github-router 0.3.257 → 0.3.261

package/dist/{peer-mcp-personas-ByulAXNm.js → peer-mcp-personas-V4AXhm9B.js}

@@ -1,13 +1,13 @@
 import { t as getPackageVersion } from "./version-_Q1WpsQp.js";
-import { t as PATHS } from "./paths-C1cLZ7Ga.js";
-import { C as copilotHeaders, E as githubAgentHeaders, O as state, S as copilotBaseUrl, T as githubAgentGraphQLHeaders, _ as withTransientRetry, b as GITHUB_API_BASE_URL, d as resolveModel, f as sleep$2, g as fetchWithTransientRetry, h as isAllowedCopilotHost, i as tryRefreshAndRetry, v as HTTPError, w as copilotVersion, x as GITHUB_GRAPHQL_URL } from "./token-R2ocFC3M.js";
+import { t as PATHS } from "./paths-BXrbboAS.js";
+import { C as copilotHeaders, E as githubAgentHeaders, O as state, S as copilotBaseUrl, T as githubAgentGraphQLHeaders, _ as withTransientRetry, b as GITHUB_API_BASE_URL, d as resolveModel, f as sleep$2, g as fetchWithTransientRetry, h as isAllowedCopilotHost, i as tryRefreshAndRetry, v as HTTPError, w as copilotVersion, x as GITHUB_GRAPHQL_URL } from "./token-DWknHe9M.js";
 import { a as resolveExecutable, c as runManagedExeCapture, i as parseIntEnv, r as parseBoolEnv } from "./exec-DTO2oin0.js";
-import { i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-DD88ka3f.js";
+import { i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-DjC9tC1A.js";
 import { t as MCP_WORKSPACE_HEADER } from "./mcp-workspace-header-CGJbNeHb.js";
 import { n as ArtifactError, r as applyInsecureTls, t as ArtifactClient } from "./client-CQMfroGV.js";
-import { n as isPidAlive, o as trackChild, r as registerColbertExitHandlers, t as getColbertInstanceUuid } from "./lifecycle-Byw5s1G8.js";
-import { h as runGateChecks, m as sealedGateIds, p as resolveSealedGate } from "./stop-gate-hook-DQc2KV7B.js";
-import { t as liveExec } from "./orchestration-hRU4TdWr.js";
+import { n as isPidAlive, r as registerColbertExitHandlers, s as trackChild, t as getColbertInstanceUuid } from "./lifecycle-Bd1Fyf4B.js";
+import { h as runGateChecks, m as sealedGateIds, p as resolveSealedGate } from "./stop-gate-hook-DoYD9Wt8.js";
+import { t as liveExec } from "./orchestration-BiZviyam.js";
 import { createRequire } from "node:module";
 import consola from "consola";
 import { chmodSync, closeSync, constants, cpSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
@@ -95,6 +95,74 @@ async function tryCreateLock(p) {
 	}
 }
 //#endregion
+//#region src/lib/one-m-context.ts
+/**
+* Context-window threshold at which Claude Code's `[1m]` accounting unlock is
+* worth requesting. Shared by `pickClaudeDefault` (`./port`), the gateway
+* picker-row seed (`./server-setup`), and the native-subagent frontmatter
+* builder (`./codex-mcp-config`) so the three cannot drift apart.
+*/
+const ONE_M_TOKENS = 1e6;
+/**
+* Whether the live Copilot catalog advertises a >=1M context window for this
+* exact model id.
+*
+* Exact-id match only — no slug translation, no family inference. Every caller
+* already holds a concrete catalog id (the seeded picker rows and the resolved
+* per-agent models both come from a catalog walk), and an inferred match could
+* silently attach `[1m]` to a sibling that does not serve 1M. `pickClaudeDefault`
+* keeps its own version-anchored regex scan because it resolves a FAMILY
+* (`opus-4.7` may ship as a `-1m` sibling slug), which is a different question.
+*
+* Returns false when the catalog is unavailable, so a thin or not-yet-populated
+* catalog degrades to bare ids (Claude Code then accounts at its 200K default —
+* under-accounting, never overflow).
+*/
+function catalogAdvertises1M(id) {
+	const models = state.models?.data;
+	if (!models) return false;
+	return (models.find((m) => m.id === id)?.capabilities?.limits?.max_context_window_tokens ?? 0) >= ONE_M_TOKENS;
+}
+/**
+* True when the user has opted out of 1M context accounting (HIPAA and similar
+* data-retention regimes).
+*
+* Deliberately PRESENCE-based rather than parsed as a boolean, because this
+* mirrors Claude Code's own gate verbatim — its `has1mContext` helper is
+* `if (process.env.CLAUDE_CODE_DISABLE_1M_CONTEXT) return false` over a raw env
+* read, so a literal `"0"` disables 1M there. Parsing it as a boolean here would
+* make the proxy attach a bracket that Claude Code then ignores: the decoration
+* and the accounting must agree in every case, so we match the quirk instead of
+* fixing it on one side only. An empty string is falsy in both.
+*/
+function oneMContextDisabled() {
+	return (process.env.CLAUDE_CODE_DISABLE_1M_CONTEXT ?? "") !== "";
+}
+/**
+* Decorate a model id with the `[1m]` literal-bracket suffix iff the catalog
+* says the model serves >=1M context and the user has not opted out.
+*
+* The bracket is Claude Code's local context-accounting unlock. Its detector is
+* `/\[1m\]/i` applied to the model id with NO vendor gate, so it works for the
+* non-Claude gateway models exactly as it does for Opus — verified against the
+* installed 2.1.222 build, where the window resolver returns `1e6` on a bracket
+* match and otherwise falls through to a 200K default. Without the bracket a
+* 1M-context model like `gpt-5.6-sol` (1,050,000) is budgeted at 200K and
+* auto-compacts at roughly a fifth of its real window.
+*
+* The bracket never reaches Copilot: `resolveModel` (`./utils`) strips it before
+* the upstream call, and because the catalog window is >=1M its `resolvedIs1M`
+* check passes, so no spurious downgrade warning fires.
+*
+* Catalog-gating is what keeps this honest for sub-1M models: `gpt-5.3-codex`
+* (400K) and `gpt-5.4-mini` (400K) are left bare, so they keep Claude Code's
+* conservative 200K accounting rather than being over-budgeted into an overflow.
+*/
+function withOneMSuffix(id) {
+	if (oneMContextDisabled()) return id;
+	return catalogAdvertises1M(id) ? `${id}[1m]` : id;
+}
+//#endregion
 //#region src/lib/port.ts
 const DEFAULT_PORT = 8787;
 const DEFAULT_CLAUDE_MODEL_FALLBACKS = [
@@ -152,7 +220,6 @@ const DEFAULT_CLAUDE_MODEL_FALLBACKS = [
 * variant" — defaulting safe-side preserves the pre-change behavior).
 */
 const DEFAULT_OPUS_FAMILY = "5";
-const ONE_M_TOKENS = 1e6;
 function pickClaudeDefault(opusFamily = DEFAULT_OPUS_FAMILY) {
 	const dotted = opusFamily.replace(/-/g, ".");
 	const bareSlug = `claude-opus-${dotted.replace(/\./g, "-")}`;
@@ -15238,7 +15305,7 @@ const BUILD_SPAWN_GRACE_MS = 3e4;
 * route). A stable sha256-prefix of the canonical path is sufficient.
 */
 function metaHashForWorkspace(workspace) {
-	const canonical = process$1.platform === "win32" ? path.resolve(workspace).toLowerCase().replace(/\\/g, "/") : path.resolve(workspace);
+	const canonical = canonicalWorkspace(workspace);
 	let h = 2166136261;
 	for (let i = 0; i < canonical.length; i++) {
 		h ^= canonical.charCodeAt(i);
@@ -15250,11 +15317,79 @@ function metaPath(workspace) {
 	return path.join(PATHS.COLBERT_META_DIR, `${metaHashForWorkspace(workspace)}.json`);
 }
 /** Read the sidecar metadata for a workspace (null if none yet). */
+/**
+* Bump this when a router-side bug could have written a failure verdict that
+* was never the workspace's fault. A sidecar stamped with an older epoch gets
+* its watchdog-attributed streak cleared ONCE, then is stamped forward.
+*
+* Epoch 1: the fail-safe-probe fix. Before it, `indexDirSignature` could not
+* match colgrep's Windows extended-length `project_path`, so the inactivity
+* watchdog killed healthy builds and recorded `stuck` — which is refused
+* forever at a cap of 2. Those users are still capped after upgrading,
+* because the existing reset triggers on git/model/engine inputs and none of
+* those changed. This is the only thing that un-sticks them.
+* Epoch 2: widened to include `corrupt`, once it became clear the identity
+* bug MANUFACTURED corrupt verdicts (a null project-dir lookup was recorded
+* as corruption).
+*
+* Epoch 3: clearing the streak was not enough — `freshnessVerdict` returns
+* `failed` straight off `meta.status`, before it looks at the disk, so a
+* zeroed counter still short-circuited every query. The reset now drops the
+* status as well.
+*/
+const WATCHDOG_EPOCH = 3;
+/**
+* Failure classes the router-side bugs could have manufactured.
+*
+* `stuck`/`crashed` came from the blind watchdog. `corrupt` belongs here too,
+* which is not obvious: `repairCorruptIndex` recorded `failureClass:"corrupt"`
+* whenever `colbertProjectDir` returned null, and a null lookup is exactly
+* what the identity bug produced for a perfectly healthy index. So a stored
+* `corrupt` is not reliable evidence about the workspace — it may be evidence
+* about us. Observed on the machine where this was diagnosed: a `corrupt`
+* marker sitting next to an index that validates as coherent with 15 shards
+* and 1.24M embeddings.
+*
+* Clearing it is safe because it only resets the STREAK. The next query still
+* re-derives the verdict from the shards on disk, so an index that really is
+* corrupt is re-detected immediately and quarantined as before.
+*
+* `launch` stays excluded: a spawn failure (missing binary, unrunnable ORT)
+* is genuinely about the environment, and the existing engine-sha reset
+* already covers the case where an upgrade fixes it.
+*/
+const EPOCH_CLEARABLE = /* @__PURE__ */ new Set([
+	"stuck",
+	"crashed",
+	"corrupt"
+]);
+/**
+* Clear a stale failure streak that a router-side bug produced.
+*
+* Bounded by construction: it fires only while the stored epoch is behind,
+* and the caller stamps the current epoch on the next write, so it is one
+* reset per epoch bump rather than a reset loop.
+*/
+function applyWatchdogEpoch(meta) {
+	if ((meta.watchdogEpoch ?? 0) >= WATCHDOG_EPOCH) return meta;
+	if (!(meta.status === "failed" && meta.failureClass !== void 0 && EPOCH_CLEARABLE.has(meta.failureClass))) return {
+		...meta,
+		watchdogEpoch: WATCHDOG_EPOCH
+	};
+	return {
+		...meta,
+		watchdogEpoch: WATCHDOG_EPOCH,
+		status: "ready",
+		failureClass: void 0,
+		failedAttempts: 0,
+		failedAt: void 0
+	};
+}
 async function readColbertMeta(workspace) {
 	try {
 		const raw = await fs$1.readFile(metaPath(workspace), "utf8");
 		const parsed = JSON.parse(raw);
-		if (parsed && typeof parsed === "object" && typeof parsed.status === "string") return parsed;
+		if (parsed && typeof parsed === "object" && typeof parsed.status === "string") return applyWatchdogEpoch(parsed);
 		return null;
 	} catch {
 		return null;
@@ -15279,9 +15414,13 @@ async function writeColbertMeta(meta) {
 async function writeColbertMetaUnchained(meta) {
 	await fs$1.mkdir(PATHS.COLBERT_META_DIR, { recursive: true });
 	const dest = metaPath(meta.workspace);
+	const stamped = {
+		...meta,
+		watchdogEpoch: WATCHDOG_EPOCH
+	};
 	const tmp = `${dest}.${process$1.pid}.${Math.random().toString(16).slice(2, 10)}.tmp`;
 	try {
-		await fs$1.writeFile(tmp, JSON.stringify(meta, null, 2));
+		await fs$1.writeFile(tmp, JSON.stringify(stamped, null, 2));
 		await fs$1.rename(tmp, dest);
 	} catch (err) {
 		await fs$1.rm(tmp, { force: true }).catch(() => {});
@@ -15380,17 +15519,112 @@ async function completedIndexOnDisk(workspace) {
 	if (!projectDir) return false;
 	return validateIndexIntegrity(path.join(projectDir, "index")).verdict !== "not-built";
 }
-function canonicalForCompare(p) {
-	return process$1.platform === "win32" ? path.resolve(p).toLowerCase().replace(/\\/g, "/") : path.resolve(p);
+/**
+* Strip a Windows extended-length prefix.
+*
+* `\\?\Q:\dir` → `Q:\dir`, and `\\?\UNC\server\share` → `\\server\share`
+* (naively slicing 4 there would yield the relative `UNC\server\share`).
+* colgrep stores `project_path` in this form — 50 of 53 dirs on the machine
+* where this was diagnosed — so every comparison against its `project.json`
+* has to account for it.
+*/
+function stripExtendedPrefix(p) {
+	if (p.startsWith("\\\\?\\UNC\\")) return `\\\\${p.slice(8)}`;
+	if (p.startsWith("\\\\?\\")) return p.slice(4);
+	return p;
 }
-/** Sync realpath-aware canonicalization (sibling of `realpathForCompare`,
-* for the on-a-timer inactivity probe which must be synchronous). */
-function canonicalRealpathSync(p) {
+/**
+* Is the volume holding `p` case-insensitive?
+*
+* Probed at runtime rather than inferred from `process.platform`, because
+* the platform is wrong in both directions: APFS can be formatted
+* case-SENSITIVE (folding there merges two genuinely distinct workspaces),
+* and Linux routinely mounts case-INSENSITIVE volumes such as exfat/NTFS
+* (not folding there splits one workspace into two identities).
+*
+* Cheap and memoized per filesystem root: stat the path back through a
+* case-flipped spelling of its own basename. Falls back to the platform
+* default only when the probe itself cannot run.
+*/
+const _caseInsensitiveByRoot = /* @__PURE__ */ new Map();
+function volumeIsCaseInsensitive(p) {
+	const root = path.parse(path.resolve(p)).root || path.sep;
+	const cached = _caseInsensitiveByRoot.get(root);
+	if (cached !== void 0) return cached;
+	let result = process$1.platform === "win32" || process$1.platform === "darwin";
+	try {
+		let probe = path.resolve(p);
+		for (let i = 0; i < 64 && !existsSync(probe); i++) {
+			const parent = path.dirname(probe);
+			if (parent === probe) break;
+			probe = parent;
+		}
+		const base = path.basename(probe);
+		if (base && /[a-z]/i.test(base)) {
+			const flipped = base === base.toLowerCase() ? base.toUpperCase() : base.toLowerCase();
+			const sibling = path.join(path.dirname(probe), flipped);
+			result = existsSync(sibling);
+		}
+	} catch {}
+	_caseInsensitiveByRoot.set(root, result);
+	return result;
+}
+/**
+* THE canonical identity for a workspace. Every surface that answers "is this
+* the same workspace?" — the meta sidecar key, the colgrep project-dir lookup,
+* the watchdog signature, the init/search locks, and the argument handed to
+* colgrep — must go through this and nothing else.
+*
+* They previously disagreed four different ways, and the disagreement is what
+* made a healthy index invisible: colgrep writes `\\?\Q:\...`, the lookup
+* normalized it to `//?/q:/...`, and nothing ever matched.
+*
+* Order matters: realpath FIRST (it resolves symlinks — the macOS
+* `/var`→`/private/var` and `/tmp`→`/private/tmp` shapes — expands 8.3 short
+* names, and returns the true on-disk casing), THEN strip any extended-length
+* prefix from the *result*. `realpathSync.native` was measured to already
+* return a clean `Q:\Software\github-router` for all input spellings, so the
+* strip is belt-and-braces rather than load-bearing; it costs nothing and
+* covers the fallback path where realpath could not run at all.
+*/
+function canonicalWorkspace(p) {
+	let out = stripExtendedPrefix(p);
 	try {
-		return canonicalForCompare(realpathSync(p));
+		out = stripExtendedPrefix(realpathSync.native(out));
+	} catch {
+		out = resolveThroughExistingAncestor(out);
+	}
+	out = path.resolve(out);
+	if (volumeIsCaseInsensitive(out)) out = out.toLowerCase();
+	return process$1.platform === "win32" ? out.replaceAll("\\", "/") : out;
+}
+/**
+* Realpath as much of `p` as exists, then re-append the missing tail. Keeps a
+* not-yet-created or just-deleted path on the same canonical root as its live
+* self.
+*/
+function resolveThroughExistingAncestor(p) {
+	const abs = path.resolve(p);
+	const tail = [];
+	let cur = abs;
+	for (let i = 0; i < 64; i++) try {
+		const real = stripExtendedPrefix(realpathSync.native(cur));
+		return tail.length > 0 ? path.join(real, ...tail.reverse()) : real;
 	} catch {
-		return canonicalForCompare(p);
+		const parent = path.dirname(cur);
+		if (parent === cur) break;
+		tail.push(path.basename(cur));
+		cur = parent;
 	}
+	return abs;
+}
+function canonicalForCompare(p) {
+	return canonicalWorkspace(p);
+}
+/** Sync realpath-aware canonicalization. Retained as a named alias so call
+* sites read intentionally; `canonicalWorkspace` already realpaths. */
+function canonicalRealpathSync(p) {
+	return canonicalWorkspace(p);
 }
 /** Recursive (bytes, fileCount) of a directory; sync + best-effort. A
 * colgrep index is a bounded set of shards so the walk stays small. */
@@ -15416,23 +15650,13 @@ function dirSizeSync(dir) {
 	}
 	return [bytes, count];
 }
-/**
-* (sync) Progress signature of a workspace's colgrep index dir for the init
-* inactivity watchdog: `${totalBytes}:${fileCount}` of the project dir, or
-* `null` if it isn't on disk yet. colgrep is SILENT on a non-TTY pipe
-* during the (potentially multi-hour) encode phase, so output is useless as
-* a progress signal — but it writes index shards incrementally, so a
-* changing signature means "still progressing" and a frozen one means
-* "hung". Successive signatures drive the watchdog: change ⇒ re-arm, frozen
-* ⇒ kill. Sync because it's called from a `setTimeout` (not awaited).
-*/
 function indexDirSignature(workspace) {
 	const indicesDir = PATHS.COLBERT_INDICES_DIR;
 	let names;
 	try {
 		names = readdirSync(indicesDir);
 	} catch {
-		return null;
+		return { kind: "unknown" };
 	}
 	const want = canonicalRealpathSync(workspace);
 	for (const name of names) {
@@ -15447,10 +15671,14 @@ function indexDirSignature(workspace) {
 		}
 		const projPath = proj.path ?? proj.project_path;
 		if (!projPath || canonicalRealpathSync(projPath) !== want) continue;
+		if (proj.model !== canonicalColbertModelDir()) continue;
 		const [bytes, count] = dirSizeSync(dir);
-		return `${bytes}:${count}`;
+		return {
+			kind: "observed",
+			signature: `${bytes}:${count}`
+		};
 	}
-	return null;
+	return { kind: "not-created" };
 }
 /**
 * Realpath-aware canonicalization for matching a workspace against
@@ -15460,11 +15688,7 @@ function indexDirSignature(workspace) {
 * when realpath fails (path doesn't exist yet).
 */
 async function realpathForCompare(p) {
-	try {
-		return canonicalForCompare(await fs$1.realpath(p));
-	} catch {
-		return canonicalForCompare(p);
-	}
+	return canonicalWorkspace(p);
 }
 /**
 * Compute the freshness verdict for a query against a workspace.
@@ -15680,18 +15904,13 @@ function envIntMs(name, fallback) {
 */
 function makeIndexProgressProbe(workspace) {
 	let lastSig;
-	let nullStreak = 0;
 	return () => {
-		const sig = indexDirSignature(workspace);
-		if (sig === null) {
-			nullStreak += 1;
-			return nullStreak <= 1;
-		}
-		nullStreak = 0;
+		const p = indexDirSignature(workspace);
+		if (p.kind !== "observed") return true;
 		const prev = lastSig;
-		lastSig = sig;
+		lastSig = p.signature;
 		if (prev === void 0) return true;
-		return sig !== prev;
+		return p.signature !== prev;
 	};
 }
 /** Workspaces with a DETACHED indexing search in flight. A new search for
@@ -15742,10 +15961,18 @@ async function runSemanticSearch(opts) {
 		case "failed": return handleFailure(workspace, fresh.meta, false);
 		case "crashed": return handleFailure(workspace, fresh.meta, true);
 		case "corrupt": return repairCorruptIndex(workspace, fresh.meta);
-		case "building": return {
-			status: "building",
-			notice: "semantic index is being built for this workspace; retry shortly (or use code_search now)"
-		};
+		case "building":
+			if (!isInitInFlight(workspace) && !await completedIndexOnDisk(workspace)) {
+				kickBackgroundInit(workspace);
+				return {
+					status: "building",
+					notice: "semantic index build was interrupted; a rebuild was started — retry shortly (or use code_search now)"
+				};
+			}
+			return {
+				status: "building",
+				notice: "semantic index is being built for this workspace; retry shortly (or use code_search now)"
+			};
 		case "stale":
 			kickBackgroundInit(workspace);
 			return {
@@ -15804,6 +16031,13 @@ async function repairCorruptIndex(workspace, meta) {
 		status: "failed",
 		failureClass: "corrupt",
 		failedAttempts: attempts,
+		failedAt: {
+			head: meta?.lastIndexedHead,
+			dirty: meta?.lastIndexedDirty,
+			binarySha: colgrepBinAsset()?.sha256,
+			ortSha: ortLibAsset()?.sha256,
+			modelRev: MODEL_REVISION
+		},
 		lastIndexedAt: (/* @__PURE__ */ new Date()).toISOString(),
 		lastIndexedHead: meta?.lastIndexedHead,
 		lastIndexedDirty: meta?.lastIndexedDirty,
@@ -15814,7 +16048,14 @@ async function repairCorruptIndex(workspace, meta) {
 		notice: "semantic index was found corrupt but a writer is still active; returned results are disabled until it exits"
 	};
 	const projectDir = await colbertProjectDir(workspace);
-	if (!projectDir) return handleFailure(workspace, failedMeta, false);
+	if (!projectDir) {
+		kickBackgroundInit(workspace);
+		return {
+			status: "unavailable",
+			isError: true,
+			notice: "no semantic index for this workspace yet — a background index was started; retry shortly or use code_search"
+		};
+	}
 	if (!await quarantineProjectDir(projectDir)) {
 		await writeColbertMeta(failedMeta).catch(() => {});
 		return {
@@ -15831,10 +16072,69 @@ async function repairCorruptIndex(workspace, meta) {
 		notice: attempts < 2 ? "semantic index was found corrupt and quarantined; a clean rebuild was started — retry mode:\"semantic\" shortly" : "semantic index repeatedly failed integrity checks; automatic rebuild is capped — do NOT retry mode:\"semantic\", use lexical search with specific symbol/keyword terms and see proxy logs"
 	};
 }
+/**
+* True when the inputs that produced the recorded failure streak differ from
+* the inputs in effect now — i.e. the streak is stale evidence and must not
+* veto a fresh attempt.
+*
+* Each signal answers "could this plausibly have fixed the cause?":
+*   - engine/runtime sha: a colgrep or ONNX-runtime upgrade may fix the exact
+*     bug that failed. Precedent: `freshnessVerdict` already forces a rebuild
+*     on an engine-sha change for the same reason.
+*   - model revision: a different embedding model is a different build.
+*   - corpus identity: HEAD moved OR the working tree's dirty-state changed.
+*     BOTH are needed — HEAD-only misses the most common local recovery
+*     (fixing a malformed file without committing), and dirty-only misses a
+*     branch switch.
+*
+* A legacy entry with no `failedAt` (written before this field existed) has no
+* baseline to compare, so it does NOT reset — it keeps today's behavior until
+* its next failure stamps one. That is the conservative direction: a missing
+* baseline must not read as "everything changed".
+*/
+function failureInputsChanged(meta, git) {
+	const at = meta?.failedAt;
+	if (!at) return false;
+	const binarySha = colgrepBinAsset()?.sha256;
+	const ortSha = ortLibAsset()?.sha256;
+	if (at.binarySha !== void 0 && binarySha !== void 0 && at.binarySha !== binarySha) return true;
+	if (at.ortSha !== void 0 && ortSha !== void 0 && at.ortSha !== ortSha) return true;
+	if (at.modelRev !== void 0 && at.modelRev !== "07ef20f406c86badca122464808f4cac2f6e4b25") return true;
+	if (at.head !== void 0 && git.head !== void 0 && at.head !== git.head) return true;
+	if (at.dirty !== void 0 && git.dirty !== void 0 && at.dirty !== git.dirty) return true;
+	return false;
+}
 async function handleFailure(workspace, meta, crashedVerdict) {
 	const cls = crashedVerdict ? "crashed" : meta?.failureClass ?? "error";
-	const attempts = crashedVerdict ? (meta?.failedAttempts ?? 0) + 1 : meta?.failedAttempts ?? 1;
 	const lastAt = meta?.lastIndexedAt;
+	const lastMs = lastAt ? Date.parse(lastAt) : NaN;
+	const backoffElapsed = !Number.isFinite(lastMs) || Date.now() - lastMs >= FAILED_RETRY_BACKOFF_MS;
+	const at = meta?.failedAt;
+	if (failureInputsChanged(meta, at?.head !== void 0 || at?.dirty !== void 0 ? await gitState(workspace).catch(() => ({})) : {})) {
+		consola.warn(`colbert: index inputs changed since the last failure (class=${cls}); clearing the failure streak${backoffElapsed ? " and retrying" : ""} for ${workspace}`);
+		await writeColbertMeta({
+			workspace,
+			model: meta?.model ?? "LateOn-Code-edge",
+			modelRev: meta?.modelRev ?? "07ef20f406c86badca122464808f4cac2f6e4b25",
+			binarySha: meta?.binarySha,
+			ortSha: meta?.ortSha,
+			status: "failed",
+			failureClass: meta?.failureClass,
+			failedAttempts: 0,
+			failedAt: void 0,
+			lastIndexedAt: meta?.lastIndexedAt,
+			lastIndexedHead: meta?.lastIndexedHead,
+			lastIndexedDirty: meta?.lastIndexedDirty,
+			ownerInstanceId: getColbertInstanceUuid()
+		}).catch(() => {});
+		if (backoffElapsed) kickBackgroundInit(workspace);
+		return {
+			status: "failed",
+			isError: true,
+			notice: backoffElapsed ? "semantic index unavailable; inputs changed since the last failure so a rebuild was started — retry mode:\"semantic\" shortly, or use code_search with specific symbol/keyword terms now" : "semantic index unavailable (recent build failure); a rebuild is pending — retry mode:\"semantic\" shortly, or use code_search with specific symbol/keyword terms now"
+		};
+	}
+	const attempts = crashedVerdict ? (meta?.failedAttempts ?? 0) + 1 : meta?.failedAttempts ?? 1;
 	if (crashedVerdict) await writeColbertMeta({
 		workspace,
 		model: meta?.model ?? "LateOn-Code-edge",
@@ -15842,14 +16142,19 @@ async function handleFailure(workspace, meta, crashedVerdict) {
 		status: "failed",
 		failureClass: "crashed",
 		failedAttempts: attempts,
+		failedAt: {
+			head: meta?.lastIndexedHead,
+			dirty: meta?.lastIndexedDirty,
+			binarySha: meta?.binarySha ?? colgrepBinAsset()?.sha256,
+			ortSha: meta?.ortSha ?? ortLibAsset()?.sha256,
+			modelRev: MODEL_REVISION
+		},
 		lastIndexedAt: lastAt ?? (/* @__PURE__ */ new Date()).toISOString(),
 		lastIndexedHead: meta?.lastIndexedHead,
 		lastIndexedDirty: meta?.lastIndexedDirty,
 		ownerInstanceId: getColbertInstanceUuid()
 	}).catch(() => {});
 	const cap = cls === "stuck" || cls === "corrupt" ? 2 : MAX_FAILED_ATTEMPTS;
-	const lastMs = lastAt ? Date.parse(lastAt) : NaN;
-	const backoffElapsed = !Number.isFinite(lastMs) || Date.now() - lastMs >= FAILED_RETRY_BACKOFF_MS;
 	if (attempts < cap && backoffElapsed) {
 		kickBackgroundInit(workspace);
 		consola.debug(`colbert: re-kicking index (class=${cls}, attempt=${attempts}/${cap})`);
@@ -15864,11 +16169,11 @@ async function handleFailure(workspace, meta, crashedVerdict) {
 		isError: true,
 		notice: "semantic index unavailable (recent build failure); retry mode:\"semantic\" shortly, or use code_search with specific symbol/keyword terms now"
 	};
-	consola.debug(`colbert: index ${cls}, giving up (attempts=${attempts})`);
+	consola.warn(`colbert: index ${cls}, giving up (attempts=${attempts}) for ${workspace}`);
 	return {
 		status: "failed",
 		isError: true,
-		notice: `semantic index keeps failing (${cls}); use code_search. See logs; for a very large repo raise GH_ROUTER_COLBERT_INIT_STALL_MS / GH_ROUTER_COLBERT_INIT_TIMEOUT_MS`
+		notice: `semantic index unavailable (${cls}); use code_search with specific symbol/keyword terms`
 	};
 }
 async function spawnSearch(opts) {
@@ -16070,6 +16375,10 @@ function kickBackgroundInit(workspace) {
 		releaseInit(workspace);
 		consola.error("colbert: background init failed:", err);
 		const prior = await readColbertMeta(workspace);
+		const g = await gitState(workspace).catch(() => ({
+			head: void 0,
+			dirty: void 0
+		}));
 		await writeColbertMeta({
 			workspace,
 			model: prior?.model ?? "LateOn-Code-edge",
@@ -16079,6 +16388,13 @@ function kickBackgroundInit(workspace) {
 			status: "failed",
 			failureClass: "launch",
 			failedAttempts: (prior?.failedAttempts ?? 0) + 1,
+			failedAt: {
+				head: g.head,
+				dirty: g.dirty,
+				binarySha: colgrepBinAsset()?.sha256,
+				ortSha: ortLibAsset()?.sha256,
+				modelRev: MODEL_REVISION
+			},
 			lastIndexedAt: (/* @__PURE__ */ new Date()).toISOString(),
 			lastIndexedHead: prior?.lastIndexedHead,
 			lastIndexedDirty: prior?.lastIndexedDirty,
@@ -16172,7 +16488,8 @@ async function runInit(workspace) {
 		buildPid: void 0,
 		ownerInstanceId: getColbertInstanceUuid(),
 		lastIndexedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		failedAttempts: prior?.failedAttempts ?? 0
+		failedAttempts: prior?.failedAttempts ?? 0,
+		failedAt: prior?.failedAt
 	};
 	try {
 		const g = await gitState(workspace);
@@ -16244,10 +16561,18 @@ async function runInit(workspace) {
 	if (ok) {
 		finalMeta.failedAttempts = 0;
 		finalMeta.failureClass = void 0;
+		finalMeta.failedAt = void 0;
 	} else {
 		finalMeta.failureClass = failureClass;
 		finalMeta.failedAttempts = (prior?.failedAttempts ?? 0) + 1;
-		consola.debug(`colbert: init ${failureClass} after ${Math.round(elapsedMs / 1e3)}s (attempt ${finalMeta.failedAttempts}) for ${workspace}`);
+		finalMeta.failedAt = {
+			head: finalMeta.lastIndexedHead,
+			dirty: finalMeta.lastIndexedDirty,
+			binarySha: finalMeta.binarySha,
+			ortSha: finalMeta.ortSha,
+			modelRev: finalMeta.modelRev
+		};
+		consola.warn(`colbert: init ${failureClass} after ${Math.round(elapsedMs / 1e3)}s (attempt ${finalMeta.failedAttempts}) for ${workspace}`);
 	}
 	await writeColbertMeta(finalMeta).catch(() => {});
 }
@@ -16324,6 +16649,36 @@ async function provisionAndIndexColbert(opts = {}) {
 		consola.debug("colbert: cwd git-detect skipped:", err);
 	}
 }
+/**
+* One-line operator warning when this workspace's semantic index is sitting in
+* a terminal `failed` state, or `null` when there is nothing to say.
+*
+* This exists because the failure mode that motivated it was SILENCE: semantic
+* search degraded to lexical on a real repo for an unknown period — possibly
+* weeks — and nobody noticed, because the only signals were a `notice` string
+* the model reads and a `consola.debug` the file logger drops. Neither reaches
+* a human. The launcher writes this to stderr next to the readiness line so a
+* degraded capability is visible at the moment the user starts a session.
+*
+* `logsToFile` says where the failure detail actually went. `claude` and
+* `codex` call `enableFileLogging()`, which redirects warnings to
+* ERROR_LOG_PATH; `start` does not, so its warnings stay on the terminal and
+* pointing at the file would send the operator to a stale or absent one.
+*
+* Deliberately advisory and best-effort: lexical search still works, so this
+* must never block or fail a launch.
+*/
+async function colbertDegradedWarning(cwd, opts = {}) {
+	if (!semanticSearchOptedIn()) return null;
+	try {
+		const meta = await readColbertMeta(cwd ?? process$1.cwd());
+		if (!meta || meta.status !== "failed") return null;
+		const cls = meta.failureClass ?? "error";
+		return `Semantic search DEGRADED for this workspace (colbert: ${cls}) — lexical code search still works. ${opts.logsToFile ? `See ${PATHS.ERROR_LOG_PATH}` : "See the proxy log output"}.${cls === "stuck" ? " For a very large repo, raise GH_ROUTER_COLBERT_INIT_STALL_MS / GH_ROUTER_COLBERT_INIT_TIMEOUT_MS." : ""}`;
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/lib/unified-code-search.ts
 /**
@@ -18005,7 +18360,7 @@ function logAudit$1(record) {
 		try {
 			const fs = await import("node:fs/promises");
 			const path = await import("node:path");
-			const { PATHS } = await import("./paths-CwKwc2pi.js");
+			const { PATHS } = await import("./paths-Dz1WyRJG.js");
 			const dir = path.join(PATHS.APP_DIR, "browser-mcp");
 			await fs.mkdir(dir, { recursive: true });
 			const line = JSON.stringify({
@@ -33788,6 +34143,6 @@ function enumerateInjectedMcpToolNames(groupKeys, opts = {}) {
 	return [...new Set(names)];
 }
 //#endregion
-export { reviewerModel as $, searchWeb as A, DEFAULT_PORT as At, readIteratorWithTimeout as B, buildToolbeltAwareness as C, DEFINITION_OF_GREATNESS as Ct, TOOLBELT_TOOLS$1 as D, DEFAULT_CLAUDE_MODEL_FALLBACKS as Dt, vscodeRipgrepPath as E, toolbeltPathOverride as Et, isAdvisorRequested as F, withInstallLock as Ft, artifactToolsEnabled as G, handleMcpDelete as H, buildAnthropicErrorEvent as I, browserCompoundToolsEnabled as J, brainstormModel as K, buildOpenAIErrorEvent as L, ADVISOR_TOOL_INSTRUCTIONS as M, UPSTREAM_INACTIVITY_TIMEOUT_MS as Mt, buildAdvisorStream as N, generateRandomPort as Nt, assetFor as O, DEFAULT_CODEX_MODEL as Ot, injectAdvisorTool as P, pickClaudeDefault as Pt, nativeSubagentModel as Q, isControllerClosedError as R, availableToolCommands as S, CONDENSED_OPERATING_SEQUENCE as St, toolbeltSkipSet as T, collapsePathKeys as Tt, handleMcpPost as U, relayAnthropicStream as V, agentToolsEnabled as W, fleetToolsEnabled as X, browserToolsEnabled as Y, geminiAvailable as Z, appendPlanReminder as _, hasSupportedBrowserInstalled as _t, buildPeerAwarenessSnippet as a, countTokens as at, runWorkerAgent as b, extractZipMember as bt, personasFor as c, assembleResponsesPayload as ct, EXPLORE_DEFAULT_MODEL as d, createResponses as dt, scoutModel as et, EXPLORE_DEFAULT_THINKING as f, createChatCompletions as ft, TEST_DEFAULT_MODEL as g, provisionBrowserAssets as gt, REVIEW_DEFAULT_MODEL as h, parseJsonOrDiagnose as ht, buildAgentPrompt as i, shimDefaultsToXhigh as it, ADVISOR_INTERNAL_TOOL_NAME as j, UPSTREAM_FETCH_TIMEOUT_MS as jt, satisfiesMinVersion as k, DEFAULT_CODEX_MODEL_FALLBACKS as kt, BROWSE_DEFAULT_MODEL as l, resolveMcpToolTimeoutMs as lt, PLAN_DEFAULT_MODEL as m, readResponseBodyCapped as mt, MCP_GROUPS as n, standInToolEnabled as nt, buildPeerAwarenessSummary as o, createMessages as ot, IMPLEMENT_DEFAULT_MODEL as p, MAX_RESPONSE_BODY_BYTES as pt, browseAgentEnabled as q, assertMcpToolSurfaceConsistent as r, workerToolsEnabled as rt, enumerateInjectedMcpToolNames as s, getTokenCount as st, GROUP_META as t, scribeModel as tt, DEFAULT_MODEL as u, pickEndpoint as ut, resolveModeDefaults as v, provisionAndIndexColbert as vt, toolbeltEnabled as w, shouldUseInsecureTls as wt, buildEnv as x, warmTreeSitterPool as xt, resolveWorkerRunOpts as y, extractTarGzMember as yt, logStreamError as z };
+export { reviewerModel as $, searchWeb as A, DEFAULT_CODEX_MODEL_FALLBACKS as At, readIteratorWithTimeout as B, buildToolbeltAwareness as C, CONDENSED_OPERATING_SEQUENCE as Ct, TOOLBELT_TOOLS$1 as D, toolbeltPathOverride as Dt, vscodeRipgrepPath as E, collapsePathKeys as Et, isAdvisorRequested as F, pickClaudeDefault as Ft, artifactToolsEnabled as G, handleMcpDelete as H, buildAnthropicErrorEvent as I, withOneMSuffix as It, browserCompoundToolsEnabled as J, brainstormModel as K, buildOpenAIErrorEvent as L, withInstallLock as Lt, ADVISOR_TOOL_INSTRUCTIONS as M, UPSTREAM_FETCH_TIMEOUT_MS as Mt, buildAdvisorStream as N, UPSTREAM_INACTIVITY_TIMEOUT_MS as Nt, assetFor as O, DEFAULT_CLAUDE_MODEL_FALLBACKS as Ot, injectAdvisorTool as P, generateRandomPort as Pt, nativeSubagentModel as Q, isControllerClosedError as R, availableToolCommands as S, warmTreeSitterPool as St, toolbeltSkipSet as T, shouldUseInsecureTls as Tt, handleMcpPost as U, relayAnthropicStream as V, agentToolsEnabled as W, fleetToolsEnabled as X, browserToolsEnabled as Y, geminiAvailable as Z, appendPlanReminder as _, hasSupportedBrowserInstalled as _t, buildPeerAwarenessSnippet as a, countTokens as at, runWorkerAgent as b, extractTarGzMember as bt, personasFor as c, assembleResponsesPayload as ct, EXPLORE_DEFAULT_MODEL as d, createResponses as dt, scoutModel as et, EXPLORE_DEFAULT_THINKING as f, createChatCompletions as ft, TEST_DEFAULT_MODEL as g, provisionBrowserAssets as gt, REVIEW_DEFAULT_MODEL as h, parseJsonOrDiagnose as ht, buildAgentPrompt as i, shimDefaultsToXhigh as it, ADVISOR_INTERNAL_TOOL_NAME as j, DEFAULT_PORT as jt, satisfiesMinVersion as k, DEFAULT_CODEX_MODEL as kt, BROWSE_DEFAULT_MODEL as l, resolveMcpToolTimeoutMs as lt, PLAN_DEFAULT_MODEL as m, readResponseBodyCapped as mt, MCP_GROUPS as n, standInToolEnabled as nt, buildPeerAwarenessSummary as o, createMessages as ot, IMPLEMENT_DEFAULT_MODEL as p, MAX_RESPONSE_BODY_BYTES as pt, browseAgentEnabled as q, assertMcpToolSurfaceConsistent as r, workerToolsEnabled as rt, enumerateInjectedMcpToolNames as s, getTokenCount as st, GROUP_META as t, scribeModel as tt, DEFAULT_MODEL as u, pickEndpoint as ut, resolveModeDefaults as v, colbertDegradedWarning as vt, toolbeltEnabled as w, DEFINITION_OF_GREATNESS as wt, buildEnv as x, extractZipMember as xt, resolveWorkerRunOpts as y, provisionAndIndexColbert as yt, logStreamError as z };
 
-//# sourceMappingURL=peer-mcp-personas-ByulAXNm.js.map
+//# sourceMappingURL=peer-mcp-personas-V4AXhm9B.js.map