@yanlinglabs/winter-agent-runtime 0.0.38 → 0.0.40

package/dist/{index-5xe59vkt.js → index-a8j104mg.js}

@@ -61,12 +61,24 @@ function createRpcBridge2(output, bridgeOpts = {}) {
           const onAbort = () => {
             if (pending.get(requestId) !== entry)
               return;
-            pending.delete(requestId);
             if (entry.timer !== undefined)
               clearTimeout(entry.timer);
-            if (held?.delete(requestId) !== true)
+            const wasHeld = held?.delete(requestId) === true;
+            if (!wasHeld)
               output.write({ type: "control_cancel_request", requestId });
-            reject(new WinterRpcError("cancelled", `the '${subtype}' request was cancelled: the runtime stopped waiting for it`));
+            const cancelled = () => {
+              if (pending.get(requestId) !== entry)
+                return;
+              pending.delete(requestId);
+              reject(new WinterRpcError("cancelled", `the '${subtype}' request was cancelled: the runtime stopped waiting for it`));
+            };
+            const grace = opts?.cancelGraceMs;
+            if (grace === undefined || wasHeld) {
+              cancelled();
+              return;
+            }
+            entry.timer = setTimeout(cancelled, grace);
+            entry.timer.unref?.();
           };
           signal.addEventListener("abort", onAbort, { once: true });
           entry.detach = () => signal.removeEventListener("abort", onAbort);
@@ -265,10 +277,28 @@ function leadingWord(s) {
 function joinLineContinuations(command) {
   if (!command.includes("\\\n"))
     return command;
-  return command.replace(/\\+\n/g, (run) => {
-    const backslashes = run.length - 1;
-    return backslashes % 2 === 1 ? "\\".repeat(backslashes - 1) : run;
-  });
+  let out = "";
+  let i = 0;
+  while (i < command.length) {
+    if (command[i] !== "\\") {
+      out += command[i];
+      i++;
+      continue;
+    }
+    let end = i;
+    while (end < command.length && command[end] === "\\")
+      end++;
+    const run = end - i;
+    if (command[end] === `
+` && run % 2 === 1) {
+      out += "\\".repeat(run - 1);
+      i = end + 1;
+    } else {
+      out += "\\".repeat(run);
+      i = end;
+    }
+  }
+  return out;
 }
 function splitCompound(rawCommand) {
   const command = joinLineContinuations(rawCommand);
@@ -350,25 +380,34 @@ function stripLeadingAssignmentsAt(s, info, start, direction) {
   }
   return pos;
 }
-function stripWrappers(rawCmd, direction) {
+function stripWrappersDetailed(rawCmd, direction) {
   const cmd = joinLineContinuations(rawCmd);
   const info = scanShellLike(cmd);
+  const finish = (pos, ambiguousForAllow = false) => {
+    const carried = info.ok ? redirectWriteSpans(cmd, info).filter((span) => span.start < pos).map((span) => cmd.slice(span.start, span.end)) : [];
+    return { inner: cmd.slice(pos), carried, ambiguousForAllow };
+  };
   let pos = 0;
   for (;; ) {
     pos = stripLeadingAssignmentsAt(cmd, info, pos, direction);
     const { word: rawWord, end: afterWordEnd } = leadingWordAt(cmd, info, pos);
     if (rawWord === undefined)
-      return cmd.slice(pos);
-    const word = dequoteShellWord(rawWord);
+      return finish(pos);
+    const isWrapperName = (r) => r === XARGS || FIXED_WRAPPERS.has(r);
+    const readings = shellWordReadings(rawWord);
+    const exact = readings[0];
+    if (direction === "allow" && !isWrapperName(exact) && readings.some(isWrapperName))
+      return finish(pos, true);
+    const word = direction === "allow" ? exact : readings.find(isWrapperName) ?? exact;
     if (word === XARGS) {
       const { word: next } = leadingWordAt(cmd, info, afterWordEnd);
       if (next !== undefined && next.startsWith("-"))
-        return cmd.slice(pos);
+        return finish(pos);
       pos = afterWordEnd;
       continue;
     }
     if (!FIXED_WRAPPERS.has(word))
-      return cmd.slice(pos);
+      return finish(pos);
     let remainderPos = afterWordEnd;
     for (;; ) {
       const { word: flag, end: afterFlagEnd } = leadingWordAt(cmd, info, remainderPos);
@@ -384,6 +423,17 @@ function stripWrappers(rawCmd, direction) {
     pos = remainderPos;
   }
 }
+var joinedStrip = (strip) => [strip.inner, ...strip.carried].filter((part) => part !== "").join(" ");
+function stripWrappers(rawCmd, direction) {
+  const strip = stripWrappersDetailed(rawCmd, direction);
+  return strip.ambiguousForAllow ? joinLineContinuations(rawCmd).trimStart() : joinedStrip(strip);
+}
+function ruleMatchTexts(command, direction) {
+  const strip = stripWrappersDetailed(command, direction);
+  if (strip.ambiguousForAllow)
+    return [];
+  return direction === "allow" ? [strip.inner] : [joinedStrip(strip), strip.inner];
+}
 var ANSI_C_SIMPLE_ESCAPES = { n: `
 `, t: "\t", r: "\r", a: "\x07", b: "\b", e: "\x1B", E: "\x1B", f: "\f", v: "\v", "\\": "\\", "'": "'", '"': '"', "?": "?" };
 function decodeAnsiCEscape(s, i) {
@@ -413,7 +463,9 @@ function decodeAnsiCEscape(s, i) {
     return { text: String.fromCharCode(s.charCodeAt(i + 1) & 31), next: i + 2 };
   return { text: `\\${ch}`, next: i + 1 };
 }
-function shellWords(s, split = true) {
+var DOUBLE_QUOTE_ESCAPABLE = new Set(["$", "`", '"', "\\", `
+`]);
+function shellWords(s, split = true, reading = "broad") {
   const words = [];
   let cur = "";
   let start = -1;
@@ -455,9 +507,12 @@ function shellWords(s, split = true) {
       if (ch === '"')
         quote = null;
       else if (ch === "\\" && i + 1 < s.length) {
-        if (s[i + 1] !== `
+        const next = s[i + 1];
+        if (reading === "bash" && !DOUBLE_QUOTE_ESCAPABLE.has(next))
+          cur += ch + next;
+        else if (next !== `
 `)
-          cur += s[i + 1];
+          cur += next;
         i++;
       } else
         cur += ch;
@@ -498,7 +553,12 @@ function shellWords(s, split = true) {
   return words;
 }
 function dequoteShellWord(word) {
-  return shellWords(word, false)[0]?.word ?? "";
+  return shellWords(word, false, "bash")[0]?.word ?? "";
+}
+function shellWordReadings(word) {
+  const exact = dequoteShellWord(word);
+  const broad = shellWords(word, false, "broad")[0]?.word ?? "";
+  return broad === exact ? [exact] : [exact, broad];
 }
 var REDIRECT_WORD_STOP = /[\s;&|<>()]/;
 function redirectWordAt(s, info, start) {
@@ -515,12 +575,23 @@ function extractRedirectWrites(rawCommand) {
   const info = scanShellLike(command);
   if (!info.ok)
     return [];
-  const { topLevel } = info;
   const writes = [];
-  const push = (raw) => {
-    writes.push({ raw, target: dequoteShellWord(raw) });
+  const pushReadings = (raw) => {
+    for (const target of shellWordReadings(raw))
+      writes.push({ raw, target });
+  };
+  for (const { target: raw } of redirectWriteSpans(command, info)) {
+    pushReadings(raw);
     if (raw.length > 1 && raw.startsWith("!"))
-      writes.push({ raw: raw.slice(1), target: dequoteShellWord(raw.slice(1)) });
+      pushReadings(raw.slice(1));
+  }
+  return writes;
+}
+function redirectWriteSpans(command, info) {
+  const { topLevel } = info;
+  const spans = [];
+  const push = (start, target, end) => {
+    spans.push({ start, end, target });
   };
   let i = 0;
   while (i < command.length) {
@@ -566,10 +637,10 @@ function extractRedirectWrites(rawCommand) {
       continue;
     }
     if (!(descriptorCopy && /^(?:[0-9]+|-)$/.test(dequoteShellWord(word))))
-      push(word);
+      push(i, word, end);
     i = end;
   }
-  return writes;
+  return spans;
 }
 function extractRedirectTargets(command) {
   return extractRedirectWrites(command).map((w) => w.target);
@@ -583,8 +654,8 @@ function isRecognizedReadOnly(command) {
   const { word: first, afterWord } = leadingWord(stripped);
   if (first === undefined)
     return false;
-  const dequotedArgs = shellWords(afterWord).map((w) => w.word).join(" ");
-  const hasFlag = (pattern) => pattern.test(afterWord) || pattern.test(dequotedArgs);
+  const views = [afterWord, ...["broad", "bash"].map((reading) => shellWords(afterWord, true, reading).map((w) => w.word).join(" "))];
+  const hasFlag = (pattern) => views.some((view) => pattern.test(view));
   if (first === "git") {
     const { word: sub } = leadingWord(afterWord);
     return sub !== undefined && GIT_READ_ONLY_SUBCOMMANDS.has(sub) && !hasFlag(GIT_WRITE_CAPABLE_FLAGS);
@@ -794,8 +865,8 @@ function matchesRule(rule, call, opts) {
     case "pattern": {
       const raw = call.input["command"];
       const cmd = typeof raw === "string" ? raw : "";
-      const stripped = stripWrappers(cmd, opts.direction);
-      return compilePattern(rule.specifier.source).test(stripped);
+      const pattern = compilePattern(rule.specifier.source);
+      return ruleMatchTexts(cmd, opts.direction).some((text) => pattern.test(text));
     }
   }
 }
@@ -1112,6 +1183,10 @@ function dedupeSameBatch(server, tools) {
   }
   return dropped ? out : tools;
 }
+var CONCURRENCY_LANE = /^[A-Za-z0-9_.:-]{1,64}$/;
+function isValidConcurrencyLane(lane) {
+  return typeof lane === "string" && CONCURRENCY_LANE.test(lane);
+}
 function registerMcpServerTools(server, incomingTools, opts) {
   if (RESERVED_MCP_SERVER_NAMES.has(server)) {
     throw new Error(`registerMcpServerTools: "${server}" is a RESERVED server name -- the standing Winter server ` + `(its name is defined in mcp/winter-server.ts) owns this identity and is registry-native; it is never installed through ` + `this live-mutation function, and nothing else may register live tools under it either.`);
@@ -1166,7 +1241,9 @@ function registerMcpServerTools(server, incomingTools, opts) {
   for (const tool of tools) {
     const canonicalName = registeredName(tool);
     const existingEntry = registry.get(canonicalName);
-    const descriptor = buildMcpToolDescriptor(server, tool, opts, plainNameFor(tool));
+    const built = buildMcpToolDescriptor(server, tool, opts, plainNameFor(tool));
+    const lane = opts.toolLanes !== undefined && Object.hasOwn(opts.toolLanes, tool.name) ? opts.toolLanes[tool.name] : undefined;
+    const descriptor = isValidConcurrencyLane(lane) ? { ...built, concurrencyLane: lane } : built;
     registry.set(canonicalName, existingEntry ? { ...existingEntry, descriptor } : { descriptor });
     mcpToolOwner.set(canonicalName, server);
     nowOwned.add(canonicalName);
@@ -4554,7 +4631,7 @@ function parentOf(dir) {
 // src/engine.ts
 import { randomUUID as randomUUID18 } from "node:crypto";
 import { homedir, release as osRelease, type as osType } from "node:os";
-import { join as join25, resolve as resolve12 } from "node:path";
+import { join as join26, resolve as resolve12 } from "node:path";
 import {
   PROTOCOL_VERSION,
   resolveWebToolsConfig,
@@ -5155,7 +5232,25 @@ function createDefaultMessagingRuntime(opts = {}) {
     subscribers,
     now
   });
-  return { seam, adapter, notifications, loopGuard: createLoopGuard(), subscribers, now, peers, classifyDeliveryError };
+  const hostPorts = new Map;
+  return {
+    seam,
+    adapter,
+    notifications,
+    loopGuard: createLoopGuard(),
+    subscribers,
+    now,
+    peers,
+    classifyDeliveryError,
+    hostMessaging: (sessionId) => hostPorts.get(sessionId),
+    registerHostMessagingPort(sessionId, port) {
+      hostPorts.set(sessionId, port);
+      return () => {
+        if (hostPorts.get(sessionId) === port)
+          hostPorts.delete(sessionId);
+      };
+    }
+  };
 }
 function getDefaultMessagingRuntime() {
   const runtime = getMessagingRuntime();
@@ -7394,6 +7489,40 @@ function transformChildFrame(frame, correlation, forwardSubagentText) {
 }
 var SESSION_LEVEL_SYSTEM_SUBTYPES = new Set(["task_started", "task_progress", "task_notification", "task_updated", "background_tasks_changed"]);
 
+// src/messaging/host-port.ts
+import { HOST_MESSAGE_LIST_SUBTYPE, HOST_MESSAGE_SEND_SUBTYPE, HOST_SESSION_STOP_SUBTYPE } from "@yanlinglabs/winter-agent-sdk";
+import { isHostMessageSendAnswer, isHostSessionStopAnswer, normaliseHostMessageListAnswer } from "@yanlinglabs/winter-agent-sdk/messaging";
+var HOST_MESSAGE_SEND_TIMEOUT_MS = 180000;
+var HOST_MESSAGE_LIST_TIMEOUT_MS = 15000;
+var HOST_SESSION_STOP_TIMEOUT_MS = 30000;
+
+class HostMessagingAnswerError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HostMessagingAnswerError";
+  }
+}
+function createHostMessagingPort(sender) {
+  return {
+    async send(request, opts) {
+      const answer = await sender.request(HOST_MESSAGE_SEND_SUBTYPE, request, { timeoutMs: HOST_MESSAGE_SEND_TIMEOUT_MS, ...opts?.signal !== undefined ? { signal: opts.signal } : {} });
+      if (!isHostMessageSendAnswer(answer))
+        throw new HostMessagingAnswerError("the host answered host_message_send with a malformed outcome");
+      return answer;
+    },
+    async list(request, opts) {
+      const answer = await sender.request(HOST_MESSAGE_LIST_SUBTYPE, request, { timeoutMs: HOST_MESSAGE_LIST_TIMEOUT_MS, ...opts?.signal !== undefined ? { signal: opts.signal } : {} });
+      return normaliseHostMessageListAnswer(answer) ?? { sessions: [] };
+    },
+    async stop(request, opts) {
+      const answer = await sender.request(HOST_SESSION_STOP_SUBTYPE, request, { timeoutMs: HOST_SESSION_STOP_TIMEOUT_MS, ...opts?.signal !== undefined ? { signal: opts.signal } : {} });
+      if (!isHostSessionStopAnswer(answer))
+        throw new HostMessagingAnswerError("the host answered host_session_stop with a malformed answer");
+      return answer;
+    }
+  };
+}
+
 // src/permissions/ruleset.ts
 import {
   readFileSync as readFileSync6,
@@ -8338,9 +8467,10 @@ function naiveWriteWords(command) {
   const out = [];
   for (const m of command.matchAll(/(?:&>>?|[0-9]*>>?\|?|[0-9]*>&|<>)[ \t]*([^\s;&|()<>]+)/g)) {
     const raw = m[1];
-    const word = dequoteShellWord(raw);
-    if (!/^(?:[0-9]+|-)$/.test(word))
-      out.push({ word, raw, quoted: word !== raw });
+    for (const word of shellWordReadings(raw)) {
+      if (!/^(?:[0-9]+|-)$/.test(word))
+        out.push({ word, raw, quoted: word !== raw });
+    }
   }
   for (const piece of naiveCommandPieces(command)) {
     const stripped = stripWrappers(piece, "denyAsk");
@@ -18802,6 +18932,7 @@ replaceExecutor("TaskOutput", taskOutputExecutor);
 
 // src/tools/impl/task-stop.ts
 import { randomUUID as randomUUID15 } from "node:crypto";
+import { boundedHostNote } from "@yanlinglabs/winter-agent-sdk/messaging";
 function parseTaskStopInput(input) {
   if (typeof input !== "object" || input === null)
     return { error: "TaskStop: input must be an object" };
@@ -18831,6 +18962,9 @@ var taskStopExecutor = {
     const id = parsed.task_id ?? parsed.shell_id;
     const task = getTask(id);
     if (!task) {
+      const host = getMessagingRuntime()?.hostMessaging?.(ctx.sessionId);
+      if (host !== undefined)
+        return stopHostSession(host, id, ctx.agentId, ctx.signal);
       return { output: `Error: TaskStop: unknown task_id "${id}"`, isError: true };
     }
     if (task.status !== "running") {
@@ -18852,6 +18986,24 @@ var taskStopExecutor = {
     return { output: formatResult(`stopped task ${id}`, id, task.kind, task.command) };
   }
 };
+var HOST_SESSION_TASK_TYPE = "session";
+async function stopHostSession(host, id, agentId, signal) {
+  let answer;
+  try {
+    answer = await host.stop({ id, ...agentId !== undefined ? { fromAgentId: agentId } : {} }, signal !== undefined ? { signal } : {});
+  } catch (err) {
+    return { output: `Error: TaskStop: the host did not answer the stop for "${id}" (${err instanceof Error ? err.name : "error"}); it may or may not have stopped`, isError: true };
+  }
+  const note = boundedHostNote(answer.note);
+  const withNote = (message) => note === undefined ? message : `${message}. ${note}`;
+  if (answer.status === "stopped")
+    return { output: JSON.stringify({ message: withNote(`stopped session ${id}: its running turn was interrupted`), task_id: id, task_type: HOST_SESSION_TASK_TYPE }) };
+  if (answer.status === "not_running")
+    return { output: JSON.stringify({ message: withNote(`session ${id} has no turn running -- nothing to stop`), task_id: id, task_type: HOST_SESSION_TASK_TYPE }) };
+  if (answer.status === "not_found")
+    return { output: `Error: TaskStop: unknown task_id "${id}" (${answer.reason ?? "not found"})`, isError: true };
+  return { output: `Error: TaskStop: ${answer.reason ?? answer.status}`, isError: true };
+}
 replaceExecutor("TaskStop", taskStopExecutor);
 
 // src/tools/impl/todo-write.ts
@@ -19448,7 +19600,8 @@ function callerContextFrom(ctx) {
   return {
     sessionId: ctx.sessionId,
     ...ctx.agentId !== undefined ? { agentId: ctx.agentId } : {},
-    ...ctx.toolUseId !== undefined ? { toolUseId: ctx.toolUseId } : {}
+    ...ctx.toolUseId !== undefined ? { toolUseId: ctx.toolUseId } : {},
+    ...ctx.signal !== undefined ? { signal: ctx.signal } : {}
   };
 }
 
@@ -22366,130 +22519,1711 @@ Sources:
 }
 replaceExecutor(SEARCH_CANONICAL_NAME, createSearchExecutor());
 
-// src/tools/read-state.ts
-import { isAbsolute as isAbsolute6, join as join24, normalize as normalize3 } from "node:path";
-function createSessionReadState(opts) {
-  const cwd = opts.cwd;
-  const reads = new Map;
-  function canonicalKey(p) {
-    const abs = isAbsolute6(p) ? p : join24(cwd, p);
-    return resolveRealTarget(normalize3(abs));
-  }
-  return {
-    recordRead(p, o) {
-      reads.set(canonicalKey(p), { complete: o.complete, mtimeMs: o.mtimeMs });
-    },
-    lookup(p) {
-      return reads.get(canonicalKey(p));
-    }
+// src/permissions/bash-read-only.ts
+import { statSync as statSync10 } from "node:fs";
+import { join as join24 } from "node:path";
+var READ_ONLY_LENGTH_LIMIT = 4096;
+var WHOLE_TEXT_REFUSALS = [
+  (text) => text.length > Math.min(PARSE_LIMIT, READ_ONLY_LENGTH_LIMIT),
+  (text) => text.trim() === "",
+  (text) => splitCompound(text) === null,
+  (text) => !passesSecurityValidators(text),
+  (text, platform) => containsVulnerableUncPath(text, platform)
+];
+function isBashCommandReadOnly(command, ctx) {
+  const platform = process.platform;
+  if (typeof command !== "string" || WHOLE_TEXT_REFUSALS.some((refuses) => refuses(command, platform)))
+    return false;
+  const joined = joinLineContinuations(command);
+  if ((substitutionBodies(joined) ?? [""]).length > 0)
+    return false;
+  const commands = readSimpleCommands(joined) ?? [];
+  if (commands.length === 0 || gitRunsUnsafely(joined, commands, ctx))
+    return false;
+  return commands.every((simple) => passesSecurityValidators(simple.text) && isSimpleCommandReadOnly(simple, platform));
+}
+var SHELL_OPERATORS = ["<<<", "&&", "||", "|&", ";;", ";&", "&>", ">>", ">&", ">|", "<<", "<&", "<>", ">", "<", "&", "|", ";"];
+var COMMAND_SEPARATORS = new Set([";", "&&", "||", "|"]);
+function throwsOutputAway(operator, descriptor, target) {
+  if (operator === ">")
+    return target === "/dev/null" && (descriptor === undefined || ["0", "1", "2"].includes(descriptor));
+  return operator === ">&" && descriptor === "2" && target === "1";
+}
+function readSimpleCommands(text) {
+  const lx = lex(text);
+  if (lx.unterminated || text.includes("\r"))
+    return null;
+  let lastNonBlank = text.length - 1;
+  while (lastNonBlank >= 0 && isBlank(text[lastNonBlank]))
+    lastNonBlank--;
+  const commands = [];
+  let words = [];
+  let wordStart = -1;
+  let awaiting;
+  let endedBySemicolon = false;
+  const closeWord = (end) => {
+    if (wordStart === -1)
+      return true;
+    const raw = text.slice(wordStart, end);
+    wordStart = -1;
+    if (awaiting !== undefined) {
+      const harmless = throwsOutputAway(awaiting.operator, awaiting.descriptor, raw);
+      awaiting = undefined;
+      return harmless;
+    }
+    words.push({ raw, value: dequoteShellWord(raw) });
+    return true;
   };
+  const opensSubstitution = (i, quoteForms) => {
+    const next = text[i + 1];
+    return text[i] === "$" && next !== undefined && (next === "(" || next === "{" || next === "[" || quoteForms && (next === "'" || next === '"'));
+  };
+  for (let i = 0;i < text.length; i++) {
+    const ch = text[i];
+    if (!isBare(lx, i)) {
+      if (lx.role[i] === 0 /* Text */ && lx.quoting[i] === 2 /* Double */ && (ch === "`" || opensSubstitution(i, false)))
+        return null;
+      if (wordStart === -1)
+        wordStart = i;
+      continue;
+    }
+    if (ch === " " || ch === "\t" || ch === `
+`) {
+      if (!closeWord(i))
+        return null;
+      if (ch === `
+` && i < lastNonBlank)
+        return null;
+      continue;
+    }
+    if (ch === "`" || ch === "(" || ch === ")" || ch === "\\")
+      return null;
+    if (opensSubstitution(i, true))
+      return null;
+    if (ch === "#" && wordStart === -1)
+      return null;
+    if (!";&|<>".includes(ch)) {
+      if (wordStart === -1)
+        wordStart = i;
+      continue;
+    }
+    const operator = SHELL_OPERATORS.find((op) => text.startsWith(op, i));
+    const glued = wordStart === -1 ? undefined : text.slice(wordStart, i);
+    let descriptor;
+    if (glued !== undefined && /^\d+$/.test(glued) && (operator[0] === ">" || operator[0] === "<")) {
+      descriptor = glued;
+      wordStart = -1;
+    } else if (!closeWord(i)) {
+      return null;
+    }
+    i += operator.length - 1;
+    if (awaiting !== undefined)
+      return null;
+    if (descriptor === undefined && COMMAND_SEPARATORS.has(operator)) {
+      if (words.length === 0)
+        return null;
+      commands.push({ words, text: words.map((w) => w.raw).join(" ") });
+      words = [];
+      endedBySemicolon = operator === ";";
+      continue;
+    }
+    awaiting = descriptor === undefined ? { operator } : { operator, descriptor };
+  }
+  if (!closeWord(text.length) || awaiting !== undefined)
+    return null;
+  if (words.length > 0)
+    commands.push({ words, text: words.map((w) => w.raw).join(" ") });
+  else if (!(commands.length > 0 && endedBySemicolon))
+    return null;
+  return commands;
+}
+var DIRECTORY_CHANGERS = new Set(["cd", "pushd", "popd"]);
+function programsRunBy(simple) {
+  const programs = new Set([simple.words[0].value]);
+  const inner = leadingWord(stripWrappers(simple.text, "denyAsk")).word;
+  if (inner !== undefined)
+    programs.add(dequoteShellWord(inner));
+  if (simple.words[0].value === "xargs")
+    for (const word of simple.words)
+      programs.add(word.value);
+  return programs;
+}
+function entryKind(path) {
+  try {
+    const entry = statSync10(path);
+    return entry.isFile() ? "file" : entry.isDirectory() ? "directory" : "other";
+  } catch {
+    return "missing";
+  }
 }
-
-// src/provider/lean-prompt.ts
-var FULL_PROMPT_OPUS_MINORS = new Set(["0", "1", "5", "6", "7"]);
-function claudeModelTakesFullPrompt(modelKey) {
-  const id = modelKey.slice(modelKey.lastIndexOf("/") + 1).toLowerCase();
-  if (id.includes("claude-3-") || id.includes("haiku") || id.includes("sonnet"))
-    return true;
-  const opus = /^claude-opus-4(?:[-.](\d{1,2}))?(?:-\d{8})?$/.exec(id);
-  if (opus === null)
+var BARE_REPOSITORY_MARKERS = [
+  ["HEAD", "file"],
+  ["objects", "directory"],
+  ["refs", "directory"]
+];
+function isCurrentDirectoryBareGitRepo(cwd) {
+  const dotGit = entryKind(join24(cwd, ".git"));
+  const workingRepository = dotGit === "file" || dotGit === "directory" && entryKind(join24(cwd, ".git", "HEAD")) === "file";
+  if (workingRepository)
     return false;
-  return FULL_PROMPT_OPUS_MINORS.has(opus[1] ?? "0");
-}
-
-// src/provider/first-party.ts
-var FIRST_PARTY_ANTHROPIC_PROVIDER_IDS = new Set(["anthropic", "console"]);
-function isFirstPartyAnthropic(providerId) {
-  return providerId !== undefined && FIRST_PARTY_ANTHROPIC_PROVIDER_IDS.has(providerId);
-}
-
-// src/engine.ts
-var SKILL_TOOL_ADVERTISED_NAME = "Skill";
-function undeclaredToolDefinitionsText(definitions) {
-  if (definitions.length === 0)
-    return "";
-  const lines = definitions.map((d) => `<function>${JSON.stringify({ name: d.name, description: d.description, parameters: d.inputSchema })}</function>`);
-  return `
-
-These loaded tools are not in this conversation's tool list, but you can call them by name; each one's input must match its parameters schema:
-<functions>
-${lines.join(`
-`)}
-</functions>`;
-}
-function providerMessageContentToText(content) {
-  if (typeof content === "string")
-    return content;
-  return content.map((block) => {
-    if (block.type === "text")
-      return block.text;
-    if (block.type === "tool_use")
-      return `[called ${block.name}]`;
-    if (block.type === "tool_reference")
-      return `[tools now callable: ${block.tool_names.join(", ")}]`;
-    if (block.type === "thinking")
-      return `[thinking: ${block.thinking.length} chars]`;
-    if (block.type === "redacted_thinking")
-      return "[redacted thinking]";
-    if (block.type === "image")
-      return `[image: ${block.source.media_type}]`;
-    return typeof block.content === "string" ? block.content : providerMessageContentToText(block.content);
-  }).join(`
-`);
+  return BARE_REPOSITORY_MARKERS.some(([name, kind]) => entryKind(join24(cwd, name)) === kind);
 }
-function isPerMessageEffortRejection(err) {
-  if (!isProviderTurnError(err) || err.status !== 400)
+var GIT_INTERNAL_TOP_LEVEL = new Set(["objects", "refs", "hooks"]);
+function namesGitInternals(path) {
+  const segments = path.split("/").filter((segment) => segment !== "" && segment !== ".");
+  const top = segments[0];
+  if (top === undefined)
     return false;
-  return /mid-conversation-output-config|per-turn effort|configuration_update/i.test(err instanceof Error ? err.message : "");
+  return top === "HEAD" && segments.length === 1 || GIT_INTERNAL_TOP_LEVEL.has(top);
 }
-function isToolChangeRejection(err, carriedChangeMessage = false) {
-  if (!isProviderTurnError(err) || err.status !== 400 && err.status !== 422)
+var CREATING_COMMANDS = new Set(["mkdir", "touch", "cp", "mv"]);
+function gitRunsUnsafely(joined, commands, ctx) {
+  const programs = commands.map(programsRunBy);
+  if (!programs.some((set) => set.has("git")))
     return false;
-  if (carriedChangeMessage && /system message|role.{0,4}system|must (immediately )?(follow|precede)|end the array|paused assistant turn/i.test(err instanceof Error ? err.message : ""))
+  if (programs.some((set) => [...DIRECTORY_CHANGERS].some((changer) => set.has(changer))))
     return true;
-  return /mid-conversation-tool-changes|inline-tools|tool_addition|tool_removal|tool_definition|tool_reference_unresolved|tool_name_conflict|available_tools_limit_exceeded|cannot yet be defined in a message|additional_tools/i.test(err instanceof Error ? err.message : "");
+  if (isCurrentDirectoryBareGitRepo(ctx.cwd))
+    return true;
+  if (extractRedirectTargets(joined).some(namesGitInternals))
+    return true;
+  const createsInternals = commands.some((simple) => CREATING_COMMANDS.has(simple.words[0].value) && simple.words.slice(1).some((w) => !w.value.startsWith("-") && namesGitInternals(w.value)));
+  return createsInternals || ctx.sandboxEnabled && ctx.cwd !== ctx.originalCwd;
 }
-function isToolSearchRejection(err) {
-  if (!isProviderTurnError(err) || err.status !== 400 && err.status !== 422)
-    return false;
-  const text = err instanceof Error ? err.message : "";
-  if (errorParam(text)?.startsWith("tool_choice") === true)
+var WEBDAV_MARKERS = [/@SSL@\d+/i, /@\d+@SSL/i, /DavWWWRoot/i];
+var isPathSeparator = (ch) => ch === "/" || ch === "\\";
+function containsVulnerableUncPath(text, platform = process.platform) {
+  if (platform !== "win32")
     return false;
-  return /tool_search|defer_loading|namespace/i.test(text);
-}
-function errorParam(text) {
-  return /"param"\s*:\s*"([^"]*)"/.exec(text)?.[1];
+  if (WEBDAV_MARKERS.some((marker) => marker.test(text)))
+    return true;
+  let i = 0;
+  while (i < text.length) {
+    if (!isPathSeparator(text[i])) {
+      i++;
+      continue;
+    }
+    const runStart = i;
+    while (i < text.length && isPathSeparator(text[i]))
+      i++;
+    const host = text[i];
+    if (i - runStart < 2 || host === undefined || /\s/.test(host))
+      continue;
+    const urlScheme = i - runStart === 2 && text[runStart] === "/" && text[runStart + 1] === "/" && text[runStart - 1] === ":";
+    if (!urlScheme)
+      return true;
+  }
+  return false;
 }
-function isAllowedToolsRejection(err) {
-  if (!isProviderTurnError(err) || err.status !== 400 && err.status !== 422)
-    return false;
-  const text = err instanceof Error ? err.message : "";
-  const param = errorParam(text);
-  if (param !== undefined)
-    return param.startsWith("tool_choice");
-  return /allowed_tools|tool_choice|tool_search/i.test(text);
+function lex(text) {
+  const quoting = new Uint8Array(text.length);
+  const role = new Uint8Array(text.length);
+  let open = 0 /* None */;
+  for (let i = 0;i < text.length; i++) {
+    const ch = text[i];
+    if (open === 1 /* Single */) {
+      quoting[i] = 1 /* Single */;
+      if (ch === "'") {
+        role[i] = 1 /* QuoteMark */;
+        open = 0 /* None */;
+      }
+      continue;
+    }
+    if (ch === "\\" && i + 1 < text.length) {
+      quoting[i] = quoting[i + 1] = open;
+      role[i] = 2 /* Escape */;
+      role[i + 1] = 3 /* Escaped */;
+      i++;
+      continue;
+    }
+    if (open === 2 /* Double */) {
+      quoting[i] = 2 /* Double */;
+      if (ch === '"') {
+        role[i] = 1 /* QuoteMark */;
+        open = 0 /* None */;
+      }
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      open = ch === "'" ? 1 /* Single */ : 2 /* Double */;
+      quoting[i] = open;
+      role[i] = 1 /* QuoteMark */;
+    }
+  }
+  return { text, quoting, role, unterminated: open !== 0 /* None */ };
+}
+var isBare = (lx, i) => lx.quoting[i] === 0 /* None */ && lx.role[i] === 0 /* Text */;
+var isBlank = (ch) => ch !== undefined && /\s/.test(ch);
+function viewsOf(lx, keepDoubleMarks) {
+  let outsideSingle = "";
+  let bare = "";
+  let bareWithMarks = "";
+  for (let i = 0;i < lx.text.length; i++) {
+    const ch = lx.text[i];
+    if (lx.role[i] === 1 /* QuoteMark */) {
+      bareWithMarks += ch;
+      if (ch === '"' && keepDoubleMarks)
+        outsideSingle += ch;
+      continue;
+    }
+    if (lx.quoting[i] === 1 /* Single */)
+      continue;
+    outsideSingle += ch;
+    if (lx.quoting[i] === 0 /* None */) {
+      bare += ch;
+      bareWithMarks += ch;
+    }
+  }
+  return { outsideSingle, bare, bareWithMarks };
 }
-function promptCacheTtlFor(config) {
-  return config.promptCacheTtl === "1h" ? "1h" : "5m";
+function wordSpans(lx) {
+  const spans = [];
+  let start = -1;
+  for (let i = 0;i <= lx.text.length; i++) {
+    const cut = i === lx.text.length || isBare(lx, i) && isBlank(lx.text[i]);
+    if (cut) {
+      if (start !== -1)
+        spans.push({ start, end: i });
+      start = -1;
+    } else if (start === -1)
+      start = i;
+  }
+  return spans;
 }
-function promptCacheKeyFor(config) {
-  return config.agentId === undefined ? config.sessionId : `${config.sessionId}:${config.agentId}`;
+function withoutHarmlessRedirections(view) {
+  const drop = new Uint8Array(view.length);
+  const markFrom = (from, to) => {
+    for (let k = from;k < to; k++)
+      drop[k] = 1;
+  };
+  const skipBlanks = (k) => {
+    while (isBlank(view[k]))
+      k++;
+    return k;
+  };
+  const endsWord = (k) => k === view.length || isBlank(view[k]);
+  const devNullAt = (k) => view.startsWith("/dev/null", k) && endsWord(k + 9) ? k + 9 : -1;
+  for (let i = 0;i < view.length; i++) {
+    const ch = view[i];
+    if (ch === "<") {
+      const end = devNullAt(skipBlanks(i + 1));
+      if (end !== -1)
+        markFrom(i, end);
+    } else if (ch === ">" && view[i + 1] === "&") {
+      const one = skipBlanks(i + 2);
+      let two = i - 1;
+      while (two >= 0 && isBlank(view[two]))
+        two--;
+      if (view[one] === "1" && endsWord(one + 1) && view[two] === "2" && isBlank(view[two - 1]))
+        markFrom(two, one + 1);
+    } else if (ch === ">") {
+      const end = devNullAt(skipBlanks(i + 1));
+      if (end !== -1)
+        markFrom(i, end);
+    }
+  }
+  let out = "";
+  for (let i = 0;i < view.length; i++)
+    if (drop[i] === 0)
+      out += view[i];
+  return out;
 }
-function withoutLoadedTools(block) {
-  const { loadedTools: _loaded, loadedToolDefinitions: _definitions, ...rest } = block;
-  return rest;
+var CONTROL_CHARACTERS = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/;
+var UNICODE_WHITESPACE = /[\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\uFEFF]/;
+function singleQuoteEndsInBackslash(lx) {
+  let lastSingleQuote = -1;
+  for (let i = lx.text.length - 1;i >= 0; i--) {
+    if (lx.text[i] === "'") {
+      lastSingleQuote = i;
+      break;
+    }
+  }
+  let inside = false;
+  let trailing = 0;
+  for (let i = 0;i < lx.text.length; i++) {
+    if (lx.quoting[i] !== 1 /* Single */)
+      continue;
+    if (lx.role[i] === 1 /* QuoteMark */) {
+      if (inside && (trailing % 2 === 1 || trailing > 0 && lastSingleQuote > i))
+        return true;
+      inside = !inside;
+      trailing = 0;
+      continue;
+    }
+    trailing = lx.text[i] === "\\" ? trailing + 1 : 0;
+  }
+  return false;
 }
-function mcpNamespaceFor(advertisedName, server) {
-  if (server === undefined)
-    return;
-  const namespace = `mcp__${server}`;
-  return advertisedName.startsWith(`${namespace}__`) && advertisedName.length > namespace.length + 2 ? namespace : undefined;
+var MIDWAY_OPENINGS = ["-", ";", ">", "<", "&&", "||"];
+function startsMidway(text) {
+  const body = text.trimStart();
+  const indentation = text.slice(0, text.length - body.length);
+  return indentation.includes("\t") || MIDWAY_OPENINGS.some((opening) => body.startsWith(opening));
 }
-var NAMED_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
-function isNamedEffort(value) {
-  return typeof value === "string" && NAMED_EFFORTS.includes(value);
+function jqReachesBeyondItsFilter(text, base) {
+  if (base !== "jq")
+    return false;
+  for (let at = text.indexOf("system");at !== -1; at = text.indexOf("system", at + 1)) {
+    if (at > 0 && /\w/.test(text[at - 1]))
+      continue;
+    let k = at + 6;
+    while (isBlank(text[k]))
+      k++;
+    if (text[k] === "(")
+      return true;
+  }
+  const words = text.split(/\s+/).slice(1);
+  return words.some((word) => {
+    if (["--from-file", "--rawfile", "--slurpfile", "--library-path"].some((long) => word.startsWith(long)))
+      return true;
+    if (!word.startsWith("-") || word.startsWith("--"))
+      return false;
+    const letters = /^-([A-Za-z]*)/.exec(word)[1];
+    return letters.includes("f") || letters.includes("L");
+  });
 }
-
+var QUOTE_MARK = /['"]/;
+var GLUED_QUOTED_VALUE_OPTION = { cut: "-d" };
+function quoteInsideFlagName(text, start, base) {
+  let end = start;
+  while (end < text.length && !isBlank(text[end]) && text[end] !== "=")
+    end++;
+  const head = text.slice(start, end);
+  const mark = head.search(/['"]/);
+  if (mark === -1)
+    return false;
+  if (Object.hasOwn(GLUED_QUOTED_VALUE_OPTION, base) && GLUED_QUOTED_VALUE_OPTION[base] === head.slice(0, mark))
+    return false;
+  const follower = text[start + mark + 1];
+  return follower === undefined || /[\w'"-]/.test(follower);
+}
+function quoteRunNearDash(text) {
+  for (const run of text.matchAll(/['"]+/g)) {
+    const before = text[run.index - 1];
+    const after = run.index + run[0].length;
+    const opensWord = before === undefined || isBlank(before);
+    let solid = after;
+    while (isBlank(text[solid]))
+      solid++;
+    if (run[0].length >= 2 && (opensWord || before === "$") && text[solid] === "-")
+      return true;
+    if (run[0].length >= 3 && (opensWord || text[after] === "-"))
+      return true;
+  }
+  return false;
+}
+function flagSpelledWithQuotes(lx, base) {
+  const text = lx.text;
+  if (base === "echo" && !/[|&;]/.test(text))
+    return false;
+  if (text.includes("$'") || text.includes('$"') || quoteRunNearDash(text))
+    return true;
+  return wordSpans(lx).some(({ start, end }) => {
+    if (lx.role[start] === 1 /* QuoteMark */)
+      return dequoteShellWord(text.slice(start, end)).startsWith("-");
+    return text[start] === "-" && quoteInsideFlagName(text, start, base);
+  });
+}
+function nextQuoteMark(s, from) {
+  for (let k = from;k < s.length; k++)
+    if (s[k] === "'" || s[k] === '"')
+      return k;
+  return -1;
+}
+function separatorInsideQuoteMarks(outsideSingle) {
+  const s = outsideSingle;
+  const spanHas = (open, chars, mustEndWord) => {
+    const close = nextQuoteMark(s, open + 1);
+    if (close === -1)
+      return false;
+    if (mustEndWord && !(close + 1 === s.length || isBlank(s[close + 1])))
+      return false;
+    for (let k = open + 1;k < close; k++)
+      if (chars.includes(s[k]))
+        return true;
+    return false;
+  };
+  for (let i = 0;i < s.length; i++) {
+    if ((s[i] === "'" || s[i] === '"') && (i === 0 || isBlank(s[i - 1])) && spanHas(i, ";&", true))
+      return true;
+  }
+  for (const [predicate, chars] of [["-name", ";|&"], ["-path", ";|&"], ["-iname", ";|&"], ["-regex", ";&"]]) {
+    for (let at = s.indexOf(predicate);at !== -1; at = s.indexOf(predicate, at + 1)) {
+      let k = at + predicate.length;
+      if (!isBlank(s[k]))
+        continue;
+      while (isBlank(s[k]))
+        k++;
+      if ((s[k] === "'" || s[k] === '"') && spanHas(k, chars, false))
+        return true;
+    }
+  }
+  return false;
+}
+function variableBesideRedirectionOrPipe(view) {
+  const solidBefore = [];
+  let last;
+  for (let i = 0;i < view.length; i++) {
+    solidBefore.push(last);
+    if (!isBlank(view[i]))
+      last = view[i];
+  }
+  const solidFrom = new Array(view.length + 1);
+  for (let i = view.length - 1;i >= 0; i--)
+    solidFrom[i] = isBlank(view[i]) ? solidFrom[i + 1] : view[i];
+  const isRouting = (ch) => ch === "<" || ch === ">" || ch === "|";
+  for (const match of view.matchAll(/\$[A-Za-z_]\w*/g)) {
+    if (isRouting(solidBefore[match.index]) || isRouting(solidFrom[match.index + match[0].length]))
+      return true;
+  }
+  return false;
+}
+function commentHoldsQuoteMark(lx) {
+  let inComment = false;
+  for (let i = 0;i < lx.text.length; i++) {
+    const ch = lx.text[i];
+    if (inComment) {
+      if (ch === `
+`)
+        inComment = false;
+      else if (ch === "'" || ch === '"')
+        return true;
+      continue;
+    }
+    if (ch === "#" && isBare(lx, i))
+      inComment = true;
+  }
+  return false;
+}
+function quotedNewlineBeforeCommentLine(lx) {
+  if (!lx.text.includes(`
+`) || !lx.text.includes("#"))
+    return false;
+  for (let i = 0;i < lx.text.length; i++) {
+    if (lx.text[i] !== `
+` || lx.quoting[i] === 0 /* None */ || lx.role[i] !== 0 /* Text */)
+      continue;
+    let k = i + 1;
+    while (k < lx.text.length && lx.text[k] !== `
+` && isBlank(lx.text[k]))
+      k++;
+    if (lx.text[k] === "#")
+      return true;
+  }
+  return false;
+}
+function lineBreakStartsCommand(bare) {
+  let lastNonBlank = -1;
+  for (let i = bare.length - 1;i >= 0; i--) {
+    if (!isBlank(bare[i])) {
+      lastNonBlank = i;
+      break;
+    }
+  }
+  for (let i = 0;i < lastNonBlank; i++) {
+    if (bare[i] !== `
+` && bare[i] !== "\r")
+      continue;
+    const continuation = i >= 2 && bare[i - 1] === "\\" && isBlank(bare[i - 2]);
+    if (!continuation)
+      return true;
+  }
+  return false;
+}
+function mentionsIfs(text) {
+  if (text.includes("$IFS"))
+    return true;
+  return text.split("}").some((stretch) => {
+    const open = stretch.indexOf("${");
+    return open !== -1 && stretch.includes("IFS", open + 2);
+  });
+}
+function readsProcessEnvironment(text) {
+  return text.split(/[\n\r\u2028\u2029]/).some((line) => {
+    const proc = line.indexOf("/proc/");
+    return proc !== -1 && line.includes("/environ", proc + "/proc/".length);
+  });
+}
+function hasLiveBacktick(lx) {
+  for (let i = 0;i < lx.text.length; i++) {
+    if (lx.text[i] === "`" && lx.quoting[i] !== 1 /* Single */ && lx.role[i] !== 3 /* Escaped */)
+      return true;
+  }
+  return false;
+}
+function escapesBlankOrOperator(lx) {
+  for (let i = 0;i < lx.text.length; i++) {
+    if (lx.role[i] !== 2 /* Escape */ || lx.quoting[i] !== 0 /* None */)
+      continue;
+    const next = lx.text[i + 1];
+    if (next === " " || next === "\t" || ";|&<>".includes(next))
+      return true;
+  }
+  return false;
+}
+function hashInsideWord(bareWithMarks) {
+  const glued = (s) => s.split(/\s+/).some((word) => {
+    for (let at = word.indexOf("#", 1);at !== -1; at = word.indexOf("#", at + 1)) {
+      if (!word.slice(0, at).endsWith("${"))
+        return true;
+    }
+    return false;
+  });
+  return glued(bareWithMarks) || glued(joinLineContinuations(bareWithMarks));
+}
+function hasBraceExpansion(bare, text) {
+  const events = [];
+  let run = 0;
+  for (let i = 0;i < bare.length; i++) {
+    const ch = bare[i];
+    const escaped = run % 2 === 1;
+    run = ch === "\\" ? run + 1 : 0;
+    if ((ch === "{" || ch === "}") && !escaped)
+      events.push(ch === "{" ? "open" : "close");
+    else if (ch === "," || ch === "." && bare[i + 1] === ".")
+      events.push("separator");
+  }
+  const opens = events.filter((e) => e === "open").length;
+  const closes = events.filter((e) => e === "close").length;
+  if (opens > 0 && closes > opens)
+    return true;
+  const owner = [];
+  const ownsSeparator = new Set;
+  for (const [id, event] of events.entries()) {
+    if (event === "open")
+      owner.push(id);
+    else if (event === "separator") {
+      if (owner.length > 0)
+        ownsSeparator.add(owner[owner.length - 1]);
+    } else if (owner.length > 0 && ownsSeparator.has(owner.pop()))
+      return true;
+  }
+  if (opens === 0)
+    return false;
+  for (let i = 0;i + 2 < text.length; i++) {
+    if ((text[i + 1] === "{" || text[i + 1] === "}") && QUOTE_MARK.test(text[i]) && QUOTE_MARK.test(text[i + 2]))
+      return true;
+  }
+  return false;
+}
+var ZSH_DANGEROUS_COMMANDS = new Set([
+  "zmodload",
+  "emulate",
+  "sysopen",
+  "sysread",
+  "syswrite",
+  "sysseek",
+  "zpty",
+  "ztcp",
+  "zsocket",
+  "mapfile",
+  "zf_rm",
+  "zf_mv",
+  "zf_ln",
+  "zf_chmod",
+  "zf_chown",
+  "zf_mkdir",
+  "zf_rmdir",
+  "zf_chgrp"
+]);
+var ZSH_PRECOMMAND_MODIFIERS = new Set(["command", "builtin", "noglob", "nocorrect"]);
+var PROGRAM_AFTER_PREFIXES = new RegExp(`^\\s*(?:(?:[A-Za-z_]\\w*=\\S*|${[...ZSH_PRECOMMAND_MODIFIERS].join("|")})\\s+)*(\\S+)([\\s\\S]*)$`);
+function runsZshBuiltin(text) {
+  const named = PROGRAM_AFTER_PREFIXES.exec(text);
+  if (named === null)
+    return false;
+  const [, program, rest] = named;
+  if (ZSH_DANGEROUS_COMMANDS.has(program))
+    return true;
+  return program === "fc" && rest.split(/\s+/).some((option) => option[0] === "-" && option.indexOf("e", 1) !== -1);
+}
+var occurrences = (s, ch) => {
+  let n = 0;
+  for (const c of s)
+    if (c === ch)
+      n++;
+  return n;
+};
+var unescapedOccurrences = (s, ch) => {
+  let n = 0;
+  for (let i = 0;i < s.length; i++)
+    if (s[i] === ch && s[i - 1] !== "\\")
+      n++;
+  return n;
+};
+function unbalancedWordNearSeparator(lx, bare) {
+  if (!(bare.includes(";") || bare.includes("&&") || bare.includes("||")))
+    return false;
+  if (lx.unterminated)
+    return true;
+  let start = -1;
+  for (let i = 0;i <= lx.text.length; i++) {
+    const cut = i === lx.text.length || isBare(lx, i) && (isBlank(lx.text[i]) || ";&|<>()".includes(lx.text[i]));
+    if (!cut) {
+      if (start === -1)
+        start = i;
+      continue;
+    }
+    if (start === -1)
+      continue;
+    const word = shellWords(lx.text.slice(start, i), false, "broad")[0]?.word ?? "";
+    start = -1;
+    if (occurrences(word, "{") !== occurrences(word, "}") || occurrences(word, "(") !== occurrences(word, ")") || occurrences(word, "[") !== occurrences(word, "]") || unescapedOccurrences(word, '"') % 2 !== 0 || unescapedOccurrences(word, "'") % 2 !== 0) {
+      return true;
+    }
+  }
+  return false;
+}
+var SUBSTITUTION_PATTERNS = [
+  /<\(/,
+  />\(/,
+  /=\(/,
+  /(?:^|[\s;&|])=[a-zA-Z_]/,
+  /\$\(/,
+  /\$\{/,
+  /\$\[/,
+  /~\[/,
+  /\(e:/,
+  /\(\+/,
+  /\}\s*always\s*\{/,
+  /<#/
+];
+var PRE_CHECKS = {
+  unreadable: [
+    (s) => s.text.includes("\r"),
+    (s) => CONTROL_CHARACTERS.test(s.text) || UNICODE_WHITESPACE.test(s.text),
+    (s) => startsMidway(s.text)
+  ],
+  hidesAWord: [
+    (s) => flagSpelledWithQuotes(s.lx, s.base),
+    (s) => hashInsideWord(s.bareWithMarks),
+    (s) => commentHoldsQuoteMark(s.lx),
+    (s) => quotedNewlineBeforeCommentLine(s.lx),
+    (s) => singleQuoteEndsInBackslash(s.lx),
+    (s) => unbalancedWordNearSeparator(s.lx, s.bare)
+  ],
+  smugglesAnOperator: [
+    (s) => lineBreakStartsCommand(s.bare),
+    (s) => s.cleaned.includes("<") || s.cleaned.includes(">"),
+    (s) => variableBesideRedirectionOrPipe(s.cleaned),
+    (s) => escapesBlankOrOperator(s.lx),
+    (s) => separatorInsideQuoteMarks(s.outsideSingle)
+  ],
+  expandsAtRunTime: [
+    (s) => hasLiveBacktick(s.lx),
+    (s) => SUBSTITUTION_PATTERNS.some((pattern) => pattern.test(s.outsideSingle)),
+    (s) => hasBraceExpansion(s.bare, s.text),
+    (s) => mentionsIfs(s.text)
+  ],
+  reachesBeyondItsArguments: [
+    (s) => jqReachesBeyondItsFilter(s.text, s.base),
+    (s) => runsZshBuiltin(s.text),
+    (s) => readsProcessEnvironment(s.text)
+  ]
+};
+function passesSecurityValidators(command) {
+  const program = /^[^ ]*/.exec(command)[0];
+  const lx = lex(command);
+  const views = viewsOf(lx, /^jq$/.test(program));
+  const scanned = { ...views, text: command, lx, base: program, cleaned: withoutHarmlessRedirections(views.bare) };
+  return Object.values(PRE_CHECKS).every((group) => group.every((fires) => !fires(scanned)));
+}
+var PARAMETER_START = /[A-Za-z_@*#?!$0-9-]/;
+function expandsWhenRun(text) {
+  const lx = lex(text);
+  for (let i = 0;i < text.length; i++) {
+    if (lx.role[i] !== 0 /* Text */)
+      continue;
+    const ch = text[i];
+    if (lx.quoting[i] === 0 /* None */ && (ch === "*" || ch === "?" || ch === "[" || ch === "]"))
+      return true;
+    const next = text[i + 1];
+    if (ch === "$" && lx.quoting[i] !== 1 /* Single */ && next !== undefined && PARAMETER_START.test(next))
+      return true;
+  }
+  return false;
+}
+function takesPatterns(simple) {
+  const [first, second] = simple.words.map((w) => w.value);
+  return ["grep", "rg", "fd", "fdfind", "find", "sed"].includes(first ?? "") || first === "git" && second === "grep";
+}
+function keptBackslashMisleads(simple) {
+  const patterns = takesPatterns(simple);
+  return simple.words.some((word) => {
+    if (!word.value.startsWith("\\"))
+      return false;
+    const broad = shellWords(word.raw, false, "broad")[0]?.word ?? "";
+    if (broad.startsWith("\\"))
+      return false;
+    const after = word.value[1];
+    return !patterns || after !== undefined && "-+{}".includes(after);
+  });
+}
+var GIT_CONFIGURING_OPTION = /\s(?:-c|--exec-path|--config-env)[\s=]/;
+function matchesReadOnlyPattern(simple) {
+  if (simple.words.some((w) => w.value.startsWith("-") && w.raw.includes("\\")))
+    return false;
+  const matched = READ_ONLY_REGEXES.some((regex) => regex.test(simple.text)) || findOnlyLists(simple);
+  return matched && !(simple.text.includes("git") && GIT_CONFIGURING_OPTION.test(simple.text));
+}
+function isSimpleCommandReadOnly(simple, platform) {
+  const refused = containsVulnerableUncPath(simple.text, platform) || expandsWhenRun(simple.text) || keptBackslashMisleads(simple);
+  return !refused && (isSafeViaFlagAllowlist(simple, platform) || matchesReadOnlyPattern(simple));
+}
+var takes = (kind, ...names) => Object.fromEntries(names.map((name) => [name, kind]));
+var GIT_REF_SELECTION = takes("none", "--all", "--branches", "--tags", "--remotes");
+var GIT_DATE_FILTERS = takes("string", "--since", "--after", "--until", "--before");
+var GIT_LOG_DISPLAY = { ...takes("none", "--oneline", "--graph", "--decorate", "--no-decorate", "--relative-date"), ...takes("string", "--date") };
+var GIT_COUNT = takes("number", "--max-count", "-n");
+var GIT_STAT = takes("none", "--stat", "--numstat", "--shortstat", "--name-only", "--name-status");
+var GIT_COLOR = takes("none", "--color", "--no-color");
+var GIT_PATCH = takes("none", "--patch", "-p", "--no-patch", "--no-ext-diff", "-s");
+var GIT_AUTHOR_FILTERS = takes("string", "--author", "--committer", "--grep");
+var REFLOG_WRITING_SUBCOMMANDS = new Set(["expire", "delete", "exists"]);
+var reflogWrites = (_text, args) => args.some((arg) => REFLOG_WRITING_SUBCOMMANDS.has(arg));
+function namesNewRef(args, flags, optionalValue) {
+  let listing = false;
+  let optionsOver = false;
+  let lastOption = "";
+  for (let i = 0;i < args.length; i++) {
+    const token = args[i];
+    if (token === "")
+      continue;
+    const word = optionsOver ? { form: "operand" } : readOptionWord(token);
+    if (word.form === "end-of-options") {
+      optionsOver = true;
+      lastOption = "";
+    } else if (word.form === "operand") {
+      if (!listing && !optionalValue.has(lastOption))
+        return true;
+    } else {
+      lastOption = word.form === "long" ? word.name : `-${word.letters}`;
+      if (word.inline !== undefined)
+        continue;
+      if (lastOption === "--list" || word.form === "short" && word.letters.includes("l"))
+        listing = true;
+      const kind = kindOf(flags, lastOption);
+      if (kind === "number" || kind === "string" || kind === "char")
+        i++;
+    }
+  }
+  return false;
+}
+var BRANCH_OPTIONAL_COMMIT = new Set(["--merged", "--no-merged"]);
+var GIT_TAG_FLAGS = {
+  ...takes("none", "-l", "--list", "--column", "--no-column", "-i", "--ignore-case"),
+  ...takes("number", "-n"),
+  ...takes("string", "--contains", "--no-contains", "--merged", "--no-merged", "--sort", "--format", "--points-at")
+};
+var GIT_BRANCH_FLAGS = {
+  ...takes("none", "-l", "--list", "-a", "--all", "-r", "--remotes", "-v", "-vv", "--verbose", "--color", "--no-color", "--column", "--no-column", "--no-abbrev", "--merged", "--no-merged", "--show-current", "-i", "--ignore-case"),
+  ...takes("attached", "--abbrev"),
+  ...takes("string", "--contains", "--no-contains", "--points-at", "--sort")
+};
+var BASE64_FLAGS = {
+  ...takes("none", "-d", "-D", "--decode", "--ignore-garbage", "-h", "--help", "--version"),
+  ...takes("number", "-b", "--break", "-w", "--wrap"),
+  ...takes("string", "-i", "--input")
+};
+var DATE_FLAGS = {
+  ...takes("string", "-d", "--date", "-r", "--reference"),
+  ...takes("attached", "--iso-8601", "--rfc-3339"),
+  ...takes("none", "-u", "--utc", "--universal", "-I", "-R", "--rfc-email", "--debug", "--help", "--version")
+};
+function dateSetsClock(_text, args) {
+  return operandsOf(args, DATE_FLAGS).some((operand) => !operand.startsWith("+"));
+}
+var TPUT_DANGEROUS_CAPABILITIES = new Set([
+  "init",
+  "reset",
+  "rs1",
+  "rs2",
+  "rs3",
+  "is1",
+  "is2",
+  "is3",
+  "iprog",
+  "if",
+  "rf",
+  "clear",
+  "flash",
+  "mc0",
+  "mc4",
+  "mc5",
+  "mc5i",
+  "mc5p",
+  "pfkey",
+  "pfloc",
+  "pfx",
+  "pfxl",
+  "smcup",
+  "rmcup"
+]);
+var TPUT_FLAGS = { ...takes("string", "-T"), ...takes("none", "-V", "-x") };
+function tputChangesTerminal(_text, args) {
+  const { options, operands } = partitionArguments(args, TPUT_FLAGS);
+  const readsStdin = options.some((option) => !option.startsWith("--") && option.split("=")[0].includes("S"));
+  return readsStdin || operands.some((operand) => TPUT_DANGEROUS_CAPABILITIES.has(operand));
+}
+var REMOTE_NAME = /^[a-zA-Z0-9_-]+$/;
+function remoteShowReachesBeyondOneRemote(_text, args) {
+  let names = 0;
+  for (const arg of args) {
+    if (arg === "-n")
+      continue;
+    if (!REMOTE_NAME.test(arg))
+      return true;
+    names++;
+  }
+  return names !== 1;
+}
+var REMOTE_LISTING_OPTIONS = new Set(["-v", "--verbose"]);
+var remoteDoesMoreThanList = (_text, args) => !args.every((arg) => REMOTE_LISTING_OPTIONS.has(arg));
+var psPrintsEnvironments = (_text, args) => args.some((arg) => /^[a-zA-Z]+$/.test(arg) && arg.includes("e"));
+var lsofWritesMountSupplement = (_text, args) => args.some((arg) => arg.slice(0, 2) === "+m");
+var pyrightWatches = (_text, args) => args.includes("--watch") || args.includes("-w");
+var FD_FLAGS = {
+  ...takes("none", "-h", "--help", "-V", "--version", "-H", "--hidden", "-I", "--no-ignore", "--no-ignore-vcs", "--no-ignore-parent", "-s", "--case-sensitive", "-i", "--ignore-case", "-g", "--glob", "--regex", "-F", "--fixed-strings", "-a", "--absolute-path", "-L", "--follow", "-p", "--full-path", "-0", "--print0", "-1", "-q", "--quiet", "--show-errors", "--strip-cwd-prefix", "--one-file-system", "--prune", "--no-require-git"),
+  ...takes("number", "-d", "--max-depth", "--min-depth", "--exact-depth", "-j", "--threads", "--max-results", "--batch-size"),
+  ...takes("string", "-t", "--type", "-e", "--extension", "-S", "--size", "--changed-within", "--changed-before", "-o", "--owner", "-E", "--exclude", "--ignore-file", "-c", "--color", "--max-buffer-time", "--search-path", "--base-directory", "--path-separator", "--hyperlink", "--and", "--format")
+};
+var CHECKSUM_FLAGS = takes("none", "-b", "--binary", "-t", "--text", "-c", "--check", "--ignore-missing", "--quiet", "--status", "--strict", "-w", "--warn", "--tag", "-z", "--zero", "--help", "--version");
+var COMMAND_SPECS = [
+  [
+    "xargs",
+    {
+      flags: { ...takes("{}", "-I"), ...takes("number", "-n", "-P", "-L", "-s"), ...takes("EOF", "-E"), ...takes("none", "-0", "-t", "-r", "-x"), ...takes("char", "-d") }
+    }
+  ],
+  [
+    "git diff",
+    {
+      flags: {
+        ...GIT_STAT,
+        ...GIT_COLOR,
+        ...takes("none", "--dirstat", "--summary", "--patch-with-stat", "--word-diff", "--color-words", "--no-renames", "--no-ext-diff", "--check", "--full-index", "--binary", "--break-rewrites", "--find-renames", "--find-copies", "--find-copies-harder", "--irreversible-delete", "--histogram", "--patience", "--minimal", "--ignore-space-at-eol", "--ignore-space-change", "--ignore-all-space", "--ignore-blank-lines", "--function-context", "--exit-code", "--quiet", "--cached", "--staged", "--pickaxe-regex", "--pickaxe-all", "--no-index", "-p", "-u", "-s", "-M", "-C", "-B", "-D", "-l", "-R"),
+        ...takes("string", "--word-diff-regex", "--ws-error-highlight", "--diff-algorithm", "--relative", "--diff-filter", "-S", "-G", "-O"),
+        ...takes("number", "--abbrev", "--inter-hunk-context")
+      }
+    }
+  ],
+  [
+    "git log",
+    {
+      flags: {
+        ...GIT_LOG_DISPLAY,
+        ...GIT_REF_SELECTION,
+        ...GIT_DATE_FILTERS,
+        ...GIT_COUNT,
+        ...GIT_STAT,
+        ...GIT_COLOR,
+        ...GIT_PATCH,
+        ...GIT_AUTHOR_FILTERS,
+        ...takes("none", "--abbrev-commit", "--full-history", "--dense", "--sparse", "--simplify-merges", "--ancestry-path", "--source", "--first-parent", "--merges", "--no-merges", "--reverse", "--walk-reflogs", "--no-min-parents", "--no-max-parents", "--follow", "--no-walk", "--left-right", "--cherry-mark", "--cherry-pick", "--boundary", "--topo-order", "--date-order", "--author-date-order", "--pickaxe-regex", "--pickaxe-all"),
+        ...takes("number", "--skip", "--max-age", "--min-age"),
+        ...takes("string", "--pretty", "--format", "--diff-filter", "-S", "-G")
+      }
+    }
+  ],
+  [
+    "git show",
+    {
+      flags: {
+        ...GIT_LOG_DISPLAY,
+        ...GIT_STAT,
+        ...GIT_COLOR,
+        ...GIT_PATCH,
+        ...takes("none", "--abbrev-commit", "--word-diff", "--color-words", "--first-parent", "--raw", "-m", "--quiet"),
+        ...takes("string", "--word-diff-regex", "--pretty", "--format", "--diff-filter")
+      }
+    }
+  ],
+  [
+    "git shortlog",
+    {
+      flags: {
+        ...GIT_REF_SELECTION,
+        ...GIT_DATE_FILTERS,
+        ...takes("none", "-s", "--summary", "-n", "--numbered", "-e", "--email", "-c", "--committer", "--no-merges"),
+        ...takes("string", "--group", "--format", "--author")
+      }
+    }
+  ],
+  ["git reflog", { respectsDoubleDash: false, flags: { ...GIT_LOG_DISPLAY, ...GIT_REF_SELECTION, ...GIT_DATE_FILTERS, ...GIT_COUNT, ...GIT_AUTHOR_FILTERS }, dangerous: reflogWrites }],
+  ["git stash list", { respectsDoubleDash: false, flags: { ...GIT_LOG_DISPLAY, ...GIT_REF_SELECTION, ...GIT_COUNT } }],
+  [
+    "git ls-remote",
+    {
+      respectsDoubleDash: false,
+      flags: {
+        ...takes("none", "--branches", "-b", "--tags", "-t", "--heads", "-h", "--refs", "--quiet", "-q", "--exit-code", "--get-url", "--symref"),
+        ...takes("string", "--sort")
+      }
+    }
+  ],
+  [
+    "git status",
+    {
+      flags: {
+        ...takes("none", "--short", "-s", "--branch", "-b", "--porcelain", "--long", "--verbose", "-v", "--ignored", "--column", "--no-column", "--ahead-behind", "--no-ahead-behind", "--renames", "--no-renames"),
+        ...takes("string", "--untracked-files", "-u", "--ignore-submodules", "--find-renames", "-M")
+      }
+    }
+  ],
+  [
+    "git blame",
+    {
+      flags: {
+        ...GIT_COLOR,
+        ...takes("string", "-L", "--date", "--ignore-rev", "--ignore-revs-file"),
+        ...takes("none", "--porcelain", "-p", "--line-porcelain", "--incremental", "--root", "--show-stats", "--show-name", "--show-number", "-n", "--show-email", "-e", "-f", "-w", "-M", "-C", "--score-debug", "-s", "-l", "-t"),
+        ...takes("number", "--abbrev")
+      }
+    }
+  ],
+  [
+    "git ls-files",
+    {
+      flags: {
+        ...takes("none", "--cached", "-c", "--deleted", "-d", "--modified", "-m", "--others", "-o", "--ignored", "-i", "--stage", "-s", "--killed", "-k", "--unmerged", "-u", "--directory", "--no-empty-directory", "--eol", "--full-name", "--debug", "-z", "-t", "-v", "-f", "--exclude-standard", "--error-unmatch", "--recurse-submodules"),
+        ...takes("number", "--abbrev"),
+        ...takes("string", "--exclude", "-x", "--exclude-from", "-X", "--exclude-per-directory")
+      }
+    }
+  ],
+  [
+    "git config --get",
+    {
+      flags: {
+        ...takes("none", "--local", "--global", "--system", "--worktree", "--bool", "--int", "--bool-or-int", "--path", "--expiry-date", "-z", "--null", "--name-only", "--show-origin", "--show-scope"),
+        ...takes("string", "--default", "--type")
+      }
+    }
+  ],
+  [
+    "git remote show",
+    {
+      flags: takes("none", "-n"),
+      dangerous: remoteShowReachesBeyondOneRemote
+    }
+  ],
+  ["git remote", { flags: takes("none", "-v", "--verbose"), dangerous: remoteDoesMoreThanList }],
+  ["git merge-base", { flags: takes("none", "--is-ancestor", "--fork-point", "--octopus", "--independent", "--all") }],
+  [
+    "git rev-parse",
+    {
+      flags: {
+        ...takes("none", "--verify", "--abbrev-ref", "--symbolic", "--symbolic-full-name", "--show-toplevel", "--show-cdup", "--show-prefix", "--git-dir", "--git-common-dir", "--absolute-git-dir", "--show-superproject-working-tree", "--is-inside-work-tree", "--is-inside-git-dir", "--is-bare-repository", "--is-shallow-repository", "--is-shallow-update", "--path-prefix"),
+        ...takes("string", "--short")
+      }
+    }
+  ],
+  [
+    "git rev-list",
+    {
+      flags: {
+        ...GIT_REF_SELECTION,
+        ...GIT_DATE_FILTERS,
+        ...GIT_COUNT,
+        ...GIT_AUTHOR_FILTERS,
+        ...takes("none", "--count", "--reverse", "--first-parent", "--ancestry-path", "--merges", "--no-merges", "--no-min-parents", "--no-max-parents", "--walk-reflogs", "--oneline", "--abbrev-commit", "--full-history", "--dense", "--sparse", "--source", "--graph"),
+        ...takes("number", "--min-parents", "--max-parents", "--skip", "--max-age", "--min-age", "--abbrev"),
+        ...takes("string", "--pretty", "--format")
+      }
+    }
+  ],
+  [
+    "git describe",
+    {
+      flags: {
+        ...takes("none", "--tags", "--long", "--always", "--contains", "--first-match", "--exact-match", "--dirty", "--broken"),
+        ...takes("string", "--match", "--exclude"),
+        ...takes("number", "--abbrev", "--candidates")
+      }
+    }
+  ],
+  ["git cat-file", { flags: takes("none", "-t", "-s", "-p", "-e", "--batch-check", "--allow-undetermined-type") }],
+  [
+    "git for-each-ref",
+    {
+      flags: {
+        ...takes("string", "--format", "--sort", "--contains", "--no-contains", "--merged", "--no-merged", "--points-at"),
+        ...takes("number", "--count")
+      }
+    }
+  ],
+  [
+    "git grep",
+    {
+      flags: {
+        ...takes("string", "-e"),
+        ...takes("none", "-E", "--extended-regexp", "-G", "--basic-regexp", "-F", "--fixed-strings", "-P", "--perl-regexp", "-i", "--ignore-case", "-v", "--invert-match", "-w", "--word-regexp", "-n", "--line-number", "-c", "--count", "-l", "--files-with-matches", "-L", "--files-without-match", "-h", "-H", "--heading", "--break", "--full-name", "--color", "--no-color", "-o", "--only-matching", "--and", "--or", "--not", "--untracked", "--no-index", "--recurse-submodules", "--cached", "-q", "--quiet"),
+        ...takes("number", "-A", "--after-context", "-B", "--before-context", "-C", "--context", "--max-depth", "--threads")
+      }
+    }
+  ],
+  [
+    "git stash show",
+    {
+      respectsDoubleDash: false,
+      flags: {
+        ...GIT_STAT,
+        ...GIT_COLOR,
+        ...GIT_PATCH,
+        ...takes("none", "--word-diff"),
+        ...takes("string", "--word-diff-regex", "--diff-filter"),
+        ...takes("number", "--abbrev")
+      }
+    }
+  ],
+  ["git worktree list", { flags: { ...takes("none", "--porcelain", "-v", "--verbose"), ...takes("string", "--expire") } }],
+  ["git tag", { flags: GIT_TAG_FLAGS, dangerous: (_text, args) => namesNewRef(args, GIT_TAG_FLAGS, new Set) }],
+  ["git branch", { flags: GIT_BRANCH_FLAGS, dangerous: (_text, args) => namesNewRef(args, GIT_BRANCH_FLAGS, BRANCH_OPTIONAL_COMMIT) }],
+  [
+    "file",
+    {
+      flags: {
+        ...takes("none", "--brief", "-b", "--mime", "-i", "--mime-type", "--mime-encoding", "--apple", "--check-encoding", "-c", "--print0", "-0", "--help", "--version", "-v", "--no-dereference", "-h", "--dereference", "-L", "--keep-going", "-k", "--list", "-l", "--no-buffer", "-n", "--preserve-date", "-p", "--raw", "-r", "-s", "--special-files", "--uncompress", "-z"),
+        ...takes("string", "--exclude", "--exclude-quiet", "-f", "-F", "--separator", "--magic-file", "-m")
+      }
+    }
+  ],
+  [
+    "sed",
+    {
+      flags: {
+        ...takes("string", "--expression", "-e"),
+        ...takes("none", "--quiet", "--silent", "-n", "--regexp-extended", "-r", "--posix", "-E", "--zero-terminated", "-z", "--separate", "-s", "--unbuffered", "-u", "--debug", "--help", "--version"),
+        ...takes("number", "--line-length", "-l")
+      },
+      dangerous: (text, args) => !sedIsAllowed(text, args)
+    }
+  ],
+  [
+    "sort",
+    {
+      flags: {
+        ...takes("none", "--ignore-leading-blanks", "-b", "--dictionary-order", "-d", "--ignore-case", "-f", "--general-numeric-sort", "-g", "--human-numeric-sort", "-h", "--ignore-nonprinting", "-i", "--month-sort", "-M", "--numeric-sort", "-n", "--random-sort", "-R", "--reverse", "-r", "--stable", "-s", "--unique", "-u", "--version-sort", "-V", "--zero-terminated", "-z", "--check", "-c", "--check-char-order", "-C", "--merge", "-m", "--help", "--version"),
+        ...takes("string", "--sort", "--key", "-k", "--field-separator", "-t", "--buffer-size", "-S"),
+        ...takes("number", "--parallel", "--batch-size")
+      }
+    }
+  ],
+  ["man", { flags: { ...takes("none", "-a", "--all", "-d", "-f", "--whatis", "-h", "-k", "--apropos", "-w"), ...takes("string", "-l", "-S", "-s") } }],
+  ["help", { flags: takes("none", "-d", "-m", "-s") }],
+  ["netstat", { flags: { ...takes("none", "-a", "-L", "-l", "-n", "-g", "-i", "-s", "-r", "-m", "-v"), ...takes("string", "-f", "-I") } }],
+  [
+    "ps",
+    {
+      flags: {
+        ...takes("none", "-e", "-A", "-a", "-d", "-N", "--deselect", "-f", "-F", "-l", "-j", "-y", "-w", "-ww", "-c", "-H", "--forest", "--headers", "--no-headers", "-L", "-T", "-m", "--help", "--info", "-V", "--version"),
+        ...takes("number", "--width"),
+        ...takes("string", "-n", "--sort", "-C", "-G", "-g", "-p", "--pid", "-q", "--quick-pid", "-s", "--sid", "-t", "--tty", "-U", "-u", "--user")
+      },
+      dangerous: psPrintsEnvironments
+    }
+  ],
+  [
+    "base64",
+    {
+      respectsDoubleDash: false,
+      flags: BASE64_FLAGS,
+      dangerous: (_text, args) => operandsOf(args, BASE64_FLAGS).length > 1
+    }
+  ],
+  [
+    "grep",
+    {
+      flags: {
+        ...takes("string", "-e", "--regexp", "-f", "--file", "--color", "--colour", "--label", "--group-separator", "--binary-files", "-D", "--devices", "-d", "--directories", "--exclude", "--exclude-from", "--exclude-dir", "--include"),
+        ...takes("none", "-F", "--fixed-strings", "-G", "--basic-regexp", "-E", "--extended-regexp", "-P", "--perl-regexp", "-i", "--ignore-case", "--no-ignore-case", "-v", "--invert-match", "-w", "--word-regexp", "-x", "--line-regexp", "-c", "--count", "-L", "--files-without-match", "-l", "--files-with-matches", "-o", "--only-matching", "-q", "--quiet", "--silent", "-s", "--no-messages", "-b", "--byte-offset", "-H", "--with-filename", "-h", "--no-filename", "-n", "--line-number", "-T", "--initial-tab", "-u", "--unix-byte-offsets", "-Z", "--null", "-z", "--null-data", "--no-group-separator", "-a", "--text", "-r", "--recursive", "-R", "--dereference-recursive", "--line-buffered", "-U", "--binary", "--help", "-V", "--version"),
+        ...takes("number", "-m", "--max-count", "-A", "--after-context", "-B", "--before-context", "-C", "--context")
+      }
+    }
+  ],
+  [
+    "rg",
+    {
+      flags: {
+        ...takes("string", "-e", "--regexp", "-f", "-g", "--glob", "-t", "--type", "-T", "--type-not", "--color"),
+        ...takes("none", "-i", "--ignore-case", "-S", "--smart-case", "-F", "--fixed-strings", "-w", "--word-regexp", "-v", "--invert-match", "-c", "--count", "-l", "--files-with-matches", "--files-without-match", "-n", "--line-number", "-o", "--only-matching", "-H", "-h", "--heading", "--no-heading", "-q", "--quiet", "--column", "--type-list", "--hidden", "--no-ignore", "-u", "-a", "--text", "-z", "-L", "--follow", "--json", "--stats", "--help", "--version", "--debug", "--"),
+        ...takes("number", "-A", "--after-context", "-B", "--before-context", "-C", "--context", "-m", "--max-count", "-d", "--max-depth")
+      }
+    }
+  ],
+  ["sha256sum", { flags: CHECKSUM_FLAGS }],
+  ["sha1sum", { flags: CHECKSUM_FLAGS }],
+  ["md5sum", { flags: CHECKSUM_FLAGS }],
+  [
+    "tree",
+    {
+      respectsDoubleDash: false,
+      flags: {
+        ...takes("none", "-a", "-d", "-l", "-f", "-x", "--gitignore", "--ignore-case", "--matchdirs", "--metafirst", "--prune", "--info", "--noreport", "-q", "-N", "-Q", "-p", "-u", "-g", "-s", "-h", "--si", "--du", "-D", "-F", "--inodes", "--device", "-v", "-t", "-c", "-U", "-r", "--dirsfirst", "--filesfirst", "-i", "-A", "-S", "-n", "-C", "-X", "-J", "--nolinks", "--hyperlink", "--fromfile", "--fromtabfile", "--fflinks", "--help", "--version"),
+        ...takes("number", "-L", "--filelimit"),
+        ...takes("string", "-P", "-I", "--gitfile", "--infofile", "--charset", "--timefmt", "--sort", "-H", "--hintro", "--houtro", "-T", "--scheme", "--authority")
+      }
+    }
+  ],
+  [
+    "date",
+    {
+      flags: DATE_FLAGS,
+      dangerous: dateSetsClock
+    }
+  ],
+  [
+    "hostname",
+    {
+      flags: takes("none", "-f", "--fqdn", "--long", "-s", "--short", "-i", "--ip-address", "-I", "--all-ip-addresses", "-a", "--alias", "-d", "--domain", "-A", "--all-fqdns", "-v", "--verbose", "-h", "--help", "-V", "--version"),
+      pattern: /^hostname(?:\s+(?:-[a-zA-Z]|--[a-zA-Z-]+))*\s*$/
+    }
+  ],
+  [
+    "info",
+    {
+      flags: {
+        ...takes("string", "-f", "--file", "-d", "--directory", "-n", "--node", "-k", "--apropos"),
+        ...takes("none", "-a", "--all", "-w", "--where", "--location", "--show-options", "--vi-keys", "--subnodes", "-h", "--help", "--usage", "--version")
+      }
+    }
+  ],
+  [
+    "lsof",
+    {
+      respectsDoubleDash: false,
+      flags: {
+        ...takes("none", "-?", "-h", "-v", "-a", "-b", "-C", "-l", "-n", "-N", "-O", "-P", "-Q", "-R", "-t", "-U", "-V", "-X", "-H", "-E", "-F", "-g", "-i", "-K", "-L", "-o", "-r", "-s", "-S", "-T", "-x"),
+        ...takes("string", "-A", "-c", "-d", "-e", "-k", "-p", "-u")
+      },
+      dangerous: lsofWritesMountSupplement
+    }
+  ],
+  [
+    "pgrep",
+    {
+      flags: {
+        ...takes("string", "-d", "--delimiter", "-g", "--pgroup", "-G", "--group", "-O", "--older", "-P", "--parent", "-s", "--session", "-t", "--terminal", "-u", "--euid", "-U", "--uid", "-F", "--pidfile", "-r", "--runstates", "--ns", "--nslist"),
+        ...takes("none", "-l", "--list-name", "-a", "--list-full", "-v", "--inverse", "-w", "--lightweight", "-c", "--count", "-f", "--full", "-i", "--ignore-case", "-n", "--newest", "-o", "--oldest", "-x", "--exact", "-L", "--logpidfile", "--help", "-V", "--version")
+      }
+    }
+  ],
+  ["tput", { flags: TPUT_FLAGS, dangerous: tputChangesTerminal }],
+  [
+    "ss",
+    {
+      flags: {
+        ...takes("none", "-h", "--help", "-V", "--version", "-n", "--numeric", "-r", "--resolve", "-a", "--all", "-l", "--listening", "-o", "--options", "-e", "--extended", "-m", "--memory", "-p", "--processes", "-i", "--info", "-s", "--summary", "-4", "--ipv4", "-6", "--ipv6", "-0", "--packet", "-t", "--tcp", "-M", "--mptcp", "-S", "--sctp", "-u", "--udp", "-d", "--dccp", "-w", "--raw", "-x", "--unix", "--tipc", "--vsock", "-Z", "--context", "-z", "--contexts", "-b", "--bpf", "-E", "--events", "-H", "--no-header", "-O", "--oneline", "--tipcinfo", "--tos", "--cgroup", "--inet-sockopt"),
+        ...takes("string", "-f", "--family", "-A", "--query", "--socket")
+      }
+    }
+  ],
+  ["fd", { flags: FD_FLAGS }],
+  ["fdfind", { flags: FD_FLAGS }],
+  [
+    "pyright",
+    {
+      respectsDoubleDash: false,
+      flags: {
+        ...takes("none", "--outputjson", "--stats", "--verbose", "--version", "--dependencies", "--warnings"),
+        ...takes("string", "--project", "-p", "--pythonversion", "--pythonplatform", "--typeshedpath", "--venvpath", "--level")
+      },
+      dangerous: pyrightWatches
+    }
+  ],
+  ["docker logs", { flags: { ...takes("none", "--follow", "-f", "--timestamps", "-t", "--details"), ...takes("string", "--tail", "-n", "--since", "--until") } }],
+  ["docker inspect", { flags: { ...takes("string", "--format", "-f", "--type"), ...takes("none", "--size", "-s") } }]
+];
+var XARGS_SAFE_TARGETS = new Set(["echo", "printf", "wc", "grep", "head", "tail"]);
+function readOptionWord(token) {
+  if (token === "--")
+    return { form: "end-of-options" };
+  if (token.length < 2 || !token.startsWith("-"))
+    return { form: "operand" };
+  const eq = token.indexOf("=");
+  const head = eq === -1 ? token : token.slice(0, eq);
+  const inline = eq === -1 ? undefined : token.slice(eq + 1);
+  if (head.startsWith("--"))
+    return inline === undefined ? { form: "long", name: head } : { form: "long", name: head, inline };
+  const letters = head.slice(1);
+  return inline === undefined ? { form: "short", letters } : { form: "short", letters, inline };
+}
+var looksLikeOption = (token) => token.length > 1 && token.startsWith("-");
+function kindOf(flags, name) {
+  return Object.hasOwn(flags, name) ? flags[name] : undefined;
+}
+function valueFits(kind, value, flag, command) {
+  switch (kind) {
+    case "number":
+      return /^\d+$/.test(value);
+    case "string":
+    case "attached":
+      return !value.startsWith("-") || command === "git" && flag === "--sort" && /^-[a-zA-Z]/.test(value);
+    case "char":
+      return value.length === 1;
+    case "{}":
+    case "EOF":
+      return value === kind;
+    default:
+      return false;
+  }
+}
+function acceptOption(tokens, i, flags, command) {
+  const word = readOptionWord(tokens[i]);
+  if (word.form !== "long" && word.form !== "short")
+    return null;
+  const name = word.form === "long" ? word.name : `-${word.letters}`;
+  const kind = kindOf(flags, name);
+  if (kind !== undefined) {
+    if (kind === "none")
+      return word.inline === undefined ? 1 : null;
+    if (kind === "attached")
+      return word.inline !== undefined && valueFits(kind, word.inline, name, command) ? 1 : null;
+    if (word.inline !== undefined)
+      return valueFits(kind, word.inline, name, command) ? 1 : null;
+    const value = tokens[i + 1];
+    if (value === undefined || looksLikeOption(value))
+      return null;
+    return valueFits(kind, value, name, command) ? 2 : null;
+  }
+  if (word.form === "long" || word.inline !== undefined)
+    return null;
+  if (command === "git" && /^\d+$/.test(word.letters))
+    return 1;
+  if (command === "grep" || command === "rg") {
+    const leading = kindOf(flags, `-${word.letters[0]}`);
+    if ((leading === "number" || leading === "string") && /^\d+$/.test(word.letters.slice(1)))
+      return 1;
+  }
+  for (const letter of word.letters) {
+    if (kindOf(flags, `-${letter}`) !== "none")
+      return null;
+  }
+  return 1;
+}
+function optionsAllowed(tokens, start, spec, command) {
+  let i = start;
+  while (i < tokens.length) {
+    const word = readOptionWord(tokens[i]);
+    if (word.form === "operand") {
+      i++;
+      continue;
+    }
+    if (word.form === "end-of-options") {
+      if (spec.respectsDoubleDash !== false)
+        return true;
+      i++;
+      continue;
+    }
+    const used = acceptOption(tokens, i, spec.flags, command);
+    if (used === null)
+      return false;
+    i += used;
+  }
+  return true;
+}
+function xargsAllowed(tokens, start, spec) {
+  let i = start;
+  while (i < tokens.length) {
+    const word = readOptionWord(tokens[i]);
+    if (word.form === "end-of-options") {
+      const target = tokens[i + 1];
+      return target !== undefined && XARGS_SAFE_TARGETS.has(target);
+    }
+    if (word.form === "operand")
+      return XARGS_SAFE_TARGETS.has(tokens[i]);
+    const used = acceptOption(tokens, i, spec.flags, "xargs");
+    if (used === null)
+      return false;
+    i += used;
+  }
+  return true;
+}
+function operandsOf(args, flags) {
+  return partitionArguments(args, flags).operands;
+}
+function partitionArguments(args, flags) {
+  const options = [];
+  const operands = [];
+  let optionsOver = false;
+  for (let i = 0;i < args.length; i++) {
+    const token = args[i];
+    const word = optionsOver ? { form: "operand" } : readOptionWord(token);
+    if (word.form === "end-of-options")
+      optionsOver = true;
+    else if (word.form === "operand")
+      operands.push(token);
+    else {
+      options.push(token);
+      const kind = word.inline === undefined ? kindOf(flags, word.form === "long" ? word.name : `-${word.letters}`) : undefined;
+      if (kind === "number" || kind === "string" || kind === "char" || kind === "{}" || kind === "EOF")
+        i++;
+    }
+  }
+  return { options, operands };
+}
+var SPEC_LEADING_WORDS = COMMAND_SPECS.map(([name, spec]) => ({ leading: name.split(" "), spec }));
+function commandSpecFor(tokens, platform) {
+  const entry = SPEC_LEADING_WORDS.find(({ leading }) => leading.every((word, k) => tokens[k] === word) && !(leading[0] === "xargs" && platform === "win32"));
+  return entry && { spec: entry.spec, words: entry.leading.length };
+}
+var namesRemoteLocation = (token) => token.length > 0 && !token.startsWith("-") && (token.includes("://") || token.includes("@") || token.includes(":") || token.includes("$"));
+var expandsAtRunTime = (token) => token.includes("$") || token.includes("{") && (token.includes(",") || token.includes(".."));
+function isSafeViaFlagAllowlist(sub, platform) {
+  const tokens = sub.words.map((w) => w.value);
+  const match = commandSpecFor(tokens, platform);
+  if (match === undefined)
+    return false;
+  const { spec, words } = match;
+  const args = tokens.slice(words);
+  if (args.some(expandsAtRunTime))
+    return false;
+  if (tokens[0] === "git" && tokens[1] === "ls-remote" && args.some(namesRemoteLocation))
+    return false;
+  const optionsOk = tokens[0] === "xargs" ? xargsAllowed(tokens, words, spec) : optionsAllowed(tokens, words, spec, tokens[0]);
+  if (!optionsOk)
+    return false;
+  if (spec.pattern !== undefined) {
+    if (!spec.pattern.test(sub.text))
+      return false;
+  } else if (sub.text.includes("`") || (tokens[0] === "rg" || tokens[0] === "grep") && /[\n\r]/.test(sub.text)) {
+    return false;
+  }
+  return !(spec.dangerous?.(sub.text, args) ?? false);
+}
+var SED_QUIET = ["-n", "--quiet", "--silent"];
+var SED_PRINT_OPTIONS = { long: ["--quiet", "--silent", "--regexp-extended", "--zero-terminated", "--posix"], letters: "nErz" };
+var SED_SUBSTITUTE_OPTIONS = { long: ["--regexp-extended", "--posix"], letters: "Er" };
+function sedOptionsWithin(options, allowed) {
+  return options.every((option) => option.startsWith("--") ? allowed.long.includes(option) : option.length > 1 && [...option.slice(1)].every((letter) => allowed.letters.includes(letter)));
+}
+var SED_PRINT_SCRIPT = /^(?:\d+(?:,\d+)?)?p\s*(?:;\s*(?:\d+(?:,\d+)?)?p\s*)*$/;
+function sedPrintScript(script) {
+  const trimmed = script.trim();
+  return !trimmed.includes(`
+`) && SED_PRINT_SCRIPT.test(trimmed);
+}
+function sedSubstituteScript(script) {
+  const s = script.trim();
+  if (!s.startsWith("s/") || occurrences(s, "/") !== 3)
+    return false;
+  const delimiters = [];
+  for (let i = 0;i < s.length; i++) {
+    if (s[i] === "\\") {
+      if (s[i + 1] === "/")
+        return false;
+      i++;
+      continue;
+    }
+    if (s[i] === "/")
+      delimiters.push(i);
+  }
+  if (delimiters.length !== 3)
+    return false;
+  if (!/^[gpimIM]*[1-9]?[gpimIM]*$/.test(s.slice(delimiters[2] + 1)))
+    return false;
+  for (let i = 0;i < s.length; i++) {
+    const ch = s[i];
+    const code = ch.charCodeAt(0);
+    if (code === 0 || code > 127)
+      return false;
+    if (`
+{}#;!~`.includes(ch))
+      return false;
+    if (ch === "\\" && s[i - 1] === "s")
+      return false;
+    if (ch === "\\" && "|#%@".includes(s[i + 1] ?? ""))
+      return false;
+    if (isBlank(ch) && "wWeE".includes(s[i + 1] ?? " "))
+      return false;
+    if (ch === ",") {
+      let k = i + 1;
+      while (isBlank(s[k]))
+        k++;
+      if (s[k] === "+" || s[k] === "-")
+        return false;
+    }
+  }
+  const transliterates = /y[^\\\n]/.test(s);
+  return !(transliterates && /[wWeE]/.test(s));
+}
+function sedIsAllowed(text, args) {
+  if (!text.startsWith("sed "))
+    return false;
+  const argumentText = text.slice(4);
+  if (/-e[wWe]|-w[eE]/.test(argumentText))
+    return false;
+  const options = args.filter((a) => a.startsWith("-") && a !== "--");
+  const operands = args.filter((a) => !a.startsWith("-"));
+  const script = operands[0];
+  if (script === undefined)
+    return false;
+  const quiet = options.some((o) => SED_QUIET.includes(o) || !o.startsWith("--") && o.includes("n"));
+  if (quiet && sedOptionsWithin(options, SED_PRINT_OPTIONS))
+    return sedPrintScript(script);
+  return operands.length === 1 && sedOptionsWithin(options, SED_SUBSTITUTE_OPTIONS) && sedSubstituteScript(script);
+}
+var PLAIN_READ_ONLY_COMMANDS = [
+  "docker ps",
+  "docker images",
+  "cal",
+  "uptime",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "stat",
+  "strings",
+  "hexdump",
+  "od",
+  "nl",
+  "id",
+  "uname",
+  "free",
+  "df",
+  "du",
+  "locale",
+  "groups",
+  "nproc",
+  "basename",
+  "dirname",
+  "realpath",
+  "cut",
+  "paste",
+  "tr",
+  "column",
+  "tac",
+  "rev",
+  "fold",
+  "expand",
+  "unexpand",
+  "fmt",
+  "comm",
+  "cmp",
+  "numfmt",
+  "readlink",
+  "diff",
+  "true",
+  "false",
+  "sleep",
+  "which",
+  "type",
+  "expr",
+  "test",
+  "getconf",
+  "seq",
+  "tsort",
+  "pr"
+];
+var PLAIN_ARGUMENTS = "(?:\\s|$)[^<>()$`|{}&;\\n\\r]*$";
+var FIND_ACTIONS = /-(?:delete|exec|execdir|ok|okdir|fprint0?|fls|fprintf)\b/;
+var FIND_FORBIDDEN_SYNTAX = "<>()$`|{}&;\n\r";
+function findOnlyLists(simple) {
+  if (simple.words[0].raw !== "find")
+    return false;
+  const args = simple.text.slice("find".length);
+  for (let i = 0;i < args.length; i++) {
+    if (args[i] === "\\" && (args[i + 1] === "(" || args[i + 1] === ")")) {
+      i++;
+      continue;
+    }
+    if (FIND_FORBIDDEN_SYNTAX.includes(args[i]))
+      return false;
+  }
+  return !FIND_ACTIONS.test(args) && simple.words.every((w) => !FIND_ACTIONS.test(w.value));
+}
+var READ_ONLY_REGEXES = [
+  ...PLAIN_READ_ONLY_COMMANDS.map((name) => new RegExp("^" + name + PLAIN_ARGUMENTS)),
+  /^echo(?:\s+(?:'[^']*'|"[^"$<>\n\r]*"|[^|;&`$(){}><#\\!"'\s]+))*(?:\s+2>&1)?\s*$/,
+  /^claude -h$/,
+  /^claude --help$/,
+  /^uniq(?:\s+(?:-[a-zA-Z]+|--[a-zA-Z-]+(?:=\S+)?|-[fsw]\s+\d+))*(?:\s|$)\s*$/,
+  /^pwd$/,
+  /^whoami$/,
+  /^node -v$/,
+  /^node --version$/,
+  /^python --version$/,
+  /^python3 --version$/,
+  /^history(?:\s+\d+)?\s*$/,
+  /^alias$/,
+  /^arch(?:\s+(?:--help|-h))?\s*$/,
+  /^ip addr$/,
+  /^ifconfig(?:\s+[a-zA-Z][a-zA-Z0-9_-]*)?\s*$/,
+  /^jq(?!\s+.*(?:-f\b|--from-file|--rawfile|--slurpfile|--run-tests|-L\b|--library-path|\benv\b|\$ENV\b))(?:\s+(?:-[a-zA-Z]+|--[a-zA-Z-]+(?:=\S+)?))*(?:\s+'[^'`]*'|\s+"[^"`]*"|\s+[^-\s'"][^\s]*)+\s*$/,
+  /^cd(?:\s+(?:'[^']*'|"[^"]*"|[^\s;|&`$(){}><#\\]+))?$/,
+  /^ls(?:\s+[^<>()$`|{}&;\n\r]*)?$/
+];
+
+// src/tools/concurrency.ts
+var MAX_TOOL_CONCURRENCY = 10;
+var CONCURRENCY_SAFE_BUILTINS = new Set(["Read", "Glob", "Grep", "LSP", "WebFetch", "WebSearch", "Search", "Agent"]);
+function schedulingForCall(name, input, bash) {
+  const descriptor = getRegisteredTool(name)?.descriptor;
+  if (descriptor === undefined)
+    return { kind: "serial" };
+  if (descriptor.source === "builtin") {
+    if (CONCURRENCY_SAFE_BUILTINS.has(descriptor.canonicalName))
+      return { kind: "concurrent" };
+    if (descriptor.canonicalName === "Bash" && bash !== undefined) {
+      const command = typeof input === "object" && input !== null ? input.command : undefined;
+      const escapes = typeof input === "object" && input !== null && input.dangerouslyDisableSandbox === true;
+      if (typeof command === "string" && !escapes && isBashCommandReadOnly(command, bash))
+        return { kind: "concurrent" };
+    }
+    return { kind: "serial" };
+  }
+  if (descriptor.source === "mcp" || descriptor.source === "sdk" || descriptor.source === "plugin") {
+    if (descriptor.annotations?.readOnlyHint === true)
+      return { kind: "concurrent" };
+    if (descriptor.concurrencyLane !== undefined)
+      return { kind: "lane", lane: descriptor.concurrencyLane };
+  }
+  return { kind: "serial" };
+}
+var SDK_MCP_CANCEL_GRACE_MS = 5000;
+function createToolLaneTails() {
+  return new Map;
+}
+function enterToolLane(lanes, lane, tail) {
+  const previous = lanes.get(lane);
+  const chained = previous === undefined ? tail : Promise.all([previous, tail]).then(() => {
+    return;
+  });
+  lanes.set(lane, chained);
+  chained.finally(() => {
+    if (lanes.get(lane) === chained)
+      lanes.delete(lane);
+  });
+  return previous;
+}
+
+// src/tools/read-state.ts
+import { isAbsolute as isAbsolute6, join as join25, normalize as normalize3 } from "node:path";
+function createSessionReadState(opts) {
+  const cwd = opts.cwd;
+  const reads = new Map;
+  function canonicalKey(p) {
+    const abs = isAbsolute6(p) ? p : join25(cwd, p);
+    return resolveRealTarget(normalize3(abs));
+  }
+  return {
+    recordRead(p, o) {
+      reads.set(canonicalKey(p), { complete: o.complete, mtimeMs: o.mtimeMs });
+    },
+    lookup(p) {
+      return reads.get(canonicalKey(p));
+    }
+  };
+}
+
+// src/provider/lean-prompt.ts
+var FULL_PROMPT_OPUS_MINORS = new Set(["0", "1", "5", "6", "7"]);
+function claudeModelTakesFullPrompt(modelKey) {
+  const id = modelKey.slice(modelKey.lastIndexOf("/") + 1).toLowerCase();
+  if (id.includes("claude-3-") || id.includes("haiku") || id.includes("sonnet"))
+    return true;
+  const opus = /^claude-opus-4(?:[-.](\d{1,2}))?(?:-\d{8})?$/.exec(id);
+  if (opus === null)
+    return false;
+  return FULL_PROMPT_OPUS_MINORS.has(opus[1] ?? "0");
+}
+
+// src/provider/first-party.ts
+var FIRST_PARTY_ANTHROPIC_PROVIDER_IDS = new Set(["anthropic", "console"]);
+function isFirstPartyAnthropic(providerId) {
+  return providerId !== undefined && FIRST_PARTY_ANTHROPIC_PROVIDER_IDS.has(providerId);
+}
+
+// src/engine.ts
+var SKILL_TOOL_ADVERTISED_NAME = "Skill";
+function undeclaredToolDefinitionsText(definitions) {
+  if (definitions.length === 0)
+    return "";
+  const lines = definitions.map((d) => `<function>${JSON.stringify({ name: d.name, description: d.description, parameters: d.inputSchema })}</function>`);
+  return `
+
+These loaded tools are not in this conversation's tool list, but you can call them by name; each one's input must match its parameters schema:
+<functions>
+${lines.join(`
+`)}
+</functions>`;
+}
+function providerMessageContentToText(content) {
+  if (typeof content === "string")
+    return content;
+  return content.map((block) => {
+    if (block.type === "text")
+      return block.text;
+    if (block.type === "tool_use")
+      return `[called ${block.name}]`;
+    if (block.type === "tool_reference")
+      return `[tools now callable: ${block.tool_names.join(", ")}]`;
+    if (block.type === "thinking")
+      return `[thinking: ${block.thinking.length} chars]`;
+    if (block.type === "redacted_thinking")
+      return "[redacted thinking]";
+    if (block.type === "image")
+      return `[image: ${block.source.media_type}]`;
+    return typeof block.content === "string" ? block.content : providerMessageContentToText(block.content);
+  }).join(`
+`);
+}
+function isPerMessageEffortRejection(err) {
+  if (!isProviderTurnError(err) || err.status !== 400)
+    return false;
+  return /mid-conversation-output-config|per-turn effort|configuration_update/i.test(err instanceof Error ? err.message : "");
+}
+function isToolChangeRejection(err, carriedChangeMessage = false) {
+  if (!isProviderTurnError(err) || err.status !== 400 && err.status !== 422)
+    return false;
+  if (carriedChangeMessage && /system message|role.{0,4}system|must (immediately )?(follow|precede)|end the array|paused assistant turn/i.test(err instanceof Error ? err.message : ""))
+    return true;
+  return /mid-conversation-tool-changes|inline-tools|tool_addition|tool_removal|tool_definition|tool_reference_unresolved|tool_name_conflict|available_tools_limit_exceeded|cannot yet be defined in a message|additional_tools/i.test(err instanceof Error ? err.message : "");
+}
+function isToolSearchRejection(err) {
+  if (!isProviderTurnError(err) || err.status !== 400 && err.status !== 422)
+    return false;
+  const text = err instanceof Error ? err.message : "";
+  if (errorParam(text)?.startsWith("tool_choice") === true)
+    return false;
+  return /tool_search|defer_loading|namespace/i.test(text);
+}
+function errorParam(text) {
+  return /"param"\s*:\s*"([^"]*)"/.exec(text)?.[1];
+}
+function isAllowedToolsRejection(err) {
+  if (!isProviderTurnError(err) || err.status !== 400 && err.status !== 422)
+    return false;
+  const text = err instanceof Error ? err.message : "";
+  const param = errorParam(text);
+  if (param !== undefined)
+    return param.startsWith("tool_choice");
+  return /allowed_tools|tool_choice|tool_search/i.test(text);
+}
+function promptCacheTtlFor(config) {
+  return config.promptCacheTtl === "1h" ? "1h" : "5m";
+}
+function promptCacheKeyFor(config) {
+  return config.agentId === undefined ? config.sessionId : `${config.sessionId}:${config.agentId}`;
+}
+function withoutLoadedTools(block) {
+  const { loadedTools: _loaded, loadedToolDefinitions: _definitions, ...rest } = block;
+  return rest;
+}
+function hostToolResultContent(blocks, icons) {
+  return withHostSiteIcons(toolResultsForHost(blocks.map((b) => b.type === "tool_result" && b.loadedTools !== undefined ? withoutLoadedTools(b) : b)), icons);
+}
+function mcpNamespaceFor(advertisedName, server) {
+  if (server === undefined)
+    return;
+  const namespace = `mcp__${server}`;
+  return advertisedName.startsWith(`${namespace}__`) && advertisedName.length > namespace.length + 2 ? namespace : undefined;
+}
+var NAMED_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+function isNamedEffort(value) {
+  return typeof value === "string" && NAMED_EFFORTS.includes(value);
+}
+
 class ProviderTurnError extends Error {
   winterProviderFailure = true;
   providerCode;
@@ -22647,7 +24381,7 @@ function raceInterrupt(p, interrupted) {
 }
 function buildBaselineDenyRules(resolvedWinterHome, brand, resolvedStoreHome) {
   const absolute = [];
-  const defaultHome = resolve12(join25(homedir(), (brand ?? WINTER_BRAND24).homeDirName));
+  const defaultHome = resolve12(join26(homedir(), (brand ?? WINTER_BRAND24).homeDirName));
   if (resolvedWinterHome !== undefined && resolve12(resolvedWinterHome) !== defaultHome) {
     const root = `/${escapeFileRulePathSegment(resolve12(resolvedWinterHome))}`;
     for (const dir of ["run"]) {
@@ -22796,6 +24530,7 @@ async function runEngine2(opts) {
   }
 }
 async function runEngineBody(opts, facetDisposers, registerBackgroundShellSweep) {
+  const sessionLaneTails = opts.toolLaneTails ?? createToolLaneTails();
   const {
     config,
     input,
@@ -23233,6 +24968,7 @@ ${escapeAttributionText(msg.body)}
   opts.onChildRosterReady?.(() => childRoster);
   opts.onForegroundChildrenReady?.(() => [...foregroundChildren]);
   const removeChildRosterSource = ensureDefaultMessagingRuntimeRegistered().addChildRosterSource(() => childRoster);
+  const removeHostMessagingPort = config.hostMessaging === true && config.agentId === undefined ? getDefaultMessagingRuntime()?.registerHostMessagingPort?.(config.sessionId, createHostMessagingPort(bridge)) : undefined;
   const sandboxSettingsForSession = config.sandbox ?? DEFAULT_SANDBOX_SETTINGS;
   const bashPostureFor = (call, dangerouslyDisableSandbox) => {
     const command = call.input["command"];
@@ -23782,16 +25518,17 @@ ${escapeAttributionText(msg.body)}
           continue;
         const toolDefs = serverCfg.tools;
         const toolNames = serverCfg.toolNames;
-        registerMcpServerTools(serverName, toolDefs, { deferredDefault: true, ...toolNames !== undefined ? { toolNames } : {} });
+        const toolLanes = serverCfg.toolLanes;
+        registerMcpServerTools(serverName, toolDefs, { deferredDefault: true, ...toolNames !== undefined ? { toolNames } : {}, ...toolLanes !== undefined ? { toolLanes } : {} });
         sdkMcpServerNames.push(serverName);
         const perServerTimeoutMs = serverCfg.timeout;
         for (const tool of toolDefs) {
           const canonicalName = toolNames !== undefined && Object.hasOwn(toolNames, tool.name) ? toolNames[tool.name] : `mcp__${serverName}__${tool.name}`;
           replaceExecutor(canonicalName, {
-            async execute(input) {
+            async execute(input, ctx) {
               const timeoutMs = perServerTimeoutMs ?? mcpEnvConfig.toolTimeoutMs ?? 120000;
               try {
-                const result = await bridge.request("sdk_mcp_call", { server: serverName, tool: tool.name, arguments: input && typeof input === "object" ? input : {} }, { timeoutMs });
+                const result = await bridge.request("sdk_mcp_call", { server: serverName, tool: tool.name, arguments: input && typeof input === "object" ? input : {} }, { timeoutMs, ...ctx?.signal !== undefined ? { signal: ctx.signal, cancelGraceMs: SDK_MCP_CANCEL_GRACE_MS } : {} });
                 const text = (result.content ?? []).map((block) => typeof block.text === "string" ? block.text : JSON.stringify(block)).join(`
 `);
                 return { output: text, ...result.isError === true ? { isError: true } : {} };
@@ -26077,34 +27814,77 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
           ...callRecord.moved !== undefined ? { nativeState: callRecord.moved.nativeState } : {},
           ...generationEffort ?? {}
         });
-        const resultBlocks = [];
+        const slots = turn.calls.map(() => {
+          return;
+        });
         const hostSiteIcons = new Map;
         let toolThrowText = null;
+        const throwTextByIndex = new Map;
+        let lateFailure;
         let structuredTerminated = false;
         const truncatedByOutputLimit = turn.stopReason === "max_tokens";
-        for (const emitted of turn.calls) {
+        const sentToHost = new Set;
+        const sendResultToHost = (index) => {
+          const block = slots[index];
+          if (block === undefined || sentToHost.has(index))
+            return;
+          sentToHost.add(index);
+          output.write({ type: "data", message: { type: "user", message: { content: hostToolResultContent([block], hostSiteIcons) } } });
+        };
+        const inFlight = new Set;
+        const deferredPostToolEffects = new Map;
+        const applyFinishedStops = () => {
+          if (turnStop.request !== undefined)
+            return;
+          for (const index of [...deferredPostToolEffects.keys()].sort((a, b) => a - b)) {
+            const stop = deferredPostToolEffects.get(index).stop;
+            if (stop !== undefined) {
+              turnStop.request = stop;
+              return;
+            }
+          }
+        };
+        const settleConcurrent = async () => {
+          while (inFlight.size > 0)
+            await Promise.all([...inFlight]);
+          for (const index of [...deferredPostToolEffects.keys()].sort((a, b) => a - b))
+            deferredPostToolEffects.get(index).apply();
+          deferredPostToolEffects.clear();
+        };
+        const deferPostToolEffects = (index, composite, hookName, apply) => {
+          const prevent = composite.preventContinuation;
+          deferredPostToolEffects.set(index, {
+            apply,
+            ...prevent !== undefined ? { stop: { hookName, ...prevent.reason !== undefined ? { reason: prevent.reason } : {} } } : {}
+          });
+        };
+        const processCall = async (emitted, index, mode) => {
+          const record = (block) => {
+            slots[index] = block;
+          };
           const resolvedName = currentToolName(emitted.name);
           const call = resolvedName !== emitted.name ? { ...emitted, name: resolvedName } : emitted;
+          applyFinishedStops();
           const stoppedBy = currentTurnStop();
           if (stoppedBy !== undefined) {
-            resultBlocks.push({ type: "tool_result", tool_use_id: call.id, content: `[not executed: the ${stoppedBy.hookName} hook stopped the turn]`, error: true });
-            continue;
+            record({ type: "tool_result", tool_use_id: call.id, content: `[not executed: the ${stoppedBy.hookName} hook stopped the turn]`, error: true });
+            return "next";
           }
           if (truncatedByOutputLimit) {
-            resultBlocks.push({ type: "tool_result", tool_use_id: call.id, content: OUTPUT_LIMIT_TRUNCATED_CALL_TEXT, is_error: true });
-            continue;
+            record({ type: "tool_result", tool_use_id: call.id, content: OUTPUT_LIMIT_TRUNCATED_CALL_TEXT, is_error: true });
+            return "next";
           }
           if (structuredOutputActive && structuredOutput !== undefined && call.name === STRUCTURED_OUTPUT_TOOL_NAME) {
             structuredOutputAttempts++;
             const validation = structuredOutput.validate(outputFormatSchema, call.input);
             if (validation.ok) {
-              resultBlocks.push({ type: "tool_result", tool_use_id: call.id, content: "Structured output accepted." });
+              record({ type: "tool_result", tool_use_id: call.id, content: "Structured output accepted." });
               finalResult = { type: "result", subtype: "success", is_error: false, structured_output: validation.value };
               structuredTerminated = true;
-              break;
+              return "stop";
             }
             if (structuredOutputAttempts >= maxStructuredOutputAttempts) {
-              resultBlocks.push({ type: "tool_result", tool_use_id: call.id, content: `Structured output validation failed: ${validation.errors.join("; ")}`, error: true });
+              record({ type: "tool_result", tool_use_id: call.id, content: `Structured output validation failed: ${validation.errors.join("; ")}`, error: true });
               finalResult = {
                 type: "result",
                 subtype: "error_max_structured_output_retries",
@@ -26113,26 +27893,26 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
                 terminal_reason: "structured_output_retry_exhausted"
               };
               structuredTerminated = true;
-              break;
+              return "stop";
             }
-            resultBlocks.push({ type: "tool_result", tool_use_id: call.id, content: `Structured output validation failed: ${validation.errors.join("; ")}. Call ${STRUCTURED_OUTPUT_TOOL_NAME} again with a corrected value.`, error: true });
-            continue;
+            record({ type: "tool_result", tool_use_id: call.id, content: `Structured output validation failed: ${validation.errors.join("; ")}. Call ${STRUCTURED_OUTPUT_TOOL_NAME} again with a corrected value.`, error: true });
+            return "next";
           }
           const callMcpServer = mcpServerIdentityForCall(call.name);
           try {
             const availabilityDescriptor = getRegisteredTool(call.name)?.descriptor;
             if (availabilityDescriptor !== undefined && !isToolAvailable(availabilityDescriptor, { ...advertisedCfg, mode: policyStateStore.getState().mode })) {
-              resultBlocks.push({
+              record({
                 type: "tool_result",
                 tool_use_id: call.id,
                 content: `'${call.name}' is not available in this session's current configuration (WS-06 §1.5 availability) -- it is registered but excluded here, so it was not executed`,
                 error: true
               });
-              continue;
+              return "next";
             }
             if (isDeferredAndUnloaded(call.name)) {
               const excludedReason = aliasExclusionLive(call.name);
-              resultBlocks.push(excludedReason !== undefined ? {
+              record(excludedReason !== undefined ? {
                 type: "tool_result",
                 tool_use_id: call.id,
                 content: `'${call.name}' is not available in this session: ${excludedReason}. It cannot be loaded with ToolSearch either -- the same exclusion removes it from the searchable pool.`,
@@ -26143,7 +27923,7 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
                 content: `'${call.name}' is a deferred tool that has not been loaded this session yet -- use ToolSearch to select it before calling it (WS-09 §8.5)`,
                 loadFirst: true
               });
-              continue;
+              return "next";
             }
             const permissionInput = typeof call.input === "object" && call.input !== null ? call.input : {};
             const evalCtxForIdentity = makeEvalCtx();
@@ -26159,8 +27939,8 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
             const declaredIdentity = declaredMcpIdentity(call.name);
             const notOffered = [...aliasPermissionIdentities(call.name, config.toolAliases, sessionBrand), ...declaredIdentity !== undefined ? [declaredIdentity] : []].some(probeRule("deny")) ? undefined : toolNotOfferedRefusal(call.name);
             if (notOffered !== undefined) {
-              resultBlocks.push({ type: "tool_result", tool_use_id: call.id, content: notOffered, is_error: true });
-              continue;
+              record({ type: "tool_result", tool_use_id: call.id, content: notOffered, is_error: true });
+              return "next";
             }
             const identityProbes = {
               deniedByRule: probeRule("deny"),
@@ -26179,12 +27959,12 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
             const decisionRaced = await raceInterrupt(evaluateWithFreshPolicy(permissionCall), interruptSignal);
             if (decisionRaced.kind === "interrupted") {
               interrupted = true;
-              break;
+              return "stop";
             }
             const decision = decisionRaced.value;
             takeGatingHookComposites(call.id, call.name);
             const denyCall = async (message, mechanism, ruleRef) => {
-              resultBlocks.push({ type: "tool_result", tool_use_id: call.id, content: message, denied: true });
+              record({ type: "tool_result", tool_use_id: call.id, content: message, denied: true });
               turnPermissionDenials.push({ tool_name: call.name, tool_use_id: call.id, tool_input: permissionCall.input });
               output.write({
                 type: "data",
@@ -26212,7 +27992,7 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
               const deferMessage = decision.message ?? "a PreToolUse hook deferred this call for durable approval";
               if (!approvalStore) {
                 await denyCall(`Denied: cannot defer -- no durable approval store is available for this session (${deferMessage})`, "hook");
-                continue;
+                return "next";
               }
               const requestId = randomUUID18();
               const executedInput = decision.transformedInput ?? permissionCall.input;
@@ -26239,9 +28019,9 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
               } catch (err) {
                 const text = err instanceof Error ? err.message : String(err);
                 await denyCall(`Denied: failed to persist the durable approval record (${text})`, "hook");
-                continue;
+                return "next";
               }
-              resultBlocks.push({ type: "tool_result", tool_use_id: call.id, content: "[deferred]", deferred: true });
+              record({ type: "tool_result", tool_use_id: call.id, content: "[deferred]", deferred: true });
               output.write({
                 type: "data",
                 message: {
@@ -26256,7 +28036,7 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
                   uuid: randomUUID18()
                 }
               });
-              continue;
+              return "next";
             }
             if (decision.decision !== "allow") {
               const deniedMessage = decision.message ?? "Permission denied";
@@ -26264,9 +28044,9 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
               if (decision.interrupt === true) {
                 interrupted = true;
                 interruptCurrentTurn.current?.();
-                break;
+                return "stop";
               }
-              continue;
+              return "next";
             }
             if (decision.updatedPermissions) {
               for (const update of decision.updatedPermissions) {
@@ -26297,18 +28077,47 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
                 }
               }
             }
-            toolReferenceCollector = [];
-            const raced = await raceInterrupt(tools.execute(executedCall, { signal: turnAbort.signal, ...decision.explicitApproval !== undefined ? { explicitApproval: decision.explicitApproval } : {} }), interruptSignal);
-            const loadedTools = advertisedNamesFor(toolReferenceCollector);
-            toolReferenceCollector = undefined;
+            if (interrupted || toolThrowText !== null || lateFailure !== undefined)
+              return "stop";
+            applyFinishedStops();
+            const stoppedBeforeStart = currentTurnStop();
+            if (stoppedBeforeStart !== undefined) {
+              record({ type: "tool_result", tool_use_id: call.id, content: `[not executed: the ${stoppedBeforeStart.hookName} hook stopped the turn]`, error: true });
+              return "next";
+            }
+            const laneTurn = mode.enterLane?.();
+            mode.readyToExecute?.();
+            if (laneTurn !== undefined) {
+              const turnOfLane = await raceInterrupt(laneTurn, interruptSignal);
+              if (turnOfLane.kind === "interrupted") {
+                interrupted = true;
+                return "stop";
+              }
+              if (interrupted || toolThrowText !== null || lateFailure !== undefined)
+                return "stop";
+              applyFinishedStops();
+              const stoppedInLane = currentTurnStop();
+              if (stoppedInLane !== undefined) {
+                record({ type: "tool_result", tool_use_id: call.id, content: `[not executed: the ${stoppedInLane.hookName} hook stopped the turn]`, error: true });
+                return "next";
+              }
+            }
+            if (!mode.concurrent)
+              toolReferenceCollector = [];
+            const execution = tools.execute(executedCall, { signal: turnAbort.signal, ...decision.explicitApproval !== undefined ? { explicitApproval: decision.explicitApproval } : {} });
+            mode.onExecution?.(execution);
+            const raced = await raceInterrupt(execution, interruptSignal);
+            const loadedTools = mode.concurrent ? [] : advertisedNamesFor(toolReferenceCollector);
+            if (!mode.concurrent)
+              toolReferenceCollector = undefined;
             const loadedToolDefinitions = loadedDefinitionsFor(loadedTools);
             const forkDefinitionsText = exactRequestLayout !== undefined ? forkLoadedDefinitionsText(loadedToolDefinitions) : "";
             if (raced.kind === "interrupted") {
               interrupted = true;
-              break;
+              return "stop";
             }
             const resultBlocksOfCall = raced.value.blocks;
-            resultBlocks.push({
+            record({
               type: "tool_result",
               tool_use_id: call.id,
               content: resultBlocksOfCall !== undefined ? forkDefinitionsText.length > 0 ? [...resultBlocksOfCall, { type: "text", text: forkDefinitionsText.trimStart() }] : [...resultBlocksOfCall] : forkDefinitionsText.length > 0 ? `${raced.value.output}${forkDefinitionsText}` : raced.value.output,
@@ -26331,57 +28140,154 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
               input: executedCall.input,
               payload: { tool_response: raced.value.output }
             });
-            if (postToolUseHookOutcome.classifierContext !== undefined) {
-              accumulatedClassifierContext.push(...postToolUseHookOutcome.classifierContext);
-            }
-            absorbHookComposite(postToolUseHookOutcome, { hookName: `${raced.value.isError === true ? "PostToolUseFailure" : "PostToolUse"}:${call.name}`, context: true, toolUseID: call.id });
+            const postHookName = `${raced.value.isError === true ? "PostToolUseFailure" : "PostToolUse"}:${call.name}`;
+            const applyPostToolEffects = () => {
+              if (postToolUseHookOutcome.classifierContext !== undefined) {
+                accumulatedClassifierContext.push(...postToolUseHookOutcome.classifierContext);
+              }
+              absorbHookComposite(postToolUseHookOutcome, { hookName: postHookName, context: true, toolUseID: call.id });
+            };
+            if (mode.concurrent)
+              deferPostToolEffects(index, postToolUseHookOutcome, postHookName, applyPostToolEffects);
+            else
+              applyPostToolEffects();
             if (postToolUseHookOutcome.transformedOutput !== undefined) {
-              const last = resultBlocks[resultBlocks.length - 1];
-              if (last !== undefined && last.type === "tool_result" && last.tool_use_id === call.id) {
-                resultBlocks[resultBlocks.length - 1] = { ...last, content: toolOutputReplacement(postToolUseHookOutcome.transformedOutput) };
+              const own = slots[index];
+              if (own !== undefined && own.type === "tool_result" && own.tool_use_id === call.id) {
+                slots[index] = { ...own, content: toolOutputReplacement(postToolUseHookOutcome.transformedOutput) };
               }
             }
           } catch (err) {
             const text = err instanceof Error ? err.message : String(err);
-            finalResult = { type: "result", subtype: "error_during_execution", is_error: true, result: text };
-            toolThrowText = text;
-            absorbHookComposite(await fireObservationalHook("PostToolUseFailure", {
+            throwTextByIndex.set(index, text);
+            if (toolThrowText === null) {
+              finalResult = { type: "result", subtype: "error_during_execution", is_error: true, result: text };
+              toolThrowText = text;
+            }
+            const failureOutcome = await fireObservationalHook("PostToolUseFailure", {
               toolUseID: call.id,
               toolName: postToolHookSubject("PostToolUseFailure", call.name),
               ...callMcpServer !== undefined ? { mcpServer: callMcpServer } : {},
               input: typeof call.input === "object" && call.input !== null ? call.input : {},
               payload: { error: text }
-            }), { hookName: `PostToolUseFailure:${call.name}`, context: true, toolUseID: call.id });
+            });
+            const failureHookName = `PostToolUseFailure:${call.name}`;
+            const applyFailureEffects = () => absorbHookComposite(failureOutcome, { hookName: failureHookName, context: true, toolUseID: call.id });
+            if (mode.concurrent)
+              deferPostToolEffects(index, failureOutcome, failureHookName, applyFailureEffects);
+            else
+              applyFailureEffects();
+            return "stop";
+          }
+          return "next";
+        };
+        const bashReadOnlyContext = () => ({
+          cwd: currentCwd,
+          originalCwd: config.cwd,
+          sandboxEnabled: sandboxSettingsForSession.enabled !== false && isSandboxAvailable()
+        });
+        for (let index = 0;index < turn.calls.length; index++) {
+          const emitted = turn.calls[index];
+          const scheduling = schedulingForCall(currentToolName(emitted.name), emitted.input, bashReadOnlyContext());
+          if (scheduling.kind === "serial") {
+            await settleConcurrent();
+          } else {
+            while (inFlight.size >= MAX_TOOL_CONCURRENCY)
+              await Promise.race(inFlight);
+          }
+          if (interrupted || toolThrowText !== null || lateFailure !== undefined)
             break;
+          if (scheduling.kind === "serial") {
+            try {
+              const outcome = await processCall(emitted, index, { concurrent: false });
+              sendResultToHost(index);
+              if (outcome === "stop")
+                break;
+            } catch (error) {
+              lateFailure = { error };
+              break;
+            }
+            continue;
           }
+          let releaseLane;
+          let laneExecution;
+          const lane = scheduling.kind === "lane" ? scheduling.lane : undefined;
+          const enterLane = lane !== undefined ? () => enterToolLane(sessionLaneTails, lane, new Promise((resolve) => releaseLane = resolve)) : undefined;
+          let markReady;
+          const ready = new Promise((resolve) => markReady = () => resolve("ready"));
+          const settled = processCall(emitted, index, {
+            concurrent: true,
+            readyToExecute: markReady,
+            ...enterLane !== undefined ? { enterLane, onExecution: (execution) => {
+              laneExecution = execution;
+            } } : {}
+          }).then((outcome) => {
+            sendResultToHost(index);
+            return outcome;
+          }).catch((error) => {
+            if (lateFailure === undefined)
+              lateFailure = { error };
+            return "stop";
+          });
+          const tracked = settled.finally(() => {
+            inFlight.delete(tracked);
+            const release = () => releaseLane?.();
+            if (laneExecution !== undefined)
+              laneExecution.then(release, release);
+            else
+              release();
+          });
+          inFlight.add(tracked);
+          const first = await Promise.race([ready, settled]);
+          if (first === "stop")
+            break;
         }
+        await settleConcurrent();
         if (toolThrowText !== null) {
-          const resultedIds = new Set(resultBlocks.map((b) => b.tool_use_id));
-          for (const call of turn.calls) {
-            if (!resultedIds.has(call.id)) {
-              resultBlocks.push({ type: "tool_result", tool_use_id: call.id, content: `[error: ${toolThrowText}]`, error: true });
-            }
-          }
+          turn.calls.forEach((call, index) => {
+            if (slots[index] === undefined)
+              slots[index] = { type: "tool_result", tool_use_id: call.id, content: `[error: ${throwTextByIndex.get(index) ?? toolThrowText}]`, error: true };
+          });
+        }
+        if (lateFailure !== undefined) {
+          const failure = lateFailure.error;
+          const text = failure instanceof Error ? failure.message : String(failure);
+          turn.calls.forEach((call, index) => {
+            if (slots[index] === undefined)
+              slots[index] = { type: "tool_result", tool_use_id: call.id, content: `[error: ${text}]`, error: true };
+          });
         }
         if (structuredTerminated) {
-          const resultedIds = new Set(resultBlocks.map((b) => b.tool_use_id));
-          for (const call of turn.calls) {
-            if (!resultedIds.has(call.id)) {
-              resultBlocks.push({ type: "tool_result", tool_use_id: call.id, content: "[not executed: the turn ended on a structured-output result]", error: true });
-            }
-          }
+          turn.calls.forEach((call, index) => {
+            if (slots[index] === undefined)
+              slots[index] = { type: "tool_result", tool_use_id: call.id, content: "[not executed: the turn ended on a structured-output result]", error: true };
+          });
         }
         if (interrupted) {
-          const resultedIds = new Set(resultBlocks.map((b) => b.tool_use_id));
-          for (const call of turn.calls) {
-            if (!resultedIds.has(call.id)) {
-              resultBlocks.push({ type: "tool_result", tool_use_id: call.id, content: "[interrupted]", interrupted: true });
-            }
+          turn.calls.forEach((call, index) => {
+            if (slots[index] === undefined)
+              slots[index] = { type: "tool_result", tool_use_id: call.id, content: "[interrupted]", interrupted: true };
+          });
+        }
+        turn.calls.forEach((call, index) => {
+          if (slots[index] === undefined)
+            slots[index] = { type: "tool_result", tool_use_id: call.id, content: "[not executed]", error: true };
+        });
+        const resultBlocks = slots;
+        const unsent = resultBlocks.filter((_, index) => !sentToHost.has(index));
+        if (unsent.length > 0) {
+          try {
+            output.write({ type: "data", message: { type: "user", message: { content: hostToolResultContent(unsent, hostSiteIcons) } } });
+          } catch (error) {
+            if (lateFailure === undefined)
+              lateFailure = { error };
           }
+          resultBlocks.forEach((_, index) => sentToHost.add(index));
         }
-        output.write({ type: "data", message: { type: "user", message: { content: withHostSiteIcons(toolResultsForHost(resultBlocks.map((b) => b.type === "tool_result" && b.loadedTools !== undefined ? withoutLoadedTools(b) : b)), hostSiteIcons) } } });
         messages.push({ role: "tool", content: resultBlocks });
         await recordUser(resultBlocks);
+        if (lateFailure !== undefined)
+          throw lateFailure.error;
         await flushPendingHookAttachments();
         gatingHookComposites.clear();
         if (finalResult)
@@ -26439,6 +28345,7 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
   if (config.agentId === undefined)
     clearNotificationQueue(config.sessionId);
   removeChildRosterSource();
+  removeHostMessagingPort?.();
   facetSelfPeer?.();
   facetNoticeForwarder?.();
   disposeSessionMcpLifecycle?.();
@@ -26457,7 +28364,7 @@ ${reason}` : ""}` : `${promptStop.hookName} hook stopped continuation${reason.le
 }
 
 // src/provider/mock.ts
-import { randomUUID as randomUUID19 } from "node:crypto";
+import { createHash as createHash2, randomUUID as randomUUID19 } from "node:crypto";
 
 // src/compaction/summarizer.ts
 var WINTER_SUMMARY_INSTRUCTION = "You are compacting a conversation so that it can continue with less context. " + "Summarize the conversation above as clear declarative statements of what is true and what was decided -- " + "not as a paraphrase of the most recent message and not as an acknowledgement. " + "Preserve every specific verbatim: numbers, names, file paths, identifiers, exact values, and any decision that was made or reversed. " + "Record work still outstanding as well as work completed. " + "Be concise but complete; never drop a fact to save words. " + "Output the summary text and nothing else.";
@@ -26642,7 +28549,7 @@ var TEST_PROVIDER_NAMES = new Set([
   "readimage",
   "calls"
 ]);
-var CALL_LINE = /^CALL\s+(\S+)(?:\s+(.*))?$/;
+var CALL_LINE = /^(\+?)CALL\s+(\S+)(?:\s+(.*))?$/;
 function promptedCallsProvider() {
   return {
     async generate({ messages }) {
@@ -26657,13 +28564,21 @@ function promptedCallsProvider() {
       }
       if (at < 0)
         return { kind: "text", text: "[]" };
-      const script = userMessageText(messages[at]).split(`
-`).map((line) => CALL_LINE.exec(line.trim())).filter((m) => m !== null).map((m) => ({ name: m[1], input: m[2] !== undefined && m[2].trim() !== "" ? JSON.parse(m[2]) : {} }));
+      const rounds = [];
+      for (const m of userMessageText(messages[at]).split(`
+`).map((line) => CALL_LINE.exec(line.trim())).filter((m) => m !== null)) {
+        const call = { name: m[2], input: m[3] !== undefined && m[3].trim() !== "" ? JSON.parse(m[3]) : {} };
+        if (m[1] === "+" && rounds.length > 0)
+          rounds[rounds.length - 1].push(call);
+        else
+          rounds.push([call]);
+      }
       const after = messages.slice(at + 1);
       const made = after.filter((m) => m.role === "assistant" && Array.isArray(m.content) && m.content.some((b) => b.type === "tool_use")).length;
-      if (made < script.length) {
-        const next = script[made];
-        return { kind: "tool_use", calls: [{ id: `calls-${at + 1}-${made + 1}`, name: next.name, input: next.input }] };
+      if (made < rounds.length) {
+        const script = createHash2("sha256").update(userMessageText(messages[at])).digest("hex").slice(0, 6);
+        const round = rounds[made];
+        return { kind: "tool_use", calls: round.map((next, i) => ({ id: `calls-${script}-${at + 1}-${made + 1}${i === 0 ? "" : `-${i + 1}`}`, name: next.name, input: next.input })) };
       }
       const results = after.flatMap((m) => Array.isArray(m.content) ? m.content : []).filter((b) => b.type === "tool_result");
       const named = new Map(after.flatMap((m) => m.role === "assistant" && Array.isArray(m.content) ? m.content : []).flatMap((b) => b.type === "tool_use" ? [[b.id, b.name]] : []));
@@ -27292,7 +29207,7 @@ function rebuildProviderMessages2(entries) {
 
 // src/store/dialect.ts
 import { randomUUID as randomUUID20 } from "node:crypto";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 import {
   WinterCompatibilitySessionStore,
   DIALECT_RECORD_ENTRY_TYPE,
@@ -27598,10 +29513,10 @@ class TranscriptWriter2 {
     return entries;
   }
 }
-var RUNTIME_ENGINE_VERSION2 = "0.0.38";
+var RUNTIME_ENGINE_VERSION2 = "0.0.40";
 function withPermissionJournal(writer, location) {
   return {
-    transcriptPath: join26(location.winterHome, "projects", location.projectKey, `${location.sessionId}.jsonl`),
+    transcriptPath: join27(location.winterHome, "projects", location.projectKey, `${location.sessionId}.jsonl`),
     recordUserEntry: (content, opts) => writer.recordUserEntry(content, opts),
     recordAssistantEntry: (content, opts) => writer.recordAssistantEntry(content, opts),
     recordAttachmentEntry: (attachment) => writer.recordAttachmentEntry(attachment),
@@ -27629,7 +29544,7 @@ function buildWriter(opts) {
     ctx: { sessionId: opts.sessionId, cwd: opts.cwd, version: RUNTIME_ENGINE_VERSION2, projectDirName: opts.projectKey },
     initialParentUuid: opts.initialParentUuid,
     ...opts.initialConversationalUuids !== undefined ? { initialConversationalUuids: opts.initialConversationalUuids } : {},
-    providerStateSink: createFileProviderStateSink(providerStateSidecarPath(join26(opts.winterHome, "projects", opts.projectKey, `${opts.sessionId}.jsonl`)))
+    providerStateSink: createFileProviderStateSink(providerStateSidecarPath(join27(opts.winterHome, "projects", opts.projectKey, `${opts.sessionId}.jsonl`)))
   });
   return withPermissionJournal(writer, { winterHome: opts.winterHome, projectKey: opts.projectKey, sessionId: opts.sessionId });
 }
@@ -27642,7 +29557,7 @@ function buildChildTranscriptWriter(opts) {
     key: { projectKey: opts.projectKey, sessionId: opts.parentSessionId, subpath: childTranscriptSubpath(opts.agentId) },
     ctx: { sessionId: opts.parentSessionId, cwd: opts.cwd, version: RUNTIME_ENGINE_VERSION2, projectDirName: opts.projectKey },
     sidechain: { agentId: opts.agentId, parentToolUseId: opts.parentToolUseId },
-    ...opts.winterHome !== undefined ? { providerStateSink: createFileProviderStateSink(providerStateSidecarPath(join26(opts.winterHome, "projects", opts.projectKey, opts.parentSessionId, `${childTranscriptSubpath(opts.agentId)}.jsonl`))) } : {}
+    ...opts.winterHome !== undefined ? { providerStateSink: createFileProviderStateSink(providerStateSidecarPath(join27(opts.winterHome, "projects", opts.projectKey, opts.parentSessionId, `${childTranscriptSubpath(opts.agentId)}.jsonl`))) } : {}
   });
 }
 var CHILD_SUBKEY_PATTERN = /^subagents\/agent-(.+)$/;
@@ -28324,4 +30239,4 @@ function selectClassifierRoute2(config, descriptorOf) {
   return { kind: "worker-eligible" };
 }
 
-export { ChildResumeModeIncomparableError, resolveChildResumeMode, ensureDefaultMessagingRuntimeRegistered, buildContinuationChain, AGENT_TOOL_CANONICAL_NAME, computeActiveSlotSet, resolveSlotToProvider, createRpcBridge2, shellWords, escapeRegExpLiteral, validatePermissionRuleString, registerTool2, getRegisteredTool, listRegisteredTools, rebrandStandingServerTools, mcpServerHasRegistrations, onCompaction2, STRUCTURED_OUTPUT_TOOL_NAME, looksLikeCommand, matchFileRule, resolveFileRuleAbsolutePath, resolveFileRuleAbsoluteGlobText, resolvesWithinPluginRoot, buildWorkflowWorkerSeatbeltProfile2, capBytes, neutralizeReminderTags, readWhole, readCappedLinesAndBytes, registerAttachmentRenderer, attachmentsIn, registerChildEngineFactory, rawToRuleValue, sourceRule, parseFrontmatter, parseAgentDefinitionFile, allowedAgentTypesFromTools, validateAgentDefinition, WinterPathsError2, sessionTempDir2, ensureTasksDir2, resolveProjectDirName2, buildForkDirectiveText, buildForkInitialMessages, gitInstructionsEnabled, isUserInvocable, buildSkillListing, registerPluginAgents, clearPluginAgents, registerSkillSessionRuntime, clearSkillSessionRuntime, buildHookEntriesFromSettings, defaultTrustSource, formatValidationErrors, createSchemaValidatorCache, killAllTaskProcessGroups, runGit, listWorktrees, canonicalAliases, WINTER_CANONICAL_ALIASES, DEFAULT_SKILL_BODY_BYTES, skillNameError, pluginNameError, capBytes2, parseSkillFile, validateSkillsOption, isSkillEnabled, autoSkillPermissionEntries, setHostWorkflowWorkerCommand, listWorkflowsForListing, buildWorkflowSkillPrompt, WORKFLOW_SANDBOX_REFUSED_EXIT_CODE2, DEFAULT_CONTEXT_WINDOW_TOKENS2, ProviderTurnError, isProviderTurnError, createContextAccountant2, runEngine2, WINTER_SUMMARY_INSTRUCTION, WINTER_PREFIX_SUMMARY_INSTRUCTION, CARRIED_SUMMARY_NOTE, retainedExchangesNote, buildSummaryInstruction, redactForSummary, summarize, summarizeOverPrefix, recordedProviderSystems2, resetRecordedProviderSystems2, echoProvider2, scriptedProvider2, stubExecutor2, P5_FIXTURE_SKILL_NAME2, P5_WORKFLOW_SCRIPT2, isTestProviderName2, testProviderForNamespace, testProviderByName2, SUBAGENT_CHILD_PROBE_TEXT2, MCP_SDK_TEST_SERVER_NAME2, MCP_SDK_TEST_TOOL_NAME2, BGTASK_TEST_TOOL_NAME2, registerBgTaskTestTool2, ResumeTargetError2, ResumeTruncationError2, findContinueTarget2, findResumeTarget2, toDialectEntries2, truncateAt2, rebuildProviderMessages2, userEntry2, winterMessageIdFor2, assistantEntry2, CLAUDE_COMPACT_SUMMARY_PREAMBLE2, claudeCompactBoundaryEntry2, claudeCompactSummaryEntry2, TranscriptWriterError2, TranscriptWriter2, RUNTIME_ENGINE_VERSION2, childTranscriptSubpath, buildChildTranscriptWriter, listChildAgentIds, resolveEngineSession2, resolveProductionWinterHome2, resolveProductionStoreHome, resolveSessionProvider, redactCredentialRef, createProviderContext, providerCredentialRef2, storeProviderCredential2, deleteProviderCredential2, validateProviderCredential2, CLASSIFIER_TOOL_NAME2, CLASSIFIER_VERDICT_SCHEMA2, CLASSIFIER_NO_VERDICT_REASONS2, DEFAULT_MAX_CONTEXT_CHARS2, CLASSIFIER_SYSTEM_PROMPT2, DEFAULT_CLASSIFIER_TIMEOUT_MS2, createModelClassifier2, selectClassifierRoute2 };
+export { ChildResumeModeIncomparableError, resolveChildResumeMode, ensureDefaultMessagingRuntimeRegistered, buildContinuationChain, AGENT_TOOL_CANONICAL_NAME, computeActiveSlotSet, resolveSlotToProvider, createRpcBridge2, shellWords, escapeRegExpLiteral, validatePermissionRuleString, registerTool2, getRegisteredTool, listRegisteredTools, rebrandStandingServerTools, mcpServerHasRegistrations, onCompaction2, STRUCTURED_OUTPUT_TOOL_NAME, looksLikeCommand, matchFileRule, resolveFileRuleAbsolutePath, resolveFileRuleAbsoluteGlobText, resolvesWithinPluginRoot, buildWorkflowWorkerSeatbeltProfile2, capBytes, neutralizeReminderTags, readWhole, readCappedLinesAndBytes, registerAttachmentRenderer, attachmentsIn, registerChildEngineFactory, rawToRuleValue, sourceRule, parseFrontmatter, parseAgentDefinitionFile, allowedAgentTypesFromTools, validateAgentDefinition, WinterPathsError2, sessionTempDir2, ensureTasksDir2, resolveProjectDirName2, buildForkDirectiveText, buildForkInitialMessages, gitInstructionsEnabled, isUserInvocable, buildSkillListing, registerPluginAgents, clearPluginAgents, registerSkillSessionRuntime, clearSkillSessionRuntime, buildHookEntriesFromSettings, defaultTrustSource, formatValidationErrors, createSchemaValidatorCache, killAllTaskProcessGroups, runGit, listWorktrees, canonicalAliases, WINTER_CANONICAL_ALIASES, DEFAULT_SKILL_BODY_BYTES, skillNameError, pluginNameError, capBytes2, parseSkillFile, validateSkillsOption, isSkillEnabled, autoSkillPermissionEntries, setHostWorkflowWorkerCommand, listWorkflowsForListing, buildWorkflowSkillPrompt, WORKFLOW_SANDBOX_REFUSED_EXIT_CODE2, createToolLaneTails, DEFAULT_CONTEXT_WINDOW_TOKENS2, ProviderTurnError, isProviderTurnError, createContextAccountant2, runEngine2, WINTER_SUMMARY_INSTRUCTION, WINTER_PREFIX_SUMMARY_INSTRUCTION, CARRIED_SUMMARY_NOTE, retainedExchangesNote, buildSummaryInstruction, redactForSummary, summarize, summarizeOverPrefix, recordedProviderSystems2, resetRecordedProviderSystems2, echoProvider2, scriptedProvider2, stubExecutor2, P5_FIXTURE_SKILL_NAME2, P5_WORKFLOW_SCRIPT2, isTestProviderName2, testProviderForNamespace, testProviderByName2, SUBAGENT_CHILD_PROBE_TEXT2, MCP_SDK_TEST_SERVER_NAME2, MCP_SDK_TEST_TOOL_NAME2, BGTASK_TEST_TOOL_NAME2, registerBgTaskTestTool2, ResumeTargetError2, ResumeTruncationError2, findContinueTarget2, findResumeTarget2, toDialectEntries2, truncateAt2, rebuildProviderMessages2, userEntry2, winterMessageIdFor2, assistantEntry2, CLAUDE_COMPACT_SUMMARY_PREAMBLE2, claudeCompactBoundaryEntry2, claudeCompactSummaryEntry2, TranscriptWriterError2, TranscriptWriter2, RUNTIME_ENGINE_VERSION2, childTranscriptSubpath, buildChildTranscriptWriter, listChildAgentIds, resolveEngineSession2, resolveProductionWinterHome2, resolveProductionStoreHome, resolveSessionProvider, redactCredentialRef, createProviderContext, providerCredentialRef2, storeProviderCredential2, deleteProviderCredential2, validateProviderCredential2, CLASSIFIER_TOOL_NAME2, CLASSIFIER_VERDICT_SCHEMA2, CLASSIFIER_NO_VERDICT_REASONS2, DEFAULT_MAX_CONTEXT_CHARS2, CLASSIFIER_SYSTEM_PROMPT2, DEFAULT_CLASSIFIER_TIMEOUT_MS2, createModelClassifier2, selectClassifierRoute2 };