cascade-ai 0.76.0 → 0.77.0

package/dist/index.js

@@ -1,12 +1,12 @@
 import Database2 from 'better-sqlite3';
-import path27, { dirname } from 'path';
-import fs26, { promises, mkdirSync, writeFileSync, existsSync, readFileSync } from 'fs';
+import path28, { dirname } from 'path';
+import fs27, { promises, mkdirSync, writeFileSync, existsSync, readFileSync } from 'fs';
 import os6 from 'os';
 import crypto, { randomUUID, randomBytes, createHash, timingSafeEqual, webcrypto } from 'crypto';
 import EventEmitter, { setMaxListeners } from 'events';
 import { glob } from 'glob';
 import Anthropic from '@anthropic-ai/sdk';
-import dns from 'dns';
+import dnsCallback from 'dns';
 import http, { createServer } from 'http';
 import https from 'https';
 import zlib from 'zlib';
@@ -23,6 +23,7 @@ import { simpleGit } from 'simple-git';
 import PDFDocument from 'pdfkit';
 import dns2 from 'dns/promises';
 import net from 'net';
+import { Agent } from 'undici';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
@@ -132,16 +133,16 @@ var require_isarray = __commonJS({
   }
 });
 
-// node_modules/jszip/node_modules/readable-stream/lib/internal/streams/stream.js
+// node_modules/readable-stream/lib/internal/streams/stream.js
 var require_stream = __commonJS({
-  "node_modules/jszip/node_modules/readable-stream/lib/internal/streams/stream.js"(exports, module) {
+  "node_modules/readable-stream/lib/internal/streams/stream.js"(exports, module) {
     module.exports = __require("stream");
   }
 });
 
-// node_modules/jszip/node_modules/safe-buffer/index.js
+// node_modules/readable-stream/node_modules/safe-buffer/index.js
 var require_safe_buffer = __commonJS({
-  "node_modules/jszip/node_modules/safe-buffer/index.js"(exports, module) {
+  "node_modules/readable-stream/node_modules/safe-buffer/index.js"(exports, module) {
     var buffer = __require("buffer");
     var Buffer2 = buffer.Buffer;
     function copyProps(src, dst) {
@@ -259,7 +260,7 @@ var require_util = __commonJS({
       typeof arg === "undefined";
     }
     exports.isPrimitive = isPrimitive;
-    exports.isBuffer = Buffer.isBuffer;
+    exports.isBuffer = __require("buffer").Buffer.isBuffer;
     function objectToString(o) {
       return Object.prototype.toString.call(o);
     }
@@ -312,9 +313,9 @@ var require_inherits = __commonJS({
   }
 });
 
-// node_modules/jszip/node_modules/readable-stream/lib/internal/streams/BufferList.js
+// node_modules/readable-stream/lib/internal/streams/BufferList.js
 var require_BufferList = __commonJS({
-  "node_modules/jszip/node_modules/readable-stream/lib/internal/streams/BufferList.js"(exports, module) {
+  "node_modules/readable-stream/lib/internal/streams/BufferList.js"(exports, module) {
     function _classCallCheck(instance, Constructor) {
       if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
@@ -389,9 +390,9 @@ var require_BufferList = __commonJS({
   }
 });
 
-// node_modules/jszip/node_modules/readable-stream/lib/internal/streams/destroy.js
+// node_modules/readable-stream/lib/internal/streams/destroy.js
 var require_destroy = __commonJS({
-  "node_modules/jszip/node_modules/readable-stream/lib/internal/streams/destroy.js"(exports, module) {
+  "node_modules/readable-stream/lib/internal/streams/destroy.js"(exports, module) {
     var pna = require_process_nextick_args();
     function destroy(err, cb) {
       var _this = this;
@@ -464,9 +465,9 @@ var require_node = __commonJS({
   }
 });
 
-// node_modules/jszip/node_modules/readable-stream/lib/_stream_writable.js
+// node_modules/readable-stream/lib/_stream_writable.js
 var require_stream_writable = __commonJS({
-  "node_modules/jszip/node_modules/readable-stream/lib/_stream_writable.js"(exports, module) {
+  "node_modules/readable-stream/lib/_stream_writable.js"(exports, module) {
     var pna = require_process_nextick_args();
     module.exports = Writable;
     function CorkedRequest(state) {
@@ -903,9 +904,9 @@ var require_stream_writable = __commonJS({
   }
 });
 
-// node_modules/jszip/node_modules/readable-stream/lib/_stream_duplex.js
+// node_modules/readable-stream/lib/_stream_duplex.js
 var require_stream_duplex = __commonJS({
-  "node_modules/jszip/node_modules/readable-stream/lib/_stream_duplex.js"(exports, module) {
+  "node_modules/readable-stream/lib/_stream_duplex.js"(exports, module) {
     var pna = require_process_nextick_args();
     var objectKeys = Object.keys || function(obj) {
       var keys2 = [];
@@ -979,10 +980,67 @@ var require_stream_duplex = __commonJS({
   }
 });
 
-// node_modules/jszip/node_modules/string_decoder/lib/string_decoder.js
+// node_modules/string_decoder/node_modules/safe-buffer/index.js
+var require_safe_buffer2 = __commonJS({
+  "node_modules/string_decoder/node_modules/safe-buffer/index.js"(exports, module) {
+    var buffer = __require("buffer");
+    var Buffer2 = buffer.Buffer;
+    function copyProps(src, dst) {
+      for (var key in src) {
+        dst[key] = src[key];
+      }
+    }
+    if (Buffer2.from && Buffer2.alloc && Buffer2.allocUnsafe && Buffer2.allocUnsafeSlow) {
+      module.exports = buffer;
+    } else {
+      copyProps(buffer, exports);
+      exports.Buffer = SafeBuffer;
+    }
+    function SafeBuffer(arg, encodingOrOffset, length) {
+      return Buffer2(arg, encodingOrOffset, length);
+    }
+    copyProps(Buffer2, SafeBuffer);
+    SafeBuffer.from = function(arg, encodingOrOffset, length) {
+      if (typeof arg === "number") {
+        throw new TypeError("Argument must not be a number");
+      }
+      return Buffer2(arg, encodingOrOffset, length);
+    };
+    SafeBuffer.alloc = function(size, fill, encoding) {
+      if (typeof size !== "number") {
+        throw new TypeError("Argument must be a number");
+      }
+      var buf = Buffer2(size);
+      if (fill !== void 0) {
+        if (typeof encoding === "string") {
+          buf.fill(fill, encoding);
+        } else {
+          buf.fill(fill);
+        }
+      } else {
+        buf.fill(0);
+      }
+      return buf;
+    };
+    SafeBuffer.allocUnsafe = function(size) {
+      if (typeof size !== "number") {
+        throw new TypeError("Argument must be a number");
+      }
+      return Buffer2(size);
+    };
+    SafeBuffer.allocUnsafeSlow = function(size) {
+      if (typeof size !== "number") {
+        throw new TypeError("Argument must be a number");
+      }
+      return buffer.SlowBuffer(size);
+    };
+  }
+});
+
+// node_modules/string_decoder/lib/string_decoder.js
 var require_string_decoder = __commonJS({
-  "node_modules/jszip/node_modules/string_decoder/lib/string_decoder.js"(exports) {
-    var Buffer2 = require_safe_buffer().Buffer;
+  "node_modules/string_decoder/lib/string_decoder.js"(exports) {
+    var Buffer2 = require_safe_buffer2().Buffer;
     var isEncoding = Buffer2.isEncoding || function(encoding) {
       encoding = "" + encoding;
       switch (encoding && encoding.toLowerCase()) {
@@ -1216,9 +1274,9 @@ var require_string_decoder = __commonJS({
   }
 });
 
-// node_modules/jszip/node_modules/readable-stream/lib/_stream_readable.js
+// node_modules/readable-stream/lib/_stream_readable.js
 var require_stream_readable = __commonJS({
-  "node_modules/jszip/node_modules/readable-stream/lib/_stream_readable.js"(exports, module) {
+  "node_modules/readable-stream/lib/_stream_readable.js"(exports, module) {
     var pna = require_process_nextick_args();
     module.exports = Readable2;
     var isArray = require_isarray();
@@ -1901,9 +1959,9 @@ var require_stream_readable = __commonJS({
   }
 });
 
-// node_modules/jszip/node_modules/readable-stream/lib/_stream_transform.js
+// node_modules/readable-stream/lib/_stream_transform.js
 var require_stream_transform = __commonJS({
-  "node_modules/jszip/node_modules/readable-stream/lib/_stream_transform.js"(exports, module) {
+  "node_modules/readable-stream/lib/_stream_transform.js"(exports, module) {
     module.exports = Transform;
     var Duplex = require_stream_duplex();
     var util = Object.create(require_util());
@@ -2000,9 +2058,9 @@ var require_stream_transform = __commonJS({
   }
 });
 
-// node_modules/jszip/node_modules/readable-stream/lib/_stream_passthrough.js
+// node_modules/readable-stream/lib/_stream_passthrough.js
 var require_stream_passthrough = __commonJS({
-  "node_modules/jszip/node_modules/readable-stream/lib/_stream_passthrough.js"(exports, module) {
+  "node_modules/readable-stream/lib/_stream_passthrough.js"(exports, module) {
     module.exports = PassThrough;
     var Transform = require_stream_transform();
     var util = Object.create(require_util());
@@ -2018,9 +2076,9 @@ var require_stream_passthrough = __commonJS({
   }
 });
 
-// node_modules/jszip/node_modules/readable-stream/readable.js
+// node_modules/readable-stream/readable.js
 var require_readable = __commonJS({
-  "node_modules/jszip/node_modules/readable-stream/readable.js"(exports, module) {
+  "node_modules/readable-stream/readable.js"(exports, module) {
     var Stream = __require("stream");
     if (process.env.READABLE_STREAM === "disable" && Stream) {
       module.exports = Stream;
@@ -2929,8 +2987,8 @@ var require_utils = __commonJS({
       var result = transform[inputType][outputType](input);
       return result;
     };
-    exports.resolve = function(path29) {
-      var parts = path29.split("/");
+    exports.resolve = function(path30) {
+      var parts = path30.split("/");
       var result = [];
       for (var index = 0; index < parts.length; index++) {
         var part = parts[index];
@@ -8745,18 +8803,18 @@ var require_object = __commonJS({
       var object = new ZipObject(name, zipObjectContent, o);
       this.files[name] = object;
     };
-    var parentFolder = function(path29) {
-      if (path29.slice(-1) === "/") {
-        path29 = path29.substring(0, path29.length - 1);
+    var parentFolder = function(path30) {
+      if (path30.slice(-1) === "/") {
+        path30 = path30.substring(0, path30.length - 1);
       }
-      var lastSlash = path29.lastIndexOf("/");
-      return lastSlash > 0 ? path29.substring(0, lastSlash) : "";
+      var lastSlash = path30.lastIndexOf("/");
+      return lastSlash > 0 ? path30.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path29) {
-      if (path29.slice(-1) !== "/") {
-        path29 += "/";
+    var forceTrailingSlash = function(path30) {
+      if (path30.slice(-1) !== "/") {
+        path30 += "/";
       }
-      return path29;
+      return path30;
     };
     var folderAdd = function(name, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults.createFolders;
@@ -9755,12 +9813,12 @@ var init_audit_logger = __esm({
       constructor(workspacePath, debugMode = false) {
         this.workspacePath = workspacePath;
         this.debugMode = debugMode;
-        const cascadeDir = path27.join(workspacePath, ".cascade");
-        if (!fs26.existsSync(cascadeDir)) {
-          fs26.mkdirSync(cascadeDir, { recursive: true });
+        const cascadeDir = path28.join(workspacePath, ".cascade");
+        if (!fs27.existsSync(cascadeDir)) {
+          fs27.mkdirSync(cascadeDir, { recursive: true });
         }
-        this.keyPath = path27.join(cascadeDir, "audit_log.key");
-        this.dbPath = path27.join(cascadeDir, "audit_log.db");
+        this.keyPath = path28.join(cascadeDir, "audit_log.key");
+        this.dbPath = path28.join(cascadeDir, "audit_log.db");
         this.initEncryptionKey();
         this.db = new Database2(this.dbPath);
         this.db.pragma("journal_mode = WAL");
@@ -9790,11 +9848,11 @@ var init_audit_logger = __esm({
         return crypto.createHash("sha256").update(`${prevHash}|${timestamp}|${eventType}|${tierId}|${encryptedPayload}`).digest("hex");
       }
       initEncryptionKey() {
-        if (fs26.existsSync(this.keyPath)) {
-          this.encryptionKey = fs26.readFileSync(this.keyPath);
+        if (fs27.existsSync(this.keyPath)) {
+          this.encryptionKey = fs27.readFileSync(this.keyPath);
         } else {
           this.encryptionKey = crypto.randomBytes(32);
-          fs26.writeFileSync(this.keyPath, this.encryptionKey);
+          fs27.writeFileSync(this.keyPath, this.encryptionKey);
         }
       }
       encrypt(text) {
@@ -9872,9 +9930,9 @@ var init_audit_logger = __esm({
       dumpDebugIfNeeded() {
         if (!this.debugMode) return;
         try {
-          const dumpPath = path27.join(os6.tmpdir(), "cascade_audit_logs_debug.json");
+          const dumpPath = path28.join(os6.tmpdir(), "cascade_audit_logs_debug.json");
           const entries = this.getAllLogs();
-          fs26.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+          fs27.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
         } catch (err) {
           console.error("Failed to dump debug audit logs", err);
         }
@@ -11565,7 +11623,7 @@ function reconcilePrice(model, live) {
 }
 
 // src/constants.ts
-var CASCADE_VERSION = "0.76.0";
+var CASCADE_VERSION = "0.77.0";
 var CASCADE_CONFIG_DIR = ".cascade";
 var CASCADE_MD_FILE = "CASCADE.md";
 var CASCADE_IGNORE_FILE = ".cascadeignore";
@@ -11586,64 +11644,88 @@ var DEFAULT_AUTO_SUMMARIZE_AT = 15e4;
 var DEFAULT_MAX_SESSION_MESSAGES = 1e3;
 var DEFAULT_RETENTION_DAYS = 90;
 var MODELS = {
-  // Anthropic
-  "claude-opus-4": {
-    id: "claude-opus-4-5",
-    name: "Claude Opus 4",
+  // Anthropic — active Claude API models (2026-08-27).
+  "claude-fable-5": {
+    id: "claude-fable-5",
+    name: "Claude Fable 5",
     provider: "anthropic",
-    contextWindow: 2e5,
+    contextWindow: 1e6,
     isVisionCapable: true,
-    inputCostPer1kTokens: 0.015,
-    outputCostPer1kTokens: 0.075,
-    maxOutputTokens: 32e3,
+    inputCostPer1kTokens: 0.01,
+    outputCostPer1kTokens: 0.05,
+    maxOutputTokens: 128e3,
     supportsStreaming: true,
     isLocal: false
   },
-  "claude-sonnet-4": {
-    id: "claude-sonnet-4-5",
-    name: "Claude Sonnet 4",
+  "claude-opus-5": {
+    id: "claude-opus-5",
+    name: "Claude Opus 5",
     provider: "anthropic",
-    contextWindow: 2e5,
+    contextWindow: 1e6,
     isVisionCapable: true,
-    inputCostPer1kTokens: 3e-3,
-    outputCostPer1kTokens: 0.015,
-    maxOutputTokens: 16e3,
+    inputCostPer1kTokens: 5e-3,
+    outputCostPer1kTokens: 0.025,
+    maxOutputTokens: 128e3,
     supportsStreaming: true,
     isLocal: false
   },
-  "claude-haiku-3-5": {
-    id: "claude-haiku-3-5-20251001",
-    name: "Claude Haiku 3.5",
+  "claude-opus-4-8": {
+    id: "claude-opus-4-8",
+    name: "Claude Opus 4.8",
     provider: "anthropic",
-    contextWindow: 2e5,
+    contextWindow: 1e6,
     isVisionCapable: true,
-    inputCostPer1kTokens: 8e-4,
-    outputCostPer1kTokens: 4e-3,
-    maxOutputTokens: 8e3,
+    inputCostPer1kTokens: 5e-3,
+    outputCostPer1kTokens: 0.025,
+    maxOutputTokens: 128e3,
     supportsStreaming: true,
     isLocal: false
   },
-  "claude-haiku-4-5": {
-    id: "claude-haiku-4-5-20251001",
-    name: "Claude Haiku 4.5",
+  "claude-opus-4-7": {
+    id: "claude-opus-4-7",
+    name: "Claude Opus 4.7",
     provider: "anthropic",
-    contextWindow: 2e5,
+    contextWindow: 1e6,
     isVisionCapable: true,
-    inputCostPer1kTokens: 8e-4,
-    outputCostPer1kTokens: 4e-3,
-    maxOutputTokens: 8e3,
+    inputCostPer1kTokens: 5e-3,
+    outputCostPer1kTokens: 0.025,
+    maxOutputTokens: 128e3,
     supportsStreaming: true,
     isLocal: false
   },
-  "claude-opus-4-8": {
-    id: "claude-opus-4-8",
-    name: "Claude Opus 4.8",
+  "claude-opus-4-6": {
+    id: "claude-opus-4-6",
+    name: "Claude Opus 4.6",
+    provider: "anthropic",
+    contextWindow: 1e6,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 5e-3,
+    outputCostPer1kTokens: 0.025,
+    maxOutputTokens: 128e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "claude-opus-4-5": {
+    id: "claude-opus-4-5-20251101",
+    name: "Claude Opus 4.5",
     provider: "anthropic",
     contextWindow: 2e5,
     isVisionCapable: true,
-    inputCostPer1kTokens: 0.015,
-    outputCostPer1kTokens: 0.075,
-    maxOutputTokens: 32e3,
+    inputCostPer1kTokens: 5e-3,
+    outputCostPer1kTokens: 0.025,
+    maxOutputTokens: 64e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "claude-sonnet-5": {
+    id: "claude-sonnet-5",
+    name: "Claude Sonnet 5",
+    provider: "anthropic",
+    contextWindow: 1e6,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 2e-3,
+    outputCostPer1kTokens: 0.01,
+    maxOutputTokens: 128e3,
     supportsStreaming: true,
     isLocal: false
   },
@@ -11651,76 +11733,135 @@ var MODELS = {
     id: "claude-sonnet-4-6",
     name: "Claude Sonnet 4.6",
     provider: "anthropic",
+    contextWindow: 1e6,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 3e-3,
+    outputCostPer1kTokens: 0.015,
+    maxOutputTokens: 64e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "claude-sonnet-4-5": {
+    id: "claude-sonnet-4-5-20250929",
+    name: "Claude Sonnet 4.5",
+    provider: "anthropic",
     contextWindow: 2e5,
     isVisionCapable: true,
     inputCostPer1kTokens: 3e-3,
     outputCostPer1kTokens: 0.015,
-    maxOutputTokens: 16e3,
+    maxOutputTokens: 64e3,
     supportsStreaming: true,
     isLocal: false
   },
-  // OpenAI
-  "gpt-4o": {
-    id: "gpt-4o",
-    name: "GPT-4o",
+  "claude-haiku-4-5": {
+    id: "claude-haiku-4-5-20251001",
+    name: "Claude Haiku 4.5",
+    provider: "anthropic",
+    contextWindow: 2e5,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 1e-3,
+    outputCostPer1kTokens: 5e-3,
+    maxOutputTokens: 64e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  // OpenAI — active chat-capable models used by Cascade's Chat Completions path.
+  "gpt-5.6-sol": {
+    id: "gpt-5.6-sol",
+    name: "GPT-5.6 Sol",
     provider: "openai",
-    contextWindow: 128e3,
+    contextWindow: 105e4,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 4e-3,
+    outputCostPer1kTokens: 0.02,
+    maxOutputTokens: 128e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gpt-5.6-terra": {
+    id: "gpt-5.6-terra",
+    name: "GPT-5.6 Terra",
+    provider: "openai",
+    contextWindow: 105e4,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 2e-3,
+    outputCostPer1kTokens: 0.012,
+    maxOutputTokens: 128e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gpt-5.6-luna": {
+    id: "gpt-5.6-luna",
+    name: "GPT-5.6 Luna",
+    provider: "openai",
+    contextWindow: 105e4,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 2e-4,
+    outputCostPer1kTokens: 12e-4,
+    maxOutputTokens: 128e3,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gpt-5.5": {
+    id: "gpt-5.5",
+    name: "GPT-5.5",
+    provider: "openai",
+    contextWindow: 105e4,
     isVisionCapable: true,
     inputCostPer1kTokens: 5e-3,
-    outputCostPer1kTokens: 0.015,
-    maxOutputTokens: 16e3,
+    outputCostPer1kTokens: 0.03,
+    maxOutputTokens: 128e3,
     supportsStreaming: true,
     isLocal: false
   },
-  "gpt-4o-mini": {
-    id: "gpt-4o-mini",
-    name: "GPT-4o Mini",
+  "gpt-5.4": {
+    id: "gpt-5.4",
+    name: "GPT-5.4",
     provider: "openai",
-    contextWindow: 128e3,
+    contextWindow: 105e4,
     isVisionCapable: true,
-    inputCostPer1kTokens: 15e-5,
-    outputCostPer1kTokens: 6e-4,
-    maxOutputTokens: 16e3,
+    inputCostPer1kTokens: 25e-4,
+    outputCostPer1kTokens: 0.015,
+    maxOutputTokens: 128e3,
     supportsStreaming: true,
     isLocal: false
   },
-  "gpt-4.1": {
-    id: "gpt-4.1",
-    name: "GPT-4.1",
+  "gpt-5.4-mini": {
+    id: "gpt-5.4-mini",
+    name: "GPT-5.4 Mini",
     provider: "openai",
-    contextWindow: 1047576,
+    contextWindow: 4e5,
     isVisionCapable: true,
-    inputCostPer1kTokens: 2e-3,
-    outputCostPer1kTokens: 8e-3,
-    maxOutputTokens: 32768,
+    inputCostPer1kTokens: 75e-5,
+    outputCostPer1kTokens: 45e-4,
+    maxOutputTokens: 128e3,
     supportsStreaming: true,
     isLocal: false
   },
-  "gpt-4.1-mini": {
-    id: "gpt-4.1-mini",
-    name: "GPT-4.1 Mini",
+  "gpt-5.4-nano": {
+    id: "gpt-5.4-nano",
+    name: "GPT-5.4 Nano",
     provider: "openai",
-    contextWindow: 1047576,
+    contextWindow: 4e5,
     isVisionCapable: true,
-    inputCostPer1kTokens: 4e-4,
-    outputCostPer1kTokens: 16e-4,
-    maxOutputTokens: 32768,
+    inputCostPer1kTokens: 2e-4,
+    outputCostPer1kTokens: 125e-5,
+    maxOutputTokens: 128e3,
     supportsStreaming: true,
     isLocal: false
   },
-  "gpt-4.1-nano": {
-    id: "gpt-4.1-nano",
-    name: "GPT-4.1 Nano",
+  "gpt-5.2": {
+    id: "gpt-5.2",
+    name: "GPT-5.2",
     provider: "openai",
-    contextWindow: 1047576,
+    contextWindow: 4e5,
     isVisionCapable: true,
-    inputCostPer1kTokens: 1e-4,
-    outputCostPer1kTokens: 4e-4,
-    maxOutputTokens: 32768,
+    inputCostPer1kTokens: 175e-5,
+    outputCostPer1kTokens: 0.014,
+    maxOutputTokens: 128e3,
     supportsStreaming: true,
     isLocal: false
   },
-  // GPT-5 family (offline baseline pricing; the live fetch keeps it current).
   "gpt-5": {
     id: "gpt-5",
     name: "GPT-5",
@@ -11757,79 +11898,149 @@ var MODELS = {
     supportsStreaming: true,
     isLocal: false
   },
-  // GPT-5 point releases — genuinely distinct capability, so they route as their
-  // own families (not folded into gpt-5). Offline baseline pricing; live fetch
-  // keeps it current. gpt-5.5 "Spud" (Apr 2026) is the current SWE-bench leader.
-  "gpt-5.5": {
-    id: "gpt-5.5",
-    name: "GPT-5.5",
+  "gpt-4.1": {
+    id: "gpt-4.1",
+    name: "GPT-4.1",
     provider: "openai",
-    contextWindow: 4e5,
+    contextWindow: 1047576,
     isVisionCapable: true,
-    inputCostPer1kTokens: 25e-4,
-    outputCostPer1kTokens: 0.02,
-    maxOutputTokens: 128e3,
+    inputCostPer1kTokens: 2e-3,
+    outputCostPer1kTokens: 8e-3,
+    maxOutputTokens: 32768,
     supportsStreaming: true,
     isLocal: false
   },
-  "gpt-5.4": {
-    id: "gpt-5.4",
-    name: "GPT-5.4",
+  "gpt-4.1-mini": {
+    id: "gpt-4.1-mini",
+    name: "GPT-4.1 Mini",
     provider: "openai",
-    contextWindow: 4e5,
+    contextWindow: 1047576,
     isVisionCapable: true,
-    inputCostPer1kTokens: 125e-5,
+    inputCostPer1kTokens: 4e-4,
+    outputCostPer1kTokens: 16e-4,
+    maxOutputTokens: 32768,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gpt-4.1-nano": {
+    id: "gpt-4.1-nano",
+    name: "GPT-4.1 Nano",
+    provider: "openai",
+    contextWindow: 1047576,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 1e-4,
+    outputCostPer1kTokens: 4e-4,
+    maxOutputTokens: 32768,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gpt-4o": {
+    id: "gpt-4o",
+    name: "GPT-4o",
+    provider: "openai",
+    contextWindow: 128e3,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 25e-4,
     outputCostPer1kTokens: 0.01,
-    maxOutputTokens: 128e3,
+    maxOutputTokens: 16e3,
     supportsStreaming: true,
     isLocal: false
   },
-  "gpt-5.4-mini": {
-    id: "gpt-5.4-mini",
-    name: "GPT-5.4 Mini",
+  "gpt-4o-mini": {
+    id: "gpt-4o-mini",
+    name: "GPT-4o Mini",
     provider: "openai",
-    contextWindow: 4e5,
+    contextWindow: 128e3,
     isVisionCapable: true,
-    inputCostPer1kTokens: 25e-5,
-    outputCostPer1kTokens: 2e-3,
-    maxOutputTokens: 128e3,
+    inputCostPer1kTokens: 15e-5,
+    outputCostPer1kTokens: 6e-4,
+    maxOutputTokens: 16e3,
     supportsStreaming: true,
     isLocal: false
   },
-  // Google
-  "gemini-2.0-flash": {
-    id: "gemini-2.0-flash",
-    name: "Gemini 2.0 Flash",
+  // Google Gemini — active GA + preview chat models. Gemini 2.0/1.5 are no
+  // longer advertised because the Gemini API shut those generations down.
+  "gemini-3.7-flash": {
+    id: "gemini-3.7-flash",
+    name: "Gemini 3.7 Flash",
     provider: "gemini",
-    contextWindow: 1e6,
+    contextWindow: 1048576,
     isVisionCapable: true,
-    inputCostPer1kTokens: 1e-4,
-    outputCostPer1kTokens: 4e-4,
-    maxOutputTokens: 8e3,
+    inputCostPer1kTokens: 75e-5,
+    outputCostPer1kTokens: 375e-5,
+    maxOutputTokens: 65536,
     supportsStreaming: true,
     isLocal: false
   },
-  "gemini-1.5-pro": {
-    id: "gemini-1.5-pro",
-    name: "Gemini 1.5 Pro",
+  "gemini-3.6-flash": {
+    id: "gemini-3.6-flash",
+    name: "Gemini 3.6 Flash",
     provider: "gemini",
-    contextWindow: 1e6,
+    contextWindow: 1048576,
     isVisionCapable: true,
-    inputCostPer1kTokens: 125e-5,
-    outputCostPer1kTokens: 5e-3,
-    maxOutputTokens: 8e3,
+    inputCostPer1kTokens: 75e-5,
+    outputCostPer1kTokens: 375e-5,
+    maxOutputTokens: 65536,
     supportsStreaming: true,
     isLocal: false
   },
-  "gemini-2.0-flash-lite": {
-    id: "gemini-2.0-flash-lite",
-    name: "Gemini 2.0 Flash-Lite",
+  "gemini-3.5-flash": {
+    id: "gemini-3.5-flash",
+    name: "Gemini 3.5 Flash",
     provider: "gemini",
-    contextWindow: 1e6,
+    contextWindow: 1048576,
     isVisionCapable: true,
-    inputCostPer1kTokens: 5e-5,
-    outputCostPer1kTokens: 2e-4,
-    maxOutputTokens: 8e3,
+    inputCostPer1kTokens: 15e-4,
+    outputCostPer1kTokens: 9e-3,
+    maxOutputTokens: 65536,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gemini-3.5-flash-lite": {
+    id: "gemini-3.5-flash-lite",
+    name: "Gemini 3.5 Flash-Lite",
+    provider: "gemini",
+    contextWindow: 1048576,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 3e-4,
+    outputCostPer1kTokens: 25e-4,
+    maxOutputTokens: 65536,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gemini-3.1-flash-lite": {
+    id: "gemini-3.1-flash-lite",
+    name: "Gemini 3.1 Flash-Lite",
+    provider: "gemini",
+    contextWindow: 1048576,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 25e-5,
+    outputCostPer1kTokens: 15e-4,
+    maxOutputTokens: 65536,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gemini-3.1-pro-preview": {
+    id: "gemini-3.1-pro-preview",
+    name: "Gemini 3.1 Pro Preview",
+    provider: "gemini",
+    contextWindow: 1048576,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 2e-3,
+    outputCostPer1kTokens: 0.012,
+    maxOutputTokens: 65536,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gemini-3-flash-preview": {
+    id: "gemini-3-flash-preview",
+    name: "Gemini 3 Flash Preview",
+    provider: "gemini",
+    contextWindow: 1048576,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 5e-4,
+    outputCostPer1kTokens: 3e-3,
+    maxOutputTokens: 65536,
     supportsStreaming: true,
     isLocal: false
   },
@@ -11837,7 +12048,7 @@ var MODELS = {
     id: "gemini-2.5-pro",
     name: "Gemini 2.5 Pro",
     provider: "gemini",
-    contextWindow: 1e6,
+    contextWindow: 1048576,
     isVisionCapable: true,
     inputCostPer1kTokens: 125e-5,
     outputCostPer1kTokens: 0.01,
@@ -11849,10 +12060,22 @@ var MODELS = {
     id: "gemini-2.5-flash",
     name: "Gemini 2.5 Flash",
     provider: "gemini",
-    contextWindow: 1e6,
+    contextWindow: 1048576,
     isVisionCapable: true,
-    inputCostPer1kTokens: 15e-5,
-    outputCostPer1kTokens: 6e-4,
+    inputCostPer1kTokens: 3e-4,
+    outputCostPer1kTokens: 25e-4,
+    maxOutputTokens: 65536,
+    supportsStreaming: true,
+    isLocal: false
+  },
+  "gemini-2.5-flash-lite": {
+    id: "gemini-2.5-flash-lite",
+    name: "Gemini 2.5 Flash-Lite",
+    provider: "gemini",
+    contextWindow: 1048576,
+    isVisionCapable: true,
+    inputCostPer1kTokens: 1e-4,
+    outputCostPer1kTokens: 4e-4,
     maxOutputTokens: 65536,
     supportsStreaming: true,
     isLocal: false
@@ -11922,43 +12145,57 @@ for (const _m of Object.values(MODELS)) {
   _m.pricingUnknown = false;
 }
 var T1_MODEL_PRIORITY = [
+  "gpt-5.6-sol",
+  "claude-fable-5",
+  "claude-opus-5",
   "gpt-5.5",
   "gpt-5.4",
+  "gemini-3.1-pro-preview",
+  "claude-opus-4-8",
+  "claude-sonnet-5",
+  "gemini-3.7-flash",
+  "gpt-5.2",
   "gpt-5",
-  "claude-opus-4",
-  "claude-sonnet-4",
   "gemini-2.5-pro",
   "gpt-4.1",
-  "gpt-4o",
-  "gemini-1.5-pro"
+  "gpt-4o"
 ];
 var T2_MODEL_PRIORITY = [
+  "gpt-5.6-terra",
+  "claude-sonnet-5",
+  "gemini-3.7-flash",
+  "gemini-3.6-flash",
   "gpt-5.4-mini",
   "gpt-5-mini",
-  "claude-sonnet-4",
+  "claude-sonnet-4-6",
   "claude-haiku-4-5",
-  "claude-haiku-3-5",
+  "gemini-3.5-flash",
   "gemini-2.5-flash",
   "gpt-4.1-mini",
   "gpt-4o-mini",
-  "gemini-2.0-flash",
   "llama3:70b"
 ];
 var T3_MODEL_PRIORITY = [
+  "gpt-5.6-luna",
+  "gpt-5.4-nano",
+  "gemini-3.5-flash-lite",
+  "gemini-3.1-flash-lite",
+  "claude-haiku-4-5",
   "gpt-5-nano",
+  "gemini-2.5-flash-lite",
   "llama3.2:3b",
   "mistral:7b",
-  "claude-haiku-4-5",
-  "claude-haiku-3-5",
   "gpt-4.1-nano",
   "gpt-4o-mini",
-  "gemini-2.5-flash",
-  "gemini-2.0-flash"
+  "gemini-2.5-flash"
 ];
 var VISION_MODEL_PRIORITY = [
-  "claude-sonnet-4",
+  "gpt-5.6-sol",
+  "claude-fable-5",
+  "claude-sonnet-5",
+  "gemini-3.7-flash",
   "gpt-4o",
-  "gemini-2.0-flash",
+  "gemini-2.5-flash",
   "llava"
 ];
 var COMPLEXITY_T2_COUNT = {
@@ -12139,7 +12376,7 @@ function isChatModel(id, methods) {
   return !NON_CHAT.test(id);
 }
 try {
-  dns.setDefaultResultOrder("ipv4first");
+  dnsCallback.setDefaultResultOrder("ipv4first");
 } catch {
 }
 function preferIpv4Host(url) {
@@ -12155,8 +12392,8 @@ function normalizeEndpoint(url) {
   if (!raw) return "";
   try {
     const u = new URL(raw);
-    const path29 = stripTrailingSlashes(`${u.pathname}${u.search}`);
-    return `${u.protocol}//${u.host.toLowerCase()}${path29}`;
+    const path30 = stripTrailingSlashes(`${u.pathname}${u.search}`);
+    return `${u.protocol}//${u.host.toLowerCase()}${path30}`;
   } catch {
     return raw.toLowerCase();
   }
@@ -12823,52 +13060,127 @@ var OpenAIProvider = class extends BaseProvider {
   }
 };
 
+// src/providers/cloud-model-catalog.json
+var cloud_model_catalog_default = {
+  models: [
+    { id: "gpt-5.6-sol", name: "GPT-5.6 Sol", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 105e4, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "gpt-5.6-terra", name: "GPT-5.6 Terra", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 105e4, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "gpt-5.6-luna", name: "GPT-5.6 Luna", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 105e4, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "gpt-5.5", name: "GPT-5.5", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 105e4, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "gpt-5.4", name: "GPT-5.4", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 105e4, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "gpt-5.4-mini", name: "GPT-5.4 Mini", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 4e5, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "gpt-5.4-nano", name: "GPT-5.4 Nano", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 4e5, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "gpt-5", name: "GPT-5", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 4e5, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "gpt-5-mini", name: "GPT-5 Mini", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 4e5, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "gpt-5-nano", name: "GPT-5 Nano", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 4e5, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "gpt-4.1", name: "GPT-4.1", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 1047576, maxOutputTokens: 32768, vision: true, toolUse: true },
+    { id: "gpt-4.1-mini", name: "GPT-4.1 Mini", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 1047576, maxOutputTokens: 32768, vision: true, toolUse: true },
+    { id: "gpt-4.1-nano", name: "GPT-4.1 Nano", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 1047576, maxOutputTokens: 32768, vision: true, toolUse: true },
+    { id: "gpt-4o", name: "GPT-4o", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 128e3, maxOutputTokens: 16384, vision: true, toolUse: true },
+    { id: "gpt-4o-mini", name: "GPT-4o Mini", providers: ["openai", "azure"], lifecycle: "ga", contextWindow: 128e3, maxOutputTokens: 16384, vision: true, toolUse: true },
+    { id: "claude-fable-5", name: "Claude Fable 5", providers: ["anthropic"], lifecycle: "ga", contextWindow: 1e6, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "claude-opus-5", name: "Claude Opus 5", providers: ["anthropic"], lifecycle: "ga", contextWindow: 1e6, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "claude-opus-4-8", name: "Claude Opus 4.8", providers: ["anthropic"], lifecycle: "ga", contextWindow: 1e6, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "claude-opus-4-7", name: "Claude Opus 4.7", providers: ["anthropic"], lifecycle: "ga", contextWindow: 1e6, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "claude-opus-4-6", name: "Claude Opus 4.6", providers: ["anthropic"], lifecycle: "ga", contextWindow: 1e6, vision: true, toolUse: true },
+    { id: "claude-opus-4-5-20251101", name: "Claude Opus 4.5", providers: ["anthropic"], lifecycle: "ga", contextWindow: 2e5, vision: true, toolUse: true },
+    { id: "claude-sonnet-5", name: "Claude Sonnet 5", providers: ["anthropic"], lifecycle: "ga", contextWindow: 1e6, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "claude-sonnet-4-6", name: "Claude Sonnet 4.6", providers: ["anthropic"], lifecycle: "ga", contextWindow: 1e6, maxOutputTokens: 128e3, vision: true, toolUse: true },
+    { id: "claude-sonnet-4-5-20250929", name: "Claude Sonnet 4.5", providers: ["anthropic"], lifecycle: "ga", contextWindow: 2e5, vision: true, toolUse: true },
+    { id: "claude-haiku-4-5-20251001", name: "Claude Haiku 4.5", providers: ["anthropic"], lifecycle: "ga", contextWindow: 2e5, maxOutputTokens: 64e3, vision: true, toolUse: true },
+    { id: "gemini-3.7-flash", name: "Gemini 3.7 Flash", providers: ["gemini"], lifecycle: "ga", contextWindow: 1048576, maxOutputTokens: 65536, vision: true, toolUse: true },
+    { id: "gemini-3.6-flash", name: "Gemini 3.6 Flash", providers: ["gemini"], lifecycle: "ga", contextWindow: 1048576, maxOutputTokens: 65536, vision: true, toolUse: true },
+    { id: "gemini-3.5-flash", name: "Gemini 3.5 Flash", providers: ["gemini"], lifecycle: "ga", contextWindow: 1048576, maxOutputTokens: 65536, vision: true, toolUse: true },
+    { id: "gemini-3.5-flash-lite", name: "Gemini 3.5 Flash-Lite", providers: ["gemini"], lifecycle: "ga", contextWindow: 1048576, maxOutputTokens: 65536, vision: true, toolUse: true },
+    { id: "gemini-3.1-flash-lite", name: "Gemini 3.1 Flash-Lite", providers: ["gemini"], lifecycle: "ga", contextWindow: 1048576, maxOutputTokens: 65536, vision: true, toolUse: true },
+    { id: "gemini-3.1-pro-preview", name: "Gemini 3.1 Pro", providers: ["gemini"], lifecycle: "preview", contextWindow: 1048576, maxOutputTokens: 65536, vision: true, toolUse: true },
+    { id: "gemini-3-flash-preview", name: "Gemini 3 Flash", providers: ["gemini"], lifecycle: "preview", contextWindow: 1048576, maxOutputTokens: 65536, vision: true, toolUse: true },
+    { id: "gemini-2.5-pro", name: "Gemini 2.5 Pro", providers: ["gemini"], lifecycle: "ga", contextWindow: 1048576, maxOutputTokens: 65536, vision: true, toolUse: true },
+    { id: "gemini-2.5-flash", name: "Gemini 2.5 Flash", providers: ["gemini"], lifecycle: "ga", contextWindow: 1048576, maxOutputTokens: 65536, vision: true, toolUse: true },
+    { id: "gemini-2.5-flash-lite", name: "Gemini 2.5 Flash-Lite", providers: ["gemini"], lifecycle: "ga", contextWindow: 1048576, maxOutputTokens: 65536, vision: true, toolUse: true }
+  ]
+};
+
 // src/providers/azure.ts
 var DEFAULT_AZURE_API_VERSION = "2024-12-01-preview";
-var AZURE_BASE_MODEL_RULES = [
-  [/gpt-?5\.5/, "gpt-5.5"],
-  [/gpt-?5\.4.*mini/, "gpt-5.4-mini"],
-  [/gpt-?5\.4/, "gpt-5.4"],
-  [/gpt-?5.*nano/, "gpt-5-nano"],
-  [/gpt-?5.*mini/, "gpt-5-mini"],
-  [/gpt-?5/, "gpt-5"],
-  [/gpt-?4\.1-nano/, "gpt-4.1-nano"],
-  [/gpt-?4\.1-mini/, "gpt-4.1-mini"],
-  [/gpt-?4\.1/, "gpt-4.1"],
-  [/gpt-?4o-mini/, "gpt-4o-mini"],
-  [/gpt-?4o/, "gpt-4o"]
-];
-var AZURE_BASE_MODELS = AZURE_BASE_MODEL_RULES.map(([, id]) => id);
+var CLOUD_MODELS = cloud_model_catalog_default.models;
+var AZURE_CATALOG = CLOUD_MODELS.filter((m) => m.providers.includes("azure")).slice().sort((a, b) => b.id.length - a.id.length || a.id.localeCompare(b.id));
+var AZURE_BASE_MODELS = AZURE_CATALOG.map((m) => m.id);
+function compactModelId(id) {
+  return id.toLowerCase().replace(/[^a-z0-9.]/g, "");
+}
+function catalogEntry(id) {
+  const n = id.toLowerCase();
+  return CLOUD_MODELS.find((m) => m.id.toLowerCase() === n);
+}
 function inferAzureBaseModel(deploymentName) {
   const n = deploymentName.toLowerCase();
-  for (const [re, base] of AZURE_BASE_MODEL_RULES) if (re.test(n)) return base;
+  const compact = compactModelId(n);
+  const hasBareGpt56Alias = compact.includes("gpt5.6");
+  for (const model of AZURE_CATALOG) {
+    if (hasBareGpt56Alias && model.id === "gpt-5") continue;
+    if (n.includes(model.id.toLowerCase()) || compact.includes(compactModelId(model.id))) {
+      return model.id;
+    }
+  }
+  if (hasBareGpt56Alias) return "gpt-5.6-sol";
+  const gpt5At = compact.indexOf("gpt5");
+  if (gpt5At !== -1) {
+    const suffix = compact.slice(gpt5At + "gpt5".length);
+    if (suffix.includes("nano")) return "gpt-5-nano";
+    if (suffix.includes("mini")) return "gpt-5-mini";
+    return "gpt-5";
+  }
+  if (compact.includes("gpt4.1nano")) return "gpt-4.1-nano";
+  if (compact.includes("gpt4.1mini")) return "gpt-4.1-mini";
+  if (compact.includes("gpt4.1")) return "gpt-4.1";
+  if (compact.includes("gpt4omini")) return "gpt-4o-mini";
+  if (compact.includes("gpt4o")) return "gpt-4o";
   return null;
 }
+function catalogModelInfo(baseModelId) {
+  const entry = catalogEntry(baseModelId);
+  if (!entry?.contextWindow) return void 0;
+  return {
+    id: entry.id,
+    name: entry.name,
+    provider: "openai",
+    contextWindow: entry.contextWindow,
+    isVisionCapable: entry.vision ?? false,
+    inputCostPer1kTokens: 0,
+    outputCostPer1kTokens: 0,
+    maxOutputTokens: entry.maxOutputTokens ?? 16e3,
+    supportsStreaming: true,
+    isLocal: false,
+    supportsToolUse: entry.toolUse ?? true,
+    pricingUnknown: true
+  };
+}
 function azureModelForDeployment(cfg) {
   if (cfg.type !== "azure" || !cfg.deploymentName?.trim()) return null;
   const id = cfg.deploymentName.trim();
   const name = cfg.label?.trim() || id;
   const baseModelId = cfg.model?.trim() || inferAzureBaseModel(id) || void 0;
-  const base = baseModelId ? MODELS[baseModelId] : void 0;
-  if (base) {
+  const base = baseModelId ? MODELS[baseModelId] ?? catalogModelInfo(baseModelId) : void 0;
+  if (base && baseModelId) {
     const azurePrice = resolvePricing(
       { id, provider: "azure", isLocal: false, baseModelId },
       { region: cfg.region }
     );
+    const exactAzurePrice = !azurePrice.unknown && !azurePrice.estimatedFromProvider;
+    const nativeToolsOnThisTransport = /^gpt-5\.6-(?:sol|terra|luna)$/i.test(baseModelId) ? false : base.supportsToolUse ?? true;
     return {
       ...base,
       id,
-      // callable deployment name
       name,
       provider: "azure",
       baseModelId,
-      // real identity for benchmark + live pricing
-      supportsToolUse: base.supportsToolUse ?? true,
-      ...azurePrice.unknown ? {} : {
+      supportsToolUse: nativeToolsOnThisTransport,
+      ...!azurePrice.unknown ? {
         inputCostPer1kTokens: azurePrice.input,
         outputCostPer1kTokens: azurePrice.output,
-        pricingUnknown: false
-      }
+        pricingUnknown: !exactAzurePrice
+      } : { pricingUnknown: true }
     };
   }
   return {
@@ -12883,18 +13195,23 @@ function azureModelForDeployment(cfg) {
     maxOutputTokens: 16e3,
     supportsStreaming: true,
     isLocal: false,
-    supportsToolUse: true
+    supportsToolUse: true,
+    pricingUnknown: true
   };
 }
+function stripTrailingSlashes3(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47) end--;
+  return value.slice(0, end);
+}
 var AzureOpenAIProvider = class extends OpenAIProvider {
   constructor(config, model) {
     const rawUrl = config.baseUrl ?? AZURE_BASE_URL_TEMPLATE.replace("{resource}", "YOUR_RESOURCE");
-    const endpoint = rawUrl.replace(/\/+$/, "");
+    const endpoint = stripTrailingSlashes3(rawUrl);
     super(
       {
         ...config,
         baseUrl: endpoint
-        // Kept for superclass compatibility if it reads it
       },
       model
     );
@@ -14637,7 +14954,7 @@ var Keystore = class {
       const creds = await this.keytar.findCredentials(KEYTAR_SERVICE);
       this.cache = Object.fromEntries(creds.map((c) => [c.account, c.password]));
       this.backend = "keytar";
-      if (password && fs26.existsSync(this.storePath)) {
+      if (password && fs27.existsSync(this.storePath)) {
         try {
           const fileEntries = this.decryptFile(password);
           for (const [k, v] of Object.entries(fileEntries)) {
@@ -14656,7 +14973,7 @@ var Keystore = class {
         "Keystore unlock requires a password because the OS keychain (keytar) is not available on this system."
       );
     }
-    if (!fs26.existsSync(this.storePath)) {
+    if (!fs27.existsSync(this.storePath)) {
       const salt = crypto.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
@@ -14670,7 +14987,7 @@ var Keystore = class {
   }
   /** Synchronous legacy unlock kept for AES-only environments. */
   unlockSync(password) {
-    if (!fs26.existsSync(this.storePath)) {
+    if (!fs27.existsSync(this.storePath)) {
       const salt = crypto.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
@@ -14728,7 +15045,7 @@ var Keystore = class {
     }
   }
   decryptFile(password, knownSalt) {
-    if (!fs26.existsSync(this.storePath)) return {};
+    if (!fs27.existsSync(this.storePath)) return {};
     try {
       const { salt, ciphertext, iv, tag } = this.readRaw();
       const useSalt = knownSalt ?? salt;
@@ -14750,8 +15067,8 @@ var Keystore = class {
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([raw.salt, iv, tag, ciphertext]);
-    fs26.mkdirSync(path27.dirname(this.storePath), { recursive: true });
-    fs26.writeFileSync(this.storePath, out, { mode: 384 });
+    fs27.mkdirSync(path28.dirname(this.storePath), { recursive: true });
+    fs27.writeFileSync(this.storePath, out, { mode: 384 });
   }
   writeWithSalt(data, salt) {
     if (!this.masterKey) throw new Error("writeWithSalt called before masterKey was set");
@@ -14761,11 +15078,11 @@ var Keystore = class {
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([salt, iv, tag, ciphertext]);
-    fs26.mkdirSync(path27.dirname(this.storePath), { recursive: true });
-    fs26.writeFileSync(this.storePath, out, { mode: 384 });
+    fs27.mkdirSync(path28.dirname(this.storePath), { recursive: true });
+    fs27.writeFileSync(this.storePath, out, { mode: 384 });
   }
   readRaw() {
-    const buf = fs26.readFileSync(this.storePath);
+    const buf = fs27.readFileSync(this.storePath);
     let offset = 0;
     const salt = buf.subarray(offset, offset + SALT_LEN);
     offset += SALT_LEN;
@@ -14798,7 +15115,7 @@ var CascadeIgnore = class {
     ]);
   }
   async load(workspacePath) {
-    const filePath = path27.join(workspacePath, ".cascadeignore");
+    const filePath = path28.join(workspacePath, ".cascadeignore");
     try {
       const content = await fs11.readFile(filePath, "utf-8");
       const lines = content.split("\n").filter((l) => l.trim() && !l.startsWith("#"));
@@ -14809,7 +15126,7 @@ var CascadeIgnore = class {
   }
   isIgnored(filePath, workspacePath) {
     try {
-      const relative = workspacePath ? path27.relative(workspacePath, filePath) : filePath;
+      const relative = workspacePath ? path28.relative(workspacePath, filePath) : filePath;
       return this.ig.ignores(relative);
     } catch {
       return false;
@@ -14820,7 +15137,7 @@ var CascadeIgnore = class {
   }
 };
 async function loadCascadeMd(workspacePath) {
-  const filePath = path27.join(workspacePath, "CASCADE.md");
+  const filePath = path28.join(workspacePath, "CASCADE.md");
   try {
     const raw = await fs11.readFile(filePath, "utf-8");
     return parseCascadeMd(raw);
@@ -14851,7 +15168,7 @@ ${raw.trim()}`;
 var MemoryStore = class _MemoryStore {
   db;
   constructor(dbPath) {
-    fs26.mkdirSync(path27.dirname(dbPath), { recursive: true });
+    fs27.mkdirSync(path28.dirname(dbPath), { recursive: true });
     try {
       this.db = new Database2(dbPath, { timeout: 5e3 });
       this.db.pragma("journal_mode = WAL");
@@ -15749,7 +16066,18 @@ var WebSearchConfigSchema = z.object({
   /** Tavily API key — get one at https://tavily.com */
   tavilyApiKey: z.string().optional(),
   /** Max results per search (default 5) */
-  maxResults: z.number().default(5)
+  maxResults: z.number().default(5),
+  /**
+   * Send `searxngUrl` through the SSRF guard. Off for a local run, where the
+   * URL is the machine owner's own config and a self-hosted SearXNG is
+   * routinely on a private address; on for a host that accepts it from a
+   * request. See `src/tools/web-search.ts`.
+   *
+   * It has to be named HERE, not just on the TypeScript interfaces: the config
+   * passes through `CascadeConfigSchema.parse()` on its way into a run, and
+   * zod drops every key this object does not declare.
+   */
+  guardSearxngUrl: z.boolean().optional()
 });
 var ToolsConfigSchema = z.object({
   shellAllowlist: z.array(z.string()).default([]),
@@ -16153,7 +16481,7 @@ function credentialEndpointsConflict(type, rowEndpoint, credentialEndpoint) {
 
 // src/config/global-credentials.ts
 function credentialsPath(globalDir2) {
-  return path27.join(globalDir2, GLOBAL_CREDENTIALS_FILE);
+  return path28.join(globalDir2, GLOBAL_CREDENTIALS_FILE);
 }
 function providerKey(p) {
   return p.type;
@@ -16183,7 +16511,7 @@ function isPersistable(p) {
 }
 function loadGlobalCredentials(globalDir2) {
   try {
-    const raw = fs26.readFileSync(credentialsPath(globalDir2), "utf-8");
+    const raw = fs27.readFileSync(credentialsPath(globalDir2), "utf-8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed.providers)) return [];
     return parsed.providers.filter(
@@ -16195,13 +16523,13 @@ function loadGlobalCredentials(globalDir2) {
 }
 function saveGlobalCredentials(globalDir2, providers) {
   const filePath = credentialsPath(globalDir2);
-  fs26.mkdirSync(globalDir2, { recursive: true, mode: 448 });
+  fs27.mkdirSync(globalDir2, { recursive: true, mode: 448 });
   const body = { version: 1, providers: providers.filter(isPersistable) };
   const tmp = `${filePath}.tmp`;
-  fs26.writeFileSync(tmp, JSON.stringify(body, null, 2), { encoding: "utf-8", mode: 384 });
-  fs26.renameSync(tmp, filePath);
+  fs27.writeFileSync(tmp, JSON.stringify(body, null, 2), { encoding: "utf-8", mode: 384 });
+  fs27.renameSync(tmp, filePath);
   try {
-    fs26.chmodSync(filePath, 384);
+    fs27.chmodSync(filePath, 384);
   } catch {
   }
 }
@@ -16602,7 +16930,7 @@ var ConfigManager = class {
   /** `globalDirOverride` exists for tests — never point it at the real home dir there. */
   constructor(workspacePath = process.cwd(), globalDirOverride) {
     this.workspacePath = workspacePath;
-    this.globalDir = globalDirOverride ?? path27.join(os6.homedir(), GLOBAL_CONFIG_DIR);
+    this.globalDir = globalDirOverride ?? path28.join(os6.homedir(), GLOBAL_CONFIG_DIR);
   }
   async load() {
     this.config = await this.loadConfig();
@@ -16616,8 +16944,8 @@ var ConfigManager = class {
     this.ignore = new CascadeIgnore();
     await this.ignore.load(this.workspacePath);
     this.cascadeMd = await loadCascadeMd(this.workspacePath);
-    this.keystore = new Keystore(path27.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
-    this.store = new MemoryStore(path27.join(this.workspacePath, CASCADE_DB_FILE));
+    this.keystore = new Keystore(path28.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
+    this.store = new MemoryStore(path28.join(this.workspacePath, CASCADE_DB_FILE));
     const globalRevoked = stripRevokedCredentials(loadGlobalCredentials(this.globalDir));
     const globalCreds = filterRetiredCredentials(globalRevoked.kept);
     if (globalRevoked.removed > 0) this.revokedCredentials += globalRevoked.removed;
@@ -16690,8 +17018,8 @@ var ConfigManager = class {
    * never reached the disk (see `commitSettings`).
    */
   async save(config = this.config) {
-    const configPath = path27.join(this.workspacePath, CASCADE_CONFIG_FILE);
-    await fs11.mkdir(path27.dirname(configPath), { recursive: true });
+    const configPath = path28.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    await fs11.mkdir(path28.dirname(configPath), { recursive: true });
     await fs11.writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
     try {
       saveGlobalCredentials(this.globalDir, config.providers);
@@ -16741,7 +17069,7 @@ var ConfigManager = class {
     this.revokedCredentials = 0;
     this.revokedPins = [];
     this.revokedNotice = void 0;
-    const configPath = path27.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    const configPath = path28.join(this.workspacePath, CASCADE_CONFIG_FILE);
     try {
       const raw = await fs11.readFile(configPath, "utf-8");
       const parsed = JSON.parse(raw);
@@ -16835,7 +17163,7 @@ var ConfigManager = class {
     return onResource;
   }
   async persistClearedPins(tiers) {
-    const configPath = path27.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    const configPath = path28.join(this.workspacePath, CASCADE_CONFIG_FILE);
     try {
       const raw = JSON.parse(await fs11.readFile(configPath, "utf-8"));
       const models = raw["models"];
@@ -17429,7 +17757,7 @@ function computeDelegationSavings(stats, t1Model) {
 var DEFAULT_SNAPSHOT_URL = "https://raw.githubusercontent.com/Varun-SV/Cascade-AI/main/src/core/router/benchmark-data.json";
 var OPENROUTER_MODELS_URL = "https://openrouter.ai/api/v1/models";
 var FETCH_TIMEOUT_MS = 8e3;
-var DEFAULT_CACHE_FILE = path27.join(os6.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
+var DEFAULT_CACHE_FILE = path28.join(os6.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
 function normalizeModelId2(id) {
   let s = id.toLowerCase();
   const slash = s.lastIndexOf("/");
@@ -17576,7 +17904,7 @@ var LiveDataProvider = class {
   }
   async saveCache() {
     try {
-      await fs11.mkdir(path27.dirname(this.opts.cacheFile), { recursive: true });
+      await fs11.mkdir(path28.dirname(this.opts.cacheFile), { recursive: true });
       const cache = {
         fetchedAt: this.fetchedAt,
         snapshot: this.snapshot ?? void 0,
@@ -17683,9 +18011,15 @@ var FAMILY_BENCHMARKS = {
   "claude-opus": { code: 95, analysis: 92, creative: 90, data: 88 },
   "claude-sonnet": { code: 93, analysis: 88, creative: 87, data: 85 },
   "claude-haiku": { code: 80, analysis: 75, creative: 76, data: 72 },
-  // OpenAI GPT-5 family — current flagship; strongest all-round. Offline
-  // baseline (the live fetch refreshes these). Distinct point releases carry
-  // their own scores: gpt-5.5 "Spud" leads SWE-bench (88.7%); gpt-5.4 ~80%.
+  // OpenAI GPT-5 family. GPT-5.6 is split by durable capability tier instead
+  // of being folded into generic gpt-5: Sol, Terra and Luna have materially
+  // different benchmark/cost envelopes and should compete independently.
+  // Scores are the committed normalized snapshot; provenance is in
+  // scripts/benchmarks/sources/openai-gpt-5.6-2026-08.json.
+  "gpt-5.6-sol": { code: 100, analysis: 98, creative: 88, data: 88 },
+  "gpt-5.6-terra": { code: 97, analysis: 92, creative: 82, data: 85 },
+  "gpt-5.6-luna": { code: 93, analysis: 85, creative: 74, data: 60 },
+  // Older GPT-5 point releases remain distinct where public data supports it.
   "gpt-5.5": { code: 97, analysis: 96, creative: 94, data: 95 },
   "gpt-5.4": { code: 94, analysis: 94, creative: 92, data: 92 },
   "gpt-5.4-mini": { code: 86, analysis: 85, creative: 85, data: 83 },
@@ -17721,13 +18055,19 @@ var FAMILY_BENCHMARKS = {
   "llama-small": { code: 55, analysis: 56, creative: 60, data: 54 }
 };
 var FAMILY_MATCHERS = [
+  [/fable/i, "claude-opus"],
   [/opus/i, "claude-opus"],
   [/sonnet/i, "claude-sonnet"],
   [/haiku/i, "claude-haiku"],
-  // GPT-5 family — ordered most-specific first. Distinct point releases
-  // (gpt-5.5, gpt-5.4, gpt-5.4-mini) match their own family; nano/mini before
-  // the base; unrecognised gpt-5.x still fold into the gpt-5 base.
+  // GPT-5 family — ordered most-specific first. GPT-5.6 durable tiers carry
+  // their own profiles. 5.4 Nano intentionally maps to the nano class rather
+  // than being swallowed by the generic 5.4 rule.
+  [/gpt-?5\.6.*sol/i, "gpt-5.6-sol"],
+  [/gpt-?5\.6.*terra/i, "gpt-5.6-terra"],
+  [/gpt-?5\.6.*luna/i, "gpt-5.6-luna"],
+  [/gpt-?5\.6(?:\s|$)/i, "gpt-5.6-sol"],
   [/gpt-?5\.5/i, "gpt-5.5"],
+  [/gpt-?5\.4.*nano/i, "gpt-5-nano"],
   [/gpt-?5\.4.*mini/i, "gpt-5.4-mini"],
   [/gpt-?5\.4/i, "gpt-5.4"],
   [/gpt-?5.*nano/i, "gpt-5-nano"],
@@ -20786,8 +21126,8 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : "") + textToolSuffix,
         // Media generation can run for a minute; without this a cancelled run
         // still pays for an image nobody will see.
         ...this.signal ? { signal: this.signal } : {},
-        saveSnapshot: async (path29, content) => {
-          this.store?.addFileSnapshot(this.taskId, path29, content);
+        saveSnapshot: async (path30, content) => {
+          this.store?.addFileSnapshot(this.taskId, path30, content);
         },
         sendPeerSync: (to, syncType, content) => {
           this.peerBus?.send(this.id, to, syncType, this.assignment?.subtaskId ?? "", content);
@@ -20990,7 +21330,7 @@ ${assignment.expectedOutput}`;
     const { promisify: promisify4 } = await import('util');
     const execFileAsync3 = promisify4(execFile4);
     for (const artifactPath of artifactPaths) {
-      const absolutePath = path27.resolve(this.artifactRoot(), artifactPath);
+      const absolutePath = path28.resolve(this.artifactRoot(), artifactPath);
       try {
         const stat = await fs11.stat(absolutePath);
         if (!stat.isFile()) {
@@ -21025,7 +21365,7 @@ ${assignment.expectedOutput}`;
           issues.push(`PDF artifact looks too small to be valid: ${artifactPath}`);
           continue;
         }
-        const ext = path27.extname(absolutePath).toLowerCase();
+        const ext = path28.extname(absolutePath).toLowerCase();
         const check = ext === ".ts" || ext === ".tsx" ? { cmd: "npx", args: ["tsc", "--noEmit", absolutePath] } : ext === ".js" || ext === ".jsx" ? { cmd: process.execPath, args: ["--check", absolutePath] } : ext === ".py" ? { cmd: "python", args: ["-m", "py_compile", absolutePath] } : null;
         if (check) {
           try {
@@ -21117,7 +21457,7 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
   async checkAcceptance(assignment) {
     const criteria = assignment.acceptance ?? [];
     if (!criteria.length) return [];
-    const resolve2 = (target) => path27.resolve(this.artifactRoot(), target);
+    const resolve2 = (target) => path28.resolve(this.artifactRoot(), target);
     const workerCanWriteFiles = canProduceFiles(this.tools.map((t) => t.name));
     return evaluateAcceptance(criteria, assignment.files ?? [], {
       stat: async (target) => {
@@ -24421,16 +24761,16 @@ function resolveInWorkspace(workspaceRoot, input) {
   if (typeof input !== "string" || input.length === 0) {
     throw new WorkspaceSandboxError(String(input), workspaceRoot);
   }
-  const root = path27.resolve(workspaceRoot);
-  const abs = path27.isAbsolute(input) ? path27.resolve(input) : path27.resolve(root, input);
-  const rel = path27.relative(root, abs);
-  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path27.isAbsolute(rel)) {
+  const root = path28.resolve(workspaceRoot);
+  const abs = path28.isAbsolute(input) ? path28.resolve(input) : path28.resolve(root, input);
+  const rel = path28.relative(root, abs);
+  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path28.isAbsolute(rel)) {
     throw new WorkspaceSandboxError(input, root);
   }
   try {
-    const real = fs26.realpathSync(abs);
-    const realRel = path27.relative(root, real);
-    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path27.isAbsolute(realRel))) {
+    const real = fs27.realpathSync(abs);
+    const realRel = path28.relative(root, real);
+    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path28.isAbsolute(realRel))) {
       throw new WorkspaceSandboxError(input, root);
     }
   } catch (e) {
@@ -24979,9 +25319,9 @@ async function animatePptx(bytes, scheme) {
     const zip = await import_jszip.default.loadAsync(bytes);
     const slidePaths = Object.keys(zip.files).filter((n) => /^ppt\/slides\/slide\d+\.xml$/.test(n));
     if (slidePaths.length === 0) return bytes;
-    for (const path29 of slidePaths) {
-      const xml = await zip.file(path29).async("string");
-      zip.file(path29, animateSlideXml(xml, scheme));
+    for (const path30 of slidePaths) {
+      const xml = await zip.file(path30).async("string");
+      zip.file(path30, animateSlideXml(xml, scheme));
     }
     return await zip.generateAsync({ type: "uint8array", compression: "DEFLATE" });
   } catch {
@@ -25367,7 +25707,7 @@ var GenerateDocumentTool = class extends BaseTool {
       }
     }
     const bytes = await renderDocument(ext, content, { name: filePath, loadImageBytes });
-    await fs11.mkdir(path27.dirname(absPath), { recursive: true });
+    await fs11.mkdir(path28.dirname(absPath), { recursive: true });
     await fs11.writeFile(absPath, bytes);
     const charts = countCharts(content);
     return [
@@ -25585,7 +25925,7 @@ var FileWriteTool = class extends BaseTool {
       } catch {
       }
     }
-    await fs11.mkdir(path27.dirname(absPath), { recursive: true });
+    await fs11.mkdir(path28.dirname(absPath), { recursive: true });
     await fs11.writeFile(absPath, content, "utf-8");
     return `Written ${content.length} characters to ${filePath}`;
   }
@@ -25943,12 +26283,10 @@ ${data.description}`;
     }
   }
 };
-
-// src/tools/browser.ts
 var BROWSER_LAUNCH_TIMEOUT_MS = 15e3;
 var BrowserTool = class extends BaseTool {
   name = "browser";
-  description = "Control a browser: navigate to URLs, click elements, fill forms, take screenshots. Only available with multimodal models.";
+  description = "Control a browser: navigate to URLs, click elements, fill forms, take screenshots. Screenshots are saved to a file for image_analyze to read.";
   inputSchema = {
     type: "object",
     properties: {
@@ -26015,7 +26353,14 @@ var BrowserTool = class extends BaseTool {
         }
         case "screenshot": {
           const buf = await page2.screenshot({ type: "png" });
-          return `data:image/png;base64,${buf.toString("base64")}`;
+          const rel = path28.join(".cascade", "screenshots", `screenshot-${Date.now()}-${randomUUID().slice(0, 8)}.png`);
+          const abs = resolveInWorkspace(this.workspaceRoot, rel);
+          await fs11.mkdir(path28.dirname(abs), { recursive: true });
+          await fs11.writeFile(abs, buf);
+          return [
+            `Screenshot saved to ${abs} (${Math.round(buf.byteLength / 1024)} KB).`,
+            `Call image_analyze with that path to see what is on it \u2014 that needs a vision-capable model.`
+          ].join(" ");
         }
         case "evaluate": {
           const result = await page2.evaluate(input["script"]);
@@ -26083,7 +26428,7 @@ var ImageAnalyzeTool = class extends BaseTool {
 };
 async function fileToImageAttachment(filePath) {
   const data = await fs11.readFile(filePath);
-  const ext = path27.extname(filePath).toLowerCase();
+  const ext = path28.extname(filePath).toLowerCase();
   const mimeMap = {
     ".jpg": "image/jpeg",
     ".jpeg": "image/jpeg",
@@ -26117,14 +26462,14 @@ var PDFCreateTool = class extends BaseTool {
     const filePath = input["path"];
     const content = input["content"];
     const title = input["title"];
-    const dir = path27.dirname(filePath);
-    if (!fs26.existsSync(dir)) {
-      fs26.mkdirSync(dir, { recursive: true });
+    const dir = path28.dirname(filePath);
+    if (!fs27.existsSync(dir)) {
+      fs27.mkdirSync(dir, { recursive: true });
     }
     return new Promise((resolve2, reject) => {
       try {
         const doc = new PDFDocument({ margin: 50 });
-        const stream = fs26.createWriteStream(filePath);
+        const stream = fs27.createWriteStream(filePath);
         doc.pipe(stream);
         if (title) {
           doc.info["Title"] = title;
@@ -26202,22 +26547,22 @@ var CodeInterpreterTool = class extends BaseTool {
       }
       cmdPrefix = NODE_CMD;
     }
-    const tmpDir = path27.join(this.workspaceRoot, ".cascade", "tmp");
-    if (!fs26.existsSync(tmpDir)) {
-      fs26.mkdirSync(tmpDir, { recursive: true });
+    const tmpDir = path28.join(this.workspaceRoot, ".cascade", "tmp");
+    if (!fs27.existsSync(tmpDir)) {
+      fs27.mkdirSync(tmpDir, { recursive: true });
     }
     const extension = language === "python" ? "py" : "js";
     const fileName = `intp_${randomUUID().slice(0, 8)}.${extension}`;
-    const filePath = path27.join(tmpDir, fileName);
-    fs26.writeFileSync(filePath, code, "utf-8");
+    const filePath = path28.join(tmpDir, fileName);
+    fs27.writeFileSync(filePath, code, "utf-8");
     const execArgs = [filePath, ...args];
     return new Promise((resolve2) => {
       const startMs = Date.now();
       execFile(cmdPrefix, execArgs, { cwd: this.workspaceRoot, timeout: 3e4 }, (error, stdout, stderr) => {
         const duration = Date.now() - startMs;
         try {
-          if (fs26.existsSync(filePath)) {
-            fs26.unlinkSync(filePath);
+          if (fs27.existsSync(filePath)) {
+            fs27.unlinkSync(filePath);
           }
         } catch (cleanupErr) {
           console.error(`Failed to cleanup interpreter script ${filePath}:`, cleanupErr);
@@ -26297,18 +26642,178 @@ ${formatted}`;
     return `Unknown action: ${action}`;
   }
 };
+var SsrfBlockedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SsrfBlockedError";
+  }
+};
+var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+var MAX_REDIRECTS2 = 5;
+function allowLocal() {
+  return process.env["CASCADE_ALLOW_LOCAL_FETCH"] === "1";
+}
+function isPrivateAddress(ip) {
+  const type = net.isIP(ip);
+  if (type === 4) return isPrivateIPv4(ip);
+  if (type === 6) return isPrivateIPv6(ip);
+  return true;
+}
+function isPrivateIPv4(ip) {
+  const parts = ip.split(".").map((p) => Number(p));
+  if (parts.length !== 4 || parts.some((p) => Number.isNaN(p) || p < 0 || p > 255)) return true;
+  const [a, b] = parts;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function ipv6Groups(ip) {
+  let s = ip.toLowerCase().replace(/^\[|\]$/g, "");
+  const zone = s.indexOf("%");
+  if (zone !== -1) s = s.slice(0, zone);
+  const dotted = /^(.*:)(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(s);
+  if (dotted) {
+    const o = [dotted[2], dotted[3], dotted[4], dotted[5]].map((p) => Number(p));
+    if (o.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return null;
+    s = `${dotted[1]}${(o[0] << 8 | o[1]).toString(16)}:${(o[2] << 8 | o[3]).toString(16)}`;
+  }
+  const halves = s.split("::");
+  if (halves.length > 2) return null;
+  const split = (part) => part ? part.split(":") : [];
+  const head = split(halves[0] ?? "");
+  const tail = halves.length === 2 ? split(halves[1] ?? "") : [];
+  const zeros = halves.length === 2 ? 8 - head.length - tail.length : 0;
+  if (zeros < 0) return null;
+  const groups = [...head, ...Array(zeros).fill("0"), ...tail];
+  if (groups.length !== 8) return null;
+  const out = [];
+  for (const g of groups) {
+    if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+    out.push(parseInt(g, 16));
+  }
+  return out;
+}
+function embeddedIPv4(g) {
+  const quad = (hi, lo) => `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+  const leadingZero = (n) => g.slice(0, n).every((x) => x === 0);
+  if (leadingZero(5) && g[5] === 65535) return quad(g[6], g[7]);
+  if (leadingZero(6)) return quad(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435) {
+    if (g[2] === 1) {
+      return quad(g[3], (g[4] & 255) << 8 | g[5] >> 8);
+    }
+    if (g[2] === 0 && g[3] === 0 && g[4] === 0 && g[5] === 0) return quad(g[6], g[7]);
+    return null;
+  }
+  if (g[0] === 8194) return quad(g[1], g[2]);
+  return null;
+}
+function isPrivateIPv6(ip) {
+  const g = ipv6Groups(ip);
+  if (!g) return true;
+  const v4 = embeddedIPv4(g);
+  if (v4) return isPrivateIPv4(v4);
+  if (g[0] === 100 && g[1] === 65435) return true;
+  if (g.every((x) => x === 0)) return true;
+  if (leading7Zero(g) && g[7] === 1) return true;
+  if ((g[0] & 65472) === 65152) return true;
+  if ((g[0] & 65024) === 64512) return true;
+  if ((g[0] & 65280) === 65280) return true;
+  return false;
+}
+function leading7Zero(g) {
+  return g.slice(0, 7).every((x) => x === 0);
+}
+async function assertPublicUrl(rawUrl) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new SsrfBlockedError(`Invalid URL: ${rawUrl}`);
+  }
+  if (!ALLOWED_PROTOCOLS.has(url.protocol)) {
+    throw new SsrfBlockedError(`Blocked URL scheme "${url.protocol}" \u2014 only http and https are allowed.`);
+  }
+  if (allowLocal()) return url;
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  if (net.isIP(host)) {
+    if (isPrivateAddress(host)) {
+      throw new SsrfBlockedError(`Blocked request to non-public address ${host}.`);
+    }
+    return url;
+  }
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) {
+    throw new SsrfBlockedError(`Blocked request to local hostname "${host}".`);
+  }
+  let addresses;
+  try {
+    const records = await dns2.lookup(host, { all: true });
+    addresses = records.map((r) => r.address);
+  } catch {
+    throw new SsrfBlockedError(`Could not resolve host "${host}".`);
+  }
+  if (addresses.length === 0 || addresses.some((addr) => isPrivateAddress(addr))) {
+    throw new SsrfBlockedError(`Blocked request to "${host}" \u2014 resolves to a non-public address.`);
+  }
+  return url;
+}
+var ssrfAgent = new Agent({
+  connect: {
+    lookup(hostname, options, callback) {
+      if (allowLocal()) {
+        dnsCallback.lookup(hostname, options, callback);
+        return;
+      }
+      dnsCallback.lookup(hostname, { ...options, all: true }, (err, addresses) => {
+        if (err) return callback(err, "", 0);
+        const list = Array.isArray(addresses) ? addresses : [addresses];
+        const bad = list.find((a) => isPrivateAddress(a.address));
+        if (bad) {
+          return callback(
+            new SsrfBlockedError(`Blocked connection to "${hostname}" \u2014 resolved to non-public address ${bad.address}.`),
+            "",
+            0
+          );
+        }
+        if (options.all) return callback(null, list);
+        const first = list[0];
+        return callback(null, first.address, first.family);
+      });
+    }
+  }
+});
+async function safeFetch(rawUrl, init = {}) {
+  let currentUrl = (await assertPublicUrl(rawUrl)).toString();
+  for (let i = 0; i <= MAX_REDIRECTS2; i++) {
+    const resp = await fetch(currentUrl, { ...init, redirect: "manual", dispatcher: ssrfAgent });
+    if (resp.status < 300 || resp.status >= 400) return resp;
+    const location = resp.headers.get("location");
+    if (!location) return resp;
+    const next = new URL(location, currentUrl);
+    await assertPublicUrl(next.toString());
+    currentUrl = next.toString();
+  }
+  throw new SsrfBlockedError(`Too many redirects (>${MAX_REDIRECTS2}).`);
+}
 
 // src/tools/web-search.ts
-async function searchSearXNG(query, baseUrl, maxResults) {
+async function searchSearXNG(query, baseUrl, maxResults, guardUrl = false) {
   const url = new URL("/search", baseUrl);
   url.searchParams.set("q", query);
   url.searchParams.set("format", "json");
   url.searchParams.set("categories", "general");
   url.searchParams.set("engines", "google,bing,duckduckgo");
-  const resp = await fetch(url.toString(), {
+  const init = {
     headers: { "User-Agent": "Cascade-AI/1.0 WebSearchTool" },
     signal: AbortSignal.timeout(1e4)
-  });
+  };
+  const resp = guardUrl ? await safeFetch(url.toString(), init) : await fetch(url.toString(), init);
   if (!resp.ok) {
     throw new Error(`SearXNG returned HTTP ${resp.status}`);
   }
@@ -26437,7 +26942,11 @@ var WebSearchTool = class extends BaseTool {
       searxngUrl: config.searxngUrl ?? process.env["SEARXNG_URL"],
       braveApiKey: config.braveApiKey ?? process.env["BRAVE_SEARCH_API_KEY"],
       tavilyApiKey: config.tavilyApiKey ?? process.env["TAVILY_API_KEY"],
-      maxResults: config.maxResults ?? 5
+      maxResults: config.maxResults ?? 5,
+      // Note this reads only from `config`, never from the environment: the
+      // guard tracks the trustworthiness of the URL the host passed in, and an
+      // env var says nothing about that.
+      guardSearxngUrl: config.guardSearxngUrl ?? false
     };
   }
   async execute(input, _options) {
@@ -26452,7 +26961,7 @@ var WebSearchTool = class extends BaseTool {
     let anyBackendReachable = false;
     if (this.config.searxngUrl) {
       try {
-        results = await searchSearXNG(query, this.config.searxngUrl, maxResults);
+        results = await searchSearXNG(query, this.config.searxngUrl, maxResults, this.config.guardSearxngUrl);
         anyBackendReachable = true;
         if (results.length > 0) return this.formatResults(query, results);
         errors.push("SearXNG: returned 0 results");
@@ -26529,7 +27038,7 @@ var GlobTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path27.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path28.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const matches = await glob(pattern, {
       cwd: searchPath,
       ignore: ["node_modules/**", ".git/**", "dist/**", "build/**"],
@@ -26542,7 +27051,7 @@ var GlobTool = class extends BaseTool {
     const withMtime = await Promise.all(
       matches.map(async (rel) => {
         try {
-          const stat = await fs11.stat(path27.join(searchPath, rel));
+          const stat = await fs11.stat(path28.join(searchPath, rel));
           return { rel, mtime: stat.mtimeMs };
         } catch {
           return { rel, mtime: 0 };
@@ -26591,7 +27100,7 @@ var GrepTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path27.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path28.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const globPattern = input["glob"];
     const outputMode = input["output_mode"] ?? "content";
     const context = input["context"] ?? 0;
@@ -26645,12 +27154,12 @@ var GrepTool = class extends BaseTool {
         nodir: true
       });
     } catch {
-      files = [path27.relative(searchPath, searchPath) || "."];
+      files = [path28.relative(searchPath, searchPath) || "."];
     }
     const results = [];
     let totalCount = 0;
     for (const rel of files) {
-      const abs = path27.join(searchPath, rel);
+      const abs = path28.join(searchPath, rel);
       let content;
       try {
         content = await fs11.readFile(abs, "utf-8");
@@ -26691,92 +27200,6 @@ Total: ${totalCount} matches`);
     return results.join("\n");
   }
 };
-var SsrfBlockedError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "SsrfBlockedError";
-  }
-};
-var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
-var MAX_REDIRECTS2 = 5;
-function allowLocal() {
-  return process.env["CASCADE_ALLOW_LOCAL_FETCH"] === "1";
-}
-function isPrivateAddress(ip) {
-  const type = net.isIP(ip);
-  if (type === 4) return isPrivateIPv4(ip);
-  if (type === 6) return isPrivateIPv6(ip);
-  return true;
-}
-function isPrivateIPv4(ip) {
-  const parts = ip.split(".").map((p) => Number(p));
-  if (parts.length !== 4 || parts.some((p) => Number.isNaN(p) || p < 0 || p > 255)) return true;
-  const [a, b] = parts;
-  if (a === 0) return true;
-  if (a === 10) return true;
-  if (a === 127) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true;
-  if (a >= 224) return true;
-  return false;
-}
-function isPrivateIPv6(ip) {
-  const lower = ip.toLowerCase().replace(/^\[|\]$/g, "");
-  if (lower === "::1" || lower === "::") return true;
-  if (lower.startsWith("fe80")) return true;
-  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
-  if (mapped) return isPrivateIPv4(mapped[1]);
-  return false;
-}
-async function assertPublicUrl(rawUrl) {
-  let url;
-  try {
-    url = new URL(rawUrl);
-  } catch {
-    throw new SsrfBlockedError(`Invalid URL: ${rawUrl}`);
-  }
-  if (!ALLOWED_PROTOCOLS.has(url.protocol)) {
-    throw new SsrfBlockedError(`Blocked URL scheme "${url.protocol}" \u2014 only http and https are allowed.`);
-  }
-  if (allowLocal()) return url;
-  const host = url.hostname.replace(/^\[|\]$/g, "");
-  if (net.isIP(host)) {
-    if (isPrivateAddress(host)) {
-      throw new SsrfBlockedError(`Blocked request to non-public address ${host}.`);
-    }
-    return url;
-  }
-  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) {
-    throw new SsrfBlockedError(`Blocked request to local hostname "${host}".`);
-  }
-  let addresses;
-  try {
-    const records = await dns2.lookup(host, { all: true });
-    addresses = records.map((r) => r.address);
-  } catch {
-    throw new SsrfBlockedError(`Could not resolve host "${host}".`);
-  }
-  if (addresses.length === 0 || addresses.some((addr) => isPrivateAddress(addr))) {
-    throw new SsrfBlockedError(`Blocked request to "${host}" \u2014 resolves to a non-public address.`);
-  }
-  return url;
-}
-async function safeFetch(rawUrl, init = {}) {
-  let currentUrl = (await assertPublicUrl(rawUrl)).toString();
-  for (let i = 0; i <= MAX_REDIRECTS2; i++) {
-    const resp = await fetch(currentUrl, { ...init, redirect: "manual" });
-    if (resp.status < 300 || resp.status >= 400) return resp;
-    const location = resp.headers.get("location");
-    if (!location) return resp;
-    const next = new URL(location, currentUrl);
-    await assertPublicUrl(next.toString());
-    currentUrl = next.toString();
-  }
-  throw new SsrfBlockedError(`Too many redirects (>${MAX_REDIRECTS2}).`);
-}
 
 // src/tools/web-fetch.ts
 var MAX_CHARS = 5e4;
@@ -27049,10 +27472,10 @@ var ToolRegistry = class extends EventEmitter {
   }
   isIgnored(filePath) {
     if (!filePath) return false;
-    const abs = path27.resolve(this.workspaceRoot, filePath);
-    const rel = path27.relative(this.workspaceRoot, abs);
-    if (!rel || rel.startsWith("..") || path27.isAbsolute(rel)) return true;
-    const posixRel = rel.split(path27.sep).join("/");
+    const abs = path28.resolve(this.workspaceRoot, filePath);
+    const rel = path28.relative(this.workspaceRoot, abs);
+    if (!rel || rel.startsWith("..") || path28.isAbsolute(rel)) return true;
+    const posixRel = rel.split(path28.sep).join("/");
     return this.ignoreMatcher.ignores(posixRel);
   }
 };
@@ -27286,22 +27709,22 @@ var FileMcpOAuthStore = class {
   filePath;
   load() {
     try {
-      return JSON.parse(fs26.readFileSync(this.filePath, "utf-8"));
+      return JSON.parse(fs27.readFileSync(this.filePath, "utf-8"));
     } catch {
       return void 0;
     }
   }
   save(state) {
-    fs26.mkdirSync(path27.dirname(this.filePath), { recursive: true, mode: 448 });
-    fs26.writeFileSync(this.filePath, JSON.stringify(state, null, 2), { mode: 384 });
+    fs27.mkdirSync(path28.dirname(this.filePath), { recursive: true, mode: 448 });
+    fs27.writeFileSync(this.filePath, JSON.stringify(state, null, 2), { mode: 384 });
     try {
-      fs26.chmodSync(this.filePath, 384);
+      fs27.chmodSync(this.filePath, 384);
     } catch {
     }
   }
   clear() {
     try {
-      fs26.rmSync(this.filePath);
+      fs27.rmSync(this.filePath);
     } catch {
     }
   }
@@ -28139,7 +28562,7 @@ var TaskAnalyzer = class {
     analysisCache.clear();
   }
 };
-var DEFAULT_STATS_FILE = path27.join(os6.homedir(), ".cascade", "model-perf.json");
+var DEFAULT_STATS_FILE = path28.join(os6.homedir(), ".cascade", "model-perf.json");
 var ModelPerformanceTracker = class _ModelPerformanceTracker {
   stats = /* @__PURE__ */ new Map();
   featureStats = /* @__PURE__ */ new Map();
@@ -28179,7 +28602,7 @@ var ModelPerformanceTracker = class _ModelPerformanceTracker {
   async save() {
     if (this.readOnly) return;
     try {
-      await fs11.mkdir(path27.dirname(this.statsFile), { recursive: true });
+      await fs11.mkdir(path28.dirname(this.statsFile), { recursive: true });
       const modelsObj = {};
       const featuresObj = {};
       for (const [key, stat] of this.stats) modelsObj[key] = stat;
@@ -28812,7 +29235,7 @@ Required capability: ${description.slice(0, 300)}`;
    *  any dangerous action, so a silently-reloaded tool can't act without approval. */
   async loadPersistedTools() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const file = path27.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
+    const file = path28.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
     try {
       const raw = await fs11.readFile(file, "utf-8");
       const specs = JSON.parse(raw);
@@ -28836,8 +29259,8 @@ Required capability: ${description.slice(0, 300)}`;
   }
   async persist() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const dir = path27.join(this.workspacePath, ".cascade");
-    const file = path27.join(dir, DYNAMIC_TOOLS_FILE);
+    const dir = path28.join(this.workspacePath, ".cascade");
+    const file = path28.join(dir, DYNAMIC_TOOLS_FILE);
     try {
       await fs11.mkdir(dir, { recursive: true });
       await fs11.writeFile(file, JSON.stringify(Array.from(this.specs.values()), null, 2), "utf-8");
@@ -28857,12 +29280,12 @@ var WorldStateDB = class {
   constructor(workspacePath, debugMode = false) {
     this.workspacePath = workspacePath;
     this.debugMode = debugMode;
-    const cascadeDir = path27.join(workspacePath, ".cascade");
-    if (!fs26.existsSync(cascadeDir)) {
-      fs26.mkdirSync(cascadeDir, { recursive: true });
+    const cascadeDir = path28.join(workspacePath, ".cascade");
+    if (!fs27.existsSync(cascadeDir)) {
+      fs27.mkdirSync(cascadeDir, { recursive: true });
     }
-    this.keyPath = path27.join(cascadeDir, "world_state.key");
-    this.dbPath = path27.join(cascadeDir, "world_state.db");
+    this.keyPath = path28.join(cascadeDir, "world_state.key");
+    this.dbPath = path28.join(cascadeDir, "world_state.db");
     this.initEncryptionKey();
     this.db = new Database2(this.dbPath);
     this.db.pragma("journal_mode = WAL");
@@ -28919,11 +29342,11 @@ var WorldStateDB = class {
     ).run(e, r, row.encrypted_value, row.source_worker, row.timestamp, validTo, change);
   }
   initEncryptionKey() {
-    if (fs26.existsSync(this.keyPath)) {
-      this.encryptionKey = fs26.readFileSync(this.keyPath);
+    if (fs27.existsSync(this.keyPath)) {
+      this.encryptionKey = fs27.readFileSync(this.keyPath);
     } else {
       this.encryptionKey = crypto.randomBytes(32);
-      fs26.writeFileSync(this.keyPath, this.encryptionKey);
+      fs27.writeFileSync(this.keyPath, this.encryptionKey);
     }
   }
   encrypt(text) {
@@ -29209,9 +29632,9 @@ var WorldStateDB = class {
   dumpDebugIfNeeded() {
     if (!this.debugMode) return;
     try {
-      const dumpPath = path27.join(os6.tmpdir(), "cascade_world_state_debug.json");
+      const dumpPath = path28.join(os6.tmpdir(), "cascade_world_state_debug.json");
       const entries = this.getAllEntries();
-      fs26.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+      fs27.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
     } catch (err) {
       console.error("Failed to dump debug world state", err);
     }
@@ -29268,7 +29691,7 @@ var ResumeStore = class {
         createdAt: checkpoint.createdAt ?? new Date(timestamp).toISOString()
       };
       await promises.mkdir(this.dir, { recursive: true });
-      const finalPath = path27.join(this.dir, `${timestamp}-${safeId(record.taskId)}.json`);
+      const finalPath = path28.join(this.dir, `${timestamp}-${safeId(record.taskId)}.json`);
       const tempPath = `${finalPath}.${process.pid}.tmp`;
       await promises.writeFile(tempPath, JSON.stringify(record, null, 2), "utf-8");
       await promises.rename(tempPath, finalPath);
@@ -29291,7 +29714,7 @@ var ResumeStore = class {
     const checkpoints = [];
     for (const candidate of candidates) {
       try {
-        const raw = await promises.readFile(path27.join(this.dir, candidate.name), "utf-8");
+        const raw = await promises.readFile(path28.join(this.dir, candidate.name), "utf-8");
         const parsed = JSON.parse(raw);
         if (isCheckpoint(parsed)) checkpoints.push(parsed);
       } catch {
@@ -29330,7 +29753,7 @@ var ResumeStore = class {
       const source = entries.find((name) => FILE_PATTERN.exec(name)?.[2] === wanted);
       if (!source) return null;
       const claimId = `${this.now()}-${safeId(target.taskId)}`;
-      await promises.rename(path27.join(this.dir, source), path27.join(this.dir, `${claimId}${CLAIM_SUFFIX}`));
+      await promises.rename(path28.join(this.dir, source), path28.join(this.dir, `${claimId}${CLAIM_SUFFIX}`));
       return { checkpoint: target, claimId };
     } catch {
       return null;
@@ -29340,8 +29763,8 @@ var ResumeStore = class {
   async release(claimId) {
     try {
       await promises.rename(
-        path27.join(this.dir, `${claimId}${CLAIM_SUFFIX}`),
-        path27.join(this.dir, `${claimId}.json`)
+        path28.join(this.dir, `${claimId}${CLAIM_SUFFIX}`),
+        path28.join(this.dir, `${claimId}.json`)
       );
     } catch {
     }
@@ -29349,7 +29772,7 @@ var ResumeStore = class {
   /** Discard a claim for good — the resumed run has taken ownership. */
   async settle(claimId) {
     try {
-      await promises.rm(path27.join(this.dir, `${claimId}${CLAIM_SUFFIX}`), { force: true });
+      await promises.rm(path28.join(this.dir, `${claimId}${CLAIM_SUFFIX}`), { force: true });
     } catch {
     }
   }
@@ -29378,8 +29801,8 @@ var ResumeStore = class {
         const stamp2 = Number(/^(\d+)-/.exec(name)?.[1]);
         if (!Number.isFinite(stamp2) || stamp2 >= cutoff) continue;
         await promises.rename(
-          path27.join(this.dir, name),
-          path27.join(this.dir, `${name.slice(0, -CLAIM_SUFFIX.length)}.json`)
+          path28.join(this.dir, name),
+          path28.join(this.dir, `${name.slice(0, -CLAIM_SUFFIX.length)}.json`)
         );
         reclaimed++;
       }
@@ -29395,7 +29818,7 @@ var ResumeStore = class {
       await Promise.all(entries.map(async (name) => {
         const match = FILE_PATTERN.exec(name);
         if (match?.[2] === wanted) {
-          await promises.rm(path27.join(this.dir, name), { force: true });
+          await promises.rm(path28.join(this.dir, name), { force: true });
         }
       }));
     } catch {
@@ -29410,7 +29833,7 @@ var ResumeStore = class {
       const doomed = files.filter((f, index) => f.timestamp < cutoff || index >= this.maxCheckpoints);
       const staleTemps = entries.filter((name) => name.endsWith(".tmp")).filter((name) => (Number(FILE_PATTERN.exec(name.replace(/\.\d+\.tmp$/, ".json"))?.[1]) || 0) < cutoff);
       await Promise.all([...doomed.map((f) => f.name), ...staleTemps].map(
-        (name) => promises.rm(path27.join(this.dir, name), { force: true })
+        (name) => promises.rm(path28.join(this.dir, name), { force: true })
       ));
     } catch {
     }
@@ -29787,7 +30210,7 @@ var WorkspaceIndex = class {
   isIgnored;
   chunker;
   constructor(opts) {
-    this.root = path27.resolve(opts.root);
+    this.root = path28.resolve(opts.root);
     this.db = opts.db;
     this.namespace = opts.namespace ?? "code";
     this.extensions = new Set((opts.extensions ?? DEFAULT_EXTENSIONS).map((e) => e.replace(/^\./, "").toLowerCase()));
@@ -29819,14 +30242,14 @@ var WorkspaceIndex = class {
         return;
       }
       for (const entry of entries) {
-        const abs = path27.join(dir, entry.name);
+        const abs = path28.join(dir, entry.name);
         if (entry.isDirectory()) {
           if (HARD_SKIP_DIRS.has(entry.name) || this.isIgnored(abs)) continue;
           await walk(abs);
         } else if (entry.isFile()) {
-          const ext = path27.extname(entry.name).slice(1).toLowerCase();
+          const ext = path28.extname(entry.name).slice(1).toLowerCase();
           if (!this.extensions.has(ext) || this.isIgnored(abs)) continue;
-          out.push(path27.relative(this.root, abs));
+          out.push(path28.relative(this.root, abs));
         }
       }
     };
@@ -29856,7 +30279,7 @@ var WorkspaceIndex = class {
     const entries = [];
     for (const rel of rels) {
       try {
-        const abs = path27.join(this.root, rel);
+        const abs = path28.join(this.root, rel);
         const stat = await fs11.stat(abs);
         if (stat.size > this.maxFileBytes) continue;
         const buf = await fs11.readFile(abs);
@@ -30346,13 +30769,13 @@ var Cascade = class _Cascade extends EventEmitter {
     this.toolRegistry = new ToolRegistry(this.config.tools, workspacePath);
     try {
       this.router.setDeadModelStore(new DeadModelStore(
-        fileDeadModelPersistence(path27.join(workspacePath, ".cascade", "dead-models.json"))
+        fileDeadModelPersistence(path28.join(workspacePath, ".cascade", "dead-models.json"))
       ));
     } catch {
     }
     try {
       this.resumeStore = new ResumeStore({
-        dir: path27.join(workspacePath, ".cascade", "resume")
+        dir: path28.join(workspacePath, ".cascade", "resume")
       });
     } catch {
     }
@@ -30440,8 +30863,8 @@ var Cascade = class _Cascade extends EventEmitter {
       this.emit("log", { level: "warn", message: "Code index enabled but no embeddings-capable provider is configured \u2014 skipping." });
       return;
     }
-    const dbPath = ci.dbPath || path27.join(this.workspacePath, ".cascade", "code-index.db");
-    fs26.mkdirSync(path27.dirname(dbPath), { recursive: true });
+    const dbPath = ci.dbPath || path28.join(this.workspacePath, ".cascade", "code-index.db");
+    fs27.mkdirSync(path28.dirname(dbPath), { recursive: true });
     const db = new Database2(dbPath);
     db.pragma("journal_mode = WAL");
     const complete = chatCompleterFromProviders(this.config.providers);
@@ -32215,8 +32638,8 @@ function replaceInPlace(target, source) {
 }
 function writeConfigFile(configPath, config) {
   try {
-    fs26.mkdirSync(path27.dirname(configPath), { recursive: true });
-    fs26.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
+    fs27.mkdirSync(path28.dirname(configPath), { recursive: true });
+    fs27.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
     return { ok: true };
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
@@ -32626,7 +33049,7 @@ function aggregateCostStats(sessions, opts = {}) {
 }
 
 // src/dashboard/server.ts
-var __dirname$1 = path27.dirname(fileURLToPath(import.meta.url));
+var __dirname$1 = path28.dirname(fileURLToPath(import.meta.url));
 var ORPHANED_ESCALATION_GRACE_MS = 3e4;
 var MASK = "***";
 function masked(key, value) {
@@ -32945,7 +33368,7 @@ var DashboardServer = class {
    * silently and still typecheck.
    */
   persistConfig(config) {
-    const result = writeConfigFile(path27.join(this.workspacePath, CASCADE_CONFIG_FILE), config);
+    const result = writeConfigFile(path28.join(this.workspacePath, CASCADE_CONFIG_FILE), config);
     if (!result.ok) console.warn(`[dashboard] Failed to persist config: ${result.error}`);
     return result;
   }
@@ -32964,7 +33387,7 @@ var DashboardServer = class {
    */
   syncGlobalCredentials() {
     try {
-      saveGlobalCredentials(path27.join(os6.homedir(), GLOBAL_CONFIG_DIR), this.config.providers ?? []);
+      saveGlobalCredentials(path28.join(os6.homedir(), GLOBAL_CONFIG_DIR), this.config.providers ?? []);
     } catch (err) {
       console.warn(`[dashboard] Failed to sync global credentials: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -32979,15 +33402,15 @@ var DashboardServer = class {
   resolveDashboardSecret() {
     const fromConfig = this.config.dashboard.secret ?? process.env["CASCADE_DASHBOARD_SECRET"];
     if (fromConfig) return fromConfig;
-    const secretPath = path27.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
+    const secretPath = path28.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
     try {
-      if (fs26.existsSync(secretPath)) {
-        const existing = fs26.readFileSync(secretPath, "utf-8").trim();
+      if (fs27.existsSync(secretPath)) {
+        const existing = fs27.readFileSync(secretPath, "utf-8").trim();
         if (existing.length >= 16) return existing;
       }
       const generated = randomUUID();
-      fs26.mkdirSync(path27.dirname(secretPath), { recursive: true });
-      fs26.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
+      fs27.mkdirSync(path28.dirname(secretPath), { recursive: true });
+      fs27.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
       if (this.config.dashboard.auth) {
         console.warn(
           `Dashboard auth enabled with no secret configured; persisted a generated secret to ${secretPath}. Set CASCADE_DASHBOARD_SECRET or config.dashboard.secret to override.`
@@ -33014,7 +33437,7 @@ var DashboardServer = class {
   // ── Setup ─────────────────────────────────────
   getGlobalStore() {
     if (!this.globalStore) {
-      const globalDbPath = path27.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path28.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       this.globalStore = new MemoryStore(globalDbPath);
     }
     return this.globalStore;
@@ -33394,12 +33817,12 @@ ${prompt}`;
     }
   }
   watchRuntimeChanges() {
-    const workspaceDbPath = path27.join(this.workspacePath, CASCADE_DB_FILE);
-    const globalDbPath = path27.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+    const workspaceDbPath = path28.join(this.workspacePath, CASCADE_DB_FILE);
+    const globalDbPath = path28.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
     const watchPaths = [workspaceDbPath, globalDbPath].filter((p, index, arr) => arr.indexOf(p) === index);
     for (const watchPath of watchPaths) {
-      if (!fs26.existsSync(watchPath)) continue;
-      fs26.watchFile(watchPath, { interval: 3e3 }, () => {
+      if (!fs27.existsSync(watchPath)) continue;
+      fs27.watchFile(watchPath, { interval: 3e3 }, () => {
         this.throttledBroadcast(watchPath === globalDbPath ? "global" : "workspace");
       });
     }
@@ -33521,7 +33944,7 @@ ${prompt}`;
       const sessionId = req.params.id;
       this.store.deleteSession(sessionId);
       this.store.deleteRuntimeSession(sessionId);
-      const globalDbPath = path27.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path28.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteRuntimeSession(sessionId);
@@ -33614,7 +34037,7 @@ ${prompt}`;
     });
     this.app.delete("/api/sessions", auth2, (req, res) => {
       const body = req.body;
-      const globalDbPath = path27.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path28.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       if (body?.ids && Array.isArray(body.ids) && body.ids.length > 0) {
         const globalStore = new MemoryStore(globalDbPath);
         try {
@@ -33637,7 +34060,7 @@ ${prompt}`;
     });
     this.app.delete("/api/runtime", auth2, (_req, res) => {
       this.store.deleteAllRuntimeNodes();
-      const globalDbPath = path27.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path28.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteAllRuntimeNodes();
@@ -33722,12 +34145,12 @@ ${prompt}`;
       if (body["tierLimits"]) this.config.tierLimits = { ...this.config.tierLimits, ...body["tierLimits"] };
       if (body["budget"]) this.config.budget = { ...this.config.budget, ...body["budget"] };
       try {
-        const configPath = path27.join(this.workspacePath, CASCADE_CONFIG_FILE);
-        const existing = fs26.existsSync(configPath) ? JSON.parse(fs26.readFileSync(configPath, "utf-8")) : {};
+        const configPath = path28.join(this.workspacePath, CASCADE_CONFIG_FILE);
+        const existing = fs27.existsSync(configPath) ? JSON.parse(fs27.readFileSync(configPath, "utf-8")) : {};
         const updated = { ...existing, tierLimits: this.config.tierLimits, budget: this.config.budget };
         const tmp = configPath + ".tmp";
-        fs26.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
-        fs26.renameSync(tmp, configPath);
+        fs27.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
+        fs27.renameSync(tmp, configPath);
         res.json({ ok: true });
       } catch (err) {
         res.status(500).json({ error: `Failed to save config: ${err instanceof Error ? err.message : String(err)}` });
@@ -33755,7 +34178,7 @@ ${prompt}`;
     this.app.get("/api/runtime", auth2, (req, res) => {
       const scope = req.query["scope"] ?? "workspace";
       if (scope === "global") {
-        const globalDbPath = path27.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+        const globalDbPath = path28.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
         const globalStore = new MemoryStore(globalDbPath);
         try {
           res.json({
@@ -34096,13 +34519,13 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    const prodPath = path27.resolve(__dirname$1, "../web/dist");
-    const devPath = path27.resolve(__dirname$1, "../../web/dist");
-    const webDistPath = fs26.existsSync(prodPath) ? prodPath : devPath;
-    if (fs26.existsSync(webDistPath)) {
+    const prodPath = path28.resolve(__dirname$1, "../web/dist");
+    const devPath = path28.resolve(__dirname$1, "../../web/dist");
+    const webDistPath = fs27.existsSync(prodPath) ? prodPath : devPath;
+    if (fs27.existsSync(webDistPath)) {
       this.app.use(express.static(webDistPath));
       this.app.get("*", (_req, res) => {
-        res.sendFile(path27.join(webDistPath, "index.html"));
+        res.sendFile(path28.join(webDistPath, "index.html"));
       });
     } else {
       this.app.get("/", (_req, res) => {
@@ -34289,14 +34712,14 @@ function planRetrieval(ctx) {
 }
 var CLOUD_SESSION_FILE = "cloud-session.json";
 function globalDir(homeDir = os6.homedir()) {
-  return path27.join(homeDir, GLOBAL_CONFIG_DIR);
+  return path28.join(homeDir, GLOBAL_CONFIG_DIR);
 }
 function cloudSessionPath(dir = globalDir()) {
-  return path27.join(dir, CLOUD_SESSION_FILE);
+  return path28.join(dir, CLOUD_SESSION_FILE);
 }
 function loadCloudSession(dir = globalDir()) {
   try {
-    const raw = fs26.readFileSync(cloudSessionPath(dir), "utf-8");
+    const raw = fs27.readFileSync(cloudSessionPath(dir), "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed?.refreshToken || !parsed?.serverUrl) return null;
     return parsed;
@@ -34305,17 +34728,17 @@ function loadCloudSession(dir = globalDir()) {
   }
 }
 function saveCloudSession(session, dir = globalDir()) {
-  fs26.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs27.mkdirSync(dir, { recursive: true, mode: 448 });
   const file = cloudSessionPath(dir);
-  fs26.writeFileSync(file, JSON.stringify(session, null, 2), { mode: 384 });
+  fs27.writeFileSync(file, JSON.stringify(session, null, 2), { mode: 384 });
   try {
-    fs26.chmodSync(file, 384);
+    fs27.chmodSync(file, 384);
   } catch {
   }
 }
 function clearCloudSession(dir = globalDir()) {
   try {
-    fs26.rmSync(cloudSessionPath(dir));
+    fs27.rmSync(cloudSessionPath(dir));
   } catch {
   }
 }
@@ -34487,16 +34910,16 @@ var CloudClient = class _CloudClient {
     return (await this.refresh()).accessToken;
   }
   /** Authenticated request that refreshes once on a 401 (e.g. server-side revoke). */
-  async authed(path29, init = {}) {
-    const call = (token) => fetch(this.url(path29), { ...init, headers: { ...init.headers ?? {}, Authorization: `Bearer ${token}` } });
+  async authed(path30, init = {}) {
+    const call = (token) => fetch(this.url(path30), { ...init, headers: { ...init.headers ?? {}, Authorization: `Bearer ${token}` } });
     let res = await call(await this.accessToken());
     if (res.status === 401) res = await call((await this.refresh()).accessToken);
     if (!res.ok) throw new Error(`Request failed (${res.status}).`);
     const text = await res.text();
     return text ? JSON.parse(text) : {};
   }
-  authedGet(path29) {
-    return this.authed(path29);
+  authedGet(path30) {
+    return this.authed(path30);
   }
   async fetchMe(token) {
     const res = await fetch(this.url("/api/me"), { headers: { Authorization: `Bearer ${token}` } });
@@ -34861,6 +35284,6 @@ function applySyncBundle(bundle, config, cleanup) {
   return next;
 }
 
-export { AZURE_BASE_MODELS, AZURE_BASE_URL_TEMPLATE, AuditLogger, CASCADE_AUDIT_FILE, CASCADE_CONFIG_DIR, CASCADE_CONFIG_FILE, CASCADE_DASHBOARD_SECRET_FILE, CASCADE_DB_FILE, CASCADE_IGNORE_FILE, CASCADE_KEYSTORE_FILE, CASCADE_MD_FILE, CASCADE_VERSION, CHARS_PER_TOKEN2 as CHARS_PER_TOKEN, COMPLEXITY_T2_COUNT, Cascade, CascadeCancelledError, CascadeIgnore, CascadeRouter, CascadeToolError, CloudClient, CodeSearchTool, ConfigManager, CurrentPageTool, DEFAULT_API_PORT, DEFAULT_APPROVAL_REQUIRED, DEFAULT_AUTO_SUMMARIZE_AT, DEFAULT_CLOUD_URL, DEFAULT_CONTEXT_LIMIT, DEFAULT_DASHBOARD_PORT, DEFAULT_MAX_SESSION_MESSAGES, DEFAULT_RETENTION_DAYS, DEFAULT_THEME, DOCUMENT_MIME, DashboardServer, DependencyScheduler, FileMcpOAuthStore, GLOBAL_CONFIG_DIR, GLOBAL_CREDENTIALS_FILE, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, GenerateDocumentTool, GraphRetriever, GraphSearchTool, HooksRunner, Keystore, LLMReranker, LM_STUDIO_BASE_URL, MAX_PAGE_TEXT_CHARS, MCP_TOOL_PREFIX, MODELS, McpClient, McpOAuthProvider, MemoryStore, OLLAMA_BASE_URL, OpenAICompatibleEmbedder, PROVIDER_DISPLAY_NAMES, RESUME_SCHEMA_VERSION, ResumeStore, Retriever, SqliteVectorStore, T1Administrator, T1_MODEL_PRIORITY, T2Manager, T2_MODEL_PRIORITY, T3Worker, T3_MODEL_PRIORITY, THEME_NAMES, TOOL_NAMES, TaskGraphValidationError, TaskScheduler, Telemetry, ToolRegistry, VISION_MODEL_PRIORITY, WorkspaceIndex, applyEndpointEdit, applyProviderApiKey, applyProviderCredential, applySettingsCredentials, applySettingsPayload, applySyncBundle, azureModelForDeployment, beginMcpOAuth, buildDocumentTools, buildManifest, buildSessionTranscript, bytesToBase64, cagCharBudget, chartKind, chartToTableRows, chatCompleterFromProviders, chunkCode, chunkText2 as chunkText, commitSettings, compileSectionGraph, compileSubtaskGraph, compileTaskGraph, completeMcpOAuth, connectMcpWithLoopbackOAuth, createCascade, credentialDispositionForEdit, credentialEndpointIdentity, decryptJSON as decryptSyncBlob, diffManifest, disambiguateMcpServerNames, discoverMcpAuthServer, discoverMcpTools, distillSessionFacts, embedderFromProviders, encryptJSON as encryptSyncBlob, endpointFromSettingsPayload, evaluateAcceptance, explainRefusal, extractCharts, failures, fileExt, fileOAuthProvider, gatherSyncBundle, hasDefaultEndpoint, hasProviderCredential, hasUsableProvider, hashContent, heuristicCodeChunker, inferAzureBaseModel, inlineRuns, isDocumentFormat, isMcpToolName, matchImageLine, mcpServerPrefix, mcpToolName, nodeHttpFetch, normalizeEndpoint, parseBlocks, parseChartSpec, parseDelimited, parseRankOrder, parseSlide, planRetrieval, preferIpv4Host, priorAzureRow, reciprocalRankFusion, refreshMcpToken, removeMcpServerDenials, renderDocument, renderDocx, renderPptx, renderXlsx, runCascade, sameAzureEndpoint, sameCredentialEndpoint, sameEndpoint, sessionWorthRemembering, settingsSnapshot, sniffImage, splitSlides, streamCascade, stripInline, summarizeCompleted, undecided, uniqueMcpServerName };
+export { AZURE_BASE_MODELS, AZURE_BASE_URL_TEMPLATE, AuditLogger, CASCADE_AUDIT_FILE, CASCADE_CONFIG_DIR, CASCADE_CONFIG_FILE, CASCADE_DASHBOARD_SECRET_FILE, CASCADE_DB_FILE, CASCADE_IGNORE_FILE, CASCADE_KEYSTORE_FILE, CASCADE_MD_FILE, CASCADE_VERSION, CHARS_PER_TOKEN2 as CHARS_PER_TOKEN, COMPLEXITY_T2_COUNT, Cascade, CascadeCancelledError, CascadeConfigSchema, CascadeIgnore, CascadeRouter, CascadeToolError, CloudClient, CodeSearchTool, ConfigManager, CurrentPageTool, DEFAULT_API_PORT, DEFAULT_APPROVAL_REQUIRED, DEFAULT_AUTO_SUMMARIZE_AT, DEFAULT_CLOUD_URL, DEFAULT_CONTEXT_LIMIT, DEFAULT_DASHBOARD_PORT, DEFAULT_MAX_SESSION_MESSAGES, DEFAULT_RETENTION_DAYS, DEFAULT_THEME, DOCUMENT_MIME, DashboardServer, DependencyScheduler, FileMcpOAuthStore, GLOBAL_CONFIG_DIR, GLOBAL_CREDENTIALS_FILE, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, GenerateDocumentTool, GraphRetriever, GraphSearchTool, HooksRunner, Keystore, LLMReranker, LM_STUDIO_BASE_URL, MAX_PAGE_TEXT_CHARS, MCP_TOOL_PREFIX, MODELS, McpClient, McpOAuthProvider, MemoryStore, OLLAMA_BASE_URL, OpenAICompatibleEmbedder, PROVIDER_DISPLAY_NAMES, RESUME_SCHEMA_VERSION, ResumeStore, Retriever, SqliteVectorStore, T1Administrator, T1_MODEL_PRIORITY, T2Manager, T2_MODEL_PRIORITY, T3Worker, T3_MODEL_PRIORITY, THEME_NAMES, TOOL_NAMES, TaskGraphValidationError, TaskScheduler, Telemetry, ToolRegistry, VISION_MODEL_PRIORITY, WorkspaceIndex, applyEndpointEdit, applyProviderApiKey, applyProviderCredential, applySettingsCredentials, applySettingsPayload, applySyncBundle, azureModelForDeployment, beginMcpOAuth, buildDocumentTools, buildManifest, buildSessionTranscript, bytesToBase64, cagCharBudget, chartKind, chartToTableRows, chatCompleterFromProviders, chunkCode, chunkText2 as chunkText, commitSettings, compileSectionGraph, compileSubtaskGraph, compileTaskGraph, completeMcpOAuth, connectMcpWithLoopbackOAuth, createCascade, credentialDispositionForEdit, credentialEndpointIdentity, decryptJSON as decryptSyncBlob, diffManifest, disambiguateMcpServerNames, discoverMcpAuthServer, discoverMcpTools, distillSessionFacts, embedderFromProviders, encryptJSON as encryptSyncBlob, endpointFromSettingsPayload, evaluateAcceptance, explainRefusal, extractCharts, failures, fileExt, fileOAuthProvider, gatherSyncBundle, hasDefaultEndpoint, hasProviderCredential, hasUsableProvider, hashContent, heuristicCodeChunker, inferAzureBaseModel, inlineRuns, isDocumentFormat, isMcpToolName, matchImageLine, mcpServerPrefix, mcpToolName, nodeHttpFetch, normalizeEndpoint, parseBlocks, parseChartSpec, parseDelimited, parseRankOrder, parseSlide, planRetrieval, preferIpv4Host, priorAzureRow, reciprocalRankFusion, refreshMcpToken, removeMcpServerDenials, renderDocument, renderDocx, renderPptx, renderXlsx, runCascade, sameAzureEndpoint, sameCredentialEndpoint, sameEndpoint, sessionWorthRemembering, settingsSnapshot, sniffImage, splitSlides, streamCascade, stripInline, summarizeCompleted, undecided, uniqueMcpServerName };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map