github-router 0.3.249 → 0.3.255

package/dist/{peer-mcp-personas-DJzLpfDJ.js → peer-mcp-personas-BDet588n.js}

@@ -1,19 +1,26 @@
-import { t as PATHS } from "./paths-BjTMI_xK.js";
-import { d as resolveExecutable, f as runCommandCapture, l as parseBoolEnv, m as runManagedExeCapture, n as isPidAlive, o as trackChild, r as registerColbertExitHandlers, t as getColbertInstanceUuid, u as parseIntEnv } from "./lifecycle-DHZsVN8j.js";
-import { i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-CUf1UDrH.js";
+import { t as getPackageVersion } from "./version-_Q1WpsQp.js";
+import { t as PATHS } from "./paths-C1cLZ7Ga.js";
+import { C as copilotHeaders, E as githubAgentHeaders, O as state, S as copilotBaseUrl, T as githubAgentGraphQLHeaders, _ as withTransientRetry, b as GITHUB_API_BASE_URL, d as resolveModel, f as sleep$2, g as fetchWithTransientRetry, h as isAllowedCopilotHost, i as tryRefreshAndRetry, v as HTTPError, w as copilotVersion, x as GITHUB_GRAPHQL_URL } from "./token-R2ocFC3M.js";
+import { a as resolveExecutable, c as runManagedExeCapture, i as parseIntEnv, r as parseBoolEnv } from "./exec-DTO2oin0.js";
+import { i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-DD88ka3f.js";
+import { t as MCP_WORKSPACE_HEADER } from "./mcp-workspace-header-CGJbNeHb.js";
+import { n as ArtifactError, r as applyInsecureTls, t as ArtifactClient } from "./client-CQMfroGV.js";
+import { n as isPidAlive, o as trackChild, r as registerColbertExitHandlers, t as getColbertInstanceUuid } from "./lifecycle-Byw5s1G8.js";
+import { h as runGateChecks, m as sealedGateIds, p as resolveSealedGate } from "./stop-gate-hook-DQc2KV7B.js";
+import { t as liveExec } from "./orchestration-hRU4TdWr.js";
 import { createRequire } from "node:module";
 import consola from "consola";
-import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import fs, { chmod, mkdir, open, readFile, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
-import * as os$1 from "node:os";
-import os, { homedir, platform, tmpdir } from "node:os";
+import { chmodSync, closeSync, constants, cpSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import * as path$1 from "node:path";
 import path, { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import fs$1, { chmod, mkdir, open, readFile, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
+import * as os$1 from "node:os";
+import os, { homedir, platform } from "node:os";
 import process$1 from "node:process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
-import { chmodSync, closeSync, cpSync, existsSync, mkdirSync, openSync, promises, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { Agent, ProxyAgent } from "undici";
+import { ProxyAgent } from "undici";
 import { z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { performance } from "node:perf_hooks";
@@ -33,914 +40,6 @@ import "diff";
 //#region \0rolldown/runtime.js
 var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
-//#region src/lib/state.ts
-const state = {
-	accountType: "enterprise",
-	manualApprove: false,
-	rateLimitWait: false,
-	showToken: false,
-	extendedBetas: false,
-	browseEnabled: false,
-	fleetEnabled: false,
-	agentsEnabled: false,
-	powerBrowseEnabled: false,
-	humanlikeForce: "auto",
-	sessionId: randomUUID(),
-	machineId: randomBytes(32).toString("hex")
-};
-//#endregion
-//#region src/lib/api-config.ts
-const standardHeaders = () => ({
-	"content-type": "application/json",
-	accept: "application/json"
-});
-const DEFAULT_COPILOT_VERSION = "0.43.2026033101";
-function copilotVersion(state) {
-	return state.copilotVersion ?? DEFAULT_COPILOT_VERSION;
-}
-const API_VERSION = "2026-01-09";
-const copilotBaseUrl = (state) => state.copilotApiUrl ?? "https://api.githubcopilot.com";
-const copilotHeaders = (state, vision = false, integrationId = "vscode-chat") => {
-	const version = copilotVersion(state);
-	const headers = {
-		Authorization: `Bearer ${state.copilotToken}`,
-		"content-type": standardHeaders()["content-type"],
-		"copilot-integration-id": integrationId,
-		"editor-version": `vscode/${state.vsCodeVersion}`,
-		"editor-plugin-version": `copilot-chat/${version}`,
-		"user-agent": `GitHubCopilotChat/${version}`,
-		"openai-intent": "conversation-panel",
-		"x-interaction-type": "conversation-panel",
-		"x-github-api-version": API_VERSION,
-		"x-request-id": randomUUID(),
-		"x-vscode-user-agent-library-version": "electron-fetch",
-		"VScode-SessionId": state.sessionId,
-		"VScode-MachineId": state.machineId
-	};
-	if (vision) headers["copilot-vision-request"] = "true";
-	return headers;
-};
-const GITHUB_API_BASE_URL = process.env.GITHUB_API_URL ?? "https://api.github.com";
-const githubHeaders = (state) => ({
-	...standardHeaders(),
-	authorization: `token ${state.githubToken}`,
-	"editor-version": `vscode/${state.vsCodeVersion}`,
-	"editor-plugin-version": `copilot-chat/${copilotVersion(state)}`,
-	"user-agent": `GitHubCopilotChat/${copilotVersion(state)}`,
-	"x-github-api-version": API_VERSION,
-	"x-vscode-user-agent-library-version": "electron-fetch"
-});
-const GITHUB_BASE_URL = "https://github.com";
-const GITHUB_CLIENT_ID = "Iv1.b507a08c87ecfe98";
-const GITHUB_APP_SCOPES = ["read:user"].join(" ");
-const GITHUB_AGENT_CLIENT_ID = "178c6fc778ccc68e1d6a";
-const GITHUB_AGENT_SCOPES = [
-	"repo",
-	"workflow",
-	"read:org"
-].join(" ");
-const GITHUB_GRAPHQL_URL = process.env.GITHUB_GRAPHQL_URL ?? "https://api.github.com/graphql";
-const GITHUB_REST_API_VERSION = "2022-11-28";
-const githubAgentHeaders = (state) => ({
-	...standardHeaders(),
-	authorization: `token ${state.githubAgentToken}`,
-	"x-github-api-version": GITHUB_REST_API_VERSION,
-	"user-agent": "github-router-first-mate"
-});
-const githubAgentGraphQLHeaders = (state, features) => ({
-	...githubAgentHeaders(state),
-	...features ? { "GraphQL-Features": features } : {}
-});
-//#endregion
-//#region src/lib/error.ts
-var HTTPError = class extends Error {
-	response;
-	constructor(message, response) {
-		super(message);
-		this.response = response;
-	}
-};
-async function forwardError(c, error) {
-	consola.error(`Error occurred at ${c.req.path}:`, error);
-	if (error instanceof HTTPError) {
-		const errorText = await error.response.text().catch(() => "");
-		let errorJson;
-		try {
-			errorJson = JSON.parse(errorText);
-		} catch {
-			errorJson = void 0;
-		}
-		if (isContextOverflow(error.response.status, errorJson, errorText)) {
-			const upstream = resolveErrorMessage(errorJson, errorText);
-			consola.error("HTTP error (mapped to overflow):", errorJson ?? errorText);
-			return c.json({
-				type: "error",
-				error: {
-					type: "invalid_request_error",
-					message: `prompt is too long: ${upstream}`
-				}
-			}, 400);
-		}
-		const responseStatus = error.response.status === 401 ? 503 : error.response.status;
-		if (isAnthropicError(errorJson)) {
-			consola.error("HTTP error:", errorJson);
-			return c.json(errorJson, responseStatus);
-		}
-		const message = resolveErrorMessage(errorJson, errorText);
-		consola.error("HTTP error:", errorJson ?? errorText);
-		return c.json({
-			type: "error",
-			error: {
-				type: resolveErrorType(responseStatus),
-				message
-			}
-		}, responseStatus);
-	}
-	return c.json({
-		type: "error",
-		error: {
-			type: "api_error",
-			message: error instanceof Error ? error.message : String(error)
-		}
-	}, 500);
-}
-function resolveErrorMessage(errorJson, fallback) {
-	if (typeof errorJson !== "object" || errorJson === null) return fallback;
-	const errorRecord = errorJson;
-	if (errorRecord.message !== void 0) return String(errorRecord.message);
-	if (typeof errorRecord.error === "object" && errorRecord.error !== null) {
-		const nestedRecord = errorRecord.error;
-		if (nestedRecord.message !== void 0) return String(nestedRecord.message);
-	}
-	return fallback;
-}
-/**
-* Check if a parsed JSON body is already in Anthropic error format:
-* { type: "error", error: { type: "...", message: "..." } }
-*/
-function isAnthropicError(json) {
-	if (typeof json !== "object" || json === null) return false;
-	const record = json;
-	if (record.type !== "error") return false;
-	if (typeof record.error !== "object" || record.error === null) return false;
-	const inner = record.error;
-	return typeof inner.type === "string" && typeof inner.message === "string";
-}
-const CONTEXT_OVERFLOW_SUBSTRINGS = [
-	"prompt is too long",
-	"context_length_exceeded",
-	"context length exceeded",
-	"input is too long",
-	"maximum context length",
-	"too many tokens"
-];
-/**
-* Detect upstream context-overflow errors so we can remap them to a 400
-* "prompt is too long" shape that triggers Claude Code self-compaction.
-*
-* Always remaps 413 (treated as a hard payload-size signal regardless of
-* body wording). Remaps 400 only when the error text contains one of the
-* known overflow substrings — a regular 400 (e.g. "model not found") must
-* NOT remap.
-*/
-function isContextOverflow(status, errorJson, errorText) {
-	if (status === 413) return true;
-	if (status !== 400) return false;
-	const haystack = (errorText + " " + (typeof errorJson === "object" && errorJson !== null ? JSON.stringify(errorJson) : "")).toLowerCase();
-	return CONTEXT_OVERFLOW_SUBSTRINGS.some((s) => haystack.includes(s));
-}
-/**
-* Map HTTP status to Anthropic error type.
-*
-* Note: a 401 from upstream is remapped to 503 in `forwardError` BEFORE
-* this function is called (no-401 invariant — see comment there). The
-* 401 → "authentication_error" mapping below is preserved for
-* defensive coverage in case any code path calls `resolveErrorType`
-* directly with an unsanitized status.
-*/
-function resolveErrorType(status) {
-	if (status === 400) return "invalid_request_error";
-	if (status === 401) return "authentication_error";
-	if (status === 403) return "permission_error";
-	if (status === 404) return "not_found_error";
-	if (status === 429) return "rate_limit_error";
-	if (status === 503) return "overloaded_error";
-	if (status === 529) return "overloaded_error";
-	return "api_error";
-}
-//#endregion
-//#region src/lib/upstream-retry.ts
-/**
-* Shared transient-failure retry for upstream calls (`src/lib/upstream-retry.ts`).
-*
-* Retries ONLY on transient conditions — never on success, never on a
-* deterministic 4xx (400/401/403/404…), so a malformed request or auth
-* failure fails fast instead of being hammered. 401 is intentionally NOT
-* retried here: it stays with the existing token-refresh path so the
-* 401→503 forwardError invariant is preserved.
-*
-* Retryable:
-*   - HTTP 429 + 5xx (500/502/503/504) — the "upstream is sick" class.
-*   - network errors (ECONNRESET / "fetch failed" / "terminated" / EPIPE …).
-*   - upstream TIMEOUT aborts: an AbortError thrown while the CALLER'S
-*     `signal` is NOT aborted (a user cancel aborts the caller's signal
-*     and is rethrown immediately, never retried).
-*
-* Exponential backoff + FULL jitter, capped, honoring `Retry-After`. The
-* inter-attempt sleep is abortable so a user cancel during backoff
-* returns promptly. Bounded `attempts` keep a single call from holding an
-* inflight slot indefinitely (robust AND fast).
-*
-* Streaming note: the user-facing passthrough and the worker loop must
-* only retry in the PRE-FIRST-BYTE window — a retry after bytes have
-* streamed would duplicate output. Callers there pass a `doFetch` that
-* has not yet handed its body to the consumer.
-*/
-const DEFAULT_RETRY_STATUSES = [
-	429,
-	500,
-	502,
-	503,
-	504
-];
-function parseRetryAfter(headerValue) {
-	if (!headerValue) return void 0;
-	const secs = Number(headerValue);
-	if (Number.isFinite(secs)) return Math.max(0, secs * 1e3);
-	const dateMs = Date.parse(headerValue);
-	if (Number.isFinite(dateMs)) return Math.max(0, dateMs - Date.now());
-}
-/**
-* A thrown fetch error that is worth retrying — network resets, broken
-* pipes, DNS hiccups, and timeout aborts. NOTE: the caller must already
-* have ruled out a user cancel (caller signal aborted) before calling
-* this, since a timeout abort and a user-cancel abort look identical.
-*/
-function isTransientNetworkError(err) {
-	const e = err;
-	if (!e) return false;
-	if (e.name === "AbortError" || e.name === "TimeoutError") return true;
-	const msg = (e.message ?? "").toLowerCase();
-	if (msg.includes("terminated") || msg.includes("fetch failed") || msg.includes("network") || msg.includes("socket") || msg.includes("econnreset") || msg.includes("etimedout") || msg.includes("econnrefused") || msg.includes("epipe") || msg.includes("enotfound")) return true;
-	const code = e.code ?? e.cause?.code;
-	return code !== void 0 && [
-		"ECONNRESET",
-		"ETIMEDOUT",
-		"ECONNREFUSED",
-		"EPIPE",
-		"ENOTFOUND"
-	].includes(code);
-}
-/** Sleep that resolves early (does not reject) when `signal` aborts — the
-*  retry loop re-checks `signal.aborted` at the top and throws there. */
-function abortableSleep(ms, signal) {
-	if (ms <= 0) return Promise.resolve();
-	return new Promise((resolve) => {
-		let settled = false;
-		const done = () => {
-			if (settled) return;
-			settled = true;
-			clearTimeout(timer);
-			signal?.removeEventListener("abort", done);
-			resolve();
-		};
-		const timer = setTimeout(done, ms);
-		if (signal) {
-			if (signal.aborted) {
-				done();
-				return;
-			}
-			signal.addEventListener("abort", done, { once: true });
-		}
-	});
-}
-/**
-* Run `doFetch` with bounded transient-failure retries. `doFetch` is a
-* thunk so each attempt issues a FRESH request (bodies can't be replayed
-* from a consumed stream). Returns the final `Response` — which may still
-* carry a retryable status if all attempts are exhausted (the caller
-* handles that as it would a single-shot failure).
-*/
-async function fetchWithTransientRetry(doFetch, opts = {}) {
-	const attempts = Math.max(1, opts.attempts ?? 3);
-	const retryStatuses = opts.retryStatuses ?? DEFAULT_RETRY_STATUSES;
-	const baseDelayMs = opts.baseDelayMs ?? 250;
-	const maxDelayMs = opts.maxDelayMs ?? 4e3;
-	const { signal, label } = opts;
-	for (let attempt = 1;; attempt++) {
-		if (signal?.aborted) throw new DOMException("This operation was aborted", "AbortError");
-		let res;
-		let caught;
-		try {
-			res = await doFetch(attempt);
-		} catch (err) {
-			caught = err;
-		}
-		if (res && !retryStatuses.includes(res.status)) return res;
-		if (caught !== void 0) {
-			if (signal?.aborted) throw caught;
-			if (!isTransientNetworkError(caught)) throw caught;
-		}
-		if (attempt >= attempts) {
-			if (res) return res;
-			throw caught;
-		}
-		const retryAfterMs = res ? parseRetryAfter(res.headers.get("retry-after")) : void 0;
-		if (res?.body) try {
-			await res.body.cancel();
-		} catch {}
-		const expCap = Math.min(maxDelayMs, baseDelayMs * 2 ** (attempt - 1));
-		const delay = Math.min(maxDelayMs, retryAfterMs ?? Math.round(Math.random() * expCap));
-		if (label) {
-			const why = res ? `HTTP ${res.status}` : caught?.name ?? "error";
-			consola.debug(`[upstream-retry] ${label}: attempt ${attempt}/${attempts} failed (${why}); retrying in ${delay}ms`);
-		}
-		await abortableSleep(delay, signal);
-	}
-}
-/** Extract an HTTP status from a thrown error (HTTPError carries
-*  `.response.status`; others may carry `.status`/`.statusCode`; last
-*  resort parses `"HTTP <code>"` from the message). */
-function errorStatus(err) {
-	const e = err;
-	for (const v of [
-		e?.status,
-		e?.statusCode,
-		e?.response?.status
-	]) if (typeof v === "number") return v;
-	const m = /\bHTTP (\d{3})\b/.exec(e?.message ?? "");
-	return m ? Number(m[1]) : void 0;
-}
-/**
-* Generic transient-retry for a non-`Response`-returning call (e.g. the
-* Copilot service clients, which throw `HTTPError` on non-OK and throw on
-* network errors). Retries `fn()` when it throws a transient error — an
-* `HTTPError`-like with a retryable status (429/5xx) OR a transient
-* network/timeout error — using the same backoff + abort semantics as
-* `fetchWithTransientRetry`. Never retries a deterministic 4xx (incl.
-* 401), a non-transient throw, or a user cancel.
-*/
-async function withTransientRetry(fn, opts = {}) {
-	const attempts = Math.max(1, opts.attempts ?? 3);
-	const retryStatuses = opts.retryStatuses ?? DEFAULT_RETRY_STATUSES;
-	const baseDelayMs = opts.baseDelayMs ?? 250;
-	const maxDelayMs = opts.maxDelayMs ?? 4e3;
-	const { signal, label } = opts;
-	for (let attempt = 1;; attempt++) {
-		if (signal?.aborted) throw new DOMException("This operation was aborted", "AbortError");
-		try {
-			return await fn(attempt);
-		} catch (err) {
-			if (signal?.aborted) throw err;
-			const status = errorStatus(err);
-			if (!(status !== void 0 && retryStatuses.includes(status) || isTransientNetworkError(err)) || attempt >= attempts) throw err;
-			const retryAfterMs = parseRetryAfter(err?.response?.headers?.get?.("retry-after") ?? null);
-			const expCap = Math.min(maxDelayMs, baseDelayMs * 2 ** (attempt - 1));
-			const delay = Math.min(maxDelayMs, retryAfterMs ?? Math.round(Math.random() * expCap));
-			if (label) consola.debug(`[upstream-retry] ${label}: attempt ${attempt}/${attempts} threw (${status !== void 0 ? `HTTP ${status}` : err?.name ?? "error"}); retrying in ${delay}ms`);
-			await abortableSleep(delay, signal);
-		}
-	}
-}
-//#endregion
-//#region src/services/github/get-copilot-token.ts
-/**
-* Allowlist of hosts the router will trust as the Copilot API base URL.
-* Anything else returned in `endpoints.api` (e.g. via a tampered or
-* misconfigured token-exchange response) is rejected — otherwise a
-* malicious value would receive the long-lived GitHub PAT we send to
-* `/mcp` for web search (see `src/services/copilot/web-search.ts`).
-*/
-const COPILOT_HOST_ALLOWLIST = [
-	"api.githubcopilot.com",
-	"api.individual.githubcopilot.com",
-	"api.business.githubcopilot.com",
-	"api.enterprise.githubcopilot.com"
-];
-/**
-* True iff `rawUrl` is an HTTPS URL whose host is a trusted Copilot API host.
-* Exported so every path that sends a long-lived token to a discovered
-* Copilot host (web search, first-mate CAPI session logs) shares one allowlist.
-*/
-function isAllowedCopilotHost(rawUrl) {
-	let parsed;
-	try {
-		parsed = new URL(rawUrl);
-	} catch {
-		return false;
-	}
-	if (parsed.protocol !== "https:") return false;
-	return COPILOT_HOST_ALLOWLIST.includes(parsed.hostname);
-}
-const getCopilotToken = async () => {
-	const response = await fetchWithTransientRetry(() => fetch(`${GITHUB_API_BASE_URL}/copilot_internal/v2/token`, { headers: githubHeaders(state) }), { label: "/copilot_internal/v2/token" });
-	if (!response.ok) throw new HTTPError("Failed to get Copilot token", response);
-	const data = await response.json();
-	if (data.endpoints?.api) if (isAllowedCopilotHost(data.endpoints.api)) state.copilotApiUrl = data.endpoints.api;
-	else consola.warn(`Refusing to honor Copilot API endpoint "${data.endpoints.api}" from the token-exchange response — not in allowlist (${COPILOT_HOST_ALLOWLIST.join(", ")}). ` + (state.copilotApiUrl ? `Keeping existing override "${state.copilotApiUrl}".` : `Falling back to the default api.githubcopilot.com.`));
-	return data;
-};
-//#endregion
-//#region src/services/github/get-device-code.ts
-const DEFAULT_DEVICE_APP = {
-	clientId: GITHUB_CLIENT_ID,
-	scope: GITHUB_APP_SCOPES
-};
-async function getDeviceCode(app = DEFAULT_DEVICE_APP) {
-	const response = await fetchWithTransientRetry(() => fetch(`${GITHUB_BASE_URL}/login/device/code`, {
-		method: "POST",
-		headers: standardHeaders(),
-		body: JSON.stringify({
-			client_id: app.clientId,
-			scope: app.scope
-		})
-	}), { label: "/login/device/code" });
-	if (!response.ok) throw new HTTPError("Failed to get device code", response);
-	return await response.json();
-}
-//#endregion
-//#region src/services/github/get-user.ts
-async function getGitHubUser() {
-	const response = await fetchWithTransientRetry(() => fetch(`${GITHUB_API_BASE_URL}/user`, { headers: {
-		authorization: `token ${state.githubToken}`,
-		...standardHeaders()
-	} }), { label: "/user" });
-	if (!response.ok) throw new HTTPError("Failed to get GitHub user", response);
-	return await response.json();
-}
-//#endregion
-//#region src/services/copilot/get-models.ts
-const getModels = async () => {
-	const response = await fetchWithTransientRetry(() => tryRefreshAndRetry(() => fetch(`${copilotBaseUrl(state)}/models`, { headers: copilotHeaders(state) }), "/models"), { label: "/models" });
-	if (!response.ok) throw new HTTPError("Failed to get models", response);
-	return await response.json();
-};
-//#endregion
-//#region src/services/get-copilot-version.ts
-const FALLBACK$1 = "0.43.2026033101";
-async function getCopilotChatVersion() {
-	const controller = new AbortController();
-	const timeout = setTimeout(() => {
-		controller.abort();
-	}, 5e3);
-	try {
-		const response = await fetch("https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery", {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				Accept: "application/json;api-version=7.1-preview.1"
-			},
-			body: JSON.stringify({
-				filters: [{ criteria: [{
-					filterType: 7,
-					value: "GitHub.copilot-chat"
-				}] }],
-				flags: 914
-			}),
-			signal: controller.signal
-		});
-		if (!response.ok) return FALLBACK$1;
-		return (await response.json())?.results?.[0]?.extensions?.[0]?.versions?.[0]?.version ?? FALLBACK$1;
-	} catch {
-		return FALLBACK$1;
-	} finally {
-		clearTimeout(timeout);
-	}
-}
-//#endregion
-//#region src/services/get-vscode-version.ts
-const FALLBACK = "1.104.3";
-async function getVSCodeVersion() {
-	const controller = new AbortController();
-	const timeout = setTimeout(() => {
-		controller.abort();
-	}, 5e3);
-	try {
-		const match = (await (await fetch("https://aur.archlinux.org/cgit/aur.git/plain/PKGBUILD?h=visual-studio-code-bin", { signal: controller.signal })).text()).match(/pkgver=([0-9.]+)/);
-		if (match) return match[1];
-		return FALLBACK;
-	} catch {
-		return FALLBACK;
-	} finally {
-		clearTimeout(timeout);
-	}
-}
-await getVSCodeVersion();
-//#endregion
-//#region src/lib/utils.ts
-const sleep$3 = (ms) => new Promise((resolve) => {
-	setTimeout(resolve, ms);
-});
-const isNullish = (value) => value === null || value === void 0;
-/**
-* Beta prefixes VS Code Copilot Chat v0.43 actually sends.
-* Default mode — makes proxy traffic indistinguishable from VS Code.
-*/
-const VSCODE_BETA_PREFIXES = [
-	"interleaved-thinking-",
-	"context-management-",
-	"advanced-tool-use-"
-];
-/**
-* Extended beta prefixes for Claude CLI compatibility.
-* Enabled via --extended-betas flag. Includes all betas confirmed
-* to work with the Copilot API.
-*
-* Notably absent (Copilot 400s on these — verified live):
-*   context-1m-, skills-, files-api-, code-execution-, output-128k-,
-*   advisor-tool- (see EXPLICITLY_STRIPPED_BETA_PREFIXES below).
-* 1M context is unlocked by selecting `claude-opus-4.7-1m-internal`
-* as the model id, not via a beta header.
-*
-* Empirical verification (2026-05-11 against api.enterprise.githubcopilot.com):
-*   task-budgets-2026-03-13          → 200 ACCEPTED (cost-ceiling leverage)
-*   token-efficient-tools-2026-03-28 → 200 ACCEPTED (per-tool token saving)
-*   summarize-connector-text-2026-03-13 → 200 (Anthropic-internal feature flag,
-*     won't fire for non-ant users; allowlisted defensively for ant edge case)
-*   afk-mode-2026-01-31              → 200 (Anthropic-internal feature flag)
-*   cli-internal-2026-02-09          → 200 (USER_TYPE=ant only)
-*   oauth-2025-04-20                 → 200 (Files-API path; Files-API itself
-*     is not supportable via Copilot, but the header alone is harmless)
-*   prompt-caching-scope-2026-01-05  → 200 even with body cache_control.scope
-*     stripped (already covered by `prompt-caching-` prefix above)
-*/
-const EXTENDED_BETA_PREFIXES = [
-	...VSCODE_BETA_PREFIXES,
-	"claude-code-",
-	"effort-",
-	"prompt-caching-",
-	"computer-use-",
-	"pdfs-",
-	"max-tokens-",
-	"token-counting-",
-	"compact-",
-	"structured-outputs-",
-	"fast-mode-",
-	"mcp-client-",
-	"mcp-servers-",
-	"redact-thinking-",
-	"web-search-",
-	"task-budgets-",
-	"token-efficient-tools-",
-	"summarize-connector-text-",
-	"afk-mode-",
-	"cli-internal-",
-	"oauth-"
-];
-/**
-* Beta prefixes the proxy explicitly STRIPS even from the extended
-* allowlist (and even if a future leverage mode broadens the allowlist
-* further). Defensive layer: today's allowlist-only filter would already
-* drop these because they're not in any allowlist, but keeping an
-* explicit deny-list catches future changes that broaden allow rules
-* (e.g. a hypothetical pattern-based mode that lets `claude-*` through).
-*
-* Empirical (2026-05-11): Copilot returns HTTP 400
-*   `unsupported beta header(s): advisor-tool-2026-03-01`
-* on every request that includes `advisor-tool-`. Stripping it is the
-* difference between a working request (no ADVISOR semantics) and a
-* fully-failed request. Document upstream limitation in CLAUDE.md.
-*/
-const EXPLICITLY_STRIPPED_BETA_PREFIXES = ["advisor-tool-"];
-/**
-* Filter an `anthropic-beta` header value, keeping only beta flags
-* in the active whitelist AND not in the explicit-strip list.
-* Uses extended prefixes when --extended-betas is enabled, VS Code-only
-* prefixes otherwise. Returns the filtered comma-separated string,
-* or undefined if nothing remains.
-*/
-function filterBetaHeader(value) {
-	const prefixes = state.extendedBetas ? EXTENDED_BETA_PREFIXES : VSCODE_BETA_PREFIXES;
-	return value.split(",").map((v) => v.trim()).filter((v) => v && prefixes.some((prefix) => v.startsWith(prefix)) && !EXPLICITLY_STRIPPED_BETA_PREFIXES.some((p) => v.startsWith(p))).join(",") || void 0;
-}
-/**
-* Normalize a model ID for fuzzy comparison: lowercase, replace dots with
-* dashes, insert dash at letter→digit boundaries, and collapse repeated
-* dashes. E.g. "gpt5.3-codex" → "gpt-5-3-codex", "GPT-5.3-Codex" → "gpt-5-3-codex".
-*/
-function normalizeModelId$1(id) {
-	return id.toLowerCase().replace(/\./g, "-").replace(/([a-z])(\d)/g, "$1-$2").replace(/-{2,}/g, "-");
-}
-/**
-* Resolve a model name to the best available variant in the Copilot model list.
-*
-* Resolution cascade:
-* 0. `[1m]` literal-bracket suffix: strip, delegate, warn if downgraded.
-*    Bracketed slug must never reach Copilot (400s on it). See cc-backup
-*    `src/utils/context.ts:35-40` for Claude Code's 1M unlock mechanism.
-* 1. Exact match
-* 2. Case-insensitive match
-* 3. Family preference (opus→1m, codex→highest version)
-* 4. Normalized match (dots→dashes, letter-digit boundaries)
-* 5. Anthropic dated-slug retry: if the input matches `claude-...-YYYYMMDD`,
-*    strip the date and re-run the cascade once. Family-guarded so non-claude
-*    8-digit suffixes can't be mis-stripped; runs after Steps 1-4 so explicit
-*    version pinning (a dated catalog id matched at Step 1) always wins.
-* 6. Return as-is with a warning
-*/
-/**
-* `[1m]`-downgrade warnings we've already emitted this process. `resolveModel`
-* is called many times per launch (env setup, model validation, the banner,
-* and — under `serve` — on every model-picker `/models` poll), so the downgrade
-* notice is deduped to once per model id to avoid log spam.
-*/
-const warnedOneMDowngrade = /* @__PURE__ */ new Set();
-function resolveModel(modelId) {
-	const models = state.models?.data;
-	if (!models) return modelId;
-	const oneMMatch = modelId.match(/^(.*)\[1m\]$/i);
-	if (oneMMatch) {
-		const stripped = oneMMatch[1];
-		const resolved = resolveModel(stripped);
-		if (!(/-1m(?:$|-)/.test(resolved) || (models.find((m) => m.id === resolved)?.capabilities?.limits?.max_context_window_tokens ?? 0) >= 1e6) && !warnedOneMDowngrade.has(modelId)) {
-			warnedOneMDowngrade.add(modelId);
-			consola.warn(`Model "${modelId}" requested 1M context but no 1M backend is in Copilot's catalog for this tier/family; downgrading upstream to "${resolved}" (200K). Claude Code's local context accounting will still assume 1M — expect premature auto-compact. Drop the [1m] suffix (or unset CLAUDE_CODE_DISABLE_1M_CONTEXT if you set it) to silence.`);
-		}
-		return resolved;
-	}
-	if (models.some((m) => m.id === modelId)) return modelId;
-	const lower = modelId.toLowerCase();
-	const ciMatch = models.find((m) => m.id.toLowerCase() === lower);
-	if (ciMatch) return ciMatch.id;
-	if (lower.includes("opus")) {
-		const oneMs = models.filter((m) => m.id.includes("opus") && /-1m(?:$|-)/.test(m.id));
-		const versionMatch = lower.match(/opus-(\d+)(?:[.-](\d+))?/);
-		const requestedVersion = versionMatch ? versionMatch[2] ? `${versionMatch[1]}.${versionMatch[2]}` : versionMatch[1] : void 0;
-		const oneM = (requestedVersion ? oneMs.find((m) => m.id.includes(`opus-${requestedVersion}-`)) : void 0) ?? (requestedVersion ? void 0 : oneMs[0]);
-		if (oneM) return oneM.id;
-	}
-	if (lower.includes("codex")) {
-		const codexModels = models.filter((m) => m.id.includes("codex") && !m.id.includes("mini"));
-		if (codexModels.length > 0) {
-			codexModels.sort((a, b) => b.id.localeCompare(a.id));
-			return codexModels[0].id;
-		}
-	}
-	const normalized = normalizeModelId$1(modelId);
-	const normMatch = models.find((m) => normalizeModelId$1(m.id) === normalized);
-	if (normMatch) return normMatch.id;
-	const dateStripped = modelId.replace(/^(claude-[\w.-]+)-20\d{6}$/i, "$1");
-	if (dateStripped !== modelId) {
-		const retried = resolveModel(dateStripped);
-		if (retried !== dateStripped || models.some((m) => m.id === dateStripped)) {
-			consola.info(`Resolved Anthropic dated slug "${modelId}" → "${retried}" (stripped -YYYYMMDD; pass an explicit catalog id to pin a snapshot)`);
-			return retried;
-		}
-	}
-	if (lower.startsWith("claude-")) {
-		const matchSonnet = /(?:^|-)sonnet(?:-|$)/.test(lower);
-		const matchHaiku = /(?:^|-)haiku(?:-|$)/.test(lower);
-		if (matchSonnet || matchHaiku) {
-			const family = matchSonnet ? "sonnet" : "haiku";
-			const familyMembers = models.filter((m) => new RegExp(`(?:^|-)${family}(?:-|$|\\.)`).test(m.id));
-			if (familyMembers.length > 0) {
-				familyMembers.sort((a, b) => b.id.localeCompare(a.id, void 0, { numeric: true }));
-				const best = familyMembers[0].id;
-				consola.info(`Model "${modelId}" not in Copilot catalog; falling back to highest available "${best}" (legacy ${family} slug). Pin a current catalog id to silence.`);
-				return best;
-			}
-		}
-	}
-	consola.warn(`Model "${modelId}" not found in Copilot model list. Available: ${models.map((m) => m.id).join(", ")}`);
-	return modelId;
-}
-/**
-* Resolve a codex model ID, falling back to the best available codex model.
-* Used by the codex subcommand for model selection.
-*/
-function resolveCodexModel(modelId) {
-	const resolved = resolveModel(modelId);
-	const models = state.models?.data;
-	if (!models) return resolved;
-	if (models.some((m) => m.id === resolved)) return resolved;
-	const candidates = models.filter((m) => {
-		const endpoints = m.supported_endpoints ?? [];
-		if (m.id.includes("mini") || m.id.includes("nano")) return false;
-		return endpoints.length === 0 || endpoints.includes("/responses");
-	});
-	if (candidates.length > 0) {
-		candidates.sort((a, b) => {
-			const aCodex = a.id.includes("codex") ? 1 : 0;
-			const bCodex = b.id.includes("codex") ? 1 : 0;
-			if (aCodex !== bCodex) return bCodex - aCodex;
-			return b.id.localeCompare(a.id);
-		});
-		const best = candidates[0].id;
-		consola.warn(`Model "${modelId}" not available, using "${best}" instead`);
-		return best;
-	}
-	return resolved;
-}
-async function cacheModels() {
-	const models = await getModels();
-	state.models = models;
-}
-const cacheVSCodeVersion = async () => {
-	const response = await getVSCodeVersion();
-	state.vsCodeVersion = response;
-	consola.info(`Using VSCode version: ${response}`);
-};
-const cacheCopilotVersion = async () => {
-	const version = await getCopilotChatVersion();
-	state.copilotVersion = version;
-	consola.info(`Using Copilot Chat version: ${version}`);
-};
-//#endregion
-//#region src/services/github/poll-access-token.ts
-async function pollAccessToken(deviceCode, clientId = GITHUB_CLIENT_ID) {
-	const sleepDuration = (deviceCode.interval + 1) * 1e3;
-	consola.debug(`Polling access token with interval of ${sleepDuration}ms`);
-	const expiresAt = Date.now() + deviceCode.expires_in * 1e3;
-	while (Date.now() < expiresAt) {
-		const response = await fetch(`${GITHUB_BASE_URL}/login/oauth/access_token`, {
-			method: "POST",
-			headers: standardHeaders(),
-			body: JSON.stringify({
-				client_id: clientId,
-				device_code: deviceCode.device_code,
-				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-			})
-		});
-		if (!response.ok) {
-			consola.error("Failed to poll access token:", await response.text());
-			if (Date.now() >= expiresAt) break;
-			await sleep$3(sleepDuration);
-			continue;
-		}
-		const json = await response.json();
-		consola.debug("Polling access token response:", json);
-		const { access_token } = json;
-		if (access_token) return access_token;
-		if (Date.now() >= expiresAt) break;
-		await sleep$3(sleepDuration);
-	}
-	throw new Error("Device code expired. Please run auth again.");
-}
-//#endregion
-//#region src/lib/token.ts
-const readGithubToken = () => fs.readFile(PATHS.GITHUB_TOKEN_PATH, "utf8");
-const writeGithubToken = (token) => fs.writeFile(PATHS.GITHUB_TOKEN_PATH, token);
-const readGithubAgentToken = () => fs.readFile(PATHS.GITHUB_AGENT_TOKEN_PATH, "utf8");
-const writeGithubAgentToken = (token) => fs.writeFile(PATHS.GITHUB_AGENT_TOKEN_PATH, token, { mode: 384 });
-const setupCopilotToken = async () => {
-	const { token, refresh_in } = await getCopilotToken();
-	state.copilotToken = token;
-	consola.debug("GitHub Copilot Token fetched successfully!");
-	if (state.showToken) consola.info("Copilot token:", token);
-	const refreshInterval = Math.max((refresh_in - 60) * 1e3, 1e3);
-	setInterval(() => {
-		refreshCopilotToken("interval");
-	}, refreshInterval);
-};
-let inflightRefresh;
-let lastRefreshSuccess = 0;
-let lastRefreshFailure = 0;
-const REFRESH_SUCCESS_COOLDOWN_MS = 3e4;
-const REFRESH_FAILURE_COOLDOWN_MS = 5e3;
-async function refreshCopilotToken(reason) {
-	if (inflightRefresh) return inflightRefresh;
-	if (reason === "401-retry") {
-		const now = Date.now();
-		if (now - lastRefreshSuccess < REFRESH_SUCCESS_COOLDOWN_MS) {
-			consola.debug(`refreshCopilotToken(${reason}) skipped: prior success within ${REFRESH_SUCCESS_COOLDOWN_MS}ms`);
-			return;
-		}
-		if (now - lastRefreshFailure < REFRESH_FAILURE_COOLDOWN_MS) {
-			consola.debug(`refreshCopilotToken(${reason}) skipped: prior failure within ${REFRESH_FAILURE_COOLDOWN_MS}ms`);
-			return;
-		}
-	}
-	inflightRefresh = (async () => {
-		consola.debug(`Refreshing Copilot token (reason=${reason})`);
-		try {
-			const { token } = await getCopilotToken();
-			state.copilotToken = token;
-			lastRefreshSuccess = Date.now();
-			consola.debug("Copilot token refreshed");
-			if (state.showToken) consola.info("Refreshed Copilot token:", token);
-		} catch (error) {
-			lastRefreshFailure = Date.now();
-			consola.error(`Failed to refresh Copilot token (reason=${reason}):`, error);
-		} finally {
-			inflightRefresh = void 0;
-		}
-	})();
-	return inflightRefresh;
-}
-/**
-* Try `request()`. If it returns a 401, refresh the Copilot token (subject
-* to the single-flight + refresh-storm-protection of `refreshCopilotToken`)
-* and retry once. After one retry, propagate whatever the second attempt
-* returned — the caller's existing 401-handling path is preserved.
-*
-* The `request` callback is responsible for capturing `state.copilotToken`
-* locally before any await; this helper does NOT re-build the request
-* itself, just re-invokes the callback after a refresh.
-*/
-async function tryRefreshAndRetry(request, routePath) {
-	const first = await request();
-	if (first.status !== 401) return first;
-	consola.warn(`${routePath}: upstream returned 401, attempting one token refresh + retry`);
-	await refreshCopilotToken("401-retry");
-	return request();
-}
-async function setupGitHubToken(options) {
-	try {
-		const githubToken = await readGithubToken();
-		if (githubToken && !options?.force) {
-			state.githubToken = githubToken;
-			if (state.showToken) consola.info("GitHub token:", githubToken);
-			await logUser();
-			return;
-		}
-		consola.info("Not logged in, getting new access token");
-		const response = await getDeviceCode();
-		consola.debug("Device code response:", response);
-		consola.info(`Please enter the code "${response.user_code}" in ${response.verification_uri}`);
-		const token = await pollAccessToken(response);
-		await writeGithubToken(token);
-		state.githubToken = token;
-		if (state.showToken) consola.info("GitHub token:", token);
-		await logUser();
-	} catch (error) {
-		if (error instanceof HTTPError) {
-			consola.error("Failed to get GitHub token:", await error.response.json());
-			throw error;
-		}
-		consola.error("Failed to get GitHub token:", error);
-		throw error;
-	}
-}
-async function logUser() {
-	const user = await getGitHubUser();
-	consola.info(`Logged in as ${user.login}`);
-}
-/**
-* Set up the SECOND, write-capable GitHub token used by the first-mate
-* agent-orchestration surface (`--agents`). Mirrors `setupGitHubToken`
-* but authenticates against the GitHub CLI's OAuth client
-* (`GITHUB_AGENT_CLIENT_ID`) requesting `repo workflow read:org`, and
-* stores the result apart at `PATHS.GITHUB_AGENT_TOKEN_PATH`. The Copilot
-* App token (`state.githubToken`) is left completely untouched — this is
-* a distinct identity for a distinct capability.
-*
-* Long-lived (device-flow user token) → no refresh loop; a later 401 is
-* surfaced to the caller as a revoked grant to re-run the login. Called
-* once from `setupAndServe` when `state.agentsEnabled` is true.
-*/
-async function setupGitHubAgentToken(options) {
-	try {
-		const existing = (await readGithubAgentToken().catch(() => "")).trim();
-		if (existing && !options?.force) {
-			state.githubAgentToken = existing;
-			if (state.showToken) consola.info("GitHub agent token:", existing);
-			await warnIfAgentScopesInsufficient();
-			return;
-		}
-		consola.info("Agent mode (--agents): a second GitHub login is required for a write-capable token (repo, workflow, read:org).");
-		const response = await getDeviceCode({
-			clientId: GITHUB_AGENT_CLIENT_ID,
-			scope: GITHUB_AGENT_SCOPES
-		});
-		consola.debug("Agent device code response:", response);
-		consola.info(`Please enter the code "${response.user_code}" in ${response.verification_uri} to authorize github-router's cloud-agent orchestration to act on your repositories.`);
-		const token = await pollAccessToken(response, GITHUB_AGENT_CLIENT_ID);
-		await writeGithubAgentToken(token);
-		state.githubAgentToken = token;
-		if (state.showToken) consola.info("GitHub agent token:", token);
-		await warnIfAgentScopesInsufficient();
-	} catch (error) {
-		if (error instanceof HTTPError) {
-			consola.error("Failed to get GitHub agent token:", await error.response.json());
-			throw error;
-		}
-		consola.error("Failed to get GitHub agent token:", error);
-		throw error;
-	}
-}
-/**
-* Best-effort check that the agent token actually carries the scopes we
-* asked for. The GitHub CLI OAuth client is a classic OAuth App, so the
-* granted scopes are echoed in the `x-oauth-scopes` response header on
-* any authenticated call. Warn loudly (not fatal) if `repo`/`workflow`
-* are missing so the failure is diagnosable at login rather than at the
-* first write 403.
-*/
-async function warnIfAgentScopesInsufficient() {
-	try {
-		const res = await fetch(`${GITHUB_API_BASE_URL}/user`, { headers: githubAgentHeaders(state) });
-		if (res.status === 401) {
-			consola.warn("GitHub agent token was rejected (401) — the grant may have been revoked. Re-run with --agents to log in again.");
-			return;
-		}
-		const scopes = (res.headers.get("x-oauth-scopes") ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-		const missing = ["repo", "workflow"].filter((s) => !scopes.includes(s));
-		if (missing.length > 0) consola.warn(`GitHub agent token is missing scope(s): ${missing.join(", ")}. The first-mate surface needs 'repo' + 'workflow' to create issues, assign cloud agents, and dispatch workflows. Re-run the agent login and grant the requested scopes.`);
-	} catch (err) {
-		consola.debug("Agent token scope check skipped:", err);
-	}
-}
-//#endregion
 //#region src/lib/update-lock.ts
 /**
 * Cross-process install lock for the auto-update / self-update paths.
@@ -996,32 +95,6 @@ async function tryCreateLock(p) {
 	}
 }
 //#endregion
-//#region src/lib/version.ts
-/**
-* Read this binary's published version from package.json at runtime.
-*
-* Done at runtime (not baked at build time) because release.yml builds
-* BEFORE `npm version patch` bumps the version — a build-time inline
-* would always ship the pre-bump value. The npm tarball ships package.json
-* alongside `dist/`, so a sibling-up lookup from import.meta.url resolves
-* cleanly in both dev (`src/lib/`) and bundled (`dist/`) layouts.
-*
-* Returns `"unknown"` if package.json can't be located or parsed —
-* never throws, so the CLI never fails to start over version reporting.
-*/
-function getPackageVersion() {
-	try {
-		const here = dirname(fileURLToPath(import.meta.url));
-		const candidates = [join(here, "..", "..", "package.json"), join(here, "..", "package.json")];
-		for (const path of candidates) try {
-			const raw = readFileSync(path, "utf8");
-			const parsed = JSON.parse(raw);
-			if (typeof parsed.version === "string" && (parsed.name === "github-router" || parsed.name === "@animeshkundu/github-router")) return parsed.version;
-		} catch {}
-	} catch {}
-	return "unknown";
-}
-//#endregion
 //#region src/lib/port.ts
 const DEFAULT_PORT = 8787;
 const DEFAULT_CLAUDE_MODEL_FALLBACKS = [
@@ -1183,432 +256,6 @@ function collapsePathKeys(env) {
 	return env;
 }
 //#endregion
-//#region src/lib/mcp-workspace-header.ts
-/** Header the per-session MCP headersHelper emits, carrying the calling Claude
-*  session's working directory. The /mcp handler uses it as the default
-*  `workspace` for repo-scoped tools so a machine-wide `serve` targets the
-*  active repo, not the proxy launch cwd. */
-const MCP_WORKSPACE_HEADER = "X-GH-Workspace";
-/** stdout JSON the headersHelper prints; Claude merges it into the connection
-*  headers. `cwd` is the helper's own process cwd = the session's project dir. */
-function buildWorkspaceHeaderJson(cwd) {
-	return JSON.stringify({ [MCP_WORKSPACE_HEADER]: cwd });
-}
-/** Command string Claude runs as the headersHelper. Mirrors
-*  buildPromptSubmitHookCommand's quoting (src/lib/orchestration/prompt-submit-hook.ts). */
-function buildWorkspaceHeaderHelperCommand(execPath, scriptPath) {
-	const q = (s) => `"${s}"`;
-	return scriptPath && scriptPath !== execPath ? `${q(execPath)} ${q(scriptPath)} internal-workspace-header` : `${q(execPath)} internal-workspace-header`;
-}
-//#endregion
-//#region src/lib/insecure-tls.ts
-/**
-* Runtime-aware "skip TLS verification" for a self-signed direct-HTTPS instance.
-* The mechanism differs by runtime and getting it wrong is silent: the BUILT
-* proxy runs under Node (bin shebang `#!/usr/bin/env node`), whose fetch (undici)
-* IGNORES a per-request `tls` option — only a `dispatcher` relaxes verification.
-* `bun run dev` and the test suite run under Bun, whose fetch honors `tls`. So we
-* detect the runtime and attach the field it actually understands.
-*
-* Shared by the fleet control-plane client and the artifact-review client — both
-* talk to a self-signed ai-or-die instance on loopback. Per-request scope (not a
-* global TLS posture change) keeps Copilot upstream verification untouched.
-*/
-const IS_BUN$1 = typeof globalThis.Bun !== "undefined";
-let sharedInsecureDispatcher;
-function insecureDispatcher() {
-	return sharedInsecureDispatcher ??= new Agent({ connect: { rejectUnauthorized: false } });
-}
-/**
-* Attach the runtime-correct TLS-verification-off mechanism to a fetch init for a
-* single self-signed direct-HTTPS instance: Bun → `tls`, Node → an undici
-* `dispatcher`. Exported so BOTH runtime branches are unit-testable under one
-* interpreter (the untested Node branch is exactly what shipped broken).
-*/
-function applyInsecureTls(init, isBun = IS_BUN$1) {
-	if (isBun) init.tls = { rejectUnauthorized: false };
-	else init.dispatcher = insecureDispatcher();
-}
-//#endregion
-//#region src/lib/artifact/client.ts
-var ArtifactError = class extends Error {
-	code;
-	retryable;
-	status;
-	detail;
-	constructor(args) {
-		super(args.message);
-		this.name = "ArtifactError";
-		this.code = args.code;
-		this.retryable = args.retryable;
-		this.status = args.status;
-		this.detail = args.detail;
-	}
-};
-const AWAIT_DEFAULT_TIMEOUT_MS = 25e3;
-const AWAIT_ABORT_MARGIN_MS = 5e3;
-const DEFAULT_RETRY_BASE_MS = 250;
-const TRANSIENT_RETRIES = 2;
-const DEFAULT_RETRYABLE_CODES = /* @__PURE__ */ new Set(["UNREACHABLE", "TIMEOUT"]);
-const AWAIT_RETRYABLE_CODES = /* @__PURE__ */ new Set(["UNREACHABLE"]);
-var ArtifactClient = class {
-	baseUrl;
-	token;
-	sessionId;
-	fetchFn;
-	insecureTLS;
-	retryBaseMs;
-	constructor(options) {
-		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
-		this.token = options.token;
-		this.sessionId = options.sessionId;
-		this.fetchFn = options.fetchFn ?? globalThis.fetch.bind(globalThis);
-		this.insecureTLS = options.insecureTLS ?? false;
-		this.retryBaseMs = options.retryBaseMs ?? DEFAULT_RETRY_BASE_MS;
-	}
-	/**
-	* Open (or replace) the review for this session. `mode` is advisory metadata
-	* forwarded to the server (forward-compat: ignored if unknown); the actual
-	* interactivity comes from the served HTML's `data-aod-*` markup. Retried on a
-	* transient failure with a STABLE idempotency key so a retry-after-success does
-	* not double-open.
-	*/
-	open(file, opts = {}) {
-		const idempotencyKey = opts.idempotencyKey ?? randomUUID();
-		const body = { file };
-		if (opts.mode) body.mode = opts.mode;
-		return this.withRetry(() => this.requestOnce({
-			method: "POST",
-			pathname: this.path("/open"),
-			body,
-			signal: opts.signal,
-			idempotencyKey
-		}), TRANSIENT_RETRIES, opts.signal);
-	}
-	/**
-	* Replace the current review's content. Exactly one of `file` | `html` (the
-	* caller-facing tool enforces that). `html` is written by the SERVER to the
-	* review's existing sandboxed file, so `html` with no existing review is an
-	* INVALID_REQUEST from the server. Retried with a stable idempotency key.
-	*/
-	update(opts) {
-		const idempotencyKey = opts.idempotencyKey ?? randomUUID();
-		const body = {};
-		if (opts.file !== void 0) body.file = opts.file;
-		if (opts.html !== void 0) body.html = opts.html;
-		return this.withRetry(() => this.requestOnce({
-			method: "POST",
-			pathname: this.path("/update"),
-			body,
-			signal: opts.signal,
-			idempotencyKey,
-			allowEmptyJson: true
-		}), TRANSIENT_RETRIES, opts.signal);
-	}
-	/** Force a reload from disk (no content change). Single-shot (idempotent, cheap). */
-	refresh(signal) {
-		return this.requestOnce({
-			method: "POST",
-			pathname: this.path("/refresh"),
-			signal,
-			allowEmptyJson: true
-		});
-	}
-	/** Hide the panel UI while keeping the review alive. Single-shot; server idempotent. */
-	dismiss(signal) {
-		return this.requestOnce({
-			method: "POST",
-			pathname: this.path("/dismiss"),
-			signal,
-			allowEmptyJson: true
-		});
-	}
-	/**
-	* Typed drain (contract v2.2 §1/§2). Long-holds up to the server cap, returns
-	* events with `id > cursor` plus the new high-water `cursor`. Idempotent by
-	* (cursor, event.id): re-calling with the same cursor replays the same window
-	* from the server's bounded buffer, so a lost cursor (compaction) is
-	* recoverable. Retried on a transient network failure (the cursor makes retry
-	* safe — no double-consumption).
-	*/
-	awaitEvents(opts = {}) {
-		const serverTimeoutMs = typeof opts.timeoutMs === "number" && Number.isFinite(opts.timeoutMs) && opts.timeoutMs > 0 ? opts.timeoutMs : AWAIT_DEFAULT_TIMEOUT_MS;
-		const clientTimeoutMs = serverTimeoutMs + AWAIT_ABORT_MARGIN_MS;
-		return this.withRetry(() => this.requestOnce({
-			method: "GET",
-			pathname: this.path("/await"),
-			query: {
-				cursor: opts.cursor,
-				timeoutMs: String(serverTimeoutMs)
-			},
-			signal: opts.signal,
-			timeoutMsHint: clientTimeoutMs
-		}), TRANSIENT_RETRIES, opts.signal, AWAIT_RETRYABLE_CODES);
-	}
-	/** Free-text agent->human reply. SINGLE-SHOT (not retried): a retry-after-success
-	*  would render a duplicate chat bubble server-side. */
-	agentReply(text, signal) {
-		return this.requestOnce({
-			method: "POST",
-			pathname: this.path("/agent-reply"),
-			body: { text },
-			signal,
-			allowEmptyJson: true
-		});
-	}
-	/**
-	* End the review. Retried with a stable idempotency key; a NOT_FOUND (the
-	* review is already ended — whether by a prior call or by a retry landing after
-	* the first attempt succeeded) is mapped to a successful `{ ok, status:"ended" }`
-	* rather than surfaced as a 404 (contract v2.2 §1.1).
-	*/
-	async end(signal) {
-		const idempotencyKey = randomUUID();
-		try {
-			return await this.withRetry(() => this.requestOnce({
-				method: "POST",
-				pathname: this.path("/end"),
-				signal,
-				idempotencyKey,
-				allowEmptyJson: true
-			}), TRANSIENT_RETRIES, signal);
-		} catch (err) {
-			if (err instanceof ArtifactError && err.code === "NOT_FOUND") return {
-				ok: true,
-				status: "ended"
-			};
-			throw err;
-		}
-	}
-	/**
-	* FROZEN legacy long-poll (contract v2.2 §1). Old payload shape,
-	* comment-equivalent only. New agents use `awaitEvents`. Single request per
-	* call (the caller-facing tool owns the bounded re-poll budget).
-	*/
-	poll(timeoutMsHint, signal) {
-		return this.requestOnce({
-			method: "GET",
-			pathname: this.path("/poll"),
-			signal,
-			timeoutMsHint
-		});
-	}
-	path(suffix) {
-		return `/api/artifact/${encodeURIComponent(this.sessionId)}${suffix}`;
-	}
-	async withRetry(fn, retries, signal, retryableCodes = DEFAULT_RETRYABLE_CODES) {
-		let attempt = 0;
-		for (;;) try {
-			return await fn();
-		} catch (err) {
-			attempt += 1;
-			if (!(err instanceof ArtifactError && err.retryable && retryableCodes.has(err.code)) || attempt > retries || signal?.aborted) throw err;
-			const base = this.retryBaseMs;
-			await sleep$2(base <= 0 ? 0 : Math.round(base * 2 ** (attempt - 1) * (.5 + Math.random() * .5)), signal);
-		}
-	}
-	async requestOnce(o) {
-		let url;
-		try {
-			url = new URL(o.pathname, `${this.baseUrl}/`);
-		} catch (err) {
-			throw new ArtifactError({
-				code: "UNREACHABLE",
-				message: "artifact API base URL is invalid",
-				retryable: false,
-				detail: err
-			});
-		}
-		if (o.query) {
-			for (const [key, value] of Object.entries(o.query)) if (value !== void 0) url.searchParams.set(key, value);
-		}
-		const timeout = combineSignalAndTimeout(o.signal, o.timeoutMsHint);
-		try {
-			const headers = { Authorization: `Bearer ${this.token}` };
-			if (o.body !== void 0) headers["Content-Type"] = "application/json";
-			if (o.idempotencyKey) headers["Idempotency-Key"] = o.idempotencyKey;
-			const init = {
-				method: o.method,
-				headers,
-				body: o.body === void 0 ? void 0 : JSON.stringify(o.body),
-				redirect: "error",
-				signal: timeout.signal
-			};
-			if (this.insecureTLS) applyInsecureTls(init);
-			const response = await this.fetchFn(url.toString(), init);
-			if (!response.ok) throw await mapHttpError$1(response);
-			let text;
-			try {
-				text = await response.text();
-			} catch (err) {
-				if (isAbortLike$2(err)) throw mapNetworkError$1(err);
-				throw new ArtifactError({
-					code: "INVALID_RESPONSE",
-					message: "artifact API response body could not be read",
-					retryable: false,
-					detail: err
-				});
-			}
-			if (!text && o.allowEmptyJson) return {};
-			try {
-				return JSON.parse(text);
-			} catch (err) {
-				throw new ArtifactError({
-					code: "INVALID_RESPONSE",
-					message: "artifact API returned a non-JSON response",
-					retryable: false,
-					detail: err
-				});
-			}
-		} catch (err) {
-			if (err instanceof ArtifactError) throw err;
-			throw mapNetworkError$1(err);
-		} finally {
-			timeout.cleanup();
-		}
-	}
-};
-function sleep$2(ms, signal) {
-	if (ms <= 0) return Promise.resolve();
-	return new Promise((resolve, reject) => {
-		const onAbort = () => {
-			clearTimeout(timer);
-			reject(new DOMException("retry backoff aborted", "AbortError"));
-		};
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, ms);
-		if (signal?.aborted) {
-			onAbort();
-			return;
-		}
-		signal?.addEventListener("abort", onAbort, { once: true });
-	});
-}
-function combineSignalAndTimeout(signal, timeoutMsHint) {
-	const timeoutMs = typeof timeoutMsHint === "number" && Number.isFinite(timeoutMsHint) && timeoutMsHint > 0 ? timeoutMsHint : void 0;
-	if (timeoutMs === void 0) return {
-		signal,
-		cleanup: () => {}
-	};
-	const controller = new AbortController();
-	const abortFromCaller = () => {
-		try {
-			controller.abort(signal?.reason);
-		} catch {
-			controller.abort();
-		}
-	};
-	if (signal?.aborted) abortFromCaller();
-	signal?.addEventListener("abort", abortFromCaller, { once: true });
-	const timer = setTimeout(() => {
-		try {
-			controller.abort(new DOMException("artifact API request timed out", "TimeoutError"));
-		} catch {
-			controller.abort();
-		}
-	}, timeoutMs);
-	return {
-		signal: controller.signal,
-		cleanup: () => {
-			clearTimeout(timer);
-			signal?.removeEventListener("abort", abortFromCaller);
-		}
-	};
-}
-async function mapHttpError$1(response) {
-	const detail = await readErrorDetail$1(response);
-	const upstreamMessage = detailToMessage$1(detail);
-	const suffix = upstreamMessage ? `: ${upstreamMessage}` : "";
-	if (response.status === 401 || response.status === 403) return new ArtifactError({
-		code: "AUTH_FAILED",
-		message: `artifact API authentication failed (${response.status})${suffix}`,
-		retryable: false,
-		status: response.status,
-		detail
-	});
-	if (response.status === 404) return new ArtifactError({
-		code: "NOT_FOUND",
-		message: `artifact session or resource not found (404)${suffix}`,
-		retryable: false,
-		status: response.status,
-		detail
-	});
-	if (response.status === 408 || response.status === 504) return new ArtifactError({
-		code: "TIMEOUT",
-		message: `artifact API request timed out (${response.status})${suffix}`,
-		retryable: true,
-		status: response.status,
-		detail
-	});
-	if (response.status === 400 && detailToCode(detail)?.toUpperCase() === "INVALID_REQUEST") return new ArtifactError({
-		code: "INVALID_REQUEST",
-		message: `artifact API rejected the request (400)${suffix}`,
-		retryable: false,
-		status: response.status,
-		detail
-	});
-	return new ArtifactError({
-		code: "UPSTREAM_ERROR",
-		message: `artifact API returned HTTP ${response.status}${suffix}`,
-		retryable: response.status === 429 || response.status >= 500,
-		status: response.status,
-		detail
-	});
-}
-function mapNetworkError$1(err) {
-	if (isAbortLike$2(err)) return new ArtifactError({
-		code: "TIMEOUT",
-		message: "artifact API request timed out or was aborted",
-		retryable: true,
-		detail: err
-	});
-	return new ArtifactError({
-		code: "UNREACHABLE",
-		message: `artifact API unreachable: ${err instanceof Error ? err.message : String(err)}`,
-		retryable: true,
-		detail: err
-	});
-}
-async function readErrorDetail$1(response) {
-	const text = await response.text().catch(() => "");
-	if (!text) return void 0;
-	try {
-		return JSON.parse(text);
-	} catch {
-		return text;
-	}
-}
-function detailToMessage$1(detail) {
-	if (typeof detail === "string") return detail;
-	if (typeof detail !== "object" || detail === null) return void 0;
-	const record = detail;
-	const error = record.error;
-	if (typeof error === "string") return error;
-	if (typeof error === "object" && error !== null) {
-		const errorRecord = error;
-		if (typeof errorRecord.message === "string") return errorRecord.message;
-		if (typeof errorRecord.code === "string") return errorRecord.code;
-	}
-	if (typeof record.message === "string") return record.message;
-}
-/** Extract a machine `code` from an upstream error body (`{error:{code}}` or
-*  `{code}`) so a tagged 400 can be classified (INVALID_REQUEST). */
-function detailToCode(detail) {
-	if (typeof detail !== "object" || detail === null) return void 0;
-	const record = detail;
-	const error = record.error;
-	if (typeof error === "object" && error !== null) {
-		const code = error.code;
-		if (typeof code === "string") return code;
-	}
-	if (typeof record.code === "string") return record.code;
-}
-function isAbortLike$2(err) {
-	return err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
-}
-//#endregion
 //#region src/lib/artifact/tools.ts
 const ARTIFACT_GROUP = "peers";
 const ARTIFACT_POLL_TOOL_BUDGET_MS = 5e4;
@@ -2632,13 +1279,13 @@ function defaultFleetConfigPath() {
 async function loadFleetRegistryConfig(configPath = defaultFleetConfigPath()) {
 	let stat;
 	try {
-		stat = await fs.stat(configPath);
+		stat = await fs$1.stat(configPath);
 	} catch (err) {
 		if (isNodeErrorCode(err, "ENOENT")) return { instances: [] };
 		throw err;
 	}
 	if (process.platform !== "win32" && (stat.mode & 63) !== 0) console.warn(`[fleet] Registry file ${configPath} is group/other-readable; it contains bearer / tunnel credentials. Consider chmod 600.`);
-	const raw = await fs.readFile(configPath, "utf8");
+	const raw = await fs$1.readFile(configPath, "utf8");
 	if (raw.trim() === "") return { instances: [] };
 	const parsed = JSON.parse(raw);
 	if (!isObject(parsed)) throw new FleetRegistryError("INVALID_CONFIG", "fleet registry must be a JSON object");
@@ -2891,7 +1538,7 @@ function nonEmptyString(raw) {
 * validation; never throws — a missing/unreadable/oversized/malformed file
 * yields `[]` (discovery is best-effort and must never break static fleet use).
 */
-async function readMeshPeers(readFileFn = (p) => fs.readFile(p, "utf8")) {
+async function readMeshPeers(readFileFn = (p) => fs$1.readFile(p, "utf8")) {
 	if (meshDiscoveryDisabled()) return [];
 	let raw;
 	try {
@@ -2978,7 +1625,7 @@ function validEgressToken(raw) {
 */
 async function readMeshEgress(options = {}) {
 	if (meshDiscoveryDisabled()) return void 0;
-	const readFileFn = options.readFileFn ?? ((p) => fs.readFile(p, "utf8"));
+	const readFileFn = options.readFileFn ?? ((p) => fs$1.readFile(p, "utf8"));
 	const now = options.now ?? (() => Date.now());
 	const pidAlive = options.pidAlive ?? defaultPidAlive;
 	let raw;
@@ -5559,7 +4206,7 @@ function isLease(value) {
 async function readLeaseFile(file) {
 	let raw;
 	try {
-		raw = await fs.readFile(file, "utf8");
+		raw = await fs$1.readFile(file, "utf8");
 	} catch (err) {
 		if (err.code === "ENOENT") return void 0;
 		throw err;
@@ -5572,40 +4219,40 @@ async function readLeaseFile(file) {
 	}
 }
 async function writeLeaseAtomic(file, lease) {
-	await fs.mkdir(path.dirname(file), { recursive: true });
+	await fs$1.mkdir(path.dirname(file), { recursive: true });
 	const tmp = `${file}.tmp.${process.pid}.${randomBytes(4).toString("hex")}`;
 	try {
-		await fs.writeFile(tmp, `${JSON.stringify(lease, null, 2)}\n`, { mode: 384 });
-		await fs.rename(tmp, file);
+		await fs$1.writeFile(tmp, `${JSON.stringify(lease, null, 2)}\n`, { mode: 384 });
+		await fs$1.rename(tmp, file);
 	} catch (err) {
-		await fs.unlink(tmp).catch(() => {});
+		await fs$1.unlink(tmp).catch(() => {});
 		throw err;
 	}
 }
 const LEASE_LOCK_MAX_WAIT_MS = 1e4;
 async function withLeaseLock(file, fn, hooks) {
 	const lockPath = `${file}.lock`;
-	await fs.mkdir(path.dirname(lockPath), { recursive: true });
+	await fs$1.mkdir(path.dirname(lockPath), { recursive: true });
 	const ownerToken = `${process.pid}-${randomBytes(8).toString("hex")}`;
 	const staging = `${lockPath}.acq.${ownerToken}`;
-	await fs.writeFile(staging, ownerToken, { mode: 384 });
+	await fs$1.writeFile(staging, ownerToken, { mode: 384 });
 	const start = Date.now();
 	try {
 		for (;;) try {
-			await fs.link(staging, lockPath);
+			await fs$1.link(staging, lockPath);
 			break;
 		} catch (err) {
 			if (err.code !== "EEXIST") throw err;
 			let observed;
 			try {
-				observed = (await fs.readFile(lockPath, "utf8")).trim();
-				const st = await fs.stat(lockPath);
+				observed = (await fs$1.readFile(lockPath, "utf8")).trim();
+				const st = await fs$1.stat(lockPath);
 				if (Date.now() - st.mtimeMs > 1e4) {
 					if (hooks?.onObservedStale) await hooks.onObservedStale();
 					const breaker = `${lockPath}.stale.${ownerToken}`;
 					let moved = false;
 					try {
-						await fs.rename(lockPath, breaker);
+						await fs$1.rename(lockPath, breaker);
 						moved = true;
 					} catch (e) {
 						if (e.code !== "ENOENT") throw e;
@@ -5613,13 +4260,13 @@ async function withLeaseLock(file, fn, hooks) {
 					if (moved) {
 						let movedToken;
 						try {
-							movedToken = (await fs.readFile(breaker, "utf8")).trim();
+							movedToken = (await fs$1.readFile(breaker, "utf8")).trim();
 						} catch {
 							movedToken = void 0;
 						}
-						if (movedToken === observed) await fs.unlink(breaker).catch(() => {});
-						else await fs.rename(breaker, lockPath).catch(async () => {
-							await fs.unlink(breaker).catch(() => {});
+						if (movedToken === observed) await fs$1.unlink(breaker).catch(() => {});
+						else await fs$1.rename(breaker, lockPath).catch(async () => {
+							await fs$1.unlink(breaker).catch(() => {});
 						});
 					}
 					continue;
@@ -5629,11 +4276,11 @@ async function withLeaseLock(file, fn, hooks) {
 			await new Promise((r) => setTimeout(r, 15));
 		}
 	} finally {
-		await fs.unlink(staging).catch(() => {});
+		await fs$1.unlink(staging).catch(() => {});
 	}
 	const verifyOwner = async () => {
 		try {
-			return (await fs.readFile(lockPath, "utf8")).trim() === ownerToken;
+			return (await fs$1.readFile(lockPath, "utf8")).trim() === ownerToken;
 		} catch {
 			return false;
 		}
@@ -5641,7 +4288,7 @@ async function withLeaseLock(file, fn, hooks) {
 	try {
 		return await fn();
 	} finally {
-		if (await verifyOwner()) await fs.unlink(lockPath).catch(() => {});
+		if (await verifyOwner()) await fs$1.unlink(lockPath).catch(() => {});
 	}
 }
 /**
@@ -5798,15 +4445,15 @@ function sleep$1(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 async function writeJsonSecure(target, value) {
-	await fs.mkdir(path.dirname(target), { recursive: true });
+	await fs$1.mkdir(path.dirname(target), { recursive: true });
 	const tmp = `${target}.tmp.${process.pid}.${randomBytes(4).toString("hex")}`;
 	try {
-		await fs.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
-		await fs.chmod(tmp, 384).catch(() => {});
-		await fs.rename(tmp, target);
-		await fs.chmod(target, 384).catch(() => {});
+		await fs$1.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
+		await fs$1.chmod(tmp, 384).catch(() => {});
+		await fs$1.rename(tmp, target);
+		await fs$1.chmod(target, 384).catch(() => {});
 	} catch (err) {
-		await fs.unlink(tmp).catch(() => {});
+		await fs$1.unlink(tmp).catch(() => {});
 		throw err;
 	}
 }
@@ -5815,11 +4462,11 @@ const LOCK_RETRY_MS = 25;
 const LOCK_MAX_WAIT_MS = 1e4;
 async function withFileLock(target, fn) {
 	const lockPath = `${target}.lock`;
-	await fs.mkdir(path.dirname(lockPath), { recursive: true });
+	await fs$1.mkdir(path.dirname(lockPath), { recursive: true });
 	const ownerToken = `${process.pid}-${randomBytes(8).toString("hex")}`;
 	const start = Date.now();
 	for (;;) try {
-		const fh = await fs.open(lockPath, "wx");
+		const fh = await fs$1.open(lockPath, "wx");
 		await fh.writeFile(ownerToken);
 		await fh.close();
 		break;
@@ -5828,14 +4475,14 @@ async function withFileLock(target, fn) {
 		if (!(code === "EEXIST" || code === "EPERM" && process.platform === "win32")) throw err;
 		let observedToken;
 		try {
-			observedToken = (await fs.readFile(lockPath, "utf8")).trim();
-			const st = await fs.stat(lockPath);
+			observedToken = (await fs$1.readFile(lockPath, "utf8")).trim();
+			const st = await fs$1.stat(lockPath);
 			if (Date.now() - st.mtimeMs > LOCK_TTL_MS) {
 				const stealPath = `${lockPath}.steal.${ownerToken}`;
 				try {
-					await fs.rename(lockPath, stealPath);
-					if ((await fs.readFile(stealPath, "utf8").catch(() => "")).trim() === observedToken) await fs.unlink(stealPath).catch(() => {});
-					else await fs.rename(stealPath, lockPath).catch(() => fs.unlink(stealPath).catch(() => {}));
+					await fs$1.rename(lockPath, stealPath);
+					if ((await fs$1.readFile(stealPath, "utf8").catch(() => "")).trim() === observedToken) await fs$1.unlink(stealPath).catch(() => {});
+					else await fs$1.rename(stealPath, lockPath).catch(() => fs$1.unlink(stealPath).catch(() => {}));
 				} catch {}
 				continue;
 			}
@@ -5845,7 +4492,7 @@ async function withFileLock(target, fn) {
 	}
 	const verifyOwner = async () => {
 		try {
-			return (await fs.readFile(lockPath, "utf8")).trim() === ownerToken;
+			return (await fs$1.readFile(lockPath, "utf8")).trim() === ownerToken;
 		} catch {
 			return false;
 		}
@@ -5853,7 +4500,7 @@ async function withFileLock(target, fn) {
 	try {
 		return await fn(verifyOwner);
 	} finally {
-		if (await verifyOwner()) await fs.unlink(lockPath).catch(() => {});
+		if (await verifyOwner()) await fs$1.unlink(lockPath).catch(() => {});
 	}
 }
 const writeChains = /* @__PURE__ */ new Map();
@@ -5870,7 +4517,7 @@ const OCC_MAX_ATTEMPTS = 16;
 const OCC_BACKOFF_MS = 10;
 async function readRaw(file) {
 	try {
-		return await fs.readFile(file, "utf8");
+		return await fs$1.readFile(file, "utf8");
 	} catch (err) {
 		if (err.code === "ENOENT") return void 0;
 		throw err;
@@ -6013,7 +4660,7 @@ function parseDecisions(raw) {
 async function readDecisionsFile() {
 	let raw;
 	try {
-		raw = await fs.readFile(decisionsPath(), "utf8");
+		raw = await fs$1.readFile(decisionsPath(), "utf8");
 	} catch (err) {
 		if (err.code !== "ENOENT") consola.debug("first-mate decisions read skipped:", err);
 		raw = void 0;
@@ -6617,7 +5264,7 @@ function parseLedgerRaw(raw) {
 async function readRepoLedgerWithRev(repo) {
 	let raw;
 	try {
-		raw = await fs.readFile(repoLedgerPath(repo), "utf8");
+		raw = await fs$1.readFile(repoLedgerPath(repo), "utf8");
 	} catch (err) {
 		if (err.code !== "ENOENT") consola.debug("first-mate ledger read skipped:", err);
 		return {
@@ -6751,7 +5398,7 @@ function repoKey(repo) {
 async function readMissions() {
 	let raw;
 	try {
-		raw = await fs.readFile(registryPath(), "utf8");
+		raw = await fs$1.readFile(registryPath(), "utf8");
 	} catch (err) {
 		if (err.code !== "ENOENT") consola.debug("first-mate registry read skipped:", err);
 		raw = void 0;
@@ -7109,7 +5756,7 @@ var Outbox = class {
 	async read() {
 		let raw;
 		try {
-			raw = await fs.readFile(this.file, "utf8");
+			raw = await fs$1.readFile(this.file, "utf8");
 		} catch (err) {
 			if (err.code === "ENOENT") return [];
 			throw err;
@@ -7124,17 +5771,17 @@ var Outbox = class {
 		}
 	}
 	async write(entries) {
-		await fs.mkdir(path.dirname(this.file), { recursive: true });
+		await fs$1.mkdir(path.dirname(this.file), { recursive: true });
 		const tmp = `${this.file}.tmp.${process.pid}.${randomBytes(4).toString("hex")}`;
 		const value = {
 			version: OUTBOX_VERSION,
 			entries
 		};
 		try {
-			await fs.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
-			await fs.rename(tmp, this.file);
+			await fs$1.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
+			await fs$1.rename(tmp, this.file);
 		} catch (err) {
-			await fs.unlink(tmp).catch(() => {});
+			await fs$1.unlink(tmp).catch(() => {});
 			throw err;
 		}
 	}
@@ -7462,9 +6109,9 @@ function sanitizeSegment(value) {
 }
 async function writeDecisionPacketHtml(packetId, html) {
 	const dir = path.join(PATHS.FIRST_MATE_DIR, "packets");
-	await fs.mkdir(dir, { recursive: true });
+	await fs$1.mkdir(dir, { recursive: true });
 	const target = path.join(dir, `${sanitizeSegment(packetId)}.html`);
-	await fs.writeFile(target, html, { mode: 384 });
+	await fs$1.writeFile(target, html, { mode: 384 });
 	return target;
 }
 function agentRepo(repo) {
@@ -11204,7 +9851,7 @@ const WIN_RENAME_TRANSIENT = /* @__PURE__ */ new Set([
 */
 async function claimByRename(from, to) {
 	for (let attempt = 0;; attempt++) try {
-		await fs.rename(from, to);
+		await fs$1.rename(from, to);
 		return true;
 	} catch (err) {
 		const code = err.code;
@@ -11241,8 +9888,8 @@ var AnswerInbox = class {
 		}))];
 		if (lines.length === 0) return 0;
 		const run = this.chain.then(async () => {
-			await fs.mkdir(path.dirname(this.file), { recursive: true });
-			await fs.appendFile(this.file, `${lines.map((l) => JSON.stringify(l)).join("\n")}\n`, { mode: 384 });
+			await fs$1.mkdir(path.dirname(this.file), { recursive: true });
+			await fs$1.appendFile(this.file, `${lines.map((l) => JSON.stringify(l)).join("\n")}\n`, { mode: 384 });
 		});
 		this.chain = run.then(() => void 0, () => void 0);
 		await run;
@@ -11283,7 +9930,7 @@ var AnswerInbox = class {
 		const claimed = [];
 		let siblings;
 		try {
-			siblings = await fs.readdir(dir);
+			siblings = await fs$1.readdir(dir);
 		} catch {
 			siblings = [];
 		}
@@ -11294,7 +9941,7 @@ var AnswerInbox = class {
 			const claim = `${orphan}.claim.${process.pid}.${randomBytes(4).toString("hex")}`;
 			if (!await claimByRename(orphan, claim)) continue;
 			try {
-				this.mergeLines(await fs.readFile(claim, "utf8"), out);
+				this.mergeLines(await fs$1.readFile(claim, "utf8"), out);
 				claimed.push(claim);
 			} catch (err) {
 				if (err.code !== "ENOENT") consola.warn(`first-mate: deferring unreadable answer claim ${claim} for retry:`, err);
@@ -11302,7 +9949,7 @@ var AnswerInbox = class {
 		}
 		const target = `${this.file}.draining.${process.pid}.${randomBytes(4).toString("hex")}`;
 		if (await claimByRename(this.file, target)) try {
-			this.mergeLines(await fs.readFile(target, "utf8"), out);
+			this.mergeLines(await fs$1.readFile(target, "utf8"), out);
 			claimed.push(target);
 		} catch (err) {
 			if (err.code !== "ENOENT") consola.warn(`first-mate: deferring unreadable inbox claim ${target} for retry:`, err);
@@ -11310,7 +9957,7 @@ var AnswerInbox = class {
 		for (const p of claimed) this.inflight.add(p);
 		const ack = async () => {
 			for (const p of claimed) {
-				await fs.unlink(p).catch(() => {});
+				await fs$1.unlink(p).catch(() => {});
 				this.inflight.delete(p);
 			}
 		};
@@ -11441,8 +10088,8 @@ var Tier1Shadow = class {
 		this.judge = opts.judge ?? defaultTier1Judge;
 	}
 	async append(record) {
-		await fs.mkdir(path.dirname(this.file), { recursive: true });
-		await fs.appendFile(this.file, `${JSON.stringify(record)}\n`, { mode: 384 });
+		await fs$1.mkdir(path.dirname(this.file), { recursive: true });
+		await fs$1.appendFile(this.file, `${JSON.stringify(record)}\n`, { mode: 384 });
 	}
 	/**
 	* Run the Tier1 judge for one request and log its would-be verdict. Returns
@@ -11719,7 +10366,7 @@ function parseStrategies(raw) {
 async function readStrategiesFile() {
 	let raw;
 	try {
-		raw = await fs.readFile(strategiesPath(), "utf8");
+		raw = await fs$1.readFile(strategiesPath(), "utf8");
 	} catch (err) {
 		if (err.code !== "ENOENT") consola.debug("first-mate strategies read skipped:", err);
 		raw = void 0;
@@ -14245,6 +12892,9 @@ function isSensitivePath(absPath, workspaceAbs) {
 */
 function rejectWindowsHostilePath(raw) {
 	if (/^[\\/]{2}/.test(raw)) return "rejected: UNC or device path";
+	if (IS_WINDOWS) {
+		if ((/^[A-Za-z]:/.test(raw) ? raw.slice(2) : raw).includes(":")) return "rejected: alternate data stream";
+	}
 	if (/^[A-Za-z]:(?![\\/])/.test(raw)) return "rejected: drive-relative path";
 	return null;
 }
@@ -16602,7 +15252,7 @@ function metaPath(workspace) {
 /** Read the sidecar metadata for a workspace (null if none yet). */
 async function readColbertMeta(workspace) {
 	try {
-		const raw = await fs.readFile(metaPath(workspace), "utf8");
+		const raw = await fs$1.readFile(metaPath(workspace), "utf8");
 		const parsed = JSON.parse(raw);
 		if (parsed && typeof parsed === "object" && typeof parsed.status === "string") return parsed;
 		return null;
@@ -16627,14 +15277,14 @@ async function writeColbertMeta(meta) {
 	return next;
 }
 async function writeColbertMetaUnchained(meta) {
-	await fs.mkdir(PATHS.COLBERT_META_DIR, { recursive: true });
+	await fs$1.mkdir(PATHS.COLBERT_META_DIR, { recursive: true });
 	const dest = metaPath(meta.workspace);
 	const tmp = `${dest}.${process$1.pid}.${Math.random().toString(16).slice(2, 10)}.tmp`;
 	try {
-		await fs.writeFile(tmp, JSON.stringify(meta, null, 2));
-		await fs.rename(tmp, dest);
+		await fs$1.writeFile(tmp, JSON.stringify(meta, null, 2));
+		await fs$1.rename(tmp, dest);
 	} catch (err) {
-		await fs.rm(tmp, { force: true }).catch(() => {});
+		await fs$1.rm(tmp, { force: true }).catch(() => {});
 		throw err;
 	}
 }
@@ -16650,7 +15300,7 @@ async function colbertProjectDir(workspace) {
 	const indicesDir = PATHS.COLBERT_INDICES_DIR;
 	let names;
 	try {
-		names = await fs.readdir(indicesDir);
+		names = await fs$1.readdir(indicesDir);
 	} catch {
 		return null;
 	}
@@ -16660,7 +15310,7 @@ async function colbertProjectDir(workspace) {
 		const dir = path.join(indicesDir, name);
 		let proj;
 		try {
-			proj = JSON.parse(await fs.readFile(path.join(dir, "project.json"), "utf8"));
+			proj = JSON.parse(await fs$1.readFile(path.join(dir, "project.json"), "utf8"));
 		} catch {
 			continue;
 		}
@@ -16811,7 +15461,7 @@ function indexDirSignature(workspace) {
 */
 async function realpathForCompare(p) {
 	try {
-		return canonicalForCompare(await fs.realpath(p));
+		return canonicalForCompare(await fs$1.realpath(p));
 	} catch {
 		return canonicalForCompare(p);
 	}
@@ -17126,12 +15776,12 @@ async function runSemanticSearch(opts) {
 async function quarantineProjectDir(projectDir) {
 	const quarantine = `${projectDir}.corrupt-${process$1.pid}-${randomBytes(4).toString("hex")}`;
 	try {
-		await fs.rename(projectDir, quarantine);
+		await fs$1.rename(projectDir, quarantine);
 	} catch (err) {
 		consola.debug("colbert: corrupt index quarantine rename failed:", err);
 		return false;
 	}
-	const removal = fs.rm(quarantine, {
+	const removal = fs$1.rm(quarantine, {
 		recursive: true,
 		force: true
 	}).catch((err) => {
@@ -18174,6 +16824,18 @@ function appBrowserMcpDir() {
 	return dir;
 }
 /**
+* Memo for the interpreter probe below. The probe shells out to
+* `where`/`which`, which measured ~196ms per spawn on Windows, and it ran on
+* every browser tool call (twice, before the preflight was deduplicated).
+*
+* Only a SUCCESSFUL resolution is cached. `process.execPath` is the
+* fall-through when the probe fails, and caching that would pin a degraded
+* interpreter for the life of the process — including across a `node` install
+* that happens while the proxy is running. The path of an existing `node` on
+* PATH, by contrast, does not change mid-process in any way that matters here.
+*/
+let cachedBridgeInterpreter;
+/**
 * Pick a runtime interpreter for the bridge. The bridge uses Node's
 * binary-stdin framing for native messaging which Bun handles
 * differently (Bun closes the bridge prematurely as soon as anything
@@ -18182,6 +16844,7 @@ function appBrowserMcpDir() {
 * binary) only if node isn't on PATH.
 */
 function resolveBridgeInterpreter() {
+	if (cachedBridgeInterpreter !== void 0) return cachedBridgeInterpreter;
 	const probeCmd = platform() === "win32" ? "where" : "which";
 	try {
 		const out = execFileSync(probeCmd, ["node"], {
@@ -18193,7 +16856,10 @@ function resolveBridgeInterpreter() {
 			timeout: 2e3,
 			windowsHide: true
 		}).toString().trim().split(/\r?\n/)[0];
-		if (out) return out;
+		if (out) {
+			cachedBridgeInterpreter = out;
+			return out;
+		}
 	} catch {}
 	return process$1.execPath;
 }
@@ -18481,8 +17147,7 @@ async function probeHealth(port, token, timeoutMs = 500) {
 }
 function bridgeBundleExists() {
 	try {
-		readFileSync(bridgeBundlePath());
-		return true;
+		return statSync(bridgeBundlePath()).isFile();
 	} catch {
 		return false;
 	}
@@ -18607,9 +17272,41 @@ let _inFlightReady;
 * Always 0 in production (only incremented when imported by tests).
 */
 let __implInvocationsForTests = 0;
+/**
+* Short-lived cache of a READY result.
+*
+* The single-flight above only collapses CONCURRENT callers — it clears in
+* `.finally()`, so sequential calls each re-run the full impl. Every browser
+* tool call runs the check twice (once in `browserPreflight` before slot
+* acquisition, once in `dispatchBrowserTool`, which is deliberate so internal
+* compound dispatches stay fail-closed), and each run re-probes health and
+* re-installs the native-messaging host — spawning `where`/`which` (~196ms on
+* Windows) and `reg.exe` (~26ms) per detected browser, synchronously.
+*
+* Only a READY result is cached, and only briefly:
+*
+*   - Caching `install_required` would freeze a recoverable state — the user
+*     loading the extension, or installing a browser, would not take effect
+*     until restart. Those paths must stay self-healing.
+*   - The TTL is deliberately short. These checks also REPAIR drift (a deleted
+*     manifest, a cleared registry key), so the window in which that repair is
+*     skipped has to stay small. A few seconds collapses the double-check and
+*     a burst of calls without turning a self-healing probe into a one-shot.
+*/
+const READY_CACHE_TTL_MS = 5e3;
+let _readyCache;
 async function ensureBridgeReady() {
+	const cached = _readyCache;
+	if (cached && Date.now() - cached.at < READY_CACHE_TTL_MS) return cached.value;
 	if (_inFlightReady) return _inFlightReady;
-	_inFlightReady = _ensureBridgeReadyImpl().finally(() => {
+	_inFlightReady = _ensureBridgeReadyImpl().then((result) => {
+		if (!result.install_required) _readyCache = {
+			at: Date.now(),
+			value: result
+		};
+		else _readyCache = void 0;
+		return result;
+	}).finally(() => {
 		_inFlightReady = void 0;
 	});
 	return _inFlightReady;
@@ -18750,6 +17447,103 @@ function preflightUrlPolicy(toolName, args) {
 	return checkUrlPolicy(args.url);
 }
 //#endregion
+//#region src/lib/attachments.ts
+/**
+* Build a text + image tool result.
+*
+* TEXT FIRST, IMAGE SECOND — and this ordering is load-bearing for a reason
+* worth recording honestly: it is test-debt accommodation, not a design
+* argument. 75 assertions across the suite read `result.content[0].text`, and
+* putting the image first would break every one of them for no gain. Nothing
+* in the MCP spec or in any known consumer is sensitive to block order, so the
+* cheap accommodation wins. If that ever stops being true, codemod the
+* assertions rather than contorting the wire shape.
+*/
+function mcpTextAndImage(text, image) {
+	return { content: [{
+		type: "text",
+		text
+	}, {
+		type: "image",
+		data: image.data,
+		mimeType: image.mimeType
+	}] };
+}
+/**
+* Media types that appear in some Copilot model's
+* `capabilities.limits.vision.supported_media_types`. This is the UNION across
+* models, not a per-model allowlist — an individual model accepts a subset
+* (gemini takes heic/heif but not gif; the gpt and claude lanes take gif but
+* not heic). Per-model narrowing is the outbound validator's job; this set only
+* answers "is this an image shape any Copilot model could take at all".
+*/
+const SUPPORTED_IMAGE_MIME_TYPES = /* @__PURE__ */ new Set([
+	"image/jpeg",
+	"image/png",
+	"image/webp",
+	"image/gif",
+	"image/heic",
+	"image/heif"
+]);
+function startsWith(bytes, offset, sig) {
+	if (bytes.length < offset + sig.length) return false;
+	for (const [i, element] of sig.entries()) if (bytes[offset + i] !== element) return false;
+	return true;
+}
+function startsWithAscii(bytes, offset, ascii) {
+	return startsWith(bytes, offset, [...ascii].map((c) => c.codePointAt(0) ?? 0));
+}
+const PNG_SIGNATURE = [
+	137,
+	80,
+	78,
+	71,
+	13,
+	10,
+	26,
+	10
+];
+/**
+* Identify an image by its leading bytes, returning a media type from
+* `SUPPORTED_IMAGE_MIME_TYPES` or `undefined` when the bytes are not a
+* supported image.
+*
+* `undefined` is a deliberate two-in-one answer: "not an image" and "an image
+* kind nothing upstream accepts" are the same outcome for every caller here,
+* because both mean the bytes must not be sent as an image block.
+*
+* Truncated and malformed inputs return `undefined` rather than throwing — a
+* caller reading an arbitrary file off disk must not be able to crash a tool
+* dispatch with a 3-byte file.
+*/
+function detectImageMimeType(bytes) {
+	if (startsWith(bytes, 0, [
+		255,
+		216,
+		255
+	])) return bytes[3] === 247 ? void 0 : "image/jpeg";
+	if (startsWith(bytes, 0, PNG_SIGNATURE)) return bytes.length >= 16 && new DataView(bytes.buffer, bytes.byteOffset).getUint32(PNG_SIGNATURE.length) === 13 && startsWithAscii(bytes, 12, "IHDR") ? "image/png" : void 0;
+	if (startsWithAscii(bytes, 0, "GIF8")) return "image/gif";
+	if (startsWithAscii(bytes, 0, "RIFF") && startsWithAscii(bytes, 8, "WEBP")) return "image/webp";
+	if (startsWithAscii(bytes, 4, "ftyp")) {
+		const brand = new TextDecoder().decode(bytes.subarray(8, 12));
+		if (brand === "heic" || brand === "heix" || brand === "hevc" || brand === "hevx") return "image/heic";
+		if (brand === "mif1" || brand === "msf1" || brand === "heim" || brand === "heis") return "image/heif";
+	}
+}
+/** Decode base64 for size-validation purposes; see the notes inside. */
+function decodeBase64Strict(input) {
+	const compact = input.replaceAll(/[\s]/g, "");
+	if (compact.length === 0) return null;
+	if (!/^[A-Za-z0-9+/]*={0,2}$/.test(compact)) return null;
+	const remainder = compact.length % 4;
+	if (remainder === 1) return null;
+	const padded = remainder === 0 ? compact : compact + "=".repeat(4 - remainder);
+	const buf = Buffer.from(padded, "base64");
+	if (buf.toString("base64") !== padded) return null;
+	return new Uint8Array(buf);
+}
+//#endregion
 //#region src/lib/browser-mcp/dispatch.ts
 /**
 * Tools whose dispatch counts as a mutating user action for pacing
@@ -18969,6 +17763,52 @@ async function bridgeCall(endpoint, tool, args, timeoutMs, signal) {
 		});
 	});
 }
+/**
+* Turn a bridge envelope that carries captured pixels into a real MCP image
+* block, or return `null` when it doesn't (the overwhelmingly common case —
+* every non-screenshot tool).
+*
+* The extension returns `{contentType, dataBase64}` for `browser_screenshot`.
+* That used to be `JSON.stringify`'d into a text block, which meant the calling
+* model received base64 characters it could not interpret, at roughly 130x the
+* token cost of the same image sent natively (base64 tokenizes at ~1.46
+* chars/token under o200k, so a 200 KB PNG is ~187k tokens — enough to be
+* rejected outright by a 200k-context model).
+*
+* Two deliberate choices:
+*
+*  - The media type is SNIFFED from the bytes, not taken from the envelope's
+*    `contentType`. A declared type is an assertion; the payload is what
+*    upstream will actually try to decode. The declared value is preserved in
+*    the text block so a mismatch stays debuggable.
+*  - The text block keeps every envelope field EXCEPT `dataBase64`, and gains
+*    a decoded `bytes` count. Callers that parsed the JSON metadata keep
+*    working; the payload simply stops being duplicated in a form nothing
+*    could read.
+*
+* Bytes that don't decode strictly, or that aren't a supported image, fall
+* through to `null` and take the plain-text path — a malformed capture must
+* not become an image block that upstream then rejects.
+*/
+function imageEnvelope(data) {
+	if (data === null || typeof data !== "object" || Array.isArray(data)) return null;
+	const record = data;
+	const encoded = record.dataBase64;
+	if (typeof encoded !== "string" || encoded.length === 0) return null;
+	const bytes = decodeBase64Strict(encoded);
+	if (!bytes) return null;
+	const mimeType = detectImageMimeType(bytes);
+	if (!mimeType) return null;
+	const meta = {
+		bytes: bytes.length,
+		mimeType
+	};
+	for (const [key, value] of Object.entries(record)) if (key !== "dataBase64") meta[key] = value;
+	return mcpTextAndImage(JSON.stringify(meta, null, 2), {
+		data: encoded,
+		mimeType
+	});
+}
 function blockedUrlEnvelope(reason) {
 	return {
 		content: [{
@@ -19034,7 +17874,6 @@ async function dispatchBrowserTool(tool, args, signal, opts = {}) {
 			token: ready.token
 		}, tool, args, callerTimeout, signal);
 		if (resp.ok) {
-			const text = typeof resp.data === "string" ? resp.data : JSON.stringify(resp.data, null, 2);
 			logAudit$1({
 				tool,
 				argsBytes: argsByteSize(args),
@@ -19042,9 +17881,9 @@ async function dispatchBrowserTool(tool, args, signal, opts = {}) {
 				profile: typeof args.profile === "string" ? args.profile : "isolated",
 				result: "ok"
 			});
-			return { content: [{
+			return imageEnvelope(resp.data) ?? { content: [{
 				type: "text",
-				text
+				text: typeof resp.data === "string" ? resp.data : JSON.stringify(resp.data, null, 2)
 			}] };
 		}
 		logAudit$1({
@@ -19094,7 +17933,7 @@ function logAudit$1(record) {
 		try {
 			const fs = await import("node:fs/promises");
 			const path = await import("node:path");
-			const { PATHS } = await import("./paths-D3XgmTcQ.js");
+			const { PATHS } = await import("./paths-CwKwc2pi.js");
 			const dir = path.join(PATHS.APP_DIR, "browser-mcp");
 			await fs.mkdir(dir, { recursive: true });
 			const line = JSON.stringify({
@@ -19674,6 +18513,169 @@ function currentInFlight() {
 	return inFlight$2;
 }
 //#endregion
+//#region src/lib/vision-preflight.ts
+/**
+* Outbound vision preflight.
+*
+* Converts what would otherwise be an opaque upstream `400` into a local,
+* actionable rejection — the same trade `predictedWindowOverflow` in
+* `src/routes/mcp/handler.ts` already makes for prompt tokens, and the reason
+* this file exists at all: `capabilities.limits.vision` advertises three fields
+* (`max_prompt_images`, `max_prompt_image_size`, `supported_media_types`) and
+* until now the proxy read exactly one of them, in the `models` pretty-printer.
+*
+* WHY ONE CHOKEPOINT, NOT PER-ADAPTER CHECKS
+*
+* Images reach the wire through more paths than is obvious: a top-level user
+* block, a block nested inside a `tool_result`, the synthetic follow-up user
+* message the shim emits because a tool-output item cannot carry images, images
+* already present in replayed conversation history, and peer-critic
+* attachments. Validating in each adapter means each adapter has to
+* rediscover every one of those shapes, and the ones it forgets fail silently.
+* So validation runs ONCE, on the fully assembled payload, immediately before
+* transport serialization — `createResponses` and `createChatCompletions` — and
+* is therefore total by construction.
+*
+* POLICY ON MISSING METADATA
+*
+* Deliberately NOT fail-open. "We don't know the limit" is not "there is no
+* limit"; treating it as the latter reproduces the exact opaque-400 this
+* module exists to remove. The three cases are distinguished:
+*
+*   - model absent from the catalog entirely → ALLOW. We have no basis for a
+*     judgement, upstream remains authoritative, and blocking would break
+*     custom catalogs and offline tests. This mirrors `modelSupportsEndpoint`.
+*   - model present, `supports.vision` not true → REJECT, naming the model.
+*   - model present, vision supported, limits absent → CONSERVATIVE FLOOR
+*     (`FLOOR_MAX_IMAGES` / `FLOOR_MAX_IMAGE_BYTES`), and the message says so,
+*     so the caller can tell a real limit from an assumed one.
+*
+* Error strings are returned to callers and end up in front of a model, so they
+* name the model, the numbers, and the fix — never a stack, a local path, or a
+* raw catalog object.
+*/
+/**
+* Floor applied when a model advertises vision but publishes no limits. Every
+* vision-capable model in the live catalog reports at least 1 image and a
+* 3 MiB ceiling, so this is the observed minimum rather than a guess.
+*/
+const FLOOR_MAX_IMAGES = 1;
+const FLOOR_MAX_IMAGE_BYTES = 3145728;
+/**
+* Split a `data:<mime>;base64,<payload>` URI. Returns `null` for any other URL
+* shape (including a plain remote `https://` reference, which the caller
+* handles separately because its bytes are not ours to inspect).
+*/
+function parseDataUrl(url) {
+	const match = /^data:([^;,]+);base64,(.*)$/s.exec(url);
+	if (!match) return null;
+	return {
+		mimeType: match[1],
+		base64: match[2]
+	};
+}
+function reject(message) {
+	return {
+		ok: false,
+		message
+	};
+}
+/**
+* Validate every image on an outbound request against the resolved model's
+* advertised vision capability.
+*
+* Remote-URL images are counted toward the cardinality limit but not size- or
+* type-checked: the bytes live on someone else's server, so any local claim
+* about them would be fiction. Upstream stays authoritative for those.
+*/
+function checkOutboundImages(modelId, images) {
+	if (images.length === 0) return { ok: true };
+	const model = state.models?.data.find((m) => m.id === modelId);
+	if (!model) return { ok: true };
+	if ((model.capabilities?.supports)?.vision !== true) return reject(`Model ${modelId} does not support image input. Send text only, or select a vision-capable model.`);
+	const limits = model.capabilities?.limits?.vision;
+	const maxImages = limits?.max_prompt_images ?? FLOOR_MAX_IMAGES;
+	const maxBytes = limits?.max_prompt_image_size ?? FLOOR_MAX_IMAGE_BYTES;
+	const assumed = limits?.max_prompt_images === void 0 ? " (assumed; the model publishes no image limits)" : "";
+	if (images.length > maxImages) return reject(`Model ${modelId} accepts at most ${maxImages} image(s) per request${assumed}, but this request carries ${images.length}. Send fewer images, or use a model with a higher image limit.`);
+	const allowedTypes = limits?.supported_media_types;
+	for (const [index, image] of images.entries()) {
+		if (image.url !== void 0 && image.base64 === void 0) continue;
+		const position = `image ${index + 1} of ${images.length}`;
+		if (image.declaredMimeType === void 0 || image.declaredMimeType.length === 0) return reject(`${position} has no media type. Anthropic's \`source.media_type\` (or a \`data:<mime>;base64,\` prefix) is required — it used to be defaulted, which silently asserted a type the model may not accept.`);
+		if (image.base64 === void 0) continue;
+		const bytes = decodeBase64Strict(image.base64);
+		if (!bytes) return reject(`${position} is not valid base64 and cannot be sent.`);
+		if (bytes.length > maxBytes) return reject(`${position} is ${bytes.length} bytes, over model ${modelId}'s ${maxBytes}-byte limit${assumed}. Re-capture at a smaller scale or lower quality.`);
+		const actual = detectImageMimeType(bytes);
+		if (!actual) return reject(`${position} is declared ${image.declaredMimeType} but its bytes are not a supported image (jpeg, png, webp, gif, heic, heif).`);
+		if (actual !== image.declaredMimeType) return reject(`${position} is declared ${image.declaredMimeType} but its bytes are ${actual}. Send the correct media type.`);
+		if (allowedTypes && allowedTypes.length > 0 && !allowedTypes.includes(actual)) return reject(`${position} is ${actual}, which model ${modelId} does not accept. Supported: ${allowedTypes.join(", ")}.`);
+	}
+	return { ok: true };
+}
+/** Collect the images on an assembled Copilot `/responses` payload. */
+function imagesInResponsesPayload(input) {
+	const images = [];
+	if (!Array.isArray(input)) return images;
+	for (const item of input) {
+		if (item === null || typeof item !== "object") continue;
+		const content = item.content;
+		if (!Array.isArray(content)) continue;
+		for (const part of content) {
+			if (part === null || typeof part !== "object") continue;
+			const p = part;
+			if (p.type !== "input_image" || typeof p.image_url !== "string") continue;
+			images.push(fromUrl(p.image_url));
+		}
+	}
+	return images;
+}
+/** Collect the images on an assembled Copilot `/chat/completions` payload. */
+function imagesInChatPayload(messages) {
+	const images = [];
+	if (!Array.isArray(messages)) return images;
+	for (const message of messages) {
+		if (message === null || typeof message !== "object") continue;
+		const content = message.content;
+		if (!Array.isArray(content)) continue;
+		for (const part of content) {
+			if (part === null || typeof part !== "object") continue;
+			const p = part;
+			if (p.type !== "image_url") continue;
+			const url = p.image_url?.url;
+			if (typeof url !== "string") continue;
+			images.push(fromUrl(url));
+		}
+	}
+	return images;
+}
+function fromUrl(url) {
+	const parsed = parseDataUrl(url);
+	return parsed ? {
+		base64: parsed.base64,
+		declaredMimeType: parsed.mimeType
+	} : { url };
+}
+/**
+* Run the preflight and throw a client-visible 400 when it fails.
+*
+* Shaped as an `HTTPError` carrying a synthetic `Response` so it flows through
+* the existing `forwardError` path and reaches the client as a normal
+* Anthropic-format `invalid_request_error` — the same envelope an upstream
+* rejection would produce, except it names the actual problem and no upstream
+* request was made. Tests assert that second property: a preflight failure must
+* cost zero upstream calls.
+*/
+function assertOutboundImagesOk(modelId, images) {
+	const verdict = checkOutboundImages(modelId, images);
+	if (verdict.ok) return;
+	throw new HTTPError(verdict.message, new Response(JSON.stringify({ error: { message: verdict.message } }), {
+		status: 400,
+		headers: { "content-type": "application/json" }
+	}));
+}
+//#endregion
 //#region src/lib/diagnose-response.ts
 const PREVIEW_LIMIT = 200;
 async function parseJsonOrDiagnose(response, routePath) {
@@ -19795,6 +18797,7 @@ async function readResponseBodyCapped(response, routePath, capBytes = MAX_RESPON
 const createChatCompletions = async (payload, modelHeaders, callerSignal, retryTransient = false) => {
 	if (!state.copilotToken) throw new Error("Copilot token not found");
 	const enableVision = payload.messages.some((x) => typeof x.content !== "string" && x.content?.some((x) => x.type === "image_url"));
+	if (enableVision) assertOutboundImagesOk(payload.model, imagesInChatPayload(payload.messages));
 	const isAgentCall = payload.messages.some((msg) => ["assistant", "tool"].includes(msg.role));
 	const url = `${copilotBaseUrl(state)}/chat/completions`;
 	const doFetch = () => {
@@ -19828,11 +18831,12 @@ const createChatCompletions = async (payload, modelHeaders, callerSignal, retryT
 		}
 		const claudeModels = state.models?.data.filter((m) => m.id.startsWith("claude")).map((m) => m.id).join(", ") ?? "(models not loaded)";
 		consola.error(`Copilot rejected model "${payload.model}": ${response.status} ${errorBody} (available Claude models: ${claudeModels})`);
-		throw new HTTPError("Failed to create chat completions", new Response(errorBody, {
+		const reconstructed = new Response(errorBody, {
 			status: response.status,
 			statusText: response.statusText,
 			headers: response.headers
-		}));
+		});
+		throw new HTTPError("Failed to create chat completions", reconstructed);
 	}
 	if (payload.stream) return events(response);
 	const cappedResult = await readResponseBodyCapped(response, "/v1/chat/completions", MAX_RESPONSE_BODY_BYTES);
@@ -19857,6 +18861,7 @@ const createChatCompletions = async (payload, modelHeaders, callerSignal, retryT
 const createResponses = async (payload, modelHeaders, callerSignal, retryTransient = false) => {
 	if (!state.copilotToken) throw new Error("Copilot token not found");
 	const enableVision = detectVision(payload.input);
+	if (enableVision) assertOutboundImagesOk(payload.model, imagesInResponsesPayload(payload.input));
 	const isAgentCall = detectAgentCall(payload.input);
 	const url = `${copilotBaseUrl(state)}/responses`;
 	const doFetch = () => {
@@ -20878,7 +19883,7 @@ const BROWSER_TOOLS = Object.freeze([
 	},
 	{
 		toolNameHttp: "browser_screenshot",
-		description: "Captures a screenshot of the visible area of a tab, as PNG by default or JPEG when requested. It takes a tab id and optional format, then returns base64-encoded image bytes plus contentType. The tab must be active in its window, so this tool auto-activates the tab if needed and that changes which tab is focused. Use screenshot for visual layout, canvas, SVG, maps, or image-only regions; prefer browser_observe when page text and actionable state are enough.",
+		description: "Captures a screenshot of the visible area of a tab and returns it as an image you can actually look at, plus a small text envelope of capture metadata. It takes a tab id, an optional format (PNG default, JPEG for smaller bytes), and an optional JPEG quality. The tab must be active in its window, so this tool auto-activates the tab if needed and that changes which tab is focused. If a capture is rejected for exceeding a model's image-size limit, the most reliable lever is a smaller browser window; PNG is usually SMALLER than JPEG for ordinary UI and text pages, so switching format is not a dependable way to shrink one. JPEG plus a low quality helps mainly for photographic or dense-colour content. Use screenshot for visual layout, canvas, SVG, maps, or image-only regions; prefer browser_observe when page text and actionable state are enough.",
 		inputSchema: {
 			type: "object",
 			required: ["tabId"],
@@ -20892,6 +19897,12 @@ const BROWSER_TOOLS = Object.freeze([
 					type: "string",
 					enum: ["png", "jpeg"],
 					description: "Image format for the returned screenshot. Default 'png'; use 'jpeg' when smaller image bytes are preferable."
+				},
+				quality: {
+					type: "number",
+					minimum: 1,
+					maximum: 100,
+					description: "JPEG quality 1-100 (ignored for PNG). Only meaningful with format='jpeg'. Note JPEG is often LARGER than PNG for flat UI screenshots — measured on a plain documentation page, PNG 35553 bytes vs JPEG q30 40599 bytes at the same viewport — so reach for it for photographic content, not as a general size lever."
 				}
 			}
 		},
@@ -21622,21 +20633,12 @@ async function runAtomicIntentStep(tabId, intent, value, signal) {
 				error: "no text match; screenshot for visual fallback failed",
 				picked
 			}, true);
-			const shotText = shotEnv.content?.[0]?.text;
-			let shot = {};
-			try {
-				shot = shotText ? JSON.parse(shotText) : {};
-			} catch {
-				return toolEnvelope({
-					ok: false,
-					error: "no text match; screenshot envelope unparseable"
-				}, true);
-			}
-			if (!shot.contentType || !shot.dataBase64) return toolEnvelope({
+			const shot = shotEnv.content.find((b) => b.type === "image");
+			if (!shot) return toolEnvelope({
 				ok: false,
-				error: "no text match; screenshot envelope missing fields"
+				error: "no text match; screenshot returned no image"
 			}, true);
-			const visual = await pickElementVisual(shot.dataBase64, shot.contentType, intent, surfaces, signal);
+			const visual = await pickElementVisual(shot.data, shot.mimeType, intent, surfaces, signal);
 			if (visual.confidence < .5) return toolEnvelope({
 				ok: false,
 				error: "no element matched intent (text + visual)",
@@ -24232,10 +23234,14 @@ async function runChatAttempt(stream, payload, opts, signal, state) {
 	let nextContentIndex = 0;
 	let activeTextIndex = null;
 	const toolPiIndexByOAI = /* @__PURE__ */ new Map();
+	let sawDone = false;
 	for await (const evt of sseStream) {
 		const data = evt?.data;
 		if (data == null) continue;
-		if (data === "[DONE]") break;
+		if (data === "[DONE]") {
+			sawDone = true;
+			break;
+		}
 		let chunk;
 		try {
 			chunk = JSON.parse(data);
@@ -24328,12 +23334,26 @@ async function runChatAttempt(stream, payload, opts, signal, state) {
 		if (choice.finish_reason) accum.finishReason = choice.finish_reason;
 	}
 	if (!state.active) return;
+	if (!sawDone && accum.finishReason == null) {
+		if (activeTextIndex != null) stream.push({
+			type: "text_end",
+			contentIndex: activeTextIndex,
+			content: joinTextChunks(accum, activeTextIndex),
+			partial: buildPartial(resolved, accum)
+		});
+		pushTerminalError(stream, resolved, /* @__PURE__ */ new Error("chat stream ended without a [DONE] sentinel (truncated)"));
+		return;
+	}
 	if (activeTextIndex != null) stream.push({
 		type: "text_end",
 		contentIndex: activeTextIndex,
 		content: joinTextChunks(accum, activeTextIndex),
 		partial: buildPartial(resolved, accum)
 	});
+	if (accum.finishReason === "content_filter") {
+		pushTerminalError(stream, resolved, /* @__PURE__ */ new Error("upstream content filter blocked the response"));
+		return;
+	}
 	for (const block of accum.blocks) {
 		if (block.kind !== "tool") continue;
 		const entry = accum.toolByIndex.get(block.contentIndex);
@@ -24359,10 +23379,7 @@ function buildPayload(context, resolved) {
 		role: "system",
 		content: context.systemPrompt
 	});
-	for (const m of context.messages) {
-		const oai = translateMessage(m);
-		if (oai) messages.push(oai);
-	}
+	messages.push(...translateMessages(context.messages));
 	const tools = translateTools(context.tools);
 	const payload = {
 		model: resolved.modelId,
@@ -24376,11 +23393,55 @@ function buildPayload(context, resolved) {
 	if (resolved.thinking !== "off") payload.reasoning_effort = resolved.thinking;
 	return payload;
 }
-function translateMessage(m) {
-	if (m.role === "user") return translateUser(m);
-	if (m.role === "assistant") return translateAssistant(m);
-	if (m.role === "toolResult") return translateToolResult(m);
-	return null;
+/**
+* Pi messages → wire messages, with tool-result images hoisted to the END of
+* each contiguous run of tool results.
+*
+* A tool-output wire item cannot carry an image, so images have to ride in a
+* separate user message. The obvious implementation — fan each `toolResult` out
+* to `[tool, user]` independently — is WRONG for parallel tool calls: it yields
+* `tool A, user A, tool B, user B`, and every provider requires the tool
+* messages answering one assistant turn to be CONTIGUOUS. The interjected user
+* message orphans the following tool message and the request is rejected.
+*
+* So images accumulate across the run and flush once, after the last tool
+* message of that run: `tool A, tool B, user(imgA, imgB)`.
+*
+* This runs at REQUEST-ASSEMBLY time over `context.messages` and never writes
+* back to worker state, so the synthetic message is ephemeral — an image is not
+* appended to the transcript and re-sent on every later turn.
+*/
+function translateMessages(messages) {
+	const out = [];
+	let pending = [];
+	const flushImages = () => {
+		if (pending.length === 0) return;
+		out.push({
+			role: "user",
+			content: pending.map((img) => ({
+				type: "image_url",
+				image_url: { url: `data:${img.mimeType};base64,${img.data}` }
+			}))
+		});
+		pending = [];
+	};
+	for (const m of messages) {
+		if (m.role === "toolResult") {
+			const images = imagePartsOf(m.content);
+			out.push({
+				role: "tool",
+				tool_call_id: m.toolCallId,
+				content: toolResultText(m, images.length > 0)
+			});
+			pending.push(...images);
+			continue;
+		}
+		flushImages();
+		if (m.role === "user") out.push(translateUser(m));
+		else if (m.role === "assistant") out.push(translateAssistant(m));
+	}
+	flushImages();
+	return out;
 }
 function translateUser(m) {
 	if (typeof m.content === "string") return {
@@ -24423,13 +23484,6 @@ function translateAssistant(m) {
 	if (toolCalls.length > 0) out.tool_calls = toolCalls;
 	return out;
 }
-function translateToolResult(m) {
-	return {
-		role: "tool",
-		tool_call_id: m.toolCallId,
-		content: joinTextParts(m.content)
-	};
-}
 function translateTools(tools) {
 	if (!tools || tools.length === 0) return void 0;
 	return tools.map((t) => ({
@@ -24441,6 +23495,37 @@ function translateTools(tools) {
 		}
 	}));
 }
+/** The image parts of a Pi tool result, in wire order. */
+function imagePartsOf(parts) {
+	const out = [];
+	for (const p of parts) {
+		if (p.type !== "image") continue;
+		if (typeof p.data !== "string" || p.data.length === 0) continue;
+		out.push({
+			data: p.data,
+			mimeType: p.mimeType ?? "image/png"
+		});
+	}
+	return out;
+}
+/**
+* The text of a tool result, with two pieces of information restored that were
+* previously thrown away:
+*
+*  - `isError`. Pi records it on the message, but the wire tool-output item has
+*    no error flag, so without a marker the model could not tell a failed call
+*    from a successful one. The Anthropic shim has always prefixed
+*    `[tool error]`; this matches it.
+*  - a pointer to the follow-up image message, when the tool returned only
+*    images. An empty tool output is confusing on its own; naming what follows
+*    is not.
+*/
+function toolResultText(m, hasImages) {
+	let text = joinTextParts(m.content);
+	if (hasImages && text.length === 0) text = "[image result below]";
+	if (m.isError === true) text = text.length > 0 ? `[tool error] ${text}` : "[tool error]";
+	return text;
+}
 function joinTextParts(parts) {
 	let s = "";
 	for (const p of parts) if (p.type === "text" && typeof p.text === "string") s += p.text;
@@ -24513,6 +23598,7 @@ async function runResponsesAttempt(stream, payload, opts, signal, state) {
 		});
 		activeTextIndex = null;
 	};
+	let sawTerminal = false;
 	for await (const evt of sseStream) {
 		const data = evt?.data;
 		if (data == null) continue;
@@ -24658,6 +23744,7 @@ async function runResponsesAttempt(stream, payload, opts, signal, state) {
 			}
 			case "response.completed":
 			case "response.incomplete":
+				sawTerminal = true;
 				accum.usage = mapResponsesUsage(ev.response?.usage);
 				if (ev.type === "response.incomplete" && ev.response?.incomplete_details?.reason === "max_output_tokens") accum.finishReason = "length";
 				if (opts.onChunk && accum.usage) try {
@@ -24679,6 +23766,11 @@ async function runResponsesAttempt(stream, payload, opts, signal, state) {
 		}
 	}
 	if (!state.active) return;
+	if (!sawTerminal) {
+		closeActiveText();
+		pushTerminalError(stream, resolved, /* @__PURE__ */ new Error("responses stream ended without a terminal event (truncated)"));
+		return;
+	}
 	closeActiveText();
 	for (const block of accum.blocks) {
 		if (block.kind !== "tool") continue;
@@ -24702,11 +23794,7 @@ async function runResponsesAttempt(stream, payload, opts, signal, state) {
 	});
 }
 function buildResponsesPayload(context, resolved) {
-	const messages = [];
-	for (const m of context.messages) {
-		const neutral = piMessageToNeutral(m);
-		if (neutral) messages.push(neutral);
-	}
+	const messages = piMessagesToNeutral(context.messages);
 	return assembleResponsesPayload({
 		model: resolved.modelId,
 		instructions: context.systemPrompt || void 0,
@@ -24716,50 +23804,82 @@ function buildResponsesPayload(context, resolved) {
 		stream: true
 	});
 }
-function piMessageToNeutral(m) {
-	if (m.role === "user") {
-		if (typeof m.content === "string") return {
+/**
+* Pi messages → neutral messages, with tool-result images hoisted to the end of
+* each contiguous run of tool results.
+*
+* Exact twin of `translateMessages` on the chat path — see that doc comment for
+* why the grouping is load-bearing rather than cosmetic. A per-message fan-out
+* interleaves a user message between parallel `function_call_output` items,
+* which at best is a shape no client emits and at worst is rejected outright.
+*/
+function piMessagesToNeutral(messages) {
+	const out = [];
+	let pending = [];
+	const flushImages = () => {
+		if (pending.length === 0) return;
+		out.push({
 			role: "user",
-			content: m.content
-		};
-		const parts = [];
-		for (const c of m.content) if (c.type === "text") parts.push({
-			type: "text",
-			text: c.text
-		});
-		else if (c.type === "image") parts.push({
-			type: "image",
-			mimeType: c.mimeType,
-			data: c.data
+			content: pending.map((img) => ({
+				type: "image",
+				mimeType: img.mimeType,
+				data: img.data
+			}))
 		});
-		return {
+		pending = [];
+	};
+	for (const m of messages) {
+		if (m.role === "toolResult") {
+			const images = imagePartsOf(m.content);
+			out.push({
+				role: "toolResult",
+				toolCallId: m.toolCallId,
+				output: toolResultText(m, images.length > 0)
+			});
+			pending.push(...images);
+			continue;
+		}
+		flushImages();
+		if (m.role === "user") if (typeof m.content === "string") out.push({
 			role: "user",
-			content: parts
-		};
-	}
-	if (m.role === "assistant") {
-		const parts = [];
-		for (const c of m.content) if (c.type === "text") parts.push({
-			type: "text",
-			text: c.text
-		});
-		else if (c.type === "toolCall") parts.push({
-			type: "toolCall",
-			id: c.id,
-			name: c.name,
-			arguments: c.arguments
+			content: m.content
 		});
-		return {
-			role: "assistant",
-			content: parts
-		};
+		else {
+			const parts = [];
+			for (const c of m.content) if (c.type === "text") parts.push({
+				type: "text",
+				text: c.text
+			});
+			else if (c.type === "image") parts.push({
+				type: "image",
+				mimeType: c.mimeType,
+				data: c.data
+			});
+			out.push({
+				role: "user",
+				content: parts
+			});
+		}
+		else if (m.role === "assistant") {
+			const parts = [];
+			for (const c of m.content) if (c.type === "text") parts.push({
+				type: "text",
+				text: c.text
+			});
+			else if (c.type === "toolCall") parts.push({
+				type: "toolCall",
+				id: c.id,
+				name: c.name,
+				arguments: c.arguments
+			});
+			out.push({
+				role: "assistant",
+				content: parts
+			});
+		}
 	}
-	if (m.role === "toolResult") return {
-		role: "toolResult",
-		toolCallId: m.toolCallId,
-		output: joinTextParts(m.content)
-	};
-	return null;
+	flushImages();
+	return out;
 }
 function piToolsToNeutral(tools) {
 	if (!tools || tools.length === 0) return void 0;
@@ -25094,7 +24214,37 @@ function argsRecord(params) {
 * `tools.ts` uses for `peer_review`.
 */
 function joinEnvelopeText(env) {
-	return (env.content ?? []).map((c) => c.text).join("\n");
+	return (env.content ?? []).filter((c) => c.type === "text").map((c) => c.text).join("\n");
+}
+/**
+* Wrap a text payload PLUS a captured image in Pi's tool-result shape.
+*
+* The browse worker's own system prompt tells it to "use screenshot to SEE the
+* page", but every result was flattened to text — so the pixels never reached
+* it and it received base64 characters instead. Pi's tool-result content
+* supports image blocks natively, and the engine's `afterToolCall` cap
+* (`tool-output-cap.ts`) already preserves them and exempts them from the text
+* byte cap. Nothing was ever producing one.
+*
+* Text first, image second — same ordering rule as the MCP surface
+* (`mcpTextAndImage`), so a consumer reading the first block still finds text.
+*/
+function imageResult$1(text, image) {
+	return {
+		content: [{
+			type: "text",
+			text
+		}, {
+			type: "image",
+			data: image.data,
+			mimeType: image.mimeType
+		}],
+		details: {}
+	};
+}
+/** The first image block on a dispatch envelope, if the tool captured one. */
+function envelopeImage(env) {
+	return (env.content ?? []).find((c) => c.type === "image");
 }
 /**
 * How a tool interacts with a session's owned tabs:
@@ -25390,7 +24540,8 @@ function makeBrowserTool(meta, parameters, dispatch, sessionId) {
 					if (typeof tabId === "number") recordSessionTab(sessionId, tabId);
 				} else if (policy === "closes") for (const tabId of toNumberArray(args.tabIds)) releaseSessionTab(sessionId, tabId);
 			}
-			return textResult$1(text);
+			const image = envelopeImage(env);
+			return image ? imageResult$1(text, image) : textResult$1(text);
 		}
 	};
 	if (meta.executionMode) tool.executionMode = meta.executionMode;
@@ -25660,6 +24811,62 @@ function truncateModelText(text, capBytes) {
 	return head + notice + tail;
 }
 /**
+* Per-result image budget.
+*
+* Images are cheap in TOKENS (a vision image costs ~1.5k regardless of byte
+* size) but not in BYTES: three 3 MiB captures is ~12 MiB of base64 on the wire
+* and in memory, and they accumulate across turns. The text cap does not bound
+* them — and should not, since counting base64 against a text budget would
+* evict real text to make room for an image the model reads for free.
+*
+* `MAX_IMAGES_PER_RESULT` is the ceiling of the most permissive model in the
+* live catalog (gemini's 10). `MAX_IMAGE_BYTES_PER_RESULT` is the published
+* 3 MiB per-image ceiling times a small factor, so a legitimate multi-image
+* result passes and a runaway one does not.
+*/
+const MAX_IMAGES_PER_RESULT = 10;
+const MAX_IMAGE_BYTES_PER_RESULT = 12582912;
+/** Decoded byte size of a base64 payload, without allocating the buffer. */
+function base64Bytes(data) {
+	if (typeof data !== "string" || data.length === 0) return 0;
+	const padding = data.endsWith("==") ? 2 : data.endsWith("=") ? 1 : 0;
+	return Math.floor(data.length * 3 / 4) - padding;
+}
+/**
+* Trim an image list to the budget, returning the survivors plus a note naming
+* what was dropped. Dropping silently is not an option: a model told to compare
+* five screenshots, shown three, and given no indication, will reason
+* confidently about a set it never saw.
+*/
+function capImages(images) {
+	const kept = [];
+	let bytes = 0;
+	let dropped = 0;
+	for (const img of images) {
+		if (kept.length >= MAX_IMAGES_PER_RESULT) {
+			dropped++;
+			continue;
+		}
+		const size = base64Bytes(img.data);
+		if (bytes + size > MAX_IMAGE_BYTES_PER_RESULT) {
+			dropped++;
+			continue;
+		}
+		bytes += size;
+		kept.push(img);
+	}
+	if (dropped === 0) return {
+		kept,
+		note: void 0
+	};
+	return {
+		kept,
+		note: NEWLINE + NEWLINE + `[...${dropped} of ${images.length} image(s) dropped: over the per-result budget of ${MAX_IMAGES_PER_RESULT} images / ${Math.round(MAX_IMAGE_BYTES_PER_RESULT / 1048576)} MiB. Request fewer images at a time, or capture at a lower quality....]`
+	};
+}
+/** Literal newline, kept out of the template above for readability. */
+const NEWLINE = "\n";
+/**
 * Cap a tool result's TEXT content to `capBytes`, preserving any non-text
 * (image) blocks. Returns the replacement content array, or `undefined` when
 * the result is already under the cap (caller leaves it untouched).
@@ -25680,20 +24887,180 @@ function capToolResultText(content, capBytes) {
 	let textBytes = 0;
 	const texts = [];
 	const images = [];
+	const other = [];
 	for (const block of content) {
 		if (!block || typeof block !== "object") continue;
 		const b = block;
 		if (b.type === "text" && typeof b.text === "string") {
 			texts.push(b.text);
 			textBytes += Buffer.byteLength(b.text, "utf8");
-		} else images.push(block);
+		} else if (b.type === "image") images.push(block);
+		else other.push(block);
 	}
-	if (textBytes <= capBytes) return void 0;
-	const capped = truncateModelText(texts.join("\n"), capBytes);
-	return [...images, {
-		type: "text",
-		text: capped
-	}];
+	const { kept, note } = capImages(images);
+	if (textBytes <= capBytes && note === void 0) return void 0;
+	const joined = texts.join(NEWLINE);
+	const capped = textBytes > capBytes ? truncateModelText(joined, capBytes) : joined;
+	return [
+		...kept,
+		...other,
+		{
+			type: "text",
+			text: capped + (note ?? "")
+		}
+	];
+}
+//#endregion
+//#region src/lib/peer-attachments.ts
+/**
+* Server-side image loading for peer-critic attachments (`imagePaths`).
+*
+* WHY PATHS AND NOT BASE64
+*
+* The obvious schema would take base64 directly. It would also mean megabytes
+* of payload crossing the MCP boundary and sitting in the CALLER's context — the
+* exact cost the browser-screenshot fix exists to remove — and it would trip the
+* `predictedTooLong` pre-flight, which sizes the brief before a slot is
+* acquired. Reading the bytes here instead keeps the caller's context clean and
+* the wire small: the caller sends a path, the proxy sends the pixels.
+*
+* The proxy and the caller are the same machine in this product (the MCP server
+* is loopback-only and the CLI is spawned by it), so a local path is meaningful
+* on both sides.
+*
+* THREAT MODEL
+*
+* This is a second file-reading path, so it must not become a way around the
+* first one's rules. Every path goes through `confineToWorkspaceResult` — the
+* SAME chokepoint the worker's `read`/`glob`/`grep` tools use — which enforces
+* workspace confinement, `realpathSync.native()` (so a symlink or junction is
+* resolved to its true target before the prefix check), and syntactic rejection
+* of UNC, device, and drive-relative Windows paths. `isSensitivePath` then
+* applies the credential-shaped denylist (`.env*`, `*.pem`, `id_rsa*`, `.ssh/`,
+* `.git/` interior, `.netrc`, …).
+*
+* On top of that, content identification adds a second barrier: a file is only
+* ever sent if its leading BYTES are a supported image, so a `.env` renamed to
+* `shot.png` is refused even if it somehow passed confinement.
+*
+* That barrier is header-only, and worth stating honestly: a file beginning
+* with a valid PNG signature and carrying arbitrary data afterwards would pass.
+* Constructing one requires write access, and a caller with write access
+* already has `bash` and could exfiltrate directly — so this stops the
+* realistic case (a model pointing at a credential file by mistake or via
+* prompt injection), not a determined adversary. Confinement and the denylist
+* are the primary controls; this is defence in depth.
+*/
+/**
+* Pre-encode size ceiling. Every vision-capable model in the live catalog
+* publishes `max_prompt_image_size: 3145728`, so anything larger cannot be sent
+* to any of them. Checking BEFORE `readFile` means an oversized file is never
+* loaded into memory, let alone base64-expanded by a third.
+*
+* The per-model check still runs later at the transport boundary
+* (`assertOutboundImagesOk`); this is the cheap guard, not the authority.
+*/
+const MAX_ATTACHMENT_BYTES = 3145728;
+const MAX_TOTAL_ATTACHMENT_BYTES = 12582912;
+/**
+* Open flags. `O_NOFOLLOW` is POSIX-only and simply absent on Windows, where
+* `fsConstants.O_NOFOLLOW` is `undefined` — OR-ing that in would produce `NaN`
+* and break every open, so it is added only when the platform defines it.
+*/
+const READ_FLAGS = typeof constants.O_NOFOLLOW === "number" ? constants.O_RDONLY | constants.O_NOFOLLOW : constants.O_RDONLY;
+/**
+* Resolve, validate, and base64-encode each path.
+*
+* Fails on the FIRST bad path rather than silently skipping it: a caller that
+* attached four screenshots and got three has been quietly misled about what the
+* reviewer actually saw.
+*
+* Error strings reach a model, so they say what was wrong and what to do, and
+* never echo the resolved absolute path (the confinement helper deliberately
+* keeps its own messages path-free for the same reason).
+*/
+async function loadPeerImages(paths, workspace) {
+	if (paths.length > 10) return {
+		ok: false,
+		error: `imagePaths: ${paths.length} paths exceeds the 10-image ceiling (the most any Copilot model accepts). Send fewer.`
+	};
+	let workspaceAbs;
+	try {
+		workspaceAbs = realpathSync.native(workspace);
+	} catch {
+		workspaceAbs = workspace;
+	}
+	const images = [];
+	let totalBytes = 0;
+	for (const [index, raw] of paths.entries()) {
+		const position = `imagePaths[${index}]`;
+		if (typeof raw !== "string" || raw.length === 0) return {
+			ok: false,
+			error: `${position}: must be a non-empty string.`
+		};
+		const confined = confineToWorkspaceResult(raw, workspaceAbs);
+		if (!confined.ok) return {
+			ok: false,
+			error: `${position}: ${confined.error}`
+		};
+		if (isSensitivePath(confined.abs, workspaceAbs)) return {
+			ok: false,
+			error: `${position}: rejected: sensitive path`
+		};
+		let handle;
+		let buf;
+		try {
+			handle = await open(confined.abs, READ_FLAGS);
+			const info = await handle.stat();
+			if (!info.isFile()) return {
+				ok: false,
+				error: `${position}: rejected: not a regular file`
+			};
+			if (info.size > 3145728) return {
+				ok: false,
+				error: `${position}: ${info.size} bytes exceeds the ${MAX_ATTACHMENT_BYTES}-byte limit every vision model publishes. Re-capture at a smaller scale or lower quality.`
+			};
+			totalBytes += info.size;
+			if (totalBytes > 12582912) return {
+				ok: false,
+				error: `${position}: the attachments total more than ${MAX_TOTAL_ATTACHMENT_BYTES} bytes. Send fewer or smaller images.`
+			};
+			const capacity = Math.min(info.size, MAX_ATTACHMENT_BYTES);
+			const scratch = Buffer.alloc(Math.min(capacity + 1, 3145729));
+			let filled = 0;
+			for (;;) {
+				const { bytesRead } = await handle.read(scratch, filled, scratch.length - filled, filled);
+				if (bytesRead === 0) break;
+				filled += bytesRead;
+				if (filled >= scratch.length) break;
+			}
+			if (filled > capacity) return {
+				ok: false,
+				error: `${position}: the file grew while it was being read. Retry once it has stopped changing.`
+			};
+			buf = scratch.subarray(0, filled);
+		} catch {
+			return {
+				ok: false,
+				error: `${position}: file not found or unreadable`
+			};
+		} finally {
+			await handle?.close().catch(() => {});
+		}
+		const mimeType = detectImageMimeType(buf);
+		if (!mimeType) return {
+			ok: false,
+			error: `${position}: not a supported image. Content is identified by its bytes, not its extension. Supported: ${[...SUPPORTED_IMAGE_MIME_TYPES].join(", ")}.`
+		};
+		images.push({
+			data: buf.toString("base64"),
+			mimeType
+		});
+	}
+	return {
+		ok: true,
+		images
+	};
 }
 //#endregion
 //#region src/lib/tokenizer.ts
@@ -25924,9 +25291,15 @@ const getTokenCount = async (payload, model) => {
 * - anthropic-version (VS Code's Anthropic SDK sends this)
 * - X-Interaction-Id (VS Code sends a session-scoped UUID)
 *
-* We intentionally omit copilot-vision-request — VS Code only sends it when
+* We intentionally omit copilot-vision-request. VS Code only sends it when
 * images are present, and the native /v1/messages endpoint handles vision
-* without requiring the header.
+* without it — VERIFIED live (2026-08-03) rather than assumed: the same
+* base64 image sent to claude-opus-5 with the header omitted and with it set
+* both returned 200 AND the model named the image's colour in each case, so
+* the pixels genuinely reach it either way. Probe `passthrough_image_claude`
+* in scripts/probe-copilot-compat.sh keeps that verified; if Copilot ever
+* starts gating vision on the header, that probe fails rather than images
+* silently degrading on the lead model's own path.
 *
 * extraHeaders allows callers to forward client-supplied beta headers
 * (anthropic-beta) so Copilot enables extended features.
@@ -25992,11 +25365,12 @@ async function createMessages(body, extraHeaders, callerSignal, retryTransient =
 			errorBody = "(could not read error body)";
 		}
 		consola.error(`Copilot /v1/messages error: ${response.status} ${errorBody}`);
-		throw new HTTPError("Copilot messages request failed", new Response(errorBody, {
+		const reconstructed = new Response(errorBody, {
 			status: response.status,
 			statusText: response.statusText,
 			headers: response.headers
-		}));
+		});
+		throw new HTTPError("Copilot messages request failed", reconstructed);
 	}
 	return response;
 }
@@ -26039,11 +25413,12 @@ async function countTokens(body, extraHeaders, callerSignal, retryTransient = fa
 			errorBody = "(could not read error body)";
 		}
 		consola.error(`Copilot count_tokens error: ${response.status} ${errorBody}`);
-		throw new HTTPError("Copilot count_tokens request failed", new Response(errorBody, {
+		const reconstructed = new Response(errorBody, {
 			status: response.status,
 			statusText: response.statusText,
 			headers: response.headers
-		}));
+		});
+		throw new HTTPError("Copilot count_tokens request failed", reconstructed);
 	}
 	return response;
 }
@@ -26543,6 +25918,11 @@ function toolEntries(scope) {
 					type: "string",
 					description: "Optional additional context (extra file content, prior decisions). Concatenated to the brief before sending."
 				},
+				imagePaths: {
+					type: "array",
+					items: { type: "string" },
+					description: "Optional paths to image files (screenshots, diagrams, charts) INSIDE the workspace for the persona to LOOK AT. The proxy reads and encodes them, so no image data passes through your context. Content is identified by bytes, not extension; jpeg/png/webp/gif/heic/heif, 3 MiB each. Note paths are confined to the proxy's working directory. Note the per-model ceiling: the gemini-backed personas accept 10 images, the gpt- and opus-backed ones accept 1."
+				},
 				effort: {
 					type: "string",
 					enum: [...p.allowedEfforts],
@@ -26802,7 +26182,10 @@ async function dispatchModelCall(args) {
 				content: [{
 					type: "input_text",
 					text: args.userText
-				}]
+				}, ...(args.images ?? []).map((img) => ({
+					type: "input_image",
+					image_url: `data:${img.mimeType};base64,${img.data}`
+				}))]
 			}],
 			stream: false,
 			reasoning: { effort: args.effort }
@@ -26820,7 +26203,20 @@ async function dispatchModelCall(args) {
 			system: args.instructions,
 			thinking: { type: "adaptive" },
 			output_config: { effort: args.effort },
-			messages: [{
+			messages: [args.images && args.images.length > 0 ? {
+				role: "user",
+				content: [{
+					type: "text",
+					text: args.userText
+				}, ...args.images.map((img) => ({
+					type: "image",
+					source: {
+						type: "base64",
+						media_type: img.mimeType,
+						data: img.data
+					}
+				}))]
+			} : {
 				role: "user",
 				content: args.userText
 			}]
@@ -26835,7 +26231,16 @@ async function dispatchModelCall(args) {
 		messages: [{
 			role: "system",
 			content: args.instructions
-		}, {
+		}, args.images && args.images.length > 0 ? {
+			role: "user",
+			content: [{
+				type: "text",
+				text: args.userText
+			}, ...args.images.map((img) => ({
+				type: "image_url",
+				image_url: { url: `data:${img.mimeType};base64,${img.data}` }
+			}))]
+		} : {
 			role: "user",
 			content: args.userText
 		}],
@@ -26847,7 +26252,7 @@ async function dispatchModelCall(args) {
 		label: resolvedModel
 	}));
 }
-async function callPersona(persona, prompt, context, effort, signal) {
+async function callPersona(persona, prompt, context, effort, signal, images) {
 	const userText = buildUserText(prompt, context);
 	const text = await dispatchModelCall({
 		model: persona.model,
@@ -26855,6 +26260,7 @@ async function callPersona(persona, prompt, context, effort, signal) {
 		instructions: persona.baseInstructions,
 		userText,
 		effort,
+		images,
 		signal
 	});
 	if (!text) return toolError(`persona ${persona.agentName}: empty assistant output`);
@@ -26903,6 +26309,7 @@ async function handleToolsCall(body, scope, sessionWorkspace) {
 	let personaPrompt;
 	let personaContext;
 	let personaEffort;
+	let personaImages;
 	if (persona) {
 		if (args.effort !== void 0 && !isEffort(args.effort)) return rpcError(body.id, RPC_INVALID_PARAMS, `tools/call: arguments.effort must be one of ${EFFORT_LEVELS.join("|")}; got ${JSON.stringify(args.effort)}`);
 		const requestedEffort = args.effort;
@@ -26910,6 +26317,12 @@ async function handleToolsCall(body, scope, sessionWorkspace) {
 		if (!prompt) return rpcError(body.id, RPC_INVALID_PARAMS, `tools/call: arguments.prompt is required`);
 		personaPrompt = prompt;
 		personaContext = typeof args.context === "string" ? args.context : void 0;
+		if (args.imagePaths !== void 0) {
+			if (!Array.isArray(args.imagePaths) || args.imagePaths.some((v) => typeof v !== "string")) return rpcError(body.id, RPC_INVALID_PARAMS, "tools/call: arguments.imagePaths must be an array of strings");
+			const loaded = await loadPeerImages(args.imagePaths, process.cwd());
+			if (!loaded.ok) return rpcError(body.id, RPC_INVALID_PARAMS, `tools/call: ${loaded.error}`);
+			personaImages = loaded.images;
+		}
 		if (requestedEffort !== void 0 && !persona.allowedEfforts.includes(requestedEffort)) return rpcError(body.id, RPC_INVALID_PARAMS, `tools/call: persona "${persona.toolNameHttp}" does not accept effort="${requestedEffort}". Allowed: ${persona.allowedEfforts.join("|")}.`);
 		personaEffort = requestedEffort ?? persona.defaultEffort;
 	}
@@ -26945,7 +26358,7 @@ async function handleToolsCall(body, scope, sessionWorkspace) {
 	const telemetryModel = persona ? persona.model : "(non-persona)";
 	try {
 		if (nonPersonaTool) applySessionWorkspace(args, sessionWorkspace, nonPersonaTool);
-		const result = persona ? await callPersona(persona, personaPrompt, personaContext, personaEffort, aborter?.signal) : await nonPersonaTool.handler(args, aborter?.signal);
+		const result = persona ? await callPersona(persona, personaPrompt, personaContext, personaEffort, aborter?.signal, personaImages) : await nonPersonaTool.handler(args, aborter?.signal);
 		logTelemetry({
 			name: telemetryName,
 			model: telemetryModel,
@@ -28178,7 +27591,7 @@ async function throttleSearch() {
 			const waitMs = 1e3 - (now - searchTimestamps[0]);
 			if (waitMs > 0) {
 				consola.debug(`Web search rate limited, waiting ${waitMs}ms`);
-				await sleep$3(waitMs);
+				await sleep$2(waitMs);
 			}
 		}
 		searchTimestamps.push(Date.now());
@@ -29230,18 +28643,49 @@ const READ_PARAMS = Type$1.Object({
 		description: "Max lines to return."
 	}))
 });
+/**
+* A file is an image if its BYTES say so. Extensions are a caller assertion and
+* are not consulted: a `.png` holding HTML must not be shipped as an image, and
+* a screenshot saved without a suffix should still work.
+*/
+function imageResult(data, mimeType) {
+	return {
+		content: [{
+			type: "text",
+			text: `[${mimeType} image, ${data.length} base64 chars]`
+		}, {
+			type: "image",
+			data,
+			mimeType
+		}],
+		details: {}
+	};
+}
+/**
+* Non-image binary detection. A NUL byte in the first few KiB is the classic
+* heuristic (it is what `grep`, `git`, and `file` all effectively use) and it is
+* enough here: the goal is not to classify the file, only to avoid handing the
+* model a wall of U+FFFD replacement characters and calling it text.
+*/
+function looksBinary(buf) {
+	return buf.subarray(0, Math.min(buf.length, 8192)).includes(0);
+}
 function readTool(workspace) {
 	return {
 		name: "read",
 		label: "Read file",
-		description: "Read a file from the worker's workspace. Returns UTF-8 text. Files larger than 10 MiB are refused; use offset/limit to page.",
+		description: "Read a file from the worker's workspace. Returns UTF-8 text, or the image itself for a jpeg/png/webp/gif/heic/heif file (detected by content, not extension) so you can actually SEE it. Other binary files are refused rather than returned as mojibake. Files larger than 10 MiB are refused; use offset/limit to page.",
 		parameters: READ_PARAMS,
 		async execute(_toolCallId, params, signal) {
 			const abs = resolvePathOrThrow(params.path, workspace);
 			const st = await stat(abs);
 			if (!st.isFile()) throw new Error("rejected: not a regular file");
 			if (st.size > READ_MAX_BYTES) throw new Error(`rejected: file >${READ_MAX_BYTES} bytes (10 MiB) — got ${st.size}`);
-			const text = (await readFile(abs, { signal })).toString("utf8");
+			const buf = await readFile(abs, { signal });
+			const imageMime = detectImageMimeType(buf);
+			if (imageMime) return imageResult(buf.toString("base64"), imageMime);
+			if (looksBinary(buf)) throw new Error(`rejected: binary file (${st.size} bytes), not a supported image. Supported image types are jpeg, png, webp, gif, heic, heif. Use \`bash\` with a suitable CLI to inspect or convert it.`);
+			const text = buf.toString("utf8");
 			if (params.offset === void 0 && params.limit === void 0) return textResult(text);
 			const lines = text.split(/\r?\n/);
 			const start = params.offset ?? 0;
@@ -30153,7 +29597,7 @@ async function sweepAgedWorkerDiffs(opts = {}) {
 	}
 	let entries;
 	try {
-		entries = await fs.readdir(PATHS.WORKER_DIFFS_DIR);
+		entries = await fs$1.readdir(PATHS.WORKER_DIFFS_DIR);
 	} catch {
 		return;
 	}
@@ -30162,8 +29606,8 @@ async function sweepAgedWorkerDiffs(opts = {}) {
 		if (!WORKER_DIFF_NAME_RE.test(name)) continue;
 		const full = path.join(PATHS.WORKER_DIFFS_DIR, name);
 		try {
-			if (now - (await fs.stat(full)).mtimeMs < AGE_SWEEP_MS$1) continue;
-			await fs.rm(full, { force: true }).catch(() => {});
+			if (now - (await fs$1.stat(full)).mtimeMs < AGE_SWEEP_MS$1) continue;
+			await fs$1.rm(full, { force: true }).catch(() => {});
 		} catch {}
 	}
 }
@@ -30176,13 +29620,13 @@ async function sweepAgedWorkerDiffs(opts = {}) {
 */
 async function saveOverflowResult(text) {
 	await sweepAgedWorkerDiffs({ throttle: true });
-	await fs.mkdir(PATHS.WORKER_DIFFS_DIR, { recursive: true });
+	await fs$1.mkdir(PATHS.WORKER_DIFFS_DIR, { recursive: true });
 	let lastErr;
 	for (let attempt = 0; attempt < 5; attempt++) {
 		const name = `${process$1.pid}-${randomBytes(4).toString("hex")}.txt`;
 		const outPath = path.join(PATHS.WORKER_DIFFS_DIR, name);
 		try {
-			await fs.writeFile(outPath, text, {
+			await fs$1.writeFile(outPath, text, {
 				mode: 384,
 				flag: "wx"
 			});
@@ -30376,7 +29820,7 @@ async function findRepoRoot(workspaceAbs) {
 async function sweepAgedWorktrees(parent) {
 	let entries;
 	try {
-		entries = await fs.readdir(parent);
+		entries = await fs$1.readdir(parent);
 	} catch (err) {
 		if (err.code === "ENOENT") return;
 		return;
@@ -30386,7 +29830,7 @@ async function sweepAgedWorktrees(parent) {
 		if (!WORKTREE_DIR_NAME_RE.test(name)) continue;
 		const full = path.join(parent, name);
 		try {
-			const ageMs = now - (await fs.stat(full)).mtimeMs;
+			const ageMs = now - (await fs$1.stat(full)).mtimeMs;
 			if (ageMs < AGE_SWEEP_MTIME_FLOOR_MS) continue;
 			if (ageMs < AGE_SWEEP_MS) continue;
 			await execFileP("git", [
@@ -30395,7 +29839,7 @@ async function sweepAgedWorktrees(parent) {
 				"--force",
 				full
 			], { timeout: 1e4 }).catch(() => {});
-			await fs.rm(full, {
+			await fs$1.rm(full, {
 				recursive: true,
 				force: true
 			}).catch(() => {});
@@ -30414,11 +29858,11 @@ async function sweepAgedWorktrees(parent) {
 async function createWorktree(workspaceAbs, opts) {
 	const { repoRoot, gitCommonDir } = await findRepoRoot(workspaceAbs);
 	const parent = path.join(gitCommonDir, "worker-worktrees");
-	await fs.mkdir(parent, { recursive: true });
+	await fs$1.mkdir(parent, { recursive: true });
 	await sweepAgedWorktrees(parent);
 	let existing = [];
 	try {
-		existing = await fs.readdir(parent);
+		existing = await fs$1.readdir(parent);
 	} catch {}
 	if (existing.filter((n) => WORKTREE_DIR_NAME_RE.test(n)).length >= QUOTA_PER_REPO) throw new Error(`worker-agent worktree: per-repo quota exceeded (>=${QUOTA_PER_REPO} entries under ${parent}); abort, investigate, then prune manually or wait for the age sweep`);
 	const suffix = randomBytes(4).toString("hex");
@@ -30466,9 +29910,9 @@ async function createWorktree(workspaceAbs, opts) {
 		for (const rel of files) {
 			const src = path.join(repoRoot, rel);
 			const dst = path.join(dir, rel);
-			await fs.mkdir(path.dirname(dst), { recursive: true });
+			await fs$1.mkdir(path.dirname(dst), { recursive: true });
 			try {
-				await fs.copyFile(src, dst);
+				await fs$1.copyFile(src, dst);
 			} catch (err) {
 				if (err.code === "ENOENT") continue;
 				throw err;
@@ -30587,13 +30031,13 @@ async function saveOverflowPatch(dir) {
 		"HEAD"
 	], { maxBuffer: 268435456 });
 	await sweepAgedWorkerDiffs({ throttle: true });
-	await fs.mkdir(PATHS.WORKER_DIFFS_DIR, { recursive: true });
+	await fs$1.mkdir(PATHS.WORKER_DIFFS_DIR, { recursive: true });
 	let lastErr;
 	for (let attempt = 0; attempt < 5; attempt++) {
 		const name = `${process$1.pid}-${randomBytes(4).toString("hex")}.patch`;
 		const patchPath = path.join(PATHS.WORKER_DIFFS_DIR, name);
 		try {
-			await fs.writeFile(patchPath, patch.stdout, {
+			await fs$1.writeFile(patchPath, patch.stdout, {
 				mode: 384,
 				flag: "wx"
 			});
@@ -31657,93 +31101,6 @@ function selectChampion(orchestrated, baseline, canonicalGateIds, tiePolicy) {
 	};
 }
 //#endregion
-//#region src/lib/orchestration/gate-runner.ts
-async function runGateChecks(checks, cwd, exec) {
-	const results = await Promise.all(checks.map(async (c) => {
-		try {
-			const r = await exec({
-				command: c.command,
-				cwd
-			});
-			return {
-				id: c.id,
-				passed: r.exitCode === 0
-			};
-		} catch {
-			return {
-				id: c.id,
-				passed: false
-			};
-		}
-	}));
-	const passed = /* @__PURE__ */ new Set();
-	const ran = /* @__PURE__ */ new Set();
-	for (const r of results) {
-		ran.add(r.id);
-		if (r.passed) passed.add(r.id);
-	}
-	return {
-		passed,
-		ran
-	};
-}
-//#endregion
-//#region src/lib/orchestration/gate-registry.ts
-/**
-* Built-in sealed gates. Commands follow this repo's TS/Bun conventions (the
-* `bun run <script>` indirection means a repo without that script simply fails
-* the check, which the selector treats as not-passed rather than a crash). New
-* ecosystems get a new sealed id here, never a caller-supplied command.
-*/
-const SEALED_GATES = {
-	"default-ci": [
-		{
-			id: "typecheck",
-			command: "bun run typecheck"
-		},
-		{
-			id: "test",
-			command: "bun test"
-		},
-		{
-			id: "lint",
-			command: "bun run lint"
-		}
-	],
-	"typecheck-test": [{
-		id: "typecheck",
-		command: "bun run typecheck"
-	}, {
-		id: "test",
-		command: "bun test"
-	}],
-	"typecheck-only": [{
-		id: "typecheck",
-		command: "bun run typecheck"
-	}]
-};
-/** The set of sealed gate ids, used as the kernel's `knownGateIds` so the IR
-*  verifier rejects an executable gate that references an unregistered id. */
-function sealedGateIds() {
-	return new Set(Object.keys(SEALED_GATES));
-}
-/**
-* Resolve a sealed gate by id. Returns a DEFENSIVE CLONE (fresh objects) so a
-* caller can never mutate the registry's command set. `undefined` for an
-* unknown id, which `run_workflow` rejects before executing anything.
-*/
-function resolveSealedGate(gateId) {
-	const checks = SEALED_GATES[gateId];
-	if (!checks) return void 0;
-	return {
-		id: gateId,
-		checks: checks.map((c) => ({
-			id: c.id,
-			command: c.command
-		}))
-	};
-}
-//#endregion
 //#region src/lib/orchestration/verify.ts
 /**
 * Static verifier for the workflow IR. This is what `decompose`'s output is
@@ -32235,186 +31592,6 @@ function makeRunner(deps, ctx) {
 	} };
 }
 //#endregion
-//#region src/lib/orchestration/gate-immutability.ts
-/** Patterns that weaken a gate regardless of language (test exclusivity / focus
-*  idioms shared across JS test runners; kept in COMMON since several languages
-*  reuse them). */
-const COMMON_PATTERNS = [{
-	name: "skipped-test",
-	re: /(\.\s*skip\s*\(|\bxit\s*\(|\bxdescribe\s*\(|\.\s*only\s*\()/
-}];
-/** Language-specific weakening patterns, selected by the added line's file type. */
-const LANG_PATTERNS = {
-	ts: [
-		{
-			name: "ts-suppression",
-			re: /@ts-(ignore|nocheck|expect-error)\b/
-		},
-		{
-			name: "any-cast",
-			re: /\bas\s+any\b|:\s*any\b/
-		},
-		{
-			name: "eslint-disable",
-			re: /eslint-disable\b/
-		}
-	],
-	py: [
-		{
-			name: "py-type-ignore",
-			re: /#\s*type:\s*ignore\b/
-		},
-		{
-			name: "py-noqa",
-			re: /#\s*noqa\b/
-		},
-		{
-			name: "py-skip",
-			re: /@(pytest\.mark\.skip|unittest\.skip)\b/
-		}
-	],
-	go: [{
-		name: "go-skip",
-		re: /\bt\.Skip\s*\(/
-	}, {
-		name: "go-nolint",
-		re: /\/\/\s*nolint\b/
-	}],
-	rust: [{
-		name: "rust-ignore",
-		re: /#\[\s*ignore\b/
-	}, {
-		name: "rust-allow",
-		re: /#\[\s*allow\s*\(/
-	}]
-};
-/** Map a file path to a language key for `LANG_PATTERNS` (null → COMMON only). */
-function langForFile(file) {
-	if (!file) return null;
-	switch (file.slice(file.lastIndexOf(".")).toLowerCase()) {
-		case ".ts":
-		case ".tsx":
-		case ".mts":
-		case ".cts":
-		case ".js":
-		case ".jsx":
-		case ".mjs":
-		case ".cjs": return "ts";
-		case ".py":
-		case ".pyi": return "py";
-		case ".go": return "go";
-		case ".rs": return "rust";
-		default: return null;
-	}
-}
-/** Union of COMMON + every language — the pre-header default (no file known yet),
-*  so a header-less diff is matched permissively, exactly as before this became
-*  language-scoped. Once a real file header appears, the set narrows to that
-*  file's language (or COMMON only for an unknown extension → fail open). */
-const ALL_PATTERNS = [...COMMON_PATTERNS, ...Object.values(LANG_PATTERNS).flat()];
-/** A `diff --git a/x b/x` or `+++ b/x` header → the current file path. */
-function fileFromHeader(line) {
-	const git = /^diff --git a\/.+ b\/(.+)$/.exec(line);
-	if (git) return git[1];
-	const plus = /^\+\+\+ b\/(.+)$/.exec(line);
-	if (plus) return plus[1];
-}
-function detectGateWeakening(diff) {
-	const findings = [];
-	let file;
-	let patterns = ALL_PATTERNS;
-	for (const raw of diff.split("\n")) {
-		const headerFile = fileFromHeader(raw);
-		if (headerFile !== void 0) {
-			file = headerFile;
-			const lang = langForFile(file);
-			patterns = lang ? [...COMMON_PATTERNS, ...LANG_PATTERNS[lang]] : COMMON_PATTERNS;
-			continue;
-		}
-		if (!raw.startsWith("+") || raw.startsWith("+++")) continue;
-		const added = raw.slice(1);
-		for (const p of patterns) if (p.re.test(added)) findings.push(file === void 0 ? {
-			pattern: p.name,
-			line: added.trim()
-		} : {
-			pattern: p.name,
-			line: added.trim(),
-			file
-		});
-	}
-	return {
-		weakened: findings.length > 0,
-		findings
-	};
-}
-//#endregion
-//#region src/lib/orchestration/stop-gate.ts
-/**
-* The Phase-0 structural-gate decision — the cheap, CERTAIN floor win. It blocks
-* marking work "done" when any canonical gate fails OR the diff weakens a gate.
-* A non-model check that fires every run and never ships broken or gate-gamed
-* code; per the floor analysis it is the only component that raises the
-* worst-case floor BY CONSTRUCTION (the orchestration on top is a conditional
-* bet).
-*
-* This is the logic behind the spawned-session Stop-hook AND the kernel runner's
-* pre-accept check. The process exec and the diff are inputs, so the decision is
-* pure + unit-testable; the hook script that runs `git diff` + invokes this is a
-* thin wrapper.
-*/
-async function evaluateStopGate(input) {
-	const gate = await runGateChecks(input.checks, input.cwd, input.exec);
-	const weak = detectGateWeakening(input.diff);
-	const failedChecks = input.checks.map((c) => c.id).filter((id) => !gate.passed.has(id));
-	const block = failedChecks.length > 0 || weak.weakened;
-	const parts = [];
-	if (failedChecks.length > 0) parts.push(`failing gates: ${failedChecks.join(", ")}`);
-	if (weak.weakened) {
-		const pats = [...new Set(weak.findings.map((f) => f.pattern))].join(", ");
-		parts.push(`gate-weakening in the diff: ${pats}`);
-	}
-	return {
-		block,
-		reason: block ? parts.join("; ") : "all canonical gates pass; no gate-weakening in the diff",
-		failedChecks,
-		weakening: weak.findings
-	};
-}
-//#endregion
-//#region src/lib/orchestration/live-exec.ts
-/**
-* Live `ExecFn` for the gate runner — runs the kernel's SEALED gate command in a
-* workspace via the project's Windows-safe exec helper (`runCommandCapture` →
-* `buildExecInvocation`, which handles cmd.exe quoting on Windows). Only the
-* kernel's sealed gate commands flow through here (tests/types/lint/build),
-* never a producer-authored string, so a simple whitespace split into argv is
-* safe for these fixed commands. A command that can't run (spawn error / killed)
-* counts as a non-zero exit, never a throw — the gate runner treats it as
-* not-passed.
-*
-* This is the one piece of the gate engine that touches a real subprocess; it is
-* model-free and cross-platform, so it is exercised directly in CI (unlike the
-* worker/worktree/model adapters, which need the gated E2E harness).
-*/
-/** Per-command wall-clock cap so a hung gate command (watch-mode test, a process
-*  waiting on stdin, a stale lockfile) is tree-killed instead of hanging the
-*  caller forever. Generous (a real typecheck/test/lint can take minutes) but
-*  bounded; override with GH_ROUTER_GATE_CMD_TIMEOUT_MS. A timeout kills the
-*  command (code null) which the gate runner treats as not-passed. */
-const CMD_TIMEOUT_MS = parseIntEnv(process.env.GH_ROUTER_GATE_CMD_TIMEOUT_MS) ?? 6e5;
-const liveExec = async ({ command, cwd }) => {
-	const argv = command.trim().split(/\s+/).filter(Boolean);
-	if (argv.length === 0) return { exitCode: 1 };
-	try {
-		return { exitCode: (await runCommandCapture(argv, {
-			cwd,
-			timeoutMs: CMD_TIMEOUT_MS
-		})).code ?? 1 };
-	} catch {
-		return { exitCode: 1 };
-	}
-};
-//#endregion
 //#region src/lib/orchestration/runner-live.ts
 /**
 * The LIVE adapter for the kernel's NodeRunner primitives. buildLiveRunner wires
@@ -32517,665 +31694,6 @@ function buildLiveRunner(ctx, prim) {
 	};
 }
 //#endregion
-//#region src/lib/orchestration/stop-gate-policy.ts
-/**
-* Pure + thin-IO policy helpers for the consent-gated, top-level-only structural
-* Stop-gate. Split out of `stop-gate-hook.ts` so the security-critical decisions
-* (is this a subagent? is this repo trusted? which checks regressed?) are small,
-* named, and unit-testable.
-*
-* Verified against the official Claude Code hooks reference
-* (https://code.claude.com/docs/en/hooks), 2026-06:
-*   - `Stop` fires for the MAIN agent; subagents fire `SubagentStop`, and a
-*     `Stop`-registered hook is converted to `SubagentStop` in a subagent
-*     context — so the hook command CAN run for a subagent. The payload carries
-*     `agent_id` / `agent_type` ONLY inside a subagent/teammate context, so that
-*     is the reliable top-level-vs-sub discriminator (NOT an env var, which the
-*     proxy cannot set on Claude-spawned subagents).
-*   - `UserPromptSubmit` fires only for human prompts to the main agent.
-*   - `stop_hook_active` is NOT in the current documented payload, so the
-*     per-prompt block budget — not that flag — must be the termination guard.
-*/
-/**
-* True when the hook is firing inside a subagent / teammate context (NOT the
-* top-level user session). Claude Code adds `agent_id` + `agent_type` to the
-* payload only there, so their presence is the discriminator. The Stop-gate and
-* the prompt-steer hook both stand down when this is true, scoping them to the
-* top-level session.
-*/
-function isSubagentContext(payload) {
-	const present = (v) => v !== void 0 && v !== null;
-	return present(payload?.agent_type) || present(payload?.agent_id);
-}
-/** Stable trust dir (NOT the per-launch mirror — trust must persist). */
-function trustDir() {
-	return path.join(PATHS.APP_DIR, "stop-gate", "trust");
-}
-/** Resolve the git repo root for `cwd`, falling back to `cwd` when not a repo. */
-async function repoRoot(cwd) {
-	const top = (await runCommandCapture([
-		"git",
-		"rev-parse",
-		"--show-toplevel"
-	], {
-		cwd,
-		timeoutMs: 5e3
-	}).catch(() => void 0))?.stdout?.trim();
-	return top && top.length > 0 ? top : cwd;
-}
-function trustFileFor(root) {
-	const key = createHash("sha256").update(path.resolve(root)).digest("hex").slice(0, 32);
-	return path.join(trustDir(), key);
-}
-/**
-* A stable identity for the repo at `root`: the first (root) commit SHA. It
-* survives normal history growth but differs across distinct repositories, so a
-* DIFFERENT repo later appearing at the same filesystem path is not silently
-* trusted (codex review #2). Empty string when unavailable (no git / no commits)
-* — trust then falls back to path-only, the best we can do.
-*/
-async function repoFingerprint(root) {
-	return (await runCommandCapture([
-		"git",
-		"rev-list",
-		"--max-parents=0",
-		"HEAD"
-	], {
-		cwd: root,
-		timeoutMs: 5e3
-	}).catch(() => void 0))?.stdout?.split(/\r?\n/).map((s) => s.trim()).filter(Boolean)[0] ?? "";
-}
-/**
-* True iff the user has consented to run the gate in this repo AND the repo's
-* identity still matches what was trusted. The trust file stores `root\nfp\n`;
-* a present fingerprint is verified against the live one (deny on mismatch, and
-* deny if we pinned one but can't recompute it — fail closed). A legacy file
-* with no fingerprint is path-only trust.
-*/
-async function isRepoTrusted(cwd) {
-	const root = await repoRoot(cwd);
-	let stored;
-	try {
-		stored = await promises.readFile(trustFileFor(root), "utf8");
-	} catch {
-		return false;
-	}
-	const storedFp = (stored.split(/\r?\n/)[1] ?? "").trim();
-	if (storedFp.length === 0) return true;
-	const currentFp = await repoFingerprint(root);
-	if (currentFp.length === 0) return false;
-	return currentFp === storedFp;
-}
-/** Record consent for this repo (consent once → automatic thereafter), pinning
-*  the repo's root-commit fingerprint so a later repo swap at the same path is
-*  not auto-trusted. */
-async function trustRepo(cwd) {
-	const root = await repoRoot(cwd);
-	const fp = await repoFingerprint(root);
-	await promises.mkdir(trustDir(), { recursive: true });
-	await promises.writeFile(trustFileFor(root), `${root}\n${fp}\n`, { mode: 384 });
-	return root;
-}
-/**
-* Repo-aware gate enable: `GH_ROUTER_DISABLE_STOP_GATE` force-off wins;
-* `GH_ROUTER_ENABLE_STOP_GATE` force-on next; otherwise default to OFF unless the
-* repo is trusted. This is the load-bearing security gate — the default is OFF,
-* so an untrusted repo's scripts are never auto-run.
-*/
-async function stopGateEnabledForRepo(cwd, env = process.env) {
-	if (parseBoolEnv(env.GH_ROUTER_DISABLE_STOP_GATE) === true) return false;
-	if (parseBoolEnv(env.GH_ROUTER_ENABLE_STOP_GATE) === true) return true;
-	return isRepoTrusted(cwd);
-}
-/**
-* Given the current failed checks and the recorded baseline, return the checks
-* that REGRESSED (failing now, not failing at baseline). A null baseline (first
-* eval) yields an empty regression set — nothing is blamed on the agent yet.
-*/
-function regressions(currentFailed, baseline) {
-	if (baseline === null) return [];
-	return currentFailed.filter((id) => !baseline.has(id));
-}
-/** File-backed `BaselineStore` under `stateDir`, keyed by sha256(session_id). */
-function fileBaselineStore(stateDir) {
-	const fileFor = (sid) => path.join(stateDir, `baseline-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
-	return {
-		async get(sid) {
-			try {
-				const raw = await promises.readFile(fileFor(sid), "utf8");
-				const arr = JSON.parse(raw);
-				if (Array.isArray(arr)) return new Set(arr.filter((x) => typeof x === "string"));
-				return /* @__PURE__ */ new Set();
-			} catch {
-				return null;
-			}
-		},
-		async set(sid, failed) {
-			await promises.mkdir(stateDir, { recursive: true });
-			await promises.writeFile(fileFor(sid), JSON.stringify([...failed]), { mode: 384 });
-		}
-	};
-}
-function fileReviewDebounce(stateDir) {
-	const fileFor = (sid) => path.join(stateDir, `review-hash-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
-	const readLast = async (sid) => {
-		try {
-			return (await promises.readFile(fileFor(sid), "utf8")).trim();
-		} catch {
-			return "";
-		}
-	};
-	return {
-		async shouldReview(sid, diffHash) {
-			if (diffHash.length === 0) return false;
-			return await readLast(sid) !== diffHash;
-		},
-		async markReviewed(sid, diffHash) {
-			await promises.mkdir(stateDir, { recursive: true });
-			await promises.writeFile(fileFor(sid), diffHash, { mode: 384 });
-		}
-	};
-}
-function fileFindingsStore(stateDir) {
-	const fileFor = (sid) => path.join(stateDir, `findings-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
-	return {
-		async read(sid) {
-			try {
-				const raw = await promises.readFile(fileFor(sid), "utf8");
-				return raw.length > 0 ? raw : null;
-			} catch {
-				return null;
-			}
-		},
-		async write(sid, findings) {
-			await promises.mkdir(stateDir, { recursive: true });
-			const tmp = `${fileFor(sid)}.${process.pid}.tmp`;
-			await promises.writeFile(tmp, findings, { mode: 384 });
-			await promises.rename(tmp, fileFor(sid));
-		},
-		async clear(sid) {
-			await promises.unlink(fileFor(sid)).catch(() => {});
-		}
-	};
-}
-/**
-* The single canonical state dir for the advisory-review layer (hook V2): the
-* Stop hook's review debounce, the background review's findings file, and the
-* UserPromptSubmit hook's last-user-prompt store all live here, keyed by
-* sha256(session_id). One dir so the three independent subcommand processes
-* (`internal-stop-hook`, `internal-stop-review`, `internal-prompt-submit`)
-* agree on where to read/write without threading a path through env. Distinct
-* from the deterministic gate's `gh-router-stopgate*` dirs (block budget +
-* baseline) so the advisory layer can be wiped independently.
-*/
-function stopReviewStateDir() {
-	return path.join(tmpdir(), "gh-router-stop-review");
-}
-function fileLastPromptStore(stateDir) {
-	const fileFor = (sid) => path.join(stateDir, `last-prompt-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
-	return {
-		async read(sid) {
-			try {
-				const raw = await promises.readFile(fileFor(sid), "utf8");
-				return raw.length > 0 ? raw : null;
-			} catch {
-				return null;
-			}
-		},
-		async write(sid, prompt) {
-			await promises.mkdir(stateDir, { recursive: true });
-			const tmp = `${fileFor(sid)}.${process.pid}.tmp`;
-			await promises.writeFile(tmp, prompt, { mode: 384 });
-			await promises.rename(tmp, fileFor(sid));
-		}
-	};
-}
-//#endregion
-//#region src/lib/orchestration/stop-gate-hook.ts
-/**
-* The Phase-0 structural-gate Stop-hook glue. `runStopGateForLaunch` resolves a
-* SEALED gate by id and evaluates it against the working-tree diff, returning the
-* block decision a spawned-session Stop hook (or a manual check) acts on.
-*
-* Safety posture (deliberately different from the kernel): a Stop hook that
-* blocks on a MISCONFIGURATION would wedge the user's session (they could not
-* stop). So this fails OPEN on config problems (unknown gate id) and blocks ONLY
-* on a genuine red gate or a gate-weakening diff. The kernel, by contrast, fails
-* CLOSED to the baseline. Both are correct for their context.
-*
-* The sealed gate + diff + exec are inputs, so the decision is pure and
-* unit-testable; the thin live wrapper (capture `git diff`, spawn the checks,
-* map the result to an exit code) is the only part that needs a real process.
-*/
-async function runStopGateForLaunch(input) {
-	const gate = resolveSealedGate(input.gateId);
-	if (!gate) return {
-		block: false,
-		reason: `stop-gate: unknown gateId "${input.gateId}" (not blocking)`,
-		failedChecks: [],
-		weakening: []
-	};
-	return evaluateStopGate({
-		checks: gate.checks,
-		cwd: input.workspace,
-		exec: input.exec,
-		diff: input.diff
-	});
-}
-/**
-* The launch-stable baseline key for the dynamic gate path: keyed by the
-* workdir + the descriptor's check set + a per-launch token, NOT the session id
-* and NOT HEAD. The LAUNCHER generates the token (passed to the child via env),
-* computes this key, and seeds the baseline (the set of checks already failing at
-* launch, BEFORE the agent mutates the tree); the runtime hook recomputes the
-* same key (reading the token from its env) and reads that baseline, so an
-* agent-introduced failure is a REGRESSION rather than being silently adopted as
-* the baseline at first stop. The per-launch token isolates concurrent sessions
-* on the same repo (they don't clobber each other's baseline). HEAD is
-* deliberately NOT in the key: an agent that COMMITS its work mid-session must
-* still be judged against the pre-session baseline (a HEAD-keyed baseline would
-* vanish on the commit — the exact moment it matters). A changed check set (the
-* agent edited the harness) yields a different key → the launch baseline no
-* longer matches and the hook degrades to first-stop baselining.
-*/
-function launchBaselineKey(workdir, descriptorKey, token) {
-	return JSON.stringify([
-		"launch",
-		path.resolve(workdir),
-		descriptorKey,
-		token ?? ""
-	]);
-}
-/**
-* Run the resolved checks ONCE at launch (pre-mutation) and record the failing
-* set as the baseline under `launchBaselineKey`. Best-effort: any failure is
-* swallowed (the hook then degrades to first-stop baselining). The launcher MUST
-* pass the SAME check set the hook will run (same `includeTests`) so a
-* pre-existing test failure isn't later miscounted as a regression.
-*
-* NOTE: capture is best-effort pre-mutation — the launcher fires it before the
-* child can edit, and in practice the agent does not mutate until well after a
-* user prompt, so the checks see the clean tree. If the agent somehow mutates
-* before this completes, the worst case is the legacy first-stop baseline (no
-* regression, never a wedge).
-*/
-async function captureLaunchBaseline(input) {
-	if (input.checks.length === 0) return;
-	try {
-		const gate = await runGateChecks(input.checks, input.workdir, input.exec);
-		const failed = input.checks.map((c) => c.id).filter((id) => !gate.passed.has(id));
-		await input.baseline.set(launchBaselineKey(input.workdir, input.descriptorKey, input.token), failed);
-	} catch {}
-}
-/**
-* The advisory background review (hook V2) is ON by default whenever the Stop
-* gate runs; it is the cross-lab accountability layer. Opt out with
-* `GH_ROUTER_DISABLE_STOP_REVIEW=1` to keep the deterministic gate but drop the
-* LLM review. (Disabling the whole gate with `GH_ROUTER_DISABLE_STOP_GATE=1`
-* also drops the review, since the review only ever fires from the gate's green
-* path.)
-*/
-function stopReviewEnabled(env = process.env) {
-	return parseBoolEnv(env.GH_ROUTER_DISABLE_STOP_REVIEW) !== true;
-}
-/** The sealed gate the Stop hook runs, overridable via `GH_ROUTER_STOP_GATE_ID`
-*  (must be a registered sealed id; the live wrapper falls open on an unknown
-*  id). Defaults to `default-ci`. */
-function stopGateId(env = process.env) {
-	const v = (env.GH_ROUTER_STOP_GATE_ID ?? "").trim();
-	return v.length > 0 ? v : "default-ci";
-}
-/**
-* PLAN-MODE env fallback. When the session is in plan mode, plan/memory scratch
-* edits should not trip the gate-WEAKENING scan (a plan/memory markdown file may
-* legitimately quote `it.skip` / `as any` while describing work). The launcher
-* sets `GH_ROUTER_STOP_GATE_PLAN_MODE` for a plan-mode session; the payload may
-* ALSO carry a forward-compat `plan_mode` field (see `decideStopHook`). Either
-* signal being present activates the scoping — the executable gate STILL runs
-* and non-plan hunks are STILL scanned.
-*/
-function stopGatePlanMode(env = process.env) {
-	return parseBoolEnv(env.GH_ROUTER_STOP_GATE_PLAN_MODE) === true;
-}
-/**
-* Is a unified-diff file path confined to a `plans/` or `memory/` directory?
-* Windows-safe (normalizes `\` → `/`). Matches only when a DIRECTORY segment of
-* the path is exactly `plans` or `memory`, so `plans/x.md`, `memory/y.md`, and
-* `a/plans/z` match while the filenames `docs/plans.md` / `myplans/x` do not.
-*/
-function isPlanMemoryDiffPath(p) {
-	const segs = p.replace(/\\/g, "/").split("/");
-	for (let i = 0; i < segs.length - 1; i++) if (segs[i] === "plans" || segs[i] === "memory") return true;
-	return false;
-}
-/**
-* Drop the file sections of a unified `git diff` whose NEW path (the `b/…` side)
-* is confined to `plans/` or `memory/` — used for the gate-WEAKENING scan when
-* plan mode is active. Sections for other files (e.g. `src/…`) are preserved
-* verbatim, so a MIXED diff keeps its non-plan hunks and `src/` weakening is
-* still caught. The executable gate does not read the diff, so filtering it here
-* never affects which checks run. A diff with no `diff --git` sections (or an
-* empty one) is returned unchanged.
-*/
-function stripPlanMemoryDiffHunks(diff) {
-	if (diff.length === 0) return diff;
-	const out = [];
-	let dropping = false;
-	for (const line of diff.split("\n")) {
-		if (line.startsWith("diff --git ")) {
-			const bPath = /^diff --git a\/.+ b\/(.+)$/.exec(line)?.[1];
-			dropping = bPath !== void 0 && isPlanMemoryDiffPath(bPath);
-			if (!dropping) out.push(line);
-			continue;
-		}
-		if (!dropping) out.push(line);
-	}
-	return out.join("\n");
-}
-/**
-* C3: whether the structural Stop-gate is disabled for THIS launch. True when the
-* `GH_ROUTER_DISABLE_STOP_GATE` env is set OR the `--no-stop-gate` launcher flag was
-* passed (`args["no-stop-gate"] === true`). A DRIVEN session sets the flag so a
-* blocking Stop hook never hangs its turn-end (~10 min) waiting on the fleet driver.
-* Pure so it is unit-testable without the live launch path.
-*/
-function stopGateDisabled(args, env = process.env) {
-	return parseBoolEnv(env.GH_ROUTER_DISABLE_STOP_GATE) === true || args["no-stop-gate"] === true;
-}
-/** True when a settings `Stop` entry already registers `command` (so the merge
-*  is idempotent across re-launches). */
-function entryHasCommand(entry, command) {
-	if (!entry || typeof entry !== "object") return false;
-	const hooks = entry.hooks;
-	if (!Array.isArray(hooks)) return false;
-	return hooks.some((h) => h && typeof h === "object" && h.command === command);
-}
-/**
-* Idempotently merge a hook running `command` for `event` (default `Stop`) into
-* an existing Claude Code settings object WITHOUT clobbering other hook events or
-* other entries. Returns a new object (never mutates the input). Re-running the
-* launcher with the same command+event does not duplicate the hook.
-*/
-function mergeStopHookIntoSettings(existing, command, event = "Stop", timeoutSec, matcher) {
-	const base = existing && typeof existing === "object" ? { ...existing } : {};
-	const hooks = base.hooks && typeof base.hooks === "object" ? { ...base.hooks } : {};
-	const arr = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
-	if (!arr.some((e) => entryHasCommand(e, command))) {
-		const hook = {
-			type: "command",
-			command
-		};
-		if (typeof timeoutSec === "number" && Number.isFinite(timeoutSec) && timeoutSec > 0) hook.timeout = timeoutSec;
-		arr.push(matcher ? {
-			matcher,
-			hooks: [hook]
-		} : { hooks: [hook] });
-	}
-	hooks[event] = arr;
-	base.hooks = hooks;
-	return base;
-}
-async function decideStopHook(input) {
-	const maxBlocks = input.maxBlocks ?? 2;
-	let payload = {};
-	let parsed = false;
-	try {
-		const p = JSON.parse(input.stdin);
-		if (p && typeof p === "object") {
-			payload = p;
-			parsed = true;
-		}
-	} catch {}
-	if (!parsed) return { exitCode: 0 };
-	if (isSubagentContext(payload)) return { exitCode: 0 };
-	const sessionId = typeof payload.session_id === "string" && payload.session_id.length > 0 ? payload.session_id : "";
-	if (!sessionId) return { exitCode: 0 };
-	const cwdRaw = typeof payload.cwd === "string" && payload.cwd.length > 0 ? payload.cwd : input.fallbackCwd;
-	let cwd = cwdRaw;
-	try {
-		cwd = await promises.realpath(cwdRaw);
-	} catch {}
-	let enabled;
-	try {
-		enabled = await input.isEnabledForRepo(cwd);
-	} catch {
-		return { exitCode: 0 };
-	}
-	if (!enabled) return { exitCode: 0 };
-	let priorBlocks;
-	try {
-		priorBlocks = await input.budget.count(sessionId);
-	} catch {
-		return { exitCode: 0 };
-	}
-	if (priorBlocks >= maxBlocks) return {
-		exitCode: 0,
-		stderr: `structural gate: reached the ${maxBlocks}-block limit for this prompt; allowing the stop WITHOUT re-running the checks. If the failures from the last block are unfixed, they are shipping — run the checks manually to verify.`
-	};
-	let resolvedKey = input.gateId;
-	let dynamicBaselineKey;
-	const planMode = input.planMode === true || payload.plan_mode === true;
-	const scanDiff = (diff) => planMode ? stripPlanMemoryDiffHunks(diff) : diff;
-	const capturedDiff = async (workdir) => {
-		try {
-			return {
-				diff: await input.captureDiff(workdir),
-				captured: true
-			};
-		} catch {
-			return {
-				diff: "",
-				captured: false
-			};
-		}
-	};
-	const runGate = async () => {
-		if (input.resolveChecks) {
-			const resolved = await input.resolveChecks(cwd).catch(() => null);
-			if (!resolved || resolved.checks.length === 0) return null;
-			resolvedKey = resolved.descriptorKey;
-			dynamicBaselineKey = resolved.baselineKey;
-			const workdir = resolved.workdir || cwd;
-			const { diff, captured } = await capturedDiff(workdir);
-			if (captured && diff.length === 0) return {
-				kind: "no-diff",
-				diff
-			};
-			const result = await evaluateStopGate({
-				checks: resolved.checks,
-				cwd: workdir,
-				exec: input.exec,
-				diff: captured ? scanDiff(diff) : ""
-			});
-			return {
-				kind: "evaluated",
-				failedChecks: [...result.failedChecks],
-				weakeningPatterns: [...new Set(result.weakening.map((w) => w.pattern))],
-				diff
-			};
-		}
-		const { diff, captured } = await capturedDiff(cwd);
-		if (captured && diff.length === 0) return {
-			kind: "no-diff",
-			diff
-		};
-		const result = await runStopGateForLaunch({
-			workspace: cwd,
-			gateId: input.gateId,
-			exec: input.exec,
-			diff: captured ? scanDiff(diff) : ""
-		});
-		return {
-			kind: "evaluated",
-			failedChecks: [...result.failedChecks],
-			weakeningPatterns: [...new Set(result.weakening.map((w) => w.pattern))],
-			diff
-		};
-	};
-	const timeoutMs = input.timeoutMs ?? 3e5;
-	let timer;
-	const raced = await Promise.race([runGate(), new Promise((resolve) => {
-		timer = setTimeout(() => resolve("timeout"), timeoutMs);
-	})]);
-	if (timer) clearTimeout(timer);
-	if (raced === "timeout") return { exitCode: 0 };
-	if (raced === null) return { exitCode: 0 };
-	if (raced.kind === "no-diff") return { exitCode: 0 };
-	const baselineKey = dynamicBaselineKey ?? JSON.stringify([
-		sessionId,
-		cwd,
-		resolvedKey
-	]);
-	const recorded = await input.baseline.get(baselineKey).catch(() => null);
-	if (recorded === null) await input.baseline.set(baselineKey, raced.failedChecks).catch(() => {});
-	const regressed = regressions(raced.failedChecks, recorded);
-	const weakened = raced.weakeningPatterns.length > 0;
-	if (regressed.length === 0 && !weakened) {
-		await maybeSpawnReview(input, sessionId, cwd, raced.diff);
-		return { exitCode: 0 };
-	}
-	try {
-		await input.budget.record(sessionId);
-	} catch {
-		return { exitCode: 0 };
-	}
-	const parts = [];
-	if (regressed.length > 0) parts.push(`regressed gates: ${regressed.join(", ")}`);
-	if (weakened) parts.push(`gate-weakening in the diff: ${raced.weakeningPatterns.join(", ")}`);
-	return {
-		exitCode: 2,
-		stderr: `structural gate failed (block ${priorBlocks + 1}/${maxBlocks}): ${parts.join("; ")}. Fix the failing checks and revert any gate-weakening (no new .skip / as any / lint-disable) before finishing.`
-	};
-}
-/**
-* The advisory-review side-effect on a GREEN stop: debounce by diff hash, then
-* fire the detached background reviewer. ADVISORY-ONLY — it returns void, never
-* throws (every step is swallowed), and the caller does not await its result for
-* the exit decision. A no-op when the review layer isn't wired (no debounce /
-* spawn injected, e.g. GH_ROUTER_DISABLE_STOP_REVIEW) or the diff is empty.
-*
-* `markReviewed` runs BEFORE the spawn so a crashing spawn still records the
-* debounce (an identical tree won't re-trigger on the next stop). The review is
-* gated on the diff CHANGING since the last review — without it, every stop of
-* an unchanged tree would re-spend a background gpt-5.6-sol review.
-*
-* The whole body is bounded by a short timeout (the stores are local temp files
-* that complete in well under a millisecond in practice, so the timeout never
-* fires normally — but if the debounce read/write ever stalled, the stop must
-* still proceed promptly; the advisory layer never delays a clean stop).
-*/
-const REVIEW_SIDE_EFFECT_BUDGET_MS = 2e3;
-async function maybeSpawnReview(input, sessionId, cwd, diff) {
-	if (!input.reviewDebounce || !input.spawnReview) return;
-	if (diff.trim().length === 0) return;
-	let timer;
-	try {
-		const work = (async () => {
-			const diffHash = createHash("sha256").update(diff).digest("hex");
-			if (!await input.reviewDebounce.shouldReview(sessionId, diffHash)) return;
-			await input.reviewDebounce.markReviewed(sessionId, diffHash);
-			input.spawnReview({
-				sessionId,
-				cwd,
-				diff,
-				diffHash
-			});
-		})();
-		await Promise.race([work, new Promise((resolve) => {
-			timer = setTimeout(resolve, REVIEW_SIDE_EFFECT_BUDGET_MS);
-		})]);
-	} catch {} finally {
-		if (timer) clearTimeout(timer);
-	}
-}
-/**
-* A file-backed `BlockBudget` under `stateDir`, keyed by a hash of the session id
-* (so a session id is never written verbatim to a predictable path). Best-effort:
-* a read miss counts as 0; `record` increments. A write/read error propagates so
-* `decideStopHook` stands down (it can't guarantee termination without the
-* budget).
-*/
-function fileBlockBudget(stateDir) {
-	const fileFor = (sid) => path.join(stateDir, `block-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
-	const readCount = async (sid) => {
-		try {
-			const raw = await promises.readFile(fileFor(sid), "utf8");
-			const n = Number.parseInt(raw.trim(), 10);
-			return Number.isFinite(n) && n > 0 ? n : 0;
-		} catch {
-			return 0;
-		}
-	};
-	return {
-		count: readCount,
-		async record(sid) {
-			const next = await readCount(sid) + 1;
-			await promises.mkdir(stateDir, { recursive: true });
-			await promises.writeFile(fileFor(sid), String(next), { mode: 384 });
-		},
-		async reset(sid) {
-			await promises.unlink(fileFor(sid)).catch(() => {});
-		}
-	};
-}
-/**
-* Build the shell command string Claude Code runs for the Stop hook. Invokes the
-* running github-router via its node/bun binary so it works regardless of PATH.
-* Pure (takes the binary + script paths) so the quoting is unit-testable; the
-* cross-platform firing is verified by the gated E2E.
-*/
-function buildStopHookCommand(execPath, scriptPath) {
-	const q = (s) => `"${s}"`;
-	if (scriptPath && scriptPath !== execPath) return `${q(execPath)} ${q(scriptPath)} internal-stop-hook`;
-	return `${q(execPath)} internal-stop-hook`;
-}
-/**
-* Build the shell command Claude Code runs for the SessionStart/SessionEnd hooks
-* (registered only when github-router runs inside an ai-or-die Terminal tab). The
-* sidecar path is baked in as a literal `--out` arg — NOT passed via env — so it
-* survives `AIORDIE_CLAUDE_BIND` being stripped from the child's environment and a
-* nested `github-router claude` can't inherit it. Pure (binary + script + out
-* paths) for unit-testable quoting; the live firing is verified end-to-end.
-*/
-function buildSessionBindHookCommand(execPath, scriptPath, outPath) {
-	const q = (s) => `"${s}"`;
-	return `${scriptPath && scriptPath !== execPath ? `${q(execPath)} ${q(scriptPath)}` : q(execPath)} internal-session-bind --out ${q(outPath)}`;
-}
-/** Command for the `internal-artifact-open` hook (no args — token comes from the
-*  mirror creds file, plan from the plans dir; nothing secret in argv). */
-function buildArtifactOpenHookCommand(execPath, scriptPath) {
-	const q = (s) => `"${s}"`;
-	return `${scriptPath && scriptPath !== execPath ? `${q(execPath)} ${q(scriptPath)}` : q(execPath)} internal-artifact-open`;
-}
-/**
-* Read-merge-atomic-write the Stop hook into a Claude Code `settings.json` file
-* (the mirrored one). A MISSING file (ENOENT) starts from `{}`; any OTHER read or
-* parse error THROWS (the caller's try/catch warns and continues) rather than
-* overwriting a file we couldn't understand with our defaults. Preserves every
-* other setting, is idempotent, and uses temp+rename so Claude Code's mtime
-* watcher never sees a half-written file. Returns the merged object.
-*/
-async function injectStopHookIntoSettingsFile(settingsPath, command, event = "Stop", timeoutSec, matcher) {
-	let existing = {};
-	let raw;
-	try {
-		raw = await promises.readFile(settingsPath, "utf8");
-	} catch (err) {
-		if (err.code !== "ENOENT") throw err;
-		raw = void 0;
-	}
-	if (raw !== void 0) {
-		const parsed = JSON.parse(raw);
-		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) existing = parsed;
-		else throw new Error(`settings.json at ${settingsPath} is not a JSON object; refusing to overwrite`);
-	}
-	const merged = mergeStopHookIntoSettings(existing, command, event, timeoutSec, matcher);
-	const tmp = `${settingsPath}.${process.pid}.tmp`;
-	await promises.writeFile(tmp, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
-	await promises.rename(tmp, settingsPath);
-	return merged;
-}
-//#endregion
 //#region src/lib/orchestration/attest.ts
 function isNonEmptyString(v) {
 	return typeof v === "string" && v.length > 0;
@@ -35174,6 +33692,6 @@ function enumerateInjectedMcpToolNames(groupKeys, opts = {}) {
 	return [...new Set(names)];
 }
 //#endregion
-export { searchWeb as $, DEFAULT_CLAUDE_MODEL_FALLBACKS as $t, trustRepo as A, state as An, getTokenCount as At, TEST_DEFAULT_MODEL as B, hasSupportedBrowserInstalled as Bt, fileLastPromptStore as C, fetchWithTransientRetry as Cn, scoutModel as Ct, repoRoot as D, copilotBaseUrl as Dn, shimDefaultsToXhigh as Dt, repoFingerprint as E, GITHUB_API_BASE_URL as En, workerToolsEnabled as Et, EXPLORE_DEFAULT_MODEL as F, createChatCompletions as Ft, buildEnv as G, CONDENSED_OPERATING_SEQUENCE as Gt, resolveModeDefaults as H, extractTarGzMember as Ht, EXPLORE_DEFAULT_THINKING as I, MAX_RESPONSE_BODY_BYTES as It, toolbeltEnabled as J, ArtifactClient as Jt, availableToolCommands as K, DEFINITION_OF_GREATNESS as Kt, IMPLEMENT_DEFAULT_MODEL as L, readResponseBodyCapped as Lt, resolveSealedGate as M, resolveMcpToolTimeoutMs as Mt, BROWSE_DEFAULT_MODEL as N, pickEndpoint as Nt, stopGateEnabledForRepo as O, copilotHeaders as On, countTokens as Ot, DEFAULT_MODEL as P, createResponses as Pt, assetFor as Q, toolbeltPathOverride as Qt, PLAN_DEFAULT_MODEL as R, parseJsonOrDiagnose as Rt, fileFindingsStore as S, getGitHubUser as Sn, reviewerModel as St, isSubagentContext as T, forwardError as Tn, standInToolEnabled as Tt, resolveWorkerRunOpts as U, extractZipMember as Ut, appendPlanReminder as V, provisionAndIndexColbert as Vt, runWorkerAgent as W, warmTreeSitterPool as Wt, vscodeRipgrepPath as X, buildWorkspaceHeaderJson as Xt, toolbeltSkipSet as Y, buildWorkspaceHeaderHelperCommand as Yt, TOOLBELT_TOOLS$1 as Z, collapsePathKeys as Zt, stopGateDisabled as _, isNullish as _n, browserCompoundToolsEnabled as _t, buildPeerAwarenessSnippet as a, generateRandomPort as an, buildAnthropicErrorEvent as at, stopReviewEnabled as b, sleep$3 as bn, geminiAvailable as bt, personasFor as c, withInstallLock as cn, logStreamError as ct, buildStopHookCommand as d, setupGitHubToken as dn, handleMcpDelete as dt, DEFAULT_CODEX_MODEL as en, ADVISOR_INTERNAL_TOOL_NAME as et, captureLaunchBaseline as f, tryRefreshAndRetry as fn, handleMcpPost as ft, launchBaselineKey as g, filterBetaHeader as gn, browseAgentEnabled as gt, injectStopHookIntoSettingsFile as h, cacheVSCodeVersion as hn, brainstormModel as ht, buildAgentPrompt as i, UPSTREAM_INACTIVITY_TIMEOUT_MS as in, isAdvisorRequested as it, liveExec as j, assembleResponsesPayload as jt, stopReviewStateDir as k, githubHeaders as kn, createMessages as kt, buildArtifactOpenHookCommand as l, setupCopilotToken as ln, readIteratorWithTimeout as lt, fileBlockBudget as m, cacheModels as mn, artifactToolsEnabled as mt, MCP_GROUPS as n, DEFAULT_PORT as nn, buildAdvisorStream as nt, buildPeerAwarenessSummary as o, pickClaudeDefault as on, buildOpenAIErrorEvent as ot, decideStopHook as p, cacheCopilotVersion as pn, agentToolsEnabled as pt, buildToolbeltAwareness as q, shouldUseInsecureTls as qt, assertMcpToolSurfaceConsistent as r, UPSTREAM_FETCH_TIMEOUT_MS as rn, injectAdvisorTool as rt, enumerateInjectedMcpToolNames as s, getPackageVersion as sn, isControllerClosedError as st, GROUP_META as t, DEFAULT_CODEX_MODEL_FALLBACKS as tn, ADVISOR_TOOL_INSTRUCTIONS as tt, buildSessionBindHookCommand as u, setupGitHubAgentToken as un, relayAnthropicStream as ut, stopGateId as v, resolveCodexModel as vn, browserToolsEnabled as vt, fileReviewDebounce as w, HTTPError as wn, scribeModel as wt, fileBaselineStore as x, getModels as xn, nativeSubagentModel as xt, stopGatePlanMode as y, resolveModel as yn, fleetToolsEnabled as yt, REVIEW_DEFAULT_MODEL as z, provisionBrowserAssets as zt };
+export { scoutModel as $, ADVISOR_INTERNAL_TOOL_NAME as A, UPSTREAM_FETCH_TIMEOUT_MS as At, relayAnthropicStream as B, buildToolbeltAwareness as C, shouldUseInsecureTls as Ct, TOOLBELT_TOOLS$1 as D, DEFAULT_CODEX_MODEL as Dt, vscodeRipgrepPath as E, DEFAULT_CLAUDE_MODEL_FALLBACKS as Et, buildAnthropicErrorEvent as F, brainstormModel as G, handleMcpPost as H, buildOpenAIErrorEvent as I, browserToolsEnabled as J, browseAgentEnabled as K, isControllerClosedError as L, buildAdvisorStream as M, generateRandomPort as Mt, injectAdvisorTool as N, pickClaudeDefault as Nt, assetFor as O, DEFAULT_CODEX_MODEL_FALLBACKS as Ot, isAdvisorRequested as P, withInstallLock as Pt, reviewerModel as Q, logStreamError as R, availableToolCommands as S, DEFINITION_OF_GREATNESS as St, toolbeltSkipSet as T, toolbeltPathOverride as Tt, agentToolsEnabled as U, handleMcpDelete as V, artifactToolsEnabled as W, geminiAvailable as X, fleetToolsEnabled as Y, nativeSubagentModel as Z, appendPlanReminder as _, provisionAndIndexColbert as _t, buildPeerAwarenessSnippet as a, createMessages as at, runWorkerAgent as b, warmTreeSitterPool as bt, personasFor as c, resolveMcpToolTimeoutMs as ct, EXPLORE_DEFAULT_MODEL as d, createChatCompletions as dt, scribeModel as et, EXPLORE_DEFAULT_THINKING as f, MAX_RESPONSE_BODY_BYTES as ft, TEST_DEFAULT_MODEL as g, hasSupportedBrowserInstalled as gt, REVIEW_DEFAULT_MODEL as h, provisionBrowserAssets as ht, buildAgentPrompt as i, countTokens as it, ADVISOR_TOOL_INSTRUCTIONS as j, UPSTREAM_INACTIVITY_TIMEOUT_MS as jt, searchWeb as k, DEFAULT_PORT as kt, BROWSE_DEFAULT_MODEL as l, pickEndpoint as lt, PLAN_DEFAULT_MODEL as m, parseJsonOrDiagnose as mt, MCP_GROUPS as n, workerToolsEnabled as nt, buildPeerAwarenessSummary as o, getTokenCount as ot, IMPLEMENT_DEFAULT_MODEL as p, readResponseBodyCapped as pt, browserCompoundToolsEnabled as q, assertMcpToolSurfaceConsistent as r, shimDefaultsToXhigh as rt, enumerateInjectedMcpToolNames as s, assembleResponsesPayload as st, GROUP_META as t, standInToolEnabled as tt, DEFAULT_MODEL as u, createResponses as ut, resolveModeDefaults as v, extractTarGzMember as vt, toolbeltEnabled as w, collapsePathKeys as wt, buildEnv as x, CONDENSED_OPERATING_SEQUENCE as xt, resolveWorkerRunOpts as y, extractZipMember as yt, readIteratorWithTimeout as z };
 
-//# sourceMappingURL=peer-mcp-personas-DJzLpfDJ.js.map
+//# sourceMappingURL=peer-mcp-personas-BDet588n.js.map