@wrongstack/core 0.9.20 → 0.10.2

package/dist/index.js

@@ -142,8 +142,10 @@ var ERROR_CODES = {
   // Container / Registry
   CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
   CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
+  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
   REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
   REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
+  REGISTRY_INVALID: "REGISTRY_INVALID",
   // File system
   FS_READ_FAILED: "FS_READ_FAILED",
   FS_WRITE_FAILED: "FS_WRITE_FAILED",
@@ -306,6 +308,16 @@ function isFsError(err) {
 // src/kernel/container.ts
 var Container = class {
   entries = /* @__PURE__ */ new Map();
+  /**
+   * Tokens currently mid-resolve. Tracked so we can detect circular
+   * dependencies (A → B → A) and throw a structured error instead of
+   * overflowing the call stack with "Maximum call stack size exceeded".
+   *
+   * Not a memoization cache — the per-entry `cache` field is the source
+   * of truth for "have I built this before?". This set only lives for
+   * the duration of a single resolve call.
+   */
+  resolving = /* @__PURE__ */ new Set();
   bind(token, factory, opts = {}) {
     if (this.entries.has(token)) {
       throw new WrongStackError({
@@ -366,14 +378,43 @@ var Container = class {
     if (entry.singleton && entry.cache !== void 0) {
       return entry.cache;
     }
-    let value = entry.factory(this);
-    for (const d of entry.decorators) {
-      value = d(value, this);
+    if (this.resolving.has(token)) {
+      const cycle = this.describeCycle(token);
+      throw new WrongStackError({
+        message: `Container: circular dependency detected \u2014 ${cycle}`,
+        code: ERROR_CODES.CONTAINER_CIRCULAR_DEPENDENCY,
+        subsystem: "container",
+        context: { token: token.description, cycle }
+      });
+    }
+    this.resolving.add(token);
+    try {
+      let value = entry.factory(this);
+      for (const d of entry.decorators) {
+        value = d(value, this);
+      }
+      if (entry.singleton) {
+        entry.cache = value;
+      }
+      return value;
+    } finally {
+      this.resolving.delete(token);
     }
-    if (entry.singleton) {
-      entry.cache = value;
+  }
+  /**
+   * Build a human-readable description of the dependency cycle that
+   * caused the resolution to re-enter. Lists the tokens in the order
+   * they were entered, then appends the re-entered token to close the
+   * loop. Falls back to a generic message if the resolving set is
+   * somehow empty (shouldn't happen, but defensive).
+   */
+  describeCycle(reentry) {
+    const descs = [];
+    for (const t2 of this.resolving) {
+      descs.push(t2.description ?? "unknown");
     }
-    return value;
+    descs.push(reentry.description ?? "unknown");
+    return descs.join(" \u2192 ");
   }
   has(token) {
     return this.entries.has(token);
@@ -644,7 +685,8 @@ var EventBus = class {
     }
     if (this.wildcards.length > 0) {
       const name = event;
-      for (const { match, fn } of this.wildcards) {
+      const snapshot = this.wildcards.slice();
+      for (const { match, fn } of snapshot) {
         if (!match(name)) continue;
         try {
           fn(name, payload);
@@ -715,11 +757,19 @@ var ScopedEventBus = class extends EventBus {
    * Uses EventBus's public API directly to avoid triggering our own `on()`
    * override (which would consume a key slot for the wrapper, then orphan
    * our registration entry under a different key).
+   *
+   * When the wrapper fires, it cleans up BOTH the underlying EventBus
+   * listener AND the tracking entry — so `scopedListenerCount` returns to
+   * its pre-`once()` value without requiring the caller to invoke the
+   * returned unsubscribe. The returned `unsub` is still safe to call
+   * after auto-removal (its delete is a no-op and its off() finds
+   * nothing to remove).
    */
   once(event, fn) {
     const key = this.nextKey++;
     const wrapper = (payload) => {
       EventBus.prototype.off.call(this, event, wrapper);
+      this.registrations.delete(key);
       fn(payload);
     };
     EventBus.prototype.on.call(this, event, wrapper);
@@ -1024,6 +1074,14 @@ var DEFAULT_CONTEXT_CONFIG = Object.freeze({
 var DEFAULT_AUTONOMY_CONFIG = Object.freeze({
   autoProceedDelayMs: 45e3
 });
+var DEFAULT_SESSION_LOGGING_CONFIG = Object.freeze({
+  auditLevel: "standard",
+  sampling: {
+    toolProgress: {
+      sampleRate: 8
+    }
+  }
+});
 
 // src/types/secret-vault.ts
 var ENCRYPTED_PREFIX = "enc:v1:";
@@ -2140,6 +2198,71 @@ var DefaultSecretScrubber = class {
 
 // src/models/models-registry.ts
 init_atomic_write();
+
+// src/utils/merge-models-payload.ts
+function mergeModelsPayload(base, overlay) {
+  const out = {};
+  for (const [id, provider] of Object.entries(base)) {
+    out[id] = cloneProvider(provider);
+  }
+  for (const [id, ovProvider] of Object.entries(overlay)) {
+    const existing = out[id];
+    out[id] = existing ? mergeProvider(existing, ovProvider) : cloneProvider(ovProvider);
+  }
+  return out;
+}
+function mergeProvider(base, overlay) {
+  const models = {};
+  for (const [mid, m] of Object.entries(base.models ?? {})) {
+    models[mid] = { ...m };
+  }
+  for (const [mid, ovModel] of Object.entries(overlay.models ?? {})) {
+    const existing = models[mid];
+    models[mid] = existing ? mergeModel(existing, ovModel) : { ...ovModel };
+  }
+  return {
+    ...base,
+    // Overlay scalar fields win when explicitly provided; otherwise keep base.
+    ...stripUndefined({
+      id: overlay.id,
+      name: overlay.name,
+      npm: overlay.npm,
+      api: overlay.api,
+      env: overlay.env,
+      doc: overlay.doc
+    }),
+    models
+  };
+}
+function mergeModel(base, overlay) {
+  const merged = { ...base, ...overlay };
+  if (base.limit || overlay.limit) {
+    merged.limit = { ...base.limit, ...overlay.limit };
+  }
+  if (base.cost || overlay.cost) {
+    merged.cost = { ...base.cost, ...overlay.cost };
+  }
+  if (base.modalities || overlay.modalities) {
+    merged.modalities = { ...base.modalities, ...overlay.modalities };
+  }
+  return merged;
+}
+function cloneProvider(p) {
+  const models = {};
+  for (const [mid, m] of Object.entries(p.models ?? {})) {
+    models[mid] = { ...m };
+  }
+  return { ...p, models };
+}
+function stripUndefined(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+
+// src/models/models-registry.ts
 var DEFAULT_URL = "https://models.dev/api.json";
 var DEFAULT_TTL_SECONDS = 24 * 3600;
 var FAMILY_BY_NPM = {
@@ -2167,7 +2290,10 @@ function classifyFamily(npm) {
   return FAMILY_BY_NPM[npm] ?? "unsupported";
 }
 var DefaultModelsRegistry = class {
+  /** Merged (base + overlay) payload — what every reader sees. */
   payload;
+  /** Memoised overlay payload (in-memory / fetched / file). */
+  overlayPayload;
   fetchedAt;
   cacheFile;
   url;
@@ -2175,6 +2301,10 @@ var DefaultModelsRegistry = class {
   fetchImpl;
   seed;
   maxStaleAgeMs;
+  overlay;
+  overlayUrl;
+  overlayFile;
+  overlayCacheFile;
   constructor(opts) {
     this.cacheFile = opts.cacheFile;
     this.url = opts.url ?? DEFAULT_URL;
@@ -2183,6 +2313,10 @@ var DefaultModelsRegistry = class {
     this.seed = opts.seed;
     const maxStaleSeconds = opts.maxStaleAgeSeconds ?? 7 * 24 * 3600;
     this.maxStaleAgeMs = maxStaleSeconds * 1e3;
+    this.overlay = opts.overlay;
+    this.overlayUrl = opts.overlayUrl;
+    this.overlayFile = opts.overlayFile;
+    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path6.join(path6.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
   }
   async load(opts = {}) {
     if (this.payload && !opts.force) return this.payload;
@@ -2191,27 +2325,45 @@ var DefaultModelsRegistry = class {
       this.fetchedAt = /* @__PURE__ */ new Date();
       return this.payload;
     }
+    const overlay = await this.loadOverlay(opts);
+    const base = await this.loadBase(opts, Object.keys(overlay).length > 0);
+    this.payload = mergeModelsPayload(base, overlay);
+    return this.payload;
+  }
+  /**
+   * Load the models.dev base payload: fresh cache → network → stale cache.
+   * On total failure, degrade to `{}` (so a non-empty overlay still drives
+   * the catalog) rather than throwing — unless there's no curated overlay to
+   * fall back on, in which case the original error propagates so pure-
+   * models.dev setups still surface the problem.
+   */
+  async loadBase(opts = {}, overlayAvailable = false) {
     if (!opts.force) {
-      const cached = await this.readCache();
+      const cached = await this.readCacheAt(this.cacheFile);
       if (cached && this.isFresh(cached.fetchedAt)) {
-        this.payload = cached.payload;
         this.fetchedAt = new Date(cached.fetchedAt);
         return cached.payload;
       }
     }
     try {
-      return await this.refresh();
+      return await this.refreshBase();
     } catch (err) {
-      const cached = await this.readCache();
+      const cached = await this.readCacheAt(this.cacheFile);
       if (cached && this.isWithinMaxStaleAge(cached.fetchedAt)) {
-        this.payload = cached.payload;
         this.fetchedAt = new Date(cached.fetchedAt);
         return cached.payload;
       }
+      if (overlayAvailable) {
+        console.warn(
+          `ModelsRegistry: models.dev unavailable (${err instanceof Error ? err.message : String(err)}); serving curated overlay only.`
+        );
+        return {};
+      }
       throw err;
     }
   }
-  async refresh() {
+  /** Fetch + cache the models.dev base. Throws on failure (used by `refresh`). */
+  async refreshBase() {
     const res = await this.fetchImpl(this.url, {
       method: "GET",
       headers: { accept: "application/json" }
@@ -2220,7 +2372,6 @@ var DefaultModelsRegistry = class {
       throw new Error(`ModelsRegistry: HTTP ${res.status} fetching ${this.url}`);
     }
     const json = await res.json();
-    this.payload = json;
     this.fetchedAt = /* @__PURE__ */ new Date();
     const envelope = {
       fetchedAt: this.fetchedAt.toISOString(),
@@ -2230,6 +2381,68 @@ var DefaultModelsRegistry = class {
     await atomicWrite(this.cacheFile, JSON.stringify(envelope));
     return json;
   }
+  /**
+   * Resolve the curated overlay, memoised. Order: in-memory `overlay` →
+   * fetched `overlayUrl` (cached, same TTL/stale rules) → `overlayFile` on
+   * disk. Never throws — a missing/broken overlay yields `{}`.
+   */
+  async loadOverlay(opts = {}) {
+    if (this.overlayPayload && !opts.force) return this.overlayPayload;
+    if (this.overlay) {
+      this.overlayPayload = this.overlay;
+      return this.overlayPayload;
+    }
+    const fetched = await this.loadOverlayFromUrl(opts);
+    if (fetched) {
+      this.overlayPayload = fetched;
+      return fetched;
+    }
+    const fromFile = await this.readOverlayFile();
+    this.overlayPayload = fromFile ?? {};
+    return this.overlayPayload;
+  }
+  async loadOverlayFromUrl(opts) {
+    if (!this.overlayUrl || !this.overlayCacheFile) return void 0;
+    if (!opts.force) {
+      const cached = await this.readCacheAt(this.overlayCacheFile);
+      if (cached && this.isFresh(cached.fetchedAt)) return cached.payload;
+    }
+    try {
+      const res = await this.fetchImpl(this.overlayUrl, {
+        method: "GET",
+        headers: { accept: "application/json" }
+      });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      const json = await res.json();
+      const envelope = {
+        fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        url: this.overlayUrl,
+        payload: json
+      };
+      await atomicWrite(this.overlayCacheFile, JSON.stringify(envelope)).catch(() => {
+      });
+      return json;
+    } catch {
+      const cached = await this.readCacheAt(this.overlayCacheFile);
+      if (cached && this.isWithinMaxStaleAge(cached.fetchedAt)) return cached.payload;
+      return void 0;
+    }
+  }
+  async readOverlayFile() {
+    if (!this.overlayFile) return void 0;
+    try {
+      const raw = await fsp2.readFile(this.overlayFile, "utf8");
+      return JSON.parse(raw);
+    } catch {
+      return void 0;
+    }
+  }
+  async refresh() {
+    const base = await this.refreshBase();
+    const overlay = await this.loadOverlay({ force: true });
+    this.payload = mergeModelsPayload(base, overlay);
+    return this.payload;
+  }
   async listProviders() {
     const payload = await this.load();
     return Object.values(payload).map((p) => this.resolveProvider(p));
@@ -2270,7 +2483,7 @@ var DefaultModelsRegistry = class {
   }
   async ageSeconds() {
     if (!this.fetchedAt) {
-      const cached = await this.readCache();
+      const cached = await this.readCacheAt(this.cacheFile);
       if (!cached) return Number.POSITIVE_INFINITY;
       return (Date.now() - new Date(cached.fetchedAt).getTime()) / 1e3;
     }
@@ -2294,9 +2507,9 @@ var DefaultModelsRegistry = class {
   isWithinMaxStaleAge(fetchedAtIso) {
     return Date.now() - new Date(fetchedAtIso).getTime() < this.maxStaleAgeMs;
   }
-  async readCache() {
+  async readCacheAt(file) {
     try {
-      const raw = await fsp2.readFile(this.cacheFile, "utf8");
+      const raw = await fsp2.readFile(file, "utf8");
       return JSON.parse(raw);
     } catch {
       return void 0;
@@ -2868,6 +3081,141 @@ function topologicalSort(graph) {
   return result;
 }
 
+// src/security/capabilities.ts
+var ToolCapabilities = {
+  /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
+  SHELL_ARBITRARY: "shell.arbitrary",
+  /** Can write / modify / delete files inside the project. */
+  FS_WRITE: "fs.write",
+  /** Can write files outside the current project root (very high risk). */
+  FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project",
+  /** Proxies tools from external MCP servers (unknown capability). */
+  MCP_PROXY: "mcp.proxy",
+  /** Can spawn or manage subagents / multi-agent tasks. */
+  SUBAGENT_SPAWN: "subagent.spawn",
+  /** Can mutate global or session configuration / trust state. */
+  CONFIG_MUTATE: "config.mutate",
+  /** Can install packages or run package managers with side effects. */
+  PACKAGE_INSTALL: "package.install"
+};
+var DANGEROUS_FOR_SUBAGENTS = [
+  ToolCapabilities.SHELL_ARBITRARY,
+  ToolCapabilities.FS_WRITE,
+  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
+  ToolCapabilities.MCP_PROXY,
+  ToolCapabilities.SUBAGENT_SPAWN,
+  ToolCapabilities.CONFIG_MUTATE,
+  ToolCapabilities.PACKAGE_INSTALL
+];
+function hasDangerousCapabilityForSubagents(toolOrCaps) {
+  if (!toolOrCaps) return false;
+  const input = toolOrCaps;
+  const caps = Array.isArray(input) ? input : input?.capabilities ?? [];
+  return caps.some((c) => DANGEROUS_FOR_SUBAGENTS.includes(c));
+}
+function getDangerousCapabilities(toolOrCaps) {
+  if (!toolOrCaps) return [];
+  const input = toolOrCaps;
+  const caps = Array.isArray(input) ? input : input?.capabilities ?? [];
+  return caps.filter(
+    (c) => DANGEROUS_FOR_SUBAGENTS.includes(c)
+  );
+}
+
+// src/utils/json-schema-validate.ts
+function validateAgainstSchema(value, schema) {
+  const errors = [];
+  walk2(value, schema, "", errors);
+  return { ok: errors.length === 0, errors };
+}
+function walk2(value, schema, path35, errors) {
+  if (schema.enum !== void 0) {
+    if (!schema.enum.some((e) => deepEqual(e, value))) {
+      errors.push({
+        path: path35 || "<root>",
+        message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
+      });
+      return;
+    }
+  }
+  if (typeof schema.type === "string") {
+    if (!checkType(value, schema.type)) {
+      errors.push({
+        path: path35 || "<root>",
+        message: `expected ${schema.type}, got ${describeType(value)}`
+      });
+      return;
+    }
+  }
+  if (schema.type === "object" && isPlainObject(value)) {
+    const obj = value;
+    for (const req of schema.required ?? []) {
+      if (!(req in obj)) {
+        errors.push({ path: joinPath(path35, req), message: "required property missing" });
+      }
+    }
+    if (schema.properties) {
+      for (const [key, subSchema] of Object.entries(schema.properties)) {
+        if (key in obj) {
+          walk2(obj[key], subSchema, joinPath(path35, key), errors);
+        }
+      }
+    }
+  }
+  if (schema.type === "array" && Array.isArray(value) && schema.items) {
+    value.forEach((item, i) => walk2(item, schema.items, `${path35}[${i}]`, errors));
+  }
+}
+function checkType(value, type) {
+  switch (type) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number" && !Number.isNaN(value);
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "boolean":
+      return typeof value === "boolean";
+    case "null":
+      return value === null;
+    case "array":
+      return Array.isArray(value);
+    case "object":
+      return isPlainObject(value);
+    default:
+      return true;
+  }
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function describeType(v) {
+  if (v === null) return "null";
+  if (Array.isArray(v)) return "array";
+  return typeof v;
+}
+function joinPath(parent, key) {
+  if (!parent) return key;
+  return `${parent}.${key}`;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b) return false;
+  if (a === null || b === null) return a === b;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
+  }
+  if (typeof a === "object" && typeof b === "object") {
+    const ak = Object.keys(a);
+    const bk = Object.keys(b);
+    if (ak.length !== bk.length) return false;
+    return ak.every(
+      (k) => deepEqual(a[k], b[k])
+    );
+  }
+  return false;
+}
+
 // src/utils/tool-output-serializer.ts
 function createToolOutputSerializer(opts = {}) {
   const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
@@ -2949,18 +3297,45 @@ var ToolExecutor = class {
         budget = this.decrementBudget(result, budget);
         return { result, tool, durationMs: Date.now() - start };
       }
+      const validation = validateAgainstSchema(use.input, tool.inputSchema);
+      if (!validation.ok) {
+        const errorDetails = validation.errors.map((e) => `  - ${e.path || "input"}: ${e.message}`).join("\n");
+        const result = {
+          type: "tool_result",
+          tool_use_id: use.id,
+          content: `Invalid arguments for tool "${tool.name}".
+
+Validation errors:
+${errorDetails}
+
+Please call the tool again with arguments that match its inputSchema. You can use the "tool-help" tool with name="${tool.name}" to see the exact expected schema.`,
+          is_error: true
+        };
+        budget = this.decrementBudget(result, budget);
+        return { result, tool, durationMs: Date.now() - start };
+      }
+      const toolDangerousCaps = getDangerousCapabilities(tool);
+      if (toolDangerousCaps.length > 0) {
+        if (this.opts.events) ;
+      }
       if (hasMalformedArguments(use.input)) {
         const result = this.malformedInputResult(use, extractMalformedRaw(use.input));
         budget = this.decrementBudget(result, budget);
         return { result, tool, durationMs: Date.now() - start };
       }
       const decision = await this.opts.permissionPolicy.evaluate(tool, use.input, ctx);
-      if (decision.permission === "deny") {
+      let effectivePermission = decision.permission;
+      const policy = this.opts.permissionPolicy;
+      const yolo = policy.getYolo?.() === true || policy.getForceAllYolo?.() === true;
+      if (toolDangerousCaps.length > 0 && effectivePermission === "auto" && !yolo) {
+        effectivePermission = "confirm";
+      }
+      if (effectivePermission === "deny") {
         const result = this.deniedResult(use, decision.reason);
         budget = this.decrementBudget(result, budget);
         return { result, tool, durationMs: Date.now() - start };
       }
-      if (decision.permission === "confirm") {
+      if (effectivePermission === "confirm") {
         if (this.opts.confirmAwaiter) {
           const choice = await this.opts.confirmAwaiter(tool, use.input, use.id, tool.name);
           if (choice !== "yes" && choice !== "always") {
@@ -2985,10 +3360,13 @@ var ToolExecutor = class {
           return { result: pending, tool, durationMs: Date.now() - start };
         }
       }
+      const toolCapsForAudit = hasDangerousCapabilityForSubagents(tool) ? tool.capabilities ?? [] : [];
       const span = this.opts.tracer?.startSpan(`tool.${tool.name}`, {
         "tool.name": tool.name,
         "tool.mutating": tool.mutating,
-        "tool.permission": tool.permission
+        "tool.permission": tool.permission,
+        "tool.capabilities": JSON.stringify(tool.capabilities ?? []),
+        "tool.has_dangerous_capabilities": toolCapsForAudit.length > 0
       });
       try {
         const result = await this.executeTool(tool, use, ctx, budget);
@@ -3931,9 +4309,11 @@ function resolveWstackPaths(opts) {
     globalPrompts: path6.join(globalRoot, "prompts"),
     cacheDir: path6.join(globalRoot, "cache"),
     modelsCache: path6.join(globalRoot, "cache", "models.dev.json"),
+    modelsOverlayCache: path6.join(globalRoot, "cache", "models-overlay.json"),
     historyFile: path6.join(globalRoot, "history"),
     logFile: path6.join(globalRoot, "logs", "wrongstack.log"),
     projectDir,
+    projectCodebaseIndex: path6.join(projectDir, "codebase-index"),
     projectMemory: path6.join(projectDir, "memory.md"),
     projectSessions: path6.join(projectDir, "sessions"),
     projectTrust: path6.join(projectDir, "trust.json"),
@@ -4042,100 +4422,6 @@ function buildChildEnv(optsOrSessionId) {
   return out;
 }
 
-// src/utils/json-schema-validate.ts
-function validateAgainstSchema(value, schema) {
-  const errors = [];
-  walk2(value, schema, "", errors);
-  return { ok: errors.length === 0, errors };
-}
-function walk2(value, schema, path35, errors) {
-  if (schema.enum !== void 0) {
-    if (!schema.enum.some((e) => deepEqual(e, value))) {
-      errors.push({
-        path: path35 || "<root>",
-        message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
-      });
-      return;
-    }
-  }
-  if (typeof schema.type === "string") {
-    if (!checkType(value, schema.type)) {
-      errors.push({
-        path: path35 || "<root>",
-        message: `expected ${schema.type}, got ${describeType(value)}`
-      });
-      return;
-    }
-  }
-  if (schema.type === "object" && isPlainObject(value)) {
-    const obj = value;
-    for (const req of schema.required ?? []) {
-      if (!(req in obj)) {
-        errors.push({ path: joinPath(path35, req), message: "required property missing" });
-      }
-    }
-    if (schema.properties) {
-      for (const [key, subSchema] of Object.entries(schema.properties)) {
-        if (key in obj) {
-          walk2(obj[key], subSchema, joinPath(path35, key), errors);
-        }
-      }
-    }
-  }
-  if (schema.type === "array" && Array.isArray(value) && schema.items) {
-    value.forEach((item, i) => walk2(item, schema.items, `${path35}[${i}]`, errors));
-  }
-}
-function checkType(value, type) {
-  switch (type) {
-    case "string":
-      return typeof value === "string";
-    case "number":
-      return typeof value === "number" && !Number.isNaN(value);
-    case "integer":
-      return typeof value === "number" && Number.isInteger(value);
-    case "boolean":
-      return typeof value === "boolean";
-    case "null":
-      return value === null;
-    case "array":
-      return Array.isArray(value);
-    case "object":
-      return isPlainObject(value);
-    default:
-      return true;
-  }
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function describeType(v) {
-  if (v === null) return "null";
-  if (Array.isArray(v)) return "array";
-  return typeof v;
-}
-function joinPath(parent, key) {
-  if (!parent) return key;
-  return `${parent}.${key}`;
-}
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (typeof a !== typeof b) return false;
-  if (a === null || b === null) return a === b;
-  if (Array.isArray(a) && Array.isArray(b)) {
-    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
-  }
-  if (typeof a === "object" && typeof b === "object") {
-    const ak = Object.keys(a);
-    const bk = Object.keys(b);
-    if (ak.length !== bk.length) return false;
-    return ak.every(
-      (k) => deepEqual(a[k], b[k])
-    );
-  }
-  return false;
-}
-
 // src/utils/json-repair.ts
 function completePartialObject(s) {
   if (!s.trim().startsWith("{")) return s;
@@ -4830,7 +5116,7 @@ function isPersistedQueueItem(v) {
 // src/storage/attachment-store.ts
 init_atomic_write();
 var DEFAULT_SPOOL_THRESHOLD = 256 * 1024;
-var PLACEHOLDER_RE = /\[(pasted|image|file) #(\d+)\]/g;
+var PLACEHOLDER_RE = /\[(pasted|image|file) #(\d+)[^\]]*\]|\[file:([^\]]+)\]/g;
 var DefaultAttachmentStore = class {
   items = /* @__PURE__ */ new Map();
   refs = [];
@@ -4884,9 +5170,15 @@ var DefaultAttachmentStore = class {
       const idx = m.index ?? 0;
       const before = text.slice(lastIndex, idx);
       if (before) blocks.push({ type: "text", text: before });
-      const kind = prefixToKind(m[1]);
-      const seq = Number(m[2]);
-      const ref = this.refs.find((r) => r.kind === kind && r.seq === seq);
+      let ref;
+      if (m[3] !== void 0) {
+        const wantPath = m[3];
+        ref = findLast(this.refs, (r) => r.kind === "file" && refPath(r) === wantPath);
+      } else {
+        const kind = prefixToKind(m[1]);
+        const seq = Number(m[2]);
+        ref = this.refs.find((r) => r.kind === kind && r.seq === seq);
+      }
       const att = ref ? this.items.get(ref.id) : void 0;
       if (!att) {
         blocks.push({ type: "text", text: m[0] });
@@ -4939,6 +5231,15 @@ function prefixToKind(prefix) {
   if (prefix === "image") return "image";
   return "file";
 }
+function refPath(ref) {
+  return ref.meta.filename ?? ref.meta.label;
+}
+function findLast(arr, pred) {
+  for (let i = arr.length - 1; i >= 0; i--) {
+    if (pred(arr[i])) return arr[i];
+  }
+  return void 0;
+}
 function mergeAdjacentText(blocks) {
   const out = [];
   for (const b of blocks) {
@@ -5266,7 +5567,8 @@ var BEHAVIOR_DEFAULTS = {
     memory: true,
     modelsRegistry: true,
     skills: true
-  }
+  },
+  session: { ...DEFAULT_SESSION_LOGGING_CONFIG }
 };
 var ENV_MAP = {
   WRONGSTACK_PROVIDER: (c, v) => {
@@ -5774,6 +6076,101 @@ var SessionAnalyzer = class {
   }
 };
 
+// src/storage/session-event-bridge.ts
+var CORE_RECONSTRUCT_EVENTS = /* @__PURE__ */ new Set([
+  "session_start",
+  "session_resumed",
+  "user_input",
+  "llm_response",
+  "tool_result",
+  "checkpoint",
+  "file_snapshot",
+  "rewound",
+  "in_flight_start",
+  "in_flight_end",
+  "session_end"
+]);
+var STANDARD_AUDIT_EVENTS = /* @__PURE__ */ new Set([
+  "llm_request",
+  "tool_use",
+  "tool_call_start",
+  "tool_call_end",
+  "compaction",
+  "error",
+  "message_truncated",
+  "provider_retry",
+  "provider_error"
+]);
+var FULL_ONLY_EVENTS = /* @__PURE__ */ new Set([
+  "tool_progress"
+]);
+function isAllowed(type, level) {
+  if (CORE_RECONSTRUCT_EVENTS.has(type)) return true;
+  if (level === "minimal") return false;
+  if (STANDARD_AUDIT_EVENTS.has(type)) return true;
+  if (level === "standard") return false;
+  if (FULL_ONLY_EVENTS.has(type)) {
+    return level === "full";
+  }
+  return true;
+}
+function createSessionEventBridge(writer, level = "standard", options = {}) {
+  const normalizedLevel = level ?? "standard";
+  const progressCounters = /* @__PURE__ */ new Map();
+  const toolProgressConfig = options.sampling?.toolProgress ?? {};
+  const TOOL_PROGRESS_SAMPLE_RATE = toolProgressConfig.sampleRate ?? 8;
+  function shouldSample(event) {
+    if (event.type !== "tool_progress") return true;
+    const progEvent = event;
+    const innerType = progEvent.event?.type;
+    if (innerType === "warning" || innerType === "metric" || innerType === "file_changed") {
+      return true;
+    }
+    if (innerType === "log" || innerType === "partial_output") {
+      const key = progEvent.id || progEvent.name;
+      const count = (progressCounters.get(key) || 0) + 1;
+      progressCounters.set(key, count);
+      return count === 1 || count % TOOL_PROGRESS_SAMPLE_RATE === 0;
+    }
+    return true;
+  }
+  return {
+    level: normalizedLevel,
+    allows(type) {
+      return isAllowed(type, normalizedLevel);
+    },
+    async append(event) {
+      if (!writer) return;
+      if (!isAllowed(event.type, normalizedLevel)) return;
+      if (!shouldSample(event)) return;
+      try {
+        await writer.append(event);
+      } catch (err) {
+      }
+    }
+  };
+}
+function resolveAuditLevel(cfg) {
+  const raw = cfg?.session?.auditLevel;
+  if (raw === "minimal" || raw === "standard" || raw === "full") {
+    return raw;
+  }
+  return "standard";
+}
+function resolveSessionLoggingConfig(cfg) {
+  const session = cfg?.session ?? {};
+  const auditLevel = resolveAuditLevel(cfg);
+  const toolProgressSampleRate = session.sampling?.toolProgress?.sampleRate ?? 8;
+  return {
+    auditLevel,
+    sampling: {
+      toolProgress: {
+        sampleRate: Math.max(1, Math.floor(toolProgressSampleRate))
+      }
+    }
+  };
+}
+
 // src/storage/todos-checkpoint.ts
 init_atomic_write();
 async function loadTodosCheckpoint(filePath) {
@@ -6262,8 +6659,6 @@ var DirectorStateCheckpoint = class {
     }
   }
 };
-
-// src/security/permission-policy.ts
 init_atomic_write();
 var DefaultPermissionPolicy = class {
   policy = {};
@@ -6504,31 +6899,21 @@ var DefaultPermissionPolicy = class {
 };
 var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   /**
-   * Tools that are too dangerous to auto-approve even in a delegated
-   * subagent context. Subagents run non-interactively under a director
-   * and cannot answer prompts, but inherited authorization does not
-   * imply blanket permission for destructive or privilege-escalating
-   * operations. These tools remain at their declared `permission`
-   * level so the leader must explicitly allow them per-spawn.
+   * Legacy name-based denylist.
+   * @deprecated Prefer declaring `capabilities` on the Tool and using capability-based checks.
    */
-  static DENY = /* @__PURE__ */ new Set([
+  static LEGACY_NAME_DENY = /* @__PURE__ */ new Set([
     "bash",
-    // arbitrary shell — use exec for constrained shell
     "write",
-    // arbitrary file write
     "edit",
-    // arbitrary in-project file modification (equivalent to write)
     "replace",
-    // arbitrary multi-file find/replace (equivalent to write)
     "scaffold",
-    // arbitrary file generation outside project root
     "patch",
-    // arbitrary diff application
     "install",
-    // installs from arbitrary package sources
     "exec"
-    // restricted shell but with arbitrary command args
   ]);
+  // Note: hasDangerousCapabilityForSubagents is now the shared helper from capabilities.ts
+  // The old private method was removed in favor of the centralized utility.
   /**
    * Tools from MCP servers (`mcp__<server>__<tool>`) are external code of
    * unknown capability — they may wrap a shell or filesystem. They are
@@ -6539,12 +6924,16 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
     return name.startsWith("mcp__");
   }
   async evaluate(tool) {
-    const blocked = _AutoApprovePermissionPolicy.DENY.has(tool.name) || _AutoApprovePermissionPolicy.isMcpTool(tool.name);
-    if (tool.permission === "deny" || blocked) {
+    const hasDangerousCap = hasDangerousCapabilityForSubagents(tool);
+    const legacyNameBlock = _AutoApprovePermissionPolicy.LEGACY_NAME_DENY.has(tool.name);
+    const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
+    const blocked = tool.permission === "deny" || hasDangerousCap || legacyNameBlock || isMcp;
+    if (blocked) {
+      const reason = hasDangerousCap ? `tool declares dangerous capability (${tool.capabilities?.join(", ")}) \u2014 not auto-approved for subagents` : legacyNameBlock || isMcp ? `tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow it explicitly` : "tool default deny";
       return {
         permission: "deny",
         source: "subagent_guard",
-        reason: blocked ? `tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow it explicitly` : "tool default deny"
+        reason
       };
     }
     return { permission: "auto", source: "yolo" };
@@ -7676,6 +8065,7 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
   events;
   failureMode;
   policyProvider;
+  sessionBridge;
   /**
    * Once a compaction attempt reduces nothing (preserveK protects everything,
    * no oversized tool_results remain to elide), retrying on every iteration
@@ -7712,6 +8102,7 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
     this.events = opts.events;
     this.failureMode = opts.failureMode ?? "throw_on_hard";
     this.policyProvider = opts.policyProvider;
+    this.sessionBridge = opts.sessionBridge;
   }
   /** Allow callers (e.g. model-switch in WebUI) to update the context window
    *  denominator when the active model changes. */
@@ -7775,6 +8166,15 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         report,
         aggressive
       });
+      await this.sessionBridge?.append({
+        type: "compaction",
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        before: report.before,
+        after: report.after,
+        level: pressure.level,
+        aggressive,
+        reductions: report.reductions?.map((r) => ({ phase: r.phase, saved: r.saved }))
+      });
       ctx.clearFileTracking();
     } catch (err) {
       const error = err instanceof Error ? err : new Error(String(err));
@@ -8686,6 +9086,13 @@ var SubagentBudget = class _SubagentBudget {
   tokenOutput = 0;
   costUsd = 0;
   startTime = null;
+  /**
+   * Timestamp of the most recent activity (iteration / tool call / token
+   * usage / streamed progress). Drives the idle timeout — reset by
+   * `markActivity()`. Initialised to `start()` time so a never-active agent
+   * still eventually trips its idle window.
+   */
+  lastActivityTime = null;
   _onThreshold;
   /**
    * Hard cap on how long `_negotiateExtension` waits for the coordinator to
@@ -8729,6 +9136,24 @@ var SubagentBudget = class _SubagentBudget {
   }
   start() {
     this.startTime = Date.now();
+    this.lastActivityTime = this.startTime;
+  }
+  /**
+   * Reset the idle clock. Called on any sign of forward progress —
+   * iterations, tool calls, token usage, and streamed tool/text progress —
+   * so a long-but-productive subagent never trips its `idleTimeoutMs`.
+   */
+  markActivity() {
+    this.lastActivityTime = Date.now();
+  }
+  /**
+   * Milliseconds since the last activity signal. Returns 0 before `start()`
+   * (nothing to measure yet). Used by the coordinator watchdog to decide
+   * whether to re-arm (still active) or reap (genuinely idle).
+   */
+  idleMs() {
+    const since = this.lastActivityTime ?? this.startTime;
+    return since === null ? 0 : Date.now() - since;
   }
   /** Returns true if we're within 10% of any limit — useful for pre-flight checks. */
   isNearLimit() {
@@ -8776,8 +9201,13 @@ var SubagentBudget = class _SubagentBudget {
     if (this.limits.maxCostUsd !== void 0 && this.costUsd > this.limits.maxCostUsd) {
       exceeded.push({ kind: "cost", used: this.costUsd, limit: this.limits.maxCostUsd });
     }
-    if (elapsedMs !== void 0 && this.limits.timeoutMs !== void 0 && elapsedMs > this.limits.timeoutMs) {
-      exceeded.push({ kind: "timeout", used: elapsedMs, limit: this.limits.timeoutMs });
+    if (elapsedMs !== void 0) {
+      const idle = this.idleMs();
+      if (this.limits.idleTimeoutMs !== void 0 && idle > this.limits.idleTimeoutMs) {
+        exceeded.push({ kind: "timeout", used: idle, limit: this.limits.idleTimeoutMs });
+      } else if (this.limits.timeoutMs !== void 0 && elapsedMs > this.limits.timeoutMs) {
+        exceeded.push({ kind: "timeout", used: elapsedMs, limit: this.limits.timeoutMs });
+      }
     }
     if (exceeded.length === 0) return [];
     if (!this._onThreshold) {
@@ -8882,6 +9312,9 @@ var SubagentBudget = class _SubagentBudget {
       if (ext.timeoutMs !== void 0) {
         this.limits.timeoutMs = ext.timeoutMs;
       }
+      if (ext.idleTimeoutMs !== void 0) {
+        this.limits.idleTimeoutMs = ext.idleTimeoutMs;
+      }
       return decision;
     } finally {
       this._pendingNegotiations.delete(kind);
@@ -8889,16 +9322,19 @@ var SubagentBudget = class _SubagentBudget {
   }
   recordIteration() {
     this.iterations++;
+    this.markActivity();
     void this.checkLimits();
   }
   recordToolCall() {
     this.toolCalls++;
+    this.markActivity();
     void this.checkLimits();
   }
   recordUsage(usage, costUsd = 0) {
     this.tokenInput += usage.input;
     this.tokenOutput += usage.output;
     this.costUsd += costUsd;
+    this.markActivity();
     void this.checkLimits();
   }
   /**
@@ -8913,15 +9349,22 @@ var SubagentBudget = class _SubagentBudget {
    * - `mode === 'auto'` + listener     → throw `BudgetExceededError` (timeout is not extendable)
    */
   checkTimeout() {
-    if (this.startTime === null || this.limits.timeoutMs === void 0) return;
+    if (this.startTime === null) return;
+    const { timeoutMs, idleTimeoutMs } = this.limits;
+    if (timeoutMs === void 0 && idleTimeoutMs === void 0) return;
     const elapsed = Date.now() - this.startTime;
-    if (elapsed <= this.limits.timeoutMs) return;
+    const wallTripped = timeoutMs !== void 0 && elapsed > timeoutMs;
+    const idleTripped = idleTimeoutMs !== void 0 && this.idleMs() > idleTimeoutMs;
+    if (!wallTripped && !idleTripped) return;
     void this.checkLimits(elapsed);
   }
-  /** Returns true if a timeout has occurred without throwing. Useful for races. */
+  /** Returns true if a wall-clock or idle timeout has occurred without throwing. */
   isTimedOut() {
-    if (this.startTime === null || this.limits.timeoutMs === void 0) return false;
-    return Date.now() - this.startTime > this.limits.timeoutMs;
+    if (this.startTime === null) return false;
+    const { timeoutMs, idleTimeoutMs } = this.limits;
+    if (timeoutMs !== void 0 && Date.now() - this.startTime > timeoutMs) return true;
+    if (idleTimeoutMs !== void 0 && this.idleMs() > idleTimeoutMs) return true;
+    return false;
   }
   usage() {
     return {
@@ -9028,6 +9471,7 @@ function makeAgentSubagentRunner(opts) {
       // Cheap: O(1) per progress event, and the budget short-circuits
       // when timeoutMs is unset (most subagents have one set anyway).
       events.on("tool.progress", () => {
+        ctx.budget.markActivity();
         try {
           ctx.budget.checkTimeout();
         } catch (e) {
@@ -9044,6 +9488,7 @@ function makeAgentSubagentRunner(opts) {
         currentToolName = e.name;
       }),
       events.on("provider.text_delta", (e) => {
+        ctx.budget.markActivity();
         streamingTextAcc = (streamingTextAcc + e.text).slice(-200);
       })
     );
@@ -11613,6 +12058,7 @@ var FLEET_ROSTER = {
     ALL_AGENT_DEFINITIONS.map((d) => [d.config.role, d.config])
   )
 };
+var DEFAULT_IDLE_TIMEOUT_MS = 15 * 60 * 1e3;
 var FLEET_ROSTER_BUDGETS = {
   "audit-log": { timeoutMs: 7.5 * 60 * 60 * 1e3, maxIterations: 5e3, maxToolCalls: 15e3 },
   "bug-hunter": { timeoutMs: 10 * 60 * 60 * 1e3, maxIterations: 8e3, maxToolCalls: 2e4 },
@@ -11624,7 +12070,7 @@ var FLEET_ROSTER_BUDGETS = {
   )
 };
 var GENERIC_SUBAGENT_BUDGET = {
-  timeoutMs: 3 * 60 * 60 * 1e3,
+  idleTimeoutMs: DEFAULT_IDLE_TIMEOUT_MS,
   maxIterations: 5e3,
   maxToolCalls: 15e3
 };
@@ -11634,7 +12080,13 @@ function applyRosterBudget(cfg) {
   if (!defaultBudget) return cfg;
   return {
     ...cfg,
-    timeoutMs: cfg.timeoutMs ?? defaultBudget.timeoutMs,
+    // Wall-clock cap is opt-in only: forward an explicit `cfg.timeoutMs`, but
+    // do NOT impose the roster's historical multi-hour wall-clock default — it
+    // killed agents that were still actively working. Reaping is idle-based.
+    timeoutMs: cfg.timeoutMs,
+    // Idle window is the default reaper. Resets on activity, so a long-but-
+    // productive run is never killed; only a genuine stall is reaped.
+    idleTimeoutMs: cfg.idleTimeoutMs ?? defaultBudget.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS,
     maxIterations: cfg.maxIterations ?? defaultBudget.maxIterations,
     maxToolCalls: cfg.maxToolCalls ?? defaultBudget.maxToolCalls,
     maxTokens: cfg.maxTokens ?? defaultBudget.maxTokens,
@@ -12196,13 +12648,17 @@ var DefaultMultiAgentCoordinator = class extends EventEmitter {
     const rawMaxTokens = subagent.config.maxTokens;
     const rawMaxCostUsd = subagent.config.maxCostUsd;
     const rawTimeoutMs = subagent.config.timeoutMs;
+    const rawIdleTimeoutMs = subagent.config.idleTimeoutMs;
     const configWithRosterDefaults = applyRosterBudget(subagent.config);
     const budget = new SubagentBudget({
       maxIterations: rawMaxIterations ?? this.config.defaultBudget?.maxIterations ?? configWithRosterDefaults.maxIterations,
       maxToolCalls: rawMaxToolCalls ?? this.config.defaultBudget?.maxToolCalls ?? configWithRosterDefaults.maxToolCalls,
       maxTokens: rawMaxTokens ?? this.config.defaultBudget?.maxTokens ?? configWithRosterDefaults.maxTokens,
       maxCostUsd: rawMaxCostUsd ?? this.config.defaultBudget?.maxCostUsd ?? configWithRosterDefaults.maxCostUsd,
-      timeoutMs: rawTimeoutMs ?? this.config.defaultBudget?.timeoutMs ?? configWithRosterDefaults.timeoutMs
+      // Wall-clock cap is opt-in (explicit config / defaultBudget only); the
+      // roster no longer supplies one. Idle is the default reaper.
+      timeoutMs: rawTimeoutMs ?? this.config.defaultBudget?.timeoutMs ?? configWithRosterDefaults.timeoutMs,
+      idleTimeoutMs: rawIdleTimeoutMs ?? this.config.defaultBudget?.idleTimeoutMs ?? configWithRosterDefaults.idleTimeoutMs
     });
     subagent.activeBudget = budget;
     if (!this.runner) {
@@ -12249,63 +12705,79 @@ var DefaultMultiAgentCoordinator = class extends EventEmitter {
   }
   async executeWithTimeout(runner, task, ctx, budget) {
     const initialTimeoutMs = budget.limits.timeoutMs;
-    if (initialTimeoutMs === void 0) return runner(task, ctx);
+    const idleLimitMs = budget.limits.idleTimeoutMs;
+    if (initialTimeoutMs === void 0 && idleLimitMs === void 0) {
+      return runner(task, ctx);
+    }
     const start = Date.now();
     let timer = null;
     const timeoutPromise = new Promise((_, reject) => {
       const armFor = (ms) => {
         if (timer) clearTimeout(timer);
-        timer = setTimeout(async () => {
-          const elapsed = Date.now() - start;
-          const limit = budget.limits.timeoutMs ?? initialTimeoutMs;
-          if (!budget.onThreshold) {
-            this.subagents.get(ctx.subagentId)?.abortController.abort();
-            reject(new BudgetExceededError("timeout", limit, elapsed));
+        timer = setTimeout(onTick, Math.max(0, ms));
+      };
+      const scheduleNext = () => {
+        const wallRemaining = initialTimeoutMs === void 0 ? Number.POSITIVE_INFINITY : (budget.limits.timeoutMs ?? initialTimeoutMs) - (Date.now() - start);
+        const idleRemaining = idleLimitMs === void 0 ? Number.POSITIVE_INFINITY : (budget.limits.idleTimeoutMs ?? idleLimitMs) - budget.idleMs();
+        armFor(Math.max(25, Math.min(wallRemaining, idleRemaining)));
+      };
+      const onTick = async () => {
+        const elapsed = Date.now() - start;
+        const wallLimit = initialTimeoutMs === void 0 ? void 0 : budget.limits.timeoutMs ?? initialTimeoutMs;
+        const idleLimit = idleLimitMs === void 0 ? void 0 : budget.limits.idleTimeoutMs ?? idleLimitMs;
+        const wallExceeded = wallLimit !== void 0 && elapsed >= wallLimit;
+        const idleExceeded = idleLimit !== void 0 && budget.idleMs() >= idleLimit;
+        if (idleExceeded && !wallExceeded) {
+          this.subagents.get(ctx.subagentId)?.abortController.abort();
+          reject(new BudgetExceededError("timeout", idleLimit, budget.idleMs()));
+          return;
+        }
+        if (!wallExceeded) {
+          scheduleNext();
+          return;
+        }
+        const limit = wallLimit;
+        if (!budget.onThreshold) {
+          this.subagents.get(ctx.subagentId)?.abortController.abort();
+          reject(new BudgetExceededError("timeout", limit, elapsed));
+          return;
+        }
+        try {
+          const result = budget.onThreshold({
+            kind: "timeout",
+            used: elapsed,
+            limit,
+            requestDecision: () => new Promise((resolveDecision) => {
+              budget._events?.emit("budget.threshold_reached", {
+                kind: "timeout",
+                used: elapsed,
+                limit,
+                timeoutMs: 6e4,
+                extend: (extra) => resolveDecision({ extend: extra }),
+                deny: () => resolveDecision("stop")
+              });
+            })
+          });
+          const decision = typeof result === "string" ? result : await result;
+          if (decision === "continue" || decision === "throw" || decision === "stop") {
+            armFor(Math.max(1e3, limit));
             return;
           }
-          try {
-            const result = budget.onThreshold({
-              kind: "timeout",
-              used: elapsed,
-              limit,
-              requestDecision: () => new Promise((resolveDecision) => {
-                budget._events?.emit("budget.threshold_reached", {
-                  kind: "timeout",
-                  used: elapsed,
-                  limit,
-                  timeoutMs: 6e4,
-                  extend: (extra) => resolveDecision({ extend: extra }),
-                  deny: () => resolveDecision("stop")
-                });
-              })
-            });
-            const decision = typeof result === "string" ? result : await result;
-            if (decision === "continue") {
-              armFor(Math.max(1e3, limit));
-              return;
-            }
-            if (decision === "throw" || decision === "stop") {
-              armFor(Math.max(1e3, limit));
-              return;
-            }
-            if (decision.extend.timeoutMs !== void 0) {
-              budget.limits.timeoutMs = decision.extend.timeoutMs;
-              const newLimit = decision.extend.timeoutMs;
-              const remaining = Math.max(1e3, newLimit - elapsed);
-              armFor(remaining);
-              return;
-            }
-            this.subagents.get(ctx.subagentId)?.abortController.abort();
-            reject(new BudgetExceededError("timeout", limit, elapsed));
-          } catch (err) {
-            this.subagents.get(ctx.subagentId)?.abortController.abort();
-            reject(
-              err instanceof BudgetExceededError ? err : new BudgetExceededError("timeout", limit, elapsed)
-            );
+          if (decision.extend.timeoutMs !== void 0) {
+            budget.limits.timeoutMs = decision.extend.timeoutMs;
+            scheduleNext();
+            return;
           }
-        }, ms);
+          this.subagents.get(ctx.subagentId)?.abortController.abort();
+          reject(new BudgetExceededError("timeout", limit, elapsed));
+        } catch (err) {
+          this.subagents.get(ctx.subagentId)?.abortController.abort();
+          reject(
+            err instanceof BudgetExceededError ? err : new BudgetExceededError("timeout", limit, elapsed)
+          );
+        }
       };
-      armFor(initialTimeoutMs);
+      scheduleNext();
     });
     try {
       return await Promise.race([runner(task, ctx), timeoutPromise]);
@@ -19343,16 +19815,16 @@ var allServers = () => ({
 function parseSkillRef(input) {
   const trimmed = input.trim().replace(/^https?:\/\/github\.com\//, "").replace(/\.git$/, "");
   const atIdx = trimmed.indexOf("@");
-  let refPath;
+  let refPath2;
   let ref;
   if (atIdx > 0) {
-    refPath = trimmed.slice(0, atIdx);
+    refPath2 = trimmed.slice(0, atIdx);
     ref = trimmed.slice(atIdx + 1);
   } else {
-    refPath = trimmed;
+    refPath2 = trimmed;
     ref = "main";
   }
-  const parts = refPath.split("/").filter(Boolean);
+  const parts = refPath2.split("/").filter(Boolean);
   if (parts.length < 2) {
     throw new Error(`Invalid skill reference "${input}". Expected format: user/repo or user/repo@ref`);
   }
@@ -23917,6 +24389,15 @@ var Agent = class {
         this.events.emit("iteration.started", { ctx: this.ctx, index: i });
         this.injectPendingBtwNotes();
         const req = await this.buildAndRunRequestPipeline(opts);
+        await this.ctx.session.append({
+          type: "llm_request",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          model: req.model,
+          messageCount: req.messages.length,
+          estimatedInputTokens: estimateRequestTokens(req.messages, req.system, req.tools ?? []).total,
+          toolCount: (req.tools ?? []).length
+        }).catch(() => {
+        });
         let res;
         try {
           res = await customRunner(this.ctx, req);
@@ -24126,6 +24607,7 @@ var Agent = class {
       this.executionStrategy
     );
     const useById = new Map(selectedToolUses.map((u) => [u.id, u]));
+    const resultsForMessage = [];
     for (const { result, tool, durationMs } of outputs) {
       if (result.type === "tool_confirm_pending") {
         const decision = await this.waitForConfirm({
@@ -24210,8 +24692,10 @@ var Agent = class {
             });
           }
         }
+        resultsForMessage.push(reRunResult.result);
         continue;
       }
+      resultsForMessage.push(result);
       const use = useById.get(result.tool_use_id);
       if (!use) continue;
       await this.pipelines.toolCall.run({
@@ -24244,7 +24728,7 @@ var Agent = class {
     }
     this.ctx.state.appendMessage({
       role: "user",
-      content: outputs.map((o) => o.result)
+      content: resultsForMessage
     });
     await this.extensions.runAfterToolExecution(this.ctx, outputs);
   }
@@ -24609,6 +25093,50 @@ var InputBuilder = class {
     this.refs.push(ref);
     return placeholder;
   }
+  /**
+   * Register-only variant of `appendPaste`. Always stores the paste and
+   * returns the inline `[pasted #N, L lines]` token WITHOUT mutating
+   * `display` — the caller (TUI) owns its own editable buffer as the single
+   * source of truth, inserts the token there, and expands the buffer at
+   * submit. The collapse decision is the caller's (it gates this call); use
+   * `wouldCollapse()` for that.
+   */
+  async registerPaste(text) {
+    const ref = await this.store.add({
+      kind: "text",
+      data: text,
+      meta: { label: paragraphLabel(text) }
+    });
+    this.refs.push(ref);
+    const lines = text.split("\n").length;
+    return `[pasted #${ref.seq}, ${lines} lines]`;
+  }
+  /**
+   * Register-only variant of `appendImage` — see `registerPaste`. Returns a
+   * seq-keyed `[image #N, LABEL]` token; does not touch `display`.
+   */
+  async registerImage(dataBase64, mediaType) {
+    const label = `${mediaType.split("/")[1]?.toUpperCase() ?? "IMG"}`;
+    const ref = await this.store.add({
+      kind: "image",
+      data: dataBase64,
+      meta: { mediaType, label }
+    });
+    this.refs.push(ref);
+    return `[image #${ref.seq}, ${label}]`;
+  }
+  /**
+   * Register-only variant of `appendFile` — see `registerPaste`. Returns a
+   * path-keyed `[file:<path>]` token (resolved by path at expand time); does
+   * not touch `display`. The path is read from `meta.filename` (falling back
+   * to `meta.label`).
+   */
+  async registerFile(input) {
+    const ref = await this.store.add({ ...input, kind: "file" });
+    this.refs.push(ref);
+    const path35 = ref.meta.filename ?? ref.meta.label ?? String(ref.seq);
+    return `[file:${path35}]`;
+  }
   /**
    * Whether `appendPaste(text)` would collapse the text to a placeholder
    * (rather than inlining it). Lets a frontend decide where to route a paste
@@ -25091,6 +25619,14 @@ var ToolRegistry = class _ToolRegistry {
         context: { tool: tool.name }
       });
     }
+    if (!tool.inputSchema || typeof tool.inputSchema !== "object") {
+      throw new WrongStackError({
+        message: `Tool "${tool.name}" has an invalid or missing inputSchema`,
+        code: ERROR_CODES.REGISTRY_INVALID,
+        subsystem: "container",
+        context: { tool: tool.name }
+      });
+    }
     this.tools.set(tool.name, { tool, owner });
   }
   /**
@@ -25100,6 +25636,9 @@ var ToolRegistry = class _ToolRegistry {
    */
   tryRegister(tool, owner = "core") {
     if (this.tools.has(tool.name)) return false;
+    if (!tool.inputSchema || typeof tool.inputSchema !== "object") {
+      return false;
+    }
     this.tools.set(tool.name, { tool, owner });
     return true;
   }
@@ -28591,6 +29130,6 @@ ${formatPlan(updated)}`
   };
 }
 
-export { ACP_AGENTS, AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, ALL_SYNC_CATEGORIES, AUDIT_LOG_AGENT, Agent, AgentError, AnnotationsStore, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutoPhasePlanner, AutoPhaseRunner, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, CONTEXT_WINDOW_MODES, CheckpointManager, CloudSync, CollaborationBus, ConfigError, ConfigMigrationError, Container, Context, ConversationState, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_MAX_ITERATIONS, DEFAULT_MODES, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SPEC_TEMPLATE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultPluginAPI, DefaultPromptStore, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultTaskStore, DefaultTokenCounter, Director, DirectorStateCheckpoint, DoneConditionChecker, ERROR_CODES, EternalAutonomyEngine, EventBus, ExtensionRegistry, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FLEET_ROSTER_WITHACP, FleetBus, FleetCostCapError, FleetManager, FleetSpawnBudgetError, FleetUsageAggregator, FsError, GitignoreUpdater, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, InputBuilder, IntelligentCompactor, KERNEL_API_VERSION, LAYER_1_IDENTITY, LLMSelector, MAX_JOURNAL_ENTRIES, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, PhaseGraphBuilder, PhaseOrchestrator, PhaseStore, Pipeline, PluginError, ProviderError, ProviderRegistry, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, ReplayLogStore, ReplayProviderRunner, ReportGenerator, RunController, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, ScopedEventBus, SddParallelRun, SddTaskDecomposer, SecurityScanner, SecurityScannerOrchestrator, SelectiveCompactor, SessionAnalyzer, SessionError, SessionRecovery, SkillGenerator, SkillInstaller, SkillManifestStore, SlashCommandRegistry, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TOKENS, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, TechStackDetector, ToolAuditLog, ToolError, ToolExecutor, ToolRegistry, WorktreeManager, WrongStackError, addPlanItem, allServers, analyzeCriticalPath, appendJournal, applyRosterBudget, asBlocks, asText, assertSafePath, atomicWrite, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildBtwBlock, buildChildEnv, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, buildRecoveryStrategies, classifyFamily, clearPlan, collabInjectMiddleware, collabPauseMiddleware, color, compileGlob, compileUserRegex, completePartialObject, composeDirectorPrompt, composeSubagentPrompt, computeTaskProgress, consumeBtwNotes, context7Server, contextManagerTool, createAutoExecutor, createAutoPhaseFromTaskGraph, createContextManagerTool, createDefaultPipelines, createDelegateTool, createGitPlugin, createMcpControlTool, createMessage, createObservabilityPlugin, createPlanPlugin, createPromptsPlugin, createSecurityPlugin, createSecuritySlashCommand, createSkillsPlugin, createSyncPlugin, createToolOutputSerializer, decryptConfigSecrets, defaultGitignoreUpdater, defaultOrchestrator, defaultReportGenerator, defaultSecurityScanner, defaultSkillGenerator, defaultTechStackDetector, deriveTodosFromPlanItem, detectNewlineStyle, dispatchAgent, downloadGitHubTarball, emptyGoal, emptyPlan, encryptConfigSecrets, ensureDir, estimateRequestTokens, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, everArtServer, extractRunEnv, filesystemServer, findCriticalPath, formatContextWindowModeList, formatGoal, formatPlan, formatPlanTemplates, formatTodosList, getAgentDefinition, getContextWindowMode, getPlanTemplate, getTemplate, githubServer, goalFilePath, googleMapsServer, hashRequest, isAgentError, isConfigError, isContextWindowModeId, isFsError, isImageBlock, isPluginError, isSessionError, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, listContextWindowModes, listPlanTemplates, listTemplates, loadDirectorState, loadGoal, loadPlan, loadPlugins, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeContinueToNextIterationTool, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeRollUpTool, makeSpawnTool, makeTerminateTool, matchAny, matchGlob, migratePlaintextSecrets, miniMaxVisionServer, normalizeToLf, parseContinueDirective, parseSkillRef, pendingBtwCount, projectHash, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, repairToolUseAdjacency, resolveContextWindowPolicy, resolveWstackPaths, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, runProviderWithRetry, safeParse, safeStringify, sanitizeJsonString, saveGoal, savePlan, saveTodosCheckpoint, scoreAgents, securitySlashCommand, sentinelServer, setBtwNote, setPlanItemStatus, slackServer, stableStringify, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, stripAnsi, summarizeUsage, templateToMarkdown, toStyle, toWrongStackError, topologicalSort, unifiedDiff, unloadPlugins, validateAgainstSchema, wireMetricsToEvents, wrapAsState, zaiVisionServer };
+export { ACP_AGENTS, AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, ALL_SYNC_CATEGORIES, AUDIT_LOG_AGENT, Agent, AgentError, AnnotationsStore, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutoPhasePlanner, AutoPhaseRunner, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, CONTEXT_WINDOW_MODES, CORE_RECONSTRUCT_EVENTS, CheckpointManager, CloudSync, CollaborationBus, ConfigError, ConfigMigrationError, Container, Context, ConversationState, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_MAX_ITERATIONS, DEFAULT_MODES, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SESSION_LOGGING_CONFIG, DEFAULT_SPEC_TEMPLATE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultPluginAPI, DefaultPromptStore, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultTaskStore, DefaultTokenCounter, Director, DirectorStateCheckpoint, DoneConditionChecker, ERROR_CODES, EternalAutonomyEngine, EventBus, ExtensionRegistry, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FLEET_ROSTER_WITHACP, FleetBus, FleetCostCapError, FleetManager, FleetSpawnBudgetError, FleetUsageAggregator, FsError, GitignoreUpdater, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, InputBuilder, IntelligentCompactor, KERNEL_API_VERSION, LAYER_1_IDENTITY, LLMSelector, MAX_JOURNAL_ENTRIES, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, PhaseGraphBuilder, PhaseOrchestrator, PhaseStore, Pipeline, PluginError, ProviderError, ProviderRegistry, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, ReplayLogStore, ReplayProviderRunner, ReportGenerator, RunController, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, STANDARD_AUDIT_EVENTS, ScopedEventBus, SddParallelRun, SddTaskDecomposer, SecurityScanner, SecurityScannerOrchestrator, SelectiveCompactor, SessionAnalyzer, SessionError, SessionRecovery, SkillGenerator, SkillInstaller, SkillManifestStore, SlashCommandRegistry, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TOKENS, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, TechStackDetector, ToolAuditLog, ToolError, ToolExecutor, ToolRegistry, WorktreeManager, WrongStackError, addPlanItem, allServers, analyzeCriticalPath, appendJournal, applyRosterBudget, asBlocks, asText, assertSafePath, atomicWrite, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildBtwBlock, buildChildEnv, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, buildRecoveryStrategies, classifyFamily, clearPlan, collabInjectMiddleware, collabPauseMiddleware, color, compileGlob, compileUserRegex, completePartialObject, composeDirectorPrompt, composeSubagentPrompt, computeTaskProgress, consumeBtwNotes, context7Server, contextManagerTool, createAutoExecutor, createAutoPhaseFromTaskGraph, createContextManagerTool, createDefaultPipelines, createDelegateTool, createGitPlugin, createMcpControlTool, createMessage, createObservabilityPlugin, createPlanPlugin, createPromptsPlugin, createSecurityPlugin, createSecuritySlashCommand, createSessionEventBridge, createSkillsPlugin, createSyncPlugin, createToolOutputSerializer, decryptConfigSecrets, defaultGitignoreUpdater, defaultOrchestrator, defaultReportGenerator, defaultSecurityScanner, defaultSkillGenerator, defaultTechStackDetector, deriveTodosFromPlanItem, detectNewlineStyle, dispatchAgent, downloadGitHubTarball, emptyGoal, emptyPlan, encryptConfigSecrets, ensureDir, estimateRequestTokens, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, everArtServer, extractRunEnv, filesystemServer, findCriticalPath, formatContextWindowModeList, formatGoal, formatPlan, formatPlanTemplates, formatTodosList, getAgentDefinition, getContextWindowMode, getPlanTemplate, getTemplate, githubServer, goalFilePath, googleMapsServer, hashRequest, isAgentError, isConfigError, isContextWindowModeId, isFsError, isImageBlock, isPluginError, isSessionError, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, listContextWindowModes, listPlanTemplates, listTemplates, loadDirectorState, loadGoal, loadPlan, loadPlugins, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeContinueToNextIterationTool, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeRollUpTool, makeSpawnTool, makeTerminateTool, matchAny, matchGlob, mergeModelsPayload, migratePlaintextSecrets, miniMaxVisionServer, normalizeToLf, parseContinueDirective, parseSkillRef, pendingBtwCount, projectHash, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, repairToolUseAdjacency, resolveAuditLevel, resolveContextWindowPolicy, resolveSessionLoggingConfig, resolveWstackPaths, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, runProviderWithRetry, safeParse, safeStringify, sanitizeJsonString, saveGoal, savePlan, saveTodosCheckpoint, scoreAgents, securitySlashCommand, sentinelServer, setBtwNote, setPlanItemStatus, slackServer, stableStringify, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, stripAnsi, summarizeUsage, templateToMarkdown, toStyle, toWrongStackError, topologicalSort, unifiedDiff, unloadPlugins, validateAgainstSchema, wireMetricsToEvents, wrapAsState, zaiVisionServer };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map