autopilot-ai 1.2.1 → 1.4.0

package/dist/sdk/index.js

@@ -325,9 +325,9 @@ var require_node_gyp_build = __commonJS({
         var debug = getFirst(path.join(dir, "build/Debug"), matchBuild);
         if (debug) return debug;
       }
-      var prebuild = resolve4(dir);
+      var prebuild = resolve6(dir);
       if (prebuild) return prebuild;
-      var nearby = resolve4(path.dirname(process.execPath));
+      var nearby = resolve6(path.dirname(process.execPath));
       if (nearby) return nearby;
       var target = [
         "platform=" + platform3,
@@ -343,7 +343,7 @@ var require_node_gyp_build = __commonJS({
         // eslint-disable-line
       ].filter(Boolean).join(" ");
       throw new Error("No native build was found for " + target + "\n    loaded from: " + dir + "\n");
-      function resolve4(dir2) {
+      function resolve6(dir2) {
         var tuples = readdirSync2(path.join(dir2, "prebuilds")).map(parseTuple);
         var tuple = tuples.filter(matchTuple(platform3, arch)).sort(compareTuples)[0];
         if (!tuple) return;
@@ -1169,7 +1169,7 @@ var init_types = __esm({
 // src/hooks/settings.ts
 import { existsSync, readFileSync as readFileSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir10 } from "os";
-import { join as join17, dirname as dirname7 } from "path";
+import { join as join17, dirname as dirname8 } from "path";
 import { createHash } from "crypto";
 function globalSettingsPath() {
   const xdg = process.env.XDG_CONFIG_HOME || join17(homedir10(), ".config");
@@ -1196,12 +1196,12 @@ function normalizeHook(event, raw, source) {
   if (!raw || typeof raw !== "object") return null;
   const r = raw;
   if (typeof r.command !== "string" || !r.command.trim()) return null;
-  const enabled = typeof r.enabled === "boolean" ? r.enabled : true;
+  const enabled2 = typeof r.enabled === "boolean" ? r.enabled : true;
   const matcher = typeof r.matcher === "string" ? r.matcher : void 0;
   const timeoutMs = typeof r.timeoutMs === "number" && r.timeoutMs > 0 ? r.timeoutMs : void 0;
   const description = typeof r.description === "string" ? r.description : void 0;
   const id = typeof r.id === "string" && r.id.length > 0 ? r.id : deriveHookId(event, r.command);
-  return { id, matcher, command: r.command, timeoutMs, enabled, description, source };
+  return { id, matcher, command: r.command, timeoutMs, enabled: enabled2, description, source };
 }
 function mergeHookMaps(a, b) {
   const out = {};
@@ -1237,7 +1237,7 @@ var init_settings = __esm({
 });
 
 // src/hooks/runner.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 function isVetoEvent(event) {
   return event === "PreToolUse" || event === "UserPromptSubmit";
 }
@@ -1354,8 +1354,8 @@ var init_runner = __esm({
     init_logger();
     DEFAULT_TIMEOUT_MS = 3e4;
     STREAM_CAP_BYTES = 4 * 1024;
-    defaultSpawn = (command, payloadJson, env, cwd, timeoutMs, signal) => new Promise((resolve4) => {
-      const child = spawn3(command, {
+    defaultSpawn = (command, payloadJson, env, cwd, timeoutMs, signal) => new Promise((resolve6) => {
+      const child = spawn4(command, {
         shell: true,
         cwd,
         env,
@@ -1369,7 +1369,7 @@ var init_runner = __esm({
         settled = true;
         clearTimeout(timer2);
         signal?.removeEventListener("abort", onAbort);
-        resolve4({ exitCode, stdout, stderr, timedOut });
+        resolve6({ exitCode, stdout, stderr, timedOut });
       };
       const onAbort = () => {
         child.kill("SIGTERM");
@@ -1442,7 +1442,7 @@ var init_manager = __esm({
 });
 
 // src/sdk/session.ts
-import { resolve as resolve3 } from "path";
+import { resolve as resolve5 } from "path";
 import { homedir as homedir11 } from "os";
 import { join as join18 } from "path";
 import { existsSync as existsSync2 } from "fs";
@@ -1490,10 +1490,10 @@ async function* readSSE(stream, signal, idleTimeoutMs, postFirstByteIdleTimeoutM
       gotFirstByte = true;
       buffer += decoder.decode(value, { stream: true });
       buffer = buffer.replace(/\r\n/g, "\n");
-      let sep2;
-      while ((sep2 = buffer.indexOf("\n\n")) !== -1) {
-        const event = buffer.slice(0, sep2);
-        buffer = buffer.slice(sep2 + 2);
+      let sep3;
+      while ((sep3 = buffer.indexOf("\n\n")) !== -1) {
+        const event = buffer.slice(0, sep3);
+        buffer = buffer.slice(sep3 + 2);
         const data = extractData(event);
         if (data !== null) yield data;
       }
@@ -2296,11 +2296,11 @@ function extractApiError(parsed, rawText) {
   return null;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     if (signal?.aborted) return reject(new DOMException("aborted", "AbortError"));
     const t = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve4();
+      resolve6();
     }, ms);
     const onAbort = () => {
       clearTimeout(t);
@@ -2385,7 +2385,7 @@ var RETENTION = {
   memoryMaxEntries: 1e3
 };
 async function rotateJsonl(path, maxBytes, rotations) {
-  const { rename } = await import("fs/promises");
+  const { rename: rename3 } = await import("fs/promises");
   let s;
   try {
     s = await stat(path);
@@ -2397,7 +2397,7 @@ async function rotateJsonl(path, maxBytes, rotations) {
     const src = i === 1 ? path : `${path}.${i - 1}`;
     const dst = `${path}.${i}`;
     try {
-      await rename(src, dst);
+      await rename3(src, dst);
     } catch {
     }
   }
@@ -3148,7 +3148,7 @@ function truncateForEmbedding(text) {
   return text.slice(0, MAX_EMBED_CHARS);
 }
 async function sleep2(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 async function fetchWithRetry(url, init, retries = 3) {
   let lastError;
@@ -3347,6 +3347,56 @@ init_mode();
 import { platform, release, homedir as homedir4 } from "os";
 import { basename, join as join7 } from "path";
 import { readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+
+// src/agent/user-shell.ts
+var enabled = false;
+function userShellCommandsEnabled() {
+  return enabled;
+}
+var USER_SHELL_PROMPT_SECTION = `## Commands the user runs with \`!\`
+
+The user can run a shell command directly in this session by typing \`!\` followed by the command in the prompt (for example \`! gh auth login\`). It runs in their real terminal with full keyboard input, and the output is added to this conversation for you to read.
+
+Your \`bash\` tool has no terminal: stdin is closed and there is no TTY, so anything that waits for typed input fails or hangs. Instead of running the command yourself, suggest \`! <exact command>\` when:
+- it needs a login or interactive auth (\`gh auth login\`, \`npm login\`, \`docker login\`, \`gcloud auth login\`, \`aws sso login\`, \`az login\`, \`wrangler login\`, \`vercel login\`, \u2026)
+- it prompts for a password, passphrase, one-time code, or confirmation (\`sudo \u2026\`, \`ssh\` with a passphrase or unknown host key, \`git push\` over HTTPS asking for credentials)
+- it is an interactive program (REPLs, setup wizards without non-interactive flags, \`git rebase -i\`, editors, TUIs)
+- the user would otherwise have to paste a secret (token, password) into the chat
+- one of your bash calls failed with a "not logged in", "authentication required", "not a tty", or "terminal required" error, or timed out waiting for input
+- the user declined permission for a command but still wants it run
+
+Prefer non-interactive flags when they exist (\`--yes\`, \`-m\`, \`--with-token\` reading an env var, \`CI=1\`) and run the command yourself. Don't suggest \`!\` for commands your bash tool can run. When you do suggest it, give the exact line to type (e.g. "run \`! gh auth login\` in the prompt, then tell me when you're done") and stop; the output will appear in the conversation.`;
+var AUTH_OR_TTY_OUTPUT = [
+  /not logged in(?:to)?\b/i,
+  /you are not logged in/i,
+  /\b(?:authentication|login|sign[- ]?in) (?:is )?required\b/i,
+  /\bplease (?:run|use) [`'"]?[\w.-]+ (?:auth )?log ?in\b/i,
+  /\bto (?:authenticate|get started with [\w ]+CLI), (?:please )?run\b/i,
+  /\bgh auth login\b/i,
+  /\bnot a tty\b/i,
+  /\binappropriate ioctl for device\b/i,
+  /\b(?:stdin|input) is not a (?:tty|terminal)\b/i,
+  /\b(?:a|no) (?:terminal|tty) (?:is )?(?:required|present)\b/i,
+  /\bmust be run (?:from|in) an? (?:terminal|interactive)/i,
+  /\brequires an interactive (?:terminal|shell|session)\b/i,
+  /\bcannot prompt\b|\bunable to prompt\b|\bprompts? (?:are )?disabled\b/i,
+  /\bcould not read (?:username|password) for\b/i,
+  /\bterminal prompts disabled\b/i,
+  /\bhost key verification failed\b/i
+];
+var INTERACTIVE_COMMAND = /^(?:sudo\b|ssh\b|passwd\b|su\b|gh auth login\b|npm (?:login|adduser)\b|yarn (?:npm )?login\b|pnpm login\b|docker login\b|gcloud auth\b|aws (?:sso )?(?:login|configure)\b|az login\b|firebase login\b|vercel login\b|wrangler login\b|netlify login\b|heroku login\b|fly(?:ctl)? auth login\b|op signin\b|gpg\b)/i;
+var TRAILING_PROMPT = /(?:password|passphrase|username|token|code|otp)[^\n]{0,40}:\s*$|\[(?:y\/n|Y\/n|y\/N)\]\s*$|\(y(?:es)?\/n(?:o)?\)\s*$|\?\s*$/i;
+function interactiveCommandHint(o) {
+  if (!o.timedOut && o.exitCode === 0) return null;
+  const cmd = o.command.trim().replace(/^cd\s+[^\s&;]+\s*(?:&&|;)\s*/, "");
+  const tail = o.output.slice(-4e3);
+  const looksInteractive = AUTH_OR_TTY_OUTPUT.some((re) => re.test(tail)) || INTERACTIVE_COMMAND.test(cmd) || o.timedOut && TRAILING_PROMPT.test(tail.trimEnd());
+  if (!looksInteractive) return null;
+  const suggestion = cmd.length <= 200 && !cmd.includes("\n") ? `\`! ${cmd}\`` : "`! <command>`";
+  return `[autopilot] This command appears to need a login, a password, or an interactive terminal, which your bash tool cannot provide. Don't retry it as-is. If a non-interactive alternative exists, use it; otherwise ask the user to run ${suggestion} in the prompt and wait for its output to appear in the conversation.`;
+}
+
+// src/agent/system-prompt.ts
 var CONTEXT_FILENAMES = ["KIMI.md", "KIMIFLARE.md", "AGENT.md"];
 var MAX_CONTEXT_BYTES = 20 * 1024;
 function loadContextFile(cwd) {
@@ -3409,6 +3459,9 @@ If the user asks what model you are, answer with exactly: \`${opts.model}\`. Thi
   const lspBlock = hasLsp ? "\n\nLSP tools are available for semantic code intelligence. Prefer `lsp_definition` over `grep` when looking for the source of a symbol. Prefer `lsp_references` over `grep` when finding usages. Use `lsp_hover` to confirm types before refactoring." : "";
   const tools = `Tools available:
 ${toolsBlock}`;
+  const userShellBlock = userShellCommandsEnabled() ? `
+
+${USER_SHELL_PROMPT_SECTION}` : "";
   const ctx = loadContextFile(opts.cwd);
   const contextBlock = ctx ? `
 
@@ -3445,13 +3498,19 @@ ${opts.lspContext}` : "";
 The following MCP server information was pre-computed by the coordinator.
 
 ${opts.mcpContext}` : "";
-  return identity + "\n\n" + env + "\n\n" + tools + lspBlock + contextBlock + modeBlock + skillsBlock + memoryBlock + lspContextBlock + mcpContextBlock;
+  const delegationBlock = opts.delegationDirective ? `
+
+## Subagent policy for this turn
+
+${opts.delegationDirective}` : "";
+  return identity + "\n\n" + env + "\n\n" + tools + lspBlock + userShellBlock + contextBlock + modeBlock + skillsBlock + memoryBlock + lspContextBlock + mcpContextBlock + delegationBlock;
 }
 function buildSystemPrompt(opts) {
   return buildStaticPrefix(opts) + "\n\n" + buildSessionPrefix(opts);
 }
 
 // src/agent/loop.ts
+var MAX_LOOP_RECOVERIES = 1;
 var BudgetExhaustedError = class extends Error {
   constructor(message = "Cumulative input token budget exhausted") {
     super(message);
@@ -3459,7 +3518,7 @@ var BudgetExhaustedError = class extends Error {
   }
 };
 var AgentLoopError = class extends Error {
-  constructor(message = "Agent got stuck repeating the same tool calls") {
+  constructor(message = "Agent got stuck repeating the same tool calls and was stopped after a recovery attempt") {
     super(message);
     this.name = "AgentLoopError";
   }
@@ -3516,6 +3575,12 @@ async function runAgentTurn(opts) {
   const turnStart = performance.now();
   logger.info("turn:start", { sessionId: opts.sessionId, codeMode: opts.codeMode ?? false });
   const max = opts.maxToolIterations ?? 200;
+  const limitBehavior = opts.toolLimitBehavior ?? (opts.continueOnLimit ? "continue" : "throw");
+  const requestedCeiling = opts.maxTotalToolIterations;
+  const hardCeiling = Math.max(
+    max,
+    requestedCeiling !== void 0 && Number.isFinite(requestedCeiling) && requestedCeiling > 0 ? Math.floor(requestedCeiling) : max * 5
+  );
   const codeMode = opts.codeMode ?? false;
   const fireStopHook = async () => {
     if (opts.signal.aborted) return;
@@ -3582,7 +3647,8 @@ async function runAgentTurn(opts) {
           model: opts.model,
           mode: opts.mode,
           skillContext: skillResult.skillContext,
-          preferPullRequests: opts.preferPullRequests
+          preferPullRequests: opts.preferPullRequests,
+          delegationDirective: opts.delegationDirective
         })
       };
     } else {
@@ -3594,7 +3660,8 @@ async function runAgentTurn(opts) {
           model: opts.model,
           mode: opts.mode,
           skillContext: skillResult.skillContext,
-          preferPullRequests: opts.preferPullRequests
+          preferPullRequests: opts.preferPullRequests,
+          delegationDirective: opts.delegationDirective
         })
       };
     }
@@ -3665,8 +3732,11 @@ IMPORTANT \u2014 explore through code, not direct tools: to read files, run shel
   const WEB_FETCH_DOMAIN_THRESHOLD = 2;
   let cumulativePromptTokens = 0;
   let iter = 0;
+  let totalIter = 0;
   let budgetExhausted = false;
   let loopExhausted = false;
+  let loopRecoveries = 0;
+  let finalizeReason = null;
   let currentTasks = [];
   let mutatingToolsSinceLastTasksSet = 0;
   const MUTATING_TOOLS2 = /* @__PURE__ */ new Set(["write", "edit", "bash"]);
@@ -3684,36 +3754,43 @@ IMPORTANT \u2014 explore through code, not direct tools: to read files, run shel
         content: "You have reached the cumulative input token budget for this session. Please synthesize your findings and provide a final summary of what was accomplished."
       });
     }
-    if (loopExhausted) {
+    if (finalizeReason === null && totalIter >= hardCeiling) {
+      finalizeReason = "limit_ceiling";
       opts.messages.push({
         role: "system",
-        content: "You have repeatedly called the same tools with identical arguments and are stuck in a loop. Please synthesize what you know from the conversation history and provide a final answer."
+        content: `You have reached the hard safety ceiling of ${hardCeiling} tool iterations for this turn. Do not call any more tools. Summarize what you accomplished, what remains unfinished, and the concrete next steps needed to complete the task.`
       });
-    }
-    if (iter >= max) {
-      if (opts.callbacks.onToolLimitReached) {
-        const decision = await opts.callbacks.onToolLimitReached();
-        if (decision === "continue") {
-          opts.messages.push({
-            role: "system",
-            content: "You have reached the tool-call limit for this session. The counter has been reset so you can continue working. Please proceed with your task."
-          });
-          iter = 0;
-        } else {
-          await fireStopHook();
-          return;
-        }
-      } else if (opts.continueOnLimit) {
+      opts.callbacks.onGuardrail?.({
+        kind: "limit_ceiling",
+        message: `Tool-iteration ceiling (${hardCeiling}) reached \u2014 wrapping up the turn with a summary.`,
+        totalIterations: totalIter
+      });
+    } else if (finalizeReason === null && iter >= max) {
+      if (limitBehavior === "continue") {
         opts.messages.push({
           role: "system",
           content: "You have reached the tool-call limit for this session. The counter has been reset so you can continue working. Please proceed with your task."
         });
         iter = 0;
+        opts.callbacks.onGuardrail?.({
+          kind: "limit_reset",
+          message: `Tool-call limit (${max}) reached \u2014 counter reset automatically (${totalIter}/${hardCeiling} total).`,
+          totalIterations: totalIter
+        });
+      } else if (limitBehavior === "stop") {
+        opts.callbacks.onGuardrail?.({
+          kind: "limit_stopped",
+          message: `Tool-call limit (${max}) reached \u2014 turn stopped.`,
+          totalIterations: totalIter
+        });
+        await fireStopHook();
+        return;
       } else {
         throw new Error(`kimiflare: tool iteration limit reached (${max})`);
       }
     }
     iter++;
+    totalIter++;
     turn++;
     const previousMessages = opts.messages.slice();
     const toolCalls = [];
@@ -3852,8 +3929,21 @@ IMPORTANT \u2014 explore through code, not direct tools: to read files, run shel
         }))
       } : {}
     };
+    if (finalizeReason !== null) {
+      delete assistantMsg.tool_calls;
+      if (!assistantMsg.content) {
+        assistantMsg.content = finalizeReason === "loop" ? "Stopped: I kept repeating blocked tool calls and could not make further progress on this task." : `Stopped: reached the ${hardCeiling}-iteration safety ceiling for this turn before finishing.`;
+      }
+    }
     opts.messages.push(assistantMsg);
     opts.callbacks.onAssistantFinal?.(assistantMsg);
+    if (finalizeReason !== null) {
+      logger.info("turn:finalized", { sessionId: opts.sessionId, reason: finalizeReason, totalIter });
+      if (budgetExhausted) throw new BudgetExhaustedError();
+      await fireStopHook();
+      if (finalizeReason === "loop") throw new AgentLoopError();
+      return;
+    }
     if (toolCalls.length === 0) {
       if (opts.sessionId && lastUsage) {
         void logTurnDebug({
@@ -3881,9 +3971,11 @@ IMPORTANT \u2014 explore through code, not direct tools: to read files, run shel
       return;
     }
     let blockedCount = 0;
+    const availableToolNames = new Set(opts.tools.map((tool) => tool.name));
+    if (codeMode) availableToolNames.add("execute_code");
     const allReadOnly = toolCalls.length > 1 && toolCalls.every((tc) => {
       const tool = opts.executor.list().find((t) => t.name === tc.function.name);
-      return tool?.isReadOnly === true;
+      return availableToolNames.has(tc.function.name) && tool?.isReadOnly === true;
     });
     if (allReadOnly) {
       opts.callbacks.onInfo?.(`${toolCalls.length} read-only tools running in parallel`);
@@ -4123,6 +4215,26 @@ IMPORTANT \u2014 explore through code, not direct tools: to read files, run shel
       for (const [i, tc] of toolCalls.entries()) {
         if (opts.signal.aborted) throw new DOMException("aborted", "AbortError");
         const loopSignature = `${tc.function.name}:${stableStringify(tc.function.arguments)}`;
+        if (!availableToolNames.has(tc.function.name)) {
+          const unavailableResult = {
+            tool_call_id: tc.id,
+            name: tc.function.name,
+            content: `Tool ${tc.function.name} is not available under this turn's policy. Continue without it or ask the user to enable it.`,
+            ok: false
+          };
+          toolResults.push(unavailableResult);
+          opts.messages.push({
+            role: "tool",
+            tool_call_id: tc.id,
+            content: sanitizeString(unavailableResult.content),
+            name: tc.function.name
+          });
+          opts.callbacks.onToolResult?.(unavailableResult);
+          recentToolCalls.push(loopSignature);
+          if (recentToolCalls.length > LOOP_WINDOW) recentToolCalls.shift();
+          blockedCount++;
+          continue;
+        }
         const loopCount = recentToolCalls.filter((s) => s === loopSignature).length;
         if (loopCount >= LOOP_THRESHOLD) {
           const warning = `Loop detected: you have called ${tc.function.name} with the same arguments multiple times in a row. Consider a different approach.`;
@@ -4485,30 +4597,30 @@ ${sandboxResult.output}` : sandboxResult.output;
       throw new BudgetExhaustedError();
     }
     if (loopExhausted) {
-      if (opts.callbacks.onLoopDetected) {
-        const decision = await opts.callbacks.onLoopDetected();
-        if (decision === "continue") {
-          opts.messages.push({
-            role: "system",
-            content: "You were stuck calling the same tools with identical arguments. The guardrail has been reset so you can continue. Try a different approach."
-          });
-          loopExhausted = false;
-          recentToolCalls.length = 0;
-          continue;
-        }
-        if (decision === "synthesize") {
-          opts.messages.push({
-            role: "system",
-            content: "You were stuck calling the same tools with identical arguments. Please synthesize and conclude your findings so far. Do not call any more tools."
-          });
-          loopExhausted = false;
-          recentToolCalls.length = 0;
-          continue;
-        }
-        await fireStopHook();
-        return;
+      loopExhausted = false;
+      recentToolCalls.length = 0;
+      if (loopRecoveries < MAX_LOOP_RECOVERIES) {
+        loopRecoveries++;
+        opts.messages.push({
+          role: "system",
+          content: "Every tool call in your last step was blocked because you kept repeating the same calls with identical arguments. Do not repeat them. Either take a genuinely different approach (different tools, arguments, or files), or, if you already have enough information, stop calling tools and give your final answer."
+        });
+        opts.callbacks.onGuardrail?.({
+          kind: "loop_recovery",
+          message: "Loop guardrail: repeated tool calls were blocked \u2014 asked the agent to change approach."
+        });
+        continue;
       }
-      throw new AgentLoopError();
+      finalizeReason = "loop";
+      opts.messages.push({
+        role: "system",
+        content: "You are still repeating blocked tool calls after being asked to change approach, so this turn is ending. Do not call any more tools. Summarize what you accomplished, what is blocking you, and what the user could do next."
+      });
+      opts.callbacks.onGuardrail?.({
+        kind: "loop_stopped",
+        message: "Loop guardrail: the agent kept repeating blocked tool calls \u2014 ending the turn with a summary."
+      });
+      continue;
     }
   }
 }
@@ -4875,15 +4987,15 @@ function makeErrorOutput(message) {
   return { content: message, rawBytes: bytes, reducedBytes: bytes };
 }
 async function execOnce(command, cwd) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     const child = spawn("bash", ["-lc", command], { cwd });
     let out = "";
     child.stdout.on("data", (d) => {
       out += d.toString("utf8");
     });
     child.on("close", (code) => {
-      if (code !== 0) return resolve4(void 0);
-      resolve4(out.trim() || void 0);
+      if (code !== 0) return resolve6(void 0);
+      resolve6(out.trim() || void 0);
     });
   });
 }
@@ -5021,7 +5133,7 @@ async function runBash(args, ctx) {
   if (pushGuard) return pushGuard;
   const { shell, args: shellArgs, isPosix } = getShellCommand(ctx.shell);
   const command = isPosix ? injectCoauthor(args.command, ctx.coauthor) : args.command;
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     logger.debug("bash:spawn", { command: args.command.slice(0, 200), cwd: ctx.cwd, shell });
     const child = spawn(shell, [...shellArgs, command], {
       cwd: ctx.cwd,
@@ -5030,6 +5142,7 @@ async function runBash(args, ctx) {
         GIT_EDITOR: "true"
       }
     });
+    child.stdin?.end();
     let stdout = "";
     let stderr = "";
     let killedByTimeout = false;
@@ -5073,8 +5186,18 @@ ${stdout.trimEnd()}`);
       if (stderr) parts.push(`--- stderr ---
 ${stderr.trimEnd()}`);
       if (!stdout && !stderr) parts.push("(no output)");
+      if (userShellCommandsEnabled() && !killedByAbort) {
+        const hint = interactiveCommandHint({
+          command: args.command,
+          exitCode: code,
+          timedOut: killedByTimeout,
+          output: `${stdout}
+${stderr}`
+        });
+        if (hint) parts.push(hint);
+      }
       const raw = parts.join("\n");
-      resolve4({
+      resolve6({
         content: raw,
         rawBytes: Buffer.byteLength(raw, "utf8"),
         reducedBytes: Buffer.byteLength(raw, "utf8")
@@ -6419,7 +6542,7 @@ var browserFetchTool = {
 };
 async function autoScroll(page) {
   await page.evaluate(async () => {
-    await new Promise((resolve4) => {
+    await new Promise((resolve6) => {
       let totalHeight = 0;
       const distance = 300;
       const timer2 = setInterval(() => {
@@ -6428,12 +6551,12 @@ async function autoScroll(page) {
         totalHeight += distance;
         if (totalHeight >= scrollHeight) {
           clearInterval(timer2);
-          resolve4();
+          resolve6();
         }
       }, 100);
       setTimeout(() => {
         clearInterval(timer2);
-        resolve4();
+        resolve6();
       }, 1e4);
     });
   });
@@ -6658,9 +6781,13 @@ function readReasoningEffortEnv() {
   const raw = process.env.KIMI_REASONING_EFFORT?.toLowerCase();
   return EFFORTS.includes(raw ?? "") ? raw : void 0;
 }
+function readSubagentPolicyEnv() {
+  const raw = process.env.KIMIFLARE_SUBAGENT_POLICY?.toLowerCase();
+  return raw === "off" || raw === "suggest" || raw === "auto" ? raw : void 0;
+}
 function readCoauthorEnv() {
-  const enabled = process.env.KIMIFLARE_COAUTHOR;
-  if (enabled === "0" || enabled === "false") return void 0;
+  const enabled2 = process.env.KIMIFLARE_COAUTHOR;
+  if (enabled2 === "0" || enabled2 === "false") return void 0;
   const name = process.env.KIMIFLARE_COAUTHOR_NAME || "kimiflare";
   const email = process.env.KIMIFLARE_COAUTHOR_EMAIL || "kimiflare@proton.me";
   return { enabled: true, name, email };
@@ -6694,6 +6821,7 @@ async function loadConfig() {
   if (!openrouterApiKey && !baseUrl) return null;
   const envModel = process.env.KIMI_MODEL || void 0;
   const envEffort = readReasoningEffortEnv();
+  const envSubagentPolicy = readSubagentPolicyEnv();
   const envCoauthor = readCoauthorEnv();
   const envCacheStable = process.env.KIMIFLARE_CACHE_STABLE_PROMPTS;
   const cacheStablePrompts = envCacheStable === "0" || envCacheStable === "false" ? false : true;
@@ -6714,6 +6842,7 @@ async function loadConfig() {
     model: m(envModel ?? persisted.model) ?? DEFAULT_MODEL,
     openrouterProvider: persisted.openrouterProvider,
     reasoningEffort: envEffort ?? persisted.reasoningEffort,
+    subagentPolicy: envSubagentPolicy ?? (persisted.subagentPolicy === "off" || persisted.subagentPolicy === "suggest" || persisted.subagentPolicy === "auto" ? persisted.subagentPolicy : "suggest"),
     modesEnabled: persisted.modesEnabled,
     coauthor: envCoauthor?.enabled ?? persisted.coauthor ?? true,
     coauthorName: envCoauthor?.name ?? persisted.coauthorName,
@@ -6722,6 +6851,7 @@ async function loadConfig() {
     cacheStablePrompts: persisted.cacheStablePrompts ?? cacheStablePrompts,
     compiledContext: persisted.compiledContext ?? compiledContext,
     imageHistoryTurns: imageHistoryTurns === void 0 || Number.isNaN(imageHistoryTurns) ? persisted.imageHistoryTurns : imageHistoryTurns,
+    maxTotalToolIterations: readNumberEnv("KIMIFLARE_MAX_TOTAL_TOOL_ITERATIONS") ?? persisted.maxTotalToolIterations,
     memoryEnabled: readBooleanEnv("KIMIFLARE_MEMORY_ENABLED") ?? persisted.memoryEnabled ?? false,
     memoryDbPath: process.env.KIMIFLARE_MEMORY_DB_PATH ?? persisted.memoryDbPath,
     memoryMaxAgeDays: readNumberEnv("KIMIFLARE_MEMORY_MAX_AGE_DAYS") ?? persisted.memoryMaxAgeDays,
@@ -6746,6 +6876,7 @@ async function loadConfig() {
     githubTokenExpiry: persisted.githubTokenExpiry,
     githubRepo: persisted.githubRepo,
     workerEndpoint: process.env.KIMIFLARE_WORKER_ENDPOINT ?? persisted.workerEndpoint,
+    workerBackend: process.env.KIMIFLARE_WORKER_BACKEND === "hotcell" ? "hotcell" : process.env.KIMIFLARE_WORKER_BACKEND === "remote" ? "remote" : persisted.workerBackend === "hotcell" ? "hotcell" : "remote",
     workerBudgetUsd: readNumberEnv("KIMIFLARE_WORKER_BUDGET_USD") ?? persisted.workerBudgetUsd,
     workerBudgetMaxUsd: readNumberEnv("KIMIFLARE_WORKER_BUDGET_MAX_USD") ?? persisted.workerBudgetMaxUsd,
     workerMaxParallel: readNumberEnv("KIMIFLARE_WORKER_MAX_PARALLEL") ?? persisted.workerMaxParallel,
@@ -6851,6 +6982,330 @@ async function saveConfig(cfg) {
   return p;
 }
 
+// src/tools/hotcell-worker.ts
+import { spawn as spawn2 } from "child_process";
+import { promisify as promisify2 } from "util";
+import { execFile as execFile2 } from "child_process";
+import { resolve as resolve3 } from "path";
+var execFileAsync = promisify2(execFile2);
+var MAX_OUTPUT_BYTES = 1e6;
+var MAX_PROMPT_CHARS = 4e4;
+var DEFAULT_CELL_TIMEOUT_MS = 3e5;
+var MAX_PARALLEL_WORKERS = 3;
+var runningWorkers = 0;
+var workerQueue = [];
+async function runHotcellWorker(options) {
+  const workerId = `hotcell-${crypto.randomUUID().slice(0, 8)}`;
+  const cwd = resolve3(options.cwd ?? process.cwd());
+  const model = options.model.trim();
+  if (!model) throw new Error("Hotcell workers require the coordinator's explicit model ID.");
+  validateModelId(model);
+  if (options.task.length + (options.context?.length ?? 0) > MAX_PROMPT_CHARS) {
+    throw new Error(`Hotcell worker prompt exceeds the ${MAX_PROMPT_CHARS.toLocaleString()} character limit.`);
+  }
+  if (!Number.isFinite(options.budgetUsd) || options.budgetUsd <= 0) {
+    throw new Error("Hotcell worker spend cap must be a positive number.");
+  }
+  if (options.signal?.aborted) return terminalResult(workerId, options.task, "cancelled", "Cancelled before worker setup.");
+  await acquireSlot(options.maxParallel ?? MAX_PARALLEL_WORKERS, options.signal);
+  let cellId;
+  let result;
+  const command = options.hotcellCommand ?? process.env.HOTCELL_BIN ?? "hotcell";
+  const execute = options.processRunner ?? runProcess;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_CELL_TIMEOUT_MS;
+  try {
+    const repo = await getCleanRepository(cwd);
+    const cellName = "autopilot-" + workerId;
+    const created = await execute(command, [
+      "create",
+      "-n",
+      "1",
+      "--name",
+      cellName,
+      "--repo",
+      repo.url,
+      "--ref",
+      repo.ref,
+      "--egress",
+      "--egress-spend-cap",
+      String(options.budgetUsd),
+      "--memory",
+      "1024",
+      "--cpus",
+      "2"
+    ], { cwd, signal: options.signal, timeoutMs: 3e5 });
+    cellId = parseCellId(created.stdout);
+    if (!cellId) {
+      try {
+        const cells = await execute(command, ["ls"], { cwd, timeoutMs: 1e4 });
+        cellId = parseNamedCellId(cells.stdout, cellName);
+      } catch {
+      }
+    }
+    if (created.timedOut || created.aborted) {
+      result = terminalResult(
+        workerId,
+        options.task,
+        options.signal?.aborted ? "cancelled" : "timed_out",
+        options.signal?.aborted ? "Cancelled during Hotcell setup." : "Hotcell setup timed out before the worker started.",
+        model
+      );
+      return result;
+    }
+    if (created.code !== 0) throw new Error(formatSetupFailure(created));
+    if (!cellId) throw new Error("Hotcell created a sandbox but did not return a recognizable cell ID.");
+    if (/no providers configured|providers:\s*\(none\)/i.test(created.stdout)) {
+      result = terminalResult(workerId, options.task, "failed", "Hotcell has no OpenRouter gateway route. Run `hotcell keys add openrouter` on the daemon host, then retry.", model);
+      return result;
+    }
+    const prompt = [
+      "You are an isolated, read-only research worker. You cannot edit files, run shell commands, push, publish, or call write-capable integrations.",
+      "Use the exact requested model and return concise findings, recommendations, and relevant file paths. Do not claim to have changed files.",
+      `Mission:
+${options.task}`,
+      options.context ? `Coordinator context:
+${options.context}` : ""
+    ].filter(Boolean).join("\n\n");
+    const encodedPrompt = Buffer.from(prompt, "utf8").toString("base64");
+    const shellCommand = [
+      'GIT_DIR="$(find /workspace -mindepth 2 -maxdepth 5 -name .git -print -quit)"',
+      'test -n "$GIT_DIR"',
+      'REPO_ROOT="${GIT_DIR%/.git}"',
+      `git -C "$REPO_ROOT" fetch --quiet origin ${shellQuote(repo.commit)}`,
+      `git -C "$REPO_ROOT" checkout --quiet --detach ${shellQuote(repo.commit)}`,
+      'cd "$REPO_ROOT"',
+      "npm ci --no-audit --no-fund --loglevel=error 1>&2",
+      'export OPENROUTER_BASE_URL="${OPENROUTER_BASE_URL%/}/v1"',
+      `PROMPT="$(printf '%s' '${encodedPrompt}' | base64 -d)"`,
+      `node --import tsx "$REPO_ROOT/src/index.tsx" --format json --max-input-tokens 14000 --model ${shellQuote(model)} --worker-profile research -p "$PROMPT"`
+    ].join(" && ");
+    const execution = await execute(command, ["exec", cellId, shellCommand, "--cwd", "/workspace"], {
+      cwd,
+      signal: options.signal,
+      timeoutMs
+    });
+    const stats = await execute(command, ["stats", cellId], { cwd, timeoutMs: 3e4 }).catch(() => void 0);
+    const metrics = stats?.code === 0 ? parseHotcellStats(stats.stdout) : {};
+    const json = parsePrintOutput(execution.stdout);
+    const summary = typeof json?.text === "string" ? json.text.trim() : execution.stdout.trim();
+    const tokensUsed = typeof json?.usage?.totalTokens === "number" ? json.usage.totalTokens : 0;
+    const budgetExhausted = execution.code === 42;
+    const diagnostic = `${execution.stdout}
+${execution.stderr}`.toLowerCase();
+    const executionDiagnostic = sanitizeHotcellDiagnostic(execution.stderr);
+    const spendExhausted = /(?:http\s*)?402|spend cap|spending limit/.test(diagnostic);
+    const status = execution.timedOut ? "timed_out" : execution.aborted ? options.signal?.aborted ? "cancelled" : "failed" : spendExhausted ? "spend_exhausted" : budgetExhausted ? "budget_exhausted" : execution.code === 0 ? "completed" : "failed";
+    const findings = summary ? [{ topic: "Research findings", summary: summary.slice(0, 4e4), confidence: "medium", sources: [], relevance: "high" }] : [];
+    result = {
+      workerId,
+      status,
+      task: options.task,
+      findings,
+      recommendations: [],
+      filesRead: [],
+      webSources: [],
+      costUsd: metrics.costUsd ?? 0,
+      tokensUsed: metrics.tokensUsed ?? tokensUsed,
+      reasoning: "",
+      model,
+      exitCode: execution.code,
+      ...budgetExhausted || spendExhausted ? { budgetExceeded: true, partialResult: findings.length > 0 } : {},
+      ...execution.code !== 0 && !budgetExhausted ? {
+        error: status === "timed_out" ? "Worker timed out." : status === "cancelled" ? "Worker cancelled." : spendExhausted ? "Hotcell per-cell spend cap was reached." : execution.outputLimitExceeded ? "Worker output exceeded the 1 MB result limit." : /unknown model|model.{0,30}(?:not found|invalid|unavailable|unsupported)/i.test(diagnostic) ? "The requested model is unavailable in the Hotcell OpenRouter gateway." : /no openrouter api key|openrouter.{0,30}(?:key|gateway).{0,30}(?:missing|not configured)/i.test(diagnostic) ? "Hotcell OpenRouter gateway credentials are not configured. Run `hotcell keys add openrouter` on the daemon host." : `Worker process exited with code ${execution.code}${executionDiagnostic ? `: ${executionDiagnostic}` : "."}`
+      } : {}
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown Hotcell worker error.";
+    result = terminalResult(workerId, options.task, options.signal?.aborted ? "cancelled" : "failed", message, model);
+  } finally {
+    if (cellId) {
+      try {
+        const removed = await execute(command, ["rm", cellId], { cwd, timeoutMs: 3e4 });
+        if (removed.code !== 0 && result) {
+          result = {
+            ...result,
+            status: result.status === "completed" ? "failed" : result.status,
+            error: [result.error, "Hotcell cleanup failed; remove the cell manually to revoke its gateway token."].filter(Boolean).join(" ")
+          };
+        }
+      } catch {
+        if (result) {
+          result = {
+            ...result,
+            status: result.status === "completed" ? "failed" : result.status,
+            error: [result.error, "Hotcell cleanup failed; remove the cell manually to revoke its gateway token."].filter(Boolean).join(" ")
+          };
+        }
+      }
+    }
+    releaseSlot();
+  }
+  return result;
+}
+async function getCleanRepository(cwd) {
+  const root = (await execFileAsync("git", ["rev-parse", "--show-toplevel"], { cwd })).stdout.trim();
+  const status = (await execFileAsync("git", ["status", "--porcelain"], { cwd: root })).stdout;
+  if (status.trim()) throw new Error("Hotcell workers require a clean Git checkout; commit or stash local changes first.");
+  const commit = (await execFileAsync("git", ["rev-parse", "HEAD"], { cwd: root })).stdout.trim();
+  const ref = (await execFileAsync("git", ["branch", "--show-current"], { cwd: root })).stdout.trim();
+  if (!ref) throw new Error("Hotcell workers require a named branch so the daemon can clone before pinning the exact commit.");
+  const url = (await execFileAsync("git", ["config", "--get", "remote.origin.url"], { cwd: root })).stdout.trim();
+  if (!/^(https:\/\/|git@|ssh:\/\/)/i.test(url) || /:\/\/[^/]*@/.test(url)) {
+    throw new Error("Hotcell workers require a credential-free HTTPS or SSH origin URL that the Hotcell daemon can clone.");
+  }
+  return { url, commit, ref };
+}
+function parseCellId(output) {
+  const uuid = output.match(/\b[a-f0-9]{8}(?:-[a-f0-9]{4,}){0,4}\b/gi)?.at(-1);
+  if (uuid) return uuid;
+  const labeled = output.match(/(?:sandbox|cell)(?:\s+id)?\s*[:= ]\s*([a-z0-9][a-z0-9_-]{7,79})/i)?.[1];
+  if (labeled) return labeled;
+  return output.split(/\r?\n/).map((line) => line.trim()).reverse().find((line) => /^[a-z0-9][a-z0-9_-]{7,79}$/i.test(line));
+}
+function parseNamedCellId(output, name) {
+  for (const line of output.split(/\r?\n/)) {
+    const columns = line.trim().split(/\s+/);
+    if (columns[1] === name && /^[a-z0-9][a-z0-9_-]{7,79}$/i.test(columns[0] ?? "")) return columns[0];
+  }
+  return void 0;
+}
+function formatSetupFailure(result) {
+  const detail = sanitizeHotcellDiagnostic(`${result.stderr}
+${result.stdout}`);
+  return `Hotcell setup failed (exit ${result.code})${detail ? `: ${detail}` : ". Check that the daemon, repository access, and gateway route are configured."}`;
+}
+function sanitizeHotcellDiagnostic(text) {
+  return text.replace(/\b(?:sk-or-v1-|sk-ant-|gh[pousr]_|github_pat_)[A-Za-z0-9_-]{8,}\b/gi, "[REDACTED]").replace(/\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi, "Bearer [REDACTED]").replace(/\b[A-Z0-9_]*(?:API[_-]?KEY|ACCESS[_-]?TOKEN|SECRET|PASSWORD)\s*[:=]\s*[^\s,;]+/gi, "[REDACTED]").trim().slice(-1500);
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function parseHotcellStats(output) {
+  const llm = output.match(/LLM:\s*([\d,]+) calls,\s*([\d,]+) in \+ ([\d,]+) out tokens,\s*\$([\d.]+)/i);
+  const totalCost = output.match(/Cost:\s*\$?([\d.]+)/i);
+  const tokensUsed = llm ? Number(llm[2].replaceAll(",", "")) + Number(llm[3].replaceAll(",", "")) : void 0;
+  const costUsd = totalCost ? Number(totalCost[1]) : llm ? Number(llm[4]) : void 0;
+  return {
+    ...Number.isFinite(tokensUsed) ? { tokensUsed } : {},
+    ...Number.isFinite(costUsd) ? { costUsd } : {}
+  };
+}
+function parsePrintOutput(stdout) {
+  const candidate = stdout.trim();
+  try {
+    const parsed = JSON.parse(candidate);
+    if (!parsed || typeof parsed !== "object") return void 0;
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+async function runProcess(executable, args, options) {
+  if (options.signal?.aborted) return { code: 130, stdout: "", stderr: "", aborted: true };
+  return await new Promise((resolvePromise, reject) => {
+    const child = spawn2(executable, args, { cwd: options.cwd, stdio: ["ignore", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    let bytes = 0;
+    let aborted2 = false;
+    let timedOut = false;
+    let outputLimitExceeded = false;
+    let settled = false;
+    const terminate = () => {
+      child.kill("SIGTERM");
+      const forceTimer = setTimeout(() => child.kill("SIGKILL"), 2e3);
+      forceTimer.unref();
+    };
+    const abort = () => {
+      aborted2 = true;
+      terminate();
+    };
+    const timer2 = setTimeout(() => {
+      timedOut = true;
+      terminate();
+    }, options.timeoutMs);
+    timer2.unref();
+    options.signal?.addEventListener("abort", abort, { once: true });
+    const collect = (target, chunk) => {
+      bytes += chunk.length;
+      if (bytes > MAX_OUTPUT_BYTES) {
+        outputLimitExceeded = true;
+        terminate();
+        return;
+      }
+      target.push(chunk);
+    };
+    child.stdout.on("data", (chunk) => collect(stdout, chunk));
+    child.stderr.on("data", (chunk) => collect(stderr, chunk));
+    child.once("error", (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer2);
+      options.signal?.removeEventListener("abort", abort);
+      reject(error);
+    });
+    child.once("close", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer2);
+      options.signal?.removeEventListener("abort", abort);
+      resolvePromise({
+        code: code ?? (aborted2 ? 130 : 1),
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8"),
+        aborted: aborted2,
+        timedOut,
+        outputLimitExceeded
+      });
+    });
+  });
+}
+function terminalResult(workerId, task, status, error, model) {
+  return {
+    workerId,
+    status,
+    task,
+    findings: [],
+    recommendations: [],
+    filesRead: [],
+    webSources: [],
+    costUsd: 0,
+    tokensUsed: 0,
+    reasoning: "",
+    ...model ? { model } : {},
+    error
+  };
+}
+async function acquireSlot(limit, signal) {
+  const cap = Math.max(1, Math.min(MAX_PARALLEL_WORKERS, Math.floor(limit) || 1));
+  if (runningWorkers < cap) {
+    runningWorkers++;
+    return;
+  }
+  await new Promise((resolvePromise, reject) => {
+    const wake = () => {
+      if (signal?.aborted) {
+        const index = workerQueue.indexOf(wake);
+        if (index >= 0) workerQueue.splice(index, 1);
+        reject(new Error("Hotcell worker cancelled while waiting for a slot."));
+        return;
+      }
+      if (runningWorkers < cap) {
+        const index = workerQueue.indexOf(wake);
+        if (index >= 0) workerQueue.splice(index, 1);
+        runningWorkers++;
+        resolvePromise();
+      }
+    };
+    workerQueue.push(wake);
+    signal?.addEventListener("abort", wake, { once: true });
+  });
+}
+function releaseSlot() {
+  runningWorkers = Math.max(0, runningWorkers - 1);
+  for (const wake of workerQueue.slice()) wake();
+}
+
 // src/tools/spawn-worker.ts
 var DEFAULT_WORKER_TIMEOUT_MS = 3e5;
 async function callWorkerEndpoint(endpoint, apiKey, payload, signal, timeoutMs = DEFAULT_WORKER_TIMEOUT_MS) {
@@ -6886,10 +7341,9 @@ async function callWorkerEndpoint(endpoint, apiKey, payload, signal, timeoutMs =
 var spawnWorkerTool = {
   name: "spawn_worker",
   description: [
-    "Spawn a standalone remote worker agent to perform research or execute a plan.",
-    "Workers run independently with their own full context window and tool access.",
-    "Mode 'plan': read-only research worker that returns structured findings.",
-    "Mode 'execute': write-enabled worker that creates a branch, implements changes, and opens a PR.",
+    "Spawn a standalone worker using the configured remote endpoint or an opt-in local Hotcell sandbox.",
+    "Mode 'plan': read-only research. Local Hotcell workers use a clean committed revision and cannot edit files.",
+    "Mode 'execute': remote write + PR only; local Hotcell execute mode is intentionally unavailable.",
     "Use for heavy tasks that benefit from parallel research (e.g. 'research OAuth2, testing, and migration')."
   ].join(" "),
   parameters: {
@@ -6922,11 +7376,11 @@ var spawnWorkerTool = {
       tools: {
         type: "string",
         enum: ["all", "read-only"],
-        description: "Tool set available to the worker. Default 'all' for plan mode, ignored for execute."
+        description: "Requested remote tool set. Local Hotcell research always uses a narrow read-only profile and rejects `all`."
       },
       model: {
         type: "string",
-        description: `Model to use for the worker. Defaults to the session's model (${DEFAULT_MODEL} if unset).`
+        description: "Model to use for the worker. Defaults to the active session model."
       },
       branchName: {
         type: "string",
@@ -6954,25 +7408,71 @@ var spawnWorkerTool = {
     body: args.task.slice(0, 200)
   }),
   async run(args, ctx) {
-    const endpoint = process.env.KIMIFLARE_WORKER_ENDPOINT;
+    const cfg = await loadConfig().catch(() => null);
+    const timeoutMs = cfg?.workerTimeoutMs ?? readNumberEnv2("KIMIFLARE_WORKER_TIMEOUT_MS") ?? DEFAULT_WORKER_TIMEOUT_MS;
+    const budgetCeiling = resolveWorkerBudgetUsd(cfg);
+    if (cfg?.workerBackend === "hotcell") {
+      if (cfg.baseUrl) {
+        return textOutput("Hotcell workers currently require an OpenRouter-backed session; custom model endpoints cannot be routed through the Hotcell gateway.");
+      }
+      if (args.mode !== "plan") {
+        return textOutput("Hotcell workers currently support read-only plan mode only. Execute mode is disabled until reviewed patch artifacts are supported.");
+      }
+      if (args.tools === "all") {
+        return textOutput("Hotcell research workers are restricted to read-only tools; the requested broader toolset is not available.");
+      }
+      const model = args.model ?? ctx.model;
+      if (!model) {
+        return textOutput("Hotcell worker requires the coordinator's active model ID. No model was provided; refusing to fall back to a default.");
+      }
+      const requestedBudget = args.budget?.maxCostUsd ?? budgetCeiling;
+      const budgetUsd = Math.min(requestedBudget, budgetCeiling);
+      if (!Number.isFinite(budgetUsd) || budgetUsd <= 0) {
+        return textOutput("Hotcell worker spend cap must be a positive number.");
+      }
+      try {
+        const result = await runHotcellWorker({
+          task: args.task,
+          context: args.context,
+          model,
+          budgetUsd,
+          timeoutMs,
+          maxParallel: cfg?.workerMaxParallel,
+          cwd: ctx.cwd,
+          signal: ctx.signal
+        });
+        if (result.status !== "completed" && result.status !== "budget_exhausted") {
+          return textOutput(`Hotcell worker ${result.status}: ${result.error ?? "unknown error"}`);
+        }
+        const lines = [
+          `Hotcell worker ${result.status}${result.status === "budget_exhausted" ? " (partial result)" : ""}.`,
+          `Model: ${result.model ?? model} \xB7 Tokens: ${result.tokensUsed.toLocaleString()} \xB7 Cost: ${result.costUsd > 0 ? `${result.costUsd.toFixed(4)} total Hotcell cost` : "unavailable from Hotcell stats"}.`,
+          ...result.findings.map((finding) => `
+## ${finding.topic}
+${finding.summary}`)
+        ];
+        if (result.status === "budget_exhausted") {
+          lines.push("\nWorker input-token budget was exhausted; review partial findings before relying on them.");
+        }
+        return textOutput(lines.join("\n"));
+      } catch (error) {
+        return textOutput(`Failed to spawn Hotcell worker: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+    const endpoint = process.env.KIMIFLARE_WORKER_ENDPOINT ?? cfg?.workerEndpoint ?? cfg?.remoteWorkerUrl;
     if (!endpoint) {
-      const msg = "Worker endpoint not configured. Set KIMIFLARE_WORKER_ENDPOINT or workerEndpoint in config.";
-      const bytes = Buffer.byteLength(msg, "utf8");
-      return { content: msg, rawBytes: bytes, reducedBytes: bytes };
+      return textOutput("Worker endpoint not configured. Set KIMIFLARE_WORKER_ENDPOINT or workerEndpoint in config, or set workerBackend to hotcell.");
     }
     const apiKey = process.env.KIMIFLARE_WORKER_API_KEY;
-    const timeoutMs = readNumberEnv2("KIMIFLARE_WORKER_TIMEOUT_MS") ?? DEFAULT_WORKER_TIMEOUT_MS;
-    const cfg = await loadConfig().catch(() => null);
-    const budgetUsd = resolveWorkerBudgetUsd(cfg);
     const defaultModel = cfg?.model ?? DEFAULT_MODEL;
     const payload = {
       mode: args.mode,
       task: args.task,
       context: args.context ?? "",
-      budget: { maxCostUsd: budgetUsd },
+      budget: { maxCostUsd: budgetCeiling },
       outputFormat: args.outputFormat ?? "structured",
       tools: args.tools ?? (args.mode === "plan" ? "read-only" : "all"),
-      model: args.model ?? defaultModel,
+      model: args.model ?? ctx.model ?? defaultModel,
       ...args.mode === "execute" ? {
         branchName: args.branchName,
         baseBranch: args.baseBranch ?? "main",
@@ -7026,6 +7526,10 @@ var spawnWorkerTool = {
     }
   }
 };
+function textOutput(content) {
+  const bytes = Buffer.byteLength(content, "utf8");
+  return { content, rawBytes: bytes, reducedBytes: bytes };
+}
 function readNumberEnv2(name) {
   const raw = process.env[name];
   if (!raw) return void 0;
@@ -7639,6 +8143,8 @@ function makeExpandArtifactTool(store) {
 }
 
 // src/tools/executor.ts
+import { realpath as realpath2 } from "fs/promises";
+import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve4, sep as sep2 } from "path";
 var ALL_TOOLS = [
   { ...readTool, isReadOnly: true },
   writeTool,
@@ -8522,7 +9028,7 @@ Context: This memory was explicitly provided by the user during a conversation.`
 };
 
 // src/lsp/connection.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import { EventEmitter } from "events";
 var LspConnection = class extends EventEmitter {
   child = null;
@@ -8539,7 +9045,7 @@ var LspConnection = class extends EventEmitter {
     if (this.child) {
       throw new Error("LSP connection already started");
     }
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve6, reject) => {
       const abortController = new AbortController();
       const spawnTimer = setTimeout(() => {
         abortController.abort();
@@ -8547,7 +9053,7 @@ var LspConnection = class extends EventEmitter {
         reject(new Error(`LSP server spawn timed out after ${spawnTimeoutMs}ms`));
       }, spawnTimeoutMs);
       try {
-        const child = spawn2(command[0], command.slice(1), {
+        const child = spawn3(command[0], command.slice(1), {
           env: { ...process.env, ...env },
           stdio: ["pipe", "pipe", "pipe"]
         });
@@ -8578,7 +9084,7 @@ var LspConnection = class extends EventEmitter {
           if (child.pid) {
             clearTimeout(spawnTimer);
             this.child = child;
-            resolve4();
+            resolve6();
           }
         });
       } catch (err) {
@@ -8593,12 +9099,12 @@ var LspConnection = class extends EventEmitter {
     }
     const id = this.nextId++;
     const msg = { jsonrpc: "2.0", id, method, params };
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve6, reject) => {
       const timer2 = setTimeout(() => {
         this.pending.delete(id);
         reject(toolTimeoutError(`LSP request '${method}'`, this.requestTimeoutMs));
       }, this.requestTimeoutMs);
-      const pending = { resolve: resolve4, reject, signal, timer: timer2 };
+      const pending = { resolve: resolve6, reject, signal, timer: timer2 };
       this.pending.set(id, pending);
       if (signal) {
         const onAbort = () => {
@@ -9139,10 +9645,10 @@ var LspManager = class {
 };
 
 // src/lsp/adapter.ts
-import { relative as relative3 } from "path";
+import { relative as relative4 } from "path";
 function formatLocation(loc, cwd) {
   const path = fromUri(loc.uri);
-  const rel = relative3(cwd, path) || path;
+  const rel = relative4(cwd, path) || path;
   return `${rel}:${loc.range.start.line + 1}:${loc.range.start.character + 1}`;
 }
 function formatLocations(locs, cwd) {
@@ -9179,7 +9685,7 @@ function formatWorkspaceSymbols(symbols, cwd) {
   if (!symbols || symbols.length === 0) return "No symbols found.";
   return symbols.map((s) => {
     const path = fromUri(s.location.uri);
-    const rel = relative3(cwd, path) || path;
+    const rel = relative4(cwd, path) || path;
     const container = s.containerName ? ` in ${s.containerName}` : "";
     return `${s.name} (${symbolKindName(s.kind)})${container} \u2014 ${rel}:${s.location.range.start.line + 1}:${s.location.range.start.character + 1}`;
   }).join("\n");
@@ -9199,7 +9705,7 @@ function formatWorkspaceEdit(edit, cwd) {
   if (edit.changes) {
     for (const [uri, edits] of Object.entries(edit.changes)) {
       const path = fromUri(uri);
-      const rel = relative3(cwd, path) || path;
+      const rel = relative4(cwd, path) || path;
       lines.push(`File: ${rel}`);
       for (const e of edits) {
         lines.push(`  ${e.range.start.line + 1}:${e.range.start.character + 1}-${e.range.end.line + 1}:${e.range.end.character + 1}: ${e.newText}`);
@@ -9218,7 +9724,7 @@ function formatCodeActions(actions) {
 }
 
 // src/tools/lsp.ts
-import { relative as relative4 } from "path";
+import { relative as relative5 } from "path";
 function makeOutput2(content) {
   const bytes = Buffer.byteLength(content, "utf8");
   return { content, rawBytes: bytes, reducedBytes: bytes };
@@ -9226,7 +9732,7 @@ function makeOutput2(content) {
 function resolveLspPath(args, ctx) {
   const raw = typeof args.path === "string" ? args.path : "";
   const resolved = resolvePath(ctx.cwd, raw);
-  const rel = relative4(ctx.cwd, resolved);
+  const rel = relative5(ctx.cwd, resolved);
   if (isPathOutside(rel)) {
     throw new Error(`Path outside workspace: ${raw}`);
   }
@@ -9505,11 +10011,11 @@ async function loadSession(filePath) {
 }
 
 // src/usage-tracker.ts
-import { readFile as readFile8, writeFile as writeFile7, mkdir as mkdir6 } from "fs/promises";
+import { readFile as readFile8, rename as rename2 } from "fs/promises";
 import { homedir as homedir8 } from "os";
 import { join as join15 } from "path";
 import { EventEmitter as EventEmitter2 } from "events";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 
 // src/pricing.ts
 var PRICE_IN_PER_M = 0.95;
@@ -9530,6 +10036,59 @@ function calculateCost(promptTokens, completionTokens, cachedTokens = 0, model)
   return { uncachedIn, cachedIn, out, total };
 }
 
+// src/util/atomic-file.ts
+import { mkdir as mkdir6, rename, rm, stat as stat4, writeFile as writeFile7 } from "fs/promises";
+import { dirname as dirname6 } from "path";
+import { randomUUID } from "crypto";
+async function writeFileAtomic(path, data) {
+  await mkdir6(dirname6(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
+  try {
+    await writeFile7(tmp, data, "utf8");
+    await rename(tmp, path);
+  } catch (err) {
+    await rm(tmp, { force: true }).catch(() => void 0);
+    throw err;
+  }
+}
+var LOCK_STALE_MS = 15e3;
+var LOCK_WAIT_MS = 5e3;
+var LOCK_RETRY_MS = 25;
+async function withFileLock(lockPath, fn) {
+  await mkdir6(dirname6(lockPath), { recursive: true });
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  let held = false;
+  while (!held) {
+    try {
+      await mkdir6(lockPath);
+      held = true;
+    } catch (err) {
+      if (err.code !== "EEXIST") break;
+      const age = await stat4(lockPath).then((s) => Date.now() - s.mtimeMs, () => 0);
+      if (age > LOCK_STALE_MS) {
+        await rm(lockPath, { recursive: true, force: true }).catch(() => void 0);
+        continue;
+      }
+      if (Date.now() > deadline) break;
+      await new Promise((r) => setTimeout(r, LOCK_RETRY_MS));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    if (held) await rm(lockPath, { recursive: true, force: true }).catch(() => void 0);
+  }
+}
+function recoverJsonPrefix(raw) {
+  for (let i = raw.lastIndexOf("}"); i > 0; i = raw.lastIndexOf("}", i - 1)) {
+    try {
+      return JSON.parse(raw.slice(0, i + 1));
+    } catch {
+    }
+  }
+  return void 0;
+}
+
 // src/usage-tracker.ts
 var LOG_VERSION2 = 1;
 var usageEvents = new EventEmitter2();
@@ -9553,21 +10112,29 @@ function cutoffDate(daysBack) {
   return d.toISOString().slice(0, 10);
 }
 async function loadLog() {
+  let raw;
   try {
-    const raw = await readFile8(usagePath(), "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed.version === LOG_VERSION2) return parsed;
+    raw = await readFile8(usagePath(), "utf8");
   } catch {
+    return { version: LOG_VERSION2, days: [], sessions: [] };
   }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    await rename2(usagePath(), `${usagePath()}.corrupt-${Date.now()}`).catch(() => void 0);
+    parsed = recoverJsonPrefix(raw);
+  }
+  if (parsed && parsed.version === LOG_VERSION2) return parsed;
   return { version: LOG_VERSION2, days: [], sessions: [] };
 }
 async function saveLog(log2) {
-  await mkdir6(usageDir(), { recursive: true });
-  await writeFile7(usagePath(), JSON.stringify(log2, null, 2), "utf8");
+  await writeFileAtomic(usagePath(), JSON.stringify(log2, null, 2));
 }
 var writeChain = Promise.resolve();
 function withLock(fn) {
-  const next = writeChain.then(fn, fn);
+  const locked = () => withFileLock(`${usagePath()}.lock`, fn);
+  const next = writeChain.then(locked, locked);
   writeChain = next.catch(() => void 0);
   return next;
 }
@@ -9597,8 +10164,7 @@ async function upsertHistoryDay(day) {
     entries.push(day);
   }
   const lines = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-  await mkdir6(usageDir(), { recursive: true });
-  await writeFile7(historyPath(), lines, "utf8");
+  await writeFileAtomic(historyPath(), lines);
 }
 function getOrCreateDay(log2, date) {
   let day = log2.days.find((d) => d.date === date);
@@ -9657,7 +10223,7 @@ async function recordUsage(sessionId, usage, lookup, model) {
   );
   const estimatedCost = cost.total;
   const cachedTokens = usage.prompt_tokens_details?.cached_tokens ?? 0;
-  const turnId = randomUUID();
+  const turnId = randomUUID2();
   const generationId = lookup?.meta.generationId;
   const inlineCost = typeof usage.cost === "number" && Number.isFinite(usage.cost) ? usage.cost : void 0;
   await withLock(async () => {
@@ -9760,7 +10326,7 @@ async function reconcileTurnCost(sessionId, turnId, lookup, fetchImpl2 = fetch,
 // src/models/openrouter-catalog.ts
 import { readFile as readFile9, writeFile as writeFile8, mkdir as mkdir7 } from "fs/promises";
 import { homedir as homedir9 } from "os";
-import { join as join16, dirname as dirname6 } from "path";
+import { join as join16, dirname as dirname7 } from "path";
 var CACHE_VERSION = 4;
 var DEFAULT_CACHE_TTL_MS = 6 * 60 * 60 * 1e3;
 function catalogCachePath() {
@@ -9826,7 +10392,7 @@ async function readCache() {
 async function writeCache(models) {
   const path = catalogCachePath();
   try {
-    await mkdir7(dirname6(path), { recursive: true });
+    await mkdir7(dirname7(path), { recursive: true });
     const cache = { version: CACHE_VERSION, fetchedAt: (/* @__PURE__ */ new Date()).toISOString(), models };
     await writeFile8(path, JSON.stringify(cache, null, 2), "utf8");
   } catch {
@@ -9899,7 +10465,7 @@ function createDefaultPermissionHandler(options) {
 async function createAgentSession(opts) {
   const config2 = await resolveSdkConfig(opts);
   if (!resolveCustomEndpoint(config2)) await ensureOpenRouterCatalog();
-  const cwd = resolve3(opts.cwd ?? process.cwd());
+  const cwd = resolve5(opts.cwd ?? process.cwd());
   const tools = opts.tools ?? ALL_TOOLS;
   let hooks;
   if (opts.enableHooks) {
@@ -10261,6 +10827,10 @@ var InternalSession = class {
       onWarning: (msg) => {
         this.emit({ type: "warning", message: msg });
       },
+      onGuardrail: (ev) => {
+        this.emit({ type: "warning", message: ev.message });
+        if (ev.kind === "limit_stopped") this.emit({ type: "status", status: "error" });
+      },
       askPermission: async (req) => {
         if (mode === "auto") return "allow";
         if (mode === "plan") {
@@ -10280,12 +10850,12 @@ var InternalSession = class {
           toolName: req.tool.name,
           args: req.args
         });
-        const decision = await new Promise((resolve4) => {
-          this.permissionResolvers.set(requestId, resolve4);
+        const decision = await new Promise((resolve6) => {
+          this.permissionResolvers.set(requestId, resolve6);
           setTimeout(() => {
             if (this.permissionResolvers.has(requestId)) {
               this.permissionResolvers.delete(requestId);
-              resolve4("deny");
+              resolve6("deny");
             }
           }, 3e5);
         });
@@ -10296,10 +10866,6 @@ var InternalSession = class {
         });
         return decision;
       },
-      onToolLimitReached: async () => {
-        this.emit({ type: "status", status: "error" });
-        return "stop";
-      },
       onKimiMdStale: () => {
         this.onKimiMdStale?.();
       }
@@ -10317,6 +10883,9 @@ var InternalSession = class {
       hooks: this.hooks,
       // M6.1: Stop fires at end-of-turn when enabled.
       maxToolIterations,
+      // SDK callers bound turns with `maxToolIterations`: stop cleanly at the
+      // limit rather than resetting (never waits on a prompt either way).
+      toolLimitBehavior: "stop",
       reasoningEffort: this.reasoningEffort,
       coauthor,
       sessionId: this.sessionId,