@pentoshi/clai 1.2.7 → 1.2.9

package/dist/agent/runner.js

@@ -1104,930 +1104,943 @@ export async function runAgentLoop(prompt, options = {}) {
         emit({ type: "turn-end", finalAnswer: answer, steps });
         return answer;
     };
-    emit({ type: "turn-start", prompt });
-    const config = getConfig();
-    const maxSteps = options.maxSteps ?? 70;
-    const confirmPort = options.confirm ?? inquirerConfirmPort;
-    const projectContext = await loadProjectContext();
-    const toolNames = availableToolNames();
-    // Build / scaffold / continuation turns must NEVER be diverted into a
-    // web.search for "current info". The /implement directive ("Execute it
-    // now…") and prompts like "create a react app" contain words such as
-    // "now"/"latest" that trip the volatile-info regex; without this guard the
-    // agent burns its turn searching the date instead of writing files.
-    const buildLikeTurn = looksLikeBuildTask(prompt, options.history);
-    const freshWebSearchRequired = !buildLikeTurn &&
-        toolNames.includes("web.search") &&
-        requiresFreshWebSearch(prompt);
-    const systemSections = [renderAgentSystemPrompt(toolNames.join(", "))];
-    if (projectContext) {
-        systemSections.push(`Project context from .clai/context.md:\n${projectContext}`);
-    }
-    if (freshWebSearchRequired) {
-        systemSections.push(freshnessGuardMessage());
-    }
-    let provider = options.provider ?? config.defaultProvider;
-    await ensureProviderConfigured(provider);
-    let model = options.model ?? config.defaultModel;
-    let lastAnswer = "";
-    const session = options.session ?? createSessionPolicy();
-    // ── Active plan context ────────────────────────────────────────────
-    // If this session already has a plan, inject it so the model keeps it in
-    // context. When the user has approved it (via /implement) we instruct the
-    // agent to execute task by task; otherwise the agent should refine/wait.
-    const activePlan = await loadPlan(session.sessionId).catch(() => undefined);
-    if (activePlan) {
-        systemSections.push(planContextMessage(activePlan, session.planApproved.value));
-    }
-    // For build/scaffold turns with no active plan yet, inject an explicit
-    // workflow so the agent does NOT rush to write files in one shot. It must
-    // explore the directory, read the relevant existing files to understand
-    // what's already there, create a comprehensive multi-task plan, then
-    // implement task by task until the goal is met. This mirrors how a careful
-    // coding agent (Claude Code) operates.
-    if (buildLikeTurn && !activePlan) {
-        systemSections.push(buildWorkflowDirective());
-    }
-    const fullSystemPrompt = systemSections.join("\n\n");
-    const userMessage = { role: "user", content: prompt };
-    if (options.images && options.images.length > 0) {
-        userMessage.images = options.images;
-    }
-    const messages = [
-        { role: "system", content: fullSystemPrompt },
-        ...(options.history ?? []),
-        userMessage,
-    ];
-    const recoveryUserMessage = (content) => {
-        const message = { role: "user", content };
+    try {
+        emit({ type: "turn-start", prompt });
+        const config = getConfig();
+        const maxSteps = options.maxSteps ?? 70;
+        const confirmPort = options.confirm ?? inquirerConfirmPort;
+        const projectContext = await loadProjectContext();
+        const toolNames = availableToolNames();
+        // Build / scaffold / continuation turns must NEVER be diverted into a
+        // web.search for "current info". The /implement directive ("Execute it
+        // now…") and prompts like "create a react app" contain words such as
+        // "now"/"latest" that trip the volatile-info regex; without this guard the
+        // agent burns its turn searching the date instead of writing files.
+        const buildLikeTurn = looksLikeBuildTask(prompt, options.history);
+        const freshWebSearchRequired = !buildLikeTurn &&
+            toolNames.includes("web.search") &&
+            requiresFreshWebSearch(prompt);
+        const systemSections = [renderAgentSystemPrompt(toolNames.join(", "))];
+        if (projectContext) {
+            systemSections.push(`Project context from .clai/context.md:\n${projectContext}`);
+        }
+        if (freshWebSearchRequired) {
+            systemSections.push(freshnessGuardMessage());
+        }
+        let provider = options.provider ?? config.defaultProvider;
+        await ensureProviderConfigured(provider);
+        let model = options.model ?? config.defaultModel;
+        let lastAnswer = "";
+        const session = options.session ?? createSessionPolicy();
+        // ── Active plan context ────────────────────────────────────────────
+        // If this session already has a plan, inject it so the model keeps it in
+        // context. When the user has approved it (via /implement) we instruct the
+        // agent to execute task by task; otherwise the agent should refine/wait.
+        const activePlan = await loadPlan(session.sessionId).catch(() => undefined);
+        if (activePlan) {
+            systemSections.push(planContextMessage(activePlan, session.planApproved.value));
+        }
+        // For build/scaffold turns with no active plan yet, inject an explicit
+        // workflow so the agent does NOT rush to write files in one shot. It must
+        // explore the directory, read the relevant existing files to understand
+        // what's already there, create a comprehensive multi-task plan, then
+        // implement task by task until the goal is met. This mirrors how a careful
+        // coding agent (Claude Code) operates.
+        if (buildLikeTurn && !activePlan) {
+            systemSections.push(buildWorkflowDirective());
+        }
+        const fullSystemPrompt = systemSections.join("\n\n");
+        const userMessage = { role: "user", content: prompt };
         if (options.images && options.images.length > 0) {
-            // Some OpenAI-compatible gateways/models attend most strongly to the
-            // latest user turn. Keep the image attached on recovery nudges so a
-            // thinking-only retry does not degrade into OCR/tool guessing.
-            message.images = options.images;
+            userMessage.images = options.images;
         }
-        return message;
-    };
-    // Track recent tool calls to detect models stuck in a loop calling the
-    // same tool with the same arguments over and over (e.g. pentest.recon
-    // called 3× on the same target without summarizing).
-    const loopGuard = new LoopGuard();
-    // Track consecutive thinking-only responses so we can nudge the model
-    // to actually act instead of silently returning an empty answer.
-    let emptyVisibleRetries = 0;
-    // Track tool calls truncated by the token limit so we can ask the model
-    // to retry in smaller pieces instead of leaking broken JSON as an answer.
-    let truncatedToolRetries = 0;
-    // Track bare-args JSON tool calls (missing the {name,args} wrapper / fence)
-    // so we can nudge the model to re-emit a proper fenced call a few times
-    // before giving up, instead of leaking the JSON as a final answer.
-    let bareToolJsonRetries = 0;
-    // Track a ```tool fence that is present but whose JSON could not be parsed
-    // (e.g. malformed extra/missing braces that are NOT simple truncation). We
-    // retry instead of leaking the raw block as the final answer.
-    let malformedFenceRetries = 0;
-    // For volatile live-info prompts, make one corrective pass if a model
-    // ignores the freshness guard and tries to answer from stale memory.
-    let sawFreshWebSearch = false;
-    let freshnessRetryUsed = false;
-    // Guard against a model that declares an approved plan "complete" while
-    // tasks are still pending and it never ran the work. We nudge it back to
-    // executing the next task a bounded number of times before giving up.
-    let prematureCompletionRetries = 0;
-    // Guard against a model that NARRATES intent ("let me explore the
-    // directory…") but emits no tool call, so nothing runs and the turn ends
-    // prematurely. On build/scaffold/plan turns where nothing has executed yet,
-    // we nudge it to emit a real tool call instead of accepting the narration
-    // as a final answer. Bounded so a model that truly can't emit the format
-    // still terminates.
-    let actionIntentRetries = 0;
-    // ── Multi-tool execution queue ─────────────────────────────────────
-    // Models naturally emit several tool calls in one message — e.g. the
-    // plan-execution rhythm "task.update in_progress → do the work →
-    // task.update done", or a batch of fs.write calls. Rather than running
-    // only the first and discarding the rest (which made models believe work
-    // ran when it didn't, and broke plan execution), we parse ALL calls in a
-    // message, run the first this iteration, and queue the rest here to run on
-    // subsequent iterations WITHOUT another model round-trip. The queue is
-    // cleared whenever a call fails, is blocked, or needs the model to react,
-    // so the model always sees errors and stays in control.
-    let pendingCalls = [];
-    // ── Step budget ───────────────────────────────────────────────────
-    // The budget governs how many *productive* steps (a tool execution or a
-    // final answer) the agent may take. Recovery iterations — nudging a model
-    // that only produced thinking, asking it to re-emit a malformed tool call,
-    // a freshness retry, or a loop-guard summary — do NOT consume this budget;
-    // they get a separate hard ceiling so a wedged model can't spin forever.
-    //
-    // Complexity is a coarse signal from prompt length, but short follow-up
-    // prompts ("do it", "build fully on your own", "app is not complete") in
-    // the middle of a multi-file build must NOT be capped like a one-shot
-    // lookup — that was the reason a React scaffold stopped half-built after
-    // 10 steps. We bump the budget when the prompt (or recent history) looks
-    // like a build/scaffold or a continuation of one.
-    const analysis = analyzeTask(prompt);
-    const hasHistory = (options.history?.length ?? 0) > 0;
-    const buildLike = buildLikeTurn;
-    let stepBudget = analysis.complexity === "simple"
-        ? 20
-        : analysis.complexity === "standard"
-            ? 40
-            : maxSteps;
-    if (buildLike) {
-        // Scaffolding / multi-file work needs room: many file writes plus a
-        // verify/build step. Continuation prompts ("do it") inherit this too.
-        stepBudget = Math.max(stepBudget, maxSteps);
-    }
-    else if (hasHistory) {
-        // A follow-up to an ongoing task should never be capped tighter than a
-        // standard one-shot, even if it's only a couple of words.
-        stepBudget = Math.max(stepBudget, 40);
-    }
-    // Hard ceiling on total loop iterations (productive + recovery) so a model
-    // stuck emitting only thinking or malformed calls can't loop indefinitely.
-    const maxIterations = stepBudget * 3;
-    let productiveSteps = 0;
-    let step = -1;
-    let nextToolEventId = 0;
-    for (let iteration = 0; iteration < maxIterations; iteration += 1) {
-        // `step` is the productive-step index (used for display + audit). It only
-        // advances when the previous iteration actually executed a tool.
-        step = productiveSteps;
-        if (productiveSteps >= stepBudget)
-            break;
-        options.signal?.throwIfAborted();
-        // `call` and `assistantText` are shared by both paths below: a fresh
-        // model round-trip, or draining a previously-queued tool call.
-        let call;
-        let assistantText;
-        let recoveredFromBareJson = false;
-        if (pendingCalls.length > 0) {
-            // Drain the next queued call from the previous model message — no new
-            // round-trip. The assistant message and any prose were already shown
-            // when the batch was parsed.
-            call = pendingCalls.shift();
-            assistantText = { visible: "", thinkContent: "", hasThinking: false };
-            const batchStatus = `  ↳ continuing batch (${pendingCalls.length} more queued)\n`;
-            writeStatus(batchStatus, chalk.dim(batchStatus));
+        const messages = [
+            { role: "system", content: fullSystemPrompt },
+            ...(options.history ?? []),
+            userMessage,
+        ];
+        const recoveryUserMessage = (content) => {
+            const message = { role: "user", content };
+            if (options.images && options.images.length > 0) {
+                // Some OpenAI-compatible gateways/models attend most strongly to the
+                // latest user turn. Keep the image attached on recovery nudges so a
+                // thinking-only retry does not degrade into OCR/tool guessing.
+                message.images = options.images;
+            }
+            return message;
+        };
+        // Track recent tool calls to detect models stuck in a loop calling the
+        // same tool with the same arguments over and over (e.g. pentest.recon
+        // called 3× on the same target without summarizing).
+        const loopGuard = new LoopGuard();
+        // Track consecutive thinking-only responses so we can nudge the model
+        // to actually act instead of silently returning an empty answer.
+        let emptyVisibleRetries = 0;
+        // Track tool calls truncated by the token limit so we can ask the model
+        // to retry in smaller pieces instead of leaking broken JSON as an answer.
+        let truncatedToolRetries = 0;
+        // Track bare-args JSON tool calls (missing the {name,args} wrapper / fence)
+        // so we can nudge the model to re-emit a proper fenced call a few times
+        // before giving up, instead of leaking the JSON as a final answer.
+        let bareToolJsonRetries = 0;
+        // Track a ```tool fence that is present but whose JSON could not be parsed
+        // (e.g. malformed extra/missing braces that are NOT simple truncation). We
+        // retry instead of leaking the raw block as the final answer.
+        let malformedFenceRetries = 0;
+        // For volatile live-info prompts, make one corrective pass if a model
+        // ignores the freshness guard and tries to answer from stale memory.
+        let sawFreshWebSearch = false;
+        let freshnessRetryUsed = false;
+        // Guard against a model that declares an approved plan "complete" while
+        // tasks are still pending and it never ran the work. We nudge it back to
+        // executing the next task a bounded number of times before giving up.
+        let prematureCompletionRetries = 0;
+        // Guard against a model that NARRATES intent ("let me explore the
+        // directory…") but emits no tool call, so nothing runs and the turn ends
+        // prematurely. On build/scaffold/plan turns where nothing has executed yet,
+        // we nudge it to emit a real tool call instead of accepting the narration
+        // as a final answer. Bounded so a model that truly can't emit the format
+        // still terminates.
+        let actionIntentRetries = 0;
+        // ── Multi-tool execution queue ─────────────────────────────────────
+        // Models naturally emit several tool calls in one message — e.g. the
+        // plan-execution rhythm "task.update in_progress → do the work →
+        // task.update done", or a batch of fs.write calls. Rather than running
+        // only the first and discarding the rest (which made models believe work
+        // ran when it didn't, and broke plan execution), we parse ALL calls in a
+        // message, run the first this iteration, and queue the rest here to run on
+        // subsequent iterations WITHOUT another model round-trip. The queue is
+        // cleared whenever a call fails, is blocked, or needs the model to react,
+        // so the model always sees errors and stays in control.
+        let pendingCalls = [];
+        // ── Step budget ───────────────────────────────────────────────────
+        // The budget governs how many *productive* steps (a tool execution or a
+        // final answer) the agent may take. Recovery iterations — nudging a model
+        // that only produced thinking, asking it to re-emit a malformed tool call,
+        // a freshness retry, or a loop-guard summary — do NOT consume this budget;
+        // they get a separate hard ceiling so a wedged model can't spin forever.
+        //
+        // Complexity is a coarse signal from prompt length, but short follow-up
+        // prompts ("do it", "build fully on your own", "app is not complete") in
+        // the middle of a multi-file build must NOT be capped like a one-shot
+        // lookup — that was the reason a React scaffold stopped half-built after
+        // 10 steps. We bump the budget when the prompt (or recent history) looks
+        // like a build/scaffold or a continuation of one.
+        const analysis = analyzeTask(prompt);
+        const hasHistory = (options.history?.length ?? 0) > 0;
+        const buildLike = buildLikeTurn;
+        let stepBudget = analysis.complexity === "simple"
+            ? 20
+            : analysis.complexity === "standard"
+                ? 40
+                : maxSteps;
+        if (buildLike) {
+            // Scaffolding / multi-file work needs room: many file writes plus a
+            // verify/build step. Continuation prompts ("do it") inherit this too.
+            stepBudget = Math.max(stepBudget, maxSteps);
         }
-        else {
-            // Buffer LLM output so tool JSON and hidden thinking are not printed raw.
-            // Status messages (rate-limit retries, fallback hints) still surface live.
-            // A spinner gives the user feedback during long thinking phases on
-            // models like glm-5.1 / deepseek-v4-flash that stream reasoning first.
-            const streamLabel = step === 0 ? "waiting for model" : `step ${step + 1}`;
-            const spinner = writesDirectly
-                ? startThinkingSpinner(streamLabel, options.signal)
-                : noopSpinner;
-            if (!writesDirectly) {
-                emit({ type: "status", text: streamLabel });
+        else if (hasHistory) {
+            // A follow-up to an ongoing task should never be capped tighter than a
+            // standard one-shot, even if it's only a couple of words.
+            stepBudget = Math.max(stepBudget, 40);
+        }
+        // Hard ceiling on total loop iterations (productive + recovery) so a model
+        // stuck emitting only thinking or malformed calls can't loop indefinitely.
+        const maxIterations = stepBudget * 3;
+        let productiveSteps = 0;
+        let step = -1;
+        let nextToolEventId = 0;
+        for (let iteration = 0; iteration < maxIterations; iteration += 1) {
+            // `step` is the productive-step index (used for display + audit). It only
+            // advances when the previous iteration actually executed a tool.
+            step = productiveSteps;
+            if (productiveSteps >= stepBudget)
+                break;
+            options.signal?.throwIfAborted();
+            // `call` and `assistantText` are shared by both paths below: a fresh
+            // model round-trip, or draining a previously-queued tool call.
+            let call;
+            let assistantText;
+            let recoveredFromBareJson = false;
+            if (pendingCalls.length > 0) {
+                // Drain the next queued call from the previous model message — no new
+                // round-trip. The assistant message and any prose were already shown
+                // when the batch was parsed.
+                call = pendingCalls.shift();
+                assistantText = { visible: "", thinkContent: "", hasThinking: false };
+                const batchStatus = `  ↳ continuing batch (${pendingCalls.length} more queued)\n`;
+                writeStatus(batchStatus, chalk.dim(batchStatus));
             }
-            let sawReasoning = false;
-            let inThinking = false;
-            let emittedThinkingStatus = false;
-            const deltaParser = writesDirectly
-                ? undefined
-                : createThinkingStreamParser((text) => emit({ type: "assistant-delta", text }), (text) => {
-                    if (!emittedThinkingStatus) {
-                        emittedThinkingStatus = true;
-                        emit({ type: "status", text: "thinking" });
-                    }
-                    emit({ type: "thinking-delta", text });
-                });
-            let completion;
-            try {
-                completion = await streamWithProvider({
-                    provider,
-                    model,
-                    messages,
-                    temperature: 0.2,
-                    // Reasoning models can spend a lot on hidden thinking; give
-                    // them headroom so the visible answer / tool call isn't
-                    // truncated to silence. The non-thinking budget must be large
-                    // enough for a single-file fs.write / multi-file fs.writeMany
-                    // payload — a truncated tool-call JSON fails to parse and leaks a
-                    // broken (and syntactically invalid) file. 8k was too small for a
-                    // full component, so allow more room for the visible tool call.
-                    maxTokens: config.thinking?.enabled ? 16_384 : 12_288,
-                    signal: options.signal,
-                    thinking: config.thinking,
-                }, (token) => {
-                    deltaParser?.push(token);
-                    // Heuristic: <think>… markers and reasoning_content tokens flow
-                    // through onToken. Surface activity in the spinner so the screen
-                    // is never empty for minutes.
-                    if (!sawReasoning && /<think/i.test(token)) {
-                        sawReasoning = true;
-                        inThinking = true;
-                        spinner.setLabel("thinking");
-                        if (!writesDirectly)
+            else {
+                // Buffer LLM output so tool JSON and hidden thinking are not printed raw.
+                // Status messages (rate-limit retries, fallback hints) still surface live.
+                // A spinner gives the user feedback during long thinking phases on
+                // models like glm-5.1 / deepseek-v4-flash that stream reasoning first.
+                const streamLabel = step === 0 ? "waiting for model" : `step ${step + 1}`;
+                const spinner = writesDirectly
+                    ? startThinkingSpinner(streamLabel, options.signal)
+                    : noopSpinner;
+                if (!writesDirectly) {
+                    emit({ type: "status", text: streamLabel });
+                }
+                let sawReasoning = false;
+                let inThinking = false;
+                let emittedThinkingStatus = false;
+                const deltaParser = writesDirectly
+                    ? undefined
+                    : createThinkingStreamParser((text) => emit({ type: "assistant-delta", text }), (text) => {
+                        if (!emittedThinkingStatus) {
+                            emittedThinkingStatus = true;
                             emit({ type: "status", text: "thinking" });
-                    }
-                    if (/<\/think>/i.test(token)) {
-                        inThinking = false;
-                    }
-                    // Only push reasoning tokens to the spinner preview. Visible
-                    // answer / tool-call tokens should NOT go through the dim
-                    // spinner preview — doing so makes the final answer appear
-                    // "diluted" in light font when the spinner's last render
-                    // briefly shows the answer text before being erased.
-                    if (inThinking) {
-                        const cleaned = token.replace(/<\/?think[^>]*>/gi, "");
-                        if (cleaned) {
-                            spinner.pushPreview(cleaned);
-                            const approx = cleaned.split(/\s+/).filter(Boolean).length;
-                            if (approx > 0)
-                                spinner.bumpReasoning(approx);
                         }
-                    }
-                }, (status) => {
+                        emit({ type: "thinking-delta", text });
+                    });
+                let completion;
+                try {
+                    completion = await streamWithProvider({
+                        provider,
+                        model,
+                        messages,
+                        temperature: 0.2,
+                        // Reasoning models can spend a lot on hidden thinking; give
+                        // them headroom so the visible answer / tool call isn't
+                        // truncated to silence. The non-thinking budget must be large
+                        // enough for a single-file fs.write / multi-file fs.writeMany
+                        // payload — a truncated tool-call JSON fails to parse and leaks a
+                        // broken (and syntactically invalid) file. 8k was too small for a
+                        // full component, so allow more room for the visible tool call.
+                        maxTokens: config.thinking?.enabled ? 16_384 : 12_288,
+                        signal: options.signal,
+                        thinking: config.thinking,
+                    }, (token) => {
+                        deltaParser?.push(token);
+                        // Heuristic: <think>… markers and reasoning_content tokens flow
+                        // through onToken. Surface activity in the spinner so the screen
+                        // is never empty for minutes.
+                        if (!sawReasoning && /<think/i.test(token)) {
+                            sawReasoning = true;
+                            inThinking = true;
+                            spinner.setLabel("thinking");
+                            if (!writesDirectly)
+                                emit({ type: "status", text: "thinking" });
+                        }
+                        if (/<\/think>/i.test(token)) {
+                            inThinking = false;
+                        }
+                        // Only push reasoning tokens to the spinner preview. Visible
+                        // answer / tool-call tokens should NOT go through the dim
+                        // spinner preview — doing so makes the final answer appear
+                        // "diluted" in light font when the spinner's last render
+                        // briefly shows the answer text before being erased.
+                        if (inThinking) {
+                            const cleaned = token.replace(/<\/?think[^>]*>/gi, "");
+                            if (cleaned) {
+                                spinner.pushPreview(cleaned);
+                                const approx = cleaned.split(/\s+/).filter(Boolean).length;
+                                if (approx > 0)
+                                    spinner.bumpReasoning(approx);
+                            }
+                        }
+                    }, (status) => {
+                        spinner.stop();
+                        writeStatus(status, chalk.dim(status));
+                    });
+                }
+                finally {
+                    // Always clear the spinner — abort, network error, or success.
                     spinner.stop();
-                    writeStatus(status, chalk.dim(status));
-                });
-            }
-            finally {
-                // Always clear the spinner — abort, network error, or success.
-                spinner.stop();
-            }
-            provider = completion.provider;
-            model = completion.model;
-            deltaParser?.finish();
-            const assistantTextResult = rememberThinkingFromText(completion.text);
-            assistantText = assistantTextResult;
-            // Try visible text first, then thinking content — some models (e.g. glm-5.1)
-            // wrap tool calls inside  considering tags, so stripThinking removes them
-            // into thinkContent and visible becomes empty. Recovering from thinkContent
-            // prevents an endless nudge loop where the model keeps hiding the call.
-            call = parseToolCall(assistantText.visible, {
-                strict: getConfig().parserStrict,
-            });
-            if (!call && assistantText.hasThinking) {
-                call = parseToolCall(assistantText.thinkContent, {
+                }
+                provider = completion.provider;
+                model = completion.model;
+                deltaParser?.finish();
+                const assistantTextResult = rememberThinkingFromText(completion.text);
+                assistantText = assistantTextResult;
+                // Try visible text first, then thinking content — some models (e.g. glm-5.1)
+                // wrap tool calls inside  considering tags, so stripThinking removes them
+                // into thinkContent and visible becomes empty. Recovering from thinkContent
+                // prevents an endless nudge loop where the model keeps hiding the call.
+                call = parseToolCall(assistantText.visible, {
                     strict: getConfig().parserStrict,
                 });
-                if (call) {
-                    writeNotice("info", "recovered tool call from thinking content", chalk.dim("  ℹ recovered tool call from thinking content\n"));
-                }
-            }
-            // ── Thinking-only recovery ────────────────────────────────────────
-            // Some models (eg gpt-oss-20b on NVIDIA NIM) occasionally spend their
-            // entire budget on hidden <think> reasoning and emit no visible text
-            // or tool call. Without this guard the agent silently returns an empty
-            // answer and the user has to re-submit the same prompt.
-            if (!assistantText.visible.trim() && !call && assistantText.hasThinking) {
-                emptyVisibleRetries += 1;
-                if (emptyVisibleRetries <= 2) {
-                    writeThinkingBlock(assistantText.thinkContent);
-                    writeNotice("warn", "model produced only thinking — nudging it to take action", chalk.yellow("  ⚠ model produced only thinking — nudging it to take action\n"));
-                    messages.push({
-                        role: "assistant",
-                        content: collapseRepeatedText(completion.text),
+                if (!call && assistantText.hasThinking) {
+                    call = parseToolCall(assistantText.thinkContent, {
+                        strict: getConfig().parserStrict,
                     });
-                    const buildNudge = buildLikeTurn && !activePlan
-                        ? "You only produced internal reasoning with no visible answer or tool call. " +
-                            "This is a BUILD/SCAFFOLD task with NO plan yet. " +
-                            "You MUST call plan.create using the ```tool format to create a comprehensive plan BEFORE writing any files or running any commands. " +
-                            "Do NOT use fs.write, fs.writeMany, fs.edit, shell.exec, shell.start, or pkg.install yet. " +
-                            "Your ONLY allowed action right now is plan.create (or read/list for exploration)."
-                        : "You only produced internal reasoning with no visible answer or tool call. " +
-                            "You MUST either call a tool using the ```tool format or provide your final answer. " +
-                            "Do NOT wrap your tool call inside  considering or reasoning tags — put it in the VISIBLE response, not hidden. " +
-                            "If images are attached, inspect them directly for visual details (text, colors, layout, spacing, style) instead of using OCR unless explicitly needed. " +
-                            "Do NOT just think — take action NOW.";
-                    messages.push(recoveryUserMessage(buildNudge));
-                    continue;
+                    if (call) {
+                        writeNotice("info", "recovered tool call from thinking content", chalk.dim("  ℹ recovered tool call from thinking content\n"));
+                    }
                 }
-                // Exhausted retries — fall through to the normal empty-answer path
-                // which will print a warning and return.
-            }
-            else {
-                // Reset the counter on any successful visible output or recovered call.
-                emptyVisibleRetries = 0;
-            }
-            // `call` was already extracted above (from visible text or thinking content).
-            // Recovery: the model meant to call a tool but emitted a bare JSON object
-            // with no ```tool fence — either a complete {name,args} the strict
-            // matchers missed (recover it directly), or just an args object like
-            // {"path":"file.pdf"} with the wrapper dropped (nudge a retry below so
-            // the requested action runs instead of the JSON leaking as the answer).
-            let bareArgsOnly = false;
-            recoveredFromBareJson = false;
-            if (!call) {
-                const bare = recognizeBareToolJson(assistantText.visible);
-                if (bare?.call) {
-                    call = bare.call;
-                    recoveredFromBareJson = true;
-                    writeNotice("info", "recovered an unfenced tool call from bare JSON", chalk.dim("  ℹ recovered an unfenced tool call from bare JSON\n"));
+                // ── Thinking-only recovery ────────────────────────────────────────
+                // Some models (eg gpt-oss-20b on NVIDIA NIM) occasionally spend their
+                // entire budget on hidden <think> reasoning and emit no visible text
+                // or tool call. Without this guard the agent silently returns an empty
+                // answer and the user has to re-submit the same prompt.
+                if (!assistantText.visible.trim() && !call && assistantText.hasThinking) {
+                    emptyVisibleRetries += 1;
+                    if (emptyVisibleRetries <= 2) {
+                        writeThinkingBlock(assistantText.thinkContent);
+                        writeNotice("warn", "model produced only thinking — nudging it to take action", chalk.yellow("  ⚠ model produced only thinking — nudging it to take action\n"));
+                        messages.push({
+                            role: "assistant",
+                            content: collapseRepeatedText(completion.text),
+                        });
+                        const buildNudge = buildLikeTurn && !activePlan
+                            ? "You only produced internal reasoning with no visible answer or tool call. " +
+                                "This is a BUILD/SCAFFOLD task with NO plan yet. " +
+                                "You MUST call plan.create using the ```tool format to create a comprehensive plan BEFORE writing any files or running any commands. " +
+                                "Do NOT use fs.write, fs.writeMany, fs.edit, shell.exec, shell.start, or pkg.install yet. " +
+                                "Your ONLY allowed action right now is plan.create (or read/list for exploration)."
+                            : "You only produced internal reasoning with no visible answer or tool call. " +
+                                "You MUST either call a tool using the ```tool format or provide your final answer. " +
+                                "Do NOT wrap your tool call inside  considering or reasoning tags — put it in the VISIBLE response, not hidden. " +
+                                "If images are attached, inspect them directly for visual details (text, colors, layout, spacing, style) instead of using OCR unless explicitly needed. " +
+                                "Do NOT just think — take action NOW.";
+                        messages.push(recoveryUserMessage(buildNudge));
+                        continue;
+                    }
+                    // Exhausted retries — fall through to the normal empty-answer path
+                    // which will print a warning and return.
                 }
-                else if (bare?.argsOnly) {
-                    bareArgsOnly = true;
+                else {
+                    // Reset the counter on any successful visible output or recovered call.
+                    emptyVisibleRetries = 0;
                 }
-            }
-            // Also check thinking content for bare JSON calls.
-            if (!call && assistantText.hasThinking) {
-                const bareThink = recognizeBareToolJson(assistantText.thinkContent);
-                if (bareThink?.call) {
-                    call = bareThink.call;
-                    recoveredFromBareJson = true;
-                    writeNotice("info", "recovered an unfenced tool call from thinking content", chalk.dim("  ℹ recovered an unfenced tool call from thinking content\n"));
+                // `call` was already extracted above (from visible text or thinking content).
+                // Recovery: the model meant to call a tool but emitted a bare JSON object
+                // with no ```tool fence — either a complete {name,args} the strict
+                // matchers missed (recover it directly), or just an args object like
+                // {"path":"file.pdf"} with the wrapper dropped (nudge a retry below so
+                // the requested action runs instead of the JSON leaking as the answer).
+                let bareArgsOnly = false;
+                recoveredFromBareJson = false;
+                if (!call) {
+                    const bare = recognizeBareToolJson(assistantText.visible);
+                    if (bare?.call) {
+                        call = bare.call;
+                        recoveredFromBareJson = true;
+                        writeNotice("info", "recovered an unfenced tool call from bare JSON", chalk.dim("  ℹ recovered an unfenced tool call from bare JSON\n"));
+                    }
+                    else if (bare?.argsOnly) {
+                        bareArgsOnly = true;
+                    }
                 }
-                else if (bareThink?.argsOnly) {
-                    bareArgsOnly = true;
+                // Also check thinking content for bare JSON calls.
+                if (!call && assistantText.hasThinking) {
+                    const bareThink = recognizeBareToolJson(assistantText.thinkContent);
+                    if (bareThink?.call) {
+                        call = bareThink.call;
+                        recoveredFromBareJson = true;
+                        writeNotice("info", "recovered an unfenced tool call from thinking content", chalk.dim("  ℹ recovered an unfenced tool call from thinking content\n"));
+                    }
+                    else if (bareThink?.argsOnly) {
+                        bareArgsOnly = true;
+                    }
                 }
-            }
-            if (!call) {
-                if (bareArgsOnly) {
-                    bareToolJsonRetries += 1;
-                    if (bareToolJsonRetries <= 3) {
-                        writeNotice("warn", "tool call missing its name/fence — asking the model to re-emit a proper ```tool block", chalk.yellow("  ⚠ tool call missing its name/fence — asking the model to re-emit a proper ```tool block\n"));
+                if (!call) {
+                    if (bareArgsOnly) {
+                        bareToolJsonRetries += 1;
+                        if (bareToolJsonRetries <= 3) {
+                            writeNotice("warn", "tool call missing its name/fence — asking the model to re-emit a proper ```tool block", chalk.yellow("  ⚠ tool call missing its name/fence — asking the model to re-emit a proper ```tool block\n"));
+                            messages.push({ role: "assistant", content: assistantText.visible });
+                            messages.push(recoveryUserMessage(buildLikeTurn && !activePlan
+                                ? "Your previous message was a bare JSON args object with no tool name and no ```tool fence, so NOTHING ran. " +
+                                    "This is a BUILD/SCAFFOLD task with NO plan yet. " +
+                                    "You MUST call plan.create using a proper ```tool block. For example:\n" +
+                                    '```tool\n{"name":"plan.create","args":{"goal":"scaffold todo app","detail":"...","tasks":["...","..."],"kind":"coding"}}\n```\n' +
+                                    "Do NOT use fs.write, fs.writeMany, shell.exec, or pkg.install yet."
+                                : "Your previous message was a bare JSON args object with no tool name and no ```tool fence, so NOTHING ran. " +
+                                    "Reply with ONLY a fenced ```tool block of the form " +
+                                    '`{"name": "<tool>", "args": { ... }}`. For example, to read a PDF:\n' +
+                                    '```tool\n{"name":"pdf.read","args":{"path":"/abs/file.pdf"}}\n```\n' +
+                                    "Choose the correct tool name for the task and include those args."));
+                            continue;
+                        }
+                        // Exhausted retries — fall through to the normal answer path.
+                    }
+                    // Detect the case where the model emitted sentinel-style tool-call
+                    // markers but the body was malformed or truncated. Printing those
+                    // raw tokens looks like a crash to the user — instead, ask the
+                    // model to retry the tool call in a clean JSON format.
+                    if (/<\|tool_call(?:s_section)?_begin\|>|<\|tool_call_argument_begin\|>/i.test(assistantText.visible)) {
+                        writeNotice("warn", "tool call was malformed or cut off — asking the model to retry in JSON form", chalk.yellow("  ⚠ tool call was malformed or cut off — asking the model to retry in JSON form\n"));
                         messages.push({ role: "assistant", content: assistantText.visible });
-                        messages.push(recoveryUserMessage(buildLikeTurn && !activePlan
-                            ? "Your previous message was a bare JSON args object with no tool name and no ```tool fence, so NOTHING ran. " +
-                                "This is a BUILD/SCAFFOLD task with NO plan yet. " +
-                                "You MUST call plan.create using a proper ```tool block. For example:\n" +
-                                '```tool\n{"name":"plan.create","args":{"goal":"scaffold todo app","detail":"...","tasks":["...","..."],"kind":"coding"}}\n```\n' +
-                                "Do NOT use fs.write, fs.writeMany, shell.exec, or pkg.install yet."
-                            : "Your previous message was a bare JSON args object with no tool name and no ```tool fence, so NOTHING ran. " +
-                                "Reply with ONLY a fenced ```tool block of the form " +
-                                '`{"name": "<tool>", "args": { ... }}`. For example, to read a PDF:\n' +
-                                '```tool\n{"name":"pdf.read","args":{"path":"/abs/file.pdf"}}\n```\n' +
-                                "Choose the correct tool name for the task and include those args."));
+                        messages.push(recoveryUserMessage("Your previous tool call was malformed or truncated. " +
+                            "Reply with ONLY a fenced ```tool block containing valid JSON " +
+                            'of the form `{"name": "<tool>", "args": { ... }}`. ' +
+                            "Do not use <|tool_call_begin|> markers."));
                         continue;
                     }
-                    // Exhausted retries — fall through to the normal answer path.
-                }
-                // Detect the case where the model emitted sentinel-style tool-call
-                // markers but the body was malformed or truncated. Printing those
-                // raw tokens looks like a crash to the user — instead, ask the
-                // model to retry the tool call in a clean JSON format.
-                if (/<\|tool_call(?:s_section)?_begin\|>|<\|tool_call_argument_begin\|>/i.test(assistantText.visible)) {
-                    writeNotice("warn", "tool call was malformed or cut off — asking the model to retry in JSON form", chalk.yellow("  ⚠ tool call was malformed or cut off — asking the model to retry in JSON form\n"));
-                    messages.push({ role: "assistant", content: assistantText.visible });
-                    messages.push(recoveryUserMessage("Your previous tool call was malformed or truncated. " +
-                        "Reply with ONLY a fenced ```tool block containing valid JSON " +
-                        'of the form `{"name": "<tool>", "args": { ... }}`. ' +
-                        "Do not use <|tool_call_begin|> markers."));
-                    continue;
-                }
-                // Detect a tool call that opened but was cut off by the token limit
-                // (most common with a large multi-file fs.writeMany). Retrying with a
-                // nudge to split the work is far better than rendering broken JSON as
-                // a final answer and leaving the project half-created.
-                if (looksLikeTruncatedToolCall(assistantText.visible)) {
-                    truncatedToolRetries += 1;
-                    if (truncatedToolRetries <= 3) {
-                        writeNotice("warn", "tool call was cut off (output too long) — asking the model to retry in smaller pieces", chalk.yellow("  ⚠ tool call was cut off (output too long) — asking the model to retry in smaller pieces\n"));
+                    // Detect a tool call that opened but was cut off by the token limit
+                    // (most common with a large multi-file fs.writeMany). Retrying with a
+                    // nudge to split the work is far better than rendering broken JSON as
+                    // a final answer and leaving the project half-created.
+                    if (looksLikeTruncatedToolCall(assistantText.visible)) {
+                        truncatedToolRetries += 1;
+                        if (truncatedToolRetries <= 3) {
+                            writeNotice("warn", "tool call was cut off (output too long) — asking the model to retry in smaller pieces", chalk.yellow("  ⚠ tool call was cut off (output too long) — asking the model to retry in smaller pieces\n"));
+                            messages.push({ role: "assistant", content: assistantText.visible });
+                            messages.push({
+                                role: "user",
+                                content: "Your previous tool call was cut off before it finished — the JSON was incomplete, so NOTHING ran. " +
+                                    "Retry now with a COMPLETE, valid ```tool block. " +
+                                    "If it was a large fs.writeMany, split it into SMALLER batches (3-5 files per call, and keep each file's content concise) " +
+                                    "so the whole JSON fits in one response. Do NOT claim any file was written until a tool call actually succeeds.",
+                            });
+                            continue;
+                        }
+                        // Exhausted retries — fall through so we don't loop forever, but the
+                        // user at least sees the (broken) output and the stop notice.
+                    }
+                    // Detect a ```tool fence whose JSON could NOT be parsed for any other
+                    // reason (malformed braces, trailing junk, a stray `}` — NOT plain
+                    // truncation, which is handled above). Without this, the raw block
+                    // leaks to the screen as a code fence and the requested action (often
+                    // a whole fs.writeMany scaffold) silently never runs — exactly the
+                    // "fs.writeMany printed but nothing created" failure. Require the fence
+                    // to actually look like an intended call (mentions name/args) so a
+                    // genuine ```tool code example in prose isn't mistaken for one.
+                    const hasFencedCallShape = countToolFences(assistantText.visible) > 0 &&
+                        /```tool\s*\n[\s\S]*?"(?:name|args)"\s*:/i.test(assistantText.visible);
+                    if (hasFencedCallShape) {
+                        malformedFenceRetries += 1;
+                        if (malformedFenceRetries <= 3) {
+                            writeNotice("warn", "tool block present but its JSON didn't parse — asking the model to re-emit valid JSON", chalk.yellow("  ⚠ tool block present but its JSON didn't parse — asking the model to re-emit valid JSON\n"));
+                            messages.push({ role: "assistant", content: assistantText.visible });
+                            messages.push({
+                                role: "user",
+                                content: "Your previous message contained a ```tool block, but its JSON was INVALID, so NOTHING ran. " +
+                                    "Common causes: an extra or missing `}` / `]`, a trailing brace after the closing `}`, or unescaped quotes/newlines inside a string value. " +
+                                    'Re-emit ONE valid ```tool block of the exact form {"name":"<tool>","args":{...}} with balanced braces. ' +
+                                    "If it was a large fs.writeMany, split it into SMALLER batches (3-5 files) so the JSON is easy to keep valid. " +
+                                    "Do NOT claim any file was written until a tool call actually succeeds.",
+                            });
+                            continue;
+                        }
+                        // Exhausted retries — fall through to the normal path.
+                    }
+                    // Normal final-answer path: strip any stray sentinel tokens that
+                    // somehow leaked into prose so the answer renders cleanly.
+                    const cleaned = stripSentinelTokens(assistantText.visible);
+                    // ── Act, don't narrate ────────────────────────────────────────────
+                    // Build/scaffold/plan turns must DO something. If the model returns
+                    // prose with NO tool call, it is narrating intent ("Let me first
+                    // explore the directory…") or writing a PLAN as prose ("Goal: … Tasks:
+                    // … please approve") instead of calling a tool — accepting it as a
+                    // final answer ends the turn with nothing done and no real plan saved.
+                    // Nudge it to emit a real tool call, with a concrete example.
+                    const wantsAction = buildLikeTurn || (activePlan && session.planApproved.value);
+                    const planNarrated = buildLikeTurn && !activePlan && looksLikePlanNarration(cleaned);
+                    if (wantsAction &&
+                        cleaned.trim().length > 0 &&
+                        actionIntentRetries < 3 &&
+                        (productiveSteps === 0 ||
+                            planNarrated ||
+                            looksLikeActionNarration(cleaned))) {
+                        actionIntentRetries += 1;
+                        let nudge;
+                        if (activePlan && session.planApproved.value) {
+                            nudge =
+                                "You wrote a message but emitted NO ```tool block, so NOTHING ran. Do NOT narrate what you will do — DO it. Emit the next tool call now (task.update / fs.writeMany / shell.exec) in a single ```tool block.";
+                            writeNotice("warn", "described an action but emitted no tool call — nudging it to run one", chalk.yellow("  ⚠ described an action but emitted no tool call — nudging it to run one\n"));
+                        }
+                        else if (planNarrated || productiveSteps > 0) {
+                            // It explored and/or wrote a plan as prose but never called
+                            // plan.create — emit the plan as a real tool call so the user gets
+                            // a checklist and the /implement gate.
+                            nudge =
+                                "You wrote the plan as PROSE but did NOT call plan.create, so no plan was saved and the user cannot /implement it. Emit it as a real tool call NOW — exactly one ```tool block:\n" +
+                                    '```tool\n{"name":"plan.create","args":{"goal":"<short goal>","detail":"<stack/approach and how you\'ll verify>","tasks":["task 1","task 2","task 3"],"kind":"coding"}}\n```\n' +
+                                    "Do not describe the plan again in prose — just emit the plan.create tool block.";
+                            writeNotice("warn", "plan was written as text, not created — nudging it to call plan.create", chalk.yellow("  ⚠ plan was written as text, not created — nudging it to call plan.create\n"));
+                        }
+                        else {
+                            nudge =
+                                "You described what you will do but emitted NO ```tool block, so NOTHING actually happened — narration is not action. Emit a real tool call NOW. For this build task, explore first like this:\n" +
+                                    '```tool\n{"name":"fs.list","args":{"path":"."}}\n```\n' +
+                                    "Then read key files, and once you understand the directory, call plan.create. Every turn MUST contain a ```tool block until the task is done.";
+                            writeNotice("warn", "described an action but emitted no tool call — nudging it to run one", chalk.yellow("  ⚠ described an action but emitted no tool call — nudging it to run one\n"));
+                        }
                         messages.push({ role: "assistant", content: assistantText.visible });
-                        messages.push({
-                            role: "user",
-                            content: "Your previous tool call was cut off before it finished — the JSON was incomplete, so NOTHING ran. " +
-                                "Retry now with a COMPLETE, valid ```tool block. " +
-                                "If it was a large fs.writeMany, split it into SMALLER batches (3-5 files per call, and keep each file's content concise) " +
-                                "so the whole JSON fits in one response. Do NOT claim any file was written until a tool call actually succeeds.",
-                        });
+                        messages.push(recoveryUserMessage(nudge));
                         continue;
                     }
-                    // Exhausted retries — fall through so we don't loop forever, but the
-                    // user at least sees the (broken) output and the stop notice.
-                }
-                // Detect a ```tool fence whose JSON could NOT be parsed for any other
-                // reason (malformed braces, trailing junk, a stray `}` — NOT plain
-                // truncation, which is handled above). Without this, the raw block
-                // leaks to the screen as a code fence and the requested action (often
-                // a whole fs.writeMany scaffold) silently never runs — exactly the
-                // "fs.writeMany printed but nothing created" failure. Require the fence
-                // to actually look like an intended call (mentions name/args) so a
-                // genuine ```tool code example in prose isn't mistaken for one.
-                const hasFencedCallShape = countToolFences(assistantText.visible) > 0 &&
-                    /```tool\s*\n[\s\S]*?"(?:name|args)"\s*:/i.test(assistantText.visible);
-                if (hasFencedCallShape) {
-                    malformedFenceRetries += 1;
-                    if (malformedFenceRetries <= 3) {
-                        writeNotice("warn", "tool block present but its JSON didn't parse — asking the model to re-emit valid JSON", chalk.yellow("  ⚠ tool block present but its JSON didn't parse — asking the model to re-emit valid JSON\n"));
+                    if (freshWebSearchRequired && !sawFreshWebSearch && !freshnessRetryUsed) {
+                        freshnessRetryUsed = true;
+                        writeNotice("info", "current-info question detected — searching the web before answering", chalk.dim("  ℹ current-info question detected — searching the web before answering\n"));
                         messages.push({ role: "assistant", content: assistantText.visible });
                         messages.push({
                             role: "user",
-                            content: "Your previous message contained a ```tool block, but its JSON was INVALID, so NOTHING ran. " +
-                                "Common causes: an extra or missing `}` / `]`, a trailing brace after the closing `}`, or unescaped quotes/newlines inside a string value. " +
-                                'Re-emit ONE valid ```tool block of the exact form {"name":"<tool>","args":{...}} with balanced braces. ' +
-                                "If it was a large fs.writeMany, split it into SMALLER batches (3-5 files) so the JSON is easy to keep valid. " +
-                                "Do NOT claim any file was written until a tool call actually succeeds.",
+                            content: freshnessGuardMessage() +
+                                " Reply with ONLY a fenced ```tool block for web.search now.",
                         });
                         continue;
                     }
-                    // Exhausted retries — fall through to the normal path.
-                }
-                // Normal final-answer path: strip any stray sentinel tokens that
-                // somehow leaked into prose so the answer renders cleanly.
-                const cleaned = stripSentinelTokens(assistantText.visible);
-                // ── Act, don't narrate ────────────────────────────────────────────
-                // Build/scaffold/plan turns must DO something. If the model returns
-                // prose with NO tool call, it is narrating intent ("Let me first
-                // explore the directory…") or writing a PLAN as prose ("Goal: … Tasks:
-                // … please approve") instead of calling a tool — accepting it as a
-                // final answer ends the turn with nothing done and no real plan saved.
-                // Nudge it to emit a real tool call, with a concrete example.
-                const wantsAction = buildLikeTurn || (activePlan && session.planApproved.value);
-                const planNarrated = buildLikeTurn && !activePlan && looksLikePlanNarration(cleaned);
-                if (wantsAction &&
-                    cleaned.trim().length > 0 &&
-                    actionIntentRetries < 3 &&
-                    (productiveSteps === 0 ||
-                        planNarrated ||
-                        looksLikeActionNarration(cleaned))) {
-                    actionIntentRetries += 1;
-                    let nudge;
-                    if (activePlan && session.planApproved.value) {
-                        nudge =
-                            "You wrote a message but emitted NO ```tool block, so NOTHING ran. Do NOT narrate what you will do — DO it. Emit the next tool call now (task.update / fs.writeMany / shell.exec) in a single ```tool block.";
-                        writeNotice("warn", "described an action but emitted no tool call — nudging it to run one", chalk.yellow("  ⚠ described an action but emitted no tool call — nudging it to run one\n"));
+                    // ── Premature-completion guard (approved plan still has work) ──────
+                    // If the user approved a plan and the model now gives a final answer
+                    // while tasks are still pending/in_progress — without having run the
+                    // work — it is fabricating completion (the exact "all tasks completed,
+                    // running at localhost:5173" failure). Force it back to executing the
+                    // next real task instead of accepting the false claim.
+                    if (session.planApproved.value && prematureCompletionRetries < 3) {
+                        const livePlan = await loadPlan(session.sessionId).catch(() => undefined);
+                        const unfinished = livePlan?.tasks.filter((t) => t.state === "pending" || t.state === "in_progress");
+                        if (livePlan && unfinished && unfinished.length > 0) {
+                            prematureCompletionRetries += 1;
+                            const next = unfinished[0];
+                            writeNotice("warn", `${unfinished.length} plan task(s) still unfinished — not accepting a "done" claim; resuming execution`, chalk.yellow(`  ⚠ ${unfinished.length} plan task(s) still unfinished — not accepting a "done" claim; resuming execution\n`));
+                            messages.push({ role: "assistant", content: assistantText.visible });
+                            messages.push({
+                                role: "user",
+                                content: `You have NOT finished the approved plan: ${unfinished.length} task(s) remain ` +
+                                    `(${unfinished.map((t) => `[${t.id}] ${t.title}`).join("; ")}). ` +
+                                    `Do NOT claim the work is complete, that files were created, or that a server is running ` +
+                                    `unless a tool call actually succeeded and you saw the output. ` +
+                                    `Resume now with the NEXT task ${next.id} ("${next.title}"): call task.update {taskId:"${next.id}", state:"in_progress"}, ` +
+                                    `then do the real work with a tool call (fs.writeMany / shell.exec / shell.start), VERIFY it, and mark it done. ` +
+                                    `Continue task by task until EVERY task is actually finished.`,
+                            });
+                            continue;
+                        }
                     }
-                    else if (planNarrated || productiveSteps > 0) {
-                        // It explored and/or wrote a plan as prose but never called
-                        // plan.create — emit the plan as a real tool call so the user gets
-                        // a checklist and the /implement gate.
-                        nudge =
-                            "You wrote the plan as PROSE but did NOT call plan.create, so no plan was saved and the user cannot /implement it. Emit it as a real tool call NOW — exactly one ```tool block:\n" +
-                                '```tool\n{"name":"plan.create","args":{"goal":"<short goal>","detail":"<stack/approach and how you\'ll verify>","tasks":["task 1","task 2","task 3"],"kind":"coding"}}\n```\n' +
-                                "Do not describe the plan again in prose — just emit the plan.create tool block.";
-                        writeNotice("warn", "plan was written as text, not created — nudging it to call plan.create", chalk.yellow("  ⚠ plan was written as text, not created — nudging it to call plan.create\n"));
+                    // If we still print a final answer while an approved plan has unfinished
+                    // tasks (retries exhausted), do NOT let a fabricated "it's done" stand
+                    // unchallenged — append an explicit, honest status so the user knows the
+                    // build did not actually complete.
+                    let completionWarning = "";
+                    let completionWarningText = "";
+                    if (session.planApproved.value) {
+                        const livePlan = await loadPlan(session.sessionId).catch(() => undefined);
+                        const unfinished = livePlan?.tasks.filter((t) => t.state === "pending" || t.state === "in_progress");
+                        if (livePlan && unfinished && unfinished.length > 0) {
+                            completionWarningText =
+                                `${unfinished.length} of ${livePlan.tasks.length} plan task(s) are NOT actually complete. ` +
+                                    "The summary above may overstate progress.";
+                            completionWarning =
+                                chalk.yellow(`\n  ⚠ ${unfinished.length} of ${livePlan.tasks.length} plan task(s) are NOT actually complete:\n`) +
+                                    unfinished
+                                        .map((t) => chalk.yellow(`    • [${t.id}] ${t.title}`))
+                                        .join("\n") +
+                                    chalk.dim("\n  The summary above may overstate progress. Re-run with /implement, or ask clai to finish the remaining tasks.\n");
+                        }
                     }
-                    else {
-                        nudge =
-                            "You described what you will do but emitted NO ```tool block, so NOTHING actually happened — narration is not action. Emit a real tool call NOW. For this build task, explore first like this:\n" +
-                                '```tool\n{"name":"fs.list","args":{"path":"."}}\n```\n' +
-                                "Then read key files, and once you understand the directory, call plan.create. Every turn MUST contain a ```tool block until the task is done.";
-                        writeNotice("warn", "described an action but emitted no tool call — nudging it to run one", chalk.yellow("  ⚠ described an action but emitted no tool call — nudging it to run one\n"));
+                    if (cleaned) {
+                        writeAssistantMessage(cleaned);
                     }
-                    messages.push({ role: "assistant", content: assistantText.visible });
-                    messages.push(recoveryUserMessage(nudge));
-                    continue;
-                }
-                if (freshWebSearchRequired && !sawFreshWebSearch && !freshnessRetryUsed) {
-                    freshnessRetryUsed = true;
-                    writeNotice("info", "current-info question detected — searching the web before answering", chalk.dim("  ℹ current-info question detected — searching the web before answering\n"));
-                    messages.push({ role: "assistant", content: assistantText.visible });
-                    messages.push({
-                        role: "user",
-                        content: freshnessGuardMessage() +
-                            " Reply with ONLY a fenced ```tool block for web.search now.",
-                    });
-                    continue;
-                }
-                // ── Premature-completion guard (approved plan still has work) ──────
-                // If the user approved a plan and the model now gives a final answer
-                // while tasks are still pending/in_progress — without having run the
-                // work — it is fabricating completion (the exact "all tasks completed,
-                // running at localhost:5173" failure). Force it back to executing the
-                // next real task instead of accepting the false claim.
-                if (session.planApproved.value && prematureCompletionRetries < 3) {
-                    const livePlan = await loadPlan(session.sessionId).catch(() => undefined);
-                    const unfinished = livePlan?.tasks.filter((t) => t.state === "pending" || t.state === "in_progress");
-                    if (livePlan && unfinished && unfinished.length > 0) {
-                        prematureCompletionRetries += 1;
-                        const next = unfinished[0];
-                        writeNotice("warn", `${unfinished.length} plan task(s) still unfinished — not accepting a "done" claim; resuming execution`, chalk.yellow(`  ⚠ ${unfinished.length} plan task(s) still unfinished — not accepting a "done" claim; resuming execution\n`));
-                        messages.push({ role: "assistant", content: assistantText.visible });
-                        messages.push({
-                            role: "user",
-                            content: `You have NOT finished the approved plan: ${unfinished.length} task(s) remain ` +
-                                `(${unfinished.map((t) => `[${t.id}] ${t.title}`).join("; ")}). ` +
-                                `Do NOT claim the work is complete, that files were created, or that a server is running ` +
-                                `unless a tool call actually succeeded and you saw the output. ` +
-                                `Resume now with the NEXT task ${next.id} ("${next.title}"): call task.update {taskId:"${next.id}", state:"in_progress"}, ` +
-                                `then do the real work with a tool call (fs.writeMany / shell.exec / shell.start), VERIFY it, and mark it done. ` +
-                                `Continue task by task until EVERY task is actually finished.`,
-                        });
-                        continue;
+                    if (completionWarning) {
+                        writeNotice("warn", completionWarningText, completionWarning);
                     }
-                }
-                // If we still print a final answer while an approved plan has unfinished
-                // tasks (retries exhausted), do NOT let a fabricated "it's done" stand
-                // unchallenged — append an explicit, honest status so the user knows the
-                // build did not actually complete.
-                let completionWarning = "";
-                let completionWarningText = "";
-                if (session.planApproved.value) {
-                    const livePlan = await loadPlan(session.sessionId).catch(() => undefined);
-                    const unfinished = livePlan?.tasks.filter((t) => t.state === "pending" || t.state === "in_progress");
-                    if (livePlan && unfinished && unfinished.length > 0) {
-                        completionWarningText =
-                            `${unfinished.length} of ${livePlan.tasks.length} plan task(s) are NOT actually complete. ` +
-                                "The summary above may overstate progress.";
-                        completionWarning =
-                            chalk.yellow(`\n  ⚠ ${unfinished.length} of ${livePlan.tasks.length} plan task(s) are NOT actually complete:\n`) +
-                                unfinished
-                                    .map((t) => chalk.yellow(`    • [${t.id}] ${t.title}`))
-                                    .join("\n") +
-                                chalk.dim("\n  The summary above may overstate progress. Re-run with /implement, or ask clai to finish the remaining tasks.\n");
+                    if (assistantText.hasThinking) {
+                        writeThinkingBlock(assistantText.thinkContent);
                     }
+                    await auditLog("agent.final", { provider, model, steps: step + 1 });
+                    lastAnswer = cleaned;
+                    return finishTurn(lastAnswer, step + 1);
                 }
-                if (cleaned) {
-                    writeAssistantMessage(cleaned);
-                }
-                if (completionWarning) {
-                    writeNotice("warn", completionWarningText, completionWarning);
+                // A valid primary tool call exists for this fresh model turn. Show any
+                // prose / thinking that preceded it, record the assistant message ONCE,
+                // then queue any additional tool calls from the same message so they
+                // run in order on the next iterations (no extra round-trip).
+                const beforeTool = recoveredFromBareJson
+                    ? ""
+                    : textBeforeToolCall(assistantText.visible);
+                if (beforeTool) {
+                    writeAssistantMessage(beforeTool);
                 }
                 if (assistantText.hasThinking) {
                     writeThinkingBlock(assistantText.thinkContent);
                 }
-                await auditLog("agent.final", { provider, model, steps: step + 1 });
-                lastAnswer = cleaned;
-                return finishTurn(lastAnswer, step + 1);
+                messages.push({
+                    role: "assistant",
+                    content: collapseRepeatedText(assistantText.visible),
+                });
+                if (!recoveredFromBareJson && call) {
+                    const allCalls = parseAllToolCalls(assistantText.visible);
+                    if (allCalls.length > 1 &&
+                        allCalls[0] &&
+                        sameToolCall(allCalls[0], call)) {
+                        pendingCalls = allCalls.slice(1);
+                        writeNotice("info", `${allCalls.length} tool calls in this message — running them in order`, chalk.dim(`  ℹ ${allCalls.length} tool calls in this message — running them in order\n`));
+                    }
+                }
             }
-            // A valid primary tool call exists for this fresh model turn. Show any
-            // prose / thinking that preceded it, record the assistant message ONCE,
-            // then queue any additional tool calls from the same message so they
-            // run in order on the next iterations (no extra round-trip).
-            const beforeTool = recoveredFromBareJson
-                ? ""
-                : textBeforeToolCall(assistantText.visible);
-            if (beforeTool) {
-                writeAssistantMessage(beforeTool);
+            // Type guard: every path above either set `call` or returned/continued.
+            if (!call)
+                continue;
+            // Models often emit a bare CLI name as the tool (e.g. {"name":"sed",...})
+            // instead of wrapping it in shell.exec. Rewrite such unknown, un-namespaced
+            // names into a shell.exec call BEFORE classification so the command both
+            // runs and is safety-classified as the shell command it really is —
+            // instead of dead-ending on "Unknown tool: sed".
+            call = normalizeToolCall(call);
+            const toolEventId = `tool-${++nextToolEventId}`;
+            // ── Duplicate-call detection ──────────────────────────────────────────
+            // If the model calls the exact same tool with the exact same args
+            // repeatedly, it's stuck in a loop. Inject a corrective message
+            // telling it to summarize the results it already has.
+            const loopCheck = loopGuard.shouldBlock(call.name, call.args);
+            if (loopCheck.block) {
+                const isWrite = call.name === "fs.write" ||
+                    call.name === "fs.writeMany" ||
+                    call.name === "fs.edit";
+                const reason = `${call.name} was already called with the same arguments — ${isWrite ? "moving on" : "forcing summary"}`;
+                writeNotice("warn", reason, chalk.yellow(`  ⚠ ${call.name} was already called with the same arguments — ${isWrite ? "moving on" : "forcing summary"}\n`));
+                // A repeat means this batch went off the rails — drop any queued calls
+                // and let the model react. The assistant message was already recorded.
+                pendingCalls = [];
+                messages.push({
+                    role: "user",
+                    content: isWrite
+                        ? `You already wrote that exact file with ${call.name}. It is saved. ` +
+                            "Do NOT write it again. Move on to the NEXT file or step. If every file is written, " +
+                            "verify the project (list the tree, run the build/install command) and give your final answer."
+                        : `You already called ${call.name} with the same arguments and received results. ` +
+                            "Do NOT call it again. Summarize the findings you already have and give your final answer NOW.",
+                });
+                continue;
             }
-            if (assistantText.hasThinking) {
-                writeThinkingBlock(assistantText.thinkContent);
+            if (loopCheck.reason) {
+                writeNotice("info", loopCheck.reason, chalk.dim(`  ℹ ${loopCheck.reason}\n`));
             }
-            messages.push({
-                role: "assistant",
-                content: collapseRepeatedText(assistantText.visible),
-            });
-            if (!recoveredFromBareJson && call) {
-                const allCalls = parseAllToolCalls(assistantText.visible);
-                if (allCalls.length > 1 &&
-                    allCalls[0] &&
-                    sameToolCall(allCalls[0], call)) {
-                    pendingCalls = allCalls.slice(1);
-                    writeNotice("info", `${allCalls.length} tool calls in this message — running them in order`, chalk.dim(`  ℹ ${allCalls.length} tool calls in this message — running them in order\n`));
+            // ── Plan / task tools (session-scoped, handled inline) ─────────────
+            // These don't go through the generic registry because they need the
+            // session id and mutate the live plan that the user can view (Ctrl+P).
+            if (call.name === "plan.create" || call.name === "task.update") {
+                const planResult = await handlePlanTool(call, session, {
+                    loopGuard,
+                    step,
+                });
+                if (planResult.handled) {
+                    productiveSteps += 1;
+                    loopGuard.recordAttempt(step, call.name, call.args, planResult.ok, 0);
+                    if (planResult.plan) {
+                        writePlanUpdate(planResult.plan, planResult.display);
+                    }
+                    // plan.create means "STOP and wait for /implement" — abandon any
+                    // other calls the model batched alongside it.
+                    if (call.name === "plan.create")
+                        pendingCalls = [];
+                    messages.push({
+                        role: "tool",
+                        content: `Tool ${call.name} result (ok=${planResult.ok}):\n${planResult.modelNote}`,
+                    });
+                    continue;
                 }
             }
-        }
-        // Type guard: every path above either set `call` or returned/continued.
-        if (!call)
-            continue;
-        // Models often emit a bare CLI name as the tool (e.g. {"name":"sed",...})
-        // instead of wrapping it in shell.exec. Rewrite such unknown, un-namespaced
-        // names into a shell.exec call BEFORE classification so the command both
-        // runs and is safety-classified as the shell command it really is —
-        // instead of dead-ending on "Unknown tool: sed".
-        call = normalizeToolCall(call);
-        const toolEventId = `tool-${++nextToolEventId}`;
-        // ── Duplicate-call detection ──────────────────────────────────────────
-        // If the model calls the exact same tool with the exact same args
-        // repeatedly, it's stuck in a loop. Inject a corrective message
-        // telling it to summarize the results it already has.
-        const loopCheck = loopGuard.shouldBlock(call.name, call.args);
-        if (loopCheck.block) {
-            const isWrite = call.name === "fs.write" ||
-                call.name === "fs.writeMany" ||
-                call.name === "fs.edit";
-            const reason = `${call.name} was already called with the same arguments — ${isWrite ? "moving on" : "forcing summary"}`;
-            writeNotice("warn", reason, chalk.yellow(`  ⚠ ${call.name} was already called with the same arguments — ${isWrite ? "moving on" : "forcing summary"}\n`));
-            // A repeat means this batch went off the rails — drop any queued calls
-            // and let the model react. The assistant message was already recorded.
-            pendingCalls = [];
-            messages.push({
-                role: "user",
-                content: isWrite
-                    ? `You already wrote that exact file with ${call.name}. It is saved. ` +
-                        "Do NOT write it again. Move on to the NEXT file or step. If every file is written, " +
-                        "verify the project (list the tree, run the build/install command) and give your final answer."
-                    : `You already called ${call.name} with the same arguments and received results. ` +
-                        "Do NOT call it again. Summarize the findings you already have and give your final answer NOW.",
+            const scope = await loadScope();
+            const decision = classifyToolCall(call, { scope });
+            await auditLog("tool.classified", {
+                call,
+                decision,
+                scope: isScopeActive(scope) ? (scope.name ?? "(unnamed)") : "(none)",
             });
-            continue;
-        }
-        if (loopCheck.reason) {
-            writeNotice("info", loopCheck.reason, chalk.dim(`  ℹ ${loopCheck.reason}\n`));
-        }
-        // ── Plan / task tools (session-scoped, handled inline) ─────────────
-        // These don't go through the generic registry because they need the
-        // session id and mutate the live plan that the user can view (Ctrl+P).
-        if (call.name === "plan.create" || call.name === "task.update") {
-            const planResult = await handlePlanTool(call, session, {
-                loopGuard,
-                step,
-            });
-            if (planResult.handled) {
-                productiveSteps += 1;
-                loopGuard.recordAttempt(step, call.name, call.args, planResult.ok, 0);
-                if (planResult.plan) {
-                    writePlanUpdate(planResult.plan, planResult.display);
-                }
-                // plan.create means "STOP and wait for /implement" — abandon any
-                // other calls the model batched alongside it.
-                if (call.name === "plan.create")
-                    pendingCalls = [];
+            // ── Plan-awaiting-approval gate ────────────────────────────────────
+            // When an active plan exists but the user has NOT approved it with
+            // /implement, the agent must NOT execute the plan. Any free-text the
+            // user typed after the plan was shown is a PLAN REVISION, not a "go"
+            // signal — the agent should re-plan (plan.create) and wait again. We
+            // hard-block execution tools here so a model that ignores the prompt
+            // directive (or recovers a stray tool call) can't start running the
+            // plan. Read-only exploration is still allowed so it can refine the
+            // plan intelligently.
+            if (activePlan &&
+                !session.planApproved.value &&
+                !isPreApprovalAllowedTool(call.name)) {
+                const reason = `plan awaiting approval — ${call.name} is blocked until you /implement (or /discard)`;
+                writeNotice("warn", reason, chalk.yellow(`  ⚠ plan awaiting approval — ${call.name} is blocked until you /implement (or /discard)\n`));
+                pendingCalls = [];
                 messages.push({
-                    role: "tool",
-                    content: `Tool ${call.name} result (ok=${planResult.ok}):\n${planResult.modelNote}`,
+                    role: "user",
+                    content: `There is an ACTIVE PLAN that has NOT been approved yet, so you must NOT execute it — ` +
+                        `you tried to call ${call.name}, which is blocked. The user's latest message is a PLAN REVISION, ` +
+                        `not approval. Update the plan to incorporate their feedback by calling plan.create again with the ` +
+                        `revised goal/detail/tasks, then STOP and wait. The user approves with /implement or cancels with /discard. ` +
+                        `Do NOT run any execution tool (shell.exec, pkg.install, fs.write, net.scan, tool.check, etc.) until they /implement.`,
                 });
                 continue;
             }
-        }
-        const scope = await loadScope();
-        const decision = classifyToolCall(call, { scope });
-        await auditLog("tool.classified", {
-            call,
-            decision,
-            scope: isScopeActive(scope) ? (scope.name ?? "(unnamed)") : "(none)",
-        });
-        // ── Plan-awaiting-approval gate ────────────────────────────────────
-        // When an active plan exists but the user has NOT approved it with
-        // /implement, the agent must NOT execute the plan. Any free-text the
-        // user typed after the plan was shown is a PLAN REVISION, not a "go"
-        // signal — the agent should re-plan (plan.create) and wait again. We
-        // hard-block execution tools here so a model that ignores the prompt
-        // directive (or recovers a stray tool call) can't start running the
-        // plan. Read-only exploration is still allowed so it can refine the
-        // plan intelligently.
-        if (activePlan &&
-            !session.planApproved.value &&
-            !isPreApprovalAllowedTool(call.name)) {
-            const reason = `plan awaiting approval — ${call.name} is blocked until you /implement (or /discard)`;
-            writeNotice("warn", reason, chalk.yellow(`  ⚠ plan awaiting approval — ${call.name} is blocked until you /implement (or /discard)\n`));
-            pendingCalls = [];
-            messages.push({
-                role: "user",
-                content: `There is an ACTIVE PLAN that has NOT been approved yet, so you must NOT execute it — ` +
-                    `you tried to call ${call.name}, which is blocked. The user's latest message is a PLAN REVISION, ` +
-                    `not approval. Update the plan to incorporate their feedback by calling plan.create again with the ` +
-                    `revised goal/detail/tasks, then STOP and wait. The user approves with /implement or cancels with /discard. ` +
-                    `Do NOT run any execution tool (shell.exec, pkg.install, fs.write, net.scan, tool.check, etc.) until they /implement.`,
-            });
-            continue;
-        }
-        if (call.name === "web.search") {
-            sawFreshWebSearch = true;
-        }
-        // Show tool call
-        const toolCallLine = chalk.cyan(`  ▶ ${call.name}`) + chalk.gray(` ${formatToolArgs(call)}`);
-        writeToolCall(toolEventId, call, styleToolChatter(call, toolCallLine) + "\n");
-        const scopeTarget = scopeTargetForToolCall(call);
-        if (scopeTarget &&
-            (!isScopeActive(scope) || !targetInScope(scopeTarget, scope))) {
-            writeNotice("info", `scope optional: ${scopeHint(scopeTarget)}`, chalk.dim(`  scope optional: ${scopeHint(scopeTarget)}\n`));
-        }
-        if (decision.level === "block") {
-            writeToolBlocked(toolEventId, call.name, decision.reason, chalk.red(`  ✗ blocked: ${decision.reason}`) + "\n");
-            lastAnswer = `Blocked: ${call.name} — ${decision.reason}`;
-            return finishTurn(lastAnswer, productiveSteps);
-        }
-        // Pentest authorization — if user confirms this, skip the per-tool confirm
-        let pentestJustConfirmed = false;
-        const needsPentestAuth = isPentestToolCall(call) &&
-            !getConfig().pentestAuthorized &&
-            !session.pentestAuthorized.value;
-        const authorized = await ensurePentestAuthorization(call, Boolean(options.autoConfirm), session, confirmPort);
-        // inquirer's confirm() creates its own readline interface which resets
-        // raw mode AND pauses stdin when it finishes. Re-assert raw mode and
-        // resume stdin so the outer keypress handler (ESC/Ctrl+C abort, Ctrl+O
-        // output pane) keeps working during the next streaming/tool phase.
-        restoreInteractiveStdin();
-        if (!authorized) {
-            lastAnswer = "Pentest authorization not confirmed.";
-            writeToolBlocked(toolEventId, call.name, lastAnswer, chalk.red(`  ✗ ${lastAnswer}`) + "\n");
-            return finishTurn(lastAnswer, productiveSteps);
-        }
-        if (needsPentestAuth) {
-            pentestJustConfirmed = true;
-        }
-        // Confirm if needed (safe tools auto-execute, pentest-auth'd tools skip)
-        // fs.delete and shell deletions NEVER auto-confirm even with -y flag.
-        const forceManualConfirm = call.name === "fs.delete";
-        if (decision.level === "confirm" && !pentestJustConfirmed) {
-            const ok = await confirmToolExecution(call, forceManualConfirm ? false : Boolean(options.autoConfirm), session, confirmPort);
-            // Re-assert raw mode and resume stdin after inquirer's confirm()
-            // (see restoreInteractiveStdin / the comment above).
+            if (call.name === "web.search") {
+                sawFreshWebSearch = true;
+            }
+            // Show tool call
+            const toolCallLine = chalk.cyan(`  ▶ ${call.name}`) + chalk.gray(` ${formatToolArgs(call)}`);
+            writeToolCall(toolEventId, call, styleToolChatter(call, toolCallLine) + "\n");
+            const scopeTarget = scopeTargetForToolCall(call);
+            if (scopeTarget &&
+                (!isScopeActive(scope) || !targetInScope(scopeTarget, scope))) {
+                writeNotice("info", `scope optional: ${scopeHint(scopeTarget)}`, chalk.dim(`  scope optional: ${scopeHint(scopeTarget)}\n`));
+            }
+            if (decision.level === "block") {
+                writeToolBlocked(toolEventId, call.name, decision.reason, chalk.red(`  ✗ blocked: ${decision.reason}`) + "\n");
+                lastAnswer = `Blocked: ${call.name} — ${decision.reason}`;
+                return finishTurn(lastAnswer, productiveSteps);
+            }
+            // Pentest authorization — if user confirms this, skip the per-tool confirm
+            let pentestJustConfirmed = false;
+            const needsPentestAuth = isPentestToolCall(call) &&
+                !getConfig().pentestAuthorized &&
+                !session.pentestAuthorized.value;
+            const authorized = await ensurePentestAuthorization(call, Boolean(options.autoConfirm), session, confirmPort);
+            // inquirer's confirm() creates its own readline interface which resets
+            // raw mode AND pauses stdin when it finishes. Re-assert raw mode and
+            // resume stdin so the outer keypress handler (ESC/Ctrl+C abort, Ctrl+O
+            // output pane) keeps working during the next streaming/tool phase.
             restoreInteractiveStdin();
-            if (!ok) {
-                lastAnswer = "Cancelled.";
-                writeNotice("warn", "cancelled", chalk.yellow(`  ✗ cancelled`) + "\n");
+            if (!authorized) {
+                lastAnswer = "Pentest authorization not confirmed.";
+                writeToolBlocked(toolEventId, call.name, lastAnswer, chalk.red(`  ✗ ${lastAnswer}`) + "\n");
                 return finishTurn(lastAnswer, productiveSteps);
             }
-        }
-        // Execute tool
-        options.signal?.throwIfAborted();
-        options.onToolStart?.(call);
-        // Heads-up when the command is about to run something that may pause
-        // for a password prompt (sudo, ssh, gpg, ...). The shell tool already
-        // routes such commands through inherited stdin so the user can type
-        // directly into the controlling TTY; we just warn them to expect it.
-        const interactiveCommand = call.name === "shell.exec" &&
-            typeof call.args.command === "string" &&
-            looksInteractiveStdin(call.args.command);
-        if (interactiveCommand && process.stdin.isTTY) {
-            writeNotice("warn", "this command may prompt for a password — type it when asked", chalk.yellow("  ⚠ this command may prompt for a password — type it when asked\n"));
-        }
-        let result;
-        let liveBytes = 0;
-        const liveCap = 16_000; // Stop streaming after this many bytes to avoid flooding the terminal.
-        let liveTruncatedNotified = false;
-        let lastProgressAt = 0;
-        // When the underlying command may pause for a password prompt
-        // (sudo / ssh / etc.) we stream the live preview *without* the dim
-        // attribute so the prompt is fully readable. Otherwise we keep the
-        // dim styling that makes ordinary tool chatter visually distinct
-        // from the model's prose.
-        const shouldDimLive = !interactiveCommand;
-        const printLive = (chunk) => {
-            // Suppress live preview for fs.read / fs.list — those are read-only
-            // and the final summary is already concise. Stream shell-style tools
-            // (shell.exec, net.scan, pentest.recon, pkg.install).
-            if (call.name === "fs.read" ||
-                call.name === "fs.list" ||
-                call.name === "fs.search")
-                return;
-            if (liveBytes >= liveCap) {
-                if (!liveTruncatedNotified) {
-                    liveTruncatedNotified = true;
-                    writeNotice("info", "live preview truncated, full output saved", chalk.dim("\n  … live preview truncated, full output saved\n"));
-                    writeNotice("info", "tool still running — ESC or Ctrl+C to abort", chalk.dim("  (tool still running — ESC or Ctrl+C to abort)\n"));
-                    lastProgressAt = Date.now();
+            if (needsPentestAuth) {
+                pentestJustConfirmed = true;
+            }
+            // Confirm if needed (safe tools auto-execute, pentest-auth'd tools skip)
+            // fs.delete and shell deletions NEVER auto-confirm even with -y flag.
+            const forceManualConfirm = call.name === "fs.delete";
+            if (decision.level === "confirm" && !pentestJustConfirmed) {
+                const ok = await confirmToolExecution(call, forceManualConfirm ? false : Boolean(options.autoConfirm), session, confirmPort);
+                // Re-assert raw mode and resume stdin after inquirer's confirm()
+                // (see restoreInteractiveStdin / the comment above).
+                restoreInteractiveStdin();
+                if (!ok) {
+                    lastAnswer = "Cancelled.";
+                    writeNotice("warn", "cancelled", chalk.yellow(`  ✗ cancelled`) + "\n");
+                    return finishTurn(lastAnswer, productiveSteps);
                 }
-                // After truncation, show a dot every 5 seconds so the user knows
-                // the tool is still running and the terminal isn't frozen.
-                const now = Date.now();
-                if (now - lastProgressAt > 5_000) {
-                    lastProgressAt = now;
-                    writeToolOutput(toolEventId, ".", chalk.dim("."));
+            }
+            // Execute tool
+            options.signal?.throwIfAborted();
+            options.onToolStart?.(call);
+            // Heads-up when the command is about to run something that may pause
+            // for a password prompt (sudo, ssh, gpg, ...). The shell tool already
+            // routes such commands through inherited stdin so the user can type
+            // directly into the controlling TTY; we just warn them to expect it.
+            const interactiveCommand = call.name === "shell.exec" &&
+                typeof call.args.command === "string" &&
+                looksInteractiveStdin(call.args.command);
+            if (interactiveCommand && process.stdin.isTTY) {
+                writeNotice("warn", "this command may prompt for a password — type it when asked", chalk.yellow("  ⚠ this command may prompt for a password — type it when asked\n"));
+            }
+            let result;
+            let liveBytes = 0;
+            const liveCap = 16_000; // Stop streaming after this many bytes to avoid flooding the terminal.
+            let liveTruncatedNotified = false;
+            let lastProgressAt = 0;
+            // When the underlying command may pause for a password prompt
+            // (sudo / ssh / etc.) we stream the live preview *without* the dim
+            // attribute so the prompt is fully readable. Otherwise we keep the
+            // dim styling that makes ordinary tool chatter visually distinct
+            // from the model's prose.
+            const shouldDimLive = !interactiveCommand;
+            const printLive = (chunk) => {
+                // Suppress live preview for fs.read / fs.list — those are read-only
+                // and the final summary is already concise. Stream shell-style tools
+                // (shell.exec, net.scan, pentest.recon, pkg.install).
+                if (call.name === "fs.read" ||
+                    call.name === "fs.list" ||
+                    call.name === "fs.search")
+                    return;
+                if (liveBytes >= liveCap) {
+                    if (!liveTruncatedNotified) {
+                        liveTruncatedNotified = true;
+                        writeNotice("info", "live preview truncated, full output saved", chalk.dim("\n  … live preview truncated, full output saved\n"));
+                        writeNotice("info", "tool still running — ESC or Ctrl+C to abort", chalk.dim("  (tool still running — ESC or Ctrl+C to abort)\n"));
+                        lastProgressAt = Date.now();
+                    }
+                    // After truncation, show a dot every 5 seconds so the user knows
+                    // the tool is still running and the terminal isn't frozen.
+                    const now = Date.now();
+                    if (now - lastProgressAt > 5_000) {
+                        lastProgressAt = now;
+                        writeToolOutput(toolEventId, ".", chalk.dim("."));
+                    }
+                    return;
+                }
+                const remaining = liveCap - liveBytes;
+                const slice = chunk.length > remaining ? chunk.slice(0, remaining) : chunk;
+                liveBytes += slice.length;
+                // Indent each line so live output lines up under the tool call.
+                const indented = slice.replace(/\r/g, "").replace(/\n(?!$)/g, "\n  ");
+                const body = indented.startsWith("\n") ? indented : `  ${indented}`;
+                // Skip the dim wrapper for interactive commands so a sudo password
+                // prompt is rendered at full brightness; everything else stays dim
+                // so tool chatter is visually distinct from the model's prose.
+                writeToolOutput(toolEventId, slice, shouldDimLive ? chalk.dim(body) : body);
+            };
+            try {
+                result = await runToolCall(call, {
+                    signal: options.signal,
+                    onOutput: (chunk) => {
+                        if (options.signal?.aborted)
+                            return;
+                        printLive(chunk);
+                    },
+                });
+                // Newline separator if live output or progress dots didn't already end with one.
+                if (liveBytes > 0 || liveTruncatedNotified) {
+                    writeToolOutput(toolEventId, "\n", "\n");
                 }
-                return;
             }
-            const remaining = liveCap - liveBytes;
-            const slice = chunk.length > remaining ? chunk.slice(0, remaining) : chunk;
-            liveBytes += slice.length;
-            // Indent each line so live output lines up under the tool call.
-            const indented = slice.replace(/\r/g, "").replace(/\n(?!$)/g, "\n  ");
-            const body = indented.startsWith("\n") ? indented : `  ${indented}`;
-            // Skip the dim wrapper for interactive commands so a sudo password
-            // prompt is rendered at full brightness; everything else stays dim
-            // so tool chatter is visually distinct from the model's prose.
-            writeToolOutput(toolEventId, slice, shouldDimLive ? chalk.dim(body) : body);
-        };
-        try {
-            result = await runToolCall(call, {
-                signal: options.signal,
-                onOutput: (chunk) => {
-                    if (options.signal?.aborted)
-                        return;
-                    printLive(chunk);
-                },
+            catch (toolError) {
+                if (isAbortError(toolError, options.signal)) {
+                    lastAnswer = "Aborted.";
+                    writeAbort();
+                    return lastAnswer;
+                }
+                const errMsg = toolError instanceof Error ? toolError.message : String(toolError);
+                result = { ok: false, output: `Tool error: ${errMsg}`, exitCode: 1 };
+            }
+            // Stop-on-error: if this call failed, abandon any remaining queued calls
+            // from the same message so the model sees the failure and decides what to
+            // do next instead of blindly running steps that depended on it.
+            if (!result.ok && pendingCalls.length > 0) {
+                const cancelledQueuedStatus = `  ↳ ${pendingCalls.length} queued call(s) cancelled because this step failed\n`;
+                writeStatus(cancelledQueuedStatus, chalk.dim(cancelledQueuedStatus));
+                pendingCalls = [];
+            }
+            const output = result.output.trim();
+            const displayMax = 6_000;
+            // If the tool already produced an artifact (shell.exec now streams to one
+            // as it runs), respect that path. Otherwise, fall back to the post-hoc
+            // save for tools that return their full output in memory.
+            const savedOutputPath = result.outputPath ??
+                (output.length > displayMax
+                    ? await saveToolOutput(call, output)
+                    : undefined);
+            const resultWithArtifact = {
+                ...result,
+                outputPath: savedOutputPath,
+                truncated: result.truncated ?? Boolean(savedOutputPath),
+            };
+            const contextOutput = formatToolContext(call, resultWithArtifact);
+            emitToolResult(toolEventId, resultWithArtifact, contextOutput, savedOutputPath);
+            options.onToolResult?.(call, resultWithArtifact);
+            await auditLog("tool.result", {
+                call,
+                ok: result.ok,
+                exitCode: result.exitCode,
+                output: result.output.slice(0, 4_000),
             });
-            // Newline separator if live output or progress dots didn't already end with one.
-            if (liveBytes > 0 || liveTruncatedNotified) {
-                writeToolOutput(toolEventId, "\n", "\n");
+            // Record the attempt in the loop guard for dedup tracking.
+            loopGuard.recordAttempt(step, call.name, call.args, result.ok, result.exitCode);
+            // A tool actually executed this iteration — count it against the
+            // productive-step budget. Recovery iterations (thinking-only nudges,
+            // malformed-call retries, freshness/loop-guard prompts) reach `continue`
+            // before this point and therefore never consume the budget.
+            productiveSteps += 1;
+            // ── Auto-retry on "command not found" ──────────────────────────
+            // Detect missing tools and instruct the model to install + retry.
+            const NOT_FOUND_RE = /command not found|ENOENT.*spawn|is not recognized/i;
+            if (!result.ok && NOT_FOUND_RE.test(output)) {
+                const cmdName = call.name === "shell.exec"
+                    ? String(call.args.command ?? "").split(/\s+/)[0]
+                    : call.name === "net.scan"
+                        ? "nmap"
+                        : call.name === "image.ocr"
+                            ? "tesseract"
+                            : undefined;
+                if (cmdName) {
+                    writeNotice("warn", `${cmdName} not found — asking model to install and retry`, chalk.yellow(`  ⚠ ${cmdName} not found — asking model to install and retry\n`));
+                    messages.push({
+                        role: "tool",
+                        content: `Tool failed: "${cmdName}" is not installed.\n` +
+                            `You MUST: 1) use pkg.install to install "${cmdName}", ` +
+                            `2) then RETRY the original command. Do NOT stop or give up.`,
+                    });
+                    continue;
+                }
             }
-        }
-        catch (toolError) {
-            if (isAbortError(toolError, options.signal)) {
+            // ── Auto-retry on "a terminal is required" sudo error ──────────────
+            // Older Node versions and some non-TTY contexts can still surface the
+            // canonical sudo "a terminal is required" or "no askpass program"
+            // failure. Tell the model to retry through plain `sudo …` (which the
+            // shell tool now inherits stdin for) instead of getting clever with
+            // -S / askpass / piping a password.
+            const SUDO_NEEDS_TTY_RE = /sudo:\s+a terminal is required to read the password|sudo:\s+a password is required|no askpass program|sudo: \d+ incorrect password attempts|sudo:\s+(?:no tty present|sorry, you must have a tty)/i;
+            if (!result.ok && SUDO_NEEDS_TTY_RE.test(output)) {
+                writeNotice("warn", "sudo needs an interactive terminal — asking the model to retry without -S/askpass", chalk.yellow("  ⚠ sudo needs an interactive terminal — asking the model to retry without -S/askpass\n"));
+                messages.push({
+                    role: "tool",
+                    content: "Tool failed: sudo could not read a password.\n" +
+                        "On the next attempt: call shell.exec with `sudo <command>` directly. " +
+                        "clai inherits stdin from the user's terminal, so the user can type the password live. " +
+                        'DO NOT use `echo "<pwd>" | sudo -S`, DO NOT use SUDO_ASKPASS, DO NOT ask the user for the password in chat. ' +
+                        "Just run `sudo <command>` and the password prompt will be visible.",
+                });
+                continue;
+            }
+            // Print tool result
+            const statusIcon = result.ok ? chalk.green("  ✓") : chalk.red("  ✗");
+            writeToolOutput(toolEventId, result.ok ? "ok\n" : "failed\n", statusIcon + "\n");
+            if (output) {
+                const displaySummary = summarizeOutput(output, displayMax);
+                const displayText = displaySummary.truncated
+                    ? `${displaySummary.text}${savedOutputPath ? chalk.dim(`\n  ... full output saved to ${savedOutputPath}`) : chalk.dim("\n  ... output truncated")}`
+                    : displaySummary.text;
+                // If we already streamed live output for this call, skip re-printing
+                // the same bytes. Just note where the full output lives if it was saved.
+                if (liveBytes > 0) {
+                    if (savedOutputPath) {
+                        writeNotice("info", `full output saved to ${savedOutputPath}`, chalk.dim(`  full output saved to ${savedOutputPath}\n`));
+                    }
+                }
+                else {
+                    const renderedOutput = indentAndWrapText(displayText);
+                    writeToolOutput(toolEventId, displayText, styleToolChatter(call, renderedOutput) + "\n");
+                }
+            }
+            if (isAbortError(undefined, options.signal)) {
                 lastAnswer = "Aborted.";
                 writeAbort();
                 return lastAnswer;
             }
-            const errMsg = toolError instanceof Error ? toolError.message : String(toolError);
-            result = { ok: false, output: `Tool error: ${errMsg}`, exitCode: 1 };
-        }
-        // Stop-on-error: if this call failed, abandon any remaining queued calls
-        // from the same message so the model sees the failure and decides what to
-        // do next instead of blindly running steps that depended on it.
-        if (!result.ok && pendingCalls.length > 0) {
-            const cancelledQueuedStatus = `  ↳ ${pendingCalls.length} queued call(s) cancelled because this step failed\n`;
-            writeStatus(cancelledQueuedStatus, chalk.dim(cancelledQueuedStatus));
-            pendingCalls = [];
-        }
-        const output = result.output.trim();
-        const displayMax = 6_000;
-        // If the tool already produced an artifact (shell.exec now streams to one
-        // as it runs), respect that path. Otherwise, fall back to the post-hoc
-        // save for tools that return their full output in memory.
-        const savedOutputPath = result.outputPath ??
-            (output.length > displayMax
-                ? await saveToolOutput(call, output)
-                : undefined);
-        const resultWithArtifact = {
-            ...result,
-            outputPath: savedOutputPath,
-            truncated: result.truncated ?? Boolean(savedOutputPath),
-        };
-        const contextOutput = formatToolContext(call, resultWithArtifact);
-        emitToolResult(toolEventId, resultWithArtifact, contextOutput, savedOutputPath);
-        options.onToolResult?.(call, resultWithArtifact);
-        await auditLog("tool.result", {
-            call,
-            ok: result.ok,
-            exitCode: result.exitCode,
-            output: result.output.slice(0, 4_000),
-        });
-        // Record the attempt in the loop guard for dedup tracking.
-        loopGuard.recordAttempt(step, call.name, call.args, result.ok, result.exitCode);
-        // A tool actually executed this iteration — count it against the
-        // productive-step budget. Recovery iterations (thinking-only nudges,
-        // malformed-call retries, freshness/loop-guard prompts) reach `continue`
-        // before this point and therefore never consume the budget.
-        productiveSteps += 1;
-        // ── Auto-retry on "command not found" ──────────────────────────
-        // Detect missing tools and instruct the model to install + retry.
-        const NOT_FOUND_RE = /command not found|ENOENT.*spawn|is not recognized/i;
-        if (!result.ok && NOT_FOUND_RE.test(output)) {
-            const cmdName = call.name === "shell.exec"
-                ? String(call.args.command ?? "").split(/\s+/)[0]
-                : call.name === "net.scan"
-                    ? "nmap"
-                    : call.name === "image.ocr"
-                        ? "tesseract"
-                        : undefined;
-            if (cmdName) {
-                writeNotice("warn", `${cmdName} not found — asking model to install and retry`, chalk.yellow(`  ⚠ ${cmdName} not found — asking model to install and retry\n`));
-                messages.push({
-                    role: "tool",
-                    content: `Tool failed: "${cmdName}" is not installed.\n` +
-                        `You MUST: 1) use pkg.install to install "${cmdName}", ` +
-                        `2) then RETRY the original command. Do NOT stop or give up.`,
+            // Register a collapse/expand viewport so the user can pull the full raw
+            // output back with Ctrl+O or `/output last` after the AI summary lands.
+            if (output) {
+                const viewport = registerViewport({
+                    toolName: call.name,
+                    argsDisplay: formatToolArgs(call),
+                    artifactPath: savedOutputPath,
+                    summary: contextOutput,
                 });
-                continue;
+                // Only print the Ctrl+O hint when there's a real artifact file
+                // (large output saved to disk). Avoid spamming the hint for
+                // every tiny tool call — the user can always use /output last.
+                if (savedOutputPath) {
+                    const viewportHint = `${formatViewportHint(viewport)}\n`;
+                    writeStatus(viewportHint, viewportHint);
+                }
             }
-        }
-        // ── Auto-retry on "a terminal is required" sudo error ──────────────
-        // Older Node versions and some non-TTY contexts can still surface the
-        // canonical sudo "a terminal is required" or "no askpass program"
-        // failure. Tell the model to retry through plain `sudo …` (which the
-        // shell tool now inherits stdin for) instead of getting clever with
-        // -S / askpass / piping a password.
-        const SUDO_NEEDS_TTY_RE = /sudo:\s+a terminal is required to read the password|sudo:\s+a password is required|no askpass program|sudo: \d+ incorrect password attempts|sudo:\s+(?:no tty present|sorry, you must have a tty)/i;
-        if (!result.ok && SUDO_NEEDS_TTY_RE.test(output)) {
-            writeNotice("warn", "sudo needs an interactive terminal — asking the model to retry without -S/askpass", chalk.yellow("  ⚠ sudo needs an interactive terminal — asking the model to retry without -S/askpass\n"));
             messages.push({
                 role: "tool",
-                content: "Tool failed: sudo could not read a password.\n" +
-                    "On the next attempt: call shell.exec with `sudo <command>` directly. " +
-                    "clai inherits stdin from the user's terminal, so the user can type the password live. " +
-                    'DO NOT use `echo "<pwd>" | sudo -S`, DO NOT use SUDO_ASKPASS, DO NOT ask the user for the password in chat. ' +
-                    "Just run `sudo <command>` and the password prompt will be visible.",
+                content: `Tool ${call.name} result (exit=${result.exitCode ?? 0}, ok=${result.ok}):\n${contextOutput}`,
             });
-            continue;
-        }
-        // Print tool result
-        const statusIcon = result.ok ? chalk.green("  ✓") : chalk.red("  ✗");
-        writeToolOutput(toolEventId, result.ok ? "ok\n" : "failed\n", statusIcon + "\n");
-        if (output) {
-            const displaySummary = summarizeOutput(output, displayMax);
-            const displayText = displaySummary.truncated
-                ? `${displaySummary.text}${savedOutputPath ? chalk.dim(`\n  ... full output saved to ${savedOutputPath}`) : chalk.dim("\n  ... output truncated")}`
-                : displaySummary.text;
-            // If we already streamed live output for this call, skip re-printing
-            // the same bytes. Just note where the full output lives if it was saved.
-            if (liveBytes > 0) {
-                if (savedOutputPath) {
-                    writeNotice("info", `full output saved to ${savedOutputPath}`, chalk.dim(`  full output saved to ${savedOutputPath}\n`));
+            // Compact older messages when the running estimate exceeds budget so
+            // free-tier context windows are not blown by long pentest sessions.
+            if (estimateMessagesTokens(messages) > 24_000) {
+                const compacted = compactMessages(messages);
+                if (compacted.length < messages.length) {
+                    messages.splice(0, messages.length, ...compacted);
+                    await auditLog("agent.compact", {
+                        newLength: messages.length,
+                        estimatedTokens: estimateMessagesTokens(messages),
+                    });
                 }
             }
-            else {
-                const renderedOutput = indentAndWrapText(displayText);
-                writeToolOutput(toolEventId, displayText, styleToolChatter(call, renderedOutput) + "\n");
-            }
         }
-        if (isAbortError(undefined, options.signal)) {
-            lastAnswer = "Aborted.";
+        lastAnswer = `Stopped after ${productiveSteps} steps.`;
+        writeNotice("warn", lastAnswer, "  " + chalk.yellow(lastAnswer) + "\n");
+        return finishTurn(lastAnswer, productiveSteps);
+    }
+    catch (error) {
+        if (isAbortError(error, options.signal)) {
             writeAbort();
-            return lastAnswer;
+            return "Aborted.";
         }
-        // Register a collapse/expand viewport so the user can pull the full raw
-        // output back with Ctrl+O or `/output last` after the AI summary lands.
-        if (output) {
-            const viewport = registerViewport({
-                toolName: call.name,
-                argsDisplay: formatToolArgs(call),
-                artifactPath: savedOutputPath,
-                summary: contextOutput,
-            });
-            // Only print the Ctrl+O hint when there's a real artifact file
-            // (large output saved to disk). Avoid spamming the hint for
-            // every tiny tool call — the user can always use /output last.
-            if (savedOutputPath) {
-                const viewportHint = `${formatViewportHint(viewport)}\n`;
-                writeStatus(viewportHint, viewportHint);
-            }
-        }
-        messages.push({
-            role: "tool",
-            content: `Tool ${call.name} result (exit=${result.exitCode ?? 0}, ok=${result.ok}):\n${contextOutput}`,
+        emit({
+            type: "turn-error",
+            message: error instanceof Error ? error.message : String(error),
         });
-        // Compact older messages when the running estimate exceeds budget so
-        // free-tier context windows are not blown by long pentest sessions.
-        if (estimateMessagesTokens(messages) > 24_000) {
-            const compacted = compactMessages(messages);
-            if (compacted.length < messages.length) {
-                messages.splice(0, messages.length, ...compacted);
-                await auditLog("agent.compact", {
-                    newLength: messages.length,
-                    estimatedTokens: estimateMessagesTokens(messages),
-                });
-            }
-        }
+        throw error;
     }
-    lastAnswer = `Stopped after ${productiveSteps} steps.`;
-    writeNotice("warn", lastAnswer, "  " + chalk.yellow(lastAnswer) + "\n");
-    return finishTurn(lastAnswer, productiveSteps);
 }
 //# sourceMappingURL=runner.js.map