github-router 0.3.282 → 0.3.285

package/dist/{peer-mcp-personas-l4P4s1fK.js → peer-mcp-personas-V6stFvpq.js}

@@ -163,6 +163,221 @@ function withOneMSuffix(id) {
 	if (oneMContextDisabled()) return id;
 	return catalogAdvertises1M(id) ? `${id}[1m]` : id;
 }
+/**
+* Decorate a slug the USER named — a `-m` argument or a launcher default — with
+* `[1m]` iff the model it actually RESOLVES to serves >=1M context.
+*
+* The difference from `withOneMSuffix` is the resolution step, and it exists
+* because the two functions are handed different kinds of string. Every
+* `withOneMSuffix` caller already holds a concrete catalog id from a catalog
+* walk, so an exact-id match is both sufficient and the safer rule: inferring a
+* match there could attach `[1m]` to a sibling that does not serve 1M. A lead
+* slug is the opposite case — it is whatever the user typed, or an
+* Anthropic-published dashed slug like `claude-opus-4-8` that the catalog
+* carries in dotted form. Exact-id matching answers "no 1M" for those purely
+* because it never found the entry, which is the silent under-accounting this
+* function exists to stop.
+*
+* Resolving first also picks up the `-1m` SIBLING shape for free:
+* `resolveModel`'s opus family preference maps `claude-opus-4-7` onto
+* `claude-opus-4.7-1m-internal` when that is what the tier carries, and the
+* sibling's own advertised window then answers the question. That is the same
+* dual-signal conclusion `pickClaudeDefault` reaches for the family shorthand,
+* so the two paths cannot disagree about a family both can be asked about.
+*
+* Idempotent: a slug that already carries the bracket is returned unchanged, so
+* a user who pins `-m claude-opus-5[1m]` by hand does not get `[1m][1m]`. That
+* early return deliberately does NOT re-validate the pin against the catalog.
+* `-m claude-haiku-4-5[1m]` therefore survives even though Haiku 4.5 is a 200K
+* model — the same as before this function existed, and `resolveModel` already
+* warns loudly about exactly that case. Stripping a bracket the user typed
+* would be the surprising behaviour, and it would be the only place in the
+* launcher that overrides an explicit `-m`.
+*
+* A repeat can still arrive from the CLIENT side rather than from here: the
+* `/model` picker rows are seeded already decorated, and Claude Code's alias
+* path appends its own bracket (`getDefaultSonnetModel() + '[1m]'`), so
+* selecting `sonnet[1m]` puts `claude-sonnet-5[1m][1m]` on the wire. That
+* resolves to the same bare id — `resolveModel`'s strip recurses — and Claude
+* Code's own detector is unanchored, so local accounting is right too. Pinned
+* by a regression test in `tests/lib-utils.test.ts`.
+*
+* Degrades the same safe direction as everything else here. An unpopulated
+* catalog makes `resolveModel` a pass-through and `catalogAdvertises1M` false,
+* so the slug stays bare and Claude Code accounts at its conservative 200K
+* default — under-accounting, never overflow.
+*/
+function withOneMSuffixForLead(slug) {
+	if (oneMContextDisabled()) return slug;
+	if (/\[1m\]$/i.test(slug)) return slug;
+	return catalogAdvertises1M(resolveModel(slug)) ? `${slug}[1m]` : slug;
+}
+//#endregion
+//#region src/services/copilot/endpoint.ts
+/**
+* Catalog spellings that mean each of our two clients. Copilot is not
+* self-consistent about the `/v1` prefix — the live catalog advertises
+* `/v1/messages` prefixed but `/chat/completions` bare, and this repo's own
+* fixtures carry both forms — so an exact-match on the bare spelling alone
+* silently misses a real shape. `src/lib/model-validation.ts` already
+* normalizes the same way (`ENDPOINT_ALIASES`); this keeps the two agreeing.
+*
+* Matching is EXACT against this set, never a suffix/`includes` test: a
+* `ws:/responses` (websocket transport) entry is NOT the `/responses` HTTP
+* client and must keep resolving to "serves neither".
+*/
+const CHAT_ENDPOINTS = /* @__PURE__ */ new Set(["/chat/completions", "/v1/chat/completions"]);
+const RESPONSES_ENDPOINTS = /* @__PURE__ */ new Set(["/responses", "/v1/responses"]);
+/**
+* Decide which endpoint to call for a model from its catalog
+* `supported_endpoints`. Prefers `/chat/completions` when available (the
+* simpler, more widely-supported shape) and falls back to `/responses` for
+* models that ONLY serve the Responses API — the gpt-5.x family except
+* `gpt-5-mini` / `gpt-5.4` (e.g. `gpt-5.4-mini`, `gpt-5.5`, the
+* `*-codex` models). Returns undefined when the model serves neither, so a
+* caller can skip it rather than 400 on `unsupported_api_for_model`.
+*
+* A model that OMITS `supported_endpoints` is treated as chat-eligible: the
+* catalog historically omits the field for chat-default models, and
+* excluding those would be a worse regression than the gap this guards.
+*/
+function pickEndpoint(model) {
+	const eps = model.supported_endpoints;
+	if (!eps || eps.length === 0) return "chat";
+	if (eps.some((e) => CHAT_ENDPOINTS.has(e))) return "chat";
+	if (eps.some((e) => RESPONSES_ENDPOINTS.has(e))) return "responses";
+}
+/**
+* `pickEndpoint` by model id against the live catalog, WITHOUT collapsing
+* "absent from the catalog" into "serves neither of our endpoints".
+*
+* This function deliberately has no default. The predecessor
+* (`endpointForModelId`) returned `pickEndpoint(found) ?? "chat"`, which
+* coerced both cases to "chat" — defensible for an unknown id, silently wrong
+* for a catalog model serving only, say, `/v1/messages`: the caller would drive
+* it through the chat client and get an opaque upstream 400 with no local
+* signal about the real cause. `src/lib/browser-mcp/compressor.ts` already
+* treats that case correctly (`if (!endpoint) continue`); this makes the same
+* distinction available to callers that resolve by id.
+*
+* Callers that legitimately want the chat default for an unknown id can still
+* have it — they just have to write it, per case, on purpose.
+*/
+function resolveEndpointForModelId(id) {
+	const found = state.models?.data?.find((m) => m.id === id);
+	if (!found) return { kind: "unknown-model" };
+	const endpoint = pickEndpoint(found);
+	if (endpoint) return {
+		kind: "endpoint",
+		endpoint
+	};
+	return {
+		kind: "unreachable",
+		endpoints: found.supported_endpoints ?? []
+	};
+}
+//#endregion
+//#region src/lib/anthropic-translate/classifier.ts
+/**
+* Routing classifier for `POST /v1/messages`.
+*
+* Claude Code speaks the Anthropic Messages wire format. Copilot only serves
+* Claude models on its native `/v1/messages` endpoint; a gpt/gemini request
+* sent there 400s. This classifier decides, from the RESOLVED model id and its
+* catalog metadata, whether a request stays on the native passthrough
+* (`createMessages`) or is diverted to the translation shim.
+*
+* Non-regression is the whole point — every Claude model (opus / sonnet / haiku /
+* any `claude-*` or Anthropic-vendored id) MUST return "claude-passthrough" so
+* its bytes reach `createMessages` unchanged — even if future catalog metadata
+* were to (wrongly) advertise a `/responses` endpoint for it. The Claude check
+* is therefore keyed off identity (id / vendor / family), NOT the endpoint.
+*
+* Non-Claude models are diverted to the translation shim by the endpoint the
+* catalog says they serve: `/responses` models (gpt-5.5, gpt-5.3-codex, …) take
+* the Responses path (`responses-shim`), `/chat/completions` models (gemini,
+* and any chat-default model) take the chat path (`chat-shim`). The decision is
+* derived from `pickEndpoint` (catalog `supported_endpoints`), never a
+* hardcoded slug list, so it generalizes. Copilot only serves Claude models on
+* its native `/v1/messages`, so diverting every non-Claude model to a shim is
+* correct — a non-Claude request sent to `/v1/messages` would 400.
+*/
+/**
+* Match "claude"/"anthropic" as a delimiter-bounded segment anywhere in a model
+* id: at the start, or after a `/ _ . : -` path/version delimiter, and followed
+* by end-of-string, another such delimiter, or a digit. This catches catalog
+* aliases like `github/claude-3-7-sonnet` or `anthropic/…` whose vendor is
+* "github" and whose family is empty — where the token only surfaces mid-id —
+* while NOT firing on incidental substrings like `notclaude`. Deliberately
+* over-inclusive at the boundaries: we fail CLOSED toward Claude (→ passthrough)
+* so a real Claude model can never be diverted to the non-Claude shim.
+*/
+const CLAUDE_ID_RE = /(^|[/_.:-])(claude|anthropic)(?=$|[/_.:-]|\d)/i;
+/**
+* True when the target is a Claude / Anthropic model. Matches on any of:
+* catalog vendor containing "anthropic", capability family containing "claude",
+* or a Claude/anthropic path-segment (see `CLAUDE_ID_RE`) in ANY id we hold —
+* the resolved id (`modelId`), the pre-resolution request id (`originalModelId`),
+* or the catalog entry's own id (`model.id`). Conservative by design: when in
+* doubt it returns true so a Claude request can never be diverted to the shim.
+*/
+function isClaudeModel(modelId, model, originalModelId) {
+	if (model) {
+		if ((model.vendor?.toLowerCase() ?? "").includes("anthropic")) return true;
+		if ((model.capabilities?.family?.toLowerCase() ?? "").includes("claude")) return true;
+	}
+	return [
+		modelId,
+		originalModelId,
+		model?.id
+	].some((id) => typeof id === "string" && CLAUDE_ID_RE.test(id));
+}
+/**
+* Decide the route for a resolved model id + its catalog entry.
+*
+* - No model id, or a Claude model → "claude-passthrough" (existing behaviour).
+* - A non-Claude model whose catalog endpoint is `/responses` → "responses-shim".
+* - A non-Claude model whose catalog endpoint is `/chat/completions` (gemini and
+*   any chat-default model) → "chat-shim".
+* - A non-Claude model absent from the catalog (so we can't confirm an endpoint)
+*   → "claude-passthrough" (unchanged; we don't divert what we can't classify).
+* - A non-Claude model that IS in the catalog and serves NEITHER of the two shim
+*   endpoints (`pickEndpoint` → undefined) → "claude-passthrough" as well.
+*
+* Those last two land on the same route but are NOT the same answer, and the
+* coincidence is deliberate rather than a collapsed default (contrast
+* `resolveEndpointForModelId`, whose callers must tell them apart because
+* guessing there produces an opaque upstream 400). Here neither shim is even a
+* candidate: a shim can only speak `/responses` or `/chat/completions`, so
+* diverting a model that serves neither would 400 just as surely. Passthrough
+* is the better default because it is sometimes RIGHT — a non-Claude catalog
+* model advertising `/v1/messages` is served by exactly the endpoint
+* passthrough uses. It also preserves this module's fail-CLOSED-toward-Claude
+* invariant: an unclassifiable model is never diverted.
+*
+* KNOWN GAP (audited, deliberately not fixed here): a non-Claude model serving
+* only something we cannot speak at all (say `/embeddings`) also lands on
+* passthrough and will still 400 upstream — `logEndpointMismatch(modelId,
+* "/v1/messages")` logs it at the passthrough seam, but no local error is
+* raised. Closing that needs a change in `src/routes/messages/handler.ts`,
+* which this seam does not own. It is strictly narrower than the defect fixed
+* in `resolveEndpointForModelId`: no such model is reachable as a Claude Code
+* `/v1/messages` target today, whereas the plan worker's `claude-opus-5`
+* default is.
+*
+* `originalModelId` is the optional pre-resolution request id; when supplied it
+* is checked for Claude-likeness alongside the resolved id so an alias that
+* resolves to a non-Claude-looking id can't slip past.
+*/
+function classifyMessagesRoute(modelId, model, originalModelId) {
+	if (!modelId) return "claude-passthrough";
+	if (isClaudeModel(modelId, model, originalModelId)) return "claude-passthrough";
+	if (!model) return "claude-passthrough";
+	const endpoint = pickEndpoint(model);
+	if (endpoint === "responses") return "responses-shim";
+	if (endpoint === "chat") return "chat-shim";
+	return "claude-passthrough";
+}
 //#endregion
 //#region src/lib/port.ts
 const DEFAULT_PORT = 8787;
@@ -209,11 +424,22 @@ const DEFAULT_CLAUDE_MODEL_FALLBACKS = [
 * This helper detects the catalog state at launch and only opts in
 * when the backend can actually serve 1M.
 *
-* Sonnet/Haiku families are intentionally NOT given `[1m]` defaults
-* because Copilot has no 1M backend for them (and Anthropic-side
-* `modelSupports1M` doesn't list haiku at all). See
-* `src/lib/server-setup.ts:getClaudeCodeEnvVars` for the
-* `ANTHROPIC_DEFAULT_{SONNET,HAIKU,OPUS}_MODEL` tier defaults.
+* This helper answers the question only for the OPUS families, because a
+* family is what it is asked about (`-m 4.7` names no slug). Every other lead
+* slug — `-m fast`, a full slug a power user pins, the implicit budget lead —
+* goes through `withOneMSuffixForLead` (`./one-m-context`) instead, which
+* resolves the slug first and then reads the resolved entry's advertised
+* window. The two agree wherever both can be asked: a family that resolves to a
+* 1M backend is 1M by either route.
+*
+* A previous revision of this comment claimed Sonnet and Haiku were left bare
+* because "Copilot has no 1M backend for them". That was true when it was
+* written and is now false for Sonnet: the live catalog advertises
+* `max_context_window_tokens: 1_000_000` on both `claude-sonnet-5` and
+* `claude-sonnet-4.6` (Haiku 4.5 really is 200K, and is left bare by the same
+* catalog check rather than by a hardcoded family rule). Nothing here is
+* family-gated any more — the catalog decides per model, so the next family
+* that ships 1M is picked up without an edit.
 *
 * Must be called AFTER `cacheModels()` has populated `state.models`.
 * Returns the bare slug if the catalog isn't populated (resolveModel
@@ -221,6 +447,88 @@ const DEFAULT_CLAUDE_MODEL_FALLBACKS = [
 * variant" — defaulting safe-side preserves the pre-change behavior).
 */
 const DEFAULT_OPUS_FAMILY = "5";
+/** The lead `-m fast` selects. Anthropic-published dashed slug that is also the
+*  Copilot catalog id verbatim, so `resolveModel` matches it exactly. */
+const BUDGET_LEAD_MODEL = "claude-sonnet-5";
+/** Small/fast tier for a budget lead, in the two forms this codebase needs.
+*
+*  `SLUG` is the Anthropic-published DASHED form and is what goes into
+*  `ANTHROPIC_SMALL_FAST_MODEL` / `ANTHROPIC_DEFAULT_HAIKU_MODEL`: Claude Code's
+*  `/model` registry is keyed on Anthropic slugs, and seeding Copilot's dotted
+*  id there reproduces the documented `claude-opus-5` failure where the picker
+*  silently falls back to an older model. `CATALOG_ID` is Copilot's DOTTED id
+*  and is what the presence probe must test, because that is the id the catalog
+*  actually carries. `resolveModel` bridges the two at request time. */
+const BUDGET_SMALL_FAST_SLUG = "claude-haiku-4-5";
+const BUDGET_SMALL_FAST_CATALOG_ID = "claude-haiku-4.5";
+/**
+* Resolve the `-m` argument to the lead slug to launch with.
+*
+*   - `fast`      → `BUDGET_LEAD_MODEL` (budget mode)
+*   - `N.M`       → the best variant of that Opus family, via `pickClaudeDefault`
+*   - a full slug → unchanged, including Copilot slugs a power user pins
+*   - absent      → the ordinary default
+*
+* Every branch is `[1m]`-decorated against the live catalog, by
+* `pickClaudeDefault` on the two Opus-family branches and by
+* `withOneMSuffixForLead` on the other two. Pinning a MODEL is not a request to
+* give up four fifths of its context window, which is what leaving the other
+* two bare amounted to: `claude-sonnet-5` advertises a 1M window, so `-m fast`
+* and `-m claude-sonnet-5` were both budgeted locally at Claude Code's 200K
+* default and auto-compacted at roughly a fifth of the real window. The
+* decoration is catalog-gated per model, so a genuinely 200K model
+* (`claude-haiku-4.5`) still comes back bare.
+*
+* `fast` resolves to an ordinary slug rather than setting a mode flag, because
+* budget mode is keyed off the RESOLVED lead everywhere it matters (the advisor
+* escalation, the delegation prose, the small/fast tier). `-m fast` and
+* `-m claude-sonnet-5` must therefore produce identical sessions, which a flag
+* only one of the two set would break. The shared decoration is part of that
+* identity: decorating one branch and not the other would reintroduce the
+* divergence through the context budget instead of through a flag.
+*
+* Callers must keep treating any explicit `-m` as explicit: the
+* `DEFAULT_CLAUDE_MODEL_FALLBACKS` walk applies to the implicit-default path
+* only, so it cannot override a requested family (or `fast`) with an older Opus.
+*/
+function resolveLeadSlugArg(modelArg) {
+	const arg = modelArg?.trim();
+	if (!arg) return pickClaudeDefault();
+	if (arg.toLowerCase() === "fast") return withOneMSuffixForLead(BUDGET_LEAD_MODEL);
+	const opusFamilyShorthand = arg.match(/^(\d+\.\d+)$/)?.[1];
+	if (opusFamilyShorthand) return pickClaudeDefault(opusFamilyShorthand);
+	return withOneMSuffixForLead(arg);
+}
+/**
+* True when `slug` names a Claude model that is NOT an Opus tier — the
+* "budget lead" condition.
+*
+* Selecting sonnet or haiku as the lead is a decision to spend less while
+* holding quality as far as possible, and three surfaces key off it: the
+* advisor escalates to the Anthropic frontier (`resolveAdvisorModel`), the
+* injected delegation prose puts the cheap agent tiers first
+* (`buildNativeReachClauses`), and the small/fast tier drops to Haiku
+* (`getClaudeCodeEnvVars`). One definition here so those three cannot disagree
+* about what counts as a budget lead.
+*
+* Resolves before the family test so the Anthropic dashed form, Copilot's
+* dotted form, and `pickClaudeDefault`'s literal `[1m]` suffix all classify
+* alike. A non-Claude lead is not a budget lead: the concept is about picking a
+* lighter tier WITHIN the Claude family, and the gpt/gemini shim models have
+* their own cost profile that this switch says nothing about.
+*
+* CONTRACT: `slug` is an already-resolved LEAD SLUG, never a raw `-m` argument.
+* `"fast"` and the `N.M` shorthand are not Claude slugs and would classify
+* false here; run them through `resolveLeadSlugArg` first, which is what every
+* caller does. Resolving internally instead would drag `pickClaudeDefault`'s
+* catalog dependency into a pure predicate and make the same input answer
+* differently before and after the catalog loads.
+*/
+function isBudgetClaudeLead(slug) {
+	if (!slug) return false;
+	if (!isClaudeModel(slug)) return false;
+	return !/opus/i.test(resolveModel(slug));
+}
 function pickClaudeDefault(opusFamily = DEFAULT_OPUS_FAMILY) {
 	const dotted = opusFamily.replace(/-/g, ".");
 	const bareSlug = `claude-opus-${dotted.replace(/\./g, "-")}`;
@@ -19985,70 +20293,6 @@ function detectAgentCall(input) {
 	});
 }
 //#endregion
-//#region src/services/copilot/endpoint.ts
-/**
-* Catalog spellings that mean each of our two clients. Copilot is not
-* self-consistent about the `/v1` prefix — the live catalog advertises
-* `/v1/messages` prefixed but `/chat/completions` bare, and this repo's own
-* fixtures carry both forms — so an exact-match on the bare spelling alone
-* silently misses a real shape. `src/lib/model-validation.ts` already
-* normalizes the same way (`ENDPOINT_ALIASES`); this keeps the two agreeing.
-*
-* Matching is EXACT against this set, never a suffix/`includes` test: a
-* `ws:/responses` (websocket transport) entry is NOT the `/responses` HTTP
-* client and must keep resolving to "serves neither".
-*/
-const CHAT_ENDPOINTS = /* @__PURE__ */ new Set(["/chat/completions", "/v1/chat/completions"]);
-const RESPONSES_ENDPOINTS = /* @__PURE__ */ new Set(["/responses", "/v1/responses"]);
-/**
-* Decide which endpoint to call for a model from its catalog
-* `supported_endpoints`. Prefers `/chat/completions` when available (the
-* simpler, more widely-supported shape) and falls back to `/responses` for
-* models that ONLY serve the Responses API — the gpt-5.x family except
-* `gpt-5-mini` / `gpt-5.4` (e.g. `gpt-5.4-mini`, `gpt-5.5`, the
-* `*-codex` models). Returns undefined when the model serves neither, so a
-* caller can skip it rather than 400 on `unsupported_api_for_model`.
-*
-* A model that OMITS `supported_endpoints` is treated as chat-eligible: the
-* catalog historically omits the field for chat-default models, and
-* excluding those would be a worse regression than the gap this guards.
-*/
-function pickEndpoint(model) {
-	const eps = model.supported_endpoints;
-	if (!eps || eps.length === 0) return "chat";
-	if (eps.some((e) => CHAT_ENDPOINTS.has(e))) return "chat";
-	if (eps.some((e) => RESPONSES_ENDPOINTS.has(e))) return "responses";
-}
-/**
-* `pickEndpoint` by model id against the live catalog, WITHOUT collapsing
-* "absent from the catalog" into "serves neither of our endpoints".
-*
-* This function deliberately has no default. The predecessor
-* (`endpointForModelId`) returned `pickEndpoint(found) ?? "chat"`, which
-* coerced both cases to "chat" — defensible for an unknown id, silently wrong
-* for a catalog model serving only, say, `/v1/messages`: the caller would drive
-* it through the chat client and get an opaque upstream 400 with no local
-* signal about the real cause. `src/lib/browser-mcp/compressor.ts` already
-* treats that case correctly (`if (!endpoint) continue`); this makes the same
-* distinction available to callers that resolve by id.
-*
-* Callers that legitimately want the chat default for an unknown id can still
-* have it — they just have to write it, per case, on purpose.
-*/
-function resolveEndpointForModelId(id) {
-	const found = state.models?.data?.find((m) => m.id === id);
-	if (!found) return { kind: "unknown-model" };
-	const endpoint = pickEndpoint(found);
-	if (endpoint) return {
-		kind: "endpoint",
-		endpoint
-	};
-	return {
-		kind: "unreachable",
-		endpoints: found.supported_endpoints ?? []
-	};
-}
-//#endregion
 //#region src/lib/browser-mcp/compressor.ts
 /**
 * Static fallback chain for the inner compressor. Order is preference:
@@ -27627,8 +27871,26 @@ function logTelemetry(t) {
 function toolAcceptsWorkspace(tool) {
 	return tool.capability === "worker" || tool.toolNameHttp === "code" || tool.toolNameHttp === "run_workflow";
 }
+/**
+* Fold the per-session `X-GH-Workspace` header into `args.workspace` when the
+* caller left it empty, and REPORT which of the two the tool ended up with.
+*
+* The return value is the load-bearing part. This function mutates `args`, so
+* once it has run a header-derived workspace is byte-indistinguishable from one
+* the caller chose — and those two cases warrant very different treatment. A
+* caller that named a directory has told us where it is; a header is a
+* connection-level default that may be stale (it is computed by a helper Claude
+* Code runs, and the calling agent may since have moved into a git worktree).
+* `runWorkerToolCall` uses the distinction to decide what to tell the caller
+* about the tree it actually ran in, so the provenance must survive the merge.
+*/
 function applySessionWorkspace(args, sessionWorkspace, tool) {
-	if ((!tool || toolAcceptsWorkspace(tool)) && typeof sessionWorkspace === "string" && sessionWorkspace.length > 0 && path.isAbsolute(sessionWorkspace) && (args.workspace === void 0 || args.workspace === "")) args.workspace = sessionWorkspace;
+	if (args.workspace !== void 0 && args.workspace !== "") return "argument";
+	if ((!tool || toolAcceptsWorkspace(tool)) && typeof sessionWorkspace === "string" && sessionWorkspace.length > 0 && path.isAbsolute(sessionWorkspace)) {
+		args.workspace = sessionWorkspace;
+		return "session";
+	}
+	return "absent";
 }
 async function handleToolsCall(body, scope, sessionWorkspace) {
 	const params = body.params ?? {};
@@ -27662,7 +27924,8 @@ async function handleToolsCall(body, scope, sessionWorkspace) {
 		personaContext = typeof args.context === "string" ? args.context : void 0;
 		if (args.imagePaths !== void 0) {
 			if (!Array.isArray(args.imagePaths) || args.imagePaths.some((v) => typeof v !== "string")) return rpcError(body.id, RPC_INVALID_PARAMS, "tools/call: arguments.imagePaths must be an array of strings");
-			const loaded = await loadPeerImages(args.imagePaths, process.cwd());
+			const imageRoot = typeof sessionWorkspace === "string" && sessionWorkspace.length > 0 && path.isAbsolute(sessionWorkspace) ? sessionWorkspace : process.cwd();
+			const loaded = await loadPeerImages(args.imagePaths, imageRoot);
 			if (!loaded.ok) return rpcError(body.id, RPC_INVALID_PARAMS, `tools/call: ${loaded.error}`);
 			personaImages = loaded.images;
 		}
@@ -27700,8 +27963,8 @@ async function handleToolsCall(body, scope, sessionWorkspace) {
 	const telemetryName = persona ? persona.agentName : nonPersonaTool.toolNameHttp;
 	const telemetryModel = persona ? persona.model : "(non-persona)";
 	try {
-		if (nonPersonaTool) applySessionWorkspace(args, sessionWorkspace, nonPersonaTool);
-		const result = persona ? await callPersona(persona, personaPrompt, personaContext, personaEffort, aborter?.signal, personaImages) : await nonPersonaTool.handler(args, aborter?.signal);
+		const workspaceSource = nonPersonaTool ? applySessionWorkspace(args, sessionWorkspace, nonPersonaTool) : "absent";
+		const result = persona ? await callPersona(persona, personaPrompt, personaContext, personaEffort, aborter?.signal, personaImages) : await nonPersonaTool.handler(args, aborter?.signal, { workspaceSource });
 		logTelemetry({
 			name: telemetryName,
 			model: telemetryModel,
@@ -28027,6 +28290,98 @@ function handleMcpDelete(c) {
 	return c.body(null, 200);
 }
 //#endregion
+//#region src/lib/reasoning-effort.ts
+/**
+* Reasoning-effort bucketing + clamping shared by the `/v1/messages` handler
+* (adaptive-thinking translation) and the Anthropic-translation shim
+* (thinking-budget → Responses `reasoning.effort`).
+*
+* Extracted from `src/routes/messages/handler.ts` so a `~/lib/*` module can
+* depend on it without importing route code (and without forming a
+* handler → shim → handler import cycle). `handler.ts` re-exports these for
+* backward compatibility with existing imports/tests.
+*/
+/**
+* Copilot's reasoning-effort tiers, lowest to highest.
+*
+* Both ends were added after the fact and both are load-bearing:
+*
+* `none` is advertised by every gpt-5.x entry in the live catalog. While it was
+* missing here it was treated as an UNRECOGNIZED value, so a client asking for
+* the MINIMUM on a model that does not offer it (gemini advertises only
+* low/medium/high) was anchored at the unknown-value tier and clamped to
+* `high` — the maximum. Listing it makes the clamp resolve to `low` instead,
+* which is what "nearest supported tier" should always have meant.
+*
+* `max` is advertised by `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-5.6-luna`,
+* `claude-opus-5` and the 4.7/4.8 Opus lines, and Claude Code's effort picker
+* offers it for any model whose entry allows it. Listing it lets an explicit
+* selection pass through, and lets `clampEffort` land on it for a model that
+* advertises nothing lower.
+*
+* `bucketEffort` deliberately reaches neither end — see below.
+*/
+const EFFORT_ORDER = [
+	"none",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+/** Anchor for an effort value that is not a recognized tier at all.
+*
+*  Deliberately NOT the top of `EFFORT_ORDER`. Callers reach this only when the
+*  incoming value is unrecognized, which is a guess — and resolving a guess to
+*  the most expensive tier a model advertises would silently spend more than the
+*  caller could have meant. Anchoring here and clamping DOWN keeps the behavior
+*  identical to before `max` joined the ladder, while `max` stays reachable by
+*  explicit, valid selection. */
+const UNKNOWN_EFFORT_ANCHOR = "xhigh";
+/**
+* Bucket a thinking budget into a Copilot reasoning-effort string.
+* `<2000`→low, `<8000`→medium, `<24000`→high, else→xhigh.
+* Defaults missing/non-numeric budgets to 8000 ("high").
+*
+* The ceiling stays at `xhigh` even though `max` exists: Anthropic's
+* `budget_tokens` is unbounded above, so any threshold chosen for a `max`
+* bucket would silently re-tier existing callers whose budgets already map to
+* `xhigh`. `max` is reachable only by explicit selection
+* (`output_config.effort`), which is an unambiguous request rather than an
+* inference from a token count.
+*/
+function bucketEffort(budget) {
+	const n = typeof budget === "number" && Number.isFinite(budget) ? budget : 8e3;
+	if (n < 2e3) return "low";
+	if (n < 8e3) return "medium";
+	if (n < 24e3) return "high";
+	return "xhigh";
+}
+/**
+* Clamp a bucketed effort to the closest value in `supported`. Ties resolve to
+* the lower-tier option (per EFFORT_ORDER).
+*
+* Iterates EFFORT_ORDER (canonical low→xhigh) so the first match on a given
+* distance is always the lower-tier value, regardless of input order in
+* `supported`.
+*/
+function clampEffort(bucketed, supported) {
+	if (supported.includes(bucketed)) return bucketed;
+	const targetIdx = EFFORT_ORDER.indexOf(bucketed);
+	let best;
+	let bestDist = Infinity;
+	for (let i = 0; i < EFFORT_ORDER.length; i++) {
+		const value = EFFORT_ORDER[i];
+		if (!supported.includes(value)) continue;
+		const dist = Math.abs(i - targetIdx);
+		if (dist < bestDist) {
+			bestDist = dist;
+			best = value;
+		}
+	}
+	return best ?? bucketed;
+}
+//#endregion
 //#region src/lib/stream-relay.ts
 const ENCODER$1 = new TextEncoder();
 /**
@@ -28514,10 +28869,15 @@ function rememberThinkingHistoryRepair(fingerprint) {
 *       re-call Copilot for the next turn — stream onto the SAME
 *       SSE connection (no new message_start; the original one is
 *       still open). Loop up to ADVISOR_MAX_TURNS times.
-* 4. Cross-lab default: route the advisor call to a different model
-*    family than the main loop (gpt-5.6-sol by default) so the user gets
-*    a true "second set of eyes" instead of Opus reviewing Opus
-*    (gemini-critic finding).
+* 4. Lead-aware model choice: route the advisor call to a different model
+*    family than the main loop (gpt-5.6-sol) so the user gets a true "second
+*    set of eyes" instead of Opus reviewing Opus (gemini-critic finding). When
+*    the LEAD is a lighter Claude tier the choice inverts and the advisor
+*    escalates to `ADVISOR_ESCALATION_MODEL` instead — see that constant for
+*    why trading the cross-lab property is the right call on that path.
+* 5. Effort follows the Claude Code effort picker (`resolveAdvisorEffort`)
+*    rather than a hardcoded constant, floored so a low picker cannot render
+*    the consultation useless.
 *
 * The translate-loop is bounded to a single user request — no
 * persistent state across requests is needed (unlike Phase G's
@@ -28541,6 +28901,185 @@ const ADVISOR_CLIENT_TOOL_NAME = "advisor";
 *  model — Opus 4.6/Sonnet 4.6 typically). */
 const ADVISOR_DEFAULT_MODEL = "gpt-5.6-sol";
 const ADVISOR_DEFAULT_EFFORT = "xhigh";
+/** The Anthropic frontier model the advisor escalates to when the LEAD is a
+*  lighter Claude tier (sonnet, haiku).
+*
+*  Selecting a lighter lead is a decision to work on a budget while holding
+*  quality: the lead does the legwork and escalates for direction. Without this,
+*  a budget lead has no transcript-aware path to the strongest Anthropic
+*  reasoner at all — `opus_critic` is stateless and sees one artifact, and the
+*  `plan` worker is read-only and never sees the transcript.
+*
+*  This deliberately trades the advisor's cross-lab property on that path. The
+*  advisor is not this repo's review instrument: it catches drift and momentum
+*  and inherits the lead's framing by design, while the fresh-context critics
+*  (`codex_critic`, `gemini_critic`, `codex_reviewer`, `gemini_reviewer`) are
+*  the decorrelation instrument and are untouched. `GH_ROUTER_ADVISOR_MODEL`
+*  keeps a cross-lab advisor one env var away for anyone who wants it back. */
+const ADVISOR_ESCALATION_MODEL = "claude-opus-5";
+/** Floor for the advisor's reasoning effort.
+*
+*  The advisor follows the Claude Code effort picker (see `resolveAdvisorEffort`)
+*  so dialing the picker down makes it cheaper, but it does NOT follow it all the
+*  way to the bottom of `EFFORT_ORDER`. The advisor fires a handful of times per
+*  session (`ADVISOR_MAX_TURNS`, typically 1-3), so it is not the budget line —
+*  the lead's own turns are — while an advisor reasoning at `none`/`low` cannot
+*  do the job the consultation exists for. The picker therefore governs the
+*  `high..max` range. */
+const ADVISOR_MIN_EFFORT = "high";
+/** Output cap for the Anthropic-branch advisor call when the catalog carries no
+*  limits for the resolved model. The value the branch used unconditionally
+*  before it became reachable, kept so a catalog-less path is no worse off. */
+const ADVISOR_FALLBACK_MAX_OUTPUT_TOKENS = 4096;
+/** Catalog spellings that mean the Responses API. Copilot is inconsistent about
+*  the `/v1` prefix, so both are matched — mirroring `CHAT_ENDPOINTS` /
+*  `RESPONSES_ENDPOINTS` in `src/services/copilot/endpoint.ts`. */
+const ADVISOR_RESPONSES_ENDPOINTS = /* @__PURE__ */ new Set(["/responses", "/v1/responses"]);
+/**
+* Which transport the advisor dispatches on: `/responses` (with
+* `reasoning.effort`) or `/v1/messages`.
+*
+* Catalog-first, name-regex second, and BOTH tests run against the bare id as
+* well as the given one. `pickEndpoint` is deliberately not reused: it answers
+* "chat or responses" for the two tool-calling clients and would send
+* `claude-opus-5` — which advertises `/v1/messages` AND `/chat/completions` — to
+* chat. The advisor's question is narrower: does this model serve `/responses`?
+*
+* The bare-id fallback is what makes `GH_ROUTER_ADVISOR_MODEL` safe. That pin is
+* accepted verbatim, so an operator can write a vendor-namespaced value like
+* `openai/gpt-5.6-sol`. Such an id is in no catalog and fails the start-anchored
+* name regex, so a catalog-only fix still posted it to `/v1/messages` and 400'd
+* — exported and directly tested for that exact input, because an earlier
+* version of this function claimed to handle it and did not.
+*/
+function advisorUsesResponses(resolvedAdvisorModel) {
+	const bare = resolvedAdvisorModel.slice(resolvedAdvisorModel.lastIndexOf("/") + 1);
+	const endpoints = (state.models?.data?.find((m) => m.id === resolvedAdvisorModel || m.id === bare))?.supported_endpoints;
+	if (endpoints && endpoints.length > 0) return endpoints.some((e) => ADVISOR_RESPONSES_ENDPOINTS.has(e));
+	return /^(gpt-|o\d|.*codex)/i.test(bare);
+}
+/** True when the model advertises a usable reasoning-effort ladder. */
+function advertisedEffortLadder(resolvedAdvisorModel) {
+	const supported = state.models?.data?.find((m) => m.id === resolvedAdvisorModel)?.capabilities?.supports?.reasoning_effort;
+	return Array.isArray(supported) && supported.length > 0 ? supported : void 0;
+}
+/** True when the advisor should escalate to `ADVISOR_ESCALATION_MODEL` for this
+*  lead: a Claude lead that is NOT already an Opus tier, on a catalog that
+*  actually carries the escalation model.
+*
+*  The catalog probe mirrors `standInToolEnabled`'s: never name a model the
+*  account cannot reach. A non-Claude lead never gets here in practice (the
+*  advisor tool is stripped for those before the request reaches this module),
+*  but the check is explicit rather than assumed.
+*
+*  The probe compares the BARE constant rather than `resolveModel`-ing it first,
+*  which is deliberate and not an oversight: `claude-opus-5` is a single-segment
+*  slug whose dashed and dotted spellings are identical, so resolution is a
+*  no-op, and `resolveModel` WARNS on an id it cannot find — routing this probe
+*  through it would emit that warning on every advisor request for anyone whose
+*  catalog lacks opus-5, which is exactly the tier this returns false for.
+*  `standInToolEnabled` compares the same id the same way. */
+function shouldEscalateAdvisor(leadModel) {
+	if (!isBudgetClaudeLead(leadModel)) return false;
+	return state.models?.data?.some((m) => m.id === "claude-opus-5") ?? false;
+}
+/**
+* Pick the advisor model for one request from the LEAD model that request is
+* running on.
+*
+* Resolved per request rather than at launch because the lead changes
+* mid-session via the `/model` picker; launch-time env plumbing would pin the
+* advisor to whatever was selected at spawn.
+*
+* Precedence:
+*   1. `GH_ROUTER_ADVISOR_MODEL` (trimmed) — the operator pin, checked first so
+*      it works on every lead.
+*   2. A lighter Claude lead with the escalation model in the catalog.
+*   3. `ADVISOR_DEFAULT_MODEL`.
+*
+* Step 3 returns the LITERAL constant rather than walking the OpenAI frontier
+* chain. An Opus lead must resolve to exactly what it resolves to today, and a
+* frontier walk could yield `gpt-5.5` on a catalog missing `gpt-5.6-sol` —
+* a silent change to the one path that is required not to move.
+*/
+/**
+* Map an operator pin onto the id the catalog actually carries.
+*
+* `GH_ROUTER_ADVISOR_MODEL` is free-form, and the natural thing to write is a
+* vendor-namespaced id like `openai/gpt-5.6-sol`. Copilot's catalog carries the
+* bare `gpt-5.6-sol`, so forwarding the namespaced form verbatim gets a 400
+* `model_not_supported` and the advisor silently degrades to its
+* "[Advisor unavailable: ...]" fallback — measured, not theorised: choosing the
+* transport correctly was NOT sufficient, because the id itself was still
+* wrong on the wire.
+*
+* An exact catalog hit wins first, so a real id containing a slash could never
+* be mangled. Only when the pin is absent from the catalog do we try its last
+* path segment, and only when THAT is present do we rewrite. A pin that matches
+* nothing is passed through untouched: the catalog may simply not be loaded
+* yet, and inventing an id would be worse than letting upstream reject it.
+*/
+function normalizeAdvisorPin(pinned) {
+	const models = state.models?.data;
+	if (!models) return pinned;
+	if (models.some((m) => m.id === pinned)) return pinned;
+	const bare = pinned.slice(pinned.lastIndexOf("/") + 1);
+	return bare !== pinned && models.some((m) => m.id === bare) ? bare : pinned;
+}
+function resolveAdvisorModel(leadModel) {
+	const pinned = process.env.GH_ROUTER_ADVISOR_MODEL?.trim();
+	if (pinned) return {
+		model: normalizeAdvisorPin(pinned),
+		escalated: false
+	};
+	if (leadModel && shouldEscalateAdvisor(leadModel)) return {
+		model: ADVISOR_ESCALATION_MODEL,
+		escalated: true
+	};
+	return {
+		model: ADVISOR_DEFAULT_MODEL,
+		escalated: false
+	};
+}
+/**
+* Resolve the advisor's reasoning effort from the ORIGINAL request body, so the
+* advisor thinks at the level selected in the Claude Code effort picker instead
+* of a hardcoded constant.
+*
+* The source is the RAW pre-`resolveModelInBody` body, deliberately. By the time
+* the handler holds a parsed body, `translateThinking` has already bucketed
+* `thinking.budget_tokens` into `output_config.effort` AND clamped it to the
+* LEAD model's allowlist — so that value encodes "what the lead could do", not
+* "what the user picked". Re-clamping it against the advisor cannot recover the
+* difference: a `max` pick on a lead whose ceiling is `high` would reach an
+* xhigh-capable advisor as `high`.
+*
+* Precedence mirrors the repo-wide rule that an explicit client effort wins:
+*   1. `output_config.effort`
+*   2. `bucketEffort(thinking.budget_tokens)`
+*   3. `ADVISOR_DEFAULT_EFFORT` — a request expressing no preference behaves
+*      exactly as it did before the picker was honored at all.
+*
+* Then floor, THEN clamp. The order is load-bearing: a model whose ceiling sits
+* below `ADVISOR_MIN_EFFORT` must still receive a value it accepts, so the clamp
+* is allowed to pull back under the floor. Flipping the two would forward an
+* effort upstream rejects.
+*/
+function resolveAdvisorEffort(rawRequestBody, advisorModel) {
+	let requested = ADVISOR_DEFAULT_EFFORT;
+	if (rawRequestBody) try {
+		const body = JSON.parse(rawRequestBody);
+		const oc = body.output_config;
+		const explicit = oc && typeof oc === "object" ? oc.effort : void 0;
+		const thinking = body.thinking;
+		if (typeof explicit === "string" && EFFORT_ORDER.includes(explicit)) requested = explicit;
+		else if (thinking && typeof thinking === "object" && thinking.type === "enabled") requested = bucketEffort(thinking.budget_tokens);
+	} catch {}
+	const floored = EFFORT_ORDER.indexOf(requested) < EFFORT_ORDER.indexOf(ADVISOR_MIN_EFFORT) ? ADVISOR_MIN_EFFORT : requested;
+	const supported = state.models?.data?.find((m) => m.id === resolveModel(advisorModel))?.capabilities?.supports?.reasoning_effort;
+	if (!Array.isArray(supported) || supported.length === 0) return floored;
+	return clampEffort(floored, supported);
+}
 /** ADVISOR_TOOL_INSTRUCTIONS verbatim from cc-backup
 *  src/utils/advisor.ts — describes when the model should invoke
 *  the advisor. Long-form prose; see source for justification. */
@@ -28636,8 +29175,12 @@ const ADVISOR_FALLBACK_MAX_TOKENS = 24e4;
 *  our o200k count and Copilot's full-payload count. The transcript token
 *  budget is `max_prompt_tokens - reserve`. Generous on purpose: a 400
 *  `model_max_prompt_tokens_exceeded` degrades to a silent advisor
-*  fallback, and the marginal window we give up is irrelevant next to
-*  gpt-5.6-sol's ~1M. */
+*  fallback, and the window given up is marginal against either advisor
+*  model's real prompt window (`claude-opus-5` 936k, `gpt-5.6-sol` ~1M off
+*  the live catalog). Sized as a fraction of the smaller of the two, not as
+*  "irrelevant next to ~1M" — that framing assumed the advisor was always
+*  the cheap side of the pair, which stopped being true once a budget lead
+*  escalates to Opus. */
 const ADVISOR_PROMPT_TOKEN_RESERVE = 8e3;
 /**
 * Derive the TOKEN budget for the rendered transcript from the advisor
@@ -28748,9 +29291,9 @@ function truncateTailToUnits(text, maxUnits, measure) {
 * Anthropic's own ADVISOR ("see the whole task + every tool call +
 * every result").
 */
-async function runAdvisor(conversation, advisorModel, advisorEffort, signal) {
+async function runAdvisor(conversation, advisorModel, advisorEffort, signal, advisorEscalated = false) {
 	if (signal?.aborted) throw new Error("advisor call aborted before dispatch");
-	const advisorSystem = "You are an expert advisor reviewing an in-progress Claude Code session. The transcript below is the work-in-progress (turns numbered, with tool calls and results inlined). Read carefully and provide concrete, actionable advice on the next step or course-correction. Be specific — cite the parts of the transcript you're responding to. If the assistant is on the right track, say so explicitly. If they're stuck or off-track, name the specific assumption or step to revisit. Aim for 2-5 paragraphs of substantive guidance.";
+	const advisorSystem = "You are an expert advisor reviewing an in-progress Claude Code session. The transcript below is the work-in-progress (turns numbered, with tool calls and results inlined). Read carefully and provide concrete, actionable advice on the next step or course-correction. Be specific — cite the parts of the transcript you're responding to. If the assistant is on the right track, say so explicitly. If they're stuck or off-track, name the specific assumption or step to revisit. Aim for 2-5 paragraphs of substantive guidance." + (advisorEscalated ? " The requesting agent is running a lighter, faster model than you. Give a directive recommendation and commit to the decision rather than laying out options for it to weigh." : "");
 	const resolvedAdvisorModel = resolveModel(advisorModel);
 	let measure;
 	let maxUnits;
@@ -28765,7 +29308,7 @@ async function runAdvisor(conversation, advisorModel, advisorEffort, signal) {
 		maxUnits = ADVISOR_MAX_CONVERSATION_CHARS;
 	}
 	const conversationText = renderConversationAsText(conversation, maxUnits, measure);
-	if (/^(gpt-|o\d|.*codex)/i.test(resolvedAdvisorModel)) {
+	if (advisorUsesResponses(resolvedAdvisorModel)) {
 		const payload = {
 			model: resolvedAdvisorModel,
 			instructions: advisorSystem,
@@ -28800,15 +29343,22 @@ async function runAdvisor(conversation, advisorModel, advisorEffort, signal) {
 		if (!text) throw new Error(`Advisor model ${resolvedAdvisorModel} returned empty assistant output`);
 		return text;
 	}
+	const advisorEntry = state.models?.data?.find((m) => m.id === resolvedAdvisorModel);
+	const limits = advisorEntry?.capabilities?.limits;
+	const maxTokens = limits?.max_non_streaming_output_tokens ?? limits?.max_output_tokens ?? ADVISOR_FALLBACK_MAX_OUTPUT_TOKENS;
 	const advisorBody = JSON.stringify({
 		model: resolvedAdvisorModel,
-		max_tokens: 4096,
+		max_tokens: maxTokens,
 		system: advisorSystem,
 		messages: [{
 			role: "user",
 			content: conversationText
 		}],
-		stream: false
+		stream: false,
+		...advisorEntry?.capabilities?.supports?.adaptive_thinking ? {
+			thinking: { type: "adaptive" },
+			...advertisedEffortLadder(resolvedAdvisorModel) ? { output_config: { effort: advisorEffort } } : {}
+		} : {}
 	});
 	const json = await (await withTransientRetry(() => createMessages(advisorBody, {}, signal), {
 		signal,
@@ -28863,6 +29413,7 @@ function sseEvent(type, data) {
 function buildAdvisorStream(opts) {
 	const advisorModel = opts.advisorModel ?? "gpt-5.6-sol";
 	const advisorEffort = opts.advisorEffort ?? "xhigh";
+	const advisorEscalated = opts.advisorEscalated ?? false;
 	const aborter = opts.externalAborter ?? new AbortController();
 	let conversation = [...opts.initialConversation];
 	return new ReadableStream({
@@ -29112,7 +29663,7 @@ function buildAdvisorStream(opts) {
 					const advisorConversation = conversation;
 					const advisorTexts = await Promise.all(advisorToolUses.map(async () => {
 						try {
-							return await runAdvisor(advisorConversation, advisorModel, advisorEffort, aborter.signal);
+							return await runAdvisor(advisorConversation, advisorModel, advisorEffort, aborter.signal, advisorEscalated);
 						} catch (err) {
 							if (aborter.signal.aborted) throw err;
 							const msg = err instanceof Error ? err.message : String(err);
@@ -34568,7 +35119,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				workspace: {
 					type: "string",
-					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected)."
+					description: "Absolute path of the directory the worker operates in. Pass YOUR OWN current working directory unless you were told to target a different one — the proxy is a separate, long-lived process and cannot see where you are, so it falls back to your session's directory, which is not necessarily yours (a sub-agent or a git worktree moves you without moving the session). Omitting it when the connection supplies nothing is an error rather than a guess. Must be absolute (relative paths rejected)."
 				},
 				maxWallClockMs: {
 					type: "integer",
@@ -34576,11 +35127,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				}
 			}
 		},
-		async handler(args, signal) {
+		async handler(args, signal, ctx) {
 			return runWorkerToolCall({
 				mode: "explore",
 				args,
-				signal
+				signal,
+				ctx
 			});
 		}
 	},
@@ -34613,7 +35165,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				workspace: {
 					type: "string",
-					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected). Must be inside a git repo (implement always runs in a worktree)."
+					description: "Absolute path of the directory the worker operates in. Pass YOUR OWN current working directory unless you were told to target a different one — the proxy is a separate, long-lived process and cannot see where you are, so it falls back to your session's directory, which is not necessarily yours (a sub-agent or a git worktree moves you without moving the session). Omitting it when the connection supplies nothing is an error rather than a guess. Must be absolute (relative paths rejected). Must be inside a git repo (implement always runs in a worktree)."
 				},
 				maxWallClockMs: {
 					type: "integer",
@@ -34621,11 +35173,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				}
 			}
 		},
-		async handler(args, signal) {
+		async handler(args, signal, ctx) {
 			return runWorkerToolCall({
 				mode: "implement",
 				args,
-				signal
+				signal,
+				ctx
 			});
 		}
 	},
@@ -34633,7 +35186,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 		toolNameHttp: "review",
 		group: "workers",
 		capability: "worker",
-		description: "Runs as the background `worker-review` agent. Dispatch via the Agent tool (subagent_type: worker-review) so the turn is never blocked; the result arrives as a completion notification. Read-only code review by an autonomous worker (Pi runtime; default model `gemini-3.1-pro-preview`, default thinking xhigh clamped to high for that model, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has the same read-only toolset as explore and verifies claims against surrounding repository context before returning severity-ranked findings with `file:line` citations. Use for reviewing a change, diff, or correctness claim when the reviewer should read the code itself rather than trusting a pasted artifact. Not for architecture critique, implementation, or test authoring; use codex_critic or gemini_critic for design review, implement for edits, and test for independent test creation. Strictly read-only: it changes nothing on disk, and its returned text is the only artifact it produces — route to `implement` or `test` when a file actually needs to change. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
+		description: "Runs as the background `worker-review` agent. Dispatch via the Agent tool (subagent_type: worker-review) so the turn is never blocked; the result arrives as a completion notification. Code review by an autonomous worker (Pi runtime; default model `gemini-3.1-pro-preview`, default thinking xhigh clamped to high for that model, override via `model` with any Copilot-catalog model that advertises `tool_calls`). It has explore's read-and-search tools PLUS `bash`, so it verifies claims by running them — reproducing a failure or running the build or suite — rather than only reading, and returns severity-ranked findings with `file:line` citations. It gets no edit/write tools unless you pass `worktree: true`, but `bash` runs real commands in the workspace, so a build or test it invokes can touch the tree. Use for reviewing a change, diff, or correctness claim when the reviewer should read the code itself rather than trusting a pasted artifact. Not for architecture critique, implementation, or test authoring; use codex_critic or gemini_critic for design review, implement for edits, and test for independent test creation. If the result is too large to relay it is truncated to a preview and the FULL text is written to a file, whose absolute path is in the returned text; read that file rather than re-running the worker.",
 		inputSchema: {
 			type: "object",
 			required: ["prompt"],
@@ -34652,9 +35205,13 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 					enum: WORKER_THINKING_LEVELS,
 					description: "Optional reasoning depth (defaults to xhigh, clamped to high for the default review model). Silently clamped to the model's allowed range; \"off\" drops the parameter entirely."
 				},
+				worktree: {
+					type: "boolean",
+					description: "Optional. When true, the review runs in an isolated git worktree replaying the workspace's working tree (dirty tracked changes and untracked-not-ignored files), which additionally grants `edit`/`write` so the reviewer can author a throwaway probe test to prove a claim. Default false: the reviewer reads and runs commands in the workspace itself. Prefer the default when verifying needs the build to work — a fresh worktree does not carry IGNORED files, so installed dependencies are absent. Requires a git repository."
+				},
 				workspace: {
 					type: "string",
-					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected)."
+					description: "Absolute path of the directory the worker operates in. Pass YOUR OWN current working directory unless you were told to target a different one — the proxy is a separate, long-lived process and cannot see where you are, so it falls back to your session's directory, which is not necessarily yours (a sub-agent or a git worktree moves you without moving the session). Omitting it when the connection supplies nothing is an error rather than a guess. Must be absolute (relative paths rejected)."
 				},
 				maxWallClockMs: {
 					type: "integer",
@@ -34662,11 +35219,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				}
 			}
 		},
-		async handler(args, signal) {
+		async handler(args, signal, ctx) {
 			return runWorkerToolCall({
 				mode: "review",
 				args,
-				signal
+				signal,
+				ctx
 			});
 		}
 	},
@@ -34695,7 +35253,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				workspace: {
 					type: "string",
-					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected)."
+					description: "Absolute path of the directory the worker operates in. Pass YOUR OWN current working directory unless you were told to target a different one — the proxy is a separate, long-lived process and cannot see where you are, so it falls back to your session's directory, which is not necessarily yours (a sub-agent or a git worktree moves you without moving the session). Omitting it when the connection supplies nothing is an error rather than a guess. Must be absolute (relative paths rejected)."
 				},
 				maxWallClockMs: {
 					type: "integer",
@@ -34703,11 +35261,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				}
 			}
 		},
-		async handler(args, signal) {
+		async handler(args, signal, ctx) {
 			return runWorkerToolCall({
 				mode: "plan",
 				args,
-				signal
+				signal,
+				ctx
 			});
 		}
 	},
@@ -34740,7 +35299,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				},
 				workspace: {
 					type: "string",
-					description: "Optional absolute path to the workspace the worker operates in. Defaults to the proxy's launch cwd. Use this when the parent agent has multiple workspaces open and the worker must operate in a specific one. Must be absolute (relative paths rejected). Must be inside a git repo (test always runs in a worktree)."
+					description: "Absolute path of the directory the worker operates in. Pass YOUR OWN current working directory unless you were told to target a different one — the proxy is a separate, long-lived process and cannot see where you are, so it falls back to your session's directory, which is not necessarily yours (a sub-agent or a git worktree moves you without moving the session). Omitting it when the connection supplies nothing is an error rather than a guess. Must be absolute (relative paths rejected). Must be inside a git repo (test always runs in a worktree)."
 				},
 				maxWallClockMs: {
 					type: "integer",
@@ -34748,11 +35307,12 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				}
 			}
 		},
-		async handler(args, signal) {
+		async handler(args, signal, ctx) {
 			return runWorkerToolCall({
 				mode: "test",
 				args,
-				signal
+				signal,
+				ctx
 			});
 		}
 	},
@@ -35075,10 +35635,12 @@ function assertMcpToolSurfaceConsistent() {
 /**
 * Shared closure body for the two worker MCP tools. Validates the
 * minimal arg shape (prompt required + optional knobs typed), then
-* forwards to `runWorkerAgent`. Outside serve mode, `workspace` defaults
-* to the proxy's launch cwd; serve mode requires an explicit/header-derived
-* workspace. Callers can override via the optional `workspace` arg
-* (absolute paths only — enforced here). The engine performs every
+* forwards to `runWorkerAgent`. `workspace` comes from the caller's
+* argument or, failing that, the per-connection session header the
+* boundary folds in; with neither, the call is REFUSED rather than
+* defaulted to the proxy's launch cwd (see the resolution block below
+* for why that default was a bug, and `GH_ROUTER_ALLOW_PROXY_CWD_WORKSPACE`
+* for the raw-client escape hatch). The engine performs every
 * deeper validation (model existence, thinking clamp, worktree
 * provisioning, semaphore acquisition, workspace realpath +
 * accessibility) and never throws — its `{text, isError?}` envelope
@@ -35091,7 +35653,7 @@ function assertMcpToolSurfaceConsistent() {
 * client that ignores the schema.
 */
 async function runWorkerToolCall(call) {
-	const { mode, args, signal } = call;
+	const { mode, args, signal, ctx } = call;
 	const prompt = typeof args.prompt === "string" ? args.prompt : "";
 	if (!prompt) return {
 		content: [{
@@ -35123,7 +35685,7 @@ async function runWorkerToolCall(call) {
 	}
 	let worktree;
 	let worktreeNote = "";
-	if (mode === "implement" || mode === "test") {
+	if (mode === "implement" || mode === "test" || mode === "review") {
 		if (args.worktree !== void 0 && typeof args.worktree !== "boolean") return {
 			content: [{
 				type: "text",
@@ -35131,11 +35693,16 @@ async function runWorkerToolCall(call) {
 			}],
 			isError: true
 		};
-		worktree = true;
-		if (args.worktree === false) worktreeNote = `[note: worker_${mode} always runs in an isolated git worktree; the requested worktree:false was overridden. For in-place edits, use the \`implementer\` subagent.]
+		if (mode === "review") worktree = args.worktree === true ? true : void 0;
+		else {
+			worktree = true;
+			if (args.worktree === false) worktreeNote = `[note: worker_${mode} always runs in an isolated git worktree; the requested worktree:false was overridden. For in-place edits, use the \`implementer\` subagent.]
 
 `;
+		}
 	}
+	const allowProxyCwd = process.env.GH_ROUTER_ALLOW_PROXY_CWD_WORKSPACE === "1";
+	const callerGaveWorkspace = args.workspace !== void 0;
 	let workspace;
 	if (args.workspace !== void 0) {
 		if (typeof args.workspace !== "string" || args.workspace.length === 0) return {
@@ -35160,7 +35727,16 @@ async function runWorkerToolCall(call) {
 		}],
 		isError: true
 	};
-	else workspace = process.cwd();
+	else if (allowProxyCwd) workspace = process.cwd();
+	else return {
+		content: [{
+			type: "text",
+			text: `worker_${mode}: a workspace is required. Nothing in this call said which directory to run in, and the proxy's own launch directory is not a safe guess — it is where the proxy was started, which may be a different checkout or git worktree than the one you are working in. Re-issue this call with \`workspace\` set to the absolute path of your current working directory. (Operators running a raw MCP client that cannot send one can restore the old launch-cwd default with GH_ROUTER_ALLOW_PROXY_CWD_WORKSPACE=1.)`
+		}],
+		isError: true
+	};
+	const effectiveSource = ctx?.workspaceSource ?? (callerGaveWorkspace ? "argument" : "absent");
+	const workspaceNote = effectiveSource === "argument" ? "" : `[workspace: ${workspace} (${effectiveSource === "session" ? "from your session's working directory; pass `workspace` explicitly if you are running somewhere else, such as a git worktree" : "the proxy's launch directory"})]\n\n`;
 	let maxWallClockMs;
 	let clampNote = "";
 	if (args.maxWallClockMs !== void 0) {
@@ -35188,7 +35764,7 @@ async function runWorkerToolCall(call) {
 		maxWallClockMs,
 		signal
 	});
-	const notePrefix = `${clampNote}${worktreeNote}`;
+	const notePrefix = `${workspaceNote}${clampNote}${worktreeNote}`;
 	return {
 		content: [{
 			type: "text",
@@ -35421,6 +35997,6 @@ function enumerateInjectedMcpToolNames(groupKeys, opts = {}) {
 	return [...new Set(names)];
 }
 //#endregion
-export { browserCompoundToolsEnabled as $, satisfiesMinVersion as A, warmTreeSitterPool as At, repairRejectedThinkingHistory as B, DEFAULT_PORT as Bt, availableToolCommands as C, parseJsonOrDiagnose as Ct, vscodeRipgrepPath as D, provisionAndIndexColbert as Dt, toolbeltSkipSet as E, colbertDegradedWarning as Et, injectAdvisorTool as F, collapsePathKeys as Ft, readIteratorWithTimeout as G, upstreamAllowH2 as Gt, buildOpenAIErrorEvent as H, UPSTREAM_INACTIVITY_TIMEOUT_MS as Ht, isAdvisorRequested as I, toolbeltPathOverride as It, handleMcpPost as J, withInstallLock as Jt, relayAnthropicStream as K, upstreamMaxConnections as Kt, formatThinkingRepairDecline as L, DEFAULT_CLAUDE_MODEL_FALLBACKS as Lt, ADVISOR_INTERNAL_TOOL_NAME as M, CONDENSED_OPERATING_SEQUENCE as Mt, ADVISOR_TOOL_INSTRUCTIONS as N, DEFINITION_OF_GREATNESS as Nt, TOOLBELT_TOOLS$1 as O, extractTarGzMember as Ot, buildAdvisorStream as P, shouldUseInsecureTls as Pt, browseAgentEnabled as Q, rememberThinkingHistoryRepair as R, DEFAULT_CODEX_MODEL as Rt, buildEnv as S, readResponseBodyCapped as St, toolbeltEnabled as T, hasSupportedBrowserInstalled as Tt, isControllerClosedError as U, generateRandomPort as Ut, buildAnthropicErrorEvent as V, UPSTREAM_FETCH_TIMEOUT_MS as Vt, logStreamError as W, pickClaudeDefault as Wt, artifactToolsEnabled as X, agentToolsEnabled as Y, brainstormModel as Z, appendPlanReminder as _, resolveMcpToolTimeoutMs as _t, buildPeerAwarenessSnippet as a, nativeSubagentModel as at, resolveWorkerRunOpts as b, createChatCompletions as bt, personasFor as c, scribeModel as ct, EXPLORE_DEFAULT_MODEL as d, shimDefaultsToXhigh as dt, browserToolsEnabled as et, EXPLORE_DEFAULT_THINKING as f, countTokens as ft, TEST_DEFAULT_MODEL as g, warnOnTokenPriceDrift as gt, REVIEW_DEFAULT_MODEL as h, assembleResponsesPayload as ht, buildAgentPrompt as i, implementerFastModel as it, searchWeb as j, provisionTreeSitterAssets as jt, assetFor as k, extractZipMember as kt, BROWSE_DEFAULT_MODEL as l, standInToolEnabled as lt, PLAN_DEFAULT_MODEL as m, getTokenCount as mt, MCP_GROUPS as n, geminiAvailable as nt, buildPeerAwarenessSummary as o, reviewerModel as ot, IMPLEMENT_DEFAULT_MODEL as p, createMessages as pt, handleMcpDelete as q, withOneMSuffix as qt, assertMcpToolSurfaceConsistent as r, generalPurposeFastModel as rt, enumerateInjectedMcpToolNames as s, scoutModel as st, GROUP_META as t, fleetToolsEnabled as tt, DEFAULT_MODEL_CHAIN as u, workerToolsEnabled as ut, resolveDefaultModel as v, pickEndpoint as vt, buildToolbeltAwareness as w, provisionBrowserAssets as wt, runWorkerAgent as x, MAX_RESPONSE_BODY_BYTES as xt, resolveModeDefaults as y, createResponses as yt, repairKnownThinkingHistory as z, DEFAULT_CODEX_MODEL_FALLBACKS as zt };
+export { handleMcpDelete as $, resolveLeadSlugArg as $t, satisfiesMinVersion as A, hasSupportedBrowserInstalled as At, rememberThinkingHistoryRepair as B, collapsePathKeys as Bt, availableToolCommands as C, resolveMcpToolTimeoutMs as Ct, vscodeRipgrepPath as D, readResponseBodyCapped as Dt, toolbeltSkipSet as E, MAX_RESPONSE_BODY_BYTES as Et, injectAdvisorTool as F, warmTreeSitterPool as Ft, isControllerClosedError as G, DEFAULT_CODEX_MODEL as Gt, repairRejectedThinkingHistory as H, BUDGET_SMALL_FAST_CATALOG_ID as Ht, isAdvisorRequested as I, provisionTreeSitterAssets as It, relayAnthropicStream as J, UPSTREAM_FETCH_TIMEOUT_MS as Jt, logStreamError as K, DEFAULT_CODEX_MODEL_FALLBACKS as Kt, resolveAdvisorEffort as L, CONDENSED_OPERATING_SEQUENCE as Lt, ADVISOR_INTERNAL_TOOL_NAME as M, provisionAndIndexColbert as Mt, ADVISOR_TOOL_INSTRUCTIONS as N, extractTarGzMember as Nt, TOOLBELT_TOOLS$1 as O, parseJsonOrDiagnose as Ot, buildAdvisorStream as P, extractZipMember as Pt, clampEffort as Q, pickClaudeDefault as Qt, resolveAdvisorModel as R, DEFINITION_OF_GREATNESS as Rt, buildEnv as S, warnOnTokenPriceDrift as St, toolbeltEnabled as T, createChatCompletions as Tt, buildAnthropicErrorEvent as U, BUDGET_SMALL_FAST_SLUG as Ut, repairKnownThinkingHistory as V, toolbeltPathOverride as Vt, buildOpenAIErrorEvent as W, DEFAULT_CLAUDE_MODEL_FALLBACKS as Wt, UNKNOWN_EFFORT_ANCHOR as X, generateRandomPort as Xt, EFFORT_ORDER as Y, UPSTREAM_INACTIVITY_TIMEOUT_MS as Yt, bucketEffort as Z, isBudgetClaudeLead as Zt, appendPlanReminder as _, shimDefaultsToXhigh as _t, buildPeerAwarenessSnippet as a, withInstallLock as an, browserCompoundToolsEnabled as at, resolveWorkerRunOpts as b, getTokenCount as bt, personasFor as c, geminiAvailable as ct, EXPLORE_DEFAULT_MODEL as d, nativeSubagentModel as dt, upstreamAllowH2 as en, handleMcpPost as et, EXPLORE_DEFAULT_THINKING as f, reviewerModel as ft, TEST_DEFAULT_MODEL as g, workerToolsEnabled as gt, REVIEW_DEFAULT_MODEL as h, standInToolEnabled as ht, buildAgentPrompt as i, withOneMSuffixForLead as in, browseAgentEnabled as it, searchWeb as j, colbertDegradedWarning as jt, assetFor as k, provisionBrowserAssets as kt, BROWSE_DEFAULT_MODEL as l, generalPurposeFastModel as lt, PLAN_DEFAULT_MODEL as m, scribeModel as mt, MCP_GROUPS as n, classifyMessagesRoute as nn, artifactToolsEnabled as nt, buildPeerAwarenessSummary as o, browserToolsEnabled as ot, IMPLEMENT_DEFAULT_MODEL as p, scoutModel as pt, readIteratorWithTimeout as q, DEFAULT_PORT as qt, assertMcpToolSurfaceConsistent as r, withOneMSuffix as rn, brainstormModel as rt, enumerateInjectedMcpToolNames as s, fleetToolsEnabled as st, GROUP_META as t, upstreamMaxConnections as tn, agentToolsEnabled as tt, DEFAULT_MODEL_CHAIN as u, implementerFastModel as ut, resolveDefaultModel as v, countTokens as vt, buildToolbeltAwareness as w, createResponses as wt, runWorkerAgent as x, assembleResponsesPayload as xt, resolveModeDefaults as y, createMessages as yt, formatThinkingRepairDecline as z, shouldUseInsecureTls as zt };
 
-//# sourceMappingURL=peer-mcp-personas-l4P4s1fK.js.map
+//# sourceMappingURL=peer-mcp-personas-V6stFvpq.js.map