reasonix 0.48.1 → 0.49.0

package/dist/cli/{chunk-JFBGSWQB.js → chunk-MQWO32ZD.js}

@@ -3,7 +3,7 @@ import { createRequire as __cr } from 'node:module'; if (typeof globalThis.requi
 import {
   MemoryStore,
   sanitizeMemoryName
-} from "./chunk-FD7SNDWW.js";
+} from "./chunk-O5LIHAMP.js";
 import {
   countTokens,
   countTokensBounded,
@@ -12,23 +12,25 @@ import {
 } from "./chunk-6OWJV3YW.js";
 import {
   Usage
-} from "./chunk-5U5LMMFF.js";
+} from "./chunk-J2IHQGPQ.js";
 import {
   applyEdit,
   applyMultiEdit,
+  decodeFileBuffer,
+  encodeFile,
   pauseGate
-} from "./chunk-6FRNXWDZ.js";
+} from "./chunk-ZWHSHFDP.js";
 import {
   NEGATIVE_CLAIM_RULE,
   PROJECT_MEMORY_FILES,
   PROJECT_MEMORY_MAX_CHARS,
   TUI_FORMATTING_RULES,
   memoryEnabled
-} from "./chunk-SLAFMXAZ.js";
+} from "./chunk-JNTMOX7G.js";
 import {
   formatHookOutcomeMessage,
   runHooks
-} from "./chunk-PJIQIYTV.js";
+} from "./chunk-PB3MAFEI.js";
 import {
   ignoredByLayers,
   loadGitignoreAt,
@@ -46,12 +48,13 @@ import {
   DEEPSEEK_CONTEXT_TOKENS,
   DEFAULT_CONTEXT_TOKENS,
   SessionStats
-} from "./chunk-IKSYVBBZ.js";
+} from "./chunk-QX5TWXRZ.js";
 import {
   t
-} from "./chunk-PIC5HJRD.js";
+} from "./chunk-YEF7C4XI.js";
 import {
   DEFAULT_INDEX_EXCLUDES,
+  ToolRateLimiter,
   addProjectPathAllowed,
   loadExaApiKey,
   loadMemoryTypeRegistry,
@@ -59,10 +62,11 @@ import {
   loadPerplexityApiKey,
   loadProjectPathAllowed,
   loadTavilyApiKey,
+  parseRateLimitedToolResult,
   require_picomatch,
   webSearchEndpoint,
   webSearchEngine
-} from "./chunk-FPME5QOO.js";
+} from "./chunk-WMTMMSXU.js";
 import {
   __commonJS,
   __esm,
@@ -6052,12 +6056,12 @@ async function waitForReady(ready, timeoutMs, serverName, signal) {
   let timer;
   let onAbort;
   try {
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve6, reject) => {
       ready.then(
         () => {
           if (settled) return;
           settled = true;
-          resolve5();
+          resolve6();
         },
         (err) => {
           if (settled) return;
@@ -6314,12 +6318,14 @@ var ToolRegistry = class {
   _interceptors = [];
   _auditListener = null;
   _resultAugmenter = null;
+  _rateLimiter;
   /** Per-tool fingerprint of the last call that failed schema validation. Cleared by any successful validation for that tool. */
   _lastMalformed = /* @__PURE__ */ new Map();
   /** Per-tool fingerprint of the last host-side gate rejection. */
   _lastGateRejection = /* @__PURE__ */ new Map();
   constructor(opts = {}) {
     this._autoFlatten = opts.autoFlatten !== false;
+    this._rateLimiter = new ToolRateLimiter(opts.rateLimit);
   }
   /** Enable / disable plan-mode enforcement at dispatch. */
   setPlanMode(on) {
@@ -6356,6 +6362,9 @@ var ToolRegistry = class {
   get hasResultAugmenter() {
     return this._resultAugmenter !== null;
   }
+  get rateLimitPolicy() {
+    return this._rateLimiter.policy;
+  }
   register(def) {
     if (!def.name) throw new Error("tool requires a name");
     const internal = { ...def };
@@ -6454,6 +6463,10 @@ var ToolRegistry = class {
         rejectedReason: "aborted"
       });
     }
+    const rateLimit = this._rateLimiter.consume(name);
+    if (!rateLimit.allowed) {
+      return JSON.stringify(rateLimit.result);
+    }
     let finalResult;
     try {
       try {
@@ -6462,7 +6475,8 @@ var ToolRegistry = class {
       }
       const result = await tool.fn(args, {
         signal: opts.signal,
-        confirmationGate: opts.confirmationGate
+        confirmationGate: opts.confirmationGate,
+        readTracker: opts.readTracker
       });
       const str = typeof result === "string" ? result : JSON.stringify(result);
       let clipped = str;
@@ -6547,6 +6561,9 @@ function plainTextRejectedReason(name, result) {
   if ((name === "edit_file" || name === "write_file") && /rejected this edit/i.test(result)) {
     return "edit-gate";
   }
+  if ((name === "edit_file" || name === "multi_edit") && /read_file first/i.test(result)) {
+    return "read-before-edit";
+  }
   if ((name === "run_command" || name === "run_background") && /\buser denied:/i.test(result)) {
     return "shell-gate";
   }
@@ -6556,6 +6573,8 @@ function rejectionRecoveryHint(reason) {
   switch (reason) {
     case "edit-gate":
       return "Do not re-emit the same edit. Try a genuinely different edit or ask the user how to proceed.";
+    case "read-before-edit":
+      return "Call read_file on the target path first, then re-issue the edit.";
     case "shell-gate":
       return "Do not retry the same command. Use an allowlisted/read-only command, wait for approval, or ask the user how to proceed.";
     case "engineering-lifecycle":
@@ -6757,6 +6776,10 @@ function buildSyntheticAssistantMessage(content, fallbackModel) {
 }
 
 // src/context-manager.ts
+function extractPinnedConstraints(systemPrompt) {
+  const pattern = /# (?:HIGH PRIORITY constraints|User memory|Project memory)[\s\S]*?(?=\n# |\n---|$)/g;
+  return Array.from(systemPrompt.matchAll(pattern), (m) => m[0]).join("\n\n");
+}
 var HISTORY_FOLD_THRESHOLD = 0.75;
 var HISTORY_FOLD_TAIL_FRACTION = 0.2;
 var HISTORY_FOLD_AGGRESSIVE_THRESHOLD = 0.78;
@@ -6771,20 +6794,25 @@ var HISTORY_FOLD_SUMMARY_TIMEOUT_MS = 15e3;
 var HISTORY_FOLD_MARKER = "[CONVERSATION HISTORY SUMMARY \u2014 earlier turns folded for context efficiency]\n\n";
 var SKILL_PIN_MEMO_HEADER = "[Active skill memos \u2014 preserved verbatim across the fold:]";
 var SKILL_PIN_REGEX = /<skill-pin name="([^"]+)">\n[\s\S]*?\n<\/skill-pin>/g;
-function extractPinnedSkills(head) {
+function buildFoldSummaryInstruction(pinnedSkillNames) {
+  const base = "Summarize the conversation above as one self-contained prose recap. Preserve the user's ORIGINAL OBJECTIVE (never paraphrase away negative constraints like 'do NOT do X'), all 'do not' / 'never' / 'avoid' instructions, decisions reached, files inspected or modified, tool results still relevant, and any open todos. Skip turn-by-turn play-by-play. Output plain prose only \u2014 no tool calls, no markdown headings, no SEARCH/REPLACE blocks.";
+  if (pinnedSkillNames.length === 0) return base;
+  const list = pinnedSkillNames.map((n) => `"${n}"`).join(", ");
+  return `${base} The following skill memos are pinned verbatim and appended after your summary \u2014 do NOT quote or paraphrase their bodies: ${list}.`;
+}
+function collectPinnedSkills(head) {
   const pinned = /* @__PURE__ */ new Map();
-  const stubbedHead = head.map((msg) => {
-    if (typeof msg.content !== "string") return msg;
-    let hit = false;
-    const next = msg.content.replace(SKILL_PIN_REGEX, (full, name) => {
+  for (const msg of head) {
+    if (typeof msg.content !== "string") continue;
+    SKILL_PIN_REGEX.lastIndex = 0;
+    for (const match of msg.content.matchAll(SKILL_PIN_REGEX)) {
+      const name = match[1];
+      const full = match[0];
       pinned.delete(name);
       pinned.set(name, full);
-      hit = true;
-      return `[skill ${JSON.stringify(name)} memo \u2014 preserved separately, do not summarize.]`;
-    });
-    return hit ? { ...msg, content: next } : msg;
-  });
-  return { stubbedHead, pinnedBodies: [...pinned.values()] };
+    }
+  }
+  return { names: [...pinned.keys()], bodies: [...pinned.values()] };
 }
 var ContextManager = class {
   constructor(deps) {
@@ -6880,16 +6908,22 @@ var ContextManager = class {
     const tail = all.slice(boundary);
     const headTokens = totalTokens - cumTokens;
     if (headTokens < totalTokens * HISTORY_FOLD_MIN_SAVINGS_FRACTION) return noop;
-    const { stubbedHead, pinnedBodies } = extractPinnedSkills(head);
-    const summary = await this.summarizeForFold(stubbedHead);
+    const { names: pinnedNames, bodies: pinnedBodies } = collectPinnedSkills(head);
+    const summary = await this.summarizeForFold(head, pinnedNames);
     if (!summary.content) return noop;
     const memoTail = pinnedBodies.length > 0 ? `
 
 ${SKILL_PIN_MEMO_HEADER}
 
 ${pinnedBodies.join("\n\n")}` : "";
+    const constraints = extractPinnedConstraints(this.deps.getSystemPrompt());
+    const constraintTail = constraints ? `
+
+[PINNED CONSTRAINTS \u2014 preserved verbatim]
+
+${constraints}` : "";
     const summaryMsg = buildAssistantMessage(
-      HISTORY_FOLD_MARKER + summary.content + memoTail,
+      HISTORY_FOLD_MARKER + summary.content + memoTail + constraintTail,
       [],
       model,
       summary.reasoningContent
@@ -6897,6 +6931,7 @@ ${pinnedBodies.join("\n\n")}` : "";
     const replacement = [summaryMsg, ...tail];
     this.deps.log.compactInPlace(replacement);
     this.persistRewrite(replacement);
+    this.deps.onLogRewrite?.();
     return {
       folded: true,
       beforeMessages: all.length,
@@ -6948,6 +6983,7 @@ ${pinnedBodies.join("\n\n")}` : "";
     if (replacement.length === all.length) return noop;
     this.deps.log.compactInPlace(replacement);
     this.persistRewrite(replacement);
+    this.deps.onLogRewrite?.();
     return {
       folded: true,
       beforeMessages: all.length,
@@ -6966,17 +7002,18 @@ ${pinnedBodies.join("\n\n")}` : "";
     this.persistRewrite([...kept]);
     return true;
   }
-  async summarizeForFold(messagesToSummarize) {
+  async summarizeForFold(messagesToSummarize, pinnedSkillNames) {
     const summaryModel = "deepseek-v4-flash";
-    const systemPrompt = "You compress conversation history for a coding agent. Output one prose recap that preserves: the user's overall goal, decisions and conclusions reached, files inspected or modified, important tool results still relevant to ongoing work, and any open todos. Skip turn-by-turn play-by-play. No tool calls, no markdown headings, no SEARCH/REPLACE blocks \u2014 plain prose only.";
     const healed = healLoadedMessages(messagesToSummarize, DEFAULT_MAX_RESULT_CHARS).messages;
+    const agentSystem = this.deps.getSystemPrompt();
+    const fewShots = this.deps.getFewShots?.() ?? [];
+    const tools = this.deps.getToolSpecs?.() ?? [];
+    const instruction = buildFoldSummaryInstruction(pinnedSkillNames);
     const messages = [
-      { role: "system", content: systemPrompt },
+      { role: "system", content: agentSystem },
+      ...fewShots.map((m) => ({ ...m })),
       ...healed,
-      {
-        role: "user",
-        content: "Summarize the conversation above as plain prose. This summary replaces the original turns to free context \u2014 make it self-contained."
-      }
+      { role: "user", content: instruction }
     ];
     const turnSignal = this.deps.getAbortSignal();
     const foldCtrl = new AbortController();
@@ -7006,9 +7043,9 @@ ${pinnedBodies.join("\n\n")}` : "";
         this.deps.client.chat({
           model: summaryModel,
           messages,
+          tools: tools.length ? tools : void 0,
           signal: foldCtrl.signal,
-          thinking: thinkingModeForModel(summaryModel),
-          reasoningEffort: "high"
+          thinking: "disabled"
         }),
         abortPromise,
         timeoutPromise
@@ -7093,6 +7130,7 @@ function formatLoopError(err, probe) {
   if (status === "402") return t("errors.balance402", { inner });
   if (status === "422") return t("errors.badparam422", { inner });
   if (status === "400") return t("errors.badrequest400", { inner });
+  if (status === "429") return t("errors.concurrency429", { inner });
   if (is5xxStatus(status)) return formatDeepSeek5xx(status, probe);
   return msg;
 }
@@ -7675,8 +7713,34 @@ function signature(call) {
   return `${call.function?.name ?? ""}::${call.function?.arguments ?? ""}`;
 }
 
+// src/tools/read-tracker.ts
+import * as pathMod from "path";
+var ReadTracker = class _ReadTracker {
+  _seen = /* @__PURE__ */ new Set();
+  static norm(abs) {
+    const resolved = pathMod.resolve(abs);
+    return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+  }
+  markRead(abs) {
+    this._seen.add(_ReadTracker.norm(abs));
+  }
+  hasRead(abs) {
+    return this._seen.has(_ReadTracker.norm(abs));
+  }
+  reset() {
+    this._seen.clear();
+  }
+  get size() {
+    return this._seen.size;
+  }
+};
+
 // src/loop.ts
 var ESCALATION_MODEL = "deepseek-v4-pro";
+var MID_TURN_STEER_WRAPPER = "[Mid-turn steer queued by the user. Do not treat this as a new task; use it only as additional guidance for the current task after completing the current step.]";
+function formatSteerUserMessage(content) {
+  return [MID_TURN_STEER_WRAPPER, content].join("\n");
+}
 var CacheFirstLoop = class {
   client;
   prefix;
@@ -7685,6 +7749,8 @@ var CacheFirstLoop = class {
   scratch = new VolatileScratch();
   stats = new SessionStats();
   repair;
+  /** Files the model has read this session; gates edit_file / multi_edit so SEARCH text matches on-disk bytes. Cleared on fold / mechanical truncate (the model's byte-level view of the elided history is gone). In-memory only — naturally empty on resume. */
+  readTracker = new ReadTracker();
   // Mutable via configure() — slash commands in the TUI / library callers tweak
   // these mid-session so users don't have to restart.
   model;
@@ -7708,15 +7774,19 @@ var CacheFirstLoop = class {
   _turnAbort = new AbortController();
   /** Authoritative running-id set — UI cards consult this instead of trusting end-event delivery. Insert at dispatch entry, delete in finally. */
   _inflight = new InflightSet();
-  /** Typeahead steer message set by the UI; step() consumes it at the next iter boundary. */
-  _steer = null;
+  /** Typeahead steer messages set by the UI; step() consumes one at each iter boundary. */
+  _steerQueue = [];
   /** Set true when a steer was consumed this turn; cleared on next step() entry. */
   _steerConsumed = false;
   /** UI calls this to inject a mid-turn steer message without aborting the current turn.
-   *  New text resets steerConsumed — a fresh steer hasn't been consumed yet. */
+   *  New text resets steerConsumed because a fresh steer is queued. */
   steer(text) {
-    this._steer = text;
-    if (text !== null) this._steerConsumed = false;
+    if (text === null) {
+      this._steerQueue.length = 0;
+      return;
+    }
+    this._steerQueue.push(text);
+    this._steerConsumed = false;
   }
   /** True when a steer was consumed this turn (UI gate to avoid double-submit). */
   get steerConsumed() {
@@ -7802,7 +7872,11 @@ var CacheFirstLoop = class {
       stats: this.stats,
       sessionName: this.sessionName,
       getAbortSignal: () => this._turnAbort.signal,
-      getCurrentTurn: () => this._turn
+      getCurrentTurn: () => this._turn,
+      getSystemPrompt: () => this.prefix.system,
+      getToolSpecs: () => this.prefix.toolSpecs,
+      getFewShots: () => this.prefix.fewShots,
+      onLogRewrite: () => this.readTracker.reset()
     });
   }
   /** Replace older turns with one summary message; keep tail within keepRecentTokens budget. */
@@ -7973,7 +8047,8 @@ ${reason}`
       const result = await this.tools.dispatch(name, args, {
         signal,
         maxResultTokens: DEFAULT_MAX_RESULT_TOKENS,
-        confirmationGate: this.confirmationGate
+        confirmationGate: this.confirmationGate,
+        readTracker: this.readTracker
       });
       const postReport = await runHooks({
         hooks: this.hooks,
@@ -8001,11 +8076,9 @@ ${reason}`
     return generated;
   }
   _inflightCounter = 0;
-  buildMessages(pendingUser) {
+  buildMessages() {
     const healedMessages = this.healActiveLogBeforeSend();
-    const msgs = [...this.prefix.toMessages(), ...healedMessages];
-    if (pendingUser !== null) msgs.push({ role: "user", content: pendingUser });
-    return msgs;
+    return [...this.prefix.toMessages(), ...healedMessages];
   }
   healActiveLogBeforeSend() {
     const current = this.log.toMessages();
@@ -8086,6 +8159,7 @@ ${reason}`
             cap: this.budgetUsd.toFixed(2)
           })
         };
+        this._steerQueue.length = 0;
         return;
       }
       if (!this._budgetWarned && spent >= this.budgetUsd * 0.8) {
@@ -8124,8 +8198,8 @@ ${reason}`
       };
     }
     this.appendAndPersist({ role: "user", content: userInput });
-    let pendingUser = null;
     const toolSpecs = this.prefix.tools();
+    let rateLimitWarningShown = false;
     for (let iter = 0; ; iter++) {
       if (signal.aborted) {
         try {
@@ -8146,6 +8220,7 @@ ${reason}`
         } finally {
           this._turnAbort = new AbortController();
         }
+        this._steerQueue.length = 0;
         return;
       }
       if (iter > 0) {
@@ -8155,14 +8230,15 @@ ${reason}`
           content: t("loop.toolUploadStatus")
         };
       }
-      let messages = this.buildMessages(pendingUser);
-      if (this._steer !== null) {
-        const steer = this._steer;
-        this._steer = null;
-        this._steerConsumed = true;
-        this.appendAndPersist({ role: "user", content: steer });
-        messages = this.buildMessages(pendingUser);
-        pendingUser = null;
+      let messages = this.buildMessages();
+      if (this._steerQueue.length > 0) {
+        const steer = this._steerQueue.shift();
+        this._steerConsumed = this._steerQueue.length === 0;
+        this.appendAndPersist({
+          role: "user",
+          content: formatSteerUserMessage(steer)
+        });
+        messages = this.buildMessages();
         yield {
           turn: this._turn,
           role: "steer",
@@ -8179,10 +8255,10 @@ ${reason}`
             content: t("loop.preflightTruncateStatus")
           };
           const result = this.context.mechanicalTruncate(this.model, {
-            allowEmpty: pendingUser !== null
+            allowEmpty: false
           });
           if (result.folded) {
-            messages = this.buildMessages(pendingUser);
+            messages = this.buildMessages();
             const after = this.context.decidePreflight(messages, this.prefix.toolSpecs, this.model);
             const stillFull = after.needsAction;
             yield {
@@ -8328,6 +8404,7 @@ ${reason}`
           } finally {
             this._turnAbort = new AbortController();
           }
+          this._steerQueue.length = 0;
           return;
         }
         const probe = is5xxError(err) ? await probeDeepSeekReachable(this.client) : void 0;
@@ -8337,6 +8414,7 @@ ${reason}`
           content: "",
           error: formatLoopError(err, probe)
         };
+        this._steerQueue.length = 0;
         return;
       }
       if (this.autoEscalate && this.modelForCurrentCall() !== ESCALATION_MODEL && isEscalationRequest(assistantContent)) {
@@ -8417,11 +8495,16 @@ ${reason}`
         };
       }
       if (repairedCalls.length === 0) {
+        if (this._steerQueue.length > 0) {
+          continue;
+        }
         if (allSuppressed) {
           yield* forceSummaryAfterIterLimit(this.summaryContext(), { reason: "stuck" });
+          this._steerQueue.length = 0;
           return;
         }
         yield { turn: this._turn, role: "done", content: assistantContent };
+        this._steerQueue.length = 0;
         return;
       }
       const decision = this.context.decideAfterUsage(usage, this.model, this._foldedThisTurn);
@@ -8467,6 +8550,7 @@ ${reason}`
         };
         this.context.trimTrailingToolCalls();
         yield* forceSummaryAfterIterLimit(this.summaryContext(), { reason: "context-guard" });
+        this._steerQueue.length = 0;
         return;
       }
       const dispatchSerial = (process.env.REASONIX_TOOL_DISPATCH ?? "auto").toLowerCase() === "serial";
@@ -8514,6 +8598,15 @@ ${reason}`
           }
           for (const w of preWarnings) yield w;
           for (const w of postWarnings) yield w;
+          const rateLimited = parseRateLimitedToolResult(result);
+          if (rateLimited && !rateLimitWarningShown) {
+            rateLimitWarningShown = true;
+            yield {
+              turn: this._turn,
+              role: "warning",
+              content: rateLimited.message
+            };
+          }
           this.appendAndPersist({
             role: "tool",
             tool_call_id: call.id ?? "",
@@ -8536,7 +8629,7 @@ ${reason}`
     return {
       client: this.client,
       signal: this._turnAbort.signal,
-      buildMessages: () => this.buildMessages(null),
+      buildMessages: () => this.buildMessages(),
       appendAndPersist: (m) => this.appendAndPersist(m),
       recordStats: (model, usage) => this.stats.record(this._turn, model, usage),
       turn: this._turn
@@ -8561,7 +8654,7 @@ function parsePositiveIntEnv(raw) {
 // src/at-mentions.ts
 import { existsSync, readFileSync, readdirSync, statSync } from "fs";
 import { readdir, stat } from "fs/promises";
-import { isAbsolute, join, relative, resolve } from "path";
+import { isAbsolute, join, relative, resolve as resolve2 } from "path";
 
 // src/at-mentions-url.ts
 var AT_URL_PATTERN = /(?<=^|\s)@(https?:\/\/\S+)/g;
@@ -8692,7 +8785,7 @@ function listFilesSync(root, opts = {}) {
 function listFilesWithStatsSync(root, opts = {}) {
   const maxResults = Math.max(1, opts.maxResults ?? 2e3);
   const ignoreDirs = new Set(opts.ignoreDirs ?? DEFAULT_PICKER_IGNORE_DIRS);
-  const rootAbs = resolve(root);
+  const rootAbs = resolve2(root);
   const respectGi = opts.respectGitignore !== false;
   const out = [];
   const walk2 = (dirAbs, dirRel, layers) => {
@@ -8756,7 +8849,7 @@ async function listFilesWithStatsAsync(root, opts = {}) {
 async function walkFilesStream(root, opts) {
   const ignoreDirs = new Set(opts.ignoreDirs ?? DEFAULT_PICKER_IGNORE_DIRS);
   const respectGi = opts.respectGitignore !== false;
-  const rootAbs = resolve(root);
+  const rootAbs = resolve2(root);
   const progressGap = Math.max(0, opts.progressIntervalMs ?? 100);
   let scanned = 0;
   let halted = false;
@@ -8834,8 +8927,8 @@ async function flushFiles(ents, dirAbs, dirRel, layers, emit) {
 async function listDirectory(root, relDir, opts = {}) {
   const ignoreDirs = new Set(opts.ignoreDirs ?? DEFAULT_PICKER_IGNORE_DIRS);
   const respectGi = opts.respectGitignore !== false;
-  const rootAbs = resolve(root);
-  const dirAbs = resolve(rootAbs, relDir);
+  const rootAbs = resolve2(root);
+  const dirAbs = resolve2(rootAbs, relDir);
   const rel = relative(rootAbs, dirAbs);
   if (rel.startsWith("..") || isAbsolute(rel)) return [];
   const layers = [];
@@ -9000,7 +9093,7 @@ function expandAtMentions(text, rootDir, opts = {}) {
   const maxBytes = opts.maxBytes ?? DEFAULT_AT_MENTION_MAX_BYTES;
   const maxDirEntries = Math.max(1, opts.maxDirEntries ?? DEFAULT_AT_DIR_MAX_ENTRIES);
   const fs4 = opts.fs ?? defaultFs;
-  const root = resolve(rootDir);
+  const root = resolve2(rootDir);
   const seen = /* @__PURE__ */ new Map();
   const expansions = [];
   const dirListings = /* @__PURE__ */ new Map();
@@ -9047,7 +9140,7 @@ function resolveMention(rawPath, root, maxBytes, maxDirEntries, fs4, dirListings
   if (isAbsolute(rawPath)) {
     return { token: `@${rawPath}`, path: rawPath, ok: false, skip: "escape" };
   }
-  const resolved = resolve(root, rawPath);
+  const resolved = resolve2(root, rawPath);
   const rel = relative(root, resolved);
   if (rel.startsWith("..") || isAbsolute(rel)) {
     return { token: `@${rawPath}`, path: rawPath, ok: false, skip: "escape" };
@@ -9077,7 +9170,7 @@ function resolveMention(rawPath, root, maxBytes, maxDirEntries, fs4, dirListings
   return { token: `@${rawPath}`, path: rawPath, ok: false, skip: "not-file" };
 }
 function readSafe(root, rawPath, fs4) {
-  const resolved = resolve(root, rawPath);
+  const resolved = resolve2(root, rawPath);
   try {
     return fs4.read(resolved);
   } catch {
@@ -9353,16 +9446,19 @@ function registerChoiceTool(registry, opts = {}) {
 
 // src/tools/web.ts
 var import_node_html_parser = __toESM(require_dist(), 1);
+import { lookup } from "dns/promises";
+import { isIP } from "net";
 var DEFAULT_FETCH_MAX_CHARS = 32e3;
 var DEFAULT_FETCH_TIMEOUT_MS = 15e3;
 var DEFAULT_TOPK = 5;
 var FETCH_MAX_BYTES = 10 * 1024 * 1024;
 var USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36";
-var MOJEEK_ENDPOINT = "https://www.mojeek.com/search";
+var BING_ENDPOINT = "https://cn.bing.com/search";
 var METASO_ENDPOINT = "https://metaso.cn/api/v1";
 var TAVILY_ENDPOINT = "https://api.tavily.com/search";
 var PERPLEXITY_ENDPOINT = "https://api.perplexity.ai/chat/completions";
 var EXA_ENDPOINT = "https://api.exa.ai/answer";
+var FETCH_MAX_REDIRECTS = 5;
 function searchStatusError(status) {
   if (status === 429) return t("webErrors.rateLimit429");
   if (status === 403) return t("webErrors.forbidden403");
@@ -9375,6 +9471,63 @@ function fetchStatusError(status, url) {
   if (status >= 500 && status <= 599) return t("webErrors.fetchServerError5xx", { status, url });
   return t("webErrors.fetchStatus", { status, url });
 }
+function parseIpv4(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4) return null;
+  let out = 0;
+  for (const part of parts) {
+    if (!/^\d+$/.test(part)) return null;
+    const n = Number(part);
+    if (!Number.isInteger(n) || n < 0 || n > 255) return null;
+    out = (out << 8) + n;
+  }
+  return out >>> 0;
+}
+function ipv4InRange(value, base, bits) {
+  const parsed = parseIpv4(base);
+  if (parsed === null) return false;
+  const mask = bits === 0 ? 0 : 4294967295 << 32 - bits >>> 0;
+  return (value & mask) === (parsed & mask);
+}
+function isPrivateIpv4(address) {
+  const value = parseIpv4(address);
+  if (value === null) return false;
+  return ipv4InRange(value, "0.0.0.0", 8) || ipv4InRange(value, "10.0.0.0", 8) || ipv4InRange(value, "100.64.0.0", 10) || ipv4InRange(value, "127.0.0.0", 8) || ipv4InRange(value, "169.254.0.0", 16) || ipv4InRange(value, "172.16.0.0", 12) || ipv4InRange(value, "192.0.0.0", 24) || ipv4InRange(value, "192.0.2.0", 24) || ipv4InRange(value, "192.168.0.0", 16) || ipv4InRange(value, "198.18.0.0", 15) || ipv4InRange(value, "198.51.100.0", 24) || ipv4InRange(value, "203.0.113.0", 24) || ipv4InRange(value, "224.0.0.0", 4) || ipv4InRange(value, "240.0.0.0", 4);
+}
+function normalizeIpv6(address) {
+  return address.toLowerCase().replace(/(^|:)0+([0-9a-f])/g, "$1$2");
+}
+function isPrivateIpv6(address) {
+  const normalized = normalizeIpv6(address);
+  const mapped = /^::ffff:(?:0+:)?(\d+\.\d+\.\d+\.\d+)$/i.exec(normalized);
+  if (mapped) return isPrivateIpv4(mapped[1]);
+  return normalized === "::" || normalized === "::1" || normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb") || normalized.startsWith("ff");
+}
+function isInternalAddress(address) {
+  const family = isIP(address);
+  if (family === 4) return isPrivateIpv4(address);
+  if (family === 6) return isPrivateIpv6(address);
+  return false;
+}
+async function assertPublicHttpUrl(rawUrl) {
+  const url = new URL(rawUrl);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error(`web_fetch refuses non-HTTP URL: ${url.protocol}`);
+  }
+  const host = url.hostname;
+  const literal = isIP(host);
+  const addresses = literal ? [host] : (await lookup(host, { all: true, verbatim: true })).map((entry) => entry.address);
+  if (addresses.length === 0 || addresses.some(isInternalAddress)) {
+    throw new Error(`web_fetch refuses internal or reserved host: ${host}`);
+  }
+  return url;
+}
+function redirectLocation(resp, currentUrl) {
+  if (resp.status < 300 || resp.status > 399) return null;
+  const location = resp.headers.get("location");
+  if (!location) return null;
+  return new URL(location, currentUrl).toString();
+}
 async function webSearch(query, opts = {}) {
   if (opts.engine === "metaso") {
     return searchMetaso(query, opts);
@@ -9391,29 +9544,29 @@ async function webSearch(query, opts = {}) {
   if (opts.engine === "exa") {
     return searchExa(query, opts);
   }
-  return searchMojeek(query, opts);
+  return searchBing(query, opts);
 }
-async function searchMojeek(query, opts = {}) {
+async function searchBing(query, opts = {}) {
   const topK = Math.max(1, Math.min(10, opts.topK ?? DEFAULT_TOPK));
-  const resp = await fetch(`${MOJEEK_ENDPOINT}?q=${encodeURIComponent(query)}`, {
+  const resp = await fetch(`${BING_ENDPOINT}?q=${encodeURIComponent(query)}`, {
     headers: {
       "User-Agent": USER_AGENT,
       Accept: "text/html,application/xhtml+xml,application/xml;q=0.9",
-      "Accept-Language": "en-US,en;q=0.9"
+      "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8"
     },
     signal: opts.signal,
     redirect: "follow"
   });
   if (!resp.ok) throw new Error(searchStatusError(resp.status));
   const html = await resp.text();
-  const results = parseMojeekResults(html).slice(0, topK);
+  const results = parseBingResults(html).slice(0, topK);
   if (results.length === 0) {
     if (/no results found|did not match any documents/i.test(html)) return [];
     if (/captcha|verify you are human|access denied|forbidden/i.test(html)) {
-      throw new Error(t("webErrors.mojeekBlocked"));
+      throw new Error(t("webErrors.bingBlocked"));
     }
     throw new Error(
-      t("webErrors.mojeekNoResults", {
+      t("webErrors.bingNoResults", {
         chars: html.length,
         preview: html.slice(0, 120).replace(/\s+/g, " ")
       })
@@ -9730,35 +9883,19 @@ function parseSearxngHtmlResults(html) {
   }
   return results;
 }
-function parseMojeekResults(html) {
-  const titles = [];
-  const titleAnchorRe = /<a\b[^>]*\bclass="title"[^>]*>[\s\S]*?<\/a>/g;
-  let m;
-  while (true) {
-    m = titleAnchorRe.exec(html);
-    if (m === null) break;
-    titles.push(m[0]);
-  }
-  const snippets = [];
-  const snippetRe = /<p\b[^>]*\bclass="s"[^>]*>([\s\S]*?)<\/p>/g;
-  while (true) {
-    m = snippetRe.exec(html);
-    if (m === null) break;
-    snippets.push(m[1] ?? "");
-  }
-  const hrefRe = /href="([^"]+)"/;
-  const innerRe = /<a\b[^>]*>([\s\S]*?)<\/a>/;
+function parseBingResults(html) {
+  const root = (0, import_node_html_parser.parse)(html);
   const results = [];
-  for (let i = 0; i < titles.length; i++) {
-    const anchor = titles[i];
-    const hrefMatch = anchor.match(hrefRe);
-    const innerMatch = anchor.match(innerRe);
-    if (!hrefMatch?.[1]) continue;
-    results.push({
-      title: decodeHtmlEntities(stripHtml(innerMatch?.[1] ?? "")).trim(),
-      url: hrefMatch[1],
-      snippet: decodeHtmlEntities(stripHtml(snippets[i] ?? "")).replace(/\s+/g, " ").trim()
-    });
+  for (const li of root.querySelectorAll("li.b_algo")) {
+    const anchor = li.querySelector("h2 a[href]");
+    if (!anchor) continue;
+    const href = anchor.getAttribute("href");
+    if (!href) continue;
+    const title = anchor.textContent.trim();
+    if (!title) continue;
+    const cap = li.querySelector("div.b_caption p");
+    const snippet = cap ? cap.textContent.trim().replace(/\s+/g, " ") : "";
+    results.push({ title, url: href, snippet });
   }
   return results;
 }
@@ -9774,12 +9911,23 @@ async function webFetch(url, opts = {}) {
   const cancel = () => ctl.abort();
   opts.signal?.addEventListener("abort", cancel, { once: true });
   let resp;
+  let currentUrl = url;
   try {
-    resp = await fetch(url, {
-      headers: { "User-Agent": USER_AGENT, Accept: "text/html,text/plain,*/*" },
-      signal: ctl.signal,
-      redirect: "follow"
-    });
+    for (let redirects = 0; ; redirects++) {
+      const parsed = await assertPublicHttpUrl(currentUrl);
+      if (ctl.signal.aborted) throw new DOMException("aborted", "AbortError");
+      resp = await fetch(parsed, {
+        headers: { "User-Agent": USER_AGENT, Accept: "text/html,text/plain,*/*" },
+        signal: ctl.signal,
+        redirect: "manual"
+      });
+      const nextUrl = redirectLocation(resp, parsed.toString());
+      if (!nextUrl) break;
+      if (redirects >= FETCH_MAX_REDIRECTS) {
+        throw new Error(`web_fetch redirect limit exceeded for ${url}`);
+      }
+      currentUrl = nextUrl;
+    }
   } catch (err) {
     if (timedOut) {
       throw new Error(t("webErrors.fetchTimeout", { ms: timeoutMs, url }));
@@ -9802,7 +9950,7 @@ async function webFetch(url, opts = {}) {
   const finalText = truncated ? `${text.slice(0, maxChars)}
 
 [\u2026 truncated ${text.length - maxChars} chars \u2026]` : text;
-  return { url, title, text: finalText, truncated };
+  return { url: currentUrl, title, text: finalText, truncated };
 }
 async function readBodyCapped(resp, maxBytes) {
   if (!resp.body) return await resp.text();
@@ -9874,9 +10022,6 @@ function walkExtract(node, out) {
   for (const child of node.childNodes) walkExtract(child, out);
   if (isBreak) out.push("\n");
 }
-function stripHtml(s) {
-  return (0, import_node_html_parser.parse)(s).text;
-}
 var HTML_ENTITIES = {
   amp: "&",
   lt: "<",
@@ -9991,14 +10136,14 @@ ${i + 1}. ${r.title}`);
 // src/tools/filesystem.ts
 var import_picomatch2 = __toESM(require_picomatch(), 1);
 import { promises as fs3 } from "fs";
-import * as pathMod4 from "path";
+import * as pathMod5 from "path";
 
 // src/memory/subdir.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { dirname, join as join2, relative as relative2, resolve as resolve2 } from "path";
+import { dirname, join as join2, relative as relative2, resolve as resolve3 } from "path";
 function findDirMemory(absDir, rootDir) {
-  const root = resolve2(rootDir);
-  const target = resolve2(absDir);
+  const root = resolve3(rootDir);
+  const target = resolve3(absDir);
   const rel = relative2(root, target);
   if (rel.startsWith("..")) return [];
   const found = [];
@@ -10020,7 +10165,7 @@ function findDirMemory(absDir, rootDir) {
   return found;
 }
 function findSubdirMemoryAncestors(absPath, rootDir) {
-  return findDirMemory(dirname(resolve2(absPath)), rootDir);
+  return findDirMemory(dirname(resolve3(absPath)), rootDir);
 }
 function readSubdirMemoryContent(path) {
   let raw;
@@ -10044,9 +10189,9 @@ ${content}`;
 // src/tools/fs/glob.ts
 var import_picomatch = __toESM(require_picomatch(), 1);
 import { promises as fs } from "fs";
-import * as pathMod from "path";
+import * as pathMod2 from "path";
 function displayRel(rootDir, full) {
-  return pathMod.relative(rootDir, full).replaceAll("\\", "/");
+  return pathMod2.relative(rootDir, full).replaceAll("\\", "/");
 }
 async function globFiles(ctx, startAbs, args) {
   if (args.signal?.aborted) {
@@ -10068,7 +10213,7 @@ async function globFiles(ctx, startAbs, args) {
       return;
     }
     for (const e of entries) {
-      const full = pathMod.join(dir, e.name);
+      const full = pathMod2.join(dir, e.name);
       if (e.isDirectory()) {
         if (!includeDeps && ctx.skipDirNames.has(e.name)) continue;
         await walk2(full);
@@ -10105,7 +10250,7 @@ async function globFiles(ctx, startAbs, args) {
 }
 
 // src/tools/fs/outline.ts
-import * as pathMod2 from "path";
+import * as pathMod3 from "path";
 var OUTLINE_MAX_ENTRIES = 30;
 var OUTLINE_TAIL_KEEP = 5;
 var TS_EXPORT_RE = /^export\s+(?:default\s+)?(?:async\s+)?(function|class|const|let|var|interface|type|enum)\s+\*?\s*(\w+)/;
@@ -10148,7 +10293,7 @@ var EXT_TO_LANG = {
   ".text": "txt"
 };
 function extractOutline(filename, lines) {
-  const ext = pathMod2.extname(filename).toLowerCase();
+  const ext = pathMod3.extname(filename).toLowerCase();
   const lang = EXT_TO_LANG[ext];
   if (!lang) return [];
   switch (lang) {
@@ -10289,7 +10434,7 @@ function formatOutline(entries) {
 
 // src/tools/fs/search.ts
 import { promises as fs2 } from "fs";
-import * as pathMod3 from "path";
+import * as pathMod4 from "path";
 
 // src/tools/fs/regex-runner.ts
 import { Worker } from "worker_threads";
@@ -10322,7 +10467,7 @@ var RegexRunner = class {
     this.defaultTimeoutMs = opts.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
   }
   testLines(text, source, flags, opts = {}) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       if (opts.signal?.aborted) {
         reject(new Error("regex evaluation aborted"));
         return;
@@ -10335,7 +10480,7 @@ var RegexRunner = class {
         this.killWorker();
         reject(new Error(`regex evaluation exceeded ${timeoutMs}ms`));
       }, timeoutMs);
-      const entry = { resolve: resolve5, reject, timer };
+      const entry = { resolve: resolve6, reject, timer };
       if (opts.signal) {
         entry.signal = opts.signal;
         entry.onAbort = () => {
@@ -10418,7 +10563,7 @@ function throwIfAborted(signal) {
   throw new DOMException("search aborted by user", "AbortError");
 }
 function displayRel2(rootDir, full) {
-  return pathMod3.relative(rootDir, full).replaceAll("\\", "/");
+  return pathMod4.relative(rootDir, full).replaceAll("\\", "/");
 }
 async function searchFiles(ctx, startAbs, args) {
   throwIfAborted(args.signal);
@@ -10442,7 +10587,7 @@ async function searchFiles(ctx, startAbs, args) {
     }
     for (const e of entries) {
       throwIfAborted(args.signal);
-      const full = pathMod3.join(dir, e.name);
+      const full = pathMod4.join(dir, e.name);
       const lower = e.name.toLowerCase();
       const hit = re ? re.test(e.name) : lower.includes(needle);
       if (hit) {
@@ -10534,11 +10679,11 @@ async function searchContent(ctx, startAbs, args) {
       throwIfTimedOut();
       if (e.isDirectory()) {
         if (!includeDeps && ctx.skipDirNames.has(e.name)) continue;
-        await walk2(pathMod3.join(dir, e.name));
+        await walk2(pathMod4.join(dir, e.name));
         continue;
       }
       if (!e.isFile()) continue;
-      const full = pathMod3.join(dir, e.name);
+      const full = pathMod4.join(dir, e.name);
       if (ctx.nameMatch && !ctx.nameMatch(e.name, displayRel2(ctx.rootDir, full))) continue;
       if (ctx.isBinaryByName(e.name)) continue;
       let fh;
@@ -10656,7 +10801,7 @@ var SKIP_DIR_NAMES = new Set(
 );
 var BINARY_EXTENSIONS = new Set(DEFAULT_INDEX_EXCLUDES.exts);
 function displayRel3(rootDir, full) {
-  return pathMod4.relative(rootDir, full).replaceAll("\\", "/");
+  return pathMod5.relative(rootDir, full).replaceAll("\\", "/");
 }
 function looksLikeAbsoluteSystemPath(raw) {
   if (/^[A-Za-z]:[\\/]/.test(raw)) return true;
@@ -10665,8 +10810,8 @@ function looksLikeAbsoluteSystemPath(raw) {
   );
 }
 function pathIsUnder(child, parent) {
-  const rel = pathMod4.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !pathMod4.isAbsolute(rel);
+  const rel = pathMod5.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !pathMod5.isAbsolute(rel);
 }
 var GLOB_METACHARS = /[*?{[]/;
 function compileNameFilter(filter) {
@@ -10698,11 +10843,11 @@ function formatBytes(n) {
   return `${(n / (1024 * 1024 * 1024)).toFixed(2)} GiB`;
 }
 function registerFilesystemTools(registry, opts) {
-  const rootDir = pathMod4.resolve(opts.rootDir);
+  const rootDir = pathMod5.resolve(opts.rootDir);
   const allowWriting = opts.allowWriting !== false;
   const outlineThresholdBytes = opts.outlineThresholdBytes ?? DEFAULT_OUTLINE_THRESHOLD_BYTES;
   const maxListBytes = opts.maxListBytes ?? DEFAULT_MAX_LIST_BYTES;
-  const normRoot = pathMod4.resolve(rootDir);
+  const normRoot = pathMod5.resolve(rootDir);
   const sessionApproved = /* @__PURE__ */ new Set();
   const shownSubdirMemory = /* @__PURE__ */ new Set();
   function withSubdirMemory(absPath, body) {
@@ -10735,7 +10880,7 @@ ${body}`;
       if (pathIsUnder(abs, dir)) return;
     }
     const stat2 = await safeLstat(abs);
-    const allowPrefix = stat2?.isDirectory() ? abs : pathMod4.dirname(abs);
+    const allowPrefix = stat2?.isDirectory() ? abs : pathMod5.dirname(abs);
     let pending = inflightGate.get(allowPrefix);
     if (!pending) {
       const gate = ctx?.confirmationGate ?? pauseGate;
@@ -10763,7 +10908,7 @@ ${body}`;
       throw new Error("path must be a non-empty string");
     }
     if (looksLikeAbsoluteSystemPath(raw)) {
-      const abs = pathMod4.resolve(raw);
+      const abs = pathMod5.resolve(raw);
       if (pathIsUnder(abs, normRoot)) return abs;
       await ensureOutsideSandboxAllowed(abs, intent, toolName, ctx);
       return abs;
@@ -10773,7 +10918,7 @@ ${body}`;
       normalized = normalized.slice(1);
     }
     if (normalized.length === 0) normalized = ".";
-    const resolved = pathMod4.resolve(rootDir, normalized);
+    const resolved = pathMod5.resolve(rootDir, normalized);
     if (!pathIsUnder(resolved, normRoot)) {
       throw new Error(
         `path escapes sandbox root (${normRoot}): ${raw} \u2014 use an absolute system path like /Users/foo or C:\\Users\\foo to request approved outside-sandbox access`
@@ -10835,7 +10980,8 @@ ${body}`;
       if (looksBinary(raw)) {
         return `[refused: ${rel} appears to be binary (${formatBytes(sizeBytes)}) \u2014 read_file returns text only. Use get_file_info for stat.]`;
       }
-      const text = raw.toString("utf8");
+      const { text } = decodeFileBuffer(raw);
+      ctx?.readTracker?.markRead(abs);
       let lines = text.split(/\r?\n/);
       if (lines.length > 0 && lines[lines.length - 1] === "") lines = lines.slice(0, -1);
       const totalLines = lines.length;
@@ -10973,7 +11119,7 @@ ${slice.join("\n")}`);
           lines.push(line);
           emitted++;
           if (e.isDirectory() && !skip) {
-            await walk2(pathMod4.join(dir, e.name), depth + 1);
+            await walk2(pathMod5.join(dir, e.name), depth + 1);
           }
         }
       };
@@ -11133,14 +11279,20 @@ ${slice.join("\n")}`);
     },
     fn: async (args, ctx) => {
       const abs = await safePath(args.path, "write_file", ctx, "write");
-      await fs3.mkdir(pathMod4.dirname(abs), { recursive: true });
-      await fs3.writeFile(abs, args.content, "utf8");
+      await fs3.mkdir(pathMod5.dirname(abs), { recursive: true });
+      let encoding = "utf8";
+      try {
+        encoding = decodeFileBuffer(await fs3.readFile(abs)).encoding;
+      } catch {
+      }
+      await fs3.writeFile(abs, encodeFile(args.content, encoding));
+      ctx?.readTracker?.markRead(abs);
       return `wrote ${args.content.length} chars to ${displayRel3(rootDir, abs)}`;
     }
   });
   registry.register({
     name: "edit_file",
-    description: "Apply a SEARCH/REPLACE edit to an existing file. `search` must match exactly (whitespace sensitive) \u2014 no regex. The match must be unique in the file; otherwise the edit is refused to avoid surprise rewrites.",
+    description: "Apply a SEARCH/REPLACE edit to an existing file. Call `read_file` on this path first this session \u2014 the tool refuses otherwise, since SEARCH must match on-disk bytes exactly. `search` is whitespace-sensitive plain text (no regex) and must be unique in the file; otherwise the edit is refused to avoid surprise rewrites.",
     parameters: {
       type: "object",
       properties: {
@@ -11150,11 +11302,16 @@ ${slice.join("\n")}`);
       },
       required: ["path", "search", "replace"]
     },
-    fn: async (args, ctx) => applyEdit(rootDir, await safePath(args.path, "edit_file", ctx, "write"), args)
+    fn: async (args, ctx) => applyEdit(
+      rootDir,
+      await safePath(args.path, "edit_file", ctx, "write"),
+      args,
+      ctx?.readTracker ? (abs) => ctx.readTracker.hasRead(abs) : void 0
+    )
   });
   registry.register({
     name: "multi_edit",
-    description: "Apply N SEARCH/REPLACE edits across ONE OR MORE files in one call. Edits validate across the full batch before writing. Validation failures leave all files untouched; disk write failures trigger best-effort rollback of files that may have been modified. Per-file edits run in array order, so a later edit can match text inserted by an earlier one. Same per-edit rules as edit_file: `search` is exact text (whitespace sensitive, no regex) and must be unique in its target file at the moment that edit applies. Use this for renames spanning multiple files, cross-file refactors, or any batch where you'd otherwise loop edit_file.",
+    description: "Apply N SEARCH/REPLACE edits across ONE OR MORE files in one call. Every target file must have been `read_file`'d this session \u2014 the tool refuses the whole batch otherwise. Edits validate across the full batch before writing. Validation failures leave all files untouched; disk write failures trigger best-effort rollback of files that may have been modified. Per-file edits run in array order, so a later edit can match text inserted by an earlier one. Same per-edit rules as edit_file: `search` is exact text (whitespace sensitive, no regex) and must be unique in its target file at the moment that edit applies. Use this for renames spanning multiple files, cross-file refactors, or any batch where you'd otherwise loop edit_file.",
     parameters: {
       type: "object",
       properties: {
@@ -11188,7 +11345,11 @@ ${slice.join("\n")}`);
           replace: e?.replace
         }))
       );
-      return applyMultiEdit(rootDir, resolved);
+      return applyMultiEdit(
+        rootDir,
+        resolved,
+        ctx?.readTracker ? (abs) => ctx.readTracker.hasRead(abs) : void 0
+      );
     }
   });
   registry.register({
@@ -11219,7 +11380,7 @@ ${slice.join("\n")}`);
     fn: async (args, ctx) => {
       const src = await safePath(args.source, "move_file", ctx, "write");
       const dst = await safePath(args.destination, "move_file", ctx, "write");
-      await fs3.mkdir(pathMod4.dirname(dst), { recursive: true });
+      await fs3.mkdir(pathMod5.dirname(dst), { recursive: true });
       await fs3.rename(src, dst);
       return `moved ${displayRel3(rootDir, src)} \u2192 ${displayRel3(rootDir, dst)}`;
     }
@@ -11287,7 +11448,7 @@ ${slice.join("\n")}`);
     fn: async (args, ctx) => {
       const src = await safePath(args.source, "copy_file", ctx);
       const dst = await safePath(args.destination, "copy_file", ctx, "write");
-      await fs3.mkdir(pathMod4.dirname(dst), { recursive: true });
+      await fs3.mkdir(pathMod5.dirname(dst), { recursive: true });
       await fs3.cp(src, dst, { recursive: true, force: false, errorOnExist: true });
       return `copied ${displayRel3(rootDir, src)} \u2192 ${displayRel3(rootDir, dst)}`;
     }
@@ -11992,7 +12153,7 @@ function formatSubagentResult(r) {
   });
 }
 function forkRegistryExcluding(parent, exclude) {
-  const child = new ToolRegistry();
+  const child = new ToolRegistry({ rateLimit: parent.rateLimitPolicy });
   for (const spec of parent.specs()) {
     const name = spec.function.name;
     if (exclude.has(name)) continue;
@@ -12004,7 +12165,7 @@ function forkRegistryExcluding(parent, exclude) {
   return child;
 }
 function forkRegistryWithAllowList(parent, allow, alsoExclude) {
-  const child = new ToolRegistry();
+  const child = new ToolRegistry({ rateLimit: parent.rateLimitPolicy });
   for (const spec of parent.specs()) {
     const name = spec.function.name;
     if (!allow.has(name)) continue;
@@ -12031,7 +12192,7 @@ import {
   writeFileSync,
   writeSync
 } from "fs";
-import { dirname as dirname3, isAbsolute as isAbsolute3, relative as relative6, resolve as resolve4 } from "path";
+import { dirname as dirname3, isAbsolute as isAbsolute3, relative as relative6, resolve as resolve5 } from "path";
 var BLOCK_RE = /^(\S[^\n]*)\n<{7} SEARCH\n([\s\S]*?)\n?={7}\n([\s\S]*?)\n?>{7} REPLACE/gm;
 function parseEditBlocks(text) {
   const out = [];
@@ -12049,15 +12210,15 @@ function parseEditBlocks(text) {
   return out;
 }
 function resolveEditPath(rootDir, rawPath) {
-  const absRoot = resolve4(rootDir);
+  const absRoot = resolve5(rootDir);
   if (/^[A-Za-z]:[\\/]/.test(rawPath) || looksLikeAbsoluteSystemPath2(rawPath)) {
-    return resolve4(rawPath);
+    return resolve5(rawPath);
   }
   let rooted = rawPath;
   while (rooted.startsWith("/") || rooted.startsWith("\\")) {
     rooted = rooted.slice(1);
   }
-  return resolve4(absRoot, rooted || ".");
+  return resolve5(absRoot, rooted || ".");
 }
 function looksLikeAbsoluteSystemPath2(rawPath) {
   return /^\/(?:home|Users|etc|var|opt|tmp|usr|mnt|Library|Volumes|proc|sys|dev|run|srv|media|Applications|System|root|boot|private)(?:[/\\]|$)/.test(
@@ -12069,7 +12230,7 @@ function pathIsUnder2(child, parent) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function applyEditBlock(block, rootDir) {
-  const absRoot = resolve4(rootDir);
+  const absRoot = resolve5(rootDir);
   const absTarget = resolveEditPath(rootDir, block.path);
   if (!pathIsUnder2(absTarget, absRoot)) {
     return {
@@ -12124,7 +12285,7 @@ function applyEditBlock(block, rootDir) {
         if (n <= 0) break;
         readBytes += n;
       }
-      const content = inBuf.toString("utf8", 0, readBytes);
+      const { text: content, encoding } = decodeFileBuffer(inBuf.subarray(0, readBytes));
       const le = lineEndingOf(content);
       const adaptedSearch = block.search.replace(/\r?\n/g, le);
       const adaptedReplace = block.replace.replace(/\r?\n/g, le);
@@ -12145,7 +12306,7 @@ function applyEditBlock(block, rootDir) {
         };
       }
       const replaced = `${content.slice(0, idx)}${adaptedReplace}${content.slice(idx + adaptedSearch.length)}`;
-      const outBuf = Buffer.from(replaced, "utf8");
+      const outBuf = encodeFile(replaced, encoding);
       ftruncateSync(fd, outBuf.length);
       let written = 0;
       while (written < outBuf.length) {
@@ -12169,7 +12330,7 @@ function toWholeFileEditBlock(path, content, rootDir) {
   let search = "";
   if (existsSync3(abs)) {
     try {
-      search = readFileSync3(abs, "utf8");
+      search = decodeFileBuffer(readFileSync3(abs)).text;
     } catch {
       search = "";
     }
@@ -12177,10 +12338,12 @@ function toWholeFileEditBlock(path, content, rootDir) {
   return { path, search, replace: content, offset: 0 };
 }
 function snapshotBeforeEdits(blocks, rootDir) {
+  const absRoot = resolve5(rootDir);
   const seen = /* @__PURE__ */ new Set();
   const snapshots = [];
   for (const b of blocks) {
     const abs = resolveEditPath(rootDir, b.path);
+    if (!pathIsUnder2(abs, absRoot)) continue;
     if (seen.has(abs)) continue;
     seen.add(abs);
     if (!existsSync3(abs)) {
@@ -12188,7 +12351,8 @@ function snapshotBeforeEdits(blocks, rootDir) {
       continue;
     }
     try {
-      snapshots.push({ path: b.path, prevContent: readFileSync3(abs, "utf8") });
+      const { text, encoding } = decodeFileBuffer(readFileSync3(abs));
+      snapshots.push({ path: b.path, prevContent: text, prevEncoding: encoding });
     } catch {
       snapshots.push({ path: b.path, prevContent: null });
     }
@@ -12196,7 +12360,7 @@ function snapshotBeforeEdits(blocks, rootDir) {
   return snapshots;
 }
 function restoreSnapshots(snapshots, rootDir) {
-  const absRoot = resolve4(rootDir);
+  const absRoot = resolve5(rootDir);
   return snapshots.map((snap) => {
     const abs = resolveEditPath(rootDir, snap.path);
     if (!pathIsUnder2(abs, absRoot)) {
@@ -12215,7 +12379,7 @@ function restoreSnapshots(snapshots, rootDir) {
           message: "removed (the edit had created it)"
         };
       }
-      writeFileSync(abs, snap.prevContent, "utf8");
+      writeFileSync(abs, encodeFile(snap.prevContent, snap.prevEncoding ?? "utf8"));
       return {
         path: snap.path,
         status: "applied",
@@ -12267,4 +12431,4 @@ export {
 he/he.js:
   (*! https://mths.be/he v1.2.0 by @mathias | MIT license *)
 */
-//# sourceMappingURL=chunk-JFBGSWQB.js.map
+//# sourceMappingURL=chunk-MQWO32ZD.js.map