github-router 0.3.248 → 0.3.250

package/dist/{peer-mcp-personas-HWhxZUvf.js → peer-mcp-personas-BvommiSI.js}

@@ -11,7 +11,7 @@ import * as path$1 from "node:path";
 import path, { dirname, join } from "node:path";
 import process$1 from "node:process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
-import { chmodSync, closeSync, cpSync, existsSync, mkdirSync, openSync, promises, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { chmodSync, closeSync, constants, cpSync, existsSync, mkdirSync, openSync, promises, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { Agent, ProxyAgent } from "undici";
 import { z } from "zod";
@@ -14245,6 +14245,9 @@ function isSensitivePath(absPath, workspaceAbs) {
 */
 function rejectWindowsHostilePath(raw) {
 	if (/^[\\/]{2}/.test(raw)) return "rejected: UNC or device path";
+	if (IS_WINDOWS) {
+		if ((/^[A-Za-z]:/.test(raw) ? raw.slice(2) : raw).includes(":")) return "rejected: alternate data stream";
+	}
 	if (/^[A-Za-z]:(?![\\/])/.test(raw)) return "rejected: drive-relative path";
 	return null;
 }
@@ -18750,6 +18753,103 @@ function preflightUrlPolicy(toolName, args) {
 	return checkUrlPolicy(args.url);
 }
 //#endregion
+//#region src/lib/attachments.ts
+/**
+* Build a text + image tool result.
+*
+* TEXT FIRST, IMAGE SECOND — and this ordering is load-bearing for a reason
+* worth recording honestly: it is test-debt accommodation, not a design
+* argument. 75 assertions across the suite read `result.content[0].text`, and
+* putting the image first would break every one of them for no gain. Nothing
+* in the MCP spec or in any known consumer is sensitive to block order, so the
+* cheap accommodation wins. If that ever stops being true, codemod the
+* assertions rather than contorting the wire shape.
+*/
+function mcpTextAndImage(text, image) {
+	return { content: [{
+		type: "text",
+		text
+	}, {
+		type: "image",
+		data: image.data,
+		mimeType: image.mimeType
+	}] };
+}
+/**
+* Media types that appear in some Copilot model's
+* `capabilities.limits.vision.supported_media_types`. This is the UNION across
+* models, not a per-model allowlist — an individual model accepts a subset
+* (gemini takes heic/heif but not gif; the gpt and claude lanes take gif but
+* not heic). Per-model narrowing is the outbound validator's job; this set only
+* answers "is this an image shape any Copilot model could take at all".
+*/
+const SUPPORTED_IMAGE_MIME_TYPES = /* @__PURE__ */ new Set([
+	"image/jpeg",
+	"image/png",
+	"image/webp",
+	"image/gif",
+	"image/heic",
+	"image/heif"
+]);
+function startsWith(bytes, offset, sig) {
+	if (bytes.length < offset + sig.length) return false;
+	for (const [i, element] of sig.entries()) if (bytes[offset + i] !== element) return false;
+	return true;
+}
+function startsWithAscii(bytes, offset, ascii) {
+	return startsWith(bytes, offset, [...ascii].map((c) => c.codePointAt(0) ?? 0));
+}
+const PNG_SIGNATURE = [
+	137,
+	80,
+	78,
+	71,
+	13,
+	10,
+	26,
+	10
+];
+/**
+* Identify an image by its leading bytes, returning a media type from
+* `SUPPORTED_IMAGE_MIME_TYPES` or `undefined` when the bytes are not a
+* supported image.
+*
+* `undefined` is a deliberate two-in-one answer: "not an image" and "an image
+* kind nothing upstream accepts" are the same outcome for every caller here,
+* because both mean the bytes must not be sent as an image block.
+*
+* Truncated and malformed inputs return `undefined` rather than throwing — a
+* caller reading an arbitrary file off disk must not be able to crash a tool
+* dispatch with a 3-byte file.
+*/
+function detectImageMimeType(bytes) {
+	if (startsWith(bytes, 0, [
+		255,
+		216,
+		255
+	])) return bytes[3] === 247 ? void 0 : "image/jpeg";
+	if (startsWith(bytes, 0, PNG_SIGNATURE)) return bytes.length >= 16 && new DataView(bytes.buffer, bytes.byteOffset).getUint32(PNG_SIGNATURE.length) === 13 && startsWithAscii(bytes, 12, "IHDR") ? "image/png" : void 0;
+	if (startsWithAscii(bytes, 0, "GIF8")) return "image/gif";
+	if (startsWithAscii(bytes, 0, "RIFF") && startsWithAscii(bytes, 8, "WEBP")) return "image/webp";
+	if (startsWithAscii(bytes, 4, "ftyp")) {
+		const brand = new TextDecoder().decode(bytes.subarray(8, 12));
+		if (brand === "heic" || brand === "heix" || brand === "hevc" || brand === "hevx") return "image/heic";
+		if (brand === "mif1" || brand === "msf1" || brand === "heim" || brand === "heis") return "image/heif";
+	}
+}
+/** Decode base64 for size-validation purposes; see the notes inside. */
+function decodeBase64Strict(input) {
+	const compact = input.replaceAll(/[\s]/g, "");
+	if (compact.length === 0) return null;
+	if (!/^[A-Za-z0-9+/]*={0,2}$/.test(compact)) return null;
+	const remainder = compact.length % 4;
+	if (remainder === 1) return null;
+	const padded = remainder === 0 ? compact : compact + "=".repeat(4 - remainder);
+	const buf = Buffer.from(padded, "base64");
+	if (buf.toString("base64") !== padded) return null;
+	return new Uint8Array(buf);
+}
+//#endregion
 //#region src/lib/browser-mcp/dispatch.ts
 /**
 * Tools whose dispatch counts as a mutating user action for pacing
@@ -18969,6 +19069,52 @@ async function bridgeCall(endpoint, tool, args, timeoutMs, signal) {
 		});
 	});
 }
+/**
+* Turn a bridge envelope that carries captured pixels into a real MCP image
+* block, or return `null` when it doesn't (the overwhelmingly common case —
+* every non-screenshot tool).
+*
+* The extension returns `{contentType, dataBase64}` for `browser_screenshot`.
+* That used to be `JSON.stringify`'d into a text block, which meant the calling
+* model received base64 characters it could not interpret, at roughly 130x the
+* token cost of the same image sent natively (base64 tokenizes at ~1.46
+* chars/token under o200k, so a 200 KB PNG is ~187k tokens — enough to be
+* rejected outright by a 200k-context model).
+*
+* Two deliberate choices:
+*
+*  - The media type is SNIFFED from the bytes, not taken from the envelope's
+*    `contentType`. A declared type is an assertion; the payload is what
+*    upstream will actually try to decode. The declared value is preserved in
+*    the text block so a mismatch stays debuggable.
+*  - The text block keeps every envelope field EXCEPT `dataBase64`, and gains
+*    a decoded `bytes` count. Callers that parsed the JSON metadata keep
+*    working; the payload simply stops being duplicated in a form nothing
+*    could read.
+*
+* Bytes that don't decode strictly, or that aren't a supported image, fall
+* through to `null` and take the plain-text path — a malformed capture must
+* not become an image block that upstream then rejects.
+*/
+function imageEnvelope(data) {
+	if (data === null || typeof data !== "object" || Array.isArray(data)) return null;
+	const record = data;
+	const encoded = record.dataBase64;
+	if (typeof encoded !== "string" || encoded.length === 0) return null;
+	const bytes = decodeBase64Strict(encoded);
+	if (!bytes) return null;
+	const mimeType = detectImageMimeType(bytes);
+	if (!mimeType) return null;
+	const meta = {
+		bytes: bytes.length,
+		mimeType
+	};
+	for (const [key, value] of Object.entries(record)) if (key !== "dataBase64") meta[key] = value;
+	return mcpTextAndImage(JSON.stringify(meta, null, 2), {
+		data: encoded,
+		mimeType
+	});
+}
 function blockedUrlEnvelope(reason) {
 	return {
 		content: [{
@@ -19034,7 +19180,6 @@ async function dispatchBrowserTool(tool, args, signal, opts = {}) {
 			token: ready.token
 		}, tool, args, callerTimeout, signal);
 		if (resp.ok) {
-			const text = typeof resp.data === "string" ? resp.data : JSON.stringify(resp.data, null, 2);
 			logAudit$1({
 				tool,
 				argsBytes: argsByteSize(args),
@@ -19042,9 +19187,9 @@ async function dispatchBrowserTool(tool, args, signal, opts = {}) {
 				profile: typeof args.profile === "string" ? args.profile : "isolated",
 				result: "ok"
 			});
-			return { content: [{
+			return imageEnvelope(resp.data) ?? { content: [{
 				type: "text",
-				text
+				text: typeof resp.data === "string" ? resp.data : JSON.stringify(resp.data, null, 2)
 			}] };
 		}
 		logAudit$1({
@@ -19674,6 +19819,169 @@ function currentInFlight() {
 	return inFlight$2;
 }
 //#endregion
+//#region src/lib/vision-preflight.ts
+/**
+* Outbound vision preflight.
+*
+* Converts what would otherwise be an opaque upstream `400` into a local,
+* actionable rejection — the same trade `predictedWindowOverflow` in
+* `src/routes/mcp/handler.ts` already makes for prompt tokens, and the reason
+* this file exists at all: `capabilities.limits.vision` advertises three fields
+* (`max_prompt_images`, `max_prompt_image_size`, `supported_media_types`) and
+* until now the proxy read exactly one of them, in the `models` pretty-printer.
+*
+* WHY ONE CHOKEPOINT, NOT PER-ADAPTER CHECKS
+*
+* Images reach the wire through more paths than is obvious: a top-level user
+* block, a block nested inside a `tool_result`, the synthetic follow-up user
+* message the shim emits because a tool-output item cannot carry images, images
+* already present in replayed conversation history, and peer-critic
+* attachments. Validating in each adapter means each adapter has to
+* rediscover every one of those shapes, and the ones it forgets fail silently.
+* So validation runs ONCE, on the fully assembled payload, immediately before
+* transport serialization — `createResponses` and `createChatCompletions` — and
+* is therefore total by construction.
+*
+* POLICY ON MISSING METADATA
+*
+* Deliberately NOT fail-open. "We don't know the limit" is not "there is no
+* limit"; treating it as the latter reproduces the exact opaque-400 this
+* module exists to remove. The three cases are distinguished:
+*
+*   - model absent from the catalog entirely → ALLOW. We have no basis for a
+*     judgement, upstream remains authoritative, and blocking would break
+*     custom catalogs and offline tests. This mirrors `modelSupportsEndpoint`.
+*   - model present, `supports.vision` not true → REJECT, naming the model.
+*   - model present, vision supported, limits absent → CONSERVATIVE FLOOR
+*     (`FLOOR_MAX_IMAGES` / `FLOOR_MAX_IMAGE_BYTES`), and the message says so,
+*     so the caller can tell a real limit from an assumed one.
+*
+* Error strings are returned to callers and end up in front of a model, so they
+* name the model, the numbers, and the fix — never a stack, a local path, or a
+* raw catalog object.
+*/
+/**
+* Floor applied when a model advertises vision but publishes no limits. Every
+* vision-capable model in the live catalog reports at least 1 image and a
+* 3 MiB ceiling, so this is the observed minimum rather than a guess.
+*/
+const FLOOR_MAX_IMAGES = 1;
+const FLOOR_MAX_IMAGE_BYTES = 3145728;
+/**
+* Split a `data:<mime>;base64,<payload>` URI. Returns `null` for any other URL
+* shape (including a plain remote `https://` reference, which the caller
+* handles separately because its bytes are not ours to inspect).
+*/
+function parseDataUrl(url) {
+	const match = /^data:([^;,]+);base64,(.*)$/s.exec(url);
+	if (!match) return null;
+	return {
+		mimeType: match[1],
+		base64: match[2]
+	};
+}
+function reject(message) {
+	return {
+		ok: false,
+		message
+	};
+}
+/**
+* Validate every image on an outbound request against the resolved model's
+* advertised vision capability.
+*
+* Remote-URL images are counted toward the cardinality limit but not size- or
+* type-checked: the bytes live on someone else's server, so any local claim
+* about them would be fiction. Upstream stays authoritative for those.
+*/
+function checkOutboundImages(modelId, images) {
+	if (images.length === 0) return { ok: true };
+	const model = state.models?.data.find((m) => m.id === modelId);
+	if (!model) return { ok: true };
+	if ((model.capabilities?.supports)?.vision !== true) return reject(`Model ${modelId} does not support image input. Send text only, or select a vision-capable model.`);
+	const limits = model.capabilities?.limits?.vision;
+	const maxImages = limits?.max_prompt_images ?? FLOOR_MAX_IMAGES;
+	const maxBytes = limits?.max_prompt_image_size ?? FLOOR_MAX_IMAGE_BYTES;
+	const assumed = limits?.max_prompt_images === void 0 ? " (assumed; the model publishes no image limits)" : "";
+	if (images.length > maxImages) return reject(`Model ${modelId} accepts at most ${maxImages} image(s) per request${assumed}, but this request carries ${images.length}. Send fewer images, or use a model with a higher image limit.`);
+	const allowedTypes = limits?.supported_media_types;
+	for (const [index, image] of images.entries()) {
+		if (image.url !== void 0 && image.base64 === void 0) continue;
+		const position = `image ${index + 1} of ${images.length}`;
+		if (image.declaredMimeType === void 0 || image.declaredMimeType.length === 0) return reject(`${position} has no media type. Anthropic's \`source.media_type\` (or a \`data:<mime>;base64,\` prefix) is required — it used to be defaulted, which silently asserted a type the model may not accept.`);
+		if (image.base64 === void 0) continue;
+		const bytes = decodeBase64Strict(image.base64);
+		if (!bytes) return reject(`${position} is not valid base64 and cannot be sent.`);
+		if (bytes.length > maxBytes) return reject(`${position} is ${bytes.length} bytes, over model ${modelId}'s ${maxBytes}-byte limit${assumed}. Re-capture at a smaller scale or lower quality.`);
+		const actual = detectImageMimeType(bytes);
+		if (!actual) return reject(`${position} is declared ${image.declaredMimeType} but its bytes are not a supported image (jpeg, png, webp, gif, heic, heif).`);
+		if (actual !== image.declaredMimeType) return reject(`${position} is declared ${image.declaredMimeType} but its bytes are ${actual}. Send the correct media type.`);
+		if (allowedTypes && allowedTypes.length > 0 && !allowedTypes.includes(actual)) return reject(`${position} is ${actual}, which model ${modelId} does not accept. Supported: ${allowedTypes.join(", ")}.`);
+	}
+	return { ok: true };
+}
+/** Collect the images on an assembled Copilot `/responses` payload. */
+function imagesInResponsesPayload(input) {
+	const images = [];
+	if (!Array.isArray(input)) return images;
+	for (const item of input) {
+		if (item === null || typeof item !== "object") continue;
+		const content = item.content;
+		if (!Array.isArray(content)) continue;
+		for (const part of content) {
+			if (part === null || typeof part !== "object") continue;
+			const p = part;
+			if (p.type !== "input_image" || typeof p.image_url !== "string") continue;
+			images.push(fromUrl(p.image_url));
+		}
+	}
+	return images;
+}
+/** Collect the images on an assembled Copilot `/chat/completions` payload. */
+function imagesInChatPayload(messages) {
+	const images = [];
+	if (!Array.isArray(messages)) return images;
+	for (const message of messages) {
+		if (message === null || typeof message !== "object") continue;
+		const content = message.content;
+		if (!Array.isArray(content)) continue;
+		for (const part of content) {
+			if (part === null || typeof part !== "object") continue;
+			const p = part;
+			if (p.type !== "image_url") continue;
+			const url = p.image_url?.url;
+			if (typeof url !== "string") continue;
+			images.push(fromUrl(url));
+		}
+	}
+	return images;
+}
+function fromUrl(url) {
+	const parsed = parseDataUrl(url);
+	return parsed ? {
+		base64: parsed.base64,
+		declaredMimeType: parsed.mimeType
+	} : { url };
+}
+/**
+* Run the preflight and throw a client-visible 400 when it fails.
+*
+* Shaped as an `HTTPError` carrying a synthetic `Response` so it flows through
+* the existing `forwardError` path and reaches the client as a normal
+* Anthropic-format `invalid_request_error` — the same envelope an upstream
+* rejection would produce, except it names the actual problem and no upstream
+* request was made. Tests assert that second property: a preflight failure must
+* cost zero upstream calls.
+*/
+function assertOutboundImagesOk(modelId, images) {
+	const verdict = checkOutboundImages(modelId, images);
+	if (verdict.ok) return;
+	throw new HTTPError(verdict.message, new Response(JSON.stringify({ error: { message: verdict.message } }), {
+		status: 400,
+		headers: { "content-type": "application/json" }
+	}));
+}
+//#endregion
 //#region src/lib/diagnose-response.ts
 const PREVIEW_LIMIT = 200;
 async function parseJsonOrDiagnose(response, routePath) {
@@ -19795,6 +20103,7 @@ async function readResponseBodyCapped(response, routePath, capBytes = MAX_RESPON
 const createChatCompletions = async (payload, modelHeaders, callerSignal, retryTransient = false) => {
 	if (!state.copilotToken) throw new Error("Copilot token not found");
 	const enableVision = payload.messages.some((x) => typeof x.content !== "string" && x.content?.some((x) => x.type === "image_url"));
+	if (enableVision) assertOutboundImagesOk(payload.model, imagesInChatPayload(payload.messages));
 	const isAgentCall = payload.messages.some((msg) => ["assistant", "tool"].includes(msg.role));
 	const url = `${copilotBaseUrl(state)}/chat/completions`;
 	const doFetch = () => {
@@ -19857,6 +20166,7 @@ const createChatCompletions = async (payload, modelHeaders, callerSignal, retryT
 const createResponses = async (payload, modelHeaders, callerSignal, retryTransient = false) => {
 	if (!state.copilotToken) throw new Error("Copilot token not found");
 	const enableVision = detectVision(payload.input);
+	if (enableVision) assertOutboundImagesOk(payload.model, imagesInResponsesPayload(payload.input));
 	const isAgentCall = detectAgentCall(payload.input);
 	const url = `${copilotBaseUrl(state)}/responses`;
 	const doFetch = () => {
@@ -19919,6 +20229,20 @@ function detectAgentCall(input) {
 //#endregion
 //#region src/services/copilot/endpoint.ts
 /**
+* Catalog spellings that mean each of our two clients. Copilot is not
+* self-consistent about the `/v1` prefix — the live catalog advertises
+* `/v1/messages` prefixed but `/chat/completions` bare, and this repo's own
+* fixtures carry both forms — so an exact-match on the bare spelling alone
+* silently misses a real shape. `src/lib/model-validation.ts` already
+* normalizes the same way (`ENDPOINT_ALIASES`); this keeps the two agreeing.
+*
+* Matching is EXACT against this set, never a suffix/`includes` test: a
+* `ws:/responses` (websocket transport) entry is NOT the `/responses` HTTP
+* client and must keep resolving to "serves neither".
+*/
+const CHAT_ENDPOINTS = /* @__PURE__ */ new Set(["/chat/completions", "/v1/chat/completions"]);
+const RESPONSES_ENDPOINTS = /* @__PURE__ */ new Set(["/responses", "/v1/responses"]);
+/**
 * Decide which endpoint to call for a model from its catalog
 * `supported_endpoints`. Prefers `/chat/completions` when available (the
 * simpler, more widely-supported shape) and falls back to `/responses` for
@@ -19934,19 +20258,37 @@ function detectAgentCall(input) {
 function pickEndpoint(model) {
 	const eps = model.supported_endpoints;
 	if (!eps || eps.length === 0) return "chat";
-	if (eps.includes("/chat/completions")) return "chat";
-	if (eps.includes("/responses")) return "responses";
+	if (eps.some((e) => CHAT_ENDPOINTS.has(e))) return "chat";
+	if (eps.some((e) => RESPONSES_ENDPOINTS.has(e))) return "responses";
 }
 /**
-* `pickEndpoint` by model id against the live catalog. Returns "chat" when
-* the id isn't in the catalog (unknown models default to the chat shape,
-* matching the field-absent rule above) — callers that need a hard
-* presence check should look the model up themselves.
+* `pickEndpoint` by model id against the live catalog, WITHOUT collapsing
+* "absent from the catalog" into "serves neither of our endpoints".
+*
+* This function deliberately has no default. The predecessor
+* (`endpointForModelId`) returned `pickEndpoint(found) ?? "chat"`, which
+* coerced both cases to "chat" — defensible for an unknown id, silently wrong
+* for a catalog model serving only, say, `/v1/messages`: the caller would drive
+* it through the chat client and get an opaque upstream 400 with no local
+* signal about the real cause. `src/lib/browser-mcp/compressor.ts` already
+* treats that case correctly (`if (!endpoint) continue`); this makes the same
+* distinction available to callers that resolve by id.
+*
+* Callers that legitimately want the chat default for an unknown id can still
+* have it — they just have to write it, per case, on purpose.
 */
-function endpointForModelId(id) {
+function resolveEndpointForModelId(id) {
 	const found = state.models?.data?.find((m) => m.id === id);
-	if (!found) return "chat";
-	return pickEndpoint(found) ?? "chat";
+	if (!found) return { kind: "unknown-model" };
+	const endpoint = pickEndpoint(found);
+	if (endpoint) return {
+		kind: "endpoint",
+		endpoint
+	};
+	return {
+		kind: "unreachable",
+		endpoints: found.supported_endpoints ?? []
+	};
 }
 //#endregion
 //#region src/lib/browser-mcp/compressor.ts
@@ -20846,7 +21188,7 @@ const BROWSER_TOOLS = Object.freeze([
 	},
 	{
 		toolNameHttp: "browser_screenshot",
-		description: "Captures a screenshot of the visible area of a tab, as PNG by default or JPEG when requested. It takes a tab id and optional format, then returns base64-encoded image bytes plus contentType. The tab must be active in its window, so this tool auto-activates the tab if needed and that changes which tab is focused. Use screenshot for visual layout, canvas, SVG, maps, or image-only regions; prefer browser_observe when page text and actionable state are enough.",
+		description: "Captures a screenshot of the visible area of a tab and returns it as an image you can actually look at, plus a small text envelope of capture metadata. It takes a tab id, an optional format (PNG default, JPEG for smaller bytes), and an optional JPEG quality. The tab must be active in its window, so this tool auto-activates the tab if needed and that changes which tab is focused. If a capture is rejected for exceeding a model's image-size limit, the most reliable lever is a smaller browser window; PNG is usually SMALLER than JPEG for ordinary UI and text pages, so switching format is not a dependable way to shrink one. JPEG plus a low quality helps mainly for photographic or dense-colour content. Use screenshot for visual layout, canvas, SVG, maps, or image-only regions; prefer browser_observe when page text and actionable state are enough.",
 		inputSchema: {
 			type: "object",
 			required: ["tabId"],
@@ -20860,6 +21202,12 @@ const BROWSER_TOOLS = Object.freeze([
 					type: "string",
 					enum: ["png", "jpeg"],
 					description: "Image format for the returned screenshot. Default 'png'; use 'jpeg' when smaller image bytes are preferable."
+				},
+				quality: {
+					type: "number",
+					minimum: 1,
+					maximum: 100,
+					description: "JPEG quality 1-100 (ignored for PNG). Only meaningful with format='jpeg'. Note JPEG is often LARGER than PNG for flat UI screenshots — measured on a plain documentation page, PNG 35553 bytes vs JPEG q30 40599 bytes at the same viewport — so reach for it for photographic content, not as a general size lever."
 				}
 			}
 		},
@@ -21590,21 +21938,12 @@ async function runAtomicIntentStep(tabId, intent, value, signal) {
 				error: "no text match; screenshot for visual fallback failed",
 				picked
 			}, true);
-			const shotText = shotEnv.content?.[0]?.text;
-			let shot = {};
-			try {
-				shot = shotText ? JSON.parse(shotText) : {};
-			} catch {
-				return toolEnvelope({
-					ok: false,
-					error: "no text match; screenshot envelope unparseable"
-				}, true);
-			}
-			if (!shot.contentType || !shot.dataBase64) return toolEnvelope({
+			const shot = shotEnv.content.find((b) => b.type === "image");
+			if (!shot) return toolEnvelope({
 				ok: false,
-				error: "no text match; screenshot envelope missing fields"
+				error: "no text match; screenshot returned no image"
 			}, true);
-			const visual = await pickElementVisual(shot.dataBase64, shot.contentType, intent, surfaces, signal);
+			const visual = await pickElementVisual(shot.data, shot.mimeType, intent, surfaces, signal);
 			if (visual.confidence < .5) return toolEnvelope({
 				ok: false,
 				error: "no element matched intent (text + visual)",
@@ -24169,7 +24508,12 @@ async function runStreamLoop(stream, context, opts, options) {
 			return;
 		}
 	}
-	if (endpointForModelId(resolved.modelId) === "responses") {
+	const resolution = resolveEndpointForModelId(resolved.modelId);
+	if (resolution.kind === "unreachable") {
+		pushUndrivableModelDiagnostic(stream, resolved, resolution.endpoints);
+		return;
+	}
+	if (resolution.kind === "endpoint" && resolution.endpoint === "responses") {
 		await runResponsesStreamLoop(stream, context, opts, options);
 		return;
 	}
@@ -24195,10 +24539,14 @@ async function runChatAttempt(stream, payload, opts, signal, state) {
 	let nextContentIndex = 0;
 	let activeTextIndex = null;
 	const toolPiIndexByOAI = /* @__PURE__ */ new Map();
+	let sawDone = false;
 	for await (const evt of sseStream) {
 		const data = evt?.data;
 		if (data == null) continue;
-		if (data === "[DONE]") break;
+		if (data === "[DONE]") {
+			sawDone = true;
+			break;
+		}
 		let chunk;
 		try {
 			chunk = JSON.parse(data);
@@ -24291,12 +24639,26 @@ async function runChatAttempt(stream, payload, opts, signal, state) {
 		if (choice.finish_reason) accum.finishReason = choice.finish_reason;
 	}
 	if (!state.active) return;
+	if (!sawDone && accum.finishReason == null) {
+		if (activeTextIndex != null) stream.push({
+			type: "text_end",
+			contentIndex: activeTextIndex,
+			content: joinTextChunks(accum, activeTextIndex),
+			partial: buildPartial(resolved, accum)
+		});
+		pushTerminalError(stream, resolved, /* @__PURE__ */ new Error("chat stream ended without a [DONE] sentinel (truncated)"));
+		return;
+	}
 	if (activeTextIndex != null) stream.push({
 		type: "text_end",
 		contentIndex: activeTextIndex,
 		content: joinTextChunks(accum, activeTextIndex),
 		partial: buildPartial(resolved, accum)
 	});
+	if (accum.finishReason === "content_filter") {
+		pushTerminalError(stream, resolved, /* @__PURE__ */ new Error("upstream content filter blocked the response"));
+		return;
+	}
 	for (const block of accum.blocks) {
 		if (block.kind !== "tool") continue;
 		const entry = accum.toolByIndex.get(block.contentIndex);
@@ -24322,10 +24684,7 @@ function buildPayload(context, resolved) {
 		role: "system",
 		content: context.systemPrompt
 	});
-	for (const m of context.messages) {
-		const oai = translateMessage(m);
-		if (oai) messages.push(oai);
-	}
+	messages.push(...translateMessages(context.messages));
 	const tools = translateTools(context.tools);
 	const payload = {
 		model: resolved.modelId,
@@ -24339,11 +24698,55 @@ function buildPayload(context, resolved) {
 	if (resolved.thinking !== "off") payload.reasoning_effort = resolved.thinking;
 	return payload;
 }
-function translateMessage(m) {
-	if (m.role === "user") return translateUser(m);
-	if (m.role === "assistant") return translateAssistant(m);
-	if (m.role === "toolResult") return translateToolResult(m);
-	return null;
+/**
+* Pi messages → wire messages, with tool-result images hoisted to the END of
+* each contiguous run of tool results.
+*
+* A tool-output wire item cannot carry an image, so images have to ride in a
+* separate user message. The obvious implementation — fan each `toolResult` out
+* to `[tool, user]` independently — is WRONG for parallel tool calls: it yields
+* `tool A, user A, tool B, user B`, and every provider requires the tool
+* messages answering one assistant turn to be CONTIGUOUS. The interjected user
+* message orphans the following tool message and the request is rejected.
+*
+* So images accumulate across the run and flush once, after the last tool
+* message of that run: `tool A, tool B, user(imgA, imgB)`.
+*
+* This runs at REQUEST-ASSEMBLY time over `context.messages` and never writes
+* back to worker state, so the synthetic message is ephemeral — an image is not
+* appended to the transcript and re-sent on every later turn.
+*/
+function translateMessages(messages) {
+	const out = [];
+	let pending = [];
+	const flushImages = () => {
+		if (pending.length === 0) return;
+		out.push({
+			role: "user",
+			content: pending.map((img) => ({
+				type: "image_url",
+				image_url: { url: `data:${img.mimeType};base64,${img.data}` }
+			}))
+		});
+		pending = [];
+	};
+	for (const m of messages) {
+		if (m.role === "toolResult") {
+			const images = imagePartsOf(m.content);
+			out.push({
+				role: "tool",
+				tool_call_id: m.toolCallId,
+				content: toolResultText(m, images.length > 0)
+			});
+			pending.push(...images);
+			continue;
+		}
+		flushImages();
+		if (m.role === "user") out.push(translateUser(m));
+		else if (m.role === "assistant") out.push(translateAssistant(m));
+	}
+	flushImages();
+	return out;
 }
 function translateUser(m) {
 	if (typeof m.content === "string") return {
@@ -24386,13 +24789,6 @@ function translateAssistant(m) {
 	if (toolCalls.length > 0) out.tool_calls = toolCalls;
 	return out;
 }
-function translateToolResult(m) {
-	return {
-		role: "tool",
-		tool_call_id: m.toolCallId,
-		content: joinTextParts(m.content)
-	};
-}
 function translateTools(tools) {
 	if (!tools || tools.length === 0) return void 0;
 	return tools.map((t) => ({
@@ -24404,6 +24800,37 @@ function translateTools(tools) {
 		}
 	}));
 }
+/** The image parts of a Pi tool result, in wire order. */
+function imagePartsOf(parts) {
+	const out = [];
+	for (const p of parts) {
+		if (p.type !== "image") continue;
+		if (typeof p.data !== "string" || p.data.length === 0) continue;
+		out.push({
+			data: p.data,
+			mimeType: p.mimeType ?? "image/png"
+		});
+	}
+	return out;
+}
+/**
+* The text of a tool result, with two pieces of information restored that were
+* previously thrown away:
+*
+*  - `isError`. Pi records it on the message, but the wire tool-output item has
+*    no error flag, so without a marker the model could not tell a failed call
+*    from a successful one. The Anthropic shim has always prefixed
+*    `[tool error]`; this matches it.
+*  - a pointer to the follow-up image message, when the tool returned only
+*    images. An empty tool output is confusing on its own; naming what follows
+*    is not.
+*/
+function toolResultText(m, hasImages) {
+	let text = joinTextParts(m.content);
+	if (hasImages && text.length === 0) text = "[image result below]";
+	if (m.isError === true) text = text.length > 0 ? `[tool error] ${text}` : "[tool error]";
+	return text;
+}
 function joinTextParts(parts) {
 	let s = "";
 	for (const p of parts) if (p.type === "text" && typeof p.text === "string") s += p.text;
@@ -24476,6 +24903,7 @@ async function runResponsesAttempt(stream, payload, opts, signal, state) {
 		});
 		activeTextIndex = null;
 	};
+	let sawTerminal = false;
 	for await (const evt of sseStream) {
 		const data = evt?.data;
 		if (data == null) continue;
@@ -24621,6 +25049,7 @@ async function runResponsesAttempt(stream, payload, opts, signal, state) {
 			}
 			case "response.completed":
 			case "response.incomplete":
+				sawTerminal = true;
 				accum.usage = mapResponsesUsage(ev.response?.usage);
 				if (ev.type === "response.incomplete" && ev.response?.incomplete_details?.reason === "max_output_tokens") accum.finishReason = "length";
 				if (opts.onChunk && accum.usage) try {
@@ -24642,6 +25071,11 @@ async function runResponsesAttempt(stream, payload, opts, signal, state) {
 		}
 	}
 	if (!state.active) return;
+	if (!sawTerminal) {
+		closeActiveText();
+		pushTerminalError(stream, resolved, /* @__PURE__ */ new Error("responses stream ended without a terminal event (truncated)"));
+		return;
+	}
 	closeActiveText();
 	for (const block of accum.blocks) {
 		if (block.kind !== "tool") continue;
@@ -24665,11 +25099,7 @@ async function runResponsesAttempt(stream, payload, opts, signal, state) {
 	});
 }
 function buildResponsesPayload(context, resolved) {
-	const messages = [];
-	for (const m of context.messages) {
-		const neutral = piMessageToNeutral(m);
-		if (neutral) messages.push(neutral);
-	}
+	const messages = piMessagesToNeutral(context.messages);
 	return assembleResponsesPayload({
 		model: resolved.modelId,
 		instructions: context.systemPrompt || void 0,
@@ -24679,50 +25109,82 @@ function buildResponsesPayload(context, resolved) {
 		stream: true
 	});
 }
-function piMessageToNeutral(m) {
-	if (m.role === "user") {
-		if (typeof m.content === "string") return {
+/**
+* Pi messages → neutral messages, with tool-result images hoisted to the end of
+* each contiguous run of tool results.
+*
+* Exact twin of `translateMessages` on the chat path — see that doc comment for
+* why the grouping is load-bearing rather than cosmetic. A per-message fan-out
+* interleaves a user message between parallel `function_call_output` items,
+* which at best is a shape no client emits and at worst is rejected outright.
+*/
+function piMessagesToNeutral(messages) {
+	const out = [];
+	let pending = [];
+	const flushImages = () => {
+		if (pending.length === 0) return;
+		out.push({
 			role: "user",
-			content: m.content
-		};
-		const parts = [];
-		for (const c of m.content) if (c.type === "text") parts.push({
-			type: "text",
-			text: c.text
+			content: pending.map((img) => ({
+				type: "image",
+				mimeType: img.mimeType,
+				data: img.data
+			}))
 		});
-		else if (c.type === "image") parts.push({
-			type: "image",
-			mimeType: c.mimeType,
-			data: c.data
-		});
-		return {
+		pending = [];
+	};
+	for (const m of messages) {
+		if (m.role === "toolResult") {
+			const images = imagePartsOf(m.content);
+			out.push({
+				role: "toolResult",
+				toolCallId: m.toolCallId,
+				output: toolResultText(m, images.length > 0)
+			});
+			pending.push(...images);
+			continue;
+		}
+		flushImages();
+		if (m.role === "user") if (typeof m.content === "string") out.push({
 			role: "user",
-			content: parts
-		};
-	}
-	if (m.role === "assistant") {
-		const parts = [];
-		for (const c of m.content) if (c.type === "text") parts.push({
-			type: "text",
-			text: c.text
-		});
-		else if (c.type === "toolCall") parts.push({
-			type: "toolCall",
-			id: c.id,
-			name: c.name,
-			arguments: c.arguments
+			content: m.content
 		});
-		return {
-			role: "assistant",
-			content: parts
-		};
+		else {
+			const parts = [];
+			for (const c of m.content) if (c.type === "text") parts.push({
+				type: "text",
+				text: c.text
+			});
+			else if (c.type === "image") parts.push({
+				type: "image",
+				mimeType: c.mimeType,
+				data: c.data
+			});
+			out.push({
+				role: "user",
+				content: parts
+			});
+		}
+		else if (m.role === "assistant") {
+			const parts = [];
+			for (const c of m.content) if (c.type === "text") parts.push({
+				type: "text",
+				text: c.text
+			});
+			else if (c.type === "toolCall") parts.push({
+				type: "toolCall",
+				id: c.id,
+				name: c.name,
+				arguments: c.arguments
+			});
+			out.push({
+				role: "assistant",
+				content: parts
+			});
+		}
 	}
-	if (m.role === "toolResult") return {
-		role: "toolResult",
-		toolCallId: m.toolCallId,
-		output: joinTextParts(m.content)
-	};
-	return null;
+	flushImages();
+	return out;
 }
 function piToolsToNeutral(tools) {
 	if (!tools || tools.length === 0) return void 0;
@@ -24993,6 +25455,33 @@ function pushBackstopDiagnostic(stream, resolved, assembledTokens, limitTokens)
 		error: final
 	});
 }
+/**
+* Terminal diagnostic for a model the worker cannot drive AT ALL: it is in the
+* live catalog, but its `supported_endpoints` name neither `/chat/completions`
+* nor `/responses` — our only two clients. Fails here, locally, naming the
+* model and what it actually serves, instead of coercing it onto the chat
+* client and surfacing an opaque upstream `unsupported_api_for_model` 400.
+* Carried as assistant TEXT so the engine surfaces it as an `isError` result
+* (same shape as the request-boundary backstop).
+*/
+function pushUndrivableModelDiagnostic(stream, resolved, endpoints) {
+	const served = endpoints.length > 0 ? endpoints.join(", ") : "(none advertised)";
+	const text = `Cannot run: ${resolved.modelId} is in the Copilot catalog but serves neither /chat/completions nor /responses — the only two APIs a worker can drive. Its catalog supported_endpoints are: ${served}. Pick a different model for this call, or change the mode default via worker_defaults (a zero-arg worker_defaults call lists the models a worker can be pointed at).`;
+	const final = {
+		...makeBaseMessage(resolved),
+		content: [{
+			type: "text",
+			text
+		}],
+		stopReason: "error",
+		errorMessage: `model ${resolved.modelId} serves no worker-drivable endpoint (${served})`
+	};
+	stream.push({
+		type: "error",
+		reason: "error",
+		error: final
+	});
+}
 function describeError(err) {
 	if (err instanceof HTTPError) return `${err.message} (status ${err.response.status})`;
 	if (err instanceof Error) return err.message;
@@ -25030,7 +25519,37 @@ function argsRecord(params) {
 * `tools.ts` uses for `peer_review`.
 */
 function joinEnvelopeText(env) {
-	return (env.content ?? []).map((c) => c.text).join("\n");
+	return (env.content ?? []).filter((c) => c.type === "text").map((c) => c.text).join("\n");
+}
+/**
+* Wrap a text payload PLUS a captured image in Pi's tool-result shape.
+*
+* The browse worker's own system prompt tells it to "use screenshot to SEE the
+* page", but every result was flattened to text — so the pixels never reached
+* it and it received base64 characters instead. Pi's tool-result content
+* supports image blocks natively, and the engine's `afterToolCall` cap
+* (`tool-output-cap.ts`) already preserves them and exempts them from the text
+* byte cap. Nothing was ever producing one.
+*
+* Text first, image second — same ordering rule as the MCP surface
+* (`mcpTextAndImage`), so a consumer reading the first block still finds text.
+*/
+function imageResult$1(text, image) {
+	return {
+		content: [{
+			type: "text",
+			text
+		}, {
+			type: "image",
+			data: image.data,
+			mimeType: image.mimeType
+		}],
+		details: {}
+	};
+}
+/** The first image block on a dispatch envelope, if the tool captured one. */
+function envelopeImage(env) {
+	return (env.content ?? []).find((c) => c.type === "image");
 }
 /**
 * How a tool interacts with a session's owned tabs:
@@ -25326,7 +25845,8 @@ function makeBrowserTool(meta, parameters, dispatch, sessionId) {
 					if (typeof tabId === "number") recordSessionTab(sessionId, tabId);
 				} else if (policy === "closes") for (const tabId of toNumberArray(args.tabIds)) releaseSessionTab(sessionId, tabId);
 			}
-			return textResult$1(text);
+			const image = envelopeImage(env);
+			return image ? imageResult$1(text, image) : textResult$1(text);
 		}
 	};
 	if (meta.executionMode) tool.executionMode = meta.executionMode;
@@ -25596,6 +26116,62 @@ function truncateModelText(text, capBytes) {
 	return head + notice + tail;
 }
 /**
+* Per-result image budget.
+*
+* Images are cheap in TOKENS (a vision image costs ~1.5k regardless of byte
+* size) but not in BYTES: three 3 MiB captures is ~12 MiB of base64 on the wire
+* and in memory, and they accumulate across turns. The text cap does not bound
+* them — and should not, since counting base64 against a text budget would
+* evict real text to make room for an image the model reads for free.
+*
+* `MAX_IMAGES_PER_RESULT` is the ceiling of the most permissive model in the
+* live catalog (gemini's 10). `MAX_IMAGE_BYTES_PER_RESULT` is the published
+* 3 MiB per-image ceiling times a small factor, so a legitimate multi-image
+* result passes and a runaway one does not.
+*/
+const MAX_IMAGES_PER_RESULT = 10;
+const MAX_IMAGE_BYTES_PER_RESULT = 12582912;
+/** Decoded byte size of a base64 payload, without allocating the buffer. */
+function base64Bytes(data) {
+	if (typeof data !== "string" || data.length === 0) return 0;
+	const padding = data.endsWith("==") ? 2 : data.endsWith("=") ? 1 : 0;
+	return Math.floor(data.length * 3 / 4) - padding;
+}
+/**
+* Trim an image list to the budget, returning the survivors plus a note naming
+* what was dropped. Dropping silently is not an option: a model told to compare
+* five screenshots, shown three, and given no indication, will reason
+* confidently about a set it never saw.
+*/
+function capImages(images) {
+	const kept = [];
+	let bytes = 0;
+	let dropped = 0;
+	for (const img of images) {
+		if (kept.length >= MAX_IMAGES_PER_RESULT) {
+			dropped++;
+			continue;
+		}
+		const size = base64Bytes(img.data);
+		if (bytes + size > MAX_IMAGE_BYTES_PER_RESULT) {
+			dropped++;
+			continue;
+		}
+		bytes += size;
+		kept.push(img);
+	}
+	if (dropped === 0) return {
+		kept,
+		note: void 0
+	};
+	return {
+		kept,
+		note: NEWLINE + NEWLINE + `[...${dropped} of ${images.length} image(s) dropped: over the per-result budget of ${MAX_IMAGES_PER_RESULT} images / ${Math.round(MAX_IMAGE_BYTES_PER_RESULT / 1048576)} MiB. Request fewer images at a time, or capture at a lower quality....]`
+	};
+}
+/** Literal newline, kept out of the template above for readability. */
+const NEWLINE = "\n";
+/**
 * Cap a tool result's TEXT content to `capBytes`, preserving any non-text
 * (image) blocks. Returns the replacement content array, or `undefined` when
 * the result is already under the cap (caller leaves it untouched).
@@ -25616,20 +26192,180 @@ function capToolResultText(content, capBytes) {
 	let textBytes = 0;
 	const texts = [];
 	const images = [];
+	const other = [];
 	for (const block of content) {
 		if (!block || typeof block !== "object") continue;
 		const b = block;
 		if (b.type === "text" && typeof b.text === "string") {
 			texts.push(b.text);
 			textBytes += Buffer.byteLength(b.text, "utf8");
-		} else images.push(block);
+		} else if (b.type === "image") images.push(block);
+		else other.push(block);
 	}
-	if (textBytes <= capBytes) return void 0;
-	const capped = truncateModelText(texts.join("\n"), capBytes);
-	return [...images, {
-		type: "text",
-		text: capped
-	}];
+	const { kept, note } = capImages(images);
+	if (textBytes <= capBytes && note === void 0) return void 0;
+	const joined = texts.join(NEWLINE);
+	const capped = textBytes > capBytes ? truncateModelText(joined, capBytes) : joined;
+	return [
+		...kept,
+		...other,
+		{
+			type: "text",
+			text: capped + (note ?? "")
+		}
+	];
+}
+//#endregion
+//#region src/lib/peer-attachments.ts
+/**
+* Server-side image loading for peer-critic attachments (`imagePaths`).
+*
+* WHY PATHS AND NOT BASE64
+*
+* The obvious schema would take base64 directly. It would also mean megabytes
+* of payload crossing the MCP boundary and sitting in the CALLER's context — the
+* exact cost the browser-screenshot fix exists to remove — and it would trip the
+* `predictedTooLong` pre-flight, which sizes the brief before a slot is
+* acquired. Reading the bytes here instead keeps the caller's context clean and
+* the wire small: the caller sends a path, the proxy sends the pixels.
+*
+* The proxy and the caller are the same machine in this product (the MCP server
+* is loopback-only and the CLI is spawned by it), so a local path is meaningful
+* on both sides.
+*
+* THREAT MODEL
+*
+* This is a second file-reading path, so it must not become a way around the
+* first one's rules. Every path goes through `confineToWorkspaceResult` — the
+* SAME chokepoint the worker's `read`/`glob`/`grep` tools use — which enforces
+* workspace confinement, `realpathSync.native()` (so a symlink or junction is
+* resolved to its true target before the prefix check), and syntactic rejection
+* of UNC, device, and drive-relative Windows paths. `isSensitivePath` then
+* applies the credential-shaped denylist (`.env*`, `*.pem`, `id_rsa*`, `.ssh/`,
+* `.git/` interior, `.netrc`, …).
+*
+* On top of that, content identification adds a second barrier: a file is only
+* ever sent if its leading BYTES are a supported image, so a `.env` renamed to
+* `shot.png` is refused even if it somehow passed confinement.
+*
+* That barrier is header-only, and worth stating honestly: a file beginning
+* with a valid PNG signature and carrying arbitrary data afterwards would pass.
+* Constructing one requires write access, and a caller with write access
+* already has `bash` and could exfiltrate directly — so this stops the
+* realistic case (a model pointing at a credential file by mistake or via
+* prompt injection), not a determined adversary. Confinement and the denylist
+* are the primary controls; this is defence in depth.
+*/
+/**
+* Pre-encode size ceiling. Every vision-capable model in the live catalog
+* publishes `max_prompt_image_size: 3145728`, so anything larger cannot be sent
+* to any of them. Checking BEFORE `readFile` means an oversized file is never
+* loaded into memory, let alone base64-expanded by a third.
+*
+* The per-model check still runs later at the transport boundary
+* (`assertOutboundImagesOk`); this is the cheap guard, not the authority.
+*/
+const MAX_ATTACHMENT_BYTES = 3145728;
+const MAX_TOTAL_ATTACHMENT_BYTES = 12582912;
+/**
+* Open flags. `O_NOFOLLOW` is POSIX-only and simply absent on Windows, where
+* `fsConstants.O_NOFOLLOW` is `undefined` — OR-ing that in would produce `NaN`
+* and break every open, so it is added only when the platform defines it.
+*/
+const READ_FLAGS = typeof constants.O_NOFOLLOW === "number" ? constants.O_RDONLY | constants.O_NOFOLLOW : constants.O_RDONLY;
+/**
+* Resolve, validate, and base64-encode each path.
+*
+* Fails on the FIRST bad path rather than silently skipping it: a caller that
+* attached four screenshots and got three has been quietly misled about what the
+* reviewer actually saw.
+*
+* Error strings reach a model, so they say what was wrong and what to do, and
+* never echo the resolved absolute path (the confinement helper deliberately
+* keeps its own messages path-free for the same reason).
+*/
+async function loadPeerImages(paths, workspace) {
+	if (paths.length > 10) return {
+		ok: false,
+		error: `imagePaths: ${paths.length} paths exceeds the 10-image ceiling (the most any Copilot model accepts). Send fewer.`
+	};
+	let workspaceAbs;
+	try {
+		workspaceAbs = realpathSync.native(workspace);
+	} catch {
+		workspaceAbs = workspace;
+	}
+	const images = [];
+	let totalBytes = 0;
+	for (const [index, raw] of paths.entries()) {
+		const position = `imagePaths[${index}]`;
+		if (typeof raw !== "string" || raw.length === 0) return {
+			ok: false,
+			error: `${position}: must be a non-empty string.`
+		};
+		const confined = confineToWorkspaceResult(raw, workspaceAbs);
+		if (!confined.ok) return {
+			ok: false,
+			error: `${position}: ${confined.error}`
+		};
+		if (isSensitivePath(confined.abs, workspaceAbs)) return {
+			ok: false,
+			error: `${position}: rejected: sensitive path`
+		};
+		let handle;
+		let buf;
+		try {
+			handle = await open(confined.abs, READ_FLAGS);
+			const info = await handle.stat();
+			if (!info.isFile()) return {
+				ok: false,
+				error: `${position}: rejected: not a regular file`
+			};
+			if (info.size > 3145728) return {
+				ok: false,
+				error: `${position}: ${info.size} bytes exceeds the ${MAX_ATTACHMENT_BYTES}-byte limit every vision model publishes. Re-capture at a smaller scale or lower quality.`
+			};
+			totalBytes += info.size;
+			if (totalBytes > 12582912) return {
+				ok: false,
+				error: `${position}: the attachments total more than ${MAX_TOTAL_ATTACHMENT_BYTES} bytes. Send fewer or smaller images.`
+			};
+			const capacity = Math.min(info.size, MAX_ATTACHMENT_BYTES);
+			const scratch = Buffer.alloc(Math.min(capacity + 1, 3145729));
+			let filled = 0;
+			for (;;) {
+				const { bytesRead } = await handle.read(scratch, filled, scratch.length - filled, filled);
+				if (bytesRead === 0) break;
+				filled += bytesRead;
+				if (filled >= scratch.length) break;
+			}
+			if (filled > capacity) return {
+				ok: false,
+				error: `${position}: the file grew while it was being read. Retry once it has stopped changing.`
+			};
+			buf = scratch.subarray(0, filled);
+		} catch {
+			return {
+				ok: false,
+				error: `${position}: file not found or unreadable`
+			};
+		} finally {
+			await handle?.close().catch(() => {});
+		}
+		const mimeType = detectImageMimeType(buf);
+		if (!mimeType) return {
+			ok: false,
+			error: `${position}: not a supported image. Content is identified by its bytes, not its extension. Supported: ${[...SUPPORTED_IMAGE_MIME_TYPES].join(", ")}.`
+		};
+		images.push({
+			data: buf.toString("base64"),
+			mimeType
+		});
+	}
+	return {
+		ok: true,
+		images
+	};
 }
 //#endregion
 //#region src/lib/tokenizer.ts
@@ -25860,9 +26596,15 @@ const getTokenCount = async (payload, model) => {
 * - anthropic-version (VS Code's Anthropic SDK sends this)
 * - X-Interaction-Id (VS Code sends a session-scoped UUID)
 *
-* We intentionally omit copilot-vision-request — VS Code only sends it when
+* We intentionally omit copilot-vision-request. VS Code only sends it when
 * images are present, and the native /v1/messages endpoint handles vision
-* without requiring the header.
+* without it — VERIFIED live (2026-08-03) rather than assumed: the same
+* base64 image sent to claude-opus-5 with the header omitted and with it set
+* both returned 200 AND the model named the image's colour in each case, so
+* the pixels genuinely reach it either way. Probe `passthrough_image_claude`
+* in scripts/probe-copilot-compat.sh keeps that verified; if Copilot ever
+* starts gating vision on the header, that probe fails rather than images
+* silently degrading on the lead model's own path.
 *
 * extraHeaders allows callers to forward client-supplied beta headers
 * (anthropic-beta) so Copilot enables extended features.
@@ -26479,6 +27221,11 @@ function toolEntries(scope) {
 					type: "string",
 					description: "Optional additional context (extra file content, prior decisions). Concatenated to the brief before sending."
 				},
+				imagePaths: {
+					type: "array",
+					items: { type: "string" },
+					description: "Optional paths to image files (screenshots, diagrams, charts) INSIDE the workspace for the persona to LOOK AT. The proxy reads and encodes them, so no image data passes through your context. Content is identified by bytes, not extension; jpeg/png/webp/gif/heic/heif, 3 MiB each. Note paths are confined to the proxy's working directory. Note the per-model ceiling: the gemini-backed personas accept 10 images, the gpt- and opus-backed ones accept 1."
+				},
 				effort: {
 					type: "string",
 					enum: [...p.allowedEfforts],
@@ -26738,7 +27485,10 @@ async function dispatchModelCall(args) {
 				content: [{
 					type: "input_text",
 					text: args.userText
-				}]
+				}, ...(args.images ?? []).map((img) => ({
+					type: "input_image",
+					image_url: `data:${img.mimeType};base64,${img.data}`
+				}))]
 			}],
 			stream: false,
 			reasoning: { effort: args.effort }
@@ -26756,7 +27506,20 @@ async function dispatchModelCall(args) {
 			system: args.instructions,
 			thinking: { type: "adaptive" },
 			output_config: { effort: args.effort },
-			messages: [{
+			messages: [args.images && args.images.length > 0 ? {
+				role: "user",
+				content: [{
+					type: "text",
+					text: args.userText
+				}, ...args.images.map((img) => ({
+					type: "image",
+					source: {
+						type: "base64",
+						media_type: img.mimeType,
+						data: img.data
+					}
+				}))]
+			} : {
 				role: "user",
 				content: args.userText
 			}]
@@ -26771,7 +27534,16 @@ async function dispatchModelCall(args) {
 		messages: [{
 			role: "system",
 			content: args.instructions
-		}, {
+		}, args.images && args.images.length > 0 ? {
+			role: "user",
+			content: [{
+				type: "text",
+				text: args.userText
+			}, ...args.images.map((img) => ({
+				type: "image_url",
+				image_url: { url: `data:${img.mimeType};base64,${img.data}` }
+			}))]
+		} : {
 			role: "user",
 			content: args.userText
 		}],
@@ -26783,7 +27555,7 @@ async function dispatchModelCall(args) {
 		label: resolvedModel
 	}));
 }
-async function callPersona(persona, prompt, context, effort, signal) {
+async function callPersona(persona, prompt, context, effort, signal, images) {
 	const userText = buildUserText(prompt, context);
 	const text = await dispatchModelCall({
 		model: persona.model,
@@ -26791,6 +27563,7 @@ async function callPersona(persona, prompt, context, effort, signal) {
 		instructions: persona.baseInstructions,
 		userText,
 		effort,
+		images,
 		signal
 	});
 	if (!text) return toolError(`persona ${persona.agentName}: empty assistant output`);
@@ -26839,6 +27612,7 @@ async function handleToolsCall(body, scope, sessionWorkspace) {
 	let personaPrompt;
 	let personaContext;
 	let personaEffort;
+	let personaImages;
 	if (persona) {
 		if (args.effort !== void 0 && !isEffort(args.effort)) return rpcError(body.id, RPC_INVALID_PARAMS, `tools/call: arguments.effort must be one of ${EFFORT_LEVELS.join("|")}; got ${JSON.stringify(args.effort)}`);
 		const requestedEffort = args.effort;
@@ -26846,6 +27620,12 @@ async function handleToolsCall(body, scope, sessionWorkspace) {
 		if (!prompt) return rpcError(body.id, RPC_INVALID_PARAMS, `tools/call: arguments.prompt is required`);
 		personaPrompt = prompt;
 		personaContext = typeof args.context === "string" ? args.context : void 0;
+		if (args.imagePaths !== void 0) {
+			if (!Array.isArray(args.imagePaths) || args.imagePaths.some((v) => typeof v !== "string")) return rpcError(body.id, RPC_INVALID_PARAMS, "tools/call: arguments.imagePaths must be an array of strings");
+			const loaded = await loadPeerImages(args.imagePaths, process.cwd());
+			if (!loaded.ok) return rpcError(body.id, RPC_INVALID_PARAMS, `tools/call: ${loaded.error}`);
+			personaImages = loaded.images;
+		}
 		if (requestedEffort !== void 0 && !persona.allowedEfforts.includes(requestedEffort)) return rpcError(body.id, RPC_INVALID_PARAMS, `tools/call: persona "${persona.toolNameHttp}" does not accept effort="${requestedEffort}". Allowed: ${persona.allowedEfforts.join("|")}.`);
 		personaEffort = requestedEffort ?? persona.defaultEffort;
 	}
@@ -26881,7 +27661,7 @@ async function handleToolsCall(body, scope, sessionWorkspace) {
 	const telemetryModel = persona ? persona.model : "(non-persona)";
 	try {
 		if (nonPersonaTool) applySessionWorkspace(args, sessionWorkspace, nonPersonaTool);
-		const result = persona ? await callPersona(persona, personaPrompt, personaContext, personaEffort, aborter?.signal) : await nonPersonaTool.handler(args, aborter?.signal);
+		const result = persona ? await callPersona(persona, personaPrompt, personaContext, personaEffort, aborter?.signal, personaImages) : await nonPersonaTool.handler(args, aborter?.signal);
 		logTelemetry({
 			name: telemetryName,
 			model: telemetryModel,
@@ -29166,18 +29946,49 @@ const READ_PARAMS = Type$1.Object({
 		description: "Max lines to return."
 	}))
 });
+/**
+* A file is an image if its BYTES say so. Extensions are a caller assertion and
+* are not consulted: a `.png` holding HTML must not be shipped as an image, and
+* a screenshot saved without a suffix should still work.
+*/
+function imageResult(data, mimeType) {
+	return {
+		content: [{
+			type: "text",
+			text: `[${mimeType} image, ${data.length} base64 chars]`
+		}, {
+			type: "image",
+			data,
+			mimeType
+		}],
+		details: {}
+	};
+}
+/**
+* Non-image binary detection. A NUL byte in the first few KiB is the classic
+* heuristic (it is what `grep`, `git`, and `file` all effectively use) and it is
+* enough here: the goal is not to classify the file, only to avoid handing the
+* model a wall of U+FFFD replacement characters and calling it text.
+*/
+function looksBinary(buf) {
+	return buf.subarray(0, Math.min(buf.length, 8192)).includes(0);
+}
 function readTool(workspace) {
 	return {
 		name: "read",
 		label: "Read file",
-		description: "Read a file from the worker's workspace. Returns UTF-8 text. Files larger than 10 MiB are refused; use offset/limit to page.",
+		description: "Read a file from the worker's workspace. Returns UTF-8 text, or the image itself for a jpeg/png/webp/gif/heic/heif file (detected by content, not extension) so you can actually SEE it. Other binary files are refused rather than returned as mojibake. Files larger than 10 MiB are refused; use offset/limit to page.",
 		parameters: READ_PARAMS,
 		async execute(_toolCallId, params, signal) {
 			const abs = resolvePathOrThrow(params.path, workspace);
 			const st = await stat(abs);
 			if (!st.isFile()) throw new Error("rejected: not a regular file");
 			if (st.size > READ_MAX_BYTES) throw new Error(`rejected: file >${READ_MAX_BYTES} bytes (10 MiB) — got ${st.size}`);
-			const text = (await readFile(abs, { signal })).toString("utf8");
+			const buf = await readFile(abs, { signal });
+			const imageMime = detectImageMimeType(buf);
+			if (imageMime) return imageResult(buf.toString("base64"), imageMime);
+			if (looksBinary(buf)) throw new Error(`rejected: binary file (${st.size} bytes), not a supported image. Supported image types are jpeg, png, webp, gif, heic, heif. Use \`bash\` with a suitable CLI to inspect or convert it.`);
+			const text = buf.toString("utf8");
 			if (params.offset === void 0 && params.limit === void 0) return textResult(text);
 			const lines = text.split(/\r?\n/);
 			const start = params.offset ?? 0;
@@ -30775,6 +31586,36 @@ function extractAssistantText(content) {
 	for (const part of content) if (part.type === "text") out += part.text;
 	return out;
 }
+/**
+* Banner that prefixes text salvaged from an EARLIER assistant turn when the
+* run ends without a usable final answer.
+*
+* It is deliberately loud. Recovered text is partial work — the model was
+* mid-investigation when it went quiet — and returning it bare would let the
+* caller read an interim note as a conclusion. That is a different bug from
+* the one this recovery fixes, and a worse one: silently wrong beats loudly
+* missing only for the model that produced it.
+*/
+const RECOVERED_TEXT_BANNER = "[recovered from an earlier turn — this run ended without a final answer, so the text below is partial work in progress, NOT a conclusion. Treat it as leads to verify, not as the worker's answer.]";
+/**
+* Compose the recovered-text block for a run that is ending with nothing
+* usable in its final turn.
+*
+* Returns `""` in the two cases where recovery would be noise: the run DID
+* produce live text (nothing was lost), or no turn ever produced any.
+*
+* Scope note: `highWater` is the LAST non-empty assistant text, not a
+* concatenation of every non-empty turn. Accumulating them would turn a
+* recovered result into a transcript dump — mostly interim narration — where
+* the last turn is both the most complete and the one the model was building
+* toward when it stalled.
+*/
+function recoveredBlock(liveText, highWater) {
+	if (liveText.trim()) return "";
+	const recovered = highWater.trim();
+	if (!recovered) return "";
+	return `${RECOVERED_TEXT_BANNER}\n\n${recovered}`;
+}
 const MAX_EMPTY_OUTPUT_NUDGES = 3;
 const EMPTY_OUTPUT_NUDGES = [
 	"Summarize your findings so far.",
@@ -30951,6 +31792,7 @@ async function runWorkerAgentOnce(opts) {
 		const abortHandler = () => agent.abort();
 		if (opts.signal) opts.signal.addEventListener("abort", abortHandler, { once: true });
 		let finalText = "";
+		let lastNonEmptyText = "";
 		let lastStopReason = null;
 		let nudgeCount = 0;
 		const maxEmptyOutputNudges = resolveMaxEmptyOutputNudges();
@@ -30977,6 +31819,7 @@ async function runWorkerAgentOnce(opts) {
 			const content = msg.content;
 			if (!Array.isArray(content)) return;
 			finalText = extractAssistantText(content);
+			if (finalText.trim()) lastNonEmptyText = finalText;
 			const sr = msg.stopReason;
 			if (typeof sr === "string") lastStopReason = sr;
 		});
@@ -30999,30 +31842,41 @@ async function runWorkerAgentOnce(opts) {
 			try {
 				await ws.remove();
 			} catch {}
-			const text = isBrowse ? terminalText ?? finalText : diff ? `${finalText}\n\n${diff}` : finalText;
+			const liveAnswer = isBrowse ? terminalText ?? finalText : finalText;
+			const recovered = recoveredBlock(liveAnswer, lastNonEmptyText);
+			const text = isBrowse ? liveAnswer : diff ? `${finalText}\n\n${diff}` : finalText;
 			if (lastStopReason === "error" || lastStopReason === "aborted") {
-				const diag = (terminalText ?? finalText).trim();
+				const diag = liveAnswer.trim();
 				let diagnostic;
 				if (lastStopReason === "aborted") diagnostic = wallClockExpired ? "[halted: wallclock]" : "[halted: cancelled]";
 				else diagnostic = diag || "Worker run failed before producing an answer — the model's input likely overflowed (a large tool result), or the upstream errored. Retry with a narrower task: target a specific section / file / element rather than reading everything at once.";
 				return {
 					text: lastStopReason === "aborted" ? [
 						diag,
+						recovered,
 						diff,
 						diagnostic
-					].filter(Boolean).join("\n\n") : [diagnostic, diff].filter(Boolean).join("\n\n"),
+					].filter(Boolean).join("\n\n") : [
+						diagnostic,
+						recovered,
+						diff
+					].filter(Boolean).join("\n\n"),
 					isError: true
 				};
 			}
 			if (budget.hardStopReason) return {
-				text: [text, `[halted: ${budget.hardStopReason}]`].filter(Boolean).join("\n\n"),
+				text: [
+					text,
+					recovered,
+					`[halted: ${budget.hardStopReason}]`
+				].filter(Boolean).join("\n\n"),
 				isError: true
 			};
 			if (!text.trim()) return {
-				text: `${NO_OUTPUT_PREFIX} after ${nudgeCount} nudges (stopReason=${lastStopReason ?? "unknown"}, turns=${budget.turns}, elapsed=${budget.elapsedMs}ms)]; retry with a different model via worker_defaults, or narrow/split the task.`,
+				text: [`${NO_OUTPUT_PREFIX} after ${nudgeCount} nudges (stopReason=${lastStopReason ?? "unknown"}, turns=${budget.turns}, elapsed=${budget.elapsedMs}ms)]; retry with a different model via worker_defaults, or narrow/split the task.`, recovered].filter(Boolean).join("\n\n"),
 				isError: true
 			};
-			return { text };
+			return { text: [text, recovered].filter(Boolean).join("\n\n") };
 		} catch (err) {
 			let diff = "";
 			try {
@@ -31035,7 +31889,12 @@ async function runWorkerAgentOnce(opts) {
 			} catch {}
 			const haltOrErr = err instanceof Error ? err.message : String(err);
 			const parts = [];
-			if (finalText) parts.push(finalText);
+			const liveAnswer = isBrowse ? terminalText ?? finalText : finalText;
+			if (liveAnswer.trim()) parts.push(liveAnswer);
+			else {
+				const recovered = recoveredBlock(liveAnswer, lastNonEmptyText);
+				if (recovered) parts.push(recovered);
+			}
 			if (diff) parts.push(diff);
 			parts.push(haltOrErr);
 			return {
@@ -35064,4 +35923,4 @@ function enumerateInjectedMcpToolNames(groupKeys, opts = {}) {
 //#endregion
 export { searchWeb as $, DEFAULT_CLAUDE_MODEL_FALLBACKS as $t, trustRepo as A, state as An, getTokenCount as At, TEST_DEFAULT_MODEL as B, hasSupportedBrowserInstalled as Bt, fileLastPromptStore as C, fetchWithTransientRetry as Cn, scoutModel as Ct, repoRoot as D, copilotBaseUrl as Dn, shimDefaultsToXhigh as Dt, repoFingerprint as E, GITHUB_API_BASE_URL as En, workerToolsEnabled as Et, EXPLORE_DEFAULT_MODEL as F, createChatCompletions as Ft, buildEnv as G, CONDENSED_OPERATING_SEQUENCE as Gt, resolveModeDefaults as H, extractTarGzMember as Ht, EXPLORE_DEFAULT_THINKING as I, MAX_RESPONSE_BODY_BYTES as It, toolbeltEnabled as J, ArtifactClient as Jt, availableToolCommands as K, DEFINITION_OF_GREATNESS as Kt, IMPLEMENT_DEFAULT_MODEL as L, readResponseBodyCapped as Lt, resolveSealedGate as M, resolveMcpToolTimeoutMs as Mt, BROWSE_DEFAULT_MODEL as N, pickEndpoint as Nt, stopGateEnabledForRepo as O, copilotHeaders as On, countTokens as Ot, DEFAULT_MODEL as P, createResponses as Pt, assetFor as Q, toolbeltPathOverride as Qt, PLAN_DEFAULT_MODEL as R, parseJsonOrDiagnose as Rt, fileFindingsStore as S, getGitHubUser as Sn, reviewerModel as St, isSubagentContext as T, forwardError as Tn, standInToolEnabled as Tt, resolveWorkerRunOpts as U, extractZipMember as Ut, appendPlanReminder as V, provisionAndIndexColbert as Vt, runWorkerAgent as W, warmTreeSitterPool as Wt, vscodeRipgrepPath as X, buildWorkspaceHeaderJson as Xt, toolbeltSkipSet as Y, buildWorkspaceHeaderHelperCommand as Yt, TOOLBELT_TOOLS$1 as Z, collapsePathKeys as Zt, stopGateDisabled as _, isNullish as _n, browserCompoundToolsEnabled as _t, buildPeerAwarenessSnippet as a, generateRandomPort as an, buildAnthropicErrorEvent as at, stopReviewEnabled as b, sleep$3 as bn, geminiAvailable as bt, personasFor as c, withInstallLock as cn, logStreamError as ct, buildStopHookCommand as d, setupGitHubToken as dn, handleMcpDelete as dt, DEFAULT_CODEX_MODEL as en, ADVISOR_INTERNAL_TOOL_NAME as et, captureLaunchBaseline as f, tryRefreshAndRetry as fn, handleMcpPost as ft, launchBaselineKey as g, filterBetaHeader as gn, browseAgentEnabled as gt, injectStopHookIntoSettingsFile as h, cacheVSCodeVersion as hn, brainstormModel as ht, buildAgentPrompt as i, UPSTREAM_INACTIVITY_TIMEOUT_MS as in, isAdvisorRequested as it, liveExec as j, assembleResponsesPayload as jt, stopReviewStateDir as k, githubHeaders as kn, createMessages as kt, buildArtifactOpenHookCommand as l, setupCopilotToken as ln, readIteratorWithTimeout as lt, fileBlockBudget as m, cacheModels as mn, artifactToolsEnabled as mt, MCP_GROUPS as n, DEFAULT_PORT as nn, buildAdvisorStream as nt, buildPeerAwarenessSummary as o, pickClaudeDefault as on, buildOpenAIErrorEvent as ot, decideStopHook as p, cacheCopilotVersion as pn, agentToolsEnabled as pt, buildToolbeltAwareness as q, shouldUseInsecureTls as qt, assertMcpToolSurfaceConsistent as r, UPSTREAM_FETCH_TIMEOUT_MS as rn, injectAdvisorTool as rt, enumerateInjectedMcpToolNames as s, getPackageVersion as sn, isControllerClosedError as st, GROUP_META as t, DEFAULT_CODEX_MODEL_FALLBACKS as tn, ADVISOR_TOOL_INSTRUCTIONS as tt, buildSessionBindHookCommand as u, setupGitHubAgentToken as un, relayAnthropicStream as ut, stopGateId as v, resolveCodexModel as vn, browserToolsEnabled as vt, fileReviewDebounce as w, HTTPError as wn, scribeModel as wt, fileBaselineStore as x, getModels as xn, nativeSubagentModel as xt, stopGatePlanMode as y, resolveModel as yn, fleetToolsEnabled as yt, REVIEW_DEFAULT_MODEL as z, provisionBrowserAssets as zt };
 
-//# sourceMappingURL=peer-mcp-personas-HWhxZUvf.js.map
+//# sourceMappingURL=peer-mcp-personas-BvommiSI.js.map