flavor-code 1.2.7 → 1.2.9

package/dist/{chunk-5RHJ3PQN.js → chunk-WGYNTR4Q.js}

@@ -12,7 +12,7 @@ import {
   redactConfig,
   setProjectMcpServerDisabled,
   updateProtectedFile
-} from "./chunk-HFR2WS6T.js";
+} from "./chunk-XFCJXRJ2.js";
 import {
   AuditLogger,
   appendUsageLog,
@@ -23,7 +23,7 @@ import {
   resolveLanguage,
   setUsageSession,
   usageLogPath
-} from "./chunk-N2S7USST.js";
+} from "./chunk-RQTYHUMK.js";
 
 // src/models/types.ts
 function modelContentText(content) {
@@ -70,11 +70,11 @@ function message(error) {
 // src/permissions/engine.ts
 import { existsSync, realpathSync } from "fs";
 import { dirname, isAbsolute, parse, relative, resolve, sep } from "path";
-var CONTROL_TOOLS = /* @__PURE__ */ new Set(["TaskPlan", "TaskUpdate", "AskUserQuestion", "TodoWrite", "TaskOutput"]);
+var CONTROL_TOOLS = /* @__PURE__ */ new Set(["TaskPlan", "TaskUpdate", "AskUserQuestion", "TodoWrite", "TaskOutput", "JobList", "JobRead", "JobWait", "JobKill", "TerminalRead", "TerminalList"]);
 var READ_TOOLS = /* @__PURE__ */ new Set(["Read", "Glob", "Grep", "Search", "List", "SkillResource", "LspFindRefs", "LspHover", "LspDiagnostics", "ListRegisteredTools"]);
 var WRITE_TOOLS = /* @__PURE__ */ new Set(["Write", "Edit", "ApplyPatch", "Copy", "Mkdir", "RegisterTool"]);
 var DESTRUCTIVE_TOOLS = /* @__PURE__ */ new Set(["Delete", "Move", "RemoveTool"]);
-var SHELL_TOOLS = /* @__PURE__ */ new Set(["Shell", "Bash", "Command", "Exec"]);
+var SHELL_TOOLS = /* @__PURE__ */ new Set(["Shell", "Bash", "Command", "Exec", "TerminalOpen", "TerminalWrite", "TerminalResize", "TerminalClose"]);
 var NETWORK_TOOLS = /* @__PURE__ */ new Set(["WebFetch", "WebSearch", "Fetch", "Network"]);
 var PATH_REQUIRED_TOOLS = /* @__PURE__ */ new Set([
   "Read",
@@ -107,18 +107,26 @@ var PermissionEngine = class {
   #lexicalWorkspace;
   #workspace;
   #mode;
+  #profile;
   constructor(options) {
     const root = resolve(options.workspace);
     this.#lexicalWorkspace = root;
     this.#workspace = existsSync(root) ? realpathSync.native(root) : root;
     this.#mode = canonicalMode(options.mode ?? "default");
+    this.#profile = options.profile ?? "standard";
   }
   get mode() {
     return this.#mode;
   }
+  get profile() {
+    return this.#profile;
+  }
   setMode(mode) {
     this.#mode = canonicalMode(mode);
   }
+  setProfile(profile) {
+    this.#profile = profile;
+  }
   decide(request) {
     if (request.tool === "Task") return request.agent === "main" ? { decision: "allow" } : { decision: "deny", reason: "Task delegation is restricted to the main agent" };
     if (CONTROL_TOOLS.has(request.tool)) return { decision: "allow" };
@@ -137,6 +145,7 @@ var PermissionEngine = class {
       }
     }
     const inside = paths.every((path) => classifyPath(this.#lexicalWorkspace, this.#workspace, path).inside);
+    if (this.#profile === "d2c") return this.#d2cDecision(request, inside);
     if (this.#mode === "plan") {
       return READ_TOOLS.has(request.tool) ? { decision: "allow" } : { decision: "deny", reason: "Plan mode is read-only" };
     }
@@ -159,6 +168,44 @@ var PermissionEngine = class {
     }
     return ask(this.#mode, `Unknown tool: ${request.tool}`);
   }
+  #d2cDecision(request, inside) {
+    if ((request.paths?.length ?? 0) > 0 && !inside) {
+      return { decision: "deny", reason: "D2C tools must remain in the workspace" };
+    }
+    if (READ_TOOLS.has(request.tool)) return { decision: "allow" };
+    if (isDeletionTool(request.tool)) {
+      return { decision: "ask", reason: "Deletion requires approval", allowAlways: false };
+    }
+    if (DESTRUCTIVE_TOOLS.has(request.tool)) {
+      return request.tool === "Move" ? { decision: "allow" } : { decision: "ask", reason: "Deletion requires approval", allowAlways: false };
+    }
+    if (WRITE_TOOLS.has(request.tool)) return { decision: "allow" };
+    if (SHELL_TOOLS.has(request.tool)) return this.#d2cShellDecision(request);
+    if (isNetworkTool(request.tool)) return { decision: "allow" };
+    return { decision: "allow" };
+  }
+  #d2cShellDecision(request) {
+    const analysis = request.args === void 0 ? analyzeCommand(request.command ?? "") : analyzeArgumentCommand(request.command ?? "", request.args);
+    const cwd = request.cwd ?? this.#workspace;
+    const cwdClassification = classifyPath(this.#lexicalWorkspace, this.#workspace, cwd);
+    if (cwdClassification.escape || !cwdClassification.inside) {
+      return { decision: "deny", reason: "D2C shell cwd must remain in the workspace" };
+    }
+    if (analysis.catastrophic) {
+      return { decision: "deny", reason: "Explicitly forbidden system-level command" };
+    }
+    if (isD2cManagedPreviewCommand(analysis.command)) {
+      return {
+        decision: "deny",
+        reason: "D2C preview lifecycle is managed by D2cCompare; pass the project directory directly instead of starting npm/Vite manually"
+      };
+    }
+    if (assessD2cCommandPaths(analysis.command, cwd, this.#workspace, this.#lexicalWorkspace) === "deny") {
+      return { decision: "deny", reason: "D2C command arguments escape the workspace" };
+    }
+    if (analysis.deletion) return { decision: "ask", reason: "Deletion requires approval", allowAlways: false };
+    return { decision: "allow" };
+  }
   #shellDecision(request) {
     const analysis = request.args === void 0 ? analyzeCommand(request.command ?? "") : analyzeArgumentCommand(request.command ?? "", request.args);
     if (request.agent === "subagent") {
@@ -201,25 +248,29 @@ function ask(mode, reason) {
 function isNetworkTool(name) {
   return NETWORK_TOOLS.has(name) || name.startsWith("mcp__");
 }
+function isDeletionTool(name) {
+  if (name === "Delete" || name === "RemoveTool") return true;
+  return /(?:^|[_-])(delete|remove|unlink|destroy)(?:[_-]|$)/i.test(name);
+}
 function analyzeArgumentCommand(executable, args) {
   const name = parse(executable.replace(/\.exe$/i, "")).name.toLowerCase();
   const command = { executable: name, args: [...args], raw: [executable, ...args].join(" ").toLowerCase() };
   if (["sh", "bash", "zsh"].includes(name)) {
     const flag = args.findIndex((arg) => arg.toLowerCase() === "-c");
-    if (flag < 0 || args[flag + 1] === void 0) return { command, destructive: false, opaque: true, wrapped: true };
+    if (flag < 0 || args[flag + 1] === void 0) return commandAnalysis(command, true, true);
     return { ...analyzeCommand(args[flag + 1]), wrapped: true };
   }
   if (name === "cmd") {
     const flag = args.findIndex((arg) => arg.toLowerCase() === "/c");
-    if (flag < 0 || args[flag + 1] === void 0) return { command, destructive: false, opaque: true, wrapped: true };
+    if (flag < 0 || args[flag + 1] === void 0) return commandAnalysis(command, true, true);
     return { ...analyzeCommand(args.slice(flag + 1).join(" ")), wrapped: true };
   }
   if (["powershell", "pwsh"].includes(name)) {
     const flag = args.findIndex((arg) => ["-command", "-c"].includes(arg.toLowerCase()));
-    if (flag < 0 || args[flag + 1] === void 0) return { command, destructive: false, opaque: true, wrapped: true };
+    if (flag < 0 || args[flag + 1] === void 0) return commandAnalysis(command, true, true);
     return { ...analyzeCommand(args.slice(flag + 1).join(" ")), wrapped: true };
   }
-  return { command, destructive: isForbiddenCommand(command), opaque: false, wrapped: false };
+  return commandAnalysis(command, false, false);
 }
 function classifyPath(lexicalWorkspace, physicalWorkspace, input) {
   const candidate = resolve(lexicalWorkspace, input);
@@ -256,33 +307,60 @@ function isWithin(root, candidate) {
   const delta = relative(root, candidate);
   return delta === "" || !delta.startsWith(`..${sep}`) && delta !== ".." && !isAbsolute(delta);
 }
+function isD2cManagedPreviewCommand(command) {
+  const executable = command.executable.replace(/\.cmd$/i, "");
+  const args = command.args.map((arg) => arg.toLowerCase());
+  if (executable === "npm") {
+    if (args[0] === "start") return true;
+    if (args[0] === "run" && ["dev", "start", "serve", "preview"].includes(args[1] ?? "")) return true;
+    if (args[0] === "exec" && args.some((arg) => arg === "vite")) return true;
+  }
+  if (["pnpm", "yarn", "bun"].includes(executable)) {
+    const script = args[0] === "run" ? args[1] : args[0];
+    if (["dev", "start", "serve", "preview"].includes(script ?? "")) return true;
+  }
+  if (executable === "npx" && args.some((arg) => arg === "vite")) return true;
+  if (executable === "vite") return true;
+  if (executable === "node" && args.some((arg) => /(?:^|[\\/])vite[\\/]bin[\\/]vite(?:\.js)?$/i.test(arg))) return true;
+  return /(?:^|[\s;&|])(?:npm(?:\.cmd)?\s+(?:run\s+)?(?:dev|start|serve|preview)|(?:pnpm|yarn|bun)(?:\.cmd)?\s+(?:run\s+)?(?:dev|start|serve|preview)|npx(?:\.cmd)?\s+(?:[^\s]+\s+)*vite|npm(?:\.cmd)?\s+exec\s+(?:--\s+)?vite|vite(?:\.cmd)?|node(?:\.exe)?\s+[^\s]*vite[\\/]bin[\\/]vite(?:\.js)?)(?:\s|$)/i.test(command.raw);
+}
+function commandAnalysis(command, opaque, wrapped) {
+  return {
+    command,
+    destructive: isForbiddenCommand(command),
+    deletion: isDeletionCommand(command),
+    catastrophic: isCatastrophicCommand(command),
+    opaque,
+    wrapped
+  };
+}
 function analyzeCommand(raw, depth = 0) {
   const command = parseCommand(raw);
-  if (depth > 4) return { command, destructive: false, opaque: true, wrapped: depth > 0 };
+  if (depth > 4) return commandAnalysis(command, true, depth > 0);
   const wrapper = command.executable;
   if (["sh", "bash", "zsh"].includes(wrapper)) {
     const flag = command.args.findIndex((arg) => arg.toLowerCase() === "-c");
-    if (flag < 0 || command.args[flag + 1] === void 0) return { command, destructive: false, opaque: true, wrapped: true };
+    if (flag < 0 || command.args[flag + 1] === void 0) return commandAnalysis(command, true, true);
     return { ...analyzeCommand(command.args.slice(flag + 1).join(" "), depth + 1), wrapped: true };
   }
   if (wrapper === "cmd") {
     const flag = command.args.findIndex((arg) => arg.toLowerCase() === "/c");
-    if (flag < 0 || command.args[flag + 1] === void 0) return { command, destructive: false, opaque: true, wrapped: true };
+    if (flag < 0 || command.args[flag + 1] === void 0) return commandAnalysis(command, true, true);
     return { ...analyzeCommand(command.args.slice(flag + 1).join(" "), depth + 1), wrapped: true };
   }
   if (["powershell", "pwsh"].includes(wrapper)) {
     const fileFlag = command.args.some((arg) => ["-file", "-f"].includes(arg.toLowerCase()));
-    if (fileFlag) return { command, destructive: false, opaque: true, wrapped: true };
+    if (fileFlag) return commandAnalysis(command, true, true);
     const flag = command.args.findIndex((arg) => ["-command", "-c"].includes(arg.toLowerCase()));
-    if (flag < 0 || command.args[flag + 1] === void 0) return { command, destructive: false, opaque: true, wrapped: true };
+    if (flag < 0 || command.args[flag + 1] === void 0) return commandAnalysis(command, true, true);
     return { ...analyzeCommand(command.args.slice(flag + 1).join(" "), depth + 1), wrapped: true };
   }
   if (wrapper === "call") {
-    if (command.args.length === 0) return { command, destructive: false, opaque: true, wrapped: true };
+    if (command.args.length === 0) return commandAnalysis(command, true, true);
     return { ...analyzeCommand(command.args.join(" "), depth + 1), wrapped: true };
   }
   const opaque = ["start", "for", "if"].includes(wrapper) || /[%!()]/.test(command.raw);
-  return { command, destructive: isForbiddenCommand(command), opaque, wrapped: depth > 0 };
+  return commandAnalysis(command, opaque, depth > 0);
 }
 function parseCommand(raw) {
   const tokens = raw.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g)?.map((token) => token.replace(/^(?:"(.*)"|'(.*)')$/, "$1$2")) ?? [];
@@ -290,15 +368,26 @@ function parseCommand(raw) {
   return { executable: parse(executable).name.toLowerCase(), args: tokens, raw: raw.toLowerCase() };
 }
 function isForbiddenCommand(command) {
+  return isCatastrophicCommand(command) || /(^|\s)(git\s+reset\s+--hard|git\s+clean\s+-[^\s]*f)/.test(command.raw);
+}
+function isCatastrophicCommand(command) {
   if (["shutdown", "reboot", "halt", "mkfs", "diskpart", "format"].includes(command.executable)) return true;
+  if (/(^|[;&|]\s*)(shutdown|reboot|halt|mkfs|diskpart|format)(?:\.exe)?(?:\s|$)/i.test(command.raw)) return true;
   if (command.executable === "rm" && isDestructiveRm(command.args)) return true;
   for (const match of command.raw.matchAll(/\brm(?:\.exe)?\s+([^;&|]+)/gi)) {
     const nested = parseCommand(`rm ${match[1] ?? ""}`);
     if (isDestructiveRm(nested.args)) return true;
   }
-  if (command.executable === "remove-item" && command.args.some((arg) => /^-(recurse|r)$/i.test(arg)) && command.args.some(isFilesystemRoot)) return true;
-  if (command.executable === "dd" && command.args.some((arg) => /^of=\/dev\//i.test(arg))) return true;
-  return /(^|\s)(git\s+reset\s+--hard|git\s+clean\s+-[^\s]*f)/.test(command.raw);
+  if (/\b(remove-item|ri)\b/i.test(command.raw)) {
+    const recursive = /\s-(recurse|r)(?:\s|$)/i.test(command.raw);
+    const root = command.args.some(isFilesystemRoot) || /\s(?:[a-z]:[\\/]?|\/)(?:\s|$)/i.test(command.raw);
+    if (recursive && root) return true;
+  }
+  return command.executable === "dd" && command.args.some((arg) => /^of=\/dev\//i.test(arg));
+}
+function isDeletionCommand(command) {
+  if (["rm", "rmdir", "unlink", "del", "erase", "remove-item", "ri"].includes(command.executable)) return true;
+  return /(^|[;&|]\s*)(rm|rmdir|unlink|del|erase|remove-item|ri)(?:\.exe)?(?:\s|$)/i.test(command.raw) || /(^|\s)git\s+(rm|clean)(?:\s|$)/i.test(command.raw) || /(^|\s)git\s+reset\s+--hard(?:\s|$)/i.test(command.raw) || /(^|\s)find\s+[^;&|]*(?:-delete|-exec\s+rm)(?:\s|$)/i.test(command.raw);
 }
 function isDestructiveRm(args) {
   const shortFlags = args.filter((arg) => /^-[^-]/.test(arg)).join("").toLowerCase();
@@ -387,6 +476,16 @@ function assessArgumentPath(value, cwd, lexicalWorkspace, physicalWorkspace) {
 function looksLikePath(value) {
   return isAbsolute(value) || value === "." || value === ".." || value.startsWith("./") || value.startsWith(".\\") || value.startsWith("../") || value.startsWith("..\\") || value.includes("/") || value.includes("\\");
 }
+function assessD2cCommandPaths(command, cwd, workspace, lexicalWorkspace) {
+  for (const raw of command.args) {
+    const value = raw.includes("=") ? raw.slice(raw.indexOf("=") + 1) : raw;
+    if (process.platform === "win32" && /^\/[a-z?]+$/i.test(value)) continue;
+    if (!(isAbsolute(value) || value === ".." || value.startsWith("../") || value.startsWith("..\\"))) continue;
+    const classification = classifyPath(lexicalWorkspace, workspace, resolve(cwd, value));
+    if (classification.escape || !classification.inside) return "deny";
+  }
+  return "allow";
+}
 
 // src/utils/redact.ts
 function redactErrorText(text) {
@@ -996,22 +1095,32 @@ function transcriptReducer(state, action) {
     state: "running",
     text: `${event.name}${event.label ? ` ${event.label}` : ""}`,
     ...event.hint === void 0 ? {} : { hint: event.hint },
+    ...event.presentation === void 0 ? {} : { presentation: event.presentation },
     tool: { name: event.name, input: event.input }
   });
   if (event.type === "tool-end") {
     const cancelled = !event.result.ok && event.result.error?.code === "cancelled";
     const previous = state.active.blocks.find((block) => block.kind === "status" && block.id === `tool:${event.id}`);
     const input = previous?.kind === "status" && previous.tool !== void 0 ? previous.tool.input : null;
+    const presentation = event.result.ok ? event.result.presentation ?? (previous?.kind === "status" ? previous.presentation : void 0) : void 0;
     return upsertStatus(state, {
       kind: "status",
       id: `tool:${event.id}`,
       state: event.result.ok ? "completed" : cancelled ? "cancelled" : "failed",
       text: `${event.result.ok ? "\u2713" : "\xD7"} ${event.name}${event.label ? ` ${event.label}` : ""}`,
       ...event.hint === void 0 ? {} : { hint: event.hint },
-      ...event.result.ok && event.result.presentation !== void 0 ? { presentation: event.result.presentation } : {},
+      ...presentation === void 0 ? {} : { presentation },
       tool: { name: event.name, input, result: event.result }
     });
   }
+  if (event.type === "deliverables") return upsertStatus(state, {
+    kind: "status",
+    id: `deliverables:${state.active.id}`,
+    state: "completed",
+    text: `Changed ${event.files.length} file${event.files.length === 1 ? "" : "s"}`,
+    details: event.files.map((file) => `${file.operation} ${file.path} (+${file.added} -${file.removed})`).join("\n"),
+    presentation: { kind: "changeset", files: event.files }
+  });
   if (event.type === "notice") return upsertStatus(state, {
     kind: "status",
     id: `notice:${state.active.blocks.length}`,
@@ -1114,12 +1223,12 @@ function hydrateHistory(messages, compact) {
 function transcriptFromLegacyConversation(messages, compact) {
   return hydrateHistory(messages, compact);
 }
-function applyTaskSnapshot(turn, snapshot2, includeTerminal = true) {
+function applyTaskSnapshot(turn, snapshot4, includeTerminal = true) {
   const taskBlocks = [];
   const previous = new Map(turn.blocks.filter((block) => block.kind === "status").map((block) => [block.id, block]));
   const now = Date.now();
   const suppressed = new Set(turn.suppressedTaskIds ?? []);
-  for (const task of snapshot2.plan?.tasks ?? []) {
+  for (const task of snapshot4.plan?.tasks ?? []) {
     const id = `task:${task.id}`;
     const terminal = ["completed", "failed", "blocked", "cancelled"].includes(task.status);
     if (!terminal) suppressed.delete(id);
@@ -1139,16 +1248,16 @@ function applyTaskSnapshot(turn, snapshot2, includeTerminal = true) {
       ...elapsedMs === void 0 ? {} : { elapsedMs }
     });
   }
-  for (const node of snapshot2.subagents.graph?.nodes ?? []) {
-    const status = snapshot2.subagents.states[node.id] ?? "pending";
+  for (const node of snapshot4.subagents.graph?.nodes ?? []) {
+    const status = snapshot4.subagents.states[node.id] ?? "pending";
     const id = `subagent:${node.id}`;
     const terminal = ["completed", "failed", "blocked", "cancelled"].includes(status);
     if (!terminal) suppressed.delete(id);
     if ((!includeTerminal || suppressed.has(id)) && terminal) continue;
     const state = status === "running" ? "running" : status === "completed" ? "completed" : status === "cancelled" ? "cancelled" : status === "failed" || status === "blocked" ? "failed" : "info";
     const prior = previous.get(id);
-    const snapshotStartedAt = snapshot2.subagents.startedAt?.[node.id];
-    const snapshotElapsedMs = snapshot2.subagents.elapsedMs?.[node.id];
+    const snapshotStartedAt = snapshot4.subagents.startedAt?.[node.id];
+    const snapshotElapsedMs = snapshot4.subagents.elapsedMs?.[node.id];
     const startedAt = state === "running" ? snapshotStartedAt ?? prior?.startedAt ?? now : prior?.startedAt ?? snapshotStartedAt;
     const elapsedMs = state !== "running" && startedAt !== void 0 ? prior?.elapsedMs ?? snapshotElapsedMs ?? Math.max(0, now - startedAt) : prior?.elapsedMs;
     taskBlocks.push({
@@ -1174,15 +1283,15 @@ function applyTaskSnapshot(turn, snapshot2, includeTerminal = true) {
   }
   return {
     ...turn,
-    taskSnapshot: snapshot2,
+    taskSnapshot: snapshot4,
     suppressedTaskIds: [...suppressed],
     blocks,
     statusLines: blocks.filter((block) => block.kind === "status").map((block) => block.text)
   };
 }
-function terminalTaskIds(snapshot2) {
-  const ids = (snapshot2.plan?.tasks ?? []).filter((task) => ["completed", "failed", "blocked", "cancelled"].includes(task.status)).map((task) => `task:${task.id}`);
-  for (const [id, status] of Object.entries(snapshot2.subagents.states)) {
+function terminalTaskIds(snapshot4) {
+  const ids = (snapshot4.plan?.tasks ?? []).filter((task) => ["completed", "failed", "blocked", "cancelled"].includes(task.status)).map((task) => `task:${task.id}`);
+  for (const [id, status] of Object.entries(snapshot4.subagents.states)) {
     if (["completed", "failed", "blocked", "cancelled"].includes(status)) ids.push(`subagent:${id}`);
   }
   return ids;
@@ -1466,7 +1575,8 @@ async function gitFiles(workspace) {
     execFile("git", ["-C", workspace, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
       encoding: "buffer",
       windowsHide: true,
-      maxBuffer: 16 * 1024 * 1024
+      maxBuffer: 16 * 1024 * 1024,
+      timeout: 3e4
     }, (error, stdout, stderr) => {
       if (error !== null) {
         reject(new Error(`Cannot enumerate checkpoint files with git: ${stderr.toString("utf8").trim() || error.message}`));
@@ -2490,10 +2600,10 @@ var AgentMessageQueue = class {
     return { steering: [...this.#steering], followUp: [...this.#followUp] };
   }
   clear() {
-    const snapshot2 = this.snapshot();
+    const snapshot4 = this.snapshot();
     this.#steering.length = 0;
     this.#followUp.length = 0;
-    return snapshot2;
+    return snapshot4;
   }
   #items(kind) {
     return kind === "steer" ? this.#steering : this.#followUp;
@@ -2862,10 +2972,10 @@ function runInvocation(invocation, signal, timeoutMs) {
 }
 
 // src/production.ts
-import { readFile as readFile16 } from "fs/promises";
-import { createHash as createHash8, randomUUID as randomUUID10 } from "crypto";
+import { readFile as readFile17 } from "fs/promises";
+import { createHash as createHash9, randomUUID as randomUUID12 } from "crypto";
 import { homedir, release as osRelease, version as osVersion } from "os";
-import { join as join17, relative as relative18, resolve as resolve21, sep as sep17 } from "path";
+import { join as join17, relative as relative20, resolve as resolve24, sep as sep19 } from "path";
 
 // src/agent/subagents.ts
 import { z as z4 } from "zod";
@@ -3037,13 +3147,13 @@ function hasCycle(nodes) {
 // src/utils/async.ts
 function awaitWithSignal(promise, signal) {
   signal.throwIfAborted();
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve25, reject) => {
     const onAbort = () => reject(signal.reason);
     signal.addEventListener("abort", onAbort, { once: true });
     promise.then(
       (value) => {
         signal.removeEventListener("abort", onAbort);
-        resolve22(value);
+        resolve25(value);
       },
       (error) => {
         signal.removeEventListener("abort", onAbort);
@@ -3591,6 +3701,7 @@ var ContextManager = class _ContextManager {
   #system;
   #volatileSystem;
   #flavor;
+  #workspaceInstructions;
   #memory;
   #userMemory;
   #compactAtChars;
@@ -3624,6 +3735,7 @@ var ContextManager = class _ContextManager {
     this.#system = options.system;
     this.#volatileSystem = options.volatileSystem;
     this.#flavor = options.flavor;
+    this.#workspaceInstructions = options.workspaceInstructions;
     this.#memory = options.memory;
     this.#userMemory = options.userMemory;
     this.#taskState = options.taskState;
@@ -3657,6 +3769,7 @@ var ContextManager = class _ContextManager {
       system: resolveSystemSections(this.#system),
       ...this.#volatileSystem === void 0 ? {} : { volatileSystem: resolveSystemSections(this.#volatileSystem) },
       ...this.#flavor === void 0 ? {} : { flavor: this.#flavor },
+      ...this.#workspaceInstructions === void 0 ? {} : { workspaceInstructions: this.#workspaceInstructions },
       ...this.#memory === void 0 ? {} : { memory: this.#memory },
       ...this.#taskState === void 0 ? {} : { taskState: this.#taskState },
       ...userMemory === void 0 ? {} : { userMemory },
@@ -3698,10 +3811,10 @@ var ContextManager = class _ContextManager {
       messages: providerValidMessages(this.#messages)
     };
   }
-  restore(snapshot2) {
-    const messages = providerValidMessages(snapshot2.messages);
-    const legacySummary = snapshot2.summary?.role === "system" && snapshot2.summary.content.startsWith("Conversation summary\n") ? snapshot2.summary.content.slice("Conversation summary\n".length) : void 0;
-    this.#compact = snapshot2.compact === void 0 ? legacySummary === void 0 ? void 0 : { summary: legacySummary, compactedAt: (/* @__PURE__ */ new Date(0)).toISOString() } : { ...snapshot2.compact };
+  restore(snapshot4) {
+    const messages = providerValidMessages(snapshot4.messages);
+    const legacySummary = snapshot4.summary?.role === "system" && snapshot4.summary.content.startsWith("Conversation summary\n") ? snapshot4.summary.content.slice("Conversation summary\n".length) : void 0;
+    this.#compact = snapshot4.compact === void 0 ? legacySummary === void 0 ? void 0 : { summary: legacySummary, compactedAt: (/* @__PURE__ */ new Date(0)).toISOString() } : { ...snapshot4.compact };
     this.#messages = messages.map((message2) => message2.role === "tool" ? { ...message2, content: truncateToolOutput(message2.content, this.#toolOutputChars) } : cloneMessage2(message2));
     this.#lastRecordedInputTokens = void 0;
     this.#estimatedTokensAtLastRecordedUsage = void 0;
@@ -3867,6 +3980,12 @@ var ContextManager = class _ContextManager {
 ${this.#flavor}`,
         cacheBreakpoint: true
       }],
+      ...this.#workspaceInstructions === void 0 ? [] : [{
+        role: "system",
+        content: `Workspace instructions
+${this.#workspaceInstructions}`,
+        cacheBreakpoint: true
+      }],
       // Stable user preferences close the cacheable prefix.
       ...userMemory === void 0 ? [] : [{ role: "system", content: `User memory
 ${userMemory}` }]
@@ -3969,6 +4088,125 @@ function providerValidMessages(input) {
   return output;
 }
 
+// src/context/workspace-instructions.ts
+import { createHash as createHash2 } from "crypto";
+import { lstat as lstat3, readFile as readFile4, realpath as realpath2 } from "fs/promises";
+import { dirname as dirname7, isAbsolute as isAbsolute4, relative as relative6, resolve as resolve6, sep as sep6 } from "path";
+var NAMES = ["AGENTS.md", "CLAUDE.md", "AGENTS.local.md", "CLAUDE.local.md"];
+var ROOT_NAMES = ["AGENTS.md", "CLAUDE.md", "AGENTS.local.md", "CLAUDE.local.md"];
+var WorkspaceInstructions = class {
+  #root;
+  #maxFileBytes;
+  #maxTotalBytes;
+  #seen = /* @__PURE__ */ new Map();
+  constructor(workspace, options = {}) {
+    this.#root = resolve6(workspace);
+    this.#maxFileBytes = options.maxFileBytes ?? 64 * 1024;
+    this.#maxTotalBytes = options.maxTotalBytes ?? 256 * 1024;
+  }
+  async baseline(scope2 = "main") {
+    const documents = await this.#readDirectories([{ path: this.#root, depth: 0 }], ROOT_NAMES);
+    return this.#format(this.#newOrChanged(documents, scope2));
+  }
+  async discover(paths, scope2 = "main") {
+    const directories = /* @__PURE__ */ new Map();
+    for (const path of paths) {
+      const absolute = resolve6(this.#root, path);
+      if (!within(this.#root, absolute)) continue;
+      const targetDirectory = await directoryForPath(absolute);
+      let current = targetDirectory;
+      while (within(this.#root, current)) {
+        const depth = depthOf(this.#root, current);
+        directories.set(current, depth);
+        if (current === this.#root) break;
+        current = dirname7(current);
+      }
+    }
+    const ordered = [...directories].map(([path, depth]) => ({ path, depth })).sort((a, b) => a.depth - b.depth || a.path.localeCompare(b.path));
+    const changed = this.#newOrChanged(await this.#readDirectories(ordered, NAMES), scope2);
+    const formatted = this.#format(changed);
+    return formatted === "" ? [] : [formatted];
+  }
+  #newOrChanged(documents, scope2) {
+    const seen = this.#seen.get(scope2) ?? /* @__PURE__ */ new Map();
+    this.#seen.set(scope2, seen);
+    const changed = [];
+    for (const document of documents) {
+      if (seen.get(document.path) === document.digest) continue;
+      seen.set(document.path, document.digest);
+      changed.push(document);
+    }
+    return changed;
+  }
+  async #readDirectories(directories, names) {
+    const result = [];
+    let physicalRoot;
+    try {
+      physicalRoot = await realpath2(this.#root);
+    } catch {
+      return result;
+    }
+    for (const directory of directories) {
+      for (const name of names) {
+        const path = resolve6(directory.path, name);
+        try {
+          const info = await lstat3(path);
+          if (!info.isFile() && !info.isSymbolicLink()) continue;
+          const physical = await realpath2(path);
+          if (!within(physicalRoot, physical)) continue;
+          const bytes = await readFile4(path);
+          const clipped = bytes.subarray(0, this.#maxFileBytes);
+          const suffix = bytes.length > clipped.length ? `
+
+[Instruction truncated at ${this.#maxFileBytes} bytes]` : "";
+          const content = clipped.toString("utf8") + suffix;
+          result.push({
+            path,
+            depth: directory.depth,
+            content,
+            digest: createHash2("sha256").update(bytes).digest("hex")
+          });
+        } catch {
+        }
+      }
+    }
+    return result;
+  }
+  #format(documents) {
+    if (documents.length === 0) return "";
+    const selected = [];
+    let bytes = 0;
+    for (const document of [...documents].sort((a, b) => b.depth - a.depth)) {
+      const size = Buffer.byteLength(document.content);
+      if (bytes + size > this.#maxTotalBytes) continue;
+      bytes += size;
+      selected.push(document);
+    }
+    selected.sort((a, b) => a.depth - b.depth || a.path.localeCompare(b.path));
+    return selected.map((document) => {
+      const display = relative6(this.#root, document.path) || document.path;
+      return `<workspace-instructions path="${display}">
+${document.content}
+</workspace-instructions>`;
+    }).join("\n\n");
+  }
+};
+async function directoryForPath(path) {
+  try {
+    return (await lstat3(path)).isDirectory() ? path : dirname7(path);
+  } catch {
+    return dirname7(path);
+  }
+}
+function depthOf(root, path) {
+  const delta = relative6(root, path);
+  return delta === "" ? 0 : delta.split(sep6).length;
+}
+function within(root, candidate) {
+  const delta = relative6(root, candidate);
+  return delta === "" || !delta.startsWith(`..${sep6}`) && delta !== ".." && !isAbsolute4(delta);
+}
+
 // src/context/summarizer.ts
 async function summarizeWithModel(options) {
   const maxAttempts = options.maxPromptTooLongAttempts ?? 3;
@@ -4244,10 +4482,10 @@ function sanitize(message2, secrets) {
 }
 function waitForRetry(delayMs, signal) {
   if (signal?.aborted) return Promise.reject(signal.reason);
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve25, reject) => {
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve22();
+      resolve25();
     }, delayMs);
     const onAbort = () => {
       clearTimeout(timer);
@@ -4260,6 +4498,7 @@ function waitForRetry(delayMs, signal) {
 
 // src/agent/loop.ts
 var DEFAULT_MAX_ITERATIONS = 40;
+var D2C_MAX_ITERATION_EXTENSIONS = 10;
 var DEFAULT_MODEL_ATTEMPTS = 3;
 var FALLBACK_MODEL_ATTEMPTS = 2;
 var RETRY_BASE_DELAY_MS = 1e3;
@@ -4278,6 +4517,7 @@ function envMaxIterations() {
 }
 var AgentLoop = class {
   #options;
+  #iterationLimitMode = "standard";
   constructor(options) {
     const envOverride = envMaxIterations();
     const maxIterations = envOverride ?? options.maxIterations ?? DEFAULT_MAX_ITERATIONS;
@@ -4300,6 +4540,9 @@ var AgentLoop = class {
   get modelId() {
     return this.#options.modelId;
   }
+  get iterationLimitMode() {
+    return this.#iterationLimitMode;
+  }
   setModel(modelId) {
     this.#options.registry.get(modelId);
     this.#options.modelId = modelId;
@@ -4308,6 +4551,10 @@ var AgentLoop = class {
     this.#options.registry.get(modelId);
     this.#options.fallbackModelId = modelId;
   }
+  /** D2C keeps a hard cap, but may automatically expand it up to ten times. */
+  setIterationLimitMode(mode) {
+    this.#iterationLimitMode = mode;
+  }
   async *run(request) {
     this.#options.context.append(request.initialUserMessage ?? { role: "user", content: request.prompt });
     let totalInputTokens = 0;
@@ -4317,7 +4564,10 @@ var AgentLoop = class {
     let hasCacheData = false;
     let accumulatedText = "";
     let modelInvocation = 0;
+    const deliverables = /* @__PURE__ */ new Map();
     let maxIterations = this.#options.maxIterations;
+    const iterationLimitMode = this.#iterationLimitMode;
+    const maxExtensions = iterationLimitMode === "d2c" ? D2C_MAX_ITERATION_EXTENSIONS : this.#options.maxExtensions;
     let extensions = 0;
     let warned = false;
     let iteration = 0;
@@ -4332,11 +4582,12 @@ var AgentLoop = class {
         const remaining = maxIterations - iteration;
         yield {
           type: "warning",
-          message: `Approaching iteration limit: ${iteration}/${maxIterations} rounds used. ${remaining} rounds remaining before automatic circuit breaker.`
+          message: iterationLimitMode === "d2c" ? `Approaching D2C base iteration limit: ${iteration}/${maxIterations} rounds used. ${remaining} rounds remain before automatic expansion (up to ${maxExtensions} expansions).` : `Approaching iteration limit: ${iteration}/${maxIterations} rounds used. ${remaining} rounds remaining before automatic circuit breaker.`
         };
       }
       if (iteration >= maxIterations) {
-        if (this.#options.hasActiveProgress?.() && extensions < this.#options.maxExtensions) {
+        const canAutoExtend = extensions < maxExtensions && (iterationLimitMode === "d2c" || this.#options.hasActiveProgress?.() === true);
+        if (canAutoExtend) {
           const previous = maxIterations;
           maxIterations += this.#options.extendIterations;
           extensions += 1;
@@ -4348,7 +4599,7 @@ var AgentLoop = class {
           };
           yield {
             type: "warning",
-            message: `Iteration limit ${previous} reached but task progress is active. Auto-extending by ${this.#options.extendIterations} rounds (extension ${extensions}/${this.#options.maxExtensions}).`
+            message: iterationLimitMode === "d2c" ? `D2C iteration limit ${previous} reached. Auto-expanding by ${this.#options.extendIterations} rounds (expansion ${extensions}/${maxExtensions}).` : `Iteration limit ${previous} reached but task progress is active. Auto-extending by ${this.#options.extendIterations} rounds (extension ${extensions}/${maxExtensions}).`
           };
           continue;
         }
@@ -4680,6 +4931,7 @@ var AgentLoop = class {
           } catch {
           }
         }
+        if (deliverables.size > 0) yield { type: "deliverables", files: [...deliverables.values()] };
         yield {
           type: "done",
           usage: {
@@ -4708,13 +4960,15 @@ var AgentLoop = class {
         for (const call of batch) {
           const label = this.#options.runtime.label(call);
           const hint = this.#options.runtime.hint(call);
+          const presentation = this.#options.runtime.callPresentation(call);
           this.#options.hallucinationGuard?.recordToolCall(call.name, call.input, call.id);
-          yield { type: "tool-start", id: call.id, name: call.name, input: call.input, ...label === void 0 ? {} : { label }, ...hint === void 0 ? {} : { hint } };
+          yield { type: "tool-start", id: call.id, name: call.name, input: call.input, ...label === void 0 ? {} : { label }, ...hint === void 0 ? {} : { hint }, ...presentation === void 0 ? {} : { presentation } };
         }
         const results = await Promise.all(batch.map(async (call) => ({
           call,
           result: await this.#options.runtime.execute(call, {
             agent: this.#options.agent,
+            ...this.#options.ownerId === void 0 ? {} : { ownerId: this.#options.ownerId },
             ...request.signal === void 0 ? {} : { signal: request.signal }
           })
         })));
@@ -4751,7 +5005,14 @@ var AgentLoop = class {
         const endLabel = this.#options.runtime.label(call);
         const endHint = this.#options.runtime.hint(call);
         this.#options.hallucinationGuard?.recordToolResult(call.name, result, call.id);
+        if (result.ok && result.presentation?.kind === "file-change") {
+          for (const change of [result.presentation, ...result.presentation.relatedChanges ?? []]) {
+            const current = deliverables.get(change.path);
+            deliverables.set(change.path, current === void 0 ? { path: change.path, operation: change.operation, added: change.added, removed: change.removed } : { ...current, operation: change.operation, added: current.added + change.added, removed: current.removed + change.removed });
+          }
+        }
         yield { type: "tool-end", id: call.id, name: call.name, result, ...endLabel === void 0 ? {} : { label: endLabel }, ...endHint === void 0 ? {} : { hint: endHint } };
+        for (const context of result.additionalContext ?? []) this.#options.context.append({ role: "system", content: context });
       }
       if (turnError !== void 0) {
         yield { type: "error", error: turnError };
@@ -4781,7 +5042,7 @@ function parallelReadBatchEnd(calls, start) {
   return end;
 }
 function toolResultMessage(toolCallId, result) {
-  return { role: "tool", toolCallId, content: JSON.stringify(result.ok ? result.output : { error: result.error }) ?? "null" };
+  return { role: "tool", toolCallId, content: result.ok && result.content !== void 0 ? result.content : JSON.stringify(result.ok ? result.output : { error: result.error }) ?? "null" };
 }
 function abortMessage(signal) {
   return signal.reason instanceof Error ? signal.reason.message : "Agent run cancelled";
@@ -4795,10 +5056,10 @@ function serializeToolInput(input) {
 }
 function waitForRetry2(delayMs, signal) {
   if (signal?.aborted) return Promise.reject(signal.reason);
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve25, reject) => {
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve22();
+      resolve25();
     }, delayMs);
     const onAbort = () => {
       clearTimeout(timer);
@@ -4876,7 +5137,7 @@ function redactClassifierText(value) {
 // src/tools/runtime.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
-import { basename as basename2, join as join5, resolve as resolve6 } from "path";
+import { basename as basename2, join as join5, resolve as resolve7 } from "path";
 import { z as z8 } from "zod";
 
 // src/tools/types.ts
@@ -4914,6 +5175,7 @@ var ToolRuntime = class {
   #disposeSchemas;
   #workspace;
   #outputLimits;
+  #afterSuccess;
   #turnOutputChars = 0;
   #disposed = false;
   constructor(options) {
@@ -4923,8 +5185,9 @@ var ToolRuntime = class {
     this.#approve = options.approve;
     this.#classify = options.classify;
     this.#alwaysAllowed = new Set(options.alwaysAllowed ?? []);
-    this.#workspace = resolve6(options.workspace ?? process.cwd());
+    this.#workspace = resolve7(options.workspace ?? process.cwd());
     this.#outputLimits = { ...DEFAULT_TOOL_OUTPUT_LIMITS, ...options.outputLimits };
+    this.#afterSuccess = options.afterSuccess;
     validateOutputLimit("perToolChars", this.#outputLimits.perToolChars);
     validateOutputLimit("perTurnChars", this.#outputLimits.perTurnChars);
     this.#disposeSchemas = [
@@ -5034,7 +5297,7 @@ var ToolRuntime = class {
       if (permission.decision === "deny") {
         return this.#fail(tool.name, input, context.agent, "permission_denied", permission.reason ?? "Tool use denied");
       }
-      if (permission.decision === "ask" && context.agent === "main" && this.#permissions.mode === "auto" && this.#classify !== void 0) {
+      if (permission.decision === "ask" && context.agent === "main" && this.#permissions.mode === "auto" && this.#permissions.profile === "standard" && this.#classify !== void 0) {
         try {
           const classified = await this.#classify(request, signal);
           if (classified.decision === "deny") {
@@ -5051,6 +5314,7 @@ var ToolRuntime = class {
       const sessionAllowed = this.#alwaysAllowed.has(getToolCategory(tool.name));
       if (!sessionAllowed && (pre.decision === "ask" || permission.decision === "ask")) {
         const reason = [pre.reason, permission.reason].filter((value) => value !== void 0).join("\n") || "Approval required";
+        const allowAlways = permission.allowAlways !== false;
         const requestDecision = await this.#hooks.emit({
           version: 1,
           type: "PermissionRequest",
@@ -5066,7 +5330,7 @@ var ToolRuntime = class {
           const ctx = requestDecision.additionalContext ?? "";
           if (ctx.includes("codeisland:allow-all")) {
             const category = getToolCategory(tool.name);
-            if (category !== "destructive") this.#alwaysAllowed.add(category);
+            if (allowAlways && category !== "destructive") this.#alwaysAllowed.add(category);
           }
         } else if (context.agent !== "main" && this.#permissions.mode !== "bubble") {
           return this.#fail(tool.name, input, context.agent, "approval_required", reason);
@@ -5074,29 +5338,46 @@ var ToolRuntime = class {
           throw signal.reason;
         } else {
           const category = getToolCategory(tool.name);
-          if (this.#approve === void 0) {
+          if (allowAlways && this.#alwaysAllowed.has(category)) {
+          } else if (this.#approve === void 0) {
             return this.#fail(tool.name, input, context.agent, "permission_denied", reason);
           } else {
-            const decision = await this.#approve({ ...request, reason }, signal);
+            const decision = await this.#approve({ ...request, reason, ...allowAlways ? {} : { allowAlways: false } }, signal);
             if (decision === "deny") {
               return this.#fail(tool.name, input, context.agent, "user_denied", reason);
             }
-            if (decision === "always" && category !== "destructive") {
+            if (decision === "always" && allowAlways && category !== "destructive") {
               this.#alwaysAllowed.add(category);
             }
           }
         }
       }
       if (signal.aborted) throw signal.reason;
-      const rawOutput = await tool.execute(input, signal);
-      const presentation = getToolPresentation(rawOutput);
-      const output = await this.#limitOutput(tool.name, rawOutput);
+      const executed = await tool.execute(input, signal, context);
+      let rawOutput;
+      try {
+        rawOutput = tool.outputSchema === void 0 ? executed : tool.outputSchema.parse(executed);
+      } catch (error) {
+        return this.#fail(tool.name, input, context.agent, "invalid_output", message(error));
+      }
+      const declaredPresentation = tool.presentResult?.(rawOutput, input);
+      const presentation = declaredPresentation ?? getToolPresentation(rawOutput);
+      const rendered = tool.renderForModel?.(rawOutput, input);
+      const output = rendered === void 0 ? await this.#limitOutput(tool.name, rawOutput) : rawOutput;
+      const content = rendered === void 0 ? void 0 : await this.#limitText(tool.name, rendered);
+      const additionalContext = await this.#afterSuccess?.(tool.name, tool.paths(input), input, rawOutput, context);
       await this.#hooks.emit({
         version: 1,
         type: "PostToolUse",
         payload: { tool: tool.name, input, agent: context.agent, output }
       });
-      return { ok: true, output, ...presentation === void 0 ? {} : { presentation } };
+      return {
+        ok: true,
+        output,
+        ...content === void 0 ? {} : { content },
+        ...presentation === void 0 ? {} : { presentation },
+        ...additionalContext === void 0 || additionalContext.length === 0 ? {} : { additionalContext }
+      };
     } catch (error) {
       return this.#fail(tool.name, input, context.agent, "tool_error", message(error));
     }
@@ -5133,6 +5414,19 @@ var ToolRuntime = class {
       savedTo
     };
   }
+  callPresentation(call) {
+    const tool = this.#tools.get(call.name);
+    if (tool?.presentCall === void 0) return void 0;
+    try {
+      return tool.presentCall(tool.inputSchema.parse(call.input));
+    } catch {
+      return void 0;
+    }
+  }
+  async #limitText(tool, content) {
+    const limited = await this.#limitOutput(tool, content);
+    return typeof limited === "string" ? limited : serializeToolOutput(limited);
+  }
   async #fail(tool, input, agent, code, errorMessage) {
     const result = { ok: false, error: { code, message: errorMessage } };
     try {
@@ -5169,6 +5463,7 @@ var LocalHarness = class {
   #options;
   #subagentModelId;
   #mainPermissions;
+  #permissionProfile = "standard";
   #contexts = /* @__PURE__ */ new WeakSet();
   #children = /* @__PURE__ */ new Set();
   #mainDefinitions;
@@ -5199,6 +5494,9 @@ var LocalHarness = class {
   get permissionMode() {
     return this.#mainPermissions.mode;
   }
+  get permissionProfile() {
+    return this.#permissionProfile;
+  }
   setModel(role, modelId) {
     this.#options.registry.get(modelId);
     if (role === "main") this.main.loop.setModel(modelId);
@@ -5210,6 +5508,12 @@ var LocalHarness = class {
   setPermissionMode(mode) {
     this.#mainPermissions.setMode(mode);
   }
+  setPermissionProfile(profile) {
+    this.#permissionProfile = profile;
+    this.#mainPermissions.setProfile(profile);
+    this.main.loop.setIterationLimitMode(profile === "d2c" ? "d2c" : "standard");
+    for (const child of this.#children) child.loop.setIterationLimitMode(profile === "d2c" ? "d2c" : "standard");
+  }
   replaceMainTools(definitions) {
     if (this.#disposed) throw new Error("LocalHarness is disposed");
     const nextDefinitions = definitions.filter((tool) => tool.agents === void 0 || tool.agents.includes("main"));
@@ -5224,7 +5528,7 @@ var LocalHarness = class {
     const tools = this.#toolsForAgent("subagent").filter((tool) => !MAIN_TASK_TOOL_NAMES.has(tool.name));
     const context = this.#options.createContext("subagent", tools, this.#subagentModelId, parentContext);
     this.#claimContext(context);
-    const profile = this.#createProfile(this.#subagentModelId, tools, "subagent", context, this.#options.approve);
+    const profile = this.#createProfile(this.#subagentModelId, tools, "subagent", context, this.#options.approve, void 0, `subagent:${task.id}`);
     let disposed = false;
     const child = {
       ...profile,
@@ -5270,9 +5574,11 @@ var LocalHarness = class {
   #toolsForAgent(agent) {
     return this.#options.tools.filter((tool) => tool.agents === void 0 || tool.agents.includes(agent));
   }
-  #createProfile(modelId, definitions, agent, context, approve, fallbackModelId) {
+  #createProfile(modelId, definitions, agent, context, approve, fallbackModelId, ownerId = agent) {
     const permissions = new PermissionEngine({
       workspace: this.#options.workspace,
+      ...this.#options.afterToolSuccess === void 0 ? {} : { afterSuccess: this.#options.afterToolSuccess },
+      profile: this.#permissionProfile,
       mode: this.#options.loopMode ? "bypassPermissions" : agent === "subagent" ? this.#mainPermissions.mode === "plan" ? "plan" : "bubble" : this.#options.permissionMode ?? "default"
     });
     if (agent === "main") this.#mainPermissions = permissions;
@@ -5302,10 +5608,12 @@ var LocalHarness = class {
         hooks: this.#options.hooks,
         tools,
         agent,
+        ownerId,
         ...maxIterations === void 0 ? {} : { maxIterations },
         ...isMain && this.#options.hasActiveProgress !== void 0 ? { hasActiveProgress: this.#options.hasActiveProgress } : {},
         ...isMain && this.#options.hallucinationGuard !== void 0 ? { hallucinationGuard: this.#options.hallucinationGuard } : {}
       });
+      loop.setIterationLimitMode(this.#permissionProfile === "d2c" ? "d2c" : "standard");
       return { get modelId() {
         return loop.modelId;
       }, context, runtime, tools, loop };
@@ -5475,7 +5783,7 @@ var HookBus = class {
   }
 };
 function runShellHandler(descriptor, event, signal) {
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve25, reject) => {
     const child = spawn3(descriptor.command, [...descriptor.args ?? []], {
       env: { ...process.env, ...descriptor.env },
       shell: false,
@@ -5518,7 +5826,7 @@ function runShellHandler(descriptor, event, signal) {
         return;
       }
       try {
-        resolve22(HookDecisionSchema.parse(JSON.parse(stdout)));
+        resolve25(HookDecisionSchema.parse(JSON.parse(stdout)));
       } catch (error) {
         reject(error);
       }
@@ -6211,9 +6519,9 @@ function extractJson(text) {
 }
 
 // src/goal/classifier.ts
-import { createHash as createHash2 } from "crypto";
-import { readFile as readFile4, readdir as readdir3 } from "fs/promises";
-import { join as join6, relative as relative6 } from "path";
+import { createHash as createHash3 } from "crypto";
+import { readFile as readFile5, readdir as readdir3 } from "fs/promises";
+import { join as join6, relative as relative7 } from "path";
 function buildSkepticPrompt(evidence, plan, index) {
   const criteriaList = plan.criteria.map((c) => `  ${c.id}. [${c.type}] ${c.description}`).join("\n");
   return [
@@ -6377,19 +6685,19 @@ function deduplicateGaps(gaps) {
 }
 function computeFingerprint(gaps) {
   const content = gaps.map((g) => `${g.criterion}:${g.description}`).sort().join("\n");
-  return createHash2("sha256").update(content).digest("hex").slice(0, 16);
+  return createHash3("sha256").update(content).digest("hex").slice(0, 16);
 }
 async function collectEvidence(workspace, objective, finalResponse, priorGaps) {
   const changedFiles = await collectChangedFiles(workspace);
   const planPath = join6(workspace, ".flavor", "goal-plan.md");
   let planFile = null;
   try {
-    planFile = await readFile4(planPath, "utf8");
+    planFile = await readFile5(planPath, "utf8");
   } catch {
   }
   return {
     objective,
-    changedFiles: changedFiles.map((f) => relative6(workspace, f)),
+    changedFiles: changedFiles.map((f) => relative7(workspace, f)),
     planFile,
     finalResponse,
     priorGaps
@@ -6407,7 +6715,7 @@ async function collectChangedFiles(workspace) {
     }
     for (const entry2 of entries) {
       const full = join6(dir, entry2.name);
-      const rel = relative6(workspace, full);
+      const rel = relative7(workspace, full);
       if (entry2.name === ".git" || entry2.name === "node_modules" || entry2.name === ".flavor" || entry2.name.startsWith(".")) continue;
       if (entry2.isDirectory()) {
         await walk(full);
@@ -6681,21 +6989,21 @@ function formatPriorGaps(gaps) {
 // src/goal/store.ts
 import { constants } from "fs";
 import { randomUUID as randomUUID4 } from "crypto";
-import { lstat as lstat3, mkdir as mkdir6, open as open3, rename as rename3, rm as rm2 } from "fs/promises";
-import { dirname as dirname7, join as join8, relative as relative7, resolve as resolve7, sep as sep6 } from "path";
+import { lstat as lstat4, mkdir as mkdir6, open as open3, rename as rename3, rm as rm2 } from "fs/promises";
+import { dirname as dirname8, join as join8, relative as relative8, resolve as resolve8, sep as sep7 } from "path";
 var DEFAULT_MAX_BYTES = 1024 * 1024;
 var GoalStore = class {
   #workspace;
   #root;
   #maxBytes;
   constructor(options) {
-    this.#workspace = resolve7(options.workspace);
+    this.#workspace = resolve8(options.workspace);
     this.#root = join8(this.#workspace, ".flavor", "goals");
     this.#maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
   }
   async save(input) {
     const state = GoalStateSchema.parse(input);
-    await assertNoSymlink(this.#workspace, dirname7(this.#root));
+    await assertNoSymlink(this.#workspace, dirname8(this.#root));
     await mkdir6(this.#root, { recursive: true, mode: 448 });
     await assertNoSymlink(this.#workspace, this.#root);
     const target = join8(this.#root, `${state.id}.json`);
@@ -6720,20 +7028,20 @@ var GoalStore = class {
   }
 };
 async function assertNoSymlink(root, target) {
-  let cursor = resolve7(target);
-  const stop = resolve7(root);
-  const value = relative7(stop, cursor);
-  if (value === ".." || value.startsWith(`..${sep6}`) || value.includes(":")) {
+  let cursor = resolve8(target);
+  const stop = resolve8(root);
+  const value = relative8(stop, cursor);
+  if (value === ".." || value.startsWith(`..${sep7}`) || value.includes(":")) {
     throw new Error("Goal path escapes workspace");
   }
   const chain = [];
   while (cursor !== stop) {
     chain.push(cursor);
-    cursor = dirname7(cursor);
+    cursor = dirname8(cursor);
   }
   for (const path of chain.reverse()) {
     try {
-      if ((await lstat3(path)).isSymbolicLink()) throw new Error(`Goal path contains a symbolic link: ${path}`);
+      if ((await lstat4(path)).isSymbolicLink()) throw new Error(`Goal path contains a symbolic link: ${path}`);
     } catch (error) {
       if (!isCode3(error, "ENOENT")) throw error;
     }
@@ -6744,8 +7052,8 @@ function isCode3(error, code) {
 }
 
 // src/loop/isolation.ts
-import { appendFile, mkdir as mkdir7, readFile as readFile5 } from "fs/promises";
-import { join as join9, resolve as resolve8 } from "path";
+import { appendFile, mkdir as mkdir7, readFile as readFile6 } from "fs/promises";
+import { join as join9, resolve as resolve9 } from "path";
 var CODE_CHANGE = /\b(?:fix|implement|add|update|change|modify|refactor|build|create|remove|delete|write|migrate)\b|修复|实现|添加|更新|修改|重构|创建|删除|迁移/i;
 var READ_ONLY = /\b(?:review|analy[sz]e|inspect|explain|research|investigate|audit|summari[sz]e|report)\b|调研|分析|审查|检查|解释|研究|总结|报告/i;
 function inferGoalIntent(goal) {
@@ -6755,7 +7063,7 @@ function inferGoalIntent(goal) {
 }
 async function prepareLoopWorkspace(options) {
   options.signal?.throwIfAborted();
-  const root = resolve8(options.root);
+  const root = resolve9(options.root);
   const intent = inferGoalIntent(options.goal);
   if (intent === "read_only") return { kind: "ready", workspace: { root, mode: "current" } };
   const inside = await git(root, ["rev-parse", "--is-inside-work-tree"]);
@@ -6798,13 +7106,13 @@ async function ensureWorktreeDirectoryIgnored(root) {
   if (ignored2.code === 0) return;
   const commonDirectory = await git(root, ["rev-parse", "--git-common-dir"]);
   if (commonDirectory.code !== 0) throw new Error(commonDirectory.stderr.trim() || "Git common directory is unavailable");
-  const gitDirectory = resolve8(root, commonDirectory.stdout.trim());
+  const gitDirectory = resolve9(root, commonDirectory.stdout.trim());
   const infoDirectory = join9(gitDirectory, "info");
   const excludePath = join9(infoDirectory, "exclude");
   await mkdir7(infoDirectory, { recursive: true });
   let existing = "";
   try {
-    existing = await readFile5(excludePath, "utf8");
+    existing = await readFile6(excludePath, "utf8");
   } catch (error) {
     if (!(typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT")) throw error;
   }
@@ -6815,8 +7123,8 @@ async function ensureWorktreeDirectoryIgnored(root) {
 
 // src/loop/store.ts
 import { constants as constants2 } from "fs";
-import { lstat as lstat4, mkdir as mkdir8, open as open4, readFile as readFile6, realpath as realpath2, rename as rename4, rm as rm3, stat as stat2 } from "fs/promises";
-import { dirname as dirname8, join as join10, relative as relative8, resolve as resolve9, sep as sep7 } from "path";
+import { lstat as lstat5, mkdir as mkdir8, open as open4, readFile as readFile7, realpath as realpath3, rename as rename4, rm as rm3, stat as stat2 } from "fs/promises";
+import { dirname as dirname9, join as join10, relative as relative9, resolve as resolve10, sep as sep8 } from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 var LOOP_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 var DEFAULT_MAX_BYTES2 = 5 * 1024 * 1024;
@@ -6826,7 +7134,7 @@ var LoopStore = class {
   #maxBytes;
   #appendTails = /* @__PURE__ */ new Map();
   constructor(options) {
-    this.#workspace = resolve9(options.workspace);
+    this.#workspace = resolve10(options.workspace);
     this.#root = join10(this.#workspace, ".flavor", "loops");
     this.#maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES2;
   }
@@ -6868,7 +7176,7 @@ var LoopStore = class {
     try {
       const metadata = await stat2(target);
       if (!metadata.isFile() || metadata.size > this.#maxBytes) throw new Error("Loop state is not a bounded regular file");
-      const raw = await readFile6(target, "utf8");
+      const raw = await readFile7(target, "utf8");
       const state = LoopStateSchema.parse(JSON.parse(raw));
       await this.#assertWorkspace(state.workspace);
       return state;
@@ -6898,7 +7206,7 @@ var LoopStore = class {
   }
   async #prepare(loopId) {
     validateId(loopId);
-    await assertNoSymlink2(this.#workspace, dirname8(this.#root));
+    await assertNoSymlink2(this.#workspace, dirname9(this.#root));
     await mkdir8(this.#root, { recursive: true, mode: 448 });
     await assertNoSymlink2(this.#workspace, this.#root);
     const directory = join10(this.#root, loopId);
@@ -6925,31 +7233,31 @@ function validateId(loopId) {
   if (!LOOP_ID.test(loopId)) throw new Error("Invalid loop id");
 }
 async function assertNoSymlink2(root, target) {
-  let cursor = resolve9(target);
-  const stop = resolve9(root);
+  let cursor = resolve10(target);
+  const stop = resolve10(root);
   if (!isWithin2(stop, cursor)) throw new Error("Loop path escapes workspace");
   const chain = [];
   while (cursor !== stop) {
     chain.push(cursor);
-    cursor = dirname8(cursor);
+    cursor = dirname9(cursor);
   }
   for (const path of chain.reverse()) {
     try {
-      if ((await lstat4(path)).isSymbolicLink()) throw new Error(`Loop path contains a symbolic link: ${path}`);
+      if ((await lstat5(path)).isSymbolicLink()) throw new Error(`Loop path contains a symbolic link: ${path}`);
     } catch (error) {
       if (!isCode4(error, "ENOENT")) throw error;
     }
   }
 }
 function isWithin2(root, path) {
-  const value = relative8(resolve9(root), resolve9(path));
-  return value === "" || !value.startsWith(`..${sep7}`) && value !== ".." && !value.includes(":");
+  const value = relative9(resolve10(root), resolve10(path));
+  return value === "" || !value.startsWith(`..${sep8}`) && value !== ".." && !value.includes(":");
 }
 async function canonical(path) {
   try {
-    return await realpath2(resolve9(path));
+    return await realpath3(resolve10(path));
   } catch {
-    return resolve9(path);
+    return resolve10(path);
   }
 }
 function isCode4(error, code) {
@@ -6957,46 +7265,191 @@ function isCode4(error, code) {
 }
 
 // src/loop/verifier.ts
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile8 } from "fs/promises";
 import { join as join11 } from "path";
 
 // src/tools/shell.ts
 import { spawn as spawn4 } from "child_process";
-import { isAbsolute as isAbsolute4, relative as relative9, resolve as resolve10, sep as sep8 } from "path";
+import { isAbsolute as isAbsolute5, relative as relative10, resolve as resolve11, sep as sep9 } from "path";
+import { z as z13 } from "zod";
+
+// src/tools/jobs.ts
 import { z as z12 } from "zod";
+var JobId = z12.string().regex(/^job-[a-f0-9-]+$/);
+var ReadInput = z12.object({ id: JobId, cursor: z12.coerce.number().int().min(0).optional() });
+var IdInput = z12.object({ id: JobId });
+function createJobTools(registry) {
+  const tools = [
+    {
+      name: "JobList",
+      description: "List background jobs owned by this agent",
+      inputSchema: z12.object({}),
+      paths: () => [],
+      execute: async (_input, _signal, context) => registry.list(owner(context)),
+      presentResult: (output) => jobListPresentation(output)
+    },
+    {
+      name: "JobRead",
+      description: "Read incremental output from an owned background job",
+      inputSchema: ReadInput,
+      paths: () => [],
+      execute: async (input, _signal, context) => registry.read(input.id, owner(context), input.cursor ?? 0),
+      renderForModel: (output) => JSON.stringify(output),
+      presentResult: (output) => jobPresentation("read", output)
+    },
+    {
+      name: "JobWait",
+      description: "Wait for an owned background job to finish",
+      inputSchema: IdInput,
+      paths: () => [],
+      execute: async (input, signal, context) => registry.wait(input.id, owner(context), signal),
+      presentResult: (output) => jobPresentation("wait", output)
+    },
+    {
+      name: "JobKill",
+      description: "Cancel an owned background job and its process tree",
+      inputSchema: IdInput,
+      paths: () => [],
+      execute: async (input, _signal, context) => {
+        registry.kill(input.id, owner(context));
+        return registry.read(input.id, owner(context));
+      },
+      presentResult: (output) => jobPresentation("kill", output)
+    }
+  ];
+  return tools;
+}
+function jobPresentation(action, job) {
+  const read = "output" in job ? job : void 0;
+  return {
+    kind: "job",
+    action,
+    id: job.id,
+    jobKind: job.kind,
+    label: job.label,
+    state: job.state,
+    ...job.exitCode === void 0 ? {} : { exitCode: job.exitCode },
+    ...job.error === void 0 ? {} : { error: job.error },
+    ...read === void 0 ? {} : { output: read.output, cursor: read.cursor },
+    ...job.truncated ? { truncated: true } : {}
+  };
+}
+function jobListPresentation(jobs) {
+  return {
+    kind: "job",
+    action: "list",
+    jobs: jobs.map((job) => ({
+      id: job.id,
+      kind: job.kind,
+      label: job.label,
+      state: job.state,
+      ...job.exitCode === void 0 ? {} : { exitCode: job.exitCode }
+    }))
+  };
+}
+function owner(context) {
+  return context?.ownerId ?? context?.agent ?? "main";
+}
+
+// src/tools/shell.ts
 var DEFAULT_MAX_OUTPUT_BYTES2 = 1048576;
-var ELLIPSIS = Buffer.from("\u2026");
+var DEFAULT_SHELL_TIMEOUT_MS = 10 * 6e4;
+var ELLIPSIS = "\u2026";
 var TERMINATION_GRACE_MS = 250;
 var TERMINATION_FAILURE_MS = 5e3;
-var ShellInput = z12.object({
-  command: z12.string().min(1),
-  args: z12.array(z12.string()),
-  cwd: z12.string().min(1).nullable().optional(),
-  timeoutMs: z12.coerce.number().int().positive().max(864e5).nullable().optional()
+var STREAM_CLOSE_GRACE_MS = 500;
+var ShellInput = z13.object({
+  command: z13.string().min(1),
+  args: z13.array(z13.string()),
+  cwd: z13.string().min(1).nullable().optional(),
+  timeoutMs: z13.coerce.number().int().positive().max(864e5).nullable().optional(),
+  background: z13.boolean().optional()
 });
 function createShellTool(workspace, options = {}) {
-  const root = resolve10(workspace);
+  const root = resolve11(workspace);
   const maxBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES2;
+  const defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS;
   if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new Error("maxOutputBytes must be a positive integer");
+  if (!Number.isSafeInteger(defaultTimeoutMs) || defaultTimeoutMs <= 0 || defaultTimeoutMs > 864e5) {
+    throw new Error("defaultTimeoutMs must be a positive integer no greater than 86400000");
+  }
   return {
     name: "Shell",
-    description: "Run a command with an argument array inside the workspace",
+    description: "Run a bounded command with an argument array inside the workspace; background=true returns a managed job id",
     inputSchema: ShellInput,
     paths: (input) => [workingDirectory(root, input.cwd ?? void 0)],
     summarize: (input) => [input.command, ...input.args].join(" "),
+    presentCall: (input) => ({ kind: "terminal", variant: "command", title: input.background ? "Starting background command" : "Running command", command: [input.command, ...input.args].join(" "), state: "running" }),
     permissions: (input) => ({
       paths: [workingDirectory(root, input.cwd ?? void 0)],
       command: input.command,
       args: input.args,
       cwd: workingDirectory(root, input.cwd ?? void 0)
     }),
-    execute: async (input, signal) => {
-      if (options.executionEnvironment === void 0) return executeShell(root, input, signal, maxBytes);
+    presentResult: (output, input) => output && "jobId" in output ? {
+      kind: "job",
+      action: "start",
+      id: output.jobId,
+      jobKind: "shell",
+      label: [input.command, ...input.args].join(" "),
+      state: "running"
+    } : { kind: "terminal", variant: "command", title: [input.command, ...input.args].join(" "), command: [input.command, ...input.args].join(" "), stdout: output.stdout, stderr: output.stderr, exitCode: output.exitCode, state: output.terminationReason === "cancelled" ? "cancelled" : output.exitCode === 0 ? "completed" : "failed", truncated: output.truncated },
+    execute: async (input, signal, context) => {
+      const timeoutMs = input.timeoutMs ?? defaultTimeoutMs;
+      if (input.background === true) {
+        if (options.jobs === void 0) throw new Error("Background shell requires a JobRegistry");
+        const cancellation = new AbortController();
+        const job = options.jobs.create({
+          kind: "shell",
+          owner: owner(context),
+          label: [input.command, ...input.args].join(" "),
+          cancel: () => cancellation.abort(new Error("Background job cancelled"))
+        });
+        void (async () => {
+          try {
+            let result2;
+            if (options.executionEnvironment === void 0) {
+              result2 = await executeShell(root, { ...input, timeoutMs }, cancellation.signal, maxBytes, (stream, text) => job.append(stream === "stderr" ? `[stderr] ${text}` : text));
+            } else {
+              const raw = await options.executionEnvironment.exec({
+                command: input.command,
+                args: input.args,
+                cwd: workingDirectory(root, input.cwd ?? void 0),
+                timeoutMs
+              }, cancellation.signal);
+              job.append(raw.stdout);
+              if (raw.stderr !== "") job.append(`[stderr] ${raw.stderr}`);
+              result2 = { ...raw, truncated: false, truncation: { stdout: { truncated: false, originalBytes: Buffer.byteLength(raw.stdout), limitBytes: maxBytes }, stderr: { truncated: false, originalBytes: Buffer.byteLength(raw.stderr), limitBytes: maxBytes } } };
+            }
+            job.complete({ exitCode: result2.exitCode });
+          } catch (error) {
+            job.fail(error);
+          }
+        })();
+        return {
+          jobId: job.id,
+          state: "running",
+          command: [input.command, ...input.args].join(" "),
+          exitCode: null,
+          signal: null,
+          stdout: "",
+          stderr: "",
+          truncated: false,
+          truncation: {
+            stdout: { truncated: false, originalBytes: 0, limitBytes: maxBytes },
+            stderr: { truncated: false, originalBytes: 0, limitBytes: maxBytes }
+          },
+          terminationReason: null
+        };
+      }
+      if (options.executionEnvironment === void 0) {
+        return executeShell(root, { ...input, timeoutMs }, signal, maxBytes);
+      }
       const result = await options.executionEnvironment.exec({
         command: input.command,
         args: input.args,
         cwd: workingDirectory(root, input.cwd ?? void 0),
-        ...input.timeoutMs == null ? {} : { timeoutMs: input.timeoutMs }
+        timeoutMs
       }, signal);
       const stdout = new BoundedOutput(maxBytes);
       const stderr = new BoundedOutput(maxBytes);
@@ -7015,7 +7468,7 @@ function createShellTool(workspace, options = {}) {
     }
   };
 }
-async function executeShell(root, input, cancellation, maxBytes) {
+async function executeShell(root, input, cancellation, maxBytes, onOutput) {
   const cwd = workingDirectory(root, input.cwd ?? void 0);
   const stdout = new BoundedOutput(maxBytes);
   const stderr = new BoundedOutput(maxBytes);
@@ -7027,27 +7480,37 @@ async function executeShell(root, input, cancellation, maxBytes) {
     const quoteArg = (s) => s.includes(" ") ? `"${s.replace(/"/g, '""')}"` : s;
     const quoted = input.args.map(quoteArg).join(" ");
     const commandLine = quoted.length > 0 ? `${quoteArg(input.command)} ${quoted}` : quoteArg(input.command);
-    const child = spawn4(commandLine, {
+    const shellCommandLine = process.platform === "win32" ? `chcp 65001>nul & ${commandLine}` : commandLine;
+    const child = spawn4(shellCommandLine, {
       cwd,
       shell: true,
       windowsHide: true,
       detached: process.platform !== "win32"
     });
     let exitObserved = false;
+    let observedExitCode = null;
+    let observedSignal = null;
     let settled = false;
     let terminationReason = null;
     let termination;
     let terminalTimer;
+    let streamCloseTimer;
+    const stdoutDecoder = onOutput === void 0 ? void 0 : new AdaptiveOutputDecoder();
+    const stderrDecoder = onOutput === void 0 ? void 0 : new AdaptiveOutputDecoder();
     const terminate = (reason) => {
-      if (termination !== void 0 || exitObserved || child.exitCode !== null || child.signalCode !== null) {
+      if (termination !== void 0 || settled) return;
+      terminationReason = reason;
+      if (exitObserved || child.exitCode !== null || child.signalCode !== null) {
+        child.stdout.destroy();
+        child.stderr.destroy();
+        void finishResolve(observedExitCode ?? child.exitCode, observedSignal ?? child.signalCode);
         return;
       }
-      terminationReason = reason;
       termination = terminateTree(child.pid);
       terminalTimer = setTimeout(() => finishReject(new Error(`Process did not close after ${reason} termination`)), TERMINATION_FAILURE_MS);
       terminalTimer.unref();
     };
-    const timeoutMs = input.timeoutMs ?? void 0;
+    const timeoutMs = input.timeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS;
     let timer;
     child.once("spawn", () => {
       if (timeoutMs === void 0 || exitObserved || settled) return;
@@ -7056,30 +7519,57 @@ async function executeShell(root, input, cancellation, maxBytes) {
     });
     const onCancel = () => terminate("cancelled");
     cancellation.addEventListener("abort", onCancel, { once: true });
-    child.stdout.on("data", (chunk) => stdout.add(chunk));
-    child.stderr.on("data", (chunk) => stderr.add(chunk));
-    child.once("exit", () => {
+    child.stdout.on("data", (chunk) => {
+      stdout.add(chunk);
+      if (stdoutDecoder !== void 0) {
+        const text = stdoutDecoder.write(chunk);
+        if (text !== "") onOutput?.("stdout", text);
+      }
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr.add(chunk);
+      if (stderrDecoder !== void 0) {
+        const text = stderrDecoder.write(chunk);
+        if (text !== "") onOutput?.("stderr", text);
+      }
+    });
+    child.once("exit", (exitCode, exitSignal) => {
       exitObserved = true;
+      observedExitCode = exitCode;
+      observedSignal = exitSignal;
       if (timer !== void 0) clearTimeout(timer);
+      streamCloseTimer = setTimeout(() => {
+        child.stdout.destroy();
+        child.stderr.destroy();
+        void finishResolve(observedExitCode, observedSignal);
+      }, STREAM_CLOSE_GRACE_MS);
+      streamCloseTimer.unref();
     });
     child.once("error", (error) => {
       finishReject(error);
     });
-    child.once("close", async (exitCode, signal) => {
-      if (termination !== void 0) await termination;
+    child.once("close", (exitCode, signal) => {
+      void finishResolve(exitCode, signal);
+    });
+    async function finishResolve(exitCode, exitSignal) {
       if (settled) return;
       settled = true;
       cleanup();
+      if (termination !== void 0) await termination;
+      const stdoutTail = stdoutDecoder?.end() ?? "";
+      const stderrTail = stderrDecoder?.end() ?? "";
+      if (stdoutTail !== "") onOutput?.("stdout", stdoutTail);
+      if (stderrTail !== "") onOutput?.("stderr", stderrTail);
       resolvePromise({
         exitCode,
-        signal,
+        signal: exitSignal,
         stdout: stdout.text(),
         stderr: stderr.text(),
         truncated: stdout.truncated || stderr.truncated,
         truncation: { stdout: stdout.metadata(), stderr: stderr.metadata() },
         terminationReason
       });
-    });
+    }
     function finishReject(error) {
       if (settled) return;
       settled = true;
@@ -7089,6 +7579,7 @@ async function executeShell(root, input, cancellation, maxBytes) {
     function cleanup() {
       if (timer !== void 0) clearTimeout(timer);
       if (terminalTimer !== void 0) clearTimeout(terminalTimer);
+      if (streamCloseTimer !== void 0) clearTimeout(streamCloseTimer);
       cancellation.removeEventListener("abort", onCancel);
     }
   });
@@ -7124,14 +7615,41 @@ var BoundedOutput = class {
     return { truncated: this.truncated, originalBytes: this.#bytes, limitBytes: this.#limit };
   }
   text() {
-    if (!this.truncated) return this.#complete.toString("utf8");
-    return Buffer.concat([utf8Prefix(this.#head), ELLIPSIS, utf8Suffix(this.#tail)]).toString("utf8");
+    if (!this.truncated) return decodeOutput(this.#complete);
+    const encoding = classifyUtf8(this.#complete) === "invalid" && process.platform === "win32" ? "gb18030" : "utf-8";
+    return `${decodePrefix(this.#head, encoding)}${ELLIPSIS}${decodeSuffix(this.#tail, encoding)}`;
+  }
+};
+var AdaptiveOutputDecoder = class {
+  #pending = Buffer.alloc(0);
+  #decoder;
+  write(chunk) {
+    if (this.#decoder !== void 0) return this.#decoder.decode(chunk, { stream: true });
+    this.#pending = Buffer.concat([this.#pending, chunk]);
+    if (this.#pending.every((byte) => byte < 128)) {
+      const ascii = this.#pending.toString("ascii");
+      this.#pending = Buffer.alloc(0);
+      return ascii;
+    }
+    const classification = classifyUtf8(this.#pending);
+    if (classification === "incomplete") return "";
+    const encoding = classification === "valid" || process.platform !== "win32" ? "utf-8" : "gb18030";
+    this.#decoder = new TextDecoder(encoding);
+    const text = this.#decoder.decode(this.#pending, { stream: true });
+    this.#pending = Buffer.alloc(0);
+    return text;
+  }
+  end() {
+    if (this.#decoder !== void 0) return this.#decoder.decode();
+    const text = decodeOutput(this.#pending);
+    this.#pending = Buffer.alloc(0);
+    return text;
   }
 };
 function workingDirectory(root, cwd = ".") {
-  const candidate = resolve10(root, cwd);
-  const delta = relative9(root, candidate);
-  if (delta === ".." || delta.startsWith(`..${sep8}`) || isAbsolute4(delta)) throw new Error("Working directory is outside the workspace");
+  const candidate = resolve11(root, cwd);
+  const delta = relative10(root, candidate);
+  if (delta === ".." || delta.startsWith(`..${sep9}`) || isAbsolute5(delta)) throw new Error("Working directory is outside the workspace");
   return candidate;
 }
 async function terminateTree(pid) {
@@ -7164,34 +7682,76 @@ async function terminateTree(pid) {
 }
 function waitForProcess(child) {
   return new Promise((resolvePromise) => {
-    child.once("error", () => resolvePromise());
-    child.once("close", () => resolvePromise());
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolvePromise();
+    };
+    const timer = setTimeout(finish, TERMINATION_FAILURE_MS);
+    timer.unref();
+    child.once("error", finish);
+    child.once("close", finish);
   });
 }
 function delay(milliseconds) {
   return new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
 }
-function utf8Prefix(buffer) {
+function decodeOutput(buffer) {
+  const encoding = classifyUtf8(buffer) === "invalid" && process.platform === "win32" ? "gb18030" : "utf-8";
+  return new TextDecoder(encoding).decode(buffer);
+}
+function decodePrefix(buffer, encoding) {
   for (let end = buffer.length; end >= Math.max(0, buffer.length - 3); end -= 1) {
     const candidate = buffer.subarray(0, end);
     try {
-      new TextDecoder("utf-8", { fatal: true }).decode(candidate);
-      return candidate;
+      return new TextDecoder(encoding, { fatal: true }).decode(candidate);
     } catch {
     }
   }
-  return Buffer.from(buffer.toString("utf8"));
+  return new TextDecoder(encoding).decode(buffer);
 }
-function utf8Suffix(buffer) {
+function decodeSuffix(buffer, encoding) {
   for (let start = 0; start <= Math.min(3, buffer.length); start += 1) {
     const candidate = buffer.subarray(start);
     try {
-      new TextDecoder("utf-8", { fatal: true }).decode(candidate);
-      return candidate;
+      return new TextDecoder(encoding, { fatal: true }).decode(candidate);
     } catch {
     }
   }
-  return Buffer.from(buffer.toString("utf8"));
+  return new TextDecoder(encoding).decode(buffer);
+}
+function classifyUtf8(buffer) {
+  try {
+    new TextDecoder("utf-8", { fatal: true }).decode(buffer);
+    return "valid";
+  } catch {
+    const suffixLength = incompleteUtf8SuffixLength(buffer);
+    if (suffixLength === 0) return "invalid";
+    try {
+      new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, buffer.length - suffixLength));
+      return "incomplete";
+    } catch {
+      return "invalid";
+    }
+  }
+}
+function incompleteUtf8SuffixLength(buffer) {
+  for (let start = Math.max(0, buffer.length - 3); start < buffer.length; start += 1) {
+    const lead = buffer[start];
+    const expected = lead >= 194 && lead <= 223 ? 2 : lead >= 224 && lead <= 239 ? 3 : lead >= 240 && lead <= 244 ? 4 : 0;
+    if (expected === 0 || buffer.length - start >= expected) continue;
+    let continuation = true;
+    for (let index = start + 1; index < buffer.length; index += 1) {
+      if ((buffer[index] & 192) !== 128) {
+        continuation = false;
+        break;
+      }
+    }
+    if (continuation) return buffer.length - start;
+  }
+  return 0;
 }
 
 // src/loop/verifier.ts
@@ -7272,7 +7832,7 @@ function isUnconditionalPassThrough(script) {
 }
 async function optionalText(path) {
   try {
-    return await readFile7(path, "utf8");
+    return await readFile8(path, "utf8");
   } catch (error) {
     if (isCode5(error, "ENOENT")) return void 0;
     throw error;
@@ -7293,7 +7853,7 @@ function isCode5(error, code) {
 
 // src/models/anthropic.ts
 import Anthropic from "@anthropic-ai/sdk";
-import { readFile as readFile8 } from "fs/promises";
+import { readFile as readFile9 } from "fs/promises";
 
 // src/utils/json.ts
 function safeParseJson(input) {
@@ -7335,6 +7895,10 @@ function normalizeToolCallInput(input, maxDepth = 3) {
 }
 
 // src/models/anthropic.ts
+var CLAUDE_CLIENT_HEADERS = {
+  "User-Agent": "claude-cli/2.1.0 (external, cli)",
+  "x-app": "cli"
+};
 var DEFAULT_MAX_OUTPUT_TOKENS = 32768;
 var MAX_CACHE_MARKERS = 4;
 function collectCacheMarkers(system, messages) {
@@ -7368,27 +7932,27 @@ function markLastBlock(message2) {
   };
   message2.content = blocks;
 }
-function updateInputUsage(snapshot2, usage) {
-  if (usage?.input_tokens != null) snapshot2.base = usage.input_tokens;
+function updateInputUsage(snapshot4, usage) {
+  if (usage?.input_tokens != null) snapshot4.base = usage.input_tokens;
   if (usage?.cache_creation_input_tokens != null) {
-    snapshot2.cacheCreation = usage.cache_creation_input_tokens;
+    snapshot4.cacheCreation = usage.cache_creation_input_tokens;
   }
   if (usage?.cache_read_input_tokens != null) {
-    snapshot2.cacheRead = usage.cache_read_input_tokens;
+    snapshot4.cacheRead = usage.cache_read_input_tokens;
   }
-  return snapshot2.base + snapshot2.cacheCreation + snapshot2.cacheRead;
+  return snapshot4.base + snapshot4.cacheCreation + snapshot4.cacheRead;
 }
-function formatCacheUsage(model, snapshot2, shape) {
-  const total = snapshot2.base + snapshot2.cacheCreation + snapshot2.cacheRead;
-  const hitRatio = total > 0 ? snapshot2.cacheRead / total : 0;
+function formatCacheUsage(model, snapshot4, shape) {
+  const total = snapshot4.base + snapshot4.cacheCreation + snapshot4.cacheRead;
+  const hitRatio = total > 0 ? snapshot4.cacheRead / total : 0;
   return JSON.stringify({
     event: "flavor-usage",
     sessionId: currentUsageSession(),
     provider: "anthropic",
     model,
-    inputTokens: snapshot2.base,
-    cacheReadTokens: snapshot2.cacheRead,
-    cacheCreationTokens: snapshot2.cacheCreation,
+    inputTokens: snapshot4.base,
+    cacheReadTokens: snapshot4.cacheRead,
+    cacheCreationTokens: snapshot4.cacheCreation,
     totalInputTokens: total,
     cacheHitRatio: Number(hitRatio.toFixed(4)),
     ...shape === void 0 ? {} : { requestMessages: shape.messages, requestMarkers: shape.markers }
@@ -7407,11 +7971,12 @@ var AnthropicModelAdapter = class {
     this.debugUsage = options.debugUsage ?? isEnvTruthy(process.env.FLAVOR_DEBUG_USAGE);
     this.client = options.client ?? new Anthropic({
       ...options.apiKey === void 0 ? {} : { apiKey: options.apiKey },
-      ...options.baseURL === void 0 ? {} : { baseURL: options.baseURL }
+      ...options.baseURL === void 0 ? {} : { baseURL: options.baseURL },
+      ...options.headers === void 0 ? {} : { defaultHeaders: options.headers }
     });
   }
-  #logUsage(request, snapshot2, shape) {
-    const line = formatCacheUsage(request.model, snapshot2, shape);
+  #logUsage(request, snapshot4, shape) {
+    const line = formatCacheUsage(request.model, snapshot4, shape);
     if (this.debugUsage) {
       try {
         process.stderr.write(`${line}
@@ -7490,7 +8055,7 @@ var AnthropicModelAdapter = class {
             source: {
               type: "base64",
               media_type: block.mediaType,
-              data: (await readFile8(block.source.path)).toString("base64")
+              data: (await readFile9(block.source.path)).toString("base64")
             }
           }));
           if (message2.cacheBreakpoint && Array.isArray(content) && content.length > 0) {
@@ -7672,7 +8237,7 @@ function resolveCacheProfile(input) {
 
 // src/models/openai.ts
 import OpenAI from "openai";
-import { readFile as readFile9 } from "fs/promises";
+import { readFile as readFile10 } from "fs/promises";
 async function toInput(message2) {
   if (message2.role === "tool") {
     if (!message2.toolCallId) throw new Error("Tool messages require toolCallId");
@@ -7684,7 +8249,7 @@ async function toInput(message2) {
   }
   const content = typeof message2.content === "string" ? message2.content : await Promise.all(message2.content.map(async (block) => block.type === "text" ? { type: "input_text", text: block.text } : {
     type: "input_image",
-    image_url: `data:${block.mediaType};base64,${(await readFile9(block.source.path)).toString("base64")}`,
+    image_url: `data:${block.mediaType};base64,${(await readFile10(block.source.path)).toString("base64")}`,
     detail: "auto"
   }));
   return [
@@ -7903,8 +8468,8 @@ var ModelRegistry = class {
 };
 
 // src/mcp/client.ts
-import { createHash as createHash3 } from "crypto";
-import { z as z13 } from "zod";
+import { createHash as createHash4 } from "crypto";
+import { z as z14 } from "zod";
 var McpManager = class {
   #workspace;
   #clientFactory;
@@ -8040,7 +8605,7 @@ async function listAllTools(client) {
 function createMcpToolDefinition(serverName, timeoutMs, client, remote) {
   if (remote.name.length === 0) throw new Error("MCP tool name must not be empty");
   if (!isRecord3(remote.inputSchema)) throw new Error(`MCP tool "${remote.name}" has no JSON object input schema`);
-  const inputSchema = z13.fromJSONSchema(
+  const inputSchema = z14.fromJSONSchema(
     remote.inputSchema
   );
   return {
@@ -8070,7 +8635,7 @@ function mcpToolName(serverName, remoteName) {
   const safe = remoteName.replace(/[^A-Za-z0-9_-]/g, "_") || "tool";
   const direct = `${prefix}${safe}`;
   if (direct.length <= 64 && safe === remoteName) return direct;
-  const suffix = `__${createHash3("sha256").update(remoteName).digest("hex").slice(0, 8)}`;
+  const suffix = `__${createHash4("sha256").update(remoteName).digest("hex").slice(0, 8)}`;
   return `${prefix}${safe.slice(0, Math.max(1, 64 - prefix.length - suffix.length))}${suffix}`;
 }
 function mcpErrorText(content) {
@@ -8089,7 +8654,7 @@ function isRecord3(value) {
 }
 
 // src/mcp/sdk.ts
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import {
   getDefaultEnvironment,
@@ -8111,7 +8676,7 @@ async function connectSdkMcpClient(input, dependencies = DEFAULT_DEPENDENCIES) {
     command: config.command,
     args: [...config.args],
     env: { ...dependencies.defaultEnvironment(), ...config.env },
-    cwd: resolve11(input.workspace, config.cwd ?? "."),
+    cwd: resolve12(input.workspace, config.cwd ?? "."),
     // MCP servers frequently log startup banners to stderr. Inheriting that
     // stream corrupts Ink's input area, so connection errors are surfaced
     // through McpManager diagnostics instead.
@@ -8136,14 +8701,14 @@ async function connectSdkMcpClient(input, dependencies = DEFAULT_DEPENDENCIES) {
 }
 
 // src/auth/oauth.ts
-import { randomBytes, createHash as createHash5 } from "crypto";
+import { randomBytes, createHash as createHash6 } from "crypto";
 import { createServer } from "http";
 import { URL as URL2, URLSearchParams } from "url";
 
 // src/auth/oauth-config.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function oauthCredentialId(tokenUrl, clientId) {
-  const digest = createHash4("sha256").update(`${tokenUrl}\0${clientId}`, "utf8").digest("base64url");
+  const digest = createHash5("sha256").update(`${tokenUrl}\0${clientId}`, "utf8").digest("base64url");
   return `oauth:${digest}`;
 }
 function parseOAuthLlmConfig(value) {
@@ -8316,8 +8881,8 @@ var OAuthCallbackAuthProvider = class {
   async #startCallbackServer(expectedState, signal) {
     let serverResolve;
     let serverReject;
-    const codePromise = new Promise((resolve22, reject) => {
-      serverResolve = resolve22;
+    const codePromise = new Promise((resolve25, reject) => {
+      serverResolve = resolve25;
       serverReject = reject;
     });
     const server = createServer((req, res) => {
@@ -8351,7 +8916,7 @@ var OAuthCallbackAuthProvider = class {
       );
       serverResolve(code);
     });
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve25, reject) => {
       server.once("error", (error) => {
         reject(new Error(`OAuth callback server failed: ${error.message}`));
       });
@@ -8368,7 +8933,7 @@ var OAuthCallbackAuthProvider = class {
         signal.addEventListener("abort", () => {
           serverReject(new Error("OAuth flow aborted"));
         }, { once: true });
-        resolve22({ redirectUri, promise: codePromise });
+        resolve25({ redirectUri, promise: codePromise });
       });
     });
   }
@@ -8400,7 +8965,7 @@ var OAuthCallbackAuthProvider = class {
     return randomBytes(32).toString("base64url");
   }
   #computeCodeChallenge(verifier) {
-    return createHash5("sha256").update(verifier).digest("base64url");
+    return createHash6("sha256").update(verifier).digest("base64url");
   }
   #generateState() {
     return randomBytes(32).toString("base64url");
@@ -8450,13 +9015,13 @@ function escapeHtml(text) {
 }
 
 // src/auth/store.ts
-import { dirname as dirname9 } from "path";
+import { dirname as dirname10 } from "path";
 function createFileTokenStore(filePath) {
   let baseline = {};
   const store = {
     tokens: {},
     async load() {
-      const key = await loadOrCreateConfigKey(dirname9(filePath));
+      const key = await loadOrCreateConfigKey(dirname10(filePath));
       const result = await readRecoverableFile(filePath, (raw) => parseTokens(decryptDocument(raw, key)));
       const tokens = result?.value ?? {};
       baseline = { ...tokens };
@@ -8464,7 +9029,7 @@ function createFileTokenStore(filePath) {
       return tokens;
     },
     async save(tokens) {
-      const key = await loadOrCreateConfigKey(dirname9(filePath));
+      const key = await loadOrCreateConfigKey(dirname10(filePath));
       const removals = Object.keys(baseline).filter((providerId) => !(providerId in tokens));
       const upserts = Object.fromEntries(Object.entries(tokens).filter(
         ([providerId, token]) => !sameToken(baseline[providerId], token)
@@ -8630,16 +9195,16 @@ function data(value) {
 
 // src/plugins/host.ts
 import { lstatSync, realpathSync as realpathSync2 } from "fs";
-import { lstat as lstat5, open as open5, readdir as readdir4, realpath as realpath3, stat as stat3, writeFile as writeFile6 } from "fs/promises";
-import { isAbsolute as isAbsolute5, relative as relative10, resolve as resolve12, sep as sep9 } from "path";
+import { lstat as lstat6, open as open5, readdir as readdir4, realpath as realpath4, stat as stat3, writeFile as writeFile6 } from "fs/promises";
+import { isAbsolute as isAbsolute6, relative as relative11, resolve as resolve13, sep as sep10 } from "path";
 import { pathToFileURL } from "url";
 
 // src/plugins/types.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 var PLUGIN_NAME = /^(?:@[a-z0-9][a-z0-9._-]{0,63}\/)?[a-z0-9][a-z0-9._-]{0,63}$/;
 var CONTRIBUTION_NAME = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
-var entry = z14.object({ name: z14.string().regex(CONTRIBUTION_NAME) }).strict();
-var uniqueArray = (schema, label, identify = (item) => String(item)) => z14.array(schema).max(256).superRefine((items, context) => {
+var entry = z15.object({ name: z15.string().regex(CONTRIBUTION_NAME) }).strict();
+var uniqueArray = (schema, label, identify = (item) => String(item)) => z15.array(schema).max(256).superRefine((items, context) => {
   const seen = /* @__PURE__ */ new Set();
   for (const [index, item] of items.entries()) {
     const key = identify(item);
@@ -8647,17 +9212,17 @@ var uniqueArray = (schema, label, identify = (item) => String(item)) => z14.arra
     seen.add(key);
   }
 });
-var PluginManifestSchema = z14.object({
-  name: z14.string().regex(PLUGIN_NAME),
-  version: z14.string().min(1).max(64),
-  apiVersion: z14.literal("1"),
-  main: z14.string().min(1).max(512),
-  permissions: uniqueArray(z14.enum(["filesystem:read", "filesystem:write"]), "permission").max(16),
-  contributes: z14.object({
+var PluginManifestSchema = z15.object({
+  name: z15.string().regex(PLUGIN_NAME),
+  version: z15.string().min(1).max(64),
+  apiVersion: z15.literal("1"),
+  main: z15.string().min(1).max(512),
+  permissions: uniqueArray(z15.enum(["filesystem:read", "filesystem:write"]), "permission").max(16),
+  contributes: z15.object({
     commands: uniqueArray(entry, "command contribution", (item) => item.name),
     tools: uniqueArray(entry, "tool contribution", (item) => item.name),
-    hooks: uniqueArray(z14.object({ name: z14.enum(HOOK_EVENT_NAMES) }).strict(), "hook contribution", (item) => item.name),
-    skillRoots: uniqueArray(entry.extend({ path: z14.string().min(1).max(512) }).strict(), "skill-root contribution", (item) => item.name),
+    hooks: uniqueArray(z15.object({ name: z15.enum(HOOK_EVENT_NAMES) }).strict(), "hook contribution", (item) => item.name),
+    skillRoots: uniqueArray(entry.extend({ path: z15.string().min(1).max(512) }).strict(), "skill-root contribution", (item) => item.name),
     modelAdapters: uniqueArray(entry, "model-adapter contribution", (item) => item.name)
   }).strict()
 }).strict();
@@ -8749,7 +9314,7 @@ var PluginHost = class {
     const roots = [];
     for (const directory of directories) {
       try {
-        for (const entry2 of await readdir4(directory, { withFileTypes: true })) if (entry2.isDirectory()) roots.push(resolve12(directory, entry2.name));
+        for (const entry2 of await readdir4(directory, { withFileTypes: true })) if (entry2.isDirectory()) roots.push(resolve13(directory, entry2.name));
       } catch (error) {
         this.#diagnose(directory, error, directory);
       }
@@ -8779,10 +9344,10 @@ var PluginHost = class {
   async #readCandidate(inputRoot, source, label = inputRoot) {
     let diagnosticLabel = label;
     try {
-      const rootInfo = await lstat5(inputRoot);
+      const rootInfo = await lstat6(inputRoot);
       if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) throw new Error("Plugin root must be a static directory");
-      const root = await realpath3(inputRoot);
-      const rawManifest = await readManifest(resolve12(root, MANIFEST));
+      const root = await realpath4(inputRoot);
+      const rawManifest = await readManifest(resolve13(root, MANIFEST));
       if (typeof rawManifest === "object" && rawManifest !== null && "name" in rawManifest && typeof rawManifest.name === "string") {
         diagnosticLabel = rawManifest.name;
       }
@@ -8881,7 +9446,7 @@ var PluginHost = class {
       assertActive();
       const permission = `filesystem:${operation}`;
       if (!manifest.permissions.includes(permission)) throw new Error(`Plugin ${manifest.name} lacks ${permission} permission`);
-      const path = resolve12(rawPath);
+      const path = resolve13(rawPath);
       const authorized = await this.#options.authorizeFilesystem?.({ plugin: manifest.name, operation, path });
       assertActive();
       if (authorized !== true) throw new Error(`Filesystem ${operation} denied for plugin ${manifest.name}`);
@@ -8922,8 +9487,8 @@ var PluginHost = class {
         if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`Skill root "${name}" must be a static directory`);
         const physical = realpathSync2.native(registered);
         assertContained(candidate.root, physical, "Skill root");
-        const snapshot2 = fromStats(info);
-        const capability = Object.freeze({ path: physical, identity: Object.freeze(pickIdentity(snapshot2)) });
+        const snapshot4 = fromStats(info);
+        const capability = Object.freeze({ path: physical, identity: Object.freeze(pickIdentity(snapshot4)) });
         return register("skillRoot", name, [capability]);
       },
       registerModelAdapter: (name, value) => register("modelAdapter", name, [value])
@@ -8949,7 +9514,7 @@ var PluginHost = class {
   }
 };
 async function readManifest(path) {
-  const lexical = await lstat5(path, { bigint: true });
+  const lexical = await lstat6(path, { bigint: true });
   if (!lexical.isFile() || lexical.isSymbolicLink()) throw new Error("Plugin manifest must be a static regular file");
   const handle = await open5(path, "r");
   try {
@@ -8966,7 +9531,7 @@ async function readManifest(path) {
     if (bytesRead > MAX_MANIFEST_BYTES2) throw new Error(`Plugin manifest exceeds ${MAX_MANIFEST_BYTES2} bytes`);
     const after = fromStats(await handle.stat({ bigint: true }));
     assertSnapshot(before, after, "Plugin manifest");
-    const current = fromStats(await lstat5(path, { bigint: true }));
+    const current = fromStats(await lstat6(path, { bigint: true }));
     assertSnapshot(before, current, "Plugin manifest path");
     return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, bytesRead)));
   } finally {
@@ -8974,9 +9539,9 @@ async function readManifest(path) {
   }
 }
 async function snapshotEntry(root, entry2) {
-  const lexicalStats = await lstat5(entry2, { bigint: true });
+  const lexicalStats = await lstat6(entry2, { bigint: true });
   if (!lexicalStats.isFile() && !lexicalStats.isSymbolicLink()) throw new Error("Plugin entry must be a file");
-  const physicalPath = await realpath3(entry2);
+  const physicalPath = await realpath4(entry2);
   assertContained(root, physicalPath, "Plugin entry symlink");
   const physicalStats = await stat3(physicalPath, { bigint: true });
   if (!physicalStats.isFile()) throw new Error("Plugin entry must resolve to a regular file");
@@ -9005,21 +9570,21 @@ function contributionNames(manifest, kind) {
 function fromStats(stats) {
   return { dev: stats.dev, ino: stats.ino, mode: stats.mode, size: stats.size, mtimeNs: stats.mtimeNs, ctimeNs: stats.ctimeNs };
 }
-function pickIdentity(snapshot2) {
-  return { dev: snapshot2.dev, ino: snapshot2.ino, mtimeNs: snapshot2.mtimeNs, ctimeNs: snapshot2.ctimeNs };
+function pickIdentity(snapshot4) {
+  return { dev: snapshot4.dev, ino: snapshot4.ino, mtimeNs: snapshot4.mtimeNs, ctimeNs: snapshot4.ctimeNs };
 }
 function assertSnapshot(expected, actual, label) {
   for (const key of ["dev", "ino", "mode", "size", "mtimeNs", "ctimeNs"]) if (expected[key] !== actual[key]) throw new Error(`${label} changed during validation`);
 }
 function resolveContained(root, value, label) {
-  if (isAbsolute5(value)) throw new Error(`${label} must be relative to the plugin root`);
-  const candidate = resolve12(root, value);
+  if (isAbsolute6(value)) throw new Error(`${label} must be relative to the plugin root`);
+  const candidate = resolve13(root, value);
   assertContained(root, candidate, label);
   return candidate;
 }
 function assertContained(root, candidate, label) {
-  const delta = relative10(root, candidate);
-  if (delta === ".." || delta.startsWith(`..${sep9}`) || isAbsolute5(delta)) throw new Error(`${label} escapes the plugin root`);
+  const delta = relative11(root, candidate);
+  if (delta === ".." || delta.startsWith(`..${sep10}`) || isAbsolute6(delta)) throw new Error(`${label} escapes the plugin root`);
 }
 function scopedLogger(logger, plugin) {
   const prefix = `[plugin:${plugin}] `;
@@ -9063,8 +9628,8 @@ function compare(left, right) {
 
 // src/skills/registry.ts
 import { constants as constants3 } from "fs";
-import { lstat as lstat6, open as defaultOpen, readdir as readdir5, realpath as realpath4 } from "fs/promises";
-import { isAbsolute as isAbsolute6, relative as relative11, resolve as resolve13, sep as sep10 } from "path";
+import { lstat as lstat7, open as defaultOpen, readdir as readdir5, realpath as realpath5 } from "fs/promises";
+import { isAbsolute as isAbsolute7, relative as relative12, resolve as resolve14, sep as sep11 } from "path";
 import { marked } from "marked";
 import { parseDocument } from "yaml";
 var SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -9189,13 +9754,13 @@ var SkillRegistry = class {
     const record = await this.#recordFor(skill);
     const normalized = normalizeReference(reference);
     const parts = normalized.split("/");
-    if (isAbsolute6(reference) || parts.includes("..") || parts.length !== 2 || !RESOURCE_DIRECTORIES.has(parts[0] ?? "") || !RESOURCE_NAME.test(parts[1] ?? "")) {
+    if (isAbsolute7(reference) || parts.includes("..") || parts.length !== 2 || !RESOURCE_DIRECTORIES.has(parts[0] ?? "") || !RESOURCE_NAME.test(parts[1] ?? "")) {
       throw new Error(`Resource reference escapes the skill root or is not a direct resource: ${reference}`);
     }
     const body = await this.loadBody(record.metadata);
     const references = extractResourceReferences(body);
     if (!references.has(normalized)) throw new Error(`Skill resource is not directly referenced: ${reference}`);
-    const candidate = resolve13(record.metadata.root, ...parts);
+    const candidate = resolve14(record.metadata.root, ...parts);
     const file = await openVerifiedFile(candidate, record.metadata.root, "Resource", this.#options.openFile);
     try {
       if (file.snapshot.size > BigInt(this.#options.maxResourceBytes)) throw new Error(`Skill resource is too large: ${reference}`);
@@ -9224,13 +9789,13 @@ var SkillRegistry = class {
   async #discoverSource(roots, source) {
     const found = [];
     for (const configuredRoot of roots) {
-      const root = resolve13(configuredRoot);
+      const root = resolve14(configuredRoot);
       let entries;
       let physicalRoot = root;
       try {
-        const rootInfo = await lstat6(root);
+        const rootInfo = await lstat7(root);
         if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) throw new Error("Skill root must be a real directory");
-        physicalRoot = await realpath4(root);
+        physicalRoot = await realpath5(root);
         entries = await readdir5(root, { withFileTypes: true });
       } catch (error) {
         if (isMissing2(error)) continue;
@@ -9239,13 +9804,13 @@ var SkillRegistry = class {
       }
       entries.sort((left, right) => compareCodePoints(left.name, right.name));
       for (const entry2 of entries) {
-        const skillRoot = resolve13(root, entry2.name);
+        const skillRoot = resolve14(root, entry2.name);
         try {
           if (entry2.isSymbolicLink()) throw new Error("Symlinked skill directories are not allowed");
           if (!entry2.isDirectory()) continue;
-          const physicalSkillRoot = await realpath4(skillRoot);
+          const physicalSkillRoot = await realpath5(skillRoot);
           if (!isWithin3(physicalRoot, physicalSkillRoot)) throw new Error("Skill directory escapes its registry root");
-          const skillFile = resolve13(skillRoot, "SKILL.md");
+          const skillFile = resolve14(skillRoot, "SKILL.md");
           const parsed = await readFrontmatterFile(
             skillFile,
             physicalSkillRoot,
@@ -9382,10 +9947,10 @@ async function openFile(path, flags) {
   return defaultOpen(path, flags);
 }
 async function openVerifiedFile(path, root, label, opener, expected) {
-  const initial = await lstat6(path, { bigint: true });
+  const initial = await lstat7(path, { bigint: true });
   if (initial.isSymbolicLink()) throw new Error(`${label} symlinks are not allowed`);
   assertRegular(initial, label);
-  const canonical3 = await realpath4(path);
+  const canonical3 = await realpath5(path);
   if (!isWithin3(root, canonical3)) throw new Error(`${label} escapes the skill root`);
   const noFollow = typeof constants3.O_NOFOLLOW === "number" ? constants3.O_NOFOLLOW : 0;
   const handle = await opener(canonical3, constants3.O_RDONLY | noFollow);
@@ -9446,8 +10011,8 @@ function decodeUtf82(content, label) {
   }
 }
 function isWithin3(root, candidate) {
-  const delta = relative11(root, candidate);
-  return delta === "" || delta !== ".." && !delta.startsWith(`..${sep10}`) && !isAbsolute6(delta);
+  const delta = relative12(root, candidate);
+  return delta === "" || delta !== ".." && !delta.startsWith(`..${sep11}`) && !isAbsolute7(delta);
 }
 function isMissing2(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
@@ -9494,10 +10059,10 @@ function score(metadata, query) {
 }
 
 // src/skills/tool.ts
-import { z as z15 } from "zod";
-var SkillResourceInput = z15.object({
-  skill: z15.string().min(1),
-  reference: z15.string().min(1)
+import { z as z16 } from "zod";
+var SkillResourceInput = z16.object({
+  skill: z16.string().min(1),
+  reference: z16.string().min(1)
 }).strict();
 function createSkillResourceTool(registry) {
   return {
@@ -9524,97 +10089,97 @@ function createSkillResourceTool(registry) {
 
 // src/session/store.ts
 import { constants as constants4 } from "fs";
-import { lstat as lstat7, mkdir as mkdir9, open as open6, readFile as readFile10, readdir as readdir6, realpath as realpath5, rename as rename5, rm as rm4, stat as stat4 } from "fs/promises";
-import { basename as basename3, dirname as dirname10, join as join12, relative as relative12, resolve as resolve14, sep as sep11 } from "path";
+import { lstat as lstat8, mkdir as mkdir9, open as open6, readFile as readFile11, readdir as readdir6, realpath as realpath6, rename as rename5, rm as rm4, stat as stat4 } from "fs/promises";
+import { basename as basename3, dirname as dirname11, join as join12, relative as relative13, resolve as resolve15, sep as sep12 } from "path";
 import { randomUUID as randomUUID6 } from "crypto";
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var SESSION_VERSION = 3;
 var DEFAULT_MAX_SESSION_BYTES = 5 * 1024 * 1024;
-var SessionIdSchema = z16.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/, "Invalid session id");
-var IsoDateSchema = z16.string().datetime({ offset: true });
-var ToolCallSchema = z16.object({
-  id: z16.string().min(1).max(256),
-  name: z16.string().min(1).max(256),
-  input: z16.unknown()
+var SessionIdSchema = z17.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/, "Invalid session id");
+var IsoDateSchema = z17.string().datetime({ offset: true });
+var ToolCallSchema = z17.object({
+  id: z17.string().min(1).max(256),
+  name: z17.string().min(1).max(256),
+  input: z17.unknown()
 }).strict();
-var TextContentBlockSchema = z16.object({
-  type: z16.literal("text"),
-  text: z16.string().max(DEFAULT_MAX_SESSION_BYTES)
+var TextContentBlockSchema = z17.object({
+  type: z17.literal("text"),
+  text: z17.string().max(DEFAULT_MAX_SESSION_BYTES)
 }).strict();
-var ImageContentBlockSchema = z16.object({
-  type: z16.literal("image"),
-  source: z16.object({ type: z16.literal("file"), path: z16.string().min(1).max(32768) }).strict(),
-  mediaType: z16.enum(["image/png", "image/jpeg", "image/webp"]),
-  sha256: z16.string().regex(/^[a-f0-9]{64}$/),
-  bytes: z16.number().int().positive().max(20 * 1024 * 1024),
-  name: z16.string().min(1).max(255).optional()
+var ImageContentBlockSchema = z17.object({
+  type: z17.literal("image"),
+  source: z17.object({ type: z17.literal("file"), path: z17.string().min(1).max(32768) }).strict(),
+  mediaType: z17.enum(["image/png", "image/jpeg", "image/webp"]),
+  sha256: z17.string().regex(/^[a-f0-9]{64}$/),
+  bytes: z17.number().int().positive().max(20 * 1024 * 1024),
+  name: z17.string().min(1).max(255).optional()
 }).strict();
-var UserContentSchema = z16.union([
-  z16.string().max(DEFAULT_MAX_SESSION_BYTES),
-  z16.array(z16.discriminatedUnion("type", [TextContentBlockSchema, ImageContentBlockSchema])).min(1).max(100)
+var UserContentSchema = z17.union([
+  z17.string().max(DEFAULT_MAX_SESSION_BYTES),
+  z17.array(z17.discriminatedUnion("type", [TextContentBlockSchema, ImageContentBlockSchema])).min(1).max(100)
 ]);
 var MessageMetadataShape = {
-  toolCallId: z16.string().min(1).max(256).optional(),
-  toolCalls: z16.array(ToolCallSchema).max(1e3).optional()
+  toolCallId: z17.string().min(1).max(256).optional(),
+  toolCalls: z17.array(ToolCallSchema).max(1e3).optional()
 };
-var MessageSchema = z16.discriminatedUnion("role", [
-  z16.object({ role: z16.literal("user"), content: UserContentSchema, ...MessageMetadataShape }).strict(),
-  z16.object({ role: z16.literal("assistant"), content: z16.string().max(DEFAULT_MAX_SESSION_BYTES), ...MessageMetadataShape }).strict(),
-  z16.object({ role: z16.literal("tool"), content: z16.string().max(DEFAULT_MAX_SESSION_BYTES), ...MessageMetadataShape }).strict()
+var MessageSchema = z17.discriminatedUnion("role", [
+  z17.object({ role: z17.literal("user"), content: UserContentSchema, ...MessageMetadataShape }).strict(),
+  z17.object({ role: z17.literal("assistant"), content: z17.string().max(DEFAULT_MAX_SESSION_BYTES), ...MessageMetadataShape }).strict(),
+  z17.object({ role: z17.literal("tool"), content: z17.string().max(DEFAULT_MAX_SESSION_BYTES), ...MessageMetadataShape }).strict()
 ]);
-var LegacySummarySchema = z16.object({ role: z16.literal("system"), content: z16.string().max(DEFAULT_MAX_SESSION_BYTES) }).strict();
-var CompactBoundarySchema = z16.object({
-  summary: z16.string().min(1).max(DEFAULT_MAX_SESSION_BYTES),
+var LegacySummarySchema = z17.object({ role: z17.literal("system"), content: z17.string().max(DEFAULT_MAX_SESSION_BYTES) }).strict();
+var CompactBoundarySchema = z17.object({
+  summary: z17.string().min(1).max(DEFAULT_MAX_SESSION_BYTES),
   compactedAt: IsoDateSchema
 }).strict();
-var StateSchema = z16.enum(["pending", "running", "completed", "failed", "blocked", "cancelled"]);
-var MemoryLifecycleSchema = z16.object({
-  status: z16.enum(["active", "completed", "abandoned"]),
-  taskId: z16.string().regex(/^memory-[A-Za-z0-9._-]{1,120}$/).optional(),
-  messageStart: z16.number().int().min(0).max(5e4).optional(),
+var StateSchema = z17.enum(["pending", "running", "completed", "failed", "blocked", "cancelled"]);
+var MemoryLifecycleSchema = z17.object({
+  status: z17.enum(["active", "completed", "abandoned"]),
+  taskId: z17.string().regex(/^memory-[A-Za-z0-9._-]{1,120}$/).optional(),
+  messageStart: z17.number().int().min(0).max(5e4).optional(),
   finalizedAt: IsoDateSchema.optional(),
-  transcriptHash: z16.string().regex(/^[a-f0-9]{64}$/).optional()
+  transcriptHash: z17.string().regex(/^[a-f0-9]{64}$/).optional()
 }).strict();
-var SessionBaseSchema = z16.object({
+var SessionBaseSchema = z17.object({
   sessionId: SessionIdSchema,
   createdAt: IsoDateSchema,
   updatedAt: IsoDateSchema,
-  workspace: z16.object({ path: z16.string().min(1).max(32768) }).strict(),
-  tasks: z16.object({
+  workspace: z17.object({ path: z17.string().min(1).max(32768) }).strict(),
+  tasks: z17.object({
     plan: TaskPlanSchema.optional(),
     graph: TaskGraphSchema.optional(),
-    states: z16.record(z16.string(), StateSchema),
-    results: z16.record(z16.string(), SubagentResultSchema)
+    states: z17.record(z17.string(), StateSchema),
+    results: z17.record(z17.string(), SubagentResultSchema)
   }).strict(),
-  models: z16.object({ main: z16.string().min(1).max(1024), subagent: z16.string().min(1).max(1024) }).strict(),
+  models: z17.object({ main: z17.string().min(1).max(1024), subagent: z17.string().min(1).max(1024) }).strict(),
   permissionMode: PermissionModeSchema,
   memory: MemoryLifecycleSchema.optional()
 }).strict();
 var SessionDocumentV1Schema = SessionBaseSchema.extend({
-  version: z16.literal(1),
-  conversation: z16.object({
+  version: z17.literal(1),
+  conversation: z17.object({
     summary: LegacySummarySchema.optional(),
-    messages: z16.array(MessageSchema).max(5e4)
+    messages: z17.array(MessageSchema).max(5e4)
   }).strict()
 }).strict();
-var ConversationSchema = z16.object({
+var ConversationSchema = z17.object({
   compact: CompactBoundarySchema.optional(),
-  messages: z16.array(MessageSchema).max(5e4)
+  messages: z17.array(MessageSchema).max(5e4)
 }).strict();
 var SessionDocumentV2Schema = SessionBaseSchema.extend({
-  version: z16.literal(2),
+  version: z17.literal(2),
   conversation: ConversationSchema
 }).strict();
-var TranscriptStateSchema = z16.custom(isTranscriptState, "Invalid transcript state");
-var TimelineSchema = z16.object({
-  version: z16.literal(1),
+var TranscriptStateSchema = z17.custom(isTranscriptState, "Invalid transcript state");
+var TimelineSchema = z17.object({
+  version: z17.literal(1),
   state: TranscriptStateSchema
 }).strict();
 var SessionDocumentSchema = SessionBaseSchema.extend({
-  version: z16.literal(SESSION_VERSION),
-  conversation: z16.object({
+  version: z17.literal(SESSION_VERSION),
+  conversation: z17.object({
     compact: CompactBoundarySchema.optional(),
-    messages: z16.array(MessageSchema).max(5e4)
+    messages: z17.array(MessageSchema).max(5e4)
   }).strict(),
   timeline: TimelineSchema
 }).strict();
@@ -9624,7 +10189,7 @@ var SessionStore = class {
   #maxBytes;
   #maxSessions;
   constructor(options) {
-    this.#workspace = resolve14(options.workspace);
+    this.#workspace = resolve15(options.workspace);
     this.#sessions = join12(this.#workspace, ".flavor", "sessions");
     this.#maxBytes = options.maxBytes ?? DEFAULT_MAX_SESSION_BYTES;
     if (!Number.isSafeInteger(this.#maxBytes) || this.#maxBytes < 256) throw new Error("maxBytes must be an integer of at least 256");
@@ -9761,7 +10326,7 @@ var SessionStore = class {
     }
     const path = this.#path(sessionId);
     try {
-      const metadata = await lstat7(path);
+      const metadata = await lstat8(path);
       if (!metadata.isFile()) throw new Error("Session path is not a regular file");
       await rm4(path);
     } catch (error) {
@@ -9770,7 +10335,7 @@ var SessionStore = class {
   }
   #path(sessionId) {
     SessionIdSchema.parse(sessionId);
-    const path = resolve14(this.#sessions, `${sessionId}.jsonl`);
+    const path = resolve15(this.#sessions, `${sessionId}.jsonl`);
     if (!isWithin4(this.#sessions, path)) throw new Error("Invalid session id");
     return path;
   }
@@ -9790,14 +10355,14 @@ var SessionStore = class {
     }
   }
   async #prepareDirectory() {
-    await assertNoSymlink3(this.#workspace, dirname10(this.#sessions));
+    await assertNoSymlink3(this.#workspace, dirname11(this.#sessions));
     await mkdir9(this.#sessions, { recursive: true, mode: 448 });
     await this.#assertSafeExistingDirectory();
   }
   async #assertSafeExistingDirectory() {
     await assertNoSymlink3(this.#workspace, this.#sessions);
-    const canonicalRoot = await realpath5(this.#workspace);
-    const canonicalSessions = await realpath5(this.#sessions);
+    const canonicalRoot = await realpath6(this.#workspace);
+    const canonicalSessions = await realpath6(this.#sessions);
     if (!isWithin4(canonicalRoot, canonicalSessions)) throw new Error("Session directory escapes the workspace");
   }
   async #quarantine(path) {
@@ -9810,7 +10375,7 @@ async function boundedRead(path, maxBytes) {
   const metadata = await stat4(path);
   if (!metadata.isFile()) throw new Error("Session path is not a regular file");
   if (metadata.size > maxBytes) throw new Error(`Session exceeds maximum read size of ${maxBytes} bytes`);
-  const value = await readFile10(path);
+  const value = await readFile11(path);
   if (value.byteLength > maxBytes) throw new Error(`Session exceeds maximum read size of ${maxBytes} bytes`);
   return value.toString("utf8");
 }
@@ -9948,31 +10513,31 @@ function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function assertNoSymlink3(root, target) {
-  let cursor = resolve14(target);
-  const stop = resolve14(root);
+  let cursor = resolve15(target);
+  const stop = resolve15(root);
   if (!isWithin4(stop, cursor)) throw new Error("Session path escapes the workspace");
   const chain = [];
   while (cursor !== stop) {
     chain.push(cursor);
-    cursor = dirname10(cursor);
+    cursor = dirname11(cursor);
   }
   for (const path of chain.reverse()) {
     try {
-      if ((await lstat7(path)).isSymbolicLink()) throw new Error(`Session path contains a symbolic link: ${path}`);
+      if ((await lstat8(path)).isSymbolicLink()) throw new Error(`Session path contains a symbolic link: ${path}`);
     } catch (error) {
       if (!isCode6(error, "ENOENT")) throw error;
     }
   }
 }
 function isWithin4(root, path) {
-  const value = relative12(resolve14(root), resolve14(path));
-  return value === "" || !value.startsWith(`..${sep11}`) && value !== ".." && !value.includes(":");
+  const value = relative13(resolve15(root), resolve15(path));
+  return value === "" || !value.startsWith(`..${sep12}`) && value !== ".." && !value.includes(":");
 }
 async function canonical2(path) {
   try {
-    return await realpath5(resolve14(path));
+    return await realpath6(resolve15(path));
   } catch {
-    return resolve14(path);
+    return resolve15(path);
   }
 }
 function isCode6(error, code) {
@@ -9999,45 +10564,45 @@ function sanitize2(input, seen = /* @__PURE__ */ new WeakSet()) {
 // src/sleep/organizer.ts
 import { constants as constants5 } from "fs";
 import { randomUUID as randomUUID7 } from "crypto";
-import { lstat as lstat8, mkdir as mkdir10, open as open7, readdir as readdir7, realpath as realpath6, rename as rename6, rm as rm5 } from "fs/promises";
-import { isAbsolute as isAbsolute7, join as join13, relative as relative13, resolve as resolve15, sep as sep12 } from "path";
-import { z as z17 } from "zod";
-var DateKeySchema = z17.string().regex(/^\d{4}-\d{2}-\d{2}$/);
-var ReviewSchema = z17.object({
-  title: z17.string().min(1).max(120),
-  taskSummary: z17.array(z17.string().min(1)).min(1).max(20),
-  executionReflection: z17.array(z17.string().min(1)).min(1).max(20),
-  decisionsAndLearnings: z17.array(z17.string().min(1)).max(20),
-  openQuestionsAndRisks: z17.array(z17.string().min(1)).max(20),
-  tomorrowPlan: z17.array(z17.string().min(1)).min(1).max(20),
-  toolUsage: z17.object({
-    totalCalls: z17.number().int().min(0),
-    shell: z17.number().int().min(0),
-    fileRead: z17.number().int().min(0),
-    fileWrite: z17.number().int().min(0),
-    search: z17.number().int().min(0),
-    lsp: z17.number().int().min(0),
-    subagent: z17.number().int().min(0),
-    other: z17.number().int().min(0)
+import { lstat as lstat9, mkdir as mkdir10, open as open7, readdir as readdir7, realpath as realpath7, rename as rename6, rm as rm5 } from "fs/promises";
+import { isAbsolute as isAbsolute8, join as join13, relative as relative14, resolve as resolve16, sep as sep13 } from "path";
+import { z as z18 } from "zod";
+var DateKeySchema = z18.string().regex(/^\d{4}-\d{2}-\d{2}$/);
+var ReviewSchema = z18.object({
+  title: z18.string().min(1).max(120),
+  taskSummary: z18.array(z18.string().min(1)).min(1).max(20),
+  executionReflection: z18.array(z18.string().min(1)).min(1).max(20),
+  decisionsAndLearnings: z18.array(z18.string().min(1)).max(20),
+  openQuestionsAndRisks: z18.array(z18.string().min(1)).max(20),
+  tomorrowPlan: z18.array(z18.string().min(1)).min(1).max(20),
+  toolUsage: z18.object({
+    totalCalls: z18.number().int().min(0),
+    shell: z18.number().int().min(0),
+    fileRead: z18.number().int().min(0),
+    fileWrite: z18.number().int().min(0),
+    search: z18.number().int().min(0),
+    lsp: z18.number().int().min(0),
+    subagent: z18.number().int().min(0),
+    other: z18.number().int().min(0)
   }).strict(),
-  tokenEstimate: z17.object({
-    estimatedInput: z17.number().int().min(0),
-    estimatedOutput: z17.number().int().min(0),
-    notes: z17.string().max(200)
+  tokenEstimate: z18.object({
+    estimatedInput: z18.number().int().min(0),
+    estimatedOutput: z18.number().int().min(0),
+    notes: z18.string().max(200)
   }).strict(),
-  humanIntervention: z17.object({
-    approvalRequests: z17.number().int().min(0),
-    questionsAsked: z17.number().int().min(0),
-    summary: z17.string().max(300)
+  humanIntervention: z18.object({
+    approvalRequests: z18.number().int().min(0),
+    questionsAsked: z18.number().int().min(0),
+    summary: z18.string().max(300)
   }).strict(),
-  qualityIndicators: z17.object({
-    hallucinationAlerts: z17.array(z17.string().min(1)).max(10),
-    failuresAndRetries: z17.array(z17.string().min(1)).max(10),
-    codeChangeSummary: z17.string().max(500),
-    overallAssessment: z17.string().max(200)
+  qualityIndicators: z18.object({
+    hallucinationAlerts: z18.array(z18.string().min(1)).max(10),
+    failuresAndRetries: z18.array(z18.string().min(1)).max(10),
+    codeChangeSummary: z18.string().max(500),
+    overallAssessment: z18.string().max(200)
   }).strict(),
-  knowledgeDeposits: z17.object({
-    worthRemembering: z17.array(z17.string().min(1)).max(10)
+  knowledgeDeposits: z18.object({
+    worthRemembering: z18.array(z18.string().min(1)).max(10)
   }).strict()
 }).strict();
 function localDateKey(date) {
@@ -10054,7 +10619,7 @@ var ProjectSleepOrganizer = class {
   #sessions;
   #generate;
   constructor(options) {
-    this.#workspace = resolve15(options.workspace);
+    this.#workspace = resolve16(options.workspace);
     this.#sleepDirectory = join13(this.#workspace, ".flavor", "sleep");
     this.#sessions = options.sessions ?? new SessionStore({ workspace: this.#workspace });
     this.#generate = options.generate;
@@ -10146,8 +10711,8 @@ Previous output was invalid. Repair it and return strict JSON only.`;
     await mkdir10(flavorDirectory, { recursive: true, mode: 448 });
     await assertNotSymlink(this.#sleepDirectory);
     await mkdir10(this.#sleepDirectory, { recursive: true, mode: 448 });
-    const root = await realpath6(this.#workspace);
-    const target = await realpath6(this.#sleepDirectory);
+    const root = await realpath7(this.#workspace);
+    const target = await realpath7(this.#sleepDirectory);
     if (!isWithin5(root, target)) throw new Error("Sleep directory escapes the workspace");
   }
   async #hasReport(date) {
@@ -10471,16 +11036,16 @@ function assertDateKey(value) {
 }
 async function assertNotSymlink(path) {
   try {
-    if ((await lstat8(path)).isSymbolicLink()) throw new Error(`Refusing to use symbolic link: ${path}`);
+    if ((await lstat9(path)).isSymbolicLink()) throw new Error(`Refusing to use symbolic link: ${path}`);
   } catch (error) {
     if (!hasCode(error, "ENOENT")) throw error;
   }
 }
 function isWithin5(root, candidate) {
-  const path = relative13(root, candidate);
+  const path = relative14(root, candidate);
   if (path === "") return true;
-  if (path === ".." || path.startsWith(`..${sep12}`) || isAbsolute7(path)) return false;
-  return process.platform !== "win32" || resolve15(root, path).toLowerCase().startsWith(`${resolve15(root).toLowerCase()}${sep12}`);
+  if (path === ".." || path.startsWith(`..${sep13}`) || isAbsolute8(path)) return false;
+  return process.platform !== "win32" || resolve16(root, path).toLowerCase().startsWith(`${resolve16(root).toLowerCase()}${sep13}`);
 }
 function hasCode(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
@@ -10529,10 +11094,10 @@ function computeSessionStats(documents) {
 
 // src/tools/files.ts
 import { constants as constants6 } from "fs";
-import { mkdir as mkdir11, open as open8, readFile as readFile11, realpath as realpath7, rename as rename7, rm as rm6, stat as stat5 } from "fs/promises";
-import { dirname as dirname11, isAbsolute as isAbsolute8, relative as relative14, resolve as resolve16, sep as sep13 } from "path";
+import { mkdir as mkdir11, open as open8, readFile as readFile12, realpath as realpath8, rename as rename7, rm as rm6, stat as stat5 } from "fs/promises";
+import { dirname as dirname12, isAbsolute as isAbsolute9, relative as relative15, resolve as resolve17, sep as sep14 } from "path";
 import { randomUUID as randomUUID8 } from "crypto";
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 
 // src/tools/file-diff.ts
 var MAX_DIFF_PREVIEW_LINES = 120;
@@ -10638,18 +11203,34 @@ function truncateLines(lines) {
 
 // src/tools/files.ts
 var MAX_READ_BYTES = 1048576;
-var ReadInput = z18.object({
-  path: z18.string().min(1),
-  maxBytes: z18.coerce.number().int().positive().max(MAX_READ_BYTES).nullable().optional(),
-  startLine: z18.coerce.number().int().positive().nullable().optional(),
-  endLine: z18.coerce.number().int().positive().nullable().optional(),
+var ReadInput2 = z19.object({
+  path: z19.string().min(1),
+  maxBytes: z19.coerce.number().int().positive().max(MAX_READ_BYTES).nullable().optional(),
+  startLine: z19.coerce.number().int().positive().nullable().optional(),
+  endLine: z19.coerce.number().int().positive().nullable().optional(),
   // Accepts booleans and their string forms (weak-typed models emit "true");
   // kept transform-free so the schema converts to JSON Schema for providers.
-  force: z18.union([z18.boolean(), z18.string().refine((value) => value === "true" || value === "false")]).nullable().optional()
+  force: z19.union([z19.boolean(), z19.string().refine((value) => value === "true" || value === "false")]).nullable().optional()
 });
-var WriteInput = z18.object({ path: z18.string().min(1), content: z18.string() });
-var EditInput = z18.object({ path: z18.string().min(1), oldText: z18.string().min(1), newText: z18.string() });
-var ApplyPatchInput = z18.object({ patch: z18.string().min(1) });
+var WriteInput = z19.object({ path: z19.string().min(1), content: z19.string() });
+var EditInput = z19.object({ path: z19.string().min(1), oldText: z19.string().min(1), newText: z19.string() });
+var ApplyPatchInput = z19.object({ patch: z19.string().min(1) });
+var FileObservationStore = class {
+  #versions = /* @__PURE__ */ new Map();
+  get(path) {
+    return this.#versions.get(path);
+  }
+  set(path, version) {
+    this.#versions.set(path, version);
+  }
+  async refresh(path) {
+    this.set(path, await fileVersion(path));
+  }
+  async assertCurrent(path, expected) {
+    const current = await fileVersion(path);
+    if (current !== expected) throw new Error(`Stale file: ${path} changed since it was read; read it again before writing`);
+  }
+};
 function createReadTool(workspace, options = {}) {
   const guard = createPathGuard(workspace);
   const openFile2 = options.openFile ?? ((path) => open8(path, constants6.O_RDONLY));
@@ -10657,7 +11238,7 @@ function createReadTool(workspace, options = {}) {
   return {
     name: "Read",
     description: "Read a UTF-8 text file, optionally restricted to a line range with startLine/endLine",
-    inputSchema: ReadInput,
+    inputSchema: ReadInput2,
     paths: (input) => [guard.lexical(input.path)],
     execute: async (input, signal) => {
       abortIfNeeded(signal);
@@ -10679,6 +11260,7 @@ function createReadTool(workspace, options = {}) {
       const textEnd = utf8SafeEnd(contents, windowBytes);
       const truncated = contents.length > windowBytes;
       const text = contents.subarray(0, textEnd).toString("utf8").replaceAll("\r\n", "\n");
+      options.observations?.set(path, versionOfStat(info));
       const lines = text.split("\n");
       if (lines.at(-1) === "") lines.pop();
       const availableLines = lines.length;
@@ -10725,6 +11307,7 @@ function createWriteTool(workspace, options = {}) {
     execute: async (input, signal) => {
       abortIfNeeded(signal);
       const path = await guard.destination(input.path);
+      const expected = await expectedMutationVersion(path, options.observations);
       const previous = await readOptionalPresentationText(path);
       if (!previous.exists || previous.text !== void 0) {
         await options.beforeCommit?.({
@@ -10734,7 +11317,9 @@ function createWriteTool(workspace, options = {}) {
           kind: previous.exists ? "update" : "create"
         }, signal);
       }
-      await atomicWrite(path, input.content, signal);
+      await assertMutationVersion(path, expected, options.observations);
+      await atomicWrite(path, input.content, signal, expected);
+      await options.observations?.refresh(path);
       const output = { path, bytes: Buffer.byteLength(input.content) };
       if (previous.exists && previous.text === void 0) return output;
       return withToolPresentation(output, buildFileChangePresentation(
@@ -10757,6 +11342,7 @@ function createEditTool(workspace, options = {}) {
       abortIfNeeded(signal);
       const displayPath = guard.lexical(input.path);
       const path = await guard.existing(input.path);
+      const expected = await expectedMutationVersion(path, options.observations);
       const contents = await readText(path);
       const hasCRLF = contents.includes("\r\n");
       const norm = (s) => hasCRLF ? s.replace(/\r\n/g, "\n") : s;
@@ -10772,7 +11358,9 @@ function createEditTool(workspace, options = {}) {
       const updatedLF = contentsLF.slice(0, first) + newTextLF + contentsLF.slice(first + oldTextLF.length);
       const updated = hasCRLF ? updatedLF.replace(/\n/g, "\r\n") : updatedLF;
       await options.beforeCommit?.({ path: displayPath, before: contents, after: updated, kind: "update" }, signal);
-      await atomicWrite(path, updated, signal);
+      await assertMutationVersion(path, expected, options.observations);
+      await atomicWrite(path, updated, signal, expected);
+      await options.observations?.refresh(path);
       return withToolPresentation(
         { path: displayPath, replacements: 1 },
         buildFileChangePresentation(displayPath, contents, updated, "update")
@@ -10793,10 +11381,12 @@ function createApplyPatchTool(workspace, options = {}) {
       const prepared = [];
       for (const change of changes) {
         const path = await guard.destination(change.path);
+        const expected = await expectedMutationVersion(path, options.observations);
         const original = change.created ? await requireAbsent(guard, change.path) : await readText(await guard.existing(change.path));
         const applied = applyHunks(original, change.hunks);
-        prepared.push({ path, content: applied.content, change, hunks: applied.hunks });
+        prepared.push({ path, content: applied.content, change, hunks: applied.hunks, expected });
       }
+      for (const change of prepared) await assertMutationVersion(change.path, change.expected, options.observations);
       for (const change of prepared) {
         const before = change.change.created ? "" : await readText(change.path);
         await options.beforeCommit?.({
@@ -10805,43 +11395,49 @@ function createApplyPatchTool(workspace, options = {}) {
           after: change.content,
           kind: change.change.created ? "create" : "update"
         }, signal);
-        await atomicWrite(change.path, change.content, signal);
+      }
+      for (const change of prepared) await assertMutationVersion(change.path, change.expected, options.observations);
+      for (const change of prepared) {
+        await atomicWrite(change.path, change.content, signal, change.expected);
+        await options.observations?.refresh(change.path);
       }
       const first = prepared[0];
+      const primaryPresentation = buildPatchPresentation(first.path, first.change.created, first.hunks);
+      const relatedChanges = prepared.slice(1).map((change) => buildPatchPresentation(change.path, change.change.created, change.hunks));
       return withToolPresentation(
         { files: prepared.map((change) => change.path) },
-        buildPatchPresentation(first.path, first.change.created, first.hunks)
+        relatedChanges.length === 0 ? primaryPresentation : { ...primaryPresentation, relatedChanges }
       );
     }
   };
 }
 function createPathGuard(workspace) {
-  const root = resolve16(workspace);
+  const root = resolve17(workspace);
   const lexical = (input) => {
-    const candidate = resolve16(root, input);
-    if (!within(root, candidate)) throw new Error("Path is outside the workspace");
+    const candidate = resolve17(root, input);
+    if (!within2(root, candidate)) throw new Error("Path is outside the workspace");
     return candidate;
   };
   return {
     lexical,
     existing: async (input) => {
       const candidate = lexical(input);
-      const physical = await realpath7(candidate);
-      if (!within(await realpath7(root), physical)) throw new Error("Path escapes the workspace through a symlink");
+      const physical = await realpath8(candidate);
+      if (!within2(await realpath8(root), physical)) throw new Error("Path escapes the workspace through a symlink");
       return physical;
     },
     destination: async (input) => {
       const candidate = lexical(input);
-      const physicalRoot = await realpath7(root);
+      const physicalRoot = await realpath8(root);
       let ancestor = candidate;
       while (true) {
         try {
-          const physical = await realpath7(ancestor);
-          if (!within(physicalRoot, physical)) throw new Error("Path escapes the workspace through a symlink");
+          const physical = await realpath8(ancestor);
+          if (!within2(physicalRoot, physical)) throw new Error("Path escapes the workspace through a symlink");
           break;
         } catch (error) {
           if (!isMissing3(error)) throw error;
-          const parent = dirname11(ancestor);
+          const parent = dirname12(ancestor);
           if (parent === ancestor) throw error;
           ancestor = parent;
         }
@@ -10850,9 +11446,9 @@ function createPathGuard(workspace) {
     }
   };
 }
-async function atomicWrite(path, content, signal) {
+async function atomicWrite(path, content, signal, expectedVersion) {
   abortIfNeeded(signal);
-  await mkdir11(dirname11(path), { recursive: true });
+  await mkdir11(dirname12(path), { recursive: true });
   const temporary = `${path}.${randomUUID8()}.tmp`;
   try {
     const handle = await open8(temporary, constants6.O_CREAT | constants6.O_EXCL | constants6.O_WRONLY, 384);
@@ -10863,19 +11459,46 @@ async function atomicWrite(path, content, signal) {
       await handle.close();
     }
     abortIfNeeded(signal);
+    if (expectedVersion !== void 0 && await fileVersion(path) !== expectedVersion) {
+      throw new Error(`Stale file: ${path} changed while the replacement was being prepared`);
+    }
     await rename7(temporary, path);
   } finally {
     await rm6(temporary, { force: true });
   }
 }
 async function readText(path) {
-  const contents = await readFile11(path);
+  const contents = await readFile12(path);
   if (isBinary(contents)) throw new Error("Cannot edit binary file as text");
   return contents.toString("utf8");
 }
+var ABSENT_VERSION = "absent";
+async function expectedMutationVersion(path, observations) {
+  const current = await fileVersion(path);
+  const observed = observations?.get(path);
+  if (observed !== void 0 && observed !== current) {
+    throw new Error(`Stale file: ${path} changed since it was read; read it again before writing`);
+  }
+  return current;
+}
+async function assertMutationVersion(path, expected, observations) {
+  if (observations !== void 0) await observations.assertCurrent(path, expected);
+  else if (await fileVersion(path) !== expected) throw new Error(`Stale file: ${path} changed since mutation preparation`);
+}
+async function fileVersion(path) {
+  try {
+    return versionOfStat(await stat5(path));
+  } catch (error) {
+    if (isMissing3(error)) return ABSENT_VERSION;
+    throw error;
+  }
+}
+function versionOfStat(info) {
+  return `${info.dev}:${info.ino}:${info.size}:${info.mtimeMs}:${info.ctimeMs}`;
+}
 async function readOptionalPresentationText(path) {
   try {
-    const contents = await readFile11(path);
+    const contents = await readFile12(path);
     return isBinary(contents) ? { exists: true } : { exists: true, text: contents.toString("utf8") };
   } catch (error) {
     return isMissing3(error) ? { exists: false } : { exists: true };
@@ -10959,9 +11582,9 @@ async function readBounded2(path, maxBytes, signal, openFile2) {
     await handle.close();
   }
 }
-function within(root, candidate) {
-  const delta = relative14(root, candidate);
-  return delta === "" || !delta.startsWith(`..${sep13}`) && delta !== ".." && !isAbsolute8(delta);
+function within2(root, candidate) {
+  const delta = relative15(root, candidate);
+  return delta === "" || !delta.startsWith(`..${sep14}`) && delta !== ".." && !isAbsolute9(delta);
 }
 function forceFlag(value) {
   return value === true || value === "true";
@@ -11182,13 +11805,321 @@ function matchesLines(source, start, expected) {
   return start >= 0 && start + expected.length <= source.length && expected.every((line, index) => source[start + index] === line);
 }
 
+// src/tools/web.ts
+import { lookup } from "dns/promises";
+import { isIP } from "net";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { z as z20 } from "zod";
+var WebFetchInput = z20.object({
+  url: z20.string().url().max(8192),
+  timeoutMs: z20.coerce.number().int().positive().max(12e4).optional(),
+  maxBytes: z20.coerce.number().int().positive().max(10 * 1024 * 1024).optional()
+});
+var WebSearchInput = z20.object({
+  query: z20.string().trim().min(1).max(1e3),
+  maxResults: z20.coerce.number().int().min(1).max(20).optional()
+});
+function createWebFetchTool() {
+  return {
+    name: "WebFetch",
+    description: "Fetch a public HTTP(S) page with SSRF protection and return readable text",
+    inputSchema: WebFetchInput,
+    outputSchema: z20.object({ url: z20.string(), status: z20.number(), contentType: z20.string(), content: z20.string(), truncated: z20.boolean() }),
+    paths: () => [],
+    summarize: (input) => input.url,
+    presentCall: (input) => ({ kind: "web", title: `Fetching ${new URL(input.url).hostname}`, url: input.url }),
+    permissions: () => ({ paths: [] }),
+    execute: async (input, signal) => fetchPublic(input.url, {
+      signal,
+      timeoutMs: input.timeoutMs ?? 3e4,
+      maxBytes: input.maxBytes ?? 2 * 1024 * 1024
+    }),
+    renderForModel: (output) => [
+      `URL: ${output.url}`,
+      `Status: ${output.status}`,
+      `Content-Type: ${output.contentType}`,
+      output.truncated ? "[Response truncated]" : "",
+      "",
+      output.content
+    ].filter((line, index) => line !== "" || index >= 4).join("\n"),
+    presentResult: (output) => ({ kind: "web", title: `Fetched ${new URL(output.url).hostname}`, url: output.url, summary: `${output.status} \xB7 ${output.contentType}` })
+  };
+}
+function createWebSearchTool(provider = createDefaultWebSearchProvider()) {
+  return {
+    name: "WebSearch",
+    description: "Search the public web and return titles, URLs, and snippets",
+    inputSchema: WebSearchInput,
+    outputSchema: z20.object({ query: z20.string(), results: z20.array(z20.object({ title: z20.string(), url: z20.string(), snippet: z20.string() })) }),
+    paths: () => [],
+    summarize: (input) => input.query,
+    presentCall: (input) => ({ kind: "web", title: `Searching: ${input.query}` }),
+    permissions: () => ({ paths: [] }),
+    execute: async (input, signal) => ({ query: input.query, results: [...await provider.search(input.query, input.maxResults ?? 8, signal)] }),
+    renderForModel: (output) => output.results.length === 0 ? `No web results found for: ${output.query}` : output.results.map((item, index) => `${index + 1}. ${item.title}
+${item.url}
+${item.snippet}`).join("\n\n"),
+    presentResult: (output) => ({ kind: "web", title: `Search: ${output.query}`, summary: `${output.results.length} results`, items: output.results })
+  };
+}
+function createDefaultWebSearchProvider(fetcher = fetchPublic) {
+  return new MultiSourceWebSearchProvider(fetcher);
+}
+var MultiSourceWebSearchProvider = class {
+  constructor(fetcher) {
+    this.fetcher = fetcher;
+  }
+  fetcher;
+  async search(query, maxResults, signal) {
+    const sources = [
+      { name: "DuckDuckGo Lite", url: `https://lite.duckduckgo.com/lite/?q=${encodeURIComponent(query)}`, parse: parseDuckDuckGo },
+      { name: "Bing", url: `https://www.bing.com/search?q=${encodeURIComponent(query)}`, parse: parseBing }
+    ];
+    const failures = [];
+    for (const source of sources) {
+      try {
+        const response = await this.fetcher(source.url, {
+          signal,
+          timeoutMs: 3e4,
+          maxBytes: 2 * 1024 * 1024,
+          rawHtml: true
+        });
+        if (response.status < 200 || response.status >= 300) {
+          failures.push(`${source.name}: HTTP ${response.status}`);
+          continue;
+        }
+        const results = source.parse(response.content);
+        if (results.length > 0) return results.slice(0, maxResults);
+        failures.push(`${source.name}: no results parsed`);
+      } catch (error) {
+        if (signal.aborted) throw error;
+        failures.push(`${source.name}: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+    throw new Error(`Web search providers failed (${failures.join("; ")})`);
+  }
+};
+async function fetchPublic(initialUrl, options) {
+  let current = new URL(initialUrl);
+  for (let redirects = 0; redirects <= 5; redirects += 1) {
+    validateUrl(current);
+    const addresses = await lookup(normalizedHostname(current.hostname), { all: true, verbatim: true });
+    if (addresses.length === 0) throw new Error("Host did not resolve");
+    if (addresses.some((entry2) => isBlockedResolvedAddress(entry2.address, current.hostname))) {
+      throw new Error("Blocked private or special network destination");
+    }
+    const response = await requestAddress(current, addresses[0].address, options);
+    if (response.redirect !== void 0) {
+      if (redirects === 5) throw new Error("Too many redirects");
+      current = new URL(response.redirect, current);
+      continue;
+    }
+    const contentType = response.contentType;
+    const decoded = new TextDecoder(charset(contentType), { fatal: false }).decode(response.body);
+    const content = !options.rawHtml && /text\/html|application\/xhtml\+xml/i.test(contentType) ? htmlToText(decoded) : decoded;
+    return { url: current.href, status: response.status, contentType, content, truncated: response.truncated };
+  }
+  throw new Error("Too many redirects");
+}
+async function requestAddress(url, address, options) {
+  return new Promise((resolvePromise, reject) => {
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(totalTimer);
+      resolvePromise(value);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(totalTimer);
+      reject(error);
+    };
+    const secure = url.protocol === "https:";
+    const request = (secure ? httpsRequest : httpRequest)({
+      protocol: url.protocol,
+      hostname: address,
+      port: url.port || (secure ? 443 : 80),
+      method: "GET",
+      path: `${url.pathname}${url.search}`,
+      headers: { host: url.host, accept: "text/html,application/json,text/plain;q=0.9,*/*;q=0.5", "accept-encoding": "identity", "user-agent": "Flavor-Code/1" },
+      ...secure ? { servername: normalizedHostname(url.hostname) } : {},
+      signal: options.signal
+    }, (response) => {
+      const status = response.statusCode ?? 0;
+      const location = response.headers.location;
+      if (location !== void 0 && [301, 302, 303, 307, 308].includes(status)) {
+        response.resume();
+        finish({ status, contentType: "", body: new Uint8Array(), truncated: false, redirect: location });
+        return;
+      }
+      const chunks = [];
+      let bytes = 0;
+      let truncated = false;
+      response.on("data", (chunk) => {
+        if (bytes >= options.maxBytes) {
+          truncated = true;
+          finish({ status, contentType: String(response.headers["content-type"] ?? "application/octet-stream"), body: Buffer.concat(chunks), truncated });
+          response.destroy();
+          return;
+        }
+        const accepted = chunk.subarray(0, options.maxBytes - bytes);
+        chunks.push(accepted);
+        bytes += accepted.length;
+        if (accepted.length < chunk.length) truncated = true;
+      });
+      response.once("end", () => finish({
+        status,
+        contentType: String(response.headers["content-type"] ?? "application/octet-stream"),
+        body: Buffer.concat(chunks),
+        truncated
+      }));
+      response.once("error", fail);
+    });
+    const totalTimer = setTimeout(() => request.destroy(new Error(`Web request timed out after ${options.timeoutMs}ms`)), options.timeoutMs);
+    totalTimer.unref();
+    request.once("error", fail);
+    request.end();
+  });
+}
+function validateUrl(url) {
+  if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error("Only HTTP(S) URLs are supported");
+  if (url.username !== "" || url.password !== "") throw new Error("URL credentials are not allowed");
+  const hostname = normalizedHostname(url.hostname).toLowerCase();
+  if (hostname === "localhost" || hostname.endsWith(".localhost")) throw new Error("Blocked private destination");
+  const port = url.port === "" ? url.protocol === "https:" ? 443 : 80 : Number(url.port);
+  if (![80, 443].includes(port)) throw new Error(`Blocked network port: ${port}`);
+  if (isIP(hostname) && isBlockedAddress(hostname)) throw new Error("Blocked private or special network destination");
+}
+function isBlockedResolvedAddress(input, hostname) {
+  return isBlockedAddress(input, { allowBenchmarkCarrier: isIP(normalizedHostname(hostname)) === 0 });
+}
+function isBlockedAddress(input, options = {}) {
+  const address = input.toLowerCase().replace(/^\[|\]$/g, "").split("%")[0];
+  if (address === "::" || address === "::1") return true;
+  const mappedIpv4 = extractMappedIpv4(address);
+  if (mappedIpv4 !== void 0) return isBlockedAddress(mappedIpv4, options);
+  if (address.includes(":")) {
+    return address.startsWith("fc") || address.startsWith("fd") || /^fe[89ab]/.test(address) || address.startsWith("ff") || address.startsWith("2001:db8:");
+  }
+  const parts = address.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return true;
+  const [a, b, c] = parts;
+  return a === 0 || a === 10 || a === 127 || a >= 224 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 192 && b === 0 && (c === 0 || c === 2) || a === 192 && b === 88 && c === 99 || !options.allowBenchmarkCarrier && a === 198 && (b === 18 || b === 19) || a === 198 && b === 51 && c === 100 || a === 203 && b === 0 && c === 113;
+}
+function extractMappedIpv4(address) {
+  if (isIP(address) !== 6) return void 0;
+  let canonical3;
+  try {
+    canonical3 = new URL(`http://[${address}]/`).hostname.replace(/^\[|\]$/g, "");
+  } catch {
+    return void 0;
+  }
+  const match = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(canonical3);
+  if (match === null) return void 0;
+  const high = Number.parseInt(match[1], 16);
+  const low = Number.parseInt(match[2], 16);
+  return `${high >>> 8}.${high & 255}.${low >>> 8}.${low & 255}`;
+}
+function normalizedHostname(hostname) {
+  return hostname.replace(/^\[|\]$/g, "");
+}
+function htmlToText(html) {
+  let text = html.replace(/<!--[\s\S]*?-->/g, "").replace(/<(script|style|noscript|svg)\b[^>]*>[\s\S]*?<\/\1>/gi, "").replace(/<h1\b[^>]*>([\s\S]*?)<\/h1>/gi, "\n# $1\n").replace(/<h2\b[^>]*>([\s\S]*?)<\/h2>/gi, "\n## $1\n").replace(/<h3\b[^>]*>([\s\S]*?)<\/h3>/gi, "\n### $1\n").replace(/<li\b[^>]*>/gi, "\n- ").replace(/<(p|div|section|article|main|header|footer|ul|ol|table|tr)\b[^>]*>/gi, "\n").replace(/<\/(p|div|section|article|main|header|footer|li|ul|ol|table|tr)>/gi, "\n").replace(/<br\s*\/?>/gi, "\n").replace(/<[^>]+>/g, "");
+  text = decodeEntities(text).replace(/\r/g, "").replace(/[ \t]+\n/g, "\n").replace(/\n[ \t]+/g, "\n").replace(/\n{3,}/g, "\n\n");
+  return text.trim();
+}
+function parseDuckDuckGo(html) {
+  const results = [];
+  const pattern = /<a[^>]*class="[^"]*result__a[^"]*"[^>]*href="([^"]+)"[^>]*>([\s\S]*?)<\/a>[\s\S]*?<a[^>]*class="[^"]*result__snippet[^"]*"[^>]*>([\s\S]*?)<\/a>/gi;
+  for (const match of html.matchAll(pattern)) {
+    const url = unwrapDuckDuckGoUrl(match[1]);
+    if (url !== void 0) results.push({ title: htmlToText(match[2]), url, snippet: htmlToText(match[3]) });
+  }
+  const litePattern = /<a\b[^>]*href=(["'])(.*?)\1[^>]*class=(["'])[^"']*\bresult-link\b[^"']*\3[^>]*>([\s\S]*?)<\/a>[\s\S]*?<td\b[^>]*class=(["'])[^"']*\bresult-snippet\b[^"']*\5[^>]*>([\s\S]*?)<\/td>/gi;
+  for (const match of html.matchAll(litePattern)) {
+    const url = unwrapDuckDuckGoUrl(match[2]);
+    if (url !== void 0) results.push({ title: htmlToText(match[4]), url, snippet: htmlToText(match[6]) });
+  }
+  return uniqueResults(results);
+}
+function parseBing(html) {
+  const results = [];
+  const itemPattern = /<li\b[^>]*class=(["'])[^"']*\bb_algo\b[^"']*\1[^>]*>([\s\S]*?)<\/li>/gi;
+  for (const itemMatch of html.matchAll(itemPattern)) {
+    const item = itemMatch[2];
+    const titleMatch = /<h2\b[^>]*>[\s\S]*?<a\b([^>]*)>([\s\S]*?)<\/a>[\s\S]*?<\/h2>/i.exec(item);
+    const snippetMatch = /<div\b[^>]*class=(["'])[^"']*\bb_caption\b[^"']*\1[^>]*>[\s\S]*?<p\b[^>]*>([\s\S]*?)<\/p>/i.exec(item);
+    if (titleMatch === null) continue;
+    const href = readHtmlAttribute(titleMatch[1], "href");
+    const url = href === void 0 ? void 0 : unwrapBingUrl(href);
+    if (url === void 0) continue;
+    results.push({ title: htmlToText(titleMatch[2]), url, snippet: snippetMatch === null ? "" : htmlToText(snippetMatch[2]) });
+  }
+  return uniqueResults(results);
+}
+function unwrapDuckDuckGoUrl(input) {
+  try {
+    const parsed = new URL(decodeEntities(input), "https://lite.duckduckgo.com");
+    return publicResultUrl(parsed.searchParams.get("uddg") ?? parsed.href);
+  } catch {
+    return void 0;
+  }
+}
+function unwrapBingUrl(input) {
+  try {
+    const parsed = new URL(decodeEntities(input), "https://www.bing.com");
+    const encoded = parsed.hostname.endsWith("bing.com") && parsed.pathname === "/ck/a" ? parsed.searchParams.get("u") : null;
+    if (encoded?.startsWith("a1")) {
+      const target = Buffer.from(encoded.slice(2), "base64url").toString("utf8");
+      return publicResultUrl(target);
+    }
+    return publicResultUrl(parsed.href);
+  } catch {
+    return void 0;
+  }
+}
+function publicResultUrl(input) {
+  try {
+    const parsed = new URL(input);
+    return parsed.protocol === "http:" || parsed.protocol === "https:" ? parsed.href : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readHtmlAttribute(attributes, name) {
+  const match = new RegExp(`\\b${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)')`, "i").exec(attributes);
+  return match?.[1] ?? match?.[2];
+}
+function uniqueResults(results) {
+  const seen = /* @__PURE__ */ new Set();
+  return results.filter((result) => {
+    if (seen.has(result.url)) return false;
+    seen.add(result.url);
+    return true;
+  });
+}
+function decodeEntities(text) {
+  const named = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " " };
+  return text.replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi, (_all, entity) => {
+    if (entity.startsWith("#x")) return String.fromCodePoint(Number.parseInt(entity.slice(2), 16));
+    if (entity.startsWith("#")) return String.fromCodePoint(Number.parseInt(entity.slice(1), 10));
+    return named[entity.toLowerCase()] ?? `&${entity};`;
+  });
+}
+function charset(contentType) {
+  return /charset\s*=\s*(?:utf-16|utf-16le)/i.test(contentType) ? "utf-16le" : "utf-8";
+}
+
 // src/tools/lsp.ts
 import { spawn as spawn5 } from "child_process";
 import { existsSync as existsSync2 } from "fs";
-import { access, constants as constants7, readFile as readFile12 } from "fs/promises";
-import { basename as basename4, dirname as dirname12, extname, isAbsolute as isAbsolute9, relative as relative15, resolve as resolve17, sep as sep14 } from "path";
+import { access, constants as constants7, readFile as readFile13 } from "fs/promises";
+import { basename as basename4, dirname as dirname13, extname, isAbsolute as isAbsolute10, relative as relative16, resolve as resolve18, sep as sep15 } from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL as pathToFileURL2 } from "url";
-import { z as z19 } from "zod";
+import { z as z21 } from "zod";
 var LSP_REQUEST_TIMEOUT_MS = 15e3;
 var LspConnection = class {
   #process;
@@ -11285,8 +12216,8 @@ var LspConnection = class {
     const id = this.#nextId++;
     const request = { jsonrpc: "2.0", id, method, params };
     const timeout = AbortSignal.timeout(LSP_REQUEST_TIMEOUT_MS);
-    const promise = new Promise((resolve22, reject) => {
-      this.#pending.set(id, { resolve: resolve22, reject });
+    const promise = new Promise((resolve25, reject) => {
+      this.#pending.set(id, { resolve: resolve25, reject });
       timeout.addEventListener("abort", () => {
         if (this.#pending.has(id)) {
           this.#pending.delete(id);
@@ -11351,7 +12282,7 @@ var LspConnection = class {
     const url = new URL(uri);
     if (url.protocol !== "file:") return;
     const filePath = fileURLToPath3(url);
-    const text = await readFile12(filePath, "utf8");
+    const text = await readFile13(filePath, "utf8");
     const current = this.#documents.get(uri);
     if (current === void 0) {
       this.#documents.set(uri, { text, version: 1 });
@@ -11402,8 +12333,8 @@ var LspBuffer = class {
     }
   }
 };
-var TYPESCRIPT_CLI = resolve17(
-  dirname12(fileURLToPath3(import.meta.resolve("typescript/package.json"))),
+var TYPESCRIPT_CLI = resolve18(
+  dirname13(fileURLToPath3(import.meta.resolve("typescript/package.json"))),
   "lib",
   "tsc.js"
 );
@@ -11444,7 +12375,7 @@ var RealLspManager = class {
   #serverConfigs;
   #onStatus;
   constructor(options) {
-    this.#workspace = resolve17(options.workspace);
+    this.#workspace = resolve18(options.workspace);
     this.#serverConfigs = options.serverConfigs ?? KNOWN_SERVERS;
     this.#onStatus = options.onStatus;
   }
@@ -11493,7 +12424,7 @@ var RealLspManager = class {
     if (pending !== void 0) return pending;
     const config = this.#serverConfigs.find((c) => c.language === language);
     if (config === void 0) return void 0;
-    const hasRoot = config.rootFiles.some((file) => existsSync2(resolve17(this.#workspace, file)));
+    const hasRoot = config.rootFiles.some((file) => existsSync2(resolve18(this.#workspace, file)));
     if (!hasRoot) return void 0;
     const startPromise = this.#startServer(config);
     this.#pendingStarts.set(language, startPromise);
@@ -11522,24 +12453,24 @@ var RealLspManager = class {
     return connection;
   }
 };
-var LspFindRefsInput = z19.object({
-  file: z19.string().min(1),
-  line: z19.coerce.number().int().nonnegative(),
-  character: z19.coerce.number().int().nonnegative()
+var LspFindRefsInput = z21.object({
+  file: z21.string().min(1),
+  line: z21.coerce.number().int().nonnegative(),
+  character: z21.coerce.number().int().nonnegative()
 });
-var LspHoverInput = z19.object({
-  file: z19.string().min(1),
-  line: z19.coerce.number().int().nonnegative(),
-  character: z19.coerce.number().int().nonnegative()
+var LspHoverInput = z21.object({
+  file: z21.string().min(1),
+  line: z21.coerce.number().int().nonnegative(),
+  character: z21.coerce.number().int().nonnegative()
 });
-var LspDiagnosticsInput = z19.object({
-  file: z19.string().min(1)
+var LspDiagnosticsInput = z21.object({
+  file: z21.string().min(1)
 });
 function createLspTools(workspace, options = {}) {
-  const root = resolve17(workspace);
+  const root = resolve18(workspace);
   const manager = options.manager ?? new RealLspManager({ workspace: root, onStatus: options.onStatus });
   const guard = (input) => {
-    const candidate = resolve17(root, input);
+    const candidate = resolve18(root, input);
     if (!isWithin6(root, candidate)) throw new Error("Path is outside the workspace");
     return candidate;
   };
@@ -11615,8 +12546,8 @@ function languageIdForPath(filePath) {
   }
 }
 function isWithin6(root, candidate) {
-  const delta = relative15(root, candidate);
-  return delta === "" || !delta.startsWith(`..${sep14}`) && delta !== ".." && !isAbsolute9(delta);
+  const delta = relative16(root, candidate);
+  return delta === "" || !delta.startsWith(`..${sep15}`) && delta !== ".." && !isAbsolute10(delta);
 }
 function uriToPath(uri) {
   try {
@@ -11648,18 +12579,18 @@ function severityLabel(severity) {
 }
 
 // src/tools/ask-user-question.ts
-import { z as z20 } from "zod";
-var QuestionOptionSchema = z20.object({
-  label: z20.string().trim().min(1),
-  description: z20.string().trim().min(1)
+import { z as z22 } from "zod";
+var QuestionOptionSchema = z22.object({
+  label: z22.string().trim().min(1),
+  description: z22.string().trim().min(1)
 });
-var QuestionSchema = z20.object({
-  question: z20.string().trim().min(1),
-  header: z20.string().trim().min(1),
-  options: z20.array(QuestionOptionSchema).min(1).max(4)
+var QuestionSchema = z22.object({
+  question: z22.string().trim().min(1),
+  header: z22.string().trim().min(1),
+  options: z22.array(QuestionOptionSchema).min(1).max(4)
 });
-var AskUserQuestionInput = z20.object({
-  questions: z20.array(QuestionSchema).min(1).max(4)
+var AskUserQuestionInput = z22.object({
+  questions: z22.array(QuestionSchema).min(1).max(4)
 });
 function hookAnswersFromUpdatedInput(updatedInput, questions) {
   if (typeof updatedInput !== "object" || updatedInput === null) return void 0;
@@ -11688,7 +12619,7 @@ var QuestionBridge = class {
   ask(questions, signal) {
     if (this.#pending !== void 0) return Promise.reject(new Error("A question is already pending"));
     if (signal.aborted) return Promise.reject(signal.reason);
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve25, reject) => {
       const onAbort = () => {
         this.#pending = void 0;
         reject(signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason)));
@@ -11700,7 +12631,7 @@ var QuestionBridge = class {
           signal.removeEventListener("abort", onAbort);
           this.#pending = void 0;
           this.#onChange?.();
-          resolve22(answers);
+          resolve25(answers);
         },
         reject: (error) => {
           signal.removeEventListener("abort", onAbort);
@@ -11743,20 +12674,20 @@ function createAskUserQuestionTool(handler) {
 }
 
 // src/tools/todo-write.ts
-import { z as z21 } from "zod";
-var TodoStatusSchema = z21.enum([
+import { z as z23 } from "zod";
+var TodoStatusSchema = z23.enum([
   "pending",
   "in_progress",
   "completed",
   "cancelled"
 ]);
-var TodoItemSchema = z21.object({
-  content: z21.string().trim().min(1),
+var TodoItemSchema = z23.object({
+  content: z23.string().trim().min(1),
   status: TodoStatusSchema,
-  activeForm: z21.string().trim().min(1)
+  activeForm: z23.string().trim().min(1)
 });
-var TodoWriteInput = z21.object({
-  todos: z21.array(TodoItemSchema).min(1).max(50)
+var TodoWriteInput = z23.object({
+  todos: z23.array(TodoItemSchema).min(1).max(50)
 });
 function createTodoWriteTool() {
   return {
@@ -11791,38 +12722,38 @@ function createTodoWriteTool() {
 
 // src/tools/managed.ts
 import { randomUUID as randomUUID9 } from "crypto";
-import { link, lstat as lstat9, mkdir as mkdir12, readFile as readFile13, readdir as readdir8, unlink, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname13, join as join14, resolve as resolve18 } from "path";
-import { z as z22 } from "zod";
+import { link, lstat as lstat10, mkdir as mkdir12, readFile as readFile14, readdir as readdir8, unlink, writeFile as writeFile7 } from "fs/promises";
+import { dirname as dirname14, join as join14, resolve as resolve19 } from "path";
+import { z as z24 } from "zod";
 var MANAGED_TOOL_VERSION = 1;
 var MAX_RECORD_BYTES = 256 * 1024;
 var TOOL_NAME = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
-var JsonSchemaObject = z22.record(z22.string(), z22.unknown()).superRefine((schema, context) => {
+var JsonSchemaObject = z24.record(z24.string(), z24.unknown()).superRefine((schema, context) => {
   if (schema.type !== "object") {
     context.addIssue({ code: "custom", message: "Tool input JSON Schema must have type object" });
   }
 });
-var RegisterManagedToolInputSchema = z22.object({
-  name: z22.string().regex(TOOL_NAME).describe("Unique callable tool name using letters, digits, and underscores"),
-  description: z22.string().min(1).max(4096).describe("Purpose and appropriate use of the generated tool"),
+var RegisterManagedToolInputSchema = z24.object({
+  name: z24.string().regex(TOOL_NAME).describe("Unique callable tool name using letters, digits, and underscores"),
+  description: z24.string().min(1).max(4096).describe("Purpose and appropriate use of the generated tool"),
   inputSchema: JsonSchemaObject.describe("Provider-facing JSON Schema with an object at the root"),
-  implementation: z22.string().min(1).max(64 * 1024).describe(
+  implementation: z24.string().min(1).max(64 * 1024).describe(
     "Async JavaScript function body, or complete function/arrow expression, receiving input, signal, and context; return the tool result"
   ),
-  scope: z22.enum(["project", "global"]).default("project").describe(
+  scope: z24.enum(["project", "global"]).default("project").describe(
     "Project persists in the current workspace; global persists for every workspace"
   ),
-  agents: z22.array(z22.enum(["main", "subagent"])).min(1).max(2).optional().describe(
+  agents: z24.array(z24.enum(["main", "subagent"])).min(1).max(2).optional().describe(
     "Agent roles allowed to call the generated tool; omit to allow both"
   )
 }).strict();
-var RemoveManagedToolInputSchema = z22.object({
-  name: z22.string().regex(TOOL_NAME).describe("Managed tool name to remove"),
-  scope: z22.enum(["project", "global"]).optional().describe("Required only when the same name exists in both scopes")
+var RemoveManagedToolInputSchema = z24.object({
+  name: z24.string().regex(TOOL_NAME).describe("Managed tool name to remove"),
+  scope: z24.enum(["project", "global"]).optional().describe("Required only when the same name exists in both scopes")
 }).strict();
 var ManagedToolRecordSchema = RegisterManagedToolInputSchema.extend({
-  version: z22.literal(MANAGED_TOOL_VERSION),
-  createdAt: z22.string().datetime()
+  version: z24.literal(MANAGED_TOOL_VERSION),
+  createdAt: z24.string().datetime()
 }).strict();
 var AsyncFunction = Object.getPrototypeOf(async function() {
 }).constructor;
@@ -11834,9 +12765,9 @@ var ManagedToolStore = class {
   #entries = /* @__PURE__ */ new Map();
   #diagnostics = [];
   constructor(options) {
-    this.#workspace = resolve18(options.workspace);
+    this.#workspace = resolve19(options.workspace);
     this.#projectRoot = join14(this.#workspace, ".flavor", "tools");
-    this.#globalRoot = join14(resolve18(options.home), ".flavor-code", "tools");
+    this.#globalRoot = join14(resolve19(options.home), ".flavor-code", "tools");
     this.#now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   }
   get diagnostics() {
@@ -11897,7 +12828,7 @@ var ManagedToolStore = class {
     if (matches.length === 0) throw new Error(`Managed tool "${input.name}" was not found`);
     if (matches.length > 1) throw new Error(`Managed tool "${input.name}" exists in multiple scopes; specify scope`);
     const entry2 = matches[0];
-    const info = await lstat9(entry2.path);
+    const info = await lstat10(entry2.path);
     if (!info.isFile() || info.isSymbolicLink()) throw new Error(`Managed tool path is no longer a regular file: ${entry2.path}`);
     await unlink(entry2.path);
     this.#entries.delete(scopedKey(entry2.scope, entry2.record.name));
@@ -11923,10 +12854,10 @@ var ManagedToolStore = class {
     for (const name of names) {
       const path = join14(root, name);
       try {
-        const info = await lstat9(path);
+        const info = await lstat10(path);
         if (!info.isFile() || info.isSymbolicLink()) throw new Error("Managed tool record must be a regular file");
         if (info.size > MAX_RECORD_BYTES) throw new Error(`Managed tool record exceeds ${MAX_RECORD_BYTES} bytes`);
-        const record = ManagedToolRecordSchema.parse(JSON.parse(await readFile13(path, "utf8")));
+        const record = ManagedToolRecordSchema.parse(JSON.parse(await readFile14(path, "utf8")));
         if (record.scope !== scope2) throw new Error(`Managed tool record scope must match its ${scope2} directory`);
         const key = scopedKey(scope2, record.name);
         if (this.#entries.has(key)) throw new Error(`Duplicate managed tool name in ${scope2} scope: ${record.name}`);
@@ -12009,7 +12940,7 @@ function createManagedToolManagementTools(options) {
   const listTools = {
     name: "ListRegisteredTools",
     description: "List durable tools created through RegisterTool, including scope, path, and active precedence",
-    inputSchema: z22.object({}).strict(),
+    inputSchema: z24.object({}).strict(),
     agents: mainOnly,
     paths: () => [],
     execute: async (_input, signal) => {
@@ -12022,7 +12953,7 @@ function createManagedToolManagementTools(options) {
 function compileDefinition(record, scope2, workspace) {
   let inputSchema;
   try {
-    inputSchema = z22.fromJSONSchema(record.inputSchema);
+    inputSchema = z24.fromJSONSchema(record.inputSchema);
   } catch (error) {
     throw new Error(`Invalid input schema for managed tool "${record.name}": ${message(error)}`);
   }
@@ -12076,7 +13007,7 @@ ${sourceUrl}`
   }
 }
 async function writeExclusive(path, content) {
-  await mkdir12(dirname13(path), { recursive: true });
+  await mkdir12(dirname14(path), { recursive: true });
   const temporary = `${path}.${randomUUID9()}.tmp`;
   try {
     await writeFile7(temporary, content, { encoding: "utf8", flag: "wx", mode: 384 });
@@ -12122,7 +13053,7 @@ function isMissing4(error) {
 }
 
 // src/hallucination/confidence.ts
-import { z as z23 } from "zod";
+import { z as z25 } from "zod";
 
 // src/hallucination/types.ts
 var DEFAULT_SLIDING_WINDOW_SIZE = 20;
@@ -12135,12 +13066,12 @@ var DEFAULT_EVALUATION_TIMEOUT_MS = 2e3;
 var MAX_QUERY_CHARS = 5e3;
 var MAX_OUTPUT_CHARS = 1e4;
 var MAX_EVIDENCE_CHARS = 6e3;
-var ConfidenceSchema = z23.object({
-  taskAlignment: z23.number(),
-  evidenceGrounding: z23.number(),
-  processReliability: z23.number(),
-  reason: z23.string(),
-  unsupportedClaims: z23.array(z23.string()).max(3)
+var ConfidenceSchema = z25.object({
+  taskAlignment: z25.number(),
+  evidenceGrounding: z25.number(),
+  processReliability: z25.number(),
+  reason: z25.string(),
+  unsupportedClaims: z25.array(z25.string()).max(3)
 });
 var PROMPT = `You are a fast, evidence-aware task-completion verifier.
 
@@ -12467,7 +13398,7 @@ function buildWarningMessages(report, languageTag) {
 }
 
 // src/hallucination/sliding-window.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 var SlidingWindow = class {
   #windowSize;
   #threshold;
@@ -12483,7 +13414,7 @@ var SlidingWindow = class {
   }
   hash(toolName, params) {
     const sorted = JSON.stringify(params, sortedKeys(params));
-    return createHash6("sha256").update(`${toolName}:${sorted}`).digest("hex");
+    return createHash7("sha256").update(`${toolName}:${sorted}`).digest("hex");
   }
   push(toolName, params) {
     const hash = this.hash(toolName, params);
@@ -12838,9 +13769,9 @@ ${total}`;
 }
 
 // src/memory/store.ts
-import { createHash as createHash7 } from "crypto";
-import { readFile as readFile14, rm as rm7 } from "fs/promises";
-import { resolve as resolve19, join as join15, relative as relative16, sep as sep15 } from "path";
+import { createHash as createHash8 } from "crypto";
+import { readFile as readFile15, rm as rm7 } from "fs/promises";
+import { resolve as resolve20, join as join15, relative as relative17, sep as sep16 } from "path";
 
 // src/memory/similarity.ts
 function normalizeForSimilarity(value) {
@@ -12942,7 +13873,7 @@ var MemoryStore = class {
   constructor(options) {
     if (!Number.isSafeInteger(options.maxEntries) || options.maxEntries < 1) throw new Error("maxEntries must be an integer of at least 1");
     if (!Number.isSafeInteger(options.maxEntryChars) || options.maxEntryChars < 1) throw new Error("maxEntryChars must be an integer of at least 1");
-    this.workspace = resolve19(options.workspace);
+    this.workspace = resolve20(options.workspace);
     this.#memoryRoot = join15(this.workspace, ".flavor", "memory");
     this.path = join15(this.#memoryRoot, "MEMORY.md");
     this.#behaviorPath = join15(this.#memoryRoot, "behavior.json");
@@ -13163,14 +14094,14 @@ var MemoryStore = class {
     });
   }
   async #readTaskItem(reference) {
-    const document = decodeTask(await readFile14(this.#resolveContentPath(reference.contentPath), "utf8"));
+    const document = decodeTask(await readFile15(this.#resolveContentPath(reference.contentPath), "utf8"));
     return document.items.find((item) => item.id === reference.id)?.content ?? reference.summary;
   }
   #resolveContentPath(contentPath) {
     if (!/^tasks\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}\.md$/.test(contentPath)) throw new Error("Invalid memory content path");
-    const path = resolve19(this.#memoryRoot, ...contentPath.split("/"));
-    const rel = relative16(this.#memoryRoot, path);
-    if (rel === ".." || rel.startsWith(`..${sep15}`)) throw new Error("Memory content path escapes the memory directory");
+    const path = resolve20(this.#memoryRoot, ...contentPath.split("/"));
+    const rel = relative17(this.#memoryRoot, path);
+    if (rel === ".." || rel.startsWith(`..${sep16}`)) throw new Error("Memory content path escapes the memory directory");
     return path;
   }
   async #updateIndex(update) {
@@ -13324,7 +14255,7 @@ function sanitizeTopicKey(value) {
   return value.normalize("NFKC").toLocaleLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 128);
 }
 function memoryId(type, content) {
-  return createHash7("sha256").update(`${type}\0${normalizeMemoryContent(content).toLocaleLowerCase()}`, "utf8").digest("hex").slice(0, 12);
+  return createHash8("sha256").update(`${type}\0${normalizeMemoryContent(content).toLocaleLowerCase()}`, "utf8").digest("hex").slice(0, 12);
 }
 function assertTaskId(taskId) {
   if (!TASK_ID.test(taskId)) throw new Error(`Invalid memory task id: ${taskId}`);
@@ -13639,8 +14570,8 @@ function createExecutionEnvironment(workspace, config) {
 }
 
 // src/ide/client.ts
-import { readFile as readFile15, readdir as readdir9, stat as stat6 } from "fs/promises";
-import { basename as basename5, join as join16, relative as relative17, resolve as resolve20, sep as sep16 } from "path";
+import { readFile as readFile16, readdir as readdir9, stat as stat6 } from "fs/promises";
+import { basename as basename5, join as join16, relative as relative18, resolve as resolve21, sep as sep17 } from "path";
 var FlavorIdeClient = class {
   #workspace;
   #home;
@@ -13651,8 +14582,8 @@ var FlavorIdeClient = class {
   #sessionId;
   #eventTail = Promise.resolve();
   constructor(options) {
-    this.#workspace = resolve20(options.workspace);
-    this.#home = resolve20(options.home);
+    this.#workspace = resolve21(options.workspace);
+    this.#home = resolve21(options.home);
     this.#environment = options.environment ?? process.env;
     this.#fetch = options.fetch ?? fetch;
   }
@@ -13746,7 +14677,7 @@ var FlavorIdeClient = class {
     const candidates = (await Promise.all(entries.map(async (name) => {
       const path = join16(directory, name);
       try {
-        const [contents, info] = await Promise.all([readFile15(path, "utf8"), stat6(path)]);
+        const [contents, info] = await Promise.all([readFile16(path, "utf8"), stat6(path)]);
         const lock = parseLockfile(contents);
         return lock === void 0 ? void 0 : { lock, modified: info.mtimeMs };
       } catch {
@@ -13850,19 +14781,385 @@ function parsePort(value) {
   return Number.isInteger(port) && port > 0 && port <= 65535 ? port : void 0;
 }
 function isWithin7(parent, child) {
-  const base = normalize(resolve20(parent));
-  const target = normalize(resolve20(child));
-  return target === base || target.startsWith(`${base}${sep16}`);
+  const base = normalize(resolve21(parent));
+  const target = normalize(resolve21(child));
+  return target === base || target.startsWith(`${base}${sep17}`);
 }
 function normalize(path) {
   const normalized = path.normalize("NFC");
   return process.platform === "win32" ? normalized.toLowerCase() : normalized;
 }
 function relativeDisplay(workspace, filePath) {
-  const path = relative17(workspace, filePath).replaceAll("\\", "/");
+  const path = relative18(workspace, filePath).replaceAll("\\", "/");
   return path && !path.startsWith("../") ? path : basename5(filePath);
 }
 
+// src/jobs/registry.ts
+import { randomUUID as randomUUID10 } from "crypto";
+var JobRegistry = class {
+  #jobs = /* @__PURE__ */ new Map();
+  #maxOutputChars;
+  #maxJobs;
+  #listeners = /* @__PURE__ */ new Set();
+  constructor(options = {}) {
+    this.#maxOutputChars = options.maxOutputChars ?? 2e5;
+    this.#maxJobs = options.maxJobs ?? 100;
+    if (!Number.isSafeInteger(this.#maxOutputChars) || this.#maxOutputChars <= 0) throw new Error("maxOutputChars must be positive");
+    if (!Number.isSafeInteger(this.#maxJobs) || this.#maxJobs <= 0) throw new Error("maxJobs must be positive");
+  }
+  create(input) {
+    this.#pruneCompleted();
+    const id = `job-${randomUUID10().slice(0, 12)}`;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    let settle;
+    const done = new Promise((resolve25) => {
+      settle = resolve25;
+    });
+    const record = {
+      id,
+      ...input,
+      state: "running",
+      createdAt: now,
+      updatedAt: now,
+      outputChars: 0,
+      truncated: false,
+      output: "",
+      outputStart: 0,
+      settle,
+      done
+    };
+    this.#jobs.set(id, record);
+    this.#publish();
+    return {
+      id,
+      append: (text) => {
+        if (record.state !== "running" || text === "") return;
+        record.output += text;
+        record.outputChars += text.length;
+        if (record.output.length > this.#maxOutputChars) {
+          const removed = record.output.length - this.#maxOutputChars;
+          record.output = record.output.slice(removed);
+          record.outputStart += removed;
+          record.truncated = true;
+        }
+        record.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+        this.#publish();
+      },
+      complete: (result = {}) => this.#finish(
+        record,
+        result.exitCode !== void 0 && result.exitCode !== null && result.exitCode !== 0 ? "failed" : "completed",
+        result
+      ),
+      fail: (error) => this.#finish(record, "failed", { error: error instanceof Error ? error.message : String(error) }),
+      cancel: () => this.#finish(record, "cancelled", {})
+    };
+  }
+  list(owner2) {
+    return [...this.#jobs.values()].filter((job) => owner2 === void 0 || job.owner === owner2).sort((a, b) => b.createdAt.localeCompare(a.createdAt)).map(snapshot2);
+  }
+  read(id, owner2, cursor = 0) {
+    const job = this.#owned(id, owner2);
+    const effective = Math.max(cursor, job.outputStart);
+    return { ...snapshot2(job), output: job.output.slice(effective - job.outputStart), cursor: job.outputStart + job.output.length };
+  }
+  async wait(id, owner2, signal) {
+    const job = this.#owned(id, owner2);
+    if (job.state !== "running") return snapshot2(job);
+    if (signal === void 0) return job.done;
+    return Promise.race([job.done, new Promise((_resolve, reject) => {
+      if (signal.aborted) {
+        reject(signal.reason);
+        return;
+      }
+      signal.addEventListener("abort", () => reject(signal.reason), { once: true });
+    })]);
+  }
+  kill(id, owner2) {
+    const job = this.#owned(id, owner2);
+    if (job.state !== "running") return;
+    void job.cancel?.();
+    this.#finish(job, "cancelled", {});
+  }
+  subscribe(listener) {
+    this.#listeners.add(listener);
+    return () => this.#listeners.delete(listener);
+  }
+  async dispose() {
+    const running = [...this.#jobs.values()].filter((job) => job.state === "running");
+    await Promise.allSettled(running.map(async (job) => job.cancel?.()));
+    for (const job of running) this.#finish(job, "cancelled", {});
+  }
+  #owned(id, owner2) {
+    const job = this.#jobs.get(id);
+    if (job === void 0) throw new Error(`Unknown job: ${id}`);
+    if (job.owner !== owner2) throw new Error("Job owner mismatch");
+    return job;
+  }
+  #finish(record, state, detail) {
+    if (record.state !== "running") return;
+    record.state = state;
+    record.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (detail.exitCode !== void 0) record.exitCode = detail.exitCode;
+    if (detail.error !== void 0) record.error = detail.error;
+    const value = snapshot2(record);
+    record.settle(value);
+    this.#publish();
+  }
+  #publish() {
+    const value = this.list();
+    for (const listener of this.#listeners) listener(value);
+  }
+  #pruneCompleted() {
+    if (this.#jobs.size < this.#maxJobs) return;
+    const removable = [...this.#jobs.values()].filter((job) => job.state !== "running").sort((a, b) => a.updatedAt.localeCompare(b.updatedAt));
+    for (const job of removable) {
+      if (this.#jobs.size < this.#maxJobs) break;
+      this.#jobs.delete(job.id);
+    }
+  }
+};
+function snapshot2(job) {
+  return {
+    id: job.id,
+    kind: job.kind,
+    owner: job.owner,
+    label: job.label,
+    state: job.state,
+    createdAt: job.createdAt,
+    updatedAt: job.updatedAt,
+    outputChars: job.outputChars,
+    truncated: job.truncated,
+    ...job.exitCode === void 0 ? {} : { exitCode: job.exitCode },
+    ...job.error === void 0 ? {} : { error: job.error }
+  };
+}
+
+// src/terminal/service.ts
+import { randomUUID as randomUUID11 } from "crypto";
+import { createRequire as nodeCreateRequire } from "module";
+import { isAbsolute as isAbsolute11, relative as relative19, resolve as resolve22, sep as sep18 } from "path";
+var TerminalService = class {
+  #root;
+  #factory;
+  #jobs;
+  #maxOutputChars;
+  #sessions = /* @__PURE__ */ new Map();
+  constructor(workspace, options = {}) {
+    this.#root = resolve22(workspace);
+    this.#factory = options.factory ?? defaultFactory;
+    this.#jobs = options.jobs;
+    this.#maxOutputChars = options.maxOutputChars ?? 2e5;
+  }
+  open(input) {
+    const cwd = workspacePath(this.#root, input.cwd ?? ".");
+    const shell = input.shell ?? defaultShell();
+    const id = `term-${randomUUID11().slice(0, 12)}`;
+    const pty = this.#factory(shell, input.args ?? [], {
+      cwd,
+      cols: input.columns ?? 100,
+      rows: input.rows ?? 30,
+      env: cleanEnvironment(process.env)
+    });
+    let jobId;
+    const record = {
+      id,
+      owner: input.owner,
+      shell,
+      cwd,
+      state: "running",
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      pty,
+      output: "",
+      outputStart: 0,
+      outputChars: 0,
+      truncated: false,
+      disposables: []
+    };
+    const job = this.#jobs?.create({ kind: "terminal", owner: input.owner, label: shell, cancel: () => this.close(id, input.owner) });
+    if (job !== void 0) {
+      jobId = job.id;
+      record.jobId = job.id;
+      record.job = job;
+    }
+    record.disposables.push(pty.onData((data2) => {
+      record.output += data2;
+      record.outputChars += data2.length;
+      if (record.output.length > this.#maxOutputChars) {
+        const removed = record.output.length - this.#maxOutputChars;
+        record.output = record.output.slice(removed);
+        record.outputStart += removed;
+        record.truncated = true;
+      }
+      job?.append(data2);
+    }));
+    record.disposables.push(pty.onExit(({ exitCode }) => {
+      if (record.state === "running") record.state = "exited";
+      record.exitCode = exitCode;
+      job?.complete({ exitCode });
+    }));
+    this.#sessions.set(id, record);
+    return { ...snapshot3(record), ...jobId === void 0 ? {} : { jobId } };
+  }
+  write(id, owner2, data2) {
+    this.#owned(id, owner2).pty.write(data2);
+  }
+  resize(id, owner2, columns, rows) {
+    this.#owned(id, owner2).pty.resize(columns, rows);
+  }
+  read(id, owner2, cursor = 0) {
+    const record = this.#owned(id, owner2);
+    const effective = Math.max(cursor, record.outputStart);
+    return { ...snapshot3(record), output: record.output.slice(effective - record.outputStart), cursor: record.outputStart + record.output.length, truncated: record.truncated };
+  }
+  list(owner2) {
+    return [...this.#sessions.values()].filter((item) => item.owner === owner2).map(snapshot3);
+  }
+  close(id, owner2) {
+    const record = this.#owned(id, owner2);
+    if (record.state === "running") record.pty.kill();
+    record.state = "closed";
+    record.job?.cancel();
+    for (const disposable of record.disposables) disposable.dispose();
+  }
+  dispose() {
+    for (const record of this.#sessions.values()) {
+      if (record.state === "running") record.pty.kill();
+      for (const disposable of record.disposables) disposable.dispose();
+      record.state = "closed";
+      record.job?.cancel();
+    }
+  }
+  #owned(id, owner2) {
+    const record = this.#sessions.get(id);
+    if (record === void 0) throw new Error(`Unknown terminal: ${id}`);
+    if (record.owner !== owner2) throw new Error("Terminal owner mismatch");
+    return record;
+  }
+};
+function snapshot3(record) {
+  return {
+    id: record.id,
+    owner: record.owner,
+    shell: record.shell,
+    cwd: record.cwd,
+    state: record.state,
+    createdAt: record.createdAt,
+    ...record.exitCode === void 0 ? {} : { exitCode: record.exitCode },
+    ...record.jobId === void 0 ? {} : { jobId: record.jobId }
+  };
+}
+function defaultFactory(shell, args, options) {
+  try {
+    const pty = nodeCreateRequire(import.meta.url)("node-pty");
+    return pty.spawn(shell, args, { ...options, name: "xterm-256color" });
+  } catch (error) {
+    throw new Error(`Pseudo-terminal backend is unavailable: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function defaultShell() {
+  return process.platform === "win32" ? process.env.ComSpec ?? "cmd.exe" : process.env.SHELL ?? "/bin/sh";
+}
+function cleanEnvironment(environment) {
+  return Object.fromEntries(Object.entries(environment).filter((entry2) => entry2[1] !== void 0));
+}
+function workspacePath(root, input) {
+  const path = resolve22(root, input);
+  const delta = relative19(root, path);
+  if (delta === ".." || delta.startsWith(`..${sep18}`) || isAbsolute11(delta)) throw new Error("Terminal cwd is outside the workspace");
+  return path;
+}
+
+// src/tools/terminal.ts
+import { z as z26 } from "zod";
+import { resolve as resolve23 } from "path";
+var Id = z26.string().regex(/^term-[a-f0-9-]+$/);
+var OpenInput = z26.object({ cwd: z26.string().optional(), shell: z26.string().optional(), args: z26.array(z26.string()).optional(), columns: z26.coerce.number().int().min(10).max(500).optional(), rows: z26.coerce.number().int().min(2).max(300).optional() });
+var WriteInput2 = z26.object({ id: Id, data: z26.string().max(1e5), enter: z26.boolean().optional() });
+var ReadInput3 = z26.object({ id: Id, cursor: z26.coerce.number().int().min(0).optional() });
+var ResizeInput = z26.object({ id: Id, columns: z26.coerce.number().int().min(10).max(500), rows: z26.coerce.number().int().min(2).max(300) });
+var CloseInput = z26.object({ id: Id });
+function createTerminalTools(terminals, workspace = process.cwd()) {
+  const tools = [
+    {
+      name: "TerminalOpen",
+      description: "Open a persistent interactive pseudo-terminal in the workspace",
+      inputSchema: OpenInput,
+      paths: (input) => [resolve23(workspace, input.cwd ?? ".")],
+      permissions: (input) => ({ paths: [resolve23(workspace, input.cwd ?? ".")], command: input.shell ?? "system-shell", args: input.args ?? [], cwd: resolve23(workspace, input.cwd ?? ".") }),
+      execute: async (input, _signal, context) => terminals.open({
+        owner: owner(context),
+        ...input.cwd === void 0 ? {} : { cwd: input.cwd },
+        ...input.shell === void 0 ? {} : { shell: input.shell },
+        ...input.args === void 0 ? {} : { args: input.args },
+        ...input.columns === void 0 ? {} : { columns: input.columns },
+        ...input.rows === void 0 ? {} : { rows: input.rows }
+      }),
+      presentResult: (output) => ({ kind: "terminal", variant: "terminal", title: `Terminal ${output.id}`, state: "running" })
+    },
+    {
+      name: "TerminalWrite",
+      description: "Write text or a command to a persistent terminal",
+      inputSchema: WriteInput2,
+      paths: () => [],
+      permissions: (input) => ({ paths: [], command: input.data, args: [] }),
+      execute: async (input, _signal, context) => {
+        terminals.write(input.id, owner(context), input.data + (input.enter ? "\r" : ""));
+        return { id: input.id, written: input.data.length + (input.enter ? 1 : 0) };
+      }
+    },
+    {
+      name: "TerminalRead",
+      description: "Read output produced by a persistent terminal since a cursor",
+      inputSchema: ReadInput3,
+      paths: () => [],
+      execute: async (input, _signal, context) => terminals.read(input.id, owner(context), input.cursor ?? 0),
+      renderForModel: (output) => output.output,
+      presentResult: (output) => {
+        const result = output;
+        return {
+          kind: "terminal",
+          variant: "terminal",
+          title: `Terminal ${result.id}`,
+          stdout: result.output,
+          truncated: result.truncated,
+          ...result.exitCode === void 0 ? { state: result.state === "closed" ? "cancelled" : "running" } : {
+            exitCode: result.exitCode,
+            state: result.exitCode === 0 ? "completed" : "failed"
+          }
+        };
+      }
+    },
+    {
+      name: "TerminalResize",
+      description: "Resize a persistent terminal",
+      inputSchema: ResizeInput,
+      paths: () => [],
+      execute: async (input, _signal, context) => {
+        terminals.resize(input.id, owner(context), input.columns, input.rows);
+        return { id: input.id, columns: input.columns, rows: input.rows };
+      }
+    },
+    {
+      name: "TerminalClose",
+      description: "Close a persistent terminal",
+      inputSchema: CloseInput,
+      paths: () => [],
+      execute: async (input, _signal, context) => {
+        terminals.close(input.id, owner(context));
+        return { id: input.id, closed: true };
+      }
+    },
+    {
+      name: "TerminalList",
+      description: "List persistent terminals owned by this agent",
+      inputSchema: z26.object({}),
+      paths: () => [],
+      execute: async (_input, _signal, context) => terminals.list(owner(context))
+    }
+  ];
+  return tools;
+}
+
 // src/production.ts
 var INTERRUPTED_TASK_PLAN_CONTEXT = [
   "The previous turn's task plan was cancelled and archived, so it is no longer active.",
@@ -13893,7 +15190,7 @@ var ApprovalBridge = class {
   request(request, signal = new AbortController().signal) {
     if (this.#settle !== void 0) return Promise.resolve("deny");
     if (signal.aborted) return Promise.resolve("deny");
-    this.#pending = { id: randomUUID10(), ...request };
+    this.#pending = { id: randomUUID12(), ...request };
     this.#onChange?.();
     return new Promise((resolvePromise) => {
       this.#settle = resolvePromise;
@@ -13914,8 +15211,8 @@ var ApprovalBridge = class {
   }
 };
 async function createProductionRuntime(options) {
-  const workspace = resolve21(options.workspace ?? process.cwd());
-  const home = resolve21(options.home ?? homedir());
+  const workspace = resolve24(options.workspace ?? process.cwd());
+  const home = resolve24(options.home ?? homedir());
   const environment = options.environment ?? process.env;
   const ide = new FlavorIdeClient({ workspace, home, environment });
   const ideReady = ide.initialize();
@@ -14048,17 +15345,29 @@ async function createProductionRuntime(options) {
     return questions.ask(qs, signal);
   };
   const executionEnvironment = createExecutionEnvironment(workspace, config.execution);
-  const fileMutationOptions = options.beforeFileCommit === void 0 ? {} : { beforeCommit: options.beforeFileCommit };
+  const jobs = new JobRegistry();
+  const terminals = new TerminalService(workspace, { jobs });
+  const observations = new FileObservationStore();
+  const workspaceInstructions = new WorkspaceInstructions(workspace);
+  const fileMutationOptions = {
+    observations,
+    ...options.beforeFileCommit === void 0 ? {} : { beforeCommit: options.beforeFileCommit }
+  };
   const tools = [
-    createReadTool(workspace),
+    createReadTool(workspace, { observations }),
     createWriteTool(workspace, fileMutationOptions),
     createEditTool(workspace, fileMutationOptions),
     createApplyPatchTool(workspace, fileMutationOptions),
     createGlobTool(workspace),
     createGrepTool(workspace),
     createShellTool(workspace, {
+      jobs,
       ...executionEnvironment === void 0 ? {} : { executionEnvironment }
     }),
+    createWebFetchTool(),
+    createWebSearchTool(),
+    ...createJobTools(jobs),
+    ...createTerminalTools(terminals, workspace),
     ...createLspTools(workspace, {
       onStatus: (message2) => emitOutput({ type: "notice", message: message2 })
     }),
@@ -14190,7 +15499,9 @@ async function createProductionRuntime(options) {
     const skillsReady = skills.discover();
     skillsReady.catch(() => void 0);
     tools.push(createSkillResourceTool(skills));
+    if (options.extraTools !== void 0) tools.push(...options.extraTools);
     const flavor = await optionalText2(join17(workspace, "FLAVOR.md"));
+    const instructionBaseline = await workspaceInstructions.baseline();
     let memoryContext;
     if (memoryStore !== void 0) {
       try {
@@ -14213,7 +15524,7 @@ async function createProductionRuntime(options) {
     let taskResults = { ...recovered?.tasks.results ?? {} };
     const subagentStartedAt = {};
     const subagentElapsedMs = {};
-    let sessionId = recovered?.sessionId ?? `session-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID10().slice(0, 8)}`;
+    let sessionId = recovered?.sessionId ?? `session-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID12().slice(0, 8)}`;
     setUsageSession(sessionId);
     ideSessionId = sessionId;
     await ideReady;
@@ -14383,6 +15694,7 @@ async function createProductionRuntime(options) {
           })
         ],
         ...flavor === void 0 ? {} : { flavor },
+        ...instructionBaseline === "" ? {} : { workspaceInstructions: instructionBaseline },
         ...memoryContext === void 0 ? {} : { memory: memoryContext },
         ...taskState === void 0 ? {} : { taskState },
         userMemory: () => userMemoryContext ?? "",
@@ -14420,6 +15732,7 @@ async function createProductionRuntime(options) {
       maxIterationsMain: config.maxIterations.main,
       maxIterationsSubagent: config.maxIterations.subagent,
       hasActiveProgress,
+      afterToolSuccess: async (_tool, paths, _input, _output, context) => workspaceInstructions.discover(paths, context.ownerId ?? context.agent),
       approve: resolveToolApproval
     });
     harnessCreated = true;
@@ -14520,7 +15833,7 @@ async function createProductionRuntime(options) {
       const prompt = String(event.payload.prompt);
       const reassessInterruptedPlan = interruptedTaskPlanNeedsReassessment && !prompt.startsWith("/");
       timelineState = transcriptReducer(timelineState, { type: "submit", prompt });
-      automaticMemoryTask = !prompt.startsWith("/");
+      automaticMemoryTask = !prompt.startsWith("/") && harness.permissionProfile !== "d2c";
       if (automaticMemoryTask) memoryReviews.dismissAll();
       if (!prompt.startsWith("/") && memoryLifecycle.status === "completed") {
         memoryLifecycle = {
@@ -14645,16 +15958,23 @@ async function createProductionRuntime(options) {
         return;
       }
       const loopExecutionEnvironment = createExecutionEnvironment(input.workspace, config.execution);
+      const loopObservations = new FileObservationStore();
+      const loopInstructions = new WorkspaceInstructions(input.workspace);
+      const loopMutationOptions = { observations: loopObservations };
       const loopTools = [
-        createReadTool(input.workspace),
-        createWriteTool(input.workspace),
-        createEditTool(input.workspace),
-        createApplyPatchTool(input.workspace),
+        createReadTool(input.workspace, { observations: loopObservations }),
+        createWriteTool(input.workspace, loopMutationOptions),
+        createEditTool(input.workspace, loopMutationOptions),
+        createApplyPatchTool(input.workspace, loopMutationOptions),
         createGlobTool(input.workspace),
         createGrepTool(input.workspace),
         createShellTool(input.workspace, {
+          jobs,
           ...loopExecutionEnvironment === void 0 ? {} : { executionEnvironment: loopExecutionEnvironment }
         }),
+        createWebFetchTool(),
+        createWebSearchTool(),
+        ...createJobTools(jobs),
         ...createLspTools(input.workspace, {
           onStatus: (status) => emitOutput({ type: "notice", message: status })
         }),
@@ -14662,6 +15982,7 @@ async function createProductionRuntime(options) {
         ...mcpTools
       ];
       const loopFlavor = await optionalText2(join17(input.workspace, "FLAVOR.md"));
+      const loopInstructionBaseline = await loopInstructions.baseline();
       const loopEnvironment = createPromptEnvironment({
         now: /* @__PURE__ */ new Date(),
         platform: process.platform,
@@ -14691,6 +16012,7 @@ async function createProductionRuntime(options) {
             })
           ],
           ...loopFlavor === void 0 ? {} : { flavor: loopFlavor },
+          ...loopInstructionBaseline === "" ? {} : { workspaceInstructions: loopInstructionBaseline },
           ...memoryContext === void 0 ? {} : { memory: memoryContext },
           userMemory: () => userMemoryContext ?? "",
           ...compactAtChars === void 0 ? {} : { compactAtChars },
@@ -14723,6 +16045,7 @@ async function createProductionRuntime(options) {
         maxIterationsMain: config.maxIterations.main,
         maxIterationsSubagent: config.maxIterations.subagent,
         loopMode: true,
+        afterToolSuccess: async (_tool, paths, _input, _output, context) => loopInstructions.discover(paths, context.ownerId ?? context.agent),
         approve: resolveToolApproval
       });
       try {
@@ -14774,7 +16097,7 @@ async function createProductionRuntime(options) {
         return answers[0] === "Continue" ? "approved" : "rejected";
       },
       fingerprint: workspaceFingerprint,
-      idFactory: () => `loop-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID10().slice(0, 8)}`
+      idFactory: () => `loop-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID12().slice(0, 8)}`
     });
     const goalStore = new GoalStore({ workspace });
     const goalOrchestrator = new GoalOrchestrator({
@@ -14787,13 +16110,13 @@ async function createProductionRuntime(options) {
       maxStallStreak: 2,
       persistence: goalStore,
       now: () => (/* @__PURE__ */ new Date()).toISOString(),
-      idFactory: () => `goal-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID10().slice(0, 8)}`,
+      idFactory: () => `goal-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID12().slice(0, 8)}`,
       runWorker: ({ workspace: goalWorkspace, prompt, signal }) => runLoopWorker({ workspace: goalWorkspace, prompt, signal })
     });
     let sessionHistory = await SessionHistory.open({
       workspace,
       sessionId,
-      restoreContext: (snapshot2) => harness.main.context.restore(snapshot2)
+      restoreContext: (snapshot4) => harness.main.context.restore(snapshot4)
     });
     const services = {
       hooks,
@@ -14905,7 +16228,7 @@ async function createProductionRuntime(options) {
       tasks: () => ({ plan: taskPlan, graph: taskGraph, states: taskStates, results: taskResults }),
       audit: async (toolFilter) => {
         try {
-          const raw = await readFile16(auditLogger.path, "utf8");
+          const raw = await readFile17(auditLogger.path, "utf8");
           const lines = raw.trim().split("\n").filter((line) => line.length > 0);
           const entries = lines.map((line) => {
             try {
@@ -14944,7 +16267,7 @@ ${summary2}`;
       },
       usage: async () => {
         try {
-          const raw = await readFile16(usageLogPath(), "utf8");
+          const raw = await readFile17(usageLogPath(), "utf8");
           return formatUsageSummary(summarizeUsage(parseUsageEntries(raw)));
         } catch (error) {
           if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
@@ -14972,7 +16295,7 @@ ${summary2}`;
         for (const key of Object.keys(subagentStartedAt)) delete subagentStartedAt[key];
         for (const key of Object.keys(subagentElapsedMs)) delete subagentElapsedMs[key];
         const previousIdeSessionId = ideSessionId;
-        sessionId = `session-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID10().slice(0, 8)}`;
+        sessionId = `session-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID12().slice(0, 8)}`;
         setUsageSession(sessionId);
         ideSessionId = sessionId;
         if (previousIdeSessionId !== void 0) await ide.endSession(previousIdeSessionId);
@@ -14981,7 +16304,7 @@ ${summary2}`;
         sessionHistory = await SessionHistory.open({
           workspace,
           sessionId,
-          restoreContext: (snapshot2) => harness.main.context.restore(snapshot2)
+          restoreContext: (snapshot4) => harness.main.context.restore(snapshot4)
         });
         memoryLifecycle = { status: "active", taskId: createMemoryTaskId(), messageStart: 0 };
         timelineState = createTranscriptState();
@@ -15087,7 +16410,10 @@ ${renderMemoryDocument(entries)}`;
             baseURL: next.baseURL,
             ...next.maxOutputTokens === void 0 ? {} : { maxOutputTokens: next.maxOutputTokens }
           };
-          registry.register(next.providerId, next.apiType === "anthropic" ? new AnthropicModelAdapter(adapterOptions) : new OpenAIModelAdapter(adapterOptions));
+          registry.register(next.providerId, next.apiType === "anthropic" ? new AnthropicModelAdapter({
+            ...adapterOptions,
+            ...providerConfig?.claudeClient === true ? { headers: CLAUDE_CLIENT_HEADERS } : {}
+          }) : new OpenAIModelAdapter(adapterOptions));
           effectiveLlm = next;
           mainModel = `${next.providerId}:${next.defaultModel}`;
           childModel = `${next.providerId}:${next.cheapModel}`;
@@ -15127,13 +16453,19 @@ ${renderMemoryDocument(entries)}`;
       sleepScheduler.start();
     }
     const session = new FlavorSession(services);
+    const authorization = {
+      permissionProfile: () => harness.permissionProfile,
+      setPermissionProfile: (profile) => harness.setPermissionProfile(profile)
+    };
     let disposed = false;
     return {
       session,
       services,
+      authorization,
       approvals,
       memoryReviews,
       restoredTranscript,
+      jobs: { list: () => jobs.list(), subscribe: (listener) => jobs.subscribe(listener) },
       get sessionId() {
         return sessionId;
       },
@@ -15150,6 +16482,8 @@ ${renderMemoryDocument(entries)}`;
         await persistTail;
         if (ideSessionId !== void 0) await ide.endSession(ideSessionId);
         await executionEnvironment?.dispose();
+        terminals.dispose();
+        await jobs.dispose();
         auditLogger.close();
         memoryReviews.dispose();
         await cleanupProduction(approvals, questions, pluginHost, mcpManager, harness);
@@ -15162,6 +16496,8 @@ ${renderMemoryDocument(entries)}`;
       if (ideSessionId !== void 0) await ide.endSession(ideSessionId);
       await sleepScheduler?.dispose();
       await executionEnvironment?.dispose();
+      terminals.dispose();
+      await jobs.dispose();
       await cleanupProduction(approvals, questions, pluginHost, mcpManager, harnessCreated ? harness : void 0);
     } catch (cleanupError) {
       attachCleanupError(primaryError, cleanupError);
@@ -15276,7 +16612,7 @@ function terminalProgressState(status) {
   return "failed";
 }
 async function workspaceFingerprint(workspace) {
-  const hash = createHash8("sha256");
+  const hash = createHash9("sha256");
   const diff = await execFileNoThrow(
     "git",
     ["-C", workspace, "diff", "--no-ext-diff", "--binary", "HEAD"],
@@ -15292,13 +16628,13 @@ async function workspaceFingerprint(workspace) {
   let remaining = 5 * 1024 * 1024;
   for (const name of untracked.stdout.split("\0").filter(Boolean).sort()) {
     if (name === ".flavor/loops" || name.startsWith(".flavor/loops/")) continue;
-    const path = resolve21(workspace, name);
-    const relativePath = relative18(resolve21(workspace), path);
-    if (relativePath === ".." || relativePath.startsWith(`..${sep17}`)) continue;
+    const path = resolve24(workspace, name);
+    const relativePath = relative20(resolve24(workspace), path);
+    if (relativePath === ".." || relativePath.startsWith(`..${sep19}`)) continue;
     hash.update(name);
     if (remaining <= 0) continue;
     try {
-      const content = await readFile16(path);
+      const content = await readFile17(path);
       const slice = content.subarray(0, remaining);
       hash.update(slice);
       remaining -= slice.length;
@@ -15495,7 +16831,10 @@ async function registerConfiguredAdapters(providers, registry, environment, diag
         ...runtimeProvider.baseURL === void 0 ? {} : { baseURL: runtimeProvider.baseURL },
         ...runtimeProvider.maxOutputTokens === void 0 ? {} : { maxOutputTokens: runtimeProvider.maxOutputTokens }
       };
-      const adapter = apiProtocol === "anthropic" ? new AnthropicModelAdapter(adapterOptions) : new OpenAIModelAdapter(adapterOptions);
+      const adapter = apiProtocol === "anthropic" ? new AnthropicModelAdapter({
+        ...adapterOptions,
+        ...runtimeProvider.claudeClient === true ? { headers: CLAUDE_CLIENT_HEADERS } : {}
+      }) : new OpenAIModelAdapter(adapterOptions);
       const cacheProfile = resolveCacheProfile({ apiType: apiProtocol, baseURL: runtimeProvider.baseURL });
       if (apiProtocol === "openai" && isDashScopeBaseURL(runtimeProvider.baseURL)) {
         diagnostics.push(
@@ -15687,7 +17026,7 @@ async function generateSleepReview(registry, modelId, prompt, signal) {
 }
 async function optionalText2(path) {
   try {
-    return await readFile16(path, "utf8");
+    return await readFile17(path, "utf8");
   } catch (error) {
     if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return void 0;
     throw error;
@@ -15700,10 +17039,10 @@ function remove(items, item) {
 function sameToolName(left, right) {
   return left.toLowerCase() === right.toLowerCase();
 }
-function storedConversation(snapshot2) {
+function storedConversation(snapshot4) {
   return {
-    ...snapshot2.compact === void 0 ? {} : { compact: snapshot2.compact },
-    messages: snapshot2.messages.flatMap((message2) => {
+    ...snapshot4.compact === void 0 ? {} : { compact: snapshot4.compact },
+    messages: snapshot4.messages.flatMap((message2) => {
       if (message2.role === "system") return [];
       const metadata = {
         ...message2.toolCallId === void 0 ? {} : { toolCallId: message2.toolCallId },
@@ -15826,10 +17165,10 @@ async function* runGoalSession(orchestrator, goal, signal) {
 }
 function memoryTranscriptHash(messages) {
   const visible = messages.filter((item) => item.role === "user" || item.role === "assistant").map((item) => `${item.role}\0${modelContentText(item.content).trim()}`).join("\n");
-  return createHash8("sha256").update(visible, "utf8").digest("hex");
+  return createHash9("sha256").update(visible, "utf8").digest("hex");
 }
 function createMemoryTaskId() {
-  return `memory-${randomUUID10()}`;
+  return `memory-${randomUUID12()}`;
 }
 
 export {