shortcutxl 0.3.60 → 0.3.62

package/BINARY-INVENTORY.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-06-04T07:10:58.989Z",
+  "generatedAt": "2026-06-10T21:37:57.358Z",
   "package": "shortcutxl",
   "binaryExtensions": [
     ".dll",
@@ -11,7 +11,7 @@
   "files": [
     {
       "path": "xll/ShortcutXL.xll",
-      "sha256": "0f4f7b363b32871ef4afd57fa891e740f91ca5ab60b8d452c36ecf334f443033",
+      "sha256": "6eaecb6c7dd047ee91a0717b8849c43baa847d0c21afe094fe1d9e6fd1f89f6a",
       "source": "ShortcutXL native XLL build",
       "version": "package",
       "builtBy": "shortcut",
@@ -523,7 +523,7 @@
     },
     {
       "path": "xll/python/Scripts/httpx.exe",
-      "sha256": "0ab1e42994f3ac9177d03abcf014f3eff940ca307b923ddf2cb2036b2c9eaadf",
+      "sha256": "6e6b7c9bb24e920a8d59ee9464ee83f245f9a2daa1489bb23a09e80e1eac59f8",
       "source": "httpx console launcher installed into embedded Python",
       "version": "see packaged httpx distribution",
       "builtBy": "third-party",
@@ -531,7 +531,7 @@
     },
     {
       "path": "xll/python/Scripts/idna.exe",
-      "sha256": "8b8baca0e902b3bd1757d5d14155cb1178e8825c232d67cd7b0c7e120c6fa5ff",
+      "sha256": "15dbbd45e6257c0ca2dc305880d90ccf626ddb5c9265f8e9116f564483176ce1",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -539,7 +539,7 @@
     },
     {
       "path": "xll/python/Scripts/pip.exe",
-      "sha256": "928216be655a94bb860d00a6a4b420d26f37fa5daa13f6d80a09aa90d87ba5f1",
+      "sha256": "373818f3109b5b0e3d7f249ebced133b042d0e2ffd2fb983967cb611c40e5d57",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -547,7 +547,7 @@
     },
     {
       "path": "xll/python/Scripts/pip3.13.exe",
-      "sha256": "928216be655a94bb860d00a6a4b420d26f37fa5daa13f6d80a09aa90d87ba5f1",
+      "sha256": "373818f3109b5b0e3d7f249ebced133b042d0e2ffd2fb983967cb611c40e5d57",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -555,7 +555,7 @@
     },
     {
       "path": "xll/python/Scripts/pip3.exe",
-      "sha256": "928216be655a94bb860d00a6a4b420d26f37fa5daa13f6d80a09aa90d87ba5f1",
+      "sha256": "373818f3109b5b0e3d7f249ebced133b042d0e2ffd2fb983967cb611c40e5d57",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -563,7 +563,7 @@
     },
     {
       "path": "xll/python/Scripts/pywin32_postinstall.exe",
-      "sha256": "cd410066e88131c0f203025dc86306a2f6498ed54abe9ff27ef349f7974c3521",
+      "sha256": "e6f28aa72208afcf845960aed0d938f48d993c78f111dab4da6e3c0b5f4a3a18",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -571,7 +571,7 @@
     },
     {
       "path": "xll/python/Scripts/pywin32_testall.exe",
-      "sha256": "af93cdcdd7dfeda2a71bedb565329960ca0d8621cb3dd36365ce197a4c44968d",
+      "sha256": "3014d8654460053f2061f84ba4cfa908682a28e81780c53763ecc01a934fa4a8",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -779,11 +779,11 @@
     },
     {
       "path": "xll/python/sqlite3.dll",
-      "sha256": "aaae3fe73a4dda249da1ed740c087d1548a1ff7b73eaa7aa62c2354a581ee299",
-      "source": "SQLite library bundled with CPython Windows embeddable runtime",
-      "version": "see packaged python runtime",
+      "sha256": "73b045c910fc19a069bae2e2c7ebb5ea66fe6c85f166535a6e07e09155cd9e6d",
+      "source": "SQLite official precompiled Windows x64 DLL",
+      "version": "3.53.2",
       "builtBy": "third-party",
-      "verification": "Downloaded from python.org CPython release artifacts; verify upstream SHA/signature before vendoring."
+      "verification": "Downloaded from sqlite.org sqlite-dll-win-x64-3530200.zip; upstream SHA3-256 is b898ced2e0627999d7d0b9d554ea53086a9b165e52ae743277d115dcd39e6868, and vendor-python.ps1 verifies extracted sqlite3.dll SHA256 73b045c910fc19a069bae2e2c7ebb5ea66fe6c85f166535a6e07e09155cd9e6d before copying."
     },
     {
       "path": "xll/python/unicodedata.pyd",

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.3.62]
+
+- **Windows runtime security** - Updated the embedded Windows SQLite DLL used by ShortcutXL's bundled Python runtime.
+- **Default model update** - Updated the default model to Fable.
+
+## [0.3.61]
+
+- **ShortcutXL plugin guidance** - Refreshed the bundled Claude and Codex ShortcutXL plugin guidance.
+
 ## [0.3.60]
 
 - **Safer shell approvals** - High-risk Outlook-style send and delete shell operations now require explicit one-time approval even when runtime shell bypass is enabled.

package/agent-docs/examples/extensions/custom-provider-anthropic/package.json

@@ -14,6 +14,6 @@
     ]
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.52.0"
+    "@anthropic-ai/sdk": "0.91.1"
   }
 }

package/binary-provenance.json

@@ -50,13 +50,13 @@
       "builtBy": "third-party",
       "verification": "Downloaded from python.org CPython release artifacts; verify upstream SHA/signature before vendoring."
     },
-    {
-      "pattern": "xll/python/sqlite3.dll",
-      "source": "SQLite library bundled with CPython Windows embeddable runtime",
-      "version": "see packaged python runtime",
-      "builtBy": "third-party",
-      "verification": "Downloaded from python.org CPython release artifacts; verify upstream SHA/signature before vendoring."
-    },
+    {
+      "pattern": "xll/python/sqlite3.dll",
+      "source": "SQLite official precompiled Windows x64 DLL",
+      "version": "3.53.2",
+      "builtBy": "third-party",
+      "verification": "Downloaded from sqlite.org sqlite-dll-win-x64-3530200.zip; upstream SHA3-256 is b898ced2e0627999d7d0b9d554ea53086a9b165e52ae743277d115dcd39e6868, and vendor-python.ps1 verifies extracted sqlite3.dll SHA256 73b045c910fc19a069bae2e2c7ebb5ea66fe6c85f166535a6e07e09155cd9e6d before copying."
+    },
     {
       "pattern": "xll/python/vcruntime*.dll",
       "source": "Microsoft Visual C++ runtime library bundled with CPython Windows embeddable runtime",

package/dist/ai/models.js

@@ -22,7 +22,8 @@ export function getModels(provider) {
         : [];
 }
 export function calculateCost(model, usage) {
-    usage.cost.input = (model.cost.input / 1000000) * usage.input;
+    const uncachedInput = Math.max(0, usage.input - usage.cacheRead - usage.cacheWrite);
+    usage.cost.input = (model.cost.input / 1000000) * uncachedInput;
     usage.cost.output = (model.cost.output / 1000000) * usage.output;
     usage.cost.cacheRead = (model.cost.cacheRead / 1000000) * usage.cacheRead;
     usage.cost.cacheWrite = (model.cost.cacheWrite / 1000000) * usage.cacheWrite;

package/dist/ai/providers/anthropic.js

@@ -113,26 +113,26 @@ export const streamAnthropic = (model, context, options) => {
         };
         try {
             const apiKey = options?.apiKey ?? getEnvApiKey(model.provider) ?? '';
-            const client = createClient(model, apiKey, options?.interleavedThinking ?? true, options?.headers);
+            const client = createClient(model, apiKey, options?.interleavedThinking ?? true, options?.headers, options?.fetchOptions);
             const params = buildParams(model, context, options);
             options?.onPayload?.(params);
             const anthropicStream = client.messages.stream({ ...params, stream: true }, { signal: options?.signal });
             stream.push({ type: 'start', partial: output });
             const blocks = output.content;
+            let uncachedInputTokens = 0;
             for await (const event of anthropicStream) {
                 if (event.type === 'message_start') {
                     // Capture initial token usage from message_start event
                     // This ensures we have input token counts even if the stream is aborted early
-                    output.usage.input = event.message.usage.input_tokens || 0;
+                    uncachedInputTokens = event.message.usage.input_tokens || 0;
                     output.usage.output = event.message.usage.output_tokens || 0;
                     output.usage.cacheRead = event.message.usage.cache_read_input_tokens || 0;
                     output.usage.cacheWrite = event.message.usage.cache_creation_input_tokens || 0;
-                    // Anthropic doesn't provide total_tokens, compute from components
-                    output.usage.totalTokens =
-                        output.usage.input +
-                            output.usage.output +
-                            output.usage.cacheRead +
-                            output.usage.cacheWrite;
+                    // Anthropic doesn't provide total_tokens; usage.input is normalized
+                    // to total input, including cache buckets.
+                    output.usage.input =
+                        uncachedInputTokens + output.usage.cacheRead + output.usage.cacheWrite;
+                    output.usage.totalTokens = output.usage.input + output.usage.output;
                     calculateCost(model, output.usage);
                 }
                 else if (event.type === 'content_block_start') {
@@ -284,9 +284,6 @@ export const streamAnthropic = (model, context, options) => {
                     }
                     // Only update usage fields if present (not null).
                     // Preserves input_tokens from message_start when proxies omit it in message_delta.
-                    if (event.usage.input_tokens != null) {
-                        output.usage.input = event.usage.input_tokens;
-                    }
                     if (event.usage.output_tokens != null) {
                         output.usage.output = event.usage.output_tokens;
                     }
@@ -296,12 +293,14 @@ export const streamAnthropic = (model, context, options) => {
                     if (event.usage.cache_creation_input_tokens != null) {
                         output.usage.cacheWrite = event.usage.cache_creation_input_tokens;
                     }
-                    // Anthropic doesn't provide total_tokens, compute from components
-                    output.usage.totalTokens =
-                        output.usage.input +
-                            output.usage.output +
-                            output.usage.cacheRead +
-                            output.usage.cacheWrite;
+                    if (event.usage.input_tokens != null) {
+                        uncachedInputTokens = event.usage.input_tokens;
+                    }
+                    // Anthropic doesn't provide total_tokens; usage.input is normalized
+                    // to total input, including cache buckets.
+                    output.usage.input =
+                        uncachedInputTokens + output.usage.cacheRead + output.usage.cacheWrite;
+                    output.usage.totalTokens = output.usage.input + output.usage.output;
                     calculateCost(model, output.usage);
                 }
             }
@@ -388,7 +387,7 @@ export const streamSimpleAnthropic = (model, context, options) => {
 function isOAuthToken(apiKey) {
     return apiKey.includes('sk-ant-oat');
 }
-function createClient(model, apiKey, interleavedThinking, optionsHeaders) {
+function createClient(model, apiKey, interleavedThinking, optionsHeaders, fetchOptions) {
     // Adaptive thinking models (Opus 4.6, Sonnet 4.6) have interleaved thinking built-in.
     // The beta header is deprecated on Opus 4.6 and redundant on Sonnet 4.6, so skip it.
     const needsInterleavedBeta = interleavedThinking && !supportsAdaptiveThinking(model.id);
@@ -403,6 +402,7 @@ function createClient(model, apiKey, interleavedThinking, optionsHeaders) {
     const client = new Anthropic({
         apiKey,
         baseURL: model.baseUrl,
+        fetchOptions: fetchOptions,
         defaultHeaders: mergeHeaders({
             accept: 'application/json',
             'anthropic-beta': betaFeatures.join(',')

package/dist/ai/providers/openai-completions.js

@@ -64,7 +64,7 @@ export const streamOpenAICompletions = (model, context, options) => {
         };
         try {
             const apiKey = options?.apiKey || getEnvApiKey(model.provider) || '';
-            const client = createClient(model, context, apiKey, options?.headers);
+            const client = createClient(model, context, apiKey, options?.headers, options?.fetchOptions);
             const params = buildParams(model, context, options);
             options?.onPayload?.(params);
             const openaiStream = await client.chat.completions.create(params, {
@@ -108,17 +108,18 @@ export const streamOpenAICompletions = (model, context, options) => {
                 if (chunk.usage) {
                     const cachedTokens = chunk.usage.prompt_tokens_details?.cached_tokens || 0;
                     const reasoningTokens = chunk.usage.completion_tokens_details?.reasoning_tokens || 0;
-                    const input = (chunk.usage.prompt_tokens || 0) - cachedTokens;
+                    const input = chunk.usage.prompt_tokens || 0;
                     const outputTokens = (chunk.usage.completion_tokens || 0) + reasoningTokens;
                     output.usage = {
-                        // OpenAI includes cached tokens in prompt_tokens, so subtract to get non-cached input
+                        // OpenAI includes cached tokens in prompt_tokens; cost calculation
+                        // derives uncached input from input - cacheRead - cacheWrite.
                         input,
                         output: outputTokens,
                         cacheRead: cachedTokens,
                         cacheWrite: 0,
                         // Compute totalTokens ourselves since we add reasoning_tokens to output
                         // and some providers (e.g., Groq) don't include them in total_tokens
-                        totalTokens: input + outputTokens + cachedTokens,
+                        totalTokens: input + outputTokens,
                         cost: {
                             input: 0,
                             output: 0,
@@ -287,7 +288,7 @@ export const streamSimpleOpenAICompletions = (model, context, options) => {
         toolChoice
     });
 };
-function createClient(model, context, apiKey, optionsHeaders) {
+function createClient(model, context, apiKey, optionsHeaders, fetchOptions) {
     if (!apiKey) {
         if (!process.env.OPENAI_API_KEY) {
             throw new Error('OpenAI API key is required. Set OPENAI_API_KEY environment variable or pass it as an argument.');
@@ -302,6 +303,7 @@ function createClient(model, context, apiKey, optionsHeaders) {
     return new OpenAI({
         apiKey,
         baseURL: model.baseUrl,
+        fetchOptions: fetchOptions,
         defaultHeaders: headers
     });
 }

package/dist/ai/providers/openai-responses-shared.d.ts

@@ -3,7 +3,7 @@ import type { Api, AssistantMessage, Context, Model, Tool, Usage } from '../type
 import type { AssistantMessageEventStream } from '../utils/event-stream.js';
 export interface OpenAIResponsesStreamOptions {
     serviceTier?: ResponseCreateParamsStreaming['service_tier'];
-    applyServiceTierPricing?: (usage: Usage, serviceTier: ResponseCreateParamsStreaming['service_tier'] | undefined) => void;
+    applyServiceTierPricing?: (usage: Usage, serviceTier: ResponseCreateParamsStreaming['service_tier'] | undefined, model: Pick<Model<Api>, 'id'>) => void;
 }
 export interface ConvertResponsesMessagesOptions {
     includeSystemPrompt?: boolean;

package/dist/ai/providers/openai-responses-shared.js

@@ -385,8 +385,9 @@ export async function processResponsesStream(openaiStream, output, stream, model
             if (response?.usage) {
                 const cachedTokens = response.usage.input_tokens_details?.cached_tokens || 0;
                 output.usage = {
-                    // OpenAI includes cached tokens in input_tokens, so subtract to get non-cached input
-                    input: (response.usage.input_tokens || 0) - cachedTokens,
+                    // OpenAI includes cached tokens in input_tokens; cost calculation
+                    // derives uncached input from input - cacheRead - cacheWrite.
+                    input: response.usage.input_tokens || 0,
                     output: response.usage.output_tokens || 0,
                     cacheRead: cachedTokens,
                     cacheWrite: 0,
@@ -397,7 +398,7 @@ export async function processResponsesStream(openaiStream, output, stream, model
             calculateCost(model, output.usage);
             if (options?.applyServiceTierPricing) {
                 const serviceTier = response?.service_tier ?? options.serviceTier;
-                options.applyServiceTierPricing(output.usage, serviceTier);
+                options.applyServiceTierPricing(output.usage, serviceTier, model);
             }
             // Map status to stop reason
             output.stopReason = mapStopReason(response?.status);

package/dist/ai/providers/openai-responses.d.ts

@@ -1,5 +1,5 @@
 import type { ResponseCreateParamsStreaming } from 'openai/resources/responses/responses.js';
-import type { SimpleStreamOptions, StreamFunction, StreamOptions } from '../types.js';
+import type { Api, Model, SimpleStreamOptions, StreamFunction, StreamOptions } from '../types.js';
 export interface OpenAIResponsesOptions extends StreamOptions {
     reasoningEffort?: 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
     reasoningSummary?: 'auto' | 'detailed' | 'concise' | null;
@@ -10,4 +10,5 @@ export interface OpenAIResponsesOptions extends StreamOptions {
  */
 export declare const streamOpenAIResponses: StreamFunction<'openai-responses', OpenAIResponsesOptions>;
 export declare const streamSimpleOpenAIResponses: StreamFunction<'openai-responses', SimpleStreamOptions>;
+export declare function getServiceTierCostMultiplier(serviceTier: ResponseCreateParamsStreaming['service_tier'] | undefined, model: Pick<Model<Api>, 'id'>): number;
 //# sourceMappingURL=openai-responses.d.ts.map

package/dist/ai/providers/openai-responses.js

@@ -1,4 +1,5 @@
 import OpenAI from 'openai';
+import { SHORTCUT_MODEL_ID } from '../../model-ids.js';
 import { getEnvApiKey } from '../env-api-keys.js';
 import { supportsXhigh } from '../models.js';
 import { AssistantMessageEventStream } from '../utils/event-stream.js';
@@ -58,7 +59,7 @@ export const streamOpenAIResponses = (model, context, options) => {
         try {
             // Create OpenAI client
             const apiKey = options?.apiKey || getEnvApiKey(model.provider) || '';
-            const client = createClient(model, context, apiKey, options?.headers);
+            const client = createClient(model, context, apiKey, options?.headers, options?.fetchOptions);
             const params = buildParams(model, context, options);
             options?.onPayload?.(params);
             const openaiStream = await client.responses.create(params, options?.signal ? { signal: options.signal } : undefined);
@@ -101,7 +102,7 @@ export const streamSimpleOpenAIResponses = (model, context, options) => {
         reasoningEffort
     });
 };
-function createClient(model, context, apiKey, optionsHeaders) {
+function createClient(model, context, apiKey, optionsHeaders, fetchOptions) {
     if (!apiKey) {
         if (!process.env.OPENAI_API_KEY) {
             throw new Error('OpenAI API key is required. Set OPENAI_API_KEY environment variable or pass it as an argument.');
@@ -116,6 +117,7 @@ function createClient(model, context, apiKey, optionsHeaders) {
     return new OpenAI({
         apiKey,
         baseURL: model.baseUrl,
+        fetchOptions: fetchOptions,
         defaultHeaders: headers
     });
 }
@@ -167,18 +169,20 @@ function buildParams(model, context, options) {
     }
     return params;
 }
-function getServiceTierCostMultiplier(serviceTier) {
+export function getServiceTierCostMultiplier(serviceTier, model) {
     switch (serviceTier) {
         case 'flex':
             return 0.5;
         case 'priority':
+            if (model.id === SHORTCUT_MODEL_ID.Gpt55)
+                return 2.5;
             return 2;
         default:
             return 1;
     }
 }
-function applyServiceTierPricing(usage, serviceTier) {
-    const multiplier = getServiceTierCostMultiplier(serviceTier);
+function applyServiceTierPricing(usage, serviceTier, model) {
+    const multiplier = getServiceTierCostMultiplier(serviceTier, model);
     if (multiplier === 1)
         return;
     usage.cost.input *= multiplier;

package/dist/ai/providers/simple-options.js

@@ -5,6 +5,7 @@ export function buildBaseOptions(model, options, apiKey) {
         signal: options?.signal,
         apiKey: apiKey || options?.apiKey,
         cacheRetention: options?.cacheRetention,
+        fetchOptions: options?.fetchOptions,
         sessionId: options?.sessionId,
         headers: options?.headers,
         onPayload: options?.onPayload,

package/dist/ai/types.d.ts

@@ -32,6 +32,13 @@ export interface StreamOptions {
      * Optional callback for inspecting provider payloads before sending.
      */
     onPayload?: (payload: unknown) => void;
+    /**
+     * Optional fetch settings for provider SDK calls.
+     *
+     * This is primarily used by first-party gateway transports that need browser
+     * cookies for auth; direct provider calls should normally leave it unset.
+     */
+    fetchOptions?: RequestInit;
     /**
      * Optional custom HTTP headers to include in API requests.
      * Merged with provider defaults; can override default headers.
@@ -95,6 +102,7 @@ export interface ToolCall {
     thoughtSignature?: string;
 }
 export interface Usage {
+    /** Total input tokens, including cache read/write buckets when present. */
     input: number;
     output: number;
     cacheRead: number;

package/dist/ai/utils/overflow.js

@@ -98,7 +98,7 @@ export function isContextOverflow(message, contextWindow) {
     }
     // Case 2: Silent overflow (z.ai style) - successful but usage exceeds context
     if (contextWindow && message.stopReason === 'stop') {
-        const inputTokens = message.usage.input + message.usage.cacheRead;
+        const inputTokens = message.usage.input;
         if (inputTokens > contextWindow) {
             return true;
         }

package/dist/app/agent-session-runtime-adapter.js

@@ -35,6 +35,14 @@ function createAgentSessionCore(session, pendingHostToolRequests) {
             session.replaceToolsByName(configuration.toolNames);
             session.agent.setSystemPrompt(configuration.systemPrompt);
         },
+        async controlTask(request) {
+            return {
+                ok: false,
+                action: request.action,
+                taskId: request.taskId,
+                reason: 'Task control is only available in the embedded ShortcutXL runtime.'
+            };
+        },
         dispose() {
             session.dispose();
         },

package/dist/app/agent-session.d.ts

@@ -346,7 +346,7 @@ export declare class AgentSession {
     private _setAutonomousState;
     /** Reload autonomous-run state from the persisted session header on resume. */
     private _restoreAutonomousStateFromSession;
-    /** Wrap a user prompt with autonomous-run framing before sending it to the model. */
+    /** Handle the product-owned /autonomous command before sending text to the model. */
     private _prepareAutonomousPrompt;
     /**
      * Queue a steering message to interrupt the agent mid-run.
@@ -362,7 +362,7 @@ export declare class AgentSession {
      * @param images Optional image attachments to include with the message
      */
     followUp(text: string, images?: ImageContent[]): Promise<void>;
-    /** Resolve raw prompt text + images into the final agent-input shape (skills, autonomous, etc.). */
+    /** Resolve raw prompt text + images into the final agent-input shape. */
     private _preparePromptInput;
     /** Enqueue a steering message to be delivered before the next assistant response. */
     private _queueSteer;

package/dist/app/agent-session.js

@@ -17,11 +17,11 @@ import { createCompactionActions, createErrorRecoveryActions, triggerCompactionI
 import { isContextOverflow } from '../core/session/context-overflow.js';
 import { SessionCompaction } from '../core/session/session-compaction.js';
 import { classifyError, SessionErrorRecovery } from '../core/session/session-error-recovery.js';
+import { getActiveUserMessageId } from '../core/user-message-id.js';
 import { isShortcutFastModeModel } from '../model-ids.js';
 import { formatFileUploadsContext, mergeFileUploads } from './file-uploads.js';
-import { getShortcutLlmProxyAttributionFromMessages } from './providers/shortcut-attribution.js';
+import { createShortcutLlmProxyClient } from './providers/shortcut-llm-proxy-client.js';
 import { expandPromptTemplate } from './resources/prompt-template-expansion.js';
-import { parseSkillBlock } from './resources/skill-block.js';
 import { AUTONOMOUS_STATE_CUSTOM_TYPE, buildAutonomousRefreshPrompt, extractProgressFolder, inferAutonomousStateFromEntries } from './session/autonomous-workflow.js';
 import { BranchManager } from './session/branch-manager.js';
 import { parseBudgetCommand } from './session/budget-command.js';
@@ -137,11 +137,18 @@ export class AgentSession {
         this._fastModeDisabledReason = this._fastModeAllowed
             ? undefined
             : (config.fastModeDisabledReason ?? 'team');
+        const summaryShortcutLlmProxy = createShortcutLlmProxyClient({
+            modelRegistry: this._modelRegistry,
+            getAttribution: () => ({
+                sessionId: this.sessionManager.getSessionId(),
+                userMessageId: getActiveUserMessageId(this.messages)
+            })
+        });
         this._summaryEmitter = new ToolSummaryEmitter({
             enabled: config.enableToolSummaries ?? true,
             isFeatureEnabled: () => this.settingsManager.getToolSummariesEnabled(),
             isEligibleTool: isToolSummaryEligible,
-            getAttribution: () => getShortcutLlmProxyAttributionFromMessages(this.messages, this.sessionManager.getSessionId()),
+            getShortcutLlmProxyClient: () => summaryShortcutLlmProxy,
             onDiagnostic: (diagnostic) => {
                 this._toolSummaryDiagnostics.push(diagnostic);
                 if (this._toolSummaryDiagnostics.length > 200) {
@@ -388,7 +395,7 @@ export class AgentSession {
             this._summaryEmitter.captureArgs(event.toolCallId, event.args);
         }
         if (event.type === 'tool_execution_end') {
-            this._summaryEmitter.maybeGenerate(event.toolCallId, event.toolName, event.result, this._modelRegistry, (e) => this._emit(e));
+            this._summaryEmitter.maybeGenerate(event.toolCallId, event.toolName, event.result, (e) => this._emit(e));
         }
         // --- Step 3c: Budget token accumulation (sync) ---
         if (event.type === 'message_end' && event.message.role === 'assistant') {
@@ -748,7 +755,7 @@ export class AgentSession {
             enabled: true,
             originalUserTask: trimmed
         });
-        await this.prompt(`[Skill:autonomous selected] ${trimmed}`);
+        await this.prompt(trimmed);
     }
     /** Stage a pending session refresh (mode/model swap) to be applied on the next prompt. */
     async preparePendingRefresh(refresh) {
@@ -969,7 +976,7 @@ export class AgentSession {
     _restoreAutonomousStateFromSession() {
         this._autonomousState = inferAutonomousStateFromEntries(this.sessionManager.getEntries());
     }
-    /** Wrap a user prompt with autonomous-run framing before sending it to the model. */
+    /** Handle the product-owned /autonomous command before sending text to the model. */
     _prepareAutonomousPrompt(text) {
         if (!text.startsWith('/autonomous'))
             return text;
@@ -981,7 +988,7 @@ export class AgentSession {
             enabled: true,
             originalUserTask: task
         });
-        return `[Skill:autonomous selected] ${task}`;
+        return task;
     }
     /**
      * Queue a steering message to interrupt the agent mid-run.
@@ -1017,7 +1024,7 @@ export class AgentSession {
         }
         await this._queueFollowUp(prepared.text, prepared.images);
     }
-    /** Resolve raw prompt text + images into the final agent-input shape (skills, autonomous, etc.). */
+    /** Resolve raw prompt text + images into the final agent-input shape. */
     async _preparePromptInput(text, images, options) {
         let currentText = this._prepareAutonomousPrompt(text);
         let currentImages = images;
@@ -1042,13 +1049,6 @@ export class AgentSession {
             currentText = this._expandSkillCommand(currentText);
             currentText = expandPromptTemplate(currentText, [...this.promptTemplates]);
         }
-        const parsedSkill = parseSkillBlock(currentText);
-        if (parsedSkill?.name === 'autonomous' && parsedSkill.userMessage) {
-            this._setAutonomousState({
-                enabled: true,
-                originalUserTask: parsedSkill.userMessage
-            });
-        }
         if (options.commandMode === 'reject' && currentText.startsWith('/')) {
             assertNotExtensionCommand(currentText, extensionRunner);
         }

package/dist/app/approvals/types.d.ts

@@ -75,5 +75,6 @@ export interface SwitchModeApprovalData {
     currentMode: string;
     targetMode: string;
     reason?: string;
+    documentPath?: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/app/background/tool-summaries.d.ts

@@ -4,7 +4,7 @@
  * Summaries are ephemeral UX — displayed to the user but never injected
  * into the LLM conversation context.
  */
-import { type ShortcutLlmProxyAttribution } from '../providers/shortcut-attribution.js';
+import { type ShortcutLlmProxyClient } from '../providers/shortcut-llm-proxy-client.js';
 export declare const TOOL_SUMMARY_MODEL = "claude-haiku-4-5-20251001";
 interface ToolSummaryInput {
     toolName: string;
@@ -13,7 +13,7 @@ interface ToolSummaryInput {
 }
 export interface ToolSummaryGenerationResult {
     summary?: string;
-    failureReason?: 'aborted' | 'http-error' | 'invalid-json' | 'missing-text' | 'network-error';
+    failureReason?: 'aborted' | 'http-error' | 'invalid-json' | 'missing-auth' | 'missing-base-url' | 'missing-text' | 'network-error';
     httpStatus?: number;
 }
 /**
@@ -22,7 +22,13 @@ export interface ToolSummaryGenerationResult {
  * Returns the summary string, or undefined if the call fails or is aborted.
  * Never throws — errors are silently swallowed since summaries are best-effort UX.
  */
-export declare function generateToolSummaryDetailed(input: ToolSummaryInput, baseUrl: string, apiKey: string, signal?: AbortSignal, maxOutputTokens?: number, attribution?: ShortcutLlmProxyAttribution): Promise<ToolSummaryGenerationResult>;
-export declare function generateToolSummary(input: ToolSummaryInput, baseUrl: string, apiKey: string, signal?: AbortSignal, maxOutputTokens?: number, attribution?: ShortcutLlmProxyAttribution): Promise<string | undefined>;
+export declare function generateToolSummaryDetailed(input: ToolSummaryInput, shortcutLlmProxy: ShortcutLlmProxyClient, options?: {
+    signal?: AbortSignal;
+    maxOutputTokens?: number;
+}): Promise<ToolSummaryGenerationResult>;
+export declare function generateToolSummary(input: ToolSummaryInput, shortcutLlmProxy: ShortcutLlmProxyClient, options?: {
+    signal?: AbortSignal;
+    maxOutputTokens?: number;
+}): Promise<string | undefined>;
 export {};
 //# sourceMappingURL=tool-summaries.d.ts.map