cascade-ai 0.66.2 → 0.67.0

package/dist/cli.cjs

@@ -9,8 +9,8 @@ var https = require('https');
 var zlib = require('zlib');
 var stream = require('stream');
 var Database2 = require('better-sqlite3');
-var path32 = require('path');
-var fs29 = require('fs');
+var path33 = require('path');
+var fs30 = require('fs');
 var os10 = require('os');
 var crypto = require('crypto');
 var ink = require('ink');
@@ -19,7 +19,7 @@ var React2 = require('react');
 var chalk7 = require('chalk');
 var dotenv = require('dotenv');
 var url = require('url');
-var fs10 = require('fs/promises');
+var fs11 = require('fs/promises');
 var _ignoreModule = require('ignore');
 var zod = require('zod');
 var child_process = require('child_process');
@@ -77,14 +77,14 @@ var http__default = /*#__PURE__*/_interopDefault(http);
 var https__default = /*#__PURE__*/_interopDefault(https);
 var zlib__default = /*#__PURE__*/_interopDefault(zlib);
 var Database2__default = /*#__PURE__*/_interopDefault(Database2);
-var path32__default = /*#__PURE__*/_interopDefault(path32);
-var fs29__default = /*#__PURE__*/_interopDefault(fs29);
+var path33__default = /*#__PURE__*/_interopDefault(path33);
+var fs30__default = /*#__PURE__*/_interopDefault(fs30);
 var os10__default = /*#__PURE__*/_interopDefault(os10);
 var crypto__default = /*#__PURE__*/_interopDefault(crypto);
 var React2__default = /*#__PURE__*/_interopDefault(React2);
 var chalk7__default = /*#__PURE__*/_interopDefault(chalk7);
 var dotenv__default = /*#__PURE__*/_interopDefault(dotenv);
-var fs10__default = /*#__PURE__*/_interopDefault(fs10);
+var fs11__default = /*#__PURE__*/_interopDefault(fs11);
 var _ignoreModule__namespace = /*#__PURE__*/_interopNamespace(_ignoreModule);
 var EventEmitter__default = /*#__PURE__*/_interopDefault(EventEmitter);
 var PDFDocument__default = /*#__PURE__*/_interopDefault(PDFDocument);
@@ -1810,7 +1810,7 @@ var CASCADE_VERSION, CASCADE_CONFIG_FILE, CASCADE_DB_FILE, CASCADE_DASHBOARD_SEC
 var init_constants = __esm({
   "src/constants.ts"() {
     init_pricing();
-    CASCADE_VERSION = "0.66.2";
+    CASCADE_VERSION = "0.67.0";
     CASCADE_CONFIG_FILE = ".cascade/config.json";
     CASCADE_DB_FILE = ".cascade/memory.db";
     CASCADE_DASHBOARD_SECRET_FILE = ".cascade/dashboard-secret";
@@ -3932,12 +3932,12 @@ var init_audit_logger = __esm({
       constructor(workspacePath, debugMode = false) {
         this.workspacePath = workspacePath;
         this.debugMode = debugMode;
-        const cascadeDir = path32__default.default.join(workspacePath, ".cascade");
-        if (!fs29__default.default.existsSync(cascadeDir)) {
-          fs29__default.default.mkdirSync(cascadeDir, { recursive: true });
+        const cascadeDir = path33__default.default.join(workspacePath, ".cascade");
+        if (!fs30__default.default.existsSync(cascadeDir)) {
+          fs30__default.default.mkdirSync(cascadeDir, { recursive: true });
         }
-        this.keyPath = path32__default.default.join(cascadeDir, "audit_log.key");
-        this.dbPath = path32__default.default.join(cascadeDir, "audit_log.db");
+        this.keyPath = path33__default.default.join(cascadeDir, "audit_log.key");
+        this.dbPath = path33__default.default.join(cascadeDir, "audit_log.db");
         this.initEncryptionKey();
         this.db = new Database2__default.default(this.dbPath);
         this.db.pragma("journal_mode = WAL");
@@ -3967,11 +3967,11 @@ var init_audit_logger = __esm({
         return crypto__default.default.createHash("sha256").update(`${prevHash}|${timestamp}|${eventType}|${tierId}|${encryptedPayload}`).digest("hex");
       }
       initEncryptionKey() {
-        if (fs29__default.default.existsSync(this.keyPath)) {
-          this.encryptionKey = fs29__default.default.readFileSync(this.keyPath);
+        if (fs30__default.default.existsSync(this.keyPath)) {
+          this.encryptionKey = fs30__default.default.readFileSync(this.keyPath);
         } else {
           this.encryptionKey = crypto__default.default.randomBytes(32);
-          fs29__default.default.writeFileSync(this.keyPath, this.encryptionKey);
+          fs30__default.default.writeFileSync(this.keyPath, this.encryptionKey);
         }
       }
       encrypt(text) {
@@ -4049,9 +4049,9 @@ var init_audit_logger = __esm({
       dumpDebugIfNeeded() {
         if (!this.debugMode) return;
         try {
-          const dumpPath = path32__default.default.join(os10__default.default.tmpdir(), "cascade_audit_logs_debug.json");
+          const dumpPath = path33__default.default.join(os10__default.default.tmpdir(), "cascade_audit_logs_debug.json");
           const entries = this.getAllLogs();
-          fs29__default.default.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+          fs30__default.default.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
         } catch (err) {
           console.error("Failed to dump debug audit logs", err);
         }
@@ -4106,7 +4106,7 @@ var Keystore = class {
       const creds = await this.keytar.findCredentials(KEYTAR_SERVICE);
       this.cache = Object.fromEntries(creds.map((c) => [c.account, c.password]));
       this.backend = "keytar";
-      if (password && fs29__default.default.existsSync(this.storePath)) {
+      if (password && fs30__default.default.existsSync(this.storePath)) {
         try {
           const fileEntries = this.decryptFile(password);
           for (const [k, v] of Object.entries(fileEntries)) {
@@ -4125,7 +4125,7 @@ var Keystore = class {
         "Keystore unlock requires a password because the OS keychain (keytar) is not available on this system."
       );
     }
-    if (!fs29__default.default.existsSync(this.storePath)) {
+    if (!fs30__default.default.existsSync(this.storePath)) {
       const salt = crypto__default.default.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
@@ -4139,7 +4139,7 @@ var Keystore = class {
   }
   /** Synchronous legacy unlock kept for AES-only environments. */
   unlockSync(password) {
-    if (!fs29__default.default.existsSync(this.storePath)) {
+    if (!fs30__default.default.existsSync(this.storePath)) {
       const salt = crypto__default.default.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
@@ -4197,7 +4197,7 @@ var Keystore = class {
     }
   }
   decryptFile(password, knownSalt) {
-    if (!fs29__default.default.existsSync(this.storePath)) return {};
+    if (!fs30__default.default.existsSync(this.storePath)) return {};
     try {
       const { salt, ciphertext, iv, tag } = this.readRaw();
       const useSalt = knownSalt ?? salt;
@@ -4219,8 +4219,8 @@ var Keystore = class {
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([raw.salt, iv, tag, ciphertext]);
-    fs29__default.default.mkdirSync(path32__default.default.dirname(this.storePath), { recursive: true });
-    fs29__default.default.writeFileSync(this.storePath, out, { mode: 384 });
+    fs30__default.default.mkdirSync(path33__default.default.dirname(this.storePath), { recursive: true });
+    fs30__default.default.writeFileSync(this.storePath, out, { mode: 384 });
   }
   writeWithSalt(data, salt) {
     if (!this.masterKey) throw new Error("writeWithSalt called before masterKey was set");
@@ -4230,11 +4230,11 @@ var Keystore = class {
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([salt, iv, tag, ciphertext]);
-    fs29__default.default.mkdirSync(path32__default.default.dirname(this.storePath), { recursive: true });
-    fs29__default.default.writeFileSync(this.storePath, out, { mode: 384 });
+    fs30__default.default.mkdirSync(path33__default.default.dirname(this.storePath), { recursive: true });
+    fs30__default.default.writeFileSync(this.storePath, out, { mode: 384 });
   }
   readRaw() {
-    const buf = fs29__default.default.readFileSync(this.storePath);
+    const buf = fs30__default.default.readFileSync(this.storePath);
     let offset = 0;
     const salt = buf.subarray(offset, offset + SALT_LEN);
     offset += SALT_LEN;
@@ -4267,9 +4267,9 @@ var CascadeIgnore = class {
     ]);
   }
   async load(workspacePath) {
-    const filePath = path32__default.default.join(workspacePath, ".cascadeignore");
+    const filePath = path33__default.default.join(workspacePath, ".cascadeignore");
     try {
-      const content = await fs10__default.default.readFile(filePath, "utf-8");
+      const content = await fs11__default.default.readFile(filePath, "utf-8");
       const lines = content.split("\n").filter((l) => l.trim() && !l.startsWith("#"));
       this.ig.add(lines);
       this.loaded = true;
@@ -4278,7 +4278,7 @@ var CascadeIgnore = class {
   }
   isIgnored(filePath, workspacePath) {
     try {
-      const relative = workspacePath ? path32__default.default.relative(workspacePath, filePath) : filePath;
+      const relative = workspacePath ? path33__default.default.relative(workspacePath, filePath) : filePath;
       return this.ig.ignores(relative);
     } catch {
       return false;
@@ -4289,7 +4289,7 @@ var CascadeIgnore = class {
   }
 };
 async function createDefaultIgnoreFile(workspacePath) {
-  const filePath = path32__default.default.join(workspacePath, ".cascadeignore");
+  const filePath = path33__default.default.join(workspacePath, ".cascadeignore");
   const content = `# .cascadeignore \u2014 Files Cascade agents cannot read or modify
 # Syntax identical to .gitignore
 
@@ -4316,12 +4316,12 @@ build/
 .DS_Store
 Thumbs.db
 `;
-  await fs10__default.default.writeFile(filePath, content, "utf-8");
+  await fs11__default.default.writeFile(filePath, content, "utf-8");
 }
 async function loadCascadeMd(workspacePath) {
-  const filePath = path32__default.default.join(workspacePath, "CASCADE.md");
+  const filePath = path33__default.default.join(workspacePath, "CASCADE.md");
   try {
-    const raw = await fs10__default.default.readFile(filePath, "utf-8");
+    const raw = await fs11__default.default.readFile(filePath, "utf-8");
     return parseCascadeMd(raw);
   } catch {
     return null;
@@ -4348,7 +4348,7 @@ ${raw.trim()}`;
   return { raw, sections, systemPrompt };
 }
 async function createDefaultCascadeMd(workspacePath) {
-  const filePath = path32__default.default.join(workspacePath, "CASCADE.md");
+  const filePath = path33__default.default.join(workspacePath, "CASCADE.md");
   const content = `# Cascade Project Instructions
 
 This file contains project-specific instructions for the Cascade AI agent.
@@ -4378,12 +4378,12 @@ All tools are allowed unless specified otherwise.
 
 List any areas the agent should not touch.
 `;
-  await fs10__default.default.writeFile(filePath, content, "utf-8");
+  await fs11__default.default.writeFile(filePath, content, "utf-8");
 }
 var MemoryStore = class _MemoryStore {
   db;
   constructor(dbPath) {
-    fs29__default.default.mkdirSync(path32__default.default.dirname(dbPath), { recursive: true });
+    fs30__default.default.mkdirSync(path33__default.default.dirname(dbPath), { recursive: true });
     try {
       this.db = new Database2__default.default(dbPath, { timeout: 5e3 });
       this.db.pragma("journal_mode = WAL");
@@ -5635,7 +5635,7 @@ function validateConfig(raw) {
 // src/config/global-credentials.ts
 init_constants();
 function credentialsPath(globalDir2) {
-  return path32__default.default.join(globalDir2, GLOBAL_CREDENTIALS_FILE);
+  return path33__default.default.join(globalDir2, GLOBAL_CREDENTIALS_FILE);
 }
 function providerKey(p) {
   if (p.type === "azure") {
@@ -5648,7 +5648,7 @@ function isPersistable(p) {
 }
 function loadGlobalCredentials(globalDir2) {
   try {
-    const raw = fs29__default.default.readFileSync(credentialsPath(globalDir2), "utf-8");
+    const raw = fs30__default.default.readFileSync(credentialsPath(globalDir2), "utf-8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed.providers)) return [];
     return parsed.providers.filter(
@@ -5660,13 +5660,13 @@ function loadGlobalCredentials(globalDir2) {
 }
 function saveGlobalCredentials(globalDir2, providers) {
   const filePath = credentialsPath(globalDir2);
-  fs29__default.default.mkdirSync(globalDir2, { recursive: true, mode: 448 });
+  fs30__default.default.mkdirSync(globalDir2, { recursive: true, mode: 448 });
   const body = { version: 1, providers: providers.filter(isPersistable) };
   const tmp = `${filePath}.tmp`;
-  fs29__default.default.writeFileSync(tmp, JSON.stringify(body, null, 2), { encoding: "utf-8", mode: 384 });
-  fs29__default.default.renameSync(tmp, filePath);
+  fs30__default.default.writeFileSync(tmp, JSON.stringify(body, null, 2), { encoding: "utf-8", mode: 384 });
+  fs30__default.default.renameSync(tmp, filePath);
   try {
-    fs29__default.default.chmodSync(filePath, 384);
+    fs30__default.default.chmodSync(filePath, 384);
   } catch {
   }
 }
@@ -5884,7 +5884,7 @@ var ConfigManager = class {
   /** `globalDirOverride` exists for tests — never point it at the real home dir there. */
   constructor(workspacePath = process.cwd(), globalDirOverride) {
     this.workspacePath = workspacePath;
-    this.globalDir = globalDirOverride ?? path32__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR);
+    this.globalDir = globalDirOverride ?? path33__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR);
   }
   async load() {
     this.config = await this.loadConfig();
@@ -5898,8 +5898,8 @@ var ConfigManager = class {
     this.ignore = new CascadeIgnore();
     await this.ignore.load(this.workspacePath);
     this.cascadeMd = await loadCascadeMd(this.workspacePath);
-    this.keystore = new Keystore(path32__default.default.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
-    this.store = new MemoryStore(path32__default.default.join(this.workspacePath, CASCADE_DB_FILE));
+    this.keystore = new Keystore(path33__default.default.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
+    this.store = new MemoryStore(path33__default.default.join(this.workspacePath, CASCADE_DB_FILE));
     await this.injectEnvKeys();
     this.config.providers = mergeGlobalCredentials(this.config.providers, loadGlobalCredentials(this.globalDir));
     await this.ensureDefaultIdentity();
@@ -5924,9 +5924,9 @@ var ConfigManager = class {
     return this.workspacePath;
   }
   async save() {
-    const configPath = path32__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
-    await fs10__default.default.mkdir(path32__default.default.dirname(configPath), { recursive: true });
-    await fs10__default.default.writeFile(configPath, JSON.stringify(this.config, null, 2), "utf-8");
+    const configPath = path33__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    await fs11__default.default.mkdir(path33__default.default.dirname(configPath), { recursive: true });
+    await fs11__default.default.writeFile(configPath, JSON.stringify(this.config, null, 2), "utf-8");
     try {
       saveGlobalCredentials(this.globalDir, this.config.providers);
     } catch (err) {
@@ -5961,9 +5961,9 @@ var ConfigManager = class {
     return configProvider?.apiKey;
   }
   async loadConfig() {
-    const configPath = path32__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    const configPath = path33__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
     try {
-      const raw = await fs10__default.default.readFile(configPath, "utf-8");
+      const raw = await fs11__default.default.readFile(configPath, "utf-8");
       return validateConfig(JSON.parse(raw));
     } catch (err) {
       if (err.code === "ENOENT") {
@@ -6963,13 +6963,13 @@ var DeadModelStore = class {
 function fileDeadModelPersistence(filePath) {
   return {
     load() {
-      if (!fs29.existsSync(filePath)) return [];
-      const raw = JSON.parse(fs29.readFileSync(filePath, "utf-8"));
+      if (!fs30.existsSync(filePath)) return [];
+      const raw = JSON.parse(fs30.readFileSync(filePath, "utf-8"));
       return Array.isArray(raw) ? raw : [];
     },
     save(records) {
-      fs29.mkdirSync(path32.dirname(filePath), { recursive: true });
-      fs29.writeFileSync(filePath, JSON.stringify(records, null, 2));
+      fs30.mkdirSync(path33.dirname(filePath), { recursive: true });
+      fs30.writeFileSync(filePath, JSON.stringify(records, null, 2));
     }
   };
 }
@@ -7128,7 +7128,7 @@ init_pricing();
 var DEFAULT_SNAPSHOT_URL = "https://raw.githubusercontent.com/Varun-SV/Cascade-AI/main/src/core/router/benchmark-data.json";
 var OPENROUTER_MODELS_URL = "https://openrouter.ai/api/v1/models";
 var FETCH_TIMEOUT_MS = 8e3;
-var DEFAULT_CACHE_FILE = path32__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
+var DEFAULT_CACHE_FILE = path33__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
 function normalizeModelId2(id) {
   let s = id.toLowerCase();
   const slash = s.lastIndexOf("/");
@@ -7163,7 +7163,7 @@ var LiveDataProvider = class {
     if (this.loaded) return;
     this.loaded = true;
     try {
-      const raw = await fs10__default.default.readFile(this.opts.cacheFile, "utf-8");
+      const raw = await fs11__default.default.readFile(this.opts.cacheFile, "utf-8");
       const cache = JSON.parse(raw);
       if (cache.snapshot?.families) {
         this.snapshot = cache.snapshot;
@@ -7275,14 +7275,14 @@ var LiveDataProvider = class {
   }
   async saveCache() {
     try {
-      await fs10__default.default.mkdir(path32__default.default.dirname(this.opts.cacheFile), { recursive: true });
+      await fs11__default.default.mkdir(path33__default.default.dirname(this.opts.cacheFile), { recursive: true });
       const cache = {
         fetchedAt: this.fetchedAt,
         snapshot: this.snapshot ?? void 0,
         prices: Object.fromEntries(this.prices),
         capabilities: Object.fromEntries(this.capabilities)
       };
-      await fs10__default.default.writeFile(this.opts.cacheFile, JSON.stringify(cache, null, 2), "utf-8");
+      await fs11__default.default.writeFile(this.opts.cacheFile, JSON.stringify(cache, null, 2), "utf-8");
     } catch {
     }
   }
@@ -9110,7 +9110,8 @@ var KNOWN_TOOLS = [
   "generate_image",
   "generate_video",
   "generate_speech",
-  "transcribe_audio"
+  "transcribe_audio",
+  "generate_document"
 ];
 var PROVIDER_BACKED_TOOLS = /* @__PURE__ */ new Set([
   "generate_image",
@@ -9127,18 +9128,45 @@ function buildWorkerRules(has) {
     canWriteFiles && "- If the task asks for a file or artifact, you must actually create it in the workspace, verify that it exists, and inspect it before claiming success.",
     has("web_search") && '- Use the "web_search" tool to find current information, documentation, news, or general web data.',
     has("pdf_create") && '- Use the "pdf_create" tool for PDF requests.',
+    // A .docx/.pptx/.xlsx is a ZIP of OOXML parts, not text with a suffix.
+    // file_write does exactly what it promises — writes the model's characters
+    // verbatim — so without this rule the worker "wrote" a Word document that
+    // Word correctly reported as corrupted. Stated as an explicit prohibition
+    // on the tool it would otherwise reach for, because "use generate_document"
+    // alone competes with a file_write habit the model already has.
+    has("generate_document") && '- For a Word (.docx), PowerPoint (.pptx) or Excel (.xlsx) deliverable you MUST call the "generate_document" tool and NEVER "file_write" or "run_code" \u2014 those formats are ZIP archives of XML, so text written straight to the path opens as a corrupted file. Pass the target path plus the source: Markdown for .docx, Markdown slides separated by --- rules for .pptx (each slide starts with a heading), CSV for .xlsx.',
+    // The alternative to this rule is not "a worse chart" — it is a paragraph
+    // describing a chart that does not exist, which is what real decks came
+    // back with. A `chart:` block is checkable, carries the exact numbers, and
+    // becomes a genuine editable PowerPoint chart object.
+    has("generate_document") && '- For any data-driven visualization (a chart, graph, trend, breakdown or comparison of numbers), emit a fenced ```chart:bar block \u2014 also chart:line, chart:pie, chart:doughnut, chart:area, chart:scatter \u2014 whose body is an optional "title: ..." line followed by CSV: a header row of "<category label>,<series name>,<series name>", then one row per category. In a PowerPoint deliverable that becomes a REAL, editable chart carrying your exact numbers; in Word and Excel the same block keeps every value as a table or worksheet. Never write prose describing a chart in place of emitting one.',
     // Without this the model "writes the image" as prose — a bracketed
     // description sitting in the deck where the picture should be — even with a
     // working image model registered. Naming the reference syntax matters as
     // much as naming the tool: a generated image nobody embeds is still a
-    // missing image.
+    // missing image. It also has to say the reference must stand ALONE on its
+    // line, because only a standalone reference is parsed as a picture (see
+    // core/documents/blocks.ts matchImageLine) — one embedded mid-sentence
+    // silently degrades to caption text.
     //
-    // Scoped to PowerPoint/Word specifically: those are the only exporters
-    // that actually embed a Markdown image reference (cloud/web/exporters.ts
-    // toPptx/toDocx). PDF and plain-text/Markdown deliverables flatten a
-    // reference straight to caption text — telling the model to call
-    // generate_image for THOSE just pays for an image nobody ever sees.
-    has("generate_image") && '- When a slide deck (PowerPoint) or Word document deliverable calls for a decorative image or illustration, you MUST call the "generate_image" tool and then reference its result using Markdown image syntax: ![description](location), where "location" is exactly the string the tool reported back. NEVER write a text placeholder or a bracketed description such as [image: a cat] in its place. Do NOT use "generate_image" for a chart, graph, or diagram that must show exact data (numbers, axes, labels) \u2014 an image model cannot guarantee those values are correct, so render that data as a Markdown table instead. For any OTHER deliverable format (PDF, plain text, code, etc.) do NOT call "generate_image" \u2014 those cannot embed the result, so describe the visual in words instead.',
+    // Scoped to PowerPoint/Word specifically: those are the only renderers that
+    // actually embed a Markdown image reference. PDF and plain-text/Markdown
+    // deliverables flatten a reference straight to caption text — telling the
+    // model to call generate_image for THOSE just pays for an image nobody
+    // ever sees.
+    has("generate_image") && // Supersedes the earlier wording of this same rule: it now names the
+    // standalone-line parser constraint, says to generate BEFORE writing the
+    // document, and points data-driven visuals at a ```chart: block rather
+    // than a Markdown table, which is only the right advice now that chart
+    // blocks render as real chart objects.
+    '- When a slide deck (PowerPoint) or Word document deliverable calls for a decorative image, photo or illustration, you MUST call the "generate_image" tool \u2014 once per image the deliverable needs, BEFORE you write the document \u2014 and then put each result on a line of its OWN using Markdown image syntax: ![description](location), where "location" is exactly the string the tool reported back. A reference inside a sentence stays prose and no picture appears. NEVER write a text placeholder or a bracketed description such as [image: a cat] in its place, and never state that an image is included when you did not generate one. Do NOT use "generate_image" for a chart, graph or diagram that must show exact data (numbers, axes, labels) \u2014 an image model cannot guarantee those values are correct; emit a ```chart: block instead. For any OTHER deliverable format (PDF, plain text, code, etc.) do NOT call "generate_image" \u2014 those cannot embed the result, so describe the visual in words instead.',
+    // The other half of image reliability, and the half no amount of
+    // instruction-tightening could fix: generate_image only exists when an
+    // OpenAI or Gemini key is configured (multimodal/registry.ts CAPABILITIES).
+    // With neither, the model was never given a choice — and a model that
+    // doesn't know that writes "[illustration of a cat]" and moves on. Said out
+    // loud, up front, so the fallback is a real chart or honest prose.
+    !has("generate_image") && (has("generate_document") || canWriteFiles) && "- No image-generation model is available on this run, so there is NO tool that can draw a picture. Do not emit a Markdown image reference, a bracketed placeholder such as [image: a cat], or any claim that an illustration is included. If the request needs a data visualization use a ```chart: block, which needs no image model; otherwise describe the visual in words and say plainly that no image could be generated.",
     // The video counterpart of the image rule above, and the fix for the
     // reported "it writes scripts forever and never makes the video" run. The
     // failure mode is identical — the model narrates the deliverable instead of
@@ -9148,7 +9176,7 @@ function buildWorkerRules(has) {
     // the deliverable rather than an illustration inside one, and the reference
     // syntax is a plain link: Markdown image syntax does not embed a video.
     has("generate_video") && '- When the subtask deliverable is a video, you MUST call the "generate_video" tool \u2014 that call IS the deliverable, and the subtask is not done until it has returned. NEVER deliver the video as prose, a script, a storyboard, or a bracketed placeholder such as [video: a cat skating], and NEVER claim a video exists unless the tool reported a location for it. Call it exactly ONCE: it is billed per second of output and renders for minutes, so a second call charges the user again. Then report the location string the tool returned VERBATIM as your result, referencing it as [description](location) if it goes inside a document. If the tool reports a failure or a timeout, report that failure verbatim and stop \u2014 do NOT call it again, and do NOT substitute a written description of a video that was never made.',
-    has("run_code") && '- Use the "run_code" tool for any file types (Excel, Zip, csv, etc.) or complex processing not covered by other tools. Always cleanup after code execution.',
+    has("run_code") && `- Use the "run_code" tool for data processing, archives, and file formats not covered by a dedicated tool. ${has("generate_document") ? 'Do NOT use it to build a .docx, .pptx or .xlsx \u2014 "generate_document" already produces those correctly. ' : ""}${has("pdf_create") ? 'Do NOT use it to build a PDF \u2014 "pdf_create" does that. ' : ""}Always cleanup after code execution.`,
     "- If you are not making meaningful progress, stop and escalate rather than looping or padding the response.",
     has("peer_message") && '- Use the "peer_message" tool to communicate with other T3 workers if your tasks have dependencies or shared state. You can send updates or wait for signals.',
     hasAnyTool && "- Only use tools directly relevant to THIS subtask. Do not reach for an unrelated connected-service action (e.g. creating, deleting, or modifying a repository, issue, or PR; sending a message) unless the subtask explicitly calls for it.",
@@ -9159,13 +9187,34 @@ function buildWorkerRules(has) {
 Rules:
 ${rules.filter((r) => r !== false).join("\n")}`;
 }
-var ARTIFACT_TOOLS = /* @__PURE__ */ new Set(["file_write", "file_edit", "shell"]);
+var ARTIFACT_TOOLS = /* @__PURE__ */ new Set(["file_write", "file_edit", "shell", "generate_document"]);
+var ARTIFACT_FILE_RE = /\b[\w./-]+\.(pdf|md|html|txt|json|csv|py|js|ts|tsx|jsx|docx?|pptx?|xlsx?|png|jpg|jpeg|svg|gif)\b/i;
 function shouldRequireArtifact(assignment, toolNames) {
   if (!toolNames.some((n) => ARTIFACT_TOOLS.has(n))) return false;
   if (assignment?.files?.length) return true;
   const haystack = `${assignment?.description ?? ""}
 ${assignment?.expectedOutput ?? ""}`;
-  return /\b[\w./-]+\.(pdf|md|html|txt|json|csv|py|js|ts|tsx|jsx|docx?|png|jpg|jpeg|svg|gif)\b/i.test(haystack) || /save (?:a|the)? file|create (?:a|the)? file|write (?:a|the)? file/i.test(haystack);
+  return ARTIFACT_FILE_RE.test(haystack) || /save (?:a|the)? file|create (?:a|the)? file|write (?:a|the)? file/i.test(haystack);
+}
+var VISUAL_REQUEST_RE = /\b(image|images|picture|pictures|photo|photos|illustration|illustrations|visual|visuals|visualisation|visualization|visualizations|chart|charts|graph|graphs|plot|plots|diagram|diagrams|infographic)\b/i;
+var IMAGE_REF_RE = /!\[[^\]]*\]\([^)]+\)/;
+var CHART_BLOCK_RE = /^\s*```+\s*chart\s*:/im;
+function missingVisualEvidence(assignment, output, calledTools, toolNames) {
+  const canVisualize = toolNames.includes("generate_image") || toolNames.includes("generate_document");
+  if (!canVisualize) return null;
+  const haystack = `${assignment?.description ?? ""}
+${assignment?.expectedOutput ?? ""}`;
+  if (!VISUAL_REQUEST_RE.test(haystack)) return null;
+  if (calledTools.includes("generate_image") || calledTools.includes("generate_document")) return null;
+  if (IMAGE_REF_RE.test(output) || CHART_BLOCK_RE.test(output)) return null;
+  const options = [];
+  if (toolNames.includes("generate_image")) {
+    options.push('call "generate_image" and reference the result on its own line as ![description](location)');
+  }
+  if (toolNames.includes("generate_document")) {
+    options.push("emit a fenced ```chart:bar (or chart:line / chart:pie) block whose body is CSV, for anything data-driven");
+  }
+  return `The subtask asks for a visual, but the output contains no embedded image and no chart block \u2014 only prose. ${options.join(", or ")}. Describing a picture is not producing one.`;
 }
 var T3Worker = class extends BaseTier {
   router;
@@ -9346,6 +9395,18 @@ Now execute your subtask using this context where relevant.`
           return this.buildResult("ESCALATED", output, { checksRun, passed, failed }, issues, correctionAttempts);
         }
       }
+      const visualIssue = missingVisualEvidence(
+        assignment,
+        output,
+        toolCalls.map((t) => t.name),
+        this.tools.map((t) => t.name)
+      );
+      if (visualIssue) {
+        correctionAttempts = 1;
+        issues.push(visualIssue);
+        this.sendStatusUpdate({ progressPct: 68, currentAction: "Verifying requested visuals", status: "IN_PROGRESS" });
+        output = await this.correctOutput(output, [visualIssue]);
+      }
       this.sendStatusUpdate({ progressPct: 70, currentAction: "Self-testing output", status: "IN_PROGRESS" });
       const testResult = await this.selfTest(assignment, output);
       checksRun.push(...testResult.checksRun);
@@ -9660,8 +9721,8 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : "") + textToolSuffix,
         // Media generation can run for a minute; without this a cancelled run
         // still pays for an image nobody will see.
         ...this.signal ? { signal: this.signal } : {},
-        saveSnapshot: async (path37, content) => {
-          this.store?.addFileSnapshot(this.taskId, path37, content);
+        saveSnapshot: async (path38, content) => {
+          this.store?.addFileSnapshot(this.taskId, path38, content);
         },
         sendPeerSync: (to, syncType, content) => {
           this.peerBus?.send(this.id, to, syncType, this.assignment?.subtaskId ?? "", content);
@@ -9837,7 +9898,7 @@ ${assignment.expectedOutput}`;
     const declared = (assignment.files ?? []).map((f) => f.trim()).filter((f) => f.includes("."));
     const haystack = `${assignment.description}
 ${assignment.expectedOutput}`;
-    const matches = haystack.match(/\b[\w./-]+\.(pdf|md|html|txt|json|csv|py|js|ts|tsx|jsx|docx?|png|jpg|jpeg|svg|gif)\b/gi) ?? [];
+    const matches = haystack.match(new RegExp(ARTIFACT_FILE_RE.source, "gi")) ?? [];
     return [.../* @__PURE__ */ new Set([...declared, ...matches.map((m) => m.trim())])];
   }
   async verifyArtifacts(assignment) {
@@ -9848,9 +9909,9 @@ ${assignment.expectedOutput}`;
     const { promisify: promisify4 } = await import('util');
     const execAsync3 = promisify4(exec3);
     for (const artifactPath of artifactPaths) {
-      const absolutePath = path32__default.default.resolve(process.cwd(), artifactPath);
+      const absolutePath = path33__default.default.resolve(process.cwd(), artifactPath);
       try {
-        const stat = await fs10__default.default.stat(absolutePath);
+        const stat = await fs11__default.default.stat(absolutePath);
         if (!stat.isFile()) {
           issues.push(`Expected artifact is not a file: ${artifactPath}`);
           continue;
@@ -9859,8 +9920,22 @@ ${assignment.expectedOutput}`;
           issues.push(`Artifact is empty: ${artifactPath}`);
           continue;
         }
-        if (!/\.pdf$/i.test(artifactPath)) {
-          const content = await fs10__default.default.readFile(absolutePath, "utf-8");
+        if (/\.(docx|pptx|xlsx)$/i.test(artifactPath)) {
+          const head = Buffer.alloc(4);
+          const fh = await fs11__default.default.open(absolutePath, "r");
+          try {
+            await fh.read(head, 0, 4, 0);
+          } finally {
+            await fh.close();
+          }
+          if (head.toString("latin1") !== "PK") {
+            issues.push(
+              `${artifactPath} is not a valid Office file \u2014 it must be written with the generate_document tool, which renders the real OOXML archive. Plain text saved under that extension opens as corrupted.`
+            );
+            continue;
+          }
+        } else if (!/\.pdf$/i.test(artifactPath)) {
+          const content = await fs11__default.default.readFile(absolutePath, "utf-8");
           if (!content.trim()) {
             issues.push(`Artifact content is empty: ${artifactPath}`);
             continue;
@@ -9869,7 +9944,7 @@ ${assignment.expectedOutput}`;
           issues.push(`PDF artifact looks too small to be valid: ${artifactPath}`);
           continue;
         }
-        const ext = path32__default.default.extname(absolutePath).toLowerCase();
+        const ext = path33__default.default.extname(absolutePath).toLowerCase();
         try {
           if (ext === ".ts" || ext === ".tsx") {
             await execAsync3(`npx tsc --noEmit ${absolutePath}`, { timeout: 1e4 });
@@ -12823,6 +12898,700 @@ function buildMediaTools(deps, readFile) {
   if (modalities.has("transcription") && readFile) tools.push(new TranscribeAudioTool(deps, readFile));
   return tools;
 }
+var WorkspaceSandboxError = class extends Error {
+  constructor(attempted, workspaceRoot) {
+    super(`Refusing access to "${attempted}" \u2014 outside workspace root "${workspaceRoot}".`);
+    this.name = "WorkspaceSandboxError";
+  }
+};
+function resolveInWorkspace(workspaceRoot, input) {
+  if (typeof input !== "string" || input.length === 0) {
+    throw new WorkspaceSandboxError(String(input), workspaceRoot);
+  }
+  const root = path33__default.default.resolve(workspaceRoot);
+  const abs = path33__default.default.isAbsolute(input) ? path33__default.default.resolve(input) : path33__default.default.resolve(root, input);
+  const rel = path33__default.default.relative(root, abs);
+  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path33__default.default.isAbsolute(rel)) {
+    throw new WorkspaceSandboxError(input, root);
+  }
+  try {
+    const real = fs30__default.default.realpathSync(abs);
+    const realRel = path33__default.default.relative(root, real);
+    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path33__default.default.isAbsolute(realRel))) {
+      throw new WorkspaceSandboxError(input, root);
+    }
+  } catch (e) {
+    if (e instanceof WorkspaceSandboxError) throw e;
+  }
+  return abs;
+}
+
+// src/core/documents/blocks.ts
+function fileExt(name) {
+  const base = name.split(/[\\/]/).pop() ?? name;
+  const dot = base.lastIndexOf(".");
+  return dot > 0 ? base.slice(dot + 1).toLowerCase() : "";
+}
+function parseDelimited(text, name = "") {
+  const delim = fileExt(name) === "tsv" || text.indexOf("	") !== -1 && text.indexOf(",") === -1 ? "	" : ",";
+  const rows = [];
+  let row = [];
+  let cell = "";
+  let quoted = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (quoted) {
+      if (ch === '"') {
+        if (text[i + 1] === '"') {
+          cell += '"';
+          i++;
+        } else quoted = false;
+      } else cell += ch;
+    } else if (ch === '"') {
+      quoted = true;
+    } else if (ch === delim) {
+      row.push(cell);
+      cell = "";
+    } else if (ch === "\n") {
+      row.push(cell);
+      rows.push(row);
+      row = [];
+      cell = "";
+    } else if (ch === "\r") ; else {
+      cell += ch;
+    }
+    if (rows.length > 5e3) break;
+  }
+  if (cell !== "" || row.length) {
+    row.push(cell);
+    rows.push(row);
+  }
+  return rows.filter((r) => r.length > 1 || (r[0] ?? "") !== "");
+}
+var CHART_ALIASES = {
+  bar: "bar",
+  column: "bar",
+  bars: "bar",
+  barchart: "bar",
+  horizontalbar: "bar",
+  line: "line",
+  lines: "line",
+  linechart: "line",
+  pie: "pie",
+  piechart: "pie",
+  doughnut: "doughnut",
+  donut: "doughnut",
+  area: "area",
+  areachart: "area",
+  scatter: "scatter",
+  xy: "scatter"
+};
+function chartKind(raw) {
+  return CHART_ALIASES[raw.trim().toLowerCase().replace(/[\s_-]/g, "")] ?? null;
+}
+function toNumber(cell) {
+  const cleaned = cell.replace(/[$£€¥,\s%]/g, "").replace(/^\((.*)\)$/, "-$1");
+  const n = Number.parseFloat(cleaned);
+  return Number.isFinite(n) ? n : 0;
+}
+function parseChartSpec(kind, body) {
+  const lines = body.replace(/\r\n/g, "\n").split("\n");
+  let title;
+  while (lines.length && !lines[0].trim()) lines.shift();
+  const titleMatch = lines[0]?.match(/^\s*title\s*:\s*(.+)$/i);
+  if (titleMatch) {
+    title = titleMatch[1].trim();
+    lines.shift();
+  }
+  const rows = parseDelimited(lines.join("\n").trim());
+  if (rows.length < 2) return null;
+  const header = rows[0].map((c) => c.trim());
+  if (header.length < 2) return null;
+  const dataRows = rows.slice(1).filter((r) => r.some((c) => c.trim() !== ""));
+  if (!dataRows.length) return null;
+  const categories = dataRows.map((r, i) => (r[0] ?? "").trim() || `Item ${i + 1}`);
+  const series = header.slice(1).map((name, col2) => ({
+    name: name || `Series ${col2 + 1}`,
+    values: dataRows.map((r) => toNumber((r[col2 + 1] ?? "").trim()))
+  }));
+  if (!series.length) return null;
+  return {
+    kind,
+    ...title ? { title } : {},
+    categoryName: header[0] || "Category",
+    categories,
+    series
+  };
+}
+function chartToTableRows(spec) {
+  return [
+    [spec.categoryName, ...spec.series.map((s) => s.name)],
+    ...spec.categories.map((cat, i) => [cat, ...spec.series.map((s) => String(s.values[i] ?? 0))])
+  ];
+}
+function parseBlocks(md) {
+  const out = [];
+  const lines = md.replace(/\r\n/g, "\n").split("\n");
+  let i = 0;
+  let ordinal = 0;
+  const reset = () => {
+    ordinal = 0;
+  };
+  while (i < lines.length) {
+    const line = lines[i] ?? "";
+    const fence = line.match(/^```+\s*(.*)$/);
+    if (fence) {
+      const info = (fence[1] ?? "").trim();
+      i++;
+      const code = [];
+      while (i < lines.length && !/^```/.test(lines[i] ?? "")) {
+        code.push(lines[i] ?? "");
+        i++;
+      }
+      i++;
+      const chartInfo = info.match(/^chart\s*:\s*(.+)$/i);
+      const kind = chartInfo ? chartKind(chartInfo[1]) : null;
+      const spec = kind ? parseChartSpec(kind, code.join("\n")) : null;
+      out.push(spec ? { t: "chart", spec } : { t: "code", lines: code });
+      reset();
+      continue;
+    }
+    if (!line.trim()) {
+      i++;
+      reset();
+      continue;
+    }
+    const h = line.match(/^(#{1,6})\s+(.*)$/);
+    if (h) {
+      out.push({ t: "heading", level: h[1].length, text: h[2] });
+      i++;
+      reset();
+      continue;
+    }
+    if (/^\s*([-*_])\s*(\1\s*){2,}$/.test(line)) {
+      out.push({ t: "hr" });
+      i++;
+      reset();
+      continue;
+    }
+    const li = line.match(/^(\s*)([-*+]|\d+[.)])\s+(.*)$/);
+    if (li) {
+      const ordered = /\d/.test(li[2]);
+      ordinal = ordered ? ordinal + 1 : 0;
+      out.push({ t: "bullet", ordered, index: ordered ? ordinal : 0, text: li[3] });
+      i++;
+      continue;
+    }
+    if (/^>\s?/.test(line)) {
+      out.push({ t: "quote", text: line.replace(/^>\s?/, "") });
+      i++;
+      reset();
+      continue;
+    }
+    if (/^\|.*\|/.test(line)) {
+      const rows = [];
+      while (i < lines.length && /^\|.*\|/.test(lines[i] ?? "")) {
+        const r = lines[i];
+        if (!/^\|[\s:|-]+\|?\s*$/.test(r)) rows.push(r.replace(/^\||\|\s*$/g, "").split("|").map((c) => c.trim()));
+        i++;
+      }
+      out.push({ t: "table", rows });
+      reset();
+      continue;
+    }
+    out.push({ t: "para", text: line });
+    i++;
+    reset();
+  }
+  return out;
+}
+var IMAGE_LINE = /^!\[([^\]]*)\]\(([^)]+)\)$/;
+function matchImageLine(s) {
+  const m = s.trim().match(IMAGE_LINE);
+  return m ? { alt: m[1].trim(), url: m[2].trim() } : null;
+}
+function sniffImage(b) {
+  const dv = new DataView(b.buffer, b.byteOffset, b.byteLength);
+  if (b.length > 24 && b[0] === 137 && b[1] === 80 && b[2] === 78 && b[3] === 71) {
+    return { type: "png", mime: "image/png", width: dv.getUint32(16), height: dv.getUint32(20) };
+  }
+  if (b.length > 10 && b[0] === 71 && b[1] === 73 && b[2] === 70) {
+    return { type: "gif", mime: "image/gif", width: dv.getUint16(6, true), height: dv.getUint16(8, true) };
+  }
+  if (b.length > 26 && b[0] === 66 && b[1] === 77) {
+    return { type: "bmp", mime: "image/bmp", width: Math.abs(dv.getInt32(18, true)), height: Math.abs(dv.getInt32(22, true)) };
+  }
+  if (b.length > 4 && b[0] === 255 && b[1] === 216) {
+    let i = 2;
+    while (i + 9 < b.length) {
+      if (b[i] !== 255) {
+        i++;
+        continue;
+      }
+      const marker = b[i + 1];
+      if (marker >= 192 && marker <= 207 && marker !== 196 && marker !== 200 && marker !== 204) {
+        return { type: "jpg", mime: "image/jpeg", height: dv.getUint16(i + 5), width: dv.getUint16(i + 7) };
+      }
+      i += 2 + dv.getUint16(i + 2);
+    }
+  }
+  return null;
+}
+function bytesToBase64(bytes) {
+  const g = globalThis;
+  if (g.Buffer) return g.Buffer.from(bytes).toString("base64");
+  const CHUNK = 32768;
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += CHUNK) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+  }
+  return g.btoa(binary);
+}
+function stripInline(s) {
+  return s.replace(/\*\*(.+?)\*\*/g, "$1").replace(/(^|[^*])\*(?!\s)(.+?)\*/g, "$1$2").replace(/`([^`]+)`/g, "$1").replace(/\[(.+?)\]\((.+?)\)/g, "$1 ($2)");
+}
+function inlineRuns(text) {
+  const acc = [];
+  const re = /(\*\*[^*]+\*\*|`[^`]+`|\[[^\]]{1,500}\]\([^)]{1,2000}\)|\*[^*\s][^*]*\*)/g;
+  let last = 0;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    if (m.index > last) acc.push({ text: text.slice(last, m.index) });
+    const tok = m[0];
+    if (tok.startsWith("**")) acc.push({ text: tok.slice(2, -2), bold: true });
+    else if (tok.startsWith("`")) acc.push({ text: tok.slice(1, -1), code: true });
+    else if (tok.startsWith("[")) {
+      const l = tok.match(/\[([^\]]{1,500})\]\(([^)]{1,2000})\)/);
+      acc.push({ text: l ? `${l[1]} (${l[2]})` : tok });
+    } else acc.push({ text: tok.slice(1, -1), italic: true });
+    last = re.lastIndex;
+  }
+  if (last < text.length) acc.push({ text: text.slice(last) });
+  return acc.length ? acc : [{ text }];
+}
+function splitSlides(md) {
+  const norm = md.replace(/\r\n/g, "\n").trim();
+  let chunks = norm.split(/\n\s*-{3,}\s*\n/);
+  if (chunks.length === 1) {
+    const lines = norm.split("\n");
+    const sections = [];
+    let cur = [];
+    for (const ln of lines) {
+      if (/^#{1,2}\s+/.test(ln) && cur.some((l) => l.trim())) {
+        sections.push(cur.join("\n"));
+        cur = [];
+      }
+      cur.push(ln);
+    }
+    if (cur.length) sections.push(cur.join("\n"));
+    if (sections.length > 1) chunks = sections;
+  }
+  return chunks.map(parseSlide).filter((s) => s.title || s.body.length || s.images.length || s.charts.length);
+}
+function parseSlide(chunk) {
+  let title = "";
+  const body = [];
+  const images = [];
+  const charts = [];
+  const lines = chunk.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i] ?? "";
+    const fence = raw.match(/^[ \t]*```+[ \t]*chart[ \t]*:(.*)/i);
+    if (fence) {
+      const kind = chartKind(fence[1]);
+      const bodyLines = [];
+      i++;
+      while (i < lines.length && !/^\s*```/.test(lines[i] ?? "")) {
+        bodyLines.push(lines[i] ?? "");
+        i++;
+      }
+      const spec = kind ? parseChartSpec(kind, bodyLines.join("\n")) : null;
+      if (spec) charts.push(spec);
+      else for (const bl of bodyLines) if (bl.trim()) body.push(stripInline(bl.trim()));
+      continue;
+    }
+    const line = raw.trim();
+    if (!line) continue;
+    const h = line.match(/^#{1,6}[ \t]+(.*)/);
+    if (h) {
+      if (!title) title = stripInline(h[1]);
+      else body.push(stripInline(h[1]));
+      continue;
+    }
+    const img = matchImageLine(line);
+    if (img) {
+      images.push(img);
+      continue;
+    }
+    const li = line.match(/^([-*+]|\d+[.)])[ \t]+(.*)/);
+    if (li) {
+      const bulletImg = matchImageLine(li[2]);
+      if (bulletImg) {
+        images.push(bulletImg);
+        continue;
+      }
+      body.push(stripInline(li[2]));
+      continue;
+    }
+    if (/^>\s?/.test(line)) {
+      body.push(stripInline(line.replace(/^>\s?/, "")));
+      continue;
+    }
+    body.push(stripInline(line));
+  }
+  return { title, body, images, charts };
+}
+function extractCharts(source) {
+  const lines = source.replace(/\r\n/g, "\n").split("\n");
+  const charts = [];
+  const rest = [];
+  for (let i = 0; i < lines.length; i++) {
+    const fence = lines[i].match(/^[ \t]*```+[ \t]*chart[ \t]*:(.*)/i);
+    if (!fence) {
+      rest.push(lines[i]);
+      continue;
+    }
+    const kind = chartKind(fence[1]);
+    const body = [];
+    i++;
+    while (i < lines.length && !/^\s*```/.test(lines[i] ?? "")) {
+      body.push(lines[i] ?? "");
+      i++;
+    }
+    const spec = kind ? parseChartSpec(kind, body.join("\n")) : null;
+    if (spec) charts.push(spec);
+    else rest.push(...body);
+  }
+  return { charts, rest: rest.join("\n") };
+}
+
+// src/core/documents/render.ts
+function isDocumentFormat(ext) {
+  return ext === "docx" || ext === "pptx" || ext === "xlsx";
+}
+async function loadImage(ref, load) {
+  if (!load) return null;
+  try {
+    const bytes = await load(ref.url);
+    if (!bytes || !bytes.length) return null;
+    const info = sniffImage(bytes);
+    if (!info || info.width <= 0 || info.height <= 0) return null;
+    return { ...info, bytes, alt: ref.alt };
+  } catch {
+    return null;
+  }
+}
+async function renderXlsx(source, opts = {}) {
+  const XLSX = await import('xlsx');
+  const { charts, rest } = extractCharts(source);
+  const name = opts.name ?? "";
+  const rows = parseDelimited(rest, name.toLowerCase().endsWith(".tsv") ? "x.tsv" : "x.csv");
+  const wb = XLSX.utils.book_new();
+  XLSX.utils.book_append_sheet(wb, XLSX.utils.aoa_to_sheet(rows.length ? rows : [[""]]), "Sheet1");
+  const used = /* @__PURE__ */ new Set(["Sheet1"]);
+  charts.forEach((spec, i) => {
+    const base = (spec.title || `Chart ${i + 1}`).replace(/[:\\/?*[\]]/g, " ").trim().slice(0, 28) || `Chart ${i + 1}`;
+    let sheetName = base;
+    let n = 2;
+    while (used.has(sheetName)) sheetName = `${base} ${n++}`.slice(0, 31);
+    used.add(sheetName);
+    const aoa = [
+      [spec.categoryName, ...spec.series.map((s) => s.name)],
+      ...spec.categories.map((cat, r) => [cat, ...spec.series.map((s) => s.values[r] ?? 0)])
+    ];
+    XLSX.utils.book_append_sheet(wb, XLSX.utils.aoa_to_sheet(aoa), sheetName);
+  });
+  return new Uint8Array(XLSX.write(wb, { type: "array", bookType: "xlsx" }));
+}
+var DOCX_MAX_W = 600;
+var DOCX_MAX_H = 864;
+async function renderDocx(md, opts = {}) {
+  const d = await import('docx');
+  const {
+    Document,
+    Packer,
+    Paragraph,
+    TextRun,
+    ImageRun,
+    HeadingLevel,
+    Table,
+    TableRow,
+    TableCell,
+    WidthType,
+    BorderStyle,
+    AlignmentType
+  } = d;
+  const HEADINGS = [
+    HeadingLevel.HEADING_1,
+    HeadingLevel.HEADING_2,
+    HeadingLevel.HEADING_3,
+    HeadingLevel.HEADING_4,
+    HeadingLevel.HEADING_5,
+    HeadingLevel.HEADING_6
+  ];
+  const runs = (text) => inlineRuns(text).map((r) => new TextRun({
+    text: r.text,
+    ...r.bold ? { bold: true } : {},
+    ...r.italic ? { italics: true } : {},
+    ...r.code ? { font: "Courier New" } : {}
+  }));
+  const tableOf = (rows) => new Table({
+    width: { size: 100, type: WidthType.PERCENTAGE },
+    rows: rows.map((r) => new TableRow({
+      children: r.map((c) => new TableCell({ children: [new Paragraph({ children: runs(c) })] }))
+    }))
+  });
+  const imageParagraph = (img) => {
+    const scale = Math.min(1, DOCX_MAX_W / img.width, DOCX_MAX_H / img.height);
+    return new Paragraph({
+      children: [new ImageRun({
+        type: img.type,
+        data: img.bytes,
+        transformation: { width: Math.round(img.width * scale), height: Math.round(img.height * scale) },
+        ...img.alt ? { altText: { name: img.alt, description: img.alt, title: img.alt } } : {}
+      })]
+    });
+  };
+  const asImage = async (text) => {
+    const ref = matchImageLine(text);
+    return ref ? await loadImage(ref, opts.loadImageBytes) : null;
+  };
+  const children = [];
+  for (const b of parseBlocks(md)) {
+    switch (b.t) {
+      case "heading":
+        children.push(new Paragraph({ heading: HEADINGS[Math.min(b.level, 6) - 1], children: runs(b.text) }));
+        break;
+      case "para": {
+        const img = await asImage(b.text);
+        children.push(img ? imageParagraph(img) : new Paragraph({ children: runs(b.text) }));
+        break;
+      }
+      case "bullet": {
+        const img = await asImage(b.text);
+        children.push(img ? imageParagraph(img) : new Paragraph({
+          children: runs(b.text),
+          ...b.ordered ? { numbering: { reference: "ol", level: 0 } } : { bullet: { level: 0 } }
+        }));
+        break;
+      }
+      case "code":
+        for (const cl of b.lines) {
+          children.push(new Paragraph({ children: [new TextRun({ text: cl || " ", font: "Courier New", size: 18 })] }));
+        }
+        break;
+      case "quote":
+        children.push(new Paragraph({ indent: { left: 360 }, children: [new TextRun({ text: stripInline(b.text), italics: true })] }));
+        break;
+      case "table":
+        children.push(tableOf(b.rows));
+        break;
+      case "chart":
+        if (b.spec.title) {
+          children.push(new Paragraph({ children: [new TextRun({ text: b.spec.title, bold: true })] }));
+        }
+        children.push(tableOf(chartToTableRows(b.spec)));
+        break;
+      case "hr":
+        children.push(new Paragraph({
+          children: [],
+          border: { bottom: { color: "CCCCCC", space: 1, style: BorderStyle.SINGLE, size: 6 } }
+        }));
+        break;
+    }
+  }
+  const doc = new Document({
+    numbering: {
+      config: [{ reference: "ol", levels: [{ level: 0, format: "decimal", text: "%1.", alignment: AlignmentType.START }] }]
+    },
+    sections: [{ children: children.length ? children : [new Paragraph({ children: [new TextRun("")] })] }]
+  });
+  return new Uint8Array(await Packer.toArrayBuffer(doc));
+}
+function pptxConstructor(mod) {
+  let c = mod;
+  for (let i = 0; i < 3 && c && typeof c !== "function"; i++) c = c.default;
+  if (typeof c !== "function") throw new Error("pptxgenjs did not export a constructor.");
+  return c;
+}
+var SLIDE_H = 7.5;
+var CONTENT_X = 0.6;
+var CONTENT_W = 12.1;
+var CONTENT_BOTTOM = 0.4;
+async function renderPptx(md, opts = {}) {
+  const PptxGen = pptxConstructor(await import('pptxgenjs'));
+  const pptx = new PptxGen();
+  pptx.layout = "LAYOUT_WIDE";
+  const CHART_TYPES = {
+    bar: pptx.ChartType["bar"],
+    line: pptx.ChartType["line"],
+    pie: pptx.ChartType["pie"],
+    doughnut: pptx.ChartType["doughnut"],
+    area: pptx.ChartType["area"],
+    scatter: pptx.ChartType["scatter"]
+  };
+  const slides = splitSlides(md);
+  const blank = { title: "", body: [""], images: [], charts: [] };
+  for (const s of slides.length ? slides : [blank]) {
+    const slide = pptx.addSlide();
+    if (s.title) slide.addText(s.title, { x: 0.5, y: 0.35, w: 12.3, h: 0.9, fontSize: 28, bold: true, color: "1F2937" });
+    const top = s.title ? 1.5 : 0.5;
+    const pics = (await Promise.all(s.images.map((r) => loadImage(r, opts.loadImageBytes)))).filter((p) => p !== null);
+    const visuals = [
+      ...s.charts.map((spec) => ({ kind: "chart", spec })),
+      ...pics.map((img) => ({ kind: "image", img }))
+    ];
+    const bodyH = visuals.length ? 2.2 : 5.4;
+    if (s.body.length) {
+      slide.addText(
+        s.body.map((t) => ({ text: t, options: { bullet: true, breakLine: true } })),
+        { x: CONTENT_X, y: top, w: CONTENT_W, h: bodyH, fontSize: 16, color: "374151", valign: "top" }
+      );
+    }
+    if (visuals.length) {
+      const y = top + (s.body.length ? bodyH + 0.2 : 0);
+      const h = Math.max(1, SLIDE_H - CONTENT_BOTTOM - y);
+      const gap = 0.3;
+      const w = (CONTENT_W - gap * (visuals.length - 1)) / visuals.length;
+      visuals.forEach((v, i) => {
+        const x = CONTENT_X + i * (w + gap);
+        if (v.kind === "image") {
+          slide.addImage({
+            data: `data:${v.img.mime};base64,${bytesToBase64(v.img.bytes)}`,
+            x,
+            y,
+            w,
+            h,
+            // 'contain' keeps the aspect ratio inside the box — a stretched
+            // render looks worse than a smaller correct one.
+            sizing: { type: "contain", w, h },
+            ...v.img.alt ? { altText: v.img.alt } : {}
+          });
+        } else {
+          slide.addChart(CHART_TYPES[v.spec.kind], chartData(v.spec), {
+            x,
+            y,
+            w,
+            h,
+            showLegend: v.spec.series.length > 1 || v.spec.kind === "pie" || v.spec.kind === "doughnut",
+            legendPos: "b",
+            showTitle: !!v.spec.title,
+            ...v.spec.title ? { title: v.spec.title } : {},
+            showValue: v.spec.kind === "pie" || v.spec.kind === "doughnut"
+          });
+        }
+      });
+    }
+  }
+  return new Uint8Array(await pptx.write({ outputType: "arraybuffer" }));
+}
+function chartData(spec) {
+  const series = spec.kind === "pie" || spec.kind === "doughnut" ? spec.series.slice(0, 1) : spec.series;
+  return series.map((s) => ({ name: s.name, labels: spec.categories, values: s.values }));
+}
+async function renderDocument(format, source, opts = {}) {
+  if (format === "docx") return renderDocx(source, opts);
+  if (format === "pptx") return renderPptx(source, opts);
+  return renderXlsx(source, opts);
+}
+
+// src/tools/generate-document.ts
+var SOURCE_HINT = {
+  docx: "Markdown",
+  pptx: "Markdown slides (separate slides with a --- rule; each slide starts with a heading)",
+  xlsx: "CSV (one header row, then data rows)"
+};
+var GenerateDocumentTool = class extends BaseTool {
+  /**
+   * `readFile` is injected so the image loader is testable and so a host with a
+   * different workspace (not plain disk) can supply its own reader.
+   */
+  constructor(readFile = async (p) => new Uint8Array(await fs11__default.default.readFile(p))) {
+    super();
+    this.readFile = readFile;
+  }
+  readFile;
+  name = "generate_document";
+  description = "Create a REAL Microsoft Office file (.docx Word, .pptx PowerPoint, .xlsx Excel) in the workspace. You write the SOURCE and this tool renders the actual binary: Markdown for .docx, Markdown slides (separated by --- rules) for .pptx, CSV for .xlsx. ALWAYS use this instead of file_write for those three extensions \u2014 file_write stores your text verbatim, which Office reports as a corrupted file. Supports embedded images (reference a generated image as ![alt](path-the-image-tool-returned) on its own line) and real, data-accurate charts (a ```chart:bar / chart:line / chart:pie fenced block whose body is CSV). Use pdf_create for PDFs.";
+  inputSchema = {
+    type: "object",
+    properties: {
+      path: {
+        type: "string",
+        description: "Where to write the file, relative to the workspace root. The extension decides the format: .docx, .pptx or .xlsx."
+      },
+      content: {
+        type: "string",
+        description: 'The document source. Markdown for .docx; Markdown slides separated by --- rules for .pptx (each slide starts with a heading); CSV for .xlsx. A standalone ![alt](path) line embeds that image. A fenced ```chart:bar (or chart:line, chart:pie, chart:area, chart:doughnut, chart:scatter) block whose body is CSV \u2014 an optional "title: \u2026" line, then a header row of "<category>,<series1>,<series2>", then data rows \u2014 becomes a real chart.'
+      },
+      format: {
+        type: "string",
+        description: 'Optional override: "docx", "pptx" or "xlsx". Normally inferred from the path extension.'
+      }
+    },
+    required: ["path", "content"]
+  };
+  isDangerous() {
+    return true;
+  }
+  async execute(input, options) {
+    const filePath = String(input["path"] ?? "").trim();
+    if (!filePath) return 'Provide a "path" for the document, e.g. "report.docx".';
+    const content = typeof input["content"] === "string" ? input["content"] : "";
+    if (!content.trim()) return 'Provide "content" \u2014 the Markdown (docx/pptx) or CSV (xlsx) source for the document.';
+    const requested = String(input["format"] ?? "").trim().toLowerCase().replace(/^\./, "");
+    const ext = requested || fileExt(filePath);
+    if (!isDocumentFormat(ext)) {
+      return `generate_document renders .docx, .pptx and .xlsx. "${filePath}" is not one of those \u2014 use pdf_create for a PDF, or file_write for a text file.`;
+    }
+    const absPath = resolveInWorkspace(this.workspaceRoot, filePath);
+    const embedded = [];
+    const skipped = [];
+    const loadImageBytes = async (url) => {
+      if (/^(https?|ftp):\/\//i.test(url)) {
+        skipped.push(`${url} (remote URL \u2014 download it into the workspace first)`);
+        return null;
+      }
+      const local = url.replace(/^file:\/\//i, "").split("?")[0].split("#")[0];
+      try {
+        const bytes2 = await this.readFile(resolveInWorkspace(this.workspaceRoot, decodeURIComponent(local)));
+        embedded.push(local);
+        return bytes2;
+      } catch {
+        skipped.push(`${local} (not found in the workspace)`);
+        return null;
+      }
+    };
+    if (options.saveSnapshot) {
+      try {
+        const old = await fs11__default.default.readFile(absPath, "utf-8");
+        await options.saveSnapshot(absPath, old);
+      } catch {
+      }
+    }
+    const bytes = await renderDocument(ext, content, { name: filePath, loadImageBytes });
+    await fs11__default.default.mkdir(path33__default.default.dirname(absPath), { recursive: true });
+    await fs11__default.default.writeFile(absPath, bytes);
+    const charts = countCharts(content);
+    return [
+      `Wrote a real ${LABEL[ext]} file to ${filePath} (${bytes.length} bytes) from ${SOURCE_HINT[ext]}.`,
+      embedded.length ? `Embedded ${embedded.length} image(s): ${embedded.join(", ")}.` : "",
+      // Named, not counted: a dropped image is the failure the user actually
+      // notices, and the model can only fix it if it is told which reference died.
+      skipped.length ? `Could NOT embed ${skipped.length} image reference(s): ${skipped.join("; ")}.` : "",
+      charts && ext === "pptx" ? `Rendered ${charts} chart block(s) as real, editable PowerPoint charts.` : "",
+      charts && ext === "docx" ? `Rendered ${charts} chart block(s) as data tables \u2014 Word documents cannot hold a native chart object.` : "",
+      charts && ext === "xlsx" ? `Wrote ${charts} chart block(s) onto their own worksheets as real rows the user can chart in Excel.` : ""
+    ].filter(Boolean).join("\n");
+  }
+};
+var LABEL = { docx: "Word", pptx: "PowerPoint", xlsx: "Excel" };
+function countCharts(source) {
+  return (source.match(/^\s*```+\s*chart\s*:/gim) ?? []).length;
+}
+function buildDocumentTools(readFile) {
+  return readFile ? [new GenerateDocumentTool(readFile)] : [];
+}
 
 // src/core/run-breaker.ts
 var DEFAULT_FAILURE_THRESHOLD = 3;
@@ -12971,35 +13740,6 @@ ${[e.stdout, e.stderr].filter(Boolean).join("\n").trim()}`;
     }
   }
 };
-var WorkspaceSandboxError = class extends Error {
-  constructor(attempted, workspaceRoot) {
-    super(`Refusing access to "${attempted}" \u2014 outside workspace root "${workspaceRoot}".`);
-    this.name = "WorkspaceSandboxError";
-  }
-};
-function resolveInWorkspace(workspaceRoot, input) {
-  if (typeof input !== "string" || input.length === 0) {
-    throw new WorkspaceSandboxError(String(input), workspaceRoot);
-  }
-  const root = path32__default.default.resolve(workspaceRoot);
-  const abs = path32__default.default.isAbsolute(input) ? path32__default.default.resolve(input) : path32__default.default.resolve(root, input);
-  const rel = path32__default.default.relative(root, abs);
-  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path32__default.default.isAbsolute(rel)) {
-    throw new WorkspaceSandboxError(input, root);
-  }
-  try {
-    const real = fs29__default.default.realpathSync(abs);
-    const realRel = path32__default.default.relative(root, real);
-    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path32__default.default.isAbsolute(realRel))) {
-      throw new WorkspaceSandboxError(input, root);
-    }
-  } catch (e) {
-    if (e instanceof WorkspaceSandboxError) throw e;
-  }
-  return abs;
-}
-
-// src/tools/file.ts
 var FileReadTool = class extends BaseTool {
   name = "file_read";
   description = "Read the contents of a file. Returns the file content as a string.";
@@ -13017,7 +13757,7 @@ var FileReadTool = class extends BaseTool {
     const absPath = resolveInWorkspace(this.workspaceRoot, filePath);
     const offset = input["offset"] ?? 1;
     const limit = input["limit"];
-    const content = await fs10__default.default.readFile(absPath, "utf-8");
+    const content = await fs11__default.default.readFile(absPath, "utf-8");
     const lines = content.split("\n");
     const start = Math.max(0, offset - 1);
     const end = limit ? start + limit : lines.length;
@@ -13046,13 +13786,13 @@ var FileWriteTool = class extends BaseTool {
     const content = input["content"];
     if (options.saveSnapshot) {
       try {
-        const oldContent = await fs10__default.default.readFile(absPath, "utf-8");
+        const oldContent = await fs11__default.default.readFile(absPath, "utf-8");
         await options.saveSnapshot(absPath, oldContent);
       } catch {
       }
     }
-    await fs10__default.default.mkdir(path32__default.default.dirname(absPath), { recursive: true });
-    await fs10__default.default.writeFile(absPath, content, "utf-8");
+    await fs11__default.default.mkdir(path33__default.default.dirname(absPath), { recursive: true });
+    await fs11__default.default.writeFile(absPath, content, "utf-8");
     return `Written ${content.length} characters to ${filePath}`;
   }
 };
@@ -13078,7 +13818,7 @@ var FileEditTool = class extends BaseTool {
     const oldString = input["old_string"];
     const newString = input["new_string"];
     const replaceAll = input["replace_all"] ?? false;
-    const rawContent = await fs10__default.default.readFile(absPath, "utf-8");
+    const rawContent = await fs11__default.default.readFile(absPath, "utf-8");
     if (options.saveSnapshot) {
       await options.saveSnapshot(absPath, rawContent);
     }
@@ -13090,7 +13830,7 @@ var FileEditTool = class extends BaseTool {
       );
     }
     const updated = replaceAll ? content.split(normalizedOld).join(newString) : content.replace(normalizedOld, newString);
-    await fs10__default.default.writeFile(absPath, updated, "utf-8");
+    await fs11__default.default.writeFile(absPath, updated, "utf-8");
     const count = replaceAll ? content.split(normalizedOld).length - 1 : 1;
     return `Replaced ${count} occurrence(s) in ${filePath}`;
   }
@@ -13113,12 +13853,12 @@ var FileDeleteTool = class extends BaseTool {
     const absPath = resolveInWorkspace(this.workspaceRoot, filePath);
     if (options.saveSnapshot) {
       try {
-        const oldContent = await fs10__default.default.readFile(absPath, "utf-8");
+        const oldContent = await fs11__default.default.readFile(absPath, "utf-8");
         await options.saveSnapshot(absPath, oldContent);
       } catch {
       }
     }
-    await fs10__default.default.rm(absPath, { recursive: false });
+    await fs11__default.default.rm(absPath, { recursive: false });
     return `Deleted ${filePath}`;
   }
 };
@@ -13135,7 +13875,7 @@ var FileListTool = class extends BaseTool {
   async execute(input, _options) {
     const inputPath = input["path"] || ".";
     const absPath = resolveInWorkspace(this.workspaceRoot, inputPath);
-    const entries = await fs10__default.default.readdir(absPath, { withFileTypes: true });
+    const entries = await fs11__default.default.readdir(absPath, { withFileTypes: true });
     return entries.map((e) => `${e.isDirectory() ? "[DIR] " : "      "}${e.name}`).join("\n") || "(empty directory)";
   }
 };
@@ -13548,8 +14288,8 @@ var ImageAnalyzeTool = class extends BaseTool {
   }
 };
 async function fileToImageAttachment(filePath) {
-  const data = await fs10__default.default.readFile(filePath);
-  const ext = path32__default.default.extname(filePath).toLowerCase();
+  const data = await fs11__default.default.readFile(filePath);
+  const ext = path33__default.default.extname(filePath).toLowerCase();
   const mimeMap = {
     ".jpg": "image/jpeg",
     ".jpeg": "image/jpeg",
@@ -13583,14 +14323,14 @@ var PDFCreateTool = class extends BaseTool {
     const filePath = input["path"];
     const content = input["content"];
     const title = input["title"];
-    const dir = path32__default.default.dirname(filePath);
-    if (!fs29__default.default.existsSync(dir)) {
-      fs29__default.default.mkdirSync(dir, { recursive: true });
+    const dir = path33__default.default.dirname(filePath);
+    if (!fs30__default.default.existsSync(dir)) {
+      fs30__default.default.mkdirSync(dir, { recursive: true });
     }
     return new Promise((resolve2, reject) => {
       try {
         const doc = new PDFDocument__default.default({ margin: 50 });
-        const stream = fs29__default.default.createWriteStream(filePath);
+        const stream = fs30__default.default.createWriteStream(filePath);
         doc.pipe(stream);
         if (title) {
           doc.info["Title"] = title;
@@ -13668,22 +14408,22 @@ var CodeInterpreterTool = class extends BaseTool {
       }
       cmdPrefix = NODE_CMD;
     }
-    const tmpDir = path32__default.default.join(this.workspaceRoot, ".cascade", "tmp");
-    if (!fs29__default.default.existsSync(tmpDir)) {
-      fs29__default.default.mkdirSync(tmpDir, { recursive: true });
+    const tmpDir = path33__default.default.join(this.workspaceRoot, ".cascade", "tmp");
+    if (!fs30__default.default.existsSync(tmpDir)) {
+      fs30__default.default.mkdirSync(tmpDir, { recursive: true });
     }
     const extension = language === "python" ? "py" : "js";
     const fileName = `intp_${crypto.randomUUID().slice(0, 8)}.${extension}`;
-    const filePath = path32__default.default.join(tmpDir, fileName);
-    fs29__default.default.writeFileSync(filePath, code, "utf-8");
+    const filePath = path33__default.default.join(tmpDir, fileName);
+    fs30__default.default.writeFileSync(filePath, code, "utf-8");
     const execArgs = [filePath, ...args];
     return new Promise((resolve2) => {
       const startMs = Date.now();
       child_process.execFile(cmdPrefix, execArgs, { cwd: this.workspaceRoot, timeout: 3e4 }, (error, stdout, stderr) => {
         const duration = Date.now() - startMs;
         try {
-          if (fs29__default.default.existsSync(filePath)) {
-            fs29__default.default.unlinkSync(filePath);
+          if (fs30__default.default.existsSync(filePath)) {
+            fs30__default.default.unlinkSync(filePath);
           }
         } catch (cleanupErr) {
           console.error(`Failed to cleanup interpreter script ${filePath}:`, cleanupErr);
@@ -13995,7 +14735,7 @@ var GlobTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path32__default.default.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path33__default.default.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const matches = await glob.glob(pattern, {
       cwd: searchPath,
       ignore: ["node_modules/**", ".git/**", "dist/**", "build/**"],
@@ -14008,7 +14748,7 @@ var GlobTool = class extends BaseTool {
     const withMtime = await Promise.all(
       matches.map(async (rel) => {
         try {
-          const stat = await fs10__default.default.stat(path32__default.default.join(searchPath, rel));
+          const stat = await fs11__default.default.stat(path33__default.default.join(searchPath, rel));
           return { rel, mtime: stat.mtimeMs };
         } catch {
           return { rel, mtime: 0 };
@@ -14057,7 +14797,7 @@ var GrepTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path32__default.default.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path33__default.default.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const globPattern = input["glob"];
     const outputMode = input["output_mode"] ?? "content";
     const context = input["context"] ?? 0;
@@ -14111,15 +14851,15 @@ var GrepTool = class extends BaseTool {
         nodir: true
       });
     } catch {
-      files = [path32__default.default.relative(searchPath, searchPath) || "."];
+      files = [path33__default.default.relative(searchPath, searchPath) || "."];
     }
     const results = [];
     let totalCount = 0;
     for (const rel of files) {
-      const abs = path32__default.default.join(searchPath, rel);
+      const abs = path33__default.default.join(searchPath, rel);
       let content;
       try {
-        content = await fs10__default.default.readFile(abs, "utf-8");
+        content = await fs11__default.default.readFile(abs, "utf-8");
       } catch {
         continue;
       }
@@ -14503,10 +15243,10 @@ var ToolRegistry = class extends EventEmitter__default.default {
   }
   isIgnored(filePath) {
     if (!filePath) return false;
-    const abs = path32__default.default.resolve(this.workspaceRoot, filePath);
-    const rel = path32__default.default.relative(this.workspaceRoot, abs);
-    if (!rel || rel.startsWith("..") || path32__default.default.isAbsolute(rel)) return true;
-    const posixRel = rel.split(path32__default.default.sep).join("/");
+    const abs = path33__default.default.resolve(this.workspaceRoot, filePath);
+    const rel = path33__default.default.relative(this.workspaceRoot, abs);
+    if (!rel || rel.startsWith("..") || path33__default.default.isAbsolute(rel)) return true;
+    const posixRel = rel.split(path33__default.default.sep).join("/");
     return this.ignoreMatcher.ignores(posixRel);
   }
 };
@@ -14740,22 +15480,22 @@ var FileMcpOAuthStore = class {
   filePath;
   load() {
     try {
-      return JSON.parse(fs29__default.default.readFileSync(this.filePath, "utf-8"));
+      return JSON.parse(fs30__default.default.readFileSync(this.filePath, "utf-8"));
     } catch {
       return void 0;
     }
   }
   save(state) {
-    fs29__default.default.mkdirSync(path32__default.default.dirname(this.filePath), { recursive: true, mode: 448 });
-    fs29__default.default.writeFileSync(this.filePath, JSON.stringify(state, null, 2), { mode: 384 });
+    fs30__default.default.mkdirSync(path33__default.default.dirname(this.filePath), { recursive: true, mode: 448 });
+    fs30__default.default.writeFileSync(this.filePath, JSON.stringify(state, null, 2), { mode: 384 });
     try {
-      fs29__default.default.chmodSync(this.filePath, 384);
+      fs30__default.default.chmodSync(this.filePath, 384);
     } catch {
     }
   }
   clear() {
     try {
-      fs29__default.default.rmSync(this.filePath);
+      fs30__default.default.rmSync(this.filePath);
     } catch {
     }
   }
@@ -15363,7 +16103,7 @@ var TaskAnalyzer = class {
 
 // src/core/router/model-performance-tracker.ts
 init_pricing();
-var DEFAULT_STATS_FILE = path32__default.default.join(os10__default.default.homedir(), ".cascade", "model-perf.json");
+var DEFAULT_STATS_FILE = path33__default.default.join(os10__default.default.homedir(), ".cascade", "model-perf.json");
 var ModelPerformanceTracker = class {
   stats = /* @__PURE__ */ new Map();
   featureStats = /* @__PURE__ */ new Map();
@@ -15383,7 +16123,7 @@ var ModelPerformanceTracker = class {
     if (this.loaded) return;
     this.loaded = true;
     try {
-      const raw = await fs10__default.default.readFile(this.statsFile, "utf-8");
+      const raw = await fs11__default.default.readFile(this.statsFile, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed.models) {
         for (const [key, stat] of Object.entries(parsed.models)) this.stats.set(key, stat);
@@ -15403,15 +16143,15 @@ var ModelPerformanceTracker = class {
   async save() {
     if (this.readOnly) return;
     try {
-      await fs10__default.default.mkdir(path32__default.default.dirname(this.statsFile), { recursive: true });
+      await fs11__default.default.mkdir(path33__default.default.dirname(this.statsFile), { recursive: true });
       const modelsObj = {};
       const featuresObj = {};
       for (const [key, stat] of this.stats) modelsObj[key] = stat;
       for (const [key, stat] of this.featureStats) featuresObj[key] = stat;
       const json = JSON.stringify({ models: modelsObj, features: featuresObj }, null, 2);
       const tmp = `${this.statsFile}.${process.pid}.${Date.now()}.tmp`;
-      await fs10__default.default.writeFile(tmp, json, "utf-8");
-      await fs10__default.default.rename(tmp, this.statsFile);
+      await fs11__default.default.writeFile(tmp, json, "utf-8");
+      await fs11__default.default.rename(tmp, this.statsFile);
     } catch {
     }
   }
@@ -15951,9 +16691,9 @@ Required capability: ${description.slice(0, 300)}`;
    *  any dangerous action, so a silently-reloaded tool can't act without approval. */
   async loadPersistedTools() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const file = path32__default.default.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
+    const file = path33__default.default.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
     try {
-      const raw = await fs10__default.default.readFile(file, "utf-8");
+      const raw = await fs11__default.default.readFile(file, "utf-8");
       const specs = JSON.parse(raw);
       if (!Array.isArray(specs)) return;
       let loaded = 0;
@@ -15975,11 +16715,11 @@ Required capability: ${description.slice(0, 300)}`;
   }
   async persist() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const dir = path32__default.default.join(this.workspacePath, ".cascade");
-    const file = path32__default.default.join(dir, DYNAMIC_TOOLS_FILE);
+    const dir = path33__default.default.join(this.workspacePath, ".cascade");
+    const file = path33__default.default.join(dir, DYNAMIC_TOOLS_FILE);
     try {
-      await fs10__default.default.mkdir(dir, { recursive: true });
-      await fs10__default.default.writeFile(file, JSON.stringify(Array.from(this.specs.values()), null, 2), "utf-8");
+      await fs11__default.default.mkdir(dir, { recursive: true });
+      await fs11__default.default.writeFile(file, JSON.stringify(Array.from(this.specs.values()), null, 2), "utf-8");
     } catch (err) {
       this.log(`[tool-creator] Failed to persist tools: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -15996,12 +16736,12 @@ var WorldStateDB = class {
   constructor(workspacePath, debugMode = false) {
     this.workspacePath = workspacePath;
     this.debugMode = debugMode;
-    const cascadeDir = path32__default.default.join(workspacePath, ".cascade");
-    if (!fs29__default.default.existsSync(cascadeDir)) {
-      fs29__default.default.mkdirSync(cascadeDir, { recursive: true });
+    const cascadeDir = path33__default.default.join(workspacePath, ".cascade");
+    if (!fs30__default.default.existsSync(cascadeDir)) {
+      fs30__default.default.mkdirSync(cascadeDir, { recursive: true });
     }
-    this.keyPath = path32__default.default.join(cascadeDir, "world_state.key");
-    this.dbPath = path32__default.default.join(cascadeDir, "world_state.db");
+    this.keyPath = path33__default.default.join(cascadeDir, "world_state.key");
+    this.dbPath = path33__default.default.join(cascadeDir, "world_state.db");
     this.initEncryptionKey();
     this.db = new Database2__default.default(this.dbPath);
     this.db.pragma("journal_mode = WAL");
@@ -16058,11 +16798,11 @@ var WorldStateDB = class {
     ).run(e, r, row.encrypted_value, row.source_worker, row.timestamp, validTo, change);
   }
   initEncryptionKey() {
-    if (fs29__default.default.existsSync(this.keyPath)) {
-      this.encryptionKey = fs29__default.default.readFileSync(this.keyPath);
+    if (fs30__default.default.existsSync(this.keyPath)) {
+      this.encryptionKey = fs30__default.default.readFileSync(this.keyPath);
     } else {
       this.encryptionKey = crypto__default.default.randomBytes(32);
-      fs29__default.default.writeFileSync(this.keyPath, this.encryptionKey);
+      fs30__default.default.writeFileSync(this.keyPath, this.encryptionKey);
     }
   }
   encrypt(text) {
@@ -16348,9 +17088,9 @@ var WorldStateDB = class {
   dumpDebugIfNeeded() {
     if (!this.debugMode) return;
     try {
-      const dumpPath = path32__default.default.join(os10__default.default.tmpdir(), "cascade_world_state_debug.json");
+      const dumpPath = path33__default.default.join(os10__default.default.tmpdir(), "cascade_world_state_debug.json");
       const entries = this.getAllEntries();
-      fs29__default.default.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+      fs30__default.default.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
     } catch (err) {
       console.error("Failed to dump debug world state", err);
     }
@@ -16720,7 +17460,7 @@ var WorkspaceIndex = class {
   isIgnored;
   chunker;
   constructor(opts) {
-    this.root = path32__default.default.resolve(opts.root);
+    this.root = path33__default.default.resolve(opts.root);
     this.db = opts.db;
     this.namespace = opts.namespace ?? "code";
     this.extensions = new Set((opts.extensions ?? DEFAULT_EXTENSIONS).map((e) => e.replace(/^\./, "").toLowerCase()));
@@ -16747,19 +17487,19 @@ var WorkspaceIndex = class {
     const walk = async (dir) => {
       let entries;
       try {
-        entries = await fs10__default.default.readdir(dir, { withFileTypes: true });
+        entries = await fs11__default.default.readdir(dir, { withFileTypes: true });
       } catch {
         return;
       }
       for (const entry of entries) {
-        const abs = path32__default.default.join(dir, entry.name);
+        const abs = path33__default.default.join(dir, entry.name);
         if (entry.isDirectory()) {
           if (HARD_SKIP_DIRS.has(entry.name) || this.isIgnored(abs)) continue;
           await walk(abs);
         } else if (entry.isFile()) {
-          const ext = path32__default.default.extname(entry.name).slice(1).toLowerCase();
+          const ext = path33__default.default.extname(entry.name).slice(1).toLowerCase();
           if (!this.extensions.has(ext) || this.isIgnored(abs)) continue;
-          out.push(path32__default.default.relative(this.root, abs));
+          out.push(path33__default.default.relative(this.root, abs));
         }
       }
     };
@@ -16789,10 +17529,10 @@ var WorkspaceIndex = class {
     const entries = [];
     for (const rel of rels) {
       try {
-        const abs = path32__default.default.join(this.root, rel);
-        const stat = await fs10__default.default.stat(abs);
+        const abs = path33__default.default.join(this.root, rel);
+        const stat = await fs11__default.default.stat(abs);
         if (stat.size > this.maxFileBytes) continue;
-        const buf = await fs10__default.default.readFile(abs);
+        const buf = await fs11__default.default.readFile(abs);
         if (buf.includes(0)) continue;
         entries.push({ path: rel, hash: hashContent(buf), text: buf.toString("utf8") });
       } catch {
@@ -17361,7 +18101,7 @@ var Cascade = class _Cascade extends EventEmitter__default.default {
     this.toolRegistry = new ToolRegistry(this.config.tools, workspacePath);
     try {
       this.router.setDeadModelStore(new DeadModelStore(
-        fileDeadModelPersistence(path32__default.default.join(workspacePath, ".cascade", "dead-models.json"))
+        fileDeadModelPersistence(path33__default.default.join(workspacePath, ".cascade", "dead-models.json"))
       ));
     } catch {
     }
@@ -17369,6 +18109,7 @@ var Cascade = class _Cascade extends EventEmitter__default.default {
       (this.config.providers ?? []).map((p) => p.type)
     );
     this.registerMediaTools(workspacePath);
+    this.registerDocumentTools(workspacePath);
     this.telemetry = config.telemetry?.enabled ? new Telemetry(config.telemetry, config.telemetry.distinctId ?? "anonymous") : noopTelemetry;
     this.worldStateDB = new WorldStateDB(this.workspacePath, this.config.workspace?.debugWorldState ?? false);
     this.router.setWorldStateDB(this.worldStateDB);
@@ -17448,8 +18189,8 @@ var Cascade = class _Cascade extends EventEmitter__default.default {
       this.emit("log", { level: "warn", message: "Code index enabled but no embeddings-capable provider is configured \u2014 skipping." });
       return;
     }
-    const dbPath = ci.dbPath || path32__default.default.join(this.workspacePath, ".cascade", "code-index.db");
-    fs29__default.default.mkdirSync(path32__default.default.dirname(dbPath), { recursive: true });
+    const dbPath = ci.dbPath || path33__default.default.join(this.workspacePath, ".cascade", "code-index.db");
+    fs30__default.default.mkdirSync(path33__default.default.dirname(dbPath), { recursive: true });
     const db = new Database2__default.default(dbPath);
     db.pragma("journal_mode = WAL");
     const complete = chatCompleterFromProviders(this.config.providers);
@@ -17789,6 +18530,35 @@ ${input}` }],
       this.toolRegistry.register(tool);
     }
   }
+  /**
+   * Register `generate_document` where there is a real workspace to write into.
+   *
+   * A `.docx`/`.pptx`/`.xlsx` is a ZIP of OOXML parts, so `file_write` — which
+   * does exactly what it says and writes the model's text verbatim — produced
+   * files Word/Excel/PowerPoint correctly reported as corrupted. This tool owns
+   * the conversion (see tools/generate-document.ts for why it isn't folded into
+   * file_write).
+   *
+   * Registered OUTSIDE `enabledTools` for the same reason the media tools are:
+   * that allowlist is a blast-radius control for tools that reach the machine
+   * or the network, and this one only writes the artifact the user asked for,
+   * into the workspace the run already owns. `disabledTools` still removes it.
+   * A host with no filesystem (the cloud) has its own browser-side exporter and
+   * simply never reaches this path — `buildDocumentTools` returns nothing
+   * without a file reader, mirroring `transcribe_audio`.
+   */
+  registerDocumentTools(workspacePath) {
+    const denied = new Set(this.config.tools?.disabledTools ?? []);
+    const tools = buildDocumentTools(async (p) => {
+      const fsp = await import('fs/promises');
+      return new Uint8Array(await fsp.readFile(p));
+    });
+    for (const tool of tools) {
+      if (denied.has(tool.name)) continue;
+      tool.setWorkspaceRoot(workspacePath);
+      this.toolRegistry.register(tool);
+    }
+  }
   /**
    * Supply per-model thumbs-up/down counts so Auto routing can weigh how models
    * have actually performed for this user, on top of public benchmarks.
@@ -18701,14 +19471,14 @@ ${finalOutput}` : ""
 init_constants();
 var CLOUD_SESSION_FILE = "cloud-session.json";
 function globalDir(homeDir = os10__default.default.homedir()) {
-  return path32__default.default.join(homeDir, GLOBAL_CONFIG_DIR);
+  return path33__default.default.join(homeDir, GLOBAL_CONFIG_DIR);
 }
 function cloudSessionPath(dir = globalDir()) {
-  return path32__default.default.join(dir, CLOUD_SESSION_FILE);
+  return path33__default.default.join(dir, CLOUD_SESSION_FILE);
 }
 function loadCloudSession(dir = globalDir()) {
   try {
-    const raw = fs29__default.default.readFileSync(cloudSessionPath(dir), "utf-8");
+    const raw = fs30__default.default.readFileSync(cloudSessionPath(dir), "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed?.refreshToken || !parsed?.serverUrl) return null;
     return parsed;
@@ -18717,17 +19487,17 @@ function loadCloudSession(dir = globalDir()) {
   }
 }
 function saveCloudSession(session, dir = globalDir()) {
-  fs29__default.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs30__default.default.mkdirSync(dir, { recursive: true, mode: 448 });
   const file = cloudSessionPath(dir);
-  fs29__default.default.writeFileSync(file, JSON.stringify(session, null, 2), { mode: 384 });
+  fs30__default.default.writeFileSync(file, JSON.stringify(session, null, 2), { mode: 384 });
   try {
-    fs29__default.default.chmodSync(file, 384);
+    fs30__default.default.chmodSync(file, 384);
   } catch {
   }
 }
 function clearCloudSession(dir = globalDir()) {
   try {
-    fs29__default.default.rmSync(cloudSessionPath(dir));
+    fs30__default.default.rmSync(cloudSessionPath(dir));
   } catch {
   }
 }
@@ -18899,16 +19669,16 @@ var CloudClient = class _CloudClient {
     return (await this.refresh()).accessToken;
   }
   /** Authenticated request that refreshes once on a 401 (e.g. server-side revoke). */
-  async authed(path37, init = {}) {
-    const call = (token) => fetch(this.url(path37), { ...init, headers: { ...init.headers ?? {}, Authorization: `Bearer ${token}` } });
+  async authed(path38, init = {}) {
+    const call = (token) => fetch(this.url(path38), { ...init, headers: { ...init.headers ?? {}, Authorization: `Bearer ${token}` } });
     let res = await call(await this.accessToken());
     if (res.status === 401) res = await call((await this.refresh()).accessToken);
     if (!res.ok) throw new Error(`Request failed (${res.status}).`);
     const text = await res.text();
     return text ? JSON.parse(text) : {};
   }
-  authedGet(path37) {
-    return this.authed(path37);
+  authedGet(path38) {
+    return this.authed(path38);
   }
   async fetchMe(token) {
     const res = await fetch(this.url("/api/me"), { headers: { Authorization: `Bearer ${token}` } });
@@ -20683,10 +21453,10 @@ function Repl({ config, workspacePath, themeName, initialPrompt, identityName, a
       }
     } catch {
     }
-    const configPath = path32__default.default.join(workspacePath, ".cascade", "config.json");
+    const configPath = path33__default.default.join(workspacePath, ".cascade", "config.json");
     try {
-      await fs10__default.default.mkdir(path32__default.default.dirname(configPath), { recursive: true });
-      await fs10__default.default.writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
+      await fs11__default.default.mkdir(path33__default.default.dirname(configPath), { recursive: true });
+      await fs11__default.default.writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       dispatch({
@@ -20737,9 +21507,9 @@ function Repl({ config, workspacePath, themeName, initialPrompt, identityName, a
       if (msg.includes("non-text parts")) return;
       originalLog(...args);
     };
-    const store = new MemoryStore(path32__default.default.join(workspacePath, CASCADE_DB_FILE));
+    const store = new MemoryStore(path33__default.default.join(workspacePath, CASCADE_DB_FILE));
     storeRef.current = store;
-    globalStoreRef.current = new MemoryStore(path32__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE));
+    globalStoreRef.current = new MemoryStore(path33__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE));
     const identityRows = store.listIdentities().map((i) => ({ id: i.id, name: i.name, isDefault: i.isDefault }));
     setIdentities(identityRows);
     let initialIdentityId = config.defaultIdentityId ?? identityRows.find((i) => i.isDefault)?.id ?? identityRows[0]?.id;
@@ -20807,14 +21577,14 @@ function Repl({ config, workspacePath, themeName, initialPrompt, identityName, a
       onThemeChange: (name) => setTheme(getTheme(name)),
       onExport: async (fmt) => {
         const stamp2 = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-        const exportPath = path32__default.default.join(workspacePath, `cascade-export-${stamp2}.${fmt === "json" ? "json" : "md"}`);
+        const exportPath = path33__default.default.join(workspacePath, `cascade-export-${stamp2}.${fmt === "json" ? "json" : "md"}`);
         if (fmt === "json") {
-          await fs10__default.default.writeFile(exportPath, JSON.stringify({ sessionId: sessionIdRef.current, messages: state.messages }, null, 2), "utf-8");
+          await fs11__default.default.writeFile(exportPath, JSON.stringify({ sessionId: sessionIdRef.current, messages: state.messages }, null, 2), "utf-8");
         } else {
           const markdown = state.messages.map((msg) => `## ${msg.role.toUpperCase()} \u2014 ${msg.timestamp}
 
 ${msg.content}`).join("\n\n");
-          await fs10__default.default.writeFile(exportPath, markdown, "utf-8");
+          await fs11__default.default.writeFile(exportPath, markdown, "utf-8");
         }
       },
       onRollback: async () => {
@@ -20824,7 +21594,7 @@ ${msg.content}`).join("\n\n");
         if (!snapshots.length) return "No file snapshots found for this session.";
         for (const { filePath, content } of snapshots) {
           try {
-            await fs10__default.default.writeFile(filePath, content, "utf-8");
+            await fs11__default.default.writeFile(filePath, content, "utf-8");
           } catch (err) {
             console.error(`Restore failed: ${filePath}`, err);
           }
@@ -21705,9 +22475,9 @@ function stringifySlashOutput(val) {
 }
 async function searchSessionsAndMessages(query, workspacePath) {
   if (!query) return "Usage: /search <query>";
-  const dbPath = path32__default.default.join(workspacePath, CASCADE_DB_FILE);
+  const dbPath = path33__default.default.join(workspacePath, CASCADE_DB_FILE);
   try {
-    await fs10__default.default.access(dbPath);
+    await fs11__default.default.access(dbPath);
   } catch {
     return "No database found. Start a conversation first.";
   }
@@ -21739,7 +22509,7 @@ async function searchSessionsAndMessages(query, workspacePath) {
 async function diagnoseRuntime(config, workspacePath) {
   const providers = config.providers.map((p) => `${p.type}${p.apiKey ? " (key set)" : " (no key)"}`).join("\n");
   const models = [`T1: ${config.models.t1 ?? "default"}`, `T2: ${config.models.t2 ?? "default"}`, `T3: ${config.models.t3 ?? "default"}`].join("\n");
-  const store = new MemoryStore(path32__default.default.join(workspacePath, CASCADE_DB_FILE));
+  const store = new MemoryStore(path33__default.default.join(workspacePath, CASCADE_DB_FILE));
   try {
     const sessions2 = store.listSessions(void 0, 3);
     return [
@@ -21758,7 +22528,7 @@ async function diagnoseRuntime(config, workspacePath) {
 }
 async function showRecentLogs(args, workspacePath) {
   const limit = Number.parseInt(args[0] ?? "10", 10) || 10;
-  const store = new MemoryStore(path32__default.default.join(workspacePath, CASCADE_DB_FILE));
+  const store = new MemoryStore(path33__default.default.join(workspacePath, CASCADE_DB_FILE));
   try {
     const logs = store.listRuntimeNodeLogs(void 0, void 0, limit);
     if (!logs.length) return "No recent runtime logs.";
@@ -21770,7 +22540,7 @@ async function showRecentLogs(args, workspacePath) {
 async function loadSessionSnapshot(args, workspacePath) {
   const sessionId = args[0];
   if (!sessionId) return "Usage: /resume <sessionId>";
-  const store = new MemoryStore(path32__default.default.join(workspacePath, CASCADE_DB_FILE));
+  const store = new MemoryStore(path33__default.default.join(workspacePath, CASCADE_DB_FILE));
   try {
     const session = store.getSession(sessionId);
     if (!session) return `Session not found: ${sessionId}`;
@@ -22198,10 +22968,10 @@ function SetupWizard({ workspacePath, onComplete }) {
           ...anyAuto ? { cascadeAuto: true } : {}
         };
         const config = CascadeConfigSchema.parse(rawConfig);
-        const configDir = path32__default.default.join(workspacePath, ".cascade");
-        await fs10__default.default.mkdir(configDir, { recursive: true });
-        const configPath = path32__default.default.join(workspacePath, CASCADE_CONFIG_FILE);
-        await fs10__default.default.writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
+        const configDir = path33__default.default.join(workspacePath, ".cascade");
+        await fs11__default.default.mkdir(configDir, { recursive: true });
+        const configPath = path33__default.default.join(workspacePath, CASCADE_CONFIG_FILE);
+        await fs11__default.default.writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
         savedConfigRef.current = config;
         dispatchRef.current({ type: "GO_DONE" });
       } catch (err) {
@@ -22542,14 +23312,14 @@ function printTelemetryBanner() {
 async function initCommand(workspacePath = process.cwd()) {
   const spin = ora__default.default({ text: "Initializing Cascade project\u2026", color: "magenta" }).start();
   try {
-    const configDir = path32__default.default.join(workspacePath, ".cascade");
-    await fs10__default.default.mkdir(configDir, { recursive: true });
-    const mdPath = path32__default.default.join(workspacePath, "CASCADE.md");
+    const configDir = path33__default.default.join(workspacePath, ".cascade");
+    await fs11__default.default.mkdir(configDir, { recursive: true });
+    const mdPath = path33__default.default.join(workspacePath, "CASCADE.md");
     if (!await fileExists(mdPath)) {
       await createDefaultCascadeMd(workspacePath);
       spin.succeed(chalk7__default.default.green("Created CASCADE.md"));
     }
-    const ignorePath = path32__default.default.join(workspacePath, ".cascadeignore");
+    const ignorePath = path33__default.default.join(workspacePath, ".cascadeignore");
     if (!await fileExists(ignorePath)) {
       await createDefaultIgnoreFile(workspacePath);
       spin.succeed(chalk7__default.default.green("Created .cascadeignore"));
@@ -22558,7 +23328,7 @@ async function initCommand(workspacePath = process.cwd()) {
     console.log();
     console.log(chalk7__default.default.magenta("  \u25C8 Cascade AI \u2014 Project initialized"));
     console.log();
-    const configPath = path32__default.default.join(workspacePath, CASCADE_CONFIG_FILE);
+    const configPath = path33__default.default.join(workspacePath, CASCADE_CONFIG_FILE);
     if (await fileExists(configPath)) {
       console.log(chalk7__default.default.yellow("  .cascade/config.json already exists \u2014 launching wizard to reconfigure."));
       console.log();
@@ -22577,7 +23347,7 @@ async function initCommand(workspacePath = process.cwd()) {
 }
 async function fileExists(p) {
   try {
-    await fs10__default.default.access(p);
+    await fs11__default.default.access(p);
     return true;
   } catch {
     return false;
@@ -22589,7 +23359,7 @@ init_constants();
 var TOS_WARNING = "Reusing this subscription token outside its own CLI may violate the vendor\u2019s terms of service.";
 async function readJson(file) {
   try {
-    const raw = await fs10__default.default.readFile(file, "utf-8");
+    const raw = await fs11__default.default.readFile(file, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -22616,7 +23386,7 @@ function fromEnv(env) {
   return out;
 }
 async function fromClaudeCode(home) {
-  const file = path32__default.default.join(home, ".claude", ".credentials.json");
+  const file = path33__default.default.join(home, ".claude", ".credentials.json");
   const data = await readJson(file);
   if (!data) return [];
   const oauth = data["claudeAiOauth"];
@@ -22639,7 +23409,7 @@ async function fromClaudeCode(home) {
   return [];
 }
 async function fromCodex(home) {
-  const file = path32__default.default.join(home, ".codex", "auth.json");
+  const file = path33__default.default.join(home, ".codex", "auth.json");
   const data = await readJson(file);
   if (!data) return [];
   const apiKey = str(data["OPENAI_API_KEY"]);
@@ -22662,7 +23432,7 @@ async function fromCodex(home) {
   return [];
 }
 async function fromGemini(home) {
-  const file = path32__default.default.join(home, ".gemini", "oauth_creds.json");
+  const file = path33__default.default.join(home, ".gemini", "oauth_creds.json");
   const data = await readJson(file);
   const accessToken = str(data?.["access_token"]);
   if (!accessToken) return [];
@@ -22678,7 +23448,7 @@ async function fromGemini(home) {
 }
 async function fromCopilot(home) {
   for (const name of ["apps.json", "hosts.json"]) {
-    const file = path32__default.default.join(home, ".config", "github-copilot", name);
+    const file = path33__default.default.join(home, ".config", "github-copilot", name);
     const data = await readJson(file);
     if (!data) continue;
     for (const value of Object.values(data)) {
@@ -22732,7 +23502,7 @@ async function doctorCommand() {
   checks.push({
     label: "Cascade config",
     ok: true,
-    detail: `Loaded ${path32__default.default.join(process.cwd(), CASCADE_CONFIG_FILE)}`
+    detail: `Loaded ${path33__default.default.join(process.cwd(), CASCADE_CONFIG_FILE)}`
   });
   const providers = [
     { type: "anthropic", name: "Anthropic" },
@@ -22843,7 +23613,7 @@ async function checkEndpoint(url) {
   }
 }
 async function indexCommand(dirPath) {
-  const workspace = path32__default.default.resolve(dirPath || process.cwd());
+  const workspace = path33__default.default.resolve(dirPath || process.cwd());
   const cm = new ConfigManager(workspace);
   await cm.load();
   const config = cm.getConfig();
@@ -22854,8 +23624,8 @@ async function indexCommand(dirPath) {
     process.exitCode = 1;
     return;
   }
-  const dbPath = config.codeIndex?.dbPath || path32__default.default.join(workspace, ".cascade", "code-index.db");
-  fs29__default.default.mkdirSync(path32__default.default.dirname(dbPath), { recursive: true });
+  const dbPath = config.codeIndex?.dbPath || path33__default.default.join(workspace, ".cascade", "code-index.db");
+  fs30__default.default.mkdirSync(path33__default.default.dirname(dbPath), { recursive: true });
   const db = new Database2__default.default(dbPath);
   db.pragma("journal_mode = WAL");
   const complete = chatCompleterFromProviders(config.providers);
@@ -23344,7 +24114,7 @@ function openBrowser2(url) {
 }
 function storePathFor(name) {
   const safe = name.replace(/[^a-z0-9._-]/gi, "_").slice(0, 64) || "server";
-  return path32__default.default.join(os10__default.default.homedir(), ".cascade-ai", "mcp-oauth", `${safe}.json`);
+  return path33__default.default.join(os10__default.default.homedir(), ".cascade-ai", "mcp-oauth", `${safe}.json`);
 }
 function defaultName(url) {
   try {
@@ -23846,7 +24616,7 @@ function aggregateCostStats(sessions2, opts = {}) {
 }
 
 // src/dashboard/server.ts
-var __dirname$1 = path32__default.default.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.cjs', document.baseURI).href))));
+var __dirname$1 = path33__default.default.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.cjs', document.baseURI).href))));
 var ORPHANED_ESCALATION_GRACE_MS = 3e4;
 var DashboardServer = class {
   app;
@@ -24126,14 +24896,14 @@ var DashboardServer = class {
    */
   persistConfig() {
     try {
-      const configPath = path32__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
-      fs29__default.default.mkdirSync(path32__default.default.dirname(configPath), { recursive: true });
-      fs29__default.default.writeFileSync(configPath, JSON.stringify(this.config, null, 2), "utf-8");
+      const configPath = path33__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
+      fs30__default.default.mkdirSync(path33__default.default.dirname(configPath), { recursive: true });
+      fs30__default.default.writeFileSync(configPath, JSON.stringify(this.config, null, 2), "utf-8");
     } catch (err) {
       console.warn(`[dashboard] Failed to persist config: ${err instanceof Error ? err.message : String(err)}`);
     }
     try {
-      saveGlobalCredentials(path32__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR), this.config.providers ?? []);
+      saveGlobalCredentials(path33__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR), this.config.providers ?? []);
     } catch (err) {
       console.warn(`[dashboard] Failed to sync global credentials: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -24148,15 +24918,15 @@ var DashboardServer = class {
   resolveDashboardSecret() {
     const fromConfig = this.config.dashboard.secret ?? process.env["CASCADE_DASHBOARD_SECRET"];
     if (fromConfig) return fromConfig;
-    const secretPath = path32__default.default.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
+    const secretPath = path33__default.default.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
     try {
-      if (fs29__default.default.existsSync(secretPath)) {
-        const existing = fs29__default.default.readFileSync(secretPath, "utf-8").trim();
+      if (fs30__default.default.existsSync(secretPath)) {
+        const existing = fs30__default.default.readFileSync(secretPath, "utf-8").trim();
         if (existing.length >= 16) return existing;
       }
       const generated = crypto.randomUUID();
-      fs29__default.default.mkdirSync(path32__default.default.dirname(secretPath), { recursive: true });
-      fs29__default.default.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
+      fs30__default.default.mkdirSync(path33__default.default.dirname(secretPath), { recursive: true });
+      fs30__default.default.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
       if (this.config.dashboard.auth) {
         console.warn(
           `Dashboard auth enabled with no secret configured; persisted a generated secret to ${secretPath}. Set CASCADE_DASHBOARD_SECRET or config.dashboard.secret to override.`
@@ -24183,7 +24953,7 @@ var DashboardServer = class {
   // ── Setup ─────────────────────────────────────
   getGlobalStore() {
     if (!this.globalStore) {
-      const globalDbPath = path32__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path33__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       this.globalStore = new MemoryStore(globalDbPath);
     }
     return this.globalStore;
@@ -24563,12 +25333,12 @@ ${prompt}`;
     }
   }
   watchRuntimeChanges() {
-    const workspaceDbPath = path32__default.default.join(this.workspacePath, CASCADE_DB_FILE);
-    const globalDbPath = path32__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+    const workspaceDbPath = path33__default.default.join(this.workspacePath, CASCADE_DB_FILE);
+    const globalDbPath = path33__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
     const watchPaths = [workspaceDbPath, globalDbPath].filter((p, index, arr) => arr.indexOf(p) === index);
     for (const watchPath of watchPaths) {
-      if (!fs29__default.default.existsSync(watchPath)) continue;
-      fs29__default.default.watchFile(watchPath, { interval: 3e3 }, () => {
+      if (!fs30__default.default.existsSync(watchPath)) continue;
+      fs30__default.default.watchFile(watchPath, { interval: 3e3 }, () => {
         this.throttledBroadcast(watchPath === globalDbPath ? "global" : "workspace");
       });
     }
@@ -24690,7 +25460,7 @@ ${prompt}`;
       const sessionId = req.params.id;
       this.store.deleteSession(sessionId);
       this.store.deleteRuntimeSession(sessionId);
-      const globalDbPath = path32__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path33__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteRuntimeSession(sessionId);
@@ -24783,7 +25553,7 @@ ${prompt}`;
     });
     this.app.delete("/api/sessions", auth2, (req, res) => {
       const body = req.body;
-      const globalDbPath = path32__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path33__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       if (body?.ids && Array.isArray(body.ids) && body.ids.length > 0) {
         const globalStore = new MemoryStore(globalDbPath);
         try {
@@ -24806,7 +25576,7 @@ ${prompt}`;
     });
     this.app.delete("/api/runtime", auth2, (_req, res) => {
       this.store.deleteAllRuntimeNodes();
-      const globalDbPath = path32__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path33__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteAllRuntimeNodes();
@@ -24892,12 +25662,12 @@ ${prompt}`;
       if (body["tierLimits"]) this.config.tierLimits = { ...this.config.tierLimits, ...body["tierLimits"] };
       if (body["budget"]) this.config.budget = { ...this.config.budget, ...body["budget"] };
       try {
-        const configPath = path32__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
-        const existing = fs29__default.default.existsSync(configPath) ? JSON.parse(fs29__default.default.readFileSync(configPath, "utf-8")) : {};
+        const configPath = path33__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
+        const existing = fs30__default.default.existsSync(configPath) ? JSON.parse(fs30__default.default.readFileSync(configPath, "utf-8")) : {};
         const updated = { ...existing, tierLimits: this.config.tierLimits, budget: this.config.budget };
         const tmp = configPath + ".tmp";
-        fs29__default.default.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
-        fs29__default.default.renameSync(tmp, configPath);
+        fs30__default.default.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
+        fs30__default.default.renameSync(tmp, configPath);
         res.json({ ok: true });
       } catch (err) {
         res.status(500).json({ error: `Failed to save config: ${err instanceof Error ? err.message : String(err)}` });
@@ -24925,7 +25695,7 @@ ${prompt}`;
     this.app.get("/api/runtime", auth2, (req, res) => {
       const scope = req.query["scope"] ?? "workspace";
       if (scope === "global") {
-        const globalDbPath = path32__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+        const globalDbPath = path33__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
         const globalStore = new MemoryStore(globalDbPath);
         try {
           res.json({
@@ -25266,13 +26036,13 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    const prodPath = path32__default.default.resolve(__dirname$1, "../web/dist");
-    const devPath = path32__default.default.resolve(__dirname$1, "../../web/dist");
-    const webDistPath = fs29__default.default.existsSync(prodPath) ? prodPath : devPath;
-    if (fs29__default.default.existsSync(webDistPath)) {
+    const prodPath = path33__default.default.resolve(__dirname$1, "../web/dist");
+    const devPath = path33__default.default.resolve(__dirname$1, "../../web/dist");
+    const webDistPath = fs30__default.default.existsSync(prodPath) ? prodPath : devPath;
+    if (fs30__default.default.existsSync(webDistPath)) {
       this.app.use(express__default.default.static(webDistPath));
       this.app.get("*", (_req, res) => {
-        res.sendFile(path32__default.default.join(webDistPath, "index.html"));
+        res.sendFile(path33__default.default.join(webDistPath, "index.html"));
       });
     } else {
       this.app.get("/", (_req, res) => {
@@ -25293,7 +26063,7 @@ init_constants();
 async function dashboardCommand(config, workspacePath = process.cwd()) {
   const port = config.dashboard.port ?? DEFAULT_DASHBOARD_PORT;
   const spin = ora__default.default({ text: `Starting dashboard on port ${port}\u2026`, color: "magenta" }).start();
-  const store = new MemoryStore(path32__default.default.join(workspacePath, CASCADE_DB_FILE));
+  const store = new MemoryStore(path33__default.default.join(workspacePath, CASCADE_DB_FILE));
   const server = new DashboardServer(config, store, workspacePath);
   server.watchRuntimeChanges();
   const gThis = globalThis;
@@ -25325,7 +26095,7 @@ init_constants();
 function makeIdentityCommand(workspacePath = process.cwd()) {
   const identity = new commander.Command("identity").alias("id").description("Manage Cascade identities");
   identity.command("list").description("List all available identities").action(() => {
-    const store = new MemoryStore(path32__default.default.join(workspacePath, CASCADE_DB_FILE));
+    const store = new MemoryStore(path33__default.default.join(workspacePath, CASCADE_DB_FILE));
     try {
       const identities = store.listIdentities();
       console.log(chalk7__default.default.bold("\n  Identities:"));
@@ -25345,7 +26115,7 @@ function makeIdentityCommand(workspacePath = process.cwd()) {
     }
   });
   identity.command("create <name>").description("Create a new identity").option("-d, --desc <text>", "Description of the identity").option("-s, --system <text>", "System prompt").option("--default", "Set as default identity").action((name, options) => {
-    const store = new MemoryStore(path32__default.default.join(workspacePath, CASCADE_DB_FILE));
+    const store = new MemoryStore(path33__default.default.join(workspacePath, CASCADE_DB_FILE));
     try {
       if (options.default) {
         const existingDefault = store.getDefaultIdentity();
@@ -25371,7 +26141,7 @@ function makeIdentityCommand(workspacePath = process.cwd()) {
     }
   });
   identity.command("set-default <name>").description("Set an identity as default by name or ID").action((query) => {
-    const store = new MemoryStore(path32__default.default.join(workspacePath, CASCADE_DB_FILE));
+    const store = new MemoryStore(path33__default.default.join(workspacePath, CASCADE_DB_FILE));
     try {
       const identities = store.listIdentities();
       const match = identities.find((i) => i.id === query || i.name.toLowerCase() === query.toLowerCase());
@@ -25520,11 +26290,11 @@ async function exportCommand(options = {}) {
   let store;
   try {
     const workspacePath = options.workspacePath ?? process.cwd();
-    const workspaceDbPath = path32__default.default.join(workspacePath, CASCADE_DB_FILE);
-    const globalDbPath = path32__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_DB_FILE);
+    const workspaceDbPath = path33__default.default.join(workspacePath, CASCADE_DB_FILE);
+    const globalDbPath = path33__default.default.join(os10__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_DB_FILE);
     let dbPath = globalDbPath;
     try {
-      await fs10__default.default.access(workspaceDbPath);
+      await fs11__default.default.access(workspaceDbPath);
       dbPath = workspaceDbPath;
     } catch {
     }
@@ -25563,8 +26333,8 @@ async function exportCommand(options = {}) {
     const ext = format === "json" ? ".json" : ".md";
     const safeName = session.title.replace(/[^\w\s-]/g, "").replace(/\s+/g, "-").slice(0, 60);
     const defaultFile = `cascade-export-${safeName}${ext}`;
-    const outPath = options.output ? path32__default.default.resolve(options.output) : path32__default.default.join(process.cwd(), defaultFile);
-    await fs10__default.default.writeFile(outPath, content, "utf-8");
+    const outPath = options.output ? path33__default.default.resolve(options.output) : path33__default.default.join(process.cwd(), defaultFile);
+    await fs11__default.default.writeFile(outPath, content, "utf-8");
     spin.succeed(chalk7__default.default.green(`Exported to ${chalk7__default.default.white(outPath)}`));
     const messageCount = Array.isArray(session.messages) ? session.messages.length : 0;
     console.log();
@@ -25791,11 +26561,11 @@ async function statsCommand() {
 dotenv__default.default.config();
 function warnIfBuildIsStale() {
   try {
-    const here = path32__default.default.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.cjs', document.baseURI).href))));
+    const here = path33__default.default.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.cjs', document.baseURI).href))));
     for (const rel of ["..", "../.."]) {
-      const pkgPath = path32__default.default.join(here, rel, "package.json");
-      if (!fs29__default.default.existsSync(pkgPath)) continue;
-      const pkg = JSON.parse(fs29__default.default.readFileSync(pkgPath, "utf-8"));
+      const pkgPath = path33__default.default.join(here, rel, "package.json");
+      if (!fs30__default.default.existsSync(pkgPath)) continue;
+      const pkg = JSON.parse(fs30__default.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.name !== "cascade-ai") continue;
       if (pkg.version && pkg.version !== CASCADE_VERSION) {
         console.error(