github-router 0.3.240 → 0.3.241

package/dist/main.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
-import { $ as searchWeb, $t as DEFAULT_CLAUDE_MODEL_FALLBACKS, A as trustRepo, An as state, At as getTokenCount, Bt as hasSupportedBrowserInstalled, C as fileLastPromptStore, Cn as fetchWithTransientRetry, Ct as scoutModel, D as repoRoot, Dn as copilotBaseUrl, Dt as shimDefaultsToXhigh, E as repoFingerprint, En as GITHUB_API_BASE_URL, Et as workerToolsEnabled, Ft as createChatCompletions, G as buildEnv, Gt as CONDENSED_OPERATING_SEQUENCE, Ht as extractTarGzMember, It as MAX_RESPONSE_BODY_BYTES, J as toolbeltEnabled, Jt as ArtifactClient, K as availableToolCommands, Kt as DEFINITION_OF_GREATNESS, Lt as readResponseBodyCapped, M as resolveSealedGate, Mt as resolveMcpToolTimeoutMs, Nt as pickEndpoint, O as stopGateEnabledForRepo, On as copilotHeaders, Ot as countTokens, Pt as createResponses, Q as assetFor, Qt as toolbeltPathOverride, Rt as parseJsonOrDiagnose, S as fileFindingsStore, Sn as getGitHubUser, St as reviewerModel, T as isSubagentContext, Tn as forwardError, Tt as standInToolEnabled, Ut as extractZipMember, Vt as provisionAndIndexColbert, Wt as warmTreeSitterPool, X as vscodeRipgrepPath, Xt as buildWorkspaceHeaderJson, Y as toolbeltSkipSet, Yt as buildWorkspaceHeaderHelperCommand, Z as TOOLBELT_TOOLS, Zt as collapsePathKeys, _ as stopGateDisabled, _n as isNullish, _t as browserCompoundToolsEnabled, a as buildPeerAwarenessSnippet, an as generateRandomPort, at as buildAnthropicErrorEvent, b as stopReviewEnabled, bn as sleep$1, bt as geminiAvailable, c as personasFor, cn as withInstallLock, ct as logStreamError, d as buildStopHookCommand, dn as setupGitHubToken, dt as handleMcpDelete, en as DEFAULT_CODEX_MODEL, et as ADVISOR_INTERNAL_TOOL_NAME, f as captureLaunchBaseline, fn as tryRefreshAndRetry, ft as handleMcpPost, g as launchBaselineKey, gn as filterBetaHeader, gt as browseAgentEnabled, h as injectStopHookIntoSettingsFile, hn as cacheVSCodeVersion, ht as brainstormModel, i as buildAgentPrompt, in as UPSTREAM_INACTIVITY_TIMEOUT_MS, it as isAdvisorRequested, j as liveExec, jt as assembleResponsesPayload, k as stopReviewStateDir, kn as githubHeaders, kt as createMessages, l as buildArtifactOpenHookCommand, ln as setupCopilotToken, lt as readIteratorWithTimeout, m as fileBlockBudget, mn as cacheModels, mt as artifactToolsEnabled, n as MCP_GROUPS, nn as DEFAULT_PORT, nt as buildAdvisorStream, o as buildPeerAwarenessSummary, on as pickClaudeDefault, ot as buildOpenAIErrorEvent, p as decideStopHook, pn as cacheCopilotVersion, pt as agentToolsEnabled, q as buildToolbeltAwareness, qt as shouldUseInsecureTls, r as assertMcpToolSurfaceConsistent, rn as UPSTREAM_FETCH_TIMEOUT_MS, rt as injectAdvisorTool, s as enumerateInjectedMcpToolNames, sn as getPackageVersion, st as isControllerClosedError, t as GROUP_META, tn as DEFAULT_CODEX_MODEL_FALLBACKS, tt as ADVISOR_TOOL_INSTRUCTIONS, u as buildSessionBindHookCommand, un as setupGitHubAgentToken, ut as relayAnthropicStream, v as stopGateId, vn as resolveCodexModel, vt as browserToolsEnabled, w as fileReviewDebounce, wn as HTTPError, wt as scribeModel, x as fileBaselineStore, xn as getModels, xt as nativeSubagentModel, y as stopGatePlanMode, yn as resolveModel, yt as fleetToolsEnabled, zt as provisionBrowserAssets } from "./peer-mcp-personas-CDja7arT.js";
-import { a as isUnderClaudeConfigMirror, d as writeRuntimeFileSecure, i as ensurePaths, o as removeOwnClaudeConfigMirror, r as ensureClaudeConfigMirror, t as PATHS, u as writeArtifactCredsToMirror } from "./paths-Srxs-aR-.js";
-import { c as killManagedTree, d as resolveExecutable, f as runCommandCapture, l as parseBoolEnv, p as runCommandVoid, s as killChildProcessTree, u as parseIntEnv } from "./lifecycle-C-9_vhyM.js";
-import { a as sweepRegistry } from "./lifecycle-Cuuj40CW.js";
+import { $ as searchWeb, $t as DEFAULT_CLAUDE_MODEL_FALLBACKS, A as trustRepo, An as state, At as getTokenCount, Bt as hasSupportedBrowserInstalled, C as fileLastPromptStore, Cn as fetchWithTransientRetry, Ct as scoutModel, D as repoRoot, Dn as copilotBaseUrl, Dt as shimDefaultsToXhigh, E as repoFingerprint, En as GITHUB_API_BASE_URL, Et as workerToolsEnabled, Ft as createChatCompletions, G as buildEnv, Gt as CONDENSED_OPERATING_SEQUENCE, Ht as extractTarGzMember, It as MAX_RESPONSE_BODY_BYTES, J as toolbeltEnabled, Jt as ArtifactClient, K as availableToolCommands, Kt as DEFINITION_OF_GREATNESS, Lt as readResponseBodyCapped, M as resolveSealedGate, Mt as resolveMcpToolTimeoutMs, Nt as pickEndpoint, O as stopGateEnabledForRepo, On as copilotHeaders, Ot as countTokens, Pt as createResponses, Q as assetFor, Qt as toolbeltPathOverride, Rt as parseJsonOrDiagnose, S as fileFindingsStore, Sn as getGitHubUser, St as reviewerModel, T as isSubagentContext, Tn as forwardError, Tt as standInToolEnabled, Ut as extractZipMember, Vt as provisionAndIndexColbert, Wt as warmTreeSitterPool, X as vscodeRipgrepPath, Xt as buildWorkspaceHeaderJson, Y as toolbeltSkipSet, Yt as buildWorkspaceHeaderHelperCommand, Z as TOOLBELT_TOOLS, Zt as collapsePathKeys, _ as stopGateDisabled, _n as isNullish, _t as browserCompoundToolsEnabled, a as buildPeerAwarenessSnippet, an as generateRandomPort, at as buildAnthropicErrorEvent, b as stopReviewEnabled, bn as sleep$1, bt as geminiAvailable, c as personasFor, cn as withInstallLock, ct as logStreamError, d as buildStopHookCommand, dn as setupGitHubToken, dt as handleMcpDelete, en as DEFAULT_CODEX_MODEL, et as ADVISOR_INTERNAL_TOOL_NAME, f as captureLaunchBaseline, fn as tryRefreshAndRetry, ft as handleMcpPost, g as launchBaselineKey, gn as filterBetaHeader, gt as browseAgentEnabled, h as injectStopHookIntoSettingsFile, hn as cacheVSCodeVersion, ht as brainstormModel, i as buildAgentPrompt, in as UPSTREAM_INACTIVITY_TIMEOUT_MS, it as isAdvisorRequested, j as liveExec, jt as assembleResponsesPayload, k as stopReviewStateDir, kn as githubHeaders, kt as createMessages, l as buildArtifactOpenHookCommand, ln as setupCopilotToken, lt as readIteratorWithTimeout, m as fileBlockBudget, mn as cacheModels, mt as artifactToolsEnabled, n as MCP_GROUPS, nt as buildAdvisorStream, o as buildPeerAwarenessSummary, on as pickClaudeDefault, ot as buildOpenAIErrorEvent, p as decideStopHook, pn as cacheCopilotVersion, pt as agentToolsEnabled, q as buildToolbeltAwareness, qt as shouldUseInsecureTls, r as assertMcpToolSurfaceConsistent, rn as UPSTREAM_FETCH_TIMEOUT_MS, rt as injectAdvisorTool, s as enumerateInjectedMcpToolNames, sn as getPackageVersion$1, st as isControllerClosedError, t as GROUP_META, tn as DEFAULT_CODEX_MODEL_FALLBACKS, tt as ADVISOR_TOOL_INSTRUCTIONS, u as buildSessionBindHookCommand, un as setupGitHubAgentToken, ut as relayAnthropicStream, v as stopGateId, vn as resolveCodexModel, vt as browserToolsEnabled, w as fileReviewDebounce, wn as HTTPError, wt as scribeModel, x as fileBaselineStore, xn as getModels, xt as nativeSubagentModel, y as stopGatePlanMode, yn as resolveModel, yt as fleetToolsEnabled, zt as provisionBrowserAssets } from "./peer-mcp-personas-r_UmLBkJ.js";
+import { a as isUnderClaudeConfigMirror, d as writeRuntimeFileSecure, i as ensurePaths, o as removeOwnClaudeConfigMirror, r as ensureClaudeConfigMirror, t as PATHS, u as writeArtifactCredsToMirror } from "./paths-BjTMI_xK.js";
+import { c as killManagedTree, d as resolveExecutable, f as runCommandCapture, l as parseBoolEnv, p as runCommandVoid, s as killChildProcessTree, u as parseIntEnv } from "./lifecycle-DHZsVN8j.js";
+import { a as sweepRegistry } from "./lifecycle-CUf1UDrH.js";
 import { defineCommand, runMain } from "citty";
 import consola from "consola";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import fs, { chmod, copyFile, link, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import os, { homedir, tmpdir } from "node:os";
-import * as nodePath$1 from "node:path";
-import nodePath from "node:path";
+import * as nodePath from "node:path";
+import path from "node:path";
 import process$1 from "node:process";
 import { execFileSync, spawn } from "node:child_process";
 import * as fs$2 from "node:fs";
@@ -24,7 +24,6 @@ import { cors } from "hono/cors";
 import { Marked } from "marked";
 import http from "node:http";
 import clipboard from "clipboardy";
-
 //#region src/auth.ts
 async function runAuth(options) {
 	if (options.verbose) {
@@ -61,7 +60,6 @@ const auth = defineCommand({
 		});
 	}
 });
-
 //#endregion
 //#region src/services/github/get-copilot-usage.ts
 const getCopilotUsage = async () => {
@@ -69,7 +67,6 @@ const getCopilotUsage = async () => {
 	if (!response.ok) throw new HTTPError("Failed to get Copilot usage", response);
 	return await response.json();
 };
-
 //#endregion
 //#region src/check-usage.ts
 const checkUsage = defineCommand({
@@ -87,13 +84,13 @@ const checkUsage = defineCommand({
 			const premiumUsed = premiumTotal - premium.remaining;
 			const premiumPercentUsed = premiumTotal > 0 ? premiumUsed / premiumTotal * 100 : 0;
 			const premiumPercentRemaining = premium.percent_remaining;
-			function summarizeQuota(name$1, snap) {
-				if (!snap) return `${name$1}: N/A`;
+			function summarizeQuota(name, snap) {
+				if (!snap) return `${name}: N/A`;
 				const total = snap.entitlement;
 				const used = total - snap.remaining;
 				const percentUsed = total > 0 ? used / total * 100 : 0;
 				const percentRemaining = snap.percent_remaining;
-				return `${name$1}: ${used}/${total} used (${percentUsed.toFixed(1)}% used, ${percentRemaining.toFixed(1)}% remaining)`;
+				return `${name}: ${used}/${total} used (${percentUsed.toFixed(1)}% used, ${percentRemaining.toFixed(1)}% remaining)`;
 			}
 			const premiumLine = `Premium: ${premiumUsed}/${premiumTotal} used (${premiumPercentUsed.toFixed(1)}% used, ${premiumPercentRemaining.toFixed(1)}% remaining)`;
 			const chatLine = summarizeQuota("Chat", usage.quota_snapshots.chat);
@@ -105,7 +102,6 @@ const checkUsage = defineCommand({
 		}
 	}
 });
-
 //#endregion
 //#region src/lib/claude-version-check.ts
 const NPM_PACKAGE$1 = "@anthropic-ai/claude-code";
@@ -115,7 +111,7 @@ const CLAUDE_VERSION_TIMEOUT_MS = 3e3;
 const NPM_INSTALL_TIMEOUT_MS = 12e4;
 /** Path to the throttle cache. Created on demand. */
 function cacheFilePath$1() {
-	return nodePath.join(os.homedir(), ".local", "share", "github-router", "last-update-check");
+	return path.join(os.homedir(), ".local", "share", "github-router", "last-update-check");
 }
 /**
 * Read the throttle cache. Returns null on missing/corrupt file —
@@ -133,7 +129,7 @@ async function readCache$1() {
 }
 async function writeCache$1(cache) {
 	try {
-		await fs.mkdir(nodePath.dirname(cacheFilePath$1()), { recursive: true });
+		await fs.mkdir(path.dirname(cacheFilePath$1()), { recursive: true });
 		await fs.writeFile(cacheFilePath$1(), JSON.stringify(cache), { mode: 384 });
 	} catch (err) {
 		consola.debug("Failed to write claude version-check cache:", err);
@@ -309,14 +305,29 @@ async function updateClaude(latestVersion, deps = {}) {
 		consola.success(`${NPM_PACKAGE$1} updated to ${latestVersion}`);
 	})) consola.debug("Claude Code update already in progress in another process; skipping.");
 }
-
 //#endregion
 //#region src/lib/self-update.ts
+/**
+* Self-update for the `github-router` proxy.
+*
+* The proxy is a *running* process, so updating its own global install
+* in place (`npm install -g github-router@latest`) deletes/overwrites
+* files the OS holds open — on Windows that fails deterministically
+* (EPERM/EBUSY) and can corrupt the install. So we never install in
+* place: when a newer version exists we spawn a **detached updater that
+* waits for this process to exit**, then installs. The update takes
+* effect on the next launch — no re-exec, no restart prompt.
+*
+* Best-effort throughout: every failure is swallowed to debug/warn and
+* never blocks startup. The startup probe is bounded and the install is
+* off the critical path (detached), so even a blackholed network can't
+* delay the proxy from serving.
+*/
 const NPM_PACKAGE = "github-router";
 const THROTTLE_HOURS = 1;
 const NPM_VIEW_TIMEOUT_MS = 5e3;
 function cacheFilePath() {
-	return nodePath.join(os.homedir(), ".local", "share", "github-router", "last-self-update-check");
+	return path.join(os.homedir(), ".local", "share", "github-router", "last-self-update-check");
 }
 async function readCache() {
 	try {
@@ -329,7 +340,7 @@ async function readCache() {
 }
 async function writeCache(cache) {
 	try {
-		await fs.mkdir(nodePath.dirname(cacheFilePath()), { recursive: true });
+		await fs.mkdir(path.dirname(cacheFilePath()), { recursive: true });
 		await fs.writeFile(cacheFilePath(), JSON.stringify(cache), { mode: 384 });
 	} catch (err) {
 		consola.debug("Failed to write self-update cache:", err);
@@ -406,7 +417,7 @@ async function runSelfUpdate(opts) {
 	try {
 		const cache = await readCache();
 		if (!opts.force && !shouldCheckNow(cache)) return;
-		const installed = getPackageVersion();
+		const installed = getPackageVersion$1();
 		if (installed === "unknown") return;
 		const npmPath = resolveExecutable("npm");
 		if (!npmPath) return;
@@ -424,10 +435,40 @@ async function runSelfUpdate(opts) {
 		consola.debug("Self-update check failed:", err);
 	}
 }
-
 //#endregion
 //#region src/lib/process-guard/index.ts
 /**
+* Crash-safe process guard (POSIX only).
+*
+* If the proxy dies WITHOUT running its own shutdown handlers (hard crash,
+* SIGKILL, OOM), nothing in `cleanup()` runs to reap the launched CLI's
+* process tree. This guard is the last-resort net for that case.
+*
+* Platform split:
+*   - **Windows: no guard needed.** Node assigns each child to a Job
+*     Object with `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE`, so when the proxy
+*     dies (any cause) the OS tears down the whole descendant tree —
+*     verified: force-killing a Node parent kills child AND grandchild.
+*     `startProcessGuard` is a no-op on win32.
+*   - **POSIX: a detached `node -e` reaper.** There is no job-object
+*     equivalent (a killed parent's children reparent to init), so we
+*     spawn a detached watchdog that learns of proxy death via an inherited
+*     stdin PIPE EOF (the proxy holds the write end; the OS closes it on
+*     proxy death) and reaps the CLI's process group.
+*
+* Never kill the WRONG process: if the child's PID/PGID was recycled after
+* the child exited, a blind `kill(-pid)` could hit an innocent group. The
+* reaper snapshots the child's process start-time at startup and, on proxy
+* death, kills ONLY if the live PID's start-time still matches. A mismatch
+* / unreadable probe → skip (fail-safe). We never trade an orphan-leak for
+* killing the user's work.
+*
+* The reaper is detached + unref'd so it survives the proxy's SIGKILL, and
+* self-exits once it has acted (or after a 24h cap) so it can never become
+* the orphan it exists to prevent. Opt out with
+* `GH_ROUTER_DISABLE_PROCESS_GUARD=1`.
+*/
+/**
 * Live reaper children, held so the GC can't collect the `ChildProcess`
 * (and with it the stdin write-end that is the proxy-death signal) while
 * the proxy runs. Entries self-remove on the reaper's exit. We do NOT
@@ -538,7 +579,6 @@ function startProcessGuard(child) {
 	if (process$1.platform === "win32") return;
 	spawnNodeReaper(pid, true);
 }
-
 //#endregion
 //#region src/lib/stripped-env-keys.ts
 /**
@@ -589,7 +629,6 @@ const STRIPPED_AUTH_ROUTING_ENV_KEYS = [
 	"AIORDIE_TOKEN",
 	"AIORDIE_INSECURE_TLS"
 ];
-
 //#endregion
 //#region src/lib/launch.ts
 /**
@@ -616,9 +655,9 @@ function sanitizeParentEnv(parent) {
 	for (const key of STRIPPED_PARENT_ENV_KEYS) delete sanitized[key];
 	return sanitized;
 }
-function commandExists(name$1) {
+function commandExists(name) {
 	try {
-		execFileSync(process$1.platform === "win32" ? "where.exe" : "which", [name$1], { stdio: "ignore" });
+		execFileSync(process$1.platform === "win32" ? "where.exe" : "which", [name], { stdio: "ignore" });
 		return true;
 	} catch {
 		return false;
@@ -637,7 +676,7 @@ function commandExists(name$1) {
 * installed fails with a spurious "not found on PATH".
 */
 function isExecutableAvailable(executable) {
-	if (nodePath.isAbsolute(executable)) return existsSync(executable);
+	if (path.isAbsolute(executable)) return existsSync(executable);
 	return commandExists(executable);
 }
 /**
@@ -683,10 +722,10 @@ function getCodexVersion() {
 	};
 	const major = Number.parseInt(m[1], 10);
 	const minor = Number.parseInt(m[2], 10);
-	const version$2 = `${m[1]}.${m[2]}.${m[3]}`;
+	const version = `${m[1]}.${m[2]}.${m[3]}`;
 	return {
 		ok: major > 0 || major === 0 && minor >= 129,
-		version: version$2
+		version
 	};
 }
 /**
@@ -704,7 +743,7 @@ function getCodexVersion() {
 function buildCodexCmd(target) {
 	const cmd = ["codex"];
 	if (target.serverUrl) cmd.push(...buildCodexProviderConfigFlags(target.serverUrl));
-	cmd.push("--sandbox", "workspace-write", "--ask-for-approval", "on-request", "-m", target.model ?? DEFAULT_CODEX_MODEL, ...target.extraArgs);
+	cmd.push("--sandbox", "workspace-write", "--ask-for-approval", "on-request", "-m", target.model ?? "gpt-5.6-sol", ...target.extraArgs);
 	return cmd;
 }
 function buildLaunchCommand(target) {
@@ -733,10 +772,10 @@ function buildLaunchCommand(target) {
 * intermediary to orphan its node/MCP grandchildren on a kill.
 */
 function windowsLaunchNeedsShell(executable) {
-	const ext = nodePath.extname(executable).toLowerCase();
+	const ext = path.extname(executable).toLowerCase();
 	return ext === ".cmd" || ext === ".bat";
 }
-function launchChild(target, server$1, options = {}) {
+function launchChild(target, server, options = {}) {
 	const { cmd, env } = buildLaunchCommand(target);
 	const executable = cmd[0];
 	if (!isExecutableAvailable(executable)) {
@@ -747,12 +786,14 @@ function launchChild(target, server$1, options = {}) {
 	}
 	let child;
 	try {
-		if (process$1.platform === "win32") if (windowsLaunchNeedsShell(cmd[0])) child = spawn(cmd.map((a) => a.includes(" ") ? `"${a}"` : a).join(" "), [], {
-			env,
-			stdio: "inherit",
-			shell: true
-		});
-		else child = spawn(cmd[0], cmd.slice(1), {
+		if (process$1.platform === "win32") if (windowsLaunchNeedsShell(cmd[0])) {
+			const quoted = cmd.map((a) => a.includes(" ") ? `"${a}"` : a).join(" ");
+			child = spawn(quoted, [], {
+				env,
+				stdio: "inherit",
+				shell: true
+			});
+		} else child = spawn(cmd[0], cmd.slice(1), {
 			env,
 			stdio: "inherit"
 		});
@@ -765,7 +806,7 @@ function launchChild(target, server$1, options = {}) {
 		const msg = `Failed to launch ${executable}: ${error instanceof Error ? error.message : String(error)}`;
 		consola.error(msg);
 		process$1.stderr.write(msg + "\n");
-		server$1.close(true).catch(() => {});
+		server.close(true).catch(() => {});
 		if (options.onShutdown) Promise.resolve(options.onShutdown()).catch(() => {});
 		process$1.exit(1);
 	}
@@ -780,7 +821,7 @@ function launchChild(target, server$1, options = {}) {
 			killChildProcessTree(child, { detachedGroup: process$1.platform !== "win32" });
 		} catch {}
 		try {
-			await server$1.close(true);
+			await server.close(true);
 		} catch {}
 		if (options.onShutdown) try {
 			await options.onShutdown();
@@ -830,7 +871,6 @@ function launchChild(target, server$1, options = {}) {
 		cleanup().then(() => exit(1)).catch(() => exit(1));
 	});
 }
-
 //#endregion
 //#region src/lib/worker-dispatch.ts
 /**
@@ -883,8 +923,7 @@ const ALL_WORKER_DISPATCH_MODES = [...CORE_WORKER_MODES, BROWSE_WORKER_MODE];
 function dispatcherAgentName(mode) {
 	return `worker-${mode}`;
 }
-/** Every possible dispatcher subagent name (used by the stale-`.md` sweep). */
-const ALL_DISPATCHER_AGENT_NAMES = ALL_WORKER_DISPATCH_MODES.map(dispatcherAgentName);
+ALL_WORKER_DISPATCH_MODES.map(dispatcherAgentName);
 /** The MCP tool name the workers server exposes for a mode under the resolved key. */
 function workerToolName(workersKey, mode) {
 	return `mcp__${workersKey}__${mode}`;
@@ -1051,7 +1090,6 @@ function parseModesCsv(csv) {
 	const out = csv.split(",").map((s) => s.trim()).filter((s) => known.has(s));
 	return out.length > 0 ? out : [...CORE_WORKER_MODES];
 }
-
 //#endregion
 //#region src/lib/codex-mcp-config.ts
 /** The `peers` server is always enabled, so its resolved key always exists;
@@ -1345,10 +1383,10 @@ function buildPeerAgentDefinitions(opts) {
 		...peersMcp
 	};
 	const nativeModel = nonEmptyModel(opts.nativeSubagentModel);
-	const reviewerModel$1 = nonEmptyModel(opts.reviewerModel);
-	const brainstormModel$1 = nonEmptyModel(opts.brainstormModel);
-	const scoutModel$1 = nonEmptyModel(opts.scoutModel);
-	const scribeModel$1 = nonEmptyModel(opts.scribeModel);
+	const reviewerModel = nonEmptyModel(opts.reviewerModel);
+	const brainstormModel = nonEmptyModel(opts.brainstormModel);
+	const scoutModel = nonEmptyModel(opts.scoutModel);
+	const scribeModel = nonEmptyModel(opts.scribeModel);
 	const modelField = nativeModel ? { model: nativeModel } : {};
 	const searchKey = opts.groupKeys.search ?? GROUP_META.search.preferredKey;
 	const searchMcp = opts.serverUrl ? { mcpServers: { [searchKey]: httpEntryFor(opts.serverUrl, "search", opts.nonce, opts.workspaceHeaderCmd) } } : {};
@@ -1358,28 +1396,28 @@ function buildPeerAgentDefinitions(opts) {
 		...modelField
 	};
 	out.reviewer = {
-		description: reviewerModel$1 ? `Feedback subagent running ${reviewerModel$1}, a DIFFERENT lab from both the lead and the implementer, so its blind spots are decorrelated from whoever produced the work. Use proactively when something already exists and you want it assessed: a diff, a plan, a document, a failing test. Unlike the stateless peer critics, it reads the repo and can RUN things, so prefer it whenever the assessment needs execution or repo context (reproduce a failure, run the suite, bisect); prefer a peer critic when you already hold the artifact and want a fresh-context opinion on it. Model is overridable at spawn.` : `Feedback subagent (native tools, runs on the lead's model in its own context). Use proactively when something already exists and you want it assessed: a diff, a plan, a document, a failing test. Unlike the stateless peer critics, it reads the repo and can RUN things, so prefer it whenever the assessment needs execution or repo context; prefer a peer critic when you already hold the artifact and want a fresh-context opinion on it. Model is overridable at spawn.`,
+		description: reviewerModel ? `Feedback subagent running ${reviewerModel}, a DIFFERENT lab from both the lead and the implementer, so its blind spots are decorrelated from whoever produced the work. Use proactively when something already exists and you want it assessed: a diff, a plan, a document, a failing test. Unlike the stateless peer critics, it reads the repo and can RUN things, so prefer it whenever the assessment needs execution or repo context (reproduce a failure, run the suite, bisect); prefer a peer critic when you already hold the artifact and want a fresh-context opinion on it. Model is overridable at spawn.` : `Feedback subagent (native tools, runs on the lead's model in its own context). Use proactively when something already exists and you want it assessed: a diff, a plan, a document, a failing test. Unlike the stateless peer critics, it reads the repo and can RUN things, so prefer it whenever the assessment needs execution or repo context; prefer a peer critic when you already hold the artifact and want a fresh-context opinion on it. Model is overridable at spawn.`,
 		prompt: "You are a feedback subagent. Your job is to tell the caller what is actually true about the artifact you are given — code, a plan, a document, a failure report — and what is wrong with it. Verify against the ACTUAL code by reading it; never assume. Do whatever the assessment requires: reproduce a failure end to end as close to how a real user hits it as you can, form hypotheses and test them against the code and runtime, and isolate the true root cause rather than a symptom. Where the change warrants it, author tests that try to BREAK the implementation (edge cases, error paths, and the acceptance criteria as executable checks), run them, and report which pass and which fail; do NOT modify production code just to make tests pass. " + fileToolSteer("builds") + " Do the work yourself — do not spawn further subagents. Report severity-ranked findings with `file:line` citations, the evidence behind each, and end with a clear go/no-go.",
-		...reviewerModel$1 ? { model: reviewerModel$1 } : {}
+		...reviewerModel ? { model: reviewerModel } : {}
 	};
 	out.brainstorm = {
-		description: brainstormModel$1 ? `Divergent-options subagent running ${brainstormModel$1} (third lab, for approaches the lead would not generate). Use proactively BEFORE an approach is chosen. Pass the decision, the constraints, what you have already ruled out, and the cost of being wrong; pass your current leading approach too if you have one, and it will try to beat it rather than restate it. Read-only; it proposes, then hands off to implementer. Model is overridable at spawn.` : `Divergent-options subagent (runs on the lead's model in its own context). Use proactively BEFORE an approach is chosen. Pass the decision, the constraints, what you have already ruled out, and the cost of being wrong; pass your current leading approach too if you have one, and it will try to beat it rather than restate it. Read-only; it proposes, then hands off to implementer. Model is overridable at spawn.`,
+		description: brainstormModel ? `Divergent-options subagent running ${brainstormModel} (third lab, for approaches the lead would not generate). Use proactively BEFORE an approach is chosen. Pass the decision, the constraints, what you have already ruled out, and the cost of being wrong; pass your current leading approach too if you have one, and it will try to beat it rather than restate it. Read-only; it proposes, then hands off to implementer. Model is overridable at spawn.` : `Divergent-options subagent (runs on the lead's model in its own context). Use proactively BEFORE an approach is chosen. Pass the decision, the constraints, what you have already ruled out, and the cost of being wrong; pass your current leading approach too if you have one, and it will try to beat it rather than restate it. Read-only; it proposes, then hands off to implementer. Model is overridable at spawn.`,
 		prompt: "You are a divergent-options subagent: the lead's sounding board while an approach is still open. Your job is to surface the option the lead would not have reached on its own. If the caller states its current leading approach, your job is to try to beat it, and you close with one verdict: `replace`, `retain`, or `insufficient evidence`. `replace` requires naming a concrete alternative that dominates it and the evidence that decides between them. `retain` is a real answer and a useful one: say it plainly when the approach survives a genuine attempt to beat it. Manufactured disagreement is as useless as agreement; do neither. If the caller states no leading approach, generate independently and let the lead compare. Return 3 to 5 approaches that differ in MECHANISM, not in phrasing. For each: how it works, what it costs, what would have to be true for it to be the right answer, and the failure mode that would kill it. Near-duplicate options are the failure mode to avoid — if only one real approach exists, say so plainly and explain why the alternatives are dead, because one honest option beats four padded ones. Screen EVERY candidate against this repository and this environment before you rank them, then verify the one you are about to recommend can actually run here: read the code path it depends on, the guard that would refuse it, the artifact it assumes exists. A recommendation that cannot execute is worse than no recommendation. If checking kills your front-runner, rerank and say so. Ground every option in what the repository actually contains, and prefer reusing what is already there over inventing something new. " + readOnlyToolSteer() + " Do the work yourself — do not spawn further subagents.",
 		tools: readOnlyToolAllowlist(searchKey),
-		...brainstormModel$1 ? { model: brainstormModel$1 } : {},
+		...brainstormModel ? { model: brainstormModel } : {},
 		...searchMcp
 	};
-	if (scoutModel$1) out.scout = {
-		description: `Read-only exploration subagent running ${scoutModel$1} (fast and cheap, so repository lookups do not run at the lead's model rates). Use proactively to find or understand something in the codebase: it sweeps widely and returns conclusions with file:line references rather than file dumps. Model is overridable at spawn.`,
+	if (scoutModel) out.scout = {
+		description: `Read-only exploration subagent running ${scoutModel} (fast and cheap, so repository lookups do not run at the lead's model rates). Use proactively to find or understand something in the codebase: it sweeps widely and returns conclusions with file:line references rather than file dumps. Model is overridable at spawn.`,
 		prompt: "You are a read-only exploration subagent. Answer the question by investigating the repository: cast a wide net, then narrow. Return the conclusion, not the raw material — cite `file:line` for anything load-bearing and quote only the lines that matter. If the answer is that something does not exist, say so explicitly and describe where you looked. " + readOnlyToolSteer() + " Do the work yourself — do not spawn further subagents.",
 		tools: readOnlyToolAllowlist(searchKey),
-		model: scoutModel$1,
+		model: scoutModel,
 		...searchMcp
 	};
 	out.scribe = {
-		description: scribeModel$1 ? `Documentation subagent running ${scribeModel$1}. Use proactively for prose that trails the code: docs, ADRs, CLAUDE.md sections, changelog entries, and README updates that have gone stale. Keeps low-glamour upkeep off the lead's context. Model is overridable at spawn.` : `Documentation subagent (runs on the lead's model in its own context). Use proactively for prose that trails the code: docs, ADRs, CLAUDE.md sections, changelog entries, and README updates that have gone stale. Model is overridable at spawn.`,
+		description: scribeModel ? `Documentation subagent running ${scribeModel}. Use proactively for prose that trails the code: docs, ADRs, CLAUDE.md sections, changelog entries, and README updates that have gone stale. Keeps low-glamour upkeep off the lead's context. Model is overridable at spawn.` : `Documentation subagent (runs on the lead's model in its own context). Use proactively for prose that trails the code: docs, ADRs, CLAUDE.md sections, changelog entries, and README updates that have gone stale. Model is overridable at spawn.`,
 		prompt: "You are a documentation subagent. Write and maintain the prose that trails the code: docs, ADRs, CLAUDE.md sections, changelog entries, README rows. Read the code before describing it — every claim you write must be checkable against the repository as it is now, not as a summary said it was. Match the surrounding document's voice, structure, and level of detail. Prefer updating an existing document over adding a new one, and delete what has become false rather than layering a correction on top of it. " + fileToolSteer("builds") + " Do the work yourself — do not spawn further subagents. Report which documents changed and any claim you could not verify.",
-		...scribeModel$1 ? { model: scribeModel$1 } : {}
+		...scribeModel ? { model: scribeModel } : {}
 	};
 	if (opts.workerToolsAvailable) {
 		const workersKey = workersKeyOf(opts.groupKeys);
@@ -1406,7 +1444,7 @@ function buildPeerAgentDefinitions(opts) {
 * sweep is scoped to peer-* names only via the persona-name allowlist.
 */
 function defaultAgentsDir() {
-	return nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "agents");
+	return path.join(PATHS.CLAUDE_CONFIG_DIR, "agents");
 }
 /**
 * YAML frontmatter string-escape — sufficient for our use case where
@@ -1506,16 +1544,16 @@ function buildAgentMd(spec) {
 * Returns the file paths plus a cleanup() that unlinks them.
 */
 async function writePeerAgentMdFiles(agents, opts) {
-	for (const name$1 of Object.keys(agents)) if (!VALID_AGENT_NAME.test(name$1)) throw new Error(`writePeerAgentMdFiles: invalid agent name ${JSON.stringify(name$1)} — must match ${VALID_AGENT_NAME.source}`);
+	for (const name of Object.keys(agents)) if (!VALID_AGENT_NAME.test(name)) throw new Error(`writePeerAgentMdFiles: invalid agent name ${JSON.stringify(name)} — must match ${VALID_AGENT_NAME.source}`);
 	const dir = opts.agentsDir ?? defaultAgentsDir();
 	await fs.mkdir(dir, { recursive: true });
 	const paths = [];
 	try {
-		for (const [name$1, def] of Object.entries(agents)) {
-			const filePath = nodePath.join(dir, `peer-${opts.fileSuffix}-${name$1}.md`);
+		for (const [name, def] of Object.entries(agents)) {
+			const filePath = path.join(dir, `peer-${opts.fileSuffix}-${name}.md`);
 			await fs.unlink(filePath).catch(() => {});
 			await writeRuntimeFileSecure(filePath, buildAgentMd({
-				name: name$1,
+				name,
 				description: def.description,
 				prompt: def.prompt,
 				model: def.model,
@@ -1574,7 +1612,7 @@ async function readMcpServersSnapshot(target) {
 */
 async function resolveGroupKeysFromMirror(enabledGroups, claudeConfigDir) {
 	const dir = claudeConfigDir ?? PATHS.CLAUDE_CONFIG_DIR;
-	const existing = await readMcpServersSnapshot(nodePath.join(dir, ".claude.json"));
+	const existing = await readMcpServersSnapshot(path.join(dir, ".claude.json"));
 	const keys = {};
 	for (const group of enabledGroups) {
 		const bare = GROUP_META[group].preferredKey;
@@ -1622,7 +1660,7 @@ async function resolveGroupKeysFromMirror(enabledGroups, claudeConfigDir) {
 */
 async function injectPeerMcpIntoMirror(serverUrl, opts) {
 	const dir = opts.claudeConfigDir ?? PATHS.CLAUDE_CONFIG_DIR;
-	const target = nodePath.join(dir, ".claude.json");
+	const target = path.join(dir, ".claude.json");
 	let existing = {};
 	try {
 		const raw = await fs.readFile(target, "utf8");
@@ -1652,7 +1690,7 @@ async function injectPeerMcpIntoMirror(serverUrl, opts) {
 		workspaceHeaderCmd: buildWorkspaceHeaderHelperCommand(process.execPath, process.argv[1])
 	});
 	const conflicts = [];
-	for (const name$1 of Object.keys(peerConfig.mcpServers)) if (mcpServers[name$1] !== void 0) conflicts.push(name$1);
+	for (const name of Object.keys(peerConfig.mcpServers)) if (mcpServers[name] !== void 0) conflicts.push(name);
 	if (conflicts.length > 0) {
 		consola.warn(`injectPeerMcpIntoMirror: your ~/.claude/.claude.json already has mcpServers entries named [${conflicts.join(", ")}]; refusing to overwrite. Subagents will not see those tools — only the parent session via --mcp-config fallback. To resolve, rename the user-side server(s) (e.g. via \`claude mcp remove\`) and relaunch.`);
 		return {
@@ -1661,7 +1699,7 @@ async function injectPeerMcpIntoMirror(serverUrl, opts) {
 			conflictingServers: conflicts
 		};
 	}
-	for (const [name$1, entry] of Object.entries(peerConfig.mcpServers)) mcpServers[name$1] = entry;
+	for (const [name, entry] of Object.entries(peerConfig.mcpServers)) mcpServers[name] = entry;
 	existing.mcpServers = mcpServers;
 	const desiredJson = JSON.stringify(existing, null, 2) + "\n";
 	await fs.mkdir(dir, { recursive: true });
@@ -1700,8 +1738,8 @@ async function writePeerMcpRuntimeFiles(serverUrl, opts) {
 	await fs.mkdir(runtimeDir, { recursive: true });
 	if (process.platform !== "win32") await fs.chmod(runtimeDir, 448).catch(() => {});
 	const fileSuffix = `${process.pid}-${randomBytes(4).toString("hex")}`;
-	const mcpConfigPath = nodePath.join(runtimeDir, `peer-mcp-${fileSuffix}.json`);
-	const agentsPath = nodePath.join(runtimeDir, `peer-agents-${fileSuffix}.json`);
+	const mcpConfigPath = path.join(runtimeDir, `peer-mcp-${fileSuffix}.json`);
+	const agentsPath = path.join(runtimeDir, `peer-agents-${fileSuffix}.json`);
 	const mcpConfig = buildPeerMcpConfig(serverUrl, {
 		codexCli: opts.codexCli,
 		geminiAvailable: opts.geminiAvailable,
@@ -1757,15 +1795,14 @@ async function writePeerMcpRuntimeFiles(serverUrl, opts) {
 		cleanup
 	};
 }
-
 //#endregion
 //#region src/lib/file-log-reporter.ts
-const MAX_LOG_BYTES = 1024 * 1024;
+const MAX_LOG_BYTES = 1048576;
 const DEDUP_MAX = 1e3;
 const ARG_MAX_LEN = 2048;
 const DEDUP_KEY_MAX_LEN = 200;
 const CREDENTIAL_RE = /\b(eyJ[A-Za-z0-9_-]{20,}(?:\.[A-Za-z0-9_-]+){0,2}|gh[opsu]_[A-Za-z0-9_]{20,}|Bearer\s+\S{20,})\b/g;
-const ALLOWED_TYPES = new Set([
+const ALLOWED_TYPES = /* @__PURE__ */ new Set([
 	"fatal",
 	"error",
 	"warn"
@@ -1909,7 +1946,6 @@ function enableFileLogging() {
 	consola.options.stdout = nullStream;
 	consola.options.stderr = nullStream;
 }
-
 //#endregion
 //#region src/lib/mcp-permissions-settings.ts
 /**
@@ -2121,7 +2157,6 @@ async function configureServeDefaultPermissionMode(settingsPath) {
 	}, "servemode");
 	return { written: true };
 }
-
 //#endregion
 //#region src/lib/model-validation.ts
 const ENDPOINT_ALIASES = {
@@ -2169,10 +2204,34 @@ function listModelsForEndpoint(path) {
 		return supported.includes(endpoint);
 	}).map((m) => m.id);
 }
-
 //#endregion
 //#region src/lib/orchestration/hook-mcp-client.ts
 /**
+* Tiny MCP-over-HTTP + inference client for the advisory-review hooks (hook V2).
+*
+* The hook subcommands (`internal-stop-review`, `internal-prompt-submit`) run as
+* SEPARATE short-lived processes spawned by Claude Code — they have no in-process
+* proxy `state`. They reach the running github-router proxy over loopback HTTP:
+*
+*   - `callMcpTool` POSTs a JSON-RPC `tools/call` to `${serverUrl}/mcp/<group>`
+*     with the per-launch `Authorization: Bearer <nonce>` (the same nonce the
+*     proxy minted in `writePeerMcpRuntimeFiles` and validates in the /mcp
+*     handler). Used for `workers/review` (the background reviewer) and
+*     `search/code` (the prompt-hook grounding search). Forces the JSON response
+*     path (`Accept: application/json`) — the SSE path's 60s-ceiling workaround
+*     is a Claude-Code-MCP-client concern; our own fetch has no such cap, so the
+*     simpler single-body JSON path is correct here.
+*
+*   - `callInference` POSTs to `${serverUrl}/v1/responses` (no nonce — the /v1/*
+*     passthrough authenticates upstream with the proxy's own Copilot token) for
+*     the single gpt-5.6-sol scope/goal call the prompt hook makes.
+*
+* Everything here is best-effort and caller-fail-open: a transport error,
+* non-2xx, timeout, or malformed body throws, and every caller wraps the call so
+* the hook degrades gracefully (no findings / the regex-heuristic goal) rather
+* than disrupting the session.
+*/
+/**
 * Read the proxy URL + nonce the launcher injected into the spawned child env
 * (`GH_ROUTER_HOOK_MCP_URL` / `GH_ROUTER_HOOK_NONCE`). Returns undefined when
 * either is absent — the hook then skips its LLM layer and falls back to its
@@ -2277,22 +2336,15 @@ async function postJson(url, payload, opts) {
 		if (opts.signal) opts.signal.removeEventListener("abort", onExternalAbort);
 	}
 }
-
-//#endregion
-//#region src/lib/orchestration/plan-review-hook.ts
-/** Minimum finalized-plan size worth spending a model review on. */
-const PLAN_REVIEW_MIN_CHARS = 220;
-/** Hard wall-clock for the advisory plan critic. */
-const PLAN_REVIEW_TIMEOUT_MS = 25e3;
 /** Cap the plan embedded in the critic brief so a huge plan file cannot dominate. */
-const MAX_REVIEWED_PLAN_CHARS = 80 * 1024;
+const MAX_REVIEWED_PLAN_CHARS = 81920;
 /** Default-on advisory plan review. Opt out with GH_ROUTER_DISABLE_PLAN_REVIEW=1. */
 function planReviewEnabled(env = process.env) {
 	return parseBoolEnv(env.GH_ROUTER_DISABLE_PLAN_REVIEW) !== true;
 }
 /** File-backed per-session debounce for finalized plans, separate from Stop diff hashes. */
 function filePlanReviewDebounce(stateDir) {
-	const fileFor = (sid) => nodePath.join(stateDir, `plan-review-hash-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
+	const fileFor = (sid) => path.join(stateDir, `plan-review-hash-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
 	const readLast = async (sid) => {
 		try {
 			return (await promises.readFile(fileFor(sid), "utf8")).trim();
@@ -2317,12 +2369,12 @@ function parseObject(raw) {
 		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
 	} catch {}
 }
-async function resolvePlanText(toolInput, readFile$1) {
+async function resolvePlanText(toolInput, readFile) {
 	if (!toolInput || typeof toolInput !== "object") return "";
 	const ti = toolInput;
 	const planFilePath = typeof ti.planFilePath === "string" && ti.planFilePath.trim().length > 0 ? ti.planFilePath.trim() : "";
 	if (planFilePath.length > 0) try {
-		const fromFile = await readFile$1(planFilePath);
+		const fromFile = await readFile(planFilePath);
 		if (fromFile.trim().length > 0) return fromFile;
 	} catch {}
 	return typeof ti.plan === "string" ? ti.plan : "";
@@ -2355,7 +2407,7 @@ async function decidePlanReviewHook(input) {
 		};
 		const cwd = typeof payload.cwd === "string" && payload.cwd.length > 0 ? payload.cwd : input.fallbackCwd;
 		const trimmed = (await resolvePlanText(payload.tool_input, input.readFile ?? ((filePath) => promises.readFile(filePath, "utf8")))).trim();
-		if (trimmed.length < (input.minChars ?? PLAN_REVIEW_MIN_CHARS)) return {
+		if (trimmed.length < (input.minChars ?? 220)) return {
 			kind: "skip",
 			reason: "trivial-plan"
 		};
@@ -2397,7 +2449,7 @@ function framePlanFindings(text) {
 }
 /** Run the bounded critic call and write material findings to the shared findings store. */
 async function runPlanReview(input) {
-	const timeoutMs = input.timeoutMs ?? PLAN_REVIEW_TIMEOUT_MS;
+	const timeoutMs = input.timeoutMs ?? 25e3;
 	let timer;
 	const controller = new AbortController();
 	try {
@@ -2433,12 +2485,39 @@ function buildPlanReviewHookCommand(execPath, scriptPath) {
 	if (scriptPath && scriptPath !== execPath) return `${q(execPath)} ${q(scriptPath)} internal-plan-review`;
 	return `${q(execPath)} internal-plan-review`;
 }
-
 //#endregion
 //#region src/lib/orchestration/harness-parse.ts
+/**
+* Deterministic, language-agnostic harness PARSER for the structural Stop-gate.
+*
+* The gate runs a repo's own checks (typecheck/lint/test/build) when the agent
+* tries to finish. Historically it only auto-enabled for Bun/TS repos via a
+* hard-coded sealed gate. This module generalizes detection by PARSING the
+* project's own authoritative config — `package.json` scripts, CI `run:` steps,
+* Make/just/task targets, and language manifests — and emitting the canonical
+* check commands it finds.
+*
+* Design properties (a cross-lab panel chose a parser over a model for these):
+*   - EVIDENCE-PINNED BY CONSTRUCTION: every emitted command is either lifted
+*     verbatim from a parsed source file (a package.json script, a CI `run:`
+*     line, a Make target invocation) or is a fixed canonical manifest command
+*     for a detected ecosystem (`cargo check`, `go vet ./...`). The parser never
+*     invents a command, so it has no hallucination / prompt-injection surface.
+*   - PURE + DETERMINISTIC: a function of the repo's files + the live PATH. The
+*     runtime Stop hook re-derives it at each stop (no cache), so it always
+*     reflects the current tree and fails open for free when a tool vanished.
+*   - SHELL-SAFE: `liveExec` runs `command.trim().split(/\s+/)` (naive argv
+*     split, no shell), so every emitted command is validated to be plain
+*     space-separated tokens with no shell operators and no `%` (cmd.exe quoting
+*     throws on `%`). See `isSafeCommand`.
+*
+* This is consumed ONLY by the local Stop hook. The sealed-gate kernel
+* (`run_workflow`) is never fed a parsed command — `GateDescriptor.kind` is
+* `"parsed"`, never a sealed id, and `sealedGateIds()` is unchanged.
+*/
 /** The fast static checks that are always-on; `test` is opt-in (it runs project
 *  code and can be slow on every stop). */
-const STATIC_IDS = new Set(["typecheck", "lint"]);
+const STATIC_IDS = /* @__PURE__ */ new Set(["typecheck", "lint"]);
 /** Reject anything that is not a plain, shell-free, `%`-free argv line. This is
 *  the load-bearing guard for `liveExec`'s naive whitespace split. */
 function isSafeCommand(command) {
@@ -2486,7 +2565,7 @@ async function readTextFile(file) {
 }
 /** package.json `scripts` as a plain string→string map (best-effort). */
 async function readScripts(root) {
-	const pkg = await readJsonFile(nodePath.join(root, "package.json"));
+	const pkg = await readJsonFile(path.join(root, "package.json"));
 	const scripts = pkg && typeof pkg === "object" ? pkg.scripts : void 0;
 	const out = {};
 	if (scripts && typeof scripts === "object") {
@@ -2496,31 +2575,31 @@ async function readScripts(root) {
 }
 /** Pick the JS package runner from the lockfile present at the root. */
 function nodeRunner(root) {
-	if (existsSync(nodePath.join(root, "bun.lockb")) || existsSync(nodePath.join(root, "bun.lock"))) return "bun";
-	if (existsSync(nodePath.join(root, "pnpm-lock.yaml"))) return "pnpm";
-	if (existsSync(nodePath.join(root, "yarn.lock"))) return "yarn";
+	if (existsSync(path.join(root, "bun.lockb")) || existsSync(path.join(root, "bun.lock"))) return "bun";
+	if (existsSync(path.join(root, "pnpm-lock.yaml"))) return "pnpm";
+	if (existsSync(path.join(root, "yarn.lock"))) return "yarn";
 	return "npm";
 }
 /** Map a package.json script NAME to a canonical id (read-only checks only — a
 *  `:fix`/`:write` variant mutates the tree and is never a gate). */
-function scriptNameToId(name$1) {
-	if (/:(fix|write)$/i.test(name$1)) return null;
-	if (/^(typecheck|type-check|check-types|tsc|types)$/i.test(name$1)) return "typecheck";
-	if (/^(lint|lint:check|eslint)$/i.test(name$1)) return "lint";
-	if (/^test$/i.test(name$1)) return "test";
+function scriptNameToId(name) {
+	if (/:(fix|write)$/i.test(name)) return null;
+	if (/^(typecheck|type-check|check-types|tsc|types)$/i.test(name)) return "typecheck";
+	if (/^(lint|lint:check|eslint)$/i.test(name)) return "lint";
+	if (/^test$/i.test(name)) return "test";
 	return null;
 }
 async function collectNodeChecks(root, includeTests) {
-	if (!existsSync(nodePath.join(root, "package.json"))) return [];
+	if (!existsSync(path.join(root, "package.json"))) return [];
 	const runner = nodeRunner(root);
 	if (resolveExecutable(runner, { env: process.env }) === null) return [];
 	const scripts = await readScripts(root);
 	const out = [];
-	for (const [name$1] of Object.entries(scripts)) {
-		const id = scriptNameToId(name$1);
+	for (const [name] of Object.entries(scripts)) {
+		const id = scriptNameToId(name);
 		if (!id) continue;
 		if (id === "test" && !includeTests) continue;
-		const command = `${runner} run ${name$1}`;
+		const command = `${runner} run ${name}`;
 		if (isSafeCommand(command)) out.push({
 			id,
 			command,
@@ -2538,11 +2617,11 @@ async function collectNodeChecks(root, includeTests) {
 */
 async function collectCiChecks(root) {
 	const files = [];
-	const wfDir = nodePath.join(root, ".github", "workflows");
+	const wfDir = path.join(root, ".github", "workflows");
 	try {
-		for (const name$1 of await promises.readdir(wfDir)) if (/\.ya?ml$/i.test(name$1)) files.push(nodePath.join(wfDir, name$1));
+		for (const name of await promises.readdir(wfDir)) if (/\.ya?ml$/i.test(name)) files.push(path.join(wfDir, name));
 	} catch {}
-	const gitlab = nodePath.join(root, ".gitlab-ci.yml");
+	const gitlab = path.join(root, ".gitlab-ci.yml");
 	if (existsSync(gitlab)) files.push(gitlab);
 	if (files.length === 0) return [];
 	let parseYaml;
@@ -2588,7 +2667,7 @@ async function collectCiChecks(root) {
 		const text = await readTextFile(f);
 		if (text === void 0) continue;
 		try {
-			walk(parseYaml(text), nodePath.relative(root, f) || nodePath.basename(f));
+			walk(parseYaml(text), path.relative(root, f) || path.basename(f));
 		} catch {}
 	}
 	return out;
@@ -2603,7 +2682,7 @@ async function collectTaskChecks(root, includeTests) {
 		["justfile", "just"],
 		[".justfile", "just"]
 	]) {
-		const text = await readTextFile(nodePath.join(root, file));
+		const text = await readTextFile(path.join(root, file));
 		if (text === void 0) continue;
 		if (resolveExecutable(tool, { env: process.env }) === null) continue;
 		for (const line of text.split(/\r?\n/)) {
@@ -2619,20 +2698,20 @@ async function collectTaskChecks(root, includeTests) {
 			});
 		}
 	}
-	const taskfile = ["Taskfile.yml", "Taskfile.yaml"].map((n) => nodePath.join(root, n)).find((p) => existsSync(p));
+	const taskfile = ["Taskfile.yml", "Taskfile.yaml"].map((n) => path.join(root, n)).find((p) => existsSync(p));
 	if (taskfile && resolveExecutable("task", { env: process.env }) !== null) {
 		const text = await readTextFile(taskfile);
 		if (text !== void 0) try {
 			const { parse } = await import("yaml");
 			const doc = parse(text);
-			for (const name$1 of Object.keys(doc?.tasks ?? {})) {
-				const id = wantId(name$1);
+			for (const name of Object.keys(doc?.tasks ?? {})) {
+				const id = wantId(name);
 				if (!id || id === "test" && !includeTests) continue;
-				const command = `task ${name$1}`;
+				const command = `task ${name}`;
 				if (isSafeCommand(command)) out.push({
 					id,
 					command,
-					source: nodePath.basename(taskfile)
+					source: path.basename(taskfile)
 				});
 			}
 		} catch {}
@@ -2640,7 +2719,7 @@ async function collectTaskChecks(root, includeTests) {
 	return out;
 }
 async function collectRustChecks(root, includeTests) {
-	if (!existsSync(nodePath.join(root, "Cargo.toml"))) return [];
+	if (!existsSync(path.join(root, "Cargo.toml"))) return [];
 	if (resolveExecutable("cargo", { env: process.env }) === null) return [];
 	const out = [{
 		id: "typecheck",
@@ -2660,7 +2739,7 @@ async function collectRustChecks(root, includeTests) {
 	return out;
 }
 async function collectGoChecks(root, includeTests) {
-	if (!existsSync(nodePath.join(root, "go.mod"))) return [];
+	if (!existsSync(path.join(root, "go.mod"))) return [];
 	if (resolveExecutable("go", { env: process.env }) === null) return [];
 	const out = [{
 		id: "typecheck",
@@ -2682,11 +2761,11 @@ async function collectPythonChecks(root, includeTests) {
 		"tox.ini",
 		"ruff.toml",
 		"mypy.ini"
-	].filter((f) => existsSync(nodePath.join(root, f)));
+	].filter((f) => existsSync(path.join(root, f)));
 	if (present.length === 0) return [];
 	const evidence = present[0];
 	const out = [];
-	const configText = await readTextFile(nodePath.join(root, present[0])) ?? "";
+	const configText = await readTextFile(path.join(root, present[0])) ?? "";
 	const mentions = (tool) => present.some((f) => f.startsWith(tool)) || configText.includes(tool);
 	if (mentions("mypy") && resolveExecutable("mypy", { env: process.env }) !== null) out.push({
 		id: "typecheck",
@@ -2698,7 +2777,7 @@ async function collectPythonChecks(root, includeTests) {
 		command: "ruff check .",
 		source: evidence
 	});
-	if (includeTests && (mentions("pytest") || existsSync(nodePath.join(root, "pytest.ini")))) {
+	if (includeTests && (mentions("pytest") || existsSync(path.join(root, "pytest.ini")))) {
 		if (resolveExecutable("pytest", { env: process.env }) !== null) out.push({
 			id: "test",
 			command: "pytest -q",
@@ -2798,9 +2877,29 @@ function descriptorHash(d) {
 	const canon = [...d.checks].map((c) => `${c.id}${c.command.trim().replace(/\s+/g, " ")}`).sort().join("
");
 	return `${d.kind}:${createHash("sha256").update(canon).digest("hex").slice(0, 32)}`;
 }
-
 //#endregion
 //#region src/lib/orchestration/gate-discovery.ts
+/**
+* Evidence-pinned model FALLBACK for the structural Stop-gate — the last resort
+* when the deterministic parser (`harness-parse`) finds no runnable checks.
+*
+* A read-only worker reads the repo's own config/docs and proposes the canonical
+* check commands. Two guards keep this safe despite being model-authored:
+*   1. SANITIZE — `sanitizeDiscoveredCheck` rejects shell metacharacters (so a
+*      command can never chain/redirect/expand), destructive/stateful verbs,
+*      interactive/watch shapes, and an executable that isn't on PATH. What
+*      survives is a single plain argv line, safe for `liveExec`'s naive split.
+*   2. EVIDENCE-PIN — a surviving command must appear (whitespace-normalized)
+*      VERBATIM in one of the collected source files. The model cannot invent a
+*      command or be prompt-injected into emitting one that isn't already a real
+*      command in the repo (and a real command in a user-trusted repo is the
+*      same authority the existing gate already runs).
+*
+* Discovery runs ONCE at launch and the result is cached per (repoFingerprint,
+* sourcesHash) in a human-readable record. The runtime Stop hook only READS the
+* cached record (no model call at stop). This is consumed ONLY by the local Stop
+* hook; the sealed-gate kernel never sees a discovered command.
+*/
 /** The allowlist of files the discovery worker is steered to read — config +
 *  docs that legitimately describe how to check a project. Secret files are
 *  additionally blocked at the worker IO layer (`.env*`/`*.pem`/`id_*`/…). */
@@ -2829,11 +2928,11 @@ const SIGNAL_FILES = [
 	"composer.json"
 ];
 const SIGNAL_DIRS = [".github/workflows"];
-const MAX_SIGNAL_BYTES = 64 * 1024;
+const MAX_SIGNAL_BYTES = 65536;
 /** Global caps so a repo with many workflow files can't inflate discovery /
 *  hashing cost: at most this many files and this much total text. */
 const MAX_SIGNAL_FILES = 40;
-const MAX_TOTAL_SIGNAL_BYTES = 512 * 1024;
+const MAX_TOTAL_SIGNAL_BYTES = 524288;
 /** Words that mark a command as destructive, stateful, or non-terminating — a
 *  "check" must never do any of these. (Shell operators are already rejected by
 *  `isSafeCommand`, so chaining can't smuggle them past this word scan.) */
@@ -2850,7 +2949,8 @@ function sanitizeDiscoveredCheck(command) {
 	const norm = normalizeWs(command);
 	if (DENY_WORD.test(norm)) return false;
 	if (isMutatingCommand(norm)) return false;
-	return resolveExecutable(norm.split(" ")[0] ?? "", { env: process.env }) !== null;
+	const first = norm.split(" ")[0] ?? "";
+	return resolveExecutable(first, { env: process.env }) !== null;
 }
 function normalizeWs(s) {
 	return s.replace(/\s+/g, " ").trim();
@@ -2872,13 +2972,13 @@ async function collectSignals(root) {
 		} catch {}
 	};
 	for (const f of SIGNAL_FILES) {
-		const abs = nodePath.join(root, f);
+		const abs = path.join(root, f);
 		if (existsSync(abs)) await readCapped(abs, f);
 	}
 	for (const d of SIGNAL_DIRS) {
-		const dir = nodePath.join(root, d);
+		const dir = path.join(root, d);
 		try {
-			for (const name$1 of await promises.readdir(dir)) if (/\.(ya?ml)$/i.test(name$1)) await readCapped(nodePath.join(dir, name$1), nodePath.join(d, name$1));
+			for (const name of await promises.readdir(dir)) if (/\.(ya?ml)$/i.test(name)) await readCapped(path.join(dir, name), path.join(d, name));
 		} catch {}
 	}
 	return {
@@ -2893,10 +2993,10 @@ async function sourcesHash(root) {
 	return createHash("sha256").update(files.sort().join("\n")).update("\0").update(text).digest("hex");
 }
 function discoveredDir() {
-	return nodePath.join(PATHS.APP_DIR, "stop-gate", "discovered");
+	return path.join(PATHS.APP_DIR, "stop-gate", "discovered");
 }
 function recordPathFor(root) {
-	return nodePath.join(discoveredDir(), createHash("sha256").update(nodePath.resolve(root)).digest("hex").slice(0, 32));
+	return path.join(discoveredDir(), createHash("sha256").update(path.resolve(root)).digest("hex").slice(0, 32));
 }
 /** Read the cached discovered record for `root`, verifying it still matches the
 *  live repo identity AND the live sources hash. Any mismatch / unreadable /
@@ -2931,16 +3031,16 @@ const DISCOVERY_PROMPT = (files) => `You are configuring an automated pre-finish
 function extractJson(text) {
 	const fenced = /```(?:json)?\s*([\s\S]*?)```/i.exec(text);
 	const body = fenced ? fenced[1] : text;
-	const start$1 = body.indexOf("{");
+	const start = body.indexOf("{");
 	const end = body.lastIndexOf("}");
-	if (start$1 < 0 || end <= start$1) return void 0;
+	if (start < 0 || end <= start) return void 0;
 	try {
-		return JSON.parse(body.slice(start$1, end + 1));
+		return JSON.parse(body.slice(start, end + 1));
 	} catch {
 		return;
 	}
 }
-const VALID_IDS = new Set([
+const VALID_IDS = /* @__PURE__ */ new Set([
 	"typecheck",
 	"lint",
 	"test"
@@ -2987,7 +3087,7 @@ async function discoverGateCommands(cwd, opts) {
 	if (files.length === 0) return null;
 	let result;
 	try {
-		const { runWorkerAgent } = await import("./engine-5VxiBAdY.js");
+		const { runWorkerAgent } = await import("./engine-DL15-epb.js");
 		result = await runWorkerAgent({
 			mode: "explore",
 			workspace: root,
@@ -3010,10 +3110,25 @@ async function discoverGateCommands(cwd, opts) {
 		evidence: files
 	};
 }
-
 //#endregion
 //#region src/lib/orchestration/prompt-submit-hook.ts
 /**
+* Pure decision logic for the `UserPromptSubmit` hook (the front-end of the
+* floor-raising surface). It serves TWO duties on the one event:
+*
+*   1. Per-prompt budget reset — clears the Stop-gate's block counter for this
+*      session so `maxBlocks` is "per user prompt", not "per session lifetime"
+*      (the per-prompt scoping the Stop-gate relies on).
+*   2. Goal steer — for a NON-trivial prompt, inject an advisory GOAL directive
+*      (additive context, never blocking) pointing the model at `/gh-research`
+*      then `/gh-orchestrate`. It raises the prior; it does not force execution.
+*
+* Top-level only: like the Stop-gate, it stands down in a subagent/teammate
+* context (the payload carries `agent_type`/`agent_id` there) so it never
+* recurses into spawned workers. Fail-open and never blocking: any error or a
+* trivial prompt yields an empty injection.
+*/
+/**
 * The advisory goal injected for a non-trivial prompt. Uses the skills' slash
 * invocation form. The model still decides whether to follow it; the Stop-gate
 * backstops correctness at the output end.
@@ -3057,7 +3172,7 @@ const PROMPT_SEARCH_TIP = "TIP (advisory): when this task needs code context, se
 *  user-derived (not invented) advisory note grounded in the search results. */
 const PROMPT_SCOPE_SYSTEM = "You are a scoping assistant for a coding agent about to act on a user's request. You are given the user's request and the results of a lexical + semantic code search over the relevant repository. Produce a SHORT advisory note (<= 120 words), plain text only:\n1. SCOPE: one line — is this trivial, focused (one area), or large/cross-cutting — grounded in what the search surfaced (reference the most relevant file(s) by name).\n2. GOAL: restate the user's OWN ask as a single measurable objective, in THEIR terms. Do NOT invent new requirements or acceptance criteria beyond what they asked.\n3. Only if the task is large/cross-cutting, add a final line: \"Consider /gh-research first to saturate understanding, then /gh-orchestrate to compose a floor-raising workflow.\" Omit it for a focused or trivial task.\nThis is advisory — the agent decides whether to follow it. Be concrete and concise; no preamble.";
 /** Max chars of each search-result blob fed into the scope inference. */
-const SEARCH_CONTEXT_CAP = 6 * 1024;
+const SEARCH_CONTEXT_CAP = 6144;
 /** Wrap the prior-turn review findings in an explicitly NON-AUTHORITATIVE frame. */
 function framePendingFindings(findings) {
 	return "ADVISORY — independent review of your PREVIOUS change (NON-AUTHORITATIVE): an independent gpt-5.6-sol reviewer flagged the following. Evaluate each on its merits — fix the real ones, and ignore any wrong one with a one-line reason. You are NOT obligated to act on these.\n" + findings.trim();
@@ -3144,9 +3259,22 @@ function buildPromptSubmitHookCommand(execPath, scriptPath) {
 	if (scriptPath && scriptPath !== execPath) return `${q(execPath)} ${q(scriptPath)} internal-prompt-submit`;
 	return `${q(execPath)} internal-prompt-submit`;
 }
-
 //#endregion
 //#region src/lib/first-mate/operator-shaping.ts
+/**
+* Operator-mode steering for github-router `--agents` sessions.
+*
+* In first-mate/operator mode the spawned Claude is the cloud-agent operator, not
+* the product implementer. Product implementation is steered to GitHub cloud
+* agents by first-mate guidance and the gh-first-mate skill. This module no
+* longer hard-blocks local file writes or shell commands: Edit/Write/NotebookEdit
+* and Bash remain available as escape hatches when needed.
+*
+* The only enforced main-operator boundary is that local worker/orchestrate MCP
+* tools stay subagent-only. The main operator should invoke the worker-* Agent
+* subagents or delegate to GitHub cloud agents rather than calling
+* `mcp__workers__*` / `mcp__orchestrate__*` directly.
+*/
 /** MCP prefixes denied to the main operator; these remain subagent-only. */
 const OPERATOR_DENIED_MCP_PREFIXES = ["mcp__workers__", "mcp__orchestrate__"];
 /**
@@ -3193,9 +3321,19 @@ function operatorPreToolUse(toolName, operatorMode, input) {
 	};
 	return { block: false };
 }
-
 //#endregion
 //#region src/internal-first-mate-guard.ts
+/**
+* The internal `internal-first-mate-guard` subcommand: a PreToolUse hook that
+* keeps local worker/orchestrate MCP tools subagent-only in cloud-agent OPERATOR
+* mode. It is injected into the spawned Claude session's settings ONLY in
+* `--agents`/operator mode, with a matcher scoped to those MCP tool prefixes.
+*
+* Reads the PreToolUse payload from stdin (`{tool_name, tool_input, ...}`) and,
+* if the tool is denied in operator mode, blocks via exit code 2 with a reason
+* on stderr (the repo's hook convention). Bash and file-authoring tools are not
+* matched by this guard and are not blocked.
+*/
 function readStdinSync() {
 	try {
 		return readFileSync(0, "utf8");
@@ -3211,7 +3349,7 @@ const internalFirstMateGuard = defineCommand({
 	run() {
 		let toolName = "";
 		let hookInput;
-		let parsed = false;
+		let parsed;
 		try {
 			const payload = JSON.parse(readStdinSync());
 			if (typeof payload.tool_name === "string") toolName = payload.tool_name;
@@ -3241,7 +3379,6 @@ const FIRST_MATE_GUARD_MATCHER = "mcp__workers__.*|mcp__orchestrate__.*";
 function buildFirstMateGuardHookCommand(execPath, entry) {
 	return `${JSON.stringify(execPath)} ${JSON.stringify(entry)} internal-first-mate-guard`;
 }
-
 //#endregion
 //#region src/lib/injected-skills/first-mate-conduct-skill.ts
 const FIRST_MATE_CONDUCT_SKILL = {
@@ -3294,7 +3431,6 @@ The ledger is durable memory for unit state; the strategy store is durable memor
 ${DEFINITION_OF_GREATNESS}
 `
 };
-
 //#endregion
 //#region src/lib/injected-skills/first-mate-operate-skill.ts
 const FIRST_MATE_OPERATE_SKILL = {
@@ -3396,14 +3532,12 @@ Hard authority limits: launching to real external channels, any spend or paid ac
 Report the current phase, its checkpoint and whether it is met with reproducible evidence, the active mission(s) and their phase-appropriate acceptance criteria, and the next decision or escalation.
 `
 };
-
 //#endregion
 //#region src/lib/injected-skills/first-mate-setup-skill.ts
 const FIRST_MATE_SETUP_SKILL = {
 	name: "gh-first-mate-scaffold",
 	md: "---\nname: gh-first-mate-scaffold\ndescription: Scaffolds a repo-geared agentic-dev foundation through first-mate: seeds guidance files, role agents, ADRs, changelog, learnings, PR template, test instructions, Copilot setup, and CI through a scaffold branch and PR. Use before the first build wave on an owned repository.\nuser-invocable: true\n---\n\n# gh-first-mate-scaffold\n\nInvoke the `scaffold_repo` MCP tool (`mcp__first-mate__scaffold_repo`) before the first build wave on an owned repository. The goal is not generic TODO stubs; it is a repo-geared foundation that GitHub agents, local agents, reviewers, and CI can read.\n\n## What it seeds\n\n- `AGENTS.md` / `CLAUDE.md` / `GEMINI.md` / `.github/copilot-instructions.md` — identical guidance with overview, detected stack, commands, hard DoD gate, primary OS, conventions, structure, decisions/memory, handoff, testing, and gotchas.\n- `.github/agents/{ceo,cto,cpo,planner,implementer,reviewer,researcher,tester}.md` mirrored into `.claude/agents/` — C-suite operator hats plus execution roles, each with frontmatter, cold-start contract, method, quality bar, output contract, and self-reminder.\n- `docs/playbook/README.md` — the autonomous DISCOVER → NICHE → POSITION → SCOPE → BUILD → LAUNCH → MEASURE → ITERATE → GROW protocol, externally verifiable phase gates, OODA / Build-Measure-Learn governance, and authority limits.\n- `docs/adrs/0000-template.md` plus `docs/adr/0001-record-architecture-decisions.md` — Nygard-style decision record foundation.\n- `LEARNINGS.md`, `CHANGELOG.md`, `docs/history/0000-template.md`, `docs/plans/README.md`, and `docs/research/README.md` — durable memory, history, plans, and research conventions.\n- `.github/pull_request_template.md` — summary, type, failure-modes-considered-and-tested, and DoD checklist.\n- `.github/instructions/tests.instructions.md` — path-scoped test guidance filled from detected framework/dir/glob where possible.\n- `.github/workflows/copilot-setup-steps.yml` and starter `.github/workflows/ci.yml` — detected toolchain setup with stable quality-gate job names.\n\nIt does not seed factory-protocol or `docs/factory/` files. Orchestration remains outside the product repo in first-mate.\n\n## Usage\n\n```\nmcp__first-mate__scaffold_repo({ repo: \"owner/repo\" })\nmcp__first-mate__scaffold_repo({ repo: \"owner/repo\", mode: \"enhance\" })\nmcp__first-mate__scaffold_repo({\n  repo: \"owner/repo\",\n  mode: \"add-missing-only\",\n  detection_overrides: { primary_os: \"windows-latest\", test_command: \"npm test\" }\n})\n```\n\nModes:\n\n- `add-missing-only` (default): seed absent files and skip present files.\n- `enhance`: for guidance files, product playbook, ADR index, changelog, and learnings, append only missing `##` sections; never rewrite existing prose. Other present files are skipped.\n- `overwrite-approved`: replace existing files only when explicitly approved.\n\nAlways inspect the returned per-file report and PR. A no-op result means the repo already has the foundation or has no missing enhanceable sections.\n"
 };
-
 //#endregion
 //#region src/lib/injected-skills/first-mate-skill.ts
 const FIRST_MATE_SKILL = {
@@ -3565,7 +3699,6 @@ When reporting progress, return:
 - Next wake: the heartbeat state — armed and next check in nextWakeSeconds seconds, or idle (disarmed).
 `
 };
-
 //#endregion
 //#region src/lib/injected-skills/floor-keeper-skill.ts
 const FLOOR_KEEPER_SKILL = {
@@ -3716,7 +3849,6 @@ Return a compact final checkpoint:
 - Do not bury cap-hit or unknown states in a green-sounding summary.
 `
 };
-
 //#endregion
 //#region src/lib/injected-skills/orchestrate-skill.ts
 const ORCHESTRATE_SKILL = {
@@ -3855,7 +3987,6 @@ Return:
 - Final residual risks and next action.
 `
 };
-
 //#endregion
 //#region src/lib/injected-skills/research-skill.ts
 const RESEARCH_SKILL = {
@@ -3967,7 +4098,6 @@ Return a compact brief, not the whole research dump:
 - Do not paste the entire persisted brief into later turns unless the user asks.
 `
 };
-
 //#endregion
 //#region src/lib/injected-skills/worker-skill.ts
 /**
@@ -4028,7 +4158,6 @@ The dispatcher calls the worker once and relays its result verbatim.
   for long worker fan-out.
 `
 };
-
 //#endregion
 //#region src/lib/injected-skills/artifact-review-skill.ts
 const ARTIFACT_REVIEW_SKILL = {
@@ -4102,7 +4231,6 @@ To let the human act on the artifact (not just comment), emit declarative contro
 - The panel is a review surface, not an approver: outward/irreversible actions still need explicit user confirmation.
 `
 };
-
 //#endregion
 //#region src/lib/claude-md-injection.ts
 /**
@@ -4189,7 +4317,7 @@ const OPERATING_DEFAULTS_DIGEST = "## Operating defaults (the user's explicit di
 * the awareness via `--append-system-prompt`, so skipping here only
 * loses descendant-reach.
 */
-const MAX_CLAUDE_MD_BYTES = 1 * 1024 * 1024;
+const MAX_CLAUDE_MD_BYTES = 1048576;
 /**
 * Bounded retry budget for the temp → rename step on Windows where
 * `fs.rename` can transiently fail with EBUSY / EPERM / EACCES when
@@ -4326,7 +4454,7 @@ async function isUnderClaudeConfigMirrorRealpath(target) {
 		consola.warn(`${ERROR_CODE$1}: realpath failed on mirror root ${mirrorRoot}: ${err instanceof Error ? err.message : String(err)}`);
 		return false;
 	}
-	const targetParent = nodePath.dirname(target);
+	const targetParent = path.dirname(target);
 	let resolvedTargetParent;
 	try {
 		resolvedTargetParent = await fs.realpath(targetParent);
@@ -4335,7 +4463,7 @@ async function isUnderClaudeConfigMirrorRealpath(target) {
 		return false;
 	}
 	if (resolvedTargetParent === resolvedRoot) return true;
-	return resolvedTargetParent.startsWith(resolvedRoot + nodePath.sep);
+	return resolvedTargetParent.startsWith(resolvedRoot + path.sep);
 }
 /**
 * Try `fs.rename(temp, target)` with bounded retry + verify-on-fail.
@@ -4385,13 +4513,13 @@ async function injectMarkerBlock(opts) {
 		consola.warn(`${ERROR_CODE$1}: refusing to inject ${label} snippet that contains marker literal; this would corrupt idempotency on the next launch`);
 		return;
 	}
-	const target = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "CLAUDE.md");
+	const target = path.join(PATHS.CLAUDE_CONFIG_DIR, "CLAUDE.md");
 	if (!await isUnderClaudeConfigMirrorRealpath(target)) {
 		consola.warn(`${ERROR_CODE$1}: refusing to write outside resolved mirror dir (target=${target}, mirror=${PATHS.CLAUDE_CONFIG_DIR}) [${label}]`);
 		return;
 	}
-	let existingContent = "";
-	let targetExists = false;
+	let existingContent;
+	let targetExists;
 	try {
 		const linkStat = await fs.lstat(target);
 		if (linkStat.isSymbolicLink()) {
@@ -4568,9 +4696,25 @@ async function prependArtifactPanelDirectiveToMirroredClaudeMd(peersKey = "peers
 		label: "artifact-panel-directive"
 	});
 }
-
 //#endregion
 //#region src/lib/injected-skills/write.ts
+/**
+* Writer for injected skills: materializes a `SKILL.md` into the per-launch
+* `CLAUDE_CONFIG_DIR` mirror so the spawned Claude Code session discovers it as a
+* user-scope skill (`<CLAUDE_CONFIG_DIR>/skills/<name>/SKILL.md`, where the folder
+* name MUST equal the frontmatter `name` — the loader enforces this).
+*
+* Safety mirrors `claude-md-injection.ts`:
+*   - mirror-only write guard (symlink-resolving) so we never touch the user's
+*     real `~/.claude/skills/`;
+*   - ATOMIC temp+rename so a concurrent child process can never read a
+*     half-written `SKILL.md` (Claude Code watches the skills dir);
+*   - warn-and-continue on every failure — an injected skill is an enhancement,
+*     never a launch blocker.
+*
+* No per-skill stale sweep is needed: the whole per-launch mirror dir is GC'd by
+* `removeOwnClaudeConfigMirror` / `sweepStaleClaudeConfigMirrors`.
+*/
 /** Grep-able prefix on every warn path (mirrors the CLAUDE_MD_WRITE convention). */
 const ERROR_CODE = "INJECTED_SKILL_WRITE";
 /**
@@ -4586,13 +4730,13 @@ const VALID_SKILL_NAME = /^[a-z][a-z0-9-]*$/;
 * then the body). Idempotent across launches (overwrite); the per-launch mirror
 * dir is disposable.
 */
-async function writeInjectedSkill(name$1, md) {
-	if (!VALID_SKILL_NAME.test(name$1)) {
-		consola.warn(`${ERROR_CODE}: invalid skill name "${name$1}" (need lowercase kebab); skipping`);
+async function writeInjectedSkill(name, md) {
+	if (!VALID_SKILL_NAME.test(name)) {
+		consola.warn(`${ERROR_CODE}: invalid skill name "${name}" (need lowercase kebab); skipping`);
 		return { written: false };
 	}
-	const dir = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "skills", name$1);
-	const target = nodePath.join(dir, "SKILL.md");
+	const dir = path.join(PATHS.CLAUDE_CONFIG_DIR, "skills", name);
+	const target = path.join(dir, "SKILL.md");
 	try {
 		await fs.mkdir(dir, { recursive: true });
 	} catch (err) {
@@ -4621,9 +4765,15 @@ async function writeInjectedSkill(name$1, md) {
 		path: target
 	};
 }
-
 //#endregion
 //#region src/lib/injected-skills/index.ts
+/**
+* Injected-skill registry: the floor-raising / controller skills the `claude`
+* launcher materializes into the per-launch `CLAUDE_CONFIG_DIR` mirror so the
+* spawned Claude Code session discovers them (`/gh-research`,
+* `/gh-orchestrate`, `/gh-floor-keeper`, `/gh-first-mate`). See
+* `docs/floor-raising-agent-surface.md`.
+*/
 /** All injected skills, in dependency order (research underpins the others). */
 const INJECTED_SKILLS = [
 	RESEARCH_SKILL,
@@ -4635,7 +4785,6 @@ const INJECTED_SKILLS = [
 	FIRST_MATE_OPERATE_SKILL,
 	FIRST_MATE_CONDUCT_SKILL
 ];
-
 //#endregion
 //#region src/lib/attribution-settings.ts
 /**
@@ -4700,11 +4849,30 @@ async function injectAttributionSuppressionIntoSettingsFile(settingsPath) {
 	await fs.rename(tmp, settingsPath);
 	return { written: true };
 }
-
 //#endregion
 //#region src/lib/toolbelt/provision.ts
+/**
+* Toolbelt provisioner: materialize curated CLI tools into the durable
+* router `bin/` dir so the spawned agent can call them on PATH.
+*
+* Properties (all load-bearing):
+*   - **Best-effort.** Every tool is isolated in try/catch; a failure
+*     skips that one tool and never throws to the launcher.
+*   - **Gap-fill.** A tool already on the user's PATH is NOT
+*     materialized (and a stale copy is removed) so we never shadow the
+*     user's own `jq`/`yq`/etc.
+*   - **Verified.** The downloaded archive's SHA256 must match the
+*     hardcoded manifest digest BEFORE extraction.
+*   - **Safe extraction.** Only the expected regular-file binary is
+*     pulled out; symlink/hardlink/device entries are rejected.
+*   - **Concurrency-safe.** A cross-process lock serializes writers;
+*     unique temp names + atomic rename avoid half-written binaries.
+*   - **Integrity-pruned.** Unexpected files in `bin/` are removed each
+*     launch so a prompt-injected agent can't plant a `git.cmd` that
+*     shadows real tools in future sessions.
+*/
 /** Per-download cap (bytes) — these binaries are a few MB at most. */
-const MAX_DOWNLOAD_BYTES = 64 * 1024 * 1024;
+const MAX_DOWNLOAD_BYTES = 67108864;
 const DOWNLOAD_TIMEOUT_MS = 3e4;
 const EXE_EXT = process$1.platform === "win32" ? ".exe" : "";
 /**
@@ -4751,13 +4919,13 @@ async function pruneUnexpected(binDir) {
 	} catch {
 		return;
 	}
-	for (const name$1 of entries) {
-		if (name$1.endsWith(".tmp")) continue;
-		if (!expected.has(name$1)) await rm(nodePath.join(binDir, name$1), { force: true }).catch(() => {});
+	for (const name of entries) {
+		if (name.endsWith(".tmp")) continue;
+		if (!expected.has(name)) await rm(path.join(binDir, name), { force: true }).catch(() => {});
 	}
 }
 async function provisionRg(binDir, skip) {
-	const dest = nodePath.join(binDir, "rg" + EXE_EXT);
+	const dest = path.join(binDir, "rg" + EXE_EXT);
 	if (skip.has("rg") || resolveExecutable("rg")) {
 		await removeBin(dest);
 		return;
@@ -4775,7 +4943,7 @@ async function provisionRg(binDir, skip) {
 	await commit(tmp, dest);
 }
 async function provisionTool(spec, binDir, skip) {
-	const dest = nodePath.join(binDir, spec.binBasename + EXE_EXT);
+	const dest = path.join(binDir, spec.binBasename + EXE_EXT);
 	const sidecar = `${dest}.sha256`;
 	const asset = assetFor(spec);
 	if (skip.has(spec.command) || !asset) {
@@ -4843,7 +5011,7 @@ async function commit(tmp, dest) {
 }
 async function ensureAliases(spec, binDir, dest) {
 	for (const alias of spec.aliases ?? []) {
-		const ap = nodePath.join(binDir, alias + EXE_EXT);
+		const ap = path.join(binDir, alias + EXE_EXT);
 		if (existsSync(ap)) continue;
 		const tmp = tempName(ap);
 		try {
@@ -4856,8 +5024,8 @@ async function ensureAliases(spec, binDir, dest) {
 	}
 }
 async function removeTool(spec, binDir) {
-	await removeBin(nodePath.join(binDir, spec.binBasename + EXE_EXT));
-	for (const alias of spec.aliases ?? []) await removeBin(nodePath.join(binDir, alias + EXE_EXT));
+	await removeBin(path.join(binDir, spec.binBasename + EXE_EXT));
+	for (const alias of spec.aliases ?? []) await removeBin(path.join(binDir, alias + EXE_EXT));
 }
 async function removeBin(dest) {
 	await rm(dest, { force: true }).catch(() => {});
@@ -4887,10 +5055,14 @@ async function exposedCommands(binDir) {
 	for (const spec of TOOLBELT_TOOLS) if (present(spec.binBasename)) out.push(spec.command);
 	return out;
 }
-
 //#endregion
 //#region src/lib/keep-awake/flags.ts
 /**
+* Env-flag parsing for the Windows keep-awake feature. Pure +
+* unit-testable (no spawn, no platform branch — the platform gate lives
+* in `keepAwakeEnabled()`).
+*/
+/**
 * True unless the operator opted out via `GH_ROUTER_DISABLE_KEEP_AWAKE`.
 * Keep-awake is ON BY DEFAULT (the win32-only platform gate is applied
 * separately in `keepAwakeEnabled()`). Mirrors the colbert opt-out idiom
@@ -4907,11 +5079,26 @@ function keepAwakeOptedIn() {
 function keepDisplayOn() {
 	return parseBoolEnv(process$1.env.GH_ROUTER_KEEP_DISPLAY_ON) === true;
 }
-
 //#endregion
 //#region src/lib/keep-awake/helper.ts
+/**
+* The persistent PowerShell helper that holds a Win32
+* `SetThreadExecutionState` assertion for the proxy's lifetime.
+*
+* `SetThreadExecutionState` is THREAD-scoped: a one-shot process that
+* sets it and exits releases the assertion immediately. So a long-lived
+* helper holds it on its own main thread and blocks on stdin; when the
+* proxy dies (clean exit, signal, SIGKILL/taskkill, OOM) the stdin pipe
+* closes, the helper hits EOF, clears the assertion, and exits — and
+* Windows releases the thread's assertion on process death regardless.
+* The helper therefore cannot outlive the proxy, so no orphan sweep is
+* needed (unlike colbert/worktrees, which leave on-disk artifacts).
+*
+* Best-effort: every failure path (no powershell, Constrained Language
+* Mode blocking `Add-Type`, spawn error) degrades to a clean no-op. We
+* NEVER attempt to install, enable, or bypass language-mode/WDAC policy.
+*/
 const ES_CONTINUOUS = 2147483648;
-const ES_SYSTEM_REQUIRED = 1;
 const ES_DISPLAY_REQUIRED = 2;
 /** Default time to wait for the helper's `OK` readiness line.
 *
@@ -4941,7 +5128,7 @@ const DEFAULT_READY_TIMEOUT_MS = 2e4;
 * 32-bit value so the hex literal handed to PowerShell is positive.
 */
 function executionStateFlags(displayRequired) {
-	let flags = ES_CONTINUOUS | ES_SYSTEM_REQUIRED;
+	let flags = -2147483647;
 	if (displayRequired) flags |= ES_DISPLAY_REQUIRED;
 	return flags >>> 0;
 }
@@ -5057,17 +5244,37 @@ function killHelper(handle) {
 		killManagedTree(child);
 	} catch {}
 }
-
 //#endregion
 //#region src/lib/keep-awake/index.ts
 /**
+* Windows keep-awake — public entry points.
+*
+* `startKeepAwake()` is the fire-and-forget call the `start` / `claude` /
+* `codex` launchers invoke after `setupAndServe` (alongside
+* `provisionAndIndexColbert()` / `runSelfUpdate()`). On Windows, by
+* default, it spawns a persistent PowerShell helper that holds a
+* `SetThreadExecutionState(ES_CONTINUOUS | ES_SYSTEM_REQUIRED)`
+* assertion so the machine doesn't idle-sleep mid-session, and registers
+* SIGINT/SIGTERM/exit handlers to release it.
+*
+* Best-effort and model-agnostic: non-win32 is a total no-op; any
+* failure (no powershell, Constrained Language Mode blocking `Add-Type`)
+* degrades to a clean debug-logged no-op. We NEVER install, enable, or
+* bypass language-mode/WDAC policy, and never block or crash launch.
+*
+* Crash safety: the helper blocks on stdin, so if the proxy is hard-
+* killed the pipe closes, the helper hits EOF and exits, and Windows
+* releases the assertion on process death — no orphan is possible, so no
+* boot-time sweep is needed.
+*/
+/**
 * True iff keep-awake should run THIS launch: win32 AND not opted out.
 * Non-win32 short-circuits before anything else (no spawn, no flags read
 * beyond the opt-out, no handler registration). `platform` is injectable
 * for tests; production callers use the default `process.platform`.
 */
-function keepAwakeEnabled(platform$1 = process$1.platform) {
-	return platform$1 === "win32" && keepAwakeOptedIn();
+function keepAwakeEnabled(platform = process$1.platform) {
+	return platform === "win32" && keepAwakeOptedIn();
 }
 let _handle = null;
 let _started = false;
@@ -5149,7 +5356,6 @@ function startKeepAwake() {
 async function stopKeepAwake() {
 	releaseSync();
 }
-
 //#endregion
 //#region src/lib/first-mate/scheduler/autospawn.ts
 /**
@@ -5215,7 +5421,7 @@ function nodeDaemonSpawn(cmd, spawnOpts, spawnImpl = spawn) {
 function maybeSpawnDaemon(opts) {
 	const env = opts.env ?? process.env;
 	if (!shouldAutoSpawnDaemon(env, opts.agentsEnabled)) return void 0;
-	const script = nodePath.join(opts.repoRoot ?? process.cwd(), "scripts/first-mate-daemon.ts");
+	const script = path.join(opts.repoRoot ?? process.cwd(), "scripts/first-mate-daemon.ts");
 	if (opts.spawn === void 0 && !existsSync(script)) {
 		consola.debug(`first-mate daemon entry not found (${script}); auto-spawn skipped.`);
 		return;
@@ -5284,7 +5490,6 @@ function wireDaemonTeardown(handle, opts = {}) {
 		kill();
 	});
 }
-
 //#endregion
 //#region src/lib/proxy.ts
 function initProxyFromEnv() {
@@ -5330,26 +5535,23 @@ function initProxyFromEnv() {
 		consola.debug("Proxy setup skipped:", err);
 	}
 }
-
 //#endregion
 //#region package.json
 var name = "github-router";
-var version$1 = "0.3.240";
-
+var version$1 = "0.3.241";
 //#endregion
 //#region src/lib/approval.ts
 const awaitApproval = async () => {
 	if (!await consola.prompt(`Accept incoming request?`, { type: "confirm" })) throw new HTTPError("Request rejected by user", Response.json({ message: "Request rejected by user" }, { status: 403 }));
 };
-
 //#endregion
 //#region src/lib/rate-limit.ts
 const RATE_LIMIT_QUEUE_TIMEOUT_MS = 5e3;
 let rateLimitChain = Promise.resolve();
-async function checkRateLimit(state$1) {
-	if (state$1.rateLimitSeconds === void 0) return;
+async function checkRateLimit(state) {
+	if (state.rateLimitSeconds === void 0) return;
 	const ticket = { aborted: false };
-	const myTurn = rateLimitChain.then(() => doCheck(state$1, ticket));
+	const myTurn = rateLimitChain.then(() => doCheck(state, ticket));
 	rateLimitChain = myTurn.catch(() => {});
 	return Promise.race([myTurn, sleep$1(RATE_LIMIT_QUEUE_TIMEOUT_MS).then(() => {
 		ticket.aborted = true;
@@ -5362,21 +5564,21 @@ async function checkRateLimit(state$1) {
 		}, { status: 429 }));
 	})]);
 }
-async function doCheck(state$1, ticket) {
-	if (state$1.rateLimitSeconds === void 0) return;
+async function doCheck(state, ticket) {
+	if (state.rateLimitSeconds === void 0) return;
 	if (ticket.aborted) return;
 	const now = Date.now();
-	if (!state$1.lastRequestTimestamp) {
-		state$1.lastRequestTimestamp = now;
+	if (!state.lastRequestTimestamp) {
+		state.lastRequestTimestamp = now;
 		return;
 	}
-	const elapsedSeconds = (now - state$1.lastRequestTimestamp) / 1e3;
-	if (elapsedSeconds > state$1.rateLimitSeconds) {
-		state$1.lastRequestTimestamp = now;
+	const elapsedSeconds = (now - state.lastRequestTimestamp) / 1e3;
+	if (elapsedSeconds > state.rateLimitSeconds) {
+		state.lastRequestTimestamp = now;
 		return;
 	}
-	const waitTimeSeconds = Math.ceil(state$1.rateLimitSeconds - elapsedSeconds);
-	if (!state$1.rateLimitWait) {
+	const waitTimeSeconds = Math.ceil(state.rateLimitSeconds - elapsedSeconds);
+	if (!state.rateLimitWait) {
 		consola.warn(`Rate limit exceeded. Need to wait ${waitTimeSeconds} more seconds.`);
 		throw new HTTPError("Rate limit exceeded", Response.json({ message: "Rate limit exceeded" }, { status: 429 }));
 	}
@@ -5384,10 +5586,9 @@ async function doCheck(state$1, ticket) {
 	consola.warn(`Rate limit reached. Waiting ${waitTimeSeconds} seconds before proceeding...`);
 	await sleep$1(waitTimeMs);
 	if (ticket.aborted) return;
-	state$1.lastRequestTimestamp = Date.now();
+	state.lastRequestTimestamp = Date.now();
 	consola.info("Rate limit wait completed, proceeding with request");
 }
-
 //#endregion
 //#region src/lib/request-log.ts
 /**
@@ -5495,7 +5696,6 @@ function collectToolFieldKeys(body) {
 	for (const tool of tools) if (tool && typeof tool === "object" && !Array.isArray(tool)) for (const k of Object.keys(tool)) seen.add(k);
 	return [...seen].sort();
 }
-
 //#endregion
 //#region src/routes/chat-completions/handler.ts
 const ENCODER$1 = new TextEncoder();
@@ -5684,7 +5884,6 @@ function extractUserQuery$2(messages) {
 		}
 	}
 }
-
 //#endregion
 //#region src/routes/chat-completions/route.ts
 const completionRoutes = new Hono();
@@ -5695,7 +5894,6 @@ completionRoutes.post("/", async (c) => {
 		return await forwardError(c, error);
 	}
 });
-
 //#endregion
 //#region src/services/copilot/create-embeddings.ts
 const createEmbeddings = async (payload) => {
@@ -5708,19 +5906,18 @@ const createEmbeddings = async (payload) => {
 	if (!response.ok) throw new HTTPError("Failed to create embeddings", response);
 	return await response.json();
 };
-
 //#endregion
 //#region src/routes/embeddings/route.ts
 const embeddingRoutes = new Hono();
 embeddingRoutes.post("/", async (c) => {
 	try {
-		const response = await createEmbeddings(await c.req.json());
+		const payload = await c.req.json();
+		const response = await createEmbeddings(payload);
 		return c.json(response);
 	} catch (error) {
 		return await forwardError(c, error);
 	}
 });
-
 //#endregion
 //#region src/routes/mcp/route.ts
 const mcpRoutes = new Hono();
@@ -5752,10 +5949,43 @@ mcpRoutes.delete("/:group", (c) => {
 		return c.body(null, 500);
 	}
 });
-
 //#endregion
 //#region src/lib/sanitize-anthropic-body.ts
 /**
+* Inbound /v1/messages body sanitizer.
+*
+* Today this only handles ADVISOR-related corruption — the
+* proxy-generated `server_tool_use{name:"advisor"}` and paired
+* `advisor_tool_result` blocks may travel through Claude Code's
+* persisted conversation state with a malformed `id`/`tool_use_id`
+* (e.g., a leftover `toolu_*` value from before the round-5 fix).
+* Every replay of that history through `/v1/messages` would 400 at
+* Copilot's spec validator without rewriting them on inbound. This
+* module performs the rewrite.
+*
+* **Out of scope** (deliberate, per gemini-critic round 6 — the "ID
+* round-trip trap"): generic `tool_use.id` and `tool_result.tool_use_id`
+* are stateful references between requests; rewriting them statelessly
+* would break Claude Code's client-side tool tracker. Only advisor
+* blocks are touched here, because both sides of an advisor pair
+* (`server_tool_use` + `advisor_tool_result`) are proxy-generated and
+* round-trip together in the same request body — so a per-request
+* deterministic transformation preserves pairing without cross-request
+* state.
+*
+* **Round-7 holistic fix**: Copilot rejects `server_tool_use{name:
+* "advisor"}` outright (spec validator says only `web_search`,
+* `tool_search_tool_regex`, `tool_search_tool_bm25` are allowed), so
+* fixing the id format alone isn't enough. The sanitizer also
+* **translates** historical advisor pairs to the
+* `tool_use{__anthropic_advisor}` + `tool_result` shape Copilot
+* accepts (per user direction "Option C"). Multi-turn split is
+* required because `tool_result` must appear in a `user` role per
+* Anthropic spec. The `__anthropic_advisor` tool definition is
+* re-injected into `tools[]` so the `tool_use.name` reference
+* resolves.
+*/
+/**
 * Convert a `srvtoolu_*` id to the matching `toolu_*` id used in the
 * Copilot-replay shape (`tool_use.id` must match `^toolu_*$`). For
 * any other input shape, fall back to a synthesized `toolu_advisor_N`
@@ -5798,7 +6028,7 @@ function splitAssistantTurnAtAdvisorPairs(originalContent, syntheticIndexRef) {
 	while (i < originalContent.length) {
 		const block = originalContent[i];
 		const b = typeof block === "object" && block !== null ? block : null;
-		if (b && b.type === "server_tool_use" && b.name === ADVISOR_INTERNAL_TOOL_NAME.replace(/^__anthropic_/, "")) {
+		if (b && b.type === "server_tool_use" && b.name === "__anthropic_advisor".replace(/^__anthropic_/, "")) {
 			const stuId = typeof b.id === "string" ? b.id : "";
 			const nextBlock = originalContent[i + 1];
 			const next = typeof nextBlock === "object" && nextBlock !== null ? nextBlock : null;
@@ -5902,8 +6132,8 @@ function sanitizeAnthropicBody(rawBody) {
 			if (!content.some((b) => {
 				if (typeof b !== "object" || b === null) return false;
 				const type = b.type;
-				const name$1 = b.name;
-				return type === "server_tool_use" && name$1 === "advisor" || type === "advisor_tool_result";
+				const name = b.name;
+				return type === "server_tool_use" && name === "advisor" || type === "advisor_tool_result";
 			})) {
 				rebuilt.push(msg);
 				continue;
@@ -5920,7 +6150,7 @@ function sanitizeAnthropicBody(rawBody) {
 			const existingTools = Array.isArray(parsed.tools) ? parsed.tools : [];
 			if (!existingTools.some((t) => {
 				if (typeof t !== "object" || t === null) return false;
-				return t.name === ADVISOR_INTERNAL_TOOL_NAME;
+				return t.name === "__anthropic_advisor";
 			})) parsed.tools = [...existingTools, {
 				name: ADVISOR_INTERNAL_TOOL_NAME,
 				description: ADVISOR_TOOL_INSTRUCTIONS,
@@ -5935,9 +6165,24 @@ function sanitizeAnthropicBody(rawBody) {
 	if (!mutated) return rawBody;
 	return JSON.stringify(parsed);
 }
-
 //#endregion
 //#region src/lib/anthropic-translate/anthropic-sse.ts
+/**
+* Anthropic Messages SSE egress: frame builders + a Bun-safe ReadableStream
+* adapter that serializes a generator of Anthropic stream events to wire bytes.
+*
+* The synthesizer (see `responses-egress.ts`) is source-specific and yields
+* plain event objects; these builders + adapter own the Anthropic wire shape
+* and the stream lifecycle so the synthesizer stays a pure state machine.
+*
+* Stream-lifecycle contract (repo mandate for any synthesized SSE surface):
+* the adapter is pull-based (backpressure-respecting), guards every
+* `controller.enqueue`/`close` against the consumer-cancel race
+* (`isControllerClosedError`), and on a mid-stream upstream error emits a
+* terminal Anthropic `event: error` frame before closing — mirroring
+* `relayAnthropicStream`. Verified against Bun's
+* `TypeError: Invalid state: Controller is already closed`.
+*/
 function makeMessageId() {
 	return `msg_${randomUUID().replace(/-/g, "")}`;
 }
@@ -6067,11 +6312,11 @@ function anthropicSseStreamFromEvents(events, opts) {
 					safeClose(controller);
 					return;
 				}
-				const name$1 = err instanceof Error ? err.name : "Error";
+				const name = err instanceof Error ? err.name : "Error";
 				const message = err instanceof Error ? err.message : String(err);
-				consola.error(`Anthropic-translate stream interrupted at ${opts.routePath}: ${name$1}: ${JSON.stringify(message)}`);
+				consola.error(`Anthropic-translate stream interrupted at ${opts.routePath}: ${name}: ${JSON.stringify(message)}`);
 				try {
-					controller.enqueue(enc.encode(buildAnthropicErrorEvent(name$1, message)));
+					controller.enqueue(enc.encode(buildAnthropicErrorEvent(name, message)));
 				} catch (enqueueError) {
 					if (!isControllerClosedError(enqueueError)) consola.warn(`Could not deliver error event to consumer at ${opts.routePath}: ${enqueueError instanceof Error ? enqueueError.message : String(enqueueError)}`);
 				}
@@ -6105,7 +6350,6 @@ function anthropicSseStreamFromEvents(events, opts) {
 		}
 	});
 }
-
 //#endregion
 //#region src/lib/reasoning-effort.ts
 /**
@@ -6160,7 +6404,6 @@ function clampEffort(bucketed, supported) {
 	}
 	return best ?? bucketed;
 }
-
 //#endregion
 //#region src/lib/anthropic-translate/anthropic-request.ts
 /**
@@ -6502,7 +6745,6 @@ function parsedToResponsesPayload(parsed) {
 		stream: parsed.stream
 	});
 }
-
 //#endregion
 //#region src/lib/anthropic-translate/chat-request.ts
 /** Build the `data:` URI (base64) or return the verbatim URL for an image part. */
@@ -6652,9 +6894,32 @@ function parsedToChatPayload(parsed) {
 	if (parsed.parallelToolCalls === false) payload.parallel_tool_calls = false;
 	return payload;
 }
-
 //#endregion
 //#region src/lib/anthropic-translate/chat-egress.ts
+/**
+* Copilot `/chat/completions` → Anthropic Messages egress (the Gemini path).
+*
+*  - `chatResponseToAnthropicMessage` maps a non-streaming chat/completions
+*    object to an Anthropic Messages object (text + tool_use blocks, usage,
+*    stop_reason).
+*  - `synthAnthropicFromChat` is the streaming state machine: it consumes
+*    Copilot's chat SSE (`choices[].delta`) and yields Anthropic stream events
+*    (message_start → content_block_* → message_delta → message_stop), reusing
+*    the shared `anthropic-sse.ts` frame builders.
+*
+* Chat streaming differs from the Responses path in one load-bearing way: there
+* is NO authoritative per-tool `.done` event carrying the full arguments — a
+* tool call's `id`/`name` arrive early (first delta for its array `index`) and
+* its `arguments` stream incrementally across later deltas keyed by that same
+* array `index`. So each tool is BUFFERED per OpenAI array index and its
+* Anthropic block is emitted ATOMICALLY at end-of-stream (content_block_start →
+* one input_json_delta with the full assembled args → content_block_stop). This
+* carries the Phase 1 C1 correctness lesson to the chat path: parallel/multiple
+* tools keep DISTINCT block indices and never lose their args to a clobbered
+* shared pointer. An open TEXT block is closed before any tool block opens (a
+* tool_use must not nest inside a text block on the wire). The Anthropic block
+* index is assigned at emit time so indices stay monotonic on the wire.
+*/
 /** Synthesize a matchable Anthropic tool_use id when the upstream id is absent. */
 function makeToolUseId$1() {
 	return `toolu_${randomUUID().replace(/-/g, "")}`;
@@ -6802,8 +7067,8 @@ async function* synthAnthropicFromChat(upstream, opts) {
 					toolByIndex.set(tcd.index, entry);
 				}
 				if (typeof tcd.id === "string" && tcd.id.length > 0) entry.id = tcd.id;
-				const name$1 = tcd.function?.name;
-				if (typeof name$1 === "string" && name$1.length > 0) entry.name = name$1;
+				const name = tcd.function?.name;
+				if (typeof name === "string" && name.length > 0) entry.name = name;
 				const argDelta = tcd.function?.arguments;
 				if (typeof argDelta === "string" && argDelta.length > 0) entry.args += argDelta;
 			}
@@ -6811,10 +7076,7 @@ async function* synthAnthropicFromChat(upstream, opts) {
 		if (choice.finish_reason != null) finishReason = choice.finish_reason;
 	}
 	if (!sawDone) throw new Error("chat stream ended without a [DONE] sentinel (truncated)");
-	if (activeTextIndex != null) {
-		yield makeContentBlockStop(activeTextIndex);
-		activeTextIndex = null;
-	}
+	if (activeTextIndex != null) yield makeContentBlockStop(activeTextIndex);
 	let sawTool = false;
 	const orderedTools = [...toolByIndex.entries()].sort((a, b) => a[0] - b[0]);
 	for (const [, entry] of orderedTools) {
@@ -6837,10 +7099,38 @@ async function* synthAnthropicFromChat(upstream, opts) {
 	});
 	yield makeMessageStop();
 }
-
 //#endregion
 //#region src/lib/anthropic-translate/responses-egress.ts
 /**
+* OpenAI `/responses` → Anthropic Messages egress.
+*
+*  - `responsesResponseToAnthropicMessage` maps a non-streaming Responses object
+*    to an Anthropic Messages object (content blocks, tool_use, usage,
+*    stop_reason).
+*  - `synthAnthropicFromResponses` is the streaming state machine: it consumes
+*    Copilot's `/responses` SSE and yields Anthropic stream events
+*    (message_start → content_block_* → message_delta → message_stop).
+*
+* The decode follows our own empirically-verified `/responses` handling
+* (`src/lib/worker-agent/stream-fn.ts`): the tool/reasoning block key is the
+* STABLE `output_index`, never the per-event `item_id` — Copilot re-encrypts
+* `item_id` on every event, so an id key makes every delta lookup miss and the
+* tool args drop to `{}`.
+*
+* Block lifecycle (mirrors stream-fn.ts): every output item is tracked
+* independently by its `output_index` key. Parallel/interleaved tool calls
+* never force-close a sibling — Responses emits ALL `output_item.added` for
+* parallel tools BEFORE the first `function_call_arguments.delta`, so opening (and
+* emitting) a tool at `added` time would ship it with empty args and drop the
+* later deltas. Instead a tool's args are BUFFERED and its Anthropic block is
+* emitted ATOMICALLY (content_block_start → single input_json_delta with the
+* full assembled args → content_block_stop) at that tool's OWN
+* `output_item.done` (or flushed at end-of-stream if the item was left
+* dangling). Only an open TEXT or THINKING block is closed on a type switch —
+* never a sibling tool. The Anthropic block index is assigned at emit time, so
+* indices stay monotonic on the wire regardless of item interleaving.
+*/
+/**
 * Stable map key for a `/responses` output item: prefer `output_index`
 * (constant per item), fall back to the opaque id only when absent. Namespaced
 * so a numeric index and a string id can never collide.
@@ -6972,11 +7262,11 @@ async function* synthAnthropicFromResponses(upstream, opts) {
 		if (existing != null && current?.kind === "text" && current.index === existing.index) return existing;
 		closeCurrent();
 		const index = nextIndex++;
-		const state$1 = {
+		const state = {
 			index,
 			emitted: ""
 		};
-		textByKey.set(key, state$1);
+		textByKey.set(key, state);
 		current = {
 			index,
 			kind: "text"
@@ -6985,7 +7275,7 @@ async function* synthAnthropicFromResponses(upstream, opts) {
 			type: "text",
 			text: ""
 		}));
-		return state$1;
+		return state;
 	};
 	const ensureThinking = (key) => {
 		if (current?.kind === "thinking" && thinkingByKey.get(key) === current.index) return current.index;
@@ -7035,9 +7325,9 @@ async function* synthAnthropicFromResponses(upstream, opts) {
 			case "response.output_text.delta": {
 				const d = ev.delta;
 				if (typeof d !== "string" || d.length === 0) break;
-				const state$1 = ensureTextState(responsesKey(ev.output_index, ev.item_id) ?? "text");
-				state$1.emitted += d;
-				q.push(makeTextDelta(state$1.index, d));
+				const state = ensureTextState(responsesKey(ev.output_index, ev.item_id) ?? "text");
+				state.emitted += d;
+				q.push(makeTextDelta(state.index, d));
 				break;
 			}
 			case "response.output_text.done": {
@@ -7046,9 +7336,9 @@ async function* synthAnthropicFromResponses(upstream, opts) {
 				const existing = textByKey.get(key);
 				if (existing == null) {
 					if (fullText.length > 0) {
-						const state$1 = ensureTextState(key);
-						state$1.emitted = fullText;
-						q.push(makeTextDelta(state$1.index, fullText));
+						const state = ensureTextState(key);
+						state.emitted = fullText;
+						q.push(makeTextDelta(state.index, fullText));
 						closeCurrent();
 					}
 				} else if (currentKind() === "text" && currentIndex() === existing.index) {
@@ -7139,7 +7429,6 @@ async function* synthAnthropicFromResponses(upstream, opts) {
 				break;
 			}
 			case "response.failed": throw new Error(ev.response?.error?.message ?? "response.failed");
-			default: break;
 		}
 		for (const e of q) yield e;
 		q.length = 0;
@@ -7158,10 +7447,33 @@ async function* synthAnthropicFromResponses(upstream, opts) {
 	for (const e of q) yield e;
 	q.length = 0;
 }
-
 //#endregion
 //#region src/lib/anthropic-translate/classifier.ts
 /**
+* Routing classifier for `POST /v1/messages`.
+*
+* Claude Code speaks the Anthropic Messages wire format. Copilot only serves
+* Claude models on its native `/v1/messages` endpoint; a gpt/gemini request
+* sent there 400s. This classifier decides, from the RESOLVED model id and its
+* catalog metadata, whether a request stays on the native passthrough
+* (`createMessages`) or is diverted to the translation shim.
+*
+* Non-regression is the whole point — every Claude model (opus / sonnet / haiku /
+* any `claude-*` or Anthropic-vendored id) MUST return "claude-passthrough" so
+* its bytes reach `createMessages` unchanged — even if future catalog metadata
+* were to (wrongly) advertise a `/responses` endpoint for it. The Claude check
+* is therefore keyed off identity (id / vendor / family), NOT the endpoint.
+*
+* Non-Claude models are diverted to the translation shim by the endpoint the
+* catalog says they serve: `/responses` models (gpt-5.5, gpt-5.3-codex, …) take
+* the Responses path (`responses-shim`), `/chat/completions` models (gemini,
+* and any chat-default model) take the chat path (`chat-shim`). The decision is
+* derived from `pickEndpoint` (catalog `supported_endpoints`), never a
+* hardcoded slug list, so it generalizes. Copilot only serves Claude models on
+* its native `/v1/messages`, so diverting every non-Claude model to a shim is
+* correct — a non-Claude request sent to `/v1/messages` would 400.
+*/
+/**
 * Match "claude"/"anthropic" as a delimiter-bounded segment anywhere in a model
 * id: at the start, or after a `/ _ . : -` path/version delimiter, and followed
 * by end-of-string, another such delimiter, or a digit. This catches catalog
@@ -7214,7 +7526,6 @@ function classifyMessagesRoute(modelId, model, originalModelId) {
 	if (endpoint === "chat") return "chat-shim";
 	return "claude-passthrough";
 }
-
 //#endregion
 //#region src/lib/anthropic-translate/index.ts
 const STREAM_HEADERS = {
@@ -7338,7 +7649,6 @@ async function handleNonClaudeChat(c, opts) {
 	}, opts.model, opts.startTime);
 	return c.json(anthropic, 200);
 }
-
 //#endregion
 //#region src/routes/messages/handler.ts
 const isWebSearchTool$1 = (tool) => !!tool && typeof tool === "object" && (typeof tool.type === "string" && tool.type.startsWith("web_search") || tool.name === "web_search");
@@ -7431,7 +7741,7 @@ function stripAdvisorTool(rawBody) {
 	const original = body.tools;
 	const tools = original.filter((tool) => {
 		if (typeof tool !== "object" || tool === null) return true;
-		if (tool.name === ADVISOR_INTERNAL_TOOL_NAME) return false;
+		if (tool.name === "__anthropic_advisor") return false;
 		const type = tool.type;
 		return typeof type !== "string" || !type.startsWith("advisor_");
 	});
@@ -7500,7 +7810,8 @@ async function handleCompletion(c) {
 	}
 	if (state.manualApprove) await awaitApproval();
 	const betaHeaders = extractBetaHeaders(c);
-	const advisorEnabled = isAdvisorRequested(c.req.header("anthropic-beta"));
+	const incomingBeta = c.req.header("anthropic-beta");
+	const advisorEnabled = isAdvisorRequested(incomingBeta);
 	let finalBody = await processWebSearch(rawBody);
 	finalBody = sanitizeAnthropicBody(finalBody);
 	if (advisorEnabled) {
@@ -7812,7 +8123,7 @@ function stripAnthropicOnlyFields$1(body) {
 	if (body.output_config !== void 0) {
 		if (body.output_config && typeof body.output_config === "object") {
 			const oc = body.output_config;
-			const PROXY_OWNED_FIELDS = new Set(["effort"]);
+			const PROXY_OWNED_FIELDS = /* @__PURE__ */ new Set(["effort"]);
 			const schema = oc.schema;
 			const ocType = oc.type;
 			let strippedAny = false;
@@ -7869,7 +8180,6 @@ function appendStructuredOutputInstruction(body, schema, ocType) {
 	}];
 	else body.system = instruction.trimStart();
 }
-
 //#endregion
 //#region src/routes/messages/count-tokens-handler.ts
 const isWebSearchTool = (tool) => typeof tool.type === "string" && tool.type.startsWith("web_search") || tool.name === "web_search";
@@ -8005,7 +8315,7 @@ function stripAnthropicOnlyFields(body) {
 	if (body.output_config !== void 0) {
 		if (body.output_config && typeof body.output_config === "object") {
 			const oc = body.output_config;
-			const PROXY_OWNED_FIELDS = new Set(["effort"]);
+			const PROXY_OWNED_FIELDS = /* @__PURE__ */ new Set(["effort"]);
 			let strippedAny = false;
 			for (const key of Object.keys(oc)) if (!PROXY_OWNED_FIELDS.has(key)) {
 				delete oc[key];
@@ -8039,7 +8349,6 @@ function stripAnthropicOnlyFields(body) {
 	}
 	return stripped;
 }
-
 //#endregion
 //#region src/routes/messages/route.ts
 const messageRoutes = new Hono();
@@ -8057,15 +8366,14 @@ messageRoutes.post("/count_tokens", async (c) => {
 		return await forwardError(c, error);
 	}
 });
-
 //#endregion
 //#region src/routes/models/route.ts
 const modelRoutes = new Hono();
 modelRoutes.get("/", async (c) => {
 	try {
 		if (!state.models) await cacheModels();
-		const models$1 = state.models?.data.map((model) => {
-			const { requestHeaders,...rest } = model;
+		const models = state.models?.data.map((model) => {
+			const { requestHeaders, ...rest } = model;
 			return {
 				...rest,
 				object: "model",
@@ -8078,14 +8386,13 @@ modelRoutes.get("/", async (c) => {
 		});
 		return c.json({
 			object: "list",
-			data: models$1,
+			data: models,
 			has_more: false
 		});
 	} catch (error) {
 		return await forwardError(c, error);
 	}
 });
-
 //#endregion
 //#region src/routes/responses/handler.ts
 const ENCODER = new TextEncoder();
@@ -8379,7 +8686,6 @@ async function syntheticCompact(c, body, startTime) {
 		}
 	});
 }
-
 //#endregion
 //#region src/routes/responses/route.ts
 const responsesRoutes = new Hono();
@@ -8397,7 +8703,6 @@ responsesRoutes.post("/compact", async (c) => {
 		return await forwardError(c, error);
 	}
 });
-
 //#endregion
 //#region src/routes/search/route.ts
 const searchRoutes = new Hono();
@@ -8411,7 +8716,6 @@ searchRoutes.post("/", async (c) => {
 		return await forwardError(c, error);
 	}
 });
-
 //#endregion
 //#region src/routes/token/route.ts
 const tokenRoute = new Hono();
@@ -8422,7 +8726,6 @@ tokenRoute.get("/", (c) => {
 	} }, 403);
 	return c.json({ token: state.copilotToken });
 });
-
 //#endregion
 //#region src/routes/usage/route.ts
 const usageRoute = new Hono();
@@ -8435,7 +8738,6 @@ usageRoute.get("/", async (c) => {
 		return await forwardError(c, error);
 	}
 });
-
 //#endregion
 //#region src/server.ts
 assertMcpToolSurfaceConsistent();
@@ -8477,7 +8779,6 @@ server.notFound((c) => c.json({
 		message: `${c.req.method} ${c.req.path} not found`
 	}
 }, 404));
-
 //#endregion
 //#region src/lib/server-setup.ts
 const MAX_PORT_RETRIES = 10;
@@ -8646,7 +8947,7 @@ const sharedServerArgs = {
 		description: "Update github-router itself to the latest npm version on launch (throttled once/hour). Best-effort and non-blocking: the proxy serves immediately and a detached updater applies the new version after this process exits (it takes effect on the NEXT launch; the running process keeps its current build). Disable with --no-self-update or GH_ROUTER_NO_SELF_UPDATE=1. Skipped silently if npm/network unavailable."
 	}
 };
-const allowedAccountTypes = new Set([
+const allowedAccountTypes = /* @__PURE__ */ new Set([
 	"individual",
 	"business",
 	"enterprise"
@@ -8782,17 +9083,17 @@ function nativeSelectableModelsInCatalog() {
 * reject, dropping the rows). Rename-over-existing is atomic on POSIX and
 * Windows (libuv MoveFileEx REPLACE_EXISTING).
 */
-function seedGatewayModelCache(serverUrl, models$1, configDir = PATHS.CLAUDE_CONFIG_DIR) {
-	if (models$1.length === 0) return false;
-	const cacheDir = nodePath$1.join(configDir, "cache");
-	const target = nodePath$1.join(cacheDir, "gateway-models.json");
-	const tmp = nodePath$1.join(cacheDir, `gateway-models.json.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`);
+function seedGatewayModelCache(serverUrl, models, configDir = PATHS.CLAUDE_CONFIG_DIR) {
+	if (models.length === 0) return false;
+	const cacheDir = nodePath.join(configDir, "cache");
+	const target = nodePath.join(cacheDir, "gateway-models.json");
+	const tmp = nodePath.join(cacheDir, `gateway-models.json.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`);
 	try {
 		fs$2.mkdirSync(cacheDir, { recursive: true });
 		const payload = {
 			baseUrl: serverUrl,
 			fetchedAt: Date.now(),
-			models: models$1.map((m) => ({
+			models: models.map((m) => ({
 				id: m.id,
 				display_name: m.display_name
 			}))
@@ -8817,7 +9118,7 @@ function seedGatewayModelCache(serverUrl, models$1, configDir = PATHS.CLAUDE_CON
 */
 function clearGatewayModelCache(configDir = PATHS.CLAUDE_CONFIG_DIR) {
 	try {
-		fs$2.rmSync(nodePath$1.join(configDir, "cache", "gateway-models.json"), { force: true });
+		fs$2.rmSync(nodePath.join(configDir, "cache", "gateway-models.json"), { force: true });
 	} catch {}
 }
 /**
@@ -8912,11 +9213,10 @@ function getCodexEnvVars(serverUrl) {
 	if (toolbeltEnabled()) Object.assign(vars, toolbeltPathOverride(process.env, PATHS.TOOLBELT_BIN_DIR));
 	return vars;
 }
-
 //#endregion
 //#region src/claude.ts
-function isFirstMateSkillName(name$1) {
-	return name$1 === "gh-first-mate" || name$1 === "gh-first-mate-scaffold" || name$1 === "gh-first-mate-operate" || name$1 === "gh-first-mate-conduct";
+function isFirstMateSkillName(name) {
+	return name === "gh-first-mate" || name === "gh-first-mate-scaffold" || name === "gh-first-mate-operate" || name === "gh-first-mate-conduct";
 }
 const claudeArgs = {
 	...sharedServerArgs,
@@ -8987,10 +9287,10 @@ const claudeArgs = {
 function collectChildPassthroughArgs(rawArgs, argsDef) {
 	const known = /* @__PURE__ */ new Set();
 	const stringTyped = /* @__PURE__ */ new Set();
-	for (const [name$1, def] of Object.entries(argsDef)) {
+	for (const [name, def] of Object.entries(argsDef)) {
 		const rawAlias = "alias" in def ? def.alias : void 0;
 		const aliases = rawAlias === void 0 ? [] : Array.isArray(rawAlias) ? rawAlias : [rawAlias];
-		for (const n of [name$1, ...aliases]) {
+		for (const n of [name, ...aliases]) {
 			known.add(n);
 			if (def.type === "string") stringTyped.add(n);
 		}
@@ -9051,7 +9351,7 @@ const claude = defineCommand({
 		} catch (err) {
 			consola.debug("Claude version check failed:", err);
 		}
-		let server$1;
+		let server;
 		let serverUrl;
 		try {
 			const result = await setupAndServe({
@@ -9059,7 +9359,7 @@ const claude = defineCommand({
 				port: parsed.port,
 				silent: true
 			});
-			server$1 = result.server;
+			server = result.server;
 			serverUrl = result.serverUrl;
 		} catch (error) {
 			consola.error("Failed to start server:", error instanceof Error ? error.message : error);
@@ -9175,12 +9475,14 @@ const claude = defineCommand({
 				let skillsWritten = 0;
 				for (const s of skillsToWrite) if ((await writeInjectedSkill(s.name, s.md).catch(() => ({ written: false }))).written) skillsWritten++;
 				try {
-					await injectStopHookIntoSettingsFile(nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"), buildPromptSubmitHookCommand(process$1.execPath, process$1.argv[1]), "UserPromptSubmit", 45);
+					const settingsPath = path.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
+					const cmd = buildPromptSubmitHookCommand(process$1.execPath, process$1.argv[1]);
+					await injectStopHookIntoSettingsFile(settingsPath, cmd, "UserPromptSubmit", 45);
 				} catch (err) {
 					consola.warn(`Could not register the UserPromptSubmit hook: ${String(err)}`);
 				}
 				try {
-					const res = await injectAllowRules(nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"), planModeAllowRules(injected.ok ? injected.serversAdded : [...Object.values(groupKeys).filter((k) => Boolean(k)), ...backend === "cli" ? ["codex-cli"] : []]));
+					const res = await injectAllowRules(path.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"), planModeAllowRules(injected.ok ? injected.serversAdded : [...Object.values(groupKeys).filter((k) => Boolean(k)), ...backend === "cli" ? ["codex-cli"] : []]));
 					if (res.added.length) consola.debug(`Auto-approved for plan mode: ${res.added.join(", ")}`);
 				} catch (err) {
 					consola.warn(`Could not auto-approve injected tools: ${String(err)}`);
@@ -9188,10 +9490,12 @@ const claude = defineCommand({
 				if (!injected.ok) consola.warn("Workers non-blocking guard NOT registered: subagent MCP injection fell back to parent-only (--mcp-config), so worker-* dispatchers cannot reach the workers server. Raw (blocking) worker tools remain usable on the main thread this session.");
 				else if (process$1.env.GH_ROUTER_DISABLE_WORKER_GUARD === "1") consola.info("Workers non-blocking guard disabled via GH_ROUTER_DISABLE_WORKER_GUARD=1 — raw mcp__workers__* is callable on the main thread (blocking); the worker-* background agents remain the steered, non-blocking default.");
 				else try {
-					const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
+					const settingsPath = path.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
 					const workersKey = workersKeyOf(groupKeys);
 					const modes = activeDispatchModes({ browse: browseAgentEnabled() });
-					await injectStopHookIntoSettingsFile(settingsPath, buildWorkerGuardHookCommand(process$1.execPath, process$1.argv[1], workersKey, modes), "PreToolUse", 10, guardToolMatcher(workersKey, modes));
+					const cmd = buildWorkerGuardHookCommand(process$1.execPath, process$1.argv[1], workersKey, modes);
+					const matcher = guardToolMatcher(workersKey, modes);
+					await injectStopHookIntoSettingsFile(settingsPath, cmd, "PreToolUse", 10, matcher);
 				} catch (err) {
 					consola.warn(`Could not register the workers PreToolUse guard hook: ${String(err)}`);
 				}
@@ -9203,7 +9507,9 @@ const claude = defineCommand({
 			if (agentToolsEnabled()) {
 				let shapingInstalled = false;
 				try {
-					await injectStopHookIntoSettingsFile(nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"), buildFirstMateGuardHookCommand(process$1.execPath, process$1.argv[1]), "PreToolUse", void 0, FIRST_MATE_GUARD_MATCHER);
+					const settingsPath = path.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
+					const guardCmd = buildFirstMateGuardHookCommand(process$1.execPath, process$1.argv[1]);
+					await injectStopHookIntoSettingsFile(settingsPath, guardCmd, "PreToolUse", void 0, FIRST_MATE_GUARD_MATCHER);
 					shapingInstalled = true;
 				} catch (err) {
 					consola.error(`Could not register the operator worker/orchestrate guard hook: ${String(err)}`);
@@ -9212,7 +9518,7 @@ const claude = defineCommand({
 			}
 			const aiordieSidecar = (process$1.env.AIORDIE_CLAUDE_BIND ?? "").trim();
 			if (aiordieSidecar.length > 0 && !aiordieSidecar.includes("\"")) try {
-				const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
+				const settingsPath = path.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
 				const command = buildSessionBindHookCommand(process$1.execPath, process$1.argv[1], aiordieSidecar);
 				await injectStopHookIntoSettingsFile(settingsPath, command, "SessionStart");
 				await injectStopHookIntoSettingsFile(settingsPath, command, "SessionEnd");
@@ -9228,13 +9534,17 @@ const claude = defineCommand({
 				}
 				try {
 					await writeArtifactCredsToMirror(shouldUseInsecureTls(process$1.env.AIORDIE_BASE_URL ?? ""));
-					await injectStopHookIntoSettingsFile(nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"), buildArtifactOpenHookCommand(process$1.execPath, process$1.argv[1]), "PostToolUse", void 0, "ExitPlanMode");
+					const settingsPath = path.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
+					const cmd = buildArtifactOpenHookCommand(process$1.execPath, process$1.argv[1]);
+					await injectStopHookIntoSettingsFile(settingsPath, cmd, "PostToolUse", void 0, "ExitPlanMode");
 				} catch (err) {
 					consola.warn(`Could not register the artifact auto-open hook: ${String(err)}`);
 				}
 			}
 			if (hookMcpRuntimeFromEnv(envVars) && planReviewEnabled()) try {
-				await injectStopHookIntoSettingsFile(nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"), buildPlanReviewHookCommand(process$1.execPath, process$1.argv[1]), "PostToolUse", void 0, "ExitPlanMode");
+				const settingsPath = path.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
+				const command = buildPlanReviewHookCommand(process$1.execPath, process$1.argv[1]);
+				await injectStopHookIntoSettingsFile(settingsPath, command, "PostToolUse", void 0, "ExitPlanMode");
 			} catch (err) {
 				consola.warn(`Could not register the advisory plan-review hook: ${String(err)}`);
 			}
@@ -9281,7 +9591,7 @@ const claude = defineCommand({
 			if (gateEnabled && descriptor) {
 				const armed = descriptor;
 				try {
-					const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
+					const settingsPath = path.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
 					const command = buildStopHookCommand(process$1.execPath, process$1.argv[1]);
 					if (armed.kind === "sealed") envVars.GH_ROUTER_STOP_GATE_ID = armed.gateId;
 					else if (armed.kind === "parsed") envVars.GH_ROUTER_STOP_GATE_PARSED = "1";
@@ -9300,7 +9610,7 @@ const claude = defineCommand({
 								exec: liveExec,
 								descriptorKey,
 								token,
-								baseline: fileBaselineStore(nodePath.join(tmpdir(), "gh-router-stopgate-baseline"))
+								baseline: fileBaselineStore(path.join(tmpdir(), "gh-router-stopgate-baseline"))
 							});
 						})().catch(() => {});
 					}
@@ -9381,7 +9691,7 @@ const claude = defineCommand({
 			consola.warn(`Operating-defaults CLAUDE.md prepend failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		if (process$1.env.GH_ROUTER_DISABLE_NO_ATTRIBUTION !== "1") try {
-			await injectAttributionSuppressionIntoSettingsFile(nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"));
+			await injectAttributionSuppressionIntoSettingsFile(path.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"));
 		} catch (err) {
 			consola.warn(`No-attribution settings backstop skipped: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -9390,10 +9700,9 @@ const claude = defineCommand({
 			envVars,
 			extraArgs,
 			model: chosenSlug
-		}, server$1, { onShutdown });
+		}, server, { onShutdown });
 	}
 });
-
 //#endregion
 //#region src/codex.ts
 const codex = defineCommand({
@@ -9415,7 +9724,7 @@ const codex = defineCommand({
 			process$1.exit(1);
 		}
 		const parsed = parseSharedArgs(args);
-		let server$1;
+		let server;
 		let serverUrl;
 		try {
 			const result = await setupAndServe({
@@ -9423,7 +9732,7 @@ const codex = defineCommand({
 				port: parsed.port,
 				silent: true
 			});
-			server$1 = result.server;
+			server = result.server;
 			serverUrl = result.serverUrl;
 		} catch (error) {
 			consola.error("Failed to start server:", error instanceof Error ? error.message : error);
@@ -9436,7 +9745,7 @@ const codex = defineCommand({
 		startKeepAwake();
 		if ((state.browseEnabled || process$1.env.GH_ROUTER_ENABLE_BROWSE === "1") && hasSupportedBrowserInstalled()) provisionBrowserAssets().catch((err) => consola.debug("Browser extension provisioning failed:", err));
 		const usingDefault = !args.model;
-		const requestedModel = args.model ?? DEFAULT_CODEX_MODEL;
+		const requestedModel = args.model ?? "gpt-5.6-sol";
 		enableFileLogging();
 		let codexModel = resolveCodexModel(requestedModel);
 		if (codexModel !== requestedModel) consola.info(`Model "${requestedModel}" resolved to "${codexModel}"`);
@@ -9463,13 +9772,12 @@ const codex = defineCommand({
 			extraArgs: args._ ?? [],
 			model: codexModel,
 			serverUrl
-		}, server$1);
+		}, server);
 	}
 });
-
 //#endregion
 //#region src/debug.ts
-async function getPackageVersion$1() {
+async function getPackageVersion() {
 	try {
 		const packageJsonPath = new URL("../package.json", import.meta.url).pathname;
 		return JSON.parse(await fs.readFile(packageJsonPath)).version;
@@ -9495,9 +9803,9 @@ async function checkTokenExists() {
 	}
 }
 async function getDebugInfo() {
-	const [version$2, tokenExists] = await Promise.all([getPackageVersion$1(), checkTokenExists()]);
+	const [version, tokenExists] = await Promise.all([getPackageVersion(), checkTokenExists()]);
 	return {
-		version: version$2,
+		version,
 		runtime: getRuntimeInfo(),
 		paths: {
 			APP_DIR: PATHS.APP_DIR,
@@ -9540,10 +9848,27 @@ const debug = defineCommand({
 		return runDebug({ json: args.json });
 	}
 });
-
 //#endregion
 //#region src/internal-prompt-submit.ts
 /**
+* The internal `internal-prompt-submit` subcommand: the executable a spawned
+* Claude Code session's `UserPromptSubmit` hook invokes (registered into the
+* mirrored settings.json by the launcher). It serves the front-end of the
+* floor-raising surface on one event:
+*   1. resets the Stop-gate's per-session block budget (making `maxBlocks`
+*      per-prompt);
+*   2. stashes the prompt + surfaces the prior turn's advisory review findings;
+*   3. for a non-trivial prompt, injects a GROUNDED, user-derived scope/goal
+*      note (one gpt-5.6-sol call over the prompt + a parallel lexical+semantic code
+*      search) — or, when the proxy URL/nonce isn't wired or anything errors,
+*      falls open to the v1 regex goal.
+*
+* ALWAYS exits 0 (never blocks the prompt): the steer is additive context, and a
+* UserPromptSubmit hook that exit-2'd would refuse the user's prompt. The pure
+* v1 path (`decidePromptSubmit`) is the fail-open fallback; V2
+* (`decidePromptSubmitV2`) layers the grounded enrichment on top via injected IO.
+*/
+/**
 * Read the hook payload from stdin SYNCHRONOUSLY (`readFileSync(0)`). An async
 * stdin read leaves an in-flight libuv FS request that, on Windows, races the
 * process teardown and trips a `uv_async_send` assertion; a synchronous read has
@@ -9626,15 +9951,25 @@ const internalPromptSubmit = defineCommand({
 				stdin,
 				steerEnabled
 			});
-			if (decision.resetSession) await fileBlockBudget(nodePath.join(tmpdir(), "gh-router-stopgate")).reset(decision.resetSession).catch(() => {});
+			if (decision.resetSession) await fileBlockBudget(path.join(tmpdir(), "gh-router-stopgate")).reset(decision.resetSession).catch(() => {});
 			if (decision.inject.length > 0) await new Promise((resolve) => process.stdout.write(`${decision.inject}\n`, () => resolve()));
 		} catch {}
 		process.exitCode = 0;
 	}
 });
-
 //#endregion
 //#region src/internal-plan-review.ts
+/**
+* The internal `internal-plan-review` subcommand: a PostToolUse(ExitPlanMode)
+* hook that spawns a bounded advisory critic review when the main agent finalizes
+* a substantive plan.
+*
+* It never blocks ExitPlanMode: the hook process exits 0 quickly after deciding
+* whether to spawn a detached reviewer. The detached child calls a cross-lab plan
+* critic and writes material findings to the SAME per-session findings store used
+* by the Stop review, so the next UserPromptSubmit surfaces them with the existing
+* non-authoritative findings path.
+*/
 function readStdin$4() {
 	try {
 		if (process.stdin.isTTY) return "";
@@ -9669,7 +10004,7 @@ function spawnDetachedPlanReview(ctx) {
 	try {
 		const dir = stopReviewStateDir();
 		mkdirSync(dir, { recursive: true });
-		payloadPath = nodePath.join(dir, `plan-review-${process.pid}-${randomBytes(4).toString("hex")}.json`);
+		payloadPath = path.join(dir, `plan-review-${process.pid}-${randomBytes(4).toString("hex")}.json`);
 		writeFileSync(payloadPath, JSON.stringify(ctx), { mode: 384 });
 		const scriptArgs = process.argv[1] && process.argv[1] !== process.execPath ? [process.argv[1]] : [];
 		const child = spawn(process.execPath, [...scriptArgs, "internal-plan-review"], {
@@ -9725,10 +10060,30 @@ const internalPlanReview = defineCommand({
 		process.exitCode = 0;
 	}
 });
-
 //#endregion
 //#region src/internal-session-bind.ts
 /**
+* The internal `internal-session-bind` subcommand: the executable a spawned Claude
+* Code session's SessionStart / SessionEnd hooks invoke (registered into the
+* mirrored settings.json by the launcher when `AIORDIE_CLAUDE_BIND` is set —
+* i.e. when github-router runs inside an ai-or-die Terminal tab).
+*
+* It reads Claude Code's hook payload from stdin and ATOMICALLY writes a tiny
+* "sidecar" JSON file (path passed via `--out`) describing the CURRENTLY active
+* claude session: its sessionId and the absolute transcript path. ai-or-die owns
+* the sidecar path and watches it, so it can bind that browser tab's session
+* summariser to the exact transcript — surviving in-session `/resume`, `/clear`,
+* `/compact`, and exit→relaunch, without guessing from the filesystem.
+*
+* Side-effect only: writes the file and exits 0. It NEVER writes to stdout (a
+* SessionStart hook's stdout is injected into the model's context) and NEVER
+* blocks (any error is swallowed → exit 0).
+*
+* Top-level filter: a SessionStart fired by a subagent/teammate carries
+* `agent_id`/`agent_type`; those are skipped so only the tab's top-level session
+* drives the binding (mirrors the Stop / UserPromptSubmit hooks).
+*/
+/**
 * Read the hook payload from stdin SYNCHRONOUSLY (`readFileSync(0)`). An async
 * stdin read leaves an in-flight libuv FS request that, on Windows, races process
 * teardown and trips a `uv_async_send` assertion; a synchronous read has no such
@@ -9759,11 +10114,11 @@ function realTranscriptPath(tp) {
 	const missing = [];
 	let cur = tp;
 	for (let i = 0; i < 64; i++) {
-		missing.unshift(nodePath.basename(cur));
-		const parent = nodePath.dirname(cur);
+		missing.unshift(path.basename(cur));
+		const parent = path.dirname(cur);
 		if (parent === cur) break;
 		try {
-			return nodePath.join(realpathSync.native(parent), ...missing);
+			return path.join(realpathSync.native(parent), ...missing);
 		} catch {
 			cur = parent;
 		}
@@ -9804,7 +10159,7 @@ function decodeSessionBind(stdin) {
 /** Atomically write the sidecar (temp + rename) so the reader never sees a partial file. */
 function writeSidecar(out, record) {
 	try {
-		mkdirSync(nodePath.dirname(out), { recursive: true });
+		mkdirSync(path.dirname(out), { recursive: true });
 	} catch {}
 	const tmp = `${out}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
 	writeFileSync(tmp, JSON.stringify(record), { mode: 384 });
@@ -9830,7 +10185,6 @@ const internalSessionBind = defineCommand({
 		process.exitCode = 0;
 	}
 });
-
 //#endregion
 //#region src/internal-workspace-header.ts
 function workspaceHeaderJsonForCwd(cwd = process.cwd()) {
@@ -9850,9 +10204,22 @@ const internalWorkspaceHeader = defineCommand({
 		process.exitCode = 0;
 	}
 });
-
 //#endregion
 //#region src/lib/artifact/plan-html.ts
+/**
+* Render a plan's markdown into a self-contained, styled HTML document for the
+* ai-or-die Artifact panel. HTML is the canonical review artifact (lavish's
+* model); converting here means the hands-off auto-open shows a formatted,
+* annotatable page instead of raw markdown.
+*
+* Security: the iframe ai-or-die serves this into runs with
+* `allow-scripts allow-same-origin`, so a `<script>` smuggled into the plan
+* markdown could read the per-session asset token. Two defenses:
+*   1. marked is configured to ESCAPE raw HTML tokens (render as visible text).
+*   2. `link`/`image` hrefs with script-bearing schemes (javascript:, vbscript:,
+*      non-image data:) are neutralised before rendering.
+* No separate sanitizer/dep needed.
+*/
 function escapeHtml(s) {
 	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
@@ -9937,7 +10304,7 @@ function renderMarkdownBody(source) {
 	let line = 1;
 	let out = "";
 	for (const tok of tokens) {
-		let html = "";
+		let html;
 		try {
 			html = m.parser([tok]);
 		} catch {
@@ -10010,9 +10377,30 @@ ${body}
 </html>
 `;
 }
-
 //#endregion
 //#region src/internal-artifact-open.ts
+/**
+* The internal `internal-artifact-open` subcommand: invoked by a spawned Claude
+* Code session's `PostToolUse` hook (matcher `ExitPlanMode`), registered into the
+* mirrored settings.json by the launcher when running inside an ai-or-die tab
+* (`AIORDIE_SESSION_ID` set). It auto-opens the just-finalized plan in the
+* ai-or-die Artifact review panel so the human reviews it WITHOUT the model
+* having to call artifact_open itself.
+*
+* Auth: AIORDIE_TOKEN is stripped from the child env, so the token can't come via
+* env or argv (argv leaks to `ps`). The launcher writes a mode-600
+* `.aiordie-artifact.json` into CLAUDE_CONFIG_DIR; this hook reads it.
+*
+* Plan: the EXACT plan for THIS session comes from the ExitPlanMode payload —
+* `tool_input.planFilePath` (per-session; never the globally-newest file in the
+* shared plans dir) with `tool_input.plan` as the markdown fallback. The plan
+* markdown is rendered to a self-contained styled HTML file (HTML is the
+* canonical artifact, lavish's model — formatted + annotatable, not raw md), and
+* THAT `.html` is opened.
+*
+* Side-effect only: never writes stdout, never throws, always exits 0. Skips
+* subagent payloads (agent_id/agent_type) like the other hooks.
+*/
 function readStdin$2() {
 	try {
 		if (process.stdin.isTTY) return "";
@@ -10022,8 +10410,8 @@ function readStdin$2() {
 	}
 }
 function credsPath() {
-	const dir = process.env.CLAUDE_CONFIG_DIR || nodePath.join(homedir(), ".claude");
-	return nodePath.join(dir, ".aiordie-artifact.json");
+	const dir = process.env.CLAUDE_CONFIG_DIR || path.join(homedir(), ".claude");
+	return path.join(dir, ".aiordie-artifact.json");
 }
 function isSubagent(payload) {
 	try {
@@ -10068,7 +10456,7 @@ function resolvePlanMarkdown(p) {
 		const md = readFileSync(p.planFilePath, "utf8");
 		if (md.trim()) return {
 			markdown: md,
-			title: nodePath.basename(p.planFilePath, nodePath.extname(p.planFilePath)),
+			title: path.basename(p.planFilePath, path.extname(p.planFilePath)),
 			nearPath: p.planFilePath
 		};
 	} catch {}
@@ -10086,8 +10474,8 @@ function writePlanHtml(html, nearPath) {
 	let target;
 	if (nearPath) target = `${nearPath.replace(/\.(md|markdown)$/i, "")}.aiordie.html`;
 	else {
-		const dir = nodePath.join(process.env.CLAUDE_CONFIG_DIR || nodePath.join(homedir(), ".claude"), "plans");
-		target = nodePath.join(dir, `aiordie-plan-${process.pid}.html`);
+		const dir = path.join(process.env.CLAUDE_CONFIG_DIR || path.join(homedir(), ".claude"), "plans");
+		target = path.join(dir, `aiordie-plan-${process.pid}.html`);
 	}
 	try {
 		writeFileSync(target, html, "utf8");
@@ -10125,10 +10513,23 @@ const internalArtifactOpen = defineCommand({
 		} catch {}
 	}
 });
-
 //#endregion
 //#region src/internal-stop-hook.ts
 /**
+* The internal `internal-stop-hook` subcommand: the executable a spawned Claude
+* Code session's Stop hook invokes (registered into the mirrored settings.json by
+* the launcher when `GH_ROUTER_ENABLE_STOP_GATE` is set). It reads Claude Code's
+* hook payload from stdin, runs the SEALED structural gate over the session's
+* working-tree diff, and maps the result to the hook exit contract: exit 2 (with
+* the reason on stderr) blocks the stop so the model fixes the failure; exit 0
+* allows it. The `stop_hook_active` loop guard (in `decideStopHook`) guarantees
+* it can never wedge the session.
+*
+* All decision logic lives in `decideStopHook` (pure, unit-tested); this wrapper
+* only does stdin read + the live `git diff` capture + the exit. The live firing
+* is verified by the gated E2E (it needs a real spawned session).
+*/
+/**
 * Read the hook payload from stdin SYNCHRONOUSLY (`readFileSync(0)`). An async
 * stdin read leaves an in-flight libuv FS request that, on Windows, races the
 * process teardown and trips a `uv_async_send` assertion; a synchronous read has
@@ -10145,7 +10546,7 @@ function readStdin$1() {
 }
 /** Max diff bytes scanned for gate-weakening: a hard cap so a huge generated diff
 *  (e.g. a lockfile) can never OOM or stall the hook. */
-const MAX_DIFF_BYTES = 2 * 1024 * 1024;
+const MAX_DIFF_BYTES = 2097152;
 /** Capture the working-tree diff WITHOUT mutating the user's index (no
 *  `git add -N`): `git diff HEAD` covers modified tracked files, which is where
 *  gate-weakening edits live. A git failure rejects, so the decision layer can run
@@ -10184,7 +10585,7 @@ function spawnStopReview(ctx, extras) {
 	try {
 		const dir = stopReviewStateDir();
 		mkdirSync(dir, { recursive: true });
-		payloadPath = nodePath.join(dir, `payload-${process.pid}-${randomBytes(4).toString("hex")}.json`);
+		payloadPath = path.join(dir, `payload-${process.pid}-${randomBytes(4).toString("hex")}.json`);
 		writeFileSync(payloadPath, JSON.stringify({
 			session_id: ctx.sessionId,
 			cwd: ctx.cwd,
@@ -10246,11 +10647,12 @@ function buildResolveChecks(mode) {
 		if (checks.length === 0) return null;
 		const descriptorKey = descriptorHash(descriptor);
 		const workdir = descriptor.workdir || root;
+		const token = process.env.GH_ROUTER_STOP_GATE_BASELINE_TOKEN || void 0;
 		return {
 			checks,
 			workdir,
 			descriptorKey,
-			baselineKey: launchBaselineKey(workdir, descriptorKey, process.env.GH_ROUTER_STOP_GATE_BASELINE_TOKEN || void 0)
+			baselineKey: launchBaselineKey(workdir, descriptorKey, token)
 		};
 	};
 }
@@ -10288,8 +10690,8 @@ const internalStopHook = defineCommand({
 				exec: liveExec,
 				captureDiff,
 				fallbackCwd: process.cwd(),
-				budget: fileBlockBudget(nodePath.join(tmpdir(), "gh-router-stopgate")),
-				baseline: fileBaselineStore(nodePath.join(tmpdir(), "gh-router-stopgate-baseline")),
+				budget: fileBlockBudget(path.join(tmpdir(), "gh-router-stopgate")),
+				baseline: fileBaselineStore(path.join(tmpdir(), "gh-router-stopgate-baseline")),
 				isEnabledForRepo: (cwd) => stopGateEnabledForRepo(cwd),
 				resolveChecks: mode ? buildResolveChecks(mode) : void 0,
 				timeoutMs: timeoutEnv,
@@ -10308,10 +10710,29 @@ const internalStopHook = defineCommand({
 		process.exitCode = decision.exitCode;
 	}
 });
-
 //#endregion
 //#region src/internal-stop-review.ts
 /**
+* The internal `internal-stop-review` subcommand: the DETACHED background process
+* the Stop hook spawns (fire-and-forget, unref'd) after a GREEN deterministic
+* gate. It runs the advisory cross-lab review described in
+* `docs/hook-v2-design.md` — ADVISORY ONLY, it never blocks anything (the Stop
+* hook already returned exit 0 before this process even started).
+*
+* It reads a JSON payload from stdin (`{session_id, cwd, diff, prompt,
+* transcript_path}`), calls the read-only `workers/review` MCP tool over loopback
+* HTTP (gpt-5.6-sol, the live working tree, an accountability brief: judge the diff
+* against the user's actual ask for wrong-spec / vacuous-tests / incompleteness),
+* and writes the findings to the per-session findings file. The next
+* `UserPromptSubmit` surfaces them to Claude NON-authoritatively, and the user
+* sees them as an accountability log.
+*
+* Everything is best-effort: a missing proxy URL/nonce, an unavailable model, a
+* review error, or an empty result all end the process with NO findings written
+* and exit 0. It NEVER authors or runs tests (that path was rejected in design as
+* non-monotone — see the handoff).
+*/
+/**
 * Read the JSON payload. The Stop hook writes it to a temp file (synchronously,
 * before spawning) and passes the path via `GH_ROUTER_STOP_REVIEW_PAYLOAD` — this
 * avoids the stdin-flush-before-parent-exit race a pipe would have for a large
@@ -10340,12 +10761,12 @@ async function readPayload() {
 /** Embed at most this many diff bytes in the review brief; the reviewer reads the
 *  live tree itself for anything beyond it, so a giant diff never blows the model
 *  window. The Stop hook already caps the captured diff at 2 MiB. */
-const MAX_EMBEDDED_DIFF_BYTES = 200 * 1024;
+const MAX_EMBEDDED_DIFF_BYTES = 204800;
 /** Wall-clock the stop-gate reviewer may take. This is INDEPENDENT of the
 *  autonomous worker's wall-clock cap (`DEFAULT_MAX_WALLCLOCK_MS`, now 6h) —
 *  it bounds this one detached review request. Nothing waits on this process,
 *  so the bound only stops a hung request from lingering forever. */
-const REVIEW_TIMEOUT_MS = 2100 * 1e3;
+const REVIEW_TIMEOUT_MS = 21e5;
 function buildReviewBrief(payload) {
 	const diff = payload.diff.length > MAX_EMBEDDED_DIFF_BYTES ? `${payload.diff.slice(0, MAX_EMBEDDED_DIFF_BYTES)}\n\n[diff truncated at ${MAX_EMBEDDED_DIFF_BYTES} bytes — read the files directly for the rest]` : payload.diff;
 	return `You are an INDEPENDENT accountability reviewer. A coding agent just finished a turn and its working-tree diff passed the deterministic checks (typecheck/test/lint). Your job is to judge whether the change ACTUALLY does what the user asked — passing checks does not prove that.
@@ -10403,10 +10824,28 @@ const internalStopReview = defineCommand({
 		} catch {}
 	}
 });
-
 //#endregion
 //#region src/internal-worker-guard.ts
 /**
+* The internal `internal-worker-guard` subcommand: the executable a spawned
+* Claude Code session's `PreToolUse` hook invokes for the workers tools
+* (registered into the mirrored settings.json by the launcher, with a matcher
+* scoped to `^mcp__<workersKey>__(explore|…)$`).
+*
+* It enforces the "workers are non-blocking" invariant: the MAIN agent (and any
+* non-dispatcher subagent) is DENIED a raw `mcp__<workersKey>__<mode>` call and
+* redirected to the matching background `worker-<mode>` dispatcher subagent; the
+* dispatcher's own call (identified by `agent_type` in the payload) is ALLOWED.
+* All the logic lives in the pure `decideWorkerGuard` (worker-dispatch.ts); this
+* entry is just stdin → decide → stdout.
+*
+* Output contract (Claude Code PreToolUse):
+*   - ALLOW → print nothing, exit 0 (normal permission flow proceeds).
+*   - DENY  → print the `{hookSpecificOutput:{permissionDecision:"deny",…}}`
+*             JSON to stdout, exit 0 (the JSON, not the exit code, blocks it).
+* Fail CLOSED: an unparseable payload for a matched worker tool is denied.
+*/
+/**
 * Read the hook payload from stdin SYNCHRONOUSLY (`readFileSync(0)`) — same
 * rationale as `internal-prompt-submit`: an async stdin read leaves an in-flight
 * libuv FS request that races Windows process teardown. Hooks always receive
@@ -10453,7 +10892,6 @@ const internalWorkerGuard = defineCommand({
 		process.exitCode = 0;
 	}
 });
-
 //#endregion
 //#region src/models.ts
 const models = defineCommand({
@@ -10513,9 +10951,9 @@ const models = defineCommand({
 		process.stdout.write(lines.join("\n"));
 	}
 });
-function filterModels(models$1, pattern) {
+function filterModels(models, pattern) {
 	const needle = pattern.toLowerCase();
-	return models$1.filter((m) => {
+	return models.filter((m) => {
 		return [
 			m.id,
 			m.name,
@@ -10526,9 +10964,9 @@ function filterModels(models$1, pattern) {
 		].join(" ").toLowerCase().includes(needle);
 	});
 }
-function groupByVendor(models$1) {
+function groupByVendor(models) {
 	const map = /* @__PURE__ */ new Map();
-	for (const m of models$1) {
+	for (const m of models) {
 		const key = m.vendor || "(unknown vendor)";
 		const bucket = map.get(key);
 		if (bucket) bucket.push(m);
@@ -10605,12 +11043,9 @@ function formatTokens(n) {
 	if (n >= 1e3 && n % 1e3 === 0) return `${n / 1e3}k`;
 	return `${n}`;
 }
-
 //#endregion
 //#region src/lib/serve/cloudcli.ts
 const CLOUDCLI_PACKAGE = "@cloudcli-ai/cloudcli";
-/** Pinned, tested known-good version. Never `@latest` (see docs/serve-control-plane.md). */
-const CLOUDCLI_PINNED_VERSION = "1.36.1";
 /**
 * Build the env handed to the CloudCLI child. Starts from `buildEnv()` — the
 * vetted secret-stripping ALLOWLIST used for worker bash (drops GITHUB_TOKEN,
@@ -10626,10 +11061,10 @@ function composeCloudCliChildEnv(anthropicVars) {
 		...anthropicVars
 	};
 }
-const SERVER_ENTRY_REL = nodePath.join("dist-server", "server", "index.js");
+const SERVER_ENTRY_REL = path.join("dist-server", "server", "index.js");
 /** Where the package's server entry lives under a given install root. */
 function serverEntryUnderRoot(root) {
-	return nodePath.join(root, "node_modules", CLOUDCLI_PACKAGE, SERVER_ENTRY_REL);
+	return path.join(root, "node_modules", CLOUDCLI_PACKAGE, SERVER_ENTRY_REL);
 }
 async function exists(p) {
 	try {
@@ -10641,7 +11076,7 @@ async function exists(p) {
 }
 async function readVersion(pkgRoot) {
 	try {
-		const raw = await fs.readFile(nodePath.join(pkgRoot, "node_modules", CLOUDCLI_PACKAGE, "package.json"), "utf8");
+		const raw = await fs.readFile(path.join(pkgRoot, "node_modules", CLOUDCLI_PACKAGE, "package.json"), "utf8");
 		return JSON.parse(raw).version ?? null;
 	} catch {
 		return null;
@@ -10655,9 +11090,9 @@ async function readVersion(pkgRoot) {
 * Never installs globally, never `@latest`.
 */
 async function resolveCloudCli(opts) {
-	const version$2 = opts.version ?? CLOUDCLI_PINNED_VERSION;
+	const version = opts.version ?? "1.36.1";
 	if (opts.cliPath) {
-		const direct = nodePath.join(opts.cliPath, SERVER_ENTRY_REL);
+		const direct = path.join(opts.cliPath, SERVER_ENTRY_REL);
 		const underRoot = serverEntryUnderRoot(opts.cliPath);
 		if (await exists(direct)) return {
 			serverEntry: direct,
@@ -10675,42 +11110,42 @@ async function resolveCloudCli(opts) {
 		serverEntry: entry,
 		version: await readVersion(root)
 	};
-	if (opts.noInstall) throw new Error(`CloudCLI is not installed and --no-install was given. Install it with:\n  npm i --prefix "${root}" ${CLOUDCLI_PACKAGE}@${version$2}`);
-	await installCloudCli(root, version$2);
+	if (opts.noInstall) throw new Error(`CloudCLI is not installed and --no-install was given. Install it with:\n  npm i --prefix "${root}" ${CLOUDCLI_PACKAGE}@${version}`);
+	await installCloudCli(root, version);
 	if (!await exists(entry)) throw new Error(`CloudCLI install completed but the server entry is missing (${entry}).`);
 	return {
 		serverEntry: entry,
 		version: await readVersion(root)
 	};
 }
-async function installCloudCli(root, version$2) {
+async function installCloudCli(root, version) {
 	const npm = resolveExecutable("npm");
 	if (!npm) throw new Error("npm not found on PATH — cannot install CloudCLI. Install Node.js/npm, or pass --cloudcli-path to an existing install.");
 	await fs.mkdir(root, {
 		recursive: true,
 		mode: 448
 	});
-	const pkgJson = nodePath.join(root, "package.json");
+	const pkgJson = path.join(root, "package.json");
 	if (!await exists(pkgJson)) await fs.writeFile(pkgJson, JSON.stringify({
 		name: "gh-router-cloudcli-host",
 		private: true
 	}, null, 2));
-	consola.info(`Installing ${CLOUDCLI_PACKAGE}@${version$2} (one-time, ~a minute; builds native deps)…`);
+	consola.info(`Installing ${CLOUDCLI_PACKAGE}@${version} (one-time, ~a minute; builds native deps)…`);
 	const { code, stderr } = await runCommandCapture([
 		npm,
 		"install",
-		`${CLOUDCLI_PACKAGE}@${version$2}`,
+		`${CLOUDCLI_PACKAGE}@${version}`,
 		"--prefix",
 		root,
 		"--no-audit",
 		"--no-fund",
 		"--loglevel=error"
-	], { timeoutMs: 10 * 6e4 });
-	if (code !== 0) throw new Error(`CloudCLI install failed (npm exit ${code}). This often means no network, a corporate proxy, or missing Windows build tools for native deps.\nInstall manually then re-run with --cloudcli-path:\n  npm i --prefix "${root}" ${CLOUDCLI_PACKAGE}@${version$2}\n${stderr.slice(0, 400)}`);
+	], { timeoutMs: 6e5 });
+	if (code !== 0) throw new Error(`CloudCLI install failed (npm exit ${code}). This often means no network, a corporate proxy, or missing Windows build tools for native deps.\nInstall manually then re-run with --cloudcli-path:\n  npm i --prefix "${root}" ${CLOUDCLI_PACKAGE}@${version}\n${stderr.slice(0, 400)}`);
 }
 /** Spawn CloudCLI on a loopback port with the given (already-filtered) env. */
 function spawnCloudCli(opts) {
-	const databasePath = nodePath.join(PATHS.CLOUDCLI_HOME, "auth.db");
+	const databasePath = path.join(PATHS.CLOUDCLI_HOME, "auth.db");
 	const node = resolveExecutable("node") ?? process.execPath;
 	const logPath = process.env.GH_ROUTER_CLOUDCLI_LOG;
 	let stdio = "ignore";
@@ -10776,7 +11211,7 @@ async function waitForCloudCliReady(port, timeoutMs = 6e4) {
 	}
 	throw new Error(`CloudCLI did not become ready within ${timeoutMs}ms`);
 }
-const secretFile = () => nodePath.join(PATHS.CLOUDCLI_HOME, ".serve-secret.json");
+const secretFile = () => path.join(PATHS.CLOUDCLI_HOME, ".serve-secret.json");
 async function loadPassword(username) {
 	try {
 		const raw = await fs.readFile(secretFile(), "utf8");
@@ -10803,21 +11238,21 @@ async function persistPassword(username, password) {
 async function mintJwt(port, username, needsSetup) {
 	const existing = await loadPassword(username);
 	if (needsSetup) {
-		const password$1 = existing ?? randomBytes(24).toString("base64url");
-		const r$1 = await req(port, "POST", "/api/auth/register", {
+		const password = existing ?? randomBytes(24).toString("base64url");
+		const r = await req(port, "POST", "/api/auth/register", {
 			username,
-			password: password$1
+			password
 		});
-		if (r$1.status === 200) {
-			const token = JSON.parse(r$1.body).token;
+		if (r.status === 200) {
+			const token = JSON.parse(r.body).token;
 			if (token) {
-				await persistPassword(username, password$1);
+				await persistPassword(username, password);
 				return token;
 			}
 		}
 	}
 	const password = existing;
-	if (!password) throw new Error(`CloudCLI already has a user but no stored password for "${username}". Delete ${nodePath.join(PATHS.CLOUDCLI_HOME, "auth.db")} and retry.`);
+	if (!password) throw new Error(`CloudCLI already has a user but no stored password for "${username}". Delete ${path.join(PATHS.CLOUDCLI_HOME, "auth.db")} and retry.`);
 	const r = await req(port, "POST", "/api/auth/login", {
 		username,
 		password
@@ -10826,9 +11261,8 @@ async function mintJwt(port, username, needsSetup) {
 		const token = JSON.parse(r.body).token;
 		if (token) return token;
 	}
-	throw new Error(`Could not obtain a CloudCLI session token (status ${r.status}). If a stale isolated DB exists, delete ${nodePath.join(PATHS.CLOUDCLI_HOME, "auth.db")} and retry.`);
+	throw new Error(`Could not obtain a CloudCLI session token (status ${r.status}). If a stale isolated DB exists, delete ${path.join(PATHS.CLOUDCLI_HOME, "auth.db")} and retry.`);
 }
-
 //#endregion
 //#region src/lib/serve/devtunnel.ts
 const SERVE_TUNNEL_LABEL = "github-router-serve";
@@ -11095,7 +11529,6 @@ async function startDevtunnel(port, opts = {}) {
 		"github-router-serve-control-plane"
 	], timeoutMs);
 }
-
 //#endregion
 //#region src/lib/serve/enhancements.ts
 const NOOP = { cleanup: async () => {} };
@@ -11176,7 +11609,7 @@ async function provisionServeEnhancements(serverUrl, opts = {}) {
 			if (s.name.startsWith("gh-first-mate") || s.name === "gh-artifact-review") continue;
 			if ((await writeInjectedSkill(s.name, s.md).catch(() => ({ written: false }))).written) skillsWritten++;
 		}
-		const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
+		const settingsPath = path.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
 		await injectAttributionSuppressionIntoSettingsFile(settingsPath).catch(() => {});
 		const strip = await sanitizeServeSettingsEnv(settingsPath).catch((err) => {
 			consola.warn(`Could not sanitize serve settings env: ${String(err)}`);
@@ -11186,16 +11619,20 @@ async function provisionServeEnhancements(serverUrl, opts = {}) {
 		if (process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== "1") await configureServeDefaultPermissionMode(settingsPath).catch((err) => consola.warn(`Could not set serve permission defaults: ${String(err)}`));
 		await injectAllowRules(settingsPath, planModeAllowRules(injected.ok ? injected.serversAdded : [...Object.values(groupKeys).filter((k) => Boolean(k)), ...opts.codexCli === true ? ["codex-cli"] : []])).catch((err) => consola.warn(`Could not auto-approve injected tools: ${String(err)}`));
 		if (workerToolsEnabled()) {
-			await injectStopHookIntoSettingsFile(settingsPath, buildPromptSubmitHookCommand(process.execPath, process.argv[1]), "UserPromptSubmit", 45).catch((err) => consola.warn(`Could not register the UserPromptSubmit hook: ${String(err)}`));
+			const promptCmd = buildPromptSubmitHookCommand(process.execPath, process.argv[1]);
+			await injectStopHookIntoSettingsFile(settingsPath, promptCmd, "UserPromptSubmit", 45).catch((err) => consola.warn(`Could not register the UserPromptSubmit hook: ${String(err)}`));
 			if (!injected.ok) consola.warn("Workers non-blocking guard NOT registered: subagent MCP injection fell back to parent-only, so worker-* dispatchers cannot reach the workers server. Raw worker tools remain usable on the main thread.");
 			else if (process.env.GH_ROUTER_DISABLE_WORKER_GUARD !== "1") {
 				const workersKey = workersKeyOf(groupKeys);
 				const modes = activeDispatchModes({ browse: browseAllowed && browseAgentEnabled() });
-				await injectStopHookIntoSettingsFile(settingsPath, buildWorkerGuardHookCommand(process.execPath, process.argv[1], workersKey, modes), "PreToolUse", 10, guardToolMatcher(workersKey, modes)).catch((err) => consola.warn(`Could not register the workers PreToolUse guard hook: ${String(err)}`));
+				const cmd = buildWorkerGuardHookCommand(process.execPath, process.argv[1], workersKey, modes);
+				const matcher = guardToolMatcher(workersKey, modes);
+				await injectStopHookIntoSettingsFile(settingsPath, cmd, "PreToolUse", 10, matcher).catch((err) => consola.warn(`Could not register the workers PreToolUse guard hook: ${String(err)}`));
 			} else consola.info("Workers non-blocking guard disabled via GH_ROUTER_DISABLE_WORKER_GUARD=1; raw worker tools remain callable on the main thread.");
 		}
 		if (planReviewEnabled()) try {
-			await injectStopHookIntoSettingsFile(settingsPath, buildPlanReviewHookCommand(process.execPath, process.argv[1]), "PostToolUse", void 0, "ExitPlanMode");
+			const command = buildPlanReviewHookCommand(process.execPath, process.argv[1]);
+			await injectStopHookIntoSettingsFile(settingsPath, command, "PostToolUse", void 0, "ExitPlanMode");
 		} catch (err) {
 			consola.warn(`Could not register the advisory plan-review hook: ${String(err)}`);
 		}
@@ -11211,7 +11648,6 @@ async function provisionServeEnhancements(serverUrl, opts = {}) {
 		return NOOP;
 	}
 }
-
 //#endregion
 //#region src/lib/serve/provider-facade.ts
 function isObject(value) {
@@ -11274,9 +11710,9 @@ function rewriteModels(upstreamJson, ctx) {
 	if (!isObject(upstreamJson)) return null;
 	const data = envelopedData(upstreamJson);
 	if (!data || !isObject(data.models) || data.cache === void 0) return null;
-	const models$1 = ctx.getModels()?.data;
-	if (!Array.isArray(models$1) || models$1.length === 0) return null;
-	const options = models$1.filter(isPickerModel).map((m) => {
+	const models = ctx.getModels()?.data;
+	if (!Array.isArray(models) || models.length === 0) return null;
+	const options = models.filter(isPickerModel).map((m) => {
 		const option = {
 			value: m.id,
 			label: m.name || m.id,
@@ -11310,21 +11746,21 @@ async function rewriteMcp(upstreamJson, ctx, query) {
 	if (!isObject(upstreamJson) || query.get("scope") !== "user") return null;
 	const data = envelopedData(upstreamJson);
 	if (!data || !Array.isArray(data.servers)) return null;
-	const mirror = await readJson(nodePath.join(ctx.claudeConfigDir, ".claude.json"));
+	const mirror = await readJson(path.join(ctx.claudeConfigDir, ".claude.json"));
 	if (!isObject(mirror) || !isObject(mirror.mcpServers)) return null;
-	const existing = new Set(data.servers.filter(isObject).map((s) => s.name).filter((name$1) => typeof name$1 === "string"));
+	const existing = new Set(data.servers.filter(isObject).map((s) => s.name).filter((name) => typeof name === "string"));
 	const additions = [];
-	for (const [name$1, entry] of Object.entries(mirror.mcpServers)) {
-		if (existing.has(name$1) || !isObject(entry)) continue;
-		const server$1 = {
+	for (const [name, entry] of Object.entries(mirror.mcpServers)) {
+		if (existing.has(name) || !isObject(entry)) continue;
+		const server = {
 			provider: "claude",
-			name: name$1,
+			name,
 			scope: "user",
 			transport: entry.type === "http" ? "http" : "stdio"
 		};
-		if (typeof entry.url === "string") server$1.url = entry.url;
-		additions.push(server$1);
-		existing.add(name$1);
+		if (typeof entry.url === "string") server.url = entry.url;
+		additions.push(server);
+		existing.add(name);
 	}
 	if (additions.length === 0) return null;
 	const nextData = cloneObject(data);
@@ -11338,7 +11774,7 @@ async function rewriteSkills(upstreamJson, ctx) {
 	if (!isObject(upstreamJson)) return null;
 	const data = envelopedData(upstreamJson);
 	if (!data || !Array.isArray(data.skills)) return null;
-	const skills = await readSkillDirs(nodePath.join(ctx.claudeConfigDir, "skills"));
+	const skills = await readSkillDirs(path.join(ctx.claudeConfigDir, "skills"));
 	if (skills.length === 0) return null;
 	const existing = new Set(data.skills.filter(isObject).map((s) => s.command).filter((command) => typeof command === "string"));
 	const additions = skills.filter((skill) => !existing.has(skill.name)).map((skill) => ({
@@ -11358,10 +11794,10 @@ async function rewriteSkills(upstreamJson, ctx) {
 }
 async function rewriteCommands(upstreamJson, ctx) {
 	if (!isObject(upstreamJson) || !Array.isArray(upstreamJson.custom)) return null;
-	const dirs = [nodePath.join(ctx.claudeConfigDir, "commands"), nodePath.join(ctx.claudeConfigDir, ".claude", "commands")];
+	const dirs = [path.join(ctx.claudeConfigDir, "commands"), path.join(ctx.claudeConfigDir, ".claude", "commands")];
 	const commandFiles = (await Promise.all(dirs.map(readCommandFiles))).flat();
 	if (commandFiles.length === 0) return null;
-	const existing = new Set(upstreamJson.custom.filter(isObject).map((c) => c.name).filter((name$1) => typeof name$1 === "string"));
+	const existing = new Set(upstreamJson.custom.filter(isObject).map((c) => c.name).filter((name) => typeof name === "string"));
 	const additions = commandFiles.filter((command) => !existing.has(command.name)).map((command) => ({
 		name: command.name,
 		path: command.relativePath,
@@ -11402,7 +11838,7 @@ async function readSkillDirs(skillsDir) {
 	try {
 		const entries = await fs.readdir(skillsDir, { withFileTypes: true });
 		return await Promise.all(entries.filter((entry) => entry.isDirectory() && entry.name.startsWith("gh-")).map(async (entry) => {
-			const sourcePath = nodePath.join(skillsDir, entry.name, "SKILL.md");
+			const sourcePath = path.join(skillsDir, entry.name, "SKILL.md");
 			let description = "";
 			try {
 				description = parseFrontmatterField(await fs.readFile(sourcePath, "utf8"), "description") ?? "";
@@ -11434,21 +11870,21 @@ async function readCommandFilesRecursive(root, dir) {
 	}
 	const out = [];
 	for (const entry of entries) {
-		const filePath = nodePath.join(dir, entry.name);
+		const filePath = path.join(dir, entry.name);
 		if (entry.isDirectory()) {
 			out.push(...await readCommandFilesRecursive(root, filePath));
 			continue;
 		}
 		if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-		const relativePath = normalizeRelative(nodePath.relative(root, filePath));
-		const name$1 = relativePath.replace(/\.md$/i, "");
+		const relativePath = normalizeRelative(path.relative(root, filePath));
+		const name = relativePath.replace(/\.md$/i, "");
 		let description = "";
 		try {
 			const md = await fs.readFile(filePath, "utf8");
 			description = parseFrontmatterField(md, "description") ?? firstMarkdownLine(md);
 		} catch {}
 		out.push({
-			name: name$1,
+			name,
 			relativePath,
 			filePath,
 			description
@@ -11477,12 +11913,11 @@ function firstMarkdownLine(markdown) {
 	return "";
 }
 function normalizeRelative(value) {
-	return value.split(nodePath.sep).join("/");
+	return value.split(path.sep).join("/");
 }
 function countCommands(builtIn) {
 	return Array.isArray(builtIn) ? builtIn.length : 0;
 }
-
 //#endregion
 //#region src/lib/serve/reverse-proxy.ts
 /**
@@ -11504,7 +11939,7 @@ const CLAUDE_SETTINGS_KEY = "claude-settings";
 * the question widget / plan card. Stripped defensively at the seed chokepoint
 * so no upstream list (mcp names, a future caller) can reintroduce them.
 */
-const NEVER_AUTO_APPROVE = new Set(["AskUserQuestion", "ExitPlanMode"]);
+const NEVER_AUTO_APPROVE = /* @__PURE__ */ new Set(["AskUserQuestion", "ExitPlanMode"]);
 /**
 * Embed the token as a JS string literal. JSON.stringify escapes quotes and
 * backslashes; we additionally neutralize `<` so the value can never break out
@@ -11540,18 +11975,18 @@ async function startReverseProxy(opts) {
 	const { targetHost, targetPort, bindHost, bindPort, authToken } = opts;
 	const ownOrigin = `http://${bindHost}:${bindPort}`;
 	const injection = buildInjection(authToken, opts.seedToolSettings === true, opts.seedAllowedTools ?? []);
-	const allowedHosts = new Set([
+	const allowedHosts = /* @__PURE__ */ new Set([
 		`127.0.0.1:${bindPort}`,
 		`localhost:${bindPort}`,
 		`[::1]:${bindPort}`,
 		...(opts.extraAllowedHosts ?? []).map((h) => h.toLowerCase())
 	]);
-	const loopbackHosts = new Set([
+	const loopbackHosts = /* @__PURE__ */ new Set([
 		`127.0.0.1:${bindPort}`,
 		`localhost:${bindPort}`,
 		`[::1]:${bindPort}`
 	]);
-	const allowedOrigins = new Set([
+	const allowedOrigins = /* @__PURE__ */ new Set([
 		`http://127.0.0.1:${bindPort}`,
 		`http://localhost:${bindPort}`,
 		`http://[::1]:${bindPort}`,
@@ -11571,7 +12006,7 @@ async function startReverseProxy(opts) {
 	const hostAllowed = (host) => !!host && (allowedHosts.has(host.toLowerCase()) || isDevtunnelHost(host.toLowerCase()));
 	const originAllowed = (origin) => !origin || allowedOrigins.has(origin.toLowerCase()) || isDevtunnelOrigin(origin);
 	const liveSockets = /* @__PURE__ */ new Set();
-	const server$1 = http.createServer((clientReq, clientRes) => {
+	const server = http.createServer((clientReq, clientRes) => {
 		clientReq.on("error", () => clientRes.destroy());
 		clientRes.on("error", () => clientReq.destroy());
 		if (!hostAllowed(clientReq.headers.host) || !originAllowed(clientReq.headers.origin)) {
@@ -11579,7 +12014,7 @@ async function startReverseProxy(opts) {
 			clientRes.end("Forbidden");
 			return;
 		}
-		if ((clientReq.url ?? "").split("?")[0] === SERVE_IDENTITY_PATH) {
+		if ((clientReq.url ?? "").split("?")[0] === "/__github-router-serve__") {
 			if (!loopbackHosts.has(String(clientReq.headers.host ?? "").toLowerCase())) {
 				clientRes.writeHead(404, { "content-type": "text/plain" });
 				clientRes.end("Not found");
@@ -11588,7 +12023,7 @@ async function startReverseProxy(opts) {
 			clientRes.writeHead(200, { "content-type": "application/json" });
 			clientRes.end(JSON.stringify({
 				service: SERVE_IDENTITY_SERVICE,
-				version: getPackageVersion()
+				version: getPackageVersion$1()
 			}));
 			return;
 		}
@@ -11673,7 +12108,7 @@ async function startReverseProxy(opts) {
 		});
 		clientReq.pipe(proxyReq);
 	});
-	server$1.on("upgrade", (clientReq, clientSock, clientHead) => {
+	server.on("upgrade", (clientReq, clientSock, clientHead) => {
 		clientSock.on("error", () => clientSock.destroy());
 		liveSockets.add(clientSock);
 		clientSock.once("close", () => liveSockets.delete(clientSock));
@@ -11718,15 +12153,15 @@ async function startReverseProxy(opts) {
 	});
 	await new Promise((resolve, reject) => {
 		const onError = (err) => reject(err);
-		server$1.once("error", onError);
-		server$1.listen(bindPort, bindHost, () => {
-			server$1.removeListener("error", onError);
+		server.once("error", onError);
+		server.listen(bindPort, bindHost, () => {
+			server.removeListener("error", onError);
 			resolve();
 		});
 	});
-	const addr = server$1.address();
+	const addr = server.address();
 	if (addr && addr.address !== "127.0.0.1" && addr.address !== "::1") {
-		await new Promise((r) => server$1.close(() => r()));
+		await new Promise((r) => server.close(() => r()));
 		throw new Error(`reverse proxy refused non-loopback bind (got ${addr.address})`);
 	}
 	return {
@@ -11736,14 +12171,13 @@ async function startReverseProxy(opts) {
 			for (const s of liveSockets) s.destroy();
 			liveSockets.clear();
 			const t = setTimeout(resolve, 1500);
-			server$1.close(() => {
+			server.close(() => {
 				clearTimeout(t);
 				resolve();
 			});
 		})
 	};
 }
-
 //#endregion
 //#region src/serve.ts
 async function getFreePort() {
@@ -11777,7 +12211,7 @@ function isPortFree(port) {
 */
 function probeExistingServe(port) {
 	return new Promise((resolve) => {
-		const req$1 = http.get({
+		const req = http.get({
 			host: "127.0.0.1",
 			port,
 			path: SERVE_IDENTITY_PATH,
@@ -11800,8 +12234,8 @@ function probeExistingServe(port) {
 			});
 			res.on("error", () => resolve(false));
 		});
-		req$1.on("timeout", () => req$1.destroy());
-		req$1.on("error", () => resolve(false));
+		req.on("timeout", () => req.destroy());
+		req.on("error", () => resolve(false));
 	});
 }
 /**
@@ -11910,7 +12344,7 @@ const serve$1 = defineCommand({
 			if (args["no-open"] !== true) openBrowser(existingUrl);
 			return;
 		}
-		const { server: server$1, serverUrl } = await setupAndServe({
+		const { server, serverUrl } = await setupAndServe({
 			...parsed,
 			port: void 0,
 			silent: true
@@ -11993,7 +12427,7 @@ const serve$1 = defineCommand({
 			} catch {}
 			if (reverseClose) await reverseClose().catch(() => {});
 			try {
-				server$1.close?.();
+				server.close?.();
 			} catch {}
 			await stopKeepAwake().catch(() => {});
 			await enhancements.cleanup().catch(() => {});
@@ -12094,12 +12528,11 @@ const serve$1 = defineCommand({
 		if (args["no-open"] !== true) openBrowser(reverse.url);
 	}
 });
-
 //#endregion
 //#region src/lib/shell.ts
 function getShell() {
-	const { platform: platform$1, env } = process$1;
-	if (platform$1 === "win32") {
+	const { platform, env } = process$1;
+	if (platform === "win32") {
 		if (env.SHELL) {
 			if (env.SHELL.endsWith("zsh")) return "zsh";
 			if (env.SHELL.endsWith("fish")) return "fish";
@@ -12157,7 +12590,6 @@ function generateEnvScript(envVars, commandToRun = "") {
 	if (commandBlock && commandToRun) return `${commandBlock}${shell === "cmd" ? " & " : shell === "powershell" ? "; " : " && "}${commandToRun}`;
 	return commandBlock || commandToRun;
 }
-
 //#endregion
 //#region src/start.ts
 function printAndCopyCommand(command, label) {
@@ -12173,7 +12605,7 @@ function generateClaudeCodeCommand(serverUrl, model) {
 	printAndCopyCommand(generateEnvScript(getClaudeCodeEnvVars(serverUrl, model), "claude --dangerously-skip-permissions"), "Claude Code");
 }
 function generateCodexCommand(serverUrl, model) {
-	const codexModel = model ?? DEFAULT_CODEX_MODEL;
+	const codexModel = model ?? "gpt-5.6-sol";
 	printAndCopyCommand(generateEnvScript(getCodexEnvVars(serverUrl), `codex -m ${codexModel}`), "Codex CLI");
 }
 const start = defineCommand({
@@ -12203,7 +12635,7 @@ const start = defineCommand({
 		const parsed = parseSharedArgs(args);
 		const { serverUrl } = await setupAndServe({
 			...parsed,
-			port: parsed.port ?? DEFAULT_PORT,
+			port: parsed.port ?? 8787,
 			silent: false
 		});
 		runSelfUpdate({ selfUpdate: args["self-update"] !== false });
@@ -12216,7 +12648,6 @@ const start = defineCommand({
 		consola.box(`🌐 Usage Viewer: https://animeshkundu.github.io/github-router/dashboard.html?endpoint=${serverUrl}/usage`);
 	}
 });
-
 //#endregion
 //#region src/main.ts
 process.on("unhandledRejection", (error) => {
@@ -12226,12 +12657,12 @@ process.on("uncaughtException", (error) => {
 	consola.error("Uncaught exception:", error);
 	process.exit(1);
 });
-const version = getPackageVersion();
+const version = getPackageVersion$1();
 const argv = process.argv.slice(2);
 const isVersionFlag = argv.includes("--version");
 const isInternalHook = argv[0] === "internal-stop-hook" || argv[0] === "internal-prompt-submit" || argv[0] === "internal-stop-review" || argv[0] === "internal-plan-review" || argv[0] === "internal-session-bind" || argv[0] === "internal-workspace-header" || argv[0] === "internal-artifact-open" || argv[0] === "internal-first-mate-guard" || argv[0] === "internal-worker-guard";
 if (!isVersionFlag && !isInternalHook) consola.info(`github-router v${version}`);
-await runMain(defineCommand({
+const main = defineCommand({
 	meta: {
 		name: "github-router",
 		version,
@@ -12256,8 +12687,9 @@ await runMain(defineCommand({
 		"internal-first-mate-guard": internalFirstMateGuard,
 		"internal-worker-guard": internalWorkerGuard
 	}
-}));
-
+});
+await runMain(main);
 //#endregion
-export {  };
+export {};
+
 //# sourceMappingURL=main.js.map