github-router 0.3.152 → 0.3.162

package/dist/main.js

@@ -1,16 +1,18 @@
 #!/usr/bin/env node
-import { $ as logStreamError, $t as copilotBaseUrl, At as UPSTREAM_FETCH_TIMEOUT_MS, B as toolbeltEnabled, Bt as cacheCopilotVersion, C as repoFingerprint, Ct as ArtifactClient, D as trustRepo, Dt as DEFAULT_CODEX_MODEL, E as stopReviewStateDir, Et as DEFAULT_CLAUDE_MODEL_FALLBACKS, Ft as withInstallLock, G as searchWeb, Gt as resolveCodexModel, H as vscodeRipgrepPath, Ht as cacheVSCodeVersion, It as setupCopilotToken, J as buildAdvisorStream, Jt as getModels, K as ADVISOR_INTERNAL_TOOL_NAME, Kt as resolveModel, Lt as setupGitHubAgentToken, Mt as generateRandomPort, Nt as pickClaudeDefault, O as resolveSealedGate, Ot as DEFAULT_CODEX_MODEL_FALLBACKS, Pt as getPackageVersion, Q as isControllerClosedError, Qt as GITHUB_API_BASE_URL, R as availableToolCommands, Rt as setupGitHubToken, S as isSubagentContext, St as shouldUseInsecureTls, T as stopGateEnabledForRepo, Tt as toolbeltPathOverride, U as TOOLBELT_TOOLS, Ut as filterBetaHeader, V as toolbeltSkipSet, Vt as cacheModels, W as assetFor, Wt as isNullish, X as isAdvisorRequested, Xt as HTTPError, Y as injectAdvisorTool, Yt as fetchWithTransientRetry, Z as buildOpenAIErrorEvent, Zt as forwardError, _ as stopReviewEnabled, _t as provisionBrowserAssets, a as buildPeerAwarenessSnippet, at as browserToolsEnabled, b as fileLastPromptStore, bt as extractTarGzMember, c as buildSessionBindHookCommand, ct as workerToolsEnabled, d as decideStopHook, dt as getTokenCount, en as copilotHeaders, et as readIteratorWithTimeout, f as fileBlockBudget, ft as createResponses, g as stopGateId, gt as parseJsonOrDiagnose, h as stopGateDisabled, ht as readResponseBodyCapped, i as buildAgentPrompt, it as agentToolsEnabled, jt as UPSTREAM_INACTIVITY_TIMEOUT_MS, k as liveExec, kt as DEFAULT_PORT, l as buildStopHookCommand, lt as countTokens, m as launchBaselineKey, mt as MAX_RESPONSE_BODY_BYTES, n as MCP_GROUPS, nn as state, nt as handleMcpDelete, o as personasFor, ot as fleetToolsEnabled, p as injectStopHookIntoSettingsFile, pt as createChatCompletions, q as ADVISOR_TOOL_INSTRUCTIONS, qt as sleep, r as assertMcpToolSurfaceConsistent, rt as handleMcpPost, s as buildArtifactOpenHookCommand, st as standInToolEnabled, t as GROUP_META, tn as githubHeaders, tt as relayAnthropicStream, u as captureLaunchBaseline, ut as createMessages, v as fileBaselineStore, vt as hasSupportedBrowserInstalled, w as repoRoot, wt as collapsePathKeys, x as fileReviewDebounce, xt as extractZipMember, y as fileFindingsStore, yt as provisionAndIndexColbert, z as buildToolbeltAwareness, zt as tryRefreshAndRetry } from "./peer-mcp-personas-BQVOxB1i.js";
-import { a as removeOwnClaudeConfigMirror, i as isUnderClaudeConfigMirror, l as writeArtifactCredsToMirror, n as ensureClaudeConfigMirror, r as ensurePaths, t as PATHS, u as writeRuntimeFileSecure } from "./paths-D0tJ_tms.js";
-import { c as killManagedTree, d as runCommandCapture, f as runCommandVoid, l as parseBoolEnv, s as killChildProcessTree, u as resolveExecutable } from "./lifecycle-DyEXZu2z.js";
-import { a as sweepRegistry } from "./lifecycle-DGvk4z63.js";
+import { $ as buildOpenAIErrorEvent, $t as resolveModel, At as ArtifactClient, B as buildToolbeltAwareness, Bt as pickClaudeDefault, C as repoFingerprint, Ct as parseJsonOrDiagnose, D as trustRepo, Dt as extractTarGzMember, E as stopReviewStateDir, Et as provisionAndIndexColbert, Ft as DEFAULT_CODEX_MODEL_FALLBACKS, G as assetFor, Gt as setupGitHubToken, H as toolbeltSkipSet, Ht as withInstallLock, It as DEFAULT_PORT, J as ADVISOR_TOOL_INSTRUCTIONS, Jt as cacheModels, K as searchWeb, Kt as tryRefreshAndRetry, Lt as UPSTREAM_FETCH_TIMEOUT_MS, Mt as toolbeltPathOverride, Nt as DEFAULT_CLAUDE_MODEL_FALLBACKS, O as resolveSealedGate, Ot as extractZipMember, Pt as DEFAULT_CODEX_MODEL, Q as buildAnthropicErrorEvent, Qt as resolveCodexModel, Rt as UPSTREAM_INACTIVITY_TIMEOUT_MS, S as isSubagentContext, St as readResponseBodyCapped, T as stopGateEnabledForRepo, Tt as hasSupportedBrowserInstalled, U as vscodeRipgrepPath, Ut as setupCopilotToken, V as toolbeltEnabled, Vt as getPackageVersion, W as TOOLBELT_TOOLS, Wt as setupGitHubAgentToken, X as injectAdvisorTool, Xt as filterBetaHeader, Y as buildAdvisorStream, Yt as cacheVSCodeVersion, Z as isAdvisorRequested, Zt as isNullish, _ as stopReviewEnabled, _t as resolveMcpToolTimeoutMs, a as buildPeerAwarenessSnippet, an as GITHUB_API_BASE_URL, at as handleMcpPost, b as fileLastPromptStore, bt as createChatCompletions, c as buildSessionBindHookCommand, cn as githubHeaders, ct as browserToolsEnabled, d as decideStopHook, dt as standInToolEnabled, en as sleep, et as isControllerClosedError, f as fileBlockBudget, ft as workerToolsEnabled, g as stopGateId, gt as assembleResponsesPayload, h as stopGateDisabled, ht as getTokenCount, i as buildAgentPrompt, in as forwardError, it as handleMcpDelete, jt as collapsePathKeys, k as liveExec, kt as shouldUseInsecureTls, l as buildStopHookCommand, ln as state, lt as fleetToolsEnabled, m as launchBaselineKey, mt as createMessages, n as MCP_GROUPS, nn as fetchWithTransientRetry, nt as readIteratorWithTimeout, o as personasFor, on as copilotBaseUrl, ot as agentToolsEnabled, p as injectStopHookIntoSettingsFile, pt as countTokens, q as ADVISOR_INTERNAL_TOOL_NAME, qt as cacheCopilotVersion, r as assertMcpToolSurfaceConsistent, rn as HTTPError, rt as relayAnthropicStream, s as buildArtifactOpenHookCommand, sn as copilotHeaders, st as browseAgentEnabled, t as GROUP_META, tn as getModels, tt as logStreamError, u as captureLaunchBaseline, ut as implementerSubagentModel, v as fileBaselineStore, vt as pickEndpoint, w as repoRoot, wt as provisionBrowserAssets, x as fileReviewDebounce, xt as MAX_RESPONSE_BODY_BYTES, y as fileFindingsStore, yt as createResponses, z as availableToolCommands, zt as generateRandomPort } from "./peer-mcp-personas-Bfq3FPKc.js";
+import { a as removeOwnClaudeConfigMirror, i as isUnderClaudeConfigMirror, l as writeArtifactCredsToMirror, n as ensureClaudeConfigMirror, r as ensurePaths, t as PATHS, u as writeRuntimeFileSecure } from "./paths-CTlT1nTo.js";
+import { c as killManagedTree, d as runCommandCapture, f as runCommandVoid, l as parseBoolEnv, s as killChildProcessTree, u as resolveExecutable } from "./lifecycle-ChPBRt6K.js";
+import { a as sweepRegistry } from "./lifecycle-BUXxiltc.js";
 import { defineCommand, runMain } from "citty";
 import consola from "consola";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import fs, { chmod, copyFile, link, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import os, { homedir, tmpdir } from "node:os";
+import * as nodePath$1 from "node:path";
 import nodePath from "node:path";
 import process$1 from "node:process";
 import { execFileSync, spawn } from "node:child_process";
+import * as fs$2 from "node:fs";
 import fs$1, { existsSync, mkdirSync, promises, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { Agent, ProxyAgent, setGlobalDispatcher } from "undici";
 import { Writable } from "node:stream";
@@ -809,6 +811,224 @@ function launchChild(target, server$1, options = {}) {
 	});
 }
 
+//#endregion
+//#region src/lib/worker-dispatch.ts
+/**
+* Frozen contract for the NON-BLOCKING workers surface.
+*
+* The `workers` MCP tools (`explore`/`implement`/`review`/`plan`/`test`, and
+* `browse` when the browse agent is enabled) BLOCK the caller for up to 6h
+* (`runWorkerAgent`). The MAIN Claude Code agent must never block on one, so a
+* per-mode `worker-*` DISPATCHER SUBAGENT — which Claude Code runs in the
+* background and reports on via a completion notification — is the only
+* sanctioned way to run a worker. This module is the single source of truth for
+* three things that must never drift:
+*
+*   1. the tool → dispatcher map (`mcp__<workersKey>__<mode>` ↔ `worker-<mode>`),
+*   2. the PreToolUse GUARD decision that denies a raw worker call from the main
+*      agent (or any non-dispatcher subagent) and redirects it to the matching
+*      `worker-*` agent, allowing it only from the dispatcher itself, and
+*   3. the dispatcher subagent bodies (description / system prompt / `tools:`
+*      allowlist).
+*
+* Imported by `codex-mcp-config.ts` (dispatcher `.md` generation + the hook
+* command it bakes into settings.json) AND `internal-worker-guard.ts` (the
+* runtime PreToolUse hook). Keeping the map here means the settings matcher, the
+* redirect target, the dispatcher names, and the `tools:` allowlist are all
+* derived from one place.
+*
+* Discrimination mechanism: a Claude Code PreToolUse payload carries
+* `agent_type` (the invoking subagent's name) ONLY inside a subagent context —
+* absent for the top-level/main agent. So `agent_type === "worker-<mode>"` is
+* the reliable "this call came from the dispatcher, allow it" signal, and its
+* absence (or any other value) means "main agent or an unrelated subagent →
+* deny". This is the SAME field this repo's Stop / prompt-submit hooks already
+* key off (`isSubagentContext` in `orchestration/stop-gate-policy.ts`); the
+* guard here is the inverse (allow-only-dispatcher rather than skip-any-sub).
+*/
+/** The five always-available worker modes (gated by `workerToolsEnabled()`). */
+const CORE_WORKER_MODES = [
+	"explore",
+	"implement",
+	"review",
+	"plan",
+	"test"
+];
+/** The browse worker mode, gated separately by `browseAgentEnabled()`. */
+const BROWSE_WORKER_MODE = "browse";
+/** Every mode the surface can expose — used to build the sweep-regex allowlist
+*  and to validate `--modes`. Order is stable (core first, browse last). */
+const ALL_WORKER_DISPATCH_MODES = [...CORE_WORKER_MODES, BROWSE_WORKER_MODE];
+/** The dispatcher subagent name for a mode, e.g. `implement` → `worker-implement`. */
+function dispatcherAgentName(mode) {
+	return `worker-${mode}`;
+}
+/** Every possible dispatcher subagent name (used by the stale-`.md` sweep). */
+const ALL_DISPATCHER_AGENT_NAMES = ALL_WORKER_DISPATCH_MODES.map(dispatcherAgentName);
+/** The MCP tool name the workers server exposes for a mode under the resolved key. */
+function workerToolName(workersKey, mode) {
+	return `mcp__${workersKey}__${mode}`;
+}
+/** The active dispatch modes for a launch: the five core modes plus `browse`
+*  only when the browse agent is enabled. */
+function activeDispatchModes(opts) {
+	return opts.browse ? [...CORE_WORKER_MODES, BROWSE_WORKER_MODE] : [...CORE_WORKER_MODES];
+}
+function escapeRegex(s) {
+	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* The Claude Code PreToolUse `matcher` (a regex over the tool name) that scopes
+* the guard hook to exactly the active worker tools — nothing else invokes the
+* hook. Anchored + exact-alternation so an unrelated `mcp__<key>__status` (a
+* future non-blocking tool with no dispatcher) is never matched, hence never
+* denied.
+*/
+function guardToolMatcher(workersKey, modes) {
+	const alt = modes.map((m) => escapeRegex(m)).join("|");
+	return `^mcp__${escapeRegex(workersKey)}__(${alt})$`;
+}
+/** Parse the worker mode out of a tool name for the resolved key, or null if it
+*  isn't one of the recognized worker tools. */
+function parseWorkerToolCall(toolName, workersKey, modes) {
+	const prefix = `mcp__${workersKey}__`;
+	if (!toolName.startsWith(prefix)) return null;
+	const rest = toolName.slice(prefix.length);
+	return modes.includes(rest) ? rest : null;
+}
+/** The `permissionDecisionReason` shown to the model on a deny, steering it to
+*  the matching background dispatcher. `mode` is null when the payload was
+*  unparseable (fail-closed generic message). */
+function guardDenyReason(mode) {
+	return `Workers run as background subagents in this session so your turn never blocks. Re-issue this as ${mode ? `Agent(subagent_type: "${dispatcherAgentName(mode)}", prompt: <your worker brief>)` : `the matching background \`worker-*\` agent via the Agent tool`}. It returns immediately and delivers the worker's result as a completion notification — do not call the raw \`mcp__…__\` worker tool from the main thread.`;
+}
+/** The stdout JSON a PreToolUse hook prints to DENY a tool call. */
+function guardDenyOutput(mode) {
+	return JSON.stringify({ hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		permissionDecision: "deny",
+		permissionDecisionReason: guardDenyReason(mode)
+	} });
+}
+/**
+* Pure PreToolUse guard decision. Given the raw stdin payload, the resolved
+* workers key, and the active modes, decide whether to DENY the tool call.
+*
+* Rules (fail toward protecting the "main never blocks" invariant):
+*   - Payload unparseable / no string `tool_name`: the matcher only fires this
+*     hook for worker tools, so a payload we can't read is still a worker call
+*     → DENY (fail closed, generic redirect).
+*   - `tool_name` is not a recognized worker tool for this key: ALLOW (not a
+*     tool we guard — never deny a non-worker tool).
+*   - `agent_type` equals one of the active dispatcher names: ALLOW (the call
+*     came from the dispatcher subagent that is meant to run the worker).
+*   - Otherwise (main agent: `agent_type` absent; or a non-dispatcher subagent):
+*     DENY with a redirect to the matching `worker-<mode>` agent.
+*/
+function decideWorkerGuard(input) {
+	let payload = null;
+	try {
+		const parsed = JSON.parse(input.stdin);
+		if (parsed && typeof parsed === "object") payload = parsed;
+	} catch {
+		payload = null;
+	}
+	const toolName = typeof payload?.tool_name === "string" ? payload.tool_name : null;
+	if (!toolName) return {
+		output: guardDenyOutput(null),
+		verdict: "deny-malformed"
+	};
+	const mode = parseWorkerToolCall(toolName, input.workersKey, input.modes);
+	if (mode === null) return {
+		output: null,
+		verdict: "allow-non-worker"
+	};
+	const agentType = payload?.agent_type;
+	if (typeof agentType === "string" && agentType === dispatcherAgentName(mode)) return {
+		output: null,
+		verdict: "allow-dispatcher"
+	};
+	return {
+		output: guardDenyOutput(mode),
+		verdict: "deny-main"
+	};
+}
+/** One-line human description shown to the lead when picking a subagent. Uses
+*  the documented "Use proactively" auto-delegation idiom. */
+function dispatcherDescription(mode) {
+	return `${{
+		explore: "Non-blocking `explore` worker: dispatches a read-only autonomous worker (its own context) in the background and delivers its summary as a completion notification.",
+		implement: "Non-blocking `implement` worker: dispatches an autonomous coding worker (read/write/bash, optional git worktree) in the background and delivers its result as a completion notification.",
+		review: "Non-blocking `review` worker: dispatches a read-only reviewer that reads the code itself to verify a change or claim, in the background, and delivers findings as a completion notification.",
+		plan: "Non-blocking `plan` worker: dispatches a read-only planner that returns an ordered implementation plan, in the background, and delivers it as a completion notification.",
+		test: "Non-blocking `test` worker: dispatches an independent test author that writes tests trying to break the implementation, in the background, and delivers pass/fail as a completion notification.",
+		browse: "Non-blocking `browse` worker: dispatches an autonomous browser agent in the background and delivers its result as a completion notification."
+	}[mode]} Use proactively for any ${mode}-mode worker task so a long run never blocks your turn: it returns immediately and notifies you when done.`;
+}
+/** The dispatcher subagent's full system prompt: call the one worker tool once,
+*  relay verbatim, do nothing else. */
+function dispatcherPrompt(mode, workersKey) {
+	const tool = workerToolName(workersKey, mode);
+	return [
+		`# Subagent: ${dispatcherAgentName(mode)}`,
+		"",
+		`You are a thin DISPATCHER for the \`${mode}\` worker. You run in the background so the`,
+		"lead agent's turn is never blocked while the (up-to-6-hour) worker runs.",
+		"",
+		"## Your only job",
+		"",
+		`Call the \`${tool}\` tool EXACTLY ONCE, passing through the fields from the lead's brief:`,
+		"  - `prompt`: the lead's worker brief, copied verbatim",
+		"  - `workspace` (optional): absolute path, if the lead specified one",
+		"  - `model` / `thinking` (optional): only if the lead specified them",
+		"  - `maxWallClockMs` (optional): per-call wall-clock budget in ms, if the lead specified one" + (mode === "implement" || mode === "test" ? "\n  - `worktree` (optional): pass `true` if the lead asked for isolated-worktree execution" : ""),
+		"",
+		"When the tool returns, output its result VERBATIM as your final message. That final",
+		"message is what the lead receives in the completion notification — it IS the result.",
+		"",
+		"## Hard rules",
+		"",
+		"- Call the worker tool exactly once. Do not retry on a normal (non-error) return.",
+		"- Do NOT attempt the task yourself, do NOT read/edit files, do NOT run other tools.",
+		"- Do NOT spawn other agents (you have no Agent tool and must not try to gain one).",
+		"- Do NOT summarize, paraphrase, or add commentary — relay the worker output verbatim.",
+		"- If the worker returns an error, relay that error verbatim (do not mask it)."
+	].join("\n");
+}
+/** The `tools:` frontmatter allowlist for a dispatcher: the workers MCP server
+*  wildcard (`mcp__<workersKey>__*`). Claude Code's `tools:` field supports
+*  MCP patterns only at SERVER granularity (`mcp__<server>__*`), not individual
+*  tool names, so this grants exactly the workers tools and NOTHING else — no
+*  Agent/Task (so it cannot spawn further agents → no recursion), no Read/Bash
+*  (so it cannot do extra work). The dispatcher's prompt narrows it to the one
+*  mode; the guard allows any dispatcher-named caller regardless. */
+function dispatcherTools(_mode, workersKey) {
+	return [`mcp__${workersKey}__*`];
+}
+/**
+* Build the shell command Claude Code runs for the workers `PreToolUse` guard
+* hook — the running github-router via its node/bun binary so it works
+* regardless of PATH. Mirrors `buildPromptSubmitHookCommand`.
+*
+* The resolved `workersKey` and the active `modes` are baked into the command
+* ARGS (not env): `mergeStopHookIntoSettings` dedups hooks by the command
+* string only, so baking the key/modes makes a changed resolution produce a
+* DISTINCT command — no stale-matcher entry can survive from a prior launch.
+*/
+function buildWorkerGuardHookCommand(execPath, scriptPath, workersKey, modes) {
+	const q = (s) => `"${s}"`;
+	const args = `internal-worker-guard --workers-key ${q(workersKey)} --modes ${q(modes.join(","))}`;
+	if (scriptPath && scriptPath !== execPath) return `${q(execPath)} ${q(scriptPath)} ${args}`;
+	return `${q(execPath)} ${args}`;
+}
+/** Parse a `--modes` CSV back into validated modes (drops unknown tokens). */
+function parseModesCsv(csv) {
+	if (!csv) return [...CORE_WORKER_MODES];
+	const known = new Set(ALL_WORKER_DISPATCH_MODES);
+	const out = csv.split(",").map((s) => s.trim()).filter((s) => known.has(s));
+	return out.length > 0 ? out : [...CORE_WORKER_MODES];
+}
+
 //#endregion
 //#region src/lib/codex-mcp-config.ts
 /** The `peers` server is always enabled, so its resolved key always exists;
@@ -816,6 +1036,13 @@ function launchChild(target, server$1, options = {}) {
 function peersKeyOf(groupKeys) {
 	return groupKeys.peers ?? GROUP_META.peers.preferredKey;
 }
+/** The resolved `workers` server key (bare `workers`, or the `gh-router-workers`
+*  fallback on collision). Used to name the dispatcher tools and the guard
+*  matcher. Falls back to the preferred bare key when the group is absent (the
+*  caller only builds worker dispatchers when the group is enabled anyway). */
+function workersKeyOf(groupKeys) {
+	return groupKeys.workers ?? GROUP_META.workers.preferredKey;
+}
 /**
 * Decide which MCP backend serves the codex personas.
 *
@@ -975,6 +1202,19 @@ function buildPeerAgentDefinitions(opts) {
 		codexCli: opts.codexCli,
 		geminiAvailable: opts.geminiAvailable
 	});
+	if (opts.implementerModel && opts.implementerModel.length > 0) out.implementer = {
+		description: "Bounded implementation subagent running gpt-5.5 (strong non-Claude coder, high reasoning). Use for well-scoped coding tasks — edits, small features, fixes — you want implemented in an integrated subagent. Model is overridable at spawn.",
+		prompt: "You are a bounded implementation subagent for well-scoped coding tasks. Implement the requested change surgically, matching the surrounding code style and minimizing unrelated churn. Verify with the project's build or tests where applicable. Do the work yourself — do not spawn further subagents. Report exactly what changed and any risks.",
+		model: opts.implementerModel
+	};
+	if (opts.workerToolsAvailable) {
+		const workersKey = workersKeyOf(opts.groupKeys);
+		for (const mode of activeDispatchModes({ browse: opts.browseAvailable === true })) out[dispatcherAgentName(mode)] = {
+			description: dispatcherDescription(mode),
+			prompt: dispatcherPrompt(mode, workersKey),
+			tools: dispatcherTools(mode, workersKey)
+		};
+	}
 	return out;
 }
 /**
@@ -1018,17 +1258,25 @@ function escapeYamlString(s) {
 * component.
 */
 const VALID_AGENT_NAME = /^[a-z][a-z0-9-]*$/;
-/** Build a single subagent .md file body (frontmatter + system prompt). */
+/** Build a single subagent .md file body (frontmatter + system prompt).
+*
+* `tools` (optional) becomes a `tools:` frontmatter allowlist RESTRICTING the
+* subagent to exactly those tools (omission inherits the parent's full toolset,
+* per Claude Code semantics). Used by the `worker-*` dispatchers to pin each to
+* its single `mcp__<workersKey>__<mode>` tool — which physically prevents them
+* from spawning other agents or doing extra work. Names are validated by the
+* caller (`writePeerAgentMdFiles`) / are proxy-generated, so no escaping needed
+* beyond the comma-join Claude Code's frontmatter parser expects. */
 function buildAgentMd(spec) {
-	return [
+	const lines = [
 		"---",
 		`name: ${spec.name}`,
-		`description: ${escapeYamlString(spec.description)}`,
-		"---",
-		"",
-		spec.prompt,
-		""
-	].join("\n");
+		`description: ${escapeYamlString(spec.description)}`
+	];
+	if (spec.model) lines.push(`model: ${escapeYamlString(spec.model)}`);
+	if (spec.tools && spec.tools.length > 0) lines.push(`tools: [${spec.tools.map((t) => JSON.stringify(t)).join(", ")}]`);
+	lines.push("---", "", spec.prompt, "");
+	return lines.join("\n");
 }
 /**
 * Write per-launch subagent .md files into the user's `~/.claude/agents/`
@@ -1059,7 +1307,9 @@ async function writePeerAgentMdFiles(agents, opts) {
 			await writeRuntimeFileSecure(filePath, buildAgentMd({
 				name: name$1,
 				description: def.description,
-				prompt: def.prompt
+				prompt: def.prompt,
+				model: def.model,
+				tools: def.tools
 			}));
 			paths.push(filePath);
 		}
@@ -1251,6 +1501,9 @@ async function writePeerMcpRuntimeFiles(serverUrl, opts) {
 		codexCli: opts.codexCli,
 		geminiAvailable: opts.geminiAvailable,
 		groupKeys: opts.groupKeys,
+		workerToolsAvailable: opts.workerToolsAvailable,
+		browseAvailable: opts.browseAvailable,
+		implementerModel: opts.implementerModel,
 		nonce,
 		codexHome
 	});
@@ -2036,7 +2289,7 @@ async function discoverGateCommands(cwd, opts) {
 	if (files.length === 0) return null;
 	let result;
 	try {
-		const { runWorkerAgent } = await import("./engine-CvY9mR3b.js");
+		const { runWorkerAgent } = await import("./engine-DHFa2_hK.js");
 		result = await runWorkerAgent({
 			mode: "explore",
 			workspace: root,
@@ -2250,9 +2503,9 @@ Use the request's kind and payload as the contract:
 
 Delegate heavy reading to workers:
 
-- Use mcp__workers__explore for focused source or history gathering.
-- Use mcp__workers__review for compact review of a specific plan, PR summary, or suspicious change.
-- Use mcp__workers__test when a missing executable check is the blocker.
+- Use the worker-explore subagent (Agent tool) for focused source or history gathering.
+- Use the worker-review subagent (Agent tool) for compact review of a specific plan, PR summary, or suspicious change.
+- Use the worker-test subagent (Agent tool) when a missing executable check is the blocker.
 
 Do not read a full diff, full CI log, or full transcript in the lead context. Ask workers for narrow facts and compact excerpts. The ledger is durable memory; context is not.
 
@@ -2385,7 +2638,7 @@ Binding rule:
 
 Ask whether changed behavior has executable coverage.
 
-- If behavior changed and no relevant test exists, use mcp__workers__test to author a focused test through a DIFFERENT lab than the implementer when possible.
+- If behavior changed and no relevant test exists, dispatch the worker-test subagent (Agent tool, subagent_type worker-test) to author a focused test through a DIFFERENT lab than the implementer when possible.
 - Cap missing-test attempts; default to a small number of focused tries.
 - Run the new test and then the relevant existing gate.
 - If creating a large new harness, broad fixture system, or slow integration environment is required, ask the user before proceeding.
@@ -2534,10 +2787,10 @@ Tag every blind spot as executable-checkable or judgment-only.
 
 ## Phase 3 and 4: decompose and plan (run in parallel)
 
-These two are INDEPENDENT: mcp__orchestrate__decompose consumes { ask, context: research brief plus blind-spots }, and mcp__workers__plan consumes the ask, acceptance criteria, research pointer, and blind-spot table. Neither needs the other's output. So issue BOTH calls in a SINGLE parallel batch (same turn) — do not wait for decompose before calling plan.
+These two are INDEPENDENT: mcp__orchestrate__decompose consumes { ask, context: research brief plus blind-spots }, and the worker-plan subagent consumes the ask, acceptance criteria, research pointer, and blind-spot table. Neither needs the other's output. So issue BOTH in a SINGLE parallel batch (same turn) — call mcp__orchestrate__decompose and dispatch the worker-plan subagent together; do not wait for decompose first.
 
 - decompose: mcp__orchestrate__decompose({ ask, context: research brief plus blind-spots }). Treat the output as a proposal, not gospel; reject or revise nodes that do not map to a real blind spot.
-- plan: mcp__workers__plan with the ask, acceptance criteria, research pointer, and blind-spot table. Ask for files, tests, rollback concerns, and minimal safe increments; keep it bounded and suited to the change size.
+- plan: dispatch the worker-plan subagent (Agent tool, subagent_type worker-plan) with the ask, acceptance criteria, research pointer, and blind-spot table. Ask for files, tests, rollback concerns, and minimal safe increments; keep it bounded and suited to the change size.
 
 ## Phase 5: compose a native Workflow
 
@@ -2559,10 +2812,10 @@ Parallelism (the Workflow tool's core optimization rule):
 
 Role to tool mapping:
 
-- research: mcp__workers__explore and mcp__search__code for focused follow-ups.
-- plan: mcp__workers__plan.
-- implement: mcp__workers__implement, with worktree:true for parallel writers.
-- test: mcp__workers__test, authored by a DIFFERENT LAB than the implementer when possible. This is an advisory practice, not enforced provenance.
+- research: worker-explore (Agent subagent) and mcp__search__code for focused follow-ups.
+- plan: worker-plan (Agent subagent).
+- implement: worker-implement (Agent subagent), with worktree:true for parallel writers.
+- test: worker-test (Agent subagent), authored by a DIFFERENT LAB than the implementer when possible. This is an advisory practice, not enforced provenance.
 - review: mcp__peers__codex_reviewer plus mcp__peers__gemini_reviewer. Advisory unless findings are converted into executable checks or code changes.
 - baseline and selector: OPT-IN only because it doubles cost. Choose max(orchestrated, baseline) by EXECUTABLE gate result, not model judgment. If no executable oracle exists, say the selector is advisory.
 - verify: cross-lab checker plus mcp__orchestrate__attest_step with producer not equal to checker lab.
@@ -2672,7 +2925,7 @@ Default caps unless the user explicitly gives a smaller or larger budget:
    - Then use mcp__search__code lexically for exact symbols, filenames, errors, routes, flags, and config keys.
    - Use git blame or history when authorship, regression timing, or intent matters.
    - Use mcp__search__web for upstream APIs, package behavior, protocol docs, or public issues.
-   - Launch parallel mcp__workers__explore workers for heavy gathering, each with a narrow question and expected artifact.
+   - Launch parallel worker-explore background subagents (via the Agent tool, subagent_type worker-explore) for heavy gathering, each with a narrow question and expected artifact. They run non-blocking and report back on completion.
    - Keep worker results summarized; do not paste every detail into the main context.
 
 4. Form a root-cause hypothesis.
@@ -2684,7 +2937,7 @@ Default caps unless the user explicitly gives a smaller or larger budget:
 5. Verify load-bearing claims adversarially.
    - First preference: reproduce the bug, run the failing test, or run the direct check. Tag verified-executable.
    - If executable proof is not available, read the actual source or primary artifact and cite the lines. Tag verified-source.
-   - Ask mcp__workers__review to confirm the source-reading for important claims.
+   - Dispatch the worker-review subagent (via the Agent tool) to confirm the source-reading for important claims.
    - Ask a different-lab refuter through mcp__peers__codex_critic or mcp__peers__gemini_critic to try to refute the hypothesis.
    - Give the refuter the symptom, observed facts, and acceptance criteria, but not your proposed root cause. Avoid anchoring them.
    - If the refuter finds a plausible alternative, add it to the worklist and spend at most one bounded round resolving it.
@@ -2723,6 +2976,67 @@ Return a compact brief, not the whole research dump:
 `
 };
 
+//#endregion
+//#region src/lib/injected-skills/worker-skill.ts
+/**
+* The `/gh-worker` skill: the operating model for the NON-BLOCKING workers
+* surface. Materialized into the per-launch mirror whenever `workerToolsEnabled()`
+* (same gate as the other floor-raising skills). Discoverability + playbook; the
+* load-bearing enforcement is the PreToolUse guard + the `worker-*` dispatcher
+* subagents (see src/lib/worker-dispatch.ts).
+*/
+const WORKER_SKILL = {
+	name: "gh-worker",
+	md: `---
+name: gh-worker
+description: How to run github-router workers without blocking your turn. Workers (explore/implement/review/plan/test) can run up to 6 hours; dispatch the matching worker-* background subagent so you get a completion notification instead of waiting. Use whenever you would reach for a worker.
+user-invocable: true
+---
+
+# gh-worker: non-blocking workers
+
+Worker tasks (explore, implement, review, plan, test) can run for up to 6 hours.
+In this session they are NON-BLOCKING BY DESIGN: you dispatch a
+background \`worker-*\` subagent, get control back immediately, and receive the
+worker's result as a completion notification when it finishes. Your turn is
+never blocked waiting on a worker, and the worker's tool output never fills your
+context (only its final result comes back).
+
+## How to run a worker
+
+Dispatch the matching dispatcher subagent with the Agent tool:
+
+- worker-explore: read-only investigation / codebase gathering, returns a summary.
+- worker-review: reads the code itself to verify a change or claim; findings with severity + file:line.
+- worker-plan: returns an ordered implementation plan from a task + acceptance criteria.
+- worker-implement: read/write/bash coding worker; pass worktree: true for isolated-worktree execution + a returned diff.
+- worker-test: independent test author that writes tests trying to break the implementation and reports pass/fail.
+
+Put the full worker brief in the subagent's prompt (and an absolute workspace
+path, or model/thinking/worktree, only if you need to override the defaults).
+The dispatcher calls the worker once and relays its result verbatim.
+
+## What to expect
+
+- The dispatch returns immediately; you can keep working or start other workers.
+- When the worker finishes you get a completion notification carrying its result.
+- Up to 8 workers run concurrently (the worker-semaphore cap); further dispatches queue.
+- You do NOT call the raw mcp__...__ worker tools from the main thread: a guard
+  denies that and points you at the matching worker-* subagent. That guard is the
+  guarantee your turn never blocks; dispatching worker-* directly is the normal path.
+
+## Notes
+
+- Large worker output may be summarized by the dispatcher relay; for a big
+  artifact, have the worker write it to a file and return the path.
+- Dispatching the same worker twice runs it twice (no dedup); avoid double-dispatch
+  for side-effecting work like worker-implement.
+- Background subagents + completion notifications are the interactive default. In
+  headless (claude -p) runs the task surface behaves differently; prefer interactive
+  for long worker fan-out.
+`
+};
+
 //#endregion
 //#region src/lib/injected-skills/artifact-review-skill.ts
 const ARTIFACT_REVIEW_SKILL = {
@@ -2814,6 +3128,8 @@ const PEER_MARKER_OPEN = "<!-- gh-router peer-mcp awareness — auto-injected, r
 const PEER_MARKER_CLOSE = "<!-- /gh-router peer-mcp awareness -->";
 const STYLE_MARKER_OPEN = "<!-- gh-router style directive — auto-injected, regenerated per launch -->";
 const STYLE_MARKER_CLOSE = "<!-- /gh-router style directive -->";
+const OPERATING_MARKER_OPEN = "<!-- gh-router operating defaults — auto-injected, regenerated per launch -->";
+const OPERATING_MARKER_CLOSE = "<!-- /gh-router operating defaults -->";
 const TOOLBELT_MARKER_OPEN = "<!-- gh-router toolbelt awareness — auto-injected, regenerated per launch -->";
 const TOOLBELT_MARKER_CLOSE = "<!-- /gh-router toolbelt awareness -->";
 const ARTIFACT_MARKER_OPEN = "<!-- gh-router artifact-panel directive — auto-injected when in an ai-or-die tab -->";
@@ -2829,6 +3145,28 @@ const ARTIFACT_PANEL_DIRECTIVE = "## Review in the artifact panel (HTML by defau
 */
 const STYLE_DIRECTIVE = "Write concisely without losing detail. Use a natural human voice. Avoid em dashes. Do not attribute work to Claude, AI, LLM, or Anthropic anywhere (commits, PRs, issues, code, comments, docs).";
 /**
+* Operating-defaults directive injected at the TOP of the mirrored CLAUDE.md
+* AND into the main agent's system prompt (`--append-system-prompt`), so it is
+* the highest-salience behavioral default. Two defaults, both explicitly
+* overridden by the user's own direction and the domain's standards:
+*
+*   1. Orchestrate (strong default): delegate the heavy / parallel /
+*      context-heavy work to the right subagent / worker / model, keeping the
+*      main context free to reason and collaborate with the user, while still
+*      doing trivial / surgical / last-mile work directly (delegating that
+*      would only add relay-fidelity loss + latency).
+*   2. Excellence lens (HYBRID per the peer review): the reliable control
+*      signal is the PRINCIPLE stated plainly; the well-known names appear only
+*      as a "bar to clear" calibration, NOT as "channel X", with an explicit
+*      no-impersonation / no-theatrics guardrail (cross-lab critics: a named
+*      entity is a dense, high-variance vector that pulls in noise + persona
+*      mannerisms at top salience, so the principle leads and the name calibrates).
+*
+* Self-referentially compliant with the style directive: no em dashes, no
+* Claude / Anthropic attribution.
+*/
+const OPERATING_DEFAULTS_DIRECTIVE = "## Operating defaults (apply when the user has not specified otherwise; the user's explicit direction and the domain's own standards always override)\n\nOrchestrate. Delegate research, implementation, review, and large reads to the right subagent, worker, or model (worker-* agents for background non-blocking runs, Task subagents for parallel work, peer critics for review) so your own context stays free to reason and collaborate with the user. Prefer parallel delegation for independent work. Do trivial, surgical, and last-mile work directly; delegate the rest rather than doing it yourself and filling your own context.\n\nAim high. Default to radical simplicity and relentless focus on the user's real experience (the Jobs and Ive bar for design), whole-systems first-principles thinking that anticipates scale and the long arc (the Gates bar for architecture and tech), and customer obsession that works backwards from the outcome (the Bezos bar for product and business). Question every assumption and prefer what you can derive, reproduce, or test. Adopt the principles, not a persona: no impersonation, name-dropping, or theatrics.";
+/**
 * Skip the helper if the user's `~/.claude/CLAUDE.md` (or, equivalently,
 * the would-be post-write file) has grown past this size.
 * Read-modify-write becomes pathological at very large sizes; CLAUDE.md
@@ -3166,6 +3504,23 @@ async function prependStyleDirectiveToMirroredClaudeMd(directive = STYLE_DIRECTI
 	});
 }
 /**
+* Prepend the operating-defaults directive (orchestrator posture + hybrid
+* excellence lens; `OPERATING_DEFAULTS_DIRECTIVE` above) to the TOP of the
+* mirrored CLAUDE.md so descendant agents (Agent subagents, agent-teams
+* teammates) inherit it. The main agent gets the same text at higher salience
+* via `--append-system-prompt`. Separate marker fence from the style / peer
+* blocks so all coexist; best-effort (warn-and-continue) like its siblings.
+*/
+async function prependOperatingDefaultsToMirroredClaudeMd(directive = OPERATING_DEFAULTS_DIRECTIVE) {
+	await injectMarkerBlock({
+		snippet: directive,
+		markerOpen: OPERATING_MARKER_OPEN,
+		markerClose: OPERATING_MARKER_CLOSE,
+		position: "top",
+		label: "operating-defaults"
+	});
+}
+/**
 * Append the toolbelt awareness one-liner (which CLI tools are on PATH)
 * to the bottom of the mirrored CLAUDE.md so descendant agents (Agent
 * subagents, agent-teams teammates) learn about the provisioned tools.
@@ -3257,6 +3612,7 @@ const INJECTED_SKILLS = [
 	RESEARCH_SKILL,
 	ORCHESTRATE_SKILL,
 	FLOOR_KEEPER_SKILL,
+	WORKER_SKILL,
 	FIRST_MATE_SKILL
 ];
 
@@ -3739,7 +4095,7 @@ function initProxyFromEnv() {
 //#endregion
 //#region package.json
 var name = "github-router";
-var version$1 = "0.3.152";
+var version$1 = "0.3.162";
 
 //#endregion
 //#region src/lib/approval.ts
@@ -4336,90 +4692,1487 @@ function sanitizeAnthropicBody(rawBody) {
 }
 
 //#endregion
-//#region src/routes/messages/handler.ts
-const isWebSearchTool$1 = (tool) => typeof tool.type === "string" && tool.type.startsWith("web_search") || tool.name === "web_search";
-/**
-* Extract whitelisted beta headers from the incoming request to forward
-* to the Copilot API. VS Code sends these to enable extended features
-* like thinking, context management, and advanced tool use.
-*/
-function extractBetaHeaders(c) {
-	const headers = {};
-	const anthropicBeta = c.req.header("anthropic-beta");
-	if (anthropicBeta) {
-		const filtered = filterBetaHeader(anthropicBeta);
-		if (filtered) headers["anthropic-beta"] = filtered;
-	}
-	return headers;
+//#region src/lib/anthropic-translate/anthropic-sse.ts
+function makeMessageId() {
+	return `msg_${randomUUID().replace(/-/g, "")}`;
+}
+function makeMessageStart(id, model, usage = {}) {
+	return {
+		type: "message_start",
+		message: {
+			id,
+			type: "message",
+			role: "assistant",
+			model,
+			content: [],
+			stop_reason: null,
+			stop_sequence: null,
+			usage: {
+				input_tokens: usage.input_tokens ?? 0,
+				output_tokens: usage.output_tokens ?? 0,
+				cache_read_input_tokens: usage.cache_read_input_tokens ?? 0,
+				cache_creation_input_tokens: usage.cache_creation_input_tokens ?? 0
+			}
+		}
+	};
+}
+function makeContentBlockStart(index, block) {
+	return {
+		type: "content_block_start",
+		index,
+		content_block: block
+	};
+}
+function makeTextDelta(index, text) {
+	return {
+		type: "content_block_delta",
+		index,
+		delta: {
+			type: "text_delta",
+			text
+		}
+	};
+}
+function makeInputJsonDelta(index, partialJson) {
+	return {
+		type: "content_block_delta",
+		index,
+		delta: {
+			type: "input_json_delta",
+			partial_json: partialJson
+		}
+	};
+}
+function makeThinkingDelta(index, thinking) {
+	return {
+		type: "content_block_delta",
+		index,
+		delta: {
+			type: "thinking_delta",
+			thinking
+		}
+	};
+}
+function makeSignatureDelta(index, signature) {
+	return {
+		type: "content_block_delta",
+		index,
+		delta: {
+			type: "signature_delta",
+			signature
+		}
+	};
+}
+function makeContentBlockStop(index) {
+	return {
+		type: "content_block_stop",
+		index
+	};
+}
+function makeMessageDelta(stopReason, stopSequence, usage) {
+	return {
+		type: "message_delta",
+		delta: {
+			stop_reason: stopReason,
+			stop_sequence: stopSequence
+		},
+		usage: {
+			input_tokens: usage.input_tokens ?? 0,
+			output_tokens: usage.output_tokens ?? 0,
+			cache_read_input_tokens: usage.cache_read_input_tokens ?? 0,
+			cache_creation_input_tokens: usage.cache_creation_input_tokens ?? 0
+		}
+	};
+}
+function makeMessageStop() {
+	return { type: "message_stop" };
+}
+/** Serialize one event to the Anthropic SSE wire form (`event:` + `data:`). */
+function serializeAnthropicEvent(ev) {
+	return `event: ${ev.type}\ndata: ${JSON.stringify(ev)}\n\n`;
 }
 /**
-* Extract the text content from the last user message for web search.
-* Handles both string content and content block arrays (multimodal).
+* Wrap a generator of Anthropic stream events into a byte `ReadableStream`.
+* Pull-based; guards the consumer-cancel race on both `enqueue` and `close`;
+* converts a mid-stream generator throw into a terminal `event: error` frame.
+* On consumer cancel it invokes `onCancel` (abort the upstream fetch) and
+* `return()`s the generator so its `finally` tears down the upstream reader.
 */
-function extractUserQuery$1(messages) {
-	for (let i = messages.length - 1; i >= 0; i--) {
-		const msg = messages[i];
-		if (msg.role === "user") {
-			if (typeof msg.content === "string") return msg.content;
-			if (Array.isArray(msg.content)) {
-				const textBlock = msg.content.find((block) => block.type === "text");
-				if (textBlock?.text) return textBlock.text;
+function anthropicSseStreamFromEvents(events, opts) {
+	const enc = new TextEncoder();
+	let consumerCancelled = false;
+	let finished = false;
+	const safeClose = (controller) => {
+		try {
+			controller.close();
+		} catch {}
+	};
+	return new ReadableStream({
+		async pull(controller) {
+			if (consumerCancelled || finished) {
+				safeClose(controller);
+				return;
+			}
+			let res;
+			try {
+				res = await events.next();
+			} catch (err) {
+				finished = true;
+				if (consumerCancelled) {
+					safeClose(controller);
+					return;
+				}
+				const name$1 = err instanceof Error ? err.name : "Error";
+				const message = err instanceof Error ? err.message : String(err);
+				consola.error(`Anthropic-translate stream interrupted at ${opts.routePath}: ${name$1}: ${JSON.stringify(message)}`);
+				try {
+					controller.enqueue(enc.encode(buildAnthropicErrorEvent(name$1, message)));
+				} catch (enqueueError) {
+					if (!isControllerClosedError(enqueueError)) consola.warn(`Could not deliver error event to consumer at ${opts.routePath}: ${enqueueError instanceof Error ? enqueueError.message : String(enqueueError)}`);
+				}
+				safeClose(controller);
+				return;
+			}
+			if (consumerCancelled) {
+				safeClose(controller);
+				return;
+			}
+			if (res.done) {
+				finished = true;
+				safeClose(controller);
+				return;
+			}
+			try {
+				controller.enqueue(enc.encode(serializeAnthropicEvent(res.value)));
+			} catch (err) {
+				if (isControllerClosedError(err)) {
+					consumerCancelled = true;
+					return;
+				}
+				throw err;
 			}
+		},
+		cancel() {
+			consumerCancelled = true;
+			finished = true;
+			opts.onCancel?.();
+			events.return?.(void 0);
 		}
-	}
+	});
 }
+
+//#endregion
+//#region src/lib/reasoning-effort.ts
 /**
-* Check if any user message contains tool_result content blocks,
-* indicating a follow-up turn where we should skip web search.
-* In Anthropic format, tool results are content blocks inside user messages,
-* NOT separate role: "tool" messages like in OpenAI format.
+* Reasoning-effort bucketing + clamping shared by the `/v1/messages` handler
+* (adaptive-thinking translation) and the Anthropic-translation shim
+* (thinking-budget → Responses `reasoning.effort`).
+*
+* Extracted from `src/routes/messages/handler.ts` so a `~/lib/*` module can
+* depend on it without importing route code (and without forming a
+* handler → shim → handler import cycle). `handler.ts` re-exports these for
+* backward compatibility with existing imports/tests.
 */
-function hasToolResultContent(messages) {
-	return messages.some((msg) => Array.isArray(msg.content) && msg.content.some((block) => block.type === "tool_result"));
-}
+const EFFORT_ORDER = [
+	"low",
+	"medium",
+	"high",
+	"xhigh"
+];
 /**
-* Inject web search results into the Anthropic system field.
-* Handles three cases: absent, string, or array of content blocks.
-* When array, prepends without cache_control to preserve existing directives.
+* Bucket a thinking budget into a Copilot reasoning-effort string.
+* `<2000`→low, `<8000`→medium, `<24000`→high, else→xhigh.
+* Defaults missing/non-numeric budgets to 8000 ("high").
 */
-function injectSearchResults(body, searchContext) {
-	if (body.system === void 0 || body.system === null) body.system = searchContext;
-	else if (typeof body.system === "string") body.system = `${searchContext}\n\n${body.system}`;
-	else if (Array.isArray(body.system)) body.system = [{
-		type: "text",
-		text: searchContext
-	}, ...body.system];
+function bucketEffort(budget) {
+	const n = typeof budget === "number" && Number.isFinite(budget) ? budget : 8e3;
+	if (n < 2e3) return "low";
+	if (n < 8e3) return "medium";
+	if (n < 24e3) return "high";
+	return "xhigh";
 }
 /**
-* Strip web_search tools from the request and clean up tool_choice.
-* Returns the modified body object.
+* Clamp a bucketed effort to the closest value in `supported`. Ties resolve to
+* the lower-tier option (per EFFORT_ORDER).
+*
+* Iterates EFFORT_ORDER (canonical low→xhigh) so the first match on a given
+* distance is always the lower-tier value, regardless of input order in
+* `supported`.
 */
-function stripWebSearchTool(body) {
-	if (!body.tools) return;
-	body.tools = body.tools.filter((tool) => !isWebSearchTool$1(tool));
-	if (body.tools.length === 0) {
-		body.tools = void 0;
-		body.tool_choice = void 0;
-	} else if (body.tool_choice && typeof body.tool_choice === "object" && body.tool_choice.type === "tool") {
-		const choiceName = body.tool_choice.name;
-		if (choiceName && !body.tools.some((tool) => tool.name === choiceName)) body.tool_choice = { type: "auto" };
+function clampEffort(bucketed, supported) {
+	if (supported.includes(bucketed)) return bucketed;
+	const targetIdx = EFFORT_ORDER.indexOf(bucketed);
+	let best;
+	let bestDist = Infinity;
+	for (let i = 0; i < EFFORT_ORDER.length; i++) {
+		const value = EFFORT_ORDER[i];
+		if (!supported.includes(value)) continue;
+		const dist = Math.abs(i - targetIdx);
+		if (dist < bestDist) {
+			bestDist = dist;
+			best = value;
+		}
+	}
+	return best ?? bucketed;
+}
+
+//#endregion
+//#region src/lib/anthropic-translate/anthropic-request.ts
+/** Flatten Anthropic `system` (string | array of text blocks) into a string. */
+function flattenSystem(system) {
+	if (typeof system === "string") return system.length > 0 ? system : void 0;
+	if (Array.isArray(system)) {
+		let s = "";
+		for (const block of system) if (block && typeof block === "object" && block.type === "text") {
+			const t = block.text;
+			if (typeof t === "string") s += t;
+		}
+		return s.length > 0 ? s : void 0;
 	}
 }
 /**
-* Process web search if the request contains a web_search tool.
-* Performs the search, injects results into system, and strips the tool.
-* Returns the (possibly modified) body string to forward.
+* Parse an Anthropic `tool_result.content` (string | block array) into the
+* plain-text `output` for the Responses `function_call_output` (a string-only
+* item) PLUS any image parts found in the content. A `function_call_output`
+* cannot carry images, so the caller emits the extracted images as a follow-up
+* user message (Claude Code browser screenshots/observations arrive this way).
+* `isError` (the tool_result `is_error` flag) is preserved by prefixing the
+* text so the model still learns the tool call failed.
 */
-async function processWebSearch(rawBody) {
-	if (!rawBody.includes("web_search")) return rawBody;
-	let body;
-	try {
-		body = JSON.parse(rawBody);
-	} catch {
-		return rawBody;
+function parseToolResultContent(content, isError) {
+	const images = [];
+	let text = "";
+	if (typeof content === "string") text = content;
+	else if (Array.isArray(content)) for (const block of content) {
+		if (!block || typeof block !== "object") continue;
+		const b = block;
+		if (b.type === "text" && typeof b.text === "string") text += b.text;
+		else if (b.type === "image") {
+			const img = anthropicImageToNeutral(b.source);
+			if (img) images.push(img);
+		}
 	}
-	if (!body.tools?.some((tool) => isWebSearchTool$1(tool))) return rawBody;
-	const query = hasToolResultContent(body.messages ?? []) ? void 0 : extractUserQuery$1(body.messages ?? []);
+	if (images.length > 0 && text.length === 0) text = "[image result below]";
+	if (isError) text = text.length > 0 ? `[tool error] ${text}` : "[tool error]";
+	return {
+		output: text,
+		images
+	};
+}
+/** Map an Anthropic `image` block source to a neutral image part. */
+function anthropicImageToNeutral(source) {
+	if (!source || typeof source !== "object") return null;
+	if (source.type === "url" && typeof source.url === "string") return {
+		type: "image",
+		url: source.url
+	};
+	if (source.type === "base64" && typeof source.data === "string") return {
+		type: "image",
+		mimeType: typeof source.media_type === "string" ? source.media_type : "image/png",
+		data: source.data
+	};
+	return null;
+}
+/** Concatenate the text of an Anthropic `document` `content`-source block array. */
+function joinDocumentContentText(content) {
+	if (!Array.isArray(content)) return "";
+	let text = "";
+	for (const block of content) if (block && typeof block === "object") {
+		const b = block;
+		if (b.type === "text" && typeof b.text === "string") text += b.text;
+	}
+	return text;
+}
+/**
+* Map an Anthropic `document` block to a neutral content part.
+*   - base64 source → neutral `document` (mimeType + data) → Responses
+*     `input_file` with `file_data`; on the chat path → an inline text note
+*     (Copilot's `/chat/completions` rejects file parts).
+*   - url source → neutral `document` (url) → Responses `input_file.file_url`.
+*   - text source (a plain-text document) → the doc's text folded into a `text`
+*     part, so the model sees it on BOTH paths.
+*   - content source (content-block document) → its text blocks folded into a
+*     `text` part.
+* Missing/invalid fields (unknown source type, `file`-id references Copilot has
+* no Files API for, empty text) yield null and are dropped.
+*/
+function anthropicDocumentToNeutral(b) {
+	const source = b.source;
+	if (!source || typeof source !== "object") return null;
+	const s = source;
+	const filename = typeof b.title === "string" && b.title.length > 0 ? b.title : "document.pdf";
+	if (s.type === "base64" && typeof s.data === "string") return {
+		type: "document",
+		mimeType: typeof s.media_type === "string" ? s.media_type : "application/pdf",
+		data: s.data,
+		filename
+	};
+	if (s.type === "url" && typeof s.url === "string") return {
+		type: "document",
+		url: s.url,
+		filename
+	};
+	if (s.type === "text" && typeof s.data === "string") return s.data.length > 0 ? {
+		type: "text",
+		text: s.data
+	} : null;
+	if (s.type === "content") {
+		const text = joinDocumentContentText(s.content);
+		return text.length > 0 ? {
+			type: "text",
+			text
+		} : null;
+	}
+	return null;
+}
+/**
+* Convert one Anthropic message into zero-or-more neutral messages. A user
+* message with `tool_result` blocks fans out: text/image content becomes a
+* user message and each tool_result becomes its own `toolResult` message,
+* emitted in wire order so a function_call_output never precedes its text.
+*/
+function anthropicMessageToNeutral(msg) {
+	const role = msg.role;
+	const content = msg.content;
+	if (role === "assistant") {
+		const parts = [];
+		if (typeof content === "string") {
+			if (content.length > 0) parts.push({
+				type: "text",
+				text: content
+			});
+		} else if (Array.isArray(content)) for (const block of content) {
+			if (!block || typeof block !== "object") continue;
+			const b = block;
+			if (b.type === "text" && typeof b.text === "string") parts.push({
+				type: "text",
+				text: b.text
+			});
+			else if (b.type === "tool_use") parts.push({
+				type: "toolCall",
+				id: typeof b.id === "string" ? b.id : "",
+				name: typeof b.name === "string" ? b.name : "",
+				arguments: b.input ?? {}
+			});
+		}
+		return [{
+			role: "assistant",
+			content: parts
+		}];
+	}
+	const out = [];
+	let userParts = [];
+	const flushUser = () => {
+		if (userParts.length === 0) return;
+		out.push({
+			role: "user",
+			content: userParts
+		});
+		userParts = [];
+	};
+	if (typeof content === "string") {
+		if (content.length > 0) out.push({
+			role: "user",
+			content
+		});
+		return out;
+	}
+	if (Array.isArray(content)) for (const block of content) {
+		if (!block || typeof block !== "object") continue;
+		const b = block;
+		if (b.type === "text" && typeof b.text === "string") userParts.push({
+			type: "text",
+			text: b.text
+		});
+		else if (b.type === "image") {
+			const img = anthropicImageToNeutral(b.source);
+			if (img) userParts.push(img);
+		} else if (b.type === "document") {
+			const doc = anthropicDocumentToNeutral(b);
+			if (doc) userParts.push(doc);
+		} else if (b.type === "tool_result") {
+			flushUser();
+			const { output, images } = parseToolResultContent(b.content, b.is_error === true);
+			out.push({
+				role: "toolResult",
+				toolCallId: typeof b.tool_use_id === "string" ? b.tool_use_id : "",
+				output
+			});
+			if (images.length > 0) out.push({
+				role: "user",
+				content: images
+			});
+		}
+	}
+	flushUser();
+	return out;
+}
+function parseTools(tools) {
+	if (!Array.isArray(tools) || tools.length === 0) return void 0;
+	const out = [];
+	for (const tool of tools) {
+		if (!tool || typeof tool !== "object") continue;
+		const t = tool;
+		if (typeof t.name !== "string" || t.name.length === 0) continue;
+		const schema = t.input_schema ?? t.parameters;
+		out.push({
+			name: t.name,
+			description: typeof t.description === "string" ? t.description : void 0,
+			parameters: schema && typeof schema === "object" ? schema : {
+				type: "object",
+				properties: {}
+			}
+		});
+	}
+	return out.length > 0 ? out : void 0;
+}
+function parseToolChoice(toolChoice) {
+	if (!toolChoice || typeof toolChoice !== "object") return void 0;
+	const tc = toolChoice;
+	switch (tc.type) {
+		case "auto": return "auto";
+		case "any": return "required";
+		case "none": return "none";
+		case "tool": return typeof tc.name === "string" && tc.name.length > 0 ? {
+			type: "function",
+			name: tc.name
+		} : void 0;
+		default: return;
+	}
+}
+/**
+* Anthropic carries `disable_parallel_tool_use` on the `tool_choice` object.
+* Returns `false` (the wire signal to disable parallel tool calls) only when it
+* is explicitly `true`; `undefined` otherwise, so the payload builders omit the
+* field rather than ever sending `parallel_tool_calls: true`.
+*/
+function parseDisableParallelToolUse(toolChoice) {
+	if (!toolChoice || typeof toolChoice !== "object") return void 0;
+	return toolChoice.disable_parallel_tool_use === true ? false : void 0;
+}
+/** Default absent Anthropic `thinking` to high effort, clamped by the model.
+*  Returns undefined for a model that advertises NO `reasoning_effort` allowlist
+*  — such a model may not support reasoning at all, so forcing an effort could
+*  400; leaving it unset preserves the pre-default safe behavior for that case. */
+function defaultReasoningEffort(model) {
+	const supported = model?.capabilities?.supports?.reasoning_effort;
+	return Array.isArray(supported) && supported.length > 0 ? clampEffort("high", supported) : void 0;
+}
+/**
+* Map Anthropic `thinking` to a Responses reasoning effort, clamped to the
+* model's `reasoning_effort` allowlist. Returns undefined when thinking is
+* absent/disabled/non-enabled; the absent default is applied at the call site.
+*/
+function parseReasoningEffort(thinking, model) {
+	if (!thinking || typeof thinking !== "object") return void 0;
+	const t = thinking;
+	if (t.type !== "enabled") return void 0;
+	const bucketed = bucketEffort(t.budget_tokens);
+	const supported = model?.capabilities?.supports?.reasoning_effort;
+	return Array.isArray(supported) && supported.length > 0 ? clampEffort(bucketed, supported) : bucketed;
+}
+/**
+* Parse an already-JSON-parsed Anthropic Messages body into the neutral shape.
+* `resolvedModel` is the catalog id the request will run on; `model` its
+* catalog entry (for the reasoning-effort allowlist).
+*/
+function parseAnthropicRequest(body, resolvedModel, model) {
+	const messages = [];
+	if (Array.isArray(body.messages)) {
+		for (const msg of body.messages) if (msg && typeof msg === "object") for (const n of anthropicMessageToNeutral(msg)) messages.push(n);
+	}
+	const maxTokens = typeof body.max_tokens === "number" && body.max_tokens > 0 ? body.max_tokens : void 0;
+	const stopSequences = Array.isArray(body.stop_sequences) ? body.stop_sequences.filter((s) => typeof s === "string") : void 0;
+	return {
+		model: resolvedModel,
+		instructions: flattenSystem(body.system),
+		messages,
+		tools: parseTools(body.tools),
+		toolChoice: parseToolChoice(body.tool_choice),
+		parallelToolCalls: parseDisableParallelToolUse(body.tool_choice),
+		reasoningEffort: body.thinking === void 0 ? defaultReasoningEffort(model) : parseReasoningEffort(body.thinking, model),
+		maxOutputTokens: maxTokens,
+		stopSequences: stopSequences && stopSequences.length > 0 ? stopSequences : void 0,
+		stream: body.stream === true
+	};
+}
+/** Build the Copilot `/responses` payload from a parsed Anthropic request. */
+function parsedToResponsesPayload(parsed) {
+	return assembleResponsesPayload({
+		model: parsed.model,
+		instructions: parsed.instructions,
+		messages: parsed.messages,
+		tools: parsed.tools,
+		toolChoice: parsed.toolChoice,
+		reasoningEffort: parsed.reasoningEffort,
+		maxOutputTokens: parsed.maxOutputTokens,
+		stopSequences: parsed.stopSequences,
+		parallelToolCalls: parsed.parallelToolCalls,
+		stream: parsed.stream
+	});
+}
+
+//#endregion
+//#region src/lib/anthropic-translate/chat-request.ts
+/** Build the `data:` URI (base64) or return the verbatim URL for an image part. */
+function imageUrlFor(part) {
+	if (typeof part.url === "string" && part.url.length > 0) return part.url;
+	return `data:${part.mimeType ?? "image/png"};base64,${part.data ?? ""}`;
+}
+/**
+* A brief inline note standing in for a document on the chat path. Copilot's
+* `/chat/completions` rejects file content parts (`type` must be `image_url` or
+* `text` → HTTP 400), so a document (PDF) can't be forwarded to a Gemini model;
+* the note keeps the document from being silently dropped and tells the model
+* one was provided but is unavailable, instead of 400ing the request.
+*
+* The note is wrapped in leading + trailing newlines so it is always DELIMITED
+* from adjacent user text — in the string-collapse branch it can't glue onto a
+* neighboring text run (`...[model]what is this?`), and in the content-parts
+* branch it stands as its own line. Regular text-to-text concatenation is left
+* untouched (only the note carries the delimiter), so wire order is preserved.
+*/
+function documentNote(part) {
+	return `\n[document "${part.filename ?? "document"}" attached but not supported for this model]\n`;
+}
+/**
+* A user turn: plain string when there are no images; otherwise OpenAI content
+* parts (`text` / `image_url`). Mirrors `neutralUserToResponses` so the two
+* shims encode a multimodal user turn the same way.
+*/
+function neutralUserToChat(m) {
+	if (typeof m.content === "string") return {
+		role: "user",
+		content: m.content
+	};
+	if (!m.content.some((c) => c.type === "image")) {
+		let text = "";
+		for (const c of m.content) if (c.type === "text") text += c.text;
+		else if (c.type === "document") text += documentNote(c);
+		return {
+			role: "user",
+			content: text
+		};
+	}
+	const parts = [];
+	for (const c of m.content) if (c.type === "text") parts.push({
+		type: "text",
+		text: c.text
+	});
+	else if (c.type === "image") parts.push({
+		type: "image_url",
+		image_url: { url: imageUrlFor(c) }
+	});
+	else if (c.type === "document") parts.push({
+		type: "text",
+		text: documentNote(c)
+	});
+	return {
+		role: "user",
+		content: parts
+	};
+}
+/**
+* An assistant turn: text parts collapse into `content`, tool_use parts become
+* OpenAI `tool_calls`. Unlike the Responses path (which flushes text before each
+* call to preserve interleaving), the chat wire shape carries all text on
+* `content` and all calls on `tool_calls`, so ordering within the turn is not
+* representable — matching how OpenAI itself echoes an assistant turn. When the
+* turn is tool-calls-only, `content` is `null` (OpenAI convention).
+*/
+function neutralAssistantToChat(m) {
+	let text = "";
+	const toolCalls = [];
+	for (const c of m.content) if (c.type === "text") text += c.text;
+	else if (c.type === "toolCall") toolCalls.push({
+		id: c.id,
+		type: "function",
+		function: {
+			name: c.name,
+			arguments: JSON.stringify(c.arguments ?? {})
+		}
+	});
+	const msg = {
+		role: "assistant",
+		content: text.length > 0 ? text : toolCalls.length > 0 ? null : ""
+	};
+	if (toolCalls.length > 0) msg.tool_calls = toolCalls;
+	return msg;
+}
+/** Translate one neutral message into a single chat/completions message. */
+function neutralMessageToChat(m) {
+	if (m.role === "user") return neutralUserToChat(m);
+	if (m.role === "assistant") return neutralAssistantToChat(m);
+	return {
+		role: "tool",
+		tool_call_id: m.toolCallId,
+		content: m.output
+	};
+}
+function neutralToolsToChat(tools) {
+	if (!tools || tools.length === 0) return void 0;
+	return tools.map((t) => ({
+		type: "function",
+		function: {
+			name: t.name,
+			description: t.description,
+			parameters: t.parameters ?? {
+				type: "object",
+				properties: {}
+			}
+		}
+	}));
+}
+/**
+* Convert the parsed (Responses-flat) `tool_choice` to the chat NESTED form.
+* A forced tool is `{type:"function", function:{name}}` on chat/completions —
+* distinct from the Responses flat `{type:"function", name}`. `"auto"` /
+* `"required"` / `"none"` pass through unchanged.
+*/
+function toolChoiceToChat(tc) {
+	if (tc === void 0) return void 0;
+	if (typeof tc === "string") return tc === "auto" || tc === "none" || tc === "required" ? tc : void 0;
+	if (tc.type === "function" && typeof tc.name === "string" && tc.name.length > 0) return {
+		type: "function",
+		function: { name: tc.name }
+	};
+}
+/** Assemble the `/chat/completions` payload from a parsed Anthropic request. */
+function parsedToChatPayload(parsed) {
+	const messages = [];
+	if (parsed.instructions) messages.push({
+		role: "system",
+		content: parsed.instructions
+	});
+	for (const m of parsed.messages) messages.push(neutralMessageToChat(m));
+	const payload = {
+		model: parsed.model,
+		messages,
+		stream: parsed.stream
+	};
+	const tools = neutralToolsToChat(parsed.tools);
+	if (tools && tools.length > 0) {
+		payload.tools = tools;
+		payload.tool_choice = toolChoiceToChat(parsed.toolChoice) ?? "auto";
+	}
+	if (parsed.reasoningEffort && parsed.reasoningEffort !== "off") payload.reasoning_effort = parsed.reasoningEffort;
+	if (typeof parsed.maxOutputTokens === "number" && parsed.maxOutputTokens > 0) payload.max_tokens = parsed.maxOutputTokens;
+	if (parsed.stopSequences && parsed.stopSequences.length > 0) payload.stop = parsed.stopSequences;
+	if (parsed.parallelToolCalls === false) payload.parallel_tool_calls = false;
+	return payload;
+}
+
+//#endregion
+//#region src/lib/anthropic-translate/chat-egress.ts
+/** Synthesize a matchable Anthropic tool_use id when the upstream id is absent. */
+function makeToolUseId$1() {
+	return `toolu_${randomUUID().replace(/-/g, "")}`;
+}
+function parseToolArgs$1(raw) {
+	if (typeof raw !== "string" || raw.trim().length === 0) return {};
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+	} catch {}
+	return {};
+}
+function anthropicUsageFromChat(u) {
+	if (!u) return {};
+	return {
+		input_tokens: u.prompt_tokens ?? 0,
+		output_tokens: u.completion_tokens ?? 0,
+		cache_read_input_tokens: u.prompt_tokens_details?.cached_tokens ?? 0,
+		cache_creation_input_tokens: 0
+	};
+}
+/**
+* Map a chat/completions `finish_reason` to an Anthropic stop_reason. A
+* truncated (`length`) response is `max_tokens` even when a partial tool call
+* is present — the response was cut — mirroring the Responses egress precedence.
+* `tool_calls` (or any buffered tool) → `tool_use`; everything else (`stop`,
+* `content_filter`, null) → `end_turn`.
+*/
+function chatStopReason(finishReason, sawTool) {
+	if (finishReason === "length") return "max_tokens";
+	if (finishReason === "tool_calls" || sawTool) return "tool_use";
+	return "end_turn";
+}
+/**
+* Map a non-streaming chat/completions object to an Anthropic Messages object.
+* The first choice's `message.content` becomes a text block (when non-empty)
+* and each `message.tool_calls[]` becomes a tool_use block.
+*/
+function chatResponseToAnthropicMessage(resp, modelId) {
+	const choice = resp.choices?.[0];
+	const content = [];
+	let sawTool = false;
+	const message = choice?.message;
+	if (message) {
+		if (typeof message.content === "string" && message.content.length > 0) content.push({
+			type: "text",
+			text: message.content
+		});
+		if (Array.isArray(message.tool_calls)) for (const tc of message.tool_calls) {
+			sawTool = true;
+			const rawId = typeof tc.id === "string" ? tc.id : "";
+			content.push({
+				type: "tool_use",
+				id: rawId.length > 0 ? rawId : makeToolUseId$1(),
+				name: typeof tc.function?.name === "string" ? tc.function.name : "",
+				input: parseToolArgs$1(tc.function?.arguments)
+			});
+		}
+	}
+	const usage = anthropicUsageFromChat(resp.usage);
+	const stopReason = chatStopReason(choice?.finish_reason ?? null, sawTool);
+	return {
+		id: typeof resp.id === "string" && resp.id.length > 0 ? `msg_${resp.id}` : makeMessageId(),
+		type: "message",
+		role: "assistant",
+		model: modelId,
+		content,
+		stop_reason: stopReason,
+		stop_sequence: null,
+		usage: {
+			input_tokens: usage.input_tokens ?? 0,
+			output_tokens: usage.output_tokens ?? 0,
+			cache_read_input_tokens: usage.cache_read_input_tokens ?? 0,
+			cache_creation_input_tokens: usage.cache_creation_input_tokens ?? 0
+		}
+	};
+}
+/**
+* Streaming synthesizer: consume a chat/completions SSE iterable, yield the
+* Anthropic event sequence. Emits `message_start` first, streams text live,
+* buffers tool calls per OpenAI array index and flushes them atomically at
+* end-of-stream (in numeric index order), then a terminal `message_delta`
+* (accumulated usage + stop_reason) and `message_stop`. The `[DONE]` sentinel
+* is the authoritative clean-end marker: a stream that ends WITHOUT it is
+* treated as truncated and throws so the stream adapter can emit a terminal
+* `event: error`. A clean `[DONE]` carrying no chunk-level `finish_reason`
+* still completes cleanly (stop_reason from any buffered tool, else `end_turn`).
+*/
+async function* synthAnthropicFromChat(upstream, opts) {
+	const messageId = opts.messageId ?? makeMessageId();
+	let nextIndex = 0;
+	let activeTextIndex = null;
+	const toolByIndex = /* @__PURE__ */ new Map();
+	let usageIn = 0;
+	let usageOut = 0;
+	let usageCacheRead = 0;
+	let finishReason = null;
+	let sawDone = false;
+	yield makeMessageStart(messageId, opts.modelId);
+	for await (const evt of upstream) {
+		const data = evt?.data;
+		if (data == null) continue;
+		if (data === "[DONE]") {
+			sawDone = true;
+			break;
+		}
+		let chunk;
+		try {
+			chunk = JSON.parse(data);
+		} catch {
+			continue;
+		}
+		if (chunk.usage) {
+			usageIn = Math.max(usageIn, chunk.usage.prompt_tokens ?? 0);
+			usageOut = Math.max(usageOut, chunk.usage.completion_tokens ?? 0);
+			usageCacheRead = Math.max(usageCacheRead, chunk.usage.prompt_tokens_details?.cached_tokens ?? 0);
+		}
+		const choice = chunk.choices?.[0];
+		if (!choice) continue;
+		const delta = choice.delta;
+		if (delta && typeof delta.content === "string" && delta.content.length > 0) {
+			if (activeTextIndex == null) {
+				activeTextIndex = nextIndex++;
+				yield makeContentBlockStart(activeTextIndex, {
+					type: "text",
+					text: ""
+				});
+			}
+			yield makeTextDelta(activeTextIndex, delta.content);
+		}
+		if (delta && Array.isArray(delta.tool_calls) && delta.tool_calls.length > 0) {
+			if (activeTextIndex != null) {
+				yield makeContentBlockStop(activeTextIndex);
+				activeTextIndex = null;
+			}
+			for (const tcd of delta.tool_calls) {
+				if (tcd == null || typeof tcd.index !== "number") continue;
+				let entry = toolByIndex.get(tcd.index);
+				if (!entry) {
+					entry = {
+						id: "",
+						name: "",
+						args: ""
+					};
+					toolByIndex.set(tcd.index, entry);
+				}
+				if (typeof tcd.id === "string" && tcd.id.length > 0) entry.id = tcd.id;
+				const name$1 = tcd.function?.name;
+				if (typeof name$1 === "string" && name$1.length > 0) entry.name = name$1;
+				const argDelta = tcd.function?.arguments;
+				if (typeof argDelta === "string" && argDelta.length > 0) entry.args += argDelta;
+			}
+		}
+		if (choice.finish_reason != null) finishReason = choice.finish_reason;
+	}
+	if (!sawDone) throw new Error("chat stream ended without a [DONE] sentinel (truncated)");
+	if (activeTextIndex != null) {
+		yield makeContentBlockStop(activeTextIndex);
+		activeTextIndex = null;
+	}
+	let sawTool = false;
+	const orderedTools = [...toolByIndex.entries()].sort((a, b) => a[0] - b[0]);
+	for (const [, entry] of orderedTools) {
+		sawTool = true;
+		const index = nextIndex++;
+		yield makeContentBlockStart(index, {
+			type: "tool_use",
+			id: entry.id.length > 0 ? entry.id : makeToolUseId$1(),
+			name: entry.name,
+			input: {}
+		});
+		yield makeInputJsonDelta(index, JSON.stringify(parseToolArgs$1(entry.args)));
+		yield makeContentBlockStop(index);
+	}
+	yield makeMessageDelta(chatStopReason(finishReason, sawTool), null, {
+		input_tokens: usageIn,
+		output_tokens: usageOut,
+		cache_read_input_tokens: usageCacheRead,
+		cache_creation_input_tokens: 0
+	});
+	yield makeMessageStop();
+}
+
+//#endregion
+//#region src/lib/anthropic-translate/responses-egress.ts
+/**
+* Stable map key for a `/responses` output item: prefer `output_index`
+* (constant per item), fall back to the opaque id only when absent. Namespaced
+* so a numeric index and a string id can never collide.
+*/
+function responsesKey(outputIndex, fallbackId) {
+	if (typeof outputIndex === "number") return `oi:${outputIndex}`;
+	if (typeof fallbackId === "string" && fallbackId.length > 0) return `id:${fallbackId}`;
+}
+/** Synthesize a matchable Anthropic tool_use id when the upstream id is absent. */
+function makeToolUseId() {
+	return `toolu_${randomUUID().replace(/-/g, "")}`;
+}
+/** First non-empty string among the candidates, or "" when none qualifies. */
+function firstNonEmpty(...vals) {
+	for (const v of vals) if (typeof v === "string" && v.length > 0) return v;
+	return "";
+}
+function anthropicUsageFromResponses(u) {
+	if (!u) return {};
+	return {
+		input_tokens: u.input_tokens ?? 0,
+		output_tokens: u.output_tokens ?? 0,
+		cache_read_input_tokens: u.input_tokens_details?.cached_tokens ?? 0,
+		cache_creation_input_tokens: 0
+	};
+}
+function parseToolArgs(raw) {
+	if (typeof raw !== "string" || raw.trim().length === 0) return {};
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+	} catch {}
+	return {};
+}
+/**
+* Map a non-streaming Responses object to an Anthropic Messages object.
+*
+* stop_reason precedence for a completed non-streaming response:
+* an incomplete/max-output response is `max_tokens` even if a partial tool call
+* is present (the response was truncated), else a function_call → `tool_use`,
+* else `end_turn`.
+*/
+function responsesResponseToAnthropicMessage(resp, modelId) {
+	const output = Array.isArray(resp.output) ? resp.output : [];
+	const content = [];
+	let sawToolUse = false;
+	for (const rawItem of output) {
+		if (!rawItem || typeof rawItem !== "object") continue;
+		const item = rawItem;
+		if (item.type === "message") {
+			let text = "";
+			if (Array.isArray(item.content)) {
+				for (const part of item.content) if (part && typeof part === "object" && part.type === "output_text" && typeof part.text === "string") text += part.text;
+			}
+			if (text.length > 0) content.push({
+				type: "text",
+				text
+			});
+		} else if (item.type === "function_call") {
+			sawToolUse = true;
+			const rawId = typeof item.call_id === "string" && item.call_id.length > 0 ? item.call_id : typeof item.id === "string" && item.id.length > 0 ? item.id : "";
+			content.push({
+				type: "tool_use",
+				id: rawId.length > 0 ? rawId : makeToolUseId(),
+				name: typeof item.name === "string" ? item.name : "",
+				input: parseToolArgs(item.arguments)
+			});
+		} else if (item.type === "reasoning") {
+			let thinking = "";
+			if (Array.isArray(item.summary)) {
+				for (const part of item.summary) if (part && typeof part === "object" && typeof part.text === "string") thinking += part.text;
+			}
+			if (thinking.length > 0) content.push({
+				type: "thinking",
+				thinking,
+				signature: typeof item.encrypted_content === "string" ? item.encrypted_content : ""
+			});
+		}
+	}
+	const usage = anthropicUsageFromResponses(resp.usage);
+	const stopReason = resp.status === "incomplete" && resp.incomplete_details?.reason === "max_output_tokens" ? "max_tokens" : sawToolUse ? "tool_use" : "end_turn";
+	return {
+		id: typeof resp.id === "string" && resp.id.length > 0 ? `msg_${resp.id}` : makeMessageId(),
+		type: "message",
+		role: "assistant",
+		model: modelId,
+		content,
+		stop_reason: stopReason,
+		stop_sequence: null,
+		usage: {
+			input_tokens: usage.input_tokens ?? 0,
+			output_tokens: usage.output_tokens ?? 0,
+			cache_read_input_tokens: usage.cache_read_input_tokens ?? 0,
+			cache_creation_input_tokens: usage.cache_creation_input_tokens ?? 0
+		}
+	};
+}
+/**
+* Streaming synthesizer: consume a `/responses` SSE iterable, yield the
+* Anthropic event sequence. Emits `message_start` first, then content blocks in
+* item order, then a terminal `message_delta` (accumulated usage + stop_reason)
+* and `message_stop`. A `response.failed` throws so the stream adapter can emit
+* a terminal `event: error`; a stream that ends WITHOUT a terminal event
+* (`completed`/`incomplete`/`failed`) is treated as truncated and throws too.
+*/
+async function* synthAnthropicFromResponses(upstream, opts) {
+	const messageId = opts.messageId ?? makeMessageId();
+	const q = [];
+	let nextIndex = 0;
+	let current = null;
+	const toolByKey = /* @__PURE__ */ new Map();
+	const thinkingByKey = /* @__PURE__ */ new Map();
+	const textByKey = /* @__PURE__ */ new Map();
+	let usageIn = 0;
+	let usageOut = 0;
+	let usageCacheRead = 0;
+	let sawTool = false;
+	let hitMaxTokens = false;
+	let sawTerminal = false;
+	const closeCurrent = () => {
+		if (!current) return;
+		q.push(makeContentBlockStop(current.index));
+		current = null;
+	};
+	const currentKind = () => current ? current.kind : null;
+	const currentIndex = () => current ? current.index : null;
+	const ensureTextState = (key) => {
+		const existing = textByKey.get(key);
+		if (existing != null && current?.kind === "text" && current.index === existing.index) return existing;
+		closeCurrent();
+		const index = nextIndex++;
+		const state$1 = {
+			index,
+			emitted: ""
+		};
+		textByKey.set(key, state$1);
+		current = {
+			index,
+			kind: "text"
+		};
+		q.push(makeContentBlockStart(index, {
+			type: "text",
+			text: ""
+		}));
+		return state$1;
+	};
+	const ensureThinking = (key) => {
+		if (current?.kind === "thinking" && thinkingByKey.get(key) === current.index) return current.index;
+		closeCurrent();
+		const index = nextIndex++;
+		current = {
+			index,
+			kind: "thinking"
+		};
+		thinkingByKey.set(key, index);
+		q.push(makeContentBlockStart(index, {
+			type: "thinking",
+			thinking: ""
+		}));
+		return index;
+	};
+	const emitTool = (t) => {
+		if (t.emitted) return;
+		closeCurrent();
+		const index = nextIndex++;
+		q.push(makeContentBlockStart(index, {
+			type: "tool_use",
+			id: t.id,
+			name: t.name,
+			input: {}
+		}));
+		const args = t.argsBuffer.length > 0 ? t.argsBuffer : "{}";
+		q.push(makeInputJsonDelta(index, args));
+		q.push(makeContentBlockStop(index));
+		t.emitted = true;
+		sawTool = true;
+	};
+	q.push(makeMessageStart(messageId, opts.modelId));
+	for (const e of q) yield e;
+	q.length = 0;
+	for await (const evt of upstream) {
+		const data = evt?.data;
+		if (data == null) continue;
+		if (data === "[DONE]") break;
+		let ev;
+		try {
+			ev = JSON.parse(data);
+		} catch {
+			continue;
+		}
+		switch (ev.type) {
+			case "response.output_text.delta": {
+				const d = ev.delta;
+				if (typeof d !== "string" || d.length === 0) break;
+				const state$1 = ensureTextState(responsesKey(ev.output_index, ev.item_id) ?? "text");
+				state$1.emitted += d;
+				q.push(makeTextDelta(state$1.index, d));
+				break;
+			}
+			case "response.output_text.done": {
+				const key = responsesKey(ev.output_index, ev.item_id) ?? "text";
+				const fullText = typeof ev.text === "string" ? ev.text : "";
+				const existing = textByKey.get(key);
+				if (existing == null) {
+					if (fullText.length > 0) {
+						const state$1 = ensureTextState(key);
+						state$1.emitted = fullText;
+						q.push(makeTextDelta(state$1.index, fullText));
+						closeCurrent();
+					}
+				} else if (currentKind() === "text" && currentIndex() === existing.index) {
+					if (fullText.length > existing.emitted.length && fullText.startsWith(existing.emitted)) {
+						q.push(makeTextDelta(existing.index, fullText.slice(existing.emitted.length)));
+						existing.emitted = fullText;
+					}
+					closeCurrent();
+				}
+				break;
+			}
+			case "response.reasoning_summary_text.delta":
+			case "response.reasoning_text.delta": {
+				const d = ev.delta;
+				if (typeof d !== "string" || d.length === 0) break;
+				const key = responsesKey(ev.output_index, ev.item_id) ?? "reasoning";
+				q.push(makeThinkingDelta(ensureThinking(key), d));
+				break;
+			}
+			case "response.reasoning_summary_text.done":
+			case "response.reasoning_text.done": break;
+			case "response.output_item.added": {
+				const item = ev.item;
+				if (item?.type === "function_call") {
+					const key = responsesKey(ev.output_index, item.id);
+					if (key == null || toolByKey.has(key)) break;
+					const toolId = firstNonEmpty(item.call_id, item.id);
+					toolByKey.set(key, {
+						id: toolId.length > 0 ? toolId : makeToolUseId(),
+						name: item.name ?? "",
+						argsBuffer: "",
+						emitted: false
+					});
+					sawTool = true;
+				}
+				break;
+			}
+			case "response.function_call_arguments.delta": {
+				const key = responsesKey(ev.output_index, ev.item_id);
+				if (key == null) break;
+				const t = toolByKey.get(key);
+				if (!t || t.emitted) break;
+				const d = ev.delta;
+				if (typeof d !== "string" || d.length === 0) break;
+				t.argsBuffer += d;
+				break;
+			}
+			case "response.function_call_arguments.done": {
+				const key = responsesKey(ev.output_index, ev.item_id);
+				if (key == null) break;
+				const t = toolByKey.get(key);
+				if (!t || t.emitted) break;
+				if (typeof ev.arguments === "string") t.argsBuffer = ev.arguments;
+				break;
+			}
+			case "response.output_item.done": {
+				const item = ev.item;
+				if (item?.type === "function_call") {
+					const key = responsesKey(ev.output_index, item.id);
+					if (key == null) break;
+					const t = toolByKey.get(key);
+					if (!t || t.emitted) break;
+					const doneId = firstNonEmpty(item.call_id, item.id);
+					if (doneId.length > 0) t.id = doneId;
+					if (typeof item.name === "string" && item.name.length > 0) t.name = item.name;
+					if (typeof item.arguments === "string") t.argsBuffer = item.arguments;
+					emitTool(t);
+				} else if (item?.type === "reasoning") {
+					const key = responsesKey(ev.output_index, item.id);
+					const idx = key != null ? thinkingByKey.get(key) : void 0;
+					if (idx != null && currentKind() === "thinking" && currentIndex() === idx) {
+						if (typeof item.encrypted_content === "string" && item.encrypted_content.length > 0) q.push(makeSignatureDelta(idx, item.encrypted_content));
+						closeCurrent();
+					}
+				}
+				break;
+			}
+			case "response.completed":
+			case "response.incomplete": {
+				sawTerminal = true;
+				const u = ev.response?.usage;
+				if (u) {
+					usageIn = Math.max(usageIn, u.input_tokens ?? 0);
+					usageOut = Math.max(usageOut, u.output_tokens ?? 0);
+					usageCacheRead = Math.max(usageCacheRead, u.input_tokens_details?.cached_tokens ?? 0);
+				}
+				if (ev.type === "response.incomplete" && ev.response?.incomplete_details?.reason === "max_output_tokens") hitMaxTokens = true;
+				break;
+			}
+			case "response.failed": throw new Error(ev.response?.error?.message ?? "response.failed");
+			default: break;
+		}
+		for (const e of q) yield e;
+		q.length = 0;
+	}
+	if (!sawTerminal) throw new Error("responses stream ended without a terminal event (truncated)");
+	closeCurrent();
+	for (const t of toolByKey.values()) if (!t.emitted) emitTool(t);
+	const stopReason = hitMaxTokens ? "max_tokens" : sawTool ? "tool_use" : "end_turn";
+	q.push(makeMessageDelta(stopReason, null, {
+		input_tokens: usageIn,
+		output_tokens: usageOut,
+		cache_read_input_tokens: usageCacheRead,
+		cache_creation_input_tokens: 0
+	}));
+	q.push(makeMessageStop());
+	for (const e of q) yield e;
+	q.length = 0;
+}
+
+//#endregion
+//#region src/lib/anthropic-translate/classifier.ts
+/**
+* Match "claude"/"anthropic" as a delimiter-bounded segment anywhere in a model
+* id: at the start, or after a `/ _ . : -` path/version delimiter, and followed
+* by end-of-string, another such delimiter, or a digit. This catches catalog
+* aliases like `github/claude-3-7-sonnet` or `anthropic/…` whose vendor is
+* "github" and whose family is empty — where the token only surfaces mid-id —
+* while NOT firing on incidental substrings like `notclaude`. Deliberately
+* over-inclusive at the boundaries: we fail CLOSED toward Claude (→ passthrough)
+* so a real Claude model can never be diverted to the non-Claude shim.
+*/
+const CLAUDE_ID_RE = /(^|[/_.:-])(claude|anthropic)(?=$|[/_.:-]|\d)/i;
+/**
+* True when the target is a Claude / Anthropic model. Matches on any of:
+* catalog vendor containing "anthropic", capability family containing "claude",
+* or a Claude/anthropic path-segment (see `CLAUDE_ID_RE`) in ANY id we hold —
+* the resolved id (`modelId`), the pre-resolution request id (`originalModelId`),
+* or the catalog entry's own id (`model.id`). Conservative by design: when in
+* doubt it returns true so a Claude request can never be diverted to the shim.
+*/
+function isClaudeModel(modelId, model, originalModelId) {
+	if (model) {
+		if ((model.vendor?.toLowerCase() ?? "").includes("anthropic")) return true;
+		if ((model.capabilities?.family?.toLowerCase() ?? "").includes("claude")) return true;
+	}
+	return [
+		modelId,
+		originalModelId,
+		model?.id
+	].some((id) => typeof id === "string" && CLAUDE_ID_RE.test(id));
+}
+/**
+* Decide the route for a resolved model id + its catalog entry.
+*
+* - No model id, or a Claude model → "claude-passthrough" (existing behaviour).
+* - A non-Claude model whose catalog endpoint is `/responses` → "responses-shim".
+* - A non-Claude model whose catalog endpoint is `/chat/completions` (gemini and
+*   any chat-default model) → "chat-shim".
+* - A non-Claude model absent from the catalog (so we can't confirm an endpoint)
+*   → "claude-passthrough" (unchanged; we don't divert what we can't classify).
+*
+* `originalModelId` is the optional pre-resolution request id; when supplied it
+* is checked for Claude-likeness alongside the resolved id so an alias that
+* resolves to a non-Claude-looking id can't slip past.
+*/
+function classifyMessagesRoute(modelId, model, originalModelId) {
+	if (!modelId) return "claude-passthrough";
+	if (isClaudeModel(modelId, model, originalModelId)) return "claude-passthrough";
+	if (!model) return "claude-passthrough";
+	const endpoint = pickEndpoint(model);
+	if (endpoint === "responses") return "responses-shim";
+	if (endpoint === "chat") return "chat-shim";
+	return "claude-passthrough";
+}
+
+//#endregion
+//#region src/lib/anthropic-translate/index.ts
+const STREAM_HEADERS = {
+	"content-type": "text/event-stream",
+	"cache-control": "no-cache",
+	"transfer-encoding": "chunked",
+	connection: "keep-alive"
+};
+function isAsyncIterable(x) {
+	return x != null && typeof x[Symbol.asyncIterator] === "function";
+}
+/**
+* Handle a `/v1/messages` request targeting a non-Claude `/responses` model.
+* Returns a streaming or non-streaming Anthropic-format Response. Upstream
+* non-2xx / abort errors are thrown (as HTTPError) and handled by the route's
+* `forwardError`, exactly like the passthrough path.
+*/
+async function handleNonClaudeResponses(c, opts) {
+	const routePath = c.req.path;
+	let body;
+	try {
+		body = JSON.parse(opts.rawBody);
+	} catch {
+		return c.json({
+			type: "error",
+			error: {
+				type: "invalid_request_error",
+				message: "Request body is not valid JSON"
+			}
+		}, 400);
+	}
+	const parsed = parseAnthropicRequest(body, opts.modelId, opts.model);
+	const payload = parsedToResponsesPayload(parsed);
+	if (consola.level >= 4) consola.debug(`Anthropic-translate → /responses model=${opts.modelId} stream=${parsed.stream} tools=${parsed.tools?.length ?? 0} effort=${parsed.reasoningEffort ?? "none"}`);
+	if (parsed.stream) {
+		const aborter = new AbortController();
+		const result = await createResponses(payload, opts.model?.requestHeaders, aborter.signal, true);
+		if (!isAsyncIterable(result)) throw new Error("Upstream /responses did not return an SSE stream (stream: true expected)");
+		logRequest({
+			method: "POST",
+			path: routePath,
+			model: opts.originalModel,
+			resolvedModel: opts.modelId,
+			status: 200,
+			streaming: true
+		}, opts.model, opts.startTime);
+		const stream = anthropicSseStreamFromEvents(synthAnthropicFromResponses(result, { modelId: opts.modelId }), {
+			routePath,
+			onCancel: () => aborter.abort()
+		});
+		return new Response(stream, {
+			status: 200,
+			headers: STREAM_HEADERS
+		});
+	}
+	const anthropic = responsesResponseToAnthropicMessage(await createResponses(payload, opts.model?.requestHeaders, void 0, true), opts.modelId);
+	logRequest({
+		method: "POST",
+		path: routePath,
+		model: opts.originalModel,
+		resolvedModel: opts.modelId,
+		inputTokens: anthropic.usage.input_tokens,
+		outputTokens: anthropic.usage.output_tokens,
+		status: 200
+	}, opts.model, opts.startTime);
+	return c.json(anthropic, 200);
+}
+/**
+* Handle a `/v1/messages` request targeting a non-Claude `/chat/completions`
+* model (gemini). Twin of `handleNonClaudeResponses` — same lifecycle, abort,
+* and logging contract, but assembles a chat/completions payload and translates
+* the chat response (object or SSE) back to the Anthropic wire shape.
+*/
+async function handleNonClaudeChat(c, opts) {
+	const routePath = c.req.path;
+	let body;
+	try {
+		body = JSON.parse(opts.rawBody);
+	} catch {
+		return c.json({
+			type: "error",
+			error: {
+				type: "invalid_request_error",
+				message: "Request body is not valid JSON"
+			}
+		}, 400);
+	}
+	const parsed = parseAnthropicRequest(body, opts.modelId, opts.model);
+	const payload = parsedToChatPayload(parsed);
+	if (consola.level >= 4) consola.debug(`Anthropic-translate → /chat/completions model=${opts.modelId} stream=${parsed.stream} tools=${parsed.tools?.length ?? 0} effort=${parsed.reasoningEffort ?? "none"}`);
+	if (parsed.stream) {
+		const aborter = new AbortController();
+		const result = await createChatCompletions(payload, opts.model?.requestHeaders, aborter.signal, true);
+		if (!isAsyncIterable(result)) throw new Error("Upstream /chat/completions did not return an SSE stream (stream: true expected)");
+		logRequest({
+			method: "POST",
+			path: routePath,
+			model: opts.originalModel,
+			resolvedModel: opts.modelId,
+			status: 200,
+			streaming: true
+		}, opts.model, opts.startTime);
+		const stream = anthropicSseStreamFromEvents(synthAnthropicFromChat(result, { modelId: opts.modelId }), {
+			routePath,
+			onCancel: () => aborter.abort()
+		});
+		return new Response(stream, {
+			status: 200,
+			headers: STREAM_HEADERS
+		});
+	}
+	const anthropic = chatResponseToAnthropicMessage(await createChatCompletions(payload, opts.model?.requestHeaders, void 0, true), opts.modelId);
+	logRequest({
+		method: "POST",
+		path: routePath,
+		model: opts.originalModel,
+		resolvedModel: opts.modelId,
+		inputTokens: anthropic.usage.input_tokens,
+		outputTokens: anthropic.usage.output_tokens,
+		status: 200
+	}, opts.model, opts.startTime);
+	return c.json(anthropic, 200);
+}
+
+//#endregion
+//#region src/routes/messages/handler.ts
+const isWebSearchTool$1 = (tool) => !!tool && typeof tool === "object" && (typeof tool.type === "string" && tool.type.startsWith("web_search") || tool.name === "web_search");
+/**
+* Extract whitelisted beta headers from the incoming request to forward
+* to the Copilot API. VS Code sends these to enable extended features
+* like thinking, context management, and advanced tool use.
+*/
+function extractBetaHeaders(c) {
+	const headers = {};
+	const anthropicBeta = c.req.header("anthropic-beta");
+	if (anthropicBeta) {
+		const filtered = filterBetaHeader(anthropicBeta);
+		if (filtered) headers["anthropic-beta"] = filtered;
+	}
+	return headers;
+}
+/**
+* Extract the text content from the last user message for web search.
+* Handles both string content and content block arrays (multimodal).
+*/
+function extractUserQuery$1(messages) {
+	for (let i = messages.length - 1; i >= 0; i--) {
+		const msg = messages[i];
+		if (msg.role === "user") {
+			if (typeof msg.content === "string") return msg.content;
+			if (Array.isArray(msg.content)) {
+				const textBlock = msg.content.find((block) => block.type === "text");
+				if (textBlock?.text) return textBlock.text;
+			}
+		}
+	}
+}
+/**
+* Check if any user message contains tool_result content blocks,
+* indicating a follow-up turn where we should skip web search.
+* In Anthropic format, tool results are content blocks inside user messages,
+* NOT separate role: "tool" messages like in OpenAI format.
+*/
+function hasToolResultContent(messages) {
+	return messages.some((msg) => Array.isArray(msg.content) && msg.content.some((block) => block.type === "tool_result"));
+}
+/**
+* Inject web search results into the Anthropic system field.
+* Handles three cases: absent, string, or array of content blocks.
+* When array, prepends without cache_control to preserve existing directives.
+*/
+function injectSearchResults(body, searchContext) {
+	if (body.system === void 0 || body.system === null) body.system = searchContext;
+	else if (typeof body.system === "string") body.system = `${searchContext}\n\n${body.system}`;
+	else if (Array.isArray(body.system)) body.system = [{
+		type: "text",
+		text: searchContext
+	}, ...body.system];
+}
+/**
+* Strip web_search tools from the request and clean up tool_choice.
+* Returns the modified body object.
+*/
+function stripWebSearchTool(body) {
+	if (!body.tools) return;
+	const tools = body.tools.filter((tool) => !isWebSearchTool$1(tool));
+	body.tools = tools;
+	if (tools.length === 0) {
+		body.tools = void 0;
+		body.tool_choice = void 0;
+	} else if (body.tool_choice && typeof body.tool_choice === "object" && body.tool_choice.type === "tool") {
+		const choiceName = body.tool_choice.name;
+		if (choiceName && !tools.some((tool) => tool && typeof tool === "object" && tool.name === choiceName)) body.tool_choice = { type: "auto" };
+	}
+}
+/**
+* Strip the injected `__anthropic_advisor` tool (and any Anthropic-native
+* `advisor_*` typed tool) from a request body. Used ONLY on the non-Claude
+* shim path: ADVISOR's server-side translate-loop (buildAdvisorStream) lives
+* on the native /v1/messages route, so a non-Claude model has no handler for
+* the tool and it must be removed before forwarding — otherwise the model
+* could emit a tool_use that nothing fulfils. Mirrors stripWebSearchTool's
+* tool_choice cleanup. Returns the original string (same reference) when
+* nothing was removed.
+*/
+function stripAdvisorTool(rawBody) {
+	let body;
+	try {
+		body = JSON.parse(rawBody);
+	} catch {
+		return rawBody;
+	}
+	if (!Array.isArray(body.tools)) return rawBody;
+	const original = body.tools;
+	const tools = original.filter((tool) => {
+		if (typeof tool !== "object" || tool === null) return true;
+		if (tool.name === ADVISOR_INTERNAL_TOOL_NAME) return false;
+		const type = tool.type;
+		return typeof type !== "string" || !type.startsWith("advisor_");
+	});
+	if (tools.length === original.length) return rawBody;
+	if (tools.length === 0) {
+		body.tools = void 0;
+		body.tool_choice = void 0;
+	} else {
+		body.tools = tools;
+		if (body.tool_choice && typeof body.tool_choice === "object" && body.tool_choice.type === "tool") {
+			const choiceName = body.tool_choice.name;
+			if (choiceName && !tools.some((tool) => tool && typeof tool === "object" && tool.name === choiceName)) body.tool_choice = { type: "auto" };
+		}
+	}
+	return JSON.stringify(body);
+}
+/**
+* Process web search if the request contains a web_search tool.
+* Performs the search, injects results into system, and strips the tool.
+* Returns the (possibly modified) body string to forward.
+*/
+async function processWebSearch(rawBody) {
+	if (!rawBody.includes("web_search")) return rawBody;
+	let body;
+	try {
+		body = JSON.parse(rawBody);
+	} catch {
+		return rawBody;
+	}
+	if (!body.tools?.some((tool) => isWebSearchTool$1(tool))) return rawBody;
+	const messages = body.messages ?? [];
+	const query = hasToolResultContent(messages) ? void 0 : extractUserQuery$1(messages);
 	if (query) try {
 		const results = await searchWeb(query);
 		const searchContext = [
@@ -4474,6 +6227,19 @@ async function handleCompletion(c) {
 	} catch {}
 	const { body: resolvedBody, originalModel, resolvedModel, selectedModel } = resolveModelInBody$1(finalBody);
 	const modelId = resolvedModel ?? originalModel;
+	const messagesRoute = classifyMessagesRoute(modelId, selectedModel, originalModel);
+	if (messagesRoute !== "claude-passthrough") {
+		const shimBody = stripAdvisorTool(resolvedBody);
+		if (advisorEnabled) consola.info("ADVISOR requested with a non-Claude model — stripping the injected __anthropic_advisor tool and proceeding without advisor (Claude-only feature; gracefully degraded).");
+		const shimOpts = {
+			rawBody: shimBody,
+			modelId,
+			model: selectedModel,
+			originalModel,
+			startTime
+		};
+		return messagesRoute === "chat-shim" ? handleNonClaudeChat(c, shimOpts) : handleNonClaudeResponses(c, shimOpts);
+	}
 	if (modelId) logEndpointMismatch(modelId, "/v1/messages");
 	const effectiveBetas = applyDefaultBetas(betaHeaders, resolvedModel ?? originalModel);
 	const advisorAborter = advisorEnabled ? new AbortController() : void 0;
@@ -4555,13 +6321,14 @@ async function handleCompletion(c) {
 	const cappedResult = await readResponseBodyCapped(response, c.req.path, MAX_RESPONSE_BODY_BYTES);
 	if (!cappedResult.ok) return c.json(cappedResult.errorResponse, cappedResult.status);
 	const responseBody = cappedResult.value;
+	const usage = responseBody.usage;
 	logRequest({
 		method: "POST",
 		path: c.req.path,
 		model: originalModel,
 		resolvedModel,
-		inputTokens: responseBody.usage?.input_tokens,
-		outputTokens: responseBody.usage?.output_tokens,
+		inputTokens: usage?.input_tokens,
+		outputTokens: usage?.output_tokens,
 		status: response.status
 	}, selectedModel, startTime);
 	if (debugEnabled) consola.debug("Non-streaming response from Copilot /v1/messages:", JSON.stringify(responseBody).slice(0, 2e3));
@@ -4608,48 +6375,6 @@ function resolveModelInBody$1(rawBody) {
 		selectedModel
 	};
 }
-const EFFORT_ORDER = [
-	"low",
-	"medium",
-	"high",
-	"xhigh"
-];
-/**
-* Bucket a thinking budget into a Copilot reasoning-effort string.
-* `<2000`→low, `<8000`→medium, `<24000`→high, else→xhigh.
-* Defaults missing/non-numeric budgets to 8000 ("high").
-*/
-function bucketEffort(budget) {
-	const n = typeof budget === "number" && Number.isFinite(budget) ? budget : 8e3;
-	if (n < 2e3) return "low";
-	if (n < 8e3) return "medium";
-	if (n < 24e3) return "high";
-	return "xhigh";
-}
-/**
-* Clamp a bucketed effort to the closest value in `supported`. Ties
-* resolve to the lower-tier option (per EFFORT_ORDER).
-*
-* Iterates EFFORT_ORDER (canonical low→xhigh) so the first match on a
-* given distance is always the lower-tier value, regardless of input
-* order in `supported`.
-*/
-function clampEffort(bucketed, supported) {
-	if (supported.includes(bucketed)) return bucketed;
-	const targetIdx = EFFORT_ORDER.indexOf(bucketed);
-	let best;
-	let bestDist = Infinity;
-	for (let i = 0; i < EFFORT_ORDER.length; i++) {
-		const value = EFFORT_ORDER[i];
-		if (!supported.includes(value)) continue;
-		const dist = Math.abs(i - targetIdx);
-		if (dist < bestDist) {
-			bestDist = dist;
-			best = value;
-		}
-	}
-	return best ?? bucketed;
-}
 /**
 * Clamp `body.output_config.effort` to the model's
 * `capabilities.supports.reasoning_effort` allowlist. Mutates `body`
@@ -4709,8 +6434,9 @@ function translateThinking(body, model) {
 	if (!model?.capabilities?.supports?.adaptive_thinking) return false;
 	const thinking = body.thinking;
 	if (!thinking || typeof thinking !== "object") return false;
-	if (thinking.type !== "enabled") return false;
-	const bucketed = bucketEffort(thinking.budget_tokens);
+	const t = thinking;
+	if (t.type !== "enabled") return false;
+	const bucketed = bucketEffort(t.budget_tokens);
 	const supported = model.capabilities.supports.reasoning_effort;
 	const effort = Array.isArray(supported) && supported.length > 0 ? clampEffort(bucketed, supported) : bucketed;
 	body.thinking = { type: "adaptive" };
@@ -4732,9 +6458,10 @@ function translateThinking(body, model) {
 function sanitizeCacheControl$1(body) {
 	let stripped = false;
 	function stripScope(block) {
-		if (block.cache_control?.scope !== void 0) {
-			delete block.cache_control.scope;
-			if (Object.keys(block.cache_control).length === 0) delete block.cache_control;
+		const cc = block.cache_control;
+		if (cc?.scope !== void 0) {
+			delete cc.scope;
+			if (Object.keys(cc).length === 0) delete block.cache_control;
 			stripped = true;
 		}
 	}
@@ -5661,6 +7388,134 @@ function parseSharedArgs(args) {
 	};
 }
 /**
+* Non-Claude models we surface as first-class, selectable rows in Claude
+* Code's model picker (Phase 3 of native-non-claude-models). The main
+* agent loop runs on them through the `/v1/messages` translation shim
+* (`src/lib/anthropic-translate/*`, branched in `routes/messages/handler.ts`)
+* that forwards non-Claude targets to Copilot `/responses` (gpt) or
+* `/chat/completions` (gemini). The exact gemini id is
+* `gemini-3.1-pro-preview` (preview slug — NOT `gemini-3.1-pro`).
+*
+* Display labels only: the gateway-model cache schema Claude Code reads is
+* `{id, display_name?}` per model — there is NO per-model context-window
+* field, so context accounting for a selected row uses Claude Code's
+* default window (safe under-accounting: it compacts earlier than the real
+* 1M/400k window, never overflows). See `seedGatewayModelCache`.
+*/
+const NATIVE_NON_CLAUDE_MODELS = [
+	{
+		id: "gpt-5.5",
+		displayName: "GPT-5.5"
+	},
+	{
+		id: "gpt-5.3-codex",
+		displayName: "GPT-5.3 Codex"
+	},
+	{
+		id: "gemini-3.5-flash",
+		displayName: "Gemini 3.5 Flash"
+	},
+	{
+		id: "gemini-3.1-pro-preview",
+		displayName: "Gemini 3.1 Pro (preview)"
+	}
+];
+/**
+* The subset of `NATIVE_NON_CLAUDE_MODELS` actually present in the live
+* Copilot catalog. License tiers differ (gpt-5.5 needs
+* pro_plus/business/enterprise/max; gemini-3.5-flash is absent on
+* edu/individual_trial), so a model missing from the catalog is silently
+* dropped — the caller then neither enables discovery nor writes a cache
+* for it, and lesser tiers see the unchanged picker. Pure (reads
+* `state.models`), so it is unit-testable without side effects.
+*/
+function nativeSelectableModelsInCatalog() {
+	const catalog = state.models?.data;
+	if (!catalog || catalog.length === 0) return [];
+	const present = new Set(catalog.map((m) => m.id));
+	return NATIVE_NON_CLAUDE_MODELS.filter((m) => present.has(m.id)).map((m) => ({
+		id: m.id,
+		display_name: m.displayName
+	}));
+}
+/**
+* Pre-seed Claude Code's gateway-model discovery cache so the non-Claude
+* models appear as selectable picker rows WITHOUT the network fetch.
+*
+* Verified against the installed Claude Code build (2.1.201): the picker
+* builder reads `<CLAUDE_CONFIG_DIR>/cache/gateway-models.json`
+* (schema `{baseUrl: string, fetchedAt: number, models: [{id, display_name?}]}`)
+* and — when gateway discovery is enabled (first-party auth mode +
+* `CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY` set + a non-`api.anthropic.com`
+* `ANTHROPIC_BASE_URL`, all true for the proxy) — maps each cached model to
+* a picker row `{value: id, label: display_name}`. Critically, the
+* cache-READ path applies NO id filter; the `/^(claude|anthropic)/i` filter
+* lives ONLY in the network-FETCH path. So a pre-seeded cache can carry the
+* real Copilot ids (`gpt-5.5`, `gemini-3.1-pro-preview`, …) — no `claude-*`
+* alias needed — and selecting a row sends that real id, which
+* `resolveModel()` exact-matches and the `/v1/messages` shim routes.
+*
+* The network fetch never overwrites this seed: it bails when nonessential
+* traffic is disabled, and the proxy ALWAYS sets
+* `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1`, so the fetch returns before
+* it can write. The seed is therefore authoritative for the session.
+*
+* `baseUrl` MUST equal the `ANTHROPIC_BASE_URL` Claude Code sees
+* (`serverUrl`) or the cache is discarded. `configDir` defaults to
+* `PATHS.CLAUDE_CONFIG_DIR` — the same dir the proxy points
+* `CLAUDE_CONFIG_DIR` at — so the write target and Claude Code's read
+* target are identical by construction.
+*
+* Best-effort: every failure is swallowed — a missing picker row must never
+* break launch. This is coupled to Claude Code's internal cache path/schema;
+* if a future build changes them the read simply ignores the seed and the
+* rows don't appear (graceful degradation). Returns whether a file was
+* written (for tests/observability).
+*
+* The write is atomic (temp file in the same dir + rename) so a Claude Code
+* read can never observe a torn/partial JSON (which its safeParse would
+* reject, dropping the rows). Rename-over-existing is atomic on POSIX and
+* Windows (libuv MoveFileEx REPLACE_EXISTING).
+*/
+function seedGatewayModelCache(serverUrl, models$1, configDir = PATHS.CLAUDE_CONFIG_DIR) {
+	if (models$1.length === 0) return false;
+	const cacheDir = nodePath$1.join(configDir, "cache");
+	const target = nodePath$1.join(cacheDir, "gateway-models.json");
+	const tmp = nodePath$1.join(cacheDir, `gateway-models.json.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`);
+	try {
+		fs$2.mkdirSync(cacheDir, { recursive: true });
+		const payload = {
+			baseUrl: serverUrl,
+			fetchedAt: Date.now(),
+			models: models$1.map((m) => ({
+				id: m.id,
+				display_name: m.display_name
+			}))
+		};
+		fs$2.writeFileSync(tmp, JSON.stringify(payload), "utf-8");
+		fs$2.renameSync(tmp, target);
+		return true;
+	} catch {
+		try {
+			fs$2.rmSync(tmp, { force: true });
+		} catch {}
+		return false;
+	}
+}
+/**
+* Remove any seeded gateway-model cache. Called when the current catalog
+* carries none of the target models, so a user who has pinned
+* `CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY` on cannot surface rows for
+* models that are no longer available. Best-effort (per-launch config dirs
+* make a stale file rare, but this closes the pinned-port + catalog-change
+* seam). Never throws.
+*/
+function clearGatewayModelCache(configDir = PATHS.CLAUDE_CONFIG_DIR) {
+	try {
+		fs$2.rmSync(nodePath$1.join(configDir, "cache", "gateway-models.json"), { force: true });
+	} catch {}
+}
+/**
 * Build environment variables for Claude Code.
 *
 * The parent env is sanitized of every key in `STRIPPED_PARENT_ENV_KEYS`
@@ -5704,16 +7559,17 @@ function getClaudeCodeEnvVars(serverUrl, model) {
 	const vars = {
 		ANTHROPIC_BASE_URL: serverUrl,
 		CLAUDE_CONFIG_DIR: PATHS.CLAUDE_CONFIG_DIR,
-		MCP_TIMEOUT: "2100000",
-		MCP_TOOL_TIMEOUT: "2100000",
 		DISABLE_NON_ESSENTIAL_MODEL_CALLS: "1",
 		CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
 		DISABLE_TELEMETRY: "1"
 	};
 	if (model) vars.ANTHROPIC_MODEL = model;
-	if (process.env.ANTHROPIC_SMALL_FAST_MODEL === void 0) vars.ANTHROPIC_SMALL_FAST_MODEL = "claude-sonnet-4-6";
-	if (process.env.ANTHROPIC_DEFAULT_SONNET_MODEL === void 0) vars.ANTHROPIC_DEFAULT_SONNET_MODEL = "claude-sonnet-4-6";
-	if (process.env.ANTHROPIC_DEFAULT_HAIKU_MODEL === void 0) vars.ANTHROPIC_DEFAULT_HAIKU_MODEL = "claude-haiku-4-5";
+	const mcpToolTimeoutMs = String(resolveMcpToolTimeoutMs());
+	if (process.env.MCP_TIMEOUT === void 0) vars.MCP_TIMEOUT = mcpToolTimeoutMs;
+	if (process.env.MCP_TOOL_TIMEOUT === void 0) vars.MCP_TOOL_TIMEOUT = mcpToolTimeoutMs;
+	if (process.env.ANTHROPIC_SMALL_FAST_MODEL === void 0) vars.ANTHROPIC_SMALL_FAST_MODEL = "claude-sonnet-5";
+	if (process.env.ANTHROPIC_DEFAULT_SONNET_MODEL === void 0) vars.ANTHROPIC_DEFAULT_SONNET_MODEL = "claude-sonnet-5";
+	if (process.env.ANTHROPIC_DEFAULT_HAIKU_MODEL === void 0) vars.ANTHROPIC_DEFAULT_HAIKU_MODEL = "claude-sonnet-5";
 	if (process.env.ANTHROPIC_DEFAULT_OPUS_MODEL === void 0) vars.ANTHROPIC_DEFAULT_OPUS_MODEL = "claude-opus-4-8";
 	if (process.env.CLAUDE_CODE_PLAN_V2_AGENT_COUNT === void 0) vars.CLAUDE_CODE_PLAN_V2_AGENT_COUNT = "7";
 	for (const key of [
@@ -5723,6 +7579,10 @@ function getClaudeCodeEnvVars(serverUrl, model) {
 		"CLAUDE_CODE_ENABLE_FINE_GRAINED_TOOL_STREAMING",
 		"CLAUDE_CODE_ENABLE_TASKS"
 	]) if (process.env[key] === void 0) vars[key] = "1";
+	const nativeModels = nativeSelectableModelsInCatalog();
+	if (nativeModels.length > 0) {
+		if (seedGatewayModelCache(serverUrl, nativeModels) && process.env.CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY === void 0 && vars.CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY === void 0) vars.CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY = "1";
+	} else clearGatewayModelCache();
 	if (toolbeltEnabled()) Object.assign(vars, toolbeltPathOverride(process.env, PATHS.TOOLBELT_BIN_DIR));
 	return vars;
 }
@@ -5750,60 +7610,116 @@ function getCodexEnvVars(serverUrl) {
 
 //#endregion
 //#region src/claude.ts
+const claudeArgs = {
+	...sharedServerArgs,
+	model: {
+		alias: "m",
+		type: "string",
+		description: "Override the default model for Claude Code. Accepts a full slug (e.g. claude-opus-4-7) or an Opus family shorthand (e.g. 4.7, 4.8, 4.6) which expands to the best variant for that family — adding the [1m] suffix when a 1M-context backend is in the catalog."
+	},
+	"codex-mcp": {
+		type: "boolean",
+		default: true,
+		description: "Wire peer-model MCP personas (codex-critic, codex-reviewer, gemini-critic) into the spawned Claude Code session"
+	},
+	"codex-cli": {
+		type: "boolean",
+		default: false,
+		description: "Add a `codex mcp-server` stdio backend so codex-implementer can mutate files. Requires codex CLI 0.129+; gracefully falls back to HTTP-only if absent."
+	},
+	"codex-mcp-only": {
+		type: "boolean",
+		default: false,
+		description: "Pass --strict-mcp-config to claude code so only github-router's MCP servers are loaded (hides user's existing MCP servers)"
+	},
+	stealth: {
+		type: "boolean",
+		default: false,
+		description: "Opt back into VS Code-only beta header filtering. Loses leverage features (task budgets, token-efficient tools, prompt caching, etc.) but minimizes the wire-fingerprint difference from VS Code Copilot Chat. By default the `claude` subcommand enables extended/leverage betas because the spawned Claude Code already identifies itself via UA and other headers — partial stealth doesn't buy much."
+	},
+	"trust-gate": {
+		type: "boolean",
+		default: false,
+		description: "Explicitly record consent for the structural Stop-gate in THIS repo (pinned to the repo's root-commit). The gate is ON BY DEFAULT when a harness is detected (consent-by-launching), so this is now mostly redundant; it stays for explicit/scripted use. Disable the gate entirely with GH_ROUTER_DISABLE_STOP_GATE=1."
+	},
+	"no-stop-gate": {
+		type: "boolean",
+		default: false,
+		description: "Disable the structural Stop-gate for THIS session (same effect as GH_ROUTER_DISABLE_STOP_GATE=1). Intended for driven/automated sessions where a blocking Stop hook would hang the turn-end while a fleet driver waits."
+	},
+	"auto-update": {
+		type: "boolean",
+		default: true,
+		description: "Check for and install the latest Claude Code on launch via `claude update` (throttled to once per hour via ~/.local/share/github-router/last-update-check). `claude update` respects the real install method (native installer or npm), so it never creates a conflicting second install; builds too old to support it fall back to `npm install -g @anthropic-ai/claude-code@latest`. Set to false (--no-auto-update) to check and warn only. Falls back gracefully if claude/npm/network unavailable."
+	},
+	"update-check": {
+		type: "boolean",
+		default: true,
+		description: "Check the npm registry for a newer Claude Code version on launch and warn if stale (non-blocking ~500ms cost). Set to false (--no-update-check) to skip the check entirely (useful for offline/CI). Independent from --auto-update: --no-update-check implies no auto-install (nothing to install since we never check)."
+	}
+};
+/**
+* Build the argv to forward to the spawned `claude` child from citty's
+* rawArgs (every token after the `claude` subcommand). citty is non-strict,
+* so an unknown flag such as `--print`/`-p`… `--output-format` is absorbed
+* into the parsed `args` object AND its value swallowed, instead of landing
+* in `args._`; forwarding only `args._` therefore drops headless flags unless
+* the user wrapped them in `--`. Here we walk rawArgs and forward every token
+* that is NOT one of github-router's OWN declared flags (or that flag's
+* consumed value). Everything after a literal `--` is forwarded verbatim,
+* preserving the prior explicit-passthrough behavior.
+*
+* A child flag whose NAME collides with a github-router flag (`-p`/`--port`,
+* `-v`/`--verbose`, `-m`/`--model`, `-a`/`--account-type`, `-r`/`--rate-limit`,
+* `-g`/`--github-token`) is owned by github-router; forward it to the child
+* explicitly after `--` (e.g. `github-router claude -- -p`). Every other Claude
+* flag (`--print`, `--output-format`, `--resume`, `--continue`, …) flows
+* through automatically.
+*/
+function collectChildPassthroughArgs(rawArgs, argsDef) {
+	const known = /* @__PURE__ */ new Set();
+	const stringTyped = /* @__PURE__ */ new Set();
+	for (const [name$1, def] of Object.entries(argsDef)) {
+		const rawAlias = "alias" in def ? def.alias : void 0;
+		const aliases = rawAlias === void 0 ? [] : Array.isArray(rawAlias) ? rawAlias : [rawAlias];
+		for (const n of [name$1, ...aliases]) {
+			known.add(n);
+			if (def.type === "string") stringTyped.add(n);
+		}
+	}
+	const forwarded = [];
+	for (let i = 0; i < rawArgs.length; i++) {
+		const tok = rawArgs[i];
+		if (tok === "--") {
+			forwarded.push(...rawArgs.slice(i + 1));
+			break;
+		}
+		if (tok === "-" || !tok.startsWith("-")) {
+			forwarded.push(tok);
+			continue;
+		}
+		const doubleDash = tok.startsWith("--");
+		const afterDashes = tok.slice(doubleDash ? 2 : 1);
+		const eq = afterDashes.indexOf("=");
+		const rawName = eq >= 0 ? afterDashes.slice(0, eq) : afterDashes;
+		const hasInlineValue = eq >= 0;
+		const negated = doubleDash && rawName.startsWith("no-");
+		const baseName = negated ? rawName.slice(3) : rawName;
+		if (!(known.has(rawName) || negated && known.has(baseName))) {
+			forwarded.push(tok);
+			continue;
+		}
+		if (!negated && !hasInlineValue && stringTyped.has(rawName) && i + 1 < rawArgs.length && rawArgs[i + 1] !== "--" && !rawArgs[i + 1].startsWith("-")) i++;
+	}
+	return forwarded;
+}
 const claude = defineCommand({
 	meta: {
 		name: "claude",
 		description: "Start the proxy server and launch Claude Code"
 	},
-	args: {
-		...sharedServerArgs,
-		model: {
-			alias: "m",
-			type: "string",
-			description: "Override the default model for Claude Code. Accepts a full slug (e.g. claude-opus-4-7) or an Opus family shorthand (e.g. 4.7, 4.8, 4.6) which expands to the best variant for that family — adding the [1m] suffix when a 1M-context backend is in the catalog."
-		},
-		"codex-mcp": {
-			type: "boolean",
-			default: true,
-			description: "Wire peer-model MCP personas (codex-critic, codex-reviewer, gemini-critic) into the spawned Claude Code session"
-		},
-		"codex-cli": {
-			type: "boolean",
-			default: false,
-			description: "Add a `codex mcp-server` stdio backend so codex-implementer can mutate files. Requires codex CLI 0.129+; gracefully falls back to HTTP-only if absent."
-		},
-		"codex-mcp-only": {
-			type: "boolean",
-			default: false,
-			description: "Pass --strict-mcp-config to claude code so only github-router's MCP servers are loaded (hides user's existing MCP servers)"
-		},
-		stealth: {
-			type: "boolean",
-			default: false,
-			description: "Opt back into VS Code-only beta header filtering. Loses leverage features (task budgets, token-efficient tools, prompt caching, etc.) but minimizes the wire-fingerprint difference from VS Code Copilot Chat. By default the `claude` subcommand enables extended/leverage betas because the spawned Claude Code already identifies itself via UA and other headers — partial stealth doesn't buy much."
-		},
-		"trust-gate": {
-			type: "boolean",
-			default: false,
-			description: "Explicitly record consent for the structural Stop-gate in THIS repo (pinned to the repo's root-commit). The gate is ON BY DEFAULT when a harness is detected (consent-by-launching), so this is now mostly redundant; it stays for explicit/scripted use. Disable the gate entirely with GH_ROUTER_DISABLE_STOP_GATE=1."
-		},
-		"no-stop-gate": {
-			type: "boolean",
-			default: false,
-			description: "Disable the structural Stop-gate for THIS session (same effect as GH_ROUTER_DISABLE_STOP_GATE=1). Intended for driven/automated sessions where a blocking Stop hook would hang the turn-end while a fleet driver waits."
-		},
-		"auto-update": {
-			type: "boolean",
-			default: true,
-			description: "Check for and install the latest Claude Code on launch via `claude update` (throttled to once per hour via ~/.local/share/github-router/last-update-check). `claude update` respects the real install method (native installer or npm), so it never creates a conflicting second install; builds too old to support it fall back to `npm install -g @anthropic-ai/claude-code@latest`. Set to false (--no-auto-update) to check and warn only. Falls back gracefully if claude/npm/network unavailable."
-		},
-		"update-check": {
-			type: "boolean",
-			default: true,
-			description: "Check the npm registry for a newer Claude Code version on launch and warn if stale (non-blocking ~500ms cost). Set to false (--no-update-check) to skip the check entirely (useful for offline/CI). Independent from --auto-update: --no-update-check implies no auto-install (nothing to install since we never check)."
-		}
-	},
-	async run({ args }) {
+	args: claudeArgs,
+	async run({ args, rawArgs }) {
 		if (!process$1.stdout.isTTY) {
 			consola.error("The claude subcommand requires a TTY (interactive terminal).");
 			process$1.exit(1);
@@ -5872,7 +7788,7 @@ const claude = defineCommand({
 		const banner = chosenSlug === resolvedSlug ? chosenSlug : `${chosenSlug} → ${resolvedSlug}`;
 		process$1.stderr.write(`Server ready on ${serverUrl}, launching Claude Code (${banner})...\n`);
 		const envVars = getClaudeCodeEnvVars(serverUrl, chosenSlug);
-		const extraArgs = args._ ?? [];
+		const extraArgs = collectChildPassthroughArgs(rawArgs, claudeArgs);
 		if (toolbeltEnabled()) {
 			provisionToolbelt().catch((err) => consola.debug("Toolbelt provisioning failed:", err));
 			const toolbeltLine = buildToolbeltAwareness(availableToolCommands());
@@ -5890,6 +7806,7 @@ const claude = defineCommand({
 			await removeOwnClaudeConfigMirror();
 		};
 		let onShutdown = baseShutdown;
+		let peerAwarenessSnippet;
 		if (args["codex-mcp"] !== false) try {
 			const requestedCli = args["codex-cli"] ?? false;
 			const backend = resolveCodexCliBackend({
@@ -5912,7 +7829,10 @@ const claude = defineCommand({
 			const runtime = await writePeerMcpRuntimeFiles(serverUrl, {
 				codexCli: backend === "cli",
 				geminiAvailable,
-				groupKeys
+				groupKeys,
+				workerToolsAvailable: workerToolsEnabled(),
+				browseAvailable: browseAgentEnabled(),
+				implementerModel: implementerSubagentModel()
 			});
 			state.peerMcpNonce = runtime.nonce;
 			envVars.GH_ROUTER_HOOK_MCP_URL = serverUrl;
@@ -5945,6 +7865,16 @@ const claude = defineCommand({
 				} catch (err) {
 					consola.warn(`Could not register the UserPromptSubmit hook: ${String(err)}`);
 				}
+				if (!injected.ok) consola.warn("Workers non-blocking guard NOT registered: subagent MCP injection fell back to parent-only (--mcp-config), so worker-* dispatchers cannot reach the workers server. Raw (blocking) worker tools remain usable on the main thread this session.");
+				else if (process$1.env.GH_ROUTER_DISABLE_WORKER_GUARD === "1") consola.info("Workers non-blocking guard disabled via GH_ROUTER_DISABLE_WORKER_GUARD=1 — raw mcp__workers__* is callable on the main thread (blocking); the worker-* background agents remain the steered, non-blocking default.");
+				else try {
+					const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
+					const workersKey = workersKeyOf(groupKeys);
+					const modes = activeDispatchModes({ browse: browseAgentEnabled() });
+					await injectStopHookIntoSettingsFile(settingsPath, buildWorkerGuardHookCommand(process$1.execPath, process$1.argv[1], workersKey, modes), "PreToolUse", 10, guardToolMatcher(workersKey, modes));
+				} catch (err) {
+					consola.warn(`Could not register the workers PreToolUse guard hook: ${String(err)}`);
+				}
 				if (skillsWritten > 0) {
 					const skillNames = skillsToWrite.map((s) => `/${s.name}`).join(", ");
 					process$1.stderr.write(`Injected skills (${skillsWritten}/${skillsToWrite.length}): ${skillNames}.\n`);
@@ -6084,7 +8014,7 @@ const claude = defineCommand({
 				agentToolsAvailable: agentToolsEnabled(),
 				groupKeys
 			});
-			extraArgs.push("--append-system-prompt", peerSnippet);
+			peerAwarenessSnippet = peerSnippet;
 			try {
 				await appendPeerAwarenessToMirroredClaudeMd(peerSnippet);
 			} catch (err) {
@@ -6098,6 +8028,12 @@ const claude = defineCommand({
 		} catch (err) {
 			consola.warn(`Peer MCP wiring failed (claude will launch without it): ${err instanceof Error ? err.message : String(err)}`);
 		}
+		extraArgs.push("--append-system-prompt", peerAwarenessSnippet ? `${OPERATING_DEFAULTS_DIRECTIVE}\n\n${peerAwarenessSnippet}` : OPERATING_DEFAULTS_DIRECTIVE);
+		try {
+			await prependOperatingDefaultsToMirroredClaudeMd();
+		} catch (err) {
+			consola.warn(`Operating-defaults CLAUDE.md prepend failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
 		launchChild({
 			kind: "claude-code",
 			envVars,
@@ -6373,7 +8309,7 @@ async function postJson(url, payload, opts) {
 * no such handle. Hooks always receive piped/redirected stdin, so this never
 * blocks (guarded against an interactive TTY, and any error -> "").
 */
-function readStdin$3() {
+function readStdin$4() {
 	try {
 		if (process.stdin.isTTY) return "";
 		return readFileSync(0, "utf8");
@@ -6404,7 +8340,7 @@ const internalPromptSubmit = defineCommand({
 	},
 	async run() {
 		try {
-			const stdin = readStdin$3();
+			const stdin = readStdin$4();
 			const steerEnabled = parseBoolEnv(process.env.GH_ROUTER_DISABLE_PROMPT_STEER) !== true;
 			const runtime = hookMcpRuntimeFromEnv();
 			let decision;
@@ -6464,7 +8400,7 @@ const internalPromptSubmit = defineCommand({
 * teardown and trips a `uv_async_send` assertion; a synchronous read has no such
 * handle. Hooks always receive piped stdin (guarded against a TTY; any error -> "").
 */
-function readStdin$2() {
+function readStdin$3() {
 	try {
 		if (process.stdin.isTTY) return "";
 		return readFileSync(0, "utf8");
@@ -6554,7 +8490,7 @@ const internalSessionBind = defineCommand({
 		try {
 			const out = typeof args.out === "string" ? args.out.trim() : "";
 			if (!out) return;
-			const record = decodeSessionBind(readStdin$2());
+			const record = decodeSessionBind(readStdin$3());
 			if (record) writeSidecar(out, record);
 		} catch {}
 		process.exitCode = 0;
@@ -6723,7 +8659,7 @@ ${body}
 
 //#endregion
 //#region src/internal-artifact-open.ts
-function readStdin$1() {
+function readStdin$2() {
 	try {
 		if (process.stdin.isTTY) return "";
 		return readFileSync(0, "utf8");
@@ -6817,7 +8753,7 @@ const internalArtifactOpen = defineCommand({
 	},
 	async run() {
 		try {
-			const raw = readStdin$1();
+			const raw = readStdin$2();
 			let payload;
 			try {
 				payload = JSON.parse(raw);
@@ -6845,7 +8781,7 @@ const internalArtifactOpen = defineCommand({
 * no such handle. Hooks always receive piped/redirected stdin, so this never
 * blocks (guarded against an interactive TTY, and any error -> "").
 */
-function readStdin() {
+function readStdin$1() {
 	try {
 		if (process.stdin.isTTY) return "";
 		return readFileSync(0, "utf8");
@@ -6972,7 +8908,7 @@ const internalStopHook = defineCommand({
 		description: "Internal: the structural-gate Stop hook. Reads the Claude Code hook payload on stdin, runs the sealed gate, exits 2 (blocks the stop) on a red gate or gate-weakening diff."
 	},
 	async run() {
-		const stdin = readStdin();
+		const stdin = readStdin$1();
 		const reviewEnabled = stopReviewEnabled() && hookMcpRuntimeFromEnv() !== void 0;
 		let transcriptPath = "";
 		let userPrompt = "";
@@ -7047,9 +8983,10 @@ async function readPayload() {
 *  live tree itself for anything beyond it, so a giant diff never blows the model
 *  window. The Stop hook already caps the captured diff at 2 MiB. */
 const MAX_EMBEDDED_DIFF_BYTES = 200 * 1024;
-/** Wall-clock the reviewer may take. Sized at the worker engine's own 30-min cap
-*  plus headroom — this process is detached, so nothing waits on it; the bound
-*  only stops a hung request from lingering forever. */
+/** Wall-clock the stop-gate reviewer may take. This is INDEPENDENT of the
+*  autonomous worker's wall-clock cap (`DEFAULT_MAX_WALLCLOCK_MS`, now 6h) —
+*  it bounds this one detached review request. Nothing waits on this process,
+*  so the bound only stops a hung request from lingering forever. */
 const REVIEW_TIMEOUT_MS = 2100 * 1e3;
 function buildReviewBrief(payload) {
 	const diff = payload.diff.length > MAX_EMBEDDED_DIFF_BYTES ? `${payload.diff.slice(0, MAX_EMBEDDED_DIFF_BYTES)}\n\n[diff truncated at ${MAX_EMBEDDED_DIFF_BYTES} bytes — read the files directly for the rest]` : payload.diff;
@@ -7109,6 +9046,56 @@ const internalStopReview = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/internal-worker-guard.ts
+/**
+* Read the hook payload from stdin SYNCHRONOUSLY (`readFileSync(0)`) — same
+* rationale as `internal-prompt-submit`: an async stdin read leaves an in-flight
+* libuv FS request that races Windows process teardown. Hooks always receive
+* piped stdin (guarded against an interactive TTY; any error → "").
+*/
+function readStdin() {
+	try {
+		if (process.stdin.isTTY) return "";
+		return readFileSync(0, "utf8");
+	} catch {
+		return "";
+	}
+}
+const internalWorkerGuard = defineCommand({
+	meta: {
+		name: "internal-worker-guard",
+		description: "Internal: the workers PreToolUse guard. Denies a raw mcp__<workers>__<mode> call from the main agent (redirecting to the worker-<mode> background subagent) and allows it from the dispatcher subagent. Fails closed."
+	},
+	args: {
+		"workers-key": {
+			type: "string",
+			description: "Resolved workers MCP config key (bare `workers` or `gh-router-workers`).",
+			required: true
+		},
+		modes: {
+			type: "string",
+			description: "CSV of active worker modes, e.g. `explore,implement,review,plan,test`.",
+			required: false
+		}
+	},
+	run(ctx) {
+		try {
+			const stdin = readStdin();
+			const workersKey = String(ctx.args["workers-key"] ?? "").trim();
+			if (workersKey.length > 0) {
+				const { output } = decideWorkerGuard({
+					stdin,
+					workersKey,
+					modes: parseModesCsv(typeof ctx.args.modes === "string" ? ctx.args.modes : void 0)
+				});
+				if (output) process.stdout.write(output);
+			}
+		} catch {}
+		process.exitCode = 0;
+	}
+});
+
 //#endregion
 //#region src/models.ts
 const models = defineCommand({
@@ -7394,7 +9381,7 @@ process.on("uncaughtException", (error) => {
 const version = getPackageVersion();
 const argv = process.argv.slice(2);
 const isVersionFlag = argv.includes("--version");
-const isInternalHook = argv[0] === "internal-stop-hook" || argv[0] === "internal-prompt-submit" || argv[0] === "internal-stop-review" || argv[0] === "internal-session-bind" || argv[0] === "internal-artifact-open";
+const isInternalHook = argv[0] === "internal-stop-hook" || argv[0] === "internal-prompt-submit" || argv[0] === "internal-stop-review" || argv[0] === "internal-session-bind" || argv[0] === "internal-artifact-open" || argv[0] === "internal-worker-guard";
 if (!isVersionFlag && !isInternalHook) consola.info(`github-router v${version}`);
 await runMain(defineCommand({
 	meta: {
@@ -7414,7 +9401,8 @@ await runMain(defineCommand({
 		"internal-prompt-submit": internalPromptSubmit,
 		"internal-stop-review": internalStopReview,
 		"internal-session-bind": internalSessionBind,
-		"internal-artifact-open": internalArtifactOpen
+		"internal-artifact-open": internalArtifactOpen,
+		"internal-worker-guard": internalWorkerGuard
 	}
 }));