@gaunt-sloth/core 2.0.0-alpha.23 → 2.0.0-alpha.25

package/dist/core/plainToolIndication.js

@@ -15,9 +15,12 @@
  * Stream discipline (matches how the plain surface prints tool activity today): the block is
  * emitted at INFO level through `displayToolIndication` — same stdout channel, same
  * `consoleLevel` gate and session-log treatment as the existing tool notices — so scripted
- * consumers that already silence INFO chatter silence this too. Colour is used only when
- * `useColour` is on AND stdout is a TTY; otherwise the block degrades to clean monochrome
- * (DL-7), with diff lines still readable via their `+`/`-` prefixes.
+ * consumers that already silence INFO chatter silence this too. Colour is used exactly when the
+ * resolved `useColour` (the CFG-30 ladder in `config/colour.ts`) says so — TUI-C35 removed the
+ * local `&& stdout.isTTY` narrowing this module used to apply on top, which was redundant against
+ * the ladder's own rung-4 TTY auto-detection everywhere except `FORCE_COLOR` on a pipe, the one
+ * case that variable exists to serve. An ordinary piped run is therefore still clean monochrome
+ * (DL-7) — rung 4 decides that — with diff lines readable via their `+`/`-` prefixes.
  *
  * Live-output dedupe: shell-shaped results (`<COMMAND_OUTPUT>`) belong to tools whose child
  * output ALREADY streamed raw via the channel's default sink, so those render with
@@ -25,9 +28,9 @@
  * the user just watched.
  */
 import { AIMessage, AIMessageChunk, ToolMessage } from '@langchain/core/messages';
-import { buildToolPreviewLines, getToolGlyph, parseCommandOutputResult, renderToolLineAnsi, summariseToolCall, } from '#src/core/toolDisplay.js';
+import { buildToolPreviewLines, getToolGlyph, isShellShapedResult, renderToolLineAnsi, summariseToolCall, } from '#src/core/toolDisplay.js';
 import { displayToolIndication } from '#src/utils/consoleUtils.js';
-import { getUseColour, stdout } from '#src/utils/systemUtils.js';
+import { getUseColour } from '#src/utils/systemUtils.js';
 const INDENT = '    ';
 /**
  * Create the per-stream observer. State is scoped to one stream (one `agent.stream()` call);
@@ -59,9 +62,12 @@ export function createPlainToolIndication(emit = displayToolIndication) {
         const name = tracked?.name || (typeof message.name === 'string' ? message.name : '') || '';
         const result = typeof message.content === 'string' ? message.content : JSON.stringify(message.content);
         const isError = message.status === 'error';
-        // Colour only when configured AND stdout is a real terminal — piped output stays clean
-        // monochrome (unlike consoleUtils' blanket dim, this block is asserted non-TTY-clean).
-        const colour = getUseColour() && !!stdout.isTTY;
+        // TUI-C35 — colour is exactly what the resolved ladder says, with no local narrowing.
+        // This used to AND in `stdout.isTTY`, which was redundant in every case but one: rung 4 of
+        // `config/colour.ts` already auto-detects from stdout's TTY status, so an unconfigured piped
+        // run is monochrome either way. The one case it changed was `FORCE_COLOR` into a pipe — which
+        // it suppressed, defeating the only thing that variable is for.
+        const colour = getUseColour();
         const statusGlyph = isError
             ? colour
                 ? '\x1b[31m✗\x1b[0m'
@@ -78,8 +84,10 @@ export function createPlainToolIndication(emit = displayToolIndication) {
             result,
             isError,
             // Shell-shaped results stream their child output live through the channel's default
-            // sink on this surface — suppress the duplicated body, keep the status tail.
-            liveOutputAlreadyShown: parseCommandOutputResult(result) !== null,
+            // sink on this surface — suppress the duplicated body, keep the status tail. TUI-C32
+            // residual c: gate on the tool NAME + shape (not shape alone), so a non-shell tool whose
+            // result merely quotes `<COMMAND_OUTPUT>` keeps its preview body instead of being suppressed.
+            liveOutputAlreadyShown: isShellShapedResult(name, result),
         });
         const body = preview.map((line) => INDENT + renderToolLineAnsi(line, colour));
         // Leading newline mirrors the historical notice framing (the model text stream may have
@@ -91,24 +99,49 @@ export function createPlainToolIndication(emit = displayToolIndication) {
             // Order matters: AIMessageChunk extends AIMessage, so test the chunk shape first
             // (mirrors processEventStream).
             if (AIMessageChunk.isInstance(chunk)) {
-                const c = chunk;
-                const deltas = c.tool_call_chunks ?? [];
-                if (deltas.length > 0) {
-                    for (const delta of deltas) {
-                        const index = typeof delta.index === 'number' ? delta.index : 0;
-                        const entry = streaming.get(index) ?? { name: '', argsText: '' };
-                        if (delta.id)
-                            entry.id = delta.id;
-                        if (delta.name)
-                            entry.name = entry.name || delta.name;
-                        if (delta.args)
-                            entry.argsText += delta.args;
-                        streaming.set(index, entry);
+                // TUI-C32 residual e — fail-soft, matching the ToolMessage branch: accumulating tool-call
+                // deltas (`JSON.stringify(tc.args)` can throw on an unserialisable arg, e.g. a BigInt) must
+                // never break the run's stream loop. On any error we simply skip this chunk's tracking.
+                try {
+                    const c = chunk;
+                    const deltas = c.tool_call_chunks ?? [];
+                    if (deltas.length > 0) {
+                        for (const delta of deltas) {
+                            const index = typeof delta.index === 'number' ? delta.index : 0;
+                            const entry = streaming.get(index) ?? { name: '', argsText: '' };
+                            if (delta.id)
+                                entry.id = delta.id;
+                            if (delta.name)
+                                entry.name = entry.name || delta.name;
+                            if (delta.args)
+                                entry.argsText += delta.args;
+                            streaming.set(index, entry);
+                        }
                     }
+                    else {
+                        // Some providers surface COMPLETE tool_calls on a chunk instead of deltas.
+                        for (const tc of c.tool_calls ?? []) {
+                            if (tc.id) {
+                                byId.set(tc.id, {
+                                    id: tc.id,
+                                    name: tc.name,
+                                    argsText: JSON.stringify(tc.args ?? {}),
+                                });
+                            }
+                        }
+                    }
+                }
+                catch {
+                    /* indication is best-effort; the model-facing stream is untouched */
                 }
-                else {
-                    // Some providers surface COMPLETE tool_calls on a chunk instead of deltas.
-                    for (const tc of c.tool_calls ?? []) {
+                return;
+            }
+            if (AIMessage.isInstance(chunk)) {
+                // A non-chunk AIMessage (resumed/checkpoint-replayed runs) carries final tool_calls.
+                // TUI-C32 residual e — same fail-soft wrap as above/the ToolMessage branch.
+                try {
+                    const m = chunk;
+                    for (const tc of m.tool_calls ?? []) {
                         if (tc.id) {
                             byId.set(tc.id, {
                                 id: tc.id,
@@ -118,15 +151,8 @@ export function createPlainToolIndication(emit = displayToolIndication) {
                         }
                     }
                 }
-                return;
-            }
-            if (AIMessage.isInstance(chunk)) {
-                // A non-chunk AIMessage (resumed/checkpoint-replayed runs) carries final tool_calls.
-                const m = chunk;
-                for (const tc of m.tool_calls ?? []) {
-                    if (tc.id) {
-                        byId.set(tc.id, { id: tc.id, name: tc.name, argsText: JSON.stringify(tc.args ?? {}) });
-                    }
+                catch {
+                    /* indication is best-effort; the model-facing stream is untouched */
                 }
                 return;
             }

package/dist/core/plainToolIndication.js.map

@@ -1 +1 @@
-{"version":3,"file":"plainToolIndication.js","sourceRoot":"","sources":["../../src/core/plainToolIndication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAElF,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,MAAM,GAAG,MAAM,CAAC;AActB;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAI,GAA2B,qBAAqB;IAEpD,wFAAwF;IACxF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEhD,MAAM,sBAAsB,GAAG,GAAS,EAAE;QACxC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,CAAC,OAAoB,EAAQ,EAAE;QACvD,MAAM,EAAE,GAAG,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9C,IAAI,EAAE;YAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC;QAC3C,uFAAuF;QACvF,uFAAuF;QACvF,MAAM,MAAM,GAAG,YAAY,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAEhD,MAAM,WAAW,GAAG,OAAO;YACzB,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,GAAG;YACP,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,OAAO,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QAClE,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;QAEnE,MAAM,OAAO,GAAG,qBAAqB,CAAC;YACpC,IAAI;YACJ,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,MAAM;YACN,OAAO;YACP,oFAAoF;YACpF,6EAA6E;YAC7E,sBAAsB,EAAE,wBAAwB,CAAC,MAAM,CAAC,KAAK,IAAI;SAClE,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9E,wFAAwF;QACxF,6BAA6B;QAC7B,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,CAAC,KAAc;YACpB,iFAAiF;YACjF,gCAAgC;YAChC,IAAI,cAAc,CAAC,UAAU,CAAC,KAAoB,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,GAAG,KAAuB,CAAC;gBAClC,MAAM,MAAM,GAAG,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC;gBACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBAC3B,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;wBAChE,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;wBACjE,IAAI,KAAK,CAAC,EAAE;4BAAE,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;wBAClC,IAAI,KAAK,CAAC,IAAI;4BAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;wBACtD,IAAI,KAAK,CAAC,IAAI;4BAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;wBAC7C,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,2EAA2E;oBAC3E,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;wBACpC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;4BACV,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;gCACd,EAAE,EAAE,EAAE,CAAC,EAAE;gCACT,IAAI,EAAE,EAAE,CAAC,IAAI;gCACb,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;6BACxC,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,SAAS,CAAC,UAAU,CAAC,KAAoB,CAAC,EAAE,CAAC;gBAC/C,qFAAqF;gBACrF,MAAM,CAAC,GAAG,KAAkB,CAAC;gBAC7B,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBACpC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;wBACV,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;oBACzF,CAAC;gBACH,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,oFAAoF;gBACpF,sFAAsF;gBACtF,WAAW;gBACX,IAAI,CAAC;oBACH,sBAAsB,EAAE,CAAC;oBACzB,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"plainToolIndication.js","sourceRoot":"","sources":["../../src/core/plainToolIndication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAElF,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,MAAM,MAAM,GAAG,MAAM,CAAC;AActB;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAI,GAA2B,qBAAqB;IAEpD,wFAAwF;IACxF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEhD,MAAM,sBAAsB,GAAG,GAAS,EAAE;QACxC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,CAAC,OAAoB,EAAQ,EAAE;QACvD,MAAM,EAAE,GAAG,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9C,IAAI,EAAE;YAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC;QAC3C,sFAAsF;QACtF,2FAA2F;QAC3F,6FAA6F;QAC7F,8FAA8F;QAC9F,gEAAgE;QAChE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,WAAW,GAAG,OAAO;YACzB,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,GAAG;YACP,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,OAAO,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QAClE,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;QAEnE,MAAM,OAAO,GAAG,qBAAqB,CAAC;YACpC,IAAI;YACJ,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,MAAM;YACN,OAAO;YACP,oFAAoF;YACpF,qFAAqF;YACrF,yFAAyF;YACzF,8FAA8F;YAC9F,sBAAsB,EAAE,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC;SAC1D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9E,wFAAwF;QACxF,6BAA6B;QAC7B,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,CAAC,KAAc;YACpB,iFAAiF;YACjF,gCAAgC;YAChC,IAAI,cAAc,CAAC,UAAU,CAAC,KAAoB,CAAC,EAAE,CAAC;gBACpD,0FAA0F;gBAC1F,4FAA4F;gBAC5F,wFAAwF;gBACxF,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,KAAuB,CAAC;oBAClC,MAAM,MAAM,GAAG,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC;oBACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;4BAC3B,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChE,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;4BACjE,IAAI,KAAK,CAAC,EAAE;gCAAE,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;4BAClC,IAAI,KAAK,CAAC,IAAI;gCAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;4BACtD,IAAI,KAAK,CAAC,IAAI;gCAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;4BAC7C,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;wBAC9B,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,2EAA2E;wBAC3E,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;4BACpC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;gCACV,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;oCACd,EAAE,EAAE,EAAE,CAAC,EAAE;oCACT,IAAI,EAAE,EAAE,CAAC,IAAI;oCACb,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;iCACxC,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;gBACvE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,SAAS,CAAC,UAAU,CAAC,KAAoB,CAAC,EAAE,CAAC;gBAC/C,qFAAqF;gBACrF,4EAA4E;gBAC5E,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,KAAkB,CAAC;oBAC7B,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;wBACpC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;4BACV,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;gCACd,EAAE,EAAE,EAAE,CAAC,EAAE;gCACT,IAAI,EAAE,EAAE,CAAC,IAAI;gCACb,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;6BACxC,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;gBACvE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,oFAAoF;gBACpF,sFAAsF;gBACtF,WAAW;gBACX,IAAI,CAAC;oBACH,sBAAsB,EAAE,CAAC;oBACzB,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/refusal.d.ts

@@ -0,0 +1,53 @@
+/**
+ * EXT-37 — content-policy refusal detection for the agent run loop.
+ *
+ * A *successful* model response (HTTP 200) can carry a stop/finish reason that means the model — or
+ * the provider's safety system — declined to answer. The content is usually empty, so without this
+ * detection the response falls through the empty-response retry in {@link GthAgentRunner} and is
+ * mis-surfaced as "no content, try again" — burning a second, paid call to reproduce a
+ * DETERMINISTIC refusal. This module normalizes the per-provider shapes into one signal so the run
+ * loop can surface the refusal clearly and terminate (never retry the same prompt).
+ *
+ * Prior art: hermes-agent `conversation_loop.py` treats `finish_reason == "content_filter"` as a
+ * terminal, non-retryable "content policy blocked" outcome and surfaces the model's explanation.
+ *
+ * Detection lives here (and is called from {@link GthAbstractAgent}, the invoke/stream loop over
+ * messages/chunks) because that is the only layer where a message's `response_metadata` /
+ * `additional_kwargs` — where finish/stop reasons live — are visible; `GthAgentRunner` only ever
+ * sees the rendered string.
+ */
+/** One detected refusal, normalized across providers. */
+export interface RefusalInfo {
+    /** Best-effort provider family the signal came from (for logging / the surfaced message). */
+    provider: 'openai' | 'anthropic' | 'bedrock' | 'unknown';
+    /** The raw stop/finish reason token that flagged the refusal (e.g. `content_filter`). */
+    reason: string;
+    /** Any model-provided explanation text (empty string when the refusal carried none). */
+    explanation: string;
+}
+/**
+ * Inspect a finished model message (an `AIMessage` / `AIMessageChunk`, or any object exposing
+ * `response_metadata` / `additional_kwargs`) and return a {@link RefusalInfo} when its stop/finish
+ * reason indicates a content-policy refusal, else `null`. Defensive: any non-message / unexpected
+ * shape yields `null`, so a normal turn is never mistaken for a refusal.
+ *
+ * Covered shapes:
+ *  - OpenAI-family `finish_reason: 'content_filter'` (also under `additional_kwargs`).
+ *  - Anthropic `stop_reason: 'refusal'`.
+ *  - Bedrock Converse guardrail intervention: `stopReason`/`stop_reason`/`finish_reason` ===
+ *    `'guardrail_intervened'`, or `additional_kwargs['amazon-bedrock-guardrailAction'] ===
+ *    `'INTERVENED'`.
+ *  - Bedrock Converse content filter: `stopReason`/`stop_reason`/`finish_reason` ===
+ *    `'content_filtered'` (EXT-41 — a distinct `StopReason` enum value from `guardrail_intervened`
+ *    that was previously mapped to `null`, i.e. a silent empty turn / false negative).
+ */
+export declare function detectRefusal(message: unknown): RefusalInfo | null;
+/**
+ * Build the clear, user-facing message shown when the model declines. Framed as the model /
+ * provider's own policy decision (not a Gaunt Sloth fault) and stated as terminal — a refusal is
+ * deterministic for the same input, so retrying as-is will not help. Any model-provided explanation
+ * is included verbatim. This string is BOTH surfaced to the console and RETURNED as the turn's
+ * answer, so the non-interactive caller writes it to the output file and exits `ok` (it is a
+ * successful, if declined, response — not a failure to be re-wrapped as "Failed to get answer").
+ */
+export declare function buildRefusalMessage(info: RefusalInfo): string;

package/dist/core/refusal.js

@@ -0,0 +1,129 @@
+/**
+ * EXT-37 — content-policy refusal detection for the agent run loop.
+ *
+ * A *successful* model response (HTTP 200) can carry a stop/finish reason that means the model — or
+ * the provider's safety system — declined to answer. The content is usually empty, so without this
+ * detection the response falls through the empty-response retry in {@link GthAgentRunner} and is
+ * mis-surfaced as "no content, try again" — burning a second, paid call to reproduce a
+ * DETERMINISTIC refusal. This module normalizes the per-provider shapes into one signal so the run
+ * loop can surface the refusal clearly and terminate (never retry the same prompt).
+ *
+ * Prior art: hermes-agent `conversation_loop.py` treats `finish_reason == "content_filter"` as a
+ * terminal, non-retryable "content policy blocked" outcome and surfaces the model's explanation.
+ *
+ * Detection lives here (and is called from {@link GthAbstractAgent}, the invoke/stream loop over
+ * messages/chunks) because that is the only layer where a message's `response_metadata` /
+ * `additional_kwargs` — where finish/stop reasons live — are visible; `GthAgentRunner` only ever
+ * sees the rendered string.
+ */
+/** Read a nested record field defensively (returns undefined for non-objects / missing keys). */
+function readField(source, key) {
+    if (!source || typeof source !== 'object')
+        return undefined;
+    return source[key];
+}
+/** Pull any human-readable explanation the refusal carried (message content, then reasoning). */
+function extractRefusalText(message) {
+    const content = readField(message, 'content');
+    if (typeof content === 'string' && content.trim().length > 0)
+        return content.trim();
+    // Content-block arrays (Anthropic / Bedrock): concatenate any text parts.
+    if (Array.isArray(content)) {
+        const text = content
+            .map((part) => {
+            if (typeof part === 'string')
+                return part;
+            const t = readField(part, 'text');
+            return typeof t === 'string' ? t : '';
+        })
+            .join('')
+            .trim();
+        if (text.length > 0)
+            return text;
+    }
+    // Some refusals put the explanation only in the reasoning channel.
+    const kwargs = readField(message, 'additional_kwargs');
+    const reasoning = readField(kwargs, 'reasoning_content');
+    if (typeof reasoning === 'string' && reasoning.trim().length > 0)
+        return reasoning.trim();
+    // Anthropic exposes the declined text on a dedicated `refusal` field in some SDK shapes.
+    const refusalField = readField(kwargs, 'refusal') ?? readField(message, 'refusal');
+    if (typeof refusalField === 'string' && refusalField.trim().length > 0)
+        return refusalField.trim();
+    return '';
+}
+/**
+ * Inspect a finished model message (an `AIMessage` / `AIMessageChunk`, or any object exposing
+ * `response_metadata` / `additional_kwargs`) and return a {@link RefusalInfo} when its stop/finish
+ * reason indicates a content-policy refusal, else `null`. Defensive: any non-message / unexpected
+ * shape yields `null`, so a normal turn is never mistaken for a refusal.
+ *
+ * Covered shapes:
+ *  - OpenAI-family `finish_reason: 'content_filter'` (also under `additional_kwargs`).
+ *  - Anthropic `stop_reason: 'refusal'`.
+ *  - Bedrock Converse guardrail intervention: `stopReason`/`stop_reason`/`finish_reason` ===
+ *    `'guardrail_intervened'`, or `additional_kwargs['amazon-bedrock-guardrailAction'] ===
+ *    `'INTERVENED'`.
+ *  - Bedrock Converse content filter: `stopReason`/`stop_reason`/`finish_reason` ===
+ *    `'content_filtered'` (EXT-41 — a distinct `StopReason` enum value from `guardrail_intervened`
+ *    that was previously mapped to `null`, i.e. a silent empty turn / false negative).
+ */
+export function detectRefusal(message) {
+    if (!message || typeof message !== 'object')
+        return null;
+    const meta = readField(message, 'response_metadata');
+    const kwargs = readField(message, 'additional_kwargs');
+    // Gather the stop/finish reason from every place providers surface it.
+    const finishReason = readField(meta, 'finish_reason') ?? readField(kwargs, 'finish_reason') ?? undefined;
+    const stopReasonSnake = readField(meta, 'stop_reason') ?? readField(kwargs, 'stop_reason') ?? undefined;
+    const stopReasonCamel = readField(meta, 'stopReason') ?? readField(kwargs, 'stopReason') ?? undefined;
+    const asString = (v) => (typeof v === 'string' ? v : undefined);
+    const finish = asString(finishReason);
+    const stopSnake = asString(stopReasonSnake);
+    const stopCamel = asString(stopReasonCamel);
+    const explanation = extractRefusalText(message);
+    // OpenAI-family content filter.
+    if (finish === 'content_filter') {
+        return { provider: 'openai', reason: 'content_filter', explanation };
+    }
+    // Anthropic refusal stop reason.
+    if (stopSnake === 'refusal' || stopCamel === 'refusal') {
+        return { provider: 'anthropic', reason: 'refusal', explanation };
+    }
+    // Bedrock Converse guardrail intervention (camelCase `stopReason`, or snake / finish variants).
+    if (stopCamel === 'guardrail_intervened' ||
+        stopSnake === 'guardrail_intervened' ||
+        finish === 'guardrail_intervened' ||
+        readField(kwargs, 'amazon-bedrock-guardrailAction') === 'INTERVENED' ||
+        readField(meta, 'amazon-bedrock-guardrailAction') === 'INTERVENED') {
+        return { provider: 'bedrock', reason: 'guardrail_intervened', explanation };
+    }
+    // EXT-41 — Bedrock Converse content filter. A distinct `StopReason` enum value from
+    // `guardrail_intervened` (both live in the same AWS Converse `StopReason` enum); previously
+    // unmapped, so a content-filtered turn returned `null` → the silent empty-turn false negative.
+    if (stopCamel === 'content_filtered' ||
+        stopSnake === 'content_filtered' ||
+        finish === 'content_filtered') {
+        return { provider: 'bedrock', reason: 'content_filtered', explanation };
+    }
+    return null;
+}
+/**
+ * Build the clear, user-facing message shown when the model declines. Framed as the model /
+ * provider's own policy decision (not a Gaunt Sloth fault) and stated as terminal — a refusal is
+ * deterministic for the same input, so retrying as-is will not help. Any model-provided explanation
+ * is included verbatim. This string is BOTH surfaced to the console and RETURNED as the turn's
+ * answer, so the non-interactive caller writes it to the output file and exits `ok` (it is a
+ * successful, if declined, response — not a failure to be re-wrapped as "Failed to get answer").
+ */
+export function buildRefusalMessage(info) {
+    const head = 'The model declined to respond (safety refusal / content filter) — this is the ' +
+        "model/provider's own policy decision, not a Gaunt Sloth error.";
+    const detail = info.explanation
+        ? `Model's explanation: ${info.explanation}`
+        : 'The model provided no explanation.';
+    const hint = 'A refusal is deterministic for the same input — rephrase the request or try a different ' +
+        'model rather than re-running it as-is.';
+    return `${head}\n\n${detail}\n\n${hint}`;
+}
+//# sourceMappingURL=refusal.js.map

package/dist/core/refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../../src/core/refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAYH,iGAAiG;AACjG,SAAS,SAAS,CAAC,MAAe,EAAE,GAAW;IAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAQ,MAAkC,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,iGAAiG;AACjG,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACpF,0EAA0E;IAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO;aACjB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC;aACR,IAAI,EAAE,CAAC;QACV,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACnC,CAAC;IACD,mEAAmE;IACnE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACzD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IAC1F,yFAAyF;IACzF,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnF,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACpE,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAEvD,uEAAuE;IACvE,MAAM,YAAY,GAChB,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,IAAI,SAAS,CAAC;IACtF,MAAM,eAAe,GACnB,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,SAAS,CAAC;IAClF,MAAM,eAAe,GACnB,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,SAAS,CAAC;IAEhF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEhD,gCAAgC;IAChC,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;IACvE,CAAC;IACD,iCAAiC;IACjC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACnE,CAAC;IACD,gGAAgG;IAChG,IACE,SAAS,KAAK,sBAAsB;QACpC,SAAS,KAAK,sBAAsB;QACpC,MAAM,KAAK,sBAAsB;QACjC,SAAS,CAAC,MAAM,EAAE,gCAAgC,CAAC,KAAK,YAAY;QACpE,SAAS,CAAC,IAAI,EAAE,gCAAgC,CAAC,KAAK,YAAY,EAClE,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,WAAW,EAAE,CAAC;IAC9E,CAAC;IACD,oFAAoF;IACpF,4FAA4F;IAC5F,+FAA+F;IAC/F,IACE,SAAS,KAAK,kBAAkB;QAChC,SAAS,KAAK,kBAAkB;QAChC,MAAM,KAAK,kBAAkB,EAC7B,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC;IAC1E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB;IACnD,MAAM,IAAI,GACR,gFAAgF;QAChF,gEAAgE,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW;QAC7B,CAAC,CAAC,wBAAwB,IAAI,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,oCAAoC,CAAC;IACzC,MAAM,IAAI,GACR,0FAA0F;QAC1F,wCAAwC,CAAC;IAC3C,OAAO,GAAG,IAAI,OAAO,MAAM,OAAO,IAAI,EAAE,CAAC;AAC3C,CAAC"}

package/dist/core/shell/approvalStop.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @module core/shell/approvalStop
+ *
+ * CFG-27 — the two ways the approvals gate **ends a run** rather than answering a tool call.
+ * Both are thrown from `GthAgentRunner.decideToolApproval`, both carry the command and the reason
+ * a person needs to see, and both are re-thrown UNCHANGED by `processMessages` (which otherwise
+ * wraps failures as `Agent processing failed: …`) so the explanation reaches the user intact.
+ *
+ * They are errors rather than {@link ../types.js ToolApprovalDecision}s on purpose. A decision is
+ * something the model observes as a `ToolMessage` and can respond to; these two are precisely the
+ * cases where the spec says the model gets no move at all:
+ *
+ * - **{@link AttackHaltError}** (§4.2) — an `attack` outcome *halts the run*. "A halt ends the
+ *   agent loop. It is not a rejection the model can respond to, and no rung except `bypass` can
+ *   turn it into anything else."
+ * - **{@link NonInteractiveEscalationError}** (§6.2) — where no human can answer, *every*
+ *   escalation is an immediate non-zero exit carrying the command, the rating and its reason.
+ *   There is no prompt, no waiting, and never a timeout into approval. Teams that need specific
+ *   commands to run unattended declare them in `approvals.allow` (§3), which is consulted before
+ *   the rater and therefore never escalates.
+ *
+ * Exit code: neither class sets one. The single-shot runtime (`runSingleShot`) already reports a
+ * thrown run as `ok: false`, and each command entry point turns that into `setExitCode(1)` — so
+ * "immediate non-zero exit carrying the explanation" is what a caller already gets, without a new
+ * exit path that could diverge from the existing one.
+ */
+/**
+ * Base class for the two run-ending approvals outcomes, so a caller that wants to present them as
+ * an ending rather than a crash can catch both with one `instanceof`. Nothing does that today —
+ * every surface currently shows the message as-is, which is already the whole explanation — and
+ * [[TUI-C26]] is the node that will catch it to render the §6.1 banner.
+ */
+export declare abstract class ApprovalStopError extends Error {
+    /** The command that ended the run. */
+    readonly command: string;
+    protected constructor(message: string, command: string);
+}
+/**
+ * §4.2 — an `attack` outcome: the command's own **structure** evidenced compromise (§4.1.1 —
+ * credential targeting, privilege escalation, persistence, deception, obfuscation). Ends the agent
+ * loop; the model is told nothing and offered nothing.
+ *
+ * [[TUI-C26]] will present this interactively as the §6.1 red banner — any key stops, typing
+ * `run anyway` runs this one command — BEFORE the throw; until then the run simply ends with this
+ * message, which is what a non-interactive session gets either way (§6.2).
+ *
+ * The recovery this message names is deliberately the **allow-list**, not `bypass`. §4.2 makes
+ * `approvals.allow` the supported way to run such a command unattended (it is consulted before the
+ * rater, so it never reaches a halt at all); `bypass` also works and is far blunter — it turns off
+ * the rater, the escalation and the halt together, for every command, for the whole run. It is a
+ * last resort, not the answer, and the wording says so in that order.
+ */
+export declare class AttackHaltError extends ApprovalStopError {
+    /** The rater's explanation of what the command's structure showed. */
+    readonly reason: string;
+    constructor(command: string, reason: string);
+}
+/**
+ * §6.2 — an escalation with nobody to ask (CI, one-shot runs, servers). Fails the build loudly,
+ * with everything a person needs in order to see why.
+ */
+export declare class NonInteractiveEscalationError extends ApprovalStopError {
+    /** The rater's outcome, when a rating existed (the unrated rungs have none). */
+    readonly outcome: string | undefined;
+    /** The rater's explanation, when a rating existed. */
+    readonly reason: string | undefined;
+    /**
+     * EXT-71 §3.2 — the declared `approvals.escalate` entry that sent this call to a human, when one
+     * did. It changes the recovery the message names: pointing someone at `approvals.allow` when they
+     * themselves wrote an escalate entry sends them to a list that cannot win, since a match on
+     * `escalate` outranks a match on `allow`.
+     */
+    readonly escalatedBy: string | undefined;
+    constructor(command: string, outcome?: string, reason?: string, escalatedBy?: string);
+}

package/dist/core/shell/approvalStop.js

@@ -0,0 +1,108 @@
+/**
+ * @module core/shell/approvalStop
+ *
+ * CFG-27 — the two ways the approvals gate **ends a run** rather than answering a tool call.
+ * Both are thrown from `GthAgentRunner.decideToolApproval`, both carry the command and the reason
+ * a person needs to see, and both are re-thrown UNCHANGED by `processMessages` (which otherwise
+ * wraps failures as `Agent processing failed: …`) so the explanation reaches the user intact.
+ *
+ * They are errors rather than {@link ../types.js ToolApprovalDecision}s on purpose. A decision is
+ * something the model observes as a `ToolMessage` and can respond to; these two are precisely the
+ * cases where the spec says the model gets no move at all:
+ *
+ * - **{@link AttackHaltError}** (§4.2) — an `attack` outcome *halts the run*. "A halt ends the
+ *   agent loop. It is not a rejection the model can respond to, and no rung except `bypass` can
+ *   turn it into anything else."
+ * - **{@link NonInteractiveEscalationError}** (§6.2) — where no human can answer, *every*
+ *   escalation is an immediate non-zero exit carrying the command, the rating and its reason.
+ *   There is no prompt, no waiting, and never a timeout into approval. Teams that need specific
+ *   commands to run unattended declare them in `approvals.allow` (§3), which is consulted before
+ *   the rater and therefore never escalates.
+ *
+ * Exit code: neither class sets one. The single-shot runtime (`runSingleShot`) already reports a
+ * thrown run as `ok: false`, and each command entry point turns that into `setExitCode(1)` — so
+ * "immediate non-zero exit carrying the explanation" is what a caller already gets, without a new
+ * exit path that could diverge from the existing one.
+ */
+/**
+ * Base class for the two run-ending approvals outcomes, so a caller that wants to present them as
+ * an ending rather than a crash can catch both with one `instanceof`. Nothing does that today —
+ * every surface currently shows the message as-is, which is already the whole explanation — and
+ * [[TUI-C26]] is the node that will catch it to render the §6.1 banner.
+ */
+export class ApprovalStopError extends Error {
+    /** The command that ended the run. */
+    command;
+    constructor(message, command) {
+        super(message);
+        this.command = command;
+        // Restore the prototype chain across the ES5 `extends Error` downlevel, so `instanceof` works.
+        Object.setPrototypeOf(this, new.target.prototype);
+        this.name = new.target.name;
+    }
+}
+/**
+ * §4.2 — an `attack` outcome: the command's own **structure** evidenced compromise (§4.1.1 —
+ * credential targeting, privilege escalation, persistence, deception, obfuscation). Ends the agent
+ * loop; the model is told nothing and offered nothing.
+ *
+ * [[TUI-C26]] will present this interactively as the §6.1 red banner — any key stops, typing
+ * `run anyway` runs this one command — BEFORE the throw; until then the run simply ends with this
+ * message, which is what a non-interactive session gets either way (§6.2).
+ *
+ * The recovery this message names is deliberately the **allow-list**, not `bypass`. §4.2 makes
+ * `approvals.allow` the supported way to run such a command unattended (it is consulted before the
+ * rater, so it never reaches a halt at all); `bypass` also works and is far blunter — it turns off
+ * the rater, the escalation and the halt together, for every command, for the whole run. It is a
+ * last resort, not the answer, and the wording says so in that order.
+ */
+export class AttackHaltError extends ApprovalStopError {
+    /** The rater's explanation of what the command's structure showed. */
+    reason;
+    constructor(command, reason) {
+        super(`Run halted: the auto-rater rated this command as an attack, which ends the run.\n` +
+            `  Command: ${command}\n` +
+            `  Reason: ${reason}\n` +
+            `This is not negotiable. If this command is legitimate and you need it to run, declare ` +
+            `it in approvals.allow — that list is consulted before the auto-rater, so it never ` +
+            `reaches a halt. Dropping to approvals "bypass" also works, but it turns off the rater, ` +
+            `the prompts and the halt for every command in the run.`, command);
+        this.reason = reason;
+    }
+}
+/**
+ * §6.2 — an escalation with nobody to ask (CI, one-shot runs, servers). Fails the build loudly,
+ * with everything a person needs in order to see why.
+ */
+export class NonInteractiveEscalationError extends ApprovalStopError {
+    /** The rater's outcome, when a rating existed (the unrated rungs have none). */
+    outcome;
+    /** The rater's explanation, when a rating existed. */
+    reason;
+    /**
+     * EXT-71 §3.2 — the declared `approvals.escalate` entry that sent this call to a human, when one
+     * did. It changes the recovery the message names: pointing someone at `approvals.allow` when they
+     * themselves wrote an escalate entry sends them to a list that cannot win, since a match on
+     * `escalate` outranks a match on `allow`.
+     */
+    escalatedBy;
+    constructor(command, outcome, reason, escalatedBy) {
+        super(`Approval required, but this session has no one to ask.\n` +
+            `  Command: ${command}\n` +
+            (outcome ? `  Rating: ${outcome}\n` : '') +
+            (reason ? `  Reason: ${reason}\n` : '') +
+            (escalatedBy
+                ? `  Matched approvals.escalate: ${escalatedBy}\n` +
+                    `An escalate entry always asks a human, whatever the rung would have done, so no ` +
+                    `entry in approvals.allow can answer it. Remove the escalate entry if this command ` +
+                    `should run unattended.`
+                : `Declare the commands this run is allowed to execute in approvals.allow — write each ` +
+                    `one as an explicit entry, for example { "type": "shell", "matcher": "exact", ` +
+                    `"pattern": "npm test" }. That list is consulted before the auto-rater and never ` +
+                    `escalates.`), command);
+        this.outcome = outcome;
+        this.reason = reason;
+        this.escalatedBy = escalatedBy;
+    }
+}
+//# sourceMappingURL=approvalStop.js.map

package/dist/core/shell/approvalStop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvalStop.js","sourceRoot":"","sources":["../../../src/core/shell/approvalStop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;GAKG;AACH,MAAM,OAAgB,iBAAkB,SAAQ,KAAK;IACnD,sCAAsC;IAC7B,OAAO,CAAS;IAEzB,YAAsB,OAAe,EAAE,OAAe;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,+FAA+F;QAC/F,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,eAAgB,SAAQ,iBAAiB;IACpD,sEAAsE;IAC7D,MAAM,CAAS;IAExB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CACH,mFAAmF;YACjF,cAAc,OAAO,IAAI;YACzB,aAAa,MAAM,IAAI;YACvB,wFAAwF;YACxF,oFAAoF;YACpF,yFAAyF;YACzF,wDAAwD,EAC1D,OAAO,CACR,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,6BAA8B,SAAQ,iBAAiB;IAClE,gFAAgF;IACvE,OAAO,CAAqB;IACrC,sDAAsD;IAC7C,MAAM,CAAqB;IACpC;;;;;OAKG;IACM,WAAW,CAAqB;IAEzC,YAAY,OAAe,EAAE,OAAgB,EAAE,MAAe,EAAE,WAAoB;QAClF,KAAK,CACH,0DAA0D;YACxD,cAAc,OAAO,IAAI;YACzB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,CAAC,WAAW;gBACV,CAAC,CAAC,iCAAiC,WAAW,IAAI;oBAChD,kFAAkF;oBAClF,oFAAoF;oBACpF,wBAAwB;gBAC1B,CAAC,CAAC,sFAAsF;oBACtF,+EAA+E;oBAC/E,kFAAkF;oBAClF,YAAY,CAAC,EACnB,OAAO,CACR,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF"}

package/dist/core/shell/arity.d.ts

@@ -18,6 +18,12 @@
  * redirections. Such commands NEVER auto-match an allow-list entry — they always go to
  * fresh human approval. This is what stops `git checkout x; rm -rf /` from matching an
  * approved `git checkout *`.
+ *
+ * EXT-55: "newlines" in that list was aspirational until this node. `normalizeCommand` folded
+ * a line break to a SPACE, so the check below never saw one and `ls -la\nrm -rf /` classified
+ * as the single command `ls`. The separator set now lives in ONE place
+ * ({@link import('./normalize.js').COMMAND_SEPARATOR_CLASS}) and a line break survives
+ * normalization, so a multi-line command is categorically ambiguous — exactly like `;`.
  */
 /**
  * Result of classifying a command for allow-list matching.

package/dist/core/shell/arity.js

@@ -18,7 +18,14 @@
  * redirections. Such commands NEVER auto-match an allow-list entry — they always go to
  * fresh human approval. This is what stops `git checkout x; rm -rf /` from matching an
  * approved `git checkout *`.
+ *
+ * EXT-55: "newlines" in that list was aspirational until this node. `normalizeCommand` folded
+ * a line break to a SPACE, so the check below never saw one and `ls -la\nrm -rf /` classified
+ * as the single command `ls`. The separator set now lives in ONE place
+ * ({@link import('./normalize.js').COMMAND_SEPARATOR_CLASS}) and a line break survives
+ * normalization, so a multi-line command is categorically ambiguous — exactly like `;`.
  */
+import { COMMAND_SEPARATOR_RE, LINE_BREAK_RE } from '#src/core/shell/normalize.js';
 /**
  * Arity table: command-prefix string → number of leading tokens (binary + subcommands,
  * flags excluded) that define the "human-understandable command". Longest matching
@@ -181,11 +188,9 @@ const ARITY = {
  * Note: `&&`/`||`/`|` are covered by the bare `&`/`|` character scan; listed conceptually.
  */
 function hasUnsafeComposition(normalized) {
-    // Newlines are folded by normalizeCommand, but guard anyway in case a raw string is passed.
-    if (/[\n\r]/.test(normalized))
-        return true;
-    // Shell control / separator operators and background.
-    if (/[;|&]/.test(normalized))
+    // Shell control / separator operators, background, AND line breaks — one shared definition of
+    // "a new command begins here" (EXT-55), so this can never drift from the hardline floor's.
+    if (COMMAND_SEPARATOR_RE.test(normalized))
         return true;
     // Command substitution: $(...) or `...`.
     if (/\$\(/.test(normalized))
@@ -235,7 +240,9 @@ export function tokenize(command) {
             inToken = true;
             continue;
         }
-        if (ch === ' ' || ch === '\t') {
+        // EXT-55: line breaks are whitespace here too, so a token can never be glued across a line
+        // (`ls\n-o` must tokenize as `ls` + `-o`, or a caller inspecting the argv would miss the flag).
+        if (ch === ' ' || ch === '\t' || ch === '\n' || ch === '\r') {
             if (inToken) {
                 tokens.push(current);
                 current = '';
@@ -294,6 +301,13 @@ export function meaningfulPrefixTokens(argv) {
  * @param normalize Normalizer to apply for the detection form (inject normalizeCommand).
  */
 export function classifyCommand(command, normalize) {
+    // EXT-55 — the boundary question is answered HERE, not delegated to the injected normalizer.
+    // `normalize` is a parameter, so this function cannot assume it preserved the command
+    // separators (folding them away is exactly the bug this node fixed). A line break anywhere
+    // INSIDE the command means more than one command → never classifiable. `.trim()` first: a
+    // purely leading/trailing break separates nothing, and models routinely emit `"npm test\n"`.
+    if (LINE_BREAK_RE.test(command.trim()))
+        return null;
     const normalized = normalize(command);
     if (!normalized)
         return null;