@ekkos/cli 0.2.18 → 0.3.3

package/dist/commands/run.js

@@ -38,22 +38,148 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.run = run;
 const chalk_1 = __importDefault(require("chalk"));
+const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const child_process_1 = require("child_process");
+// ═══════════════════════════════════════════════════════════════════════════
+// ccDNA AUTO-LOAD: Apply Claude Code patches before spawning
+// ═══════════════════════════════════════════════════════════════════════════
+const CCDNA_PATHS = [
+    // Development path (DEV sibling directory)
+    // From: EKKOS/packages/ekkos-cli/dist/commands/ → DEV/ekkos-ccdna/
+    path.join(__dirname, '..', '..', '..', '..', '..', 'ekkos-ccdna', 'dist', 'index.mjs'),
+    // User install path
+    path.join(os.homedir(), '.ekkos', 'ccdna', 'dist', 'index.mjs'),
+    // npm global (homebrew)
+    '/opt/homebrew/lib/node_modules/ekkos-ccdna/dist/index.mjs',
+    // npm global (standard)
+    path.join(os.homedir(), '.npm-global', 'lib', 'node_modules', 'ekkos-ccdna', 'dist', 'index.mjs'),
+];
+/**
+ * Find ccDNA installation path
+ */
+function findCcdnaPath() {
+    for (const p of CCDNA_PATHS) {
+        if (fs.existsSync(p)) {
+            return p;
+        }
+    }
+    return null;
+}
+/**
+ * Apply ccDNA patches silently before Claude spawns
+ * Returns version string if patches were applied, null otherwise
+ *
+ * @param verbose - Show detailed output
+ * @param claudePath - Path to Claude Code to patch (if different from default)
+ */
+function applyCcdnaPatches(verbose, claudePath) {
+    const ccdnaPath = findCcdnaPath();
+    if (!ccdnaPath) {
+        if (verbose) {
+            console.log(chalk_1.default.gray('  ccDNA not found - skipping patches'));
+        }
+        return null;
+    }
+    // Read ccDNA version from package.json FIRST
+    let ccdnaVersion = 'unknown';
+    try {
+        const pkgPath = path.join(path.dirname(ccdnaPath), '..', 'package.json');
+        if (fs.existsSync(pkgPath)) {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+            ccdnaVersion = pkg.version || 'unknown';
+        }
+    }
+    catch {
+        // Ignore version detection errors
+    }
+    try {
+        // Set env var to tell ccDNA which Claude to patch
+        // eslint-disable-next-line no-restricted-syntax
+        const env = { ...process.env };
+        if (claudePath) {
+            // ccDNA checks CCDNA_CC_INSTALLATION_PATH to override default detection
+            env.CCDNA_CC_INSTALLATION_PATH = claudePath;
+        }
+        // Run ccDNA in apply mode (non-interactive)
+        (0, child_process_1.execSync)(`node "${ccdnaPath}" -a`, {
+            stdio: verbose ? 'inherit' : 'pipe',
+            timeout: 30000, // 30 second timeout
+            env,
+        });
+        if (verbose) {
+            console.log(chalk_1.default.green(`  ✓ ccDNA v${ccdnaVersion} patches applied`));
+        }
+        return ccdnaVersion;
+    }
+    catch (err) {
+        if (verbose) {
+            console.log(chalk_1.default.yellow(`  ⚠ ccDNA patch failed: ${err.message}`));
+        }
+        return null;
+    }
+}
+/**
+ * Restore original Claude Code (remove ccDNA patches) on exit
+ * This restores the ekkOS-managed installation (~/.ekkos/claude-code/) to its base state
+ *
+ * NOTE: We intentionally DON'T restore on exit anymore because:
+ * 1. ekkOS uses a SEPARATE installation (~/.ekkos/claude-code/) from homebrew
+ * 2. The homebrew `claude` command should always be vanilla (untouched)
+ * 3. The ekkOS installation can stay patched - it's only used by `ekkos run`
+ *
+ * This function is kept for manual/explicit restore scenarios.
+ */
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+function restoreCcdnaPatches(verbose, claudePath) {
+    const ccdnaPath = findCcdnaPath();
+    if (!ccdnaPath) {
+        return false;
+    }
+    try {
+        // Set env var to tell ccDNA which Claude to restore
+        // eslint-disable-next-line no-restricted-syntax
+        const env = { ...process.env };
+        if (claudePath) {
+            env.CCDNA_CC_INSTALLATION_PATH = claudePath;
+        }
+        // Run ccDNA in restore mode (non-interactive)
+        (0, child_process_1.execSync)(`node "${ccdnaPath}" -r`, {
+            stdio: verbose ? 'inherit' : 'pipe',
+            timeout: 30000, // 30 second timeout
+            env,
+        });
+        if (verbose) {
+            console.log(chalk_1.default.green('  ✓ ccDNA patches removed (vanilla restored)'));
+        }
+        return true;
+    }
+    catch (err) {
+        if (verbose) {
+            console.log(chalk_1.default.yellow(`  ⚠ ccDNA restore failed: ${err.message}`));
+        }
+        return false;
+    }
+}
 const state_1 = require("../utils/state");
 const doctor_1 = require("./doctor");
 const stream_tailer_1 = require("../capture/stream-tailer");
+const jsonl_rewriter_1 = require("../capture/jsonl-rewriter");
+const transcript_repair_1 = require("../capture/transcript-repair");
 // Try to load node-pty (may fail on Node 24+)
 let pty = null;
-try {
-    pty = require('node-pty');
-}
-catch {
-    // node-pty not available, will use spawn fallback
-}
+(async () => {
+    try {
+        pty = await Promise.resolve().then(() => __importStar(require('node-pty')));
+    }
+    catch {
+        // node-pty not available, will use spawn fallback
+    }
+})();
 function getConfig(options) {
+    /* eslint-disable no-restricted-syntax -- Config timing values, not API keys */
     return {
         slashOpenDelayMs: options.slashOpenDelayMs ??
             parseInt(process.env.EKKOS_SLASH_OPEN_DELAY_MS || '500', 10), // was 1000
@@ -70,6 +196,7 @@ function getConfig(options) {
             process.env.EKKOS_DEBUG_LOG_PATH ??
             path.join(os.homedir(), '.ekkos', 'auto-continue.debug.log')
     };
+    /* eslint-enable no-restricted-syntax */
 }
 // ═══════════════════════════════════════════════════════════════════════════
 // PATTERN MATCHING
@@ -108,6 +235,22 @@ const PALETTE_INDICATOR_REGEX = /\/(clear|continue|compact|help|bug|config)/i;
 const SESSION_NAME_IN_STATUS_REGEX = /·\s*([a-z]+-[a-z]+-[a-z]+)\s*·/i;
 // Weaker signal: any 3-word slug (word-word-word pattern)
 const SESSION_NAME_REGEX = /\b([a-z]+-[a-z]+-[a-z]+)\b/i;
+// Orphan tool_result marker emitted by ccDNA validate mode
+// Example: [ekkOS] ORPHAN_TOOL_RESULT {"idx":0,"tool_use_id":"toolu_01...","block_idx":0}
+const ORPHAN_MARKER_REGEX = /\[ekkOS\]\s+ORPHAN_TOOL_RESULT\s+(\{.*?\})/gi;
+// Cooldown to prevent thrashing if output repeats the marker
+const ORPHAN_DETECTION_COOLDOWN_MS = 15000;
+// ═══════════════════════════════════════════════════════════════════════════
+// SILENT FAILURE DETECTION - Catch API errors even when ccDNA markers missing
+// ═══════════════════════════════════════════════════════════════════════════
+// Pattern 1: API returns 400 error (often due to orphan tool_results)
+const API_400_REGEX = /(?:status[:\s]*400|"status":\s*400|HTTP\/\d\.\d\s+400|error.*400)/i;
+// Pattern 2: Anthropic API specific error about tool_result without tool_use
+const ORPHAN_API_ERROR_REGEX = /tool_result.*(?:no matching|without|missing).*tool_use|tool_use.*not found/i;
+// Pattern 3: Generic "invalid" message structure error
+const INVALID_MESSAGE_REGEX = /invalid.*message|message.*invalid|malformed.*request/i;
+// Cooldown for silent failure detection (separate from orphan marker cooldown)
+const SILENT_FAILURE_COOLDOWN_MS = 30000;
 // ═══════════════════════════════════════════════════════════════════════════
 // SESSION NAME VALIDATION (MUST use words from session-words.json)
 // This is the SOURCE OF TRUTH for valid session names
@@ -222,17 +365,29 @@ async function runSlashCommand(shell, command, config, getOutputBuffer, arg) {
     await typeSlowly(shell, '/', config.charDelayMs);
     dlog('Typed / to open palette');
     // STEP 3: Wait for palette to open
-    await sleep(config.slashOpenDelayMs);
+    // Improved: Poll for palette indicator instead of hard sleep.
+    // This reduces latency on fast machines while ensuring safety on slow ones.
+    let paletteVisible = false;
+    const paletteStartTime = Date.now();
+    const maxWait = config.slashOpenDelayMs + config.paletteRetryMs;
+    while (Date.now() - paletteStartTime < maxWait) {
+        const currentBuffer = getOutputBuffer();
+        if (PALETTE_INDICATOR_REGEX.test(stripAnsi(currentBuffer))) {
+            paletteVisible = true;
+            dlog(`Palette detected after ${Date.now() - paletteStartTime}ms`);
+            break;
+        }
+        await sleep(50);
+    }
     // STEP 4: Check if palette opened (look for command indicators in buffer)
-    const bufferAfterSlash = getOutputBuffer();
-    if (!PALETTE_INDICATOR_REGEX.test(stripAnsi(bufferAfterSlash))) {
-        // Palette might not have opened - retry once
-        dlog('Palette indicator not detected, retrying with extra wait');
-        await sleep(config.paletteRetryMs);
-        // Type / again in case first one was eaten
-        shell.write('\x15'); // Clear line again
-        await sleep(60);
+    if (!paletteVisible) {
+        // Palette definitely didn't open - retry once
+        dlog('Palette indicator not detected after polling, retrying with force clear');
+        // Type / again in case first one was eaten or stuck in mid-render
+        shell.write('\x15'); // Ctrl+U
+        await sleep(100);
         await typeSlowly(shell, '/', config.charDelayMs);
+        // Brief wait for the second attempt
         await sleep(config.slashOpenDelayMs);
     }
     // STEP 5: Type the command
@@ -254,58 +409,191 @@ async function runSlashCommand(shell, command, config, getOutputBuffer, arg) {
 // Memory API URL
 const MEMORY_API_URL = 'https://mcp.ekkos.dev';
 const isWindows = os.platform() === 'win32';
-// Pinned Claude Code version for ekkos run
-// 2.1.6 has the old context calculation (95% of full 200K, not effective window)
-// NOTE: Homebrew global installs may be broken, but npm installs work fine
-const PINNED_CLAUDE_VERSION = '2.1.6';
+// Claude Code version for ekkos run
+// 'latest' = use latest version, or specify like '2.1.33' for specific version
+// Core ekkOS patches (eviction, context management) work with all recent versions
+// Cosmetic patches may fail on newer versions but don't affect functionality
+const PINNED_CLAUDE_VERSION = '2.1.33';
+// Max output tokens for Claude responses
+// Default: 16384 (safe for Sonnet 4.5)
+// Opus 4.5 supports up to 64k - set EKKOS_MAX_OUTPUT_TOKENS=32768 or =65536 to use higher limits
+// Configurable via environment variable
+const EKKOS_MAX_OUTPUT_TOKENS = process.env.EKKOS_MAX_OUTPUT_TOKENS || '16384';
+// Default proxy URL for context eviction
+// eslint-disable-next-line no-restricted-syntax -- Config URL, not API key
+const EKKOS_PROXY_URL = process.env.EKKOS_PROXY_URL || 'https://mcp.ekkos.dev';
+// Track proxy mode for getEkkosEnv (set by run() based on options)
+let proxyModeEnabled = true;
+// ═══════════════════════════════════════════════════════════════════════════
+// SESSION NAME GENERATION - Uses shared uuidToWords from state.ts
+// ═══════════════════════════════════════════════════════════════════════════
+/**
+ * Generate a unique session UUID and convert to human-readable name
+ * Each CLI invocation gets a NEW session (not tied to project path)
+ * Uses uuidToWords from state.ts for consistency with hooks
+ */
+function generateCliSessionName() {
+    const sessionUuid = crypto.randomUUID();
+    return (0, state_1.uuidToWords)(sessionUuid);
+}
+// Track current CLI session name (set once at startup, stable for entire run)
+let cliSessionName = null;
+let cliSessionId = null;
+/**
+ * Get environment with ekkOS enhancements
+ * - Sets CLAUDE_CODE_MAX_OUTPUT_TOKENS to 32k for longer responses
+ * - Routes API through ekkOS proxy for seamless context eviction (when enabled)
+ * - Sets EKKOS_PROXY_MODE to signal JSONL rewriter to disable eviction
+ * - Passes session headers for eviction/retrieval context tracking
+ */
+function getEkkosEnv() {
+    /* eslint-disable no-restricted-syntax -- System env spreading, not API key access */
+    const env = {
+        ...process.env,
+        CLAUDE_CODE_MAX_OUTPUT_TOKENS: EKKOS_MAX_OUTPUT_TOKENS,
+    };
+    /* eslint-enable no-restricted-syntax */
+    // Check if proxy is disabled via env var or options
+    // eslint-disable-next-line no-restricted-syntax -- Feature flag, not API key
+    const proxyDisabled = process.env.EKKOS_DISABLE_PROXY === '1' || !proxyModeEnabled;
+    if (!proxyDisabled) {
+        env.EKKOS_PROXY_MODE = '1';
+        // Enable ultra-minimal mode by default (30%→20% eviction for constant-cost infinite context)
+        env.EKKOS_ULTRA_MINIMAL = '1';
+        // Use placeholder for session name - will be bound by hook with Claude's real session
+        // This fixes the mismatch where CLI generated one name but Claude Code used another
+        // The hook calls POST /proxy/session/bind with Claude's actual session name
+        if (!cliSessionName) {
+            cliSessionName = '_pending'; // Placeholder - hook will bind real name
+            cliSessionId = `pending-${Date.now()}`;
+            console.log(chalk_1.default.gray(`  📂 Session: pending (will bind to Claude session)`));
+        }
+        // Get full userId from config (NOT the truncated version from auth token)
+        // Config has full UUID like "d4532ba0-0a86-42ce-bab4-22aa62b55ce6"
+        // This matches the turns/ R2 structure: turns/{fullUserId}/{sessionName}/
+        const ekkosConfig = (0, state_1.getConfig)();
+        let userId = ekkosConfig?.userId || 'anonymous';
+        // Fallback to auth token extraction if config doesn't have userId
+        if (userId === 'anonymous') {
+            const authToken = (0, state_1.getAuthToken)();
+            if (authToken?.startsWith('ekk_')) {
+                const parts = authToken.split('_');
+                if (parts.length >= 2) {
+                    userId = parts[1];
+                }
+            }
+        }
+        // CRITICAL: Embed user/session in URL path since ANTHROPIC_HEADERS doesn't work
+        // Claude Code SDK doesn't forward custom headers, but it DOES use ANTHROPIC_BASE_URL
+        // Format: https://mcp.ekkos.dev/proxy/{userId}/{sessionName}?project={base64(cwd)}
+        // Gateway extracts from URL: /proxy/{userId}/{sessionName}/v1/messages
+        // Project path is base64-encoded to handle special chars safely
+        const projectPath = process.cwd();
+        const projectPathEncoded = Buffer.from(projectPath).toString('base64url');
+        const proxyUrl = `${EKKOS_PROXY_URL}/proxy/${encodeURIComponent(userId)}/${encodeURIComponent(cliSessionName)}?project=${projectPathEncoded}`;
+        env.ANTHROPIC_BASE_URL = proxyUrl;
+        console.log(chalk_1.default.gray(`  📡 Proxy: ${proxyUrl.replace(userId, userId.slice(0, 8) + '...')}`));
+    }
+    else {
+        env.EKKOS_PROXY_MODE = '0';
+    }
+    return env;
+}
 // ekkOS-managed Claude installation path
 const EKKOS_CLAUDE_DIR = path.join(os.homedir(), '.ekkos', 'claude-code');
 const EKKOS_CLAUDE_BIN = path.join(EKKOS_CLAUDE_DIR, 'node_modules', '.bin', 'claude');
 /**
- * Check if a Claude installation matches our required version
+ * Check if a Claude installation exists and get its version
+ * Returns version string if found, null otherwise
  */
-function checkClaudeVersion(claudePath) {
+function getClaudeVersion(claudePath) {
     try {
         const version = (0, child_process_1.execSync)(`"${claudePath}" --version 2>/dev/null`, { encoding: 'utf-8' }).trim();
-        // Version output is like "2.1.6 (Claude Code)" - extract the version number
-        const match = version.match(/^(\d+\.\d+\.\d+)/);
-        if (match) {
-            return match[1] === PINNED_CLAUDE_VERSION;
-        }
-        return false;
+        // Look for pattern like "2.1.6 (Claude Code)" or just "2.1.6" anywhere in output
+        const match = version.match(/(\d+\.\d+\.\d+)\s*\(Claude Code\)/);
+        if (match)
+            return match[1];
+        const fallbackMatch = version.match(/(\d+\.\d+\.\d+)/);
+        if (fallbackMatch)
+            return fallbackMatch[1];
+        return null;
     }
     catch {
-        return false;
+        return null;
     }
 }
+/**
+ * Check if a Claude installation matches our required version
+ * When PINNED_CLAUDE_VERSION is 'latest', any version is acceptable
+ */
+function checkClaudeVersion(claudePath) {
+    const version = getClaudeVersion(claudePath);
+    if (!version)
+        return false;
+    // 'latest' means any version is acceptable
+    if (PINNED_CLAUDE_VERSION === 'latest')
+        return true;
+    return version === PINNED_CLAUDE_VERSION;
+}
 /**
  * Install Claude Code to ekkOS-managed directory
  * This gives us full control over the version without npx auto-update messages
  */
 function installEkkosClaudeVersion() {
-    console.log(chalk_1.default.cyan(`\n📦 Installing Claude Code v${PINNED_CLAUDE_VERSION} to ~/.ekkos/claude-code...`));
+    const versionLabel = PINNED_CLAUDE_VERSION === 'latest' ? 'latest' : `v${PINNED_CLAUDE_VERSION}`;
+    console.log(chalk_1.default.cyan(`\n📦 Installing Claude Code ${versionLabel} to ~/.ekkos/claude-code...`));
     console.log(chalk_1.default.gray('   (This is a one-time setup for optimal context window behavior)\n'));
     try {
         // Create directory if needed
         if (!fs.existsSync(EKKOS_CLAUDE_DIR)) {
             fs.mkdirSync(EKKOS_CLAUDE_DIR, { recursive: true });
         }
-        // Initialize package.json if needed
+        // Clean existing installation to ensure correct version is installed
+        // This prevents npm from reusing a cached/different version
+        const nodeModulesPath = path.join(EKKOS_CLAUDE_DIR, 'node_modules');
+        const packageLockPath = path.join(EKKOS_CLAUDE_DIR, 'package-lock.json');
+        if (fs.existsSync(nodeModulesPath)) {
+            fs.rmSync(nodeModulesPath, { recursive: true, force: true });
+        }
+        if (fs.existsSync(packageLockPath)) {
+            fs.unlinkSync(packageLockPath);
+        }
+        // Always write fresh package.json with exact version pinned
         const packageJsonPath = path.join(EKKOS_CLAUDE_DIR, 'package.json');
-        if (!fs.existsSync(packageJsonPath)) {
-            fs.writeFileSync(packageJsonPath, JSON.stringify({
-                name: 'ekkos-claude-code',
-                version: '1.0.0',
-                private: true,
-                description: 'ekkOS-managed Claude Code installation'
-            }, null, 2));
-        }
-        // Install specific version
-        (0, child_process_1.execSync)(`npm install @anthropic-ai/claude-code@${PINNED_CLAUDE_VERSION}`, {
+        fs.writeFileSync(packageJsonPath, JSON.stringify({
+            name: 'ekkos-claude-code',
+            version: '1.0.0',
+            private: true,
+            description: 'ekkOS-managed Claude Code installation',
+            dependencies: {
+                '@anthropic-ai/claude-code': PINNED_CLAUDE_VERSION
+            }
+        }, null, 2));
+        // Install with exact version pinning
+        (0, child_process_1.execSync)(`npm install --save-exact`, {
             cwd: EKKOS_CLAUDE_DIR,
             stdio: 'inherit'
         });
-        console.log(chalk_1.default.green(`\n✓ Claude Code v${PINNED_CLAUDE_VERSION} installed successfully!`));
+        // Verify the installed version
+        const installedPkgPath = path.join(EKKOS_CLAUDE_DIR, 'node_modules', '@anthropic-ai', 'claude-code', 'package.json');
+        let installedVersion = 'unknown';
+        if (fs.existsSync(installedPkgPath)) {
+            const installedPkg = JSON.parse(fs.readFileSync(installedPkgPath, 'utf-8'));
+            installedVersion = installedPkg.version;
+            // Only check version match if not using 'latest'
+            if (PINNED_CLAUDE_VERSION !== 'latest' && installedPkg.version !== PINNED_CLAUDE_VERSION) {
+                console.error(chalk_1.default.red(`\n✗ Version mismatch: expected ${PINNED_CLAUDE_VERSION}, got ${installedPkg.version}`));
+                console.log(chalk_1.default.yellow('   Trying to force correct version...\n'));
+                // Force reinstall with exact version
+                fs.rmSync(nodeModulesPath, { recursive: true, force: true });
+                (0, child_process_1.execSync)(`npm install @anthropic-ai/claude-code@${PINNED_CLAUDE_VERSION} --save-exact`, {
+                    cwd: EKKOS_CLAUDE_DIR,
+                    stdio: 'inherit'
+                });
+                installedVersion = PINNED_CLAUDE_VERSION;
+            }
+        }
+        console.log(chalk_1.default.green(`\n✓ Claude Code v${installedVersion} installed successfully!`));
         return true;
     }
     catch (err) {
@@ -318,54 +606,45 @@ function installEkkosClaudeVersion() {
  * Resolve full path to claude executable
  * Returns direct path if found with correct version, otherwise 'npx:VERSION'
  *
- * IMPORTANT: We MUST use version 2.1.6 specifically because Anthropic changed
- * context window calculation after this version. 2.1.6 uses 95% of full 200K,
- * newer versions use a different (more restrictive) effective window.
+ * IMPORTANT: We pin to a specific Claude Code version (currently 2.1.33) to ensure
+ * consistent behavior with ekkOS context management and eviction patches.
+ *
+ * CRITICAL: ekkos run ONLY uses the ekkOS-managed installation at ~/.ekkos/claude-code/
+ * This ensures complete separation from the user's existing Claude installation (Homebrew/npm).
+ * The user's `claude` command remains untouched and can be any version.
  *
  * Priority:
- * 1. ekkOS-managed installation (~/.ekkos/claude-code) - CLEANEST, auto-installed
- * 2. Homebrew/global install IF version matches 2.1.6
- * 3. npx with pinned version (fallback, shows update message)
+ * 1. ekkOS-managed installation (~/.ekkos/claude-code) - ONLY option for ekkos run
+ * 2. Auto-install if doesn't exist
+ * 3. npx with pinned version (fallback if install fails)
  */
 function resolveClaudePath() {
-    // PRIORITY 1: ekkOS-managed installation (cleanest - no update messages)
+    // PRIORITY 1: ekkOS-managed installation
     if (fs.existsSync(EKKOS_CLAUDE_BIN) && checkClaudeVersion(EKKOS_CLAUDE_BIN)) {
         return EKKOS_CLAUDE_BIN;
     }
-    // PRIORITY 2: Check Homebrew and global installations - only use if version matches
-    const candidatePaths = [
-        // Homebrew
-        '/opt/homebrew/bin/claude', // macOS Apple Silicon
-        '/usr/local/bin/claude', // macOS Intel
-        '/home/linuxbrew/.linuxbrew/bin/claude', // Linux (system)
-        path.join(os.homedir(), '.linuxbrew/bin/claude'), // Linux (user)
-        // Global npm install
-        path.join(os.homedir(), '.npm-global/bin/claude'),
-        path.join(os.homedir(), '.local/bin/claude'),
-    ];
-    for (const p of candidatePaths) {
-        if (fs.existsSync(p) && checkClaudeVersion(p)) {
-            return p; // Direct path with correct version
-        }
-    }
-    // PRIORITY 3: Auto-install to ekkOS-managed directory
+    // PRIORITY 2: Auto-install to ekkOS-managed directory (user's Claude stays untouched)
     if (installEkkosClaudeVersion()) {
         if (fs.existsSync(EKKOS_CLAUDE_BIN)) {
             return EKKOS_CLAUDE_BIN;
         }
     }
-    // PRIORITY 4: Fall back to npx with pinned version (shows update message)
+    // PRIORITY 3: Fall back to npx with pinned version (shows update message)
+    // This is rare - only happens if install failed
     return `npx:${PINNED_CLAUDE_VERSION}`;
 }
 /**
  * Original resolve function for fallback to global install
  */
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
 function resolveGlobalClaudePath() {
     // Windows global paths
     if (isWindows) {
+        /* eslint-disable no-restricted-syntax -- System paths, not API keys */
         const windowsPaths = [
             path.join(process.env.APPDATA || '', 'npm', 'claude.cmd'),
             path.join(process.env.LOCALAPPDATA || '', 'npm', 'claude.cmd'),
+            /* eslint-enable no-restricted-syntax */
             path.join(os.homedir(), 'AppData', 'Roaming', 'npm', 'claude.cmd'),
             path.join(os.homedir(), '.npm-global', 'claude.cmd')
         ];
@@ -467,7 +746,7 @@ async function emergencyCapture(transcriptPath, sessionId) {
             dlog('Context captured to ekkOS');
         }
     }
-    catch (err) {
+    catch {
         // Silent fail - don't block the clear process
         dlog('Warning: Could not capture context');
     }
@@ -508,8 +787,17 @@ async function run(options) {
     const verbose = options.verbose || false;
     const bypass = options.bypass || false;
     const noInject = options.noInject || false;
+    // Set proxy mode based on options (used by getEkkosEnv)
+    proxyModeEnabled = !(options.noProxy || false);
+    if (proxyModeEnabled) {
+        console.log(chalk_1.default.cyan('  🧠 ekkOS_Continuum Loaded!'));
+    }
+    else if (verbose) {
+        console.log(chalk_1.default.yellow('  ⏭️  API proxy disabled (--no-proxy)'));
+    }
     // Generate instance ID for this run
     const instanceId = generateInstanceId();
+    // eslint-disable-next-line no-restricted-syntax -- Instance tracking, not API key
     process.env.EKKOS_INSTANCE_ID = instanceId;
     // ══════════════════════════════════════════════════════════════════════════
     // PRE-FLIGHT DIAGNOSTICS (--doctor flag)
@@ -540,8 +828,43 @@ async function run(options) {
     // ══════════════════════════════════════════════════════════════════════════
     (0, state_1.ensureEkkosDir)();
     (0, state_1.clearAutoClearFlag)();
+    // Resolve Claude path FIRST so ccDNA patches the RIGHT installation
     const rawClaudePath = resolveClaudePath();
     const isNpxMode = rawClaudePath.startsWith('npx:');
+    // Get the actual CLI path for ccDNA to patch
+    // CRITICAL: ONLY patch the ekkOS-managed installation, NEVER touch Homebrew/global!
+    let claudeCliPath;
+    // Always target the ekkOS-managed installation for patching
+    // Even if we're running from Homebrew, we only patch our own installation
+    if (fs.existsSync(EKKOS_CLAUDE_BIN)) {
+        try {
+            const realPath = fs.realpathSync(EKKOS_CLAUDE_BIN);
+            if (realPath.endsWith('.js') && fs.existsSync(realPath)) {
+                claudeCliPath = realPath;
+            }
+        }
+        catch {
+            // Ignore - will use default detection
+        }
+    }
+    // ══════════════════════════════════════════════════════════════════════════
+    // ccDNA AUTO-PATCH: Apply Claude Code customizations before spawn
+    // This patches the context warning, themes, and other ccDNA features
+    // Skip if --no-dna flag is set
+    // ══════════════════════════════════════════════════════════════════════════
+    const noDna = options.noDna || false;
+    let ccdnaVersion = null;
+    if (noDna) {
+        if (verbose) {
+            console.log(chalk_1.default.yellow('  ⏭️  Skipping ccDNA injection (--no-dna)'));
+        }
+    }
+    else {
+        if (verbose && claudeCliPath) {
+            console.log(chalk_1.default.gray(`  🔧 Patching: ${claudeCliPath}`));
+        }
+        ccdnaVersion = applyCcdnaPatches(verbose, claudeCliPath);
+    }
     const pinnedVersion = isNpxMode ? rawClaudePath.split(':')[1] : null;
     const claudePath = isNpxMode ? 'npx' : rawClaudePath;
     // Build args early
@@ -554,7 +877,6 @@ async function run(options) {
     }
     // Check PTY availability early
     const usePty = pty !== null;
-    const monitorOnlyMode = noInject || (isWindows && !usePty);
     // ══════════════════════════════════════════════════════════════════════════
     // CONCURRENT STARTUP: Spawn Claude while animation runs
     // Buffer output until animation completes, then flush
@@ -574,7 +896,7 @@ async function run(options) {
                 cols: process.stdout.columns || 80,
                 rows: process.stdout.rows || 24,
                 cwd: process.cwd(),
-                env: process.env
+                env: getEkkosEnv()
             });
             // Buffer output until animation completes using delegating handler
             earlyDataHandler = (data) => {
@@ -657,14 +979,18 @@ async function run(options) {
             // Find positions with sparkle-able characters
             const sparklePositions = [];
             for (let i = 0; i < line.length; i++) {
-                if (sparkleChars.includes(line[i])) {
+                const charItem = line[i];
+                if (typeof charItem === 'string' && sparkleChars.includes(charItem)) {
                     sparklePositions.push(i);
                 }
             }
             if (sparklePositions.length > 0) {
                 const pos = sparklePositions[Math.floor(Math.random() * sparklePositions.length)];
+                const charAtPos = line[pos];
                 // Mark this position for sparkle (we'll handle coloring below)
-                frameLines[lineIdx][pos] = { char: line[pos], sparkle: true };
+                if (typeof charAtPos === 'string') {
+                    frameLines[lineIdx][pos] = { char: charAtPos, sparkle: true };
+                }
             }
         }
         // Move cursor up and render frame
@@ -672,7 +998,7 @@ async function run(options) {
         for (const line of frameLines) {
             let output = '';
             for (const char of line) {
-                if (char && typeof char === 'object' && char.sparkle) {
+                if (typeof char === 'object' && 'sparkle' in char && char.sparkle) {
                     const sparkleColor = sparkleColors[Math.floor(Math.random() * sparkleColors.length)];
                     output += sparkleColor(char.char);
                 }
@@ -772,6 +1098,9 @@ async function run(options) {
     if (bypass) {
         console.log(chalk_1.default.yellow('  ⚡ Bypass permissions mode enabled'));
     }
+    if (noDna) {
+        console.log(chalk_1.default.yellow('  ⏭️  ccDNA injection skipped (--no-dna)'));
+    }
     if (verbose) {
         console.log(chalk_1.default.gray(`  📁 Debug log: ${config.debugLogPath}`));
         console.log(chalk_1.default.gray(`  ⏱  Timing: clear=${config.clearWaitMs}ms, idleMax=${config.maxIdleWaitMs}ms (~${Math.round((config.clearWaitMs + config.maxIdleWaitMs * 2 + 1700) / 1000)}s total)`));
@@ -820,9 +1149,8 @@ async function run(options) {
     let isAutoClearInProgress = false;
     let transcriptPath = null;
     let currentSessionId = null;
-    // Stream tailer for mid-turn context capture
+    // Stream tailer for mid-turn context capture (must be declared before polling code)
     let streamTailer = null;
-    // Instance-namespaced cache directory per spec v1.2
     const streamCacheDir = path.join(os.homedir(), '.ekkos', 'cache', 'sessions', instanceId);
     // Helper to start stream tailer when we have transcript path
     function startStreamTailer(tPath, sId, sName) {
@@ -853,6 +1181,132 @@ async function run(options) {
             dlog('Stream tailer stopped');
         }
     }
+    // ════════════════════════════════════════════════════════════════════════════
+    // FAST TRANSCRIPT DETECTION: Poll for new jsonl files immediately
+    // Claude creates the transcript file BEFORE outputting the session name
+    // So we watch for new files rather than parsing TUI output (which is slower)
+    // ════════════════════════════════════════════════════════════════════════════
+    const encodedCwd = process.cwd().replace(/\//g, '-');
+    const projectDir = path.join(os.homedir(), '.claude', 'projects', encodedCwd);
+    const launchTime = Date.now();
+    // Track existing jsonl files at startup
+    let existingJsonlFiles = new Set();
+    try {
+        const files = fs.readdirSync(projectDir);
+        existingJsonlFiles = new Set(files.filter(f => f.endsWith('.jsonl')));
+        dlog(`[TRANSCRIPT] Found ${existingJsonlFiles.size} existing jsonl files at startup`);
+    }
+    catch {
+        dlog('[TRANSCRIPT] Project dir does not exist yet');
+    }
+    // Poll for new transcript file every 500ms for up to 30 seconds
+    let transcriptPollInterval = null;
+    function pollForNewTranscript() {
+        if (transcriptPath) {
+            // Already found - stop polling
+            if (transcriptPollInterval) {
+                clearInterval(transcriptPollInterval);
+                transcriptPollInterval = null;
+            }
+            return;
+        }
+        // Stop after 30 seconds
+        if (Date.now() - launchTime > 30000) {
+            // FALLBACK FIX: If no transcript found yet, pick most recent jsonl as best guess
+            // This handles /continue scenarios where the file already existed
+            if (!transcriptPath) {
+                try {
+                    const files = fs.readdirSync(projectDir);
+                    const jsonlFiles = files
+                        .filter(f => f.endsWith('.jsonl'))
+                        .map(f => ({
+                        name: f,
+                        path: path.join(projectDir, f),
+                        mtime: fs.statSync(path.join(projectDir, f)).mtimeMs
+                    }))
+                        .sort((a, b) => b.mtime - a.mtime);
+                    if (jsonlFiles.length > 0) {
+                        transcriptPath = jsonlFiles[0].path;
+                        currentSessionId = jsonlFiles[0].name.replace('.jsonl', '');
+                        dlog(`[TRANSCRIPT] TIMEOUT FALLBACK: Using most recent file ${transcriptPath}`);
+                        evictionDebugLog('TRANSCRIPT_SET', 'Polling timeout fallback - using most recent jsonl', {
+                            transcriptPath,
+                            currentSessionId,
+                            fileCount: jsonlFiles.length,
+                        });
+                        startStreamTailer(transcriptPath, currentSessionId);
+                    }
+                    else {
+                        dlog('[TRANSCRIPT] TIMEOUT FALLBACK: No jsonl files found in project dir');
+                    }
+                }
+                catch (err) {
+                    dlog(`[TRANSCRIPT] TIMEOUT FALLBACK ERROR: ${err.message}`);
+                }
+            }
+            dlog('[TRANSCRIPT] Polling timeout - fallback complete');
+            if (transcriptPollInterval) {
+                clearInterval(transcriptPollInterval);
+                transcriptPollInterval = null;
+            }
+            return;
+        }
+        try {
+            const currentFiles = fs.readdirSync(projectDir);
+            const jsonlFiles = currentFiles.filter(f => f.endsWith('.jsonl'));
+            // Find NEW files (created after we started)
+            for (const file of jsonlFiles) {
+                if (!existingJsonlFiles.has(file)) {
+                    // New file! This is our transcript
+                    const fullPath = path.join(projectDir, file);
+                    const sessionId = file.replace('.jsonl', '');
+                    transcriptPath = fullPath;
+                    currentSessionId = sessionId;
+                    dlog(`[TRANSCRIPT] FAST DETECT: New transcript found! ${fullPath}`);
+                    evictionDebugLog('TRANSCRIPT_SET', 'Fast poll detected new file', {
+                        transcriptPath,
+                        currentSessionId,
+                        elapsedMs: Date.now() - launchTime
+                    });
+                    startStreamTailer(transcriptPath, currentSessionId);
+                    // Stop polling
+                    if (transcriptPollInterval) {
+                        clearInterval(transcriptPollInterval);
+                        transcriptPollInterval = null;
+                    }
+                    return;
+                }
+            }
+            // Also check for recently modified files (in case we missed the creation)
+            const recentFiles = jsonlFiles
+                .map(f => ({ name: f, path: path.join(projectDir, f), mtime: fs.statSync(path.join(projectDir, f)).mtimeMs }))
+                .filter(f => f.mtime > launchTime - 2000) // Modified within 2s of launch
+                .sort((a, b) => b.mtime - a.mtime);
+            if (recentFiles.length > 0) {
+                const newest = recentFiles[0];
+                transcriptPath = newest.path;
+                currentSessionId = newest.name.replace('.jsonl', '');
+                dlog(`[TRANSCRIPT] FAST DETECT: Recent transcript found! ${transcriptPath}`);
+                evictionDebugLog('TRANSCRIPT_SET', 'Fast poll found recent file', {
+                    transcriptPath,
+                    currentSessionId,
+                    elapsedMs: Date.now() - launchTime
+                });
+                startStreamTailer(transcriptPath, currentSessionId);
+                if (transcriptPollInterval) {
+                    clearInterval(transcriptPollInterval);
+                    transcriptPollInterval = null;
+                }
+            }
+        }
+        catch {
+            // Project dir doesn't exist yet, keep polling
+        }
+    }
+    // Start polling immediately
+    transcriptPollInterval = setInterval(pollForNewTranscript, 500);
+    pollForNewTranscript(); // Also run once immediately
+    dlog('[TRANSCRIPT] Fast polling started - looking for new jsonl files');
     // ══════════════════════════════════════════════════════════════════════════
     // SESSION NAME TRACKING (from live TUI output)
     // Claude prints: "· Turn N · groovy-koala-saves · 📅"
@@ -869,42 +1323,203 @@ async function run(options) {
     // Debounce tracking to prevent double triggers
     let lastDetectionTime = 0;
     const DETECTION_COOLDOWN = 30000; // 30 seconds cooldown
-    // Use args from early setup
-    const args = earlyArgs;
+    // JSONL eviction tracking - prevent rapid re-eviction
+    let lastEvictionTime = 0;
     // ══════════════════════════════════════════════════════════════════════════
-    // WINDOWS: MONITOR-ONLY MODE WITHOUT PTY (Per Spec v1.2 Addendum)
-    // Without node-pty/ConPTY, auto-continue cannot work on Windows.
-    // Instead of hard-failing, we enter monitor-only mode.
+    // ORPHAN TOOL_RESULT RECOVERY - React to ccDNA validate mode markers
     // ══════════════════════════════════════════════════════════════════════════
-    if (isWindows && !usePty) {
-        console.log('');
-        console.log(chalk_1.default.yellow.bold('⚠️  Monitor-only mode (PTY not available)'));
-        console.log('');
-        console.log(chalk_1.default.gray('Without node-pty (ConPTY), auto-continue cannot inject commands.'));
-        console.log(chalk_1.default.gray('ekkOS will monitor context usage and provide instructions when needed.'));
-        console.log('');
-        console.log(chalk_1.default.cyan('To enable auto-continue:'));
-        console.log(chalk_1.default.white('  Option 1: Use Node 20 or 22 LTS'));
-        console.log(chalk_1.default.gray('    winget install OpenJS.NodeJS.LTS'));
-        console.log(chalk_1.default.white('  Option 2: npm install node-pty-prebuilt-multiarch'));
-        console.log('');
-        console.log(chalk_1.default.gray('Run `ekkos doctor` for detailed diagnostics.'));
-        console.log('');
+    let lastOrphanDetectionTime = 0;
+    let isOrphanRecoveryInProgress = false;
+    // Deduplication: track orphan tool_use_ids we've already handled
+    const handledOrphanIds = new Set();
+    // Separate buffer for orphan detection (larger, to avoid truncation)
+    let orphanDetectionBuffer = '';
+    // Cursor for efficient scanning (avoids re-scanning already-processed text)
+    let orphanScanCursor = 0;
+    const ORPHAN_SCAN_TAIL_SLACK = 256; // Keep some overlap for chunk boundary tolerance
+    // ══════════════════════════════════════════════════════════════════════════
+    // SILENT FAILURE DETECTION - Catch API errors even without ccDNA markers
+    // ══════════════════════════════════════════════════════════════════════════
+    let lastSilentFailureTime = 0;
+    let silentFailureCount = 0;
+    const MAX_SILENT_FAILURES_BEFORE_ALERT = 2; // Alert user after 2 silent failures
+    // ══════════════════════════════════════════════════════════════════════════
+    // TURN-END EVICTION - Only clean up when Claude is idle (safe state)
+    // ══════════════════════════════════════════════════════════════════════════
+    let lastContextPercent = 0;
+    let lastLoggedPercent = 0; // For throttling context % logs
+    let turnEndTimeout = null;
+    const TURN_END_STABLE_MS = 500; // Must see idle prompt for 500ms
+    let pendingClearAfterEviction = false; // Flag to trigger /clear after eviction
+    // Debug log to eviction-debug.log for 400 error diagnosis
+    function evictionDebugLog(category, msg, data) {
+        try {
+            const logDir = path.join(os.homedir(), '.ekkos', 'logs');
+            if (!fs.existsSync(logDir))
+                fs.mkdirSync(logDir, { recursive: true });
+            const logPath = path.join(logDir, 'eviction-debug.log');
+            const ts = new Date().toISOString();
+            const line = `[${ts}] [${category}] ${msg}${data ? '\n  ' + JSON.stringify(data, null, 2).replace(/\n/g, '\n  ') : ''}`;
+            fs.appendFileSync(logPath, line + '\n');
+        }
+        catch { /* silent */ }
     }
-    else if (noInject) {
-        console.log(chalk_1.default.yellow('  Monitor-only mode (--no-inject)'));
+    // DEFENSIVE: Validate transcriptPath is a real file, not corrupted garbage
+    function validateTranscriptPath(pathToCheck) {
+        if (!pathToCheck)
+            return false;
+        // Check for ANSI escape codes (corruption signal)
+        if (pathToCheck.includes('\u001b') || pathToCheck.includes('\x1b')) {
+            evictionDebugLog('PATH_INVALID', 'Transcript path contains ANSI escape codes - clearing', {
+                path: pathToCheck.slice(0, 100),
+            });
+            return false;
+        }
+        // Check it starts with / or ~ (absolute path)
+        if (!pathToCheck.startsWith('/') && !pathToCheck.startsWith('~')) {
+            evictionDebugLog('PATH_INVALID', 'Transcript path is not absolute - clearing', {
+                path: pathToCheck.slice(0, 100),
+            });
+            return false;
+        }
+        // Check file exists
+        if (!fs.existsSync(pathToCheck)) {
+            evictionDebugLog('PATH_INVALID', 'Transcript path does not exist - clearing', {
+                path: pathToCheck,
+            });
+            return false;
+        }
+        return true;
     }
-    if (verbose) {
-        if (isNpxMode) {
-            console.log(chalk_1.default.gray(`  🤖 Using claude-code@${pinnedVersion} via npx (pinned for better context)`));
+    /**
+     * Check if there are in-flight tool calls (tool_uses without matching tool_results)
+     * CRITICAL: We must NOT evict while tools are in-flight or we'll orphan tool_results
+     */
+    function hasInFlightTools() {
+        if (!transcriptPath)
+            return false;
+        try {
+            const content = fs.readFileSync(transcriptPath, 'utf-8');
+            const lines = content.split('\n').filter(l => l.trim());
+            // Extract all tool_use IDs and tool_result references
+            const toolUseIds = new Set();
+            const toolResultIds = new Set();
+            for (const line of lines) {
+                // Extract tool_use IDs using JSON parsing
+                try {
+                    const obj = JSON.parse(line);
+                    const contentArr = obj?.message?.content;
+                    if (Array.isArray(contentArr)) {
+                        for (const block of contentArr) {
+                            if (block?.type === 'tool_use' && typeof block?.id === 'string') {
+                                toolUseIds.add(block.id);
+                            }
+                            if (block?.type === 'tool_result' && typeof block?.tool_use_id === 'string') {
+                                toolResultIds.add(block.tool_use_id);
+                            }
+                        }
+                    }
+                }
+                catch {
+                    // Skip invalid JSON lines
+                }
+            }
+            // In-flight = tool_uses that don't have matching results yet
+            const inFlightCount = [...toolUseIds].filter(id => !toolResultIds.has(id)).length;
+            if (inFlightCount > 0) {
+                evictionDebugLog('IN_FLIGHT_CHECK', `Found ${inFlightCount} in-flight tools - blocking eviction`, {
+                    totalToolUses: toolUseIds.size,
+                    totalToolResults: toolResultIds.size,
+                    inFlightCount,
+                });
+                return true;
+            }
+            return false;
         }
-        else {
-            console.log(chalk_1.default.gray(`  🤖 Using claude at: ${claudePath}`));
+        catch (err) {
+            evictionDebugLog('IN_FLIGHT_ERROR', `Failed to check in-flight tools: ${err.message}`);
+            return true; // Assume in-flight on error (safer)
+        }
+    }
+    async function handleTurnEnd() {
+        if (!transcriptPath || isAutoClearInProgress)
+            return;
+        // DEFENSIVE: Validate path before using
+        if (!validateTranscriptPath(transcriptPath)) {
+            evictionDebugLog('TURN_END_ABORT', 'Invalid transcriptPath detected - resetting to null', {
+                corruptedPath: transcriptPath?.slice(0, 100),
+            });
+            transcriptPath = null;
+            return;
         }
+        // CRITICAL: Don't evict if tools are still in-flight
+        // This prevents orphaning tool_results and causing 400 errors
+        if (hasInFlightTools()) {
+            evictionDebugLog('TURN_END_BLOCKED', 'Eviction blocked - in-flight tools detected');
+            return;
+        }
+        const now = Date.now();
+        if ((now - lastEvictionTime) < 10000)
+            return; // 10s cooldown
+        evictionDebugLog('TURN_END', 'Turn end detected - no in-flight tools', {
+            transcriptPath,
+            lastContextPercent,
+            timeSinceLastEviction: now - lastEvictionTime,
+        });
+        // Run continuous clean first (always safe)
+        const cleanResult = (0, jsonl_rewriter_1.continuousClean)(transcriptPath);
+        if (cleanResult.cleaned > 0) {
+            dlog(`🧹 Turn-end: Cleaned ${cleanResult.cleaned} junk lines`);
+            evictionDebugLog('CONTINUOUS_CLEAN', `Cleaned ${cleanResult.cleaned} junk lines`);
+        }
+        // Then run eviction if needed (disabled when proxy handles it, or via EKKOS_DISABLE_EVICTION=1)
+        // CRITICAL: When proxy mode is enabled, the proxy does seamless eviction - local JSONL eviction must be disabled
+        // eslint-disable-next-line no-restricted-syntax -- Feature flag, not API key
+        const evictionDisabled = process.env.EKKOS_DISABLE_EVICTION === '1' || proxyModeEnabled;
+        if (evictionDisabled) {
+            evictionDebugLog('EVICTION_DISABLED', proxyModeEnabled
+                ? 'Eviction disabled - proxy handles context management'
+                : 'Eviction disabled via EKKOS_DISABLE_EVICTION=1');
+        }
+        else if ((0, jsonl_rewriter_1.needsEviction)(lastContextPercent)) {
+            dlog(`📉 Turn-end eviction at ${lastContextPercent}%`);
+            evictionDebugLog('EVICTION_TRIGGER', `Eviction triggered at ${lastContextPercent}%`);
+            lastEvictionTime = now;
+            // Use HANDSHAKE EVICTION for data safety
+            // This ensures R2 backup is confirmed BEFORE local deletion
+            const result = await (0, jsonl_rewriter_1.evictToTargetAsync)(transcriptPath, lastContextPercent, currentSessionId || undefined, currentSession || undefined);
+            if (result.success && (result.evicted > 0 || result.truncated > 0)) {
+                dlog(`   ✅ Evicted ${result.evicted}, truncated ${result.truncated} → ${result.newPercent}%`);
+                evictionDebugLog('EVICTION_COMPLETE', 'Eviction completed', {
+                    evicted: result.evicted,
+                    truncated: result.truncated,
+                    newPercent: result.newPercent,
+                    handshakeUsed: result.handshakeUsed,
+                });
+                // SLIDING WINDOW: Trigger /clear to make Claude Code reload the slimmed transcript
+                pendingClearAfterEviction = true;
+                dlog('   🔄 Pending /clear to reload evicted transcript');
+            }
+            else {
+                evictionDebugLog('EVICTION_NOOP', 'No eviction performed', result);
+            }
+        }
+    }
+    // Use args from early setup
+    const args = earlyArgs;
+    if (noInject) {
+        console.log(chalk_1.default.yellow('  Monitor-only mode (--no-inject)'));
+    }
+    if (verbose) {
+        // Show Claude version with ccDNA version if patched
+        const ccVersion = pinnedVersion || PINNED_CLAUDE_VERSION;
+        const versionStr = ccdnaVersion
+            ? `Claude Code v${ccVersion} + ekkOS_Continuum v${ccdnaVersion}`
+            : `Claude Code v${ccVersion}`;
+        console.log(chalk_1.default.gray(`  🤖 ${versionStr}`));
         if (currentSession) {
             console.log(chalk_1.default.green(`  📍 Session: ${currentSession}`));
         }
-        console.log(chalk_1.default.gray(`  💻 PTY mode: ${usePty ? 'node-pty' : 'spawn+script (fallback)'}`));
         console.log('');
     }
     let shell;
@@ -947,7 +1562,7 @@ async function run(options) {
                     cols: process.stdout.columns || 80,
                     rows: process.stdout.rows || 24,
                     cwd: process.cwd(),
-                    env: process.env
+                    env: getEkkosEnv()
                 });
                 shell = {
                     write: (data) => ptyShell.write(data),
@@ -958,15 +1573,21 @@ async function run(options) {
                 };
             }
             catch (err) {
-                dlog(`node-pty spawn failed: ${err.message}`);
-                // Fall through to spawn mode
-                return runWithSpawn(claudePath, args, options, {
-                    currentSession,
-                    isAutoClearInProgress,
-                    transcriptPath,
-                    currentSessionId,
-                    outputBuffer
+                // PTY spawn failed - fall back to spawn pass-through
+                dlog(`PTY spawn failed: ${err.message}, using spawn fallback`);
+                const spawnedProcess = (0, child_process_1.spawn)(claudePath, args, {
+                    stdio: 'inherit',
+                    cwd: process.cwd(),
+                    env: getEkkosEnv()
+                });
+                spawnedProcess.on('exit', (code) => process.exit(code ?? 0));
+                spawnedProcess.on('error', (e) => {
+                    console.error(chalk_1.default.red(`Failed to start Claude: ${e.message}`));
+                    process.exit(1);
                 });
+                process.on('SIGINT', () => spawnedProcess.kill('SIGINT'));
+                process.on('SIGTERM', () => spawnedProcess.kill('SIGTERM'));
+                return;
             }
         }
         // Handle terminal resize
@@ -975,14 +1596,26 @@ async function run(options) {
         });
     }
     else {
-        // Fallback: use spawn+script for PTY emulation
-        return runWithSpawn(claudePath, args, options, {
-            currentSession,
-            isAutoClearInProgress,
-            transcriptPath,
-            currentSessionId,
-            outputBuffer
+        // PTY not available - use spawn with stdio inherit (clean pass-through)
+        // This mode doesn't support auto-continue but provides full Claude Code experience
+        dlog('PTY not available, using spawn pass-through mode');
+        const spawnedProcess = (0, child_process_1.spawn)(claudePath, args, {
+            stdio: 'inherit',
+            cwd: process.cwd(),
+            env: getEkkosEnv()
+        });
+        spawnedProcess.on('exit', (code) => {
+            process.exit(code ?? 0);
         });
+        spawnedProcess.on('error', (err) => {
+            console.error(chalk_1.default.red(`Failed to start Claude: ${err.message}`));
+            process.exit(1);
+        });
+        // Handle signals for clean shutdown
+        process.on('SIGINT', () => spawnedProcess.kill('SIGINT'));
+        process.on('SIGTERM', () => spawnedProcess.kill('SIGTERM'));
+        // In spawn mode, we don't continue with the rest of the PTY-specific code
+        return;
     }
     // Forward user input to PTY (named function so we can pause/resume)
     const onStdinData = (data) => {
@@ -996,6 +1629,7 @@ async function run(options) {
     // Helper to get current output buffer (for readiness checks)
     const getOutputBuffer = () => outputBuffer;
     // Handle context wall detection
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     async function handleContextWall() {
         // Debounce check - prevent double triggers (BEFORE pausing stdin)
         const now = Date.now();
@@ -1142,6 +1776,285 @@ async function run(options) {
             dlog('Stdin resumed');
         }
     }
+    // ══════════════════════════════════════════════════════════════════════════
+    // ORPHAN TOOL_RESULT RECOVERY
+    // When ccDNA validate mode detects orphan tool_results before an API call,
+    // it emits [ekkOS] ORPHAN_TOOL_RESULT to the terminal. We detect this marker
+    // and repair the transcript (rollback or surgical).
+    //
+    // NOTE: We do NOT run /clear + /continue anymore. That was leftover from when
+    // ccDNA was in evict mode (filtering in-memory messages). With ccDNA in validate
+    // mode and the JSONL rewriter as the single disk authority, orphans indicate a
+    // BUG in the sliding window - not a state desync that needs rebuilding.
+    // The in-memory state is fine; we just fix the disk and log the bug.
+    // ══════════════════════════════════════════════════════════════════════════
+    function handleOrphanToolResult(orphan) {
+        const now = Date.now();
+        if (isOrphanRecoveryInProgress) {
+            dlog('Orphan recovery already in progress, ignoring');
+            return;
+        }
+        if (now - lastOrphanDetectionTime < ORPHAN_DETECTION_COOLDOWN_MS) {
+            dlog('Orphan recovery suppressed by cooldown');
+            return;
+        }
+        lastOrphanDetectionTime = now;
+        isOrphanRecoveryInProgress = true;
+        // Cancel any pending turn-end eviction timer (don't evict while handling orphan)
+        if (turnEndTimeout) {
+            clearTimeout(turnEndTimeout);
+            turnEndTimeout = null;
+        }
+        // Log the bug - this should NOT happen with a working sliding window
+        evictionDebugLog('ORPHAN_BUG_DETECTED', '═══════════════════════════════════════════════════════════', {
+            alert: '🚨 ORPHAN TOOL_RESULT DETECTED - SLIDING WINDOW BUG 🚨',
+            orphan: {
+                messageIndex: orphan.idx,
+                toolUseId: orphan.tool_use_id,
+                blockIndex: orphan.block_idx,
+            },
+            context: {
+                transcriptPath,
+                currentSessionId,
+                currentSession,
+                lastContextPercent,
+            },
+            diagnosis: 'JSONL rewriter evicted tool_use without its tool_result, or vice versa',
+            action: 'Attempting disk repair via rollback or surgical removal',
+        });
+        console.log(`\n[ekkOS] 🚨 BUG: Orphan tool_result detected (${orphan.tool_use_id})`);
+        console.log(`[ekkOS] 🔧 Repairing disk transcript...`);
+        try {
+            // Repair the disk transcript if we have one
+            if (transcriptPath && validateTranscriptPath(transcriptPath)) {
+                // Don't repair if tools are still in-flight
+                if (hasInFlightTools()) {
+                    evictionDebugLog('ORPHAN_REPAIR_BLOCKED', 'In-flight tools present, deferring repair');
+                    isOrphanRecoveryInProgress = false;
+                    return;
+                }
+                dlog(`Repairing transcript: ${transcriptPath}`);
+                const repair = (0, transcript_repair_1.repairOrRollbackTranscript)(transcriptPath);
+                evictionDebugLog('ORPHAN_REPAIR_RESULT', '═══════════════════════════════════════════════════════════', {
+                    result: repair.action.toUpperCase(),
+                    orphansFound: repair.orphansFound,
+                    removedLines: repair.removedLines ?? 0,
+                    backupUsed: repair.backupUsed ?? 'none',
+                    reason: repair.reason ?? 'success',
+                });
+                dlog(`Orphan repair: ${repair.action} (orphans=${repair.orphansFound}, removed=${repair.removedLines ?? 0})`);
+                if (repair.action === 'failed') {
+                    console.log(`[ekkOS] ❌ WARNING: Orphan repair failed - session may be unstable`);
+                    console.log(`[ekkOS]    Reason: ${repair.reason}`);
+                }
+                else if (repair.action === 'rollback') {
+                    console.log(`[ekkOS] ✅ Disk repaired via ROLLBACK to backup`);
+                }
+                else if (repair.action === 'surgical_repair') {
+                    console.log(`[ekkOS] ✅ Disk repaired via SURGICAL removal (${repair.removedLines} lines removed)`);
+                }
+                else {
+                    console.log(`[ekkOS] ✅ No repair needed - transcript is healthy`);
+                }
+                // POST-REPAIR VALIDATION: Verify repair actually worked
+                if (repair.action !== 'failed' && repair.action !== 'none') {
+                    try {
+                        // eslint-disable-next-line @typescript-eslint/no-require-imports
+                        const { countOrphansInJsonl } = require('../capture/transcript-repair');
+                        const { orphans: postRepairOrphans } = countOrphansInJsonl(transcriptPath);
+                        if (postRepairOrphans > 0) {
+                            evictionDebugLog('POST_REPAIR_VALIDATION_FAILED', '⚠️ Repair completed but orphans still exist!', {
+                                repair,
+                                postRepairOrphans,
+                                alert: 'REPAIR DID NOT FIX THE PROBLEM',
+                            });
+                            console.log(`[ekkOS] ⚠️ Post-repair check: ${postRepairOrphans} orphan(s) still present!`);
+                            console.log(`[ekkOS]    Repair may have been incomplete - consider /clear + /continue`);
+                        }
+                        else {
+                            evictionDebugLog('POST_REPAIR_VALIDATION_SUCCESS', '✅ Repair verified - no orphans remaining', {
+                                repair,
+                            });
+                            dlog('Post-repair validation passed - transcript is clean');
+                        }
+                    }
+                    catch (validationErr) {
+                        dlog(`Post-repair validation failed: ${validationErr.message}`);
+                    }
+                }
+            }
+            else {
+                evictionDebugLog('ORPHAN_REPAIR_SKIPPED', 'No valid transcriptPath', { transcriptPath });
+                dlog('No transcript to repair');
+            }
+        }
+        catch (err) {
+            evictionDebugLog('ORPHAN_REPAIR_ERROR', err.message, { stack: err.stack });
+        }
+        finally {
+            // Release flag immediately - no stdin pause needed since we're not injecting commands
+            isOrphanRecoveryInProgress = false;
+        }
+    }
+    // ══════════════════════════════════════════════════════════════════════════
+    // ORPHAN DETECTION FUNCTION - Can be called from shell.onData or tests
+    // Uses cursor-based scanning to avoid re-scanning already-processed text
+    // ══════════════════════════════════════════════════════════════════════════
+    function runOrphanDetection() {
+        if (isAutoClearInProgress || isOrphanRecoveryInProgress)
+            return;
+        // Only scan from cursor position forward (plus tail slack for boundary tolerance)
+        const scanStart = Math.max(0, orphanScanCursor - ORPHAN_SCAN_TAIL_SLACK);
+        const textToScan = orphanDetectionBuffer.slice(scanStart);
+        // Reset regex lastIndex before matching
+        ORPHAN_MARKER_REGEX.lastIndex = 0;
+        let orphanMatch;
+        while ((orphanMatch = ORPHAN_MARKER_REGEX.exec(textToScan)) !== null) {
+            try {
+                const orphanJson = orphanMatch[1];
+                const orphan = JSON.parse(orphanJson);
+                // Deduplication: skip if we've already handled this orphan
+                if (handledOrphanIds.has(orphan.tool_use_id)) {
+                    dlog(`Skipping already-handled orphan: ${orphan.tool_use_id}`);
+                    continue;
+                }
+                dlog(`Detected ORPHAN_TOOL_RESULT: ${orphan.tool_use_id}`);
+                evictionDebugLog('ORPHAN_MARKER_DETECTED', 'ccDNA reported orphan in PTY output', {
+                    orphan,
+                    bufferLen: orphanDetectionBuffer.length,
+                    scanCursor: orphanScanCursor,
+                    handledCount: handledOrphanIds.size,
+                });
+                // Mark as handled before firing (prevents re-trigger)
+                handledOrphanIds.add(orphan.tool_use_id);
+                // Fire and forget - the handler has its own cooldown/reentrancy guards
+                void handleOrphanToolResult(orphan);
+            }
+            catch (e) {
+                evictionDebugLog('ORPHAN_PARSE_ERROR', 'Failed to parse ORPHAN_TOOL_RESULT payload', {
+                    sample: orphanMatch?.[1]?.slice(0, 200),
+                    err: e.message,
+                });
+            }
+        }
+        // Advance cursor to end of buffer (next scan starts from here)
+        orphanScanCursor = orphanDetectionBuffer.length;
+    }
+    // ══════════════════════════════════════════════════════════════════════════
+    // TEST TRIGGER: Synthetic orphan marker injection
+    // Set EKKOS_TEST_ORPHAN=1 to inject after transcriptPath is discovered (full E2E)
+    // Set EKKOS_TEST_ORPHAN=2 to inject after 5s regardless (detection-only test)
+    // ══════════════════════════════════════════════════════════════════════════
+    // eslint-disable-next-line no-restricted-syntax -- Test flag, not API key
+    const testOrphanMode = process.env.EKKOS_TEST_ORPHAN;
+    if (testOrphanMode === '1' || testOrphanMode === '2') {
+        console.log(`[ekkOS TEST] Test trigger starting (mode=${testOrphanMode})`);
+        evictionDebugLog('TEST_TRIGGER_START', 'Test trigger initialized', { mode: testOrphanMode });
+        // eslint-disable-next-line no-restricted-syntax -- Test flag, not API key
+        const isQuickMode = process.env.EKKOS_TEST_ORPHAN === '2';
+        const TEST_MAX_WAIT_MS = isQuickMode ? 5000 : 20000;
+        const TEST_POLL_MS = 500;
+        let testWaitedMs = 0;
+        let testInjected = false;
+        // ... (rest of the code remains the same)
+        const injectMarker = (mode) => {
+            if (testInjected)
+                return;
+            testInjected = true;
+            const testOrphan = { idx: 0, tool_use_id: 'toolu_TEST_' + Date.now(), block_idx: 0 };
+            const testMarker = `[ekkOS] ORPHAN_TOOL_RESULT ${JSON.stringify(testOrphan)}`;
+            dlog(`TEST: Injecting synthetic orphan marker (${mode})`);
+            evictionDebugLog('TEST_ORPHAN_INJECT', `Synthetic orphan marker injected (${mode})`, {
+                testOrphan,
+                testMarker,
+                transcriptPath: transcriptPath || 'not_discovered',
+                waitedMs: testWaitedMs,
+                mode,
+            });
+            // Inject directly into detection buffer and run detection
+            orphanDetectionBuffer += '\n' + testMarker + '\n';
+            runOrphanDetection();
+        };
+        const testPollInterval = setInterval(() => {
+            testWaitedMs += TEST_POLL_MS;
+            // Check if transcriptPath is now available (full E2E test)
+            if (transcriptPath && validateTranscriptPath(transcriptPath)) {
+                clearInterval(testPollInterval);
+                setTimeout(() => injectMarker('transcriptPath_ready'), 1000);
+            }
+            else if (testWaitedMs >= TEST_MAX_WAIT_MS) {
+                clearInterval(testPollInterval);
+                // In quick mode or after timeout, inject anyway (detection-only test)
+                injectMarker(isQuickMode ? 'quick_mode' : 'timeout_fallback');
+            }
+        }, TEST_POLL_MS);
+    }
+    // ══════════════════════════════════════════════════════════════════════════
+    // SILENT FAILURE DETECTION HANDLER
+    // Catches API 400 errors and orphan-related messages even without ccDNA markers
+    // This is a backup for when ccDNA validate mode isn't working or is disabled
+    // ══════════════════════════════════════════════════════════════════════════
+    function handleSilentFailure(matchType, matchedText) {
+        const now = Date.now();
+        // Cooldown check
+        if (now - lastSilentFailureTime < SILENT_FAILURE_COOLDOWN_MS) {
+            dlog(`Silent failure suppressed by cooldown (${matchType})`);
+            return;
+        }
+        // Don't trigger during active recovery
+        if (isOrphanRecoveryInProgress || isAutoClearInProgress) {
+            dlog(`Silent failure ignored - recovery in progress (${matchType})`);
+            return;
+        }
+        lastSilentFailureTime = now;
+        silentFailureCount++;
+        evictionDebugLog('SILENT_FAILURE_DETECTED', '════════════════════════════════════════════════════════', {
+            alert: '⚠️ SILENT FAILURE - API error detected without ccDNA marker',
+            matchType,
+            matchedText: matchedText.slice(0, 200),
+            silentFailureCount,
+            transcriptPath,
+            diagnosis: 'Possible orphan tool_result or ccDNA not in validate mode',
+        });
+        console.log(`\n[ekkOS] ⚠️ Silent failure detected: ${matchType}`);
+        // After multiple failures, alert user and suggest action
+        if (silentFailureCount >= MAX_SILENT_FAILURES_BEFORE_ALERT) {
+            console.log(`[ekkOS] ⚠️ Multiple API errors detected (${silentFailureCount}x)`);
+            console.log(`[ekkOS]    This may indicate orphan tool_results in the transcript`);
+            console.log(`[ekkOS]    Try: /clear then /continue to rebuild message state`);
+            evictionDebugLog('SILENT_FAILURE_ALERT', 'Multiple silent failures - user alerted', {
+                count: silentFailureCount,
+                suggestion: '/clear + /continue',
+            });
+            // Reset counter after alerting
+            silentFailureCount = 0;
+        }
+        // Attempt proactive repair if we have a transcript
+        if (transcriptPath && validateTranscriptPath(transcriptPath) && !hasInFlightTools()) {
+            dlog('Attempting proactive repair due to silent failure');
+            try {
+                // eslint-disable-next-line @typescript-eslint/no-require-imports
+                const { countOrphansInJsonl } = require('../capture/transcript-repair');
+                const { orphans: orphanCount, orphanIds } = countOrphansInJsonl(transcriptPath);
+                if (orphanCount > 0) {
+                    evictionDebugLog('SILENT_FAILURE_ORPHANS_FOUND', `Proactive scan found ${orphanCount} orphans`, {
+                        transcriptPath,
+                        orphanCount,
+                        orphanIds: orphanIds.slice(0, 5), // Log first 5 IDs
+                    });
+                    console.log(`[ekkOS] 🔍 Found ${orphanCount} orphan(s) in transcript - triggering repair`);
+                    // Trigger orphan recovery (reuse existing handler)
+                    void handleOrphanToolResult({ idx: -1, tool_use_id: 'silent_failure_detected' });
+                }
+                else {
+                    dlog('Proactive scan found no orphans - API error may be unrelated');
+                }
+            }
+            catch (err) {
+                dlog(`Proactive repair scan failed: ${err.message}`);
+            }
+        }
+    }
     // Monitor PTY output
     shell.onData((data) => {
         // Pass through to terminal
@@ -1152,18 +2065,81 @@ async function run(options) {
         if (outputBuffer.length > 5000) {
             outputBuffer = outputBuffer.slice(-2000);
         }
+        // ══════════════════════════════════════════════════════════════════════════
+        // ORPHAN TOOL_RESULT DETECTION
+        // ccDNA validate mode emits [ekkOS] ORPHAN_TOOL_RESULT when it detects
+        // tool_results without matching tool_uses. This triggers automatic repair.
+        // Uses separate larger buffer to avoid truncation issues.
+        // ══════════════════════════════════════════════════════════════════════════
+        if (!isAutoClearInProgress && !isOrphanRecoveryInProgress) {
+            // Append to orphan detection buffer (larger than main buffer to catch full markers)
+            orphanDetectionBuffer += stripAnsi(data);
+            if (orphanDetectionBuffer.length > 10000) {
+                const trimAmount = orphanDetectionBuffer.length - 8000;
+                orphanDetectionBuffer = orphanDetectionBuffer.slice(-8000);
+                // Adjust cursor to account for trimmed portion
+                orphanScanCursor = Math.max(0, orphanScanCursor - trimAmount);
+            }
+            // Run detection (extracted function for testability)
+            runOrphanDetection();
+            // ════════════════════════════════════════════════════════════════════════
+            // SILENT FAILURE DETECTION - Catch API errors without ccDNA markers
+            // ════════════════════════════════════════════════════════════════════════
+            const normalizedForSilent = stripAnsi(data);
+            // Check for API 400 errors
+            if (API_400_REGEX.test(normalizedForSilent)) {
+                handleSilentFailure('API_400', normalizedForSilent.match(API_400_REGEX)?.[0] || '400');
+            }
+            // Check for explicit orphan-related API error messages
+            else if (ORPHAN_API_ERROR_REGEX.test(normalizedForSilent)) {
+                handleSilentFailure('ORPHAN_API_ERROR', normalizedForSilent.match(ORPHAN_API_ERROR_REGEX)?.[0] || 'orphan');
+            }
+            // Check for generic invalid message errors
+            else if (INVALID_MESSAGE_REGEX.test(normalizedForSilent)) {
+                handleSilentFailure('INVALID_MESSAGE', normalizedForSilent.match(INVALID_MESSAGE_REGEX)?.[0] || 'invalid');
+            }
+        }
         // Try to extract transcript path from output (Claude shows it on startup)
-        const transcriptMatch = data.match(/transcript[_\s]?(?:path)?[:\s]+([^\s\n]+\.jsonl?)/i);
+        // CRITICAL: Strip ANSI codes FIRST to prevent capturing terminal garbage
+        const cleanData = stripAnsi(data);
+        const transcriptMatch = cleanData.match(/transcript[_\s]?(?:path)?[:\s]+([^\s\n]+\.jsonl?)/i);
         if (transcriptMatch) {
-            transcriptPath = transcriptMatch[1];
-            dlog(`Detected transcript: ${transcriptPath}`);
-            // Start tailer if we have session ID
-            if (currentSessionId && transcriptPath) {
-                startStreamTailer(transcriptPath, currentSessionId, currentSession || undefined);
+            const candidatePath = transcriptMatch[1];
+            // Validate it's an actual path (not garbage from terminal output)
+            if (candidatePath.startsWith('/') || candidatePath.startsWith('~')) {
+                const resolvedPath = candidatePath.startsWith('~')
+                    ? path.join(os.homedir(), candidatePath.slice(1))
+                    : candidatePath;
+                if (fs.existsSync(resolvedPath)) {
+                    // DEFENSIVE: Double-check no ANSI codes leaked through
+                    if (resolvedPath.includes('\u001b') || resolvedPath.includes('\x1b')) {
+                        evictionDebugLog('PATH_CORRUPTION', 'ANSI codes detected in resolved path!', {
+                            resolvedPath,
+                            candidatePath,
+                            cleanDataSample: cleanData.slice(0, 200),
+                        });
+                    }
+                    else {
+                        transcriptPath = resolvedPath;
+                        evictionDebugLog('TRANSCRIPT_SET', 'transcriptPath set from output', { transcriptPath });
+                        dlog(`Detected transcript from output: ${transcriptPath}`);
+                    }
+                    // Start tailer if we have session ID
+                    if (currentSessionId) {
+                        startStreamTailer(transcriptPath, currentSessionId, currentSession || undefined);
+                    }
+                }
+                else {
+                    dlog(`Transcript path candidate doesn't exist: ${resolvedPath}`);
+                }
+            }
+            else {
+                dlog(`Transcript path candidate rejected (not absolute): ${candidatePath}`);
             }
         }
         // Try to extract session ID from output (fallback - Claude rarely prints this)
-        const sessionMatch = data.match(/session[_\s]?(?:id)?[:\s]+([a-f0-9-]{36})/i);
+        // Use cleanData (already stripped of ANSI) to avoid terminal garbage
+        const sessionMatch = cleanData.match(/session[_\s]?(?:id)?[:\s]+([a-f0-9-]{36})/i);
         if (sessionMatch) {
             currentSessionId = sessionMatch[1];
             currentSession = (0, state_1.uuidToWords)(currentSessionId);
@@ -1174,10 +2150,11 @@ async function run(options) {
             dlog(`Session detected from UUID: ${currentSession}`);
             // Try to find/construct transcript path from session ID
             if (!transcriptPath) {
-                const encodedCwd = process.cwd().replace(/\//g, '-').replace(/^-/, '');
+                const encodedCwd = process.cwd().replace(/\//g, '-');
                 const possibleTranscript = path.join(os.homedir(), '.claude', 'projects', encodedCwd, `${currentSessionId}.jsonl`);
                 if (fs.existsSync(possibleTranscript)) {
                     transcriptPath = possibleTranscript;
+                    evictionDebugLog('TRANSCRIPT_SET', 'Set from session ID', { transcriptPath, source: 'sessionId' });
                     dlog(`Found transcript from session ID: ${transcriptPath}`);
                     startStreamTailer(transcriptPath, currentSessionId, currentSession || undefined);
                 }
@@ -1209,11 +2186,14 @@ async function run(options) {
                 (0, state_1.updateState)({ sessionName: currentSession });
                 dlog(`Session detected from status line: ${currentSession} (observedSessionThisRun=true)`);
                 // Try to start stream tailer - scan for matching transcript file
+                dlog(`[TRANSCRIPT_SCAN] streamTailer=${!!streamTailer}, transcriptPath=${transcriptPath || 'NULL'}`);
                 if (!streamTailer) {
-                    const encodedCwd = process.cwd().replace(/\//g, '-').replace(/^-/, '');
+                    const encodedCwd = process.cwd().replace(/\//g, '-');
                     const projectDir = path.join(os.homedir(), '.claude', 'projects', encodedCwd);
+                    dlog(`[TRANSCRIPT_SCAN] Scanning projectDir: ${projectDir}`);
                     try {
                         const files = fs.readdirSync(projectDir);
+                        dlog(`[TRANSCRIPT_SCAN] Found ${files.length} files in projectDir`);
                         // Find most recent .jsonl file (likely current session)
                         const jsonlFiles = files
                             .filter(f => f.endsWith('.jsonl'))
@@ -1223,17 +2203,25 @@ async function run(options) {
                             mtime: fs.statSync(path.join(projectDir, f)).mtimeMs
                         }))
                             .sort((a, b) => b.mtime - a.mtime);
+                        dlog(`[TRANSCRIPT_SCAN] Found ${jsonlFiles.length} .jsonl files`);
                         if (jsonlFiles.length > 0) {
                             transcriptPath = jsonlFiles[0].path;
                             currentSessionId = jsonlFiles[0].name.replace('.jsonl', '');
-                            dlog(`Found transcript from project scan: ${transcriptPath}`);
+                            dlog(`[TRANSCRIPT_SCAN] SUCCESS! transcriptPath=${transcriptPath}`);
+                            evictionDebugLog('TRANSCRIPT_SET', 'Set from session name detection', { transcriptPath, currentSessionId });
                             startStreamTailer(transcriptPath, currentSessionId, currentSession);
                         }
+                        else {
+                            dlog(`[TRANSCRIPT_SCAN] No jsonl files found!`);
+                        }
                     }
-                    catch {
-                        // Project dir might not exist yet
+                    catch (err) {
+                        dlog(`[TRANSCRIPT_SCAN] ERROR: ${err.message}`);
                     }
                 }
+                else {
+                    dlog(`[TRANSCRIPT_SCAN] Skipped - streamTailer already running`);
+                }
             }
             else {
                 // Same session, just update timestamp
@@ -1265,15 +2253,117 @@ async function run(options) {
                 }
             }
         }
-        // Check for context wall patterns (ANSI-stripped + regex for robustness)
-        if (!isAutoClearInProgress) {
+        // ══════════════════════════════════════════════════════════════════════════
+        // TURN-END EVICTION - Track context % and run cleanup when Claude goes idle
+        // This is MUCH safer than mid-stream eviction because:
+        // 1. All tool calls have completed (no in-flight tools)
+        // 2. JSONL is in a consistent state
+        // 3. Claude Code is between operations
+        // ══════════════════════════════════════════════════════════════════════════
+        // ════════════════════════════════════════════════════════════════════════
+        // CONTEXT % CALCULATION - Only when proxy mode is OFF (hook handles it otherwise)
+        // ════════════════════════════════════════════════════════════════════════
+        if (!proxyModeEnabled) {
+            // Track context percentage - PRIMARY: calculate from JSONL file size
+            // Claude Code has ~200K token limit. 1 token ≈ 4 chars = 4 bytes
+            // 200K tokens ≈ 800KB. We estimate context % from file size.
+            if (transcriptPath && fs.existsSync(transcriptPath)) {
+                try {
+                    const fileSize = fs.statSync(transcriptPath).size;
+                    const estimatedMaxSize = 800 * 1024; // 800KB ≈ 200K tokens
+                    lastContextPercent = Math.min(100, Math.round((fileSize / estimatedMaxSize) * 100));
+                    // Log periodically (every ~5%)
+                    if (Math.abs(lastContextPercent - (lastLoggedPercent || 0)) >= 5) {
+                        dlog(`[CONTEXT] Estimated ${lastContextPercent}% from file size (${Math.round(fileSize / 1024)}KB)`);
+                        lastLoggedPercent = lastContextPercent;
+                    }
+                }
+                catch {
+                    // Fall back to regex if file read fails
+                    const contextPercentMatch = outputBuffer.match(/(\d+)K?\s*\((\d+)%\)/);
+                    if (contextPercentMatch) {
+                        lastContextPercent = parseFloat(contextPercentMatch[2]);
+                    }
+                }
+            }
+        }
+        // ════════════════════════════════════════════════════════════════════════
+        // CONTINUOUS CLEANUP - Runs ALWAYS (proxy handles big evictions, local handles junk)
+        // handleTurnEnd() has internal check to skip threshold eviction when proxy is on
+        // ════════════════════════════════════════════════════════════════════════
+        // Detect idle prompt (turn end) and schedule cleanup
+        const strippedOutput = stripAnsi(outputBuffer);
+        const idlePromptDetected = IDLE_PROMPT_REGEX.test(strippedOutput);
+        // DEFENSIVE LOGGING: Log when idle prompt detected but conditions fail
+        if (idlePromptDetected && (!transcriptPath || isAutoClearInProgress)) {
+            evictionDebugLog('TURN_CHECK_BLOCKED', 'Idle prompt detected but eviction blocked', {
+                transcriptPath: transcriptPath || 'NULL',
+                isAutoClearInProgress,
+                lastContextPercent,
+                outputBufferEnd: strippedOutput.slice(-100),
+            });
+        }
+        if (idlePromptDetected && transcriptPath && !isAutoClearInProgress) {
+            // Cancel any existing timer
+            if (turnEndTimeout) {
+                clearTimeout(turnEndTimeout);
+            }
+            // Start new debounce timer - fires when idle for TURN_END_STABLE_MS
+            turnEndTimeout = setTimeout(() => {
+                handleTurnEnd().catch(err => {
+                    evictionDebugLog('TURN_END_ERROR', `Async eviction error: ${err.message}`);
+                });
+                turnEndTimeout = null;
+            }, TURN_END_STABLE_MS);
+        }
+        // SLIDING WINDOW: Inject /clear after eviction to force transcript reload
+        if (idlePromptDetected && pendingClearAfterEviction && !isAutoClearInProgress) {
+            pendingClearAfterEviction = false;
+            isAutoClearInProgress = true;
+            dlog('🔄 SLIDING WINDOW: Injecting /clear to reload evicted transcript');
+            evictionDebugLog('SLIDING_WINDOW_CLEAR', 'Injecting /clear after eviction');
+            // Pause stdin to prevent interference
+            process.stdin.off('data', onStdinData);
+            (async () => {
+                try {
+                    // Clear current input line
+                    shell.write('\x15'); // Ctrl+U
+                    await sleep(60);
+                    // Type /clear
+                    for (const char of '/clear') {
+                        shell.write(char);
+                        await sleep(20);
+                    }
+                    await sleep(100);
+                    // Send Enter
+                    shell.write('\r');
+                    dlog('🔄 /clear injected - Claude Code will reload transcript');
+                    // Resume stdin after brief delay
+                    await sleep(500);
+                    process.stdin.on('data', onStdinData);
+                    isAutoClearInProgress = false;
+                }
+                catch (err) {
+                    dlog(`❌ Failed to inject /clear: ${err.message}`);
+                    process.stdin.on('data', onStdinData);
+                    isAutoClearInProgress = false;
+                }
+            })();
+        }
+        // BACKUP: Context wall detection - emergency evict
+        if (!isAutoClearInProgress && transcriptPath) {
             const normalized = normalizeForMatch(outputBuffer);
             if (CONTEXT_WALL_REGEX.test(normalized)) {
-                dlog('Context wall detected via regex');
-                handleContextWall().catch(err => {
-                    dlog(`Error during auto-clear: ${err.message}`);
-                    isAutoClearInProgress = false;
-                });
+                dlog('⚠️ CONTEXT WALL - emergency evict to 50%');
+                // Cancel turn-end timer if pending
+                if (turnEndTimeout) {
+                    clearTimeout(turnEndTimeout);
+                    turnEndTimeout = null;
+                }
+                const result = (0, jsonl_rewriter_1.emergencyEvict)(transcriptPath);
+                if (result.success) {
+                    dlog(`   ✅ Emergency evicted ${result.evicted} lines`);
+                }
             }
         }
     });
@@ -1343,6 +2433,8 @@ Use Perplexity for deep research. Be thorough but efficient. Start now.`;
         stopStreamTailer(); // Stop stream capture
         (0, state_1.unregisterActiveSession)(); // Remove from active sessions registry
         cleanupInstanceFile(instanceId); // Clean up instance file
+        // NOTE: No ccDNA restore needed - ekkOS uses separate installation from homebrew
+        // ~/.ekkos/claude-code/ stays patched, homebrew `claude` is always vanilla
         // Restore terminal
         if (process.stdin.isTTY) {
             process.stdin.setRawMode(false);
@@ -1358,6 +2450,7 @@ Use Perplexity for deep research. Be thorough but efficient. Start now.`;
         stopStreamTailer(); // Stop stream capture
         (0, state_1.unregisterActiveSession)(); // Remove from active sessions registry
         cleanupInstanceFile(instanceId); // Clean up instance file
+        // NOTE: No ccDNA restore needed - ekkOS uses separate installation from homebrew
         if (process.stdin.isTTY) {
             process.stdin.setRawMode(false);
         }
@@ -1368,160 +2461,3 @@ Use Perplexity for deep research. Be thorough but efficient. Start now.`;
     process.on('SIGINT', cleanup);
     process.on('SIGTERM', cleanup);
 }
-/**
- * Fallback implementation using spawn+script for PTY emulation
- * Used when node-pty is not available (e.g., Node 24+)
- */
-async function runWithSpawn(claudePath, args, options, state) {
-    const verbose = options.verbose || false;
-    let { currentSession, isAutoClearInProgress, transcriptPath, currentSessionId, outputBuffer } = state;
-    // Debounce tracking
-    let lastDetectionTime = 0;
-    const DETECTION_COOLDOWN = 30000;
-    console.log(chalk_1.default.gray('Using spawn fallback mode (node-pty unavailable)'));
-    console.log(chalk_1.default.yellow('⚠️  Auto-continue requires PTY - manual /clear + /continue only'));
-    console.log(chalk_1.default.gray('   To enable auto-continue: npm rebuild node-pty'));
-    console.log('');
-    let claude;
-    if (isWindows) {
-        // ══════════════════════════════════════════════════════════════════════════
-        // WINDOWS: Full TTY passthrough (no output monitoring, no auto-inject)
-        //
-        // Why: Without node-pty/ConPTY, we cannot simultaneously:
-        //   1. Keep Claude TUI interactive
-        //   2. Read output for context-wall detection
-        //
-        // Piping stdout triggers Claude's --print mode which breaks the TUI.
-        // Solution: stdio: 'inherit' for complete passthrough.
-        // ══════════════════════════════════════════════════════════════════════════
-        if (claudePath === 'npx') {
-            console.log('');
-            console.log(chalk_1.default.red('═══════════════════════════════════════════════════════════════════'));
-            console.log(chalk_1.default.red('  Windows requires Claude Code to be installed globally'));
-            console.log(chalk_1.default.red('═══════════════════════════════════════════════════════════════════'));
-            console.log('');
-            console.log(chalk_1.default.yellow('  Run this command first:'));
-            console.log(chalk_1.default.cyan('    npm install -g @anthropic-ai/claude-code'));
-            console.log('');
-            console.log(chalk_1.default.yellow('  Then try again:'));
-            console.log(chalk_1.default.cyan('    ekkos run -b'));
-            console.log('');
-            process.exit(1);
-        }
-        console.log(chalk_1.default.gray('Windows mode: full TTY passthrough (no auto-inject)'));
-        console.log(chalk_1.default.gray('Context wall → manual /clear + /continue <session>'));
-        console.log('');
-        // Build command for passthrough
-        const fullCmd = args.length > 0
-            ? `"${claudePath}" ${args.join(' ')}`
-            : `"${claudePath}"`;
-        // spawnSync with stdio: 'inherit' = full console passthrough
-        // This is the ONLY way to keep Claude TUI working on Windows without PTY
-        const { spawnSync } = require('child_process');
-        try {
-            const result = spawnSync('cmd.exe', ['/c', fullCmd], {
-                stdio: 'inherit', // CRITICAL: Full passthrough, no piping
-                cwd: process.cwd(),
-                env: process.env,
-                windowsHide: false,
-                shell: false
-            });
-            (0, state_1.clearAutoClearFlag)();
-            process.exit(result.status || 0);
-        }
-        catch (err) {
-            console.error(chalk_1.default.red('Failed to launch Claude:'), err.message);
-            console.log('');
-            console.log(chalk_1.default.yellow('Try running claude directly:'));
-            console.log(chalk_1.default.cyan('  claude'));
-            console.log('');
-            process.exit(1);
-        }
-        return; // Unreachable due to spawnSync + process.exit, but explicit
-    }
-    else {
-        // Use script command for PTY on Unix
-        const scriptCmd = process.platform === 'darwin'
-            ? ['script', '-q', '/dev/null', claudePath, ...args]
-            : ['script', '-q', '-c', `${claudePath} ${args.join(' ')}`, '/dev/null'];
-        claude = (0, child_process_1.spawn)(scriptCmd[0], scriptCmd.slice(1), {
-            stdio: ['inherit', 'pipe', 'inherit'],
-            cwd: process.cwd(),
-            env: process.env
-        });
-    }
-    // Ensure claude was spawned
-    if (!claude) {
-        console.error(chalk_1.default.red('Failed to spawn Claude'));
-        process.exit(1);
-    }
-    // For Windows direct spawn without piped stdout
-    if (isWindows && !claude.stdout) {
-        console.log(chalk_1.default.yellow('Running in basic mode - context detection disabled'));
-        claude.on('exit', (code) => {
-            (0, state_1.clearAutoClearFlag)();
-            process.exit(code || 0);
-        });
-        return;
-    }
-    // Monitor output
-    if (claude.stdout) {
-        claude.stdout.on('data', async (data) => {
-            const chunk = data.toString();
-            process.stdout.write(chunk);
-            outputBuffer += chunk;
-            if (outputBuffer.length > 5000) {
-                outputBuffer = outputBuffer.slice(-2000);
-            }
-            // Extract session info
-            const sessionMatch = chunk.match(/session[_\s]?(?:id)?[:\s]+([a-f0-9-]{36})/i);
-            if (sessionMatch) {
-                currentSessionId = sessionMatch[1];
-                currentSession = (0, state_1.uuidToWords)(currentSessionId);
-                (0, state_1.updateState)({ sessionId: currentSessionId, sessionName: currentSession });
-            }
-            // Detect context wall - show manual instructions (ANSI-stripped + regex)
-            const now = Date.now();
-            if (!isAutoClearInProgress && (now - lastDetectionTime >= DETECTION_COOLDOWN)) {
-                const normalized = normalizeForMatch(outputBuffer);
-                if (CONTEXT_WALL_REGEX.test(normalized)) {
-                    // CRITICAL: Clear buffer immediately
-                    outputBuffer = '';
-                    lastDetectionTime = now;
-                    isAutoClearInProgress = true;
-                    if (!currentSession) {
-                        const savedState = (0, state_1.getState)();
-                        currentSession = savedState?.sessionName || 'unknown-session';
-                    }
-                    // Log to file only - don't corrupt TUI
-                    dlog('════════════════════════════════════════════════════════════');
-                    dlog('CONTEXT LIMIT REACHED (spawn fallback mode)');
-                    dlog(`Session: ${currentSession}`);
-                    dlog('Manual restore required: /clear then /continue ' + currentSession);
-                    dlog('════════════════════════════════════════════════════════════');
-                    setTimeout(() => {
-                        isAutoClearInProgress = false;
-                        // Buffer already cleared at detection time
-                    }, DETECTION_COOLDOWN);
-                }
-            }
-        });
-    }
-    claude.on('exit', (code) => {
-        (0, state_1.clearAutoClearFlag)();
-        dlog(`Claude exited with code ${code}`);
-        process.exit(code || 0);
-    });
-    claude.on('error', (err) => {
-        dlog(`Error: ${err.message}`);
-        process.exit(1);
-    });
-    // Cleanup
-    const cleanup = () => {
-        (0, state_1.clearAutoClearFlag)();
-        claude.kill();
-        process.exit(0);
-    };
-    process.on('SIGINT', cleanup);
-    process.on('SIGTERM', cleanup);
-}