@yanlinglabs/winter-agent-runtime 0.0.36 → 0.0.38

package/dist/{index-c8j57y8v.js → index-5xe59vkt.js}

@@ -934,6 +934,7 @@ function validatePermissionRuleString(raw, direction) {
 }
 
 // src/tools/registry.ts
+var DEFERRED_BUILTINS_CAPABILITY = "winter.deferred-builtins";
 var registry = new Map;
 function registerTool2(t) {
   if (registry.has(t.descriptor.canonicalName)) {
@@ -996,8 +997,9 @@ function onRegistryChange(cb) {
     registryChangeListeners.delete(cb);
   };
 }
-function buildMcpToolDescriptor(server, tool, opts) {
-  const canonicalName = `mcp__${server}__${tool.name}`;
+function buildMcpToolDescriptor(server, tool, opts, plainName) {
+  const mcpSpelling = `mcp__${server}__${tool.name}`;
+  const canonicalName = plainName ?? mcpSpelling;
   const requiresInteraction = tool._meta?.["anthropic/requiresUserInteraction"] === true;
   const perToolAlwaysLoad = tool._meta?.["anthropic/alwaysLoad"] === true;
   const alwaysLoadResolved = perToolAlwaysLoad || opts.alwaysLoad === true ? true : opts.alwaysLoad;
@@ -1017,9 +1019,23 @@ function buildMcpToolDescriptor(server, tool, opts) {
     ...alwaysLoadResolved !== undefined ? { alwaysLoad: alwaysLoadResolved } : {},
     deferred: opts.deferredDefault,
     ...tool._meta !== undefined ? { _meta: tool._meta } : {},
-    ...requiresInteraction ? { interaction: "required" } : {}
+    ...requiresInteraction ? { interaction: "required" } : {},
+    ...plainName !== undefined ? { mcpName: mcpSpelling } : {}
   };
 }
+var TOOL_SEARCH_TOOL_NAME = "ToolSearch";
+var PLAIN_TOOL_NAME = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+function mcpSpellingOf(name) {
+  return registry.get(name)?.descriptor.mcpName;
+}
+function registeredNameForMcpSpelling(name) {
+  if (registry.has(name))
+    return name;
+  for (const [registered, entry] of registry)
+    if (entry.descriptor.mcpName === name)
+      return registered;
+  return name;
+}
 var RESERVED_MCP_SERVER_NAMES = new Set([WINTER_BRAND.mcpServerName]);
 var STANDING_REBRANDS = new Map;
 function rebrandStandingServerTools(renames, serverName) {
@@ -1101,13 +1117,36 @@ function registerMcpServerTools(server, incomingTools, opts) {
     throw new Error(`registerMcpServerTools: "${server}" is a RESERVED server name -- the standing Winter server ` + `(its name is defined in mcp/winter-server.ts) owns this identity and is registry-native; it is never installed through ` + `this live-mutation function, and nothing else may register live tools under it either.`);
   }
   const tools = dedupeSameBatch(server, incomingTools);
-  const newNames = new Set(tools.map((t) => `mcp__${server}__${t.name}`));
+  const plainNameFor = (tool) => opts.toolNames !== undefined && Object.hasOwn(opts.toolNames, tool.name) ? opts.toolNames[tool.name] : undefined;
+  const registeredName = (tool) => plainNameFor(tool) ?? `mcp__${server}__${tool.name}`;
+  const newNames = new Set(tools.map(registeredName));
   const previouslyOwned = mcpServerOwnedNames.get(server);
   if (tools.length === 0 && (previouslyOwned === undefined || previouslyOwned.size === 0))
     return;
+  const plainNamesSeen = new Set;
   for (const tool of tools) {
-    const canonicalName = `mcp__${server}__${tool.name}`;
+    const plain = plainNameFor(tool);
+    if (plain !== undefined) {
+      if (typeof plain !== "string" || !PLAIN_TOOL_NAME.test(plain) || plain.startsWith("mcp__")) {
+        throw new Error(`registerMcpServerTools: server "${server}" names its tool "${tool.name}" ${JSON.stringify(plain)} -- a plain tool name must match ${String(PLAIN_TOOL_NAME)} and must not start with "mcp__"`);
+      }
+      if (plainNamesSeen.has(plain)) {
+        throw new Error(`registerMcpServerTools: server "${server}" gives two of its tools the same plain name "${plain}"`);
+      }
+      plainNamesSeen.add(plain);
+    }
+    const canonicalName = registeredName(tool);
     const existingOwner = mcpToolOwner.get(canonicalName);
+    const spelling = plain !== undefined ? `mcp__${server}__${tool.name}` : undefined;
+    for (const [name, entry] of registry) {
+      const foreign = mcpToolOwner.get(name) !== server;
+      if (foreign && entry.descriptor.mcpName !== undefined && (entry.descriptor.mcpName === canonicalName || entry.descriptor.mcpName === spelling)) {
+        throw new Error(`registerMcpServerTools: "${canonicalName}" collides with the old spelling "${entry.descriptor.mcpName}" that "${name}" keeps -- refusing to register a second tool under it`);
+      }
+      if (foreign && spelling !== undefined && name === spelling) {
+        throw new Error(`registerMcpServerTools: the old spelling "${spelling}" of server "${server}"'s renamed tool "${plain}" is already a registered tool -- refusing to register a second tool under it`);
+      }
+    }
     if (registry.has(canonicalName) && existingOwner === undefined) {
       throw new Error(`registerMcpServerTools: "${canonicalName}" is already registered by a non-live-MCP mechanism ` + `(e.g. a static WS-06 descriptor stub, or the standing winter server's own advisor identity) -- ` + `refusing to overwrite it. If this name is meant to be a live-connected MCP tool, its static ` + `registration must be removed first.`);
     }
@@ -1125,9 +1164,9 @@ function registerMcpServerTools(server, incomingTools, opts) {
   }
   const nowOwned = new Set;
   for (const tool of tools) {
-    const canonicalName = `mcp__${server}__${tool.name}`;
+    const canonicalName = registeredName(tool);
     const existingEntry = registry.get(canonicalName);
-    const descriptor = buildMcpToolDescriptor(server, tool, opts);
+    const descriptor = buildMcpToolDescriptor(server, tool, opts, plainNameFor(tool));
     registry.set(canonicalName, existingEntry ? { ...existingEntry, descriptor } : { descriptor });
     mcpToolOwner.set(canonicalName, server);
     nowOwned.add(canonicalName);
@@ -1206,12 +1245,15 @@ function resolveDeferral(descriptor, mode, activation) {
   const modes = descriptor.availability.modes;
   if (modes !== undefined && !modes.includes(mode))
     return "hidden";
-  if (descriptor.source === "builtin")
+  if (descriptor.canonicalName === TOOL_SEARCH_TOOL_NAME)
     return "eager";
   if (descriptor.alwaysLoad === true)
     return "eager";
+  const hostDeferred = activation.deferTools?.includes(descriptor.canonicalName) === true;
+  if (descriptor.source === "builtin" && !hostDeferred)
+    return "eager";
   const declared = descriptor.deferred;
-  const eligible = declared === true ? true : Array.isArray(declared) ? declared.includes(mode) : false;
+  const eligible = hostDeferred || (declared === true ? true : Array.isArray(declared) ? declared.includes(mode) : false);
   if (!eligible)
     return "eager";
   return isDeferralActive(activation) ? "deferred" : "eager";
@@ -1250,6 +1292,8 @@ function isAvailable(descriptor, cfg) {
     return false;
   if (a.insideSubagent === false && cfg.insideSubagent === true)
     return false;
+  if (a.requiresAnyCapability !== undefined && !a.requiresAnyCapability.some((c) => cfg.capabilities?.includes(c) === true))
+    return false;
   if (!descriptor.capabilityRequirements.every((c) => cfg.capabilities?.includes(c) === true))
     return false;
   return true;
@@ -1276,8 +1320,17 @@ function isBareDenied(canonicalName, disallowedTools) {
   });
 }
 function buildAdvertisedSet(cfg) {
-  const requested = cfg.tools;
-  return listRegisteredTools().map((t) => t.descriptor).filter((d) => d.disposition !== "correctly-absent").filter((d) => d.exposure !== "hidden").filter((d) => requested === undefined || requested.includes(d.canonicalName)).filter((d) => isAvailable(d, cfg)).filter((d) => !isBareDenied(d.canonicalName, cfg.disallowedTools));
+  return listRegisteredTools().map((t) => t.descriptor).filter((d) => d.disposition !== "correctly-absent").filter((d) => d.exposure !== "hidden").filter((d) => isRequestedTool(d, cfg.tools)).filter((d) => isAvailable(d, cfg)).filter((d) => !isDescriptorBareDenied(d, cfg.disallowedTools));
+}
+function isRequestedTool(descriptor, tools) {
+  if (descriptor.source !== "builtin")
+    return true;
+  if (tools === undefined)
+    return descriptor.availability.optIn !== true;
+  return tools.includes(descriptor.canonicalName);
+}
+function isDescriptorBareDenied(descriptor, disallowedTools) {
+  return isBareDenied(descriptor.canonicalName, disallowedTools) || descriptor.mcpName !== undefined && isBareDenied(descriptor.mcpName, disallowedTools);
 }
 function unknownToolResult(name) {
   return { output: `Error: unknown tool "${name}" -- no descriptor is registered under that name`, isError: true };
@@ -1295,7 +1348,12 @@ function notYetExecutableResult(name) {
   };
 }
 function foldResult(result) {
-  return { output: result.output, ...result.blocks !== undefined ? { blocks: result.blocks } : {}, ...result.isError === true ? { isError: true } : {} };
+  return {
+    output: result.output,
+    ...result.blocks !== undefined ? { blocks: result.blocks } : {},
+    ...result.isError === true ? { isError: true } : {},
+    ...result.siteIcons !== undefined && result.siteIcons.length > 0 ? { siteIcons: result.siteIcons } : {}
+  };
 }
 function unavailableResult(name) {
   return {
@@ -2462,6 +2520,8 @@ function renderPlanModeBlock(input) {
 }
 
 // src/context/attachments.ts
+var DEFERRED_TOOLS_ADDED_HEADER = "The following deferred tools are now available via ToolSearch:";
+var DEFERRED_TOOLS_REMOVED_HEADER = "The following deferred tools are no longer available (their MCP server disconnected). Do not search for them — ToolSearch will return no match:";
 var AGENT_LISTING_INITIAL_HEADER = "Available agent types for the Agent tool:";
 var AGENT_LISTING_ADDED_HEADER = "New agent types are now available for the Agent tool:";
 var AGENT_LISTING_REMOVED_HEADER = "The following agent types are no longer available:";
@@ -2511,6 +2571,44 @@ ${removedTypes.map((t) => `- ${t}`).join(`
 
 `));
 });
+registerAttachmentRenderer("deferred_tools_delta", (a) => {
+  const addedLines = stringArray(a["addedLines"]);
+  const removedNames = stringArray(a["removedNames"]);
+  const parts = [];
+  if (addedLines.length > 0)
+    parts.push(`${DEFERRED_TOOLS_ADDED_HEADER}
+${addedLines.join(`
+`)}`);
+  if (removedNames.length > 0)
+    parts.push(`${DEFERRED_TOOLS_REMOVED_HEADER}
+${removedNames.join(`
+`)}`);
+  return parts.length === 0 ? undefined : neutralizeReminderTags(parts.join(`
+
+`));
+});
+function announcedDeferredTools(messages) {
+  const announced = new Set;
+  for (const a of attachmentsIn(messages)) {
+    if (a.type !== "deferred_tools_delta")
+      continue;
+    if (Array.isArray(a["addedLines"]))
+      for (const name of stringArray(a["addedNames"]))
+        announced.add(name);
+    for (const name of stringArray(a["removedNames"]))
+      announced.delete(name);
+  }
+  return announced;
+}
+function computeDeferredToolsDelta(deferred, offered, history) {
+  const announced = announcedDeferredTools(history);
+  const offeredNow = new Set([...offered, ...deferred]);
+  const added = [...new Set(deferred)].filter((name) => !announced.has(name)).sort();
+  const removed = [...announced].filter((name) => !offeredNow.has(name)).sort();
+  if (added.length === 0 && removed.length === 0)
+    return;
+  return { type: "deferred_tools_delta", addedNames: added, addedLines: added, removedNames: removed };
+}
 registerAttachmentRenderer("skill_listing", (a) => {
   const content = typeof a["content"] === "string" ? a["content"] : "";
   if (content.length === 0)
@@ -6470,6 +6568,7 @@ ${body}
 // src/mcp/control.ts
 var REPLACE_ELIGIBLE_ORIGINS = new Set(["explicit", "dynamic"]);
 function createMcpControlSeam(internals, opts = {}) {
+  const hostReserved = new Set(opts.hostReservedServerNames ?? []);
   const reservedServerName = opts.reservedServerName ?? WINTER_SERVER_NAME;
   return {
     async reconnect(serverName) {
@@ -6498,6 +6597,10 @@ function createMcpControlSeam(internals, opts = {}) {
           errors[name] = `"${reservedServerName}" is a reserved server identity (RULING P4-B, the standing Winter server) -- no source may configure a live MCP server under this name`;
           continue;
         }
+        if (hostReserved.has(name) && raw?.type !== "sdk") {
+          errors[name] = `"${name}" is a server name this session's host reserves for its own in-process server -- only an in-process (type "sdk") server may be configured under it`;
+          continue;
+        }
         const result = validateServerConfig(raw);
         if (!result.ok) {
           errors[name] = result.reason;
@@ -6573,6 +6676,7 @@ function validateServerConfig(raw) {
 }
 function resolveMcpServerSources(sources, opts) {
   const reservedServerName = opts.reservedServerName ?? WINTER_SERVER_NAME;
+  const hostReserved = new Set(opts.hostReservedServerNames ?? []);
   const resolved = [];
   const shadowed = [];
   const rejected = [];
@@ -6597,6 +6701,10 @@ function resolveMcpServerSources(sources, opts) {
           rejected.push({ name, origin, code: "reserved_name", reason: `"${reservedServerName}" is a reserved server identity (RULING P4-B, the standing Winter server) -- no source may configure a live MCP server under this name` });
           continue;
         }
+        if (hostReserved.has(name) && (origin !== "explicit" || raw?.type !== "sdk")) {
+          rejected.push({ name, origin, code: "reserved_name", reason: `"${name}" is a server name this session's host reserves for its own in-process server -- no ${origin} source may configure a server under this name` });
+          continue;
+        }
         const validated = validateServerConfig(raw);
         if (!validated.ok) {
           rejected.push({ name, origin, code: "invalid_config", reason: validated.reason });
@@ -7168,7 +7276,7 @@ function createMcpLifecycle(deps) {
   };
   return {
     stateSource,
-    controlSeam: createMcpControlSeam(internals, { ...deps.reservedServerName !== undefined ? { reservedServerName: deps.reservedServerName } : {} }),
+    controlSeam: createMcpControlSeam(internals, { ...deps.reservedServerName !== undefined ? { reservedServerName: deps.reservedServerName } : {}, ...deps.hostReservedServerNames !== undefined ? { hostReservedServerNames: deps.hostReservedServerNames } : {} }),
     start,
     launch,
     dispose,
@@ -11012,13 +11120,15 @@ function capHookText(text, limit = MAX_HOOK_TEXT_CHARS) {
 
 // src/hooks/runner.ts
 function mcpToolProvenance(toolName) {
-  const server = mcpServerOwningTool(toolName);
+  const registered = registeredNameForMcpSpelling(toolName);
+  const server = mcpServerOwningTool(registered);
   if (server === undefined)
     return;
+  const spelled = mcpSpellingOf(registered) ?? registered;
   const prefix = `mcp__${server}__`;
-  if (!toolName.startsWith(prefix) || toolName.length === prefix.length)
+  if (!spelled.startsWith(prefix) || spelled.length === prefix.length)
     return;
-  return { server, tool: toolName.slice(prefix.length) };
+  return { server, tool: spelled.slice(prefix.length) };
 }
 function mcpServerIdentity(toolName, renames) {
   const name = mcpServerOwningTool(toolName);
@@ -14739,6 +14849,26 @@ stub({
   disposition: "implement-now"
 });
 
+// src/tools/descriptors/search.ts
+var SEARCH_CANONICAL_NAME = "Search";
+var SEARCH_ANSWER_CAPABILITY = "winter.search-answer";
+var SEARCH_DESCRIPTION = "Search the web and get back a written answer with its sources, in a single call. Ask a real question, not keywords — a search engine answers it and the answer comes back already synthesized, followed by the pages it came from. Use it freely whenever a fact might be newer than you are, or when the user asks about something current, and cite the URLs you used.";
+var descriptor = {
+  canonicalName: SEARCH_CANONICAL_NAME,
+  advertisedName: SEARCH_CANONICAL_NAME,
+  source: "builtin",
+  inputSchema: { type: "object", properties: { query: { type: "string", minLength: 1, description: "The question to answer" } }, required: ["query"] },
+  description: SEARCH_DESCRIPTION,
+  searchHint: "answer a question from the web with sources",
+  annotations: { readOnlyHint: true, openWorldHint: true },
+  exposure: "eager",
+  permissionClass: "network",
+  availability: { optIn: true },
+  capabilityRequirements: [SEARCH_ANSWER_CAPABILITY],
+  disposition: "implement-now"
+};
+stub(descriptor);
+
 // src/tools/descriptors/tool-search.ts
 stub({
   canonicalName: "ToolSearch",
@@ -14752,11 +14882,13 @@ stub({
     },
     required: ["query"]
   },
-  description: "Fetches full schema definitions for deferred tools so they can be called.",
+  description: `Fetches full schema definitions for deferred tools so they can be called.
+
+` + "Deferred tools appear by name in <system-reminder> messages. Until fetched, only the name is known — there is no parameter schema, so the tool cannot be invoked. " + 'Query forms: "select:Read,Edit,Grep" fetches these exact tools by name; "notebook jupyter" is a keyword search over the deferred tools.',
   exposure: "eager",
   permissionClass: "read",
-  availability: { requiresToolSearchEnabled: true },
-  capabilityRequirements: ["winter.mcp"],
+  availability: { requiresToolSearchEnabled: true, requiresAnyCapability: ["winter.mcp", DEFERRED_BUILTINS_CAPABILITY] },
+  capabilityRequirements: [],
   disposition: "implement-now"
 });
 
@@ -14993,7 +15125,7 @@ var WEB_SEARCH_INPUT_SCHEMA_FIRST_PARTY = {
 function webSearchInputSchemaFor(firstPartyAnthropic) {
   return firstPartyAnthropic ? WEB_SEARCH_INPUT_SCHEMA_FIRST_PARTY : WEB_SEARCH_INPUT_SCHEMA_PORTABLE;
 }
-var descriptor = {
+var descriptor2 = {
   canonicalName: WEB_SEARCH_CANONICAL_NAME,
   advertisedName: WEB_SEARCH_CANONICAL_NAME,
   source: "builtin",
@@ -15007,14 +15139,14 @@ var descriptor = {
   capabilityRequirements: ["winter.search-backend"],
   disposition: "implement-now"
 };
-Object.defineProperty(descriptor, "description", {
+Object.defineProperty(descriptor2, "description", {
   enumerable: true,
   configurable: true,
   get() {
     return webSearchDescription(false);
   }
 });
-stub(descriptor);
+stub(descriptor2);
 
 // src/tools/descriptors/winter-list-agents.ts
 import { WINTER_BRAND as WINTER_BRAND13, mcpToolName } from "@yanlinglabs/winter-agent-sdk";
@@ -19083,6 +19215,7 @@ function computeExposurePartition(query) {
     ...query.platform !== undefined ? { platform: query.platform } : {},
     ...query.capabilities !== undefined ? { capabilities: query.capabilities } : {},
     ...query.disallowedTools !== undefined ? { disallowedTools: query.disallowedTools } : {},
+    ...query.tools !== undefined ? { tools: query.tools } : {},
     ...query.insideSubagent !== undefined ? { insideSubagent: query.insideSubagent } : {},
     ...query.familyMetadata !== undefined ? { familyMetadata: query.familyMetadata } : {}
   };
@@ -19142,6 +19275,7 @@ function exposureQuery(deps) {
     ...deps.platform !== undefined ? { platform: deps.platform } : {},
     ...deps.capabilities !== undefined ? { capabilities: deps.capabilities } : {},
     ...deps.disallowedTools !== undefined ? { disallowedTools: deps.disallowedTools } : {},
+    ...deps.tools !== undefined ? { tools: deps.tools } : {},
     ...deps.insideSubagent !== undefined ? { insideSubagent: deps.insideSubagent } : {},
     ...deps.familyMetadata !== undefined ? { familyMetadata: deps.familyMetadata } : {},
     ...deps.toolAliases !== undefined ? { toolAliases: deps.toolAliases } : {},
@@ -19175,7 +19309,9 @@ async function executeToolSearch(input, deps) {
   const query = rec.query;
   const maxResults = typeof rec.max_results === "number" && Number.isFinite(rec.max_results) && rec.max_results > 0 ? Math.floor(rec.max_results) : DEFAULT_MAX_RESULTS;
   const pendingWaitMs = deps.pendingWaitMs ?? DEFAULT_PENDING_WAIT_MS;
-  const selectNames = parseSelect(query);
+  const resolveName = deps.resolveName ?? registeredNameForMcpSpelling;
+  const parsedSelect = parseSelect(query);
+  const selectNames = parsedSelect === undefined ? undefined : [...new Set(parsedSelect.map(resolveName))];
   let attempt = runAttempt(query, selectNames, maxResults, deps);
   const incomplete = selectNames !== undefined ? attempt.matches.length < selectNames.length : attempt.matches.length === 0;
   if (incomplete && deps.stateSource !== undefined) {
@@ -19215,7 +19351,7 @@ function getToolSearchSessionRuntime(sessionId) {
 }
 
 // src/tools/impl/tool-search.ts
-var TOOL_SEARCH_TOOL_NAME = "ToolSearch";
+var TOOL_SEARCH_TOOL_NAME2 = "ToolSearch";
 function notWiredResult() {
   return {
     output: "Error: ToolSearch has no session runtime registered for this session (WS-09 §8) -- engine.ts must call registerToolSearchSessionRuntime(sessionId, ...) once per run (toolsearch/search.ts); this is a host wiring gap, not a model input error.",
@@ -19233,7 +19369,7 @@ var toolSearchExecutor = {
     return { output: JSON.stringify(outcome.result) };
   }
 };
-replaceExecutor(TOOL_SEARCH_TOOL_NAME, toolSearchExecutor);
+replaceExecutor(TOOL_SEARCH_TOOL_NAME2, toolSearchExecutor);
 
 // src/tools/impl/wait-for-mcp-servers.ts
 var WAIT_FOR_MCP_SERVERS_TOOL_NAME = "WaitForMcpServers";
@@ -19845,6 +19981,9 @@ function inheritedWebSessionFacts(sessionId) {
 function searchBackendUsable(runtime) {
   return runtime.web.search.enabled;
 }
+function searchAnswerUsable(runtime) {
+  return runtime.web.search.enabled && runtime.web.search.authRef !== undefined && runtime.resolveToolSecret !== undefined;
+}
 function digestModelResolves(runtime) {
   const tag = runtime.web.fetch.digestModel;
   if (tag === undefined)
@@ -20937,6 +21076,85 @@ async function runInnerModel(ctx, request, runtime) {
   }
 }
 
+// src/tools/impl/_site-icons.ts
+var SITE_ICONS_MAX = 10;
+var SITE_ICON_URL_MAX_LENGTH = 2048;
+var ICON_SCAN_CHARS = 256 * 1024;
+function siteIconHttpsUrl(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > SITE_ICON_URL_MAX_LENGTH)
+    return;
+  let parsed;
+  try {
+    parsed = new URL(value.trim());
+  } catch {
+    return;
+  }
+  if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "" || !isPublicName(parsed.hostname))
+    return;
+  const href = parsed.href;
+  return href.length <= SITE_ICON_URL_MAX_LENGTH && /^https:\/\/[!-~]+$/.test(href) ? href : undefined;
+}
+var PRIVATE_NAME_SUFFIX = /\.(?:localhost|local|internal|lan|home|home\.arpa|corp|intranet|private)$/;
+function isPublicName(hostname) {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  if (host.length === 0 || host.length > 253 || host.startsWith("[") || !host.includes("."))
+    return false;
+  if (host === "localhost" || PRIVATE_NAME_SUFFIX.test(host))
+    return false;
+  const labels = host.split(".");
+  return /[a-z]/.test(labels[labels.length - 1]) && labels.every((l) => l.length > 0 && l.length <= 63);
+}
+function collectSiteIcons(entries) {
+  const out = [];
+  const seen = new Set;
+  for (const e of entries) {
+    if (out.length >= SITE_ICONS_MAX)
+      break;
+    const url = siteIconHttpsUrl(e.url);
+    const iconUrl = siteIconHttpsUrl(e.iconUrl);
+    if (url === undefined || iconUrl === undefined || seen.has(url))
+      continue;
+    seen.add(url);
+    out.push({ url, iconUrl });
+  }
+  return out.length > 0 ? out : undefined;
+}
+var LINK_TAG = /<link\b[^>]*>/gi;
+var ATTRIBUTE = /([A-Za-z][\w:-]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+))/g;
+function pageIconUrl(html, pageUrl) {
+  const page = siteIconHttpsUrl(pageUrl);
+  if (page === undefined)
+    return;
+  const head = html.length > ICON_SCAN_CHARS ? html.slice(0, ICON_SCAN_CHARS) : html;
+  let best;
+  for (const tag of head.matchAll(LINK_TAG)) {
+    const attrs = {};
+    for (const m of tag[0].matchAll(ATTRIBUTE))
+      attrs[m[1].toLowerCase()] = m[2] ?? m[3] ?? m[4] ?? "";
+    const rel = (attrs["rel"] ?? "").toLowerCase().split(/\s+/).filter((t) => t.length > 0);
+    const href = decodeHtmlEntities(attrs["href"] ?? "").trim();
+    const lowered = href.toLowerCase();
+    if (href.length === 0 || rel.includes("mask-icon") || lowered.startsWith("data:") || /\.svg(?:[?#]|$)/.test(lowered))
+      continue;
+    const rank = rel.includes("apple-touch-icon") || rel.includes("apple-touch-icon-precomposed") ? 3 : rel.includes("icon") ? 2 : 0;
+    if (rank === 0)
+      continue;
+    if (best === undefined || rank > best.rank) {
+      const resolved = resolveIcon(href, page);
+      if (resolved !== undefined)
+        best = { rank, href: resolved };
+    }
+  }
+  return best?.href ?? siteIconHttpsUrl(new URL("/favicon.ico", page).href);
+}
+function resolveIcon(href, page) {
+  try {
+    return siteIconHttpsUrl(new URL(href, page).href);
+  } catch {
+    return;
+  }
+}
+
 // src/tools/impl/web-fetch.ts
 var DIGEST_CONTENT_CAP = 1e5;
 var RESULT_CAP = 50000;
@@ -20993,6 +21211,10 @@ async function raceAgainstAbort(promise, signal) {
     });
   });
 }
+function siteIconsFor(pageUrl, iconUrl) {
+  const siteIcons = iconUrl !== undefined ? collectSiteIcons([{ url: pageUrl, iconUrl }]) : undefined;
+  return siteIcons !== undefined ? { siteIcons } : {};
+}
 function capResult(text) {
   if (text.length <= RESULT_CAP)
     return text;
@@ -21156,11 +21378,15 @@ function createWebFetchExecutor(deps = {}) {
     const preapproved = isPreapprovedUrl(originalUrl);
     let content;
     let contentType;
+    let pageUrl;
+    let iconUrl;
+    let addressPublic;
     const cached = cache.get(ctx.sessionId, inputUrlString);
     if (cached !== undefined) {
       const addressVerdict = await raceAgainstAbort(classifyHostname(stripIpv6Brackets(originalUrl.hostname), resolveHost), ctx.signal);
       if (addressVerdict === "aborted")
         return { output: "WebFetch was interrupted.", isError: true };
+      addressPublic = addressVerdict.class !== "private";
       if (addressVerdict.class === "private") {
         const refusal = privateAddressRefusal(originalUrl.hostname, policy, addressVerdict.reason);
         if (refusal !== undefined)
@@ -21173,6 +21399,7 @@ function createWebFetchExecutor(deps = {}) {
         const finalVerdict = await raceAgainstAbort(classifyHostname(stripIpv6Brackets(cachedHost), resolveHost), ctx.signal);
         if (finalVerdict === "aborted")
           return { output: "WebFetch was interrupted.", isError: true };
+        addressPublic &&= finalVerdict.class !== "private";
         if (finalVerdict.class === "private") {
           const refusal = privateAddressRefusal(cachedHost, policy, finalVerdict.reason);
           if (refusal !== undefined)
@@ -21181,6 +21408,8 @@ function createWebFetchExecutor(deps = {}) {
       }
       content = cached.content;
       contentType = cached.contentType;
+      pageUrl = cached.finalUrl;
+      iconUrl = cached.iconUrl;
     } else {
       const outcome = await performWebFetch(inputUrlString, prompt, { blockedDomains, privateAddressPolicy: policy, userAgent: winterUserAgent(), ...ctx.signal !== undefined ? { signal: ctx.signal } : {} }, netDeps);
       switch (outcome.kind) {
@@ -21226,9 +21455,12 @@ The response body was not retrieved. If this URL requires authentication, use an
       }
       const kind = classifyContentType(outcome.contentType);
       if (kind === "html") {
-        content = await convertFetchedHtml(new TextDecoder("utf-8", { fatal: false }).decode(outcome.body));
+        const html = new TextDecoder("utf-8", { fatal: false }).decode(outcome.body);
+        iconUrl = pageIconUrl(html, outcome.finalUrl);
+        content = await convertFetchedHtml(html);
       } else if (kind === "text") {
         content = new TextDecoder("utf-8", { fatal: false }).decode(outcome.body);
+        iconUrl = pageIconUrl("", outcome.finalUrl);
       } else {
         const savedPath = await saveBinaryToTemp(ctx, originalUrl, outcome.body);
         const sizeLabel = `${outcome.body.byteLength.toLocaleString("en-US")} bytes`;
@@ -21236,14 +21468,18 @@ The response body was not retrieved. If this URL requires authentication, use an
         return { output: note };
       }
       contentType = outcome.contentType;
-      const entry = { bytes: Buffer.byteLength(content, "utf8"), code: outcome.status, codeText: outcome.statusText, content, contentType, finalUrl: outcome.finalUrl };
+      pageUrl = outcome.finalUrl;
+      addressPublic = policy !== "allow";
+      const entry = { bytes: Buffer.byteLength(content, "utf8"), code: outcome.status, codeText: outcome.statusText, content, contentType, finalUrl: outcome.finalUrl, ...iconUrl !== undefined ? { iconUrl } : {} };
       cache.set(ctx.sessionId, inputUrlString, entry);
     }
+    if (!addressPublic)
+      iconUrl = undefined;
     if (preapproved && contentType.toLowerCase().includes("text/markdown") && content.length < 1e5) {
-      return { output: capResult(content) };
+      return { output: capResult(content), ...siteIconsFor(pageUrl, iconUrl) };
     }
     const digest = await runDigest(ctx, runtime, content, prompt, preapproved);
-    return { output: capResult(digest.output), ...digest.isError ? { isError: true } : {} };
+    return { output: capResult(digest.output), ...digest.isError ? { isError: true } : siteIconsFor(pageUrl, iconUrl) };
   }
   return {
     async execute(rawInput, ctx) {
@@ -21387,7 +21623,8 @@ function hitFromRecord(record) {
   const title = capText(typeof record["title"] === "string" && record["title"].trim().length > 0 ? record["title"].trim() : url, EXA_TITLE_MAX_CHARACTERS);
   const highlight = highlightFrom(record["highlights"]) || highlightFrom(record["summary"]) || highlightFrom(record["text"]);
   const published = typeof record["publishedDate"] === "string" && record["publishedDate"].length > 0 ? record["publishedDate"] : undefined;
-  return { title, url, highlight: capText(highlight.trim(), EXA_HIGHLIGHTS_MAX_CHARACTERS), ...published !== undefined ? { publishedDate: published } : {} };
+  const favicon = siteIconHttpsUrl(record["favicon"]);
+  return { title, url, highlight: capText(highlight.trim(), EXA_HIGHLIGHTS_MAX_CHARACTERS), ...published !== undefined ? { publishedDate: published } : {}, ...favicon !== undefined ? { favicon } : {} };
 }
 var FIELD_LINE = /^(Title|URL|Published(?: Date)?|Author|Highlights|Text|Summary|Content):[ \t]*(.*)$/i;
 function hitsFromPlainText(text) {
@@ -21946,6 +22183,7 @@ function createWebSearchExecutor(deps = {}) {
       return { output: `Error: web search failed unexpectedly (${err instanceof Error ? err.name : "unknown error"}).`, isError: true };
     }
     const events = [];
+    const iconEntries = [];
     let successfulSearches = 0;
     let attemptedSearches = 0;
     let lastFailureMessage;
@@ -21970,6 +22208,9 @@ function createWebSearchExecutor(deps = {}) {
       }
       successfulSearches += 1;
       events.push({ type: "search_result", hits: outcome.hits.map((h) => ({ title: h.title, url: h.url })) });
+      for (const h of outcome.hits)
+        if (h.favicon !== undefined)
+          iconEntries.push({ url: h.url, iconUrl: h.favicon });
     }
     if (pass !== undefined && !pass.ok) {
       events.push({ type: "text", text: `
@@ -21981,12 +22222,150 @@ ${innerFailureText(pass)}` });
 
 ${lastFailureMessage}` });
     }
-    return { output: assembleWebSearchOutputCapped(query, events, resultCap) };
+    const siteIcons = collectSiteIcons(iconEntries);
+    return { output: assembleWebSearchOutputCapped(query, events, resultCap), ...siteIcons !== undefined ? { siteIcons } : {} };
   }
   return { execute };
 }
 replaceExecutor(WEB_SEARCH_CANONICAL_NAME, createWebSearchExecutor());
 
+// src/tools/impl/search.ts
+var SEARCH_REQUEST_TIMEOUT_MS = 45000;
+var SEARCH_ANSWER_CHARS = 24000;
+var SEARCH_MAX_CITATIONS = 20;
+var SEARCH_TOTAL_OUTPUT_CHARS = 30000;
+var EXA_ANSWER_URL = "https://api.exa.ai/answer";
+function isValidCitations(value) {
+  if (value === undefined)
+    return true;
+  if (!Array.isArray(value))
+    return false;
+  return value.every((item) => item !== null && typeof item === "object");
+}
+function searchStatusMessage(status) {
+  switch (status) {
+    case 401:
+    case 403:
+      return "search failed: the configured Exa API key was rejected — it needs to be replaced before Search can work";
+    case 402:
+      return "search failed: this Exa account is out of credits or over its budget — top it up at exa.ai, or answer from what you already know and say the search was unavailable";
+    case 429:
+      return "search failed: the search service is rate-limiting this key — wait a little before searching again, and do not retry in a loop";
+    case 400:
+      return "search failed: the search service rejected the request as malformed — try a plainer question";
+    default:
+      return `search failed: the search service is unavailable (HTTP ${status})`;
+  }
+}
+var SEARCH_NO_KEY_MESSAGE = "Search needs an Exa API key (from exa.ai), and none is configured for this session";
+function errorResult6(output) {
+  return { output, isError: true };
+}
+function createSearchExecutor(deps = {}) {
+  const endpoint = deps.endpoint ?? EXA_ANSWER_URL;
+  const timeoutMs = deps.timeoutMs ?? SEARCH_REQUEST_TIMEOUT_MS;
+  async function execute(rawInput, ctx) {
+    const record = typeof rawInput === "object" && rawInput !== null ? rawInput : {};
+    const query = typeof record["query"] === "string" ? record["query"] : "";
+    if (query.trim().length === 0)
+      return errorResult6("Error: Missing query");
+    const runtime = webSessionRuntimeFor(ctx);
+    if (runtime === undefined)
+      return errorResult6("Error: Search is not available for this session (no search runtime is wired up for it -- a host wiring gap, not an input error).");
+    if (!runtime.web.search.enabled)
+      return { output: "Web search is turned off for this session." };
+    const resolveKey = exaKeyResolverFor(runtime);
+    if (resolveKey === undefined)
+      return errorResult6(SEARCH_NO_KEY_MESSAGE);
+    let key;
+    try {
+      const secret = await resolveKey();
+      if (secret.status === "missing")
+        return errorResult6(SEARCH_NO_KEY_MESSAGE);
+      if (secret.status === "unreadable")
+        return errorResult6(`search failed: an Exa API key is configured but could not be used: ${secret.message}`);
+      key = secret.key;
+    } catch (err) {
+      return errorResult6(`search failed: the key resolver failed with ${err instanceof Error ? err.name : "an unknown error"}`);
+    }
+    if (key.length === 0)
+      return errorResult6(SEARCH_NO_KEY_MESSAGE);
+    const fetchFn = deps.fetchFn ?? fetch;
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    const signal = ctx.signal !== undefined ? AbortSignal.any([ctx.signal, timeoutSignal]) : timeoutSignal;
+    let res;
+    try {
+      res = await fetchFn(endpoint, {
+        method: "POST",
+        headers: { "x-api-key": key, "content-type": "application/json" },
+        body: JSON.stringify({ query }),
+        redirect: "manual",
+        signal
+      });
+    } catch (err) {
+      const name = err instanceof Error ? err.name : "";
+      if (name === "AbortError" || name === "TimeoutError") {
+        return errorResult6(ctx.signal?.aborted === true ? "Search was interrupted." : `search timed out for ${query}`);
+      }
+      const rawMessage = err instanceof Error ? err.message : String(err);
+      console.error(`Search: network error (${name || "Error"}) — ${rawMessage.replaceAll(key, "<redacted>")}`);
+      return errorResult6("search failed: could not reach the search service");
+    }
+    if (res.status !== 200) {
+      try {
+        await res.body?.cancel();
+      } catch {}
+      return errorResult6(searchStatusMessage(res.status));
+    }
+    let data;
+    try {
+      data = await res.json();
+    } catch (err) {
+      return errorResult6(`search failed: could not parse response (${err instanceof Error ? err.message : String(err)})`);
+    }
+    if (data === null || typeof data !== "object" || !isValidCitations(data.citations))
+      return errorResult6("search failed: malformed response from search service");
+    if (data.answer !== undefined && typeof data.answer !== "string")
+      return errorResult6("search failed: malformed response from search service");
+    const fullAnswer = (data.answer ?? "").trim();
+    const answer = fullAnswer.length > SEARCH_ANSWER_CHARS ? fullAnswer.slice(0, SEARCH_ANSWER_CHARS) + `
+
+[answer truncated]` : fullAnswer;
+    const hostFloor = Array.isArray(record["blocked_domains"]) ? record["blocked_domains"].filter((d) => typeof d === "string" && d.trim().length > 0).slice(0, 1000) : [];
+    const floor = hostFloor.length > 0 ? [...runtime.web.blockedDomains, ...hostFloor] : runtime.web.blockedDomains;
+    const rawCitations = (data.citations ?? []).slice(0, SEARCH_MAX_CITATIONS);
+    let withheld = 0;
+    const citations = rawCitations.filter((c) => {
+      if (typeof c.url !== "string" || c.url.length === 0 || !isDomainBlocked(c.url, floor))
+        return true;
+      withheld++;
+      return false;
+    });
+    const withheldNote = withheld > 0 ? `
+
+[${withheld} source${withheld === 1 ? "" : "s"} withheld — matched the dangerous-domain list]` : "";
+    const siteIcons = collectSiteIcons(citations.map((c) => ({ url: c.url, iconUrl: c.favicon })));
+    const withIcons = (output) => ({ output, ...siteIcons !== undefined ? { siteIcons } : {} });
+    if (answer === "")
+      return withIcons(`no answer for ${query}${withheldNote}`);
+    const sources = citations.length === 0 ? `
+
+[unsourced — ${withheld > 0 ? "every source was withheld by the dangerous-domain list" : "the search service returned no sources"}; say so if you repeat this]` : `
+
+Sources:
+` + citations.map((c, i) => `${i + 1}. ${(typeof c.title === "string" ? c.title.trim() : "") || "-"}
+   ${typeof c.url === "string" && c.url.length > 0 ? c.url : "-"}`).join(`
+`);
+    const rendered = answer + sources;
+    const capped = rendered.length > SEARCH_TOTAL_OUTPUT_CHARS ? rendered.slice(0, SEARCH_TOTAL_OUTPUT_CHARS) + `
+
+[truncated]` : rendered;
+    return withIcons(capped + withheldNote);
+  }
+  return { execute };
+}
+replaceExecutor(SEARCH_CANONICAL_NAME, createSearchExecutor());
+
 // src/tools/read-state.ts
 import { isAbsolute as isAbsolute6, join as join24, normalize as normalize3 } from "node:path";
 function createSessionReadState(opts) {
@@ -22207,6 +22586,18 @@ function toolResultsForHost(content) {
   };
   return blank(content) ?? content;
 }
+function withHostSiteIcons(content, icons) {
+  if (icons.size === 0)
+    return content;
+  return content.map((block) => {
+    if (block.type !== "tool_result")
+      return block;
+    const forCall = icons.get(block.tool_use_id);
+    if (forCall === undefined || forCall.length === 0)
+      return block;
+    return { ...block, winter_site_icons: forCall.map((icon) => ({ url: icon.url, icon_url: icon.iconUrl })) };
+  });
+}
 function asRebuiltContent(content) {
   return content.length === 1 && content[0].type === "text" ? content[0].text : content;
 }
@@ -22349,11 +22740,48 @@ function toolOutputReplacement(value) {
     return capHookText(String(value), cap);
   }
 }
+function withLegacyToolNameRules(opts) {
+  const legacy = opts.config.legacyToolNames;
+  if (legacy === undefined || Object.keys(legacy).length === 0)
+    return opts;
+  const expand = (rules) => {
+    if (rules === undefined)
+      return;
+    const out = [...rules];
+    for (const raw of rules) {
+      const head = /^([^(]+)(.*)$/s.exec(raw.trim());
+      if (head === null)
+        continue;
+      const target = Object.hasOwn(legacy, head[1]) ? legacy[head[1]] : undefined;
+      if (typeof target === "string" && target.length > 0)
+        out.push(`${target}${head[2]}`);
+    }
+    return [...new Set(out)];
+  };
+  const config = opts.config;
+  const permissions = config.permissions;
+  return {
+    ...opts,
+    config: {
+      ...config,
+      ...config.allowedTools !== undefined ? { allowedTools: expand(config.allowedTools) } : {},
+      ...config.disallowedTools !== undefined ? { disallowedTools: expand(config.disallowedTools) } : {},
+      ...permissions !== undefined ? {
+        permissions: {
+          ...permissions,
+          ...permissions.allow !== undefined ? { allow: expand(permissions.allow) } : {},
+          ...permissions.ask !== undefined ? { ask: expand(permissions.ask) } : {},
+          ...permissions.deny !== undefined ? { deny: expand(permissions.deny) } : {}
+        }
+      } : {}
+    }
+  };
+}
 async function runEngine2(opts) {
   const facetDisposers = [];
   let sweepBackgroundShellTasksOnExit;
   try {
-    return await runEngineBody(opts, facetDisposers, (fn) => {
+    return await runEngineBody(withLegacyToolNameRules(opts), facetDisposers, (fn) => {
       sweepBackgroundShellTasksOnExit = fn;
     });
   } finally {
@@ -22434,6 +22862,16 @@ async function runEngineBody(opts, facetDisposers, registerBackgroundShellSweep)
     resolveToolSecret: resolveToolSecretRoute,
     onPricedGeneration
   } = opts;
+  const legacyToolNames = config.legacyToolNames ?? {};
+  const currentToolName = (name) => {
+    if (getRegisteredTool(name) !== undefined)
+      return name;
+    const legacy = Object.hasOwn(legacyToolNames, name) ? legacyToolNames[name] : undefined;
+    if (typeof legacy === "string" && getRegisteredTool(legacy) !== undefined)
+      return legacy;
+    return name.startsWith("mcp__") ? registeredNameForMcpSpelling(name) : name;
+  };
+  const legacyNameOf = (name) => Object.entries(legacyToolNames).find(([old, current]) => current === name && getRegisteredTool(old) === undefined)?.[0];
   registerBackgroundShellSweep(() => {
     const swept = stopSessionShellTasks({ sessionId: config.sessionId, ...config.agentId !== undefined ? { agentId: config.agentId } : {} });
     if (swept.length > 0) {
@@ -23148,7 +23586,7 @@ ${escapeAttributionText(msg.body)}
     });
     return {
       policy: policyResult,
-      tools: req.definition?.tools !== undefined && !req.definition.tools.includes("*") ? req.definition.tools.filter((name) => currentAdvertisedCanonicalNames.includes(name)) : [...currentAdvertisedCanonicalNames],
+      tools: req.definition?.tools !== undefined && !req.definition.tools.includes("*") ? [...new Set(req.definition.tools.map(currentToolName))].filter((name) => currentAdvertisedCanonicalNames.includes(name)) : [...currentAdvertisedCanonicalNames],
       ...childSlot,
       effort: req.definition?.effort !== undefined ? String(req.definition.effort) : "inherit",
       thinking: undefined,
@@ -23323,7 +23761,7 @@ ${escapeAttributionText(msg.body)}
             const denyEntry = findAgentDenyRule(evalCtx.policy.rules, agentType, denyOpts);
             if (denyEntry !== undefined)
               return agentTypeDeniedMessage(agentType, denyEntry);
-            if (isBuiltinAllToolsDenied(def, currentAdvertisedCanonicalNames)) {
+            if (isBuiltinAllToolsDenied({ ...def.tools !== undefined ? { tools: def.tools.map(currentToolName) } : {} }, currentAdvertisedCanonicalNames)) {
               return `Agent type '${agentType}' is unavailable because every tool it may use is denied by the current permission settings.`;
             }
             return;
@@ -23343,11 +23781,12 @@ ${escapeAttributionText(msg.body)}
         if (serverCfg.type !== "sdk" || !serverCfg.tools || serverCfg.tools.length === 0)
           continue;
         const toolDefs = serverCfg.tools;
-        registerMcpServerTools(serverName, toolDefs, { deferredDefault: true });
+        const toolNames = serverCfg.toolNames;
+        registerMcpServerTools(serverName, toolDefs, { deferredDefault: true, ...toolNames !== undefined ? { toolNames } : {} });
         sdkMcpServerNames.push(serverName);
         const perServerTimeoutMs = serverCfg.timeout;
         for (const tool of toolDefs) {
-          const canonicalName = `mcp__${serverName}__${tool.name}`;
+          const canonicalName = toolNames !== undefined && Object.hasOwn(toolNames, tool.name) ? toolNames[tool.name] : `mcp__${serverName}__${tool.name}`;
           replaceExecutor(canonicalName, {
             async execute(input) {
               const timeoutMs = perServerTimeoutMs ?? mcpEnvConfig.toolTimeoutMs ?? 120000;
@@ -23379,13 +23818,15 @@ ${escapeAttributionText(msg.body)}
     const resolvedSources = resolveMcpServerSources(sources, {
       ...config.strictMcpConfig !== undefined ? { strictMcpConfig: config.strictMcpConfig } : {},
       trustedWorkspace,
-      reservedServerName: sessionBrand.mcpServerName
+      reservedServerName: sessionBrand.mcpServerName,
+      ...config.reservedMcpServerNames !== undefined ? { hostReservedServerNames: config.reservedMcpServerNames } : {}
     });
     mcpLifecycle = createMcpLifecycle({
       servers: resolvedSources.resolved,
       envConfig: mcpEnvConfig,
       elicitationAsk: createElicitationAsker2(bridge),
       reservedServerName: sessionBrand.mcpServerName,
+      ...config.reservedMcpServerNames !== undefined ? { hostReservedServerNames: config.reservedMcpServerNames } : {},
       cwd: config.cwd,
       ...mcpOAuthStore !== undefined ? { oauth: createSessionMcpOAuth({ store: mcpOAuthStore, sender: bridge, brand: sessionBrand, ...config.hostCredentials === true ? { hostOwnsRefresh: true } : {} }) } : {}
     });
@@ -23395,11 +23836,13 @@ ${escapeAttributionText(msg.body)}
   const effectiveMcpStateSource = mcpServerStateSource ?? mcpLifecycle?.stateSource;
   const effectiveMcpControlSeam = mcpControlSeam ?? mcpLifecycle?.controlSeam;
   const sessionHasMcp = () => (effectiveMcpStateSource?.snapshot().length ?? 0) > 0;
-  const enableToolSearch = config.toolSearchEnabled === true ? "true" : config.toolSearchEnabled === false ? "false" : mcpEnvConfig.enableToolSearch;
+  const toolSearchExcludedByTools = config.tools !== undefined && !config.tools.includes(TOOL_SEARCH_TOOL_NAME);
+  const enableToolSearch = toolSearchExcludedByTools ? "false" : config.toolSearchEnabled === true ? "true" : config.toolSearchEnabled === false ? "false" : mcpEnvConfig.enableToolSearch;
   const deferralActivation = {
     enableToolSearch,
     providerSupportsToolSearch: providerSupportsToolSearch ?? true,
-    deferrableContextShare: deferrableContextShare ?? 0
+    deferrableContextShare: deferrableContextShare ?? 0,
+    ...config.deferTools !== undefined ? { deferTools: config.deferTools } : {}
   };
   const toolSearchEnabledDerived = isDeferralActive(deferralActivation);
   const enableFileCheckpointing = config.enableFileCheckpointing === true;
@@ -23432,7 +23875,7 @@ ${escapeAttributionText(msg.body)}
     return availableAgentNames(defs, {
       isDenied: (agentType) => findAgentDenyRule(evalCtx.policy.rules, agentType, denyOpts) !== undefined,
       ...config.allowedAgentTypes !== undefined ? { allowedAgentTypes: config.allowedAgentTypes } : {},
-      isAllToolsDenied: (def) => isBuiltinAllToolsDenied(def, currentAdvertisedCanonicalNames)
+      isAllToolsDenied: (def) => isBuiltinAllToolsDenied({ ...def.tools !== undefined ? { tools: def.tools.map(currentToolName) } : {} }, currentAdvertisedCanonicalNames)
     });
   }
   function sessionAvailableAgentDefinitions(at = {}) {
@@ -23503,11 +23946,14 @@ ${escapeAttributionText(msg.body)}
   facetDisposers.push(forgetSessionWebState);
   const WEB_DERIVED_CAPABILITIES = [
     { token: "winter.search-backend", probeTool: "WebSearch", fact: () => searchBackendUsable(webSessionRuntime) },
-    { token: "winter.fetch-extractor", probeTool: "WebFetch", fact: () => digestModelResolves(webSessionRuntime) }
+    { token: "winter.fetch-extractor", probeTool: "WebFetch", fact: () => digestModelResolves(webSessionRuntime) },
+    { token: SEARCH_ANSWER_CAPABILITY, probeTool: SEARCH_CANONICAL_NAME, fact: () => searchAnswerUsable(webSessionRuntime) }
   ];
   const resolveLiveSessionCapabilities = () => {
     const base = resolveSessionCapabilities(config.capabilities, { hasMcpServers: sessionHasMcp() });
     const derived = reviewerResolves() ? [ADVISOR_CAPABILITY] : [];
+    if ((config.deferTools?.length ?? 0) > 0)
+      derived.push(DEFERRED_BUILTINS_CAPABILITY);
     for (const cap of WEB_DERIVED_CAPABILITIES) {
       if (getRegisteredTool(cap.probeTool)?.executor !== undefined && cap.fact())
         derived.push(cap.token);
@@ -23521,6 +23967,7 @@ ${escapeAttributionText(msg.body)}
     mode: policyStateStore.getState().mode,
     platform: process.platform,
     ...config.disallowedTools !== undefined ? { disallowedTools: config.disallowedTools } : {},
+    ...config.tools !== undefined ? { tools: config.tools } : {},
     capabilities: sessionCapabilities,
     toolSearchEnabled: toolSearchEnabledDerived,
     ...config.insideSubagent !== undefined ? { insideSubagent: config.insideSubagent } : {},
@@ -23606,6 +24053,8 @@ ${escapeAttributionText(msg.body)}
       return visibleServerToolFilter();
     },
     ...config.disallowedTools !== undefined ? { disallowedTools: config.disallowedTools } : {},
+    ...config.tools !== undefined ? { tools: config.tools } : {},
+    resolveName: currentToolName,
     ...config.insideSubagent !== undefined ? { insideSubagent: config.insideSubagent } : {},
     ...config.familyMetadata !== undefined ? { familyMetadata: config.familyMetadata } : {},
     ...config.toolAliases !== undefined ? { toolAliases: config.toolAliases } : {},
@@ -24638,6 +25087,12 @@ ${escapeAttributionText(msg.body)}
     return { system: joinSystemBlocks(systemBlocks), systemBlocks };
   };
   const requestMessages = (context, effort, toolChanges) => buildRequestMessages(messages, context.userContextText, { systemReminders: systemRemindersOnWire(), ...effort !== undefined ? { effort } : {}, ...toolChanges !== undefined ? { toolChanges } : {} });
+  const deferredToolNamesToAnnounce = () => {
+    refreshAdvertisedPartition();
+    const eagerNames = new Set(advertisedPartition.eager.map((d) => d.canonicalName));
+    const twins = new Set(Object.entries(suppressionAliasTable).filter(([source]) => eagerNames.has(source)).map(([, target]) => target));
+    return [...new Set(advertisedPartition.deferred.filter((d) => !twins.has(d.canonicalName)).map((d) => d.advertisedName))];
+  };
   const systemRemindersOnWire = () => currentModelDescription()?.wire?.midConversationSystem === true;
   const currentModelDescription = () => {
     const key = currentProviderIdentity?.modelKey ?? currentModel;
@@ -24793,6 +25248,13 @@ ${escapeAttributionText(msg.body)}
           produced.push(needsAuth);
       }
     }
+    if (exactRequestLayout === undefined) {
+      const deferredNow = deferredToolNamesToAnnounce();
+      const offeredNow = [...advertisedPartition.eager, ...advertisedPartition.deferred].map((d) => d.advertisedName);
+      const deferredDelta = computeDeferredToolsDelta(deferredNow, offeredNow, messages);
+      if (deferredDelta !== undefined)
+        produced.push(deferredDelta);
+    }
     if (phase === "tool-round") {
       const attachment = taskNotificationAttachment(notifications.drainFor(config.agentId, { maxPriority: "next" }), {
         inHumanTurn: config.agentId === undefined && !turnStartedByNotification
@@ -25031,15 +25493,19 @@ ${escapeAttributionText(msg.body)}
     return cached ? { name: identity.name, configName: identity.configName } : identity;
   };
   const declaredMcpIdentity = (toolName) => {
-    if (mcpServerRenames === undefined)
-      return;
-    for (const [actual, declared] of Object.entries(mcpServerRenames)) {
-      if (toolName === `mcp__${actual}`)
-        return `mcp__${declared}`;
-      if (toolName.startsWith(`mcp__${actual}__`))
-        return `mcp__${declared}__${toolName.slice(`mcp__${actual}__`.length)}`;
+    const legacy = legacyNameOf(toolName);
+    if (legacy !== undefined)
+      return legacy;
+    const spelled = mcpSpellingOf(toolName) ?? toolName;
+    if (mcpServerRenames !== undefined) {
+      for (const [actual, declared] of Object.entries(mcpServerRenames)) {
+        if (spelled === `mcp__${actual}`)
+          return `mcp__${declared}`;
+        if (spelled.startsWith(`mcp__${actual}__`))
+          return `mcp__${declared}__${spelled.slice(`mcp__${actual}__`.length)}`;
+      }
     }
-    return;
+    return spelled !== toolName ? spelled : undefined;
   };
   const postToolHookSubject = (event, toolName) => {
     const declared = declaredMcpIdentity(toolName);
@@ -25612,10 +26078,13 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
           ...generationEffort ?? {}
         });
         const resultBlocks = [];
+        const hostSiteIcons = new Map;
         let toolThrowText = null;
         let structuredTerminated = false;
         const truncatedByOutputLimit = turn.stopReason === "max_tokens";
-        for (const call of turn.calls) {
+        for (const emitted of turn.calls) {
+          const resolvedName = currentToolName(emitted.name);
+          const call = resolvedName !== emitted.name ? { ...emitted, name: resolvedName } : emitted;
           const stoppedBy = currentTurnStop();
           if (stoppedBy !== undefined) {
             resultBlocks.push({ type: "tool_result", tool_use_id: call.id, content: `[not executed: the ${stoppedBy.hookName} hook stopped the turn]`, error: true });
@@ -25847,6 +26316,8 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
               ...loadedTools.length > 0 ? { loadedTools } : {},
               ...loadedToolDefinitions.length > 0 ? { loadedToolDefinitions } : {}
             });
+            if (raced.value.siteIcons !== undefined && raced.value.siteIcons.length > 0)
+              hostSiteIcons.set(call.id, raced.value.siteIcons);
             const postToolUseHookOutcome = raced.value.isError === true ? await fireObservationalHook("PostToolUseFailure", {
               toolUseID: call.id,
               toolName: postToolHookSubject("PostToolUseFailure", call.name),
@@ -25908,7 +26379,7 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
             }
           }
         }
-        output.write({ type: "data", message: { type: "user", message: { content: toolResultsForHost(resultBlocks.map((b) => b.type === "tool_result" && b.loadedTools !== undefined ? withoutLoadedTools(b) : b)) } } });
+        output.write({ type: "data", message: { type: "user", message: { content: withHostSiteIcons(toolResultsForHost(resultBlocks.map((b) => b.type === "tool_result" && b.loadedTools !== undefined ? withoutLoadedTools(b) : b)), hostSiteIcons) } } });
         messages.push({ role: "tool", content: resultBlocks });
         await recordUser(resultBlocks);
         await flushPendingHookAttachments();
@@ -26168,8 +26639,43 @@ var TEST_PROVIDER_NAMES = new Set([
   "p5skill",
   "p5checkpoint",
   "p5workflow",
-  "readimage"
+  "readimage",
+  "calls"
 ]);
+var CALL_LINE = /^CALL\s+(\S+)(?:\s+(.*))?$/;
+function promptedCallsProvider() {
+  return {
+    async generate({ messages }) {
+      let at = -1;
+      for (let i = messages.length - 1;i >= 0; i--) {
+        const m = messages[i];
+        if (m.role === "user" && userMessageText(m).split(`
+`).some((line) => CALL_LINE.test(line.trim()))) {
+          at = i;
+          break;
+        }
+      }
+      if (at < 0)
+        return { kind: "text", text: "[]" };
+      const script = userMessageText(messages[at]).split(`
+`).map((line) => CALL_LINE.exec(line.trim())).filter((m) => m !== null).map((m) => ({ name: m[1], input: m[2] !== undefined && m[2].trim() !== "" ? JSON.parse(m[2]) : {} }));
+      const after = messages.slice(at + 1);
+      const made = after.filter((m) => m.role === "assistant" && Array.isArray(m.content) && m.content.some((b) => b.type === "tool_use")).length;
+      if (made < script.length) {
+        const next = script[made];
+        return { kind: "tool_use", calls: [{ id: `calls-${at + 1}-${made + 1}`, name: next.name, input: next.input }] };
+      }
+      const results = after.flatMap((m) => Array.isArray(m.content) ? m.content : []).filter((b) => b.type === "tool_result");
+      const named = new Map(after.flatMap((m) => m.role === "assistant" && Array.isArray(m.content) ? m.content : []).flatMap((b) => b.type === "tool_use" ? [[b.id, b.name]] : []));
+      const text = (content) => typeof content === "string" ? content : Array.isArray(content) ? content.map((b) => b !== null && typeof b === "object" && typeof b.text === "string" ? b.text : "").join(`
+`) : String(content);
+      return {
+        kind: "text",
+        text: JSON.stringify(results.map((r) => ({ name: named.get(r.tool_use_id) ?? null, isError: r.is_error === true || r.error === true, content: text(r.content) })))
+      };
+    }
+  };
+}
 function isTestProviderName2(v) {
   return TEST_PROVIDER_NAMES.has(v);
 }
@@ -26334,6 +26840,8 @@ function rawTestProviderByName(name) {
         }
       };
     }
+    case "calls":
+      return promptedCallsProvider();
     case "mcpsdk":
       return scriptedProvider2([
         { kind: "tool_use", calls: [{ id: "mcpsdk-call-1", name: MCP_SDK_TEST_TOOL_NAME2, input: { x: 1 } }] },
@@ -27090,7 +27598,7 @@ class TranscriptWriter2 {
     return entries;
   }
 }
-var RUNTIME_ENGINE_VERSION2 = "0.0.36";
+var RUNTIME_ENGINE_VERSION2 = "0.0.38";
 function withPermissionJournal(writer, location) {
   return {
     transcriptPath: join26(location.winterHome, "projects", location.projectKey, `${location.sessionId}.jsonl`),