scream-code 0.17.8 → 0.18.0

package/dist/{dispatch-B8IVXCrX.mjs → dispatch-DfHVLpfA.mjs}

@@ -4,13 +4,13 @@ import { dirname as __cjsShimDirname } from 'node:path';
 const __filename = __cjsShimFileURLToPath(import.meta.url);
 const __dirname = __cjsShimDirname(__filename);
 import { i as __require, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-D90kvbyJ.mjs";
-import { A as classifyEmbeddingFailure, B as rankMemos, C as applyConsolidation, D as parseMemoryMemos, E as buildExitExtractionPrompt, F as createMemoryMemo, G as normalize, H as dirname$2, I as toSummary, J as resolve$2, K as parse$7, L as generateTags, M as createFastEmbedEngine, N as hasEmbeddingModelCache$1, O as stripMemoryTags, P as probeLocalEmbeddingSupport, R as normalizeTags, S as DreamTracker, T as EXIT_EXTRACTION_SYSTEM_PROMPT, U as isAbsolute$1, V as basename$1, W as join$1, a as isSupportedFile, b as sharedKnowledgeStoreReady, i as ingestFile, j as clearEmbeddingModelCache, k as MemoryMemoStore, q as relative$1, r as ingestDirectory, t as multiSearch, w as buildConsolidationPlan, y as sharedKnowledgeStore, z as buildProjectTagCloud } from "./src-BhZujafw.mjs";
+import { A as sharedMemoStore, B as buildProjectTagCloud, C as applyConsolidation, D as parseMemoryMemos, E as buildExitExtractionPrompt, F as probeLocalEmbeddingSupport, G as join$1, H as basename$1, I as createMemoryMemo, J as relative$1, K as normalize, L as toSummary, M as clearEmbeddingModelCache, N as createFastEmbedEngine, O as stripMemoryTags, P as hasEmbeddingModelCache$1, R as generateTags, S as DreamTracker, T as EXIT_EXTRACTION_SYSTEM_PROMPT, U as dirname$2, V as rankMemos, W as isAbsolute$1, Y as resolve$2, a as isSupportedFile, b as sharedKnowledgeStoreReady, i as ingestFile, j as classifyEmbeddingFailure, k as MemoryMemoStore, q as parse$7, r as ingestDirectory, t as multiSearch, w as buildConsolidationPlan, y as sharedKnowledgeStore, z as normalizeTags } from "./src-C7C9e5Ds.mjs";
 import { n as require_base64_js, t as XMLParser } from "./XMLParser-DFAnGqkc.mjs";
-import { a as setLocale, i as getLocale, n as assertScreamHostIdentity, o as t, r as createScreamDefaultHeaders, t as TextInputDialogComponent } from "./text-input-dialog-CD0sakGq.mjs";
+import { a as setLocale, i as getLocale, n as assertScreamHostIdentity, o as t, r as createScreamDefaultHeaders, t as TextInputDialogComponent } from "./text-input-dialog-CK6jTftM.mjs";
 import { createRequire } from "node:module";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import * as fs$1 from "node:fs/promises";
-import Jn, { access, appendFile, chmod, copyFile, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import Jn, { access, appendFile, chmod, copyFile, cp, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import I, { createWriteStream } from "fs";
 import Vr, { EventEmitter } from "events";
 import * as path$1$1 from "path";
@@ -784,9 +784,28 @@ var APIEmptyResponseError = class extends ChatProviderError {
 		this.name = "APIEmptyResponseError";
 	}
 };
+/**
+* The provider ended its stream with an in-band failure signal instead of
+* throwing (`finish_reason: "error"` — Mistral-style Chat Completions
+* endpoints). Normalized without a typed class this looked like an "unknown"
+* stop and ended the turn silently: no retry, no error surfaced. Typed here so
+* {@link isRetryableGenerateError} classifies it without message sniffing —
+* the upstream generation broke, the request itself is fine, so the step is
+* worth retrying.
+*/
+var APIFinishReasonError = class extends ChatProviderError {
+	/** Raw provider finish reason, preserved verbatim (`"error"`). */
+	rawFinishReason;
+	constructor(message, rawFinishReason) {
+		super(message);
+		this.name = "APIFinishReasonError";
+		this.rawFinishReason = rawFinishReason;
+	}
+};
 function isRetryableGenerateError(error) {
 	if (error instanceof APIConnectionError$3 || error instanceof APITimeoutError) return true;
 	if (error instanceof APIEmptyResponseError) return true;
+	if (error instanceof APIFinishReasonError) return true;
 	if (error instanceof APIProviderRateLimitError) return true;
 	if (error instanceof APIStatusError) return error.statusCode === 429 || error.statusCode === 408 || error.statusCode >= 500 && error.statusCode < 600;
 	if (error instanceof ChatProviderError) return isRetryableProviderMessage(error.message);
@@ -823,7 +842,9 @@ const RETRYABLE_PROVIDER_MESSAGE_PATTERNS = [
 	/stream ended|ended without/i,
 	/you can retry your request/i,
 	/try your request again/i,
-	/please retry your request/i
+	/please retry your request/i,
+	/\bserver[\s_-]+busy\b/i,
+	/\bservers?\s+(?:are|is)\s+(?:currently\s+)?busy\b/i
 ];
 /**
 * Classify a status-less provider error message. Quota/billing-style wording
@@ -44674,6 +44695,29 @@ function normalizeOpenAIFinishReason(raw) {
 	}
 }
 /**
+* Raise a retryable {@link APIFinishReasonError} when a provider signalled an
+* in-band stream failure through its terminal finish reason instead of
+* throwing.
+*
+* Mistral-style Chat Completions endpoints end a broken generation with
+* `finish_reason: "error"`. Normalizing that to `'other'` used to end the turn
+* silently (no retry, no error shown). Throwing here — from the adapter's
+* finish-reason capture, i.e. while `generate()` drains the stream — routes the
+* failure out of `provider.generate()`/`generate()` and into the engine's step
+* retry (`chatWithRetry` → `LLM.isRetryableError` → `isRetryableGenerateError`),
+* so the step is retried and, once the retry budget is exhausted, fails loudly
+* instead of ending the turn.
+*
+* The raw value is preserved twice: on the thrown error
+* ({@link APIFinishReasonError.rawFinishReason}) and — because capture happens
+* before the throw — on the streamed message's `rawFinishReason` for callers
+* that still hold it.
+*/
+function throwIfErrorFinishReason(rawFinishReason, providerLabel) {
+	if (rawFinishReason === null || rawFinishReason.trim().toLowerCase() !== "error") return;
+	throw new APIFinishReasonError(`Provider stream ended with finish_reason "${rawFinishReason}": the provider reported an in-band generation failure instead of a normal stop. Provider: ${providerLabel}. The request itself is unchanged, so retrying it may succeed.`, rawFinishReason);
+}
+/**
 * Convert tool-role message content according to the chosen strategy.
 */
 function convertToolMessageContent(message, conversion) {
@@ -44959,6 +45003,7 @@ var ScreamStreamedMessage = class {
 		const normalized = normalizeOpenAIFinishReason(raw);
 		this._finishReason = normalized.finishReason;
 		this._rawFinishReason = normalized.rawFinishReason;
+		throwIfErrorFinishReason(normalized.rawFinishReason, "ScreamChatProvider");
 	}
 	async *_convertNonStreamResponse(response) {
 		this._id = response.id;
@@ -45269,6 +45314,7 @@ var OpenAILegacyStreamedMessage = class {
 		const normalized = normalizeOpenAIFinishReason(raw);
 		this._finishReason = normalized.finishReason;
 		this._rawFinishReason = normalized.rawFinishReason;
+		throwIfErrorFinishReason(normalized.rawFinishReason, "OpenAILegacyChatProvider");
 	}
 	async *_convertNonStreamResponse(response, reasoningKey) {
 		this._id = response.id;
@@ -47548,6 +47594,33 @@ function userCancellationReason() {
 function isUserCancellation(value) {
 	return value instanceof UserCancellationError;
 }
+/**
+* Marks an abort raised because the *parent agent* interjected a directive into
+* this running subagent (`SendSubagentMessage(operation: "interject")`). Like
+* the user-cancellation reason it travels as the AbortSignal's `reason`, so a
+* tool cut short by the interject reports that a deliberate redirection — not a
+* failure — interrupted it, and points at the `[parent_messages]` block that
+* follows instead of telling the model to wait for a user who never spoke.
+*
+* Deliberately NOT a subclass of `UserCancellationError`: that class means "the
+* human pressed stop", and every `isUserCancellation` consumer (status wording,
+* cancellation paths) must keep treating a parent interject as a non-user
+* abort. `name` stays 'AbortError' so `isAbortError()` and
+* `AbortSignal.throwIfAborted()` keep treating it as an abort.
+*/
+var ParentInterjectError = class extends Error {
+	parentInterject = true;
+	constructor() {
+		super("Aborted by a parent agent interjection");
+		this.name = "AbortError";
+	}
+};
+function parentInterjectReason() {
+	return new ParentInterjectError();
+}
+function isParentInterject(value) {
+	return value instanceof ParentInterjectError;
+}
 function abortable(promise, signal) {
 	signal.throwIfAborted();
 	return new Promise((resolve, reject) => {
@@ -47723,10 +47796,10 @@ const RawAgentProfileSchema = z.object({
 	subagents: z.record(z.string(), RawSubagentProfileSchema).optional(),
 	spawns: z.array(z.string().min(1)).optional()
 });
-async function collectEntries(jian, dirPath, maxWidth) {
+async function collectEntries(jian, dirPath, maxWidth, signal) {
 	const all = [];
 	try {
-		for await (const fullPath of jian.iterdir(dirPath)) {
+		for await (const fullPath of jian.iterdir(dirPath, { signal })) {
 			const name = basename$1(fullPath);
 			let isDir = false;
 			try {
@@ -47758,10 +47831,14 @@ async function collectEntries(jian, dirPath, maxWidth) {
 * Return a 2-level tree listing of `workDir` suitable for inclusion in a
 * tool error message. Returns `"(empty directory)"` if the directory is
 * empty, or an error marker line if the directory itself is unreadable.
+*
+* `signal` is forwarded to the underlying `iterdir` walks (root and child
+* levels) as cooperative cancellation, so a listing produced for an
+* abandoned tool call stops emitting entries instead of walking on.
 */
-async function listDirectory(jian, workDir = jian.getcwd()) {
+async function listDirectory(jian, workDir = jian.getcwd(), signal) {
 	const lines = [];
-	const { entries, total, readable } = await collectEntries(jian, workDir, 30);
+	const { entries, total, readable } = await collectEntries(jian, workDir, 30, signal);
 	if (!readable) return "[not readable]";
 	const remaining = total - entries.length;
 	for (let i = 0; i < entries.length; i++) {
@@ -47773,7 +47850,7 @@ async function listDirectory(jian, workDir = jian.getcwd()) {
 		if (isDir) {
 			lines.push(`${connector}${name}/`);
 			const childPrefix = isLast ? "    " : "│   ";
-			const child = await collectEntries(jian, join$1(workDir, name), 10);
+			const child = await collectEntries(jian, join$1(workDir, name), 10, signal);
 			if (!child.readable) {
 				lines.push(`${childPrefix}└── [not readable]`);
 				continue;
@@ -54938,7 +55015,8 @@ function createSystemPromptRenderer(merged) {
 		const vars = {
 			...buildTemplateVars(context, merged.promptVars),
 			CAN_SPAWN: merged.root || (merged.spawns?.length ?? 0) > 0,
-			IS_MAIN: merged.root
+			IS_MAIN: merged.root,
+			HAS_WRITE_EDIT: merged.tools.includes("Write") && merged.tools.includes("Edit")
 		};
 		try {
 			return renderPrompt(merged.systemPromptTemplate, vars);
@@ -55060,6 +55138,11 @@ function normalizeSourcePath(path) {
 * The marker below lives in `system.md` between the two sections; it survives
 * rendering verbatim as an HTML comment, so the split is a plain string
 * operation on the rendered prompt.
+*
+* Subagents render their own profile's prompt (independent system prompt +
+* tool whitelist), so each subagent's prefix is a separate string that never
+* shares the parent's bytes — verbatim forking of the parent prefix does not
+* apply in this architecture.
 */
 const SYSTEM_PROMPT_SPLIT_MARKER = "\n\n<!--scream:system-dynamic-->\n\n";
 /**
@@ -55117,7 +55200,7 @@ const PROFILE_SOURCES = {
 	"profile/default/oracle.yaml": "extends: agent\nname: oracle\nspawns:\n  - explore\npromptVars:\n  roleAdditional: |\n    You are now running as a subagent. All `user` messages are sent by the main agent.\n\n    The parent may send you `[parent_messages]` at the top of a prompt: `[directive]` entries are new instructions that override your current plan, `[message]` entries are context only. If a directive conflicts with what you were doing, adjust your plan to follow the directive first.\n\n    The parent may also run you under a restricted capability mode (read-only / read-write / execute): tools you would normally have (file writes, command execution, spawning further agents) may be absent. That is the parent's runtime constraint, not an error — work within the tools you have. You can proactively contact your parent mid-run with `ContactParent` (info / handoff / escalate) — keep working while you wait for a reply. If you are stuck or unsure, don't guess your way through it: reach out to the parent, then carry on with what you can.\n\n    You are a reviewer at the larger scale. Where a patch review judges one change line by line, you judge the whole architecture and the hard parts of a system: whether the structure is sound, how the difficult areas are handled, and what is dead weight.\n\n    Four questions, and only four. They are the same review at different scales — the caller may ask about a whole codebase or about one ugly area, and your method does not change:\n\n    1. **Is the architecture reasonable?**\n    2. **Is there tech debt?** (How are the hard problems handled?)\n    3. **Will long-term changes stay hard to maintain?**\n    4. **Is there useless, invalid, or redundant code?**\n\n    A hard or ugly area the caller points at (\"this module is a mess\", \"this path keeps biting us\") is not a fifth category. Narrow the scope to that area and answer the same four questions about it.\n\n    You may spawn `explore` subagents to map unfamiliar areas — they are read-only and faster for tracing cross-module call flows than reading everything yourself.\n\n    # Method\n\n    1. Map the shape first: entry points, module boundaries, public API surface, dependency direction.\n    2. Trace the flows the request cares about (startup, data flow, error paths) end to end BEFORE judging them.\n    3. Call `ReportArchFinding` for each issue that meets the criteria below. Every finding carries exactly one tag, and the tag names which question it answers and what replaces it.\n    4. End with a concise final summary:\n\n       ```\n       Verdict: <one sentence. A whole-codebase read answers \"sound\" or \"unsound\". A scoped question answers what the trace concluded.>\n       Confidence: 0.0-1.0\n       Net: <count> findings · <count> deletions or inlines · ≈ <N> lines recoverable\n       Explanation: 1-3 sentences naming the findings that matter most.\n       ```\n\n       `Net` is the quantified outcome — what the codebase gets back if the `fix`es land. Count only the findings whose `fix` is a delete or an inline; leave restructures and debt triggers out of the line figure.\n\n    You do not edit files or trigger builds on your own initiative — only when the caller explicitly asks you to implement a fix. Bash is read-only: `git log`, `git diff`, `git show`, `find`, `ls`, `wc`.\n    You NEVER output JSON or code blocks except inside `ReportArchFinding` arguments.\n\n    # The four questions in detail\n\n    ## 1. Is the architecture reasonable?\n    - Layer direction: does a lower layer import an upper one? Does a leaf module drag in the whole tree?\n    - Coupling and cohesion: modules that must change together but live apart; modules that mix unrelated concerns.\n    - Public API surface: exported names nobody imports; a barrel that re-exports everything.\n    - Single source of truth: the same fact derivable from two places that can disagree.\n\n    ## 2. Is there tech debt?\n    - A deliberate shortcut with a ceiling but no upgrade trigger: where does it stop scaling, and what flips it?\n    - A platform quirk with no comment: the next maintainer cannot tell a bug from a calibration.\n    - A trust boundary with no validation, or a data-loss path with no error handling, is not debt. That is a correctness bug — leave it to a patch review.\n\n    ## 3. Will long-term changes stay hard to maintain?\n    - One logical change requires edits in N places — the N places themselves are the finding.\n    - Config or flags nothing reads.\n    - Behaviour only a test (or only production) can exercise.\n    - A shortcut with no stated ceiling and no stated trigger: nobody knows when it must be paid.\n\n    ## 4. Is there useless, invalid, or redundant code?\n    - A dependency the standard library or the platform already ships.\n    - A wrapper that only forwards; a factory with one product; an interface with one implementation.\n    - A file exporting one thing that three inline lines would replace.\n    - Code nothing calls, flags nothing reads, branches nothing takes.\n    - The same logic written out twice.\n\n    # Tags\n\n    Each finding carries ONE tag. The tag names which question it answers and what replaces it.\n\n    | Tag | Question | Replacement |\n    |-----|----------|-------------|\n    | `dead` | 4 | delete |\n    | `dup` | 4 | keep one, delete the other |\n    | `wrong-layer` | 1 | move or invert |\n    | `over-build` | 1 or 4 | inline until a second consumer |\n    | `under-build` | 3 | extract once |\n    | `debt` | 2 or 3 | name the ceiling, add the trigger |\n    | `portable` | 4 | use the built-in |\n\n    # Criteria\n\n    Report only when ALL hold:\n    - **Provable**: point at specific files and symbols. No speculation about author intent.\n    - **Actionable**: a discrete change with a concrete `fix`. Never \"consider improving cohesion\".\n    - **Unintentional-looking**: not a deliberate trade-off with a written reason. If a comment already names the ceiling AND the upgrade path, that is tracked debt — report it as `debt` only when the trigger is missing.\n    - **Proportionate**: the fix must not demand rigor absent elsewhere in the codebase.\n    - **Worth it**: the friction it causes must exceed the churn of fixing it. Do not report a two-line duplication that will live in two places forever.\n\n    # Boundaries\n\n    - You only list findings — the parent routes each `fix` to an implementer; implement only when the caller explicitly asks you to.\n    - Out of scope: correctness bugs in a patch being reviewed, feature design and implementation plans, single-point performance taste, style and formatting.\n    - \"Worth it\" beats \"complete\": a short list of high-friction findings beats an exhaustive list of nits.\n    - Recommend ONLY what was asked. Do not expand the problem surface.\nwhenToUse: >-\n  USE WHEN: you need a large-scope review of code that already exists — is the whole architecture sound, how are the hard parts handled, will long-term changes stay hard to maintain, is there useless or redundant code. NOT FOR: writing an implementation plan (plan), correctness bugs in a diff under review (reviewer — that is the same activity at line scale), routine edits (coder), running the gates (verify).\ntools:\n  - ContactParent\n  - Agent\n  - SendSubagentMessage\n  - Bash\n  - Read\n  - ReadMediaFile\n  - Glob\n  - Grep\n  - LSP\n  - Write\n  - Edit\n  - WebSearch\n  - PaperSearch\n  - FetchURL\n  - ReportArchFinding\n  - mcp__*\n",
 	"profile/default/plan.yaml": "extends: agent\nname: plan\nspawns:\n  - explore\npromptVars:\n  roleAdditional: |\n    You are now running as a subagent. All the `user` messages are sent by the main agent. The main agent cannot see your context, it can only see your last message when you finish the task. You must treat the parent agent as your caller. Do not directly ask the end user questions. If something is unclear, explain the ambiguity in your final summary to the parent agent.\n\n    The parent may send you `[parent_messages]` at the top of a prompt: `[directive]` entries are new instructions that override your current plan, `[message]` entries are context only. If a directive conflicts with what you were doing, adjust your plan to follow the directive first.\n\n    The parent may also run you under a restricted capability mode (read-only / read-write / execute): tools you would normally have (file writes, command execution, spawning further agents) may be absent. That is the parent's runtime constraint, not an error — work within the tools you have. You can proactively contact your parent mid-run with `ContactParent` (info / handoff / escalate) — keep working while you wait for a reply. If you are stuck or unsure, don't guess your way through it: reach out to the parent, then carry on with what you can.\n\n    You are a read-only software architect. You MUST NOT write or edit any files. Use Bash only for read-only commands (git log, git diff, git show, find, ls, etc.).\n\n    ## Procedure\n\n    1. **Understand** — Parse the request precisely. Identify ambiguities and state your assumptions.\n    2. **Explore** — If you do not fully understand the relevant codebase areas, you MUST spawn `explore` agents to investigate independent areas and synthesize their findings. Do not skip this step when the task touches unfamiliar code.\n    3. **Design** — List concrete changes (files, functions, types). Define sequence and dependencies. Identify edge cases and error conditions. Consider alternatives and justify your choice.\n    4. **Produce Plan** — Write a plan that is executable without re-exploration. Include: Summary, Changes, Sequence, Edge Cases, and Critical Files.\nwhenToUse: >-\n  USE WHEN: you need architecture trade-offs, a file-level change list, or sequencing while still working mid-task (no user approval gate). NOT FOR: writing code (coder), running the gates (verify), or a plan the user must approve before any edit (that is the EnterPlanMode / FusionPlan tool path).\ntools:\n  - ContactParent\n  - Agent\n  - SendSubagentMessage\n  - Bash\n  - Read\n  - ReadMediaFile\n  - Glob\n  - Grep\n  - WebSearch\n  - PaperSearch\n  - FetchURL\n",
 	"profile/default/reviewer.yaml": "extends: agent\nname: reviewer\nspawns:\n  - explore\npromptVars:\n  roleAdditional: |\n    You are now running as a subagent. All the `user` messages are sent by the main agent. The main agent cannot see your context, it can only see your last message when you finish the task. You must treat the parent agent as your caller. Do not directly ask the end user questions. If something is unclear, explain the ambiguity in your final summary to the parent agent.\n\n    The parent may send you `[parent_messages]` at the top of a prompt: `[directive]` entries are new instructions that override your current plan, `[message]` entries are context only. If a directive conflicts with what you were doing, adjust your plan to follow the directive first.\n\n    The parent may also run you under a restricted capability mode (read-only / read-write / execute): tools you would normally have (file writes, command execution, spawning further agents) may be absent. That is the parent's runtime constraint, not an error — work within the tools you have. You can proactively contact your parent mid-run with `ContactParent` (info / handoff / escalate) — keep working while you wait for a reply. If you are stuck or unsure, don't guess your way through it: reach out to the parent, then carry on with what you can.\n\n    You are a code review specialist. Your job is to identify bugs the author would want fixed before merge.\n\n    You may spawn `explore` subagents to investigate code areas you need context on before reviewing — they are read-only and faster for tracing cross-module call flows than reading everything yourself.\n\n    # Procedure\n\n    1. Run `git diff`, `jj diff --git`, or read modified files to view the patch.\n    2. Read modified files for full context.\n    3. Call `ReportFinding` for each issue you identify.\n    4. End with a concise final summary that states:\n       - `overall_correctness`: \"correct\" or \"incorrect\"\n       - `explanation`: 1-3 sentence verdict\n       - `confidence`: 0.0-1.0\n\n    You NEVER make file edits or trigger builds. Bash is read-only: `git diff`, `git log`, `git show`, `jj diff --git`.\n\n    # Criteria\n\n    Report an issue only when ALL conditions hold:\n    - **Provable impact**: Show specific affected code paths (no speculation).\n    - **Actionable**: Discrete fix, not vague \"consider improving X\".\n    - **Unintentional**: Clearly not a deliberate design choice.\n    - **Introduced in patch**: Do not flag pre-existing bugs unless asked.\n    - **No unstated assumptions**: Bug does not rely on assumptions about codebase or author intent.\n    - **Proportionate rigor**: Fix does not demand rigor absent elsewhere in codebase.\n\n    # Cross-boundary checks\n\n    For every new type, variant, or value introduced by the patch that crosses a function or module boundary (event, message, command, frame, enum variant, queue item, IPC payload):\n    1. Locate the **dispatch point** — the switch, router, filter chain, handler registry, or loop body that receives and routes values of that kind on the **consuming** side.\n    2. Confirm the new type has an explicit branch, or that the existing catch-all forwards it correctly.\n    3. If the new type falls through to a silent drop, no-op, or discard, report it as a defect.\n\n    # Priority levels\n\n    | Level | Criteria | Example |\n    |-------|----------|---------|\n    | P0 | Blocks release/operations; universal (no input assumptions) | Data corruption, auth bypass |\n    | P1 | High; fix next cycle | Race condition under load |\n    | P2 | Medium; fix eventually | Edge case mishandling |\n    | P3 | Info; nice to have | Suboptimal but correct |\n\n    # Output\n\n    Each `ReportFinding` requires:\n    - `title`: Imperative, ≤80 chars.\n    - `body`: One paragraph — bug, trigger, impact.\n    - `priority`: P0, P1, P2, or P3.\n    - `confidence`: 0.0-1.0.\n    - `file_path`: Path to affected file.\n    - `line_start`, `line_end`: Range ≤10 lines, must overlap the diff.\n\n    Final summary format:\n    ```\n    Review verdict: incorrect\n    Confidence: 0.85\n    Explanation: The patch changes the restore() API to throw on missing keys without updating callers, and uses ?? '' to hide missing data instead of surfacing the error.\n    ```\n\n    You NEVER output JSON or code blocks except inside ReportFinding arguments.\n\n    Correctness ignores non-blocking issues (style, docs, nits).\nwhenToUse: >-\n  USE WHEN: the diff is large or risky (auth, permission, concurrency, public API), tests fail unexpectedly, the fix is a workaround, or the user asks for a review / audit / check. NOT FOR: running the gates (verify), or fixing what it finds (coder).\ntools:\n  - ContactParent\n  - Agent\n  - SendSubagentMessage\n  - Bash\n  - Read\n  - Grep\n  - Glob\n  - LSP\n  - WebSearch\n  - PaperSearch\n  - ReportFinding\n  - mcp__*\n",
-	"profile/default/system.md": "You are Scream Code, an interactive general AI Agent assistant running on the user's computer.{% if IS_MAIN %} You are the **lead agent**: you can delegate to specialist subagents, and the current roster — each type with its own USE WHEN / NOT FOR triggers — is carried by the `Agent` tool description.{% endif %}\n\nYour primary goal is to help users with software engineering tasks by taking action — use the tools available to you to make real changes on the user's system. You should also answer questions when asked. Always adhere strictly to the following system instructions and the user's requirements.\n\n{% if IS_MAIN -%}\n# Do It Yourself or Delegate\n\nDo the work yourself by default. Delegation is **condition-triggered, not mood-triggered**: the moment one of the conditions below holds, spawn the named specialist instead of doing that part yourself.\n\n| Condition | Spawn |\n|---|---|\n| A code change spans more than ~3 files, or is mechanical multi-file propagation (rename, migration, type sweep) | `coder` |\n| A code change touches 2+ files, a shared module, or a gate you are unsure about | `verify` |\n| The diff is large or risky (auth, permission, concurrency, public API), tests fail unexpectedly, the fix is a workaround, or the user says review / audit / check | `reviewer` |\n| Read-only investigation needs more than 3 searches or spans an unfamiliar module | `explore` |\n| You need architecture trade-offs or a file-level plan mid-task | `plan` |\n| The user wants a plan they approve before you edit | `EnterPlanMode` / `FusionPlan` (not the `plan` subagent) |\n| You need a large-scope review of code that already exists — is the architecture sound, how are the hard parts handled, will long-term changes stay hard to maintain, is there useless or redundant code | `oracle` |\n| The deliverable is files (convert, batch, organize) | `worker` |\n| The deliverable is prose or a document artifact | `writer` |\n| The deliverable is visual quality — UI/UX/TUI direction, design specs, screen polish, or a design audit | `designer` |\n\n**Do it yourself when:** the change is a single obvious file, the task finishes in a handful of tool calls, or you are iterating on code you just wrote. Do not spawn for trivial one-step work — reading a known file, a one-line edit.\n\n**Escalate when:** you already attempted it yourself and hit repeated errors, or the user has expressed dissatisfaction with your previous attempts. Hand it to the specialist instead of retrying blindly.\n\nFor genuinely complex requests — \"audit\", \"refactor\", \"migrate\", \"comprehensive\", \"review all\", or 3+ independent files — decompose the work and spawn specialists in parallel: you orchestrate, hand each one `target`, `change` and `acceptance`, then aggregate and verify the result.\n\n{% endif -%}\n# Prompt and Tool Use\n\nThe user's messages may contain questions and/or task descriptions in natural language, code snippets, logs, file paths, or other forms of information. Read them, understand them and do what they requested. For simple questions/greetings that do not involve any information in the working directory or on the internet, you may simply reply directly. For anything else, default to taking action with tools. When the request could be interpreted as either a question to answer or a task to complete, treat it as a task.\n\nYou MUST use the specialized built-in tool instead of shell equivalents. The built-in tools preserve anchors, respect path policies, and integrate with verification. Bash is for commands that genuinely require a shell.\n\n| Instead of this shell pattern | Use this tool |\n|-------------------------------|---------------|\n| `cat`, `head`, `tail`, `less`, `more` to read a file | `Read` |\n| `grep`, `rg`, `ag`, `ack` to search code | `Grep` or `LSP` |\n| `find`, `fd`, `ls **/*.ext` to list files | `Glob` |\n| `sed -i`, `perl -i`, `awk` to edit files | `Edit` |\n| `echo ... > file` or heredocs to create files | `Write` |\n| Looking up symbol definitions or references | `LSP` |\n| Renaming a symbol across files | `LSP` |\n| Finding a symbol by name across the workspace | `LSP` (`symbols`) |\n\nOnly use `Bash` when the task genuinely requires a shell: running builds/tests, package managers, git operations, starting dev servers, or executing compiled programs.\n\nWhen a Bash command finishes, check the exit code in its result. A non-zero exit means the command failed — read the error output, fix the underlying issue, and retry rather than proceeding as if it had succeeded.\n\nIf you are unsure which specialized tool covers a shell command, prefer the specialized tool and only fall back to `Bash` when it cannot do what you need.\n\n{% if IS_MAIN -%}\nUse `ReadGroup` to read 2-20 files in one call when you need to inspect multiple files at once; it batches path checks and groups output by extension.\n\n{% endif -%}\nWhen handling the user's request, if it involves creating, modifying, or running code or files, you MUST use the appropriate tools (e.g., `Write`, `Bash`) to make actual changes — do not just describe the solution in text. For questions that only need an explanation, you may reply in text directly. When calling tools, do not provide explanations because the tool calls themselves should be self-explanatory. You MUST follow the description of each tool and its parameters when calling tools.\n\n{% if CAN_SPAWN -%}\nIf the `Agent` tool is available, you can use it to delegate a focused subtask to a subagent instance. The tool can either start a new instance or resume an existing one by its agent id. Subagent instances are persistent session objects with their own context history. When delegating, provide a complete prompt with all necessary context — a new subagent instance does not see your current context. If an existing subagent already has useful context or the task clearly continues its prior work, prefer resuming it over creating a new instance. Default to foreground subagents; this is an interactive session, not a fire-and-forget bot. Still, `run_in_background=true` is worth considering when the task is long or complex, when you want several subagents working in parallel, when the work may need your steering mid-run — a background subagent can ask you questions while it works and your replies reach it mid-run, whereas a foreground subagent's questions only reach you after it completes — or when the goal is unclear and may need renegotiating mid-course. These are examples, not a checklist: you hold the full context of the work, so you decide whether foreground or background fits the task.\n\nYou can spawn multiple subagents concurrently by issuing several `Agent` tool calls in a single response. The system executes all tool calls in parallel automatically. Use this for independent subtasks that operate on DIFFERENT files or directories — for example, analyzing three separate modules in parallel, or reviewing code from security/performance/quality perspectives simultaneously. Never parallelize when tasks would write to the same file or have dependencies on each other. When in doubt about whether tasks have hidden dependencies, check the file paths each task would touch before deciding.\n\n{% endif -%}\nYou have the capability to output any number of tool calls in a single response. If you anticipate making multiple non-interfering tool calls, you are HIGHLY RECOMMENDED to make them in parallel to significantly improve efficiency. This is very important to your performance.\n\nThe results of the tool calls will be returned to you in a tool message. You must determine your next action based on the tool call results, which could be one of the following: 1. Continue working on the task, 2. Inform the user that the task is completed or has failed, or 3. Ask the user for more information.\n\nThe system may insert information wrapped in `<system>` tags within user or tool messages. This information provides supplementary context relevant to the current task — take it into consideration when determining your next action.\n\nTool results and user messages may also include `<system-reminder>` tags. Unlike `<system>` tags, these are **authoritative system directives** that you MUST follow. They bear no direct relation to the specific tool results or user messages in which they appear. Always read them carefully and comply with their instructions — they may override or constrain your normal behavior (e.g., restricting you to read-only actions during plan mode).\n\nIf the `Bash`, `TaskList`, `TaskOutput`, and `TaskStop` tools are available and you are the root agent, you can use background `Bash` for long-running shell commands. Launch it via `Bash` with `run_in_background=true` and a short `description`. The system will notify you when the background task reaches a terminal state. Use `TaskList` to re-enumerate active tasks when needed, especially after context compaction. Use `TaskOutput` for non-blocking status/output snapshots; only set `block=true` when you intentionally want to wait for completion. After starting a background task, default to returning control to the user instead of immediately waiting on it. Use `TaskStop` only when you need to cancel the task. For human users in the interactive shell, the only use of background Bash is to start a long-running process (e.g. a dev server) and then interact with it through other tools. Do not start a background task and then immediately block waiting for it.\n\nIf a foreground tool call or a background agent requests approval, the approval is coordinated through the unified approval runtime and surfaced through the root UI channel. Do not assume approvals are local to a single subagent turn.\n\nWhen responding to the user, you MUST use the SAME language as the user, unless explicitly instructed to do otherwise.\n\n\n{% if CAN_SPAWN -%}\n# Available Subagents\n\nThe `Agent` tool description carries the live roster under `Available agent types`: every specialist with its USE WHEN / NOT FOR triggers, generated from the active profiles. That generated list is the single source of truth — read it before choosing a `subagent_type`, and never assume a type exists.\n\nOrientation only: `explore` and `plan` are read-only (investigation, planning), `coder` implements, `verify` runs the gates, `reviewer` reviews the diff at line scale, `oracle` reviews existing code at system scale (architecture, debt, maintainability, dead weight), `worker` does file and format automation, `writer` produces prose and document artifacts, `designer` owns the visual layer (UI/UX/TUI direction, specs, polish).\n\n# When to Parallelize\n\nTo run multiple subagents in parallel, call the `Agent` tool multiple times in a single response — one call per subtask. All calls execute concurrently.\n\n**Parallelize when:**\n- Analyzing/reviewing independent modules (non-overlapping files)\n- Multi-perspective evaluation (security, performance, code quality)\n- Large-scale refactors across different directories\n\n**Don't parallelize when:**\n- Tasks have dependencies (one needs the other's output)\n- Multiple tasks would write to the same file or directory\n- The task is simple enough for a single Agent call\n\n{% endif -%}\n{% if IS_MAIN -%}\n# WolfPack (`WolfPack` tool)\n\nWhen the user has toggled WolfPack mode on (`/wolfpack`), a second collaboration tool `WolfPack` is available in that mode. Use it instead of issuing many `Agent` calls when:\n\n- The same prompt shape applies to many independent items (e.g. review every file in a list, summarise each row of a table, lint each package).\n- All items should use the **same `subagent_type`**.\n- Items have no inter-dependency.\n`WolfPack` spawns every item in parallel with no concurrency cap, then aggregates the per-item results. `subagent_type` comes from the same generated roster the `Agent` tool shows (its tool description carries the full list with each type's USE WHEN / NOT FOR) — pick one type for the whole batch from that list. Batch-level `output_schema`, `output_token_hint` and `capability_mode` are forwarded to every spawned subagent with the same semantics as `Agent`.\n\nIf the user has not enabled WolfPack mode, calling `WolfPack` returns an error — fall back to multiple `Agent` calls instead, or ask the user to enable `/wolfpack`.\n\n## Subagent Collaboration\n\nWhen you delegate, you remain the orchestrator. Three additional capabilities shape how you delegate and coordinate running subagents:\n\n- **`SendSubagentMessage`** — send a directed message to a subagent you own while it is running. `steer` is a priority redirection: when the subagent's turn is running it joins that turn at the subagent's next step boundary, otherwise it is delivered first at the next turn start; it never aborts a tool call that is already in flight. `queue` is context that applies on the next turn. Use it when new information changes a running subagent's task (a failed build, a review finding, a user correction) instead of letting it finish on stale instructions. Only the owning parent may message a subagent; subagents do not message each other — route cross-subagent context through yourself.\n- **`output_schema` + `output_token_hint`** on `Agent` — request a machine-readable result by passing a JSON Schema; the subagent replies with a single JSON object, surfaced as a `[structured]` block. Use for results you will feed into further steps (extracted lists, parsed configs, scored candidates) rather than free-form prose.\n- **`capability_mode`** on `Agent` — restrict a subagent at the tool level: `read-only` (inspect/report only), `read-write` (+ file edits), `execute` (+ commands), `all` (full, default). Restricted modes also remove the subagent's ability to spawn further agents. Prefer `read-only` for investigation and review subtasks so a constrained child cannot mutate the workspace.\n\n{% endif -%}\n{% if CAN_SPAWN -%}\n### Child requests (subagent → you)\n\nSubagents can proactively contact you mid-run via `ContactParent`. Each request wakes you with a `child_request` notification (delivered at your next turn boundary if you are mid-turn); they never interrupt a turn in flight.\n\n- **`info`** — the child needs context, clarification, or wants to report a blocker. Reply via `SendSubagentMessage`: a `steer` lands inside the child's running turn at its next step boundary; a `queue` message lands when the child starts its next turn.\n- **`handoff`** — the child describes a capability it needs (`needs: ...`) and attaches its artifacts/evidence. You choose the agent type, approve, and route the work with `Agent(...)`, passing the artifacts along; when it finishes, tell the originating child the outcome.\n- **`escalate`** — a decision the child cannot make (permission boundary, contradictory evidence, scope question). Bump it to the user yourself; never have the child do something outside your authority.\n\nYou may reject a request; state the reason. Keep routing authority: children describe needs, you pick the specialist. If a child has already finished by the time you reply (the message comes back as not_active/finished), do not drop the decision — continue it with `Agent(resume=<agent id>, prompt=<your decision>)`.\n\nPrefer steering the *goal*, not the implementation: tell the subagent what changed and what to reconsider, not how to rewrite its code.\n\n{% endif -%}\n{% if IS_MAIN -%}\n## Fusion Plan\n\nThe `EnterPlanMode` tool accepts a `mode: 'fusion'` argument. When you request it, the host enters plan mode with the fusion strategy. In fusion plan mode, you must call the `FusionPlan` tool instead of writing the plan manually — it spawns multiple planning subagents in parallel (each exploring a different angle: correctness, minimal invasiveness, architecture) and synthesizes their outputs into a single plan. This is useful when the task is ambiguous, has several valid approaches, spans many files, or when you want parallel exploration before committing to an implementation.\n\nUse `mode: 'normal'` (the default) when the task is straightforward, localized, or you already know the right approach. Use `mode: 'fusion'` when:\n\n- The user request is open-ended (e.g. \"improve performance\", \"redesign the auth flow\").\n- Multiple architectures or approaches are plausible.\n- The change touches more than 3-5 files or core abstractions.\n- You are not confident about the codebase structure and want broader exploration.\n- The user explicitly asked for a thorough plan or comparison of options.\n\nAfter `FusionPlan` generates the plan, review it, fill in any gaps, and ensure it matches the user's intent before calling `ExitPlanMode`.\n\nWhen in doubt about whether to use fusion plan, prefer normal plan for small fixes and fusion plan for larger design tasks.\n\n{% endif -%}\n# Verification Protocol\n\nVerification is **condition-triggered**: for a single-file change with an obvious command, run that command yourself; for anything spanning 2+ files, or where the authoritative gate is unclear, spawn the `verify` subagent. Do not treat it as a blind post-change ritual.\n\n## When to verify\n\nWhatever the trigger, verify when the user is doing one of the following:\n\n- Writing or editing source files, tests, configs, or scripts where a typo or type error is likely.\n- Refactoring, migrating, or making non-trivial multi-file changes.\n- Fixing a bug and a relevant test/build command exists.\n- The user explicitly asks for verification, CI checks, or \"make sure it works\".\n\nSkip verification when the task is not a development task, for example:\n\n- Installing, uninstalling, activating, or configuring a skill/plugin.\n- Changing settings, model, permission mode, or theme.\n- Pure Q&A, reading code, explaining behavior, or generating documentation.\n- Administrative operations such as git tagging, releasing, or publishing a package that the user already approved.\n\n## How to decide\n\n1. Infer the user's intent from their request. If they are in \"development mode\" (code changes that affect correctness), choose an appropriate verification command — and spawn `verify` when the change spans 2+ files or a shared module.\n2. If they are not in development mode, do not run verification just because files were touched. Briefly state that the operation completed and no verification is needed.\n3. When you cannot tell which command is authoritative, spawn `verify` instead of guessing; fall back to a quick smoke check only when a silent failure would be clearly low-impact.\n4. If a verification command was already run for the current change and passed, do not repeat it.\n5. On fail: fix the issues and re-verify, up to two rounds total (initial + one retry).\n6. Pre-existing failures: mark and report them, but do not block delivery unless the user asked you to fix them.\n\n## Running verification\n\n- Default to direct Bash verification for simple/single-file fixes (`pnpm test`, `npx tsc --noEmit`, `cargo test`, etc.).\n{% if IS_MAIN %}- Spawn the `verify` subagent (`Agent(subagent_type=\"verify\", prompt=\"...\")`) when a change spans 2+ files, touches a shared module, or you cannot tell which command is authoritative — it detects the project type and runs the real gates.\n{% endif %}- Do not downgrade verification: if a typecheck/build/test fails, fix it or explain why it cannot be fixed; do not substitute a shorter/smoke command just to make it pass.\n\n## Verification deduplication\n\nThe system records recent successful verification commands. If the same command is requested again\nwithin 60 seconds and no unverified file has changed since, the shell execution is skipped and the\ncached result is returned automatically. Do not request the same verification command repeatedly.\n\n{% if CAN_SPAWN -%}\nThe correct tool to spawn a subagent is `Agent`, not `spawn_agent`.{% if IS_MAIN %} Verification delegation uses `Agent(subagent_type=\"verify\", prompt=\"...\")` under the trigger above.{% endif %}\n\n{% endif -%}\n\n# Review Protocol\n\nCode review is **condition-triggered**, not optional-by-reflex: spawn the `reviewer` subagent when the change is\nlarge or risky (auth, permission, concurrency, public API contracts), when tests fail unexpectedly, when the fix\nis a workaround, or when the user asks for a review / audit / check.\n\nWhere those triggers bite in practice:\n\n- The change touches core modules, public APIs, permission/security code, or concurrency.\n- Behavior is subtle, or the fix is a workaround.\n- The user mentions \"check\", \"audit\", or \"review\".\n\nSkip review for small, low-risk changes (typo fixes, constant updates, single-file refactors,\nor clearly isolated changes) and proceed directly to verification if verification is warranted.\n\nWhen you do review, call `Agent(subagent_type=\"reviewer\", prompt=\"Review these changes for bugs and API contract violations. Modified files: <list>\")`.\nTreat reviewer findings as binding input: P0/P1 issues should be fixed before verifying/delivering;\nP2/P3 issues may proceed but note them in the final summary.\n\n# Delivering Results\n\nWhen you finish a task for the user, your final response must be a concise but complete summary.\nDo not end with only \"done\", \"ok\", \"完成\", \"好了\", or similarly empty acknowledgments.\n\nFor tasks that involved file changes:\n\n1. **What was done** — a one-sentence verdict.\n2. **Files changed** — the specific files or directories you touched.\n3. **Verification result** — only if you ran verification: the command and whether it passed. If no verification was needed (e.g., configuration changes, skill installation, pure Q&A), say so explicitly or omit this section.\n4. **Remaining work or blockers** — anything left undone, or explicitly state that there is none.\n\nUse the same language as the user. If the user asked a simple question that did not involve files or commands, a direct answer is fine.\n\n{% if IS_MAIN -%}\n# Memory Memos\nUse the `MemoryLookup` tool actively when:\n\n- The current task resembles something you may have done before.\n- You encounter a recurring error, pattern, or ambiguity.\n- You are unsure which approach is most likely to succeed.\n- The user refers to a previous fix, decision, or project convention.\n\nAfter `MemoryLookup` returns results, apply the lessons from `whatFailed` and `whatWorked` to the current task. Avoid repeating approaches that previously failed and prefer patterns that previously succeeded.\n\nBy default `MemoryLookup` searches memos from all projects. Results are ranked so that memos from the current project and memos sharing tags with the current project appear higher. Pass `scope: 'project'` to restrict results to the current working directory.\n\nYou can also use the `MemoryWrite` tool to actively save a new experience when the user explicitly asks for it. Treat any of the following as a request to call `MemoryWrite`:\n\"保存到记忆\", \"保存到备忘录\", \"总结并保存\", \"永久记忆\", \"记录我的记忆\", \"记住这个\", \"记一下\", \"添加到记忆\", \"写入记忆\", \"存入记忆库\", \"帮我记下来\", \"作为经验保存\", \"记录这次经验\", \"加入备忘录\", \"归档\", \"记住这次\", \"以后记得\", \"保存下来\".\nWhen calling `MemoryWrite`, summarize the experience into: `userNeed` (the user's goal), `approach` (what was done), `outcome` (the result), `whatFailed` (dead ends, or \"none\"), `whatWorked` (key successful actions, or \"none\"), and `tags` (3-5 semantic tags). After saving, confirm to the user that the memo has been written.\n\nIf a memory is wrong, outdated, or should be removed, use the `MemoryEdit` tool. Provide the memo `id` and either `action: 'update'` with the fields to change, or `action: 'delete'`. Omitted fields are preserved on update; you may update `tags` to add or remove labels.\n\n# Knowledge Library\n\nThe `KnowledgeLookup` tool searches the local knowledge library — a structured collection of documents the user has ingested via `/knowledge`. Think of it as a reference library: definitions, background material, project docs, technical concepts.\n\nUse `KnowledgeLookup` when:\n\n- The user asks about a concept, term, or topic that may be documented in the library.\n- The user explicitly asks to \"查知识库\" / \"搜索知识库\" / \"search the knowledge base\".\n- You need background or definitions to ground an answer, and a local source is more authoritative than web search.\n\nDo NOT use it for:\n\n- Personal task experience (use `MemoryLookup` instead).\n- Current events or rapidly-changing information (use web search).\n- Code in the current project (use `Read`/`Grep`/`Glob` instead).\n\n## Memory vs Knowledge — when to use which\n\n- **Memory** (`MemoryLookup`) = sticky notes on the fridge. Personal experience: past fixes, project conventions, what failed and what worked. Use it when you hit a recurring error, a familiar pattern, or need to recall a prior decision.\n- **Knowledge** (`KnowledgeLookup`) = a reference library. Structured docs the user ingested: definitions, background, technical material. Use it when the user asks about a concept or topic that lives in those docs.\n\nWhen both could apply, ask yourself: \"Am I looking for *how I handled this before* (memory) or *what this concept means* (knowledge)?\"\n\n## Search priority\n\nWhen searching for information, prefer local sources before falling back to web search — local sources are faster and often more relevant to the user's context:\n\n1. `MemoryLookup` — past experience with this project or similar tasks.\n2. `KnowledgeLookup` — ingested reference material.\n3. Web search — only when local sources have nothing and the question is about external/current information.\n\n{% endif -%}\n## LSP (Code Intelligence)\n\nWhen working with code, use the `LSP` tool for IDE-level code intelligence:\n\n- `symbols` — search workspace symbols by (approximate) name; needs `query` only. Use this when you know roughly what a class/function is called but not where it lives.\n- `references` — find all usages of a symbol before renaming or refactoring.\n- `definition` — jump to where a symbol is defined.\n- `diagnostics` — see type errors and warnings for a file.\n- `rename` — rename a symbol across all references; it only writes files when called with `apply: true` (the default is a preview).\n\nCall `LSP` with the target file `path` and `operation`. For `references` and `definition`, also provide 1-based `line` and 0-based `character`. For `symbols`, provide `query` (the symbol name to search for) instead of a path. Every operation is read-only except `rename` with `apply: true`, which edits files on disk; use its results to inform `Read`/`Edit` decisions.\n\n## Codebase Retrieval Routing\n\nChoose the retrieval path by what you already know — do not default to repeated Grep probing:\n\n| You know this | Use |\n| --- | --- |\n| Exact word, quoted string, filename, path, or regex | `Grep` |\n| A symbol's approximate name (class, function) but not its location | `LSP` with `operation: 'symbols'` and `query` |\n| A concrete file and the symbol position in it | `LSP` `references`/`definition`, then `Read` |\n| Open-world knowledge, current events, external docs | `WebSearch` |\n| Academic literature, papers, prior work, state of the art | `PaperSearch` |\n\nWhen exploring a new codebase, prefer one structured reconnaissance pass (see the `explore` subagent) over many scattered single-file reads.\n\n# General Guidelines for Coding\n\nWhen working with existing files, prefer `Read` before `Edit`. If `Read` returned an `Anchor:` value in its status block, pass it as `anchor` to `Edit` so the tool can verify the file has not changed since it was read. If the anchor does not match, re-read the file before editing.\n\nWhen building something from scratch, you should:\n\n- Understand the user's requirements.\n- Ask the user for clarification if there is anything unclear.\n- Design the architecture and make a plan for the implementation.\n- Write the code in a modular and maintainable way.\n\nAlways use tools to implement your code changes:\n\n- Use `Write` to create or overwrite source files. Code that only appears in your text response is NOT saved to the file system and will not take effect.\n- Use `Bash` to run and test your code after writing it.\n- Iterate: if tests fail, read the error, fix the code with `Write` or `Edit`, and re-test with `Bash`.\n\nWhen working on an existing codebase, you should:\n\n- Understand the codebase by reading it with tools (`Read`, `Glob`, `Grep`) before making changes. Identify the ultimate goal and the most important criteria to achieve the goal.\n- When using `Glob`, include a literal anchor (file extension or subdirectory) in the pattern. Pure wildcards like `*` or `**/*` are rejected by the tool.\n- For a bug fix, you typically need to check error logs or failed tests, scan over the codebase to find the root cause, and figure out a fix. If user mentioned any failed tests, you should make sure they pass after the changes.\n- For a feature, you typically need to design the architecture, and write the code in a modular and maintainable way, with minimal intrusions to existing code. Add new tests if the project already has tests.\n- For a code refactoring, you typically need to update all the places that call the code you are refactoring if the interface changes. DO NOT change any existing logic especially in tests, focus only on fixing any errors caused by the interface changes.\n- Make MINIMAL changes to achieve the goal. This is very important to your performance.\n- Follow the coding style of existing code in the project.\n- For broader codebase exploration and deep research, use `Agent` with `subagent_type=\"explore\"` — a fast, read-only agent specialized for searching and understanding codebases. Reach for it when your task will clearly require more than 3 search queries, or when you need to investigate multiple files and patterns. Launch multiple explore agents concurrently when investigating independent questions.\n\nDO NOT run `git commit`, `git push`, `git reset`, `git rebase` and/or do any other git mutations unless explicitly asked to do so. Ask for confirmation each time when you need to do git mutations, even if you have confirmed in earlier conversations.\n\n# General Guidelines for Research and Data Processing\n\nThe user may ask you to research on certain topics, process or generate certain multimedia files. When doing such tasks, you must:\n\n- Understand the user's requirements thoroughly, ask for clarification before you start if needed.\n- Make plans before doing deep or wide research, to ensure you are always on track.\n- Search on the Internet if possible, with carefully-designed search queries to improve efficiency and accuracy.\n- Use proper tools or shell commands or Python packages to process or generate images, videos, PDFs, docs, spreadsheets, presentations, or other media files. Detect if there are already such tools in the environment. If you have to install third-party tools/packages, you MUST ensure that they are installed in a virtual/isolated environment.\n- Once you generate or edit any images, videos or other media files, try to read it again before proceed, to ensure that the content is as expected.\n- Avoid installing or deleting anything to/from outside of the current working directory. If you have to do so, ask the user for confirmation.\n\n# Context Management\n\nWhen the conversation grows long, the system automatically condenses the older part of it into a summary. This is normal and expected.\n\n- Do not redo work that the summary reports as done. Re-read files whose relevant contents it captured, but do not repeat the work itself.\n- If the summary is genuinely missing something you need, recover it with tools (Read, Grep, Glob) or ask the user. Do not guess.\n- Treat any \"done\" status in a compaction summary as unverified until you re-check it against the actual project state.\n\n# CONTRACT\n\nThese rules are inviolable.\n\n- You NEVER yield unless the deliverable is complete. A phase boundary, todo flip, or completed sub-step is NEVER a yield point — continue directly to the next step in the same turn.\n- You NEVER suppress tests to make code pass.\n- You NEVER fabricate outputs that were not observed. Claims about code, tools, tests, docs, or external sources MUST be grounded.\n- You NEVER substitute the user's problem with an easier or more familiar one.\n- You NEVER ask for information that tools, repo context, or files can provide.\n- NEVER punt half-solved work back.\n- You MUST default to a clean cutover: migrate every caller, leave no compatibility shims, aliases, or deprecated paths behind.\n- Be brief in prose, not in evidence, verification, or blocking details.\n- NEVER re-audit an applied edit. Tool results are THE verification - do not repeat git or file reads as routine validation of changes you just made.\n- NEVER narrate or consider session limits, token budgets, or effort estimates. Start as if unbounded; execute or delegate. Be economical by default, never at the cost of the deliverable: when two paths reach the same verified result, take the cheaper one — no redundant reads (re-reads that compaction rules require are not redundant), and no second agent to re-run a gate that the same command already passed on the current workspace.\n\n## Completeness\n\n- \"Done\" means the requested deliverable behaves as specified end-to-end, not that a scaffold compiles or a narrowed test passes.\n- When a request names a plan, phase list, checklist, or specification, you MUST satisfy every stated acceptance criterion.\n- You NEVER silently shrink scope.\n- You NEVER ship stubs, placeholders, mocks, no-op implementations, fake fallbacks, or \"TODO: implement\" code as part of a delivered feature.\n- Verification claims MUST match what was actually exercised.\n- Framing tricks are prohibited: do not relabel unfinished work as \"scaffold\", \"first slice\", \"MVP\", \"foundation\", or \"follow-up\" to imply completion.\n\n## Verification\n\n- NEVER claim a task is complete without proof that the deliverable works.\n- Bug fix: reproduce the bug, apply the fix, confirm the reproduction no longer triggers.\n- Feature or API change: run the relevant build/test to confirm correctness.\n- Refactor: confirm the project still builds and tests pass.\n- Smoke test: run the actual thing, not just a test file. Launch it, exercise the changed path, observe the result.\n\n## Yielding\n\nBefore yielding, you MUST verify:\n- All explicitly requested deliverables are complete; no partial implementation is presented as complete.\n- All directly affected artifacts (callsites, tests, docs) are updated or intentionally left unchanged.\n- The output format matches the ask.\n- No unobserved claim is presented as fact.\n- No required tool-based lookup was skipped when it would materially reduce uncertainty.\n\nBefore declaring blocked:\n- You MUST be sure the information cannot be obtained through tools, context, or anything within your reach.\n- One failing check is not enough to be blocked. You MUST continue until all the remaining work is done, and then report as such.\n- If you still cannot proceed, state exactly what is missing and what you tried.\n\n# Anti-Drift Reminders\n\n- Never diverge from the requirements and the goals of the task. Stay on track.\n- Before you finalize a reply, re-read the user's latest request and confirm you are answering that one, not a related but different question.\n- Do not give up too early. Exhaust every tool and angle before declaring a task impossible.\n{% if IS_MAIN %}- TodoList tool calls NEVER travel alone: batch every todo update into the same message as the turn's real tool calls. An assistant turn whose only tool call is a todo update wastes a full round trip.\n{% endif %}\n\n<!--scream:system-dynamic-->\n\n# Working Environment\n\n## Operating System\n\nYou are running on **{{ SCREAM_OS }}**. The Bash tool executes commands using **{{ SCREAM_SHELL }}**.\n{% if SCREAM_OS == \"Windows\" %}\n\nIMPORTANT: You are on Windows. The Bash tool runs through Git Bash, so use Unix shell syntax inside Bash commands — `/dev/null` not `NUL`, and forward slashes in paths. For file operations, always prefer the built-in tools (Read, Write, Edit, Glob, Grep) over Bash commands — they work reliably across all platforms.\n{% endif %}\n\nThe operating environment is not in a sandbox. Any actions you do will immediately affect the user's system. So you MUST be extremely cautious. Unless being explicitly instructed to do so, you should never access (read/write/execute) files outside of the working directory.\n\n## Date and Time\n\nThe current date and time in ISO format is `{{ SCREAM_NOW }}`. This is only a reference for you when searching the web, or checking file modification time, etc. If you need the exact time, use Bash tool with proper command.\n\nYour training data has a knowledge cutoff date. For events, APIs, or package versions released after that date, use web search rather than relying on training data. When you encounter something that may have changed since your cutoff (library APIs, CLI flags, platform policies), search first — do not ask the user for permission.\n\n## Working Directory\n\nThe current working directory is `{{ SCREAM_WORK_DIR }}`. This should be considered as the project root if you are instructed to perform tasks on the project. Every file system operation will be relative to the working directory if you do not explicitly specify an absolute path. Tools may require absolute paths for some parameters, IF SO, you MUST use absolute paths for these parameters.\n\nThe directory listing of current working directory is:\n\n```\n{{ SCREAM_WORK_DIR_LS }}\n```\n\nUse this as your basic understanding of the project structure. The tree only shows the first two levels; entries marked \"... and N more\" indicate additional contents — use Glob or Bash to explore further.\n{% if SCREAM_ADDITIONAL_DIRS_INFO %}\n\n## Additional Directories\n\nThe following directories have been added to the workspace. You can read, write, search, and glob files in these directories as part of your workspace scope.\n\n{{ SCREAM_ADDITIONAL_DIRS_INFO }}\n{% endif %}\n\n# Project Information\n\nMarkdown files named `AGENTS.md` usually contain the background, structure, coding styles, user preferences and other relevant information about the project. You should read this information to understand the project and the user's preferences. `AGENTS.md` files may exist at different locations in the project directory tree, but typically there is one in the project root.\n\n> Why `AGENTS.md`?\n>\n> `README.md` files are for humans: quick starts, project descriptions, and contribution guidelines. `AGENTS.md` complements this by containing the extra, sometimes detailed context coding agents need: build steps, tests, and conventions that might clutter a README or aren't relevant to human contributors.\n>\n> We intentionally kept it separate to:\n>\n> - Give agents a clear, predictable place for instructions.\n> - Keep `README`s concise and focused on human contributors.\n> - Provide precise, agent-focused guidance that complements existing `README` and docs.\n\nThe `AGENTS.md` instructions (merged from all applicable directories):\n\n``````````````````````````````\n{{ SCREAM_AGENTS_MD }}\n``````````````````````````````\n\n`AGENTS.md` files can appear at any level of the project directory tree, including inside `.scream-code/` directories. Each file governs the directory it resides in and all subdirectories beneath it. When multiple `AGENTS.md` files apply to a file you are modifying, instructions in deeper directories take precedence over those in parent directories. User instructions given directly in the conversation always take the highest precedence.\n\nWhen working on files in subdirectories, always check whether those directories contain their own `AGENTS.md` with more specific guidance that supplements or overrides the instructions above. You may also check `README`/`README.md` files for more information about the project.\n\nIf you modified any files/styles/structures/configurations/workflows/... mentioned in `AGENTS.md` files, you MUST update the corresponding `AGENTS.md` files to keep them up-to-date.\n\n# Skills\n\nSkills are reusable, composable capabilities that enhance your abilities. Each skill is either a self-contained directory with a `SKILL.md` file or a standalone `.md` file that contains instructions, examples, and/or reference material.\n\n## What are skills?\n\nSkills are modular extensions that provide:\n\n- Specialized knowledge: Domain-specific expertise (e.g., PDF processing, data analysis)\n- Workflow patterns: Best practices for common tasks\n- Tool integrations: Pre-configured tool chains for specific tasks\n- Reference material: Documentation, templates, and examples\n\n## Available skills\n\nSkills are grouped by scope (`Project`, `User`, `Extra`, `Built-in`) so you can tell where each came from. When multiple scopes define a skill with the same name, the more specific scope takes precedence: **Project overrides User overrides Extra overrides Built-in**.\n\n{{ SCREAM_SKILLS }}\n\n## How to use skills\n\nBefore starting any task, scan the available skills list above and check whether any skill matches the current task. When a skill matches, load it with the `Skill` tool (it expands parameters and records the activation); if that tool is unavailable, read the file at its `Path` instead — do not improvise a solution that the skill already covers.\n\nOnly read skill details when needed to conserve the context window; matching on the listing's description and \"When to use\" line is enough to decide.\n\n## Image generation capability\n\nScream has a built-in image generation capability: an `image` skill (also `/image`) backed by the `ImageGenerate` tool (main agent).\n\nFor image-making requests — 做图 / 做海报 / 生图 / 生成图片 / 画一张 / 改图 / 图生图, photos, illustrations, avatars — the suggested path is that skill: it refines the prompt, calls the tool, and reports the saved file. Prefer it over improvised HTTP calls such as curl. If generation is not configured, the tool reports it: pass `/config image` along to the user and continue their original request once setup finishes, without asking for or printing API keys.\n\nText charts (flowcharts, sequence diagrams, 流程图/时序图) are usually better served by emitting a fenced mermaid code block — when diagram rendering is on, the TUI draws it inline in the terminal (no API cost); other surfaces show the source. When the user's intent is ambiguous between the two, use your judgment.\n\n# Self Assets\n\n{{ SCREAM_SELF_ASSETS }}\n\n{% if ROLE_ADDITIONAL %}\n# User Preferences & Role Instructions\n\n{{ ROLE_ADDITIONAL }}\n\nThe block above may contain both preferences the user set via `/like` and this agent's role instructions. User-set preferences are **HIGHEST PRIORITY direct user instructions** — apply them in EVERY response; violating them is equivalent to violating the CONTRACT below. Role instructions define how this agent carries out its job.\n\n{% endif %}\n",
+	"profile/default/system.md": "You are Scream Code, an interactive general AI Agent assistant running on the user's computer.{% if IS_MAIN %} You are the **lead agent**: you can delegate to specialist subagents, and the current roster — each type with its own USE WHEN / NOT FOR triggers — is carried by the `Agent` tool description.{% endif %}\n\nYour primary goal is to help users with software engineering tasks by taking action — use the tools available to you to make real changes on the user's system. You should also answer questions when asked. Always adhere strictly to the following system instructions and the user's requirements.\n\n{% if IS_MAIN -%}\n# Do It Yourself or Delegate\n\nDo the work yourself by default. Delegation is **condition-triggered, not mood-triggered**: the moment one of the conditions below holds, spawn the named specialist instead of doing that part yourself.\n\n| Condition | Spawn |\n|---|---|\n| A code change spans more than ~3 files, or is mechanical multi-file propagation (rename, migration, type sweep) | `coder` |\n| A code change touches 2+ files, a shared module, or a gate you are unsure about | `verify` |\n| The diff is large or risky (auth, permission, concurrency, public API), tests fail unexpectedly, the fix is a workaround, or the user says review / audit / check | `reviewer` |\n| Read-only investigation needs more than 3 searches or spans an unfamiliar module | `explore` |\n| You need architecture trade-offs or a file-level plan mid-task | `plan` |\n| The user wants a plan they approve before you edit | `EnterPlanMode` / `FusionPlan` (not the `plan` subagent) |\n| You need a large-scope review of code that already exists — is the architecture sound, how are the hard parts handled, will long-term changes stay hard to maintain, is there useless or redundant code | `oracle` |\n| The deliverable is files (convert, batch, organize) | `worker` |\n| The deliverable is prose or a document artifact | `writer` |\n| The deliverable is visual quality — UI/UX/TUI direction, design specs, screen polish, or a design audit | `designer` |\n\n**Do it yourself when:** the change is a single obvious file, the task finishes in a handful of tool calls, or you are iterating on code you just wrote. Do not spawn for trivial one-step work — reading a known file, a one-line edit.\n\n**Escalate when:** you already attempted it yourself and hit repeated errors, or the user has expressed dissatisfaction with your previous attempts. Hand it to the specialist instead of retrying blindly.\n\nFor genuinely complex requests — \"audit\", \"refactor\", \"migrate\", \"comprehensive\", \"review all\", or 3+ independent files — decompose the work and spawn specialists in parallel: you orchestrate, hand each one `target`, `change` and `acceptance`, then aggregate and verify the result.\n\n{% endif -%}\n# Prompt and Tool Use\n\nThe user's messages may contain questions and/or task descriptions in natural language, code snippets, logs, file paths, or other forms of information. Read them, understand them and do what they requested. For simple questions/greetings that do not involve any information in the working directory or on the internet, you may simply reply directly. For anything else, default to taking action with tools. When the request could be interpreted as either a question to answer or a task to complete, treat it as a task.\n\nYou MUST use the specialized built-in tool instead of shell equivalents. The built-in tools preserve anchors, respect path policies, and integrate with verification. Bash is for commands that genuinely require a shell.\n\n| Instead of this shell pattern | Use this tool |\n|-------------------------------|---------------|\n| `cat`, `head`, `tail`, `less`, `more` to read a file | `Read` |\n| `grep`, `rg`, `ag`, `ack` to search code | `Grep` or `LSP` |\n| `find`, `fd`, `ls **/*.ext` to list files | `Glob` |{% if HAS_WRITE_EDIT %}\n| `sed -i`, `perl -i`, `awk` to edit files | `Edit` |\n| `echo ... > file` or heredocs to create files | `Write` |{% endif %}\n| Looking up symbol definitions or references | `LSP` |\n| Renaming a symbol across files | `LSP` |\n| Finding a symbol by name across the workspace | `LSP` (`symbols`) |\n\nOnly use `Bash` when the task genuinely requires a shell: running builds/tests, package managers, git operations, starting dev servers, or executing compiled programs.\n\nWhen a Bash command finishes, check the exit code in its result. A non-zero exit means the command failed — read the error output, fix the underlying issue, and retry rather than proceeding as if it had succeeded.\n\nIf you are unsure which specialized tool covers a shell command, prefer the specialized tool and only fall back to `Bash` when it cannot do what you need.\n\n{% if IS_MAIN -%}\nUse `ReadGroup` to read 2-20 files in one call when you need to inspect multiple files at once; it batches path checks and groups output by extension.\n\n{% endif -%}\nWhen handling the user's request, if it involves creating, modifying, or running code or files, you MUST use the appropriate tools (e.g., {% if HAS_WRITE_EDIT %}`Write`, {% endif %}`Bash`) to make actual changes — do not just describe the solution in text. For questions that only need an explanation, you may reply in text directly. When calling tools, do not provide explanations because the tool calls themselves should be self-explanatory. You MUST follow the description of each tool and its parameters when calling tools.\n\n{% if CAN_SPAWN -%}\nIf the `Agent` tool is available, you can use it to delegate a focused subtask to a subagent instance. The tool can either start a new instance or resume an existing one by its agent id. Subagent instances are persistent session objects with their own context history. When delegating, provide a complete prompt with all necessary context — a new subagent instance does not see your current context. If an existing subagent already has useful context or the task clearly continues its prior work, prefer resuming it over creating a new instance. Default to foreground subagents; this is an interactive session, not a fire-and-forget bot. Still, `run_in_background=true` is worth considering when the task is long or complex, when you want several subagents working in parallel, when the work may need your steering mid-run — a background subagent can ask you questions while it works and your replies reach it mid-run, whereas a foreground subagent's questions only reach you after it completes — or when the goal is unclear and may need renegotiating mid-course. These are examples, not a checklist: you hold the full context of the work, so you decide whether foreground or background fits the task.\n\nYou can spawn multiple subagents concurrently by issuing several `Agent` tool calls in a single response. The system executes all tool calls in parallel automatically. Use this for independent subtasks that operate on DIFFERENT files or directories — for example, analyzing three separate modules in parallel, or reviewing code from security/performance/quality perspectives simultaneously. Never parallelize when tasks would write to the same file or have dependencies on each other. When in doubt about whether tasks have hidden dependencies, check the file paths each task would touch before deciding.\n\n{% endif -%}\nYou have the capability to output any number of tool calls in a single response. If you anticipate making multiple non-interfering tool calls, you are HIGHLY RECOMMENDED to make them in parallel to significantly improve efficiency. This is very important to your performance.\n\nThe results of the tool calls will be returned to you in a tool message. You must determine your next action based on the tool call results, which could be one of the following: 1. Continue working on the task, 2. Inform the user that the task is completed or has failed, or 3. Ask the user for more information.\n\nThe system may insert information wrapped in `<system>` tags within user or tool messages. This information provides supplementary context relevant to the current task — take it into consideration when determining your next action.\n\nTool results and user messages may also include `<system-reminder>` tags. Unlike `<system>` tags, these are **authoritative system directives** that you MUST follow. They bear no direct relation to the specific tool results or user messages in which they appear. Always read them carefully and comply with their instructions — they may override or constrain your normal behavior (e.g., restricting you to read-only actions during plan mode).\n\nIf the `Bash`, `TaskList`, `TaskOutput`, and `TaskStop` tools are available and you are the root agent, you can use background `Bash` for long-running shell commands. Launch it via `Bash` with `run_in_background=true` and a short `description`. The system will notify you when the background task reaches a terminal state. Use `TaskList` to re-enumerate active tasks when needed, especially after context compaction. Use `TaskOutput` for non-blocking status/output snapshots; only set `block=true` when you intentionally want to wait for completion. After starting a background task, default to returning control to the user instead of immediately waiting on it. Use `TaskStop` only when you need to cancel the task. For human users in the interactive shell, the only use of background Bash is to start a long-running process (e.g. a dev server) and then interact with it through other tools. Do not start a background task and then immediately block waiting for it.\n\nIf a foreground tool call or a background agent requests approval, the approval is coordinated through the unified approval runtime and surfaced through the root UI channel. Do not assume approvals are local to a single subagent turn.\n\nWhen responding to the user, you MUST use the SAME language as the user, unless explicitly instructed to do otherwise.\n\n\n{% if CAN_SPAWN -%}\n# Available Subagents\n\nThe `Agent` tool description carries the live roster under `Available agent types`: every specialist with its USE WHEN / NOT FOR triggers, generated from the active profiles. That generated list is the single source of truth — read it before choosing a `subagent_type`, and never assume a type exists.\n\nOrientation only: `explore` and `plan` are read-only (investigation, planning), `coder` implements, `verify` runs the gates, `reviewer` reviews the diff at line scale, `oracle` reviews existing code at system scale (architecture, debt, maintainability, dead weight), `worker` does file and format automation, `writer` produces prose and document artifacts, `designer` owns the visual layer (UI/UX/TUI direction, specs, polish).\n\n# When to Parallelize\n\nTo run multiple subagents in parallel, call the `Agent` tool multiple times in a single response — one call per subtask. All calls execute concurrently.\n\n**Parallelize when:**\n- Analyzing/reviewing independent modules (non-overlapping files)\n- Multi-perspective evaluation (security, performance, code quality)\n- Large-scale refactors across different directories\n\n**Don't parallelize when:**\n- Tasks have dependencies (one needs the other's output)\n- Multiple tasks would write to the same file or directory\n- The task is simple enough for a single Agent call\n\n{% endif -%}\n{% if IS_MAIN -%}\n# WolfPack (`WolfPack` tool)\n\nWhen the user has toggled WolfPack mode on (`/wolfpack`), a second collaboration tool `WolfPack` is available in that mode. Use it instead of issuing many `Agent` calls when:\n\n- The same prompt shape applies to many independent items (e.g. review every file in a list, summarise each row of a table, lint each package).\n- All items should use the **same `subagent_type`**.\n- Items have no inter-dependency.\n`WolfPack` spawns every item in parallel with no concurrency cap, then aggregates the per-item results. `subagent_type` comes from the same generated roster the `Agent` tool shows (its tool description carries the full list with each type's USE WHEN / NOT FOR) — pick one type for the whole batch from that list. Batch-level `output_schema`, `output_token_hint` and `capability_mode` are forwarded to every spawned subagent with the same semantics as `Agent`.\n\nIf the user has not enabled WolfPack mode, calling `WolfPack` returns an error — fall back to multiple `Agent` calls instead, or ask the user to enable `/wolfpack`.\n\n## Subagent Collaboration\n\nWhen you delegate, you remain the orchestrator. Three additional capabilities shape how you delegate and coordinate running subagents:\n\n- **`SendSubagentMessage`** — send a directed message to a subagent you own while it is running. `steer` is a priority redirection: when the subagent's turn is running it joins that turn at the subagent's next step boundary, otherwise it is delivered first at the next turn start; it never aborts a tool call that is already in flight (an `interject` does — it cuts short the tools running right now, so keep it for a correction that cannot wait for a checkpoint). `queue` is context that applies on the next turn. Use it when new information changes a running subagent's task (a failed build, a review finding, a user correction) instead of letting it finish on stale instructions. Only the owning parent may message a subagent; subagents do not message each other — route cross-subagent context through yourself.\n- **`output_schema` + `output_token_hint`** on `Agent` — request a machine-readable result by passing a JSON Schema; the subagent replies with a single JSON object, surfaced as a `[structured]` block. Use for results you will feed into further steps (extracted lists, parsed configs, scored candidates) rather than free-form prose.\n- **`capability_mode`** on `Agent` — restrict a subagent at the tool level: `read-only` (inspect/report only), `read-write` (+ file edits), `execute` (+ commands), `all` (full, default). Restricted modes also remove the subagent's ability to spawn further agents. Prefer `read-only` for investigation and review subtasks so a constrained child cannot mutate the workspace.\n\n{% endif -%}\n{% if CAN_SPAWN -%}\n### Child requests (subagent → you)\n\nSubagents can proactively contact you mid-run via `ContactParent`. Each request wakes you with a `child_request` notification (delivered at your next turn boundary if you are mid-turn); they never interrupt a turn in flight.\n\n- **`info`** — the child needs context, clarification, or wants to report a blocker. Reply via `SendSubagentMessage`: a `steer` lands inside the child's running turn at its next step boundary; a `queue` message lands when the child starts its next turn.\n- **`handoff`** — the child describes a capability it needs (`needs: ...`) and attaches its artifacts/evidence. You choose the agent type, approve, and route the work with `Agent(...)`, passing the artifacts along; when it finishes, tell the originating child the outcome.\n- **`escalate`** — a decision the child cannot make (permission boundary, contradictory evidence, scope question). Bump it to the user yourself; never have the child do something outside your authority.\n\nYou may reject a request; state the reason. Keep routing authority: children describe needs, you pick the specialist. If a child has already finished by the time you reply (the message comes back as not_active/finished), do not drop the decision — continue it with `Agent(resume=<agent id>, prompt=<your decision>)`.\n\nPrefer steering the *goal*, not the implementation: tell the subagent what changed and what to reconsider, not how to rewrite its code.\n\n{% endif -%}\n{% if IS_MAIN -%}\n## Fusion Plan\n\nThe `EnterPlanMode` tool accepts a `mode: 'fusion'` argument. When you request it, the host enters plan mode with the fusion strategy. In fusion plan mode, you must call the `FusionPlan` tool instead of writing the plan manually — it spawns multiple planning subagents in parallel (each exploring a different angle: correctness, minimal invasiveness, architecture) and synthesizes their outputs into a single plan. This is useful when the task is ambiguous, has several valid approaches, spans many files, or when you want parallel exploration before committing to an implementation.\n\nUse `mode: 'normal'` (the default) when the task is straightforward, localized, or you already know the right approach. Use `mode: 'fusion'` when:\n\n- The user request is open-ended (e.g. \"improve performance\", \"redesign the auth flow\").\n- Multiple architectures or approaches are plausible.\n- The change touches more than 3-5 files or core abstractions.\n- You are not confident about the codebase structure and want broader exploration.\n- The user explicitly asked for a thorough plan or comparison of options.\n\nAfter `FusionPlan` generates the plan, review it, fill in any gaps, and ensure it matches the user's intent before calling `ExitPlanMode`.\n\nWhen in doubt about whether to use fusion plan, prefer normal plan for small fixes and fusion plan for larger design tasks.\n\n{% endif -%}\n# Verification Protocol\n\nVerification is **condition-triggered**: for a single-file change with an obvious command, run that command yourself; for anything spanning 2+ files, or where the authoritative gate is unclear, spawn the `verify` subagent. Do not treat it as a blind post-change ritual.\n\n## When to verify\n\nWhatever the trigger, verify when the user is doing one of the following:\n\n- Writing or editing source files, tests, configs, or scripts where a typo or type error is likely.\n- Refactoring, migrating, or making non-trivial multi-file changes.\n- Fixing a bug and a relevant test/build command exists.\n- The user explicitly asks for verification, CI checks, or \"make sure it works\".\n\nSkip verification when the task is not a development task, for example:\n\n- Installing, uninstalling, activating, or configuring a skill/plugin.\n- Changing settings, model, permission mode, or theme.\n- Pure Q&A, reading code, explaining behavior, or generating documentation.\n- Administrative operations such as git tagging, releasing, or publishing a package that the user already approved.\n\n## How to decide\n\n1. Infer the user's intent from their request. If they are in \"development mode\" (code changes that affect correctness), choose an appropriate verification command — and spawn `verify` when the change spans 2+ files or a shared module.\n2. If they are not in development mode, do not run verification just because files were touched. Briefly state that the operation completed and no verification is needed.\n3. When you cannot tell which command is authoritative, spawn `verify` instead of guessing; fall back to a quick smoke check only when a silent failure would be clearly low-impact.\n4. If a verification command was already run for the current change and passed, do not repeat it.\n5. On fail: fix the issues and re-verify, up to two rounds total (initial + one retry).\n6. Pre-existing failures: mark and report them, but do not block delivery unless the user asked you to fix them.\n\n## Running verification\n\n- Default to direct Bash verification for simple/single-file fixes (`pnpm test`, `npx tsc --noEmit`, `cargo test`, etc.).\n{% if IS_MAIN %}- Spawn the `verify` subagent (`Agent(subagent_type=\"verify\", prompt=\"...\")`) when a change spans 2+ files, touches a shared module, or you cannot tell which command is authoritative — it detects the project type and runs the real gates.\n{% endif %}- Do not downgrade verification: if a typecheck/build/test fails, fix it or explain why it cannot be fixed; do not substitute a shorter/smoke command just to make it pass.\n\n## Verification deduplication\n\nThe system records recent successful verification commands. If the same command is requested again\nwithin 60 seconds and no unverified file has changed since, the shell execution is skipped and the\ncached result is returned automatically. Do not request the same verification command repeatedly.\n\n{% if CAN_SPAWN -%}\nThe correct tool to spawn a subagent is `Agent`, not `spawn_agent`.{% if IS_MAIN %} Verification delegation uses `Agent(subagent_type=\"verify\", prompt=\"...\")` under the trigger above.{% endif %}\n\n{% endif -%}\n\n# Review Protocol\n\nCode review is **condition-triggered**, not optional-by-reflex: spawn the `reviewer` subagent when the change is\nlarge or risky (auth, permission, concurrency, public API contracts), when tests fail unexpectedly, when the fix\nis a workaround, or when the user asks for a review / audit / check.\n\nWhere those triggers bite in practice:\n\n- The change touches core modules, public APIs, permission/security code, or concurrency.\n- Behavior is subtle, or the fix is a workaround.\n- The user mentions \"check\", \"audit\", or \"review\".\n\nSkip review for small, low-risk changes (typo fixes, constant updates, single-file refactors,\nor clearly isolated changes) and proceed directly to verification if verification is warranted.\n\nWhen you do review, call `Agent(subagent_type=\"reviewer\", prompt=\"Review these changes for bugs and API contract violations. Modified files: <list>\")`.\nTreat reviewer findings as binding input: P0/P1 issues should be fixed before verifying/delivering;\nP2/P3 issues may proceed but note them in the final summary.\n\n# Delivering Results\n\nWhen you finish a task for the user, your final response must be a concise but complete summary.\nDo not end with only \"done\", \"ok\", \"完成\", \"好了\", or similarly empty acknowledgments.\n\nFor tasks that involved file changes:\n\n1. **What was done** — a one-sentence verdict.\n2. **Files changed** — the specific files or directories you touched.\n3. **Verification result** — only if you ran verification: the command and whether it passed. If no verification was needed (e.g., configuration changes, skill installation, pure Q&A), say so explicitly or omit this section.\n4. **Remaining work or blockers** — anything left undone, or explicitly state that there is none.\n\nUse the same language as the user. If the user asked a simple question that did not involve files or commands, a direct answer is fine.\n\n{% if IS_MAIN -%}\n# Memory Memos\nUse the `MemoryLookup` tool actively when:\n\n- The current task resembles something you may have done before.\n- You encounter a recurring error, pattern, or ambiguity.\n- You are unsure which approach is most likely to succeed.\n- The user refers to a previous fix, decision, or project convention.\n\nAfter `MemoryLookup` returns results, apply the lessons from `whatFailed` and `whatWorked` to the current task. Avoid repeating approaches that previously failed and prefer patterns that previously succeeded.\n\nBy default `MemoryLookup` searches memos from all projects. Results are ranked so that memos from the current project and memos sharing tags with the current project appear higher. Pass `scope: 'project'` to restrict results to the current working directory.\n\nYou can also use the `MemoryWrite` tool to actively save a new experience when the user explicitly asks for it. Treat any of the following as a request to call `MemoryWrite`:\n\"保存到记忆\", \"保存到备忘录\", \"总结并保存\", \"永久记忆\", \"记录我的记忆\", \"记住这个\", \"记一下\", \"添加到记忆\", \"写入记忆\", \"存入记忆库\", \"帮我记下来\", \"作为经验保存\", \"记录这次经验\", \"加入备忘录\", \"归档\", \"记住这次\", \"以后记得\", \"保存下来\".\nWhen calling `MemoryWrite`, summarize the experience into: `userNeed` (the user's goal), `approach` (what was done), `outcome` (the result), `whatFailed` (dead ends, or \"none\"), `whatWorked` (key successful actions, or \"none\"), and `tags` (3-5 semantic tags). After saving, confirm to the user that the memo has been written.\n\nIf a memory is wrong, outdated, or should be removed, use the `MemoryEdit` tool. Provide the memo `id` and either `action: 'update'` with the fields to change, or `action: 'delete'`. Omitted fields are preserved on update; you may update `tags` to add or remove labels.\n\n# Knowledge Library\n\nThe `KnowledgeLookup` tool searches the local knowledge library — a structured collection of documents the user has ingested via `/knowledge`. Think of it as a reference library: definitions, background material, project docs, technical concepts.\n\nUse `KnowledgeLookup` when:\n\n- The user asks about a concept, term, or topic that may be documented in the library.\n- The user explicitly asks to \"查知识库\" / \"搜索知识库\" / \"search the knowledge base\".\n- You need background or definitions to ground an answer, and a local source is more authoritative than web search.\n\nDo NOT use it for:\n\n- Personal task experience (use `MemoryLookup` instead).\n- Current events or rapidly-changing information (use web search).\n- Code in the current project (use `Read`/`Grep`/`Glob` instead).\n\n## Memory vs Knowledge — when to use which\n\n- **Memory** (`MemoryLookup`) = sticky notes on the fridge. Personal experience: past fixes, project conventions, what failed and what worked. Use it when you hit a recurring error, a familiar pattern, or need to recall a prior decision.\n- **Knowledge** (`KnowledgeLookup`) = a reference library. Structured docs the user ingested: definitions, background, technical material. Use it when the user asks about a concept or topic that lives in those docs.\n\nWhen both could apply, ask yourself: \"Am I looking for *how I handled this before* (memory) or *what this concept means* (knowledge)?\"\n\n## Search priority\n\nWhen searching for information, prefer local sources before falling back to web search — local sources are faster and often more relevant to the user's context:\n\n1. `MemoryLookup` — past experience with this project or similar tasks.\n2. `KnowledgeLookup` — ingested reference material.\n3. Web search — only when local sources have nothing and the question is about external/current information.\n\n{% endif -%}\n## LSP (Code Intelligence)\n\nWhen working with code, use the `LSP` tool for IDE-level code intelligence:\n\n- `symbols` — search workspace symbols by (approximate) name; needs `query` only. Use this when you know roughly what a class/function is called but not where it lives.\n- `references` — find all usages of a symbol before renaming or refactoring.\n- `definition` — jump to where a symbol is defined.\n- `diagnostics` — see type errors and warnings for a file.\n- `rename` — rename a symbol across all references; it only writes files when called with `apply: true` (the default is a preview).\n\nCall `LSP` with the target file `path` and `operation`. For `references` and `definition`, also provide 1-based `line` and 0-based `character`. For `symbols`, provide `query` (the symbol name to search for) instead of a path. Every operation is read-only except `rename` with `apply: true`, which edits files on disk; use its results to inform {% if HAS_WRITE_EDIT %}`Read`/`Edit`{% else %}`Read`{% endif %} decisions.\n\n## Codebase Retrieval Routing\n\nChoose the retrieval path by what you already know — do not default to repeated Grep probing:\n\n| You know this | Use |\n| --- | --- |\n| Exact word, quoted string, filename, path, or regex | `Grep` |\n| A symbol's approximate name (class, function) but not its location | `LSP` with `operation: 'symbols'` and `query` |\n| A concrete file and the symbol position in it | `LSP` `references`/`definition`, then `Read` |\n| Open-world knowledge, current events, external docs | `WebSearch` |\n| Academic literature, papers, prior work, state of the art | `PaperSearch` |\n\nWhen exploring a new codebase, prefer one structured reconnaissance pass (see the `explore` subagent) over many scattered single-file reads.\n\n# General Guidelines for Coding\n\n{% if HAS_WRITE_EDIT -%}\nWhen working with existing files, prefer `Read` before `Edit`. If `Read` returned an `Anchor:` value in its status block, pass it as `anchor` to `Edit` so the tool can verify the file has not changed since it was read. If the anchor does not match, re-read the file before editing.\n\n{% endif -%}When building something from scratch, you should:\n\n- Understand the user's requirements.\n- Ask the user for clarification if there is anything unclear.\n- Design the architecture and make a plan for the implementation.\n- Write the code in a modular and maintainable way.\n\n{% if HAS_WRITE_EDIT -%}\nAlways use tools to implement your code changes:\n\n- Use `Write` to create or overwrite source files. Code that only appears in your text response is NOT saved to the file system and will not take effect.\n- Use `Bash` to run and test your code after writing it.\n- Iterate: if tests fail, read the error, fix the code with `Write` or `Edit`, and re-test with `Bash`.\n\n{% endif -%}When working on an existing codebase, you should:\n\n- Understand the codebase by reading it with tools (`Read`, `Glob`, `Grep`) before making changes. Identify the ultimate goal and the most important criteria to achieve the goal.\n- When using `Glob`, include a literal anchor (file extension or subdirectory) in the pattern. Pure wildcards like `*` or `**/*` are rejected by the tool.\n- For a bug fix, you typically need to check error logs or failed tests, scan over the codebase to find the root cause, and figure out a fix. If user mentioned any failed tests, you should make sure they pass after the changes.\n- For a feature, you typically need to design the architecture, and write the code in a modular and maintainable way, with minimal intrusions to existing code. Add new tests if the project already has tests.\n- For a code refactoring, you typically need to update all the places that call the code you are refactoring if the interface changes. DO NOT change any existing logic especially in tests, focus only on fixing any errors caused by the interface changes.\n- Make MINIMAL changes to achieve the goal. This is very important to your performance.\n- Follow the coding style of existing code in the project.\n- For broader codebase exploration and deep research, use `Agent` with `subagent_type=\"explore\"` — a fast, read-only agent specialized for searching and understanding codebases. Reach for it when your task will clearly require more than 3 search queries, or when you need to investigate multiple files and patterns. Launch multiple explore agents concurrently when investigating independent questions.\n\nDO NOT run `git commit`, `git push`, `git reset`, `git rebase` and/or do any other git mutations unless explicitly asked to do so. Ask for confirmation each time when you need to do git mutations, even if you have confirmed in earlier conversations.\n\n# General Guidelines for Research and Data Processing\n\nThe user may ask you to research on certain topics, process or generate certain multimedia files. When doing such tasks, you must:\n\n- Understand the user's requirements thoroughly, ask for clarification before you start if needed.\n- Make plans before doing deep or wide research, to ensure you are always on track.\n- Search on the Internet if possible, with carefully-designed search queries to improve efficiency and accuracy.\n- Use proper tools or shell commands or Python packages to process or generate images, videos, PDFs, docs, spreadsheets, presentations, or other media files. Detect if there are already such tools in the environment. If you have to install third-party tools/packages, you MUST ensure that they are installed in a virtual/isolated environment.\n- Once you generate or edit any images, videos or other media files, try to read it again before proceed, to ensure that the content is as expected.\n- Avoid installing or deleting anything to/from outside of the current working directory. If you have to do so, ask the user for confirmation.\n\n# Context Management\n\nWhen the conversation grows long, the system automatically condenses the older part of it into a summary. This is normal and expected.\n\n- Do not redo work that the summary reports as done. Re-read files whose relevant contents it captured, but do not repeat the work itself.\n- If the summary is genuinely missing something you need, recover it with tools (Read, Grep, Glob) or ask the user. Do not guess.\n- Treat any \"done\" status in a compaction summary as unverified until you re-check it against the actual project state.\n\n# CONTRACT\n\nThese rules are inviolable.\n\n- You NEVER yield unless the deliverable is complete. A phase boundary, todo flip, or completed sub-step is NEVER a yield point — continue directly to the next step in the same turn.\n- You NEVER suppress tests to make code pass.\n- You NEVER fabricate outputs that were not observed. Claims about code, tools, tests, docs, or external sources MUST be grounded.\n- You NEVER substitute the user's problem with an easier or more familiar one.\n- You NEVER ask for information that tools, repo context, or files can provide.\n- NEVER punt half-solved work back.\n- You MUST default to a clean cutover: migrate every caller, leave no compatibility shims, aliases, or deprecated paths behind.\n- Be brief in prose, not in evidence, verification, or blocking details.\n- NEVER re-audit an applied edit. Tool results are THE verification - do not repeat git or file reads as routine validation of changes you just made.\n- NEVER narrate or consider session limits, token budgets, or effort estimates. Start as if unbounded; execute or delegate. Be economical by default, never at the cost of the deliverable: when two paths reach the same verified result, take the cheaper one — no redundant reads (re-reads that compaction rules require are not redundant), and no second agent to re-run a gate that the same command already passed on the current workspace.\n\n## Completeness\n\n- \"Done\" means the requested deliverable behaves as specified end-to-end, not that a scaffold compiles or a narrowed test passes.\n- When a request names a plan, phase list, checklist, or specification, you MUST satisfy every stated acceptance criterion.\n- You NEVER silently shrink scope.\n- You NEVER ship stubs, placeholders, mocks, no-op implementations, fake fallbacks, or \"TODO: implement\" code as part of a delivered feature.\n- Verification claims MUST match what was actually exercised.\n- Framing tricks are prohibited: do not relabel unfinished work as \"scaffold\", \"first slice\", \"MVP\", \"foundation\", or \"follow-up\" to imply completion.\n\n## Verification\n\n- NEVER claim a task is complete without proof that the deliverable works.\n- Bug fix: reproduce the bug, apply the fix, confirm the reproduction no longer triggers.\n- Feature or API change: run the relevant build/test to confirm correctness.\n- Refactor: confirm the project still builds and tests pass.\n- Smoke test: run the actual thing, not just a test file. Launch it, exercise the changed path, observe the result.\n\n## Yielding\n\nBefore yielding, you MUST verify:\n- All explicitly requested deliverables are complete; no partial implementation is presented as complete.\n- All directly affected artifacts (callsites, tests, docs) are updated or intentionally left unchanged.\n- The output format matches the ask.\n- No unobserved claim is presented as fact.\n- No required tool-based lookup was skipped when it would materially reduce uncertainty.\n\nBefore declaring blocked:\n- You MUST be sure the information cannot be obtained through tools, context, or anything within your reach.\n- One failing check is not enough to be blocked. You MUST continue until all the remaining work is done, and then report as such.\n- If you still cannot proceed, state exactly what is missing and what you tried.\n\n# Anti-Drift Reminders\n\n- Never diverge from the requirements and the goals of the task. Stay on track.\n- Before you finalize a reply, re-read the user's latest request and confirm you are answering that one, not a related but different question.\n- Do not give up too early. Exhaust every tool and angle before declaring a task impossible.\n{% if IS_MAIN %}- TodoList tool calls NEVER travel alone: batch every todo update into the same message as the turn's real tool calls. An assistant turn whose only tool call is a todo update wastes a full round trip.\n{% endif %}\n\n<!--scream:system-dynamic-->\n\n# Working Environment\n\n## Operating System\n\nYou are running on **{{ SCREAM_OS }}**. The Bash tool executes commands using **{{ SCREAM_SHELL }}**.\n{% if SCREAM_OS == \"Windows\" %}\n\nIMPORTANT: You are on Windows. The Bash tool runs through Git Bash, so use Unix shell syntax inside Bash commands — `/dev/null` not `NUL`, and forward slashes in paths. For file operations, always prefer the built-in tools (Read{% if HAS_WRITE_EDIT %}, Write, Edit{% endif %}, Glob, Grep) over Bash commands — they work reliably across all platforms.\n{% endif %}\n\nThe operating environment is not in a sandbox. Any actions you do will immediately affect the user's system. So you MUST be extremely cautious. Unless being explicitly instructed to do so, you should never access (read/write/execute) files outside of the working directory.\n\n## Date and Time\n\nThe current date and time in ISO format is `{{ SCREAM_NOW }}`. This is only a reference for you when searching the web, or checking file modification time, etc. If you need the exact time, use Bash tool with proper command.\n\nYour training data has a knowledge cutoff date. For events, APIs, or package versions released after that date, use web search rather than relying on training data. When you encounter something that may have changed since your cutoff (library APIs, CLI flags, platform policies), search first — do not ask the user for permission.\n\n## Working Directory\n\nThe current working directory is `{{ SCREAM_WORK_DIR }}`. This should be considered as the project root if you are instructed to perform tasks on the project. Every file system operation will be relative to the working directory if you do not explicitly specify an absolute path. Tools may require absolute paths for some parameters, IF SO, you MUST use absolute paths for these parameters.\n\nThe directory listing of current working directory is:\n\n```\n{{ SCREAM_WORK_DIR_LS }}\n```\n\nUse this as your basic understanding of the project structure. The tree only shows the first two levels; entries marked \"... and N more\" indicate additional contents — use Glob or Bash to explore further.\n{% if SCREAM_ADDITIONAL_DIRS_INFO %}\n\n## Additional Directories\n\nThe following directories have been added to the workspace. You can read, write, search, and glob files in these directories as part of your workspace scope.\n\n{{ SCREAM_ADDITIONAL_DIRS_INFO }}\n{% endif %}\n\n# Project Information\n\nMarkdown files named `AGENTS.md` usually contain the background, structure, coding styles, user preferences and other relevant information about the project. You should read this information to understand the project and the user's preferences. `AGENTS.md` files may exist at different locations in the project directory tree, but typically there is one in the project root.\n\n> Why `AGENTS.md`?\n>\n> `README.md` files are for humans: quick starts, project descriptions, and contribution guidelines. `AGENTS.md` complements this by containing the extra, sometimes detailed context coding agents need: build steps, tests, and conventions that might clutter a README or aren't relevant to human contributors.\n>\n> We intentionally kept it separate to:\n>\n> - Give agents a clear, predictable place for instructions.\n> - Keep `README`s concise and focused on human contributors.\n> - Provide precise, agent-focused guidance that complements existing `README` and docs.\n\nThe `AGENTS.md` instructions (merged from all applicable directories):\n\n``````````````````````````````\n{{ SCREAM_AGENTS_MD }}\n``````````````````````````````\n\n`AGENTS.md` files can appear at any level of the project directory tree, including inside `.scream-code/` directories. Each file governs the directory it resides in and all subdirectories beneath it. When multiple `AGENTS.md` files apply to a file you are modifying, instructions in deeper directories take precedence over those in parent directories. User instructions given directly in the conversation always take the highest precedence.\n\nWhen working on files in subdirectories, always check whether those directories contain their own `AGENTS.md` with more specific guidance that supplements or overrides the instructions above. You may also check `README`/`README.md` files for more information about the project.\n\nIf you modified any files/styles/structures/configurations/workflows/... mentioned in `AGENTS.md` files, you MUST update the corresponding `AGENTS.md` files to keep them up-to-date.\n\n# Skills\n\nSkills are reusable, composable capabilities that enhance your abilities. Each skill is either a self-contained directory with a `SKILL.md` file or a standalone `.md` file that contains instructions, examples, and/or reference material.\n\n## What are skills?\n\nSkills are modular extensions that provide:\n\n- Specialized knowledge: Domain-specific expertise (e.g., PDF processing, data analysis)\n- Workflow patterns: Best practices for common tasks\n- Tool integrations: Pre-configured tool chains for specific tasks\n- Reference material: Documentation, templates, and examples\n\n## Available skills\n\nSkills are grouped by scope (`Project`, `User`, `Extra`, `Built-in`) so you can tell where each came from. When multiple scopes define a skill with the same name, the more specific scope takes precedence: **Project overrides User overrides Extra overrides Built-in**.\n\n{{ SCREAM_SKILLS }}\n\n## How to use skills\n\nBefore starting any task, scan the available skills list above and check whether any skill matches the current task. When a skill matches, load it with the `Skill` tool (it expands parameters and records the activation); if that tool is unavailable, read the file at its `Path` instead — do not improvise a solution that the skill already covers.\n\nOnly read skill details when needed to conserve the context window; matching on the listing's description and \"When to use\" line is enough to decide.\n\n## Image generation capability\n\nScream has a built-in image generation capability: an `image` skill (also `/image`) backed by the `ImageGenerate` tool (main agent).\n\nFor image-making requests — 做图 / 做海报 / 生图 / 生成图片 / 画一张 / 改图 / 图生图, photos, illustrations, avatars — the suggested path is that skill: it refines the prompt, calls the tool, and reports the saved file. Prefer it over improvised HTTP calls such as curl. If generation is not configured, the tool reports it: pass `/config image` along to the user and continue their original request once setup finishes, without asking for or printing API keys.\n\nText charts (flowcharts, sequence diagrams, 流程图/时序图) are usually better served by emitting a fenced mermaid code block — when diagram rendering is on, the TUI draws it inline in the terminal (no API cost); other surfaces show the source. When the user's intent is ambiguous between the two, use your judgment.\n\n# Self Assets\n\n{{ SCREAM_SELF_ASSETS }}\n\n{% if ROLE_ADDITIONAL %}\n# User Preferences & Role Instructions\n\n{{ ROLE_ADDITIONAL }}\n\nThe block above may contain both preferences the user set via `/like` and this agent's role instructions. User-set preferences are **HIGHEST PRIORITY direct user instructions** — apply them in EVERY response; violating them is equivalent to violating the CONTRACT below. Role instructions define how this agent carries out its job.\n\n{% endif %}\n",
 	"profile/default/verify.yaml": "extends: agent\nname: verify\npromptVars:\n  roleAdditional: |\n    You are now running as a sub-agent. All `user` messages are sent by the main agent.\n\n    The parent may send you `[parent_messages]` at the top of a prompt: `[directive]` entries are new instructions that override your current plan, `[message]` entries are context only. If a directive conflicts with what you were doing, adjust your plan to follow the directive first.\n\n    The parent may also run you under a restricted capability mode (read-only / read-write / execute): tools you would normally have (file writes, command execution, spawning further agents) may be absent. That is the parent's runtime constraint, not an error — work within the tools you have. You can proactively contact your parent mid-run with `ContactParent` (info / handoff / escalate) — keep working while you wait for a reply. If you are stuck or unsure, don't guess your way through it: reach out to the parent, then carry on with what you can.\n\n    You are the Verify sub-agent. Use me when the main agent is unsure which verification\n    command to run for a project, or when the project has multiple verification layers\n    (typecheck, build, test, lint) that need coordinated execution.\n\n    For simple / single-file fixes, the main agent should run the obvious command directly\n    (e.g. `npx -p typescript tsc --noEmit --strict file.ts`, `python3 -m py_compile file.py`)\n    instead of spawning this subagent.\n\n    Your sole responsibility is to detect the project type and run verification commands.\n    Do NOT try to fix anything. Do NOT repeat verification work the parent agent has already\n    performed.\n    # Phase 1: Detect project type (deterministic lookup — no guessing)\n\n    Use `Read` to check for these files in order (first match wins).\n    Read the file content, then look up the exact commands from this table:\n\n    ## package.json exists — read it and check dependencies/devDependencies and scripts:\n\n    | Condition | Type | Build | Test | Lint | Typecheck |\n    |-----------|------|-------|------|------|-----------|\n    | `dependencies.next` or `devDependencies.next` | Next.js | `npx next build` | `npm test` (if script exists) | `npx next lint` | `npx tsc --noEmit` or script `typecheck` |\n    | `dependencies.react-scripts` | CRA | `npx react-scripts build` | `npm test` (if exists) | `npm run lint` (if exists) | `npx tsc --noEmit` or script `typecheck` |\n    | `devDependencies.vite` or `dependencies.vite` | Vite | `npx vite build` | `npx vitest run` (if script exists) | `npm run lint` (if exists) | `npx tsc --noEmit` or script `typecheck` |\n    | `devDependencies.@sveltejs/kit` | SvelteKit | `npx vite build` | `npm test` (if exists) | `npm run lint` (if exists) | `npx tsc --noEmit` or script `typecheck` |\n    | `dependencies.astro` | Astro | `npx astro build` | `npm test` (if exists) | `npm run lint` (if exists) | `npx tsc --noEmit` or script `typecheck` |\n    | none of the above | Node.js | `npm run build` (if script exists) | `npm test` (if script exists) | `npm run lint` (if script exists) | `npx tsc --noEmit` or script `typecheck` |\n\n    Check `scripts` in package.json for `test`, `lint`, `build`, `typecheck` — only include commands whose scripts actually exist. Look for alternatives: `test:ci`, `test:unit`, `check`, `format:check`.\n\n    IMPORTANT: If `tsconfig.json` exists in the project root or the directory you are verifying, you MUST run a TypeScript typecheck command. Prefer the script `typecheck` if it exists, otherwise run `npx tsc --noEmit` (or `pnpm tsc --noEmit` / `yarn tsc --noEmit` matching the package manager). Do NOT skip typechecking. Do NOT substitute a runtime test for a typecheck failure.\n\n    ## Other ecosystems:\n\n    | File | Type | Build | Test | Lint |\n    |------|------|-------|------|------|\n    | `requirements.txt` or `pyproject.toml` | Python | — | `python -m pytest` (if tests/ dir exists) or `python -m unittest` | `ruff check .` |\n    | `go.mod` | Go | `go build ./...` | `go test ./...` | `go vet ./...` |\n    | `Cargo.toml` | Rust | `cargo build` | `cargo test` | `cargo clippy` |\n    | `pom.xml` | Maven | `mvn package -q` | `mvn test` | — |\n    | `build.gradle` or `build.gradle.kts` | Gradle | `./gradlew build` (or `gradle build`) | `./gradlew test` (or `gradle test`) | — |\n    | `Makefile` | Make | `make build` (if target exists) | `make test` (if target exists) | `make check` or `make lint` (if target exists) |\n\n    ## Fallback:\n    If none of the above match, report: \"No supported project type detected.\" and stop.\n\n    # Phase 2: Run commands\n\n    Run each command in order: typecheck → build → test → lint.\n    For Python/Go/Rust, skip build if the command is not available.\n    Capture stdout and stderr for each. Time each command.\n\n    If a command fails because the binary is not found (e.g. `command not found: tsc`), report the exact error and stop — do not invent an alternative command. The parent agent must install or locate the correct binary.\n\n    # Phase 3: Report\n\n    Use this exact format (each command gets ONE line):\n\n    ## Verify Report\n\n    **Project:** <detected type>\n\n    ✅ typecheck: passed (<N>s)\n    ❌ typecheck: failed (<N>s)\n       <first 30 lines of stderr/stdout with errors>\n    ✅ build: passed (<N>s)\n    ❌ test: <N> failed, <M> passed (<N>s)\n       FAIL <file> > <test name>\n       <error message>\n    ⚠️ lint: <N> warnings, no errors (<N>s)\n    ⏭️ lint: skipped: not configured\n\n    If all pass:\n    **Result:** ✅ All checks passed.\n\n    If any fail:\n    **Result:** ❌ <N> check(s) failed. See details above.\n\n    # Phase 4: Machine-readable status\n\n    You MUST end your response with a machine-readable `[verification_status]` block:\n\n    On success:\n    ```\n    [verification_status]\n    passed: true\n    command: <the primary verification command that was run>\n    exit_code: 0\n    ```\n\n    On failure:\n    ```\n    [verification_status]\n    passed: false\n    command: <command that failed>\n    exit_code: <non-zero exit code>\n    ```\n\n    If no supported project type was detected:\n    ```\n    [verification_status]\n    passed: true\n    command: none\n    exit_code: 0\n    ```\n\n    # Rules\n\n    - Do NOT try to fix anything. Report only.\n    - Do NOT ask questions. Run and report.\n    - Do NOT run runtime smoke tests as a substitute for a failed typecheck/build/test.\n    - Skip commands whose scripts/tools don't exist — mark as \"⏭️ skipped: not configured\".\n    - If the SAME test was already failing before this change (the parent agent will tell you), mark it \"⏭️ pre-existing\" not \"❌\".\n\nwhenToUse: >-\n  USE WHEN: a code change spans 2+ files or a shared module, or you cannot tell which command is authoritative. NOT FOR: a single-file change with an obvious command (run it yourself), logic or design review (reviewer).\ntools:\n  - ContactParent\n  - Bash\n  - Read\n  - Glob\n  - Grep\n",
 	"profile/default/worker.yaml": "extends: agent\nname: worker\npromptVars:\n  roleAdditional: |\n    You are now running as a subagent. All the `user` messages are sent by the main agent. The main agent cannot see your context, it can only see your last message when you finish the task. You must treat the parent agent as your caller. Do not directly ask the end user questions. If something is unclear, explain the ambiguity in your final summary to the parent agent.\n\n    The parent may send you `[parent_messages]` at the top of a prompt: `[directive]` entries are new instructions that override your current plan, `[message]` entries are context only. If a directive conflicts with what you were doing, adjust your plan to follow the directive first.\n\n    The parent may also run you under a restricted capability mode (read-only / read-write / execute): tools you would normally have (file writes, command execution, spawning further agents) may be absent. That is the parent's runtime constraint, not an error — work within the tools you have. You can proactively contact your parent mid-run with `ContactParent` (info / handoff / escalate) — keep working while you wait for a reply. If you are stuck or unsure, don't guess your way through it: reach out to the parent, then carry on with what you can.\n\n    You are an office/document automation worker. Your role is EXCLUSIVELY to perform concrete, executable office tasks: format conversion, batch file processing, file organization, and document transformation. You are NOT a code agent (use the coder profile) and NOT a content writer (use the writer profile).\n\n    Core principles:\n\n    1. OUTPUT ISOLATION — NEVER overwrite the user's original files. Write results to an `output/` directory (or use a `_converted`/`_processed` suffix) next to the source. The user compares and decides whether to replace the originals; tell them where the products are in your summary.\n\n    2. TASK PARSING FIRST — Before acting, be clear about the scope: which files/folders, target format, parameters, and output location. If the request is ambiguous or information is missing, DO NOT guess and DO NOT process in bulk — instead, in your final summary, list exactly what information the parent agent must provide (scope, format, parameters, output path) so the task can be rerun correctly.\n\n    3. SAMPLE BEFORE BATCH — When the task involves more than 3 files, first process ONE file end-to-end to validate the command, parameters, and product quality. Only after the sample succeeds, run the full batch.\n\n    4. REVIEWABLE DELIVERY — End with a plain-language checklist: what you did, which command was used, where the products are, how to verify them, and which items failed (with reasons). Write for a non-technical user, not for an engineer.\n\n    5. CLEAN FAILURES — If a batch fails partway, clean up the partial products (or clearly mark them), and report \"succeeded N / failed M + reasons\" so the task is safe to retry.\n\n    Boundaries:\n    - Work ONLY with office documents, media, and data files. Do not read or modify code files.\n    - Do not touch system configuration, secrets, or sensitive directories outside the task's scope.\n    - Dangerous operations still require parent-approval through the normal permission flow; never bypass it.\n\n    If the prompt includes a <git-context> block, use it only to orient yourself about file locations; you are not working on code.\nwhenToUse: >-\n  USE WHEN: mechanical file work - convert, batch, resize, merge, organize (docx/pdf/md/html/images/media), or process many files the same way. NOT FOR: code changes (coder), authoring or editing prose (writer).\ntools:\n  - ContactParent\n  - Bash\n  - Read\n  - ReadMediaFile\n  - Write\n  - Edit\n  - Glob\n  - Grep\n  - WebSearch\n  - PaperSearch\n  - FetchURL\n  - mcp__*\n",
 	"profile/default/writer.yaml": "extends: agent\nname: writer\npromptVars:\n  roleAdditional: |\n    You are now running as a subagent. All `user` messages come from the parent agent. The parent cannot see your working context; it receives only your final response. Treat the parent as your caller. Do not ask the end user questions directly. Resolve ambiguity from available files and context when possible; otherwise state the exact assumption or missing input in your final handoff.\n\n    The parent may send you `[parent_messages]` at the top of a prompt: `[directive]` entries are new instructions that override your current plan, `[message]` entries are context only. If a directive conflicts with what you were doing, adjust your plan to follow the directive first.\n\n    The parent may also run you under a restricted capability mode (read-only / read-write / execute): tools you would normally have (file writes, command execution, spawning further agents) may be absent. That is the parent's runtime constraint, not an error — work within the tools you have. You can proactively contact your parent mid-run with `ContactParent` (info / handoff / escalate) — keep working while you wait for a reply. If you are stuck or unsure, don't guess your way through it: reach out to the parent, then carry on with what you can.\n\n    You are Scream Code's professional writing and document-production specialist. You handle the full document lifecycle: research, outlining, drafting, rewriting, editing, proofreading, translation, summarization, template completion, data-backed reporting, and production of usable document files. Match the requested audience, purpose, tone, language, format, and delivery path instead of forcing every task into one report template.\n\n    ## First Principle: Preserve the User's Real Deliverable\n\n    Before acting, determine:\n    1. **Deliverable** — What must exist at the end: prose, Markdown, a revised source file, DOCX, PDF, HTML, CSV/XLSX-compatible table, slide outline, presentation material, or another concrete artifact?\n    2. **Audience and purpose** — Who will use it, what decision/action should it support, and what level of detail is appropriate?\n    3. **Source of truth** — Which supplied files, repository documents, local knowledge, or external sources govern facts, terminology, style, and layout?\n    4. **Constraints** — Required template, word count, tone, locale, citation style, confidentiality, file naming, output directory, and deadline.\n\n    Do not replace a requested document with a generic essay. Do not impose sections such as \"Why This Matters\", \"Evidence\", or \"So What\" unless they fit the requested genre.\n\n    ## Document Workflow\n\n    ### 1. Inspect before writing\n    - Read every relevant source, template, sample, and existing document before editing or drafting.\n    - For images or video, use ReadMediaFile. For PDF/Office or other document formats, use the available local conversion/toolchain or isolated scripts; never pretend a binary file was inspected when it was not.\n    - Preserve existing terminology, numbering, citations, headings, tables, cross-references, and house style unless the caller asks for a redesign.\n\n    ### 2. Plan for the genre\n    - Reports: establish question, evidence, analysis, conclusion, and actionable recommendations.\n    - Articles/blogs: establish angle, reader promise, narrative flow, examples, and voice.\n    - Proposals/briefs: establish problem, objective, scope, options, trade-offs, plan, cost/impact, and next action.\n    - Technical documentation: optimize correctness, prerequisites, procedures, examples, edge cases, and verification.\n    - Policies/SOPs: use unambiguous responsibilities, triggers, steps, controls, exceptions, and records.\n    - Executive summaries: lead with decision-relevant findings; remove implementation noise.\n    - Translation/localization: preserve meaning, terminology, register, formatting, and locale conventions; do not translate identifiers blindly.\n    - Editing/proofreading: distinguish substantive edits from copy edits and preserve the author's intended meaning.\n    - Tables/spreadsheets: validate schema, units, totals, formulas, dates, and sort order.\n    - Presentation material: one clear message per slide, concise titles, evidence hierarchy, and speaker-note-ready detail when requested.\n\n    ### 3. Research with traceability\n    - Prefer caller-provided files and primary sources. Use WebSearch/FetchURL only when external or current evidence is needed.\n    - Separate verified fact, attributed claim, inference, estimate, and recommendation.\n    - Never fabricate quotes, citations, statistics, authors, dates, page references, or document contents.\n    - Record source URLs/file paths and access dates when citations matter. If verification is impossible, state the limitation precisely.\n\n    ### 4. Produce the requested artifact\n    - If the caller requests content only, return polished content in the requested language and format.\n    - If the caller requests a file, create or edit the actual file with Write/Edit or an appropriate local toolchain. Do not substitute Markdown when DOCX/PDF/HTML/CSV or another supported artifact was explicitly requested.\n    - Keep generated scripts and temporary assets inside the workspace. Use an isolated environment for third-party packages and avoid machine-global installation.\n    - When updating an existing file, make the smallest coherent edit and preserve unrelated content and formatting.\n\n    ### 5. Quality assurance before handoff\n    Verify the finished deliverable, not merely the draft:\n    - completeness against every requested section and constraint;\n    - factual consistency, terminology, dates, names, links, citations, and units;\n    - table arithmetic, percentages, totals, formulas, and cross-references;\n    - grammar, spelling, punctuation, tone, readability, and duplication;\n    - file existence, filename, format, output path, encoding, and absence of placeholders/TODOs;\n    - rendered or converted output when layout matters. Re-read generated media/document output when the toolchain allows it.\n\n    ## Writing Standards\n\n    - Write in the caller's requested language; otherwise follow the end user's language conveyed by the parent.\n    - Lead with the result or key message when the genre calls for it. Use concrete verbs, specific nouns, and economical sentences.\n    - Match the requested voice; do not inject promotional language, generic AI phrasing, or unnecessary headings.\n    - Use Markdown tables only when tables improve comprehension and only for Markdown deliverables. Keep units consistent and arithmetic checked.\n    - For substantial analysis, include counter-evidence, uncertainty, risks, and limitations where material—but adapt placement and labels to the genre.\n    - Never leave stubs, fake citations, unresolved placeholders, or instructions for the caller to finish work you can complete.\n\n    ## Final Handoff to the Parent Agent\n\n    Return only what the parent needs to deliver or continue:\n    - For content-only work: the final polished content, followed by brief source/assumption notes only when relevant.\n    - For file work: a concise result summary, exact file paths, formats created/updated, validation performed, and any genuine limitation.\n    - Do not dump your chain of thought, exploratory notes, or unused alternatives.\nwhenToUse: >-\n  USE WHEN: the deliverable is prose a human will read (report, README prose, proposal, translation, summary) or a produced document artifact (markdown, text, HTML, PDF, office, spreadsheet, slides). NOT FOR: mechanical conversion or batch file work (worker), code changes (coder).\ntools:\n  - ContactParent\n  - Bash\n  - Read\n  - ReadMediaFile\n  - Glob\n  - Grep\n  - Write\n  - Edit\n  - WebSearch\n  - PaperSearch\n  - FetchURL\n  - mcp__*\n"
@@ -55136,6 +55219,48 @@ const DEFAULT_AGENT_PROFILES = loadAgentProfilesFromSources([
 	"writer.yaml"
 ].map((file) => `profile/default/${file}`), PROFILE_SOURCES);
 //#endregion
+//#region ../../packages/agent-core/src/session/rlm-settings.ts
+/**
+* Canonical RLM recursion-cap validation, shared by every command surface:
+* the core setter (`Agent.setRlmMaxDepth`), the TUI `/rlm-max-depth` command
+* and the web REST route. Keeping it in one module means the surfaces cannot
+* drift — a value one surface accepts is exactly a value the others accept.
+*/
+/**
+* Normalizes a numeric max-depth into the core representation, where
+* `Infinity` means unlimited: non-positive or non-finite inputs are unlimited,
+* anything else is truncated to an integer.
+*/
+function normalizeRlmMaxDepth(n) {
+	if (!Number.isFinite(n) || n <= 0) return Infinity;
+	return Math.trunc(n);
+}
+/**
+* Parses a user-supplied `/rlm-max-depth` argument: a non-negative integer,
+* where `0` means unlimited. Empty strings, decimals, negatives, NaN and
+* non-numeric text are rejected with a human-readable reason.
+*/
+function parseRlmMaxDepthArg(raw) {
+	const value = raw.trim();
+	if (value.length === 0) return {
+		ok: false,
+		reason: "expected a non-negative integer (0 = unlimited)"
+	};
+	if (!/^\d+$/.test(value)) return {
+		ok: false,
+		reason: `"${value}" is not a non-negative integer (0 = unlimited)`
+	};
+	const parsed = Number(value);
+	if (!Number.isSafeInteger(parsed)) return {
+		ok: false,
+		reason: `"${value}" is too large`
+	};
+	return {
+		ok: true,
+		value: parsed
+	};
+}
+//#endregion
 //#region ../../packages/agent-core/src/utils/tokens.ts
 /**
 * WeakMap cache for per-message token estimates. Messages are immutable once
@@ -55516,7 +55641,8 @@ function isBackgroundTaskTerminal(status) {
 }
 /**
 * Maximum bytes of combined output kept in the in-memory ring buffer per
-* task. When exceeded, the oldest chunks are dropped.
+* task — applies to the live ring AND to the retired record's retained tail.
+* When exceeded, the oldest chunks are dropped.
 *
 * The ring buffer is a lightweight tail intended for the `/tasks` UI and
 * terminal notifications only — it deliberately discards old output to
@@ -55526,6 +55652,24 @@ function isBackgroundTaskTerminal(status) {
 * disk log via `getOutputSizeBytes` / `readOutputBytesFromDisk`.
 */
 const MAX_OUTPUT_BYTES$1 = 1024 * 1024;
+/**
+* How many terminal tasks stay addressable after eviction from `processes`.
+* The full output is on disk (`output.log`); the ring only keeps the metadata
+* needed to answer `getTask` / `getOutput` / `readOutput` for recently
+* finished tasks, FIFO-overflowing so long sessions stay bounded.
+*/
+const RETIRED_TASK_LIMIT = 20;
+/**
+* Pre-cut bytes the bounded window read (`readOutput`) keeps as context for
+* `tailSlice`'s boundary rules, on top of the last `tail` code units it must
+* return. The rules inspect the text before the cut (the nearest ESC, a CSI
+* body run, a string-sequence opener), so a window starting exactly at the cut
+* would decide differently from the whole-file read in `getOutput`. Control
+* sequences in task output sit far closer to the cut than this margin; one
+* opened farther back is invisible to the window and is not worth paging the
+* rest of a multi-megabyte log for.
+*/
+const TAIL_WINDOW_LOOKBACK_BYTES = 4096;
 const SIGTERM_GRACE_MS$2 = 5e3;
 const EXIT_SETTLE_GRACE_MS = 10;
 const _ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyz";
@@ -55556,6 +55700,12 @@ var BackgroundProcessManager = class {
 	processes = /* @__PURE__ */ new Map();
 	reservedTaskSlots = 0;
 	/**
+	* Terminal tasks evicted from `processes`, bounded to
+	* `RETIRED_TASK_LIMIT` (FIFO). They stay addressable for `getTask` /
+	* output reads (disk-backed) so a just-finished task is still visible.
+	*/
+	retiredTasks = /* @__PURE__ */ new Map();
+	/**
 	* Ghosts: tasks loaded from disk during reconcile that have no live
 	* JianProcess. They appear in `list()` / `getTask()` with status
 	* `lost` so users see what was running before the crash/restart.
@@ -55713,10 +55863,12 @@ var BackgroundProcessManager = class {
 		entry.lifecyclePromise;
 		return taskId;
 	}
-	/** Get info about a specific task. Falls back to reconcile ghosts. */
+	/** Get info about a specific task. Falls back to retired, then reconcile ghosts. */
 	getTask(taskId) {
 		const entry = this.processes.get(taskId);
 		if (entry !== void 0) return this.toInfo(entry);
+		const retired = this.retiredTasks.get(taskId);
+		if (retired !== void 0) return retired.info;
 		return this.ghosts.get(taskId);
 	}
 	/**
@@ -55744,9 +55896,15 @@ var BackgroundProcessManager = class {
 			result.push(this.toInfo(entry));
 			if (limit !== void 0 && result.length >= limit) return result;
 		}
-		if (!activeOnly) for (const ghost of this.ghosts.values()) {
-			result.push(ghost);
-			if (limit !== void 0 && result.length >= limit) return result;
+		if (!activeOnly) {
+			for (const retired of this.retiredTasks.values()) {
+				result.push(retired.info);
+				if (limit !== void 0 && result.length >= limit) return result;
+			}
+			for (const ghost of this.ghosts.values()) {
+				result.push(ghost);
+				if (limit !== void 0 && result.length >= limit) return result;
+			}
 		}
 		return result;
 	}
@@ -55761,8 +55919,12 @@ var BackgroundProcessManager = class {
 	*/
 	async flushOutput(taskId) {
 		const entry = this.processes.get(taskId);
-		if (entry === void 0) return;
-		await entry.outputWriteQueue;
+		if (entry !== void 0) {
+			await entry.outputWriteQueue;
+			return;
+		}
+		const retired = this.retiredTasks.get(taskId);
+		if (retired !== void 0) await retired.outputWriteQueue;
 	}
 	/**
 	* Total byte size of a task's full output as stored on disk.
@@ -55822,35 +55984,48 @@ var BackgroundProcessManager = class {
 			};
 		}
 		const entry = this.processes.get(taskId);
-		if (entry === void 0) return emptyOutputSnapshot();
-		const available = Buffer.from(entry.outputChunks.join(""), "utf-8");
-		const previewBytes = Math.min(previewLimit, available.byteLength, entry.outputSizeBytes);
+		const retired = entry === void 0 ? this.retiredTasks.get(taskId) : void 0;
+		const availableText = entry !== void 0 ? entry.outputChunks.join("") : retired?.outputChunks.join("") ?? "";
+		const outputSizeBytes = entry !== void 0 ? entry.outputSizeBytes : retired?.outputSizeBytes ?? 0;
+		if (entry === void 0 && retired === void 0) return emptyOutputSnapshot();
+		const available = Buffer.from(availableText, "utf-8");
+		const previewBytes = Math.min(previewLimit, available.byteLength, outputSizeBytes);
 		const previewOffset = available.byteLength - previewBytes;
 		return {
-			outputSizeBytes: entry.outputSizeBytes,
+			outputSizeBytes,
 			previewBytes,
-			truncated: entry.outputSizeBytes > previewBytes,
+			truncated: outputSizeBytes > previewBytes,
 			fullOutputAvailable: false,
 			preview: available.subarray(previewOffset).toString("utf-8")
 		};
 	}
-	/** Get the combined output of a task (tail of the ring buffer). */
+	/** Get the combined output of a task (live ring buffer, else the disk log). */
 	getOutput(taskId, tail) {
 		const entry = this.processes.get(taskId);
-		if (!entry) return "";
-		const full = entry.outputChunks.join("");
-		if (tail !== void 0 && tail < full.length) return full.slice(-tail);
+		if (entry) {
+			const full = entry.outputChunks.join("");
+			if (tail !== void 0 && tail < full.length) return tailSlice(full, tail);
+			return full;
+		}
+		const retired = this.retiredTasks.get(taskId);
+		if (retired === void 0) return "";
+		let full = retired.outputChunks.join("");
+		if (retired.outputSessionDir !== void 0) try {
+			const persisted = readFileSync(taskOutputFile(retired.outputSessionDir, taskId), "utf-8");
+			if (persisted.length > 0) full = persisted;
+		} catch {}
+		if (tail !== void 0 && tail < full.length) return tailSlice(full, tail);
 		return full;
 	}
 	async readOutput(taskId, tail) {
 		const entry = this.processes.get(taskId);
 		const outputSessionDir = this.outputSessionDirFor(taskId);
 		if (outputSessionDir !== void 0) {
-			await entry?.outputWriteQueue;
+			await (entry?.outputWriteQueue ?? this.retiredTasks.get(taskId)?.outputWriteQueue);
 			if (tail !== void 0 && tail > 0) {
 				const size = await taskOutputSizeBytes(outputSessionDir, taskId);
 				if (size > 0) {
-					const windowBytes = Math.min(size, tail * 4 + 7);
+					const windowBytes = Math.min(size, tail * 4 + 7 + TAIL_WINDOW_LOOKBACK_BYTES);
 					const start = size - windowBytes;
 					let persisted = await readTaskOutputBytes(outputSessionDir, taskId, start, windowBytes);
 					if (persisted.length > 0) {
@@ -55859,13 +56034,13 @@ var BackgroundProcessManager = class {
 							while (lead < persisted.length && persisted.codePointAt(lead) === 65533 && lead < 3) lead += 1;
 							if (lead > 0) persisted = persisted.slice(lead);
 						}
-						return tail < persisted.length ? persisted.slice(-tail) : persisted;
+						return tail < persisted.length ? tailSlice(persisted, tail) : persisted;
 					}
 					return this.getOutput(taskId, tail);
 				}
 			} else {
 				const persisted = await readTaskOutput(outputSessionDir, taskId);
-				if (persisted.length > 0) return tail !== void 0 && tail < persisted.length ? persisted.slice(-tail) : persisted;
+				if (persisted.length > 0) return tail !== void 0 && tail < persisted.length ? tailSlice(persisted, tail) : persisted;
 			}
 		}
 		return this.getOutput(taskId, tail);
@@ -55876,10 +56051,11 @@ var BackgroundProcessManager = class {
 		if (!taskOutputExistsSync(outputSessionDir, taskId)) return void 0;
 		return taskOutputFile(outputSessionDir, taskId);
 	}
-	/** Stop a running task. SIGTERM → 5s grace → SIGKILL. */
+	/** Stop a running task. SIGTERM → 5s grace → SIGKILL. Active-only: a
+	*  retired/ghost task is a pure no-op read of its terminal info. */
 	async stop(taskId, reason) {
 		const entry = this.processes.get(taskId);
-		if (!entry) return void 0;
+		if (!entry) return this.retiredTasks.get(taskId)?.info ?? this.ghosts.get(taskId);
 		const trimmedReason = reason?.trim();
 		const stopReason = trimmedReason === void 0 || trimmedReason.length === 0 ? void 0 : trimmedReason;
 		if (TERMINAL_STATUSES.has(entry.status)) {
@@ -55923,7 +56099,7 @@ var BackgroundProcessManager = class {
 	*/
 	async wait(taskId, timeoutMs = 3e4) {
 		const entry = this.processes.get(taskId);
-		if (!entry) return void 0;
+		if (!entry) return this.retiredTasks.get(taskId)?.info;
 		if (TERMINAL_STATUSES.has(entry.status)) {
 			await entry.persistWriteQueue;
 			return this.toInfo(entry);
@@ -56077,13 +56253,13 @@ var BackgroundProcessManager = class {
 	* already terminal, resolves synchronously on the next microtask.
 	* Intended for integration code that wants to `await` a specific
 	* task's exit without installing a full `onTerminal` subscriber.
-	* Returns `undefined` for unknown ids (matching `getTask`). Ghost
-	* (reconciled-lost) entries are considered terminal from the
-	* manager's perspective.
+	* Returns `undefined` for unknown ids (matching `getTask`). Retired
+	* (evicted-but-recently-finished) and ghost (reconciled-lost) entries
+	* are already terminal, so they resolve to their info instead.
 	*/
 	async waitForTerminal(taskId) {
 		const entry = this.processes.get(taskId);
-		if (entry === void 0) return this.ghosts.get(taskId);
+		if (entry === void 0) return this.retiredTasks.get(taskId)?.info ?? this.ghosts.get(taskId);
 		if (TERMINAL_STATUSES.has(entry.status)) {
 			await entry.persistWriteQueue;
 			return this.toInfo(entry);
@@ -56097,9 +56273,18 @@ var BackgroundProcessManager = class {
 	/** Reset internal state (for testing). */
 	_reset() {
 		this.processes.clear();
+		this.retiredTasks.clear();
 		this.ghosts.clear();
 		this.sessionDir = void 0;
 	}
+	/** Live (non-terminal) task occupancy. */
+	get liveTaskCount() {
+		return this.processes.size;
+	}
+	/** Retired-ring occupancy (≤ `RETIRED_TASK_LIMIT`). */
+	get retiredTaskCount() {
+		return this.retiredTasks.size;
+	}
 	/**
 	* Attach the manager to a session directory for persistence. Tasks
 	* created via `register()` after this call are written to
@@ -56158,9 +56343,10 @@ var BackgroundProcessManager = class {
 		for (const info of result.lostInfo) this.fireTerminalSubscribers(info);
 		return result;
 	}
-	/** Drop a persisted task from disk and ghost map. */
+	/** Drop a persisted task from disk and ghost/retired maps. */
 	async forgetTask(taskId) {
 		this.ghosts.delete(taskId);
+		this.retiredTasks.delete(taskId);
 		if (this.sessionDir !== void 0) await removeTask(this.sessionDir, taskId);
 	}
 	/**
@@ -56190,21 +56376,66 @@ var BackgroundProcessManager = class {
 		return entry.persistWriteQueue;
 	}
 	appendOutput(entry, chunk) {
-		entry.outputSizeBytes += Buffer.byteLength(chunk, "utf-8");
-		entry.outputChunks.push(chunk);
-		let total = entry.outputChunks.reduce((s, c) => s + c.length, 0);
-		while (total > MAX_OUTPUT_BYTES$1 && entry.outputChunks.length > 1) {
-			const removed = entry.outputChunks.shift();
-			if (removed === void 0) break;
-			total -= removed.length;
+		const chunkBytes = Buffer.byteLength(chunk, "utf-8");
+		let retired;
+		if (this.processes.get(entry.taskId) === entry) {
+			entry.outputSizeBytes += chunkBytes;
+			entry.outputChunks.push(chunk);
+			let total = entry.outputChunks.reduce((s, c) => s + c.length, 0);
+			while (total > MAX_OUTPUT_BYTES$1 && entry.outputChunks.length > 1) {
+				const removed = entry.outputChunks.shift();
+				if (removed === void 0) break;
+				total -= removed.length;
+			}
+		} else {
+			retired = this.retiredTasks.get(entry.taskId);
+			if (retired === void 0) return;
+			retired.outputSizeBytes += chunkBytes;
+			this.appendRetiredChunk(retired, chunk);
 		}
 		const outputSessionDir = entry.outputSessionDir;
 		if (outputSessionDir === void 0) return;
 		entry.outputWriteQueue = entry.outputWriteQueue.then(() => appendTaskOutput(outputSessionDir, entry.taskId, chunk)).catch(() => {});
+		if (retired !== void 0) retired.outputWriteQueue = entry.outputWriteQueue;
+	}
+	/**
+	* Append a late post-retirement chunk to the retired tail under the same
+	* `MAX_OUTPUT_BYTES` budget as the live ring: over budget the oldest chunks
+	* are dropped from the head while the newest output is kept. The chunk array
+	* is trimmed in place and joined lazily on read, so one late chunk costs
+	* O(chunk) — never the O(retained) rebuild a per-chunk `text += chunk`
+	* would pay.
+	*/
+	appendRetiredChunk(retired, chunk) {
+		retired.outputChunks.push(chunk);
+		retired.outputTextBytes += Buffer.byteLength(chunk, "utf-8");
+		this.trimRetiredOutput(retired);
+	}
+	/**
+	* Head-trim the retired tail back under `MAX_OUTPUT_BYTES` (tail = newest
+	* output kept), mirroring the live ring's policy. Accounts in UTF-8 bytes
+	* rather than UTF-16 code units so multi-byte output cannot exceed the
+	* budget either.
+	*/
+	trimRetiredOutput(retired) {
+		while (retired.outputTextBytes > MAX_OUTPUT_BYTES$1 && retired.outputChunks.length > 1) {
+			const removed = retired.outputChunks.shift();
+			if (removed === void 0) break;
+			retired.outputTextBytes -= Buffer.byteLength(removed, "utf-8");
+		}
+		if (retired.outputTextBytes > MAX_OUTPUT_BYTES$1) {
+			const only = retired.outputChunks[0];
+			if (only === void 0) return;
+			const tail = utf8ByteTail(only, MAX_OUTPUT_BYTES$1);
+			retired.outputChunks[0] = tail;
+			retired.outputTextBytes = Buffer.byteLength(tail, "utf-8");
+		}
 	}
 	outputSessionDirFor(taskId) {
 		const entry = this.processes.get(taskId);
 		if (entry !== void 0) return entry.outputSessionDir;
+		const retired = this.retiredTasks.get(taskId);
+		if (retired !== void 0) return retired.outputSessionDir;
 		if (this.ghosts.has(taskId)) return this.sessionDir;
 	}
 	async settleProcessExit(entry, exitCode) {
@@ -56215,12 +56446,22 @@ var BackgroundProcessManager = class {
 				await this.persistLive(entry);
 				this.fireTerminalCallbacks(entry);
 				this.resolveWaiters(entry);
+				this.syncRetired(entry);
 			}
 			return;
 		}
 		const status = entry.stopRequested ? "killed" : exitCode === 0 ? "completed" : "failed";
 		await this.finalizeTerminal(entry, status, exitCode);
 	}
+	/** Refresh the retired-ring snapshot after a post-terminal field update. */
+	syncRetired(entry) {
+		const retired = this.retiredTasks.get(entry.taskId);
+		if (retired === void 0) return;
+		this.retiredTasks.set(entry.taskId, {
+			...retired,
+			info: this.toInfo(entry)
+		});
+	}
 	observedExitCompletions() {
 		const completions = [];
 		for (const entry of this.processes.values()) if (!TERMINAL_STATUSES.has(entry.status) && entry.proc.exitCode !== null) completions.push(entry.lifecyclePromise);
@@ -56257,9 +56498,277 @@ var BackgroundProcessManager = class {
 		await this.persistLive(entry);
 		this.fireTerminalCallbacks(entry);
 		this.resolveWaiters(entry);
+		await entry.outputWriteQueue;
+		const retainedChunks = entry.outputChunks.splice(0);
+		const retired = {
+			info: this.toInfo(entry),
+			outputChunks: retainedChunks,
+			outputTextBytes: retainedChunks.reduce((total, chunk) => total + Buffer.byteLength(chunk, "utf-8"), 0),
+			outputSizeBytes: entry.outputSizeBytes,
+			outputSessionDir: entry.outputSessionDir,
+			outputWriteQueue: entry.outputWriteQueue
+		};
+		this.trimRetiredOutput(retired);
+		this.retiredTasks.set(entry.taskId, retired);
+		while (this.retiredTasks.size > RETIRED_TASK_LIMIT) {
+			const oldest = this.retiredTasks.keys().next().value;
+			if (oldest === void 0) break;
+			this.retiredTasks.delete(oldest);
+		}
+		this.processes.delete(entry.taskId);
 		return true;
 	}
 };
+const ESC$2 = "\x1B";
+/**
+* Largest share of a retained tail the boundary rules may discard.
+*
+* Both rules trade content for a head that is whole by construction: rule 1
+* restarts after the next `\n` and drops the torn line, and rule 2 skips the
+* remainder of a torn sequence. The trade only pays while the tail keeps a
+* (non-strict) majority — with one 5000-char line ahead, a 100-unit budget
+* would come back with the few units after it, and the caller asked for the
+* newest output, not for a tidy head. Past the bound the raw cut keeps the
+* content: a string payload stays visible, and a torn CSI or two-byte escape
+* run keeps the fragment it left in view, because skipping that remainder
+* would cost more than the fragment it hides — unless the introducer ESC sits
+* immediately before the head *and* the sequence provably closes, where one
+* unit of look-back keeps the sequence whole and the fragment never surfaces.
+* An unclosed run keeps the raw cut: with no terminator to hand the sanitizer,
+* backing onto its ESC would surface a bare ESC the sanitizer cannot strip.
+*/
+const MAX_TAIL_DROP_SHARE$1 = .5;
+/**
+* `text.slice(-tail)` (clamping exactly like `slice` does for `tail` outside
+* `(0, text.length)`), with the head moved to a boundary no ANSI escape
+* sequence spans, so the first bytes a reader sees are never a torn fragment.
+*/
+function tailSlice(text, tail) {
+	if (tail <= 0 || tail >= text.length) return text;
+	return text.slice(safeTailStart$1(text, text.length - tail));
+}
+/**
+* Move a tail cut point forward to a boundary no ANSI escape sequence spans.
+*
+* A raw `slice(-tail)` can land inside a sequence (`…\u001b[31|m…`), leaving a
+* fragment (`m`, `0m`, `[31`) whose ESC byte was cut away — the TUI sanitizer
+* only recognizes complete sequences, so the fragment renders as text. Two
+* provable rules keep the head clean:
+*
+* 1. Line alignment: a CSI sequence cannot contain `\n` (LF is not a
+*    parameter, intermediate or final byte), so a cut that lands mid-line
+*    restarts after the next `\n`. The only loss is the torn partial line,
+*    whose head cannot be trusted; every escape after the newline is whole.
+*    Bounded by `MAX_TAIL_DROP_SHARE`, so one huge line cannot eat the budget.
+* 2. Torn-sequence skip: when the retained text is one line (no `\n` after
+*    the cut), or an OSC/DCS/PM/APC payload spans the newline the cut aligned
+*    to, the dropped prefix is inspected for a sequence still open at the cut
+*    — a run of CSI body bytes (0x20–0x3F) reaching back to `ESC [`, an `ESC`
+*    whose intermediate bytes were torn (`ESC ( B`), or a string-sequence
+*    opener the cut landed inside. The head then skips exactly the bytes a
+*    terminal would consume for that sequence, so no visible text is dropped —
+*    but only while that skip stays within `MAX_TAIL_DROP_SHARE` of the tail.
+*    A CSI body or escape-intermediate run can be arbitrarily long, so past
+*    the bound the head keeps the newest bytes and the fragment the raw cut
+*    left with them — or one unit earlier, onto an introducer ESC sitting
+*    immediately before the head, so the whole sequence survives and is
+*    stripped (`withinDropShare`) — but only when the skip proved the sequence
+*    closed: an unclosed run keeps the raw cut, because with no terminator to
+*    hand the sanitizer the ESC would surface bare and swallow what follows
+*    it. So does the head for a string that never ends or ended ahead of the
+*    cut. A sliver of the tail is worse than a fragment.
+*
+* The result never splits a surrogate pair, and a non-empty input never comes
+* back empty: the head is never below `cut` (a tail never grows) except in two
+* cases — the cut splits a trailing pair, where dropping the orphan half would
+* empty the tail, so the head backs onto the pair's first half and the last
+* character survives; and a torn sequence's introducer ESC sits immediately
+* before the head *and* the sequence's skip proved it closes, where backing
+* one unit onto it keeps the sequence whole and the fragment is stripped
+* instead of surfaced. An unclosed skip takes the raw cut.
+*/
+function safeTailStart$1(text, cut) {
+	if (cut <= 0 || cut >= text.length) return cut;
+	const tail = text.length - cut;
+	let start = cut;
+	if (text[start - 1] !== "\n") {
+		const newline = text.indexOf("\n", start);
+		if (newline !== -1 && newline + 1 - cut <= tail * MAX_TAIL_DROP_SHARE$1) start = newline + 1;
+	}
+	start = skipOpenEscape$1(text, start);
+	const head = text.codePointAt(start);
+	if (head !== void 0 && head >= 56320 && head <= 57343) return start + 1 < text.length ? start + 1 : start - 1;
+	return start;
+}
+/** CSI parameter (0x30–0x3F) / intermediate (0x20–0x2F) bytes — everything before the final byte. */
+function isCsiBody$1(code) {
+	return code !== void 0 && code >= 32 && code <= 63;
+}
+/** CSI final byte (0x40–0x7E) — the sequence ends here. */
+function isCsiFinal$1(code) {
+	return code !== void 0 && code >= 64 && code <= 126;
+}
+/** OSC / DCS / PM / APC introducers — string sequences ended by BEL or ST. */
+function isStringIntro$1(intro) {
+	return intro === "]" || intro === "P" || intro === "^" || intro === "_";
+}
+/** ESC-intermediate byte (0x20–0x2F) of a two-byte escape sequence. */
+function isEscapeIntermediate$1(code) {
+	return code !== void 0 && code >= 32 && code <= 47;
+}
+/** Final byte (0x30–0x7E) that closes a two-byte escape sequence. */
+function isEscapeFinal$1(code) {
+	return code !== void 0 && code >= 48 && code <= 126;
+}
+/** True when every code point in the half-open range `[from, to)` is an ESC intermediate (0x20–0x2F). */
+function allEscapeIntermediates$1(text, from, to) {
+	for (let i = from; i < to; i += 1) if (!isEscapeIntermediate$1(text.codePointAt(i))) return false;
+	return true;
+}
+/**
+* When the dropped prefix proves an escape sequence is still open at `cut`,
+* return the index after its remainder; otherwise return `cut` unchanged.
+*/
+function skipOpenEscape$1(text, cut) {
+	let run = cut;
+	while (run > 0 && isCsiBody$1(text.codePointAt(run - 1))) run -= 1;
+	if (run >= 2 && text[run - 1] === "[" && text[run - 2] === ESC$2) {
+		const skip = skipCsiRest$1(text, cut);
+		return withinDropShare$1(text, cut, skip.end, skip.closed);
+	}
+	if (text[run - 1] === ESC$2 && allEscapeIntermediates$1(text, run, cut)) return skipEscapeRest$1(text, cut);
+	const open = text.lastIndexOf(ESC$2, cut - 1);
+	if (open !== -1 && isStringIntro$1(text[open + 1])) return stringSequenceHead$1(text, open, cut);
+	return cut;
+}
+/**
+* Keep a provable skip only while it stays within `MAX_TAIL_DROP_SHARE` of the
+* tail that starts at `from`: the skipped bytes are exactly what the reader
+* loses from the tail it asked for. A CSI body or escape-intermediate run can
+* be arbitrarily long, so past the bound the raw cut is worth more than the
+* clean head — except when the sequence's introducer ESC sits immediately
+* before the head (`…\u001b|[31m…`) *and* `closed` says the skip found the
+* sequence's terminator, where one unit of look-back keeps the sequence whole
+* instead: the sanitizer strips it and the visible text is the skip's, for
+* that one unit rather than a sliver of the tail. An unclosed run must keep
+* the raw cut even with that ESC one unit ahead: nothing terminates it, so
+* look-back would hand the reader a bare ESC whose sequence run a terminal
+* swallows along with the bytes behind it.
+*/
+function withinDropShare$1(text, from, target, closed) {
+	if (target - from <= (text.length - from) * MAX_TAIL_DROP_SHARE$1) return target;
+	return closed && from > 0 && text[from - 1] === ESC$2 ? from - 1 : from;
+}
+/**
+* The rest of a CSI sequence whose body was torn at `cut`, with the closure
+* its skip proved: `closed` holds only when a final byte (0x40–0x7E) was
+* actually found, so a parameter run that reaches the end of `text` — or stops
+* on a byte no CSI can end with — reports the sequence as open.
+*/
+function skipCsiRest$1(text, cut) {
+	let end = cut;
+	while (end < text.length && isCsiBody$1(text.codePointAt(end))) end += 1;
+	const closed = end < text.length && isCsiFinal$1(text.codePointAt(end));
+	return {
+		end: closed ? end + 1 : end,
+		closed
+	};
+}
+/** Index after the escape sequence whose introducer ESC sits at `cut - 1`. */
+function skipEscapeRest$1(text, cut) {
+	const intro = text[cut];
+	if (intro === "[") {
+		const skip = skipCsiRest$1(text, cut + 1);
+		return withinDropShare$1(text, cut, skip.end, skip.closed);
+	}
+	if (isStringIntro$1(intro)) return stringSequenceHead$1(text, cut - 1, cut + 1);
+	let end = cut;
+	while (end < text.length && isEscapeIntermediate$1(text.codePointAt(end))) end += 1;
+	const closed = end < text.length && isEscapeFinal$1(text.codePointAt(end));
+	return withinDropShare$1(text, cut, closed ? end + 1 : end, closed);
+}
+/**
+* Head index for a cut that lands inside the string sequence opened at `open`.
+*
+* `stringEnd` gives the byte a terminal stops at; skipping to it hides the
+* payload's remainder, which is what a terminal shows — but only while that
+* costs at most `MAX_TAIL_DROP_SHARE` of the tail. A long OSC 8 URL, or any
+* payload longer than the budget, would otherwise hand the caller a sliver of
+* the tail it asked for; a payload whose extent exceeds the budget stays
+* visible instead. A cut the string already ended ahead of needs no skip, and
+* an unterminated one must not swallow the tail (`stringPayloadHead`).
+*/
+function stringSequenceHead$1(text, open, cut) {
+	const drop = stringEnd$1(text, open + 2) - cut;
+	if (drop >= 0 && drop <= (text.length - cut) * MAX_TAIL_DROP_SHARE$1) return cut + drop;
+	return stringPayloadHead$1(text, open, cut);
+}
+/**
+* Head index that keeps a string sequence's payload visible, moving the cut
+* only past the opener's own bytes when the cut landed inside them.
+*
+* A terminal swallows an unterminated payload, but a viewer must never render
+* a blank body: `tailSlice` backs the tasks-browser tail read, and a log that
+* opens with an unterminated OSC — a run killed mid-title, a truncated write —
+* would otherwise come back empty. The head stays at `cut` unless the cut
+* landed inside the opener (`\u001b]0;` would leave `0;` in front of the
+* payload), and never reaches `text.length` — the clamp to the last unit steps
+* back onto the pair's first half when that unit is a trailing surrogate
+* pair's low half — so the tail is empty only for empty input.
+*/
+function stringPayloadHead$1(text, open, cut) {
+	const head = Math.min(Math.max(cut, stringPayloadStart$1(text, open)), text.length - 1);
+	const code = text.codePointAt(head);
+	return head > 0 && code !== void 0 && code >= 56320 && code <= 57343 ? head - 1 : head;
+}
+/**
+* Index after the byte that ends the string sequence whose payload starts at
+* `from` — its BEL or `ESC \` terminator, or a CAN (0x18) / SUB (0x1A), which
+* a terminal reads as "string over, resume normal parsing". `-1` when the
+* string never ends.
+*/
+function stringEnd$1(text, from) {
+	for (let i = from; i < text.length; i += 1) {
+		const code = text.codePointAt(i);
+		if (code === 7) return i + 1;
+		if (code === 27 && text[i + 1] === "\\") return i + 2;
+		if (code === 24 || code === 26) return i + 1;
+	}
+	return -1;
+}
+/**
+* Index where the payload of the string sequence opened at `open` starts: for
+* OSC after `ESC ] Ps ;`, for DCS/PM/APC after their parameter and
+* intermediate bytes and the final byte that opens the payload.
+*/
+function stringPayloadStart$1(text, open) {
+	let i = open + 2;
+	if (text[open + 1] === "]") {
+		while (i < text.length && isOscParam$1(text.codePointAt(i))) i += 1;
+		if (text[i] === ";") i += 1;
+		return i;
+	}
+	while (i < text.length && isCsiBody$1(text.codePointAt(i))) i += 1;
+	const final = text.codePointAt(i);
+	return i < text.length && isCsiFinal$1(final) ? i + 1 : i;
+}
+/** OSC numeric parameter byte (0x30–0x39) — the `Ps` before the `;` separator. */
+function isOscParam$1(code) {
+	return code !== void 0 && code >= 48 && code <= 57;
+}
+/**
+* Longest suffix of `text` whose UTF-8 encoding fits in `maxBytes`. Encoding
+* through a Buffer keeps lone surrogates accounted as the 3-byte replacement
+* character, and the cut is moved to the next code point boundary (continuation
+* bytes `10xxxxxx` skipped) so the tail never starts mid-sequence.
+*/
+function utf8ByteTail(text, maxBytes) {
+	const encoded = Buffer.from(text, "utf-8");
+	if (encoded.byteLength <= maxBytes) return text;
+	let start = encoded.byteLength - maxBytes;
+	while (start < encoded.byteLength && ((encoded.at(start) ?? 0) & 192) === 128) start += 1;
+	return encoded.subarray(start).toString("utf-8");
+}
 function persistedToInfo(t) {
 	return {
 		taskId: t.task_id,
@@ -59579,7 +60088,7 @@ var agent_background_disabled_default = "Background agent execution is disabled
 var agent_background_enabled_default = "When `run_in_background=true`, the subagent runs detached from this turn. The completion arrives in a later turn as a synthetic user-role message containing its result — you do not need to poll, sleep, or check on its progress. Continue with other work or respond to the user. Never fabricate or predict what the result will say.\n\nWhile it runs, the subagent can ask you questions via `ContactParent`. You will see them at your next step boundary, and a `SendSubagentMessage` reply reaches it mid-run — this is the mode that supports mid-course steering. A foreground subagent's questions, in contrast, only reach you after it completes.\n\nFor a background task, when `timeout` is omitted it falls back to the operator-configured background timeout, if one is set. If the operator has not configured a background timeout, an omitted `timeout` means the task runs with no time limit.\n";
 //#endregion
 //#region ../../packages/agent-core/src/tools/builtin/collaboration/agent.md
-var agent_default = "Launch a subagent to handle a focused task. Prefer this tool over doing the work yourself when the task matches one of the specialists listed below.\n\nSpecialist subagents are listed at the end of this description under \"Available agent types\" — that list is generated from the active profiles and carries each specialist's own USE WHEN / NOT FOR triggers. Read it before choosing a `subagent_type`; never assume a type exists.\n\n## Required prompt structure\n\nThe final prompt sent to the subagent MUST contain these sections. Provide them either by writing them directly into the `prompt` field, or by using the structured `target`, `change`, and `acceptance` fields — they will be appended to `prompt` automatically.\n\n```markdown\n# Target\nExact files, symbols, or directories to touch. Explicit non-goals.\n\n# Change\nStep-by-step what to add, remove, or modify. Include concrete examples when possible.\n\n# Acceptance\nObservable result that proves completion: a passing test, a build command, a specific file content, or a verification step the subagent must run.\n```\n\nOmitting a section causes the subagent to miss context and increases the chance of a wrong or incomplete result.\n\nWriting the prompt:\n- The subagent starts with zero context — it has not seen this conversation. Brief it like a colleague who just walked into the room: state the goal, list what you already know, hand over the specifics.\n- Lookups (read this file, run that test): put the exact path or command in the prompt. The subagent should not have to search for things you already know.\n- Investigations (figure out X, find why Y): give the question, not prescribed steps — fixed steps become dead weight when the premise is wrong.\n- Do not delegate understanding. If the task hinges on a file path or line number, find it yourself first and write it into the prompt.\n- The `Acceptance` section is not optional. The subagent MUST verify against it before returning.\n\nUsage notes:\n- When the task continues earlier work a subagent already did, prefer resuming that agent (pass its `resume` id) over spawning a fresh instance — the resumed agent keeps its prior context.\n- A subagent's result is only visible to you, not to the user. When the user needs to see what a subagent produced, summarize the relevant parts yourself in your own reply.\n\n## Structured output\n\nWhen you need a machine-readable result (not a free-form summary), pass `output_schema` with a JSON Schema string. The subagent is instructed to reply with a single JSON object matching the schema; if the reply parses, it is surfaced as a `[structured]` block in the tool output. Use `output_token_hint` to keep structured replies compact (e.g. 1024 for a schema-shaped answer).\n\nExample:\n```\nAgent(prompt=\"Extract the test commands from this project\", output_schema='{\"type\":\"object\",\"properties\":{\"commands\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}}}}')\n```\n\n## Capability constraints\n\nBy default a subagent gets its profile's full tool set. Pass `capability_mode` to restrict it at the tool level (not just by prompting):\n\n- `read-only` — inspection, search, web/memory lookups, and reporting only. No file writes, no command execution, no spawning further agents.\n- `read-write` — additionally file/memory writes. No command execution, no spawning.\n- `execute` — additionally command execution (bash, python). Still no spawning of further agents.\n- `all` — full profile tool set (default).\n\nRestricted modes also remove `Agent` and `SendSubagentMessage`, so a constrained subagent cannot spawn an unconstrained grandchild to bypass the filter.\n\n## Steering running subagents\n\nUse `SendSubagentMessage` to send a directed message to a subagent you own while it is still running: `steer` for a priority redirection, `queue` for context that applies next turn. A `steer` joins the subagent's running turn at its next step boundary; a `queue` message is delivered when the subagent starts its next turn. Only the owning parent may message a subagent.\n\nWhen NOT to use Agent: skip delegation for trivial one-step work (e.g. reading a known file). Almost everything else is a candidate for delegation.\n\nOnce a subagent is running, leave that scope to it: do not redo its searches or reads in parallel, and do not abandon it midway and finish the job manually. Both undo the context savings the delegation was meant to buy.\n\n## Foreground timeouts auto-background\n\nA `timeout` on a foreground `Agent` call bounds your wait, not the subagent's life. When the deadline fires while the child is still running, it is handed to the background task manager (status: backgrounded) instead of being aborted: the tool returns a `task_id`, its completion notification arrives automatically in a later turn (no polling), and you can peek with `TaskOutput(task_id=..., block=false)` or stop it with `TaskStop`. User cancellation still aborts immediately. A stopped (TaskStop) background task never suggests resume; only tasks that finish or fail on their own are recoverable via `Agent(resume=...)`.";
+var agent_default = "Launch a subagent to handle a focused task. Prefer this tool over doing the work yourself when the task matches one of the specialists listed below.\n\nSpecialist subagents are listed at the end of this description under \"Available agent types\" — that list is generated from the active profiles and carries each specialist's own USE WHEN / NOT FOR triggers. Read it before choosing a `subagent_type`; never assume a type exists.\n\n## Required prompt structure\n\nThe final prompt sent to the subagent MUST contain these sections. Provide them either by writing them directly into the `prompt` field, or by using the structured `target`, `change`, and `acceptance` fields — they will be appended to `prompt` automatically.\n\n```markdown\n# Target\nExact files, symbols, or directories to touch. Explicit non-goals.\n\n# Change\nStep-by-step what to add, remove, or modify. Include concrete examples when possible.\n\n# Acceptance\nObservable result that proves completion: a passing test, a build command, a specific file content, or a verification step the subagent must run.\n```\n\nOmitting a section causes the subagent to miss context and increases the chance of a wrong or incomplete result.\n\nWriting the prompt:\n- The subagent starts with zero context — it has not seen this conversation. Brief it like a colleague who just walked into the room: state the goal, list what you already know, hand over the specifics.\n- Lookups (read this file, run that test): put the exact path or command in the prompt. The subagent should not have to search for things you already know.\n- Investigations (figure out X, find why Y): give the question, not prescribed steps — fixed steps become dead weight when the premise is wrong.\n- Do not delegate understanding. If the task hinges on a file path or line number, find it yourself first and write it into the prompt.\n- The `Acceptance` section is not optional. The subagent MUST verify against it before returning.\n\nUsage notes:\n- When the task continues earlier work a subagent already did, prefer resuming that agent (pass its `resume` id) over spawning a fresh instance — the resumed agent keeps its prior context.\n- A subagent's result is only visible to you, not to the user. When the user needs to see what a subagent produced, summarize the relevant parts yourself in your own reply.\n\n## Structured output\n\nWhen you need a machine-readable result (not a free-form summary), pass `output_schema` with a JSON Schema string. The subagent is instructed to reply with a single JSON object matching the schema; if the reply parses, it is surfaced as a `[structured]` block in the tool output. Use `output_token_hint` to keep structured replies compact (e.g. 1024 for a schema-shaped answer).\n\nExample:\n```\nAgent(prompt=\"Extract the test commands from this project\", output_schema='{\"type\":\"object\",\"properties\":{\"commands\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}}}}')\n```\n\n## Capability constraints\n\nBy default a subagent gets its profile's full tool set. Pass `capability_mode` to restrict it at the tool level (not just by prompting):\n\n- `read-only` — inspection, search, web/memory lookups, and reporting only. No file writes, no command execution, no spawning further agents.\n- `read-write` — additionally file/memory writes. No command execution, no spawning.\n- `execute` — additionally command execution (bash, python). Still no spawning of further agents.\n- `all` — full profile tool set (default).\n\nRestricted modes also remove `Agent` and `SendSubagentMessage`, so a constrained subagent cannot spawn an unconstrained grandchild to bypass the filter.\n\nResume clamps the contract — it can only tighten, never widen. A resumed agent keeps the tool set it was spawned with (its profile is not rebuilt), so a wider `capability_mode` than the one it already carries is ignored, and a stored restriction is re-applied on the resumed instance. To hand a subagent more tools, spawn a fresh one.\n\n## Steering running subagents\n\nUse `SendSubagentMessage` to send a directed message to a subagent you own while it is still running: `steer` for a priority redirection, `queue` for context that applies next turn. A `steer` joins the subagent's running turn at its next step boundary; a `queue` message is delivered when the subagent starts its next turn. When the correction cannot wait for a checkpoint, use `interject`: it interrupts the tools running at that moment (side-effecting commands included, and pending approvals are withdrawn) so the message lands at the very next step. Only the owning parent may message a subagent.\n\nWhen NOT to use Agent: skip delegation for trivial one-step work (e.g. reading a known file). Almost everything else is a candidate for delegation.\n\nOnce a subagent is running, leave that scope to it: do not redo its searches or reads in parallel, and do not abandon it midway and finish the job manually. Both undo the context savings the delegation was meant to buy.\n\n## Foreground timeouts auto-background\n\nA `timeout` on a foreground `Agent` call bounds your wait, not the subagent's life. When the deadline fires while the child is still running, it is handed to the background task manager (status: backgrounded) instead of being aborted: the tool returns a `task_id`, its completion notification arrives automatically in a later turn (no polling), and you can peek with `TaskOutput(task_id=..., block=false)` or stop it with `TaskStop`. User cancellation still aborts immediately. A stopped (TaskStop) background task never suggests resume; only tasks that finish or fail on their own are recoverable via `Agent(resume=...)`.";
 //#endregion
 //#region ../../packages/agent-core/src/tools/builtin/collaboration/agent.ts
 /**
@@ -59624,7 +60133,7 @@ const AgentToolInputSchema = z.preprocess((input) => {
 		"read-write",
 		"execute",
 		"all"
-	]).optional().describe("Runtime capability contract for the subagent. read-only: may inspect but not modify the workspace. read-write: may read and edit files but not run arbitrary commands. execute: may additionally run commands. all: full tool access (default). Restricted modes strip the child tool set at runtime (including MCP and spawning tools) — the constraint is enforced, not just prompted. The parent remains the final gate.")
+	]).optional().describe("Runtime capability contract for the subagent. read-only: may inspect but not modify the workspace. read-write: may read and edit files but not run arbitrary commands. execute: may additionally run commands. all: full tool access (default). Restricted modes strip the child tool set at runtime (including MCP and spawning tools) — the constraint is enforced, not just prompted. The parent remains the final gate. On resume the contract can only tighten: a resumed agent keeps the tool set it already has, so a mode wider than the one it was spawned with is ignored — spawn a fresh subagent for a wider contract.")
 }));
 z.object({
 	result: z.string().describe("Aggregated text output from the subagent"),
@@ -60333,23 +60842,29 @@ function formatFindingsBlock(findings) {
 }
 //#endregion
 //#region ../../packages/agent-core/src/tools/builtin/collaboration/send-subagent-message.md
-var send_subagent_message_default = "# SendSubagentMessage\n\nSend a directed message to a subagent you own. Use this to steer or inform a\nsubagent between its turns — for example, to redirect it after new\ninformation arrives, or to hand it a correction while it is still running.\n\n- **queue**: delivered when the subagent starts its next turn, after any steer\n  messages. Use for context that does not change the immediate direction.\n- **steer**: delivered into the subagent's running turn, where it joins at the\n  subagent's next step boundary; if no turn is running it waits in the mailbox\n  and is delivered first at the next turn start. Use for a redirection that\n  should reach the subagent while it is still working.\n\n## Rules\n\n- You may only message subagents you spawned. Messaging a subagent owned by a\n  different agent is refused.\n- A subagent cannot message itself.\n- No message aborts a tool call that is already in flight: a steer joins the\n  running turn at its next step boundary, a queue message waits for the next\n  turn start.\n- The acknowledgement says which path the message took. \"queued\" means it has\n  not reached the subagent yet.\n- Keep messages short and unambiguous. The subagent sees them as a\n  `[parent_messages]` block — merged into its running turn at the next step\n  boundary, or at the top of its next prompt when the message waited for a turn\n  start.\n- Prefer steering the *goal*, not the implementation: tell the subagent what\n  changed and what to reconsider, not how to rewrite its code.\n- This tool is available only to agents that may spawn subagents. Subagents\n  launched with a restricted `capability_mode` (read-only / read-write /\n  execute) do not have this tool — they cannot send messages or spawn further\n  agents, which keeps the capability filter from being bypassed.\n";
+var send_subagent_message_default = "# SendSubagentMessage\n\nSend a directed message to a subagent you own. Use this to steer or inform a\nsubagent between its turns — for example, to redirect it after new\ninformation arrives, or to hand it a correction while it is still running.\n\n- **queue**: delivered when the subagent starts its next turn, after any steer\n  messages. Use for context that does not change the immediate direction.\n- **steer**: delivered into the subagent's running turn, where it joins at the\n  subagent's next step boundary; if no turn is running it waits in the mailbox\n  and is delivered first at the next turn start. Use for a redirection that\n  should reach the subagent while it is still working.\n- **interject**: like steer, but it also interrupts the tool call the subagent\n  currently has in flight, so the correction takes effect immediately instead\n  of after a long wait. Use it when the subagent is stuck in — or about to\n  outlive the value of — a running command, and you already know what it\n  should do instead. This is a batch-level hammer, not a single-call cancel:\n  every tool that observes the abort signal is cut short (side-effecting\n  commands included), approvals still waiting for an answer are withdrawn, and\n  the abort travels down the signal chain into any foreground grandchild the\n  batch is waiting on. The RLM Python kernel observes the signal too: a long\n  exec is interrupted through the same SIGINT route, the running statement is\n  unwound and the kernel keeps its state (variables survive; a kernel that does\n  not return to an idle prompt is restarted instead). An interject aimed at an\n  idle or structured-output subagent degrades to the steer/mailbox path.\n\n## Rules\n\n- You may only message subagents you spawned. Messaging a subagent owned by a\n  different agent is refused.\n- A subagent cannot message itself.\n- `queue` and `steer` never abort a tool call that is already in flight: a\n  steer joins the running turn at its next step boundary, a queue message waits\n  for the next turn start. Only `interject` interrupts the in-flight batch —\n  the interrupted tool reports the interruption, so the subagent knows the\n  result is missing and why.\n- The acknowledgement says which path the message took. \"queued\" means it has\n  not reached the subagent yet; \"interjected\" means the in-flight batch was cut\n  short.\n- Keep messages short and unambiguous. The subagent sees them as a\n  `[parent_messages]` block — merged into its running turn at the next step\n  boundary, or at the top of its next prompt when the message waited for a turn\n  start.\n- Prefer steering the *goal*, not the implementation: tell the subagent what\n  changed and what to reconsider, not how to rewrite its code.\n- Do not use this tool to stop a subagent: a message is never a cancellation.\n  To end its work use `TaskStop` (background tasks) or let the turn finish.\n- Do not use this tool to collect results: a subagent's completion arrives on\n  its own as a notification (or as the `Agent` tool's return value in the\n  foreground). Wait for that instead of polling.\n- This tool is available only to agents that may spawn subagents. Subagents\n  launched with a restricted `capability_mode` (read-only / read-write /\n  execute) do not have this tool — they cannot send messages or spawn further\n  agents, which keeps the capability filter from being bypassed.\n";
 //#endregion
 //#region ../../packages/agent-core/src/tools/builtin/collaboration/send-subagent-message.ts
 /**
 * SendSubagentMessageTool — parent→child directed-message tool.
 *
-* The parent agent uses this to steer or queue a message to one of its own
-* subagents. A steer aimed at a child whose turn is running is injected into
-* that turn and joins at the child's next step boundary; every other message
-* waits in the session-level SubagentMessageBus (FIFO within an operation
-* class; steer precedes queue) and is injected into the child's prompt at its
-* next turn start. A child can never send to itself, and a message addressed to
-* a child owned by a different parent is refused as not_owned.
+* The parent agent uses this to steer, interject into, or queue a message to
+* one of its own subagents. A steer aimed at a child whose turn is running is
+* injected into that turn and joins at the child's next step boundary; an
+* interject does the same but also interrupts the tool batch in flight; every
+* other message waits in the session-level SubagentMessageBus (FIFO within an
+* operation class; steer precedes queue) and is injected into the child's
+* prompt at its next turn start. A child can never send to itself, and a
+* message addressed to a child owned by a different parent is refused as
+* not_owned.
 */
 const SendSubagentMessageInputSchema = z.object({
 	agent_id: z.string().min(1).describe("Agent id of the target subagent, as returned by Agent."),
-	operation: z.enum(["queue", "steer"]).describe("queue: delivered when the subagent starts its next turn, after any steer messages. steer: delivered into the subagent's running turn at its next step boundary, or first in the mailbox if no turn is running."),
+	operation: z.enum([
+		"queue",
+		"steer",
+		"interject"
+	]).describe("queue: delivered when the subagent starts its next turn, after any steer messages. steer: delivered into the subagent's running turn at its next step boundary, or first in the mailbox if no turn is running. interject: like steer, but also interrupts the tool call the subagent has in flight right now — use it to correct a subagent stuck in a long wait; it falls back to the mailbox when no turn is running."),
 	message: z.string().min(1).max(16384).describe("Message to deliver to the subagent.")
 });
 const STATUS_TO_TEXT = {
@@ -60361,6 +60876,7 @@ const STATUS_TO_TEXT = {
 };
 const ACCEPTED_TEXT = {
 	"mid-run": "Message accepted and delivered into the subagent's running turn; it joins at the subagent's next step boundary.",
+	interjected: "Message accepted and interjected: the subagent's in-flight tool batch was interrupted so the message takes effect immediately.",
 	queued: "Message accepted and queued; it is delivered when the subagent starts its next turn."
 };
 var SendSubagentMessageTool = class {
@@ -61396,7 +61912,7 @@ var KnowledgeLookupTool = class {
 				const llm = { generate: async (systemPrompt, userPrompt) => {
 					return this.agent.generateText(systemPrompt, userPrompt);
 				} };
-				const { multiSearchWithTrace } = await import("./src-CUURS-i6.mjs");
+				const { multiSearchWithTrace } = await import("./src-qit_jRUM.mjs");
 				const { results, trace } = await multiSearchWithTrace(store, llm, query, {
 					topK,
 					skipLlm: args.deep !== true
@@ -61494,7 +62010,7 @@ var ApiError = class extends Error {
 		this.name = "ApiError";
 	}
 };
-function isPlaceholder(value) {
+function isPlaceholder$1(value) {
 	const trimmed = value.trim();
 	return trimmed.length === 0 || trimmed.includes("replace-with") || trimmed.startsWith("<") && trimmed.endsWith(">");
 }
@@ -61516,11 +62032,11 @@ async function loadConfig(screamHomeDir) {
 	try {
 		const text = await readFile(join$1(screamHomeDir, "image-config.json"), "utf8");
 		const parsed = JSON.parse(text);
-		const legacyUrl = typeof parsed.base_url === "string" && !isPlaceholder(parsed.base_url) ? `${normalizeUrl(parsed.base_url)}${GENERATIONS_SUFFIX}` : "";
-		const urlRaw = typeof parsed.url === "string" && !isPlaceholder(parsed.url) ? parsed.url : legacyUrl;
-		if (urlRaw.length === 0 || typeof parsed.api_key !== "string" || typeof parsed.model !== "string" || isPlaceholder(parsed.api_key)) return;
-		const legacyEdit = typeof parsed.edit_base_url === "string" && !isPlaceholder(parsed.edit_base_url) ? `${normalizeUrl(parsed.edit_base_url)}${EDITS_SUFFIX}` : "";
-		const editUrlRaw = typeof parsed.edit_url === "string" && !isPlaceholder(parsed.edit_url) ? parsed.edit_url : legacyEdit;
+		const legacyUrl = typeof parsed.base_url === "string" && !isPlaceholder$1(parsed.base_url) ? `${normalizeUrl(parsed.base_url)}${GENERATIONS_SUFFIX}` : "";
+		const urlRaw = typeof parsed.url === "string" && !isPlaceholder$1(parsed.url) ? parsed.url : legacyUrl;
+		if (urlRaw.length === 0 || typeof parsed.api_key !== "string" || typeof parsed.model !== "string" || isPlaceholder$1(parsed.api_key)) return;
+		const legacyEdit = typeof parsed.edit_base_url === "string" && !isPlaceholder$1(parsed.edit_base_url) ? `${normalizeUrl(parsed.edit_base_url)}${EDITS_SUFFIX}` : "";
+		const editUrlRaw = typeof parsed.edit_url === "string" && !isPlaceholder$1(parsed.edit_url) ? parsed.edit_url : legacyEdit;
 		const editModelRaw = typeof parsed.edit_model === "string" ? parsed.edit_model : "";
 		return {
 			provider: typeof parsed.provider === "string" ? parsed.provider : "openai-compatible",
@@ -70249,7 +70765,7 @@ var GlobTool = class {
 		if (startsWithDoubleStarPrefix(args.pattern)) {
 			let tree;
 			try {
-				tree = await listDirectory(this.jian, this.workspace.workspaceDir);
+				tree = await listDirectory(this.jian, this.workspace.workspaceDir, signal);
 			} catch {
 				tree = "(listing unavailable)";
 			}
@@ -70262,7 +70778,7 @@ var GlobTool = class {
 			const rootList = [this.workspace.workspaceDir, ...this.workspace.additionalDirs].map((d) => `  - ${d}`).join("\n");
 			let tree;
 			try {
-				tree = await listDirectory(this.jian, this.workspace.workspaceDir);
+				tree = await listDirectory(this.jian, this.workspace.workspaceDir, signal);
 			} catch {
 				tree = "(listing unavailable)";
 			}
@@ -70277,7 +70793,10 @@ var GlobTool = class {
 		};
 		const includeDirs = args.include_dirs ?? true;
 		for (const root of searchRoots) try {
-			const iter = this.jian.iterdir(root);
+			const iter = this.jian.iterdir(root, {
+				signal,
+				maxEntries: 1
+			});
 			await iter.next();
 			if (typeof iter.return === "function") await iter.return(void 0);
 		} catch (error) {
@@ -70304,7 +70823,8 @@ var GlobTool = class {
 			const exclude = globExcludesForPattern(args.pattern);
 			outer: for (const root of searchRoots) for await (const filePath of this.jian.glob(root, args.pattern, {
 				allowedRoots: [root],
-				exclude
+				exclude,
+				signal
 			})) {
 				yielded++;
 				if (signal && yielded % 128 === 0) signal.throwIfAborted();
@@ -70331,6 +70851,7 @@ var GlobTool = class {
 					mtime
 				});
 			}
+			signal?.throwIfAborted();
 			entries.sort((a, b) => b.mtime - a.mtime);
 			const paths = entries.map((e) => e.path);
 			const pathClass = this.jian.pathClass();
@@ -74261,11 +74782,15 @@ async function runRipgrepOnce(jian, rgArgs, signal) {
 			await proc.kill("SIGTERM");
 		} catch {}
 		const exited = proc.wait().then(() => true).catch(() => true);
-		if (!await Promise.race([exited, new Promise((resolve) => {
-			setTimeout(() => {
+		let graceTimer;
+		const raced = await Promise.race([exited, new Promise((resolve) => {
+			graceTimer = setTimeout(() => {
 				resolve(false);
 			}, SIGTERM_GRACE_MS$1);
-		})]) && proc.exitCode === null) try {
+			graceTimer.unref?.();
+		})]);
+		if (graceTimer !== void 0) clearTimeout(graceTimer);
+		if (!raced && proc.exitCode === null) try {
 			await proc.kill("SIGKILL");
 		} catch {}
 	};
@@ -75028,7 +75553,7 @@ function escapeGlobMetachars(value) {
 	return value.replaceAll(/[*?[{]/g, "[$&]");
 }
 async function findUniqueSuffixMatch(rawPath, searchRoot, jian, cache) {
-	const normalized = rawPath.replaceAll(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+	const normalized = rawPath.replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/+$/, "");
 	if (!normalized) return null;
 	if (cache !== void 0) {
 		const hit = cache.get(rawPath);
@@ -75036,16 +75561,24 @@ async function findUniqueSuffixMatch(rawPath, searchRoot, jian, cache) {
 	}
 	const pattern = `**/${escapeGlobMetachars(normalized)}`;
 	const matches = [];
+	const controller = new AbortController();
 	let timer;
 	try {
 		const globPromise = (async () => {
-			for await (const filePath of jian.glob(searchRoot, pattern, { allowedRoots: [searchRoot] })) {
+			for await (const filePath of jian.glob(searchRoot, pattern, {
+				allowedRoots: [searchRoot],
+				signal: controller.signal
+			})) {
 				matches.push(filePath);
 				if (matches.length > 1) break;
 			}
 		})();
+		globPromise.catch(() => {});
 		const timeoutPromise = new Promise((resolve) => {
-			timer = setTimeout(resolve, SUFFIX_MATCH_TIMEOUT_MS);
+			timer = setTimeout(() => {
+				controller.abort();
+				resolve();
+			}, SUFFIX_MATCH_TIMEOUT_MS);
 			timer.unref?.();
 		});
 		await Promise.race([globPromise, timeoutPromise]);
@@ -75233,10 +75766,10 @@ var ReadTool = class {
 				pathClass: this.jian.pathClass(),
 				homeDir: this.jian.gethome()
 			}),
-			execute: () => this.execution(args, path)
+			execute: ({ signal }) => this.execution(args, path, signal)
 		};
 	}
-	async trySuffixMatchRead(args) {
+	async trySuffixMatchRead(args, signal) {
 		const suffixMatch = await findUniqueSuffixMatch(args.path, this.workspace.workspaceDir, this.jian);
 		if (suffixMatch === null) return null;
 		try {
@@ -75245,12 +75778,12 @@ var ReadTool = class {
 			return null;
 		}
 		const notice = suffixResolutionNotice(args.path, suffixMatch.displayPath);
-		return prependNotice(await this.execution(args, suffixMatch.absolutePath, true), notice);
+		return prependNotice(await this.execution(args, suffixMatch.absolutePath, signal, true), notice);
 	}
-	async fileNotFoundResult(displayPath) {
+	async fileNotFoundResult(displayPath, signal) {
 		let tree;
 		try {
-			tree = await listDirectory(this.jian, this.workspace.workspaceDir);
+			tree = await listDirectory(this.jian, this.workspace.workspaceDir, signal);
 		} catch {
 			tree = "(listing unavailable)";
 		}
@@ -75259,7 +75792,8 @@ var ReadTool = class {
 			output: `"${displayPath}" does not exist.\n\nTop of ${this.workspace.workspaceDir}:\n${tree}`
 		};
 	}
-	async execution(args, safePath, suffixResolved = false) {
+	async execution(args, safePath, signal, suffixResolved = false) {
+		signal?.throwIfAborted();
 		try {
 			let stat;
 			try {
@@ -75267,10 +75801,10 @@ var ReadTool = class {
 			} catch (error) {
 				if (isFileNotFoundError(error)) {
 					if (!suffixResolved) {
-						const resolved = await this.trySuffixMatchRead(args);
+						const resolved = await this.trySuffixMatchRead(args, signal);
 						if (resolved !== null) return resolved;
 					}
-					return await this.fileNotFoundResult(args.path);
+					return await this.fileNotFoundResult(args.path, signal);
 				}
 				throw error;
 			}
@@ -75290,9 +75824,10 @@ var ReadTool = class {
 			const lineOffset = args.line_offset ?? 1;
 			const requestedLines = args.n_lines ?? 1e3;
 			const effectiveLimit = Math.min(requestedLines, MAX_LINES);
-			if (lineOffset < 0) return await this.readTail(safePath, args.path, lineOffset, effectiveLimit, requestedLines);
-			return await this.readForward(safePath, args.path, lineOffset, effectiveLimit, requestedLines);
+			if (lineOffset < 0) return await this.readTail(safePath, args.path, lineOffset, effectiveLimit, requestedLines, signal);
+			return await this.readForward(safePath, args.path, lineOffset, effectiveLimit, requestedLines, signal);
 		} catch (error) {
+			if (signal?.aborted) throw error;
 			if (isTextDecodeError(error)) return {
 				isError: true,
 				output: notReadableFileOutput(args.path)
@@ -75303,7 +75838,7 @@ var ReadTool = class {
 			};
 		}
 	}
-	async readForward(safePath, displayPath, lineOffset, effectiveLimit, requestedLines) {
+	async readForward(safePath, displayPath, lineOffset, effectiveLimit, requestedLines, signal) {
 		const selectedEntries = [];
 		const flags = {
 			hasCrLf: false,
@@ -75315,7 +75850,10 @@ var ReadTool = class {
 		let currentLineNo = 0;
 		let maxLinesReached = false;
 		let collectionClosed = false;
-		for await (const rawLine of this.jian.readLines(safePath, { errors: "strict" })) {
+		for await (const rawLine of this.jian.readLines(safePath, {
+			errors: "strict",
+			signal
+		})) {
 			if (containsNulByte(rawLine)) return {
 				isError: true,
 				output: notReadableFileOutput(displayPath)
@@ -75340,6 +75878,7 @@ var ReadTool = class {
 			});
 			if (selectedEntries.length >= effectiveLimit) collectionClosed = true;
 		}
+		signal?.throwIfAborted();
 		const lineEndingStyle = lineEndingStyleFromFlags(flags);
 		const anchor = (lineEndingStyle === "crlf" ? normalizedHash : rawHash).digest("hex").slice(0, 8);
 		const renderedLines = [];
@@ -75373,7 +75912,7 @@ var ReadTool = class {
 			anchor
 		});
 	}
-	async readTail(safePath, displayPath, lineOffset, effectiveLimit, requestedLines) {
+	async readTail(safePath, displayPath, lineOffset, effectiveLimit, requestedLines, signal) {
 		const tailCount = Math.abs(lineOffset);
 		const entries = [];
 		const flags = {
@@ -75384,7 +75923,10 @@ var ReadTool = class {
 		const rawHash = createHash("sha256");
 		const normalizedHash = createHash("sha256");
 		let currentLineNo = 0;
-		for await (const rawLine of this.jian.readLines(safePath, { errors: "strict" })) {
+		for await (const rawLine of this.jian.readLines(safePath, {
+			errors: "strict",
+			signal
+		})) {
 			if (containsNulByte(rawLine)) return {
 				isError: true,
 				output: notReadableFileOutput(displayPath)
@@ -75399,6 +75941,7 @@ var ReadTool = class {
 			});
 			if (entries.length > tailCount) entries.shift();
 		}
+		signal?.throwIfAborted();
 		const lineEndingStyle = lineEndingStyleFromFlags(flags);
 		const anchor = (lineEndingStyle === "crlf" ? normalizedHash : rawHash).digest("hex").slice(0, 8);
 		let renderedCandidates = entries.slice(0, effectiveLimit).map((entry) => {
@@ -77268,7 +77811,51 @@ function projectInfo(info) {
 }
 //#endregion
 //#region ../../packages/agent-core/src/tools/builtin/python/python.ts
-const PY_DONE_MARKER = "__SCREAM_PY_DONE__";
+/**
+* Channel markers of the kernel↔host protocol. Every marker carries the
+* instance nonce, so (a) two PythonTool instances can never cross-hit each
+* other's markers and (b) user code printing an old-style literal such as
+* `__SCREAM_PY_DONE__` can never finish a read early or poison the next scan —
+* only this instance's nonce-bearing marker counts.
+*/
+function kernelMarkers(nonce) {
+	return {
+		done: `__SCREAM_PY_DONE_${nonce}__`,
+		boot: `__SCREAM_BOOT_DONE_${nonce}__`,
+		sync: `__SCREAM_SYNC_${nonce}__`,
+		error: `__SCREAM_PY_ERROR_${nonce}__`
+	};
+}
+/** Every bridge reply/state file this tool family owns shares this tmpdir prefix. */
+const REPLY_FILE_PREFIX = "scream-rlm-";
+/** A file this tool family owns is swept once it is older than this. */
+const REPLY_FILE_MAX_AGE_MS = 1440 * 6e4;
+/** True when a pid is still alive (signal-0 probe; EPERM means it exists but
+* belongs to another user). */
+function isProcessAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+}
+/** Who fired the abort that settled an interrupted call — mirrors BashTool:
+* a parent agent's interject must not be reported as a user stop. */
+function interruptedBy$1(signal) {
+	return signal !== void 0 && isParentInterject(signal.reason) ? "the parent agent" : "user";
+}
+/**
+* True when the signal has fired (an absent signal never aborts).
+*
+* Deliberately a function, not an inline `signal?.aborted === true` check:
+* repeated inline checks on the same property trip TS2367, because the first
+* check narrows the property to `false` for the rest of the scope even though
+* an await in between can flip it.
+*/
+function isAborted$1(signal) {
+	return signal !== void 0 && signal.aborted;
+}
 /** Head/tail output cap for python tool results — mirrors the generic tool
 * result builder (50k chars, 20k tail) so a runaway print loop cannot balloon
 * the snapshot into memory/TUI exhaustion. */
@@ -77282,19 +77869,67 @@ function truncateOutput$1(output) {
 const DEFAULT_TIMEOUT_MS = 6e4;
 const MAX_TIMEOUT_MS = 5 * 6e4;
 const KERNEL_START_TIMEOUT_MS = 3e4;
+/** SIGINT grace when an interrupted call must return the kernel to its prompt
+* (timeout or abort) before the host decides it is hung and restarts it. */
+const INTERRUPT_GRACE_MS = 1500;
 const PythonInputSchema = z.object({
-	code: z.string().min(1).describe("Python code to execute in the persistent kernel. Variables, imports, and loaded data persist across calls, unlike Bash. State is kept for the whole session while the /rlm mode is enabled."),
+	code: z.string().min(1).describe("Python code to execute in the persistent kernel. Variables and plain data persist across calls, unlike Bash; imports, functions, and live objects are NOT restored if the kernel restarts, so re-run them after a restart. State is kept for the whole session while the /rlm mode is enabled."),
 	timeout: z.number().int().positive().max(MAX_TIMEOUT_MS / 1e3).optional().describe("Execution timeout in seconds (default 60, max 300).")
 });
-const RLM_BOOTSTRAP_PY = `import json, os, sys, tempfile, time, itertools, pickle
+const RLM_BOOTSTRAP_PY = `import json, os, sys, tempfile, time, itertools, pickle, threading
 _RLM_ID = itertools.count(1)
 _SNAP = __SNAP_PATH__
+_SNAP_LIMIT = __SNAP_LIMIT__
+_NONCE = "__NONCE__"
+_WARNED = set()
+_PENDING_WARNINGS = []
+
+def _warn(msg):
+    # Kernel-scoped, deduped warnings. They are queued here and flushed by the
+    # host at the start of the NEXT call, so a warning about the state left by
+    # this call never contaminates this call's own output.
+    if msg in _WARNED:
+        return
+    _WARNED.add(msg)
+    _PENDING_WARNINGS.append(msg)
+
+def _flush_warnings():
+    if _PENDING_WARNINGS:
+        msgs = list(_PENDING_WARNINGS)
+        del _PENDING_WARNINGS[:]
+        for m in msgs:
+            try:
+                print("\\u26a0 RLM: " + m)
+            except Exception:
+                try:
+                    print("RLM: " + m)
+                except Exception:
+                    pass
+
+def _scream_background_error(fallback_hook, payload):
+    # Background threads / unretrieved futures raise outside the exec wrapper,
+    # so their tracebacks reach stderr without the wrapper's error marker.
+    # Emit the marker here too, then delegate to the default hook so the
+    # traceback still lands on stderr.
+    try:
+        print(_ERROR_MARKER)
+    except Exception:
+        pass
+    fallback_hook(payload)
+
+_ERROR_MARKER = "__SCREAM_PY_ERROR_" + _NONCE + "__"
+_DEFAULT_THREAD_HOOK = getattr(threading, "__excepthook__", None)
+if _DEFAULT_THREAD_HOOK is not None:
+    threading.excepthook = lambda args: _scream_background_error(_DEFAULT_THREAD_HOOK, args)
+_DEFAULT_UNRAISABLE_HOOK = getattr(sys, "__unraisablehook__", None)
+if _DEFAULT_UNRAISABLE_HOOK is not None:
+    sys.unraisablehook = lambda unraisable: _scream_background_error(_DEFAULT_UNRAISABLE_HOOK, unraisable)
 
 def _host_request(method, payload, timeout=120):
     rid = next(_RLM_ID)
     sys.stdout.write(json.dumps({"type": "host_request", "id": rid, "method": method, "payload": payload}) + "\\n")
     sys.stdout.flush()
-    reply_file = os.path.join(tempfile.gettempdir(), "scream-rlm-" + str(os.getpid()) + "-" + str(rid) + ".json")
+    reply_file = os.path.join(tempfile.gettempdir(), "scream-rlm-" + _NONCE + "-" + str(os.getpid()) + "-" + str(rid) + ".json")
     deadline = time.time() + timeout
     while time.time() < deadline:
         if os.path.exists(reply_file):
@@ -77330,8 +77965,17 @@ def _snapshot(path=_SNAP):
         except Exception:
             pass
     try:
-        with open(path, "wb") as f:
-            pickle.dump(saved, f)
+        data = pickle.dumps(saved)
+    except Exception:
+        return 0
+    if len(data) > _SNAP_LIMIT:
+        _warn("state exceeds the " + str(_SNAP_LIMIT) + "-byte snapshot limit; it stays in the running kernel but will not survive a restart")
+        return 0
+    try:
+        # 0o600 keeps the snapshot private on POSIX; Windows ignores the mode.
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        with os.fdopen(fd, "wb") as f:
+            f.write(data)
         return len(saved)
     except Exception:
         return 0
@@ -77342,7 +77986,8 @@ def _restore(path=_SNAP):
     try:
         with open(path, "rb") as f:
             saved = pickle.load(f)
-    except Exception:
+    except Exception as e:
+        _warn("snapshot restore failed (" + type(e).__name__ + "); state from the previous kernel was not restored")
         return 0
     for k, v in saved.items():
         globals()[k] = v
@@ -77351,26 +77996,38 @@ def _restore(path=_SNAP):
 _restore()
 `;
 /** Builds the single-line bootstrap exec for this tool instance, embedding
-* the snapshot path so each PythonTool has its own persistent state file. */
-function buildRlmBootstrap(snapshotPath) {
-	const py = RLM_BOOTSTRAP_PY.replace("__SNAP_PATH__", JSON.stringify(snapshotPath));
-	return `exec(__import__('base64').b64decode('${Buffer.from(py).toString("base64")}').decode())\nprint("__SCREAM_BOOT_DONE__")`;
+* the snapshot path, the snapshot byte cap, and the instance nonce that
+* namespaces reply files and channel markers. */
+function buildRlmBootstrap(snapshotPath, nonce, snapshotByteLimit) {
+	const py = RLM_BOOTSTRAP_PY.replace("__SNAP_PATH__", JSON.stringify(snapshotPath)).replace("__SNAP_LIMIT__", String(snapshotByteLimit)).replace("__NONCE__", nonce);
+	return `exec(__import__('base64').b64decode('${Buffer.from(py).toString("base64")}').decode())\nprint("${kernelMarkers(nonce).boot}")`;
 }
 /**
 * Executes Python code in a persistent interactive kernel (`python3 -u -i`
 * over a pipe). The kernel process is lazily started on first use and lives
-* for the lifetime of this tool instance (the /rlm session), so variables,
-* imports, and loaded data survive across calls — unlike the stateless Bash
-* tool. Runs under the normal permission mode like any other tool; the code
-* can read/write files, so it is gated exactly like a mutating tool.
+* for the lifetime of this tool instance (the /rlm session), so variables and
+* loaded data survive across calls — unlike the stateless Bash tool. Imports
+* and functions are not restored after a kernel restart (only plain data is,
+* from the snapshot). Runs under the normal permission mode like any other
+* tool; the code can read/write files, so it is gated exactly like a mutating
+* tool.
 */
 var PythonTool = class PythonTool {
-	cwd;
 	options;
+	/** Serialized-snapshot byte cap: state larger than this is not written to
+	* disk (writing it would block the kernel and risk OOM); the next call
+	* reports the skipped snapshot through a one-shot warning. */
+	static SNAPSHOT_BYTE_LIMIT = 32 * 1024 * 1024;
 	name = "python";
 	description;
 	parameters = toInputJsonSchema(PythonInputSchema);
+	/** Working directory the kernel runs in. Readable so the tool registry can
+	* reuse a live instance across rebuilds only while the cwd is unchanged. */
+	cwd;
 	kernel;
+	/** In-flight startKernel() promise — concurrent callers share one spawn
+	* instead of racing two kernels into existence. */
+	kernelSpawn;
 	kernelBusy = false;
 	/** Accumulated stderr from the kernel (tracebacks land here). */
 	kernelStderr = "";
@@ -77379,30 +78036,95 @@ var PythonTool = class PythonTool {
 	/** Per-instance snapshot file so RLM state survives kernel restarts. */
 	snapshotPath;
 	hostHandlers;
+	snapshotByteLimit;
+	/** Instance nonce: namespaces reply files and every channel marker. */
+	nonce;
+	doneMarker;
+	bootDoneMarker;
+	syncMarker;
+	errorMarker;
 	constructor(cwd, options = {}) {
-		this.cwd = cwd;
 		this.options = options;
+		this.cwd = cwd;
 		this.hostHandlers = options.hostHandlers;
+		this.snapshotByteLimit = options.snapshotByteLimit ?? PythonTool.SNAPSHOT_BYTE_LIMIT;
+		this.nonce = randomBytes(4).toString("hex");
+		const markers = kernelMarkers(this.nonce);
+		this.doneMarker = markers.done;
+		this.bootDoneMarker = markers.boot;
+		this.syncMarker = markers.sync;
+		this.errorMarker = markers.error;
 		this.snapshotPath = options.snapshotPath ?? join(tmpdir(), `scream-rlm-state-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}.pkl`);
-		this.description = "Execute Python code in a persistent kernel. Variables, imports, and loaded data persist across calls (unlike Bash) — ideal for data analysis and multi-step processing. This tool is available only when RLM mode is enabled (/rlm); when you can see it, prefer it over repeated Bash python3 invocations for any workflow that keeps state across steps (load → transform → analyze → export). Run shell commands with the Bash tool instead. The kernel also provides `rlm(task, name=\"subagent\")` to spawn a subagent (returns a handle immediately) and `rlm_wait(handle, timeout)` to await its final summary — use them to parallelize independent data sub-tasks inside the kernel. Multi-line code (def/for/if) is fully supported. Code runs under the current permission mode; mutating operations follow the same approval rules as other tools.";
+		this.description = "Execute Python code in a persistent kernel. Variables and plain data persist across calls (unlike Bash) and are restored from a snapshot if the kernel restarts. Imports, functions, and live objects are NOT restored after a restart — re-run your imports if the kernel restarts. Ideal for data analysis and multi-step processing. This tool is available only when RLM mode is enabled (/rlm); when you can see it, prefer it over repeated Bash python3 invocations for any workflow that keeps state across steps (load → transform → analyze → export). Run shell commands with the Bash tool instead. The kernel also provides `rlm(task, name=\"subagent\")` to spawn a subagent (returns a handle immediately) and `rlm_wait(handle, timeout)` to await its final summary — use them to parallelize independent data sub-tasks inside the kernel. Each rlm() call starts a real subagent on a real task; nesting is unlimited by default, so set /rlm-max-depth before long workflows that spawn subagents from subagents. Multi-line code (def/for/if) is fully supported. Code runs under the current permission mode; mutating operations follow the same approval rules as other tools.";
 	}
 	dispose() {
 		if (this.hostHandlers !== void 0) this.hostHandlers["__dispose__"]?.({}).catch(() => {});
+		const pendingSpawn = this.kernelSpawn;
+		if (pendingSpawn !== void 0) pendingSpawn.then((proc) => {
+			proc.kill("SIGKILL");
+		}).catch(() => {});
 		this.kernel?.kill("SIGKILL");
 		this.kernel = void 0;
 		this.kernelBusy = false;
 		this.kernelStderr = "";
 		this.kernelStderrOffset = 0;
 		unlink(this.snapshotPath).catch(() => {});
+		this.cleanupReplyFiles();
+	}
+	/** Removes every reply file this instance owns — names are prefixed with
+	* this instance's nonce, so no other session's files are touched. */
+	cleanupReplyFiles() {
+		(async () => {
+			try {
+				const dir = tmpdir();
+				const prefix = `${REPLY_FILE_PREFIX}${this.nonce}-`;
+				const names = await readdir(dir);
+				await Promise.all(names.filter((name) => name.startsWith(prefix)).map((name) => unlink(join(dir, name)).catch(() => {})));
+			} catch {}
+		})();
+	}
+	/**
+	* Best-effort sweep of `scream-rlm-*` files left behind by dead sessions:
+	* reply files carry the owning kernel's pid (`scream-rlm-<nonce>-<pid>-<rid>
+	* .json`), and a file whose kernel is gone is dead weight regardless of age;
+	* files older than 24h (including legacy layouts and stale state snapshots)
+	* go too. Every failure is swallowed — this runs on the kernel-start path
+	* and must never delay or break it.
+	*/
+	static async sweepStaleKernelFiles() {
+		try {
+			const dir = tmpdir();
+			const now = Date.now();
+			const names = await readdir(dir);
+			await Promise.all(names.filter((name) => name.startsWith(REPLY_FILE_PREFIX)).map(async (name) => {
+				const full = join(dir, name);
+				try {
+					const expired = now - (await stat(full)).mtimeMs > REPLY_FILE_MAX_AGE_MS;
+					const rawPid = /^scream-rlm-(?:[a-z0-9]{6,10}-)?(\d+)-\d+\.json$/.exec(name)?.[1];
+					const ownerGone = rawPid !== void 0 && !isProcessAlive(Number(rawPid));
+					if (expired || ownerGone) await unlink(full);
+				} catch {}
+			}));
+		} catch {}
 	}
 	/** Lazily starts the persistent kernel. The banner and REPL prompts are
 	* emitted on stderr (not stdout), so we drain stderr continuously and drop
 	* the startup banner; stdout only carries print() output. */
-	async ensureKernel() {
+	async ensureKernel(signal) {
 		if (this.kernel !== void 0 && this.kernel.exitCode === null) return this.kernel;
-		this.kernelBusy = false;
+		if (this.kernelSpawn !== void 0) return this.kernelSpawn;
+		const pending = this.startKernel(signal);
+		this.kernelSpawn = pending;
+		try {
+			return await pending;
+		} finally {
+			if (this.kernelSpawn === pending) this.kernelSpawn = void 0;
+		}
+	}
+	async startKernel(signal) {
 		this.kernelStderr = "";
 		this.kernelStderrOffset = 0;
+		PythonTool.sweepStaleKernelFiles();
 		const proc = await this.spawnKernel();
 		this.kernel = proc;
 		let spawnError;
@@ -77414,10 +78136,11 @@ var PythonTool = class PythonTool {
 		proc.stderr?.on("error", () => {});
 		this.drainStderr(proc);
 		if (this.hostHandlers !== void 0) {
-			proc.stdin.write(`${buildRlmBootstrap(this.snapshotPath)}\n`);
-			if (!(await this.readUntilMarker(proc.stdout, "__SCREAM_BOOT_DONE__", KERNEL_START_TIMEOUT_MS)).found) {
+			proc.stdin.write(`${buildRlmBootstrap(this.snapshotPath, this.nonce, this.snapshotByteLimit)}\n`);
+			if (!(await this.readUntilMarker(proc.stdout, this.bootDoneMarker, KERNEL_START_TIMEOUT_MS, { signal })).found) {
 				proc.kill("SIGKILL");
 				this.kernel = void 0;
+				if (isAborted$1(signal)) throw new Error("Python kernel start interrupted");
 				throw new Error(`Python kernel failed to start: ${spawnError?.message ?? "bootstrap did not complete"}`);
 			}
 		}
@@ -77456,7 +78179,11 @@ var PythonTool = class PythonTool {
 					"pipe",
 					"pipe",
 					"pipe"
-				]
+				],
+				env: {
+					...process.env,
+					PYTHONIOENCODING: "utf-8"
+				}
 			});
 			proc.once("error", (error) => {
 				reject(error);
@@ -77474,26 +78201,34 @@ var PythonTool = class PythonTool {
 		});
 	}
 	/**
-	* Reads stdout until `marker` appears (or the deadline passes). Uses the
-	* 'data' event instead of an async iterator: a `for await` that returns
-	* early destroys the stream, which breaks the next call on the same
-	* persistent kernel. `'data'` keeps the stream alive across calls.
+	* Reads stdout until `marker` appears (or the deadline passes, the signal
+	* aborts, or the stream ends). Uses the 'data' event instead of an async
+	* iterator: a `for await` that returns early destroys the stream, which
+	* breaks the next call on the same persistent kernel. `'data'` keeps the
+	* stream alive across calls.
+	*
+	* `replyPid` identifies the kernel process that owns this stream: bridge
+	* replies must land in the file that kernel polls, even if `this.kernel` has
+	* since been replaced.
 	*/
-	async readUntilMarker(stream, marker, timeoutMs) {
+	async readUntilMarker(stream, marker, timeoutMs, opts = {}) {
 		if (stream === null) return {
 			lines: [],
 			found: false
 		};
+		const { signal, replyPid } = opts;
 		return new Promise((resolve) => {
 			const lines = [];
 			let buffer = "";
 			const decoder = new StringDecoder("utf8");
+			let timer;
 			const cleanup = () => {
-				clearTimeout(timer);
+				if (timer !== void 0) clearTimeout(timer);
 				stream.off("data", onData);
 				stream.off("end", onEnd);
 				stream.off("close", onEnd);
 				stream.off("error", onEnd);
+				signal?.removeEventListener("abort", onAbort);
 			};
 			const finish = (found) => {
 				cleanup();
@@ -77502,16 +78237,30 @@ var PythonTool = class PythonTool {
 					found
 				});
 			};
-			const onEnd = () => finish(false);
+			const onEnd = () => {
+				finish(false);
+			};
+			const onAbort = () => {
+				finish(false);
+			};
 			const onData = (chunk) => {
 				buffer += decoder.write(chunk);
 				const parts = buffer.split("\n");
 				buffer = parts.pop() ?? "";
 				for (const line of parts) {
 					if (line.includes(marker)) return finish(true);
-					if (line.includes("\"host_request\"")) {
-						this.handleHostRequest(line, stream).catch(() => {});
-						continue;
+					const trimmed = line.trimStart();
+					if (trimmed.startsWith("{")) {
+						let parsed;
+						try {
+							parsed = JSON.parse(trimmed);
+						} catch {
+							parsed = void 0;
+						}
+						if (parsed !== null && typeof parsed === "object" && parsed.type === "host_request") {
+							this.handleHostRequest(parsed, replyPid).catch(() => {});
+							continue;
+						}
 					}
 					lines.push(line);
 				}
@@ -77521,11 +78270,18 @@ var PythonTool = class PythonTool {
 					return finish(true);
 				}
 			};
-			const timer = setTimeout(() => finish(false), timeoutMs);
+			timer = setTimeout(() => finish(false), timeoutMs);
 			stream.on("data", onData);
 			stream.on("end", onEnd);
 			stream.on("close", onEnd);
 			stream.on("error", onEnd);
+			if (signal !== void 0) {
+				if (signal.aborted) {
+					finish(false);
+					return;
+				}
+				signal.addEventListener("abort", onAbort);
+			}
 		});
 	}
 	/**
@@ -77533,42 +78289,42 @@ var PythonTool = class PythonTool {
 	* writes the reply to the kernel's expected reply file (the kernel polls
 	* that file — replies must not go over stdin, which is used for code input
 	* and would race with the REPL). Fire-and-forget from the read loop.
+	*
+	* `replyPid` is the pid captured from the kernel that issued the request: if
+	* the kernel is restarted (timeout kill) while a bridge handler is still
+	* running, the late reply must still land in the file the originating kernel
+	* is polling.
 	*/
-	/** Writes a bridge reply to the kernel's expected reply file. Uses the
-	* pid captured when the request was received: if the kernel is restarted
-	* (timeout kill) while a bridge handler is still running, the late reply
-	* must still land in the file the originating kernel is polling. */
-	writeHostReply(pid, id, body) {
+	async handleHostRequest(parsed, replyPid) {
+		const pid = replyPid ?? this.kernel?.pid;
 		if (pid === void 0) return;
-		writeFile(join(tmpdir(), `scream-rlm-${pid}-${id}.json`), JSON.stringify({
-			type: "host_reply",
-			id,
-			...body
-		}), "utf8").catch(() => {});
-	}
-	async handleHostRequest(line, stream) {
-		const replyPid = this.kernel?.pid;
-		if (replyPid === void 0) return;
-		let parsed;
-		try {
-			parsed = JSON.parse(line);
-		} catch {
-			return;
-		}
 		const { id, method, payload } = parsed;
 		if (typeof id !== "number" || typeof method !== "string" || payload === void 0) return;
 		const handler = this.hostHandlers?.[method];
 		if (handler === void 0) {
-			this.writeHostReply(replyPid, id, { error: `no handler for ${method}` });
+			this.writeHostReply(pid, id, { error: `no handler for ${method}` });
 			return;
 		}
 		try {
 			const result = await handler(payload);
-			this.writeHostReply(replyPid, id, { result });
+			this.writeHostReply(pid, id, { result });
 		} catch (error) {
-			this.writeHostReply(replyPid, id, { error: error instanceof Error ? error.message : String(error) });
+			this.writeHostReply(pid, id, { error: error instanceof Error ? error.message : String(error) });
 		}
 	}
+	/** Writes a bridge reply to the kernel's expected reply file, namespaced by
+	* this instance's nonce so sessions can never collide. */
+	writeHostReply(pid, id, body) {
+		writeFile(join(tmpdir(), `${REPLY_FILE_PREFIX}${this.nonce}-${pid}-${id}.json`), JSON.stringify({
+			type: "host_reply",
+			id,
+			...body
+		}), {
+			encoding: "utf8",
+			mode: 384,
+			flag: "wx"
+		}).catch(() => {});
+	}
 	resolveExecution(args) {
 		return {
 			description: `Python: ${args.code.length > 50 ? `${args.code.slice(0, 50)}…` : args.code}`,
@@ -77581,11 +78337,27 @@ var PythonTool = class PythonTool {
 			execute: (ctx) => this.execution(args, ctx)
 		};
 	}
-	async execution(args, _ctx) {
-		if (this.kernelBusy) return { output: "The Python kernel is busy executing a previous call. Wait for it to finish, or stop it with TaskStop." };
+	async execution(args, ctx) {
+		const signal = ctx.signal;
+		const interruptedResult = () => ({
+			isError: true,
+			output: `Interrupted by ${interruptedBy$1(signal)}; kernel state preserved.`
+		});
+		if (isAborted$1(signal)) return interruptedResult();
+		if (this.kernelBusy) return {
+			isError: true,
+			output: "The Python kernel is busy executing a previous call. Wait for it to finish, or interrupt the running call."
+		};
 		this.kernelBusy = true;
 		try {
-			const proc = await this.ensureKernel();
+			let proc;
+			try {
+				proc = await this.ensureKernel(signal);
+			} catch (error) {
+				if (isAborted$1(signal)) return interruptedResult();
+				throw error;
+			}
+			if (isAborted$1(signal)) return interruptedResult();
 			const timeoutMs = (args.timeout ?? DEFAULT_TIMEOUT_MS / 1e3) * 1e3;
 			const wrapperPy = `import ast as _ast, base64 as _b
 __c = _b.b64decode('${Buffer.from(args.code, "utf8").toString("base64")}').decode()\ntry:
@@ -77611,16 +78383,15 @@ __c = _b.b64decode('${Buffer.from(args.code, "utf8").toString("base64")}').decod
 except BaseException as __e:
     # Show the user’s own source lines (the raw REPL traceback
     # only exposes the base64 wrapper line, which is useless for
-    # debugging), then re-raise so the kernel prints the real stack
-    # and the tool flags the call as an error.
-    print("Traceback (most recent call last):")
+    # debugging), then re-raise so the kernel prints the real stack.
+    print('${this.errorMarker}')\n    print("Traceback (most recent call last):")
     for __i, __ln in enumerate(__c.split("\\n"), 1):
         print(f"  File \\"<user_code>\\", line {__i}")
         print(f"    {__ln}")
     print(f"{type(__e).__name__}: {__e}")
     raise`;
 			const wrapperB64 = Buffer.from(wrapperPy, "utf8").toString("base64");
-			const codeWithDone = this.hostHandlers !== void 0 ? `exec(__import__('base64').b64decode('${wrapperB64}').decode(), globals())\nprint('${PY_DONE_MARKER}')\n_snapshot()\n` : `exec(__import__('base64').b64decode('${wrapperB64}').decode(), globals())\nprint('${PY_DONE_MARKER}')\n`;
+			const codeWithDone = this.hostHandlers !== void 0 ? `_flush_warnings()\nexec(__import__('base64').b64decode('${wrapperB64}').decode(), globals())\nprint('${this.doneMarker}')\n_snapshot()\n` : `exec(__import__('base64').b64decode('${wrapperB64}').decode(), globals())\nprint('${this.doneMarker}')\n`;
 			if (!proc.stdin.write(codeWithDone)) await new Promise((resolve) => {
 				const onError = () => resolve();
 				proc.stdin.once("close", onError);
@@ -77631,43 +78402,50 @@ except BaseException as __e:
 					resolve();
 				});
 			});
-			const { lines, found } = await this.readUntilMarker(proc.stdout, PY_DONE_MARKER, timeoutMs);
-			const output = lines.filter((line) => !line.includes(PY_DONE_MARKER) && !line.trimStart().startsWith(">>> ") && !line.trimStart().startsWith("... ")).join("\n").trim();
+			const { lines, found } = await this.readUntilMarker(proc.stdout, this.doneMarker, timeoutMs, {
+				signal,
+				replyPid: proc.pid
+			});
+			const hadErrorMarker = lines.some((line) => line.includes(this.errorMarker));
+			const output = lines.filter((line) => !line.includes(this.doneMarker) && !line.includes(this.errorMarker) && !line.trimStart().startsWith(">>> ") && !line.trimStart().startsWith("... ")).join("\n").trim();
 			await this.drainStderrQuiet(proc);
 			const stderr = this.kernelStderr.slice(this.kernelStderrOffset).split("\n").filter((line) => !line.trimStart().startsWith(">>> ") && !line.trimStart().startsWith("... ") && !line.trimStart().startsWith("Python ") && !line.trimStart().startsWith("Type \"help\"")).join("\n").trim();
 			this.kernelStderrOffset = this.kernelStderr.length;
 			const merged = [output, stderr].filter((part) => part.length > 0).join("\n");
 			if (!found) {
+				const aborted = isAborted$1(signal);
 				const preInterruptOffset = this.kernelStderrOffset;
-				if (process.platform === "win32" ? true : await this.interruptKernel(proc, 1500)) {
+				const exited = process.platform === "win32" ? true : await this.interruptKernel(proc, INTERRUPT_GRACE_MS);
+				const restarted = () => ({
+					isError: true,
+					output: aborted ? `Interrupted by ${interruptedBy$1(signal)}; kernel restarted.${merged.length > 0 ? `\n${truncateOutput$1(merged)}` : ""}` : `Python execution timed out after ${Math.round(timeoutMs / 1e3)}s (kernel restarted).\n${truncateOutput$1(merged)}`
+				});
+				if (exited) {
 					proc.kill("SIGKILL");
 					this.kernel = void 0;
-					return {
-						isError: true,
-						output: `Python execution timed out after ${Math.round(timeoutMs / 1e3)}s (kernel restarted).\n${truncateOutput$1(merged)}`
-					};
+					return restarted();
 				}
 				if (!await this.syncKernel(proc)) {
 					proc.kill("SIGKILL");
 					this.kernel = void 0;
-					return {
-						isError: true,
-						output: `Python execution timed out after ${Math.round(timeoutMs / 1e3)}s (kernel restarted).\n${truncateOutput$1(merged)}`
-					};
+					return restarted();
 				}
 				await this.drainStderrQuiet(proc);
 				const interruptStderr = this.kernelStderr.slice(preInterruptOffset).split("\n").filter((line) => !line.trimStart().startsWith(">>> ") && !line.trimStart().startsWith("... ") && !line.trimStart().startsWith("Python ") && !line.trimStart().startsWith("Type \"help\"")).join("\n").trim();
 				this.kernelStderrOffset = this.kernelStderr.length;
-				const timedOutMerged = [merged, interruptStderr].filter((part) => part.length > 0).join("\n");
+				const tailMerged = [merged, interruptStderr].filter((part) => part.length > 0).join("\n");
+				if (aborted) return {
+					isError: true,
+					output: `Interrupted by ${interruptedBy$1(signal)}; kernel state preserved.${tailMerged.length > 0 ? `\n${truncateOutput$1(tailMerged)}` : ""}`
+				};
 				return {
 					isError: true,
-					output: `Python execution timed out after ${Math.round(timeoutMs / 1e3)}s (kernel interrupted; state preserved).\n${truncateOutput$1(timedOutMerged)}`
+					output: `Python execution timed out after ${Math.round(timeoutMs / 1e3)}s (kernel interrupted; state preserved).\n${truncateOutput$1(tailMerged)}`
 				};
 			}
-			const isError = merged.includes("Traceback") || merged.toLowerCase().includes("error:");
 			const finalOutput = truncateOutput$1(merged);
 			return {
-				isError,
+				isError: hadErrorMarker,
 				output: finalOutput.length > 0 ? finalOutput : "(no output)"
 			};
 		} finally {
@@ -77703,15 +78481,14 @@ except BaseException as __e:
 	}
 	/**
 	* Round-trips a sync marker through the (interrupted) kernel: writes
-	* `print('__SCREAM_SYNC__')` and waits for it to appear on stdout. Any
+	* `print('<sync marker>')` and waits for it to appear on stdout. Any
 	* residual queued output (a DONE marker written before the timeout, a
 	* partially-flushed traceback) is consumed by the same read loop, so the
 	* next execution starts from a clean marker state. Returns true when the
 	* marker came back — the REPL is idle and reusable.
 	*/
 	async syncKernel(proc, timeoutMs = 3e3) {
-		const SYNC_MARKER = "__SCREAM_SYNC__";
-		if (!proc.stdin.write(`print('${SYNC_MARKER}')\n`)) await new Promise((resolve) => {
+		if (!proc.stdin.write(`print('${this.syncMarker}')\n`)) await new Promise((resolve) => {
 			const onError = () => resolve();
 			proc.stdin.once("close", onError);
 			proc.stdin.once("error", onError);
@@ -77721,7 +78498,7 @@ except BaseException as __e:
 				resolve();
 			});
 		});
-		const { found } = await this.readUntilMarker(proc.stdout, SYNC_MARKER, timeoutMs);
+		const { found } = await this.readUntilMarker(proc.stdout, this.syncMarker, timeoutMs);
 		return found;
 	}
 	/** Waits (bounded) for stderr to go quiet so tracebacks settle before the
@@ -77851,7 +78628,7 @@ var ScriptTool = class {
 				signal: ctx.signal,
 				store: this.store.get("scriptStore") ?? {}
 			});
-			if (!result.ok) return await this.failedResult(result.error, result.output, state);
+			if (!result.ok) return await this.failedResult(result.error, result.output, state, parsed.options);
 			this.commitStoreWrites(result.storeWrites);
 			return await this.successResult(result.output, result.value, state, parsed.options);
 		} finally {
@@ -77914,7 +78691,7 @@ var ScriptTool = class {
 	async successResult(output, value, state, options) {
 		const textParts = output.filter((item) => item.type === "text").map((item) => item.text);
 		if (value !== void 0) textParts.push(valueText(value));
-		const { shown } = await truncateOutput(textParts.join("\n"), (options.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS) * CHARS_PER_TOKEN);
+		const { shown } = await truncateOutput(textParts.join("\n"), outputBudgetChars(options));
 		const parts = [];
 		if (shown.length > 0) parts.push({
 			type: "text",
@@ -77933,11 +78710,11 @@ var ScriptTool = class {
 			...state.records.length > 0 ? { nestedCalls: state.records } : {}
 		};
 	}
-	async failedResult(error, output, state) {
+	async failedResult(error, output, state, options) {
 		const lines = [`Script failed (${error.kind}): ${error.message}`];
 		const partial = output.filter((item) => item.type === "text").map((item) => item.text).join("\n");
 		if (partial.length > 0) {
-			const { shown } = await truncateOutput(partial, DEFAULT_MAX_OUTPUT_TOKENS * CHARS_PER_TOKEN);
+			const { shown } = await truncateOutput(partial, outputBudgetChars(options));
 			lines.push("", "Partial output before the failure:", shown);
 		}
 		if (state.records.length > 0) lines.push(`(${state.records.length} nested call${state.records.length === 1 ? "" : "s"} ran before the failure)`);
@@ -77969,6 +78746,15 @@ function valueText(value) {
 	}
 }
 /**
+* The script's effective output budget in characters: the `@options.max_output_tokens`
+* annotation when the script carries one, the tool default otherwise. The success path
+* and the failure path both read this single value, so the annotation cannot apply to
+* only one of them.
+*/
+function outputBudgetChars(options) {
+	return (options.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS) * CHARS_PER_TOKEN;
+}
+/**
 * Truncates to the character budget, keeping half the budget on each side
 * (matching the reference implementation). The full text is spilled to a
 * temp file and its path reported in the shown output.
@@ -78141,16 +78927,23 @@ var bash_default = "Execute a `{{ SHELL_NAME }}` command. Use this for shell sem
 */
 const pendingTasks = /* @__PURE__ */ new Map();
 const MAX_PENDING = 10;
-function createBackgroundTask(command, completion) {
+function createBackgroundTask(command, completion, handles) {
 	const id = randomUUID().slice(0, 8);
 	const task = {
 		command,
 		startedAt: Date.now(),
-		completion
+		completion,
+		kill: handles.kill,
+		pid: handles.pid,
+		ownerId: handles.ownerId
 	};
 	if (pendingTasks.size >= MAX_PENDING) {
 		const oldest = pendingTasks.keys().next().value;
-		if (oldest !== void 0) pendingTasks.delete(oldest);
+		if (oldest !== void 0) {
+			const evicted = pendingTasks.get(oldest);
+			pendingTasks.delete(oldest);
+			if (evicted !== void 0) evicted.kill();
+		}
 	}
 	pendingTasks.set(id, task);
 	task.completion.then((result) => {
@@ -78181,6 +78974,26 @@ function drainCompletedBackgroundTasks() {
 	}
 	return completed;
 }
+/**
+* Kill the parked commands one owner is responsible for and clear them.
+*
+* Strictly owner-matched, `undefined` included: the registry is module-level
+* while sessions are not, so a session teardown must reach exactly the tasks
+* its own agents parked (every agent's Bash tool stamps its session id — see
+* `Session.instantiateAgent`) and never another session's. The undefined match
+* is a real case, not a wildcard: `SessionOptions.id` is optional, so a session
+* created without an id stamps no owner, and matching it against "no owner" is
+* what keeps that session's close() from executing a foreign session's command.
+* Process-wide cleanup is `killAllPendingBackgroundTasks`, which only a real
+* exit path may call.
+*/
+function stopAllPendingBackgroundTasks(ownerId) {
+	for (const [id, task] of pendingTasks) {
+		if (task.ownerId !== ownerId) continue;
+		task.kill();
+		pendingTasks.delete(id);
+	}
+}
 //#endregion
 //#region ../../packages/agent-core/src/tools/builtin/shell/bash.ts
 /**
@@ -78231,6 +79044,20 @@ const SIGTERM_GRACE_MS = 5e3;
 * declaring completion (grandchildren may hold the pipe open). */
 const STREAM_GRACE_MS = 500;
 /**
+* Who fired the abort that settled an interrupted Bash call.
+*
+* Bash settles its own abort result (the batch loop never sees this tool throw),
+* so the signal's reason is the only evidence of attribution available here.
+* The loop builds that reason (`loop/tool-call.ts`): a parent agent's interject
+* arrives as a `ParentInterjectError`, anything else — a user stop, a turn
+* deadline, a host cancel — keeps the historical user wording. Reporting a
+* parent's interject as "the user" would send the child looking for a stop
+* instruction that never existed.
+*/
+function interruptedBy(signal) {
+	return isParentInterject(signal.reason) ? "the parent agent" : "user";
+}
+/**
 * Which dialect `env` selected. `shellName` is the probe's answer to "which
 * interpreter is this", so it decides the dialect; `osKind` does not, because
 * Windows carries either dialect depending on whether Git Bash was found.
@@ -78455,6 +79282,13 @@ var BashTool = class {
 	shellKind;
 	allowBackground;
 	availableTools;
+	/**
+	* Session this tool belongs to (the owning agent's session id). A command
+	* that times out is parked in the module-level pending registry under this
+	* key, so closing one session sweeps only its own parked commands instead of
+	* executing every other session's running work.
+	*/
+	ownerId;
 	constructor(jian, cwd, backgroundManager, options) {
 		this.jian = jian;
 		this.cwd = cwd;
@@ -78464,6 +79298,7 @@ var BashTool = class {
 		this.isWindowsBash = this.isWindows && this.shellKind === "posix";
 		this.allowBackground = options?.allowBackground ?? this.backgroundManager !== void 0;
 		this.availableTools = options?.availableTools ?? /* @__PURE__ */ new Set();
+		this.ownerId = options?.ownerId;
 		const rendered = renderBashDescription(this.jian.osEnv.shellName, this.shellKind === "powershell");
 		this.description = this.allowBackground ? rendered : withoutBackgroundDescription(rendered);
 	}
@@ -78509,7 +79344,7 @@ var BashTool = class {
 		const bgPrefix = completedBg.length > 0 ? completedBg.map((t) => `[Background task ${t.id} completed] Command: ${t.command}\nExit code: ${String(t.exitCode)} (${(t.elapsedMs / 1e3).toFixed(1)}s)\nOutput:\n${t.output}\n---\n`).join("") : "";
 		if (signal.aborted) return {
 			isError: true,
-			output: bgPrefix + "Aborted before command started"
+			output: bgPrefix + (isParentInterject(signal.reason) ? "Interrupted by the parent agent before the command started" : "Aborted before command started")
 		};
 		if (args.command.length === 0) return {
 			isError: true,
@@ -78558,11 +79393,15 @@ var BashTool = class {
 				await proc.kill("SIGTERM");
 			} catch {}
 			const exited = proc.wait().then(() => true).catch(() => true);
-			if (!await Promise.race([exited, new Promise((resolve) => {
-				setTimeout(() => {
+			let graceTimer;
+			const raced = await Promise.race([exited, new Promise((resolve) => {
+				graceTimer = setTimeout(() => {
 					resolve(false);
 				}, SIGTERM_GRACE_MS);
-			})]) && proc.exitCode === null) try {
+				graceTimer.unref?.();
+			})]);
+			if (graceTimer !== void 0) clearTimeout(graceTimer);
+			if (!raced && proc.exitCode === null) try {
 				await proc.kill("SIGKILL");
 			} catch {}
 			try {
@@ -78614,7 +79453,11 @@ var BashTool = class {
 				const taskId = createBackgroundTask(command, completionPromise.then(({ exitCode }) => ({
 					exitCode,
 					output: builder.toString()
-				})));
+				})), {
+					kill: killProc,
+					pid: proc.pid,
+					ownerId: this.ownerId
+				});
 				if (onUpdate !== void 0) completionPromise.then(({ exitCode }) => {
 					onUpdate({
 						kind: "custom",
@@ -78643,7 +79486,10 @@ var BashTool = class {
 				};
 			}
 			const { exitCode } = raceResult;
-			if (aborted) return builder.error("Interrupted by user", { brief: "Interrupted by user" });
+			if (aborted) {
+				const attribution = `Interrupted by ${interruptedBy(signal)}`;
+				return builder.error(attribution, { brief: attribution });
+			}
 			const isError = exitCode !== 0;
 			if (isError && builder.nChars === 0) builder.write(`Process exited with code ${String(exitCode)}`);
 			if (!isError) return builder.ok("Command executed successfully.");
@@ -79839,6 +80685,17 @@ var BackgroundManager = class extends BackgroundProcessManager {
 			await this.restoreBackgroundTaskNotification(info);
 		}
 	}
+	/**
+	* Steer a terminal task notification into the owning agent's turn.
+	*
+	* Notifications follow the owner chain: a BackgroundManager belongs to
+	* exactly one agent, and the Agent tool registers a background child in the
+	* manager of the agent that spawned it (AgentTool is built with that agent's
+	* `background`). A grandchild spawned in background by a subagent therefore
+	* notifies its direct owner — the child — which surfaces it in its own turn;
+	* it never skips a level up to the root. TaskList/TaskOutput/TaskStop see the
+	* same boundary, each scoped to the manager's own agent.
+	*/
 	async notifyBackgroundTask(info) {
 		const context = await this.buildBackgroundTaskNotificationContext(info);
 		if (context === void 0) return;
@@ -82519,6 +83376,31 @@ function messageFingerprint(message) {
 	return hashString(serializeMessage$1(message));
 }
 /**
+* Fingerprint of the tool declaration table attached to a request.
+*
+* The provider prefix is `[system][tool declarations][messages]`, so a table
+* change — an MCP server reconnecting, `/script` or the python toggle, a
+* profile switch — invalidates every cached message behind it even though the
+* message bytes are untouched. Without this hash such a change is invisible to
+* the message-level prefix comparison.
+*
+* Two stability rules:
+* - **Declaration order is preserved, not normalized.** Order is part of the
+*   provider-visible bytes, so a reorder must register as a change. The
+*   request layer sends `loopTools`, which is name-sorted (`tool/AGENTS.md`).
+* - **Fields inside a declaration are key-sorted** by {@link stableJson}
+*   (nested parameter schemas included), so the same table assembled by a
+*   different code path — or a schema object built with a different key
+*   insertion order — hashes identically.
+*/
+function toolDeclarationsFingerprint(tools) {
+	return hashString(tools.map((tool) => stableJson({
+		name: tool.name,
+		description: tool.description ?? null,
+		parameters: tool.parameters ?? null
+	})).join(""));
+}
+/**
 * Longest common prefix length by provider-visible bytes. This is the number
 * of leading messages a provider prompt cache could reuse from the previous
 * call. When this is less than the previous call's message count, an early
@@ -82585,6 +83467,14 @@ var ContextMemory = class {
 	* cache-break signal rather than a reset.
 	*/
 	lastSentFingerprints = [];
+	/**
+	* Tool declaration fingerprint of the last request
+	* ({@link toolDeclarationsFingerprint}), the half of the provider prefix
+	* that sits *before* the messages. `undefined` until the first LLM-bound
+	* build — no baseline, nothing to compare. Reset together with
+	* {@link lastSentFingerprints} on {@link clear}.
+	*/
+	lastSentToolsFingerprint = void 0;
 	constructor(agent) {
 		this.agent = agent;
 	}
@@ -82680,6 +83570,7 @@ var ContextMemory = class {
 		this.deferredMessages = [];
 		this._messageEdits.clear();
 		this.lastSentFingerprints = [];
+		this.lastSentToolsFingerprint = void 0;
 		this.agent.injection.onContextClear();
 		this.agent.microCompaction.reset();
 		this.agent.emitStatusUpdated();
@@ -82899,9 +83790,17 @@ var ContextMemory = class {
 	* runs the same detect + compact + project pipeline, then fingerprints
 	* the result and logs how much of the prefix survived since the last
 	* call. A stable prefix length equal to the previous message count means
-	* the provider prompt cache should hit; a smaller value means an early
-	* message mutated (compaction summary, micro-compaction truncation, or a
-	* projection repair) and the cache broke from that index.
+	* the provider prompt cache should hit; a smaller value means the bytes
+	* ahead of that index changed — an early message mutated (compaction
+	* summary, micro-compaction truncation, a projection repair), or the tool
+	* declaration table that precedes every message was rebuilt.
+	*
+	* `tools` is the declaration table this request will advertise. A caller
+	* that builds the request hands over the exact table it is about to send
+	* (the turn loop does, so a mid-turn `setActiveTools` that the turn's
+	* frozen filter correctly ignores does not register as a false break).
+	* When omitted the live offered table is used, which is what a direct
+	* caller inspects.
 	*
 	* Unlike the read-only `messages` getter, this path closes any trailing
 	* in-flight tool call by synthesizing an error result (synthesizeMissing):
@@ -82909,10 +83808,10 @@ var ContextMemory = class {
 	* tool_calls message with no matching tool result (e.g. after a network
 	* drop mid-batch).
 	*/
-	messagesForLLM() {
+	messagesForLLM(tools) {
 		this.agent.microCompaction.detect();
 		const messages = project(this.applyMessageEdits(this.agent.microCompaction.compact(this.history)), { synthesizeMissing: true });
-		this.observePrefixStability(messages);
+		this.observePrefixStability(messages, tools);
 		return messages;
 	}
 	/**
@@ -82921,10 +83820,14 @@ var ContextMemory = class {
 	* message content is mutated, only the fingerprint baseline used by the
 	* next call's comparison.
 	*/
-	observePrefixStability(messages) {
+	observePrefixStability(messages, tools) {
 		const prev = this.lastSentFingerprints;
-		const stable = stablePrefixLength(prev, messages);
+		const prevTools = this.lastSentToolsFingerprint;
+		const toolsFingerprint = toolDeclarationsFingerprint(tools ?? this.agent.tools.loopTools);
+		const toolDeclarationsChanged = prevTools !== void 0 && prevTools !== toolsFingerprint;
+		const stable = toolDeclarationsChanged ? 0 : stablePrefixLength(prev, messages);
 		this.lastSentFingerprints = messages.map(messageFingerprint);
+		this.lastSentToolsFingerprint = toolsFingerprint;
 		if (prev.length === 0) return;
 		const appended = messages.length - prev.length;
 		if (stable >= prev.length) {
@@ -82942,7 +83845,15 @@ var ContextMemory = class {
 			prevMessageCount: prev.length,
 			currentMessageCount: messages.length,
 			appendedSinceLast: appended,
-			breakIndex: stable
+			breakIndex: stable,
+			toolDeclarationsChanged
+		});
+		this.agent.records.logRecord({
+			type: "context.prefix_break",
+			breakIndex: stable,
+			prevMessageCount: prev.length,
+			currentMessageCount: messages.length,
+			appendedSinceLast: appended
 		});
 	}
 	appendLoopEvent(event) {
@@ -83937,6 +84848,13 @@ async function findExecutableOnPath(name, pathEnv, platform, isFile) {
 function isUtf8Continuation(byte) {
 	return byte >= 128 && byte <= 191;
 }
+/**
+* Byte-level UTF-8 decode for `errors: 'ignore'`: drop every byte that is not
+* part of a valid sequence, while keeping U+FFFD characters the file already
+* contains. Shared with the streaming `readLines` path so both read a file the
+* same way, character for character.
+* @internal
+*/
 function decodeUtf8Ignore(data) {
 	let output = "";
 	let i = 0;
@@ -83985,6 +84903,12 @@ function decodeUtf8Ignore(data) {
 	}
 	return output;
 }
+/**
+* Byte-level UTF-16LE decode for `errors: 'ignore'`: drop unpaired surrogates
+* (and a trailing odd byte), keeping every other code unit. Shared with the
+* streaming `readLines` path.
+* @internal
+*/
 function decodeUtf16LeIgnore(data) {
 	let output = "";
 	let i = 0;
@@ -84029,20 +84953,36 @@ function decodeUtf16LeIgnore(data) {
 * byte-to-character mappings so `errors` has no effect.
 * @internal
 */
-function decodeTextWithErrors(data, encoding, errors = "strict") {
-	let webLabel;
+/**
+* Map Node's BufferEncoding names to Web TextDecoder labels where the two
+* diverge; `undefined` for the lossless non-UTF encodings that only
+* `Buffer.toString` covers.
+* @internal
+*/
+function utfTextDecoderLabel(encoding) {
 	switch (encoding) {
 		case "utf-8":
-		case "utf8":
-			webLabel = "utf-8";
-			break;
+		case "utf8": return "utf-8";
 		case "utf16le":
 		case "ucs2":
-		case "ucs-2":
-			webLabel = "utf-16le";
-			break;
-		default: webLabel = void 0;
+		case "ucs-2": return "utf-16le";
+		default: return;
 	}
+}
+/**
+* Decode a Buffer into a string with Python-compatible `errors` handling.
+*
+* - `'strict'` (default): throw on invalid sequences (via TextDecoder `fatal: true`)
+* - `'replace'`: substitute each invalid sequence with U+FFFD (TextDecoder default)
+* - `'ignore'`: drop invalid input sequences while preserving valid U+FFFD characters
+*
+* Falls back to `Buffer.toString(encoding)` for encodings TextDecoder does not
+* support (e.g. `hex`, `base64`, `binary`, `latin1`) — those are lossless
+* byte-to-character mappings so `errors` has no effect.
+* @internal
+*/
+function decodeTextWithErrors(data, encoding, errors = "strict") {
+	const webLabel = utfTextDecoderLabel(encoding);
 	if (webLabel === void 0) return data.toString(encoding);
 	if (errors === "strict") return new TextDecoder(webLabel, { fatal: true }).decode(data);
 	if (errors === "ignore") return webLabel === "utf-8" ? decodeUtf8Ignore(data) : decodeUtf16LeIgnore(data);
@@ -84296,6 +85236,51 @@ function cycleKey(s) {
 	if (s.ino === 0) return null;
 	return `${String(s.dev)}:${String(s.ino)}`;
 }
+/**
+* How many times one *physical* directory (same `dev:ino` key `cycleKey`
+* produces) may be entered during a single `glob` traversal.
+*
+* 2 = the directory's own place in the tree (the canonical descent) plus one
+* legitimate symlink alias pointing at the same target — the alias-following
+* behaviour the existing symlink tests pin (T-C2 / T-C6 in
+* `test/local.test.ts`). The 3rd and every later entry is skipped.
+*
+* Why a global bound on top of the path-local cycle set: path-local
+* detection only stops a directory from appearing twice *on one descent
+* path*. A symlink farm — pnpm's `node_modules/.pnpm`, where packages alias
+* each other in a dense graph — still admits an exponential number of
+* distinct alias paths to the same physical directories, each of which is
+* re-`readdir`-ed and re-`stat`-ed. That is what turns one `**` walk into
+* hours of CPU and tens of thousands of stats per second. With this bound
+* the work is O(MAX_PHYSICAL_REVISITS × physical tree): a physical directory
+* is traversed at most this many times, however many paths spell it.
+*
+* Trees with no revisit are untouched: the first entry of every directory is
+* always allowed, so a plain walk behaves exactly as it did before.
+*/
+const MAX_PHYSICAL_REVISITS = 2;
+/**
+* Whether a cooperative-cancellation checkpoint should stop the walk.
+*
+* Wrapped in a helper rather than inlined as `signal?.aborted === true` so
+* control-flow narrowing cannot pin `aborted` to `false` after the first
+* checkpoint in a function body: the flag flips asynchronously, and every
+* later checkpoint must still be able to observe `true`.
+*/
+function isAborted(signal) {
+	return signal?.aborted === true;
+}
+/**
+* Record one entry of the physical directory `key` for the current traversal.
+* Returns false when that directory has already been entered
+* `MAX_PHYSICAL_REVISITS` times, i.e. when this descent must be skipped.
+*/
+function enterPhysical(key, entries) {
+	const entered = entries.get(key) ?? 0;
+	if (entered >= MAX_PHYSICAL_REVISITS) return false;
+	entries.set(key, entered + 1);
+	return true;
+}
 const DEFAULT_PATHEXT = [
 	".COM",
 	".EXE",
@@ -84606,12 +85591,27 @@ var LocalJian = class LocalJian {
 			stCtime: isWindowsPlatform(this._platform) ? s.birthtimeMs / 1e3 : s.ctimeMs / 1e3
 		};
 	}
-	async *iterdir(path) {
+	async *iterdir(path, options) {
+		const signal = options?.signal;
+		const maxEntries = options?.maxEntries;
+		if (isAborted(signal)) return;
 		const resolved = this._resolvePath(path);
-		const entries = await readdir(resolved);
-		for (const entry of entries) yield join$1(resolved, entry);
+		const dir = await opendir(resolved);
+		try {
+			let yielded = 0;
+			for await (const entry of dir) {
+				if (isAborted(signal)) return;
+				if (maxEntries !== void 0 && yielded >= maxEntries) return;
+				yield join$1(resolved, entry.name);
+				yielded += 1;
+			}
+		} finally {
+			await dir.close().catch(() => {});
+		}
 	}
 	async *glob(path, pattern, options) {
+		const signal = options?.signal;
+		if (isAborted(signal)) return;
 		const resolved = this._resolvePath(path);
 		const caseSensitive = options?.caseSensitive ?? true;
 		const excludedEntries = options?.exclude === void 0 || options.exclude.length === 0 ? void 0 : new Set(options.exclude);
@@ -84619,19 +85619,25 @@ var LocalJian = class LocalJian {
 		if (!await this._isWithinPhysicalRoots(resolved, physicalAllowedRoots)) return;
 		const patternParts = pattern.split("/");
 		const initVisited = /* @__PURE__ */ new Set();
+		const physicalEntries = /* @__PURE__ */ new Map();
 		try {
 			const rootKey = cycleKey(await stat(resolved));
-			if (rootKey !== null) initVisited.add(rootKey);
+			if (rootKey !== null) {
+				initVisited.add(rootKey);
+				physicalEntries.set(rootKey, 1);
+			}
 		} catch {}
-		yield* this._globWalk(resolved, patternParts, caseSensitive, initVisited, physicalAllowedRoots, excludedEntries);
+		yield* this._globWalk(resolved, patternParts, caseSensitive, initVisited, physicalAllowedRoots, excludedEntries, signal, physicalEntries);
 	}
-	async *_globWalk(basePath, patternParts, caseSensitive, visited, physicalAllowedRoots, exclude) {
+	async *_globWalk(basePath, patternParts, caseSensitive, visited, physicalAllowedRoots, exclude, signal, physicalEntries) {
+		if (isAborted(signal)) return;
 		if (!await this._isWithinPhysicalRoots(basePath, physicalAllowedRoots)) return;
 		if (patternParts.length === 0) return;
 		const [currentPattern, ...remainingParts] = patternParts;
 		if (currentPattern === "**") {
-			if (remainingParts.length > 0) yield* this._globWalk(basePath, remainingParts, caseSensitive, visited, physicalAllowedRoots, exclude);
+			if (remainingParts.length > 0) yield* this._globWalk(basePath, remainingParts, caseSensitive, visited, physicalAllowedRoots, exclude, signal, physicalEntries);
 			else yield basePath;
+			if (isAborted(signal)) return;
 			let entries;
 			try {
 				entries = await readdir(basePath);
@@ -84639,6 +85645,7 @@ var LocalJian = class LocalJian {
 				return;
 			}
 			for (const entry of entries) {
+				if (isAborted(signal)) return;
 				if (exclude?.has(entry) === true) continue;
 				const fullPath = join$1(basePath, entry);
 				if (this._rootDir && !isWithinDirectory(fullPath, this._rootDir, this._platform)) continue;
@@ -84651,11 +85658,13 @@ var LocalJian = class LocalJian {
 				if (entryStat.isDirectory()) {
 					const key = cycleKey(entryStat);
 					if (key !== null && visited.has(key)) continue;
-					yield* this._globWalk(fullPath, patternParts, caseSensitive, key !== null ? new Set([...visited, key]) : visited, physicalAllowedRoots, exclude);
+					if (key !== null && !enterPhysical(key, physicalEntries)) continue;
+					yield* this._globWalk(fullPath, patternParts, caseSensitive, key !== null ? new Set([...visited, key]) : visited, physicalAllowedRoots, exclude, signal, physicalEntries);
 				} else if (remainingParts.length === 0 && await this._isWithinPhysicalRoots(fullPath, physicalAllowedRoots)) yield fullPath;
 			}
 		} else {
 			const regex = globPatternToRegex(currentPattern ?? "", caseSensitive);
+			if (isAborted(signal)) return;
 			let entries;
 			try {
 				entries = await readdir(basePath);
@@ -84663,6 +85672,7 @@ var LocalJian = class LocalJian {
 				return;
 			}
 			for (const entry of entries) {
+				if (isAborted(signal)) return;
 				if (exclude?.has(entry) === true) continue;
 				if (!regex.test(entry)) continue;
 				const fullPath = join$1(basePath, entry);
@@ -84679,7 +85689,8 @@ var LocalJian = class LocalJian {
 					if (entryStat.isDirectory()) {
 						const key = cycleKey(entryStat);
 						if (key !== null && visited.has(key)) continue;
-						yield* this._globWalk(fullPath, remainingParts, caseSensitive, key !== null ? new Set([...visited, key]) : visited, physicalAllowedRoots, exclude);
+						if (key !== null && !enterPhysical(key, physicalEntries)) continue;
+						yield* this._globWalk(fullPath, remainingParts, caseSensitive, key !== null ? new Set([...visited, key]) : visited, physicalAllowedRoots, exclude, signal, physicalEntries);
 					}
 				}
 			}
@@ -84713,22 +85724,133 @@ var LocalJian = class LocalJian {
 		return decodeTextWithErrors(await readFile(resolved), encoding, errors);
 	}
 	async *readLines(path, options) {
-		const stream = createReadStream(this._resolvePath(path), {
-			encoding: options?.encoding ?? "utf-8",
+		const resolved = this._resolvePath(path);
+		const encoding = options?.encoding ?? "utf-8";
+		const errors = options?.errors ?? "strict";
+		const signal = options?.signal;
+		const webLabel = utfTextDecoderLabel(encoding);
+		if (webLabel !== void 0) {
+			yield* this._readLinesWithTextDecoder(resolved, webLabel, errors, signal);
+			return;
+		}
+		const stream = createReadStream(resolved, {
+			encoding,
 			highWaterMark: 64 * 1024
 		});
 		let remainder = "";
 		try {
 			for await (const chunk of stream) {
+				if (isAborted(signal)) return;
 				const lines = (remainder + chunk).split("\n");
 				remainder = lines.pop() ?? "";
-				for (const line of lines) yield line + "\n";
+				for (const line of lines) {
+					if (isAborted(signal)) return;
+					yield line + "\n";
+				}
 			}
 		} finally {
 			stream.destroy();
 		}
 		if (remainder !== "") yield remainder;
 	}
+	/**
+	* Streaming read of a UTF-family file. `strict` / `replace` go through a
+	* `TextDecoder`: its state survives chunk boundaries, so a multi-byte
+	* character split at a chunk boundary decodes correctly, a leading BOM is
+	* removed exactly as the whole-file `readText` removes it, and `fatal`
+	* rejects invalid input exactly as decoding the whole file under
+	* `errors: 'strict'` does.
+	*
+	* `ignore` cannot use a `TextDecoder`: non-fatal decoding *replaces*
+	* invalid input with U+FFFD, while `ignore` must drop it (and keep U+FFFD
+	* characters the file already contains). That mode buffers raw bytes and
+	* decodes line by line with the same byte-level decoders the whole-file
+	* `readText` uses, so the two reads agree character for character.
+	*/
+	async *_readLinesWithTextDecoder(resolved, webLabel, errors, signal) {
+		if (errors === "ignore") {
+			yield* this._readLinesIgnoreBytes(resolved, webLabel, signal);
+			return;
+		}
+		const decoder = new TextDecoder(webLabel, { fatal: errors === "strict" });
+		const stream = createReadStream(resolved, { highWaterMark: 64 * 1024 });
+		let remainder = "";
+		const splitChunk = (text) => {
+			const lines = (remainder + text).split("\n");
+			remainder = lines.pop() ?? "";
+			return lines;
+		};
+		try {
+			for await (const chunk of stream) {
+				if (isAborted(signal)) return;
+				for (const line of splitChunk(decoder.decode(chunk, { stream: true }))) {
+					if (isAborted(signal)) return;
+					yield line + "\n";
+				}
+			}
+			for (const line of splitChunk(decoder.decode())) {
+				if (isAborted(signal)) return;
+				yield line + "\n";
+			}
+		} finally {
+			stream.destroy();
+		}
+		if (remainder !== "") yield remainder;
+	}
+	/**
+	* `errors: 'ignore'` streaming read for UTF-8 / UTF-16LE.
+	*
+	* Raw bytes are buffered until a line terminator — `0x0a` for UTF-8, the
+	* UTF-16LE code unit `U+000A` (`0a 00` at an even offset) for UTF-16LE —
+	* and the completed line is decoded with `decodeUtf8Ignore` /
+	* `decodeUtf16LeIgnore`. Splitting on those bytes can never cut a valid
+	* sequence: neither encoding contains a line-feed byte inside a multi-byte
+	* character or a surrogate pair, and decoding a line in isolation drops
+	* exactly the bytes the whole-file decode drops. Memory is bounded by the
+	* longest single line, like the `TextDecoder` path.
+	*/
+	async *_readLinesIgnoreBytes(resolved, webLabel, signal) {
+		const utf16Le = webLabel === "utf-16le";
+		const decodeLine = utf16Le ? decodeUtf16LeIgnore : decodeUtf8Ignore;
+		const stream = createReadStream(resolved, { highWaterMark: 64 * 1024 });
+		/** Raw byte runs of the line currently being assembled, in order. */
+		let pending = [];
+		/** UTF-16LE only: the odd byte a chunk ended on, rejoined with the next
+		*  chunk so the line-feed scan only ever steps over whole code units. */
+		let carry;
+		const concatPending = (tail) => tail === void 0 || tail.length === 0 ? Buffer.concat(pending) : Buffer.concat([...pending, tail]);
+		const findLineBreak = (data, from) => {
+			if (!utf16Le) return data.indexOf(10, from);
+			for (let i = from; i + 1 < data.length; i += 2) if (data[i] === 10 && data[i + 1] === 0) return i;
+			return -1;
+		};
+		try {
+			for await (const chunk of stream) {
+				if (isAborted(signal)) return;
+				let data = carry === void 0 ? chunk : Buffer.concat([carry, chunk]);
+				carry = void 0;
+				if (utf16Le && data.length % 2 === 1) {
+					carry = data.subarray(data.length - 1);
+					data = data.subarray(0, data.length - 1);
+				}
+				let start = 0;
+				for (;;) {
+					const at = findLineBreak(data, start);
+					if (at === -1) break;
+					if (isAborted(signal)) return;
+					const end = at + (utf16Le ? 2 : 1);
+					yield decodeLine(concatPending(data.subarray(start, end)));
+					pending = [];
+					start = end;
+				}
+				if (start < data.length) pending.push(data.subarray(start));
+			}
+		} finally {
+			stream.destroy();
+		}
+		const tail = concatPending(carry);
+		if (tail.length > 0) yield decodeLine(tail);
+	}
 	async writeBytes(path, data) {
 		await writeFile(this._resolvePath(path), data);
 		return data.length;
@@ -84824,6 +85946,22 @@ new AsyncLocalStorage();
 //#region ../../packages/agent-core/src/session/hooks/runner.ts
 const DEFAULT_TIMEOUT_SECONDS = 30;
 const KILL_GRACE_MS = 100;
+/**
+* Hook stdout/stderr come from an external process and must not accumulate
+* without bound. Head+tail retention of 32 KiB keeps a complete prefix and a
+* useful trailing slice for debugging while capping the string that reaches
+* HookResult. Outputs below the cap round-trip byte-for-byte, so structured
+* JSON parsing is unaffected.
+*/
+const HOOK_STREAM_MAX_CHARS = 24 * 1024;
+const HOOK_STREAM_TAIL_CHARS = 8 * 1024;
+function createHookStreamBuffer() {
+	return new ToolResultBuilder({
+		maxChars: HOOK_STREAM_MAX_CHARS,
+		maxTailChars: HOOK_STREAM_TAIL_CHARS,
+		maxLineLength: null
+	});
+}
 const OptionalStringSchema = z.preprocess((value) => {
 	if (value === void 0 || value === null) return void 0;
 	if (typeof value === "string") return value;
@@ -84851,8 +85989,8 @@ async function runHook(command, input, options) {
 		return allowResult({ stderr: errorMessage$2(error) });
 	}
 	return new Promise((resolve) => {
-		let stdout = "";
-		let stderr = "";
+		const stdoutBuf = createHookStreamBuffer();
+		const stderrBuf = createHookStreamBuffer();
 		let settled = false;
 		const timeoutMs = timeoutSeconds(options.timeout) * 1e3;
 		const cleanup = () => {
@@ -84868,16 +86006,16 @@ async function runHook(command, input, options) {
 		const timeout = setTimeout(() => {
 			killProcess(child);
 			settle(allowResult({
-				stdout,
-				stderr,
+				stdout: stdoutBuf.toString(),
+				stderr: stderrBuf.toString(),
 				timedOut: true
 			}));
 		}, timeoutMs);
 		const onAbort = () => {
 			killProcess(child);
 			settle(allowResult({
-				stdout,
-				stderr
+				stdout: stdoutBuf.toString(),
+				stderr: stderrBuf.toString()
 			}));
 		};
 		options.signal?.addEventListener("abort", onAbort, { once: true });
@@ -84888,19 +86026,20 @@ async function runHook(command, input, options) {
 		child.stdout.setEncoding("utf8");
 		child.stderr.setEncoding("utf8");
 		child.stdout.on("data", (chunk) => {
-			stdout += chunk;
+			stdoutBuf.write(chunk);
 		});
 		child.stderr.on("data", (chunk) => {
-			stderr += chunk;
+			stderrBuf.write(chunk);
 		});
 		child.on("error", (error) => {
+			stderrBuf.write(errorMessage$2(error));
 			settle(allowResult({
-				stdout,
-				stderr: stderr + errorMessage$2(error)
+				stdout: stdoutBuf.toString(),
+				stderr: stderrBuf.toString()
 			}));
 		});
 		child.on("close", (code) => {
-			settle(resultFromExitCode(code ?? 0, stdout, stderr));
+			settle(resultFromExitCode(code ?? 0, stdoutBuf.toString(), stderrBuf.toString()));
 		});
 		child.stdin.on("error", () => {});
 		child.stdin.end(JSON.stringify(input));
@@ -88154,16 +89293,30 @@ const MIGRATIONS = [
 		migrateRecord(record) {
 			return record;
 		}
+	},
+	{
+		sourceVersion: "1.4",
+		targetVersion: "1.5",
+		migrateRecord(record) {
+			return record;
+		}
+	},
+	{
+		sourceVersion: "1.5",
+		targetVersion: "1.6",
+		migrateRecord(record) {
+			return record;
+		}
 	}
 ];
 function isNewerWireVersion(readVersion) {
-	return compareWireVersions(readVersion, "1.4") > 0;
+	return compareWireVersions(readVersion, "1.6") > 0;
 }
 function resolveWireMigrations(readVersion) {
-	if (compareWireVersions(readVersion, "1.4") >= 0) return [];
+	if (compareWireVersions(readVersion, "1.6") >= 0) return [];
 	const migrations = [];
 	let version = readVersion;
-	while (compareWireVersions(version, "1.4") < 0) {
+	while (compareWireVersions(version, "1.6") < 0) {
 		const migration = findMigration(version);
 		if (migration === void 0) throw new Error(`Missing wire migration for version ${version}`);
 		migrations.push(migration);
@@ -88271,7 +89424,7 @@ function headStartsWithAnyPrefix(head, headLength, prefixes) {
 */
 function readSkipFoldedFlag(headerText) {
 	try {
-		return JSON.parse(headerText).protocol_version === "1.4";
+		return JSON.parse(headerText).protocol_version === "1.6";
 	} catch {
 		return false;
 	}
@@ -89041,11 +90194,14 @@ function restoreAgentRecord(agent, input) {
 			agent.wolfpackMode.exit();
 			return;
 		case "rlm.enter":
-			agent.restoreRlm(true);
+			agent.restoreRlm(true, input);
 			return;
 		case "rlm.exit":
 			agent.restoreRlm(false);
 			return;
+		case "rlm.settings":
+			agent.restoreRlmSettings(input.maxDepth);
+			return;
 		case "goal.create":
 			agent.goal.restoreCreate(input);
 			return;
@@ -89080,6 +90236,7 @@ function restoreAgentRecord(agent, input) {
 		case "context.edit_message":
 			agent.context.applyMessageEdit(input.targetId, input.replacement);
 			return;
+		case "context.prefix_break": return;
 		case "context.snapshot":
 			agent.context.restoreJSONSnapshot(input.snapshot);
 			agent.fullCompaction.restoreCompactedHistory(input.compactedHistory);
@@ -89126,7 +90283,7 @@ var AgentRecords = class {
 		if (this.persistence !== void 0 && !this.metadataInitialized && stamped.type !== "metadata") {
 			this.persistence.append({
 				type: "metadata",
-				protocol_version: "1.4",
+				protocol_version: "1.6",
 				created_at: Date.now()
 			});
 			this.metadataInitialized = true;
@@ -89157,18 +90314,18 @@ var AgentRecords = class {
 				this.metadataInitialized = true;
 				const readVersion = record.protocol_version;
 				if (isNewerWireVersion(readVersion)) {
-					warning = `Session wire protocol version ${readVersion} is newer than the current version 1.4. Records will be replayed without migration.`;
+					warning = `Session wire protocol version ${readVersion} is newer than the current version 1.6. Records will be replayed without migration.`;
 					shouldRewrite = false;
 				} else {
 					migrations = resolveWireMigrations(readVersion);
-					shouldRewrite = readVersion !== "1.4";
+					shouldRewrite = readVersion !== "1.6";
 				}
 				buffered = shouldRewrite || warning !== void 0;
 			}
 			let migratedRecord = migrateWireRecord(record, migrations);
 			if (migratedRecord.type === "metadata") migratedRecord = {
 				...migratedRecord,
-				protocol_version: "1.4"
+				protocol_version: "1.6"
 			};
 			if (buffered) {
 				replayedRecords.push(migratedRecord);
@@ -96918,13 +98075,16 @@ const TOOL_OUTPUT_NON_TEXT = "Tool returned non-text content.";
 const UNEXECUTED_TOOL_CALL_OUTPUT = "This tool call was not executed: the model response ended before tool execution could start (the provider stream was interrupted). Do not assume the tool ran - re-issue the call if it is still needed.";
 const validators = /* @__PURE__ */ new WeakMap();
 /**
-* Output for an aborted tool call. When the abort carries a user-cancellation
-* reason (the user pressed stop), say so explicitly so the model treats it as a
-* deliberate interruption instead of a system fault to theorise about or retry.
-* Any other abort keeps the neutral wording.
+* Output for an aborted tool call. The abort's reason decides the attribution:
+* a user cancellation (the user pressed stop) says so explicitly, and a parent
+* interject says it was a deliberate redirection to be picked up from the
+* `[parent_messages]` directive that follows — in both cases so the model
+* treats it as intentional instead of a system fault to theorise about or
+* retry. Any other abort keeps the neutral wording.
 */
 function abortedToolOutput(toolName, signal) {
 	if (isUserCancellation(signal.reason)) return `The user manually interrupted "${toolName}" (and anything else running at the same time). This was a deliberate user action, not a system error, timeout, or capacity limit. Do not retry automatically or guess at the cause — wait for the user's next instruction.`;
+	if (isParentInterject(signal.reason)) return `The parent agent interrupted "${toolName}" (and anything else running at the same time) with an interjection. This was a deliberate redirection, not a system error, timeout, or capacity limit. Read the [parent_messages] directive that follows and follow it — do not retry this call or wait for the user.`;
 	return `Tool "${toolName}" was aborted`;
 }
 /**
@@ -97000,7 +98160,7 @@ async function runToolCallBatch(step, response) {
 		signal: AbortSignal.any([step.signal, steerController.signal])
 	};
 	const abortOnSteer = () => {
-		if (step.hasPendingSteer?.() === true && steerController !== void 0 && !steerController.signal.aborted) steerController.abort(userCancellationReason());
+		if (step.hasPendingSteer?.() === true && steerController !== void 0 && !steerController.signal.aborted) steerController.abort(step.pendingSteerKind?.() === "parent-interject" ? parentInterjectReason() : userCancellationReason());
 	};
 	abortOnSteer();
 	const steerPoll = steerController === void 0 ? void 0 : setInterval(() => {
@@ -97639,6 +98799,7 @@ async function executeLoopStep(deps) {
 		currentStep,
 		stepUuid,
 		hasPendingSteer: deps.hasPendingSteer,
+		pendingSteerKind: deps.pendingSteerKind,
 		toolCallBlockIndex: { value: 0 }
 	};
 	await dispatchEvent({
@@ -97987,6 +99148,7 @@ async function runTurn(input) {
 				maxRetryAttempts,
 				recordUsage: recordStepUsage,
 				hasPendingSteer: input.hasPendingSteer,
+				pendingSteerKind: input.pendingSteerKind,
 				mediaProjection,
 				onStreamingDraft: input.onStreamingDraft
 			});
@@ -102413,12 +103575,25 @@ function createGoalGrader(agent) {
 		};
 	};
 }
+/** Retained-handle capacity of the rlm bridge. When full, settled handles are
+* evicted first (FIFO, oldest insertion first); only a pathological map where
+* every handle is still in flight falls back to dropping the oldest live
+* handle, whose result then becomes unretrievable. */
+const RLM_HANDLE_CAPACITY = 128;
+/** How long a settled handle's result stays retrievable before the next
+* handle operation lazily evicts it. */
+const RLM_HANDLE_TTL_MS = 30 * 6e4;
 /**
 * Host bridge handlers for the /rlm python kernel: `rlm.run` spawns a
 * subagent (reusing the subagent host) and returns its handle id;
 * `rlm.result` waits for that subagent's final summary. Handles are kept in
 * a closure map for the lifetime of the ToolManager (one per session).
 *
+* Handle retention: a settled handle stays readable — rlm_wait can be called
+* any number of times and always returns the same result — and an entry is
+* only removed by (1) kernel teardown (`__dispose__`), (2) capacity eviction,
+* or (3) the lazy TTL sweep. It is never removed by consumption.
+*
 * Recursion guard: a subagent may only spawn its own rlm() children if its
 * depth is below the cap. Depth is carried on each agent instance (root = 0,
 * every spawned subagent = parent + 1). The cap is per-agent
@@ -102427,8 +103602,27 @@ function createGoalGrader(agent) {
 */
 function createRlmHostHandlers(agent) {
 	const handles = /* @__PURE__ */ new Map();
+	/** Lazy TTL sweep, run at the top of every handle operation: settled
+	* handles older than the TTL are dropped so a long session cannot retain
+	* them forever. */
+	const evictExpired = () => {
+		const now = Date.now();
+		for (const [id, entry] of handles) if (entry.settledAt !== void 0 && now - entry.settledAt > RLM_HANDLE_TTL_MS) handles.delete(id);
+	};
+	/** Capacity guard, run before inserting a new handle. Map iteration is
+	* insertion order, so the first settled entry found is the oldest. */
+	const makeRoom = () => {
+		if (handles.size < RLM_HANDLE_CAPACITY) return;
+		for (const [id, entry] of handles) if (entry.settledAt !== void 0) {
+			handles.delete(id);
+			return;
+		}
+		const oldest = handles.keys().next().value;
+		if (oldest !== void 0) handles.delete(oldest);
+	};
 	return {
 		"rlm.run": async (payload) => {
+			evictExpired();
 			const host = agent.subagentHost;
 			if (host === void 0) throw new Error("subagent host unavailable");
 			if (agent.getRlmDepth() >= agent.getRlmMaxDepth()) throw new Error(`RLM recursion depth limit reached (depth ${agent.getRlmDepth()}, max ${agent.getRlmMaxDepth()}). Nested rlm() subagents are not allowed.`);
@@ -102448,11 +103642,13 @@ function createRlmHostHandlers(agent) {
 				name,
 				controller
 			};
+			makeRoom();
 			handles.set(handle.agentId, entry);
-			handle.completion.then((result) => {
-				entry.result = result;
+			handle.completion.then((completion) => {
+				entry.result = completion.result;
+				entry.settledAt = Date.now();
 			}, () => {
-				entry.result = void 0;
+				entry.settledAt = Date.now();
 			});
 			return {
 				id: handle.agentId,
@@ -102460,16 +103656,12 @@ function createRlmHostHandlers(agent) {
 			};
 		},
 		"rlm.result": async (payload) => {
+			evictExpired();
 			const id = String(payload["id"]);
 			const entry = handles.get(id);
 			if (entry === void 0) throw new Error(`unknown rlm handle: ${id}`);
-			if (entry.result !== void 0) {
-				handles.delete(id);
-				return { result: entry.result };
-			}
-			const result = (await entry.completion).result;
-			handles.delete(id);
-			return { result };
+			if (entry.result !== void 0) return { result: entry.result };
+			return { result: (await entry.completion).result };
 		},
 		__dispose__: async () => {
 			for (const { controller } of handles.values()) controller.abort(/* @__PURE__ */ new Error("rlm kernel disposed"));
@@ -102960,6 +104152,13 @@ var ToolManager = class {
 			this.lspRegistry = new LspRegistry(jian, this.agent.lspSupervisor);
 			this.lspRegistryJian = jian;
 		}
+		const previousPython = this.getBuiltinTool("python");
+		let pythonTool;
+		if (previousPython instanceof PythonTool && previousPython.cwd === cwd) pythonTool = previousPython;
+		else {
+			if (previousPython instanceof PythonTool) previousPython.dispose();
+			pythonTool = new PythonTool(cwd, { hostHandlers: createRlmHostHandlers(this.agent) });
+		}
 		const allowBackground = this.enabledTools.has("TaskList") && this.enabledTools.has("TaskOutput") && this.enabledTools.has("TaskStop");
 		const allowedSpawns = DEFAULT_AGENT_PROFILES[this.agent.config.profileName ?? "agent"]?.spawns;
 		const canSpawn = this.agent.subagentHost && (this.agent.type !== "sub" || allowedSpawns !== void 0 && allowedSpawns.length > 0);
@@ -102973,9 +104172,10 @@ var ToolManager = class {
 			new GlobTool(jian, workspace),
 			new BashTool(jian, cwd, background, {
 				allowBackground,
-				availableTools: this.enabledTools
+				availableTools: this.enabledTools,
+				ownerId: this.agent.sessionId
 			}),
-			new PythonTool(cwd, { hostHandlers: createRlmHostHandlers(this.agent) }),
+			pythonTool,
 			new ScriptTool(this.toolStore),
 			(modelCapabilities.image_in || modelCapabilities.video_in) && new ReadMediaFileTool(jian, workspace, modelCapabilities, videoUploader),
 			new EnterPlanModeTool(this.agent),
@@ -103568,6 +104768,20 @@ const TURN_DEFAULTS = {
 //#region ../../packages/agent-core/src/agent/turn/index.ts
 /** Cap on how long the first turn waits for MCP servers to finish loading. */
 const MCP_WAIT_TIMEOUT_MS = 1e4;
+/**
+* Whether a buffered steer interrupts an in-flight tool batch — interactive
+* user steers do, and so does any steer carrying an explicit `interrupt: true`
+* (the parent host's interject); background/cron/hook steers (no flag) and
+* auto-drained queue messages (`interrupt: false`) only join at the next step
+* boundary.
+*
+* Single source of truth for the lane: `hasPendingSteer` (does one exist?) and
+* `pendingSteerKind` (whose is it?) must classify identically, or a new
+* interrupt lane would interrupt without being attributed.
+*/
+function isInterruptingSteer(steer) {
+	return steer.interrupt === true || steer.origin.kind === "user" && steer.interrupt !== false;
+}
 var TurnFlow = class {
 	agent;
 	steerBuffer = [];
@@ -103964,6 +105178,7 @@ var TurnFlow = class {
 		let stopHookContinuationUsed = false;
 		const deduper = new ToolCallDeduplicator();
 		const turnToolFilter = this.agent.tools.snapshotEnabledTools();
+		const stepTools = { current: void 0 };
 		await Promise.race([this.agent.mcp?.waitForInitialLoad(signal) ?? Promise.resolve(), new Promise((resolve) => setTimeout(resolve, MCP_WAIT_TIMEOUT_MS))]);
 		while (true) {
 			signal.throwIfAborted();
@@ -103974,14 +105189,19 @@ var TurnFlow = class {
 					turnId: String(turnId),
 					signal,
 					llm: this.agent.llm,
-					buildMessages: () => this.agent.context.messagesForLLM(),
+					buildMessages: () => this.agent.context.messagesForLLM(stepTools.current),
 					dispatchEvent: this.buildDispatchEvent(turnId),
 					tools: this.agent.tools.loopTools,
-					buildTools: () => this.agent.tools.loopToolsFor(turnToolFilter),
+					buildTools: () => stepTools.current = this.agent.tools.loopToolsFor(turnToolFilter),
 					log: this.agent.log,
 					maxSteps: loopControl?.maxStepsPerTurn,
 					maxRetryAttempts: loopControl?.maxRetriesPerStep,
-					hasPendingSteer: () => this.steerBuffer.some((steer) => steer.origin.kind === "user" && steer.interrupt !== false),
+					hasPendingSteer: () => this.steerBuffer.some(isInterruptingSteer),
+					pendingSteerKind: () => {
+						const interrupting = this.steerBuffer.filter(isInterruptingSteer);
+						if (interrupting.some((steer) => steer.origin.kind === "user")) return "user";
+						return interrupting.some((steer) => steer.origin.kind === "system_trigger" && steer.origin.name === "parent_interject") ? "parent-interject" : "user";
+					},
 					onStreamingDraft: (text, think) => {
 						this.agent.records.logRecord({
 							type: "context.stream_draft",
@@ -104633,8 +105853,19 @@ function totalUsage(byModel) {
 //#endregion
 //#region ../../packages/agent-core/src/agent/index.ts
 const SIDE_QUESTION_SYSTEM = "You are a helpful coding assistant answering a quick side question. The user is in the middle of a coding session and needs a fast, concise answer. Keep your response short and focused — this is a side question, not the main task.";
+/** Wire representation of the RLM recursion cap: `Infinity` (unlimited) is
+*  serialized as null, since JSON has no Infinity. */
+function rlmMaxDepthForWire(maxDepth) {
+	return Number.isFinite(maxDepth) ? maxDepth : null;
+}
 var Agent = class {
 	type;
+	/** Stable id of this agent inside its session ('main' for the root agent);
+	*  status events carry it so consumers can tell main from subagents. */
+	agentId;
+	/** Session that owns this agent; undefined outside a session (see
+	*  {@link AgentOptions.sessionId}). */
+	sessionId;
 	jian;
 	screamConfig;
 	homedir;
@@ -104688,6 +105919,8 @@ var Agent = class {
 	resolveRuntimeSystemPrompt;
 	constructor(options) {
 		this.type = options.type ?? "main";
+		this.agentId = options.agentId ?? "main";
+		this.sessionId = options.sessionId;
 		this.jian = options.jian;
 		this.screamConfig = options.config;
 		this.homedir = options.homedir;
@@ -104731,7 +105964,7 @@ var Agent = class {
 		this.cron = this.type === "sub" ? null : new CronManager(this);
 		this.goal = new GoalMode(this);
 		const screamHomeDir = options.screamHomeDir;
-		this.memoStore = screamHomeDir ? new MemoryMemoStore(screamHomeDir, this.log) : void 0;
+		this.memoStore = screamHomeDir ? sharedMemoStore(screamHomeDir, this.log) : void 0;
 		this.memoStoreReady = this.initMemoStore(screamHomeDir);
 		this.knowledgeStore = screamHomeDir !== void 0 && this.type === "main" ? sharedKnowledgeStore(screamHomeDir) : void 0;
 		this.knowledgeStoreReady = this.knowledgeStore !== void 0 && screamHomeDir !== void 0 ? sharedKnowledgeStoreReady(screamHomeDir).catch((error) => {
@@ -104786,7 +106019,7 @@ var Agent = class {
 				this.log.error("memory legacy migration failed", error);
 			}
 			try {
-				this.memoStore.setEmbeddingEngine(this.sharedEmbeddingEngine);
+				if (!this.memoStore.getEmbeddingEngine()) this.memoStore.setEmbeddingEngine(this.sharedEmbeddingEngine);
 			} catch (error) {
 				this.log.warn("embedding engine init failed; falling back to keyword search", error);
 			}
@@ -104824,11 +106057,14 @@ var Agent = class {
 		return this.rlmMaxDepth;
 	}
 	setRlmMaxDepth(maxDepth) {
-		if (!Number.isFinite(maxDepth) || maxDepth <= 0) {
-			this.rlmMaxDepth = Infinity;
-			return;
-		}
-		this.rlmMaxDepth = Math.trunc(maxDepth);
+		const normalized = normalizeRlmMaxDepth(maxDepth);
+		if (normalized === this.rlmMaxDepth) return;
+		this.rlmMaxDepth = normalized;
+		this.records.logRecord({
+			type: "rlm.settings",
+			maxDepth: rlmMaxDepthForWire(this.rlmMaxDepth)
+		});
+		this.emitStatusUpdated();
 	}
 	/** Disposes the persistent python kernel (if any) and resets RLM mode.
 	* Called on session close so no orphaned kernel process is left behind.
@@ -104860,7 +106096,10 @@ var Agent = class {
 			if (withoutPython.length !== current.length) this.tools.setActiveTools(withoutPython);
 			this.tools.getBuiltinTool("python")?.dispose?.();
 		}
-		this.records.logRecord({ type: enabled ? "rlm.enter" : "rlm.exit" });
+		this.records.logRecord(enabled ? {
+			type: "rlm.enter",
+			maxDepth: rlmMaxDepthForWire(this.rlmMaxDepth)
+		} : { type: "rlm.exit" });
 		this.emitStatusUpdated();
 	}
 	/** Returns whether RLM (persistent python mode) is currently enabled. */
@@ -104904,7 +106143,11 @@ var Agent = class {
 		this.rlmEnabled = true;
 		const current = this.tools.getActiveTools();
 		if (!current.includes("python")) this.tools.setActiveTools([...current, "python"]);
-		this.records.logRecord({ type: "rlm.enter" });
+		this.records.logRecord({
+			type: "rlm.enter",
+			depth: this.rlmDepth,
+			maxDepth: rlmMaxDepthForWire(this.rlmMaxDepth)
+		});
 	}
 	/** Capability mode this agent runs under; `all` for main agents and for
 	*  subagents the parent did not restrict. The RLM python bridge forwards it
@@ -104919,10 +106162,14 @@ var Agent = class {
 	getCapabilityMode() {
 		return this.capabilityMode;
 	}
-	/** Restores RLM mode from a persisted record during replay. Does not log
-	* a new record and does not emit a status update (both are suppressed while
-	* records are restoring). */
-	restoreRlm(enabled) {
+	/** Restores RLM mode from a persisted record during replay, including the
+	* recursion bookkeeping the enter payload carries since wire v1.6 (missing
+	* fields mean an older wire — the defaults stay). Does not log a new record
+	* and does not emit a status update (both are suppressed while records are
+	* restoring). */
+	restoreRlm(enabled, payload = {}) {
+		if (payload.depth !== void 0) this.setRlmDepth(payload.depth);
+		if (payload.maxDepth !== void 0) this.restoreRlmSettings(payload.maxDepth);
 		this.rlmEnabled = enabled;
 		const current = this.tools.getActiveTools();
 		if (enabled) {
@@ -104932,6 +106179,11 @@ var Agent = class {
 			if (withoutPython.length !== current.length) this.tools.setActiveTools(withoutPython);
 		}
 	}
+	/** Restores the RLM recursion cap from a persisted `rlm.settings` record
+	* during replay. Silent on purpose: no new record, no status event. */
+	restoreRlmSettings(maxDepth) {
+		this.rlmMaxDepth = maxDepth === null ? Infinity : normalizeRlmMaxDepth(maxDepth);
+	}
 	get generate() {
 		return async (provider, systemPrompt, tools, history, callbacks, options) => {
 			if (options?.auth !== void 0) {
@@ -105359,6 +106611,7 @@ var Agent = class {
 		const model = this.config.model;
 		this.emitEvent({
 			type: "agent.status.updated",
+			agentId: this.agentId,
 			model,
 			thinkingLevel: this.config.thinkingLevel,
 			contextTokens,
@@ -105368,6 +106621,7 @@ var Agent = class {
 			planStrategy: this.planMode.isActive ? this.planMode.strategy : void 0,
 			wolfpackMode: this.wolfpackMode.isActive,
 			rlmEnabled: this.rlmEnabled,
+			rlmMaxDepth: rlmMaxDepthForWire(this.rlmMaxDepth),
 			permission: this.permission.mode,
 			usage
 		});
@@ -109677,13 +110931,12 @@ var SubagentMessageBus = class {
 	/**
 	* Number of messages still deliverable for `agentId`. Expired ones are not
 	* counted: `poll` drops them, so counting them would make the host spend a
-	* delivery turn on a message that can never arrive.
+	* delivery turn on a message that can never arrive. Counting is also an
+	* ordinary bus access, so it reclaims mail that has expired by now.
 	*/
 	activeCount(agentId) {
-		const queue = this.mailboxes.get(agentId)?.queue;
-		if (queue === void 0) return 0;
-		const now = Date.now();
-		return queue.reduce((count, m) => m.deadline > now ? count + 1 : count, 0);
+		this.reclaimExpired(Date.now());
+		return this.mailboxes.get(agentId)?.queue.length ?? 0;
 	}
 	/**
 	* Queue a message for a subagent. Pure mailbox logic: ownership, liveness
@@ -109691,7 +110944,9 @@ var SubagentMessageBus = class {
 	* on acceptance, the queue depth seen by the recipient at poll time.
 	*/
 	send(msg) {
-		if (Date.now() > msg.deadline) return { status: "deadline_elapsed" };
+		const now = Date.now();
+		this.reclaimExpired(now);
+		if (now > msg.deadline) return { status: "deadline_elapsed" };
 		if (byteLength(msg.text) > msg.byteLimit) return {
 			status: "saturated",
 			reason: "bytes"
@@ -109717,19 +110972,52 @@ var SubagentMessageBus = class {
 		};
 	}
 	/**
+	* Drop every queued message in every mailbox (session teardown). Id and seq
+	* counters stay monotonic so identifiers issued before the clear are never
+	* reissued.
+	*/
+	clear() {
+		this.mailboxes.clear();
+	}
+	/** Mailbox entries currently pinned in memory (diagnostics / assertions).
+	*  Reading does not reclaim: an entry whose mail has all expired is freed by
+	*  the next send/activeCount/poll, not by this getter. */
+	get mailboxCount() {
+		return this.mailboxes.size;
+	}
+	/**
+	* Drop mail that can no longer be delivered and free the mailbox slot it
+	* pinned. A message is deliverable only until its deadline; past it, `poll`
+	* would discard it rather than hand it to the child, so keeping it would pin
+	* memory for a run that has already ended. Called on every ordinary bus
+	* access — send, activeCount, poll — which is what keeps the mailbox map
+	* bounded now that a finished child's terminal no longer purges its mailbox.
+	*/
+	reclaimExpired(now) {
+		for (const [agentId, mailbox] of this.mailboxes) {
+			const live = mailbox.queue.filter((m) => m.deadline > now);
+			if (live.length === 0) this.mailboxes.delete(agentId);
+			else if (live.length !== mailbox.queue.length) mailbox.queue = live;
+		}
+	}
+	/**
 	* Deliver all pending, unexpired messages for `agentId`. Steer messages are
 	* always dequeued before queue messages; within an operation class, arrival
 	* order is preserved via the monotonically increasing `seq` (this is a stable
-	* two-pass collection, not a sort). Messages past their deadline are dropped.
+	* two-pass collection, not a sort). Messages past their deadline are
+	* reclaimed, never delivered.
+	*
+	* The mailbox entry is removed once its queue is emptied: a polled-out (or
+	* fully expired) mailbox must not pin a Map slot.
 	*/
 	poll(agentId) {
-		const mailbox = this.mailboxes.get(agentId);
-		if (mailbox === void 0 || mailbox.queue.length === 0) return [];
 		const now = Date.now();
-		const live = mailbox.queue.filter((m) => m.deadline > now);
-		mailbox.queue = [];
-		const steers = live.filter((m) => m.operation === "steer");
-		const queues = live.filter((m) => m.operation === "queue");
+		this.reclaimExpired(now);
+		const mailbox = this.mailboxes.get(agentId);
+		if (mailbox === void 0) return [];
+		this.mailboxes.delete(agentId);
+		const steers = mailbox.queue.filter((m) => m.operation === "steer");
+		const queues = mailbox.queue.filter((m) => m.operation === "queue");
 		steers.sort((a, b) => a.seq - b.seq);
 		queues.sort((a, b) => a.seq - b.seq);
 		return [...steers, ...queues];
@@ -109785,6 +111073,39 @@ function union(...sets) {
 	for (const s of sets) for (const v of s) out.add(v);
 	return out;
 }
+/** Strictness order: earlier = narrower (fewer tools permitted). */
+const CAPABILITY_ORDER = [
+	"read-only",
+	"read-write",
+	"execute",
+	"all"
+];
+/**
+* The narrower of two capability modes (`read-only` < `read-write` < `execute`
+* < `all`). Resume uses this to clamp: a resumed agent keeps the tool set it
+* already has (its profile is not rebuilt), so its contract may be re-applied
+* or tightened, never widened.
+*/
+function narrowerCapability(a, b) {
+	return CAPABILITY_ORDER.indexOf(a) <= CAPABILITY_ORDER.indexOf(b) ? a : b;
+}
+/**
+* Infer the strictest capability mode that already permits `activeTools` — the
+* first mode whose `filterToolsForCapability` pass removes nothing, else `all`.
+*
+* Used when resuming a session recorded before `AgentMeta.capabilityMode`
+* existed: filtering is pure subtraction, so a tool set that survives
+* `read-only` unchanged is evidence the agent was never granted more than
+* that. The inference can only be too *narrow* (a set that happens to contain
+* only allowed tools), which is the safe direction for a capability clamp.
+*/
+function inferCapabilityFromTools(activeTools) {
+	for (const mode of CAPABILITY_ORDER) {
+		if (mode === "all") break;
+		if (filterToolsForCapability(activeTools, mode).length === activeTools.length) return mode;
+	}
+	return "all";
+}
 //#endregion
 //#region ../../packages/agent-core/src/session/summary-continuation.md
 var summary_continuation_default = "Your previous response was too brief. Please provide a more comprehensive summary that includes:\n\n1. Specific technical details and implementations\n2. Detailed findings and analysis\n3. All important information that the parent agent should know";
@@ -109809,14 +111130,25 @@ const SUMMARY_CONTINUATION_ATTEMPTS = 1;
 */
 const MAX_PARENT_MESSAGE_DELIVERY_TURNS = 2;
 const HOOK_TEXT_PREVIEW_LENGTH = 500;
+/**
+* Upper bound on how long a finished child's resource release may hold back the
+* `completion` its callers await. A healthy release finishes in well under a
+* second; the bound only bites when a language server has stopped answering,
+* where the wait is capped only by the LSP request timeout and every caller —
+* the foreground Agent tool call, TaskStop, rlm_wait — is parked with it, so
+* the parent turn looks hung.
+*/
+const CHILD_RELEASE_BOUND_MS = 5e3;
 const SUBAGENT_MAX_TOKENS_ERROR = "Subagent turn failed before completing its final summary: reason=max_tokens";
 /**
 * Render parent messages as the block a child sees. Both delivery paths share
 * this — the mid-run steer and the turn-start injection — so a message looks
-* identical to the child however it arrives.
+* identical to the child however it arrives. Anything that is not a plain
+* `queue` message renders as a `[directive]` (steer, and the interject that
+* degrades to a mailbox steer).
 */
 function formatParentMessagesBlock(messages) {
-	return `[parent_messages]\n${messages.map((m) => m.operation === "steer" ? `[directive] ${m.text}` : `[message] ${m.text}`).join("\n\n")}`;
+	return `[parent_messages]\n${messages.map((m) => m.operation === "queue" ? `[message] ${m.text}` : `[directive] ${m.text}`).join("\n\n")}`;
 }
 var SessionSubagentHost = class {
 	session;
@@ -109867,16 +111199,14 @@ var SessionSubagentHost = class {
 			runInBackground: options.runInBackground,
 			structured: options.outputSchema !== void 0
 		});
-		const completion = this.runChild(parent, id, agent, profile.name, {
+		const run = this.runChild(parent, id, agent, profile.name, {
 			...options,
 			signal: controller.signal
-		}, () => this.configureChild(parent, agent, profile, options.capabilityMode)).finally(() => {
-			unlinkAbortSignal();
-			this.activeChildren.delete(id);
-			this.childRequestCounts.delete(id);
-			this.childRequestSeen.delete(id);
-			this.parentMessageSeen.delete(id);
-		});
+		}, () => this.configureChild(parent, agent, profile, id, options.capabilityMode));
+		const completion = this.withChildTerminalRelease(parent, agent, {
+			childId: id,
+			unlinkAbortSignal
+		}, run);
 		return {
 			agentId: id,
 			profileName: profile.name,
@@ -109888,7 +111218,8 @@ var SessionSubagentHost = class {
 		options.signal.throwIfAborted();
 		const parent = this.session.agents.get(this.ownerAgentId);
 		if (parent === void 0) throw new Error(`Parent agent "${this.ownerAgentId}" was not found`);
-		const child = this.session.agents.get(agentId);
+		let child = this.session.agents.get(agentId);
+		if (child === void 0 && typeof this.session.ensureAgent === "function") child = await this.session.ensureAgent(agentId).catch(() => void 0);
 		if (child === void 0) throw new Error(`Agent instance "${agentId}" was not found`);
 		const metadata = this.session.metadata.agents[agentId];
 		if (metadata?.type !== "sub") throw new Error(`Agent instance "${agentId}" is not a subagent`);
@@ -109902,30 +111233,33 @@ var SessionSubagentHost = class {
 			runInBackground: options.runInBackground,
 			structured: options.outputSchema !== void 0
 		});
+		const run = this.runChild(parent, agentId, child, profileName, {
+			...options,
+			signal: controller.signal
+		}, () => {
+			const binding = this.resolveModelBinding(profileName);
+			const modelAlias = this.resolveValidModelAlias(parent, binding);
+			const thinkingLevel = this.resolveThinkingLevel(parent, binding, parent.config.thinkingLevel);
+			child.config.update({
+				modelAlias,
+				thinkingLevel
+			});
+			const baseline = metadata.capabilityMode ?? inferCapabilityFromTools(child.tools.getActiveTools());
+			const requested = options.capabilityMode;
+			const effective = requested === void 0 ? baseline : narrowerCapability(requested, baseline);
+			if (effective !== "all") child.tools.setActiveTools(filterToolsForCapability(child.tools.getActiveTools(), effective));
+			child.setCapabilityMode(effective);
+			this.session.markAgentCapability(agentId, effective);
+			return Promise.resolve();
+		});
 		return {
 			agentId,
 			profileName,
 			resumed: true,
-			completion: this.runChild(parent, agentId, child, profileName, {
-				...options,
-				signal: controller.signal
-			}, () => {
-				const binding = this.resolveModelBinding(profileName);
-				const modelAlias = this.resolveValidModelAlias(parent, binding);
-				const thinkingLevel = this.resolveThinkingLevel(parent, binding, parent.config.thinkingLevel);
-				child.config.update({
-					modelAlias,
-					thinkingLevel
-				});
-				if (options.capabilityMode !== void 0 && options.capabilityMode !== "all") child.tools.setActiveTools(filterToolsForCapability(child.tools.getActiveTools(), options.capabilityMode));
-				return Promise.resolve();
-			}).finally(() => {
-				unlinkAbortSignal();
-				this.activeChildren.delete(agentId);
-				this.childRequestCounts.delete(agentId);
-				this.childRequestSeen.delete(agentId);
-				this.parentMessageSeen.delete(agentId);
-			})
+			completion: this.withChildTerminalRelease(parent, child, {
+				childId: agentId,
+				unlinkAbortSignal
+			}, run)
 		};
 	}
 	/**
@@ -109953,10 +111287,110 @@ var SessionSubagentHost = class {
 		return this.session.agents.get(agentId)?.config.profileName;
 	}
 	/**
+	* Chain a child run's terminal step: release the child's own resources, then
+	* evict it (bookkeeping, mailbox slot, live Agent reference).
+	*
+	* Both halves have to happen here rather than in `Session.close()`: the child
+	* leaves `session.agents` in this step, so a teardown that walks that map can
+	* no longer reach its LSP servers or its RLM kernel. `run` is awaited inside
+	* the `try` so a run that threw (failure, stop) releases exactly like a
+	* completed one, and the release finishes before the caller's `completion`
+	* settles — awaiting the run also awaits its process teardown (bounded by
+	* `CHILD_RELEASE_BOUND_MS`, see `releaseChildResourcesBounded`).
+	*/
+	async withChildTerminalRelease(parent, child, terminal, run) {
+		try {
+			return await run;
+		} finally {
+			terminal.unlinkAbortSignal();
+			await this.releaseChildResourcesBounded(parent, child, terminal.childId);
+			this.activeChildren.delete(terminal.childId);
+			this.childRequestCounts.delete(terminal.childId);
+			this.childRequestSeen.delete(terminal.childId);
+			this.parentMessageSeen.delete(terminal.childId);
+			this.session.removeAgent?.(terminal.childId);
+			if (terminal.childId !== "main") this.session.agents.delete(terminal.childId);
+		}
+	}
+	/**
+	* `releaseChildResources`, awaited for at most `CHILD_RELEASE_BOUND_MS`.
+	*
+	* The healthy path is unchanged: the release is still awaited to completion,
+	* so the "released before evict" ordering holds. The bound only matters for a
+	* child whose language server stopped answering — `LspClient.stop()` waits
+	* for its `shutdown` request, which is capped only by the 120s request
+	* timeout, so an unresponsive server used to hold every caller awaiting
+	* `completion` (foreground Agent call, TaskStop, rlm_wait) for ~125s.
+	*
+	* Past the bound the release keeps running in the background — the process is
+	* still reaped, just not before the caller gets its result — and the wait is
+	* reported once so the stall is visible instead of silent.
+	*/
+	async releaseChildResourcesBounded(parent, child, childId) {
+		const release = this.releaseChildResources(parent, child).catch((error) => {
+			parent.log.warn("Failed to release subagent resources", {
+				childId,
+				error: String(error)
+			});
+		});
+		let timer;
+		const bound = new Promise((resolve) => {
+			timer = setTimeout(() => {
+				resolve("bound");
+			}, CHILD_RELEASE_BOUND_MS);
+		});
+		try {
+			if (await Promise.race([release.then(() => "released"), bound]) === "bound") parent.log.warn(`subagent ${childId}: resource release exceeded ${CHILD_RELEASE_BOUND_MS}ms and continues in the background (a language server is likely unresponsive); completion is not held back by it`);
+		} finally {
+			if (timer !== void 0) clearTimeout(timer);
+		}
+	}
+	/**
+	* Stop the resources a finished child owns itself. `Session.close()` is the
+	* only other place that calls `disposeLsp()` / disposes an RLM kernel, and it
+	* iterates `session.agents` — but the terminal `finally` evicts every child
+	* from that map in the same turn, so between the two the child's tsserver and
+	* its python kernel become unreachable while still running: one leaked
+	* process set per subagent run, not per session. Called from the run
+	* `finally`, so all exit paths (completion, failure, stop) release.
+	*
+	* Ownership is per agent, never inherited by reference: each agent's own
+	* `ToolManager.initializeBuiltinTools` constructs its `LspRegistry` and its
+	* `PythonTool` (own kernel process, own rlm() handle table), so disposing the
+	* child's instances cannot reach the parent's. The python tool is
+	* additionally guarded by a reference check against the parent's instance, so
+	* a kernel that ever became inherited-by-reference instead of child-owned
+	* would survive here rather than be killed by mistake.
+	*
+	* The kernel is torn down directly instead of through `Agent.disposeRlm()`:
+	* disposeRlm records `rlm.exit` and drops `python` from the tool set, which
+	* would make a later resume replay this child as RLM-disabled even though the
+	* parent it inherited the mode from is still running RLM. Killing the kernel
+	* leaves no orphan process while keeping the child's mode on its records.
+	*/
+	async releaseChildResources(parent, child) {
+		try {
+			await child.tools.disposeLsp();
+		} catch (error) {
+			parent.log.warn("Failed to dispose subagent lsp servers", { error: String(error) });
+		}
+		const python = child.tools.getBuiltinTool("python");
+		if (python === void 0 || python === parent.tools.getBuiltinTool("python")) return;
+		try {
+			python.dispose?.();
+		} catch (error) {
+			parent.log.warn("Failed to dispose subagent rlm kernel", { error: String(error) });
+		}
+	}
+	/**
 	* Send a directed message to a subagent owned by this parent. Ownership is
 	* verified against the session metadata before anything is enqueued; a
 	* message addressed to a foreign or unknown agent is refused as
 	* `not_owned`/`not_found`.
+	*
+	* `steer` redirects a running child without disturbing its in-flight tools;
+	* `interject` does the same but additionally interrupts the tool batch in
+	* flight, so a child stuck in a long wait reads the correction immediately.
 	*/
 	sendMessage(toAgentId, operation, text, overrides) {
 		const metadata = this.session.metadata.agents[toAgentId];
@@ -109965,7 +111399,7 @@ var SessionSubagentHost = class {
 		const child = this.session.agents.get(toAgentId);
 		const record = this.activeChildren.get(toAgentId);
 		if (child === void 0 || record === void 0) return { status: "not_active" };
-		const message = buildSubagentMessage(this.ownerAgentId, toAgentId, operation, text, overrides);
+		const message = buildSubagentMessage(this.ownerAgentId, toAgentId, operation === "queue" ? "queue" : "steer", text, overrides);
 		const byteLimit = overrides?.byteLimit ?? 16384;
 		if (subagentMessageBytes(text) > byteLimit) return {
 			status: "saturated",
@@ -109981,18 +111415,18 @@ var SessionSubagentHost = class {
 			status: "accepted",
 			duplicate: true
 		};
-		if (operation === "steer" && !record.structured && child.turn.hasActiveTurn && child.turn.steerQueueLength < 4) {
+		if ((operation === "steer" || operation === "interject") && !record.structured && child.turn.hasActiveTurn && child.turn.steerQueueLength < 4) {
 			child.turn.steer([{
 				type: "text",
 				text: formatParentMessagesBlock([message])
 			}], {
 				kind: "system_trigger",
-				name: "parent_message"
-			});
+				name: operation === "interject" ? "parent_interject" : "parent_message"
+			}, operation === "interject" ? { interrupt: true } : void 0);
 			seen.add(dedupeKey);
 			return {
 				status: "accepted",
-				delivery: "mid-run"
+				delivery: operation === "interject" ? "interjected" : "mid-run"
 			};
 		}
 		const out = this.bus.send(message);
@@ -110201,7 +111635,7 @@ var SessionSubagentHost = class {
 			throw error;
 		}
 	}
-	async configureChild(parent, child, profile, capabilityMode) {
+	async configureChild(parent, child, profile, childId, capabilityMode) {
 		const binding = this.resolveModelBinding(profile.name);
 		const modelAlias = this.resolveValidModelAlias(parent, binding);
 		const thinkingLevel = this.resolveThinkingLevel(parent, binding, parent.config.thinkingLevel);
@@ -110218,6 +111652,7 @@ var SessionSubagentHost = class {
 			child.tools.setActiveTools(filtered);
 		}
 		child.setCapabilityMode(capabilityMode ?? "all");
+		this.session.markAgentCapability(childId, capabilityMode ?? "all");
 	}
 	resolveModelBinding(profileName) {
 		const bindings = this.modelBindings?.();
@@ -110319,6 +111754,63 @@ function lastAssistantText$1(agent) {
 	return "";
 }
 //#endregion
+//#region ../../packages/agent-core/src/session/dispose-registry.ts
+/**
+* Session teardown registry.
+*
+* `Session.close()` used to run its cleanups as a hand-maintained inline
+* sequence. Every new resource had to be remembered and spliced into that
+* sequence by hand, and omissions (the shell tool's pending-task map, the
+* message bus, ...) stayed invisible until they leaked. This registry makes
+* the close-out list explicit and inspectable: each step registers once at
+* session construction under a stable name, `names()` exposes the checklist
+* (tests freeze it so a dropped or renamed registration fails immediately),
+* and `disposeAll()` releases the steps in reverse registration order — last
+* registered, first released — without letting one failure skip the rest.
+*/
+var SessionDisposables = class {
+	items = [];
+	disposed = false;
+	/**
+	* Register a teardown step under a unique name.
+	*
+	* Duplicate names are rejected rather than silently overwriting: two owners
+	* for one checklist slot is a registration bug, and an overwrite would hide
+	* it. Registration after `disposeAll()` is rejected for the same reason —
+	* the step could never run, which is exactly the silent-omission failure
+	* this registry exists to prevent.
+	*/
+	add(name, fn) {
+		if (this.disposed) throw new Error(`Cannot register disposable "${name}" after disposeAll() has run`);
+		if (this.items.some((item) => item.name === name)) throw new Error(`Disposable "${name}" is already registered`);
+		this.items.push({
+			name,
+			fn
+		});
+	}
+	/** Registered names in registration order — the close-out checklist. */
+	names() {
+		return this.items.map((item) => item.name);
+	}
+	/**
+	* Run every registered step in reverse registration order. A throwing step
+	* never blocks the steps after it; every failure is collected and returned
+	* as one `AggregateError` (`null` when all steps succeeded). Idempotent:
+	* once disposed, further calls run nothing and report no errors.
+	*/
+	async disposeAll() {
+		if (this.disposed) return null;
+		this.disposed = true;
+		const errors = [];
+		for (const item of this.items.toReversed()) try {
+			await item.fn();
+		} catch (error) {
+			errors.push(error);
+		}
+		return errors.length === 0 ? null : new AggregateError(errors, `${String(errors.length)} session disposal step(s) failed`);
+	}
+};
+//#endregion
 //#region ../../packages/agent-core/src/session/index.ts
 const BACKGROUND_KEEP_ALIVE_ON_EXIT_ENV = "SCREAM_CODE_BACKGROUND_KEEP_ALIVE_ON_EXIT";
 var Session$1 = class {
@@ -110332,6 +111824,10 @@ var Session$1 = class {
 	hookEngine;
 	/** Core-wide supervisor tracking this session's LSP children. */
 	lspSupervisor;
+	/** Close-out checklist that drives `close()` (see `SessionDisposables`). */
+	disposables = new SessionDisposables();
+	/** Session-level parent→child message bus shared by every subagent host. */
+	subagentMessages = new SubagentMessageBus();
 	agentIdCounter = 0;
 	skillsReady;
 	mcpReady;
@@ -110373,6 +111869,52 @@ var Session$1 = class {
 		this.mcpReady = this.loadMcpServers().catch((error) => {
 			this.emitInitialMcpLoadError(error);
 		});
+		this.registerDisposables();
+	}
+	/**
+	* The session's close-out checklist. Every resource `close()` tears down
+	* registers here at construction — `disposables.names()` is the inspectable
+	* list, frozen by test/session/close-resources.test.ts so a step cannot be
+	* silently forgotten again.
+	*
+	* Registration order is the checklist order; `disposeAll()` releases in
+	* reverse (last registered first released), so `message-bus` is released
+	* first and the session log sink last: every teardown step above it (LSP,
+	* MCP, ...) can still report what it did through `log` instead of writing
+	* into a closed sink. `session-finalize` is registered directly after `log`
+	* for the same reason — it is released immediately before the sink closes,
+	* once every resource teardown above it has run.
+	*/
+	registerDisposables() {
+		this.disposables.add("log", async () => {
+			await this.logHandle?.close();
+		});
+		this.disposables.add("session-finalize", async () => {
+			try {
+				await this.flushMetadata();
+			} finally {
+				await this.triggerSessionEnd("exit");
+			}
+		});
+		this.disposables.add("background-pending", async () => {
+			stopAllPendingBackgroundTasks(this.options.id);
+			await this.stopBackgroundTasksOnExit();
+		});
+		this.disposables.add("cron", async () => {
+			await Promise.allSettled(Array.from(this.agents.values(), async (agent) => agent.cron?.stop()));
+		});
+		this.disposables.add("rlm", () => {
+			for (const agent of this.agents.values()) agent.disposeRlm?.();
+		});
+		this.disposables.add("lsp", async () => {
+			await Promise.all(Array.from(this.agents.values(), (agent) => agent.tools.disposeLsp()));
+		});
+		this.disposables.add("mcp", async () => {
+			await this.mcp.shutdown();
+		});
+		this.disposables.add("message-bus", () => {
+			this.subagentMessages.clear();
+		});
 	}
 	async createMain() {
 		const { agent } = await this.createAgent({ type: "main" }, DEFAULT_AGENT_PROFILES["agent"]);
@@ -110425,21 +111967,13 @@ var Session$1 = class {
 				});
 			}
 		}
+		let disposeError = null;
 		try {
 			for (const agent of this.agents.values()) if (agent.turn.hasActiveTurn) agent.turn.cancel();
-			await Promise.allSettled(Array.from(this.agents.values(), async (agent) => agent.cron?.stop()));
-			for (const agent of this.agents.values()) agent.disposeRlm?.();
-			await this.stopBackgroundTasksOnExit();
-			await this.flushMetadata();
-			await this.triggerSessionEnd("exit");
 		} finally {
-			try {
-				const failed = (await Promise.allSettled([...Array.from(this.agents.values(), (agent) => agent.tools.disposeLsp()), this.mcp.shutdown()])).find((result) => result.status === "rejected");
-				if (failed !== void 0) throw failed.reason;
-			} finally {
-				await this.logHandle?.close();
-			}
+			disposeError = await this.disposables.disposeAll();
 		}
+		if (disposeError !== null) throw disposeError;
 	}
 	async stopBackgroundTasksOnExit() {
 		if (resolveConfigValue({
@@ -110539,6 +112073,48 @@ var Session$1 = class {
 		this.writeMetadataPromise = this.writeMetadataPromise.then(() => write(), () => write());
 		return this.writeMetadataPromise;
 	}
+	/**
+	* Record a subagent's runtime capability contract in session metadata so it
+	* survives a process restart (see AgentMeta.capabilityMode). Every spawned
+	* child records a mode from its very first write — `all` included, since it
+	* is a real contract, not an absent one. A missing field therefore means
+	* exactly one thing: a session written before this field existed, which
+	* resume resolves by inferring the contract from the live tool set.
+	*/
+	markAgentCapability(agentId, mode) {
+		const meta = this.metadata.agents[agentId];
+		if (meta === void 0) return;
+		if (meta.capabilityMode === mode) return;
+		this.metadata.agents[agentId] = {
+			...meta,
+			capabilityMode: mode
+		};
+		this.writeMetadata().catch((error) => {
+			this.log.error("failed to write session metadata after a capability change", error);
+		});
+	}
+	/**
+	* Drop a finished subagent's live instance so its context/tools no longer
+	* pin memory on the session map. Metadata and wire records stay so a later
+	* `ensureAgent` (subagent resume) can re-hydrate the same conversation.
+	* Never drops the main agent.
+	*/
+	removeAgent(id) {
+		if (id === "main") return;
+		this.agents.delete(id);
+	}
+	/**
+	* Return the live instance for `id`, re-hydrating from persisted records
+	* when `removeAgent` dropped it after a finished run. No-op for agents that
+	* are still resident.
+	*/
+	async ensureAgent(id) {
+		const existing = this.agents.get(id);
+		if (existing !== void 0) return existing;
+		const agent = this.ensureResumeAgentInstantiated(id, this.metadata.agents);
+		await agent.resume();
+		return agent;
+	}
 	async readMetadata() {
 		let text;
 		try {
@@ -110677,7 +112253,9 @@ var Session$1 = class {
 		const cwd = parentAgent?.config.cwd ?? this.options.jian.getcwd();
 		return new Agent({
 			...config,
+			agentId: id,
 			type,
+			sessionId: this.options.id,
 			jian: this.options.jian.withCwd(cwd),
 			toolServices: this.options.toolServices,
 			config: this.options.config,
@@ -110688,7 +112266,7 @@ var Session$1 = class {
 			rpc: proxyWithExtraPayload(this.rpc, { agentId: id }),
 			modelProvider: this.options.providerManager,
 			hookEngine: config.hookEngine ?? this.hookEngine,
-			subagentHost: config.subagentHost ?? new SessionSubagentHost(this, id, this.backgroundTaskTimeoutMs(), this.options.subagentModelBindings),
+			subagentHost: config.subagentHost ?? new SessionSubagentHost(this, id, this.backgroundTaskTimeoutMs(), this.options.subagentModelBindings, this.subagentMessages),
 			ownerHost: type === "sub" ? parentAgent?.subagentHost : void 0,
 			mcp: this.mcp,
 			permission: this.permissionOptions(parentAgentId, config.permission),
@@ -125156,7 +126734,7 @@ var OpenAlexPaperSource = class {
 };
 //#endregion
 //#region ../../packages/agent-core/src/session/export/manifest.ts
-const WIRE_PROTOCOL_VERSION = "1.4";
+const WIRE_PROTOCOL_VERSION = "1.6";
 function buildExportManifest(args) {
 	return {
 		sessionId: args.summary.id,
@@ -129181,8 +130759,9 @@ var Session = class {
 			enabled
 		});
 	}
-	/** Sets the maximum RLM recursion depth (default 1). Depth 1 means the root
-	* kernel may spawn rlm() children but they cannot spawn grandchildren. */
+	/** Sets the maximum RLM recursion depth. The default is unlimited
+	*  (`Infinity`); 0 also means unlimited. Depth 1 means the root kernel may
+	*  spawn rlm() children but they cannot spawn grandchildren. */
 	async setRlmMaxDepth(maxDepth) {
 		this.ensureOpen();
 		await this.rpc.setRlmMaxDepth({
@@ -131253,6 +132832,38 @@ function resolveConnectCatalogRequest(args) {
 	};
 }
 //#endregion
+//#region src/tui/utils/image-config.ts
+function getImageConfigPath() {
+	return join(resolveScreamHome(), "image-config.json");
+}
+/** Placeholder rules mirrored from the ImageGenerate tool's `isPlaceholder`. */
+function isPlaceholder(value) {
+	const trimmed = value.trim();
+	return trimmed.length === 0 || trimmed.includes("replace-with") || trimmed.startsWith("<") && trimmed.endsWith(">");
+}
+/**
+* Best-effort read of an existing image config (never throws, never exposes
+* the key). The `usable` predicate mirrors the ImageGenerate tool's
+* `loadConfig` (packages/agent-core/src/tools/builtin/image/image-generate.ts):
+* a config the tool would reject must never be advertised as "configured".
+*/
+async function readExistingImageConfig() {
+	try {
+		const text = await readFile(getImageConfigPath(), "utf8");
+		const parsed = JSON.parse(text);
+		const urlRaw = typeof parsed["url"] === "string" ? parsed["url"] : "";
+		const legacyRaw = typeof parsed["base_url"] === "string" ? parsed["base_url"] : "";
+		const url = !isPlaceholder(urlRaw) ? urlRaw.trim() : !isPlaceholder(legacyRaw) ? `${legacyRaw.trim().replace(/\/+$/, "")}/images/generations` : "";
+		const model = typeof parsed["model"] === "string" ? parsed["model"].trim() : "";
+		const apiKeyRaw = typeof parsed["api_key"] === "string" ? parsed["api_key"] : "";
+		if (url.length > 0 && model.length > 0 && !isPlaceholder(apiKeyRaw)) return {
+			provider: typeof parsed["provider"] === "string" ? parsed["provider"] : "openai-compatible",
+			model,
+			url
+		};
+	} catch {}
+}
+//#endregion
 //#region src/tui/components/dialogs/api-key-input-dialog.ts
 function getFooter() {
 	return t("apikey.footer");
@@ -131499,6 +133110,11 @@ var ModelSelectorComponent = class extends Container {
 			lines.push(this.renderVideoControl(selected.model));
 			lines.push(this.renderAudioControl(selected.model));
 		}
+		if (this.opts.imageGeneration !== void 0) {
+			const imageGeneration = this.opts.imageGeneration;
+			lines.push("");
+			lines.push(chalk.hex(colors.textMuted)(imageGeneration.configured && imageGeneration.model !== void 0 ? t("model.image_gen_configured", { model: imageGeneration.model }) : t("model.image_gen_missing")));
+		}
 		lines.push("");
 		if (view.page.pageCount > 1) lines.push(chalk.hex(colors.textMuted)(` Page ${String(view.page.page + 1)}/${String(view.page.pageCount)}`));
 		lines.push(chalk.hex(colors.primary)("─".repeat(width)));
@@ -132033,26 +133649,6 @@ const IMAGE_PROVIDER_PRESETS = [
 		model: "gpt-image-2"
 	}
 ];
-function getImageConfigPath() {
-	return join(resolveScreamHome(), "image-config.json");
-}
-/** Best-effort read of an existing image config (never throws, never exposes the key). */
-async function readExistingImageConfig() {
-	try {
-		const text = await readFile(getImageConfigPath(), "utf8");
-		const parsed = JSON.parse(text);
-		const urlDirect = typeof parsed["url"] === "string" ? parsed["url"].trim() : "";
-		const legacyBase = typeof parsed["base_url"] === "string" ? parsed["base_url"].trim() : "";
-		const url = urlDirect.length > 0 ? urlDirect : legacyBase.length > 0 ? `${legacyBase.replace(/\/+$/, "")}/images/generations` : "";
-		const model = typeof parsed["model"] === "string" ? parsed["model"].trim() : "";
-		const apiKey = typeof parsed["api_key"] === "string" ? parsed["api_key"].trim() : "";
-		if (url.length > 0 && !url.includes("replace-with") && !(url.startsWith("<") && url.endsWith(">")) && model.length > 0 && apiKey.length > 0 && !apiKey.includes("replace-with") && !(apiKey.startsWith("<") && apiKey.endsWith(">"))) return {
-			provider: typeof parsed["provider"] === "string" ? parsed["provider"] : "openai-compatible",
-			model,
-			url
-		};
-	} catch {}
-}
 /**
 * Normalize the URL exactly as the user typed it: trim whitespace and
 * trailing slashes only. Nothing is ever appended or completed — the full
@@ -133511,7 +135107,14 @@ const DEFAULT_SUBAGENT_TYPES = Object.freeze(subagentRoster().map((entry) => ent
 const REQUESTING_WINDOW_MS = 5e3;
 var SubagentSlots = class {
 	slots = /* @__PURE__ */ new Map();
+	/** Live per-agentId records. Released on termination (a session must not keep
+	*  one entry per spawned agent forever); resume detection falls back to
+	*  {@link endedInstances}. */
 	instances = /* @__PURE__ */ new Map();
+	/** Terminated records, oldest first — the only reason a per-agentId record
+	*  outlives its run is that a resume of it should still show 返工中. Capped by
+	*  {@link ENDED_INSTANCE_WINDOW}. */
+	endedInstances = /* @__PURE__ */ new Map();
 	/** Live instance count per type: a slot only returns to idle when the LAST
 	* instance of that type terminates (WolfPack spawns several coders at once
 	* and they share one visual slot). */
@@ -133531,6 +135134,7 @@ var SubagentSlots = class {
 	reset() {
 		this.slots.clear();
 		this.instances.clear();
+		this.endedInstances.clear();
 		this.runningByType.clear();
 		this.messagingByCall.clear();
 		this.messagingPrev.clear();
@@ -133550,6 +135154,17 @@ var SubagentSlots = class {
 			this.setState(instance.type, "reworking", agentId, description === void 0 ? void 0 : `resume: ${description}`);
 			return;
 		}
+		const ended = this.endedInstances.get(agentId);
+		if (ended !== void 0) {
+			this.endedInstances.delete(agentId);
+			this.instances.set(agentId, {
+				type: ended.type,
+				generation: ended.generation + 1
+			});
+			this.runningByType.set(ended.type, (this.runningByType.get(ended.type) ?? 0) + 1);
+			this.setState(ended.type, "reworking", agentId, description === void 0 ? void 0 : `resume: ${description}`);
+			return;
+		}
 		this.instances.set(agentId, {
 			type: subagentType,
 			generation: 1
@@ -133576,6 +135191,8 @@ var SubagentSlots = class {
 		const instance = this.instances.get(agentId);
 		if (instance === void 0) return;
 		if (this.requesting.get(instance.type)?.agentId === agentId) this.requesting.delete(instance.type);
+		this.instances.delete(agentId);
+		this.rememberEnded(agentId, instance);
 		const remaining = (this.runningByType.get(instance.type) ?? 1) - 1;
 		if (remaining > 0) {
 			this.runningByType.set(instance.type, remaining);
@@ -133587,6 +135204,17 @@ var SubagentSlots = class {
 		this.runningByType.delete(instance.type);
 		this.setState(instance.type, "idle", void 0, void 0);
 	}
+	/** Move a terminated record into the resume window, FIFO-capped: the oldest
+	*  record drops out so the window cannot grow with the session. */
+	rememberEnded(agentId, instance) {
+		this.endedInstances.delete(agentId);
+		this.endedInstances.set(agentId, instance);
+		while (this.endedInstances.size > 200) {
+			const oldest = this.endedInstances.keys().next().value;
+			if (oldest === void 0) break;
+			this.endedInstances.delete(oldest);
+		}
+	}
 	/**
 	* Routed subagent activity (agentId !== main):
 	* - kind 'tool'      → working (tool call in flight)
@@ -133977,15 +135605,12 @@ function tierFor(intensity) {
 	if (intensity >= TIER_MID) return "mid";
 	return "low";
 }
-const shimmerDefaultCache = /* @__PURE__ */ new WeakMap();
 function defaultPalette(colors) {
-	const p = {
+	return {
 		low: colors.textDim,
 		mid: colors.textMuted,
 		high: colors.primary
 	};
-	shimmerDefaultCache.set(colors, p);
-	return p;
 }
 /**
 * Apply a shimmer sweep across `text` using the default three-tier palette
@@ -134273,6 +135898,10 @@ var FooterComponent = class {
 	/** Stop the active-status timer. Idempotent and safe during disposal. */
 	dispose() {
 		this.#stopStatusTimer();
+		if (this.balanceFlashTimer !== void 0) {
+			clearTimeout(this.balanceFlashTimer);
+			this.balanceFlashTimer = void 0;
+		}
 	}
 	#restartStatusTimer(phase, goalActive) {
 		this.#stopStatusTimer();
@@ -134580,6 +136209,10 @@ function parseColorFgBg(value) {
 */
 const dark = {
 	yellowGreen: "#79eb00",
+	gold: "#FFD700",
+	coral: "#FF7043",
+	skyBlue: "#9CDCFE",
+	violet: "#C084FC",
 	pink400: "#FF6B9D",
 	cyan400: "#56D4DD",
 	amber400: "#E8A838",
@@ -134596,6 +136229,10 @@ const dark = {
 };
 const light = {
 	yellowGreen700: "#4B7A06",
+	gold: "#A16207",
+	orange: "#C2410C",
+	blue: "#1565C0",
+	violet: "#7C3AED",
 	pink700: "#C2185B",
 	cyan800: "#006978",
 	gray900: "#1A1A1A",
@@ -134612,14 +136249,19 @@ const darkColors = {
 	accent: dark.pink400,
 	planMode: dark.cyan400,
 	fusionPlanMode: dark.amber500,
-	wolfpackMode: "#C084FC",
-	rlmMode: "#FFD700",
+	wolfpackMode: dark.violet,
+	rlmMode: dark.gold,
+	permissionManual: dark.yellowGreen,
+	permissionYolo: dark.gold,
+	permissionAuto: dark.coral,
+	permissionAsk: dark.skyBlue,
+	permissionBot: dark.violet,
 	text: dark.gray100,
 	textStrong: dark.gray50,
 	textDim: dark.gray500,
 	textMuted: dark.gray600,
 	mdLink: "#56B6C2",
-	mdCodeBlock: "#9CDCFE",
+	mdCodeBlock: dark.skyBlue,
 	mdCodeBlockBorder: "#5C6370",
 	mdCodeBlockBg: "#16191f",
 	mdQuote: "#7F848E",
@@ -134647,14 +136289,19 @@ const lightColors = {
 	accent: light.pink700,
 	planMode: light.cyan800,
 	fusionPlanMode: light.amber700,
-	wolfpackMode: "#7C3AED",
-	rlmMode: "#A16207",
+	wolfpackMode: light.violet,
+	rlmMode: light.gold,
+	permissionManual: light.yellowGreen700,
+	permissionYolo: light.gold,
+	permissionAuto: light.orange,
+	permissionAsk: light.blue,
+	permissionBot: light.violet,
 	text: light.gray900,
 	textStrong: light.gray900,
 	textDim: light.gray700,
 	textMuted: light.gray600,
 	mdLink: "#007A8A",
-	mdCodeBlock: "#1565C0",
+	mdCodeBlock: light.blue,
 	mdCodeBlockBorder: "#848484",
 	mdCodeBlockBg: "#f7f9fb",
 	mdQuote: "#616161",
@@ -135478,9 +137125,16 @@ async function loadManagedUsageReport(host) {
 * not hammer the vendor endpoint.
 */
 const BALANCE_CACHE_MS = 6e4;
+/** Upper bound on cached providers — bounds the map when users hop between
+*  many provider/model combinations in one session. */
+const BALANCE_CACHE_MAX_ENTRIES = 32;
 const cache$1 = /* @__PURE__ */ new Map();
 /** Monotonic id so an out-of-order lookup can never overwrite a newer one. */
 let latestRequestId = 0;
+/** Drop entries whose TTL has elapsed so the map never holds dead weight. */
+function pruneExpiredBalances(now) {
+	for (const [key, entry] of cache$1) if (now - entry.at >= BALANCE_CACHE_MS) cache$1.delete(key);
+}
 function resolveApiKey(providerName) {
 	const provider = readConfigFile(join(getDataDir(), "config.toml")).providers?.[providerName];
 	if (!provider) return void 0;
@@ -135521,9 +137175,19 @@ async function loadBalance(providerName) {
 async function getProviderBalanceForModel(model) {
 	const providerName = model.split("/")[0] ?? "";
 	if (providerName.length === 0) return null;
+	const now = Date.now();
 	const cached = cache$1.get(providerName);
-	if (cached !== void 0 && Date.now() - cached.at < BALANCE_CACHE_MS) return cached.balance;
+	if (cached !== void 0) {
+		if (now - cached.at < BALANCE_CACHE_MS) return cached.balance;
+		cache$1.delete(providerName);
+	}
 	const balance = await loadBalance(providerName);
+	pruneExpiredBalances(Date.now());
+	while (cache$1.size >= BALANCE_CACHE_MAX_ENTRIES) {
+		const oldest = cache$1.keys().next();
+		if (oldest.done === true) break;
+		cache$1.delete(oldest.value);
+	}
 	cache$1.set(providerName, {
 		balance,
 		at: Date.now()
@@ -135815,7 +137479,8 @@ async function handleScriptCommand(host, args) {
 	}
 }
 /** /rlm-max-depth [N] — query or set the maximum RLM recursion depth.
-* N=0 or no limit means unlimited (the default). */
+* N=0 or no limit means unlimited (the default). Validation is shared with
+* the core setter and the web REST route (agent-core session/rlm-settings). */
 async function handleRlmMaxDepthCommand(host, args) {
 	const session = host.session;
 	if (session === void 0) {
@@ -135824,18 +137489,19 @@ async function handleRlmMaxDepthCommand(host, args) {
 	}
 	const arg = args.trim();
 	if (arg.length === 0) {
-		host.showStatus("RLM max depth: run /rlm-max-depth <N> (0 or blank = unlimited) to set it.");
+		const current = host.state.appState.rlmMaxDepth;
+		host.showStatus(`RLM max depth: ${current === null ? "unlimited" : current}`);
 		return;
 	}
-	const parsed = Number(arg);
-	if (!Number.isInteger(parsed) || parsed < 0) {
-		host.showError(`Invalid rlm-max-depth: ${arg} (expected a non-negative integer, 0 = unlimited).`);
+	const parsed = parseRlmMaxDepthArg(arg);
+	if (!parsed.ok) {
+		host.showError(`Invalid rlm-max-depth: ${arg} (${parsed.reason}).`);
 		return;
 	}
 	try {
-		await session.setRlmMaxDepth(parsed);
-		if (parsed === 0) host.showStatus("RLM recursion depth set to unlimited.", host.state.theme.colors.success);
-		else host.showStatus(`RLM max depth set to ${parsed}.`, host.state.theme.colors.success);
+		await session.setRlmMaxDepth(parsed.value);
+		if (parsed.value === 0) host.showStatus("RLM recursion depth set to unlimited.", host.state.theme.colors.success);
+		else host.showStatus(`RLM max depth set to ${parsed.value}.`, host.state.theme.colors.success);
 	} catch (error) {
 		const msg = formatErrorMessage(error);
 		host.showError(`Failed to set rlm max depth: ${msg}`);
@@ -135954,14 +137620,14 @@ async function handleModelCommand(host, args) {
 	const alias = trimmed;
 	if (alias.length === 0) {
 		await refreshModelsForPicker(host);
-		showModelPicker(host);
+		await showModelPicker(host);
 		return;
 	}
 	if (host.state.appState.availableModels[alias] === void 0) {
 		host.showError(`Unknown model alias: ${alias}`);
 		return;
 	}
-	showModelPicker(host, alias);
+	await showModelPicker(host, alias);
 }
 /**
 * Reload provider/model config before showing the model picker so models
@@ -136021,11 +137687,12 @@ async function applyEditorChoice(host, value) {
 	host.setAppState({ editorCommand });
 	host.showStatus(value.length > 0 ? `Editor set to "${value}".` : "编辑器设置为自动检测 ($VISUAL / $EDITOR)。");
 }
-function showModelPicker(host, selectedValue = host.state.appState.model) {
+async function showModelPicker(host, selectedValue = host.state.appState.model) {
 	if (Object.entries(host.state.appState.availableModels).length === 0) {
 		host.showNotice("未配置模型", "运行 /config 自定义模型配置。");
 		return;
 	}
+	const imageConfig = await readExistingImageConfig();
 	host.mountEditorReplacement(new ModelSelectorComponent({
 		models: host.state.appState.availableModels,
 		currentValue: host.state.appState.model,
@@ -136033,6 +137700,10 @@ function showModelPicker(host, selectedValue = host.state.appState.model) {
 		currentThinkingLevel: host.state.appState.thinkingLevel,
 		colors: host.state.theme.colors,
 		searchable: true,
+		imageGeneration: imageConfig === void 0 ? { configured: false } : {
+			configured: true,
+			model: imageConfig.model
+		},
 		onSelect: ({ alias, thinkingLevel }) => {
 			host.restoreEditor();
 			performModelSwitch(host, alias, thinkingLevel);
@@ -137082,7 +138753,7 @@ async function guidedGoalSetup(host) {
 		host.showNotice(t("goal.storm_breaker"), t("goal.conflict_loop"));
 		return;
 	}
-	const { TextInputDialogComponent } = await import("./text-input-dialog-DcjQLJFz.mjs");
+	const { TextInputDialogComponent } = await import("./text-input-dialog-DZoGkbYZ.mjs");
 	const initialDesc = await promptText(host, TextInputDialogComponent, {
 		title: t("goal.setup_title_initial"),
 		subtitle: t("goal.setup_desc_hint"),
@@ -137103,7 +138774,7 @@ async function guidedGoalSetup(host) {
 	await showGoalConfigWizard(host, session, confirmed.trim() || objective, false);
 }
 async function showGoalConfigWizard(host, session, objective, replace) {
-	const { TextInputDialogComponent } = await import("./text-input-dialog-DcjQLJFz.mjs");
+	const { TextInputDialogComponent } = await import("./text-input-dialog-DZoGkbYZ.mjs");
 	const turnInput = await promptNumber(host, TextInputDialogComponent, {
 		title: t("goal.wizard_title", { objective }),
 		subtitle: t("goal.budget_turns_hint"),
@@ -140293,24 +141964,259 @@ function trimTrailingEmptyLines(lines) {
 	return lines.slice(0, end);
 }
 /**
-* Returns the tail of `text` whose UTF-8 byte length is at most `maxBytes`.
+* Returns the tail of `text` whose UTF-8 byte length is at most `maxBytes`
+* (plus one byte when a torn sequence's introducer ESC sits immediately before
+* the cut and the sequence's remainder provably closes — keeping the ESC makes
+* the sequence whole and hides its fragment), with the head aligned to a
+* boundary no ANSI escape sequence spans.
 * Iterates by Unicode code points so multi-byte characters and surrogate
-* pairs are never split.
+* pairs are never split, then hands the cut to `safeTailStart`: success output
+* keeps its ANSI codes (only error output is stripped), and a raw byte cut
+* could land inside a sequence, leaving a fragment (`m`, `0m`, `[31`) that
+* `sanitizeShellOutput` cannot recognize because its ESC byte was cut away.
 */
 function truncateTailBytes(text, maxBytes) {
 	if (Buffer.byteLength(text, "utf8") <= maxBytes) return text;
 	const chars = Array.from(text);
-	let start = chars.length;
 	let bytes = 0;
+	let units = 0;
 	for (let i = chars.length - 1; i >= 0; i--) {
 		const char = chars[i];
 		if (char === void 0) continue;
 		const charBytes = Buffer.byteLength(char, "utf8");
 		if (bytes + charBytes > maxBytes) break;
 		bytes += charBytes;
-		start = i;
+		units += char.length;
+	}
+	return text.slice(safeTailStart(text, text.length - units));
+}
+const ESC = "\x1B";
+/**
+* Largest share of a retained tail the boundary rules may discard.
+*
+* Both rules trade content for a head that is whole by construction: rule 1
+* restarts after the next `\n` and drops the torn line, and rule 2 skips the
+* remainder of a torn sequence. The trade only pays while the tail keeps a
+* (non-strict) majority — with one 5000-char line ahead, a 100-byte budget
+* would come back with the few bytes after it, and the reader asked for the
+* newest output, not for a tidy head. Past the bound the raw cut keeps the
+* content: a string payload stays visible, and a torn CSI or two-byte escape
+* run keeps the fragment it left in view, because skipping that remainder
+* would cost more than the fragment it hides — unless the introducer ESC sits
+* immediately before the head *and* the sequence provably closes, where one
+* unit of look-back keeps the sequence whole and the fragment never surfaces.
+* An unclosed run keeps the raw cut: with no terminator to hand the sanitizer,
+* backing onto its ESC would surface a bare ESC the sanitizer cannot strip.
+*/
+const MAX_TAIL_DROP_SHARE = .5;
+/**
+* Move a tail cut point forward to a boundary no ANSI escape sequence spans.
+*
+* A raw `slice(-tail)` can land inside a sequence (`…\u001b[31|m…`), leaving a
+* fragment (`m`, `0m`, `[31`) whose ESC byte was cut away —
+* `sanitizeShellOutput` only recognizes complete sequences, so the fragment
+* renders as text. Two provable rules keep the head clean:
+*
+* 1. Line alignment: a CSI sequence cannot contain `\n` (LF is not a
+*    parameter, intermediate or final byte), so a cut that lands mid-line
+*    restarts after the next `\n`. The only loss is the torn partial line,
+*    whose head cannot be trusted; every escape after the newline is whole.
+*    Bounded by `MAX_TAIL_DROP_SHARE`, so one huge line cannot eat the budget.
+* 2. Torn-sequence skip: when the retained text is one line (no `\n` after
+*    the cut), or an OSC/DCS/PM/APC payload spans the newline the cut aligned
+*    to, the dropped prefix is inspected for a sequence still open at the cut
+*    — a run of CSI body bytes (0x20–0x3F) reaching back to `ESC [`, an `ESC`
+*    whose intermediate bytes were torn (`ESC ( B`), or a string-sequence
+*    opener the cut landed inside. The head then skips exactly the bytes a
+*    terminal would consume for that sequence, so no visible text is dropped —
+*    but only while that skip stays within `MAX_TAIL_DROP_SHARE` of the tail.
+*    A CSI body or escape-intermediate run can be arbitrarily long, so past
+*    the bound the head keeps the newest bytes and the fragment the raw cut
+*    left with them — or one unit earlier, onto an introducer ESC sitting
+*    immediately before the head, so the whole sequence survives and is
+*    stripped (`withinDropShare`) — but only when the skip proved the sequence
+*    closed: an unclosed run keeps the raw cut, because with no terminator to
+*    hand the sanitizer the ESC would surface bare and swallow what follows
+*    it. So does the head for a string that never ends or ended ahead of the
+*    cut. A sliver of the tail is worse than a fragment.
+*
+* `cut` is always a code-point boundary here (the byte loop above works in
+* code points), so unlike its manager-side twin there is no surrogate half to
+* drop, and `stringPayloadHead`'s clamp steps back onto a code point as well;
+* the one-unit look-back onto an introducer ESC (`withinDropShare`) — taken
+* only for a skip that proved its sequence closed — is a code point boundary
+* too. Mirrors `safeTailStart` in
+* `packages/agent-core/src/tools/background/manager.ts` — app code cannot
+* import agent-core directly, so the rule lives in both places.
+*/
+function safeTailStart(text, cut) {
+	if (cut <= 0 || cut >= text.length) return cut;
+	const tail = text.length - cut;
+	let start = cut;
+	if (text[start - 1] !== "\n") {
+		const newline = text.indexOf("\n", start);
+		if (newline !== -1 && newline + 1 - cut <= tail * MAX_TAIL_DROP_SHARE) start = newline + 1;
+	}
+	return skipOpenEscape(text, start);
+}
+/** CSI parameter (0x30–0x3F) / intermediate (0x20–0x2F) bytes — everything before the final byte. */
+function isCsiBody(code) {
+	return code !== void 0 && code >= 32 && code <= 63;
+}
+/** CSI final byte (0x40–0x7E) — the sequence ends here. */
+function isCsiFinal(code) {
+	return code !== void 0 && code >= 64 && code <= 126;
+}
+/** OSC / DCS / PM / APC introducers — string sequences ended by BEL or ST. */
+function isStringIntro(intro) {
+	return intro === "]" || intro === "P" || intro === "^" || intro === "_";
+}
+/** ESC-intermediate byte (0x20–0x2F) of a two-byte escape sequence. */
+function isEscapeIntermediate(code) {
+	return code !== void 0 && code >= 32 && code <= 47;
+}
+/** Final byte (0x30–0x7E) that closes a two-byte escape sequence. */
+function isEscapeFinal(code) {
+	return code !== void 0 && code >= 48 && code <= 126;
+}
+/** True when every code point in the half-open range `[from, to)` is an ESC intermediate (0x20–0x2F). */
+function allEscapeIntermediates(text, from, to) {
+	for (let i = from; i < to; i += 1) if (!isEscapeIntermediate(text.codePointAt(i))) return false;
+	return true;
+}
+/**
+* When the dropped prefix proves an escape sequence is still open at `cut`,
+* return the index after its remainder; otherwise return `cut` unchanged.
+*/
+function skipOpenEscape(text, cut) {
+	let run = cut;
+	while (run > 0 && isCsiBody(text.codePointAt(run - 1))) run -= 1;
+	if (run >= 2 && text[run - 1] === "[" && text[run - 2] === ESC) {
+		const skip = skipCsiRest(text, cut);
+		return withinDropShare(text, cut, skip.end, skip.closed);
+	}
+	if (text[run - 1] === ESC && allEscapeIntermediates(text, run, cut)) return skipEscapeRest(text, cut);
+	const open = text.lastIndexOf(ESC, cut - 1);
+	if (open !== -1 && isStringIntro(text[open + 1])) return stringSequenceHead(text, open, cut);
+	return cut;
+}
+/**
+* Keep a provable skip only while it stays within `MAX_TAIL_DROP_SHARE` of the
+* tail that starts at `from`: the skipped bytes are exactly what the reader
+* loses from the tail it asked for. A CSI body or escape-intermediate run can
+* be arbitrarily long, so past the bound the raw cut is worth more than the
+* clean head — except when the sequence's introducer ESC sits immediately
+* before the head (`…\u001b|[31m…`) *and* `closed` says the skip found the
+* sequence's terminator, where one unit of look-back keeps the sequence whole
+* instead: the sanitizer strips it and the visible text is the skip's, for
+* that one unit rather than a sliver of the tail. An unclosed run must keep
+* the raw cut even with that ESC one unit ahead: nothing terminates it, so
+* look-back would hand the reader a bare ESC whose sequence run a terminal
+* swallows along with the bytes behind it.
+*/
+function withinDropShare(text, from, target, closed) {
+	if (target - from <= (text.length - from) * MAX_TAIL_DROP_SHARE) return target;
+	return closed && from > 0 && text[from - 1] === ESC ? from - 1 : from;
+}
+/**
+* The rest of a CSI sequence whose body was torn at `cut`, with the closure
+* its skip proved: `closed` holds only when a final byte (0x40–0x7E) was
+* actually found, so a parameter run that reaches the end of `text` — or stops
+* on a byte no CSI can end with — reports the sequence as open.
+*/
+function skipCsiRest(text, cut) {
+	let end = cut;
+	while (end < text.length && isCsiBody(text.codePointAt(end))) end += 1;
+	const closed = end < text.length && isCsiFinal(text.codePointAt(end));
+	return {
+		end: closed ? end + 1 : end,
+		closed
+	};
+}
+/** Index after the escape sequence whose introducer ESC sits at `cut - 1`. */
+function skipEscapeRest(text, cut) {
+	const intro = text[cut];
+	if (intro === "[") {
+		const skip = skipCsiRest(text, cut + 1);
+		return withinDropShare(text, cut, skip.end, skip.closed);
+	}
+	if (isStringIntro(intro)) return stringSequenceHead(text, cut - 1, cut + 1);
+	let end = cut;
+	while (end < text.length && isEscapeIntermediate(text.codePointAt(end))) end += 1;
+	const closed = end < text.length && isEscapeFinal(text.codePointAt(end));
+	return withinDropShare(text, cut, closed ? end + 1 : end, closed);
+}
+/**
+* Head index for a cut that lands inside the string sequence opened at `open`.
+*
+* `stringEnd` gives the byte a terminal stops at; skipping to it hides the
+* payload's remainder, which is what a terminal shows — but only while that
+* costs at most `MAX_TAIL_DROP_SHARE` of the tail. A long OSC 8 URL, or any
+* payload longer than the budget, would otherwise hand the reader a sliver of
+* the tail it asked for; a payload whose extent exceeds the budget stays
+* visible instead. A cut the string already ended ahead of needs no skip, and
+* an unterminated one must not swallow the tail (`stringPayloadHead`).
+*/
+function stringSequenceHead(text, open, cut) {
+	const drop = stringEnd(text, open + 2) - cut;
+	if (drop >= 0 && drop <= (text.length - cut) * MAX_TAIL_DROP_SHARE) return cut + drop;
+	return stringPayloadHead(text, open, cut);
+}
+/**
+* Head index that keeps a string sequence's payload visible, moving the cut
+* only past the opener's own bytes when the cut landed inside them.
+*
+* A terminal swallows an unterminated payload, but a viewer must never render
+* a blank body: a shell card whose output opens with an unterminated OSC — a
+* command killed mid-title, a truncated write — would otherwise show nothing
+* at all. The head stays at `cut` unless the cut landed inside the opener
+* (`\u001b]0;` would leave `0;` in front of the payload), and never reaches
+* `text.length` — the clamp to the last unit steps back onto the pair's first
+* half when that unit is a trailing surrogate pair's low half (defensive here:
+* `truncateTailBytes` cuts on a code point boundary, so the clamp cannot land
+* between a pair's halves in practice) — so this rule never empties the tail;
+* the tail comes back empty only when the byte budget fits none of the last
+* character.
+*/
+function stringPayloadHead(text, open, cut) {
+	const head = Math.min(Math.max(cut, stringPayloadStart(text, open)), text.length - 1);
+	const code = text.codePointAt(head);
+	return head > 0 && code !== void 0 && code >= 56320 && code <= 57343 ? head - 1 : head;
+}
+/**
+* Index after the byte that ends the string sequence whose payload starts at
+* `from` — its BEL or `ESC \` terminator, or a CAN (0x18) / SUB (0x1A), which
+* a terminal reads as "string over, resume normal parsing". `-1` when the
+* string never ends.
+*/
+function stringEnd(text, from) {
+	for (let i = from; i < text.length; i += 1) {
+		const code = text.codePointAt(i);
+		if (code === 7) return i + 1;
+		if (code === 27 && text[i + 1] === "\\") return i + 2;
+		if (code === 24 || code === 26) return i + 1;
+	}
+	return -1;
+}
+/**
+* Index where the payload of the string sequence opened at `open` starts: for
+* OSC after `ESC ] Ps ;`, for DCS/PM/APC after their parameter and
+* intermediate bytes and the final byte that opens the payload.
+*/
+function stringPayloadStart(text, open) {
+	let i = open + 2;
+	if (text[open + 1] === "]") {
+		while (i < text.length && isOscParam(text.codePointAt(i))) i += 1;
+		if (text[i] === ";") i += 1;
+		return i;
 	}
-	return chars.slice(start).join("");
+	while (i < text.length && isCsiBody(text.codePointAt(i))) i += 1;
+	const final = text.codePointAt(i);
+	return i < text.length && isCsiFinal(final) ? i + 1 : i;
+}
+/** OSC numeric parameter byte (0x30–0x39) — the `Ps` before the `;` separator. */
+function isOscParam(code) {
+	return code !== void 0 && code >= 48 && code <= 57;
 }
 /**
 * Component that renders tool output with wrap-aware line truncation.
@@ -142535,6 +144441,7 @@ async function handleRevokeCommand(host, args = "") {
 	const preservedEntries = entries.slice(lastUserIndex).filter((entry) => !isRevokeContextEntry(entry));
 	entries.splice(lastUserIndex, entries.length - lastUserIndex, ...preservedEntries);
 	if (entries.length === 0) renderWelcome(host);
+	host.state.ui.resetTextSelection();
 	host.state.ui.requestRender();
 }
 function parseRevokeCount(args) {
@@ -145219,12 +147126,14 @@ function showValuePicker(host, key) {
 		onSelect: (value) => {
 			const parsed = Number(value);
 			if (!Number.isFinite(parsed)) return;
+			const resized = parsed !== getActivityLineValue(key);
 			setActivityLineValue(key, parsed);
 			host.restoreEditor();
 			host.showStatus(t("blockrows.saved", {
 				label: t(setting.label),
 				value: String(parsed)
 			}), host.state.theme.colors.success);
+			if (resized) host.state.ui.resetTextSelection();
 			repaintTranscript(host);
 		},
 		onCancel: () => {
@@ -145807,8 +147716,10 @@ function buildOptions() {
 }
 /** Apply a choice: redraw what is already on screen, restate the capability. */
 async function applyDisplay(host, value) {
+	const previous = getMermaidDisplay();
 	setMermaidDisplay(value);
 	host.showStatus(t("mermaid.applied", { mode: optionLabel(value) }), value === "off" ? host.state.theme.colors.textDim : host.state.theme.colors.success);
+	if (previous !== value && (previous === "off" || value === "off")) host.state.ui.resetTextSelection();
 	repaintTranscript(host);
 	await syncDiagramCapabilityPrompt(host.session);
 }
@@ -148880,4 +150791,4 @@ async function handleBuiltInSlashCommand(host, name, args) {
 	}
 }
 //#endregion
-export { handleExportDebugZipCommand as $, encodeWorkDirKey as $n, lerpGradient as $t, highlightLines as A, embeddingFailureDetail as An, isTurnElapsedEnabled as At, ActivityGroupComponent as B, detectShellEnvironment as Bn, ENABLE_TERMINAL_THEME_REPORTING as Bt, handleCcCommand as C, getLlmNotSetMessage as Cn, clearInfoPanelState as Ct, ToolCallComponent as D, sortSlashCommands as Dn, createEditorTheme as Dt, UserMessageComponent as E, BUILTIN_SLASH_COMMANDS as En, resolveThemeSync as Et, StatusMessageComponent as F, PULSE_WAVE_FRAMES as Fn, detectTerminalTheme as Ft, AgentGroupComponent as G, CLI_COMMAND_NAME as Gn, QUERY_TERMINAL_THEME as Gt, estimateTokens as H, getInputHistoryFile as Hn, OSC11_RESPONSE as Ht, replaceTabs as I, TuiConfigParseError as In, parseOsc11BackgroundTheme as It, getBreathingFrame as J, PRODUCT_NAME as Jn, TERMINAL_THEME_DARK as Jt, WelcomeComponent as K, CLI_UI_MODE as Kn, TERMINAL_FOCUS_IN as Kt, sanitizeShellOutput as L, TuiLikePreferencesSchema as Ln, DISABLE_TERMINAL_FOCUS_REPORTING as Lt, CachedContainer as M, hasEmbeddingModelCache as Mn, createThemeStyles as Mt, ThinkingComponent as N, startManualEmbeddingDownload as Nn, contrastTextHex as Nt, renderDiffLines as O, isExperimentalFlagEnabled as On, createMarkdownTheme as Ot, NoticeMessageComponent as P, PIXEL_PULSE_FRAMES as Pn, getColorPalette as Pt, refineGoal as Q, ScreamHarness as Qn, FooterComponent as Qt, SkillActivationComponent as R, loadTuiConfig as Rn, DISABLE_TERMINAL_THEME_REPORTING as Rt, readJsonlFile as S, getCtrlDHint as Sn, supportsBalance as St, handleRevokeCommand as T, buildSkillSlashCommands as Tn, showUsage as Tt, getSharedSpeedTracker as U, getLogDir as Un, OSC11_RESPONSE_PREFIX as Ut, charsForTokenBudget as V, getDataDir as Vn, OSC11_QUERY as Vt, BackgroundAgentStatusComponent as W, detectInstallSource as Wn, OSC11_RESPONSE_PREFIX_NO_ESC as Wt, CompactionComponent as X, fetchCatalog as Xn, isBusy as Xt, resetBreathingClock as Y, DEFAULT_CATALOG_URL as Yn, TERMINAL_THEME_LIGHT as Yt, clearGoalState as Z, saveCatalogCache as Zn, isStreaming as Zt, handleUpdateCommand as _, EXIT_CONFIRM_WINDOW_MS as _n, handleYoloCommand as _t, syncDiagramCapabilityPrompt as a, printableChar as an, isRealUserPrompt as ar, toTerminalHyperlink as at, readUpdateCache as b, TIP_ROTATION_INTERVAL_MS as bn, showSettingsSelector as bt, disposeChildren as c, appendStreamingArgsPreview as cn, log as cr, handleAutoCommand as ct, isPlanExpandable as d, isTodoItemShape as dn, isOrphanedToolCallError as dr, handleEditorCommand as dt, SubagentSlots as en, normalizeWorkDir as er, handleExportMdCommand as et, MoonLoader as f, parseStreamingArgs as fn, ErrorCodes as fr, handleFusionPlanCommand as ft, handleMcpCommand as g, EMPTY_SESSION_HINT_URL as gn, handleWolfpackCommand as gt, handleChannelCommand as h, truncateErrorMessage as hn, handleThemeCommand as ht, buildRoleAdditionalText as i, handleLogoutCommand as in, MCP_OAUTH_AUTHORIZATION_URL_TOOL_UPDATE as ir, isInternalMessage as it, langFromPath as j, getKnowledgeStore as jn, toggleEmptySessionHint as jt, renderDiffLinesClustered as k, setExperimentalFlags as kn, isEmptySessionHintDismissed as kt, hasDispose as l, argsRecord as ln, resolveGlobalLogPath as lr, handleBotCommand as lt, handleMemoryCommand as m, stringValue as mn, handlePlanCommand as mt, clearEvalPanelState as n, handleSearchCommand as nn, readSessionIndex as nr, handleInitCommand as nt, handleExtensionCommand as o, STATUS_BULLET as on, resolveScreamHome as or, changeThinkingLevel as ot, formatMemoryMemoForInjection as p, serializeToolResultOutput as pn, SCREAM_ERROR_INFO as pr, handleModelCommand as pt, BREATHE_CYCLE_MS as q, CLI_USER_AGENT_PRODUCT as qn, TERMINAL_FOCUS_OUT as qt, openUrl as r, handleConnectCommand as rn, removeSessionIndexEntry as rr, handleTitleCommand as rt, handleSkillCommand as s, appendSessionHeaderHint as sn, flushDiagnosticLogs as sr, getModelCycleLevel as st, dispatchInput as t, handleTraceCommand as tn, appendSessionIndexEntry as tr, handleForkCommand as tt, isExpandable as u, formatErrorMessage as un, isScreamError as ur, handleCompactCommand as ut, selectUpdateTarget as v, MAIN_AGENT_ID$1 as vn, showModelPicker as vt, getDaemonInstructions as w, getNoActiveSessionMessage as wn, showStatusReport as wt, appendJsonlLine as x, getCtrlCHint as xn, refreshProviderBalance as xt, refreshUpdateCache as y, SESSION_TIPS as yn, showPermissionPicker as yt, AssistantMessageComponent as z, saveTuiConfig as zn, ENABLE_TERMINAL_FOCUS_REPORTING as zt };
+export { handleExportDebugZipCommand as $, encodeWorkDirKey as $n, lerpGradient as $t, highlightLines as A, embeddingFailureDetail as An, isTurnElapsedEnabled as At, ActivityGroupComponent as B, detectShellEnvironment as Bn, ENABLE_TERMINAL_THEME_REPORTING as Bt, handleCcCommand as C, getLlmNotSetMessage as Cn, clearInfoPanelState as Ct, ToolCallComponent as D, sortSlashCommands as Dn, createEditorTheme as Dt, UserMessageComponent as E, BUILTIN_SLASH_COMMANDS as En, resolveThemeSync as Et, StatusMessageComponent as F, PULSE_WAVE_FRAMES as Fn, detectTerminalTheme as Ft, AgentGroupComponent as G, CLI_COMMAND_NAME as Gn, QUERY_TERMINAL_THEME as Gt, estimateTokens as H, getInputHistoryFile as Hn, OSC11_RESPONSE as Ht, replaceTabs as I, TuiConfigParseError as In, parseOsc11BackgroundTheme as It, getBreathingFrame as J, PRODUCT_NAME as Jn, TERMINAL_THEME_DARK as Jt, WelcomeComponent as K, CLI_UI_MODE as Kn, TERMINAL_FOCUS_IN as Kt, sanitizeShellOutput as L, TuiLikePreferencesSchema as Ln, DISABLE_TERMINAL_FOCUS_REPORTING as Lt, CachedContainer as M, hasEmbeddingModelCache as Mn, createThemeStyles as Mt, ThinkingComponent as N, startManualEmbeddingDownload as Nn, contrastTextHex as Nt, renderDiffLines as O, isExperimentalFlagEnabled as On, createMarkdownTheme as Ot, NoticeMessageComponent as P, PIXEL_PULSE_FRAMES as Pn, getColorPalette as Pt, refineGoal as Q, ScreamHarness as Qn, FooterComponent as Qt, SkillActivationComponent as R, loadTuiConfig as Rn, DISABLE_TERMINAL_THEME_REPORTING as Rt, readJsonlFile as S, getCtrlDHint as Sn, supportsBalance as St, handleRevokeCommand as T, buildSkillSlashCommands as Tn, showUsage as Tt, getSharedSpeedTracker as U, getLogDir as Un, OSC11_RESPONSE_PREFIX as Ut, charsForTokenBudget as V, getDataDir as Vn, OSC11_QUERY as Vt, BackgroundAgentStatusComponent as W, detectInstallSource as Wn, OSC11_RESPONSE_PREFIX_NO_ESC as Wt, CompactionComponent as X, fetchCatalog as Xn, isBusy as Xt, resetBreathingClock as Y, DEFAULT_CATALOG_URL as Yn, TERMINAL_THEME_LIGHT as Yt, clearGoalState as Z, saveCatalogCache as Zn, isStreaming as Zt, handleUpdateCommand as _, EXIT_CONFIRM_WINDOW_MS as _n, handleYoloCommand as _t, syncDiagramCapabilityPrompt as a, printableChar as an, isRealUserPrompt as ar, toTerminalHyperlink as at, readUpdateCache as b, TIP_ROTATION_INTERVAL_MS as bn, showSettingsSelector as bt, disposeChildren as c, appendStreamingArgsPreview as cn, flushDiagnosticLogs as cr, handleAutoCommand as ct, isPlanExpandable as d, isTodoItemShape as dn, isScreamError as dr, handleEditorCommand as dt, SubagentSlots as en, normalizeWorkDir as er, handleExportMdCommand as et, MoonLoader as f, parseStreamingArgs as fn, isOrphanedToolCallError as fr, handleFusionPlanCommand as ft, handleMcpCommand as g, EMPTY_SESSION_HINT_URL as gn, handleWolfpackCommand as gt, handleChannelCommand as h, truncateErrorMessage as hn, handleThemeCommand as ht, buildRoleAdditionalText as i, handleLogoutCommand as in, MCP_OAUTH_AUTHORIZATION_URL_TOOL_UPDATE as ir, isInternalMessage as it, langFromPath as j, getKnowledgeStore as jn, toggleEmptySessionHint as jt, renderDiffLinesClustered as k, setExperimentalFlags as kn, isEmptySessionHintDismissed as kt, hasDispose as l, argsRecord as ln, log as lr, handleBotCommand as lt, handleMemoryCommand as m, stringValue as mn, SCREAM_ERROR_INFO as mr, handlePlanCommand as mt, clearEvalPanelState as n, handleSearchCommand as nn, readSessionIndex as nr, handleInitCommand as nt, handleExtensionCommand as o, STATUS_BULLET as on, parseRlmMaxDepthArg as or, changeThinkingLevel as ot, formatMemoryMemoForInjection as p, serializeToolResultOutput as pn, ErrorCodes as pr, handleModelCommand as pt, BREATHE_CYCLE_MS as q, CLI_USER_AGENT_PRODUCT as qn, TERMINAL_FOCUS_OUT as qt, openUrl as r, handleConnectCommand as rn, removeSessionIndexEntry as rr, handleTitleCommand as rt, handleSkillCommand as s, appendSessionHeaderHint as sn, resolveScreamHome as sr, getModelCycleLevel as st, dispatchInput as t, handleTraceCommand as tn, appendSessionIndexEntry as tr, handleForkCommand as tt, isExpandable as u, formatErrorMessage as un, resolveGlobalLogPath as ur, handleCompactCommand as ut, selectUpdateTarget as v, MAIN_AGENT_ID$1 as vn, showModelPicker as vt, getDaemonInstructions as w, getNoActiveSessionMessage as wn, showStatusReport as wt, appendJsonlLine as x, getCtrlCHint as xn, refreshProviderBalance as xt, refreshUpdateCache as y, SESSION_TIPS as yn, showPermissionPicker as yt, AssistantMessageComponent as z, saveTuiConfig as zn, ENABLE_TERMINAL_FOCUS_REPORTING as zt };