github-router 0.3.248 → 0.3.250

package/dist/browser-ext/background.js

@@ -183,7 +183,14 @@ async function toolScreenshot(args) {
   // reason. Real Chrome with a visible window has a surface and works
   // fine. If you're driving Chrome-for-Testing programmatically and
   // need screenshots, launch with `--headless=new`.
-  const dataUrl = await chrome.tabs.captureVisibleTab(windowId, { format })
+  // `quality` (1-100) applies to JPEG only; Chrome ignores it for PNG. It is the
+  // model's lever for shrinking a capture when a full-size one is refused for
+  // exceeding a model's image-size limit — without it, "retake it smaller" is
+  // advice the caller cannot act on. An older extension build that predates this
+  // simply ignores the extra key and captures at default quality.
+  const captureOpts = { format }
+  if (typeof args.quality === "number") captureOpts.quality = args.quality
+  const dataUrl = await chrome.tabs.captureVisibleTab(windowId, captureOpts)
   // dataUrl: "data:image/png;base64,...."
   const m = /^data:([^;]+);base64,(.*)$/.exec(dataUrl)
   if (!m) throw new Error("browser_screenshot: captureVisibleTab returned unexpected shape")

package/dist/browser-ext/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "github-router browser bridge",
   "short_name": "gh-router-browser",
-  "version": "0.3.248",
+  "version": "0.3.250",
   "description": "Bridge between Claude (via github-router /mcp) and the browser. Implements tab control, navigation, clicks, form fill, downloads, screenshots, devtools eval. Blocks navigation to chrome://settings.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqJElxuBlonBS3TVW9FJN0mGTtShB3L1hoaYf6k39SOr1ogGYmF90EjRxy1i21k9wQQjPf26bcBu/9X67KrQjQV0uB38CaNukgiSeoLjfptN811u+PJHx6BP+jx3Qa6/3VenNPxHC8WEU0GXql8QSjIHEyCwKb6fMASXOK94JyB5Ywov2x8mt/+9ncqBBBMVzf6r5Sagy4PL1XnryLsuADD/vOEkPet8wXgH/Oj7v5tTsQQZ7U1JT51PoDs2BFnXc5v3TkVgZwd32k3ONh+nkDw1Hof+4zwUGOyJE6eMrlYzRlKM4Qxdf9JpavQvqfieAbTRWcyKeclnHeoIfE7cDBQIDAQAB",
   "background": {

package/dist/engine-dOYoMQis.js

@@ -0,0 +1,2 @@
+import { W as runWorkerAgent } from "./peer-mcp-personas-BvommiSI.js";
+export { runWorkerAgent };

package/dist/main.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as searchWeb, $t as DEFAULT_CLAUDE_MODEL_FALLBACKS, A as trustRepo, An as state, At as getTokenCount, Bt as hasSupportedBrowserInstalled, C as fileLastPromptStore, Cn as fetchWithTransientRetry, Ct as scoutModel, D as repoRoot, Dn as copilotBaseUrl, Dt as shimDefaultsToXhigh, E as repoFingerprint, En as GITHUB_API_BASE_URL, Et as workerToolsEnabled, Ft as createChatCompletions, G as buildEnv, Gt as CONDENSED_OPERATING_SEQUENCE, Ht as extractTarGzMember, It as MAX_RESPONSE_BODY_BYTES, J as toolbeltEnabled, Jt as ArtifactClient, K as availableToolCommands, Kt as DEFINITION_OF_GREATNESS, Lt as readResponseBodyCapped, M as resolveSealedGate, Mt as resolveMcpToolTimeoutMs, Nt as pickEndpoint, O as stopGateEnabledForRepo, On as copilotHeaders, Ot as countTokens, Pt as createResponses, Q as assetFor, Qt as toolbeltPathOverride, Rt as parseJsonOrDiagnose, S as fileFindingsStore, Sn as getGitHubUser, St as reviewerModel, T as isSubagentContext, Tn as forwardError, Tt as standInToolEnabled, Ut as extractZipMember, Vt as provisionAndIndexColbert, Wt as warmTreeSitterPool, X as vscodeRipgrepPath, Xt as buildWorkspaceHeaderJson, Y as toolbeltSkipSet, Yt as buildWorkspaceHeaderHelperCommand, Z as TOOLBELT_TOOLS, Zt as collapsePathKeys, _ as stopGateDisabled, _n as isNullish, _t as browserCompoundToolsEnabled, a as buildPeerAwarenessSnippet, an as generateRandomPort, at as buildAnthropicErrorEvent, b as stopReviewEnabled, bn as sleep$1, bt as geminiAvailable, c as personasFor, cn as withInstallLock, ct as logStreamError, d as buildStopHookCommand, dn as setupGitHubToken, dt as handleMcpDelete, en as DEFAULT_CODEX_MODEL, et as ADVISOR_INTERNAL_TOOL_NAME, f as captureLaunchBaseline, fn as tryRefreshAndRetry, ft as handleMcpPost, g as launchBaselineKey, gn as filterBetaHeader, gt as browseAgentEnabled, h as injectStopHookIntoSettingsFile, hn as cacheVSCodeVersion, ht as brainstormModel, i as buildAgentPrompt, in as UPSTREAM_INACTIVITY_TIMEOUT_MS, it as isAdvisorRequested, j as liveExec, jt as assembleResponsesPayload, k as stopReviewStateDir, kn as githubHeaders, kt as createMessages, l as buildArtifactOpenHookCommand, ln as setupCopilotToken, lt as readIteratorWithTimeout, m as fileBlockBudget, mn as cacheModels, mt as artifactToolsEnabled, n as MCP_GROUPS, nt as buildAdvisorStream, o as buildPeerAwarenessSummary, on as pickClaudeDefault, ot as buildOpenAIErrorEvent, p as decideStopHook, pn as cacheCopilotVersion, pt as agentToolsEnabled, q as buildToolbeltAwareness, qt as shouldUseInsecureTls, r as assertMcpToolSurfaceConsistent, rn as UPSTREAM_FETCH_TIMEOUT_MS, rt as injectAdvisorTool, s as enumerateInjectedMcpToolNames, sn as getPackageVersion$1, st as isControllerClosedError, t as GROUP_META, tn as DEFAULT_CODEX_MODEL_FALLBACKS, tt as ADVISOR_TOOL_INSTRUCTIONS, u as buildSessionBindHookCommand, un as setupGitHubAgentToken, ut as relayAnthropicStream, v as stopGateId, vn as resolveCodexModel, vt as browserToolsEnabled, w as fileReviewDebounce, wn as HTTPError, wt as scribeModel, x as fileBaselineStore, xn as getModels, xt as nativeSubagentModel, y as stopGatePlanMode, yn as resolveModel, yt as fleetToolsEnabled, zt as provisionBrowserAssets } from "./peer-mcp-personas-HWhxZUvf.js";
+import { $ as searchWeb, $t as DEFAULT_CLAUDE_MODEL_FALLBACKS, A as trustRepo, An as state, At as getTokenCount, Bt as hasSupportedBrowserInstalled, C as fileLastPromptStore, Cn as fetchWithTransientRetry, Ct as scoutModel, D as repoRoot, Dn as copilotBaseUrl, Dt as shimDefaultsToXhigh, E as repoFingerprint, En as GITHUB_API_BASE_URL, Et as workerToolsEnabled, Ft as createChatCompletions, G as buildEnv, Gt as CONDENSED_OPERATING_SEQUENCE, Ht as extractTarGzMember, It as MAX_RESPONSE_BODY_BYTES, J as toolbeltEnabled, Jt as ArtifactClient, K as availableToolCommands, Kt as DEFINITION_OF_GREATNESS, Lt as readResponseBodyCapped, M as resolveSealedGate, Mt as resolveMcpToolTimeoutMs, Nt as pickEndpoint, O as stopGateEnabledForRepo, On as copilotHeaders, Ot as countTokens, Pt as createResponses, Q as assetFor, Qt as toolbeltPathOverride, Rt as parseJsonOrDiagnose, S as fileFindingsStore, Sn as getGitHubUser, St as reviewerModel, T as isSubagentContext, Tn as forwardError, Tt as standInToolEnabled, Ut as extractZipMember, Vt as provisionAndIndexColbert, Wt as warmTreeSitterPool, X as vscodeRipgrepPath, Xt as buildWorkspaceHeaderJson, Y as toolbeltSkipSet, Yt as buildWorkspaceHeaderHelperCommand, Z as TOOLBELT_TOOLS, Zt as collapsePathKeys, _ as stopGateDisabled, _n as isNullish, _t as browserCompoundToolsEnabled, a as buildPeerAwarenessSnippet, an as generateRandomPort, at as buildAnthropicErrorEvent, b as stopReviewEnabled, bn as sleep$1, bt as geminiAvailable, c as personasFor, cn as withInstallLock, ct as logStreamError, d as buildStopHookCommand, dn as setupGitHubToken, dt as handleMcpDelete, en as DEFAULT_CODEX_MODEL, et as ADVISOR_INTERNAL_TOOL_NAME, f as captureLaunchBaseline, fn as tryRefreshAndRetry, ft as handleMcpPost, g as launchBaselineKey, gn as filterBetaHeader, gt as browseAgentEnabled, h as injectStopHookIntoSettingsFile, hn as cacheVSCodeVersion, ht as brainstormModel, i as buildAgentPrompt, in as UPSTREAM_INACTIVITY_TIMEOUT_MS, it as isAdvisorRequested, j as liveExec, jt as assembleResponsesPayload, k as stopReviewStateDir, kn as githubHeaders, kt as createMessages, l as buildArtifactOpenHookCommand, ln as setupCopilotToken, lt as readIteratorWithTimeout, m as fileBlockBudget, mn as cacheModels, mt as artifactToolsEnabled, n as MCP_GROUPS, nt as buildAdvisorStream, o as buildPeerAwarenessSummary, on as pickClaudeDefault, ot as buildOpenAIErrorEvent, p as decideStopHook, pn as cacheCopilotVersion, pt as agentToolsEnabled, q as buildToolbeltAwareness, qt as shouldUseInsecureTls, r as assertMcpToolSurfaceConsistent, rn as UPSTREAM_FETCH_TIMEOUT_MS, rt as injectAdvisorTool, s as enumerateInjectedMcpToolNames, sn as getPackageVersion$1, st as isControllerClosedError, t as GROUP_META, tn as DEFAULT_CODEX_MODEL_FALLBACKS, tt as ADVISOR_TOOL_INSTRUCTIONS, u as buildSessionBindHookCommand, un as setupGitHubAgentToken, ut as relayAnthropicStream, v as stopGateId, vn as resolveCodexModel, vt as browserToolsEnabled, w as fileReviewDebounce, wn as HTTPError, wt as scribeModel, x as fileBaselineStore, xn as getModels, xt as nativeSubagentModel, y as stopGatePlanMode, yn as resolveModel, yt as fleetToolsEnabled, zt as provisionBrowserAssets } from "./peer-mcp-personas-BvommiSI.js";
 import { a as isUnderClaudeConfigMirror, d as writeRuntimeFileSecure, i as ensurePaths, o as removeOwnClaudeConfigMirror, r as ensureClaudeConfigMirror, t as PATHS, u as writeArtifactCredsToMirror } from "./paths-BjTMI_xK.js";
 import { c as killManagedTree, d as resolveExecutable, f as runCommandCapture, l as parseBoolEnv, p as runCommandVoid, s as killChildProcessTree, u as parseIntEnv } from "./lifecycle-DHZsVN8j.js";
 import { a as sweepRegistry } from "./lifecycle-CUf1UDrH.js";
@@ -18,6 +18,7 @@ import { Agent, ProxyAgent, setGlobalDispatcher } from "undici";
 import { Writable } from "node:stream";
 import { clearTimeout as clearTimeout$1, setTimeout as setTimeout$1 } from "node:timers";
 import { serve } from "srvx";
+import { createBodyTooLargeError, limitRequestBody } from "srvx/body-limit";
 import { getProxyForUrl } from "proxy-from-env";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
@@ -1396,7 +1397,7 @@ function buildPeerAgentDefinitions(opts) {
 		...modelField
 	};
 	out.reviewer = {
-		description: reviewerModel ? `Feedback subagent running ${reviewerModel}, a DIFFERENT lab from both the lead and the implementer, so its blind spots are decorrelated from whoever produced the work. Use proactively when something already exists and you want it assessed: a diff, a plan, a document, a failing test. Unlike the stateless peer critics, it reads the repo and can RUN things, so prefer it whenever the assessment needs execution or repo context (reproduce a failure, run the suite, bisect); prefer a peer critic when you already hold the artifact and want a fresh-context opinion on it. Model is overridable at spawn.` : `Feedback subagent (native tools, runs on the lead's model in its own context). Use proactively when something already exists and you want it assessed: a diff, a plan, a document, a failing test. Unlike the stateless peer critics, it reads the repo and can RUN things, so prefer it whenever the assessment needs execution or repo context; prefer a peer critic when you already hold the artifact and want a fresh-context opinion on it. Model is overridable at spawn.`,
+		description: reviewerModel ? `Feedback subagent running ${reviewerModel}, a DIFFERENT lab from both the lead and the implementer, so its blind spots are decorrelated from whoever produced the work. Use proactively when something already exists and you want it assessed: a diff, a plan, a document, a failing test. Unlike the stateless peer critics, it reads the repo and can RUN things, so prefer it whenever the assessment needs execution or repo context (reproduce a failure, run the suite, bisect); prefer a peer critic when you already hold the artifact and want a fresh-context opinion on it. It can also REVIEW SCREENSHOTS and other images: just point it at the file and it will look at them (its model accepts up to 10 images per request, more than any other lane here). Model is overridable at spawn.` : `Feedback subagent (native tools, runs on the lead's model in its own context). Use proactively when something already exists and you want it assessed: a diff, a plan, a document, a failing test. Unlike the stateless peer critics, it reads the repo and can RUN things, so prefer it whenever the assessment needs execution or repo context; prefer a peer critic when you already hold the artifact and want a fresh-context opinion on it. Model is overridable at spawn.`,
 		prompt: "You are a feedback subagent. Your job is to tell the caller what is actually true about the artifact you are given — code, a plan, a document, a failure report — and what is wrong with it. Verify against the ACTUAL code by reading it; never assume. Do whatever the assessment requires: reproduce a failure end to end as close to how a real user hits it as you can, form hypotheses and test them against the code and runtime, and isolate the true root cause rather than a symptom. Where the change warrants it, author tests that try to BREAK the implementation (edge cases, error paths, and the acceptance criteria as executable checks), run them, and report which pass and which fail; do NOT modify production code just to make tests pass. " + fileToolSteer("builds") + " Do the work yourself — do not spawn further subagents. Report severity-ranked findings with `file:line` citations, the evidence behind each, and end with a clear go/no-go.",
 		...reviewerModel ? { model: reviewerModel } : {}
 	};
@@ -3087,7 +3088,7 @@ async function discoverGateCommands(cwd, opts) {
 	if (files.length === 0) return null;
 	let result;
 	try {
-		const { runWorkerAgent } = await import("./engine-C1nJ6ue1.js");
+		const { runWorkerAgent } = await import("./engine-dOYoMQis.js");
 		result = await runWorkerAgent({
 			mode: "explore",
 			workspace: root,
@@ -4281,14 +4282,27 @@ const STYLE_DIRECTIVE = "Write concisely without losing detail. Use a natural hu
 *      main context free to reason and collaborate with the user, while still
 *      doing trivial / surgical / last-mile work directly (delegating that
 *      would only add relay-fidelity loss + latency).
-*   2. Excellence lens: the principles stated plainly and concretely (radical
+*   2. Adversarial review: WHEN a peer critic earns its keep and, equally
+*      important, when reaching for one is ritual rather than review. Same
+*      failure shape the delegation default had: "consult a critic for
+*      non-trivial changes" is unfalsifiable in advance, so it collapses into
+*      either never (four of four unprimed agents) or always (worse than
+*      never). The discriminator is whether the conclusion still turns on
+*      judgment once the direct evidence is in: a consequential recommendation
+*      cannot be run, which is exactly where confabulation hides, while a
+*      tracing question a search already proved gains nothing from a second
+*      model re-deriving it. The roster, the lens-to-artifact match, the
+*      advisor-complements-rather-than-substitutes distinction, and the
+*      do-not-anchor-the-critic rule live here; the digest carries only the
+*      trigger and the ritual exclusion.
+*   3. Excellence lens: the principles stated plainly and concretely (radical
 *      simplicity + real-user focus; whole-system first-principles thinking that
 *      anticipates scale; work back from the customer outcome). Named exemplars
 *      were dropped per the injected-surface review: a named entity is a dense,
 *      high-variance vector that pulls in persona mannerisms at top salience, and
 *      the guidance favors specific functional framing over comparison, so
 *      specificity carries the vividness instead.
-*   3. Engineering excellence: quality / robustness / maintainability over
+*   4. Engineering excellence: quality / robustness / maintainability over
 *      development cost; reproduce a bug end-to-end (as a real user hits it)
 *      before fixing so the fix targets the real cause; a pixel-perfect UI bar;
 *      and fix any lint error / test failure / flake on sight, whoever caused it,
@@ -4300,15 +4314,24 @@ const STYLE_DIRECTIVE = "Write concisely without losing detail. Use a natural hu
 * Self-referentially compliant with the style directive: no em dashes, no
 * Claude / Anthropic attribution.
 */
-const OPERATING_DEFAULTS_DIRECTIVE = "## Operating defaults (apply when the user has not specified otherwise; the user's explicit direction and the domain's own standards always override)\n\nOrchestrate. Delegate research, implementation, review, and large reads to the right subagent, worker, or model. Reach for `implementer` when you know what to build, `reviewer` when something exists and you want it assessed (including reproducing and root-causing a failure), `brainstorm` when you do not yet know which approach to take, `scout` to find or understand something in the repo, and `scribe` for docs and ADRs that trail the code; worker-* agents for background non-blocking runs; Task subagents for parallel work; peer critics for review. That keeps your own context free to reason and collaborate with the user. Prefer parallel delegation for independent work. Delegation pays when the work is WIDE (many files or sources to sweep) or SLOW, and you need only the conclusion: the main thread is where you think with and respond to the user, and its context window is a finite shared resource. It does NOT pay merely because a sub-question is separable. A narrow, deep question whose whole value is file:line fidelity loses exactly that through a summarization layer, and a sub-question you could answer in one command is cheaper done directly than paying a subagent's startup. Do trivial, surgical, and last-mile work yourself.\n\nAim high. Default to radical simplicity and a relentless focus on the user's real experience: design for the person and the job to be done, not the demo. Reason about the whole system from first principles, anticipating scale and the long arc rather than patching the surface. Work backwards from the outcome the user actually needs. Question every assumption and prefer what you can derive, reproduce, or test.\n\nEngineering excellence. When making technical decisions, give little weight to development cost; prefer quality, simplicity, robustness, scalability, and long-term maintainability. Fix a bug by first reproducing it end to end, as close to how a real user hits it as you can, so you solve the real problem and not a symptom. When testing a product end to end, be picky about the UI and obsessed with pixel perfection: if something clearly looks off, even when it is unrelated to your task, get it fixed along the way. Hold that same bar for the codebase itself: a lint error, a failing test, or a flaky test is worth fixing the moment you see it, whoever introduced it. Fold it into your current work rather than letting it derail the task the user actually asked for.";
+const OPERATING_DEFAULTS_DIRECTIVE = "## Operating defaults (apply when the user has not specified otherwise; the user's explicit direction and the domain's own standards always override)\n\nOrchestrate. Delegate research, implementation, review, and large reads to the right subagent, worker, or model. Reach for `implementer` when you know what to build, `reviewer` when something exists and you want it assessed (including reproducing and root-causing a failure), `brainstorm` when you do not yet know which approach to take, `scout` to find or understand something in the repo, and `scribe` for docs and ADRs that trail the code; worker-* agents for background non-blocking runs; Task subagents for parallel work; peer critics for review. That keeps your own context free to reason and collaborate with the user. Prefer parallel delegation for independent work. Delegation pays when the work is WIDE (many files or sources to sweep) or SLOW, and you need only the conclusion: the main thread is where you think with and respond to the user, and its context window is a finite shared resource. It does NOT pay merely because a sub-question is separable. A narrow, deep question whose whole value is file:line fidelity loses exactly that through a summarization layer, and a sub-question you could answer in one command is cheaper done directly than paying a subagent's startup. Do trivial, surgical, and last-mile work yourself.\n\nAdversarial review. The peer critics (`codex_critic` and `codex_reviewer`, `gemini_critic` and `gemini_reviewer`, `opus_critic`, and the `peer-review-coordinator` that fans out to several of them) are fresh-context models, so what they add is a blind spot that whoever produced the work cannot reach by thinking harder about it; prefer a critic from a different lab than the producer, since blind spots correlate within a lab. The `advisor` is a complement and not a substitute: it sees your transcript, so it catches your own drift and momentum, but it inherits your framing, which is exactly what a fresh-context critic does not. They earn their keep on consequential design choices, recommendations, and hard-to-reverse decisions: the cases where plausible alternatives remain and the conclusion rests on judgment rather than on something you can verify directly. That is where confabulation hides, so budget the wait even under delivery pressure. Always consult one when the change touches auth, user input, database queries, crypto, or serialization. They do NOT pay for read-only tracing, ordinary repository lookup, or a conclusion that a focused test, a direct reproduction, or unambiguous code evidence already settles. Asking a critic to re-derive a proven fact returns a confident answer either way, which is ritual skepticism rather than review, and skipping them there is the right call and not a shortcut. Match the lens to the artifact: a strategic critic for plans and trade-offs, a code reviewer for a concrete diff, the coordinator only when the risk warrants several independent lenses. Give whichever you pick the artifact and the constraints and not your rationale, since justification anchors the review and dulls it.\n\nAim high. Default to radical simplicity and a relentless focus on the user's real experience: design for the person and the job to be done, not the demo. Reason about the whole system from first principles, anticipating scale and the long arc rather than patching the surface. Work backwards from the outcome the user actually needs. Question every assumption and prefer what you can derive, reproduce, or test.\n\nEngineering excellence. When making technical decisions, give little weight to development cost; prefer quality, simplicity, robustness, scalability, and long-term maintainability. Fix a bug by first reproducing it end to end, as close to how a real user hits it as you can, so you solve the real problem and not a symptom. When testing a product end to end, be picky about the UI and obsessed with pixel perfection: if something clearly looks off, even when it is unrelated to your task, get it fixed along the way. Hold that same bar for the codebase itself: a lint error, a failing test, or a flaky test is worth fixing the moment you see it, whoever introduced it. Fold it into your current work rather than letting it derail the task the user actually asked for.";
 /**
 * Condensed digest of OPERATING_DEFAULTS_DIRECTIVE for the spawned session's
 * system prompt (--append-system-prompt). The FULL directive is prepended to
 * the mirrored CLAUDE.md (read by the main agent and descendants); this digest
 * keeps both behavioral directives at top salience without duplicating the full
 * ~310-token block in the context window every turn. Points to the full copy.
+*
+* The unverifiable-claim rule is here rather than in CLAUDE.md alone because it
+* fires at a moment that suppresses lookups: an agent racing to deliver a
+* recommendation is precisely the one that will not stop to consult its project
+* instructions, which is how the check got crowded out in the first place. It
+* also closes a hole in the rule above it, which only covers claims that direct
+* evidence CAN settle. The roster of critics, the lens-to-artifact match, and
+* the reasoning stay in the directive; the always-resident copy carries only
+* the trigger and the ritual exclusion.
 */
-const OPERATING_DEFAULTS_DIGEST = "## Operating defaults (the user's explicit direction and the domain's standards always override)\n\nDelegate when the work is WIDE (many files or sources to sweep) or SLOW and you need only the conclusion, to protect the main thread's finite context and keep it free for reasoning and interacting with the user; prefer parallel delegation for independent work. Do NOT delegate merely because a sub-question is separable: a narrow, deep question whose value is file:line fidelity loses exactly that through a summarization layer, and one answerable in a single command is cheaper done directly. Do trivial, surgical, and last-mile work yourself.\n\nVerify, do not assert. Run the code, read the file, check the exit code. A claim in prose is worth nothing against state you did not check, and a check that cannot fail proves nothing. Reproduce a bug end to end, the way a real user hits it, before fixing it. Fix a lint error, failing test, or flake the moment you see it, whoever introduced it, without letting it derail the task at hand. Prefer quality and long-term maintainability over development cost.\n\nThe agent roster, the tool surface, and the reasoning behind these defaults are in your CLAUDE.md project instructions. Read them when choosing HOW to work; the rules above apply without a lookup.";
+const OPERATING_DEFAULTS_DIGEST = "## Operating defaults (the user's explicit direction and the domain's standards always override)\n\nDelegate when the work is WIDE (many files or sources to sweep) or SLOW and you need only the conclusion, to protect the main thread's finite context and keep it free for reasoning and interacting with the user; prefer parallel delegation for independent work. Do NOT delegate merely because a sub-question is separable: a narrow, deep question whose value is file:line fidelity loses exactly that through a summarization layer, and one answerable in a single command is cheaper done directly. Do trivial, surgical, and last-mile work yourself.\n\nVerify, do not assert. Run the code, read the file, check the exit code. A claim in prose is worth nothing against state you did not check, and a check that cannot fail proves nothing. Reproduce a bug end to end, the way a real user hits it, before fixing it. Fix a lint error, failing test, or flake the moment you see it, whoever introduced it, without letting it derail the task at hand. Prefer quality and long-term maintainability over development cost.\n\nVerification has a blind spot: a consequential recommendation, a design or trade-off call, or a hard-to-reverse decision that still turns on judgment among plausible alternatives once the direct evidence is in. That is where confabulation hides, so put it past a peer critic before you ship it and budget the wait even under delivery pressure. When a test, a run, a reproduction, or a search would settle the claim, settle it that way instead; a critic asked to re-derive what you can already prove is ritual, not review.\n\nThe agent roster, the tool surface, and the reasoning behind these defaults are in your CLAUDE.md project instructions. Read them when choosing HOW to work; the rules above apply without a lookup.";
 /**
 * Skip the helper if the user's `~/.claude/CLAUDE.md` (or, equivalently,
 * the would-be post-write file) has grown past this size.
@@ -5538,7 +5561,7 @@ function initProxyFromEnv() {
 //#endregion
 //#region package.json
 var name = "github-router";
-var version$1 = "0.3.248";
+var version$1 = "0.3.250";
 //#endregion
 //#region src/lib/approval.ts
 const awaitApproval = async () => {
@@ -6945,12 +6968,18 @@ function anthropicUsageFromChat(u) {
 * Map a chat/completions `finish_reason` to an Anthropic stop_reason. A
 * truncated (`length`) response is `max_tokens` even when a partial tool call
 * is present — the response was cut — mirroring the Responses egress precedence.
-* `tool_calls` (or any buffered tool) → `tool_use`; everything else (`stop`,
-* `content_filter`, null) → `end_turn`.
+* `tool_calls` (or any buffered tool) → `tool_use`.
+*
+* `content_filter` maps to Anthropic's `refusal`, NOT `end_turn`. It used to
+* collapse into `end_turn`, which made an upstream safety block indistinguishable
+* from a normal completion: the client saw a successful, usually empty, message
+* and had no way to tell that content had been withheld. `refusal` is the
+* documented Anthropic stop_reason for exactly this case.
 */
 function chatStopReason(finishReason, sawTool) {
 	if (finishReason === "length") return "max_tokens";
 	if (finishReason === "tool_calls" || sawTool) return "tool_use";
+	if (finishReason === "content_filter") return "refusal";
 	return "end_turn";
 }
 /**
@@ -6968,6 +6997,10 @@ function chatResponseToAnthropicMessage(resp, modelId) {
 			type: "text",
 			text: message.content
 		});
+		if (typeof message.refusal === "string" && message.refusal.length > 0) content.push({
+			type: "text",
+			text: message.refusal
+		});
 		if (Array.isArray(message.tool_calls)) for (const tc of message.tool_calls) {
 			sawTool = true;
 			const rawId = typeof tc.id === "string" ? tc.id : "";
@@ -7050,6 +7083,16 @@ async function* synthAnthropicFromChat(upstream, opts) {
 			}
 			yield makeTextDelta(activeTextIndex, delta.content);
 		}
+		if (delta && typeof delta.refusal === "string" && delta.refusal.length > 0) {
+			if (activeTextIndex == null) {
+				activeTextIndex = nextIndex++;
+				yield makeContentBlockStart(activeTextIndex, {
+					type: "text",
+					text: ""
+				});
+			}
+			yield makeTextDelta(activeTextIndex, delta.refusal);
+		}
 		if (delta && Array.isArray(delta.tool_calls) && delta.tool_calls.length > 0) {
 			if (activeTextIndex != null) {
 				yield makeContentBlockStop(activeTextIndex);
@@ -7512,6 +7555,29 @@ function isClaudeModel(modelId, model, originalModelId) {
 *   any chat-default model) → "chat-shim".
 * - A non-Claude model absent from the catalog (so we can't confirm an endpoint)
 *   → "claude-passthrough" (unchanged; we don't divert what we can't classify).
+* - A non-Claude model that IS in the catalog and serves NEITHER of the two shim
+*   endpoints (`pickEndpoint` → undefined) → "claude-passthrough" as well.
+*
+* Those last two land on the same route but are NOT the same answer, and the
+* coincidence is deliberate rather than a collapsed default (contrast
+* `resolveEndpointForModelId`, whose callers must tell them apart because
+* guessing there produces an opaque upstream 400). Here neither shim is even a
+* candidate: a shim can only speak `/responses` or `/chat/completions`, so
+* diverting a model that serves neither would 400 just as surely. Passthrough
+* is the better default because it is sometimes RIGHT — a non-Claude catalog
+* model advertising `/v1/messages` is served by exactly the endpoint
+* passthrough uses. It also preserves this module's fail-CLOSED-toward-Claude
+* invariant: an unclassifiable model is never diverted.
+*
+* KNOWN GAP (audited, deliberately not fixed here): a non-Claude model serving
+* only something we cannot speak at all (say `/embeddings`) also lands on
+* passthrough and will still 400 upstream — `logEndpointMismatch(modelId,
+* "/v1/messages")` logs it at the passthrough seam, but no local error is
+* raised. Closing that needs a change in `src/routes/messages/handler.ts`,
+* which this seam does not own. It is strictly narrower than the defect fixed
+* in `resolveEndpointForModelId`: no such model is reachable as a Claude Code
+* `/v1/messages` target today, whereas the plan worker's `claude-opus-5`
+* default is.
 *
 * `originalModelId` is the optional pre-resolution request id; when supplied it
 * is checked for Claude-likeness alongside the resolved id so an alias that
@@ -8783,21 +8849,177 @@ server.notFound((c) => c.json({
 //#region src/lib/server-setup.ts
 const MAX_PORT_RETRIES = 10;
 /**
+* Maximum request body the proxy will accept, in bytes.
+*
+* Pinned EXPLICITLY because the runtimes disagree by default: bun's `serve`
+* defaults `maxRequestBodySize` to 128 MB and rejects past it, while
+* `node:http` (the srvx node adapter) has no body limit at all. Left
+* unset, the same request succeeds under node and 413s under bun, with
+* nothing in the response explaining that the runtime is the variable.
+* Same class of defect as the `idleTimeout` divergence below.
+*
+* Note which side that leaves exposed: `dist/main.js` ships
+* `#!/usr/bin/env node`, so npm-installed users are on the runtime with NO
+* limit, and bun is mostly the dev/`bun run start` path. The uncapped case
+* was the shipped one.
+*
+* 128 MB — i.e. bun's default, adopted as the intended value on BOTH
+* runtimes rather than inherited on one:
+*
+* - It sits above the traffic this proxy is built for, with margin. A
+*   full 1M-token Claude Code context is on the order of 4-5 MB of JSON
+*   text; base64 inline images inflate 4/3 and are re-sent every turn, so
+*   an image-heavy session runs to tens of MB. That is an estimate, not a
+*   measurement, which is part of why the cap is set well clear of it
+*   rather than snugly above it.
+* - Removing the limit to "match node" is not free even on loopback. The
+*   app mounts permissive `cors()`, so any web page the user visits can
+*   POST to 127.0.0.1:<port> (CORS gates reading the response, not sending
+*   the request); so can any local process. An unbounded body lets either
+*   stream the proxy to death.
+* - Raising it above 128 MB buys nothing and costs safety: the proxy
+*   BUFFERS the whole body (`c.req.json()`), parses it into a JS object
+*   (multiples of the text size in heap), then re-serializes it upstream.
+*   Past ~512 MB V8's max string length makes `JSON.stringify` fail
+*   opaquely — a cap well under that keeps the failure explainable.
+*
+* A body over this ceiling means something is wrong (runaway loop,
+* corrupted context), not a workload that needs a bigger buffer, so
+* there is deliberately no env override to raise it.
+*/
+const MAX_REQUEST_BODY_BYTES = 134217728;
+/**
+* Where the RUNTIME's own body check sits. Not the policy.
+*
+* The policy is `MAX_REQUEST_BODY_BYTES`, enforced by `withBodyLimit` in
+* this process, identically on every runtime. This value exists only to
+* displace the 128 MB default bun's `serve` applies, which would otherwise pre-empt
+* that gate — bun enforces its limit at header-parse time by replying and
+* closing while the client is still uploading, so a client that has not
+* finished writing never reads the reply. Measured with a real client
+* posting 64 MB over a limit: `The socket connection was closed
+* unexpectedly`, i.e. exactly the opaque failure this change removes, and
+* exactly what bun does TODAY at its default. An early response from our
+* own handler, by contrast, is delivered cleanly (413 with the JSON body,
+* ~50ms, no memory growth; draining the body first was strictly worse at
+* 155ms and +50 MB, so we do not drain).
+*
+* Set as ONE top-level srvx option, so bun and node get the same number.
+* A bun-only override would put the two runtimes back on different
+* thresholds, which is the defect being fixed, not a fix for it.
+*
+* Deliberately far above the policy so the policy always decides first:
+* everything a client can realistically send is answered by the explained
+* 413, and this is reached only by a body that is both undeclared and
+* absurd. It stays finite so "no limit at all" is never the state. It
+* bounds nothing the gate does not already bound — an unread body is
+* discarded by both runtimes rather than buffered — so a high value costs
+* no memory, and buys message quality across the whole realistic range.
+*/
+const TRANSPORT_BODY_CEILING_BYTES = 1073741824;
+/**
+* The 413 the user sees when a request body is over the ceiling.
+*
+* Anthropic error envelope (`request_too_large` is Anthropic's own 413
+* category), so a client that parses our error shape on every other path
+* parses this one too, and the message says what to actually do about it.
+*
+* `declaredBytes` is present only when the request declared a length. A
+* body caught mid-stream has no known size, and saying so beats inventing
+* one. Byte counts are exact, with the MB figure only as a gloss:
+* rounding alone reads as a contradiction at the boundary, where a body
+* one byte over renders as "128.0 MB, over the 128.0 MB limit".
+*/
+function bodyTooLargeResponse(declaredBytes) {
+	const mb = (n) => `${(n / 1048576).toFixed(1)} MB`;
+	const actual = declaredBytes === void 0 ? `Request body exceeds the size github-router accepts` : `Request body is ${declaredBytes} bytes (${mb(declaredBytes)}), over the size github-router accepts`;
+	return new Response(JSON.stringify({
+		type: "error",
+		error: {
+			type: "request_too_large",
+			message: `${actual}: at most ${MAX_REQUEST_BODY_BYTES} bytes (${mb(MAX_REQUEST_BODY_BYTES)}), the same limit under bun and node. This is usually an accumulated conversation or inline images (base64 attachments are re-sent every turn) rather than one large message — start a new session or drop the attachments.`
+		}
+	}), {
+		status: 413,
+		headers: { "content-type": "application/json" }
+	});
+}
+/** srvx's canonical over-limit error, however it reaches us. */
+function isBodyTooLarge(error) {
+	return typeof error === "object" && error !== null && error.code === "ERR_BODY_TOO_LARGE";
+}
+/**
+* Enforce `MAX_REQUEST_BODY_BYTES` in-process, so the limit and the
+* rejection are the same on every runtime.
+*
+* Leaving it to the runtimes is what produced the divergence in the first
+* place, and their rejections are not interchangeable:
+*
+* - bun rejects at header-parse time and closes the connection while the
+*   client is still uploading, so the client sees a dead socket rather
+*   than the 413 (measured; see `TRANSPORT_BODY_CEILING_BYTES`).
+* - node lets the handler run and rejects the body READ with an
+*   `ERR_BODY_TOO_LARGE` error. The app installs no Hono `onError`, so
+*   that becomes `500 Internal Server Error` — indistinguishable from a
+*   real proxy fault.
+*
+* Two layers, one threshold, applied uniformly:
+*
+* 1. A declared `Content-Length` over the limit is answered before the
+*    body is read at all. This is the path every real client takes
+*    (Claude Code / undici / curl all declare a length on a JSON body).
+* 2. Anything else — chunked, or a length that understates the body — is
+*    caught mid-stream by srvx's own `limitRequestBody`, the same helper
+*    its node and deno adapters use. Overflow is surfaced as the SAME
+*    explained 413 rather than leaking out as a 500.
+*
+* So a body that declares no length is no longer a hole in the message
+* quality OR in the bound, and neither depends on which runtime is
+* serving. Verified end to end against both adapters with a real client:
+* declared-over and chunked-over each return an identical 413.
+*/
+function withBodyLimit(fetchHandler) {
+	return async (request) => {
+		const declared = request.headers.get("content-length");
+		if (declared !== null && /^\d+$/.test(declared)) {
+			const bytes = Number(declared);
+			if (bytes > 134217728) return bodyTooLargeResponse(bytes);
+		}
+		let overflowed = false;
+		const limited = limitRequestBody(request, MAX_REQUEST_BODY_BYTES, { createError: (max) => {
+			overflowed = true;
+			return createBodyTooLargeError(max);
+		} });
+		try {
+			const response = await fetchHandler(limited);
+			if (overflowed) {
+				response.body?.cancel().catch(() => {});
+				return bodyTooLargeResponse();
+			}
+			return response;
+		} catch (error) {
+			if (overflowed || isBodyTooLarge(error)) return bodyTooLargeResponse();
+			throw error;
+		}
+	};
+}
+/**
 * Build the srvx `serve()` options shared by the explicit-port and
 * random-port paths.
 *
-* Extracted and exported so the Bun idle-reaper override below is
+* Extracted and exported so the per-runtime overrides below are
 * assertable. `setupAndServe` itself performs auth and network I/O, so the
 * only way to pin this behaviour in a test is to make the options object
-* reachable on its own — and it needs pinning, because deleting the override
-* reintroduces a failure that looks like an upstream/network problem rather
-* than a config one.
+* reachable on its own — and it needs pinning, because deleting either
+* override reintroduces a failure that looks like an upstream/network
+* problem rather than a config one.
 */
 function buildServeOptions(fetchHandler, silent) {
 	return {
-		fetch: fetchHandler,
+		fetch: withBodyLimit(fetchHandler),
 		hostname: "127.0.0.1",
 		silent,
+		maxRequestBodySize: TRANSPORT_BODY_CEILING_BYTES,
 		bun: { idleTimeout: 0 }
 	};
 }