zidane 7.0.32 → 7.1.3

package/dist/{approvals-DkwGBMZ9.js → approvals-u2T19Dc-.js}

@@ -1,37 +1,38 @@
 import { n as __require } from "./rolldown-runtime-BhDjJH2R.js";
 import { n as THINKING_LEVELS, u as toolResultToText } from "./types-CWgENVLY.js";
-import { $n as effectiveContextWindow, A as buildPostCompactAttachments, Bn as artifactKindLabel, Bt as multiEdit, D as resolvePersistDir, E as resolveMcpWarningsDir, Et as waitTask, It as shell, Jn as renderArtifactRow, Jt as edit, Kt as grep, M as selectFilesFromSession, Ot as createSpawnTool, P as compactConversation, Pt as shellKill, Qn as OUTPUT_RESERVE_TOKENS, Rt as readFile$1, S as migrateSessionArtifactDirs, Tn as createDebugLog, Wt as listFiles, Xt as artifacts_default, Z as EMPTY_EXTENSION_REGISTRY, bt as composePresets, cn as mergeKeybindings, dn as readKeybindingsRaw, dt as composeExtensionPreset, f as applyCompactSummaryCutoff, fn as resolveExtensionKeybindings, g as unwrapCallTool, k as resolveTasksDir, kt as isSpawnTool, lt as buildExtensionPreset, mt as filterRegistryPlugins, q as summaryToTurn, qt as glob, t as createAgent, wt as writeFile$1, xt as definePreset } from "./agent-BCG9JcZl.js";
-import { F as parseCommandInvocation, M as commandBlocksToContent, P as executeCommand, c as SKILL_EDIT_METADATA_KEY, g as readSkillEditMarker, j as commandBlockToEvent, l as ZIDANE_EXTENSION_SKILL_NAME, m as extensionDirForCwd, s as EXTENSION_EDIT_METADATA_KEY, u as ZIDANE_SKILL_EDIT_SKILL_NAME, v as withZidaneExtensionSkill, w as generateStructuredData, y as withZidaneSkillEditSkill } from "./src-CjkY6fBj.js";
+import { $n as effectiveContextWindow, A as buildPostCompactAttachments, Bn as artifactKindLabel, Bt as multiEdit, D as resolvePersistDir, E as resolveMcpWarningsDir, Et as waitTask, It as shell, Jn as renderArtifactRow, Jt as edit, Kt as grep, M as selectFilesFromSession, Ot as createSpawnTool, P as compactConversation, Pt as shellKill, Qn as OUTPUT_RESERVE_TOKENS, Rt as readFile$1, S as migrateSessionArtifactDirs, Tn as createDebugLog, Wt as listFiles, Xt as artifacts_default, Z as EMPTY_EXTENSION_REGISTRY, bt as composePresets, cn as mergeKeybindings, dn as readKeybindingsRaw, dt as composeExtensionPreset, f as applyCompactSummaryCutoff, fn as resolveExtensionKeybindings, g as unwrapCallTool, in as formatBindingForDisplay, k as resolveTasksDir, kt as isSpawnTool, lt as buildExtensionPreset, mt as filterRegistryPlugins, q as summaryToTurn, qt as glob, t as createAgent, wt as writeFile$1, xt as definePreset } from "./agent-_xxElOgH.js";
+import { F as parseCommandInvocation, M as commandBlocksToContent, P as executeCommand, c as SKILL_EDIT_METADATA_KEY, g as readSkillEditMarker, j as commandBlockToEvent, l as ZIDANE_EXTENSION_SKILL_NAME, m as extensionDirForCwd, s as EXTENSION_EDIT_METADATA_KEY, u as ZIDANE_SKILL_EDIT_SKILL_NAME, v as withZidaneExtensionSkill, w as generateStructuredData, y as withZidaneSkillEditSkill } from "./src-CkNQKFKr.js";
 import { a as formatDuration, c as previewLine, i as fmtTokens, l as shortId, s as formatTaskSummary, t as ageString } from "./format-BF745pLL.js";
-import { r as createProcessContext } from "./contexts-BSFQVclW.js";
+import { a as DEFAULT_UNREADABLE_DIRS, c as resolveUnreadableDirs, l as resolveWritableRoots, o as isolationAvailability, r as createProcessContext, s as parseAllowWriteSetting, u as resolveWritableRootsAsync } from "./contexts-CRE9pw07.js";
 import { u as errorMessage$1 } from "./errors-DKiMrOKq.js";
-import { L as projectUserPaths, R as findGitRoot$1, x as discoverSkills } from "./skills-PJyiSRCp.js";
+import { L as projectUserPaths, R as findGitRoot$1, x as discoverSkills } from "./skills-BC3dodWp.js";
 import { t as writeFileAtomic } from "./atomic-write-B7zr1ddF.js";
-import { n as defaultPluginDataRoot, p as resolveStorageDirs, r as loadAgentPlugin } from "./plugins-B531Tz5b.js";
+import { n as defaultPluginDataRoot, p as resolveStorageDirs, r as loadAgentPlugin } from "./plugins-gbI7SBA6.js";
 import { r as createLogger, t as consoleSink } from "./logger--C1VQjwJ.js";
 import { h as McpOAuthProvider, l as normalizeMcpServers, n as connectMcpServers, s as nonOwningMcpView } from "./mcp-CgNd-f3F.js";
 import { appendDynamicSection, joinSystemPrompt, splitSystemPrompt } from "./prompt.js";
-import { o as loadSession, t as createSession } from "./session-CVy-2mAy.js";
+import { l as withExtensionSession, o as loadSession, t as createSession } from "./session-BqRP1hS7.js";
 import { n as flattenTurns, r as formatTokenUsage } from "./stats-DAKBEKjc.js";
 import { i as installCacheBreakLogger } from "./cache-telemetry-ehVdWsg2.js";
 import { i as findActiveTriggers, n as collectReferences, o as mergeSuggestions, t as applyInsert } from "./completion-core-BRo86R_L.js";
-import { p as sanitizeProviderDiagnosticMetadata } from "./anthropic-B4UmPm4H.js";
+import { h as sanitizeProviderDiagnosticMetadata, n as THINKING_BINDING_SETTING_ENV } from "./anthropic-DPPs3wjJ.js";
 import { r as fetchUrl } from "./fetch-url-ma-5_p0p.js";
 import { webSearch } from "./tools/web-search.js";
-import { A as chunkMarkdownForRender, At as MAIN_SESSION_TITLE, Bt as renderSessionEventXml, Ft as artifactsFromTurns, It as isMainSession, J as filterChainFallbacks, Lt as orchestratedBy, Nt as SESSION_ROLE_KEY, Pt as WORKER_REPORT_FRAGMENT, Qt as formatRunReceiptLine, Rt as parseSessionEventXml, St as promptTurnRefs, U as buildRunModel, Ut as sessionEventLabel, _n as mergeApprovalAndBodyOutcomes, bn as rewriteMultiEditHeader, dn as previewEditPayload, et as restoreChainFallbacks, hn as buildEditOutcomesAnnotation, jt as ORCHESTRATED_BY_KEY, kt as MAIN_PLAYBOOK_FRAGMENT, ln as extractEditPayload, m as ownerOf, nn as runReceiptFromRun, tn as hasRunReceipt, u as capTranscriptEvents, vn as parseEditOutcomesFromResult, wn as chatReferenceTokensFromText, xn as stripEditOutcomesAnnotation, yn as resolveApprovalForPayload, zt as renderProjectsBriefing } from "./turn-operations-HX3g3XIc.js";
-import { T as restoreModelOptions, b as modelSupportsReasoning, d as BUILTIN_PROVIDERS, f as anthropicDescriptor, g as getContextWindow, h as enabledModelOptions, i as readCredentials, m as credKeyOf, n as applyApiKeyEnv, r as credentialsPath, t as detectAuth, x as modelsForDescriptor } from "./auth-D0BHBb02.js";
+import { $t as formatRunReceiptLine, A as chunkMarkdownForRender, At as MAIN_PLAYBOOK_FRAGMENT, Bt as renderProjectsBriefing, Ct as promptTurnRefs, Ft as WORKER_REPORT_FRAGMENT, I as cacheBreakChip, It as artifactsFromTurns, L as cacheBreakNoticeText, Lt as isMainSession, Mt as ORCHESTRATED_BY_KEY, Pt as SESSION_ROLE_KEY, Rt as orchestratedBy, Sn as stripEditOutcomesAnnotation, Tn as chatReferenceTokensFromText, Vt as renderSessionEventXml, W as buildRunModel, Wt as sessionEventLabel, Y as filterChainFallbacks, bn as resolveApprovalForPayload, fn as previewEditPayload, gn as buildEditOutcomesAnnotation, jt as MAIN_SESSION_TITLE, m as ownerOf, nn as hasRunReceipt, rn as runReceiptFromRun, tt as restoreChainFallbacks, u as capTranscriptEvents, un as extractEditPayload, vn as mergeApprovalAndBodyOutcomes, xn as rewriteMultiEditHeader, yn as parseEditOutcomesFromResult, zt as parseSessionEventXml } from "./turn-operations-6JDu2ewy.js";
+import { T as restoreModelOptions, b as modelSupportsReasoning, d as BUILTIN_PROVIDERS, f as anthropicDescriptor, g as getContextWindow, h as enabledModelOptions, i as readCredentials, m as credKeyOf, n as applyApiKeyEnv, r as credentialsPath, t as detectAuth, x as modelsForDescriptor } from "./auth-HRKkOErn.js";
 import { basename, delimiter, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { Buffer } from "node:buffer";
 import { chmodSync, closeSync, cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, watch, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { readFile, readdir, stat, writeFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
-import { homedir, tmpdir } from "node:os";
 import { createHash, randomUUID } from "node:crypto";
 import { Fzf } from "fzf";
 import { createGunzip } from "node:zlib";
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from "react";
 import { Writable } from "node:stream";
 import { jsx } from "react/jsx-runtime";
+import process$1 from "node:process";
 //#region src/chat/store.ts
 function ensureStateDir(path) {
 	const dir = dirname(path);
@@ -2307,6 +2308,7 @@ function discoveryDedupHash(input) {
 const SHARED_BEHAVIOR = {
 	compactStrategy: "tail",
 	compactThreshold: 128 * 1024,
+	compactThresholdWindowFraction: .25,
 	compactKeepTurns: 8,
 	elideStaleReads: "notice",
 	mediaKeepTurns: 8,
@@ -2816,6 +2818,23 @@ function chatAutoCompactBehavior(opts) {
 		releaseReplacedTurns: true
 	};
 }
+/**
+* The per-run window knobs a chat host spreads into `agent.run`'s `behavior`:
+* the auto-compaction config from {@link chatAutoCompactBehavior} PLUS the
+* picked model's raw window as `behavior.contextWindow`, so window-relative
+* wire budgets (`compactThresholdWindowFraction`) see the window even when the
+* user has auto-compaction switched off. Both hosts go through this so they
+* cannot drift: the TUI and the GUI/daemon engine hand the loop the same
+* shape for the same settings.
+*/
+function chatWindowBehavior(opts) {
+	const autoCompact = chatAutoCompactBehavior(opts);
+	const contextWindow = typeof opts.rawContextWindow === "number" && Number.isFinite(opts.rawContextWindow) && opts.rawContextWindow > 0 ? opts.rawContextWindow : void 0;
+	return {
+		autoCompact,
+		...contextWindow !== void 0 ? { contextWindow } : {}
+	};
+}
 //#endregion
 //#region src/chat/auto-update.ts
 const OPT_OUT_VARS$1 = [
@@ -7791,6 +7810,9 @@ const DEFAULT_SETTINGS = {
 	resumeLastSession: true,
 	persistToolResults: true,
 	stableToolList: false,
+	sandbox: false,
+	sandboxNetwork: "allow",
+	sandboxAllowWrite: "",
 	autoCompact: true,
 	autoCompactThreshold: .8,
 	resumeOnMaxTokens: false,
@@ -7800,6 +7822,7 @@ const DEFAULT_SETTINGS = {
 	maxCostUsd: 0,
 	maxTotalTokens: 0,
 	maxWallMinutes: 0,
+	thinkingBinding: "drop_block",
 	showEditDiffs: true,
 	editDiffDisplay: "full",
 	showCompactionSummary: false,
@@ -7934,7 +7957,13 @@ const SETTINGS_TOGGLES = [
 		category: "agent",
 		key: "stableToolList",
 		label: "Stable tool list (call_tool)",
-		description: "invoke MCP tools surfaced by tool_search through `call_tool` instead of adding them to the model's tool list, so tool discovery never breaks the prompt cache (next session activation)"
+		description: "invoke MCP tools surfaced by tool_search through `call_tool` instead of adding them to the model's tool list, so tool discovery never breaks the prompt cache. Anthropic always works this way (replayed thinking is bound to the tool list); this toggle affects other providers (next session activation)"
+	},
+	{
+		category: "agent",
+		key: "sandbox",
+		label: "Sandbox shell commands",
+		description: "run the model's shell commands under the OS sandbox (macOS Seatbelt / Linux bwrap): writes limited to the project, temp dirs and \"Sandbox writable paths\", credential dirs hidden; write_file/edit follow the same roots. Does not cover ! commands, MCP servers or fetch_url. Fails closed when the sandbox is unavailable (next session activation)"
 	},
 	{
 		category: "agent",
@@ -8133,6 +8162,19 @@ const SETTINGS_CHOICES = [
 			}
 		]
 	},
+	{
+		category: "agent",
+		key: "sandboxNetwork",
+		label: "Sandbox network",
+		description: "network access for sandboxed shell commands (allow keeps bun install / git fetch / gh working; deny blocks all sockets, the only way to stop exfiltration of readable files). Needs \"Sandbox shell commands\"",
+		options: [{
+			value: "allow",
+			label: "Allow"
+		}, {
+			value: "deny",
+			label: "Deny"
+		}]
+	},
 	{
 		category: "agent",
 		key: "autoCompactThreshold",
@@ -8353,6 +8395,26 @@ const SETTINGS_CHOICES = [
 			}
 		]
 	},
+	{
+		category: "agent",
+		key: "thinkingBinding",
+		label: "Preserved thinking (Anthropic only)",
+		description: "when earlier reasoning no longer matches the conversation prefix: drop it server-side and continue, fail the run with the API error (no retry, history untouched — for debugging), or let the account default decide. Applies on the next run",
+		options: [
+			{
+				value: "drop_block",
+				label: "Drop silently"
+			},
+			{
+				value: "error",
+				label: "Fail the run"
+			},
+			{
+				value: "off",
+				label: "Account default"
+			}
+		]
+	},
 	{
 		category: "ui",
 		key: "toolCallDisplay",
@@ -8475,6 +8537,13 @@ const SETTINGS_CHOICES = [
 	}
 ];
 const SETTINGS_INPUTS = [
+	{
+		category: "agent",
+		key: "sandboxAllowWrite",
+		label: "Sandbox writable paths",
+		description: "extra directories sandboxed shell commands may write to, comma-separated, ~ expanded (the project, temp dirs and a worktree's git dir are always writable). Needs \"Sandbox shell commands\"",
+		placeholder: "~/.cache, ~/.bun/install/cache"
+	},
 	{
 		category: "ui",
 		key: "sessionIcon",
@@ -8799,7 +8868,7 @@ function buildHints(options) {
 			label: "select"
 		},
 		{
-			key: "esc",
+			key: formatBindingForDisplay(keybindings.abortRun),
 			label: "abort run"
 		}
 	]);
@@ -8813,7 +8882,7 @@ function buildHints(options) {
 			label: "select"
 		},
 		{
-			key: "esc",
+			key: formatBindingForDisplay(keybindings.abortRun),
 			label: "abort run"
 		}
 	]);
@@ -8838,9 +8907,13 @@ function buildHints(options) {
 			label: inFlightToolCount === 1 ? "cancel" : `cancel (${inFlightToolCount})`
 		});
 		baseBusyHints.push({
-			key: "esc",
+			key: formatBindingForDisplay(keybindings.abortRun),
 			label: "abort"
 		});
+		baseBusyHints.push({
+			key: "esc",
+			label: "sessions"
+		});
 		return withTodos(baseBusyHints);
 	}
 	if (screen === "auth") return [
@@ -9355,6 +9428,109 @@ function runEndNotice(reason) {
 	}
 }
 //#endregion
+//#region src/chat/mcp-credentials.ts
+const FILE_MODE = 384;
+function mcpCredentialsPath(dataDir) {
+	return resolve(dataDir, "mcp-credentials.json");
+}
+function readAll(dataDir) {
+	const path = mcpCredentialsPath(dataDir);
+	if (!existsSync(path)) return {};
+	try {
+		const raw = readFileSync(path, "utf-8");
+		const parsed = JSON.parse(raw);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+		return parsed;
+	} catch {
+		return {};
+	}
+}
+function writeAll(dataDir, all) {
+	writeFileAtomic(mcpCredentialsPath(dataDir), `${JSON.stringify(all, null, 2)}\n`, {
+		ensureDir: true,
+		mode: FILE_MODE
+	});
+}
+/**
+* Build a file-backed `McpCredentialStore`. All per-server reads / writes
+* funnel through the single `mcp-credentials.json` file — this keeps
+* concurrent flows for different servers from clobbering each other since
+* each save reads-modifies-writes the full file atomically.
+*
+* Two flows for the same server name CAN race (last write wins). MCP OAuth
+* flows are user-driven and serial in practice (one login modal at a time),
+* so this is acceptable; a per-server file split + cross-process lock would
+* be required to handle a multi-process scenario.
+*/
+function createFileMcpCredentialStore(dataDir) {
+	return {
+		load(name) {
+			return readAll(dataDir)[name];
+		},
+		save(name, entry) {
+			const all = readAll(dataDir);
+			all[name] = entry;
+			writeAll(dataDir, all);
+		},
+		delete(name) {
+			const all = readAll(dataDir);
+			if (!(name in all)) return;
+			delete all[name];
+			writeAll(dataDir, all);
+		}
+	};
+}
+/**
+* Convenience patches for individual sub-fields. The provider class uses
+* these so a `saveTokens` call doesn't have to round-trip `clientInformation`
+* + `discoveryState` it never touched.
+*/
+function patchMcpCredential(store, name, patch) {
+	const existing = store.load(name) ?? {};
+	store.save(name, {
+		...existing,
+		...patch
+	});
+}
+//#endregion
+//#region src/chat/sandbox-settings.ts
+const OFF = {
+	isolation: void 0,
+	warning: void 0
+};
+/**
+* Credential paths hidden from sandboxed commands: the home-relative
+* defaults plus zidane's provider and MCP credential files at the host's
+* actual data dir. Exported for tests; hosts go through the resolvers.
+*/
+function sandboxUnreadableDirs(dataDir) {
+	const dirs = resolveUnreadableDirs(DEFAULT_UNREADABLE_DIRS);
+	if (dataDir) dirs.push(credentialsPath(dataDir), mcpCredentialsPath(dataDir));
+	return [...new Set(dirs)];
+}
+function finish(settings, writableRoots, options) {
+	const isolation = {
+		writableRoots,
+		network: settings.sandboxNetwork ?? "allow",
+		unreadableDirs: sandboxUnreadableDirs(options.dataDir)
+	};
+	const availability = isolationAvailability();
+	return {
+		isolation,
+		warning: availability.ok ? void 0 : `"Sandbox shell commands" is on but cannot be enforced: ${availability.reason}. Shell commands will be refused until you fix this or turn the setting off.`
+	};
+}
+/** Sync form — in-process TUI (`buildAgent` is synchronous). */
+function resolveSandboxFromSettings(settings, cwd, options = {}) {
+	if (!settings.sandbox) return OFF;
+	return finish(settings, resolveWritableRoots(cwd, { extra: parseAllowWriteSetting(settings.sandboxAllowWrite ?? "", cwd) }), options);
+}
+/** Async form — daemon host; the git worktree probe must not block the shared loop. */
+async function resolveSandboxFromSettingsAsync(settings, cwd, options = {}) {
+	if (!settings.sandbox) return OFF;
+	return finish(settings, await resolveWritableRootsAsync(cwd, { extra: parseAllowWriteSetting(settings.sandboxAllowWrite ?? "", cwd) }), options);
+}
+//#endregion
 //#region src/chat/model-chain-metadata.ts
 /**
 * Assemble the `metadata.modelChain` value for a model pick — the full
@@ -9437,6 +9613,27 @@ async function createMainSession(store) {
 	return id;
 }
 //#endregion
+//#region src/chat/thinking-binding.ts
+/**
+* Publish the user's `thinkingBinding` setting to the Anthropic provider.
+*
+* The chat runtimes build `anthropic()` through a no-arg factory, so the
+* setting travels through the environment: the provider resolves
+* `param > ZIDANE_THINKING_BINDING (shell) > ZIDANE_THINKING_BINDING_SETTING
+* (this) > 'drop_block'` on every request. Writing a DISTINCT variable keeps
+* the shell override authoritative without any launch-time capture — a host
+* or window created later in the same process cannot read this write back
+* as a shell value.
+*
+* Called by every runtime that starts runs: the chat host's send path
+* (daemon, GUI) and the in-process TUI on setting change. Process-global by
+* nature; matches settings being shared across windows today. Inert on
+* non-Anthropic providers.
+*/
+function applyThinkingBindingSetting(value) {
+	process$1.env[THINKING_BINDING_SETTING_ENV] = value ?? "drop_block";
+}
+//#endregion
 //#region src/chat/builtin-commands.ts
 function createBuiltinCommands(opts) {
 	const commands = [{
@@ -9791,6 +9988,12 @@ function createCommandModule(deps) {
 		const sessionId = opts.sessionId;
 		const controller = new AbortController();
 		run.commandAbort = controller;
+		const dispatchRunId = randomUUID();
+		broadcast({
+			kind: "run:start",
+			sessionId,
+			runId: dispatchRunId
+		});
 		const requestInteraction = interactions.requestInteractionFor(sessionId);
 		const requestCommandInteraction = (request) => {
 			if (controller.signal.aborted) return Promise.reject(/* @__PURE__ */ new Error("command aborted"));
@@ -10112,7 +10315,7 @@ function createCommandModule(deps) {
 				separateNextEmit = true;
 			}
 		};
-		const execute = () => executeCommand(command, ctx);
+		const execute = () => withExtensionSession(session, () => executeCommand(command, ctx));
 		const executeScoped = env.hostRuntime ? () => env.hostRuntime.runWith(sessionHostRuntime(run, env, { appendNote: (blocks) => blocks.forEach(emitBlock) }), execute) : execute;
 		try {
 			if (session.turns.length > 0) emitEvent({
@@ -10139,7 +10342,7 @@ function createCommandModule(deps) {
 		}
 		return {
 			ran: true,
-			runId: randomUUID()
+			runId: dispatchRunId
 		};
 	}
 	return {
@@ -11599,6 +11802,7 @@ function createChatHost(env) {
 			persistThreshold: 0,
 			persistDir
 		};
+		const sandbox = await resolveSandboxFromSettingsAsync(settings, cwd, { dataDir: env.userDataDir() });
 		const providerKey = readSessionProvider(data.metadata, providers);
 		const providerDescriptor = providerDescriptorFor(providers, providerKey);
 		const modelOverride = readSessionModel(data.metadata, providers);
@@ -11669,7 +11873,10 @@ function createChatHost(env) {
 			...system ? { system } : {},
 			session,
 			artifacts: artifactsEnabled,
-			execution: createProcessContext({ cwd }),
+			execution: createProcessContext({
+				cwd,
+				...sandbox.isolation ? { isolation: sandbox.isolation } : {}
+			}),
 			skills: finalSkills,
 			mcpServers: dedupByName([
 				...mcpServers,
@@ -11693,12 +11900,43 @@ function createChatHost(env) {
 			});
 		});
 		installCacheBreakLogger(agent.hooks, { log: (line) => hostDebug("cache-break", line) });
+		let pendingCacheNotice = null;
 		agent.hooks.hook("cache:break", (info) => {
 			broadcast({
 				kind: "cache:break",
 				sessionId,
 				info
 			});
+			pendingCacheNotice = info;
+		});
+		agent.hooks.hook("session:turns", () => {
+			const info = pendingCacheNotice;
+			if (!info) return;
+			pendingCacheNotice = null;
+			const session = agent.session;
+			if (!session) return;
+			const chip = cacheBreakChip(info);
+			const text = cacheBreakNoticeText(info);
+			const notice = {
+				severity: chip.tone === "warn" ? "warn" : "info",
+				label: "cache"
+			};
+			const turnId = randomUUID();
+			session.appendTurns([{
+				id: turnId,
+				role: "command",
+				createdAt: Date.now(),
+				content: noticeTurnContent(notice, text)
+			}]).then(() => broadcast({
+				kind: "event",
+				sessionId,
+				event: {
+					kind: "info",
+					text,
+					notice,
+					turnId
+				}
+			})).catch((err) => hostDebug("cache-break", `notice persist failed: ${String(err)}`));
 		});
 		broadcast({
 			kind: "system-md",
@@ -11706,6 +11944,18 @@ function createChatHost(env) {
 			file: builtInSystem?.systemFile ?? null,
 			shadowed: builtInSystem?.shadowedSystemFiles ?? []
 		});
+		if (sandbox.warning) broadcast({
+			kind: "event",
+			sessionId,
+			event: {
+				kind: "info",
+				text: sandbox.warning,
+				notice: {
+					severity: "warn",
+					label: "sandbox"
+				}
+			}
+		});
 		const spawnCandidate = (composedPreset.tools ?? {}).spawn;
 		const commandSeam = spawnCandidate && isSpawnTool(spawnCandidate) ? {
 			spawnTool: spawnCandidate,
@@ -12637,6 +12887,7 @@ function createChatHost(env) {
 	async function preparePrompt(opts, internal, trackSettlement) {
 		const generation = teardownGeneration;
 		const settings = env.readSettings();
+		applyThinkingBindingSetting(settings.thinkingBinding);
 		const run = await ensureAgent(opts.sessionId);
 		assertDispatchOpen(generation);
 		if (run.agent.isRunning) throw new Error(`Session "${opts.sessionId}" already has a run in flight. Use steer/followUp (or pushQueued) to feed the active run.`);
@@ -12719,14 +12970,14 @@ function createChatHost(env) {
 			encoding: "base64",
 			...a.name ? { name: a.name } : {}
 		})] : opts.prompt;
-		const autoCompactDescriptor = BUILTIN_PROVIDERS[run.providerKey] ?? BUILTIN_PROVIDERS.anthropic;
 		const sendRuntime = await env.runtimeConfig(run.cwd);
+		const autoCompactDescriptor = sendRuntime.providers[run.providerKey] ?? BUILTIN_PROVIDERS[run.providerKey] ?? BUILTIN_PROVIDERS.anthropic;
 		assertDispatchOpen(generation);
 		const summarizer = resolveCompactionSummarizer(settings.compactionModel, (key) => buildProvider(sendRuntime.providers, key), {
 			providerKey: run.providerKey,
 			model: modelOverride ?? run.model
 		});
-		const autoCompactRun = chatAutoCompactBehavior({
+		const windowRun = chatWindowBehavior({
 			enabled: settings.autoCompact,
 			threshold: settings.autoCompactThreshold,
 			rawContextWindow: getContextWindow(autoCompactDescriptor, modelOverride ?? run.model),
@@ -12745,7 +12996,7 @@ function createChatHost(env) {
 			system: systemNudge && run.system ? `${run.system}\n\n${systemNudge}` : systemNudge,
 			signal: run.controller.signal,
 			behavior: {
-				autoCompact: autoCompactRun,
+				...windowRun,
 				...caps
 			},
 			...run.rules && !systemNudge ? { contextSections: run.rules } : {},
@@ -13184,7 +13435,8 @@ function createChatHost(env) {
 			for (const [key, value] of Object.entries(patch)) if (value === void 0) delete data.metadata[key];
 			else data.metadata[key] = value;
 			if (opts.bumpUpdatedAt !== false) data.updatedAt = Date.now();
-			await env.store.save(data);
+			if (env.store.saveMeta) await env.store.saveMeta(data);
+			else await env.store.save(data);
 		},
 		async setSessionModel(sessionId, pick) {
 			await host.patchSessionMeta(sessionId, {
@@ -14004,71 +14256,6 @@ function useMcpAuthDispatch() {
 	return dispatch;
 }
 //#endregion
-//#region src/chat/mcp-credentials.ts
-const FILE_MODE = 384;
-function mcpCredentialsPath(dataDir) {
-	return resolve(dataDir, "mcp-credentials.json");
-}
-function readAll(dataDir) {
-	const path = mcpCredentialsPath(dataDir);
-	if (!existsSync(path)) return {};
-	try {
-		const raw = readFileSync(path, "utf-8");
-		const parsed = JSON.parse(raw);
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-		return parsed;
-	} catch {
-		return {};
-	}
-}
-function writeAll(dataDir, all) {
-	writeFileAtomic(mcpCredentialsPath(dataDir), `${JSON.stringify(all, null, 2)}\n`, {
-		ensureDir: true,
-		mode: FILE_MODE
-	});
-}
-/**
-* Build a file-backed `McpCredentialStore`. All per-server reads / writes
-* funnel through the single `mcp-credentials.json` file — this keeps
-* concurrent flows for different servers from clobbering each other since
-* each save reads-modifies-writes the full file atomically.
-*
-* Two flows for the same server name CAN race (last write wins). MCP OAuth
-* flows are user-driven and serial in practice (one login modal at a time),
-* so this is acceptable; a per-server file split + cross-process lock would
-* be required to handle a multi-process scenario.
-*/
-function createFileMcpCredentialStore(dataDir) {
-	return {
-		load(name) {
-			return readAll(dataDir)[name];
-		},
-		save(name, entry) {
-			const all = readAll(dataDir);
-			all[name] = entry;
-			writeAll(dataDir, all);
-		},
-		delete(name) {
-			const all = readAll(dataDir);
-			if (!(name in all)) return;
-			delete all[name];
-			writeAll(dataDir, all);
-		}
-	};
-}
-/**
-* Convenience patches for individual sub-fields. The provider class uses
-* these so a `saveTokens` call doesn't have to round-trip `clientInformation`
-* + `discoveryState` it never touched.
-*/
-function patchMcpCredential(store, name, patch) {
-	const existing = store.load(name) ?? {};
-	store.save(name, {
-		...existing,
-		...patch
-	});
-}
-//#endregion
 //#region src/chat/mcp-rows.ts
 /**
 * Flatten a server catalog plus the per-server expanded set into the
@@ -17030,6 +17217,6 @@ function createApprovalHub(options) {
 	};
 }
 //#endregion
-export { supportsOAuth as $, parseMcpsFile as $n, pruneTodosByRun as $r, EditOutcomeLedger as $t, useSafeModeQueue as A, noticeTurnContent as Ai, quoteForShell as An, discoverAgentsMd as Ar, makeRequestInteraction as At, USAGE_CACHE_TTL_MS as B, createArtifactsCompletionProvider as Bn, singleAgentRegistry as Br, extractEditPayloadForGate as Bt, resolveSessionExportTarget as C, deriveSessionTitle as Ci, GRUVBOX_DARK as Cn, parseSemver as Cr, InteractionsProvider as Ct, scopeCwd as D, listSessionMeta as Di, CATPPUCCIN_MACCHIATO as Dn, chatAutoCompactBehavior as Dr, createInteractionTools as Dt, resolveSessionCwd as E, lastContextSizeFromTurns as Ei, CATPPUCCIN_LATTE as En, resolvePlatformPackage as Er, createAutomaticInteractionResponse as Et, matchesSafelistEntry as F, titleFromTurns as Fi, ConfigProvider as Fn, DEFAULT_BUDGET_EXCLUDE_TOOLS as Fr, STALE_RUN_MARKER_MS as Ft, usageChecksOptedOut as G, importFromClaudeCode as Gn, TODO_STATUS_GLYPHS as Gr, createMainSession as Gt, fetchAllProviderUsage as H, useCompletion as Hn, TODOREAD_TOOL as Hr, resolveCwdPath as Ht, projectsFilePath as I, toolCallPreview as Ii, useConfig as In, DEFAULT_PERSIST_EXCLUDE_TOOLS as Ir, createChatHost as It, fetchOAuthRedirect as J, upsertMcpServer as Jn, createTodoTools as Jr, runEndNotice as Jt, usageSourceFor as K, mcpsWritePath as Kn, TODO_WRITE_COUNTS_METADATA_KEY as Kr, modelChainMetadata as Kt, readProjects as L, toolResultText as Li, resolveConfig as Ln, PLAN_AGENT as Lr, toTodosSnapshot as Lt, addToSafelist as M, serverToolResultSummary as Mi, DiscoveryProvider as Mn, BUILD_AGENT as Mr, serializeInteractionResponse as Mt, getSafelist as N, stripSpawnTokensLine as Ni, useDiscovery as Nn, BUILTIN_AGENTS as Nr, useInteractionsActions as Nt, SafeModeProvider as O, loadState as Oi, CATPPUCCIN_MOCHA as On, groupArtifacts as Or, isInteractionTool as Ot, isOnSafelist as P, sumRunCosts as Pi, useDiscoveryOptional as Pn, DEFAULT_AGENT_ID as Pr, useInteractionsQueue as Pt, runOAuthLogin as Q, discoverProjectMcps as Qn, pickActiveRunId as Qr, attachMcpWarnLog as Qt, suggestSafelistEntries as R, updateToolEventOutcomes as Ri, resolveStoragePaths as Rn, accentColor as Rr, installProviderDiagnosticHook as Rt, renderSession as S, createStateStore as Si, VAPORWAVE_THEME as Sn, detectPackageManager as Sr, HOST_INTERACTION_ID_PREFIX as St, folderlessCwd as T, getSessionMeta as Ti, CATPPUCCIN_FRAPPE as Tn, performSelfUpdate as Tr, buildResumedToolResultsTurn as Tt, fetchProviderUsage as U, countClaudeSessionFiles as Un, TODOS_METADATA_KEY as Ur, serializePreview as Ut, clearProviderUsageCache as V, scoreArtifacts as Vn, DEFAULT_MAX_TODO_ITEMS as Vr, readFileSafe as Vt, providerUsageSupported as W, hasClaudeCodeSetup as Wn, TODOWRITE_TOOL as Wr, createBuiltinCommands as Wt, redirectUriFromAuthUrl as X, dedupMcpServersByName as Xn, getTodosForRun as Xr, discoverProjectPlugins as Xt, normalizeRedirectPaste as Y, buildMcpServers as Yn, getArchivedTodosForRun as Yr, buildPluginContributions as Yt, oauthUsesManualCodePaste as Z, defaultMcpsConfigPaths as Zn, isTodoTool as Zr, parsePluginScanPathEnv as Zt, buildSpawnEndEvent as _, envSection as _i, useSettings as _n, findInstalledCompanion as _r, useMcpAuthState as _t, renderActiveTodoAnchor as a, ACTIONS_WITH_CARE_DOCTRINE as ai, buildHints as an, buildRestartHint as ar, subscribeMcpToolsCache as at, defaultSkillScanPaths as b, DEFAULT_SESSION_TITLE as bi, resolveChipColor as bn, compareSemver as br, ASK_USER_TOOL as bt, useSelectStyle as c, IDENTITY_PREFIX as ci, useEnabledToggleSet as cn, runUpdateCommand as cr, useMcpToolToggleSet as ct, useTheme as d, PLAN_MODE_DOCTRINE as di, SETTINGS_CHOICES as dn, probeInstalledVersion as dr, parentServerName as dt, sanitizeTodoItems as ei, runCompaction as en, tryOpenBrowser as er, clearMcpToolsCache as et, discoverSystemMd as f, PLAN_MODE_DOCTRINE_NO_PROMPTS as fi, SETTINGS_INPUTS as fn, readUpdateAppliedMarker as fr, createFileMcpCredentialStore as ft, useStreamBuffer as g, buildPlanSystem as gi, enforceSettingsInvariants as gn, writeUpdateAppliedMarker as gr, useMcpAuthDispatch as gt, userSystemMdPath as h, buildBuildSystem as hi, clampFps as hn, watchInstalledVersion as hr, McpAuthProvider as ht, createActiveTodoAnchorHooks as i, useActiveTodos as ii, truncateTrailing as in, upgradeInstalledPackages as ir, saveMcpToolsCache as it, IMPLICITLY_SAFE_TOOLS as j, saveState as ji, createDiscoverySlot as jn, renderAgentsMdBlock as jr, pendingInteractionsFromTurns as jt, useSafeModeActions as k, marginTopFor as ki, parseEditorCommand as kn, summarizeArtifactCounts as kr, isModelInteraction as kt, useSurfaces as l, INTERACTION_GUIDANCE as li, DEFAULT_SETTINGS as ln, UPDATE_APPLIED_MARKER as lr, buildVisibleMcpRows as lt, userScopeOverridesLoad as m, TOKEN_DISCIPLINE_DOCTRINE as mi, SettingsProvider as mn, useRestartRequired as mr, patchMcpCredential as mt, createMemoryApprovalsStore as n, setTodosForRun as ni, clipHintsToWidth as nn, bootProfileEnabled as nr, mcpToolsCachePath as nt, ThemeProvider as o, COMMUNICATION_DOCTRINE as oi, shortChord as on, buildUpdateHint as or, buildToolToggle as ot, renderSystemMdSeed as p, SUBAGENT_GUIDANCE as pi, SETTINGS_TOGGLES as pn, updateAppliedMarkerPath as pr, mcpCredentialsPath as pt, formatPathForCwd as q, removeMcpServer as qn, applyTodosSnapshot as qr, sessionModelFallbacks as qt, computeTurnAnchors as r, todoProgressLabel as ri, hintsLength as rn, bootTick as rr, refreshMcpToolsCatalog as rt, useColors as s, DOING_TASKS_DOCTRINE as si, listProjectFiles as sn, useUpdateCheck as sr, useMcpToolToggleMap as st, createApprovalHub as t, selectActiveTodos as ti, EMPTY_HINTS as tn, tryRevealPath as tr, loadMcpToolsCache as tt, useSyntaxStyles as u, INTERACTION_GUIDANCE_NO_PROMPTS as ui, SETTINGS_CATEGORIES as un, hasUpdateAppliedMarker as ur, indexOfServerRow as ut, buildSpawnStartEvent as v, chatReferenceTokensForPrompt as vi, BUILTIN_THEMES as vn, checkForUpdate as vr, getMcpAuthStatus as vt, writeSessionExport as w, eventsFromTurns as wi, GRUVBOX_LIGHT as wn, performInPlaceSelfUpdate as wr, PRESENT_PLAN_TOOL as wt, discoverProjectSkills as x, compactSummaryEvent as xi, resolveTheme as xn, detectLibc as xr, AUTOMATIC_INTERACTION_INSTRUCTION as xt, buildSkillsConfig as y, createChatTurnsReadTool as yi, DEFAULT_THEME as yn, checkTarballAvailable as yr, reduceMcpAuth as yt, writeProjects as z, usageByModel as zi, ARTIFACTS_COMPLETION_PROVIDER_ID as zn, resolveAgentId as zr, createInteractionHub as zt };
+export { supportsOAuth as $, defaultMcpsConfigPaths as $n, getTodosForRun as $r, parsePluginScanPathEnv as $t, useSafeModeQueue as A, listSessionMeta as Ai, CATPPUCCIN_MOCHA as An, chatWindowBehavior as Ar, useInteractionsActions as At, USAGE_CACHE_TTL_MS as B, toolResultText as Bi, resolveStoragePaths as Bn, PLAN_AGENT as Br, serializePreview as Bt, resolveSessionExportTarget as C, DEFAULT_SESSION_TITLE as Ci, resolveTheme as Cn, detectLibc as Cr, createAutomaticInteractionResponse as Ct, scopeCwd as D, eventsFromTurns as Di, CATPPUCCIN_FRAPPE as Dn, performSelfUpdate as Dr, makeRequestInteraction as Dt, resolveSessionCwd as E, deriveSessionTitle as Ei, GRUVBOX_LIGHT as En, performInPlaceSelfUpdate as Er, isModelInteraction as Et, matchesSafelistEntry as F, serverToolResultSummary as Fi, useDiscovery as Fn, BUILD_AGENT as Fr, installProviderDiagnosticHook as Ft, usageChecksOptedOut as G, countClaudeSessionFiles as Gn, TODOREAD_TOOL as Gr, sessionModelFallbacks as Gt, fetchAllProviderUsage as H, usageByModel as Hi, createArtifactsCompletionProvider as Hn, resolveAgentId as Hr, applyThinkingBindingSetting as Ht, projectsFilePath as I, stripSpawnTokensLine as Ii, useDiscoveryOptional as In, BUILTIN_AGENTS as Ir, createInteractionHub as It, fetchOAuthRedirect as J, mcpsWritePath as Jn, TODO_STATUS_GLYPHS as Jr, mcpCredentialsPath as Jt, usageSourceFor as K, hasClaudeCodeSetup as Kn, TODOS_METADATA_KEY as Kr, resolveSandboxFromSettings as Kt, readProjects as L, sumRunCosts as Li, ConfigProvider as Ln, DEFAULT_AGENT_ID as Lr, extractEditPayloadForGate as Lt, addToSafelist as M, marginTopFor as Mi, quoteForShell as Mn, summarizeArtifactCounts as Mr, STALE_RUN_MARKER_MS as Mt, getSafelist as N, noticeTurnContent as Ni, createDiscoverySlot as Nn, discoverAgentsMd as Nr, createChatHost as Nt, SafeModeProvider as O, getSessionMeta as Oi, CATPPUCCIN_LATTE as On, resolvePlatformPackage as Or, pendingInteractionsFromTurns as Ot, isOnSafelist as P, saveState as Pi, DiscoveryProvider as Pn, renderAgentsMdBlock as Pr, toTodosSnapshot as Pt, runOAuthLogin as Q, dedupMcpServersByName as Qn, getArchivedTodosForRun as Qr, discoverProjectPlugins as Qt, suggestSafelistEntries as R, titleFromTurns as Ri, useConfig as Rn, DEFAULT_BUDGET_EXCLUDE_TOOLS as Rr, readFileSafe as Rt, renderSession as S, createChatTurnsReadTool as Si, resolveChipColor as Sn, compareSemver as Sr, buildResumedToolResultsTurn as St, folderlessCwd as T, createStateStore as Ti, GRUVBOX_DARK as Tn, parseSemver as Tr, isInteractionTool as Tt, fetchProviderUsage as U, scoreArtifacts as Un, singleAgentRegistry as Ur, createMainSession as Ut, clearProviderUsageCache as V, updateToolEventOutcomes as Vi, ARTIFACTS_COMPLETION_PROVIDER_ID as Vn, accentColor as Vr, createBuiltinCommands as Vt, providerUsageSupported as W, useCompletion as Wn, DEFAULT_MAX_TODO_ITEMS as Wr, modelChainMetadata as Wt, redirectUriFromAuthUrl as X, upsertMcpServer as Xn, applyTodosSnapshot as Xr, runEndNotice as Xt, normalizeRedirectPaste as Y, removeMcpServer as Yn, TODO_WRITE_COUNTS_METADATA_KEY as Yr, patchMcpCredential as Yt, oauthUsesManualCodePaste as Z, buildMcpServers as Zn, createTodoTools as Zr, buildPluginContributions as Zt, buildSpawnEndEvent as _, TOKEN_DISCIPLINE_DOCTRINE as _i, clampFps as _n, watchInstalledVersion as _r, ASK_USER_TOOL as _t, renderActiveTodoAnchor as a, setTodosForRun as ai, hintsLength as an, bootTick as ar, subscribeMcpToolsCache as at, defaultSkillScanPaths as b, envSection as bi, BUILTIN_THEMES as bn, checkForUpdate as br, InteractionsProvider as bt, useSelectStyle as c, ACTIONS_WITH_CARE_DOCTRINE as ci, shortChord as cn, buildUpdateHint as cr, useMcpToolToggleSet as ct, useTheme as d, IDENTITY_PREFIX as di, DEFAULT_SETTINGS as dn, UPDATE_APPLIED_MARKER as dr, parentServerName as dt, isTodoTool as ei, attachMcpWarnLog as en, discoverProjectMcps as er, clearMcpToolsCache as et, discoverSystemMd as f, INTERACTION_GUIDANCE as fi, SETTINGS_CATEGORIES as fn, hasUpdateAppliedMarker as fr, McpAuthProvider as ft, useStreamBuffer as g, SUBAGENT_GUIDANCE as gi, SettingsProvider as gn, useRestartRequired as gr, reduceMcpAuth as gt, userSystemMdPath as h, PLAN_MODE_DOCTRINE_NO_PROMPTS as hi, SETTINGS_TOGGLES as hn, updateAppliedMarkerPath as hr, getMcpAuthStatus as ht, createActiveTodoAnchorHooks as i, selectActiveTodos as ii, clipHintsToWidth as in, bootProfileEnabled as ir, saveMcpToolsCache as it, IMPLICITLY_SAFE_TOOLS as j, loadState as ji, parseEditorCommand as jn, groupArtifacts as jr, useInteractionsQueue as jt, useSafeModeActions as k, lastContextSizeFromTurns as ki, CATPPUCCIN_MACCHIATO as kn, chatAutoCompactBehavior as kr, serializeInteractionResponse as kt, useSurfaces as l, COMMUNICATION_DOCTRINE as li, listProjectFiles as ln, useUpdateCheck as lr, buildVisibleMcpRows as lt, userScopeOverridesLoad as m, PLAN_MODE_DOCTRINE as mi, SETTINGS_INPUTS as mn, readUpdateAppliedMarker as mr, useMcpAuthState as mt, createMemoryApprovalsStore as n, pruneTodosByRun as ni, runCompaction as nn, tryOpenBrowser as nr, mcpToolsCachePath as nt, ThemeProvider as o, todoProgressLabel as oi, truncateTrailing as on, upgradeInstalledPackages as or, buildToolToggle as ot, renderSystemMdSeed as p, INTERACTION_GUIDANCE_NO_PROMPTS as pi, SETTINGS_CHOICES as pn, probeInstalledVersion as pr, useMcpAuthDispatch as pt, formatPathForCwd as q, importFromClaudeCode as qn, TODOWRITE_TOOL as qr, createFileMcpCredentialStore as qt, computeTurnAnchors as r, sanitizeTodoItems as ri, EMPTY_HINTS as rn, tryRevealPath as rr, refreshMcpToolsCatalog as rt, useColors as s, useActiveTodos as si, buildHints as sn, buildRestartHint as sr, useMcpToolToggleMap as st, createApprovalHub as t, pickActiveRunId as ti, EditOutcomeLedger as tn, parseMcpsFile as tr, loadMcpToolsCache as tt, useSyntaxStyles as u, DOING_TASKS_DOCTRINE as ui, useEnabledToggleSet as un, runUpdateCommand as ur, indexOfServerRow as ut, buildSpawnStartEvent as v, buildBuildSystem as vi, enforceSettingsInvariants as vn, writeUpdateAppliedMarker as vr, AUTOMATIC_INTERACTION_INSTRUCTION as vt, writeSessionExport as w, compactSummaryEvent as wi, VAPORWAVE_THEME as wn, detectPackageManager as wr, createInteractionTools as wt, discoverProjectSkills as x, chatReferenceTokensForPrompt as xi, DEFAULT_THEME as xn, checkTarballAvailable as xr, PRESENT_PLAN_TOOL as xt, buildSkillsConfig as y, buildPlanSystem as yi, useSettings as yn, findInstalledCompanion as yr, HOST_INTERACTION_ID_PREFIX as yt, writeProjects as z, toolCallPreview as zi, resolveConfig as zn, DEFAULT_PERSIST_EXCLUDE_TOOLS as zr, resolveCwdPath as zt };
 
-//# sourceMappingURL=approvals-DkwGBMZ9.js.map
+//# sourceMappingURL=approvals-u2T19Dc-.js.map