@oh-my-pi/pi-coding-agent 17.1.2 → 17.1.4

package/dist/types/session/agent-session.d.ts

@@ -342,10 +342,7 @@ export declare class AgentSession {
      * Transcript for TUI display. Full history is kept for export/resume-style
      * callers; live chat can collapse compacted history to keep the hot render
      * surface bounded. Display-only — NEVER feed the result to
-     * `agent.replaceMessages` or a provider. Because it is never re-obfuscated,
-     * it opts into legacy index-derived alias restoration so pre-keyed sessions
-     * still render their secrets; the agent-feeding paths
-     * (`buildDisplaySessionContext`) keep the keyed-only default.
+     * `agent.replaceMessages` or a provider.
      */
     buildTranscriptSessionContext(options?: Pick<BuildSessionContextOptions, "collapseCompactedHistory" | "keepDanglingToolCalls">): SessionContext;
     /** Convert session messages using the same pre-LLM pipeline as the active session. */
@@ -830,7 +827,25 @@ export declare class AgentSession {
             toolCallId: string;
             questions: AskToolInput["questions"];
         };
+        /**
+         * `true` when this call committed a new sibling answer for an `ask`
+         * re-answer (`reanswerAskResult` was applied). The interactive caller
+         * resumes the agent via {@link resumeAfterAskReanswer} *after* rebuilding
+         * its transcript, so the resumed turn never renders against the stale
+         * pre-rebuild UI (issue #6483).
+         */
+        askReanswerCommitted?: boolean;
     }>;
+    /**
+     * Resume the agent after the interactive `/tree` caller has committed an
+     * `ask` re-answer (`navigateTree` returned `askReanswerCommitted`) and
+     * rebuilt its transcript. Mirrors how a live `ask` completion drives a
+     * follow-up turn, but is deferred to the caller so the resumed turn renders
+     * against the rebuilt UI rather than the stale pre-navigation transcript
+     * (issue #6483). The scheduled continue honors the same disposed/compacting
+     * guards as every other post-prompt continuation.
+     */
+    resumeAfterAskReanswer(): void;
     /**
      * Build a standalone `AgentToolContext` for running `AskTool.execute()`
      * outside a normal agent turn, for `/tree` `ask` re-answer (issue #5642).

package/dist/types/session/prewalk.d.ts

@@ -2,7 +2,7 @@ import type { Agent, AgentMessage, AgentTurnEndContext } from "@oh-my-pi/pi-agen
 import type { Model } from "@oh-my-pi/pi-ai";
 import type { LocalProtocolOptions } from "../internal-urls/index.js";
 import type { PlanModeState } from "../plan-mode/state.js";
-import type { ConfiguredThinkingLevel } from "../thinking.js";
+import { type ConfiguredThinkingLevel } from "../thinking.js";
 import type { PlanProposalHandler } from "../tools/resolve.js";
 import type { PlanYolo, Prewalk } from "./agent-session-types.js";
 import type { SessionManager } from "./session-manager.js";
@@ -11,6 +11,7 @@ export interface PrewalkCoordinatorHost {
     agent: Agent;
     sessionManager: SessionManager;
     model(): Model | undefined;
+    configuredThinkingLevel(): ConfiguredThinkingLevel | undefined;
     emitNotice(level: "info" | "warning" | "error", message: string, source?: string): void;
     setModelTemporary(model: Model, thinkingLevel?: ConfiguredThinkingLevel, options?: {
         ephemeral?: boolean;

package/dist/types/session/session-advisors.d.ts

@@ -122,6 +122,14 @@ export declare class SessionAdvisors {
     detachAndCloseRecorders(): Promise<void>;
     /** Re-primes advisor transcript views across a conversation boundary. */
     resetSessionState(): void;
+    /**
+     * Rebind every live advisor to the active primary conversation's provider
+     * identity (session id, prompt-cache key, credential + metadata resolvers,
+     * telemetry). Invoked on every provider-session change — including branch
+     * paths that skip conversation restore — so advisors never keep emitting the
+     * previous conversation's session id/metadata (issue #6625).
+     */
+    refreshProviderIdentity(): void;
     /** Re-primes advisor transcript views after an in-conversation history rewrite. */
     resetAllRuntimes(): void;
     /** Whether live runtimes still match the resolved advisor configuration. */

package/dist/types/session/session-metadata.d.ts

@@ -0,0 +1,29 @@
+import type { AuthStorage } from "./auth-storage.js";
+/**
+ * Build the per-request `metadata` payload for the Anthropic provider, shaped
+ * like real Claude Code's `getAPIMetadata` output (`{ session_id, account_uuid,
+ * device_id }`) so the backend buckets requests under one session and attributes
+ * them to the authenticated OAuth account when available. Resolved at request
+ * time so token refreshes and login/logout transitions don't strand a stale
+ * account UUID in memory. `account_uuid` and `device_id` are omitted for
+ * non-Anthropic providers to avoid leaking the user's Claude identity to
+ * third-party APIs (including Anthropic-format-compatible proxies such as
+ * cloudflare-ai-gateway or gitlab-duo).
+ *
+ * Installed via `Agent#setMetadataResolver` on the main `AgentSession`, each
+ * subagent session, and the separately constructed advisor `Agent` — each with
+ * its own provider session id — so Main, subagent, and Advisor requests each
+ * expose a distinct, stable provider-facing session identity.
+ *
+ * `provider` is the target provider string (e.g. `"anthropic"`) and gates the
+ * `account_uuid` and `device_id` lookups — only `"anthropic"` requests carry them.
+ *
+ * `sessionId` is forwarded to the auth-storage session-sticky lookup so that
+ * multi-credential setups attribute to the same OAuth account used for the
+ * actual API request rather than always picking the first credential.
+ *
+ * `authStorage` is treated as optional so test fixtures that stub `modelRegistry`
+ * without a real storage layer still work; the resolver simply skips the lookup
+ * and emits `{ session_id }` alone, matching the no-OAuth-credential path.
+ */
+export declare function buildSessionMetadata(sessionId: string, provider: string, authStorage: AuthStorage | undefined): Record<string, unknown>;

package/dist/types/session/turn-recovery.d.ts

@@ -137,12 +137,12 @@ export declare class TurnRecovery {
      */
     isRetryableError(message: AssistantMessage): boolean;
     /**
-     * Resume a stalled turn after every emitted tool call has produced a result.
-     * Cursor calls must also carry the server-execution marker. The failed
-     * assistant/tool-result pair stays in context so completed side effects are
-     * continued from rather than replayed.
+     * Classify a reasonless abort or stream stall whose emitted tool calls all
+     * have results. The failed assistant/tool-result pair stays in context so
+     * continuation cannot replay completed side effects; synthetic results tell
+     * the next turn that an unexecuted call must be reissued.
      */
-    canResumeResolvedStreamStall(message: AssistantMessage): boolean;
+    classifyResolvedInterruptedToolTurn(message: AssistantMessage): "reasonless-abort" | "stream-stall" | undefined;
     /** Checks whether a provider error represents a classifier refusal. */
     isClassifierRefusal(message: AssistantMessage): boolean;
     /** Clears fallback ownership after an explicit model change. */

package/dist/types/stt/sherpa-runtime.d.ts

@@ -0,0 +1,38 @@
+interface SherpaOfflineResult {
+    text?: string;
+}
+interface SherpaOfflineStream {
+    acceptWaveform(audio: {
+        samples: Float32Array;
+        sampleRate: number;
+    }): void;
+}
+interface SherpaOfflineConfig {
+    modelConfig: {
+        transducer: {
+            encoder: string;
+            decoder: string;
+            joiner: string;
+        };
+        tokens: string;
+        modelType: string;
+        numThreads: number;
+        provider: string;
+        debug: number;
+    };
+    decodingMethod: string;
+}
+/** A sherpa-onnx recognizer instance used by the STT worker. */
+export interface SherpaOfflineRecognizer {
+    createStream(): SherpaOfflineStream;
+    decodeAsync(stream: SherpaOfflineStream): Promise<SherpaOfflineResult>;
+}
+/** The native sherpa-onnx module surface used by the STT worker. */
+export interface SherpaRuntime {
+    OfflineRecognizer: {
+        createAsync(config: SherpaOfflineConfig): Promise<SherpaOfflineRecognizer>;
+    };
+}
+/** Loads the nearest working source-workspace sherpa wrapper, including hoisted fallbacks. */
+export declare function loadSourceSherpaRuntime(sourceUrl: string): SherpaRuntime;
+export {};

package/dist/types/thinking.d.ts

@@ -43,6 +43,30 @@ export declare const AUTO_THINKING: "auto";
 export type ConfiguredThinkingLevel = ThinkingLevel | typeof AUTO_THINKING;
 /** Maps the session-level `auto` sentinel to `undefined`; concrete levels pass through. */
 export declare function concreteThinkingLevel(level: ConfiguredThinkingLevel | undefined): ThinkingLevel | undefined;
+/**
+ * True when a prewalk hand-off from `current`/`currentLevel` to
+ * `target`/`targetLevel` would change nothing observable: same model id, same
+ * auto/fixed mode, and the same model-clamped effective effort. Prewalk arms and
+ * switches only when this is false.
+ *
+ * An effort-only delta on the same model id is a legitimate cheapening hand-off
+ * — on a reasoning model the effort is the bulk of the cost — so it is NOT a
+ * no-op and must still switch. A `targetLevel` of `undefined` means the prewalk
+ * pattern carried no explicit `:level` suffix (no effort change requested),
+ * which on the same model is a no-op.
+ *
+ * `auto` mode is compared before efforts: `auto` and a fixed selector that both
+ * resolve to `undefined` effort (e.g. `:inherit`) are NOT interchangeable —
+ * applying the fixed selector clears per-turn classification, so switching
+ * auto↔fixed is always a real change even when the clamped efforts match.
+ *
+ * Efforts are otherwise compared AFTER model clamping, so a target the model
+ * cannot honor (e.g. `:xhigh` on a model capped at `high`) — which
+ * `setThinkingLevel` would clamp straight back to the active effort — is
+ * recognized as a no-op instead of triggering an ephemeral reset and the
+ * plan/checklist nudges for nothing.
+ */
+export declare function prewalkWouldBeNoop(current: Model | undefined, currentLevel: ConfiguredThinkingLevel | undefined, target: Model, targetLevel: ConfiguredThinkingLevel | undefined): boolean;
 /** Metadata used to render the `auto` selector value alongside concrete levels. */
 export interface ConfiguredThinkingLevelMetadata {
     value: ConfiguredThinkingLevel;

package/dist/types/tools/auto-generated-guard.d.ts

@@ -1,11 +1,13 @@
+import { type Settings } from "../config/settings.js";
 /**
  * Check if a file is auto-generated by examining its content.
  * Throws ToolError if the file appears to be auto-generated.
  *
  * @param absolutePath - Absolute path to the file
  * @param displayPath - Path to show in error messages (relative or as provided)
+ * @param activeSettings - Session settings; falls back to global settings or the schema default
  */
-export declare function assertEditableFile(absolutePath: string, displayPath?: string): Promise<void>;
+export declare function assertEditableFile(absolutePath: string, displayPath?: string, activeSettings?: Settings): Promise<void>;
 /**
  * Check if file content is auto-generated.
  * Uses only the first CHECK_BYTE_COUNT characters of the content.
@@ -13,5 +15,6 @@ export declare function assertEditableFile(absolutePath: string, displayPath?: s
  *
  * @param content - File content to check (can be full content or prefix)
  * @param displayPath - Path to show in error messages
+ * @param activeSettings - Session settings; falls back to global settings or the schema default
  */
-export declare function assertEditableFileContent(content: string, displayPath: string): void;
+export declare function assertEditableFileContent(content: string, displayPath: string, activeSettings?: Settings): void;

package/dist/types/tools/bash.d.ts

@@ -17,12 +17,13 @@ export declare const BASH_DEFAULT_PREVIEW_LINES = 10;
  * containing a space, pipe, `&&`, redirect, or `$(...)`.
  *
  * The wrap reuses the same shell binary + args the local `bash-executor` would
- * pick via `settings.getShellConfig()` — Git Bash / `bash.exe` on Windows,
+ * pick via `settings.getShellConfig()` — Git Bash / `bash.exe` on Windows
+ * (`cmd.exe /c` as the last-resort fallback when no bash exists on the host),
  * `$SHELL` (bash/zsh) with the `sh` fallback on POSIX — so the ACP path
  * preserves `bash` tool semantics (`$VAR`, `$(...)`, `source`, POSIX quoting,
- * `-l`) instead of dropping to `cmd.exe` on Windows. The agent host's shell
- * path is used as a proxy for the client's, matching the near-universal
- * ACP deployment shape of an editor spawning omp as a co-hosted subprocess.
+ * `-l`) wherever a POSIX shell is available. The agent host's shell path is
+ * used as a proxy for the client's, matching the near-universal ACP
+ * deployment shape of an editor spawning omp as a co-hosted subprocess.
  */
 export declare function wrapShellLineForClientTerminal(line: string, shellConfig: {
     shell: string;

package/dist/types/tools/computer/exposure.d.ts

@@ -0,0 +1,8 @@
+import type { Model } from "@oh-my-pi/pi-ai";
+export type ComputerExposureMode = "native" | "function" | "unavailable";
+export interface ComputerExposureOptions {
+    azureBaseUrl?: string;
+    azureResourceName?: string;
+}
+/** Match the provider transport's effective Computer Use tool representation. */
+export declare function computerExposureMode(model: Model | undefined, options?: ComputerExposureOptions): ComputerExposureMode;

package/dist/types/tools/computer/supervisor.d.ts

@@ -29,4 +29,4 @@ export declare class ComputerSupervisor implements ComputerController {
 }
 export declare function registerComputerController(ownerId: string | undefined, controller: ComputerController): () => void;
 export declare function releaseComputerSessionsForOwner(ownerId: string | undefined): Promise<void>;
-export declare function smokeTestComputerWorker(timeoutMs?: number): Promise<void>;
+export declare function smokeTestComputerWorker(timeoutMs?: number, createWorker?: ComputerWorkerFactory): Promise<void>;

package/dist/types/tools/computer/worker-entry.d.ts

@@ -1 +1 @@
-export {};
+export declare function startComputerWorker(): void;

package/dist/types/tools/computer/worker.d.ts

@@ -1,4 +1,4 @@
-import { type DesktopAction, type DesktopCapture, DesktopSession, type DesktopSessionOptions } from "@oh-my-pi/pi-natives";
+import type { DesktopAction, DesktopCapture, DesktopSession, DesktopSessionOptions } from "@oh-my-pi/pi-natives";
 import type { ComputerWorkerTransport } from "./protocol.js";
 export interface NativeDesktopSession {
     readonly capabilities: DesktopSession["capabilities"];

package/dist/types/tools/computer.d.ts

@@ -63,6 +63,12 @@ export declare class ComputerTool implements AgentTool<typeof computerSchema, Co
     readonly strict = false;
     readonly approval: typeof computerApproval;
     readonly formatApprovalDetails: (args: unknown) => string[];
+    /**
+     * Settings snapshot used to create the tool's current controller; refreshed
+     * when a model switch crosses the coordinate-safe sizing boundary. Surfaced
+     * by `/computer status`.
+     */
+    effectiveConfiguration: Readonly<DesktopSessionOptions>;
     constructor(session: ToolSession, createController?: ComputerControllerFactory);
     get description(): string;
     execute(_toolCallId: string, params: ComputerParams, signal?: AbortSignal, _onUpdate?: AgentToolUpdateCallback<ComputerToolDetails>, context?: AgentToolContext): Promise<AgentToolResult<ComputerToolDetails>>;

package/dist/types/tools/memory-render.d.ts

@@ -13,10 +13,7 @@ import type { Component } from "@oh-my-pi/pi-tui";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types.js";
 import type { Theme } from "../modes/theme/theme.js";
 interface RetainRenderArgs {
-    items?: Array<{
-        content?: string;
-        context?: string;
-    }>;
+    items?: unknown;
 }
 interface QueryRenderArgs {
     query?: string;

package/dist/types/tools/shell-tokenize.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Conservative shell command tokenizer shared by the bash approval-pattern
+ * matcher and the gh-cache invalidator.
+ *
+ * Splits a bash command into independent command segments, each a list of word
+ * tokens. Handles single/double-quoted strings, backslash escapes, and the
+ * standard operators (`;`, `&&`, `||`, `|`, `&`, `(`, `)`, newlines) as segment
+ * boundaries so callers treat the pieces as independent command sequences.
+ *
+ * It is deliberately not a full POSIX parser — heredocs, command substitution,
+ * and arithmetic expansion are out of scope; callers fall through when they
+ * cannot find the structure they need.
+ */
+export declare function tokenizeShellSegments(command: string): string[][];

package/dist/types/tools/todo.d.ts

@@ -144,7 +144,13 @@ type TodoRenderArgs = TodoRenderOp & {
 };
 /** One-based ASCII roman numeral for display (I, II, III, IV, …). */
 export declare function phaseRomanNumeral(oneBasedIndex: number): string;
-/** Display-only phase header: `I. Foundation`. State and prompts never see this. */
+/**
+ * Display-only phase header: `I. Foundation`. State and prompts never see this.
+ *
+ * Sanitized for the same reason task labels are: this is a render boundary and
+ * the name may carry provider or session text holding control sequences. The
+ * raw `phase.name` stays the lookup key everywhere else.
+ */
 export declare function formatPhaseDisplayName(name: string, oneBasedIndex: number): string;
 export declare const TODO_STRIKE_HOLD_FRAMES = 2;
 export declare const TODO_STRIKE_REVEAL_FRAMES = 12;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-coding-agent",
-	"version": "17.1.2",
+	"version": "17.1.4",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -53,17 +53,17 @@
 		"@babel/parser": "^7.29.7",
 		"@babel/traverse": "^7.29.7",
 		"@mozilla/readability": "^0.6.0",
-		"@oh-my-pi/hashline": "17.1.2",
-		"@oh-my-pi/omp-stats": "17.1.2",
-		"@oh-my-pi/pi-agent-core": "17.1.2",
-		"@oh-my-pi/pi-ai": "17.1.2",
-		"@oh-my-pi/pi-catalog": "17.1.2",
-		"@oh-my-pi/pi-mnemopi": "17.1.2",
-		"@oh-my-pi/pi-natives": "17.1.2",
-		"@oh-my-pi/pi-tui": "17.1.2",
-		"@oh-my-pi/pi-utils": "17.1.2",
-		"@oh-my-pi/pi-wire": "17.1.2",
-		"@oh-my-pi/snapcompact": "17.1.2",
+		"@oh-my-pi/hashline": "17.1.4",
+		"@oh-my-pi/omp-stats": "17.1.4",
+		"@oh-my-pi/pi-agent-core": "17.1.4",
+		"@oh-my-pi/pi-ai": "17.1.4",
+		"@oh-my-pi/pi-catalog": "17.1.4",
+		"@oh-my-pi/pi-mnemopi": "17.1.4",
+		"@oh-my-pi/pi-natives": "17.1.4",
+		"@oh-my-pi/pi-tui": "17.1.4",
+		"@oh-my-pi/pi-utils": "17.1.4",
+		"@oh-my-pi/pi-wire": "17.1.4",
+		"@oh-my-pi/snapcompact": "17.1.4",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/api-logs": "^0.220.0",
 		"@opentelemetry/context-async-hooks": "^2.9.0",

package/src/advisor/__tests__/advisor.test.ts

@@ -1634,7 +1634,7 @@ describe("advisor", () => {
 			await Promise.resolve();
 
 			expect(promptInputs).toHaveLength(1);
-			expect(promptInputs[0]).toContain("#TOKABC123_");
+			expect(promptInputs[0]).toContain("$$TOKABC123_");
 			expect(promptInputs[0]).not.toContain("tok_abc123");
 		});
 		it("does not scan advisor-hidden successful tool-result bodies", async () => {
@@ -1666,7 +1666,7 @@ describe("advisor", () => {
 			await Promise.resolve();
 
 			expect(promptInputs).toHaveLength(1);
-			expect(promptInputs[0]).toContain("#TOKABC123_");
+			expect(promptInputs[0]).toContain("$$TOKABC123_");
 			expect(promptInputs[0]).not.toContain("tok_abc123");
 		});
 		it("does not scan tool-call arguments hidden by the primary-argument preview", async () => {
@@ -1693,7 +1693,7 @@ describe("advisor", () => {
 			});
 			runtime.onTurnEnd();
 			await runtime.waitForCatchup(1000, 1);
-			expect(promptInputs[0]).toContain("#TOKABC123_");
+			expect(promptInputs[0]).toContain("$$TOKABC123_");
 			expect(promptInputs[0]).not.toContain("tok_abc123");
 		});
 
@@ -1722,7 +1722,7 @@ describe("advisor", () => {
 			});
 			runtime.onTurnEnd();
 			await runtime.waitForCatchup(1000, 1);
-			expect(promptInputs[0]).toContain("#TOKABC123_");
+			expect(promptInputs[0]).toContain("$$TOKABC123_");
 			expect(promptInputs[0]).not.toContain("tok_abc123");
 		});
 
@@ -1761,7 +1761,7 @@ describe("advisor", () => {
 			await Promise.resolve();
 
 			expect(promptInputs).toHaveLength(1);
-			expect(promptInputs[0]).toContain("#TOKABC123_");
+			expect(promptInputs[0]).toContain("$$TOKABC123_");
 			expect(promptInputs[0]).not.toContain("tok_abc123");
 		});
 		it("does not scan execution source after the advisor preview cap", async () => {
@@ -1798,7 +1798,7 @@ describe("advisor", () => {
 			await Promise.resolve();
 
 			expect(promptInputs).toHaveLength(1);
-			expect(promptInputs[0]).toContain("#TOKABC123_");
+			expect(promptInputs[0]).toContain("$$TOKABC123_");
 			expect(promptInputs[0]).not.toContain("tok_abc123");
 		});
 
@@ -1829,7 +1829,7 @@ describe("advisor", () => {
 			await Promise.resolve();
 
 			expect(promptInputs).toHaveLength(1);
-			expect(promptInputs[0]).toContain("#TOKABC123_");
+			expect(promptInputs[0]).toContain("$$TOKABC123_");
 			expect(promptInputs[0]).not.toContain("tok_abc123");
 			expect(obfuscate).not.toHaveBeenCalledWith("tok_abc123", expect.anything());
 		});
@@ -1864,7 +1864,7 @@ describe("advisor", () => {
 			await Promise.resolve();
 
 			expect(promptInputs).toHaveLength(1);
-			expect(promptInputs[0]).toContain("#TOKABC123_");
+			expect(promptInputs[0]).toContain("$$TOKABC123_");
 			expect(promptInputs[0]).not.toContain("tok_abc123");
 			expect(obfuscate).not.toHaveBeenCalledWith("tok_abc123", expect.anything());
 		});
@@ -1876,7 +1876,7 @@ describe("advisor", () => {
 			// precomputation obfuscateMessages performs for the primary provider path
 			// (see secrets-obfuscator.test.ts). Redacting message fields independently
 			// would let the EARLIER user message's plain secret (OTHERSECRET) mint a
-			// friendly-prefixed placeholder ("#TOKABC123_<hash>#") before the SIBLING
+			// friendly-prefixed placeholder ("$$TOKABC123_<hash>$$") before the SIBLING
 			// toolResult's `details.diff` field, later in the same delta, reveals the
 			// regex-protected value that friendly name normalizes to
 			// (tok_abc123 -> TOKABC123) — baking a normalized rendering of that
@@ -2004,7 +2004,7 @@ describe("advisor", () => {
 			// placeholder from a PRIOR thinking block: if thinking fell through
 			// unredacted, the advisor prompt would receive both the raw secret AND,
 			// had it been redacted without sharing the regex collision set, a
-			// normalized "#TOKABC123_<hash>#" rendering of the regex-protected value
+			// normalized "$$TOKABC123_<hash>$$" rendering of the regex-protected value
 			// (tok_abc123) only discovered later in the same delta.
 			const obfuscator = new SecretObfuscator([
 				{ type: "plain", content: "OTHERSECRET", friendlyName: "TOKABC123" },
@@ -3938,6 +3938,76 @@ describe("advisor", () => {
 			expect(promptInputs[1]).toContain("bbb");
 		});
 
+		it("notifies the host after the advisor persistently quarantines its output (issue #6661)", async () => {
+			const state: { messages: AgentMessage[]; error?: string } = { messages: [] };
+			let promptCalls = 0;
+			let shouldQuarantine = true;
+			const agent: AdvisorAgent = {
+				prompt: async input => {
+					promptCalls++;
+					state.messages.push({ role: "user", content: input, timestamp: Date.now() } as AgentMessage);
+					if (shouldQuarantine) {
+						state.messages.push({
+							role: "assistant",
+							content: [
+								{ type: "text", text: "The agent skipped the required plan step." },
+								{ type: "toolCall", id: `tc-${promptCalls}`, name: "bash", arguments: { command: "ls" } },
+							],
+							stopReason: "toolUse",
+							timestamp: Date.now(),
+						} as unknown as AgentMessage);
+						throw new AdvisorOutputQuarantinedError(
+							"Advisor response quarantined: requested unavailable tool bash",
+						);
+					}
+					state.messages.push({
+						role: "assistant",
+						content: [{ type: "text", text: "ok" }],
+						timestamp: Date.now(),
+					} as unknown as AgentMessage);
+				},
+				abort: () => {},
+				reset: () => {
+					state.messages.length = 0;
+					state.error = undefined;
+				},
+				rollbackTo: count => {
+					if (count < state.messages.length) state.messages.length = count;
+					state.error = undefined;
+				},
+				state,
+			};
+			const notifyFailures: string[] = [];
+			const messages: AgentMessage[] = [{ role: "user", content: "aaa", timestamp: 1 } as AgentMessage];
+			const host: AdvisorRuntimeHost = {
+				snapshotMessages: () => messages,
+				enqueueAdvice: () => {},
+				notifyFailure: err => notifyFailures.push(err instanceof Error ? err.message : String(err)),
+			};
+			const runtime = new AdvisorRuntime(agent, host, 0);
+
+			// Every advisor turn calls an ungranted tool and is quarantined, so its
+			// advice never reaches the primary. A persistently-quarantining advisor is
+			// a supervision failure the user must see in the main UI, not an unbounded
+			// silent re-prime loop.
+			for (let i = 2; i <= 5; i++) {
+				messages.push({ role: "user", content: `msg-${i}`, timestamp: i } as AgentMessage);
+				runtime.onTurnEnd(messages);
+				await settleUntil(() => runtime.backlog === 0);
+			}
+
+			expect(promptCalls).toBeGreaterThanOrEqual(2);
+			expect(notifyFailures).toEqual(["Advisor response quarantined: requested unavailable tool bash"]);
+			expect(runtime.failureNotified).toBe(true);
+
+			shouldQuarantine = false;
+			messages.push({ role: "user", content: "recovered", timestamp: 6 } as AgentMessage);
+			runtime.onTurnEnd(messages);
+			await settleUntil(() => runtime.backlog === 0);
+
+			expect(runtime.failureNotified).toBe(false);
+		});
+
 		it("drops the in-flight batch when a reset aborts the advisor prompt", async () => {
 			const promptInputs: string[] = [];
 			const { promise: firstPromptStarted, resolve: startFirstPrompt } = Promise.withResolvers<void>();

package/src/advisor/runtime.ts

@@ -218,6 +218,15 @@ export function buildAdvisorQuarantineSourceText(currentInput: string, messages:
  */
 const MAX_COALESCE_ROUNDS = 3;
 
+/**
+ * Consecutive quarantined advisor turns tolerated before the failure is surfaced
+ * to the host UI. A quarantine discards the advisor's whole turn before dispatch,
+ * so its advice never reaches the primary; one silent re-prime is allowed to
+ * recover a one-off hallucination, but a persistent quarantine loop is a real
+ * supervision gap the user must see (issue #6661). Reset on any successful turn.
+ */
+const MAX_QUARANTINE_RETRIES = 2;
+
 const ADVISOR_RENDER_OPTIONS = {
 	includeThinking: true,
 	includeToolIntent: true,
@@ -279,6 +288,8 @@ export class AdvisorRuntime {
 	#backlog = 0;
 	#consecutiveFailures = 0;
 	#failureNotified = false;
+	/** Consecutive quarantined turns since the last success/reset (issue #6661). */
+	#consecutiveQuarantines = 0;
 	/** Completed 3-failure backlog-drop cycles since the last success/reset. */
 	#droppedBacklogs = 0;
 	/**
@@ -450,7 +461,6 @@ export class AdvisorRuntime {
 
 	#clearAdvisorContextAtCurrentCursor(): void {
 		this.#consecutiveFailures = 0;
-		this.#failureNotified = false;
 		this.#clearSeenContext();
 		try {
 			this.agent.reset();
@@ -505,6 +515,8 @@ export class AdvisorRuntime {
 		this.#halted = false;
 		this.#failing = false;
 		this.#droppedBacklogs = 0;
+		this.#consecutiveQuarantines = 0;
+		this.#failureNotified = false;
 		this.#resetAdvisorContext(true, true);
 	}
 
@@ -865,6 +877,7 @@ export class AdvisorRuntime {
 					this.#consecutiveFailures = 0;
 					this.#failureNotified = false;
 					this.#droppedBacklogs = 0;
+					this.#consecutiveQuarantines = 0;
 					if (this.host.onTurnSuccess) {
 						try {
 							await this.host.onTurnSuccess();
@@ -906,6 +919,19 @@ export class AdvisorRuntime {
 						logger.debug("advisor onTurnError hook failed", { err: String(hookErr) });
 					}
 					if (err instanceof AdvisorOutputQuarantinedError) {
+						// A quarantine discards the advisor's whole turn before dispatch, so
+						// its advice never reaches the primary. One re-prime is allowed to
+						// recover a one-off hallucination silently; a persistent quarantine
+						// loop is a supervision gap the user must see in the main UI — not an
+						// unbounded silent retry. Surface it (deduped by #notifyFailureOnce)
+						// and drop the batch to break the loop (issue #6661).
+						this.#consecutiveQuarantines++;
+						if (this.#consecutiveQuarantines >= MAX_QUARANTINE_RETRIES) {
+							this.#notifyFailureOnce(err);
+							this.#consecutiveQuarantines = 0;
+							this.#resetAdvisorContext(true, true);
+							continue;
+						}
 						const rePrime = this.#pending.length > 0 ? this.#latestMessages : undefined;
 						// Wake catchup waiters only when nothing is re-primed; otherwise the
 						// re-primed turn restores the backlog and waiters resolve on its completion.