@oh-my-pi/pi-coding-agent 17.1.7 → 17.2.0

package/dist/types/tools/read.d.ts

@@ -24,6 +24,8 @@ export interface ReadToolDetails {
     method?: string;
     notes?: string[];
     meta?: OutputMeta;
+    /** Full on-disk byte size recorded before applying a file range. */
+    fileSize?: number;
     /** Raw text + start line for user-visible TUI rendering, set when content is text-like.
      * Mirrors the same lines the model receives but without hashline/line-number prefixes,
      * so the TUI can render the file content with its own gutter without re-parsing the formatted text. */

package/dist/types/tools/xdev.d.ts

@@ -103,10 +103,11 @@ export declare function resolveMountedXdevTool(state: XdevState, name: string):
 export declare function resolveMountedXdevExecutable(state: XdevState, name: string): Tool | undefined;
 /** Mounted tools in presentation order, resolved from the canonical map. */
 export declare function listXdevTools(state: XdevState): Tool[];
-/** `{name, summary}` pairs for prompt templates and `/tools` display. */
+/** `{name, summary, dynamic}` triples for prompt templates and `/tools` display. */
 export declare function xdevEntries(state: XdevState): Array<{
     name: string;
     summary: string;
+    dynamic: boolean;
 }>;
 /** `read xd://` listing with one device per line. */
 export declare function xdevListing(state: XdevState): string;

package/dist/types/tui/output-block.d.ts

@@ -16,6 +16,7 @@ export interface OutputBlockOptions {
     width: number;
     applyBg?: boolean;
     contentPaddingLeft?: number;
+    contentPaddingRight?: number;
     /** Override the state-derived border color. Used for muted "legacy" tool
      * frames that should not visually compete with framed-output tools. */
     borderColor?: ThemeColor;
@@ -28,12 +29,11 @@ export declare function markFramedBlockComponent<T extends Component>(component:
 export declare function isFramedBlockComponent(component: Component): boolean;
 /**
  * Inner content width that {@link renderOutputBlock} wraps its body to, for a
- * given outer `width`: both vertical borders (1 cell each) plus the left
- * content padding. Renderers that size a tail window MUST budget visual rows
- * against this, not the outer width — otherwise the block re-wraps their lines
- * into more rows than they counted and the box overflows its intended height.
+ * given outer `width`: both vertical borders plus symmetric content padding.
+ * An explicit left padding of zero keeps legacy flush blocks flush on both
+ * sides unless a right padding is provided separately.
  */
-export declare function outputBlockContentWidth(width: number, contentPaddingLeft?: number): number;
+export declare function outputBlockContentWidth(width: number, contentPaddingLeft?: number, contentPaddingRight?: number): number;
 export declare function renderOutputBlock(options: OutputBlockOptions, theme: Theme): string[];
 /**
  * Cached wrapper around `renderOutputBlock`.

package/dist/types/utils/changelog.d.ts

@@ -1,3 +1,4 @@
+import type { SettingValue } from "../config/settings.js";
 export interface ChangelogEntry {
     major: number;
     minor: number;
@@ -21,7 +22,13 @@ export interface StartupChangelogSelection {
     persistCurrentVersion: boolean;
     truncated: boolean;
     selectedEntries: number;
+    totalUnseenEntries: number;
+    latestVersion: string | undefined;
+    changeCount: number;
+    categoryCounts: Record<string, number>;
 }
+/** Format the compact, deterministic startup update notice. */
+export declare function formatStartupChangelogSummary(selection: StartupChangelogSelection): string;
 /**
  * Parse changelog entries from omp's package asset when available, falling back
  * to the copy embedded in compiled binaries.
@@ -55,6 +62,18 @@ export declare function renderChangelogEntries(entries: ChangelogEntry[], option
  * Select bounded release notes for interactive startup.
  */
 export declare function selectStartupChangelog(entries: ChangelogEntry[], lastVersion: string | undefined, currentVersion: string): StartupChangelogSelection;
+/**
+ * Resolve and persist the automatic startup changelog decision.
+ *
+ * Hidden mode advances the marker only for an upgrade, so downgrades do not
+ * erase knowledge of a newer version the user has already seen.
+ */
+export declare function resolveStartupChangelogForDisplay(options: {
+    mode: SettingValue<"startup.changelogMode">;
+    currentVersion: string;
+    changelogPath?: string;
+    agentDir?: string;
+}): Promise<StartupChangelogSelection | undefined>;
 export { getChangelogPath } from "../config.js";
 /**
  * Last omp version whose changelog the user has seen. Stored as a plain-text

package/dist/types/utils/git.d.ts

@@ -147,6 +147,14 @@ export declare const GIT_COMMAND_TIMEOUT_MS: number;
 export declare const GIT_NETWORK_TIMEOUT_MS: number;
 /** Maximum captured stdout or stderr bytes retained from git and gh subprocesses. */
 export declare const GIT_COMMAND_OUTPUT_LIMIT_BYTES: number;
+/**
+ * Deadline for synchronous git plumbing commands launched via
+ * {@link gitSpawnSyncText}. These run on the render path (e.g. reftable HEAD
+ * resolution), so the deadline is short: a command that has not exited by then
+ * is killed and reported as {@link GIT_COMMAND_TIMEOUT_EXIT_CODE} so the caller
+ * degrades instead of freezing the UI indefinitely.
+ */
+export declare const GIT_SPAWN_SYNC_TIMEOUT_MS = 5000;
 interface CommandOptions {
     readonly env?: Record<string, string | undefined>;
     readonly maxOutputBytes?: number;
@@ -271,6 +279,8 @@ export declare const log: {
 export declare const revList: {
     /** Commits in `base..head`, oldest first. */
     range(cwd: string, base: string, head: string, signal?: AbortSignal): Promise<string[]>;
+    /** Commits reachable from `ref` that touched `file`, newest first, capped at `limit`. */
+    touching(cwd: string, ref: string, file: string, limit: number, signal?: AbortSignal): Promise<string[]>;
 };
 export declare const branch: {
     /** Current branch name, or null if detached/unavailable. */

package/dist/types/utils/jj.d.ts

@@ -16,14 +16,21 @@ export interface JjRepository {
     storeDir: string;
 }
 /** Options for `jj diff` invocations. */
-export interface DiffOptions {
+export interface DiffOptions extends JjCommandOptions {
     /** Optional file paths to restrict the diff with `-- <files>`. */
     readonly files?: readonly string[];
     /** Return only changed file names instead of Git-format diff text. */
     readonly nameOnly?: boolean;
-    /** Optional abort signal passed to the spawned `jj` process. */
+}
+/** Options for a bounded `jj` subprocess query. */
+export interface JjCommandOptions {
+    /** Optional cancellation signal for the subprocess. */
     readonly signal?: AbortSignal;
+    /** Deadline in milliseconds. Defaults to {@link JJ_COMMAND_TIMEOUT_MS}. */
+    readonly timeoutMs?: number;
 }
+/** Default finite deadline for local jj subprocesses. */
+export declare const JJ_COMMAND_TIMEOUT_MS = 5000;
 /** Error thrown when a checked `jj` command exits non-zero. */
 export declare class JjCommandError extends Error {
     /** Arguments passed after the common `jj --no-pager --color=never` prefix. */
@@ -46,7 +53,7 @@ export declare const workingCopy: {
      * Label `@` with its nearest bookmark, falling back to its short change ID.
      * Returns `null` when `jj` is unavailable or the query fails.
      */
-    label(cwd: string, signal?: AbortSignal): Promise<string | null>;
+    label(cwd: string, options?: JjCommandOptions): Promise<string | null>;
     /** Parse working-copy label query output. */
     parseLabel: typeof parseWorkingCopyLabel;
 };
@@ -56,7 +63,7 @@ export declare const status: {
      * Count changes in `@` relative to its parent using the Git status shape.
      * Jujutsu has no index, so `staged` is always zero.
      */
-    summary(cwd: string, signal?: AbortSignal): Promise<git.GitStatusSummary | null>;
+    summary(cwd: string, options?: JjCommandOptions): Promise<git.GitStatusSummary | null>;
     /** Parse `jj diff --summary` output into status counts. */
     parse: typeof parseStatusSummary;
 };

package/dist/types/web/search/types.d.ts

@@ -34,7 +34,7 @@ export declare const SEARCH_PROVIDER_OPTIONS: readonly [{
 }, {
     readonly value: "exa";
     readonly label: "Exa";
-    readonly description: "Uses Exa API when EXA_API_KEY is set; falls back to Exa MCP";
+    readonly description: "API via /login exa or EXA_API_KEY; explicit keyless fallback via MCP";
 }, {
     readonly value: "tinyfish";
     readonly label: "TinyFish";
@@ -136,7 +136,7 @@ export declare const SEARCH_PROVIDER_CHOICES: ({
 } | {
     readonly value: "exa";
     readonly label: "Exa";
-    readonly description: "Uses Exa API when EXA_API_KEY is set; falls back to Exa MCP";
+    readonly description: "API via /login exa or EXA_API_KEY; explicit keyless fallback via MCP";
 } | {
     readonly value: "tinyfish";
     readonly label: "TinyFish";

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-coding-agent",
-	"version": "17.1.7",
+	"version": "17.2.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -52,17 +52,17 @@
 		"@agentclientprotocol/sdk": "1.2.1",
 		"@babel/parser": "^7.29.7",
 		"@mozilla/readability": "^0.6.0",
-		"@oh-my-pi/hashline": "17.1.7",
-		"@oh-my-pi/omp-stats": "17.1.7",
-		"@oh-my-pi/pi-agent-core": "17.1.7",
-		"@oh-my-pi/pi-ai": "17.1.7",
-		"@oh-my-pi/pi-catalog": "17.1.7",
-		"@oh-my-pi/pi-mnemopi": "17.1.7",
-		"@oh-my-pi/pi-natives": "17.1.7",
-		"@oh-my-pi/pi-tui": "17.1.7",
-		"@oh-my-pi/pi-utils": "17.1.7",
-		"@oh-my-pi/pi-wire": "17.1.7",
-		"@oh-my-pi/snapcompact": "17.1.7",
+		"@oh-my-pi/hashline": "17.2.0",
+		"@oh-my-pi/omp-stats": "17.2.0",
+		"@oh-my-pi/pi-agent-core": "17.2.0",
+		"@oh-my-pi/pi-ai": "17.2.0",
+		"@oh-my-pi/pi-catalog": "17.2.0",
+		"@oh-my-pi/pi-mnemopi": "17.2.0",
+		"@oh-my-pi/pi-natives": "17.2.0",
+		"@oh-my-pi/pi-tui": "17.2.0",
+		"@oh-my-pi/pi-utils": "17.2.0",
+		"@oh-my-pi/pi-wire": "17.2.0",
+		"@oh-my-pi/snapcompact": "17.2.0",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/api-logs": "^0.220.0",
 		"@opentelemetry/context-async-hooks": "^2.9.0",
@@ -107,6 +107,10 @@
 		"dist/cli.js",
 		"dist/CHANGELOG-*.md",
 		"dist/*.node",
+		"dist/template-*.css",
+		"dist/template-*.html",
+		"dist/template-*.js",
+		"dist/tool-views.generated-*.js",
 		"scripts",
 		"examples",
 		"README.md",

package/scripts/bundle-dist.ts

@@ -9,6 +9,7 @@ const packageDir = path.join(import.meta.dir, "..");
 const outDir = path.join(packageDir, "dist");
 const cliPath = path.join(outDir, "cli.js");
 const shebang = "#!/usr/bin/env bun\n";
+const legacyHtmlExportAssetPattern = /^(?:template-[^.]+\.(?:css|html|js)|tool-views\.generated-[^.]+\.js)$/;
 
 // Native / optional / platform-specific deps are loaded from installed files.
 // `omp-legacy-pi-modules` exists only in compiled binaries via the build plugin;
@@ -80,7 +81,8 @@ async function cleanBundleOutputs(): Promise<void> {
 					entry === "cli.js" ||
 					entry.endsWith(".node") ||
 					entry.endsWith(".js.map") ||
-					(entry.startsWith("CHANGELOG-") && entry.endsWith(".md")),
+					(entry.startsWith("CHANGELOG-") && entry.endsWith(".md")) ||
+					legacyHtmlExportAssetPattern.test(entry),
 			)
 			.map(entry => fs.rm(path.join(outDir, entry), { force: true })),
 	);

package/src/advisor/advise-tool.ts

@@ -75,17 +75,6 @@ export function isInterruptingSeverity(severity: AdvisorSeverity | undefined): b
 	return severity === "concern" || severity === "blocker";
 }
 
-/**
- * Append a staleness caveat to an advisor note when newer primary turns arrived
- * after the reviewed transcript window (i.e. `hasFreshBacklog` is true on the
- * advisor runtime at delivery time). Pure function — no session coupling — so it
- * can be unit-tested in isolation and called from `AgentSession#routeAdvice`.
- */
-export function annotateForStaleness(note: string, hasFreshBacklog: boolean): string {
-	if (!hasFreshBacklog) return note;
-	return `${note}\n\n_(Note: newer primary turns arrived after this reviewed window — verify this still applies.)_`;
-}
-
 /** How an advisor note is routed to the primary. */
 export type AdvisorDeliveryChannel = "aside" | "steer" | "preserve";
 /** Half-open turn-count fence for the post-interrupt cooldown. */

package/src/advisor/runtime.ts

@@ -2,6 +2,7 @@ import type { AgentMessage } from "@oh-my-pi/pi-agent-core";
 import { estimateTokens } from "@oh-my-pi/pi-agent-core/compaction";
 import type { AssistantMessage, ImageContent, TextContent } from "@oh-my-pi/pi-ai";
 import * as AIError from "@oh-my-pi/pi-ai/error";
+import { raceWithSignal } from "@oh-my-pi/pi-ai/utils/abort";
 import { type CursorExecResolvedCarrier, kCursorExecResolved } from "@oh-my-pi/pi-ai/utils/block-symbols";
 import { logger } from "@oh-my-pi/pi-utils";
 import { obfuscateToolArguments, type SecretObfuscator } from "../secrets/obfuscator";
@@ -47,7 +48,7 @@ export interface AdvisorRuntimeHost {
 	 * recovery path must never replay the full primary transcript.
 	 * Optional: hosts that omit it get no proactive maintenance.
 	 */
-	maintainContext?(incomingTokens: number): Promise<boolean>;
+	maintainContext?(incomingTokens: number, signal: AbortSignal): Promise<boolean>;
 	/**
 	 * Called immediately before each `agent.prompt(batch)` cycle. Lets the host
 	 * clear per-update advisor state — currently the one-advise-per-update gate
@@ -67,6 +68,7 @@ export interface AdvisorRuntimeHost {
 	onTurnError?(
 		error: unknown,
 		failedMessages: readonly AgentMessage[],
+		signal: AbortSignal,
 	): Promise<boolean | undefined> | boolean | undefined;
 	/** Called after a successful advisor turn so the host can finish fallback lifecycle reporting. */
 	onTurnSuccess?(): Promise<void> | void;
@@ -76,6 +78,8 @@ export interface AdvisorRuntimeHost {
 	 *  recovery (credential switch, fallback chain) declined. Cleared only by
 	 *  an explicit reset (`/new`, config rebuild, session restart). */
 	notifyQuotaExhausted?(): void;
+	/** Stable identity for the live advisor model. Used to restore full transcript rendering after a model switch. */
+	getModelIdentity?(): string;
 }
 
 /**
@@ -228,7 +232,6 @@ const MAX_COALESCE_ROUNDS = 3;
 const MAX_QUARANTINE_RETRIES = 2;
 
 const ADVISOR_RENDER_OPTIONS = {
-	includeThinking: true,
 	includeToolIntent: true,
 	watchedRoles: true,
 	expandPrimaryContext: true,
@@ -285,11 +288,17 @@ export class AdvisorRuntime {
 	#advisorRegexSecretValues = new Set<string>();
 	#pending: PendingDelta[] = [];
 	#busy = false;
+	#sessionTransitionPaused = false;
+	#promptInFlight: Promise<void> | undefined;
+	#iterationAbort: AbortController | undefined;
 	#backlog = 0;
 	#consecutiveFailures = 0;
 	#failureNotified = false;
 	/** Consecutive quarantined turns since the last success/reset (issue #6661). */
 	#consecutiveQuarantines = 0;
+	/** Whether primary reasoning is included in advisor deltas for the current model. */
+	#includeThinking = true;
+	#modelIdentity: string | undefined;
 	/** Completed 3-failure backlog-drop cycles since the last success/reset. */
 	#droppedBacklogs = 0;
 	/**
@@ -340,18 +349,6 @@ export class AdvisorRuntime {
 		return this.#halted;
 	}
 
-	/**
-	 * True when `#pending` is non-empty while the drain loop is busy — i.e., newer
-	 * primary turns arrived after the current batch's transcript window was fixed
-	 * but before the advisor model finished processing it. The delivery path uses
-	 * this to annotate advice that was generated without seeing those newer turns.
-	 * Can be true during `agent.prompt()`, a `maintainContext` await, or a retry
-	 * sleep — any time `#drain` is busy and a concurrent `onTurnEnd` pushed.
-	 */
-	get hasFreshBacklog(): boolean {
-		return this.#pending.length > 0;
-	}
-
 	/**
 	 * Called after each primary turn ends. Renders the incremental delta and
 	 * queues it for the advisor model.
@@ -440,6 +437,7 @@ export class AdvisorRuntime {
 	}
 
 	dispose(): void {
+		this.#iterationAbort?.abort("advisor disposed");
 		this.disposed = true;
 		this.#epoch++;
 		this.#pending = [];
@@ -502,6 +500,31 @@ export class AdvisorRuntime {
 		});
 	}
 
+	/** Stop new advisor work and wait only for the active prompt's recorder-visible events. */
+	pauseForSessionTransition(): Promise<void> {
+		if (!this.#sessionTransitionPaused) {
+			this.#sessionTransitionPaused = true;
+			this.#wakeAllWaiters();
+			this.#iterationAbort?.abort("advisor session transition");
+			try {
+				this.agent.abort("advisor session transition");
+			} catch {}
+		}
+		return (
+			this.#promptInFlight?.then(
+				() => {},
+				() => {},
+			) ?? Promise.resolve()
+		);
+	}
+
+	/** Continue queued work after a session transition rolls back or preserves the conversation. */
+	resumeAfterSessionTransition(): void {
+		if (!this.#sessionTransitionPaused) return;
+		this.#sessionTransitionPaused = false;
+		if (!this.#quotaExhausted && !this.#halted) void this.#drain();
+	}
+
 	/**
 	 * Re-prime the advisor after a history rewrite (compaction, session
 	 * switch/resume, branch). Clears the advisor's own (non-persisted) context
@@ -510,7 +533,9 @@ export class AdvisorRuntime {
 	 * leaving it blind to everything before the rewrite.
 	 */
 	reset(): void {
+		this.#iterationAbort?.abort("advisor reset");
 		this.#epoch++;
+		this.#sessionTransitionPaused = false;
 		this.#quotaExhausted = false;
 		this.#halted = false;
 		this.#failing = false;
@@ -542,13 +567,23 @@ export class AdvisorRuntime {
 		this.#wakeAllWaiters();
 	}
 
+	#syncModelIdentity(): void {
+		const identity = this.host.getModelIdentity?.();
+		if (identity === undefined || identity === this.#modelIdentity) return;
+		this.#modelIdentity = identity;
+		this.#includeThinking = true;
+	}
+
 	#formatRawDelta(rawMessages: AgentMessage[], wip = false): string | null {
 		const delta = rawMessages
 			.filter(message => !(message.role === "custom" && message.customType === "advisor"))
 			.map(message => this.#dedupContextMessage(message));
 		if (delta.length === 0) return null;
 		const obfuscator = this.host.obfuscator;
-		let md = formatSessionHistoryMarkdown(delta, ADVISOR_RENDER_OPTIONS);
+		let md = formatSessionHistoryMarkdown(delta, {
+			...ADVISOR_RENDER_OPTIONS,
+			includeThinking: this.#includeThinking,
+		});
 		if (!md.trim()) return null;
 		if (obfuscator?.hasSecrets()) {
 			let discoveredNewRegexSecretValue = false;
@@ -582,7 +617,7 @@ export class AdvisorRuntime {
 						? obfuscateAdvisorMessage(obfuscator, message, this.#advisorRegexSecretValues)
 						: message,
 				),
-				ADVISOR_RENDER_OPTIONS,
+				{ ...ADVISOR_RENDER_OPTIONS, includeThinking: this.#includeThinking },
 			);
 			md = obfuscator.obfuscate(md, this.#advisorRegexSecretValues);
 		}
@@ -708,6 +743,7 @@ export class AdvisorRuntime {
 		epoch: number,
 		initial: PendingDelta[],
 		recoveringOverflow: boolean,
+		signal: AbortSignal,
 	): Promise<{
 		batch: string | null;
 		rawMessages: AgentMessage[];
@@ -724,11 +760,12 @@ export class AdvisorRuntime {
 		let wip = initial.at(-1)?.wip ?? false;
 
 		for (let round = 0; round < MAX_COALESCE_ROUNDS; round++) {
+			if (this.#sessionTransitionPaused) break;
 			if (this.host.maintainContext) {
 				const incomingTokens = estimateTokens({ role: "user", content: batchText, timestamp: Date.now() });
 				let shouldResetContext = false;
 				try {
-					shouldResetContext = await this.host.maintainContext(incomingTokens);
+					shouldResetContext = await this.host.maintainContext(incomingTokens, signal);
 				} catch (err) {
 					logger.debug("advisor context maintenance failed", { err: String(err) });
 				}
@@ -745,6 +782,7 @@ export class AdvisorRuntime {
 					// remain queued and ship as their own subsequent batch.
 					if (round > 0) {
 						const lateItems = this.#pending.splice(0);
+						initial.push(...lateItems);
 						turns += lateItems.reduce((sum, b) => sum + b.turns, 0);
 						if (lateItems.length > 0) {
 							wip = lateItems.at(-1)!.wip;
@@ -781,6 +819,7 @@ export class AdvisorRuntime {
 			// update WIP state, and re-check the maintenance budget.
 			const late = this.#pending.splice(0);
 			if (late.length === 0) break;
+			initial.push(...late);
 			batchText = [batchText, ...late.map(b => b.text)].join("\n\n");
 			rawMessages = rawMessages.concat(late.flatMap(b => b.rawMessages));
 			turns += late.reduce((sum, b) => sum + b.turns, 0);
@@ -814,10 +853,12 @@ export class AdvisorRuntime {
 	}
 
 	async #drain(): Promise<void> {
-		if (this.#busy) return;
+		if (this.#busy || this.#sessionTransitionPaused) return;
 		this.#busy = true;
 		try {
-			while (!this.disposed && this.#pending.length) {
+			this.#syncModelIdentity();
+			while (!this.disposed && !this.#sessionTransitionPaused && this.#pending.length) {
+				this.#syncModelIdentity();
 				let popped: PendingDelta[];
 				if (this.#pending[0]?.overflowRecovery) {
 					const recovery = this.#pending.shift();
@@ -826,6 +867,8 @@ export class AdvisorRuntime {
 				} else {
 					popped = this.#pending.splice(0);
 				}
+				const iterationAbort = new AbortController();
+				this.#iterationAbort = iterationAbort;
 				const epoch = this.#epoch;
 				for (const delta of popped) {
 					if (delta.renderRevision === this.#renderRevision) continue;
@@ -834,10 +877,19 @@ export class AdvisorRuntime {
 					delta.renderRevision = this.#renderRevision;
 				}
 				const recoveringOverflow = popped.some(delta => delta.overflowRecovery === true);
-				const result = await this.#collectAndMaintainBatch(epoch, popped, recoveringOverflow);
+				const result = await this.#collectAndMaintainBatch(
+					epoch,
+					popped,
+					recoveringOverflow,
+					iterationAbort.signal,
+				);
 
 				// Epoch was invalidated during batch collection; restart the loop.
 				if (result === null) continue;
+				if (this.#sessionTransitionPaused) {
+					this.#pending.unshift(...popped);
+					continue;
+				}
 
 				const { batch, rawMessages, finalTurns, wip, resetContext } = result;
 
@@ -859,7 +911,13 @@ export class AdvisorRuntime {
 					// Reset the host's per-update advisor state (one-advise-per-update
 					// gate) before each model cycle so the new batch starts fresh.
 					this.host.beginAdvisorUpdate?.();
-					await this.agent.prompt(batch);
+					const prompt = this.agent.prompt(batch);
+					this.#promptInFlight = prompt;
+					try {
+						await prompt;
+					} finally {
+						if (this.#promptInFlight === prompt) this.#promptInFlight = undefined;
+					}
 					// Agent.#runLoop catches provider/stream failures internally and
 					// resolves prompt() cleanly with stopReason: "error". Treat that
 					// as a failed turn so endpoint rejections trip the retry path.
@@ -880,12 +938,17 @@ export class AdvisorRuntime {
 					this.#consecutiveQuarantines = 0;
 					if (this.host.onTurnSuccess) {
 						try {
-							await this.host.onTurnSuccess();
+							await raceWithSignal(Promise.resolve(this.host.onTurnSuccess()), iterationAbort.signal);
 						} catch (hookErr) {
 							logger.debug("advisor onTurnSuccess hook failed", { err: String(hookErr) });
 						}
 					}
 				} catch (err) {
+					if (this.#sessionTransitionPaused) {
+						this.#rollbackFailedTurn(messageSnapshot);
+						this.#pending.unshift(...popped);
+						continue;
+					}
 					// reset()/dispose() aborts the in-flight prompt; treat it as a
 					// reset, not a transient failure — drop the stale batch.
 					if (this.#epoch !== epoch) continue;
@@ -897,6 +960,9 @@ export class AdvisorRuntime {
 					this.#wakeAllWaiters();
 					const failedMessages = this.agent.state.messages.slice(messageSnapshot);
 					const terminalFailure = this.#terminalAssistantFailure(messageSnapshot);
+					const classifierRefusal =
+						(terminalFailure !== undefined && isClassifierRefusal(terminalFailure)) ||
+						AIError.is(AIError.classify(err), AIError.Flag.ContentBlocked);
 					const terminalFailureId =
 						terminalFailure === undefined ? undefined : AIError.classifyMessage(terminalFailure);
 					const contextOverflow =
@@ -912,12 +978,43 @@ export class AdvisorRuntime {
 						AIError.is(terminalFailureId, AIError.Flag.ContextOverflow);
 					this.#rollbackFailedTurn(messageSnapshot);
 					logger.debug("advisor turn failed", { err: String(err) });
+					if (classifierRefusal) {
+						if (this.#includeThinking) {
+							this.#includeThinking = false;
+							const strippedBatch = this.#formatRawDelta(rawMessages, wip);
+							if (strippedBatch) {
+								this.#pending.unshift({
+									text: strippedBatch,
+									rawMessages,
+									renderRevision: this.#renderRevision,
+									turns: finalTurns,
+									wip,
+									overflowRecovery: recoveringOverflow || undefined,
+								});
+								logger.debug("advisor refusal recovered by stripping primary reasoning");
+								continue;
+							}
+						}
+						this.#notifyFailureOnce(err);
+						this.#clearSeenContext();
+						this.#backlog = Math.max(0, this.#backlog - finalTurns);
+						this.#notifyWaiters();
+						continue;
+					}
 					let recovered = false;
 					try {
-						recovered = (await this.host.onTurnError?.(err, failedMessages)) === true;
+						recovered =
+							(await raceWithSignal(
+								Promise.resolve(this.host.onTurnError?.(err, failedMessages, iterationAbort.signal)),
+								iterationAbort.signal,
+							)) === true;
 					} catch (hookErr) {
 						logger.debug("advisor onTurnError hook failed", { err: String(hookErr) });
 					}
+					if (this.#sessionTransitionPaused) {
+						this.#pending.unshift(...popped);
+						continue;
+					}
 					if (err instanceof AdvisorOutputQuarantinedError) {
 						// A quarantine discards the advisor's whole turn before dispatch, so
 						// its advice never reaches the primary. One re-prime is allowed to
@@ -1032,7 +1129,15 @@ export class AdvisorRuntime {
 								wip,
 								overflowRecovery: recoveringOverflow || undefined,
 							});
-							await Bun.sleep(this.retryDelayMs);
+							if (this.retryDelayMs <= 0) {
+								await Bun.sleep(0);
+							} else {
+								try {
+									await raceWithSignal(Bun.sleep(this.retryDelayMs), iterationAbort.signal);
+								} catch (sleepError) {
+									if (!iterationAbort.signal.aborted) throw sleepError;
+								}
+							}
 						}
 					}
 				}
@@ -1043,11 +1148,20 @@ export class AdvisorRuntime {
 				}
 			}
 		} finally {
+			this.#iterationAbort = undefined;
 			this.#busy = false;
 		}
 	}
 }
 
+/** Mirrors turn recovery's refusal classification and retains AIError's provider-neutral content-block fallback. */
+function isClassifierRefusal(message: AssistantMessage): boolean {
+	if (message.stopReason !== "error") return false;
+	const stopType = message.stopDetails?.type;
+	if (stopType === "refusal" || stopType === "sensitive") return true;
+	return AIError.is(AIError.classifyMessage(message), AIError.Flag.ContentBlocked);
+}
+
 /**
  * The only malformed advisor turn shape: the prompt resolved but produced no
  * assistant response at all. Everything an assistant message carries — advice,