cascade-ai 0.20.0 → 0.20.2

package/dist/index.js

@@ -1,9 +1,9 @@
 import Database from 'better-sqlite3';
-import path21 from 'path';
-import fs20 from 'fs';
+import path24 from 'path';
+import fs23 from 'fs';
 import os6 from 'os';
-import crypto3, { randomUUID, timingSafeEqual } from 'crypto';
-import EventEmitter from 'events';
+import crypto4, { randomUUID, randomBytes, createHash, timingSafeEqual, webcrypto } from 'crypto';
+import EventEmitter, { setMaxListeners } from 'events';
 import { glob } from 'glob';
 import Anthropic from '@anthropic-ai/sdk';
 import OpenAI, { AzureOpenAI } from 'openai';
@@ -24,6 +24,9 @@ import dns2 from 'dns/promises';
 import net from 'net';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';
+import { auth, discoverOAuthProtectedResourceMetadata, discoverAuthorizationServerMetadata, refreshAuthorization, UnauthorizedError } from '@modelcontextprotocol/sdk/client/auth.js';
 import { z } from 'zod';
 import { Worker } from 'worker_threads';
 import { fileURLToPath } from 'url';
@@ -58,12 +61,12 @@ var init_audit_logger = __esm({
       constructor(workspacePath, debugMode = false) {
         this.workspacePath = workspacePath;
         this.debugMode = debugMode;
-        const cascadeDir = path21.join(workspacePath, ".cascade");
-        if (!fs20.existsSync(cascadeDir)) {
-          fs20.mkdirSync(cascadeDir, { recursive: true });
+        const cascadeDir = path24.join(workspacePath, ".cascade");
+        if (!fs23.existsSync(cascadeDir)) {
+          fs23.mkdirSync(cascadeDir, { recursive: true });
         }
-        this.keyPath = path21.join(cascadeDir, "audit_log.key");
-        this.dbPath = path21.join(cascadeDir, "audit_log.db");
+        this.keyPath = path24.join(cascadeDir, "audit_log.key");
+        this.dbPath = path24.join(cascadeDir, "audit_log.db");
         this.initEncryptionKey();
         this.db = new Database(this.dbPath);
         this.db.pragma("journal_mode = WAL");
@@ -90,19 +93,19 @@ var init_audit_logger = __esm({
       encryptionKey;
       /** SHA-256 link over everything that identifies an entry, chained to the previous entry's hash. */
       chainHash(prevHash, timestamp, eventType, tierId, encryptedPayload) {
-        return crypto3.createHash("sha256").update(`${prevHash}|${timestamp}|${eventType}|${tierId}|${encryptedPayload}`).digest("hex");
+        return crypto4.createHash("sha256").update(`${prevHash}|${timestamp}|${eventType}|${tierId}|${encryptedPayload}`).digest("hex");
       }
       initEncryptionKey() {
-        if (fs20.existsSync(this.keyPath)) {
-          this.encryptionKey = fs20.readFileSync(this.keyPath);
+        if (fs23.existsSync(this.keyPath)) {
+          this.encryptionKey = fs23.readFileSync(this.keyPath);
         } else {
-          this.encryptionKey = crypto3.randomBytes(32);
-          fs20.writeFileSync(this.keyPath, this.encryptionKey);
+          this.encryptionKey = crypto4.randomBytes(32);
+          fs23.writeFileSync(this.keyPath, this.encryptionKey);
         }
       }
       encrypt(text) {
-        const iv = crypto3.randomBytes(16);
-        const cipher = crypto3.createCipheriv("aes-256-gcm", this.encryptionKey, iv);
+        const iv = crypto4.randomBytes(16);
+        const cipher = crypto4.createCipheriv("aes-256-gcm", this.encryptionKey, iv);
         let encrypted = cipher.update(text, "utf8", "hex");
         encrypted += cipher.final("hex");
         const authTag = cipher.getAuthTag().toString("hex");
@@ -114,14 +117,14 @@ var init_audit_logger = __esm({
         const [ivHex, authTagHex, encryptedHex] = parts;
         const iv = Buffer.from(ivHex, "hex");
         const authTag = Buffer.from(authTagHex, "hex");
-        const decipher = crypto3.createDecipheriv("aes-256-gcm", this.encryptionKey, iv);
+        const decipher = crypto4.createDecipheriv("aes-256-gcm", this.encryptionKey, iv);
         decipher.setAuthTag(authTag);
         let decrypted = decipher.update(encryptedHex, "hex", "utf8");
         decrypted += decipher.final("utf8");
         return decrypted;
       }
       logEvent(eventType, tierId, payloadObj) {
-        const id = crypto3.randomUUID();
+        const id = crypto4.randomUUID();
         const timestamp = (/* @__PURE__ */ new Date()).toISOString();
         const payload = JSON.stringify(payloadObj);
         const encryptedPayload = this.encrypt(payload);
@@ -175,9 +178,9 @@ var init_audit_logger = __esm({
       dumpDebugIfNeeded() {
         if (!this.debugMode) return;
         try {
-          const dumpPath = path21.join(os6.tmpdir(), "cascade_audit_logs_debug.json");
+          const dumpPath = path24.join(os6.tmpdir(), "cascade_audit_logs_debug.json");
           const entries = this.getAllLogs();
-          fs20.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+          fs23.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
         } catch (err) {
           console.error("Failed to dump debug audit logs", err);
         }
@@ -190,7 +193,7 @@ var init_audit_logger = __esm({
 });
 
 // src/constants.ts
-var CASCADE_VERSION = "0.20.0";
+var CASCADE_VERSION = "0.20.2";
 var CASCADE_CONFIG_DIR = ".cascade";
 var CASCADE_MD_FILE = "CASCADE.md";
 var CASCADE_IGNORE_FILE = ".cascadeignore";
@@ -345,6 +348,82 @@ var MODELS = {
     supportsStreaming: true,
     isLocal: false
   },
+  // GPT-5 family (offline baseline pricing; the live fetch keeps it current).
+  "gpt-5": {
+    id: "gpt-5",
+    name: "GPT-5",
+    provider: "openai",
+    contextWindow: 4e5,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 125e-5,
+    outputCostPer1kTokens: 0.01,
+    maxOutputTokens: 128e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gpt-5-mini": {
+    id: "gpt-5-mini",
+    name: "GPT-5 Mini",
+    provider: "openai",
+    contextWindow: 4e5,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 25e-5,
+    outputCostPer1kTokens: 2e-3,
+    maxOutputTokens: 128e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gpt-5-nano": {
+    id: "gpt-5-nano",
+    name: "GPT-5 Nano",
+    provider: "openai",
+    contextWindow: 4e5,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 5e-5,
+    outputCostPer1kTokens: 4e-4,
+    maxOutputTokens: 128e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  // GPT-5 point releases — genuinely distinct capability, so they route as their
+  // own families (not folded into gpt-5). Offline baseline pricing; live fetch
+  // keeps it current. gpt-5.5 "Spud" (Apr 2026) is the current SWE-bench leader.
+  "gpt-5.5": {
+    id: "gpt-5.5",
+    name: "GPT-5.5",
+    provider: "openai",
+    contextWindow: 4e5,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 25e-4,
+    outputCostPer1kTokens: 0.02,
+    maxOutputTokens: 128e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gpt-5.4": {
+    id: "gpt-5.4",
+    name: "GPT-5.4",
+    provider: "openai",
+    contextWindow: 4e5,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 125e-5,
+    outputCostPer1kTokens: 0.01,
+    maxOutputTokens: 128e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gpt-5.4-mini": {
+    id: "gpt-5.4-mini",
+    name: "GPT-5.4 Mini",
+    provider: "openai",
+    contextWindow: 4e5,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 25e-5,
+    outputCostPer1kTokens: 2e-3,
+    maxOutputTokens: 128e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
   // Google
   "gemini-2.0-flash": {
     id: "gemini-2.0-flash",
@@ -464,6 +543,9 @@ for (const _m of Object.values(MODELS)) {
   if (_m.supportsToolUse === void 0) _m.supportsToolUse = !_m.isLocal;
 }
 var T1_MODEL_PRIORITY = [
+  "gpt-5.5",
+  "gpt-5.4",
+  "gpt-5",
   "claude-opus-4",
   "claude-sonnet-4",
   "gemini-2.5-pro",
@@ -472,6 +554,8 @@ var T1_MODEL_PRIORITY = [
   "gemini-1.5-pro"
 ];
 var T2_MODEL_PRIORITY = [
+  "gpt-5.4-mini",
+  "gpt-5-mini",
   "claude-sonnet-4",
   "claude-haiku-4-5",
   "claude-haiku-3-5",
@@ -482,6 +566,7 @@ var T2_MODEL_PRIORITY = [
   "llama3:70b"
 ];
 var T3_MODEL_PRIORITY = [
+  "gpt-5-nano",
   "llama3.2:3b",
   "mistral:7b",
   "claude-haiku-4-5",
@@ -788,10 +873,23 @@ var AnthropicProvider = class extends BaseProvider {
     return result;
   }
 };
+function isReasoningModel(id) {
+  const m = (id || "").toLowerCase();
+  return /(^o[1345]\b)|(^o[1345]-)|gpt-?5/.test(m);
+}
+function isParamShapeError(err) {
+  const e = err;
+  const msg = String(e?.message ?? e?.error?.message ?? "").toLowerCase();
+  return msg.includes("max_completion_tokens") || msg.includes("max_tokens") && (msg.includes("unsupported") || msg.includes("not supported") || msg.includes("use")) || msg.includes("temperature") && (msg.includes("unsupported") || msg.includes("does not support") || msg.includes("only the default"));
+}
 var OpenAIProvider = class extends BaseProvider {
   client;
+  /** Once we learn (from the model id or an API error) that this deployment
+   *  needs max_completion_tokens, remember it so we don't re-fail every call. */
+  useMaxCompletionTokens;
   constructor(config, model) {
     super(config, model);
+    this.useMaxCompletionTokens = isReasoningModel(model.id);
     this.client = new OpenAI({
       apiKey: config.apiKey,
       baseURL: config.baseUrl
@@ -815,27 +913,23 @@ var OpenAIProvider = class extends BaseProvider {
     let inputTokens = 0;
     let outputTokens = 0;
     let finishReason = "stop";
-    const params = {
+    const budget = options.maxTokens ?? this.model.maxOutputTokens;
+    const buildParams = (useCompletionTokens) => ({
       model: this.model.id,
       messages,
-      max_tokens: options.maxTokens ?? this.model.maxOutputTokens,
-      temperature: options.temperature ?? 0.7,
+      ...useCompletionTokens ? { max_completion_tokens: budget } : { max_tokens: budget },
+      ...useCompletionTokens ? {} : { temperature: options.temperature ?? 0.7 },
       tools: tools?.length ? tools : void 0,
       stream: true,
       stream_options: { include_usage: true }
-    };
+    });
     let stream;
     try {
-      stream = await this.client.chat.completions.create(params, { signal: options.signal });
+      stream = await this.client.chat.completions.create(buildParams(this.useMaxCompletionTokens), { signal: options.signal });
     } catch (err) {
-      if (err.message && err.message.includes("max_completion_tokens")) {
-        const fallbackParams = { ...params };
-        delete fallbackParams.max_tokens;
-        fallbackParams.max_completion_tokens = options.maxTokens ?? this.model.maxOutputTokens;
-        if (this.model.id.includes("o1") || this.model.id.includes("o3")) {
-          fallbackParams.temperature = 1;
-        }
-        stream = await this.client.chat.completions.create(fallbackParams, { signal: options.signal });
+      if (!this.useMaxCompletionTokens && isParamShapeError(err)) {
+        this.useMaxCompletionTokens = true;
+        stream = await this.client.chat.completions.create(buildParams(true), { signal: options.signal });
       } else {
         throw err;
       }
@@ -993,13 +1087,48 @@ var OpenAIProvider = class extends BaseProvider {
 };
 
 // src/providers/azure.ts
+var DEFAULT_AZURE_API_VERSION = "2024-12-01-preview";
+function inferAzureBaseModel(deploymentName) {
+  const n = deploymentName.toLowerCase();
+  const rules = [
+    [/gpt-?5\.5/, "gpt-5.5"],
+    [/gpt-?5\.4.*mini/, "gpt-5.4-mini"],
+    [/gpt-?5\.4/, "gpt-5.4"],
+    [/gpt-?5.*nano/, "gpt-5-nano"],
+    [/gpt-?5.*mini/, "gpt-5-mini"],
+    [/gpt-?5/, "gpt-5"],
+    [/gpt-?4\.1-nano/, "gpt-4.1-nano"],
+    [/gpt-?4\.1-mini/, "gpt-4.1-mini"],
+    [/gpt-?4\.1/, "gpt-4.1"],
+    [/gpt-?4o-mini/, "gpt-4o-mini"],
+    [/gpt-?4o/, "gpt-4o"]
+  ];
+  for (const [re, base] of rules) if (re.test(n)) return base;
+  return null;
+}
 function azureModelForDeployment(cfg) {
   if (cfg.type !== "azure" || !cfg.deploymentName?.trim()) return null;
   const id = cfg.deploymentName.trim();
+  const name = cfg.label?.trim() || id;
+  const baseModelId = cfg.model?.trim() || inferAzureBaseModel(id) || void 0;
+  const base = baseModelId ? MODELS[baseModelId] : void 0;
+  if (base) {
+    return {
+      ...base,
+      id,
+      // callable deployment name
+      name,
+      provider: "azure",
+      baseModelId,
+      // real identity for benchmark + live pricing
+      supportsToolUse: base.supportsToolUse ?? true
+    };
+  }
   return {
     id,
-    name: cfg.label?.trim() || id,
+    name,
     provider: "azure",
+    ...baseModelId ? { baseModelId } : {},
     contextWindow: 128e3,
     isVisionCapable: false,
     inputCostPer1kTokens: 25e-4,
@@ -1026,7 +1155,7 @@ var AzureOpenAIProvider = class extends OpenAIProvider {
       apiKey: config.apiKey,
       endpoint,
       deployment: config.deploymentName ?? model.id,
-      apiVersion: config.apiVersion ?? "2024-08-01-preview"
+      apiVersion: config.apiVersion ?? DEFAULT_AZURE_API_VERSION
     });
   }
   async listModels() {
@@ -1034,25 +1163,22 @@ var AzureOpenAIProvider = class extends OpenAIProvider {
     return [fromDeployment ?? this.model];
   }
   async isAvailable() {
-    const params = {
+    const ping = (extra) => this.client.chat.completions.create({
       model: this.model.id,
       messages: [{ role: "user", content: "ping" }],
-      max_tokens: 1
-    };
+      ...extra
+    });
+    const reasoning = isReasoningModel(this.model.id);
     try {
-      await this.client.chat.completions.create(params);
+      await ping(reasoning ? { max_completion_tokens: 16 } : { max_tokens: 1 });
       return true;
     } catch (err) {
-      if (err?.message && String(err.message).includes("max_completion_tokens")) {
+      if (isParamShapeError(err)) {
         try {
-          await this.client.chat.completions.create({
-            model: this.model.id,
-            messages: [{ role: "user", content: "ping" }],
-            max_completion_tokens: 1
-          });
+          await ping({ max_completion_tokens: 16 });
           return true;
-        } catch {
-          return false;
+        } catch (err2) {
+          return isParamShapeError(err2);
         }
       }
       return false;
@@ -1090,14 +1216,14 @@ var GeminiProvider = class extends BaseProvider {
     const toolCalls = [];
     let finishReason = "stop";
     for await (const chunk of stream) {
-      const text = chunk.text ?? "";
-      if (text) {
-        fullContent += text;
-        onChunk({ text, finishReason: null });
-      }
       const candidates = chunk.candidates ?? [];
       for (const candidate of candidates) {
         for (const part of candidate?.content?.parts ?? []) {
+          if (part.thought) continue;
+          if (typeof part.text === "string" && part.text) {
+            fullContent += part.text;
+            onChunk({ text: part.text, finishReason: null });
+          }
           if (part.functionCall) {
             toolCalls.push({
               id: part.functionCall.name,
@@ -1657,9 +1783,20 @@ var OpenAICompatibleProvider = class extends OpenAIProvider {
 };
 
 // src/core/router/selector.ts
+function normalizeModelId(id) {
+  return id.replace(/^models\//, "").toLowerCase();
+}
 var ModelSelector = class {
   availableProviders;
   availableModels;
+  /**
+   * Per-provider set of model ids the provider's own API confirmed it serves
+   * (from listModels discovery). When present for a provider, AUTO selection
+   * skips that provider's bundled catalog ids that aren't in the set — so a
+   * stale/access-gated catalog id is never picked, then 404'd, then failed over.
+   * Absent for a provider ⇒ no validation ran ⇒ behave exactly as before.
+   */
+  validatedIds = /* @__PURE__ */ new Map();
   constructor(availableProviders) {
     this.availableProviders = availableProviders;
     this.availableModels = new Map(Object.entries(MODELS));
@@ -1667,6 +1804,20 @@ var ModelSelector = class {
   addDynamicModel(model) {
     this.availableModels.set(model.id, model);
   }
+  /** Record the ids a provider's API actually serves (discovery). Empty ⇒ ignored. */
+  setValidatedModels(provider, ids) {
+    if (!ids.length) return;
+    this.validatedIds.set(provider, new Set(ids.map(normalizeModelId)));
+  }
+  /**
+   * A model is usable for AUTO selection when its provider is available AND —
+   * if that provider was validated — the id is one the provider confirmed.
+   */
+  isUsable(model) {
+    if (!this.availableProviders.has(model.provider)) return false;
+    const valid = this.validatedIds.get(model.provider);
+    return !valid || valid.has(normalizeModelId(model.id));
+  }
   /**
    * Permanently drop a model from the available set for this session. Used by
    * the router's 404 / "model not found" self-heal so a dead id is never
@@ -1704,10 +1855,10 @@ var ModelSelector = class {
     const priority = this.getPriorityList(tier);
     for (const key of priority) {
       const model = this.availableModels.get(key);
-      if (model && this.availableProviders.has(model.provider)) return model;
+      if (model && this.isUsable(model)) return model;
     }
     for (const [, model] of this.availableModels) {
-      if (this.availableProviders.has(model.provider)) return model;
+      if (this.isUsable(model)) return model;
     }
     return null;
   }
@@ -1727,7 +1878,7 @@ var ModelSelector = class {
     for (let i = currentIdx + 1; i < priority.length; i++) {
       const key = priority[i];
       const model = this.availableModels.get(key);
-      if (model && this.availableProviders.has(model.provider)) return model;
+      if (model && this.isUsable(model)) return model;
     }
     return null;
   }
@@ -1755,7 +1906,7 @@ var ModelSelector = class {
     const candidates = [];
     for (const key of priority) {
       const model = this.availableModels.get(key);
-      if (model && this.availableProviders.has(model.provider)) {
+      if (model && this.isUsable(model)) {
         candidates.push(model);
       }
     }
@@ -2200,8 +2351,8 @@ function computeDelegationSavings(stats, t1Model) {
 var DEFAULT_SNAPSHOT_URL = "https://raw.githubusercontent.com/Varun-SV/Cascade-AI/main/src/core/router/benchmark-data.json";
 var OPENROUTER_MODELS_URL = "https://openrouter.ai/api/v1/models";
 var FETCH_TIMEOUT_MS = 8e3;
-var DEFAULT_CACHE_FILE = path21.join(os6.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
-function normalizeModelId(id) {
+var DEFAULT_CACHE_FILE = path24.join(os6.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
+function normalizeModelId2(id) {
   let s = id.toLowerCase();
   const slash = s.lastIndexOf("/");
   if (slash !== -1) s = s.slice(slash + 1);
@@ -2318,7 +2469,7 @@ var LiveDataProvider = class {
       const capabilities = /* @__PURE__ */ new Map();
       for (const m of data.data) {
         if (!m?.id) continue;
-        const key = normalizeModelId(m.id);
+        const key = normalizeModelId2(m.id);
         if (m.pricing) {
           const input = Number(m.pricing.prompt) * 1e3;
           const output = Number(m.pricing.completion) * 1e3;
@@ -2345,7 +2496,7 @@ var LiveDataProvider = class {
   }
   async saveCache() {
     try {
-      await fs4.mkdir(path21.dirname(this.opts.cacheFile), { recursive: true });
+      await fs4.mkdir(path24.dirname(this.opts.cacheFile), { recursive: true });
       const cache = {
         fetchedAt: this.fetchedAt,
         snapshot: this.snapshot ?? void 0,
@@ -2362,7 +2513,7 @@ var LiveDataProvider = class {
   }
   /** Current per-1k price for a model id, or null when unknown. */
   getLivePrice(modelId) {
-    return this.prices.get(normalizeModelId(modelId)) ?? null;
+    return this.prices.get(normalizeModelId2(modelId)) ?? null;
   }
   /**
    * Returns a price-corrected copy of each model when live pricing is known,
@@ -2370,14 +2521,14 @@ var LiveDataProvider = class {
    */
   applyLivePricing(models) {
     return models.map((m) => {
-      const p = this.getLivePrice(m.id);
+      const p = this.getLivePrice(m.baseModelId ?? m.id);
       if (!p) return m;
       return { ...m, inputCostPer1kTokens: p.input, outputCostPer1kTokens: p.output };
     });
   }
   /** Current capability facts for a model id, or null when unknown. */
   getCapability(modelId) {
-    return this.capabilities.get(normalizeModelId(modelId)) ?? null;
+    return this.capabilities.get(normalizeModelId2(modelId)) ?? null;
   }
   /**
    * Returns capability-corrected copies of each model (originals untouched):
@@ -2387,7 +2538,7 @@ var LiveDataProvider = class {
    */
   applyLiveCapabilities(models) {
     return models.map((m) => {
-      const c = this.getCapability(m.id);
+      const c = this.getCapability(m.baseModelId ?? m.id);
       if (!c) return m;
       const next = { ...m };
       if (c.contextWindow) next.contextWindow = c.contextWindow;
@@ -2421,6 +2572,15 @@ var FAMILY_BENCHMARKS = {
   "claude-opus": { code: 95, analysis: 92, creative: 90, data: 88 },
   "claude-sonnet": { code: 93, analysis: 88, creative: 87, data: 85 },
   "claude-haiku": { code: 80, analysis: 75, creative: 76, data: 72 },
+  // OpenAI GPT-5 family — current flagship; strongest all-round. Offline
+  // baseline (the live fetch refreshes these). Distinct point releases carry
+  // their own scores: gpt-5.5 "Spud" leads SWE-bench (88.7%); gpt-5.4 ~80%.
+  "gpt-5.5": { code: 97, analysis: 96, creative: 94, data: 95 },
+  "gpt-5.4": { code: 94, analysis: 94, creative: 92, data: 92 },
+  "gpt-5.4-mini": { code: 86, analysis: 85, creative: 85, data: 83 },
+  "gpt-5": { code: 96, analysis: 95, creative: 93, data: 93 },
+  "gpt-5-mini": { code: 88, analysis: 86, creative: 86, data: 84 },
+  "gpt-5-nano": { code: 78, analysis: 75, creative: 78, data: 73 },
   // OpenAI — strong all-round, particularly creative/writing.
   "gpt-4.1": { code: 90, analysis: 89, creative: 91, data: 87 },
   "gpt-4.1-mini": { code: 82, analysis: 80, creative: 83, data: 79 },
@@ -2447,6 +2607,15 @@ var FAMILY_MATCHERS = [
   [/opus/i, "claude-opus"],
   [/sonnet/i, "claude-sonnet"],
   [/haiku/i, "claude-haiku"],
+  // GPT-5 family — ordered most-specific first. Distinct point releases
+  // (gpt-5.5, gpt-5.4, gpt-5.4-mini) match their own family; nano/mini before
+  // the base; unrecognised gpt-5.x still fold into the gpt-5 base.
+  [/gpt-?5\.5/i, "gpt-5.5"],
+  [/gpt-?5\.4.*mini/i, "gpt-5.4-mini"],
+  [/gpt-?5\.4/i, "gpt-5.4"],
+  [/gpt-?5.*nano/i, "gpt-5-nano"],
+  [/gpt-?5.*mini/i, "gpt-5-mini"],
+  [/gpt-?5/i, "gpt-5"],
   [/gpt-?4\.1-nano/i, "gpt-4.1-nano"],
   [/gpt-?4\.1-mini/i, "gpt-4.1-mini"],
   [/gpt-?4\.1/i, "gpt-4.1"],
@@ -2466,7 +2635,7 @@ var FAMILY_MATCHERS = [
   [/gemma/i, "gemma"]
 ];
 function resolveFamily(model) {
-  const hay = `${model.id} ${model.name}`;
+  const hay = `${model.baseModelId ?? ""} ${model.id} ${model.name}`;
   for (const [re, fam] of FAMILY_MATCHERS) {
     if (re.test(hay)) return fam;
   }
@@ -2488,6 +2657,50 @@ function benchmarkScore01(model, taskType) {
 }
 
 // src/core/router/index.ts
+function inferModelCapability(id) {
+  const s = (id || "").toLowerCase();
+  let score = 0;
+  if (/\b(mini|nano|small|lite|flash|instant|tiny|micro|0\.5b|1b|1\.5b|3b|7b|8b)\b/.test(s)) score -= 30;
+  else if (/\b(pro|max|opus|ultra|large|xl|xxl|70b|405b|405)\b/.test(s)) score += 30;
+  const m = s.match(/(\d{1,3})(?:\.(\d))?/);
+  if (m) {
+    let major = parseInt(m[1], 10);
+    let minor = m[2] ? parseInt(m[2], 10) : 0;
+    if (major >= 30 && major < 100) {
+      minor = major % 10;
+      major = Math.floor(major / 10);
+    }
+    score += major + minor / 10;
+  }
+  return score;
+}
+function azureModelForTier(tier, ranked) {
+  if (ranked.length === 0) return void 0;
+  if (tier === "T1") return ranked[0];
+  if (tier === "T3") return ranked[ranked.length - 1];
+  return ranked[Math.min(1, ranked.length - 1)];
+}
+var DISCOVERY_TTL_MS = 15 * 60 * 1e3;
+var DISCOVERY_TIMEOUT_MS = 4e3;
+var cloudDiscoveryCache = /* @__PURE__ */ new Map();
+function discoveryCacheKey(type, cfg) {
+  const raw = `${type}|${cfg.apiKey ?? ""}|${cfg.baseUrl ?? ""}`;
+  return crypto4.createHash("sha256").update(raw).digest("hex").slice(0, 24);
+}
+function applyTierLimits(options, tier, limits) {
+  if (!limits) return options;
+  const key = tier.toLowerCase();
+  const maxTokens = limits[`${key}MaxTokens`];
+  const temperature = limits[`${key}Temperature`];
+  let next = options;
+  if (typeof maxTokens === "number" && maxTokens > 0 && (!next.maxTokens || next.maxTokens > maxTokens)) {
+    next = { ...next, maxTokens };
+  }
+  if (typeof temperature === "number" && next.temperature === void 0) {
+    next = { ...next, temperature };
+  }
+  return next;
+}
 var CascadeRouter = class _CascadeRouter extends EventEmitter {
   selector;
   failover;
@@ -2557,12 +2770,12 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
       const results = await Promise.all(ocConfigs.map((cfg) => this.discoverOpenAICompatibleModels(cfg)));
       if (results.some(Boolean)) this.selector.markProviderAvailable("openai-compatible");
     }
-    if (availableProviders.has("azure")) {
-      for (const cfg of config.providers) {
-        const model = azureModelForDeployment(cfg);
-        if (model) this.selector.addDynamicModel(model);
-      }
+    const azureDeployments = config.providers.map((cfg) => azureModelForDeployment(cfg)).filter((m) => m !== null);
+    if (azureDeployments.length > 0) {
+      for (const model of azureDeployments) this.selector.addDynamicModel(model);
+      availableProviders.add("azure");
     }
+    await this.validateCloudProviderModels(config);
     for (const tier of ["T1", "T2", "T3"]) {
       const override = tier === "T1" ? config.models.t1 : tier === "T2" ? config.models.t2 : config.models.t3;
       if (!override || override === "auto") continue;
@@ -2583,9 +2796,10 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
       this.tierModels.set(tier, model);
       this.ensureProvider(model, config.providers);
     }
+    const azureRanked = [...azureDeployments].sort((a, b) => inferModelCapability(b.id) - inferModelCapability(a.id));
     for (const tier of ["T1", "T2", "T3"]) {
       if (this.tierModels.has(tier)) continue;
-      const model = this.selector.selectForTier(tier);
+      const model = this.selector.getCandidatesForTier(tier)[0] ?? (azureRanked.length ? azureModelForTier(tier, azureRanked) : void 0) ?? this.selector.selectForTier(tier);
       if (model) {
         this.tierModels.set(tier, model);
         this.ensureProvider(model, config.providers);
@@ -2667,7 +2881,8 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
         live: benchCfg.live,
         pricingLive: benchCfg.pricingLive,
         refreshHours: benchCfg.refreshHours,
-        sourceUrl: benchCfg.sourceUrl
+        sourceUrl: benchCfg.sourceUrl,
+        cacheFile: benchCfg.cacheFile
       });
       setBenchmarkLiveProvider(this.liveData);
     }
@@ -2680,6 +2895,40 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
   getLiveData() {
     return this.liveData;
   }
+  /**
+   * Validate the official cloud providers (anthropic/openai/gemini) against
+   * their own /models list at init time so AUTO selection only picks a model the
+   * key actually serves. This is the fix for "a non-existent catalog model gets
+   * selected, then the run fails over through several models before one works".
+   * Cached per key (TTL) so a per-request router doesn't re-discover; fully
+   * best-effort + time-boxed, so offline/error simply keeps the bundled catalog.
+   */
+  async validateCloudProviderModels(config) {
+    const providers = ["anthropic", "openai", "gemini"];
+    await Promise.all(providers.map(async (type) => {
+      if (!this.selector.isProviderAvailable(type)) return;
+      const cfg = config.providers.find((p) => p.type === type);
+      if (!cfg?.apiKey) return;
+      const cacheKey = discoveryCacheKey(type, cfg);
+      let entry = cloudDiscoveryCache.get(cacheKey);
+      if (!entry || Date.now() - entry.at > DISCOVERY_TTL_MS) {
+        const seed = this.getAnyModelForProvider(type);
+        if (!seed) return;
+        try {
+          const provider = this.createProvider(cfg, seed);
+          if (typeof provider.listModels !== "function") return;
+          const models = await withTimeout(provider.listModels(), DISCOVERY_TIMEOUT_MS, `${type} model discovery timed out`);
+          if (!models.length) return;
+          entry = { models, ids: models.map((m) => m.id), at: Date.now() };
+          cloudDiscoveryCache.set(cacheKey, entry);
+        } catch {
+          return;
+        }
+      }
+      for (const m of entry.models) this.selector.addDynamicModel(m);
+      this.selector.setValidatedModels(type, entry.ids);
+    }));
+  }
   /**
    * Query each available cloud provider's live model list and register the
    * results. Confirms catalog ids still exist and surfaces newly released
@@ -2733,19 +2982,14 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
         this.runBudgetExceededReason ?? "Per-task budget exceeded."
       );
     }
-    const limits = this.config?.tierLimits;
-    const tierKey = tier.toLowerCase();
-    const tierMaxTokens = limits?.[`${tierKey}MaxTokens`];
-    if (tierMaxTokens && (!options.maxTokens || options.maxTokens > tierMaxTokens)) {
-      options = { ...options, maxTokens: tierMaxTokens };
-    }
+    options = applyTierLimits(options, tier, this.config?.tierLimits);
     if (this.runSignal && !options.signal) {
       options = { ...options, signal: this.runSignal };
     }
     if (options.model && !requireVision) {
       this.ensureProvider(options.model, this.config.providers);
     }
-    let model = requireVision ? this.selector.selectVisionModel() : options.model ?? this.tierModels.get(tier);
+    let model = requireVision ? this.selector.selectVisionModel() : options.model ?? this.tierModels.get(tier) ?? this.selector.selectForTier(tier) ?? void 0;
     if (options.forceLocal && model && !this.isPrivateModel(model)) {
       const localModel = this.selector.getAllAvailableModels().find((m) => this.isPrivateModel(m));
       if (!localModel) {
@@ -2854,7 +3098,8 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
       }
       if (isModelNotFoundError(errMsg)) {
         this.selector.removeModel(model.id);
-        const next = this.selector.selectForTier(tier);
+        const depth = (options._notFoundDepth ?? 0) + 1;
+        const next = depth <= 3 ? this.selector.selectForTier(tier) : null;
         if (next && next.id !== model.id) {
           this.tierModels.set(tier, next);
           this.ensureProvider(next, this.config.providers);
@@ -2866,7 +3111,8 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
           });
           releaseLocalSlot?.();
           releaseLocalSlot = void 0;
-          const retryOpts = options.model && options.model.id === model.id ? { ...options, model: void 0 } : options;
+          const base = options.model && options.model.id === model.id ? { ...options, model: void 0 } : options;
+          const retryOpts = { ...base, _notFoundDepth: depth };
           return this.generate(tier, retryOpts, onChunk, requireVision);
         }
       }
@@ -2932,6 +3178,15 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
   getSelector() {
     return this.selector;
   }
+  /**
+   * The tightest context window (in tokens) across the resolved tier models, or
+   * undefined if none are resolved yet. Extended-context compaction budgets
+   * against this so the compacted context fits whichever tier handles the run.
+   */
+  getReferenceContextWindow() {
+    const windows = [...this.tierModels.values()].map((m) => m.contextWindow).filter((n) => typeof n === "number" && n > 0);
+    return windows.length ? Math.min(...windows) : void 0;
+  }
   /** Wire the Cascade Auto task analyzer used for per-subtask model routing. */
   setTaskAnalyzer(analyzer) {
     this.taskAnalyzer = analyzer;
@@ -3111,6 +3366,10 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
     return this.selector?.getAllAvailableModels() ?? [];
   }
   // ── Private ──────────────────────────────────
+  /** Logs why a configured provider failed its availability probe. */
+  emitProbeFailure(type, reason) {
+    console.warn(`[router] provider "${type}" is not available: ${reason}`);
+  }
   async detectAvailableProviders(configs) {
     const available = /* @__PURE__ */ new Set();
     const checks = configs.map(async (cfg) => {
@@ -3120,7 +3379,9 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
         const provider = this.createProvider(cfg, testModel);
         const ok = await provider.isAvailable();
         if (ok) available.add(cfg.type);
-      } catch {
+        else this.emitProbeFailure(cfg.type, "availability check returned false (bad key, wrong endpoint/deployment, or unreachable)");
+      } catch (err) {
+        this.emitProbeFailure(cfg.type, err instanceof Error ? err.message : String(err));
       }
     });
     await Promise.allSettled(checks);
@@ -3790,18 +4051,51 @@ var WorkerStallError = class extends Error {
   }
   partialOutput;
 };
-var T3_SYSTEM_PROMPT = `You are a T3 Worker agent in the Cascade AI system. Your job is to execute a specific subtask completely and accurately.
+var KNOWN_TOOLS = [
+  "shell",
+  "file_read",
+  "file_write",
+  "file_edit",
+  "file_delete",
+  "file_list",
+  "git",
+  "github",
+  "image_analyze",
+  "pdf_create",
+  "run_code",
+  "peer_message",
+  "web_search",
+  "glob",
+  "grep",
+  "web_fetch"
+];
+function buildWorkerRules(has) {
+  const canWriteFiles = has("file_write") || has("file_edit") || has("run_code");
+  const hasAnyTool = KNOWN_TOOLS.some(has);
+  const rules = [
+    "- Execute the subtask completely \u2014 do not stop partway through.",
+    hasAnyTool && "- Use tools when needed. Ask for approval only when the tool registry requires it.",
+    canWriteFiles && "- If the task asks for a file or artifact, you must actually create it in the workspace, verify that it exists, and inspect it before claiming success.",
+    has("web_search") && '- Use the "web_search" tool to find current information, documentation, news, or general web data.',
+    has("pdf_create") && '- Use the "pdf_create" tool for PDF requests.',
+    has("run_code") && '- Use the "run_code" tool for any file types (Excel, Zip, csv, etc.) or complex processing not covered by other tools. Always cleanup after code execution.',
+    "- If you are not making meaningful progress, stop and escalate rather than looping or padding the response.",
+    has("peer_message") && '- Use the "peer_message" tool to communicate with other T3 workers if your tasks have dependencies or shared state. You can send updates or wait for signals.',
+    "- Return structured output that directly addresses the expected output specification."
+  ];
+  return `You are a T3 Worker agent in the Cascade AI system. Your job is to execute a specific subtask completely and accurately.
 
 Rules:
-- Execute the subtask completely \u2014 do not stop partway through.
-- Use tools when needed. Ask for approval only when the tool registry requires it.
-- If the task asks for a file or artifact, you must actually create it in the workspace, verify that it exists, and inspect it before claiming success.
-- Use the "web_search" tool to find current information, documentation, news, or general web data.
-- Use the "pdf_create" tool for PDF requests.
-- Use the "run_code" tool for any file types (Excel, Zip, csv, etc.) or complex processing not covered by other tools. Always cleanup after code execution.
-- If you are not making meaningful progress, stop and escalate rather than looping or padding the response.
-- Use the "peer_message" tool to communicate with other T3 workers if your tasks have dependencies or shared state. You can send updates or wait for signals.
-- Return structured output that directly addresses the expected output specification.`;
+${rules.filter((r) => r !== false).join("\n")}`;
+}
+var ARTIFACT_TOOLS = /* @__PURE__ */ new Set(["file_write", "file_edit", "shell"]);
+function shouldRequireArtifact(assignment, toolNames) {
+  if (!toolNames.some((n) => ARTIFACT_TOOLS.has(n))) return false;
+  if (assignment?.files?.length) return true;
+  const haystack = `${assignment?.description ?? ""}
+${assignment?.expectedOutput ?? ""}`;
+  return /\b[\w./-]+\.(pdf|md|html|txt|json|csv|py|js|ts|tsx|jsx|docx?|png|jpg|jpeg|svg|gif)\b/i.test(haystack) || /save (?:a|the)? file|create (?:a|the)? file|write (?:a|the)? file/i.test(haystack);
+}
 var T3Worker = class extends BaseTier {
   router;
   toolRegistry;
@@ -4282,8 +4576,8 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : "") + textToolSuffix,
         tierId: this.id,
         sessionId: this.taskId,
         requireApproval: false,
-        saveSnapshot: async (path22, content) => {
-          this.store?.addFileSnapshot(this.taskId, path22, content);
+        saveSnapshot: async (path26, content) => {
+          this.store?.addFileSnapshot(this.taskId, path26, content);
         },
         sendPeerSync: (to, syncType, content) => {
           this.peerBus?.send(this.id, to, syncType, this.assignment?.subtaskId ?? "", content);
@@ -4435,10 +4729,7 @@ ${assignment.expectedOutput}`;
     };
   }
   requiresArtifact() {
-    if (this.assignment?.files?.length) return true;
-    const haystack = `${this.assignment?.description ?? ""}
-${this.assignment?.expectedOutput ?? ""}`;
-    return /\b[\w./-]+\.(pdf|md|html|txt|json|csv|py|js|ts|tsx|jsx|docx?|png|jpg|jpeg|svg|gif)\b/i.test(haystack) || /save (?:a|the)? file|create (?:a|the)? file|write (?:a|the)? file/i.test(haystack);
+    return shouldRequireArtifact(this.assignment, this.tools.map((t) => t.name));
   }
   extractArtifactPaths(assignment) {
     const declared = (assignment.files ?? []).map((f) => f.trim()).filter((f) => f.includes("."));
@@ -4455,7 +4746,7 @@ ${assignment.expectedOutput}`;
     const { promisify: promisify4 } = await import('util');
     const execAsync2 = promisify4(exec2);
     for (const artifactPath of artifactPaths) {
-      const absolutePath = path21.resolve(process.cwd(), artifactPath);
+      const absolutePath = path24.resolve(process.cwd(), artifactPath);
       try {
         const stat = await fs4.stat(absolutePath);
         if (!stat.isFile()) {
@@ -4476,7 +4767,7 @@ ${assignment.expectedOutput}`;
           issues.push(`PDF artifact looks too small to be valid: ${artifactPath}`);
           continue;
         }
-        const ext = path21.extname(absolutePath).toLowerCase();
+        const ext = path24.extname(absolutePath).toLowerCase();
         try {
           if (ext === ".ts" || ext === ".tsx") {
             await execAsync2(`npx tsc --noEmit ${absolutePath}`, { timeout: 1e4 });
@@ -4653,7 +4944,8 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
     return result.output;
   }
   buildSystemPrompt(assignment) {
-    return `${T3_SYSTEM_PROMPT}
+    const available = new Set(this.toolRegistry.getToolDefinitions().map((t) => t.name));
+    return `${buildWorkerRules((name) => available.has(name))}
 
 Your subtask:
 - Title: ${assignment.subtaskTitle}
@@ -5052,11 +5344,15 @@ var RedactionLayer = class {
 };
 
 // src/core/tiers/t2-manager.ts
-var T2_SYSTEM_PROMPT = `You are a T2 Manager agent in the Cascade AI system.
-Your role is to analyze a section of a task and decompose it into 2-5 discrete subtasks for T3 Workers.
-If subtasks have dependencies, you can specify "executionMode": "sequential" for the section.
-Provide "peerT3Ids" to subtasks so they can coordinate using the peer_message tool.
-Return ONLY valid JSON matching the T3 subtask array schema \u2014 no other text.`;
+function buildT2SystemPrompt(hasPeerMessage) {
+  return [
+    "You are a T2 Manager agent in the Cascade AI system.",
+    "Your role is to analyze a section of a task and decompose it into 2-5 discrete subtasks for T3 Workers.",
+    'If subtasks have dependencies, you can specify "executionMode": "sequential" for the section.',
+    hasPeerMessage && 'Provide "peerT3Ids" to subtasks so they can coordinate using the peer_message tool.',
+    "Return ONLY valid JSON matching the T3 subtask array schema \u2014 no other text."
+  ].filter((l) => l !== false).join("\n");
+}
 var T2Manager = class extends BaseTier {
   router;
   toolRegistry;
@@ -5275,7 +5571,7 @@ Return ONLY the JSON array.`;
     const messages = [{ role: "user", content: prompt }];
     const result = await this.router.generate("T2", {
       messages,
-      systemPrompt: this.systemPromptOverride + T2_SYSTEM_PROMPT + (this.hierarchyContext ? `
+      systemPrompt: this.systemPromptOverride + buildT2SystemPrompt(this.toolRegistry.hasTool("peer_message")) + (this.hierarchyContext ? `
 
 HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
       maxTokens: 2e3,
@@ -5630,16 +5926,16 @@ ${peerOutputs}` : "";
     let currentSummary = "";
     let i = 0;
     while (i < completed.length) {
-      let chunkText = "";
+      let chunkText3 = "";
       let chunkEnd = i;
       while (chunkEnd < completed.length) {
         const nextOutput = `[T3-${chunkEnd + 1}]: ${completed[chunkEnd].output}
 
 `;
-        if (chunkText.length + nextOutput.length > MAX_CHUNK_LENGTH && chunkEnd > i) {
+        if (chunkText3.length + nextOutput.length > MAX_CHUNK_LENGTH && chunkEnd > i) {
           break;
         }
-        chunkText += nextOutput;
+        chunkText3 += nextOutput;
         chunkEnd++;
       }
       i = chunkEnd;
@@ -5650,7 +5946,7 @@ PREVIOUS SUMMARY SO FAR:
 ${currentSummary}
 
 NEW OUTPUTS TO INTEGRATE:
-` : "\nOUTPUTS:\n"}${chunkText}${peerContext}`;
+` : "\nOUTPUTS:\n"}${chunkText3}${peerContext}`;
       const messages = [{ role: "user", content: prompt }];
       try {
         const streamFinal = isLastChunk && this.isPresenter ? (chunk) => this.emit("stream:token", { tierId: this.id, text: chunk.text, primary: true }) : void 0;
@@ -5665,7 +5961,7 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
         currentSummary = result.content;
       } catch (err) {
         this.log(`aggregateResults: LLM summarization failed at chunk \u2014 returning raw T3 outputs. Error: ${err instanceof Error ? err.message : String(err)}`);
-        return currentSummary + "\n\n" + chunkText;
+        return currentSummary + "\n\n" + chunkText3;
       }
     }
     return currentSummary;
@@ -5779,7 +6075,16 @@ function isStrongKeywordOverlap(a = [], b = []) {
   const ratio = shared.length / Math.min(a.length, b.length);
   return shared.length >= 3 && ratio >= 0.6;
 }
-var T1_SYSTEM_PROMPT = `You are T1, the Administrator in the Cascade AI orchestration system.
+function buildT1SystemPrompt(has) {
+  const canWriteArtifacts = has("file_write") || has("file_edit") || has("run_code") || has("pdf_create");
+  const rules = [
+    "- Simple \u2192 1 T3, Moderate \u2192 2-3 T2s, Complex \u2192 3-5 T2s, Highly Complex \u2192 5+ T2s",
+    "- Return ONLY valid JSON \u2014 no other text",
+    has("pdf_create") && '- If the user asks for a PDF, explicitly use the "pdf_create" tool',
+    has("run_code") && '- If the user asks for Excel/Zip/complex processing, use "run_code" with Python or Node.js',
+    canWriteArtifacts && "- Ensure every plan includes explicit creation and verification steps for requested artifacts"
+  ];
+  return `You are T1, the Administrator in the Cascade AI orchestration system.
 
 Your responsibilities:
 1. Analyze task complexity: Simple | Moderate | Complex | Highly Complex
@@ -5795,11 +6100,7 @@ The directory must appear verbatim in every subtask that creates or reads a file
 NEVER omit the directory prefix when decomposing into subtasks.
 
 Rules:
-- Simple \u2192 1 T3, Moderate \u2192 2-3 T2s, Complex \u2192 3-5 T2s, Highly Complex \u2192 5+ T2s
-- Return ONLY valid JSON \u2014 no other text
-- If the user asks for a PDF, explicitly use the "pdf_create" tool
-- If the user asks for Excel/Zip/complex processing, use "run_code" with Python or Node.js
-- Ensure every plan includes explicit creation and verification steps for requested artifacts
+${rules.filter((r) => r !== false).join("\n")}
 
 DEPENDENCY GUIDANCE:
 - Leave "dependsOn" empty [] for sections that are independent (e.g. writing different files, researching different topics).
@@ -5811,6 +6112,7 @@ QUALITY RULES:
 - Each section must have a clear, testable "expectedOutput" so T2 knows when it is done.
 - Do NOT create trivial sections that only move files or print summaries \u2014 fold those into adjacent sections.
 - If the plan would naturally produce fewer than 2 independent sections, prefer Moderate routing (single T2).`;
+}
 var T1Administrator = class extends BaseTier {
   router;
   toolRegistry;
@@ -6138,10 +6440,11 @@ SPEC RULES \u2014 each subtask is a self-contained spec slice (workers execute f
 - "acceptance": 1-3 checks a reviewer could verify mechanically (file exists / contains X / command exits 0). These define done.
 - "contextBrief": 1-3 short sentences with the ONLY background the worker needs. It sees nothing else about the task, so make the brief self-sufficient \u2014 but never pad it.
 - RIGHT-SIZE the plan: use the FEWEST sections and workers that fully cover the task. One section with 1-2 subtasks is the CORRECT plan for a small task; padding a plan with filler sections wastes the user's money.`;
+    const available = new Set(this.toolRegistry.getToolDefinitions().map((t) => t.name));
     const messages = [{ role: "user", content: decompositionPrompt }];
     const result = await this.router.generate("T1", {
       messages,
-      systemPrompt: this.systemPromptOverride + T1_SYSTEM_PROMPT,
+      systemPrompt: this.systemPromptOverride + buildT1SystemPrompt((name) => available.has(name)),
       maxTokens: 4e3
     });
     try {
@@ -6586,16 +6889,16 @@ function resolveInWorkspace(workspaceRoot, input) {
   if (typeof input !== "string" || input.length === 0) {
     throw new WorkspaceSandboxError(String(input), workspaceRoot);
   }
-  const root = path21.resolve(workspaceRoot);
-  const abs = path21.isAbsolute(input) ? path21.resolve(input) : path21.resolve(root, input);
-  const rel = path21.relative(root, abs);
-  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path21.isAbsolute(rel)) {
+  const root = path24.resolve(workspaceRoot);
+  const abs = path24.isAbsolute(input) ? path24.resolve(input) : path24.resolve(root, input);
+  const rel = path24.relative(root, abs);
+  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path24.isAbsolute(rel)) {
     throw new WorkspaceSandboxError(input, root);
   }
   try {
-    const real = fs20.realpathSync(abs);
-    const realRel = path21.relative(root, real);
-    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path21.isAbsolute(realRel))) {
+    const real = fs23.realpathSync(abs);
+    const realRel = path24.relative(root, real);
+    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path24.isAbsolute(realRel))) {
       throw new WorkspaceSandboxError(input, root);
     }
   } catch (e) {
@@ -6656,7 +6959,7 @@ var FileWriteTool = class extends BaseTool {
       } catch {
       }
     }
-    await fs4.mkdir(path21.dirname(absPath), { recursive: true });
+    await fs4.mkdir(path24.dirname(absPath), { recursive: true });
     await fs4.writeFile(absPath, content, "utf-8");
     return `Written ${content.length} characters to ${filePath}`;
   }
@@ -7068,36 +7371,36 @@ var BrowserTool = class extends BaseTool {
         return `Browser launch failed: ${err instanceof Error ? err.message : String(err)}`;
       }
     }
-    const page = this.page;
+    const page2 = this.page;
     try {
       switch (action) {
         case "navigate": {
-          await page.goto(input["url"], { timeout });
-          const title = await page.title();
+          await page2.goto(input["url"], { timeout });
+          const title = await page2.title();
           return `Navigated to ${input["url"]} (title: "${title}")`;
         }
         case "click": {
-          await page.click(input["selector"], { timeout });
+          await page2.click(input["selector"], { timeout });
           return `Clicked ${input["selector"]}`;
         }
         case "fill": {
-          await page.fill(input["selector"], input["value"]);
+          await page2.fill(input["selector"], input["value"]);
           return `Filled ${input["selector"]} with value`;
         }
         case "screenshot": {
-          const buf = await page.screenshot({ type: "png" });
+          const buf = await page2.screenshot({ type: "png" });
           return `data:image/png;base64,${buf.toString("base64")}`;
         }
         case "evaluate": {
-          const result = await page.evaluate(input["script"]);
+          const result = await page2.evaluate(input["script"]);
           return JSON.stringify(result);
         }
         case "extract_text": {
-          const text = await page.locator("body").innerText();
+          const text = await page2.locator("body").innerText();
           return text.slice(0, 1e4);
         }
         case "wait": {
-          await page.waitForTimeout(timeout);
+          await page2.waitForTimeout(timeout);
           return `Waited ${timeout}ms`;
         }
         default:
@@ -7154,7 +7457,7 @@ var ImageAnalyzeTool = class extends BaseTool {
 };
 async function fileToImageAttachment(filePath) {
   const data = await fs4.readFile(filePath);
-  const ext = path21.extname(filePath).toLowerCase();
+  const ext = path24.extname(filePath).toLowerCase();
   const mimeMap = {
     ".jpg": "image/jpeg",
     ".jpeg": "image/jpeg",
@@ -7188,14 +7491,14 @@ var PDFCreateTool = class extends BaseTool {
     const filePath = input["path"];
     const content = input["content"];
     const title = input["title"];
-    const dir = path21.dirname(filePath);
-    if (!fs20.existsSync(dir)) {
-      fs20.mkdirSync(dir, { recursive: true });
+    const dir = path24.dirname(filePath);
+    if (!fs23.existsSync(dir)) {
+      fs23.mkdirSync(dir, { recursive: true });
     }
     return new Promise((resolve, reject) => {
       try {
         const doc = new PDFDocument({ margin: 50 });
-        const stream = fs20.createWriteStream(filePath);
+        const stream = fs23.createWriteStream(filePath);
         doc.pipe(stream);
         if (title) {
           doc.info["Title"] = title;
@@ -7273,22 +7576,22 @@ var CodeInterpreterTool = class extends BaseTool {
       }
       cmdPrefix = NODE_CMD;
     }
-    const tmpDir = path21.join(this.workspaceRoot, ".cascade", "tmp");
-    if (!fs20.existsSync(tmpDir)) {
-      fs20.mkdirSync(tmpDir, { recursive: true });
+    const tmpDir = path24.join(this.workspaceRoot, ".cascade", "tmp");
+    if (!fs23.existsSync(tmpDir)) {
+      fs23.mkdirSync(tmpDir, { recursive: true });
     }
     const extension = language === "python" ? "py" : "js";
     const fileName = `intp_${randomUUID().slice(0, 8)}.${extension}`;
-    const filePath = path21.join(tmpDir, fileName);
-    fs20.writeFileSync(filePath, code, "utf-8");
+    const filePath = path24.join(tmpDir, fileName);
+    fs23.writeFileSync(filePath, code, "utf-8");
     const execArgs = [filePath, ...args];
     return new Promise((resolve) => {
       const startMs = Date.now();
       execFile(cmdPrefix, execArgs, { cwd: this.workspaceRoot, timeout: 3e4 }, (error, stdout, stderr) => {
         const duration = Date.now() - startMs;
         try {
-          if (fs20.existsSync(filePath)) {
-            fs20.unlinkSync(filePath);
+          if (fs23.existsSync(filePath)) {
+            fs23.unlinkSync(filePath);
           }
         } catch (cleanupErr) {
           console.error(`Failed to cleanup interpreter script ${filePath}:`, cleanupErr);
@@ -7595,7 +7898,7 @@ var GlobTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path21.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path24.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const matches = await glob(pattern, {
       cwd: searchPath,
       ignore: ["node_modules/**", ".git/**", "dist/**", "build/**"],
@@ -7608,7 +7911,7 @@ var GlobTool = class extends BaseTool {
     const withMtime = await Promise.all(
       matches.map(async (rel) => {
         try {
-          const stat = await fs4.stat(path21.join(searchPath, rel));
+          const stat = await fs4.stat(path24.join(searchPath, rel));
           return { rel, mtime: stat.mtimeMs };
         } catch {
           return { rel, mtime: 0 };
@@ -7657,7 +7960,7 @@ var GrepTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path21.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path24.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const globPattern = input["glob"];
     const outputMode = input["output_mode"] ?? "content";
     const context = input["context"] ?? 0;
@@ -7711,12 +8014,12 @@ var GrepTool = class extends BaseTool {
         nodir: true
       });
     } catch {
-      files = [path21.relative(searchPath, searchPath) || "."];
+      files = [path24.relative(searchPath, searchPath) || "."];
     }
     const results = [];
     let totalCount = 0;
     for (const rel of files) {
-      const abs = path21.join(searchPath, rel);
+      const abs = path24.join(searchPath, rel);
       let content;
       try {
         content = await fs4.readFile(abs, "utf-8");
@@ -8081,13 +8384,16 @@ var ToolRegistry = class extends EventEmitter {
   }
   isIgnored(filePath) {
     if (!filePath) return false;
-    const abs = path21.resolve(this.workspaceRoot, filePath);
-    const rel = path21.relative(this.workspaceRoot, abs);
-    if (!rel || rel.startsWith("..") || path21.isAbsolute(rel)) return true;
-    const posixRel = rel.split(path21.sep).join("/");
+    const abs = path24.resolve(this.workspaceRoot, filePath);
+    const rel = path24.relative(this.workspaceRoot, abs);
+    if (!rel || rel.startsWith("..") || path24.isAbsolute(rel)) return true;
+    const posixRel = rel.split(path24.sep).join("/");
     return this.ignoreMatcher.ignores(posixRel);
   }
 };
+function isRemoteMcpServer(server) {
+  return typeof server.url === "string" && server.url.length > 0;
+}
 var McpClient = class _McpClient {
   static activeProcessPids = /* @__PURE__ */ new Set();
   /** 
@@ -8114,7 +8420,8 @@ var McpClient = class _McpClient {
     this.approvalCallback = options.approvalCallback;
     this.onWarn = options.onWarn ?? ((message) => console.warn(message));
   }
-  async connect(server) {
+  async connect(server, opts = {}) {
+    const remote = isRemoteMcpServer(server);
     if (!this.trustedServers.has(server.name)) {
       const approved = this.approvalCallback ? await this.approvalCallback(server) : false;
       if (!approved) {
@@ -8124,19 +8431,29 @@ var McpClient = class _McpClient {
       }
       this.trustedServers.add(server.name);
     }
-    const transport = new StdioClientTransport({
-      command: server.command,
-      args: server.args ?? [],
-      env: { ...process.env, ...server.env ?? {} }
-    });
     const client = new Client(
       { name: "cascade-ai", version: "0.1.0" },
       { capabilities: {} }
     );
-    await client.connect(transport);
+    let transport;
+    if (remote) {
+      transport = await this.connectRemote(server, client, opts.authProvider);
+    } else {
+      if (!server.command) {
+        throw new Error(`MCP server "${server.name}" has neither a url nor a command.`);
+      }
+      transport = new StdioClientTransport({
+        command: server.command,
+        args: server.args ?? [],
+        env: { ...process.env, ...server.env ?? {} }
+      });
+      await client.connect(transport);
+    }
     this.clients.set(server.name, client);
     this.transports.set(server.name, transport);
-    if (transport.pid) _McpClient.activeProcessPids.add(transport.pid);
+    if (transport instanceof StdioClientTransport && transport.pid) {
+      _McpClient.activeProcessPids.add(transport.pid);
+    }
     const toolsResult = await client.listTools();
     for (const tool of toolsResult.tools) {
       for (const existing of this.tools.values()) {
@@ -8155,11 +8472,37 @@ var McpClient = class _McpClient {
       });
     }
   }
+  /**
+   * Connect to a remote MCP server. Tries Streamable HTTP first (the current
+   * transport); if that fails (a legacy server that only speaks SSE), retries
+   * once over SSE. Auth headers ride on every request. Returns the live
+   * transport so the caller can register it.
+   */
+  async connectRemote(server, client, authProvider) {
+    const url = new URL(server.url);
+    const headers = server.headers && Object.keys(server.headers).length ? server.headers : void 0;
+    const opts = {
+      ...authProvider ? { authProvider } : {},
+      ...headers ? { requestInit: { headers } } : {}
+    };
+    try {
+      const http4 = new StreamableHTTPClientTransport(url, opts);
+      await client.connect(http4);
+      return http4;
+    } catch (httpErr) {
+      this.onWarn(`[mcp] Streamable HTTP failed for "${server.name}", falling back to SSE: ${String(httpErr)}`);
+      const sse = new SSEClientTransport(url, opts);
+      await client.connect(sse);
+      return sse;
+    }
+  }
   async disconnect(serverName) {
     const client = this.clients.get(serverName);
     if (client) {
       const transport = this.transports.get(serverName);
-      if (transport?.pid) _McpClient.activeProcessPids.delete(transport.pid);
+      if (transport instanceof StdioClientTransport && transport.pid) {
+        _McpClient.activeProcessPids.delete(transport.pid);
+      }
       await client.close();
       this.clients.delete(serverName);
       this.transports.delete(serverName);
@@ -8193,7 +8536,7 @@ var McpClient = class _McpClient {
   getActivePids() {
     const pids = [];
     for (const transport of this.transports.values()) {
-      if (transport.pid) pids.push(transport.pid);
+      if (transport instanceof StdioClientTransport && transport.pid) pids.push(transport.pid);
     }
     return pids;
   }
@@ -8201,6 +8544,277 @@ var McpClient = class _McpClient {
     return this.clients.has(serverName);
   }
 };
+var McpOAuthProvider = class {
+  constructor(opts) {
+    this.opts = opts;
+    this._state = opts.state ?? randomBytes(16).toString("hex");
+  }
+  opts;
+  cache;
+  _state;
+  /** The `state` this provider uses — callers validate it on the callback. */
+  get oauthState() {
+    return this._state;
+  }
+  async loaded() {
+    if (!this.cache) this.cache = await this.opts.store.load() ?? {};
+    return this.cache;
+  }
+  async persist() {
+    await this.opts.store.save(this.cache ?? {});
+  }
+  get redirectUrl() {
+    return this.opts.redirectUrl;
+  }
+  get clientMetadata() {
+    return {
+      redirect_uris: [this.opts.redirectUrl],
+      client_name: this.opts.clientName ?? "Cascade AI",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      // public client — PKCE, no secret
+      ...this.opts.scope ? { scope: this.opts.scope } : {}
+    };
+  }
+  state() {
+    return this._state;
+  }
+  async clientInformation() {
+    return (await this.loaded()).clientInformation;
+  }
+  async saveClientInformation(info) {
+    (await this.loaded()).clientInformation = info;
+    await this.persist();
+  }
+  async tokens() {
+    return (await this.loaded()).tokens;
+  }
+  async saveTokens(tokens) {
+    (await this.loaded()).tokens = tokens;
+    await this.persist();
+  }
+  async redirectToAuthorization(authorizationUrl) {
+    await this.opts.redirect(authorizationUrl);
+  }
+  async saveCodeVerifier(codeVerifier) {
+    (await this.loaded()).codeVerifier = codeVerifier;
+    await this.persist();
+  }
+  async codeVerifier() {
+    const v = (await this.loaded()).codeVerifier;
+    if (!v) throw new Error("No PKCE verifier saved for this MCP OAuth flow.");
+    return v;
+  }
+  async invalidateCredentials(scope) {
+    const s = await this.loaded();
+    if (scope === "all" || scope === "client") s.clientInformation = void 0;
+    if (scope === "all" || scope === "tokens") s.tokens = void 0;
+    if (scope === "all" || scope === "verifier") s.codeVerifier = void 0;
+    await this.persist();
+  }
+};
+var FileMcpOAuthStore = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  load() {
+    try {
+      return JSON.parse(fs23.readFileSync(this.filePath, "utf-8"));
+    } catch {
+      return void 0;
+    }
+  }
+  save(state) {
+    fs23.mkdirSync(path24.dirname(this.filePath), { recursive: true, mode: 448 });
+    fs23.writeFileSync(this.filePath, JSON.stringify(state, null, 2), { mode: 384 });
+    try {
+      fs23.chmodSync(this.filePath, 384);
+    } catch {
+    }
+  }
+  clear() {
+    try {
+      fs23.rmSync(this.filePath);
+    } catch {
+    }
+  }
+};
+function fileOAuthProvider(storePath) {
+  return new McpOAuthProvider({
+    redirectUrl: "http://127.0.0.1/callback",
+    // unused by refresh
+    store: new FileMcpOAuthStore(storePath),
+    redirect: () => {
+      throw new Error("This MCP server needs re-authorization \u2014 run `cascade mcp connect` again.");
+    }
+  });
+}
+function beginMcpOAuth(provider, serverUrl) {
+  return auth(provider, { serverUrl });
+}
+async function completeMcpOAuth(provider, serverUrl, authorizationCode) {
+  await auth(provider, { serverUrl, authorizationCode });
+}
+async function discoverMcpAuthServer(serverUrl) {
+  try {
+    const prm = await discoverOAuthProtectedResourceMetadata(serverUrl);
+    return prm.authorization_servers?.[0];
+  } catch {
+    return void 0;
+  }
+}
+async function refreshMcpToken(input) {
+  const metadata = await discoverAuthorizationServerMetadata(input.authorizationServerUrl);
+  return refreshAuthorization(input.authorizationServerUrl, {
+    metadata,
+    clientInformation: input.clientInformation,
+    refreshToken: input.refreshToken
+  });
+}
+async function connectMcpWithLoopbackOAuth(opts) {
+  const listener = await startCallbackListener(opts);
+  const transport = new StreamableHTTPClientTransport(new URL(opts.serverUrl), {
+    authProvider: new McpOAuthProvider({
+      redirectUrl: listener.redirectUri,
+      store: opts.store,
+      redirect: (url) => opts.openUrl(url.toString()),
+      clientName: opts.clientName,
+      scope: opts.scope
+    })
+  });
+  const client = new Client({ name: "cascade-ai", version: "0.1.0" }, { capabilities: {} });
+  try {
+    try {
+      await client.connect(transport);
+      const state2 = await opts.store.load();
+      if (!state2?.tokens) throw new Error("MCP server did not require authorization.");
+      return { tokens: state2.tokens, clientInformation: state2.clientInformation };
+    } catch (err) {
+      if (!(err instanceof UnauthorizedError)) throw err;
+    }
+    const code = await listener.waitForCode;
+    await transport.finishAuth(code);
+    const state = await opts.store.load();
+    if (!state?.tokens) throw new Error("Authorization completed but no tokens were issued.");
+    return { tokens: state.tokens, clientInformation: state.clientInformation };
+  } finally {
+    listener.close();
+    await transport.close().catch(() => {
+    });
+  }
+}
+function startCallbackListener(opts) {
+  return new Promise((resolveListener, rejectListener) => {
+    let resolveCode;
+    let rejectCode;
+    const waitForCode = new Promise((res, rej) => {
+      resolveCode = res;
+      rejectCode = rej;
+    });
+    let server;
+    const close = () => {
+      try {
+        server?.close();
+      } catch {
+      }
+    };
+    const timer = setTimeout(() => {
+      rejectCode(new Error("Authorization timed out."));
+      close();
+    }, opts.timeoutMs ?? 5 * 6e4);
+    timer.unref?.();
+    const settle = (code) => {
+      clearTimeout(timer);
+      resolveCode(code);
+    };
+    const fail = (err) => {
+      clearTimeout(timer);
+      rejectCode(err);
+    };
+    server = http.createServer((req, res) => {
+      const reqUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (reqUrl.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      const code = reqUrl.searchParams.get("code");
+      const err = reqUrl.searchParams.get("error");
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      if (err || !code) {
+        res.end(page("Authorization failed", "You can close this tab and try again."));
+        fail(new Error(err ? `Authorization failed: ${err}` : "No authorization code returned."));
+        return;
+      }
+      res.end(page("Connected", "You can close this tab and return to Cascade."));
+      settle(code);
+    });
+    opts.signal?.addEventListener("abort", () => {
+      fail(new Error("Authorization cancelled."));
+      close();
+    }, { once: true });
+    server.on("error", (e) => {
+      clearTimeout(timer);
+      rejectListener(e);
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      resolveListener({ redirectUri: `http://127.0.0.1:${port}/callback`, waitForCode, close });
+    });
+  });
+}
+function page(title, body) {
+  return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title} \xB7 Cascade</title><body style="margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;font-family:system-ui,-apple-system,Segoe UI,Roboto,sans-serif;background:#0b0d12;color:#e6e8ee"><div style="text-align:center;padding:40px"><div style="font-size:15px;font-weight:600;margin-bottom:8px">${title}</div><div style="font-size:13px;color:#9aa3b2">${body}</div></div></body>`;
+}
+
+// src/core/knowledge/session-memory.ts
+function sessionWorthRemembering(history, latestPrompt, output) {
+  const turns = history.length + (latestPrompt ? 1 : 0);
+  const historyChars = history.reduce((n, m) => n + messageText(m.content).trim().length, 0);
+  const substance = historyChars + (output?.trim().length ?? 0) + (latestPrompt?.trim().length ?? 0);
+  return turns >= 2 && substance >= 200;
+}
+function messageText(content) {
+  if (typeof content === "string") return content;
+  return content.map((block) => block.type === "text" ? block.text : block.type === "image" ? "[image]" : "").join(" ");
+}
+function buildSessionTranscript(history, latestPrompt, output, maxChars = 6e3) {
+  const lines = [
+    ...history.slice(-12).map((m) => `${m.role}: ${messageText(m.content)}`),
+    `user: ${latestPrompt}`,
+    `assistant: ${output}`
+  ];
+  const joined = lines.join("\n");
+  return joined.length > maxChars ? joined.slice(joined.length - maxChars) : joined;
+}
+async function distillSessionFacts(transcript, generate) {
+  const prompt = `From this conversation, extract durable facts worth remembering about the USER and their PROJECT for future sessions.
+Return ONLY a JSON array of {"entity","relation","value"} triples \u2014 e.g.
+{"entity":"user","relation":"prefers","value":"TypeScript"} or
+{"entity":"project","relation":"deploys_to","value":"Railway"}.
+Capture stable preferences, decisions, and project facts. Ignore transient chit-chat,
+one-off questions, and anything already obvious. At most 6 triples. If nothing durable, return [].
+
+Conversation:
+${transcript}`;
+  try {
+    const raw = await generate(prompt);
+    const match = /\[[\s\S]*\]/.exec(raw);
+    if (!match) return [];
+    const parsed = JSON.parse(match[0]);
+    if (!Array.isArray(parsed)) return [];
+    const out = [];
+    for (const f of parsed.slice(0, 6)) {
+      if (f && typeof f.entity === "string" && typeof f.relation === "string" && typeof f.value === "string" && f.entity.trim() && f.relation.trim() && f.value.trim()) {
+        out.push({ entity: f.entity.trim(), relation: f.relation.trim(), value: f.value.trim() });
+      }
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
 
 // src/core/cascade.ts
 init_audit_logger();
@@ -8390,9 +9004,17 @@ var ModelOverridesSchema = z.object({
 });
 var McpServerConfigSchema = z.object({
   name: z.string(),
-  command: z.string(),
+  // Local (stdio) transport.
+  command: z.string().optional(),
   args: z.array(z.string()).optional(),
-  env: z.record(z.string()).optional()
+  env: z.record(z.string()).optional(),
+  // Remote (hosted-safe) transport.
+  url: z.string().url().optional(),
+  headers: z.record(z.string()).optional(),
+  // Path to this server's OAuth token store (set by `cascade mcp connect`).
+  oauthStore: z.string().optional()
+}).refine((s) => !!s.command || !!s.url, {
+  message: "MCP server needs either a command (local) or a url (remote)."
 });
 var WebSearchConfigSchema = z.object({
   /** Base URL of your SearXNG instance (e.g. http://localhost:8080) */
@@ -8461,12 +9083,26 @@ var TelemetryConfigSchema = z.object({
 var MemoryConfigSchema = z.object({
   maxSessionMessages: z.number().default(1e3),
   autoSummarizeAt: z.number().default(15e4),
-  retentionDays: z.number().default(90)
+  retentionDays: z.number().default(90),
+  /** Opt-in session→knowledge distillation after each run. Default: false. */
+  rememberSessions: z.boolean().default(false)
 });
 var TierLimitsSchema = z.object({
   t1MaxTokens: z.number().optional(),
   t2MaxTokens: z.number().optional(),
-  t3MaxTokens: z.number().optional()
+  t3MaxTokens: z.number().optional(),
+  // Per-tier sampling temperature (0–2). Applied only to calls that don't set
+  // their own temperature — internal deterministic calls (classification,
+  // routing) pin temperature: 0 explicitly and are never overridden.
+  t1Temperature: z.number().min(0).max(2).optional(),
+  t2Temperature: z.number().min(0).max(2).optional(),
+  t3Temperature: z.number().min(0).max(2).optional()
+});
+var ExtendedContextConfigSchema = z.object({
+  enabled: z.boolean().default(false),
+  // 1 = no headroom past the window (compact-to-fit only); 2–3 = allow chunking
+  // an input up to N× the window before truncating. Bounded to keep cost sane.
+  maxMultiplier: z.number().min(1).max(5).default(2)
 });
 var BudgetConfigSchema = z.object({
   dailyBudgetUsd: z.number().optional(),
@@ -8500,6 +9136,7 @@ var CascadeConfigSchema = z.object({
   telemetry: TelemetryConfigSchema.default({}),
   memory: MemoryConfigSchema.default({}),
   tierLimits: TierLimitsSchema.default({}),
+  extendedContext: ExtendedContextConfigSchema.default({}),
   budget: BudgetConfigSchema.default({}),
   theme: z.string().default("cascade"),
   workspace: WorkspaceConfigSchema.default({}),
@@ -8536,7 +9173,9 @@ var CascadeConfigSchema = z.object({
      */
     sourceUrl: z.string().url().optional(),
     /** Fetch current per-token prices from OpenRouter (free, no key). */
-    pricingLive: z.boolean().default(true)
+    pricingLive: z.boolean().default(true),
+    /** Cache location for the fetched snapshot (cloud → persistent volume). */
+    cacheFile: z.string().optional()
   }).default({}),
   /**
    * Runtime Tool Creation: when true, T3 workers can generate and register new tools
@@ -8555,6 +9194,27 @@ var CascadeConfigSchema = z.object({
   knowledge: z.object({
     factsExtraction: z.boolean().default(true)
   }).default({}),
+  /**
+   * Fast answer behaviour. `autoSimple`: pure small talk ("hi", "who are you")
+   * skips the T1/T2/T3 machinery for a direct single-model reply — same cost
+   * shape as the explicit fast-answer toggle, applied automatically.
+   */
+  fastAnswer: z.object({
+    autoSimple: z.boolean().default(true)
+  }).default({}),
+  /**
+   * Workspace code index (Phase 3). Opt-in. When enabled, Cascade registers a
+   * `code_search` tool backed by a hybrid + reranked index of the workspace so
+   * workers can find code by meaning. Build/refresh the index with
+   * `cascade index`; set autoRefresh to update it at run start (incremental —
+   * only changed files are re-embedded).
+   */
+  codeIndex: z.object({
+    enabled: z.boolean().default(false),
+    autoRefresh: z.boolean().default(false),
+    /** SQLite file for the index. Defaults to <workspace>/.cascade/code-index.db. */
+    dbPath: z.string().optional()
+  }).default({}),
   /**
    * Persist runtime-generated tools to .cascade/dynamic-tools.json and reload them
    * on startup for cross-run dedup. Reloaded (and peer-received) tools are always
@@ -8654,7 +9314,16 @@ var CascadeConfigSchema = z.object({
     paths: z.array(z.object({ pattern: z.string().min(1), policy: z.enum(["local-only"]) })).default([])
   }).optional(),
   /** Routing controls — forceTier pins the root tier, bypassing the classifier. */
-  routing: z.object({ forceTier: z.enum(["auto", "T1", "T2", "T3"]).default("auto") }).optional(),
+  routing: z.object({
+    forceTier: z.enum(["auto", "T1", "T2", "T3"]).default("auto"),
+    // Where the model-performance stats live. Defaults to ~/.cascade/model-perf.json
+    // when unset; the cloud points it at the persistent volume so learning survives
+    // redeploys and is shared across users.
+    perfStatsPath: z.string().optional(),
+    // When false, Cascade still READS the shared performance scores to route, but
+    // does NOT record this run's outcomes (opt-out). Default true.
+    learnFromOutcomes: z.boolean().default(true)
+  }).optional(),
   /**
    * T3→T2 reinforcement: when enabled, a worker that discovers its subtask should
    * fan out can call the `request_workers` tool to have its T2 manager spawn
@@ -8871,12 +9540,12 @@ var TaskAnalyzer = class {
    * Record the outcome of a completed run across all tiers that were selected
    * during this session and persist stats to disk.
    */
-  recordRunOutcome(outcome, costByTier) {
+  recordRunOutcome(outcome, costByTier, contextTokens = 0) {
     if (!this.tracker || !this.lastProfile) return;
     const taskType = this.lastProfile.type;
     for (const [tier, model] of this.lastSelectedModels) {
       const cost = costByTier[tier] ?? 0;
-      this.tracker.record(model.id, taskType, outcome, 0, cost);
+      this.tracker.record(model.id, taskType, outcome, 0, cost, contextTokens);
     }
     this.lastSelectedModels.clear();
     void this.tracker.save();
@@ -8927,14 +9596,21 @@ var TaskAnalyzer = class {
     analysisCache.clear();
   }
 };
-var DEFAULT_STATS_FILE = path21.join(os6.homedir(), ".cascade", "model-perf.json");
+var DEFAULT_STATS_FILE = path24.join(os6.homedir(), ".cascade", "model-perf.json");
 var ModelPerformanceTracker = class {
   stats = /* @__PURE__ */ new Map();
   featureStats = /* @__PURE__ */ new Map();
   statsFile;
+  readOnly;
   loaded = false;
-  constructor(statsFile = DEFAULT_STATS_FILE) {
+  /**
+   * @param statsFile where stats persist (cloud → the persistent volume).
+   * @param options.readOnly consume the shared scores but don't record/save this
+   *        run's outcomes — the opt-out path for users who declined to contribute.
+   */
+  constructor(statsFile = DEFAULT_STATS_FILE, options = {}) {
     this.statsFile = statsFile;
+    this.readOnly = options.readOnly ?? false;
   }
   async load() {
     if (this.loaded) return;
@@ -8958,34 +9634,44 @@ var ModelPerformanceTracker = class {
     }
   }
   async save() {
+    if (this.readOnly) return;
     try {
-      await fs4.mkdir(path21.dirname(this.statsFile), { recursive: true });
+      await fs4.mkdir(path24.dirname(this.statsFile), { recursive: true });
       const modelsObj = {};
       const featuresObj = {};
       for (const [key, stat] of this.stats) modelsObj[key] = stat;
       for (const [key, stat] of this.featureStats) featuresObj[key] = stat;
-      await fs4.writeFile(this.statsFile, JSON.stringify({ models: modelsObj, features: featuresObj }, null, 2), "utf-8");
+      const json = JSON.stringify({ models: modelsObj, features: featuresObj }, null, 2);
+      const tmp = `${this.statsFile}.${process.pid}.${Date.now()}.tmp`;
+      await fs4.writeFile(tmp, json, "utf-8");
+      await fs4.rename(tmp, this.statsFile);
     } catch {
     }
   }
-  record(modelId, taskType, outcome, retries = 0, costUsd = 0) {
+  record(modelId, taskType, outcome, retries = 0, costUsd = 0, contextTokens = 0) {
+    if (this.readOnly) return;
     const key = `${modelId}:${taskType}`;
     const s = this.stats.get(key) ?? {
       successCount: 0,
       failureCount: 0,
       totalRetries: 0,
       totalCostUsd: 0,
-      sampleCount: 0
+      sampleCount: 0,
+      totalContextTokens: 0,
+      failureContextTokens: 0
     };
     this.stats.set(key, {
       successCount: s.successCount + (outcome === "success" ? 1 : 0),
       failureCount: s.failureCount + (outcome === "failure" ? 1 : 0),
       totalRetries: s.totalRetries + retries,
       totalCostUsd: s.totalCostUsd + costUsd,
-      sampleCount: s.sampleCount + 1
+      sampleCount: s.sampleCount + 1,
+      totalContextTokens: (s.totalContextTokens ?? 0) + Math.max(0, contextTokens),
+      failureContextTokens: (s.failureContextTokens ?? 0) + (outcome === "failure" ? Math.max(0, contextTokens) : 0)
     });
   }
   recordFeatureCost(featureTag, costUsd) {
+    if (this.readOnly) return;
     const s = this.featureStats.get(featureTag) ?? { totalCostUsd: 0, runCount: 0 };
     this.featureStats.set(featureTag, {
       totalCostUsd: s.totalCostUsd + costUsd,
@@ -9498,7 +10184,7 @@ Required capability: ${description.slice(0, 300)}`;
    *  any dangerous action, so a silently-reloaded tool can't act without approval. */
   async loadPersistedTools() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const file = path21.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
+    const file = path24.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
     try {
       const raw = await fs4.readFile(file, "utf-8");
       const specs = JSON.parse(raw);
@@ -9522,8 +10208,8 @@ Required capability: ${description.slice(0, 300)}`;
   }
   async persist() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const dir = path21.join(this.workspacePath, ".cascade");
-    const file = path21.join(dir, DYNAMIC_TOOLS_FILE);
+    const dir = path24.join(this.workspacePath, ".cascade");
+    const file = path24.join(dir, DYNAMIC_TOOLS_FILE);
     try {
       await fs4.mkdir(dir, { recursive: true });
       await fs4.writeFile(file, JSON.stringify(Array.from(this.specs.values()), null, 2), "utf-8");
@@ -9543,12 +10229,12 @@ var WorldStateDB = class {
   constructor(workspacePath, debugMode = false) {
     this.workspacePath = workspacePath;
     this.debugMode = debugMode;
-    const cascadeDir = path21.join(workspacePath, ".cascade");
-    if (!fs20.existsSync(cascadeDir)) {
-      fs20.mkdirSync(cascadeDir, { recursive: true });
+    const cascadeDir = path24.join(workspacePath, ".cascade");
+    if (!fs23.existsSync(cascadeDir)) {
+      fs23.mkdirSync(cascadeDir, { recursive: true });
     }
-    this.keyPath = path21.join(cascadeDir, "world_state.key");
-    this.dbPath = path21.join(cascadeDir, "world_state.db");
+    this.keyPath = path24.join(cascadeDir, "world_state.key");
+    this.dbPath = path24.join(cascadeDir, "world_state.db");
     this.initEncryptionKey();
     this.db = new Database(this.dbPath);
     this.db.pragma("journal_mode = WAL");
@@ -9570,6 +10256,20 @@ var WorldStateDB = class {
         PRIMARY KEY (entity, relation)
       )
     `);
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS facts_history (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        entity TEXT NOT NULL,
+        relation TEXT NOT NULL,
+        encrypted_value TEXT NOT NULL,
+        source_worker TEXT NOT NULL,
+        valid_from TEXT NOT NULL,
+        valid_to TEXT NOT NULL,
+        change TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS facts_history_key
+        ON facts_history(entity, relation, valid_to DESC);
+    `);
   }
   workspacePath;
   debugMode;
@@ -9577,17 +10277,30 @@ var WorldStateDB = class {
   keyPath;
   dbPath;
   encryptionKey;
+  /**
+   * Append the CURRENTLY-stored fact for (e, r) to the history ledger before it
+   * is overwritten/deleted, timestamped [its recorded time → now]. No-op when
+   * there is no current row. The value stays encrypted with the same key.
+   */
+  archiveCurrentFact(e, r, change, validTo) {
+    const row = this.db.prepare("SELECT encrypted_value, source_worker, timestamp FROM facts WHERE entity = ? AND relation = ?").get(e, r);
+    if (!row) return;
+    this.db.prepare(
+      `INSERT INTO facts_history (entity, relation, encrypted_value, source_worker, valid_from, valid_to, change)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`
+    ).run(e, r, row.encrypted_value, row.source_worker, row.timestamp, validTo, change);
+  }
   initEncryptionKey() {
-    if (fs20.existsSync(this.keyPath)) {
-      this.encryptionKey = fs20.readFileSync(this.keyPath);
+    if (fs23.existsSync(this.keyPath)) {
+      this.encryptionKey = fs23.readFileSync(this.keyPath);
     } else {
-      this.encryptionKey = crypto3.randomBytes(32);
-      fs20.writeFileSync(this.keyPath, this.encryptionKey);
+      this.encryptionKey = crypto4.randomBytes(32);
+      fs23.writeFileSync(this.keyPath, this.encryptionKey);
     }
   }
   encrypt(text) {
-    const iv = crypto3.randomBytes(16);
-    const cipher = crypto3.createCipheriv("aes-256-gcm", this.encryptionKey, iv);
+    const iv = crypto4.randomBytes(16);
+    const cipher = crypto4.createCipheriv("aes-256-gcm", this.encryptionKey, iv);
     let encrypted = cipher.update(text, "utf8", "hex");
     encrypted += cipher.final("hex");
     const authTag = cipher.getAuthTag().toString("hex");
@@ -9599,14 +10312,14 @@ var WorldStateDB = class {
     const [ivHex, authTagHex, encryptedHex] = parts;
     const iv = Buffer.from(ivHex, "hex");
     const authTag = Buffer.from(authTagHex, "hex");
-    const decipher = crypto3.createDecipheriv("aes-256-gcm", this.encryptionKey, iv);
+    const decipher = crypto4.createDecipheriv("aes-256-gcm", this.encryptionKey, iv);
     decipher.setAuthTag(authTag);
     let decrypted = decipher.update(encryptedHex, "hex", "utf8");
     decrypted += decipher.final("utf8");
     return decrypted;
   }
   addEntry(workerId, summary) {
-    const id = crypto3.randomUUID();
+    const id = crypto4.randomUUID();
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
     const payload = JSON.stringify({ summary });
     const encryptedPayload = this.encrypt(payload);
@@ -9654,8 +10367,9 @@ var WorldStateDB = class {
     const r = normalizeKey(relation);
     const v = value.trim();
     if (!e || !r || !v) return;
+    const now = timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
     const encrypted = this.encrypt(JSON.stringify({ value: v }));
-    const stmt = this.db.prepare(`
+    const upsert = this.db.prepare(`
       INSERT INTO facts (entity, relation, encrypted_value, source_worker, timestamp)
       VALUES (?, ?, ?, ?, ?)
       ON CONFLICT(entity, relation) DO UPDATE SET
@@ -9663,7 +10377,20 @@ var WorldStateDB = class {
         source_worker   = excluded.source_worker,
         timestamp       = excluded.timestamp
     `);
-    stmt.run(e, r, encrypted, sourceWorker, timestamp ?? (/* @__PURE__ */ new Date()).toISOString());
+    const tx = this.db.transaction(() => {
+      const current = this.db.prepare("SELECT encrypted_value FROM facts WHERE entity = ? AND relation = ?").get(e, r);
+      if (current) {
+        let prevValue = null;
+        try {
+          prevValue = JSON.parse(this.decrypt(current.encrypted_value)).value;
+        } catch {
+          prevValue = null;
+        }
+        if (prevValue !== v) this.archiveCurrentFact(e, r, "update", now);
+      }
+      upsert.run(e, r, encrypted, sourceWorker, now);
+    });
+    tx();
     this.dumpDebugIfNeeded();
   }
   rowToFact(row) {
@@ -9732,32 +10459,99 @@ var WorldStateDB = class {
     const e = normalizeKey(entity);
     const r = normalizeKey(relation);
     if (!e || !r) return false;
-    const result = this.db.prepare("DELETE FROM facts WHERE entity = ? AND relation = ?").run(e, r);
-    return result.changes > 0;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const tx = this.db.transaction(() => {
+      this.archiveCurrentFact(e, r, "delete", now);
+      return this.db.prepare("DELETE FROM facts WHERE entity = ? AND relation = ?").run(e, r);
+    });
+    return tx().changes > 0;
   }
-  /** Delete every fact. Returns how many were removed. */
+  /** Delete every fact. Returns how many were removed. History is preserved. */
   clearFacts() {
-    return this.db.prepare("DELETE FROM facts").run().changes;
-  }
-  // ── Export / Import ──────────────────────────
-  //
-  //  Knowledge travels DECRYPTED in the export bundle (a portable plaintext
-  //  JSON file — the encryption key never leaves this machine) and re-encrypts
-  //  with the LOCAL key on import.
-  exportKnowledge() {
-    return { facts: this.getAllFacts(), worldLog: this.getAllEntries() };
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const tx = this.db.transaction(() => {
+      const rows = this.db.prepare("SELECT entity, relation, encrypted_value, source_worker, timestamp FROM facts").all();
+      const archive = this.db.prepare(
+        `INSERT INTO facts_history (entity, relation, encrypted_value, source_worker, valid_from, valid_to, change)
+         VALUES (?, ?, ?, ?, ?, ?, 'clear')`
+      );
+      for (const row of rows) {
+        archive.run(row.entity, row.relation, row.encrypted_value, row.source_worker, row.timestamp, now);
+      }
+      return this.db.prepare("DELETE FROM facts").run().changes;
+    });
+    return tx();
   }
+  // ── History + restore (undo) ──────────────────
   /**
-   * Merge imported knowledge. Facts upsert on (entity, relation) with
-   * newer-timestamp-wins (a local fact newer than the imported one is kept);
-   * log entries append with fresh ids, skipping exact duplicates
-   * (worker + timestamp + summary). Returns counts of what actually landed.
+   * Prior values for one (entity, relation), newest-first — the durable trail of
+   * what this fact used to be before it was overwritten or deleted. Decrypted
+   * here (the ciphertext never leaves this process).
    */
-  importKnowledge(data) {
-    let facts = 0;
-    let logEntries = 0;
-    if (Array.isArray(data.facts)) {
-      const local = new Map(this.getAllFacts().map((f) => [`${f.entity}\0${f.relation}`, f.timestamp]));
+  getFactHistory(entity, relation) {
+    const e = normalizeKey(entity);
+    const r = normalizeKey(relation);
+    if (!e || !r) return [];
+    const rows = this.db.prepare(
+      `SELECT encrypted_value, source_worker, valid_from, valid_to, change
+         FROM facts_history WHERE entity = ? AND relation = ? ORDER BY valid_to DESC, id DESC`
+    ).all(e, r);
+    return rows.map((row) => {
+      let value;
+      try {
+        value = JSON.parse(this.decrypt(row.encrypted_value)).value;
+      } catch {
+        value = "[Decryption Failed]";
+      }
+      return { value, sourceWorker: row.source_worker, validFrom: row.valid_from, validTo: row.valid_to, change: row.change };
+    });
+  }
+  /**
+   * Restore a historical value for (entity, relation) as the current fact. The
+   * value currently in place (if any) is itself archived first, so restore is
+   * undoable. When `validFrom` is given, restores that exact historical entry;
+   * otherwise restores the most recent one. Returns whether anything was restored.
+   */
+  restoreFact(entity, relation, validFrom) {
+    const e = normalizeKey(entity);
+    const r = normalizeKey(relation);
+    if (!e || !r) return false;
+    const row = validFrom ? this.db.prepare(
+      `SELECT encrypted_value, source_worker FROM facts_history
+           WHERE entity = ? AND relation = ? AND valid_from = ? ORDER BY id DESC LIMIT 1`
+    ).get(e, r, validFrom) : this.db.prepare(
+      `SELECT encrypted_value, source_worker FROM facts_history
+           WHERE entity = ? AND relation = ? ORDER BY valid_to DESC, id DESC LIMIT 1`
+    ).get(e, r);
+    if (!row) return false;
+    let value;
+    try {
+      value = JSON.parse(this.decrypt(row.encrypted_value)).value;
+    } catch {
+      return false;
+    }
+    this.upsertFact(e, r, value, `${row.source_worker} (restored)`);
+    return true;
+  }
+  // ── Export / Import ──────────────────────────
+  //
+  //  Knowledge travels DECRYPTED in the export bundle (a portable plaintext
+  //  JSON file — the encryption key never leaves this machine) and re-encrypts
+  //  with the LOCAL key on import.
+  exportKnowledge() {
+    return { facts: this.getAllFacts(), worldLog: this.getAllEntries() };
+  }
+  /**
+   * Merge imported knowledge. Facts upsert on (entity, relation) with
+   * newer-timestamp-wins (a local fact newer than the imported one is kept);
+   * log entries append with fresh ids, skipping exact duplicates
+   * (worker + timestamp + summary). Returns counts of what actually landed.
+   */
+  importKnowledge(data) {
+    let facts = 0;
+    let logEntries = 0;
+    if (Array.isArray(data.facts)) {
+      const local = new Map(this.getAllFacts().map((f) => [`${f.entity}\0${f.relation}`, f.timestamp]));
       for (const f of data.facts) {
         if (!f || typeof f.entity !== "string" || typeof f.relation !== "string" || typeof f.value !== "string") continue;
         const key = `${normalizeKey(f.entity)}\0${normalizeKey(f.relation)}`;
@@ -9777,7 +10571,7 @@ var WorldStateDB = class {
         const timestamp = e.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
         const key = `${workerId}\0${timestamp}\0${e.summary}`;
         if (seen.has(key)) continue;
-        stmt.run(crypto3.randomUUID(), timestamp, workerId, this.encrypt(JSON.stringify({ summary: e.summary })));
+        stmt.run(crypto4.randomUUID(), timestamp, workerId, this.encrypt(JSON.stringify({ summary: e.summary })));
         seen.add(key);
         logEntries++;
       }
@@ -9787,9 +10581,9 @@ var WorldStateDB = class {
   dumpDebugIfNeeded() {
     if (!this.debugMode) return;
     try {
-      const dumpPath = path21.join(os6.tmpdir(), "cascade_world_state_debug.json");
+      const dumpPath = path24.join(os6.tmpdir(), "cascade_world_state_debug.json");
       const entries = this.getAllEntries();
-      fs20.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+      fs23.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
     } catch (err) {
       console.error("Failed to dump debug world state", err);
     }
@@ -9826,6 +10620,894 @@ var PrivacyPaths = class {
     return relativePaths.some((p) => this.isLocalOnly(p));
   }
 };
+var ignore3 = ignoreFactory.default ?? ignoreFactory;
+var CascadeIgnore = class {
+  ig;
+  loaded = false;
+  constructor() {
+    this.ig = ignore3();
+    this.ig.add([
+      ".cascade/keystore.enc",
+      ".cascade/memory.db",
+      ".env",
+      ".env.*",
+      "*.pem",
+      "*.key",
+      "id_rsa",
+      "id_ed25519"
+    ]);
+  }
+  async load(workspacePath) {
+    const filePath = path24.join(workspacePath, ".cascadeignore");
+    try {
+      const content = await fs4.readFile(filePath, "utf-8");
+      const lines = content.split("\n").filter((l) => l.trim() && !l.startsWith("#"));
+      this.ig.add(lines);
+      this.loaded = true;
+    } catch {
+    }
+  }
+  isIgnored(filePath, workspacePath) {
+    try {
+      const relative = workspacePath ? path24.relative(workspacePath, filePath) : filePath;
+      return this.ig.ignores(relative);
+    } catch {
+      return false;
+    }
+  }
+  getPatterns() {
+    return this.ig._rules?.map((r) => r.pattern) ?? [];
+  }
+};
+
+// src/retrieval/retriever.ts
+function reciprocalRankFusion(lists, rrfK = 60) {
+  const scores = /* @__PURE__ */ new Map();
+  const items = /* @__PURE__ */ new Map();
+  for (const list of lists) {
+    list.forEach((item, rank3) => {
+      scores.set(item.id, (scores.get(item.id) ?? 0) + 1 / (rrfK + rank3));
+      if (!items.has(item.id)) items.set(item.id, item);
+    });
+  }
+  return [...items.values()].map((item) => ({ ...item, score: scores.get(item.id) ?? 0 })).sort((a, b) => b.score - a.score);
+}
+var Retriever = class {
+  constructor(embedder, store, reranker) {
+    this.embedder = embedder;
+    this.store = store;
+    this.reranker = reranker;
+  }
+  embedder;
+  store;
+  reranker;
+  /** Chunk model this retriever embeds with (for cache/version keys). */
+  get embedModel() {
+    return this.embedder.model;
+  }
+  /** True when this source is already indexed under the current embed model. */
+  isIndexed(namespace, sourceId) {
+    return this.store.hasSource(namespace, sourceId, this.embedder.model);
+  }
+  /**
+   * Embed and store a source's chunks. Skips work when the source is already
+   * indexed under the current embed model (so re-runs don't re-embed). Returns
+   * the number of chunks newly indexed.
+   */
+  async index(namespace, sourceId, chunks) {
+    if (chunks.length === 0 || this.isIndexed(namespace, sourceId)) return 0;
+    const vectors = await this.embedder.embed(chunks.map((c) => c.text));
+    const records = chunks.map((c, i) => ({
+      chunk: { id: `${namespace}:${sourceId}:${c.ord}`, text: c.text, sourceId, ord: c.ord, meta: { namespace } },
+      vector: vectors[i] ?? []
+    })).filter((r) => r.vector.length > 0);
+    this.store.upsert(records, this.embedder.model);
+    return records.length;
+  }
+  /** Hybrid search: lexical ∪ dense, fused with RRF, then optionally reranked. */
+  async search(query, opts) {
+    const candidates = opts.candidates ?? 30;
+    const k = opts.k ?? 6;
+    const base = { namespace: opts.namespace, k: candidates, sourceIds: opts.sourceIds };
+    const lexical = this.store.lexicalSearch(query, base);
+    let dense = [];
+    try {
+      const [qvec] = await this.embedder.embed([query]);
+      if (qvec && qvec.length) dense = this.store.denseSearch(qvec, base);
+    } catch {
+    }
+    const fused = reciprocalRankFusion([lexical, dense], opts.rrfK ?? 60);
+    if (this.reranker && opts.rerank !== false && fused.length > 1) {
+      return this.reranker.rerank(query, fused, k);
+    }
+    return fused.slice(0, k);
+  }
+};
+
+// src/retrieval/sqlite-store.ts
+function normalize(vec) {
+  const f = new Float32Array(vec);
+  let sum = 0;
+  for (let i = 0; i < f.length; i++) sum += f[i] * f[i];
+  const norm = Math.sqrt(sum) || 1;
+  for (let i = 0; i < f.length; i++) f[i] /= norm;
+  return f;
+}
+function toBlob(f) {
+  return Buffer.from(f.buffer, f.byteOffset, f.byteLength);
+}
+function fromBlob(buf) {
+  return new Float32Array(buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength));
+}
+function ftsMatchExpr(query) {
+  const terms = (query.toLowerCase().match(/[a-z0-9]+/g) ?? []).filter((t) => t.length > 1).slice(0, 24);
+  if (terms.length === 0) return null;
+  return terms.map((t) => `"${t}"`).join(" OR ");
+}
+var SqliteVectorStore = class {
+  constructor(db) {
+    this.db = db;
+    this.migrate();
+  }
+  db;
+  migrate() {
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS kb_chunks (
+        chunk_id TEXT PRIMARY KEY,
+        namespace TEXT NOT NULL,
+        source_id TEXT NOT NULL,
+        ord INTEGER NOT NULL,
+        text TEXT NOT NULL,
+        embed_model TEXT NOT NULL,
+        dims INTEGER NOT NULL,
+        vector BLOB NOT NULL,
+        created_at INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_kb_chunks_ns_src ON kb_chunks(namespace, source_id);
+      CREATE VIRTUAL TABLE IF NOT EXISTS kb_fts USING fts5(
+        text, chunk_id UNINDEXED, namespace UNINDEXED, source_id UNINDEXED
+      );
+    `);
+  }
+  upsert(records, embedModel) {
+    if (records.length === 0) return;
+    const insChunk = this.db.prepare(
+      `INSERT OR REPLACE INTO kb_chunks (chunk_id, namespace, source_id, ord, text, embed_model, dims, vector, created_at)
+       VALUES (@chunk_id, @namespace, @source_id, @ord, @text, @embed_model, @dims, @vector, @created_at)`
+    );
+    const delFts = this.db.prepare("DELETE FROM kb_fts WHERE chunk_id = ?");
+    const insFts = this.db.prepare("INSERT INTO kb_fts (text, chunk_id, namespace, source_id) VALUES (?, ?, ?, ?)");
+    const now = Date.now();
+    const tx = this.db.transaction((rows) => {
+      for (const { chunk, vector } of rows) {
+        const f = normalize(vector);
+        insChunk.run({
+          chunk_id: chunk.id,
+          namespace: chunk.meta?.["namespace"] ?? "",
+          source_id: chunk.sourceId,
+          ord: chunk.ord,
+          text: chunk.text,
+          embed_model: embedModel,
+          dims: f.length,
+          vector: toBlob(f),
+          created_at: now
+        });
+        delFts.run(chunk.id);
+        insFts.run(chunk.text, chunk.id, chunk.meta?.["namespace"] ?? "", chunk.sourceId);
+      }
+    });
+    tx(records);
+  }
+  hasSource(namespace, sourceId, embedModel) {
+    const row = this.db.prepare("SELECT 1 FROM kb_chunks WHERE namespace = ? AND source_id = ? AND embed_model = ? LIMIT 1").get(namespace, sourceId, embedModel);
+    return !!row;
+  }
+  deleteSource(namespace, sourceId) {
+    this.db.prepare("DELETE FROM kb_chunks WHERE namespace = ? AND source_id = ?").run(namespace, sourceId);
+    this.db.prepare("DELETE FROM kb_fts WHERE namespace = ? AND source_id = ?").run(namespace, sourceId);
+  }
+  lexicalSearch(query, opts) {
+    const expr = ftsMatchExpr(query);
+    if (!expr) return [];
+    const k = opts.k ?? 10;
+    const srcFilter = this.sourceFilter(opts.sourceIds, "kb_fts");
+    const rows = this.db.prepare(
+      `SELECT chunk_id, source_id, text, bm25(kb_fts) AS score
+         FROM kb_fts
+         WHERE kb_fts MATCH ? AND namespace = ? ${srcFilter.clause}
+         ORDER BY score ASC LIMIT ?`
+    ).all(expr, opts.namespace, ...srcFilter.params, k);
+    return rows.map((r, i) => ({ id: r.chunk_id, sourceId: r.source_id, ord: i, text: r.text, score: -r.score }));
+  }
+  denseSearch(queryVector, opts) {
+    const q = normalize(queryVector);
+    const k = opts.k ?? 10;
+    const srcFilter = this.sourceFilter(opts.sourceIds, "kb_chunks");
+    const rows = this.db.prepare(
+      `SELECT chunk_id, source_id, ord, text, vector FROM kb_chunks
+         WHERE namespace = ? ${srcFilter.clause}`
+    ).all(opts.namespace, ...srcFilter.params);
+    const scored = rows.map((r) => {
+      const v = fromBlob(r.vector);
+      let dot = 0;
+      const n = Math.min(v.length, q.length);
+      for (let i = 0; i < n; i++) dot += v[i] * q[i];
+      return { id: r.chunk_id, sourceId: r.source_id, ord: r.ord, text: r.text, score: dot };
+    });
+    scored.sort((a, b) => b.score - a.score);
+    return scored.slice(0, k);
+  }
+  sourceFilter(sourceIds, table) {
+    if (!sourceIds || sourceIds.length === 0) return { clause: "", params: [] };
+    const placeholders = sourceIds.map(() => "?").join(", ");
+    return { clause: `AND ${table}.source_id IN (${placeholders})`, params: sourceIds };
+  }
+};
+
+// src/retrieval/code-chunk.ts
+var DEFAULTS = { targetChars: 1600, overlapLines: 2 };
+var BOUNDARY_RE = new RegExp(
+  [
+    /^\s*(export\s+)?(default\s+)?(async\s+)?function\s+/,
+    // JS/TS function
+    /^\s*(export\s+)?(abstract\s+)?class\s+/,
+    // class (JS/TS/PY/…)
+    /^\s*(export\s+)?(interface|type|enum|namespace|module)\s+\w/,
+    // TS declarations
+    /^\s*(export\s+)?(const|let|var)\s+[\w$]+\s*[:=][^\n]*=>/,
+    // arrow-fn const
+    /^\s*(async\s+)?def\s+\w/,
+    // Python def
+    /^\s*(pub\s+)?(async\s+)?fn\s+\w/,
+    // Rust fn
+    /^\s*(pub\s+)?(struct|enum|trait|impl)\b/,
+    // Rust items
+    /^func\s+/,
+    // Go func
+    /^\s*(public|private|protected|internal|static|final|abstract)[\w\s<>,\[\]]*\s[\w$]+\s*\(/
+    // Java/C# member
+  ].map((r) => r.source).join("|")
+);
+function hardSplitByLines(lines, targetChars, overlapLines) {
+  const out = [];
+  let cur = [];
+  let curLen = 0;
+  for (const line of lines) {
+    if (curLen + line.length > targetChars && cur.length) {
+      out.push(cur.join("\n"));
+      cur = overlapLines > 0 ? cur.slice(-overlapLines) : [];
+      curLen = cur.reduce((n, l) => n + l.length + 1, 0);
+    }
+    cur.push(line);
+    curLen += line.length + 1;
+  }
+  if (cur.length) out.push(cur.join("\n"));
+  return out;
+}
+function chunkCode(text, opts = {}) {
+  const { targetChars, overlapLines } = { ...DEFAULTS, ...opts };
+  const normalized = text.replace(/\r\n/g, "\n").replace(/\s+$/, "");
+  if (!normalized.trim()) return [];
+  const lines = normalized.split("\n");
+  const boundaries = [0];
+  for (let i = 1; i < lines.length; i++) {
+    if (BOUNDARY_RE.test(lines[i])) boundaries.push(i);
+  }
+  boundaries.push(lines.length);
+  const segments = [];
+  for (let b = 0; b < boundaries.length - 1; b++) {
+    const seg = lines.slice(boundaries[b], boundaries[b + 1]).join("\n").replace(/^\n+|\n+$/g, "");
+    if (seg.trim()) segments.push(seg);
+  }
+  const chunks = [];
+  let cur = "";
+  for (const seg of segments) {
+    if (seg.length > targetChars) {
+      if (cur) {
+        chunks.push(cur);
+        cur = "";
+      }
+      chunks.push(...hardSplitByLines(seg.split("\n"), targetChars, overlapLines));
+      continue;
+    }
+    const candidate = cur ? `${cur}
+
+${seg}` : seg;
+    if (candidate.length > targetChars && cur) {
+      chunks.push(cur);
+      cur = seg;
+    } else cur = candidate;
+  }
+  if (cur.trim()) chunks.push(cur);
+  return chunks.map((text2, ord) => ({ text: text2.replace(/^\n+|\n+$/g, ""), ord }));
+}
+var heuristicCodeChunker = {
+  chunk: (text, opts) => chunkCode(text, opts)
+};
+function hashContent(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+function buildManifest(entries) {
+  const files = {};
+  for (const e of entries) files[e.path] = e.hash;
+  const root = createHash("sha256").update(Object.keys(files).sort().map((p) => `${p}:${files[p]}`).join("\n")).digest("hex");
+  return { files, root };
+}
+function diffManifest(oldManifest, next) {
+  const added = [];
+  const changed = [];
+  const removed = [];
+  const unchanged = [];
+  const old = oldManifest?.files ?? {};
+  for (const [p, h] of Object.entries(next.files)) {
+    if (!(p in old)) added.push(p);
+    else if (old[p] !== h) changed.push(p);
+    else unchanged.push(p);
+  }
+  for (const p of Object.keys(old)) if (!(p in next.files)) removed.push(p);
+  return { added, changed, removed, unchanged };
+}
+
+// src/retrieval/workspace-index.ts
+var DEFAULT_EXTENSIONS = [
+  "ts",
+  "tsx",
+  "js",
+  "jsx",
+  "mjs",
+  "cjs",
+  "py",
+  "go",
+  "rs",
+  "java",
+  "rb",
+  "php",
+  "c",
+  "h",
+  "cpp",
+  "hpp",
+  "cc",
+  "cs",
+  "swift",
+  "kt",
+  "scala",
+  "sh",
+  "sql",
+  "md",
+  "json",
+  "yaml",
+  "yml",
+  "toml"
+];
+var DEFAULT_MAX_FILE_BYTES = 512 * 1024;
+var HARD_SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", ".next", "out", "target", "vendor", ".cache", "coverage"]);
+var WorkspaceIndex = class {
+  root;
+  db;
+  store;
+  retriever;
+  namespace;
+  extensions;
+  maxFileBytes;
+  isIgnored;
+  chunker;
+  constructor(opts) {
+    this.root = path24.resolve(opts.root);
+    this.db = opts.db;
+    this.namespace = opts.namespace ?? "code";
+    this.extensions = new Set((opts.extensions ?? DEFAULT_EXTENSIONS).map((e) => e.replace(/^\./, "").toLowerCase()));
+    this.maxFileBytes = opts.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES;
+    this.isIgnored = opts.isIgnored ?? (() => false);
+    this.chunker = opts.chunker ?? heuristicCodeChunker;
+    this.store = new SqliteVectorStore(this.db);
+    this.retriever = new Retriever(opts.embedder, this.store, opts.reranker);
+    this.migrate();
+  }
+  migrate() {
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS code_manifest (
+        namespace TEXT NOT NULL,
+        path TEXT NOT NULL,
+        hash TEXT NOT NULL,
+        PRIMARY KEY (namespace, path)
+      );
+    `);
+  }
+  /** Recursively collect indexable files under root (relative paths). */
+  async collectFiles() {
+    const out = [];
+    const walk = async (dir) => {
+      let entries;
+      try {
+        entries = await fs4.readdir(dir, { withFileTypes: true });
+      } catch {
+        return;
+      }
+      for (const entry of entries) {
+        const abs = path24.join(dir, entry.name);
+        if (entry.isDirectory()) {
+          if (HARD_SKIP_DIRS.has(entry.name) || this.isIgnored(abs)) continue;
+          await walk(abs);
+        } else if (entry.isFile()) {
+          const ext = path24.extname(entry.name).slice(1).toLowerCase();
+          if (!this.extensions.has(ext) || this.isIgnored(abs)) continue;
+          out.push(path24.relative(this.root, abs));
+        }
+      }
+    };
+    await walk(this.root);
+    return out;
+  }
+  loadStoredManifest() {
+    const rows = this.db.prepare("SELECT path, hash FROM code_manifest WHERE namespace = ?").all(this.namespace);
+    if (rows.length === 0) return null;
+    return buildManifest(rows);
+  }
+  saveManifest(manifest) {
+    const del = this.db.prepare("DELETE FROM code_manifest WHERE namespace = ?");
+    const ins = this.db.prepare("INSERT INTO code_manifest (namespace, path, hash) VALUES (?, ?, ?)");
+    const tx = this.db.transaction(() => {
+      del.run(this.namespace);
+      for (const [p, h] of Object.entries(manifest.files)) ins.run(this.namespace, p, h);
+    });
+    tx();
+  }
+  /**
+   * Scan the workspace and bring the index up to date, re-embedding only files
+   * whose contents changed since the last refresh. Returns what changed.
+   */
+  async refresh(onFile) {
+    const rels = await this.collectFiles();
+    const entries = [];
+    for (const rel of rels) {
+      try {
+        const abs = path24.join(this.root, rel);
+        const stat = await fs4.stat(abs);
+        if (stat.size > this.maxFileBytes) continue;
+        const buf = await fs4.readFile(abs);
+        if (buf.includes(0)) continue;
+        entries.push({ path: rel, hash: hashContent(buf), text: buf.toString("utf8") });
+      } catch {
+      }
+    }
+    const next = buildManifest(entries.map((e) => ({ path: e.path, hash: e.hash })));
+    const diff = diffManifest(this.loadStoredManifest(), next);
+    const byPath = new Map(entries.map((e) => [e.path, e.text]));
+    let chunks = 0;
+    for (const rel of [...diff.added, ...diff.changed]) {
+      onFile?.(rel);
+      this.store.deleteSource(this.namespace, rel);
+      const pieces = this.chunker.chunk(byPath.get(rel) ?? "", { filename: rel });
+      chunks += await this.retriever.index(this.namespace, rel, pieces);
+    }
+    for (const rel of diff.removed) this.store.deleteSource(this.namespace, rel);
+    this.saveManifest(next);
+    return {
+      filesIndexed: diff.added.length + diff.changed.length,
+      filesRemoved: diff.removed.length,
+      filesUnchanged: diff.unchanged.length,
+      chunks,
+      root: next.root
+    };
+  }
+  /** Hybrid + reranked search over the indexed codebase. */
+  async search(query, k = 8) {
+    return this.retriever.search(query, { namespace: this.namespace, k, candidates: 40 });
+  }
+};
+var DEFAULT_OPENAI_EMBED_MODEL = "text-embedding-3-small";
+var DEFAULT_OLLAMA_EMBED_MODEL = "nomic-embed-text";
+var BATCH = 96;
+var OpenAICompatibleEmbedder = class {
+  model;
+  client;
+  dimensions;
+  resolvedDims = 0;
+  constructor(opts) {
+    this.model = opts.model;
+    this.dimensions = opts.dimensions;
+    this.client = new OpenAI({ apiKey: opts.apiKey || "sk-none", baseURL: opts.baseURL });
+  }
+  get dims() {
+    return this.dimensions ?? this.resolvedDims;
+  }
+  async embed(texts) {
+    if (texts.length === 0) return [];
+    const out = [];
+    for (let i = 0; i < texts.length; i += BATCH) {
+      const batch = texts.slice(i, i + BATCH).map((t) => t.trim() ? t : " ");
+      const res = await this.client.embeddings.create({
+        model: this.model,
+        input: batch,
+        ...this.dimensions ? { dimensions: this.dimensions } : {}
+      });
+      const rows = [...res.data].sort((a, b) => a.index - b.index);
+      for (const row of rows) {
+        const vec = row.embedding;
+        if (!this.resolvedDims) this.resolvedDims = vec.length;
+        out.push(vec);
+      }
+    }
+    return out;
+  }
+};
+var EMBED_CAPABLE = /* @__PURE__ */ new Set(["openai", "openai-compatible", "ollama"]);
+function embedderFromProviders(providers, opts = {}) {
+  const ranked = [...providers].sort((a, b) => rank(a.type) - rank(b.type));
+  const chosen = ranked.find((p) => EMBED_CAPABLE.has(p.type) && (p.apiKey || p.type === "ollama" || p.baseUrl));
+  if (!chosen) return null;
+  const model = opts.model || (chosen.type === "ollama" ? DEFAULT_OLLAMA_EMBED_MODEL : DEFAULT_OPENAI_EMBED_MODEL);
+  return new OpenAICompatibleEmbedder({
+    apiKey: chosen.apiKey,
+    baseURL: chosen.baseUrl,
+    model,
+    dimensions: opts.dimensions
+  });
+}
+function rank(type) {
+  if (type === "openai") return 0;
+  if (type === "openai-compatible") return 1;
+  if (type === "ollama") return 2;
+  return 9;
+}
+var RERANK_INSTRUCTIONS = 'You are a search reranker. Given a query and numbered passages, return the passage numbers ordered from MOST to LEAST relevant to the query. Respond with ONLY a comma-separated list of numbers (e.g. "3,1,4"). Include only clearly relevant passages; omit irrelevant ones.';
+function parseRankOrder(reply, count) {
+  const nums = (reply.match(/\d+/g) ?? []).map((n) => Number(n) - 1);
+  const seen = /* @__PURE__ */ new Set();
+  const order = [];
+  for (const i of nums) {
+    if (i >= 0 && i < count && !seen.has(i)) {
+      seen.add(i);
+      order.push(i);
+    }
+  }
+  return order.length ? order : null;
+}
+var LLMReranker = class {
+  name = "llm-listwise";
+  complete;
+  /** Cap on candidates sent to the model (keeps the prompt + cost bounded). */
+  maxCandidates;
+  constructor(opts) {
+    this.complete = opts.complete;
+    this.maxCandidates = opts.maxCandidates ?? 20;
+  }
+  async rerank(query, candidates, topK) {
+    if (candidates.length <= 1) return candidates.slice(0, topK);
+    const pool = candidates.slice(0, this.maxCandidates);
+    const numbered = pool.map((c, i) => `[${i + 1}] ${c.text.slice(0, 600).replace(/\s+/g, " ").trim()}`).join("\n");
+    const prompt = `${RERANK_INSTRUCTIONS}
+
+Query: ${query}
+
+Passages:
+${numbered}
+
+Ranked passage numbers:`;
+    let order = null;
+    try {
+      order = parseRankOrder(await this.complete(prompt), pool.length);
+    } catch {
+      order = null;
+    }
+    if (!order) return candidates.slice(0, topK);
+    const ranked = order.map((i, rank3) => ({ ...pool[i], score: 1 / (rank3 + 1) }));
+    if (ranked.length < topK) {
+      const chosen = new Set(order);
+      for (let i = 0; i < pool.length && ranked.length < topK; i++) {
+        if (!chosen.has(i)) ranked.push({ ...pool[i], score: 0 });
+      }
+    }
+    return ranked.slice(0, topK);
+  }
+};
+function chatCompleterFromProviders(providers, opts = {}) {
+  const capable = /* @__PURE__ */ new Set(["openai", "openai-compatible", "ollama"]);
+  const ranked = [...providers].sort((a, b) => rank2(a.type) - rank2(b.type));
+  const chosen = ranked.find((p) => capable.has(p.type) && (p.apiKey || p.type === "ollama" || p.baseUrl));
+  if (!chosen) return null;
+  const model = opts.model || chosen.model || (chosen.type === "ollama" ? "llama3" : "gpt-4o-mini");
+  const client = new OpenAI({ apiKey: chosen.apiKey || "sk-none", baseURL: chosen.baseUrl });
+  return async (prompt) => {
+    const res = await client.chat.completions.create({
+      model,
+      messages: [{ role: "user", content: prompt }],
+      temperature: 0,
+      max_tokens: 60
+    });
+    return res.choices[0]?.message?.content ?? "";
+  };
+}
+function rank2(type) {
+  if (type === "openai") return 0;
+  if (type === "openai-compatible") return 1;
+  if (type === "ollama") return 2;
+  return 9;
+}
+
+// src/tools/code-search.ts
+var MAX_CHARS2 = 12e3;
+var CodeSearchTool = class extends BaseTool {
+  constructor(index) {
+    super();
+    this.index = index;
+  }
+  index;
+  name = "code_search";
+  description = "Search the indexed workspace codebase for code relevant to a query (semantic + keyword). Returns the most relevant snippets with their file paths. Use to find where something is implemented or how an API is used.";
+  inputSchema = {
+    type: "object",
+    properties: {
+      query: { type: "string", description: "What to look for (natural language or code terms)." },
+      k: { type: "number", description: "Max snippets to return (default 6)." }
+    },
+    required: ["query"]
+  };
+  async execute(input, _options) {
+    const query = String(input["query"] ?? "").trim();
+    if (!query) return 'Provide a "query" to search the codebase.';
+    const k = typeof input["k"] === "number" ? Math.max(1, Math.min(20, input["k"])) : 6;
+    let hits;
+    try {
+      hits = await this.index.search(query, k);
+    } catch (err) {
+      return `Code search failed: ${err instanceof Error ? err.message : String(err)}`;
+    }
+    if (hits.length === 0) return "No relevant code found in the workspace index.";
+    let out = "";
+    for (const h of hits) {
+      const block = `# ${h.sourceId}
+${h.text}
+`;
+      if (out.length + block.length > MAX_CHARS2) break;
+      out += (out ? "\n---\n\n" : "") + block;
+    }
+    return out;
+  }
+};
+
+// src/retrieval/graph.ts
+var STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "and",
+  "or",
+  "of",
+  "to",
+  "in",
+  "on",
+  "for",
+  "is",
+  "are",
+  "was",
+  "were",
+  "what",
+  "which",
+  "who",
+  "how",
+  "why",
+  "does",
+  "do",
+  "did",
+  "with",
+  "that",
+  "this",
+  "it",
+  "its",
+  "by",
+  "from",
+  "as",
+  "at",
+  "be",
+  "has",
+  "have",
+  "had",
+  "will"
+]);
+function tokenize(text) {
+  return (text.toLowerCase().match(/[a-z0-9_$.]+/g) ?? []).filter((t) => t.length > 1 && !STOPWORDS.has(t));
+}
+function entityTokens(entity) {
+  return entity.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length > 1);
+}
+var GraphRetriever = class {
+  constructor(source) {
+    this.source = source;
+  }
+  source;
+  /**
+   * Retrieve facts relevant to a query, expanding the graph a few hops from the
+   * entities the query mentions. Returns facts ranked by relevance.
+   */
+  search(query, opts = {}) {
+    const hops = opts.hops ?? 1;
+    const limit = opts.limit ?? 30;
+    const qTokens = new Set(tokenize(query));
+    if (qTokens.size === 0) return [];
+    const all = this.source.getAllFacts();
+    if (all.length === 0) return [];
+    const entityNames = [...new Set(all.map((f) => f.entity))];
+    const seeds = entityNames.filter((e) => {
+      const et = entityTokens(e);
+      return et.some((t) => qTokens.has(t)) || qTokens.has(e.toLowerCase());
+    });
+    if (seeds.length === 0) return [];
+    const visited = new Set(seeds);
+    let frontier = seeds;
+    const collected = /* @__PURE__ */ new Map();
+    for (let hop = 0; hop <= hops && frontier.length; hop++) {
+      const facts = this.source.getFactsForEntities(frontier);
+      for (const f of facts) {
+        const key = `${f.entity}\0${f.relation}`;
+        if (!collected.has(key)) collected.set(key, { ...f, score: 0, hop });
+      }
+      const next = [];
+      for (const f of facts) {
+        const valLower = f.value.toLowerCase();
+        for (const e of entityNames) {
+          if (visited.has(e)) continue;
+          if (valLower.includes(e.toLowerCase())) {
+            visited.add(e);
+            next.push(e);
+          }
+        }
+      }
+      frontier = next;
+    }
+    const ranked = [...collected.values()].map((f) => {
+      const hay = new Set(tokenize(`${f.entity} ${f.relation} ${f.value}`));
+      let overlap = 0;
+      for (const t of qTokens) if (hay.has(t)) overlap++;
+      return { ...f, score: overlap };
+    });
+    ranked.sort((a, b) => b.score - a.score || a.hop - b.hop || a.entity.localeCompare(b.entity));
+    return ranked.slice(0, limit);
+  }
+  /** Human-readable "- entity relation value" lines for injection into a run. */
+  format(facts) {
+    return facts.map((f) => `- ${f.entity} ${f.relation} ${f.value}`).join("\n");
+  }
+};
+
+// src/tools/graph-search.ts
+var MAX_CHARS3 = 8e3;
+var GraphSearchTool = class extends BaseTool {
+  name = "knowledge_graph_search";
+  description = "Search the project knowledge graph (learned entity\u2192relation\u2192value facts) for information related to a query, expanding a couple of hops across relationships. Use for relational or multi-hop questions about the project.";
+  inputSchema = {
+    type: "object",
+    properties: {
+      query: { type: "string", description: "What to look up (mention the entities of interest)." },
+      hops: { type: "number", description: "Relationship hops to expand (default 1, max 3)." }
+    },
+    required: ["query"]
+  };
+  retriever;
+  constructor(source) {
+    super();
+    this.retriever = new GraphRetriever(source);
+  }
+  async execute(input, _options) {
+    const query = String(input["query"] ?? "").trim();
+    if (!query) return 'Provide a "query" naming the entities to look up.';
+    const hops = typeof input["hops"] === "number" ? Math.max(0, Math.min(3, input["hops"])) : 1;
+    const facts = this.retriever.search(query, { hops, limit: 40 });
+    if (facts.length === 0) return "No related facts found in the project knowledge graph.";
+    const formatted = this.retriever.format(facts);
+    return formatted.length > MAX_CHARS3 ? `${formatted.slice(0, MAX_CHARS3)}
+\u2026` : formatted;
+  }
+};
+
+// src/core/context/compaction.ts
+function estimateTokens(text) {
+  if (!text) return 0;
+  return Math.max(1, Math.ceil(text.length / 4));
+}
+function contentToText(content) {
+  if (typeof content === "string") return content;
+  return content.map((c) => c.type === "text" ? c.text : c.type === "tool_result" ? c.content : `[${c.type}]`).join(" ");
+}
+function messagesTokens(messages) {
+  return messages.reduce((n, m) => n + estimateTokens(contentToText(m.content)), 0);
+}
+function atomize(text, maxChars) {
+  const seps = ["\n\n", "\n", ". ", " "];
+  let units = [text];
+  for (const sep of seps) {
+    if (units.every((u) => u.length <= maxChars)) break;
+    const next = [];
+    for (const u of units) {
+      if (u.length <= maxChars) {
+        next.push(u);
+        continue;
+      }
+      const parts = u.split(sep);
+      parts.forEach((p, i) => next.push(i < parts.length - 1 ? p + sep : p));
+    }
+    units = next;
+  }
+  const out = [];
+  for (const u of units) {
+    if (u.length <= maxChars) out.push(u);
+    else for (let i = 0; i < u.length; i += maxChars) out.push(u.slice(i, i + maxChars));
+  }
+  return out;
+}
+function chunkText(text, opts) {
+  const maxChars = Math.max(1, Math.floor(opts.maxTokens * 4));
+  const overlap = Math.min(maxChars - 1, Math.max(0, Math.floor(maxChars * (opts.overlapRatio ?? 0.1))));
+  const trimmed = text.trim();
+  if (!trimmed) return [];
+  if (trimmed.length <= maxChars) return [trimmed];
+  const units = atomize(trimmed, maxChars);
+  const chunks = [];
+  let cur = "";
+  for (const u of units) {
+    if (cur && cur.length + u.length > maxChars) {
+      chunks.push(cur.trim());
+      cur = overlap > 0 ? cur.slice(-overlap) : "";
+    }
+    cur += u;
+  }
+  if (cur.trim()) chunks.push(cur.trim());
+  return chunks;
+}
+function needsCompaction(totalTokens, contextWindow, reserve = 0.2) {
+  if (!contextWindow || contextWindow <= 0) return false;
+  return totalTokens > contextWindow * (1 - reserve);
+}
+async function mapReduceCompact(text, opts) {
+  const capChars = opts.capTokens * 4;
+  let working = text;
+  let truncated = false;
+  if (working.length > capChars) {
+    working = working.slice(0, capChars);
+    truncated = true;
+  }
+  const instruction = opts.instruction ?? "Summarize this content, preserving key facts, names, numbers, and decisions.";
+  let chunks = chunkText(working, { maxTokens: opts.chunkTokens });
+  if (chunks.length <= 1) return { text: working, chunks: chunks.length, calls: 0, truncated };
+  let calls = 0;
+  let parts = await Promise.all(
+    chunks.map((c, i) => {
+      calls++;
+      return opts.summarize(c, `${instruction} (part ${i + 1} of ${chunks.length})`);
+    })
+  );
+  let combined = parts.join("\n\n");
+  const maxPasses = opts.maxReducePasses ?? 3;
+  for (let pass = 0; pass < maxPasses && estimateTokens(combined) > opts.targetTokens; pass++) {
+    const groups = chunkText(combined, { maxTokens: opts.chunkTokens });
+    if (groups.length <= 1) break;
+    parts = await Promise.all(
+      groups.map((g) => {
+        calls++;
+        return opts.summarize(g, "Merge these partial summaries into one cohesive summary; keep all distinct facts.");
+      })
+    );
+    combined = parts.join("\n\n");
+  }
+  const note = truncated ? "\n\n[Note: input exceeded the extended-context cap and was truncated.]" : "";
+  return { text: combined + note, chunks: chunks.length, calls, truncated };
+}
+async function rollingSummary(messages, opts) {
+  if (messages.length <= opts.keepRecent) return messages;
+  const older = messages.slice(0, messages.length - opts.keepRecent);
+  const recent = messages.slice(messages.length - opts.keepRecent);
+  const transcript = older.map((m) => `${m.role}: ${contentToText(m.content)}`).join("\n");
+  const summary = await opts.summarize(
+    transcript,
+    "Summarize this earlier conversation. Preserve facts, decisions, names, numbers, and any open threads or todos."
+  );
+  const summaryMessage = {
+    role: "system",
+    content: `Summary of earlier conversation (folded to fit the context window):
+${summary}`
+  };
+  return [summaryMessage, ...recent];
+}
 
 // src/core/steering/guidance.ts
 var GuidanceQueue = class {
@@ -9852,10 +11534,22 @@ var GuidanceQueue = class {
 };
 
 // src/core/cascade.ts
+function buildContextualPrompt(prompt, history = []) {
+  const recent = history.slice(-6);
+  if (recent.length === 0) return prompt;
+  const asText = (content) => typeof content === "string" ? content : content.map((b) => b.type === "text" ? b.text : "[non-text]").join(" ");
+  const block = recent.map((m) => `${m.role === "assistant" ? "Assistant" : "User"}: ${asText(m.content).slice(0, 2e3)}`).join("\n");
+  return `Recent conversation (for context \u2014 the user is continuing it; resolve their latest message with this in mind):
+${block}
+
+Latest user message:
+${prompt}`;
+}
 var Cascade = class _Cascade extends EventEmitter {
   router;
   toolRegistry;
   mcpClient;
+  codeIndex;
   config;
   /** Orchestration decisions for the CURRENT run — cleared on each run(). */
   decisionLog = [];
@@ -9913,7 +11607,10 @@ var Cascade = class _Cascade extends EventEmitter {
   }
   initOptionalFeatures() {
     if (this.config.cascadeAuto === true) {
-      this.perfTracker = new ModelPerformanceTracker();
+      this.perfTracker = new ModelPerformanceTracker(
+        this.config.routing?.perfStatsPath,
+        { readOnly: this.config.routing?.learnFromOutcomes === false }
+      );
       void this.perfTracker.load();
       this.taskAnalyzer = new TaskAnalyzer(this.perfTracker, this.config.autoBias ?? "balanced");
       this.router.setTaskAnalyzer(this.taskAnalyzer);
@@ -9955,6 +11652,41 @@ var Cascade = class _Cascade extends EventEmitter {
       this.emit("mcp:approval-required", { server });
     });
   }
+  /**
+   * Build the workspace code index and register the `code_search` tool. Uses the
+   * user's own provider key for embeddings (and, if chat-capable, reranking).
+   * The index persists to a per-workspace SQLite file; `autoRefresh` brings it
+   * up to date at init (incremental — only changed files re-embed).
+   */
+  async initCodeIndex() {
+    const ci = this.config.codeIndex;
+    const embedder = embedderFromProviders(this.config.providers);
+    if (!embedder) {
+      this.emit("log", { level: "warn", message: "Code index enabled but no embeddings-capable provider is configured \u2014 skipping." });
+      return;
+    }
+    const dbPath = ci.dbPath || path24.join(this.workspacePath, ".cascade", "code-index.db");
+    fs23.mkdirSync(path24.dirname(dbPath), { recursive: true });
+    const db = new Database(dbPath);
+    db.pragma("journal_mode = WAL");
+    const complete = chatCompleterFromProviders(this.config.providers);
+    const reranker = complete ? new LLMReranker({ complete }) : void 0;
+    const ignore4 = new CascadeIgnore();
+    await ignore4.load(this.workspacePath);
+    const index = new WorkspaceIndex({
+      root: this.workspacePath,
+      db,
+      embedder,
+      reranker,
+      isIgnored: (abs) => ignore4.isIgnored(abs, this.workspacePath)
+    });
+    if (ci.autoRefresh) {
+      const res = await index.refresh();
+      this.emit("log", { level: "info", message: `Code index refreshed: ${res.filesIndexed} indexed, ${res.filesUnchanged} unchanged, ${res.chunks} chunks.` });
+    }
+    this.codeIndex = index;
+    this.toolRegistry.register(new CodeSearchTool(index));
+  }
   recordDecision(kind, detail) {
     this.decisionLog.push({ at: (/* @__PURE__ */ new Date()).toISOString(), kind, detail });
   }
@@ -10019,6 +11751,87 @@ var Cascade = class _Cascade extends EventEmitter {
   resolvePlanApproval(approved, note, editedPlan) {
     this.pendingPlanApproval?.({ approved, note, editedPlan });
   }
+  // ── Extended-context approval ───────────────────────────────────────
+  // Same gate pattern: an oversized single input costs extra model calls to
+  // chunk + map-reduce, so we confirm before spending. No listener (headless)
+  // or a timeout means PROCEED — the feature is opt-in, and the run's budget
+  // cap is the real guardrail against runaway cost.
+  pendingContextApproval;
+  /** Resolve a pending extended-context confirmation from a UI listener. */
+  resolveContextApproval(approved) {
+    this.pendingContextApproval?.(approved);
+  }
+  async requestContextApproval(info) {
+    if (this.listenerCount("context:approval-required") === 0) return true;
+    return await new Promise((resolve) => {
+      const timeout = setTimeout(() => {
+        if (this.pendingContextApproval) {
+          this.pendingContextApproval = void 0;
+          resolve(true);
+        }
+      }, 12e4);
+      this.pendingContextApproval = (approved) => {
+        clearTimeout(timeout);
+        this.pendingContextApproval = void 0;
+        resolve(approved);
+      };
+      this.emit("context:approval-required", info);
+    });
+  }
+  /**
+   * Extended context: when enabled, compact an over-budget conversation history
+   * (rolling summary — cheap, automatic) and/or a single oversized input (chunk
+   * + map-reduce — confirm-gated) so the run fits the model's window. Returns a
+   * new options object with the compacted prompt/history; a no-op when disabled,
+   * when nothing overflows, or when the model window isn't known yet.
+   */
+  async applyExtendedContext(options) {
+    const ec = this.config.extendedContext;
+    if (!ec?.enabled) return options;
+    const windowTokens = this.router.getReferenceContextWindow();
+    if (!windowTokens) return options;
+    const reserve = 0.2;
+    const budget = Math.floor(windowTokens * (1 - reserve));
+    const multiplier = ec.maxMultiplier ?? 2;
+    const capTokens = windowTokens * multiplier;
+    const summarize = async (input, instruction) => {
+      const res = await this.router.generate("T3", {
+        messages: [{ role: "user", content: `${instruction}
+
+${input}` }],
+        maxTokens: 1024,
+        temperature: 0
+      });
+      return res.content;
+    };
+    let history = options.conversationHistory ?? [];
+    let prompt = options.prompt;
+    if (history.length > 4 && needsCompaction(messagesTokens(history), windowTokens, reserve)) {
+      try {
+        const before = history.length;
+        history = await rollingSummary(history, { summarize, keepRecent: 4, targetTokens: budget });
+        this.recordDecision("context", `Extended context: folded ${before - history.length + 1} earlier turns into a summary to fit the window`);
+        this.emit("context:compacted", { kind: "history", foldedTurns: before - (history.length - 1) });
+      } catch {
+      }
+    }
+    const inputTokens = estimateTokens(prompt);
+    if (inputTokens > windowTokens) {
+      const chunkTokens = Math.max(256, Math.floor(budget / 3));
+      const estChunks = Math.ceil(inputTokens / chunkTokens);
+      const approved = await this.requestContextApproval({ inputTokens, windowTokens, multiplier, estChunks });
+      if (approved) {
+        try {
+          const r = await mapReduceCompact(prompt, { summarize, chunkTokens, targetTokens: budget, capTokens });
+          prompt = r.text;
+          this.recordDecision("context", `Extended context: compacted a ${inputTokens}-token input via ${r.chunks} chunks (${r.calls} calls${r.truncated ? ", truncated at cap" : ""})`);
+          this.emit("context:compacted", { kind: "input", chunks: r.chunks, calls: r.calls, truncated: r.truncated });
+        } catch {
+        }
+      }
+    }
+    return { ...options, prompt, conversationHistory: history };
+  }
   /**
    * Autonomy control (used by the /auto command). 'auto' makes the next run
    * hands-off: the plan gate auto-approves and non-dangerous tools auto-approve,
@@ -10132,13 +11945,31 @@ ${last.partialOutput}` : "");
       if (this.config.tools.mcpServers?.length) {
         for (const server of this.config.tools.mcpServers) {
           try {
-            await this.mcpClient.connect(server);
+            const authProvider = server.oauthStore ? fileOAuthProvider(server.oauthStore) : void 0;
+            await this.mcpClient.connect(server, authProvider ? { authProvider } : {});
             this.toolRegistry.registerMcpTools(this.mcpClient);
           } catch (err) {
             console.error(`Failed to connect to MCP server "${server.name}":`, err);
           }
         }
       }
+      if (this.config.codeIndex?.enabled) {
+        try {
+          await this.initCodeIndex();
+        } catch (err) {
+          console.error("Failed to initialize workspace code index:", err);
+        }
+      }
+      if (this.config.knowledge?.factsExtraction !== false) {
+        try {
+          const ws = this.worldStateDB;
+          if (ws && ws.getAllFacts().length > 0) {
+            this.toolRegistry.register(new GraphSearchTool(ws));
+          }
+        } catch (err) {
+          console.error("Failed to register knowledge graph search:", err);
+        }
+      }
       const pluginPaths = this.config["plugins"];
       if (pluginPaths?.length) {
         for (const pluginPath of pluginPaths) {
@@ -10187,6 +12018,33 @@ ${last.partialOutput}` : "");
     const casual = /^(hi|hello|hey|greetings|thanks|thank you|thx|bye|goodbye|cya)$/i.test(prompt.trim().replace(/[!?.]+$/, ""));
     return casual;
   }
+  /**
+   * Pure small talk that a single tool-less model answers best: greetings,
+   * acknowledgements and self-identity questions. Deliberately NARROWER than
+   * looksLikeConversational — "what is X" / "show me Y" / "list Z" need tools
+   * or real lookup and stay on the worker path. Bare confirmations ("yes",
+   * "ok") in an ongoing conversation are task input, not small talk.
+   */
+  looksLikeSmallTalk(prompt, history = []) {
+    const p = prompt.trim();
+    if (this.isCasualGreeting(p)) return true;
+    if (/^(?:who|what)\b.*\byou\b/i.test(p) || /^what can you\b/i.test(p)) {
+      return p.split(/\s+/).length <= 12;
+    }
+    if (history.length === 0 && /^(?:hi|hello|hey|greetings)\b[\s,!.]*\w*[!.]*$/i.test(p)) return true;
+    return false;
+  }
+  /**
+   * A terse option/menu selection ("3", "b)", "option 2") replying to an
+   * ongoing conversation. These inherit the prior turn's intent — they are
+   * usually an ACTION choice, so they must not be short-circuited to a
+   * tool-less direct answer, and a context-free on-device hint about them
+   * is noise (the hint classifier never saw the conversation).
+   */
+  looksLikeTerseOptionReply(prompt) {
+    const p = prompt.trim();
+    return /^\(?(?:\d{1,2}|[a-d])[.)]?$/i.test(p) || /^(?:option|choice)\s+\d{1,2}$/i.test(p);
+  }
   looksLikeSimpleArtifactTask(prompt) {
     return /create .*\.(txt|md|json|csv)\b/i.test(prompt) && !/(research|compare|thorough|pdf|report|analy[sz]e|architecture|multi-agent)/i.test(prompt);
   }
@@ -10267,7 +12125,28 @@ ${last.partialOutput}` : "");
       return 0;
     }
   }
-  async determineComplexity(prompt, workspacePath, conversationHistory = []) {
+  /**
+   * Raises a raw complexity verdict (from the classifier LLM or a caller hint)
+   * to the tier the prompt's signals demand. A small model that under-rates
+   * clearly multi-step build work can't strand it below where it belongs:
+   * explicit build+scale signals floor it to Complex (full T1→T2→T3), and a
+   * single-deliverable build floors a "Simple" up to Moderate (one manager).
+   * Conservative on purpose — the source is free to go higher, and a manual
+   * tier override is the escape hatch. Records the decision it makes.
+   */
+  floorComplexity(prompt, verdict, source, reason) {
+    if (verdict !== "Complex" && this.looksClearlyComplex(prompt)) {
+      this.recordDecision("complexity", `Complex \u2014 heuristic floor over ${source} "${verdict}": explicit multi-step build/implementation signals (T1 engaged)`);
+      return "Complex";
+    }
+    if (verdict === "Simple" && this.looksLikeModerateBuild(prompt)) {
+      this.recordDecision("complexity", `Moderate \u2014 heuristic floor over ${source} "Simple": build signals without multi-system scale (single manager)`);
+      return "Moderate";
+    }
+    this.recordDecision("complexity", `${verdict} \u2014 ${source}${reason ? `: ${reason}` : ""}`);
+    return verdict;
+  }
+  async determineComplexity(prompt, workspacePath, conversationHistory = [], hint) {
     if (this.isCasualGreeting(prompt)) {
       this.recordDecision("complexity", "Simple \u2014 heuristic: casual greeting (no classifier call)");
       return "Simple";
@@ -10284,6 +12163,16 @@ ${last.partialOutput}` : "");
       this.recordDecision("complexity", "Simple \u2014 heuristic: read-only inquiry over existing content (single agent, no classifier call)");
       return "Simple";
     }
+    if (hint) {
+      if (this.looksLikeTerseOptionReply(prompt) && conversationHistory.length > 0) {
+        this.recordDecision(
+          "complexity",
+          `terse option reply \u2014 on-device hint "${hint}" ignored; classifying with conversation context`
+        );
+      } else {
+        return this.floorComplexity(prompt, hint, "on-device hint");
+      }
+    }
     let workspaceContext = "";
     try {
       const count = await this.countWorkspaceFiles(workspacePath);
@@ -10331,39 +12220,45 @@ ${prompt}` : prompt;
       const reason = content.replace(/^\S+\s*[—–-]*\s*/, "").trim();
       let verdict;
       if (match) {
-        verdict = match[1] === "simple" ? "Simple" : match[1] === "moderate" ? "Moderate" : "Complex";
-        if (verdict !== "Complex" && this.looksClearlyComplex(prompt)) {
-          this.recordDecision("complexity", `Complex \u2014 heuristic floor over classifier "${verdict}": explicit multi-step build/implementation signals (T1 engaged)`);
-          verdict = "Complex";
-        } else if (verdict === "Simple" && this.looksLikeModerateBuild(prompt)) {
-          this.recordDecision("complexity", 'Moderate \u2014 heuristic floor over classifier "Simple": build signals without multi-system scale (single manager)');
-          verdict = "Moderate";
-        } else {
-          this.recordDecision("complexity", `${verdict} \u2014 classifier: ${reason || "no reason given"}`);
-        }
+        const raw = match[1] === "simple" ? "Simple" : match[1] === "moderate" ? "Moderate" : "Complex";
+        verdict = this.floorComplexity(prompt, raw, "classifier", reason || "no reason given");
       } else {
         const words = prompt.trim().split(/\s+/).length;
         verdict = words <= 12 ? "Simple" : words >= 40 || this.looksClearlyComplex(prompt) ? "Complex" : "Moderate";
         this.recordDecision("complexity", `${verdict} \u2014 classifier output unparseable; defaulted by length/signals`);
       }
       return verdict;
-    } catch {
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err);
+      if (this.listenerCount("log") > 0) this.emit("log", { level: "warn", message: `Complexity classifier failed: ${detail}` });
+      else console.warn(`[cascade] Complexity classifier failed: ${detail}`);
       const followUpPrompt = /^(proceed|continue|go ahead|do it|yes|yep|ok|okay|carry on)$/i.test(prompt.trim());
       if (followUpPrompt && recentHistory.length > 0) {
         this.recordDecision("complexity", "Complex \u2014 classifier unavailable; short follow-up inherits prior context");
         return "Complex";
       }
-      this.recordDecision("complexity", "Moderate \u2014 classifier unavailable; defaulting to the mid-cost route");
+      this.recordDecision("complexity", `Moderate \u2014 classifier unavailable (${detail}); defaulting to the mid-cost route`);
       return "Moderate";
     }
   }
   async run(options) {
     await this.init();
     this.router.beginRun();
+    if (options.signal) setMaxListeners(64, options.signal);
     this.router.setRunSignal(options.signal);
     const startMs = Date.now();
     const taskId = randomUUID();
     this.decisionLog = [];
+    if (options.fastAnswer) {
+      return this.runFastAnswer(options, startMs, taskId);
+    }
+    const routingPrompt = options.routingPrompt ?? options.prompt;
+    const pinnedTier = ["T1", "T2", "T3"].includes(this.config.routing?.forceTier ?? "");
+    if (this.config.fastAnswer?.autoSimple !== false && !pinnedTier && this.looksLikeSmallTalk(routingPrompt, options.conversationHistory)) {
+      this.recordDecision("complexity", "Simple \u2014 heuristic: small talk \u2192 direct answer (no worker, no classifier call)");
+      return this.runFastAnswer(options, startMs, taskId, { auto: true });
+    }
+    options = await this.applyExtendedContext(options);
     const escalator = new PermissionEscalator(this.config.approvalTimeoutMs ?? 6e5, this.config.autonomy === "auto");
     escalator.on("permission:user-required", async (req) => {
       this.emit("permission:user-required", req);
@@ -10403,7 +12298,12 @@ ${prompt}` : prompt;
       complexity = forced;
       this.recordDecision("complexity", `${forced} \u2014 manually forced via routing.forceTier=${forceTier}`);
     } else {
-      complexity = await this.determineComplexity(options.prompt, options.workspacePath || process.cwd(), options.conversationHistory);
+      complexity = await this.determineComplexity(
+        routingPrompt,
+        options.workspacePath || process.cwd(),
+        options.conversationHistory,
+        options.complexityHint
+      );
     }
     this.telemetry.capture("cascade:session_start", {
       complexity,
@@ -10418,7 +12318,7 @@ ${prompt}` : prompt;
         const tierKey = tier.toLowerCase();
         if (this.config.models?.[tierKey]) return;
         try {
-          const model = await this.taskAnalyzer.selectModel(options.prompt, tier, this.router.getSelector());
+          const model = await this.taskAnalyzer.selectModel(routingPrompt, tier, this.router.getSelector());
           if (model) {
             this.router.overrideTierModel(tier, model);
             const taskType = this.taskAnalyzer.getLastProfile()?.type ?? "mixed";
@@ -10440,6 +12340,7 @@ ${prompt}` : prompt;
     }).join("  \xB7  "));
     const toolCreator = this.toolCreator;
     if (toolCreator) toolCreator.setPermissionEscalator(escalator);
+    const rootPrompt = buildContextualPrompt(options.prompt, options.conversationHistory);
     let finalOutput = "";
     let t2Results = [];
     let runError = null;
@@ -10498,7 +12399,7 @@ ${prompt}` : prompt;
         const assignment = {
           subtaskId: taskId,
           subtaskTitle: "Direct Request",
-          description: options.prompt,
+          description: rootPrompt,
           expectedOutput: "A complete and direct answer.",
           constraints: [],
           peerT3Ids: [],
@@ -10543,7 +12444,7 @@ ${prompt}` : prompt;
         const assignment = {
           sectionId: taskId,
           sectionTitle: "Direct Task",
-          description: options.prompt,
+          description: rootPrompt,
           expectedOutput: "A complete resolution of the task.",
           constraints: [],
           t3Subtasks: []
@@ -10555,7 +12456,17 @@ ${prompt}` : prompt;
         if (completed.length > 0) {
           finalOutput = t2Result.sectionSummary + "\n\n" + completed.map((r) => r.output).join("\n\n");
         } else {
-          finalOutput = "Task failed to complete successfully.";
+          const partial = t2Result.t3Results.map((r) => typeof r.output === "string" ? r.output : "").filter((o) => o.trim()).sort((a, b) => b.length - a.length)[0];
+          const reasons = Array.from(
+            new Set(t2Result.t3Results.flatMap((r) => r.issues ?? []).filter(Boolean))
+          );
+          if (partial) {
+            finalOutput = reasons.length ? `${partial}
+
+_(incomplete: ${reasons.join("; ")})_` : partial;
+          } else {
+            finalOutput = reasons.length ? `The task could not be completed: ${reasons.join("; ")}` : "The task could not be completed \u2014 the model returned no usable output.";
+          }
         }
       } else {
         const t1 = new T1Administrator(this.router, this.toolRegistry, this.config);
@@ -10579,7 +12490,7 @@ ${prompt}` : prompt;
             return decision;
           });
         }
-        const result = await t1.execute(options.prompt, options.images, void 0, options.signal);
+        const result = await t1.execute(rootPrompt, options.images, void 0, options.signal);
         finalOutput = result.output;
         t2Results = result.t2Results;
       }
@@ -10614,7 +12525,7 @@ ${prompt}` : prompt;
       if (this.taskAnalyzer) {
         try {
           const stats2 = this.router.getStats();
-          this.taskAnalyzer.recordRunOutcome(runError ? "failure" : "success", stats2.costByTier);
+          this.taskAnalyzer.recordRunOutcome(runError ? "failure" : "success", stats2.costByTier, stats2.totalTokens);
         } catch {
         }
       }
@@ -10637,6 +12548,10 @@ ${prompt}` : prompt;
     }
     const stats = this.router.getStats();
     const durationMs = Date.now() - startMs;
+    if (!runError && this.config.memory?.rememberSessions) {
+      void this.rememberSession(options, finalOutput).catch(() => {
+      });
+    }
     return {
       output: finalOutput,
       sessionId: options.sessionId ?? "",
@@ -10655,6 +12570,121 @@ ${prompt}` : prompt;
       costPercentByTier: this.router.getTierCostPercentages()
     };
   }
+  /**
+   * Direct single-model reply — the "fast answer" path. No planning, no workers,
+   * no tools, no artifact verification: the user's message (with recent history)
+   * answered by one mid-tier model, streamed as the primary output and shaped
+   * into the normal CascadeRunResult so persistence + the run receipt still work.
+   */
+  async runFastAnswer(options, startMs, taskId, { auto = false } = {}) {
+    const tier = "T2";
+    const selector = this.router.getSelector();
+    const model = options.fastAnswerModel ? selector.selectForTier(tier, options.fastAnswerModel) : selector.getCandidatesForTier(tier)[0] ?? selector.selectForTier(tier);
+    if (!model) {
+      throw new Error("No model is available for a fast answer \u2014 add a provider API key first.");
+    }
+    this.recordDecision(
+      "model",
+      `Fast answer${auto ? " (auto)" : ""} \u2192 ${model.provider}:${model.id} \u2014 direct single-model reply (no orchestration)`
+    );
+    this.emit("tier:status", { tierId: "fast", role: tier, status: "ACTIVE", model: `${model.provider}:${model.id}` });
+    let identityPrompt = "";
+    if (this.store) {
+      const identityId = options.identityId || this.config.defaultIdentityId;
+      if (identityId) {
+        const identity = this.store.listIdentities().find((i) => i.id === identityId);
+        if (identity?.systemPrompt) identityPrompt = identity.systemPrompt + "\n\n";
+      }
+    }
+    const history = (options.conversationHistory ?? []).slice(-10);
+    const userContent = options.images?.length ? [
+      { type: "text", text: options.prompt },
+      ...options.images.map((image) => ({ type: "image", image }))
+    ] : options.prompt;
+    const messages = [...history, { role: "user", content: userContent }];
+    const systemPrompt = identityPrompt + "You are Cascade in fast mode. Answer the user directly, accurately and concisely. You have no tools and cannot run code, browse, or create files \u2014 do not claim to.";
+    let streamed = "";
+    const requireVision = !!options.images?.length;
+    let result;
+    try {
+      result = await this.router.generate(
+        tier,
+        { messages, systemPrompt, maxTokens: 2048, ...requireVision ? {} : { model } },
+        (chunk) => {
+          streamed += chunk.text;
+          this.emit("stream:token", { tierId: "fast", text: chunk.text, primary: true });
+          options.streamCallback?.({ text: chunk.text, finishReason: null });
+        },
+        requireVision
+      );
+    } catch (err) {
+      if (err instanceof CascadeCancelledError || options.signal?.aborted) {
+        this.emit("run:cancelled", { taskId, reason: err instanceof Error ? err.message : "Task cancelled" });
+        this.emit("tier:status", { tierId: "fast", role: tier, status: "COMPLETED", model: `${model.provider}:${model.id}` });
+        const stats2 = this.router.getStats();
+        return {
+          output: streamed,
+          sessionId: options.sessionId ?? "",
+          taskId,
+          usage: {
+            inputTokens: 0,
+            outputTokens: 0,
+            totalTokens: stats2.totalTokens,
+            estimatedCostUsd: stats2.totalCostUsd
+          },
+          t2Results: [],
+          durationMs: Date.now() - startMs,
+          costByTier: stats2.costByTier,
+          tokensByTier: stats2.tokensByTier,
+          costByFeature: stats2.costByFeature,
+          costPercentByTier: this.router.getTierCostPercentages()
+        };
+      }
+      throw err;
+    } finally {
+      this.router.setRunSignal(void 0);
+    }
+    this.emit("tier:status", { tierId: "fast", role: tier, status: "COMPLETED", model: `${model.provider}:${model.id}` });
+    const stats = this.router.getStats();
+    return {
+      output: result.content || streamed,
+      sessionId: options.sessionId ?? "",
+      taskId,
+      usage: {
+        inputTokens: result.usage?.inputTokens ?? 0,
+        outputTokens: result.usage?.outputTokens ?? 0,
+        totalTokens: stats.totalTokens,
+        estimatedCostUsd: stats.totalCostUsd
+      },
+      t2Results: [],
+      durationMs: Date.now() - startMs,
+      costByTier: stats.costByTier,
+      tokensByTier: stats.tokensByTier,
+      costByFeature: stats.costByFeature,
+      costPercentByTier: this.router.getTierCostPercentages()
+    };
+  }
+  /**
+   * Distill a completed session into durable facts and store them in the
+   * project knowledge graph (opt-in via memory.rememberSessions). Best-effort:
+   * skips trivial exchanges, uses one cheap T3 call, and swallows all errors.
+   */
+  async rememberSession(options, output) {
+    const db = this.router.getWorldStateDB?.();
+    if (!db) return;
+    const history = options.conversationHistory ?? [];
+    if (!sessionWorthRemembering(history, options.prompt, output)) return;
+    const transcript = buildSessionTranscript(history, options.prompt, output);
+    const facts = await distillSessionFacts(transcript, async (prompt) => {
+      const res = await this.router.generate("T3", {
+        messages: [{ role: "user", content: prompt }],
+        maxTokens: 300,
+        temperature: 0
+      });
+      return res.content;
+    });
+    for (const f of facts) db.upsertFact(f.entity, f.relation, f.value, "session-memory");
+  }
   getRouter() {
     return this.router;
   }
@@ -10719,7 +12749,7 @@ var Keystore = class {
       const creds = await this.keytar.findCredentials(KEYTAR_SERVICE);
       this.cache = Object.fromEntries(creds.map((c) => [c.account, c.password]));
       this.backend = "keytar";
-      if (password && fs20.existsSync(this.storePath)) {
+      if (password && fs23.existsSync(this.storePath)) {
         try {
           const fileEntries = this.decryptFile(password);
           for (const [k, v] of Object.entries(fileEntries)) {
@@ -10738,8 +12768,8 @@ var Keystore = class {
         "Keystore unlock requires a password because the OS keychain (keytar) is not available on this system."
       );
     }
-    if (!fs20.existsSync(this.storePath)) {
-      const salt = crypto3.randomBytes(SALT_LEN);
+    if (!fs23.existsSync(this.storePath)) {
+      const salt = crypto4.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
       this.cache = {};
@@ -10752,8 +12782,8 @@ var Keystore = class {
   }
   /** Synchronous legacy unlock kept for AES-only environments. */
   unlockSync(password) {
-    if (!fs20.existsSync(this.storePath)) {
-      const salt = crypto3.randomBytes(SALT_LEN);
+    if (!fs23.existsSync(this.storePath)) {
+      const salt = crypto4.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
       this.cache = {};
@@ -10810,12 +12840,12 @@ var Keystore = class {
     }
   }
   decryptFile(password, knownSalt) {
-    if (!fs20.existsSync(this.storePath)) return {};
+    if (!fs23.existsSync(this.storePath)) return {};
     try {
       const { salt, ciphertext, iv, tag } = this.readRaw();
       const useSalt = knownSalt ?? salt;
       const key = this.masterKey ?? this.deriveKey(password, useSalt);
-      const decipher = crypto3.createDecipheriv(ALGORITHM, key, iv);
+      const decipher = crypto4.createDecipheriv(ALGORITHM, key, iv);
       decipher.setAuthTag(tag);
       const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
       return JSON.parse(decrypted.toString("utf-8"));
@@ -10826,28 +12856,28 @@ var Keystore = class {
   saveAll(data) {
     if (!this.masterKey) return;
     const raw = this.readRaw();
-    const iv = crypto3.randomBytes(IV_LEN);
-    const cipher = crypto3.createCipheriv(ALGORITHM, this.masterKey, iv);
+    const iv = crypto4.randomBytes(IV_LEN);
+    const cipher = crypto4.createCipheriv(ALGORITHM, this.masterKey, iv);
     const plaintext = Buffer.from(JSON.stringify(data), "utf-8");
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([raw.salt, iv, tag, ciphertext]);
-    fs20.mkdirSync(path21.dirname(this.storePath), { recursive: true });
-    fs20.writeFileSync(this.storePath, out, { mode: 384 });
+    fs23.mkdirSync(path24.dirname(this.storePath), { recursive: true });
+    fs23.writeFileSync(this.storePath, out, { mode: 384 });
   }
   writeWithSalt(data, salt) {
     if (!this.masterKey) throw new Error("writeWithSalt called before masterKey was set");
-    const iv = crypto3.randomBytes(IV_LEN);
-    const cipher = crypto3.createCipheriv(ALGORITHM, this.masterKey, iv);
+    const iv = crypto4.randomBytes(IV_LEN);
+    const cipher = crypto4.createCipheriv(ALGORITHM, this.masterKey, iv);
     const plaintext = Buffer.from(JSON.stringify(data), "utf-8");
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([salt, iv, tag, ciphertext]);
-    fs20.mkdirSync(path21.dirname(this.storePath), { recursive: true });
-    fs20.writeFileSync(this.storePath, out, { mode: 384 });
+    fs23.mkdirSync(path24.dirname(this.storePath), { recursive: true });
+    fs23.writeFileSync(this.storePath, out, { mode: 384 });
   }
   readRaw() {
-    const buf = fs20.readFileSync(this.storePath);
+    const buf = fs23.readFileSync(this.storePath);
     let offset = 0;
     const salt = buf.subarray(offset, offset + SALT_LEN);
     offset += SALT_LEN;
@@ -10859,50 +12889,11 @@ var Keystore = class {
     return { salt, iv, tag, ciphertext };
   }
   deriveKey(password, salt) {
-    return crypto3.pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, KEY_LEN, "sha256");
-  }
-};
-var ignore3 = ignoreFactory.default ?? ignoreFactory;
-var CascadeIgnore = class {
-  ig;
-  loaded = false;
-  constructor() {
-    this.ig = ignore3();
-    this.ig.add([
-      ".cascade/keystore.enc",
-      ".cascade/memory.db",
-      ".env",
-      ".env.*",
-      "*.pem",
-      "*.key",
-      "id_rsa",
-      "id_ed25519"
-    ]);
-  }
-  async load(workspacePath) {
-    const filePath = path21.join(workspacePath, ".cascadeignore");
-    try {
-      const content = await fs4.readFile(filePath, "utf-8");
-      const lines = content.split("\n").filter((l) => l.trim() && !l.startsWith("#"));
-      this.ig.add(lines);
-      this.loaded = true;
-    } catch {
-    }
-  }
-  isIgnored(filePath, workspacePath) {
-    try {
-      const relative = workspacePath ? path21.relative(workspacePath, filePath) : filePath;
-      return this.ig.ignores(relative);
-    } catch {
-      return false;
-    }
-  }
-  getPatterns() {
-    return this.ig._rules?.map((r) => r.pattern) ?? [];
+    return crypto4.pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, KEY_LEN, "sha256");
   }
 };
 async function loadCascadeMd(workspacePath) {
-  const filePath = path21.join(workspacePath, "CASCADE.md");
+  const filePath = path24.join(workspacePath, "CASCADE.md");
   try {
     const raw = await fs4.readFile(filePath, "utf-8");
     return parseCascadeMd(raw);
@@ -10933,7 +12924,7 @@ ${raw.trim()}`;
 var MemoryStore = class _MemoryStore {
   db;
   constructor(dbPath) {
-    fs20.mkdirSync(path21.dirname(dbPath), { recursive: true });
+    fs23.mkdirSync(path24.dirname(dbPath), { recursive: true });
     try {
       this.db = new Database(dbPath, { timeout: 5e3 });
       this.db.pragma("journal_mode = WAL");
@@ -11768,8 +13759,8 @@ Original error: ${err.message}`
     };
   }
 };
-function credentialsPath(globalDir) {
-  return path21.join(globalDir, GLOBAL_CREDENTIALS_FILE);
+function credentialsPath(globalDir2) {
+  return path24.join(globalDir2, GLOBAL_CREDENTIALS_FILE);
 }
 function providerKey(p) {
   if (p.type === "azure") {
@@ -11780,9 +13771,9 @@ function providerKey(p) {
 function isPersistable(p) {
   return Boolean(p.apiKey || p.authToken || p.type === "azure" || p.baseUrl);
 }
-function loadGlobalCredentials(globalDir) {
+function loadGlobalCredentials(globalDir2) {
   try {
-    const raw = fs20.readFileSync(credentialsPath(globalDir), "utf-8");
+    const raw = fs23.readFileSync(credentialsPath(globalDir2), "utf-8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed.providers)) return [];
     return parsed.providers.filter(
@@ -11792,15 +13783,15 @@ function loadGlobalCredentials(globalDir) {
     return [];
   }
 }
-function saveGlobalCredentials(globalDir, providers) {
-  const filePath = credentialsPath(globalDir);
-  fs20.mkdirSync(globalDir, { recursive: true, mode: 448 });
+function saveGlobalCredentials(globalDir2, providers) {
+  const filePath = credentialsPath(globalDir2);
+  fs23.mkdirSync(globalDir2, { recursive: true, mode: 448 });
   const body = { version: 1, providers: providers.filter(isPersistable) };
   const tmp = `${filePath}.tmp`;
-  fs20.writeFileSync(tmp, JSON.stringify(body, null, 2), { encoding: "utf-8", mode: 384 });
-  fs20.renameSync(tmp, filePath);
+  fs23.writeFileSync(tmp, JSON.stringify(body, null, 2), { encoding: "utf-8", mode: 384 });
+  fs23.renameSync(tmp, filePath);
   try {
-    fs20.chmodSync(filePath, 384);
+    fs23.chmodSync(filePath, 384);
   } catch {
   }
 }
@@ -11835,15 +13826,15 @@ var ConfigManager = class {
   /** `globalDirOverride` exists for tests — never point it at the real home dir there. */
   constructor(workspacePath = process.cwd(), globalDirOverride) {
     this.workspacePath = workspacePath;
-    this.globalDir = globalDirOverride ?? path21.join(os6.homedir(), GLOBAL_CONFIG_DIR);
+    this.globalDir = globalDirOverride ?? path24.join(os6.homedir(), GLOBAL_CONFIG_DIR);
   }
   async load() {
     this.config = await this.loadConfig();
     this.ignore = new CascadeIgnore();
     await this.ignore.load(this.workspacePath);
     this.cascadeMd = await loadCascadeMd(this.workspacePath);
-    this.keystore = new Keystore(path21.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
-    this.store = new MemoryStore(path21.join(this.workspacePath, CASCADE_DB_FILE));
+    this.keystore = new Keystore(path24.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
+    this.store = new MemoryStore(path24.join(this.workspacePath, CASCADE_DB_FILE));
     await this.injectEnvKeys();
     this.config.providers = mergeGlobalCredentials(this.config.providers, loadGlobalCredentials(this.globalDir));
     await this.ensureDefaultIdentity();
@@ -11867,8 +13858,8 @@ var ConfigManager = class {
     return this.workspacePath;
   }
   async save() {
-    const configPath = path21.join(this.workspacePath, CASCADE_CONFIG_FILE);
-    await fs4.mkdir(path21.dirname(configPath), { recursive: true });
+    const configPath = path24.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    await fs4.mkdir(path24.dirname(configPath), { recursive: true });
     await fs4.writeFile(configPath, JSON.stringify(this.config, null, 2), "utf-8");
     try {
       saveGlobalCredentials(this.globalDir, this.config.providers);
@@ -11897,7 +13888,7 @@ var ConfigManager = class {
     return configProvider?.apiKey;
   }
   async loadConfig() {
-    const configPath = path21.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    const configPath = path24.join(this.workspacePath, CASCADE_CONFIG_FILE);
     try {
       const raw = await fs4.readFile(configPath, "utf-8");
       return validateConfig(JSON.parse(raw));
@@ -12317,7 +14308,7 @@ function aggregateCostStats(sessions, opts = {}) {
 }
 
 // src/dashboard/server.ts
-var __dirname$1 = path21.dirname(fileURLToPath(import.meta.url));
+var __dirname$1 = path24.dirname(fileURLToPath(import.meta.url));
 var DashboardServer = class {
   app;
   httpServer;
@@ -12551,14 +14542,14 @@ var DashboardServer = class {
    */
   persistConfig() {
     try {
-      const configPath = path21.join(this.workspacePath, CASCADE_CONFIG_FILE);
-      fs20.mkdirSync(path21.dirname(configPath), { recursive: true });
-      fs20.writeFileSync(configPath, JSON.stringify(this.config, null, 2), "utf-8");
+      const configPath = path24.join(this.workspacePath, CASCADE_CONFIG_FILE);
+      fs23.mkdirSync(path24.dirname(configPath), { recursive: true });
+      fs23.writeFileSync(configPath, JSON.stringify(this.config, null, 2), "utf-8");
     } catch (err) {
       console.warn(`[dashboard] Failed to persist config: ${err instanceof Error ? err.message : String(err)}`);
     }
     try {
-      saveGlobalCredentials(path21.join(os6.homedir(), GLOBAL_CONFIG_DIR), this.config.providers ?? []);
+      saveGlobalCredentials(path24.join(os6.homedir(), GLOBAL_CONFIG_DIR), this.config.providers ?? []);
     } catch (err) {
       console.warn(`[dashboard] Failed to sync global credentials: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -12573,15 +14564,15 @@ var DashboardServer = class {
   resolveDashboardSecret() {
     const fromConfig = this.config.dashboard.secret ?? process.env["CASCADE_DASHBOARD_SECRET"];
     if (fromConfig) return fromConfig;
-    const secretPath = path21.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
+    const secretPath = path24.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
     try {
-      if (fs20.existsSync(secretPath)) {
-        const existing = fs20.readFileSync(secretPath, "utf-8").trim();
+      if (fs23.existsSync(secretPath)) {
+        const existing = fs23.readFileSync(secretPath, "utf-8").trim();
         if (existing.length >= 16) return existing;
       }
       const generated = randomUUID();
-      fs20.mkdirSync(path21.dirname(secretPath), { recursive: true });
-      fs20.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
+      fs23.mkdirSync(path24.dirname(secretPath), { recursive: true });
+      fs23.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
       if (this.config.dashboard.auth) {
         console.warn(
           `Dashboard auth enabled with no secret configured; persisted a generated secret to ${secretPath}. Set CASCADE_DASHBOARD_SECRET or config.dashboard.secret to override.`
@@ -12608,7 +14599,7 @@ var DashboardServer = class {
   // ── Setup ─────────────────────────────────────
   getGlobalStore() {
     if (!this.globalStore) {
-      const globalDbPath = path21.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path24.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       this.globalStore = new MemoryStore(globalDbPath);
     }
     return this.globalStore;
@@ -12877,12 +14868,12 @@ ${prompt}`;
     }
   }
   watchRuntimeChanges() {
-    const workspaceDbPath = path21.join(this.workspacePath, CASCADE_DB_FILE);
-    const globalDbPath = path21.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+    const workspaceDbPath = path24.join(this.workspacePath, CASCADE_DB_FILE);
+    const globalDbPath = path24.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
     const watchPaths = [workspaceDbPath, globalDbPath].filter((p, index, arr) => arr.indexOf(p) === index);
     for (const watchPath of watchPaths) {
-      if (!fs20.existsSync(watchPath)) continue;
-      fs20.watchFile(watchPath, { interval: 3e3 }, () => {
+      if (!fs23.existsSync(watchPath)) continue;
+      fs23.watchFile(watchPath, { interval: 3e3 }, () => {
         this.throttledBroadcast(watchPath === globalDbPath ? "global" : "workspace");
       });
     }
@@ -12904,7 +14895,7 @@ ${prompt}`;
   }
   setupRoutes() {
     const authRequired = this.config.dashboard.auth;
-    const auth = authMiddleware(this.dashboardSecret, authRequired);
+    const auth2 = authMiddleware(this.dashboardSecret, authRequired);
     const passwordHash = authRequired ? this.resolvePasswordHash() : null;
     const loginLimiter = rateLimit({
       windowMs: 15 * 60 * 1e3,
@@ -12963,7 +14954,7 @@ ${prompt}`;
         res.status(401).json({ error: "Invalid credentials" });
       }
     });
-    this.app.post("/api/force-halt", auth, mutationLimiter, (req, res) => {
+    this.app.post("/api/force-halt", auth2, mutationLimiter, (req, res) => {
       const body = req.body;
       const sessionId = typeof body["sessionId"] === "string" ? body["sessionId"] : void 0;
       const nodeId = typeof body["nodeId"] === "string" ? body["nodeId"] : void 0;
@@ -12972,7 +14963,7 @@ ${prompt}`;
       if (sessionId) this.socket.broadcastToRoom(`session:${sessionId}`, "session:halt", payload);
       res.json({ success: true, ...payload });
     });
-    this.app.post("/api/inject", auth, mutationLimiter, (req, res) => {
+    this.app.post("/api/inject", auth2, mutationLimiter, (req, res) => {
       const body = req.body;
       const message = typeof body["message"] === "string" ? body["message"] : void 0;
       const sessionId = typeof body["sessionId"] === "string" ? body["sessionId"] : void 0;
@@ -12987,11 +14978,11 @@ ${prompt}`;
       if (sessionId) this.socket.broadcastToRoom(`session:${sessionId}`, "session:message-injected", payload);
       res.json({ success: true, ...payload });
     });
-    this.app.get("/api/sessions", auth, (_req, res) => {
+    this.app.get("/api/sessions", auth2, (_req, res) => {
       const sessions = this.store.listSessions();
       res.json(sessions);
     });
-    this.app.get("/api/sessions/:id", auth, (req, res) => {
+    this.app.get("/api/sessions/:id", auth2, (req, res) => {
       const id = req.params.id;
       const session = this.store.getSession(id);
       if (!session) {
@@ -13000,11 +14991,11 @@ ${prompt}`;
       }
       res.json(session);
     });
-    this.app.delete("/api/sessions/:id", auth, (req, res) => {
+    this.app.delete("/api/sessions/:id", auth2, (req, res) => {
       const sessionId = req.params.id;
       this.store.deleteSession(sessionId);
       this.store.deleteRuntimeSession(sessionId);
-      const globalDbPath = path21.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path24.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteRuntimeSession(sessionId);
@@ -13016,7 +15007,7 @@ ${prompt}`;
       this.socket.broadcast("runtime:refresh", { scope: "global" });
       res.json({ ok: true });
     });
-    this.app.get("/api/export", auth, (req, res) => {
+    this.app.get("/api/export", auth2, (req, res) => {
       try {
         const sessionsParam = typeof req.query["sessions"] === "string" ? req.query["sessions"] : "all";
         const includeMemories = req.query["memories"] === "1" || req.query["memories"] === "true";
@@ -13039,7 +15030,7 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    this.app.post("/api/import", auth, mutationLimiter, (req, res) => {
+    this.app.post("/api/import", auth2, mutationLimiter, (req, res) => {
       try {
         const bundle = req.body;
         if (!bundle || bundle.format !== "cascade-export@1") {
@@ -13070,7 +15061,7 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    this.app.post("/api/sessions/:id/rollback", auth, mutationLimiter, async (req, res) => {
+    this.app.post("/api/sessions/:id/rollback", auth2, mutationLimiter, async (req, res) => {
       const sessionId = req.params.id;
       const taskIds = this.sessionTaskIds.get(sessionId) ?? [];
       if (!taskIds.length) {
@@ -13095,9 +15086,9 @@ ${prompt}`;
       }
       res.json({ ok: true, restored });
     });
-    this.app.delete("/api/sessions", auth, (req, res) => {
+    this.app.delete("/api/sessions", auth2, (req, res) => {
       const body = req.body;
-      const globalDbPath = path21.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path24.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       if (body?.ids && Array.isArray(body.ids) && body.ids.length > 0) {
         const globalStore = new MemoryStore(globalDbPath);
         try {
@@ -13118,9 +15109,9 @@ ${prompt}`;
       this.socket.broadcast("runtime:refresh", { scope: "workspace" });
       this.socket.broadcast("runtime:refresh", { scope: "global" });
     });
-    this.app.delete("/api/runtime", auth, (_req, res) => {
+    this.app.delete("/api/runtime", auth2, (_req, res) => {
       this.store.deleteAllRuntimeNodes();
-      const globalDbPath = path21.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path24.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteAllRuntimeNodes();
@@ -13131,10 +15122,10 @@ ${prompt}`;
       this.socket.broadcast("runtime:refresh", { scope: "global" });
       res.json({ ok: true });
     });
-    this.app.get("/api/identities", auth, (_req, res) => {
+    this.app.get("/api/identities", auth2, (_req, res) => {
       res.json(this.store.listIdentities());
     });
-    this.app.post("/api/identities", auth, (req, res) => {
+    this.app.post("/api/identities", auth2, (req, res) => {
       const body = req.body;
       if (!body.name) {
         res.status(400).json({ error: "name is required" });
@@ -13156,7 +15147,7 @@ ${prompt}`;
       this.store.createIdentity(identity);
       res.json(identity);
     });
-    this.app.put("/api/identities/:id", auth, (req, res) => {
+    this.app.put("/api/identities/:id", auth2, (req, res) => {
       const identityId = req.params.id;
       const body = req.body;
       if (body.setDefault) {
@@ -13167,11 +15158,11 @@ ${prompt}`;
       this.store.updateIdentity(identityId, body);
       res.json({ ok: true });
     });
-    this.app.delete("/api/identities/:id", auth, (req, res) => {
+    this.app.delete("/api/identities/:id", auth2, (req, res) => {
       this.store.deleteIdentity(req.params.id);
       res.json({ ok: true });
     });
-    this.app.get("/api/audit/verify", auth, async (_req, res) => {
+    this.app.get("/api/audit/verify", auth2, async (_req, res) => {
       try {
         const { AuditLogger: AuditLogger3 } = await Promise.resolve().then(() => (init_audit_logger(), audit_logger_exports));
         const logger = new AuditLogger3(this.workspacePath);
@@ -13184,16 +15175,16 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    this.app.get("/api/audit/:sessionId", auth, (req, res) => {
+    this.app.get("/api/audit/:sessionId", auth2, (req, res) => {
       const log = this.store.getAuditLog(req.params.sessionId);
       res.json(log);
     });
-    this.app.get("/api/config", auth, (_req, res) => {
+    this.app.get("/api/config", auth2, (_req, res) => {
       const safe = { ...this.config };
       safe.providers = safe.providers.map((p) => ({ ...p, apiKey: p.apiKey ? "***" : void 0 }));
       res.json(safe);
     });
-    this.app.put("/api/config", auth, async (req, res) => {
+    this.app.put("/api/config", auth2, async (req, res) => {
       const body = req.body;
       if (body["tierLimits"] !== void 0 && (typeof body["tierLimits"] !== "object" || Array.isArray(body["tierLimits"]))) {
         res.status(400).json({ error: "tierLimits must be an object" });
@@ -13206,18 +15197,18 @@ ${prompt}`;
       if (body["tierLimits"]) this.config.tierLimits = { ...this.config.tierLimits, ...body["tierLimits"] };
       if (body["budget"]) this.config.budget = { ...this.config.budget, ...body["budget"] };
       try {
-        const configPath = path21.join(this.workspacePath, CASCADE_CONFIG_FILE);
-        const existing = fs20.existsSync(configPath) ? JSON.parse(fs20.readFileSync(configPath, "utf-8")) : {};
+        const configPath = path24.join(this.workspacePath, CASCADE_CONFIG_FILE);
+        const existing = fs23.existsSync(configPath) ? JSON.parse(fs23.readFileSync(configPath, "utf-8")) : {};
         const updated = { ...existing, tierLimits: this.config.tierLimits, budget: this.config.budget };
         const tmp = configPath + ".tmp";
-        fs20.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
-        fs20.renameSync(tmp, configPath);
+        fs23.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
+        fs23.renameSync(tmp, configPath);
         res.json({ ok: true });
       } catch (err) {
         res.status(500).json({ error: `Failed to save config: ${err instanceof Error ? err.message : String(err)}` });
       }
     });
-    this.app.get("/api/runtime/logs/:sessionId", auth, (req, res) => {
+    this.app.get("/api/runtime/logs/:sessionId", auth2, (req, res) => {
       const sessionId = req.params["sessionId"];
       const before = req.query["before"];
       const limitStr = req.query["limit"];
@@ -13228,7 +15219,7 @@ ${prompt}`;
       );
       res.json(logs);
     });
-    this.app.get("/api/stats", auth, (_req, res) => {
+    this.app.get("/api/stats", auth2, (_req, res) => {
       const sessions = this.store.listSessions(void 0, 1e3);
       res.json({
         totalSessions: sessions.length,
@@ -13236,10 +15227,10 @@ ${prompt}`;
         totalCostUsd: sessions.reduce((acc, s) => acc + s.metadata.totalCostUsd, 0)
       });
     });
-    this.app.get("/api/runtime", auth, (req, res) => {
+    this.app.get("/api/runtime", auth2, (req, res) => {
       const scope = req.query["scope"] ?? "workspace";
       if (scope === "global") {
-        const globalDbPath = path21.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+        const globalDbPath = path24.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
         const globalStore = new MemoryStore(globalDbPath);
         try {
           res.json({
@@ -13260,7 +15251,7 @@ ${prompt}`;
         logs: this.store.listRuntimeNodeLogs(void 0, void 0, 500)
       });
     });
-    this.app.post("/api/run", auth, mutationLimiter, (req, res) => {
+    this.app.post("/api/run", auth2, mutationLimiter, (req, res) => {
       const body = req.body;
       if (!body.prompt || typeof body.prompt !== "string") {
         res.status(400).json({ error: "prompt is required" });
@@ -13319,7 +15310,7 @@ ${prompt}`;
         }
       })();
     });
-    this.app.get("/api/models", auth, (_req, res) => {
+    this.app.get("/api/models", auth2, (_req, res) => {
       res.json({
         t1: this.config.models?.t1 ?? "auto",
         t2: this.config.models?.t2 ?? "auto",
@@ -13330,7 +15321,7 @@ ${prompt}`;
         }))
       });
     });
-    this.app.get("/api/sessions/:id/why", auth, (req, res) => {
+    this.app.get("/api/sessions/:id/why", auth2, (req, res) => {
       const report = this.whyBySession.get(req.params.id);
       if (!report) {
         res.status(404).json({ error: "No decision trail recorded for this session in the current app run." });
@@ -13338,7 +15329,7 @@ ${prompt}`;
       }
       res.json(report);
     });
-    this.app.get("/api/sessions/:id/changes", auth, async (req, res) => {
+    this.app.get("/api/sessions/:id/changes", auth2, async (req, res) => {
       const sessionId = req.params.id;
       const taskIds = this.sessionTaskIds.get(sessionId) ?? [];
       const before = /* @__PURE__ */ new Map();
@@ -13362,7 +15353,7 @@ ${prompt}`;
       }));
       res.json({ sessionId, changes: changes.filter((c) => c.changed) });
     });
-    this.app.post("/api/sessions/:id/revert-file", auth, mutationLimiter, async (req, res) => {
+    this.app.post("/api/sessions/:id/revert-file", auth2, mutationLimiter, async (req, res) => {
       const sessionId = req.params.id;
       const body = req.body;
       if (!body.filePath || typeof body.filePath !== "string") {
@@ -13390,7 +15381,7 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    this.app.get("/api/costs", auth, (_req, res) => {
+    this.app.get("/api/costs", auth2, (_req, res) => {
       try {
         const sessions = this.store.listSessions(void 0, 1e3);
         const budget = this.config.budget ?? { warnAtPct: 80 };
@@ -13406,14 +15397,14 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    this.app.get("/api/schedules", auth, (_req, res) => {
+    this.app.get("/api/schedules", auth2, (_req, res) => {
       try {
         res.json(this.scheduler.list().map((t) => ({ ...t, armed: this.scheduler.isRunning(t.id) })));
       } catch (err) {
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    this.app.post("/api/schedules", auth, mutationLimiter, (req, res) => {
+    this.app.post("/api/schedules", auth2, mutationLimiter, (req, res) => {
       const body = req.body;
       if (!body.name?.trim() || !body.cronExpression?.trim() || !body.prompt?.trim()) {
         res.status(400).json({ error: "name, cronExpression, and prompt are required" });
@@ -13439,7 +15430,7 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    this.app.put("/api/schedules/:id", auth, mutationLimiter, (req, res) => {
+    this.app.put("/api/schedules/:id", auth2, mutationLimiter, (req, res) => {
       const id = req.params.id;
       const existing = this.scheduler.list().find((t) => t.id === id);
       if (!existing) {
@@ -13466,7 +15457,7 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    this.app.delete("/api/schedules/:id", auth, mutationLimiter, (req, res) => {
+    this.app.delete("/api/schedules/:id", auth2, mutationLimiter, (req, res) => {
       try {
         this.scheduler.remove(req.params.id);
         res.json({ ok: true });
@@ -13474,7 +15465,7 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    this.app.get("/api/knowledge", auth, (_req, res) => {
+    this.app.get("/api/knowledge", auth2, (_req, res) => {
       try {
         const ws = new WorldStateDB(this.workspacePath);
         try {
@@ -13487,7 +15478,7 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    this.app.delete("/api/knowledge/fact", auth, mutationLimiter, (req, res) => {
+    this.app.delete("/api/knowledge/fact", auth2, mutationLimiter, (req, res) => {
       const body = req.body;
       if (!body.entity || !body.relation) {
         res.status(400).json({ error: "entity and relation are required" });
@@ -13504,7 +15495,7 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    this.app.delete("/api/knowledge", auth, mutationLimiter, (_req, res) => {
+    this.app.delete("/api/knowledge", auth2, mutationLimiter, (_req, res) => {
       try {
         const ws = new WorldStateDB(this.workspacePath);
         try {
@@ -13516,7 +15507,42 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    this.app.get("/api/audit-chain", auth, async (req, res) => {
+    this.app.get("/api/knowledge/fact/history", auth2, (req, res) => {
+      const entity = req.query["entity"];
+      const relation = req.query["relation"];
+      if (typeof entity !== "string" || typeof relation !== "string") {
+        res.status(400).json({ error: "entity and relation are required" });
+        return;
+      }
+      try {
+        const ws = new WorldStateDB(this.workspacePath);
+        try {
+          res.json({ history: ws.getFactHistory(entity, relation) });
+        } finally {
+          ws.close();
+        }
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.post("/api/knowledge/fact/restore", auth2, mutationLimiter, (req, res) => {
+      const body = req.body;
+      if (!body.entity || !body.relation) {
+        res.status(400).json({ error: "entity and relation are required" });
+        return;
+      }
+      try {
+        const ws = new WorldStateDB(this.workspacePath);
+        try {
+          res.json({ ok: true, restored: ws.restoreFact(body.entity, body.relation, body.validFrom) });
+        } finally {
+          ws.close();
+        }
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.get("/api/audit-chain", auth2, async (req, res) => {
       try {
         const limit = Math.min(500, Math.max(1, parseInt(req.query["limit"] || "200", 10) || 200));
         const offset = Math.max(0, parseInt(req.query["offset"] || "0", 10) || 0);
@@ -13534,13 +15560,13 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    const prodPath = path21.resolve(__dirname$1, "../web/dist");
-    const devPath = path21.resolve(__dirname$1, "../../web/dist");
-    const webDistPath = fs20.existsSync(prodPath) ? prodPath : devPath;
-    if (fs20.existsSync(webDistPath)) {
+    const prodPath = path24.resolve(__dirname$1, "../web/dist");
+    const devPath = path24.resolve(__dirname$1, "../../web/dist");
+    const webDistPath = fs23.existsSync(prodPath) ? prodPath : devPath;
+    if (fs23.existsSync(webDistPath)) {
       this.app.use(express.static(webDistPath));
       this.app.get("*", (_req, res) => {
-        res.sendFile(path21.join(webDistPath, "index.html"));
+        res.sendFile(path24.join(webDistPath, "index.html"));
       });
     } else {
       this.app.get("/", (_req, res) => {
@@ -13613,6 +15639,553 @@ var HooksRunner = class {
   }
 };
 
-export { AZURE_BASE_URL_TEMPLATE, AuditLogger, CASCADE_AUDIT_FILE, CASCADE_CONFIG_DIR, CASCADE_CONFIG_FILE, CASCADE_DASHBOARD_SECRET_FILE, CASCADE_DB_FILE, CASCADE_IGNORE_FILE, CASCADE_KEYSTORE_FILE, CASCADE_MD_FILE, CASCADE_VERSION, COMPLEXITY_T2_COUNT, Cascade, CascadeCancelledError, CascadeIgnore, CascadeRouter, CascadeToolError, ConfigManager, DEFAULT_API_PORT, DEFAULT_APPROVAL_REQUIRED, DEFAULT_AUTO_SUMMARIZE_AT, DEFAULT_CONTEXT_LIMIT, DEFAULT_DASHBOARD_PORT, DEFAULT_MAX_SESSION_MESSAGES, DEFAULT_RETENTION_DAYS, DEFAULT_THEME, DashboardServer, GLOBAL_CONFIG_DIR, GLOBAL_CREDENTIALS_FILE, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, HooksRunner, Keystore, LM_STUDIO_BASE_URL, MODELS, McpClient, MemoryStore, OLLAMA_BASE_URL, PROVIDER_DISPLAY_NAMES, T1Administrator, T1_MODEL_PRIORITY, T2Manager, T2_MODEL_PRIORITY, T3Worker, T3_MODEL_PRIORITY, THEME_NAMES, TOOL_NAMES, TaskScheduler, Telemetry, ToolRegistry, VISION_MODEL_PRIORITY, createCascade, nodeHttpFetch, preferIpv4Host, runCascade, streamCascade };
+// src/retrieval/chunk.ts
+var DEFAULTS2 = { targetChars: 2e3, overlapChars: 200, minChars: 80 };
+function splitLongBlock(block, max) {
+  if (block.length <= max) return [block];
+  const out = [];
+  const sentences = block.match(/[^.!?\n]+[.!?]*\s*/g) ?? [block];
+  let cur = "";
+  for (const s of sentences) {
+    if (s.length > max) {
+      if (cur) {
+        out.push(cur);
+        cur = "";
+      }
+      for (let i = 0; i < s.length; i += max) out.push(s.slice(i, i + max));
+      continue;
+    }
+    if (cur.length + s.length > max) {
+      out.push(cur);
+      cur = s;
+    } else cur += s;
+  }
+  if (cur.trim()) out.push(cur);
+  return out.map((x) => x.trim()).filter(Boolean);
+}
+function overlapTail(text, overlap) {
+  if (overlap <= 0 || text.length <= overlap) return text.length <= overlap ? text : "";
+  const tail = text.slice(text.length - overlap);
+  const sp = tail.indexOf(" ");
+  return sp > 0 ? tail.slice(sp + 1) : tail;
+}
+function chunkText2(input, options = {}) {
+  const { targetChars, overlapChars, minChars } = { ...DEFAULTS2, ...options };
+  const normalized = input.replace(/\r\n/g, "\n").replace(/\n{3,}/g, "\n\n").trim();
+  if (!normalized) return [];
+  const rawBlocks = normalized.split(/\n\s*\n/).map((b) => b.trim()).filter(Boolean);
+  const blocks = [];
+  for (const b of rawBlocks) blocks.push(...splitLongBlock(b, targetChars));
+  const chunks = [];
+  let cur = "";
+  for (const block of blocks) {
+    const candidate = cur ? `${cur}
+
+${block}` : block;
+    if (candidate.length > targetChars && cur) {
+      chunks.push(cur);
+      const carry = overlapTail(cur, overlapChars);
+      cur = carry ? `${carry}
+
+${block}` : block;
+    } else {
+      cur = candidate;
+    }
+  }
+  if (cur.trim()) {
+    if (chunks.length && cur.length < minChars) chunks[chunks.length - 1] += `
+
+${cur}`;
+    else chunks.push(cur);
+  }
+  return chunks.map((text, ord) => ({ text: text.trim(), ord }));
+}
+
+// src/retrieval/plan.ts
+var CHARS_PER_TOKEN = 4;
+function cagCharBudget(contextWindowTokens, opts = {}) {
+  const docFraction = opts.docFraction ?? 0.5;
+  const charsPerToken = opts.charsPerToken ?? CHARS_PER_TOKEN;
+  return Math.max(0, Math.floor(contextWindowTokens * docFraction * charsPerToken));
+}
+function planRetrieval(ctx) {
+  if (ctx.sourceCount <= 0) return { mode: "none", reason: "no attached knowledge to retrieve" };
+  if (ctx.fastAnswer) return { mode: "cag", reason: "fast answer \u2014 inject attached knowledge in full, no retrieval" };
+  if (ctx.totalChars <= ctx.cagCharBudget) {
+    return { mode: "cag", reason: "attached knowledge fits the context budget \u2014 inject in full" };
+  }
+  return { mode: "rag", reason: "attached knowledge exceeds the budget \u2014 retrieve relevant passages" };
+}
+var CLOUD_SESSION_FILE = "cloud-session.json";
+function globalDir(homeDir = os6.homedir()) {
+  return path24.join(homeDir, GLOBAL_CONFIG_DIR);
+}
+function cloudSessionPath(dir = globalDir()) {
+  return path24.join(dir, CLOUD_SESSION_FILE);
+}
+function loadCloudSession(dir = globalDir()) {
+  try {
+    const raw = fs23.readFileSync(cloudSessionPath(dir), "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed?.refreshToken || !parsed?.serverUrl) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function saveCloudSession(session, dir = globalDir()) {
+  fs23.mkdirSync(dir, { recursive: true, mode: 448 });
+  const file = cloudSessionPath(dir);
+  fs23.writeFileSync(file, JSON.stringify(session, null, 2), { mode: 384 });
+  try {
+    fs23.chmodSync(file, 384);
+  } catch {
+  }
+}
+function clearCloudSession(dir = globalDir()) {
+  try {
+    fs23.rmSync(cloudSessionPath(dir));
+  } catch {
+  }
+}
+
+// src/cloud/client.ts
+var DEFAULT_CLOUD_URL = "https://app.cascadeai.in";
+var REFRESH_MARGIN_MS = 6e4;
+var FileCloudSessionStore = class {
+  constructor(dir) {
+    this.dir = dir;
+  }
+  dir;
+  load() {
+    return loadCloudSession(this.dir);
+  }
+  save(session) {
+    saveCloudSession(session, this.dir);
+  }
+  clear() {
+    clearCloudSession(this.dir);
+  }
+};
+var CloudClient = class _CloudClient {
+  constructor(serverUrl, dir, store) {
+    this.serverUrl = serverUrl;
+    this.store = store ?? new FileCloudSessionStore(dir);
+  }
+  serverUrl;
+  store;
+  /** Build a client from a stored session, or null if not signed in. */
+  static fromSession(dir, store) {
+    const src = store ?? new FileCloudSessionStore(dir);
+    const s = src.load();
+    return s ? new _CloudClient(s.serverUrl, dir, src) : null;
+  }
+  url(p) {
+    return `${this.serverUrl.replace(/\/$/, "")}${p}`;
+  }
+  // ── Device login ──────────────────────────────
+  async startDevice() {
+    const res = await fetch(this.url("/api/native/device"), { method: "POST" });
+    if (!res.ok) throw new Error(`Could not start sign-in (${res.status}).`);
+    const b = await res.json();
+    return { deviceCode: b.device_code, userCode: b.user_code, verificationUri: b.verification_uri, expiresIn: b.expires_in, interval: b.interval };
+  }
+  /** Single poll of the device grant. On approval, persists + returns the session. */
+  async pollDevice(deviceCode) {
+    const res = await fetch(this.url("/api/native/device/token"), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+    if (res.status === 428) return "pending";
+    if (res.status === 429) return "slow_down";
+    if (!res.ok) return "expired";
+    const tokens = await res.json();
+    const session = await this.finishLogin(tokens);
+    return { session };
+  }
+  /**
+   * Run the full device flow: start it, hand the code to `onCode`, then poll at
+   * the server's interval until approved or expired.
+   */
+  async runDeviceLogin(onCode, opts = {}) {
+    const start = await this.startDevice();
+    onCode(start);
+    let interval = start.interval;
+    const deadline = Date.now() + start.expiresIn * 1e3;
+    while (Date.now() < deadline) {
+      if (opts.signal?.aborted) throw new Error("Sign-in cancelled.");
+      await sleep(interval * 1e3, opts.signal);
+      const r = await this.pollDevice(start.deviceCode);
+      if (r === "slow_down") {
+        interval += 5;
+        continue;
+      }
+      if (r === "pending") continue;
+      if (r === "expired") throw new Error("The sign-in code expired. Run `cascade login` again.");
+      return r.session;
+    }
+    throw new Error("The sign-in code expired. Run `cascade login` again.");
+  }
+  // ── Loopback login (desktop) — RFC 8252 ───────
+  /**
+   * Run the loopback flow for a rich native client (the desktop). Opens a
+   * one-shot listener on `http://127.0.0.1:<random>`, sends the user to the
+   * provider in the system browser via `openUrl`, catches the one-time code on
+   * the loopback redirect, and exchanges it (+ the PKCE verifier) for tokens.
+   *
+   * No secret is involved: PKCE S256 proves the client that started the flow is
+   * the one redeeming the code. Storage-agnostic — persists through the same
+   * session store as the device flow, so callers get a ready `CloudSession`.
+   */
+  async runLoopbackLogin(openUrl, opts = {}) {
+    const provider = opts.provider ?? "google";
+    const { verifier, challenge } = makePkce();
+    const appState = base64url(randomBytes(16));
+    const listener = await startLoopbackListener(appState, opts);
+    try {
+      const authorizeUrl = this.url(
+        `/auth/native/${encodeURIComponent(provider)}?redirect_uri=${encodeURIComponent(listener.redirectUri)}&code_challenge=${encodeURIComponent(challenge)}&state=${encodeURIComponent(appState)}`
+      );
+      await openUrl(authorizeUrl);
+      const code = await listener.waitForCode;
+      const res = await fetch(this.url("/api/native/token"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ code, code_verifier: verifier })
+      });
+      if (!res.ok) throw new Error("Sign-in could not be completed. Please try again.");
+      const tokens = await res.json();
+      return await this.finishLogin(tokens);
+    } finally {
+      listener.close();
+    }
+  }
+  /** Exchange a fresh token response for a stored session (fetches the user). */
+  async finishLogin(tokens) {
+    const partial = {
+      serverUrl: this.serverUrl,
+      accessToken: tokens.access_token,
+      accessExpiresAt: Date.now() + tokens.expires_in * 1e3,
+      refreshToken: tokens.refresh_token,
+      user: { id: "", email: null, name: null }
+    };
+    const user = await this.fetchMe(partial.accessToken);
+    const session = { ...partial, user };
+    this.store.save(session);
+    return session;
+  }
+  // ── Token lifecycle ───────────────────────────
+  session() {
+    const s = this.store.load();
+    if (!s) throw new Error("Not signed in. Run `cascade login`.");
+    return s;
+  }
+  async refresh() {
+    const s = this.session();
+    const res = await fetch(this.url("/api/native/refresh"), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh_token: s.refreshToken })
+    });
+    if (!res.ok) {
+      this.store.clear();
+      throw new Error("Your session expired. Run `cascade login` again.");
+    }
+    const tokens = await res.json();
+    const next = {
+      ...s,
+      accessToken: tokens.access_token,
+      accessExpiresAt: Date.now() + tokens.expires_in * 1e3,
+      refreshToken: tokens.refresh_token
+      // rotated
+    };
+    this.store.save(next);
+    return next;
+  }
+  async accessToken() {
+    const s = this.session();
+    if (s.accessExpiresAt - Date.now() > REFRESH_MARGIN_MS) return s.accessToken;
+    return (await this.refresh()).accessToken;
+  }
+  /** Authenticated request that refreshes once on a 401 (e.g. server-side revoke). */
+  async authed(path26, init = {}) {
+    const call = (token) => fetch(this.url(path26), { ...init, headers: { ...init.headers ?? {}, Authorization: `Bearer ${token}` } });
+    let res = await call(await this.accessToken());
+    if (res.status === 401) res = await call((await this.refresh()).accessToken);
+    if (!res.ok) throw new Error(`Request failed (${res.status}).`);
+    const text = await res.text();
+    return text ? JSON.parse(text) : {};
+  }
+  authedGet(path26) {
+    return this.authed(path26);
+  }
+  async fetchMe(token) {
+    const res = await fetch(this.url("/api/me"), { headers: { Authorization: `Bearer ${token}` } });
+    if (!res.ok) throw new Error(`Could not load your account (${res.status}).`);
+    const b = await res.json();
+    return b.user ?? { id: "", email: null, name: null };
+  }
+  // ── Read API ──────────────────────────────────
+  async me() {
+    const b = await this.authedGet("/api/me");
+    return b.user ?? { id: "", email: null, name: null };
+  }
+  async listConversations() {
+    const b = await this.authedGet("/api/conversations");
+    return b.conversations ?? [];
+  }
+  async getMessages(conversationId) {
+    const b = await this.authedGet(`/api/conversations/${encodeURIComponent(conversationId)}/messages`);
+    return b.messages ?? [];
+  }
+  // ── Write API (cloud-backed sessions for desktop + CLI) ───
+  // Native surfaces execute runs LOCALLY (their own keys + shell/file/git tools)
+  // and persist each finished turn into the shared cloud conversation tree, so
+  // web, desktop, and CLI all show the same sessions and branching works across
+  // every surface.
+  /** Start a new cloud conversation and return it. */
+  async createConversation(title) {
+    const b = await this.authed("/api/conversations", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ title: title ?? null })
+    });
+    return b.conversation;
+  }
+  /** Persist a locally-executed turn; returns the new active path (with siblings). */
+  async appendTurn(conversationId, turn) {
+    const b = await this.authed(
+      `/api/conversations/${encodeURIComponent(conversationId)}/turns`,
+      { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(turn) }
+    );
+    return b.messages ?? [];
+  }
+  /** Branching: switch the active path to a sibling; returns the new path. */
+  async selectBranch(conversationId, messageId) {
+    const b = await this.authed(
+      `/api/conversations/${encodeURIComponent(conversationId)}/select-branch`,
+      { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ messageId }) }
+    );
+    return b.messages ?? [];
+  }
+  /** Branching: delete a message and its subtree; returns the new path. */
+  async deleteMessage(conversationId, messageId) {
+    const b = await this.authed(
+      `/api/conversations/${encodeURIComponent(conversationId)}/messages/${encodeURIComponent(messageId)}`,
+      { method: "DELETE" }
+    );
+    return b.messages ?? [];
+  }
+  async renameConversation(conversationId, title) {
+    await this.authed(`/api/conversations/${encodeURIComponent(conversationId)}/title`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ title })
+    });
+  }
+  async deleteConversation(conversationId) {
+    await this.authed(`/api/conversations/${encodeURIComponent(conversationId)}`, { method: "DELETE" });
+  }
+  // ── Key sync (E2E-encrypted settings relay) ───
+  /** Fetch the stored encrypted settings envelope (ciphertext only), or null. */
+  async pullSecrets() {
+    return this.authed("/api/keysync");
+  }
+  /** Store/replace the encrypted settings envelope. The server never decrypts it. */
+  async pushSecrets(blob) {
+    return this.authed("/api/keysync", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ blob })
+    });
+  }
+  /** Forget the stored envelope on the server. */
+  async deleteSecrets() {
+    await this.authed("/api/keysync", { method: "DELETE" });
+  }
+  async logout() {
+    const s = this.store.load();
+    if (s) {
+      try {
+        await fetch(this.url("/api/native/logout"), {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ refresh_token: s.refreshToken })
+        });
+      } catch {
+      }
+    }
+    this.store.clear();
+  }
+};
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    const t = setTimeout(resolve, ms);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(t);
+      reject(new Error("aborted"));
+    }, { once: true });
+  });
+}
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function makePkce() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function startLoopbackListener(expectedState, opts) {
+  return new Promise((resolveListener, rejectListener) => {
+    let resolveCode;
+    let rejectCode;
+    const waitForCode = new Promise((res, rej) => {
+      resolveCode = res;
+      rejectCode = rej;
+    });
+    let server;
+    const close = () => {
+      try {
+        server?.close();
+      } catch {
+      }
+    };
+    const timeoutMs = opts.timeoutMs ?? 5 * 6e4;
+    const timer = setTimeout(() => {
+      rejectCode(new Error("Sign-in timed out. Please try again."));
+      close();
+    }, timeoutMs);
+    timer.unref?.();
+    const settleCode = (code) => {
+      clearTimeout(timer);
+      resolveCode(code);
+    };
+    const failCode = (err) => {
+      clearTimeout(timer);
+      rejectCode(err);
+    };
+    server = http.createServer((req, res) => {
+      const reqUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (reqUrl.pathname !== "/cb") {
+        res.writeHead(404).end();
+        return;
+      }
+      const code = reqUrl.searchParams.get("code");
+      const state = reqUrl.searchParams.get("state");
+      const err = reqUrl.searchParams.get("error");
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      if (err || !code || state !== expectedState) {
+        res.end(resultPage("Sign-in failed", "Something went wrong. Return to Cascade and try again."));
+        failCode(new Error(err ? `Sign-in failed: ${err}` : "The sign-in response was invalid."));
+        return;
+      }
+      res.end(resultPage("Signed in to Cascade", "You can close this tab and return to the app."));
+      settleCode(code);
+    });
+    opts.signal?.addEventListener("abort", () => {
+      failCode(new Error("Sign-in cancelled."));
+      close();
+    }, { once: true });
+    server.on("error", (e) => {
+      clearTimeout(timer);
+      rejectListener(e);
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      resolveListener({ redirectUri: `http://127.0.0.1:${port}/cb`, waitForCode, close });
+    });
+  });
+}
+function resultPage(title, body) {
+  return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title} \xB7 Cascade</title><body style="margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;font-family:system-ui,-apple-system,Segoe UI,Roboto,sans-serif;background:#0b0d12;color:#e6e8ee"><div style="text-align:center;padding:40px"><div style="font-size:15px;font-weight:600;margin-bottom:8px">${title}</div><div style="font-size:13px;color:#9aa3b2">${body}</div></div></body>`;
+}
+var PBKDF2_ITERATIONS2 = 21e4;
+var SALT_BYTES = 16;
+var IV_BYTES = 12;
+function toBase64(buf) {
+  const bytes = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
+  return Buffer.from(bytes).toString("base64");
+}
+function fromBase64(b64) {
+  return new Uint8Array(Buffer.from(b64, "base64"));
+}
+async function deriveKey(passphrase, salt) {
+  const baseKey = await webcrypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(passphrase),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return webcrypto.subtle.deriveKey(
+    { name: "PBKDF2", salt, iterations: PBKDF2_ITERATIONS2, hash: "SHA-256" },
+    baseKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function encryptJSON(data, passphrase) {
+  const salt = webcrypto.getRandomValues(new Uint8Array(SALT_BYTES));
+  const iv = webcrypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const key = await deriveKey(passphrase, salt);
+  const plaintext = new TextEncoder().encode(JSON.stringify(data));
+  const ciphertext = await webcrypto.subtle.encrypt({ name: "AES-GCM", iv }, key, plaintext);
+  return { ciphertext: toBase64(ciphertext), salt: toBase64(salt), iv: toBase64(iv) };
+}
+async function decryptJSON(blob, passphrase) {
+  const salt = fromBase64(blob.salt);
+  const iv = fromBase64(blob.iv);
+  const key = await deriveKey(passphrase, salt);
+  const ciphertext = fromBase64(blob.ciphertext);
+  const plaintext = await webcrypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ciphertext);
+  return JSON.parse(new TextDecoder().decode(plaintext));
+}
+
+// src/cloud/keysync.ts
+function providerSig(p) {
+  return [p.type, p.baseUrl ?? "", p.deploymentName ?? "", p.label ?? ""].join("\0");
+}
+function mergeByKey(local, incoming, key) {
+  if (!incoming?.length) return local;
+  const map = /* @__PURE__ */ new Map();
+  for (const l of local ?? []) map.set(key(l), l);
+  for (const i of incoming) map.set(key(i), i);
+  return [...map.values()];
+}
+function gatherSyncBundle(config) {
+  const bundle = { v: 1 };
+  if (config.providers?.length) bundle.providers = config.providers;
+  if (config.tools?.webSearch) bundle.webSearch = config.tools.webSearch;
+  if (config.tools?.mcpServers?.length) bundle.mcpServers = config.tools.mcpServers;
+  if (config.models) bundle.models = config.models;
+  if (config.budget) bundle.budget = config.budget;
+  const prefs = {};
+  if (config.autoBias !== void 0) prefs.autoBias = config.autoBias;
+  if (config.cascadeAuto !== void 0) prefs.cascadeAuto = config.cascadeAuto;
+  if (config.extendedContext !== void 0) prefs.extendedContext = config.extendedContext;
+  if (config.autonomy !== void 0) prefs.autonomy = config.autonomy;
+  if (Object.keys(prefs).length) bundle.prefs = prefs;
+  return bundle;
+}
+function applySyncBundle(bundle, config) {
+  const next = { ...config, tools: { ...config.tools } };
+  if (bundle.providers) next.providers = mergeByKey(config.providers, bundle.providers, providerSig) ?? [];
+  if (bundle.webSearch) next.tools.webSearch = { ...config.tools?.webSearch, ...bundle.webSearch };
+  if (bundle.mcpServers) next.tools.mcpServers = mergeByKey(config.tools?.mcpServers, bundle.mcpServers, (m) => m.name);
+  if (bundle.models) next.models = { ...config.models, ...bundle.models };
+  if (bundle.budget) next.budget = { ...config.budget, ...bundle.budget };
+  if (bundle.prefs) {
+    const p = bundle.prefs;
+    if (p.autoBias !== void 0) next.autoBias = p.autoBias;
+    if (p.cascadeAuto !== void 0) next.cascadeAuto = p.cascadeAuto;
+    if (p.extendedContext !== void 0) next.extendedContext = p.extendedContext;
+    if (p.autonomy !== void 0) next.autonomy = p.autonomy;
+  }
+  return next;
+}
+
+export { AZURE_BASE_URL_TEMPLATE, AuditLogger, CASCADE_AUDIT_FILE, CASCADE_CONFIG_DIR, CASCADE_CONFIG_FILE, CASCADE_DASHBOARD_SECRET_FILE, CASCADE_DB_FILE, CASCADE_IGNORE_FILE, CASCADE_KEYSTORE_FILE, CASCADE_MD_FILE, CASCADE_VERSION, CHARS_PER_TOKEN, COMPLEXITY_T2_COUNT, Cascade, CascadeCancelledError, CascadeIgnore, CascadeRouter, CascadeToolError, CloudClient, CodeSearchTool, ConfigManager, DEFAULT_API_PORT, DEFAULT_APPROVAL_REQUIRED, DEFAULT_AUTO_SUMMARIZE_AT, DEFAULT_CLOUD_URL, DEFAULT_CONTEXT_LIMIT, DEFAULT_DASHBOARD_PORT, DEFAULT_MAX_SESSION_MESSAGES, DEFAULT_RETENTION_DAYS, DEFAULT_THEME, DashboardServer, FileMcpOAuthStore, GLOBAL_CONFIG_DIR, GLOBAL_CREDENTIALS_FILE, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, GraphRetriever, GraphSearchTool, HooksRunner, Keystore, LLMReranker, LM_STUDIO_BASE_URL, MODELS, McpClient, McpOAuthProvider, MemoryStore, OLLAMA_BASE_URL, OpenAICompatibleEmbedder, PROVIDER_DISPLAY_NAMES, Retriever, SqliteVectorStore, T1Administrator, T1_MODEL_PRIORITY, T2Manager, T2_MODEL_PRIORITY, T3Worker, T3_MODEL_PRIORITY, THEME_NAMES, TOOL_NAMES, TaskScheduler, Telemetry, ToolRegistry, VISION_MODEL_PRIORITY, WorkspaceIndex, applySyncBundle, azureModelForDeployment, beginMcpOAuth, buildManifest, buildSessionTranscript, cagCharBudget, chatCompleterFromProviders, chunkCode, chunkText2 as chunkText, completeMcpOAuth, connectMcpWithLoopbackOAuth, createCascade, decryptJSON as decryptSyncBlob, diffManifest, discoverMcpAuthServer, distillSessionFacts, embedderFromProviders, encryptJSON as encryptSyncBlob, fileOAuthProvider, gatherSyncBundle, hashContent, heuristicCodeChunker, inferAzureBaseModel, nodeHttpFetch, parseRankOrder, planRetrieval, preferIpv4Host, reciprocalRankFusion, refreshMcpToken, runCascade, sessionWorthRemembering, streamCascade };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map