zidane 5.10.13 → 5.11.1

package/dist/{tools-NxnEmzYg.js → tools-ZHKOh44k.js}

@@ -1,25 +1,26 @@
 import { r as utf8ByteLength } from "./utils-ngQzYzZD.js";
 import { t as buildContextBreakdown } from "./context-breakdown-kO-pDsay.js";
 import { a as formatTaskStatus, i as formatDuration, o as formatTaskSummary, s as previewLine } from "./format-BNOXpl-1.js";
-import { a as createCursorOAuthProvider, c as baseten, d as anthropic, h as FAST_MODE_OPTIONS, m as ANTHROPIC_EXTRA_MODELS, n as openai, o as generatePkce, r as local, s as cerebras, t as openrouter, u as arcee } from "./providers-BGBB18zz.js";
+import { a as createCursorOAuthProvider, c as baseten, d as anthropic, g as FAST_MODE_OPTIONS, h as ANTHROPIC_EXTRA_MODELS, m as writeFileAtomicAsync, n as openai, o as generatePkce, r as local, s as cerebras, t as openrouter, u as arcee } from "./providers-C2cxujp_.js";
 import { i as AgentProviderError, l as errorMessage, n as AgentBudgetExceededError, o as AgentToolPairingError, p as toTypedError, t as AgentAbortedError } from "./errors-DkR6GPJw.js";
-import { A as renderSystemForWire, D as appendStaticSection, a as detectTurnInterruption, c as filterUnresolvedToolUses, d as remintDuplicateToolCallIds, n as SYNTHETIC_TOOL_RESULT_PLACEHOLDER, o as ensureEndsWithUserMessage, s as ensureToolResultPairing } from "./messages-C_1AmSpk.js";
+import { A as renderSystemForWire, D as appendStaticSection, a as detectTurnInterruption, c as filterUnresolvedToolUses, d as remintDuplicateToolCallIds, n as SYNTHETIC_TOOL_RESULT_PLACEHOLDER, o as ensureEndsWithUserMessage, s as ensureToolResultPairing } from "./messages-RPKrEPvH.js";
 import { a as toolResultToText, i as toolOutputByteLength, n as documentBlockMarker, r as toolOutputBudgetByteLength, t as DEFAULT_AGENT_CLOCK } from "./types-BiobHM1D.js";
 import { t as reconcileImageMediaType } from "./image-sniff-B7uFSNO1.js";
-import { r as createProcessContext, t as resolveDetachedTasksCapability } from "./contexts-BJVgG0LY.js";
+import { r as createProcessContext, t as resolveDetachedTasksCapability } from "./contexts-DglWSzmR.js";
 import { i as styleReplacementForVia, n as resolveOldString, r as stripLineNumberPrefixes, t as describeVia } from "./edit-utils-EGosADZq.js";
 import { a as markReadStateElided, n as getToolDedupState, o as readStateKey, r as hashContent, s as resolveReadStateMap } from "./read-state-BFqpQRc5.js";
-import { S as escapeXml, d as buildCatalog, n as stripShellInterpolations, p as installAllowedToolsGate, r as resolveSkills, t as interpolateShellCommands, v as validateResourcePathReal, x as createSkillActivationState } from "./interpolate-Dy7Lunvg.js";
-import { n as connectMcpServers } from "./mcp-tevNihk_.js";
+import { S as escapeXml, d as buildCatalog, n as stripShellInterpolations, p as installAllowedToolsGate, r as resolveSkills, t as interpolateShellCommands, v as validateResourcePathReal, x as createSkillActivationState } from "./interpolate-CTfr0GdR.js";
+import { n as connectMcpServers } from "./mcp-Cy9mgCcr.js";
 import { n as flattenTurns, r as formatTokenUsage, t as effectiveInputFromTurn } from "./stats-DAKBEKjc.js";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { n as shellQuote, t as alwaysQuote } from "./shell-quote-BmnhZmdM.js";
+import { isAbsolute, join, resolve } from "node:path";
 import { createHooks } from "hookable";
 import { getModel, getModels } from "@earendil-works/pi-ai";
 import { Buffer } from "node:buffer";
 import { refreshAnthropicToken, refreshOpenAICodexToken, registerOAuthProvider } from "@earendil-works/pi-ai/oauth";
+import { glob, readdir, rm, stat, unlink } from "node:fs/promises";
 import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
-import { glob, mkdir, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 //#region src/aliasing.ts
 /**
 * Build alias lookup maps from a `toolAliases` record.
@@ -82,8 +83,8 @@ function toCanonicalName(wire, maps) {
 * Why: SDK consumers and tool descriptions across the ecosystem
 * inconsistently reference one form or the other (Anthropic's docs use
 * double, zidane uses single). A Claude-Code-trained model emitting
-* `mcp__supabase__apply_migration` against a server zidane registered as
-* `mcp_supabase_apply_migration` would otherwise trip the `tool:unknown`
+* `mcp__acme__apply_migration` against a server zidane registered as
+* `mcp_acme_apply_migration` would otherwise trip the `tool:unknown`
 * path and waste a turn on the correction.
 *
 * Idempotent: a canonical that already has a double-underscore alias
@@ -1403,6 +1404,14 @@ function installDedupToolsGate(hooks, getDedupTools, getSession) {
 */
 const PERSISTENCE_PREVIEW_BYTES = 2 * 1024;
 /**
+* Preview size for persist-on-elide stubs. Much smaller than
+* {@link PERSISTENCE_PREVIEW_BYTES}: this content is being COMPACTED OUT (it's
+* old), so the stub only needs a hint plus the recovery path, not a full
+* preview. Keeping it small stops the elided region from ballooning ~40× over
+* the lossy stub it replaces while still being recoverable by reading `path`.
+*/
+const ELIDE_PERSIST_PREVIEW_BYTES = 256;
+/**
 * Byte-stable prefix every {@link buildPersistedStub} output starts with.
 * Exported so wire-level passes (tail compaction, future stale-output
 * elision) can recognize a persisted stub and preserve its path attribute
@@ -1632,7 +1641,7 @@ async function enforcePersistDirCap(persistDir, maxBytes, opts = {}) {
 * surface.
 */
 function buildPersistedStub(input) {
-	const { slice: previewSlice, bytes: previewBytes } = sliceFirstBytes(input.output, PERSISTENCE_PREVIEW_BYTES);
+	const { slice: previewSlice, bytes: previewBytes } = sliceFirstBytes(input.output, input.previewBytes ?? 2048);
 	const previewMarker = previewSlice.length < input.output.length ? `\n…(${input.originalBytes - previewBytes} more bytes in persisted file)` : "";
 	return [
 		`${PERSISTED_STUB_PREFIX}${escapeXml(input.toolName)}" bytes="${input.originalBytes}" path="${escapeXml(input.persistedPath)}">`,
@@ -1662,30 +1671,76 @@ async function cleanupPersistedSession(persistRoot) {
 	}
 }
 /**
-* Write-then-rename for atomicity. A concurrent reader (or a crash mid-
-* write) never observes a partial file: the rename is atomic on every
-* POSIX FS, and the destination is either the fully-written file or
-* absent. Creates the parent directory on demand so the caller doesn't
-* have to track which sessions have already initialized their dir.
-*
-* On write failure (disk full, permissions, signal), removes the `.tmp`
-* file so it doesn't accumulate as debris alongside successful blobs.
-* The unlink itself is best-effort — if we can't write to the dir we
-* likely can't unlink from it either, and the original error is what
-* the caller needs to see.
-*
-* Same idiom we use elsewhere (state-store snapshots, session export).
+* Persist-on-elide: belatedly write tool results that tail compaction is
+* about to replace with the lossy `[…elided…]` stub, swapping in a
+* recoverable `<persisted-output … path=…>` stub instead. This is the lazy
+* counterpart to {@link maybePersistToolResult}'s eager (emit-time)
+* persistence — it only fires when a result is actually being compacted out,
+* so recent results stay full inline while OLD ones become recoverable rather
+* than destroyed. Closes the context-loss gap for non-read results between
+* the lossy stub and re-runnable side effects: after this, a compacted result
+* is always retrievable by `read_file`-ing its path.
+*
+* `items` are the {@link TailCompactionResult.persistableElided} entries (the
+* caller has already filtered out reads — which recover via the read-state
+* dedup re-serve — and results too small to be worth persisting). Each
+* `output` is the ORIGINAL content captured before the lossy stub replaced it.
+*
+* Idempotency: blobs are immutable (a tool result never changes), so we write
+* `<callId>.txt` only when it's absent and otherwise just rebuild the
+* byte-stable stub. The session keeps the original content; only the wire copy
+* carries the stub — consistent with compaction being wire-only. Returns the
+* messages with the lossy stubs swapped; unchanged when nothing was persisted.
+*/
+async function persistElidedToolResults(messages, items, opts) {
+	if (items.length === 0 || !isAbsolute(opts.persistDir)) return messages;
+	const stubByCallId = /* @__PURE__ */ new Map();
+	let wroteAny = false;
+	for (const item of items) {
+		if (!SAFE_CALL_ID.test(item.callId) || item.callId.includes("..")) continue;
+		const persistedPath = join(opts.persistDir, `${item.callId}.txt`);
+		let exists = false;
+		try {
+			exists = (await stat(persistedPath)).isFile();
+		} catch {
+			exists = false;
+		}
+		if (!exists) try {
+			await writeAtomic(persistedPath, item.output);
+			wroteAny = true;
+		} catch {
+			continue;
+		}
+		stubByCallId.set(item.callId, buildPersistedStub({
+			toolName: item.toolName,
+			originalBytes: toolOutputByteLength(item.output),
+			persistedPath,
+			output: item.output,
+			previewBytes: ELIDE_PERSIST_PREVIEW_BYTES
+		}));
+	}
+	if (wroteAny && typeof opts.maxBytes === "number" && Number.isFinite(opts.maxBytes) && opts.maxBytes > 0) await enforcePersistDirCap(opts.persistDir, opts.maxBytes);
+	if (stubByCallId.size === 0) return messages;
+	return messages.map((msg) => {
+		if (!msg.content.some((b) => b.type === "tool_result" && stubByCallId.has(b.callId))) return msg;
+		return {
+			...msg,
+			content: msg.content.map((b) => b.type === "tool_result" && stubByCallId.has(b.callId) ? {
+				...b,
+				output: stubByCallId.get(b.callId)
+			} : b)
+		};
+	});
+}
+/**
+* Write-then-rename for atomicity — delegates to the shared
+* {@link writeFileAtomicAsync} helper (unique pid+counter tmp suffix,
+* fsync before rename, tmp cleanup on failure). Creates the parent
+* directory on demand so the caller doesn't have to track which
+* sessions have already initialized their dir.
 */
 async function writeAtomic(path, content) {
-	await mkdir(dirname(path), { recursive: true });
-	const tmp = `${path}.tmp`;
-	try {
-		await writeFile(tmp, content, "utf8");
-		await rename(tmp, path);
-	} catch (err) {
-		await rm(tmp, { force: true }).catch(() => {});
-		throw err;
-	}
+	await writeFileAtomicAsync(path, content, { ensureDir: true });
 }
 /**
 * Take the first `cap` bytes of `text` without splitting a UTF-8
@@ -2125,6 +2180,25 @@ const SHELL_CASCADE_CANCEL_MESSAGE = "Cancelled: a sibling `shell` call in the s
 */
 const CANCELLED_BY_USER_SENTINEL = "zidane:tool:cancelled-by-user";
 /**
+* Grace window after a run-level abort before we force-settle a tool body that
+* hasn't returned. Well-behaved tools observe `childSignal` and finalize their
+* own bookkeeping (e.g. `spawn` awaits its child's session-persisting `finally`
+* block); they settle within this window and the forced rejection never fires.
+* Only a body that *ignores* its signal hits the timeout — that's the wedge we
+* guard against. Kept short so a real wedge doesn't stall `drain()` for long,
+* but long enough for a normal abort-driven cleanup to complete.
+*
+* Overridable via `ZIDANE_RUN_ABORT_GRACE_MS` (internal/testing only — lets
+* the wedge test exercise the forced-rejection path without a multi-second
+* real wait). Read per-use (not memoized) so tests can set it; falls back to
+* the 2s default on any non-finite value.
+*/
+const DEFAULT_RUN_ABORT_GRACE_MS = 2e3;
+function runAbortGraceMs() {
+	const raw = Number(process.env.ZIDANE_RUN_ABORT_GRACE_MS);
+	return Number.isFinite(raw) && raw >= 0 ? raw : DEFAULT_RUN_ABORT_GRACE_MS;
+}
+/**
 * Compute the effective thinking budget for a given run-relative turn, given
 * the configured decay schedule. Pure helper — exported for tests and so
 * downstream tooling can preview decay curves without spinning up the loop.
@@ -2272,32 +2346,56 @@ function applyCompactSummaryCutoff(turns) {
 * alone — those are consumer-controlled and the consumer is responsible for
 * matching prompt parts to the provider's capabilities.
 */
-const COMPACTION_STUB = "[…elided by client-side tail compaction; ask the user or re-run the tool to retrieve.]";
+const COMPACTION_STUB = "[…elided: older tool output trimmed to fit the context budget.]";
 const COMPACTION_STUB_BYTES = toolOutputByteLength(COMPACTION_STUB);
-/**
-* Tail-compaction for non-Anthropic providers: when the cumulative byte size
-* of `tool_result` content across the wire-level message list exceeds
-* `threshold`, replace older `tool_result` outputs with a short stub. The
-* newest `keepTurns` messages (user/assistant alike) are left untouched so
-* the model retains the freshest tool context.
-*
-* Only `tool_result` blocks are touched — text and image blocks pass through
-* unchanged. Mutates a shallow-cloned message array; original `messages` is
-* not modified.
-*
-* For Anthropic users, prefer the server-side `context-management-2025-06-27`
-* beta (token-accurate, no client-side approximation). This function is the
-* client-side fallback for OpenAI-compatible / OpenRouter / Cerebras runs
-* against OSS models that lack a server-side equivalent.
-*/
-function applyTailCompaction(messages, threshold, keepTurns) {
-	if (messages.length === 0) return messages;
+const COMPACT_CHUNK_TURNS = 8;
+function applyTailCompaction(messages, threshold, keepTurns, options) {
+	const elidedReadPaths = [];
+	const persistableElided = [];
+	const toolNameByCallId = options?.toolNameByCallId;
+	const persistElideMinBytes = options?.persistElideMinBytes ?? 0;
+	if (messages.length === 0) return {
+		messages,
+		elidedReadPaths,
+		persistableElided
+	};
 	let totalBytes = 0;
 	for (const msg of messages) for (const block of msg.content) if (block.type === "tool_result") totalBytes += toolOutputByteLength(block.output);
-	if (totalBytes <= threshold) return messages;
+	if (totalBytes <= threshold) return {
+		messages,
+		elidedReadPaths,
+		persistableElided
+	};
 	const keep = Math.max(0, keepTurns);
-	const cutoff = messages.length - keep;
-	if (cutoff <= 0) return messages;
+	const floorCutoff = messages.length - keep;
+	if (floorCutoff <= 0) return {
+		messages,
+		elidedReadPaths,
+		persistableElided
+	};
+	let keptBytes = 0;
+	let budgetCutoff = floorCutoff;
+	for (let i = messages.length - 1; i >= 0; i--) {
+		for (const block of messages[i].content) if (block.type === "tool_result") keptBytes += toolOutputByteLength(block.output);
+		if (keptBytes > threshold) {
+			budgetCutoff = i + 1;
+			break;
+		}
+	}
+	const rawCutoff = Math.min(budgetCutoff, floorCutoff);
+	if (rawCutoff <= 0) return {
+		messages,
+		elidedReadPaths,
+		persistableElided
+	};
+	const chunk = Math.max(1, options?.chunkTurns ?? 1);
+	const cutoff = Math.floor(rawCutoff / chunk) * chunk;
+	if (cutoff <= 0) return {
+		messages,
+		elidedReadPaths,
+		persistableElided
+	};
+	const readPathByCallId = options?.readPathByCallId;
 	let changed = false;
 	const out = messages.slice();
 	for (let i = 0; i < cutoff; i++) {
@@ -2305,10 +2403,18 @@ function applyTailCompaction(messages, threshold, keepTurns) {
 		let msgChanged = false;
 		const newContent = msg.content.map((block) => {
 			if (block.type !== "tool_result") return block;
-			if (toolOutputByteLength(block.output) <= COMPACTION_STUB_BYTES) return block;
+			const existingBytes = toolOutputByteLength(block.output);
+			if (existingBytes <= COMPACTION_STUB_BYTES) return block;
 			if (typeof block.output === "string" && block.output.startsWith("<persisted-output tool=\"")) return block;
 			msgChanged = true;
 			changed = true;
+			const readPath = readPathByCallId?.get(block.callId);
+			if (readPath !== void 0) elidedReadPaths.push(readPath);
+			else if (persistElideMinBytes > 0 && typeof block.output === "string" && existingBytes > persistElideMinBytes) persistableElided.push({
+				callId: block.callId,
+				toolName: toolNameByCallId?.get(block.callId) ?? "tool",
+				output: block.output
+			});
 			return {
 				...block,
 				output: COMPACTION_STUB
@@ -2319,7 +2425,34 @@ function applyTailCompaction(messages, threshold, keepTurns) {
 			content: newContent
 		};
 	}
-	return changed ? out : messages;
+	return {
+		messages: changed ? out : messages,
+		elidedReadPaths,
+		persistableElided
+	};
+}
+/**
+* Build a call_id → file path map for `read_file` tool calls in `messages`.
+* Tail compaction uses it to learn which stubbed `tool_result`s were file
+* reads, so their read-state dedup can be invalidated. Resolve this from the
+* canonical, pre-alias history — call_ids are stable across the alias rewrite,
+* so the map still keys the wire-level `tool_result` blocks.
+*/
+function collectCallMaps(messages) {
+	const readPathByCallId = /* @__PURE__ */ new Map();
+	const toolNameByCallId = /* @__PURE__ */ new Map();
+	for (const msg of messages) for (const block of msg.content) {
+		if (block.type !== "tool_call") continue;
+		toolNameByCallId.set(block.id, block.name);
+		if (block.name === "read_file") {
+			const path = block.input.path;
+			if (typeof path === "string" && path.length > 0) readPathByCallId.set(block.id, path);
+		}
+	}
+	return {
+		readPathByCallId,
+		toolNameByCallId
+	};
 }
 /**
 * Replace `read_file` `tool_result` blocks with a short stub when a later
@@ -2338,7 +2471,7 @@ function applyTailCompaction(messages, threshold, keepTurns) {
 * Pure function, exported for tests and so downstream tooling can preview
 * elision without spinning up the loop.
 */
-const STALE_READ_STUB = "[…elided: file edited later in this run; re-read if still needed.]";
+const STALE_READ_STUB = "[…elided: this file was edited later in the run, so this earlier read is stale.]";
 function applyStaleReadElision(messages) {
 	if (messages.length === 0) return {
 		messages,
@@ -2394,7 +2527,7 @@ function applyStaleReadElision(messages) {
 		let msgChanged = false;
 		const newContent = msg.content.map((block) => {
 			if (block.type !== "tool_result" || !staleCallIds.has(block.callId)) return block;
-			if (block.output === "[…elided: file edited later in this run; re-read if still needed.]") return block;
+			if (block.output === "[…elided: this file was edited later in the run, so this earlier read is stale.]") return block;
 			if (typeof block.output === "string" && block.output.startsWith("<persisted-output tool=\"")) return block;
 			msgChanged = true;
 			changed = true;
@@ -2473,10 +2606,10 @@ function applyPairingRepair(ctx, messages, turnId) {
 		...ctx.providerName ? { provider: ctx.providerName } : {},
 		repairs
 	});
-	for (const repair of repairs) ctx.hooks.callHook("pairing:repair", {
+	for (const repair of repairs) Promise.resolve(ctx.hooks.callHook("pairing:repair", {
 		...repair,
 		turnId
-	});
+	})).catch(() => {});
 	return repaired;
 }
 function sanitizeStoredToolResults(provider, messages) {
@@ -3001,7 +3134,19 @@ async function executeTurn(ctx, turn, priorUsage) {
 	if (ctx.compactStrategy === "tail") {
 		const threshold = typeof ctx.compactThreshold === "number" && ctx.compactThreshold > 0 ? ctx.compactThreshold : 131072;
 		const keep = typeof ctx.compactKeepTurns === "number" && ctx.compactKeepTurns >= 0 ? ctx.compactKeepTurns : 4;
-		sanitizedMessages = applyTailCompaction(sanitizedMessages, threshold, keep);
+		const { readPathByCallId, toolNameByCallId } = collectCallMaps(canonicalMessages);
+		const compacted = applyTailCompaction(sanitizedMessages, threshold, keep, {
+			readPathByCallId,
+			toolNameByCallId,
+			chunkTurns: COMPACT_CHUNK_TURNS,
+			persistElideMinBytes: ctx.persistDir ? PERSISTENCE_PREVIEW_BYTES : 0
+		});
+		sanitizedMessages = compacted.messages;
+		markReadStateForElidedPaths(ctx, ctx.handle.cwd, compacted.elidedReadPaths);
+		if (ctx.persistDir && compacted.persistableElided.length > 0) sanitizedMessages = await persistElidedToolResults(sanitizedMessages, compacted.persistableElided, {
+			persistDir: ctx.persistDir,
+			maxBytes: ctx.persistMaxBytes
+		});
 	} else if (typeof ctx.compactStrategy === "function") {
 		const threshold = typeof ctx.compactThreshold === "number" && ctx.compactThreshold > 0 ? ctx.compactThreshold : 131072;
 		const keep = typeof ctx.compactKeepTurns === "number" && ctx.compactKeepTurns >= 0 ? ctx.compactKeepTurns : 4;
@@ -3207,12 +3352,12 @@ async function executeTurn(ctx, turn, priorUsage) {
 		if (reminted.reminted.length > 0) {
 			canonicalToolCalls = reminted.toolCalls;
 			canonicalContent = reminted.content;
-			for (const r of reminted.reminted) ctx.hooks.callHook("pairing:repair", {
+			for (const r of reminted.reminted) Promise.resolve(ctx.hooks.callHook("pairing:repair", {
 				mode: "duplicate-tool-use-remint",
 				callId: r.oldId,
 				messageIndex: ctx.turns.length,
 				turnId
-			});
+			})).catch(() => {});
 		}
 	}
 	if (turnTtftMs !== void 0 && result.usage.timeToFirstTokenMs === void 0) result.usage.timeToFirstTokenMs = turnTtftMs;
@@ -3582,10 +3727,31 @@ async function runSingleToolDispatch(ctx, call, turnId, fixed) {
 			perCallAbort.signal.addEventListener("abort", onAbort, { once: true });
 			removeAbortListener = () => perCallAbort.signal.removeEventListener("abort", onAbort);
 		});
+		let removeRunAbortListener;
+		let runAbortTimer;
+		const runAbortPromise = new Promise((_, reject) => {
+			const forceReject = () => reject(new DOMException("Aborted", "AbortError"));
+			const armGrace = () => {
+				runAbortTimer = setTimeout(forceReject, runAbortGraceMs());
+				runAbortTimer.unref?.();
+			};
+			if (ctx.signal.aborted) {
+				armGrace();
+				return;
+			}
+			ctx.signal.addEventListener("abort", armGrace, { once: true });
+			removeRunAbortListener = () => ctx.signal.removeEventListener("abort", armGrace);
+		});
 		try {
-			output = await Promise.race([bodyPromise, cancellationPromise]);
+			output = await Promise.race([
+				bodyPromise,
+				cancellationPromise,
+				runAbortPromise
+			]);
 		} finally {
 			removeAbortListener?.();
+			removeRunAbortListener?.();
+			if (runAbortTimer !== void 0) clearTimeout(runAbortTimer);
 		}
 	} catch (err) {
 		const isOurSentinel = err instanceof Error && err.message === CANCELLED_BY_USER_SENTINEL;
@@ -4419,13 +4585,43 @@ function buildPromptMessage(provider, parts) {
 const DEFAULT_BLOCK_THRESHOLD = 4;
 const DEFAULT_ABORT_THRESHOLD = 8;
 /**
-* Default tracked-tool predicate: `shell` exactly, plus any tool whose
-* canonical name ends in `_execute_sql` (the MCP SQL-runner shape,
-* `mcp_<server>_execute_sql`). Both are auto-approved, side-effect-light
-* retry magnets — the exact loop shapes the abort escalation exists for.
+* Tools watched in sliding-window mode even without an explicit `windowSize`.
+* A re-read loop cycles through a handful of slices of the same file (offset
+* 1 → 52 → 199 → 1 …), so consecutive-streak counting — which resets on every
+* changed offset — never trips. Exact-payload keying in a window catches the
+* revisited slice while leaving linear chunked reads (distinct slices, never
+* repeated) untouched. Other tracked tools (shell, SQL) keep streak mode.
+*/
+const READ_LOOP_TOOLS = new Set(["read_file"]);
+/**
+* Default window for {@link READ_LOOP_TOOLS} when the consumer sets no global
+* `windowSize`. Sized so a short revisit cycle still reaches the abort
+* threshold: a 3-slice cycle fills a 24-call window with 8 occurrences of each
+* slice.
+*/
+const DEFAULT_READ_LOOP_WINDOW = 24;
+/**
+* Universal repeat ceiling: the last-resort loop breaker. Independent of the
+* tracked-tool set, it counts exact `(tool, args)` repeats across EVERY tool —
+* catching loops the per-tool streak/window misses (a `grep`/`glob`/`edit`
+* cycle, or a model hammering a tool that keeps getting blocked). Set high
+* enough that legitimate identical repeats (a handful of retries) don't trip,
+* but a genuine spin does.
+*/
+const DEFAULT_GLOBAL_CEILING = 12;
+/** Sliding window (per run+tool) the global ceiling counts repeats within. */
+const DEFAULT_GLOBAL_CEILING_WINDOW = 40;
+/**
+* Default tracked-tool predicate: the built-in `shell` and `read_file` tools.
+* `shell` is an auto-approved, side-effect-light retry magnet; `read_file` is
+* the re-read loop magnet — a compaction/dedup interaction can strand the
+* model re-reading one file forever (see {@link READ_LOOP_TOOLS}). Both are the
+* loop shapes the abort escalation exists for. Consumers that want to track
+* additional tools (e.g. an MCP query runner) pass them via
+* {@link RepeatGuardConfig.tools}.
 */
 function defaultRepeatGuardTracked(name) {
-	return name === "shell" || name.endsWith("_execute_sql");
+	return name === "shell" || name === "read_file";
 }
 function compileMatchers(tools) {
 	if (tools === void 0) return defaultRepeatGuardTracked;
@@ -4471,10 +4667,12 @@ function normalizeShellCommand(command) {
 }
 /**
 * Built-in normalizer used when the consumer doesn't supply one. Shell-shaped
-* tools get {@link normalizeShellCommand}; SQL-runner tools get a whitespace-
-* collapsed query; everything else falls back to a stable JSON encoding.
-* Returns `undefined` when there's no meaningful payload to key on (so the
-* call is excluded from streak tracking rather than keyed on `'{}'`).
+* tools get {@link normalizeShellCommand}; everything else falls back to a
+* stable JSON encoding. Returns `undefined` when there's no meaningful payload
+* to key on (so the call is excluded from streak tracking rather than keyed on
+* `'{}'`). Consumers needing semantic keying for their own tools (e.g.
+* collapsing a query's whitespace) supply a normalizer via
+* {@link RepeatGuardConfig.normalize}.
 */
 function defaultRepeatGuardNormalize(name, input) {
 	if (name === "shell") {
@@ -4482,11 +4680,6 @@ function defaultRepeatGuardNormalize(name, input) {
 		if (typeof cmd !== "string" || cmd.trim().length === 0) return void 0;
 		return `shell:${normalizeShellCommand(cmd)}`;
 	}
-	if (name.endsWith("_execute_sql")) {
-		const q = input.query ?? input.sql ?? input.statement;
-		if (typeof q !== "string" || q.trim().length === 0) return void 0;
-		return `sql:${q.replace(/\s+/g, " ").trim().toLowerCase()}`;
-	}
 	try {
 		return `json:${stableStringify(input)}`;
 	} catch {
@@ -4528,6 +4721,7 @@ function formatBlockReason(reason, name, count) {
 function installRepeatGuard(hooks, getConfig, abort) {
 	const streaks = /* @__PURE__ */ new Map();
 	const windows = /* @__PURE__ */ new Map();
+	const globalWindows = /* @__PURE__ */ new Map();
 	function streakKey(runId, name) {
 		return `${runId ?? "-"}::${name}`;
 	}
@@ -4540,20 +4734,60 @@ function installRepeatGuard(hooks, getConfig, abort) {
 			const reachable = Number.isFinite(abortThreshold) ? abortThreshold : blockThreshold;
 			windowSize = Math.max(Math.floor(config.windowSize), reachable);
 		}
+		const rawGlobalCeiling = typeof config.globalCeiling === "number" && Number.isFinite(config.globalCeiling) ? Math.floor(config.globalCeiling) : DEFAULT_GLOBAL_CEILING;
+		const globalCeiling = rawGlobalCeiling > 0 && Number.isFinite(abortThreshold) ? Math.max(2, rawGlobalCeiling, abortThreshold) : 0;
+		const globalWindow = Math.max(globalCeiling, typeof config.globalCeilingWindow === "number" && Number.isFinite(config.globalCeilingWindow) ? Math.floor(config.globalCeilingWindow) : DEFAULT_GLOBAL_CEILING_WINDOW);
+		const isGloballyExcluded = config.globalCeilingExclude === void 0 ? () => false : compileMatchers(config.globalCeilingExclude);
 		return {
 			isTracked: compileMatchers(config.tools),
 			normalize: config.normalize ?? defaultRepeatGuardNormalize,
 			blockThreshold,
 			abortThreshold,
 			countBlockedCalls: config.countBlockedCalls === true,
-			windowSize
+			windowSize,
+			globalCeiling,
+			globalWindow,
+			isGloballyExcluded
 		};
 	}
 	async function gateHandler(ctx) {
 		if (ctx.result !== void 0) return;
 		const config = getConfig();
 		if (!config) return;
-		const { isTracked, normalize, blockThreshold, abortThreshold, countBlockedCalls, windowSize } = resolve(config);
+		const resolved = resolve(config);
+		const { isTracked, normalize, blockThreshold, abortThreshold, countBlockedCalls, windowSize } = resolved;
+		if (resolved.globalCeiling > 0 && !resolved.isGloballyExcluded(ctx.name)) {
+			let gkey;
+			try {
+				gkey = `${ctx.name}\u0000${stableStringify(ctx.input)}`;
+			} catch {
+				gkey = "";
+			}
+			if (gkey.length > 0) {
+				const gslot = streakKey(ctx.runId, ctx.name);
+				const recent = globalWindows.get(gslot) ?? [];
+				recent.push(gkey);
+				if (recent.length > resolved.globalWindow) recent.shift();
+				globalWindows.set(gslot, recent);
+				let gcount = 0;
+				for (const k of recent) if (k === gkey) gcount++;
+				if (gcount >= resolved.globalCeiling) {
+					if (!ctx.block) {
+						ctx.block = true;
+						ctx.reason = formatBlockReason(config.blockReason, ctx.name, gcount);
+					}
+					await hooks.callHook("repeat-guard:exceeded", {
+						tool: ctx.name,
+						count: gcount,
+						threshold: resolved.globalCeiling,
+						turnId: ctx.turnId,
+						action: "abort"
+					});
+					abort();
+					return;
+				}
+			}
+		}
 		if (!isTracked(ctx.name)) return;
 		if (ctx.block && !countBlockedCalls) return;
 		let key;
@@ -4565,11 +4799,12 @@ function installRepeatGuard(hooks, getConfig, abort) {
 		if (typeof key !== "string" || key.length === 0) return;
 		const blockedByPriorGate = ctx.block;
 		const slot = streakKey(ctx.runId, ctx.name);
+		const effectiveWindow = windowSize ?? (READ_LOOP_TOOLS.has(ctx.name) ? Math.max(DEFAULT_READ_LOOP_WINDOW, Number.isFinite(abortThreshold) ? abortThreshold : DEFAULT_READ_LOOP_WINDOW) : void 0);
 		let count;
-		if (windowSize !== void 0) {
+		if (effectiveWindow !== void 0) {
 			const recent = windows.get(slot) ?? [];
 			recent.push(key);
-			if (recent.length > windowSize) recent.shift();
+			if (recent.length > effectiveWindow) recent.shift();
 			windows.set(slot, recent);
 			count = 0;
 			for (const k of recent) if (k === key) count++;
@@ -4613,6 +4848,7 @@ function installRepeatGuard(hooks, getConfig, abort) {
 		unregister();
 		streaks.clear();
 		windows.clear();
+		globalWindows.clear();
 	};
 }
 //#endregion
@@ -5264,36 +5500,6 @@ function createSkillsReadTool(options) {
 	};
 }
 //#endregion
-//#region src/tools/shell-quote.ts
-/**
-* Shared shell-argument quoter for tool implementations.
-*
-* Single source of truth so `grep`, `binary-read`, and `skills-run-script`
-* don't drift on the POSIX `'\''` escape pattern.
-*/
-const SAFE_TOKEN_RE = /^[\w@%+=:,./-]+$/;
-const SINGLE_QUOTE_RE = /'/g;
-/**
-* Wrap an argument in single quotes, escaping embedded single quotes via the
-* standard POSIX `'\''` close-escape-reopen trick. Tokens that are already
-* shell-safe pass through unchanged so command lines stay readable in logs.
-*
-* NOT a sandbox — only safe when the caller controls the surrounding shell
-* context. Use it for arguments only, never for the verb / subcommand.
-*/
-function shellQuote(arg) {
-	if (SAFE_TOKEN_RE.test(arg)) return arg;
-	return `'${arg.replace(SINGLE_QUOTE_RE, "'\\''")}'`;
-}
-/**
-* Variant that always quotes — useful when the caller doesn't want a
-* conditional `unquoted-when-safe` branch (consistent log shape, paranoid
-* inputs that contain whitespace by construction).
-*/
-function alwaysQuote(arg) {
-	return `'${arg.replace(SINGLE_QUOTE_RE, "'\\''")}'`;
-}
-//#endregion
 //#region src/tools/skills-run-script.ts
 const ABS_WINDOWS_RE = /^[a-z]:[\\/]/i;
 const COLLAPSE_SLASHES_RE = /\/+/g;
@@ -5441,7 +5647,15 @@ function createSkillsUseTool(options) {
 				if (!skill.instructions.includes("!`")) body = skill.instructions;
 				else if (options.allowShellInterpolation !== false) {
 					const failures = [];
-					body = await interpolateShellCommands(skill.instructions, ctx.execution, ctx.handle, { onFailure: (command) => failures.push(command) });
+					const approve = options.approveShellInterpolation;
+					body = await interpolateShellCommands(skill.instructions, ctx.execution, ctx.handle, {
+						onFailure: (command) => failures.push(command),
+						...approve ? { approve: (command) => approve({
+							skillName,
+							source: skill.source,
+							command
+						}) } : {}
+					});
 					if (failures.length > 0) body += `\n\nWarning: ${failures.length} shell interpolation command${failures.length === 1 ? "" : "s"} failed during activation (${failures.map((c) => `\`${c}\``).join(", ")}). The instructions above may be missing dynamic content — see the inline [command failed …] markers.`;
 				} else body = stripShellInterpolations(skill.instructions);
 				interpolatedBodyCache.set(skillName, body);
@@ -6227,7 +6441,7 @@ function installLazyDisclosureGate(hooks, lazyCanonicalNames, unlocked, discover
 *
 *     # MCP Server Instructions
 *
-*     ## supabase
+*     ## acme
 *     The project is provisioned. Use `apply_migration` directly.
 *
 *     ## linear
@@ -6273,12 +6487,12 @@ function childRunIdSet(session) {
 * Throws on an unrecoverable resume request; otherwise returns the filtered
 * turns (or `undefined` when the session has no turns).
 */
-function validateAndPrepareResume(session, prompt) {
+function validateAndPrepareResume(session, prompt, hasPendingTaskNotifications = false) {
 	const hasSessionTurns = !!session && session.turns.length > 0;
-	if (!prompt && !hasSessionTurns) throw new Error("prompt is required when no session with existing turns is provided");
+	if (!prompt && !hasSessionTurns && !hasPendingTaskNotifications) throw new Error("prompt is required when no session with existing turns is provided");
 	let resumeFilteredTurns;
 	if (hasSessionTurns) resumeFilteredTurns = filterUnresolvedToolUses(session.turns);
-	if (!prompt && resumeFilteredTurns) {
+	if (!prompt && resumeFilteredTurns && !hasPendingTaskNotifications) {
 		const lastTurn = resumeFilteredTurns.at(-1);
 		if (lastTurn && lastTurn.role !== "user") {
 			const detail = detectTurnInterruption(resumeFilteredTurns) === "completed" ? "last turn is a completed assistant message" : "last turn is mid-stream assistant content";
@@ -6386,7 +6600,7 @@ function createAgent({ provider, name: agentName, system: agentSystem, tools: ag
 	const skillActivationState = createSkillActivationState({ maxActive: skillsConfig?.maxActive });
 	async function run(options) {
 		if (running) throw new Error("Agent is already running. Use steer() or followUp() to queue messages, or waitForIdle().");
-		const resumeFilteredTurns = validateAndPrepareResume(session, options.prompt);
+		const resumeFilteredTurns = validateAndPrepareResume(session, options.prompt, pendingTaskNotifications.size > 0);
 		const clock = options.clock ?? agentClock ?? DEFAULT_AGENT_CLOCK;
 		let externalAbortListener;
 		const externalSignal = options.signal;
@@ -6472,6 +6686,7 @@ function createAgent({ provider, name: agentName, system: agentSystem, tools: ag
 			const thinking = options.thinking ?? "off";
 			const model = options.model ?? provider.meta.defaultModel;
 			const resolvedBehavior = resolveBehavior(agentBehavior, options.behavior);
+			if (provider.meta?.clearsContextServerSide) resolvedBehavior.dedupReads = false;
 			const { maxConcurrentTools, toolBatchExecutor, shouldRethrowToolError, maxTurns, maxTurnsWarning, maxCostUsd, maxTotalTokens, maxWallMs, maxTokens, retry, thinkingBudget, modelOptions: behaviorModelOptions, schema, cache, toolOutputBudget, toolOutputBudgetExcludeTools, compactStrategy, compactThreshold, compactKeepTurns, thinkingDecay, dedupTools, toolBudgets, repeatGuard, elideStaleReads, toolDisclosure, mcpToolNameSeparator, toolSearch, surfaceMcpInstructions, persistThreshold, persistExcludeTools, persistDir, persistMaxBytes, strictToolPairing, maxPairingRepairsPerTurn, maxConsecutivePauseTurns, persistTurns } = resolvedBehavior;
 			const modelOptions = options.modelOptions ?? behaviorModelOptions;
 			let system = options.system || agentSystem || "You are a helpful assistant.";
@@ -6492,7 +6707,8 @@ function createAgent({ provider, name: agentName, system: agentSystem, tools: ag
 					catalog: resolvedSkills,
 					state: skillActivationState,
 					hooks,
-					allowShellInterpolation: skillsConfig?.allowShellInterpolation
+					allowShellInterpolation: skillsConfig?.allowShellInterpolation,
+					approveShellInterpolation: skillsConfig?.approveShellInterpolation
 				}),
 				skills_read: createSkillsReadTool({
 					catalog: resolvedSkills,
@@ -7309,6 +7525,9 @@ function createAgent({ provider, name: agentName, system: agentSystem, tools: ag
 		abort,
 		cancelTool,
 		killBackgroundTask,
+		get hasPendingTaskNotifications() {
+			return pendingTaskNotifications.size > 0;
+		},
 		steer,
 		followUp: followUpFn,
 		waitForIdle,
@@ -8254,7 +8473,7 @@ const readFile$1 = {
 			const prior = readState.get(absKey);
 			if (prior && prior.contentHash === currentHash && prior.offset === offsetForKey && prior.limit === limitForKey && prior.maxBytes === maxBytesForKey && prior.lineNumbers === showLineNumbers && prior.elided !== true) {
 				rememberRead();
-				return `File ${path} unchanged since the previous read in this session — the prior result is still current. If that output is no longer visible in your context (e.g. it was compacted away), re-read with a different offset/limit or lineNumbers value to get the full contents again.`;
+				return `File ${path} unchanged since the previous read in this session — the prior result above is still current, so this duplicate read was skipped to save tokens.`;
 			}
 		}
 		if (looksBinary(raw)) return `[binary file: ${path}, ${totalBytes} bytes; use shell with hexdump | xxd | od to inspect]`;
@@ -8782,7 +9001,7 @@ function createSpawnTool(options = {}) {
 					const childHandle = agent.handle;
 					if (childHandle && ctx.execution.reassignBackgroundTasks) try {
 						const reassigned = await ctx.execution.reassignBackgroundTasks(childHandle, ctx.handle, (info) => {
-							ctx.hooks.callHook("background:exit", info);
+							Promise.resolve(ctx.hooks.callHook("background:exit", info)).catch(() => {});
 						});
 						for (const entry of reassigned) await ctx.hooks.callHook("background:reassign", {
 							taskId: entry.taskId,
@@ -8903,6 +9122,6 @@ const writeFile$1 = {
 	}
 };
 //#endregion
-export { piIdOf as $, PERSISTED_STUB_PREFIX as A, anthropicDescriptor as B, normalizeShellCommand as C, TOOL_USE_CANCELLED_MESSAGE as D, SHELL_CASCADE_CANCEL_MESSAGE as E, resolveMcpWarningsDir as F, getContextWindow as G, credKeyOf as H, resolvePersistDir as I, modelOptionsFor as J, getModelInfo as K, resolveTasksDir as L, buildPersistedStub as M, cleanupPersistedSession as N, TOOL_USE_SKIPPED_MESSAGE as O, maybePersistToolResult as P, openrouterDescriptor as Q, BUILTIN_PROVIDERS as R, defaultRepeatGuardTracked as S, INTERRUPT_MESSAGE_FOR_TOOL_USE as T, effectiveContextWindow as U, cerebrasDescriptor as V, enabledModelOptions as W, modelsForDescriptor as X, modelSupportsReasoning as Y, openaiDescriptor as Z, alwaysQuote as _, multiEdit as a, shell as b, grep as c, createAgent as d, restoreModelOptions as et, WAIT_TASK_TIMED_OUT_PREFIX as f, createSkillsRunScriptTool as g, createSkillsUseTool as h, readFile$1 as i, PERSISTENCE_PREVIEW_BYTES as j, validateToolArgs as k, glob$1 as l, createToolSearchTool as m, createSpawnTool as n, listFiles as o, waitTask as p, localDescriptor as q, shellKill as r, createInteractionTool as s, writeFile$1 as t, edit as u, createSkillsReadTool as v, stableStringify as w, defaultRepeatGuardNormalize as x, createShellTool as y, OUTPUT_RESERVE_TOKENS as z };
+export { restoreModelOptions as $, PERSISTENCE_PREVIEW_BYTES as A, cerebrasDescriptor as B, stableStringify as C, TOOL_USE_SKIPPED_MESSAGE as D, TOOL_USE_CANCELLED_MESSAGE as E, resolvePersistDir as F, getModelInfo as G, effectiveContextWindow as H, resolveTasksDir as I, modelSupportsReasoning as J, localDescriptor as K, BUILTIN_PROVIDERS as L, cleanupPersistedSession as M, maybePersistToolResult as N, validateToolArgs as O, resolveMcpWarningsDir as P, piIdOf as Q, OUTPUT_RESERVE_TOKENS as R, normalizeShellCommand as S, SHELL_CASCADE_CANCEL_MESSAGE as T, enabledModelOptions as U, credKeyOf as V, getContextWindow as W, openaiDescriptor as X, modelsForDescriptor as Y, openrouterDescriptor as Z, createSkillsReadTool as _, multiEdit as a, defaultRepeatGuardNormalize as b, grep as c, createAgent as d, WAIT_TASK_TIMED_OUT_PREFIX as f, createSkillsRunScriptTool as g, createSkillsUseTool as h, readFile$1 as i, buildPersistedStub as j, PERSISTED_STUB_PREFIX as k, glob$1 as l, createToolSearchTool as m, createSpawnTool as n, listFiles as o, waitTask as p, modelOptionsFor as q, shellKill as r, createInteractionTool as s, writeFile$1 as t, edit as u, createShellTool as v, INTERRUPT_MESSAGE_FOR_TOOL_USE as w, defaultRepeatGuardTracked as x, shell as y, anthropicDescriptor as z };
 
-//# sourceMappingURL=tools-NxnEmzYg.js.map
+//# sourceMappingURL=tools-ZHKOh44k.js.map