github-router 0.3.212 → 0.3.229

package/dist/{peer-mcp-personas-C1RegCRs.js → peer-mcp-personas-BKwMCOsl.js}

@@ -23,12 +23,13 @@ import { Worker } from "node:worker_threads";
 import { gunzipSync, inflateRawSync } from "node:zlib";
 import WebSocket from "ws";
 import { events } from "fetch-event-stream";
-import { Type } from "typebox";
+import { Type, Type as Type$1 } from "typebox";
 import "partial-json";
 import { Compile } from "typebox/compile";
 import { Value } from "typebox/value";
 import "yaml";
 import "ignore";
+import "diff";
 
 //#region rolldown:runtime
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
@@ -637,9 +638,9 @@ function resolveModel(modelId) {
 	if (oneMMatch) {
 		const stripped = oneMMatch[1];
 		const resolved = resolveModel(stripped);
-		if (!/-1m(?:$|-)/.test(resolved) && !warnedOneMDowngrade.has(modelId)) {
+		if (!(/-1m(?:$|-)/.test(resolved) || (models.find((m) => m.id === resolved)?.capabilities?.limits?.max_context_window_tokens ?? 0) >= 1e6) && !warnedOneMDowngrade.has(modelId)) {
 			warnedOneMDowngrade.add(modelId);
-			consola.warn(`Model "${modelId}" requested 1M context but no -1m backend is in Copilot's catalog for this tier/family; downgrading upstream to "${resolved}" (200K). Claude Code's local context accounting will still assume 1M — expect premature auto-compact. Drop the [1m] suffix (or unset CLAUDE_CODE_DISABLE_1M_CONTEXT if you set it) to silence.`);
+			consola.warn(`Model "${modelId}" requested 1M context but no 1M backend is in Copilot's catalog for this tier/family; downgrading upstream to "${resolved}" (200K). Claude Code's local context accounting will still assume 1M — expect premature auto-compact. Drop the [1m] suffix (or unset CLAUDE_CODE_DISABLE_1M_CONTEXT if you set it) to silence.`);
 		}
 		return resolved;
 	}
@@ -649,8 +650,8 @@ function resolveModel(modelId) {
 	if (ciMatch) return ciMatch.id;
 	if (lower.includes("opus")) {
 		const oneMs = models.filter((m) => m.id.includes("opus") && /-1m(?:$|-)/.test(m.id));
-		const versionMatch = lower.match(/opus-(\d+)[.-](\d+)/);
-		const requestedVersion = versionMatch ? `${versionMatch[1]}.${versionMatch[2]}` : void 0;
+		const versionMatch = lower.match(/opus-(\d+)(?:[.-](\d+))?/);
+		const requestedVersion = versionMatch ? versionMatch[2] ? `${versionMatch[1]}.${versionMatch[2]}` : versionMatch[1] : void 0;
 		const oneM = (requestedVersion ? oneMs.find((m) => m.id.includes(`opus-${requestedVersion}-`)) : void 0) ?? (requestedVersion ? void 0 : oneMs[0]);
 		if (oneM) return oneM.id;
 	}
@@ -1005,15 +1006,15 @@ function getPackageVersion() {
 //#region src/lib/port.ts
 const DEFAULT_PORT = 8787;
 const DEFAULT_CLAUDE_MODEL_FALLBACKS = [
+	"claude-opus-4-8",
 	"claude-opus-4-7",
-	"claude-opus-4-6",
-	"claude-opus-4-5"
+	"claude-opus-4-6"
 ];
 /**
 * Cap-aware default picker for `ANTHROPIC_MODEL` on the implicit-default
 * path. Returns `claude-opus-${family}[1m]` when the live Copilot catalog
 * shows the family is 1M-capable, else the bare `claude-opus-${family}`
-* slug. `family` defaults to `"4.8"` so the no-arg call selects the
+* slug. `family` defaults to `"5"` so the no-arg call selects the
 * current default; explicit values like `"4.7"` or `"4.6"` are used to
 * honor the `github-router claude -m <version>` family shorthand.
 *
@@ -1027,8 +1028,8 @@ const DEFAULT_CLAUDE_MODEL_FALLBACKS = [
 *   2. **Base-slug capability signal** — the catalog entry whose id IS
 *      the base `opus-${family}` slug advertises
 *      `capabilities.limits.max_context_window_tokens >= 1_000_000`. This
-*      is how 4.8 ships — there is no `-1m` sibling; the single
-*      `claude-opus-4.8` id is the 1M variant.
+*      is how 4.8 and 5 ship — there is no `-1m` sibling; the single
+*      `claude-opus-4.8` / `claude-opus-5` id is itself the 1M variant.
 * Either signal flips on the `[1m]` decoration. Both signals together
 * also flip it on (no double-counting). The breadcrumb log names which
 * signal fired so users can spot catalog shape changes.
@@ -1058,7 +1059,7 @@ const DEFAULT_CLAUDE_MODEL_FALLBACKS = [
 * can't tell the difference between "no catalog yet" and "no 1M
 * variant" — defaulting safe-side preserves the pre-change behavior).
 */
-const DEFAULT_OPUS_FAMILY = "4.8";
+const DEFAULT_OPUS_FAMILY = "5";
 const ONE_M_TOKENS = 1e6;
 function pickClaudeDefault(opusFamily = DEFAULT_OPUS_FAMILY) {
 	const dotted = opusFamily.replace(/-/g, ".");
@@ -6187,19 +6188,19 @@ function resolveTierModel(tier$1) {
 
 //#endregion
 //#region src/lib/first-mate/classifier.ts
-function isRecord$2(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function firstMessageContent$1(value) {
-	if (!isRecord$2(value) || !Array.isArray(value.choices)) return null;
+	if (!isRecord$1(value) || !Array.isArray(value.choices)) return null;
 	const first = value.choices[0];
-	if (!isRecord$2(first) || !isRecord$2(first.message)) return null;
+	if (!isRecord$1(first) || !isRecord$1(first.message)) return null;
 	return typeof first.message.content === "string" ? first.message.content : null;
 }
 function parseJsonObject(value) {
 	try {
 		const parsed = JSON.parse(value);
-		return isRecord$2(parsed) ? parsed : null;
+		return isRecord$1(parsed) ? parsed : null;
 	} catch {
 		return null;
 	}
@@ -6269,7 +6270,7 @@ async function classifyPlanReady(logExcerpt) {
 		schemaHint: "{\"planReady\":boolean,\"planExcerpt\":\"<=1200 chars from the completed plan, or empty\",\"confidence\":number}",
 		maxTokens: 500,
 		validate(value) {
-			if (!isRecord$2(value)) return null;
+			if (!isRecord$1(value)) return null;
 			const planReady = booleanValue$1(value.planReady);
 			const planExcerpt = stringValue$1(value.planExcerpt);
 			if (planReady === null || planExcerpt === null) return null;
@@ -6286,7 +6287,7 @@ async function classifyQuestionAnswerable(question, acceptanceCriteria) {
 		user: `Acceptance criteria:\n${acceptanceCriteria}\n\nAgent question:\n${question}`,
 		schemaHint: "{\"answerable\":boolean,\"answer\":\"present only when answerable\",\"confidence\":number}",
 		validate(value) {
-			if (!isRecord$2(value)) return null;
+			if (!isRecord$1(value)) return null;
 			const answerable = booleanValue$1(value.answerable);
 			if (answerable === null) return null;
 			const answer = stringValue$1(value.answer);
@@ -6304,7 +6305,7 @@ async function classifyFixAddressed(failureSummary, latestLogExcerpt) {
 		user: `Failure summary:\n${failureSummary}\n\nLatest log excerpt:\n${latestLogExcerpt}`,
 		schemaHint: "{\"addressed\":boolean,\"confidence\":number}",
 		validate(value) {
-			if (!isRecord$2(value)) return null;
+			if (!isRecord$1(value)) return null;
 			const addressed = booleanValue$1(value.addressed);
 			return addressed === null ? null : { addressed };
 		}
@@ -6316,7 +6317,7 @@ async function classifyStuck(logExcerpt) {
 		user: `Log excerpt:\n${logExcerpt}`,
 		schemaHint: "{\"stuck\":boolean,\"confidence\":number}",
 		validate(value) {
-			if (!isRecord$2(value)) return null;
+			if (!isRecord$1(value)) return null;
 			const stuck = booleanValue$1(value.stuck);
 			return stuck === null ? null : { stuck };
 		}
@@ -12715,7 +12716,7 @@ function parsePackageJson(text) {
 	if (text === void 0) return void 0;
 	try {
 		const parsed = JSON.parse(text);
-		if (!isRecord$1(parsed)) return void 0;
+		if (!isRecord(parsed)) return void 0;
 		return {
 			scripts: stringRecord(parsed.scripts),
 			dependencies: stringRecord(parsed.dependencies),
@@ -12727,9 +12728,9 @@ function parsePackageJson(text) {
 		return;
 	}
 }
-function detectCommands(packageJson, overrides) {
+function detectCommands(packageJson, overrides$1) {
 	const commands = {};
-	const pm = overrides?.package_manager ?? packageJson?.packageManager?.split("@")[0];
+	const pm = overrides$1?.package_manager ?? packageJson?.packageManager?.split("@")[0];
 	const runner = pm === "bun" || pm === "pnpm" || pm === "yarn" || pm === "npm" ? pm : "npm";
 	const scripts = packageJson?.scripts ?? {};
 	if (packageJson !== void 0) {
@@ -12742,11 +12743,11 @@ function detectCommands(packageJson, overrides) {
 			"dev"
 		]) if (scripts[key] !== void 0) commands[key] = runScriptCommand(runner, key);
 	}
-	if (overrides?.build_command !== void 0) commands.build = overrides.build_command;
-	if (overrides?.typecheck_command !== void 0) commands.typecheck = overrides.typecheck_command;
-	if (overrides?.lint_command !== void 0) commands.lint = overrides.lint_command;
-	if (overrides?.test_command !== void 0) commands.test = overrides.test_command;
-	if (overrides?.dev_command !== void 0) commands.dev = overrides.dev_command;
+	if (overrides$1?.build_command !== void 0) commands.build = overrides$1.build_command;
+	if (overrides$1?.typecheck_command !== void 0) commands.typecheck = overrides$1.typecheck_command;
+	if (overrides$1?.lint_command !== void 0) commands.lint = overrides$1.lint_command;
+	if (overrides$1?.test_command !== void 0) commands.test = overrides$1.test_command;
+	if (overrides$1?.dev_command !== void 0) commands.dev = overrides$1.dev_command;
 	return commands;
 }
 function detectPackageManager(rootNames, packageJsonText) {
@@ -12915,11 +12916,11 @@ function buildScaffoldPrBody(reports) {
 		"No factory protocol files are seeded; orchestration remains external to the repository."
 	].join("\n");
 }
-function isRecord$1(value) {
+function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stringRecord(value) {
-	if (!isRecord$1(value)) return {};
+	if (!isRecord(value)) return {};
 	const result = {};
 	for (const [key, entry] of Object.entries(value)) if (typeof entry === "string") result[key] = entry;
 	return result;
@@ -13334,40 +13335,47 @@ function deriveDefinitionName(node) {
 	return null;
 }
 /**
-* Collect EVERY definition node from the parse tree — top-level AND
-* nested (class methods, methods' inner functions, nested classes, …) —
-* so the outline is a COMPLETE structural map the model can rely on to
-* decide what to read. Recurses through non-definition wrappers (TS
-* `export_statement`, Python `decorated_definition`, C++
-* `template_declaration`, …) at the same depth, and INTO each definition
-* at depth+1 to surface its members.
-*
-* `defTypes` is the language's definition-node-type set. Each node yields
-* one entry; the `name` is derived per `deriveDefinitionName` (a node
-* with no recoverable name is skipped, but the walk still descends into
-* it so its named members aren't lost). Bounded at `MAX_OUTLINE_ENTRIES`.
-*/
+* Collect declarations that help a model navigate a file: top-level symbols
+* and members of class-like containers. Function-local variables and nested
+* helpers are deliberately omitted because they inflate the summary without
+* identifying useful read targets. Non-definition wrappers (exports,
+* decorators, templates) preserve the surrounding depth.
+*/
+const OUTLINE_MEMBER_CONTAINERS = new Set([
+	"class_declaration",
+	"class_definition",
+	"class_specifier",
+	"interface_declaration",
+	"annotation_type_declaration",
+	"impl_item",
+	"trait_item",
+	"struct_item",
+	"namespace_definition",
+	"module"
+]);
 function collectDefinitions(root, defTypes, signal) {
 	const out = [];
-	const visit = (node, depth) => {
+	const visit = (node, depth, includeDefinitions) => {
 		if (signal?.aborted || out.length >= MAX_OUTLINE_ENTRIES) return;
 		for (const child of node.namedChildren) {
 			if (signal?.aborted || out.length >= MAX_OUTLINE_ENTRIES) return;
 			if (defTypes.has(child.type)) {
-				const name = deriveDefinitionName(child);
-				if (name !== null) out.push({
-					kind: child.type,
-					name,
-					line: child.startPosition.row + 1,
-					depth
-				});
-				visit(child, depth + 1);
+				if (includeDefinitions) {
+					const name = deriveDefinitionName(child);
+					if (name !== null) out.push({
+						kind: child.type,
+						name,
+						line: child.startPosition.row + 1,
+						depth
+					});
+				}
+				if (includeDefinitions && OUTLINE_MEMBER_CONTAINERS.has(child.type)) visit(child, depth + 1, true);
 				continue;
 			}
-			visit(child, depth);
+			visit(child, depth, includeDefinitions);
 		}
 	};
-	visit(root, 0);
+	visit(root, 0, true);
 	return out;
 }
 /**
@@ -13511,10 +13519,10 @@ function confirmDefinitionSites(tree, source, language, hits, signal) {
 	return confirmed;
 }
 /**
-* Full structural outline of a single file — EVERY definition, top-level
-* AND nested (functions, classes, methods, nested functions, interfaces,
-* type aliases, enums, including exported / decorated / templated
-* wrappers). Each entry carries a `depth` (0 = top-level). Reuses the
+* Navigational structural outline of a single file: top-level declarations
+* plus class-like members (methods, fields, interface members), excluding
+* function-local variables and nested implementation helpers. Each entry
+* carries a `depth` (0 = top-level). Reuses the
 * shared grammar bundle and the same `Parser` the structural pass uses
 * — no second `Parser.init()`.
 *
@@ -13679,6 +13687,14 @@ var TreeSitterPool = class {
 			spawned: this.workersSpawned
 		};
 	}
+	/**
+	* Launch-time latency optimization: ready ONE worker and its grammar bundle.
+	* A single worker keeps startup CPU/memory bounded while removing the first
+	* query's initialization wait; normal demand still grows the pool lazily.
+	*/
+	async warm() {
+		return await this.ensureWorkers(1) > 0;
+	}
 	queue = [];
 	inflight = /* @__PURE__ */ new Map();
 	constructor() {
@@ -13694,18 +13710,19 @@ var TreeSitterPool = class {
 	*  callers onto one in-flight ensure so 8 simultaneous searches don't each
 	*  spawn a fresh batch. Returns the live worker count (0 → caller must fall
 	*  back to the in-process path). */
-	ensureWorkers() {
+	ensureWorkers(target = this.size) {
 		if (this.unavailable || this.shuttingDown) return Promise.resolve(0);
+		const desired = Math.max(1, Math.min(target, this.size));
 		const liveNow = this.workers.filter((w) => w.ready && w.loaded.size > 0).length;
-		if (liveNow >= this.size) return Promise.resolve(liveNow);
-		if (this.ensuring) return this.ensuring;
-		this.ensuring = this.doEnsureWorkers().finally(() => {
+		if (liveNow >= desired) return Promise.resolve(liveNow);
+		if (this.ensuring) return liveNow > 0 ? Promise.resolve(liveNow) : this.ensuring;
+		this.ensuring = this.doEnsureWorkers(desired).finally(() => {
 			this.ensuring = null;
 		});
-		return this.ensuring;
+		return liveNow > 0 ? Promise.resolve(liveNow) : this.ensuring;
 	}
-	async doEnsureWorkers() {
-		const need = this.size - this.workers.length;
+	async doEnsureWorkers(target) {
+		const need = target - this.workers.length;
 		const spawns = [];
 		for (let i = 0; i < need; i++) spawns.push(this.spawnWorker());
 		const spawned = await Promise.all(spawns);
@@ -13926,13 +13943,23 @@ var TreeSitterPool = class {
 			budgetHit: false
 		};
 		opts.signal.addEventListener("abort", onAbort, { once: true });
-		const budgetTimer = setTimeout(() => {
-			budgetHit = true;
-			stop();
-		}, opts.budgetMs);
-		budgetTimer.unref?.();
+		let budgetTimer;
 		try {
 			if (await this.ensureWorkers() === 0) return null;
+			if (opts.signal.aborted) return {
+				byFile,
+				budgetHit: false
+			};
+			if (opts.budgetMs <= 0) {
+				budgetHit = true;
+				stop();
+			} else {
+				budgetTimer = setTimeout(() => {
+					budgetHit = true;
+					stop();
+				}, opts.budgetMs);
+				budgetTimer.unref?.();
+			}
 			const dispatchFile = async (job, retried) => {
 				if (stopped) return;
 				const id = this.nextJobId++;
@@ -13963,7 +13990,7 @@ var TreeSitterPool = class {
 			};
 			await Promise.all(jobs.map((job) => dispatchFile(job, false)));
 		} finally {
-			clearTimeout(budgetTimer);
+			if (budgetTimer) clearTimeout(budgetTimer);
 			opts.signal.removeEventListener("abort", onAbort);
 		}
 		const stillLive = this.workers.some((w) => w.ready && w.loaded.size > 0);
@@ -14009,6 +14036,7 @@ function resolveWorkerPath() {
 let _pool = null;
 let _shutdownRegistered = false;
 let _testCrashOnceArmed = false;
+let _warmOverride;
 /**
 * The pool is ON by default for real (non-CI) runs and OFF under CI.
 *
@@ -14054,6 +14082,24 @@ function getTreeSitterPool() {
 	}
 	return _pool;
 }
+/**
+* Best-effort launch warm-up. Returns immediately when disabled/unavailable and
+* never rejects; lazy initialization remains the fallback after any failure.
+*/
+async function warmTreeSitterPool() {
+	if (process.env.GH_ROUTER_DISABLE_TS_POOL_WARMUP === "1") return;
+	const pool = getTreeSitterPool();
+	if (!pool) return;
+	try {
+		if (await (_warmOverride?.(pool) ?? pool.warm())) return;
+	} catch (err) {
+		consola.debug(`[code_search] tree-sitter pool warm-up failed; using lazy initialization: ${err.message}`);
+	}
+	if (_pool === pool) {
+		pool.shutdown();
+		_pool = null;
+	}
+}
 
 //#endregion
 //#region src/lib/worker-agent/paths.ts
@@ -14256,9 +14302,9 @@ const WALL_TIME_MS = 3e4;
 * Structural-pass settings. The wall-clock budget is checked between
 * files (NOT mid-parse — tree-sitter doesn't surface a usable cancel
 * hook in the web-tree-sitter binding we're on), so a single
-* pathological file can overrun by one file's parse-time. In practice
-* a single source file parses in well under 50ms; 200ms gives us
-* comfortable headroom for ~5-10 files even on cold cache.
+* pathological file can overrun by one file's parse-time. Worker/grammar
+* initialization is completed before this timer starts; the 200ms budget
+* therefore measures parsing only, on cold and warm queries alike.
 */
 const STRUCTURAL_BUDGET_MS = 200;
 let _structuralBudgetTestOverride = null;
@@ -14853,7 +14899,7 @@ async function runStructuralPassPooled(opts) {
 	}
 	return {
 		confirmedHitIndexes,
-		fallback: run.budgetHit ? `structural budget exceeded after parsing ${run.byFile.size}/${opts.cap} hits; retry with structural: "topN" or narrow your query` : null,
+		fallback: run.budgetHit ? `structural budget exceeded after parsing ${run.byFile.size}/${jobs.length} files; retry with structural: "topN" or narrow your query` : null,
 		outlinesByFile
 	};
 }
@@ -15183,26 +15229,23 @@ function dropAstGrepSecrets(env) {
 	return env;
 }
 /**
-* Resolve the ast-grep binary. Checks the toolbelt bin dir (where the
-* proxy materializes `sg` + `ast-grep`) AND the system PATH, trying `sg`
-* first then `ast-grep`. Returns an ABSOLUTE path or `null` when neither
-* is found. `resolveExecutable` honors PATHEXT on Windows and excludes
-* the cwd (no planted-`sg.exe` vector). The toolbelt dir is searched by
-* prepending it to a PATH copy so the same resolver handles both sources.
+* Resolve the ast-grep binary. Checks the known router-owned toolbelt paths
+* directly before consulting PATH for the unambiguous `ast-grep` name.
+* Returns an ABSOLUTE path or `null` when neither source has it.
 */
 function resolveAstGrep() {
 	const toolbeltDir = PATHS.TOOLBELT_BIN_DIR;
-	const sgInToolbelt = resolveExecutable("sg", { env: {
-		...process.env,
-		PATH: toolbeltDir
-	} });
-	if (sgInToolbelt) return sgInToolbelt;
-	const astGrep = resolveExecutable("ast-grep", { env: {
-		...process.env,
-		PATH: `${toolbeltDir}${path.delimiter}${pathEnvValue()}`
-	} });
-	if (astGrep) return astGrep;
-	return null;
+	const toolbeltNames = process.platform === "win32" ? [
+		"sg.exe",
+		"ast-grep.exe",
+		"sg",
+		"ast-grep"
+	] : ["sg", "ast-grep"];
+	for (const name of toolbeltNames) {
+		const candidate = path.resolve(toolbeltDir, name);
+		if (existsSync(candidate)) return candidate;
+	}
+	return resolveExecutable("ast-grep", { env: process.env });
 }
 /**
 * Test-only override for the ast-grep resolver. `undefined` = use the real
@@ -15216,11 +15259,6 @@ let _astGrepResolverOverride;
 function resolveAstGrepForRun() {
 	return (_astGrepResolverOverride ?? resolveAstGrep)();
 }
-/** Read PATH case-insensitively from the live env. */
-function pathEnvValue() {
-	for (const key of Object.keys(process.env)) if (key.toLowerCase() === "path") return process.env[key] ?? "";
-	return "";
-}
 /**
 * Run ast-grep with `pattern` over `workspaceCanonical` and return its
 * matches in `RawHit` shape (relativized, 1-indexed). Read-only,
@@ -15242,7 +15280,7 @@ async function runAstGrep(opts) {
 	const binary = resolveAstGrepForRun();
 	if (!binary) return {
 		hits: [],
-		notice: "ast_pattern requires ast-grep (sg), which isn't available here; the model can run ast-grep directly or omit ast_pattern"
+		notice: `ast_pattern requires ast-grep, but no executable was found at ${PATHS.TOOLBELT_BIN_DIR} (sg/ast-grep) or on PATH (ast-grep); install ast-grep or omit ast_pattern`
 	};
 	if (!opts.lang || !/^[A-Za-z0-9_+-]{1,20}$/.test(opts.lang)) return {
 		hits: [],
@@ -15823,318 +15861,6 @@ function modelDirName() {
 /** Short model id used in the sidecar metadata `model` field. */
 const MODEL_ID = "LateOn-Code-edge";
 
-//#endregion
-//#region src/lib/colbert/index-store.ts
-const GIT_TIMEOUT_MS = 4e3;
-/** Grace window after a `building` write before a workspace with no live
-* build PID is declared `crashed` — covers the cross-process window where
-* one proxy wrote `building` but hasn't yet recorded the colgrep child PID. */
-const BUILD_SPAWN_GRACE_MS = 3e4;
-/**
-* Hash a workspace path the same way the metadata sidecar is keyed.
-* NOTE: this is the ROUTER-OWNED meta key, independent of colgrep's
-* internal xxh3 physical-dir key (we never need to predict colgrep's
-* key because we pass the workspace as colgrep's PATH arg and let it
-* route). A stable sha256-prefix of the canonical path is sufficient.
-*/
-function metaHashForWorkspace(workspace) {
-	const canonical = process$1.platform === "win32" ? nodePath.resolve(workspace).toLowerCase().replace(/\\/g, "/") : nodePath.resolve(workspace);
-	let h = 2166136261;
-	for (let i = 0; i < canonical.length; i++) {
-		h ^= canonical.charCodeAt(i);
-		h = Math.imul(h, 16777619);
-	}
-	return (h >>> 0).toString(16).padStart(8, "0");
-}
-function metaPath(workspace) {
-	return nodePath.join(PATHS.COLBERT_META_DIR, `${metaHashForWorkspace(workspace)}.json`);
-}
-/** Read the sidecar metadata for a workspace (null if none yet). */
-async function readColbertMeta(workspace) {
-	try {
-		const raw = await fs.readFile(metaPath(workspace), "utf8");
-		const parsed = JSON.parse(raw);
-		if (parsed && typeof parsed === "object" && typeof parsed.status === "string") return parsed;
-		return null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Per-workspace write serializer. `runInit` issues a pre-spawn
-* `building` write, an `onSpawn` write that patches in the colgrep child
-* PID, and a final `ready`/`failed` write. Chaining them per workspace
-* guarantees the final write lands AFTER the (fire-and-forget) onSpawn
-* write, so a `ready` result is never clobbered back to `building` by a
-* late atomic-rename.
-*/
-const _metaWriteChains = /* @__PURE__ */ new Map();
-/** Atomically write the sidecar metadata for a workspace (serialized). */
-async function writeColbertMeta(meta) {
-	const key = metaHashForWorkspace(meta.workspace);
-	const next = (_metaWriteChains.get(key) ?? Promise.resolve()).then(() => writeColbertMetaUnchained(meta));
-	_metaWriteChains.set(key, next.then(() => void 0, () => void 0));
-	return next;
-}
-async function writeColbertMetaUnchained(meta) {
-	await fs.mkdir(PATHS.COLBERT_META_DIR, { recursive: true });
-	const dest = metaPath(meta.workspace);
-	const tmp = `${dest}.${process$1.pid}.${Math.random().toString(16).slice(2, 10)}.tmp`;
-	try {
-		await fs.writeFile(tmp, JSON.stringify(meta, null, 2));
-		await fs.rename(tmp, dest);
-	} catch (err) {
-		await fs.rm(tmp, { force: true }).catch(() => {});
-		throw err;
-	}
-}
-/**
-* Whether a COMPLETED colgrep index exists on disk for this workspace.
-* The preflight uses this to distinguish `building`/`absent` (no
-* completed index → don't spawn a foreground colgrep) from a real
-* index. We scan COLGREP_DATA_DIR for any per-project dir containing a
-* `project.json` whose canonical path matches this workspace AND an
-* `index/metadata.json` marker.
-*/
-async function completedIndexOnDisk(workspace) {
-	const indicesDir = PATHS.COLBERT_INDICES_DIR;
-	let names;
-	try {
-		names = await fs.readdir(indicesDir);
-	} catch {
-		return false;
-	}
-	const wantCanonical = await realpathForCompare(workspace);
-	for (const name of names) {
-		if (name === ".gh-router-meta") continue;
-		const projJson = nodePath.join(indicesDir, name, "project.json");
-		let proj;
-		try {
-			proj = JSON.parse(await fs.readFile(projJson, "utf8"));
-		} catch {
-			continue;
-		}
-		const projPath = proj.path ?? proj.project_path;
-		if (!projPath) continue;
-		if (await realpathForCompare(projPath) !== wantCanonical) continue;
-		if (existsSync(nodePath.join(indicesDir, name, "index", "metadata.json"))) return true;
-		if (existsSync(nodePath.join(indicesDir, name, "index"))) try {
-			if ((await fs.readdir(nodePath.join(indicesDir, name, "index"))).length > 0) return true;
-		} catch {}
-	}
-	return false;
-}
-function canonicalForCompare(p) {
-	return process$1.platform === "win32" ? nodePath.resolve(p).toLowerCase().replace(/\\/g, "/") : nodePath.resolve(p);
-}
-/** Sync realpath-aware canonicalization (sibling of `realpathForCompare`,
-* for the on-a-timer inactivity probe which must be synchronous). */
-function canonicalRealpathSync(p) {
-	try {
-		return canonicalForCompare(realpathSync(p));
-	} catch {
-		return canonicalForCompare(p);
-	}
-}
-/** Recursive (bytes, fileCount) of a directory; sync + best-effort. A
-* colgrep index is a bounded set of shards so the walk stays small. */
-function dirSizeSync(dir) {
-	let bytes = 0;
-	let count = 0;
-	let entries;
-	try {
-		entries = readdirSync(dir, { withFileTypes: true });
-	} catch {
-		return [0, 0];
-	}
-	for (const e of entries) {
-		const p = nodePath.join(dir, e.name);
-		if (e.isDirectory()) {
-			const [b, c] = dirSizeSync(p);
-			bytes += b;
-			count += c;
-		} else try {
-			bytes += statSync(p).size;
-			count += 1;
-		} catch {}
-	}
-	return [bytes, count];
-}
-/**
-* (sync) Progress signature of a workspace's colgrep index dir for the init
-* inactivity watchdog: `${totalBytes}:${fileCount}` of the project dir, or
-* `null` if it isn't on disk yet. colgrep is SILENT on a non-TTY pipe
-* during the (potentially multi-hour) encode phase, so output is useless as
-* a progress signal — but it writes index shards incrementally, so a
-* changing signature means "still progressing" and a frozen one means
-* "hung". Successive signatures drive the watchdog: change ⇒ re-arm, frozen
-* ⇒ kill. Sync because it's called from a `setTimeout` (not awaited).
-*/
-function indexDirSignature(workspace) {
-	const indicesDir = PATHS.COLBERT_INDICES_DIR;
-	let names;
-	try {
-		names = readdirSync(indicesDir);
-	} catch {
-		return null;
-	}
-	const want = canonicalRealpathSync(workspace);
-	for (const name of names) {
-		if (name === ".gh-router-meta") continue;
-		const dir = nodePath.join(indicesDir, name);
-		let proj;
-		try {
-			proj = JSON.parse(readFileSync(nodePath.join(dir, "project.json"), "utf8"));
-		} catch {
-			continue;
-		}
-		const projPath = proj.path ?? proj.project_path;
-		if (!projPath || canonicalRealpathSync(projPath) !== want) continue;
-		const [bytes, count] = dirSizeSync(dir);
-		return `${bytes}:${count}`;
-	}
-	return null;
-}
-/**
-* Realpath-aware canonicalization for matching a workspace against
-* colgrep's stored `project_path`. colgrep stores the OS realpath (e.g.
-* macOS `/tmp` → `/private/tmp`, Windows 8.3 short names), so a plain
-* `path.resolve` comparison misses. Falls back to `canonicalForCompare`
-* when realpath fails (path doesn't exist yet).
-*/
-async function realpathForCompare(p) {
-	try {
-		return canonicalForCompare(await fs.realpath(p));
-	} catch {
-		return canonicalForCompare(p);
-	}
-}
-/**
-* Compute the freshness verdict for a query against a workspace.
-*
-* Routing (per the dropped-fallback contract):
-*   - `failed`   — sidecar says failed → caller returns isError.
-*   - `building` — a tracked init is live OR no completed index on disk
-*                  → caller returns building notice (NO results).
-*   - `absent`   — never indexed → caller kicks a debounced background
-*                  init, returns absent (isError).
-*   - `stale`    — ready but HEAD moved / tree dirty since index → caller
-*                  returns stale notice (NO results, NO re-search).
-*   - `fresh`    — ready + completed index + HEAD matches + not newly
-*                  dirty → caller spawns colgrep search.
-*/
-async function freshnessVerdict(workspace) {
-	const meta = await readColbertMeta(workspace);
-	if (!meta || meta.status === "absent") return {
-		verdict: "absent",
-		meta
-	};
-	if (meta.status === "failed") return {
-		verdict: "failed",
-		meta
-	};
-	if (meta.status === "building") {
-		const pid = typeof meta.buildPid === "number" ? meta.buildPid : 0;
-		if (isInitInFlight(workspace) || pid > 0 && isPidAlive(pid)) return {
-			verdict: "building",
-			meta
-		};
-		const startedMs = meta.lastIndexedAt ? Date.parse(meta.lastIndexedAt) : NaN;
-		if (Number.isFinite(startedMs) && Date.now() - startedMs < BUILD_SPAWN_GRACE_MS) return {
-			verdict: "building",
-			meta
-		};
-		if (!await completedIndexOnDisk(workspace)) return {
-			verdict: "crashed",
-			meta
-		};
-	}
-	if (!await completedIndexOnDisk(workspace)) return {
-		verdict: "building",
-		meta
-	};
-	const git = await gitState(workspace);
-	if (!git.isRepo) return {
-		verdict: "fresh",
-		meta
-	};
-	const headMoved = meta.lastIndexedHead !== void 0 && git.head !== meta.lastIndexedHead;
-	const newlyDirty = git.dirty && meta.lastIndexedDirty !== true;
-	if (headMoved || newlyDirty) return {
-		verdict: "stale",
-		meta,
-		head: git.head,
-		dirty: git.dirty
-	};
-	return {
-		verdict: "fresh",
-		meta,
-		head: git.head,
-		dirty: git.dirty
-	};
-}
-/** Cheap, bounded git probe via the native-exe runner. */
-async function gitState(workspace) {
-	const git = resolveExecutable("git");
-	if (!git) return { isRepo: false };
-	try {
-		const inside = await runManagedExeCapture(git, [
-			"-C",
-			workspace,
-			"rev-parse",
-			"--is-inside-work-tree"
-		], {
-			timeoutMs: GIT_TIMEOUT_MS,
-			maxStdoutBytes: 64 * 1024
-		});
-		if (inside.code !== 0 || inside.stdout.trim() !== "true") return { isRepo: false };
-		const head = await runManagedExeCapture(git, [
-			"-C",
-			workspace,
-			"rev-parse",
-			"HEAD"
-		], {
-			timeoutMs: GIT_TIMEOUT_MS,
-			maxStdoutBytes: 64 * 1024
-		});
-		const status = await runManagedExeCapture(git, [
-			"-C",
-			workspace,
-			"status",
-			"--porcelain"
-		], {
-			timeoutMs: GIT_TIMEOUT_MS,
-			maxStdoutBytes: 1024 * 1024
-		});
-		return {
-			isRepo: true,
-			head: head.code === 0 ? head.stdout.trim() || void 0 : void 0,
-			dirty: status.code === 0 ? status.stdout.trim().length > 0 : void 0
-		};
-	} catch {
-		return { isRepo: false };
-	}
-}
-const _initInFlight = /* @__PURE__ */ new Set();
-/** True iff a background init for this workspace is already in flight. */
-function isInitInFlight(workspace) {
-	return _initInFlight.has(initKey(workspace));
-}
-/** Mark a background init started (debounce). Returns false if already running. */
-function tryClaimInit(workspace) {
-	const k = initKey(workspace);
-	if (_initInFlight.has(k)) return false;
-	_initInFlight.add(k);
-	return true;
-}
-/** Release the debounce claim (call in the init's finally). */
-function releaseInit(workspace) {
-	_initInFlight.delete(initKey(workspace));
-}
-function initKey(workspace) {
-	return `${MODEL_ID}::${canonicalForCompare(workspace)}`;
-}
-
 //#endregion
 //#region src/lib/toolbelt/extract.ts
 function baseName(p) {
@@ -16167,13 +15893,13 @@ function baseName(p) {
 */
 async function extractTarXzMember(buf, wantBasename, tmpDir) {
 	const { spawn: spawn$1 } = await import("node:child_process");
-	const fs$1 = await import("node:fs/promises");
+	const fs$2 = await import("node:fs/promises");
 	const path$1 = await import("node:path");
 	const archivePath = path$1.join(tmpDir, "archive.tar.xz");
 	const extractDir = path$1.join(tmpDir, "x");
 	try {
-		await fs$1.mkdir(extractDir, { recursive: true });
-		await fs$1.writeFile(archivePath, buf);
+		await fs$2.mkdir(extractDir, { recursive: true });
+		await fs$2.writeFile(archivePath, buf);
 	} catch {
 		return null;
 	}
@@ -16210,25 +15936,25 @@ async function extractTarXzMember(buf, wantBasename, tmpDir) {
 			resolve(code === 0);
 		});
 	})) return null;
-	const found = await findRegularFile(fs$1, path$1, extractDir, new Set([wantBasename, `${wantBasename}.exe`]), 6);
+	const found = await findRegularFile(fs$2, path$1, extractDir, new Set([wantBasename, `${wantBasename}.exe`]), 6);
 	if (!found) return null;
 	try {
-		return await fs$1.readFile(found);
+		return await fs$2.readFile(found);
 	} catch {
 		return null;
 	}
 }
-async function findRegularFile(fs$1, path$1, dir, wants, depthBudget) {
+async function findRegularFile(fs$2, path$1, dir, wants, depthBudget) {
 	if (depthBudget < 0) return null;
 	let entries;
 	try {
-		entries = await fs$1.readdir(dir, { withFileTypes: true });
+		entries = await fs$2.readdir(dir, { withFileTypes: true });
 	} catch {
 		return null;
 	}
 	for (const e of entries) if (e.isFile() && wants.has(e.name)) return path$1.join(dir, e.name);
 	for (const e of entries) if (e.isDirectory()) {
-		const hit = await findRegularFile(fs$1, path$1, path$1.join(dir, e.name), wants, depthBudget - 1);
+		const hit = await findRegularFile(fs$2, path$1, path$1.join(dir, e.name), wants, depthBudget - 1);
 		if (hit) return hit;
 	}
 	return null;
@@ -16339,6 +16065,14 @@ function colgrepBinaryPath() {
 function colbertModelDir() {
 	return nodePath.join(PATHS.COLBERT_MODELS_DIR, "LateOn-Code-edge", modelDirName());
 }
+/**
+* Canonical model argument for every colgrep invocation and project lookup.
+* colgrep hashes the raw model string, so slash variants fork one physical
+* index into distinct project keys on Windows.
+*/
+function canonicalColbertModelDir() {
+	return nodePath.resolve(colbertModelDir());
+}
 /** Absolute path the provisioned ORT dylib lives at. */
 function colbertOrtDylibPath() {
 	const lib = ortLibAsset()?.member ?? "libonnxruntime.so";
@@ -16461,7 +16195,7 @@ async function provisionColbert() {
 		result.status = "incomplete";
 	});
 	if (result.binaryPath && result.ortDylibPath && result.modelDir) {
-		const smoke = await runSmokeTest(result.binaryPath, result.ortDylibPath, result.modelDir);
+		const smoke = await runSmokeTest(result.binaryPath, result.ortDylibPath);
 		if (smoke.ok) {
 			await writeFile(smokeMarkerPath(), expectedSmokeMarker()).catch(() => {});
 			result.status = "ready";
@@ -16590,7 +16324,7 @@ async function sidecarMatches(sidecar, sha256) {
 * scanning stderr for colgrep's exact "ignoring" warning — if present,
 * the dylib didn't load and we fail the smoke test even on exit 0.
 */
-async function runSmokeTest(binaryPath, ortDylibPath, modelDir) {
+async function runSmokeTest(binaryPath, ortDylibPath) {
 	const tmp = nodePath.join(PATHS.COLBERT_DIR, `smoke-${process$1.pid}-${randomBytes(4).toString("hex")}`);
 	const fixtureDir = nodePath.join(tmp, "fixture");
 	const dataDir = nodePath.join(tmp, "data");
@@ -16619,7 +16353,7 @@ async function runSmokeTest(binaryPath, ortDylibPath, modelDir) {
 			"never",
 			"--force-cpu",
 			"--model",
-			modelDir,
+			canonicalColbertModelDir(),
 			"-y",
 			"-k",
 			"1",
@@ -16657,6 +16391,395 @@ async function runSmokeTest(binaryPath, ortDylibPath, modelDir) {
 	}
 }
 
+//#endregion
+//#region src/lib/colbert/index-store.ts
+const GIT_TIMEOUT_MS = 4e3;
+/** Grace window after a `building` write before a workspace with no live
+* build PID is declared `crashed` — covers the cross-process window where
+* one proxy wrote `building` but hasn't yet recorded the colgrep child PID. */
+const BUILD_SPAWN_GRACE_MS = 3e4;
+/**
+* Hash a workspace path the same way the metadata sidecar is keyed.
+* NOTE: this is the ROUTER-OWNED meta key, independent of colgrep's
+* internal xxh3 physical-dir key (we never need to predict colgrep's
+* key because we pass the workspace as colgrep's PATH arg and let it
+* route). A stable sha256-prefix of the canonical path is sufficient.
+*/
+function metaHashForWorkspace(workspace) {
+	const canonical = process$1.platform === "win32" ? nodePath.resolve(workspace).toLowerCase().replace(/\\/g, "/") : nodePath.resolve(workspace);
+	let h = 2166136261;
+	for (let i = 0; i < canonical.length; i++) {
+		h ^= canonical.charCodeAt(i);
+		h = Math.imul(h, 16777619);
+	}
+	return (h >>> 0).toString(16).padStart(8, "0");
+}
+function metaPath(workspace) {
+	return nodePath.join(PATHS.COLBERT_META_DIR, `${metaHashForWorkspace(workspace)}.json`);
+}
+/** Read the sidecar metadata for a workspace (null if none yet). */
+async function readColbertMeta(workspace) {
+	try {
+		const raw = await fs.readFile(metaPath(workspace), "utf8");
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && typeof parsed.status === "string") return parsed;
+		return null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Per-workspace write serializer. `runInit` issues a pre-spawn
+* `building` write, an `onSpawn` write that patches in the colgrep child
+* PID, and a final `ready`/`failed` write. Chaining them per workspace
+* guarantees the final write lands AFTER the (fire-and-forget) onSpawn
+* write, so a `ready` result is never clobbered back to `building` by a
+* late atomic-rename.
+*/
+const _metaWriteChains = /* @__PURE__ */ new Map();
+/** Atomically write the sidecar metadata for a workspace (serialized). */
+async function writeColbertMeta(meta) {
+	const key = metaHashForWorkspace(meta.workspace);
+	const next = (_metaWriteChains.get(key) ?? Promise.resolve()).then(() => writeColbertMetaUnchained(meta));
+	_metaWriteChains.set(key, next.then(() => void 0, () => void 0));
+	return next;
+}
+async function writeColbertMetaUnchained(meta) {
+	await fs.mkdir(PATHS.COLBERT_META_DIR, { recursive: true });
+	const dest = metaPath(meta.workspace);
+	const tmp = `${dest}.${process$1.pid}.${Math.random().toString(16).slice(2, 10)}.tmp`;
+	try {
+		await fs.writeFile(tmp, JSON.stringify(meta, null, 2));
+		await fs.rename(tmp, dest);
+	} catch (err) {
+		await fs.rm(tmp, { force: true }).catch(() => {});
+		throw err;
+	}
+}
+/**
+* Whether a COMPLETED colgrep index exists on disk for this workspace.
+* The preflight uses this to distinguish `building`/`absent` (no
+* completed index → don't spawn a foreground colgrep) from a real
+* index. We scan COLGREP_DATA_DIR for any per-project dir containing a
+* `project.json` whose canonical path matches this workspace AND an
+* `index/metadata.json` marker.
+*/
+async function colbertProjectDir(workspace) {
+	const indicesDir = PATHS.COLBERT_INDICES_DIR;
+	let names;
+	try {
+		names = await fs.readdir(indicesDir);
+	} catch {
+		return null;
+	}
+	const wantCanonical = await realpathForCompare(workspace);
+	for (const name of names) {
+		if (name === ".gh-router-meta" || name.includes(".corrupt-")) continue;
+		const dir = nodePath.join(indicesDir, name);
+		let proj;
+		try {
+			proj = JSON.parse(await fs.readFile(nodePath.join(dir, "project.json"), "utf8"));
+		} catch {
+			continue;
+		}
+		const projPath = proj.path ?? proj.project_path;
+		if (!projPath || await realpathForCompare(projPath) !== wantCanonical) continue;
+		if (proj.model !== canonicalColbertModelDir()) continue;
+		return dir;
+	}
+	return null;
+}
+/** Validate the contiguous embedding interval encoded by PLAID shard metadata. */
+function validateIndexIntegrity(projectIndexDir) {
+	let names;
+	try {
+		names = readdirSync(projectIndexDir).filter((name) => /^\d+\.metadata\.json$/.test(name));
+	} catch (err) {
+		return err.code === "ENOENT" ? { verdict: "not-built" } : {
+			verdict: "corrupt",
+			reason: "index directory unreadable"
+		};
+	}
+	if (names.length === 0) return { verdict: "not-built" };
+	const intervals = [];
+	for (const name of names) try {
+		const parsed = JSON.parse(readFileSync(nodePath.join(projectIndexDir, name), "utf8"));
+		const start = parsed.embedding_offset;
+		const count = parsed.num_embeddings;
+		if (typeof start !== "number" || typeof count !== "number" || !Number.isSafeInteger(start) || !Number.isSafeInteger(count) || start < 0 || count < 0) return {
+			verdict: "corrupt",
+			reason: `invalid shard metadata: ${name}`
+		};
+		intervals.push({
+			start,
+			count
+		});
+	} catch {
+		return {
+			verdict: "corrupt",
+			reason: `unreadable shard metadata: ${name}`
+		};
+	}
+	intervals.sort((a, b) => a.start - b.start || a.count - b.count);
+	let cursorEnd = 0;
+	let sum = 0;
+	let gapped = false;
+	for (const interval of intervals) {
+		if (interval.start < cursorEnd) return {
+			verdict: "corrupt",
+			reason: "overlapping shard intervals"
+		};
+		if (interval.start > cursorEnd) gapped = true;
+		cursorEnd = interval.start + interval.count;
+		sum += interval.count;
+	}
+	if (gapped) return {
+		verdict: "suspect",
+		reason: "gap between shard intervals"
+	};
+	return {
+		verdict: "coherent",
+		shardCount: intervals.length,
+		embeddingCount: sum
+	};
+}
+async function completedIndexOnDisk(workspace) {
+	const projectDir = await colbertProjectDir(workspace);
+	if (!projectDir) return false;
+	return validateIndexIntegrity(nodePath.join(projectDir, "index")).verdict !== "not-built";
+}
+function canonicalForCompare(p) {
+	return process$1.platform === "win32" ? nodePath.resolve(p).toLowerCase().replace(/\\/g, "/") : nodePath.resolve(p);
+}
+/** Sync realpath-aware canonicalization (sibling of `realpathForCompare`,
+* for the on-a-timer inactivity probe which must be synchronous). */
+function canonicalRealpathSync(p) {
+	try {
+		return canonicalForCompare(realpathSync(p));
+	} catch {
+		return canonicalForCompare(p);
+	}
+}
+/** Recursive (bytes, fileCount) of a directory; sync + best-effort. A
+* colgrep index is a bounded set of shards so the walk stays small. */
+function dirSizeSync(dir) {
+	let bytes = 0;
+	let count = 0;
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return [0, 0];
+	}
+	for (const e of entries) {
+		const p = nodePath.join(dir, e.name);
+		if (e.isDirectory()) {
+			const [b, c] = dirSizeSync(p);
+			bytes += b;
+			count += c;
+		} else try {
+			bytes += statSync(p).size;
+			count += 1;
+		} catch {}
+	}
+	return [bytes, count];
+}
+/**
+* (sync) Progress signature of a workspace's colgrep index dir for the init
+* inactivity watchdog: `${totalBytes}:${fileCount}` of the project dir, or
+* `null` if it isn't on disk yet. colgrep is SILENT on a non-TTY pipe
+* during the (potentially multi-hour) encode phase, so output is useless as
+* a progress signal — but it writes index shards incrementally, so a
+* changing signature means "still progressing" and a frozen one means
+* "hung". Successive signatures drive the watchdog: change ⇒ re-arm, frozen
+* ⇒ kill. Sync because it's called from a `setTimeout` (not awaited).
+*/
+function indexDirSignature(workspace) {
+	const indicesDir = PATHS.COLBERT_INDICES_DIR;
+	let names;
+	try {
+		names = readdirSync(indicesDir);
+	} catch {
+		return null;
+	}
+	const want = canonicalRealpathSync(workspace);
+	for (const name of names) {
+		if (name === ".gh-router-meta") continue;
+		if (name.includes(".corrupt-")) continue;
+		const dir = nodePath.join(indicesDir, name);
+		let proj;
+		try {
+			proj = JSON.parse(readFileSync(nodePath.join(dir, "project.json"), "utf8"));
+		} catch {
+			continue;
+		}
+		const projPath = proj.path ?? proj.project_path;
+		if (!projPath || canonicalRealpathSync(projPath) !== want) continue;
+		const [bytes, count] = dirSizeSync(dir);
+		return `${bytes}:${count}`;
+	}
+	return null;
+}
+/**
+* Realpath-aware canonicalization for matching a workspace against
+* colgrep's stored `project_path`. colgrep stores the OS realpath (e.g.
+* macOS `/tmp` → `/private/tmp`, Windows 8.3 short names), so a plain
+* `path.resolve` comparison misses. Falls back to `canonicalForCompare`
+* when realpath fails (path doesn't exist yet).
+*/
+async function realpathForCompare(p) {
+	try {
+		return canonicalForCompare(await fs.realpath(p));
+	} catch {
+		return canonicalForCompare(p);
+	}
+}
+/**
+* Compute the freshness verdict for a query against a workspace.
+*
+* Routing (per the dropped-fallback contract):
+*   - `failed`   — sidecar says failed → caller returns isError.
+*   - `building` — a tracked init is live OR no completed index on disk
+*                  → caller returns building notice (NO results).
+*   - `absent`   — never indexed → caller kicks a debounced background
+*                  init, returns absent (isError).
+*   - `stale`    — ready but HEAD moved / tree dirty since index → caller
+*                  returns stale notice (NO results, NO re-search).
+*   - `fresh`    — ready + completed index + HEAD matches + not newly
+*                  dirty → caller spawns colgrep search.
+*/
+async function freshnessVerdict(workspace) {
+	const meta = await readColbertMeta(workspace);
+	if (!meta || meta.status === "absent") return {
+		verdict: "absent",
+		meta
+	};
+	if (meta.status === "failed") return {
+		verdict: "failed",
+		meta
+	};
+	if (meta.status === "building") {
+		const pid = typeof meta.buildPid === "number" ? meta.buildPid : 0;
+		if (isInitInFlight(workspace) || pid > 0 && isPidAlive(pid)) return {
+			verdict: "building",
+			meta
+		};
+		const startedMs = meta.lastIndexedAt ? Date.parse(meta.lastIndexedAt) : NaN;
+		if (Number.isFinite(startedMs) && Date.now() - startedMs < BUILD_SPAWN_GRACE_MS) return {
+			verdict: "building",
+			meta
+		};
+		if (!await completedIndexOnDisk(workspace)) return {
+			verdict: "crashed",
+			meta
+		};
+	}
+	const projectDir = await colbertProjectDir(workspace);
+	if (!projectDir) return {
+		verdict: "building",
+		meta
+	};
+	const integrity = validateIndexIntegrity(nodePath.join(projectDir, "index"));
+	if (integrity.verdict === "not-built") return {
+		verdict: "building",
+		meta
+	};
+	if (integrity.verdict === "corrupt") return {
+		verdict: "corrupt",
+		meta
+	};
+	if (integrity.verdict === "suspect") return {
+		verdict: "stale",
+		meta
+	};
+	const binarySha = colgrepBinAsset()?.sha256;
+	const ortSha = ortLibAsset()?.sha256;
+	if (binarySha && meta.binarySha !== binarySha || ortSha && meta.ortSha !== ortSha) return {
+		verdict: "stale",
+		meta
+	};
+	const git = await gitState(workspace);
+	if (!git.isRepo) return {
+		verdict: "fresh",
+		meta
+	};
+	const headMoved = meta.lastIndexedHead !== void 0 && git.head !== meta.lastIndexedHead;
+	const newlyDirty = git.dirty && meta.lastIndexedDirty !== true;
+	if (headMoved || newlyDirty) return {
+		verdict: "stale",
+		meta,
+		head: git.head,
+		dirty: git.dirty
+	};
+	return {
+		verdict: "fresh",
+		meta,
+		head: git.head,
+		dirty: git.dirty
+	};
+}
+/** Cheap, bounded git probe via the native-exe runner. */
+async function gitState(workspace) {
+	const git = resolveExecutable("git");
+	if (!git) return { isRepo: false };
+	try {
+		const inside = await runManagedExeCapture(git, [
+			"-C",
+			workspace,
+			"rev-parse",
+			"--is-inside-work-tree"
+		], {
+			timeoutMs: GIT_TIMEOUT_MS,
+			maxStdoutBytes: 64 * 1024
+		});
+		if (inside.code !== 0 || inside.stdout.trim() !== "true") return { isRepo: false };
+		const head = await runManagedExeCapture(git, [
+			"-C",
+			workspace,
+			"rev-parse",
+			"HEAD"
+		], {
+			timeoutMs: GIT_TIMEOUT_MS,
+			maxStdoutBytes: 64 * 1024
+		});
+		const status = await runManagedExeCapture(git, [
+			"-C",
+			workspace,
+			"status",
+			"--porcelain"
+		], {
+			timeoutMs: GIT_TIMEOUT_MS,
+			maxStdoutBytes: 1024 * 1024
+		});
+		return {
+			isRepo: true,
+			head: head.code === 0 ? head.stdout.trim() || void 0 : void 0,
+			dirty: status.code === 0 ? status.stdout.trim().length > 0 : void 0
+		};
+	} catch {
+		return { isRepo: false };
+	}
+}
+const _initInFlight = /* @__PURE__ */ new Set();
+/** True iff a background init for this workspace is already in flight. */
+function isInitInFlight(workspace) {
+	return _initInFlight.has(initKey(workspace));
+}
+/** Mark a background init started (debounce). Returns false if already running. */
+function tryClaimInit(workspace) {
+	const k = initKey(workspace);
+	if (_initInFlight.has(k)) return false;
+	_initInFlight.add(k);
+	return true;
+}
+/** Release the debounce claim (call in the init's finally). */
+function releaseInit(workspace) {
+	_initInFlight.delete(initKey(workspace));
+}
+function initKey(workspace) {
+	return `${MODEL_ID}::${canonicalForCompare(workspace)}`;
+}
+
 //#endregion
 //#region src/lib/colbert/runner.ts
 /** Caller responsiveness budget for a search. A warm search is sub-second;
@@ -16726,6 +16849,10 @@ function makeIndexProgressProbe(workspace) {
 * colgrep writer per workspace" goal as the init debounce. Cleared when the
 * detached search completes. */
 const _searchIndexInFlight = /* @__PURE__ */ new Set();
+const _initPromises = /* @__PURE__ */ new Map();
+/** In-flight quarantine deletions, drained by teardown (Windows EBUSY). */
+const _quarantineRemovals = /* @__PURE__ */ new Set();
+let _runManagedExeCapture = runManagedExeCapture;
 /** Build the isolating env for any colgrep child (search or init). */
 function colgrepEnv() {
 	const ortDir = nodePath.dirname(colbertOrtDylibPath());
@@ -16763,6 +16890,7 @@ async function runSemanticSearch(opts) {
 			};
 		case "failed": return handleFailure(workspace, fresh.meta, false);
 		case "crashed": return handleFailure(workspace, fresh.meta, true);
+		case "corrupt": return repairCorruptIndex(workspace, fresh.meta);
 		case "building": return {
 			status: "building",
 			notice: "semantic index is being built for this workspace; retry shortly (or use code_search now)"
@@ -16795,6 +16923,64 @@ async function runSemanticSearch(opts) {
 * by the inactivity watchdog) retries at most once — re-running a hung build
 * usually hangs again; transient classes retry up to `MAX_FAILED_ATTEMPTS`.
 */
+async function quarantineProjectDir(projectDir) {
+	const quarantine = `${projectDir}.corrupt-${process$1.pid}-${randomBytes(4).toString("hex")}`;
+	try {
+		await fs.rename(projectDir, quarantine);
+	} catch (err) {
+		consola.debug("colbert: corrupt index quarantine rename failed:", err);
+		return false;
+	}
+	const removal = fs.rm(quarantine, {
+		recursive: true,
+		force: true
+	}).catch((err) => {
+		consola.debug("colbert: corrupt index quarantine cleanup failed:", err);
+	}).finally(() => {
+		_quarantineRemovals.delete(removal);
+	});
+	_quarantineRemovals.add(removal);
+	return true;
+}
+async function repairCorruptIndex(workspace, meta) {
+	const wsKey = nodePath.resolve(workspace);
+	const attempts = (meta?.failureClass === "corrupt" ? meta.failedAttempts ?? 0 : 0) + 1;
+	const failedMeta = {
+		workspace,
+		model: meta?.model ?? MODEL_ID,
+		modelRev: meta?.modelRev ?? MODEL_REVISION,
+		binarySha: colgrepBinAsset()?.sha256,
+		ortSha: ortLibAsset()?.sha256,
+		status: "failed",
+		failureClass: "corrupt",
+		failedAttempts: attempts,
+		lastIndexedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		lastIndexedHead: meta?.lastIndexedHead,
+		lastIndexedDirty: meta?.lastIndexedDirty,
+		ownerInstanceId: getColbertInstanceUuid()
+	};
+	if (_searchIndexInFlight.has(wsKey) || isInitInFlight(workspace)) return {
+		status: "building",
+		notice: "semantic index was found corrupt but a writer is still active; returned results are disabled until it exits"
+	};
+	const projectDir = await colbertProjectDir(workspace);
+	if (!projectDir) return handleFailure(workspace, failedMeta, false);
+	if (!await quarantineProjectDir(projectDir)) {
+		await writeColbertMeta(failedMeta).catch(() => {});
+		return {
+			status: "failed",
+			isError: true,
+			notice: "semantic index is corrupt but could not be quarantined; returned lexical results — close active colgrep processes and retry"
+		};
+	}
+	await writeColbertMeta(failedMeta).catch(() => {});
+	if (attempts < 2) kickBackgroundInit(workspace);
+	return {
+		status: "failed",
+		isError: true,
+		notice: attempts < 2 ? "semantic index was found corrupt and quarantined; a clean rebuild was started — retry mode:\"semantic\" shortly" : "semantic index repeatedly failed integrity checks; automatic rebuild is capped — do NOT retry mode:\"semantic\", use lexical search with specific symbol/keyword terms and see proxy logs"
+	};
+}
 async function handleFailure(workspace, meta, crashedVerdict) {
 	const cls = crashedVerdict ? "crashed" : meta?.failureClass ?? "error";
 	const attempts = crashedVerdict ? (meta?.failedAttempts ?? 0) + 1 : meta?.failedAttempts ?? 1;
@@ -16811,7 +16997,7 @@ async function handleFailure(workspace, meta, crashedVerdict) {
 		lastIndexedDirty: meta?.lastIndexedDirty,
 		ownerInstanceId: getColbertInstanceUuid()
 	}).catch(() => {});
-	const cap = cls === "stuck" ? 2 : MAX_FAILED_ATTEMPTS;
+	const cap = cls === "stuck" || cls === "corrupt" ? 2 : MAX_FAILED_ATTEMPTS;
 	const lastMs = lastAt ? Date.parse(lastAt) : NaN;
 	const backoffElapsed = !Number.isFinite(lastMs) || Date.now() - lastMs >= FAILED_RETRY_BACKOFF_MS;
 	if (attempts < cap && backoffElapsed) {
@@ -16854,7 +17040,7 @@ async function spawnSearch(opts) {
 		"never",
 		"--force-cpu",
 		"--model",
-		colbertModelDir(),
+		canonicalColbertModelDir(),
 		"-y",
 		"-k",
 		String(opts.limit)
@@ -16869,7 +17055,7 @@ async function spawnSearch(opts) {
 	_searchIndexInFlight.add(wsKey);
 	let searchPromise;
 	try {
-		searchPromise = runManagedExeCapture(binary, args, {
+		searchPromise = _runManagedExeCapture(binary, args, {
 			env: colgrepEnv(),
 			inactivityTimeoutMs: INIT_STALL_MS,
 			onInactivityCheck: makeIndexProgressProbe(opts.workspace),
@@ -16985,14 +17171,24 @@ function buildSnippet(unit) {
 	const sig = typeof unit.signature === "string" ? unit.signature.trim() : "";
 	const code = typeof unit.code === "string" ? unit.code : "";
 	if (!code) return sig;
-	const body = code.split("\n").slice(0, 6).join("\n");
-	const snippet = sig && !body.startsWith(sig) ? `${sig}\n${body}` : body;
+	const lines = code.split("\n");
+	const body = lines.slice(0, 6).join("\n");
+	const firstBodyLine = lines[0]?.trim() ?? "";
+	const snippet = sig && firstBodyLine !== sig ? `${sig}\n${body}` : body;
 	return snippet.length > 600 ? snippet.slice(0, 600) + "…" : snippet;
 }
+function stripExtendedPathPrefix(value) {
+	if (/^\\\\\?\\UNC\\/i.test(value)) return `\\\\${value.slice(8)}`;
+	if (/^\\\\\?\\[a-z]:\\/i.test(value)) return value.slice(4);
+	return value;
+}
 function relativize(file, workspace, workspaceReal) {
-	for (const base of [workspace, workspaceReal]) try {
-		const rel = nodePath.relative(base, file);
-		if (rel && !rel.startsWith("..") && !nodePath.isAbsolute(rel)) return rel;
+	const normalizedFile = stripExtendedPathPrefix(file);
+	for (const rawBase of [workspace, workspaceReal]) try {
+		const base = stripExtendedPathPrefix(rawBase);
+		const flavor = /^[a-z]:[\\/]/i.test(base) || base.startsWith("\\\\") ? nodePath.win32 : nodePath;
+		const rel = flavor.relative(base, normalizedFile);
+		if (rel && !rel.startsWith("..") && !flavor.isAbsolute(rel)) return rel;
 	} catch {}
 	return file;
 }
@@ -17019,9 +17215,31 @@ function clampLimit(limit) {
 function kickBackgroundInit(workspace) {
 	if (isInitInFlight(workspace)) return;
 	if (!tryClaimInit(workspace)) return;
-	runInit(workspace).catch((err) => {
-		consola.debug("colbert: background init failed:", err);
+	const key = nodePath.resolve(workspace);
+	const promise = runInit(workspace).catch(async (err) => {
+		releaseInit(workspace);
+		consola.error("colbert: background init failed:", err);
+		const prior = await readColbertMeta(workspace);
+		await writeColbertMeta({
+			workspace,
+			model: prior?.model ?? MODEL_ID,
+			modelRev: prior?.modelRev ?? MODEL_REVISION,
+			binarySha: colgrepBinAsset()?.sha256,
+			ortSha: ortLibAsset()?.sha256,
+			status: "failed",
+			failureClass: "launch",
+			failedAttempts: (prior?.failedAttempts ?? 0) + 1,
+			lastIndexedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			lastIndexedHead: prior?.lastIndexedHead,
+			lastIndexedDirty: prior?.lastIndexedDirty,
+			ownerInstanceId: getColbertInstanceUuid()
+		}).catch((writeErr) => {
+			consola.error("colbert: failed to record background init failure:", writeErr);
+		});
+	}).finally(() => {
+		_initPromises.delete(key);
 	});
+	_initPromises.set(key, promise);
 }
 /**
 * Whether the STARTUP auto-kick should fire for a workspace. Skips a build
@@ -17034,25 +17252,72 @@ function kickBackgroundInit(workspace) {
 async function startupKickAllowed(workspace) {
 	const meta = await readColbertMeta(workspace);
 	if (!meta || meta.status !== "failed") return true;
-	if ((meta.failedAttempts ?? 0) >= MAX_FAILED_ATTEMPTS) return false;
+	const cap = meta.failureClass === "stuck" || meta.failureClass === "corrupt" ? 2 : MAX_FAILED_ATTEMPTS;
+	if ((meta.failedAttempts ?? 0) >= cap) return false;
 	if (meta.failureClass === "stuck") return false;
 	return true;
 }
+/**
+* Encoding sessions colgrep may run in parallel: 25% of the machine's
+* threads, never fewer than 2.
+*
+* colgrep defaults this to the FULL CPU count, so a background index build
+* saturates the machine — the exact opposite of what a background build
+* should do during an interactive agent session (the proxy even holds a
+* keep-awake assertion so those sessions run long and unattended). The floor
+* of 2 keeps a 1- to 7-thread box from dropping to a single session and
+* taking proportionally forever.
+*
+* Override with `GH_ROUTER_COLBERT_PARALLEL` (a positive integer).
+*/
+function colbertParallelSessions() {
+	const raw = Number(process$1.env.GH_ROUTER_COLBERT_PARALLEL);
+	if (Number.isSafeInteger(raw) && raw > 0) return raw;
+	const threads = os.availableParallelism?.() ?? os.cpus?.().length ?? 4;
+	return Math.max(2, Math.floor(threads * .25));
+}
+/**
+* Persist the parallelism cap into the router-owned colgrep config.
+*
+* `--parallel` exists only on the `settings` subcommand — there is no
+* per-run flag and no env var. It writes `parallel_sessions` to
+* `<COLGREP_DATA_DIR>/../config.json`, which for us is
+* `<APP_DIR>/colbert/config.json`: router-owned, and NOT the user's own
+* colgrep config (verified — after we write ours, a plain `colgrep
+* settings` with no COLGREP_DATA_DIR still reports `auto`).
+*
+* Best-effort: failing here means colgrep encodes at its default (all
+* threads), which is greedy but not incorrect, so it must never block a
+* build.
+*/
+async function applyParallelismCap(binary) {
+	const sessions$1 = colbertParallelSessions();
+	try {
+		await _runManagedExeCapture(binary, [
+			"settings",
+			"--parallel",
+			String(sessions$1)
+		], {
+			env: colgrepEnv(),
+			timeoutMs: 3e4,
+			maxStdoutBytes: MAX_STDOUT_BYTES
+		});
+	} catch (err) {
+		consola.debug("colbert: could not cap colgrep parallelism:", err);
+	}
+}
 async function runInit(workspace) {
 	const binary = colgrepBinaryPath();
-	if (!existsSync(binary)) {
-		releaseInit(workspace);
-		return;
-	}
-	if (!existsSync(colbertOrtDylibPath())) {
-		releaseInit(workspace);
-		return;
-	}
+	if (!existsSync(binary)) throw new Error("colgrep binary is missing");
+	if (!existsSync(colbertOrtDylibPath())) throw new Error("ColBERT ONNX runtime is missing");
+	await applyParallelismCap(binary);
 	const prior = await readColbertMeta(workspace);
 	const baseMeta = {
 		workspace,
 		model: MODEL_ID,
 		modelRev: MODEL_REVISION,
+		binarySha: colgrepBinAsset()?.sha256,
+		ortSha: ortLibAsset()?.sha256,
 		status: "building",
 		buildPid: void 0,
 		ownerInstanceId: getColbertInstanceUuid(),
@@ -17074,7 +17339,7 @@ async function runInit(workspace) {
 		"never",
 		"--force-cpu",
 		"--model",
-		colbertModelDir(),
+		canonicalColbertModelDir(),
 		workspace
 	];
 	const onInactivityCheck = makeIndexProgressProbe(workspace);
@@ -17082,7 +17347,7 @@ async function runInit(workspace) {
 	let ok$3 = false;
 	let failureClass;
 	try {
-		const res = await runManagedExeCapture(binary, args, {
+		const res = await _runManagedExeCapture(binary, args, {
 			env: colgrepEnv(),
 			timeoutMs: INIT_TIMEOUT_MS,
 			inactivityTimeoutMs: INIT_STALL_MS,
@@ -17097,10 +17362,18 @@ async function runInit(workspace) {
 			}
 		});
 		ok$3 = !res.stalled && !res.timedOut && res.code === 0;
-		if (!ok$3) failureClass = res.stalled || res.timedOut ? "stuck" : "error";
-	} catch {
+		if (ok$3) {
+			const projectDir = await colbertProjectDir(workspace);
+			ok$3 = projectDir !== null && validateIndexIntegrity(nodePath.join(projectDir, "index")).verdict === "coherent";
+			if (!ok$3) {
+				failureClass = "corrupt";
+				if (projectDir) await quarantineProjectDir(projectDir);
+			}
+		} else failureClass = res.stalled || res.timedOut ? "stuck" : "error";
+	} catch (err) {
 		ok$3 = false;
 		failureClass = "launch";
+		consola.error("colbert: init failed to launch:", err);
 	} finally {
 		releaseInit(workspace);
 	}
@@ -17203,8 +17476,10 @@ function lexicalSearchCodeMode(mode) {
 * it both levers: retry `mode:"semantic"` shortly (the index is self-healing
 * in the background) OR re-query now with specific symbol/keyword terms.
 */
+const FALLBACK_GUIDANCE_MARKER = "retry mode:\"semantic\"";
+const FALLBACK_GUIDANCE = `${FALLBACK_GUIDANCE_MARKER} shortly, or re-query now with specific symbol/keyword terms`;
 function fallbackNoticeFor(status) {
-	const tail = "retry mode:\"semantic\" shortly, or re-query now with specific symbol/keyword terms";
+	const tail = FALLBACK_GUIDANCE;
 	switch (status) {
 		case "building": return `semantic index is building; returned lexical keyword matches — ${tail}`;
 		case "stale": return `semantic index predates the current HEAD/tree (a background re-index was started); returned lexical keyword matches — ${tail}`;
@@ -17223,6 +17498,38 @@ function joinNotice(primary, secondary) {
 	if (primary && secondary) return `${primary} (${secondary})`;
 	return primary || secondary || void 0;
 }
+/** Preserve runner-specific context while guaranteeing actionable guidance once. */
+function semanticFallbackNotice(sem) {
+	if (!sem.notice) return fallbackNoticeFor(sem.status);
+	if (sem.notice.includes(FALLBACK_GUIDANCE_MARKER)) return sem.notice;
+	return `${sem.notice} — ${FALLBACK_GUIDANCE}`;
+}
+async function outlinesForSemanticResults(input, results, signal) {
+	if (input.summary === false) return void 0;
+	const seen = /* @__PURE__ */ new Set();
+	const files = [];
+	for (const result of results) {
+		if (seen.has(result.file)) continue;
+		seen.add(result.file);
+		files.push(result.file);
+		if (files.length >= 10) break;
+	}
+	const outlines = [];
+	const deadline = Date.now() + 2e3;
+	const workspace = nodePath.resolve(input.workspace);
+	for (const file of files) {
+		if (signal?.aborted || Date.now() > deadline) break;
+		const abs = nodePath.resolve(workspace, file);
+		const rel = nodePath.relative(workspace, abs);
+		if (!rel || rel.startsWith("..") || nodePath.isAbsolute(rel)) continue;
+		const outlined = await outlineFile(abs, signal);
+		outlines.push({
+			file,
+			outline: outlined.outline
+		});
+	}
+	return outlines;
+}
 async function runLexical(input, mode, source, signal) {
 	const isAst = mode === "ast";
 	const resp = await searchCode({
@@ -17284,22 +17591,26 @@ async function runUnifiedCodeSearch(input, signal) {
 			notice: joinNotice(r$1.notice, "semantic search errored; returned lexical results")
 		};
 	}
-	if (sem.status === "ready") return {
-		source: "semantic",
-		results: (sem.results ?? []).map((r$1) => ({
+	if (sem.status === "ready") {
+		const results = (sem.results ?? []).map((r$1) => ({
 			file: r$1.file,
 			line: r$1.line,
 			snippet: r$1.snippet,
 			...r$1.endLine !== void 0 ? { endLine: r$1.endLine } : {},
 			...r$1.name !== void 0 ? { name: r$1.name } : {},
 			...r$1.score !== void 0 ? { score: r$1.score } : {}
-		})),
-		...sem.notice ? { notice: sem.notice } : {}
-	};
+		}));
+		return {
+			source: "semantic",
+			results,
+			outlines: await outlinesForSemanticResults(input, results, signal),
+			...sem.notice ? { notice: sem.notice } : {}
+		};
+	}
 	const r = await runLexical(input, "lexical", "lexical-fallback", signal);
 	return {
 		...r,
-		notice: joinNotice(r.notice, fallbackNoticeFor(sem.status))
+		notice: joinNotice(r.notice, semanticFallbackNotice(sem))
 	};
 }
 
@@ -18495,16 +18806,16 @@ function logAudit$1(record) {
 	if (process.env.GH_ROUTER_LOG_BROWSER_MCP !== "1") return;
 	(async () => {
 		try {
-			const fs$1 = await import("node:fs/promises");
+			const fs$2 = await import("node:fs/promises");
 			const path$1 = await import("node:path");
 			const { PATHS: PATHS$1 } = await import("./paths-B5k78n0d.js");
 			const dir = path$1.join(PATHS$1.APP_DIR, "browser-mcp");
-			await fs$1.mkdir(dir, { recursive: true });
+			await fs$2.mkdir(dir, { recursive: true });
 			const line = JSON.stringify({
 				ts: (/* @__PURE__ */ new Date()).toISOString(),
 				...record
 			}) + "\n";
-			await fs$1.appendFile(path$1.join(dir, "audit.log"), line, "utf8");
+			await fs$2.appendFile(path$1.join(dir, "audit.log"), line, "utf8");
 		} catch {}
 	})();
 }
@@ -21340,58 +21651,6 @@ function registerExitHandlers$1() {
 }
 registerExitHandlers$1();
 
-//#endregion
-//#region src/vendor/pi/ai/api-registry.ts
-const apiProviderRegistry = /* @__PURE__ */ new Map();
-function getApiProvider(api) {
-	return apiProviderRegistry.get(api)?.provider;
-}
-
-//#endregion
-//#region src/vendor/pi/ai/env-api-keys.ts
-let _existsSync = null;
-let _homedir = null;
-let _join = null;
-const dynamicImport = (specifier) => import(specifier);
-const NODE_FS_SPECIFIER = "node:fs";
-const NODE_OS_SPECIFIER = "node:os";
-const NODE_PATH_SPECIFIER = "node:path";
-if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
-	dynamicImport(NODE_FS_SPECIFIER).then((m) => {
-		_existsSync = m.existsSync;
-	});
-	dynamicImport(NODE_OS_SPECIFIER).then((m) => {
-		_homedir = m.homedir;
-	});
-	dynamicImport(NODE_PATH_SPECIFIER).then((m) => {
-		_join = m.join;
-	});
-}
-
-//#endregion
-//#region src/vendor/pi/ai/models.generated.ts
-const MODELS = {};
-
-//#endregion
-//#region src/vendor/pi/ai/models.ts
-const modelRegistry = /* @__PURE__ */ new Map();
-for (const [provider, models] of Object.entries(MODELS)) {
-	const providerModels = /* @__PURE__ */ new Map();
-	for (const [id, model] of Object.entries(models)) providerModels.set(id, model);
-	modelRegistry.set(provider, providerModels);
-}
-
-//#endregion
-//#region src/vendor/pi/ai/stream.ts
-function resolveApiProvider(api) {
-	const provider = getApiProvider(api);
-	if (!provider) throw new Error(`No API provider registered for api: ${api}`);
-	return provider;
-}
-function streamSimple(model, context, options) {
-	return resolveApiProvider(model.api).streamSimple(model, context, options);
-}
-
 //#endregion
 //#region src/vendor/pi/ai/utils/event-stream.ts
 var EventStream = class {
@@ -21453,19 +21712,89 @@ var AssistantMessageEventStream = class extends EventStream {
 	}
 };
 
+//#endregion
+//#region src/vendor/pi/ai/env-api-keys.ts
+let _existsSync = null;
+let _homedir = null;
+let _join = null;
+const dynamicImport = (specifier) => import(specifier);
+const NODE_FS_SPECIFIER = "node:fs";
+const NODE_OS_SPECIFIER = "node:os";
+const NODE_PATH_SPECIFIER = "node:path";
+if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
+	dynamicImport(NODE_FS_SPECIFIER).then((m) => {
+		_existsSync = m.existsSync;
+	});
+	dynamicImport(NODE_OS_SPECIFIER).then((m) => {
+		_homedir = m.homedir;
+	});
+	dynamicImport(NODE_PATH_SPECIFIER).then((m) => {
+		_join = m.join;
+	});
+}
+
+//#endregion
+//#region src/vendor/pi/ai/utils/retry.ts
+function buildProviderErrorPattern(patterns) {
+	return new RegExp(patterns.join("|"), "i");
+}
+const NON_RETRYABLE_PROVIDER_LIMIT_ERROR_PATTERN = buildProviderErrorPattern([
+	"GoUsageLimitError",
+	"FreeUsageLimitError",
+	"Monthly usage limit reached",
+	"available balance",
+	"insufficient_quota",
+	"out of budget",
+	"quota exceeded",
+	"billing"
+]);
+const RETRYABLE_PROVIDER_ERROR_PATTERN = buildProviderErrorPattern([
+	"overloaded",
+	"rate.?limit",
+	"too many requests",
+	"429",
+	"500",
+	"502",
+	"503",
+	"504",
+	"524",
+	"service.?unavailable",
+	"server.?error",
+	"internal.?error",
+	"provider.?returned.?error",
+	"network.?error",
+	"connection.?error",
+	"connection.?refused",
+	"connection.?lost",
+	"other side closed",
+	"fetch failed",
+	"getaddrinfo",
+	"ENOTFOUND",
+	"EAI_AGAIN",
+	"upstream.?connect",
+	"reset before headers",
+	"socket hang up",
+	"socket connection was closed",
+	"timed? out",
+	"timeout",
+	"terminated",
+	"websocket.?closed",
+	"websocket.?error",
+	"ended without",
+	"stream ended before message_stop",
+	"stream ended before a terminal response event",
+	"http2 request did not get a response",
+	"retry delay",
+	"you can retry your request",
+	"try your request again",
+	"please retry your request",
+	"ResourceExhausted"
+]);
+
 //#endregion
 //#region src/vendor/pi/ai/utils/validation.ts
 const validatorCache = /* @__PURE__ */ new WeakMap();
 const TYPEBOX_KIND = Symbol.for("TypeBox.Kind");
-function isRecord(value) {
-	return typeof value === "object" && value !== null;
-}
-function isJsonSchemaObject(value) {
-	return isRecord(value);
-}
-function hasTypeBoxMetadata(schema) {
-	return isRecord(schema) && Object.getOwnPropertySymbols(schema).includes(TYPEBOX_KIND);
-}
 function getSchemaTypes(schema) {
 	if (typeof schema.type === "string") return [schema.type];
 	if (Array.isArray(schema.type)) return schema.type.filter((type) => typeof type === "string");
@@ -21479,15 +21808,11 @@ function matchesJsonType(value, type) {
 		case "string": return typeof value === "string";
 		case "null": return value === null;
 		case "array": return Array.isArray(value);
-		case "object": return isRecord(value) && !Array.isArray(value);
+		case "object": return typeof value === "object" && value !== null && !Array.isArray(value);
 		default: return false;
 	}
 }
-function isValidatorSchema(value) {
-	return isRecord(value);
-}
 function getSubSchemaValidator(schema) {
-	if (!isValidatorSchema(schema)) return;
 	try {
 		return getValidator(schema);
 	} catch {
@@ -21540,7 +21865,7 @@ function applySchemaObjectCoercion(value, schema) {
 		if (!(key in value)) continue;
 		value[key] = coerceWithJsonSchema(value[key], propertySchema);
 	}
-	if (schema.additionalProperties && isJsonSchemaObject(schema.additionalProperties)) for (const [key, propertyValue] of Object.entries(value)) {
+	if (schema.additionalProperties && typeof schema.additionalProperties === "object") for (const [key, propertyValue] of Object.entries(value)) {
 		if (definedKeys.has(key)) continue;
 		value[key] = coerceWithJsonSchema(propertyValue, schema.additionalProperties);
 	}
@@ -21554,7 +21879,7 @@ function applySchemaArrayCoercion(value, schema) {
 		}
 		return;
 	}
-	if (isJsonSchemaObject(schema.items)) for (let index = 0; index < value.length; index++) value[index] = coerceWithJsonSchema(value[index], schema.items);
+	if (schema.items && typeof schema.items === "object") for (let index = 0; index < value.length; index++) value[index] = coerceWithJsonSchema(value[index], schema.items);
 }
 function coerceWithUnionSchema(value, schemas) {
 	for (const schema of schemas) {
@@ -21577,7 +21902,7 @@ function coerceWithJsonSchema(value, schema) {
 			break;
 		}
 	}
-	if (schemaTypes.includes("object") && isRecord(nextValue) && !Array.isArray(nextValue)) applySchemaObjectCoercion(nextValue, schema);
+	if (schemaTypes.includes("object") && typeof nextValue === "object" && nextValue !== null && !Array.isArray(nextValue)) applySchemaObjectCoercion(nextValue, schema);
 	if (schemaTypes.includes("array") && Array.isArray(nextValue)) applySchemaArrayCoercion(nextValue, schema);
 	return nextValue;
 }
@@ -21610,9 +21935,9 @@ function validateToolArguments(tool$1, toolCall) {
 	const args = structuredClone(toolCall.arguments);
 	Value.Convert(tool$1.parameters, args);
 	const validator = getValidator(tool$1.parameters);
-	if (!hasTypeBoxMetadata(tool$1.parameters) && isJsonSchemaObject(tool$1.parameters)) {
+	if (!Object.getOwnPropertySymbols(tool$1.parameters).includes(TYPEBOX_KIND)) {
 		const coerced = coerceWithJsonSchema(args, tool$1.parameters);
-		if (coerced !== args) if (isRecord(args) && isRecord(coerced)) {
+		if (coerced !== args) if (typeof args === "object" && args !== null && typeof coerced === "object" && coerced !== null) {
 			for (const key of Object.keys(args)) delete args[key];
 			Object.assign(args, coerced);
 		} else return validator.Check(coerced) ? coerced : args;
@@ -21623,6 +21948,14 @@ function validateToolArguments(tool$1, toolCall) {
 	throw new Error(errorMessage);
 }
 
+//#endregion
+//#region src/vendor/pi/agent/stream-fn.ts
+let defaultStreamFn;
+function getDefaultStreamFn() {
+	if (!defaultStreamFn) throw new Error("No default stream function configured. Pass streamFn explicitly or call setDefaultStreamFn().");
+	return defaultStreamFn;
+}
+
 //#endregion
 //#region src/vendor/pi/agent/agent-loop.ts
 async function runAgentLoop(prompts, context, config, emit, signal, streamFn) {
@@ -21643,7 +21976,7 @@ async function runAgentLoop(prompts, context, config, emit, signal, streamFn) {
 			message: prompt
 		});
 	}
-	await runLoop(currentContext, newMessages, config, signal, emit, streamFn);
+	await runLoop(currentContext, newMessages, config, signal, emit, streamFn ?? getDefaultStreamFn());
 	return newMessages;
 }
 async function runAgentLoopContinue(context, config, emit, signal, streamFn) {
@@ -21653,13 +21986,13 @@ async function runAgentLoopContinue(context, config, emit, signal, streamFn) {
 	const currentContext = { ...context };
 	await emit({ type: "agent_start" });
 	await emit({ type: "turn_start" });
-	await runLoop(currentContext, newMessages, config, signal, emit, streamFn);
+	await runLoop(currentContext, newMessages, config, signal, emit, streamFn ?? getDefaultStreamFn());
 	return newMessages;
 }
 /**
 * Main loop logic shared by agentLoop and agentLoopContinue.
 */
-async function runLoop(initialContext, newMessages, initialConfig, signal, emit, streamFn) {
+async function runLoop(initialContext, newMessages, initialConfig, signal, emit, streamFunction) {
 	let currentContext = initialContext;
 	let config = initialConfig;
 	let firstTurn = true;
@@ -21684,7 +22017,7 @@ async function runLoop(initialContext, newMessages, initialConfig, signal, emit,
 				}
 				pendingMessages = [];
 			}
-			const message = await streamAssistantResponse(currentContext, config, signal, emit, streamFn);
+			const message = await streamAssistantResponse(currentContext, config, signal, emit, streamFunction);
 			newMessages.push(message);
 			if (message.stopReason === "error" || message.stopReason === "aborted") {
 				await emit({
@@ -21702,7 +22035,7 @@ async function runLoop(initialContext, newMessages, initialConfig, signal, emit,
 			const toolResults = [];
 			hasMoreToolCalls = false;
 			if (toolCalls.length > 0) {
-				const executedToolBatch = await executeToolCalls(currentContext, message, config, signal, emit);
+				const executedToolBatch = message.stopReason === "length" ? await failToolCallsFromTruncatedMessage(toolCalls, emit) : await executeToolCalls(currentContext, message, config, signal, emit);
 				toolResults.push(...executedToolBatch.messages);
 				hasMoreToolCalls = !executedToolBatch.terminate;
 				for (const result of toolResults) {
@@ -21760,7 +22093,7 @@ async function runLoop(initialContext, newMessages, initialConfig, signal, emit,
 * Stream an assistant response from the LLM.
 * This is where AgentMessage[] gets transformed to Message[] for the LLM.
 */
-async function streamAssistantResponse(context, config, signal, emit, streamFn) {
+async function streamAssistantResponse(context, config, signal, emit, streamFunction) {
 	let messages = context.messages;
 	if (config.transformContext) messages = await config.transformContext(messages, signal);
 	const llmMessages = await config.convertToLlm(messages);
@@ -21769,7 +22102,6 @@ async function streamAssistantResponse(context, config, signal, emit, streamFn)
 		messages: llmMessages,
 		tools: context.tools
 	};
-	const streamFunction = streamFn || streamSimple;
 	const resolvedApiKey = (config.getApiKey ? await config.getApiKey(config.model.provider) : void 0) || config.apiKey;
 	const response = await streamFunction(config.model, llmContext, {
 		...config,
@@ -21839,6 +22171,37 @@ async function streamAssistantResponse(context, config, signal, emit, streamFn)
 	return finalMessage;
 }
 /**
+* Fail all tool calls from an assistant message that was truncated by the
+* output token limit. Streamed tool-call arguments are finalized with a
+* best-effort JSON salvage parser, so a truncated message can yield tool calls
+* whose arguments parse and validate but are silently incomplete. None of them
+* are safe to execute; report each as an error so the model can re-issue them.
+*/
+async function failToolCallsFromTruncatedMessage(toolCalls, emit) {
+	const messages = [];
+	for (const toolCall of toolCalls) {
+		await emit({
+			type: "tool_execution_start",
+			toolCallId: toolCall.id,
+			toolName: toolCall.name,
+			args: toolCall.arguments
+		});
+		const finalized = {
+			toolCall,
+			result: createErrorToolResult(`Tool call "${toolCall.name}" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments.`),
+			isError: true
+		};
+		await emitToolExecutionEnd(finalized, emit);
+		const toolResultMessage = createToolResultMessage(finalized);
+		await emitToolResultMessage(toolResultMessage, emit);
+		messages.push(toolResultMessage);
+	}
+	return {
+		messages,
+		terminate: false
+	};
+}
+/**
 * Execute tool calls from an assistant message.
 */
 async function executeToolCalls(currentContext, assistantMessage, config, signal, emit) {
@@ -21977,8 +22340,10 @@ async function prepareToolCall(currentContext, assistantMessage, toolCall, confi
 }
 async function executePreparedToolCall(prepared, signal, emit) {
 	const updateEvents = [];
+	let acceptingUpdates = true;
 	try {
 		const result = await prepared.tool.execute(prepared.toolCall.id, prepared.args, signal, (partialResult) => {
+			if (!acceptingUpdates) return;
 			updateEvents.push(Promise.resolve(emit({
 				type: "tool_execution_update",
 				toolCallId: prepared.toolCall.id,
@@ -21987,17 +22352,21 @@ async function executePreparedToolCall(prepared, signal, emit) {
 				partialResult
 			})));
 		});
+		acceptingUpdates = false;
 		await Promise.all(updateEvents);
 		return {
 			result,
 			isError: false
 		};
 	} catch (error) {
+		acceptingUpdates = false;
 		await Promise.all(updateEvents);
 		return {
 			result: createErrorToolResult(error instanceof Error ? error.message : String(error)),
 			isError: true
 		};
+	} finally {
+		acceptingUpdates = false;
 	}
 }
 async function finalizeExecutedToolCall(currentContext, assistantMessage, prepared, executed, config, signal) {
@@ -22014,8 +22383,10 @@ async function finalizeExecutedToolCall(currentContext, assistantMessage, prepar
 		}, signal);
 		if (afterResult) {
 			result = {
+				...result,
 				content: afterResult.content ?? result.content,
 				details: afterResult.details ?? result.details,
+				usage: afterResult.usage ?? result.usage,
 				terminate: afterResult.terminate ?? result.terminate
 			};
 			isError = afterResult.isError ?? isError;
@@ -22053,8 +22424,10 @@ function createToolResultMessage(finalized) {
 		role: "toolResult",
 		toolCallId: finalized.toolCall.id,
 		toolName: finalized.toolCall.name,
-		content: finalized.result.content,
+		content: finalized.result.content ?? [],
 		details: finalized.result.details,
+		usage: finalized.result.usage,
+		...finalized.result.addedToolNames?.length ? { addedToolNames: finalized.result.addedToolNames } : {},
 		isError: finalized.isError,
 		timestamp: Date.now()
 	};
@@ -22171,13 +22544,15 @@ var Agent$1 = class {
 	followUpQueue;
 	convertToLlm;
 	transformContext;
-	streamFn;
+	streamFunction;
 	getApiKey;
 	onPayload;
 	onResponse;
 	beforeToolCall;
 	afterToolCall;
+	shouldStopAfterTurn;
 	prepareNextTurn;
+	prepareNextTurnWithContext;
 	activeRun;
 	/** Session identifier forwarded to providers for cache-aware backends. */
 	sessionId;
@@ -22189,24 +22564,27 @@ var Agent$1 = class {
 	maxRetryDelayMs;
 	/** Tool execution strategy for assistant messages that contain multiple tool calls. */
 	toolExecution;
-	constructor(options = {}) {
-		this._state = createMutableAgentState(options.initialState);
-		this.convertToLlm = options.convertToLlm ?? defaultConvertToLlm;
-		this.transformContext = options.transformContext;
-		this.streamFn = options.streamFn ?? streamSimple;
-		this.getApiKey = options.getApiKey;
-		this.onPayload = options.onPayload;
-		this.onResponse = options.onResponse;
-		this.beforeToolCall = options.beforeToolCall;
-		this.afterToolCall = options.afterToolCall;
-		this.prepareNextTurn = options.prepareNextTurn;
-		this.steeringQueue = new PendingMessageQueue(options.steeringMode ?? "one-at-a-time");
-		this.followUpQueue = new PendingMessageQueue(options.followUpMode ?? "one-at-a-time");
-		this.sessionId = options.sessionId;
-		this.thinkingBudgets = options.thinkingBudgets;
-		this.transport = options.transport ?? "auto";
-		this.maxRetryDelayMs = options.maxRetryDelayMs;
-		this.toolExecution = options.toolExecution ?? "parallel";
+	constructor(options) {
+		const runtimeOptions = options ?? {};
+		this._state = createMutableAgentState(runtimeOptions.initialState);
+		this.convertToLlm = runtimeOptions.convertToLlm ?? defaultConvertToLlm;
+		this.transformContext = runtimeOptions.transformContext;
+		this.streamFunction = runtimeOptions.streamFn ?? getDefaultStreamFn();
+		this.getApiKey = runtimeOptions.getApiKey;
+		this.onPayload = runtimeOptions.onPayload;
+		this.onResponse = runtimeOptions.onResponse;
+		this.beforeToolCall = runtimeOptions.beforeToolCall;
+		this.afterToolCall = runtimeOptions.afterToolCall;
+		this.shouldStopAfterTurn = runtimeOptions.shouldStopAfterTurn;
+		this.prepareNextTurn = runtimeOptions.prepareNextTurn;
+		this.prepareNextTurnWithContext = runtimeOptions.prepareNextTurnWithContext;
+		this.steeringQueue = new PendingMessageQueue(runtimeOptions.steeringMode ?? "one-at-a-time");
+		this.followUpQueue = new PendingMessageQueue(runtimeOptions.followUpMode ?? "one-at-a-time");
+		this.sessionId = runtimeOptions.sessionId;
+		this.thinkingBudgets = runtimeOptions.thinkingBudgets;
+		this.transport = runtimeOptions.transport ?? "auto";
+		this.maxRetryDelayMs = runtimeOptions.maxRetryDelayMs;
+		this.toolExecution = runtimeOptions.toolExecution ?? "parallel";
 	}
 	/**
 	* Subscribe to agent lifecycle events.
@@ -22336,12 +22714,12 @@ var Agent$1 = class {
 	}
 	async runPromptMessages(messages, options = {}) {
 		await this.runWithLifecycle(async (signal) => {
-			await runAgentLoop(messages, this.createContextSnapshot(), this.createLoopConfig(options), (event) => this.processEvents(event), signal, this.streamFn);
+			await runAgentLoop(messages, this.createContextSnapshot(), this.createLoopConfig(options), (event) => this.processEvents(event), signal, this.streamFunction);
 		});
 	}
 	async runContinuation() {
 		await this.runWithLifecycle(async (signal) => {
-			await runAgentLoopContinue(this.createContextSnapshot(), this.createLoopConfig(), (event) => this.processEvents(event), signal, this.streamFn);
+			await runAgentLoopContinue(this.createContextSnapshot(), this.createLoopConfig(), (event) => this.processEvents(event), signal, this.streamFunction);
 		});
 	}
 	createContextSnapshot() {
@@ -22365,7 +22743,11 @@ var Agent$1 = class {
 			toolExecution: this.toolExecution,
 			beforeToolCall: this.beforeToolCall,
 			afterToolCall: this.afterToolCall,
-			prepareNextTurn: this.prepareNextTurn ? async () => await this.prepareNextTurn?.(this.signal) : void 0,
+			shouldStopAfterTurn: this.shouldStopAfterTurn,
+			prepareNextTurn: this.prepareNextTurnWithContext || this.prepareNextTurn ? async (context) => {
+				if (this.prepareNextTurnWithContext) return await this.prepareNextTurnWithContext(context, this.signal);
+				return await this.prepareNextTurn?.(this.signal);
+			} : void 0,
 			convertToLlm: this.convertToLlm,
 			transformContext: this.transformContext,
 			getApiKey: this.getApiKey,
@@ -22490,28 +22872,49 @@ var Agent$1 = class {
 const DEFAULT_MAX_BYTES = 50 * 1024;
 const runtimeBuffer = globalThis.Buffer;
 
+//#endregion
+//#region src/vendor/pi/agent/harness/tools/bash.ts
+const MAX_TIMEOUT_SECONDS = 2147483647 / 1e3;
+const bashSchema = Type.Object({
+	command: Type.String({ description: "Bash command to execute" }),
+	timeout: Type.Optional(Type.Number({ description: "Timeout in seconds (optional, no default timeout)" }))
+});
+
+//#endregion
+//#region src/vendor/pi/agent/harness/tools/edit.ts
+const replaceEditSchema = Type.Object({
+	oldText: Type.String({ description: "Exact text for one targeted replacement. It must be unique in the original file and must not overlap with any other edits[].oldText in the same call." }),
+	newText: Type.String({ description: "Replacement text for this targeted edit." })
+}, {});
+const editSchema = Type.Object({
+	path: Type.String({ description: "Path to the file to edit (relative or absolute)" }),
+	edits: Type.Array(replaceEditSchema, { description: "One or more targeted replacements. Each edit is matched against the original file, not incrementally. Do not include overlapping or nested edits. If two changes touch the same block or nearby lines, merge them into one edit instead." })
+}, {});
+
+//#endregion
+//#region src/vendor/pi/agent/harness/tools/read.ts
+const readSchema = Type.Object({
+	path: Type.String({ description: "Path to the file to read (relative or absolute)" }),
+	offset: Type.Optional(Type.Number({ description: "Line number to start reading from (1-indexed)" })),
+	limit: Type.Optional(Type.Number({ description: "Maximum number of lines to read" }))
+});
+
+//#endregion
+//#region src/vendor/pi/agent/harness/tools/write.ts
+const writeSchema = Type.Object({
+	path: Type.String({ description: "Path to the file to write (relative or absolute)" }),
+	content: Type.String({ description: "Content to write to the file" })
+});
+
 //#endregion
 //#region src/lib/worker-agent/budget.ts
 const DEFAULT_MAX_TURNS = 500;
 const DEFAULT_MAX_WALLCLOCK_MS = 360 * 6e4;
+const DEFAULT_MODEL_CALL_TIMEOUT_MS = 15 * 6e4;
 const DEFAULT_MAX_TOOL_BYTES = 16 * 1024 * 1024;
 const DEFAULT_MAX_TOOL_CALLS = 250;
 const DEFAULT_MAX_REPEATED_CALLS = 3;
 /**
-* Thrown when the wall-clock budget is exceeded. Engine catches this
-* around `agent.prompt()` / `agent.continue()` and converts it to a
-* terse `[halted: wallclock]` reply. Carries no extra metadata — by
-* design (no advice).
-*/
-var WorkerAbort = class extends Error {
-	reason;
-	constructor(reason) {
-		super(`[halted: ${reason}]`);
-		this.reason = reason;
-		this.name = "WorkerAbort";
-	}
-};
-/**
 * Read a positive-integer env override. Returns `undefined` if the
 * env var is unset, empty, or doesn't parse to a positive integer —
 * keeping the constructor defaults intact. We don't throw on bad input
@@ -22540,6 +22943,8 @@ const DEFAULT_MCP_TOOL_TIMEOUT_MS = 225e5;
 * hard-killed by the harness.
 */
 const MCP_TIMEOUT_HEADROOM_MS = 15 * 6e4;
+/** Smallest useful worker deadline when the MCP timeout is misconfigured below headroom. */
+const MIN_WORKER_WALLCLOCK_MS = 1e3;
 /**
 * The MCP per-tool-call timeout the proxy injects into the spawned CLI, in ms.
 * Positive-integer override via `GH_ROUTER_MCP_TOOL_TIMEOUT_MS`; falls back to
@@ -22551,6 +22956,10 @@ const MCP_TIMEOUT_HEADROOM_MS = 15 * 6e4;
 function resolveMcpToolTimeoutMs() {
 	return envInt("GH_ROUTER_MCP_TOOL_TIMEOUT_MS") ?? DEFAULT_MCP_TOOL_TIMEOUT_MS;
 }
+/** Whole-call deadline for one worker model turn, including SSE consumption. */
+function resolveWorkerModelCallTimeoutMs() {
+	return envInt("GH_ROUTER_WORKER_MODEL_CALL_TIMEOUT_MS") ?? DEFAULT_MODEL_CALL_TIMEOUT_MS;
+}
 /**
 * The maximum wall-clock a single worker call may be granted: the MCP
 * tool-call timeout minus the teardown headroom. A per-call `maxWallClockMs`
@@ -22560,7 +22969,7 @@ function resolveMcpToolTimeoutMs() {
 * the default MCP timeout (22_500_000 − 900_000 === 21_600_000).
 */
 function workerWallClockCeilingMs() {
-	return resolveMcpToolTimeoutMs() - MCP_TIMEOUT_HEADROOM_MS;
+	return Math.max(MIN_WORKER_WALLCLOCK_MS, resolveMcpToolTimeoutMs() - MCP_TIMEOUT_HEADROOM_MS);
 }
 /**
 * Resolve a `BudgetConfig` from defaults + env overrides + caller-
@@ -22570,13 +22979,14 @@ function workerWallClockCeilingMs() {
 * can introspect the merged config without spinning up the `Budget`
 * class.
 */
-function resolveBudgetConfig(overrides) {
+function resolveBudgetConfig(overrides$1) {
+	const requestedWallClockMs = overrides$1?.maxWallClockMs ?? envInt("GH_ROUTER_WORKER_MAX_WALLCLOCK_MS") ?? DEFAULT_MAX_WALLCLOCK_MS;
 	return {
-		maxTurns: overrides?.maxTurns ?? envInt("GH_ROUTER_WORKER_MAX_TURNS") ?? DEFAULT_MAX_TURNS,
-		maxWallClockMs: overrides?.maxWallClockMs ?? envInt("GH_ROUTER_WORKER_MAX_WALLCLOCK_MS") ?? DEFAULT_MAX_WALLCLOCK_MS,
-		maxToolBytes: overrides?.maxToolBytes ?? envInt("GH_ROUTER_WORKER_MAX_TOOL_BYTES") ?? DEFAULT_MAX_TOOL_BYTES,
-		maxToolCalls: overrides?.maxToolCalls ?? envInt("GH_ROUTER_WORKER_MAX_TOOL_CALLS") ?? DEFAULT_MAX_TOOL_CALLS,
-		maxRepeatedCalls: overrides?.maxRepeatedCalls ?? envInt("GH_ROUTER_WORKER_MAX_REPEATED_CALLS") ?? DEFAULT_MAX_REPEATED_CALLS
+		maxTurns: overrides$1?.maxTurns ?? envInt("GH_ROUTER_WORKER_MAX_TURNS") ?? DEFAULT_MAX_TURNS,
+		maxWallClockMs: Math.min(requestedWallClockMs, workerWallClockCeilingMs()),
+		maxToolBytes: overrides$1?.maxToolBytes ?? envInt("GH_ROUTER_WORKER_MAX_TOOL_BYTES") ?? DEFAULT_MAX_TOOL_BYTES,
+		maxToolCalls: overrides$1?.maxToolCalls ?? envInt("GH_ROUTER_WORKER_MAX_TOOL_CALLS") ?? DEFAULT_MAX_TOOL_CALLS,
+		maxRepeatedCalls: overrides$1?.maxRepeatedCalls ?? envInt("GH_ROUTER_WORKER_MAX_REPEATED_CALLS") ?? DEFAULT_MAX_REPEATED_CALLS
 	};
 }
 /**
@@ -22588,11 +22998,10 @@ function resolveBudgetConfig(overrides) {
 *   - `checkBeforeCall(name, args)` is called from Pi's
 *     `beforeToolCall` hook. Returns `{block: true, reason: "[halted:
 *     turns]"}` etc. when a cap fires.
-*   - `recordToolBytes(result)` is called from Pi's `afterToolCall`
-*     hook.
-*   - `checkWallClock()` is called by the engine around blocking
-*     awaits and from `beforeToolCall` — throws `WorkerAbort` when
-*     `Date.now() - startMs > maxWallClockMs`.
+*   - `recordToolBytes(result)` is called from Pi's `afterToolCall` hook.
+*   - A hard cap latches `hardStopReason`; the engine's
+*     `shouldStopAfterTurn` hook reads it and ends the loop before another
+*     provider request. The repeated-call guard remains a non-terminal block.
 */
 var Budget = class {
 	config;
@@ -22600,10 +23009,11 @@ var Budget = class {
 	turnCount = 0;
 	toolBytes = 0;
 	toolCallCount = 0;
+	hardStopReasonValue = null;
 	lastCallKey = null;
 	consecutiveRepeats = 0;
-	constructor(overrides) {
-		this.config = resolveBudgetConfig(overrides);
+	constructor(overrides$1) {
+		this.config = resolveBudgetConfig(overrides$1);
 		this.startMs = Date.now();
 	}
 	/** Record a turn. Does NOT throw — `checkBeforeCall` surfaces the cap. */
@@ -22622,16 +23032,16 @@ var Budget = class {
 	get elapsedMs() {
 		return Date.now() - this.startMs;
 	}
-	/**
-	* Throw `WorkerAbort("wallclock")` if elapsed time exceeds
-	* `maxWallClockMs`. Engine wraps long awaits in `await
-	* Promise.race([..., wallClockTimer])` for prompt cancellation; this
-	* is the fallback for cases where the timer hasn't fired yet but a
-	* call site wants to be sure (e.g. before sending the next LLM
-	* request).
-	*/
-	checkWallClock() {
-		if (this.elapsedMs > this.config.maxWallClockMs) throw new WorkerAbort("wallclock");
+	/** First hard cap reached during this run, or null while work may continue. */
+	get hardStopReason() {
+		return this.hardStopReasonValue;
+	}
+	halt(reason) {
+		this.hardStopReasonValue ??= reason;
+		return {
+			block: true,
+			reason: `[halted: ${reason}]`
+		};
 	}
 	/**
 	* Pi `beforeToolCall` integration. Returns `{block: true, reason}`
@@ -22650,23 +23060,12 @@ var Budget = class {
 	* signature in Pi without forcing the engine into a wrapper.
 	*/
 	checkBeforeCall(toolName, args) {
-		if (this.turnCount > this.config.maxTurns) return {
-			block: true,
-			reason: "[halted: turns]"
-		};
-		if (this.elapsedMs > this.config.maxWallClockMs) return {
-			block: true,
-			reason: "[halted: wallclock]"
-		};
-		if (this.toolBytes > this.config.maxToolBytes) return {
-			block: true,
-			reason: "[halted: tool-bytes]"
-		};
+		if (this.hardStopReasonValue) return this.halt(this.hardStopReasonValue);
+		if (this.turnCount > this.config.maxTurns) return this.halt("turns");
+		if (this.elapsedMs > this.config.maxWallClockMs) return this.halt("wallclock");
+		if (this.toolBytes > this.config.maxToolBytes) return this.halt("tool-bytes");
 		this.toolCallCount += 1;
-		if (this.toolCallCount > this.config.maxToolCalls) return {
-			block: true,
-			reason: "[halted: tool-calls]"
-		};
+		if (this.toolCallCount > this.config.maxToolCalls) return this.halt("tool-calls");
 		const key = `${toolName}:${stableArgs(args)}`;
 		if (key === this.lastCallKey) this.consecutiveRepeats += 1;
 		else {
@@ -22735,14 +23134,15 @@ function extractTextByteLength(result) {
 * the clamp logic. Lower index = less thinking. `"off"` is below
 * everything; `"xhigh"` is the cap.
 */
-const THINKING_ORDER = [
+const WORKER_THINKING_LEVELS = Object.freeze([
 	"off",
 	"minimal",
 	"low",
 	"medium",
 	"high",
 	"xhigh"
-];
+]);
+const THINKING_ORDER = WORKER_THINKING_LEVELS;
 function tier(level) {
 	const i = THINKING_ORDER.indexOf(level);
 	return i < 0 ? THINKING_ORDER.indexOf("high") : i;
@@ -22784,13 +23184,7 @@ function resolveModelAndThinking(opts) {
 	});
 	const allowedRaw = found.capabilities?.supports?.reasoning_effort;
 	if (!allowedRaw || allowedRaw.length === 0) return mkOk("off");
-	const allowed = allowedRaw.filter((l) => [
-		"minimal",
-		"low",
-		"medium",
-		"high",
-		"xhigh"
-	].includes(l)).sort((a, b) => tier(a) - tier(b));
+	const allowed = allowedRaw.filter((l) => WORKER_THINKING_LEVELS.includes(l) && l !== "off").sort((a, b) => tier(a) - tier(b));
 	if (allowed.length === 0) return mkOk("off");
 	if (opts.thinking === "off") return mkOk("off");
 	if (allowed.includes(opts.thinking)) return mkOk(opts.thinking);
@@ -22804,6 +23198,40 @@ function resolveModelAndThinking(opts) {
 	return mkOk(clamp$1);
 }
 
+//#endregion
+//#region src/lib/worker-agent/session-defaults.ts
+const MODES = Object.freeze([
+	"explore",
+	"review",
+	"plan",
+	"implement",
+	"test",
+	"browse"
+]);
+/**
+* Process-global, in-memory overrides. They are intentionally not persisted.
+* In `serve` mode one process may serve multiple client sessions, so these
+* values are process-wide rather than isolated to an individual client.
+*/
+const overrides = {};
+function getWorkerSessionDefault(mode) {
+	return { ...overrides[mode] };
+}
+function setWorkerSessionDefault(mode, value) {
+	const next = { ...overrides[mode] };
+	if (value.model !== void 0) next.model = value.model;
+	if (value.thinking !== void 0) next.thinking = value.thinking;
+	overrides[mode] = next;
+	return { ...next };
+}
+function resetWorkerSessionDefault(mode) {
+	delete overrides[mode];
+}
+function resetAllWorkerSessionDefaults() {
+	for (const mode of MODES) delete overrides[mode];
+}
+const WORKER_MODES = MODES;
+
 //#endregion
 //#region src/lib/worker-agent/prompts.ts
 /**
@@ -23220,6 +23648,13 @@ function assembleResponsesPayload(opts) {
 */
 /** Conservative bytes/token for dense DOM-JSON; over-counts tokens by design. */
 const BYTES_PER_TOKEN = 3;
+/**
+* Conservative context floor when the live catalog omits or reports an invalid window.
+* This is deliberately not a hardcoded per-model window table: duplicating the
+* live catalog would go stale on every model launch and violate the rule to
+* gate on catalog capabilities rather than model slugs.
+*/
+const FALLBACK_WINDOW_TOKENS = 128e3;
 const OUTPUT_RESERVE_TOKENS = 12e3;
 const TOOL_SCHEMA_RESERVE_TOKENS = 6e3;
 const SYSTEM_RESERVE_TOKENS = 2e3;
@@ -23253,17 +23688,19 @@ function tokensFromBytes(bytes) {
 /**
 * Build a per-run budget from the model's catalog context window (tokens).
 *
-* Returns `undefined` when the window is unknown / non-positive — callers
-* MUST no-op (no compaction, no dynamic cap) rather than prune blindly
-* against a guessed window. This is the safe degradation on a catalog that
-* doesn't report `max_context_window_tokens`.
+* Unknown, non-finite, and non-positive windows use the conservative fallback
+* floor so compaction and the dynamic result cap remain engaged. The returned
+* `windowKnown` flag keeps the request backstop advisory in that case: upstream
+* remains authoritative when the model's real window is unknown.
 */
 function makeContextBudget(windowTokens) {
-	if (windowTokens === void 0 || !Number.isFinite(windowTokens) || windowTokens <= 0) return;
-	const inputHardLimitTokens = Math.max(0, Math.floor(windowTokens * (1 - ASSEMBLY_MARGIN_FRACTION)) - OUTPUT_RESERVE_TOKENS);
+	const windowKnown = windowTokens !== void 0 && Number.isFinite(windowTokens) && windowTokens > 0;
+	const effectiveWindowTokens = windowKnown ? windowTokens : FALLBACK_WINDOW_TOKENS;
+	const inputHardLimitTokens = Math.max(0, Math.floor(effectiveWindowTokens * (1 - ASSEMBLY_MARGIN_FRACTION)) - OUTPUT_RESERVE_TOKENS);
 	const promptBudgetTokens = Math.max(0, inputHardLimitTokens - TOOL_SCHEMA_RESERVE_TOKENS - SYSTEM_RESERVE_TOKENS);
 	return {
-		windowTokens,
+		windowKnown,
+		windowTokens: effectiveWindowTokens,
 		inputHardLimitTokens,
 		promptBudgetTokens,
 		compactTriggerTokens: Math.floor(promptBudgetTokens * COMPACT_TRIGGER_FRACTION),
@@ -23271,7 +23708,7 @@ function makeContextBudget(windowTokens) {
 		hardLimitTokens: Math.floor(promptBudgetTokens * HARD_LIMIT_FRACTION),
 		keepRecentTokens: Math.max(KEEP_RECENT_FLOOR_TOKENS, Math.floor(promptBudgetTokens * KEEP_RECENT_FRACTION)),
 		maxProtectedTokens: Math.max(Math.max(KEEP_RECENT_FLOOR_TOKENS, Math.floor(promptBudgetTokens * KEEP_RECENT_FRACTION)), Math.floor(promptBudgetTokens * MAX_PROTECTED_FRACTION)),
-		perResultCapBytes: clamp(Math.round(windowTokens * PER_RESULT_CAP_FRACTION * BYTES_PER_TOKEN), PER_RESULT_CAP_MIN_BYTES, PER_RESULT_CAP_MAX_BYTES)
+		perResultCapBytes: clamp(Math.round(effectiveWindowTokens * PER_RESULT_CAP_FRACTION * BYTES_PER_TOKEN), PER_RESULT_CAP_MIN_BYTES, PER_RESULT_CAP_MAX_BYTES)
 	};
 }
 
@@ -23294,11 +23731,52 @@ function createCopilotStreamFn(opts) {
 		return stream;
 	};
 }
+async function runModelCallAttempts(stream, resolved, options, timeoutMs, runAttempt) {
+	for (let attempt = 0; attempt < 2; attempt += 1) {
+		const deadline = new AbortController();
+		let localDeadlineFired = false;
+		let rejectDeadline = () => {};
+		const timeoutPromise = new Promise((_resolve, reject) => {
+			rejectDeadline = reject;
+		});
+		timeoutPromise.catch(() => {});
+		const timer = setTimeout(() => {
+			localDeadlineFired = true;
+			const error = new DOMException("Worker model call timed out", "TimeoutError");
+			deadline.abort(error);
+			rejectDeadline(error);
+		}, timeoutMs);
+		const signal = options?.signal ? AbortSignal.any([options.signal, deadline.signal]) : deadline.signal;
+		const state$1 = {
+			emitted: false,
+			active: true
+		};
+		const attemptPromise = runAttempt(signal, state$1);
+		attemptPromise.catch(() => {});
+		try {
+			await Promise.race([attemptPromise, timeoutPromise]);
+			return;
+		} catch (err) {
+			if (options?.signal?.aborted) {
+				pushTerminalError(stream, resolved, options.signal.reason ?? err);
+				return;
+			}
+			if (!state$1.emitted && attempt === 0) continue;
+			if (localDeadlineFired) pushModelCallTimeoutDiagnostic(stream, resolved, timeoutMs, state$1.emitted);
+			else pushTerminalError(stream, resolved, err);
+			return;
+		} finally {
+			state$1.active = false;
+			clearTimeout(timer);
+		}
+	}
+}
 async function runStreamLoop(stream, context, opts, options) {
 	const { resolved } = opts;
 	if (opts.contextBudget) {
 		const assembledTokens = tokensFromBytes(estimateContextBytes(context));
-		if (assembledTokens > opts.contextBudget.inputHardLimitTokens) {
+		if (assembledTokens > opts.contextBudget.inputHardLimitTokens) if (!opts.contextBudget.windowKnown) consola.warn(`[worker] assembled request estimate ${assembledTokens} tokens exceeds fallback input limit ${opts.contextBudget.inputHardLimitTokens}; proceeding because the catalog window is unknown`);
+		else {
 			pushBackstopDiagnostic(stream, resolved, assembledTokens, opts.contextBudget.inputHardLimitTokens);
 			return;
 		}
@@ -23314,15 +23792,13 @@ async function runStreamLoop(stream, context, opts, options) {
 		pushTerminalError(stream, resolved, err);
 		return;
 	}
-	let sseStream;
-	try {
-		const result = await createChatCompletions(payload, void 0, options?.signal, true);
-		if (result == null || typeof result[Symbol.asyncIterator] !== "function") throw new Error("Upstream did not return an SSE stream (stream: true expected)");
-		sseStream = result;
-	} catch (err) {
-		pushTerminalError(stream, resolved, err);
-		return;
-	}
+	await runModelCallAttempts(stream, resolved, options, opts.modelCallTimeoutMs ?? 15 * 6e4, (signal, state$1) => runChatAttempt(stream, payload, opts, signal, state$1));
+}
+async function runChatAttempt(stream, payload, opts, signal, state$1) {
+	const { resolved } = opts;
+	const result = await createChatCompletions(payload, void 0, signal, false);
+	if (result == null || typeof result[Symbol.asyncIterator] !== "function") throw new Error("Upstream did not return an SSE stream (stream: true expected)");
+	const sseStream = result;
 	const accum = {
 		blocks: [],
 		textChunksByIndex: /* @__PURE__ */ new Map(),
@@ -23331,100 +23807,102 @@ async function runStreamLoop(stream, context, opts, options) {
 	let nextContentIndex = 0;
 	let activeTextIndex = null;
 	const toolPiIndexByOAI = /* @__PURE__ */ new Map();
-	try {
-		for await (const evt of sseStream) {
-			const data = evt?.data;
-			if (data == null) continue;
-			if (data === "[DONE]") break;
-			let chunk;
-			try {
-				chunk = JSON.parse(data);
-			} catch {
-				continue;
+	for await (const evt of sseStream) {
+		const data = evt?.data;
+		if (data == null) continue;
+		if (data === "[DONE]") break;
+		let chunk;
+		try {
+			chunk = JSON.parse(data);
+		} catch {
+			continue;
+		}
+		try {
+			opts.onChunk?.(chunk);
+		} catch {}
+		if (chunk.usage) accum.usage = chunk.usage;
+		const choice = chunk.choices?.[0];
+		if (!choice) continue;
+		const delta = choice.delta ?? {};
+		if (typeof delta.content === "string" && delta.content.length > 0) {
+			if (activeTextIndex == null) {
+				state$1.emitted = true;
+				activeTextIndex = nextContentIndex++;
+				accum.blocks.push({
+					kind: "text",
+					contentIndex: activeTextIndex
+				});
+				accum.textChunksByIndex.set(activeTextIndex, []);
+				if (!state$1.active) return;
+				stream.push({
+					type: "text_start",
+					contentIndex: activeTextIndex,
+					partial: buildPartial(resolved, accum)
+				});
 			}
-			try {
-				opts.onChunk?.(chunk);
-			} catch {}
-			if (chunk.usage) accum.usage = chunk.usage;
-			const choice = chunk.choices?.[0];
-			if (!choice) continue;
-			const delta = choice.delta ?? {};
-			if (typeof delta.content === "string" && delta.content.length > 0) {
-				if (activeTextIndex == null) {
-					activeTextIndex = nextContentIndex++;
-					accum.blocks.push({
-						kind: "text",
-						contentIndex: activeTextIndex
-					});
-					accum.textChunksByIndex.set(activeTextIndex, []);
-					stream.push({
-						type: "text_start",
-						contentIndex: activeTextIndex,
-						partial: buildPartial(resolved, accum)
-					});
-				}
-				accum.textChunksByIndex.get(activeTextIndex).push(delta.content);
+			accum.textChunksByIndex.get(activeTextIndex).push(delta.content);
+			stream.push({
+				type: "text_delta",
+				contentIndex: activeTextIndex,
+				delta: delta.content,
+				partial: buildPartial(resolved, accum)
+			});
+		}
+		if (Array.isArray(delta.tool_calls) && delta.tool_calls.length > 0) {
+			if (activeTextIndex != null) {
+				if (!state$1.active) return;
 				stream.push({
-					type: "text_delta",
+					type: "text_end",
 					contentIndex: activeTextIndex,
-					delta: delta.content,
+					content: joinTextChunks(accum, activeTextIndex),
 					partial: buildPartial(resolved, accum)
 				});
+				activeTextIndex = null;
 			}
-			if (Array.isArray(delta.tool_calls) && delta.tool_calls.length > 0) {
-				if (activeTextIndex != null) {
+			for (const tcd of delta.tool_calls) {
+				if (tcd == null || tcd.index == null) continue;
+				let piIdx = toolPiIndexByOAI.get(tcd.index);
+				if (piIdx == null) {
+					state$1.emitted = true;
+					piIdx = nextContentIndex++;
+					toolPiIndexByOAI.set(tcd.index, piIdx);
+					accum.blocks.push({
+						kind: "tool",
+						contentIndex: piIdx,
+						openaiIndex: tcd.index
+					});
+					accum.toolByIndex.set(piIdx, {
+						id: "",
+						name: "",
+						argumentChunks: []
+					});
+					if (!state$1.active) return;
 					stream.push({
-						type: "text_end",
-						contentIndex: activeTextIndex,
-						content: joinTextChunks(accum, activeTextIndex),
+						type: "toolcall_start",
+						contentIndex: piIdx,
 						partial: buildPartial(resolved, accum)
 					});
-					activeTextIndex = null;
 				}
-				for (const tcd of delta.tool_calls) {
-					if (tcd == null || tcd.index == null) continue;
-					let piIdx = toolPiIndexByOAI.get(tcd.index);
-					if (piIdx == null) {
-						piIdx = nextContentIndex++;
-						toolPiIndexByOAI.set(tcd.index, piIdx);
-						accum.blocks.push({
-							kind: "tool",
-							contentIndex: piIdx,
-							openaiIndex: tcd.index
-						});
-						accum.toolByIndex.set(piIdx, {
-							id: "",
-							name: "",
-							argumentChunks: []
-						});
-						stream.push({
-							type: "toolcall_start",
-							contentIndex: piIdx,
-							partial: buildPartial(resolved, accum)
-						});
-					}
-					const entry = accum.toolByIndex.get(piIdx);
-					if (!entry) continue;
-					if (tcd.id) entry.id = tcd.id;
-					if (tcd.function?.name) entry.name = tcd.function.name;
-					const argDelta = tcd.function?.arguments;
-					if (typeof argDelta === "string" && argDelta.length > 0) {
-						entry.argumentChunks.push(argDelta);
-						stream.push({
-							type: "toolcall_delta",
-							contentIndex: piIdx,
-							delta: argDelta,
-							partial: buildPartial(resolved, accum)
-						});
-					}
+				const entry = accum.toolByIndex.get(piIdx);
+				if (!entry) continue;
+				if (tcd.id) entry.id = tcd.id;
+				if (tcd.function?.name) entry.name = tcd.function.name;
+				const argDelta = tcd.function?.arguments;
+				if (typeof argDelta === "string" && argDelta.length > 0) {
+					entry.argumentChunks.push(argDelta);
+					if (!state$1.active) return;
+					stream.push({
+						type: "toolcall_delta",
+						contentIndex: piIdx,
+						delta: argDelta,
+						partial: buildPartial(resolved, accum)
+					});
 				}
 			}
-			if (choice.finish_reason) accum.finishReason = choice.finish_reason;
 		}
-	} catch (err) {
-		pushTerminalError(stream, resolved, err);
-		return;
+		if (choice.finish_reason) accum.finishReason = choice.finish_reason;
 	}
+	if (!state$1.active) return;
 	if (activeTextIndex != null) {
 		stream.push({
 			type: "text_end",
@@ -23587,15 +24065,13 @@ async function runResponsesStreamLoop(stream, context, opts, options) {
 		pushTerminalError(stream, resolved, err);
 		return;
 	}
-	let sseStream;
-	try {
-		const result = await createResponses(payload, void 0, options?.signal, true);
-		if (result == null || typeof result[Symbol.asyncIterator] !== "function") throw new Error("Upstream did not return an SSE stream (stream: true expected)");
-		sseStream = result;
-	} catch (err) {
-		pushTerminalError(stream, resolved, err);
-		return;
-	}
+	await runModelCallAttempts(stream, resolved, options, opts.modelCallTimeoutMs ?? 15 * 6e4, (signal, state$1) => runResponsesAttempt(stream, payload, opts, signal, state$1));
+}
+async function runResponsesAttempt(stream, payload, opts, signal, state$1) {
+	const { resolved } = opts;
+	const result = await createResponses(payload, void 0, signal, false);
+	if (result == null || typeof result[Symbol.asyncIterator] !== "function") throw new Error("Upstream did not return an SSE stream (stream: true expected)");
+	const sseStream = result;
 	const accum = {
 		blocks: [],
 		textChunksByIndex: /* @__PURE__ */ new Map(),
@@ -23615,166 +24091,173 @@ async function runResponsesStreamLoop(stream, context, opts, options) {
 		});
 		activeTextIndex = null;
 	};
-	try {
-		for await (const evt of sseStream) {
-			const data = evt?.data;
-			if (data == null) continue;
-			if (data === "[DONE]") break;
-			let ev;
-			try {
-				ev = JSON.parse(data);
-			} catch {
-				continue;
-			}
-			switch (ev.type) {
-				case "response.output_text.delta": {
-					const delta = ev.delta;
-					if (typeof delta !== "string" || delta.length === 0) break;
-					if (activeTextIndex == null) {
-						activeTextIndex = nextContentIndex++;
-						accum.blocks.push({
-							kind: "text",
-							contentIndex: activeTextIndex
-						});
-						accum.textChunksByIndex.set(activeTextIndex, []);
-						stream.push({
-							type: "text_start",
-							contentIndex: activeTextIndex,
-							partial: buildPartial(resolved, accum)
-						});
-					}
-					accum.textChunksByIndex.get(activeTextIndex).push(delta);
+	for await (const evt of sseStream) {
+		const data = evt?.data;
+		if (data == null) continue;
+		if (data === "[DONE]") break;
+		let ev;
+		try {
+			ev = JSON.parse(data);
+		} catch {
+			continue;
+		}
+		switch (ev.type) {
+			case "response.output_text.delta": {
+				const delta = ev.delta;
+				if (typeof delta !== "string" || delta.length === 0) break;
+				if (activeTextIndex == null) {
+					state$1.emitted = true;
+					activeTextIndex = nextContentIndex++;
+					accum.blocks.push({
+						kind: "text",
+						contentIndex: activeTextIndex
+					});
+					accum.textChunksByIndex.set(activeTextIndex, []);
+					if (!state$1.active) return;
 					stream.push({
-						type: "text_delta",
+						type: "text_start",
 						contentIndex: activeTextIndex,
-						delta,
 						partial: buildPartial(resolved, accum)
 					});
-					break;
 				}
-				case "response.output_text.done":
-					if (activeTextIndex == null && typeof ev.text === "string" && ev.text.length > 0) {
-						activeTextIndex = nextContentIndex++;
-						accum.blocks.push({
-							kind: "text",
-							contentIndex: activeTextIndex
-						});
-						accum.textChunksByIndex.set(activeTextIndex, []);
-						stream.push({
-							type: "text_start",
-							contentIndex: activeTextIndex,
-							partial: buildPartial(resolved, accum)
-						});
-						accum.textChunksByIndex.get(activeTextIndex).push(ev.text);
-						stream.push({
-							type: "text_delta",
-							contentIndex: activeTextIndex,
-							delta: ev.text,
-							partial: buildPartial(resolved, accum)
-						});
-					}
-					closeActiveText();
-					break;
-				case "response.output_item.added": {
-					const item = ev.item;
-					if (item?.type !== "function_call") break;
-					const key = responsesToolKey(ev.output_index, item.id);
-					if (key == null) break;
-					if (toolPiIndexByKey.has(key)) break;
-					closeActiveText();
-					const piIdx = nextContentIndex++;
-					toolPiIndexByKey.set(key, piIdx);
+				accum.textChunksByIndex.get(activeTextIndex).push(delta);
+				if (!state$1.active) return;
+				stream.push({
+					type: "text_delta",
+					contentIndex: activeTextIndex,
+					delta,
+					partial: buildPartial(resolved, accum)
+				});
+				break;
+			}
+			case "response.output_text.done":
+				if (activeTextIndex == null && typeof ev.text === "string" && ev.text.length > 0) {
+					state$1.emitted = true;
+					activeTextIndex = nextContentIndex++;
 					accum.blocks.push({
-						kind: "tool",
-						contentIndex: piIdx,
-						openaiIndex: piIdx
-					});
-					accum.toolByIndex.set(piIdx, {
-						id: item.call_id ?? item.id ?? key,
-						name: item.name ?? "",
-						argumentChunks: []
-					});
-					stream.push({
-						type: "toolcall_start",
-						contentIndex: piIdx,
-						partial: buildPartial(resolved, accum)
+						kind: "text",
+						contentIndex: activeTextIndex
 					});
-					break;
-				}
-				case "response.function_call_arguments.delta": {
-					const key = responsesToolKey(ev.output_index, ev.item_id);
-					if (key == null) break;
-					const piIdx = toolPiIndexByKey.get(key);
-					if (piIdx == null) break;
-					const entry = accum.toolByIndex.get(piIdx);
-					if (!entry) break;
-					const delta = ev.delta;
-					if (typeof delta !== "string" || delta.length === 0) break;
-					entry.argumentChunks.push(delta);
+					accum.textChunksByIndex.set(activeTextIndex, []);
+					if (!state$1.active) return;
 					stream.push({
-						type: "toolcall_delta",
-						contentIndex: piIdx,
-						delta,
+						type: "text_start",
+						contentIndex: activeTextIndex,
 						partial: buildPartial(resolved, accum)
 					});
-					break;
-				}
-				case "response.function_call_arguments.done": {
-					const key = responsesToolKey(ev.output_index, ev.item_id);
-					if (key == null) break;
-					const piIdx = toolPiIndexByKey.get(key);
-					if (piIdx == null) break;
-					const entry = accum.toolByIndex.get(piIdx);
-					if (entry && typeof ev.arguments === "string") entry.argumentChunks = [ev.arguments];
-					break;
-				}
-				case "response.output_item.done": {
-					const item = ev.item;
-					if (item?.type !== "function_call") break;
-					const key = responsesToolKey(ev.output_index, item.id);
-					if (key == null) break;
-					const piIdx = toolPiIndexByKey.get(key);
-					if (piIdx == null) break;
-					const entry = accum.toolByIndex.get(piIdx);
-					if (!entry) break;
-					if (item.call_id) entry.id = item.call_id;
-					if (item.name) entry.name = item.name;
-					if (typeof item.arguments === "string") entry.argumentChunks = [item.arguments];
+					accum.textChunksByIndex.get(activeTextIndex).push(ev.text);
+					if (!state$1.active) return;
 					stream.push({
-						type: "toolcall_end",
-						contentIndex: piIdx,
-						toolCall: makePiToolCall(entry),
+						type: "text_delta",
+						contentIndex: activeTextIndex,
+						delta: ev.text,
 						partial: buildPartial(resolved, accum)
 					});
-					closedToolItems.add(piIdx);
-					break;
 				}
-				case "response.completed":
-				case "response.incomplete":
-					accum.usage = mapResponsesUsage(ev.response?.usage);
-					if (ev.type === "response.incomplete" && ev.response?.incomplete_details?.reason === "max_output_tokens") accum.finishReason = "length";
-					if (opts.onChunk && accum.usage) try {
-						opts.onChunk({
-							id: "",
-							object: "chat.completion.chunk",
-							created: 0,
-							model: resolved.modelId,
-							choices: [],
-							usage: accum.usage
-						});
-					} catch {}
-					break;
-				case "response.failed":
-					closeActiveText();
-					pushTerminalError(stream, resolved, new Error(ev.response?.error?.message ?? "response.failed"));
-					return;
-				default: break;
+				closeActiveText();
+				break;
+			case "response.output_item.added": {
+				const item = ev.item;
+				if (item?.type !== "function_call") break;
+				const key = responsesToolKey(ev.output_index, item.id);
+				if (key == null) break;
+				if (toolPiIndexByKey.has(key)) break;
+				closeActiveText();
+				state$1.emitted = true;
+				const piIdx = nextContentIndex++;
+				toolPiIndexByKey.set(key, piIdx);
+				accum.blocks.push({
+					kind: "tool",
+					contentIndex: piIdx,
+					openaiIndex: piIdx
+				});
+				accum.toolByIndex.set(piIdx, {
+					id: item.call_id ?? item.id ?? key,
+					name: item.name ?? "",
+					argumentChunks: []
+				});
+				if (!state$1.active) return;
+				stream.push({
+					type: "toolcall_start",
+					contentIndex: piIdx,
+					partial: buildPartial(resolved, accum)
+				});
+				break;
+			}
+			case "response.function_call_arguments.delta": {
+				const key = responsesToolKey(ev.output_index, ev.item_id);
+				if (key == null) break;
+				const piIdx = toolPiIndexByKey.get(key);
+				if (piIdx == null) break;
+				const entry = accum.toolByIndex.get(piIdx);
+				if (!entry) break;
+				const delta = ev.delta;
+				if (typeof delta !== "string" || delta.length === 0) break;
+				entry.argumentChunks.push(delta);
+				if (!state$1.active) return;
+				stream.push({
+					type: "toolcall_delta",
+					contentIndex: piIdx,
+					delta,
+					partial: buildPartial(resolved, accum)
+				});
+				break;
+			}
+			case "response.function_call_arguments.done": {
+				const key = responsesToolKey(ev.output_index, ev.item_id);
+				if (key == null) break;
+				const piIdx = toolPiIndexByKey.get(key);
+				if (piIdx == null) break;
+				const entry = accum.toolByIndex.get(piIdx);
+				if (entry && typeof ev.arguments === "string") entry.argumentChunks = [ev.arguments];
+				break;
+			}
+			case "response.output_item.done": {
+				const item = ev.item;
+				if (item?.type !== "function_call") break;
+				const key = responsesToolKey(ev.output_index, item.id);
+				if (key == null) break;
+				const piIdx = toolPiIndexByKey.get(key);
+				if (piIdx == null) break;
+				const entry = accum.toolByIndex.get(piIdx);
+				if (!entry) break;
+				if (item.call_id) entry.id = item.call_id;
+				if (item.name) entry.name = item.name;
+				if (typeof item.arguments === "string") entry.argumentChunks = [item.arguments];
+				if (!state$1.active) return;
+				stream.push({
+					type: "toolcall_end",
+					contentIndex: piIdx,
+					toolCall: makePiToolCall(entry),
+					partial: buildPartial(resolved, accum)
+				});
+				closedToolItems.add(piIdx);
+				break;
 			}
+			case "response.completed":
+			case "response.incomplete":
+				accum.usage = mapResponsesUsage(ev.response?.usage);
+				if (ev.type === "response.incomplete" && ev.response?.incomplete_details?.reason === "max_output_tokens") accum.finishReason = "length";
+				if (opts.onChunk && accum.usage) try {
+					opts.onChunk({
+						id: "",
+						object: "chat.completion.chunk",
+						created: 0,
+						model: resolved.modelId,
+						choices: [],
+						usage: accum.usage
+					});
+				} catch {}
+				break;
+			case "response.failed":
+				if (!state$1.active) return;
+				closeActiveText();
+				pushTerminalError(stream, resolved, new Error(ev.response?.error?.message ?? "response.failed"));
+				return;
+			default: break;
 		}
-	} catch (err) {
-		pushTerminalError(stream, resolved, err);
-		return;
 	}
+	if (!state$1.active) return;
 	closeActiveText();
 	for (const block of accum.blocks) {
 		if (block.kind !== "tool") continue;
@@ -24092,6 +24575,23 @@ function fieldBytes(v) {
 * the engine marks the result isError). No upstream call is made — this
 * replaces an opaque upstream 4xx with an actionable, sanitized message.
 */
+function pushModelCallTimeoutDiagnostic(stream, resolved, timeoutMs, emitted) {
+	const text = `Worker model call timed out after ${timeoutMs}ms${emitted ? " after emitting partial output" : " after two attempts with no output"}. The upstream stream stopped making progress. Retry the worker call; if it repeats, choose a different model.`;
+	const final = {
+		...makeBaseMessage(resolved),
+		content: [{
+			type: "text",
+			text
+		}],
+		stopReason: "error",
+		errorMessage: "worker model-call deadline exceeded"
+	};
+	stream.push({
+		type: "error",
+		reason: "error",
+		error: final
+	});
+}
 function pushBackstopDiagnostic(stream, resolved, assembledTokens, limitTokens) {
 	const text = `Request too large: the assembled input is ~${assembledTokens} tokens, over the ~${limitTokens}-token budget for ${resolved.modelId}. The run was stopped before an overflow error. Retry with a narrower task — target a specific section / file / element rather than reading everything at once.`;
 	const final = {
@@ -25143,7 +25643,7 @@ function shimDefaultsToXhigh(id) {
 * ALL THREE peer models the consensus protocol needs:
 *   - an OpenAI frontier model (`gpt-5.6-sol`, else `gpt-5.5` — see
 *     `resolveOpenAiFrontier`)
-*   - `claude-opus-4-7`     (opus_critic's model)
+*   - `claude-opus-5`       (stand_in's Anthropic slot)
 *   - any `gemini-3.X.*pro` (gemini_critic's model family — matches the
 *     same regex `geminiAvailable()` uses, so the gate stays in sync if
 *     the GA slug renames `gemini-3.1-pro-preview` → `gemini-3.1-pro`)
@@ -25152,11 +25652,8 @@ function shimDefaultsToXhigh(id) {
 * fails `tools/call` with -32601 (mirroring the `worker` capability's
 * defense-in-depth pattern — the gated tool is functionally invisible).
 *
-* Tier-mismatch on `claude-opus-4-7`: the proxy's `resolveModel` will
-* fuzzy-match `claude-opus-4-7` to `claude-opus-4.7` (Copilot's dotted
-* slug). For the catalog probe we use the Anthropic-published dashed
-* slug too — `state.models?.data` mirrors Copilot's catalog where these
-* land under the dotted slug, so we match by Copilot's actual id shape.
+* `claude-opus-5` is a single-segment slug (dotted == dashed), so the
+* catalog probe matches Copilot's actual id shape directly.
 */
 function geminiAvailable(source = state) {
 	const models = source.models?.data;
@@ -25183,7 +25680,7 @@ function standInToolEnabled() {
 	const models = state.models?.data;
 	if (!models) return false;
 	const hasOpenAi = resolveOpenAiFrontier() != null;
-	const hasOpus = models.some((m) => m.id === "claude-opus-4-7" || m.id === "claude-opus-4.7");
+	const hasOpus = models.some((m) => m.id === "claude-opus-5");
 	const hasGeminiPro = geminiAvailable();
 	return hasOpenAi && hasOpus && hasGeminiPro;
 }
@@ -25461,27 +25958,42 @@ function checkAuth(c) {
 	return { ok: true };
 }
 /**
-* The 1M-context Opus 4.6 variant (`claude-opus-4.6-1m`, `max_prompt_tokens`
-* 936K). opus_critic prefers it so it can take large artifacts in one shot
-* (the whole point of pairing it with gpt-5.6-sol as the big-window peers);
-* falls back to the 200K `claude-opus-4-6` when the catalog doesn't carry
-* a 1M 4.6 slug. The regex is version-anchored to 4.6 AND requires a
-* `-1m` suffix boundary (not a permissive `.*1m`), so it does NOT
-* false-positive on `claude-opus-4.7-1m-internal` (stand_in's pinned
-* 4.7 row), `claude-opus-4.6-1max` (hypothetical), or `claude-opus-4.8`
-* (1M-without-sibling). Tolerates dotted (`opus-4.6-1m`) and dashed
-* (`opus-4-6-1m`) catalog separators.
+* opus_critic's effective model, resolved against the live catalog.
+*
+* Prefers `claude-opus-5` — a single-segment slug that is natively 1M
+* (no `-1m` sibling), so it takes large artifacts in one shot (the whole
+* point of pairing it with gpt-5.6-sol as the big-window peers). When opus-5
+* isn't in the catalog (e.g. a lesser tier), falls back to the older
+* 1M-context Opus 4.6 variant (`claude-opus-4.6-1m`, `max_prompt_tokens`
+* 936K), then to the 200K `claude-opus-4-6`. The 4.6 regex is
+* version-anchored AND requires a `-1m` suffix boundary (not a permissive
+* `.*1m`), so it does NOT false-positive on `claude-opus-4.7-1m-internal`,
+* `claude-opus-4.6-1max`, or a 1M-without-sibling base slug. Tolerates
+* dotted (`opus-4.6-1m`) and dashed (`opus-4-6-1m`) catalog separators.
 */
 const OPUS_1M_RE = /opus-4[.-]6-1m(?:$|-)/i;
 function resolveOpusCriticModel() {
-	const oneM = state.models?.data?.find((m) => OPUS_1M_RE.test(m.id));
+	const models = state.models?.data;
+	if (models?.some((m) => m.id === "claude-opus-5")) return "claude-opus-5";
+	const oneM = models?.find((m) => OPUS_1M_RE.test(m.id));
 	return oneM ? oneM.id : "claude-opus-4-6";
 }
 function activePersonas() {
-	return PERSONAS_READ.filter((p) => !p.requiresGeminiCatalog || geminiAvailable()).map((p) => p.toolNameHttp === "opus_critic" ? {
-		...p,
-		model: resolveOpusCriticModel()
-	} : p);
+	return PERSONAS_READ.filter((p) => !p.requiresGeminiCatalog || geminiAvailable()).map((p) => {
+		if (p.toolNameHttp !== "opus_critic") return p;
+		const model = resolveOpusCriticModel();
+		const allowedEfforts = model === "claude-opus-5" ? [
+			"low",
+			"medium",
+			"high",
+			"xhigh"
+		] : p.allowedEfforts;
+		return {
+			...p,
+			model,
+			allowedEfforts
+		};
+	});
 }
 function toolEntries(scope) {
 	const personaEntries = scope === "all" || scope === "peers" ? activePersonas().map((p) => ({
@@ -25672,7 +26184,9 @@ async function predictedWindowOverflow(persona, prompt, context) {
 		return;
 	}
 	if (tokens <= budget) return void 0;
-	const opusHint = OPUS_1M_RE.test(id) ? "" : " / `opus_critic` (Opus-4.7 1M ≈ 936K tokens, when the enterprise catalog carries it)";
+	const criticModel = resolveOpusCriticModel();
+	const criticIs1M = criticModel === "claude-opus-5" || OPUS_1M_RE.test(criticModel);
+	const opusHint = id === "claude-opus-5" || OPUS_1M_RE.test(id) || !criticIs1M ? "" : " / `opus_critic` (Opus 5, 1M context ≈ 1M tokens)";
 	return `pre-flight rejected: this ${persona.toolNameHttp} brief is ≈${tokens} tokens, over the ${budget}-token budget for ${persona.model} (its ${maxPromptTokens}-token prompt window minus a ${PEER_PROMPT_TOKEN_RESERVE}-token framing reserve). Do NOT summarize or truncate the artifact to fit. Route the full artifact to a larger-window peer — \`codex_critic\` (gpt-5.6-sol ≈ 1M tokens)${opusHint} — or split it into focused sub-calls BY CONCERN and call them in parallel, then aggregate.`;
 }
 /**
@@ -25732,7 +26246,7 @@ function jsonPathPreflightCap(body, scope) {
 * the `stand_in` orchestrator in `src/lib/stand-in.ts` — can reuse the
 * same per-endpoint request shaping without re-implementing it. The
 * stand_in tool needs to drive its own per-round system prompts across
-* three concrete models (gpt-5.6-sol, claude-opus-4-7, gemini-3.1-pro-preview),
+* three concrete models (gpt-5.6-sol, claude-opus-5, gemini-3.1-pro-preview),
 * each on a different endpoint; doing that with a `PersonaSpec` would
 * require either inventing throwaway personas per round or duplicating
 * the dispatch switch.
@@ -28033,13 +28547,13 @@ function atomicWriteSync(absPath, contents) {
 		throw err;
 	}
 }
-const READ_PARAMS = Type.Object({
-	path: Type.String({ description: "Workspace-relative or absolute path." }),
-	offset: Type.Optional(Type.Integer({
+const READ_PARAMS = Type$1.Object({
+	path: Type$1.String({ description: "Workspace-relative or absolute path." }),
+	offset: Type$1.Optional(Type$1.Integer({
 		minimum: 0,
 		description: "Line offset (0-indexed)."
 	})),
-	limit: Type.Optional(Type.Integer({
+	limit: Type$1.Optional(Type$1.Integer({
 		minimum: 1,
 		description: "Max lines to return."
 	}))
@@ -28064,9 +28578,9 @@ function readTool(workspace) {
 		}
 	};
 }
-const GLOB_PARAMS = Type.Object({
-	pattern: Type.String({ description: "ripgrep glob pattern, e.g. `src/**/*.ts`." }),
-	limit: Type.Optional(Type.Integer({
+const GLOB_PARAMS = Type$1.Object({
+	pattern: Type$1.String({ description: "ripgrep glob pattern, e.g. `src/**/*.ts`." }),
+	limit: Type$1.Optional(Type$1.Integer({
 		minimum: 1,
 		maximum: SEARCH_HARD_MAX
 	}))
@@ -28093,11 +28607,11 @@ function globTool(workspace) {
 		}
 	};
 }
-const GREP_PARAMS = Type.Object({
-	query: Type.String({ description: "Pattern to search for." }),
-	mode: Type.Optional(Type.Union([Type.Literal("literal"), Type.Literal("regex")], { description: "`literal` (default) = fixed-string; `regex` = PCRE2." })),
-	file_glob: Type.Optional(Type.String({ description: "ripgrep glob filter, e.g. `*.ts`." })),
-	limit: Type.Optional(Type.Integer({
+const GREP_PARAMS = Type$1.Object({
+	query: Type$1.String({ description: "Pattern to search for." }),
+	mode: Type$1.Optional(Type$1.Union([Type$1.Literal("literal"), Type$1.Literal("regex")], { description: "`literal` (default) = fixed-string; `regex` = PCRE2." })),
+	file_glob: Type$1.Optional(Type$1.String({ description: "ripgrep glob filter, e.g. `*.ts`." })),
+	limit: Type$1.Optional(Type$1.Integer({
 		minimum: 1,
 		maximum: SEARCH_HARD_MAX
 	}))
@@ -28133,10 +28647,10 @@ function grepTool(workspace) {
 		}
 	};
 }
-const EDIT_PARAMS = Type.Object({
-	path: Type.String({ description: "Workspace-relative or absolute path." }),
-	old_string: Type.String({ description: "Exact text to find. Must match exactly once; tool returns `not found` (0 matches) or `matches N times` (>1) without editing." }),
-	new_string: Type.String({ description: "Replacement text. May be empty (deletes old_string)." })
+const EDIT_PARAMS = Type$1.Object({
+	path: Type$1.String({ description: "Workspace-relative or absolute path." }),
+	old_string: Type$1.String({ description: "Exact text to find. Must match exactly once; tool returns `not found` (0 matches) or `matches N times` (>1) without editing." }),
+	new_string: Type$1.String({ description: "Replacement text. May be empty (deletes old_string)." })
 });
 function editTool(workspace) {
 	return {
@@ -28164,9 +28678,9 @@ function editTool(workspace) {
 		}
 	};
 }
-const WRITE_PARAMS = Type.Object({
-	path: Type.String({ description: "Workspace-relative or absolute path." }),
-	contents: Type.String({ description: "Full file contents. Refused if >10 MiB." })
+const WRITE_PARAMS = Type$1.Object({
+	path: Type$1.String({ description: "Workspace-relative or absolute path." }),
+	contents: Type$1.String({ description: "Full file contents. Refused if >10 MiB." })
 });
 function writeTool(workspace) {
 	return {
@@ -28182,9 +28696,9 @@ function writeTool(workspace) {
 		}
 	};
 }
-const BASH_PARAMS = Type.Object({
-	cmd: Type.String({ description: "Shell command line." }),
-	timeout_ms: Type.Optional(Type.Integer({
+const BASH_PARAMS = Type$1.Object({
+	cmd: Type$1.String({ description: "Shell command line." }),
+	timeout_ms: Type$1.Optional(Type$1.Integer({
 		minimum: 100,
 		maximum: BASH_MAX_TIMEOUT_MS,
 		description: `Per-call timeout (default ${BASH_DEFAULT_TIMEOUT_MS} ms).`
@@ -28217,7 +28731,7 @@ function bashTool(workspace) {
 		}
 	};
 }
-const WEB_SEARCH_PARAMS = Type.Object({ query: Type.String({ description: "Natural-language search query." }) });
+const WEB_SEARCH_PARAMS = Type$1.Object({ query: Type$1.String({ description: "Natural-language search query." }) });
 function webSearchTool() {
 	return {
 		name: "web_search",
@@ -28233,7 +28747,7 @@ function webSearchTool() {
 		}
 	};
 }
-const FETCH_URL_PARAMS = Type.Object({ url: Type.String({ description: "Absolute URL (http/https only)." }) });
+const FETCH_URL_PARAMS = Type$1.Object({ url: Type$1.String({ description: "Absolute URL (http/https only)." }) });
 function fetchUrlTool() {
 	return {
 		name: "fetch_url",
@@ -28287,26 +28801,26 @@ function fetchUrlTool() {
 		}
 	};
 }
-const CODE_SEARCH_PARAMS = Type.Object({
-	query: Type.String({ description: "Search text. Natural-language intent in the default `semantic` mode; a literal string in `lexical`/`exact`; a PCRE2 regex in `regex`." }),
-	mode: Type.Optional(Type.Union([
-		Type.Literal("semantic"),
-		Type.Literal("lexical"),
-		Type.Literal("exact"),
-		Type.Literal("regex"),
-		Type.Literal("ast")
+const CODE_SEARCH_PARAMS = Type$1.Object({
+	query: Type$1.String({ description: "Search text. Natural-language intent in the default `semantic` mode; a literal string in `lexical`/`exact`; a PCRE2 regex in `regex`." }),
+	mode: Type$1.Optional(Type$1.Union([
+		Type$1.Literal("semantic"),
+		Type$1.Literal("lexical"),
+		Type$1.Literal("exact"),
+		Type$1.Literal("regex"),
+		Type$1.Literal("ast")
 	], { description: "Search mode. `semantic` (DEFAULT): ColBERT meaning-based ranking, falls back to lexical when the index isn't ready (response `source` says which engine ran). `lexical`: BM25F + tree-sitter (best for exact symbols). `exact`: fixed-string. `regex`: PCRE2. `ast`: ast-grep structural (needs `ast_pattern` + `ast_lang`)." })),
-	pattern: Type.Optional(Type.String({ description: "Semantic mode only: regex pre-filter (colgrep -e) — grep first, then rank semantically. Ignored in lexical modes." })),
-	file_glob: Type.Optional(Type.String({ description: "ripgrep glob filter." })),
-	limit: Type.Optional(Type.Integer({
+	pattern: Type$1.Optional(Type$1.String({ description: "Semantic mode only: regex pre-filter (colgrep -e) — grep first, then rank semantically. Ignored in lexical modes." })),
+	file_glob: Type$1.Optional(Type$1.String({ description: "ripgrep glob filter." })),
+	limit: Type$1.Optional(Type$1.Integer({
 		minimum: 1,
 		description: "Max hits to return."
 	})),
-	structural: Type.Optional(Type.Union([Type.Literal("full"), Type.Literal("topN")], { description: "Structural-ranking depth (lexical mode only)." })),
-	complete: Type.Optional(Type.Boolean({ description: "Lexical mode: when true, return the COMPLETE match set (every line ripgrep would find, capped only by `limit`) — disables the default precision shoulder cut + per-file cap. Use it when you must not miss any occurrence (every caller of X, a rename, an audit). The default response `notice` says when matches were hidden." })),
-	multiline: Type.Optional(Type.Boolean({ description: "Set true with mode:'regex' to let a pattern span newlines (ripgrep -U), e.g. 'foo[\\s\\S]*?bar' across lines. (literal/lexical queries can't contain a newline.)" })),
-	ast_pattern: Type.Optional(Type.String({ description: "mode:'ast' structural pattern (e.g. 'function $F($$$) { $$$ }'). Matches come from ast-grep instead of ripgrep — for multi-line AST shapes the regex modes can't express. Takes precedence over `query`. REQUIRES `ast_lang`. If ast-grep isn't installed you get a `notice`; it never falls back to regex." })),
-	ast_lang: Type.Optional(Type.String({ description: "Language grammar for `ast_pattern` (REQUIRED with it): 'ts' | 'tsx' | 'js' | 'py' | 'rust' | 'go' | … Without it ast-grep cross-matches every language and returns garbage." }))
+	structural: Type$1.Optional(Type$1.Union([Type$1.Literal("full"), Type$1.Literal("topN")], { description: "Structural-ranking depth (lexical mode only)." })),
+	complete: Type$1.Optional(Type$1.Boolean({ description: "Lexical mode: when true, return the COMPLETE match set (every line ripgrep would find, capped only by `limit`) — disables the default precision shoulder cut + per-file cap. Use it when you must not miss any occurrence (every caller of X, a rename, an audit). The default response `notice` says when matches were hidden." })),
+	multiline: Type$1.Optional(Type$1.Boolean({ description: "Set true with mode:'regex' to let a pattern span newlines (ripgrep -U), e.g. 'foo[\\s\\S]*?bar' across lines. (literal/lexical queries can't contain a newline.)" })),
+	ast_pattern: Type$1.Optional(Type$1.String({ description: "mode:'ast' structural pattern (e.g. 'function $F($$$) { $$$ }'). Matches come from ast-grep instead of ripgrep — for multi-line AST shapes the regex modes can't express. Takes precedence over `query`. REQUIRES `ast_lang`. If ast-grep isn't installed you get a `notice`; it never falls back to regex." })),
+	ast_lang: Type$1.Optional(Type$1.String({ description: "Language grammar for `ast_pattern` (REQUIRED with it): 'ts' | 'tsx' | 'js' | 'py' | 'rust' | 'go' | … Without it ast-grep cross-matches every language and returns garbage." }))
 });
 function codeSearchTool(workspace) {
 	return {
@@ -28465,9 +28979,9 @@ const GIT_DIFF_PRODUCING = new Set([
 	"show",
 	"diff"
 ]);
-const TOOLBELT_PARAMS = Type.Object({
-	tool: Type.Union(TOOLBELT_TOOLS.map((t) => Type.Literal(t)), { description: "Which read-only analysis CLI to run: rg (ripgrep search), fd (file find), sg (ast-grep structural search), jq (JSON), yq (YAML/TOML/XML), gron (flatten JSON to greppable lines), scc (code stats: LOC + complexity), tokei (code stats), difft (difftastic structural diff), git (read-only subcommands only)." }),
-	args: Type.Optional(Type.Array(Type.String(), { description: "Arguments passed LITERALLY to the tool (no shell: no pipes, redirects, chaining, or glob expansion). For git, args[0] must be a read-only subcommand (log/show/diff/blame/ls-files/…)." }))
+const TOOLBELT_PARAMS = Type$1.Object({
+	tool: Type$1.Union(TOOLBELT_TOOLS.map((t) => Type$1.Literal(t)), { description: "Which read-only analysis CLI to run: rg (ripgrep search), fd (file find), sg (ast-grep structural search), jq (JSON), yq (YAML/TOML/XML), gron (flatten JSON to greppable lines), scc (code stats: LOC + complexity), tokei (code stats), difft (difftastic structural diff), git (read-only subcommands only)." }),
+	args: Type$1.Optional(Type$1.Array(Type$1.String(), { description: "Arguments passed LITERALLY to the tool (no shell: no pipes, redirects, chaining, or glob expansion). For git, args[0] must be a read-only subcommand (log/show/diff/blame/ls-files/…)." }))
 });
 /**
 * True iff `arg` triggers a denied flag. Long flags (`--foo`) match on the
@@ -28576,10 +29090,10 @@ function toolbeltTool(workspace) {
 	};
 }
 const PEER_CRITIC_TUPLE = [
-	Type.Literal("codex_critic"),
-	Type.Literal("gemini_critic"),
-	Type.Literal("codex_reviewer"),
-	Type.Literal("opus_critic")
+	Type$1.Literal("codex_critic"),
+	Type$1.Literal("gemini_critic"),
+	Type$1.Literal("codex_reviewer"),
+	Type$1.Literal("opus_critic")
 ];
 /**
 * Critic names accepted by `peer_review.critic`. Exported for the
@@ -28587,17 +29101,17 @@ const PEER_CRITIC_TUPLE = [
 * against `PERSONAS_READ` from `~/lib/peer-mcp-personas`.
 */
 const PEER_CRITIC_NAMES = PEER_CRITIC_TUPLE.map((l) => l.const);
-const PEER_EFFORT_UNION = Type.Union([
-	Type.Literal("low"),
-	Type.Literal("medium"),
-	Type.Literal("high"),
-	Type.Literal("xhigh")
+const PEER_EFFORT_UNION = Type$1.Union([
+	Type$1.Literal("low"),
+	Type$1.Literal("medium"),
+	Type$1.Literal("high"),
+	Type$1.Literal("xhigh")
 ], { description: "Reasoning depth. Per-critic allowedEfforts gate; out-of-band values are clamped to the critic's default." });
-const PEER_REVIEW_PARAMS = Type.Object({
-	critic: Type.Union([...PEER_CRITIC_TUPLE], { description: "Critic tool name. One of " + PEER_CRITIC_NAMES.map((n) => `\`${n}\``).join(", ") + ". `gemini_critic` is only valid when gemini-3.x is in the Copilot catalog; otherwise the call is refused." }),
-	prompt: Type.String({ description: "The brief — artifact under review plus constraints. Pasted verbatim into the critic's user message." }),
-	context: Type.Optional(Type.String({ description: "Optional extra context concatenated to the brief." })),
-	effort: Type.Optional(PEER_EFFORT_UNION)
+const PEER_REVIEW_PARAMS = Type$1.Object({
+	critic: Type$1.Union([...PEER_CRITIC_TUPLE], { description: "Critic tool name. One of " + PEER_CRITIC_NAMES.map((n) => `\`${n}\``).join(", ") + ". `gemini_critic` is only valid when gemini-3.x is in the Copilot catalog; otherwise the call is refused." }),
+	prompt: Type$1.String({ description: "The brief — artifact under review plus constraints. Pasted verbatim into the critic's user message." }),
+	context: Type$1.Optional(Type$1.String({ description: "Optional extra context concatenated to the brief." })),
+	effort: Type$1.Optional(PEER_EFFORT_UNION)
 });
 function lookupPersona(critic) {
 	const persona = PERSONAS_READ.find((p) => p.toolNameHttp === critic);
@@ -28618,10 +29132,10 @@ function lookupPersona(critic) {
 * `acquireInFlightSlot`, and `callPersona` keeps the slot accounting,
 * effort clamping, and isError-promotion semantics identical.
 */
-const CODEX_REVIEW_PARAMS = Type.Object({
-	prompt: Type.String({ description: "The code-review brief — diff or single file under review plus constraints. Pasted verbatim into codex-reviewer's user message." }),
-	context: Type.Optional(Type.String({ description: "Optional extra context concatenated to the brief." })),
-	effort: Type.Optional(PEER_EFFORT_UNION)
+const CODEX_REVIEW_PARAMS = Type$1.Object({
+	prompt: Type$1.String({ description: "The code-review brief — diff or single file under review plus constraints. Pasted verbatim into codex-reviewer's user message." }),
+	context: Type$1.Optional(Type$1.String({ description: "Optional extra context concatenated to the brief." })),
+	effort: Type$1.Optional(PEER_EFFORT_UNION)
 });
 function codexReviewTool() {
 	return {
@@ -28632,7 +29146,7 @@ function codexReviewTool() {
 		executionMode: "sequential",
 		async execute(_toolCallId, params, signal) {
 			if (networkDisabled()) throw new Error("rejected: network disabled");
-			const persona = lookupPersona("codex-reviewer");
+			const persona = lookupPersona("codex_reviewer");
 			const requested = params.effort;
 			const effort = requested && persona.allowedEfforts.includes(requested) ? requested : persona.defaultEffort;
 			const release = acquireInFlightSlot();
@@ -28655,7 +29169,7 @@ function geminiInCatalog() {
 	if (!models) return false;
 	return models.some((m) => /^gemini-3\..*pro/i.test(m.id));
 }
-const ADVISOR_PARAMS = Type.Object({ concern: Type.String({
+const ADVISOR_PARAMS = Type$1.Object({ concern: Type$1.String({
 	description: "What you want a second pair of eyes on — your current approach, the blocker you're stuck on, or the decision you're about to commit. Required: the advisor needs a focal point.",
 	minLength: 1
 }) });
@@ -28770,22 +29284,22 @@ function advisorTool(getMessages) {
 		}
 	};
 }
-const UPDATE_PLAN_PARAMS = Type.Object({
-	steps: Type.Array(Type.Object({
-		title: Type.String({
+const UPDATE_PLAN_PARAMS = Type$1.Object({
+	steps: Type$1.Array(Type$1.Object({
+		title: Type$1.String({
 			minLength: 1,
 			description: "Short imperative description of the step."
 		}),
-		status: Type.Union([
-			Type.Literal("pending"),
-			Type.Literal("in_progress"),
-			Type.Literal("completed")
+		status: Type$1.Union([
+			Type$1.Literal("pending"),
+			Type$1.Literal("in_progress"),
+			Type$1.Literal("completed")
 		], { description: "Current status of this step." })
 	}), {
 		minItems: 1,
 		description: "The FULL ordered plan. Each call replaces the previous plan, so always send every step (not just the changed one)."
 	}),
-	explanation: Type.Optional(Type.String({ description: "Optional one-line note on what changed this update." }))
+	explanation: Type$1.Optional(Type$1.String({ description: "Optional one-line note on what changed this update." }))
 });
 function createPlanState() {
 	return { current: [] };
@@ -29380,15 +29894,21 @@ registerExitHandlers(WORKTREE_REGISTRY);
 *  mode. */
 const DEFAULT_MODEL = "gpt-5.4-mini";
 const DEFAULT_THINKING = "xhigh";
-/** Default model for the READ-ONLY `explore` mode. `claude-sonnet-5` at `xhigh`
-*  (via `DEFAULT_THINKING`) — a strong, NATIVE (no-shim) tool-caller for repo
-*  research. Native Claude models run as workers over `/chat/completions`, the
-*  same path proven by `PLAN_DEFAULT_MODEL` (claude-opus-4.8). Like `implement`'s
-*  gpt-5.6-sol this is NOT a `workerToolsEnabled` gate input — if absent (e.g. a
-*  non-enterprise tier) `explore` errors helpfully at call time rather than
-*  vanishing the whole worker surface. The caller (the main model) overrides
-*  BOTH the model and the reasoning per call via the `model` / `thinking` args. */
-const EXPLORE_DEFAULT_MODEL = "claude-sonnet-5";
+/** Default model for the READ-ONLY `explore` mode. `gemini-3.6-flash` at `high`
+*  (via `EXPLORE_DEFAULT_THINKING`; flash advertises no xhigh) — a fast, cheap,
+*  1M-context tool-caller for read-only repo research. Routes over
+*  `/chat/completions` via the translation shim (the same proven path the
+*  `review` worker uses for gemini). Like `implement`'s gpt-5.6-sol this is NOT a
+*  `workerToolsEnabled` gate input — if absent (e.g. a non-enterprise tier)
+*  `explore` errors helpfully at call time rather than vanishing the whole worker
+*  surface. The caller (the main model) overrides BOTH the model and the reasoning
+*  per call via the `model` / `thinking` args — see the tier ladder (gpt-5.6-sol
+*  heavy / gpt-5.6-terra moderate / gemini-3.6-flash light) in the MCP tool desc. */
+const EXPLORE_DEFAULT_MODEL = "gemini-3.6-flash";
+/** Default thinking for `explore`. `high` (flash has no xhigh); explicit rather
+*  than inherited from `DEFAULT_THINKING` so the explore effort can't drift if the
+*  shared fallback changes. */
+const EXPLORE_DEFAULT_THINKING = "high";
 /** Default model + thinking for the READ-ONLY `review` mode.
 *  `gemini-3.1-pro-preview` at `xhigh` (clamped to `high` at call time — gemini
 *  advertises no xhigh). DELIBERATELY DECORRELATED FROM THE IMPLEMENTER: bounded
@@ -29410,6 +29930,10 @@ const REVIEW_DEFAULT_THINKING = "xhigh";
 *  autonomous implementation. An explicit `opts.model` still wins. */
 const IMPLEMENT_DEFAULT_MODEL = "gpt-5.6-sol";
 const IMPLEMENT_DEFAULT_THINKING = "xhigh";
+/** `test` starts with the same built-in pair as `implement`, but remains an
+* independent mode so either can be overridden without affecting the other. */
+const TEST_DEFAULT_MODEL = "gpt-5.6-sol";
+const TEST_DEFAULT_THINKING = "xhigh";
 /** Default model for `browse` mode. `gpt-5.4-mini` — the Gate-B-winning
 *  browse model (small + fast enough to drive a tab at human pace, with
 *  enough tool-calling discipline to terminate). This is DISTINCT from the
@@ -29429,14 +29953,53 @@ const BROWSE_DEFAULT_THINKING = "high";
 /** Default model + thinking for the read-only `plan` mode. `claude-opus-4.8`
 *  at `xhigh` — planning is the highest-leverage read-only step (the plan
 *  shapes everything downstream), so it gets the strongest reasoning model
-*  rather than the cheap `gemini-3.5-flash` explore default. Uses the DOTTED
+*  rather than the lightweight `gemini-3.6-flash` explore default. Uses the DOTTED
 *  Copilot catalog id (the worker resolver exact-matches `catalog.id`, it does
-*  NOT translate the Anthropic dashed slug). Falls back to a helpful
-*  unknown-model error at call time if opus-4.8 isn't in the catalog (e.g. a
-*  non-enterprise tier), exactly like `implement`'s `gpt-5.6-sol`. Caller's `model`
-*  arg still wins. */
-const PLAN_DEFAULT_MODEL = "claude-opus-4.8";
-const PLAN_DEFAULT_THINKING = "xhigh";
+*  NOT translate the Anthropic dashed slug; `claude-opus-5` is a single-segment
+*  slug so dotted == dashed). Falls back to a helpful unknown-model error at call
+*  time if opus-5 isn't in the catalog (e.g. a non-enterprise tier), exactly like
+*  `implement`'s `gpt-5.6-sol`. Caller's `model` arg still wins. */
+const PLAN_DEFAULT_MODEL = "claude-opus-5";
+const BUILT_IN_MODE_DEFAULTS = Object.freeze({
+	explore: {
+		model: EXPLORE_DEFAULT_MODEL,
+		thinking: EXPLORE_DEFAULT_THINKING
+	},
+	review: {
+		model: REVIEW_DEFAULT_MODEL,
+		thinking: REVIEW_DEFAULT_THINKING
+	},
+	plan: {
+		model: PLAN_DEFAULT_MODEL,
+		thinking: "xhigh"
+	},
+	implement: {
+		model: IMPLEMENT_DEFAULT_MODEL,
+		thinking: IMPLEMENT_DEFAULT_THINKING
+	},
+	test: {
+		model: TEST_DEFAULT_MODEL,
+		thinking: TEST_DEFAULT_THINKING
+	},
+	browse: {
+		model: BROWSE_DEFAULT_MODEL,
+		thinking: BROWSE_DEFAULT_THINKING
+	}
+});
+/** Resolve the effective mode ladder without changing the gate sentinel. */
+function resolveModeDefaults(mode, ignoreSessionDefaults = false) {
+	const builtIn = BUILT_IN_MODE_DEFAULTS[mode] ?? {
+		model: DEFAULT_MODEL,
+		thinking: DEFAULT_THINKING
+	};
+	const override = ignoreSessionDefaults ? {} : getWorkerSessionDefault(mode);
+	return {
+		model: override.model ?? builtIn.model,
+		thinking: override.thinking ?? builtIn.thinking,
+		modelSource: override.model === void 0 ? "built-in" : "override",
+		thinkingSource: override.thinking === void 0 ? "built-in" : "override"
+	};
+}
 /**
 * `Model<any>` shim used to satisfy `Agent.initialState.model` typing.
 *
@@ -29450,6 +30013,7 @@ const PLAN_DEFAULT_THINKING = "xhigh";
 * diagnostics (e.g. error-message AssistantMessage's `model` field
 * if Pi ever inspects it) faithful to what the caller asked for.
 */
+let agentOptionsObserverForTests;
 function makeModelShim(modelId) {
 	return {
 		id: modelId,
@@ -29487,6 +30051,34 @@ function extractAssistantText(content) {
 	for (const part of content) if (part.type === "text") out += part.text;
 	return out;
 }
+const MAX_EMPTY_OUTPUT_NUDGES = 3;
+const EMPTY_OUTPUT_NUDGES = [
+	"Summarize your findings so far.",
+	"Your previous reply was empty. Provide the answer now in plain text.",
+	"Reply with plain text only. Do not call any tool."
+];
+/**
+* Resolve the per-run nudge cap. Zero explicitly disables nudging; malformed,
+* negative, and fractional values fall back to the default.
+*/
+function resolveMaxEmptyOutputNudges() {
+	const raw = process$1.env.GH_ROUTER_WORKER_MAX_NUDGES;
+	if (raw === void 0 || raw === "") return MAX_EMPTY_OUTPUT_NUDGES;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed < 0 || !Number.isInteger(parsed)) return MAX_EMPTY_OUTPUT_NUDGES;
+	return parsed;
+}
+function emptyOutputNudge(attempt) {
+	return EMPTY_OUTPUT_NUDGES[Math.min(attempt, EMPTY_OUTPUT_NUDGES.length) - 1];
+}
+/** True only for a clean, empty assistant stop with no pending tool calls. */
+function shouldNudgeForEmptyOutput(message) {
+	if (message.role !== "assistant") return false;
+	const assistant = message;
+	if (assistant.stopReason !== "stop" || !Array.isArray(assistant.content)) return false;
+	if (assistant.content.some((part) => part.type === "toolCall")) return false;
+	return extractAssistantText(assistant.content).trim() === "";
+}
 /**
 * Trivial stub for the no-worktree path. `dir` is the workspace
 * itself; `finalize` returns an empty diff (the response text won't
@@ -29527,21 +30119,15 @@ async function runWorkerAgentOnce(opts) {
 		isError: true
 	};
 	try {
-		const isBrowse = opts.mode === "browse";
-		const isPlan = opts.mode === "plan";
-		const isReview = opts.mode === "review";
-		const isWriteCapable = opts.mode === "implement" || opts.mode === "test";
-		const isExplore = opts.mode === "explore";
-		const defaultModel = isBrowse ? BROWSE_DEFAULT_MODEL : isPlan ? PLAN_DEFAULT_MODEL : isReview ? REVIEW_DEFAULT_MODEL : isWriteCapable ? IMPLEMENT_DEFAULT_MODEL : isExplore ? EXPLORE_DEFAULT_MODEL : DEFAULT_MODEL;
-		const defaultThinking = isBrowse ? BROWSE_DEFAULT_THINKING : isPlan ? PLAN_DEFAULT_THINKING : isReview ? REVIEW_DEFAULT_THINKING : isWriteCapable ? IMPLEMENT_DEFAULT_THINKING : DEFAULT_THINKING;
 		const resolved = resolveModelAndThinking({
-			model: opts.model ?? defaultModel,
-			thinking: opts.thinking ?? defaultThinking
+			model: opts.model,
+			thinking: opts.thinking
 		});
 		if (!resolved.ok) return {
 			text: resolved.error,
 			isError: true
 		};
+		const isBrowse = opts.mode === "browse";
 		const ctxBudget = makeContextBudget(resolved.contextWindow);
 		const workspaceInput = opts.workspace ?? (isBrowse ? process$1.cwd() : void 0);
 		if (workspaceInput === void 0) return {
@@ -29581,7 +30167,7 @@ async function runWorkerAgentOnce(opts) {
 			getMessages,
 			planState
 		});
-		const agent = new Agent$1({
+		const agentOptions = {
 			initialState: {
 				systemPrompt: systemPromptFor(opts.mode),
 				model: makeModelShim(resolved.modelId),
@@ -29590,7 +30176,8 @@ async function runWorkerAgentOnce(opts) {
 			},
 			streamFn: createCopilotStreamFn({
 				resolved,
-				contextBudget: ctxBudget
+				contextBudget: ctxBudget,
+				modelCallTimeoutMs: resolveWorkerModelCallTimeoutMs()
 			}),
 			toolExecution: "parallel",
 			transformContext: async (messages) => {
@@ -29623,6 +30210,7 @@ async function runWorkerAgentOnce(opts) {
 					if (a.trim()) terminalText = a;
 				}
 			},
+			shouldStopAfterTurn: () => budget.hardStopReason !== null,
 			afterToolCall: async (ctx) => {
 				budget.recordToolBytes(ctx.result);
 				if (ctxBudget) {
@@ -29633,15 +30221,32 @@ async function runWorkerAgentOnce(opts) {
 			prepareNextTurn: async () => {
 				budget.addTurn();
 			}
-		});
+		};
+		agentOptionsObserverForTests?.(agentOptions);
+		const agent = new Agent$1(agentOptions);
 		agentHolder.agent = agent;
-		const abortHandler = () => agent?.abort();
-		if (opts.signal) if (opts.signal.aborted) agent.abort();
-		else opts.signal.addEventListener("abort", abortHandler, { once: true });
+		const abortHandler = () => agent.abort();
+		if (opts.signal) opts.signal.addEventListener("abort", abortHandler, { once: true });
 		let finalText = "";
 		let lastStopReason = null;
+		let nudgeCount = 0;
+		const maxEmptyOutputNudges = resolveMaxEmptyOutputNudges();
 		let terminalText = null;
 		const unsubscribe = agent.subscribe((event) => {
+			if (event.type === "turn_end") {
+				if (nudgeCount < maxEmptyOutputNudges && shouldNudgeForEmptyOutput(event.message)) {
+					nudgeCount += 1;
+					agent.followUp({
+						role: "user",
+						content: [{
+							type: "text",
+							text: emptyOutputNudge(nudgeCount)
+						}],
+						timestamp: Date.now()
+					});
+				}
+				return;
+			}
 			if (event.type !== "message_end") return;
 			const msg = event.message;
 			if (typeof msg !== "object" || msg === null) return;
@@ -29652,11 +30257,14 @@ async function runWorkerAgentOnce(opts) {
 			const sr = msg.stopReason;
 			if (typeof sr === "string") lastStopReason = sr;
 		});
+		let wallClockExpired = false;
 		const wallClockTimer = setTimeout(() => {
-			agent?.abort();
+			wallClockExpired = true;
+			agent.abort();
 		}, budget.config.maxWallClockMs);
 		wallClockTimer.unref?.();
 		try {
+			if (opts.signal?.aborted) throw new Error("[halted: cancelled]");
 			await agent.prompt(opts.prompt);
 			await agent.waitForIdle();
 			let diff = "";
@@ -29669,12 +30277,26 @@ async function runWorkerAgentOnce(opts) {
 				await ws.remove();
 			} catch {}
 			const text = isBrowse ? terminalText ?? finalText : diff ? `${finalText}\n\n${diff}` : finalText;
-			if (lastStopReason === "error") return {
-				text: [(terminalText ?? finalText).trim() || "Worker run failed before producing an answer — the model's input likely overflowed (a large tool result), or the upstream errored. Retry with a narrower task: target a specific section / file / element rather than reading everything at once.", diff].filter(Boolean).join("\n\n"),
+			if (lastStopReason === "error" || lastStopReason === "aborted") {
+				const diag = (terminalText ?? finalText).trim();
+				let diagnostic;
+				if (lastStopReason === "aborted") diagnostic = wallClockExpired ? "[halted: wallclock]" : "[halted: cancelled]";
+				else diagnostic = diag || "Worker run failed before producing an answer — the model's input likely overflowed (a large tool result), or the upstream errored. Retry with a narrower task: target a specific section / file / element rather than reading everything at once.";
+				return {
+					text: lastStopReason === "aborted" ? [
+						diag,
+						diff,
+						diagnostic
+					].filter(Boolean).join("\n\n") : [diagnostic, diff].filter(Boolean).join("\n\n"),
+					isError: true
+				};
+			}
+			if (budget.hardStopReason) return {
+				text: [text, `[halted: ${budget.hardStopReason}]`].filter(Boolean).join("\n\n"),
 				isError: true
 			};
 			if (!text.trim()) return {
-				text: `${NO_OUTPUT_PREFIX} (stopReason=${lastStopReason ?? "unknown"}, turns=${budget.turns}, elapsed=${budget.elapsedMs}ms)]`,
+				text: `${NO_OUTPUT_PREFIX} after ${nudgeCount} nudges (stopReason=${lastStopReason ?? "unknown"}, turns=${budget.turns}, elapsed=${budget.elapsedMs}ms)]; retry with a different model via worker_defaults, or narrow/split the task.`,
 				isError: true
 			};
 			return { text };
@@ -29708,42 +30330,21 @@ async function runWorkerAgentOnce(opts) {
 }
 /**
 * Prefix of the sentinel `runWorkerAgentOnce` returns when a worker stops
-* CLEANLY but emits no usable text — the model occasionally ends a turn right
-* after a tool call without summarizing. Stable so the retry wrapper can detect
-* exactly this case. Distinct from a budget cap (`WorkerAbort` → halt message),
-* a stream error (`stopReason="error"` → overflow/upstream diagnostic), and a
-* real failure — none of which carry this prefix, so none are retried.
+* cleanly but emits no usable text even after its bounded in-run nudges. Kept
+* stable for callers that recognize the existing sentinel shape.
 */
 const NO_OUTPUT_PREFIX = "[worker exited with no output";
-/** True iff `r` is the transient no-output sentinel (a clean stop with empty
-*  text), the one case worth a fresh retry. Keyed on the specific sentinel
-*  PREFIX, not on `isError` — so the retry can't be silently decoupled if the
-*  sentinel's error flag ever changes, and a real worker answer never begins
-*  with this string. */
-function isTransientNoOutput(r) {
-	return typeof r.text === "string" && r.text.startsWith(NO_OUTPUT_PREFIX);
-}
-/**
-* Run `runOnce`, and on the transient no-output sentinel retry EXACTLY ONCE with
-* a fresh run before surfacing it. Real errors, budget caps, and stream errors
-* are returned as-is (they have distinct, actionable messages and a retry would
-* not help). A consumed abort signal short-circuits the retry. If the retry also
-* produces no output, the ORIGINAL is returned (one is enough signal; the
-* failure isn't hidden). Extracted + injected for unit-testability.
-*/
-async function withNoOutputRetry(runOnce, opts) {
-	const first = await runOnce(opts);
-	if (!isTransientNoOutput(first) || opts.signal?.aborted) return first;
-	const second = await runOnce(opts);
-	return isTransientNoOutput(second) ? first : second;
+/** Public entry. Resolve model/thinking once, then run under one transcript and Budget. */
+function resolveWorkerRunOpts(opts) {
+	const defaults = resolveModeDefaults(opts.mode, opts.ignoreSessionDefaults === true);
+	return {
+		...opts,
+		model: opts.model ?? defaults.model,
+		thinking: opts.thinking ?? defaults.thinking
+	};
 }
-/**
-* Public entry: a worker run with a single transient-no-output retry. Wraps the
-* implementation (`runWorkerAgentOnce`); the signature is unchanged so every
-* caller (MCP dispatch, the orchestration runner) gets the retry for free.
-*/
 async function runWorkerAgent(opts) {
-	return withNoOutputRetry(runWorkerAgentOnce, opts);
+	return runWorkerAgentOnce(resolveWorkerRunOpts(opts));
 }
 /**
 * Test-only exports. The public surface of the engine is
@@ -29794,8 +30395,8 @@ const STAND_IN_MODELS = Object.freeze([
 		effort: "xhigh"
 	},
 	{
-		key: "claude-opus-4-7",
-		model: "claude-opus-4-7",
+		key: "claude-opus-5",
+		model: "claude-opus-5",
 		endpoint: "/v1/messages",
 		effort: "xhigh"
 	},
@@ -31891,7 +32492,8 @@ async function runWorkflowLive(opts) {
 				mode,
 				prompt,
 				workspace,
-				signal: opts.signal
+				signal: opts.signal,
+				ignoreSessionDefaults: true
 			});
 			return {
 				text: r.text,
@@ -32011,10 +32613,11 @@ function isMcpGroup(s) {
 * (handler.ts:handleToolsCallSSE). Claude Code's MCP HTTP client honors
 * `text/event-stream` responses without applying the ~60s per-tool-call
 * timer that previously broke xhigh on gpt-5.5 (~56s wall) and on
-* Anthropic Opus families (high+ thinking budgets). opus-critic itself
-* now runs on claude-opus-4-6 which doesn't advertise xhigh, so the
-* SSE long-tail concern there is moot; the SSE machinery still applies
-* to the other personas that do expose xhigh.
+* Anthropic Opus families (high+ thinking budgets). opus-critic caps its
+* exposed effort at `high` (its effective model can fall back to
+* claude-opus-4-6, which doesn't advertise xhigh), so the SSE long-tail
+* concern there is moot; the SSE machinery still applies to the other
+* personas that do expose xhigh.
 */
 const EFFORT_LEVELS = [
 	"low",
@@ -32147,7 +32750,7 @@ Reply format (markdown):
 
 Resilience reminder:
   If your session terminates abnormally before "Status: complete", the lead will retry once. On recovery, ask the lead to confirm what's already been done before re-applying changes — duplicate edits are worse than a slow restart.`;
-const OPUS_CRITIC_BASE = `You are opus-critic, a fresh-context same-lab adversarial reviewer running on Opus 4.6. The lead orchestrator that just delegated to you runs newer Opus-family context, but you are NOT the lead. You did not see the lead's reasoning trace. You only see the brief.
+const OPUS_CRITIC_BASE = `You are opus-critic, a fresh-context same-lab adversarial reviewer running on Opus 5. The lead orchestrator that just delegated to you runs Opus-family context too, but you are NOT the lead. You did not see the lead's reasoning trace. You only see the brief.
 
 Your job is to spot what the lead missed because of cognitive momentum, sunk-cost on a plan, or motivated reasoning toward a particular fix. Your blind-spot diversification is LIMITED compared to codex-critic (gpt-5.6-sol) and gemini-critic (gemini-3.1-pro), same lab, adjacent model family, related priors. Use that honestly: don't pretend to find a different perspective when the obvious read is "the lead got it right." Silence on good work is a valid and welcome answer.
 
@@ -32232,9 +32835,9 @@ const PERSONAS_READ = Object.freeze([
 	{
 		agentName: "opus-critic",
 		toolNameHttp: "opus_critic",
-		model: "claude-opus-4-6",
+		model: "claude-opus-5",
 		endpoint: "/v1/messages",
-		description: "Adversarial same-lab critic backed by fresh-context Opus 4.6, with limited blind-spot diversity compared with cross-lab critics. It reviews plans, designs, or code tradeoffs for cognitive momentum, sunk-cost reasoning, and confabulated assumptions, then returns a calibrated objection or no material objection. Use when a same-family sanity check can catch lead-context drift or when comparing against codex_critic / gemini_critic findings. Not a substitute for cross-lab review on security-sensitive or high-risk changes; use codex_critic or gemini_critic for stronger diversity. On enterprise catalogs that carry Opus-4.6-1M it runs with ≈936K input tokens; otherwise ≈168K. Pinned two minors behind the default Opus so the panel spans more of the version curve. Pass artifact verbatim.",
+		description: "Adversarial same-lab critic backed by fresh-context Opus 5, with limited blind-spot diversity compared with cross-lab critics. It reviews plans, designs, or code tradeoffs for cognitive momentum, sunk-cost reasoning, and confabulated assumptions, then returns a calibrated objection or no material objection. Use when a same-family sanity check can catch lead-context drift or when comparing against codex_critic / gemini_critic findings. Not a substitute for cross-lab review on security-sensitive or high-risk changes; use codex_critic or gemini_critic for stronger diversity. Runs with the full 1M-context Opus 5 window (native, no -1m sibling needed). Pass artifact verbatim.",
 		baseInstructions: OPUS_CRITIC_BASE,
 		agentPrompt: "",
 		writeCapable: false,
@@ -32383,7 +32986,7 @@ function buildPeerAwarenessSnippet(opts) {
 		criticList.push("`gemini_reviewer` (gemini-3.1-pro, line-level code review)");
 		criticList.push("`gemini_critic` (gemini-3.1-pro)");
 	}
-	criticList.push("`opus_critic` (Opus 4.6)");
+	criticList.push("`opus_critic` (Opus 5)");
 	const codexCliClause = opts.codexCli ? " `mcp__codex-cli__codex` dispatches to `codex-implementer` (gpt-5.3-codex with workspace-write) for end-to-end coding tasks." : "";
 	const para2Parts = [`\`mcp__${searchKey}__code\` is the one-stop code search (no extra model call). Its DEFAULT mode (or \`mode:"semantic"\`) ranks by MEANING via ColBERT over a per-workspace index, the first thing to reach for on intent/concept questions ("where is retry/backoff handled", "how does auth work"); when that index isn't ready it transparently falls back to lexical (the response \`source\` says which engine ran). Forced modes cover the rest: \`lexical\` (BM25F-ranked + tree-sitter, best for exact symbols), \`exact\`, \`regex\`, \`complete\` (exhaustive set), \`ast_pattern\`+\`ast_lang\` for multi-line AST shapes, \`scan\` for a whole-workspace symbol outline, \`multiline\` for cross-line regex. Multiple queries can run in a single turn. The index covers code-shaped files; for unstructured files (logs, \`.csv\`, \`.env*\`, config-only wiring), \`grep\`/\`glob\` still apply.`];
 	if (opts.workerToolsAvailable) para2Parts.push(`\`worker-*\` are background Agent subagents (subagent_type) that run the matching worker in its own context and deliver the result as a completion notification, so a long run never blocks the turn: \`worker-explore\` (read-only research), \`worker-review\` (reads the code to verify a change or claim), \`worker-plan\` (ordered implementation plan), \`worker-implement\` (edit/write/bash; ALWAYS runs in an isolated git worktree and returns the diff via a saved patch file; for in-place edits use the \`implementer\` subagent), \`worker-test\` (independent test author; also always worktree-isolated). The raw \`mcp__${workersKey}__*\` tools they call are guarded (a direct main-thread call is redirected to the matching agent); Workers themselves have \`code_search\`.`);
@@ -32460,6 +33063,15 @@ function formatWebSearchResult(results) {
 	const refsLine = results.references.map((r) => `- [${r.title}](${r.url})`).join("\n");
 	return `${results.content}\n\n## References\n${refsLine}`;
 }
+/**
+* Model-override tier ladder surfaced on the read-heavy workers
+* (explore / implement / review). The caller picks a model by task weight;
+* all three tiers are 1M-context, and `high` is the recommended reasoning
+* depth for the ladder (flash tops out at high; sol/terra go higher if the
+* caller wants). Appended to those tools' `model` param description so the
+* lead has actionable override guidance instead of a bare free string.
+*/
+const WORKER_TIER_GUIDANCE = " Override by task weight: `gpt-5.6-sol` (heavy/deep), `gpt-5.6-terra` (moderate), `gemini-3.6-flash` (light/cheap) — all 1M context; pair with thinking:'high'.";
 const NON_PERSONA_MCP_TOOLS = Object.freeze([
 	{
 		toolNameHttp: "web",
@@ -32647,11 +33259,84 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 			}
 		}
 	},
+	{
+		toolNameHttp: "worker_defaults",
+		group: "workers",
+		capability: "worker",
+		description: "Sets or clears process-wide worker model/reasoning defaults and returns the full effective table. Omit arguments to inspect current values. Per-call worker arguments still take precedence; values are in-memory and apply to every client served by this process.",
+		inputSchema: {
+			type: "object",
+			additionalProperties: false,
+			properties: {
+				mode: {
+					type: "string",
+					enum: WORKER_MODES,
+					description: "Worker mode to set or clear."
+				},
+				model: {
+					type: "string",
+					description: "Copilot catalog model id to use by default for the mode."
+				},
+				thinking: {
+					type: "string",
+					enum: WORKER_THINKING_LEVELS,
+					description: "Requested default reasoning level; clamped per run for the selected model."
+				},
+				clear: {
+					type: "boolean",
+					description: "When true, clears both overrides for the selected mode."
+				},
+				clearAll: {
+					type: "boolean",
+					description: "When true, clears overrides for every worker mode."
+				}
+			}
+		},
+		async handler(args) {
+			const mode = typeof args.mode === "string" && WORKER_MODES.includes(args.mode) ? args.mode : void 0;
+			const model = typeof args.model === "string" ? args.model : void 0;
+			const thinking = typeof args.thinking === "string" && WORKER_THINKING_LEVELS.includes(args.thinking) ? args.thinking : void 0;
+			const clear = args.clear === true;
+			const clearAll = args.clearAll === true;
+			if (args.mode !== void 0 && mode === void 0 || args.model !== void 0 && model === void 0 || args.thinking !== void 0 && thinking === void 0 || args.clear !== void 0 && typeof args.clear !== "boolean" || args.clearAll !== void 0 && typeof args.clearAll !== "boolean" || clearAll && (mode !== void 0 || model !== void 0 || thinking !== void 0 || args.clear !== void 0) || clear && (mode === void 0 || model !== void 0 || thinking !== void 0) || !clearAll && !clear && (model !== void 0 || thinking !== void 0) && mode === void 0) return {
+				content: [{
+					type: "text",
+					text: "worker_defaults: use mode with model/thinking or clear:true; clearAll:true must stand alone"
+				}],
+				isError: true
+			};
+			if (clearAll) resetAllWorkerSessionDefaults();
+			else if (clear && mode) resetWorkerSessionDefault(mode);
+			else if (mode && (model !== void 0 || thinking !== void 0)) {
+				const current = resolveModeDefaults(mode);
+				const validation = resolveModelAndThinking({
+					model: model ?? current.model,
+					thinking: thinking ?? current.thinking
+				});
+				if (!validation.ok) return {
+					content: [{
+						type: "text",
+						text: validation.error
+					}],
+					isError: true
+				};
+				setWorkerSessionDefault(mode, {
+					model,
+					thinking
+				});
+			}
+			const table = Object.fromEntries(WORKER_MODES.map((workerMode) => [workerMode, resolveModeDefaults(workerMode)]));
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(table)
+			}] };
+		}
+	},
 	{
 		toolNameHttp: "explore",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-explore` agent. Dispatch via the Agent tool (subagent_type: worker-explore) so the turn is never blocked; the result arrives as a completion notification. Read-only investigation by an autonomous worker (Pi runtime; default model `claude-sonnet-5` at xhigh reasoning, override via the `model` arg with any Copilot-catalog model that advertises `tool_calls`). It has read, glob, grep, semantic-first code search, web search, fetch_url, advisor, update_plan, and read-only toolbelt tools, and it returns a single text answer. Use for bounded research, repo discovery, dependency investigation, or multi-file reading that would otherwise consume the lead context window. Not for implementation, test authoring, or verification of a concrete diff; use implement, test, or review for those scopes. Brief the investigation goal and constraints, not step-by-step tool semantics.",
+		description: "Runs as the background `worker-explore` agent. Dispatch via the Agent tool (subagent_type: worker-explore) so the turn is never blocked; the result arrives as a completion notification. Read-only investigation by an autonomous worker (Pi runtime; default model `gemini-3.6-flash` at high reasoning, override via the `model` arg with any Copilot-catalog model that advertises `tool_calls`). It has read, glob, grep, semantic-first code search, web search, fetch_url, advisor, update_plan, and read-only toolbelt tools, and it returns a single text answer. Use for bounded research, repo discovery, dependency investigation, or multi-file reading that would otherwise consume the lead context window. Not for implementation, test authoring, or verification of a concrete diff; use implement, test, or review for those scopes. Brief the investigation goal and constraints, not step-by-step tool semantics.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -32663,19 +33348,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				model: {
 					type: "string",
-					description: "Optional Copilot catalog model id (defaults to claude-sonnet-5). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch."
+					description: "Optional Copilot catalog model id (defaults to gemini-3.6-flash). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch." + WORKER_TIER_GUIDANCE
 				},
 				thinking: {
 					type: "string",
-					enum: [
-						"off",
-						"minimal",
-						"low",
-						"medium",
-						"high",
-						"xhigh"
-					],
-					description: "Optional reasoning depth (default xhigh). Silently clamped to the model's allowed range; \"off\" drops the parameter entirely."
+					enum: WORKER_THINKING_LEVELS,
+					description: "Optional reasoning depth. Use worker_defaults to inspect the effective value. Silently clamped to the model's allowed range; \"off\" drops the parameter entirely."
 				},
 				workspace: {
 					type: "string",
@@ -32715,19 +33393,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				model: {
 					type: "string",
-					description: "Optional Copilot catalog model id (defaults to gpt-5.6-sol). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch."
+					description: "Optional Copilot catalog model id (defaults to gpt-5.6-sol). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch." + WORKER_TIER_GUIDANCE
 				},
 				thinking: {
 					type: "string",
-					enum: [
-						"off",
-						"minimal",
-						"low",
-						"medium",
-						"high",
-						"xhigh"
-					],
-					description: "Optional reasoning depth (default xhigh). Silently clamped to the model's allowed range; \"off\" drops the parameter entirely."
+					enum: WORKER_THINKING_LEVELS,
+					description: "Optional reasoning depth. Use worker_defaults to inspect the effective value. Silently clamped to the model's allowed range; \"off\" drops the parameter entirely."
 				},
 				workspace: {
 					type: "string",
@@ -32763,18 +33434,11 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				model: {
 					type: "string",
-					description: "Optional Copilot catalog model id (defaults to gemini-3.1-pro-preview). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch."
+					description: "Optional Copilot catalog model id (defaults to gemini-3.1-pro-preview). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch." + WORKER_TIER_GUIDANCE
 				},
 				thinking: {
 					type: "string",
-					enum: [
-						"off",
-						"minimal",
-						"low",
-						"medium",
-						"high",
-						"xhigh"
-					],
+					enum: WORKER_THINKING_LEVELS,
 					description: "Optional reasoning depth (defaults to xhigh, clamped to high for the default review model). Silently clamped to the model's allowed range; \"off\" drops the parameter entirely."
 				},
 				workspace: {
@@ -32799,7 +33463,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "plan",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-plan` agent. Dispatch via the Agent tool (subagent_type: worker-plan) so the turn is never blocked; the result arrives as a completion notification. Read-only implementation planning by an autonomous worker (Pi runtime; default model `claude-opus-4.8` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read-only toolset as explore and returns a concrete, ordered implementation plan covering files, approach, risks, and how acceptance criteria will be verified. Use before coding when the task needs repo-grounded sequencing or acceptance criteria translated into implementation steps. Not for editing files, running an implementation, writing tests, or adversarial review; use implement, test, or review for those scopes.",
+		description: "Runs as the background `worker-plan` agent. Dispatch via the Agent tool (subagent_type: worker-plan) so the turn is never blocked; the result arrives as a completion notification. Read-only implementation planning by an autonomous worker (Pi runtime; default model `claude-opus-5` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read-only toolset as explore and returns a concrete, ordered implementation plan covering files, approach, risks, and how acceptance criteria will be verified. Use before coding when the task needs repo-grounded sequencing or acceptance criteria translated into implementation steps. Not for editing files, running an implementation, writing tests, or adversarial review; use implement, test, or review for those scopes.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -32811,19 +33475,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				model: {
 					type: "string",
-					description: "Optional Copilot catalog model id (defaults to claude-opus-4.8). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch."
+					description: "Optional Copilot catalog model id (defaults to claude-opus-5). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch."
 				},
 				thinking: {
 					type: "string",
-					enum: [
-						"off",
-						"minimal",
-						"low",
-						"medium",
-						"high",
-						"xhigh"
-					],
-					description: "Optional reasoning depth (default xhigh). Silently clamped to the model's allowed range; \"off\" drops the parameter entirely."
+					enum: WORKER_THINKING_LEVELS,
+					description: "Optional reasoning depth. Use worker_defaults to inspect the effective value. Silently clamped to the model's allowed range; \"off\" drops the parameter entirely."
 				},
 				workspace: {
 					type: "string",
@@ -32867,15 +33524,8 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				thinking: {
 					type: "string",
-					enum: [
-						"off",
-						"minimal",
-						"low",
-						"medium",
-						"high",
-						"xhigh"
-					],
-					description: "Optional reasoning depth (default xhigh). Silently clamped to the model's allowed range; \"off\" drops the parameter entirely."
+					enum: WORKER_THINKING_LEVELS,
+					description: "Optional reasoning depth. Use worker_defaults to inspect the effective value. Silently clamped to the model's allowed range; \"off\" drops the parameter entirely."
 				},
 				workspace: {
 					type: "string",
@@ -33248,14 +33898,7 @@ async function runWorkerToolCall(call) {
 		isError: true
 	};
 	const thinkingRaw = args.thinking;
-	const ALLOWED_THINKING = [
-		"off",
-		"minimal",
-		"low",
-		"medium",
-		"high",
-		"xhigh"
-	];
+	const ALLOWED_THINKING = WORKER_THINKING_LEVELS;
 	let thinking;
 	if (thinkingRaw !== void 0) {
 		if (typeof thinkingRaw !== "string" || !ALLOWED_THINKING.includes(thinkingRaw)) return {
@@ -33568,5 +34211,5 @@ function enumerateInjectedMcpToolNames(groupKeys, opts = {}) {
 }
 
 //#endregion
-export { buildAdvisorStream as $, getPackageVersion as $t, trustRepo as A, readResponseBodyCapped as At, runWorkerAgent as B, ArtifactClient as Bt, fileLastPromptStore as C, getTokenCount as Ct, repoRoot as D, createResponses as Dt, repoFingerprint as E, pickEndpoint as Et, EXPLORE_DEFAULT_MODEL as F, extractTarGzMember as Ft, toolbeltEnabled as G, DEFAULT_CLAUDE_MODEL_FALLBACKS as Gt, buildEnv as H, buildWorkspaceHeaderJson as Ht, IMPLEMENT_DEFAULT_MODEL as I, extractZipMember as It, TOOLBELT_TOOLS$1 as J, DEFAULT_PORT as Jt, toolbeltSkipSet as K, DEFAULT_CODEX_MODEL as Kt, PLAN_DEFAULT_MODEL as L, CONDENSED_OPERATING_SEQUENCE as Lt, resolveSealedGate as M, provisionBrowserAssets as Mt, BROWSE_DEFAULT_MODEL as N, hasSupportedBrowserInstalled as Nt, stopGateEnabledForRepo as O, createChatCompletions as Ot, DEFAULT_MODEL as P, provisionAndIndexColbert as Pt, ADVISOR_TOOL_INSTRUCTIONS as Q, pickClaudeDefault as Qt, REVIEW_DEFAULT_MODEL as R, DEFINITION_OF_GREATNESS as Rt, fileFindingsStore as S, state as Sn, createMessages as St, isSubagentContext as T, resolveMcpToolTimeoutMs as Tt, availableToolCommands as U, collapsePathKeys as Ut, withNoOutputRetry as V, buildWorkspaceHeaderHelperCommand as Vt, buildToolbeltAwareness as W, toolbeltPathOverride as Wt, searchWeb as X, UPSTREAM_INACTIVITY_TIMEOUT_MS as Xt, assetFor as Y, UPSTREAM_FETCH_TIMEOUT_MS as Yt, ADVISOR_INTERNAL_TOOL_NAME as Z, generateRandomPort as Zt, stopGateDisabled as _, forwardError as _n, nativeSubagentModel as _t, buildPeerAwarenessSnippet as a, cacheCopilotVersion as an, logStreamError as at, stopReviewEnabled as b, copilotHeaders as bn, shimDefaultsToXhigh as bt, personasFor as c, filterBetaHeader as cn, handleMcpDelete as ct, buildStopHookCommand as d, resolveModel as dn, artifactToolsEnabled as dt, withInstallLock as en, injectAdvisorTool as et, captureLaunchBaseline as f, sleep as fn, browseAgentEnabled as ft, launchBaselineKey as g, HTTPError as gn, geminiAvailable as gt, injectStopHookIntoSettingsFile as h, fetchWithTransientRetry as hn, fleetToolsEnabled as ht, buildAgentPrompt as i, tryRefreshAndRetry as in, isControllerClosedError as it, liveExec as j, parseJsonOrDiagnose as jt, stopReviewStateDir as k, MAX_RESPONSE_BODY_BYTES as kt, buildArtifactOpenHookCommand as l, isNullish as ln, handleMcpPost as lt, fileBlockBudget as m, getGitHubUser as mn, browserToolsEnabled as mt, MCP_GROUPS as n, setupGitHubAgentToken as nn, buildAnthropicErrorEvent as nt, buildPeerAwarenessSummary as o, cacheModels as on, readIteratorWithTimeout as ot, decideStopHook as p, getModels as pn, browserCompoundToolsEnabled as pt, vscodeRipgrepPath as q, DEFAULT_CODEX_MODEL_FALLBACKS as qt, assertMcpToolSurfaceConsistent as r, setupGitHubToken as rn, buildOpenAIErrorEvent as rt, enumerateInjectedMcpToolNames as s, cacheVSCodeVersion as sn, relayAnthropicStream as st, GROUP_META as t, setupCopilotToken as tn, isAdvisorRequested as tt, buildSessionBindHookCommand as u, resolveCodexModel as un, agentToolsEnabled as ut, stopGateId as v, GITHUB_API_BASE_URL as vn, standInToolEnabled as vt, fileReviewDebounce as w, assembleResponsesPayload as wt, fileBaselineStore as x, githubHeaders as xn, countTokens as xt, stopGatePlanMode as y, copilotBaseUrl as yn, workerToolsEnabled as yt, appendPlanReminder as z, shouldUseInsecureTls as zt };
-//# sourceMappingURL=peer-mcp-personas-C1RegCRs.js.map
+export { searchWeb as $, UPSTREAM_FETCH_TIMEOUT_MS as $t, trustRepo as A, createResponses as At, TEST_DEFAULT_MODEL as B, warmTreeSitterPool as Bt, fileLastPromptStore as C, copilotBaseUrl as Cn, shimDefaultsToXhigh as Ct, repoRoot as D, assembleResponsesPayload as Dt, repoFingerprint as E, state as En, getTokenCount as Et, EXPLORE_DEFAULT_MODEL as F, provisionBrowserAssets as Ft, buildEnv as G, buildWorkspaceHeaderHelperCommand as Gt, resolveModeDefaults as H, DEFINITION_OF_GREATNESS as Ht, EXPLORE_DEFAULT_THINKING as I, hasSupportedBrowserInstalled as It, toolbeltEnabled as J, toolbeltPathOverride as Jt, availableToolCommands as K, buildWorkspaceHeaderJson as Kt, IMPLEMENT_DEFAULT_MODEL as L, provisionAndIndexColbert as Lt, resolveSealedGate as M, MAX_RESPONSE_BODY_BYTES as Mt, BROWSE_DEFAULT_MODEL as N, readResponseBodyCapped as Nt, stopGateEnabledForRepo as O, resolveMcpToolTimeoutMs as Ot, DEFAULT_MODEL as P, parseJsonOrDiagnose as Pt, assetFor as Q, DEFAULT_PORT as Qt, PLAN_DEFAULT_MODEL as R, extractTarGzMember as Rt, fileFindingsStore as S, GITHUB_API_BASE_URL as Sn, workerToolsEnabled as St, isSubagentContext as T, githubHeaders as Tn, createMessages as Tt, resolveWorkerRunOpts as U, shouldUseInsecureTls as Ut, appendPlanReminder as V, CONDENSED_OPERATING_SEQUENCE as Vt, runWorkerAgent as W, ArtifactClient as Wt, vscodeRipgrepPath as X, DEFAULT_CODEX_MODEL as Xt, toolbeltSkipSet as Y, DEFAULT_CLAUDE_MODEL_FALLBACKS as Yt, TOOLBELT_TOOLS$1 as Z, DEFAULT_CODEX_MODEL_FALLBACKS as Zt, stopGateDisabled as _, getModels as _n, browserToolsEnabled as _t, buildPeerAwarenessSnippet as a, setupCopilotToken as an, buildAnthropicErrorEvent as at, stopReviewEnabled as b, HTTPError as bn, nativeSubagentModel as bt, personasFor as c, tryRefreshAndRetry as cn, logStreamError as ct, buildStopHookCommand as d, cacheVSCodeVersion as dn, handleMcpDelete as dt, UPSTREAM_INACTIVITY_TIMEOUT_MS as en, ADVISOR_INTERNAL_TOOL_NAME as et, captureLaunchBaseline as f, filterBetaHeader as fn, handleMcpPost as ft, launchBaselineKey as g, sleep as gn, browserCompoundToolsEnabled as gt, injectStopHookIntoSettingsFile as h, resolveModel as hn, browseAgentEnabled as ht, buildAgentPrompt as i, withInstallLock as in, isAdvisorRequested as it, liveExec as j, createChatCompletions as jt, stopReviewStateDir as k, pickEndpoint as kt, buildArtifactOpenHookCommand as l, cacheCopilotVersion as ln, readIteratorWithTimeout as lt, fileBlockBudget as m, resolveCodexModel as mn, artifactToolsEnabled as mt, MCP_GROUPS as n, pickClaudeDefault as nn, buildAdvisorStream as nt, buildPeerAwarenessSummary as o, setupGitHubAgentToken as on, buildOpenAIErrorEvent as ot, decideStopHook as p, isNullish as pn, agentToolsEnabled as pt, buildToolbeltAwareness as q, collapsePathKeys as qt, assertMcpToolSurfaceConsistent as r, getPackageVersion as rn, injectAdvisorTool as rt, enumerateInjectedMcpToolNames as s, setupGitHubToken as sn, isControllerClosedError as st, GROUP_META as t, generateRandomPort as tn, ADVISOR_TOOL_INSTRUCTIONS as tt, buildSessionBindHookCommand as u, cacheModels as un, relayAnthropicStream as ut, stopGateId as v, getGitHubUser as vn, fleetToolsEnabled as vt, fileReviewDebounce as w, copilotHeaders as wn, countTokens as wt, fileBaselineStore as x, forwardError as xn, standInToolEnabled as xt, stopGatePlanMode as y, fetchWithTransientRetry as yn, geminiAvailable as yt, REVIEW_DEFAULT_MODEL as z, extractZipMember as zt };
+//# sourceMappingURL=peer-mcp-personas-BKwMCOsl.js.map