.limits.timeoutMs;
   const idleLimitMs = budget.limits.idleTimeoutMs;
@@ -19115,9 +19936,17 @@ async function executeSubagentWithTimeout({
     const scheduleNext = () => {
       const wallLimit = budget.limits.timeoutMs ?? initialTimeoutMs;
       const wallRemaining = initialTimeoutMs === void 0 ? Number.POSITIVE_INFINITY : wallLimit - (Date.now() - start);
-      const idleRemaining = idleLimitMs === void 0 ? Number.POSITIVE_INFINITY : (budget.limits.idleTimeoutMs ?? idleLimitMs) - budget.idleMs();
-      const preemptRemaining = initialTimeoutMs === void 0 || preemptedCeiling === wallLimit ? Number.POSITIVE_INFINITY : wallLimit * preemptFraction - (Date.now() - start);
-      armFor(Math.max(25, Math.min(wallRemaining, idleRemaining, preemptRemaining)));
+      const idleRemaining = idleLimitMs === void 0 || gracefulFinish !== void 0 && initialTimeoutMs !== void 0 ? Number.POSITIVE_INFINITY : (budget.limits.idleTimeoutMs ?? idleLimitMs) - budget.idleMs();
+      const preemptRemaining = initialTimeoutMs === void 0 || preemptedCeiling === wallLimit || gracefulFinish !== void 0 ? Number.POSITIVE_INFINITY : wallLimit * preemptFraction - (Date.now() - start);
+      const next = Math.min(wallRemaining, idleRemaining, preemptRemaining);
+      if (!Number.isFinite(next)) {
+        if (timer) {
+          clearTimeout(timer);
+          timer = null;
+        }
+        return;
+      }
+      armFor(Math.max(25, next));
     };
     const negotiateTimeout = async (used, limit) => {
       const handler = budget.onThreshold;
@@ -19166,6 +19995,10 @@ async function executeSubagentWithTimeout({
       const wallExceeded = wallLimit !== void 0 && elapsed >= wallLimit;
       const idleExceeded = idleLimit !== void 0 && budget.idleMs() >= idleLimit;
       if (idleExceeded && !wallExceeded) {
+        if (gracefulFinish !== void 0 && initialTimeoutMs !== void 0) {
+          scheduleNext();
+          return;
+        }
         const sessionId = currentSessionId();
         budget._events?.emit("budget.threshold_reached", {
           ...sessionId ? { sessionId } : {},
@@ -19182,7 +20015,7 @@ async function executeSubagentWithTimeout({
         reject(new BudgetExceededError("idle_timeout", idleLimit ?? 0, budget.idleMs()));
         return;
       }
-      if (wallLimit !== void 0 && !wallExceeded && budget.onThreshold && preemptState === "active" /* ACTIVE */ && elapsed >= wallLimit * preemptFraction) {
+      if (wallLimit !== void 0 && !wallExceeded && gracefulFinish === void 0 && budget.onThreshold && preemptState === "active" /* ACTIVE */ && elapsed >= wallLimit * preemptFraction) {
         const activityTs = Date.now() - budget.idleMs();
         if (activityTs <= lastGrantActivityTs) {
           preemptState = "locked" /* LOCKED */;
@@ -19216,6 +20049,22 @@ async function executeSubagentWithTimeout({
         return;
       }
       const limit = wallLimit ?? 0;
+      if (gracefulFinish !== void 0) {
+        if (!budget.graceGranted) {
+          const reason = `wall-clock budget of ${Math.round(limit / 1e3)}s reached`;
+          if (budget.notifyFinish(reason, { graceMs: gracefulFinish.graceMs })) {
+            scheduleNext();
+            return;
+          }
+          abortSubagent(ctx.subagentId);
+          reject(new BudgetExceededError("timeout", limit, elapsed));
+          return;
+        } else {
+          abortSubagent(ctx.subagentId);
+          reject(new BudgetExceededError("timeout", limit, elapsed));
+          return;
+        }
+      }
       if (!budget.onThreshold) {
         abortSubagent(ctx.subagentId);
         reject(new BudgetExceededError("timeout", limit, elapsed));
@@ -19363,7 +20212,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
     return { ...subagent, name: display };
   }
   async spawn(subagent) {
-    const id = subagent.id || randomUUID11();
+    const id = subagent.id || randomUUID12();
     const cfg = this.withNickname(subagent, id);
     if (this.subagents.has(id)) {
       throw new Error(`Subagent id "${id}" already exists \u2014 refusing to overwrite`);
@@ -19600,6 +20449,32 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
   completeTask(result) {
     this.recordCompletion(result);
   }
+  /**
+   * Ask every RUNNING subagent that opted into `gracefulFinish` to finish its
+   * task in its own turn (see coordination/subagent-finish.ts). This is the
+   * leader-side entry point for "the leader agent has finished": it delivers
+   * an in-band notification between tool batches — never an interrupt, never
+   * an abort. Each notified subagent keeps its existing time budget and
+   * accelerates; the watchdog still bounds the maximum lifetime.
+   *
+   * Subagents without the policy opted in are deliberately untouched — their
+   * lifecycle remains the legacy watchdog contract.
+   *
+   * Returns the number of subagents actually notified.
+   */
+  requestFinish(reason) {
+    let notified = 0;
+    for (const subagent of this.subagents.values()) {
+      if (subagent.status !== "running") continue;
+      if (!resolveGracefulFinish(subagent.config)) continue;
+      const budget = subagent.activeBudget;
+      if (!budget) continue;
+      const usage = budget.usage();
+      if (usage.iterations === 0 && usage.toolCalls === 0) continue;
+      if (budget.notifyFinish(reason)) notified++;
+    }
+    return notified;
+  }
   // --- internal dispatching ---------------------------------------------
   tryDispatchNext() {
     while (this.canDispatch()) {
@@ -19773,7 +20648,14 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
         idleTimeoutMs: rawIdleTimeoutMs ?? this.config.defaultBudget?.idleTimeoutMs ?? configWithRosterDefaults.idleTimeoutMs
       },
       "auto",
-      { sessionId: () => this.currentSessionId() }
+      {
+        sessionId: () => this.currentSessionId(),
+        subagentId,
+        // Graceful-finish runs own wall-clock enforcement to the watchdog so
+        // the notify-then-bound lifecycle cannot be raced by tool.progress
+        // heartbeats calling checkTimeout() (see subagent-budget.ts).
+        ...resolveGracefulFinish(subagent.config) ? { wallClockWatchdogOwned: true } : {}
+      }
     );
     subagent.activeBudget = budget;
     if (!this.runner) {
@@ -19806,7 +20688,8 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
         task,
         runCtx,
         budget,
-        subagent.config.preemptFraction
+        subagent.config.preemptFraction,
+        resolveGracefulFinish(subagent.config)
       );
       result = {
         subagentId,
@@ -19836,13 +20719,14 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
     }
     this.recordCompletion(result);
   }
-  async executeWithTimeout(runner, task, ctx, budget, preemptFraction) {
+  async executeWithTimeout(runner, task, ctx, budget, preemptFraction, gracefulFinish) {
     return executeSubagentWithTimeout({
       runner,
       task,
       ctx,
       budget,
       preemptFraction,
+      gracefulFinish,
       abortSubagent: (subagentId) => this.subagents.get(subagentId)?.abortController.abort(),
       currentSessionId: () => this.currentSessionId()
     });
@@ -20151,6 +21035,7 @@ function worktreeOwnerLabel(task, config) {
 }
 
 // src/coordination/director.ts
+var BUSY_REARM_FLOOR_MS = 1e3;
 var Director = class _Director {
   /* eslint-disable-next-line @typescript-eslint/no-unused-vars — just a cast helper */
   static _asManifestEntry(v) {
@@ -20216,6 +21101,13 @@ var Director = class _Director {
   subagentIdleTimeoutMs;
   retireSubagentOnTaskComplete;
   subagentIdleTimers = /* @__PURE__ */ new Map();
+  /**
+   * Effective idle window per subagent (spawn-time `idleTimeoutMs` override
+   * or the Director-wide default; undefined = no window). Internal-task
+   * completion re-arms with THIS value, not the Director-wide default, so
+   * a subagent-configured window survives its first internal probe.
+   */
+  subagentIdleDelayMs = /* @__PURE__ */ new Map();
   sharedScratchpadPath;
   maxSpawns;
   maxSpawnDepth;
@@ -20248,7 +21140,7 @@ var Director = class _Director {
   sessionProvider;
   sessionModel;
   constructor(opts) {
-    this.id = opts.config.coordinatorId || randomUUID12();
+    this.id = opts.config.coordinatorId || randomUUID13();
     this.manifestPath = opts.manifestPath;
     this.roster = opts.roster;
     this.directorPreamble = opts.directorPreamble ?? DEFAULT_DIRECTOR_PREAMBLE;
@@ -20372,7 +21264,13 @@ var Director = class _Director {
   handleTaskCompleted(payload) {
     const r = payload.result;
     const settled = this.tasks.settle(r);
-    if (settled.internal) return;
+    if (settled.internal) {
+      this.armSubagentIdleRetirement(
+        r.subagentId,
+        this.subagentIdleDelayMs.get(r.subagentId) ?? this.subagentIdleTimeoutMs
+      );
+      return;
+    }
     const title = this.tasks.descriptionFor(r.taskId, payload.task.description ?? r.taskId);
     if (!settled.consumedInBand && this.taskResultNotifier) {
       const resultText = typeof r.result === "string" ? r.result : r.result !== void 0 ? safeStringify(r.result) : void 0;
@@ -20437,7 +21335,7 @@ var Director = class _Director {
     }
     this.armSubagentIdleRetirement(
       r.subagentId,
-      this.retireSubagentOnTaskComplete ? 0 : this.subagentIdleTimeoutMs
+      this.retireSubagentOnTaskComplete ? 0 : this.subagentIdleDelayMs.get(r.subagentId) ?? this.subagentIdleTimeoutMs
     );
   }
   extensionsFor(subagentId) {
@@ -20455,6 +21353,17 @@ var Director = class _Director {
   isWorkComplete() {
     return this.workCompleteFlag;
   }
+  /**
+   * Ask every running background subagent that opted into `gracefulFinish`
+   * to finish its task in its own turn. In-band notification between tool
+   * batches — no interrupt, no abort; each subagent keeps its time budget and
+   * accelerates. Session shutdown calls this before draining Chimera work so
+   * the post-session reviewer is nudged to complete rather than killed.
+   * Returns the number of subagents notified.
+   */
+  requestFinish(reason) {
+    return this.coordinator.requestFinish(reason);
+  }
   setLeaderBtwNote(note) {
     return this.btwNotes.add(note);
   }
@@ -20512,6 +21421,7 @@ var Director = class _Director {
     this.resolveSpawnModel(config);
     const subagentId = await spawn3(this, config, priceLookup);
     const perSubagentIdleMs = typeof config.idleTimeoutMs === "number" && Number.isFinite(config.idleTimeoutMs) && config.idleTimeoutMs >= 0 ? config.idleTimeoutMs : this.subagentIdleTimeoutMs;
+    this.subagentIdleDelayMs.set(subagentId, perSubagentIdleMs);
     this.armSubagentIdleRetirement(subagentId, perSubagentIdleMs);
     return subagentId;
   }
@@ -20531,7 +21441,7 @@ var Director = class _Director {
       );
     }
     const msg = {
-      id: randomUUID12(),
+      id: randomUUID13(),
       type: "task",
       from: this.id,
       to: subagentId,
@@ -20565,6 +21475,7 @@ var Director = class _Director {
     this.budgetPolicy.dispose();
     for (const timer of this.subagentIdleTimers.values()) clearTimeout(timer);
     this.subagentIdleTimers.clear();
+    this.subagentIdleDelayMs.clear();
     await this.coordinator.stopAll();
     this.tasks.resolveWaitersOnShutdown();
     for (const b of this.subagentBridges.values()) {
@@ -20623,6 +21534,7 @@ var Director = class _Director {
   }
   async remove(subagentId) {
     this.clearSubagentIdleRetirement(subagentId);
+    this.subagentIdleDelayMs.delete(subagentId);
     void this.appendSessionEvent({
       type: "agent_stopped",
       ts: (/* @__PURE__ */ new Date()).toISOString(),
@@ -20675,9 +21587,13 @@ var Director = class _Director {
     const timer = setTimeout(() => {
       this.subagentIdleTimers.delete(subagentId);
       const entry = this.coordinator.getStatus().subagents.find((a) => a.id === subagentId);
-      if (entry?.status !== "idle") return;
+      if (entry === void 0) return;
+      if (entry.status !== "idle") {
+        this.armSubagentIdleRetirement(subagentId, Math.max(delayMs, BUSY_REARM_FLOOR_MS));
+        return;
+      }
       if (this.coordinator.listPendingTasks().some((task) => task.subagentId === subagentId)) {
-        this.armSubagentIdleRetirement(subagentId, this.subagentIdleTimeoutMs);
+        this.armSubagentIdleRetirement(subagentId, Math.max(delayMs, BUSY_REARM_FLOOR_MS));
         return;
       }
       void this.remove(subagentId).catch(
@@ -23961,7 +24877,7 @@ function _resetDesignRulesCache() {
 }
 
 // src/execution/design-color.ts
-function clamp(n, lo, hi) {
+function clamp2(n, lo, hi) {
   return n < lo ? lo : n > hi ? hi : n;
 }
 function parseOklch(value) {
@@ -23977,9 +24893,9 @@ function parseOklch(value) {
   let a = 1;
   if (alphaPart !== void 0) {
     const av = parseComponent(alphaPart.trim(), true);
-    if (av !== null) a = clamp(av, 0, 1);
+    if (av !== null) a = clamp2(av, 0, 1);
   }
-  return [clamp(L, 0, 1), Math.max(0, C), H, a];
+  return [clamp2(L, 0, 1), Math.max(0, C), H, a];
 }
 function parseComponent(s, percentIsFraction) {
   s = s.trim();
@@ -23998,7 +24914,7 @@ function parseAngle(s) {
 }
 function linearToSrgb(c) {
   const v = c <= 31308e-7 ? 12.92 * c : 1.055 * c ** (1 / 2.4) - 0.055;
-  return clamp(v, 0, 1);
+  return clamp2(v, 0, 1);
 }
 function toHex2(n) {
   return Math.round(n * 255).toString(16).padStart(2, "0");
@@ -24203,16 +25119,16 @@ async function runDesignVerify(projectRoot, tokens, explicitFiles) {
 }
 
 // src/execution/design-detect.ts
-var META_KEY = "designStudio";
+var META_KEY2 = "designStudio";
 function getDesignState(ctx) {
-  const v = ctx.meta[META_KEY];
+  const v = ctx.meta[META_KEY2];
   return v && typeof v === "object" ? v : void 0;
 }
 function ensureState(ctx) {
   let s = getDesignState(ctx);
   if (!s) {
     s = { active: false, signals: [] };
-    ctx.meta[META_KEY] = s;
+    ctx.meta[META_KEY2] = s;
   }
   return s;
 }
@@ -26134,7 +27050,7 @@ ${summaryText}` : summaryText;
 };
 
 // src/execution/parallel-eternal-engine.ts
-import { randomUUID as randomUUID13 } from "node:crypto";
+import { randomUUID as randomUUID14 } from "node:crypto";
 var GOAL_COMPLETE_MARKER2 = /^\s*\[goal[_\s-]?complete\]\s*$/im;
 var ParallelEternalEngine = class {
   constructor(opts) {
@@ -26211,7 +27127,7 @@ var ParallelEternalEngine = class {
     this.state = "running";
     await this.persistState("running");
     const config = {
-      coordinatorId: `parallel-${randomUUID13().slice(0, 8)}`,
+      coordinatorId: `parallel-${randomUUID14().slice(0, 8)}`,
       maxConcurrent: this.slots,
       doneCondition: { type: "all_tasks_done" }
     };
@@ -26265,7 +27181,7 @@ var ParallelEternalEngine = class {
     }
     if (!this.coordinator) {
       const config = {
-        coordinatorId: `parallel-${randomUUID13().slice(0, 8)}`,
+        coordinatorId: `parallel-${randomUUID14().slice(0, 8)}`,
         maxConcurrent: this.slots,
         doneCondition: { type: "all_tasks_done" }
       };
@@ -26351,7 +27267,7 @@ ${recentJournal}` : "No prior iterations.",
       const task = expectDefined(tasks[i]);
       const route = routes[i] ?? null;
       const subagentId = `parallel-${this.iterations}-${i}`;
-      const taskId = randomUUID13();
+      const taskId = randomUUID14();
       const personaLine = route ? `Acting agent: ${route.definition.config.name} \u2014 ${route.definition.capability.summary}
 ` : "";
       const spec = {
@@ -26566,7 +27482,7 @@ ${lastFew}` : "No prior iterations.",
 };
 
 // src/core/streaming-response-builder.ts
-import { randomUUID as randomUUID14 } from "node:crypto";
+import { randomUUID as randomUUID15 } from "node:crypto";
 var STREAM_DRAIN_TIMEOUT_MS = 500;
 function buildResponse(state) {
   const content = [];
@@ -26626,7 +27542,7 @@ function handleContentBlockStart(state, ev) {
     state.textBuffers.push("");
     state.blockOrder.push({ kind: "text", idx: state.currentTextIndex });
   } else if (kind === "tool_use") {
-    const id = ev.id ?? randomUUID14();
+    const id = ev.id ?? randomUUID15();
     state.tools.set(id, { name: ev.name ?? "unknown", partial: "" });
     state.blockOrder.push({ kind: "tool", id });
     state.currentTextIndex = -1;
@@ -27033,7 +27949,7 @@ function replaceAllCaseInsensitive(haystack, needle, replacement) {
 }
 
 // src/core/provider-runner.ts
-import { randomUUID as randomUUID15 } from "node:crypto";
+import { randomUUID as randomUUID16 } from "node:crypto";
 function scrubProviderBody(body) {
   if (!body) return void 0;
   return {
@@ -27055,11 +27971,11 @@ function providerLogCtx(p, r) {
 }
 async function runProviderWithRetry(opts) {
   const { provider, request, signal, ctx, events, retry, logger, tracer } = opts;
-  const logicalRequestId = randomUUID15();
+  const logicalRequestId = randomUUID16();
   const promptManifest = createChroniclePromptManifest(request);
   let attempt = 0;
   for (; ; ) {
-    const attemptId = randomUUID15();
+    const attemptId = randomUUID16();
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const startedNs = process.hrtime.bigint();
     const correlation = {
@@ -27949,6 +28865,10 @@ var DefaultSkillLoader = class {
         );
         for (const e of entries) {
           if (!await entryIsDirectory(dir, e)) continue;
+          if (!isValidSkillNameFormat(e.name)) {
+            this.skipped.push({ dir, entry: e.name, reason: "invalid-name-format" });
+            continue;
+          }
           const skillFile = path30.join(dir, e.name, "SKILL.md");
           let raw;
           try {
@@ -28622,7 +29542,7 @@ function readPolicy(ctx) {
 }
 
 // src/execution/tool-executor.ts
-import { randomUUID as randomUUID18 } from "node:crypto";
+import { randomUUID as randomUUID19 } from "node:crypto";
 import * as fs10 from "node:fs/promises";
 import * as path35 from "node:path";
 
@@ -28630,7 +29550,7 @@ import * as path35 from "node:path";
 var GOVERNED_TOOL_EXECUTOR_META_KEY = "toolExecutor.executeGoverned";
 
 // src/execution/tool-executor-support.ts
-import { createHash as createHash8, randomUUID as randomUUID16 } from "node:crypto";
+import { createHash as createHash8, randomUUID as randomUUID17 } from "node:crypto";
 import * as fs9 from "node:fs/promises";
 import * as path33 from "node:path";
 
@@ -28761,7 +29681,7 @@ async function maybePersistLargeToolOutput(toolName, content, budget) {
     await fs9.mkdir(dir, { recursive: true });
     const safeTool = toolName.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    const filePath = path33.join(dir, `${stamp}-${safeTool}-${randomUUID16()}.log`);
+    const filePath = path33.join(dir, `${stamp}-${safeTool}-${randomUUID17()}.log`);
     await fs9.writeFile(filePath, content, "utf8");
     const marker = `[full tool output: ${bytes} bytes at ${filePath}; read/grep that file selectively instead of re-running or requesting more output]`;
     const fixedBytes = Buffer.byteLength(marker + TOOL_OUTPUT_ARTIFACT_OMISSION, "utf8");
@@ -29310,7 +30230,7 @@ ${errorDetails}`,
 }
 
 // src/execution/tool-executor-runner.ts
-import { randomUUID as randomUUID17 } from "node:crypto";
+import { randomUUID as randomUUID18 } from "node:crypto";
 
 // src/observability/process-telemetry.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
@@ -29449,7 +30369,7 @@ async function runToolWithTimeout(tool, input, parentSignal, ctx, opts, config,
     progressTailChars: config.progressTailChars,
     progressHeadChars: config.progressHeadChars
   }) : (async () => tool.execute(input, ctx, { signal: combined }))();
-  const telemetryToolCallId = toolUseId ?? `nested-${randomUUID17()}`;
+  const telemetryToolCallId = toolUseId ?? `nested-${randomUUID18()}`;
   const toolPromise = opts.events ? runWithNetworkTelemetry(
     {
       events: opts.events,
@@ -29622,7 +30542,7 @@ var ToolExecutor = class _ToolExecutor {
         return { result, tool, durationMs: Date.now() - start };
       }
       if (effectivePermission === "confirm") {
-        const suggestedPattern = boundary.decision === "confirm" ? `kanban-boundary:${boundary.path ?? tool.name}` : subjectForToolInput(tool.name, use.input, tool.subjectKey) ?? tool.name;
+        const suggestedPattern = boundary.decision === "confirm" ? `kanban-boundary:${boundary.path ?? tool.name}` : subjectForToolInput(tool.name, use.input, tool.subjectKey, tool.subjectFields) ?? tool.name;
         if (this.opts.confirmAwaiter) {
           const awaiter = this.opts.confirmAwaiter;
           const choice = await new Promise(
@@ -29842,7 +30762,7 @@ ${post.additionalContext}`;
     const bridge = async (toolName, input) => {
       const nestedUse = {
         type: "tool_use",
-        id: `nested-${randomUUID18()}`,
+        id: `nested-${randomUUID19()}`,
         name: toolName,
         input
       };
@@ -30446,13 +31366,13 @@ import * as fs11 from "node:fs/promises";
 import * as path37 from "node:path";
 
 // src/types/mode-prompts.ts
-import { readFileSync as readFileSync10, statSync as statSync4 } from "node:fs";
+import { readFileSync as readFileSync11, statSync as statSync4 } from "node:fs";
 import * as path36 from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function modePrompt(id) {
   for (const dir of modePromptDirCandidates()) {
     try {
-      return readFileSync10(path36.join(dir, `${id}.md`), "utf8").trimEnd();
+      return readFileSync11(path36.join(dir, `${id}.md`), "utf8").trimEnd();
     } catch {
     }
   }
@@ -31130,7 +32050,17 @@ function normalizeModelsDevModel(model) {
   const reasoningConfig = {
     default: disableSupported ? "enabled" : "always_on",
     disableSupported,
-    effortSupported: effortLevels.length > 0,
+    // Tri-state (see ReasoningConfig.effortSupported):
+    //   options present  → documented answer (true when effort values exist;
+    //                      an explicitly EMPTY array is a documented "no
+    //                      effort control", not an absent field).
+    //   field ABSENT     → the model is known to reason but its vocabulary is
+    //                      undocumented → `undefined`, so the resolver forwards
+    //                      the request and each wire adapter applies its own
+    //                      transport gating. Sending `false` here would make
+    //                      the resolver claim "does not support effort" — an
+    //                      assertion the catalog never made.
+    ...raw === void 0 ? {} : { effortSupported: effortLevels.length > 0 },
     effortLevels,
     preserveThinking: model.interleaved ? "always_on" : "unsupported"
   };
@@ -31717,9 +32647,9 @@ async function startMetricsServer(opts) {
   let server;
   if (useHttps && tls) {
     const { createServer } = await import("node:https");
-    const { readFileSync: readFileSync12 } = await import("node:fs");
+    const { readFileSync: readFileSync13 } = await import("node:fs");
     server = createServer(
-      { cert: readFileSync12(tls.cert), key: readFileSync12(tls.key) },
+      { cert: readFileSync13(tls.cert), key: readFileSync13(tls.key) },
       listener
     );
   } else {
@@ -32142,7 +33072,9 @@ function hasRecursiveForceDelete(command, projectRoot) {
     if (token === "rd" || token === "rmdir") {
       const args = commandSegment(tokens, i + 1).map((arg) => arg.toLowerCase());
       if (args.includes("/s")) {
-        const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+        const targets = args.filter(
+          (arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg)
+        );
         if (targets.length === 0) return true;
         if (targets.some(isCatastrophicDeleteTarget)) return true;
         if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
@@ -32211,7 +33143,8 @@ function hasFindExec(command) {
 function isCatastrophicDeleteTarget(rawTarget) {
   const t = rawTarget.replace(/^['"]|['"]$/g, "").trim();
   if (!t) return false;
-  if (t === "*" || t === "." || t === "./" || t === ".\\" || t === "./*" || t === ".\\*") return true;
+  if (t === "*" || t === "." || t === "./" || t === ".\\" || t === "./*" || t === ".\\*")
+    return true;
   const s = t.replace(/[\\/]\*+$/, "").replace(/[\\/]+$/, "");
   if (s === "") return true;
   if (s === "~" || /^\$HOME$/i.test(s) || /^%USERPROFILE%$/i.test(s)) return true;
@@ -32251,12 +33184,16 @@ function hasCatastrophicDelete(command) {
       const args = tokens.slice(i + 1);
       const recursive = args.some((arg) => arg.toLowerCase() === "/s");
       if (!recursive) continue;
-      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      const targets = args.filter(
+        (arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg)
+      );
       if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
     if (token === "del" || token === "erase") {
       const args = tokens.slice(i + 1);
-      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      const targets = args.filter(
+        (arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg)
+      );
       if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
   }
@@ -32317,6 +33254,47 @@ function isClearlyDestructiveBashCommand(command, projectRoot) {
   if (HIGH_IMPACT_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
   return false;
 }
+var WELL_KNOWN_CREDENTIAL_ENV_VARS = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "OPENAI_API_KEY",
+  "AZURE_OPENAI_API_KEY",
+  "GEMINI_API_KEY",
+  "GOOGLE_API_KEY",
+  "GOOGLE_APPLICATION_CREDENTIALS",
+  "GOOGLE_GENERATIVE_AI_API_KEY",
+  "GROQ_API_KEY",
+  "MISTRAL_API_KEY",
+  "COHERE_API_KEY",
+  "DEEPSEEK_API_KEY",
+  "XAI_API_KEY",
+  "OPENROUTER_API_KEY",
+  "PERPLEXITY_API_KEY",
+  "TOGETHER_API_KEY",
+  "FIREWORKS_API_KEY",
+  "HUGGINGFACE_API_KEY",
+  "HF_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_TOKEN",
+  "NPM_TOKEN",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "AZURE_CLIENT_SECRET",
+  "GITLAB_TOKEN",
+  "SLACK_TOKEN",
+  "STRIPE_SECRET_KEY",
+  "TELEGRAM_BOT_TOKEN",
+  "WRONGSTACK_VAULT_PASSPHRASE"
+]);
+function attachesWellKnownCredential(input) {
+  if (!input || typeof input !== "object") return false;
+  const envVars = input["envVars"];
+  if (!Array.isArray(envVars)) return false;
+  return envVars.some(
+    (name) => typeof name === "string" && WELL_KNOWN_CREDENTIAL_ENV_VARS.has(name.toUpperCase())
+  );
+}
 
 // src/security/permission-helpers.ts
 function matchesTrust(patterns, subject) {
@@ -32333,7 +33311,7 @@ function hasShellSubject(tool) {
   ]);
 }
 function alwaysAllowUnavailableReason(tool, input) {
-  const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
+  const subject = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
   if (subject !== void 0) return void 0;
   return `"always allow" needs a subject to remember, and ${tool.name} calls do not carry one (no subjectKey, and no path/url/name input). Recording it would store a rule that can never match. Approve this call, or set a trust rule for ${tool.name} explicitly.`;
 }
@@ -32393,8 +33371,18 @@ var AGENT_STATE_SENSITIVE_BASENAMES = /^(?:config\.json|config\.local\.json|trus
 function unescapeGlobSubject(value) {
   return value.replace(/\\([*?[\]])/g, "$1");
 }
+function stripAdsSuffix(forwardSlashPath) {
+  const cut = forwardSlashPath.lastIndexOf("/");
+  const dir = cut === -1 ? "" : forwardSlashPath.slice(0, cut + 1);
+  const base = cut === -1 ? forwardSlashPath : forwardSlashPath.slice(cut + 1);
+  const colon = base.indexOf(":");
+  if (colon === -1 || cut === -1 && colon === 1 && base.length <= 2) return forwardSlashPath;
+  return dir + base.slice(0, colon);
+}
 function normalizeForCompare(value) {
-  const forward = unescapeGlobSubject(value).replace(/\\/g, "/").replace(/\/+$/, "");
+  const forward = stripAdsSuffix(
+    unescapeGlobSubject(value).replace(/\\/g, "/").replace(/\/+$/, "")
+  );
   return process.platform === "win32" ? forward.toLowerCase() : forward;
 }
 function realpathOfNearestExisting(p) {
@@ -32431,7 +33419,7 @@ function isProtectedAgentStatePath(absPath) {
   return AGENT_STATE_SENSITIVE_BASENAMES.test(path40.basename(normalizeForCompare(absPath)));
 }
 function pathLooksSensitive(rawPath) {
-  const normalized = stripShellQuotes(rawPath).replace(/\\/g, "/");
+  const normalized = stripAdsSuffix(stripShellQuotes(rawPath).replace(/\\/g, "/"));
   if (SENSITIVE_READ_PATHS.some((pattern) => pattern.test(normalized))) return true;
   return isProtectedAgentStatePath(normalized);
 }
@@ -32455,10 +33443,24 @@ function shellCommandReadsSensitivePath(command) {
   }
   return false;
 }
+function isSensitiveReadCall(tool, input) {
+  const isReadTool = hasCapability(tool, ToolCapabilities.FS_READ) || tool.name === "read" || tool.name === "grep" || tool.name === "glob" || tool.name === "tree";
+  if (isReadTool && inputPathLooksSensitive(input)) return true;
+  const hasShellCap = hasCapability(tool, [
+    ToolCapabilities.SHELL_ARBITRARY,
+    ToolCapabilities.SHELL_RESTRICTED,
+    ToolCapabilities.SHELL_EXEC
+  ]);
+  if (!hasShellCap && tool.name !== "bash" && tool.name !== "shell" && tool.name !== "exec") {
+    return false;
+  }
+  const command = shellCommandLineFromInput(input);
+  return command ? shellCommandReadsSensitivePath(command) : false;
+}
 
 // src/security/permission-explain.ts
 function explainPermissionTrace(state, tool, input, ctx) {
-  const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
+  const subject = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
   const steps = [];
   let winnerIndex = -1;
   const add = (rule, matched, decision, source, detail) => {
@@ -32679,13 +33681,7 @@ function explainPermissionTrace(state, tool, input, ctx) {
         }
       };
     }
-    add(
-      "yolo",
-      true,
-      "auto",
-      "yolo",
-      "YOLO mode is active \u2014 auto-approving every non-denied call"
-    );
+    add("yolo", true, "auto", "yolo", "YOLO mode is active \u2014 auto-approving every non-denied call");
     winnerIndex = steps.length - 1;
     return {
       toolName: tool.name,
@@ -32956,7 +33952,14 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   static isMcpTool(name) {
     return name.startsWith("mcp__");
   }
-  async evaluate(tool) {
+  async evaluate(tool, input) {
+    if (input !== void 0 && isSensitiveReadCall(tool, input)) {
+      return {
+        permission: "deny",
+        source: "subagent_guard",
+        reason: "subagents may not read credential-bearing paths \u2014 the leader must perform this read so the user can approve it"
+      };
+    }
     const caps = tool.capabilities ?? [];
     const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
     const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
@@ -32983,8 +33986,8 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   }
   allowOnce() {
   }
-  async explain(tool) {
-    const decision = await this.evaluate(tool);
+  async explain(tool, input) {
+    const decision = await this.evaluate(tool, input);
     return {
       toolName: tool.name,
       subject: null,
@@ -33034,6 +34037,17 @@ function fsWriteTargetPaths(input) {
   }
   return out;
 }
+function mergeTrustEntries(exact, wildcard) {
+  if (!exact) return wildcard;
+  if (!wildcard) return exact;
+  const deny = [...wildcard.deny ?? [], ...exact.deny ?? []];
+  const merged = {
+    ...wildcard,
+    ...exact
+  };
+  if (deny.length > 0) merged.deny = [...new Set(deny)];
+  return merged;
+}
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -33072,6 +34086,7 @@ var DefaultPermissionPolicy = class {
   yoloBlockedAsDestructive(tool, input, ctx) {
     if (!this.yolo || this.yoloDestructive) return false;
     if (this.hasAgentStateWriteTarget(tool, input, ctx)) return true;
+    if (attachesWellKnownCredential(input)) return true;
     const isShellSurface = tool.name === "bash" || tool.name === "exec" || (tool.capabilities ?? []).includes("shell.arbitrary");
     if (!isShellSurface) return false;
     const command = getInputString(input, "command") ?? shellCommandLineFromInput(input);
@@ -33165,8 +34180,8 @@ var DefaultPermissionPolicy = class {
       };
     }
     const namespaceEntry = this.findNamespaceEntry(tool.name);
-    const entry = this.policy[tool.name] ?? namespaceEntry;
-    const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
+    const entry = mergeTrustEntries(this.policy[tool.name], namespaceEntry);
+    const subject = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
     const cacheKey = `${tool.name}::${subject ?? tool.name}`;
     const evalKey = `${cacheKey}::${permissionFingerprint(tool)}`;
     if (tool.name !== "write" && !this.hasAgentStateWriteTarget(tool, input, ctx)) {
@@ -33183,15 +34198,6 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
-    if (this.sessionAllowed.has(cacheKey)) {
-      this.sessionAllowed.delete(cacheKey);
-      const decision = {
-        permission: "auto",
-        source: "trust",
-        reason: "session one-shot allow (user pressed yes)"
-      };
-      return decision;
-    }
     if (entry?.deny && subject && matchesTrust(entry.deny, subject)) {
       this._logDeny(tool.name, subject, "matched deny pattern");
       const decision = {
@@ -33202,6 +34208,15 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
+    if (this.sessionAllowed.has(cacheKey)) {
+      this.sessionAllowed.delete(cacheKey);
+      const decision = {
+        permission: "auto",
+        source: "trust",
+        reason: "session one-shot allow (user pressed yes)"
+      };
+      return decision;
+    }
     if (tool.permission === "deny") {
       this._logDeny(tool.name, subject, "tool default deny");
       const decision = {
@@ -33212,6 +34227,7 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
+    const denyUnevaluated = Boolean(entry?.deny?.length) && subject === void 0;
     const allowMatches = hasShellSubject(tool) ? matchesCommandTrust : matchesTrust;
     if (entry?.allow && subject && allowMatches(entry.allow, subject)) {
       const decision = {
@@ -33222,7 +34238,7 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
-    if (entry?.auto) {
+    if (entry?.auto && !denyUnevaluated) {
       const decision = { permission: "auto", source: "trust" };
       this._evalCache.set(evalKey, decision);
       return decision;
@@ -33322,19 +34338,10 @@ var DefaultPermissionPolicy = class {
     }
     return { permission: "confirm", source: "default" };
   }
+  // Delegates to the shared helper so the subagent policy applies the exact
+  // same rule — see `isSensitiveReadCall` in ./permission-helpers.ts.
   isSensitiveReadCall(tool, input) {
-    const isReadTool = hasCapability(tool, ToolCapabilities.FS_READ) || tool.name === "read" || tool.name === "grep" || tool.name === "glob" || tool.name === "tree";
-    if (isReadTool && inputPathLooksSensitive(input)) return true;
-    const hasShellCap = hasCapability(tool, [
-      ToolCapabilities.SHELL_ARBITRARY,
-      ToolCapabilities.SHELL_RESTRICTED,
-      ToolCapabilities.SHELL_EXEC
-    ]);
-    if (!hasShellCap && tool.name !== "bash" && tool.name !== "shell" && tool.name !== "exec") {
-      return false;
-    }
-    const command = shellCommandLineFromInput(input);
-    return command ? shellCommandReadsSensitivePath(command) : false;
+    return isSensitiveReadCall(tool, input);
   }
   async trust(rule) {
     if (!this.loaded) await this.reload();
@@ -33458,7 +34465,7 @@ function walk2(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
+var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();
@@ -33567,6 +34574,14 @@ function keyFileNeedsHardening(keyFile, opts) {
   }
   return false;
 }
+function mkdirSecretDirSync(dir) {
+  fs14.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (process.platform === "win32") return;
+  try {
+    fs14.chmodSync(dir, 448);
+  } catch {
+  }
+}
 function writeKeyFileAtomicSync(keyFile, content) {
   const tmp = `${keyFile}.${randomBytes3(4).toString("hex")}.tmp`;
   const fd = fs14.openSync(tmp, "w", 384);
@@ -33714,7 +34729,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes3(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs14.mkdirSync(path42.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path42.dirname(this.keyFile));
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
@@ -33798,7 +34813,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs14.mkdirSync(path42.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path42.dirname(this.keyFile));
     const key = randomBytes3(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
@@ -34500,6 +35515,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
     path: "features.mailboxBridge",
     reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
+  },
+  {
+    // `plugins` is already denied above, so a repo cannot ADD a plugin. This
+    // closes the other half: a repo could previously ship
+    // `{"features":{"pluginsTrust":false}}` and switch off the integrity gate
+    // for plugins the user had ALREADY installed globally — disarming the
+    // trust-on-first-use pin that exists to catch a supply-chain update
+    // rewriting a plugin's entry file. Same operator-owned class as the
+    // switches above.
+    path: "features.pluginsTrust",
+    reason: "Disables the plugin trust-on-first-use integrity gate, re-trusting changed code in already-installed global plugins."
   }
 ];
 function deleteNestedPath(target, path47) {
@@ -35472,7 +36498,7 @@ function deepFreeze(obj) {
 }
 
 // src/storage/plan-store.ts
-import { randomUUID as randomUUID19 } from "node:crypto";
+import { randomUUID as randomUUID20 } from "node:crypto";
 import * as fsp30 from "node:fs/promises";
 async function loadPlan(filePath, events) {
   const t0 = Date.now();
@@ -35571,7 +36597,7 @@ function emptyPlan(sessionId, title) {
 function addPlanItem(plan, title, details) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const item = {
-    id: `plan_${Date.now()}_${randomUUID19().slice(0, 6)}`,
+    id: `plan_${Date.now()}_${randomUUID20().slice(0, 6)}`,
     title,
     details,
     status: "open",
@@ -35643,7 +36669,7 @@ function deriveTodosFromPlanItem(plan, idOrIndex, subtasks) {
   if (subtasks && subtasks.length > 0) {
     for (const st of subtasks) {
       todos.push({
-        id: `todo_${Date.now()}_${randomUUID19().slice(0, 6)}`,
+        id: `todo_${Date.now()}_${randomUUID20().slice(0, 6)}`,
         content: st,
         status: "pending",
         promotedFromPlan: item.id