github-router 0.3.122 → 0.3.129

package/dist/{peer-mcp-personas-B6z15bmc.js → peer-mcp-personas-B1Oqydxt.js}

@@ -13,6 +13,7 @@ import process$1 from "node:process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { chmodSync, closeSync, cpSync, existsSync, mkdirSync, openSync, promises, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { fileURLToPath } from "node:url";
+import { Agent } from "undici";
 import { performance } from "node:perf_hooks";
 import { createInterface } from "node:readline";
 import Parser from "web-tree-sitter";
@@ -307,12 +308,12 @@ async function fetchWithTransientRetry(doFetch, opts = {}) {
 			await res.body.cancel();
 		} catch {}
 		const expCap = Math.min(maxDelayMs, baseDelayMs * 2 ** (attempt - 1));
-		const delay = Math.min(maxDelayMs, retryAfterMs ?? Math.round(Math.random() * expCap));
+		const delay$1 = Math.min(maxDelayMs, retryAfterMs ?? Math.round(Math.random() * expCap));
 		if (label) {
 			const why = res ? `HTTP ${res.status}` : caught?.name ?? "error";
-			consola.debug(`[upstream-retry] ${label}: attempt ${attempt}/${attempts} failed (${why}); retrying in ${delay}ms`);
+			consola.debug(`[upstream-retry] ${label}: attempt ${attempt}/${attempts} failed (${why}); retrying in ${delay$1}ms`);
 		}
-		await abortableSleep(delay, signal);
+		await abortableSleep(delay$1, signal);
 	}
 }
 /** Extract an HTTP status from a thrown error (HTTPError carries
@@ -353,9 +354,9 @@ async function withTransientRetry(fn, opts = {}) {
 			if (!(status !== void 0 && retryStatuses.includes(status) || isTransientNetworkError(err)) || attempt >= attempts) throw err;
 			const retryAfterMs = parseRetryAfter(err?.response?.headers?.get?.("retry-after") ?? null);
 			const expCap = Math.min(maxDelayMs, baseDelayMs * 2 ** (attempt - 1));
-			const delay = Math.min(maxDelayMs, retryAfterMs ?? Math.round(Math.random() * expCap));
-			if (label) consola.debug(`[upstream-retry] ${label}: attempt ${attempt}/${attempts} threw (${status !== void 0 ? `HTTP ${status}` : err?.name ?? "error"}); retrying in ${delay}ms`);
-			await abortableSleep(delay, signal);
+			const delay$1 = Math.min(maxDelayMs, retryAfterMs ?? Math.round(Math.random() * expCap));
+			if (label) consola.debug(`[upstream-retry] ${label}: attempt ${attempt}/${attempts} threw (${status !== void 0 ? `HTTP ${status}` : err?.name ?? "error"}); retrying in ${delay$1}ms`);
+			await abortableSleep(delay$1, signal);
 		}
 	}
 }
@@ -1199,7 +1200,7 @@ async function mapHttpError$1(response) {
 	});
 }
 function mapNetworkError$1(err) {
-	if (isAbortLike$1(err)) return new ArtifactError({
+	if (isAbortLike$2(err)) return new ArtifactError({
 		code: "TIMEOUT",
 		message: "artifact API request timed out or was aborted",
 		retryable: true,
@@ -1234,7 +1235,7 @@ function detailToMessage$1(detail) {
 	}
 	if (typeof record.message === "string") return record.message;
 }
-function isAbortLike$1(err) {
+function isAbortLike$2(err) {
 	return err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
 }
 
@@ -1417,8 +1418,235 @@ function stringProp$1(description) {
 	};
 }
 
+//#endregion
+//#region src/lib/fleet/tunnel-auth.ts
+var TunnelAuthError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "TunnelAuthError";
+		this.code = code;
+	}
+};
+const REFRESH_MARGIN_MS = 5 * 6e4;
+const MIN_REMINT_INTERVAL_MS = 3e4;
+const DEVTUNNEL_TIMEOUT_MS = 1e4;
+const MINT_FAILURE_BACKOFF_MS = 3e4;
+const MAX_PLAUSIBLE_TTL_MS = 2880 * 6e4;
+const MAX_STDOUT_BYTES$2 = 256 * 1024;
+const TUNNEL_ID_RE$1 = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const JWT_REDACT_RE = /eyJ[A-Za-z0-9._-]{20,}/g;
+const SCHEME_TOKEN_RE = /(bearer|tunnel) +[!-~]+/gi;
+/** Strip credential-shaped substrings from any string before it is logged or surfaced. */
+function redactTunnelSecrets(s) {
+	return s.replace(JWT_REDACT_RE, "<redacted-token>").replace(SCHEME_TOKEN_RE, "$1 <redacted-token>");
+}
+function safeRealpath(p) {
+	try {
+		return realpathSync(p);
+	} catch {
+		return nodePath.resolve(p);
+	}
+}
+/**
+* Guard the resolved `devtunnel` path: it must be a trusted ABSOLUTE path that
+* is not the current working directory's own binary. `resolveExecutable` already
+* excludes cwd; this is defense-in-depth against a cwd-local / relative
+* resolution ever reaching a child-process spawn. Both paths are canonicalized
+* (realpath, resolving `..` and symlinks) before the cwd-containment check, so a
+* non-canonical path like `/safe/../cwd/devtunnel` or a symlink cannot evade it.
+* Returns the (original) path to spawn, or throws.
+*/
+function assertTrustedDevtunnelPath(resolved, cwd = typeof process.cwd === "function" ? nodePath.resolve(process.cwd()) : null) {
+	if (!resolved) throw new TunnelAuthError("NOT_INSTALLED", "the devtunnel CLI was not found on PATH; install it and run `devtunnel user login` on this (control-plane) machine");
+	if (!nodePath.isAbsolute(resolved)) throw new TunnelAuthError("NOT_INSTALLED", "refusing to run a non-absolute devtunnel binary");
+	const ext = nodePath.extname(resolved).toLowerCase();
+	if (ext === ".cmd" || ext === ".bat" || ext === ".ps1") throw new TunnelAuthError("NOT_INSTALLED", "resolved devtunnel is a script shim (.cmd/.bat/.ps1); github-router runs the native devtunnel(.exe) — ensure the native binary precedes any shim on PATH");
+	const realResolved = safeRealpath(resolved);
+	const realCwd = cwd ? safeRealpath(cwd) : null;
+	if (realCwd && (realResolved === realCwd || realResolved.startsWith(realCwd + nodePath.sep))) throw new TunnelAuthError("NOT_INSTALLED", "refusing to run a cwd-local devtunnel binary");
+	return resolved;
+}
+/**
+* The real runner: resolve `devtunnel` to a trusted absolute path (PATH-resolved,
+* cwd-excluded) and run it with `shell:false` (native binary).
+*/
+function realDevtunnelRunner() {
+	return async (args) => {
+		const res = await runManagedExeCapture(assertTrustedDevtunnelPath(resolveExecutable("devtunnel")), args, {
+			timeoutMs: DEVTUNNEL_TIMEOUT_MS,
+			maxStdoutBytes: MAX_STDOUT_BYTES$2
+		});
+		return {
+			stdout: res.stdout,
+			stderr: res.stderr,
+			code: res.code,
+			timedOut: res.timedOut
+		};
+	};
+}
+function looksLikeJwt(s) {
+	const parts = s.split(".");
+	if (parts.length !== 3) return false;
+	return parts.every((p) => p.length > 0 && /^[A-Za-z0-9_-]+$/.test(p));
+}
+/** Recursively collect JWT-shaped strings from arbitrary parsed JSON. */
+function collectJwts(value, out) {
+	if (typeof value === "string") {
+		if (value.startsWith("eyJ") && looksLikeJwt(value)) out.add(value);
+		return;
+	}
+	if (Array.isArray(value)) {
+		for (const v of value) collectJwts(v, out);
+		return;
+	}
+	if (value && typeof value === "object") for (const v of Object.values(value)) collectJwts(v, out);
+}
+/**
+* Extract the single access token from `devtunnel token --json` output. Prefers
+* structured JSON; falls back to a token-shaped scan. Refuses to guess when zero
+* or more-than-one distinct tokens are present (so we never send a wrong JWT).
+*/
+function extractToken(stdout) {
+	const found = /* @__PURE__ */ new Set();
+	try {
+		collectJwts(JSON.parse(stdout), found);
+	} catch {}
+	if (found.size === 0) {
+		for (const tok of stdout.split(/[^A-Za-z0-9._-]+/)) if (tok.startsWith("eyJ") && looksLikeJwt(tok)) found.add(tok);
+	}
+	if (found.size === 0) throw new TunnelAuthError("PARSE", "no tunnel access token found in devtunnel output");
+	if (found.size > 1) throw new TunnelAuthError("PARSE", "devtunnel output contained more than one token; refusing to guess");
+	return [...found][0];
+}
+/** Parse a JWT `exp` claim (seconds) into epoch milliseconds. Throws on a missing/non-numeric exp. */
+function parseJwtExpMs(jwt) {
+	const parts = jwt.split(".");
+	if (parts.length !== 3) throw new TunnelAuthError("PARSE", "tunnel token is not a JWT");
+	let payload;
+	try {
+		payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+	} catch {
+		throw new TunnelAuthError("PARSE", "tunnel token payload was not decodable");
+	}
+	const exp = payload?.exp;
+	if (typeof exp !== "number" || !Number.isFinite(exp)) throw new TunnelAuthError("PARSE", "tunnel token has no numeric exp claim");
+	return exp * 1e3;
+}
+function classifyMintFailure(res) {
+	if (res.timedOut) return new TunnelAuthError("TIMEOUT", "devtunnel token request timed out");
+	const stderr = (res.stderr || "").toLowerCase();
+	const tail = redactTunnelSecrets((res.stderr || "").trim()).slice(-300);
+	const suffix = tail ? ` [${tail}]` : "";
+	if (/log ?in|sign ?in|not authenticated|unauthor|401/.test(stderr)) return new TunnelAuthError("NOT_LOGGED_IN", `devtunnel is not logged in (or lacks access to this tunnel) on the control-plane machine; run \`devtunnel user login\`${suffix}`);
+	if (/not found|404|does not exist|no such tunnel/.test(stderr)) return new TunnelAuthError("TUNNEL_NOT_FOUND", `devtunnel could not find the tunnel; verify tunnelId with \`devtunnel list\`${suffix}`);
+	return new TunnelAuthError("MINT_FAILED", `devtunnel token failed (exit ${res.code})${suffix}`);
+}
+/**
+* Create a per-process token provider: lazy mint, per-tunnel in-memory cache,
+* single-flight, and short negative backoff on non-timeout failures.
+*/
+function createTunnelTokenProvider(runner = realDevtunnelRunner()) {
+	const cache = /* @__PURE__ */ new Map();
+	const inflight = /* @__PURE__ */ new Map();
+	const backoff = /* @__PURE__ */ new Map();
+	async function mint(cfg) {
+		if (!TUNNEL_ID_RE$1.test(cfg.tunnelId)) throw new TunnelAuthError("MINT_FAILED", "invalid tunnelId; must match a devtunnel tunnel name");
+		const args = [
+			"token",
+			cfg.tunnelId,
+			"--scopes",
+			"connect",
+			"--json"
+		];
+		let res;
+		try {
+			res = await runner(args);
+		} catch (err) {
+			if (err instanceof TunnelAuthError) throw err;
+			throw new TunnelAuthError("MINT_FAILED", redactTunnelSecrets(err instanceof Error ? err.message : String(err)));
+		}
+		if (res.timedOut) throw new TunnelAuthError("TIMEOUT", "devtunnel token request timed out");
+		if (res.code !== 0) throw classifyMintFailure(res);
+		const token = extractToken(res.stdout);
+		const expMs = parseJwtExpMs(token);
+		const now = Date.now();
+		if (expMs <= now) throw new TunnelAuthError("PARSE", "devtunnel minted an already-expired token");
+		if (expMs - now > MAX_PLAUSIBLE_TTL_MS) throw new TunnelAuthError("PARSE", "devtunnel token TTL is implausibly long; refusing");
+		const existing = cache.get(cfg.tunnelId);
+		if (!existing || expMs > existing.expMs) cache.set(cfg.tunnelId, {
+			token,
+			expMs,
+			mintedAt: now
+		});
+		return cache.get(cfg.tunnelId).token;
+	}
+	function mintOnce(cfg) {
+		const key = cfg.tunnelId;
+		return (async () => {
+			try {
+				const token = await mint(cfg);
+				backoff.delete(key);
+				return token;
+			} catch (err) {
+				const e = err instanceof TunnelAuthError ? err : new TunnelAuthError("MINT_FAILED", redactTunnelSecrets(String(err)));
+				if (e.code !== "TIMEOUT") backoff.set(key, {
+					until: Date.now() + MINT_FAILURE_BACKOFF_MS,
+					err: e
+				});
+				const c = cache.get(key);
+				if (c && c.expMs > Date.now()) return c.token;
+				throw e;
+			} finally {
+				inflight.delete(key);
+			}
+		})();
+	}
+	return {
+		async getToken(cfg) {
+			const key = cfg.tunnelId;
+			const now = Date.now();
+			const cached$1 = cache.get(key);
+			if (cached$1 && cached$1.expMs > now) {
+				const comfortablyFresh = cached$1.expMs - now > REFRESH_MARGIN_MS;
+				const recentlyMinted = now - cached$1.mintedAt < MIN_REMINT_INTERVAL_MS;
+				if (comfortablyFresh || recentlyMinted) return cached$1.token;
+			}
+			const inf = inflight.get(key);
+			if (inf) return inf;
+			const bo = backoff.get(key);
+			if (bo && now < bo.until) {
+				if (cached$1 && cached$1.expMs > now) return cached$1.token;
+				throw bo.err;
+			}
+			const p = mintOnce(cfg);
+			inflight.set(key, p);
+			return p;
+		},
+		invalidate(cfg) {
+			cache.delete(cfg.tunnelId);
+			backoff.delete(cfg.tunnelId);
+		}
+	};
+}
+
 //#endregion
 //#region src/lib/fleet/client.ts
+const IS_BUN = typeof globalThis.Bun !== "undefined";
+let sharedInsecureDispatcher;
+function insecureDispatcher() {
+	return sharedInsecureDispatcher ??= new Agent({ connect: { rejectUnauthorized: false } });
+}
+/**
+* Attach the runtime-correct TLS-verification-off mechanism to a fetch init for a
+* single self-signed direct-HTTPS instance: Bun → `tls`, Node → an undici
+* `dispatcher`. Exported so BOTH runtime branches are unit-testable under one
+* interpreter (the untested Node branch is exactly what shipped broken).
+*/
+function applyInsecureTls(init, isBun = IS_BUN) {
+	if (isBun) init.tls = { rejectUnauthorized: false };
+	else init.dispatcher = insecureDispatcher();
+}
 var FleetError = class extends Error {
 	code;
 	retryable;
@@ -1450,12 +1678,23 @@ function decodeSessionId(globalId) {
 }
 var FleetClient = class {
 	baseUrl;
+	origin;
 	token;
 	fetchFn;
+	getTunnelToken;
+	onTunnelAuthInvalidate;
+	insecureTLS;
 	constructor(options) {
 		this.baseUrl = options.url.replace(/\/+$/, "");
+		this.origin = new URL(this.baseUrl).origin;
 		this.token = options.token;
 		this.fetchFn = options.fetchFn ?? globalThis.fetch.bind(globalThis);
+		this.getTunnelToken = options.getTunnelToken;
+		this.onTunnelAuthInvalidate = options.onTunnelAuthInvalidate;
+		this.insecureTLS = options.insecureTLS === true;
+	}
+	capabilities(signal) {
+		return this.request("GET", "/api/control/capabilities", void 0, void 0, signal);
 	}
 	listSessions(signal) {
 		return this.request("GET", "/api/control/sessions", void 0, void 0, signal);
@@ -1525,67 +1764,178 @@ var FleetClient = class {
 	async request(method, pathname, query, body, signal) {
 		const url = new URL(pathname, `${this.baseUrl}/`);
 		for (const [key, value] of Object.entries(query ?? {})) url.searchParams.set(key, value);
-		let response;
-		try {
-			response = await this.fetchFn(url.toString(), {
-				method,
-				headers: {
-					Authorization: `Bearer ${this.token}`,
-					...body === void 0 ? {} : { "Content-Type": "application/json" }
-				},
-				body: body === void 0 ? void 0 : JSON.stringify(body),
-				redirect: "error",
-				signal
-			});
-		} catch (err) {
-			throw mapNetworkError(err);
+		if (url.origin !== this.origin) throw new FleetError({
+			code: "UNREACHABLE",
+			message: "fleet request URL origin did not match the registered instance origin",
+			retryable: false
+		});
+		const devtunnelHost = isDevtunnelHost(url.hostname);
+		const tunnelEligible = this.getTunnelToken !== void 0 && devtunnelHost && url.protocol === "https:";
+		for (let attempt = 0; attempt < 2; attempt++) {
+			let tunnelToken;
+			if (tunnelEligible) try {
+				tunnelToken = await this.getTunnelToken();
+			} catch (err) {
+				throw mapTunnelAuthError(err);
+			}
+			const attachTunnel = tunnelToken !== void 0 && tunnelToken !== "";
+			const canRetry = attachTunnel && !!this.onTunnelAuthInvalidate && attempt === 0;
+			const headers = {
+				Authorization: `Bearer ${this.token}`,
+				...devtunnelHost ? { "X-Tunnel-Skip-Anti-Phishing-Page": "true" } : {},
+				...attachTunnel ? { "X-Tunnel-Authorization": `tunnel ${tunnelToken}` } : {},
+				...body === void 0 ? {} : { "Content-Type": "application/json" }
+			};
+			let response;
+			try {
+				const init = {
+					method,
+					headers,
+					body: body === void 0 ? void 0 : JSON.stringify(body),
+					redirect: "error",
+					signal
+				};
+				if (this.insecureTLS) applyInsecureTls(init);
+				response = await this.fetchFn(url.toString(), init);
+			} catch (err) {
+				if (canRetry && method === "GET") {
+					this.onTunnelAuthInvalidate();
+					continue;
+				}
+				throw mapNetworkError(err, devtunnelHost);
+			}
+			if (!response.ok) {
+				if ((response.status === 401 || response.status === 403) && canRetry) {
+					this.onTunnelAuthInvalidate();
+					continue;
+				}
+				throw await mapHttpError(response, url.toString());
+			}
+			return await response.json();
 		}
-		if (!response.ok) throw await mapHttpError(response);
-		return await response.json();
+		throw new FleetError({
+			code: "AUTH_FAILED",
+			message: "fleet instance tunnel authentication failed after re-mint; verify the tunnel and `devtunnel user login`",
+			retryable: false
+		});
 	}
 };
-async function mapHttpError(response) {
+/** Dev Tunnel access tokens are only ever scoped to the `*.devtunnels.ms` service. */
+function isDevtunnelHost(hostname) {
+	return hostname === "devtunnels.ms" || hostname.endsWith(".devtunnels.ms");
+}
+function mapTunnelAuthError(err) {
+	if (err instanceof TunnelAuthError) return new FleetError({
+		code: "AUTH_FAILED",
+		message: err.message,
+		retryable: err.code === "TIMEOUT",
+		detail: { tunnelAuth: err.code }
+	});
+	return mapNetworkError(err);
+}
+async function mapHttpError(response, requestUrl) {
 	const detail = await readErrorDetail(response);
 	const upstreamMessage = detailToMessage(detail);
 	const suffix = upstreamMessage ? `: ${upstreamMessage}` : "";
-	if (response.status === 401 || response.status === 403) return new FleetError({
+	const status = response.status;
+	if (isDevTunnelHost(requestUrl) && detectDevTunnelNoHost(status, detail)) return new FleetError({
+		code: "NO_HOST",
+		message: `dev tunnel relay reports no host connected (${status})${suffix}`,
+		retryable: true,
+		status,
+		detail
+	});
+	if (status === 401 || status === 403) return new FleetError({
 		code: "AUTH_FAILED",
-		message: `fleet instance authentication failed (${response.status})${suffix}`,
+		message: `fleet instance authentication failed (${status})${suffix}`,
 		retryable: false,
-		status: response.status,
+		status,
 		detail
 	});
-	if (response.status === 404) return new FleetError({
+	if (status === 404) return new FleetError({
 		code: "SESSION_NOT_FOUND",
 		message: `fleet session or resource not found (404)${suffix}`,
 		retryable: false,
-		status: response.status,
+		status,
 		detail
 	});
-	if (response.status === 409 || response.status === 412) return new FleetError({
+	if (status === 409 || status === 412) return new FleetError({
 		code: "PRECONDITION_FAILED",
-		message: `fleet instance precondition failed (${response.status})${suffix}`,
+		message: `fleet instance precondition failed (${status})${suffix}`,
 		retryable: false,
-		status: response.status,
+		status,
 		detail
 	});
-	if (response.status === 408 || response.status === 504) return new FleetError({
+	if (status === 400) return new FleetError({
+		code: "BAD_REQUEST",
+		message: `fleet instance rejected the request (400)${suffix}`,
+		retryable: false,
+		status,
+		detail
+	});
+	if (status === 408 || status === 504) return new FleetError({
 		code: "TIMEOUT",
-		message: `fleet instance request timed out (${response.status})${suffix}`,
+		message: `fleet instance request timed out (${status})${suffix}`,
 		retryable: true,
-		status: response.status,
+		status,
+		detail
+	});
+	if ((status === 502 || status === 503) && isDevTunnelHost(requestUrl)) return new FleetError({
+		code: "RELAY_ERROR",
+		message: `dev tunnel relay returned HTTP ${status} (host may be down, restarting, or under load)${suffix}`,
+		retryable: true,
+		status,
+		detail
+	});
+	if (status === 429) return new FleetError({
+		code: "RATE_LIMITED",
+		message: `fleet instance rate-limited the request (429)${suffix}`,
+		retryable: true,
+		status,
 		detail
 	});
 	return new FleetError({
 		code: "UPSTREAM_ERROR",
-		message: `fleet instance returned HTTP ${response.status}${suffix}`,
-		retryable: response.status === 429 || response.status >= 500,
-		status: response.status,
+		message: `fleet instance returned HTTP ${status}${suffix}`,
+		retryable: status >= 500,
+		status,
 		detail
 	});
 }
-function mapNetworkError(err) {
-	if (isAbortLike(err)) return new FleetError({
+const DEVTUNNEL_HOST_RE$1 = /(?:^|\.)devtunnels\.ms$|(?:^|\.)tunnels\.api\.visualstudio\.com$/i;
+/** F4: only Dev Tunnel relay hosts may be classified NO_HOST / RELAY_ERROR. */
+function isDevTunnelHost(requestUrl) {
+	try {
+		return DEVTUNNEL_HOST_RE$1.test(new URL(requestUrl).hostname);
+	} catch {
+		return false;
+	}
+}
+const DEVTUNNEL_NO_HOST_SIGNALS = [
+	"no host is currently connected",
+	"tunnel is not currently hosted",
+	"host is not accepting connections",
+	"tunnel host is not connected",
+	"no connection to the host",
+	"tunnelporthostnotconnected"
+];
+function detectDevTunnelNoHost(status, detail) {
+	if (status !== 502 && status !== 503 && status !== 404) return false;
+	const haystack = detailToSearchString(detail).toLowerCase();
+	if (haystack === "") return false;
+	return DEVTUNNEL_NO_HOST_SIGNALS.some((signal) => haystack.includes(signal));
+}
+function detailToSearchString(detail) {
+	if (detail === void 0 || detail === null) return "";
+	if (typeof detail === "string") return detail;
+	try {
+		return JSON.stringify(detail);
+	} catch {
+		return String(detail);
+	}
+}
+function mapNetworkError(err, devtunnelHost = false) {
+	if (isAbortLike$1(err)) return new FleetError({
 		code: "TIMEOUT",
 		message: "fleet instance request timed out or was aborted",
 		retryable: true,
@@ -1593,7 +1943,7 @@ function mapNetworkError(err) {
 	});
 	return new FleetError({
 		code: "UNREACHABLE",
-		message: `fleet instance unreachable: ${err instanceof Error ? err.message : String(err)}`,
+		message: `fleet instance unreachable: ${err instanceof Error ? err.message : String(err)}${devtunnelHost ? " — if this is a private VS Code Dev Tunnel, an unauthenticated request is redirected to GitHub auth (which we refuse to follow): set a `tunnelId` (auto-mint) / `tunnelToken` in the registry, or make the tunnel anonymous" : ""}`,
 		retryable: true,
 		detail: err
 	});
@@ -1620,7 +1970,7 @@ function detailToMessage(detail) {
 	}
 	if (typeof record.message === "string") return record.message;
 }
-function isAbortLike(err) {
+function isAbortLike$1(err) {
 	return err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
 }
 
@@ -1645,7 +1995,7 @@ async function loadFleetRegistryConfig(configPath = defaultFleetConfigPath()) {
 		if (isNodeErrorCode(err, "ENOENT")) return { instances: [] };
 		throw err;
 	}
-	if (process.platform !== "win32" && (stat$1.mode & 63) !== 0) console.warn(`[fleet] Registry file ${configPath} is group/other-readable; it contains bearer tokens. Consider chmod 600.`);
+	if (process.platform !== "win32" && (stat$1.mode & 63) !== 0) console.warn(`[fleet] Registry file ${configPath} is group/other-readable; it contains bearer / tunnel credentials. Consider chmod 600.`);
 	const raw = await fs.readFile(configPath, "utf8");
 	if (raw.trim() === "") return { instances: [] };
 	const parsed = JSON.parse(raw);
@@ -1722,15 +2072,48 @@ function parseInstance(raw) {
 		throw invalidInstanceUrlError(id);
 	}
 	if (!isAllowedInstanceUrl(parsedUrl)) throw invalidInstanceUrlError(id);
+	assertDevTunnelUrlShape(id, parsedUrl);
+	if (parsedUrl.username !== "" || parsedUrl.password !== "") throw new FleetRegistryError("INVALID_CONFIG", `fleet registry instance ${id} url must not contain embedded credentials (userinfo)`);
 	if (typeof token !== "string" || token === "") throw new FleetRegistryError("INVALID_CONFIG", `fleet registry instance ${id} token must be a non-empty string`);
+	const tunnelId = parseTunnelId(id, instance.tunnelId);
+	const tunnelToken = parseTunnelToken(id, instance.tunnelToken);
+	const insecureTLS = parseInsecureTLS(id, instance.insecureTLS);
+	if (insecureTLS) {
+		if (parsedUrl.protocol !== "https:") throw new FleetRegistryError("INVALID_CONFIG", `fleet registry instance ${id} insecureTLS only applies to an https url (an http url has no TLS to relax)`);
+		if (tunnelId !== void 0 || tunnelToken !== void 0) throw new FleetRegistryError("INVALID_CONFIG", `fleet registry instance ${id} insecureTLS must not be combined with a Dev Tunnel (tunnelId/tunnelToken); the relay presents a valid public cert, so disabling verification only exposes the bearer/tunnel token to MITM`);
+		if (!isLocalNetworkHost(parsedUrl.hostname)) throw new FleetRegistryError("INVALID_CONFIG", DEVTUNNEL_HOST_RE.test(parsedUrl.hostname) ? `fleet registry instance ${id} insecureTLS must not be set on a Dev Tunnel host; *.devtunnels.ms presents a valid public cert` : `fleet registry instance ${id} insecureTLS is only allowed for a local-network host (loopback, a private/LAN IP, or a .local name); refusing to disable TLS verification for public host ${parsedUrl.hostname}`);
+	}
 	return {
 		id: id.trim(),
 		label: label.trim(),
 		url: trimmedUrl,
 		token,
 		default: instance.default === true ? true : void 0,
-		allowExec: instance.allowExec === true ? true : void 0
-	};
+		allowExec: instance.allowExec === true ? true : void 0,
+		tunnelId,
+		tunnelToken,
+		insecureTLS
+	};
+}
+const TUNNEL_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function parseTunnelId(id, raw) {
+	if (raw === void 0) return void 0;
+	if (typeof raw !== "string" || !TUNNEL_ID_RE.test(raw.trim())) throw new FleetRegistryError("INVALID_CONFIG", `fleet registry instance ${id} tunnelId must match ${TUNNEL_ID_RE.source} (a devtunnel tunnel name from \`devtunnel list\`)`);
+	return raw.trim();
+}
+function parseTunnelToken(id, raw) {
+	if (raw === void 0) return void 0;
+	if (typeof raw !== "string") throw new FleetRegistryError("INVALID_CONFIG", `fleet registry instance ${id} tunnelToken must be a string`);
+	let t = raw.trim();
+	if (t.startsWith("\"") && t.endsWith("\"") || t.startsWith("'") && t.endsWith("'")) t = t.slice(1, -1).trim();
+	t = t.replace(/^X-Tunnel-Authorization:\s*/i, "").replace(/^tunnel\s+/i, "").trim();
+	if (t === "" || /\s/.test(t)) throw new FleetRegistryError("INVALID_CONFIG", `fleet registry instance ${id} tunnelToken must be a non-empty single-line token`);
+	return t;
+}
+function parseInsecureTLS(id, raw) {
+	if (raw === void 0) return void 0;
+	if (typeof raw !== "boolean") throw new FleetRegistryError("INVALID_CONFIG", `fleet registry instance ${id} insecureTLS must be a boolean`);
+	return raw === true ? true : void 0;
 }
 function invalidInstanceUrlError(id) {
 	return new FleetRegistryError("INVALID_CONFIG", `${id.trim()} url must be https (or http://localhost for local testing)`);
@@ -1740,13 +2123,56 @@ function isAllowedInstanceUrl(url) {
 	if (url.protocol !== "http:") return false;
 	return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
 }
+function isLocalNetworkHost(hostnameRaw) {
+	const host = hostnameRaw.replace(/^\[/, "").replace(/\]$/, "").toLowerCase();
+	if (host === "localhost") return true;
+	if (host.endsWith(".local")) return true;
+	const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+	if (v4) {
+		const octets = [
+			Number(v4[1]),
+			Number(v4[2]),
+			Number(v4[3]),
+			Number(v4[4])
+		];
+		if (octets.some((o) => o > 255)) return false;
+		const a = octets[0];
+		const b = octets[1];
+		if (a === 127) return true;
+		if (a === 10) return true;
+		if (a === 172 && b >= 16 && b <= 31) return true;
+		if (a === 192 && b === 168) return true;
+		if (a === 169 && b === 254) return true;
+		return false;
+	}
+	if (host.includes(":")) {
+		if (host === "::1") return true;
+		if (/^fe[89ab]/.test(host)) return true;
+		if (/^f[cd]/.test(host)) return true;
+		return false;
+	}
+	return false;
+}
+const DEVTUNNEL_HOST_RE = /(?:^|\.)devtunnels\.ms$|(?:^|\.)tunnels\.api\.visualstudio\.com$/i;
+function assertDevTunnelUrlShape(id, url) {
+	if (!DEVTUNNEL_HOST_RE.test(url.hostname)) return;
+	if (url.port === "") return;
+	const firstDot = url.hostname.indexOf(".");
+	const firstLabel = firstDot < 0 ? url.hostname : url.hostname.slice(0, firstDot);
+	const rest = firstDot < 0 ? "" : url.hostname.slice(firstDot + 1);
+	const corrected = rest === "" ? `https://${firstLabel}-${url.port}.devtunnels.ms` : `https://${firstLabel}-${url.port}.${rest}`;
+	throw new FleetRegistryError("INVALID_CONFIG", `${id.trim()} url ${url.href} uses the wrong Dev Tunnel form: the forwarded port must be fused into the hostname, not given as a :port suffix. Use ${corrected} instead (the bare \`<id>.<cluster>.devtunnels.ms:<port>\` host addresses the tunnel-management endpoint, not the relayed service).`);
+}
 function resolvedInstance(instance) {
 	return {
 		id: instance.id,
 		label: instance.label,
 		url: instance.url,
 		token: instance.token,
-		allowExec: instance.allowExec
+		allowExec: instance.allowExec,
+		tunnelId: instance.tunnelId,
+		tunnelToken: instance.tunnelToken,
+		insecureTLS: instance.insecureTLS
 	};
 }
 function isObject(value) {
@@ -1761,6 +2187,15 @@ function isNodeErrorCode(err, code) {
 const FLEET_GROUP = "fleet";
 const INSTANCE_PROBE_TIMEOUT_MS = 2e3;
 const INSTANCE_PROBE_CACHE_TTL_MS = 5e3;
+const CAPABILITIES_CACHE_TTL_MS = 6e4;
+const AWAIT_TURN_DEFAULT_TIMEOUT_MS = 3e4;
+const AWAIT_TURN_TIMEOUT_SLACK_MS = 5e3;
+const LIST_INSTANCES_FANOUT_CONCURRENCY = 16;
+const AWAIT_TURN_FANOUT_CONCURRENCY = 256;
+const INSTANCE_PROBE_RATE_LIMIT_MAX_RETRIES = 1;
+const INSTANCE_PROBE_RATE_LIMIT_BACKOFF_BASE_MS = 250;
+const INSTANCE_PROBE_RATE_LIMIT_BACKOFF_MAX_MS = 1e3;
+const FLEET_FANOUT_CONCURRENCY_ENV = "GH_ROUTER_FLEET_FANOUT_CONCURRENCY";
 var FleetToolInputError = class extends Error {
 	code;
 	constructor(code, message) {
@@ -1770,28 +2205,59 @@ var FleetToolInputError = class extends Error {
 	}
 };
 let defaultRegistry;
+let defaultTunnelProvider;
 const awaitTurnCursors = /* @__PURE__ */ new Map();
 const instanceProbeCache = /* @__PURE__ */ new Map();
 function createFleetTools(options = {}) {
 	const registry = options.registry;
 	const clients = /* @__PURE__ */ new Map();
+	const capabilitiesCache = /* @__PURE__ */ new Map();
+	const tunnelProvider = options.tunnelTokenProvider ?? (defaultTunnelProvider ??= createTunnelTokenProvider());
+	const probeRetryDelay = options.probeRetryDelay ?? delay;
+	const awaitTurnDeadlineSlackMs = nonNegativeNumberOrDefault(options.awaitTurnDeadlineSlackMs, AWAIT_TURN_TIMEOUT_SLACK_MS);
 	function getRegistry() {
 		if (registry) return registry;
 		defaultRegistry ??= new FleetRegistry();
 		return defaultRegistry;
 	}
 	function clientFor(instance) {
-		const key = `${instance.id}\0${instance.url}\0${instance.token}`;
+		const key = `${instance.id}\0${instance.url}\0${instance.token}\0${instance.tunnelId ?? ""}\0${instance.tunnelToken ?? ""}\0${instance.insecureTLS === true ? "1" : "0"}`;
 		const existing = clients.get(key);
 		if (existing) return existing;
 		const created = options.createClient ? options.createClient(instance) : new FleetClient({
 			url: instance.url,
 			token: instance.token,
-			fetchFn: options.fetchFn
+			fetchFn: options.fetchFn,
+			insecureTLS: instance.insecureTLS,
+			...tunnelClientOptions(instance, tunnelProvider)
 		});
 		clients.set(key, created);
 		return created;
 	}
+	async function getInstanceCapabilities(instance, signal) {
+		const now = Date.now();
+		const cached$1 = capabilitiesCache.get(instance.id);
+		if (cached$1 && now - cached$1.at < CAPABILITIES_CACHE_TTL_MS) return cached$1.caps;
+		try {
+			const response = await clientFor(instance).capabilities(signal);
+			const caps = new Set(response.capabilities);
+			capabilitiesCache.set(instance.id, {
+				caps,
+				at: Date.now()
+			});
+			return caps;
+		} catch {
+			capabilitiesCache.set(instance.id, {
+				caps: null,
+				at: Date.now()
+			});
+			return null;
+		}
+	}
+	async function assertCapability(instance, cap, featureName, signal) {
+		const caps = await getInstanceCapabilities(instance, signal);
+		if (caps !== null && !caps.has(cap)) throw new FleetToolInputError("UNSUPPORTED_CAPABILITY", `fleet instance ${instance.id} does not advertise the '${cap}' capability required for ${featureName}; omit it or upgrade the ai-or-die control plane`);
+	}
 	async function resolve(arg) {
 		return getRegistry().resolveInstance(arg);
 	}
@@ -1815,37 +2281,46 @@ function createFleetTools(options = {}) {
 		const now = Date.now();
 		const cached$1 = instanceProbeCache.get(cacheKey);
 		if (cached$1 && now - cached$1.at < INSTANCE_PROBE_CACHE_TTL_MS) return cached$1.result;
-		const timeout = createProbeTimeout();
-		try {
-			const response = await clientFor(await resolve(info.id)).listSessions(timeout.signal);
-			const lastSeen = Date.now();
-			const result = {
-				id: info.id,
-				label: info.label,
-				reachable: true,
-				sessionCount: response.sessions.length,
-				lastSeen
-			};
-			instanceProbeCache.set(cacheKey, {
-				result,
-				at: lastSeen
-			});
-			return result;
-		} catch (err) {
-			const result = {
-				id: info.id,
-				label: info.label,
-				reachable: false,
-				error: fleetProbeErrorCode(err)
-			};
-			instanceProbeCache.set(cacheKey, {
-				result,
-				at: Date.now()
-			});
-			return result;
-		} finally {
-			timeout.cleanup();
+		for (let attempt = 0; attempt <= INSTANCE_PROBE_RATE_LIMIT_MAX_RETRIES; attempt++) {
+			const timeout = createProbeTimeout();
+			try {
+				const response = await clientFor(await resolve(info.id)).listSessions(timeout.signal);
+				const lastSeen = Date.now();
+				const result$1 = {
+					id: info.id,
+					label: info.label,
+					reachable: true,
+					sessionCount: response.sessions.length,
+					lastSeen
+				};
+				instanceProbeCache.set(cacheKey, {
+					result: result$1,
+					at: lastSeen
+				});
+				return result$1;
+			} catch (err) {
+				const code = fleetProbeErrorCode(err);
+				if (code === "RATE_LIMITED" && attempt < INSTANCE_PROBE_RATE_LIMIT_MAX_RETRIES) {
+					timeout.cleanup();
+					await probeRetryDelay(probeRateLimitBackoffMs(attempt));
+					continue;
+				}
+				const result$1 = failedProbeResult(info, code);
+				instanceProbeCache.set(cacheKey, {
+					result: result$1,
+					at: Date.now()
+				});
+				return result$1;
+			} finally {
+				timeout.cleanup();
+			}
 		}
+		const result = failedProbeResult(info, "UNREACHABLE");
+		instanceProbeCache.set(cacheKey, {
+			result,
+			at: Date.now()
+		});
+		return result;
 	}
 	function tool$1(toolNameHttp, description, inputSchema, handler) {
 		return {
@@ -1865,8 +2340,7 @@ function createFleetTools(options = {}) {
 	}
 	return Object.freeze([
 		tool$1("list_instances", "List registered remote ai-or-die instances in the fleet registry. Tokens are never returned.", objectSchema({}, []), async () => {
-			const instances = await getRegistry().listInstances();
-			return ok({ instances: await Promise.all(instances.map((instance) => probeInstance(instance))) });
+			return ok({ instances: await mapWithConcurrency(await getRegistry().listInstances(), fleetFanoutConcurrency(LIST_INSTANCES_FANOUT_CONCURRENCY), (instance) => probeInstance(instance)) });
 		}),
 		tool$1("list_sessions", "List sessions on one fleet instance, returning globally-addressable session ids.", objectSchema({ instance: stringProp("Instance id or label. Defaults to the registry default, or the sole instance.") }, []), async (args, signal) => {
 			const instance = await resolve(optionalString(args, "instance"));
@@ -1903,12 +2377,12 @@ function createFleetTools(options = {}) {
 				sessionId: globalId
 			});
 		}),
-		tool$1("send_message", "Send a message to a fleet session. Returns isError if delivery failed or an awaited confirmation did not arrive.", objectSchema({
+		tool$1("send_message", "Send a message to a fleet session. isError reflects DELIVERY ONLY: it is true only when the message could not be delivered to the session (transport/precondition failure). A delivered message whose confirmation did not arrive within awaitMs is NOT an error — it returns delivered:true with confirmationPending/confirmationTimedOut, because a long turn legitimately outruns awaitMs. Recommended pattern: send with awaitMs:0 for a fast delivery ack that never blocks on confirmation, then call await_turn (filtered to this sessionId) to observe the session's actual turn completion. The idempotencyKey makes a retried send safe (a retry never re-types the message).", objectSchema({
 			sessionId: stringProp("Global session id in the form instanceId:localSessionId."),
 			instance: stringProp("Optional instance id/label; when supplied it must agree with sessionId."),
 			message: stringProp("Message text to deliver to the session."),
-			idempotencyKey: stringProp("Caller-generated idempotency key."),
-			awaitMs: numberProp("Optional confirmation wait time in milliseconds.")
+			idempotencyKey: stringProp("Caller-generated idempotency key. Reuse the same key on retry; the upstream dedupes so a retry never re-types."),
+			awaitMs: numberProp("Optional best-effort confirmation wait (ms) — NOT a deadline. Prefer awaitMs:0 plus await_turn; a turn that outruns awaitMs returns confirmationPending, not an error.")
 		}, [
 			"sessionId",
 			"message",
@@ -1921,14 +2395,21 @@ function createFleetTools(options = {}) {
 				idempotencyKey: requiredString(args, "idempotencyKey"),
 				...awaitMs === void 0 ? {} : { awaitMs }
 			}, signal);
-			const delivered = response.delivered !== false;
-			const confirmed = response.confirmed !== false;
-			const isError = !delivered || awaitMs !== void 0 && awaitMs > 0 && !confirmed;
+			const delivered = !(response.delivered === false || response.delivery?.status === "failed" || response.delivery?.status === "error");
+			const confirmed = delivered && response.confirmed === true;
+			const confirmationTimedOut = delivered && !confirmed && (awaitMs !== void 0 && awaitMs > 0 || response.confirmationTimedOut === true);
+			const isError = !delivered;
 			return jsonResult({
 				resolvedInstance: publicInstance(instance),
 				sessionId: globalId,
 				...response,
-				...isError ? { message: !delivered ? "message was not delivered by the upstream instance" : `message delivery was not confirmed within awaitMs=${awaitMs}` } : {}
+				delivered,
+				confirmed,
+				...confirmationTimedOut ? {
+					confirmationPending: true,
+					confirmationTimedOut: true
+				} : {},
+				...isError ? { message: "message was not delivered to the session by the upstream instance" } : confirmationTimedOut ? { message: "delivered; turn completion not confirmed in the await window. Use await_turn filtered to this sessionId to observe completion (the idempotencyKey makes a retried send safe)." } : {}
 			}, isError);
 		}),
 		tool$1("send_keys", "Send key input to a fleet session.", objectSchema({
@@ -1983,19 +2464,30 @@ function createFleetTools(options = {}) {
 			name: stringProp("Optional display name for the session."),
 			workingDir: stringProp("Optional working directory on the remote instance."),
 			idempotencyKey: stringProp("Caller-generated idempotency key."),
-			start: booleanProp("Whether the remote instance should start the session immediately.")
+			start: booleanProp("Whether the remote instance should start the session immediately."),
+			readyTimeoutMs: numberProp("F17: bounded ms to wait for the agent to become driveable before returning. The response carries ready/bound/blocker."),
+			permissionMode: stringProp("F10 (claude only): permission mode the launched agent starts in — one of plan | acceptEdits | default | bypassPermissions. Rejected with BAD_REQUEST if unknown or if agentArgs also sets it."),
+			agentArgs: arrayProp("F10 (claude only): extra launcher args appended after the github-router prefix. Must NOT include --permission-mode or --dangerously-skip-permissions (use permissionMode) — rejected with BAD_REQUEST.")
 		}, [
 			"instance",
 			"agent",
 			"idempotencyKey"
 		]), async (args, signal) => {
 			const instance = await resolve(requiredString(args, "instance"));
+			const agent = requiredString(args, "agent");
 			const idempotencyKey = requiredString(args, "idempotencyKey");
+			const permissionMode = optionalString(args, "permissionMode");
+			const agentArgs = optionalStringArray(args, "agentArgs");
+			if (permissionMode !== void 0) await assertCapability(instance, "permission_mode", "permissionMode", signal);
+			if (agentArgs !== void 0) await assertCapability(instance, "agent_args", "agentArgs", signal);
 			const response = await clientFor(instance).createSession(definedObject({
-				agent: requiredString(args, "agent"),
+				agent,
 				name: optionalString(args, "name"),
 				workingDir: optionalString(args, "workingDir"),
 				start: optionalBoolean(args, "start"),
+				readyTimeoutMs: optionalNumber(args, "readyTimeoutMs"),
+				permissionMode,
+				agentArgs,
 				idempotencyKey
 			}), signal);
 			const localSessionId = typeof response.sessionId === "string" ? response.sessionId : "";
@@ -2023,30 +2515,52 @@ function createFleetTools(options = {}) {
 				...response
 			});
 		}),
-		tool$1("await_turn", "Long-poll session events across fleet instances. The server owns per-target cursors, so callers do not pass cursor tokens.", objectSchema({
+		tool$1("await_turn", "Long-poll session events across fleet instances. The server owns per-target opaque cursors, so callers do not pass cursor tokens. Distinct concurrent watchers over the same instance set should pass a distinct watcherId so they do not share a cursor.", objectSchema({
 			instances: arrayProp("Instance ids or labels to poll. Omit with sessionIds to target those session instances; omit both to poll every registered instance."),
 			sessionIds: arrayProp("Global session ids to filter to."),
 			timeoutMs: numberProp("Long-poll timeout per instance in milliseconds."),
-			kinds: arrayProp("Optional event kinds to filter to.")
+			kinds: arrayProp("Optional event kinds to filter to."),
+			watcherId: stringProp("Optional stable id for this watcher. Use a distinct value for concurrent watchers over the same target set to keep cursors isolated.")
 		}, []), async (args, signal) => {
 			const target = await resolveAwaitTarget(args, getRegistry());
-			const clientKey = target.instances.map((instance) => instance.id).sort().join(",");
-			const cursorByInstance = awaitTurnCursors.get(clientKey) ?? /* @__PURE__ */ new Map();
-			awaitTurnCursors.set(clientKey, cursorByInstance);
+			const cursorByInstance = takeAwaitTurnCursorMap(awaitTurnCursorKey(optionalString(args, "watcherId")));
 			const timeoutMs = optionalNumber(args, "timeoutMs");
 			const kinds = optionalStringArray(args, "kinds");
-			const responses = await Promise.all(target.instances.map(async (instance) => {
-				const response = await clientFor(instance).waitEvents(definedObject({
-					cursor: cursorByInstance.get(instance.id),
-					timeoutMs,
-					sessionIds: target.localSessionIdsByInstance.get(instance.id),
-					kinds
-				}), signal);
-				cursorByInstance.set(instance.id, response.cursor);
-				return {
-					instance,
-					response
-				};
+			const results = await mapWithConcurrency(target.instances, fleetFanoutConcurrency(AWAIT_TURN_FANOUT_CONCURRENCY), async (instance) => {
+				const deadline = createAwaitTurnDeadline(timeoutMs, awaitTurnDeadlineSlackMs);
+				const combined = combineAbortSignals([signal, deadline.signal]);
+				try {
+					const response = await clientFor(instance).waitEvents(definedObject({
+						cursor: cursorByInstance.get(instance.id),
+						timeoutMs,
+						sessionIds: target.localSessionIdsByInstance.get(instance.id),
+						kinds
+					}), combined.signal);
+					cursorByInstance.set(instance.id, response.cursor);
+					return {
+						ok: true,
+						instance,
+						response
+					};
+				} catch (err) {
+					const error = fleetProbeErrorCode(err);
+					const hint = fleetProbeHint(error);
+					return {
+						ok: false,
+						instance,
+						error,
+						...hint ? { hint } : {}
+					};
+				} finally {
+					combined.cleanup();
+					deadline.cleanup();
+				}
+			});
+			const responses = results.filter(isAwaitTurnSuccess);
+			const errors = results.filter(isAwaitTurnFailure).map(({ instance, error, hint }) => ({
+				instance: publicInstance(instance),
+				error,
+				...hint ? { hint } : {}
 			}));
 			const events$1 = responses.flatMap(({ instance, response }) => response.events.map((event) => stampEvent(instance, event))).sort(compareStampedEvents);
 			const gaps = responses.flatMap(({ instance, response }) => response.gaps.map((gap) => ({
@@ -2059,9 +2573,10 @@ function createFleetTools(options = {}) {
 				gaps,
 				cursors: responses.map(({ instance, response }) => ({
 					instance: publicInstance(instance),
-					...parseCursor(response.cursor)
+					cursor: response.cursor
 				})),
-				more: responses.some(({ response }) => response.more)
+				more: responses.some(({ response }) => response.more),
+				...errors.length > 0 ? { errors } : {}
 			});
 		}),
 		tool$1("read_file", "Read a file from one fleet instance via its existing /api/files/content endpoint.", objectSchema({
@@ -2131,13 +2646,81 @@ function createProbeTimeout() {
 		cleanup: () => clearTimeout(timer)
 	};
 }
+function createAwaitTurnDeadline(timeoutMs, slackMs) {
+	const deadlineMs = Math.max(0, timeoutMs ?? AWAIT_TURN_DEFAULT_TIMEOUT_MS) + slackMs;
+	const controller = new AbortController();
+	const timer = setTimeout(() => {
+		const err = /* @__PURE__ */ new Error("await_turn per-instance deadline exceeded");
+		err.name = "TimeoutError";
+		controller.abort(err);
+	}, deadlineMs);
+	return {
+		signal: controller.signal,
+		cleanup: () => clearTimeout(timer)
+	};
+}
+function combineAbortSignals(signals) {
+	const noop = () => {};
+	const present = signals.filter((signal) => signal !== void 0);
+	if (present.length === 0) return {
+		signal: void 0,
+		cleanup: noop
+	};
+	if (present.length === 1) return {
+		signal: present[0],
+		cleanup: noop
+	};
+	const any = AbortSignal.any;
+	if (typeof any === "function") return {
+		signal: any(present),
+		cleanup: noop
+	};
+	const controller = new AbortController();
+	const listeners = [];
+	const cleanup = () => {
+		for (const { signal, handler } of listeners) signal.removeEventListener("abort", handler);
+		listeners.length = 0;
+	};
+	for (const signal of present) {
+		if (signal.aborted) {
+			if (!controller.signal.aborted) controller.abort(signal.reason);
+			cleanup();
+			return {
+				signal: controller.signal,
+				cleanup: noop
+			};
+		}
+		const handler = () => {
+			if (!controller.signal.aborted) controller.abort(signal.reason);
+		};
+		signal.addEventListener("abort", handler, { once: true });
+		listeners.push({
+			signal,
+			handler
+		});
+	}
+	return {
+		signal: controller.signal,
+		cleanup
+	};
+}
 function fleetProbeErrorCode(err) {
 	if (typeof err === "object" && err !== null && "code" in err) {
 		const code = err.code;
 		if (typeof code === "string" && isFleetErrorCode(code)) return code;
 	}
+	if (isAbortLike(err)) return "TIMEOUT";
 	return "UNREACHABLE";
 }
+function fleetProbeHint(code) {
+	switch (code) {
+		case "NO_HOST": return "tunnel relay up, no ai-or-die host connected (start the host on that machine)";
+		case "RELAY_ERROR": return "tunnel relay returned an error; the host may be down, restarting, or under load";
+		case "TIMEOUT": return "no response before the probe deadline; the host may be slow or the tunnel may have no host";
+		case "UNREACHABLE": return "could not connect (DNS or connection failure); check the instance url";
+		default: return;
+	}
+}
 function isFleetErrorCode(code) {
 	switch (code) {
 		case "UNREACHABLE":
@@ -2145,7 +2728,11 @@ function isFleetErrorCode(code) {
 		case "SESSION_NOT_FOUND":
 		case "PRECONDITION_FAILED":
 		case "TIMEOUT":
-		case "UPSTREAM_ERROR": return true;
+		case "UPSTREAM_ERROR":
+		case "NO_HOST":
+		case "RELAY_ERROR":
+		case "BAD_REQUEST":
+		case "RATE_LIMITED": return true;
 		default: return false;
 	}
 }
@@ -2188,22 +2775,92 @@ function stampEvent(instance, event) {
 		...typeof event.sessionId === "string" ? { sessionId: encodeSessionId(instance.id, event.sessionId) } : {}
 	};
 }
+function eventAtMs(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (typeof value === "string") {
+		const parsed = Date.parse(value);
+		if (!Number.isNaN(parsed)) return parsed;
+	}
+	return 0;
+}
 function compareStampedEvents(a, b) {
-	const atA = typeof a.at === "string" ? a.at : "";
-	const atB = typeof b.at === "string" ? b.at : "";
-	if (atA !== atB) return atA < atB ? -1 : 1;
+	const atA = eventAtMs(a.at);
+	const atB = eventAtMs(b.at);
+	if (atA !== atB) return atA - atB;
 	return (typeof a.seq === "number" ? a.seq : 0) - (typeof b.seq === "number" ? b.seq : 0);
 }
-function parseCursor(cursor) {
-	const idx = cursor.indexOf(":");
-	if (idx < 0) return { cursor };
-	const seq = Number(cursor.slice(idx + 1));
+const MAX_WATCHER_ID_LEN = 200;
+const MAX_AWAIT_TURN_CURSOR_KEYS = 1024;
+function awaitTurnCursorKey(watcherId) {
+	const id = watcherId ?? "default";
+	return id.length > MAX_WATCHER_ID_LEN ? id.slice(0, MAX_WATCHER_ID_LEN) : id;
+}
+function takeAwaitTurnCursorMap(clientKey) {
+	const existing = awaitTurnCursors.get(clientKey);
+	if (existing) {
+		awaitTurnCursors.delete(clientKey);
+		awaitTurnCursors.set(clientKey, existing);
+		return existing;
+	}
+	const created = /* @__PURE__ */ new Map();
+	awaitTurnCursors.set(clientKey, created);
+	while (awaitTurnCursors.size > MAX_AWAIT_TURN_CURSOR_KEYS) {
+		const oldest = awaitTurnCursors.keys().next().value;
+		if (oldest === void 0) break;
+		awaitTurnCursors.delete(oldest);
+	}
+	return created;
+}
+function isAwaitTurnSuccess(result) {
+	return result.ok;
+}
+function isAwaitTurnFailure(result) {
+	return !result.ok;
+}
+function failedProbeResult(info, code) {
+	const hint = fleetProbeHint(code);
 	return {
-		cursor,
-		epoch: cursor.slice(0, idx),
-		...Number.isFinite(seq) ? { seq } : {}
+		id: info.id,
+		label: info.label,
+		reachable: false,
+		error: code,
+		...hint ? { hint } : {}
 	};
 }
+async function mapWithConcurrency(items, limit, fn) {
+	const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 1;
+	const concurrency = Math.max(1, Math.min(items.length || 1, safeLimit));
+	const results = new Array(items.length);
+	let nextIndex = 0;
+	async function worker() {
+		while (nextIndex < items.length) {
+			const index = nextIndex++;
+			results[index] = await fn(items[index], index);
+		}
+	}
+	await Promise.all(Array.from({ length: concurrency }, () => worker()));
+	return results;
+}
+function fleetFanoutConcurrency(defaultLimit) {
+	const raw = process.env[FLEET_FANOUT_CONCURRENCY_ENV];
+	const parsed = raw === void 0 ? NaN : Number.parseInt(raw, 10);
+	if (Number.isFinite(parsed) && parsed > 0) return Math.floor(parsed);
+	return defaultLimit;
+}
+function probeRateLimitBackoffMs(attempt) {
+	return Math.min(INSTANCE_PROBE_RATE_LIMIT_BACKOFF_BASE_MS * 2 ** attempt, INSTANCE_PROBE_RATE_LIMIT_BACKOFF_MAX_MS);
+}
+function nonNegativeNumberOrDefault(value, fallback) {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : fallback;
+}
+async function delay(ms) {
+	if (ms <= 0) return;
+	await new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isAbortLike(err) {
+	if (!(err instanceof Error)) return false;
+	return err.name === "AbortError" || err.name === "TimeoutError";
+}
 function uniqueInstances(instances) {
 	const seen = /* @__PURE__ */ new Set();
 	const result = [];
@@ -2220,6 +2877,26 @@ function publicInstance(instance) {
 		label: instance.label
 	};
 }
+/**
+* Build the FleetClient tunnel-auth options for a resolved instance.
+* Resolution order: a `tunnelId` enables auto-mint + auto-refresh (and the
+* evict-on-failure hook); else a static `tunnelToken` is sent directly (no
+* retry, since it cannot be re-minted); else no tunnel auth.
+*/
+function tunnelClientOptions(instance, provider) {
+	if (instance.tunnelId) {
+		const cfg = { tunnelId: instance.tunnelId };
+		return {
+			getTunnelToken: () => provider.getToken(cfg),
+			onTunnelAuthInvalidate: () => provider.invalidate(cfg)
+		};
+	}
+	if (instance.tunnelToken) {
+		const token = instance.tunnelToken;
+		return { getTunnelToken: async () => token };
+	}
+	return {};
+}
 function ok(value) {
 	return jsonResult(value, false);
 }
@@ -11362,7 +12039,7 @@ var PendingMessageQueue = class {
 * `Agent` owns the current transcript, emits lifecycle events, executes tools,
 * and exposes queueing APIs for steering and follow-up messages.
 */
-var Agent = class {
+var Agent$1 = class {
 	_state;
 	listeners = /* @__PURE__ */ new Set();
 	steeringQueue;
@@ -18325,7 +19002,7 @@ async function runWorkerAgentOnce(opts) {
 			getMessages,
 			planState
 		});
-		const agent = new Agent({
+		const agent = new Agent$1({
 			initialState: {
 				systemPrompt: systemPromptFor(opts.mode),
 				model: makeModelShim(resolved.modelId),
@@ -22007,4 +22684,4 @@ async function runStandInToolCall(args, signal) {
 
 //#endregion
 export { handleMcpDelete as $, IMPLEMENT_DEFAULT_MODEL as A, setupCopilotToken as At, TOOLBELT_TOOLS$1 as B, sleep as Bt, stopGateEnabledForRepo as C, DEFAULT_PORT as Ct, liveExec as D, pickClaudeDefault as Dt, resolveSealedGate as E, generateRandomPort as Et, availableToolCommands as F, cacheVSCodeVersion as Ft, buildAdvisorStream as G, GITHUB_API_BASE_URL as Gt, searchWeb as H, fetchWithTransientRetry as Ht, buildToolbeltAwareness as I, filterBetaHeader as It, buildOpenAIErrorEvent as J, githubHeaders as Jt, injectAdvisorTool as K, copilotBaseUrl as Kt, toolbeltEnabled as L, isNullish as Lt, appendPlanReminder as M, tryRefreshAndRetry as Mt, runWorkerAgent as N, cacheCopilotVersion as Nt, BROWSE_DEFAULT_MODEL as O, getPackageVersion as Ot, withNoOutputRetry as P, cacheModels as Pt, relayAnthropicStream as Q, toolbeltSkipSet as R, resolveCodexModel as Rt, repoRoot as S, DEFAULT_CODEX_MODEL_FALLBACKS as St, trustRepo as T, UPSTREAM_INACTIVITY_TIMEOUT_MS as Tt, ADVISOR_INTERNAL_TOOL_NAME as U, HTTPError as Ut, assetFor as V, getModels as Vt, ADVISOR_TOOL_INSTRUCTIONS as W, forwardError as Wt, logStreamError as X, isControllerClosedError as Y, state as Yt, readIteratorWithTimeout as Z, fileFindingsStore as _, extractZipMember as _t, buildPeerAwarenessSnippet as a, countTokens as at, isSubagentContext as b, DEFAULT_CLAUDE_MODEL_FALLBACKS as bt, buildStopHookCommand as c, createResponses as ct, fileBlockBudget as d, readResponseBodyCapped as dt, handleMcpPost as et, injectStopHookIntoSettingsFile as f, parseJsonOrDiagnose as ft, fileBaselineStore as g, extractTarGzMember as gt, stopReviewEnabled as h, provisionAndIndexColbert as ht, buildAgentPrompt as i, workerToolsEnabled as it, PLAN_DEFAULT_MODEL as j, setupGitHubToken as jt, DEFAULT_MODEL as k, withInstallLock as kt, captureLaunchBaseline as l, createChatCompletions as lt, stopGateId as m, hasSupportedBrowserInstalled as mt, MCP_GROUPS as n, fleetToolsEnabled as nt, personasFor as o, createMessages as ot, launchBaselineKey as p, provisionBrowserAssets as pt, isAdvisorRequested as q, copilotHeaders as qt, assertMcpToolSurfaceConsistent as r, standInToolEnabled as rt, buildSessionBindHookCommand as s, getTokenCount as st, GROUP_META as t, browserToolsEnabled as tt, decideStopHook as u, MAX_RESPONSE_BODY_BYTES as ut, fileLastPromptStore as v, collapsePathKeys as vt, stopReviewStateDir as w, UPSTREAM_FETCH_TIMEOUT_MS as wt, repoFingerprint as x, DEFAULT_CODEX_MODEL as xt, fileReviewDebounce as y, toolbeltPathOverride as yt, vscodeRipgrepPath as z, resolveModel as zt };
-//# sourceMappingURL=peer-mcp-personas-B6z15bmc.js.map
+//# sourceMappingURL=peer-mcp-personas-B1Oqydxt.js.map