github-router 0.3.204 → 0.3.206

package/dist/{peer-mcp-personas-BekOx3Rp.js → peer-mcp-personas-C3ii7ZqP.js}

@@ -27330,11 +27330,152 @@ function buildWorkerTools(opts) {
 	];
 }
 
+//#endregion
+//#region src/lib/worker-agent/relay-cap.ts
+/** Default relay-safe byte budget for a worker result. */
+const DEFAULT_MAX_RESULT_BYTES = 16 * 1024;
+/** Lower clamp — below this a preview is barely useful. */
+const MIN_MAX_RESULT_BYTES = 8 * 1024;
+/**
+* Upper clamp. 20480 B ≈ 20k tokens even at the ~1 byte/token dense
+* worst case, comfortably under Claude Code's 25k-token result cap. The
+* env override is clamped to this, so it can never reintroduce the
+* overflow the cap exists to prevent.
+*/
+const MAX_MAX_RESULT_BYTES = 20 * 1024;
+/**
+* Age at which a spilled `.patch`/`.txt` is swept. Matches the worktree
+* dir age sweep in `worktree.ts`.
+*/
+const AGE_SWEEP_MS$1 = 10080 * 60 * 1e3;
+/** Min interval between throttled hot-path sweeps (see `sweepAgedWorkerDiffs`). */
+const SWEEP_THROTTLE_MS = 60 * 1e3;
+let lastThrottledSweepAt = 0;
+/**
+* Strict name pattern for router-written overflow files:
+* `<pid>-<8hex>.(patch|txt)`. Shared by the sweep so it NEVER removes a
+* file it didn't write (a user could drop something else under the dir).
+*/
+const WORKER_DIFF_NAME_RE = /^\d+-[0-9a-f]{8}\.(?:patch|txt)$/;
+/** Resolve the relay-safe byte cap from env, clamped to the safe range. */
+function resolveMaxResultBytes() {
+	const raw = process$1.env.GH_ROUTER_WORKER_MAX_RESULT_BYTES;
+	if (raw === void 0) return DEFAULT_MAX_RESULT_BYTES;
+	const n = Number(raw);
+	if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) return DEFAULT_MAX_RESULT_BYTES;
+	return Math.min(MAX_MAX_RESULT_BYTES, Math.max(MIN_MAX_RESULT_BYTES, n));
+}
+/**
+* Return the longest prefix of `text` whose UTF-8 encoding is at most
+* `maxBytes` long, cut on a codepoint boundary (never mid-multibyte).
+*/
+function utf8HeadPreview(text, maxBytes) {
+	if (maxBytes <= 0) return "";
+	const buf = Buffer.from(text, "utf8");
+	if (buf.length <= maxBytes) return text;
+	let end = maxBytes;
+	while (end > 0 && (buf[end] & 192) === 128) end--;
+	return buf.subarray(0, end).toString("utf8");
+}
+/**
+* Best-effort age sweep of router-written overflow files under
+* `WORKER_DIFFS_DIR`. Only removes entries whose NAME matches
+* `WORKER_DIFF_NAME_RE` and whose mtime is older than 7 days — a fresh
+* file a concurrent worker just wrote (new mtime) is never touched, and
+* a locked file just skips. Errors are swallowed so a sweep never blocks
+* the write it precedes.
+*
+* `opts.throttle` (used by the write hot path) skips the readdir/stat scan
+* when a throttled sweep ran within the last minute, so concurrent overflow
+* writes don't each re-scan the directory. Direct callers (and tests) sweep
+* unconditionally.
+*/
+async function sweepAgedWorkerDiffs(opts = {}) {
+	if (opts.throttle) {
+		const now$1 = Date.now();
+		if (now$1 - lastThrottledSweepAt < SWEEP_THROTTLE_MS) return;
+		lastThrottledSweepAt = now$1;
+	}
+	let entries;
+	try {
+		entries = await fs.readdir(PATHS.WORKER_DIFFS_DIR);
+	} catch {
+		return;
+	}
+	const now = Date.now();
+	for (const name of entries) {
+		if (!WORKER_DIFF_NAME_RE.test(name)) continue;
+		const full = nodePath.join(PATHS.WORKER_DIFFS_DIR, name);
+		try {
+			if (now - (await fs.stat(full)).mtimeMs < AGE_SWEEP_MS$1) continue;
+			await fs.rm(full, { force: true }).catch(() => {});
+		} catch {}
+	}
+}
+/**
+* Write `text` in full to a durable `.txt` under `WORKER_DIFFS_DIR` and
+* return its absolute path. Unique `<pid>-<8hex>.txt` name, `0o600`,
+* exclusive-create (`wx`) so it never clobbers a pre-existing file /
+* symlink. Retries on the (astronomically rare) name collision with a
+* fresh suffix. Sweeps aged files first (throttled, best-effort).
+*/
+async function saveOverflowResult(text) {
+	await sweepAgedWorkerDiffs({ throttle: true });
+	await fs.mkdir(PATHS.WORKER_DIFFS_DIR, { recursive: true });
+	let lastErr;
+	for (let attempt = 0; attempt < 5; attempt++) {
+		const name = `${process$1.pid}-${randomBytes(4).toString("hex")}.txt`;
+		const outPath = nodePath.join(PATHS.WORKER_DIFFS_DIR, name);
+		try {
+			await fs.writeFile(outPath, text, {
+				mode: 384,
+				flag: "wx"
+			});
+			return outPath;
+		} catch (err) {
+			if (err.code !== "EEXIST") throw err;
+			lastErr = err;
+		}
+	}
+	throw lastErr instanceof Error ? lastErr : /* @__PURE__ */ new Error("saveOverflowResult: exhausted unique-name retries");
+}
+/**
+* Cap a worker result to a relay-safe size. `reservedBytes` is the UTF-8
+* byte length of any must-survive envelope the caller will add OUTSIDE this
+* result (a `clampNote`/`worktreeNote` prefix, or the browse
+* `[browse session: id]` suffix), so the caller's final `envelope + result`
+* (or `result + envelope`) is guaranteed `<=` the configured cap.
+*
+* If the text fits under the effective cap it is returned unchanged.
+* Otherwise the FULL text is spilled to a durable file and a bounded
+* UTF-8-safe head preview + the file path is returned. On write failure the
+* preview is still returned with an explicit failure note — NEVER the
+* oversized original (that would re-trigger the overflow this guard prevents).
+*/
+async function relaySafeText(text, reservedBytes = 0) {
+	const cap = Math.max(0, resolveMaxResultBytes() - Math.max(0, reservedBytes));
+	if (Buffer.byteLength(text, "utf8") <= cap) return text;
+	let savedPath = null;
+	let saveError = null;
+	try {
+		savedPath = await saveOverflowResult(text);
+	} catch (err) {
+		saveError = err instanceof Error ? err.message : String(err);
+	}
+	const trailer = savedPath !== null ? `\n\n[result truncated to fit the relay; full result saved to: ${savedPath}]` : `\n\n[result truncated to fit the relay; saving the full result failed: ${saveError ?? "unknown"}]`;
+	const out = utf8HeadPreview(text, Math.max(0, cap - Buffer.byteLength(trailer, "utf8"))) + trailer;
+	return Buffer.byteLength(out, "utf8") <= cap ? out : utf8HeadPreview(out, cap);
+}
+
 //#endregion
 //#region src/lib/worker-agent/worktree.ts
-/** Hard cap on the `finalize()` diff text. Above this we return a
-*  summary instead of a half-hunk. */
-const DIFF_CAP_BYTES = 256 * 1024;
+/**
+* A diff at or below this size is inlined in full. Above it, `finalize()`
+* saves the complete patch to a file and returns a `git diff --stat`
+* summary + a bounded UTF-8-safe preview + the file path, so the full
+* change never rides (and overflows) Claude Code's 25k-token result relay.
+*/
+const PREVIEW_CAP = 8 * 1024;
 /** Max entries allowed under `<repoRoot>/.git/worker-worktrees/`. */
 const QUOTA_PER_REPO = 20;
 /** Per-call age sweep: remove worktree dirs older than this. */
@@ -27421,7 +27562,7 @@ async function findRepoRoot(workspaceAbs) {
 	} catch (err) {
 		const e = err;
 		const detail = e.stderr ? e.stderr.trim() : e.message;
-		throw new Error(`worker-agent worktree: git unavailable or workspace is not a repository: ${detail}`);
+		throw new Error(`worker-agent worktree: git unavailable or workspace is not a repository: ${detail}. worker_implement/worker_test always run in an isolated git worktree and require a git repo; for in-place edits (or a non-git workspace), use the native \`implementer\` subagent instead.`);
 	}
 	const lines = result.stdout.split(/\r?\n/).filter((s) => s.length > 0);
 	if (lines.length < 2) throw new Error(`worker-agent worktree: unexpected git rev-parse output: ${JSON.stringify(result.stdout)}`);
@@ -27598,7 +27739,7 @@ async function createWorktree(workspaceAbs, opts) {
 			"diff",
 			"HEAD"
 		], { maxBuffer: 256 * 1024 * 1024 });
-		if (diff.stdout.length <= DIFF_CAP_BYTES) return diff.stdout;
+		if (Buffer.byteLength(diff.stdout, "utf8") <= PREVIEW_CAP) return diff.stdout;
 		let stat$1 = "";
 		try {
 			stat$1 = (await execFileP("git", [
@@ -27609,8 +27750,8 @@ async function createWorktree(workspaceAbs, opts) {
 				"HEAD"
 			])).stdout;
 		} catch {}
-		const lineCount = stat$1.split(/\r?\n/).filter((l) => l.length > 0).length;
-		const summary = `[diff truncated at 256KB; ${Math.max(0, lineCount - 1)} files changed]\n${stat$1}`;
+		const preview = utf8HeadPreview(diff.stdout, PREVIEW_CAP);
+		const previewBlock = `\n\n--- diff preview (first ${PREVIEW_CAP >> 10} KiB of ${Buffer.byteLength(diff.stdout, "utf8")} bytes) ---\n` + preview;
 		let savedPath = null;
 		let saveError = null;
 		try {
@@ -27618,8 +27759,8 @@ async function createWorktree(workspaceAbs, opts) {
 		} catch (err) {
 			saveError = err.message;
 		}
-		if (savedPath !== null) return `${summary}\nFull patch (git apply-able; includes binary blobs) saved to: ${savedPath}`;
-		return `${summary}\n[full patch save failed: ${saveError ?? "unknown"}; only the summary above is available]`;
+		if (savedPath !== null) return `[large diff — full patch saved to a file]\n${stat$1}${previewBlock}\n\nFull patch (git apply-able; includes binary blobs) saved to: ${savedPath}`;
+		return `[large diff — full patch save FAILED: ${saveError ?? "unknown"}; only the summary + preview below survive]\n${stat$1}${previewBlock}`;
 	};
 	return {
 		dir,
@@ -27633,11 +27774,11 @@ async function createWorktree(workspaceAbs, opts) {
 * durable, router-owned file under `PATHS.WORKER_DIFFS_DIR` and return its
 * absolute path.
 *
-* Called by `finalize()` ONLY when the inline diff overflows
-* `DIFF_CAP_BYTES`: the worktree is removed immediately after finalize, so a
-* truncated inline diff would otherwise lose the actual patch forever. The
-* durable dir lives under the app dir — never inside the worktree (deleted)
-* nor the user's repo (don't pollute it).
+* Called by `finalize()` whenever the inline diff exceeds `PREVIEW_CAP`:
+* the worktree is removed immediately after finalize, so the full patch
+* must be persisted or the actual change is lost forever. The durable dir
+* lives under the app dir — never inside the worktree (deleted) nor the
+* user's repo (don't pollute it).
 *
 * `--binary` keeps binary blobs recoverable (git base85-encodes them into
 * the patch) and `--full-index` writes exact 40-char object indexes, so the
@@ -27656,14 +27797,24 @@ async function saveOverflowPatch(dir) {
 		"--full-index",
 		"HEAD"
 	], { maxBuffer: 256 * 1024 * 1024 });
+	await sweepAgedWorkerDiffs({ throttle: true });
 	await fs.mkdir(PATHS.WORKER_DIFFS_DIR, { recursive: true });
-	const name = `${process$1.pid}-${randomBytes(4).toString("hex")}.patch`;
-	const patchPath = nodePath.join(PATHS.WORKER_DIFFS_DIR, name);
-	await fs.writeFile(patchPath, patch.stdout, {
-		mode: 384,
-		flag: "wx"
-	});
-	return patchPath;
+	let lastErr;
+	for (let attempt = 0; attempt < 5; attempt++) {
+		const name = `${process$1.pid}-${randomBytes(4).toString("hex")}.patch`;
+		const patchPath = nodePath.join(PATHS.WORKER_DIFFS_DIR, name);
+		try {
+			await fs.writeFile(patchPath, patch.stdout, {
+				mode: 384,
+				flag: "wx"
+			});
+			return patchPath;
+		} catch (err) {
+			if (err.code !== "EEXIST") throw err;
+			lastErr = err;
+		}
+	}
+	throw lastErr instanceof Error ? lastErr : /* @__PURE__ */ new Error("saveOverflowPatch: exhausted unique-name retries");
 }
 
 //#endregion
@@ -30697,7 +30848,7 @@ function buildPeerAwarenessSnippet(opts) {
 	criticList.push("`opus_critic` (Opus 4.6)");
 	const codexCliClause = opts.codexCli ? " `mcp__codex-cli__codex` dispatches to `codex-implementer` (gpt-5.3-codex with workspace-write) for end-to-end coding tasks." : "";
 	const para2Parts = [`\`mcp__${searchKey}__code\` is the one-stop code search (no extra model call). Its DEFAULT mode (or \`mode:"semantic"\`) ranks by MEANING via ColBERT over a per-workspace index, the first thing to reach for on intent/concept questions ("where is retry/backoff handled", "how does auth work"); when that index isn't ready it transparently falls back to lexical (the response \`source\` says which engine ran). Forced modes cover the rest: \`lexical\` (BM25F-ranked + tree-sitter, best for exact symbols), \`exact\`, \`regex\`, \`complete\` (exhaustive set), \`ast_pattern\`+\`ast_lang\` for multi-line AST shapes, \`scan\` for a whole-workspace symbol outline, \`multiline\` for cross-line regex. Multiple queries can run in a single turn. The index covers code-shaped files; for unstructured files (logs, \`.csv\`, \`.env*\`, config-only wiring), \`grep\`/\`glob\` still apply.`];
-	if (opts.workerToolsAvailable) para2Parts.push(`\`worker-*\` are background Agent subagents (subagent_type) that run the matching worker in its own context and deliver the result as a completion notification, so a long run never blocks the turn: \`worker-explore\` (read-only research), \`worker-review\` (reads the code to verify a change or claim), \`worker-plan\` (ordered implementation plan), \`worker-implement\` (edit/write/bash; \`worktree: true\` isolates in a git worktree and returns the diff), \`worker-test\` (independent test author). The raw \`mcp__${workersKey}__*\` tools they call are guarded (a direct main-thread call is redirected to the matching agent); Workers themselves have \`code_search\`.`);
+	if (opts.workerToolsAvailable) para2Parts.push(`\`worker-*\` are background Agent subagents (subagent_type) that run the matching worker in its own context and deliver the result as a completion notification, so a long run never blocks the turn: \`worker-explore\` (read-only research), \`worker-review\` (reads the code to verify a change or claim), \`worker-plan\` (ordered implementation plan), \`worker-implement\` (edit/write/bash; ALWAYS runs in an isolated git worktree and returns the diff via a saved patch file; for in-place edits use the \`implementer\` subagent), \`worker-test\` (independent test author; also always worktree-isolated). The raw \`mcp__${workersKey}__*\` tools they call are guarded (a direct main-thread call is redirected to the matching agent); Workers themselves have \`code_search\`.`);
 	para2Parts.push(`Three native subagents are always available (Task): \`implementer\` (bounded implementation), \`debugger\` (reproduce + isolate a failure's root cause), and \`qa-engineer\` (review + author/run tests), each in its own context so the lead's context stays free; on gpt-5.6-sol when in the catalog, else the lead's model.`);
 	if (opts.workerToolsAvailable) para2Parts.push(`For a bounded, well-scoped implementation, prefer the \`implementer\` subagent over \`worker-implement\`; reach for \`worker-implement\` only when you specifically need git-worktree isolation, parallel variants, or a throwaway experiment.`);
 	if (opts.workerToolsAvailable) para2Parts.push(`\`mcp__${orchestrateKey}__decompose\` composes an open-ended ask into a typed, VERIFIED workflow IR (a strong driver decorrelated by a cross-lab critic, so the decompose step isn't a single point of failure), and \`mcp__${orchestrateKey}__run_workflow\` executes that IR through a frozen kernel delivering max(orchestrated, baseline) over a sealed executable gate, so it never ships worse than a plain single-model run. \`mcp__${orchestrateKey}__verify_workflow\` checks an IR's floor invariants before you run it, and \`mcp__${orchestrateKey}__attest_step\` audits that a finished run's producers were each checked by a different lab. They suit non-trivial, role-separated asks; a trivial ask does not need them.`);
@@ -31010,7 +31161,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "implement",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-implement` agent. Dispatch via the Agent tool (subagent_type: worker-implement) so the turn is never blocked; the result arrives as a completion notification. Delegates a scoped coding task to an autonomous worker (Pi runtime; default model `gpt-5.6-sol` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the explore read-only tools plus edit, write, bash, and codex_review, and it returns its final text with any changed files or worktree diff. Use for bounded implementation work that may take a while or benefits from isolated worker context. Not for pure research, planning, review, or independent test authoring; use explore, plan, review, or test for those scopes. With `worktree: false` (default) edits happen in place, so concurrent implement calls and lead edits to the same files can race. With `worktree: true` it runs in an isolated git worktree and returns the diff; this errors if the workspace is not a git repository.",
+		description: "Runs as the background `worker-implement` agent. Dispatch via the Agent tool (subagent_type: worker-implement) so the turn is never blocked; the result arrives as a completion notification. Delegates a scoped coding task to an autonomous worker (Pi runtime; default model `gpt-5.6-sol` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the explore read-only tools plus edit, write, bash, and codex_review, and it returns its final text with any changed files or worktree diff. Use for bounded implementation work that may take a while or benefits from isolated worker context. Not for pure research, planning, review, or independent test authoring; use explore, plan, review, or test for those scopes. ALWAYS runs in an isolated git worktree and returns the diff via a saved patch file (a `--stat` summary + a bounded preview + the patch path; a small diff is inlined in full) — it never edits your working tree, and it HARD-ERRORS if the workspace is not a git repository. For in-place edits, use the native `implementer` subagent.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -31022,7 +31173,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				worktree: {
 					type: "boolean",
-					description: "When true, run inside a fresh git worktree and return Pi's final text followed by the unified diff (so the lead can review before merging). When false/omitted, edits the workspace in place, so concurrent worker calls and lead edits can race. Errors if true and the workspace is not a git repository."
+					description: "Ignored — worker_implement ALWAYS runs in an isolated git worktree and returns the diff (retained for compatibility; worktree:false is overridden with a note). For in-place edits, use the `implementer` subagent."
 				},
 				model: {
 					type: "string",
@@ -31042,7 +31193,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				workspace: {
 					type: "string",
-					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected). For worktree:true, must be inside a git repo."
+					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected). Must be inside a git repo (implement always runs in a worktree)."
 				},
 				maxWallClockMs: {
 					type: "integer",
@@ -31158,7 +31309,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "test",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-test` agent. Dispatch via the Agent tool (subagent_type: worker-test) so the turn is never blocked; the result arrives as a completion notification. Independent adversarial test authoring by an autonomous worker (Pi runtime; default model `gpt-5.6-sol` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read/write toolset as implement and writes tests that try to break the implementation through edge cases, error paths, and acceptance criteria, then runs them and reports pass/fail. Use when a separate test author should challenge an implementation without modifying the production code to make tests pass. Not for implementing fixes, broad research, or code review; use implement, explore, or review for those scopes. With `worktree: true` it runs in an isolated git worktree and returns the test diff; this errors if the workspace is not a git repository.",
+		description: "Runs as the background `worker-test` agent. Dispatch via the Agent tool (subagent_type: worker-test) so the turn is never blocked; the result arrives as a completion notification. Independent adversarial test authoring by an autonomous worker (Pi runtime; default model `gpt-5.6-sol` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read/write toolset as implement and writes tests that try to break the implementation through edge cases, error paths, and acceptance criteria, then runs them and reports pass/fail. Use when a separate test author should challenge an implementation without modifying the production code to make tests pass. Not for implementing fixes, broad research, or code review; use implement, explore, or review for those scopes. ALWAYS runs in an isolated git worktree and returns the test diff via a saved patch file (a `--stat` summary + a bounded preview + the patch path; a small diff is inlined in full) — it never edits your working tree, and it HARD-ERRORS if the workspace is not a git repository. For in-place test authoring, use the native `implementer` subagent.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -31170,7 +31321,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				worktree: {
 					type: "boolean",
-					description: "When true, run inside a fresh git worktree and return Pi's final text followed by the unified diff (so the lead can review the authored tests before merging). When false/omitted, writes tests in place, so concurrent worker calls and lead edits can race. Errors if true and the workspace is not a git repository."
+					description: "Ignored — worker_test ALWAYS runs in an isolated git worktree and returns the diff (retained for compatibility; worktree:false is overridden with a note). For in-place test authoring, use the `implementer` subagent."
 				},
 				model: {
 					type: "string",
@@ -31190,7 +31341,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				workspace: {
 					type: "string",
-					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected). For worktree:true, must be inside a git repo."
+					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected). Must be inside a git repo (test always runs in a worktree)."
 				},
 				maxWallClockMs: {
 					type: "integer",
@@ -31579,15 +31730,19 @@ async function runWorkerToolCall(call) {
 		thinking = thinkingRaw;
 	}
 	let worktree;
-	if ((mode === "implement" || mode === "test") && args.worktree !== void 0) {
-		if (typeof args.worktree !== "boolean") return {
+	let worktreeNote = "";
+	if (mode === "implement" || mode === "test") {
+		if (args.worktree !== void 0 && typeof args.worktree !== "boolean") return {
 			content: [{
 				type: "text",
 				text: `worker_${mode}: arguments.worktree must be a boolean when provided`
 			}],
 			isError: true
 		};
-		worktree = args.worktree;
+		worktree = true;
+		if (args.worktree === false) worktreeNote = `[note: worker_${mode} always runs in an isolated git worktree; the requested worktree:false was overridden. For in-place edits, use the \`implementer\` subagent.]
+
+`;
 	}
 	let workspace;
 	if (args.workspace !== void 0) {
@@ -31641,10 +31796,11 @@ async function runWorkerToolCall(call) {
 		maxWallClockMs,
 		signal
 	});
+	const notePrefix = `${clampNote}${worktreeNote}`;
 	return {
 		content: [{
 			type: "text",
-			text: `${clampNote}${result.text}`
+			text: `${notePrefix}${await relaySafeText(result.text, Buffer.byteLength(notePrefix, "utf8"))}`
 		}],
 		isError: result.isError
 	};
@@ -31733,10 +31889,11 @@ async function runBrowseToolCall(args, signal) {
 	} finally {
 		releaseBrowseSession(sessionId);
 	}
+	const sessionSuffix = `\n\n[browse session: ${sessionId}]`;
 	return {
 		content: [{
 			type: "text",
-			text: `${result.text}\n\n[browse session: ${sessionId}]`
+			text: `${await relaySafeText(result.text, Buffer.byteLength(sessionSuffix, "utf8"))}${sessionSuffix}`
 		}],
 		isError: result.isError
 	};
@@ -31874,4 +32031,4 @@ function enumerateInjectedMcpToolNames(groupKeys, opts = {}) {
 
 //#endregion
 export { buildAdvisorStream as $, setupCopilotToken as $t, trustRepo as A, readResponseBodyCapped as At, runWorkerAgent as B, buildWorkspaceHeaderJson as Bt, fileLastPromptStore as C, getTokenCount as Ct, repoRoot as D, createResponses as Dt, repoFingerprint as E, pickEndpoint as Et, EXPLORE_DEFAULT_MODEL as F, extractTarGzMember as Ft, toolbeltEnabled as G, DEFAULT_CODEX_MODEL_FALLBACKS as Gt, buildEnv as H, toolbeltPathOverride as Ht, IMPLEMENT_DEFAULT_MODEL as I, extractZipMember as It, TOOLBELT_TOOLS$1 as J, UPSTREAM_INACTIVITY_TIMEOUT_MS as Jt, toolbeltSkipSet as K, DEFAULT_PORT as Kt, PLAN_DEFAULT_MODEL as L, shouldUseInsecureTls as Lt, resolveSealedGate as M, provisionBrowserAssets as Mt, BROWSE_DEFAULT_MODEL as N, hasSupportedBrowserInstalled as Nt, stopGateEnabledForRepo as O, createChatCompletions as Ot, DEFAULT_MODEL as P, provisionAndIndexColbert as Pt, ADVISOR_TOOL_INSTRUCTIONS as Q, withInstallLock as Qt, REVIEW_DEFAULT_MODEL as R, ArtifactClient as Rt, fileFindingsStore as S, createMessages as St, isSubagentContext as T, resolveMcpToolTimeoutMs as Tt, availableToolCommands as U, DEFAULT_CLAUDE_MODEL_FALLBACKS as Ut, withNoOutputRetry as V, collapsePathKeys as Vt, buildToolbeltAwareness as W, DEFAULT_CODEX_MODEL as Wt, searchWeb as X, pickClaudeDefault as Xt, assetFor as Y, generateRandomPort as Yt, ADVISOR_INTERNAL_TOOL_NAME as Z, getPackageVersion as Zt, stopGateDisabled as _, copilotBaseUrl as _n, nativeSubagentModel as _t, buildPeerAwarenessSnippet as a, cacheVSCodeVersion as an, logStreamError as at, stopReviewEnabled as b, state as bn, shimDefaultsToXhigh as bt, personasFor as c, resolveCodexModel as cn, handleMcpDelete as ct, buildStopHookCommand as d, getModels as dn, artifactToolsEnabled as dt, setupGitHubAgentToken as en, injectAdvisorTool as et, captureLaunchBaseline as f, getGitHubUser as fn, browseAgentEnabled as ft, launchBaselineKey as g, GITHUB_API_BASE_URL as gn, geminiAvailable as gt, injectStopHookIntoSettingsFile as h, forwardError as hn, fleetToolsEnabled as ht, buildAgentPrompt as i, cacheModels as in, isControllerClosedError as it, liveExec as j, parseJsonOrDiagnose as jt, stopReviewStateDir as k, MAX_RESPONSE_BODY_BYTES as kt, buildArtifactOpenHookCommand as l, resolveModel as ln, handleMcpPost as lt, fileBlockBudget as m, HTTPError as mn, browserToolsEnabled as mt, MCP_GROUPS as n, tryRefreshAndRetry as nn, buildAnthropicErrorEvent as nt, buildPeerAwarenessSummary as o, filterBetaHeader as on, readIteratorWithTimeout as ot, decideStopHook as p, fetchWithTransientRetry as pn, browserCompoundToolsEnabled as pt, vscodeRipgrepPath as q, UPSTREAM_FETCH_TIMEOUT_MS as qt, assertMcpToolSurfaceConsistent as r, cacheCopilotVersion as rn, buildOpenAIErrorEvent as rt, enumerateInjectedMcpToolNames as s, isNullish as sn, relayAnthropicStream as st, GROUP_META as t, setupGitHubToken as tn, isAdvisorRequested as tt, buildSessionBindHookCommand as u, sleep as un, agentToolsEnabled as ut, stopGateId as v, copilotHeaders as vn, standInToolEnabled as vt, fileReviewDebounce as w, assembleResponsesPayload as wt, fileBaselineStore as x, countTokens as xt, stopGatePlanMode as y, githubHeaders as yn, workerToolsEnabled as yt, appendPlanReminder as z, buildWorkspaceHeaderHelperCommand as zt };
-//# sourceMappingURL=peer-mcp-personas-BekOx3Rp.js.map
+//# sourceMappingURL=peer-mcp-personas-C3ii7ZqP.js.map