@pentoshi/clai 1.2.6 → 1.2.7

package/dist/agent/runner.js

@@ -16,7 +16,7 @@ import { auditLog } from "../store/logs.js";
 import { loadProjectContext } from "../store/project.js";
 import { loadScope, isScopeActive, targetInScope } from "../store/scope.js";
 import { ensureProviderConfigured } from "../commands/providers.js";
-import { rememberThinkingFromText, renderThinkingSummary, } from "../ui/thinking.js";
+import { createThinkingStreamParser, rememberThinkingFromText, renderThinkingSummary, } from "../ui/thinking.js";
 import { renderMarkdown, indentAndWrapText } from "../ui/markdown.js";
 import { startThinkingSpinner } from "../ui/spinner.js";
 import { safeCwd } from "../os/cwd.js";
@@ -740,7 +740,7 @@ const PRE_APPROVAL_ALLOWED_TOOLS = new Set([
 export function isPreApprovalAllowedTool(name) {
     return PRE_APPROVAL_ALLOWED_TOOLS.has(name);
 }
-function styleToolChatter(call, text) {
+export function styleToolChatter(call, text) {
     return shouldDimToolChatter(call) ? chalk.dim(text) : text;
 }
 function isAbortError(error, signal) {
@@ -819,7 +819,21 @@ function formatToolContext(call, result) {
         : "";
     return `${summary.text}${saved}`.trim();
 }
-async function ensurePentestAuthorization(call, autoConfirm, session) {
+const inquirerConfirmPort = {
+    async confirmTool(call) {
+        return confirm({
+            message: chalk.yellow(`  run ${call.name}: ${formatToolArgs(call)}?`),
+            default: true,
+        });
+    },
+    async confirmPentest() {
+        return confirm({
+            message: chalk.red("clai only assists with security testing on systems you own or have written permission to test. Confirm for this session?"),
+            default: false,
+        });
+    },
+};
+async function ensurePentestAuthorization(call, autoConfirm, session, confirmPort) {
     if (!isPentestToolCall(call))
         return true;
     // Persistent auth (via `clai authorize-pentest AGREE`) wins.
@@ -834,16 +848,13 @@ async function ensurePentestAuthorization(call, autoConfirm, session) {
         session.pentestAuthorized.value = true;
         return true;
     }
-    const ok = await confirm({
-        message: chalk.red("clai only assists with security testing on systems you own or have written permission to test. Confirm for this session?"),
-        default: false,
-    });
+    const ok = await confirmPort.confirmPentest();
     if (!ok)
         return false;
     session.pentestAuthorized.value = true;
     return true;
 }
-async function confirmToolExecution(call, autoConfirm, session) {
+async function confirmToolExecution(call, autoConfirm, session, confirmPort) {
     const config = getConfig();
     if (autoConfirm)
         return true;
@@ -854,10 +865,7 @@ async function confirmToolExecution(call, autoConfirm, session) {
     // set so authorizations never leak across processes.
     if (config.allowAlwaysTools.includes(call.name))
         return true;
-    return confirm({
-        message: chalk.yellow(`  run ${call.name}: ${formatToolArgs(call)}?`),
-        default: true,
-    });
+    return confirmPort.confirmTool(call);
 }
 /** Build the system-context block describing the session's active plan. */
 function planContextMessage(plan, approved) {
@@ -950,6 +958,7 @@ async function handlePlanTool(call, session, ctx) {
         return {
             handled: true,
             ok: true,
+            plan,
             display,
             modelNote: `Plan saved with ${plan.tasks.length} task(s). STOP here and wait — produce NO other tool calls now. ` +
                 "Do NOT start executing tasks until the user approves with /implement. " +
@@ -1008,6 +1017,7 @@ async function handlePlanTool(call, session, ctx) {
     return {
         handled: true,
         ok: true,
+        plan,
         display: checklist + "\n",
         modelNote: allDone
             ? "Task updated. ALL tasks are now finished. Verify the result and give your final summary."
@@ -1015,8 +1025,89 @@ async function handlePlanTool(call, session, ctx) {
     };
 }
 export async function runAgentLoop(prompt, options = {}) {
+    const writesDirectly = !options.onEvent;
+    const emit = (event) => options.onEvent?.(event);
+    const noopSpinner = {
+        setLabel: () => { },
+        bumpReasoning: () => { },
+        pushPreview: () => { },
+        stop: () => { },
+    };
+    const writeStatus = (text, rendered = chalk.dim(text)) => {
+        emit({ type: "status", text });
+        if (writesDirectly)
+            process.stdout.write(rendered);
+    };
+    const writeNotice = (level, text, rendered) => {
+        emit({ type: "notice", level, text });
+        if (writesDirectly)
+            process.stdout.write(rendered);
+    };
+    const writeAssistantMessage = (text) => {
+        emit({ type: "assistant-message", text });
+        const rendered = renderMarkdown(text);
+        if (writesDirectly) {
+            process.stdout.write(text.endsWith("\n") ? rendered : `${rendered}\n`);
+        }
+    };
+    const writeThinkingBlock = (content) => {
+        emit({ type: "thinking-block", content });
+        if (writesDirectly)
+            process.stdout.write(`${renderThinkingSummary(content)}\n`);
+    };
+    const writeToolOutput = (id, chunk, rendered) => {
+        emit({ type: "tool-output", id, chunk });
+        if (writesDirectly)
+            process.stdout.write(rendered);
+    };
+    const writeToolCall = (id, call, rendered) => {
+        emit({
+            type: "tool-call",
+            id,
+            name: call.name,
+            argsDisplay: formatToolArgs(call),
+        });
+        if (writesDirectly)
+            process.stdout.write(rendered);
+    };
+    const writePlanUpdate = (plan, rendered) => {
+        emit({ type: "plan-update", plan });
+        if (writesDirectly)
+            process.stdout.write(rendered);
+    };
+    const writeToolBlocked = (id, name, reason, rendered) => {
+        emit({ type: "tool-blocked", id, name, reason });
+        if (writesDirectly)
+            process.stdout.write(rendered);
+    };
+    const writeAbort = () => {
+        emit({ type: "turn-aborted" });
+        if (writesDirectly)
+            process.stdout.write(chalk.yellow("  ⏹ Aborted.\n"));
+    };
+    const emitToolResult = (id, result, summary, artifactPath) => {
+        const event = {
+            type: "tool-result",
+            id,
+            ok: result.ok,
+            summary,
+        };
+        if (typeof result.exitCode === "number") {
+            event.exitCode = result.exitCode;
+        }
+        if (artifactPath) {
+            event.artifactPath = artifactPath;
+        }
+        emit(event);
+    };
+    const finishTurn = (answer, steps) => {
+        emit({ type: "turn-end", finalAnswer: answer, steps });
+        return answer;
+    };
+    emit({ type: "turn-start", prompt });
     const config = getConfig();
     const maxSteps = options.maxSteps ?? 70;
+    const confirmPort = options.confirm ?? inquirerConfirmPort;
     const projectContext = await loadProjectContext();
     const toolNames = availableToolNames();
     // Build / scaffold / continuation turns must NEVER be diverted into a
@@ -1157,6 +1248,7 @@ export async function runAgentLoop(prompt, options = {}) {
     const maxIterations = stepBudget * 3;
     let productiveSteps = 0;
     let step = -1;
+    let nextToolEventId = 0;
     for (let iteration = 0; iteration < maxIterations; iteration += 1) {
         // `step` is the productive-step index (used for display + audit). It only
         // advances when the previous iteration actually executed a tool.
@@ -1175,16 +1267,33 @@ export async function runAgentLoop(prompt, options = {}) {
             // when the batch was parsed.
             call = pendingCalls.shift();
             assistantText = { visible: "", thinkContent: "", hasThinking: false };
-            process.stdout.write(chalk.dim(`  ↳ continuing batch (${pendingCalls.length} more queued)\n`));
+            const batchStatus = `  ↳ continuing batch (${pendingCalls.length} more queued)\n`;
+            writeStatus(batchStatus, chalk.dim(batchStatus));
         }
         else {
             // Buffer LLM output so tool JSON and hidden thinking are not printed raw.
             // Status messages (rate-limit retries, fallback hints) still surface live.
             // A spinner gives the user feedback during long thinking phases on
             // models like glm-5.1 / deepseek-v4-flash that stream reasoning first.
-            const spinner = startThinkingSpinner(step === 0 ? "waiting for model" : `step ${step + 1}`, options.signal);
+            const streamLabel = step === 0 ? "waiting for model" : `step ${step + 1}`;
+            const spinner = writesDirectly
+                ? startThinkingSpinner(streamLabel, options.signal)
+                : noopSpinner;
+            if (!writesDirectly) {
+                emit({ type: "status", text: streamLabel });
+            }
             let sawReasoning = false;
             let inThinking = false;
+            let emittedThinkingStatus = false;
+            const deltaParser = writesDirectly
+                ? undefined
+                : createThinkingStreamParser((text) => emit({ type: "assistant-delta", text }), (text) => {
+                    if (!emittedThinkingStatus) {
+                        emittedThinkingStatus = true;
+                        emit({ type: "status", text: "thinking" });
+                    }
+                    emit({ type: "thinking-delta", text });
+                });
             let completion;
             try {
                 completion = await streamWithProvider({
@@ -1203,6 +1312,7 @@ export async function runAgentLoop(prompt, options = {}) {
                     signal: options.signal,
                     thinking: config.thinking,
                 }, (token) => {
+                    deltaParser?.push(token);
                     // Heuristic: <think>… markers and reasoning_content tokens flow
                     // through onToken. Surface activity in the spinner so the screen
                     // is never empty for minutes.
@@ -1210,6 +1320,8 @@ export async function runAgentLoop(prompt, options = {}) {
                         sawReasoning = true;
                         inThinking = true;
                         spinner.setLabel("thinking");
+                        if (!writesDirectly)
+                            emit({ type: "status", text: "thinking" });
                     }
                     if (/<\/think>/i.test(token)) {
                         inThinking = false;
@@ -1230,7 +1342,7 @@ export async function runAgentLoop(prompt, options = {}) {
                     }
                 }, (status) => {
                     spinner.stop();
-                    process.stdout.write(chalk.dim(status));
+                    writeStatus(status, chalk.dim(status));
                 });
             }
             finally {
@@ -1239,6 +1351,7 @@ export async function runAgentLoop(prompt, options = {}) {
             }
             provider = completion.provider;
             model = completion.model;
+            deltaParser?.finish();
             const assistantTextResult = rememberThinkingFromText(completion.text);
             assistantText = assistantTextResult;
             // Try visible text first, then thinking content — some models (e.g. glm-5.1)
@@ -1253,7 +1366,7 @@ export async function runAgentLoop(prompt, options = {}) {
                     strict: getConfig().parserStrict,
                 });
                 if (call) {
-                    process.stdout.write(chalk.dim("  ℹ recovered tool call from thinking content\n"));
+                    writeNotice("info", "recovered tool call from thinking content", chalk.dim("  ℹ recovered tool call from thinking content\n"));
                 }
             }
             // ── Thinking-only recovery ────────────────────────────────────────
@@ -1264,8 +1377,8 @@ export async function runAgentLoop(prompt, options = {}) {
             if (!assistantText.visible.trim() && !call && assistantText.hasThinking) {
                 emptyVisibleRetries += 1;
                 if (emptyVisibleRetries <= 2) {
-                    process.stdout.write(`${renderThinkingSummary(assistantText.thinkContent)}\n`);
-                    process.stdout.write(chalk.yellow("  ⚠ model produced only thinking — nudging it to take action\n"));
+                    writeThinkingBlock(assistantText.thinkContent);
+                    writeNotice("warn", "model produced only thinking — nudging it to take action", chalk.yellow("  ⚠ model produced only thinking — nudging it to take action\n"));
                     messages.push({
                         role: "assistant",
                         content: collapseRepeatedText(completion.text),
@@ -1304,7 +1417,7 @@ export async function runAgentLoop(prompt, options = {}) {
                 if (bare?.call) {
                     call = bare.call;
                     recoveredFromBareJson = true;
-                    process.stdout.write(chalk.dim("  ℹ recovered an unfenced tool call from bare JSON\n"));
+                    writeNotice("info", "recovered an unfenced tool call from bare JSON", chalk.dim("  ℹ recovered an unfenced tool call from bare JSON\n"));
                 }
                 else if (bare?.argsOnly) {
                     bareArgsOnly = true;
@@ -1316,7 +1429,7 @@ export async function runAgentLoop(prompt, options = {}) {
                 if (bareThink?.call) {
                     call = bareThink.call;
                     recoveredFromBareJson = true;
-                    process.stdout.write(chalk.dim("  ℹ recovered an unfenced tool call from thinking content\n"));
+                    writeNotice("info", "recovered an unfenced tool call from thinking content", chalk.dim("  ℹ recovered an unfenced tool call from thinking content\n"));
                 }
                 else if (bareThink?.argsOnly) {
                     bareArgsOnly = true;
@@ -1326,7 +1439,7 @@ export async function runAgentLoop(prompt, options = {}) {
                 if (bareArgsOnly) {
                     bareToolJsonRetries += 1;
                     if (bareToolJsonRetries <= 3) {
-                        process.stdout.write(chalk.yellow("  ⚠ tool call missing its name/fence — asking the model to re-emit a proper ```tool block\n"));
+                        writeNotice("warn", "tool call missing its name/fence — asking the model to re-emit a proper ```tool block", chalk.yellow("  ⚠ tool call missing its name/fence — asking the model to re-emit a proper ```tool block\n"));
                         messages.push({ role: "assistant", content: assistantText.visible });
                         messages.push(recoveryUserMessage(buildLikeTurn && !activePlan
                             ? "Your previous message was a bare JSON args object with no tool name and no ```tool fence, so NOTHING ran. " +
@@ -1348,7 +1461,7 @@ export async function runAgentLoop(prompt, options = {}) {
                 // raw tokens looks like a crash to the user — instead, ask the
                 // model to retry the tool call in a clean JSON format.
                 if (/<\|tool_call(?:s_section)?_begin\|>|<\|tool_call_argument_begin\|>/i.test(assistantText.visible)) {
-                    process.stdout.write(chalk.yellow("  ⚠ tool call was malformed or cut off — asking the model to retry in JSON form\n"));
+                    writeNotice("warn", "tool call was malformed or cut off — asking the model to retry in JSON form", chalk.yellow("  ⚠ tool call was malformed or cut off — asking the model to retry in JSON form\n"));
                     messages.push({ role: "assistant", content: assistantText.visible });
                     messages.push(recoveryUserMessage("Your previous tool call was malformed or truncated. " +
                         "Reply with ONLY a fenced ```tool block containing valid JSON " +
@@ -1363,7 +1476,7 @@ export async function runAgentLoop(prompt, options = {}) {
                 if (looksLikeTruncatedToolCall(assistantText.visible)) {
                     truncatedToolRetries += 1;
                     if (truncatedToolRetries <= 3) {
-                        process.stdout.write(chalk.yellow("  ⚠ tool call was cut off (output too long) — asking the model to retry in smaller pieces\n"));
+                        writeNotice("warn", "tool call was cut off (output too long) — asking the model to retry in smaller pieces", chalk.yellow("  ⚠ tool call was cut off (output too long) — asking the model to retry in smaller pieces\n"));
                         messages.push({ role: "assistant", content: assistantText.visible });
                         messages.push({
                             role: "user",
@@ -1390,7 +1503,7 @@ export async function runAgentLoop(prompt, options = {}) {
                 if (hasFencedCallShape) {
                     malformedFenceRetries += 1;
                     if (malformedFenceRetries <= 3) {
-                        process.stdout.write(chalk.yellow("  ⚠ tool block present but its JSON didn't parse — asking the model to re-emit valid JSON\n"));
+                        writeNotice("warn", "tool block present but its JSON didn't parse — asking the model to re-emit valid JSON", chalk.yellow("  ⚠ tool block present but its JSON didn't parse — asking the model to re-emit valid JSON\n"));
                         messages.push({ role: "assistant", content: assistantText.visible });
                         messages.push({
                             role: "user",
@@ -1427,7 +1540,7 @@ export async function runAgentLoop(prompt, options = {}) {
                     if (activePlan && session.planApproved.value) {
                         nudge =
                             "You wrote a message but emitted NO ```tool block, so NOTHING ran. Do NOT narrate what you will do — DO it. Emit the next tool call now (task.update / fs.writeMany / shell.exec) in a single ```tool block.";
-                        process.stdout.write(chalk.yellow("  ⚠ described an action but emitted no tool call — nudging it to run one\n"));
+                        writeNotice("warn", "described an action but emitted no tool call — nudging it to run one", chalk.yellow("  ⚠ described an action but emitted no tool call — nudging it to run one\n"));
                     }
                     else if (planNarrated || productiveSteps > 0) {
                         // It explored and/or wrote a plan as prose but never called
@@ -1437,14 +1550,14 @@ export async function runAgentLoop(prompt, options = {}) {
                             "You wrote the plan as PROSE but did NOT call plan.create, so no plan was saved and the user cannot /implement it. Emit it as a real tool call NOW — exactly one ```tool block:\n" +
                                 '```tool\n{"name":"plan.create","args":{"goal":"<short goal>","detail":"<stack/approach and how you\'ll verify>","tasks":["task 1","task 2","task 3"],"kind":"coding"}}\n```\n' +
                                 "Do not describe the plan again in prose — just emit the plan.create tool block.";
-                        process.stdout.write(chalk.yellow("  ⚠ plan was written as text, not created — nudging it to call plan.create\n"));
+                        writeNotice("warn", "plan was written as text, not created — nudging it to call plan.create", chalk.yellow("  ⚠ plan was written as text, not created — nudging it to call plan.create\n"));
                     }
                     else {
                         nudge =
                             "You described what you will do but emitted NO ```tool block, so NOTHING actually happened — narration is not action. Emit a real tool call NOW. For this build task, explore first like this:\n" +
                                 '```tool\n{"name":"fs.list","args":{"path":"."}}\n```\n' +
                                 "Then read key files, and once you understand the directory, call plan.create. Every turn MUST contain a ```tool block until the task is done.";
-                        process.stdout.write(chalk.yellow("  ⚠ described an action but emitted no tool call — nudging it to run one\n"));
+                        writeNotice("warn", "described an action but emitted no tool call — nudging it to run one", chalk.yellow("  ⚠ described an action but emitted no tool call — nudging it to run one\n"));
                     }
                     messages.push({ role: "assistant", content: assistantText.visible });
                     messages.push(recoveryUserMessage(nudge));
@@ -1452,7 +1565,7 @@ export async function runAgentLoop(prompt, options = {}) {
                 }
                 if (freshWebSearchRequired && !sawFreshWebSearch && !freshnessRetryUsed) {
                     freshnessRetryUsed = true;
-                    process.stdout.write(chalk.dim("  ℹ current-info question detected — searching the web before answering\n"));
+                    writeNotice("info", "current-info question detected — searching the web before answering", chalk.dim("  ℹ current-info question detected — searching the web before answering\n"));
                     messages.push({ role: "assistant", content: assistantText.visible });
                     messages.push({
                         role: "user",
@@ -1473,7 +1586,7 @@ export async function runAgentLoop(prompt, options = {}) {
                     if (livePlan && unfinished && unfinished.length > 0) {
                         prematureCompletionRetries += 1;
                         const next = unfinished[0];
-                        process.stdout.write(chalk.yellow(`  ⚠ ${unfinished.length} plan task(s) still unfinished — not accepting a "done" claim; resuming execution\n`));
+                        writeNotice("warn", `${unfinished.length} plan task(s) still unfinished — not accepting a "done" claim; resuming execution`, chalk.yellow(`  ⚠ ${unfinished.length} plan task(s) still unfinished — not accepting a "done" claim; resuming execution\n`));
                         messages.push({ role: "assistant", content: assistantText.visible });
                         messages.push({
                             role: "user",
@@ -1493,10 +1606,14 @@ export async function runAgentLoop(prompt, options = {}) {
                 // unchallenged — append an explicit, honest status so the user knows the
                 // build did not actually complete.
                 let completionWarning = "";
+                let completionWarningText = "";
                 if (session.planApproved.value) {
                     const livePlan = await loadPlan(session.sessionId).catch(() => undefined);
                     const unfinished = livePlan?.tasks.filter((t) => t.state === "pending" || t.state === "in_progress");
                     if (livePlan && unfinished && unfinished.length > 0) {
+                        completionWarningText =
+                            `${unfinished.length} of ${livePlan.tasks.length} plan task(s) are NOT actually complete. ` +
+                                "The summary above may overstate progress.";
                         completionWarning =
                             chalk.yellow(`\n  ⚠ ${unfinished.length} of ${livePlan.tasks.length} plan task(s) are NOT actually complete:\n`) +
                                 unfinished
@@ -1506,19 +1623,17 @@ export async function runAgentLoop(prompt, options = {}) {
                     }
                 }
                 if (cleaned) {
-                    process.stdout.write(renderMarkdown(cleaned));
-                    if (!cleaned.endsWith("\n"))
-                        process.stdout.write("\n");
+                    writeAssistantMessage(cleaned);
                 }
                 if (completionWarning) {
-                    process.stdout.write(completionWarning);
+                    writeNotice("warn", completionWarningText, completionWarning);
                 }
                 if (assistantText.hasThinking) {
-                    process.stdout.write(`${renderThinkingSummary(assistantText.thinkContent)}\n`);
+                    writeThinkingBlock(assistantText.thinkContent);
                 }
                 await auditLog("agent.final", { provider, model, steps: step + 1 });
                 lastAnswer = cleaned;
-                return lastAnswer;
+                return finishTurn(lastAnswer, step + 1);
             }
             // A valid primary tool call exists for this fresh model turn. Show any
             // prose / thinking that preceded it, record the assistant message ONCE,
@@ -1528,10 +1643,10 @@ export async function runAgentLoop(prompt, options = {}) {
                 ? ""
                 : textBeforeToolCall(assistantText.visible);
             if (beforeTool) {
-                process.stdout.write(renderMarkdown(beforeTool) + "\n");
+                writeAssistantMessage(beforeTool);
             }
             if (assistantText.hasThinking) {
-                process.stdout.write(`${renderThinkingSummary(assistantText.thinkContent)}\n`);
+                writeThinkingBlock(assistantText.thinkContent);
             }
             messages.push({
                 role: "assistant",
@@ -1543,7 +1658,7 @@ export async function runAgentLoop(prompt, options = {}) {
                     allCalls[0] &&
                     sameToolCall(allCalls[0], call)) {
                     pendingCalls = allCalls.slice(1);
-                    process.stdout.write(chalk.dim(`  ℹ ${allCalls.length} tool calls in this message — running them in order\n`));
+                    writeNotice("info", `${allCalls.length} tool calls in this message — running them in order`, chalk.dim(`  ℹ ${allCalls.length} tool calls in this message — running them in order\n`));
                 }
             }
         }
@@ -1556,6 +1671,7 @@ export async function runAgentLoop(prompt, options = {}) {
         // runs and is safety-classified as the shell command it really is —
         // instead of dead-ending on "Unknown tool: sed".
         call = normalizeToolCall(call);
+        const toolEventId = `tool-${++nextToolEventId}`;
         // ── Duplicate-call detection ──────────────────────────────────────────
         // If the model calls the exact same tool with the exact same args
         // repeatedly, it's stuck in a loop. Inject a corrective message
@@ -1565,7 +1681,8 @@ export async function runAgentLoop(prompt, options = {}) {
             const isWrite = call.name === "fs.write" ||
                 call.name === "fs.writeMany" ||
                 call.name === "fs.edit";
-            process.stdout.write(chalk.yellow(`  ⚠ ${call.name} was already called with the same arguments — ${isWrite ? "moving on" : "forcing summary"}\n`));
+            const reason = `${call.name} was already called with the same arguments — ${isWrite ? "moving on" : "forcing summary"}`;
+            writeNotice("warn", reason, chalk.yellow(`  ⚠ ${call.name} was already called with the same arguments — ${isWrite ? "moving on" : "forcing summary"}\n`));
             // A repeat means this batch went off the rails — drop any queued calls
             // and let the model react. The assistant message was already recorded.
             pendingCalls = [];
@@ -1581,7 +1698,7 @@ export async function runAgentLoop(prompt, options = {}) {
             continue;
         }
         if (loopCheck.reason) {
-            process.stdout.write(chalk.dim(`  ℹ ${loopCheck.reason}\n`));
+            writeNotice("info", loopCheck.reason, chalk.dim(`  ℹ ${loopCheck.reason}\n`));
         }
         // ── Plan / task tools (session-scoped, handled inline) ─────────────
         // These don't go through the generic registry because they need the
@@ -1594,7 +1711,9 @@ export async function runAgentLoop(prompt, options = {}) {
             if (planResult.handled) {
                 productiveSteps += 1;
                 loopGuard.recordAttempt(step, call.name, call.args, planResult.ok, 0);
-                process.stdout.write(planResult.display);
+                if (planResult.plan) {
+                    writePlanUpdate(planResult.plan, planResult.display);
+                }
                 // plan.create means "STOP and wait for /implement" — abandon any
                 // other calls the model batched alongside it.
                 if (call.name === "plan.create")
@@ -1625,7 +1744,8 @@ export async function runAgentLoop(prompt, options = {}) {
         if (activePlan &&
             !session.planApproved.value &&
             !isPreApprovalAllowedTool(call.name)) {
-            process.stdout.write(chalk.yellow(`  ⚠ plan awaiting approval — ${call.name} is blocked until you /implement (or /discard)\n`));
+            const reason = `plan awaiting approval — ${call.name} is blocked until you /implement (or /discard)`;
+            writeNotice("warn", reason, chalk.yellow(`  ⚠ plan awaiting approval — ${call.name} is blocked until you /implement (or /discard)\n`));
             pendingCalls = [];
             messages.push({
                 role: "user",
@@ -1642,23 +1762,23 @@ export async function runAgentLoop(prompt, options = {}) {
         }
         // Show tool call
         const toolCallLine = chalk.cyan(`  ▶ ${call.name}`) + chalk.gray(` ${formatToolArgs(call)}`);
-        process.stdout.write(styleToolChatter(call, toolCallLine) + "\n");
+        writeToolCall(toolEventId, call, styleToolChatter(call, toolCallLine) + "\n");
         const scopeTarget = scopeTargetForToolCall(call);
         if (scopeTarget &&
             (!isScopeActive(scope) || !targetInScope(scopeTarget, scope))) {
-            process.stdout.write(chalk.dim(`  scope optional: ${scopeHint(scopeTarget)}\n`));
+            writeNotice("info", `scope optional: ${scopeHint(scopeTarget)}`, chalk.dim(`  scope optional: ${scopeHint(scopeTarget)}\n`));
         }
         if (decision.level === "block") {
-            process.stdout.write(chalk.red(`  ✗ blocked: ${decision.reason}`) + "\n");
+            writeToolBlocked(toolEventId, call.name, decision.reason, chalk.red(`  ✗ blocked: ${decision.reason}`) + "\n");
             lastAnswer = `Blocked: ${call.name} — ${decision.reason}`;
-            return lastAnswer;
+            return finishTurn(lastAnswer, productiveSteps);
         }
         // Pentest authorization — if user confirms this, skip the per-tool confirm
         let pentestJustConfirmed = false;
         const needsPentestAuth = isPentestToolCall(call) &&
             !getConfig().pentestAuthorized &&
             !session.pentestAuthorized.value;
-        const authorized = await ensurePentestAuthorization(call, Boolean(options.autoConfirm), session);
+        const authorized = await ensurePentestAuthorization(call, Boolean(options.autoConfirm), session, confirmPort);
         // inquirer's confirm() creates its own readline interface which resets
         // raw mode AND pauses stdin when it finishes. Re-assert raw mode and
         // resume stdin so the outer keypress handler (ESC/Ctrl+C abort, Ctrl+O
@@ -1666,8 +1786,8 @@ export async function runAgentLoop(prompt, options = {}) {
         restoreInteractiveStdin();
         if (!authorized) {
             lastAnswer = "Pentest authorization not confirmed.";
-            process.stdout.write(chalk.red(`  ✗ ${lastAnswer}`) + "\n");
-            return lastAnswer;
+            writeToolBlocked(toolEventId, call.name, lastAnswer, chalk.red(`  ✗ ${lastAnswer}`) + "\n");
+            return finishTurn(lastAnswer, productiveSteps);
         }
         if (needsPentestAuth) {
             pentestJustConfirmed = true;
@@ -1676,14 +1796,14 @@ export async function runAgentLoop(prompt, options = {}) {
         // fs.delete and shell deletions NEVER auto-confirm even with -y flag.
         const forceManualConfirm = call.name === "fs.delete";
         if (decision.level === "confirm" && !pentestJustConfirmed) {
-            const ok = await confirmToolExecution(call, forceManualConfirm ? false : Boolean(options.autoConfirm), session);
+            const ok = await confirmToolExecution(call, forceManualConfirm ? false : Boolean(options.autoConfirm), session, confirmPort);
             // Re-assert raw mode and resume stdin after inquirer's confirm()
             // (see restoreInteractiveStdin / the comment above).
             restoreInteractiveStdin();
             if (!ok) {
                 lastAnswer = "Cancelled.";
-                process.stdout.write(chalk.yellow(`  ✗ cancelled`) + "\n");
-                return lastAnswer;
+                writeNotice("warn", "cancelled", chalk.yellow(`  ✗ cancelled`) + "\n");
+                return finishTurn(lastAnswer, productiveSteps);
             }
         }
         // Execute tool
@@ -1697,7 +1817,7 @@ export async function runAgentLoop(prompt, options = {}) {
             typeof call.args.command === "string" &&
             looksInteractiveStdin(call.args.command);
         if (interactiveCommand && process.stdin.isTTY) {
-            process.stdout.write(chalk.yellow("  ⚠ this command may prompt for a password — type it when asked\n"));
+            writeNotice("warn", "this command may prompt for a password — type it when asked", chalk.yellow("  ⚠ this command may prompt for a password — type it when asked\n"));
         }
         let result;
         let liveBytes = 0;
@@ -1721,8 +1841,8 @@ export async function runAgentLoop(prompt, options = {}) {
             if (liveBytes >= liveCap) {
                 if (!liveTruncatedNotified) {
                     liveTruncatedNotified = true;
-                    process.stdout.write(chalk.dim("\n  … live preview truncated, full output saved\n"));
-                    process.stdout.write(chalk.dim("  (tool still running — ESC or Ctrl+C to abort)\n"));
+                    writeNotice("info", "live preview truncated, full output saved", chalk.dim("\n  … live preview truncated, full output saved\n"));
+                    writeNotice("info", "tool still running — ESC or Ctrl+C to abort", chalk.dim("  (tool still running — ESC or Ctrl+C to abort)\n"));
                     lastProgressAt = Date.now();
                 }
                 // After truncation, show a dot every 5 seconds so the user knows
@@ -1730,7 +1850,7 @@ export async function runAgentLoop(prompt, options = {}) {
                 const now = Date.now();
                 if (now - lastProgressAt > 5_000) {
                     lastProgressAt = now;
-                    process.stdout.write(chalk.dim("."));
+                    writeToolOutput(toolEventId, ".", chalk.dim("."));
                 }
                 return;
             }
@@ -1743,7 +1863,7 @@ export async function runAgentLoop(prompt, options = {}) {
             // Skip the dim wrapper for interactive commands so a sudo password
             // prompt is rendered at full brightness; everything else stays dim
             // so tool chatter is visually distinct from the model's prose.
-            process.stdout.write(shouldDimLive ? chalk.dim(body) : body);
+            writeToolOutput(toolEventId, slice, shouldDimLive ? chalk.dim(body) : body);
         };
         try {
             result = await runToolCall(call, {
@@ -1755,13 +1875,14 @@ export async function runAgentLoop(prompt, options = {}) {
                 },
             });
             // Newline separator if live output or progress dots didn't already end with one.
-            if (liveBytes > 0 || liveTruncatedNotified)
-                process.stdout.write("\n");
+            if (liveBytes > 0 || liveTruncatedNotified) {
+                writeToolOutput(toolEventId, "\n", "\n");
+            }
         }
         catch (toolError) {
             if (isAbortError(toolError, options.signal)) {
                 lastAnswer = "Aborted.";
-                process.stdout.write(chalk.yellow("  ⏹ Aborted.\n"));
+                writeAbort();
                 return lastAnswer;
             }
             const errMsg = toolError instanceof Error ? toolError.message : String(toolError);
@@ -1771,7 +1892,8 @@ export async function runAgentLoop(prompt, options = {}) {
         // from the same message so the model sees the failure and decides what to
         // do next instead of blindly running steps that depended on it.
         if (!result.ok && pendingCalls.length > 0) {
-            process.stdout.write(chalk.dim(`  ↳ ${pendingCalls.length} queued call(s) cancelled because this step failed\n`));
+            const cancelledQueuedStatus = `  ↳ ${pendingCalls.length} queued call(s) cancelled because this step failed\n`;
+            writeStatus(cancelledQueuedStatus, chalk.dim(cancelledQueuedStatus));
             pendingCalls = [];
         }
         const output = result.output.trim();
@@ -1788,6 +1910,8 @@ export async function runAgentLoop(prompt, options = {}) {
             outputPath: savedOutputPath,
             truncated: result.truncated ?? Boolean(savedOutputPath),
         };
+        const contextOutput = formatToolContext(call, resultWithArtifact);
+        emitToolResult(toolEventId, resultWithArtifact, contextOutput, savedOutputPath);
         options.onToolResult?.(call, resultWithArtifact);
         await auditLog("tool.result", {
             call,
@@ -1814,7 +1938,7 @@ export async function runAgentLoop(prompt, options = {}) {
                         ? "tesseract"
                         : undefined;
             if (cmdName) {
-                process.stdout.write(chalk.yellow(`  ⚠ ${cmdName} not found — asking model to install and retry\n`));
+                writeNotice("warn", `${cmdName} not found — asking model to install and retry`, chalk.yellow(`  ⚠ ${cmdName} not found — asking model to install and retry\n`));
                 messages.push({
                     role: "tool",
                     content: `Tool failed: "${cmdName}" is not installed.\n` +
@@ -1832,7 +1956,7 @@ export async function runAgentLoop(prompt, options = {}) {
         // -S / askpass / piping a password.
         const SUDO_NEEDS_TTY_RE = /sudo:\s+a terminal is required to read the password|sudo:\s+a password is required|no askpass program|sudo: \d+ incorrect password attempts|sudo:\s+(?:no tty present|sorry, you must have a tty)/i;
         if (!result.ok && SUDO_NEEDS_TTY_RE.test(output)) {
-            process.stdout.write(chalk.yellow("  ⚠ sudo needs an interactive terminal — asking the model to retry without -S/askpass\n"));
+            writeNotice("warn", "sudo needs an interactive terminal — asking the model to retry without -S/askpass", chalk.yellow("  ⚠ sudo needs an interactive terminal — asking the model to retry without -S/askpass\n"));
             messages.push({
                 role: "tool",
                 content: "Tool failed: sudo could not read a password.\n" +
@@ -1845,7 +1969,7 @@ export async function runAgentLoop(prompt, options = {}) {
         }
         // Print tool result
         const statusIcon = result.ok ? chalk.green("  ✓") : chalk.red("  ✗");
-        process.stdout.write(statusIcon + "\n");
+        writeToolOutput(toolEventId, result.ok ? "ok\n" : "failed\n", statusIcon + "\n");
         if (output) {
             const displaySummary = summarizeOutput(output, displayMax);
             const displayText = displaySummary.truncated
@@ -1855,20 +1979,19 @@ export async function runAgentLoop(prompt, options = {}) {
             // the same bytes. Just note where the full output lives if it was saved.
             if (liveBytes > 0) {
                 if (savedOutputPath) {
-                    process.stdout.write(chalk.dim(`  full output saved to ${savedOutputPath}\n`));
+                    writeNotice("info", `full output saved to ${savedOutputPath}`, chalk.dim(`  full output saved to ${savedOutputPath}\n`));
                 }
             }
             else {
                 const renderedOutput = indentAndWrapText(displayText);
-                process.stdout.write(styleToolChatter(call, renderedOutput) + "\n");
+                writeToolOutput(toolEventId, displayText, styleToolChatter(call, renderedOutput) + "\n");
             }
         }
         if (isAbortError(undefined, options.signal)) {
             lastAnswer = "Aborted.";
-            process.stdout.write(chalk.yellow("  ⏹ Aborted.\n"));
+            writeAbort();
             return lastAnswer;
         }
-        const contextOutput = formatToolContext(call, resultWithArtifact);
         // Register a collapse/expand viewport so the user can pull the full raw
         // output back with Ctrl+O or `/output last` after the AI summary lands.
         if (output) {
@@ -1882,7 +2005,8 @@ export async function runAgentLoop(prompt, options = {}) {
             // (large output saved to disk). Avoid spamming the hint for
             // every tiny tool call — the user can always use /output last.
             if (savedOutputPath) {
-                process.stdout.write(`${formatViewportHint(viewport)}\n`);
+                const viewportHint = `${formatViewportHint(viewport)}\n`;
+                writeStatus(viewportHint, viewportHint);
             }
         }
         messages.push({
@@ -1903,7 +2027,7 @@ export async function runAgentLoop(prompt, options = {}) {
         }
     }
     lastAnswer = `Stopped after ${productiveSteps} steps.`;
-    process.stdout.write("  " + chalk.yellow(lastAnswer) + "\n");
-    return lastAnswer;
+    writeNotice("warn", lastAnswer, "  " + chalk.yellow(lastAnswer) + "\n");
+    return finishTurn(lastAnswer, productiveSteps);
 }
 //# sourceMappingURL=runner.js.map