zidane 5.3.2 → 5.4.1

package/dist/{tools-CCsL5SCO.js → tools-PQH1Ge4M.js}

@@ -805,20 +805,13 @@ const IMAGE_OMITTED_MARKER = "[image omitted — model does not support vision]"
 const INTERRUPT_MESSAGE_FOR_TOOL_USE = "[Request interrupted by user for tool use]";
 /**
 * Canonical tool_result text emitted when a tool call is skipped because a
-* sibling sequential call errored or a steering message arrived between
-* iterations of {@link executeToolsSequential}. Distinguished from
-* {@link INTERRUPT_MESSAGE_FOR_TOOL_USE} so consumers can distinguish "user
+* steering message arrived between dispatches inside
+* {@link executeToolBatch}. Distinguished from
+* {@link INTERRUPT_MESSAGE_FOR_TOOL_USE} so consumers can split "user
 * cancelled" from "framework superseded".
 */
 const TOOL_USE_SKIPPED_MESSAGE = "[Tool use skipped — superseded by user message]";
 /**
-* Canonical tool_result text emitted when the loop catches a sequential
-* sibling that threw and synthesizes follow-up results for the remaining
-* queued calls. Distinct from {@link TOOL_USE_SKIPPED_MESSAGE} so telemetry
-* can split "skipped by user steering" from "skipped after error".
-*/
-const TOOL_USE_AFTER_ERROR_MESSAGE = "[Tool use skipped — previous tool call in batch threw]";
-/**
 * Compute the effective thinking budget for a given run-relative turn, given
 * the configured decay schedule. Pure helper — exported for tests and so
 * downstream tooling can preview decay curves without spinning up the loop.
@@ -1078,6 +1071,8 @@ function applyStaleReadElision(messages) {
 		messages,
 		elidedPaths: []
 	};
+	const pathsWithFreshRead = /* @__PURE__ */ new Set();
+	for (const [callId, info] of readCallInfo) if (!staleCallIds.has(callId)) pathsWithFreshRead.add(info.path);
 	let changed = false;
 	const out = messages.slice();
 	for (let i = 0; i < out.length; i++) {
@@ -1101,7 +1096,7 @@ function applyStaleReadElision(messages) {
 	}
 	return {
 		messages: changed ? out : messages,
-		elidedPaths: [...elidedPathSet]
+		elidedPaths: [...elidedPathSet].filter((p) => !pathsWithFreshRead.has(p))
 	};
 }
 /**
@@ -1518,7 +1513,7 @@ async function executeTurn(ctx, turn) {
 			usage: result.usage
 		};
 	}
-	const toolResults = ctx.toolExecution === "parallel" ? await executeToolsParallel(ctx, canonicalToolCalls, turnId) : await executeToolsSequential(ctx, canonicalToolCalls, turnId);
+	const toolResults = await executeToolBatch(ctx, canonicalToolCalls, turnId);
 	const toolResultMsg = ctx.provider.toolResultsMessage(toolResults);
 	const toolResultsTurn = {
 		id: await ctx.generateTurnId(),
@@ -1859,57 +1854,170 @@ async function emitToolResult(ctx, params) {
 		isError
 	};
 }
-async function executeToolsSequential(ctx, toolCalls, turnId) {
-	const results = [];
-	for (let i = 0; i < toolCalls.length; i++) {
-		const call = toolCalls[i];
-		if (ctx.signal.aborted) {
-			for (let j = i; j < toolCalls.length; j++) results.push({
-				id: toolCalls[j].id,
-				content: INTERRUPT_MESSAGE_FOR_TOOL_USE,
-				isError: true
-			});
-			return results;
-		}
-		if (ctx.steeringQueue.length > 0) {
-			for (let j = i; j < toolCalls.length; j++) results.push({
-				id: toolCalls[j].id,
-				content: TOOL_USE_SKIPPED_MESSAGE,
-				isError: true
-			});
-			return results;
-		}
-		try {
-			const { result } = await executeSingleTool(ctx, call, turnId);
-			results.push(result);
-		} catch (err) {
-			results.push({
-				id: call.id,
-				content: `Error: ${errorMessage(err)}`,
-				isError: true
-			});
-			for (let j = i + 1; j < toolCalls.length; j++) results.push({
-				id: toolCalls[j].id,
-				content: TOOL_USE_AFTER_ERROR_MESSAGE,
-				isError: true
-			});
-			return results;
-		}
+/** Default cap on in-flight tools per turn. Mirrors Claude Code's `CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY`. */
+const DEFAULT_MAX_CONCURRENT_TOOLS = 10;
+/** Canonical name of the shell tool — referenced for cascade-cancel semantics. */
+const SHELL_TOOL_NAME = "shell";
+/** Reason surfaced on `siblingAbort.signal` when a shell error cancels its fleet. */
+const SHELL_CASCADE_REASON = "sibling-shell-error";
+/**
+* Canonical `tool_result.content` text emitted to siblings that were
+* cancelled by a `shell` error in the same batch. Distinct from
+* {@link INTERRUPT_MESSAGE_FOR_TOOL_USE} (user-issued abort) and
+* {@link TOOL_USE_SKIPPED_MESSAGE} (steered) so consumers can split
+* the three causes by string-match.
+*/
+const SHELL_CASCADE_CANCEL_MESSAGE = "Cancelled: a sibling `shell` call in the same batch errored; re-run independently if still needed.";
+/**
+* Resolve a tool's concurrency-safety verdict for a specific call.
+*
+* - Missing toolDef (unknown tool) → `false`. `executeSingleTool` handles
+*   the unknown-tool path itself; barriering it keeps the unknown-tool
+*   error from racing with siblings.
+* - Static `true` / `false` → use as-is.
+* - Function → invoke; any throw is treated as `false` (fail-closed) so a
+*   buggy predicate can't accidentally widen the safety window.
+*
+* Pure / sync — pre-computed once per call before dispatch begins, so the
+* scheduler's hot path stays branch-light.
+*/
+function resolveConcurrencySafe(def, input) {
+	if (!def) return false;
+	const flag = def.isConcurrencySafe;
+	if (flag === void 0) return false;
+	if (typeof flag === "boolean") return flag;
+	try {
+		return flag(input) === true;
+	} catch {
+		return false;
 	}
-	return results;
 }
-async function executeToolsParallel(ctx, toolCalls, turnId) {
-	const executions = toolCalls.map((call) => executeSingleTool(ctx, call, turnId));
-	return (await Promise.allSettled(executions)).map((s, i) => {
-		if (s.status === "fulfilled") return s.value.result;
-		const reason = s.reason;
-		const isAbort = ctx.signal.aborted || reason instanceof Error && reason.name === "AbortError";
-		return {
-			id: toolCalls[i].id,
-			content: isAbort ? INTERRUPT_MESSAGE_FOR_TOOL_USE : `Error: ${reason instanceof Error ? reason.message : String(reason)}`,
+/**
+* Unified per-turn tool dispatcher.
+*
+* Walks `toolCalls` in submission order. For each call:
+*
+* - **Concurrency-safe + fleet is all safe + room under the cap** → fires
+*   asynchronously and the loop advances to the next call. The fleet runs
+*   in parallel up to `behavior.maxConcurrentTools` (default {@link
+*   DEFAULT_MAX_CONCURRENT_TOOLS}).
+* - **Unsafe** (or the in-flight fleet contains anything unsafe) → acts
+*   as a barrier: waits for the fleet to drain, then runs alone, then
+*   unblocks the queue.
+*
+* Results are written into a fixed `results[index]` array on completion
+* and yielded back in submission order, so the model sees deterministic
+* adjacency regardless of which call finished first.
+*
+* **Failure modes:**
+*
+* - **Hook throws / tool body throws** — captured per-call into a
+*   `tool_result` so the assistant turn's `tool_use` IDs always have
+*   matching `tool_result` IDs (providers reject orphan IDs).
+* - **Parent abort** mid-batch — drains the in-flight fleet (their
+*   `AbortError` becomes `INTERRUPT_MESSAGE_FOR_TOOL_USE`), then synthesizes
+*   interrupt results for any unstarted calls so the turn closes cleanly.
+* - **Steering queue populated** between dispatches — same drain + a
+*   `TOOL_USE_SKIPPED_MESSAGE` result for unstarted calls. The outer loop
+*   picks up the steer at the next checkpoint.
+* - **Shell error in a fleet** — `siblingAbort.abort('sibling-shell-error')`
+*   tears down concurrently-running siblings. Mirrors the convention that
+*   shell commands often chain (`mkdir foo && cd foo`); one failing
+*   sibling commonly invalidates the rest. Non-shell errors are isolated.
+*
+* A child `AbortController` (`siblingAbort`) forwards the parent abort
+* AND carries the shell-cascade signal — siblings see one signal source.
+*/
+async function executeToolBatch(ctx, toolCalls, turnId) {
+	if (toolCalls.length === 0) return [];
+	const N = toolCalls.length;
+	const maxConcurrent = Math.max(1, ctx.maxConcurrentTools ?? DEFAULT_MAX_CONCURRENT_TOOLS);
+	const results = Array.from({ length: N });
+	const safe = Array.from({ length: N });
+	for (let i = 0; i < N; i++) safe[i] = resolveConcurrencySafe(ctx.tools[toolCalls[i].name], toolCalls[i].input);
+	const siblingAbort = new AbortController();
+	let parentAbortListener;
+	if (ctx.signal.aborted) siblingAbort.abort(ctx.signal.reason ?? "parent-aborted");
+	else {
+		parentAbortListener = () => siblingAbort.abort(ctx.signal.reason ?? "parent-aborted");
+		ctx.signal.addEventListener("abort", parentAbortListener, { once: true });
+	}
+	const childCtx = {
+		...ctx,
+		signal: siblingAbort.signal
+	};
+	/** Indices currently in flight. Tracked for fleet-safety + cap checks. */
+	const inFlight = /* @__PURE__ */ new Map();
+	/**
+	* Distinguish a shell-cascade kill from a user-issued abort so the
+	* model sees actionable text. When BOTH the parent signal and the
+	* sibling signal are aborted, the parent wins — user-issued aborts
+	* take precedence (the model is being interrupted by the human, not
+	* by a sibling's failure).
+	*/
+	const cancelMessage = () => {
+		if (ctx.signal.aborted) return INTERRUPT_MESSAGE_FOR_TOOL_USE;
+		if (siblingAbort.signal.reason === SHELL_CASCADE_REASON) return SHELL_CASCADE_CANCEL_MESSAGE;
+		return INTERRUPT_MESSAGE_FOR_TOOL_USE;
+	};
+	const dispatch = (index) => {
+		const call = toolCalls[index];
+		return executeSingleTool(childCtx, call, turnId).then(({ result }) => {
+			results[index] = result;
+			if (result.isError && call.name === SHELL_TOOL_NAME && !siblingAbort.signal.aborted) siblingAbort.abort(SHELL_CASCADE_REASON);
+		}, (err) => {
+			const isAbort = siblingAbort.signal.aborted || ctx.signal.aborted || err instanceof Error && err.name === "AbortError";
+			results[index] = {
+				id: call.id,
+				content: isAbort ? cancelMessage() : `Error: ${errorMessage(err)}`,
+				isError: true
+			};
+		}).finally(() => {
+			inFlight.delete(index);
+		});
+	};
+	const drain = async () => {
+		if (inFlight.size > 0) await Promise.all([...inFlight.values()]);
+	};
+	/** Whether every in-flight call is concurrency-safe. */
+	const fleetAllSafe = () => {
+		for (const idx of inFlight.keys()) if (!safe[idx]) return false;
+		return true;
+	};
+	/**
+	* Fill all unstarted slots (`results[j]` still undefined) with the
+	* canonical text + `isError: true`. Used at every short-circuit
+	* branch (abort / steer) so the assistant turn's `tool_use` IDs
+	* always have matching `tool_result` IDs — providers reject orphan
+	* IDs loudly.
+	*/
+	const fillUnstarted = (from, content) => {
+		for (let j = from; j < N; j++) if (!results[j]) results[j] = {
+			id: toolCalls[j].id,
+			content,
 			isError: true
 		};
-	});
+	};
+	try {
+		for (let i = 0; i < N; i++) {
+			if (!safe[i] || !fleetAllSafe() || inFlight.size >= maxConcurrent) await drain();
+			if (ctx.signal.aborted) {
+				await drain();
+				fillUnstarted(i, INTERRUPT_MESSAGE_FOR_TOOL_USE);
+				return results;
+			}
+			if (ctx.steeringQueue.length > 0) {
+				await drain();
+				fillUnstarted(i, TOOL_USE_SKIPPED_MESSAGE);
+				return results;
+			}
+			inFlight.set(i, dispatch(i));
+		}
+		await drain();
+		return results;
+	} finally {
+		if (parentAbortListener) ctx.signal.removeEventListener("abort", parentAbortListener);
+	}
 }
 //#endregion
 //#region src/prompt.ts
@@ -2129,6 +2237,7 @@ function looksBinary(text, sniffBytes = SNIFF_BYTES) {
 function createSkillsReadTool(options) {
 	const byName = new Map(options.catalog.map((s) => [s.name, s]));
 	return {
+		isConcurrencySafe: true,
 		spec: {
 			name: "skills_read",
 			description: "Read a bundled resource file from an active skill. The skill must have been activated via skills_use first. Path is relative to the skill's directory (e.g. \"references/REFERENCE.md\", \"assets/template.txt\").",
@@ -2392,6 +2501,7 @@ function createToolSearchTool(options) {
 	}
 	const maxLimit = Math.max(options.catalog.length, 1);
 	return {
+		isConcurrencySafe: true,
 		spec: {
 			name: "tool_search",
 			description: "Discover and load schemas for additional tools listed in <searchable_tools>. Tools listed there are advertised by name + description only — their input schemas are not loaded into context until you surface them through this tool. Pass `query` for a substring search, `names` to load specific tools, or `server` to load every tool from one MCP server. Returned tools become callable for the rest of this run.",
@@ -2607,7 +2717,7 @@ async function synthesizeMissingToolResults(turns, syntheticTurnId, runId, provi
 }
 function resolveBehavior(agentBehavior, runBehavior) {
 	return {
-		toolExecution: runBehavior?.toolExecution ?? agentBehavior?.toolExecution ?? "parallel",
+		maxConcurrentTools: runBehavior?.maxConcurrentTools ?? agentBehavior?.maxConcurrentTools,
 		maxTurns: runBehavior?.maxTurns ?? agentBehavior?.maxTurns,
 		maxTokens: runBehavior?.maxTokens ?? agentBehavior?.maxTokens,
 		thinkingBudget: runBehavior?.thinkingBudget ?? agentBehavior?.thinkingBudget,
@@ -2917,7 +3027,7 @@ function createAgent({ provider, name: agentName, system: agentSystem, tools: ag
 			const thinking = options.thinking ?? "off";
 			const model = options.model ?? provider.meta.defaultModel;
 			const resolvedBehavior = resolveBehavior(agentBehavior, options.behavior);
-			const { toolExecution, maxTurns, maxTokens, thinkingBudget, schema, cache, toolOutputBudget, compactStrategy, compactThreshold, compactKeepTurns, thinkingDecay, dedupTools, toolBudgets, elideStaleReads, toolDisclosure, toolSearch, persistThreshold, persistExcludeTools, persistDir, strictToolPairing } = resolvedBehavior;
+			const { maxConcurrentTools, maxTurns, maxTokens, thinkingBudget, schema, cache, toolOutputBudget, compactStrategy, compactThreshold, compactKeepTurns, thinkingDecay, dedupTools, toolBudgets, elideStaleReads, toolDisclosure, toolSearch, persistThreshold, persistExcludeTools, persistDir, strictToolPairing } = resolvedBehavior;
 			let system = options.system || agentSystem || "You are a helpful assistant.";
 			if (skillsCatalog) system = `${system}\n\n${skillsCatalog}`;
 			const runBaseTools = options.tools !== void 0 ? options.tools : mcpConnection ? {
@@ -3080,7 +3190,7 @@ function createAgent({ provider, name: agentName, system: agentSystem, tools: ag
 					model,
 					system,
 					thinking,
-					toolExecution,
+					...maxConcurrentTools !== void 0 ? { maxConcurrentTools } : {},
 					signal: abortController.signal,
 					execution: executionContext,
 					handle: executionHandle,
@@ -3662,7 +3772,7 @@ const edit = {
 			if (readState) {
 				const absKey = readStateKey(ctx.handle.cwd, target);
 				const prior = readState.get(absKey);
-				if (!prior) return `Edit error: ${target} has not been read in this session. Call read_file first so the edit applies against the current contents. (Reads inside a \`spawn\` subagent with \`persist: false\` and without \`shareReadState: true\` do NOT propagate to the parent — re-read in the calling context.)`;
+				if (!prior) return `Edit error: ${target} has not been read in this session. Call read_file first so the edit applies against the current contents.`;
 				if (prior.contentHash !== hashContent(original)) return `Edit error: ${target} has changed on disk since the last read. Re-read the file before editing.`;
 			}
 		}
@@ -3760,6 +3870,7 @@ async function globViaShell(pattern, ctx, limit) {
 	return result.stdout.split("\n").filter((line) => line.length > 0);
 }
 const glob = {
+	isConcurrencySafe: true,
 	spec: {
 		name: "glob",
 		description: "Match files by glob pattern (supports **, *, ?). Relative to the execution context cwd. By default each row is `<path>\\t<size-bytes>\\t<mtime-iso>`; set `metadata: false` for a plain newline-separated list of paths. Always sorted.",
@@ -3825,6 +3936,7 @@ const glob = {
 const DEFAULT_HEAD_LIMIT = 250;
 const DEFAULT_OUTPUT_MODE = "files_with_matches";
 const grep = {
+	isConcurrencySafe: true,
 	spec: {
 		name: "grep",
 		description: "Search file contents by regex. Returns matching paths (default), match content, or per-file counts. Backed by ripgrep when available with a Bun.Glob fallback for in-process runs.",
@@ -4060,6 +4172,7 @@ function createInteractionTool(options) {
 //#endregion
 //#region src/tools/list-files.ts
 const listFiles = {
+	isConcurrencySafe: true,
 	spec: {
 		name: "list_files",
 		description: "List files and directories at the given path (relative to project root).",
@@ -4082,10 +4195,33 @@ const listFiles = {
 };
 //#endregion
 //#region src/tools/multi-edit.ts
+/**
+* Inline annotation builder — kept local to avoid importing from
+* `chat/edit-approval.ts` (that's a renderer-side module; tools live
+* one layer below). Line shape matches `parseEditOutcomesFromResult`'s
+* regex so the round-trip is lossless.
+*
+* Newlines in `reason` are folded to spaces because the parser is line-
+* scoped (`body.split('\n')`); a multi-line reason would split into a
+* "trailing prose" line and trip the malformed-block guard, losing every
+* outcome below it. Static reasons in this file are single-line; the
+* sanitize is a guard against a pathological `target` (file path
+* containing a newline) leaking into `old_string not found in <target>`.
+*/
+function annotationFor(outcomes) {
+	const lines = ["<edit-outcomes>"];
+	for (let i = 0; i < outcomes.length; i++) {
+		const o = outcomes[i];
+		const reason = o.reason ? `: ${o.reason.replace(/\r?\n/g, " ")}` : "";
+		lines.push(`#${i + 1} ${o.kind}${reason}`);
+	}
+	lines.push("</edit-outcomes>");
+	return lines.join("\n");
+}
 const multiEdit = {
 	spec: {
 		name: "multi_edit",
-		description: "Apply a sequential list of edits to a file. Each edit operates on the result of the previous edit. Prefer this over multiple `edit` calls when several non-overlapping changes are needed in the same file. The batch is atomic — if any edit fails to apply, none are written. Each step tolerates `read_file` line-number prefixes (`<N>\\t…`, `<N>|…`, or `<N>→…`) in `old_string` / `new_string`.",
+		description: "Apply a sequential list of edits to a file. Each edit operates on the result of the previous APPLIED edit. Prefer this over multiple `edit` calls when several non-overlapping changes are needed in the same file. Edits run **best-effort**: a per-step failure (`old_string` not found, ambiguous match without `replace_all`, identical strings) is reported in the result but does NOT block the remaining steps. The file is written iff at least one step applied. The result lists per-hunk outcomes (`applied` / `failed`) so the model can re-issue just the failures without resending the whole batch. Each step tolerates `read_file` line-number prefixes (`<N>\\t…`, `<N>|…`, or `<N>→…`) in `old_string` / `new_string`.",
 		inputSchema: {
 			type: "object",
 			properties: {
@@ -4095,7 +4231,7 @@ const multiEdit = {
 				},
 				edits: {
 					type: "array",
-					description: "List of edits applied in order; each operates on the previous edit's output.",
+					description: "List of edits applied in order; each operates on the previous applied edit's output.",
 					items: {
 						type: "object",
 						properties: {
@@ -4125,40 +4261,88 @@ const multiEdit = {
 			if (readState) {
 				const absKey = readStateKey(ctx.handle.cwd, target);
 				const prior = readState.get(absKey);
-				if (!prior) return `multi_edit error: ${target} has not been read in this session. Call read_file first so the edits apply against the current contents. (Reads inside a \`spawn\` subagent with \`persist: false\` and without \`shareReadState: true\` do NOT propagate to the parent — re-read in the calling context.)`;
+				if (!prior) return `multi_edit error: ${target} has not been read in this session. Call read_file first so the edits apply against the current contents.`;
 				if (prior.contentHash !== hashContent(current)) return `multi_edit error: ${target} has changed on disk since the last read. Re-read the file before editing.`;
 			}
 		}
+		const outcomes = [];
 		let totalReplacements = 0;
 		for (let i = 0; i < steps.length; i++) {
 			const step = steps[i];
 			const find = step.old_string;
 			const replacement = step.new_string;
 			const replaceAll = step.replace_all === true;
-			if (typeof find !== "string" || typeof replacement !== "string") return `multi_edit error: edit #${i + 1} is missing old_string or new_string.`;
-			if (find.length === 0) return `multi_edit error: edit #${i + 1} has empty old_string. Use write_file to fully replace a file.`;
-			if (find === replacement) return `multi_edit error: edit #${i + 1} old_string and new_string are identical.`;
+			if (typeof find !== "string" || typeof replacement !== "string") {
+				outcomes.push({
+					kind: "failed",
+					reason: "missing old_string or new_string"
+				});
+				continue;
+			}
+			if (find.length === 0) {
+				outcomes.push({
+					kind: "failed",
+					reason: "empty old_string (use write_file to fully replace a file)"
+				});
+				continue;
+			}
+			if (find === replacement) {
+				outcomes.push({
+					kind: "failed",
+					reason: "old_string and new_string are identical"
+				});
+				continue;
+			}
 			const match = resolveOldString(current, find);
-			if (!match) return `multi_edit error: edit #${i + 1} old_string not found in ${target}.`;
+			if (!match) {
+				outcomes.push({
+					kind: "failed",
+					reason: `old_string not found in ${target}`
+				});
+				continue;
+			}
 			const { actual, occurrences, via } = match;
-			if (occurrences > 1 && !replaceAll) return `multi_edit error: edit #${i + 1} old_string appears ${occurrences} times. Pass replace_all=true on this edit or expand old_string for uniqueness.`;
+			if (occurrences > 1 && !replaceAll) {
+				outcomes.push({
+					kind: "failed",
+					reason: `old_string appears ${occurrences} times — pass replace_all=true on this edit or expand old_string for uniqueness`
+				});
+				continue;
+			}
 			const styledReplacement = styleReplacementForVia(replacement, via, actual);
 			current = replaceAll ? current.split(actual).join(styledReplacement) : current.replace(actual, styledReplacement);
 			totalReplacements += occurrences;
+			outcomes.push({ kind: "applied" });
 		}
-		await ctx.execution.writeFile(ctx.handle, target, current);
-		const readState = resolveReadStateMap(ctx);
-		if (readState) {
-			const absKey = readStateKey(ctx.handle.cwd, target);
-			const prior = readState.get(absKey);
-			if (prior) readState.set(absKey, {
-				...prior,
-				contentHash: hashContent(current),
-				mtimeMs: Date.now()
-			});
+		const appliedCount = outcomes.reduce((n, o) => o.kind === "applied" ? n + 1 : n, 0);
+		const failedCount = outcomes.length - appliedCount;
+		if (appliedCount > 0) {
+			await ctx.execution.writeFile(ctx.handle, target, current);
+			const readState = resolveReadStateMap(ctx);
+			if (readState) {
+				const absKey = readStateKey(ctx.handle.cwd, target);
+				const prior = readState.get(absKey);
+				if (prior) readState.set(absKey, {
+					...prior,
+					contentHash: hashContent(current),
+					mtimeMs: Date.now()
+				});
+			}
 		}
 		const n = steps.length;
-		return `Edited ${target}: applied ${n} edit${n === 1 ? "" : "s"} (${totalReplacements} replacement${totalReplacements === 1 ? "" : "s"}).`;
+		let header;
+		if (appliedCount === n) header = `Edited ${target}: applied ${n} edit${n === 1 ? "" : "s"} (${totalReplacements} replacement${totalReplacements === 1 ? "" : "s"}).`;
+		else if (appliedCount > 0) header = `Edited ${target}: applied ${appliedCount} of ${n} edits (${totalReplacements} replacement${totalReplacements === 1 ? "" : "s"}).`;
+		else header = `multi_edit error: no edits applied to ${target} (${n} attempted).`;
+		const failureLines = [];
+		for (let i = 0; i < outcomes.length; i++) {
+			const o = outcomes[i];
+			if (o.kind === "failed") failureLines.push(`edit #${i + 1} failed: ${o.reason}`);
+		}
+		const parts = [header];
+		if (failureLines.length > 0) parts.push(failureLines.join("\n"));
+		if (failedCount > 0) parts.push(annotationFor(outcomes));
+		return parts.join("\n\n");
 	}
 };
 //#endregion
@@ -4244,6 +4428,7 @@ const DEFAULT_BYTE_CAP = 262144;
 */
 const DEFAULT_IMAGE_BYTE_CAP = 5 * 1024 * 1024;
 const readFile$1 = {
+	isConcurrencySafe: true,
 	spec: {
 		name: "read_file",
 		description: "Read a file by path. Returns lines [offset..offset+limit). Default offset=1, limit=2000. Each line is prefixed with its 1-indexed line number followed by a tab (e.g. `42\\tconst foo = bar`); the prefix is metadata, not part of the file. Mirrors Claude Code's `cat -n`-style compact output for token efficiency. A trailing footer explains how to read the rest when truncated. Binary files return a short marker rather than mojibake.",
@@ -4438,7 +4623,110 @@ function extractTrailingCommand(command) {
 * context's own default (30 s for in-process).
 */
 const DEFAULT_MAX_OUTPUT_BYTES = 32768;
+/**
+* Best-effort read-only allow-list for the leading command token. Members
+* are commands whose stock behavior cannot mutate the workspace under any
+* argument combination — `ls`, `cat`, `pwd`, etc. Commands that *can*
+* mutate depending on flags (`find -delete`, `git tag <name>`, `tar -x`)
+* are intentionally excluded; the input-aware {@link isReadOnlyShellCommand}
+* predicate falls back to the conservative "not safe" answer for them, so
+* the scheduler barriers them.
+*/
+const SHELL_READ_ONLY_COMMANDS = new Set([
+	"ls",
+	"cat",
+	"head",
+	"tail",
+	"wc",
+	"pwd",
+	"whoami",
+	"id",
+	"date",
+	"uname",
+	"hostname",
+	"tty",
+	"echo",
+	"printf",
+	"env",
+	"printenv",
+	"which",
+	"type",
+	"command",
+	"file",
+	"stat",
+	"grep",
+	"rg",
+	"ag",
+	"true",
+	"false",
+	"test"
+]);
+/**
+* `git` subcommands that are pure reads regardless of arguments. Excludes
+* `branch`/`tag`/`remote` (which can mutate when given a name) and
+* `config` (which writes when given a value).
+*/
+const GIT_READ_ONLY_SUBCOMMANDS = new Set([
+	"status",
+	"log",
+	"diff",
+	"show",
+	"blame",
+	"rev-parse",
+	"ls-files",
+	"ls-tree",
+	"cat-file",
+	"reflog",
+	"shortlog",
+	"describe",
+	"rev-list",
+	"name-rev",
+	"whatchanged",
+	"merge-base",
+	"symbolic-ref"
+]);
+/**
+* Conservative read-only verdict for a shell command — used to opt a
+* `shell` invocation into the scheduler's concurrent fleet. Returns
+* `false` (fail-closed) on anything ambiguous so the scheduler barriers
+* it. Specifically:
+*
+* - Rejects compound commands (`;`, `&&`, `||`, `|`) and redirects (`>`,
+*   `>>`, `<`) — even a pipe to a read-only sink is treated as too
+*   complex to analyze.
+* - Rejects subshell / process substitution (`$(...)`, `` `...` ``,
+*   `<(...)`, `>(...)`).
+* - Skips leading `VAR=value` env assignments to find the real
+*   command token.
+* - Strips a possible absolute path on the command (`/usr/bin/ls` → `ls`).
+* - Allows the command iff its base name is in
+*   {@link SHELL_READ_ONLY_COMMANDS} OR it's `git <subcmd>` where
+*   `<subcmd>` is in {@link GIT_READ_ONLY_SUBCOMMANDS}.
+*
+* Cheap (no spawned process; regex + token scan). Safe to call from the
+* hot scheduler path.
+*/
+function isReadOnlyShellCommand(command) {
+	if (typeof command !== "string") return false;
+	const trimmed = command.trim();
+	if (trimmed === "") return false;
+	if (/[<>;&|`\n]/.test(trimmed)) return false;
+	if (trimmed.includes("$(") || trimmed.includes("<(") || trimmed.includes(">(")) return false;
+	const tokens = trimmed.split(/\s+/);
+	let i = 0;
+	while (i < tokens.length && /^[A-Z_]\w*=/i.test(tokens[i])) i++;
+	const head = tokens[i];
+	if (!head) return false;
+	const base = head.split("/").pop() ?? head;
+	if (SHELL_READ_ONLY_COMMANDS.has(base)) return true;
+	if (base === "git") {
+		const sub = tokens[i + 1];
+		return typeof sub === "string" && GIT_READ_ONLY_SUBCOMMANDS.has(sub);
+	}
+	return false;
+}
 const shell = {
+	isConcurrencySafe: (input) => isReadOnlyShellCommand(input.command),
 	spec: {
 		name: "shell",
 		description: "Execute a shell command in the project root and return its combined stdout/stderr. Output is tail-priority truncated at 32 KiB by default; errors and exit-code summaries live in the tail. By default each call appends a `(exit N, Nms)` footer and surfaces non-empty stderr in a separate section even on success — set `metadata: false` to return only stdout. Set maxOutputBytes=0 to disable truncation.",
@@ -4715,6 +5003,7 @@ function createSpawnTool(options = {}) {
 		get totalChildStats() {
 			return { ...localStats };
 		},
+		isConcurrencySafe: true,
 		spec: {
 			name: "spawn",
 			description: "Spawn a sub-agent for a self-contained task that benefits from isolation (separate context window, separate retries) — for example, a deep research dive or a long codegen pass on a specific file. The sub-agent runs independently with its own tool access and returns its final response. Do NOT spawn for sequential steps you could do yourself.",
@@ -4947,6 +5236,6 @@ const writeFile$1 = {
 	}
 };
 //#endregion
-export { readStateKey as A, PERSISTENCE_PREVIEW_BYTES as C, resolvePersistDir as D, maybePersistToolResult as E, getReadState as O, PERSISTED_STUB_PREFIX as S, cleanupPersistedSession as T, createSkillsReadTool as _, multiEdit as a, TOOL_USE_SKIPPED_MESSAGE as b, grep as c, resolveOldString as d, styleReplacementForVia as f, createSkillsRunScriptTool as g, createSkillsUseTool as h, readFile$1 as i, resolveReadStateMap as j, hashContent as k, glob as l, createToolSearchTool as m, createSpawnTool as n, listFiles as o, createAgent as p, shell as r, createInteractionTool as s, writeFile$1 as t, edit as u, INTERRUPT_MESSAGE_FOR_TOOL_USE as v, buildPersistedStub as w, validateToolArgs as x, TOOL_USE_AFTER_ERROR_MESSAGE as y };
+export { readStateKey as A, PERSISTENCE_PREVIEW_BYTES as C, resolvePersistDir as D, maybePersistToolResult as E, getReadState as O, PERSISTED_STUB_PREFIX as S, cleanupPersistedSession as T, createSkillsReadTool as _, multiEdit as a, TOOL_USE_SKIPPED_MESSAGE as b, grep as c, resolveOldString as d, styleReplacementForVia as f, createSkillsRunScriptTool as g, createSkillsUseTool as h, readFile$1 as i, resolveReadStateMap as j, hashContent as k, glob as l, createToolSearchTool as m, createSpawnTool as n, listFiles as o, createAgent as p, shell as r, createInteractionTool as s, writeFile$1 as t, edit as u, INTERRUPT_MESSAGE_FOR_TOOL_USE as v, buildPersistedStub as w, validateToolArgs as x, SHELL_CASCADE_CANCEL_MESSAGE as y };
 
-//# sourceMappingURL=tools-CCsL5SCO.js.map
+//# sourceMappingURL=tools-PQH1Ge4M.js.map