@wrongstack/core 0.54.1 → 0.66.13

package/dist/index.js

@@ -93,7 +93,7 @@ async function renameWithRetry(from, to) {
       if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
         throw err;
       }
-      await new Promise((resolve12) => setTimeout(resolve12, delays[i]));
+      await new Promise((resolve13) => setTimeout(resolve13, delays[i]));
     }
   }
   throw lastErr;
@@ -884,7 +884,9 @@ var TOKENS = {
   /** Optional git-worktree lifecycle manager (per-phase isolation in AutoPhase). */
   WorktreeManager: t("WorktreeManager"),
   /** Optional global Brain arbiter for policy/decision escalation. */
-  BrainArbiter: t("BrainArbiter")
+  BrainArbiter: t("BrainArbiter"),
+  /** Lifecycle hook registry (shell + in-process hooks). */
+  HookRegistry: t("HookRegistry")
 };
 
 // src/kernel/run-controller.ts
@@ -2058,7 +2060,7 @@ var DefaultPathResolver = class {
 var NETWORK_ERR_RE = /ECONN|ETIMEDOUT|ETIME|ENOTFOUND|EAI_AGAIN|fetch failed/i;
 
 // src/execution/error-handler.ts
-var CONTEXT_OVERFLOW_RE = /context|too long|tokens/i;
+var CONTEXT_OVERFLOW_RE = /context|too long|tokens|exceeds the context window|context window/i;
 function buildRecoveryStrategies(opts) {
   return [
     {
@@ -2066,7 +2068,7 @@ function buildRecoveryStrategies(opts) {
       compactor: opts?.compactor,
       async attempt(err, ctx) {
         if (!(err instanceof ProviderError)) return null;
-        if (err.status !== 413 && !CONTEXT_OVERFLOW_RE.test(err.message)) return null;
+        if (err.status !== 413 && !isContextOverflowError(err)) return null;
         if (this.compactor) {
           try {
             const report = await this.compactor.compact(ctx, { aggressive: true });
@@ -2129,6 +2131,14 @@ function buildRecoveryStrategies(opts) {
   ];
 }
 var DEFAULT_RECOVERY_STRATEGIES = buildRecoveryStrategies();
+function isContextOverflowError(err) {
+  return CONTEXT_OVERFLOW_RE.test([
+    err.message,
+    err.body?.message,
+    err.body?.type,
+    err.body?.raw
+  ].filter(Boolean).join("\n"));
+}
 var DefaultErrorHandler = class {
   strategies;
   constructor(strategies = DEFAULT_RECOVERY_STRATEGIES) {
@@ -2145,7 +2155,7 @@ var DefaultErrorHandler = class {
       if (err.status === 429) return { kind: "rate_limit", retryable: true };
       if (err.status === 529) return { kind: "overloaded", retryable: true };
       if (err.status >= 500) return { kind: "server", retryable: true };
-      if (err.status === 413 || CONTEXT_OVERFLOW_RE.test(err.message)) {
+      if (err.status === 413 || isContextOverflowError(err)) {
         return { kind: "context_overflow", retryable: false };
       }
       if (err.status >= 400) return { kind: "client", retryable: false };
@@ -3049,7 +3059,7 @@ var InMemoryAgentBridge = class {
       );
     }
     this.inflightGuards.add(correlationId);
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       const timer = setTimeout(() => {
         this.inflightGuards.delete(correlationId);
         this.pendingRequests.delete(correlationId);
@@ -3061,7 +3071,7 @@ var InMemoryAgentBridge = class {
         return;
       }
       this.pendingRequests.set(correlationId, {
-        resolve: resolve12,
+        resolve: resolve13,
         reject,
         timer
       });
@@ -3254,11 +3264,11 @@ function validateAgainstSchema(value, schema) {
   walk2(value, schema, "", errors);
   return { ok: errors.length === 0, errors };
 }
-function walk2(value, schema, path36, errors) {
+function walk2(value, schema, path37, errors) {
   if (schema.enum !== void 0) {
     if (!schema.enum.some((e) => deepEqual(e, value))) {
       errors.push({
-        path: path36 || "<root>",
+        path: path37 || "<root>",
         message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
       });
       return;
@@ -3267,7 +3277,7 @@ function walk2(value, schema, path36, errors) {
   if (typeof schema.type === "string") {
     if (!checkType(value, schema.type)) {
       errors.push({
-        path: path36 || "<root>",
+        path: path37 || "<root>",
         message: `expected ${schema.type}, got ${describeType(value)}`
       });
       return;
@@ -3277,19 +3287,19 @@ function walk2(value, schema, path36, errors) {
     const obj = value;
     for (const req of schema.required ?? []) {
       if (!(req in obj)) {
-        errors.push({ path: joinPath(path36, req), message: "required property missing" });
+        errors.push({ path: joinPath(path37, req), message: "required property missing" });
       }
     }
     if (schema.properties) {
       for (const [key, subSchema] of Object.entries(schema.properties)) {
         if (key in obj) {
-          walk2(obj[key], subSchema, joinPath(path36, key), errors);
+          walk2(obj[key], subSchema, joinPath(path37, key), errors);
         }
       }
     }
   }
   if (schema.type === "array" && Array.isArray(value) && schema.items) {
-    value.forEach((item, i) => walk2(item, schema.items, `${path36}[${i}]`, errors));
+    value.forEach((item, i) => walk2(item, schema.items, `${path37}[${i}]`, errors));
   }
 }
 function checkType(value, type) {
@@ -3385,6 +3395,29 @@ function createToolOutputSerializer(opts = {}) {
   }
   return { serialize, enforceCap, capBytes };
 }
+function truncateForEvent(content, max = 400) {
+  if (!content) return "";
+  return content.length <= max ? content : `${content.slice(0, max - 1)}\u2026`;
+}
+function sizeSignals(toolName, content) {
+  if (!content || content.length === 0) {
+    return { outputBytes: 0, outputTokens: 0, outputLines: void 0 };
+  }
+  const outputBytes = Buffer.byteLength(content, "utf8");
+  const outputTokens = Math.max(1, Math.round(outputBytes / 3.5));
+  let outputLines;
+  if (toolName === "read") {
+    const lineRe = /^\s*\d+→/gm;
+    let count = 0;
+    while (lineRe.exec(content) !== null) count++;
+    if (count > 0) outputLines = count;
+  } else if (toolName === "bash" || toolName === "shell" || toolName === "grep" || toolName === "logs") {
+    let nl = 0;
+    for (let i = 0; i < content.length; i++) if (content.charCodeAt(i) === 10) nl++;
+    outputLines = nl + (content.endsWith("\n") ? 0 : 1);
+  }
+  return { outputBytes, outputTokens, outputLines };
+}
 
 // src/execution/tool-executor.ts
 var ToolExecutor = class {
@@ -3415,8 +3448,9 @@ var ToolExecutor = class {
    */
   async executeBatch(toolUses, ctx, strategy) {
     let budget = this.opts.perIterationOutputCapBytes ?? 1e5;
-    const runOne = async (use) => {
+    const runOne = async (use0) => {
       const start = Date.now();
+      let use = use0;
       const tool = this.registry.get(use.name);
       if (!tool) {
         const result = this.unknownToolResult(use, () => this.registry.list().map((t2) => t2.name));
@@ -3449,10 +3483,36 @@ Please call the tool again with arguments that match its inputSchema. You can us
         budget = this.decrementBudget(result, budget);
         return { result, tool, durationMs: Date.now() - start };
       }
+      if (this.opts.hookRunner?.has("PreToolUse")) {
+        const pre = await this.opts.hookRunner.preToolUse(tool.name, use.input, ctx);
+        if (pre.block) {
+          const result = this.blockedByHookResult(use, pre.reason);
+          budget = this.decrementBudget(result, budget);
+          return { result, tool, durationMs: Date.now() - start };
+        }
+        if (pre.input) {
+          const reval = validateAgainstSchema(pre.input, tool.inputSchema);
+          if (!reval.ok) {
+            const errorDetails = reval.errors.map((e) => `  - ${e.path || "input"}: ${e.message}`).join("\n");
+            const result = {
+              type: "tool_result",
+              tool_use_id: use.id,
+              content: `A PreToolUse hook rewrote the arguments for "${tool.name}" into an invalid shape.
+
+Validation errors:
+${errorDetails}`,
+              is_error: true
+            };
+            budget = this.decrementBudget(result, budget);
+            return { result, tool, durationMs: Date.now() - start };
+          }
+          use = { ...use, input: pre.input };
+        }
+      }
       const decision = await this.opts.permissionPolicy.evaluate(tool, use.input, ctx);
       let effectivePermission = decision.permission;
       const policy = this.opts.permissionPolicy;
-      const yolo = policy.getYolo?.() === true || policy.getForceAllYolo?.() === true;
+      const yolo = policy.getYolo?.() === true || policy.getYoloDestructive?.() === true || policy.getForceAllYolo?.() === true;
       if (toolDangerousCaps.length > 0 && effectivePermission === "auto" && !yolo) {
         effectivePermission = "confirm";
       }
@@ -3495,7 +3555,20 @@ Please call the tool again with arguments that match its inputSchema. You can us
         "tool.has_dangerous_capabilities": toolCapsForAudit.length > 0
       });
       try {
-        const result = await this.executeTool(tool, use, ctx, budget);
+        let result = await this.executeTool(tool, use, ctx, budget);
+        if (this.opts.hookRunner?.has("PostToolUse")) {
+          const post = await this.opts.hookRunner.postToolUse(
+            tool.name,
+            use.input,
+            { content: String(result.content), isError: !!result.is_error },
+            ctx
+          );
+          if (post.additionalContext) {
+            result = { ...result, content: `${result.content}
+
+${post.additionalContext}` };
+          }
+        }
         budget = this.decrementBudget(result, budget);
         span?.setAttribute("tool.is_error", !!result.is_error);
         span?.setAttribute(
@@ -3684,6 +3757,14 @@ ${excerpt}`;
       is_error: true
     };
   }
+  blockedByHookResult(use, reason) {
+    return {
+      type: "tool_result",
+      tool_use_id: use.id,
+      content: `Tool "${use.name}" was blocked by a PreToolUse hook: ${reason ?? "no reason given"}`,
+      is_error: true
+    };
+  }
   decrementBudget(result, budget) {
     const contentBytes = typeof result.content === "string" ? Buffer.byteLength(result.content, "utf8") : Buffer.byteLength(JSON.stringify(result.content), "utf8");
     return Math.max(0, budget - contentBytes);
@@ -6933,12 +7014,97 @@ var DirectorStateCheckpoint = class {
   }
 };
 init_atomic_write();
+var DESTRUCTIVE_BASH_PATTERNS = [
+  /\bgit\s+(?:clean\s+-[^\s]*[xdf]|reset\s+--hard)\b/i,
+  /\b(?:drop|truncate)\s+(?:table|database|schema)\b/i,
+  /\bdelete\s+from\b/i,
+  /\b(?:mkfs|format|diskpart|shutdown|reboot)\b/i,
+  /\bchmod\s+-R\s+777\b/i,
+  /\bchown\s+-R\b/i,
+  /\b(?:curl|wget)\b.*\|\s*(?:sh|bash|zsh|pwsh|powershell)\b/i,
+  /\b(?:powershell|pwsh)\b.*(?:-encodedcommand|-enc)\b/i,
+  /:\(\)\s*\{\s*:\|:&\s*}\s*;/
+];
+var PROJECT_ESCAPE_PATTERN = /(?:^|[\s"'])\.\.(?:[\\/]|$)/;
+var ABSOLUTE_PATH_PATTERN = /(?:^|[\s"'])(?:~[\\/]|\/[A-Za-z0-9_.-]|[A-Za-z]:[\\/])/;
+var SHELL_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", "|", ";", ">", ">>", "<", "2>", "2>>"]);
+function getInputString(input, key) {
+  if (!input || typeof input !== "object") return void 0;
+  const value = input[key];
+  return typeof value === "string" ? value : void 0;
+}
+function pathLooksInsideProject(rawPath, projectRoot) {
+  if (!projectRoot) return false;
+  if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
+  const resolved = path6.resolve(projectRoot, rawPath);
+  const relative8 = path6.relative(projectRoot, resolved);
+  return !!relative8 && !relative8.startsWith("..") && !path6.isAbsolute(relative8);
+}
+function tokenizeShell(command) {
+  return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
+}
+function pathTokenIsOutsideProject(token, projectRoot) {
+  if (!token || SHELL_OPERATORS.has(token) || token.startsWith("-")) return false;
+  if (token === "/" || token === "~" || token === "." || token === "..") return token !== ".";
+  if (token.includes("*")) return true;
+  if (token.startsWith("..") || token.includes("../") || token.includes("..\\")) return true;
+  if (path6.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
+  return false;
+}
+function hasDangerousDeleteTarget(tokens, start, projectRoot) {
+  const targets = tokens.slice(start).filter((token) => !token.startsWith("-") && !SHELL_OPERATORS.has(token));
+  if (targets.length === 0) return true;
+  return targets.some((target) => pathTokenIsOutsideProject(target, projectRoot));
+}
+function hasDestructiveDelete(command, projectRoot) {
+  const tokens = tokenizeShell(command);
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i]?.toLowerCase();
+    if (!token) continue;
+    if (token === "rm") {
+      const args = tokens.slice(i + 1);
+      const recursiveOrForce = args.some(
+        (arg) => /^-[^-]*[rf]/i.test(arg) || arg === "--recursive" || arg === "--force"
+      );
+      if (recursiveOrForce && hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+    }
+    if (token === "rmdir" || token === "rd") {
+      const args = tokens.slice(i + 1);
+      const recursive = args.some((arg) => arg.toLowerCase() === "/s");
+      if (recursive && hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+    }
+    if (token === "del" || token === "erase") {
+      if (hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+    }
+    if (token === "remove-item") {
+      const args = tokens.slice(i + 1).map((arg) => arg.toLowerCase());
+      const recursiveOrForce = args.includes("-recurse") || args.includes("-force");
+      if (recursiveOrForce && hasDangerousDeleteTarget(tokens, i + 1, projectRoot)) return true;
+    }
+  }
+  return false;
+}
+function isClearlyDestructiveBashCommand(command, projectRoot) {
+  const trimmed = command.trim();
+  if (!trimmed) return false;
+  if (hasDestructiveDelete(trimmed, projectRoot)) return true;
+  if (DESTRUCTIVE_BASH_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
+  if (/\bcd\s+(?:\.\.|~|\/|[A-Za-z]:[\\/])/i.test(trimmed)) return true;
+  if (PROJECT_ESCAPE_PATTERN.test(trimmed)) return true;
+  const absolute = trimmed.match(ABSOLUTE_PATH_PATTERN)?.[0]?.trim().replace(/^['"]|['"]$/g, "");
+  if (absolute && !pathLooksInsideProject(absolute, projectRoot)) return true;
+  return false;
+}
+
+// src/security/permission-policy.ts
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
   trustFile;
   yolo;
-  forceAllYolo;
+  yoloDestructive;
+  /** When true, destructive ops still require confirmation even in YOLO mode. */
+  confirmDestructive;
   /**
    * Session-scoped "soft deny" map. When the user presses 'n' (block once),
    * the tool+pattern is added here. If the LLM retries in the same session,
@@ -6971,7 +7137,8 @@ var DefaultPermissionPolicy = class {
   constructor(opts) {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
-    this.forceAllYolo = opts.forceAllYolo ?? false;
+    this.yoloDestructive = opts.yoloDestructive ?? opts.forceAllYolo ?? false;
+    this.confirmDestructive = opts.confirmDestructive ?? false;
     this.promptDelegate = opts.promptDelegate;
   }
   /**
@@ -6991,13 +7158,29 @@ var DefaultPermissionPolicy = class {
   getYolo() {
     return this.yolo;
   }
-  /** Toggle force-all-YOLO at runtime. */
+  /** Toggle the destructive YOLO override at runtime. */
+  setYoloDestructive(enabled) {
+    this.yoloDestructive = enabled;
+  }
+  /** Check whether the destructive YOLO override is active. */
+  getYoloDestructive() {
+    return this.yoloDestructive;
+  }
+  /** Toggle destructive confirmation gate (only meaningful when yolo is active). */
+  setConfirmDestructive(enabled) {
+    this.confirmDestructive = enabled;
+  }
+  /** Check whether destructive confirmation gate is active. */
+  getConfirmDestructive() {
+    return this.confirmDestructive;
+  }
+  /** @deprecated Use `setYoloDestructive`. */
   setForceAllYolo(enabled) {
-    this.forceAllYolo = enabled;
+    this.setYoloDestructive(enabled);
   }
-  /** Check whether force-all-YOLO is active. */
+  /** @deprecated Use `getYoloDestructive`. */
   getForceAllYolo() {
-    return this.forceAllYolo;
+    return this.getYoloDestructive();
   }
   async reload() {
     try {
@@ -7044,29 +7227,28 @@ var DefaultPermissionPolicy = class {
       return { permission: "auto", source: "trust" };
     }
     if (this.yolo) {
-      if (tool.riskTier === "destructive" && !this.forceAllYolo) {
-        if (this.promptDelegate) {
-          const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
-          if (decision === "always") {
-            await this.trust({ tool: tool.name, pattern: subject ?? tool.name });
-            return {
-              permission: "auto",
-              source: "user",
-              reason: "destructive yolo always-allowed"
-            };
-          }
-          if (decision === "deny") {
-            await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
-            return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
+      if (this.confirmDestructive) {
+        const destructive = this.isDestructiveYoloCall(tool, input, ctx);
+        if (destructive) {
+          if (this.promptDelegate) {
+            const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
+            if (decision === "always") {
+              await this.trust({ tool: tool.name, pattern: subject ?? tool.name });
+              return { permission: "auto", source: "user", reason: "destructive yolo always-allowed" };
+            }
+            if (decision === "deny") {
+              await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
+              return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
+            }
+            return { permission: decision === "yes" ? "auto" : "deny", source: "user" };
           }
-          return { permission: decision === "yes" ? "auto" : "deny", source: "user" };
+          return {
+            permission: "confirm",
+            source: "yolo_destructive",
+            riskTier: "destructive",
+            reason: "destructive tool needs explicit approval (confirmDestructive is on)"
+          };
         }
-        return {
-          permission: "confirm",
-          source: "yolo_destructive",
-          riskTier: "destructive",
-          reason: "destructive tool needs explicit approval even in yolo mode"
-        };
       }
       return { permission: "auto", source: "yolo" };
     }
@@ -7096,6 +7278,18 @@ var DefaultPermissionPolicy = class {
     }
     return { permission: "confirm", source: "default" };
   }
+  isDestructiveYoloCall(tool, input, ctx) {
+    if (tool.name === "bash") {
+      const command = getInputString(input, "command");
+      return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;
+    }
+    if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
+      const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
+      if (!targetPath || !ctx.projectRoot) return false;
+      return !pathLooksInsideProject(targetPath, ctx.projectRoot);
+    }
+    return tool.riskTier === "destructive";
+  }
   async trust(rule) {
     if (!this.loaded) await this.reload();
     const entry = this.policy[rule.tool] ?? {};
@@ -7566,8 +7760,8 @@ async function streamProviderToResponse(provider, req, signal, ctx, events) {
       try {
         await Promise.race([
           Promise.resolve(iter.return?.()),
-          new Promise((resolve12) => {
-            drainTimer = setTimeout(resolve12, 500);
+          new Promise((resolve13) => {
+            drainTimer = setTimeout(resolve13, 500);
           })
         ]);
       } finally {
@@ -7628,7 +7822,7 @@ async function runProviderWithRetry(opts) {
           description
         });
       }
-      await new Promise((resolve12, reject) => {
+      await new Promise((resolve13, reject) => {
         let settled = false;
         const onAbort = () => {
           if (settled) return;
@@ -7641,7 +7835,7 @@ async function runProviderWithRetry(opts) {
           settled = true;
           clearTimeout(t2);
           signal.removeEventListener("abort", onAbort);
-          resolve12();
+          resolve13();
         }, delay);
         if (signal.aborted) {
           onAbort();
@@ -9191,7 +9385,8 @@ ${recentJournal}` : "No prior iterations.",
       "   \u2022 When this iteration's Task is finished (real artifact / passing",
       "     test / applied diff / clean output), emit `[done]` on its own line.",
       "   \u2022 Do not stop on the first obstacle \u2014 try at least 3 distinct",
-      "     approaches before giving up. YOLO is active; no confirmations.",
+      "     approaches before giving up. YOLO is active for normal project work;",
+      "     destructive-gated confirmations still belong to the permission flow.",
       "",
       "2. UPDATE TODO STATE (when Source is `todo`)",
       "   \u2022 Mark this todo `in_progress` via the todos tool before tool work.",
@@ -9320,7 +9515,7 @@ ${recentJournal}` : "No prior iterations.",
   }
 };
 function sleep(ms) {
-  return new Promise((resolve12) => setTimeout(resolve12, ms));
+  return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 
 // src/coordination/subagent-budget.ts
@@ -9536,12 +9731,12 @@ var SubagentBudget = class _SubagentBudget {
           if (!bus || !bus.hasListenerFor("budget.threshold_reached")) {
             return Promise.resolve("stop");
           }
-          return new Promise((resolve12) => {
+          return new Promise((resolve13) => {
             let resolved = false;
             const respond = (d) => {
               if (resolved) return;
               resolved = true;
-              resolve12(d);
+              resolve13(d);
             };
             const fallback = setTimeout(
               () => respond("stop"),
@@ -9612,15 +9807,22 @@ var SubagentBudget = class _SubagentBudget {
     void this.checkLimits();
   }
   /**
-   * Wall-clock budget check. Unlike other limits, timeout is always a hard stop
-   * — wall-clock time cannot be "extended" by the coordinator, so it throws
-   * synchronously rather than entering the negotiation flow.
+   * Wall-clock / idle budget check. Delegates to `checkLimits(elapsed)`, so
+   * `timeout` and `idle_timeout` follow the SAME negotiation path as the other
+   * kinds — they are NOT a special-cased hard stop. This is deliberate: a
+   * heartbeat-aware policy (see `attachAutoExtend` and `CollabSession`) grants
+   * a timeout extension only while the agent is making progress and denies it
+   * once the agent is genuinely stuck, which is safer than an unconditional
+   * hard kill of a long-but-working agent. The runner translates the resulting
+   * `BudgetThresholdSignal` decision (`extend` → patch limits in place,
+   * `stop` → abort) just like every other kind.
    *
-   * Decision table:
-   * - no `onThreshold` handler         → throw `BudgetExceededError`
-   * - `mode === 'sync'`               → throw `BudgetExceededError`
-   * - `mode === 'auto'` + no listener  → throw `BudgetExceededError`
-   * - `mode === 'auto'` + listener     → throw `BudgetExceededError` (timeout is not extendable)
+   * Decision table (same as `checkLimits`):
+   * - no `onThreshold` handler        → throw `BudgetExceededError` (hard stop)
+   * - `mode === 'sync'`               → throw `BudgetExceededError` (hard stop)
+   * - `mode === 'auto'` + no listener → throw `BudgetExceededError` (no one to ask)
+   * - `mode === 'auto'` + listener    → throw `BudgetThresholdSignal` (negotiated;
+   *                                     a heartbeat-aware policy may extend the timeout)
    */
   checkTimeout() {
     if (this.startTime === null) return;
@@ -12486,7 +12688,10 @@ var NICKNAME_POOL = {
   "lavoisier": { name: "Lavoisier", domain: "chemistry" },
   "mendeleev": { name: "Mendeleev", domain: "chemistry" }
 };
-var ALL_NICKNAMES = Object.values(NICKNAME_POOL);
+var ALL_NICKNAMES = Object.entries(NICKNAME_POOL);
+var NAME_TO_KEY = Object.fromEntries(
+  ALL_NICKNAMES.map(([key, entry]) => [entry.name, key])
+);
 var DOMAIN_PREFERENCES = {
   "security": ["shannon", "turing", "lamarr", "stallman"],
   "bug-hunter": ["darwin", "curie", "feynman", "fermi"],
@@ -12519,17 +12724,23 @@ function assignNickname(role, used) {
   for (const key of preferences) {
     const entry = NICKNAME_POOL[key];
     if (entry && !used.has(key)) {
-      return `${entry.name} (${formatRole(role)})`;
+      return { key, display: `${entry.name} (${formatRole(role)})` };
     }
   }
-  for (const entry of ALL_NICKNAMES) {
-    const key = Object.entries(NICKNAME_POOL).find(([, v]) => v.name === entry.name)?.[0];
-    if (key && !used.has(key)) {
-      return `${entry.name} (${formatRole(role)})`;
+  for (const [key, entry] of ALL_NICKNAMES) {
+    if (!used.has(key)) {
+      return { key, display: `${entry.name} (${formatRole(role)})` };
     }
   }
   const counter = used.size + 1;
-  return `Scientist #${counter} (${formatRole(role)})`;
+  return { key: `scientist-${counter}`, display: `Scientist #${counter} (${formatRole(role)})` };
+}
+function nicknameKeyFromDisplay(display) {
+  const base = display.replace(/\s*\([^)]*\)\s*$/, "").trim();
+  const key = NAME_TO_KEY[base];
+  if (key) return key;
+  const synthesized = base.match(/^Scientist #(\d+)$/);
+  return synthesized ? `scientist-${synthesized[1]}` : void 0;
 }
 function formatRole(role) {
   return role.split(/[-_]/).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
@@ -12616,11 +12827,10 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
     const name = subagent.name?.trim() ?? "";
     const isPlaceholder = name === "" || name.toLowerCase() === role.toLowerCase() || name === "subagent" || name === "adhoc" || name === "generic" || /^slot-/.test(name);
     if (!isPlaceholder) return subagent;
-    const nickname = assignNickname(role, this.usedNicknames);
-    const baseKey = nickname.split(" ")[0].toLowerCase().replace(/[^a-z0-9-]/g, "-");
-    this.usedNicknames.add(baseKey);
-    this.subagentNicknames.set(subagentId, baseKey);
-    return { ...subagent, name: nickname };
+    const { key, display } = assignNickname(role, this.usedNicknames);
+    this.usedNicknames.add(key);
+    this.subagentNicknames.set(subagentId, key);
+    return { ...subagent, name: display };
   }
   async spawn(subagent) {
     const id = subagent.id || randomUUID();
@@ -12768,7 +12978,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       taskIds.map((id) => {
         const cached = this.completedResults.find((r) => r.taskId === id);
         if (cached) return cached;
-        return new Promise((resolve12, reject) => {
+        return new Promise((resolve13, reject) => {
           const timeout = setTimeout(() => {
             this.off("task.completed", handler);
             reject(new Error(`awaitTasks timed out waiting for task "${id}"`));
@@ -12777,7 +12987,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
             if (result.taskId === id) {
               clearTimeout(timeout);
               this.off("task.completed", handler);
-              resolve12(result);
+              resolve13(result);
             }
           };
           this.on("task.completed", handler);
@@ -12872,23 +13082,32 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
    */
   drainPendingAsAborted(message) {
     const dropped = this.pendingTasks.splice(0, this.pendingTasks.length);
-    for (const t2 of dropped) {
-      const synthetic = {
-        subagentId: t2.subagentId ?? "unassigned",
-        taskId: t2.id,
-        status: "stopped",
-        error: {
-          kind: "aborted_by_parent",
-          message,
-          retryable: false
-        },
-        iterations: 0,
-        toolCalls: 0,
-        durationMs: 0
-      };
-      this.completedResults.push(synthetic);
-      this.emit("task.completed", { task: t2, result: synthetic });
-    }
+    for (const t2 of dropped) this.emitPendingAborted(t2, message);
+  }
+  /**
+   * Emit a synthetic `stopped`/`aborted_by_parent` completion for a single
+   * PENDING task — one that was never counted in `inFlight`. This MUST bypass
+   * `recordCompletion`: that path does `inFlight--`, which for a pending task
+   * steals a decrement from a genuinely in-flight task and trips the underflow
+   * guard — suppressing that real task's `task.completed` and hanging its
+   * `awaitTasks()` caller. Pushes the result and fires the event directly.
+   */
+  emitPendingAborted(task, message) {
+    const synthetic = {
+      subagentId: task.subagentId ?? "unassigned",
+      taskId: task.id,
+      status: "stopped",
+      error: {
+        kind: "aborted_by_parent",
+        message,
+        retryable: false
+      },
+      iterations: 0,
+      toolCalls: 0,
+      durationMs: 0
+    };
+    this.completedResults.push(synthetic);
+    this.emit("task.completed", { task, result: synthetic });
   }
   async runDispatched(subagentId, task) {
     const subagent = this.subagents.get(subagentId);
@@ -13149,20 +13368,10 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
     const orphaned = this.pendingTasks.filter((t2) => t2.subagentId === subagentId);
     this.pendingTasks = this.pendingTasks.filter((t2) => t2.subagentId !== subagentId);
     for (const t2 of orphaned) {
-      const synthetic = {
-        subagentId,
-        taskId: t2.id,
-        status: "stopped",
-        error: {
-          kind: "aborted_by_parent",
-          message: `Subagent "${subagentId}" was removed while task "${t2.id}" was pending`,
-          retryable: false
-        },
-        iterations: 0,
-        toolCalls: 0,
-        durationMs: 0
-      };
-      this.recordCompletion(synthetic);
+      this.emitPendingAborted(
+        t2,
+        `Subagent "${subagentId}" was removed while task "${t2.id}" was pending`
+      );
     }
     this.fleetBus?.emit({
       subagentId,
@@ -13280,7 +13489,7 @@ function providerErrorToSubagentError(err, message, cause) {
 
 // src/execution/parallel-eternal-engine.ts
 function sleep2(ms) {
-  return new Promise((resolve12) => setTimeout(resolve12, ms));
+  return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 var GOAL_COMPLETE_MARKER2 = /^\s*\[goal[_\s-]?complete\]\s*$/im;
 var ParallelEternalEngine = class {
@@ -13459,7 +13668,8 @@ ${recentJournal}` : "No prior iterations.",
       "\u2500\u2500 EXECUTION PROTOCOL \u2500\u2500",
       "\u2022 Execute the assigned task end-to-end using multiple tool calls.",
       "\u2022 Emit `[done]` on its own line when the task is complete.",
-      "\u2022 Do not ask for confirmation \u2014 YOLO is active.",
+      "\u2022 Do not ask before routine in-project tool use \u2014 YOLO is active for normal project work.",
+      "\u2022 If a destructive-gated confirmation appears, wait for the permission flow.",
       "\u2022 If the overall Mission is accomplished, emit `[GOAL_COMPLETE]` followed by a verification recipe.",
       "\u2022 Keep output concise \u2014 summarize findings, do not transcribe files."
     ].join("\n");
@@ -13539,6 +13749,7 @@ ${personaLine}Task: ${task}
     } catch {
       results = coordinator.results().slice(-taskIds.length);
     }
+    await Promise.allSettled(subagentIds.map((id) => coordinator.remove(id)));
     const allSuccessful = results.length > 0 && results.every((r) => r.status === "success");
     const goalComplete = results.some(
       (r) => r.status === "success" && typeof r.result === "string" && GOAL_COMPLETE_MARKER2.test(r.result)
@@ -13716,8 +13927,10 @@ ${journalTail.join("\n")}` : "Recent journal: (none \u2014 this is the first ite
       "  decide.",
       "",
       "### Operating principles",
-      "- YOLO is active. Do NOT ask for confirmation, do NOT propose",
-      "  options. Pick the best path and execute it.",
+      "- YOLO is active for normal project work. Proceed with routine",
+      "  in-project tool use without pre-confirming; pick the best path and execute it.",
+      "  If the permission system raises a destructive-gated confirmation, wait",
+      "  for that flow instead of trying to bypass it.",
       "- Use tools freely; multiple calls per turn are normal and expected.",
       "- When working on a todo, mark it `in_progress` via the todos tool",
       "  before tool work and `completed` (or `cancelled` with a reason)",
@@ -14332,6 +14545,10 @@ Emit each evaluation immediately. Do not wait until you have read all reports.`;
     return lines.join("\n");
   }
   cleanup() {
+    if (this._timeoutTimer) {
+      clearTimeout(this._timeoutTimer);
+      this._timeoutTimer = void 0;
+    }
     for (const dispose of this.disposers) dispose();
     this.disposers.length = 0;
   }
@@ -15461,18 +15678,20 @@ var Director = class _Director {
       if (e.subagentId.startsWith("bug-hunter-") || e.subagentId.startsWith("refactor-planner-") || e.subagentId.startsWith("critic-")) {
         return;
       }
-      if (payload.kind === "timeout") {
+      if (payload.kind === "timeout" || payload.kind === "idle_timeout") {
+        const heartbeatKey = `${e.subagentId}:${payload.kind}`;
         const progress = progressBySubagent.get(e.subagentId) ?? 0;
-        const lastProgress = lastTimeoutProgress.get(e.subagentId) ?? -1;
+        const lastProgress = lastTimeoutProgress.get(heartbeatKey) ?? -1;
         if (progress <= lastProgress) {
           payload.deny();
           return;
         }
-        lastTimeoutProgress.set(e.subagentId, progress);
+        lastTimeoutProgress.set(heartbeatKey, progress);
+        const field = payload.kind === "timeout" ? "timeoutMs" : "idleTimeoutMs";
         setImmediate(() => {
           const newLimit = Math.min(Math.ceil(payload.limit * 2), 24 * 60 * 6e4);
-          this.recordExtension(e.subagentId, e.taskId, "timeout", newLimit);
-          payload.extend({ timeoutMs: newLimit });
+          this.recordExtension(e.subagentId, e.taskId, payload.kind, newLimit);
+          payload.extend({ [field]: newLimit });
         });
         return;
       }
@@ -15788,10 +16007,9 @@ var Director = class _Director {
       if (this.fleetManager) {
         this.fleetManager.assignNicknameAndRecord(config);
       } else {
-        config.name = assignNickname(role, this._usedNicknames);
-        this._usedNicknames.add(
-          config.name.split(" ")[0].toLowerCase().replace(/[^a-z0-9-]/g, "-")
-        );
+        const { key, display } = assignNickname(role, this._usedNicknames);
+        config.name = display;
+        this._usedNicknames.add(key);
       }
     }
     result = await this.coordinator.spawn(config);
@@ -16085,11 +16303,11 @@ var Director = class _Director {
         if (cached) return cached;
         const existing = this.taskWaiters.get(id);
         if (existing) return existing.promise;
-        let resolve12;
+        let resolve13;
         const promise = new Promise((res) => {
-          resolve12 = res;
+          resolve13 = res;
         });
-        this.taskWaiters.set(id, { promise, resolve: resolve12 });
+        this.taskWaiters.set(id, { promise, resolve: resolve13 });
         return promise;
       })
     );
@@ -16113,8 +16331,8 @@ var Director = class _Director {
     } else {
       const entry = this.manifestEntries.get(subagentId);
       if (entry?.name) {
-        const nicknameKey = entry.name.split(" ")[0].toLowerCase().replace(/[^a-z0-9-]/g, "-");
-        this._usedNicknames.delete(nicknameKey);
+        const nicknameKey = nicknameKeyFromDisplay(entry.name);
+        if (nicknameKey) this._usedNicknames.delete(nicknameKey);
       }
     }
     this.manifestEntries.delete(subagentId);
@@ -16474,7 +16692,7 @@ function createDelegateTool(opts) {
           subagentId
         });
         const dir = director;
-        const result = await new Promise((resolve12) => {
+        const result = await new Promise((resolve13) => {
           let settled = false;
           let timer;
           const finish = (value) => {
@@ -16484,7 +16702,7 @@ function createDelegateTool(opts) {
             offTool();
             offIter();
             offProgress();
-            resolve12(value);
+            resolve13(value);
           };
           const arm = () => {
             if (timer) clearTimeout(timer);
@@ -18114,9 +18332,9 @@ var AISpecBuilder = class {
     if (!this.sessionPath) return;
     try {
       const fsp20 = await import('fs/promises');
-      const path36 = await import('path');
+      const path37 = await import('path');
       const { atomicWrite: atomicWrite2 } = await Promise.resolve().then(() => (init_atomic_write(), atomic_write_exports));
-      await fsp20.mkdir(path36.dirname(this.sessionPath), { recursive: true });
+      await fsp20.mkdir(path37.dirname(this.sessionPath), { recursive: true });
       await atomicWrite2(this.sessionPath, JSON.stringify(this.session, null, 2));
     } catch {
     }
@@ -18826,15 +19044,15 @@ function computeCriticalPath(graph, _topoOrder, blockedByMap) {
       maxId = id;
     }
   }
-  const path36 = [];
+  const path37 = [];
   let current = maxId;
   const visited = /* @__PURE__ */ new Set();
   while (current && !visited.has(current)) {
     visited.add(current);
-    path36.unshift(current);
+    path37.unshift(current);
     current = prev.get(current) ?? null;
   }
-  return path36;
+  return path37;
 }
 function computeParallelGroups(graph, blockedByMap) {
   const groups = [];
@@ -19384,7 +19602,7 @@ var SddParallelRun = class {
       "\u2500\u2500 EXECUTION PROTOCOL \u2500\u2500",
       "\u2022 Execute the assigned SDD task end-to-end using multiple tool calls.",
       "\u2022 Mark the task [done] in the tracker when complete.",
-      "\u2022 Do not ask for confirmation.",
+      "\u2022 Do not ask before routine in-project tool use; if a permission gate appears, wait for that flow.",
       "\u2022 Keep output concise \u2014 summarize changes, do not transcribe files."
     ].join("\n");
     const spawns = subagentIds.map(
@@ -19627,9 +19845,9 @@ var DefaultHealthRegistry = class {
   }
   async runOne(check) {
     let timer = null;
-    const timeout = new Promise((resolve12) => {
+    const timeout = new Promise((resolve13) => {
       timer = setTimeout(
-        () => resolve12({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
+        () => resolve13({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
         this.timeoutMs
       );
     });
@@ -19812,7 +20030,7 @@ async function startMetricsServer(opts) {
   const tls = opts.tls;
   const useHttps = !!(tls?.cert && tls?.key);
   const host = opts.host ?? "127.0.0.1";
-  const path36 = opts.path ?? "/metrics";
+  const path37 = opts.path ?? "/metrics";
   const healthPath = opts.healthPath ?? "/healthz";
   const healthRegistry = opts.healthRegistry;
   const listener = (req, res) => {
@@ -19822,7 +20040,7 @@ async function startMetricsServer(opts) {
       return;
     }
     const url = req.url.split("?")[0];
-    if (url === path36) {
+    if (url === path37) {
       let body;
       try {
         body = renderPrometheus(opts.sink.snapshot());
@@ -19868,14 +20086,14 @@ async function startMetricsServer(opts) {
     const { createServer } = await import('http');
     server = createServer(listener);
   }
-  await new Promise((resolve12, reject) => {
+  await new Promise((resolve13, reject) => {
     const onError = (err) => {
       server.off("listening", onListening);
       reject(err);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve12();
+      resolve13();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -19886,9 +20104,9 @@ async function startMetricsServer(opts) {
   const protocol = useHttps ? "https" : "http";
   return {
     port: boundPort,
-    url: `${protocol}://${host}:${boundPort}${path36}`,
-    close: () => new Promise((resolve12, reject) => {
-      server.close((err) => err ? reject(err) : resolve12());
+    url: `${protocol}://${host}:${boundPort}${path37}`,
+    close: () => new Promise((resolve13, reject) => {
+      server.close((err) => err ? reject(err) : resolve13());
     })
   };
 }
@@ -20437,7 +20655,7 @@ var context7Server = () => ({
   name: "context7",
   description: "Codebase-aware documentation and Q&A (context7.ai)",
   transport: "streamable-http",
-  url: "https://server.context7.ai/mcp",
+  url: "https://mcp.context7.com/mcp",
   permission: "confirm"
 });
 var braveSearchServer = () => ({
@@ -22215,8 +22433,8 @@ function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
   }
   const dest = path6.resolve(localPath, normalizedRel);
   const root = path6.resolve(localPath);
-  const relative7 = path6.relative(root, dest);
-  if (relative7.startsWith("..") || path6.isAbsolute(relative7)) {
+  const relative8 = path6.relative(root, dest);
+  if (relative8.startsWith("..") || path6.isAbsolute(relative8)) {
     throw new Error(`Refusing CloudSync path outside category root: ${remotePath}`);
   }
   return dest;
@@ -23389,7 +23607,7 @@ var SecurityScannerOrchestrator = class {
       const delay = Math.round(policy.delayMs(attempt));
       const status = isProviderErr ? err.status : 0;
       console.warn(`[SecurityScanner] retry ${attempt + 1} after ${delay}ms (status=${status}) \u2014 ${errAsErr.message}`);
-      await new Promise((resolve12) => setTimeout(resolve12, delay));
+      await new Promise((resolve13) => setTimeout(resolve13, delay));
       return this.completeWithRetry(provider, request, abortController, attempt + 1);
     }
   }
@@ -24248,11 +24466,10 @@ var FleetManager = class {
    */
   assignNicknameAndRecord(config) {
     const role = config.role ?? "subagent";
-    const nickname = assignNickname(role, this._usedNicknames);
-    const baseKey = nickname.split(" ")[0].toLowerCase().replace(/[^a-z0-9-]/g, "-");
-    this._usedNicknames.add(baseKey);
-    config.name = nickname;
-    return nickname;
+    const { key, display } = assignNickname(role, this._usedNicknames);
+    this._usedNicknames.add(key);
+    config.name = display;
+    return display;
   }
   /**
    * Returns the set of already-assigned nickname keys — useful for debugging
@@ -24437,8 +24654,8 @@ var FleetManager = class {
   removeSubagent(subagentId) {
     const entry = this.manifestEntries.get(subagentId);
     if (entry?.name) {
-      const nicknameKey = entry.name.split(" ")[0].toLowerCase().replace(/[^a-z0-9-]/g, "-");
-      this._usedNicknames.delete(nicknameKey);
+      const nicknameKey = nicknameKeyFromDisplay(entry.name);
+      if (nicknameKey) this._usedNicknames.delete(nicknameKey);
     }
     for (const [taskId, task] of this.pendingTasks) {
       if (task.subagentId === subagentId) {
@@ -24885,37 +25102,146 @@ var ExtensionRegistry = class {
   }
 };
 
-// src/core/btw.ts
-var META_KEY = "_btwNotes";
-function readQueue(ctx) {
-  const raw = ctx.meta[META_KEY];
-  return Array.isArray(raw) ? raw : [];
-}
-function setBtwNote(ctx, text) {
-  const trimmed = text.trim();
-  if (!trimmed) return readQueue(ctx).length;
-  const next = [...readQueue(ctx), trimmed].slice(-20);
-  ctx.meta[META_KEY] = next;
-  return next.length;
-}
-function pendingBtwCount(ctx) {
-  return readQueue(ctx).length;
-}
-function consumeBtwNotes(ctx) {
-  const notes = readQueue(ctx);
-  if (notes.length > 0) delete ctx.meta[META_KEY];
-  return notes;
-}
-function buildBtwBlock(notes) {
-  const body = notes.map((n) => `- ${n}`).join("\n");
-  return [
-    "[BY THE WAY \u2014 the user added this while you were working. Fold it into",
-    "your current task; do not restart from scratch unless it contradicts the",
-    "goal:",
-    "",
-    body,
-    "]"
-  ].join("\n");
+// src/core/agent-tools.ts
+function createAgentToolHandler(a) {
+  async function executeSingleWithDecision(tool, use) {
+    const start = Date.now();
+    try {
+      const result = await a.toolExecutor.executeTool(
+        tool,
+        use,
+        a.ctx,
+        a.perIterationOutputCapBytes
+      );
+      return { result, durationMs: Date.now() - start };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return {
+        result: {
+          type: "tool_result",
+          tool_use_id: use.id,
+          content: `Tool "${tool.name}" threw: ${msg}`,
+          is_error: true
+        },
+        durationMs: Date.now() - start
+      };
+    }
+  }
+  function waitForConfirm(info) {
+    return new Promise((resolve13) => {
+      a.events.emit("tool.confirm_needed", {
+        tool: info.tool,
+        input: info.input,
+        toolUseId: info.toolUseId,
+        suggestedPattern: info.suggestedPattern,
+        resolve: resolve13
+      });
+    });
+  }
+  function emitToolExecuted(toolUseId, toolName, durationMs, ok, input, content) {
+    const sig = sizeSignals(toolName, content);
+    a.events.emit("tool.executed", {
+      id: toolUseId,
+      name: toolName,
+      durationMs,
+      ok,
+      input,
+      output: truncateForEvent(content),
+      outputBytes: sig.outputBytes,
+      outputTokens: sig.outputTokens,
+      outputLines: sig.outputLines
+    });
+  }
+  async function executeTools(toolUses) {
+    const selectedToolUses = await a.extensions.runBeforeToolExecution(a.ctx, toolUses);
+    const { outputs } = await a.toolExecutor.executeBatch(
+      selectedToolUses,
+      a.ctx,
+      a.executionStrategy
+    );
+    const useById = new Map(selectedToolUses.map((u) => [u.id, u]));
+    const resultsForMessage = [];
+    for (const { result, tool, durationMs } of outputs) {
+      if (result.type === "tool_confirm_pending") {
+        const decision = await waitForConfirm({
+          tool,
+          input: result.input,
+          toolUseId: result.toolUseId,
+          suggestedPattern: result.suggestedPattern
+        });
+        if (decision === "always") {
+          try {
+            await a.permission.trust({ tool: tool.name, pattern: result.suggestedPattern });
+            a.events.emit("trust.persisted", { tool: tool.name, pattern: result.suggestedPattern, decision });
+          } catch {
+          }
+        } else if (decision === "deny") {
+          try {
+            await a.permission.deny({ tool: tool.name, pattern: result.suggestedPattern });
+            a.events.emit("trust.persisted", { tool: tool.name, pattern: result.suggestedPattern, decision });
+          } catch {
+          }
+        }
+        if (decision === "yes") {
+          const p = a.permission;
+          p.allowOnce?.({ tool: tool.name, pattern: result.suggestedPattern });
+        } else if (decision === "no") {
+          const p = a.permission;
+          p.denyOnce?.({ tool: tool.name, pattern: result.suggestedPattern });
+        }
+        const reRunResult = decision === "yes" || decision === "always" ? await executeSingleWithDecision(tool, {
+          id: result.toolUseId,
+          name: tool.name,
+          input: result.input
+        }) : {
+          result: {
+            type: "tool_result",
+            tool_use_id: result.toolUseId,
+            content: decision === "deny" ? `Tool "${tool.name}" denied and blocked for this pattern.` : `Tool "${tool.name}" denied by user.`,
+            is_error: true
+          },
+          durationMs: 0
+        };
+        const use2 = useById.get(reRunResult.result.tool_use_id);
+        if (use2) {
+          await a.pipelines.toolCall.run({ toolUse: use2, result: reRunResult.result, ctx: a.ctx, tool });
+          await a.ctx.session.append({
+            type: "tool_result",
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            id: reRunResult.result.tool_use_id,
+            content: reRunResult.result.content,
+            isError: !!reRunResult.result.is_error
+          });
+          emitToolExecuted(
+            reRunResult.result.tool_use_id,
+            tool.name,
+            reRunResult.durationMs,
+            !reRunResult.result.is_error,
+            result.input,
+            reRunResult.result.content
+          );
+        }
+        resultsForMessage.push(reRunResult.result);
+        continue;
+      }
+      resultsForMessage.push(result);
+      const use = useById.get(result.tool_use_id);
+      if (!use) continue;
+      await a.pipelines.toolCall.run({ toolUse: use, result, ctx: a.ctx, tool: tool ?? void 0 });
+      await a.ctx.session.append({
+        type: "tool_result",
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        id: result.tool_use_id,
+        content: result.content,
+        isError: !!result.is_error
+      });
+      emitToolExecuted(result.tool_use_id, use.name, durationMs, !result.is_error, use.input, result.content);
+    }
+    a.ctx.state.appendMessage({ role: "user", content: resultsForMessage });
+    await a.extensions.runAfterToolExecution(a.ctx, outputs);
+    return resultsForMessage;
+  }
+  return { executeTools, executeSingleWithDecision };
 }
 
 // src/core/continue-to-next-iteration.ts
@@ -24933,13 +25259,13 @@ function parseContinueDirective(text) {
   }
   return lastDirective;
 }
-var META_KEY2 = "_autonomousContinue";
+var META_KEY = "_autonomousContinue";
 function setAutonomousContinue(ctx) {
-  ctx.meta[META_KEY2] = true;
+  ctx.meta[META_KEY] = true;
 }
 function consumeAutonomousContinue(ctx) {
-  const val = ctx.meta[META_KEY2] === true;
-  delete ctx.meta[META_KEY2];
+  const val = ctx.meta[META_KEY] === true;
+  delete ctx.meta[META_KEY];
   return val;
 }
 function makeContinueToNextIterationTool() {
@@ -24962,31 +25288,129 @@ function makeContinueToNextIterationTool() {
   };
 }
 
-// src/core/iteration-limit.ts
-function requestLimitExtension(opts) {
-  const { events, currentIterations, currentLimit, autoExtend, timeoutMs = 3e4 } = opts;
-  return new Promise((resolve12) => {
-    let resolved = false;
-    const timerFired = () => {
-      if (!resolved) {
-        resolved = true;
-        resolve12(0);
-      }
-    };
-    const timer = setTimeout(timerFired, timeoutMs);
-    timer.unref();
-    const deny = () => {
-      if (!resolved) {
-        resolved = true;
-        clearTimeout(timer);
-        resolve12(0);
-      }
+// src/core/agent-response.ts
+function createAgentResponseHandler(a) {
+  async function buildAndRunRequestPipeline(opts) {
+    const repaired = repairToolUseAdjacency(a.ctx.messages);
+    if (repaired.report.changed) {
+      a.ctx.state.replaceMessages(repaired.messages);
+      a.events.emit("context.repaired", {
+        ctx: a.ctx,
+        ...repaired.report
+      });
+      a.logger.warn(
+        `Repaired context tool adjacency: removed ${repaired.report.removedToolUses.length} tool_use block(s), ${repaired.report.removedToolResults.length} tool_result block(s), ${repaired.report.removedMessages} empty message(s)`
+      );
+    }
+    const baseReq = {
+      model: opts.model ?? a.ctx.model,
+      system: a.ctx.systemPrompt,
+      messages: a.ctx.messages,
+      tools: a.tools.list(),
+      maxTokens: 8192
     };
-    const grant = (extra) => {
-      if (!resolved) {
-        resolved = true;
+    return a.pipelines.request.run(baseReq);
+  }
+  async function processResponse(raw, req) {
+    let res = raw;
+    res = await a.pipelines.response.run(res);
+    a.events.emit("provider.response", {
+      ctx: a.ctx,
+      usage: res.usage,
+      stopReason: res.stopReason
+    });
+    a.ctx.tokenCounter.account(res.usage, req.model);
+    a.ctx.state.appendMessage({ role: "assistant", content: res.content });
+    await a.ctx.session.append({
+      type: "llm_response",
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      content: res.content,
+      stopReason: res.stopReason,
+      usage: res.usage
+    });
+    if (a.ctx.signal.aborted) {
+      let finalText2 = "";
+      for (const block of res.content) {
+        if (isTextBlock(block)) finalText2 += block.text;
+      }
+      return { finalText: finalText2, aborted: true, done: false };
+    }
+    let finalText = "";
+    const streamed = a.ctx.provider.capabilities.streaming;
+    for (const block of res.content) {
+      if (isTextBlock(block)) {
+        const rendered = await a.pipelines.assistantOutput.run(block);
+        finalText += rendered.text;
+        if (!streamed) a.renderer?.write(rendered);
+      }
+    }
+    let directive = "none";
+    if (finalText) {
+      directive = parseContinueDirective(finalText);
+    }
+    return { finalText, aborted: false, done: false, directive };
+  }
+  return { buildAndRunRequestPipeline, processResponse };
+}
+
+// src/core/btw.ts
+var META_KEY2 = "_btwNotes";
+function readQueue(ctx) {
+  const raw = ctx.meta[META_KEY2];
+  return Array.isArray(raw) ? raw : [];
+}
+function setBtwNote(ctx, text) {
+  const trimmed = text.trim();
+  if (!trimmed) return readQueue(ctx).length;
+  const next = [...readQueue(ctx), trimmed].slice(-20);
+  ctx.meta[META_KEY2] = next;
+  return next.length;
+}
+function pendingBtwCount(ctx) {
+  return readQueue(ctx).length;
+}
+function consumeBtwNotes(ctx) {
+  const notes = readQueue(ctx);
+  if (notes.length > 0) delete ctx.meta[META_KEY2];
+  return notes;
+}
+function buildBtwBlock(notes) {
+  const body = notes.map((n) => `- ${n}`).join("\n");
+  return [
+    "[BY THE WAY \u2014 the user added this while you were working. Fold it into",
+    "your current task; do not restart from scratch unless it contradicts the",
+    "goal:",
+    "",
+    body,
+    "]"
+  ].join("\n");
+}
+
+// src/core/iteration-limit.ts
+function requestLimitExtension(opts) {
+  const { events, currentIterations, currentLimit, autoExtend, timeoutMs = 3e4 } = opts;
+  return new Promise((resolve13) => {
+    let resolved = false;
+    const timerFired = () => {
+      if (!resolved) {
+        resolved = true;
+        resolve13(0);
+      }
+    };
+    const timer = setTimeout(timerFired, timeoutMs);
+    timer.unref();
+    const deny = () => {
+      if (!resolved) {
+        resolved = true;
         clearTimeout(timer);
-        resolve12(Math.max(0, extra));
+        resolve13(0);
+      }
+    };
+    const grant = (extra) => {
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timer);
+        resolve13(Math.max(0, extra));
       }
     };
     events.emit("iteration.limit_reached", {
@@ -25000,216 +25424,113 @@ function requestLimitExtension(opts) {
         if (!resolved) {
           resolved = true;
           clearTimeout(timer);
-          resolve12(100);
+          resolve13(100);
         }
       });
     }
   });
 }
 
-// src/core/agent.ts
-var DEFAULT_MAX_ITERATIONS = 100;
-function normalizeInput(input) {
-  if (typeof input === "string") {
-    return { blocks: [{ type: "text", text: input }], text: input };
-  }
-  const text = input.filter(isTextBlock).map((b) => b.text).join("");
-  return { blocks: input, text };
-}
-function createDefaultPipelines() {
-  return {
-    request: new Pipeline(),
-    response: new Pipeline(),
-    toolCall: new Pipeline(),
-    userInput: new Pipeline(),
-    assistantOutput: new Pipeline(),
-    contextWindow: new Pipeline()
-  };
+// src/core/agent-loop.ts
+function toError(err) {
+  return err instanceof Error ? err : new Error(String(err));
 }
-var Agent = class {
-  container;
-  tools;
-  providers;
-  events;
-  pipelines;
-  ctx;
-  maxIterations;
-  executionStrategy;
-  perIterationOutputCapBytes;
-  plugins = [];
-  toolExecutor;
-  autoExtendLimit;
-  /** Enables autonomous continue: model can signal `[continue]` or call continue_to_next_iteration() to re-run. */
-  autonomousContinue;
-  tracer;
-  extensions;
-  constructor(init) {
-    this.container = init.container;
-    this.tools = init.tools;
-    this.providers = init.providers;
-    this.events = init.events;
-    this.pipelines = init.pipelines;
-    this.ctx = init.context;
-    this.maxIterations = init.maxIterations ?? DEFAULT_MAX_ITERATIONS;
-    this.executionStrategy = init.executionStrategy ?? "smart";
-    this.perIterationOutputCapBytes = init.perIterationOutputCapBytes ?? 1e5;
-    this.autoExtendLimit = init.autoExtendLimit ?? true;
-    this.autonomousContinue = init.autonomousContinue ?? false;
-    this.tracer = init.tracer;
-    this.extensions = init.extensions ?? new ExtensionRegistry();
-    this.extensions.setLogger(this.container.resolve(TOKENS.Logger));
-    this.toolExecutor = init.toolExecutor;
-  }
-  get logger() {
-    return this.container.resolve(TOKENS.Logger);
-  }
-  get retry() {
-    return this.container.resolve(TOKENS.RetryPolicy);
-  }
-  get errorHandler() {
-    return this.container.resolve(TOKENS.ErrorHandler);
-  }
-  get permission() {
-    return this.container.resolve(TOKENS.PermissionPolicy);
+function createAgentLoopHandler(a, handlers) {
+  async function compactContextIfNeeded() {
+    await a.pipelines.contextWindow.run(a.ctx);
   }
-  get renderer() {
-    return this.container.has(TOKENS.Renderer) ? this.container.resolve(TOKENS.Renderer) : void 0;
+  function emitContextPct() {
+    const maxContext = a.ctx.provider.capabilities.maxContext ?? 2e5;
+    const { total } = estimateRequestTokens(a.ctx.messages, a.ctx.systemPrompt, a.ctx.tools ?? []);
+    a.events.emit("ctx.pct", { load: total / maxContext, tokens: total, maxContext });
   }
-  /**
-   * Switch from inline CLI prompts to event-driven confirmation.
-   * Clears both the ToolExecutor's confirmAwaiter (so it returns
-   * `ToolConfirmPendingResult`) and the permission policy's
-   * promptDelegate (so `evaluate()` returns `confirm`).
-   *
-   * Call this before entering TUI or any mode where stdin is owned
-   * by a UI framework (Ink, WebUI WS bridge). Without this, the
-   * inline prompt writes to stdout and blocks on stdin — both of
-   * which are owned by the framework — making the prompt invisible
-   * and the input deadlocked.
-   */
-  disableInteractiveConfirmation() {
-    this.toolExecutor.clearConfirmAwaiter();
-    const policy = this.permission;
-    if (typeof policy.setPromptDelegate === "function") {
-      policy.setPromptDelegate(void 0);
+  function injectPendingBtwNotes() {
+    const notes = consumeBtwNotes(a.ctx);
+    if (notes.length === 0) return;
+    const block = { type: "text", text: buildBtwBlock(notes) };
+    const messages = a.ctx.messages;
+    const last = messages[messages.length - 1];
+    if (last && last.role === "user") {
+      const content = typeof last.content === "string" ? [{ type: "text", text: last.content }, block] : [...last.content, block];
+      a.ctx.state.replaceMessages([...messages.slice(0, -1), { ...last, content }]);
+    } else {
+      a.ctx.state.appendMessage({ role: "user", content: [block] });
     }
   }
-  register(tool) {
-    this.tools.register(tool);
-  }
-  async use(plugin, api) {
-    await plugin.setup(api);
-    this.plugins.push({ plugin, api });
-  }
-  /** Tear down all plugins in reverse order, calling their teardown hooks. */
-  async teardown() {
-    const errors = [];
-    for (const { plugin, api } of this.plugins.toReversed()) {
-      if (typeof plugin.teardown !== "function") continue;
-      try {
-        await plugin.teardown(api);
-      } catch (err) {
-        errors.push(err);
+  async function checkIterationLimit(iterationIndex, limit, hasHardLimit, currentIterations, delegateSummaries) {
+    if (hasHardLimit && iterationIndex >= limit) {
+      const extendBy = await requestLimitExtension({
+        events: a.events,
+        currentIterations,
+        currentLimit: limit,
+        autoExtend: a.autoExtendLimit
+      });
+      if (extendBy > 0) {
+        const newLimit = limit + extendBy;
+        a.logger.info(`Iteration limit extended by ${extendBy} (new limit: ${newLimit})`);
+        return { limit: newLimit };
       }
+      return { limit, exit: { status: "max_iterations", iterations: currentIterations, delegateSummaries } };
     }
-    this.plugins.length = 0;
-    if (errors.length > 0) {
-      throw new Error(`Agent teardown failed: ${errors.map(String).join("; ")}`);
-    }
-  }
-  async run(userInput, opts = {}) {
-    const controller = new RunController({ parentSignal: opts.signal });
-    const signal = controller.signal;
-    this.ctx.signal = signal;
-    controller.onAbort(() => this.ctx.drainAbortHooks());
-    const span = this.tracer?.startSpan("agent.run", {
-      "agent.model": opts.model ?? this.ctx.model,
-      "agent.executionStrategy": opts.executionStrategy ?? this.executionStrategy
-    });
-    const { blocks, text } = normalizeInput(userInput);
-    const inputPayload = { content: blocks, text, ctx: this.ctx };
-    await this.extensions.runBeforeRun(this.ctx, inputPayload);
-    try {
-      const result = await this.runInner(inputPayload, opts, controller);
-      span?.setAttribute("agent.status", result.status);
-      span?.setAttribute("agent.iterations", result.iterations);
-      await this.extensions.runAfterRun(this.ctx, result);
-      return result;
-    } catch (err) {
-      const wse = err instanceof AgentError ? err : toWrongStackError(err);
-      this.events.emit("error", { err: toError(err), phase: "agent" });
-      if (err instanceof Error) span?.recordError(err);
-      span?.setAttribute("agent.status", "failed");
-      const result = {
-        status: signal.aborted ? "aborted" : "failed",
-        iterations: 0,
-        error: wse
-      };
-      await this.extensions.runAfterRun(this.ctx, result);
-      return result;
-    } finally {
-      span?.end();
-      await controller.dispose();
-    }
+    return { limit };
   }
-  async runInner(inputPayload, opts, controller) {
-    await this.pipelines.userInput.run(inputPayload);
-    this.ctx.state.appendMessage({ role: "user", content: inputPayload.content });
-    await this.ctx.session.append({
+  async function runInner(inputPayload, opts, controller, autonomousContinue) {
+    await a.pipelines.userInput.run(inputPayload);
+    a.ctx.state.appendMessage({ role: "user", content: inputPayload.content });
+    await a.ctx.session.append({
       type: "user_input",
       ts: (/* @__PURE__ */ new Date()).toISOString(),
       content: inputPayload.content
     });
-    const promptIndex = this.ctx.messages.filter((m) => m.role === "user").length - 1;
+    const promptIndex = a.ctx.messages.filter((m) => m.role === "user").length - 1;
     const preview = inputPayload.text.slice(0, 80) + (inputPayload.text.length > 80 ? "\u2026" : "");
-    await this.ctx.session.writeCheckpoint(promptIndex, preview);
+    await a.ctx.session.writeCheckpoint(promptIndex, preview);
     let finalText = "";
     let iterations = 0;
     const delegateSummaries = [];
-    let effectiveLimit = opts.maxIterations ?? this.maxIterations;
+    let effectiveLimit = opts.maxIterations ?? a.maxIterations;
     const hasHardLimit = effectiveLimit > 0 && Number.isFinite(effectiveLimit);
     let recoveryRetries = 0;
-    const autonomousContinue = opts.autonomousContinue ?? this.autonomousContinue;
     const onSubagentDone = ({ summary, ok }) => {
       delegateSummaries.push({ summary, ok });
     };
-    const offSubagentDone = this.events.on("subagent.done", onSubagentDone);
-    const diRunner = this.container.has(TOKENS.ProviderRunner) ? this.container.resolve(TOKENS.ProviderRunner) : null;
+    const offSubagentDone = a.events.on("subagent.done", onSubagentDone);
+    const diRunner = a.container.has(TOKENS.ProviderRunner) ? a.container.resolve(TOKENS.ProviderRunner) : null;
     const baseRunner = diRunner ? (ctx, req) => diRunner.run({
       provider: ctx.provider,
       request: req,
       signal: controller.signal,
       ctx,
-      events: this.events,
-      retry: this.retry,
-      logger: this.logger,
-      tracer: this.tracer
+      events: a.events,
+      retry: a.retry,
+      logger: a.logger,
+      tracer: a.tracer
     }) : async (ctx, req) => runProviderWithRetry({
       provider: ctx.provider,
       request: req,
       signal: controller.signal,
       ctx,
-      events: this.events,
-      retry: this.retry,
-      logger: this.logger,
-      tracer: this.tracer
+      events: a.events,
+      retry: a.retry,
+      logger: a.logger,
+      tracer: a.tracer
     });
-    const customRunner = this.extensions.wrapProviderRunner(baseRunner);
+    const customRunner = a.extensions.wrapProviderRunner(baseRunner);
     try {
       for (let i = 0; ; i++) {
         iterations = i + 1;
         if (controller.signal.aborted) {
           return { status: "aborted", iterations };
         }
-        await this.ctx.session.writeInFlightMarker(`iteration ${i} / max ${this.maxIterations}`).catch((err) => {
-          this.logger.debug?.(
+        await a.ctx.session.writeInFlightMarker(`iteration ${i} / max ${a.maxIterations}`).catch((err) => {
+          a.logger.debug?.(
             `in-flight marker write failed: ${err instanceof Error ? err.message : String(err)}`
           );
         });
         if (autonomousContinue) {
-          consumeAutonomousContinue(this.ctx);
+          consumeAutonomousContinue(a.ctx);
         }
-        const limitCheck = await this.checkIterationLimit(
+        const limitCheck = await checkIterationLimit(
           i,
           effectiveLimit,
           hasHardLimit,
@@ -25220,11 +25541,11 @@ var Agent = class {
         if (limitCheck.exit) {
           return { ...limitCheck.exit, finalText };
         }
-        await this.extensions.runBeforeIteration(this.ctx, i);
-        this.events.emit("iteration.started", { ctx: this.ctx, index: i });
-        this.injectPendingBtwNotes();
-        const req = await this.buildAndRunRequestPipeline(opts);
-        await this.ctx.session.append({
+        await a.extensions.runBeforeIteration(a.ctx, i);
+        a.events.emit("iteration.started", { ctx: a.ctx, index: i });
+        injectPendingBtwNotes();
+        const req = await handlers.response.buildAndRunRequestPipeline(opts);
+        await a.ctx.session.append({
           type: "llm_request",
           ts: (/* @__PURE__ */ new Date()).toISOString(),
           model: req.model,
@@ -25235,39 +25556,39 @@ var Agent = class {
         });
         let res;
         try {
-          res = await customRunner(this.ctx, req);
+          res = await customRunner(a.ctx, req);
           const calibratedEstimate = estimateRequestTokensCalibrated(req.messages, req.system, req.tools ?? []).total;
           recordActualUsage(res.usage.input, calibratedEstimate);
           recoveryRetries = 0;
         } catch (err) {
           if (controller.signal.aborted) {
-            this.events.emit("error", { err: toError(err), phase: "provider" });
+            a.events.emit("error", { err: toError(err), phase: "provider" });
             return { status: "aborted", iterations, error: toWrongStackError(err, "AGENT_ABORTED") };
           }
-          const extDecision = await this.extensions.runOnError(this.ctx, err, "provider", i);
+          const extDecision = await a.extensions.runOnError(a.ctx, err, "provider", i);
           if (extDecision) {
             if (extDecision.action === "fail") {
-              this.events.emit("error", { err: toError(err), phase: "provider" });
+              a.events.emit("error", { err: toError(err), phase: "provider" });
               return { status: "failed", iterations, error: toWrongStackError(err), delegateSummaries };
             }
             if (extDecision.action === "continue") {
-              await this.extensions.runAfterIteration(this.ctx, i);
+              await a.extensions.runAfterIteration(a.ctx, i);
               continue;
             }
             if (extDecision.action === "retry") {
               recoveryRetries++;
               if (recoveryRetries > 2) {
-                this.events.emit("error", { err: toError(err), phase: "provider" });
+                a.events.emit("error", { err: toError(err), phase: "provider" });
                 return { status: "failed", iterations, error: toWrongStackError(err), delegateSummaries };
               }
-              if (extDecision.model) this.ctx.model = extDecision.model;
-              this.logger.info("Extension requested retry; retrying turn");
+              if (extDecision.model) a.ctx.model = extDecision.model;
+              a.logger.info("Extension requested retry; retrying turn");
               continue;
             }
           }
-          const recovered = await this.errorHandler.recover(err, this.ctx);
+          const recovered = await a.errorHandler.recover(err, a.ctx);
           if (!recovered || recovered.action === "fail") {
-            this.events.emit("error", { err: toError(err), phase: "provider" });
+            a.events.emit("error", { err: toError(err), phase: "provider" });
             return {
               status: "failed",
               iterations,
@@ -25278,17 +25599,17 @@ var Agent = class {
           if (recovered.action === "retry") {
             recoveryRetries++;
             if (recoveryRetries > 2) {
-              this.events.emit("error", { err: toError(err), phase: "provider" });
+              a.events.emit("error", { err: toError(err), phase: "provider" });
               return { status: "failed", iterations, error: toWrongStackError(err) };
             }
-            if (recovered.model) this.ctx.model = recovered.model;
-            this.logger.info(`Recovered provider error via ${recovered.reason}; retrying turn`);
+            if (recovered.model) a.ctx.model = recovered.model;
+            a.logger.info(`Recovered provider error via ${recovered.reason}; retrying turn`);
             continue;
           }
           recoveryRetries = 0;
           res = recovered.response;
         }
-        const responseResult = await this.processResponse(res, req);
+        const responseResult = await handlers.response.processResponse(res, req);
         if (responseResult.aborted) {
           return { status: "aborted", iterations, finalText: responseResult.finalText, delegateSummaries };
         }
@@ -25298,11 +25619,11 @@ var Agent = class {
         finalText = responseResult.finalText;
         const toolUses = res.content.filter(isToolUseBlock);
         if (toolUses.length === 0) {
-          this.emitContextPct();
-          this.events.emit("iteration.completed", { ctx: this.ctx, index: i });
+          emitContextPct();
+          a.events.emit("iteration.completed", { ctx: a.ctx, index: i });
           if (autonomousContinue && responseResult.directive === "continue") {
-            await this.compactContextIfNeeded();
-            await this.extensions.runAfterIteration(this.ctx, i);
+            await compactContextIfNeeded();
+            await a.extensions.runAfterIteration(a.ctx, i);
             continue;
           }
           if (autonomousContinue && responseResult.directive === "stop") {
@@ -25310,18 +25631,18 @@ var Agent = class {
           }
           return { status: "done", iterations, finalText, delegateSummaries };
         }
-        await this.executeTools(toolUses);
-        if (autonomousContinue && consumeAutonomousContinue(this.ctx)) {
-          this.emitContextPct();
-          this.events.emit("iteration.completed", { ctx: this.ctx, index: i });
-          await this.compactContextIfNeeded();
-          await this.extensions.runAfterIteration(this.ctx, i);
+        await handlers.tools.executeTools(toolUses);
+        if (autonomousContinue && consumeAutonomousContinue(a.ctx)) {
+          emitContextPct();
+          a.events.emit("iteration.completed", { ctx: a.ctx, index: i });
+          await compactContextIfNeeded();
+          await a.extensions.runAfterIteration(a.ctx, i);
           continue;
         }
-        this.emitContextPct();
-        this.events.emit("iteration.completed", { ctx: this.ctx, index: i });
-        await this.compactContextIfNeeded();
-        await this.extensions.runAfterIteration(this.ctx, i);
+        emitContextPct();
+        a.events.emit("iteration.completed", { ctx: a.ctx, index: i });
+        await compactContextIfNeeded();
+        await a.extensions.runAfterIteration(a.ctx, i);
         if (autonomousContinue && responseResult.directive === "continue") {
           continue;
         }
@@ -25330,348 +25651,417 @@ var Agent = class {
         }
       }
     } finally {
-      offSubagentDone();
-      const reason = controller.signal.aborted ? "aborted" : "clean";
-      await this.ctx.session.clearInFlightMarker(reason).catch((err) => {
-        this.logger.debug?.(
-          `in-flight marker clear failed: ${err instanceof Error ? err.message : String(err)}`
-        );
-      });
+      offSubagentDone();
+      const reason = controller.signal.aborted ? "aborted" : "clean";
+      await a.ctx.session.clearInFlightMarker(reason).catch((err) => {
+        a.logger.debug?.(
+          `in-flight marker clear failed: ${err instanceof Error ? err.message : String(err)}`
+        );
+      });
+    }
+  }
+  return { runInner };
+}
+
+// src/core/agent-types.ts
+var DEFAULT_MAX_ITERATIONS = 100;
+function normalizeInput(input) {
+  if (typeof input === "string") {
+    return { blocks: [{ type: "text", text: input }], text: input };
+  }
+  const text = input.filter(isTextBlock).map((b) => b.text).join("");
+  return { blocks: input, text };
+}
+function createDefaultPipelines() {
+  return {
+    request: new Pipeline(),
+    response: new Pipeline(),
+    toolCall: new Pipeline(),
+    userInput: new Pipeline(),
+    assistantOutput: new Pipeline(),
+    contextWindow: new Pipeline()
+  };
+}
+
+// src/core/agent.ts
+var Agent = class {
+  container;
+  tools;
+  providers;
+  events;
+  pipelines;
+  ctx;
+  maxIterations;
+  executionStrategy;
+  perIterationOutputCapBytes;
+  plugins = [];
+  toolExecutor;
+  autoExtendLimit;
+  autonomousContinue;
+  tracer;
+  extensions;
+  _toolHandler;
+  _responseHandler;
+  _loopHandler;
+  constructor(init) {
+    this.container = init.container;
+    this.tools = init.tools;
+    this.providers = init.providers;
+    this.events = init.events;
+    this.pipelines = init.pipelines;
+    this.ctx = init.context;
+    this.maxIterations = init.maxIterations ?? DEFAULT_MAX_ITERATIONS;
+    this.executionStrategy = init.executionStrategy ?? "smart";
+    this.perIterationOutputCapBytes = init.perIterationOutputCapBytes ?? 1e5;
+    this.autoExtendLimit = init.autoExtendLimit ?? true;
+    this.autonomousContinue = init.autonomousContinue ?? false;
+    this.tracer = init.tracer;
+    this.extensions = init.extensions ?? new ExtensionRegistry();
+    this.extensions.setLogger(this.container.resolve(TOKENS.Logger));
+    this.toolExecutor = init.toolExecutor;
+    this._toolHandler = createAgentToolHandler(this);
+    this._responseHandler = createAgentResponseHandler(this);
+    this._loopHandler = createAgentLoopHandler(this, {
+      tools: this._toolHandler,
+      response: this._responseHandler
+    });
+  }
+  get logger() {
+    return this.container.resolve(TOKENS.Logger);
+  }
+  get retry() {
+    return this.container.resolve(TOKENS.RetryPolicy);
+  }
+  get errorHandler() {
+    return this.container.resolve(TOKENS.ErrorHandler);
+  }
+  get permission() {
+    return this.container.resolve(TOKENS.PermissionPolicy);
+  }
+  get renderer() {
+    return this.container.has(TOKENS.Renderer) ? this.container.resolve(TOKENS.Renderer) : void 0;
+  }
+  disableInteractiveConfirmation() {
+    this.toolExecutor.clearConfirmAwaiter();
+    const policy = this.permission;
+    if (typeof policy.setPromptDelegate === "function") {
+      policy.setPromptDelegate(void 0);
+    }
+  }
+  register(tool) {
+    this.tools.register(tool);
+  }
+  async use(plugin, api) {
+    await plugin.setup(api);
+    this.plugins.push({ plugin, api });
+  }
+  async teardown() {
+    const errors = [];
+    for (const { plugin, api } of this.plugins.toReversed()) {
+      if (typeof plugin.teardown !== "function") continue;
+      try {
+        await plugin.teardown(api);
+      } catch (err) {
+        errors.push(err);
+      }
+    }
+    this.plugins.length = 0;
+    if (errors.length > 0) {
+      throw new Error(`Agent teardown failed: ${errors.map(String).join("; ")}`);
+    }
+  }
+  async run(userInput, opts = {}) {
+    const controller = new RunController({ parentSignal: opts.signal });
+    const signal = controller.signal;
+    this.ctx.signal = signal;
+    controller.onAbort(() => this.ctx.drainAbortHooks());
+    const span = this.tracer?.startSpan("agent.run", {
+      "agent.model": opts.model ?? this.ctx.model,
+      "agent.executionStrategy": opts.executionStrategy ?? this.executionStrategy
+    });
+    const { blocks, text } = normalizeInput(userInput);
+    const inputPayload = { content: blocks, text, ctx: this.ctx };
+    await this.extensions.runBeforeRun(this.ctx, inputPayload);
+    try {
+      const autonomousContinue = opts.autonomousContinue ?? this.autonomousContinue;
+      const result = await this._loopHandler.runInner(inputPayload, opts, controller, autonomousContinue);
+      span?.setAttribute("agent.status", result.status);
+      span?.setAttribute("agent.iterations", result.iterations);
+      await this.extensions.runAfterRun(this.ctx, result);
+      return result;
+    } catch (err) {
+      const wse = err instanceof AgentError ? err : toWrongStackError(err);
+      this.events.emit("error", { err: err instanceof Error ? err : new Error(String(err)), phase: "agent" });
+      if (err instanceof Error) span?.recordError(err);
+      span?.setAttribute("agent.status", "failed");
+      const result = {
+        status: signal.aborted ? "aborted" : "failed",
+        iterations: 0,
+        error: wse
+      };
+      await this.extensions.runAfterRun(this.ctx, result);
+      return result;
+    } finally {
+      span?.end();
+      await controller.dispose();
     }
   }
-  /**
-   * Check if iteration limit has been reached and request extension if needed.
-   * Returns the new effective limit (possibly extended) and a RunResult if
-   * the loop should exit. Returns `{ limit }` with no result when the
-   * iteration may proceed.
-   */
-  async checkIterationLimit(iterationIndex, limit, hasHardLimit, currentIterations, delegateSummaries) {
-    if (hasHardLimit && iterationIndex >= limit) {
-      const extendBy = await requestLimitExtension({
-        events: this.events,
-        currentIterations,
-        currentLimit: limit,
-        autoExtend: this.autoExtendLimit
-      });
-      if (extendBy > 0) {
-        const newLimit = limit + extendBy;
-        this.logger.info(`Iteration limit extended by ${extendBy} (new limit: ${newLimit})`);
-        return { limit: newLimit };
+  // ── Tool + response execution handled by AgentToolHandler / AgentResponseHandler ──
+};
+
+// src/hooks/registry.ts
+var HookRegistry = class {
+  entries = [];
+  /** Register an in-process hook. Returns an unsubscribe function. */
+  registerInProcess(event, matcher, hook, owner) {
+    const entry = {
+      kind: "inprocess",
+      event,
+      matcher: matcher ?? "*",
+      hook,
+      owner
+    };
+    this.entries.push(entry);
+    return () => this.remove(entry);
+  }
+  /** Register a single shell hook. Returns an unsubscribe function. */
+  registerShell(event, hook) {
+    const entry = {
+      kind: "shell",
+      event,
+      matcher: hook.matcher ?? "*",
+      command: hook.command,
+      timeoutMs: hook.timeoutMs
+    };
+    this.entries.push(entry);
+    return () => this.remove(entry);
+  }
+  /** Bulk-load shell hooks from a `config.hooks` map. */
+  loadShellHooks(hooks) {
+    if (!hooks) return;
+    for (const [event, list] of Object.entries(hooks)) {
+      for (const h of list ?? []) {
+        if (h?.command) this.registerShell(event, h);
       }
-      return { limit, exit: { status: "max_iterations", iterations: currentIterations, delegateSummaries } };
     }
-    return { limit };
   }
-  /**
-   * Build request and run through request pipeline.
-   */
-  async buildAndRunRequestPipeline(opts) {
-    const repaired = repairToolUseAdjacency(this.ctx.messages);
-    if (repaired.report.changed) {
-      this.ctx.state.replaceMessages(repaired.messages);
-      this.events.emit("context.repaired", {
-        ctx: this.ctx,
-        ...repaired.report
+  /** All entries registered for an event, in registration order. */
+  list(event) {
+    return this.entries.filter((e) => e.event === event);
+  }
+  /** True when any entry is registered for the event. */
+  has(event) {
+    return this.entries.some((e) => e.event === event);
+  }
+  /** Drop every registered hook (used in teardown / tests). */
+  clear() {
+    this.entries.length = 0;
+  }
+  remove(entry) {
+    const i = this.entries.indexOf(entry);
+    if (i >= 0) this.entries.splice(i, 1);
+  }
+};
+function hookMatcherMatches(matcher, toolName) {
+  if (!matcher || matcher === "*") return true;
+  if (toolName === void 0) return true;
+  const target = toolName.toLowerCase();
+  return matcher.split("|").map((s) => s.trim().toLowerCase()).filter(Boolean).includes(target);
+}
+var DEFAULT_TIMEOUT_MS3 = 5e3;
+var MAX_OUTPUT_BYTES = 64 * 1024;
+async function runShellHook(spec, input, logger) {
+  const timeoutMs = spec.timeoutMs ?? DEFAULT_TIMEOUT_MS3;
+  return await new Promise((resolve13) => {
+    let settled = false;
+    const done = (v) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve13(v);
+    };
+    let child;
+    try {
+      child = spawn(spec.command, {
+        cwd: input.cwd,
+        env: process.env,
+        stdio: ["pipe", "pipe", "pipe"],
+        shell: true
       });
-      this.logger.warn(
-        `Repaired context tool adjacency: removed ${repaired.report.removedToolUses.length} tool_use block(s), ${repaired.report.removedToolResults.length} tool_result block(s), ${repaired.report.removedMessages} empty message(s)`
-      );
+    } catch (err2) {
+      logger?.warn?.(`hook spawn failed: ${err2 instanceof Error ? err2.message : String(err2)}`);
+      return resolve13(null);
     }
-    const baseReq = {
-      model: opts.model ?? this.ctx.model,
-      system: this.ctx.systemPrompt,
-      messages: this.ctx.messages,
-      tools: this.tools.list(),
-      maxTokens: 8192
-    };
-    return this.pipelines.request.run(baseReq);
-  }
-  /**
-   * Process the provider response: run response pipeline, emit events,
-   * update session, render text, handle abort.
-   */
-  async processResponse(raw, req) {
-    let res = raw;
-    res = await this.pipelines.response.run(res);
-    this.events.emit("provider.response", {
-      ctx: this.ctx,
-      usage: res.usage,
-      stopReason: res.stopReason
+    const timer = setTimeout(() => {
+      logger?.warn?.(`hook command timed out after ${timeoutMs}ms: ${spec.command}`);
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+      done(null);
+    }, timeoutMs);
+    let out = "";
+    let err = "";
+    let outTrunc = false;
+    child.stdout?.on("data", (d) => {
+      if (outTrunc) return;
+      out += d.toString("utf8");
+      if (Buffer.byteLength(out, "utf8") > MAX_OUTPUT_BYTES) {
+        out = out.slice(0, MAX_OUTPUT_BYTES);
+        outTrunc = true;
+      }
     });
-    this.ctx.tokenCounter.account(res.usage, req.model);
-    this.ctx.state.appendMessage({ role: "assistant", content: res.content });
-    await this.ctx.session.append({
-      type: "llm_response",
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      content: res.content,
-      stopReason: res.stopReason,
-      usage: res.usage
+    child.stderr?.on("data", (d) => {
+      if (err.length < MAX_OUTPUT_BYTES) err += d.toString("utf8");
     });
-    if (this.ctx.signal.aborted) {
-      let finalText2 = "";
-      for (const block of res.content) {
-        if (isTextBlock(block)) finalText2 += block.text;
+    child.on("error", (e) => {
+      logger?.warn?.(`hook command error: ${e instanceof Error ? e.message : String(e)}`);
+      done(null);
+    });
+    child.on("close", (code) => {
+      if (code === 2) {
+        const reason = (err.trim() || out.trim() || "blocked by hook").slice(0, 2e3);
+        return done({ decision: "block", reason });
       }
-      return { finalText: finalText2, aborted: true, done: false };
+      const parsed = parseOutcome(out);
+      done(parsed);
+    });
+    try {
+      child.stdin?.end(`${JSON.stringify(input)}
+`);
+    } catch {
     }
-    let finalText = "";
-    const streamed = this.ctx.provider.capabilities.streaming;
-    for (const block of res.content) {
-      if (isTextBlock(block)) {
-        const rendered = await this.pipelines.assistantOutput.run(block);
-        finalText += rendered.text;
-        if (!streamed) this.renderer?.write(rendered);
-      }
+  });
+}
+function parseOutcome(stdout) {
+  const trimmed = stdout.trim();
+  if (!trimmed || trimmed[0] !== "{") return null;
+  try {
+    const obj = JSON.parse(trimmed);
+    const outcome = {};
+    if (obj["decision"] === "block" || obj["decision"] === "allow") {
+      outcome.decision = obj["decision"];
     }
-    let directive = "none";
-    if (finalText) {
-      directive = parseContinueDirective(finalText);
+    if (typeof obj["reason"] === "string") outcome.reason = obj["reason"];
+    if (typeof obj["additionalContext"] === "string") {
+      outcome.additionalContext = obj["additionalContext"];
     }
-    return { finalText, aborted: false, done: false, directive };
+    if (obj["modifiedInput"] && typeof obj["modifiedInput"] === "object") {
+      outcome.modifiedInput = obj["modifiedInput"];
+    }
+    return outcome;
+  } catch {
+    return null;
   }
-  /**
-   * Execute tools and append tool results to context.
-   * When a tool returns `tool_confirm_pending` (no confirmAwaiter set),
-   * we pause and emit `tool.confirm_needed`. The run is blocked until
-   * the event listener resolves the confirmation, then we re-run the
-   * single tool.
-   */
-  async executeTools(toolUses) {
-    const selectedToolUses = await this.extensions.runBeforeToolExecution(this.ctx, toolUses);
-    const { outputs } = await this.toolExecutor.executeBatch(
-      selectedToolUses,
-      this.ctx,
-      this.executionStrategy
-    );
-    const useById = new Map(selectedToolUses.map((u) => [u.id, u]));
-    const resultsForMessage = [];
-    for (const { result, tool, durationMs } of outputs) {
-      if (result.type === "tool_confirm_pending") {
-        const decision = await this.waitForConfirm({
-          tool,
-          input: result.input,
-          toolUseId: result.toolUseId,
-          suggestedPattern: result.suggestedPattern
-        });
-        if (decision === "always") {
-          try {
-            await this.permission.trust({
-              tool: tool.name,
-              pattern: result.suggestedPattern
-            });
-            this.events.emit("trust.persisted", {
-              tool: tool.name,
-              pattern: result.suggestedPattern,
-              decision
-            });
-          } catch {
-          }
-        } else if (decision === "deny") {
-          try {
-            await this.permission.deny({
-              tool: tool.name,
-              pattern: result.suggestedPattern
-            });
-            this.events.emit("trust.persisted", {
-              tool: tool.name,
-              pattern: result.suggestedPattern,
-              decision
-            });
-          } catch {
-          }
-        }
-        if (decision === "yes") {
-          const p = this.permission;
-          p.allowOnce?.({ tool: tool.name, pattern: result.suggestedPattern });
-        } else if (decision === "no") {
-          const p = this.permission;
-          p.denyOnce?.({ tool: tool.name, pattern: result.suggestedPattern });
-        }
-        const reRunResult = decision === "yes" || decision === "always" ? await this.executeSingleWithDecision(
-          tool,
-          { id: result.toolUseId, name: tool.name, input: result.input }
-        ) : {
-          result: {
-            type: "tool_result",
-            tool_use_id: result.toolUseId,
-            content: decision === "deny" ? `Tool "${tool.name}" denied and blocked for this pattern.` : `Tool "${tool.name}" denied by user.`,
-            is_error: true
-          },
-          durationMs: 0
-        };
-        const use2 = useById.get(reRunResult.result.tool_use_id);
-        if (use2) {
-          await this.pipelines.toolCall.run({
-            toolUse: use2,
-            result: reRunResult.result,
-            ctx: this.ctx,
-            tool
-          });
-          await this.ctx.session.append({
-            type: "tool_result",
-            ts: (/* @__PURE__ */ new Date()).toISOString(),
-            id: reRunResult.result.tool_use_id,
-            content: reRunResult.result.content,
-            isError: !!reRunResult.result.is_error
-          });
-          {
-            const sig = sizeSignals(tool?.name, reRunResult.result.content);
-            this.events.emit("tool.executed", {
-              id: reRunResult.result.tool_use_id,
-              name: tool.name,
-              durationMs: reRunResult.durationMs,
-              ok: !reRunResult.result.is_error,
-              input: result.input,
-              output: truncateForEvent(reRunResult.result.content),
-              outputBytes: sig.outputBytes,
-              outputTokens: sig.outputTokens,
-              outputLines: sig.outputLines
-            });
-          }
-        }
-        resultsForMessage.push(reRunResult.result);
-        continue;
+}
+
+// src/hooks/runner.ts
+var HookRunner = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.registry = opts.registry;
+  }
+  opts;
+  registry;
+  /** Cheap guard so callers can skip building payloads when nothing listens. */
+  has(event) {
+    return this.registry.has(event);
+  }
+  async preToolUse(toolName, toolInput, env) {
+    const entries = this.matching("PreToolUse", toolName);
+    if (entries.length === 0) return {};
+    let current = toolInput;
+    let mutated = false;
+    for (const entry of entries) {
+      const payload = {
+        event: "PreToolUse",
+        toolName,
+        toolInput: current,
+        ...this.base(env)
+      };
+      const outcome = await this.invoke(entry, payload);
+      if (!outcome) continue;
+      if (outcome.modifiedInput && typeof outcome.modifiedInput === "object") {
+        current = outcome.modifiedInput;
+        mutated = true;
       }
-      resultsForMessage.push(result);
-      const use = useById.get(result.tool_use_id);
-      if (!use) continue;
-      await this.pipelines.toolCall.run({
-        toolUse: use,
-        result,
-        ctx: this.ctx,
-        tool: tool ?? void 0
-      });
-      await this.ctx.session.append({
-        type: "tool_result",
-        ts: (/* @__PURE__ */ new Date()).toISOString(),
-        id: result.tool_use_id,
-        content: result.content,
-        isError: !!result.is_error
-      });
-      {
-        const sig = sizeSignals(use.name, result.content);
-        this.events.emit("tool.executed", {
-          id: result.tool_use_id,
-          name: use.name,
-          durationMs,
-          ok: !result.is_error,
-          input: use.input,
-          output: truncateForEvent(result.content),
-          outputBytes: sig.outputBytes,
-          outputTokens: sig.outputTokens,
-          outputLines: sig.outputLines
-        });
+      if (outcome.decision === "block") {
+        return { block: true, reason: outcome.reason ?? `Blocked by ${entry.event} hook` };
       }
     }
-    this.ctx.state.appendMessage({
-      role: "user",
-      content: resultsForMessage
-    });
-    await this.extensions.runAfterToolExecution(this.ctx, outputs);
+    return mutated ? { input: current } : {};
   }
-  /**
-   * Fold any pending `/btw` notes into the conversation. Called at the top of
-   * each iteration so a note set mid-run reaches the model on its next turn.
-   *
-   * To stay valid across all provider wire families we never create two
-   * consecutive user messages: if the last message is a user turn (e.g. the
-   * tool_result block from the previous iteration) we append the note as an
-   * extra text block on that turn; otherwise we add a fresh user message.
-   */
-  injectPendingBtwNotes() {
-    const notes = consumeBtwNotes(this.ctx);
-    if (notes.length === 0) return;
-    const block = { type: "text", text: buildBtwBlock(notes) };
-    const messages = this.ctx.messages;
-    const last = messages[messages.length - 1];
-    if (last && last.role === "user") {
-      const content = typeof last.content === "string" ? [{ type: "text", text: last.content }, block] : [...last.content, block];
-      this.ctx.state.replaceMessages([...messages.slice(0, -1), { ...last, content }]);
-    } else {
-      this.ctx.state.appendMessage({ role: "user", content: [block] });
+  async postToolUse(toolName, toolInput, result, env) {
+    const payload = {
+      event: "PostToolUse",
+      toolName,
+      toolInput,
+      toolResult: result,
+      ...this.base(env)
+    };
+    return { additionalContext: await this.collectContext("PostToolUse", toolName, payload) };
+  }
+  async userPromptSubmit(prompt, env) {
+    const entries = this.matching("UserPromptSubmit", void 0);
+    if (entries.length === 0) return {};
+    const payload = { event: "UserPromptSubmit", prompt, ...this.base(env) };
+    const parts = [];
+    for (const entry of entries) {
+      const outcome = await this.invoke(entry, payload);
+      if (!outcome) continue;
+      if (outcome.decision === "block") {
+        return { block: true, reason: outcome.reason ?? "Blocked by UserPromptSubmit hook" };
+      }
+      if (outcome.additionalContext) parts.push(outcome.additionalContext);
     }
+    return parts.length ? { additionalContext: parts.join("\n") } : {};
   }
-  waitForConfirm(info) {
-    return new Promise((resolve12) => {
-      this.events.emit("tool.confirm_needed", {
-        tool: info.tool,
-        input: info.input,
-        toolUseId: info.toolUseId,
-        suggestedPattern: info.suggestedPattern,
-        resolve: resolve12
-      });
-    });
+  async sessionStart(env) {
+    const payload = { event: "SessionStart", ...this.base(env) };
+    return { additionalContext: await this.collectContext("SessionStart", void 0, payload) };
   }
-  async executeSingleWithDecision(tool, use) {
-    const start = Date.now();
+  async stop(env) {
+    const payload = { event: "Stop", ...this.base(env) };
+    await this.collectContext("Stop", void 0, payload);
+  }
+  // ── internals ──────────────────────────────────────────────────────
+  base(env) {
+    const sessionId = this.opts.sessionId?.();
+    return sessionId ? { cwd: env.cwd, sessionId } : { cwd: env.cwd };
+  }
+  matching(event, toolName) {
+    return this.registry.list(event).filter((e) => hookMatcherMatches(e.matcher, toolName));
+  }
+  async invoke(entry, payload) {
     try {
-      const result = await this.toolExecutor.executeTool(
-        tool,
-        use,
-        this.ctx,
-        this.perIterationOutputCapBytes
+      if (entry.kind === "inprocess") {
+        const r = await entry.hook(payload);
+        return r ?? null;
+      }
+      if (this.opts.allowShell === false) return null;
+      return await runShellHook(
+        { command: entry.command, timeoutMs: entry.timeoutMs },
+        payload,
+        this.opts.logger
       );
-      return { result, durationMs: Date.now() - start };
     } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      return {
-        result: {
-          type: "tool_result",
-          tool_use_id: use.id,
-          content: `Tool "${tool.name}" threw: ${msg}`,
-          is_error: true
-        },
-        durationMs: Date.now() - start
-      };
+      this.opts.logger?.warn?.(
+        `${payload.event} hook threw: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return null;
     }
   }
-  /**
-   * Run context window pipeline. The pipeline may be empty, or it may contain
-   * middleware with its own injected dependencies.
-   */
-  async compactContextIfNeeded() {
-    await this.pipelines.contextWindow.run(this.ctx);
-  }
-  /**
-   * Emit the current context window load as a `ctx.pct` event so subscribers
-   * (FleetBus → TUI) can render a live fill bar per agent.
-   */
-  emitContextPct() {
-    const maxContext = this.ctx.provider.capabilities.maxContext ?? 2e5;
-    const { total } = estimateRequestTokens(
-      this.ctx.messages,
-      this.ctx.systemPrompt,
-      this.ctx.tools ?? []
-    );
-    this.events.emit("ctx.pct", { load: total / maxContext, tokens: total, maxContext });
+  async collectContext(event, toolName, payload) {
+    const entries = this.matching(event, toolName);
+    if (entries.length === 0) return void 0;
+    const parts = [];
+    for (const entry of entries) {
+      const outcome = await this.invoke(entry, payload);
+      if (outcome?.additionalContext) parts.push(outcome.additionalContext);
+    }
+    return parts.length ? parts.join("\n") : void 0;
   }
 };
-function toError(err) {
-  return err instanceof Error ? err : new Error(String(err));
-}
-function truncateForEvent(content, max = 400) {
-  if (!content) return "";
-  return content.length <= max ? content : `${content.slice(0, max - 1)}\u2026`;
-}
-function sizeSignals(toolName, content) {
-  if (typeof content !== "string" || content.length === 0) {
-    return { outputBytes: 0, outputTokens: 0, outputLines: void 0 };
-  }
-  const outputBytes = Buffer.byteLength(content, "utf8");
-  const outputTokens = Math.max(1, Math.round(outputBytes / 3.5));
-  let outputLines;
-  if (toolName === "read") {
-    const lineRe = /^\s*\d+→/gm;
-    let count = 0;
-    while (lineRe.exec(content) !== null) count++;
-    if (count > 0) outputLines = count;
-  } else if (toolName === "bash" || toolName === "shell" || toolName === "grep" || toolName === "logs") {
-    let nl = 0;
-    for (let i = 0; i < content.length; i++) if (content.charCodeAt(i) === 10) nl++;
-    outputLines = nl + (content.endsWith("\n") ? 0 : 1);
-  }
-  return { outputBytes, outputTokens, outputLines };
-}
 async function bootConfig(options = {}) {
   const { flags = {}, appLabel = "wstack", loadSyncConfig = true } = options;
   const cwd = typeof flags["cwd"] === "string" ? path6.resolve(flags["cwd"]) : process.cwd();
@@ -25719,6 +26109,10 @@ function flagsToConfigPatch(flags) {
   const patch = {};
   if (typeof flags["provider"] === "string") patch.provider = flags["provider"];
   if (typeof flags["model"] === "string") patch.model = flags["model"];
+  if (typeof flags["fallback-model"] === "string") {
+    const list = flags["fallback-model"].split(",").map((s) => s.trim()).filter(Boolean);
+    if (list.length > 0) patch.fallbackModels = list;
+  }
   if (typeof flags["cwd"] === "string") patch.cwd = flags["cwd"];
   if (typeof flags["log-level"] === "string") {
     patch.log = { level: flags["log-level"] };
@@ -26050,8 +26444,8 @@ var InputBuilder = class {
   async registerFile(input) {
     const ref = await this.store.add({ ...input, kind: "file" });
     this.refs.push(ref);
-    const path36 = ref.meta.filename ?? ref.meta.label ?? String(ref.seq);
-    return `[file:${path36}]`;
+    const path37 = ref.meta.filename ?? ref.meta.label ?? String(ref.seq);
+    return `[file:${path37}]`;
   }
   /**
    * Whether `appendPaste(text)` would collapse the text to a placeholder
@@ -26451,12 +26845,12 @@ ${mem}`);
     }
   }
   async gitStatus(root) {
-    return new Promise((resolve12) => {
+    return new Promise((resolve13) => {
       let settled = false;
       const finish = (s) => {
         if (settled) return;
         settled = true;
-        resolve12(s);
+        resolve13(s);
       };
       let proc;
       const timer = setTimeout(() => {
@@ -26851,9 +27245,13 @@ var DefaultPluginAPI = class {
   config;
   log;
   configStore;
+  hookRegistry;
+  ownerName;
   pluginCleanupFns = [];
   constructor(init) {
     const owner = init.ownerName;
+    this.ownerName = owner;
+    this.hookRegistry = init.hookRegistry;
     this.container = init.container;
     this.events = init.events;
     this.config = init.config;
@@ -26940,6 +27338,13 @@ var DefaultPluginAPI = class {
   registerSystemPromptContributor(c) {
     return this.extensions.registerSystemPromptContributor(c);
   }
+  registerHook(event, matcher, hook) {
+    if (!this.hookRegistry) return () => {
+    };
+    const off = this.hookRegistry.registerInProcess(event, matcher, hook, this.ownerName);
+    this.pluginCleanupFns.push(off);
+    return off;
+  }
 };
 var noopMcp = {
   start: async () => void 0,
@@ -27662,7 +28067,7 @@ var PhaseOrchestrator = class {
   async mergeOne(phase, handle) {
     if (!this.worktrees) return;
     try {
-      const resolve12 = this.ctx.resolveConflict ? async (info) => {
+      const resolve13 = this.ctx.resolveConflict ? async (info) => {
         const shouldResolve = await this.shouldAttemptConflictResolution(phase, info);
         if (!shouldResolve) return false;
         this.emit("phase.conflictResolving", {
@@ -27672,7 +28077,7 @@ var PhaseOrchestrator = class {
         });
         return this.ctx.resolveConflict(phase, info);
       } : void 0;
-      const result = await this.worktrees.merge(handle, { squash: true, resolve: resolve12 });
+      const result = await this.worktrees.merge(handle, { squash: true, resolve: resolve13 });
       if (result.resolved) {
         this.emit("phase.conflictResolved", { phaseId: phase.id, name: phase.name });
       }
@@ -28022,7 +28427,7 @@ var PhaseOrchestrator = class {
     }
   }
   delay(ms) {
-    return new Promise((resolve12) => setTimeout(resolve12, ms));
+    return new Promise((resolve13) => setTimeout(resolve13, ms));
   }
 };
 
@@ -29059,12 +29464,12 @@ var BrainDecisionQueue = class {
       options: request.options,
       rationale: "Decision escalated to human authority."
     };
-    const pending = new Promise((resolve12) => {
-      const entry = { request, resolve: resolve12 };
+    const pending = new Promise((resolve13) => {
+      const entry = { request, resolve: resolve13 };
       if (this.opts.timeoutMs && this.opts.timeoutMs > 0) {
         entry.timer = setTimeout(() => {
           this.pending.delete(request.id);
-          resolve12({ type: "deny", reason: "Brain human decision timed out." });
+          resolve13({ type: "deny", reason: "Brain human decision timed out." });
         }, this.opts.timeoutMs);
       }
       this.pending.set(request.id, entry);
@@ -29179,8 +29584,8 @@ var CollaborationBus = class {
     if (this.isPaused()) return false;
     this.pausedAtMs = Date.now();
     this.pausedBy = byParticipant;
-    this.pausePromise = new Promise((resolve12) => {
-      this.pauseResolve = resolve12;
+    this.pausePromise = new Promise((resolve13) => {
+      this.pauseResolve = resolve13;
     });
     return true;
   }
@@ -29216,8 +29621,8 @@ var CollaborationBus = class {
       return true;
     }
     let timer;
-    const timeoutPromise = new Promise((resolve12) => {
-      timer = setTimeout(() => resolve12("timeout"), timeoutMs);
+    const timeoutPromise = new Promise((resolve13) => {
+      timer = setTimeout(() => resolve13("timeout"), timeoutMs);
     });
     const resumedPromise = this.pausePromise.then(() => "resumed");
     const winner = await Promise.race([resumedPromise, timeoutPromise]);
@@ -29708,7 +30113,7 @@ function createGitPlugin() {
 }
 async function runGit(args, cwd) {
   try {
-    return await new Promise((resolve12, reject) => {
+    return await new Promise((resolve13, reject) => {
       const child = spawn("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
       let stdout = "";
       let stderr = "";
@@ -29729,7 +30134,7 @@ async function runGit(args, cwd) {
           })
         );
       });
-      child.on("close", (code) => resolve12({ stdout, stderr, code: code ?? 0 }));
+      child.on("close", (code) => resolve13({ stdout, stderr, code: code ?? 0 }));
     });
   } catch (err) {
     if (err instanceof WrongStackError) throw err;
@@ -30405,6 +30810,6 @@ ${formatPlan(updated)}`
   };
 }
 
-export { ACP_AGENTS, AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, ALL_SYNC_CATEGORIES, AUDIT_LOG_AGENT, Agent, AgentError, AnnotationsStore, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutoPhasePlanner, AutoPhaseRunner, AutonomousRunner, BUG_HUNTER_AGENT, BrainDecisionQueue, BudgetExceededError, CONTEXT_WINDOW_MODES, CORE_RECONSTRUCT_EVENTS, CheckpointManager, CloudSync, CollaborationBus, ConfigError, ConfigMigrationError, Container, Context, ConversationState, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_MAX_ITERATIONS, DEFAULT_MODES, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SESSION_LOGGING_CONFIG, DEFAULT_SPEC_TEMPLATE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultBrainArbiter, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultPluginAPI, DefaultPromptStore, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultTaskStore, DefaultTokenCounter, Director, DirectorStateCheckpoint, DoneConditionChecker, ERROR_CODES, EternalAutonomyEngine, EventBus, ExtensionRegistry, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FLEET_ROSTER_WITHACP, FleetBus, FleetCostCapError, FleetManager, FleetSpawnBudgetError, FleetUsageAggregator, FsError, GitignoreUpdater, HumanEscalatingBrainArbiter, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, InputBuilder, IntelligentCompactor, KERNEL_API_VERSION, LAYER_1_IDENTITY, LLMSelector, MATRIX_PHASE_KEYS, MAX_JOURNAL_ENTRIES, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, ObservableBrainArbiter, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, PhaseGraphBuilder, PhaseOrchestrator, PhaseStore, Pipeline, PluginError, ProviderError, ProviderRegistry, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, ReplayLogStore, ReplayProviderRunner, ReportGenerator, RunController, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, STANDARD_AUDIT_EVENTS, ScopedEventBus, SddParallelRun, SddTaskDecomposer, SecurityScanner, SecurityScannerOrchestrator, SelectiveCompactor, SessionAnalyzer, SessionError, SessionRecovery, SkillGenerator, SkillInstaller, SkillManifestStore, SlashCommandRegistry, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TOKENS, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, TechStackDetector, ToolAuditLog, ToolError, ToolExecutor, ToolRegistry, WorktreeManager, WrongStackError, addPlanItem, allServers, analyzeCriticalPath, appendJournal, applyRosterBudget, asBlocks, asText, assertSafePath, atomicWrite, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, bootConfig, braveSearchServer, buildBtwBlock, buildChildEnv, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, buildRecoveryStrategies, classifyFamily, clearPlan, collabInjectMiddleware, collabPauseMiddleware, color, compileGlob, compileUserRegex, completePartialObject, composeDirectorPrompt, composeSubagentPrompt, computeTaskProgress, consumeBtwNotes, context7Server, contextManagerTool, createAutoExecutor, createAutoPhaseFromTaskGraph, createContextManagerTool, createDefaultPipelines, createDelegateTool, createGitPlugin, createMcpControlTool, createMessage, createObservabilityPlugin, createPlanPlugin, createPromptsPlugin, createSecurityPlugin, createSecuritySlashCommand, createSessionEventBridge, createSkillsPlugin, createSyncPlugin, createToolOutputSerializer, decryptConfigSecrets, defaultGitignoreUpdater, defaultOrchestrator, defaultReportGenerator, defaultSecurityScanner, defaultSkillGenerator, defaultTechStackDetector, deriveTodosFromPlanItem, detectNewlineStyle, dispatchAgent, downloadGitHubTarball, emptyGoal, emptyPlan, encryptConfigSecrets, ensureDir, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, everArtServer, expandGlob, extractRunEnv, filesystemServer, findCriticalPath, flagsToConfigPatch, formatContextWindowModeList, formatGoal, formatHumanPrompt, formatPlan, formatPlanTemplates, formatTodosList, getAgentDefinition, getCalibrationState, getContextWindowMode, getPlanTemplate, getTemplate, getTermSize, githubServer, goalFilePath, googleMapsServer, hashRequest, isAgentError, isConfigError, isContextWindowModeId, isFsError, isImageBlock, isInteractive, isPluginError, isSessionError, isStdinTTY, isStdoutTTY, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isValidMatrixKey, isWrongStackError, listContextWindowModes, listPlanTemplates, listTemplates, loadDirectorState, loadGoal, loadPlan, loadPlugins, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeContinueToNextIterationTool, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeRollUpTool, makeSpawnTool, makeTerminateTool, matchAny, matchGlob, matrixKeyKind, mergeCustomModelDefs, mergeModelsPayload, migratePlaintextSecrets, miniMaxVisionServer, normalizeToLf, onResize, parseContinueDirective, parseSkillRef, pendingBtwCount, phaseForRole, projectHash, recordActualUsage, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, repairToolUseAdjacency, resetCalibration, resolveAuditLevel, resolveContextWindowPolicy, resolveModelMatrix, resolveSessionLoggingConfig, resolveWstackPaths, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, runProviderWithRetry, safeParse, safeStringify, sanitizeJsonString, saveGoal, savePlan, saveTodosCheckpoint, scoreAgents, securitySlashCommand, sentinelServer, setBtwNote, setPlanItemStatus, setRawMode, slackServer, stableStringify, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, stripAnsi, summarizeUsage, templateToMarkdown, toStyle, toWrongStackError, topologicalSort, unifiedDiff, unloadPlugins, validateAgainstSchema, wireMetricsToEvents, wrapAsState, writeErr, writeOut, zaiVisionServer };
+export { ACP_AGENTS, AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, ALL_SYNC_CATEGORIES, AUDIT_LOG_AGENT, Agent, AgentError, AnnotationsStore, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutoPhasePlanner, AutoPhaseRunner, AutonomousRunner, BUG_HUNTER_AGENT, BrainDecisionQueue, BudgetExceededError, CONTEXT_WINDOW_MODES, CORE_RECONSTRUCT_EVENTS, CheckpointManager, CloudSync, CollaborationBus, ConfigError, ConfigMigrationError, Container, Context, ConversationState, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_MAX_ITERATIONS, DEFAULT_MODES, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SESSION_LOGGING_CONFIG, DEFAULT_SPEC_TEMPLATE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultBrainArbiter, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultPluginAPI, DefaultPromptStore, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultTaskStore, DefaultTokenCounter, Director, DirectorStateCheckpoint, DoneConditionChecker, ERROR_CODES, EternalAutonomyEngine, EventBus, ExtensionRegistry, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FLEET_ROSTER_WITHACP, FleetBus, FleetCostCapError, FleetManager, FleetSpawnBudgetError, FleetUsageAggregator, FsError, GitignoreUpdater, HookRegistry, HookRunner, HumanEscalatingBrainArbiter, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, InputBuilder, IntelligentCompactor, KERNEL_API_VERSION, LAYER_1_IDENTITY, LLMSelector, MATRIX_PHASE_KEYS, MAX_JOURNAL_ENTRIES, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, ObservableBrainArbiter, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, PhaseGraphBuilder, PhaseOrchestrator, PhaseStore, Pipeline, PluginError, ProviderError, ProviderRegistry, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, ReplayLogStore, ReplayProviderRunner, ReportGenerator, RunController, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, STANDARD_AUDIT_EVENTS, ScopedEventBus, SddParallelRun, SddTaskDecomposer, SecurityScanner, SecurityScannerOrchestrator, SelectiveCompactor, SessionAnalyzer, SessionError, SessionRecovery, SkillGenerator, SkillInstaller, SkillManifestStore, SlashCommandRegistry, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TOKENS, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, TechStackDetector, ToolAuditLog, ToolError, ToolExecutor, ToolRegistry, WorktreeManager, WrongStackError, addPlanItem, allServers, analyzeCriticalPath, appendJournal, applyRosterBudget, asBlocks, asText, assertSafePath, atomicWrite, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, bootConfig, braveSearchServer, buildBtwBlock, buildChildEnv, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, buildRecoveryStrategies, classifyFamily, clearPlan, collabInjectMiddleware, collabPauseMiddleware, color, compileGlob, compileUserRegex, completePartialObject, composeDirectorPrompt, composeSubagentPrompt, computeTaskProgress, consumeBtwNotes, context7Server, contextManagerTool, createAutoExecutor, createAutoPhaseFromTaskGraph, createContextManagerTool, createDefaultPipelines, createDelegateTool, createGitPlugin, createMcpControlTool, createMessage, createObservabilityPlugin, createPlanPlugin, createPromptsPlugin, createSecurityPlugin, createSecuritySlashCommand, createSessionEventBridge, createSkillsPlugin, createSyncPlugin, createToolOutputSerializer, decryptConfigSecrets, defaultGitignoreUpdater, defaultOrchestrator, defaultReportGenerator, defaultSecurityScanner, defaultSkillGenerator, defaultTechStackDetector, deriveTodosFromPlanItem, detectNewlineStyle, dispatchAgent, downloadGitHubTarball, emptyGoal, emptyPlan, encryptConfigSecrets, ensureDir, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, everArtServer, expandGlob, extractRunEnv, filesystemServer, findCriticalPath, flagsToConfigPatch, formatContextWindowModeList, formatGoal, formatHumanPrompt, formatPlan, formatPlanTemplates, formatTodosList, getAgentDefinition, getCalibrationState, getContextWindowMode, getPlanTemplate, getTemplate, getTermSize, githubServer, goalFilePath, googleMapsServer, hashRequest, hookMatcherMatches, isAgentError, isConfigError, isContextWindowModeId, isFsError, isImageBlock, isInteractive, isPluginError, isSessionError, isStdinTTY, isStdoutTTY, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isValidMatrixKey, isWrongStackError, listContextWindowModes, listPlanTemplates, listTemplates, loadDirectorState, loadGoal, loadPlan, loadPlugins, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeContinueToNextIterationTool, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeRollUpTool, makeSpawnTool, makeTerminateTool, matchAny, matchGlob, matrixKeyKind, mergeCustomModelDefs, mergeModelsPayload, migratePlaintextSecrets, miniMaxVisionServer, normalizeToLf, onResize, parseContinueDirective, parseSkillRef, pendingBtwCount, phaseForRole, projectHash, recordActualUsage, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, repairToolUseAdjacency, resetCalibration, resolveAuditLevel, resolveContextWindowPolicy, resolveModelMatrix, resolveSessionLoggingConfig, resolveWstackPaths, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, runProviderWithRetry, runShellHook, safeParse, safeStringify, sanitizeJsonString, saveGoal, savePlan, saveTodosCheckpoint, scoreAgents, securitySlashCommand, sentinelServer, setBtwNote, setPlanItemStatus, setRawMode, slackServer, stableStringify, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, stripAnsi, summarizeUsage, templateToMarkdown, toStyle, toWrongStackError, topologicalSort, unifiedDiff, unloadPlugins, validateAgainstSchema, wireMetricsToEvents, wrapAsState, writeErr, writeOut, zaiVisionServer };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map