@inetafrica/open-claudia 2.9.0 → 2.9.3

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## v2.9.3
+- **Bot advertises a distinct "thinking" state before its first token (Kazee parity Phase 2).** The typing pipeline now carries an additive `state` discriminator (`'thinking' | 'typing'`) — no new socket event. The runner advertises `thinking` from the moment a turn starts until the first stream event (text delta, assistant content, tool call, or result), then flips to plain `typing`; Kazee clients render "<name> is thinking…" in the header/chat-list for that pre-token window and fall back to normal typing text otherwise. The Telegram adapter ignores `state` (its chat action has no such distinction), so the change is inert there. Pairs with the chat-central `message:interactiveUpdated` broadcast (server-authoritative button selection) landing in the same release across chat-central/web/mobile.
+- **Ships the v2.9.2 work that never published.** v2.9.2 (Kazee REST media fallback when a socket send lacks a media path, plus an explicit `typing:stop` on turn end) was committed to main but no tag was ever pushed, so CI never published it. This tag carries it to npm alongside the thinking-state change.
+
+## v2.9.1
+- **Post-turn reviewer no longer rewrites pack sections blind — context starvation fixed.** The reviewer prompt showed only the pack *index* (name + description), so a State rewrite was regenerated from the turn text alone and silently destroyed durable facts the turn didn't restate; worse, with no project name in the turn text it could attribute the work to the wrong pack entirely (observed live: an AQUELLE product-shot turn filed under Alpha Protein, wiping a promoted root-cause fact). The runner now passes the turn's **active packs** (recall-surfaced ∪ explicitly opened) into `reviewTurn`; the prompt includes their **full current Stance/Procedure/State + recent journal**, with two new rules: attribute updates to an active pack unless the turn clearly names another, and treat section rewrites as **merges** — carry forward every still-true fact, drop only what the turn contradicted or completed.
+- **Structural enforcement, not just prompt guidance.** `applyAction` drops section rewrites (State/Stance/Procedure) targeting any pack whose current content the reviewer did not see — journal lines still land; the announce line notes the drop. Applies to the update path, the exists-on-create path, and the versioned-duplicate fold.
+- **Provenance guard extended.** A user-authored Procedure now gets the same intent-wins protection as Stance (an automated writer never silently replaces it). State stays rewritable by design, but replacing a user-authored State is now flagged in the reviewer's announcement (⚠️) so the overwrite is visible instead of silent.
+
 ## v2.9.0
 - **Hybrid async approvals — a destructive run no longer burns the turn or dead-ends on a late press.** v2.8.0's chat approval blocked the CLI for 5 minutes and treated timeout as denial, which had two UX failures: an undecided window wasted minutes of live turn, and a button pressed after the window hit a dead-end (terse auto-ack, no agent reaction — the record was already denied). The flow is now two-phase. **Fast path**: the CLI waits ~90s; an inline Approve runs immediately, Deny refuses — unchanged semantics, just a tighter window. **Async path**: if undecided at 90s, the CLI marks the record `detached` and exits code 5 with instructions to end the turn ("pending your Approve/Deny — do NOT retry"); the record stays open for 24h. When the button is eventually pressed, the `apr:` handler sees the detached record and **schedules an immediate wakeup** in the originating channel carrying the decision and the exact command, so the agent reacts either way (runs it, or acknowledges the denial).
 - **One-shot approval tokens, fail-closed on every branch.** The woken agent redeems the decision with `tool run <name> <args> --approval <apr_id>`. `approvals.consume()` requires ALL of: status `approved`, never consumed before (single use — a replay is refused), within 24h of request, and a command line **byte-identical** to what the user saw on the buttons (a mismatch refuses without burning the token). `--approval` is honored on top-level runs only — a nested/composed tool can't smuggle a token — and redemption stamps `approvedVia: "chat-approval"` + exports `OPEN_CLAUDIA_APPROVED_TIER=destructive` exactly like an inline approve, so composition inheritance is unchanged. Undecided, denied, expired, unknown, or mismatched never runs.

package/channels/kazee/adapter.js

@@ -256,6 +256,9 @@ class KazeeAdapter {
       body.type = "interactive";
       body.interactive = { buttons };
     }
+    // Progressive delivery of the bot's own answer — tell the server this is a
+    // streaming edit so it skips editHistory + the "edited" marker.
+    if (opts.streaming) body.streaming = true;
     try {
       await this._request("PUT", `/message/${encodeURIComponent(messageId)}`, body);
     } catch (e) {
@@ -299,30 +302,56 @@ class KazeeAdapter {
         console.error("Kazee upload returned no media id:", JSON.stringify(upload).slice(0, 300));
         return false;
       }
-      // Post the message via the v2 socket event `message:send`, which
-      // accepts `mediaIds` referencing already-saved Media docs. We avoid
-      // the REST sendMessage action because it tries to re-Media.create
-      // from media_url and that call omits required schema fields
-      // (chat/bucketName/fileName/minioPath) — it always 500s.
+      const type = this._kazeeFileType(fileName);
+      // Prefer the v2 socket event `message:send` (real-time fan-out), which
+      // accepts `mediaIds` referencing already-saved Media docs. If the socket
+      // is down or the ack errors, fall back to the REST sendMessage action —
+      // it now accepts already-uploaded media via `media_ids` (previously it
+      // only took media_url and re-Media.create'd, which always 500'd).
       const payload = {
         chatId: channelId,
         content: caption || "",
-        type: this._kazeeFileType(fileName),
+        type,
         findMeCode: `oc-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
         mediaIds: [mediaId],
       };
-      const res = await this._socketEmit("message:send", payload, 30000);
-      if (res && res.code) {
-        console.error("Kazee message:send error:", res.code, res.message);
-        return false;
+      try {
+        const res = await this._socketEmit("message:send", payload, 30000);
+        if (res && res.code) {
+          console.error(`Kazee message:send error (${res.code}), falling back to REST:`, res.message);
+          return await this._sendMediaViaRest(channelId, mediaId, type, caption);
+        }
+        return true;
+      } catch (sockErr) {
+        console.error("Kazee message:send unavailable, falling back to REST:", sockErr.message);
+        return await this._sendMediaViaRest(channelId, mediaId, type, caption);
       }
-      return true;
     } catch (e) {
       console.error("Kazee sendFile error:", e.message);
       return false;
     }
   }
 
+  // REST fallback for posting an already-uploaded Media doc when the socket
+  // path is unavailable. Mirrors send()'s route (POST /chat/:id/message →
+  // sendMessage action) but references the saved media by id.
+  async _sendMediaViaRest(channelId, mediaId, type, caption) {
+    try {
+      await this._request("POST", `/chat/${encodeURIComponent(channelId)}/message`, {
+        chat_id: channelId,
+        sender: this.botUserId,
+        content: caption || "",
+        type,
+        media_ids: [mediaId],
+        findMeCode: `oc-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+      });
+      return true;
+    } catch (e) {
+      console.error("Kazee REST media send failed:", e.message);
+      return false;
+    }
+  }
+
   // Promisified ack-style socket emit. chat-central v2 handlers respond
   // either with a success body or an { code, message, action } error.
   _socketEmit(event, payload, timeoutMs = 15000) {
@@ -355,8 +384,22 @@ class KazeeAdapter {
     return "file";
   }
 
-  async typing(channelId) {
-    try { this._socket?.emit?.("typing:start", { chatId: channelId }); } catch (e) {}
+  // `state` is an optional richer indicator: "thinking" (the bot is reasoning
+  // pre-first-token) vs the default "typing". Kazee clients render "thinking"
+  // distinctly; older clients ignore the field and fall back to "typing".
+  async typing(channelId, state) {
+    try {
+      const payload = { chatId: channelId };
+      if (state) payload.state = state;
+      this._socket?.emit?.("typing:start", payload);
+    } catch (e) {}
+  }
+
+  // Socket channels keep rendering "typing…" until an explicit stop. Telegram
+  // has no equivalent (its chat action self-expires), so this is Kazee-only and
+  // called via optional chaining from the core typing heartbeat cleanup.
+  async typingStop(channelId) {
+    try { this._socket?.emit?.("typing:stop", { chatId: channelId }); } catch (e) {}
   }
 
   async downloadMedia(media) {

package/channels/telegram/adapter.js

@@ -351,7 +351,9 @@ class TelegramAdapter {
     }
   }
 
-  async typing(channelId) {
+  // Telegram exposes only a single "typing" chat action, so the optional
+  // `state` (thinking vs typing) is accepted for signature parity but ignored.
+  async typing(channelId, _state) {
     try { await this.bot.sendChatAction(channelId, "typing"); } catch (e) {}
   }
 

package/channels/types.js

@@ -55,7 +55,8 @@
  *   delete(channelId, messageId): Promise<void>
  *   sendVoice(channelId, oggPath): Promise<boolean>
  *   sendFile(channelId, filePath, caption?): Promise<boolean>
- *   typing(channelId): Promise<void>
+ *   typing(channelId, state?): Promise<void>  // state: "thinking" | "typing" (default). Non-socket channels ignore state.
+ *   typingStop?(channelId): Promise<void>     // optional — socket channels only
  *   downloadMedia(mediaRef): Promise<localPath|null>
  *   registerCommands(commands: CommandSpec[]): Promise<void>
  */

package/core/io.js

@@ -52,11 +52,11 @@ async function sendFile(filePath, caption) {
   return adapter.sendFile(channelId, filePath, caption);
 }
 
-async function typing() {
+async function typing(state) {
   const adapter = currentAdapter();
   const channelId = currentChannelId();
   if (!adapter || !channelId) return;
-  return adapter.typing(channelId);
+  return adapter.typing(channelId, state);
 }
 
 function splitMessage(text, maxLen = 4000) {

package/core/pack-review.js

@@ -58,7 +58,34 @@ function formatAnnouncement(lines) {
   return [header, ...lines].join("\n\n");
 }
 
-function buildReviewPrompt(userText, assistantText) {
+// Full current content of the packs a turn actually worked with, rendered
+// into the review prompt so section rewrites are merges (old content visible)
+// instead of blind regenerations from the turn text — a blind State rewrite
+// silently destroys durable facts the turn didn't restate.
+const ACTIVE_PACK_MAX = 4;
+const ACTIVE_SECTION_CHARS = 1500;
+
+function renderActivePacks(activePacks) {
+  const dirs = (Array.isArray(activePacks) ? activePacks : []).slice(0, ACTIVE_PACK_MAX);
+  const blocks = [];
+  for (const dir of dirs) {
+    let p = null;
+    try { p = packs.readPack(dir); } catch (e) {}
+    if (!p) continue;
+    const sec = p.sections || {};
+    const journal = String(sec.Journal || "").split("\n").filter((l) => l.trim()).slice(-3).join("\n");
+    const parts = [`### ${p.dir}: ${p.name} — ${p.description || ""}`];
+    if (String(sec.Stance || "").trim()) parts.push(`Stance:\n${clip(sec.Stance.trim(), ACTIVE_SECTION_CHARS)}`);
+    if (String(sec.Procedure || "").trim()) parts.push(`Procedure:\n${clip(sec.Procedure.trim(), ACTIVE_SECTION_CHARS)}`);
+    if (String(sec.State || "").trim()) parts.push(`State (current):\n${clip(sec.State.trim(), ACTIVE_SECTION_CHARS)}`);
+    if (journal) parts.push(`Journal (recent):\n${journal}`);
+    blocks.push(parts.join("\n"));
+  }
+  return blocks.join("\n\n");
+}
+
+function buildReviewPrompt(userText, assistantText, activePacks) {
+  const activeBlock = renderActivePacks(activePacks);
   const index = packs.listPacks().map((p) => {
     const ab = p.kind === "ability" ? " ◆ability" : "";
     const prov = p.kind === "ability" && p.learned_on
@@ -93,7 +120,11 @@ A LESSON is a single always-loaded rule (NOT topic-gated like packs/entities —
 
 Existing packs:
 ${index}
+${activeBlock ? `
+Packs ACTIVE during this turn — their FULL CURRENT content. The turn's work almost certainly belongs to one of these:
 
+${activeBlock}
+` : ""}
 Known entities:
 ${entityIndex}
 
@@ -112,6 +143,8 @@ ${clip(assistantText)}
 
 Decide. Rules:
 - Bias toward action: if the turn did real work on an identifiable topic (a named system, project, server, app, person, or domain), record it — at minimum a journal line. Most working turns deserve one. Reserve empty actions for small talk, pure status checks, and turns that contain nothing new.
+- ATTRIBUTION: prefer updating one of the ACTIVE packs above. The turn text often does not name its project (pronouns, follow-ups, pasted URLs) — never attribute the work to a different pack from the index on thematic similarity alone when an active pack fits the work.
+- State/Stance/Procedure rewrites are MERGES, never regenerations: start from the pack's CURRENT content shown in the ACTIVE block above, carry forward every fact that is still true, drop only what this turn contradicted or completed, then fold in what changed. Never drop a durable fact merely because this turn did not mention it. If a pack's current content is NOT shown above, do not rewrite its sections — record a journal line only (section rewrites there are discarded).
 - UPDATE an existing pack when the turn touched that topic: append a journal line, and rewrite State if where-things-stand changed. Update Stance when the user expressed a lasting preference or rule; Procedure when a verified working method emerged.
 - PROMOTE durable conclusions out of the Journal. A confirmed root-cause diagnosis, an established fact, or a settled design decision must go into Stance/Procedure/State (the parts always injected in full), NOT only a Journal line — Journal is truncated to the last few lines on injection, so a conclusion left only there will silently fall out of recall over time.
 - CREATE a pack ONLY when the turn worked on a durable topic that NO existing pack covers. Before creating, scan the existing packs above for one already about this project/system/domain — if one exists, UPDATE it instead. A new pack must be a genuinely DISTINCT topic, never a narrower facet, version, release, sub-feature, phase, or component of a topic an existing pack already owns. In particular: a release or version of a project (e.g. a pack named after "<project> v2.6.39") is a Journal line + State update on that project's EXISTING pack — NEVER its own pack. Likewise sub-features of one system belong in that system's pack, not in siblings. When unsure whether something is a new topic or a facet of an existing one, treat it as a facet and UPDATE. Do not create packs for one-off trivia.
@@ -189,7 +222,7 @@ function findDuplicatePack({ dir, name, description, tags }) {
   return null;
 }
 
-function applyAction(a) {
+function applyAction(a, activeSet = null) {
   if (!a || typeof a !== "object") return null;
   const guard = guardCheck(a);
   if (guard.flagged) {
@@ -198,11 +231,17 @@ function applyAction(a) {
   if (a.action === "update" && a.pack) {
     const existing = packs.readPack(a.pack);
     if (!existing) return null;
+    // Structural enforcement of merge-not-regenerate: the reviewer only saw
+    // the full current sections of the turn's ACTIVE packs, so a section
+    // rewrite on any other pack is blind (generated from the turn text alone)
+    // and would destroy durable facts. Journal lines always land; section
+    // rewrites are dropped for packs outside the active set.
+    const blind = activeSet instanceof Set && !activeSet.has(a.pack);
     const r = packs.updatePack(a.pack, {
       journal: a.journal || "",
-      state: typeof a.state === "string" ? a.state : "",
-      stance: typeof a.stance === "string" ? a.stance : "",
-      procedure: typeof a.procedure === "string" ? a.procedure : "",
+      state: !blind && typeof a.state === "string" ? a.state : "",
+      stance: !blind && typeof a.stance === "string" ? a.stance : "",
+      procedure: !blind && typeof a.procedure === "string" ? a.procedure : "",
     }, "reviewer");
     // Cross-project reuse: only abilities carry applied_on, so ignore the field
     // on context packs (keeps project trackers churn-free).
@@ -212,7 +251,15 @@ function applyAction(a) {
         if (packs.recordApplied(a.pack, proj)) appliedTo = proj;
       }
     }
-    return { kind: "update", dir: a.pack, name: existing.name, note: a.journal || (appliedTo ? `reused on ${appliedTo}` : "state updated"), protectedStance: !!r.protectedStance, appliedTo };
+    return {
+      kind: "update", dir: a.pack, name: existing.name,
+      note: a.journal || (appliedTo ? `reused on ${appliedTo}` : "state updated"),
+      protectedStance: !!r.protectedStance,
+      protectedProcedure: !!r.protectedProcedure,
+      overwroteUserState: !!r.overwroteUserState,
+      blindSkipped: blind && [a.state, a.stance, a.procedure].some((s) => typeof s === "string" && s.trim()),
+      appliedTo,
+    };
   }
   if (a.action === "create" && (a.dir || a.name)) {
     const dir = packs.slugify(a.dir || a.name);
@@ -223,7 +270,8 @@ function applyAction(a) {
       : [];
     const projects = applied_on.length ? applied_on : (learned_on ? [learned_on] : []);
     if (packs.readPack(dir)) {
-      packs.updatePack(dir, { journal: a.journal || "", state: a.state || "" }, "reviewer");
+      const blind = activeSet instanceof Set && !activeSet.has(dir);
+      packs.updatePack(dir, { journal: a.journal || "", state: blind ? "" : (a.state || "") }, "reviewer");
       if (kind === "ability") for (const proj of projects) packs.recordApplied(dir, proj);
       return { kind: "update", dir, name: a.name || dir, note: a.journal || "state updated" };
     }
@@ -232,7 +280,8 @@ function applyAction(a) {
     // they are activity-named and cross-project by design).
     const dupeDir = kind === "context" ? findDuplicatePack({ dir, name: a.name, description: a.description, tags: a.tags }) : null;
     if (dupeDir && packs.readPack(dupeDir)) {
-      packs.updatePack(dupeDir, { journal: a.journal || "", state: a.state || "" }, "reviewer");
+      const blind = activeSet instanceof Set && !activeSet.has(dupeDir);
+      packs.updatePack(dupeDir, { journal: a.journal || "", state: blind ? "" : (a.state || "") }, "reviewer");
       const ex = packs.readPack(dupeDir);
       return { kind: "update", dir: dupeDir, name: (ex && ex.name) || dupeDir, note: a.journal || "folded a new-pack proposal into the existing pack" };
     }
@@ -319,7 +368,7 @@ function shouldSkipReview({ userText, assistantText, signals = {} }) {
 
 // Fire-and-forget. `announce` is an async (text) => void bound to the
 // originating channel; failures are logged, never thrown into the turn.
-function reviewTurn({ userText, assistantText, channelId, announce, signals }) {
+function reviewTurn({ userText, assistantText, channelId, announce, signals, activePacks }) {
   if (!enabled()) return;
   const skip = shouldSkipReview({ userText, assistantText, signals });
   if (skip) {
@@ -329,7 +378,8 @@ function reviewTurn({ userText, assistantText, channelId, announce, signals }) {
     return;
   }
 
-  const prompt = buildReviewPrompt(redactSensitive(String(userText || "")), redactSensitive(String(assistantText || "")));
+  const activeSet = Array.isArray(activePacks) && activePacks.length ? new Set(activePacks) : null;
+  const prompt = buildReviewPrompt(redactSensitive(String(userText || "")), redactSensitive(String(assistantText || "")), activePacks);
 
   spawnSubagent(prompt, {
     model: REVIEW_MODEL,
@@ -343,7 +393,7 @@ function reviewTurn({ userText, assistantText, channelId, announce, signals }) {
     const usedIds = []; // nodes this turn's work demonstrably touched
     for (const a of decision.actions) {
       try {
-        const r = applyAction(a);
+        const r = applyAction(a, activeSet);
         if (r && (r.kind === "update" || r.kind === "create") && r.dir) usedIds.push(`pack:${r.dir}`);
         if (r && r.kind === "skipped") {
           lines.push(`🛡️ Skipped a memory write that looked like an injected instruction (${r.reason}).`);
@@ -352,7 +402,11 @@ function reviewTurn({ userText, assistantText, channelId, announce, signals }) {
         } else if (r && r.kind === "create") {
           lines.push(`📦 New pack: ${r.name}${r.parent ? ` (filed under ${r.parent})` : ""}\n${clipWords(r.note, 180)}\n↳ open-claudia pack show ${r.dir}`);
         } else if (r) {
-          lines.push(`✏️ ${r.name} — ${clipWords(r.note, 180)}${r.appliedTo ? ` 🧩 (now also applies to ${r.appliedTo})` : ""}\n↳ open-claudia pack show ${r.dir}`);
+          const marks = [];
+          if (r.appliedTo) marks.push(` 🧩 (now also applies to ${r.appliedTo})`);
+          if (r.overwroteUserState) marks.push(" ⚠️ replaced a user-written State — check it kept your facts");
+          if (r.blindSkipped) marks.push(" (section rewrite dropped: pack wasn't active this turn — journal only)");
+          lines.push(`✏️ ${r.name} — ${clipWords(r.note, 180)}${marks.join("")}\n↳ open-claudia pack show ${r.dir}`);
         }
       } catch (e) {
         console.warn(`[pack-review] apply failed: ${e.message}`);

package/core/packs.js

@@ -393,8 +393,26 @@ function updatePack(dir, { description, tags, stance, procedure, state, journal,
       applied.push("Stance");
     }
   }
-  if (typeof procedure === "string" && procedure.trim()) { pack.sections.Procedure = procedure.trim(); applied.push("Procedure"); }
-  if (typeof state === "string" && state.trim()) { pack.sections.State = state.trim(); applied.push("State"); }
+  let protectedProcedure = false;
+  if (typeof procedure === "string" && procedure.trim()) {
+    // Same intent-wins rule as Stance: a user-authored Procedure is a verified
+    // how-to — an automated writer never silently replaces it.
+    if (origin !== "user" && provenanceOf(dir, "Procedure") === "user") {
+      protectedProcedure = true;
+    } else {
+      pack.sections.Procedure = procedure.trim();
+      applied.push("Procedure");
+    }
+  }
+  // State stays rewritable by design (it tracks "now"), but replacing a
+  // user-authored State is flagged so the caller can announce the overwrite
+  // instead of it happening silently.
+  let overwroteUserState = false;
+  if (typeof state === "string" && state.trim()) {
+    if (origin !== "user" && provenanceOf(dir, "State") === "user") overwroteUserState = true;
+    pack.sections.State = state.trim();
+    applied.push("State");
+  }
   if (typeof journal === "string" && journal.trim()) {
     const entries = pack.sections.Journal.split("\n").filter((l) => l.trim());
     const line = journal.trim().replace(/\n+/g, " ");
@@ -409,6 +427,8 @@ function updatePack(dir, { description, tags, stance, procedure, state, journal,
   writePack(pack);
   if (applied.length) setProvenance(dir, applied, origin);
   pack.protectedStance = protectedStance;
+  pack.protectedProcedure = protectedProcedure;
+  pack.overwroteUserState = overwroteUserState;
   return pack;
 }
 

package/core/runner.js

@@ -812,12 +812,30 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   // receipt through the recall/discoverer phase and into streaming, not just
   // for the ~5s a single typing action lasts. Stored on state so /stop can
   // clear it instantly. Cleared on close/error/cancel.
+  // While true, the bot is reasoning before its first output token, so the
+  // typing heartbeat advertises the richer "thinking" state. Flipped to false
+  // the moment the first assistant text / tool_use / text_delta arrives.
+  state.thinkingPhase = true;
   const startTyping = () => {
     if (!adapter || !channelId) return;
-    adapter.typing(channelId).catch(() => {});
-    if (!state.typingHeartbeat) state.typingHeartbeat = setInterval(() => adapter.typing(channelId).catch(() => {}), 4000);
+    adapter.typing(channelId, state.thinkingPhase ? "thinking" : undefined).catch(() => {});
+    if (!state.typingHeartbeat) state.typingHeartbeat = setInterval(() => adapter.typing(channelId, state.thinkingPhase ? "thinking" : undefined).catch(() => {}), 4000);
+  };
+  // Called on the first real output token to leave the thinking phase and, if
+  // the turn is still live, immediately advertise plain "typing" so the client
+  // flips without waiting for the next 4s heartbeat.
+  const endThinking = () => {
+    if (!state.thinkingPhase) return;
+    state.thinkingPhase = false;
+    if (adapter && channelId && state.typingHeartbeat) adapter.typing(channelId).catch(() => {});
+  };
+  const stopTyping = () => {
+    state.thinkingPhase = false;
+    if (state.typingHeartbeat) { clearInterval(state.typingHeartbeat); state.typingHeartbeat = null; }
+    // Telegram's chat action auto-expires, but socket-based channels (Kazee)
+    // keep showing "typing…" until told to stop. Optional on the adapter.
+    if (adapter && channelId) { try { adapter.typingStop?.(channelId); } catch (e) {} }
   };
-  const stopTyping = () => { if (state.typingHeartbeat) { clearInterval(state.typingHeartbeat); state.typingHeartbeat = null; } };
   // Pre-spawn window (recall/compaction/auth): /stop has no process to kill, so
   // it sets state.cancelRequested and we bail at the checkpoint before spawning.
   state.preparingRun = true;
@@ -1041,8 +1059,13 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   // reflects what was read, not what was pushed. (consumeLastInjected is
   // drained here to keep the per-turn buffer from leaking into the next turn.)
   let turnRecallTier = "";
+  // Pack dirs surfaced (recall-matched) for this turn — joined with
+  // openedThisTurn at end-of-turn to tell the post-turn reviewer which packs
+  // this turn's work belongs to (attribution + safe State rewrites).
+  let surfacedPackDirs = [];
   try {
     const injected = require("./system-prompt").consumeLastInjected();
+    if (injected && Array.isArray(injected.packDirs)) surfacedPackDirs = injected.packDirs;
     if (injected && injected.recall) {
       const r = injected.recall;
       turnRecallTier = String(r.tier || "");
@@ -1168,7 +1191,7 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
         if (!state.statusMessageId && assistantText) {
           state.statusMessageId = await send(display.length > 4000 ? display.slice(-4000) : display, telegramHtmlOpts({ replyTo: replyToMsgId }));
         } else if (state.statusMessageId) {
-          await editMessage(state.statusMessageId, display.length > 4000 ? display.slice(-4000) : display, telegramHtmlOpts());
+          await editMessage(state.statusMessageId, display.length > 4000 ? display.slice(-4000) : display, telegramHtmlOpts({ streaming: true }));
         }
         lastUpdate = display;
       }
@@ -1190,6 +1213,17 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
     const lastNewline = state.streamBuffer.lastIndexOf("\n");
     state.streamBuffer = lastNewline >= 0 ? state.streamBuffer.slice(lastNewline + 1) : state.streamBuffer;
     for (const evt of events) {
+      // Leave the "thinking" phase the moment the model produces any real
+      // output — streamed text, a finished assistant block, a tool call, or a
+      // terminal result. Idempotent (guards on state.thinkingPhase internally).
+      if (state.thinkingPhase && (
+        (evt.type === "stream_event" && evt.event?.type === "content_block_delta" && evt.event.delta?.type === "text_delta") ||
+        (evt.type === "assistant" && evt.message?.content) ||
+        (evt.type === "tool_call" && evt.subtype === "started") ||
+        evt.type === "result"
+      )) {
+        endThinking();
+      }
       // Voice latency probe: first "system" event = CLI ready (cold-start done);
       // "result" = generation finished (before the TTS tail drains).
       if (voiceStreaming && vlFirstSysAt == null && evt.type === "system") vlFirstSysAt = Date.now();
@@ -1394,7 +1428,7 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
       const firstChunk = chunks[0];
 
       if (state.statusMessageId && chunks.length === 1) {
-        await editMessage(state.statusMessageId, firstChunk, telegramHtmlOpts());
+        await editMessage(state.statusMessageId, firstChunk, telegramHtmlOpts({ streaming: true }));
       } else {
         const sent = await send(firstChunk, telegramHtmlOpts({ replyTo: replyToMsgId }));
         if (!sent) await send(firstChunk);
@@ -1537,6 +1571,14 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
         userText: prompt,
         assistantText,
         channelId,
+        // Packs this turn demonstrably worked with: surfaced by recall for the
+        // incoming message, or explicitly opened by the agent. The reviewer
+        // sees their full current sections and must attribute updates here —
+        // prevents cross-project misattribution and blind State rewrites.
+        activePacks: [...new Set([
+          ...surfacedPackDirs,
+          ...[...openedThisTurn].filter((n) => n.startsWith("pack:")).map((n) => n.slice(5)),
+        ])],
         signals: { tier: turnRecallTier, wrote: toolUses.some((t) => WRITE_TOOLS.has(t)) },
         announce: (text) => chatContext.run(store, () => send(text)),
       });

package/core/system-prompt.js

@@ -442,10 +442,10 @@ function tryUseRecallBudget(budget, text) {
 // What the last promptWithDynamicContext call freshly injected (not the
 // deduped repeats) — consumed by the runner to announce recalls in chat,
 // mirroring the write-side announcements.
-let lastInjected = { packs: [], entities: [], recall: null };
+let lastInjected = { packs: [], packDirs: [], entities: [], recall: null };
 function consumeLastInjected() {
   const out = lastInjected;
-  lastInjected = { packs: [], entities: [], recall: null };
+  lastInjected = { packs: [], packDirs: [], entities: [], recall: null };
   return out;
 }
 
@@ -743,7 +743,7 @@ function voiceReplyGuidance() {
 }
 
 async function promptWithDynamicContext(prompt, opts = {}) {
-  lastInjected = { packs: [], entities: [], recall: null };
+  lastInjected = { packs: [], packDirs: [], entities: [], recall: null };
   try {
     const { userText, contextText } = recallMatchParts(prompt);
     let historyText = "";
@@ -770,6 +770,10 @@ async function promptWithDynamicContext(prompt, opts = {}) {
     const toolBlock = result.toolBlock || "";
     const episodeBlock = result.episodeBlock || "";
     const why = result.why || {};
+    // Pack DIRS surfaced for this turn (matched, whether or not the body was
+    // freshly injected or deduped) — consumed by the post-turn reviewer so it
+    // knows which packs the turn's work belongs to and can see their content.
+    lastInjected.packDirs = (result.packMatches || []).map((m) => m.dir).filter(Boolean);
     lastInjected.recall = {
       engine: engine.name || recall.activeEngineName(settings),
       gated: !!result.gated,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.9.0",
+  "version": "2.9.3",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {