blun-king-cli 9.1.599 → 9.1.601

package/worker-host.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// BLUN_BUILD_INPUT_SHA256:25c271186c418490335e30ef395705d13d90d816c66cac47bb57835f2482f093
+// BLUN_BUILD_INPUT_SHA256:b5b19f76ccc092b4eba456b9da34bbda10f5c0717713caa03a28337eab2cac02
 import { fileURLToPath as __cjsShimFileURLToPath } from 'node:url';
 import { dirname as __cjsShimDirname } from 'node:path';
 const __filename = __cjsShimFileURLToPath(import.meta.url);
@@ -9,14 +9,14 @@ import crypto$1, { createHash, randomBytes, randomInt, randomUUID } from "node:c
 import * as fs$12 from "node:fs";
 import Kt, { appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, opendirSync, promises, readFileSync, readSync, readdirSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import * as path$11 from "node:path";
-import path, { basename, dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
+import path, { basename, dirname, isAbsolute, join, parse, posix, relative, resolve, sep, win32 } from "node:path";
 import { Blob as Blob$1, File as File$1 } from "node:buffer";
 import * as nodeOs from "node:os";
 import os, { arch, homedir, hostname, release, tmpdir, type, userInfo } from "node:os";
 import fs, { access, appendFile, chmod, copyFile, cp, link, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import * as sysPath from "path";
-import path$1, { dirname as dirname$1, parse } from "path";
+import path$1, { dirname as dirname$1, parse as parse$1 } from "path";
 import I, { existsSync as existsSync$1, promises as promises$1, stat as stat$1, unwatchFile, watch, watchFile } from "fs";
 import zi from "assert";
 import Qr, { EventEmitter } from "events";
@@ -469,7 +469,7 @@ const basename$1 = function(p, extension) {
 	}
 	return extension && lastSegment.endsWith(extension) ? lastSegment.slice(0, -extension.length) : lastSegment;
 };
-const parse$8 = function(p) {
+const parse$9 = function(p) {
 	const root = _PATH_ROOT_RE.exec(p)?.[0]?.replace(/\\/g, "/") || "";
 	const base = basename$1(p);
 	const extension = extname(base);
@@ -495,7 +495,7 @@ const _path = {
 	matchesGlob,
 	normalize: normalize$3,
 	normalizeString,
-	parse: parse$8,
+	parse: parse$9,
 	relative: relative$1,
 	resolve: resolve$2,
 	sep: "/",
@@ -8984,7 +8984,7 @@ const ZodError$1 = $constructor("ZodError", initializer);
 const ZodRealError = $constructor("ZodError", initializer, { Parent: Error });
 //#endregion
 //#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/parse.js
-const parse$7 = /* @__PURE__ */ _parse(ZodRealError);
+const parse$8 = /* @__PURE__ */ _parse(ZodRealError);
 const parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
 const safeParse$1 = /* @__PURE__ */ _safeParse(ZodRealError);
 const safeParseAsync = /* @__PURE__ */ _safeParseAsync(ZodRealError);
@@ -9022,7 +9022,7 @@ const ZodType$1 = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
 		reg.add(inst, meta);
 		return inst;
 	});
-	inst.parse = (data, params) => parse$7(inst, data, params, { callee: inst.parse });
+	inst.parse = (data, params) => parse$8(inst, data, params, { callee: inst.parse });
 	inst.safeParse = (data, params) => safeParse$1(inst, data, params);
 	inst.parseAsync = async (data, params) => parseAsync(inst, data, params, { callee: inst.parseAsync });
 	inst.safeParseAsync = async (data, params) => safeParseAsync(inst, data, params);
@@ -15233,7 +15233,7 @@ function peekTable(key, table, meta, type) {
 		state.c
 	];
 }
-function parse$6(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
+function parse$7(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
 	let res = {};
 	let meta = {};
 	let tbl = res;
@@ -15486,7 +15486,7 @@ function loadRuntimeConfigSafe(filePath, env = process.env) {
 	if (text !== void 0 && text.trim().length > 0) {
 		let data;
 		try {
-			data = parse$6(text);
+			data = parse$7(text);
 		} catch (error) {
 			fileError = new BlunError(ErrorCodes.CONFIG_INVALID, `Invalid TOML in ${filePath}: ${describeUnknownError(error)}`, { cause: error });
 			fileWarnings.push(`Invalid TOML in ${filePath}: ${describeTomlSyntaxError(error)}.`);
@@ -15568,7 +15568,7 @@ function parseConfigString(tomlText, filePath = "config.toml") {
 	if (tomlText.trim().length === 0) return getDefaultConfig();
 	let data;
 	try {
-		data = parse$6(tomlText);
+		data = parse$7(tomlText);
 	} catch (error) {
 		throw new BlunError(ErrorCodes.CONFIG_INVALID, `Invalid TOML in ${filePath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
 	}
@@ -15967,7 +15967,7 @@ async function readWorkspaceLocalToml(kaos, configPath) {
 	};
 	let raw;
 	try {
-		raw = parse$6(text);
+		raw = parse$7(text);
 	} catch (error) {
 		throw new BlunError(ErrorCodes.CONFIG_INVALID, `Invalid TOML in ${configPath}: ${describeError$1(error)}`, { cause: error });
 	}
@@ -180434,7 +180434,10 @@ function applyCompletionBudgetWithDetails(args) {
 	});
 	if (args.retry !== void 0) cap = Math.max(args.retry.minimumCompletionTokens, Math.ceil(cap * args.retry.multiplier));
 	const maxContextTokens = args.capability?.max_context_tokens;
-	if (args.usedContextTokens !== void 0 && maxContextTokens !== void 0 && maxContextTokens > 0) cap = Math.max(MIN_FLOOR, Math.min(cap, maxContextTokens - args.usedContextTokens));
+	if (args.usedContextTokens !== void 0 && maxContextTokens !== void 0 && maxContextTokens > 0) {
+		const headroom = Math.min(2048, Math.ceil(maxContextTokens * .01));
+		cap = Math.max(MIN_FLOOR, Math.min(cap, maxContextTokens - args.usedContextTokens - headroom));
+	}
 	return {
 		provider: args.provider.withMaxCompletionTokens(cap, {
 			usedContextTokens: args.usedContextTokens,
@@ -229582,7 +229585,7 @@ var FullCompaction = class {
 				this.agent.log.error("failed to refresh system prompt after compaction", { error });
 			}
 			await this.agent.injection.injectAfterCompaction();
-			this.fitRetainedInput();
+			this.fitRetainedInput({}, result.keptHeadUserMessageCount !== void 0);
 			this.lastCompactedState = {
 				tokenCount: this.tokenCountWithPending,
 				modelAlias: this.agent.activeResponderModel ?? this.agent.config.modelAlias,
@@ -229618,17 +229621,18 @@ var FullCompaction = class {
 			this.agent.turn.onCompactionFinished();
 		}
 	}
-	fitRetainedInput(context = {}) {
+	fitRetainedInput(context = {}, freshBudgetedSelection = false) {
 		const budget = this.getCompactionBudgetTokens();
 		const window = this.getEffectiveMaxContextTokens();
 		const limit = window > 0 ? window - 1 : Infinity;
+		const hardContextLimit = window > 0 && !freshBudgetedSelection ? window : void 0;
 		const estimate = (messages) => this.estimateProjectedRequestTokens({
 			...context,
 			messages
 		});
 		const preserveLatestUser = this.agent.turn.hasActiveTurn;
-		if (budget === void 0) return this.agent.context.fitCompactionPrefix(limit, estimate, preserveLatestUser);
-		return this.agent.context.fitCompactionPrefix(Math.min(Math.floor(budget * .8), limit), estimate, preserveLatestUser) || this.agent.context.fitCompactionPrefix(Math.min(Math.floor(budget * .9) - 1, limit), estimate, preserveLatestUser);
+		if (budget === void 0) return this.agent.context.fitCompactionPrefix(limit, estimate, preserveLatestUser, hardContextLimit);
+		return this.agent.context.fitCompactionPrefix(Math.min(Math.floor(budget * .8), limit), estimate, preserveLatestUser, hardContextLimit) || this.agent.context.fitCompactionPrefix(Math.min(Math.floor(budget * .9) - 1, limit), estimate, preserveLatestUser, hardContextLimit);
 	}
 	buildInstruction(customInstruction) {
 		return renderPrompt(compaction_instruction_default, { customInstruction: customInstruction?.trim() ?? "" }).trimEnd();
@@ -232498,7 +232502,7 @@ function expandUserPath(value, pathClass, homeDir) {
 }
 function defaultCwdForPath(value) {
 	if (!isAbsolute$1(value)) return void 0;
-	return parse$8(value).root;
+	return parse$9(value).root;
 }
 function pathMatchSemantics(value, pattern, pathOptions) {
 	return { pathClass: pathOptions?.pathClass ?? ([value, pattern].some((candidate) => {
@@ -233588,7 +233592,7 @@ var ContextMemory = class {
 		this.agent.microCompaction.reset();
 		this.agent.emitStatusUpdated();
 	}
-	fitCompactionPrefix(maxRequestTokens, estimateRequest, preserveLatestUser = false) {
+	fitCompactionPrefix(maxRequestTokens, estimateRequest, preserveLatestUser = false, hardContextLimit) {
 		const prefixLength = this._history.findIndex((message) => message.origin?.kind === "compaction_summary");
 		if (prefixLength <= 0 || !Number.isSafeInteger(maxRequestTokens) || maxRequestTokens <= 0) return false;
 		const suffix = this._history.slice(prefixLength);
@@ -233600,7 +233604,9 @@ var ContextMemory = class {
 			];
 			return Math.max(estimateTokensForMessages(messages), estimateRequest(project(messages, { dropOrphanResults: true })));
 		};
-		if (estimate(this._history.slice(0, prefixLength)) <= maxRequestTokens) return false;
+		const requestTokens = estimate(this._history.slice(0, prefixLength));
+		if (requestTokens <= maxRequestTokens) return false;
+		if (hardContextLimit !== void 0 && requestTokens >= hardContextLimit) return false;
 		const sourceKey = Symbol("compaction source");
 		const sources = collectCompactableUserMessages(this._history.slice(0, prefixLength)).map((message) => ({
 			...message,
@@ -234490,6 +234496,9 @@ var HookEngine = class {
 		for (const [event, hooks] of this.byEvent.entries()) result[event] = hooks.length;
 		return result;
 	}
+	hasMatchingHook(event, matcherValue) {
+		return this.matchingHooks(event, matcherValue).length > 0;
+	}
 	closeAdmission() {
 		this.admissionClosed = true;
 	}
@@ -258561,7 +258570,7 @@ var vn = (s) => {
 }, Qi = (s, t) => {
 	let e = new Map(t.map((o) => [mt(o), !0])), i = s.filter, r = 100, n = (o, h = "", a = 0) => {
 		if (a >= r) return e.set(o, !1), !1;
-		let l = h || parse(o).root || ".", c;
+		let l = h || parse$1(o).root || ".", c;
 		if (o === l) c = !1;
 		else {
 			let d = e.get(o);
@@ -264005,450 +264014,1899 @@ function safeToolResultFileStem(toolName, toolCallId) {
 	return `${toolName}-${toolCallId}`.replace(/[^a-zA-Z0-9._-]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 80) || "tool-result";
 }
 //#endregion
-//#region ../../packages/agent-core/src/agent/response-review-decision.ts
-const STAGES = [
-	"setup",
-	"native",
-	"release",
-	"verification"
-];
-const REASONS = [
-	"invalid_settings",
-	"connection_unavailable",
-	"connection_changed",
-	"native_unavailable",
-	"native_rejected",
-	"release_denied",
-	"release_rejected",
-	"verification_denied",
-	"verification_rejected",
-	"binding_mismatch",
-	"cancelled",
-	"exception"
-];
-const FINDINGS = new Set([
-	"empty-target",
-	"unicode-not-nfc",
-	"replacement-character",
-	"nul-character",
-	"script-mismatch",
-	"missing-language-character-profile",
-	"ascii-folding-pressure",
-	"short-text-native-review-required",
-	"suspected-ascii-substitution",
-	"invalid-target-type",
-	"exact-language-required",
-	"missing-response-attestations",
-	"isolated-guard-unavailable",
-	"unrecognized-finding"
-]);
-/** Never carry provider/guard prose, signed receipts or arbitrary codes into logs. */
-function rejectionFindings(report) {
-	const codes = [];
-	if (report?.["reason"] !== void 0) codes.push(report["reason"]);
-	if (Array.isArray(report?.["findings"])) for (const item of report["findings"].slice(0, 32)) codes.push(typeof item === "object" && item !== null && "code" in item ? item.code : void 0);
-	const safe = [...new Set(codes.map((code) => typeof code === "string" && FINDINGS.has(code) ? code : "unrecognized-finding"))];
-	return safe.length ? safe : void 0;
+//#region ../../packages/kaos/src/errors.ts
+/**
+* Base error class for the kaos package.
+*/
+var KaosError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "KaosError";
+	}
+};
+/**
+* Equivalent to Python's FileExistsError — indicates a file or directory already exists.
+*/
+var KaosFileExistsError = class extends KaosError {
+	constructor(message) {
+		super(message);
+		this.name = "KaosFileExistsError";
+	}
+};
+/**
+* Thrown by `detectEnvironment` on Windows when no Git Bash install can be
+* located. Carries the list of paths that were probed so callers can include
+* them in install hints.
+*/
+var KaosShellNotFoundError = class extends KaosError {
+	constructor(message) {
+		super(message);
+		this.name = "KaosShellNotFoundError";
+	}
+};
+//#endregion
+//#region ../../packages/kaos/src/environment.ts
+/**
+* Environment — cross-platform probe of OS / shell.
+*
+* Detection is a pure function of injected probes (`platform` / `arch` /
+* `release` / `env` / `isFile` / `execFileText`) so the same suite runs
+* identically on any host OS. `detectEnvironmentFromNode()` bundles the Node
+* defaults for production callers.
+*
+* On Windows the probe expects Git Bash (the canonical POSIX shell that
+* ships with Git for Windows). If it cannot be located the function
+* throws `KaosShellNotFoundError`; the SDK layer can wrap that into a
+* user-facing install hint. Set `BLUN_SHELL_PATH` to override.
+*/
+const GIT_EXEC_PATH_TIMEOUT_MS = 5e3;
+function resolveOsKind(platform) {
+	switch (platform) {
+		case "darwin": return "macOS";
+		case "linux": return "Linux";
+		case "win32": return "Windows";
+		default: return platform;
+	}
 }
-function rejectionMessage(value) {
-	if (!STAGES.includes(value.stage) || !REASONS.includes(value.reason)) return void 0;
-	const findings = rejectionFindings({ findings: value.findings?.map((code) => ({ code })) });
-	return `Response review rejected candidate: ${value.stage}/${value.reason}` + (findings?.length ? ` (${findings.join(", ")})` : "");
+async function detectEnvironment(deps) {
+	const osKind = resolveOsKind(deps.platform);
+	const osArch = deps.arch;
+	const osVersion = deps.release;
+	if (deps.platform === "win32") return {
+		osKind,
+		osArch,
+		osVersion,
+		shellName: "bash",
+		shellPath: await locateWindowsGitBash(deps)
+	};
+	const candidates = [
+		"/bin/bash",
+		"/usr/bin/bash",
+		"/usr/local/bin/bash"
+	];
+	let found;
+	for (const p of candidates) if (await deps.isFile(p)) {
+		found = p;
+		break;
+	}
+	if (found !== void 0) return {
+		osKind,
+		osArch,
+		osVersion,
+		shellName: "bash",
+		shellPath: found
+	};
+	return {
+		osKind,
+		osArch,
+		osVersion,
+		shellName: "sh",
+		shellPath: "/bin/sh"
+	};
 }
-//#endregion
-//#region ../../packages/agent-core/src/agent/response-review.ts
-const MAX_CANDIDATE_BYTES = 1048576;
-const MAX_CANDIDATE_PARTS = 4096;
-const REVIEW_TIMEOUT_MS = 3e4;
-const REVIEW_CANCEL_SETTLE_MS = 1e3;
-const MAX_REVIEW_ATTEMPTS = 2;
-function createReviewedOutputDispatcher(options) {
-	let pending = [];
-	let bytes = 0;
-	let stepUuid;
-	let epoch = 0;
-	let reviewing = false;
-	let turnId;
-	let stepNumber = 0;
-	let toolTextWithheld = false;
-	const toolCalls = /* @__PURE__ */ new Map();
-	const toolResults = /* @__PURE__ */ new Set();
-	let invalidToolExchange = false;
-	function clear() {
-		pending = [];
-		bytes = 0;
-		stepUuid = void 0;
-		epoch += 1;
-		reviewing = false;
-		toolCalls.clear();
-		toolResults.clear();
-		invalidToolExchange = false;
+async function locateWindowsGitBash(deps) {
+	const checked = [];
+	const override = deps.env["BLUN_SHELL_PATH"]?.trim();
+	if (override !== void 0 && override.length > 0) {
+		checked.push(override);
+		if (await deps.isFile(override)) return override;
 	}
-	function dispatch(event) {
-		if (event.type === "text.delta") {
-			options.onTextProgress?.();
-			return;
-		}
-		if (event.type === "step.begin") {
-			clear();
-			if (turnId !== event.turnId) toolTextWithheld = false;
-			turnId = event.turnId;
-			stepNumber = event.step;
-			stepUuid = event.uuid;
-			return options.dispatch(event);
-		}
-		if (event.type === "content.part" && event.part.type === "text") {
-			if (reviewing) {
-				clear();
-				return Promise.reject(/* @__PURE__ */ new Error("Response review candidate changed during verification"));
-			}
-			if (stepUuid !== event.stepUuid) return Promise.reject(/* @__PURE__ */ new Error("Response review step mismatch"));
-			bytes += Buffer.byteLength(event.part.text);
-			if (bytes > MAX_CANDIDATE_BYTES || pending.length >= MAX_CANDIDATE_PARTS) {
-				clear();
-				return Promise.reject(/* @__PURE__ */ new Error("Response review candidate exceeds limit"));
-			}
-			pending.push({
-				...event,
-				part: { ...event.part }
-			});
-			return Promise.resolve();
-		}
-		if (event.type === "step.end") return finish(event);
-		if (event.type === "turn.interrupted") clear();
-		if (event.type === "step.retrying") {
-			clear();
-			stepUuid = event.stepUuid;
-		}
-		if (event.type === "tool.call") {
-			const recordedEpoch = epoch;
-			const { toolCallId, uuid } = event;
-			const matchesStep = event.stepUuid === stepUuid && event.turnId === turnId && event.step === stepNumber;
-			return options.dispatch(event).then(() => {
-				if (recordedEpoch !== epoch) return;
-				if (!matchesStep || toolCalls.has(toolCallId)) invalidToolExchange = true;
-				else toolCalls.set(toolCallId, uuid);
-			});
+	const gitExecutables = await findExecutablesOnPath("git.exe", deps.env["PATH"], deps.platform, deps.isFile);
+	for (const gitExe of gitExecutables) {
+		const inferred = gitBashCandidatesFromGitExe(gitExe);
+		if (inferred !== void 0) for (const candidate of inferred) {
+			checked.push(candidate);
+			if (await deps.isFile(candidate)) return candidate;
 		}
-		if (event.type === "tool.result") {
-			const recordedEpoch = epoch;
-			const { toolCallId, parentUuid } = event;
-			return options.dispatch(event).then(() => {
-				if (recordedEpoch !== epoch) return;
-				if (toolCalls.get(toolCallId) !== parentUuid || toolResults.has(toolCallId)) invalidToolExchange = true;
-				else toolResults.add(toolCallId);
-			});
+		const gitExecPath = await readGitExecPath(deps, gitExe);
+		if (gitExecPath === void 0) continue;
+		for (const candidate of gitBashCandidatesFromGitExecPath(gitExecPath)) {
+			checked.push(candidate);
+			if (await deps.isFile(candidate)) return candidate;
 		}
-		if (event.type === "content.part") return options.dispatch(event);
-		options.dispatch(event);
 	}
-	async function finish(event) {
-		if (pending.length === 0) return options.dispatch(event);
-		if (event.uuid !== stepUuid) throw new Error("Response review step mismatch");
-		const currentEpoch = epoch;
-		const parts = [...pending];
-		reviewing = true;
-		const text = parts.map((part) => part.part.type === "text" ? part.part.text : "").join("");
-		try {
-			if (event.finishReason !== "end_turn" && event.finishReason !== "tool_use") throw new Error("Response review requires a complete candidate");
-			if (options.review === void 0) throw new Error("Response review unavailable");
-			options.signal.throwIfAborted();
-			let approval;
-			let rejection;
-			let nativeRejection = false;
-			for (let attempt = 1; attempt <= MAX_REVIEW_ATTEMPTS; attempt += 1) {
-				options.signal.throwIfAborted();
-				if (epoch !== currentEpoch) throw new Error("Response review candidate changed during verification");
-				const deadline = createDeadlineAbortSignal(options.signal, REVIEW_TIMEOUT_MS);
-				let requested;
-				let attemptRejection;
-				let attemptNativeRejection = false;
-				try {
-					requested = options.review({
-						text,
-						turnId: event.turnId,
-						step: event.step,
-						signal: deadline.signal,
-						onRejected: (decision) => {
-							if (!deadline.signal.aborted) {
-								const message = rejectionMessage(decision);
-								attemptNativeRejection = attemptRejection === void 0 && message !== void 0 && decision.stage === "native" && decision.reason === "native_rejected";
-								attemptRejection = message;
-							}
-						}
-					});
-					approval = await abortable(requested, deadline.signal);
-					rejection = attemptRejection;
-					nativeRejection = attemptNativeRejection;
-					break;
-				} catch {
-					options.signal.throwIfAborted();
-					if (attemptRejection !== void 0) throw new Error(attemptRejection);
-					if (deadline.timedOut() && attempt < MAX_REVIEW_ATTEMPTS && requested !== void 0 && epoch === currentEpoch && await waitForCancelledReview(requested)) continue;
-					throw new Error(deadline.timedOut() ? "Response review timed out" : "Response review failed");
-				} finally {
-					deadline.clear();
-				}
-			}
-			options.signal.throwIfAborted();
-			if (epoch !== currentEpoch) throw new Error("Response review candidate changed during verification");
-			if (nativeRejection && !toolTextWithheld && event.finishReason === "tool_use" && event.turnId === turnId && event.step === stepNumber && !invalidToolExchange && toolCalls.size > 0 && toolResults.size === toolCalls.size) {
-				toolTextWithheld = true;
-				await options.dispatch(event);
-				try {
-					options.onToolTextWithheld?.({
-						turnId: event.turnId,
-						step: event.step
-					});
-				} catch {}
-				return;
-			}
-			if (rejection !== void 0) throw new Error(rejection);
-			if (epoch !== currentEpoch || approval?.targetSha256 !== createHash("sha256").update(text).digest("hex") || !Number.isSafeInteger(approval.expiresAt) || approval.expiresAt <= Date.now()) throw new Error("Response review did not approve the exact current candidate");
-			for (const part of parts) {
-				options.signal.throwIfAborted();
-				if (epoch !== currentEpoch || approval.expiresAt <= Date.now()) throw new Error("Response review approval no longer current");
-				await options.dispatch(part);
-			}
-			options.signal.throwIfAborted();
-			if (epoch !== currentEpoch || approval.expiresAt <= Date.now()) throw new Error("Response review approval no longer current");
-			options.dispatch({
-				type: "text.delta",
-				delta: text
-			});
-			await options.dispatch(event);
-		} finally {
-			if (epoch === currentEpoch) clear();
+	const candidates = [
+		"C:\\Program Files\\Git\\bin\\bash.exe",
+		"C:\\Program Files\\Git\\usr\\bin\\bash.exe",
+		"C:\\Program Files (x86)\\Git\\bin\\bash.exe",
+		"C:\\Program Files (x86)\\Git\\usr\\bin\\bash.exe"
+	];
+	const localAppData = deps.env["LOCALAPPDATA"]?.trim();
+	if (localAppData !== void 0 && localAppData.length > 0) {
+		candidates.push(`${localAppData}\\Programs\\Git\\bin\\bash.exe`);
+		candidates.push(`${localAppData}\\Programs\\Git\\usr\\bin\\bash.exe`);
+	}
+	for (const candidate of candidates) {
+		checked.push(candidate);
+		if (await deps.isFile(candidate)) return candidate;
+	}
+	throw new KaosShellNotFoundError(`Git Bash was not found on this Windows host. Install Git for Windows from https://gitforwindows.org/ or set BLUN_SHELL_PATH to a bash.exe. Checked: ${checked.join(", ")}.`);
+}
+async function readGitExecPath(deps, gitExe) {
+	if (deps.platform === "win32" && !isAbsoluteWindowsPath(gitExe)) return void 0;
+	const stdout = await deps.execFileText(gitExe, ["--exec-path"], GIT_EXEC_PATH_TIMEOUT_MS);
+	if (stdout === void 0) return void 0;
+	for (const line of stdout.split(/\r?\n/)) {
+		const execPath = line.trim();
+		if (execPath.length > 0) return execPath;
+	}
+}
+function gitBashCandidatesFromGitExe(gitExe) {
+	const normalizedGitExe = path$11.win32.normalize(normalizeWindowsPath(gitExe));
+	const gitDir = path$11.win32.dirname(normalizedGitExe);
+	const gitDirName = path$11.win32.basename(gitDir).toLowerCase();
+	if (gitDirName !== "cmd" && gitDirName !== "bin") return;
+	return gitBashCandidatesFromGitRoot(path$11.win32.dirname(gitDir));
+}
+function gitBashCandidatesFromGitExecPath(execPath) {
+	const normalized = path$11.win32.normalize(normalizeWindowsPath(execPath));
+	const parts = normalized.split("\\");
+	for (let i = parts.length - 1; i >= 0; i -= 1) {
+		const segment = parts[i]?.toLowerCase();
+		if (segment === "mingw32" || segment === "mingw64") {
+			const root = parts.slice(0, i).join("\\");
+			if (root.length > 0) return gitBashCandidatesFromGitRoot(root);
 		}
 	}
-	async function waitForCancelledReview(requested) {
-		const deadline = createDeadlineAbortSignal(options.signal, REVIEW_CANCEL_SETTLE_MS);
+	return gitBashCandidatesFromGitRoot(path$11.win32.join(normalized, "..", ".."));
+}
+function gitBashCandidatesFromGitRoot(root) {
+	return [path$11.win32.normalize(path$11.win32.join(root, "bin", "bash.exe")), path$11.win32.normalize(path$11.win32.join(root, "usr", "bin", "bash.exe"))];
+}
+function normalizeWindowsPath(path) {
+	return path.replaceAll("/", "\\");
+}
+function isAbsoluteWindowsPath(path) {
+	return path$11.win32.isAbsolute(normalizeWindowsPath(path));
+}
+function dedupeWindowsPaths(paths) {
+	const deduped = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const path of paths) {
+		const key = normalizeWindowsPath(path).toLowerCase();
+		if (seen.has(key)) continue;
+		seen.add(key);
+		deduped.push(path);
+	}
+	return deduped;
+}
+/**
+* Production convenience — derive the deps bag from Node's ambient surface.
+*
+* The result is memoised: subsequent calls return the original promise.
+* `Environment` is immutable for the lifetime of the process (it derives
+* from `process.platform`, `process.arch`, `os.release()`, and one-time
+* shell-path discovery), so caching is sound. Tests that need to probe
+* with different inputs should call {@link detectEnvironment} directly
+* with an injected deps bag.
+*/
+let detectedEnvironment;
+function detectEnvironmentFromNode() {
+	if (detectedEnvironment !== void 0) return detectedEnvironment;
+	const platform = process.platform;
+	const env = process.env;
+	const isFile = async (path) => {
 		try {
-			await abortable(requested.then(() => void 0, () => void 0), deadline.signal);
-			options.signal.throwIfAborted();
+			await access(path, constants.F_OK);
 			return true;
 		} catch {
-			options.signal.throwIfAborted();
 			return false;
-		} finally {
-			deadline.clear();
 		}
+	};
+	detectedEnvironment = detectEnvironment({
+		platform,
+		arch: process.arch,
+		release: nodeOs.release(),
+		env,
+		isFile,
+		execFileText
+	});
+	return detectedEnvironment;
+}
+async function findExecutablesOnPath(name, pathEnv, platform, isFile) {
+	if (pathEnv === void 0 || pathEnv.length === 0) return [];
+	const listSep = platform === "win32" ? ";" : ":";
+	const dirSep = platform === "win32" ? "\\" : "/";
+	const paths = [];
+	for (const rawDir of pathEnv.split(listSep)) {
+		const dir = rawDir.trim();
+		if (dir.length === 0) continue;
+		if (platform === "win32" && !isAbsoluteWindowsPath(dir)) continue;
+		const candidate = dir.endsWith(dirSep) ? `${dir}${name}` : `${dir}${dirSep}${name}`;
+		if (await isFile(candidate)) paths.push(candidate);
 	}
-	return dispatch;
+	return platform === "win32" ? dedupeWindowsPaths(paths) : paths;
+}
+async function execFileText(file, args, timeoutMs) {
+	return new Promise((resolve) => {
+		execFile(file, [...args], {
+			encoding: "utf8",
+			timeout: timeoutMs,
+			windowsHide: true
+		}, (error, stdout) => {
+			if (error !== null) {
+				resolve(void 0);
+				return;
+			}
+			resolve(stdout);
+		});
+	});
 }
 //#endregion
-//#region ../../packages/agent-core/src/agent/turn/index.ts
-function blunExtractText(content) {
-	if (typeof content === "string") return content;
-	if (Array.isArray(content)) return content.map((c) => typeof c === "string" ? c : c && typeof c === "object" && "text" in c && typeof c.text === "string" ? c.text : "").join(" ");
-	return "";
+//#region ../../packages/kaos/src/internal.ts
+function isUtf8Continuation(byte) {
+	return byte >= 128 && byte <= 191;
 }
-/**
-* BLUN: decide whether a turn should carry the full tool set. Small-context models
-* (e.g. King on an 8k window) lose their identity/language when all tool schemas
-* flood the prompt. A plain greeting omits task tools but keeps any enabled
-* language review workflow. Conservative: only very short, clearly
-* conversational messages skip task tools; anything task-like keeps the full set.
-*/
-function blunTurnNeedsTools(input, origin) {
-	if (origin.kind !== "user") return true;
-	const text = blunExtractText(input).trim().toLowerCase();
-	if (text.length === 0 || text.length > 48) return true;
-	return !/^(?:hi|hallo|hey|hello|hoi|moin|servus|yo|danke|thanks|thx|bye|tschau|ciao)[.!?]*$/.test(text) && !/^(?:wer bist du|who are you|wie geht(?: es dir)?|how are you|na)[.!?]*$/.test(text);
+function decodeUtf8Ignore(data) {
+	let output = "";
+	let i = 0;
+	while (i < data.length) {
+		const b0 = data[i];
+		if (b0 === void 0) break;
+		if (b0 <= 127) {
+			output += String.fromCodePoint(b0);
+			i += 1;
+			continue;
+		}
+		if (b0 >= 194 && b0 <= 223) {
+			const b1 = data[i + 1];
+			if (b1 !== void 0 && isUtf8Continuation(b1)) {
+				output += String.fromCodePoint((b0 & 31) << 6 | b1 & 63);
+				i += 2;
+				continue;
+			}
+			i += 1;
+			continue;
+		}
+		if (b0 >= 224 && b0 <= 239) {
+			const b1 = data[i + 1];
+			const b2 = data[i + 2];
+			if (b1 !== void 0 && (b0 === 224 && b1 >= 160 && b1 <= 191 || b0 >= 225 && b0 <= 236 && isUtf8Continuation(b1) || b0 === 237 && b1 >= 128 && b1 <= 159 || b0 >= 238 && b0 <= 239 && isUtf8Continuation(b1)) && b2 !== void 0 && isUtf8Continuation(b2)) {
+				output += String.fromCodePoint((b0 & 15) << 12 | (b1 & 63) << 6 | b2 & 63);
+				i += 3;
+				continue;
+			}
+			i += 1;
+			continue;
+		}
+		if (b0 >= 240 && b0 <= 244) {
+			const b1 = data[i + 1];
+			const b2 = data[i + 2];
+			const b3 = data[i + 3];
+			if (b1 !== void 0 && (b0 === 240 && b1 >= 144 && b1 <= 191 || b0 >= 241 && b0 <= 243 && isUtf8Continuation(b1) || b0 === 244 && b1 >= 128 && b1 <= 143) && b2 !== void 0 && b3 !== void 0 && isUtf8Continuation(b2) && isUtf8Continuation(b3)) {
+				output += String.fromCodePoint((b0 & 7) << 18 | (b1 & 63) << 12 | (b2 & 63) << 6 | b3 & 63);
+				i += 4;
+				continue;
+			}
+			i += 1;
+			continue;
+		}
+		i += 1;
+	}
+	return output;
 }
-function blunThinkingIntentInput(input) {
-	const channelText = [...blunExtractText(input).matchAll(/(?:^|\r?\n)<channel\b[^>]*>\r?\n([\s\S]*?)\r?\n<\/channel>(?=\r?\n|$)/gi)].at(-1)?.[1];
-	return channelText === void 0 ? input : [{
-		type: "text",
-		text: channelText
-	}];
+function decodeUtf16LeIgnore(data) {
+	let output = "";
+	let i = 0;
+	while (i + 1 < data.length) {
+		const first = data[i];
+		const second = data[i + 1];
+		if (first === void 0 || second === void 0) break;
+		const codeUnit = first | second << 8;
+		if (codeUnit >= 55296 && codeUnit <= 56319) {
+			const lowFirst = data[i + 2];
+			const lowSecond = data[i + 3];
+			if (lowFirst !== void 0 && lowSecond !== void 0) {
+				const low = lowFirst | lowSecond << 8;
+				if (low >= 56320 && low <= 57343) {
+					const codePoint = 65536 + (codeUnit - 55296 << 10) + (low - 56320);
+					output += String.fromCodePoint(codePoint);
+					i += 4;
+					continue;
+				}
+			}
+			i += 2;
+			continue;
+		}
+		if (codeUnit >= 56320 && codeUnit <= 57343) {
+			i += 2;
+			continue;
+		}
+		output += String.fromCodePoint(codeUnit);
+		i += 2;
+	}
+	return output;
 }
-function blunTurnHasAttachment(input) {
-	return input.some((part) => part.type !== "text") || /\b(?:image_path|attachment_file_id)\s*=/i.test(blunExtractText(input));
+/**
+* Decode a Buffer into a string with Python-compatible `errors` handling.
+*
+* - `'strict'` (default): throw on invalid sequences (via TextDecoder `fatal: true`)
+* - `'replace'`: substitute each invalid sequence with U+FFFD (TextDecoder default)
+* - `'ignore'`: drop invalid input sequences while preserving valid U+FFFD characters
+*
+* Falls back to `Buffer.toString(encoding)` for encodings TextDecoder does not
+* support (e.g. `hex`, `base64`, `binary`, `latin1`) — those are lossless
+* byte-to-character mappings so `errors` has no effect.
+* @internal
+*/
+function decodeTextWithErrors(data, encoding, errors = "strict", ignoreBOM = false) {
+	let webLabel;
+	switch (encoding) {
+		case "utf-8":
+		case "utf8":
+			webLabel = "utf-8";
+			break;
+		case "utf16le":
+		case "ucs2":
+		case "ucs-2":
+			webLabel = "utf-16le";
+			break;
+		default: webLabel = void 0;
+	}
+	if (webLabel === void 0) return data.toString(encoding);
+	if (errors === "strict") return new TextDecoder(webLabel, {
+		fatal: true,
+		ignoreBOM
+	}).decode(data);
+	if (errors === "ignore") return webLabel === "utf-8" ? decodeUtf8Ignore(data) : decodeUtf16LeIgnore(data);
+	return new TextDecoder(webLabel, {
+		fatal: false,
+		ignoreBOM
+	}).decode(data);
 }
-function greetingHistory(history, anchor) {
-	const start = anchor === void 0 ? -1 : history.indexOf(anchor);
-	if (start < 0) return history;
-	const recent = [];
-	let chars = 0;
-	for (let i = start - 1; i >= 0 && recent.length < 6; i -= 1) {
-		const message = history[i];
-		if (message.role === "tool" || message.toolCalls.length > 0) break;
-		if (message.role !== "assistant" && message.origin?.kind !== "user") continue;
-		const size = blunExtractText(message.content).length;
-		if (chars + size > 12e3 || message.content.some((part) => part.type !== "text")) break;
-		recent.unshift(message);
-		chars += size;
+/**
+* Convert a glob pattern segment (e.g. "*.txt", "file?.log") into a RegExp.
+* Mirrors Python pathlib behavior: includes dotfiles, case-sensitive by default.
+* @internal
+*/
+function globPatternToRegex(pattern, caseSensitive) {
+	let regex = "^";
+	for (let i = 0; i < pattern.length; i++) {
+		const ch = pattern[i];
+		if (ch === void 0) break;
+		switch (ch) {
+			case "*":
+				regex += "[^/]*";
+				break;
+			case "?":
+				regex += "[^/]";
+				break;
+			case "[": {
+				const end = pattern.indexOf("]", i + 1);
+				if (end === -1) regex += "\\[";
+				else {
+					let charClass = pattern.slice(i + 1, end);
+					charClass = charClass.replace(/\\/g, "\\\\");
+					if (charClass.startsWith("!")) charClass = "^" + charClass.slice(1);
+					else if (charClass.startsWith("^")) charClass = "\\" + charClass;
+					regex += "[" + charClass + "]";
+					i = end;
+				}
+				break;
+			}
+			case "\\":
+				if (i + 1 < pattern.length) {
+					const next = pattern.charAt(i + 1);
+					regex += next.replaceAll(/[{}()+.\\[\]^$|]/g, "\\$&");
+					i++;
+				} else regex += "\\\\";
+				break;
+			default: regex += ch.replaceAll(/[{}()+.\\[\]^$|]/g, "\\$&");
+		}
 	}
-	while (recent.length > 0 && recent[0].role !== "user") recent.shift();
-	return [...recent, ...history.slice(start)];
+	regex += "$";
+	return new RegExp(regex, caseSensitive ? "" : "i");
 }
 /**
-* BLUN: builtin tools kept when the full schema set would overflow a small
-* context window. The essential read / edit / run / track loop — enough for
-* King to do real work on a 32k window without the full ~15k-token tool floor
-* that pushes a single task turn to ~82% context and into a compaction
-* death-loop (compaction can only shrink conversation, never the fixed tool
-* floor, so it re-triggers every turn).
+* A Readable wrapper that preserves source backpressure while still allowing
+* consumers to read buffered output after the source has ended.
+* @internal
 */
-const BLUN_LEAN_TOOL_NAMES = new Set([
-	"Read",
-	"ReadBatch",
-	"Write",
-	"Edit",
-	"Grep",
-	"Glob",
-	"Bash",
-	"TodoList",
-	"Skill",
-	"CompactConversation",
-	"MistakeRecord"
-]);
-const BLUN_LANGUAGE_REVIEW_TOOL_NAMES = new Set([
-	"release_response",
-	"release_translation",
-	"verify_release_token",
-	"validate_text"
-].map((name) => qualifyMcpToolName("blun-language-guard", name)));
+var BufferedReadable = class extends Readable {
+	_source;
+	_ended = false;
+	constructor(source) {
+		super({ highWaterMark: 128 * 1024 });
+		this._source = source;
+		this._source.on("data", this._onData);
+		this._source.on("end", this._onEnd);
+		this._source.on("close", this._onClose);
+		this._source.on("error", this._onError);
+	}
+	_read() {
+		if (!this._ended && !this.destroyed) this._source.resume();
+	}
+	_destroy(error, callback) {
+		this._source.off("data", this._onData);
+		this._source.off("end", this._onEnd);
+		this._source.off("close", this._onClose);
+		this._source.off("error", this._onError);
+		this._source.destroy();
+		callback(error);
+	}
+	_onData = (chunk) => {
+		if (!this.push(chunk)) this._source.pause();
+	};
+	_onEnd = () => {
+		this._ended = true;
+		this.push(null);
+	};
+	_onClose = () => {
+		if (!this._ended) {
+			this._ended = true;
+			this.push(null);
+		}
+	};
+	_onError = (error) => {
+		this.destroy(error);
+	};
+};
+//#endregion
+//#region ../../packages/kaos/src/login-shell-path.ts
 /**
-* Channel/session MCP tools that must survive the lean cut — e.g. the Telegram
-* reply tools. Without these a bridged session can RECEIVE a message but has no
-* way to answer it (King processes the turn, then has no reply tool). Their
-* schemas are tiny, so keeping them does not reappear the compaction floor.
-* Matches both bare names and MCP-prefixed variants (…__reply).
+* Login-shell PATH probe — enrich `process.env.PATH` with entries from the
+* user's login shell.
+*
+* When blun is launched from a context that skipped the user's shell
+* profile (GUI launchers, non-login parent shells), `process.env.PATH`
+* misses entries like `/opt/homebrew/bin`, so commands spawned by the Bash
+* tool can't find tools the user has in their interactive shell (e.g.
+* `gh`). We run the user's login shell once (`$SHELL -l -c /usr/bin/env`),
+* extract its PATH, and append the entries the current PATH lacks. Existing
+* entries keep their order and priority; failures (no resolvable shell,
+* hung or broken profile) silently leave PATH untouched.
 *
+* launchd/daemon launches can leave `$SHELL` unset or blank (see
+* `defaultShell()` in agent-core's terminalService for the same case), so
+* the probe falls back to the OS account's login shell from the user
+* database before giving up.
+*
+* Like `detectEnvironment`, the probe is a pure function of injected deps
+* so the suite runs identically on any host. Windows is skipped: the
+* problem is specific to POSIX login-shell profiles.
 */
-const BLUN_LEAN_KEEP_RE = /(^|__|:)(reply|react|edit_message|download_attachment|memory_(?:status|settings_update|remember|list|threads_list|recall))$/i;
-/** Telegram writes require a real inbound user turn, never an internal nudge. */
-const BLUN_TELEGRAM_OUTBOUND_TOOL_RE = /^mcp__[^\s]*telegram[^\s]*__(?:reply|react|edit_message)$/i;
-function blunToolsForOrigin(tools, origin) {
-	if (origin.kind !== "system_trigger" && origin.kind !== "injection") return tools;
-	return tools.filter((tool) => !BLUN_TELEGRAM_OUTBOUND_TOOL_RE.test(tool.name));
+const LOGIN_SHELL_ENV_TIMEOUT_MS = 5e3;
+/**
+* Run the user's login shell and return its PATH, or `undefined` when the
+* probe does not apply (Windows, no resolvable shell) or fails (spawn
+* error, timeout, no PATH in the output).
+*/
+async function probeLoginShellPath(deps) {
+	if (deps.platform === "win32") return void 0;
+	const envShell = deps.env["SHELL"]?.trim();
+	const shell = envShell === void 0 || envShell.length === 0 ? deps.userShell() : envShell;
+	if (shell === void 0 || shell.length === 0) return void 0;
+	const stdout = await deps.execFileText(shell, [
+		"-l",
+		"-c",
+		"/usr/bin/env"
+	], LOGIN_SHELL_ENV_TIMEOUT_MS);
+	if (stdout === void 0) return void 0;
+	let path;
+	for (const line of stdout.split("\n")) if (line.startsWith("PATH=")) path = line.slice(5).trim();
+	if (path === void 0 || path.length === 0) return void 0;
+	return path;
 }
 /**
-* Restore bounded schema disclosure even on large-context models. Only tools
-* already eligible for this turn enter the loader; execution still follows
-* the ordinary permission pipeline.
+* Union of the current PATH and the login-shell PATH: the current PATH
+* string is kept verbatim — including empty components, which POSIX
+* command lookup treats as the current directory — and login-shell
+* entries the current PATH lacks are appended in their own order. When
+* nothing is missing the current string is returned unchanged. Only
+* absolute login-shell entries are imported: empty, `.`, and relative
+* components are all cwd-dependent lookup, and appending one the user
+* did not already have would widen their search path — LocalKaos runs
+* commands from arbitrary workspace directories.
 */
-function blunSelectTurnTools(tools, maxContextTokens, loadedToolNames = /* @__PURE__ */ new Set(), requiredToolNames = /* @__PURE__ */ new Set(), selected = []) {
-	if (estimateTokensForTools(tools) <= (0, import_turn_tool_performance_policy.toolSchemaBudgetTokens)(maxContextTokens) || tools.some((tool) => tool.name === "ToolSearch")) {
-		selected.splice(0, selected.length, ...tools);
-		return selected;
+function mergeLoginShellPath(currentPath, loginShellPath) {
+	const current = currentPath ?? "";
+	const seen = new Set(current.split(":").filter((entry) => entry.length > 0));
+	const additions = [];
+	for (const entry of loginShellPath.split(":")) {
+		if (!entry.startsWith("/") || seen.has(entry)) continue;
+		seen.add(entry);
+		additions.push(entry);
 	}
-	selected.splice(0, selected.length, ...tools.filter((tool) => BLUN_LEAN_TOOL_NAMES.has(tool.name) || BLUN_LEAN_KEEP_RE.test(tool.name) || BLUN_LANGUAGE_REVIEW_TOOL_NAMES.has(tool.name) || loadedToolNames.has(tool.name) || requiredToolNames.has(tool.name)));
-	const names = new Set(selected.map((tool) => tool.name));
-	const deferred = tools.filter((tool) => !names.has(tool.name));
-	if (deferred.length > 0) selected.push((0, import_turn_tool_performance_policy.createDeferredToolLoader)(selected, deferred, loadedToolNames));
-	return selected;
+	if (additions.length === 0) return current;
+	if (currentPath === void 0) return additions.join(":");
+	return `${current}:${additions.join(":")}`;
 }
-const LLM_NOT_SET_MESSAGE = "LLM not set, send \"/login\" to login";
-/** Origin tag for the synthetic "continue" prompt that drives each goal turn. */
-const GOAL_CONTINUATION_ORIGIN = {
-	kind: "system_trigger",
-	name: "goal_continuation"
-};
-function goalContinuationOrigin(origin) {
-	const cronRunId = origin.kind === "cron_job" ? origin.runId : origin.kind === "system_trigger" && origin.name === "goal_continuation" ? origin.cronRunId : void 0;
-	return cronRunId === void 0 ? GOAL_CONTINUATION_ORIGIN : {
-		kind: "system_trigger",
-		name: "goal_continuation",
-		cronRunId
-	};
+/** Probe the login shell and merge its PATH into `deps.env['PATH']`. */
+async function applyLoginShellPath(deps) {
+	const loginShellPath = await probeLoginShellPath(deps);
+	if (loginShellPath === void 0) return;
+	const currentPath = deps.env["PATH"];
+	const merged = mergeLoginShellPath(currentPath, loginShellPath);
+	if (merged === (currentPath ?? "")) return;
+	deps.env["PATH"] = merged;
 }
-const GOAL_COMPLETION_REMINDER_NAME = "goal_completion";
-const GOAL_BLOCKED_REMINDER_NAME = "goal_blocked";
-const GOAL_RATE_LIMIT_PAUSE_REASON = "Paused after provider rate limit";
-const GOAL_PROVIDER_CONNECTION_PAUSE_PREFIX = "Paused after provider connection error";
-const GOAL_PROVIDER_AUTH_PAUSE_PREFIX = "Paused after provider authentication error";
-const GOAL_PROVIDER_API_PAUSE_PREFIX = "Paused after provider API error";
-const GOAL_MODEL_CONFIG_PAUSE_PREFIX = "Paused after model configuration error";
-const GOAL_RUNTIME_PAUSE_PREFIX = "Paused after runtime error";
-const GOAL_PROVIDER_FILTERED_PAUSE_REASON = "Paused after provider safety policy block";
 /**
-* The prompt the goal driver appends to start each continuation turn — the
-* autonomous stand-in for the user typing "continue". The model decides when to
-* stop by calling `UpdateGoal`; otherwise the driver runs another turn.
+* Production convenience — apply the probe to `process.env` once per
+* process. Memoised like `detectEnvironmentFromNode`: the login-shell PATH
+* does not change for the lifetime of the process, and repeated
+* `LocalKaos.create()` calls must not re-spawn the shell.
 */
-const GOAL_CONTINUATION_PROMPT = [
-	"Continue working toward the active goal.",
-	"Keep the self-audit brief. Do not explore unrelated interpretations once the goal can be",
-	"decided. If the objective is simple, already answered, impossible, unsafe, or contradictory,",
-	"do not run another goal turn. Explain briefly if useful, then call UpdateGoal with `complete`",
-	"or `blocked` in the same turn. Otherwise, weigh the objective and any completion criteria",
-	"against the work done so far. Goal mode is iterative: do one coherent slice of work, then",
-	"reassess.",
-	"",
-	"CRITICAL — WHEN TO END THE GOAL:",
-	"When all required work is done — files written, code executed, tests passing, validation",
-	"passed — you MUST call UpdateGoal with `complete` IMMEDIATELY. Do not narrerate the next step",
-	"and stop without calling it. Do not leave the goal active when the work is finished.",
-	"If you have completed the task and are about to end your response, call UpdateGoal with",
-	"`complete` FIRST, then give your summary. Never end a turn with the goal still active if",
-	"the work is actually done.",
-	"",
-	"Do not mark complete after only producing a plan, summary, first pass, or partial result.",
-	"Do not mark complete after announcing the next step without executing it.",
-	"If an external condition or required user input prevents progress, or the objective cannot",
-	"be completed as stated, call UpdateGoal with `blocked`. On error or failure, call",
-	"UpdateGoal with `blocked`, NOT `complete`.",
-	"Otherwise keep going — use the existing conversation context and your tools,",
-	"and do not ask the user for input unless a real blocker prevents progress."
-].join(" ");
-var TurnFlow = class {
-	agent;
-	admissionClosed = false;
-	loadedToolNames = /* @__PURE__ */ new Set();
-	refreshSelectedTools;
-	executions = new ExecutionLedger();
-	executingControllers = /* @__PURE__ */ new Set();
-	steerBuffer = [];
-	nextSteerSequence = 0;
-	turnId = -1;
-	activeTurn = null;
-	toolCallStartedAt = /* @__PURE__ */ new Map();
-	toolCallDupType = /* @__PURE__ */ new Map();
-	stepToolCallKeys = /* @__PURE__ */ new Map();
-	telemetryModeByTurn = /* @__PURE__ */ new Map();
-	currentStepByTurn = /* @__PURE__ */ new Map();
-	interruptedTelemetryTurnIds = /* @__PURE__ */ new Set();
-	stepFailureByTurn = /* @__PURE__ */ new Map();
-	providerRequestFailureByTurn = /* @__PURE__ */ new Map();
-	currentStep = 0;
-	constructor(agent) {
-		this.agent = agent;
+/**
+* Login shell from the OS user database (`/etc/passwd` via getpwuid on
+* Linux, Directory Services on macOS). `userInfo()` throws when the uid
+* has no database entry (e.g. containers running an arbitrary uid), and
+* service accounts may carry `/usr/sbin/nologin` — the latter needs no
+* special casing here because probing it simply fails and degrades
+* silently.
+*/
+function userShellFromNode() {
+	try {
+		const shell = userInfo().shell;
+		return shell === null || shell.length === 0 ? void 0 : shell;
+	} catch {
+		return;
 	}
-	/** Explicit host shutdown only; ordinary cancellation remains resumable. */
-	closeAdmission() {
-		this.admissionClosed = true;
+}
+let appliedLoginShellPath;
+function applyLoginShellPathFromNode() {
+	if (appliedLoginShellPath !== void 0) return appliedLoginShellPath;
+	appliedLoginShellPath = applyLoginShellPath({
+		platform: process.platform,
+		env: process.env,
+		userShell: userShellFromNode,
+		execFileText
+	});
+	return appliedLoginShellPath;
+}
+//#endregion
+//#region ../../packages/kaos/src/local.ts
+const isWindows$1 = process.platform === "win32";
+const READ_CHUNK_SIZE = 64 * 1024;
+/**
+* Build the `(dev, ino)` cycle-detection key used by `_globWalk`'s
+* visited set. Returns `null` when `ino` is 0, which Node returns on
+* filesystems that don't carry inodes (Windows FAT/exFAT, some SMB/NFS
+* mounts). A null key signals "no reliable identity for this dir" so
+* the caller skips visited tracking for that descent — cycle safety
+* is weakened on those filesystems, but normal walking works instead
+* of every directory colliding on the shared key `"<dev>:0"`.
+*/
+function cycleKey(s) {
+	if (s.ino === 0) return null;
+	return `${String(s.dev)}:${String(s.ino)}`;
+}
+function buildLocalSpawnOptions(_isWindows, cwd, env) {
+	return {
+		cwd,
+		env,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		detached: true,
+		windowsHide: true
+	};
+}
+var LocalProcess = class {
+	stdin;
+	stdout;
+	stderr;
+	pid;
+	_child;
+	_exitCode = null;
+	_exitPromise;
+	_disposed = false;
+	constructor(child) {
+		if (child.stdin === null || child.stdout === null || child.stderr === null) throw new Error("Process must be created with stdin/stdout/stderr pipes.");
+		this._child = child;
+		this.stdin = child.stdin;
+		this.stdout = new BufferedReadable(child.stdout);
+		this.stderr = new BufferedReadable(child.stderr);
+		this.pid = child.pid ?? -1;
+		this._exitPromise = new Promise((resolve, reject) => {
+			child.on("exit", (code) => {
+				this._exitCode = code ?? -1;
+				resolve(this._exitCode);
+			});
+			child.on("error", (error) => {
+				reject(error);
+			});
+		});
 	}
-	async quiesce(options) {
-		const deadline = new QuiescenceDeadline(options.deadlineAt);
-		this.closeAdmission();
-		const reason = /* @__PURE__ */ new Error("Turn admission is closed for quiescence");
-		if (this.hasActiveTurn) this.cancel(void 0, reason);
-		for (const controller of this.executingControllers) controller.abort(reason);
-		await deadline.wait(this.executions.drain());
-		const checkedAt = Date.now();
-		const remaining = this.executions.pending;
-		return {
-			admissionClosed: true,
-			checkedAt,
-			remaining,
-			status: deadline.expired || remaining.length > 0 ? "incomplete" : "quiescent",
-			reason: deadline.expired ? "deadline" : void 0
-		};
+	get exitCode() {
+		return this._exitCode;
 	}
-	/** Actual execution, unlike waitForCurrentTurn(signal), is not abortable. */
-	waitForExecutionEnd() {
-		return this.executions.drain();
+	async wait() {
+		return this._exitPromise;
 	}
-	get pendingExecutions() {
-		return this.executions.pending;
+	kill(signal) {
+		if (this.pid <= 0) return Promise.resolve();
+		if (isWindows$1) {
+			const taskkillArgs = [
+				"/T",
+				"/F",
+				"/PID",
+				String(this.pid)
+			];
+			return new Promise((resolve) => {
+				const killer = spawn("taskkill", taskkillArgs, {
+					stdio: "ignore",
+					windowsHide: true
+				});
+				const done = () => {
+					resolve();
+				};
+				killer.once("error", done);
+				killer.once("close", done);
+			});
+		}
+		try {
+			process.kill(-this.pid, signal ?? "SIGTERM");
+		} catch (error) {
+			const err = error;
+			if (err.code === "ESRCH") return Promise.resolve();
+			if (err.code === "EPERM") {
+				try {
+					this._child.kill(signal ?? "SIGTERM");
+				} catch {}
+				return Promise.resolve();
+			}
+			throw error;
+		}
+		return Promise.resolve();
 	}
-	assertAdmissionOpen() {
-		if (this.admissionClosed) throw new Error("Turn admission is closed for quiescence");
+	dispose() {
+		if (this._disposed) return;
+		this._disposed = true;
+		this.stdin.destroy();
+		this.stdout.destroy();
+		this.stderr.destroy();
 	}
-	/** Best-effort agent id (main / generated id) derived from the agent homedir. */
+};
+/**
+* A KAOS implementation that directly interacts with the local filesystem.
+*
+* Note: LocalKaos maintains its own per-instance working directory (`_cwd`)
+* rather than mutating `process.cwd()`. This lets multiple LocalKaos instances
+* coexist with independent cwds (e.g. when switching contexts via
+* `runWithKaos`) without cross-polluting each other's relative-path resolution.
+*/
+var LocalKaos = class LocalKaos {
+	name = "local";
+	osEnv;
+	_cwd;
+	_envLayers;
+	constructor(osEnv, cwd, envLayers = []) {
+		this._cwd = normalize$3(cwd ?? process.cwd());
+		this.osEnv = osEnv;
+		this._envLayers = envLayers;
+	}
+	/**
+	* Construct a fresh `LocalKaos` after probing the host environment.
+	*
+	* Each call returns a new instance with its own `_cwd`; concurrent
+	* callers can therefore operate on independent working directories
+	* without polluting one another.
+	*/
+	static async create() {
+		const [osEnv] = await Promise.all([detectEnvironmentFromNode(), applyLoginShellPathFromNode()]);
+		return new LocalKaos(osEnv);
+	}
+	withCwd(cwd) {
+		return new LocalKaos(this.osEnv, cwd, this._envLayers);
+	}
+	withEnv(env) {
+		return new LocalKaos(this.osEnv, this._cwd, [...this._envLayers, env]);
+	}
+	_resolvePath(path) {
+		if (isAbsolute$1(path)) return normalize$3(path);
+		return join$1(this._cwd, path);
+	}
+	pathClass() {
+		return isWindows$1 ? "win32" : "posix";
+	}
+	normpath(path) {
+		return normalize$3(path);
+	}
+	gethome() {
+		return normalize$3(homedir());
+	}
+	getcwd() {
+		return this._cwd;
+	}
+	/**
+	* Change the working directory of this LocalKaos instance.
+	*
+	* Unlike Python's `os.chdir`, this is instance-scoped and never touches
+	* `process.cwd()`. Child processes spawned via {@link exec} inherit this
+	* instance's `_cwd`; concurrent LocalKaos instances each carry their own
+	* independent cwd. If you need Python-compatible process-global cwd,
+	* call `process.chdir(x)` directly.
+	*/
+	async chdir(path) {
+		const resolved = this._resolvePath(path);
+		if (!(await stat(resolved)).isDirectory()) throw new Error(`Not a directory: ${resolved}`);
+		this._cwd = resolved;
+	}
+	async stat(path, options) {
+		const resolved = this._resolvePath(path);
+		const s = options?.followSymlinks ?? true ? await stat(resolved) : await lstat(resolved);
+		return {
+			stMode: s.mode,
+			stIno: s.ino,
+			stDev: s.dev,
+			stNlink: s.nlink,
+			stUid: s.uid,
+			stGid: s.gid,
+			stSize: s.size,
+			stAtime: s.atimeMs / 1e3,
+			stMtime: s.mtimeMs / 1e3,
+			stCtime: isWindows$1 ? s.birthtimeMs / 1e3 : s.ctimeMs / 1e3
+		};
+	}
+	async *iterdir(path) {
+		const resolved = this._resolvePath(path);
+		const entries = await readdir(resolved);
+		for (const entry of entries) yield join$1(resolved, entry);
+	}
+	async *glob(path, pattern, options) {
+		const resolved = this._resolvePath(path);
+		const caseSensitive = options?.caseSensitive ?? true;
+		const patternParts = pattern.split("/");
+		const initVisited = /* @__PURE__ */ new Set();
+		try {
+			const rootKey = cycleKey(await stat(resolved));
+			if (rootKey !== null) initVisited.add(rootKey);
+		} catch {}
+		yield* this._globWalk(resolved, patternParts, caseSensitive, initVisited);
+	}
+	async *_globWalk(basePath, patternParts, caseSensitive, visited) {
+		if (patternParts.length === 0) return;
+		const [currentPattern, ...remainingParts] = patternParts;
+		if (currentPattern === "**") {
+			if (remainingParts.length > 0) yield* this._globWalk(basePath, remainingParts, caseSensitive, visited);
+			else yield basePath;
+			let entries;
+			try {
+				entries = await readdir(basePath);
+			} catch {
+				return;
+			}
+			for (const entry of entries) {
+				const fullPath = join$1(basePath, entry);
+				let entryStat;
+				try {
+					entryStat = await stat(fullPath);
+				} catch {
+					continue;
+				}
+				if (entryStat.isDirectory()) {
+					const key = cycleKey(entryStat);
+					if (key !== null && visited.has(key)) continue;
+					yield* this._globWalk(fullPath, patternParts, caseSensitive, key !== null ? new Set([...visited, key]) : visited);
+				} else if (remainingParts.length === 0) yield fullPath;
+			}
+		} else {
+			const regex = globPatternToRegex(currentPattern ?? "", caseSensitive);
+			let entries;
+			try {
+				entries = await readdir(basePath);
+			} catch {
+				return;
+			}
+			for (const entry of entries) {
+				if (!regex.test(entry)) continue;
+				const fullPath = join$1(basePath, entry);
+				if (remainingParts.length === 0) yield fullPath;
+				else {
+					let entryStat;
+					try {
+						entryStat = await stat(fullPath);
+					} catch {
+						continue;
+					}
+					if (entryStat.isDirectory()) {
+						const key = cycleKey(entryStat);
+						if (key !== null && visited.has(key)) continue;
+						yield* this._globWalk(fullPath, remainingParts, caseSensitive, key !== null ? new Set([...visited, key]) : visited);
+					}
+				}
+			}
+		}
+	}
+	async readBytes(path, n) {
+		const resolved = this._resolvePath(path);
+		if (n === void 0) return Buffer.from(await readFile(resolved));
+		const fh = await open(resolved, "r");
+		try {
+			const buf = Buffer.alloc(n);
+			const { bytesRead } = await fh.read(buf, 0, n, 0);
+			return buf.subarray(0, bytesRead);
+		} finally {
+			await fh.close();
+		}
+	}
+	async readText(path, options) {
+		const resolved = this._resolvePath(path);
+		const encoding = options?.encoding ?? "utf-8";
+		const errors = options?.errors ?? "strict";
+		return decodeTextWithErrors(await readFile(resolved), encoding, errors);
+	}
+	async *readLines(path, options) {
+		const resolved = this._resolvePath(path);
+		const encoding = options?.encoding ?? "utf-8";
+		const errors = options?.errors ?? "strict";
+		if (!isUtf8Encoding(encoding)) {
+			yield* splitLinesKeepingTerminator(decodeTextWithErrors(await readFile(resolved), encoding, errors));
+			return;
+		}
+		yield* this._readUtf8Lines(resolved, errors);
+	}
+	async scanTextFile(path) {
+		const fh = await open(this._resolvePath(path), "r");
+		try {
+			const buf = Buffer.alloc(READ_CHUNK_SIZE);
+			const flags = {
+				hasCrLf: false,
+				hasLf: false,
+				hasLoneCr: false
+			};
+			const validator = createUtf8Validator();
+			let totalLines = 0;
+			let totalBytes = 0;
+			let endsWithNewline = false;
+			let hasNul = false;
+			let prevWasCr = false;
+			while (true) {
+				const { bytesRead } = await fh.read(buf, 0, buf.length, null);
+				if (bytesRead === 0) break;
+				const chunk = buf.subarray(0, bytesRead);
+				validator.write(chunk);
+				for (let i = 0; i < chunk.length; i += 1) {
+					const byte = chunk[i];
+					if (byte === void 0) continue;
+					if (byte === 0) hasNul = true;
+					if (byte === 10) totalLines += 1;
+				}
+				prevWasCr = updateLineEndingFlagsFromBytes(flags, chunk, prevWasCr);
+				totalBytes += bytesRead;
+				endsWithNewline = chunk[bytesRead - 1] === 10;
+			}
+			if (prevWasCr) flags.hasLoneCr = true;
+			validator.end();
+			if (totalBytes > 0 && !endsWithNewline) totalLines += 1;
+			return {
+				totalLines,
+				endsWithNewline,
+				hasNul,
+				lineEndingFlags: flags
+			};
+		} finally {
+			await fh.close();
+		}
+	}
+	async *readLineRange(path, options) {
+		const resolved = this._resolvePath(path);
+		const errors = options.errors ?? "strict";
+		yield* this._readUtf8Lines(resolved, errors, {
+			startLine: options.startLine,
+			maxLines: options.maxLines
+		});
+	}
+	async *readTailLines(path, options) {
+		if (options.tailCount <= 0) return;
+		const resolved = this._resolvePath(path);
+		const errors = options.errors ?? "strict";
+		const fh = await open(resolved, "r");
+		try {
+			const s = await fh.stat();
+			if (s.size === 0) return;
+			let pos = s.size;
+			let foundLf = 0;
+			let startOffset = 0;
+			let needLf = options.tailCount;
+			let sawTailBlock = false;
+			while (pos > 0 && foundLf < needLf) {
+				const readSize = Math.min(READ_CHUNK_SIZE, pos);
+				pos -= readSize;
+				const buf = Buffer.alloc(readSize);
+				await fh.read(buf, 0, readSize, pos);
+				if (!sawTailBlock) {
+					sawTailBlock = true;
+					needLf = buf[readSize - 1] === 10 ? options.tailCount + 1 : options.tailCount;
+				}
+				for (let i = readSize - 1; i >= 0; i -= 1) {
+					if (buf[i] !== 10) continue;
+					foundLf += 1;
+					if (foundLf === needLf) {
+						startOffset = pos + i + 1;
+						break;
+					}
+				}
+			}
+			if (foundLf < needLf) startOffset = 0;
+			yield* splitLinesKeepingTerminator(decodeTextWithErrors(await readRange(fh, startOffset, s.size - startOffset), "utf-8", errors, startOffset !== 0));
+		} finally {
+			await fh.close();
+		}
+	}
+	async *_readUtf8Lines(resolved, errors, range) {
+		const startLine = range?.startLine ?? 1;
+		const maxLines = range?.maxLines ?? Number.POSITIVE_INFINITY;
+		const fh = await open(resolved, "r");
+		try {
+			const buf = Buffer.alloc(READ_CHUNK_SIZE);
+			let pending = [];
+			let pendingOffset = 0;
+			let fileOffset = 0;
+			let lineNo = 1;
+			let yielded = 0;
+			while (true) {
+				const { bytesRead } = await fh.read(buf, 0, buf.length, null);
+				if (bytesRead === 0) break;
+				const chunk = buf.subarray(0, bytesRead);
+				let lineStart = 0;
+				for (let i = 0; i < chunk.length; i += 1) {
+					if (chunk[i] !== 10) continue;
+					const piece = chunk.subarray(lineStart, i + 1);
+					const lineOffset = pending.length === 0 ? fileOffset + lineStart : pendingOffset;
+					const line = pending.length === 0 ? piece : Buffer.concat([...pending, piece]);
+					if (lineNo >= startLine) {
+						yield decodeTextWithErrors(line, "utf-8", errors, lineOffset !== 0);
+						yielded += 1;
+						if (yielded >= maxLines) return;
+					}
+					pending = [];
+					lineStart = i + 1;
+					lineNo += 1;
+				}
+				if (lineStart < chunk.length) {
+					const tail = Buffer.from(chunk.subarray(lineStart));
+					if (pending.length === 0) pendingOffset = fileOffset + lineStart;
+					pending.push(tail);
+				}
+				fileOffset += bytesRead;
+			}
+			if (pending.length > 0) {
+				const line = Buffer.concat(pending);
+				if (lineNo >= startLine) yield decodeTextWithErrors(line, "utf-8", errors, pendingOffset !== 0);
+			}
+		} finally {
+			await fh.close();
+		}
+	}
+	async writeBytes(path, data) {
+		await writeFile(this._resolvePath(path), data);
+		return data.length;
+	}
+	async writeText(path, data, options) {
+		const resolved = this._resolvePath(path);
+		const encoding = options?.encoding ?? "utf-8";
+		if ((options?.mode ?? "w") === "a") await appendFile(resolved, data, encoding);
+		else await writeFile(resolved, data, encoding);
+		return data.length;
+	}
+	async mkdir(path, options) {
+		const resolved = this._resolvePath(path);
+		const parents = options?.parents ?? false;
+		const existOk = options?.existOk ?? false;
+		if (parents) {
+			if (!existOk) try {
+				if ((await stat(resolved)).isDirectory()) throw new KaosFileExistsError(`${resolved} already exists`);
+			} catch (error) {
+				if (error instanceof KaosFileExistsError) throw error;
+				if (error.code !== "ENOENT") throw error;
+			}
+			await mkdir(resolved, { recursive: true });
+			return;
+		}
+		try {
+			await mkdir(resolved);
+		} catch (error) {
+			if (existOk && error instanceof Error && "code" in error && error.code === "EEXIST") {
+				if (!(await stat(resolved)).isDirectory()) throw new KaosFileExistsError(`${resolved} already exists but is not a directory`);
+				return;
+			}
+			throw error;
+		}
+	}
+	async exec(...args) {
+		const command = args[0];
+		if (command === void 0) throw new Error("LocalKaos.exec(): at least one argument (the command to run) is required.");
+		const child = spawn(command, args.slice(1), buildLocalSpawnOptions(isWindows$1, this._cwd, this._buildExecEnv()));
+		await waitForSpawn(child);
+		return new LocalProcess(child);
+	}
+	async execWithEnv(args, env) {
+		const command = args[0];
+		if (command === void 0) throw new Error("LocalKaos.execWithEnv(): at least one argument (the command to run) is required.");
+		const child = spawn(command, args.slice(1), buildLocalSpawnOptions(isWindows$1, this._cwd, this._buildExecEnv(env)));
+		await waitForSpawn(child);
+		return new LocalProcess(child);
+	}
+	_buildExecEnv(invocationEnv) {
+		if (this._envLayers.length === 0) return invocationEnv;
+		const merged = {
+			...process.env,
+			...invocationEnv
+		};
+		for (const layer of this._envLayers) Object.assign(merged, layer);
+		return merged;
+	}
+};
+function isUtf8Encoding(encoding) {
+	return encoding === "utf-8" || encoding === "utf8";
+}
+function* splitLinesKeepingTerminator(text) {
+	if (text.length === 0) return;
+	let start = 0;
+	for (let i = 0; i < text.length; i += 1) if (text.codePointAt(i) === 10) {
+		yield text.slice(start, i + 1);
+		start = i + 1;
+	}
+	if (start < text.length) yield text.slice(start);
+}
+function updateLineEndingFlagsFromBytes(flags, chunk, prevWasCr) {
+	for (let i = 0; i < chunk.length; i += 1) {
+		const byte = chunk[i];
+		if (byte === void 0) continue;
+		if (byte === 13) {
+			if (prevWasCr) flags.hasLoneCr = true;
+			prevWasCr = true;
+		} else if (byte === 10) {
+			if (prevWasCr) flags.hasCrLf = true;
+			else flags.hasLf = true;
+			prevWasCr = false;
+		} else {
+			if (prevWasCr) flags.hasLoneCr = true;
+			prevWasCr = false;
+		}
+	}
+	return prevWasCr;
+}
+function createUtf8Validator() {
+	let needed = 0;
+	let lower = 128;
+	let upper = 191;
+	const fail = () => {
+		throw new TypeError("Invalid UTF-8 data");
+	};
+	return {
+		write(chunk) {
+			for (let i = 0; i < chunk.length; i += 1) {
+				const byte = chunk[i];
+				if (byte === void 0) continue;
+				if (needed === 0) {
+					if (byte <= 127) continue;
+					if (byte >= 194 && byte <= 223) needed = 1;
+					else if (byte === 224) {
+						needed = 2;
+						lower = 160;
+					} else if (byte >= 225 && byte <= 236) needed = 2;
+					else if (byte === 237) {
+						needed = 2;
+						upper = 159;
+					} else if (byte >= 238 && byte <= 239) needed = 2;
+					else if (byte === 240) {
+						needed = 3;
+						lower = 144;
+					} else if (byte >= 241 && byte <= 243) needed = 3;
+					else if (byte === 244) {
+						needed = 3;
+						upper = 143;
+					} else fail();
+				} else {
+					if (byte < lower || byte > upper) fail();
+					lower = 128;
+					upper = 191;
+					needed -= 1;
+				}
+			}
+		},
+		end() {
+			if (needed !== 0) fail();
+		}
+	};
+}
+async function readRange(fh, start, length) {
+	const data = Buffer.alloc(length);
+	let offset = 0;
+	while (offset < length) {
+		const { bytesRead } = await fh.read(data, offset, length - offset, start + offset);
+		if (bytesRead === 0) break;
+		offset += bytesRead;
+	}
+	return offset === length ? data : data.subarray(0, offset);
+}
+function waitForSpawn(child) {
+	return new Promise((resolve, reject) => {
+		const onSpawn = () => {
+			child.off("error", onError);
+			resolve();
+		};
+		const onError = (err) => {
+			child.off("spawn", onSpawn);
+			reject(err);
+		};
+		child.once("spawn", onSpawn);
+		child.once("error", onError);
+	});
+}
+new AsyncLocalStorage();
+//#endregion
+//#region ../../packages/agent-core/src/agent/turn/historical-tool-projection.ts
+const MIN_CHARS = 3e3;
+const MAX_REFERENCE_CHARS = 2500;
+const RECOVERY_REFERENCE = /\[Tool result offloaded\]|\[Repeated tool result omitted\]|^output_path\s*:|Tool output exceeded \d+ characters/m;
+function identity(stat) {
+	return `${stat.dev}:${stat.ino}:${stat.birthtimeNs}`;
+}
+function revision(stat) {
+	return `${identity(stat)}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}:${stat.mode}`;
+}
+function canonical(path) {
+	const normalized = resolve(path);
+	return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+async function checkedDirectory(path) {
+	const stat = await lstat(path, { bigint: true });
+	if (!stat.isDirectory() || stat.isSymbolicLink() || canonical(await realpath(path)) !== canonical(path)) throw new Error("Unsafe recovery directory");
+	return stat;
+}
+async function checkedAncestors(path) {
+	for (let current = resolve(path); current !== parse(current).root; current = dirname(current)) await checkedDirectory(current);
+}
+function persistableText(message) {
+	if (message.isError === true || message.content.length !== 1) return void 0;
+	const part = message.content[0];
+	if (part?.type !== "text") return void 0;
+	const text = part.text;
+	if (text.length < MIN_CHARS || text.includes("\0") || RECOVERY_REFERENCE.test(text) || Buffer.from(text, "utf8").toString("utf8") !== text || text.split("\n").some((line) => line.length > 2e3)) return void 0;
+	return text;
+}
+/** Lossless request-only view. The owning context and records never receive these references. */
+var HistoricalToolProjection = class {
+	agent;
+	files = /* @__PURE__ */ new Map();
+	directories = /* @__PURE__ */ new Map();
+	dirtyDirectories = /* @__PURE__ */ new Set();
+	pending = Promise.resolve();
+	constructor(agent) {
+		this.agent = agent;
+	}
+	async project(history, turnAnchor, tools, context) {
+		const unchanged = {
+			history,
+			changed: false
+		};
+		const boundary = turnAnchor === void 0 ? -1 : history.indexOf(turnAnchor);
+		const read = tools.find((tool) => tool.name === "Read");
+		if (boundary < 0 || !(read instanceof ReadTool) || !(this.agent.kaos instanceof LocalKaos) || this.agent.homedir === void 0 || this.agent.hooks?.hasMatchingHook("PreToolUse", "Read")) return unchanged;
+		const calls = /* @__PURE__ */ new Map();
+		const results = /* @__PURE__ */ new Map();
+		const knownTools = new Set(this.agent.tools.loopTools.map((tool) => tool.name));
+		history.forEach((message, index) => {
+			for (const call of message.toolCalls) {
+				const previous = calls.get(call.id);
+				calls.set(call.id, {
+					index,
+					name: call.name,
+					count: (previous?.count ?? 0) + 1
+				});
+			}
+			if (message.role === "tool" && message.toolCallId !== void 0) {
+				const previous = results.get(message.toolCallId);
+				results.set(message.toolCallId, {
+					index,
+					count: (previous?.count ?? 0) + 1
+				});
+			}
+		});
+		const closedBatches = /* @__PURE__ */ new Set();
+		for (let index = 0; index < boundary; index++) {
+			const message = history[index];
+			if (message.role === "assistant" && message.toolCalls.length > 0 && message.toolCalls.every((call) => {
+				const result = results.get(call.id);
+				return calls.get(call.id)?.count === 1 && result?.count === 1 && result.index > index && result.index < boundary;
+			})) closedBatches.add(index);
+		}
+		const projected = [...history];
+		let changed = false;
+		for (let index = 0; index < boundary; index++) {
+			context.signal.throwIfAborted();
+			const message = history[index];
+			if (message.role !== "tool" || !message.toolCallId) continue;
+			const call = calls.get(message.toolCallId);
+			if (call === void 0 || call.count !== 1 || !closedBatches.has(call.index) || !knownTools.has(call.name)) continue;
+			const text = persistableText(message);
+			if (text === void 0) continue;
+			const digest = createHash("sha256").update(JSON.stringify([
+				canonical(this.agent.homedir),
+				call.name,
+				message.toolCallId,
+				text
+			])).digest("hex");
+			const outputPath = join(resolve(this.agent.homedir), "tool-results", "historical", `${digest}.txt`);
+			const header = `[Tool result offloaded]\noutput_path: ${outputPath}\noutput_size_chars: ${text.length}\nsha256: ${createHash("sha256").update(text).digest("hex")}\nnext_step: Use Read with this path and line_offset/n_lines to recover the complete output.
+
+[preview]
+`;
+			if (header.length >= MAX_REFERENCE_CHARS) continue;
+			try {
+				if (!await this.canRead(read, outputPath, context)) continue;
+				const save = this.pending.then(() => this.persist(outputPath, text));
+				this.pending = save.catch(() => void 0);
+				await save;
+				const stat = await this.agent.kaos.stat(outputPath);
+				if ((stat.stMode & 61440) !== 32768 || stat.stSize !== Buffer.byteLength(text)) continue;
+				const bytes = await this.agent.kaos.readBytes(outputPath, Buffer.byteLength(text) + 1);
+				if (!Buffer.from(bytes).equals(Buffer.from(text)) || detectFileType(outputPath, Buffer.from(bytes).subarray(0, 512)).kind !== "text") continue;
+				await this.verifyFile(outputPath, text);
+				context.signal.throwIfAborted();
+				if (!await this.canRead(read, outputPath, context)) continue;
+				let preview = text.slice(0, MAX_REFERENCE_CHARS - header.length);
+				if (/[\uD800-\uDBFF]$/.test(preview)) preview = preview.slice(0, -1);
+				projected[index] = {
+					...message,
+					content: [{
+						type: "text",
+						text: header + preview
+					}]
+				};
+				changed = true;
+			} catch {
+				context.signal.throwIfAborted();
+			}
+		}
+		try {
+			for (const path of this.dirtyDirectories) await this.verifyDirectory(path);
+			this.dirtyDirectories.clear();
+		} catch {
+			return unchanged;
+		}
+		return {
+			history: changed ? projected : history,
+			changed
+		};
+	}
+	async canRead(read, path, context) {
+		if (this.agent.tools.loopTools.find((tool) => tool.name === "Read") !== read || this.agent.hooks?.hasMatchingHook("PreToolUse", "Read")) return false;
+		const args = {
+			path,
+			line_offset: 1,
+			n_lines: 1e3
+		};
+		const execution = read.resolveExecution(args);
+		if ("isError" in execution) return false;
+		const toolCall = {
+			type: "function",
+			id: "historical-recovery-check",
+			name: "Read",
+			arguments: JSON.stringify(args)
+		};
+		for (const policy of this.agent.permission.policies) {
+			const result = await policy.evaluate({
+				...context,
+				tool: read,
+				toolCall,
+				toolCalls: [toolCall],
+				args,
+				execution
+			});
+			if (result !== void 0) return result.kind === "approve" && result.executionMetadata === void 0;
+		}
+		return false;
+	}
+	async ensureDirectory(path) {
+		let created = false;
+		try {
+			await mkdir(path, { mode: 448 });
+			created = true;
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+		}
+		if (created && this.directories.has(dirname(path))) this.dirtyDirectories.add(dirname(path));
+		const stat = await checkedDirectory(path);
+		const previous = this.directories.get(path);
+		if (previous !== void 0 && previous.identity !== identity(stat)) throw new Error("Recovery directory replaced");
+		if (previous === void 0) {
+			if (created) await hardenPrivatePath(path, "directory");
+			await this.verifyDirectory(path);
+		} else if (previous.revision !== revision(stat) && !this.dirtyDirectories.has(path)) await this.verifyDirectory(path);
+	}
+	async verifyDirectory(path) {
+		const before = await checkedDirectory(path);
+		const previous = this.directories.get(path);
+		if (previous !== void 0 && previous.identity !== identity(before)) throw new Error("Recovery directory replaced");
+		if (process.platform === "win32") new WindowsPrivateAcl().verify(path, "directory");
+		else if ((before.mode & 63n) !== 0n) throw new Error("Recovery directory is not private");
+		const after = await checkedDirectory(path);
+		if (revision(before) !== revision(after)) throw new Error("Recovery directory changed during verification");
+		this.directories.set(path, {
+			identity: identity(after),
+			revision: revision(after)
+		});
+	}
+	async persist(path, text) {
+		await checkedAncestors(dirname(dirname(dirname(path))));
+		await this.ensureDirectory(dirname(dirname(path)));
+		await this.ensureDirectory(dirname(path));
+		if (this.files.has(path)) {
+			await this.verifyFile(path, text);
+			return;
+		}
+		try {
+			await lstat(path);
+			await this.verifyFile(path, text);
+			if (process.platform === "win32") new WindowsPrivateAcl().verify(path, "file");
+			this.files.set(path, revision(await lstat(path, { bigint: true })));
+			return;
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		const staging = join(dirname(path), `${randomUUID()}.staging`);
+		this.dirtyDirectories.add(dirname(path));
+		try {
+			await atomicWritePrivate(staging, text);
+			await checkedAncestors(dirname(path));
+			await link(staging, path);
+		} finally {
+			await unlink(staging).catch(() => void 0);
+		}
+		await this.verifyFile(path, text);
+		this.files.set(path, revision(await lstat(path, { bigint: true })));
+	}
+	async verifyFile(path, text) {
+		const before = await lstat(path, { bigint: true });
+		if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1n || before.size !== BigInt(Buffer.byteLength(text)) || process.platform !== "win32" && (before.mode & 63n) !== 0n || canonical(await realpath(path)) !== canonical(path)) throw new Error("Unsafe recovery artifact");
+		const previous = this.files.get(path);
+		if (previous !== void 0 && previous !== revision(before)) throw new Error("Recovery artifact changed");
+		const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+		try {
+			if (revision(await handle.stat({ bigint: true })) !== revision(before) || !(await handle.readFile()).equals(Buffer.from(text)) || revision(await handle.stat({ bigint: true })) !== revision(before) || revision(await lstat(path, { bigint: true })) !== revision(before) || canonical(await realpath(path)) !== canonical(path)) throw new Error("Recovery artifact changed");
+		} finally {
+			await handle.close();
+		}
+	}
+};
+//#endregion
+//#region ../../packages/agent-core/src/agent/response-review-decision.ts
+const STAGES = [
+	"setup",
+	"native",
+	"release",
+	"verification"
+];
+const REASONS = [
+	"invalid_settings",
+	"connection_unavailable",
+	"connection_changed",
+	"native_unavailable",
+	"native_rejected",
+	"release_denied",
+	"release_rejected",
+	"verification_denied",
+	"verification_rejected",
+	"binding_mismatch",
+	"cancelled",
+	"exception"
+];
+const FINDINGS = new Set([
+	"empty-target",
+	"unicode-not-nfc",
+	"replacement-character",
+	"nul-character",
+	"script-mismatch",
+	"missing-language-character-profile",
+	"ascii-folding-pressure",
+	"short-text-native-review-required",
+	"suspected-ascii-substitution",
+	"invalid-target-type",
+	"exact-language-required",
+	"missing-response-attestations",
+	"isolated-guard-unavailable",
+	"unrecognized-finding"
+]);
+/** Never carry provider/guard prose, signed receipts or arbitrary codes into logs. */
+function rejectionFindings(report) {
+	const codes = [];
+	if (report?.["reason"] !== void 0) codes.push(report["reason"]);
+	if (Array.isArray(report?.["findings"])) for (const item of report["findings"].slice(0, 32)) codes.push(typeof item === "object" && item !== null && "code" in item ? item.code : void 0);
+	const safe = [...new Set(codes.map((code) => typeof code === "string" && FINDINGS.has(code) ? code : "unrecognized-finding"))];
+	return safe.length ? safe : void 0;
+}
+function rejectionMessage(value) {
+	if (!STAGES.includes(value.stage) || !REASONS.includes(value.reason)) return void 0;
+	const findings = rejectionFindings({ findings: value.findings?.map((code) => ({ code })) });
+	return `Response review rejected candidate: ${value.stage}/${value.reason}` + (findings?.length ? ` (${findings.join(", ")})` : "");
+}
+//#endregion
+//#region ../../packages/agent-core/src/agent/response-review-deadline.ts
+const IDLE_TIMEOUT_MS = 3e4;
+const NATIVE_FIRST_CONTENT_MS = 9e4;
+const ABSOLUTE_TIMEOUT_MS = 12e4;
+function createResponseReviewDeadline(source) {
+	const absoluteExpiresAt = performance.now() + ABSOLUTE_TIMEOUT_MS;
+	const absolute = createDeadlineAbortSignal(source, ABSOLUTE_TIMEOUT_MS);
+	const controller = new AbortController();
+	const unlink = linkAbortSignal(absolute.signal, controller);
+	let stage = "setup";
+	let didTimeout = false;
+	let closed = false;
+	let idle;
+	let idleExpiresAt = 0;
+	const expire = () => {
+		didTimeout = true;
+		controller.abort(abortError());
+	};
+	const expireIfDue = () => {
+		if (closed || controller.signal.aborted) return;
+		const now = performance.now();
+		if (now >= absoluteExpiresAt || now >= idleExpiresAt) expire();
+	};
+	const refresh = (timeoutMs) => {
+		idleExpiresAt = performance.now() + timeoutMs;
+		if (idle !== void 0) clearTimeout(idle);
+		idle = setTimeout(expire, timeoutMs);
+	};
+	refresh(IDLE_TIMEOUT_MS);
+	return {
+		signal: controller.signal,
+		timedOut: () => didTimeout || absolute.timedOut(),
+		throwIfAborted: () => {
+			expireIfDue();
+			controller.signal.throwIfAborted();
+		},
+		progress: (event) => {
+			expireIfDue();
+			if (closed || controller.signal.aborted) return;
+			if (event === "native.start" && stage === "setup") {
+				stage = "native";
+				refresh(NATIVE_FIRST_CONTENT_MS);
+			} else if (event === "native.text" && stage === "native") refresh(IDLE_TIMEOUT_MS);
+			else if (event === "release.start" && stage === "native") {
+				stage = "release";
+				refresh(IDLE_TIMEOUT_MS);
+			} else if (event === "verification.start" && stage === "release") {
+				stage = "verification";
+				refresh(IDLE_TIMEOUT_MS);
+			}
+		},
+		clear: () => {
+			closed = true;
+			if (idle !== void 0) clearTimeout(idle);
+			idle = void 0;
+			unlink();
+			absolute.clear();
+		}
+	};
+}
+//#endregion
+//#region ../../packages/agent-core/src/agent/response-review.ts
+const MAX_CANDIDATE_BYTES = 1048576;
+const MAX_CANDIDATE_PARTS = 4096;
+const REVIEW_CANCEL_SETTLE_MS = 1e3;
+const MAX_REVIEW_ATTEMPTS = 2;
+function createReviewedOutputDispatcher(options) {
+	let pending = [];
+	let bytes = 0;
+	let stepUuid;
+	let epoch = 0;
+	let reviewing = false;
+	let turnId;
+	let stepNumber = 0;
+	let toolTextWithheld = false;
+	const toolCalls = /* @__PURE__ */ new Map();
+	const toolResults = /* @__PURE__ */ new Set();
+	let invalidToolExchange = false;
+	function clear() {
+		pending = [];
+		bytes = 0;
+		stepUuid = void 0;
+		epoch += 1;
+		reviewing = false;
+		toolCalls.clear();
+		toolResults.clear();
+		invalidToolExchange = false;
+	}
+	function dispatch(event) {
+		if (event.type === "text.delta") {
+			options.onTextProgress?.();
+			return;
+		}
+		if (event.type === "step.begin") {
+			clear();
+			if (turnId !== event.turnId) toolTextWithheld = false;
+			turnId = event.turnId;
+			stepNumber = event.step;
+			stepUuid = event.uuid;
+			return options.dispatch(event);
+		}
+		if (event.type === "content.part" && event.part.type === "text") {
+			if (reviewing) {
+				clear();
+				return Promise.reject(/* @__PURE__ */ new Error("Response review candidate changed during verification"));
+			}
+			if (stepUuid !== event.stepUuid) return Promise.reject(/* @__PURE__ */ new Error("Response review step mismatch"));
+			bytes += Buffer.byteLength(event.part.text);
+			if (bytes > MAX_CANDIDATE_BYTES || pending.length >= MAX_CANDIDATE_PARTS) {
+				clear();
+				return Promise.reject(/* @__PURE__ */ new Error("Response review candidate exceeds limit"));
+			}
+			pending.push({
+				...event,
+				part: { ...event.part }
+			});
+			return Promise.resolve();
+		}
+		if (event.type === "step.end") return finish(event);
+		if (event.type === "turn.interrupted") clear();
+		if (event.type === "step.retrying") {
+			clear();
+			stepUuid = event.stepUuid;
+		}
+		if (event.type === "tool.call") {
+			const recordedEpoch = epoch;
+			const { toolCallId, uuid } = event;
+			const matchesStep = event.stepUuid === stepUuid && event.turnId === turnId && event.step === stepNumber;
+			return options.dispatch(event).then(() => {
+				if (recordedEpoch !== epoch) return;
+				if (!matchesStep || toolCalls.has(toolCallId)) invalidToolExchange = true;
+				else toolCalls.set(toolCallId, uuid);
+			});
+		}
+		if (event.type === "tool.result") {
+			const recordedEpoch = epoch;
+			const { toolCallId, parentUuid } = event;
+			return options.dispatch(event).then(() => {
+				if (recordedEpoch !== epoch) return;
+				if (toolCalls.get(toolCallId) !== parentUuid || toolResults.has(toolCallId)) invalidToolExchange = true;
+				else toolResults.add(toolCallId);
+			});
+		}
+		if (event.type === "content.part") return options.dispatch(event);
+		options.dispatch(event);
+	}
+	async function finish(event) {
+		if (pending.length === 0) return options.dispatch(event);
+		if (event.uuid !== stepUuid) throw new Error("Response review step mismatch");
+		const currentEpoch = epoch;
+		const isCurrentCandidate = () => epoch === currentEpoch;
+		const parts = [...pending];
+		reviewing = true;
+		const text = parts.map((part) => part.part.type === "text" ? part.part.text : "").join("");
+		try {
+			if (event.finishReason !== "end_turn" && event.finishReason !== "tool_use") throw new Error("Response review requires a complete candidate");
+			if (options.review === void 0) throw new Error("Response review unavailable");
+			options.signal.throwIfAborted();
+			let approval;
+			let rejection;
+			let nativeRejection = false;
+			for (let attempt = 1; attempt <= MAX_REVIEW_ATTEMPTS; attempt += 1) {
+				options.signal.throwIfAborted();
+				if (epoch !== currentEpoch) throw new Error("Response review candidate changed during verification");
+				const deadline = createResponseReviewDeadline(options.signal);
+				let requested;
+				const pendingOperations = [];
+				let attemptRejection;
+				let attemptNativeRejection = false;
+				try {
+					requested = options.review({
+						text,
+						turnId: event.turnId,
+						step: event.step,
+						signal: deadline.signal,
+						onProgress: (progress) => {
+							if (isCurrentCandidate()) deadline.progress(progress);
+						},
+						onPendingOperation: (operation) => {
+							pendingOperations.push(operation.then(() => void 0, () => void 0));
+						},
+						onRejected: (decision) => {
+							if (!deadline.signal.aborted) {
+								const message = rejectionMessage(decision);
+								attemptNativeRejection = attemptRejection === void 0 && message !== void 0 && decision.stage === "native" && decision.reason === "native_rejected";
+								attemptRejection = message;
+							}
+						}
+					});
+					approval = await abortable(requested, deadline.signal);
+					deadline.throwIfAborted();
+					rejection = attemptRejection;
+					nativeRejection = attemptNativeRejection;
+					break;
+				} catch {
+					options.signal.throwIfAborted();
+					if (attemptRejection !== void 0) throw new Error(attemptRejection);
+					if (deadline.timedOut() && attempt < MAX_REVIEW_ATTEMPTS && requested !== void 0 && epoch === currentEpoch && await waitForCancelledReview(requested, pendingOperations)) continue;
+					throw new Error(deadline.timedOut() ? "Response review timed out" : "Response review failed");
+				} finally {
+					deadline.clear();
+				}
+			}
+			options.signal.throwIfAborted();
+			if (epoch !== currentEpoch) throw new Error("Response review candidate changed during verification");
+			if (nativeRejection && !toolTextWithheld && event.finishReason === "tool_use" && event.turnId === turnId && event.step === stepNumber && !invalidToolExchange && toolCalls.size > 0 && toolResults.size === toolCalls.size) {
+				toolTextWithheld = true;
+				await options.dispatch(event);
+				try {
+					options.onToolTextWithheld?.({
+						turnId: event.turnId,
+						step: event.step
+					});
+				} catch {}
+				return;
+			}
+			if (rejection !== void 0) throw new Error(rejection);
+			if (epoch !== currentEpoch || approval?.targetSha256 !== createHash("sha256").update(text).digest("hex") || !Number.isSafeInteger(approval.expiresAt) || approval.expiresAt <= Date.now()) throw new Error("Response review did not approve the exact current candidate");
+			for (const part of parts) {
+				options.signal.throwIfAborted();
+				if (epoch !== currentEpoch || approval.expiresAt <= Date.now()) throw new Error("Response review approval no longer current");
+				await options.dispatch(part);
+			}
+			options.signal.throwIfAborted();
+			if (epoch !== currentEpoch || approval.expiresAt <= Date.now()) throw new Error("Response review approval no longer current");
+			options.dispatch({
+				type: "text.delta",
+				delta: text
+			});
+			await options.dispatch(event);
+		} finally {
+			if (epoch === currentEpoch) clear();
+		}
+	}
+	async function waitForCancelledReview(requested, pendingOperations) {
+		const deadline = createDeadlineAbortSignal(options.signal, REVIEW_CANCEL_SETTLE_MS);
+		try {
+			await abortable(requested.then(() => void 0, () => void 0), deadline.signal);
+			let observed = 0;
+			while (observed < pendingOperations.length) {
+				const batch = pendingOperations.slice(observed);
+				observed = pendingOperations.length;
+				await abortable(Promise.all(batch), deadline.signal);
+			}
+			options.signal.throwIfAborted();
+			return true;
+		} catch {
+			options.signal.throwIfAborted();
+			return false;
+		} finally {
+			deadline.clear();
+		}
+	}
+	return dispatch;
+}
+//#endregion
+//#region ../../packages/agent-core/src/agent/turn/index.ts
+function blunExtractText(content) {
+	if (typeof content === "string") return content;
+	if (Array.isArray(content)) return content.map((c) => typeof c === "string" ? c : c && typeof c === "object" && "text" in c && typeof c.text === "string" ? c.text : "").join(" ");
+	return "";
+}
+/**
+* BLUN: decide whether a turn should carry the full tool set. Small-context models
+* (e.g. King on an 8k window) lose their identity/language when all tool schemas
+* flood the prompt. A plain greeting omits task tools but keeps any enabled
+* language review workflow. Conservative: only very short, clearly
+* conversational messages skip task tools; anything task-like keeps the full set.
+*/
+function blunTurnNeedsTools(input, origin) {
+	if (origin.kind !== "user") return true;
+	const text = blunExtractText(input).trim().toLowerCase();
+	if (text.length === 0 || text.length > 48) return true;
+	return !/^(?:hi|hallo|hey|hello|hoi|moin|servus|yo|danke|thanks|thx|bye|tschau|ciao)[.!?]*$/.test(text) && !/^(?:wer bist du|who are you|wie geht(?: es dir)?|how are you|na)[.!?]*$/.test(text);
+}
+function blunThinkingIntentInput(input) {
+	const channelText = [...blunExtractText(input).matchAll(/(?:^|\r?\n)<channel\b[^>]*>\r?\n([\s\S]*?)\r?\n<\/channel>(?=\r?\n|$)/gi)].at(-1)?.[1];
+	return channelText === void 0 ? input : [{
+		type: "text",
+		text: channelText
+	}];
+}
+function blunTurnHasAttachment(input) {
+	return input.some((part) => part.type !== "text") || /\b(?:image_path|attachment_file_id)\s*=/i.test(blunExtractText(input));
+}
+function greetingHistory(history, anchor) {
+	const start = anchor === void 0 ? -1 : history.indexOf(anchor);
+	if (start < 0) return history;
+	const recent = [];
+	let chars = 0;
+	for (let i = start - 1; i >= 0 && recent.length < 6; i -= 1) {
+		const message = history[i];
+		if (message.role === "tool" || message.toolCalls.length > 0) break;
+		if (message.role !== "assistant" && message.origin?.kind !== "user") continue;
+		const size = blunExtractText(message.content).length;
+		if (chars + size > 12e3 || message.content.some((part) => part.type !== "text")) break;
+		recent.unshift(message);
+		chars += size;
+	}
+	while (recent.length > 0 && recent[0].role !== "user") recent.shift();
+	return [...recent, ...history.slice(start)];
+}
+/**
+* BLUN: builtin tools kept when the full schema set would overflow a small
+* context window. The essential read / edit / run / track loop — enough for
+* King to do real work on a 32k window without the full ~15k-token tool floor
+* that pushes a single task turn to ~82% context and into a compaction
+* death-loop (compaction can only shrink conversation, never the fixed tool
+* floor, so it re-triggers every turn).
+*/
+const BLUN_LEAN_TOOL_NAMES = new Set([
+	"Read",
+	"ReadBatch",
+	"Write",
+	"Edit",
+	"Grep",
+	"Glob",
+	"Bash",
+	"TodoList",
+	"Skill",
+	"CompactConversation",
+	"MistakeRecord"
+]);
+const BLUN_LANGUAGE_REVIEW_TOOL_NAMES = new Set([
+	"release_response",
+	"release_translation",
+	"verify_release_token",
+	"validate_text"
+].map((name) => qualifyMcpToolName("blun-language-guard", name)));
+/**
+* Channel/session MCP tools that must survive the lean cut — e.g. the Telegram
+* reply tools. Without these a bridged session can RECEIVE a message but has no
+* way to answer it (King processes the turn, then has no reply tool). Their
+* schemas are tiny, so keeping them does not reappear the compaction floor.
+* Matches both bare names and MCP-prefixed variants (…__reply).
+*
+*/
+const BLUN_LEAN_KEEP_RE = /(^|__|:)(reply|react|edit_message|download_attachment|memory_(?:status|settings_update|remember|list|threads_list|recall))$/i;
+/** Telegram writes require a real inbound user turn, never an internal nudge. */
+const BLUN_TELEGRAM_OUTBOUND_TOOL_RE = /^mcp__[^\s]*telegram[^\s]*__(?:reply|react|edit_message)$/i;
+function blunToolsForOrigin(tools, origin) {
+	if (origin.kind !== "system_trigger" && origin.kind !== "injection") return tools;
+	return tools.filter((tool) => !BLUN_TELEGRAM_OUTBOUND_TOOL_RE.test(tool.name));
+}
+/**
+* Restore bounded schema disclosure even on large-context models. Only tools
+* already eligible for this turn enter the loader; execution still follows
+* the ordinary permission pipeline.
+*/
+function blunSelectTurnTools(tools, maxContextTokens, loadedToolNames = /* @__PURE__ */ new Set(), requiredToolNames = /* @__PURE__ */ new Set(), selected = []) {
+	if (estimateTokensForTools(tools) <= (0, import_turn_tool_performance_policy.toolSchemaBudgetTokens)(maxContextTokens) || tools.some((tool) => tool.name === "ToolSearch")) {
+		selected.splice(0, selected.length, ...tools);
+		return selected;
+	}
+	selected.splice(0, selected.length, ...tools.filter((tool) => BLUN_LEAN_TOOL_NAMES.has(tool.name) || BLUN_LEAN_KEEP_RE.test(tool.name) || BLUN_LANGUAGE_REVIEW_TOOL_NAMES.has(tool.name) || loadedToolNames.has(tool.name) || requiredToolNames.has(tool.name)));
+	const names = new Set(selected.map((tool) => tool.name));
+	const deferred = tools.filter((tool) => !names.has(tool.name));
+	if (deferred.length > 0) selected.push((0, import_turn_tool_performance_policy.createDeferredToolLoader)(selected, deferred, loadedToolNames));
+	return selected;
+}
+const LLM_NOT_SET_MESSAGE = "LLM not set, send \"/login\" to login";
+/** Origin tag for the synthetic "continue" prompt that drives each goal turn. */
+const GOAL_CONTINUATION_ORIGIN = {
+	kind: "system_trigger",
+	name: "goal_continuation"
+};
+function goalContinuationOrigin(origin) {
+	const cronRunId = origin.kind === "cron_job" ? origin.runId : origin.kind === "system_trigger" && origin.name === "goal_continuation" ? origin.cronRunId : void 0;
+	return cronRunId === void 0 ? GOAL_CONTINUATION_ORIGIN : {
+		kind: "system_trigger",
+		name: "goal_continuation",
+		cronRunId
+	};
+}
+const GOAL_COMPLETION_REMINDER_NAME = "goal_completion";
+const GOAL_BLOCKED_REMINDER_NAME = "goal_blocked";
+const GOAL_RATE_LIMIT_PAUSE_REASON = "Paused after provider rate limit";
+const GOAL_PROVIDER_CONNECTION_PAUSE_PREFIX = "Paused after provider connection error";
+const GOAL_PROVIDER_AUTH_PAUSE_PREFIX = "Paused after provider authentication error";
+const GOAL_PROVIDER_API_PAUSE_PREFIX = "Paused after provider API error";
+const GOAL_MODEL_CONFIG_PAUSE_PREFIX = "Paused after model configuration error";
+const GOAL_RUNTIME_PAUSE_PREFIX = "Paused after runtime error";
+const GOAL_PROVIDER_FILTERED_PAUSE_REASON = "Paused after provider safety policy block";
+/**
+* The prompt the goal driver appends to start each continuation turn — the
+* autonomous stand-in for the user typing "continue". The model decides when to
+* stop by calling `UpdateGoal`; otherwise the driver runs another turn.
+*/
+const GOAL_CONTINUATION_PROMPT = [
+	"Continue working toward the active goal.",
+	"Keep the self-audit brief. Do not explore unrelated interpretations once the goal can be",
+	"decided. If the objective is simple, already answered, impossible, unsafe, or contradictory,",
+	"do not run another goal turn. Explain briefly if useful, then call UpdateGoal with `complete`",
+	"or `blocked` in the same turn. Otherwise, weigh the objective and any completion criteria",
+	"against the work done so far. Goal mode is iterative: do one coherent slice of work, then",
+	"reassess.",
+	"",
+	"CRITICAL — WHEN TO END THE GOAL:",
+	"When all required work is done — files written, code executed, tests passing, validation",
+	"passed — you MUST call UpdateGoal with `complete` IMMEDIATELY. Do not narrerate the next step",
+	"and stop without calling it. Do not leave the goal active when the work is finished.",
+	"If you have completed the task and are about to end your response, call UpdateGoal with",
+	"`complete` FIRST, then give your summary. Never end a turn with the goal still active if",
+	"the work is actually done.",
+	"",
+	"Do not mark complete after only producing a plan, summary, first pass, or partial result.",
+	"Do not mark complete after announcing the next step without executing it.",
+	"If an external condition or required user input prevents progress, or the objective cannot",
+	"be completed as stated, call UpdateGoal with `blocked`. On error or failure, call",
+	"UpdateGoal with `blocked`, NOT `complete`.",
+	"Otherwise keep going — use the existing conversation context and your tools,",
+	"and do not ask the user for input unless a real blocker prevents progress."
+].join(" ");
+var TurnFlow = class {
+	agent;
+	admissionClosed = false;
+	loadedToolNames = /* @__PURE__ */ new Set();
+	refreshSelectedTools;
+	executions = new ExecutionLedger();
+	executingControllers = /* @__PURE__ */ new Set();
+	steerBuffer = [];
+	nextSteerSequence = 0;
+	turnId = -1;
+	activeTurn = null;
+	toolCallStartedAt = /* @__PURE__ */ new Map();
+	toolCallDupType = /* @__PURE__ */ new Map();
+	stepToolCallKeys = /* @__PURE__ */ new Map();
+	telemetryModeByTurn = /* @__PURE__ */ new Map();
+	currentStepByTurn = /* @__PURE__ */ new Map();
+	interruptedTelemetryTurnIds = /* @__PURE__ */ new Set();
+	stepFailureByTurn = /* @__PURE__ */ new Map();
+	providerRequestFailureByTurn = /* @__PURE__ */ new Map();
+	currentStep = 0;
+	historicalToolProjection;
+	constructor(agent) {
+		this.agent = agent;
+		this.historicalToolProjection = new HistoricalToolProjection(agent);
+	}
+	/** Explicit host shutdown only; ordinary cancellation remains resumable. */
+	closeAdmission() {
+		this.admissionClosed = true;
+	}
+	async quiesce(options) {
+		const deadline = new QuiescenceDeadline(options.deadlineAt);
+		this.closeAdmission();
+		const reason = /* @__PURE__ */ new Error("Turn admission is closed for quiescence");
+		if (this.hasActiveTurn) this.cancel(void 0, reason);
+		for (const controller of this.executingControllers) controller.abort(reason);
+		await deadline.wait(this.executions.drain());
+		const checkedAt = Date.now();
+		const remaining = this.executions.pending;
+		return {
+			admissionClosed: true,
+			checkedAt,
+			remaining,
+			status: deadline.expired || remaining.length > 0 ? "incomplete" : "quiescent",
+			reason: deadline.expired ? "deadline" : void 0
+		};
+	}
+	/** Actual execution, unlike waitForCurrentTurn(signal), is not abortable. */
+	waitForExecutionEnd() {
+		return this.executions.drain();
+	}
+	get pendingExecutions() {
+		return this.executions.pending;
+	}
+	assertAdmissionOpen() {
+		if (this.admissionClosed) throw new Error("Turn admission is closed for quiescence");
+	}
+	/** Best-effort agent id (main / generated id) derived from the agent homedir. */
 	get agentId() {
 		return this.agent.homedir ? basename$1(this.agent.homedir) : this.agent.type;
 	}
@@ -264821,7 +266279,10 @@ var TurnFlow = class {
 			turnId,
 			origin
 		});
+		const previousLastMessage = this.agent.context.history.at(-1);
 		this.agent.context.appendUserMessage(input, origin);
+		const appendedMessage = this.agent.context.history.at(-1);
+		const turnAnchor = appendedMessage !== previousLastMessage && appendedMessage?.role === "user" && appendedMessage.origin === origin ? appendedMessage : void 0;
 		const startedAt = Date.now();
 		let ended;
 		let blockedByUserPromptHook = false;
@@ -264848,7 +266309,7 @@ var TurnFlow = class {
 					this.agent.log.warn("Turn-start observation failed");
 				}
 				signal.throwIfAborted();
-				const stopReason = await this.runStepLoop(turnId, signal, input, origin, (response) => {
+				const stopReason = await this.runStepLoop(turnId, signal, input, origin, turnAnchor, (response) => {
 					completedResponse = response;
 				});
 				completedStopReason = stopReason;
@@ -265013,7 +266474,7 @@ var TurnFlow = class {
 			content: hookResult.message
 		});
 	}
-	async runStepLoop(turnId, signal, input, origin, onFinalResponse) {
+	async runStepLoop(turnId, signal, input, origin, turnAnchor, onFinalResponse) {
 		let stopHookContinuationUsed = false;
 		let goalOutcomeMessageContinuationUsed = false;
 		const deduper = new ToolCallDeduplicator({ telemetry: this.agent.telemetry });
@@ -265026,11 +266487,25 @@ var TurnFlow = class {
 		let taskToolsNeeded = turnNeedsThinking || blunTurnHasAttachment(input);
 		const greetingAnchor = this.agent.context.history.findLast((message) => message.role === "user" && message.origin?.kind === "user");
 		let partialContext = false;
-		const turnHistory = () => {
-			const history = personalMemoryRecall === void 0 ? this.agent.context.history : [...this.agent.context.history, personalMemoryRecall];
+		const turnHistory = async (tools) => {
+			const raw = [...this.agent.context.history];
+			const history = personalMemoryRecall === void 0 ? raw : [...raw, personalMemoryRecall];
 			const selected = taskToolsNeeded ? history : greetingHistory(history, greetingAnchor);
-			partialContext = selected.length < history.length;
-			return selected;
+			const projected = await this.historicalToolProjection.project(selected, turnAnchor, tools, {
+				turnId: String(turnId),
+				stepNumber: this.currentStep,
+				signal,
+				llm: turnLLM
+			});
+			const current = this.agent.context.history;
+			if (current.length !== raw.length || current.some((message, index) => message !== raw[index])) {
+				const latest = personalMemoryRecall === void 0 ? current : [...current, personalMemoryRecall];
+				const retained = taskToolsNeeded ? latest : greetingHistory(latest, greetingAnchor);
+				partialContext = retained.length < latest.length;
+				return retained;
+			}
+			partialContext = selected.length < history.length || projected.changed;
+			return projected.history;
 		};
 		const turnLLM = this.agent.llmForTurn(turnNeedsThinking ? void 0 : "off");
 		const turnTools = this.agent.tools.captureTurnTools();
@@ -265066,8 +266541,8 @@ var TurnFlow = class {
 						}, completion);
 					},
 					llm: turnLLM,
-					buildMessages: () => this.agent.context.project(turnHistory(), { dropOrphanResults: true }),
-					buildMessagesStrict: () => this.agent.context.project(turnHistory(), {
+					buildMessages: async () => this.agent.context.project(await turnHistory(selectedTools), { dropOrphanResults: true }),
+					buildMessagesStrict: async () => this.agent.context.project(await turnHistory(selectedTools), {
 						synthesizeMissing: true,
 						dropOrphanResults: true,
 						dedupeDuplicateToolCalls: true,
@@ -268209,12 +269684,14 @@ function readPayload(result, includeError = false) {
 /** Receipts never enter ordinary tool execution, hooks, replay or model history. */
 function createGuardResponseReviewer(host) {
 	const { language, guardVersion } = host;
-	return async ({ text, turnId, step, signal, onRejected }) => {
+	return async ({ text, turnId, step, signal, onRejected, onPendingOperation, onProgress }) => {
 		const input = {
 			text,
 			turnId,
 			step,
-			signal
+			signal,
+			onPendingOperation,
+			onProgress
 		};
 		const targetSha256 = digest(text);
 		let stage = "setup";
@@ -268241,6 +269718,10 @@ function createGuardResponseReviewer(host) {
 		const blocked = (reason, findings) => {
 			record(signal.aborted ? "cancelled" : reason, findings);
 		};
+		const track = (operation) => {
+			onPendingOperation?.(operation.then(() => void 0, () => void 0));
+			return operation;
+		};
 		try {
 			if (!/^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/.test(language) || /^(auto|all)$/i.test(language) || guardVersion.trim().length === 0) return blocked("invalid_settings");
 			const resolve = () => {
@@ -268253,13 +269734,14 @@ function createGuardResponseReviewer(host) {
 			const current = () => !signal.aborted && resolve()?.client === connection.client;
 			if (!current()) return blocked("connection_changed");
 			stage = "native";
-			const native = await abortable(host.reviewNative({ ...input }), signal);
+			onProgress?.("native.start");
+			const native = await abortable(track(host.reviewNative({ ...input })), signal);
 			if (!current()) return blocked("connection_changed");
 			if (native === void 0) return blocked("native_unavailable");
 			if (!passed(native.nativeness) || !passed(native.orthography)) return blocked("native_rejected");
 			const authorized = async (name) => {
 				if (!current()) return false;
-				return passed(await abortable(host.authorize({
+				return passed(await abortable(track(host.authorize({
 					toolName: qualifyMcpToolName(SERVER_NAME, name),
 					targetSha256,
 					language,
@@ -268268,11 +269750,12 @@ function createGuardResponseReviewer(host) {
 					turnId,
 					step,
 					signal
-				}), signal)) && current();
+				})), signal)) && current();
 			};
 			stage = "release";
+			onProgress?.("release.start");
 			if (!await authorized("release_response")) return blocked("release_denied");
-			const releaseResult = await abortable(connection.client.callTool("release_response", {
+			const releaseResult = await abortable(track(connection.client.callTool("release_response", {
 				target_text: text,
 				language,
 				content_type: "prose",
@@ -268281,7 +269764,7 @@ function createGuardResponseReviewer(host) {
 					nativeness: true,
 					orthography: true
 				}
-			}, signal), signal);
+			}, signal)), signal);
 			if (!current()) return blocked("connection_changed");
 			if (releaseResult.isError) return blocked("release_rejected", rejectionFindings(readPayload(releaseResult, true)));
 			const released = readPayload(releaseResult);
@@ -268289,8 +269772,9 @@ function createGuardResponseReviewer(host) {
 			if (!current()) return blocked("connection_changed");
 			if (status !== "PASS" || release_allowed !== true || blocking === true || typeof release_token !== "string" || release_token.length === 0 || release_token.length > 65536) return blocked("release_rejected", rejectionFindings(released));
 			stage = "verification";
+			onProgress?.("verification.start");
 			if (!await authorized("verify_release_token")) return blocked("verification_denied");
-			const { status: verificationStatus, valid, checks, payload } = readPayload(await abortable(connection.client.callTool("verify_release_token", {
+			const { status: verificationStatus, valid, checks, payload } = readPayload(await abortable(track(connection.client.callTool("verify_release_token", {
 				release_token,
 				source_text: "",
 				target_text: text,
@@ -268298,7 +269782,7 @@ function createGuardResponseReviewer(host) {
 				purpose: "response",
 				content_type: "prose",
 				short_text_reviewed: false
-			}, signal), signal)) ?? {};
+			}, signal)), signal)) ?? {};
 			if (!current()) return blocked("connection_changed");
 			if (verificationStatus !== "PASS" || valid !== true || !isPlainRecord(checks) || !CHECK_NAMES.every((name) => checks[name] === true) || !isPlainRecord(payload)) return blocked("verification_rejected");
 			const { v, source_sha256, target_sha256, language: verifiedLanguage, purpose, content_type, short_text_reviewed, exp, iat } = payload;
@@ -268370,6 +269854,7 @@ async function reviewNativeResponse(agent, language, input) {
 		});
 	};
 	const valueType = (value) => value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
+	let formatRetry = false;
 	for (let attempt = 1; attempt <= 2; attempt += 1) {
 		let receivedBytes = 0;
 		let outputLimitExceeded = false;
@@ -268378,21 +269863,27 @@ async function reviewNativeResponse(agent, language, input) {
 		};
 		const options = {
 			signal,
+			onExecution: (completion) => {
+				input.onPendingOperation?.(completion.then(() => void 0, () => void 0));
+			},
 			requestLogFields: {
 				turnStep: `review:${input.turnId}.${String(input.step)}`,
 				attempt: `${attempt}/2`
 			}
 		};
-		const prompt = attempt === 1 ? NATIVE_REVIEW_PROMPT : `${NATIVE_REVIEW_PROMPT}\nThe previous review did not satisfy the required JSON format. Return exactly one object with the two required boolean keys nativeness and orthography, no wrapper or additional keys. Use true or false, not strings or null. Set a check to false if it fails or you are uncertain.`;
+		const prompt = !formatRetry ? NATIVE_REVIEW_PROMPT : `${NATIVE_REVIEW_PROMPT}\nThe previous review did not satisfy the required JSON format. Return exactly one object with the two required boolean keys nativeness and orthography, no wrapper or additional keys. Use true or false, not strings or null. Set a check to false if it fails or you are uncertain.`;
 		try {
 			signal.throwIfAborted();
-			const response = await abortable(agent.generate(provider, prompt, [], [createUserMessage(candidateMessage)], { onMessagePart: (part) => {
+			const requested = agent.generate(provider, prompt, [], [createUserMessage(candidateMessage)], { onMessagePart: (part) => {
 				if (part.type === "text") receivedBytes += Buffer.byteLength(part.text);
 				if (receivedBytes > MAX_REVIEW_RESULT_BYTES) {
 					outputLimitExceeded = true;
 					throw new Error("Native review output exceeds limit");
 				}
-			} }, options), signal);
+				if (!signal.aborted && part.type === "text" && part.text.trim().length > 0) input.onProgress?.("native.text");
+			} }, options);
+			input.onPendingOperation?.(requested.then(() => void 0, () => void 0));
+			const response = await abortable(requested, signal);
 			if (response.usage !== null) agent.usage.record(modelAlias, response.usage, "turn");
 			signal.throwIfAborted();
 			if (response.message.toolCalls.length > 0) return invalid("tool_calls");
@@ -268405,7 +269896,10 @@ async function reviewNativeResponse(agent, language, input) {
 				parsed = JSON.parse(text);
 			} catch {
 				record("invalid_json", attempt);
-				if (attempt === 1) continue;
+				if (attempt === 1) {
+					formatRetry = true;
+					continue;
+				}
 				return;
 			}
 			if (!isPlainRecord(parsed) || Object.keys(parsed).length !== 2 || typeof parsed["nativeness"] !== "boolean" || typeof parsed["orthography"] !== "boolean") {
@@ -268416,7 +269910,10 @@ async function reviewNativeResponse(agent, language, input) {
 					nativenessType: fields ? valueType(fields["nativeness"]) : "missing",
 					orthographyType: fields ? valueType(fields["orthography"]) : "missing"
 				});
-				if (attempt === 1 && !(fields && (fields["nativeness"] === false || fields["orthography"] === false))) continue;
+				if (attempt === 1 && !(fields && (fields["nativeness"] === false || fields["orthography"] === false))) {
+					formatRetry = true;
+					continue;
+				}
 				return;
 			}
 			record(parsed["nativeness"] && parsed["orthography"] ? "approved" : "native_rejected", attempt, {
@@ -268427,7 +269924,12 @@ async function reviewNativeResponse(agent, language, input) {
 				nativeness: parsed["nativeness"],
 				orthography: parsed["orthography"]
 			};
-		} catch {
+		} catch (error) {
+			if (!signal.aborted && !outputLimitExceeded && attempt === 1 && error instanceof APIProviderRateLimitError) {
+				record("rate_limited", attempt);
+				if (error.retryAfterMs === null) await agent.providerRetryWait.defer(providerRetryScope(modelAlias, provider), 1e3);
+				continue;
+			}
 			return invalid(signal.aborted ? "cancelled" : outputLimitExceeded ? "output_limit" : "generation_failed");
 		}
 	}
@@ -309746,7 +311248,7 @@ const NINE = "9".charCodeAt(0);
 * @returns An array containing the integer step size and the integer offset of the nth rule.
 * @example nthCheck.parse("2n+3"); // returns [2, 3]
 */
-function parse$5(formula) {
+function parse$6(formula) {
 	formula = formula.trim().toLowerCase();
 	if (formula === "even") return [2, 0];
 	else if (formula === "odd") return [2, 1];
@@ -309846,7 +311348,7 @@ function compile$2(parsed) {
 * check(6); // `true`
 */
 function nthCheck(formula) {
-	return compile$2(parse$5(formula));
+	return compile$2(parse$6(formula));
 }
 //#endregion
 //#region ../../node_modules/.pnpm/css-select@5.2.2/node_modules/css-select/lib/esm/pseudo-selectors/filters.js
@@ -315506,7 +317008,7 @@ var DOMParser = class DOMParser {
 };
 //#endregion
 //#region ../../node_modules/.pnpm/linkedom@0.18.12/node_modules/linkedom/esm/shared/parse-json.js
-const { parse: parse$1 } = JSON;
+const { parse: parse$2 } = JSON;
 //#endregion
 //#region ../../node_modules/.pnpm/linkedom@0.18.12/node_modules/linkedom/esm/index.js
 const parseHTML$1 = (html, globals = null) => new DOMParser().parseFromString(html, "text/html", globals).defaultView;
@@ -331936,1142 +333438,6 @@ async function assertSuccess(response, operation) {
 	throw new Error(`${operation} failed: HTTP ${String(response.status)}${detail ? `: ${detail}` : ""}`);
 }
 //#endregion
-//#region ../../packages/kaos/src/errors.ts
-/**
-* Base error class for the kaos package.
-*/
-var KaosError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "KaosError";
-	}
-};
-/**
-* Equivalent to Python's FileExistsError — indicates a file or directory already exists.
-*/
-var KaosFileExistsError = class extends KaosError {
-	constructor(message) {
-		super(message);
-		this.name = "KaosFileExistsError";
-	}
-};
-/**
-* Thrown by `detectEnvironment` on Windows when no Git Bash install can be
-* located. Carries the list of paths that were probed so callers can include
-* them in install hints.
-*/
-var KaosShellNotFoundError = class extends KaosError {
-	constructor(message) {
-		super(message);
-		this.name = "KaosShellNotFoundError";
-	}
-};
-//#endregion
-//#region ../../packages/kaos/src/environment.ts
-/**
-* Environment — cross-platform probe of OS / shell.
-*
-* Detection is a pure function of injected probes (`platform` / `arch` /
-* `release` / `env` / `isFile` / `execFileText`) so the same suite runs
-* identically on any host OS. `detectEnvironmentFromNode()` bundles the Node
-* defaults for production callers.
-*
-* On Windows the probe expects Git Bash (the canonical POSIX shell that
-* ships with Git for Windows). If it cannot be located the function
-* throws `KaosShellNotFoundError`; the SDK layer can wrap that into a
-* user-facing install hint. Set `BLUN_SHELL_PATH` to override.
-*/
-const GIT_EXEC_PATH_TIMEOUT_MS = 5e3;
-function resolveOsKind(platform) {
-	switch (platform) {
-		case "darwin": return "macOS";
-		case "linux": return "Linux";
-		case "win32": return "Windows";
-		default: return platform;
-	}
-}
-async function detectEnvironment(deps) {
-	const osKind = resolveOsKind(deps.platform);
-	const osArch = deps.arch;
-	const osVersion = deps.release;
-	if (deps.platform === "win32") return {
-		osKind,
-		osArch,
-		osVersion,
-		shellName: "bash",
-		shellPath: await locateWindowsGitBash(deps)
-	};
-	const candidates = [
-		"/bin/bash",
-		"/usr/bin/bash",
-		"/usr/local/bin/bash"
-	];
-	let found;
-	for (const p of candidates) if (await deps.isFile(p)) {
-		found = p;
-		break;
-	}
-	if (found !== void 0) return {
-		osKind,
-		osArch,
-		osVersion,
-		shellName: "bash",
-		shellPath: found
-	};
-	return {
-		osKind,
-		osArch,
-		osVersion,
-		shellName: "sh",
-		shellPath: "/bin/sh"
-	};
-}
-async function locateWindowsGitBash(deps) {
-	const checked = [];
-	const override = deps.env["BLUN_SHELL_PATH"]?.trim();
-	if (override !== void 0 && override.length > 0) {
-		checked.push(override);
-		if (await deps.isFile(override)) return override;
-	}
-	const gitExecutables = await findExecutablesOnPath("git.exe", deps.env["PATH"], deps.platform, deps.isFile);
-	for (const gitExe of gitExecutables) {
-		const inferred = gitBashCandidatesFromGitExe(gitExe);
-		if (inferred !== void 0) for (const candidate of inferred) {
-			checked.push(candidate);
-			if (await deps.isFile(candidate)) return candidate;
-		}
-		const gitExecPath = await readGitExecPath(deps, gitExe);
-		if (gitExecPath === void 0) continue;
-		for (const candidate of gitBashCandidatesFromGitExecPath(gitExecPath)) {
-			checked.push(candidate);
-			if (await deps.isFile(candidate)) return candidate;
-		}
-	}
-	const candidates = [
-		"C:\\Program Files\\Git\\bin\\bash.exe",
-		"C:\\Program Files\\Git\\usr\\bin\\bash.exe",
-		"C:\\Program Files (x86)\\Git\\bin\\bash.exe",
-		"C:\\Program Files (x86)\\Git\\usr\\bin\\bash.exe"
-	];
-	const localAppData = deps.env["LOCALAPPDATA"]?.trim();
-	if (localAppData !== void 0 && localAppData.length > 0) {
-		candidates.push(`${localAppData}\\Programs\\Git\\bin\\bash.exe`);
-		candidates.push(`${localAppData}\\Programs\\Git\\usr\\bin\\bash.exe`);
-	}
-	for (const candidate of candidates) {
-		checked.push(candidate);
-		if (await deps.isFile(candidate)) return candidate;
-	}
-	throw new KaosShellNotFoundError(`Git Bash was not found on this Windows host. Install Git for Windows from https://gitforwindows.org/ or set BLUN_SHELL_PATH to a bash.exe. Checked: ${checked.join(", ")}.`);
-}
-async function readGitExecPath(deps, gitExe) {
-	if (deps.platform === "win32" && !isAbsoluteWindowsPath(gitExe)) return void 0;
-	const stdout = await deps.execFileText(gitExe, ["--exec-path"], GIT_EXEC_PATH_TIMEOUT_MS);
-	if (stdout === void 0) return void 0;
-	for (const line of stdout.split(/\r?\n/)) {
-		const execPath = line.trim();
-		if (execPath.length > 0) return execPath;
-	}
-}
-function gitBashCandidatesFromGitExe(gitExe) {
-	const normalizedGitExe = path$11.win32.normalize(normalizeWindowsPath(gitExe));
-	const gitDir = path$11.win32.dirname(normalizedGitExe);
-	const gitDirName = path$11.win32.basename(gitDir).toLowerCase();
-	if (gitDirName !== "cmd" && gitDirName !== "bin") return;
-	return gitBashCandidatesFromGitRoot(path$11.win32.dirname(gitDir));
-}
-function gitBashCandidatesFromGitExecPath(execPath) {
-	const normalized = path$11.win32.normalize(normalizeWindowsPath(execPath));
-	const parts = normalized.split("\\");
-	for (let i = parts.length - 1; i >= 0; i -= 1) {
-		const segment = parts[i]?.toLowerCase();
-		if (segment === "mingw32" || segment === "mingw64") {
-			const root = parts.slice(0, i).join("\\");
-			if (root.length > 0) return gitBashCandidatesFromGitRoot(root);
-		}
-	}
-	return gitBashCandidatesFromGitRoot(path$11.win32.join(normalized, "..", ".."));
-}
-function gitBashCandidatesFromGitRoot(root) {
-	return [path$11.win32.normalize(path$11.win32.join(root, "bin", "bash.exe")), path$11.win32.normalize(path$11.win32.join(root, "usr", "bin", "bash.exe"))];
-}
-function normalizeWindowsPath(path) {
-	return path.replaceAll("/", "\\");
-}
-function isAbsoluteWindowsPath(path) {
-	return path$11.win32.isAbsolute(normalizeWindowsPath(path));
-}
-function dedupeWindowsPaths(paths) {
-	const deduped = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const path of paths) {
-		const key = normalizeWindowsPath(path).toLowerCase();
-		if (seen.has(key)) continue;
-		seen.add(key);
-		deduped.push(path);
-	}
-	return deduped;
-}
-/**
-* Production convenience — derive the deps bag from Node's ambient surface.
-*
-* The result is memoised: subsequent calls return the original promise.
-* `Environment` is immutable for the lifetime of the process (it derives
-* from `process.platform`, `process.arch`, `os.release()`, and one-time
-* shell-path discovery), so caching is sound. Tests that need to probe
-* with different inputs should call {@link detectEnvironment} directly
-* with an injected deps bag.
-*/
-let detectedEnvironment;
-function detectEnvironmentFromNode() {
-	if (detectedEnvironment !== void 0) return detectedEnvironment;
-	const platform = process.platform;
-	const env = process.env;
-	const isFile = async (path) => {
-		try {
-			await access(path, constants.F_OK);
-			return true;
-		} catch {
-			return false;
-		}
-	};
-	detectedEnvironment = detectEnvironment({
-		platform,
-		arch: process.arch,
-		release: nodeOs.release(),
-		env,
-		isFile,
-		execFileText
-	});
-	return detectedEnvironment;
-}
-async function findExecutablesOnPath(name, pathEnv, platform, isFile) {
-	if (pathEnv === void 0 || pathEnv.length === 0) return [];
-	const listSep = platform === "win32" ? ";" : ":";
-	const dirSep = platform === "win32" ? "\\" : "/";
-	const paths = [];
-	for (const rawDir of pathEnv.split(listSep)) {
-		const dir = rawDir.trim();
-		if (dir.length === 0) continue;
-		if (platform === "win32" && !isAbsoluteWindowsPath(dir)) continue;
-		const candidate = dir.endsWith(dirSep) ? `${dir}${name}` : `${dir}${dirSep}${name}`;
-		if (await isFile(candidate)) paths.push(candidate);
-	}
-	return platform === "win32" ? dedupeWindowsPaths(paths) : paths;
-}
-async function execFileText(file, args, timeoutMs) {
-	return new Promise((resolve) => {
-		execFile(file, [...args], {
-			encoding: "utf8",
-			timeout: timeoutMs,
-			windowsHide: true
-		}, (error, stdout) => {
-			if (error !== null) {
-				resolve(void 0);
-				return;
-			}
-			resolve(stdout);
-		});
-	});
-}
-//#endregion
-//#region ../../packages/kaos/src/internal.ts
-function isUtf8Continuation(byte) {
-	return byte >= 128 && byte <= 191;
-}
-function decodeUtf8Ignore(data) {
-	let output = "";
-	let i = 0;
-	while (i < data.length) {
-		const b0 = data[i];
-		if (b0 === void 0) break;
-		if (b0 <= 127) {
-			output += String.fromCodePoint(b0);
-			i += 1;
-			continue;
-		}
-		if (b0 >= 194 && b0 <= 223) {
-			const b1 = data[i + 1];
-			if (b1 !== void 0 && isUtf8Continuation(b1)) {
-				output += String.fromCodePoint((b0 & 31) << 6 | b1 & 63);
-				i += 2;
-				continue;
-			}
-			i += 1;
-			continue;
-		}
-		if (b0 >= 224 && b0 <= 239) {
-			const b1 = data[i + 1];
-			const b2 = data[i + 2];
-			if (b1 !== void 0 && (b0 === 224 && b1 >= 160 && b1 <= 191 || b0 >= 225 && b0 <= 236 && isUtf8Continuation(b1) || b0 === 237 && b1 >= 128 && b1 <= 159 || b0 >= 238 && b0 <= 239 && isUtf8Continuation(b1)) && b2 !== void 0 && isUtf8Continuation(b2)) {
-				output += String.fromCodePoint((b0 & 15) << 12 | (b1 & 63) << 6 | b2 & 63);
-				i += 3;
-				continue;
-			}
-			i += 1;
-			continue;
-		}
-		if (b0 >= 240 && b0 <= 244) {
-			const b1 = data[i + 1];
-			const b2 = data[i + 2];
-			const b3 = data[i + 3];
-			if (b1 !== void 0 && (b0 === 240 && b1 >= 144 && b1 <= 191 || b0 >= 241 && b0 <= 243 && isUtf8Continuation(b1) || b0 === 244 && b1 >= 128 && b1 <= 143) && b2 !== void 0 && b3 !== void 0 && isUtf8Continuation(b2) && isUtf8Continuation(b3)) {
-				output += String.fromCodePoint((b0 & 7) << 18 | (b1 & 63) << 12 | (b2 & 63) << 6 | b3 & 63);
-				i += 4;
-				continue;
-			}
-			i += 1;
-			continue;
-		}
-		i += 1;
-	}
-	return output;
-}
-function decodeUtf16LeIgnore(data) {
-	let output = "";
-	let i = 0;
-	while (i + 1 < data.length) {
-		const first = data[i];
-		const second = data[i + 1];
-		if (first === void 0 || second === void 0) break;
-		const codeUnit = first | second << 8;
-		if (codeUnit >= 55296 && codeUnit <= 56319) {
-			const lowFirst = data[i + 2];
-			const lowSecond = data[i + 3];
-			if (lowFirst !== void 0 && lowSecond !== void 0) {
-				const low = lowFirst | lowSecond << 8;
-				if (low >= 56320 && low <= 57343) {
-					const codePoint = 65536 + (codeUnit - 55296 << 10) + (low - 56320);
-					output += String.fromCodePoint(codePoint);
-					i += 4;
-					continue;
-				}
-			}
-			i += 2;
-			continue;
-		}
-		if (codeUnit >= 56320 && codeUnit <= 57343) {
-			i += 2;
-			continue;
-		}
-		output += String.fromCodePoint(codeUnit);
-		i += 2;
-	}
-	return output;
-}
-/**
-* Decode a Buffer into a string with Python-compatible `errors` handling.
-*
-* - `'strict'` (default): throw on invalid sequences (via TextDecoder `fatal: true`)
-* - `'replace'`: substitute each invalid sequence with U+FFFD (TextDecoder default)
-* - `'ignore'`: drop invalid input sequences while preserving valid U+FFFD characters
-*
-* Falls back to `Buffer.toString(encoding)` for encodings TextDecoder does not
-* support (e.g. `hex`, `base64`, `binary`, `latin1`) — those are lossless
-* byte-to-character mappings so `errors` has no effect.
-* @internal
-*/
-function decodeTextWithErrors(data, encoding, errors = "strict", ignoreBOM = false) {
-	let webLabel;
-	switch (encoding) {
-		case "utf-8":
-		case "utf8":
-			webLabel = "utf-8";
-			break;
-		case "utf16le":
-		case "ucs2":
-		case "ucs-2":
-			webLabel = "utf-16le";
-			break;
-		default: webLabel = void 0;
-	}
-	if (webLabel === void 0) return data.toString(encoding);
-	if (errors === "strict") return new TextDecoder(webLabel, {
-		fatal: true,
-		ignoreBOM
-	}).decode(data);
-	if (errors === "ignore") return webLabel === "utf-8" ? decodeUtf8Ignore(data) : decodeUtf16LeIgnore(data);
-	return new TextDecoder(webLabel, {
-		fatal: false,
-		ignoreBOM
-	}).decode(data);
-}
-/**
-* Convert a glob pattern segment (e.g. "*.txt", "file?.log") into a RegExp.
-* Mirrors Python pathlib behavior: includes dotfiles, case-sensitive by default.
-* @internal
-*/
-function globPatternToRegex(pattern, caseSensitive) {
-	let regex = "^";
-	for (let i = 0; i < pattern.length; i++) {
-		const ch = pattern[i];
-		if (ch === void 0) break;
-		switch (ch) {
-			case "*":
-				regex += "[^/]*";
-				break;
-			case "?":
-				regex += "[^/]";
-				break;
-			case "[": {
-				const end = pattern.indexOf("]", i + 1);
-				if (end === -1) regex += "\\[";
-				else {
-					let charClass = pattern.slice(i + 1, end);
-					charClass = charClass.replace(/\\/g, "\\\\");
-					if (charClass.startsWith("!")) charClass = "^" + charClass.slice(1);
-					else if (charClass.startsWith("^")) charClass = "\\" + charClass;
-					regex += "[" + charClass + "]";
-					i = end;
-				}
-				break;
-			}
-			case "\\":
-				if (i + 1 < pattern.length) {
-					const next = pattern.charAt(i + 1);
-					regex += next.replaceAll(/[{}()+.\\[\]^$|]/g, "\\$&");
-					i++;
-				} else regex += "\\\\";
-				break;
-			default: regex += ch.replaceAll(/[{}()+.\\[\]^$|]/g, "\\$&");
-		}
-	}
-	regex += "$";
-	return new RegExp(regex, caseSensitive ? "" : "i");
-}
-/**
-* A Readable wrapper that preserves source backpressure while still allowing
-* consumers to read buffered output after the source has ended.
-* @internal
-*/
-var BufferedReadable = class extends Readable {
-	_source;
-	_ended = false;
-	constructor(source) {
-		super({ highWaterMark: 128 * 1024 });
-		this._source = source;
-		this._source.on("data", this._onData);
-		this._source.on("end", this._onEnd);
-		this._source.on("close", this._onClose);
-		this._source.on("error", this._onError);
-	}
-	_read() {
-		if (!this._ended && !this.destroyed) this._source.resume();
-	}
-	_destroy(error, callback) {
-		this._source.off("data", this._onData);
-		this._source.off("end", this._onEnd);
-		this._source.off("close", this._onClose);
-		this._source.off("error", this._onError);
-		this._source.destroy();
-		callback(error);
-	}
-	_onData = (chunk) => {
-		if (!this.push(chunk)) this._source.pause();
-	};
-	_onEnd = () => {
-		this._ended = true;
-		this.push(null);
-	};
-	_onClose = () => {
-		if (!this._ended) {
-			this._ended = true;
-			this.push(null);
-		}
-	};
-	_onError = (error) => {
-		this.destroy(error);
-	};
-};
-//#endregion
-//#region ../../packages/kaos/src/login-shell-path.ts
-/**
-* Login-shell PATH probe — enrich `process.env.PATH` with entries from the
-* user's login shell.
-*
-* When blun is launched from a context that skipped the user's shell
-* profile (GUI launchers, non-login parent shells), `process.env.PATH`
-* misses entries like `/opt/homebrew/bin`, so commands spawned by the Bash
-* tool can't find tools the user has in their interactive shell (e.g.
-* `gh`). We run the user's login shell once (`$SHELL -l -c /usr/bin/env`),
-* extract its PATH, and append the entries the current PATH lacks. Existing
-* entries keep their order and priority; failures (no resolvable shell,
-* hung or broken profile) silently leave PATH untouched.
-*
-* launchd/daemon launches can leave `$SHELL` unset or blank (see
-* `defaultShell()` in agent-core's terminalService for the same case), so
-* the probe falls back to the OS account's login shell from the user
-* database before giving up.
-*
-* Like `detectEnvironment`, the probe is a pure function of injected deps
-* so the suite runs identically on any host. Windows is skipped: the
-* problem is specific to POSIX login-shell profiles.
-*/
-const LOGIN_SHELL_ENV_TIMEOUT_MS = 5e3;
-/**
-* Run the user's login shell and return its PATH, or `undefined` when the
-* probe does not apply (Windows, no resolvable shell) or fails (spawn
-* error, timeout, no PATH in the output).
-*/
-async function probeLoginShellPath(deps) {
-	if (deps.platform === "win32") return void 0;
-	const envShell = deps.env["SHELL"]?.trim();
-	const shell = envShell === void 0 || envShell.length === 0 ? deps.userShell() : envShell;
-	if (shell === void 0 || shell.length === 0) return void 0;
-	const stdout = await deps.execFileText(shell, [
-		"-l",
-		"-c",
-		"/usr/bin/env"
-	], LOGIN_SHELL_ENV_TIMEOUT_MS);
-	if (stdout === void 0) return void 0;
-	let path;
-	for (const line of stdout.split("\n")) if (line.startsWith("PATH=")) path = line.slice(5).trim();
-	if (path === void 0 || path.length === 0) return void 0;
-	return path;
-}
-/**
-* Union of the current PATH and the login-shell PATH: the current PATH
-* string is kept verbatim — including empty components, which POSIX
-* command lookup treats as the current directory — and login-shell
-* entries the current PATH lacks are appended in their own order. When
-* nothing is missing the current string is returned unchanged. Only
-* absolute login-shell entries are imported: empty, `.`, and relative
-* components are all cwd-dependent lookup, and appending one the user
-* did not already have would widen their search path — LocalKaos runs
-* commands from arbitrary workspace directories.
-*/
-function mergeLoginShellPath(currentPath, loginShellPath) {
-	const current = currentPath ?? "";
-	const seen = new Set(current.split(":").filter((entry) => entry.length > 0));
-	const additions = [];
-	for (const entry of loginShellPath.split(":")) {
-		if (!entry.startsWith("/") || seen.has(entry)) continue;
-		seen.add(entry);
-		additions.push(entry);
-	}
-	if (additions.length === 0) return current;
-	if (currentPath === void 0) return additions.join(":");
-	return `${current}:${additions.join(":")}`;
-}
-/** Probe the login shell and merge its PATH into `deps.env['PATH']`. */
-async function applyLoginShellPath(deps) {
-	const loginShellPath = await probeLoginShellPath(deps);
-	if (loginShellPath === void 0) return;
-	const currentPath = deps.env["PATH"];
-	const merged = mergeLoginShellPath(currentPath, loginShellPath);
-	if (merged === (currentPath ?? "")) return;
-	deps.env["PATH"] = merged;
-}
-/**
-* Production convenience — apply the probe to `process.env` once per
-* process. Memoised like `detectEnvironmentFromNode`: the login-shell PATH
-* does not change for the lifetime of the process, and repeated
-* `LocalKaos.create()` calls must not re-spawn the shell.
-*/
-/**
-* Login shell from the OS user database (`/etc/passwd` via getpwuid on
-* Linux, Directory Services on macOS). `userInfo()` throws when the uid
-* has no database entry (e.g. containers running an arbitrary uid), and
-* service accounts may carry `/usr/sbin/nologin` — the latter needs no
-* special casing here because probing it simply fails and degrades
-* silently.
-*/
-function userShellFromNode() {
-	try {
-		const shell = userInfo().shell;
-		return shell === null || shell.length === 0 ? void 0 : shell;
-	} catch {
-		return;
-	}
-}
-let appliedLoginShellPath;
-function applyLoginShellPathFromNode() {
-	if (appliedLoginShellPath !== void 0) return appliedLoginShellPath;
-	appliedLoginShellPath = applyLoginShellPath({
-		platform: process.platform,
-		env: process.env,
-		userShell: userShellFromNode,
-		execFileText
-	});
-	return appliedLoginShellPath;
-}
-//#endregion
-//#region ../../packages/kaos/src/local.ts
-const isWindows$1 = process.platform === "win32";
-const READ_CHUNK_SIZE = 64 * 1024;
-/**
-* Build the `(dev, ino)` cycle-detection key used by `_globWalk`'s
-* visited set. Returns `null` when `ino` is 0, which Node returns on
-* filesystems that don't carry inodes (Windows FAT/exFAT, some SMB/NFS
-* mounts). A null key signals "no reliable identity for this dir" so
-* the caller skips visited tracking for that descent — cycle safety
-* is weakened on those filesystems, but normal walking works instead
-* of every directory colliding on the shared key `"<dev>:0"`.
-*/
-function cycleKey(s) {
-	if (s.ino === 0) return null;
-	return `${String(s.dev)}:${String(s.ino)}`;
-}
-function buildLocalSpawnOptions(_isWindows, cwd, env) {
-	return {
-		cwd,
-		env,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		],
-		detached: true,
-		windowsHide: true
-	};
-}
-var LocalProcess = class {
-	stdin;
-	stdout;
-	stderr;
-	pid;
-	_child;
-	_exitCode = null;
-	_exitPromise;
-	_disposed = false;
-	constructor(child) {
-		if (child.stdin === null || child.stdout === null || child.stderr === null) throw new Error("Process must be created with stdin/stdout/stderr pipes.");
-		this._child = child;
-		this.stdin = child.stdin;
-		this.stdout = new BufferedReadable(child.stdout);
-		this.stderr = new BufferedReadable(child.stderr);
-		this.pid = child.pid ?? -1;
-		this._exitPromise = new Promise((resolve, reject) => {
-			child.on("exit", (code) => {
-				this._exitCode = code ?? -1;
-				resolve(this._exitCode);
-			});
-			child.on("error", (error) => {
-				reject(error);
-			});
-		});
-	}
-	get exitCode() {
-		return this._exitCode;
-	}
-	async wait() {
-		return this._exitPromise;
-	}
-	kill(signal) {
-		if (this.pid <= 0) return Promise.resolve();
-		if (isWindows$1) {
-			const taskkillArgs = [
-				"/T",
-				"/F",
-				"/PID",
-				String(this.pid)
-			];
-			return new Promise((resolve) => {
-				const killer = spawn("taskkill", taskkillArgs, {
-					stdio: "ignore",
-					windowsHide: true
-				});
-				const done = () => {
-					resolve();
-				};
-				killer.once("error", done);
-				killer.once("close", done);
-			});
-		}
-		try {
-			process.kill(-this.pid, signal ?? "SIGTERM");
-		} catch (error) {
-			const err = error;
-			if (err.code === "ESRCH") return Promise.resolve();
-			if (err.code === "EPERM") {
-				try {
-					this._child.kill(signal ?? "SIGTERM");
-				} catch {}
-				return Promise.resolve();
-			}
-			throw error;
-		}
-		return Promise.resolve();
-	}
-	dispose() {
-		if (this._disposed) return;
-		this._disposed = true;
-		this.stdin.destroy();
-		this.stdout.destroy();
-		this.stderr.destroy();
-	}
-};
-/**
-* A KAOS implementation that directly interacts with the local filesystem.
-*
-* Note: LocalKaos maintains its own per-instance working directory (`_cwd`)
-* rather than mutating `process.cwd()`. This lets multiple LocalKaos instances
-* coexist with independent cwds (e.g. when switching contexts via
-* `runWithKaos`) without cross-polluting each other's relative-path resolution.
-*/
-var LocalKaos = class LocalKaos {
-	name = "local";
-	osEnv;
-	_cwd;
-	_envLayers;
-	constructor(osEnv, cwd, envLayers = []) {
-		this._cwd = normalize$3(cwd ?? process.cwd());
-		this.osEnv = osEnv;
-		this._envLayers = envLayers;
-	}
-	/**
-	* Construct a fresh `LocalKaos` after probing the host environment.
-	*
-	* Each call returns a new instance with its own `_cwd`; concurrent
-	* callers can therefore operate on independent working directories
-	* without polluting one another.
-	*/
-	static async create() {
-		const [osEnv] = await Promise.all([detectEnvironmentFromNode(), applyLoginShellPathFromNode()]);
-		return new LocalKaos(osEnv);
-	}
-	withCwd(cwd) {
-		return new LocalKaos(this.osEnv, cwd, this._envLayers);
-	}
-	withEnv(env) {
-		return new LocalKaos(this.osEnv, this._cwd, [...this._envLayers, env]);
-	}
-	_resolvePath(path) {
-		if (isAbsolute$1(path)) return normalize$3(path);
-		return join$1(this._cwd, path);
-	}
-	pathClass() {
-		return isWindows$1 ? "win32" : "posix";
-	}
-	normpath(path) {
-		return normalize$3(path);
-	}
-	gethome() {
-		return normalize$3(homedir());
-	}
-	getcwd() {
-		return this._cwd;
-	}
-	/**
-	* Change the working directory of this LocalKaos instance.
-	*
-	* Unlike Python's `os.chdir`, this is instance-scoped and never touches
-	* `process.cwd()`. Child processes spawned via {@link exec} inherit this
-	* instance's `_cwd`; concurrent LocalKaos instances each carry their own
-	* independent cwd. If you need Python-compatible process-global cwd,
-	* call `process.chdir(x)` directly.
-	*/
-	async chdir(path) {
-		const resolved = this._resolvePath(path);
-		if (!(await stat(resolved)).isDirectory()) throw new Error(`Not a directory: ${resolved}`);
-		this._cwd = resolved;
-	}
-	async stat(path, options) {
-		const resolved = this._resolvePath(path);
-		const s = options?.followSymlinks ?? true ? await stat(resolved) : await lstat(resolved);
-		return {
-			stMode: s.mode,
-			stIno: s.ino,
-			stDev: s.dev,
-			stNlink: s.nlink,
-			stUid: s.uid,
-			stGid: s.gid,
-			stSize: s.size,
-			stAtime: s.atimeMs / 1e3,
-			stMtime: s.mtimeMs / 1e3,
-			stCtime: isWindows$1 ? s.birthtimeMs / 1e3 : s.ctimeMs / 1e3
-		};
-	}
-	async *iterdir(path) {
-		const resolved = this._resolvePath(path);
-		const entries = await readdir(resolved);
-		for (const entry of entries) yield join$1(resolved, entry);
-	}
-	async *glob(path, pattern, options) {
-		const resolved = this._resolvePath(path);
-		const caseSensitive = options?.caseSensitive ?? true;
-		const patternParts = pattern.split("/");
-		const initVisited = /* @__PURE__ */ new Set();
-		try {
-			const rootKey = cycleKey(await stat(resolved));
-			if (rootKey !== null) initVisited.add(rootKey);
-		} catch {}
-		yield* this._globWalk(resolved, patternParts, caseSensitive, initVisited);
-	}
-	async *_globWalk(basePath, patternParts, caseSensitive, visited) {
-		if (patternParts.length === 0) return;
-		const [currentPattern, ...remainingParts] = patternParts;
-		if (currentPattern === "**") {
-			if (remainingParts.length > 0) yield* this._globWalk(basePath, remainingParts, caseSensitive, visited);
-			else yield basePath;
-			let entries;
-			try {
-				entries = await readdir(basePath);
-			} catch {
-				return;
-			}
-			for (const entry of entries) {
-				const fullPath = join$1(basePath, entry);
-				let entryStat;
-				try {
-					entryStat = await stat(fullPath);
-				} catch {
-					continue;
-				}
-				if (entryStat.isDirectory()) {
-					const key = cycleKey(entryStat);
-					if (key !== null && visited.has(key)) continue;
-					yield* this._globWalk(fullPath, patternParts, caseSensitive, key !== null ? new Set([...visited, key]) : visited);
-				} else if (remainingParts.length === 0) yield fullPath;
-			}
-		} else {
-			const regex = globPatternToRegex(currentPattern ?? "", caseSensitive);
-			let entries;
-			try {
-				entries = await readdir(basePath);
-			} catch {
-				return;
-			}
-			for (const entry of entries) {
-				if (!regex.test(entry)) continue;
-				const fullPath = join$1(basePath, entry);
-				if (remainingParts.length === 0) yield fullPath;
-				else {
-					let entryStat;
-					try {
-						entryStat = await stat(fullPath);
-					} catch {
-						continue;
-					}
-					if (entryStat.isDirectory()) {
-						const key = cycleKey(entryStat);
-						if (key !== null && visited.has(key)) continue;
-						yield* this._globWalk(fullPath, remainingParts, caseSensitive, key !== null ? new Set([...visited, key]) : visited);
-					}
-				}
-			}
-		}
-	}
-	async readBytes(path, n) {
-		const resolved = this._resolvePath(path);
-		if (n === void 0) return Buffer.from(await readFile(resolved));
-		const fh = await open(resolved, "r");
-		try {
-			const buf = Buffer.alloc(n);
-			const { bytesRead } = await fh.read(buf, 0, n, 0);
-			return buf.subarray(0, bytesRead);
-		} finally {
-			await fh.close();
-		}
-	}
-	async readText(path, options) {
-		const resolved = this._resolvePath(path);
-		const encoding = options?.encoding ?? "utf-8";
-		const errors = options?.errors ?? "strict";
-		return decodeTextWithErrors(await readFile(resolved), encoding, errors);
-	}
-	async *readLines(path, options) {
-		const resolved = this._resolvePath(path);
-		const encoding = options?.encoding ?? "utf-8";
-		const errors = options?.errors ?? "strict";
-		if (!isUtf8Encoding(encoding)) {
-			yield* splitLinesKeepingTerminator(decodeTextWithErrors(await readFile(resolved), encoding, errors));
-			return;
-		}
-		yield* this._readUtf8Lines(resolved, errors);
-	}
-	async scanTextFile(path) {
-		const fh = await open(this._resolvePath(path), "r");
-		try {
-			const buf = Buffer.alloc(READ_CHUNK_SIZE);
-			const flags = {
-				hasCrLf: false,
-				hasLf: false,
-				hasLoneCr: false
-			};
-			const validator = createUtf8Validator();
-			let totalLines = 0;
-			let totalBytes = 0;
-			let endsWithNewline = false;
-			let hasNul = false;
-			let prevWasCr = false;
-			while (true) {
-				const { bytesRead } = await fh.read(buf, 0, buf.length, null);
-				if (bytesRead === 0) break;
-				const chunk = buf.subarray(0, bytesRead);
-				validator.write(chunk);
-				for (let i = 0; i < chunk.length; i += 1) {
-					const byte = chunk[i];
-					if (byte === void 0) continue;
-					if (byte === 0) hasNul = true;
-					if (byte === 10) totalLines += 1;
-				}
-				prevWasCr = updateLineEndingFlagsFromBytes(flags, chunk, prevWasCr);
-				totalBytes += bytesRead;
-				endsWithNewline = chunk[bytesRead - 1] === 10;
-			}
-			if (prevWasCr) flags.hasLoneCr = true;
-			validator.end();
-			if (totalBytes > 0 && !endsWithNewline) totalLines += 1;
-			return {
-				totalLines,
-				endsWithNewline,
-				hasNul,
-				lineEndingFlags: flags
-			};
-		} finally {
-			await fh.close();
-		}
-	}
-	async *readLineRange(path, options) {
-		const resolved = this._resolvePath(path);
-		const errors = options.errors ?? "strict";
-		yield* this._readUtf8Lines(resolved, errors, {
-			startLine: options.startLine,
-			maxLines: options.maxLines
-		});
-	}
-	async *readTailLines(path, options) {
-		if (options.tailCount <= 0) return;
-		const resolved = this._resolvePath(path);
-		const errors = options.errors ?? "strict";
-		const fh = await open(resolved, "r");
-		try {
-			const s = await fh.stat();
-			if (s.size === 0) return;
-			let pos = s.size;
-			let foundLf = 0;
-			let startOffset = 0;
-			let needLf = options.tailCount;
-			let sawTailBlock = false;
-			while (pos > 0 && foundLf < needLf) {
-				const readSize = Math.min(READ_CHUNK_SIZE, pos);
-				pos -= readSize;
-				const buf = Buffer.alloc(readSize);
-				await fh.read(buf, 0, readSize, pos);
-				if (!sawTailBlock) {
-					sawTailBlock = true;
-					needLf = buf[readSize - 1] === 10 ? options.tailCount + 1 : options.tailCount;
-				}
-				for (let i = readSize - 1; i >= 0; i -= 1) {
-					if (buf[i] !== 10) continue;
-					foundLf += 1;
-					if (foundLf === needLf) {
-						startOffset = pos + i + 1;
-						break;
-					}
-				}
-			}
-			if (foundLf < needLf) startOffset = 0;
-			yield* splitLinesKeepingTerminator(decodeTextWithErrors(await readRange(fh, startOffset, s.size - startOffset), "utf-8", errors, startOffset !== 0));
-		} finally {
-			await fh.close();
-		}
-	}
-	async *_readUtf8Lines(resolved, errors, range) {
-		const startLine = range?.startLine ?? 1;
-		const maxLines = range?.maxLines ?? Number.POSITIVE_INFINITY;
-		const fh = await open(resolved, "r");
-		try {
-			const buf = Buffer.alloc(READ_CHUNK_SIZE);
-			let pending = [];
-			let pendingOffset = 0;
-			let fileOffset = 0;
-			let lineNo = 1;
-			let yielded = 0;
-			while (true) {
-				const { bytesRead } = await fh.read(buf, 0, buf.length, null);
-				if (bytesRead === 0) break;
-				const chunk = buf.subarray(0, bytesRead);
-				let lineStart = 0;
-				for (let i = 0; i < chunk.length; i += 1) {
-					if (chunk[i] !== 10) continue;
-					const piece = chunk.subarray(lineStart, i + 1);
-					const lineOffset = pending.length === 0 ? fileOffset + lineStart : pendingOffset;
-					const line = pending.length === 0 ? piece : Buffer.concat([...pending, piece]);
-					if (lineNo >= startLine) {
-						yield decodeTextWithErrors(line, "utf-8", errors, lineOffset !== 0);
-						yielded += 1;
-						if (yielded >= maxLines) return;
-					}
-					pending = [];
-					lineStart = i + 1;
-					lineNo += 1;
-				}
-				if (lineStart < chunk.length) {
-					const tail = Buffer.from(chunk.subarray(lineStart));
-					if (pending.length === 0) pendingOffset = fileOffset + lineStart;
-					pending.push(tail);
-				}
-				fileOffset += bytesRead;
-			}
-			if (pending.length > 0) {
-				const line = Buffer.concat(pending);
-				if (lineNo >= startLine) yield decodeTextWithErrors(line, "utf-8", errors, pendingOffset !== 0);
-			}
-		} finally {
-			await fh.close();
-		}
-	}
-	async writeBytes(path, data) {
-		await writeFile(this._resolvePath(path), data);
-		return data.length;
-	}
-	async writeText(path, data, options) {
-		const resolved = this._resolvePath(path);
-		const encoding = options?.encoding ?? "utf-8";
-		if ((options?.mode ?? "w") === "a") await appendFile(resolved, data, encoding);
-		else await writeFile(resolved, data, encoding);
-		return data.length;
-	}
-	async mkdir(path, options) {
-		const resolved = this._resolvePath(path);
-		const parents = options?.parents ?? false;
-		const existOk = options?.existOk ?? false;
-		if (parents) {
-			if (!existOk) try {
-				if ((await stat(resolved)).isDirectory()) throw new KaosFileExistsError(`${resolved} already exists`);
-			} catch (error) {
-				if (error instanceof KaosFileExistsError) throw error;
-				if (error.code !== "ENOENT") throw error;
-			}
-			await mkdir(resolved, { recursive: true });
-			return;
-		}
-		try {
-			await mkdir(resolved);
-		} catch (error) {
-			if (existOk && error instanceof Error && "code" in error && error.code === "EEXIST") {
-				if (!(await stat(resolved)).isDirectory()) throw new KaosFileExistsError(`${resolved} already exists but is not a directory`);
-				return;
-			}
-			throw error;
-		}
-	}
-	async exec(...args) {
-		const command = args[0];
-		if (command === void 0) throw new Error("LocalKaos.exec(): at least one argument (the command to run) is required.");
-		const child = spawn(command, args.slice(1), buildLocalSpawnOptions(isWindows$1, this._cwd, this._buildExecEnv()));
-		await waitForSpawn(child);
-		return new LocalProcess(child);
-	}
-	async execWithEnv(args, env) {
-		const command = args[0];
-		if (command === void 0) throw new Error("LocalKaos.execWithEnv(): at least one argument (the command to run) is required.");
-		const child = spawn(command, args.slice(1), buildLocalSpawnOptions(isWindows$1, this._cwd, this._buildExecEnv(env)));
-		await waitForSpawn(child);
-		return new LocalProcess(child);
-	}
-	_buildExecEnv(invocationEnv) {
-		if (this._envLayers.length === 0) return invocationEnv;
-		const merged = {
-			...process.env,
-			...invocationEnv
-		};
-		for (const layer of this._envLayers) Object.assign(merged, layer);
-		return merged;
-	}
-};
-function isUtf8Encoding(encoding) {
-	return encoding === "utf-8" || encoding === "utf8";
-}
-function* splitLinesKeepingTerminator(text) {
-	if (text.length === 0) return;
-	let start = 0;
-	for (let i = 0; i < text.length; i += 1) if (text.codePointAt(i) === 10) {
-		yield text.slice(start, i + 1);
-		start = i + 1;
-	}
-	if (start < text.length) yield text.slice(start);
-}
-function updateLineEndingFlagsFromBytes(flags, chunk, prevWasCr) {
-	for (let i = 0; i < chunk.length; i += 1) {
-		const byte = chunk[i];
-		if (byte === void 0) continue;
-		if (byte === 13) {
-			if (prevWasCr) flags.hasLoneCr = true;
-			prevWasCr = true;
-		} else if (byte === 10) {
-			if (prevWasCr) flags.hasCrLf = true;
-			else flags.hasLf = true;
-			prevWasCr = false;
-		} else {
-			if (prevWasCr) flags.hasLoneCr = true;
-			prevWasCr = false;
-		}
-	}
-	return prevWasCr;
-}
-function createUtf8Validator() {
-	let needed = 0;
-	let lower = 128;
-	let upper = 191;
-	const fail = () => {
-		throw new TypeError("Invalid UTF-8 data");
-	};
-	return {
-		write(chunk) {
-			for (let i = 0; i < chunk.length; i += 1) {
-				const byte = chunk[i];
-				if (byte === void 0) continue;
-				if (needed === 0) {
-					if (byte <= 127) continue;
-					if (byte >= 194 && byte <= 223) needed = 1;
-					else if (byte === 224) {
-						needed = 2;
-						lower = 160;
-					} else if (byte >= 225 && byte <= 236) needed = 2;
-					else if (byte === 237) {
-						needed = 2;
-						upper = 159;
-					} else if (byte >= 238 && byte <= 239) needed = 2;
-					else if (byte === 240) {
-						needed = 3;
-						lower = 144;
-					} else if (byte >= 241 && byte <= 243) needed = 3;
-					else if (byte === 244) {
-						needed = 3;
-						upper = 143;
-					} else fail();
-				} else {
-					if (byte < lower || byte > upper) fail();
-					lower = 128;
-					upper = 191;
-					needed -= 1;
-				}
-			}
-		},
-		end() {
-			if (needed !== 0) fail();
-		}
-	};
-}
-async function readRange(fh, start, length) {
-	const data = Buffer.alloc(length);
-	let offset = 0;
-	while (offset < length) {
-		const { bytesRead } = await fh.read(data, offset, length - offset, start + offset);
-		if (bytesRead === 0) break;
-		offset += bytesRead;
-	}
-	return offset === length ? data : data.subarray(0, offset);
-}
-function waitForSpawn(child) {
-	return new Promise((resolve, reject) => {
-		const onSpawn = () => {
-			child.off("error", onError);
-			resolve();
-		};
-		const onError = (err) => {
-			child.off("spawn", onSpawn);
-			reject(err);
-		};
-		child.once("spawn", onSpawn);
-		child.once("error", onError);
-	});
-}
-new AsyncLocalStorage();
-//#endregion
 //#region ../../packages/agent-core/src/agent/replay/build.ts
 async function buildReplay(persistence, range) {
 	const agent = new Agent$1({