zidane 6.4.4 → 6.5.1

package/dist/{agent-8sUadp5M.js → agent-BVNkC1h4.js}

@@ -1,24 +1,22 @@
-import { a as rewriteMessagesToWire, i as rewriteContentToCanonical, n as buildAliasMaps, o as toCanonicalName, r as buildSanitizedWireAliases, s as toWireName, t as augmentMcpDoubleUnderscoreAliases } from "./aliasing-lVFbm81n.js";
+import { B as rewriteMessagesToWire, H as toWireName, I as augmentMcpDoubleUnderscoreAliases, L as buildAliasMaps, M as buildPromptMessage, N as canonicalizePrompt, R as buildSanitizedWireAliases, V as toCanonicalName, z as rewriteContentToCanonical } from "./openai-compat-CnHeo4Lz.js";
 import { a as isWireTurn, c as toolOutputByteLength, i as documentBlockMarker, l as toolResultToText, o as sanitizeToolResultMetadata, s as toolOutputBudgetByteLength, t as DEFAULT_AGENT_CLOCK } from "./types-BIarq1qE.js";
-import { i as styleReplacementForVia, n as resolveOldString, r as stripLineNumberPrefixes, t as describeVia } from "./edit-utils-EGosADZq.js";
-import { a as getReadState, d as noteStaleRejection, f as readStateKey, l as hydrateReadStateFromSessionAsync, m as staleRefusalHint, n as createToolStateController, o as getToolDedupState, p as resolveReadStateMap, s as hashContent, u as markReadStateElided } from "./tool-state-DTs-3ZHH.js";
+import { a as styleReplacementForVia, i as stripLineNumberPrefixes, n as describeVia, r as resolveOldString, t as buildContextBreakdown } from "./context-breakdown-BLF10tOO.js";
 import { n as estimateTokens, r as utf8ByteLength } from "./utils-ngQzYzZD.js";
-import { t as buildContextBreakdown } from "./context-breakdown-Dzo25N45.js";
 import { a as formatDuration, c as previewLine, o as formatTaskStatus, s as formatTaskSummary } from "./format-BF745pLL.js";
 import { i as parseGitLsFiles, r as GIT_LS_FILES_COMMAND } from "./glob-DluQFSw1.js";
 import { i as isOutputExceededMessage } from "./output-cap-C9zukcCj.js";
 import { r as createProcessContext, t as resolveDetachedTasksCapability } from "./contexts-DWVt7MvF.js";
 import { n as shellQuote, t as alwaysQuote } from "./shell-quote-BmnhZmdM.js";
 import { a as AgentProviderError, d as isAbortLikeError, h as toTypedError, i as AgentLengthResumeExhaustedError, n as AgentBudgetExceededError, s as AgentToolPairingError, t as AgentAbortedError, u as errorMessage } from "./errors-BwBxu3zD.js";
-import { C as stripShellInterpolations, O as validateResourcePathReal, S as interpolateShellCommands, _ as lastLine, b as resolveSubdirRoot, d as installAllowedToolsGate, f as createSkillActivationState, g as fetchInstallSource, h as defaultWhich, j as projectUserPaths, l as buildCatalog, m as defaultExec, p as InstallSourceError, t as resolveSkills, v as parseInstallSource, x as escapeXml, y as resolveNpmVersion } from "./resolve-CZJxds85.js";
+import { A as createSkillActivationState, D as escapeXml, E as buildCatalog, F as validateResourcePathReal, R as projectUserPaths, _ as lastLine, a as interpolateShellCommands, b as resolveSubdirRoot, g as fetchInstallSource, h as defaultWhich, k as installAllowedToolsGate, m as defaultExec, n as resolveSkills, o as stripShellInterpolations, p as InstallSourceError, v as parseInstallSource, y as resolveNpmVersion } from "./skills-Cp9vnBwd.js";
 import { n as writeFileAtomicAsync, t as writeFileAtomic } from "./atomic-write-B7zr1ddF.js";
+import { p as resolveStorageDirs, r as loadAgentPlugin } from "./plugins-2PMTVcp-.js";
 import { r as createLogger, t as consoleSink } from "./logger-DBX9uYOw.js";
 import { n as reconcileImageMediaType } from "./media-sniff-UKijEaiQ.js";
-import { d as wrapDiscoveredMcpTools, i as deriveMcpToolMeta, n as connectMcpServers, s as nonOwningMcpView } from "./mcp-3GXUBwur.js";
-import { M as buildPromptMessage, N as canonicalizePrompt } from "./openai-compat-B3c_hzwf.js";
+import { f as wrapDiscoveredMcpTools, i as deriveMcpToolMeta, n as connectMcpServers, s as nonOwningMcpView } from "./mcp-C6IkXNOS.js";
 import { appendStaticSection, renderSystemForWire } from "./prompt.js";
-import { a as detectTurnInterruption, c as ensureToolResultPairing, l as filterUnresolvedToolUses, m as resolveContentRefsInMessages, n as SYNTHETIC_TOOL_RESULT_PLACEHOLDER, p as remintDuplicateToolCallIds, s as ensureEndsWithUserMessage } from "./messages-C01kKGj0.js";
-import { a as getExtensionSessionState, c as setExtensionSessionState, l as withExtensionSession, n as currentExtensionSession, r as deleteExtensionSessionState, s as resumeChainRunIds } from "./session-cr9VdoEO.js";
+import { a as detectTurnInterruption, c as ensureToolResultPairing, l as filterUnresolvedToolUses, m as resolveContentRefsInMessages, n as SYNTHETIC_TOOL_RESULT_PLACEHOLDER, p as remintDuplicateToolCallIds, s as ensureEndsWithUserMessage } from "./messages-C_H9soi5.js";
+import { a as getExtensionSessionState, c as setExtensionSessionState, l as withExtensionSession, n as currentExtensionSession, r as deleteExtensionSessionState, s as resumeChainRunIds } from "./session-VpLrNaFQ.js";
 import { n as flattenTurns, r as formatTokenUsage, t as effectiveInputFromTurn } from "./stats-DAKBEKjc.js";
 import { a as withInactivityTimeout, i as settleWithinTimeout, n as linkAbortSignal, o as withTimeout$1, r as resolveTimeoutMs, t as OperationTimeoutError } from "./timeout-BDetbuN6.js";
 import { createRequire } from "node:module";
@@ -30,6 +28,436 @@ import { copyFile, mkdir, readdir, rm, stat, unlink } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
 import { homedir, tmpdir } from "node:os";
 import { createHash } from "node:crypto";
+//#region src/tools/read-state.ts
+const STATE = /* @__PURE__ */ new WeakMap();
+/**
+* Get or lazily create the per-session read-state map. Returns `undefined`
+* when no session is provided.
+*
+* Most tool callers should prefer {@link resolveReadStateMap}, which
+* additionally honors an explicit `ctx.readState` (the path
+* `spawn`'s `shareReadState: true` uses to forward the parent's map
+* into a sessionless child). Use this helper directly only when the
+* Session-keyed map is exactly what you want and you don't need to
+* accept an override.
+*/
+function getReadState(session) {
+	if (!session) return void 0;
+	let map = STATE.get(session);
+	if (!map) {
+		map = /* @__PURE__ */ new Map();
+		STATE.set(session, map);
+	}
+	return map;
+}
+/**
+* Resolve the active read-state map from a tool context. An explicit
+* `ctx.readState` wins (used by `spawn`'s `shareReadState` opt-in to
+* forward the parent's map into a sessionless child); otherwise the
+* usual `Session`-keyed lookup applies.
+*
+* Tools should call this helper instead of `getReadState(ctx.session)`
+* directly so the `shareReadState` plumbing is honored uniformly.
+*/
+function resolveReadStateMap(ctx) {
+	return ctx.readState ?? getReadState(ctx.session);
+}
+/**
+* Mark a read-state entry as elided from the on-wire history WITHOUT
+* un-registering it.
+*
+* Used by the loop's `elideStaleReads` pass. The entry must survive —
+* deleting it made the `requireReadBeforeEdit` gate reject the very next
+* edit on a file the model had demonstrably read and just edited (the
+* gate's failure mode then defeats the gate: models degrade to raw shell
+* edits that bypass the guard entirely). The `elided` flag instead
+* defeats only the dedup stub: the next identical re-read returns the
+* full body again, and `rememberRead` clears the flag.
+*
+* No-op when the path has no entry in the resolved map(s).
+*/
+function markReadStateElided(ctx, cwd, path) {
+	const key = readStateKey(cwd, path);
+	for (const map of [ctx.readState, ctx.session ? STATE.get(ctx.session) : void 0]) {
+		const entry = map?.get(key);
+		if (entry && entry.elided !== true) map.set(key, {
+			...entry,
+			elided: true
+		});
+	}
+}
+/**
+* Record one `requireReadBeforeEdit` drift refusal against `entry` and
+* return the consecutive count (1 for the first). The caller composes the
+* refusal message with {@link staleRefusalHint}.
+*/
+function noteStaleRejection(map, key, entry) {
+	const count = (entry.staleRejections ?? 0) + 1;
+	map.set(key, {
+		...entry,
+		staleRejections: count
+	});
+	return count;
+}
+/**
+* Escalating suffix for a drift refusal. Empty on the first refusal — the
+* base "re-read the file" advice is correct and sufficient. From the second
+* consecutive refusal on, the model has demonstrably re-read and been
+* refused again, so repeating the same advice reads as a broken tool;
+* name the real hypothesis (an external writer) instead.
+*/
+function staleRefusalHint(count) {
+	if (count < 2) return "";
+	return ` This is refusal #${count} since your last read — a process outside this session (editor auto-save, formatter, codegen watcher) may be rewriting the file between your reads.`;
+}
+/**
+* Canonical read-state key for a `(cwd, path)` pair.
+*
+* `ctx.execution.readFile(handle, path)` resolves the model-provided
+* path against `handle.cwd` before touching disk — so `src/App.tsx`,
+* `./src/App.tsx`, and `/abs/cwd/src/App.tsx` all read the **same**
+* bytes. The read-state map MUST mirror that resolution: without it,
+* a model that reads `src/App.tsx` and then edits `./src/App.tsx`
+* trips the `requireReadBeforeEdit` gate for a file it demonstrably
+* already saw (the gate's "has not been read in this session" message
+* fires on a stale key).
+*
+* `node:path`'s `resolve(cwd, path)` short-circuits when `path` is
+* already absolute, so absolute and relative shapes converge on the
+* same canonical form. We don't `realpath()` symlinks — the file IS
+* the path the model addressed, not the realpath behind it; the host's
+* execution context decides how to dereference.
+*/
+function readStateKey(cwd, path) {
+	return resolve(cwd, path);
+}
+/**
+* 64-bit content hash: two independent 32-bit FNV-1a-style lanes (different
+* offset bases + multipliers) concatenated as 16 hex chars. Fast,
+* non-cryptographic — but wide enough that the `requireReadBeforeEdit`
+* drift gate, which silently corrupts a file on a false "unchanged"
+* verdict, isn't betting on a 32-bit birthday bound (~1 in 4 billion per
+* pair; uncomfortably reachable over many files × many sessions). Entries
+* live only in per-session in-memory maps, so widening needs no
+* stored-format migration. Still cheaper than allocating a Buffer and
+* pulling in `crypto`.
+*/
+function hashContent(text) {
+	let h1 = 2166136261;
+	let h2 = 2128831031;
+	for (let i = 0; i < text.length; i++) {
+		const c = text.charCodeAt(i);
+		h1 = Math.imul(h1 ^ c, 16777619) >>> 0;
+		h2 = Math.imul(h2 ^ c, 2246822507) >>> 0;
+	}
+	return h1.toString(16).padStart(8, "0") + h2.toString(16).padStart(8, "0");
+}
+const READ_FILE_DEFAULT_OFFSET = 1;
+const READ_FILE_DEFAULT_LIMIT = 2e3;
+const READ_FILE_DEFAULT_MAX_BYTES = 262144;
+const READ_FILE_FOOTER_RE = /\n\n…(?:read lines|truncated)/;
+const READ_FILE_LINE_RE = /^\d{1,9}\t(.*)$/;
+/**
+* Rebuild the per-session read-state map from durable session turns.
+*
+* Durable replay runtimes may return recorded tool results without re-running
+* the tool body, so in-memory side effects like `readState.set(...)` can be
+* missing even though the transcript contains the successful `read_file`.
+* This helper is intentionally opt-in: live hosts keep the normal side-effect
+* behavior unless they call it themselves.
+*
+* Hydration only fills missing keys. Live in-memory state may already reflect a
+* newer read or edit from the current run, and durable history cannot prove it
+* is fresher. Relative paths are resolved against the current execution cwd,
+* matching replay hosts that run sessions from a stable workspace.
+*/
+function hydrateReadStateFromSession(session, cwd, options = {}) {
+	if (!session) return 0;
+	const readState = getReadState(session);
+	if (!readState) return 0;
+	const normalized = normalizeHydrateReadStateOptions(options);
+	const pending = /* @__PURE__ */ new Map();
+	const known = /* @__PURE__ */ new Map();
+	const preexistingKeys = new Set(readState.keys());
+	let hydrated = 0;
+	for (const turn of session.turns) for (const block of turn.content) {
+		if (block.type === "tool_call") {
+			const canonicalName = canonicalToolCallName(block.name, normalized);
+			if (canonicalName === normalized.readFileToolName || canonicalName === normalized.writeFileToolName || canonicalName === normalized.editToolName || canonicalName === normalized.multiEditToolName) pending.set(block.id, {
+				name: canonicalName,
+				input: block.input
+			});
+			continue;
+		}
+		if (block.type !== "tool_result") continue;
+		const call = pending.get(block.callId);
+		if (!call) continue;
+		pending.delete(block.callId);
+		if (block.isError === true) continue;
+		const next = stateFromToolResult(call, toolResultToText(block.output), turn, cwd, normalized, known);
+		if (!next) continue;
+		if (!preexistingKeys.has(next.key)) {
+			readState.set(next.key, next.file.entry);
+			hydrated += 1;
+		}
+		known.set(next.key, next.file);
+	}
+	return hydrated;
+}
+/**
+* Async replay hydrator for durable hosts that can cheaply read the current
+* full file through their execution context. Transcript-only reconstruction is
+* still preferred for full reads; partial/truncated read_file entries fall back
+* to `readFileForHash` and hash those full current bytes.
+*/
+async function hydrateReadStateFromSessionAsync(session, cwd, options = {}) {
+	if (!session) return 0;
+	const readState = getReadState(session);
+	if (!readState) return 0;
+	const normalized = normalizeHydrateReadStateOptions(options);
+	const pending = /* @__PURE__ */ new Map();
+	const known = /* @__PURE__ */ new Map();
+	const preexistingKeys = new Set(readState.keys());
+	let hydrated = 0;
+	for (const turn of session.turns) for (const block of turn.content) {
+		if (block.type === "tool_call") {
+			const canonicalName = canonicalToolCallName(block.name, normalized);
+			if (canonicalName === normalized.readFileToolName || canonicalName === normalized.writeFileToolName || canonicalName === normalized.editToolName || canonicalName === normalized.multiEditToolName) pending.set(block.id, {
+				name: canonicalName,
+				input: block.input
+			});
+			continue;
+		}
+		if (block.type !== "tool_result") continue;
+		const call = pending.get(block.callId);
+		if (!call) continue;
+		pending.delete(block.callId);
+		if (block.isError === true) continue;
+		const next = await stateFromToolResultAsync(call, toolResultToText(block.output), turn, cwd, normalized, known);
+		if (!next) continue;
+		if (!preexistingKeys.has(next.key)) {
+			readState.set(next.key, next.file.entry);
+			hydrated += 1;
+		}
+		known.set(next.key, next.file);
+	}
+	return hydrated;
+}
+function normalizeHydrateReadStateOptions(options) {
+	return {
+		readFileToolName: options.readFileToolName ?? "read_file",
+		writeFileToolName: options.writeFileToolName ?? "write_file",
+		editToolName: options.editToolName ?? "edit",
+		multiEditToolName: options.multiEditToolName ?? "multi_edit",
+		defaultLineNumbers: options.defaultLineNumbers ?? true,
+		...options.readFileForHash ? { readFileForHash: options.readFileForHash } : {},
+		...options.aliasMaps ? { aliasMaps: options.aliasMaps } : {}
+	};
+}
+/**
+* Resolve a transcript tool-call name to its canonical form for matching.
+* Honors `aliasMaps` (wire → canonical) when present; otherwise the name is
+* already canonical (zidane persists canonical names) and passes through.
+*/
+function canonicalToolCallName(name, options) {
+	return options.aliasMaps ? toCanonicalName(name, options.aliasMaps) : name;
+}
+function stateFromToolResult(call, output, resultTurn, cwd, options, known) {
+	if (call.name === options.readFileToolName) return readFileStateFromResult(call.input, output, resultTurn, cwd, options.defaultLineNumbers);
+	if (call.name === options.writeFileToolName) return writeFileStateFromResult(call.input, output, resultTurn, cwd);
+	if (call.name === options.editToolName) return editStateFromResult(call.input, output, resultTurn, cwd, known);
+	if (call.name === options.multiEditToolName) return multiEditStateFromResult(call.input, output, resultTurn, cwd, known);
+}
+async function stateFromToolResultAsync(call, output, resultTurn, cwd, options, known) {
+	if (call.name === options.readFileToolName) return await readFileStateFromResultAsync(call.input, output, resultTurn, cwd, {
+		defaultLineNumbers: options.defaultLineNumbers,
+		readFileForHash: options.readFileForHash
+	});
+	return stateFromToolResult(call, output, resultTurn, cwd, options, known);
+}
+function readFileStateFromResult(input, output, resultTurn, cwd, defaultLineNumbers) {
+	const path = typeof input.path === "string" ? input.path : void 0;
+	if (!path || !isSuccessfulFullReadOutput(output)) return void 0;
+	const lineNumbers = typeof input.lineNumbers === "boolean" ? input.lineNumbers : defaultLineNumbers;
+	const content = lineNumbers ? stripReadFileLineNumbers(output) : output;
+	if (content === void 0) return void 0;
+	const entry = {
+		contentHash: hashContent(content),
+		offset: normalizeReadInteger(input.offset, READ_FILE_DEFAULT_OFFSET),
+		limit: normalizeReadInteger(input.limit, READ_FILE_DEFAULT_LIMIT),
+		maxBytes: normalizeReadInteger(input.maxBytes, READ_FILE_DEFAULT_MAX_BYTES),
+		lineNumbers,
+		mtimeMs: resultTurn.createdAt
+	};
+	return {
+		key: readStateKey(cwd, path),
+		file: {
+			content,
+			entry
+		}
+	};
+}
+async function readFileStateFromResultAsync(input, output, resultTurn, cwd, options) {
+	const reconstructed = readFileStateFromResult(input, output, resultTurn, cwd, options.defaultLineNumbers);
+	if (reconstructed) return reconstructed;
+	const path = typeof input.path === "string" ? input.path : void 0;
+	if (!path || !options.readFileForHash || !isSuccessfulReadOutput(output)) return void 0;
+	let content;
+	try {
+		content = await options.readFileForHash(path);
+	} catch {
+		return;
+	}
+	if (typeof content !== "string") return void 0;
+	const lineNumbers = typeof input.lineNumbers === "boolean" ? input.lineNumbers : options.defaultLineNumbers;
+	const entry = {
+		contentHash: hashContent(content),
+		offset: normalizeReadInteger(input.offset, READ_FILE_DEFAULT_OFFSET),
+		limit: normalizeReadInteger(input.limit, READ_FILE_DEFAULT_LIMIT),
+		maxBytes: normalizeReadInteger(input.maxBytes, READ_FILE_DEFAULT_MAX_BYTES),
+		lineNumbers,
+		mtimeMs: resultTurn.createdAt
+	};
+	return {
+		key: readStateKey(cwd, path),
+		file: {
+			content,
+			entry
+		}
+	};
+}
+function writeFileStateFromResult(input, output, resultTurn, cwd) {
+	const path = typeof input.path === "string" ? input.path : void 0;
+	const content = typeof input.content === "string" ? input.content : void 0;
+	if (!path || content === void 0) return void 0;
+	if (!output.startsWith(`Created ${path} (`) && !output.startsWith(`Updated ${path} (`)) return void 0;
+	return {
+		key: readStateKey(cwd, path),
+		file: {
+			content,
+			entry: {
+				contentHash: hashContent(content),
+				offset: 0,
+				limit: Number.POSITIVE_INFINITY,
+				maxBytes: Number.POSITIVE_INFINITY,
+				mtimeMs: resultTurn.createdAt,
+				elided: true
+			}
+		}
+	};
+}
+function editStateFromResult(input, output, resultTurn, cwd, known) {
+	const path = typeof input.path === "string" ? input.path : void 0;
+	const oldString = typeof input.old_string === "string" ? input.old_string : void 0;
+	const newString = typeof input.new_string === "string" ? input.new_string : void 0;
+	if (!path || oldString === void 0 || newString === void 0) return void 0;
+	if (!output.startsWith(`Edited ${path}: replaced `)) return void 0;
+	const key = readStateKey(cwd, path);
+	const prior = known.get(key);
+	if (!prior) return void 0;
+	const nextContent = applyEdit(prior.content, oldString, newString, input.replace_all === true);
+	if (nextContent === void 0) return void 0;
+	return {
+		key,
+		file: {
+			content: nextContent,
+			entry: {
+				...prior.entry,
+				contentHash: hashContent(nextContent),
+				mtimeMs: resultTurn.createdAt,
+				elided: true
+			}
+		}
+	};
+}
+function multiEditStateFromResult(input, output, resultTurn, cwd, known) {
+	const path = typeof input.path === "string" ? input.path : void 0;
+	const edits = Array.isArray(input.edits) ? input.edits : void 0;
+	if (!path || !edits) return void 0;
+	if (!output.startsWith(`Edited ${path}: applied `)) return void 0;
+	const key = readStateKey(cwd, path);
+	const prior = known.get(key);
+	if (!prior) return void 0;
+	const applied = parseMultiEditAppliedSteps(output, edits.length);
+	let current = prior.content;
+	for (let i = 0; i < edits.length; i++) {
+		if (!applied.has(i)) continue;
+		const step = edits[i];
+		if (typeof step.old_string !== "string" || typeof step.new_string !== "string") return void 0;
+		const next = applyEdit(current, step.old_string, step.new_string, step.replace_all === true);
+		if (next === void 0) return void 0;
+		current = next;
+	}
+	return {
+		key,
+		file: {
+			content: current,
+			entry: {
+				...prior.entry,
+				contentHash: hashContent(current),
+				mtimeMs: resultTurn.createdAt,
+				elided: true
+			}
+		}
+	};
+}
+function applyEdit(content, oldString, newString, replaceAll) {
+	const match = resolveOldString(content, oldString);
+	if (!match) return void 0;
+	if (match.occurrences > 1 && !replaceAll) return void 0;
+	const styledReplacement = styleReplacementForVia(newString, match.via, match.actual);
+	return replaceAll ? content.split(match.actual).join(styledReplacement) : content.replace(match.actual, styledReplacement);
+}
+function parseMultiEditAppliedSteps(output, editCount) {
+	const annotationMatch = /<edit-outcomes>\n([\s\S]*?)\n<\/edit-outcomes>/.exec(output);
+	if (!annotationMatch) return new Set(Array.from({ length: editCount }, (_, i) => i));
+	const applied = /* @__PURE__ */ new Set();
+	for (const line of annotationMatch[1].split("\n")) {
+		const match = /^#(\d+) applied$/.exec(line.trim());
+		if (!match) continue;
+		const index = Number(match[1]) - 1;
+		if (index >= 0 && index < editCount) applied.add(index);
+	}
+	return applied;
+}
+function isSuccessfulFullReadOutput(output) {
+	if (!isSuccessfulReadOutput(output) || READ_FILE_FOOTER_RE.test(output)) return false;
+	return true;
+}
+function isSuccessfulReadOutput(output) {
+	if (output.length === 0) return true;
+	if (output.startsWith("File not found:") || output.startsWith("[binary file:") || output.startsWith("Image:") || output.startsWith("Document:") || output.startsWith("[image too large to inline:") || output.startsWith("[document:") || output.startsWith("[document too large to attach:") || output.startsWith("Image read failed:") || output.startsWith("Document read failed:") || output.includes(" unchanged since the previous read in this session ")) return false;
+	return true;
+}
+function stripReadFileLineNumbers(output) {
+	const lines = output.split("\n");
+	const stripped = [];
+	for (const line of lines) {
+		const match = READ_FILE_LINE_RE.exec(line);
+		if (!match) return void 0;
+		stripped.push(match[1]);
+	}
+	return stripped.join("\n");
+}
+function normalizeReadInteger(value, fallback) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return fallback;
+	return Math.floor(value);
+}
+const TOOL_DEDUP_STATE = /* @__PURE__ */ new WeakMap();
+/**
+* Get or lazily create the per-session tool-dedup map. Returns `undefined`
+* when no session is provided — middleware should treat that as "no dedup".
+*/
+function getToolDedupState(session) {
+	if (!session) return void 0;
+	let map = TOOL_DEDUP_STATE.get(session);
+	if (!map) {
+		map = /* @__PURE__ */ new Map();
+		TOOL_DEDUP_STATE.set(session, map);
+	}
+	return map;
+}
+//#endregion
 //#region src/behaviors/dedup-tools.ts
 /**
 * Install the per-tool argument-dedup middleware on a hook bus.
@@ -1224,6 +1652,43 @@ function defineExtension(definition) {
 	return definition;
 }
 //#endregion
+//#region src/debug-log.ts
+/**
+* `ZIDANE_DEBUG`-gated diagnostic logging.
+*
+* The three subsystems that need this (TUI shell, discovery, extension
+* scanning) each had their own three-line copy, differing only in the scope
+* label and — accidentally — in sink and formatting: one used `console.error`
+* with a raw error object, two used `process.stderr.write` with
+* {@link errorMessage}. The label is a real per-module difference, so it's a
+* parameter; the rest was drift.
+*
+* Distinct from `./logger`, which is the structured, sink-backed `Logger`
+* surfaced to extensions and hosts. This is the unstructured "print it when
+* debugging" path: no levels, no sinks, off unless `ZIDANE_DEBUG` is set, and
+* always stderr so it can never corrupt stdout for a piped host.
+*/
+/**
+* Build a debug logger scoped to a subsystem. Emits
+* `[zidane/<scope>] <label>: <details…>` on stderr when `ZIDANE_DEBUG` is set,
+* and is a no-op otherwise.
+*
+* `details` are flattened through {@link errorMessage}, so an `Error` prints
+* its message rather than `[object Object]` and plain strings pass through.
+*
+* The env var is read per call rather than captured at module load so a test
+* (or a host toggling it at runtime) sees the change; the check is a property
+* read on an already-materialized object, so the cost is irrelevant next to
+* the I/O it guards.
+*/
+function createDebugLog(scope) {
+	return (label, ...details) => {
+		if (!process.env.ZIDANE_DEBUG) return;
+		const tail = details.length > 0 ? `: ${details.map(errorMessage).join(" ")}` : "";
+		process.stderr.write(`[zidane/${scope}] ${label}${tail}\n`);
+	};
+}
+//#endregion
 //#region src/extensions/with-timeout.ts
 /**
 * Internal: race a promise against a timeout. Shared by the discovery
@@ -1246,6 +1711,11 @@ function withTimeout(promise, timeoutMs, message, onTimeout) {
 //#endregion
 //#region src/extensions/discovery.ts
 /**
+* Scoped `ZIDANE_DEBUG` logger. A `const` rather than a hoisted function
+* declaration, so it must precede its call sites.
+*/
+const debugLog = createDebugLog("extensions");
+/**
 * Entry-point filenames probed inside each `<name>/` directory, in
 * preference order. Bun loads `.ts` / `.tsx` natively; `.mjs` / `.js`
 * are accepted so pre-compiled extensions (or vibe-coded JS-only ones)
@@ -1657,9 +2127,6 @@ function isExtensionManifest(value) {
 	const isStringArray = (x) => Array.isArray(x) && x.every((el) => typeof el === "string");
 	return (v.name === void 0 || typeof v.name === "string") && (v.displayName === void 0 || typeof v.displayName === "string") && (v.description === void 0 || typeof v.description === "string") && (v.permissions === void 0 || isStringArray(v.permissions)) && (v.capabilities === void 0 || isStringArray(v.capabilities));
 }
-function debugLog(label, err) {
-	if (process.env.ZIDANE_DEBUG) process.stderr.write(`[zidane/extensions] ${label}: ${errorMessage(err)}\n`);
-}
 //#endregion
 //#region src/extensions/host-modules.ts
 const registered = /* @__PURE__ */ new Set();
@@ -2318,86 +2785,6 @@ function stripJsonComments(input) {
 	return out;
 }
 //#endregion
-//#region src/chat/xdg.ts
-/**
-* XDG Base Directory resolution for zidane.
-*
-* The user's storage spreads across four logical slots:
-*
-*   - **config** — credentials, mcp-credentials, keybindings, config.json,
-*     mcps.json, skills (user-editable surface).
-*   - **data**   — sessions.db (long-lived chat history).
-*   - **state**  — state.json (per-machine UI bookkeeping: last provider,
-*     last model, last agent, settings).
-*   - **cache**  — persisted tool results, background-task logs,
-*     auto-update registry cache (regenerable, safe to wipe).
-*
-* Historically all four collapsed to `~/.zidane/`. This module adds
-* XDG-Base-Directory-aware defaults so a Linux user with no existing
-* `~/.zidane/` lands in the conventional `~/.config/zidane/`,
-* `~/.local/share/zidane/`, `~/.local/state/zidane/`, `~/.cache/zidane/`
-* trio. Existing setups (anyone with a `~/.zidane/` directory or
-* `ZIDANE_STORAGE_DIR` set) keep the single-dir layout unchanged.
-*
-* Resolution flow — applied in this order:
-*
-*   1. Caller passed an explicit `storageDir` (`ChatOptions.storageDir`)
-*      OR `ZIDANE_STORAGE_DIR` is set → **legacy-explicit** single-dir
-*      layout under `<storageDir>/<prefix>`. The four slots collapse to
-*      the same directory.
-*   2. `~/<prefix>/` already exists on disk → **legacy-existing**
-*      single-dir layout under that directory. Upgrades never silently
-*      shift files around.
-*   3. Any `XDG_*_HOME` env var is set OR `process.platform === 'linux'`
-*      → **XDG split**. Each slot lands in its own dir. Per-slot
-*      `ZIDANE_{CONFIG,DATA,CACHE,STATE}_DIR` overrides beat the XDG
-*      vars for surgical tweaks.
-*   4. Otherwise (macOS/Windows, no XDG signal, no existing dir) →
-*      **default** single-dir layout at `~/<prefix>/`. Day-one behavior
-*      on these platforms is unchanged.
-*
-* The `userDir` legacy alias always equals `configDir` so existing code
-* that still references `paths.userDir` keeps reading credentials, mcps,
-* etc. from the right place.
-*/
-/**
-* Resolve the four storage slots according to the precedence above.
-*
-* Pure aside from one filesystem probe (`existsSync(home/<prefix>)`)
-* — the same probe `resolveStoragePaths` would do anyway when
-* computing `paths.userDir`. No directories are created here; the
-* relevant write paths (state store, credentials writer, persist
-* dir) handle their own lazy `mkdirSync` already.
-*/
-function resolveStorageDirs(opts = {}) {
-	const env = opts.env ?? process.env;
-	const home = opts.home ?? homedir();
-	const platform = opts.platform ?? process.platform;
-	const rawPrefix = opts.prefix ?? ".zidane";
-	const prefixBare = rawPrefix.replace(/^\./, "");
-	const explicitStorageDir = opts.storageDir ?? env.ZIDANE_STORAGE_DIR;
-	if (explicitStorageDir) return single(resolve(explicitStorageDir, rawPrefix), "legacy-explicit");
-	const legacyHomeDir = resolve(home, rawPrefix);
-	if (existsSync(legacyHomeDir)) return single(legacyHomeDir, "legacy-existing");
-	if (platform === "linux" || !!env.XDG_CONFIG_HOME || !!env.XDG_DATA_HOME || !!env.XDG_CACHE_HOME || !!env.XDG_STATE_HOME || !!env.ZIDANE_CONFIG_DIR || !!env.ZIDANE_DATA_DIR || !!env.ZIDANE_STATE_DIR || !!env.ZIDANE_CACHE_DIR) return {
-		configDir: env.ZIDANE_CONFIG_DIR ?? resolve(env.XDG_CONFIG_HOME || resolve(home, ".config"), prefixBare),
-		dataDir: env.ZIDANE_DATA_DIR ?? resolve(env.XDG_DATA_HOME || resolve(home, ".local", "share"), prefixBare),
-		stateDir: env.ZIDANE_STATE_DIR ?? resolve(env.XDG_STATE_HOME || resolve(home, ".local", "state"), prefixBare),
-		cacheDir: env.ZIDANE_CACHE_DIR ?? resolve(env.XDG_CACHE_HOME || resolve(home, ".cache"), prefixBare),
-		mode: "xdg"
-	};
-	return single(legacyHomeDir, "default");
-}
-function single(base, mode) {
-	return {
-		configDir: base,
-		dataDir: base,
-		stateDir: base,
-		cacheDir: base,
-		mode
-	};
-}
-//#endregion
 //#region src/tools/path-suggest.ts
 function entryPath$2(entry) {
 	return typeof entry === "string" ? entry : entry.path;
@@ -5068,6 +5455,12 @@ function describeChildRuns(session) {
 	if (childRuns.length === 0) return "No child runs exist in this session.";
 	return childRuns.map((r, i) => `- ${r.label ?? `child-${i + 1}`} · ${r.status} · ${r.prompt.slice(0, 80)}`).join("\n");
 }
+/**
+* Reserve the next `child-N` label for this session. Exported so the durable
+* (child-as-invocation) spawn tool in `src/restate/spawn.ts` allocates labels
+* from the same session-anchored counter — otherwise the two tools would number
+* children independently and a session that used both would collide.
+*/
 function reserveChildLabel(session) {
 	let counter = sessionChildCounters.get(session);
 	if (counter === void 0) {
@@ -5444,6 +5837,7 @@ function buildSpawnTool(options, state) {
 			}, state);
 		},
 		isConcurrencySafe: true,
+		runsNestedAgent: true,
 		spec: {
 			name: "spawn",
 			description: `Spawn a sub-agent for a self-contained task that benefits from isolation (separate context window, separate retries): for example, a deep research dive or a long codegen pass on a specific file. The sub-agent inherits your tool set (including \`spawn\` itself, depth-capped) and your system prompt unless overridden, runs independently, and returns its final response. Do NOT spawn for sequential steps you could do yourself.${modelCatalog ? " Children can run on a DIFFERENT model via the `model` field: cost-tier your delegation: mechanical, parallelizable, or high-volume search work belongs on cheaper/faster models, while synthesis and judgment stay on your own model." : ""}${options.persist ? " A stopped or failed sub-agent can be CONTINUED instead of restarted: pass `resume` with its child label (e.g. \"child-2\") and put the continuation instruction in `task`; the child picks up with its prior conversation intact." : ""}`,
@@ -5585,15 +5979,31 @@ function buildSpawnTool(options, state) {
 					...ctx.behavior !== void 0 ? { behavior: ctx.behavior } : {}
 				};
 				const sharedReadState = options.shareReadState ? resolveReadStateMap(ctx) : void 0;
+				const journaledDeadlineMs = ctx.clock?.journaled === true && options.timeoutMs !== void 0 && options.timeoutMs > 0 ? options.timeoutMs : void 0;
 				const agent = createAgent({
 					...parentPreset,
 					...options.preset,
 					...inheritedMcp.mcpConnector !== void 0 && options.preset?.mcpServers === void 0 ? { mcpConnector: inheritedMcp.mcpConnector } : {},
 					provider: childProvider,
 					execution: ctx.execution,
+					...ctx.clock ? { clock: ctx.clock } : {},
+					...options.shareHandle && ctx.handle ? { handle: ctx.handle } : {},
 					...options.persist && ctx.session ? { session: ctx.session } : {},
 					...sharedReadState ? { readState: sharedReadState } : {}
 				});
+				let reportedStats;
+				agent.hooks.hook("agent:done", (stats) => {
+					reportedStats = stats;
+				});
+				const nowMs = () => ctx.clock ? ctx.clock.now() : Date.now();
+				const spawnStartedMs = await nowMs();
+				let deadlineExceeded = false;
+				if (journaledDeadlineMs !== void 0) agent.hooks.hook("turn:after", (turnCtx) => {
+					if (deadlineExceeded) return;
+					if (turnCtx.message.createdAt - spawnStartedMs < journaledDeadlineMs) return;
+					deadlineExceeded = true;
+					agent.abort();
+				});
 				if (forwardHooks) {
 					const unregisterEnricher = agent.hooks.hook("tool:before", async (toolCtx) => {
 						if (toolCtx.name !== "write_file" && toolCtx.name !== "edit" && toolCtx.name !== "multi_edit") return;
@@ -5614,6 +6024,7 @@ function buildSpawnTool(options, state) {
 				const spawnHookCtx = {
 					id,
 					task,
+					...ctx.callId ? { callId: ctx.callId } : {},
 					...resumeLabel !== void 0 ? { resumesChildId: resumeLabel } : {},
 					depth: childDepth,
 					model: announcedModel,
@@ -5631,48 +6042,54 @@ function buildSpawnTool(options, state) {
 					signal: ctx.signal,
 					depth: childDepth,
 					...options.persist && ctx.runId ? { parentRunId: ctx.runId } : {},
+					...ctx.callId ? { parentCallId: ctx.callId } : {},
 					...options.persist && ctx.session ? { runLabel: id } : {},
 					...resumeRun ? { resumeRunId: resumeRun.id } : {},
 					...propagatedTracing ? { tracingContext: propagatedTracing } : {}
 				});
 				try {
-					finalStats = await raceWithTimeout(runPromise, options.timeoutMs);
+					finalStats = await raceWithTimeout(runPromise, journaledDeadlineMs === void 0 ? options.timeoutMs : void 0);
 					const treeTurns = flattenTurns(finalStats).length;
 					const usage = formatTokenUsage(finalStats);
-					if (ctx.signal.aborted) {
+					const elapsedMs = await nowMs() - spawnStartedMs;
+					if (deadlineExceeded) {
+						childRunStatus = "timeout";
+						result = `[sub-agent ${id}] Timed out after ${journaledDeadlineMs}ms`;
+					} else if (ctx.signal.aborted) {
 						childRunStatus = "aborted";
-						result = [`[sub-agent ${id}] Aborted after ${treeTurns} turns (${finalStats.elapsed}ms)`, `Tokens: ${usage}`].join("\n");
+						result = [`[sub-agent ${id}] Aborted after ${treeTurns} turns (${elapsedMs}ms)`, `Tokens: ${usage}`].join("\n");
 					} else {
 						const response = extractText(agent.turns.at(-1));
 						responseText = response ?? "";
 						result = [
-							`[sub-agent ${id}] Completed in ${treeTurns} turns (${finalStats.elapsed}ms)`,
+							`[sub-agent ${id}] Completed in ${treeTurns} turns (${elapsedMs}ms)`,
 							`Tokens: ${usage}`,
 							"",
 							response || "(no text response)"
 						].join("\n");
 					}
 				} catch (err) {
-					if (err instanceof SpawnTimeoutError) {
+					const timedOutAfterMs = err instanceof SpawnTimeoutError ? err.timeoutMs : deadlineExceeded ? journaledDeadlineMs : void 0;
+					if (timedOutAfterMs !== void 0) {
 						childRunStatus = "timeout";
 						agent.abort();
 						try {
 							finalStats = await runPromise;
 						} catch {
-							finalStats = {
+							finalStats = reportedStats ?? {
 								totalIn: 0,
 								totalOut: 0,
 								totalCacheRead: 0,
 								totalCacheCreation: 0,
 								turns: 0,
-								elapsed: err.timeoutMs
+								elapsed: timedOutAfterMs
 							};
 						}
-						result = `[sub-agent ${id}] Timed out after ${err.timeoutMs}ms`;
+						result = `[sub-agent ${id}] Timed out after ${timedOutAfterMs}ms`;
 					} else {
 						const error = err instanceof Error ? err : new Error(String(err));
 						childRunStatus = "error";
-						finalStats = {
+						finalStats = reportedStats ?? {
 							totalIn: 0,
 							totalOut: 0,
 							totalCacheRead: 0,
@@ -5684,6 +6101,7 @@ function buildSpawnTool(options, state) {
 						await ctx.hooks.callHook("spawn:error", {
 							id,
 							task,
+							...ctx.callId ? { callId: ctx.callId } : {},
 							depth: childDepth,
 							model: announcedModel,
 							provider: childProvider.name,
@@ -5692,7 +6110,7 @@ function buildSpawnTool(options, state) {
 					}
 				} finally {
 					const childHandle = agent.handle;
-					if (childHandle && ctx.execution.reassignBackgroundTasks) try {
+					if (childHandle && childHandle.id !== ctx.handle.id && ctx.execution.reassignBackgroundTasks) try {
 						const reassigned = await ctx.execution.reassignBackgroundTasks(childHandle, ctx.handle, (info) => {
 							Promise.resolve(ctx.hooks.callHook("background:exit", info)).catch(() => {});
 						});
@@ -5726,6 +6144,7 @@ function buildSpawnTool(options, state) {
 				const childRunStats = {
 					id,
 					task,
+					...ctx.callId ? { callId: ctx.callId } : {},
 					stats: finalStats,
 					depth: childDepth,
 					status: childRunStatus,
@@ -5736,6 +6155,7 @@ function buildSpawnTool(options, state) {
 				if (destroyError) await ctx.hooks.callHook("spawn:error", {
 					id,
 					task,
+					...ctx.callId ? { callId: ctx.callId } : {},
 					depth: childDepth,
 					model: announcedModel,
 					provider: childProvider.name,
@@ -6262,6 +6682,58 @@ function warnUnsafeKey(logger, method, key) {
 	logger.warn(`${method}: refused unsafe key`, { key });
 }
 /**
+* Resolve a path inside one extension's storage root for the given scope.
+*
+* A module-level function (rather than a closure inside `makeContext`) so
+* `ctx.loadAgentPlugin` can derive its `${PLUGIN_DATA}` parent from the same
+* rules without depending on declaration order within the context builder.
+*/
+function extensionStoragePath(paths, extensionName, scope, ...segments) {
+	const root = resolve(scope === "cache" ? paths.cacheDir : scope === "data" ? paths.dataDir : scope === "project" || scope === "session" ? paths.projectRoot ?? paths.dataDir : paths.configDir ?? paths.dataDir, "extensions", extensionName);
+	const target = resolve(root, ...segments);
+	if (target !== root && !target.startsWith(root + sep)) return root;
+	return target;
+}
+/**
+* Stamp the contributing extension onto a skill.
+*
+* `SkillConfig.source` carries the scope (project / user / inline) and is
+* defaulted here for extensions that don't set it. The extension NAME goes in
+* `metadata` under the `zidane.` prefix the Agent Skills spec reserves for
+* client-specific keys, so the skill stays spec-conformant while a host UI can
+* still say which extension shipped it.
+*/
+function withProvenance(skill, source, extensionName) {
+	return {
+		...skill,
+		source: skill.source ?? source,
+		metadata: {
+			...skill.metadata,
+			"zidane.extension": extensionName
+		}
+	};
+}
+/**
+* Rejected-plugin placeholder for `ctx.loadAgentPlugin` calls that never
+* reach the loader (missing `dir`, or a late call after `setup` resolved).
+* Returning a `LoadedPlugin` with `ok: false` rather than throwing keeps the
+* method's contract uniform — callers branch on `ok`, never on exceptions.
+*/
+function emptyPluginHandle(dir) {
+	return {
+		ok: false,
+		dir,
+		root: dir,
+		skills: [],
+		mcpServers: [],
+		components: {
+			skills: "unsupported",
+			mcp: "unsupported"
+		},
+		diagnostics: []
+	};
+}
+/**
 * Build the merged registry. `loaded` typically comes from
 * `discoverExtensions()` plus any inline ones via `inlineLoadedExtension`.
 *
@@ -6307,6 +6779,7 @@ async function buildExtensionRegistry(loaded, options = {}) {
 			hooks: {},
 			mcpServers: [],
 			skills: [],
+			plugins: [],
 			systemFragments: [],
 			contextBreakdownSections: [],
 			contextPanelSections: [],
@@ -6467,6 +6940,7 @@ function captureContributions(perExtSinks) {
 		hooks: perExtSinks.hooks,
 		mcpServers: perExtSinks.mcpServers,
 		skills: perExtSinks.skills,
+		plugins: perExtSinks.plugins,
 		systemFragments: perExtSinks.systemFragments,
 		contextBreakdownSections: perExtSinks.contextBreakdownSections,
 		contextPanelSections: perExtSinks.contextPanelSections,
@@ -6544,6 +7018,7 @@ function mergeContributions(active, inactive = [], options = {}) {
 	const hooks = {};
 	const mcpServers = [];
 	const skills = [];
+	const plugins = [];
 	const systemFragments = [];
 	const contextBreakdownSections = [];
 	const contextPanelSections = [];
@@ -6586,6 +7061,7 @@ function mergeContributions(active, inactive = [], options = {}) {
 		}
 		mcpServers.push(...c.mcpServers);
 		skills.push(...c.skills);
+		plugins.push(...c.plugins);
 		systemFragments.push(...c.systemFragments);
 		contextBreakdownSections.push(...c.contextBreakdownSections);
 		contextPanelSections.push(...c.contextPanelSections);
@@ -6659,6 +7135,7 @@ function mergeContributions(active, inactive = [], options = {}) {
 		hooks,
 		mcpServers,
 		skills,
+		plugins,
 		systemFragments,
 		contextBreakdownSections,
 		contextPanelSections,
@@ -6777,6 +7254,46 @@ function filterExtensionRegistry(registry, enabled) {
 	const filteredOut = registry.loaded.filter((ext) => !allow.has(ext.name));
 	return mergeContributions(filteredActive, [...registry.inactive, ...filteredOut]);
 }
+/**
+* Drop the contributions of Agent Plugins the user has disabled.
+*
+* `filterExtensionRegistry` keys on EXTENSION names, so it can't express
+* "this extension runs, but the plugin it loaded does not". Plugin skills and
+* MCP servers are fanned into the loading extension's sinks by
+* `ctx.loadAgentPlugin`, which means without this pass `enabledPlugins` would
+* render a checkbox that changes nothing for extension-loaded plugins.
+*
+* Skills are matched by `metadata['zidane.plugin']` (stamped by the loader);
+* MCP servers carry no such marker, so they're matched by identity against
+* the server list on each {@link LoadedPluginRecord}.
+*
+* Returns the input registry unchanged when nothing is disabled, so callers
+* can compare identity to skip recomposing.
+*/
+function filterRegistryPlugins(registry, enabledPlugins, shadowed) {
+	if (registry.plugins.length === 0) return registry;
+	const allow = enabledPlugins === void 0 ? null : new Set(enabledPlugins);
+	const dropped = registry.plugins.filter((record) => allow !== null && !allow.has(record.name) || shadowed?.has(record.name) === true);
+	if (dropped.length === 0) return registry;
+	const droppedNames = new Set(dropped.map((record) => record.name));
+	const droppedServers = new Set(dropped.flatMap((record) => record.plugin.mcpServers));
+	const prune = (ext) => {
+		const contributions = ext.contributions;
+		if (!contributions || contributions.plugins.length === 0) return ext;
+		return {
+			...ext,
+			contributions: {
+				...contributions,
+				skills: contributions.skills.filter((skill) => {
+					const owner = skill.metadata?.["zidane.plugin"];
+					return owner === void 0 || !droppedNames.has(owner);
+				}),
+				mcpServers: contributions.mcpServers.filter((server) => !droppedServers.has(server))
+			}
+		};
+	};
+	return mergeContributions(registry.loaded.map(prune), registry.inactive);
+}
 /** Dispose resources owned by an extension registry. Idempotent per registry. */
 async function disposeExtensionRegistry(registry) {
 	await registry.dispose();
@@ -6845,10 +7362,50 @@ function makeContext(opts) {
 			logger.warn("registerSkill: missing name");
 			return;
 		}
-		sinks.skills.push({
-			...skill,
-			source: skill.source ?? source
+		sinks.skills.push(withProvenance(skill, source, definition.name));
+	};
+	const loadPlugin = async (spec) => {
+		const options = typeof spec === "string" ? { dir: spec } : spec;
+		const requested = options?.dir;
+		if (typeof requested !== "string" || requested.length === 0) {
+			logger.warn("loadAgentPlugin: missing dir");
+			return emptyPluginHandle("");
+		}
+		if (!guardOpen("loadAgentPlugin")) return emptyPluginHandle(requested);
+		const target = isAbsolute(requested) ? requested : resolve(dir ?? paths.cwd, requested);
+		const loaded = await loadAgentPlugin(target, {
+			source,
+			dataRoot: extensionStoragePath(paths, definition.name, "data", "plugin-data"),
+			...options.skills !== void 0 ? { skills: options.skills } : {},
+			...options.mcp !== void 0 ? { mcp: options.mcp } : {},
+			...options.namePrefix !== void 0 ? { namePrefix: options.namePrefix } : {}
+		});
+		for (const diagnostic of loaded.diagnostics) {
+			const detail = {
+				plugin: loaded.manifest?.name ?? target,
+				code: diagnostic.code,
+				...diagnostic.path ? { path: diagnostic.path } : {}
+			};
+			if (diagnostic.severity === "error") logger.error(`loadAgentPlugin: ${diagnostic.message}`, detail);
+			else logger.warn(`loadAgentPlugin: ${diagnostic.message}`, detail);
+		}
+		if (!guardOpen("loadAgentPlugin (completed after setup resolved)")) return loaded;
+		if (loaded.ok) {
+			for (const skill of loaded.skills) sinks.skills.push(withProvenance(skill, source, definition.name));
+			for (const config of loaded.mcpServers) sinks.mcpServers.push(config);
+		}
+		sinks.plugins.push({
+			name: loaded.manifest?.name ?? basename(target),
+			extensionName: definition.name,
+			dir: target,
+			plugin: loaded
+		});
+		logger.debug("loadAgentPlugin: registered", {
+			plugin: loaded.manifest?.name,
+			skills: loaded.skills.length,
+			mcpServers: loaded.mcpServers.length
 		});
+		return loaded;
 	};
 	const registerCompletionProvider = (provider) => {
 		if (!guardOpen("registerCompletionProvider")) return;
@@ -7231,12 +7788,7 @@ function makeContext(opts) {
 		const persisted = readSettings?.()?.extensionConfig?.[definition.name]?.[key];
 		return resolveExtensionConfigValue(item, persisted);
 	} };
-	const storageSurface = { path: (scope, ...segments) => {
-		const root = resolve(scope === "cache" ? paths.cacheDir : scope === "data" ? paths.dataDir : scope === "project" || scope === "session" ? paths.projectRoot ?? paths.dataDir : paths.configDir ?? paths.dataDir, "extensions", definition.name);
-		const target = resolve(root, ...segments);
-		if (target !== root && !target.startsWith(root + sep)) return root;
-		return target;
-	} };
+	const storageSurface = { path: (scope, ...segments) => extensionStoragePath(paths, definition.name, scope, ...segments) };
 	const sessionSurface = {
 		get: (key) => getExtensionSessionState(currentExtensionSession(), definition.name, key),
 		set: (key, value) => setExtensionSessionState(currentExtensionSession(), definition.name, key, value),
@@ -7347,6 +7899,7 @@ function makeContext(opts) {
 		registerHook,
 		registerMcpServer,
 		registerSkill,
+		loadAgentPlugin: loadPlugin,
 		registerCompletionProvider,
 		registerInlineAutocompleteProvider,
 		registerCommand,
@@ -7997,6 +8550,7 @@ const EMPTY_EXTENSION_REGISTRY = Object.freeze({
 	hooks: Object.freeze({}),
 	mcpServers: Object.freeze([]),
 	skills: Object.freeze([]),
+	plugins: Object.freeze([]),
 	systemFragments: Object.freeze([]),
 	contextBreakdownSections: Object.freeze([]),
 	contextPanelSections: Object.freeze([]),
@@ -12511,6 +13065,7 @@ function buildToolHookBase(ctx, turnId, callId, name, displayName, input) {
 		input,
 		...ctx.runId !== void 0 ? { runId: ctx.runId } : {},
 		...ctx.parentRunId !== void 0 ? { parentRunId: ctx.parentRunId } : {},
+		...ctx.parentCallId !== void 0 ? { parentCallId: ctx.parentCallId } : {},
 		...typeof ctx.depth === "number" ? { depth: ctx.depth } : {}
 	};
 }
@@ -12722,6 +13277,7 @@ async function runSingleToolDispatch(ctx, call, turnId, fixed) {
 			callId,
 			runId: ctx.runId,
 			...ctx.parentRunId !== void 0 ? { parentRunId: ctx.parentRunId } : {},
+			...ctx.parentCallId !== void 0 ? { parentCallId: ctx.parentCallId } : {},
 			...ctx.session ? { session: ctx.session } : {},
 			...ctx.readState ? { readState: ctx.readState } : {},
 			...ctx.toolState ? { state: ctx.toolState.begin(callId) } : {},
@@ -13322,6 +13878,7 @@ async function startDurableToolExecution(ctx, call, turnId, index) {
 		callId,
 		runId: ctx.runId,
 		...ctx.parentRunId !== void 0 ? { parentRunId: ctx.parentRunId } : {},
+		...ctx.parentCallId !== void 0 ? { parentCallId: ctx.parentCallId } : {},
 		...ctx.session ? { session: ctx.session } : {},
 		...ctx.readState ? { readState: ctx.readState } : {},
 		...ctx.toolState ? { state: ctx.toolState.begin(callId) } : {},
@@ -13703,6 +14260,221 @@ function createToolCancelRegistry(options = {}) {
 	};
 }
 //#endregion
+//#region src/tool-state.ts
+/**
+* Durable key/value state for tools.
+*
+* A tool reaches this through {@link ToolContext.state} — a plain,
+* SYNCHRONOUS map view. Synchronous is not a convenience choice: under a
+* durable-execution runtime the tool body runs inside a journaled action
+* (Restate's `ctx.run`), and a durable read (`ctx.get`) is illegal in
+* there. So the flow is split into three phases the runtime can journal
+* independently:
+*
+*   1. **hydrate** — load the snapshot ONCE per agent, outside any
+*      journaled action, before the first tool dispatch.
+*   2. **stage** — the tool mutates its per-call view. Mutations are
+*      recorded as an ordered {@link ToolStateOp} list, NOT written
+*      through: they're plain data, so a durable adapter can journal them
+*      alongside the tool result.
+*   3. **commit** — the loop applies the staged ops through
+*      {@link ToolStateStore.commit} after the call settles, outside the
+*      journaled action.
+*
+* The invariant that makes this replay-safe:
+*
+* > A staged mutation is committed only if it came back OUT of a journal
+* > entry.
+*
+* A durable adapter (see `restateTool`) reads {@link StagedToolState.pending}
+* from inside its journaled closure, ships the ops out as part of the
+* journaled value, and calls {@link StagedToolState.restore} outside it. On
+* replay the tool body never runs, so nothing is staged live — `restore`
+* re-seeds the exact same ops from the journal and the commit re-issues an
+* identical write. Paths that produced no journal entry (a fatal error, a
+* control abort, a dead attempt) call {@link StagedToolState.clear} so live
+* mutations from an attempt nobody recorded can never reach the store.
+*
+* The store seam is deliberately runtime-agnostic: `zidane/restate` ships
+* `restateToolStateStore`, but a Redis / Postgres / file-backed
+* implementation is the same two methods. With no store configured the
+* controller is in-memory only — `ctx.state` still works everywhere
+* (local CLI, tests, subagents), it just doesn't outlive the process.
+*/
+/**
+* Default per-value size budget: 64 KiB of JSON.
+*
+* Deliberately far below any backend's hard ceiling (Restate's journal-entry
+* limit is 32 MiB) because this is a design guard, not a protocol limit.
+* Durable tool state is for flags, ids, counters, and cursors; a value that
+* doesn't fit in 64 KiB is a payload, and payloads belong in the tool result
+* or in storage the tool owns. Raise it on the store if you disagree — but
+* know that everything here is rewritten on every commit.
+*/
+const DEFAULT_MAX_VALUE_BYTES = 64 * 1024;
+/** Brand so {@link stagedToolState} can recognise views this module made. */
+const STAGED = Symbol("zidane.toolState.staged");
+/**
+* Resolve the staging handle behind a view. Returns `undefined` for a
+* missing view or a foreign implementation (a host that supplied its own
+* `ToolStateView`), which lets adapters degrade to "no durable staging"
+* instead of throwing.
+*/
+function stagedToolState(view) {
+	if (!view) return void 0;
+	return view[STAGED] ?? void 0;
+}
+function createToolStateController(store) {
+	const snapshot = /* @__PURE__ */ new Map();
+	const views = /* @__PURE__ */ new Map();
+	const maxValueBytes = store?.maxValueBytes ?? 65536;
+	let hydrated;
+	const hydrate = () => {
+		if (hydrated) return hydrated;
+		hydrated = (async () => {
+			if (!store) return;
+			const loaded = await store.load();
+			for (const [key, value] of Object.entries(loaded ?? {})) if (!snapshot.has(key)) snapshot.set(key, value);
+		})().catch((err) => {
+			hydrated = void 0;
+			throw err;
+		});
+		return hydrated;
+	};
+	const begin = (callId) => {
+		const existing = views.get(callId);
+		if (existing) return existing;
+		const view = createStagingView(snapshot, maxValueBytes);
+		views.set(callId, view);
+		return view;
+	};
+	const commit = async (callId) => {
+		const view = views.get(callId);
+		if (!view) return;
+		views.delete(callId);
+		const ops = view[STAGED].pending();
+		if (ops.length === 0) return;
+		await store?.commit(ops);
+		applyOps(snapshot, ops);
+	};
+	return {
+		hydrate,
+		begin,
+		commit,
+		discard: (callId) => {
+			views.delete(callId);
+		},
+		pending: (callId) => views.get(callId)?.[STAGED].pending() ?? [],
+		snapshot: () => Object.fromEntries(snapshot)
+	};
+}
+/**
+* Build a view over `snapshot` that records writes instead of applying
+* them. Reads layer staged ops on top of the snapshot so a tool sees its
+* own writes back — including deletions, which read as absent.
+*/
+function createStagingView(snapshot, maxValueBytes) {
+	let ops = [];
+	const latest = /* @__PURE__ */ new Map();
+	const stage = (op) => {
+		ops.push(op);
+		latest.set(op.key, op);
+	};
+	const resolve = (key) => {
+		const staged = latest.get(key);
+		if (staged) return staged.delete === true ? { present: false } : {
+			present: true,
+			value: staged.value
+		};
+		return snapshot.has(key) ? {
+			present: true,
+			value: snapshot.get(key)
+		} : { present: false };
+	};
+	const view = {
+		get: (key) => {
+			const resolved = resolve(key);
+			return resolved.present ? resolved.value : void 0;
+		},
+		set: (key, value) => {
+			assertStorable(key, value, maxValueBytes);
+			if (value === void 0) stage({
+				key,
+				delete: true
+			});
+			else stage({
+				key,
+				value
+			});
+		},
+		delete: (key) => {
+			stage({
+				key,
+				delete: true
+			});
+		},
+		has: (key) => resolve(key).present,
+		keys: () => {
+			const keys = new Set(snapshot.keys());
+			for (const [key, op] of latest) if (op.delete === true) keys.delete(key);
+			else keys.add(key);
+			return [...keys].sort();
+		},
+		[STAGED]: {
+			pending: () => [...ops],
+			restore: (restored) => {
+				ops = [...restored];
+				latest.clear();
+				for (const op of ops) latest.set(op.key, op);
+			},
+			clear: () => {
+				ops = [];
+				latest.clear();
+			}
+		}
+	};
+	Object.defineProperty(view, STAGED, {
+		value: view[STAGED],
+		enumerable: false
+	});
+	return view;
+}
+/**
+* Reject a value that can't survive the trip to the store, at the moment the
+* tool stages it.
+*
+* Scalars are skipped: they're bounded, and paying a `JSON.stringify` per
+* `set` on a hot tool would be a real cost for no signal. Strings and objects
+* are measured in UTF-8 bytes, which is what both the journal and the store
+* actually spend.
+*/
+function assertStorable(key, value, maxValueBytes) {
+	if (value === void 0 || value === null || typeof value === "boolean" || typeof value === "number") return;
+	if (typeof value === "function" || typeof value === "symbol" || typeof value === "bigint") throw new TypeError(`tool state value for "${key}" is a ${typeof value}, which cannot cross a durable store — use a JSON-serializable value.`);
+	let json;
+	try {
+		json = typeof value === "string" ? value : JSON.stringify(value) ?? "";
+	} catch (err) {
+		throw new TypeError(`tool state value for "${key}" is not JSON-serializable (${err instanceof Error ? err.message : String(err)}) — durable tool state crosses a journal, so cycles and exotic values can't be stored.`);
+	}
+	const bytes = Buffer.byteLength(json, "utf8");
+	if (bytes > maxValueBytes) throw new RangeError(`tool state value for "${key}" is ${formatBytes(bytes)}, over the ${formatBytes(maxValueBytes)} limit. Durable tool state is for flags, ids, counters, and cursors — it is rewritten on every commit and crosses a journal entry. Keep the payload in the tool result or in storage the tool owns, and store a reference here.`);
+}
+function formatBytes(bytes) {
+	if (bytes < 1024) return `${bytes} B`;
+	if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+	return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+/** Apply ops to a snapshot map in order — last write per key wins. */
+function applyOps(snapshot, ops) {
+	for (const op of ops) if (op.delete === true) snapshot.delete(op.key);
+	else snapshot.set(op.key, op.value);
+}
+/** Runtime guard for a journaled op list — adapters validate before restoring. */
+function isToolStateOps(value) {
+	return Array.isArray(value) && value.every((op) => typeof op === "object" && op !== null && typeof op.key === "string" && (op.delete === true || "value" in op));
+}
+//#endregion
 //#region src/agent.ts
 /**
 * Single builder for a {@link ContextAssembly}, shared by the per-run snapshot
@@ -15406,6 +16178,7 @@ function createAgent(rawOptions) {
 					...agentReadState ? { readState: agentReadState } : {},
 					toolState: toolStateController,
 					...options.parentRunId ? { parentRunId: options.parentRunId } : {},
+					...options.parentCallId ? { parentCallId: options.parentCallId } : {},
 					depth: runDepth,
 					thinkingBudget,
 					...taskBudget !== void 0 ? { taskBudget } : {},
@@ -16024,6 +16797,6 @@ function createAgent(rawOptions) {
 	};
 }
 //#endregion
-export { removeInstalledExtension as $, readKeybindings as $t, NO_TOOLS_PREAMBLE as A, looksBinary as At, stripImagesFromTurns as B, validateToolArgs as Bt, resolveTasksDir as C, shouldAutoCompact as Cn, createSkillsRunScriptTool as Ct, selectRecentFiles as D, stableStringify as Dn, shell as Dt, selectFilesFromSession as E, normalizeShellCommand as En, createShellTool as Et, buildTailCompactPrompt as F, listFiles as Ft, EMPTY_EXTENSION_REGISTRY as G, KEYBINDING_KEY_COL_WIDTH as Gt, truncateHeadForPtlRetry as H, DEFAULT_KEYBINDINGS as Ht, buildUpToCompactPrompt as I, createInteractionTool as It, fetchExtensionSource as J, groupBindings as Jt, createExtensionPromptBridge as K, ensureKeybindingsFile as Kt, ANCHOR_PREVIEW_MAX_CHARS as L, grep as Lt, buildCompactPrompt as M, createModelSearchTool as Mt, buildFromCompactPrompt as N, formatModelLine as Nt, compactConversation as O, tailTruncate as Ot, buildFullCompactPrompt as P, matchModelEntries as Pt, readExtensionInstallProvenance as Q, parseBindingSpec as Qt, anchorPreviewFor as R, glob as Rt, resolveSessionDir as S, effectiveContextWindow as Sn, createSkillsUseTool as St, selectFilesFromReadState as T, defaultRepeatGuardTracked as Tn, shellKill as Tt, CompactInvalidInputError as U, KEYBINDING_DEFS as Ut, summaryToTurn as V, resolveStorageDirs as Vt, CompactPromptTooLongError as W, KEYBINDING_DEF_BY_ACTION as Wt, listExtensionCandidates as X, matchesBinding as Xt, installExtensionFromSpec as Y, keybindingsPath as Yt, parseExtensionInstallSource as Z, mergeKeybindings as Zt, rehomePersistedStubs as _, resolveExtensionConfigValue as _n, WAIT_TASK_TIMED_OUT_PREFIX as _t, SHELL_CASCADE_CANCEL_MESSAGE as a, defaultExtensionScanPaths as an, composeExtensionPreset as at, resolveMcpWarningsDir as b, AUTO_COMPACT_MIN_GROWTH_FRACTION as bn, createSpawnTool as bt, applyCompactSummaryCutoff as c, isExtensionDefinition as cn, mergeContributions as ct, PERSISTED_STUB_PREFIX as d, defineExtension as dn, createWorkspaceSurface as dt, readKeybindingsRaw as en, updateInstalledExtension as et, PERSISTENCE_PREVIEW_BYTES as f, clampExtensionConfigNumber as fn, composePresets as ft, migrateSessionArtifactDirs as g, resolveExtensionConfig as gn, writeFile$1 as gt, maybePersistToolResult as h, isValidExtensionConfigValue as hn, basic_default as ht, INTERRUPT_MESSAGE_FOR_TOOL_USE as i, ENTRY_CANDIDATES as in, buildExtensionRegistry as it, TRAILER as j, multiEdit as jt, BASE_INSTRUCTIONS as k, readFile$1 as kt, collectNewlyStaleReadPaths as l, parseExtensionScanPathEnv as ln, partitionExtensionCatalog as lt, cleanupPersistedSession as m, isValidExtensionConfigItem as mn, basicTools as mt, normalizeProviders as n, stripJsonComments as nn, discoverAndBuildExtensionRegistry as nt, TOOL_USE_CANCELLED_MESSAGE as o, discoverExtensions as on, disposeExtensionRegistry as ot, buildPersistedStub as p, coerceExtensionConfigInput as pn, definePreset as pt, ExtensionInstallError as q, formatBindingForDisplay as qt, resolveModelTargets as r, registerExtensionHostModules as rn, buildExtensionPreset as rt, TOOL_USE_SKIPPED_MESSAGE as s, inlineLoadedExtension as sn, filterExtensionRegistry as st, createAgent as t, resolveExtensionKeybindings as tn, createExtensionHud as tt, renderStaleReadNotice as u, scanExtensionDirectories as un, createExtensionHostRuntimeBridge as ut, resolveLegacyPersistDir as v, sanitizeExtensionConfigActionPatch as vn, waitTask as vt, buildPostCompactAttachments as w, defaultRepeatGuardNormalize as wn, createSkillsReadTool as wt, resolvePersistDir as x, OUTPUT_RESERVE_TOKENS as xn, isSpawnTool as xt, resolveLegacySessionDir as y, toWireConfigSchema as yn, createToolSearchTool as yt, sliceForCompaction as z, edit as zt };
+export { installExtensionFromSpec as $, groupBindings as $t, selectFilesFromSession as A, defaultRepeatGuardNormalize as An, createSkillsReadTool as At, buildUpToCompactPrompt as B, matchModelEntries as Bt, resolveLegacySessionDir as C, resolveExtensionConfigValue as Cn, waitTask as Ct, resolveTasksDir as D, OUTPUT_RESERVE_TOKENS as Dn, reserveChildLabel as Dt, resolveSessionDir as E, AUTO_COMPACT_MIN_GROWTH_FRACTION as En, isSpawnTool as Et, TRAILER as F, hashContent as Fn, readFile$1 as Ft, summaryToTurn as G, edit as Gt, anchorPreviewFor as H, createInteractionTool as Ht, buildCompactPrompt as I, hydrateReadStateFromSession as In, looksBinary as It, CompactPromptTooLongError as J, KEYBINDING_DEFS as Jt, truncateHeadForPtlRetry as K, validateToolArgs as Kt, buildFromCompactPrompt as L, hydrateReadStateFromSessionAsync as Ln, multiEdit as Lt, compactConversation as M, normalizeShellCommand as Mn, createShellTool as Mt, BASE_INSTRUCTIONS as N, stableStringify as Nn, shell as Nt, buildPostCompactAttachments as O, effectiveContextWindow as On, createSkillsUseTool as Ot, NO_TOOLS_PREAMBLE as P, getReadState as Pn, tailTruncate as Pt, fetchExtensionSource as Q, formatBindingForDisplay as Qt, buildFullCompactPrompt as R, readStateKey as Rn, createModelSearchTool as Rt, resolveLegacyPersistDir as S, resolveExtensionConfig as Sn, WAIT_TASK_TIMED_OUT_PREFIX as St, resolvePersistDir as T, toWireConfigSchema as Tn, createSpawnTool as Tt, sliceForCompaction as U, grep as Ut, ANCHOR_PREVIEW_MAX_CHARS as V, listFiles as Vt, stripImagesFromTurns as W, glob as Wt, createExtensionPromptBridge as X, KEYBINDING_KEY_COL_WIDTH as Xt, EMPTY_EXTENSION_REGISTRY as Y, KEYBINDING_DEF_BY_ACTION as Yt, ExtensionInstallError as Z, ensureKeybindingsFile as Zt, buildPersistedStub as _, defineExtension as _n, composePresets as _t, stagedToolState as a, readKeybindingsRaw as an, createExtensionHud as at, migrateSessionArtifactDirs as b, isValidExtensionConfigItem as bn, basic_default as bt, INTERRUPT_MESSAGE_FOR_TOOL_USE as c, registerExtensionHostModules as cn, buildExtensionRegistry as ct, TOOL_USE_SKIPPED_MESSAGE as d, discoverExtensions as dn, filterExtensionRegistry as dt, keybindingsPath as en, listExtensionCandidates as et, applyCompactSummaryCutoff as f, inlineLoadedExtension as fn, filterRegistryPlugins as ft, PERSISTENCE_PREVIEW_BYTES as g, createDebugLog as gn, createWorkspaceSurface as gt, PERSISTED_STUB_PREFIX as h, scanExtensionDirectories as hn, createExtensionHostRuntimeBridge as ht, isToolStateOps as i, readKeybindings as in, updateInstalledExtension as it, selectRecentFiles as j, defaultRepeatGuardTracked as jn, shellKill as jt, selectFilesFromReadState as k, shouldAutoCompact as kn, createSkillsRunScriptTool as kt, SHELL_CASCADE_CANCEL_MESSAGE as l, ENTRY_CANDIDATES as ln, composeExtensionPreset as lt, renderStaleReadNotice as m, parseExtensionScanPathEnv as mn, partitionExtensionCatalog as mt, DEFAULT_MAX_VALUE_BYTES as n, mergeKeybindings as nn, readExtensionInstallProvenance as nt, normalizeProviders as o, resolveExtensionKeybindings as on, discoverAndBuildExtensionRegistry as ot, collectNewlyStaleReadPaths as p, isExtensionDefinition as pn, mergeContributions as pt, CompactInvalidInputError as q, DEFAULT_KEYBINDINGS as qt, createToolStateController as r, parseBindingSpec as rn, removeInstalledExtension as rt, resolveModelTargets as s, stripJsonComments as sn, buildExtensionPreset as st, createAgent as t, matchesBinding as tn, parseExtensionInstallSource as tt, TOOL_USE_CANCELLED_MESSAGE as u, defaultExtensionScanPaths as un, disposeExtensionRegistry as ut, cleanupPersistedSession as v, clampExtensionConfigNumber as vn, definePreset as vt, resolveMcpWarningsDir as w, sanitizeExtensionConfigActionPatch as wn, createToolSearchTool as wt, rehomePersistedStubs as x, isValidExtensionConfigValue as xn, writeFile$1 as xt, maybePersistToolResult as y, coerceExtensionConfigInput as yn, basicTools as yt, buildTailCompactPrompt as z, resolveReadStateMap as zn, formatModelLine as zt };
 
-//# sourceMappingURL=agent-8sUadp5M.js.map
+//# sourceMappingURL=agent-BVNkC1h4.js.map