github-router 0.3.276 → 0.3.285

package/dist/{peer-mcp-personas-DRL_xT4h.js → peer-mcp-personas-V6stFvpq.js}

@@ -1,13 +1,14 @@
-import { t as getPackageVersion } from "./version-_Q1WpsQp.js";
-import { t as PATHS } from "./paths-j2B7b0DZ.js";
-import { A as state, C as GITHUB_GRAPHQL_URL, D as githubAgentGraphQLHeaders, E as copilotVersion, O as githubAgentHeaders, S as GITHUB_API_BASE_URL, T as copilotHeaders, b as sanitizeTransportText, d as resolveModel, f as sleep$2, g as HTTPError, h as isAllowedCopilotHost, i as tryRefreshAndRetry, v as classifyTransportError, w as copilotBaseUrl, x as withTransientRetry, y as fetchWithTransientRetry } from "./token-CxPaBEUS.js";
+import { n as explicitPackageRoot } from "./package-root-B-osctCk.js";
+import { t as getPackageVersion } from "./version-C8x2hQrZ.js";
+import { t as PATHS } from "./paths-wLC0InjX.js";
+import { A as state, C as GITHUB_GRAPHQL_URL, D as githubAgentGraphQLHeaders, E as copilotVersion, O as githubAgentHeaders, S as GITHUB_API_BASE_URL, T as copilotHeaders, b as sanitizeTransportText, d as resolveModel, f as sleep$2, g as HTTPError, h as isAllowedCopilotHost, i as tryRefreshAndRetry, v as classifyTransportError, w as copilotBaseUrl, x as withTransientRetry, y as fetchWithTransientRetry } from "./token-CnlB0884.js";
 import { a as resolveExecutable, c as runManagedExeCapture, i as parseIntEnv, l as spawnTaskkillBestEffort, r as parseBoolEnv } from "./exec-y8C_MU8A.js";
-import { i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-LA4rAuAL.js";
-import { t as MCP_WORKSPACE_HEADER } from "./mcp-workspace-header-CGJbNeHb.js";
+import { i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-B7CHqKlF.js";
+import { t as MCP_WORKSPACE_HEADER } from "./mcp-workspace-header-ucs2SDST.js";
 import { n as ArtifactError, r as applyInsecureTls, t as ArtifactClient } from "./client-CQMfroGV.js";
-import { n as isPidAlive$1, r as registerColbertExitHandlers, s as trackChild, t as getColbertInstanceUuid } from "./lifecycle-AGXnd-ZY.js";
-import { h as runGateChecks, m as sealedGateIds, p as resolveSealedGate } from "./stop-gate-hook-CaUrldLh.js";
-import { t as liveExec } from "./orchestration-CpkG8ScN.js";
+import { n as isPidAlive$1, r as registerColbertExitHandlers, s as trackChild, t as getColbertInstanceUuid } from "./lifecycle-D-rL81tT.js";
+import { f as resolveSealedGate, m as runGateChecks, p as sealedGateIds } from "./stop-gate-hook-DgJ6sW8N.js";
+import { t as liveExec } from "./orchestration-CtM6FYNx.js";
 import { createRequire } from "node:module";
 import consola from "consola";
 import { chmodSync, closeSync, constants, cpSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
@@ -162,6 +163,221 @@ function withOneMSuffix(id) {
 	if (oneMContextDisabled()) return id;
 	return catalogAdvertises1M(id) ? `${id}[1m]` : id;
 }
+/**
+* Decorate a slug the USER named — a `-m` argument or a launcher default — with
+* `[1m]` iff the model it actually RESOLVES to serves >=1M context.
+*
+* The difference from `withOneMSuffix` is the resolution step, and it exists
+* because the two functions are handed different kinds of string. Every
+* `withOneMSuffix` caller already holds a concrete catalog id from a catalog
+* walk, so an exact-id match is both sufficient and the safer rule: inferring a
+* match there could attach `[1m]` to a sibling that does not serve 1M. A lead
+* slug is the opposite case — it is whatever the user typed, or an
+* Anthropic-published dashed slug like `claude-opus-4-8` that the catalog
+* carries in dotted form. Exact-id matching answers "no 1M" for those purely
+* because it never found the entry, which is the silent under-accounting this
+* function exists to stop.
+*
+* Resolving first also picks up the `-1m` SIBLING shape for free:
+* `resolveModel`'s opus family preference maps `claude-opus-4-7` onto
+* `claude-opus-4.7-1m-internal` when that is what the tier carries, and the
+* sibling's own advertised window then answers the question. That is the same
+* dual-signal conclusion `pickClaudeDefault` reaches for the family shorthand,
+* so the two paths cannot disagree about a family both can be asked about.
+*
+* Idempotent: a slug that already carries the bracket is returned unchanged, so
+* a user who pins `-m claude-opus-5[1m]` by hand does not get `[1m][1m]`. That
+* early return deliberately does NOT re-validate the pin against the catalog.
+* `-m claude-haiku-4-5[1m]` therefore survives even though Haiku 4.5 is a 200K
+* model — the same as before this function existed, and `resolveModel` already
+* warns loudly about exactly that case. Stripping a bracket the user typed
+* would be the surprising behaviour, and it would be the only place in the
+* launcher that overrides an explicit `-m`.
+*
+* A repeat can still arrive from the CLIENT side rather than from here: the
+* `/model` picker rows are seeded already decorated, and Claude Code's alias
+* path appends its own bracket (`getDefaultSonnetModel() + '[1m]'`), so
+* selecting `sonnet[1m]` puts `claude-sonnet-5[1m][1m]` on the wire. That
+* resolves to the same bare id — `resolveModel`'s strip recurses — and Claude
+* Code's own detector is unanchored, so local accounting is right too. Pinned
+* by a regression test in `tests/lib-utils.test.ts`.
+*
+* Degrades the same safe direction as everything else here. An unpopulated
+* catalog makes `resolveModel` a pass-through and `catalogAdvertises1M` false,
+* so the slug stays bare and Claude Code accounts at its conservative 200K
+* default — under-accounting, never overflow.
+*/
+function withOneMSuffixForLead(slug) {
+	if (oneMContextDisabled()) return slug;
+	if (/\[1m\]$/i.test(slug)) return slug;
+	return catalogAdvertises1M(resolveModel(slug)) ? `${slug}[1m]` : slug;
+}
+//#endregion
+//#region src/services/copilot/endpoint.ts
+/**
+* Catalog spellings that mean each of our two clients. Copilot is not
+* self-consistent about the `/v1` prefix — the live catalog advertises
+* `/v1/messages` prefixed but `/chat/completions` bare, and this repo's own
+* fixtures carry both forms — so an exact-match on the bare spelling alone
+* silently misses a real shape. `src/lib/model-validation.ts` already
+* normalizes the same way (`ENDPOINT_ALIASES`); this keeps the two agreeing.
+*
+* Matching is EXACT against this set, never a suffix/`includes` test: a
+* `ws:/responses` (websocket transport) entry is NOT the `/responses` HTTP
+* client and must keep resolving to "serves neither".
+*/
+const CHAT_ENDPOINTS = /* @__PURE__ */ new Set(["/chat/completions", "/v1/chat/completions"]);
+const RESPONSES_ENDPOINTS = /* @__PURE__ */ new Set(["/responses", "/v1/responses"]);
+/**
+* Decide which endpoint to call for a model from its catalog
+* `supported_endpoints`. Prefers `/chat/completions` when available (the
+* simpler, more widely-supported shape) and falls back to `/responses` for
+* models that ONLY serve the Responses API — the gpt-5.x family except
+* `gpt-5-mini` / `gpt-5.4` (e.g. `gpt-5.4-mini`, `gpt-5.5`, the
+* `*-codex` models). Returns undefined when the model serves neither, so a
+* caller can skip it rather than 400 on `unsupported_api_for_model`.
+*
+* A model that OMITS `supported_endpoints` is treated as chat-eligible: the
+* catalog historically omits the field for chat-default models, and
+* excluding those would be a worse regression than the gap this guards.
+*/
+function pickEndpoint(model) {
+	const eps = model.supported_endpoints;
+	if (!eps || eps.length === 0) return "chat";
+	if (eps.some((e) => CHAT_ENDPOINTS.has(e))) return "chat";
+	if (eps.some((e) => RESPONSES_ENDPOINTS.has(e))) return "responses";
+}
+/**
+* `pickEndpoint` by model id against the live catalog, WITHOUT collapsing
+* "absent from the catalog" into "serves neither of our endpoints".
+*
+* This function deliberately has no default. The predecessor
+* (`endpointForModelId`) returned `pickEndpoint(found) ?? "chat"`, which
+* coerced both cases to "chat" — defensible for an unknown id, silently wrong
+* for a catalog model serving only, say, `/v1/messages`: the caller would drive
+* it through the chat client and get an opaque upstream 400 with no local
+* signal about the real cause. `src/lib/browser-mcp/compressor.ts` already
+* treats that case correctly (`if (!endpoint) continue`); this makes the same
+* distinction available to callers that resolve by id.
+*
+* Callers that legitimately want the chat default for an unknown id can still
+* have it — they just have to write it, per case, on purpose.
+*/
+function resolveEndpointForModelId(id) {
+	const found = state.models?.data?.find((m) => m.id === id);
+	if (!found) return { kind: "unknown-model" };
+	const endpoint = pickEndpoint(found);
+	if (endpoint) return {
+		kind: "endpoint",
+		endpoint
+	};
+	return {
+		kind: "unreachable",
+		endpoints: found.supported_endpoints ?? []
+	};
+}
+//#endregion
+//#region src/lib/anthropic-translate/classifier.ts
+/**
+* Routing classifier for `POST /v1/messages`.
+*
+* Claude Code speaks the Anthropic Messages wire format. Copilot only serves
+* Claude models on its native `/v1/messages` endpoint; a gpt/gemini request
+* sent there 400s. This classifier decides, from the RESOLVED model id and its
+* catalog metadata, whether a request stays on the native passthrough
+* (`createMessages`) or is diverted to the translation shim.
+*
+* Non-regression is the whole point — every Claude model (opus / sonnet / haiku /
+* any `claude-*` or Anthropic-vendored id) MUST return "claude-passthrough" so
+* its bytes reach `createMessages` unchanged — even if future catalog metadata
+* were to (wrongly) advertise a `/responses` endpoint for it. The Claude check
+* is therefore keyed off identity (id / vendor / family), NOT the endpoint.
+*
+* Non-Claude models are diverted to the translation shim by the endpoint the
+* catalog says they serve: `/responses` models (gpt-5.5, gpt-5.3-codex, …) take
+* the Responses path (`responses-shim`), `/chat/completions` models (gemini,
+* and any chat-default model) take the chat path (`chat-shim`). The decision is
+* derived from `pickEndpoint` (catalog `supported_endpoints`), never a
+* hardcoded slug list, so it generalizes. Copilot only serves Claude models on
+* its native `/v1/messages`, so diverting every non-Claude model to a shim is
+* correct — a non-Claude request sent to `/v1/messages` would 400.
+*/
+/**
+* Match "claude"/"anthropic" as a delimiter-bounded segment anywhere in a model
+* id: at the start, or after a `/ _ . : -` path/version delimiter, and followed
+* by end-of-string, another such delimiter, or a digit. This catches catalog
+* aliases like `github/claude-3-7-sonnet` or `anthropic/…` whose vendor is
+* "github" and whose family is empty — where the token only surfaces mid-id —
+* while NOT firing on incidental substrings like `notclaude`. Deliberately
+* over-inclusive at the boundaries: we fail CLOSED toward Claude (→ passthrough)
+* so a real Claude model can never be diverted to the non-Claude shim.
+*/
+const CLAUDE_ID_RE = /(^|[/_.:-])(claude|anthropic)(?=$|[/_.:-]|\d)/i;
+/**
+* True when the target is a Claude / Anthropic model. Matches on any of:
+* catalog vendor containing "anthropic", capability family containing "claude",
+* or a Claude/anthropic path-segment (see `CLAUDE_ID_RE`) in ANY id we hold —
+* the resolved id (`modelId`), the pre-resolution request id (`originalModelId`),
+* or the catalog entry's own id (`model.id`). Conservative by design: when in
+* doubt it returns true so a Claude request can never be diverted to the shim.
+*/
+function isClaudeModel(modelId, model, originalModelId) {
+	if (model) {
+		if ((model.vendor?.toLowerCase() ?? "").includes("anthropic")) return true;
+		if ((model.capabilities?.family?.toLowerCase() ?? "").includes("claude")) return true;
+	}
+	return [
+		modelId,
+		originalModelId,
+		model?.id
+	].some((id) => typeof id === "string" && CLAUDE_ID_RE.test(id));
+}
+/**
+* Decide the route for a resolved model id + its catalog entry.
+*
+* - No model id, or a Claude model → "claude-passthrough" (existing behaviour).
+* - A non-Claude model whose catalog endpoint is `/responses` → "responses-shim".
+* - A non-Claude model whose catalog endpoint is `/chat/completions` (gemini and
+*   any chat-default model) → "chat-shim".
+* - A non-Claude model absent from the catalog (so we can't confirm an endpoint)
+*   → "claude-passthrough" (unchanged; we don't divert what we can't classify).
+* - A non-Claude model that IS in the catalog and serves NEITHER of the two shim
+*   endpoints (`pickEndpoint` → undefined) → "claude-passthrough" as well.
+*
+* Those last two land on the same route but are NOT the same answer, and the
+* coincidence is deliberate rather than a collapsed default (contrast
+* `resolveEndpointForModelId`, whose callers must tell them apart because
+* guessing there produces an opaque upstream 400). Here neither shim is even a
+* candidate: a shim can only speak `/responses` or `/chat/completions`, so
+* diverting a model that serves neither would 400 just as surely. Passthrough
+* is the better default because it is sometimes RIGHT — a non-Claude catalog
+* model advertising `/v1/messages` is served by exactly the endpoint
+* passthrough uses. It also preserves this module's fail-CLOSED-toward-Claude
+* invariant: an unclassifiable model is never diverted.
+*
+* KNOWN GAP (audited, deliberately not fixed here): a non-Claude model serving
+* only something we cannot speak at all (say `/embeddings`) also lands on
+* passthrough and will still 400 upstream — `logEndpointMismatch(modelId,
+* "/v1/messages")` logs it at the passthrough seam, but no local error is
+* raised. Closing that needs a change in `src/routes/messages/handler.ts`,
+* which this seam does not own. It is strictly narrower than the defect fixed
+* in `resolveEndpointForModelId`: no such model is reachable as a Claude Code
+* `/v1/messages` target today, whereas the plan worker's `claude-opus-5`
+* default is.
+*
+* `originalModelId` is the optional pre-resolution request id; when supplied it
+* is checked for Claude-likeness alongside the resolved id so an alias that
+* resolves to a non-Claude-looking id can't slip past.
+*/
+function classifyMessagesRoute(modelId, model, originalModelId) {
+	if (!modelId) return "claude-passthrough";
+	if (isClaudeModel(modelId, model, originalModelId)) return "claude-passthrough";
+	if (!model) return "claude-passthrough";
+	const endpoint = pickEndpoint(model);
+	if (endpoint === "responses") return "responses-shim";
+	if (endpoint === "chat") return "chat-shim";
+	return "claude-passthrough";
+}
 //#endregion
 //#region src/lib/port.ts
 const DEFAULT_PORT = 8787;
@@ -208,11 +424,22 @@ const DEFAULT_CLAUDE_MODEL_FALLBACKS = [
 * This helper detects the catalog state at launch and only opts in
 * when the backend can actually serve 1M.
 *
-* Sonnet/Haiku families are intentionally NOT given `[1m]` defaults
-* because Copilot has no 1M backend for them (and Anthropic-side
-* `modelSupports1M` doesn't list haiku at all). See
-* `src/lib/server-setup.ts:getClaudeCodeEnvVars` for the
-* `ANTHROPIC_DEFAULT_{SONNET,HAIKU,OPUS}_MODEL` tier defaults.
+* This helper answers the question only for the OPUS families, because a
+* family is what it is asked about (`-m 4.7` names no slug). Every other lead
+* slug — `-m fast`, a full slug a power user pins, the implicit budget lead —
+* goes through `withOneMSuffixForLead` (`./one-m-context`) instead, which
+* resolves the slug first and then reads the resolved entry's advertised
+* window. The two agree wherever both can be asked: a family that resolves to a
+* 1M backend is 1M by either route.
+*
+* A previous revision of this comment claimed Sonnet and Haiku were left bare
+* because "Copilot has no 1M backend for them". That was true when it was
+* written and is now false for Sonnet: the live catalog advertises
+* `max_context_window_tokens: 1_000_000` on both `claude-sonnet-5` and
+* `claude-sonnet-4.6` (Haiku 4.5 really is 200K, and is left bare by the same
+* catalog check rather than by a hardcoded family rule). Nothing here is
+* family-gated any more — the catalog decides per model, so the next family
+* that ships 1M is picked up without an edit.
 *
 * Must be called AFTER `cacheModels()` has populated `state.models`.
 * Returns the bare slug if the catalog isn't populated (resolveModel
@@ -220,6 +447,88 @@ const DEFAULT_CLAUDE_MODEL_FALLBACKS = [
 * variant" — defaulting safe-side preserves the pre-change behavior).
 */
 const DEFAULT_OPUS_FAMILY = "5";
+/** The lead `-m fast` selects. Anthropic-published dashed slug that is also the
+*  Copilot catalog id verbatim, so `resolveModel` matches it exactly. */
+const BUDGET_LEAD_MODEL = "claude-sonnet-5";
+/** Small/fast tier for a budget lead, in the two forms this codebase needs.
+*
+*  `SLUG` is the Anthropic-published DASHED form and is what goes into
+*  `ANTHROPIC_SMALL_FAST_MODEL` / `ANTHROPIC_DEFAULT_HAIKU_MODEL`: Claude Code's
+*  `/model` registry is keyed on Anthropic slugs, and seeding Copilot's dotted
+*  id there reproduces the documented `claude-opus-5` failure where the picker
+*  silently falls back to an older model. `CATALOG_ID` is Copilot's DOTTED id
+*  and is what the presence probe must test, because that is the id the catalog
+*  actually carries. `resolveModel` bridges the two at request time. */
+const BUDGET_SMALL_FAST_SLUG = "claude-haiku-4-5";
+const BUDGET_SMALL_FAST_CATALOG_ID = "claude-haiku-4.5";
+/**
+* Resolve the `-m` argument to the lead slug to launch with.
+*
+*   - `fast`      → `BUDGET_LEAD_MODEL` (budget mode)
+*   - `N.M`       → the best variant of that Opus family, via `pickClaudeDefault`
+*   - a full slug → unchanged, including Copilot slugs a power user pins
+*   - absent      → the ordinary default
+*
+* Every branch is `[1m]`-decorated against the live catalog, by
+* `pickClaudeDefault` on the two Opus-family branches and by
+* `withOneMSuffixForLead` on the other two. Pinning a MODEL is not a request to
+* give up four fifths of its context window, which is what leaving the other
+* two bare amounted to: `claude-sonnet-5` advertises a 1M window, so `-m fast`
+* and `-m claude-sonnet-5` were both budgeted locally at Claude Code's 200K
+* default and auto-compacted at roughly a fifth of the real window. The
+* decoration is catalog-gated per model, so a genuinely 200K model
+* (`claude-haiku-4.5`) still comes back bare.
+*
+* `fast` resolves to an ordinary slug rather than setting a mode flag, because
+* budget mode is keyed off the RESOLVED lead everywhere it matters (the advisor
+* escalation, the delegation prose, the small/fast tier). `-m fast` and
+* `-m claude-sonnet-5` must therefore produce identical sessions, which a flag
+* only one of the two set would break. The shared decoration is part of that
+* identity: decorating one branch and not the other would reintroduce the
+* divergence through the context budget instead of through a flag.
+*
+* Callers must keep treating any explicit `-m` as explicit: the
+* `DEFAULT_CLAUDE_MODEL_FALLBACKS` walk applies to the implicit-default path
+* only, so it cannot override a requested family (or `fast`) with an older Opus.
+*/
+function resolveLeadSlugArg(modelArg) {
+	const arg = modelArg?.trim();
+	if (!arg) return pickClaudeDefault();
+	if (arg.toLowerCase() === "fast") return withOneMSuffixForLead(BUDGET_LEAD_MODEL);
+	const opusFamilyShorthand = arg.match(/^(\d+\.\d+)$/)?.[1];
+	if (opusFamilyShorthand) return pickClaudeDefault(opusFamilyShorthand);
+	return withOneMSuffixForLead(arg);
+}
+/**
+* True when `slug` names a Claude model that is NOT an Opus tier — the
+* "budget lead" condition.
+*
+* Selecting sonnet or haiku as the lead is a decision to spend less while
+* holding quality as far as possible, and three surfaces key off it: the
+* advisor escalates to the Anthropic frontier (`resolveAdvisorModel`), the
+* injected delegation prose puts the cheap agent tiers first
+* (`buildNativeReachClauses`), and the small/fast tier drops to Haiku
+* (`getClaudeCodeEnvVars`). One definition here so those three cannot disagree
+* about what counts as a budget lead.
+*
+* Resolves before the family test so the Anthropic dashed form, Copilot's
+* dotted form, and `pickClaudeDefault`'s literal `[1m]` suffix all classify
+* alike. A non-Claude lead is not a budget lead: the concept is about picking a
+* lighter tier WITHIN the Claude family, and the gpt/gemini shim models have
+* their own cost profile that this switch says nothing about.
+*
+* CONTRACT: `slug` is an already-resolved LEAD SLUG, never a raw `-m` argument.
+* `"fast"` and the `N.M` shorthand are not Claude slugs and would classify
+* false here; run them through `resolveLeadSlugArg` first, which is what every
+* caller does. Resolving internally instead would drag `pickClaudeDefault`'s
+* catalog dependency into a pure predicate and make the same input answer
+* differently before and after the catalog loads.
+*/
+function isBudgetClaudeLead(slug) {
+	if (!slug) return false;
+	if (!isClaudeModel(slug)) return false;
+	return !/opus/i.test(resolveModel(slug));
+}
 function pickClaudeDefault(opusFamily = DEFAULT_OPUS_FAMILY) {
 	const dotted = opusFamily.replace(/-/g, ".");
 	const bareSlug = `claude-opus-${dotted.replace(/\./g, "-")}`;
@@ -11888,6 +12197,123 @@ function objectProp(description, properties, required) {
 function anyProp(description) {
 	return { description };
 }
+//#endregion
+//#region src/lib/tree-sitter-assets/files.ts
+/** WASM assets code search loads from tree-sitter-wasms. */
+const TREE_SITTER_GRAMMAR_FILES = {
+	typescript: "tree-sitter-typescript.wasm",
+	tsx: "tree-sitter-tsx.wasm",
+	javascript: "tree-sitter-javascript.wasm",
+	python: "tree-sitter-python.wasm",
+	go: "tree-sitter-go.wasm",
+	rust: "tree-sitter-rust.wasm",
+	java: "tree-sitter-java.wasm",
+	c: "tree-sitter-c.wasm",
+	cpp: "tree-sitter-cpp.wasm"
+};
+const TREE_SITTER_RUNTIME_FILE = "tree-sitter.wasm";
+//#endregion
+//#region src/lib/tree-sitter-assets/provision.ts
+const PUBLISH_ATTEMPTS = 3;
+let _provisioned$1 = false;
+let _inFlight$1;
+/**
+* Materialize every required WASM asset. Single-flight and success-cached;
+* transient failures remain retryable. Never throws to the launcher.
+*/
+function provisionTreeSitterAssets() {
+	if (_provisioned$1) return Promise.resolve();
+	if (_inFlight$1) return _inFlight$1;
+	_inFlight$1 = Promise.resolve().then(() => provisionImpl()).then((complete) => {
+		if (complete) _provisioned$1 = true;
+	}).finally(() => {
+		_inFlight$1 = void 0;
+	});
+	return _inFlight$1;
+}
+function provisionImpl() {
+	try {
+		const require = createRequire(import.meta.url);
+		const grammarPackage = require.resolve("tree-sitter-wasms/package.json");
+		const grammarRoot = path.join(path.dirname(grammarPackage), "out");
+		const runtime = require.resolve("web-tree-sitter/tree-sitter.wasm");
+		const destination = PATHS.TREE_SITTER_ASSETS_DIR;
+		mkdirSync(destination, { recursive: true });
+		let complete = publishAsset(runtime, path.join(destination, TREE_SITTER_RUNTIME_FILE));
+		for (const filename of Object.values(TREE_SITTER_GRAMMAR_FILES)) complete = publishAsset(path.join(grammarRoot, filename), path.join(destination, filename)) && complete;
+		return complete;
+	} catch (err) {
+		consola.debug("[tree-sitter-assets] provisioning skipped:", err);
+		return false;
+	}
+}
+/**
+* Publish through a unique same-directory temporary file. Never remove the
+* destination first: a concurrent parser must see either the prior complete
+* file or the new complete file, never a missing/partial path. A losing racer
+* accepts the winner when its bytes match the source.
+*/
+function publishAsset(source, destination) {
+	let bytes;
+	try {
+		bytes = readFileSync(source);
+	} catch {
+		return false;
+	}
+	if (matchesContent(destination, bytes)) return true;
+	for (let attempt = 0; attempt < PUBLISH_ATTEMPTS; attempt++) {
+		const tmp = `${destination}.${process.pid}-${attempt}.tmp`;
+		try {
+			writeFileSync(tmp, bytes);
+			renameSync(tmp, destination);
+			return true;
+		} catch {
+			try {
+				rmSync(tmp, { force: true });
+			} catch {}
+			if (matchesContent(destination, bytes)) return true;
+		}
+	}
+	return false;
+}
+/**
+* Whether the published file is byte-identical to the source.
+*
+* Content, not size: a grammar upgrade that happens to keep the same byte
+* length would otherwise never propagate, and the stale copy would shadow the
+* package's newer file permanently — a silent, self-perpetuating wrong answer.
+* The size check first keeps the common case to one `stat`.
+*/
+function matchesContent(file, bytes) {
+	try {
+		const stat = statSync(file);
+		if (!stat.isFile() || stat.size !== bytes.byteLength) return false;
+		return readFileSync(file).equals(bytes);
+	} catch {
+		return false;
+	}
+}
+/**
+* Whether the stable directory holds the COMPLETE asset set: the runtime plus
+* every grammar.
+*
+* Callers must gate on the whole set, never on the one file they are about to
+* read. web-tree-sitter enforces a language-ABI version between the runtime and
+* the grammars, so adopting a stable runtime while grammars still come from the
+* package tree (or the reverse) can pair mismatched builds. That surfaces as a
+* caught `Language.load` failure, which silently disables structural ranking —
+* the exact silent degradation this whole change is meant to end.
+*/
+function stableTreeSitterAssetsComplete() {
+	const dir = PATHS.TREE_SITTER_ASSETS_DIR;
+	return [TREE_SITTER_RUNTIME_FILE, ...Object.values(TREE_SITTER_GRAMMAR_FILES)].every((name) => {
+		try {
+			return statSync(path.join(dir, name)).isFile();
+		} catch {
+			return false;
+		}
+	});
+}
 /**
 * Extension → grammar key. Grammars not in this map skip structural
 * parsing (the hit falls back to the regex SYMBOL_REGEX heuristic for
@@ -11915,22 +12341,11 @@ const EXTENSION_TO_LANG = {
 	".hxx": "cpp"
 };
 /**
-* Grammar key → wasm filename under `node_modules/tree-sitter-wasms/out/`.
-* Resolved at runtime from `node_modules`; the file paths are stable
-* because `tree-sitter-wasms` ships prebuilt binaries (no per-install
-* codegen).
+* Grammar key → wasm filename. The stable APP_DIR copy is preferred; the
+* original `node_modules/tree-sitter-wasms/out/` directory remains the
+* first-run fallback while background provisioning completes.
 */
-const GRAMMAR_FILES = {
-	typescript: "tree-sitter-typescript.wasm",
-	tsx: "tree-sitter-tsx.wasm",
-	javascript: "tree-sitter-javascript.wasm",
-	python: "tree-sitter-python.wasm",
-	go: "tree-sitter-go.wasm",
-	rust: "tree-sitter-rust.wasm",
-	java: "tree-sitter-java.wasm",
-	c: "tree-sitter-c.wasm",
-	cpp: "tree-sitter-cpp.wasm"
-};
+const GRAMMAR_FILES = TREE_SITTER_GRAMMAR_FILES;
 /**
 * Per-language definition-shape node types. When a matched identifier
 * sits inside one of these nodes AND is at the node's "name" position,
@@ -12064,12 +12479,16 @@ function getLanguageKeyForPath(filePath) {
 }
 let _grammarBundle;
 /**
-* Resolve the `tree-sitter-wasms/out/` directory at the package root.
-* `require.resolve` is used through a try/catch — the bundled-only
-* fallback runs in environments where node_modules has been pruned to
-* just runtime deps.
+* Resolve the grammar directory. The stable APP_DIR copy wins only when the
+* COMPLETE set is present; otherwise `require.resolve` supplies the
+* package-tree fallback for first launch or a best-effort provisioning failure.
+*
+* All-or-nothing on purpose — see `stableTreeSitterAssetsComplete()`: mixing a
+* stable runtime with package-tree grammars can pair mismatched ABI builds and
+* silently disable structural ranking.
 */
 function resolveGrammarRoot() {
+	if (stableTreeSitterAssetsComplete()) return PATHS.TREE_SITTER_ASSETS_DIR;
 	try {
 		const pkgPath = __require.resolve("tree-sitter-wasms/package.json");
 		return path$1.join(path$1.dirname(pkgPath), "out");
@@ -12078,6 +12497,15 @@ function resolveGrammarRoot() {
 	}
 }
 /**
+* web-tree-sitter normally resolves this sidecar relative to its JS module.
+* Prefer the durable copy, but only under the same all-present gate the
+* grammars use, so the runtime and the grammars always come from one install.
+*/
+function parserInitOptions() {
+	if (!stableTreeSitterAssetsComplete()) return void 0;
+	return { locateFile: () => path$1.join(PATHS.TREE_SITTER_ASSETS_DIR, TREE_SITTER_RUNTIME_FILE) };
+}
+/**
 * Pre-load all grammars at module-init time so the first search
 * doesn't pay a ~500ms cold-start cost. The Promise is captured at
 * import time and awaited per-call; per-grammar failures are caught
@@ -12088,7 +12516,7 @@ function getGrammarBundle() {
 	_grammarBundle = { ready: (async () => {
 		const out = /* @__PURE__ */ new Map();
 		try {
-			await Parser.init();
+			await Parser.init(parserInitOptions());
 		} catch (err) {
 			consola.warn(`[code_search] tree-sitter Parser.init failed; structural ranking disabled: ${err.message}`);
 			return out;
@@ -13271,16 +13699,19 @@ const STRUCTURAL_CACHE_MAX = 64;
 const SYMBOL_REGEX = /^(?:export\s+)?(?:default\s+)?(?:async\s+)?(?:public\s+|private\s+|protected\s+|static\s+|abstract\s+|readonly\s+)*(?:function|class|interface|type|enum|def|fn|trait|impl|module|namespace|const|let|var)\s+[A-Za-z_$]/;
 let _rgResolution;
 /**
-* Tri-tier resolution. Memoized. Mirrors cc-backup
+* Four-tier resolution. Memoized. Mirrors cc-backup
 * `src/utils/ripgrep.ts:31-65`.
 *
 *   1. System rg on PATH — use the literal command name `"rg"` (NOT
 *      the absolute path). This leverages NoDefaultCurrentDirectory-
 *      InExePath on Windows, preventing PATH-hijacking via a
 *      malicious ./rg.exe in the proxy's cwd.
-*   2. Bundled via `@vscode/ripgrep` — falls back to the per-platform
+*   2. Router-owned toolbelt copy under APP_DIR. Its absolute path is
+*      safe because it cannot resolve to a planted binary in the cwd,
+*      and it survives a temp-hosted bunx package tree being reaped.
+*   3. Bundled via `@vscode/ripgrep` — falls back to the per-platform
 *      binary that `optionalDependencies` installed.
-*   3. Throw — surfaced to the caller as an MCP isError response.
+*   4. Throw — surfaced to the caller as an MCP isError response.
 */
 function resolveRipgrep() {
 	if (_rgResolution) return _rgResolution;
@@ -13291,6 +13722,14 @@ function resolveRipgrep() {
 		};
 		return _rgResolution;
 	}
+	const toolbeltPath = path$1.join(PATHS.TOOLBELT_BIN_DIR, process.platform === "win32" ? "rg.exe" : "rg");
+	if (existsSync(toolbeltPath)) {
+		_rgResolution = {
+			rgPath: toolbeltPath,
+			source: "toolbelt"
+		};
+		return _rgResolution;
+	}
 	try {
 		const mod = __require("@vscode/ripgrep");
 		if (mod.rgPath && existsSync(mod.rgPath)) {
@@ -17206,14 +17645,19 @@ function findPackageRoot(startDir, maxHops = 10) {
 	}
 }
 /**
-* Resolve the github-router package root. Uses two sources in order:
-*   1. process.argv[1] — the entrypoint script, walks up from there.
-*   2. import.meta.url of THIS module, walks up from there.
-*   3. process.cwd() as last resort.
+* Resolve the github-router package root. Uses sources in order:
+*   1. The explicit root baked into the relocated hook launcher's argv. From
+*      `<APP_DIR>/hooks/`, neither entrypoint walk can find the package and cwd
+*      is the user's workspace, so this source must win when present.
+*   2. process.argv[1] — the entrypoint script, walks up from there.
+*   3. import.meta.url of THIS module, walks up from there.
+*   4. process.cwd() as last resort.
 *
-* Robust across bun (src/main.ts) and node (dist/main.js) launch paths.
+* Robust across relocated hooks, bun (src/main.ts), and node (dist/main.js).
 */
 function packageRoot() {
+	const explicit = explicitPackageRoot();
+	if (explicit) return explicit;
 	const entryPath = typeof process$1?.argv?.[1] === "string" ? process$1.argv[1] : void 0;
 	if (entryPath) {
 		const fromEntry = findPackageRoot(path.dirname(entryPath));
@@ -18470,7 +18914,7 @@ function logAudit$1(record) {
 		try {
 			const fs = await import("node:fs/promises");
 			const path = await import("node:path");
-			const { PATHS } = await import("./paths-DN3Nio42.js");
+			const { PATHS } = await import("./paths-CV9K7Xqm.js");
 			const dir = path.join(PATHS.APP_DIR, "browser-mcp");
 			await fs.mkdir(dir, { recursive: true });
 			const line = JSON.stringify({
@@ -19849,70 +20293,6 @@ function detectAgentCall(input) {
 	});
 }
 //#endregion
-//#region src/services/copilot/endpoint.ts
-/**
-* Catalog spellings that mean each of our two clients. Copilot is not
-* self-consistent about the `/v1` prefix — the live catalog advertises
-* `/v1/messages` prefixed but `/chat/completions` bare, and this repo's own
-* fixtures carry both forms — so an exact-match on the bare spelling alone
-* silently misses a real shape. `src/lib/model-validation.ts` already
-* normalizes the same way (`ENDPOINT_ALIASES`); this keeps the two agreeing.
-*
-* Matching is EXACT against this set, never a suffix/`includes` test: a
-* `ws:/responses` (websocket transport) entry is NOT the `/responses` HTTP
-* client and must keep resolving to "serves neither".
-*/
-const CHAT_ENDPOINTS = /* @__PURE__ */ new Set(["/chat/completions", "/v1/chat/completions"]);
-const RESPONSES_ENDPOINTS = /* @__PURE__ */ new Set(["/responses", "/v1/responses"]);
-/**
-* Decide which endpoint to call for a model from its catalog
-* `supported_endpoints`. Prefers `/chat/completions` when available (the
-* simpler, more widely-supported shape) and falls back to `/responses` for
-* models that ONLY serve the Responses API — the gpt-5.x family except
-* `gpt-5-mini` / `gpt-5.4` (e.g. `gpt-5.4-mini`, `gpt-5.5`, the
-* `*-codex` models). Returns undefined when the model serves neither, so a
-* caller can skip it rather than 400 on `unsupported_api_for_model`.
-*
-* A model that OMITS `supported_endpoints` is treated as chat-eligible: the
-* catalog historically omits the field for chat-default models, and
-* excluding those would be a worse regression than the gap this guards.
-*/
-function pickEndpoint(model) {
-	const eps = model.supported_endpoints;
-	if (!eps || eps.length === 0) return "chat";
-	if (eps.some((e) => CHAT_ENDPOINTS.has(e))) return "chat";
-	if (eps.some((e) => RESPONSES_ENDPOINTS.has(e))) return "responses";
-}
-/**
-* `pickEndpoint` by model id against the live catalog, WITHOUT collapsing
-* "absent from the catalog" into "serves neither of our endpoints".
-*
-* This function deliberately has no default. The predecessor
-* (`endpointForModelId`) returned `pickEndpoint(found) ?? "chat"`, which
-* coerced both cases to "chat" — defensible for an unknown id, silently wrong
-* for a catalog model serving only, say, `/v1/messages`: the caller would drive
-* it through the chat client and get an opaque upstream 400 with no local
-* signal about the real cause. `src/lib/browser-mcp/compressor.ts` already
-* treats that case correctly (`if (!endpoint) continue`); this makes the same
-* distinction available to callers that resolve by id.
-*
-* Callers that legitimately want the chat default for an unknown id can still
-* have it — they just have to write it, per case, on purpose.
-*/
-function resolveEndpointForModelId(id) {
-	const found = state.models?.data?.find((m) => m.id === id);
-	if (!found) return { kind: "unknown-model" };
-	const endpoint = pickEndpoint(found);
-	if (endpoint) return {
-		kind: "endpoint",
-		endpoint
-	};
-	return {
-		kind: "unreachable",
-		endpoints: found.supported_endpoints ?? []
-	};
-}
-//#endregion
 //#region src/lib/browser-mcp/compressor.ts
 /**
 * Static fallback chain for the inner compressor. Order is preference:
@@ -22715,7 +23095,7 @@ const EMPTY_USAGE = {
 		total: 0
 	}
 };
-const DEFAULT_MODEL$1 = {
+const DEFAULT_MODEL = {
 	id: "unknown",
 	name: "unknown",
 	api: "unknown",
@@ -22737,7 +23117,7 @@ function createMutableAgentState(initialState) {
 	let messages = initialState?.messages?.slice() ?? [];
 	return {
 		systemPrompt: initialState?.systemPrompt ?? "",
-		model: initialState?.model ?? DEFAULT_MODEL$1,
+		model: initialState?.model ?? DEFAULT_MODEL,
 		thinkingLevel: initialState?.thinkingLevel ?? "off",
 		get tools() {
 			return tools;
@@ -23462,18 +23842,174 @@ function resolveModelAndThinking(opts) {
 	if (!clamp) clamp = allowed[0];
 	return mkOk(clamp);
 }
+const CATALOG_PRICE_SCALE = 1e9;
+const TOKENS_PER_MILLION = 1e6;
+/**
+* Last-resort per-1M-token prices, recorded from the live catalog on
+* 2026-08-12. The LIVE catalog always wins; this only fills in when
+* `state.models` is unpopulated, which in practice means the startup catalog
+* fetch failed. Without it the injected roster degrades to bare names and the
+* model loses the cost signal entirely for that session.
+*
+* A hardcoded copy of a value that HAS a live source is a second source of
+* truth, and this one has already been observed to drift: two figures written
+* from memory into a commit message (`gpt-5.3-codex` 400/1600, `gpt-5.5`
+* 500/2000) were both wrong against the live catalog (175/1400 and 500/3000).
+* That is exactly the silent-misroute failure this table risks, so
+* `warnOnTokenPriceDrift()` compares it against the live catalog once at
+* startup and logs any disagreement rather than letting a stale number sit
+* here indefinitely.
+*
+* This is NOT the same trade as `INDICATIVE_TOKENS_PER_SECOND`: throughput
+* cannot be derived from the catalog at all, so hardcoding is the only option
+* there. Price can, so hardcoding is strictly a degraded fallback.
+*/
+const FALLBACK_TOKEN_PRICES = Object.freeze({
+	"gpt-5.6-luna": {
+		in: 20,
+		out: 120
+	},
+	"gpt-5.6-terra": {
+		in: 200,
+		out: 1200
+	},
+	"gpt-5.4-mini": {
+		in: 75,
+		out: 450
+	},
+	"claude-sonnet-5": {
+		in: 200,
+		out: 1e3
+	},
+	"gpt-5.3-codex": {
+		in: 175,
+		out: 1400
+	},
+	"claude-haiku-4.5": {
+		in: 100,
+		out: 500
+	},
+	"claude-opus-5": {
+		in: 500,
+		out: 2500
+	},
+	"gpt-5.6-sol": {
+		in: 500,
+		out: 3e3
+	},
+	"grok-4.5": {
+		in: 200,
+		out: 600
+	},
+	"gpt-5.5": {
+		in: 500,
+		out: 3e3
+	},
+	"gemini-3.6-flash": {
+		in: 150,
+		out: 750
+	},
+	"gemini-3.5-flash": {
+		in: 150,
+		out: 900
+	},
+	"gemini-3.1-pro-preview": {
+		in: 200,
+		out: 1200
+	}
+});
+/**
+* Compare every `FALLBACK_TOKEN_PRICES` entry against the live catalog and warn
+* on disagreement. Call once after the catalog is populated. Makes fallback
+* staleness VISIBLE instead of silent: a stale entry only ever surfaces on the
+* degraded path, where nobody is looking, so without this it could be wrong for
+* months. Warn-only by design — a price mismatch must never block a launch.
+*/
+function warnOnTokenPriceDrift() {
+	for (const [id, hardcoded] of Object.entries(FALLBACK_TOKEN_PRICES)) {
+		const live = livePricesFor(id);
+		if (!live) continue;
+		if (live.in !== hardcoded.in || live.out !== hardcoded.out) consola.warn(`[model-resolve] FALLBACK_TOKEN_PRICES is stale for ${id}: hardcoded ${hardcoded.in}/${hardcoded.out}, live catalog ${live.in}/${live.out}. Update the table in src/lib/worker-agent/model-resolve.ts.`);
+	}
+}
+/** Live-catalog price lookup with no fallback. Split out so the drift check can
+*  compare against the catalog without the fallback masking a disagreement. */
+function livePricesFor(modelId) {
+	const prices = state.models?.data.find((model) => model.id === modelId)?.billing?.token_prices;
+	if (!prices || typeof prices.batch_size !== "number" || !Number.isSafeInteger(prices.batch_size) || prices.batch_size <= 0 || typeof prices.input_price !== "number" || !Number.isFinite(prices.input_price) || prices.input_price < 0 || typeof prices.output_price !== "number" || !Number.isFinite(prices.output_price) || prices.output_price < 0) return;
+	const toPerMillion = (price) => price / CATALOG_PRICE_SCALE * TOKENS_PER_MILLION / prices.batch_size;
+	return {
+		in: toPerMillion(prices.input_price),
+		out: toPerMillion(prices.output_price)
+	};
+}
+/**
+* A model's per-1M-token prices: live catalog first, then the dated fallback
+* table. Still returns undefined for a model in neither, so a caller never
+* mistakes a guess for a fact — the fallback covers models we have actually
+* recorded, not every id.
+*/
+function catalogTokenPrices(modelId) {
+	return livePricesFor(modelId) ?? FALLBACK_TOKEN_PRICES[modelId];
+}
+/**
+* Approximate output tokens/sec, median of n=3 per model, measured 2026-08-12
+* through this proxy. Reproduce with `bun scripts/bench-model-speed.ts` — the
+* harness is committed precisely so these numbers can be re-derived and
+* challenged instead of being trusted. Rounded coarsely on purpose: run-to-run
+* variance is large (`gpt-5.6-sol` measured 22 in an early n=1 pass and 74 at
+* n=3), so any digit beyond the leading one or two would be false precision.
+*
+* Wall clock includes time-to-first-token, which is why an early n=1 pass put
+* `gemini-3.1-pro-preview` at 9: that response emitted only 66 tokens, so TTFT
+* dominated. Reasoning tokens are timed but may not appear in `output_tokens`,
+* so heavy-reasoning models are penalised here.
+*
+* This is a deliberately hardcoded, coarse speed hint, indicative and never a
+* per-call benchmark: a recoverable speed retry is safer than a quality score
+* that silently misroutes.
+*
+* NOT the whole picture for agent work. The benchmark also measures p50 latency
+* to a trivial tool call, which is the workload an agent model actually spends
+* its turns on, and the ordering differs from raw generation: `gpt-5.6-sol`
+* generates at 75 but takes ~4.3s to reach a tool call, while `gpt-5.6-luna`
+* takes ~0.9s. That figure is deliberately NOT surfaced to the model, because a
+* second speed axis invites optimising a routing choice that policy already
+* settles (see the decorrelation note below).
+*/
+const INDICATIVE_TOKENS_PER_SECOND = Object.freeze({
+	"gpt-5.6-luna": 120,
+	"gpt-5.6-terra": 100,
+	"gpt-5.4-mini": 100,
+	"claude-sonnet-5": 100,
+	"gpt-5.3-codex": 85,
+	"claude-haiku-4.5": 85,
+	"claude-opus-5": 80,
+	"gpt-5.6-sol": 75,
+	"grok-4.5": 70,
+	"gpt-5.5": 65,
+	"gemini-3.6-flash": 45,
+	"gemini-3.5-flash": 40,
+	"gemini-3.1-pro-preview": 25
+});
+/** Returns the approximate, indicative output speed when it was measured. */
+function indicativeTokensPerSecond(modelId) {
+	return INDICATIVE_TOKENS_PER_SECOND[modelId];
+}
 /** Worker-usable models need a big enough window to be worth delegating to. */
 const CATALOG_MIN_CONTEXT = 2e5;
 /**
 * Derived view of the live catalog: every model a worker could actually be
 * pointed at, with the metadata needed to choose between them.
 *
-* DERIVED ONLY, and that is the whole design. A one-liner like "strong
+* Derived facts only, with one explicitly-labelled exception:
+* `INDICATIVE_TOKENS_PER_SECOND` is a dated, coarse measurement whose speed
+* signal is recoverable by retrying a slow selection. A one-liner like "strong
 * reasoning, weak long-context recall" cannot be computed from catalog
 * metadata — it is editorial, it goes stale silently as vendors ship, and the
 * asymmetry is brutal: a MISSING characterization costs one suboptimal pick
 * the model recovers from, while a WRONG one misroutes invisibly at the call
-* site. So this ships facts and lets the caller judge.
+* site. So this ships facts, the recoverable speed hint, and no quality score.
 *
 * It exists because the hardcoded chains cannot discover anything. Models are
 * live in the catalog that appear nowhere in `src/` — nobody evaluated them
@@ -23499,13 +24035,16 @@ function buildCatalogView() {
 		if (ctx < CATALOG_MIN_CONTEXT) continue;
 		const efforts = (supports.reasoning_effort ?? []).filter((effort) => WORKER_THINKING_LEVELS.includes(effort));
 		if (efforts.length === 0) continue;
+		const prices = catalogTokenPrices(model.id);
+		const tps = indicativeTokensPerSecond(model.id);
 		rows.push({
 			id: model.id,
 			vendor: model.vendor,
 			ctx,
 			...limits?.max_output_tokens ? { maxOut: limits.max_output_tokens } : {},
 			efforts,
-			...model.model_picker_price_category ? { cost: model.model_picker_price_category } : {}
+			...prices ?? {},
+			...tps === void 0 ? {} : { tps }
 		});
 	}
 	return rows.sort((a, b) => a.id.localeCompare(b.id));
@@ -26511,13 +27050,12 @@ function geminiAvailable(source = state) {
 * one walk instead of hand-copying it. Ids are matched EXACTLY against
 * `catalog.id` — no slug translation, matching the pre-existing behavior.
 *
-* `minContextTokens` is OPT-IN because the two constraints are genuinely
-* per-agent: the `generic*` chains promise 1M end to end, while `scoutModel`
-* deliberately keeps a 400K last resort for its wider availability. Enforcing
-* the floor here rather than by comment is what stops a chain silently
-* degrading when an id's advertised window shrinks upstream — `withOneMSuffix`
-* would then just omit the `[1m]` bracket, and the agent would be budgeted at
-* Claude Code's 200K default with no signal that anything changed.
+* `minContextTokens` is OPT-IN because the constraint is genuinely per-agent:
+* the conditional cheaper-tier agents promise 1M end to end. Enforcing the
+* floor here rather than by comment is what stops a chain silently degrading
+* when an id's advertised window shrinks upstream — `withOneMSuffix` would then
+* just omit the `[1m]` bracket, and the agent would be budgeted at Claude Code's
+* 200K default with no signal that anything changed.
 */
 function firstPresentInCatalog(chain, opts) {
 	const models = state.models?.data;
@@ -26607,61 +27145,47 @@ function scribeModel() {
 * (same behavior as before `scout` existed) rather than to an expensive
 * impostor wearing the cheap agent's name.
 *
-* `gpt-5.6-luna` sits between the two originals because the old chain fell
-* straight from a 1M model to 400K `gpt-5.4-mini`, which loses the `[1m]`
-* bracket and drops Claude Code's accounting to its 200K default. Luna is
-* cheaper than mini, keeps 1M, and is cross-vendor from the primary, so it
-* covers a Gemini-side outage that a same-vendor entry would not.
+* `gpt-5.6-luna` leads because it is the cheapest 1M-context model in the
+* catalog; `gemini-3.6-flash` remains the cross-vendor fallback so an OpenAI-side
+* outage does not remove the scout. Both entries must continue advertising at
+* least 1M context so Claude Code's `[1m]` accounting remains honest if an
+* upstream catalog entry shrinks.
 *
-* Deliberately NO `minContextTokens` floor, unlike the `generic*` resolvers:
-* `gpt-5.4-mini` is retained as the last resort precisely BECAUSE it is the
-* widest-availability id here (its `restricted_to` includes `individual_trial`
-* and `edu`, which neither flash nor luna does). On a thin non-enterprise
-* catalog a 400K scout beats no scout.
+* This chain deliberately uses literal ids rather than `EXPLORE_DEFAULT_MODEL`:
+* the explore worker default and scout's cross-vendor fallback are independent
+* policies, so retuning one must not silently collapse the other. There is no
+* 400K last resort. On a catalog carrying neither chain member, `scout` is
+* dropped rather than inheriting the lead or presenting a narrower-context agent.
 */
+const SCOUT_MODEL_CHAIN = Object.freeze(["gpt-5.6-luna", "gemini-3.6-flash"]);
 function scoutModel() {
-	return firstPresentInCatalog([
-		EXPLORE_DEFAULT_MODEL,
-		"gpt-5.6-luna",
-		DEFAULT_MODEL
-	], { requireToolCalls: true });
-}
-/** Model for `generic` — the mid-tier catch-all. Absent → the agent is dropped.
-*
-*  `gpt-5.6-sol` is deliberately NOT in this chain: the OpenAI frontier coder is
-*  already `implementer`'s job, and a catch-all that quietly costs frontier
-*  rates is the opposite of what this agent is for. Both entries are 1M+ and
-*  mid-to-high capability, which is the most the description may claim. */
-function genericModel() {
-	return firstPresentInCatalog(["gpt-5.6-terra", REVIEW_DEFAULT_MODEL], {
+	return firstPresentInCatalog(SCOUT_MODEL_CHAIN, {
 		requireToolCalls: true,
 		minContextTokens: ONE_M_TOKENS
 	});
 }
-/** Model for `generic-fast` — the Gemini flash tier. Absent → dropped.
+/** Model for `implementer-fast` — the cheaper implementation tier. Absent →
+*  the agent is dropped.
 *
-*  Both entries are the same vendor, context, price point and `minimal..high`
-*  effort ladder, so the agent's identity survives the fallback intact. That is
-*  why the fallback is `gemini-3.5-flash` and not `gpt-5.6-luna`, which would
-*  otherwise be the natural cross-vendor choice: luna is `genericCheapModel`'s
-*  only entry, and using it in both places would collapse two roster entries
-*  onto one model in the degraded case. */
-function genericFastModel() {
-	return firstPresentInCatalog([EXPLORE_DEFAULT_MODEL, "gemini-3.5-flash"], {
+*  `gpt-5.6-sol` is deliberately NOT in this chain: changes needing frontier
+*  judgment already belong to `implementer`, while this agent handles
+*  well-specified, mechanical changes at a lower tier. Both entries are 1M+;
+*  their different speed and effort properties stay out of shared claims. */
+function implementerFastModel() {
+	return firstPresentInCatalog(["gpt-5.6-terra", REVIEW_DEFAULT_MODEL], {
 		requireToolCalls: true,
 		minContextTokens: ONE_M_TOKENS
 	});
 }
-/** Model for `generic-cheap` — the cheapest catch-all. Absent → dropped.
+/** Model for `general-purpose-fast` — the fast, cheapest catch-all. Absent →
+*  dropped.
 *
-*  Single-entry by design (see `genericFastModel` for why luna is not shared).
-*  `gpt-5.6-luna` is the cheapest id in the catalog and undercuts even the 400K
-*  `gpt-5.4-mini`, while carrying 1.05M context and the full `none..max` effort
-*  ladder — so unlike the flash tier it propagates a CLI effort pick above
-*  `high` rather than clamping it. No `-mini`/`-lite`/`-haiku` model in the
-*  catalog serves 1M, which is why the cheap catch-all is a `gpt-5.6-*` slug
-*  rather than a mini one. */
-function genericCheapModel() {
+*  Single-entry by design. `gpt-5.6-luna` is the cheapest model in the live
+*  catalog and measured fastest among the catch-all candidates, while carrying
+*  1.05M context and the full `none..max` effort ladder. No
+*  `-mini`/`-lite`/`-haiku` model in the catalog serves 1M, which is why this
+*  catch-all uses a `gpt-5.6-*` slug rather than a mini one. */
+function generalPurposeFastModel() {
 	return firstPresentInCatalog(["gpt-5.6-luna"], {
 		requireToolCalls: true,
 		minContextTokens: ONE_M_TOKENS
@@ -26671,15 +27195,14 @@ function genericCheapModel() {
 * Gate for the worker tools (`explore`, `review`, `implement`).
 *
 * Returns true iff BOTH:
-*   1. Copilot's live catalog (`state.models?.data`) contains the
-*      worker default model (`gpt-5.4-mini`, used by explore)
-*      AND that entry advertises `capabilities.supports.tool_calls ===
-*      true`. The worker loop is function-calling; a model that can't
-*      emit tool_calls is unusable, so dormant-register (omit from
-*      `tools/list`) keeps the surface honest. (The implement default
-*      `gpt-5.6-sol` is NOT gated here — if it's absent, implement calls
-*      surface a clean resolve error rather than disabling all worker
-*      tools, since explore/review still work.)
+*   1. Copilot's live catalog (`state.models?.data`) contains any model in the
+*      ordered worker gate chain (`gpt-5.6-luna` → `gpt-5.4-mini`) and that
+*      entry advertises `capabilities.supports.tool_calls === true`. Luna leads
+*      on qualifying tiers; mini preserves the worker surface on individual
+*      trial and education catalogs. The catalog is the entitlement signal.
+*      The worker loop is function-calling, so a model without tool calls is
+*      unusable. Per-mode defaults are NOT gated here — an absent mode default
+*      surfaces a clean resolve error rather than disabling all worker tools.
 *   2. The operator hasn't set `GH_ROUTER_DISABLE_WORKER_TOOLS=1`
 *      (opt-out — workers ship enabled by default per plan).
 *
@@ -26688,17 +27211,12 @@ function genericCheapModel() {
 * validation in the engine, which surfaces a clean `isError`
 * envelope with the catalog's eligible model ids on mismatch.
 *
-* `WORKER_DEFAULT_MODEL` is imported (aliased from `DEFAULT_MODEL`)
-* from `src/lib/worker-agent` so the engine owns the single source
-* of truth.
+* `WORKER_DEFAULT_MODEL_CHAIN` is imported from `src/lib/worker-agent` so the
+* engine owns the single source of truth for both gating and fallback order.
 */
 function workerToolsEnabled() {
 	if (process.env.GH_ROUTER_DISABLE_WORKER_TOOLS === "1") return false;
-	const models = state.models?.data;
-	if (!models) return false;
-	const found = models.find((m) => m.id === DEFAULT_MODEL);
-	if (!found) return false;
-	return found.capabilities?.supports?.tool_calls === true;
+	return firstPresentInCatalog(DEFAULT_MODEL_CHAIN, { requireToolCalls: true }) != null;
 }
 /**
 * Gate for the compound L2 browser tools (`browser_act`, `browser_observe`,
@@ -26805,10 +27323,10 @@ function artifactToolsEnabled() {
 *      browser is on disk. The browse agent drives the SAME Chrome/Edge
 *      bridge as the raw `browser_*` tools, so it can't be useful without
 *      that surface enabled.
-*   2. The browse default model (`BROWSE_DEFAULT_MODEL`, `gpt-5.4-mini`)
+*   2. The browse default model (`BROWSE_DEFAULT_MODEL`, `gpt-5.6-luna`)
 *      is in Copilot's live catalog AND `pickEndpoint()` resolves a
 *      reachable endpoint for it. Unlike `workerToolsEnabled()` (which
-*      checks `tool_calls` on the gemini default), the browse default is
+*      checks `tool_calls` on the shared gate sentinel), the browse default is
 *      a `/responses`-only gpt-5.x model — `pickEndpoint` is the right
 *      reachability probe (it returns undefined only when the model
 *      serves neither chat nor responses).
@@ -27353,8 +27871,26 @@ function logTelemetry(t) {
 function toolAcceptsWorkspace(tool) {
 	return tool.capability === "worker" || tool.toolNameHttp === "code" || tool.toolNameHttp === "run_workflow";
 }
+/**
+* Fold the per-session `X-GH-Workspace` header into `args.workspace` when the
+* caller left it empty, and REPORT which of the two the tool ended up with.
+*
+* The return value is the load-bearing part. This function mutates `args`, so
+* once it has run a header-derived workspace is byte-indistinguishable from one
+* the caller chose — and those two cases warrant very different treatment. A
+* caller that named a directory has told us where it is; a header is a
+* connection-level default that may be stale (it is computed by a helper Claude
+* Code runs, and the calling agent may since have moved into a git worktree).
+* `runWorkerToolCall` uses the distinction to decide what to tell the caller
+* about the tree it actually ran in, so the provenance must survive the merge.
+*/
 function applySessionWorkspace(args, sessionWorkspace, tool) {
-	if ((!tool || toolAcceptsWorkspace(tool)) && typeof sessionWorkspace === "string" && sessionWorkspace.length > 0 && path.isAbsolute(sessionWorkspace) && (args.workspace === void 0 || args.workspace === "")) args.workspace = sessionWorkspace;
+	if (args.workspace !== void 0 && args.workspace !== "") return "argument";
+	if ((!tool || toolAcceptsWorkspace(tool)) && typeof sessionWorkspace === "string" && sessionWorkspace.length > 0 && path.isAbsolute(sessionWorkspace)) {
+		args.workspace = sessionWorkspace;
+		return "session";
+	}
+	return "absent";
 }
 async function handleToolsCall(body, scope, sessionWorkspace) {
 	const params = body.params ?? {};
@@ -27388,7 +27924,8 @@ async function handleToolsCall(body, scope, sessionWorkspace) {
 		personaContext = typeof args.context === "string" ? args.context : void 0;
 		if (args.imagePaths !== void 0) {
 			if (!Array.isArray(args.imagePaths) || args.imagePaths.some((v) => typeof v !== "string")) return rpcError(body.id, RPC_INVALID_PARAMS, "tools/call: arguments.imagePaths must be an array of strings");
-			const loaded = await loadPeerImages(args.imagePaths, process.cwd());
+			const imageRoot = typeof sessionWorkspace === "string" && sessionWorkspace.length > 0 && path.isAbsolute(sessionWorkspace) ? sessionWorkspace : process.cwd();
+			const loaded = await loadPeerImages(args.imagePaths, imageRoot);
 			if (!loaded.ok) return rpcError(body.id, RPC_INVALID_PARAMS, `tools/call: ${loaded.error}`);
 			personaImages = loaded.images;
 		}
@@ -27426,8 +27963,8 @@ async function handleToolsCall(body, scope, sessionWorkspace) {
 	const telemetryName = persona ? persona.agentName : nonPersonaTool.toolNameHttp;
 	const telemetryModel = persona ? persona.model : "(non-persona)";
 	try {
-		if (nonPersonaTool) applySessionWorkspace(args, sessionWorkspace, nonPersonaTool);
-		const result = persona ? await callPersona(persona, personaPrompt, personaContext, personaEffort, aborter?.signal, personaImages) : await nonPersonaTool.handler(args, aborter?.signal);
+		const workspaceSource = nonPersonaTool ? applySessionWorkspace(args, sessionWorkspace, nonPersonaTool) : "absent";
+		const result = persona ? await callPersona(persona, personaPrompt, personaContext, personaEffort, aborter?.signal, personaImages) : await nonPersonaTool.handler(args, aborter?.signal, { workspaceSource });
 		logTelemetry({
 			name: telemetryName,
 			model: telemetryModel,
@@ -27753,6 +28290,98 @@ function handleMcpDelete(c) {
 	return c.body(null, 200);
 }
 //#endregion
+//#region src/lib/reasoning-effort.ts
+/**
+* Reasoning-effort bucketing + clamping shared by the `/v1/messages` handler
+* (adaptive-thinking translation) and the Anthropic-translation shim
+* (thinking-budget → Responses `reasoning.effort`).
+*
+* Extracted from `src/routes/messages/handler.ts` so a `~/lib/*` module can
+* depend on it without importing route code (and without forming a
+* handler → shim → handler import cycle). `handler.ts` re-exports these for
+* backward compatibility with existing imports/tests.
+*/
+/**
+* Copilot's reasoning-effort tiers, lowest to highest.
+*
+* Both ends were added after the fact and both are load-bearing:
+*
+* `none` is advertised by every gpt-5.x entry in the live catalog. While it was
+* missing here it was treated as an UNRECOGNIZED value, so a client asking for
+* the MINIMUM on a model that does not offer it (gemini advertises only
+* low/medium/high) was anchored at the unknown-value tier and clamped to
+* `high` — the maximum. Listing it makes the clamp resolve to `low` instead,
+* which is what "nearest supported tier" should always have meant.
+*
+* `max` is advertised by `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-5.6-luna`,
+* `claude-opus-5` and the 4.7/4.8 Opus lines, and Claude Code's effort picker
+* offers it for any model whose entry allows it. Listing it lets an explicit
+* selection pass through, and lets `clampEffort` land on it for a model that
+* advertises nothing lower.
+*
+* `bucketEffort` deliberately reaches neither end — see below.
+*/
+const EFFORT_ORDER = [
+	"none",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+/** Anchor for an effort value that is not a recognized tier at all.
+*
+*  Deliberately NOT the top of `EFFORT_ORDER`. Callers reach this only when the
+*  incoming value is unrecognized, which is a guess — and resolving a guess to
+*  the most expensive tier a model advertises would silently spend more than the
+*  caller could have meant. Anchoring here and clamping DOWN keeps the behavior
+*  identical to before `max` joined the ladder, while `max` stays reachable by
+*  explicit, valid selection. */
+const UNKNOWN_EFFORT_ANCHOR = "xhigh";
+/**
+* Bucket a thinking budget into a Copilot reasoning-effort string.
+* `<2000`→low, `<8000`→medium, `<24000`→high, else→xhigh.
+* Defaults missing/non-numeric budgets to 8000 ("high").
+*
+* The ceiling stays at `xhigh` even though `max` exists: Anthropic's
+* `budget_tokens` is unbounded above, so any threshold chosen for a `max`
+* bucket would silently re-tier existing callers whose budgets already map to
+* `xhigh`. `max` is reachable only by explicit selection
+* (`output_config.effort`), which is an unambiguous request rather than an
+* inference from a token count.
+*/
+function bucketEffort(budget) {
+	const n = typeof budget === "number" && Number.isFinite(budget) ? budget : 8e3;
+	if (n < 2e3) return "low";
+	if (n < 8e3) return "medium";
+	if (n < 24e3) return "high";
+	return "xhigh";
+}
+/**
+* Clamp a bucketed effort to the closest value in `supported`. Ties resolve to
+* the lower-tier option (per EFFORT_ORDER).
+*
+* Iterates EFFORT_ORDER (canonical low→xhigh) so the first match on a given
+* distance is always the lower-tier value, regardless of input order in
+* `supported`.
+*/
+function clampEffort(bucketed, supported) {
+	if (supported.includes(bucketed)) return bucketed;
+	const targetIdx = EFFORT_ORDER.indexOf(bucketed);
+	let best;
+	let bestDist = Infinity;
+	for (let i = 0; i < EFFORT_ORDER.length; i++) {
+		const value = EFFORT_ORDER[i];
+		if (!supported.includes(value)) continue;
+		const dist = Math.abs(i - targetIdx);
+		if (dist < bestDist) {
+			bestDist = dist;
+			best = value;
+		}
+	}
+	return best ?? bucketed;
+}
+//#endregion
 //#region src/lib/stream-relay.ts
 const ENCODER$1 = new TextEncoder();
 /**
@@ -28240,10 +28869,15 @@ function rememberThinkingHistoryRepair(fingerprint) {
 *       re-call Copilot for the next turn — stream onto the SAME
 *       SSE connection (no new message_start; the original one is
 *       still open). Loop up to ADVISOR_MAX_TURNS times.
-* 4. Cross-lab default: route the advisor call to a different model
-*    family than the main loop (gpt-5.6-sol by default) so the user gets
-*    a true "second set of eyes" instead of Opus reviewing Opus
-*    (gemini-critic finding).
+* 4. Lead-aware model choice: route the advisor call to a different model
+*    family than the main loop (gpt-5.6-sol) so the user gets a true "second
+*    set of eyes" instead of Opus reviewing Opus (gemini-critic finding). When
+*    the LEAD is a lighter Claude tier the choice inverts and the advisor
+*    escalates to `ADVISOR_ESCALATION_MODEL` instead — see that constant for
+*    why trading the cross-lab property is the right call on that path.
+* 5. Effort follows the Claude Code effort picker (`resolveAdvisorEffort`)
+*    rather than a hardcoded constant, floored so a low picker cannot render
+*    the consultation useless.
 *
 * The translate-loop is bounded to a single user request — no
 * persistent state across requests is needed (unlike Phase G's
@@ -28267,6 +28901,185 @@ const ADVISOR_CLIENT_TOOL_NAME = "advisor";
 *  model — Opus 4.6/Sonnet 4.6 typically). */
 const ADVISOR_DEFAULT_MODEL = "gpt-5.6-sol";
 const ADVISOR_DEFAULT_EFFORT = "xhigh";
+/** The Anthropic frontier model the advisor escalates to when the LEAD is a
+*  lighter Claude tier (sonnet, haiku).
+*
+*  Selecting a lighter lead is a decision to work on a budget while holding
+*  quality: the lead does the legwork and escalates for direction. Without this,
+*  a budget lead has no transcript-aware path to the strongest Anthropic
+*  reasoner at all — `opus_critic` is stateless and sees one artifact, and the
+*  `plan` worker is read-only and never sees the transcript.
+*
+*  This deliberately trades the advisor's cross-lab property on that path. The
+*  advisor is not this repo's review instrument: it catches drift and momentum
+*  and inherits the lead's framing by design, while the fresh-context critics
+*  (`codex_critic`, `gemini_critic`, `codex_reviewer`, `gemini_reviewer`) are
+*  the decorrelation instrument and are untouched. `GH_ROUTER_ADVISOR_MODEL`
+*  keeps a cross-lab advisor one env var away for anyone who wants it back. */
+const ADVISOR_ESCALATION_MODEL = "claude-opus-5";
+/** Floor for the advisor's reasoning effort.
+*
+*  The advisor follows the Claude Code effort picker (see `resolveAdvisorEffort`)
+*  so dialing the picker down makes it cheaper, but it does NOT follow it all the
+*  way to the bottom of `EFFORT_ORDER`. The advisor fires a handful of times per
+*  session (`ADVISOR_MAX_TURNS`, typically 1-3), so it is not the budget line —
+*  the lead's own turns are — while an advisor reasoning at `none`/`low` cannot
+*  do the job the consultation exists for. The picker therefore governs the
+*  `high..max` range. */
+const ADVISOR_MIN_EFFORT = "high";
+/** Output cap for the Anthropic-branch advisor call when the catalog carries no
+*  limits for the resolved model. The value the branch used unconditionally
+*  before it became reachable, kept so a catalog-less path is no worse off. */
+const ADVISOR_FALLBACK_MAX_OUTPUT_TOKENS = 4096;
+/** Catalog spellings that mean the Responses API. Copilot is inconsistent about
+*  the `/v1` prefix, so both are matched — mirroring `CHAT_ENDPOINTS` /
+*  `RESPONSES_ENDPOINTS` in `src/services/copilot/endpoint.ts`. */
+const ADVISOR_RESPONSES_ENDPOINTS = /* @__PURE__ */ new Set(["/responses", "/v1/responses"]);
+/**
+* Which transport the advisor dispatches on: `/responses` (with
+* `reasoning.effort`) or `/v1/messages`.
+*
+* Catalog-first, name-regex second, and BOTH tests run against the bare id as
+* well as the given one. `pickEndpoint` is deliberately not reused: it answers
+* "chat or responses" for the two tool-calling clients and would send
+* `claude-opus-5` — which advertises `/v1/messages` AND `/chat/completions` — to
+* chat. The advisor's question is narrower: does this model serve `/responses`?
+*
+* The bare-id fallback is what makes `GH_ROUTER_ADVISOR_MODEL` safe. That pin is
+* accepted verbatim, so an operator can write a vendor-namespaced value like
+* `openai/gpt-5.6-sol`. Such an id is in no catalog and fails the start-anchored
+* name regex, so a catalog-only fix still posted it to `/v1/messages` and 400'd
+* — exported and directly tested for that exact input, because an earlier
+* version of this function claimed to handle it and did not.
+*/
+function advisorUsesResponses(resolvedAdvisorModel) {
+	const bare = resolvedAdvisorModel.slice(resolvedAdvisorModel.lastIndexOf("/") + 1);
+	const endpoints = (state.models?.data?.find((m) => m.id === resolvedAdvisorModel || m.id === bare))?.supported_endpoints;
+	if (endpoints && endpoints.length > 0) return endpoints.some((e) => ADVISOR_RESPONSES_ENDPOINTS.has(e));
+	return /^(gpt-|o\d|.*codex)/i.test(bare);
+}
+/** True when the model advertises a usable reasoning-effort ladder. */
+function advertisedEffortLadder(resolvedAdvisorModel) {
+	const supported = state.models?.data?.find((m) => m.id === resolvedAdvisorModel)?.capabilities?.supports?.reasoning_effort;
+	return Array.isArray(supported) && supported.length > 0 ? supported : void 0;
+}
+/** True when the advisor should escalate to `ADVISOR_ESCALATION_MODEL` for this
+*  lead: a Claude lead that is NOT already an Opus tier, on a catalog that
+*  actually carries the escalation model.
+*
+*  The catalog probe mirrors `standInToolEnabled`'s: never name a model the
+*  account cannot reach. A non-Claude lead never gets here in practice (the
+*  advisor tool is stripped for those before the request reaches this module),
+*  but the check is explicit rather than assumed.
+*
+*  The probe compares the BARE constant rather than `resolveModel`-ing it first,
+*  which is deliberate and not an oversight: `claude-opus-5` is a single-segment
+*  slug whose dashed and dotted spellings are identical, so resolution is a
+*  no-op, and `resolveModel` WARNS on an id it cannot find — routing this probe
+*  through it would emit that warning on every advisor request for anyone whose
+*  catalog lacks opus-5, which is exactly the tier this returns false for.
+*  `standInToolEnabled` compares the same id the same way. */
+function shouldEscalateAdvisor(leadModel) {
+	if (!isBudgetClaudeLead(leadModel)) return false;
+	return state.models?.data?.some((m) => m.id === "claude-opus-5") ?? false;
+}
+/**
+* Pick the advisor model for one request from the LEAD model that request is
+* running on.
+*
+* Resolved per request rather than at launch because the lead changes
+* mid-session via the `/model` picker; launch-time env plumbing would pin the
+* advisor to whatever was selected at spawn.
+*
+* Precedence:
+*   1. `GH_ROUTER_ADVISOR_MODEL` (trimmed) — the operator pin, checked first so
+*      it works on every lead.
+*   2. A lighter Claude lead with the escalation model in the catalog.
+*   3. `ADVISOR_DEFAULT_MODEL`.
+*
+* Step 3 returns the LITERAL constant rather than walking the OpenAI frontier
+* chain. An Opus lead must resolve to exactly what it resolves to today, and a
+* frontier walk could yield `gpt-5.5` on a catalog missing `gpt-5.6-sol` —
+* a silent change to the one path that is required not to move.
+*/
+/**
+* Map an operator pin onto the id the catalog actually carries.
+*
+* `GH_ROUTER_ADVISOR_MODEL` is free-form, and the natural thing to write is a
+* vendor-namespaced id like `openai/gpt-5.6-sol`. Copilot's catalog carries the
+* bare `gpt-5.6-sol`, so forwarding the namespaced form verbatim gets a 400
+* `model_not_supported` and the advisor silently degrades to its
+* "[Advisor unavailable: ...]" fallback — measured, not theorised: choosing the
+* transport correctly was NOT sufficient, because the id itself was still
+* wrong on the wire.
+*
+* An exact catalog hit wins first, so a real id containing a slash could never
+* be mangled. Only when the pin is absent from the catalog do we try its last
+* path segment, and only when THAT is present do we rewrite. A pin that matches
+* nothing is passed through untouched: the catalog may simply not be loaded
+* yet, and inventing an id would be worse than letting upstream reject it.
+*/
+function normalizeAdvisorPin(pinned) {
+	const models = state.models?.data;
+	if (!models) return pinned;
+	if (models.some((m) => m.id === pinned)) return pinned;
+	const bare = pinned.slice(pinned.lastIndexOf("/") + 1);
+	return bare !== pinned && models.some((m) => m.id === bare) ? bare : pinned;
+}
+function resolveAdvisorModel(leadModel) {
+	const pinned = process.env.GH_ROUTER_ADVISOR_MODEL?.trim();
+	if (pinned) return {
+		model: normalizeAdvisorPin(pinned),
+		escalated: false
+	};
+	if (leadModel && shouldEscalateAdvisor(leadModel)) return {
+		model: ADVISOR_ESCALATION_MODEL,
+		escalated: true
+	};
+	return {
+		model: ADVISOR_DEFAULT_MODEL,
+		escalated: false
+	};
+}
+/**
+* Resolve the advisor's reasoning effort from the ORIGINAL request body, so the
+* advisor thinks at the level selected in the Claude Code effort picker instead
+* of a hardcoded constant.
+*
+* The source is the RAW pre-`resolveModelInBody` body, deliberately. By the time
+* the handler holds a parsed body, `translateThinking` has already bucketed
+* `thinking.budget_tokens` into `output_config.effort` AND clamped it to the
+* LEAD model's allowlist — so that value encodes "what the lead could do", not
+* "what the user picked". Re-clamping it against the advisor cannot recover the
+* difference: a `max` pick on a lead whose ceiling is `high` would reach an
+* xhigh-capable advisor as `high`.
+*
+* Precedence mirrors the repo-wide rule that an explicit client effort wins:
+*   1. `output_config.effort`
+*   2. `bucketEffort(thinking.budget_tokens)`
+*   3. `ADVISOR_DEFAULT_EFFORT` — a request expressing no preference behaves
+*      exactly as it did before the picker was honored at all.
+*
+* Then floor, THEN clamp. The order is load-bearing: a model whose ceiling sits
+* below `ADVISOR_MIN_EFFORT` must still receive a value it accepts, so the clamp
+* is allowed to pull back under the floor. Flipping the two would forward an
+* effort upstream rejects.
+*/
+function resolveAdvisorEffort(rawRequestBody, advisorModel) {
+	let requested = ADVISOR_DEFAULT_EFFORT;
+	if (rawRequestBody) try {
+		const body = JSON.parse(rawRequestBody);
+		const oc = body.output_config;
+		const explicit = oc && typeof oc === "object" ? oc.effort : void 0;
+		const thinking = body.thinking;
+		if (typeof explicit === "string" && EFFORT_ORDER.includes(explicit)) requested = explicit;
+		else if (thinking && typeof thinking === "object" && thinking.type === "enabled") requested = bucketEffort(thinking.budget_tokens);
+	} catch {}
+	const floored = EFFORT_ORDER.indexOf(requested) < EFFORT_ORDER.indexOf(ADVISOR_MIN_EFFORT) ? ADVISOR_MIN_EFFORT : requested;
+	const supported = state.models?.data?.find((m) => m.id === resolveModel(advisorModel))?.capabilities?.supports?.reasoning_effort;
+	if (!Array.isArray(supported) || supported.length === 0) return floored;
+	return clampEffort(floored, supported);
+}
 /** ADVISOR_TOOL_INSTRUCTIONS verbatim from cc-backup
 *  src/utils/advisor.ts — describes when the model should invoke
 *  the advisor. Long-form prose; see source for justification. */
@@ -28362,8 +29175,12 @@ const ADVISOR_FALLBACK_MAX_TOKENS = 24e4;
 *  our o200k count and Copilot's full-payload count. The transcript token
 *  budget is `max_prompt_tokens - reserve`. Generous on purpose: a 400
 *  `model_max_prompt_tokens_exceeded` degrades to a silent advisor
-*  fallback, and the marginal window we give up is irrelevant next to
-*  gpt-5.6-sol's ~1M. */
+*  fallback, and the window given up is marginal against either advisor
+*  model's real prompt window (`claude-opus-5` 936k, `gpt-5.6-sol` ~1M off
+*  the live catalog). Sized as a fraction of the smaller of the two, not as
+*  "irrelevant next to ~1M" — that framing assumed the advisor was always
+*  the cheap side of the pair, which stopped being true once a budget lead
+*  escalates to Opus. */
 const ADVISOR_PROMPT_TOKEN_RESERVE = 8e3;
 /**
 * Derive the TOKEN budget for the rendered transcript from the advisor
@@ -28474,9 +29291,9 @@ function truncateTailToUnits(text, maxUnits, measure) {
 * Anthropic's own ADVISOR ("see the whole task + every tool call +
 * every result").
 */
-async function runAdvisor(conversation, advisorModel, advisorEffort, signal) {
+async function runAdvisor(conversation, advisorModel, advisorEffort, signal, advisorEscalated = false) {
 	if (signal?.aborted) throw new Error("advisor call aborted before dispatch");
-	const advisorSystem = "You are an expert advisor reviewing an in-progress Claude Code session. The transcript below is the work-in-progress (turns numbered, with tool calls and results inlined). Read carefully and provide concrete, actionable advice on the next step or course-correction. Be specific — cite the parts of the transcript you're responding to. If the assistant is on the right track, say so explicitly. If they're stuck or off-track, name the specific assumption or step to revisit. Aim for 2-5 paragraphs of substantive guidance.";
+	const advisorSystem = "You are an expert advisor reviewing an in-progress Claude Code session. The transcript below is the work-in-progress (turns numbered, with tool calls and results inlined). Read carefully and provide concrete, actionable advice on the next step or course-correction. Be specific — cite the parts of the transcript you're responding to. If the assistant is on the right track, say so explicitly. If they're stuck or off-track, name the specific assumption or step to revisit. Aim for 2-5 paragraphs of substantive guidance." + (advisorEscalated ? " The requesting agent is running a lighter, faster model than you. Give a directive recommendation and commit to the decision rather than laying out options for it to weigh." : "");
 	const resolvedAdvisorModel = resolveModel(advisorModel);
 	let measure;
 	let maxUnits;
@@ -28491,7 +29308,7 @@ async function runAdvisor(conversation, advisorModel, advisorEffort, signal) {
 		maxUnits = ADVISOR_MAX_CONVERSATION_CHARS;
 	}
 	const conversationText = renderConversationAsText(conversation, maxUnits, measure);
-	if (/^(gpt-|o\d|.*codex)/i.test(resolvedAdvisorModel)) {
+	if (advisorUsesResponses(resolvedAdvisorModel)) {
 		const payload = {
 			model: resolvedAdvisorModel,
 			instructions: advisorSystem,
@@ -28526,15 +29343,22 @@ async function runAdvisor(conversation, advisorModel, advisorEffort, signal) {
 		if (!text) throw new Error(`Advisor model ${resolvedAdvisorModel} returned empty assistant output`);
 		return text;
 	}
+	const advisorEntry = state.models?.data?.find((m) => m.id === resolvedAdvisorModel);
+	const limits = advisorEntry?.capabilities?.limits;
+	const maxTokens = limits?.max_non_streaming_output_tokens ?? limits?.max_output_tokens ?? ADVISOR_FALLBACK_MAX_OUTPUT_TOKENS;
 	const advisorBody = JSON.stringify({
 		model: resolvedAdvisorModel,
-		max_tokens: 4096,
+		max_tokens: maxTokens,
 		system: advisorSystem,
 		messages: [{
 			role: "user",
 			content: conversationText
 		}],
-		stream: false
+		stream: false,
+		...advisorEntry?.capabilities?.supports?.adaptive_thinking ? {
+			thinking: { type: "adaptive" },
+			...advertisedEffortLadder(resolvedAdvisorModel) ? { output_config: { effort: advisorEffort } } : {}
+		} : {}
 	});
 	const json = await (await withTransientRetry(() => createMessages(advisorBody, {}, signal), {
 		signal,
@@ -28589,6 +29413,7 @@ function sseEvent(type, data) {
 function buildAdvisorStream(opts) {
 	const advisorModel = opts.advisorModel ?? "gpt-5.6-sol";
 	const advisorEffort = opts.advisorEffort ?? "xhigh";
+	const advisorEscalated = opts.advisorEscalated ?? false;
 	const aborter = opts.externalAborter ?? new AbortController();
 	let conversation = [...opts.initialConversation];
 	return new ReadableStream({
@@ -28838,7 +29663,7 @@ function buildAdvisorStream(opts) {
 					const advisorConversation = conversation;
 					const advisorTexts = await Promise.all(advisorToolUses.map(async () => {
 						try {
-							return await runAdvisor(advisorConversation, advisorModel, advisorEffort, aborter.signal);
+							return await runAdvisor(advisorConversation, advisorModel, advisorEffort, aborter.signal, advisorEscalated);
 						} catch (err) {
 							if (aborter.signal.aborted) throw err;
 							const msg = err instanceof Error ? err.message : String(err);
@@ -31561,32 +32386,33 @@ async function saveOverflowPatch(dir) {
 */
 const WORKTREE_REGISTRY = new WorktreeRegistry();
 registerExitHandlers$1(WORKTREE_REGISTRY);
-/** Worker-availability GATE sentinel + final fallback. `gpt-5.4-mini` — cheap,
-*  broadly-available, tool-call-capable, 400k-context, with tight
-*  function-calling-loop discipline (earlier gemini-flash cheap defaults
-*  early-stopped with empty turns on the function-calling loop; gpt-5.4-mini
-*  does not). Exported and aliased as `WORKER_DEFAULT_MODEL`:
-*  `workerToolsEnabled()` gates the ENTIRE worker surface on this id being
-*  present with `tool_calls`. It is no longer `explore`'s default (see
-*  `EXPLORE_DEFAULT_MODEL`) — it stays the gate sentinel because it's the
-*  cheapest broadly-present tool-caller, and the fallback for any unmatched
-*  mode. */
-const DEFAULT_MODEL = "gpt-5.4-mini";
+/** Worker-availability gate + unmatched-mode fallback chain. Luna leads where
+*  the live catalog grants access: it is cheaper, faster, and has a larger context
+*  window than mini. Mini remains the broad-tier fallback because individual-trial
+*  and education catalogs may omit Luna. The catalog itself is the entitlement
+*  signal; `billing.restricted_to` describes model policy, not the user's tier.
+*
+*  `workerToolsEnabled()` admits the worker surface when either entry is present
+*  with `tool_calls`. `resolveDefaultModel()` picks the first usable live entry for
+*  an unmatched worker mode. Per-mode defaults remain independent of the gate. */
+const DEFAULT_MODEL_CHAIN = Object.freeze(["gpt-5.6-luna", "gpt-5.4-mini"]);
 const DEFAULT_THINKING = "xhigh";
-/** Default model for the READ-ONLY `explore` mode. `gemini-3.6-flash` at `high`
-*  (via `EXPLORE_DEFAULT_THINKING`; flash advertises no xhigh) — a fast, cheap,
-*  1M-context tool-caller for read-only repo research. Routes over
-*  `/chat/completions` via the translation shim (the same proven path the
-*  `review` worker uses for gemini). Like `implement`'s gpt-5.6-sol this is NOT a
-*  `workerToolsEnabled` gate input — if absent (e.g. a non-enterprise tier)
-*  `explore` errors helpfully at call time rather than vanishing the whole worker
-*  surface. The caller (the main model) overrides BOTH the model and the reasoning
-*  per call via the `model` / `thinking` args — see the tier ladder (gpt-5.6-sol
-*  heavy / gpt-5.6-terra moderate / gemini-3.6-flash light) in the MCP tool desc. */
-const EXPLORE_DEFAULT_MODEL = "gemini-3.6-flash";
-/** Default thinking for `explore`. `high` (flash has no xhigh); explicit rather
-*  than inherited from `DEFAULT_THINKING` so the explore effort can't drift if the
-*  shared fallback changes. */
+function resolveDefaultModel() {
+	const models = state.models?.data ?? [];
+	return DEFAULT_MODEL_CHAIN.find((id) => models.some((model) => model.id === id && model.capabilities?.supports?.tool_calls === true)) ?? DEFAULT_MODEL_CHAIN[0];
+}
+/** Default model for the READ-ONLY `explore` mode. `gpt-5.6-luna` at `high`
+*  (via `EXPLORE_DEFAULT_THINKING`) is the measured strict improvement over the
+*  former Gemini Flash default: lower token cost, faster generation and tool-call
+*  latency, a larger context window, and the full reasoning-effort ladder. `high`
+*  is therefore a real selected tier rather than a clamp. Like `implement`'s
+*  gpt-5.6-sol this per-mode default is NOT a `workerToolsEnabled` gate input — if
+*  absent on a thin catalog, `explore` errors helpfully at call time rather than
+*  vanishing the whole worker surface. The caller can override model and thinking
+*  per call via the `model` / `thinking` args. */
+const EXPLORE_DEFAULT_MODEL = "gpt-5.6-luna";
+/** Default thinking for `explore`. Explicit rather than inherited from
+*  `DEFAULT_THINKING` so the explore effort cannot drift with the fallback. */
 const EXPLORE_DEFAULT_THINKING = "high";
 /** Default model + thinking for the READ-ONLY `review` mode.
 *  `gemini-3.1-pro-preview` at `xhigh` (clamped to `high` at call time — gemini
@@ -31603,41 +32429,44 @@ const EXPLORE_DEFAULT_THINKING = "high";
 const REVIEW_DEFAULT_MODEL = "gemini-3.1-pro-preview";
 const REVIEW_DEFAULT_THINKING = "xhigh";
 /** Default model + thinking for the READ+WRITE `implement` mode. `gpt-5.6-sol`
-*  at `xhigh` — the strongest reasoning tier in the catalog, 1M+ context,
-*  routed through `/responses` by the stream-fn endpoint split. Coding edits
-*  benefit from maximum reasoning; the higher per-call cost is justified for
-*  autonomous implementation. An explicit `opts.model` still wins. */
+*  at `high` — a time-to-outcome default for the 1M+ context model, routed
+*  through `/responses` by the stream-fn endpoint split. Any caller can restore
+*  a higher tier per call via `thinking` or per session via `worker_defaults`;
+*  precedence is per-call > session > built-in. */
 const IMPLEMENT_DEFAULT_MODEL = "gpt-5.6-sol";
-const IMPLEMENT_DEFAULT_THINKING = "xhigh";
-/** `test` starts with the same built-in pair as `implement`, but remains an
-* independent mode so either can be overridden without affecting the other. */
+const IMPLEMENT_DEFAULT_THINKING = "high";
+/** `test` starts with the same time-to-outcome built-in pair as `implement`, but
+* remains independent so either mode can restore a higher tier per call via
+* `thinking` or per session via `worker_defaults`. Resolution precedence is
+* per-call > session > built-in. */
 const TEST_DEFAULT_MODEL = "gpt-5.6-sol";
-const TEST_DEFAULT_THINKING = "xhigh";
-/** Default model for `browse` mode. `gpt-5.4-mini` — the Gate-B-winning
-*  browse model (small + fast enough to drive a tab at human pace, with
-*  enough tool-calling discipline to terminate). This is DISTINCT from the
-*  gemini worker `DEFAULT_MODEL`: browse is a different workload (drive a
-*  page, not read a repo) and was tuned separately. May be retuned after
-*  the flash-vs-mini eval settles. Routed through `/responses` by the
-*  stream-fn's endpoint split (it's a gpt-5.x model). Caller can override
+const TEST_DEFAULT_THINKING = "high";
+/** Default model for `browse` mode. `gpt-5.6-luna` has the same measured image
+*  ceiling as `gpt-5.4-mini`, so screenshot-heavy sessions retain their input
+*  capacity, and endpoint routing is derived from the live catalog. Luna's full
+*  reasoning-effort ladder preserves the independent `high` browse default.
+*  This is deliberately a per-mode default even though it also leads
+*  `DEFAULT_MODEL_CHAIN`; the general worker gate remains tier-adaptive while
+*  browse still applies its independent reachability gate. Caller can override
 *  per call via the `model` arg.
 *
 *  Exported so the MCP browse handler reads the same constant — drift
 *  between the two would ship a tool whose docs disagree with its runtime
 *  default. */
-const BROWSE_DEFAULT_MODEL = "gpt-5.4-mini";
+const BROWSE_DEFAULT_MODEL = "gpt-5.6-luna";
 /** Default thinking for `browse`. Higher than the page-driving workload
 *  strictly needs, but the termination discipline benefits from it. */
 const BROWSE_DEFAULT_THINKING = "high";
-/** Default model + thinking for the read-only `plan` mode. `claude-opus-4.8`
-*  at `xhigh` — planning is the highest-leverage read-only step (the plan
-*  shapes everything downstream), so it gets the strongest reasoning model
-*  rather than the lightweight `gemini-3.6-flash` explore default. Uses the DOTTED
-*  Copilot catalog id (the worker resolver exact-matches `catalog.id`, it does
-*  NOT translate the Anthropic dashed slug; `claude-opus-5` is a single-segment
-*  slug so dotted == dashed). Falls back to a helpful unknown-model error at call
-*  time if opus-5 isn't in the catalog (e.g. a non-enterprise tier), exactly like
-*  `implement`'s `gpt-5.6-sol`. Caller's `model` arg still wins. */
+/** Default model + thinking for the read-only `plan` mode. `claude-opus-5`
+*  at `high` favours time-to-outcome while retaining the strongest planning
+*  model rather than the lightweight `gpt-5.6-luna` explore default. Any
+*  caller can restore a higher tier per call via `thinking` or per session via
+*  `worker_defaults`; precedence is per-call > session > built-in. Uses the
+*  DOTTED Copilot catalog id (the worker resolver exact-matches `catalog.id`, it
+*  does NOT translate the Anthropic dashed slug; `claude-opus-5` is a
+*  single-segment slug so dotted == dashed). Falls back to a helpful unknown-model
+*  error at call time if opus-5 isn't in the catalog (e.g. a non-enterprise tier),
+*  exactly like `implement`'s `gpt-5.6-sol`. */
 const PLAN_DEFAULT_MODEL = "claude-opus-5";
 const BUILT_IN_MODE_DEFAULTS = Object.freeze({
 	explore: {
@@ -31650,7 +32479,7 @@ const BUILT_IN_MODE_DEFAULTS = Object.freeze({
 	},
 	plan: {
 		model: PLAN_DEFAULT_MODEL,
-		thinking: "xhigh"
+		thinking: "high"
 	},
 	implement: {
 		model: IMPLEMENT_DEFAULT_MODEL,
@@ -31665,10 +32494,10 @@ const BUILT_IN_MODE_DEFAULTS = Object.freeze({
 		thinking: BROWSE_DEFAULT_THINKING
 	}
 });
-/** Resolve the effective mode ladder without changing the gate sentinel. */
+/** Resolve the effective mode ladder without changing the worker gate. */
 function resolveModeDefaults(mode, ignoreSessionDefaults = false) {
 	const builtIn = BUILT_IN_MODE_DEFAULTS[mode] ?? {
-		model: "gpt-5.4-mini",
+		model: resolveDefaultModel(),
 		thinking: DEFAULT_THINKING
 	};
 	const override = ignoreSessionDefaults ? {} : getWorkerSessionDefault(mode);
@@ -33720,7 +34549,7 @@ const PERSONAS_READ = Object.freeze([
 		toolNameHttp: "codex_reviewer",
 		model: "gpt-5.3-codex",
 		endpoint: "/v1/responses",
-		description: "Line-level code reviewer backed by gpt-5.3-codex (OpenAI, ≈272K-token input window), a code-specialist reviewer that is fastest around high effort (~16s at high effort). It reviews concrete diffs, files, or function bodies and returns findings with severity, file:line locations, issue impact, and a minimal suggested fix. Use when the artifact is actual code and the goal is bug, edge-case, security, concurrency, resource, or idiom review. Not for architecture or tradeoff review, use codex_critic or gemini_critic; pass the diff or file content verbatim.",
+		description: "Line-level code reviewer backed by gpt-5.3-codex (OpenAI, ≈272K-token input window), a code specialist for line-level review. It reviews concrete diffs, files, or function bodies and returns findings with severity, file:line locations, issue impact, and a minimal suggested fix. Use when the artifact is actual code and the goal is bug, edge-case, security, concurrency, resource, or idiom review. Not for architecture or tradeoff review, use codex_critic or gemini_critic; pass the diff or file content verbatim.",
 		baseInstructions: REVIEWER_BASE,
 		agentPrompt: "",
 		writeCapable: false,
@@ -33912,13 +34741,8 @@ function buildPeerAwarenessSnippet(opts) {
 	const codexCliClause = opts.codexCli ? " `mcp__codex-cli__codex` dispatches to `codex-implementer` (gpt-5.3-codex with workspace-write) for end-to-end coding tasks." : "";
 	const para2Parts = [`\`mcp__${searchKey}__code\` is the one-stop code search (no extra model call). Its DEFAULT mode (or \`mode:"semantic"\`) ranks by MEANING via ColBERT over a per-workspace index, the first thing to reach for on intent/concept questions ("where is retry/backoff handled", "how does auth work"); when that index isn't ready it transparently falls back to lexical (the response \`source\` says which engine ran). Forced modes cover the rest: \`lexical\` (BM25F-ranked + tree-sitter, best for exact symbols), \`exact\`, \`regex\`, \`complete\` (exhaustive set), \`ast_pattern\`+\`ast_lang\` for multi-line AST shapes, \`scan\` for a whole-workspace symbol outline, \`multiline\` for cross-line regex. Multiple queries can run in a single turn. The index covers code-shaped files; for unstructured files (logs, \`.csv\`, \`.env*\`, config-only wiring), \`grep\`/\`glob\` still apply.`];
 	if (opts.workerToolsAvailable) para2Parts.push(`\`worker-*\` are background Agent subagents (subagent_type) that run the matching worker in its own context and deliver the result as a completion notification, so a long run never blocks the turn: \`worker-explore\` (read-only research), \`worker-review\` (reads the code to verify a change or claim), \`worker-plan\` (ordered implementation plan), \`worker-implement\` (edit/write/bash; ALWAYS runs in an isolated git worktree and returns the diff via a saved patch file; for in-place edits use the \`implementer\` subagent), \`worker-test\` (independent test author; also always worktree-isolated)${opts.browseAvailable ? ", `worker-browse` (autonomous browser agent driving a real browser)" : ""}. The raw \`mcp__${workersKey}__*\` tools they call are guarded (a direct main-thread call is redirected to the matching agent); Workers themselves have \`code_search\`.`);
-	const catchAllNames = [
-		opts.genericAvailable === false ? void 0 : "`generic`",
-		opts.genericFastAvailable === false ? void 0 : "`generic-fast`",
-		opts.genericCheapAvailable === false ? void 0 : "`generic-cheap`"
-	].filter((n) => n != null);
-	const catchAllClause = catchAllNames.length > 0 ? ` Catch-alls on non-lead models, for work no specialist fits, cheapest last: ${catchAllNames.join(", ")}.` : "";
-	para2Parts.push(`Native subagents (Task), each in its own context so heavy work never fills yours: \`implementer\` (you know what to build), \`reviewer\` (something exists and you want it assessed, including reproducing and root-causing a failure), \`brainstorm\` (you do not yet know which approach to take)${opts.scoutAvailable === false ? "" : ", `scout` (find or understand something in the repo, cheap)"}, \`scribe\` (docs and ADRs that trail the code).${catchAllClause}`);
+	const catchAllClause = opts.generalPurposeFastAvailable === false ? "" : " Catch-all on a fast, economical non-lead model for work no specialist fits: `general-purpose-fast`.";
+	para2Parts.push(`Native subagents (Task), each in its own context so heavy work never fills yours: \`implementer\` (coding changes needing judgment or with ambiguous scope)${opts.implementerFastAvailable === false ? "" : ", `implementer-fast` (well-specified, mechanical coding changes)"}, \`reviewer\` (something exists and you want it assessed, including reproducing and root-causing a failure), \`brainstorm\` (you do not yet know which approach to take)${opts.scoutAvailable === false ? "" : ", `scout` (find or understand something in the repo, cheap)"}, \`scribe\` (docs and ADRs that trail the code).${catchAllClause}`);
 	if (opts.workerToolsAvailable) para2Parts.push(`For a bounded, well-scoped implementation, prefer the \`implementer\` subagent over \`worker-implement\`; reach for \`worker-implement\` only when you specifically need git-worktree isolation, parallel variants, or a throwaway experiment.`);
 	if (opts.workerToolsAvailable) para2Parts.push(`\`mcp__${orchestrateKey}__decompose\` composes an open-ended ask into a typed, VERIFIED workflow IR (a strong driver decorrelated by a cross-lab critic, so the decompose step isn't a single point of failure), and \`mcp__${orchestrateKey}__run_workflow\` executes that IR through a frozen kernel delivering max(orchestrated, baseline) over a sealed executable gate, so it never ships worse than a plain single-model run. \`mcp__${orchestrateKey}__verify_workflow\` checks an IR's floor invariants before you run it, and \`mcp__${orchestrateKey}__attest_step\` audits that a finished run's producers were each checked by a different lab. They suit non-trivial, role-separated asks; a trivial ask does not need them.`);
 	else para2Parts.push(`\`mcp__${orchestrateKey}__verify_workflow\` statically checks a workflow IR's floor invariants and \`mcp__${orchestrateKey}__attest_step\` audits a run's cross-lab lineage (the \`decompose\`/\`run_workflow\` composer + kernel need the worker backend, unavailable here).`);
@@ -33951,15 +34775,27 @@ function buildPeerAwarenessSnippet(opts) {
 */
 function buildPeerAwarenessSummary(opts) {
 	const key = (g) => opts.groupKeys?.[g] ?? GROUP_META[g].preferredKey;
-	const summaryCatchAlls = [
-		opts.genericAvailable === false ? void 0 : "`generic`",
-		opts.genericFastAvailable === false ? void 0 : "`generic-fast`",
-		opts.genericCheapAvailable === false ? void 0 : "`generic-cheap`"
+	const renderNative = (name) => {
+		const modelId = opts.nativeAgentModels?.[name];
+		if (!modelId) return `\`${name}\``;
+		const prices = catalogTokenPrices(modelId);
+		const tps = indicativeTokensPerSecond(modelId);
+		if (!prices || tps == null) return `\`${name}\``;
+		return `\`${name}\` ${prices.in}/${prices.out} ~${tps}t/s`;
+	};
+	const summaryNativeNames = [
+		renderNative("implementer"),
+		opts.implementerFastAvailable === false ? void 0 : renderNative("implementer-fast"),
+		renderNative("reviewer"),
+		renderNative("brainstorm"),
+		opts.scoutAvailable === false ? void 0 : renderNative("scout"),
+		renderNative("scribe"),
+		opts.generalPurposeFastAvailable === false ? void 0 : renderNative("general-purpose-fast")
 	].filter((n) => n != null);
 	const lines = [
 		"## Injected capabilities (summary)",
 		"",
-		`Native subagents (Task), each in its own context: \`implementer\` (you know what to build), \`reviewer\` (something exists and you want it assessed, including reproducing and root-causing a failure), \`brainstorm\` (you do not yet know which approach to take)${opts.scoutAvailable === false ? "" : ", `scout` (find or understand something in the repo, cheap)"}, \`scribe\` (docs and ADRs that trail the code).${summaryCatchAlls.length > 0 ? ` Catch-alls on non-lead models for work no specialist fits, cheapest last: ${summaryCatchAlls.join(", ")}.` : ""} They read the repo and can run things; the peer critics below cannot, so reach for \`reviewer\` when an assessment needs execution or repo context and for a critic when you already hold the artifact.`,
+		`${summaryNativeNames.some((n) => /\d/.test(n)) ? "Native subagents (Task), own context. Cost is per 1M tokens in/out, tok/s approximate:" : "Native subagents (Task), each in its own context:"} ${summaryNativeNames.join(", ")}. Each agent's own description states when it applies. They read the repo and can run things; the peer critics below cannot, so reach for \`reviewer\` when an assessment needs execution or repo context and for a critic when you already hold the artifact.`,
 		`A layer of MCP tools, background workers, and skills is injected into this session. Cross-lab peer critics under \`mcp__${key("peers")}__*\` (plus the \`peer-review-coordinator\` subagent) review plans and diffs adversarially, and Claude Code's built-in \`advisor\` catches approach drift. \`mcp__${key("search")}__code\` is meaning-first code search and \`mcp__${key("search")}__web\` returns citable web sources.`
 	];
 	if (opts.workerToolsAvailable) lines.push(`Background \`worker-*\` agents (explore, review, plan, implement, test${opts.browseAvailable ? ", browse" : ""}) run delegated work in their own context without blocking your turn, and \`mcp__${key("orchestrate")}__*\` composes, verifies, and runs floor-raising workflows.`);
@@ -34262,7 +35098,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "explore",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-explore` agent. Dispatch via the Agent tool (subagent_type: worker-explore) so the turn is never blocked; the result arrives as a completion notification. Read-only investigation by an autonomous worker (Pi runtime; default model `gemini-3.6-flash` at high reasoning, override via the `model` arg with any Copilot-catalog model that advertises `tool_calls`). It has read, glob, grep, semantic-first code search, web search, fetch_url, advisor, update_plan, and read-only toolbelt tools, and it returns a single text answer. Use for bounded research, repo discovery, dependency investigation, or multi-file reading that would otherwise consume the lead context window. Not for implementation, test authoring, or verification of a concrete diff; use implement, test, or review for those scopes. Brief the investigation goal and constraints, not step-by-step tool semantics. Strictly read-only: it changes nothing on disk, and its returned text is the only artifact it produces — route to `implement` or `test` when a file actually needs to change. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
+		description: "Runs as the background `worker-explore` agent. Dispatch via the Agent tool (subagent_type: worker-explore) so the turn is never blocked; the result arrives as a completion notification. Read-only investigation by an autonomous worker (Pi runtime; default model `gpt-5.6-luna` at high reasoning, override via the `model` arg with any Copilot-catalog model that advertises `tool_calls`). It has read, glob, grep, semantic-first code search, web search, fetch_url, advisor, update_plan, and read-only toolbelt tools, and it returns a single text answer. Use for bounded research, repo discovery, dependency investigation, or multi-file reading that would otherwise consume the lead context window. Not for implementation, test authoring, or verification of a concrete diff; use implement, test, or review for those scopes. Brief the investigation goal and constraints, not step-by-step tool semantics. Strictly read-only: it changes nothing on disk, and its returned text is the only artifact it produces — route to `implement` or `test` when a file actually needs to change. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -34274,7 +35110,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				model: {
 					type: "string",
-					description: "Optional Copilot catalog model id (defaults to gemini-3.6-flash). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch. Override by task weight: `gpt-5.6-sol` (heavy/deep), `gpt-5.6-terra` (moderate), `gemini-3.6-flash` (light/cheap) — all 1M context; pair with thinking:'high'."
+					description: "Optional Copilot catalog model id (defaults to gpt-5.6-luna). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch. Override by task weight: `gpt-5.6-sol` (heavy/deep), `gpt-5.6-terra` (moderate), `gpt-5.6-luna` (light/cheap) — all 1M context; pair with thinking:'high'."
 				},
 				thinking: {
 					type: "string",
@@ -34283,7 +35119,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				workspace: {
 					type: "string",
-					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected)."
+					description: "Absolute path of the directory the worker operates in. Pass YOUR OWN current working directory unless you were told to target a different one — the proxy is a separate, long-lived process and cannot see where you are, so it falls back to your session's directory, which is not necessarily yours (a sub-agent or a git worktree moves you without moving the session). Omitting it when the connection supplies nothing is an error rather than a guess. Must be absolute (relative paths rejected)."
 				},
 				maxWallClockMs: {
 					type: "integer",
@@ -34291,11 +35127,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				}
 			}
 		},
-		async handler(args, signal) {
+		async handler(args, signal, ctx) {
 			return runWorkerToolCall({
 				mode: "explore",
 				args,
-				signal
+				signal,
+				ctx
 			});
 		}
 	},
@@ -34303,7 +35140,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "implement",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-implement` agent. Dispatch via the Agent tool (subagent_type: worker-implement) so the turn is never blocked; the result arrives as a completion notification. Delegates a scoped coding task to an autonomous worker (Pi runtime; default model `gpt-5.6-sol` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the explore read-only tools plus edit, write, bash, and codex_review, and it returns its final text with any changed files or worktree diff. Use for bounded implementation work that may take a while or benefits from isolated worker context. Not for pure research, planning, review, or independent test authoring; use explore, plan, review, or test for those scopes. ALWAYS runs in an isolated git worktree and returns the diff via a saved patch file (a `--stat` summary + a bounded preview + the patch path; a small diff is inlined in full) — it never edits your working tree, and it HARD-ERRORS if the workspace is not a git repository. For in-place edits, use the native `implementer` subagent. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
+		description: "Runs as the background `worker-implement` agent. Dispatch via the Agent tool (subagent_type: worker-implement) so the turn is never blocked; the result arrives as a completion notification. Delegates a scoped coding task to an autonomous worker (Pi runtime; default model `gpt-5.6-sol` at high reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the explore read-only tools plus edit, write, bash, and codex_review, and it returns its final text with any changed files or worktree diff. Use for bounded implementation work that may take a while or benefits from isolated worker context. Not for pure research, planning, review, or independent test authoring; use explore, plan, review, or test for those scopes. ALWAYS runs in an isolated git worktree and returns the diff via a saved patch file (a `--stat` summary + a bounded preview + the patch path; a small diff is inlined in full) — it never edits your working tree, and it HARD-ERRORS if the workspace is not a git repository. For in-place edits, use the native `implementer` subagent. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -34319,7 +35156,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				model: {
 					type: "string",
-					description: "Optional Copilot catalog model id (defaults to gpt-5.6-sol). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch. Override by task weight: `gpt-5.6-sol` (heavy/deep), `gpt-5.6-terra` (moderate), `gemini-3.6-flash` (light/cheap) — all 1M context; pair with thinking:'high'."
+					description: "Optional Copilot catalog model id (defaults to gpt-5.6-sol). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch. Override by task weight: `gpt-5.6-sol` (heavy/deep), `gpt-5.6-terra` (moderate), `gpt-5.6-luna` (light/cheap) — all 1M context; pair with thinking:'high'."
 				},
 				thinking: {
 					type: "string",
@@ -34328,7 +35165,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				workspace: {
 					type: "string",
-					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected). Must be inside a git repo (implement always runs in a worktree)."
+					description: "Absolute path of the directory the worker operates in. Pass YOUR OWN current working directory unless you were told to target a different one — the proxy is a separate, long-lived process and cannot see where you are, so it falls back to your session's directory, which is not necessarily yours (a sub-agent or a git worktree moves you without moving the session). Omitting it when the connection supplies nothing is an error rather than a guess. Must be absolute (relative paths rejected). Must be inside a git repo (implement always runs in a worktree)."
 				},
 				maxWallClockMs: {
 					type: "integer",
@@ -34336,11 +35173,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				}
 			}
 		},
-		async handler(args, signal) {
+		async handler(args, signal, ctx) {
 			return runWorkerToolCall({
 				mode: "implement",
 				args,
-				signal
+				signal,
+				ctx
 			});
 		}
 	},
@@ -34348,7 +35186,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "review",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-review` agent. Dispatch via the Agent tool (subagent_type: worker-review) so the turn is never blocked; the result arrives as a completion notification. Read-only code review by an autonomous worker (Pi runtime; default model `gemini-3.1-pro-preview`, default thinking xhigh clamped to high for that model, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read-only toolset as explore and verifies claims against surrounding repository context before returning severity-ranked findings with `file:line` citations. Use for reviewing a change, diff, or correctness claim when the reviewer should read the code itself rather than trusting a pasted artifact. Not for architecture critique, implementation, or test authoring; use codex_critic or gemini_critic for design review, implement for edits, and test for independent test creation. Strictly read-only: it changes nothing on disk, and its returned text is the only artifact it produces — route to `implement` or `test` when a file actually needs to change. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
+		description: "Runs as the background `worker-review` agent. Dispatch via the Agent tool (subagent_type: worker-review) so the turn is never blocked; the result arrives as a completion notification. Code review by an autonomous worker (Pi runtime; default model `gemini-3.1-pro-preview`, default thinking xhigh clamped to high for that model, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has explore's read-and-search tools PLUS `bash`, so it verifies claims by running them — reproducing a failure or running the build or suite — rather than only reading, and returns severity-ranked findings with `file:line` citations. It gets no edit/write tools unless you pass `worktree: true`, but `bash` runs real commands in the workspace, so a build or test it invokes can touch the tree. Use for reviewing a change, diff, or correctness claim when the reviewer should read the code itself rather than trusting a pasted artifact. Not for architecture critique, implementation, or test authoring; use codex_critic or gemini_critic for design review, implement for edits, and test for independent test creation. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -34360,16 +35198,20 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				model: {
 					type: "string",
-					description: "Optional Copilot catalog model id (defaults to gemini-3.1-pro-preview). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch. Override by task weight: `gpt-5.6-sol` (heavy/deep), `gpt-5.6-terra` (moderate), `gemini-3.6-flash` (light/cheap) — all 1M context; pair with thinking:'high'."
+					description: "Optional Copilot catalog model id (defaults to gemini-3.1-pro-preview). Must advertise tool_calls support; the engine emits an isError envelope listing the eligible catalog models on mismatch. Override by task weight: `gpt-5.6-sol` (heavy/deep), `gpt-5.6-terra` (moderate), `gpt-5.6-luna` (light/cheap) — all 1M context; pair with thinking:'high'."
 				},
 				thinking: {
 					type: "string",
 					enum: WORKER_THINKING_LEVELS,
 					description: "Optional reasoning depth (defaults to xhigh, clamped to high for the default review model). Silently clamped to the model's allowed range; \"off\" drops the parameter entirely."
 				},
+				worktree: {
+					type: "boolean",
+					description: "Optional. When true, the review runs in an isolated git worktree replaying the workspace's working tree (dirty tracked changes and untracked-not-ignored files), which additionally grants `edit`/`write` so the reviewer can author a throwaway probe test to prove a claim. Default false: the reviewer reads and runs commands in the workspace itself. Prefer the default when verifying needs the build to work — a fresh worktree does not carry IGNORED files, so installed dependencies are absent. Requires a git repository."
+				},
 				workspace: {
 					type: "string",
-					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected)."
+					description: "Absolute path of the directory the worker operates in. Pass YOUR OWN current working directory unless you were told to target a different one — the proxy is a separate, long-lived process and cannot see where you are, so it falls back to your session's directory, which is not necessarily yours (a sub-agent or a git worktree moves you without moving the session). Omitting it when the connection supplies nothing is an error rather than a guess. Must be absolute (relative paths rejected)."
 				},
 				maxWallClockMs: {
 					type: "integer",
@@ -34377,11 +35219,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				}
 			}
 		},
-		async handler(args, signal) {
+		async handler(args, signal, ctx) {
 			return runWorkerToolCall({
 				mode: "review",
 				args,
-				signal
+				signal,
+				ctx
 			});
 		}
 	},
@@ -34389,7 +35232,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "plan",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-plan` agent. Dispatch via the Agent tool (subagent_type: worker-plan) so the turn is never blocked; the result arrives as a completion notification. Read-only implementation planning by an autonomous worker (Pi runtime; default model `claude-opus-5` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read-only toolset as explore and returns a concrete, ordered implementation plan covering files, approach, risks, and how acceptance criteria will be verified. Use before coding when the task needs repo-grounded sequencing or acceptance criteria translated into implementation steps. Not for editing files, running an implementation, writing tests, or adversarial review; use implement, test, or review for those scopes. Strictly read-only: it changes nothing on disk, and its returned text is the only artifact it produces — route to `implement` or `test` when a file actually needs to change. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
+		description: "Runs as the background `worker-plan` agent. Dispatch via the Agent tool (subagent_type: worker-plan) so the turn is never blocked; the result arrives as a completion notification. Read-only implementation planning by an autonomous worker (Pi runtime; default model `claude-opus-5` at high reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read-only toolset as explore and returns a concrete, ordered implementation plan covering files, approach, risks, and how acceptance criteria will be verified. Use before coding when the task needs repo-grounded sequencing or acceptance criteria translated into implementation steps. Not for editing files, running an implementation, writing tests, or adversarial review; use implement, test, or review for those scopes. Strictly read-only: it changes nothing on disk, and its returned text is the only artifact it produces — route to `implement` or `test` when a file actually needs to change. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -34410,7 +35253,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				workspace: {
 					type: "string",
-					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected)."
+					description: "Absolute path of the directory the worker operates in. Pass YOUR OWN current working directory unless you were told to target a different one — the proxy is a separate, long-lived process and cannot see where you are, so it falls back to your session's directory, which is not necessarily yours (a sub-agent or a git worktree moves you without moving the session). Omitting it when the connection supplies nothing is an error rather than a guess. Must be absolute (relative paths rejected)."
 				},
 				maxWallClockMs: {
 					type: "integer",
@@ -34418,11 +35261,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				}
 			}
 		},
-		async handler(args, signal) {
+		async handler(args, signal, ctx) {
 			return runWorkerToolCall({
 				mode: "plan",
 				args,
-				signal
+				signal,
+				ctx
 			});
 		}
 	},
@@ -34430,7 +35274,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "test",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-test` agent. Dispatch via the Agent tool (subagent_type: worker-test) so the turn is never blocked; the result arrives as a completion notification. Independent adversarial test authoring by an autonomous worker (Pi runtime; default model `gpt-5.6-sol` at xhigh reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read/write toolset as implement and writes tests that try to break the implementation through edge cases, error paths, and acceptance criteria, then runs them and reports pass/fail. Use when a separate test author should challenge an implementation without modifying the production code to make tests pass. Not for implementing fixes, broad research, or code review; use implement, explore, or review for those scopes. ALWAYS runs in an isolated git worktree and returns the test diff via a saved patch file (a `--stat` summary + a bounded preview + the patch path; a small diff is inlined in full) — it never edits your working tree, and it HARD-ERRORS if the workspace is not a git repository. For in-place test authoring, use the native `implementer` subagent. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
+		description: "Runs as the background `worker-test` agent. Dispatch via the Agent tool (subagent_type: worker-test) so the turn is never blocked; the result arrives as a completion notification. Independent adversarial test authoring by an autonomous worker (Pi runtime; default model `gpt-5.6-sol` at high reasoning, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read/write toolset as implement and writes tests that try to break the implementation through edge cases, error paths, and acceptance criteria, then runs them and reports pass/fail. Use when a separate test author should challenge an implementation without modifying the production code to make tests pass. Not for implementing fixes, broad research, or code review; use implement, explore, or review for those scopes. ALWAYS runs in an isolated git worktree and returns the test diff via a saved patch file (a `--stat` summary + a bounded preview + the patch path; a small diff is inlined in full) — it never edits your working tree, and it HARD-ERRORS if the workspace is not a git repository. For in-place test authoring, use the native `implementer` subagent. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -34455,7 +35299,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				workspace: {
 					type: "string",
-					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected). Must be inside a git repo (test always runs in a worktree)."
+					description: "Absolute path of the directory the worker operates in. Pass YOUR OWN current working directory unless you were told to target a different one — the proxy is a separate, long-lived process and cannot see where you are, so it falls back to your session's directory, which is not necessarily yours (a sub-agent or a git worktree moves you without moving the session). Omitting it when the connection supplies nothing is an error rather than a guess. Must be absolute (relative paths rejected). Must be inside a git repo (test always runs in a worktree)."
 				},
 				maxWallClockMs: {
 					type: "integer",
@@ -34463,11 +35307,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				}
 			}
 		},
-		async handler(args, signal) {
+		async handler(args, signal, ctx) {
 			return runWorkerToolCall({
 				mode: "test",
 				args,
-				signal
+				signal,
+				ctx
 			});
 		}
 	},
@@ -34677,7 +35522,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "browse",
 		group: "workers",
 		capability: "browse_agent",
-		description: "Runs as the background `worker-browse` agent. Dispatch via the Agent tool (subagent_type: worker-browse) so the turn is never blocked; the result arrives as a completion notification. A Pi-driven autonomous browser worker (default model `gpt-5.4-mini`) drives a real browser to accomplish `task`, keeps raw DOM and page snapshots inside its own context, and returns a single text result. Use for delegated multi-step web tasks such as comparing prices, logging into a dashboard, or summarizing pages when the lead does not need to steer each click. Not for direct in-context browser control, screenshots, or precise element interactions; use the `browser` MCP tools for those. Pass `sessionId` to continue a prior browse session, or omit it for a fresh isolated session; multiple calls run as parallel sessions on the shared browser. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
+		description: "Runs as the background `worker-browse` agent. Dispatch via the Agent tool (subagent_type: worker-browse) so the turn is never blocked; the result arrives as a completion notification. A Pi-driven autonomous browser worker (default model `gpt-5.6-luna`) drives a real browser to accomplish `task`, keeps raw DOM and page snapshots inside its own context, and returns a single text result. Use for delegated multi-step web tasks such as comparing prices, logging into a dashboard, or summarizing pages when the lead does not need to steer each click. Not for direct in-context browser control, screenshots, or precise element interactions; use the `browser` MCP tools for those. Pass `sessionId` to continue a prior browse session, or omit it for a fresh isolated session; multiple calls run as parallel sessions on the shared browser. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["task"],
@@ -34790,10 +35635,12 @@ function assertMcpToolSurfaceConsistent() {
 /**
 * Shared closure body for the two worker MCP tools. Validates the
 * minimal arg shape (prompt required + optional knobs typed), then
-* forwards to `runWorkerAgent`. Outside serve mode, `workspace` defaults
-* to the proxy's launch cwd; serve mode requires an explicit/header-derived
-* workspace. Callers can override via the optional `workspace` arg
-* (absolute paths only — enforced here). The engine performs every
+* forwards to `runWorkerAgent`. `workspace` comes from the caller's
+* argument or, failing that, the per-connection session header the
+* boundary folds in; with neither, the call is REFUSED rather than
+* defaulted to the proxy's launch cwd (see the resolution block below
+* for why that default was a bug, and `GH_ROUTER_ALLOW_PROXY_CWD_WORKSPACE`
+* for the raw-client escape hatch). The engine performs every
 * deeper validation (model existence, thinking clamp, worktree
 * provisioning, semaphore acquisition, workspace realpath +
 * accessibility) and never throws — its `{text, isError?}` envelope
@@ -34806,7 +35653,7 @@ function assertMcpToolSurfaceConsistent() {
 * client that ignores the schema.
 */
 async function runWorkerToolCall(call) {
-	const { mode, args, signal } = call;
+	const { mode, args, signal, ctx } = call;
 	const prompt = typeof args.prompt === "string" ? args.prompt : "";
 	if (!prompt) return {
 		content: [{
@@ -34838,7 +35685,7 @@ async function runWorkerToolCall(call) {
 	}
 	let worktree;
 	let worktreeNote = "";
-	if (mode === "implement" || mode === "test") {
+	if (mode === "implement" || mode === "test" || mode === "review") {
 		if (args.worktree !== void 0 && typeof args.worktree !== "boolean") return {
 			content: [{
 				type: "text",
@@ -34846,11 +35693,16 @@ async function runWorkerToolCall(call) {
 			}],
 			isError: true
 		};
-		worktree = true;
-		if (args.worktree === false) worktreeNote = `[note: worker_${mode} always runs in an isolated git worktree; the requested worktree:false was overridden. For in-place edits, use the \`implementer\` subagent.]
+		if (mode === "review") worktree = args.worktree === true ? true : void 0;
+		else {
+			worktree = true;
+			if (args.worktree === false) worktreeNote = `[note: worker_${mode} always runs in an isolated git worktree; the requested worktree:false was overridden. For in-place edits, use the \`implementer\` subagent.]
 
 `;
+		}
 	}
+	const allowProxyCwd = process.env.GH_ROUTER_ALLOW_PROXY_CWD_WORKSPACE === "1";
+	const callerGaveWorkspace = args.workspace !== void 0;
 	let workspace;
 	if (args.workspace !== void 0) {
 		if (typeof args.workspace !== "string" || args.workspace.length === 0) return {
@@ -34875,7 +35727,16 @@ async function runWorkerToolCall(call) {
 		}],
 		isError: true
 	};
-	else workspace = process.cwd();
+	else if (allowProxyCwd) workspace = process.cwd();
+	else return {
+		content: [{
+			type: "text",
+			text: `worker_${mode}: a workspace is required. Nothing in this call said which directory to run in, and the proxy's own launch directory is not a safe guess — it is where the proxy was started, which may be a different checkout or git worktree than the one you are working in. Re-issue this call with \`workspace\` set to the absolute path of your current working directory. (Operators running a raw MCP client that cannot send one can restore the old launch-cwd default with GH_ROUTER_ALLOW_PROXY_CWD_WORKSPACE=1.)`
+		}],
+		isError: true
+	};
+	const effectiveSource = ctx?.workspaceSource ?? (callerGaveWorkspace ? "argument" : "absent");
+	const workspaceNote = effectiveSource === "argument" ? "" : `[workspace: ${workspace} (${effectiveSource === "session" ? "from your session's working directory; pass `workspace` explicitly if you are running somewhere else, such as a git worktree" : "the proxy's launch directory"})]\n\n`;
 	let maxWallClockMs;
 	let clampNote = "";
 	if (args.maxWallClockMs !== void 0) {
@@ -34903,7 +35764,7 @@ async function runWorkerToolCall(call) {
 		maxWallClockMs,
 		signal
 	});
-	const notePrefix = `${clampNote}${worktreeNote}`;
+	const notePrefix = `${workspaceNote}${clampNote}${worktreeNote}`;
 	return {
 		content: [{
 			type: "text",
@@ -35136,6 +35997,6 @@ function enumerateInjectedMcpToolNames(groupKeys, opts = {}) {
 	return [...new Set(names)];
 }
 //#endregion
-export { browserToolsEnabled as $, searchWeb as A, CONDENSED_OPERATING_SEQUENCE as At, buildAnthropicErrorEvent as B, UPSTREAM_INACTIVITY_TIMEOUT_MS as Bt, buildToolbeltAwareness as C, provisionBrowserAssets as Ct, TOOLBELT_TOOLS$1 as D, extractTarGzMember as Dt, vscodeRipgrepPath as E, provisionAndIndexColbert as Et, isAdvisorRequested as F, DEFAULT_CLAUDE_MODEL_FALLBACKS as Ft, relayAnthropicStream as G, withOneMSuffix as Gt, isControllerClosedError as H, pickClaudeDefault as Ht, formatThinkingRepairDecline as I, DEFAULT_CODEX_MODEL as It, agentToolsEnabled as J, handleMcpDelete as K, withInstallLock as Kt, rememberThinkingHistoryRepair as L, DEFAULT_CODEX_MODEL_FALLBACKS as Lt, ADVISOR_TOOL_INSTRUCTIONS as M, shouldUseInsecureTls as Mt, buildAdvisorStream as N, collapsePathKeys as Nt, assetFor as O, extractZipMember as Ot, injectAdvisorTool as P, toolbeltPathOverride as Pt, browserCompoundToolsEnabled as Q, repairKnownThinkingHistory as R, DEFAULT_PORT as Rt, availableToolCommands as S, parseJsonOrDiagnose as St, toolbeltSkipSet as T, colbertDegradedWarning as Tt, logStreamError as U, upstreamAllowH2 as Ut, buildOpenAIErrorEvent as V, generateRandomPort as Vt, readIteratorWithTimeout as W, upstreamMaxConnections as Wt, brainstormModel as X, artifactToolsEnabled as Y, browseAgentEnabled as Z, appendPlanReminder as _, pickEndpoint as _t, buildPeerAwarenessSnippet as a, nativeSubagentModel as at, runWorkerAgent as b, MAX_RESPONSE_BODY_BYTES as bt, personasFor as c, scribeModel as ct, EXPLORE_DEFAULT_MODEL as d, shimDefaultsToXhigh as dt, fleetToolsEnabled as et, EXPLORE_DEFAULT_THINKING as f, countTokens as ft, TEST_DEFAULT_MODEL as g, resolveMcpToolTimeoutMs as gt, REVIEW_DEFAULT_MODEL as h, assembleResponsesPayload as ht, buildAgentPrompt as i, genericModel as it, ADVISOR_INTERNAL_TOOL_NAME as j, DEFINITION_OF_GREATNESS as jt, satisfiesMinVersion as k, warmTreeSitterPool as kt, BROWSE_DEFAULT_MODEL as l, standInToolEnabled as lt, PLAN_DEFAULT_MODEL as m, getTokenCount as mt, MCP_GROUPS as n, genericCheapModel as nt, buildPeerAwarenessSummary as o, reviewerModel as ot, IMPLEMENT_DEFAULT_MODEL as p, createMessages as pt, handleMcpPost as q, assertMcpToolSurfaceConsistent as r, genericFastModel as rt, enumerateInjectedMcpToolNames as s, scoutModel as st, GROUP_META as t, geminiAvailable as tt, DEFAULT_MODEL as u, workerToolsEnabled as ut, resolveModeDefaults as v, createResponses as vt, toolbeltEnabled as w, hasSupportedBrowserInstalled as wt, buildEnv as x, readResponseBodyCapped as xt, resolveWorkerRunOpts as y, createChatCompletions as yt, repairRejectedThinkingHistory as z, UPSTREAM_FETCH_TIMEOUT_MS as zt };
+export { handleMcpDelete as $, resolveLeadSlugArg as $t, satisfiesMinVersion as A, hasSupportedBrowserInstalled as At, rememberThinkingHistoryRepair as B, collapsePathKeys as Bt, availableToolCommands as C, resolveMcpToolTimeoutMs as Ct, vscodeRipgrepPath as D, readResponseBodyCapped as Dt, toolbeltSkipSet as E, MAX_RESPONSE_BODY_BYTES as Et, injectAdvisorTool as F, warmTreeSitterPool as Ft, isControllerClosedError as G, DEFAULT_CODEX_MODEL as Gt, repairRejectedThinkingHistory as H, BUDGET_SMALL_FAST_CATALOG_ID as Ht, isAdvisorRequested as I, provisionTreeSitterAssets as It, relayAnthropicStream as J, UPSTREAM_FETCH_TIMEOUT_MS as Jt, logStreamError as K, DEFAULT_CODEX_MODEL_FALLBACKS as Kt, resolveAdvisorEffort as L, CONDENSED_OPERATING_SEQUENCE as Lt, ADVISOR_INTERNAL_TOOL_NAME as M, provisionAndIndexColbert as Mt, ADVISOR_TOOL_INSTRUCTIONS as N, extractTarGzMember as Nt, TOOLBELT_TOOLS$1 as O, parseJsonOrDiagnose as Ot, buildAdvisorStream as P, extractZipMember as Pt, clampEffort as Q, pickClaudeDefault as Qt, resolveAdvisorModel as R, DEFINITION_OF_GREATNESS as Rt, buildEnv as S, warnOnTokenPriceDrift as St, toolbeltEnabled as T, createChatCompletions as Tt, buildAnthropicErrorEvent as U, BUDGET_SMALL_FAST_SLUG as Ut, repairKnownThinkingHistory as V, toolbeltPathOverride as Vt, buildOpenAIErrorEvent as W, DEFAULT_CLAUDE_MODEL_FALLBACKS as Wt, UNKNOWN_EFFORT_ANCHOR as X, generateRandomPort as Xt, EFFORT_ORDER as Y, UPSTREAM_INACTIVITY_TIMEOUT_MS as Yt, bucketEffort as Z, isBudgetClaudeLead as Zt, appendPlanReminder as _, shimDefaultsToXhigh as _t, buildPeerAwarenessSnippet as a, withInstallLock as an, browserCompoundToolsEnabled as at, resolveWorkerRunOpts as b, getTokenCount as bt, personasFor as c, geminiAvailable as ct, EXPLORE_DEFAULT_MODEL as d, nativeSubagentModel as dt, upstreamAllowH2 as en, handleMcpPost as et, EXPLORE_DEFAULT_THINKING as f, reviewerModel as ft, TEST_DEFAULT_MODEL as g, workerToolsEnabled as gt, REVIEW_DEFAULT_MODEL as h, standInToolEnabled as ht, buildAgentPrompt as i, withOneMSuffixForLead as in, browseAgentEnabled as it, searchWeb as j, colbertDegradedWarning as jt, assetFor as k, provisionBrowserAssets as kt, BROWSE_DEFAULT_MODEL as l, generalPurposeFastModel as lt, PLAN_DEFAULT_MODEL as m, scribeModel as mt, MCP_GROUPS as n, classifyMessagesRoute as nn, artifactToolsEnabled as nt, buildPeerAwarenessSummary as o, browserToolsEnabled as ot, IMPLEMENT_DEFAULT_MODEL as p, scoutModel as pt, readIteratorWithTimeout as q, DEFAULT_PORT as qt, assertMcpToolSurfaceConsistent as r, withOneMSuffix as rn, brainstormModel as rt, enumerateInjectedMcpToolNames as s, fleetToolsEnabled as st, GROUP_META as t, upstreamMaxConnections as tn, agentToolsEnabled as tt, DEFAULT_MODEL_CHAIN as u, implementerFastModel as ut, resolveDefaultModel as v, countTokens as vt, buildToolbeltAwareness as w, createResponses as wt, runWorkerAgent as x, assembleResponsesPayload as xt, resolveModeDefaults as y, createMessages as yt, formatThinkingRepairDecline as z, shouldUseInsecureTls as zt };
 
-//# sourceMappingURL=peer-mcp-personas-DRL_xT4h.js.map
+//# sourceMappingURL=peer-mcp-personas-V6stFvpq.js.map