github-router 0.3.250 → 0.3.256

package/dist/{peer-mcp-personas-BvommiSI.js → peer-mcp-personas-BPl6_V2A.js}

@@ -1,19 +1,26 @@
-import { t as PATHS } from "./paths-BjTMI_xK.js";
-import { d as resolveExecutable, f as runCommandCapture, l as parseBoolEnv, m as runManagedExeCapture, n as isPidAlive, o as trackChild, r as registerColbertExitHandlers, t as getColbertInstanceUuid, u as parseIntEnv } from "./lifecycle-DHZsVN8j.js";
-import { i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-CUf1UDrH.js";
+import { t as getPackageVersion } from "./version-_Q1WpsQp.js";
+import { t as PATHS } from "./paths-C1cLZ7Ga.js";
+import { C as copilotHeaders, E as githubAgentHeaders, O as state, S as copilotBaseUrl, T as githubAgentGraphQLHeaders, _ as withTransientRetry, b as GITHUB_API_BASE_URL, d as resolveModel, f as sleep$2, g as fetchWithTransientRetry, h as isAllowedCopilotHost, i as tryRefreshAndRetry, v as HTTPError, w as copilotVersion, x as GITHUB_GRAPHQL_URL } from "./token-R2ocFC3M.js";
+import { a as resolveExecutable, c as runManagedExeCapture, i as parseIntEnv, r as parseBoolEnv } from "./exec-DTO2oin0.js";
+import { i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-DD88ka3f.js";
+import { t as MCP_WORKSPACE_HEADER } from "./mcp-workspace-header-CGJbNeHb.js";
+import { n as ArtifactError, r as applyInsecureTls, t as ArtifactClient } from "./client-CQMfroGV.js";
+import { n as isPidAlive, o as trackChild, r as registerColbertExitHandlers, t as getColbertInstanceUuid } from "./lifecycle-Byw5s1G8.js";
+import { h as runGateChecks, m as sealedGateIds, p as resolveSealedGate } from "./stop-gate-hook-DQc2KV7B.js";
+import { t as liveExec } from "./orchestration-hRU4TdWr.js";
 import { createRequire } from "node:module";
 import consola from "consola";
-import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import fs, { chmod, mkdir, open, readFile, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
-import * as os$1 from "node:os";
-import os, { homedir, platform, tmpdir } from "node:os";
+import { chmodSync, closeSync, constants, cpSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import * as path$1 from "node:path";
 import path, { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import fs$1, { chmod, mkdir, open, readFile, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
+import * as os$1 from "node:os";
+import os, { homedir, platform } from "node:os";
 import process$1 from "node:process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
-import { chmodSync, closeSync, constants, cpSync, existsSync, mkdirSync, openSync, promises, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { Agent, ProxyAgent } from "undici";
+import { ProxyAgent } from "undici";
 import { z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { performance } from "node:perf_hooks";
@@ -33,914 +40,6 @@ import "diff";
 //#region \0rolldown/runtime.js
 var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
-//#region src/lib/state.ts
-const state = {
-	accountType: "enterprise",
-	manualApprove: false,
-	rateLimitWait: false,
-	showToken: false,
-	extendedBetas: false,
-	browseEnabled: false,
-	fleetEnabled: false,
-	agentsEnabled: false,
-	powerBrowseEnabled: false,
-	humanlikeForce: "auto",
-	sessionId: randomUUID(),
-	machineId: randomBytes(32).toString("hex")
-};
-//#endregion
-//#region src/lib/api-config.ts
-const standardHeaders = () => ({
-	"content-type": "application/json",
-	accept: "application/json"
-});
-const DEFAULT_COPILOT_VERSION = "0.43.2026033101";
-function copilotVersion(state) {
-	return state.copilotVersion ?? DEFAULT_COPILOT_VERSION;
-}
-const API_VERSION = "2026-01-09";
-const copilotBaseUrl = (state) => state.copilotApiUrl ?? "https://api.githubcopilot.com";
-const copilotHeaders = (state, vision = false, integrationId = "vscode-chat") => {
-	const version = copilotVersion(state);
-	const headers = {
-		Authorization: `Bearer ${state.copilotToken}`,
-		"content-type": standardHeaders()["content-type"],
-		"copilot-integration-id": integrationId,
-		"editor-version": `vscode/${state.vsCodeVersion}`,
-		"editor-plugin-version": `copilot-chat/${version}`,
-		"user-agent": `GitHubCopilotChat/${version}`,
-		"openai-intent": "conversation-panel",
-		"x-interaction-type": "conversation-panel",
-		"x-github-api-version": API_VERSION,
-		"x-request-id": randomUUID(),
-		"x-vscode-user-agent-library-version": "electron-fetch",
-		"VScode-SessionId": state.sessionId,
-		"VScode-MachineId": state.machineId
-	};
-	if (vision) headers["copilot-vision-request"] = "true";
-	return headers;
-};
-const GITHUB_API_BASE_URL = process.env.GITHUB_API_URL ?? "https://api.github.com";
-const githubHeaders = (state) => ({
-	...standardHeaders(),
-	authorization: `token ${state.githubToken}`,
-	"editor-version": `vscode/${state.vsCodeVersion}`,
-	"editor-plugin-version": `copilot-chat/${copilotVersion(state)}`,
-	"user-agent": `GitHubCopilotChat/${copilotVersion(state)}`,
-	"x-github-api-version": API_VERSION,
-	"x-vscode-user-agent-library-version": "electron-fetch"
-});
-const GITHUB_BASE_URL = "https://github.com";
-const GITHUB_CLIENT_ID = "Iv1.b507a08c87ecfe98";
-const GITHUB_APP_SCOPES = ["read:user"].join(" ");
-const GITHUB_AGENT_CLIENT_ID = "178c6fc778ccc68e1d6a";
-const GITHUB_AGENT_SCOPES = [
-	"repo",
-	"workflow",
-	"read:org"
-].join(" ");
-const GITHUB_GRAPHQL_URL = process.env.GITHUB_GRAPHQL_URL ?? "https://api.github.com/graphql";
-const GITHUB_REST_API_VERSION = "2022-11-28";
-const githubAgentHeaders = (state) => ({
-	...standardHeaders(),
-	authorization: `token ${state.githubAgentToken}`,
-	"x-github-api-version": GITHUB_REST_API_VERSION,
-	"user-agent": "github-router-first-mate"
-});
-const githubAgentGraphQLHeaders = (state, features) => ({
-	...githubAgentHeaders(state),
-	...features ? { "GraphQL-Features": features } : {}
-});
-//#endregion
-//#region src/lib/error.ts
-var HTTPError = class extends Error {
-	response;
-	constructor(message, response) {
-		super(message);
-		this.response = response;
-	}
-};
-async function forwardError(c, error) {
-	consola.error(`Error occurred at ${c.req.path}:`, error);
-	if (error instanceof HTTPError) {
-		const errorText = await error.response.text().catch(() => "");
-		let errorJson;
-		try {
-			errorJson = JSON.parse(errorText);
-		} catch {
-			errorJson = void 0;
-		}
-		if (isContextOverflow(error.response.status, errorJson, errorText)) {
-			const upstream = resolveErrorMessage(errorJson, errorText);
-			consola.error("HTTP error (mapped to overflow):", errorJson ?? errorText);
-			return c.json({
-				type: "error",
-				error: {
-					type: "invalid_request_error",
-					message: `prompt is too long: ${upstream}`
-				}
-			}, 400);
-		}
-		const responseStatus = error.response.status === 401 ? 503 : error.response.status;
-		if (isAnthropicError(errorJson)) {
-			consola.error("HTTP error:", errorJson);
-			return c.json(errorJson, responseStatus);
-		}
-		const message = resolveErrorMessage(errorJson, errorText);
-		consola.error("HTTP error:", errorJson ?? errorText);
-		return c.json({
-			type: "error",
-			error: {
-				type: resolveErrorType(responseStatus),
-				message
-			}
-		}, responseStatus);
-	}
-	return c.json({
-		type: "error",
-		error: {
-			type: "api_error",
-			message: error instanceof Error ? error.message : String(error)
-		}
-	}, 500);
-}
-function resolveErrorMessage(errorJson, fallback) {
-	if (typeof errorJson !== "object" || errorJson === null) return fallback;
-	const errorRecord = errorJson;
-	if (errorRecord.message !== void 0) return String(errorRecord.message);
-	if (typeof errorRecord.error === "object" && errorRecord.error !== null) {
-		const nestedRecord = errorRecord.error;
-		if (nestedRecord.message !== void 0) return String(nestedRecord.message);
-	}
-	return fallback;
-}
-/**
-* Check if a parsed JSON body is already in Anthropic error format:
-* { type: "error", error: { type: "...", message: "..." } }
-*/
-function isAnthropicError(json) {
-	if (typeof json !== "object" || json === null) return false;
-	const record = json;
-	if (record.type !== "error") return false;
-	if (typeof record.error !== "object" || record.error === null) return false;
-	const inner = record.error;
-	return typeof inner.type === "string" && typeof inner.message === "string";
-}
-const CONTEXT_OVERFLOW_SUBSTRINGS = [
-	"prompt is too long",
-	"context_length_exceeded",
-	"context length exceeded",
-	"input is too long",
-	"maximum context length",
-	"too many tokens"
-];
-/**
-* Detect upstream context-overflow errors so we can remap them to a 400
-* "prompt is too long" shape that triggers Claude Code self-compaction.
-*
-* Always remaps 413 (treated as a hard payload-size signal regardless of
-* body wording). Remaps 400 only when the error text contains one of the
-* known overflow substrings — a regular 400 (e.g. "model not found") must
-* NOT remap.
-*/
-function isContextOverflow(status, errorJson, errorText) {
-	if (status === 413) return true;
-	if (status !== 400) return false;
-	const haystack = (errorText + " " + (typeof errorJson === "object" && errorJson !== null ? JSON.stringify(errorJson) : "")).toLowerCase();
-	return CONTEXT_OVERFLOW_SUBSTRINGS.some((s) => haystack.includes(s));
-}
-/**
-* Map HTTP status to Anthropic error type.
-*
-* Note: a 401 from upstream is remapped to 503 in `forwardError` BEFORE
-* this function is called (no-401 invariant — see comment there). The
-* 401 → "authentication_error" mapping below is preserved for
-* defensive coverage in case any code path calls `resolveErrorType`
-* directly with an unsanitized status.
-*/
-function resolveErrorType(status) {
-	if (status === 400) return "invalid_request_error";
-	if (status === 401) return "authentication_error";
-	if (status === 403) return "permission_error";
-	if (status === 404) return "not_found_error";
-	if (status === 429) return "rate_limit_error";
-	if (status === 503) return "overloaded_error";
-	if (status === 529) return "overloaded_error";
-	return "api_error";
-}
-//#endregion
-//#region src/lib/upstream-retry.ts
-/**
-* Shared transient-failure retry for upstream calls (`src/lib/upstream-retry.ts`).
-*
-* Retries ONLY on transient conditions — never on success, never on a
-* deterministic 4xx (400/401/403/404…), so a malformed request or auth
-* failure fails fast instead of being hammered. 401 is intentionally NOT
-* retried here: it stays with the existing token-refresh path so the
-* 401→503 forwardError invariant is preserved.
-*
-* Retryable:
-*   - HTTP 429 + 5xx (500/502/503/504) — the "upstream is sick" class.
-*   - network errors (ECONNRESET / "fetch failed" / "terminated" / EPIPE …).
-*   - upstream TIMEOUT aborts: an AbortError thrown while the CALLER'S
-*     `signal` is NOT aborted (a user cancel aborts the caller's signal
-*     and is rethrown immediately, never retried).
-*
-* Exponential backoff + FULL jitter, capped, honoring `Retry-After`. The
-* inter-attempt sleep is abortable so a user cancel during backoff
-* returns promptly. Bounded `attempts` keep a single call from holding an
-* inflight slot indefinitely (robust AND fast).
-*
-* Streaming note: the user-facing passthrough and the worker loop must
-* only retry in the PRE-FIRST-BYTE window — a retry after bytes have
-* streamed would duplicate output. Callers there pass a `doFetch` that
-* has not yet handed its body to the consumer.
-*/
-const DEFAULT_RETRY_STATUSES = [
-	429,
-	500,
-	502,
-	503,
-	504
-];
-function parseRetryAfter(headerValue) {
-	if (!headerValue) return void 0;
-	const secs = Number(headerValue);
-	if (Number.isFinite(secs)) return Math.max(0, secs * 1e3);
-	const dateMs = Date.parse(headerValue);
-	if (Number.isFinite(dateMs)) return Math.max(0, dateMs - Date.now());
-}
-/**
-* A thrown fetch error that is worth retrying — network resets, broken
-* pipes, DNS hiccups, and timeout aborts. NOTE: the caller must already
-* have ruled out a user cancel (caller signal aborted) before calling
-* this, since a timeout abort and a user-cancel abort look identical.
-*/
-function isTransientNetworkError(err) {
-	const e = err;
-	if (!e) return false;
-	if (e.name === "AbortError" || e.name === "TimeoutError") return true;
-	const msg = (e.message ?? "").toLowerCase();
-	if (msg.includes("terminated") || msg.includes("fetch failed") || msg.includes("network") || msg.includes("socket") || msg.includes("econnreset") || msg.includes("etimedout") || msg.includes("econnrefused") || msg.includes("epipe") || msg.includes("enotfound")) return true;
-	const code = e.code ?? e.cause?.code;
-	return code !== void 0 && [
-		"ECONNRESET",
-		"ETIMEDOUT",
-		"ECONNREFUSED",
-		"EPIPE",
-		"ENOTFOUND"
-	].includes(code);
-}
-/** Sleep that resolves early (does not reject) when `signal` aborts — the
-*  retry loop re-checks `signal.aborted` at the top and throws there. */
-function abortableSleep(ms, signal) {
-	if (ms <= 0) return Promise.resolve();
-	return new Promise((resolve) => {
-		let settled = false;
-		const done = () => {
-			if (settled) return;
-			settled = true;
-			clearTimeout(timer);
-			signal?.removeEventListener("abort", done);
-			resolve();
-		};
-		const timer = setTimeout(done, ms);
-		if (signal) {
-			if (signal.aborted) {
-				done();
-				return;
-			}
-			signal.addEventListener("abort", done, { once: true });
-		}
-	});
-}
-/**
-* Run `doFetch` with bounded transient-failure retries. `doFetch` is a
-* thunk so each attempt issues a FRESH request (bodies can't be replayed
-* from a consumed stream). Returns the final `Response` — which may still
-* carry a retryable status if all attempts are exhausted (the caller
-* handles that as it would a single-shot failure).
-*/
-async function fetchWithTransientRetry(doFetch, opts = {}) {
-	const attempts = Math.max(1, opts.attempts ?? 3);
-	const retryStatuses = opts.retryStatuses ?? DEFAULT_RETRY_STATUSES;
-	const baseDelayMs = opts.baseDelayMs ?? 250;
-	const maxDelayMs = opts.maxDelayMs ?? 4e3;
-	const { signal, label } = opts;
-	for (let attempt = 1;; attempt++) {
-		if (signal?.aborted) throw new DOMException("This operation was aborted", "AbortError");
-		let res;
-		let caught;
-		try {
-			res = await doFetch(attempt);
-		} catch (err) {
-			caught = err;
-		}
-		if (res && !retryStatuses.includes(res.status)) return res;
-		if (caught !== void 0) {
-			if (signal?.aborted) throw caught;
-			if (!isTransientNetworkError(caught)) throw caught;
-		}
-		if (attempt >= attempts) {
-			if (res) return res;
-			throw caught;
-		}
-		const retryAfterMs = res ? parseRetryAfter(res.headers.get("retry-after")) : void 0;
-		if (res?.body) try {
-			await res.body.cancel();
-		} catch {}
-		const expCap = Math.min(maxDelayMs, baseDelayMs * 2 ** (attempt - 1));
-		const delay = Math.min(maxDelayMs, retryAfterMs ?? Math.round(Math.random() * expCap));
-		if (label) {
-			const why = res ? `HTTP ${res.status}` : caught?.name ?? "error";
-			consola.debug(`[upstream-retry] ${label}: attempt ${attempt}/${attempts} failed (${why}); retrying in ${delay}ms`);
-		}
-		await abortableSleep(delay, signal);
-	}
-}
-/** Extract an HTTP status from a thrown error (HTTPError carries
-*  `.response.status`; others may carry `.status`/`.statusCode`; last
-*  resort parses `"HTTP <code>"` from the message). */
-function errorStatus(err) {
-	const e = err;
-	for (const v of [
-		e?.status,
-		e?.statusCode,
-		e?.response?.status
-	]) if (typeof v === "number") return v;
-	const m = /\bHTTP (\d{3})\b/.exec(e?.message ?? "");
-	return m ? Number(m[1]) : void 0;
-}
-/**
-* Generic transient-retry for a non-`Response`-returning call (e.g. the
-* Copilot service clients, which throw `HTTPError` on non-OK and throw on
-* network errors). Retries `fn()` when it throws a transient error — an
-* `HTTPError`-like with a retryable status (429/5xx) OR a transient
-* network/timeout error — using the same backoff + abort semantics as
-* `fetchWithTransientRetry`. Never retries a deterministic 4xx (incl.
-* 401), a non-transient throw, or a user cancel.
-*/
-async function withTransientRetry(fn, opts = {}) {
-	const attempts = Math.max(1, opts.attempts ?? 3);
-	const retryStatuses = opts.retryStatuses ?? DEFAULT_RETRY_STATUSES;
-	const baseDelayMs = opts.baseDelayMs ?? 250;
-	const maxDelayMs = opts.maxDelayMs ?? 4e3;
-	const { signal, label } = opts;
-	for (let attempt = 1;; attempt++) {
-		if (signal?.aborted) throw new DOMException("This operation was aborted", "AbortError");
-		try {
-			return await fn(attempt);
-		} catch (err) {
-			if (signal?.aborted) throw err;
-			const status = errorStatus(err);
-			if (!(status !== void 0 && retryStatuses.includes(status) || isTransientNetworkError(err)) || attempt >= attempts) throw err;
-			const retryAfterMs = parseRetryAfter(err?.response?.headers?.get?.("retry-after") ?? null);
-			const expCap = Math.min(maxDelayMs, baseDelayMs * 2 ** (attempt - 1));
-			const delay = Math.min(maxDelayMs, retryAfterMs ?? Math.round(Math.random() * expCap));
-			if (label) consola.debug(`[upstream-retry] ${label}: attempt ${attempt}/${attempts} threw (${status !== void 0 ? `HTTP ${status}` : err?.name ?? "error"}); retrying in ${delay}ms`);
-			await abortableSleep(delay, signal);
-		}
-	}
-}
-//#endregion
-//#region src/services/github/get-copilot-token.ts
-/**
-* Allowlist of hosts the router will trust as the Copilot API base URL.
-* Anything else returned in `endpoints.api` (e.g. via a tampered or
-* misconfigured token-exchange response) is rejected — otherwise a
-* malicious value would receive the long-lived GitHub PAT we send to
-* `/mcp` for web search (see `src/services/copilot/web-search.ts`).
-*/
-const COPILOT_HOST_ALLOWLIST = [
-	"api.githubcopilot.com",
-	"api.individual.githubcopilot.com",
-	"api.business.githubcopilot.com",
-	"api.enterprise.githubcopilot.com"
-];
-/**
-* True iff `rawUrl` is an HTTPS URL whose host is a trusted Copilot API host.
-* Exported so every path that sends a long-lived token to a discovered
-* Copilot host (web search, first-mate CAPI session logs) shares one allowlist.
-*/
-function isAllowedCopilotHost(rawUrl) {
-	let parsed;
-	try {
-		parsed = new URL(rawUrl);
-	} catch {
-		return false;
-	}
-	if (parsed.protocol !== "https:") return false;
-	return COPILOT_HOST_ALLOWLIST.includes(parsed.hostname);
-}
-const getCopilotToken = async () => {
-	const response = await fetchWithTransientRetry(() => fetch(`${GITHUB_API_BASE_URL}/copilot_internal/v2/token`, { headers: githubHeaders(state) }), { label: "/copilot_internal/v2/token" });
-	if (!response.ok) throw new HTTPError("Failed to get Copilot token", response);
-	const data = await response.json();
-	if (data.endpoints?.api) if (isAllowedCopilotHost(data.endpoints.api)) state.copilotApiUrl = data.endpoints.api;
-	else consola.warn(`Refusing to honor Copilot API endpoint "${data.endpoints.api}" from the token-exchange response — not in allowlist (${COPILOT_HOST_ALLOWLIST.join(", ")}). ` + (state.copilotApiUrl ? `Keeping existing override "${state.copilotApiUrl}".` : `Falling back to the default api.githubcopilot.com.`));
-	return data;
-};
-//#endregion
-//#region src/services/github/get-device-code.ts
-const DEFAULT_DEVICE_APP = {
-	clientId: GITHUB_CLIENT_ID,
-	scope: GITHUB_APP_SCOPES
-};
-async function getDeviceCode(app = DEFAULT_DEVICE_APP) {
-	const response = await fetchWithTransientRetry(() => fetch(`${GITHUB_BASE_URL}/login/device/code`, {
-		method: "POST",
-		headers: standardHeaders(),
-		body: JSON.stringify({
-			client_id: app.clientId,
-			scope: app.scope
-		})
-	}), { label: "/login/device/code" });
-	if (!response.ok) throw new HTTPError("Failed to get device code", response);
-	return await response.json();
-}
-//#endregion
-//#region src/services/github/get-user.ts
-async function getGitHubUser() {
-	const response = await fetchWithTransientRetry(() => fetch(`${GITHUB_API_BASE_URL}/user`, { headers: {
-		authorization: `token ${state.githubToken}`,
-		...standardHeaders()
-	} }), { label: "/user" });
-	if (!response.ok) throw new HTTPError("Failed to get GitHub user", response);
-	return await response.json();
-}
-//#endregion
-//#region src/services/copilot/get-models.ts
-const getModels = async () => {
-	const response = await fetchWithTransientRetry(() => tryRefreshAndRetry(() => fetch(`${copilotBaseUrl(state)}/models`, { headers: copilotHeaders(state) }), "/models"), { label: "/models" });
-	if (!response.ok) throw new HTTPError("Failed to get models", response);
-	return await response.json();
-};
-//#endregion
-//#region src/services/get-copilot-version.ts
-const FALLBACK$1 = "0.43.2026033101";
-async function getCopilotChatVersion() {
-	const controller = new AbortController();
-	const timeout = setTimeout(() => {
-		controller.abort();
-	}, 5e3);
-	try {
-		const response = await fetch("https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery", {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				Accept: "application/json;api-version=7.1-preview.1"
-			},
-			body: JSON.stringify({
-				filters: [{ criteria: [{
-					filterType: 7,
-					value: "GitHub.copilot-chat"
-				}] }],
-				flags: 914
-			}),
-			signal: controller.signal
-		});
-		if (!response.ok) return FALLBACK$1;
-		return (await response.json())?.results?.[0]?.extensions?.[0]?.versions?.[0]?.version ?? FALLBACK$1;
-	} catch {
-		return FALLBACK$1;
-	} finally {
-		clearTimeout(timeout);
-	}
-}
-//#endregion
-//#region src/services/get-vscode-version.ts
-const FALLBACK = "1.104.3";
-async function getVSCodeVersion() {
-	const controller = new AbortController();
-	const timeout = setTimeout(() => {
-		controller.abort();
-	}, 5e3);
-	try {
-		const match = (await (await fetch("https://aur.archlinux.org/cgit/aur.git/plain/PKGBUILD?h=visual-studio-code-bin", { signal: controller.signal })).text()).match(/pkgver=([0-9.]+)/);
-		if (match) return match[1];
-		return FALLBACK;
-	} catch {
-		return FALLBACK;
-	} finally {
-		clearTimeout(timeout);
-	}
-}
-await getVSCodeVersion();
-//#endregion
-//#region src/lib/utils.ts
-const sleep$3 = (ms) => new Promise((resolve) => {
-	setTimeout(resolve, ms);
-});
-const isNullish = (value) => value === null || value === void 0;
-/**
-* Beta prefixes VS Code Copilot Chat v0.43 actually sends.
-* Default mode — makes proxy traffic indistinguishable from VS Code.
-*/
-const VSCODE_BETA_PREFIXES = [
-	"interleaved-thinking-",
-	"context-management-",
-	"advanced-tool-use-"
-];
-/**
-* Extended beta prefixes for Claude CLI compatibility.
-* Enabled via --extended-betas flag. Includes all betas confirmed
-* to work with the Copilot API.
-*
-* Notably absent (Copilot 400s on these — verified live):
-*   context-1m-, skills-, files-api-, code-execution-, output-128k-,
-*   advisor-tool- (see EXPLICITLY_STRIPPED_BETA_PREFIXES below).
-* 1M context is unlocked by selecting `claude-opus-4.7-1m-internal`
-* as the model id, not via a beta header.
-*
-* Empirical verification (2026-05-11 against api.enterprise.githubcopilot.com):
-*   task-budgets-2026-03-13          → 200 ACCEPTED (cost-ceiling leverage)
-*   token-efficient-tools-2026-03-28 → 200 ACCEPTED (per-tool token saving)
-*   summarize-connector-text-2026-03-13 → 200 (Anthropic-internal feature flag,
-*     won't fire for non-ant users; allowlisted defensively for ant edge case)
-*   afk-mode-2026-01-31              → 200 (Anthropic-internal feature flag)
-*   cli-internal-2026-02-09          → 200 (USER_TYPE=ant only)
-*   oauth-2025-04-20                 → 200 (Files-API path; Files-API itself
-*     is not supportable via Copilot, but the header alone is harmless)
-*   prompt-caching-scope-2026-01-05  → 200 even with body cache_control.scope
-*     stripped (already covered by `prompt-caching-` prefix above)
-*/
-const EXTENDED_BETA_PREFIXES = [
-	...VSCODE_BETA_PREFIXES,
-	"claude-code-",
-	"effort-",
-	"prompt-caching-",
-	"computer-use-",
-	"pdfs-",
-	"max-tokens-",
-	"token-counting-",
-	"compact-",
-	"structured-outputs-",
-	"fast-mode-",
-	"mcp-client-",
-	"mcp-servers-",
-	"redact-thinking-",
-	"web-search-",
-	"task-budgets-",
-	"token-efficient-tools-",
-	"summarize-connector-text-",
-	"afk-mode-",
-	"cli-internal-",
-	"oauth-"
-];
-/**
-* Beta prefixes the proxy explicitly STRIPS even from the extended
-* allowlist (and even if a future leverage mode broadens the allowlist
-* further). Defensive layer: today's allowlist-only filter would already
-* drop these because they're not in any allowlist, but keeping an
-* explicit deny-list catches future changes that broaden allow rules
-* (e.g. a hypothetical pattern-based mode that lets `claude-*` through).
-*
-* Empirical (2026-05-11): Copilot returns HTTP 400
-*   `unsupported beta header(s): advisor-tool-2026-03-01`
-* on every request that includes `advisor-tool-`. Stripping it is the
-* difference between a working request (no ADVISOR semantics) and a
-* fully-failed request. Document upstream limitation in CLAUDE.md.
-*/
-const EXPLICITLY_STRIPPED_BETA_PREFIXES = ["advisor-tool-"];
-/**
-* Filter an `anthropic-beta` header value, keeping only beta flags
-* in the active whitelist AND not in the explicit-strip list.
-* Uses extended prefixes when --extended-betas is enabled, VS Code-only
-* prefixes otherwise. Returns the filtered comma-separated string,
-* or undefined if nothing remains.
-*/
-function filterBetaHeader(value) {
-	const prefixes = state.extendedBetas ? EXTENDED_BETA_PREFIXES : VSCODE_BETA_PREFIXES;
-	return value.split(",").map((v) => v.trim()).filter((v) => v && prefixes.some((prefix) => v.startsWith(prefix)) && !EXPLICITLY_STRIPPED_BETA_PREFIXES.some((p) => v.startsWith(p))).join(",") || void 0;
-}
-/**
-* Normalize a model ID for fuzzy comparison: lowercase, replace dots with
-* dashes, insert dash at letter→digit boundaries, and collapse repeated
-* dashes. E.g. "gpt5.3-codex" → "gpt-5-3-codex", "GPT-5.3-Codex" → "gpt-5-3-codex".
-*/
-function normalizeModelId$1(id) {
-	return id.toLowerCase().replace(/\./g, "-").replace(/([a-z])(\d)/g, "$1-$2").replace(/-{2,}/g, "-");
-}
-/**
-* Resolve a model name to the best available variant in the Copilot model list.
-*
-* Resolution cascade:
-* 0. `[1m]` literal-bracket suffix: strip, delegate, warn if downgraded.
-*    Bracketed slug must never reach Copilot (400s on it). See cc-backup
-*    `src/utils/context.ts:35-40` for Claude Code's 1M unlock mechanism.
-* 1. Exact match
-* 2. Case-insensitive match
-* 3. Family preference (opus→1m, codex→highest version)
-* 4. Normalized match (dots→dashes, letter-digit boundaries)
-* 5. Anthropic dated-slug retry: if the input matches `claude-...-YYYYMMDD`,
-*    strip the date and re-run the cascade once. Family-guarded so non-claude
-*    8-digit suffixes can't be mis-stripped; runs after Steps 1-4 so explicit
-*    version pinning (a dated catalog id matched at Step 1) always wins.
-* 6. Return as-is with a warning
-*/
-/**
-* `[1m]`-downgrade warnings we've already emitted this process. `resolveModel`
-* is called many times per launch (env setup, model validation, the banner,
-* and — under `serve` — on every model-picker `/models` poll), so the downgrade
-* notice is deduped to once per model id to avoid log spam.
-*/
-const warnedOneMDowngrade = /* @__PURE__ */ new Set();
-function resolveModel(modelId) {
-	const models = state.models?.data;
-	if (!models) return modelId;
-	const oneMMatch = modelId.match(/^(.*)\[1m\]$/i);
-	if (oneMMatch) {
-		const stripped = oneMMatch[1];
-		const resolved = resolveModel(stripped);
-		if (!(/-1m(?:$|-)/.test(resolved) || (models.find((m) => m.id === resolved)?.capabilities?.limits?.max_context_window_tokens ?? 0) >= 1e6) && !warnedOneMDowngrade.has(modelId)) {
-			warnedOneMDowngrade.add(modelId);
-			consola.warn(`Model "${modelId}" requested 1M context but no 1M backend is in Copilot's catalog for this tier/family; downgrading upstream to "${resolved}" (200K). Claude Code's local context accounting will still assume 1M — expect premature auto-compact. Drop the [1m] suffix (or unset CLAUDE_CODE_DISABLE_1M_CONTEXT if you set it) to silence.`);
-		}
-		return resolved;
-	}
-	if (models.some((m) => m.id === modelId)) return modelId;
-	const lower = modelId.toLowerCase();
-	const ciMatch = models.find((m) => m.id.toLowerCase() === lower);
-	if (ciMatch) return ciMatch.id;
-	if (lower.includes("opus")) {
-		const oneMs = models.filter((m) => m.id.includes("opus") && /-1m(?:$|-)/.test(m.id));
-		const versionMatch = lower.match(/opus-(\d+)(?:[.-](\d+))?/);
-		const requestedVersion = versionMatch ? versionMatch[2] ? `${versionMatch[1]}.${versionMatch[2]}` : versionMatch[1] : void 0;
-		const oneM = (requestedVersion ? oneMs.find((m) => m.id.includes(`opus-${requestedVersion}-`)) : void 0) ?? (requestedVersion ? void 0 : oneMs[0]);
-		if (oneM) return oneM.id;
-	}
-	if (lower.includes("codex")) {
-		const codexModels = models.filter((m) => m.id.includes("codex") && !m.id.includes("mini"));
-		if (codexModels.length > 0) {
-			codexModels.sort((a, b) => b.id.localeCompare(a.id));
-			return codexModels[0].id;
-		}
-	}
-	const normalized = normalizeModelId$1(modelId);
-	const normMatch = models.find((m) => normalizeModelId$1(m.id) === normalized);
-	if (normMatch) return normMatch.id;
-	const dateStripped = modelId.replace(/^(claude-[\w.-]+)-20\d{6}$/i, "$1");
-	if (dateStripped !== modelId) {
-		const retried = resolveModel(dateStripped);
-		if (retried !== dateStripped || models.some((m) => m.id === dateStripped)) {
-			consola.info(`Resolved Anthropic dated slug "${modelId}" → "${retried}" (stripped -YYYYMMDD; pass an explicit catalog id to pin a snapshot)`);
-			return retried;
-		}
-	}
-	if (lower.startsWith("claude-")) {
-		const matchSonnet = /(?:^|-)sonnet(?:-|$)/.test(lower);
-		const matchHaiku = /(?:^|-)haiku(?:-|$)/.test(lower);
-		if (matchSonnet || matchHaiku) {
-			const family = matchSonnet ? "sonnet" : "haiku";
-			const familyMembers = models.filter((m) => new RegExp(`(?:^|-)${family}(?:-|$|\\.)`).test(m.id));
-			if (familyMembers.length > 0) {
-				familyMembers.sort((a, b) => b.id.localeCompare(a.id, void 0, { numeric: true }));
-				const best = familyMembers[0].id;
-				consola.info(`Model "${modelId}" not in Copilot catalog; falling back to highest available "${best}" (legacy ${family} slug). Pin a current catalog id to silence.`);
-				return best;
-			}
-		}
-	}
-	consola.warn(`Model "${modelId}" not found in Copilot model list. Available: ${models.map((m) => m.id).join(", ")}`);
-	return modelId;
-}
-/**
-* Resolve a codex model ID, falling back to the best available codex model.
-* Used by the codex subcommand for model selection.
-*/
-function resolveCodexModel(modelId) {
-	const resolved = resolveModel(modelId);
-	const models = state.models?.data;
-	if (!models) return resolved;
-	if (models.some((m) => m.id === resolved)) return resolved;
-	const candidates = models.filter((m) => {
-		const endpoints = m.supported_endpoints ?? [];
-		if (m.id.includes("mini") || m.id.includes("nano")) return false;
-		return endpoints.length === 0 || endpoints.includes("/responses");
-	});
-	if (candidates.length > 0) {
-		candidates.sort((a, b) => {
-			const aCodex = a.id.includes("codex") ? 1 : 0;
-			const bCodex = b.id.includes("codex") ? 1 : 0;
-			if (aCodex !== bCodex) return bCodex - aCodex;
-			return b.id.localeCompare(a.id);
-		});
-		const best = candidates[0].id;
-		consola.warn(`Model "${modelId}" not available, using "${best}" instead`);
-		return best;
-	}
-	return resolved;
-}
-async function cacheModels() {
-	const models = await getModels();
-	state.models = models;
-}
-const cacheVSCodeVersion = async () => {
-	const response = await getVSCodeVersion();
-	state.vsCodeVersion = response;
-	consola.info(`Using VSCode version: ${response}`);
-};
-const cacheCopilotVersion = async () => {
-	const version = await getCopilotChatVersion();
-	state.copilotVersion = version;
-	consola.info(`Using Copilot Chat version: ${version}`);
-};
-//#endregion
-//#region src/services/github/poll-access-token.ts
-async function pollAccessToken(deviceCode, clientId = GITHUB_CLIENT_ID) {
-	const sleepDuration = (deviceCode.interval + 1) * 1e3;
-	consola.debug(`Polling access token with interval of ${sleepDuration}ms`);
-	const expiresAt = Date.now() + deviceCode.expires_in * 1e3;
-	while (Date.now() < expiresAt) {
-		const response = await fetch(`${GITHUB_BASE_URL}/login/oauth/access_token`, {
-			method: "POST",
-			headers: standardHeaders(),
-			body: JSON.stringify({
-				client_id: clientId,
-				device_code: deviceCode.device_code,
-				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-			})
-		});
-		if (!response.ok) {
-			consola.error("Failed to poll access token:", await response.text());
-			if (Date.now() >= expiresAt) break;
-			await sleep$3(sleepDuration);
-			continue;
-		}
-		const json = await response.json();
-		consola.debug("Polling access token response:", json);
-		const { access_token } = json;
-		if (access_token) return access_token;
-		if (Date.now() >= expiresAt) break;
-		await sleep$3(sleepDuration);
-	}
-	throw new Error("Device code expired. Please run auth again.");
-}
-//#endregion
-//#region src/lib/token.ts
-const readGithubToken = () => fs.readFile(PATHS.GITHUB_TOKEN_PATH, "utf8");
-const writeGithubToken = (token) => fs.writeFile(PATHS.GITHUB_TOKEN_PATH, token);
-const readGithubAgentToken = () => fs.readFile(PATHS.GITHUB_AGENT_TOKEN_PATH, "utf8");
-const writeGithubAgentToken = (token) => fs.writeFile(PATHS.GITHUB_AGENT_TOKEN_PATH, token, { mode: 384 });
-const setupCopilotToken = async () => {
-	const { token, refresh_in } = await getCopilotToken();
-	state.copilotToken = token;
-	consola.debug("GitHub Copilot Token fetched successfully!");
-	if (state.showToken) consola.info("Copilot token:", token);
-	const refreshInterval = Math.max((refresh_in - 60) * 1e3, 1e3);
-	setInterval(() => {
-		refreshCopilotToken("interval");
-	}, refreshInterval);
-};
-let inflightRefresh;
-let lastRefreshSuccess = 0;
-let lastRefreshFailure = 0;
-const REFRESH_SUCCESS_COOLDOWN_MS = 3e4;
-const REFRESH_FAILURE_COOLDOWN_MS = 5e3;
-async function refreshCopilotToken(reason) {
-	if (inflightRefresh) return inflightRefresh;
-	if (reason === "401-retry") {
-		const now = Date.now();
-		if (now - lastRefreshSuccess < REFRESH_SUCCESS_COOLDOWN_MS) {
-			consola.debug(`refreshCopilotToken(${reason}) skipped: prior success within ${REFRESH_SUCCESS_COOLDOWN_MS}ms`);
-			return;
-		}
-		if (now - lastRefreshFailure < REFRESH_FAILURE_COOLDOWN_MS) {
-			consola.debug(`refreshCopilotToken(${reason}) skipped: prior failure within ${REFRESH_FAILURE_COOLDOWN_MS}ms`);
-			return;
-		}
-	}
-	inflightRefresh = (async () => {
-		consola.debug(`Refreshing Copilot token (reason=${reason})`);
-		try {
-			const { token } = await getCopilotToken();
-			state.copilotToken = token;
-			lastRefreshSuccess = Date.now();
-			consola.debug("Copilot token refreshed");
-			if (state.showToken) consola.info("Refreshed Copilot token:", token);
-		} catch (error) {
-			lastRefreshFailure = Date.now();
-			consola.error(`Failed to refresh Copilot token (reason=${reason}):`, error);
-		} finally {
-			inflightRefresh = void 0;
-		}
-	})();
-	return inflightRefresh;
-}
-/**
-* Try `request()`. If it returns a 401, refresh the Copilot token (subject
-* to the single-flight + refresh-storm-protection of `refreshCopilotToken`)
-* and retry once. After one retry, propagate whatever the second attempt
-* returned — the caller's existing 401-handling path is preserved.
-*
-* The `request` callback is responsible for capturing `state.copilotToken`
-* locally before any await; this helper does NOT re-build the request
-* itself, just re-invokes the callback after a refresh.
-*/
-async function tryRefreshAndRetry(request, routePath) {
-	const first = await request();
-	if (first.status !== 401) return first;
-	consola.warn(`${routePath}: upstream returned 401, attempting one token refresh + retry`);
-	await refreshCopilotToken("401-retry");
-	return request();
-}
-async function setupGitHubToken(options) {
-	try {
-		const githubToken = await readGithubToken();
-		if (githubToken && !options?.force) {
-			state.githubToken = githubToken;
-			if (state.showToken) consola.info("GitHub token:", githubToken);
-			await logUser();
-			return;
-		}
-		consola.info("Not logged in, getting new access token");
-		const response = await getDeviceCode();
-		consola.debug("Device code response:", response);
-		consola.info(`Please enter the code "${response.user_code}" in ${response.verification_uri}`);
-		const token = await pollAccessToken(response);
-		await writeGithubToken(token);
-		state.githubToken = token;
-		if (state.showToken) consola.info("GitHub token:", token);
-		await logUser();
-	} catch (error) {
-		if (error instanceof HTTPError) {
-			consola.error("Failed to get GitHub token:", await error.response.json());
-			throw error;
-		}
-		consola.error("Failed to get GitHub token:", error);
-		throw error;
-	}
-}
-async function logUser() {
-	const user = await getGitHubUser();
-	consola.info(`Logged in as ${user.login}`);
-}
-/**
-* Set up the SECOND, write-capable GitHub token used by the first-mate
-* agent-orchestration surface (`--agents`). Mirrors `setupGitHubToken`
-* but authenticates against the GitHub CLI's OAuth client
-* (`GITHUB_AGENT_CLIENT_ID`) requesting `repo workflow read:org`, and
-* stores the result apart at `PATHS.GITHUB_AGENT_TOKEN_PATH`. The Copilot
-* App token (`state.githubToken`) is left completely untouched — this is
-* a distinct identity for a distinct capability.
-*
-* Long-lived (device-flow user token) → no refresh loop; a later 401 is
-* surfaced to the caller as a revoked grant to re-run the login. Called
-* once from `setupAndServe` when `state.agentsEnabled` is true.
-*/
-async function setupGitHubAgentToken(options) {
-	try {
-		const existing = (await readGithubAgentToken().catch(() => "")).trim();
-		if (existing && !options?.force) {
-			state.githubAgentToken = existing;
-			if (state.showToken) consola.info("GitHub agent token:", existing);
-			await warnIfAgentScopesInsufficient();
-			return;
-		}
-		consola.info("Agent mode (--agents): a second GitHub login is required for a write-capable token (repo, workflow, read:org).");
-		const response = await getDeviceCode({
-			clientId: GITHUB_AGENT_CLIENT_ID,
-			scope: GITHUB_AGENT_SCOPES
-		});
-		consola.debug("Agent device code response:", response);
-		consola.info(`Please enter the code "${response.user_code}" in ${response.verification_uri} to authorize github-router's cloud-agent orchestration to act on your repositories.`);
-		const token = await pollAccessToken(response, GITHUB_AGENT_CLIENT_ID);
-		await writeGithubAgentToken(token);
-		state.githubAgentToken = token;
-		if (state.showToken) consola.info("GitHub agent token:", token);
-		await warnIfAgentScopesInsufficient();
-	} catch (error) {
-		if (error instanceof HTTPError) {
-			consola.error("Failed to get GitHub agent token:", await error.response.json());
-			throw error;
-		}
-		consola.error("Failed to get GitHub agent token:", error);
-		throw error;
-	}
-}
-/**
-* Best-effort check that the agent token actually carries the scopes we
-* asked for. The GitHub CLI OAuth client is a classic OAuth App, so the
-* granted scopes are echoed in the `x-oauth-scopes` response header on
-* any authenticated call. Warn loudly (not fatal) if `repo`/`workflow`
-* are missing so the failure is diagnosable at login rather than at the
-* first write 403.
-*/
-async function warnIfAgentScopesInsufficient() {
-	try {
-		const res = await fetch(`${GITHUB_API_BASE_URL}/user`, { headers: githubAgentHeaders(state) });
-		if (res.status === 401) {
-			consola.warn("GitHub agent token was rejected (401) — the grant may have been revoked. Re-run with --agents to log in again.");
-			return;
-		}
-		const scopes = (res.headers.get("x-oauth-scopes") ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-		const missing = ["repo", "workflow"].filter((s) => !scopes.includes(s));
-		if (missing.length > 0) consola.warn(`GitHub agent token is missing scope(s): ${missing.join(", ")}. The first-mate surface needs 'repo' + 'workflow' to create issues, assign cloud agents, and dispatch workflows. Re-run the agent login and grant the requested scopes.`);
-	} catch (err) {
-		consola.debug("Agent token scope check skipped:", err);
-	}
-}
-//#endregion
 //#region src/lib/update-lock.ts
 /**
 * Cross-process install lock for the auto-update / self-update paths.
@@ -996,32 +95,6 @@ async function tryCreateLock(p) {
 	}
 }
 //#endregion
-//#region src/lib/version.ts
-/**
-* Read this binary's published version from package.json at runtime.
-*
-* Done at runtime (not baked at build time) because release.yml builds
-* BEFORE `npm version patch` bumps the version — a build-time inline
-* would always ship the pre-bump value. The npm tarball ships package.json
-* alongside `dist/`, so a sibling-up lookup from import.meta.url resolves
-* cleanly in both dev (`src/lib/`) and bundled (`dist/`) layouts.
-*
-* Returns `"unknown"` if package.json can't be located or parsed —
-* never throws, so the CLI never fails to start over version reporting.
-*/
-function getPackageVersion() {
-	try {
-		const here = dirname(fileURLToPath(import.meta.url));
-		const candidates = [join(here, "..", "..", "package.json"), join(here, "..", "package.json")];
-		for (const path of candidates) try {
-			const raw = readFileSync(path, "utf8");
-			const parsed = JSON.parse(raw);
-			if (typeof parsed.version === "string" && (parsed.name === "github-router" || parsed.name === "@animeshkundu/github-router")) return parsed.version;
-		} catch {}
-	} catch {}
-	return "unknown";
-}
-//#endregion
 //#region src/lib/port.ts
 const DEFAULT_PORT = 8787;
 const DEFAULT_CLAUDE_MODEL_FALLBACKS = [
@@ -1183,432 +256,6 @@ function collapsePathKeys(env) {
 	return env;
 }
 //#endregion
-//#region src/lib/mcp-workspace-header.ts
-/** Header the per-session MCP headersHelper emits, carrying the calling Claude
-*  session's working directory. The /mcp handler uses it as the default
-*  `workspace` for repo-scoped tools so a machine-wide `serve` targets the
-*  active repo, not the proxy launch cwd. */
-const MCP_WORKSPACE_HEADER = "X-GH-Workspace";
-/** stdout JSON the headersHelper prints; Claude merges it into the connection
-*  headers. `cwd` is the helper's own process cwd = the session's project dir. */
-function buildWorkspaceHeaderJson(cwd) {
-	return JSON.stringify({ [MCP_WORKSPACE_HEADER]: cwd });
-}
-/** Command string Claude runs as the headersHelper. Mirrors
-*  buildPromptSubmitHookCommand's quoting (src/lib/orchestration/prompt-submit-hook.ts). */
-function buildWorkspaceHeaderHelperCommand(execPath, scriptPath) {
-	const q = (s) => `"${s}"`;
-	return scriptPath && scriptPath !== execPath ? `${q(execPath)} ${q(scriptPath)} internal-workspace-header` : `${q(execPath)} internal-workspace-header`;
-}
-//#endregion
-//#region src/lib/insecure-tls.ts
-/**
-* Runtime-aware "skip TLS verification" for a self-signed direct-HTTPS instance.
-* The mechanism differs by runtime and getting it wrong is silent: the BUILT
-* proxy runs under Node (bin shebang `#!/usr/bin/env node`), whose fetch (undici)
-* IGNORES a per-request `tls` option — only a `dispatcher` relaxes verification.
-* `bun run dev` and the test suite run under Bun, whose fetch honors `tls`. So we
-* detect the runtime and attach the field it actually understands.
-*
-* Shared by the fleet control-plane client and the artifact-review client — both
-* talk to a self-signed ai-or-die instance on loopback. Per-request scope (not a
-* global TLS posture change) keeps Copilot upstream verification untouched.
-*/
-const IS_BUN$1 = typeof globalThis.Bun !== "undefined";
-let sharedInsecureDispatcher;
-function insecureDispatcher() {
-	return sharedInsecureDispatcher ??= new Agent({ connect: { rejectUnauthorized: false } });
-}
-/**
-* Attach the runtime-correct TLS-verification-off mechanism to a fetch init for a
-* single self-signed direct-HTTPS instance: Bun → `tls`, Node → an undici
-* `dispatcher`. Exported so BOTH runtime branches are unit-testable under one
-* interpreter (the untested Node branch is exactly what shipped broken).
-*/
-function applyInsecureTls(init, isBun = IS_BUN$1) {
-	if (isBun) init.tls = { rejectUnauthorized: false };
-	else init.dispatcher = insecureDispatcher();
-}
-//#endregion
-//#region src/lib/artifact/client.ts
-var ArtifactError = class extends Error {
-	code;
-	retryable;
-	status;
-	detail;
-	constructor(args) {
-		super(args.message);
-		this.name = "ArtifactError";
-		this.code = args.code;
-		this.retryable = args.retryable;
-		this.status = args.status;
-		this.detail = args.detail;
-	}
-};
-const AWAIT_DEFAULT_TIMEOUT_MS = 25e3;
-const AWAIT_ABORT_MARGIN_MS = 5e3;
-const DEFAULT_RETRY_BASE_MS = 250;
-const TRANSIENT_RETRIES = 2;
-const DEFAULT_RETRYABLE_CODES = /* @__PURE__ */ new Set(["UNREACHABLE", "TIMEOUT"]);
-const AWAIT_RETRYABLE_CODES = /* @__PURE__ */ new Set(["UNREACHABLE"]);
-var ArtifactClient = class {
-	baseUrl;
-	token;
-	sessionId;
-	fetchFn;
-	insecureTLS;
-	retryBaseMs;
-	constructor(options) {
-		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
-		this.token = options.token;
-		this.sessionId = options.sessionId;
-		this.fetchFn = options.fetchFn ?? globalThis.fetch.bind(globalThis);
-		this.insecureTLS = options.insecureTLS ?? false;
-		this.retryBaseMs = options.retryBaseMs ?? DEFAULT_RETRY_BASE_MS;
-	}
-	/**
-	* Open (or replace) the review for this session. `mode` is advisory metadata
-	* forwarded to the server (forward-compat: ignored if unknown); the actual
-	* interactivity comes from the served HTML's `data-aod-*` markup. Retried on a
-	* transient failure with a STABLE idempotency key so a retry-after-success does
-	* not double-open.
-	*/
-	open(file, opts = {}) {
-		const idempotencyKey = opts.idempotencyKey ?? randomUUID();
-		const body = { file };
-		if (opts.mode) body.mode = opts.mode;
-		return this.withRetry(() => this.requestOnce({
-			method: "POST",
-			pathname: this.path("/open"),
-			body,
-			signal: opts.signal,
-			idempotencyKey
-		}), TRANSIENT_RETRIES, opts.signal);
-	}
-	/**
-	* Replace the current review's content. Exactly one of `file` | `html` (the
-	* caller-facing tool enforces that). `html` is written by the SERVER to the
-	* review's existing sandboxed file, so `html` with no existing review is an
-	* INVALID_REQUEST from the server. Retried with a stable idempotency key.
-	*/
-	update(opts) {
-		const idempotencyKey = opts.idempotencyKey ?? randomUUID();
-		const body = {};
-		if (opts.file !== void 0) body.file = opts.file;
-		if (opts.html !== void 0) body.html = opts.html;
-		return this.withRetry(() => this.requestOnce({
-			method: "POST",
-			pathname: this.path("/update"),
-			body,
-			signal: opts.signal,
-			idempotencyKey,
-			allowEmptyJson: true
-		}), TRANSIENT_RETRIES, opts.signal);
-	}
-	/** Force a reload from disk (no content change). Single-shot (idempotent, cheap). */
-	refresh(signal) {
-		return this.requestOnce({
-			method: "POST",
-			pathname: this.path("/refresh"),
-			signal,
-			allowEmptyJson: true
-		});
-	}
-	/** Hide the panel UI while keeping the review alive. Single-shot; server idempotent. */
-	dismiss(signal) {
-		return this.requestOnce({
-			method: "POST",
-			pathname: this.path("/dismiss"),
-			signal,
-			allowEmptyJson: true
-		});
-	}
-	/**
-	* Typed drain (contract v2.2 §1/§2). Long-holds up to the server cap, returns
-	* events with `id > cursor` plus the new high-water `cursor`. Idempotent by
-	* (cursor, event.id): re-calling with the same cursor replays the same window
-	* from the server's bounded buffer, so a lost cursor (compaction) is
-	* recoverable. Retried on a transient network failure (the cursor makes retry
-	* safe — no double-consumption).
-	*/
-	awaitEvents(opts = {}) {
-		const serverTimeoutMs = typeof opts.timeoutMs === "number" && Number.isFinite(opts.timeoutMs) && opts.timeoutMs > 0 ? opts.timeoutMs : AWAIT_DEFAULT_TIMEOUT_MS;
-		const clientTimeoutMs = serverTimeoutMs + AWAIT_ABORT_MARGIN_MS;
-		return this.withRetry(() => this.requestOnce({
-			method: "GET",
-			pathname: this.path("/await"),
-			query: {
-				cursor: opts.cursor,
-				timeoutMs: String(serverTimeoutMs)
-			},
-			signal: opts.signal,
-			timeoutMsHint: clientTimeoutMs
-		}), TRANSIENT_RETRIES, opts.signal, AWAIT_RETRYABLE_CODES);
-	}
-	/** Free-text agent->human reply. SINGLE-SHOT (not retried): a retry-after-success
-	*  would render a duplicate chat bubble server-side. */
-	agentReply(text, signal) {
-		return this.requestOnce({
-			method: "POST",
-			pathname: this.path("/agent-reply"),
-			body: { text },
-			signal,
-			allowEmptyJson: true
-		});
-	}
-	/**
-	* End the review. Retried with a stable idempotency key; a NOT_FOUND (the
-	* review is already ended — whether by a prior call or by a retry landing after
-	* the first attempt succeeded) is mapped to a successful `{ ok, status:"ended" }`
-	* rather than surfaced as a 404 (contract v2.2 §1.1).
-	*/
-	async end(signal) {
-		const idempotencyKey = randomUUID();
-		try {
-			return await this.withRetry(() => this.requestOnce({
-				method: "POST",
-				pathname: this.path("/end"),
-				signal,
-				idempotencyKey,
-				allowEmptyJson: true
-			}), TRANSIENT_RETRIES, signal);
-		} catch (err) {
-			if (err instanceof ArtifactError && err.code === "NOT_FOUND") return {
-				ok: true,
-				status: "ended"
-			};
-			throw err;
-		}
-	}
-	/**
-	* FROZEN legacy long-poll (contract v2.2 §1). Old payload shape,
-	* comment-equivalent only. New agents use `awaitEvents`. Single request per
-	* call (the caller-facing tool owns the bounded re-poll budget).
-	*/
-	poll(timeoutMsHint, signal) {
-		return this.requestOnce({
-			method: "GET",
-			pathname: this.path("/poll"),
-			signal,
-			timeoutMsHint
-		});
-	}
-	path(suffix) {
-		return `/api/artifact/${encodeURIComponent(this.sessionId)}${suffix}`;
-	}
-	async withRetry(fn, retries, signal, retryableCodes = DEFAULT_RETRYABLE_CODES) {
-		let attempt = 0;
-		for (;;) try {
-			return await fn();
-		} catch (err) {
-			attempt += 1;
-			if (!(err instanceof ArtifactError && err.retryable && retryableCodes.has(err.code)) || attempt > retries || signal?.aborted) throw err;
-			const base = this.retryBaseMs;
-			await sleep$2(base <= 0 ? 0 : Math.round(base * 2 ** (attempt - 1) * (.5 + Math.random() * .5)), signal);
-		}
-	}
-	async requestOnce(o) {
-		let url;
-		try {
-			url = new URL(o.pathname, `${this.baseUrl}/`);
-		} catch (err) {
-			throw new ArtifactError({
-				code: "UNREACHABLE",
-				message: "artifact API base URL is invalid",
-				retryable: false,
-				detail: err
-			});
-		}
-		if (o.query) {
-			for (const [key, value] of Object.entries(o.query)) if (value !== void 0) url.searchParams.set(key, value);
-		}
-		const timeout = combineSignalAndTimeout(o.signal, o.timeoutMsHint);
-		try {
-			const headers = { Authorization: `Bearer ${this.token}` };
-			if (o.body !== void 0) headers["Content-Type"] = "application/json";
-			if (o.idempotencyKey) headers["Idempotency-Key"] = o.idempotencyKey;
-			const init = {
-				method: o.method,
-				headers,
-				body: o.body === void 0 ? void 0 : JSON.stringify(o.body),
-				redirect: "error",
-				signal: timeout.signal
-			};
-			if (this.insecureTLS) applyInsecureTls(init);
-			const response = await this.fetchFn(url.toString(), init);
-			if (!response.ok) throw await mapHttpError$1(response);
-			let text;
-			try {
-				text = await response.text();
-			} catch (err) {
-				if (isAbortLike$2(err)) throw mapNetworkError$1(err);
-				throw new ArtifactError({
-					code: "INVALID_RESPONSE",
-					message: "artifact API response body could not be read",
-					retryable: false,
-					detail: err
-				});
-			}
-			if (!text && o.allowEmptyJson) return {};
-			try {
-				return JSON.parse(text);
-			} catch (err) {
-				throw new ArtifactError({
-					code: "INVALID_RESPONSE",
-					message: "artifact API returned a non-JSON response",
-					retryable: false,
-					detail: err
-				});
-			}
-		} catch (err) {
-			if (err instanceof ArtifactError) throw err;
-			throw mapNetworkError$1(err);
-		} finally {
-			timeout.cleanup();
-		}
-	}
-};
-function sleep$2(ms, signal) {
-	if (ms <= 0) return Promise.resolve();
-	return new Promise((resolve, reject) => {
-		const onAbort = () => {
-			clearTimeout(timer);
-			reject(new DOMException("retry backoff aborted", "AbortError"));
-		};
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, ms);
-		if (signal?.aborted) {
-			onAbort();
-			return;
-		}
-		signal?.addEventListener("abort", onAbort, { once: true });
-	});
-}
-function combineSignalAndTimeout(signal, timeoutMsHint) {
-	const timeoutMs = typeof timeoutMsHint === "number" && Number.isFinite(timeoutMsHint) && timeoutMsHint > 0 ? timeoutMsHint : void 0;
-	if (timeoutMs === void 0) return {
-		signal,
-		cleanup: () => {}
-	};
-	const controller = new AbortController();
-	const abortFromCaller = () => {
-		try {
-			controller.abort(signal?.reason);
-		} catch {
-			controller.abort();
-		}
-	};
-	if (signal?.aborted) abortFromCaller();
-	signal?.addEventListener("abort", abortFromCaller, { once: true });
-	const timer = setTimeout(() => {
-		try {
-			controller.abort(new DOMException("artifact API request timed out", "TimeoutError"));
-		} catch {
-			controller.abort();
-		}
-	}, timeoutMs);
-	return {
-		signal: controller.signal,
-		cleanup: () => {
-			clearTimeout(timer);
-			signal?.removeEventListener("abort", abortFromCaller);
-		}
-	};
-}
-async function mapHttpError$1(response) {
-	const detail = await readErrorDetail$1(response);
-	const upstreamMessage = detailToMessage$1(detail);
-	const suffix = upstreamMessage ? `: ${upstreamMessage}` : "";
-	if (response.status === 401 || response.status === 403) return new ArtifactError({
-		code: "AUTH_FAILED",
-		message: `artifact API authentication failed (${response.status})${suffix}`,
-		retryable: false,
-		status: response.status,
-		detail
-	});
-	if (response.status === 404) return new ArtifactError({
-		code: "NOT_FOUND",
-		message: `artifact session or resource not found (404)${suffix}`,
-		retryable: false,
-		status: response.status,
-		detail
-	});
-	if (response.status === 408 || response.status === 504) return new ArtifactError({
-		code: "TIMEOUT",
-		message: `artifact API request timed out (${response.status})${suffix}`,
-		retryable: true,
-		status: response.status,
-		detail
-	});
-	if (response.status === 400 && detailToCode(detail)?.toUpperCase() === "INVALID_REQUEST") return new ArtifactError({
-		code: "INVALID_REQUEST",
-		message: `artifact API rejected the request (400)${suffix}`,
-		retryable: false,
-		status: response.status,
-		detail
-	});
-	return new ArtifactError({
-		code: "UPSTREAM_ERROR",
-		message: `artifact API returned HTTP ${response.status}${suffix}`,
-		retryable: response.status === 429 || response.status >= 500,
-		status: response.status,
-		detail
-	});
-}
-function mapNetworkError$1(err) {
-	if (isAbortLike$2(err)) return new ArtifactError({
-		code: "TIMEOUT",
-		message: "artifact API request timed out or was aborted",
-		retryable: true,
-		detail: err
-	});
-	return new ArtifactError({
-		code: "UNREACHABLE",
-		message: `artifact API unreachable: ${err instanceof Error ? err.message : String(err)}`,
-		retryable: true,
-		detail: err
-	});
-}
-async function readErrorDetail$1(response) {
-	const text = await response.text().catch(() => "");
-	if (!text) return void 0;
-	try {
-		return JSON.parse(text);
-	} catch {
-		return text;
-	}
-}
-function detailToMessage$1(detail) {
-	if (typeof detail === "string") return detail;
-	if (typeof detail !== "object" || detail === null) return void 0;
-	const record = detail;
-	const error = record.error;
-	if (typeof error === "string") return error;
-	if (typeof error === "object" && error !== null) {
-		const errorRecord = error;
-		if (typeof errorRecord.message === "string") return errorRecord.message;
-		if (typeof errorRecord.code === "string") return errorRecord.code;
-	}
-	if (typeof record.message === "string") return record.message;
-}
-/** Extract a machine `code` from an upstream error body (`{error:{code}}` or
-*  `{code}`) so a tagged 400 can be classified (INVALID_REQUEST). */
-function detailToCode(detail) {
-	if (typeof detail !== "object" || detail === null) return void 0;
-	const record = detail;
-	const error = record.error;
-	if (typeof error === "object" && error !== null) {
-		const code = error.code;
-		if (typeof code === "string") return code;
-	}
-	if (typeof record.code === "string") return record.code;
-}
-function isAbortLike$2(err) {
-	return err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
-}
-//#endregion
 //#region src/lib/artifact/tools.ts
 const ARTIFACT_GROUP = "peers";
 const ARTIFACT_POLL_TOOL_BUDGET_MS = 5e4;
@@ -2632,13 +1279,13 @@ function defaultFleetConfigPath() {
 async function loadFleetRegistryConfig(configPath = defaultFleetConfigPath()) {
 	let stat;
 	try {
-		stat = await fs.stat(configPath);
+		stat = await fs$1.stat(configPath);
 	} catch (err) {
 		if (isNodeErrorCode(err, "ENOENT")) return { instances: [] };
 		throw err;
 	}
 	if (process.platform !== "win32" && (stat.mode & 63) !== 0) console.warn(`[fleet] Registry file ${configPath} is group/other-readable; it contains bearer / tunnel credentials. Consider chmod 600.`);
-	const raw = await fs.readFile(configPath, "utf8");
+	const raw = await fs$1.readFile(configPath, "utf8");
 	if (raw.trim() === "") return { instances: [] };
 	const parsed = JSON.parse(raw);
 	if (!isObject(parsed)) throw new FleetRegistryError("INVALID_CONFIG", "fleet registry must be a JSON object");
@@ -2891,7 +1538,7 @@ function nonEmptyString(raw) {
 * validation; never throws — a missing/unreadable/oversized/malformed file
 * yields `[]` (discovery is best-effort and must never break static fleet use).
 */
-async function readMeshPeers(readFileFn = (p) => fs.readFile(p, "utf8")) {
+async function readMeshPeers(readFileFn = (p) => fs$1.readFile(p, "utf8")) {
 	if (meshDiscoveryDisabled()) return [];
 	let raw;
 	try {
@@ -2978,7 +1625,7 @@ function validEgressToken(raw) {
 */
 async function readMeshEgress(options = {}) {
 	if (meshDiscoveryDisabled()) return void 0;
-	const readFileFn = options.readFileFn ?? ((p) => fs.readFile(p, "utf8"));
+	const readFileFn = options.readFileFn ?? ((p) => fs$1.readFile(p, "utf8"));
 	const now = options.now ?? (() => Date.now());
 	const pidAlive = options.pidAlive ?? defaultPidAlive;
 	let raw;
@@ -5559,7 +4206,7 @@ function isLease(value) {
 async function readLeaseFile(file) {
 	let raw;
 	try {
-		raw = await fs.readFile(file, "utf8");
+		raw = await fs$1.readFile(file, "utf8");
 	} catch (err) {
 		if (err.code === "ENOENT") return void 0;
 		throw err;
@@ -5572,40 +4219,40 @@ async function readLeaseFile(file) {
 	}
 }
 async function writeLeaseAtomic(file, lease) {
-	await fs.mkdir(path.dirname(file), { recursive: true });
+	await fs$1.mkdir(path.dirname(file), { recursive: true });
 	const tmp = `${file}.tmp.${process.pid}.${randomBytes(4).toString("hex")}`;
 	try {
-		await fs.writeFile(tmp, `${JSON.stringify(lease, null, 2)}\n`, { mode: 384 });
-		await fs.rename(tmp, file);
+		await fs$1.writeFile(tmp, `${JSON.stringify(lease, null, 2)}\n`, { mode: 384 });
+		await fs$1.rename(tmp, file);
 	} catch (err) {
-		await fs.unlink(tmp).catch(() => {});
+		await fs$1.unlink(tmp).catch(() => {});
 		throw err;
 	}
 }
 const LEASE_LOCK_MAX_WAIT_MS = 1e4;
 async function withLeaseLock(file, fn, hooks) {
 	const lockPath = `${file}.lock`;
-	await fs.mkdir(path.dirname(lockPath), { recursive: true });
+	await fs$1.mkdir(path.dirname(lockPath), { recursive: true });
 	const ownerToken = `${process.pid}-${randomBytes(8).toString("hex")}`;
 	const staging = `${lockPath}.acq.${ownerToken}`;
-	await fs.writeFile(staging, ownerToken, { mode: 384 });
+	await fs$1.writeFile(staging, ownerToken, { mode: 384 });
 	const start = Date.now();
 	try {
 		for (;;) try {
-			await fs.link(staging, lockPath);
+			await fs$1.link(staging, lockPath);
 			break;
 		} catch (err) {
 			if (err.code !== "EEXIST") throw err;
 			let observed;
 			try {
-				observed = (await fs.readFile(lockPath, "utf8")).trim();
-				const st = await fs.stat(lockPath);
+				observed = (await fs$1.readFile(lockPath, "utf8")).trim();
+				const st = await fs$1.stat(lockPath);
 				if (Date.now() - st.mtimeMs > 1e4) {
 					if (hooks?.onObservedStale) await hooks.onObservedStale();
 					const breaker = `${lockPath}.stale.${ownerToken}`;
 					let moved = false;
 					try {
-						await fs.rename(lockPath, breaker);
+						await fs$1.rename(lockPath, breaker);
 						moved = true;
 					} catch (e) {
 						if (e.code !== "ENOENT") throw e;
@@ -5613,13 +4260,13 @@ async function withLeaseLock(file, fn, hooks) {
 					if (moved) {
 						let movedToken;
 						try {
-							movedToken = (await fs.readFile(breaker, "utf8")).trim();
+							movedToken = (await fs$1.readFile(breaker, "utf8")).trim();
 						} catch {
 							movedToken = void 0;
 						}
-						if (movedToken === observed) await fs.unlink(breaker).catch(() => {});
-						else await fs.rename(breaker, lockPath).catch(async () => {
-							await fs.unlink(breaker).catch(() => {});
+						if (movedToken === observed) await fs$1.unlink(breaker).catch(() => {});
+						else await fs$1.rename(breaker, lockPath).catch(async () => {
+							await fs$1.unlink(breaker).catch(() => {});
 						});
 					}
 					continue;
@@ -5629,11 +4276,11 @@ async function withLeaseLock(file, fn, hooks) {
 			await new Promise((r) => setTimeout(r, 15));
 		}
 	} finally {
-		await fs.unlink(staging).catch(() => {});
+		await fs$1.unlink(staging).catch(() => {});
 	}
 	const verifyOwner = async () => {
 		try {
-			return (await fs.readFile(lockPath, "utf8")).trim() === ownerToken;
+			return (await fs$1.readFile(lockPath, "utf8")).trim() === ownerToken;
 		} catch {
 			return false;
 		}
@@ -5641,7 +4288,7 @@ async function withLeaseLock(file, fn, hooks) {
 	try {
 		return await fn();
 	} finally {
-		if (await verifyOwner()) await fs.unlink(lockPath).catch(() => {});
+		if (await verifyOwner()) await fs$1.unlink(lockPath).catch(() => {});
 	}
 }
 /**
@@ -5798,15 +4445,15 @@ function sleep$1(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 async function writeJsonSecure(target, value) {
-	await fs.mkdir(path.dirname(target), { recursive: true });
+	await fs$1.mkdir(path.dirname(target), { recursive: true });
 	const tmp = `${target}.tmp.${process.pid}.${randomBytes(4).toString("hex")}`;
 	try {
-		await fs.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
-		await fs.chmod(tmp, 384).catch(() => {});
-		await fs.rename(tmp, target);
-		await fs.chmod(target, 384).catch(() => {});
+		await fs$1.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
+		await fs$1.chmod(tmp, 384).catch(() => {});
+		await fs$1.rename(tmp, target);
+		await fs$1.chmod(target, 384).catch(() => {});
 	} catch (err) {
-		await fs.unlink(tmp).catch(() => {});
+		await fs$1.unlink(tmp).catch(() => {});
 		throw err;
 	}
 }
@@ -5815,11 +4462,11 @@ const LOCK_RETRY_MS = 25;
 const LOCK_MAX_WAIT_MS = 1e4;
 async function withFileLock(target, fn) {
 	const lockPath = `${target}.lock`;
-	await fs.mkdir(path.dirname(lockPath), { recursive: true });
+	await fs$1.mkdir(path.dirname(lockPath), { recursive: true });
 	const ownerToken = `${process.pid}-${randomBytes(8).toString("hex")}`;
 	const start = Date.now();
 	for (;;) try {
-		const fh = await fs.open(lockPath, "wx");
+		const fh = await fs$1.open(lockPath, "wx");
 		await fh.writeFile(ownerToken);
 		await fh.close();
 		break;
@@ -5828,14 +4475,14 @@ async function withFileLock(target, fn) {
 		if (!(code === "EEXIST" || code === "EPERM" && process.platform === "win32")) throw err;
 		let observedToken;
 		try {
-			observedToken = (await fs.readFile(lockPath, "utf8")).trim();
-			const st = await fs.stat(lockPath);
+			observedToken = (await fs$1.readFile(lockPath, "utf8")).trim();
+			const st = await fs$1.stat(lockPath);
 			if (Date.now() - st.mtimeMs > LOCK_TTL_MS) {
 				const stealPath = `${lockPath}.steal.${ownerToken}`;
 				try {
-					await fs.rename(lockPath, stealPath);
-					if ((await fs.readFile(stealPath, "utf8").catch(() => "")).trim() === observedToken) await fs.unlink(stealPath).catch(() => {});
-					else await fs.rename(stealPath, lockPath).catch(() => fs.unlink(stealPath).catch(() => {}));
+					await fs$1.rename(lockPath, stealPath);
+					if ((await fs$1.readFile(stealPath, "utf8").catch(() => "")).trim() === observedToken) await fs$1.unlink(stealPath).catch(() => {});
+					else await fs$1.rename(stealPath, lockPath).catch(() => fs$1.unlink(stealPath).catch(() => {}));
 				} catch {}
 				continue;
 			}
@@ -5845,7 +4492,7 @@ async function withFileLock(target, fn) {
 	}
 	const verifyOwner = async () => {
 		try {
-			return (await fs.readFile(lockPath, "utf8")).trim() === ownerToken;
+			return (await fs$1.readFile(lockPath, "utf8")).trim() === ownerToken;
 		} catch {
 			return false;
 		}
@@ -5853,7 +4500,7 @@ async function withFileLock(target, fn) {
 	try {
 		return await fn(verifyOwner);
 	} finally {
-		if (await verifyOwner()) await fs.unlink(lockPath).catch(() => {});
+		if (await verifyOwner()) await fs$1.unlink(lockPath).catch(() => {});
 	}
 }
 const writeChains = /* @__PURE__ */ new Map();
@@ -5870,7 +4517,7 @@ const OCC_MAX_ATTEMPTS = 16;
 const OCC_BACKOFF_MS = 10;
 async function readRaw(file) {
 	try {
-		return await fs.readFile(file, "utf8");
+		return await fs$1.readFile(file, "utf8");
 	} catch (err) {
 		if (err.code === "ENOENT") return void 0;
 		throw err;
@@ -6013,7 +4660,7 @@ function parseDecisions(raw) {
 async function readDecisionsFile() {
 	let raw;
 	try {
-		raw = await fs.readFile(decisionsPath(), "utf8");
+		raw = await fs$1.readFile(decisionsPath(), "utf8");
 	} catch (err) {
 		if (err.code !== "ENOENT") consola.debug("first-mate decisions read skipped:", err);
 		raw = void 0;
@@ -6617,7 +5264,7 @@ function parseLedgerRaw(raw) {
 async function readRepoLedgerWithRev(repo) {
 	let raw;
 	try {
-		raw = await fs.readFile(repoLedgerPath(repo), "utf8");
+		raw = await fs$1.readFile(repoLedgerPath(repo), "utf8");
 	} catch (err) {
 		if (err.code !== "ENOENT") consola.debug("first-mate ledger read skipped:", err);
 		return {
@@ -6751,7 +5398,7 @@ function repoKey(repo) {
 async function readMissions() {
 	let raw;
 	try {
-		raw = await fs.readFile(registryPath(), "utf8");
+		raw = await fs$1.readFile(registryPath(), "utf8");
 	} catch (err) {
 		if (err.code !== "ENOENT") consola.debug("first-mate registry read skipped:", err);
 		raw = void 0;
@@ -7109,7 +5756,7 @@ var Outbox = class {
 	async read() {
 		let raw;
 		try {
-			raw = await fs.readFile(this.file, "utf8");
+			raw = await fs$1.readFile(this.file, "utf8");
 		} catch (err) {
 			if (err.code === "ENOENT") return [];
 			throw err;
@@ -7124,17 +5771,17 @@ var Outbox = class {
 		}
 	}
 	async write(entries) {
-		await fs.mkdir(path.dirname(this.file), { recursive: true });
+		await fs$1.mkdir(path.dirname(this.file), { recursive: true });
 		const tmp = `${this.file}.tmp.${process.pid}.${randomBytes(4).toString("hex")}`;
 		const value = {
 			version: OUTBOX_VERSION,
 			entries
 		};
 		try {
-			await fs.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
-			await fs.rename(tmp, this.file);
+			await fs$1.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
+			await fs$1.rename(tmp, this.file);
 		} catch (err) {
-			await fs.unlink(tmp).catch(() => {});
+			await fs$1.unlink(tmp).catch(() => {});
 			throw err;
 		}
 	}
@@ -7462,9 +6109,9 @@ function sanitizeSegment(value) {
 }
 async function writeDecisionPacketHtml(packetId, html) {
 	const dir = path.join(PATHS.FIRST_MATE_DIR, "packets");
-	await fs.mkdir(dir, { recursive: true });
+	await fs$1.mkdir(dir, { recursive: true });
 	const target = path.join(dir, `${sanitizeSegment(packetId)}.html`);
-	await fs.writeFile(target, html, { mode: 384 });
+	await fs$1.writeFile(target, html, { mode: 384 });
 	return target;
 }
 function agentRepo(repo) {
@@ -11204,7 +9851,7 @@ const WIN_RENAME_TRANSIENT = /* @__PURE__ */ new Set([
 */
 async function claimByRename(from, to) {
 	for (let attempt = 0;; attempt++) try {
-		await fs.rename(from, to);
+		await fs$1.rename(from, to);
 		return true;
 	} catch (err) {
 		const code = err.code;
@@ -11241,8 +9888,8 @@ var AnswerInbox = class {
 		}))];
 		if (lines.length === 0) return 0;
 		const run = this.chain.then(async () => {
-			await fs.mkdir(path.dirname(this.file), { recursive: true });
-			await fs.appendFile(this.file, `${lines.map((l) => JSON.stringify(l)).join("\n")}\n`, { mode: 384 });
+			await fs$1.mkdir(path.dirname(this.file), { recursive: true });
+			await fs$1.appendFile(this.file, `${lines.map((l) => JSON.stringify(l)).join("\n")}\n`, { mode: 384 });
 		});
 		this.chain = run.then(() => void 0, () => void 0);
 		await run;
@@ -11283,7 +9930,7 @@ var AnswerInbox = class {
 		const claimed = [];
 		let siblings;
 		try {
-			siblings = await fs.readdir(dir);
+			siblings = await fs$1.readdir(dir);
 		} catch {
 			siblings = [];
 		}
@@ -11294,7 +9941,7 @@ var AnswerInbox = class {
 			const claim = `${orphan}.claim.${process.pid}.${randomBytes(4).toString("hex")}`;
 			if (!await claimByRename(orphan, claim)) continue;
 			try {
-				this.mergeLines(await fs.readFile(claim, "utf8"), out);
+				this.mergeLines(await fs$1.readFile(claim, "utf8"), out);
 				claimed.push(claim);
 			} catch (err) {
 				if (err.code !== "ENOENT") consola.warn(`first-mate: deferring unreadable answer claim ${claim} for retry:`, err);
@@ -11302,7 +9949,7 @@ var AnswerInbox = class {
 		}
 		const target = `${this.file}.draining.${process.pid}.${randomBytes(4).toString("hex")}`;
 		if (await claimByRename(this.file, target)) try {
-			this.mergeLines(await fs.readFile(target, "utf8"), out);
+			this.mergeLines(await fs$1.readFile(target, "utf8"), out);
 			claimed.push(target);
 		} catch (err) {
 			if (err.code !== "ENOENT") consola.warn(`first-mate: deferring unreadable inbox claim ${target} for retry:`, err);
@@ -11310,7 +9957,7 @@ var AnswerInbox = class {
 		for (const p of claimed) this.inflight.add(p);
 		const ack = async () => {
 			for (const p of claimed) {
-				await fs.unlink(p).catch(() => {});
+				await fs$1.unlink(p).catch(() => {});
 				this.inflight.delete(p);
 			}
 		};
@@ -11441,8 +10088,8 @@ var Tier1Shadow = class {
 		this.judge = opts.judge ?? defaultTier1Judge;
 	}
 	async append(record) {
-		await fs.mkdir(path.dirname(this.file), { recursive: true });
-		await fs.appendFile(this.file, `${JSON.stringify(record)}\n`, { mode: 384 });
+		await fs$1.mkdir(path.dirname(this.file), { recursive: true });
+		await fs$1.appendFile(this.file, `${JSON.stringify(record)}\n`, { mode: 384 });
 	}
 	/**
 	* Run the Tier1 judge for one request and log its would-be verdict. Returns
@@ -11719,7 +10366,7 @@ function parseStrategies(raw) {
 async function readStrategiesFile() {
 	let raw;
 	try {
-		raw = await fs.readFile(strategiesPath(), "utf8");
+		raw = await fs$1.readFile(strategiesPath(), "utf8");
 	} catch (err) {
 		if (err.code !== "ENOENT") consola.debug("first-mate strategies read skipped:", err);
 		raw = void 0;
@@ -16605,7 +15252,7 @@ function metaPath(workspace) {
 /** Read the sidecar metadata for a workspace (null if none yet). */
 async function readColbertMeta(workspace) {
 	try {
-		const raw = await fs.readFile(metaPath(workspace), "utf8");
+		const raw = await fs$1.readFile(metaPath(workspace), "utf8");
 		const parsed = JSON.parse(raw);
 		if (parsed && typeof parsed === "object" && typeof parsed.status === "string") return parsed;
 		return null;
@@ -16630,14 +15277,14 @@ async function writeColbertMeta(meta) {
 	return next;
 }
 async function writeColbertMetaUnchained(meta) {
-	await fs.mkdir(PATHS.COLBERT_META_DIR, { recursive: true });
+	await fs$1.mkdir(PATHS.COLBERT_META_DIR, { recursive: true });
 	const dest = metaPath(meta.workspace);
 	const tmp = `${dest}.${process$1.pid}.${Math.random().toString(16).slice(2, 10)}.tmp`;
 	try {
-		await fs.writeFile(tmp, JSON.stringify(meta, null, 2));
-		await fs.rename(tmp, dest);
+		await fs$1.writeFile(tmp, JSON.stringify(meta, null, 2));
+		await fs$1.rename(tmp, dest);
 	} catch (err) {
-		await fs.rm(tmp, { force: true }).catch(() => {});
+		await fs$1.rm(tmp, { force: true }).catch(() => {});
 		throw err;
 	}
 }
@@ -16653,7 +15300,7 @@ async function colbertProjectDir(workspace) {
 	const indicesDir = PATHS.COLBERT_INDICES_DIR;
 	let names;
 	try {
-		names = await fs.readdir(indicesDir);
+		names = await fs$1.readdir(indicesDir);
 	} catch {
 		return null;
 	}
@@ -16663,7 +15310,7 @@ async function colbertProjectDir(workspace) {
 		const dir = path.join(indicesDir, name);
 		let proj;
 		try {
-			proj = JSON.parse(await fs.readFile(path.join(dir, "project.json"), "utf8"));
+			proj = JSON.parse(await fs$1.readFile(path.join(dir, "project.json"), "utf8"));
 		} catch {
 			continue;
 		}
@@ -16814,7 +15461,7 @@ function indexDirSignature(workspace) {
 */
 async function realpathForCompare(p) {
 	try {
-		return canonicalForCompare(await fs.realpath(p));
+		return canonicalForCompare(await fs$1.realpath(p));
 	} catch {
 		return canonicalForCompare(p);
 	}
@@ -17129,12 +15776,12 @@ async function runSemanticSearch(opts) {
 async function quarantineProjectDir(projectDir) {
 	const quarantine = `${projectDir}.corrupt-${process$1.pid}-${randomBytes(4).toString("hex")}`;
 	try {
-		await fs.rename(projectDir, quarantine);
+		await fs$1.rename(projectDir, quarantine);
 	} catch (err) {
 		consola.debug("colbert: corrupt index quarantine rename failed:", err);
 		return false;
 	}
-	const removal = fs.rm(quarantine, {
+	const removal = fs$1.rm(quarantine, {
 		recursive: true,
 		force: true
 	}).catch((err) => {
@@ -17909,13 +16556,27 @@ async function runUnifiedCodeSearch(input, signal) {
 //#endregion
 //#region src/lib/browser-mcp/browser-detect.ts
 let cached;
-function probeWindows() {
-	const found = [];
-	const probe = (subkey) => {
+function probeWindowsRegistry(subkey) {
+	try {
+		execFileSync("reg.exe", [
+			"query",
+			`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\${subkey}`,
+			"/ve"
+		], {
+			windowsHide: true,
+			timeout: 3e3,
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+		return true;
+	} catch {
 		try {
 			execFileSync("reg.exe", [
 				"query",
-				`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\${subkey}`,
+				`HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\${subkey}`,
 				"/ve"
 			], {
 				windowsHide: true,
@@ -17928,43 +16589,27 @@ function probeWindows() {
 			});
 			return true;
 		} catch {
-			try {
-				execFileSync("reg.exe", [
-					"query",
-					`HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\${subkey}`,
-					"/ve"
-				], {
-					windowsHide: true,
-					timeout: 3e3,
-					stdio: [
-						"ignore",
-						"pipe",
-						"ignore"
-					]
-				});
-				return true;
-			} catch {
-				return false;
-			}
+			return false;
 		}
-	};
-	if (probe("chrome.exe")) found.push("chrome");
-	if (probe("msedge.exe")) found.push("edge");
-	if (!found.includes("chrome")) {
-		const localApp = process$1.env.LOCALAPPDATA;
-		const pf = process$1.env["PROGRAMFILES"];
-		const pf86 = process$1.env["PROGRAMFILES(X86)"];
-		if ([
-			localApp ? path.join(localApp, "Google", "Chrome", "Application", "chrome.exe") : void 0,
-			pf ? path.join(pf, "Google", "Chrome", "Application", "chrome.exe") : void 0,
-			pf86 ? path.join(pf86, "Google", "Chrome", "Application", "chrome.exe") : void 0
-		].filter((p) => typeof p === "string").some(existsSync)) found.push("chrome");
-	}
-	if (!found.includes("edge")) {
-		const pf86 = process$1.env["PROGRAMFILES(X86)"];
-		const pf = process$1.env["PROGRAMFILES"];
-		if ([pf86 ? path.join(pf86, "Microsoft", "Edge", "Application", "msedge.exe") : void 0, pf ? path.join(pf, "Microsoft", "Edge", "Application", "msedge.exe") : void 0].filter((p) => typeof p === "string").some(existsSync)) found.push("edge");
 	}
+}
+/** Well-known install locations. Per-user installs land in LocalAppData; system installs in Program Files. */
+function windowsLiteralPaths(browser) {
+	const localApp = process$1.env.LOCALAPPDATA;
+	const pf = process$1.env["PROGRAMFILES"];
+	const pf86 = process$1.env["PROGRAMFILES(X86)"];
+	return (browser === "chrome" ? [
+		localApp ? path.join(localApp, "Google", "Chrome", "Application", "chrome.exe") : void 0,
+		pf ? path.join(pf, "Google", "Chrome", "Application", "chrome.exe") : void 0,
+		pf86 ? path.join(pf86, "Google", "Chrome", "Application", "chrome.exe") : void 0
+	] : [pf86 ? path.join(pf86, "Microsoft", "Edge", "Application", "msedge.exe") : void 0, pf ? path.join(pf, "Microsoft", "Edge", "Application", "msedge.exe") : void 0]).filter((p) => typeof p === "string");
+}
+function probeWindows() {
+	const found = [];
+	if (windowsLiteralPaths("chrome").some(existsSync)) found.push("chrome");
+	if (windowsLiteralPaths("edge").some(existsSync)) found.push("edge");
+	if (!found.includes("chrome") && probeWindowsRegistry("chrome.exe")) found.push("chrome");
+	if (!found.includes("edge") && probeWindowsRegistry("msedge.exe")) found.push("edge");
 	return found;
 }
 function probeMacOS() {
@@ -18177,6 +16822,18 @@ function appBrowserMcpDir() {
 	return dir;
 }
 /**
+* Memo for the interpreter probe below. The probe shells out to
+* `where`/`which`, which measured ~196ms per spawn on Windows, and it ran on
+* every browser tool call (twice, before the preflight was deduplicated).
+*
+* Only a SUCCESSFUL resolution is cached. `process.execPath` is the
+* fall-through when the probe fails, and caching that would pin a degraded
+* interpreter for the life of the process — including across a `node` install
+* that happens while the proxy is running. The path of an existing `node` on
+* PATH, by contrast, does not change mid-process in any way that matters here.
+*/
+let cachedBridgeInterpreter;
+/**
 * Pick a runtime interpreter for the bridge. The bridge uses Node's
 * binary-stdin framing for native messaging which Bun handles
 * differently (Bun closes the bridge prematurely as soon as anything
@@ -18185,6 +16842,7 @@ function appBrowserMcpDir() {
 * binary) only if node isn't on PATH.
 */
 function resolveBridgeInterpreter() {
+	if (cachedBridgeInterpreter !== void 0) return cachedBridgeInterpreter;
 	const probeCmd = platform() === "win32" ? "where" : "which";
 	try {
 		const out = execFileSync(probeCmd, ["node"], {
@@ -18196,7 +16854,10 @@ function resolveBridgeInterpreter() {
 			timeout: 2e3,
 			windowsHide: true
 		}).toString().trim().split(/\r?\n/)[0];
-		if (out) return out;
+		if (out) {
+			cachedBridgeInterpreter = out;
+			return out;
+		}
 	} catch {}
 	return process$1.execPath;
 }
@@ -18484,8 +17145,7 @@ async function probeHealth(port, token, timeoutMs = 500) {
 }
 function bridgeBundleExists() {
 	try {
-		readFileSync(bridgeBundlePath());
-		return true;
+		return statSync(bridgeBundlePath()).isFile();
 	} catch {
 		return false;
 	}
@@ -18522,6 +17182,13 @@ function loadExpectedExtensionVersion() {
 */
 const DEV_VERSION_SENTINEL = "0.0.0";
 /**
+* Stand-in for `version_mismatch.loaded` when the loaded extension is
+* too old to report a version at all (it predates the `__hello__`
+* handshake). Kept human-readable because it is rendered verbatim into
+* the model-facing instructions.
+*/
+const UNKNOWN_LOADED_VERSION = "unknown (extension reported no version)";
+/**
 * Track which `(extensionId, expectedVersion)` pairs we've already
 * tried to auto-reload in this process. Prevents an infinite reload
 * loop if the on-disk version somehow stays ahead of what the browser
@@ -18530,6 +17197,15 @@ const DEV_VERSION_SENTINEL = "0.0.0";
 */
 const attemptedReloads = /* @__PURE__ */ new Set();
 /**
+* `auto_installed` for the `extension_outdated` payloads below.
+*
+* Reaching those branches means the bridge is running and the extension is
+* connected, so the native-messaging manifest is provably already correct —
+* nothing was installed, and claiming otherwise would point the reader at a
+* step that is not the remedy. The remedy is reloading the extension.
+*/
+const NOTHING_AUTO_INSTALLED = Object.freeze([]);
+/**
 * Send POST /reload to the bridge — triggers __reload__ control frame
 * over native messaging, which the extension's handler dispatches into
 * chrome.runtime.reload(). After this returns, the OLD bridge process
@@ -18574,7 +17250,10 @@ function buildInstallRequired(reason, autoInstalled, versionMismatch) {
 	const instructions = (() => {
 		if (reason === "no_supported_browser") return "No Chrome or Edge installation was detected on this host. Install one and restart the github-router proxy.";
 		if (reason === "bridge_bundle_missing") return "The bridge bundle is missing. Run `bun run build` from the github-router checkout to produce dist/browser-bridge/index.js, then retry.";
-		if (reason === "extension_outdated" && versionMismatch) return `Your loaded github-router browser extension is version ${versionMismatch.loaded} but the github-router package shipped version ${versionMismatch.expected}. Auto-reload was attempted and did not converge — Chrome likely disabled the extension because the new manifest declares new permissions. Open chrome://extensions (or edge://extensions), find the github-router extension card, click "Enable" if it's disabled, then click the reload arrow. Retry this tool call afterwards.`;
+		if (reason === "extension_outdated" && versionMismatch) {
+			if (versionMismatch.loaded === UNKNOWN_LOADED_VERSION) return `Your loaded github-router browser extension did not report a version, so the proxy cannot confirm it is up to date and auto-reload could not fix it (the github-router package shipped version ${versionMismatch.expected}). This usually means the loaded extension predates the auto-reload support and has been silently running stale. Open chrome://extensions (or edge://extensions), find the github-router extension card, and click the reload arrow; if the card is missing, click "Load unpacked" and select the load_unpacked_dir above. If it still reports no version afterwards, restart the github-router proxy so the native bridge is refreshed too.`;
+			return `Your loaded github-router browser extension is version ${versionMismatch.loaded} but the github-router package shipped version ${versionMismatch.expected}. Auto-reload was attempted and did not converge — Chrome likely disabled the extension because the new manifest declares new permissions. Open chrome://extensions (or edge://extensions), find the github-router extension card, click "Enable" if it's disabled, then click the reload arrow. Retry this tool call afterwards.`;
+		}
 		return "Open chrome://extensions (or edge://extensions), enable Developer Mode, click 'Load unpacked', and select the load_unpacked_dir above. Then retry this tool call. If you just updated the github-router package, an extension already loaded may need to be reloaded — click the reload arrow on its card.";
 	})();
 	return {
@@ -18591,6 +17270,31 @@ function buildInstallRequired(reason, autoInstalled, versionMismatch) {
 	};
 }
 /**
+* Is the loaded extension out of date with respect to the shipped one?
+*
+* `loaded === undefined` means the extension reported no version. The
+* bridge has echoed `extension_loaded_version` since the very release
+* that added the `__hello__` handshake, so on any bridge new enough to
+* run this code, a CONNECTED extension that reports no version is one
+* that predates the handshake — the most stale state there is. Treating
+* that absence as "not checkable" failed open permanently for exactly
+* the extensions this check exists to catch: one months out of date kept
+* serving requests while silently ignoring newer arguments, and nothing
+* ever said so. Absence is a staleness signal.
+*
+* The dev sentinel is exempt on both sides: a source checkout loads at
+* "0.0.0" and is expected to diverge.
+*
+* Exported for tests — this predicate is the whole invariant, and it had
+* no coverage when it silently regressed.
+*/
+function isExtensionStale(expected, loaded) {
+	if (typeof expected !== "string" || expected === DEV_VERSION_SENTINEL) return false;
+	if (typeof loaded !== "string") return true;
+	if (loaded === DEV_VERSION_SENTINEL) return false;
+	return loaded !== expected;
+}
+/**
 * Full pre-flight. Returns either `{install_required: false, port,
 * token, pid}` (bridge ready, extension connected) or an
 * `install_required` payload the dispatcher hands directly to the
@@ -18610,9 +17314,41 @@ let _inFlightReady;
 * Always 0 in production (only incremented when imported by tests).
 */
 let __implInvocationsForTests = 0;
+/**
+* Short-lived cache of a READY result.
+*
+* The single-flight above only collapses CONCURRENT callers — it clears in
+* `.finally()`, so sequential calls each re-run the full impl. Every browser
+* tool call runs the check twice (once in `browserPreflight` before slot
+* acquisition, once in `dispatchBrowserTool`, which is deliberate so internal
+* compound dispatches stay fail-closed), and each run re-probes health and
+* re-installs the native-messaging host — spawning `where`/`which` (~196ms on
+* Windows) and `reg.exe` (~26ms) per detected browser, synchronously.
+*
+* Only a READY result is cached, and only briefly:
+*
+*   - Caching `install_required` would freeze a recoverable state — the user
+*     loading the extension, or installing a browser, would not take effect
+*     until restart. Those paths must stay self-healing.
+*   - The TTL is deliberately short. These checks also REPAIR drift (a deleted
+*     manifest, a cleared registry key), so the window in which that repair is
+*     skipped has to stay small. A few seconds collapses the double-check and
+*     a burst of calls without turning a self-healing probe into a one-shot.
+*/
+const READY_CACHE_TTL_MS = 5e3;
+let _readyCache;
 async function ensureBridgeReady() {
+	const cached = _readyCache;
+	if (cached && Date.now() - cached.at < READY_CACHE_TTL_MS) return cached.value;
 	if (_inFlightReady) return _inFlightReady;
-	_inFlightReady = _ensureBridgeReadyImpl().finally(() => {
+	_inFlightReady = _ensureBridgeReadyImpl().then((result) => {
+		if (!result.install_required) _readyCache = {
+			at: Date.now(),
+			value: result
+		};
+		else _readyCache = void 0;
+		return result;
+	}).finally(() => {
 		_inFlightReady = void 0;
 	});
 	return _inFlightReady;
@@ -18623,28 +17359,30 @@ async function _ensureBridgeReadyImpl() {
 	const browsers = detectSupportedBrowsers();
 	if (browsers.length === 0) return buildInstallRequired("no_supported_browser", []);
 	if (!bridgeBundleExists()) return buildInstallRequired("bridge_bundle_missing", []);
-	const autoInstalled = installNativeHostForAll(browsers).flatMap((r) => [`nmh_manifest_${r.browser}`]);
+	const installNow = () => installNativeHostForAll(browsers).map((r) => `nmh_manifest_${r.browser}`);
 	const discovery = readBridgeDiscovery();
-	if (!discovery) return buildInstallRequired("bridge_not_running", autoInstalled);
+	if (!discovery) return buildInstallRequired("bridge_not_running", installNow());
 	const health = await probeHealth(discovery.port, discovery.token);
-	if (!health || !health.ok) return buildInstallRequired("bridge_not_running", autoInstalled);
-	if (!health.extension_connected) return buildInstallRequired("extension_not_loaded", autoInstalled);
+	if (!health || !health.ok) return buildInstallRequired("bridge_not_running", installNow());
+	if (!health.extension_connected) return buildInstallRequired("extension_not_loaded", installNow());
 	const expectedVersion = loadExpectedExtensionVersion();
 	const loadedVersion = health.extension_loaded_version;
-	if (typeof expectedVersion === "string" && typeof loadedVersion === "string" && expectedVersion !== DEV_VERSION_SENTINEL && loadedVersion !== DEV_VERSION_SENTINEL && expectedVersion !== loadedVersion) {
+	const loadedUnknown = typeof loadedVersion !== "string";
+	if (typeof expectedVersion === "string" && isExtensionStale(expectedVersion, loadedVersion)) {
+		const loadedLabel = loadedUnknown ? UNKNOWN_LOADED_VERSION : loadedVersion;
 		const reloadKey = `${loadStableExtensionId()}::${expectedVersion}`;
-		if (attemptedReloads.has(reloadKey)) return buildInstallRequired("extension_outdated", autoInstalled, {
-			loaded: loadedVersion,
+		if (attemptedReloads.has(reloadKey)) return buildInstallRequired("extension_outdated", NOTHING_AUTO_INSTALLED, {
+			loaded: loadedLabel,
 			expected: expectedVersion
 		});
 		attemptedReloads.add(reloadKey);
-		if (!await postReload(discovery.port, discovery.token)) return buildInstallRequired("extension_outdated", autoInstalled, {
-			loaded: loadedVersion,
+		if (!await postReload(discovery.port, discovery.token)) return buildInstallRequired("extension_outdated", NOTHING_AUTO_INSTALLED, {
+			loaded: loadedLabel,
 			expected: expectedVersion
 		});
 		const newDiscovery = await pollUntilExtensionVersion(expectedVersion, 3e3, 150);
-		if (!newDiscovery) return buildInstallRequired("extension_outdated", autoInstalled, {
-			loaded: loadedVersion,
+		if (!newDiscovery) return buildInstallRequired("extension_outdated", NOTHING_AUTO_INSTALLED, {
+			loaded: loadedLabel,
 			expected: expectedVersion
 		});
 		return {
@@ -19161,6 +17899,30 @@ async function browserPreflight(tool, args) {
 	if (ready.install_required) return { envelope: installRequiredToolResult(ready) };
 	return { envelope: void 0 };
 }
+const WINDOW_POLICIES = [
+	"deny",
+	"restore",
+	"foreground"
+];
+const DEFAULT_WINDOW_POLICY = "foreground";
+/**
+* Resolve the window-remediation policy for pixel capture.
+*
+* `captureVisibleTab` cannot produce a frame for a window the browser
+* is not painting, so capturing against a minimized window requires
+* making it paintable first. Whether the proxy is allowed to touch the
+* user's window state is the user's call, not the model's — so it comes
+* from the environment and is injected here, rather than being an
+* argument the model chooses. Note this is a usability control, not a
+* security boundary: the default is the permissive setting, so a model
+* that simply omits the argument already gets the most intrusive
+* behavior. The lever that actually restrains the proxy is setting this
+* env var to `deny`.
+*/
+function resolveWindowPolicy() {
+	const raw = process.env.GH_ROUTER_BROWSER_WINDOW_POLICY?.trim().toLowerCase();
+	return WINDOW_POLICIES.includes(raw ?? "") ? raw : DEFAULT_WINDOW_POLICY;
+}
 /**
 * Real dispatcher for any browser_* tool. Used by the entries in
 * src/lib/browser-mcp/index.ts. Returns the standard MCP tool-result
@@ -19175,10 +17937,14 @@ async function dispatchBrowserTool(tool, args, signal, opts = {}) {
 	const { defaultMs, maxMs } = pickTimeout(tool);
 	const callerTimeout = typeof opts.timeoutMs === "number" && opts.timeoutMs > 0 ? Math.min(opts.timeoutMs, maxMs) : defaultMs;
 	try {
+		const callArgs = tool === "browser_screenshot" ? {
+			...args,
+			windowPolicy: resolveWindowPolicy()
+		} : args;
 		const resp = await bridgeCall({
 			port: ready.port,
 			token: ready.token
-		}, tool, args, callerTimeout, signal);
+		}, tool, callArgs, callerTimeout, signal);
 		if (resp.ok) {
 			logAudit$1({
 				tool,
@@ -19239,7 +18005,7 @@ function logAudit$1(record) {
 		try {
 			const fs = await import("node:fs/promises");
 			const path = await import("node:path");
-			const { PATHS } = await import("./paths-D3XgmTcQ.js");
+			const { PATHS } = await import("./paths-CwKwc2pi.js");
 			const dir = path.join(PATHS.APP_DIR, "browser-mcp");
 			await fs.mkdir(dir, { recursive: true });
 			const line = JSON.stringify({
@@ -20137,11 +18903,12 @@ const createChatCompletions = async (payload, modelHeaders, callerSignal, retryT
 		}
 		const claudeModels = state.models?.data.filter((m) => m.id.startsWith("claude")).map((m) => m.id).join(", ") ?? "(models not loaded)";
 		consola.error(`Copilot rejected model "${payload.model}": ${response.status} ${errorBody} (available Claude models: ${claudeModels})`);
-		throw new HTTPError("Failed to create chat completions", new Response(errorBody, {
+		const reconstructed = new Response(errorBody, {
 			status: response.status,
 			statusText: response.statusText,
 			headers: response.headers
-		}));
+		});
+		throw new HTTPError("Failed to create chat completions", reconstructed);
 	}
 	if (payload.stream) return events(response);
 	const cappedResult = await readResponseBodyCapped(response, "/v1/chat/completions", MAX_RESPONSE_BODY_BYTES);
@@ -21188,7 +19955,7 @@ const BROWSER_TOOLS = Object.freeze([
 	},
 	{
 		toolNameHttp: "browser_screenshot",
-		description: "Captures a screenshot of the visible area of a tab and returns it as an image you can actually look at, plus a small text envelope of capture metadata. It takes a tab id, an optional format (PNG default, JPEG for smaller bytes), and an optional JPEG quality. The tab must be active in its window, so this tool auto-activates the tab if needed and that changes which tab is focused. If a capture is rejected for exceeding a model's image-size limit, the most reliable lever is a smaller browser window; PNG is usually SMALLER than JPEG for ordinary UI and text pages, so switching format is not a dependable way to shrink one. JPEG plus a low quality helps mainly for photographic or dense-colour content. Use screenshot for visual layout, canvas, SVG, maps, or image-only regions; prefer browser_observe when page text and actionable state are enough.",
+		description: "Captures a screenshot of the visible area of a tab and returns it as an image you can actually look at, plus a small text envelope of capture metadata. It takes a tab id, an optional format (PNG default, JPEG for smaller bytes), and an optional JPEG quality. The tab must be active in its window, so this tool auto-activates the tab if needed and that changes which tab is focused. The browser does not paint a minimized window, so a capture needs one that is on screen: by default the tool un-minimizes and raises the target window, which takes focus (the operator can set GH_ROUTER_BROWSER_WINDOW_POLICY=restore to un-minimize without taking focus, or =deny to leave window state untouched and fail instead). If a capture still cannot produce a frame it fails fast with a named code rather than hanging. WINDOW_MINIMIZED and CAPTURE_STALLED mean the window is not visible (minimized, fully covered, on another virtual desktop, or a locked session) and will keep failing until that changes, so make the window visible instead of retrying; TARGET_CHANGED and QUEUE_BUSY mean another tab switch or capture got in the way and a plain retry is the right response. If a capture is rejected for exceeding a model's image-size limit, the most reliable lever is a smaller browser window; PNG is usually SMALLER than JPEG for ordinary UI and text pages, so switching format is not a dependable way to shrink one. JPEG plus a low quality helps mainly for photographic or dense-colour content. Use screenshot for visual layout, canvas, SVG, maps, or image-only regions; prefer browser_observe when page text and actionable state are enough.",
 		inputSchema: {
 			type: "object",
 			required: ["tabId"],
@@ -26670,11 +25437,12 @@ async function createMessages(body, extraHeaders, callerSignal, retryTransient =
 			errorBody = "(could not read error body)";
 		}
 		consola.error(`Copilot /v1/messages error: ${response.status} ${errorBody}`);
-		throw new HTTPError("Copilot messages request failed", new Response(errorBody, {
+		const reconstructed = new Response(errorBody, {
 			status: response.status,
 			statusText: response.statusText,
 			headers: response.headers
-		}));
+		});
+		throw new HTTPError("Copilot messages request failed", reconstructed);
 	}
 	return response;
 }
@@ -26717,11 +25485,12 @@ async function countTokens(body, extraHeaders, callerSignal, retryTransient = fa
 			errorBody = "(could not read error body)";
 		}
 		consola.error(`Copilot count_tokens error: ${response.status} ${errorBody}`);
-		throw new HTTPError("Copilot count_tokens request failed", new Response(errorBody, {
+		const reconstructed = new Response(errorBody, {
 			status: response.status,
 			statusText: response.statusText,
 			headers: response.headers
-		}));
+		});
+		throw new HTTPError("Copilot count_tokens request failed", reconstructed);
 	}
 	return response;
 }
@@ -28894,7 +27663,7 @@ async function throttleSearch() {
 			const waitMs = 1e3 - (now - searchTimestamps[0]);
 			if (waitMs > 0) {
 				consola.debug(`Web search rate limited, waiting ${waitMs}ms`);
-				await sleep$3(waitMs);
+				await sleep$2(waitMs);
 			}
 		}
 		searchTimestamps.push(Date.now());
@@ -30900,7 +29669,7 @@ async function sweepAgedWorkerDiffs(opts = {}) {
 	}
 	let entries;
 	try {
-		entries = await fs.readdir(PATHS.WORKER_DIFFS_DIR);
+		entries = await fs$1.readdir(PATHS.WORKER_DIFFS_DIR);
 	} catch {
 		return;
 	}
@@ -30909,8 +29678,8 @@ async function sweepAgedWorkerDiffs(opts = {}) {
 		if (!WORKER_DIFF_NAME_RE.test(name)) continue;
 		const full = path.join(PATHS.WORKER_DIFFS_DIR, name);
 		try {
-			if (now - (await fs.stat(full)).mtimeMs < AGE_SWEEP_MS$1) continue;
-			await fs.rm(full, { force: true }).catch(() => {});
+			if (now - (await fs$1.stat(full)).mtimeMs < AGE_SWEEP_MS$1) continue;
+			await fs$1.rm(full, { force: true }).catch(() => {});
 		} catch {}
 	}
 }
@@ -30923,13 +29692,13 @@ async function sweepAgedWorkerDiffs(opts = {}) {
 */
 async function saveOverflowResult(text) {
 	await sweepAgedWorkerDiffs({ throttle: true });
-	await fs.mkdir(PATHS.WORKER_DIFFS_DIR, { recursive: true });
+	await fs$1.mkdir(PATHS.WORKER_DIFFS_DIR, { recursive: true });
 	let lastErr;
 	for (let attempt = 0; attempt < 5; attempt++) {
 		const name = `${process$1.pid}-${randomBytes(4).toString("hex")}.txt`;
 		const outPath = path.join(PATHS.WORKER_DIFFS_DIR, name);
 		try {
-			await fs.writeFile(outPath, text, {
+			await fs$1.writeFile(outPath, text, {
 				mode: 384,
 				flag: "wx"
 			});
@@ -31123,7 +29892,7 @@ async function findRepoRoot(workspaceAbs) {
 async function sweepAgedWorktrees(parent) {
 	let entries;
 	try {
-		entries = await fs.readdir(parent);
+		entries = await fs$1.readdir(parent);
 	} catch (err) {
 		if (err.code === "ENOENT") return;
 		return;
@@ -31133,7 +29902,7 @@ async function sweepAgedWorktrees(parent) {
 		if (!WORKTREE_DIR_NAME_RE.test(name)) continue;
 		const full = path.join(parent, name);
 		try {
-			const ageMs = now - (await fs.stat(full)).mtimeMs;
+			const ageMs = now - (await fs$1.stat(full)).mtimeMs;
 			if (ageMs < AGE_SWEEP_MTIME_FLOOR_MS) continue;
 			if (ageMs < AGE_SWEEP_MS) continue;
 			await execFileP("git", [
@@ -31142,7 +29911,7 @@ async function sweepAgedWorktrees(parent) {
 				"--force",
 				full
 			], { timeout: 1e4 }).catch(() => {});
-			await fs.rm(full, {
+			await fs$1.rm(full, {
 				recursive: true,
 				force: true
 			}).catch(() => {});
@@ -31161,11 +29930,11 @@ async function sweepAgedWorktrees(parent) {
 async function createWorktree(workspaceAbs, opts) {
 	const { repoRoot, gitCommonDir } = await findRepoRoot(workspaceAbs);
 	const parent = path.join(gitCommonDir, "worker-worktrees");
-	await fs.mkdir(parent, { recursive: true });
+	await fs$1.mkdir(parent, { recursive: true });
 	await sweepAgedWorktrees(parent);
 	let existing = [];
 	try {
-		existing = await fs.readdir(parent);
+		existing = await fs$1.readdir(parent);
 	} catch {}
 	if (existing.filter((n) => WORKTREE_DIR_NAME_RE.test(n)).length >= QUOTA_PER_REPO) throw new Error(`worker-agent worktree: per-repo quota exceeded (>=${QUOTA_PER_REPO} entries under ${parent}); abort, investigate, then prune manually or wait for the age sweep`);
 	const suffix = randomBytes(4).toString("hex");
@@ -31213,9 +29982,9 @@ async function createWorktree(workspaceAbs, opts) {
 		for (const rel of files) {
 			const src = path.join(repoRoot, rel);
 			const dst = path.join(dir, rel);
-			await fs.mkdir(path.dirname(dst), { recursive: true });
+			await fs$1.mkdir(path.dirname(dst), { recursive: true });
 			try {
-				await fs.copyFile(src, dst);
+				await fs$1.copyFile(src, dst);
 			} catch (err) {
 				if (err.code === "ENOENT") continue;
 				throw err;
@@ -31334,13 +30103,13 @@ async function saveOverflowPatch(dir) {
 		"HEAD"
 	], { maxBuffer: 268435456 });
 	await sweepAgedWorkerDiffs({ throttle: true });
-	await fs.mkdir(PATHS.WORKER_DIFFS_DIR, { recursive: true });
+	await fs$1.mkdir(PATHS.WORKER_DIFFS_DIR, { recursive: true });
 	let lastErr;
 	for (let attempt = 0; attempt < 5; attempt++) {
 		const name = `${process$1.pid}-${randomBytes(4).toString("hex")}.patch`;
 		const patchPath = path.join(PATHS.WORKER_DIFFS_DIR, name);
 		try {
-			await fs.writeFile(patchPath, patch.stdout, {
+			await fs$1.writeFile(patchPath, patch.stdout, {
 				mode: 384,
 				flag: "wx"
 			});
@@ -32404,93 +31173,6 @@ function selectChampion(orchestrated, baseline, canonicalGateIds, tiePolicy) {
 	};
 }
 //#endregion
-//#region src/lib/orchestration/gate-runner.ts
-async function runGateChecks(checks, cwd, exec) {
-	const results = await Promise.all(checks.map(async (c) => {
-		try {
-			const r = await exec({
-				command: c.command,
-				cwd
-			});
-			return {
-				id: c.id,
-				passed: r.exitCode === 0
-			};
-		} catch {
-			return {
-				id: c.id,
-				passed: false
-			};
-		}
-	}));
-	const passed = /* @__PURE__ */ new Set();
-	const ran = /* @__PURE__ */ new Set();
-	for (const r of results) {
-		ran.add(r.id);
-		if (r.passed) passed.add(r.id);
-	}
-	return {
-		passed,
-		ran
-	};
-}
-//#endregion
-//#region src/lib/orchestration/gate-registry.ts
-/**
-* Built-in sealed gates. Commands follow this repo's TS/Bun conventions (the
-* `bun run <script>` indirection means a repo without that script simply fails
-* the check, which the selector treats as not-passed rather than a crash). New
-* ecosystems get a new sealed id here, never a caller-supplied command.
-*/
-const SEALED_GATES = {
-	"default-ci": [
-		{
-			id: "typecheck",
-			command: "bun run typecheck"
-		},
-		{
-			id: "test",
-			command: "bun test"
-		},
-		{
-			id: "lint",
-			command: "bun run lint"
-		}
-	],
-	"typecheck-test": [{
-		id: "typecheck",
-		command: "bun run typecheck"
-	}, {
-		id: "test",
-		command: "bun test"
-	}],
-	"typecheck-only": [{
-		id: "typecheck",
-		command: "bun run typecheck"
-	}]
-};
-/** The set of sealed gate ids, used as the kernel's `knownGateIds` so the IR
-*  verifier rejects an executable gate that references an unregistered id. */
-function sealedGateIds() {
-	return new Set(Object.keys(SEALED_GATES));
-}
-/**
-* Resolve a sealed gate by id. Returns a DEFENSIVE CLONE (fresh objects) so a
-* caller can never mutate the registry's command set. `undefined` for an
-* unknown id, which `run_workflow` rejects before executing anything.
-*/
-function resolveSealedGate(gateId) {
-	const checks = SEALED_GATES[gateId];
-	if (!checks) return void 0;
-	return {
-		id: gateId,
-		checks: checks.map((c) => ({
-			id: c.id,
-			command: c.command
-		}))
-	};
-}
-//#endregion
 //#region src/lib/orchestration/verify.ts
 /**
 * Static verifier for the workflow IR. This is what `decompose`'s output is
@@ -32982,186 +31664,6 @@ function makeRunner(deps, ctx) {
 	} };
 }
 //#endregion
-//#region src/lib/orchestration/gate-immutability.ts
-/** Patterns that weaken a gate regardless of language (test exclusivity / focus
-*  idioms shared across JS test runners; kept in COMMON since several languages
-*  reuse them). */
-const COMMON_PATTERNS = [{
-	name: "skipped-test",
-	re: /(\.\s*skip\s*\(|\bxit\s*\(|\bxdescribe\s*\(|\.\s*only\s*\()/
-}];
-/** Language-specific weakening patterns, selected by the added line's file type. */
-const LANG_PATTERNS = {
-	ts: [
-		{
-			name: "ts-suppression",
-			re: /@ts-(ignore|nocheck|expect-error)\b/
-		},
-		{
-			name: "any-cast",
-			re: /\bas\s+any\b|:\s*any\b/
-		},
-		{
-			name: "eslint-disable",
-			re: /eslint-disable\b/
-		}
-	],
-	py: [
-		{
-			name: "py-type-ignore",
-			re: /#\s*type:\s*ignore\b/
-		},
-		{
-			name: "py-noqa",
-			re: /#\s*noqa\b/
-		},
-		{
-			name: "py-skip",
-			re: /@(pytest\.mark\.skip|unittest\.skip)\b/
-		}
-	],
-	go: [{
-		name: "go-skip",
-		re: /\bt\.Skip\s*\(/
-	}, {
-		name: "go-nolint",
-		re: /\/\/\s*nolint\b/
-	}],
-	rust: [{
-		name: "rust-ignore",
-		re: /#\[\s*ignore\b/
-	}, {
-		name: "rust-allow",
-		re: /#\[\s*allow\s*\(/
-	}]
-};
-/** Map a file path to a language key for `LANG_PATTERNS` (null → COMMON only). */
-function langForFile(file) {
-	if (!file) return null;
-	switch (file.slice(file.lastIndexOf(".")).toLowerCase()) {
-		case ".ts":
-		case ".tsx":
-		case ".mts":
-		case ".cts":
-		case ".js":
-		case ".jsx":
-		case ".mjs":
-		case ".cjs": return "ts";
-		case ".py":
-		case ".pyi": return "py";
-		case ".go": return "go";
-		case ".rs": return "rust";
-		default: return null;
-	}
-}
-/** Union of COMMON + every language — the pre-header default (no file known yet),
-*  so a header-less diff is matched permissively, exactly as before this became
-*  language-scoped. Once a real file header appears, the set narrows to that
-*  file's language (or COMMON only for an unknown extension → fail open). */
-const ALL_PATTERNS = [...COMMON_PATTERNS, ...Object.values(LANG_PATTERNS).flat()];
-/** A `diff --git a/x b/x` or `+++ b/x` header → the current file path. */
-function fileFromHeader(line) {
-	const git = /^diff --git a\/.+ b\/(.+)$/.exec(line);
-	if (git) return git[1];
-	const plus = /^\+\+\+ b\/(.+)$/.exec(line);
-	if (plus) return plus[1];
-}
-function detectGateWeakening(diff) {
-	const findings = [];
-	let file;
-	let patterns = ALL_PATTERNS;
-	for (const raw of diff.split("\n")) {
-		const headerFile = fileFromHeader(raw);
-		if (headerFile !== void 0) {
-			file = headerFile;
-			const lang = langForFile(file);
-			patterns = lang ? [...COMMON_PATTERNS, ...LANG_PATTERNS[lang]] : COMMON_PATTERNS;
-			continue;
-		}
-		if (!raw.startsWith("+") || raw.startsWith("+++")) continue;
-		const added = raw.slice(1);
-		for (const p of patterns) if (p.re.test(added)) findings.push(file === void 0 ? {
-			pattern: p.name,
-			line: added.trim()
-		} : {
-			pattern: p.name,
-			line: added.trim(),
-			file
-		});
-	}
-	return {
-		weakened: findings.length > 0,
-		findings
-	};
-}
-//#endregion
-//#region src/lib/orchestration/stop-gate.ts
-/**
-* The Phase-0 structural-gate decision — the cheap, CERTAIN floor win. It blocks
-* marking work "done" when any canonical gate fails OR the diff weakens a gate.
-* A non-model check that fires every run and never ships broken or gate-gamed
-* code; per the floor analysis it is the only component that raises the
-* worst-case floor BY CONSTRUCTION (the orchestration on top is a conditional
-* bet).
-*
-* This is the logic behind the spawned-session Stop-hook AND the kernel runner's
-* pre-accept check. The process exec and the diff are inputs, so the decision is
-* pure + unit-testable; the hook script that runs `git diff` + invokes this is a
-* thin wrapper.
-*/
-async function evaluateStopGate(input) {
-	const gate = await runGateChecks(input.checks, input.cwd, input.exec);
-	const weak = detectGateWeakening(input.diff);
-	const failedChecks = input.checks.map((c) => c.id).filter((id) => !gate.passed.has(id));
-	const block = failedChecks.length > 0 || weak.weakened;
-	const parts = [];
-	if (failedChecks.length > 0) parts.push(`failing gates: ${failedChecks.join(", ")}`);
-	if (weak.weakened) {
-		const pats = [...new Set(weak.findings.map((f) => f.pattern))].join(", ");
-		parts.push(`gate-weakening in the diff: ${pats}`);
-	}
-	return {
-		block,
-		reason: block ? parts.join("; ") : "all canonical gates pass; no gate-weakening in the diff",
-		failedChecks,
-		weakening: weak.findings
-	};
-}
-//#endregion
-//#region src/lib/orchestration/live-exec.ts
-/**
-* Live `ExecFn` for the gate runner — runs the kernel's SEALED gate command in a
-* workspace via the project's Windows-safe exec helper (`runCommandCapture` →
-* `buildExecInvocation`, which handles cmd.exe quoting on Windows). Only the
-* kernel's sealed gate commands flow through here (tests/types/lint/build),
-* never a producer-authored string, so a simple whitespace split into argv is
-* safe for these fixed commands. A command that can't run (spawn error / killed)
-* counts as a non-zero exit, never a throw — the gate runner treats it as
-* not-passed.
-*
-* This is the one piece of the gate engine that touches a real subprocess; it is
-* model-free and cross-platform, so it is exercised directly in CI (unlike the
-* worker/worktree/model adapters, which need the gated E2E harness).
-*/
-/** Per-command wall-clock cap so a hung gate command (watch-mode test, a process
-*  waiting on stdin, a stale lockfile) is tree-killed instead of hanging the
-*  caller forever. Generous (a real typecheck/test/lint can take minutes) but
-*  bounded; override with GH_ROUTER_GATE_CMD_TIMEOUT_MS. A timeout kills the
-*  command (code null) which the gate runner treats as not-passed. */
-const CMD_TIMEOUT_MS = parseIntEnv(process.env.GH_ROUTER_GATE_CMD_TIMEOUT_MS) ?? 6e5;
-const liveExec = async ({ command, cwd }) => {
-	const argv = command.trim().split(/\s+/).filter(Boolean);
-	if (argv.length === 0) return { exitCode: 1 };
-	try {
-		return { exitCode: (await runCommandCapture(argv, {
-			cwd,
-			timeoutMs: CMD_TIMEOUT_MS
-		})).code ?? 1 };
-	} catch {
-		return { exitCode: 1 };
-	}
-};
-//#endregion
 //#region src/lib/orchestration/runner-live.ts
 /**
 * The LIVE adapter for the kernel's NodeRunner primitives. buildLiveRunner wires
@@ -33264,665 +31766,6 @@ function buildLiveRunner(ctx, prim) {
 	};
 }
 //#endregion
-//#region src/lib/orchestration/stop-gate-policy.ts
-/**
-* Pure + thin-IO policy helpers for the consent-gated, top-level-only structural
-* Stop-gate. Split out of `stop-gate-hook.ts` so the security-critical decisions
-* (is this a subagent? is this repo trusted? which checks regressed?) are small,
-* named, and unit-testable.
-*
-* Verified against the official Claude Code hooks reference
-* (https://code.claude.com/docs/en/hooks), 2026-06:
-*   - `Stop` fires for the MAIN agent; subagents fire `SubagentStop`, and a
-*     `Stop`-registered hook is converted to `SubagentStop` in a subagent
-*     context — so the hook command CAN run for a subagent. The payload carries
-*     `agent_id` / `agent_type` ONLY inside a subagent/teammate context, so that
-*     is the reliable top-level-vs-sub discriminator (NOT an env var, which the
-*     proxy cannot set on Claude-spawned subagents).
-*   - `UserPromptSubmit` fires only for human prompts to the main agent.
-*   - `stop_hook_active` is NOT in the current documented payload, so the
-*     per-prompt block budget — not that flag — must be the termination guard.
-*/
-/**
-* True when the hook is firing inside a subagent / teammate context (NOT the
-* top-level user session). Claude Code adds `agent_id` + `agent_type` to the
-* payload only there, so their presence is the discriminator. The Stop-gate and
-* the prompt-steer hook both stand down when this is true, scoping them to the
-* top-level session.
-*/
-function isSubagentContext(payload) {
-	const present = (v) => v !== void 0 && v !== null;
-	return present(payload?.agent_type) || present(payload?.agent_id);
-}
-/** Stable trust dir (NOT the per-launch mirror — trust must persist). */
-function trustDir() {
-	return path.join(PATHS.APP_DIR, "stop-gate", "trust");
-}
-/** Resolve the git repo root for `cwd`, falling back to `cwd` when not a repo. */
-async function repoRoot(cwd) {
-	const top = (await runCommandCapture([
-		"git",
-		"rev-parse",
-		"--show-toplevel"
-	], {
-		cwd,
-		timeoutMs: 5e3
-	}).catch(() => void 0))?.stdout?.trim();
-	return top && top.length > 0 ? top : cwd;
-}
-function trustFileFor(root) {
-	const key = createHash("sha256").update(path.resolve(root)).digest("hex").slice(0, 32);
-	return path.join(trustDir(), key);
-}
-/**
-* A stable identity for the repo at `root`: the first (root) commit SHA. It
-* survives normal history growth but differs across distinct repositories, so a
-* DIFFERENT repo later appearing at the same filesystem path is not silently
-* trusted (codex review #2). Empty string when unavailable (no git / no commits)
-* — trust then falls back to path-only, the best we can do.
-*/
-async function repoFingerprint(root) {
-	return (await runCommandCapture([
-		"git",
-		"rev-list",
-		"--max-parents=0",
-		"HEAD"
-	], {
-		cwd: root,
-		timeoutMs: 5e3
-	}).catch(() => void 0))?.stdout?.split(/\r?\n/).map((s) => s.trim()).filter(Boolean)[0] ?? "";
-}
-/**
-* True iff the user has consented to run the gate in this repo AND the repo's
-* identity still matches what was trusted. The trust file stores `root\nfp\n`;
-* a present fingerprint is verified against the live one (deny on mismatch, and
-* deny if we pinned one but can't recompute it — fail closed). A legacy file
-* with no fingerprint is path-only trust.
-*/
-async function isRepoTrusted(cwd) {
-	const root = await repoRoot(cwd);
-	let stored;
-	try {
-		stored = await promises.readFile(trustFileFor(root), "utf8");
-	} catch {
-		return false;
-	}
-	const storedFp = (stored.split(/\r?\n/)[1] ?? "").trim();
-	if (storedFp.length === 0) return true;
-	const currentFp = await repoFingerprint(root);
-	if (currentFp.length === 0) return false;
-	return currentFp === storedFp;
-}
-/** Record consent for this repo (consent once → automatic thereafter), pinning
-*  the repo's root-commit fingerprint so a later repo swap at the same path is
-*  not auto-trusted. */
-async function trustRepo(cwd) {
-	const root = await repoRoot(cwd);
-	const fp = await repoFingerprint(root);
-	await promises.mkdir(trustDir(), { recursive: true });
-	await promises.writeFile(trustFileFor(root), `${root}\n${fp}\n`, { mode: 384 });
-	return root;
-}
-/**
-* Repo-aware gate enable: `GH_ROUTER_DISABLE_STOP_GATE` force-off wins;
-* `GH_ROUTER_ENABLE_STOP_GATE` force-on next; otherwise default to OFF unless the
-* repo is trusted. This is the load-bearing security gate — the default is OFF,
-* so an untrusted repo's scripts are never auto-run.
-*/
-async function stopGateEnabledForRepo(cwd, env = process.env) {
-	if (parseBoolEnv(env.GH_ROUTER_DISABLE_STOP_GATE) === true) return false;
-	if (parseBoolEnv(env.GH_ROUTER_ENABLE_STOP_GATE) === true) return true;
-	return isRepoTrusted(cwd);
-}
-/**
-* Given the current failed checks and the recorded baseline, return the checks
-* that REGRESSED (failing now, not failing at baseline). A null baseline (first
-* eval) yields an empty regression set — nothing is blamed on the agent yet.
-*/
-function regressions(currentFailed, baseline) {
-	if (baseline === null) return [];
-	return currentFailed.filter((id) => !baseline.has(id));
-}
-/** File-backed `BaselineStore` under `stateDir`, keyed by sha256(session_id). */
-function fileBaselineStore(stateDir) {
-	const fileFor = (sid) => path.join(stateDir, `baseline-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
-	return {
-		async get(sid) {
-			try {
-				const raw = await promises.readFile(fileFor(sid), "utf8");
-				const arr = JSON.parse(raw);
-				if (Array.isArray(arr)) return new Set(arr.filter((x) => typeof x === "string"));
-				return /* @__PURE__ */ new Set();
-			} catch {
-				return null;
-			}
-		},
-		async set(sid, failed) {
-			await promises.mkdir(stateDir, { recursive: true });
-			await promises.writeFile(fileFor(sid), JSON.stringify([...failed]), { mode: 384 });
-		}
-	};
-}
-function fileReviewDebounce(stateDir) {
-	const fileFor = (sid) => path.join(stateDir, `review-hash-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
-	const readLast = async (sid) => {
-		try {
-			return (await promises.readFile(fileFor(sid), "utf8")).trim();
-		} catch {
-			return "";
-		}
-	};
-	return {
-		async shouldReview(sid, diffHash) {
-			if (diffHash.length === 0) return false;
-			return await readLast(sid) !== diffHash;
-		},
-		async markReviewed(sid, diffHash) {
-			await promises.mkdir(stateDir, { recursive: true });
-			await promises.writeFile(fileFor(sid), diffHash, { mode: 384 });
-		}
-	};
-}
-function fileFindingsStore(stateDir) {
-	const fileFor = (sid) => path.join(stateDir, `findings-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
-	return {
-		async read(sid) {
-			try {
-				const raw = await promises.readFile(fileFor(sid), "utf8");
-				return raw.length > 0 ? raw : null;
-			} catch {
-				return null;
-			}
-		},
-		async write(sid, findings) {
-			await promises.mkdir(stateDir, { recursive: true });
-			const tmp = `${fileFor(sid)}.${process.pid}.tmp`;
-			await promises.writeFile(tmp, findings, { mode: 384 });
-			await promises.rename(tmp, fileFor(sid));
-		},
-		async clear(sid) {
-			await promises.unlink(fileFor(sid)).catch(() => {});
-		}
-	};
-}
-/**
-* The single canonical state dir for the advisory-review layer (hook V2): the
-* Stop hook's review debounce, the background review's findings file, and the
-* UserPromptSubmit hook's last-user-prompt store all live here, keyed by
-* sha256(session_id). One dir so the three independent subcommand processes
-* (`internal-stop-hook`, `internal-stop-review`, `internal-prompt-submit`)
-* agree on where to read/write without threading a path through env. Distinct
-* from the deterministic gate's `gh-router-stopgate*` dirs (block budget +
-* baseline) so the advisory layer can be wiped independently.
-*/
-function stopReviewStateDir() {
-	return path.join(tmpdir(), "gh-router-stop-review");
-}
-function fileLastPromptStore(stateDir) {
-	const fileFor = (sid) => path.join(stateDir, `last-prompt-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
-	return {
-		async read(sid) {
-			try {
-				const raw = await promises.readFile(fileFor(sid), "utf8");
-				return raw.length > 0 ? raw : null;
-			} catch {
-				return null;
-			}
-		},
-		async write(sid, prompt) {
-			await promises.mkdir(stateDir, { recursive: true });
-			const tmp = `${fileFor(sid)}.${process.pid}.tmp`;
-			await promises.writeFile(tmp, prompt, { mode: 384 });
-			await promises.rename(tmp, fileFor(sid));
-		}
-	};
-}
-//#endregion
-//#region src/lib/orchestration/stop-gate-hook.ts
-/**
-* The Phase-0 structural-gate Stop-hook glue. `runStopGateForLaunch` resolves a
-* SEALED gate by id and evaluates it against the working-tree diff, returning the
-* block decision a spawned-session Stop hook (or a manual check) acts on.
-*
-* Safety posture (deliberately different from the kernel): a Stop hook that
-* blocks on a MISCONFIGURATION would wedge the user's session (they could not
-* stop). So this fails OPEN on config problems (unknown gate id) and blocks ONLY
-* on a genuine red gate or a gate-weakening diff. The kernel, by contrast, fails
-* CLOSED to the baseline. Both are correct for their context.
-*
-* The sealed gate + diff + exec are inputs, so the decision is pure and
-* unit-testable; the thin live wrapper (capture `git diff`, spawn the checks,
-* map the result to an exit code) is the only part that needs a real process.
-*/
-async function runStopGateForLaunch(input) {
-	const gate = resolveSealedGate(input.gateId);
-	if (!gate) return {
-		block: false,
-		reason: `stop-gate: unknown gateId "${input.gateId}" (not blocking)`,
-		failedChecks: [],
-		weakening: []
-	};
-	return evaluateStopGate({
-		checks: gate.checks,
-		cwd: input.workspace,
-		exec: input.exec,
-		diff: input.diff
-	});
-}
-/**
-* The launch-stable baseline key for the dynamic gate path: keyed by the
-* workdir + the descriptor's check set + a per-launch token, NOT the session id
-* and NOT HEAD. The LAUNCHER generates the token (passed to the child via env),
-* computes this key, and seeds the baseline (the set of checks already failing at
-* launch, BEFORE the agent mutates the tree); the runtime hook recomputes the
-* same key (reading the token from its env) and reads that baseline, so an
-* agent-introduced failure is a REGRESSION rather than being silently adopted as
-* the baseline at first stop. The per-launch token isolates concurrent sessions
-* on the same repo (they don't clobber each other's baseline). HEAD is
-* deliberately NOT in the key: an agent that COMMITS its work mid-session must
-* still be judged against the pre-session baseline (a HEAD-keyed baseline would
-* vanish on the commit — the exact moment it matters). A changed check set (the
-* agent edited the harness) yields a different key → the launch baseline no
-* longer matches and the hook degrades to first-stop baselining.
-*/
-function launchBaselineKey(workdir, descriptorKey, token) {
-	return JSON.stringify([
-		"launch",
-		path.resolve(workdir),
-		descriptorKey,
-		token ?? ""
-	]);
-}
-/**
-* Run the resolved checks ONCE at launch (pre-mutation) and record the failing
-* set as the baseline under `launchBaselineKey`. Best-effort: any failure is
-* swallowed (the hook then degrades to first-stop baselining). The launcher MUST
-* pass the SAME check set the hook will run (same `includeTests`) so a
-* pre-existing test failure isn't later miscounted as a regression.
-*
-* NOTE: capture is best-effort pre-mutation — the launcher fires it before the
-* child can edit, and in practice the agent does not mutate until well after a
-* user prompt, so the checks see the clean tree. If the agent somehow mutates
-* before this completes, the worst case is the legacy first-stop baseline (no
-* regression, never a wedge).
-*/
-async function captureLaunchBaseline(input) {
-	if (input.checks.length === 0) return;
-	try {
-		const gate = await runGateChecks(input.checks, input.workdir, input.exec);
-		const failed = input.checks.map((c) => c.id).filter((id) => !gate.passed.has(id));
-		await input.baseline.set(launchBaselineKey(input.workdir, input.descriptorKey, input.token), failed);
-	} catch {}
-}
-/**
-* The advisory background review (hook V2) is ON by default whenever the Stop
-* gate runs; it is the cross-lab accountability layer. Opt out with
-* `GH_ROUTER_DISABLE_STOP_REVIEW=1` to keep the deterministic gate but drop the
-* LLM review. (Disabling the whole gate with `GH_ROUTER_DISABLE_STOP_GATE=1`
-* also drops the review, since the review only ever fires from the gate's green
-* path.)
-*/
-function stopReviewEnabled(env = process.env) {
-	return parseBoolEnv(env.GH_ROUTER_DISABLE_STOP_REVIEW) !== true;
-}
-/** The sealed gate the Stop hook runs, overridable via `GH_ROUTER_STOP_GATE_ID`
-*  (must be a registered sealed id; the live wrapper falls open on an unknown
-*  id). Defaults to `default-ci`. */
-function stopGateId(env = process.env) {
-	const v = (env.GH_ROUTER_STOP_GATE_ID ?? "").trim();
-	return v.length > 0 ? v : "default-ci";
-}
-/**
-* PLAN-MODE env fallback. When the session is in plan mode, plan/memory scratch
-* edits should not trip the gate-WEAKENING scan (a plan/memory markdown file may
-* legitimately quote `it.skip` / `as any` while describing work). The launcher
-* sets `GH_ROUTER_STOP_GATE_PLAN_MODE` for a plan-mode session; the payload may
-* ALSO carry a forward-compat `plan_mode` field (see `decideStopHook`). Either
-* signal being present activates the scoping — the executable gate STILL runs
-* and non-plan hunks are STILL scanned.
-*/
-function stopGatePlanMode(env = process.env) {
-	return parseBoolEnv(env.GH_ROUTER_STOP_GATE_PLAN_MODE) === true;
-}
-/**
-* Is a unified-diff file path confined to a `plans/` or `memory/` directory?
-* Windows-safe (normalizes `\` → `/`). Matches only when a DIRECTORY segment of
-* the path is exactly `plans` or `memory`, so `plans/x.md`, `memory/y.md`, and
-* `a/plans/z` match while the filenames `docs/plans.md` / `myplans/x` do not.
-*/
-function isPlanMemoryDiffPath(p) {
-	const segs = p.replace(/\\/g, "/").split("/");
-	for (let i = 0; i < segs.length - 1; i++) if (segs[i] === "plans" || segs[i] === "memory") return true;
-	return false;
-}
-/**
-* Drop the file sections of a unified `git diff` whose NEW path (the `b/…` side)
-* is confined to `plans/` or `memory/` — used for the gate-WEAKENING scan when
-* plan mode is active. Sections for other files (e.g. `src/…`) are preserved
-* verbatim, so a MIXED diff keeps its non-plan hunks and `src/` weakening is
-* still caught. The executable gate does not read the diff, so filtering it here
-* never affects which checks run. A diff with no `diff --git` sections (or an
-* empty one) is returned unchanged.
-*/
-function stripPlanMemoryDiffHunks(diff) {
-	if (diff.length === 0) return diff;
-	const out = [];
-	let dropping = false;
-	for (const line of diff.split("\n")) {
-		if (line.startsWith("diff --git ")) {
-			const bPath = /^diff --git a\/.+ b\/(.+)$/.exec(line)?.[1];
-			dropping = bPath !== void 0 && isPlanMemoryDiffPath(bPath);
-			if (!dropping) out.push(line);
-			continue;
-		}
-		if (!dropping) out.push(line);
-	}
-	return out.join("\n");
-}
-/**
-* C3: whether the structural Stop-gate is disabled for THIS launch. True when the
-* `GH_ROUTER_DISABLE_STOP_GATE` env is set OR the `--no-stop-gate` launcher flag was
-* passed (`args["no-stop-gate"] === true`). A DRIVEN session sets the flag so a
-* blocking Stop hook never hangs its turn-end (~10 min) waiting on the fleet driver.
-* Pure so it is unit-testable without the live launch path.
-*/
-function stopGateDisabled(args, env = process.env) {
-	return parseBoolEnv(env.GH_ROUTER_DISABLE_STOP_GATE) === true || args["no-stop-gate"] === true;
-}
-/** True when a settings `Stop` entry already registers `command` (so the merge
-*  is idempotent across re-launches). */
-function entryHasCommand(entry, command) {
-	if (!entry || typeof entry !== "object") return false;
-	const hooks = entry.hooks;
-	if (!Array.isArray(hooks)) return false;
-	return hooks.some((h) => h && typeof h === "object" && h.command === command);
-}
-/**
-* Idempotently merge a hook running `command` for `event` (default `Stop`) into
-* an existing Claude Code settings object WITHOUT clobbering other hook events or
-* other entries. Returns a new object (never mutates the input). Re-running the
-* launcher with the same command+event does not duplicate the hook.
-*/
-function mergeStopHookIntoSettings(existing, command, event = "Stop", timeoutSec, matcher) {
-	const base = existing && typeof existing === "object" ? { ...existing } : {};
-	const hooks = base.hooks && typeof base.hooks === "object" ? { ...base.hooks } : {};
-	const arr = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
-	if (!arr.some((e) => entryHasCommand(e, command))) {
-		const hook = {
-			type: "command",
-			command
-		};
-		if (typeof timeoutSec === "number" && Number.isFinite(timeoutSec) && timeoutSec > 0) hook.timeout = timeoutSec;
-		arr.push(matcher ? {
-			matcher,
-			hooks: [hook]
-		} : { hooks: [hook] });
-	}
-	hooks[event] = arr;
-	base.hooks = hooks;
-	return base;
-}
-async function decideStopHook(input) {
-	const maxBlocks = input.maxBlocks ?? 2;
-	let payload = {};
-	let parsed = false;
-	try {
-		const p = JSON.parse(input.stdin);
-		if (p && typeof p === "object") {
-			payload = p;
-			parsed = true;
-		}
-	} catch {}
-	if (!parsed) return { exitCode: 0 };
-	if (isSubagentContext(payload)) return { exitCode: 0 };
-	const sessionId = typeof payload.session_id === "string" && payload.session_id.length > 0 ? payload.session_id : "";
-	if (!sessionId) return { exitCode: 0 };
-	const cwdRaw = typeof payload.cwd === "string" && payload.cwd.length > 0 ? payload.cwd : input.fallbackCwd;
-	let cwd = cwdRaw;
-	try {
-		cwd = await promises.realpath(cwdRaw);
-	} catch {}
-	let enabled;
-	try {
-		enabled = await input.isEnabledForRepo(cwd);
-	} catch {
-		return { exitCode: 0 };
-	}
-	if (!enabled) return { exitCode: 0 };
-	let priorBlocks;
-	try {
-		priorBlocks = await input.budget.count(sessionId);
-	} catch {
-		return { exitCode: 0 };
-	}
-	if (priorBlocks >= maxBlocks) return {
-		exitCode: 0,
-		stderr: `structural gate: reached the ${maxBlocks}-block limit for this prompt; allowing the stop WITHOUT re-running the checks. If the failures from the last block are unfixed, they are shipping — run the checks manually to verify.`
-	};
-	let resolvedKey = input.gateId;
-	let dynamicBaselineKey;
-	const planMode = input.planMode === true || payload.plan_mode === true;
-	const scanDiff = (diff) => planMode ? stripPlanMemoryDiffHunks(diff) : diff;
-	const capturedDiff = async (workdir) => {
-		try {
-			return {
-				diff: await input.captureDiff(workdir),
-				captured: true
-			};
-		} catch {
-			return {
-				diff: "",
-				captured: false
-			};
-		}
-	};
-	const runGate = async () => {
-		if (input.resolveChecks) {
-			const resolved = await input.resolveChecks(cwd).catch(() => null);
-			if (!resolved || resolved.checks.length === 0) return null;
-			resolvedKey = resolved.descriptorKey;
-			dynamicBaselineKey = resolved.baselineKey;
-			const workdir = resolved.workdir || cwd;
-			const { diff, captured } = await capturedDiff(workdir);
-			if (captured && diff.length === 0) return {
-				kind: "no-diff",
-				diff
-			};
-			const result = await evaluateStopGate({
-				checks: resolved.checks,
-				cwd: workdir,
-				exec: input.exec,
-				diff: captured ? scanDiff(diff) : ""
-			});
-			return {
-				kind: "evaluated",
-				failedChecks: [...result.failedChecks],
-				weakeningPatterns: [...new Set(result.weakening.map((w) => w.pattern))],
-				diff
-			};
-		}
-		const { diff, captured } = await capturedDiff(cwd);
-		if (captured && diff.length === 0) return {
-			kind: "no-diff",
-			diff
-		};
-		const result = await runStopGateForLaunch({
-			workspace: cwd,
-			gateId: input.gateId,
-			exec: input.exec,
-			diff: captured ? scanDiff(diff) : ""
-		});
-		return {
-			kind: "evaluated",
-			failedChecks: [...result.failedChecks],
-			weakeningPatterns: [...new Set(result.weakening.map((w) => w.pattern))],
-			diff
-		};
-	};
-	const timeoutMs = input.timeoutMs ?? 3e5;
-	let timer;
-	const raced = await Promise.race([runGate(), new Promise((resolve) => {
-		timer = setTimeout(() => resolve("timeout"), timeoutMs);
-	})]);
-	if (timer) clearTimeout(timer);
-	if (raced === "timeout") return { exitCode: 0 };
-	if (raced === null) return { exitCode: 0 };
-	if (raced.kind === "no-diff") return { exitCode: 0 };
-	const baselineKey = dynamicBaselineKey ?? JSON.stringify([
-		sessionId,
-		cwd,
-		resolvedKey
-	]);
-	const recorded = await input.baseline.get(baselineKey).catch(() => null);
-	if (recorded === null) await input.baseline.set(baselineKey, raced.failedChecks).catch(() => {});
-	const regressed = regressions(raced.failedChecks, recorded);
-	const weakened = raced.weakeningPatterns.length > 0;
-	if (regressed.length === 0 && !weakened) {
-		await maybeSpawnReview(input, sessionId, cwd, raced.diff);
-		return { exitCode: 0 };
-	}
-	try {
-		await input.budget.record(sessionId);
-	} catch {
-		return { exitCode: 0 };
-	}
-	const parts = [];
-	if (regressed.length > 0) parts.push(`regressed gates: ${regressed.join(", ")}`);
-	if (weakened) parts.push(`gate-weakening in the diff: ${raced.weakeningPatterns.join(", ")}`);
-	return {
-		exitCode: 2,
-		stderr: `structural gate failed (block ${priorBlocks + 1}/${maxBlocks}): ${parts.join("; ")}. Fix the failing checks and revert any gate-weakening (no new .skip / as any / lint-disable) before finishing.`
-	};
-}
-/**
-* The advisory-review side-effect on a GREEN stop: debounce by diff hash, then
-* fire the detached background reviewer. ADVISORY-ONLY — it returns void, never
-* throws (every step is swallowed), and the caller does not await its result for
-* the exit decision. A no-op when the review layer isn't wired (no debounce /
-* spawn injected, e.g. GH_ROUTER_DISABLE_STOP_REVIEW) or the diff is empty.
-*
-* `markReviewed` runs BEFORE the spawn so a crashing spawn still records the
-* debounce (an identical tree won't re-trigger on the next stop). The review is
-* gated on the diff CHANGING since the last review — without it, every stop of
-* an unchanged tree would re-spend a background gpt-5.6-sol review.
-*
-* The whole body is bounded by a short timeout (the stores are local temp files
-* that complete in well under a millisecond in practice, so the timeout never
-* fires normally — but if the debounce read/write ever stalled, the stop must
-* still proceed promptly; the advisory layer never delays a clean stop).
-*/
-const REVIEW_SIDE_EFFECT_BUDGET_MS = 2e3;
-async function maybeSpawnReview(input, sessionId, cwd, diff) {
-	if (!input.reviewDebounce || !input.spawnReview) return;
-	if (diff.trim().length === 0) return;
-	let timer;
-	try {
-		const work = (async () => {
-			const diffHash = createHash("sha256").update(diff).digest("hex");
-			if (!await input.reviewDebounce.shouldReview(sessionId, diffHash)) return;
-			await input.reviewDebounce.markReviewed(sessionId, diffHash);
-			input.spawnReview({
-				sessionId,
-				cwd,
-				diff,
-				diffHash
-			});
-		})();
-		await Promise.race([work, new Promise((resolve) => {
-			timer = setTimeout(resolve, REVIEW_SIDE_EFFECT_BUDGET_MS);
-		})]);
-	} catch {} finally {
-		if (timer) clearTimeout(timer);
-	}
-}
-/**
-* A file-backed `BlockBudget` under `stateDir`, keyed by a hash of the session id
-* (so a session id is never written verbatim to a predictable path). Best-effort:
-* a read miss counts as 0; `record` increments. A write/read error propagates so
-* `decideStopHook` stands down (it can't guarantee termination without the
-* budget).
-*/
-function fileBlockBudget(stateDir) {
-	const fileFor = (sid) => path.join(stateDir, `block-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
-	const readCount = async (sid) => {
-		try {
-			const raw = await promises.readFile(fileFor(sid), "utf8");
-			const n = Number.parseInt(raw.trim(), 10);
-			return Number.isFinite(n) && n > 0 ? n : 0;
-		} catch {
-			return 0;
-		}
-	};
-	return {
-		count: readCount,
-		async record(sid) {
-			const next = await readCount(sid) + 1;
-			await promises.mkdir(stateDir, { recursive: true });
-			await promises.writeFile(fileFor(sid), String(next), { mode: 384 });
-		},
-		async reset(sid) {
-			await promises.unlink(fileFor(sid)).catch(() => {});
-		}
-	};
-}
-/**
-* Build the shell command string Claude Code runs for the Stop hook. Invokes the
-* running github-router via its node/bun binary so it works regardless of PATH.
-* Pure (takes the binary + script paths) so the quoting is unit-testable; the
-* cross-platform firing is verified by the gated E2E.
-*/
-function buildStopHookCommand(execPath, scriptPath) {
-	const q = (s) => `"${s}"`;
-	if (scriptPath && scriptPath !== execPath) return `${q(execPath)} ${q(scriptPath)} internal-stop-hook`;
-	return `${q(execPath)} internal-stop-hook`;
-}
-/**
-* Build the shell command Claude Code runs for the SessionStart/SessionEnd hooks
-* (registered only when github-router runs inside an ai-or-die Terminal tab). The
-* sidecar path is baked in as a literal `--out` arg — NOT passed via env — so it
-* survives `AIORDIE_CLAUDE_BIND` being stripped from the child's environment and a
-* nested `github-router claude` can't inherit it. Pure (binary + script + out
-* paths) for unit-testable quoting; the live firing is verified end-to-end.
-*/
-function buildSessionBindHookCommand(execPath, scriptPath, outPath) {
-	const q = (s) => `"${s}"`;
-	return `${scriptPath && scriptPath !== execPath ? `${q(execPath)} ${q(scriptPath)}` : q(execPath)} internal-session-bind --out ${q(outPath)}`;
-}
-/** Command for the `internal-artifact-open` hook (no args — token comes from the
-*  mirror creds file, plan from the plans dir; nothing secret in argv). */
-function buildArtifactOpenHookCommand(execPath, scriptPath) {
-	const q = (s) => `"${s}"`;
-	return `${scriptPath && scriptPath !== execPath ? `${q(execPath)} ${q(scriptPath)}` : q(execPath)} internal-artifact-open`;
-}
-/**
-* Read-merge-atomic-write the Stop hook into a Claude Code `settings.json` file
-* (the mirrored one). A MISSING file (ENOENT) starts from `{}`; any OTHER read or
-* parse error THROWS (the caller's try/catch warns and continues) rather than
-* overwriting a file we couldn't understand with our defaults. Preserves every
-* other setting, is idempotent, and uses temp+rename so Claude Code's mtime
-* watcher never sees a half-written file. Returns the merged object.
-*/
-async function injectStopHookIntoSettingsFile(settingsPath, command, event = "Stop", timeoutSec, matcher) {
-	let existing = {};
-	let raw;
-	try {
-		raw = await promises.readFile(settingsPath, "utf8");
-	} catch (err) {
-		if (err.code !== "ENOENT") throw err;
-		raw = void 0;
-	}
-	if (raw !== void 0) {
-		const parsed = JSON.parse(raw);
-		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) existing = parsed;
-		else throw new Error(`settings.json at ${settingsPath} is not a JSON object; refusing to overwrite`);
-	}
-	const merged = mergeStopHookIntoSettings(existing, command, event, timeoutSec, matcher);
-	const tmp = `${settingsPath}.${process.pid}.tmp`;
-	await promises.writeFile(tmp, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
-	await promises.rename(tmp, settingsPath);
-	return merged;
-}
-//#endregion
 //#region src/lib/orchestration/attest.ts
 function isNonEmptyString(v) {
 	return typeof v === "string" && v.length > 0;
@@ -35921,6 +33764,6 @@ function enumerateInjectedMcpToolNames(groupKeys, opts = {}) {
 	return [...new Set(names)];
 }
 //#endregion
-export { searchWeb as $, DEFAULT_CLAUDE_MODEL_FALLBACKS as $t, trustRepo as A, state as An, getTokenCount as At, TEST_DEFAULT_MODEL as B, hasSupportedBrowserInstalled as Bt, fileLastPromptStore as C, fetchWithTransientRetry as Cn, scoutModel as Ct, repoRoot as D, copilotBaseUrl as Dn, shimDefaultsToXhigh as Dt, repoFingerprint as E, GITHUB_API_BASE_URL as En, workerToolsEnabled as Et, EXPLORE_DEFAULT_MODEL as F, createChatCompletions as Ft, buildEnv as G, CONDENSED_OPERATING_SEQUENCE as Gt, resolveModeDefaults as H, extractTarGzMember as Ht, EXPLORE_DEFAULT_THINKING as I, MAX_RESPONSE_BODY_BYTES as It, toolbeltEnabled as J, ArtifactClient as Jt, availableToolCommands as K, DEFINITION_OF_GREATNESS as Kt, IMPLEMENT_DEFAULT_MODEL as L, readResponseBodyCapped as Lt, resolveSealedGate as M, resolveMcpToolTimeoutMs as Mt, BROWSE_DEFAULT_MODEL as N, pickEndpoint as Nt, stopGateEnabledForRepo as O, copilotHeaders as On, countTokens as Ot, DEFAULT_MODEL as P, createResponses as Pt, assetFor as Q, toolbeltPathOverride as Qt, PLAN_DEFAULT_MODEL as R, parseJsonOrDiagnose as Rt, fileFindingsStore as S, getGitHubUser as Sn, reviewerModel as St, isSubagentContext as T, forwardError as Tn, standInToolEnabled as Tt, resolveWorkerRunOpts as U, extractZipMember as Ut, appendPlanReminder as V, provisionAndIndexColbert as Vt, runWorkerAgent as W, warmTreeSitterPool as Wt, vscodeRipgrepPath as X, buildWorkspaceHeaderJson as Xt, toolbeltSkipSet as Y, buildWorkspaceHeaderHelperCommand as Yt, TOOLBELT_TOOLS$1 as Z, collapsePathKeys as Zt, stopGateDisabled as _, isNullish as _n, browserCompoundToolsEnabled as _t, buildPeerAwarenessSnippet as a, generateRandomPort as an, buildAnthropicErrorEvent as at, stopReviewEnabled as b, sleep$3 as bn, geminiAvailable as bt, personasFor as c, withInstallLock as cn, logStreamError as ct, buildStopHookCommand as d, setupGitHubToken as dn, handleMcpDelete as dt, DEFAULT_CODEX_MODEL as en, ADVISOR_INTERNAL_TOOL_NAME as et, captureLaunchBaseline as f, tryRefreshAndRetry as fn, handleMcpPost as ft, launchBaselineKey as g, filterBetaHeader as gn, browseAgentEnabled as gt, injectStopHookIntoSettingsFile as h, cacheVSCodeVersion as hn, brainstormModel as ht, buildAgentPrompt as i, UPSTREAM_INACTIVITY_TIMEOUT_MS as in, isAdvisorRequested as it, liveExec as j, assembleResponsesPayload as jt, stopReviewStateDir as k, githubHeaders as kn, createMessages as kt, buildArtifactOpenHookCommand as l, setupCopilotToken as ln, readIteratorWithTimeout as lt, fileBlockBudget as m, cacheModels as mn, artifactToolsEnabled as mt, MCP_GROUPS as n, DEFAULT_PORT as nn, buildAdvisorStream as nt, buildPeerAwarenessSummary as o, pickClaudeDefault as on, buildOpenAIErrorEvent as ot, decideStopHook as p, cacheCopilotVersion as pn, agentToolsEnabled as pt, buildToolbeltAwareness as q, shouldUseInsecureTls as qt, assertMcpToolSurfaceConsistent as r, UPSTREAM_FETCH_TIMEOUT_MS as rn, injectAdvisorTool as rt, enumerateInjectedMcpToolNames as s, getPackageVersion as sn, isControllerClosedError as st, GROUP_META as t, DEFAULT_CODEX_MODEL_FALLBACKS as tn, ADVISOR_TOOL_INSTRUCTIONS as tt, buildSessionBindHookCommand as u, setupGitHubAgentToken as un, relayAnthropicStream as ut, stopGateId as v, resolveCodexModel as vn, browserToolsEnabled as vt, fileReviewDebounce as w, HTTPError as wn, scribeModel as wt, fileBaselineStore as x, getModels as xn, nativeSubagentModel as xt, stopGatePlanMode as y, resolveModel as yn, fleetToolsEnabled as yt, REVIEW_DEFAULT_MODEL as z, provisionBrowserAssets as zt };
+export { scoutModel as $, ADVISOR_INTERNAL_TOOL_NAME as A, UPSTREAM_FETCH_TIMEOUT_MS as At, relayAnthropicStream as B, buildToolbeltAwareness as C, shouldUseInsecureTls as Ct, TOOLBELT_TOOLS$1 as D, DEFAULT_CODEX_MODEL as Dt, vscodeRipgrepPath as E, DEFAULT_CLAUDE_MODEL_FALLBACKS as Et, buildAnthropicErrorEvent as F, brainstormModel as G, handleMcpPost as H, buildOpenAIErrorEvent as I, browserToolsEnabled as J, browseAgentEnabled as K, isControllerClosedError as L, buildAdvisorStream as M, generateRandomPort as Mt, injectAdvisorTool as N, pickClaudeDefault as Nt, assetFor as O, DEFAULT_CODEX_MODEL_FALLBACKS as Ot, isAdvisorRequested as P, withInstallLock as Pt, reviewerModel as Q, logStreamError as R, availableToolCommands as S, DEFINITION_OF_GREATNESS as St, toolbeltSkipSet as T, toolbeltPathOverride as Tt, agentToolsEnabled as U, handleMcpDelete as V, artifactToolsEnabled as W, geminiAvailable as X, fleetToolsEnabled as Y, nativeSubagentModel as Z, appendPlanReminder as _, provisionAndIndexColbert as _t, buildPeerAwarenessSnippet as a, createMessages as at, runWorkerAgent as b, warmTreeSitterPool as bt, personasFor as c, resolveMcpToolTimeoutMs as ct, EXPLORE_DEFAULT_MODEL as d, createChatCompletions as dt, scribeModel as et, EXPLORE_DEFAULT_THINKING as f, MAX_RESPONSE_BODY_BYTES as ft, TEST_DEFAULT_MODEL as g, hasSupportedBrowserInstalled as gt, REVIEW_DEFAULT_MODEL as h, provisionBrowserAssets as ht, buildAgentPrompt as i, countTokens as it, ADVISOR_TOOL_INSTRUCTIONS as j, UPSTREAM_INACTIVITY_TIMEOUT_MS as jt, searchWeb as k, DEFAULT_PORT as kt, BROWSE_DEFAULT_MODEL as l, pickEndpoint as lt, PLAN_DEFAULT_MODEL as m, parseJsonOrDiagnose as mt, MCP_GROUPS as n, workerToolsEnabled as nt, buildPeerAwarenessSummary as o, getTokenCount as ot, IMPLEMENT_DEFAULT_MODEL as p, readResponseBodyCapped as pt, browserCompoundToolsEnabled as q, assertMcpToolSurfaceConsistent as r, shimDefaultsToXhigh as rt, enumerateInjectedMcpToolNames as s, assembleResponsesPayload as st, GROUP_META as t, standInToolEnabled as tt, DEFAULT_MODEL as u, createResponses as ut, resolveModeDefaults as v, extractTarGzMember as vt, toolbeltEnabled as w, collapsePathKeys as wt, buildEnv as x, CONDENSED_OPERATING_SEQUENCE as xt, resolveWorkerRunOpts as y, extractZipMember as yt, readIteratorWithTimeout as z };
 
-//# sourceMappingURL=peer-mcp-personas-BvommiSI.js.map
+//# sourceMappingURL=peer-mcp-personas-BPl6_V2A.js.map