@gaberrb/polypus 0.4.5 → 0.4.7

package/dist/index.js

@@ -110,6 +110,7 @@ var en = {
   "cli.opt.mode": "plan | review | bypass (overrides config)",
   "cli.opt.maxSteps": "maximum agent steps",
   "cli.opt.json": "headless mode: emit a single JSON object (steps, tool calls, files changed, usage) instead of the TUI \u2014 use with --mode bypass",
+  "cli.opt.verify": "after the agent finishes, run project checks (typecheck/build/test) and iterate until they pass",
   "cli.arg.swarmTask": "high-level task to split across agents",
   "cli.opt.agents": "comma-separated agent names (default: all configured)",
   "cli.opt.maxSubtasks": "maximum number of parallel subtasks",
@@ -137,6 +138,15 @@ var en = {
   "run.autocorrect": "\u21BB tool failed \u2014 auto-correcting with extra context",
   "run.cancelled": "\u25A0 cancelled",
   "run.jsonNeedsTask": "--json requires a task argument (headless mode has no interactive REPL).",
+  "review.approveAll": "approve all",
+  "review.reject": "reject",
+  "review.pickHunks": "pick hunks\u2026",
+  "review.selectHunks": "Select the hunks to apply (space to toggle, enter to confirm)",
+  "verify.running": "verifying (running project checks)",
+  "verify.noChecks": "no verification checks detected (no package.json scripts) \u2014 skipping",
+  "verify.passed": "verification passed",
+  "verify.failed": "{n} check(s) failed \u2014 handing the output back to the agent (attempt {attempt})",
+  "verify.giveUp": "{n} check(s) still failing after the retry budget \u2014 stopping",
   // repl
   "repl.welcome": "Polypus interactive session.",
   "repl.welcomeHint": " Type /help for commands, /exit to quit.",
@@ -340,6 +350,7 @@ var ptBR = {
   "cli.opt.mode": "plan | review | bypass (sobrescreve a config)",
   "cli.opt.maxSteps": "n\xFAmero m\xE1ximo de passos do agente",
   "cli.opt.json": "modo headless: emite um \xFAnico objeto JSON (passos, tool calls, arquivos alterados, uso) em vez da TUI \u2014 use com --mode bypass",
+  "cli.opt.verify": "ap\xF3s o agente terminar, roda as checagens do projeto (typecheck/build/test) e itera at\xE9 passar",
   "cli.arg.swarmTask": "tarefa de alto n\xEDvel para dividir entre os agentes",
   "cli.opt.agents": "nomes de agentes separados por v\xEDrgula (padr\xE3o: todos)",
   "cli.opt.maxSubtasks": "n\xFAmero m\xE1ximo de subtarefas paralelas",
@@ -365,6 +376,15 @@ var ptBR = {
   "run.autocorrect": "\u21BB tool falhou \u2014 autocorrigindo com contexto extra",
   "run.cancelled": "\u25A0 cancelado",
   "run.jsonNeedsTask": "--json exige um argumento de tarefa (o modo headless n\xE3o tem REPL interativo).",
+  "review.approveAll": "aprovar tudo",
+  "review.reject": "rejeitar",
+  "review.pickHunks": "escolher hunks\u2026",
+  "review.selectHunks": "Selecione os hunks a aplicar (espa\xE7o alterna, enter confirma)",
+  "verify.running": "verificando (rodando as checagens do projeto)",
+  "verify.noChecks": "nenhuma checagem detectada (sem scripts no package.json) \u2014 pulando",
+  "verify.passed": "verifica\xE7\xE3o passou",
+  "verify.failed": "{n} checagem(ns) falharam \u2014 devolvendo a sa\xEDda ao agente (tentativa {attempt})",
+  "verify.giveUp": "{n} checagem(ns) ainda falhando ap\xF3s o limite de tentativas \u2014 parando",
   "repl.welcome": "Sess\xE3o interativa do Polypus.",
   "repl.welcomeHint": " Digite /help para comandos, /exit para sair.",
   "repl.modeChanged": "modo \u2192 {mode}",
@@ -963,6 +983,10 @@ function createProvider(agent) {
   return { config: agent, provider, toolMode: resolveToolMode(agent) };
 }
 
+// src/core/permissions/modes.ts
+import { readFile as readFile2 } from "fs/promises";
+import { resolve as resolve2 } from "path";
+
 // src/core/permissions/allowlist.ts
 import { isAbsolute, relative, resolve, sep } from "path";
 function globToRegExp(glob) {
@@ -1058,6 +1082,111 @@ function scanSecrets(text2) {
   return findings;
 }
 
+// src/core/permissions/diff.ts
+var CONTEXT = 3;
+function splitLines(text2) {
+  return text2 === "" ? [] : text2.split("\n");
+}
+function lcsOps(a, b) {
+  const n = a.length;
+  const m = b.length;
+  const dp = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
+  for (let i2 = n - 1; i2 >= 0; i2--) {
+    for (let j2 = m - 1; j2 >= 0; j2--) {
+      dp[i2][j2] = a[i2] === b[j2] ? dp[i2 + 1][j2 + 1] + 1 : Math.max(dp[i2 + 1][j2], dp[i2][j2 + 1]);
+    }
+  }
+  const out = [];
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (a[i] === b[j]) {
+      out.push({ type: " ", text: a[i] });
+      i++;
+      j++;
+    } else if (dp[i + 1][j] >= dp[i][j + 1]) {
+      out.push({ type: "-", text: a[i] });
+      i++;
+    } else {
+      out.push({ type: "+", text: b[j] });
+      j++;
+    }
+  }
+  while (i < n) out.push({ type: "-", text: a[i++] });
+  while (j < m) out.push({ type: "+", text: b[j++] });
+  return out;
+}
+function computeHunks(oldText, newText) {
+  const a = splitLines(oldText);
+  const b = splitLines(newText);
+  const ops = lcsOps(a, b);
+  const isChange = ops.map((o) => o.type !== " ");
+  const keep = new Array(ops.length).fill(false);
+  for (let k2 = 0; k2 < ops.length; k2++) {
+    if (isChange[k2]) {
+      for (let c = Math.max(0, k2 - CONTEXT); c <= Math.min(ops.length - 1, k2 + CONTEXT); c++) {
+        keep[c] = true;
+      }
+    }
+  }
+  const hunks = [];
+  let oldLine = 0;
+  let newLine = 0;
+  let k = 0;
+  while (k < ops.length) {
+    const op = ops[k];
+    if (!keep[k]) {
+      if (op.type !== "+") oldLine++;
+      if (op.type !== "-") newLine++;
+      k++;
+      continue;
+    }
+    const oldStart = oldLine;
+    const newStart = newLine;
+    const lines = [];
+    let oldCount = 0;
+    let newCount = 0;
+    while (k < ops.length && keep[k]) {
+      const cur = ops[k];
+      lines.push(cur);
+      if (cur.type !== "+") {
+        oldLine++;
+        oldCount++;
+      }
+      if (cur.type !== "-") {
+        newLine++;
+        newCount++;
+      }
+      k++;
+    }
+    hunks.push({ oldStart, oldCount, newStart, newCount, lines });
+  }
+  return hunks;
+}
+function applyHunks(oldText, hunks, approved) {
+  const a = splitLines(oldText);
+  const out = [];
+  let oldIdx = 0;
+  hunks.forEach((hunk, idx) => {
+    while (oldIdx < hunk.oldStart) out.push(a[oldIdx++]);
+    if (approved.has(idx)) {
+      for (const l of hunk.lines) if (l.type !== "-") out.push(l.text);
+    } else {
+      for (const l of hunk.lines) if (l.type !== "+") out.push(l.text);
+    }
+    oldIdx = hunk.oldStart + hunk.oldCount;
+  });
+  while (oldIdx < a.length) out.push(a[oldIdx++]);
+  return out.join("\n");
+}
+function hunkLabel(hunk) {
+  const added = hunk.lines.filter((l) => l.type === "+").length;
+  const removed = hunk.lines.filter((l) => l.type === "-").length;
+  const firstChange = hunk.lines.find((l) => l.type !== " ");
+  const preview = firstChange ? firstChange.text.trim().slice(0, 50) : "";
+  return `@@ -${hunk.oldStart + 1},${hunk.oldCount} +${hunk.newStart + 1},${hunk.newCount} @@ (+${added}/-${removed}) ${preview}`;
+}
+
 // src/core/permissions/modes.ts
 var PermissionEngine = class {
   constructor(opts) {
@@ -1075,7 +1204,14 @@ var PermissionEngine = class {
   async authorizeWrite(target, preview, content) {
     const d = checkPath(this.opts.policy, target);
     if (!d.allowed) return { allowed: false, reason: d.reason };
-    const findings = scanSecrets(content ?? preview ?? "");
+    let oldContent = "";
+    try {
+      oldContent = await readFile2(resolve2(this.opts.policy.workspace, target), "utf8");
+    } catch {
+    }
+    const hunks = content !== void 0 ? computeHunks(oldContent, content) : [];
+    const added = hunks.flatMap((h) => h.lines.filter((l) => l.type === "+").map((l) => l.text)).join("\n");
+    const findings = scanSecrets(hunks.length > 0 ? added : content ?? preview ?? "");
     if (findings.length > 0) {
       const first = findings[0];
       return {
@@ -1087,8 +1223,13 @@ var PermissionEngine = class {
       return { allowed: false, reason: "plan mode: file modifications are disabled" };
     }
     if (this.opts.mode === "bypass") return { allowed: true };
-    const ok = await this.ask({ kind: "write", summary: `write ${d.rel}`, preview });
-    return ok ? { allowed: true } : { allowed: false, reason: "rejected by user" };
+    const res = await this.ask({ kind: "write", summary: `write ${d.rel}`, preview, hunks });
+    if (res === true) return { allowed: true };
+    if (res === false) return { allowed: false, reason: "rejected by user" };
+    const approved = new Set(res);
+    if (approved.size === 0) return { allowed: false, reason: "rejected by user" };
+    if (approved.size === hunks.length) return { allowed: true };
+    return { allowed: true, content: applyHunks(oldContent, hunks, approved) };
   }
   async authorizeCommand(command) {
     const screen = screenCommand(command);
@@ -1100,8 +1241,8 @@ var PermissionEngine = class {
     }
     if (this.opts.mode === "bypass") return { allowed: true };
     if (isCommandPreApproved(this.opts.allowedCommands, command)) return { allowed: true };
-    const ok = await this.ask({ kind: "command", summary: `run: ${command}` });
-    return ok ? { allowed: true } : { allowed: false, reason: "rejected by user" };
+    const res = await this.ask({ kind: "command", summary: `run: ${command}` });
+    return res === true ? { allowed: true } : { allowed: false, reason: "rejected by user" };
   }
   async ask(req) {
     if (!this.opts.confirm) return false;
@@ -1330,8 +1471,8 @@ function makeDriver(kind, tools) {
 }
 
 // src/core/tools/edit-file.ts
-import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { resolve as resolve2 } from "path";
+import { readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
+import { resolve as resolve3 } from "path";
 import { z as z2 } from "zod";
 var Args = z2.object({
   path: z2.string().min(1),
@@ -1361,10 +1502,10 @@ var editFileTool = {
         output: "edit_file needs three arguments: 'path', 'search' (exact text to find), and 'replace'. Resend the tool call with all three filled in."
       };
     }
-    const abs = resolve2(ctx.workspace, args.data.path);
+    const abs = resolve3(ctx.workspace, args.data.path);
     let content;
     try {
-      content = await readFile2(abs, "utf8");
+      content = await readFile3(abs, "utf8");
     } catch (err) {
       return { ok: false, output: `Could not read file to edit: ${err.message}` };
     }
@@ -1383,11 +1524,11 @@ var editFileTool = {
       args.data.path,
       `- ${firstLine(args.data.search)}
 + ${firstLine(args.data.replace)}`,
-      args.data.replace
+      updated
     );
     if (!decision.allowed) return { ok: false, output: `Edit denied: ${decision.reason}` };
     try {
-      await writeFile2(abs, updated, "utf8");
+      await writeFile2(abs, decision.content ?? updated, "utf8");
       return { ok: true, output: `Edited ${args.data.path}.` };
     } catch (err) {
       return { ok: false, output: `Could not write edit: ${err.message}` };
@@ -1400,7 +1541,7 @@ function firstLine(s) {
 
 // src/core/tools/list-dir.ts
 import { readdir } from "fs/promises";
-import { resolve as resolve3 } from "path";
+import { resolve as resolve4 } from "path";
 import { z as z3 } from "zod";
 var Args2 = z3.object({ path: z3.string().default(".") });
 var listDirTool = {
@@ -1421,7 +1562,7 @@ var listDirTool = {
       return { ok: false, output: `List denied: ${decision.reason}` };
     }
     try {
-      const entries = await readdir(resolve3(ctx.workspace, path), { withFileTypes: true });
+      const entries = await readdir(resolve4(ctx.workspace, path), { withFileTypes: true });
       const lines = entries.map((e) => e.isDirectory() ? `${e.name}/` : e.name).sort();
       return { ok: true, output: lines.length ? lines.join("\n") : "(empty)" };
     } catch (err) {
@@ -1431,8 +1572,8 @@ var listDirTool = {
 };
 
 // src/core/tools/read-file.ts
-import { readFile as readFile3 } from "fs/promises";
-import { resolve as resolve4 } from "path";
+import { readFile as readFile4 } from "fs/promises";
+import { resolve as resolve5 } from "path";
 import { z as z4 } from "zod";
 var Args3 = z4.object({ path: z4.string().min(1) });
 var MAX_CHARS = 6e4;
@@ -1453,7 +1594,7 @@ var readFileTool = {
     const decision = ctx.permissions.authorizeRead(args.data.path);
     if (!decision.allowed) return { ok: false, output: `Read denied: ${decision.reason}` };
     try {
-      const content = await readFile3(resolve4(ctx.workspace, args.data.path), "utf8");
+      const content = await readFile4(resolve5(ctx.workspace, args.data.path), "utf8");
       const truncated = content.length > MAX_CHARS;
       return {
         ok: true,
@@ -1514,8 +1655,8 @@ function clamp(s) {
 }
 
 // src/core/tools/search-file.ts
-import { readdir as readdir2, readFile as readFile4, stat } from "fs/promises";
-import { join as join2, resolve as resolve5 } from "path";
+import { readdir as readdir2, readFile as readFile5, stat } from "fs/promises";
+import { join as join2, resolve as resolve6 } from "path";
 import { z as z6 } from "zod";
 var Args5 = z6.object({
   query: z6.string().min(1),
@@ -1567,7 +1708,7 @@ var searchTool = {
     }
     const globRe = glob ? globToRegExp(glob) : void 0;
     const limit = max_results ?? DEFAULT_MAX_RESULTS;
-    const root = resolve5(ctx.workspace, path);
+    const root = resolve6(ctx.workspace, path);
     const matches = [];
     let truncated = false;
     const walk = async (dir) => {
@@ -1593,7 +1734,7 @@ var searchTool = {
         try {
           const info = await stat(abs);
           if (info.size > MAX_FILE_BYTES) continue;
-          const content = await readFile4(abs, "utf8");
+          const content = await readFile5(abs, "utf8");
           if (content.includes(NUL)) continue;
           const lines = content.split("\n");
           for (let i = 0; i < lines.length; i++) {
@@ -1638,7 +1779,7 @@ var FINISH_TOOL = {
 
 // src/core/tools/write-file.ts
 import { mkdir as mkdir2, writeFile as writeFile3 } from "fs/promises";
-import { dirname, resolve as resolve6 } from "path";
+import { dirname, resolve as resolve7 } from "path";
 import { z as z7 } from "zod";
 var Args6 = z7.object({ path: z7.string().min(1), content: z7.string() });
 var writeFileTool = {
@@ -1667,11 +1808,12 @@ var writeFileTool = {
     const preview = previewContent(args.data.content);
     const decision = await ctx.permissions.authorizeWrite(args.data.path, preview, args.data.content);
     if (!decision.allowed) return { ok: false, output: `Write denied: ${decision.reason}` };
+    const finalContent = decision.content ?? args.data.content;
     try {
-      const abs = resolve6(ctx.workspace, args.data.path);
+      const abs = resolve7(ctx.workspace, args.data.path);
       await mkdir2(dirname(abs), { recursive: true });
-      await writeFile3(abs, args.data.content, "utf8");
-      const lines = args.data.content.split("\n").length;
+      await writeFile3(abs, finalContent, "utf8");
+      const lines = finalContent.split("\n").length;
       return { ok: true, output: `Wrote ${args.data.path} (${lines} lines).` };
     } catch (err) {
       return { ok: false, output: `Could not write file: ${err.message}` };
@@ -1700,8 +1842,8 @@ function getTool(name) {
 }
 
 // src/core/agent/correction.ts
-import { readFile as readFile5, readdir as readdir3 } from "fs/promises";
-import { dirname as dirname2, resolve as resolve7 } from "path";
+import { readFile as readFile6, readdir as readdir3 } from "fs/promises";
+import { dirname as dirname2, resolve as resolve8 } from "path";
 function truncationGuidance(toolName) {
   const fileHint = toolName === "write_file" || toolName === "edit_file" ? " Write large files in parts: create the file with the first chunk via write_file, then append the rest with edit_file in the next steps." : "";
   return [
@@ -1801,7 +1943,7 @@ ${text2}` : null;
 }
 async function readWorkspaceFile(workspace, path) {
   try {
-    return await readFile5(resolve7(workspace, path), "utf8");
+    return await readFile6(resolve8(workspace, path), "utf8");
   } catch {
     return null;
   }
@@ -1859,11 +2001,11 @@ async function occurrenceLines(workspace, path, search) {
   return out;
 }
 async function listNearest(workspace, path) {
-  let dir = dirname2(resolve7(workspace, path));
+  let dir = dirname2(resolve8(workspace, path));
   for (let i = 0; i < 8; i++) {
     try {
       const entries = await readdir3(dir, { withFileTypes: true });
-      const rel = dir === resolve7(workspace) ? "." : dir;
+      const rel = dir === resolve8(workspace) ? "." : dir;
       const names = entries.slice(0, 40).map((e) => e.isDirectory() ? `${e.name}/` : e.name);
       return `${rel}:
   ${names.join("  ") || "(empty)"}`;
@@ -1885,14 +2027,14 @@ function formatSchema(spec) {
 }
 
 // src/core/agent/project-context.ts
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 import { join as join3 } from "path";
 var INSTRUCTION_FILES = [join3(".poly", "agents.md"), "AGENTS.md"];
 var MAX_CHARS2 = 8e3;
 async function loadProjectInstructions(workspace) {
   for (const rel of INSTRUCTION_FILES) {
     try {
-      const raw = (await readFile6(join3(workspace, rel), "utf8")).trim();
+      const raw = (await readFile7(join3(workspace, rel), "utf8")).trim();
       if (!raw) continue;
       return raw.length > MAX_CHARS2 ? raw.slice(0, MAX_CHARS2) + "\n\u2026(truncated)" : raw;
     } catch {
@@ -2053,8 +2195,8 @@ ${guidance}`;
 }
 
 // src/core/context/mentions.ts
-import { readdir as readdir4, readFile as readFile7, stat as stat2 } from "fs/promises";
-import { resolve as resolve8 } from "path";
+import { readdir as readdir4, readFile as readFile8, stat as stat2 } from "fs/promises";
+import { resolve as resolve9 } from "path";
 var MAX_FILE_CHARS = 1e4;
 var MENTION_RE = /(?:^|\s)@([\w./-]+)/g;
 async function resolveMentions(task, policy) {
@@ -2070,7 +2212,7 @@ async function resolveMentions(task, policy) {
 ${t("mentions.notFound", { path: token })}`);
       continue;
     }
-    const abs = resolve8(policy.workspace, token);
+    const abs = resolve9(policy.workspace, token);
     try {
       const info = await stat2(abs);
       if (info.isDirectory()) {
@@ -2080,7 +2222,7 @@ ${t("mentions.notFound", { path: token })}`);
 ${listing || "(empty)"}`);
         injected.push(decision.rel);
       } else {
-        const raw = await readFile7(abs, "utf8");
+        const raw = await readFile8(abs, "utf8");
         const content = raw.length > MAX_FILE_CHARS ? raw.slice(0, MAX_FILE_CHARS) + "\n\u2026[truncated]" : raw;
         blocks.push(`## @${decision.rel}
 \`\`\`
@@ -2102,6 +2244,58 @@ ${blocks.join("\n\n")}`;
   return { task: augmented, injected };
 }
 
+// src/core/agent/verify.ts
+import { exec as exec2 } from "child_process";
+import { readFile as readFile9 } from "fs/promises";
+import { resolve as resolve10 } from "path";
+import { promisify as promisify2 } from "util";
+var execAsync2 = promisify2(exec2);
+var MAX_OUTPUT3 = 8e3;
+var CHECK_SCRIPTS = ["typecheck", "build", "test"];
+async function detectChecks(workspace) {
+  try {
+    const raw = await readFile9(resolve10(workspace, "package.json"), "utf8");
+    const scripts = JSON.parse(raw).scripts ?? {};
+    return CHECK_SCRIPTS.filter((s) => typeof scripts[s] === "string").map((s) => `npm run ${s}`);
+  } catch {
+    return [];
+  }
+}
+async function runChecks(workspace, commands) {
+  const results = [];
+  for (const command of commands) {
+    try {
+      const { stdout: stdout2, stderr } = await execAsync2(command, {
+        cwd: workspace,
+        timeout: 3e5,
+        maxBuffer: 10 * 1024 * 1024,
+        windowsHide: true
+      });
+      results.push({ command, ok: true, output: clamp2(`${stdout2}${stderr ? `
+${stderr}` : ""}`.trim()) });
+    } catch (err) {
+      const e = err;
+      const body = `${e.stdout ?? ""}${e.stderr ?? ""}`.trim() || e.message;
+      results.push({ command, ok: false, output: clamp2(body) });
+    }
+  }
+  return results;
+}
+function buildVerifyFeedback(failed) {
+  const blocks = failed.map((f) => `$ ${f.command}
+${f.output}`).join("\n\n");
+  return [
+    "Verification failed. The following checks did not pass:",
+    "",
+    blocks,
+    "",
+    "Fix the underlying problem in the code (do not disable or skip the checks), then call `finish`."
+  ].join("\n");
+}
+function clamp2(s) {
+  return s.length > MAX_OUTPUT3 ? s.slice(-MAX_OUTPUT3) : s;
+}
+
 // src/cli/commands/json-output.ts
 var OUTPUT_PREVIEW = 500;
 function createJsonCollector() {
@@ -2794,10 +2988,10 @@ async function readLineTTY(prompt) {
   stdin.resume();
   stdin.on("data", onData);
   try {
-    const line = await new Promise((resolve10) => {
-      rl.question(prompt).then(resolve10, () => resolve10(null));
-      rl.on("SIGINT", () => resolve10(null));
-      rl.on("close", () => resolve10(null));
+    const line = await new Promise((resolve12) => {
+      rl.question(prompt).then(resolve12, () => resolve12(null));
+      rl.on("SIGINT", () => resolve12(null));
+      rl.on("close", () => resolve12(null));
     });
     return line === null ? null : store.expand(line);
   } finally {
@@ -3391,6 +3585,7 @@ var Spinner = class {
 };
 
 // src/cli/commands/run.ts
+var MAX_VERIFY_FIXES = 3;
 async function run(task, opts) {
   let config = await loadConfig();
   const agentConfig = resolveAgent(config, opts.agent);
@@ -3425,7 +3620,7 @@ async function run(task, opts) {
         )
       );
     }
-    await executeTask(task, resolved2, workspace, session, opts.json ?? false);
+    await executeTask(task, resolved2, workspace, session, opts.json ?? false, opts.verify ?? false);
     return;
   }
   const resolved = createProvider(agentConfig);
@@ -3448,7 +3643,7 @@ async function run(task, opts) {
   };
   await startRepl(ctx);
 }
-async function executeTask(task, resolved, workspace, session, json = false) {
+async function executeTask(task, resolved, workspace, session, json = false, verify = false) {
   const mention = await resolveMentions(task, {
     workspace,
     allow: session.allow,
@@ -3475,25 +3670,29 @@ async function executeTask(task, resolved, workspace, session, json = false) {
       return ok;
     }
   });
+  const runOnce = (taskText) => runAgent({
+    task: taskText,
+    workspace,
+    agent: resolved,
+    permissions,
+    promptContext: { workspace, mode: session.mode, allow: session.allow },
+    history: session.history,
+    maxSteps: session.maxSteps,
+    signal: controller.signal,
+    events: collector ? collector.events : renderEvents(spinner3)
+  });
   if (!json) spinner3.start(t("ui.thinking"));
   let result;
   try {
-    result = await runAgent({
-      task,
-      workspace,
-      agent: resolved,
-      permissions,
-      promptContext: { workspace, mode: session.mode, allow: session.allow },
-      history: session.history,
-      maxSteps: session.maxSteps,
-      signal: controller.signal,
-      events: collector ? collector.events : renderEvents(spinner3)
-    });
+    result = await runOnce(task);
+    session.history = result.messages;
+    if (verify && result.reason === "finished" && !controller.signal.aborted) {
+      result = await runVerification(runOnce, workspace, session, spinner3, json, controller.signal, result);
+    }
   } finally {
     spinner3.stop();
     cancel2.dispose();
   }
-  session.history = result.messages;
   if (collector) {
     process.stdout.write(JSON.stringify(collector.build(result)) + "\n");
     return;
@@ -3549,11 +3748,69 @@ function listenForCancel(controller) {
   return { pause: detach, resume: attach, dispose: detach };
 }
 async function confirmAction(req) {
+  if (req.kind === "write" && req.hunks && req.hunks.length > 0) {
+    renderDiff(req.hunks);
+    const options = [
+      { value: "approve", label: t("review.approveAll") },
+      { value: "reject", label: t("review.reject") },
+      ...req.hunks.length > 1 ? [{ value: "hunks", label: t("review.pickHunks") }] : []
+    ];
+    const choice = await p2.select({ message: t("run.confirm", { summary: req.summary }), options });
+    if (p2.isCancel(choice) || choice === "reject") return false;
+    if (choice === "approve") return true;
+    const selected = await p2.multiselect({
+      message: t("review.selectHunks"),
+      options: req.hunks.map((h, i) => ({ value: i, label: hunkLabel(h) })),
+      required: false
+    });
+    if (p2.isCancel(selected)) return false;
+    return selected;
+  }
   if (req.preview) console.log(pc8.dim(req.preview));
   const answer = await p2.confirm({ message: t("run.confirm", { summary: req.summary }) });
   if (p2.isCancel(answer)) return false;
   return answer === true;
 }
+async function runVerification(runOnce, workspace, session, spinner3, json, signal, initial) {
+  const checks = await detectChecks(workspace);
+  if (checks.length === 0) {
+    if (!json) console.log(pc8.dim(t("verify.noChecks")));
+    return initial;
+  }
+  let result = initial;
+  for (let fix = 0; ; fix++) {
+    if (signal.aborted) return result;
+    if (!json) spinner3.start(t("verify.running"));
+    const results = await runChecks(workspace, checks);
+    spinner3.stop();
+    const failed = results.filter((r) => !r.ok);
+    if (failed.length === 0) {
+      if (!json) console.log(pc8.green("\u2713 " + t("verify.passed")));
+      return result;
+    }
+    if (fix >= MAX_VERIFY_FIXES) {
+      if (!json) console.log(pc8.yellow("\u26A0 " + t("verify.giveUp", { n: failed.length })));
+      return result;
+    }
+    if (!json) {
+      console.log(pc8.yellow("\u2717 " + t("verify.failed", { n: failed.length, attempt: fix + 1 })));
+    }
+    if (!json) spinner3.start(t("ui.thinking"));
+    result = await runOnce(buildVerifyFeedback(failed));
+    spinner3.stop();
+    session.history = result.messages;
+  }
+}
+function renderDiff(hunks) {
+  for (const h of hunks) {
+    console.log(pc8.cyan(`@@ -${h.oldStart + 1},${h.oldCount} +${h.newStart + 1},${h.newCount} @@`));
+    for (const l of h.lines) {
+      if (l.type === "+") console.log(pc8.green(`+${l.text}`));
+      else if (l.type === "-") console.log(pc8.red(`-${l.text}`));
+      else console.log(pc8.dim(` ${l.text}`));
+    }
+  }
+}
 function renderEvents(spinner3) {
   return {
     onStep() {
@@ -3942,9 +4199,9 @@ async function resolveOpenRouterKey() {
 }
 
 // src/cli/commands/prd.ts
-import { writeFile as writeFile5, readFile as readFile8 } from "fs/promises";
+import { writeFile as writeFile5, readFile as readFile10 } from "fs/promises";
 import { execFile } from "child_process";
-import { promisify as promisify2 } from "util";
+import { promisify as promisify3 } from "util";
 import pc11 from "picocolors";
 
 // src/core/agent/prd.ts
@@ -4034,13 +4291,13 @@ async function withRetry(fn, opts = {}) {
 
 // src/cli/commands/cli-io.ts
 import { readFileSync, existsSync as existsSync2 } from "fs";
-import { resolve as resolve9 } from "path";
+import { resolve as resolve11 } from "path";
 var GUIDE_MAX = 12e3;
 function readProjectGuide(files) {
   const parts = [];
   for (const file of files) {
     try {
-      const path = resolve9(process.cwd(), file);
+      const path = resolve11(process.cwd(), file);
       if (existsSync2(path)) parts.push(`# ${file}
 ${readFileSync(path, "utf8").trim()}`);
     } catch {
@@ -4066,7 +4323,7 @@ function stripBom(s) {
 }
 
 // src/cli/commands/prd.ts
-var exec2 = promisify2(execFile);
+var exec3 = promisify3(execFile);
 async function prd(issueRef, opts) {
   const issue = await loadIssue(issueRef, opts.input);
   const { provider } = resolveFreeProvider(opts.model ?? DEFAULT_PRD_MODEL);
@@ -4081,11 +4338,11 @@ async function prd(issueRef, opts) {
 }
 async function loadIssue(issueRef, input) {
   if (input) {
-    const raw = input === "-" ? await readStdin() : await readFile8(input, "utf8");
+    const raw = input === "-" ? await readStdin() : await readFile10(input, "utf8");
     return normalize2(JSON.parse(stripBom(raw)));
   }
   const num = numericRef(issueRef);
-  const { stdout: stdout2 } = await exec2("gh", ["issue", "view", num, "--json", "number,title,body,comments"]);
+  const { stdout: stdout2 } = await exec3("gh", ["issue", "view", num, "--json", "number,title,body,comments"]);
   const data = normalize2(JSON.parse(stdout2));
   data.number ??= Number(num);
   return data;
@@ -4100,9 +4357,9 @@ function normalize2(raw) {
 }
 
 // src/cli/commands/review.ts
-import { writeFile as writeFile6, readFile as readFile9 } from "fs/promises";
+import { writeFile as writeFile6, readFile as readFile11 } from "fs/promises";
 import { execFile as execFile2 } from "child_process";
-import { promisify as promisify3 } from "util";
+import { promisify as promisify4 } from "util";
 import pc12 from "picocolors";
 
 // src/core/agent/review.ts
@@ -4160,7 +4417,7 @@ ${projectGuide}`
 }
 
 // src/cli/commands/review.ts
-var exec3 = promisify3(execFile2);
+var exec4 = promisify4(execFile2);
 async function review(prRef, opts) {
   const num = opts.input ? prRef.replace(/^#/, "") : numericRef(prRef);
   const diff = await loadDiff(num, opts.input);
@@ -4176,13 +4433,13 @@ async function review(prRef, opts) {
   }
 }
 async function loadDiff(num, input) {
-  if (input) return input === "-" ? readStdin() : readFile9(input, "utf8");
-  const { stdout: stdout2 } = await exec3("gh", ["pr", "diff", num]);
+  if (input) return input === "-" ? readStdin() : readFile11(input, "utf8");
+  const { stdout: stdout2 } = await exec4("gh", ["pr", "diff", num]);
   return stdout2;
 }
 async function loadMeta(num, input) {
   if (input) return { number: Number(num) || void 0, title: `PR ${num}`, body: "" };
-  const { stdout: stdout2 } = await exec3("gh", ["pr", "view", num, "--json", "number,title,body"]);
+  const { stdout: stdout2 } = await exec4("gh", ["pr", "view", num, "--json", "number,title,body"]);
   const raw = JSON.parse(stdout2);
   return { number: raw.number, title: raw.title ?? "", body: raw.body ?? "" };
 }
@@ -4248,7 +4505,7 @@ function buildProgram() {
   program.command("add-agent").argument("<name>", t("cli.arg.addAgentName")).requiredOption("--provider <provider>", t("cli.opt.provider")).requiredOption("--model <model>", t("cli.opt.model")).option("--api-key <key>", t("cli.opt.apiKey")).option("--base-url <url>", t("cli.opt.baseUrl")).option("--tool-mode <mode>", t("cli.opt.toolMode"), "auto").option("--set-default", t("cli.opt.setDefault")).description(t("cli.cmd.addAgent")).action((name, opts) => addAgent(name, opts));
   program.command("remove-agent").argument("<name>", t("cli.arg.removeAgentName")).description(t("cli.cmd.removeAgent")).action((name) => removeAgent(name));
   program.command("list-agents").alias("agents").description(t("cli.cmd.listAgents")).action(() => listAgents());
-  program.command("run").argument("[task]", t("cli.arg.runTask")).option("--agent <name>", t("cli.opt.agent")).option("--mode <mode>", t("cli.opt.mode")).option("--max-steps <n>", t("cli.opt.maxSteps")).option("--json", t("cli.opt.json")).description(t("cli.cmd.run")).action((task, opts) => run(task, opts));
+  program.command("run").argument("[task]", t("cli.arg.runTask")).option("--agent <name>", t("cli.opt.agent")).option("--mode <mode>", t("cli.opt.mode")).option("--max-steps <n>", t("cli.opt.maxSteps")).option("--json", t("cli.opt.json")).option("--verify", t("cli.opt.verify")).description(t("cli.cmd.run")).action((task, opts) => run(task, opts));
   program.command("swarm").argument("<task>", t("cli.arg.swarmTask")).option("--agents <names>", t("cli.opt.agents")).option("--max-subtasks <n>", t("cli.opt.maxSubtasks")).description(t("cli.cmd.swarm")).action((task, opts) => swarm(task, opts));
   program.command("models").option("--search <text>", t("cli.opt.search")).option("--tools", t("cli.opt.toolsOnly")).option("--free", t("cli.opt.free")).option("--max-price <usd>", t("cli.opt.maxPrice")).option("--sort <order>", t("cli.opt.sort")).option("--limit <n>", t("cli.opt.limit")).description(t("cli.cmd.models")).action((opts) => models(opts));
   program.command("prd").argument("<issue>", t("cli.arg.prdIssue")).option("--out <file>", t("cli.opt.out")).option("--model <model>", t("cli.opt.model")).option("--input <file>", t("cli.opt.input")).description(t("cli.cmd.prd")).action((issue, opts) => prd(issue, opts));