@wrongstack/core 0.9.20 → 0.10.2

package/dist/{system-prompt-CneIxVip.d.ts → system-prompt-CM6zOhd2.d.ts}

@@ -1,4 +1,4 @@
-import { T as TextBlock, c as ContentBlock, Q as Tool } from './context-zkZeILpr.js';
+import { T as TextBlock, c as ContentBlock, Q as Tool } from './context-7u93AcGD.js';
 
 /**
  * Container — dependency injection with explicit bind / override / decorate.
@@ -19,10 +19,28 @@ interface BindOptions {
 }
 declare class Container {
     private readonly entries;
+    /**
+     * Tokens currently mid-resolve. Tracked so we can detect circular
+     * dependencies (A → B → A) and throw a structured error instead of
+     * overflowing the call stack with "Maximum call stack size exceeded".
+     *
+     * Not a memoization cache — the per-entry `cache` field is the source
+     * of truth for "have I built this before?". This set only lives for
+     * the duration of a single resolve call.
+     */
+    private readonly resolving;
     bind<T>(token: Token<T>, factory: Factory<T>, opts?: BindOptions): void;
     override<T>(token: Token<T>, factory: Factory<T>, opts?: BindOptions): void;
     decorate<T>(token: Token<T>, decorator: Decorator<T>, owner?: string): void;
     resolve<T>(token: Token<T>): T;
+    /**
+     * Build a human-readable description of the dependency cycle that
+     * caused the resolution to re-enter. Lists the tokens in the order
+     * they were entered, then appends the re-entered token to close the
+     * loop. Falls back to a generic message if the resolving set is
+     * somehow empty (shouldn't happen, but defensive).
+     */
+    private describeCycle;
     has<T>(token: Token<T>): boolean;
     ownerOf<T>(token: Token<T>): string | undefined;
     /**

package/dist/{tool-executor-flTuxsqO.d.ts → tool-executor-D7RxLtg4.d.ts}

@@ -1,8 +1,8 @@
-import { d as Context, n as ProviderError, Q as Tool, _ as ToolUseBlock, Y as ToolResultBlock } from './context-zkZeILpr.js';
-import { a as Compactor, C as CompactReport } from './compactor-D7X96RLZ.js';
-import { R as RecoveryDecision, E as ErrorHandler, a as RetryPolicy } from './retry-policy-J9N_PM40.js';
+import { d as Context, n as ProviderError, Q as Tool, _ as ToolUseBlock, Y as ToolResultBlock } from './context-7u93AcGD.js';
+import { a as Compactor, C as CompactReport } from './compactor-D1RHFRmF.js';
+import { R as RecoveryDecision, E as ErrorHandler, a as RetryPolicy } from './retry-policy-KF18W4dg.js';
 import { b as ModelsRegistry } from './models-registry-BcYJDKLm.js';
-import { y as ToolExecutorOptions, z as ToolExecutorStrategy, T as ToolBatchResult } from './index-BIHJ4uII.js';
+import { y as ToolExecutorOptions, z as ToolExecutorStrategy, T as ToolBatchResult } from './index-DgQWnZxP.js';
 
 interface CompactorOptions {
     preserveK?: number;

package/dist/types/index.d.ts

@@ -1,29 +1,29 @@
-export { A as AgentError, a as Capabilities, b as ConfigError, c as ContentBlock, E as ERROR_CODES, g as ErrorCode, h as ErrorSeverity, i as ErrorSubsystem, F as FileSnapshot, j as FsError, I as ImageBlock, J as JSONSchema, M as Message, k as MessageRole, P as Permission, l as PluginError, m as Provider, n as ProviderError, o as ProviderErrorBody, p as Request, q as Response, r as ResumedSession, s as RiskTier, S as SessionData, v as SessionError, w as SessionEvent, x as SessionMetadata, y as SessionStore, z as SessionSummary, B as SessionWriter, H as StopReason, K as StreamEvent, T as TextBlock, L as ThinkingBlock, Q as Tool, U as ToolCallContext, V as ToolError, W as ToolFinalEvent, X as ToolProgressEvent, Y as ToolResultBlock, Z as ToolStreamEvent, _ as ToolUseBlock, $ as Usage, a0 as WrongStackError, a1 as asBlocks, a2 as asText, a4 as isAgentError, a5 as isConfigError, a6 as isFsError, a7 as isImageBlock, a8 as isPluginError, a9 as isSessionError, aa as isTextBlock, ab as isThinkingBlock, ac as isToolError, ad as isToolResultBlock, ae as isToolUseBlock, af as isWrongStackError, ag as toWrongStackError } from '../context-zkZeILpr.js';
-export { P as ProviderRunner, R as RunProviderOptions } from '../provider-runner-BZdDrWrS.js';
-export { A as AutonomyConfig, C as CONTEXT_WINDOW_MODES, a as Config, b as ConfigLoader, c as ConfigStore, d as ContextConfig, e as ContextWindowAggressiveOn, f as ContextWindowConfigLike, g as ContextWindowMode, h as ContextWindowModeId, i as ContextWindowPolicy, j as ContextWindowThresholds, D as DEFAULT_CONTEXT_WINDOW_MODE_ID, F as FeaturesConfig, L as LogConfig, M as MCPServerConfig, P as PluginConfig, k as ProviderApiKey, l as ProviderConfig, S as SyncCategory, m as SyncConfig, T as ToolsConfig, n as formatContextWindowModeList, o as getContextWindowMode, p as isContextWindowModeId, q as listContextWindowModes, r as resolveContextWindowPolicy } from '../config-CLXMDOSs.js';
-export { C as CompactReport, a as Compactor } from '../compactor-D7X96RLZ.js';
-export { P as PermissionDecision, a as PermissionPolicy, T as TrustPolicy } from '../permission-H35s9Evv.js';
+export { A as AgentError, a as Capabilities, b as ConfigError, c as ContentBlock, E as ERROR_CODES, g as ErrorCode, h as ErrorSeverity, i as ErrorSubsystem, F as FileSnapshot, j as FsError, I as ImageBlock, J as JSONSchema, M as Message, k as MessageRole, P as Permission, l as PluginError, m as Provider, n as ProviderError, o as ProviderErrorBody, p as Request, q as Response, r as ResumedSession, s as RiskTier, S as SessionData, v as SessionError, w as SessionEvent, x as SessionMetadata, y as SessionStore, z as SessionSummary, B as SessionWriter, H as StopReason, K as StreamEvent, T as TextBlock, L as ThinkingBlock, Q as Tool, U as ToolCallContext, V as ToolError, W as ToolFinalEvent, X as ToolProgressEvent, Y as ToolResultBlock, Z as ToolStreamEvent, _ as ToolUseBlock, $ as Usage, a0 as WrongStackError, a1 as asBlocks, a2 as asText, a4 as isAgentError, a5 as isConfigError, a6 as isFsError, a7 as isImageBlock, a8 as isPluginError, a9 as isSessionError, aa as isTextBlock, ab as isThinkingBlock, ac as isToolError, ad as isToolResultBlock, ae as isToolUseBlock, af as isWrongStackError, ag as toWrongStackError } from '../context-7u93AcGD.js';
+export { P as ProviderRunner, R as RunProviderOptions } from '../provider-runner-BmPe2RuU.js';
+export { A as AutonomyConfig, C as CONTEXT_WINDOW_MODES, a as Config, b as ConfigLoader, c as ConfigStore, d as ContextConfig, e as ContextWindowAggressiveOn, f as ContextWindowConfigLike, g as ContextWindowMode, h as ContextWindowModeId, i as ContextWindowPolicy, j as ContextWindowThresholds, D as DEFAULT_CONTEXT_WINDOW_MODE_ID, F as FeaturesConfig, L as LogConfig, M as MCPServerConfig, P as PluginConfig, k as ProviderApiKey, l as ProviderConfig, S as SessionLoggingConfig, m as SyncCategory, n as SyncConfig, T as ToolsConfig, o as formatContextWindowModeList, p as getContextWindowMode, q as isContextWindowModeId, r as listContextWindowModes, s as resolveContextWindowPolicy } from '../config-CJXBka2r.js';
+export { C as CompactReport, a as Compactor } from '../compactor-D1RHFRmF.js';
+export { P as PermissionDecision, a as PermissionPolicy, T as TrustPolicy } from '../permission-B6sldrSp.js';
 export { C as CheckpointInfo, R as RewindResult, a as RewindResultExtended, S as SessionRewinder } from '../session-rewinder-C9HnMkhP.js';
-export { A as AddAttachmentInput, a as Attachment, b as AttachmentKind, c as AttachmentMeta, d as AttachmentRef, e as AttachmentStore, D as DefaultSessionReader } from '../session-reader-C7JJlxOw.js';
-export { D as DEFAULT_AUTONOMY_CONFIG, a as DEFAULT_CONTEXT_CONFIG, b as DEFAULT_TOOLS_CONFIG } from '../default-config-Uzla85H-.js';
+export { A as AddAttachmentInput, a as Attachment, b as AttachmentKind, c as AttachmentMeta, d as AttachmentRef, e as AttachmentStore, D as DefaultSessionReader } from '../session-reader-CCSBfQmd.js';
+export { D as DEFAULT_AUTONOMY_CONFIG, a as DEFAULT_CONTEXT_CONFIG, b as DEFAULT_SESSION_LOGGING_CONFIG, c as DEFAULT_TOOLS_CONFIG } from '../default-config-DEXI4jsl.js';
 export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-scrubber-7rSC_emZ.js';
 export { D as DefaultLogger, a as DefaultLoggerOptions } from '../logger-bOzkF5LL.js';
-export { D as DefaultPathResolver, a as DefaultTokenCounter } from '../path-resolver-CHiBL0DD.js';
+export { D as DefaultPathResolver, a as DefaultTokenCounter } from '../path-resolver-BfyK-I7w.js';
 export { M as MemoryEntry, a as MemoryScope, b as MemoryStore } from '../memory-CEXuo7sz.js';
-export { C as CompactorOptions, D as DEFAULT_RECOVERY_STRATEGIES, a as DefaultErrorHandler, b as DefaultRetryPolicy, H as HybridCompactor, R as RecoveryStrategy, T as ToolExecutor, c as buildRecoveryStrategies } from '../tool-executor-flTuxsqO.js';
+export { C as CompactorOptions, D as DEFAULT_RECOVERY_STRATEGIES, a as DefaultErrorHandler, b as DefaultRetryPolicy, H as HybridCompactor, R as RecoveryStrategy, T as ToolExecutor, c as buildRecoveryStrategies } from '../tool-executor-D7RxLtg4.js';
 export { S as SkillEntry, a as SkillLoader, b as SkillManifest } from '../skill-CxuWrsKK.js';
-export { a as BuildContext, c as ModelCapabilities, e as Renderer, S as SystemPromptBuilder } from '../system-prompt-CneIxVip.js';
+export { a as BuildContext, c as ModelCapabilities, e as Renderer, S as SystemPromptBuilder } from '../system-prompt-CM6zOhd2.js';
 export { I as InputReader, P as PromptOption } from '../input-reader-E-ffP2ee.js';
-export { M as MCPRegistryView, j as MetricsSinkView, P as Plugin, k as PluginAPI, l as PluginCapabilities, m as PluginDependency, n as PluginPipelines, o as ProviderFactory, r as ProviderRegistryView, S as SessionWriterView, u as SlashCommand, v as SlashCommandRegistryView, w as SystemPromptContributor, F as ToolRegistryView } from '../index-BIHJ4uII.js';
-export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-OG_30xqZ.js';
+export { M as MCPRegistryView, j as MetricsSinkView, P as Plugin, k as PluginAPI, l as PluginCapabilities, m as PluginDependency, n as PluginPipelines, o as ProviderFactory, r as ProviderRegistryView, S as SessionWriterView, u as SlashCommand, v as SlashCommandRegistryView, w as SystemPromptContributor, F as ToolRegistryView } from '../index-DgQWnZxP.js';
+export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-gwMAo6E3.js';
 export { D as DEFAULT_MODES, M as Mode, a as ModeConfig, b as ModeManifest, c as ModeStore } from '../mode-CV077NjV.js';
-export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-Dti3KXGk.js';
-export { C as CoordinatorEvents, k as CoordinatorStatus, D as DoneCondition, M as MultiAgentConfig, l as MultiAgentCoordinator, S as SpawnResult, n as SubagentConfig, o as SubagentContext, p as SubagentError, q as SubagentErrorKind, r as SubagentRunContext, s as SubagentRunOutcome, t as SubagentRunner, T as TaskDelegation, u as TaskResult, v as TaskSpec } from '../multi-agent-DNp6lAzg.js';
+export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-DBBGP5O4.js';
+export { C as CoordinatorEvents, k as CoordinatorStatus, D as DoneCondition, M as MultiAgentConfig, l as MultiAgentCoordinator, S as SpawnResult, n as SubagentConfig, o as SubagentContext, p as SubagentError, q as SubagentErrorKind, r as SubagentRunContext, s as SubagentRunOutcome, t as SubagentRunner, T as TaskDelegation, u as TaskResult, v as TaskSpec } from '../multi-agent-C1O8EFzb.js';
 export { C as CriticalPathResult, D as DEFAULT_SPEC_TEMPLATE, S as SpecAnalysis, a as SpecApiEndpoint, b as SpecRequirement, c as SpecSection, d as SpecSectionType, e as SpecStatus, f as SpecTemplate, g as SpecValidationResult, h as Specification, T as TaskAssignment, i as TaskDependency, j as TaskEdge, k as TaskFilter, l as TaskGraph, m as TaskNode, n as TaskPriority, o as TaskProgress, p as TaskSort, q as TaskStatus, r as TaskType, s as computeTaskProgress, t as findCriticalPath, u as topologicalSort } from '../task-graph-D1YQbpxF.js';
 export { A as AggregateHealth, H as HealthCheck, a as HealthCheckResult, b as HealthRegistry, c as HealthStatus, M as MetricLabels, d as MetricSeries, e as MetricsSink, f as MetricsSnapshot, S as Span, T as Tracer } from '../observability-BhnVLBLS.js';
-import '../events-DH-9r-_C.js';
+import '../events-Bw1K5E6K.js';
 import '../logger-DDd5C--Z.js';
-import '../retry-policy-J9N_PM40.js';
+import '../retry-policy-KF18W4dg.js';
 import '../models-registry-BcYJDKLm.js';
 import '../secret-vault-DoISxaKO.js';
 import '../secret-scrubber-3MHDDAtm.js';

package/dist/types/index.js

@@ -66,8 +66,10 @@ var ERROR_CODES = {
   // Container / Registry
   CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
   CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
+  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
   REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
   REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
+  REGISTRY_INVALID: "REGISTRY_INVALID",
   // File system
   FS_READ_FAILED: "FS_READ_FAILED",
   FS_WRITE_FAILED: "FS_WRITE_FAILED",
@@ -315,6 +317,14 @@ var DEFAULT_CONTEXT_CONFIG = Object.freeze({
 var DEFAULT_AUTONOMY_CONFIG = Object.freeze({
   autoProceedDelayMs: 45e3
 });
+var DEFAULT_SESSION_LOGGING_CONFIG = Object.freeze({
+  auditLevel: "standard",
+  sampling: {
+    toolProgress: {
+      sampleRate: 8
+    }
+  }
+});
 
 // src/types/secret-vault.ts
 var ENCRYPTED_PREFIX = "enc:v1:";
@@ -1481,6 +1491,71 @@ var DefaultSecretScrubber = class {
     return visit(obj);
   }
 };
+
+// src/utils/merge-models-payload.ts
+function mergeModelsPayload(base, overlay) {
+  const out = {};
+  for (const [id, provider] of Object.entries(base)) {
+    out[id] = cloneProvider(provider);
+  }
+  for (const [id, ovProvider] of Object.entries(overlay)) {
+    const existing = out[id];
+    out[id] = existing ? mergeProvider(existing, ovProvider) : cloneProvider(ovProvider);
+  }
+  return out;
+}
+function mergeProvider(base, overlay) {
+  const models = {};
+  for (const [mid, m] of Object.entries(base.models ?? {})) {
+    models[mid] = { ...m };
+  }
+  for (const [mid, ovModel] of Object.entries(overlay.models ?? {})) {
+    const existing = models[mid];
+    models[mid] = existing ? mergeModel(existing, ovModel) : { ...ovModel };
+  }
+  return {
+    ...base,
+    // Overlay scalar fields win when explicitly provided; otherwise keep base.
+    ...stripUndefined({
+      id: overlay.id,
+      name: overlay.name,
+      npm: overlay.npm,
+      api: overlay.api,
+      env: overlay.env,
+      doc: overlay.doc
+    }),
+    models
+  };
+}
+function mergeModel(base, overlay) {
+  const merged = { ...base, ...overlay };
+  if (base.limit || overlay.limit) {
+    merged.limit = { ...base.limit, ...overlay.limit };
+  }
+  if (base.cost || overlay.cost) {
+    merged.cost = { ...base.cost, ...overlay.cost };
+  }
+  if (base.modalities || overlay.modalities) {
+    merged.modalities = { ...base.modalities, ...overlay.modalities };
+  }
+  return merged;
+}
+function cloneProvider(p) {
+  const models = {};
+  for (const [mid, m] of Object.entries(p.models ?? {})) {
+    models[mid] = { ...m };
+  }
+  return { ...p, models };
+}
+function stripUndefined(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+
+// src/models/models-registry.ts
 var DEFAULT_URL = "https://models.dev/api.json";
 var DEFAULT_TTL_SECONDS = 24 * 3600;
 var FAMILY_BY_NPM = {
@@ -1508,7 +1583,10 @@ function classifyFamily(npm) {
   return FAMILY_BY_NPM[npm] ?? "unsupported";
 }
 var DefaultModelsRegistry = class {
+  /** Merged (base + overlay) payload — what every reader sees. */
   payload;
+  /** Memoised overlay payload (in-memory / fetched / file). */
+  overlayPayload;
   fetchedAt;
   cacheFile;
   url;
@@ -1516,6 +1594,10 @@ var DefaultModelsRegistry = class {
   fetchImpl;
   seed;
   maxStaleAgeMs;
+  overlay;
+  overlayUrl;
+  overlayFile;
+  overlayCacheFile;
   constructor(opts) {
     this.cacheFile = opts.cacheFile;
     this.url = opts.url ?? DEFAULT_URL;
@@ -1524,6 +1606,10 @@ var DefaultModelsRegistry = class {
     this.seed = opts.seed;
     const maxStaleSeconds = opts.maxStaleAgeSeconds ?? 7 * 24 * 3600;
     this.maxStaleAgeMs = maxStaleSeconds * 1e3;
+    this.overlay = opts.overlay;
+    this.overlayUrl = opts.overlayUrl;
+    this.overlayFile = opts.overlayFile;
+    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path4.join(path4.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
   }
   async load(opts = {}) {
     if (this.payload && !opts.force) return this.payload;
@@ -1532,27 +1618,45 @@ var DefaultModelsRegistry = class {
       this.fetchedAt = /* @__PURE__ */ new Date();
       return this.payload;
     }
+    const overlay = await this.loadOverlay(opts);
+    const base = await this.loadBase(opts, Object.keys(overlay).length > 0);
+    this.payload = mergeModelsPayload(base, overlay);
+    return this.payload;
+  }
+  /**
+   * Load the models.dev base payload: fresh cache → network → stale cache.
+   * On total failure, degrade to `{}` (so a non-empty overlay still drives
+   * the catalog) rather than throwing — unless there's no curated overlay to
+   * fall back on, in which case the original error propagates so pure-
+   * models.dev setups still surface the problem.
+   */
+  async loadBase(opts = {}, overlayAvailable = false) {
     if (!opts.force) {
-      const cached = await this.readCache();
+      const cached = await this.readCacheAt(this.cacheFile);
       if (cached && this.isFresh(cached.fetchedAt)) {
-        this.payload = cached.payload;
         this.fetchedAt = new Date(cached.fetchedAt);
         return cached.payload;
       }
     }
     try {
-      return await this.refresh();
+      return await this.refreshBase();
     } catch (err) {
-      const cached = await this.readCache();
+      const cached = await this.readCacheAt(this.cacheFile);
       if (cached && this.isWithinMaxStaleAge(cached.fetchedAt)) {
-        this.payload = cached.payload;
         this.fetchedAt = new Date(cached.fetchedAt);
         return cached.payload;
       }
+      if (overlayAvailable) {
+        console.warn(
+          `ModelsRegistry: models.dev unavailable (${err instanceof Error ? err.message : String(err)}); serving curated overlay only.`
+        );
+        return {};
+      }
       throw err;
     }
   }
-  async refresh() {
+  /** Fetch + cache the models.dev base. Throws on failure (used by `refresh`). */
+  async refreshBase() {
     const res = await this.fetchImpl(this.url, {
       method: "GET",
       headers: { accept: "application/json" }
@@ -1561,7 +1665,6 @@ var DefaultModelsRegistry = class {
       throw new Error(`ModelsRegistry: HTTP ${res.status} fetching ${this.url}`);
     }
     const json = await res.json();
-    this.payload = json;
     this.fetchedAt = /* @__PURE__ */ new Date();
     const envelope = {
       fetchedAt: this.fetchedAt.toISOString(),
@@ -1571,6 +1674,68 @@ var DefaultModelsRegistry = class {
     await atomicWrite(this.cacheFile, JSON.stringify(envelope));
     return json;
   }
+  /**
+   * Resolve the curated overlay, memoised. Order: in-memory `overlay` →
+   * fetched `overlayUrl` (cached, same TTL/stale rules) → `overlayFile` on
+   * disk. Never throws — a missing/broken overlay yields `{}`.
+   */
+  async loadOverlay(opts = {}) {
+    if (this.overlayPayload && !opts.force) return this.overlayPayload;
+    if (this.overlay) {
+      this.overlayPayload = this.overlay;
+      return this.overlayPayload;
+    }
+    const fetched = await this.loadOverlayFromUrl(opts);
+    if (fetched) {
+      this.overlayPayload = fetched;
+      return fetched;
+    }
+    const fromFile = await this.readOverlayFile();
+    this.overlayPayload = fromFile ?? {};
+    return this.overlayPayload;
+  }
+  async loadOverlayFromUrl(opts) {
+    if (!this.overlayUrl || !this.overlayCacheFile) return void 0;
+    if (!opts.force) {
+      const cached = await this.readCacheAt(this.overlayCacheFile);
+      if (cached && this.isFresh(cached.fetchedAt)) return cached.payload;
+    }
+    try {
+      const res = await this.fetchImpl(this.overlayUrl, {
+        method: "GET",
+        headers: { accept: "application/json" }
+      });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      const json = await res.json();
+      const envelope = {
+        fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        url: this.overlayUrl,
+        payload: json
+      };
+      await atomicWrite(this.overlayCacheFile, JSON.stringify(envelope)).catch(() => {
+      });
+      return json;
+    } catch {
+      const cached = await this.readCacheAt(this.overlayCacheFile);
+      if (cached && this.isWithinMaxStaleAge(cached.fetchedAt)) return cached.payload;
+      return void 0;
+    }
+  }
+  async readOverlayFile() {
+    if (!this.overlayFile) return void 0;
+    try {
+      const raw = await fs.readFile(this.overlayFile, "utf8");
+      return JSON.parse(raw);
+    } catch {
+      return void 0;
+    }
+  }
+  async refresh() {
+    const base = await this.refreshBase();
+    const overlay = await this.loadOverlay({ force: true });
+    this.payload = mergeModelsPayload(base, overlay);
+    return this.payload;
+  }
   async listProviders() {
     const payload = await this.load();
     return Object.values(payload).map((p) => this.resolveProvider(p));
@@ -1611,7 +1776,7 @@ var DefaultModelsRegistry = class {
   }
   async ageSeconds() {
     if (!this.fetchedAt) {
-      const cached = await this.readCache();
+      const cached = await this.readCacheAt(this.cacheFile);
       if (!cached) return Number.POSITIVE_INFINITY;
       return (Date.now() - new Date(cached.fetchedAt).getTime()) / 1e3;
     }
@@ -1635,9 +1800,9 @@ var DefaultModelsRegistry = class {
   isWithinMaxStaleAge(fetchedAtIso) {
     return Date.now() - new Date(fetchedAtIso).getTime() < this.maxStaleAgeMs;
   }
-  async readCache() {
+  async readCacheAt(file) {
     try {
-      const raw = await fs.readFile(this.cacheFile, "utf8");
+      const raw = await fs.readFile(file, "utf8");
       return JSON.parse(raw);
     } catch {
       return void 0;
@@ -2209,6 +2374,141 @@ function topologicalSort(graph) {
   return result;
 }
 
+// src/security/capabilities.ts
+var ToolCapabilities = {
+  /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
+  SHELL_ARBITRARY: "shell.arbitrary",
+  /** Can write / modify / delete files inside the project. */
+  FS_WRITE: "fs.write",
+  /** Can write files outside the current project root (very high risk). */
+  FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project",
+  /** Proxies tools from external MCP servers (unknown capability). */
+  MCP_PROXY: "mcp.proxy",
+  /** Can spawn or manage subagents / multi-agent tasks. */
+  SUBAGENT_SPAWN: "subagent.spawn",
+  /** Can mutate global or session configuration / trust state. */
+  CONFIG_MUTATE: "config.mutate",
+  /** Can install packages or run package managers with side effects. */
+  PACKAGE_INSTALL: "package.install"
+};
+var DANGEROUS_FOR_SUBAGENTS = [
+  ToolCapabilities.SHELL_ARBITRARY,
+  ToolCapabilities.FS_WRITE,
+  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
+  ToolCapabilities.MCP_PROXY,
+  ToolCapabilities.SUBAGENT_SPAWN,
+  ToolCapabilities.CONFIG_MUTATE,
+  ToolCapabilities.PACKAGE_INSTALL
+];
+function hasDangerousCapabilityForSubagents(toolOrCaps) {
+  if (!toolOrCaps) return false;
+  const input = toolOrCaps;
+  const caps = Array.isArray(input) ? input : input?.capabilities ?? [];
+  return caps.some((c) => DANGEROUS_FOR_SUBAGENTS.includes(c));
+}
+function getDangerousCapabilities(toolOrCaps) {
+  if (!toolOrCaps) return [];
+  const input = toolOrCaps;
+  const caps = Array.isArray(input) ? input : input?.capabilities ?? [];
+  return caps.filter(
+    (c) => DANGEROUS_FOR_SUBAGENTS.includes(c)
+  );
+}
+
+// src/utils/json-schema-validate.ts
+function validateAgainstSchema(value, schema) {
+  const errors = [];
+  walk2(value, schema, "", errors);
+  return { ok: errors.length === 0, errors };
+}
+function walk2(value, schema, path6, errors) {
+  if (schema.enum !== void 0) {
+    if (!schema.enum.some((e) => deepEqual(e, value))) {
+      errors.push({
+        path: path6 || "<root>",
+        message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
+      });
+      return;
+    }
+  }
+  if (typeof schema.type === "string") {
+    if (!checkType(value, schema.type)) {
+      errors.push({
+        path: path6 || "<root>",
+        message: `expected ${schema.type}, got ${describeType(value)}`
+      });
+      return;
+    }
+  }
+  if (schema.type === "object" && isPlainObject(value)) {
+    const obj = value;
+    for (const req of schema.required ?? []) {
+      if (!(req in obj)) {
+        errors.push({ path: joinPath(path6, req), message: "required property missing" });
+      }
+    }
+    if (schema.properties) {
+      for (const [key, subSchema] of Object.entries(schema.properties)) {
+        if (key in obj) {
+          walk2(obj[key], subSchema, joinPath(path6, key), errors);
+        }
+      }
+    }
+  }
+  if (schema.type === "array" && Array.isArray(value) && schema.items) {
+    value.forEach((item, i) => walk2(item, schema.items, `${path6}[${i}]`, errors));
+  }
+}
+function checkType(value, type) {
+  switch (type) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number" && !Number.isNaN(value);
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "boolean":
+      return typeof value === "boolean";
+    case "null":
+      return value === null;
+    case "array":
+      return Array.isArray(value);
+    case "object":
+      return isPlainObject(value);
+    default:
+      return true;
+  }
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function describeType(v) {
+  if (v === null) return "null";
+  if (Array.isArray(v)) return "array";
+  return typeof v;
+}
+function joinPath(parent, key) {
+  if (!parent) return key;
+  return `${parent}.${key}`;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b) return false;
+  if (a === null || b === null) return a === b;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
+  }
+  if (typeof a === "object" && typeof b === "object") {
+    const ak = Object.keys(a);
+    const bk = Object.keys(b);
+    if (ak.length !== bk.length) return false;
+    return ak.every(
+      (k) => deepEqual(a[k], b[k])
+    );
+  }
+  return false;
+}
+
 // src/utils/tool-output-serializer.ts
 function createToolOutputSerializer(opts = {}) {
   const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
@@ -2290,18 +2590,45 @@ var ToolExecutor = class {
         budget = this.decrementBudget(result, budget);
         return { result, tool, durationMs: Date.now() - start };
       }
+      const validation = validateAgainstSchema(use.input, tool.inputSchema);
+      if (!validation.ok) {
+        const errorDetails = validation.errors.map((e) => `  - ${e.path || "input"}: ${e.message}`).join("\n");
+        const result = {
+          type: "tool_result",
+          tool_use_id: use.id,
+          content: `Invalid arguments for tool "${tool.name}".
+
+Validation errors:
+${errorDetails}
+
+Please call the tool again with arguments that match its inputSchema. You can use the "tool-help" tool with name="${tool.name}" to see the exact expected schema.`,
+          is_error: true
+        };
+        budget = this.decrementBudget(result, budget);
+        return { result, tool, durationMs: Date.now() - start };
+      }
+      const toolDangerousCaps = getDangerousCapabilities(tool);
+      if (toolDangerousCaps.length > 0) {
+        if (this.opts.events) ;
+      }
       if (hasMalformedArguments(use.input)) {
         const result = this.malformedInputResult(use, extractMalformedRaw(use.input));
         budget = this.decrementBudget(result, budget);
         return { result, tool, durationMs: Date.now() - start };
       }
       const decision = await this.opts.permissionPolicy.evaluate(tool, use.input, ctx);
-      if (decision.permission === "deny") {
+      let effectivePermission = decision.permission;
+      const policy = this.opts.permissionPolicy;
+      const yolo = policy.getYolo?.() === true || policy.getForceAllYolo?.() === true;
+      if (toolDangerousCaps.length > 0 && effectivePermission === "auto" && !yolo) {
+        effectivePermission = "confirm";
+      }
+      if (effectivePermission === "deny") {
         const result = this.deniedResult(use, decision.reason);
         budget = this.decrementBudget(result, budget);
         return { result, tool, durationMs: Date.now() - start };
       }
-      if (decision.permission === "confirm") {
+      if (effectivePermission === "confirm") {
         if (this.opts.confirmAwaiter) {
           const choice = await this.opts.confirmAwaiter(tool, use.input, use.id, tool.name);
           if (choice !== "yes" && choice !== "always") {
@@ -2326,10 +2653,13 @@ var ToolExecutor = class {
           return { result: pending, tool, durationMs: Date.now() - start };
         }
       }
+      const toolCapsForAudit = hasDangerousCapabilityForSubagents(tool) ? tool.capabilities ?? [] : [];
       const span = this.opts.tracer?.startSpan(`tool.${tool.name}`, {
         "tool.name": tool.name,
         "tool.mutating": tool.mutating,
-        "tool.permission": tool.permission
+        "tool.permission": tool.permission,
+        "tool.capabilities": JSON.stringify(tool.capabilities ?? []),
+        "tool.has_dangerous_capabilities": toolCapsForAudit.length > 0
       });
       try {
         const result = await this.executeTool(tool, use, ctx, budget);
@@ -2874,6 +3204,6 @@ function renderPlainText(meta, events) {
   return lines.join("\n");
 }
 
-export { AgentError, CONTEXT_WINDOW_MODES, ConfigError, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONTEXT_CONFIG, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEFAULT_MODES, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SPEC_TEMPLATE, DEFAULT_TOOLS_CONFIG, DefaultErrorHandler, DefaultLogger, DefaultModelsRegistry, DefaultPathResolver, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultTokenCounter, ERROR_CODES, FsError, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, PluginError, ProviderError, SessionError, ToolError, ToolExecutor, WrongStackError, asBlocks, asText, buildRecoveryStrategies, classifyFamily, computeTaskProgress, createMessage, decryptConfigSecrets, encryptConfigSecrets, findCriticalPath, formatContextWindowModeList, getContextWindowMode, isAgentError, isConfigError, isContextWindowModeId, isFsError, isImageBlock, isPluginError, isSessionError, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, listContextWindowModes, migratePlaintextSecrets, resolveContextWindowPolicy, rewriteConfigEncrypted, toWrongStackError, topologicalSort };
+export { AgentError, CONTEXT_WINDOW_MODES, ConfigError, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONTEXT_CONFIG, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEFAULT_MODES, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SESSION_LOGGING_CONFIG, DEFAULT_SPEC_TEMPLATE, DEFAULT_TOOLS_CONFIG, DefaultErrorHandler, DefaultLogger, DefaultModelsRegistry, DefaultPathResolver, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultTokenCounter, ERROR_CODES, FsError, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, PluginError, ProviderError, SessionError, ToolError, ToolExecutor, WrongStackError, asBlocks, asText, buildRecoveryStrategies, classifyFamily, computeTaskProgress, createMessage, decryptConfigSecrets, encryptConfigSecrets, findCriticalPath, formatContextWindowModeList, getContextWindowMode, isAgentError, isConfigError, isContextWindowModeId, isFsError, isImageBlock, isPluginError, isSessionError, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, listContextWindowModes, migratePlaintextSecrets, resolveContextWindowPolicy, rewriteConfigEncrypted, toWrongStackError, topologicalSort };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map