github-router 0.3.263 → 0.3.270

package/dist/{peer-mcp-personas-B22ncnbQ.js → peer-mcp-personas-pWP3Eyt7.js}

@@ -1,13 +1,13 @@
 import { t as getPackageVersion } from "./version-_Q1WpsQp.js";
-import { t as PATHS } from "./paths-BXrbboAS.js";
-import { C as copilotHeaders, E as githubAgentHeaders, O as state, S as copilotBaseUrl, T as githubAgentGraphQLHeaders, _ as withTransientRetry, b as GITHUB_API_BASE_URL, d as resolveModel, f as sleep$2, g as fetchWithTransientRetry, h as isAllowedCopilotHost, i as tryRefreshAndRetry, v as HTTPError, w as copilotVersion, x as GITHUB_GRAPHQL_URL } from "./token-C8Uh7aUe.js";
-import { a as resolveExecutable, c as runManagedExeCapture, i as parseIntEnv, r as parseBoolEnv } from "./exec-DTO2oin0.js";
-import { i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-DjC9tC1A.js";
+import { t as PATHS } from "./paths-Bg1_DWhi.js";
+import { A as state, C as GITHUB_GRAPHQL_URL, D as githubAgentGraphQLHeaders, E as copilotVersion, O as githubAgentHeaders, S as GITHUB_API_BASE_URL, T as copilotHeaders, b as sanitizeTransportText, d as resolveModel, f as sleep$2, g as HTTPError, h as isAllowedCopilotHost, i as tryRefreshAndRetry, v as classifyTransportError, w as copilotBaseUrl, x as withTransientRetry, y as fetchWithTransientRetry } from "./token-iaSGp76k.js";
+import { a as resolveExecutable, c as runManagedExeCapture, i as parseIntEnv, l as spawnTaskkillBestEffort, r as parseBoolEnv } from "./exec-y8C_MU8A.js";
+import { i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-0XrazT05.js";
 import { t as MCP_WORKSPACE_HEADER } from "./mcp-workspace-header-CGJbNeHb.js";
 import { n as ArtifactError, r as applyInsecureTls, t as ArtifactClient } from "./client-CQMfroGV.js";
-import { n as isPidAlive, r as registerColbertExitHandlers, s as trackChild, t as getColbertInstanceUuid } from "./lifecycle-Bd1Fyf4B.js";
-import { h as runGateChecks, m as sealedGateIds, p as resolveSealedGate } from "./stop-gate-hook-Bmwla_2u.js";
-import { t as liveExec } from "./orchestration-B6qidQAd.js";
+import { n as isPidAlive, r as registerColbertExitHandlers, s as trackChild, t as getColbertInstanceUuid } from "./lifecycle-AgNOtFRv.js";
+import { h as runGateChecks, m as sealedGateIds, p as resolveSealedGate } from "./stop-gate-hook-BqpumJtl.js";
+import { t as liveExec } from "./orchestration-B_Q3ncXI.js";
 import { createRequire } from "node:module";
 import consola from "consola";
 import { chmodSync, closeSync, constants, cpSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
@@ -3966,6 +3966,7 @@ async function readCappedText(response) {
 		text += decoder.decode();
 	} catch (err) {
 		consola.debug("first-mate capi: capped read interrupted:", err);
+		await reader.cancel().catch(() => void 0);
 	}
 	return text.length > MAX_LOG_BYTES ? text.slice(0, MAX_LOG_BYTES) : text;
 }
@@ -4511,13 +4512,45 @@ function currentFenceToken() {
 function sleep$1(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
+/**
+* Backoff for a transient Windows rename failure.
+*
+* On Windows `fs.rename` over an existing destination transiently fails with
+* EPERM / EBUSY / EACCES when anything else holds the target open for even a
+* moment — antivirus, the search indexer, a backup agent, an editor. Nothing is
+* wrong; the handle closes microseconds later.
+*
+* This matters here more than most places: this function is the durable write
+* for mission ledgers and decisions. Without a retry, a single AV scan landing
+* on the wrong millisecond throws out of a state write, and the caller sees a
+* mission-tracking failure it cannot act on. Observed in the test suite as an
+* EPERM on `octo__alpha.json`.
+*
+* Same delays as `renameWithRetry` in `~/lib/claude-md-injection`, which
+* documents the underlying Windows behavior at length.
+*/
+const RENAME_RETRY_DELAYS_MS = [
+	50,
+	200,
+	500
+];
 async function writeJsonSecure(target, value) {
 	await fs$1.mkdir(path.dirname(target), { recursive: true });
 	const tmp = `${target}.tmp.${process.pid}.${randomBytes(4).toString("hex")}`;
 	try {
 		await fs$1.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
 		await fs$1.chmod(tmp, 384).catch(() => {});
-		await fs$1.rename(tmp, target);
+		let lastErr;
+		let renamed = false;
+		for (let attempt = 0; attempt <= RENAME_RETRY_DELAYS_MS.length; attempt++) try {
+			await fs$1.rename(tmp, target);
+			renamed = true;
+			break;
+		} catch (err) {
+			lastErr = err;
+			if (attempt < RENAME_RETRY_DELAYS_MS.length) await sleep$1(RENAME_RETRY_DELAYS_MS[attempt]);
+		}
+		if (!renamed) throw lastErr;
 		await fs$1.chmod(target, 384).catch(() => {});
 	} catch (err) {
 		await fs$1.unlink(tmp).catch(() => {});
@@ -9776,6 +9809,35 @@ function parseRepoSlug(value) {
 		repo: parts[1].trim()
 	};
 }
+/**
+* Repositories `scaffold_repo` is permitted to write to.
+*
+* `parseRepoSlug` validates SHAPE only, so before this gate any `owner/name`
+* the agent token could reach was writable. The tool's own description says it
+* "is not for arbitrary third-party repositories" — that was prose in a model-
+* facing string, not enforcement.
+*
+* Why it matters here specifically: `--browse` ingests arbitrary web content,
+* and that content reaches a model whose tool surface (under `--agents`, with
+* the second write-scoped token) includes creating branches, committing files,
+* and opening PRs. A fetched page that talks a model into naming a different
+* repo is the realistic version of that risk, and nothing downstream would
+* have caught it: the branch+PR flow and the human merge gate bound the BLAST
+* RADIUS of a write, but neither constrains WHICH repo it lands in.
+*
+* Configured with `GH_ROUTER_FM_SCAFFOLD_REPOS` as a comma-separated list of
+* `owner/name` entries; `owner/*` allows a whole org. Matching is
+* case-insensitive (GitHub logins are). Unset means DENY-ALL rather than
+* allow-all: a default-open gate is not a gate, and the operator who wants
+* scaffolding is the one who knows which repos they own. The error names the
+* env var so the honest use case is one copy-paste away.
+*/
+function assertScaffoldRepoAllowed(repo) {
+	const patterns = (process.env.GH_ROUTER_FM_SCAFFOLD_REPOS ?? "").split(",").map((entry) => entry.trim().toLowerCase()).filter((entry) => entry.length > 0);
+	const slug = `${repo.owner}/${repo.repo}`.toLowerCase();
+	if (patterns.some((pattern) => pattern === slug || pattern === `${repo.owner.toLowerCase()}/*`)) return;
+	throw new ScaffoldHelperError("repo-not-allowed", `scaffold_repo refused ${slug}: it is not in the allowlist. This tool creates branches, commits files, and opens pull requests, so it is restricted to repositories the operator has named. Set GH_ROUTER_FM_SCAFFOLD_REPOS to a comma-separated list of owner/name entries (or owner/* for a whole org) to permit it.` + (patterns.length === 0 ? " It is currently unset, so every repository is denied." : ""));
+}
 function normalizeBranchRef(value) {
 	const trimmed = value.trim();
 	const withoutRefsPrefix = trimmed.startsWith("refs/heads/") ? trimmed.slice(11) : trimmed.startsWith("heads/") ? trimmed.slice(6) : trimmed;
@@ -10673,7 +10735,7 @@ function createFirstMateTools(depsOverride = {}) {
 				repos
 			});
 		}),
-		tool("scaffold_repo", "Seeds first-mate and agentic-dev convention files into a GitHub repository by creating a scaffold branch, committing deterministic files, and opening a pull request; it does not write directly to the default branch. Inputs name the owner/name repo, optional base ref, handling mode, and optional detection overrides for stack, OS, package manager, commands, and UI evidence. Returns the pull request plus committed, preserved, and per-file report data, or a no-op note when nothing needs seeding. Use when preparing an owned repository for the first-mate cloud-agent workflow. It is not for arbitrary third-party repositories, normal feature work, or repeated runs unless the operator intentionally wants missing or enhanced convention files.", objectSchema({
+		tool("scaffold_repo", "Seeds first-mate and agentic-dev convention files into a GitHub repository by creating a scaffold branch, committing deterministic files, and opening a pull request; it does not write directly to the default branch. Inputs name the owner/name repo, optional base ref, handling mode, and optional detection overrides for stack, OS, package manager, commands, and UI evidence. Returns the pull request plus committed, preserved, and per-file report data, or a no-op note when nothing needs seeding. Use when preparing an owned repository for the first-mate cloud-agent workflow. Repositories must be allowlisted by the operator via GH_ROUTER_FM_SCAFFOLD_REPOS (unset denies every repository), so a repo outside that list is refused rather than written to. It is not for arbitrary third-party repositories, normal feature work, or repeated runs unless the operator intentionally wants missing or enhanced convention files.", objectSchema({
 			repo: stringProp("Repository as an owner/name string."),
 			mode: enumProp([
 				"add-missing-only",
@@ -10685,6 +10747,7 @@ function createFirstMateTools(depsOverride = {}) {
 		}, ["repo"]), async (args, signal) => {
 			const input = parseScaffoldRepoArgs(args);
 			const repo = parseRepoSlug(input.repo);
+			assertScaffoldRepoAllowed(repo);
 			const repository = input.base_ref === void 0 ? await getRepositoryDetails(repo, signal) : { defaultBranch: normalizeBranchRef(input.base_ref) };
 			const baseBranch = repository.defaultBranch;
 			const desiredFiles = buildScaffoldFiles(await detectScaffoldOptions({
@@ -13318,14 +13381,7 @@ function tokenize(text) {
 function killChild(child) {
 	if (!child.pid || child.killed) return;
 	if (process.platform === "win32") {
-		try {
-			execFile("taskkill", [
-				"/T",
-				"/F",
-				"/PID",
-				String(child.pid)
-			], () => {});
-		} catch {}
+		spawnTaskkillBestEffort(child.pid);
 		return;
 	}
 	try {
@@ -18367,7 +18423,7 @@ function logAudit$1(record) {
 		try {
 			const fs = await import("node:fs/promises");
 			const path = await import("node:path");
-			const { PATHS } = await import("./paths-Dz1WyRJG.js");
+			const { PATHS } = await import("./paths-BbHtQAOs.js");
 			const dir = path.join(PATHS.APP_DIR, "browser-mcp");
 			await fs.mkdir(dir, { recursive: true });
 			const line = JSON.stringify({
@@ -19183,7 +19239,10 @@ async function readResponseBodyCapped(response, routePath, capBytes = MAX_RESPON
 			chunks.push(value);
 		}
 	} catch (err) {
-		if (!capped) consola.warn(`readResponseBodyCapped: read error at ${routePath}:`, err);
+		if (!capped) {
+			consola.warn(`readResponseBodyCapped: read error at ${routePath}:`, err);
+			await reader.cancel().catch(() => void 0);
+		}
 	}
 	if (capped) {
 		consola.warn(`Non-streaming upstream response at ${routePath} exceeded ${capBytes} bytes (10 MiB cap); dropping body to prevent OOM. Check upstream health.`);
@@ -27204,10 +27263,8 @@ function relayAnthropicStream(body, opts) {
 					safeClose(controller);
 					return;
 				}
-				const errName = error instanceof Error ? error.name : "Error";
-				const errMessage = error instanceof Error ? error.message : String(error);
-				consola.error(`Upstream stream interrupted at ${opts.routePath}: bytes=${bytesRelayed} errType=${errName} message=${JSON.stringify(errMessage)}`);
-				const event = buildAnthropicErrorEvent(errName, errMessage);
+				const { errName, errMessage, transport } = logStreamError(opts.routePath, error, bytesRelayed);
+				const event = buildAnthropicErrorEvent(errName, errMessage, transport);
 				try {
 					controller.enqueue(ENCODER$1.encode(event));
 				} catch (enqueueError) {
@@ -27272,12 +27329,13 @@ async function readIteratorWithTimeout(iterator, timeoutMs) {
 *   event: error
 *   data: {"type":"error","error":{"type":"...","message":"..."}}
 */
-function buildAnthropicErrorEvent(errName, errMessage) {
+function buildAnthropicErrorEvent(errName, errMessage, transportDetails) {
+	const details = transportDetails ?? classifyNamedStreamError(errName, errMessage);
 	const payload = {
 		type: "error",
 		error: {
-			type: classifyStreamError(errName),
-			message: `Upstream stream interrupted: ${errName}: ${errMessage}`
+			type: classifyStreamError(details),
+			message: formatStreamErrorMessage(details)
 		}
 	};
 	return `event: error\ndata: ${JSON.stringify(payload)}\n\n`;
@@ -27287,24 +27345,42 @@ function buildAnthropicErrorEvent(errName, errMessage) {
 * followed by the `data: [DONE]` terminator that OpenAI clients expect.
 */
 function buildOpenAIErrorEvent(errName, errMessage) {
+	const details = classifyNamedStreamError(errName, errMessage);
 	const payload = { error: {
-		type: classifyStreamError(errName),
-		message: `Upstream stream interrupted: ${errName}: ${errMessage}`
+		type: classifyStreamError(details),
+		message: formatStreamErrorMessage(details)
 	} };
 	return `data: ${JSON.stringify(payload)}\n\ndata: [DONE]\n\n`;
 }
-function classifyStreamError(errName) {
-	if (errName === "AbortError") return "timeout_error";
-	if (errName === "InactivityTimeout") return "timeout_error";
+function classifyNamedStreamError(errName, errMessage) {
+	const error = Object.assign(new Error(errMessage), { name: errName });
+	return classifyTransportError(error);
+}
+function classifyStreamError(details) {
+	if (details.name === "AbortError" || details.name === "InactivityTimeout" || details.name === "TimeoutError" || details.name === "timeout_error") return "timeout_error";
+	if (details.classification === "transient") return "overloaded_error";
 	return "api_error";
 }
-function logStreamError(routePath, error) {
-	const errName = error instanceof Error ? error.name : "Error";
-	const errMessage = error instanceof Error ? error.message : String(error);
-	consola.error(`Upstream stream interrupted at ${routePath}: errType=${errName} message=${JSON.stringify(errMessage)}`);
+function formatStreamErrorMessage(details) {
+	const code = details.causeCode ?? details.code;
+	const suffix = code ? ` (${sanitizeTransportText(code)})` : "";
+	const diagnostic = `${sanitizeTransportText(details.name)}: ${sanitizeTransportText(details.message)}${suffix}`;
+	if (details.classification === "transient") return `Upstream stream interrupted by a transient transport failure; retry the request. ${diagnostic}`;
+	if (details.classification === "deterministic") return `Upstream stream interrupted by a connectivity or TLS configuration failure. ${diagnostic}`;
+	return `Upstream stream interrupted: ${diagnostic}`;
+}
+function logStreamError(routePath, error, bytesRelayed) {
+	const transport = classifyTransportError(error);
+	const errName = transport.name;
+	const errMessage = transport.message;
+	const byteField = bytesRelayed === void 0 ? "" : ` bytes=${Math.max(0, bytesRelayed)}`;
+	const codeField = transport.code ? ` code=${JSON.stringify(transport.code)}` : "";
+	const causeCodeField = transport.causeCode ? ` causeCode=${JSON.stringify(transport.causeCode)}` : "";
+	consola.error("Upstream stream interrupted", `routePath=${JSON.stringify(routePath)}${byteField} classification=${transport.classification} errType=${errName}${codeField}${causeCodeField} message=${JSON.stringify(errMessage)}`);
 	return {
 		errName,
-		errMessage
+		errMessage,
+		transport
 	};
 }
 //#endregion
@@ -27656,10 +27732,11 @@ async function runAdvisor(conversation, advisorModel, advisorEffort, signal) {
 * against edge cases that would otherwise emit a malformed block —
 * spec violation in either direction is a 400.
 */
-function toClientServerToolUseId(id, fallbackIndex) {
-	const suffix = id.startsWith("toolu_") ? id.slice(6) : id;
-	if (/^[a-zA-Z0-9_]+$/.test(suffix)) return `srvtoolu_${suffix}`;
-	return `srvtoolu_advisor_${fallbackIndex}`;
+function toClientServerToolUseId(id, _fallbackIndex) {
+	if (!id.startsWith("toolu_")) throw new Error("advisor tool_use id is not round-trippable");
+	const suffix = id.slice(6);
+	if (!/^[a-zA-Z0-9_]+$/.test(suffix)) throw new Error("advisor tool_use id is not round-trippable");
+	return `srvtoolu_${suffix}`;
 }
 /**
 * Build an SSE event line in the canonical Anthropic shape:
@@ -27695,6 +27772,7 @@ function buildAdvisorStream(opts) {
 			let messageStartForwarded = false;
 			let nextSyntheticIndex = 0;
 			let turnsRun;
+			let pendingMessageDelta = null;
 			const safeEnqueue = (bytes) => {
 				try {
 					controller.enqueue(bytes);
@@ -27708,9 +27786,42 @@ function buildAdvisorStream(opts) {
 				}
 			};
 			const safeEnqueueEvent = (type, data) => safeEnqueue(ENCODER.encode(sseEvent(type, data)));
+			const captureMessageDelta = (payload) => {
+				const delta = payload.delta && typeof payload.delta === "object" ? payload.delta : {};
+				const usage = payload.usage && typeof payload.usage === "object" ? payload.usage : {};
+				if (!pendingMessageDelta) pendingMessageDelta = {
+					stopReason: delta.stop_reason ?? null,
+					stopSequence: delta.stop_sequence ?? null,
+					usage: {}
+				};
+				else {
+					if (delta.stop_reason !== void 0) pendingMessageDelta.stopReason = delta.stop_reason;
+					if (delta.stop_sequence !== void 0) pendingMessageDelta.stopSequence = delta.stop_sequence;
+				}
+				for (const [key, value] of Object.entries(usage)) if (typeof value === "number" && Number.isFinite(value)) pendingMessageDelta.usage[key] = (pendingMessageDelta.usage[key] ?? 0) + value;
+			};
+			const emitTerminal = (forcedStopReason) => {
+				if (pendingMessageDelta || forcedStopReason) {
+					const terminal = pendingMessageDelta ?? {
+						stopReason: null,
+						stopSequence: null,
+						usage: {}
+					};
+					if (!safeEnqueueEvent("message_delta", {
+						type: "message_delta",
+						delta: {
+							stop_reason: forcedStopReason ?? terminal.stopReason,
+							stop_sequence: terminal.stopSequence
+						},
+						usage: terminal.usage
+					})) return false;
+				}
+				return safeEnqueueEvent("message_stop", { type: "message_stop" });
+			};
 			async function processOneTurn(response) {
 				const capturedBlocks = [];
-				let advisorToolUse = null;
+				const advisorToolUses = [];
+				let clientToolUseCount = 0;
 				const indexToBlock = /* @__PURE__ */ new Map();
 				for await (const ev of events(response)) {
 					if (!ev.event || !ev.data) continue;
@@ -27720,7 +27831,8 @@ function buildAdvisorStream(opts) {
 					} catch {
 						if (!safeEnqueue(ENCODER.encode(`event: ${ev.event}\ndata: ${ev.data}\n\n`))) return {
 							capturedBlocks,
-							advisorToolUse
+							advisorToolUses,
+							clientToolUseCount
 						};
 						continue;
 					}
@@ -27729,7 +27841,8 @@ function buildAdvisorStream(opts) {
 							if (!messageStartForwarded) {
 								if (!safeEnqueueEvent(ev.event, payload)) return {
 									capturedBlocks,
-									advisorToolUse
+									advisorToolUses,
+									clientToolUseCount
 								};
 								messageStartForwarded = true;
 							}
@@ -27741,12 +27854,13 @@ function buildAdvisorStream(opts) {
 								const myIndex = nextSyntheticIndex++;
 								if (block.type === "tool_use" && block.name === "__anthropic_advisor") {
 									const id = typeof block.id === "string" ? block.id : `toolu_advisor_${myIndex}`;
-									advisorToolUse = {
+									const advisorToolUse = {
 										index: myIndex,
 										id,
 										clientId: toClientServerToolUseId(id, myIndex),
 										inputJson: ""
 									};
+									advisorToolUses.push(advisorToolUse);
 									const translated = {
 										...payload,
 										index: myIndex,
@@ -27759,7 +27873,8 @@ function buildAdvisorStream(opts) {
 									};
 									if (!safeEnqueueEvent(ev.event, translated)) return {
 										capturedBlocks,
-										advisorToolUse
+										advisorToolUses,
+										clientToolUseCount
 									};
 									const captured = {
 										block: {
@@ -27774,13 +27889,15 @@ function buildAdvisorStream(opts) {
 									capturedBlocks.push(captured);
 									indexToBlock.set(upstreamIndex, captured);
 								} else {
+									if (block.type === "tool_use") clientToolUseCount++;
 									const reindexed = {
 										...payload,
 										index: myIndex
 									};
 									if (!safeEnqueueEvent(ev.event, reindexed)) return {
 										capturedBlocks,
-										advisorToolUse
+										advisorToolUses,
+										clientToolUseCount
 									};
 									const captured = {
 										block: { ...block },
@@ -27803,7 +27920,8 @@ function buildAdvisorStream(opts) {
 								};
 								if (!safeEnqueueEvent(ev.event, reindexed)) return {
 									capturedBlocks,
-									advisorToolUse
+									advisorToolUses,
+									clientToolUseCount
 								};
 								if (captured && delta) {
 									if (delta.type === "text_delta" && typeof delta.text === "string") captured.block.text = (captured.block.text ?? "") + delta.text;
@@ -27817,7 +27935,8 @@ function buildAdvisorStream(opts) {
 								}
 							} else if (!safeEnqueueEvent(ev.event, payload)) return {
 								capturedBlocks,
-								advisorToolUse
+								advisorToolUses,
+								clientToolUseCount
 							};
 							continue;
 						}
@@ -27830,7 +27949,8 @@ function buildAdvisorStream(opts) {
 							};
 							if (!safeEnqueueEvent(ev.event, reindexed)) return {
 								capturedBlocks,
-								advisorToolUse
+								advisorToolUses,
+								clientToolUseCount
 							};
 							if (captured) {
 								if (captured.block.type === "tool_use" && captured.partialJson.length > 0) try {
@@ -27839,38 +27959,28 @@ function buildAdvisorStream(opts) {
 									consola.warn(`advisor: malformed input_json_delta for tool_use id=${captured.block.id ?? "?"} name=${captured.block.name ?? "?"} partialJson.length=${captured.partialJson.length} parseError=${err instanceof Error ? err.message : String(err)}`);
 									captured.block.input = {};
 								}
-								if (captured.block.type === "text" && (typeof captured.block.text !== "string" || captured.block.text.length === 0)) captured.dropFromReplay = true;
 							}
 							continue;
 						}
 						case "message_delta":
-							if (!safeEnqueueEvent(ev.event, payload)) return {
-								capturedBlocks,
-								advisorToolUse
-							};
+							captureMessageDelta(payload);
 							continue;
-						case "message_stop":
-							if (advisorToolUse) return {
-								capturedBlocks,
-								advisorToolUse
-							};
-							if (!safeEnqueueEvent(ev.event, payload)) return {
-								capturedBlocks,
-								advisorToolUse
-							};
-							return {
-								capturedBlocks,
-								advisorToolUse
-							};
+						case "message_stop": return {
+							capturedBlocks,
+							advisorToolUses,
+							clientToolUseCount
+						};
 						default: if (!safeEnqueueEvent(ev.event, payload)) return {
 							capturedBlocks,
-							advisorToolUse
+							advisorToolUses,
+							clientToolUseCount
 						};
 					}
 				}
 				return {
 					capturedBlocks,
-					advisorToolUse
+					advisorToolUses,
+					clientToolUseCount
 				};
 			}
 			try {
@@ -27878,13 +27988,16 @@ function buildAdvisorStream(opts) {
 				for (turnsRun = 0; turnsRun < 16; turnsRun++) {
 					if (aborter.signal.aborted) return;
 					if (conversation === null) return;
-					const { capturedBlocks, advisorToolUse } = await processOneTurn(response);
-					if (!advisorToolUse) return;
+					const { capturedBlocks, advisorToolUses, clientToolUseCount } = await processOneTurn(response);
+					if (advisorToolUses.length === 0) {
+						emitTerminal();
+						return;
+					}
 					if (aborter.signal.aborted) return;
 					if (conversation === null) return;
 					const assistantTurn = {
 						role: "assistant",
-						content: capturedBlocks.filter((c) => !c.dropFromReplay).map((c) => {
+						content: capturedBlocks.map((c) => {
 							if (c.advisorReplay) {
 								const input = typeof c.block.input === "object" && c.block.input !== null ? c.block.input : {};
 								return {
@@ -27898,41 +28011,55 @@ function buildAdvisorStream(opts) {
 						})
 					};
 					conversation.push(assistantTurn);
-					let advisorText;
-					try {
-						advisorText = await runAdvisor(conversation, advisorModel, advisorEffort, aborter.signal);
-					} catch (err) {
-						if (aborter.signal.aborted) return;
-						const msg = err instanceof Error ? err.message : String(err);
-						consola.warn(`Advisor model call failed: ${msg}`);
-						advisorText = `[Advisor unavailable: ${msg}. Continuing without external review — proceed with caution and consider self-checking against your primary-source evidence.]`;
-					}
+					const advisorConversation = conversation;
+					const advisorTexts = await Promise.all(advisorToolUses.map(async () => {
+						try {
+							return await runAdvisor(advisorConversation, advisorModel, advisorEffort, aborter.signal);
+						} catch (err) {
+							if (aborter.signal.aborted) throw err;
+							const msg = err instanceof Error ? err.message : String(err);
+							consola.warn(`Advisor model call failed: ${msg}`);
+							return `[Advisor unavailable: ${msg}. Continuing without external review — proceed with caution and consider self-checking against your primary-source evidence.]`;
+						}
+					})).catch((err) => {
+						if (aborter.signal.aborted) return null;
+						throw err;
+					});
+					if (!advisorTexts) return;
 					if (aborter.signal.aborted) return;
 					if (conversation === null) return;
-					const resultIndex = nextSyntheticIndex++;
-					if (!safeEnqueueEvent("content_block_start", {
-						type: "content_block_start",
-						index: resultIndex,
-						content_block: {
-							type: "advisor_tool_result",
-							tool_use_id: advisorToolUse.clientId,
-							content: {
-								type: "advisor_result",
-								text: advisorText
+					for (let index = 0; index < advisorToolUses.length; index++) {
+						const advisorToolUse = advisorToolUses[index];
+						const advisorText = advisorTexts[index];
+						const resultIndex = nextSyntheticIndex++;
+						if (!safeEnqueueEvent("content_block_start", {
+							type: "content_block_start",
+							index: resultIndex,
+							content_block: {
+								type: "advisor_tool_result",
+								tool_use_id: advisorToolUse.clientId,
+								content: {
+									type: "advisor_result",
+									text: advisorText
+								}
 							}
-						}
-					})) return;
-					if (!safeEnqueueEvent("content_block_stop", {
-						type: "content_block_stop",
-						index: resultIndex
-					})) return;
+						})) return;
+						if (!safeEnqueueEvent("content_block_stop", {
+							type: "content_block_stop",
+							index: resultIndex
+						})) return;
+					}
+					if (clientToolUseCount > 0) {
+						emitTerminal("tool_use");
+						return;
+					}
 					conversation.push({
 						role: "user",
-						content: [{
+						content: advisorToolUses.map((advisorToolUse, index) => ({
 							type: "tool_result",
 							tool_use_id: advisorToolUse.id,
-							content: advisorText
-						}]
+							content: advisorTexts[index]
+						}))
 					});
 					if (aborter.signal.aborted) return;
 					response = await createMessages(JSON.stringify({
@@ -27963,7 +28090,7 @@ function buildAdvisorStream(opts) {
 					type: "content_block_stop",
 					index: finalIndex
 				});
-				safeEnqueueEvent("message_stop", { type: "message_stop" });
+				emitTerminal("end_turn");
 			} catch (err) {
 				if (aborter.signal.aborted) return;
 				const msg = err instanceof Error ? err.message : String(err);
@@ -33284,7 +33411,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "explore",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-explore` agent. Dispatch via the Agent tool (subagent_type: worker-explore) so the turn is never blocked; the result arrives as a completion notification. Read-only investigation by an autonomous worker (Pi runtime; default model `gemini-3.6-flash` at high reasoning, override via the `model` arg with any Copilot-catalog model that advertises `tool_calls`). It has read, glob, grep, semantic-first code search, web search, fetch_url, advisor, update_plan, and read-only toolbelt tools, and it returns a single text answer. Use for bounded research, repo discovery, dependency investigation, or multi-file reading that would otherwise consume the lead context window. Not for implementation, test authoring, or verification of a concrete diff; use implement, test, or review for those scopes. Brief the investigation goal and constraints, not step-by-step tool semantics.",
+		description: "Runs as the background `worker-explore` agent. Dispatch via the Agent tool (subagent_type: worker-explore) so the turn is never blocked; the result arrives as a completion notification. Read-only investigation by an autonomous worker (Pi runtime; default model `gemini-3.6-flash` at high reasoning, override via the `model` arg with any Copilot-catalog model that advertises `tool_calls`). It has read, glob, grep, semantic-first code search, web search, fetch_url, advisor, update_plan, and read-only toolbelt tools, and it returns a single text answer. Use for bounded research, repo discovery, dependency investigation, or multi-file reading that would otherwise consume the lead context window. Not for implementation, test authoring, or verification of a concrete diff; use implement, test, or review for those scopes. Brief the investigation goal and constraints, not step-by-step tool semantics. Strictly read-only: it changes nothing on disk, and its returned text is the only artifact it produces — route to `implement` or `test` when a file actually needs to change. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -33325,7 +33452,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "implement",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-implement` agent. Dispatch via the Agent tool (subagent_type: worker-implement) so the turn is never blocked; the result arrives as a completion notification. Delegates a scoped coding task to an autonomous worker (Pi runtime; default model `gpt-5.6-sol` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the explore read-only tools plus edit, write, bash, and codex_review, and it returns its final text with any changed files or worktree diff. Use for bounded implementation work that may take a while or benefits from isolated worker context. Not for pure research, planning, review, or independent test authoring; use explore, plan, review, or test for those scopes. ALWAYS runs in an isolated git worktree and returns the diff via a saved patch file (a `--stat` summary + a bounded preview + the patch path; a small diff is inlined in full) — it never edits your working tree, and it HARD-ERRORS if the workspace is not a git repository. For in-place edits, use the native `implementer` subagent.",
+		description: "Runs as the background `worker-implement` agent. Dispatch via the Agent tool (subagent_type: worker-implement) so the turn is never blocked; the result arrives as a completion notification. Delegates a scoped coding task to an autonomous worker (Pi runtime; default model `gpt-5.6-sol` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the explore read-only tools plus edit, write, bash, and codex_review, and it returns its final text with any changed files or worktree diff. Use for bounded implementation work that may take a while or benefits from isolated worker context. Not for pure research, planning, review, or independent test authoring; use explore, plan, review, or test for those scopes. ALWAYS runs in an isolated git worktree and returns the diff via a saved patch file (a `--stat` summary + a bounded preview + the patch path; a small diff is inlined in full) — it never edits your working tree, and it HARD-ERRORS if the workspace is not a git repository. For in-place edits, use the native `implementer` subagent. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -33370,7 +33497,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "review",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-review` agent. Dispatch via the Agent tool (subagent_type: worker-review) so the turn is never blocked; the result arrives as a completion notification. Read-only code review by an autonomous worker (Pi runtime; default model `gemini-3.1-pro-preview`, default thinking xhigh clamped to high for that model, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read-only toolset as explore and verifies claims against surrounding repository context before returning severity-ranked findings with `file:line` citations. Use for reviewing a change, diff, or correctness claim when the reviewer should read the code itself rather than trusting a pasted artifact. Not for architecture critique, implementation, or test authoring; use codex_critic or gemini_critic for design review, implement for edits, and test for independent test creation.",
+		description: "Runs as the background `worker-review` agent. Dispatch via the Agent tool (subagent_type: worker-review) so the turn is never blocked; the result arrives as a completion notification. Read-only code review by an autonomous worker (Pi runtime; default model `gemini-3.1-pro-preview`, default thinking xhigh clamped to high for that model, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read-only toolset as explore and verifies claims against surrounding repository context before returning severity-ranked findings with `file:line` citations. Use for reviewing a change, diff, or correctness claim when the reviewer should read the code itself rather than trusting a pasted artifact. Not for architecture critique, implementation, or test authoring; use codex_critic or gemini_critic for design review, implement for edits, and test for independent test creation. Strictly read-only: it changes nothing on disk, and its returned text is the only artifact it produces — route to `implement` or `test` when a file actually needs to change. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -33411,7 +33538,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "plan",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-plan` agent. Dispatch via the Agent tool (subagent_type: worker-plan) so the turn is never blocked; the result arrives as a completion notification. Read-only implementation planning by an autonomous worker (Pi runtime; default model `claude-opus-5` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read-only toolset as explore and returns a concrete, ordered implementation plan covering files, approach, risks, and how acceptance criteria will be verified. Use before coding when the task needs repo-grounded sequencing or acceptance criteria translated into implementation steps. Not for editing files, running an implementation, writing tests, or adversarial review; use implement, test, or review for those scopes.",
+		description: "Runs as the background `worker-plan` agent. Dispatch via the Agent tool (subagent_type: worker-plan) so the turn is never blocked; the result arrives as a completion notification. Read-only implementation planning by an autonomous worker (Pi runtime; default model `claude-opus-5` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read-only toolset as explore and returns a concrete, ordered implementation plan covering files, approach, risks, and how acceptance criteria will be verified. Use before coding when the task needs repo-grounded sequencing or acceptance criteria translated into implementation steps. Not for editing files, running an implementation, writing tests, or adversarial review; use implement, test, or review for those scopes. Strictly read-only: it changes nothing on disk, and its returned text is the only artifact it produces — route to `implement` or `test` when a file actually needs to change. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -33452,7 +33579,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "test",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-test` agent. Dispatch via the Agent tool (subagent_type: worker-test) so the turn is never blocked; the result arrives as a completion notification. Independent adversarial test authoring by an autonomous worker (Pi runtime; default model `gpt-5.6-sol` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read/write toolset as implement and writes tests that try to break the implementation through edge cases, error paths, and acceptance criteria, then runs them and reports pass/fail. Use when a separate test author should challenge an implementation without modifying the production code to make tests pass. Not for implementing fixes, broad research, or code review; use implement, explore, or review for those scopes. ALWAYS runs in an isolated git worktree and returns the test diff via a saved patch file (a `--stat` summary + a bounded preview + the patch path; a small diff is inlined in full) — it never edits your working tree, and it HARD-ERRORS if the workspace is not a git repository. For in-place test authoring, use the native `implementer` subagent.",
+		description: "Runs as the background `worker-test` agent. Dispatch via the Agent tool (subagent_type: worker-test) so the turn is never blocked; the result arrives as a completion notification. Independent adversarial test authoring by an autonomous worker (Pi runtime; default model `gpt-5.6-sol` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read/write toolset as implement and writes tests that try to break the implementation through edge cases, error paths, and acceptance criteria, then runs them and reports pass/fail. Use when a separate test author should challenge an implementation without modifying the production code to make tests pass. Not for implementing fixes, broad research, or code review; use implement, explore, or review for those scopes. ALWAYS runs in an isolated git worktree and returns the test diff via a saved patch file (a `--stat` summary + a bounded preview + the patch path; a small diff is inlined in full) — it never edits your working tree, and it HARD-ERRORS if the workspace is not a git repository. For in-place test authoring, use the native `implementer` subagent. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -33699,7 +33826,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "browse",
 		group: "workers",
 		capability: "browse_agent",
-		description: "Runs as the background `worker-browse` agent. Dispatch via the Agent tool (subagent_type: worker-browse) so the turn is never blocked; the result arrives as a completion notification. A Pi-driven autonomous browser worker (default model `gpt-5.4-mini`) drives a real browser to accomplish `task`, keeps raw DOM and page snapshots inside its own context, and returns a single text result. Use for delegated multi-step web tasks such as comparing prices, logging into a dashboard, or summarizing pages when the lead does not need to steer each click. Not for direct in-context browser control, screenshots, or precise element interactions; use the `browser` MCP tools for those. Pass `sessionId` to continue a prior browse session, or omit it for a fresh isolated session; multiple calls run as parallel sessions on the shared browser.",
+		description: "Runs as the background `worker-browse` agent. Dispatch via the Agent tool (subagent_type: worker-browse) so the turn is never blocked; the result arrives as a completion notification. A Pi-driven autonomous browser worker (default model `gpt-5.4-mini`) drives a real browser to accomplish `task`, keeps raw DOM and page snapshots inside its own context, and returns a single text result. Use for delegated multi-step web tasks such as comparing prices, logging into a dashboard, or summarizing pages when the lead does not need to steer each click. Not for direct in-context browser control, screenshots, or precise element interactions; use the `browser` MCP tools for those. Pass `sessionId` to continue a prior browse session, or omit it for a fresh isolated session; multiple calls run as parallel sessions on the shared browser. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["task"],
@@ -34160,4 +34287,4 @@ function enumerateInjectedMcpToolNames(groupKeys, opts = {}) {
 //#endregion
 export { reviewerModel as $, searchWeb as A, DEFAULT_CODEX_MODEL_FALLBACKS as At, readIteratorWithTimeout as B, buildToolbeltAwareness as C, CONDENSED_OPERATING_SEQUENCE as Ct, TOOLBELT_TOOLS$1 as D, toolbeltPathOverride as Dt, vscodeRipgrepPath as E, collapsePathKeys as Et, isAdvisorRequested as F, pickClaudeDefault as Ft, artifactToolsEnabled as G, handleMcpDelete as H, buildAnthropicErrorEvent as I, withOneMSuffix as It, browserCompoundToolsEnabled as J, brainstormModel as K, buildOpenAIErrorEvent as L, withInstallLock as Lt, ADVISOR_TOOL_INSTRUCTIONS as M, UPSTREAM_FETCH_TIMEOUT_MS as Mt, buildAdvisorStream as N, UPSTREAM_INACTIVITY_TIMEOUT_MS as Nt, assetFor as O, DEFAULT_CLAUDE_MODEL_FALLBACKS as Ot, injectAdvisorTool as P, generateRandomPort as Pt, nativeSubagentModel as Q, isControllerClosedError as R, availableToolCommands as S, warmTreeSitterPool as St, toolbeltSkipSet as T, shouldUseInsecureTls as Tt, handleMcpPost as U, relayAnthropicStream as V, agentToolsEnabled as W, fleetToolsEnabled as X, browserToolsEnabled as Y, geminiAvailable as Z, appendPlanReminder as _, hasSupportedBrowserInstalled as _t, buildPeerAwarenessSnippet as a, countTokens as at, runWorkerAgent as b, extractTarGzMember as bt, personasFor as c, assembleResponsesPayload as ct, EXPLORE_DEFAULT_MODEL as d, createResponses as dt, scoutModel as et, EXPLORE_DEFAULT_THINKING as f, createChatCompletions as ft, TEST_DEFAULT_MODEL as g, provisionBrowserAssets as gt, REVIEW_DEFAULT_MODEL as h, parseJsonOrDiagnose as ht, buildAgentPrompt as i, shimDefaultsToXhigh as it, ADVISOR_INTERNAL_TOOL_NAME as j, DEFAULT_PORT as jt, satisfiesMinVersion as k, DEFAULT_CODEX_MODEL as kt, BROWSE_DEFAULT_MODEL as l, resolveMcpToolTimeoutMs as lt, PLAN_DEFAULT_MODEL as m, readResponseBodyCapped as mt, MCP_GROUPS as n, standInToolEnabled as nt, buildPeerAwarenessSummary as o, createMessages as ot, IMPLEMENT_DEFAULT_MODEL as p, MAX_RESPONSE_BODY_BYTES as pt, browseAgentEnabled as q, assertMcpToolSurfaceConsistent as r, workerToolsEnabled as rt, enumerateInjectedMcpToolNames as s, getTokenCount as st, GROUP_META as t, scribeModel as tt, DEFAULT_MODEL as u, pickEndpoint as ut, resolveModeDefaults as v, colbertDegradedWarning as vt, toolbeltEnabled as w, DEFINITION_OF_GREATNESS as wt, buildEnv as x, extractZipMember as xt, resolveWorkerRunOpts as y, provisionAndIndexColbert as yt, logStreamError as z };
 
-//# sourceMappingURL=peer-mcp-personas-B22ncnbQ.js.map
+//# sourceMappingURL=peer-mcp-personas-pWP3Eyt7.js.map