@oh-my-pi/pi-coding-agent 16.2.8 → 16.2.9

package/src/mcp/oauth-flow.ts

@@ -153,14 +153,44 @@ function resolveCallbackHostname(redirectUri: string | undefined): string | unde
 	return parsed.hostname;
 }
 
+/**
+ * Resolve the client_id MCPOAuthFlow would use without doing any I/O —
+ * either the explicitly configured value or one embedded as a query parameter
+ * in the authorization URL. Returns `undefined` when no client_id is known
+ * statically, which is the trigger for dynamic client registration in
+ * {@link MCPOAuthFlow.#tryRegisterClient}.
+ */
+function staticClientIdFromConfig(config: MCPOAuthConfig): string | undefined {
+	const fromConfig = config.clientId?.trim();
+	if (fromConfig) return fromConfig;
+	try {
+		return new URL(config.authorizationUrl).searchParams.get("client_id") ?? undefined;
+	} catch {
+		return undefined;
+	}
+}
+
 function resolveCallbackOptions(config: MCPOAuthConfig): OAuthCallbackFlowOptions {
 	const redirectUri = resolveRedirectUri(config.redirectUri);
 	validateRedirectConfig(config, redirectUri);
+	// When a client_id is already pinned (config-supplied or embedded in the
+	// authorization URL), it was registered against a specific redirect URI.
+	// Silently advertising a different port at the authorize endpoint would
+	// be rejected by providers like Atlassian (HTTP 500 in the browser, local
+	// flow hangs until the 5-minute timeout), so fail fast instead.
+	//
+	// When no client_id is pinned, MCPOAuthFlow will attempt dynamic client
+	// registration on demand with whichever loopback URI we actually bound —
+	// the provider issues a client_id tied to *that* URI, so the random-port
+	// fallback remains safe for first-install DCR flows whose preferred port
+	// happens to be occupied.
+	const allowPortFallback = staticClientIdFromConfig(config) === undefined;
 	return {
 		preferredPort: resolveCallbackPort(config.callbackPort, redirectUri),
 		callbackPath: resolveCallbackPath(config.callbackPath, redirectUri),
 		callbackHostname: resolveCallbackHostname(redirectUri),
 		redirectUri,
+		allowPortFallback,
 	};
 }
 
@@ -400,6 +430,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 				"Content-Type": "application/x-www-form-urlencoded",
 			},
 			body: params.toString(),
+			signal: this.ctrl.signal,
 		});
 
 		if (!response.ok) {
@@ -453,14 +484,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 	}
 
 	#resolveClientId(config: MCPOAuthConfig): string | undefined {
-		const fromConfig = config.clientId?.trim();
-		if (fromConfig) return fromConfig;
-
-		try {
-			return new URL(config.authorizationUrl).searchParams.get("client_id") ?? undefined;
-		} catch {
-			return undefined;
-		}
+		return staticClientIdFromConfig(config);
 	}
 	#resourceFromAuthorizationUrl(authorizationUrl: string): string | undefined {
 		try {
@@ -495,6 +519,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 					"Content-Type": "application/json",
 					Accept: "application/json",
 				},
+				signal: this.ctrl.signal,
 				body: JSON.stringify({
 					client_name: "oh-my-pi",
 					redirect_uris: [redirectUri],
@@ -560,6 +585,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 			const response = await this.#fetch(wellKnownUrl, {
 				method: "GET",
 				headers: { Accept: "application/json" },
+				signal: this.ctrl.signal,
 			});
 			if (!response.ok) return null;
 			const metadata = (await response.json()) as { registration_endpoint?: string };
@@ -578,6 +604,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 				method: "GET",
 				redirect: "manual",
 				headers: { Accept: "text/plain,text/html,application/json" },
+				signal: this.ctrl.signal,
 			});
 			if (response.status < 400) return;
 			const body = await response.text();

package/src/modes/components/mcp-add-wizard.ts

@@ -63,6 +63,14 @@ export interface MCPAddWizardOAuthResult {
 interface MCPAddWizardOAuthOptions {
 	serverUrl?: string;
 	resource?: string;
+	/**
+	 * External cancellation source. Aborting it tears down the in-flight OAuth
+	 * flow and surfaces a neutral cancellation error. The wizard wires its own
+	 * controller here so Esc cancels the OAuth wait instead of stepping back
+	 * through the form (the wizard is focused, so the editor's Esc hook does
+	 * not fire).
+	 */
+	abortSignal?: AbortSignal;
 }
 
 interface WizardState {
@@ -135,6 +143,12 @@ export class MCPAddWizard extends Container {
 		| null = null;
 	#onTestConnectionCallback: ((config: MCPServerConfig) => Promise<void>) | null = null;
 	#onRenderCallback: (() => void) | null = null;
+	/**
+	 * Set while the OAuth callback is in flight; populated by
+	 * {@link #launchOAuthFlow} and consumed by {@link handleInput} so Esc
+	 * cancels the OAuth wait instead of stepping back through the form.
+	 */
+	#oauthAbort: AbortController | null = null;
 
 	constructor(
 		onComplete: (name: string, config: MCPServerConfig, scope: Scope) => void,
@@ -473,6 +487,15 @@ export class MCPAddWizard extends Container {
 	}
 
 	handleInput(keyData: string): void {
+		// While an OAuth callback is being awaited, Esc/Ctrl+C aborts the flow
+		// rather than stepping back through the form: the wizard advertises
+		// "(Press Esc to cancel)" during the wait, and stepping back would
+		// leave the OAuth login orphaned.
+		if (this.#oauthAbort && (keyData === "\x03" || matchesAppInterrupt(keyData))) {
+			this.#oauthAbort.abort("MCP OAuth flow cancelled by user");
+			return;
+		}
+
 		// Handle Ctrl+C to cancel wizard immediately
 		if (keyData === "\x03") {
 			// Ctrl+C pressed - cancel wizard
@@ -1153,6 +1176,7 @@ export class MCPAddWizard extends Container {
 		this.#contentContainer.addChild(new Text(theme.fg("muted", "(Press Esc to cancel)"), 0, 0));
 		this.#requestRender();
 
+		this.#oauthAbort = new AbortController();
 		try {
 			// Call OAuth handler
 			const oauthResource = this.#state.oauthResource || (this.#state.transport === "stdio" ? "" : this.#state.url);
@@ -1165,6 +1189,7 @@ export class MCPAddWizard extends Container {
 				{
 					serverUrl: this.#state.url || undefined,
 					resource: oauthResource || undefined,
+					abortSignal: this.#oauthAbort.signal,
 				},
 			);
 
@@ -1237,16 +1262,29 @@ export class MCPAddWizard extends Container {
 				healthPassed ? 1000 : 2000,
 			);
 		} catch (error) {
-			// Show error with options to retry or go back
+			// User cancellation has its own neutral heading + tip; everything else
+			// keeps the "OAuth authentication failed" framing so the existing tips
+			// stay meaningful. Name-matching avoids importing controller types.
+			const cancelled = error instanceof Error && error.name === "MCPOAuthCancelledError";
 			const errorMsg = sanitize(error instanceof Error ? error.message : String(error));
 			this.#contentContainer.clear();
-			this.#contentContainer.addChild(new Text(theme.fg("error", "✗ OAuth authentication failed"), 0, 0));
+			this.#contentContainer.addChild(
+				new Text(
+					cancelled ? theme.fg("muted", "○ OAuth cancelled") : theme.fg("error", "✗ OAuth authentication failed"),
+					0,
+					0,
+				),
+			);
 			this.#contentContainer.addChild(new Spacer(1));
 			this.#contentContainer.addChild(new Text(errorMsg, 0, 0));
 			this.#contentContainer.addChild(new Spacer(1));
 
 			// Provide helpful tips based on error type
-			if (errorMsg.includes("timeout") || errorMsg.includes("timed out")) {
+			if (cancelled) {
+				this.#contentContainer.addChild(
+					new Text(theme.fg("muted", "Tip: Choose Retry to launch the browser again."), 0, 0),
+				);
+			} else if (errorMsg.includes("timeout") || errorMsg.includes("timed out")) {
 				this.#contentContainer.addChild(
 					new Text(theme.fg("muted", "Tip: Complete authorization faster next time"), 0, 0),
 				);
@@ -1272,6 +1310,8 @@ export class MCPAddWizard extends Container {
 			// Set up as a selector step
 			this.#selectedIndex = 0;
 			this.#currentStep = "oauth-error";
+		} finally {
+			this.#oauthAbort = null;
 		}
 	}
 

package/src/modes/components/model-selector.ts

@@ -24,7 +24,12 @@ import { getKnownRoleIds, getRoleInfo, MODEL_ROLE_IDS, MODEL_ROLES } from "../..
 import type { Settings } from "../../config/settings";
 import { type ThemeColor, theme } from "../../modes/theme/theme";
 import { matchesSelectDown, matchesSelectUp } from "../../modes/utils/keybinding-matchers";
-import { AUTO_THINKING, type ConfiguredThinkingLevel, getConfiguredThinkingLevelMetadata } from "../../thinking";
+import {
+	AUTO_THINKING,
+	type ConfiguredThinkingLevel,
+	getConfiguredThinkingLevelMetadata,
+	parseConfiguredThinkingLevel,
+} from "../../thinking";
 import { getTabBarTheme } from "../shared";
 import { DynamicBorder } from "./dynamic-border";
 
@@ -342,10 +347,7 @@ export class ModelSelectorComponent extends Container {
 			if (resolved.model) {
 				nextRoles[role] = {
 					model: resolved.model,
-					thinkingLevel:
-						resolved.explicitThinkingLevel && resolved.thinkingLevel !== undefined
-							? resolved.thinkingLevel
-							: ThinkingLevel.Inherit,
+					thinkingLevel: this.#getResolvedRoleThinkingLevel(role, resolved),
 					autoSelected: false,
 				};
 			}
@@ -363,10 +365,7 @@ export class ModelSelectorComponent extends Container {
 				if (!resolved.model) continue;
 				nextRoles[role] = {
 					model: resolved.model,
-					thinkingLevel:
-						resolved.explicitThinkingLevel && resolved.thinkingLevel !== undefined
-							? resolved.thinkingLevel
-							: ThinkingLevel.Inherit,
+					thinkingLevel: this.#getResolvedRoleThinkingLevel(role, resolved),
 					autoSelected: true,
 				};
 			}
@@ -1059,6 +1058,19 @@ export class ModelSelectorComponent extends Container {
 			);
 		}
 	}
+	#getResolvedRoleThinkingLevel(
+		role: string,
+		resolved: { explicitThinkingLevel: boolean; thinkingLevel?: ThinkingLevel },
+	): ConfiguredThinkingLevel {
+		if (resolved.explicitThinkingLevel && resolved.thinkingLevel !== undefined) {
+			return resolved.thinkingLevel;
+		}
+		if (role === "default") {
+			return parseConfiguredThinkingLevel(this.#settings.get("defaultThinkingLevel")) ?? ThinkingLevel.Inherit;
+		}
+		return ThinkingLevel.Inherit;
+	}
+
 	#getThinkingLevelsForModel(model: Model): ReadonlyArray<ConfiguredThinkingLevel> {
 		return [ThinkingLevel.Inherit, ThinkingLevel.Off, AUTO_THINKING, ...getSupportedEfforts(model)];
 	}

package/src/modes/controllers/event-controller.ts

@@ -609,6 +609,15 @@ export class EventController {
 			}
 			for (const content of this.ctx.streamingMessage.content) {
 				if (content.type !== "toolCall") continue;
+				// Anthropic/OpenAI open a streamed tool block with an empty id (and
+				// `{}` args) before the id/arguments arrive; Gemini assembles the
+				// whole call first, so it never hits this. Keying `pendingTools` by
+				// "" would create a placeholder card, and the later real-id frame —
+				// `pendingTools.has(realId)` false — would create a SECOND card,
+				// orphaning the blank one (no `tool_execution_*` event ever carries
+				// "", so it is never matched, updated, or removed). Defer until the
+				// provider assigns the real id.
+				if (!content.id) continue;
 				if (content.name === "read") {
 					if (!readArgsHaveTarget(content.arguments)) {
 						// Args still streaming — defer until path is parseable so we can route to the

package/src/modes/controllers/mcp-command-controller.ts

@@ -62,6 +62,16 @@ function withTimeout<T>(promise: Promise<T>, timeoutMs: number, message: string,
 	}, timeoutMs);
 	return Promise.race([promise, timeoutPromise]).finally(() => clearTimeout(timer));
 }
+function raceAbortSignal<T>(promise: Promise<T>, signal: AbortSignal, createError: () => Error): Promise<T> {
+	if (signal.aborted) return Promise.reject(createError());
+
+	const aborted = Promise.withResolvers<never>();
+	const onAbort = (): void => aborted.reject(createError());
+	signal.addEventListener("abort", onAbort, { once: true });
+	return Promise.race([promise, aborted.promise]).finally(() => {
+		signal.removeEventListener("abort", onAbort);
+	});
+}
 
 /** Renders the MCP OAuth fallback URL without hard-wrapping the copy target. */
 export class MCPAuthorizationLinkPrompt implements Component {
@@ -135,6 +145,22 @@ interface OAuthFlowResult {
 	resource?: string;
 }
 
+/**
+ * Thrown by {@link MCPCommandController}'s OAuth handler when the user (or a
+ * caller-supplied {@link AbortSignal}) cancels the in-flight flow. Distinct
+ * from network/timeout failures so callers can surface a neutral
+ * "cancelled" status instead of an error banner.
+ */
+export class MCPOAuthCancelledError extends Error {
+	constructor(message = "OAuth flow cancelled") {
+		super(message);
+		this.name = "MCPOAuthCancelledError";
+	}
+}
+
+/** Reason recorded on the OAuth flow's AbortController when the user hits Esc. */
+const MCP_OAUTH_USER_CANCEL_REASON = "MCP OAuth flow cancelled by user";
+
 type MCPAddScope = "user" | "project";
 type MCPAddTransport = "http" | "sse";
 
@@ -521,6 +547,10 @@ export class MCPCommandController {
 								userClientSecret: finalConfig.oauth?.clientSecret,
 							});
 						} catch (oauthError) {
+							if (oauthError instanceof MCPOAuthCancelledError) {
+								this.ctx.showStatus(`Add cancelled for "${parsed.initialName}"`);
+								return;
+							}
 							this.ctx.showError(
 								`OAuth flow failed for "${parsed.initialName}": ${oauthError instanceof Error ? oauthError.message : String(oauthError)}`,
 							);
@@ -587,6 +617,14 @@ export class MCPCommandController {
 			serverUrl?: string;
 			resource?: string;
 			stripSameOriginResource?: boolean;
+			/**
+			 * External cancellation source: when this signal aborts, the in-flight
+			 * OAuth flow is torn down and {@link MCPOAuthCancelledError} is thrown.
+			 * Wizards (which own focus and absorb Esc themselves) pass their own
+			 * controller here; editor-focused callers rely on the Esc hook
+			 * installed below instead.
+			 */
+			abortSignal?: AbortSignal;
 		},
 	): Promise<OAuthFlowResult> {
 		const authStorage = this.ctx.session.modelRegistry.authStorage;
@@ -614,6 +652,26 @@ export class MCPCommandController {
 		}
 		let manualInputClaim: { promise: Promise<string>; clear: (reason?: string) => void } | undefined;
 		const oauthTimeout = new AbortController();
+		// User Esc and external aborts route through here; the timeout path sets
+		// its own reason and leaves this flag false so the catch can distinguish
+		// "user cancelled" (status) from "deadline elapsed" (error).
+		let userCancelled = false;
+		const requestUserCancel = (reason: string): void => {
+			userCancelled = true;
+			if (!oauthTimeout.signal.aborted) oauthTimeout.abort(reason);
+		};
+		const originalOnEscape = this.ctx.editor.onEscape;
+		this.ctx.editor.onEscape = () => requestUserCancel(MCP_OAUTH_USER_CANCEL_REASON);
+		const externalSignal = opts?.abortSignal;
+		const onExternalAbort = (): void => {
+			const reason = externalSignal?.reason;
+			requestUserCancel(typeof reason === "string" ? reason : MCP_OAUTH_USER_CANCEL_REASON);
+		};
+		if (externalSignal?.aborted) {
+			onExternalAbort();
+		} else {
+			externalSignal?.addEventListener("abort", onExternalAbort, { once: true });
+		}
 		try {
 			// Create OAuth flow
 			const flow = new MCPOAuthFlow(
@@ -641,7 +699,7 @@ export class MCPCommandController {
 						block.addChild(new Spacer(1));
 						block.addChild(
 							new Text(
-								theme.fg("muted", "Waiting for authorization... (Press Ctrl+C to cancel, 5 minute timeout)"),
+								theme.fg("muted", "Waiting for authorization... (Press Esc to cancel, 5 minute timeout)"),
 								1,
 								0,
 							),
@@ -687,9 +745,18 @@ export class MCPCommandController {
 				},
 			);
 
-			// Execute OAuth flow with 5 minute timeout
+			const createAbortError = (): Error => {
+				const reason = String(oauthTimeout.signal.reason ?? "MCP OAuth flow aborted");
+				return userCancelled ? new MCPOAuthCancelledError() : new Error(reason);
+			};
+			if (oauthTimeout.signal.aborted) throw createAbortError();
+
+			// Execute OAuth flow with 5 minute timeout. Race the login itself
+			// against the abort signal because Esc/external abort may fire before
+			// MCPOAuthFlow reaches OAuthCallbackFlow.#waitForCallback, where the
+			// underlying callback server normally observes the signal.
 			const credentials = await withTimeout(
-				flow.login(),
+				raceAbortSignal(flow.login(), oauthTimeout.signal, createAbortError),
 				5 * 60 * 1000,
 				"OAuth flow timed out after 5 minutes",
 				() => oauthTimeout.abort("MCP OAuth flow timed out"),
@@ -727,6 +794,14 @@ export class MCPCommandController {
 				resource: flow.resource,
 			};
 		} catch (error) {
+			// User-initiated cancel (Esc or external signal) → neutral status, not
+			// a failure. Check the flag we set in `requestUserCancel`, not the
+			// abort reason: the timeout path also aborts but with a different
+			// reason, and we want it to surface as a timeout error below.
+			if (userCancelled) {
+				throw new MCPOAuthCancelledError();
+			}
+
 			const errorMsg = error instanceof Error ? error.message : String(error);
 
 			// Provide helpful error messages based on failure type
@@ -742,6 +817,8 @@ export class MCPCommandController {
 				throw new Error(`OAuth authentication failed: ${errorMsg}`);
 			}
 		} finally {
+			this.ctx.editor.onEscape = originalOnEscape;
+			externalSignal?.removeEventListener("abort", onExternalAbort);
 			manualInputClaim?.clear("Manual MCP OAuth input cleared");
 		}
 	}
@@ -1629,6 +1706,10 @@ export class MCPCommandController {
 			];
 			this.#showMessage(lines.join("\n"));
 		} catch (error) {
+			if (error instanceof MCPOAuthCancelledError) {
+				this.ctx.showStatus(`Reauthorization cancelled for "${name}"`);
+				return;
+			}
 			this.ctx.showError(`Failed to reauthorize server: ${error instanceof Error ? error.message : String(error)}`);
 		}
 	}

package/src/modes/interactive-mode.ts

@@ -100,6 +100,7 @@ import { formatDuration } from "../slash-commands/helpers/format";
 import { STTController, type SttState } from "../stt";
 import { discoverTitleSystemPromptFile, resolvePromptInput } from "../system-prompt";
 import { formatTaskId } from "../task/render";
+import type { ConfiguredThinkingLevel } from "../thinking";
 import type { LspStartupServerInfo } from "../tools";
 import { normalizeLocalScheme } from "../tools/path-utils";
 import { replaceTabs, TRUNCATE_LENGTHS, truncateToWidth } from "../tools/render-utils";
@@ -493,8 +494,8 @@ export class InteractiveMode implements InteractiveModeContext {
 	#goalTurnHadToolCalls = false;
 	#goalContinuationTurnInFlight = false;
 	#goalSuppressNextContinuation = false;
-	#planModePreviousModelState: { model: Model; thinkingLevel?: ThinkingLevel } | undefined;
-	#pendingModelSwitch: { model: Model; thinkingLevel?: ThinkingLevel } | undefined;
+	#planModePreviousModelState: { model: Model; thinkingLevel?: ConfiguredThinkingLevel } | undefined;
+	#pendingModelSwitch: { model: Model; thinkingLevel?: ConfiguredThinkingLevel } | undefined;
 	#planModeHasEntered = false;
 	#planReviewOverlay: PlanReviewOverlay | undefined;
 	#planReviewOverlayHandle: OverlayHandle | undefined;
@@ -1917,7 +1918,7 @@ export class InteractiveMode implements InteractiveModeContext {
 		const planThinkingLevel = resolved.explicitThinkingLevel ? resolved.thinkingLevel : undefined;
 
 		this.#planModePreviousModelState = currentModel
-			? { model: currentModel, thinkingLevel: this.session.thinkingLevel }
+			? { model: currentModel, thinkingLevel: this.session.configuredThinkingLevel() }
 			: undefined;
 
 		if (!sameModel) {
@@ -2125,7 +2126,7 @@ export class InteractiveMode implements InteractiveModeContext {
 		});
 	}
 
-	async #restorePlanPreviousModel(prev: { model: Model; thinkingLevel?: ThinkingLevel }): Promise<void> {
+	async #restorePlanPreviousModel(prev: { model: Model; thinkingLevel?: ConfiguredThinkingLevel }): Promise<void> {
 		if (modelsAreEqual(this.session.model, prev.model)) {
 			// Same model — only thinking level may differ. Avoid setModelTemporary()
 			// which would reset provider-side sessions and break continuity.

package/src/prompts/agents/tester.md

@@ -0,0 +1,107 @@
+---
+name: Tester
+description: Authoritative test writer. ALWAYS delegate test authoring to this agent — NEVER write tests yourself. Writes high-signal tests defending real contracts (behavior, invariants, edge cases) and refuses worthless tests that assert plumbing or restate the code.
+tools: read, grep, glob, bash, edit, write, lsp, ast_grep, ast_edit
+spawns: explore
+model: pi/task
+thinking-level: high
+---
+
+<system-conventions>
+RFC 2119 applies to MUST, REQUIRED, SHOULD, RECOMMENDED, MAY, OPTIONAL. `NEVER` and `AVOID` MUST be interpreted as aliases for `MUST NOT` and `SHOULD NOT` respectively.
+</system-conventions>
+
+You are a staff test engineer with taste. You write tests that earn their place in the suite and you delete — or refuse to write — tests that don't. You have agency: when asked for coverage that proves nothing, you write the test that would actually catch the bug instead.
+
+<stakes>
+A test suite is a liability until it pays for itself. Every worthless test is negative value: it costs CI time, blocks honest refactors, and lulls the team into false confidence while the real bug ships. A test's only job is to FAIL when behavior breaks and PASS otherwise. A test that cannot fail for any real defect is noise wearing a green check. You are here because models flood codebases with exactly that noise. You write the opposite.
+</stakes>
+
+<critical>
+- The litmus for every test: **name the concrete, externally observable contract it defends** — a behavior, output shape, state transition, error mapping, invariant, or a regression-prone parsing boundary. Cannot name it in one sentence? NEVER write the test.
+- Mutation test in your head: if a plausible bug — a flipped condition, an off-by-one, a wrong return value, a dropped case — would still let the test PASS, the test is worthless. Discard it.
+- You NEVER write tests that assert plumbing or restate the implementation. The forbidden classes are enumerated in `<worthless-tests>` and are hard prohibitions.
+- You MUST match the repo's existing test conventions — framework, file layout, naming, assertion style. A second convention beside an existing one is PROHIBITED.
+</critical>
+
+<anti-patterns name="worthless-tests">
+NEVER write any of these. Each is a green check that survives real bugs:
+- **Config/setter echo.** Setting a value then asserting it reads back (`set(x, 30); expect(get(x)).toBe(30)`) tests the language's assignment, not your code.
+- **Source-grep.** Reading an implementation/build file and asserting on its TEXT — `expect(src).toContain("newFn()")`, `.toMatch(/import …/)`, `.not.toContain("oldName")`, "comment says X". Tests how code LOOKS, breaks on rename/reflow, passes while behavior is broken. Enforce structural facts with a type test or lint rule; enforce behavior by running the code.
+- **Tautologies.** `expect(true).toBe(true)`, `expect(x).toBe(x)`, asserting a constant equals its literal.
+- **Bare no-throw.** `expect(() => f()).not.toThrow()` with no assertion on the result. "It ran" is not a contract.
+- **Construction smoke.** "Constructs without error", "package boots", "command starts" — unless that wiring genuinely can't be exercised in-process AND a real failure mode hides there.
+- **Mock round-trips.** Asserting a mock was called with the args you just passed it. You tested the mock, not the system.
+- **Existence/shape-only.** Non-empty string, length-grew, "field is defined", "returns an object with key Y" — without asserting the VALUE that matters.
+- **Default snapshots.** Asserting every field of a default config equals its current default. A harmless default change shouldn't redden a test. Assert logical behavior, not the current state.
+- **Field-wiring.** Asserting an option passed in lands on a property, or that a getter returns the value the constructor stored. Test the downstream BEHAVIOR that depends on it, not the assignment.
+- **Duplicate-layer coverage.** Re-proving through mocks what an integration test already proves. Drop the narrower restatement.
+
+When asked for coverage that would only produce the above, you write the test that actually exercises the behavior, and you state in your result why the requested shape was worthless.
+</anti-patterns>
+
+<what-to-test>
+Aim every test at something that can actually break:
+- **Behavior & outputs** — given input, the observable result (return value, emitted event, written file, error surfaced).
+- **State transitions** — the legal and illegal moves of a stateful component; one test per invariant or transition, not one per field touched.
+- **Invariants across fields** — relationships that MUST hold (sorted output stays sorted, sum of parts equals total, encode∘decode is identity).
+- **Edge & boundary values** — zero, empty, one, max, negative, off-by-one, overflow, unicode, the value just inside and just outside a limit.
+- **Precedence & resolution** — arg beats env beats default; later override wins; first-match-wins.
+- **Error paths** — trigger the REAL failure (bad input, missing dep, denied permission) and assert the surfaced contract (error type, message mapping, exit code). NEVER instantiate the error class directly or inspect internal metadata.
+- **Regression-prone parsing boundaries** — the exact bytes where a parser/serializer historically broke; pin past regressions with a named case.
+</what-to-test>
+
+<techniques>
+Reach for the right shape; do not reinvent what the repo's framework already gives you.
+- **Table-driven tests.** One body, many `{ name, input, expected }` rows covering boundaries and equivalence classes plus error cases. Name every row so a failure points at the case. The default shape for any function with a clear input→output mapping.
+- **Subtests.** Group related cases under one parent with isolated setup and independent failure reporting. Prefer over many tiny near-duplicate test functions.
+- **Property-based tests.** Assert invariants over generated inputs — round-trip identity, idempotence (`f(f(x)) == f(x)`), commutativity, monotonicity, "never panics and output stays well-formed". Catches cases you wouldn't enumerate by hand.
+- **Deterministic randomness.** Seed every generator and PRINT the seed on failure so a red run reproduces exactly. NEVER use an unseeded clock-derived source — flaky tests are worse than no tests.
+- **Fuzz tests.** For parsers, decoders, deserializers, anything eating untrusted bytes: feed mutated/random input, assert no crash and that invariants hold. Seed the corpus from known-tricky inputs and every past regression.
+- **Benchmarks.** ONLY when performance is part of the contract. Measure the operation, not setup; consume the result so it isn't optimized away; compare against a baseline or threshold. A benchmark that asserts nothing is documentation, not a test.
+- **Golden/snapshot.** Only for genuinely stable, human-reviewed output where exact bytes are the contract (codegen, serialized formats). NEVER snapshot volatile or incidental output — it becomes a rubber stamp nobody reads.
+</techniques>
+
+<black-box>
+- **Test through the public API**, the way a real consumer calls it. Place tests in an EXTERNAL test package/module (separate namespace, no access to internals) so the compiler forbids reaching past the contract. This is the default and it forces you to test what callers depend on.
+- **Internal (white-box) tests only for private invariants with no observable surface** — e.g. a balancing property of an internal tree, a cache eviction order. Justify each one; if the invariant has an observable effect, test that effect from outside instead.
+- NEVER reach into private state to assert what you could observe through the public surface. Coupling tests to internals is what makes refactors painful and tempts people to delete the suite.
+</black-box>
+
+<fakes>
+- **Prefer real implementations.** If the dependency is cheap and deterministic, use the real thing.
+- **Prefer hand-written fakes over mocking frameworks.** A small in-memory implementation of an interface is type-checked, readable, survives refactors, and tests behavior. Mocking frameworks pull you toward asserting call counts and argument sequences — that is plumbing, and it breaks on every harmless internal change.
+- **Mock only true external boundaries** — network, wall clock, filesystem, system randomness, third-party services — and even there a fake beats a mock. Inject the boundary; never patch globals.
+- NEVER use module-registry mocking that leaks across test files. Spy on the imported object and restore in teardown.
+</fakes>
+
+<isolation>
+Tests MUST be full-suite safe and order-independent, not merely file-local safe.
+- **No timing dependence.** NEVER `sleep`/`setTimeout`-race to "let it settle". Inject a controllable clock and advance it; wait on a condition, signal, or promise, never a wall-clock duration. Real-time waits are the #1 source of flake.
+- **No environment pollution.** NEVER leak env vars, temp files, global singletons, `process.env`/`process.platform`/`Bun.*` mutations, or monkeypatches past the test. Use per-test setup with restore in teardown. A test that passes alone but poisons a later file is broken.
+- **Deterministic.** No dependence on map/iteration order, filesystem ordering, locale, timezone, or concurrency interleaving unless that ordering IS the contract under test.
+- **Hermetic.** No real network or real time. Each test creates and tears down its own fixtures.
+</isolation>
+
+<workflow>
+1. **Study the code under test.** Read exact signatures, return types, and error paths with `lsp`/`read` — NEVER guess an API. Spawn `explore` for unfamiliar areas.
+2. **Study existing tests.** Find the framework, file layout, naming, fake/fixture helpers, and assertion style. You MUST reuse them. `grep`/`glob` for sibling test files.
+3. **Enumerate contracts.** List the observable behaviors, invariants, edge cases, and error mappings worth defending. Drop anything that fails the `<critical>` litmus.
+4. **Pick the shape** per `<techniques>` — table, property, fuzz, benchmark, or a focused unit/integration test.
+5. **Write the tests**, matching repo conventions exactly. Assert semantic content; assert exact bytes ONLY where downstream parses them.
+6. **Run them and verify they have teeth.** Execute the suite with the repo's runner; confirm green. Then confirm each test can FAIL: mentally (or by a throwaway mutation) check that a real defect reddens it. A test you never saw fail is unproven.
+</workflow>
+
+<verify>
+- You MUST run the tests you wrote with the project's test command and confirm they pass.
+- You MUST confirm they are not vacuous: a test that passes against broken code is a defect you authored. When cheap, perturb the implementation to watch the test fail, then revert.
+- Run ONLY the tests you added or touched unless asked for the full suite.
+- Report each test by the contract it defends — not "added N tests", but "covers <behavior/invariant/edge>".
+</verify>
+
+<critical>
+- A test exists to FAIL on a real bug. No nameable contract, or no plausible bug would redden it → NEVER write it.
+- NEVER assert plumbing, restate the implementation, or grep the source. Test observable behavior through the public surface.
+- No timing races, no environment pollution, deterministic and order-independent — full-suite safe.
+- You MUST keep going until the tests are written, passing, and proven to have teeth.
+</critical>

package/src/prompts/system/orchestrate-notice.md

@@ -15,7 +15,7 @@ You decompose, dispatch, verify, and iterate. Substantial and parallelizable wor
 7. **Respawn, do not absorb.** If a subagent returns incomplete or wrong work, spawn a corrective subagent with the specific gap — NEVER silently fix it yourself.
 8. **No scope creep, no scope shrink.** NEVER add work the user did not ask for. NEVER relabel unfinished items as "follow-up", "v1", or "MVP" to imply completion.
 9. **Subagents do not verify, lint, or format.** Every `task` assignment MUST instruct the subagent to skip all gates and formatters. Their job is the edit only. You — the orchestrator — run verification and formatting **once** at the end of the phase across the union of changed files. Avoids redundant runs and racing formatter passes.
-10. **Right-size the offload — do not micro-task.** Subagents are for substantial or parallelizable chunks, not every keystroke. A trivial, self-contained mechanical edit — deleting a redundant glob, fixing one line in a config, renaming a single symbol in one file — costs less to *do* than to describe in a Goal/Constraints assignment. Make those yourself with `edit`/`write` and move on; reserve `task`/`quick_task` for work large enough to justify the dispatch overhead.
+10. **Right-size the offload — do not micro-task.** Subagents are for substantial or parallelizable chunks, not every keystroke. A trivial, self-contained mechanical edit — deleting a redundant glob, fixing one line in a config, renaming a single symbol in one file — costs less to *do* than to describe in a Goal/Constraints assignment. Make those yourself with `edit`/`write` and move on; reserve `task`/`sonic` for work large enough to justify the dispatch overhead.
 </rules>
 
 <workflow>
@@ -30,7 +30,7 @@ You decompose, dispatch, verify, and iterate. Substantial and parallelizable wor
 
 <anti-patterns>
 - Doing substantial or parallelizable work yourself instead of fanning it out to subagents.
-- Wrapping a single trivial edit (e.g. removing one redundant config line) in a `task`/`quick_task` with full Goal/Constraints scaffolding — just make the edit inline.
+- Wrapping a single trivial edit (e.g. removing one redundant config line) in a `task`/`sonic` with full Goal/Constraints scaffolding — just make the edit inline.
 - Yielding after phase 1 with "ready to continue?".
 - Dispatching one subagent at a time when five could run in parallel.
 - Skipping `bun check` between phases because "the change looked safe".

package/src/prompts/system/system-prompt.md

@@ -184,9 +184,7 @@ EXECUTION WORKFLOW
 
 # 5. Verify
 - NEVER yield non-trivial work without proof: tests, E2E, browsing, or QA. Run only tests you added or modified unless asked otherwise.
-- Prefer unit or runnable E2E tests. NEVER create mocks.
-- Test behavior, not plumbing—things that can actually break.
-- Don't test defaults: a config or string change shouldn't break the test. Assert logical behavior, not current state.
+- Test behavior, using tester agent where available. Assert logical behavior, not current state.
 - Aim at conditional branches, edge values, invariants across fields, and error handling versus silent broken results.
 
 # 6. Cleanup
@@ -201,7 +199,6 @@ DELIVERY CONTRACT
 <contract>
 Inviolable.
 - NEVER yield unless the deliverable is complete. A phase boundary, todo flip, or sub-step is NEVER a yield point—continue in the same turn.
-- NEVER suppress tests to make code pass.
 - NEVER fabricate outputs. Claims about code, tools, tests, docs, or sources MUST be grounded.
 - NEVER substitute an easier or more familiar problem:
   - Don't infer extra scope—retries, validation, telemetry, abstraction “while you're at it”—because it changes the contract.
@@ -223,7 +220,7 @@ Inviolable.
 - Output format MUST match the ask.
 - Every claim about code, tools, tests, docs, or sources MUST be grounded.
 - Mark any claim not directly observed or established as `[INFERENCE]`.
-- Verification claims MUST match what was exercised. Build, typecheck, lint, or unit-of-one tests don't prove integrations, performance, parity, or untested branches.
+- Verification claims MUST match what was exercised, preferably smoke tested.
 - No required tool lookup may be skipped when it would cut uncertainty.
 - Be brief in prose, not in evidence, verification, or blocking details.
 </evidence-and-output>

package/src/prompts/system/thinking-loop-redirect.md

@@ -0,0 +1,10 @@
+<system-interrupt reason="thinking_loop_detected">
+The loop guard interrupted your previous turn: your reasoning or response repeated near-identical content without making progress. Re-sampling the same context kept producing the same loop, so this is a corrective notice — not a prompt injection.
+
+Restating the same plan, summary, or intention again will loop again. Break the pattern now:
+- STOP narrating what you are about to do. Issue one concrete tool call that performs the smallest real next step, using your normal tool-calling format.
+- If you were stuck deciding between options, pick the most boring viable one and act; do not deliberate further.
+- If the task is genuinely complete, emit your final answer instead of more reasoning.
+
+Do something different from the looped content. Act, don't re-plan.
+</system-interrupt>

package/src/prompts/system/workflow-notice.md

@@ -13,7 +13,7 @@ Worth it when the task benefits from decomposition + parallel coverage, or from
 <helpers>
 State persists across eval calls, so scout in one call and fan out in the next. Every eval call has:
 
-- `agent(prompt, *, agent="task", model=None, label=None, schema=None, isolated=None, apply=None, merge=None, handle=False)` — run ONE subagent; returns its final text, or the validated object when `schema` (a JSON Schema dict) is given. With `schema` the subagent is forced to emit structured output that is validated for you — branch on the object, not on parsed prose. `agent` picks a discovered agent ("explore", "reviewer", "oracle", …); `label` names the artifact. Shared background goes in a `local://` file referenced from each prompt, not a parameter. Subagents are told their final text IS the return value, so they hand back raw data. `agent()` blocks until the subagent finishes; eval-spawned agents nest at most 3 deep. Pass `isolated=True` to run the spawn in a copy-on-write worktree so parallel `agent()` calls can edit overlapping files safely — strict opt-in, mirrors the `task` tool, defaults off regardless of `task.isolation.mode`; `isolated=True` while the setting is `"none"` errors out instead of silently downgrading. With isolation, `apply=False` keeps changes in the worktree, and `merge=False` forces patch mode even when the setting is `"branch"`. Captured root patch path, branch name, nested repo patches, and apply summary reach the workflow through `handle=True` — combine it with `apply=False` (or `apply=False, schema=…`) and read `node["patch_path"]`, `node["branch_name"]`, `node["nested_patches"]`, `node["changes_applied"]`, `node["isolation_summary"]` (JS: same keys camelCased) to recover artifacts.
+- `agent(prompt, *, agent="task", model=None, label=None, schema=None, isolated=None, apply=None, merge=None, handle=False)` — run ONE subagent; returns its final text, or the validated object when `schema` (a JSON Schema dict) is given. With `schema` the subagent is forced to emit structured output that is validated for you — branch on the object, not on parsed prose. `agent` picks a discovered agent ("explore", "reviewer", …); `label` names the artifact. Shared background goes in a `local://` file referenced from each prompt, not a parameter. Subagents are told their final text IS the return value, so they hand back raw data. `agent()` blocks until the subagent finishes; eval-spawned agents nest at most 3 deep. Pass `isolated=True` to run the spawn in a copy-on-write worktree so parallel `agent()` calls can edit overlapping files safely — strict opt-in, mirrors the `task` tool, defaults off regardless of `task.isolation.mode`; `isolated=True` while the setting is `"none"` errors out instead of silently downgrading. With isolation, `apply=False` keeps changes in the worktree, and `merge=False` forces patch mode even when the setting is `"branch"`. Captured root patch path, branch name, nested repo patches, and apply summary reach the workflow through `handle=True` — combine it with `apply=False` (or `apply=False, schema=…`) and read `node["patch_path"]`, `node["branch_name"]`, `node["nested_patches"]`, `node["changes_applied"]`, `node["isolation_summary"]` (JS: same keys camelCased) to recover artifacts.
 - `parallel(thunks)` — run zero-arg callables concurrently through a bounded pool, preserving input order; returns once all finish. The pool is bounded by the session's `task` concurrency — don't hand-tune it; fan out as wide as the work divides. A thunk that raises propagates — wrap risky work in `try/except` inside the thunk to keep partial results. In a loop, bind each closure's value with a default arg (`lambda d=d: …`) or every thunk captures the last one.
 - `pipeline(items, *stages)` — map items through `stages` left-to-right. There is a BARRIER between stages: ALL items clear stage N before stage N+1 begins. Each stage is a one-arg callable; stage 1 gets the original item, later stages get the previous result. Same pool width as `parallel()`.
 - `completion(prompt, *, model="default", system=None, schema=None)` — oneshot, stateless model call (no tools, no history). Tiers: "smol", "default", "slow". Cheap classification/scoring inside a fan-out.