@pentoshi/clai 2.0.26 → 2.0.28

package/dist/agent/runner.js

@@ -4,17 +4,17 @@ import { mkdir, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { fixOwner, handlePermissionError } from "../os/permissions.js";
 import { join, resolve } from "node:path";
-import { streamWithProvider } from "../llm/router.js";
+import { streamWithProvider, completeWithProvider } from "../llm/router.js";
 import { randomUUID } from "node:crypto";
 import { jobManager } from "../tools/jobs.js";
 import { currentDateTimeContext, renderAgentSystemPrompt, } from "../prompts/index.js";
 import { getConfig } from "../store/config.js";
 import { classifyToolCall, isPentestToolCall, scopeHint, scopeTargetForToolCall, } from "../safety/classifier.js";
-import { availableToolNames, normalizeToolCall, runToolCall } from "../tools/registry.js";
+import { availableToolNames, normalizeToolCall, runToolCall, BATCH_SAFE_TOOLS, } from "../tools/registry.js";
 import { looksInteractiveStdin } from "../tools/shell.js";
 import { reduceToolOutput } from "../tools/policies/output-policy.js";
 import { formatViewportHint, registerViewport } from "../ui/output-pane.js";
-import { compactMessages, estimateMessagesTokens } from "./context-manager.js";
+import { compactMessagesWithSummary, estimateMessagesTokens, isCompactionMemoryMessage, } from "./context-manager.js";
 import { auditLog } from "../store/logs.js";
 import { loadProjectContext } from "../store/project.js";
 import { loadScope, isScopeActive, targetInScope } from "../store/scope.js";
@@ -36,11 +36,12 @@ function renderPlanForTerminal(plan) {
         : undefined;
     return side ?? renderPlanChecklist(plan);
 }
-export function createSessionPolicy() {
+export function createSessionPolicy(sessionId) {
     return {
         allow: new Set(),
         pentestAuthorized: { value: false },
-        sessionId: `sess-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`,
+        sessionId: sessionId ??
+            `sess-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`,
         planApproved: { value: false },
     };
 }
@@ -55,21 +56,21 @@ export function preprocessJson(raw) {
             result += char;
         }
         else if (inString) {
-            if (char === '\n') {
-                result += '\\n';
+            if (char === "\n") {
+                result += "\\n";
             }
-            else if (char === '\r') {
-                result += '\\r';
+            else if (char === "\r") {
+                result += "\\r";
             }
-            else if (char === '\t') {
-                result += '\\t';
+            else if (char === "\t") {
+                result += "\\t";
             }
             else {
                 result += char;
             }
         }
         else {
-            if (char === ',' && i + 1 < raw.length) {
+            if (char === "," && i + 1 < raw.length) {
                 let nextNonWs = "";
                 for (let j = i + 1; j < raw.length; j++) {
                     if (!/\s/.test(raw[j])) {
@@ -77,13 +78,13 @@ export function preprocessJson(raw) {
                         break;
                     }
                 }
-                if (nextNonWs === '}' || nextNonWs === ']') {
+                if (nextNonWs === "}" || nextNonWs === "]") {
                     continue;
                 }
             }
             result += char;
         }
-        if (char === '\\' && inString) {
+        if (char === "\\" && inString) {
             escaped = !escaped;
         }
         else {
@@ -92,24 +93,154 @@ export function preprocessJson(raw) {
     }
     return result;
 }
+/**
+ * Last-resort lenient repair for tool-call JSON that strict JSON.parse
+ * rejected. Models frequently emit "almost JSON": smart/curly quotes from a
+ * copy-paste, Python-style True/False/None literals, or an object that is
+ * wholly single-quoted. We only apply these transforms when a strict parse
+ * has already failed, so well-formed JSON is never touched.
+ */
+function lenientJsonParse(text) {
+    const candidates = [];
+    // 1. Normalize unicode/smart quotes to ASCII quotes.
+    const deSmart = text
+        .replace(/[\u201C\u201D\u201E\u2033]/g, '"')
+        .replace(/[\u2018\u2019\u201A\u2032]/g, "'");
+    candidates.push(deSmart);
+    // 2. Python/JS literals → JSON literals (outside of double-quoted strings).
+    candidates.push(replaceOutsideStrings(deSmart));
+    // 3. Single-quoted object → double-quoted (only when there are no double
+    //    quotes already, so we don't corrupt strings that contain apostrophes).
+    if (!deSmart.includes('"') && deSmart.includes("'")) {
+        candidates.push(deSmart.replace(/'/g, '"'));
+    }
+    for (const candidate of candidates) {
+        try {
+            return JSON.parse(preprocessJson(candidate).trim());
+        }
+        catch {
+            // try the next repair
+        }
+    }
+    return undefined;
+}
+/** Replace bare Python/JS literals (True/False/None/NaN) with JSON equivalents,
+ *  skipping anything inside a double-quoted string. */
+function replaceOutsideStrings(text) {
+    let inString = false;
+    let escaped = false;
+    let out = "";
+    let i = 0;
+    while (i < text.length) {
+        const ch = text[i];
+        if (inString) {
+            out += ch;
+            if (escaped)
+                escaped = false;
+            else if (ch === "\\")
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            i += 1;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            out += ch;
+            i += 1;
+            continue;
+        }
+        const rest = text.slice(i);
+        const m = /^(True|False|None|NaN|undefined)\b/.exec(rest);
+        if (m) {
+            const word = m[1];
+            out +=
+                word === "True"
+                    ? "true"
+                    : word === "False"
+                        ? "false"
+                        : word === "NaN"
+                            ? "0"
+                            : "null"; // None / undefined
+            i += word.length;
+            continue;
+        }
+        out += ch;
+        i += 1;
+    }
+    return out;
+}
 function tryParseCall(raw) {
+    let parsed;
     try {
-        const preprocessed = preprocessJson(raw);
-        const parsed = JSON.parse(preprocessed.trim());
-        if (typeof parsed.name === "string" &&
-            parsed.args &&
-            typeof parsed.args === "object") {
-            return {
-                name: parsed.name,
-                args: parsed.args,
-            };
-        }
+        parsed = JSON.parse(preprocessJson(raw).trim());
     }
     catch {
-        // not valid JSON
+        // Strict parse failed — try lenient repairs before giving up so a model
+        // that emits smart quotes / single quotes / Python literals still works.
+        const repaired = lenientJsonParse(raw.trim());
+        if (repaired && typeof repaired === "object" && !Array.isArray(repaired)) {
+            parsed = repaired;
+        }
+    }
+    if (!parsed)
+        return undefined;
+    const anyParsed = parsed;
+    // Accept name under several keys models commonly use.
+    const nameRaw = typeof parsed.name === "string"
+        ? parsed.name
+        : typeof anyParsed.tool_name === "string"
+            ? anyParsed.tool_name
+            : undefined;
+    if (typeof nameRaw === "string" && nameRaw.length > 0) {
+        // Strip a leading "functions." namespace some models add.
+        const name = nameRaw.replace(/^functions\./, "");
+        // Many OpenAI/Hermes/Qwen-trained models emit {"name","arguments"}
+        // (or "parameters"/"input") instead of {"name","args"} — accept any.
+        const argsSrc = pickObject(parsed.args) ??
+            pickObject(parsed.arguments) ??
+            pickObject(anyParsed.parameters) ??
+            pickObject(anyParsed.input);
+        if (argsSrc) {
+            return { name, args: argsSrc };
+        }
+        // Allow an empty args object explicitly written as {} or null (common for
+        // sysinfo), but do NOT invent args for objects that merely happen to
+        // contain a "name" key (e.g. {"name":"shell.exec"} with no command).
+        if (parsed.args === null || parsed.arguments === null) {
+            return { name, args: {} };
+        }
+        // Flattened form: the args are emitted as SIBLINGS of `name` rather than
+        // nested (e.g. {"name":"web.fetch","url":"…","responseMode":"raw"}). Treat
+        // the non-reserved keys as args, but only when at least one is a known
+        // tool-arg key so plain data objects carrying a `name` are not misread.
+        const flat = {};
+        for (const key of Object.keys(anyParsed)) {
+            if (!FLATTENED_RESERVED_KEYS.has(key))
+                flat[key] = anyParsed[key];
+        }
+        const flatKeys = Object.keys(flat);
+        if (flatKeys.length > 0 && flatKeys.some((k) => TOOL_ARG_KEYS.has(k))) {
+            return { name, args: flat };
+        }
     }
     return undefined;
 }
+// Keys that name the tool or wrap its arguments — excluded when recovering a
+// flattened tool call whose args sit alongside `name`.
+const FLATTENED_RESERVED_KEYS = new Set([
+    "name",
+    "tool_name",
+    "args",
+    "arguments",
+    "parameters",
+    "input",
+]);
+function pickObject(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
 // Kimi K2 / Moonshot models on NVIDIA NIM emit tool calls using a
 // sentinel-token format that looks like:
 //   <|tool_calls_section_begin|>
@@ -127,13 +258,56 @@ function parseKimiToolCall(text) {
     const name = match[1];
     return tryParseCall(JSON.stringify({ name, args: tryJson(match[2]) ?? {} }));
 }
+// Recognized XML-ish tool-call wrappers some models emit (with or without a
+// matching close tag). Used so we can recover a call even when the model
+// forgot the closing tag, while plain prose never matches.
+const XML_BLOCK_OPENERS = /<tool_call>|<function_calls>|<invoke>|<ant:invoke>/i;
+/**
+ * Scan `text` starting at the index of the first `{`, returning the balanced
+ * JSON substring (respecting strings) or undefined if braces never balance.
+ * Lets us recover a tool-call JSON object the model emitted without a closing
+ * wrapper tag, where a non-greedy regex would stop at the first inner brace.
+ */
+function extractBalancedJson(text) {
+    const start = text.indexOf("{");
+    if (start < 0)
+        return undefined;
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = start; i < text.length; i += 1) {
+        const ch = text[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === "\\") {
+            escaped = true;
+            continue;
+        }
+        if (ch === '"') {
+            inString = !inString;
+            continue;
+        }
+        if (inString)
+            continue;
+        if (ch === "{")
+            depth += 1;
+        else if (ch === "}") {
+            depth -= 1;
+            if (depth === 0)
+                return text.slice(start, i + 1);
+        }
+    }
+    return undefined;
+}
 function parseXmlToolCall(text) {
-    // Pattern 1:
-    // <tool_call>
+    // Pattern 1 (name + args/arguments/parameters JSON):
+    //  <tool_call>
     // <name>tool.name</name>
-    // <args>{...}</args>
-    // </tool_call>
-    const xmlNameArgs = text.match(/<tool_call>[\s\S]*?<name>\s*([\w.]+?)\s*<\/name>\s*<args>\s*(\{[\s\S]*?\})\s*<\/args>[\s\S]*?<\/tool_call>/i);
+    // <args>{...}</args>   (or <arguments> / <parameters>)
+    //  <tool_call>
+    const xmlNameArgs = text.match(/<tool_call>[\s\S]*?<name>\s*([\w.]+?)\s*<\/name>\s*<(?:args|arguments|parameters)>\s*(\{[\s\S]*?\})\s*<\/(?:args|arguments|parameters)>[\s\S]*?<\/tool_call>/i);
     if (xmlNameArgs?.[1] && xmlNameArgs?.[2]) {
         try {
             const args = JSON.parse(preprocessJson(xmlNameArgs[2]));
@@ -145,11 +319,11 @@ function parseXmlToolCall(text) {
         catch { }
     }
     // Pattern 1b (MiMo alternative):
-    // <tool_call>
+    //  <tool_call>
     // <tool_name>tool.name</tool_name>
-    // <parameters>{...}</parameters>
-    // </tool_call>
-    const xmlToolNameParams = text.match(/<tool_call>[\s\S]*?<tool_name>\s*([\w.]+?)\s*<\/tool_name>\s*<parameters>\s*(\{[\s\S]*?\})\s*<\/parameters>[\s\S]*?<\/tool_call>/i);
+    // <parameters>{...}</parameters>   (or <arguments> / <args>)
+    //  <tool_call>
+    const xmlToolNameParams = text.match(/<tool_call>[\s\S]*?<tool_name>\s*([\w.]+?)\s*<\/tool_name>\s*<(?:parameters|arguments|args)>\s*(\{[\s\S]*?\})\s*<\/(?:parameters|arguments|args)>[\s\S]*?<\/tool_call>/i);
     if (xmlToolNameParams?.[1] && xmlToolNameParams?.[2]) {
         try {
             const args = JSON.parse(preprocessJson(xmlToolNameParams[2]));
@@ -160,13 +334,12 @@ function parseXmlToolCall(text) {
         }
         catch { }
     }
-    // Pattern 1c (MiMo function/parameter format):
-    // <tool_call>
+    // Pattern 1c (MiMo function/parameter format), with or WITHOUT a
+    // surrounding <tool_call> wrapper (some models emit the bare function block):
     // <function=tool.name>
     // <parameter=name>value</parameter>
     // </function>
-    // </tool_call>
-    const xmlFunctionBlock = text.match(/<tool_call>[\s\S]*?<function=([\w.]+?)>([\s\S]*?)<\/function>[\s\S]*?<\/tool_call>/i);
+    const xmlFunctionBlock = text.match(/<function=([\w.]+?)>([\s\S]*?)<\/function>/i);
     if (xmlFunctionBlock?.[1] && xmlFunctionBlock?.[2]) {
         const name = xmlFunctionBlock[1];
         const inner = xmlFunctionBlock[2];
@@ -187,17 +360,55 @@ function parseXmlToolCall(text) {
         }
         return { name, args };
     }
-    // Pattern 2:
-    // <tool_call>
-    // <tool>
-    // {"name": "...", "args": {...}}
-    // </tool_call>
-    // or simply <tool_call> {"name": "...", "args": {...}} </tool_call>
-    const xmlJson = text.match(/<tool_call>[\s\S]*?(?:<tool>)?\s*(\{[\s\S]*?\})\s*<\/tool_call>/i);
-    if (xmlJson?.[1]) {
-        const call = tryParseCall(xmlJson[1]);
-        if (call)
-            return call;
+    // Pattern 2: JSON object inside a recognized wrapper (closed). The wrapper
+    // may be the tool_call sentinel, <function_calls>, or <invoke>/<ant:invoke>.
+    // Backtracking off the closing tag handles nested {} in the args.
+    const wrappers = [
+        "<tool_call>",
+        "<function_calls>",
+        "<invoke>",
+        "<ant:invoke>",
+    ];
+    for (const open of wrappers) {
+        const close = open === "<function_calls>"
+            ? "</function_calls>"
+            : open === "<invoke>"
+                ? "</invoke>"
+                : open === "<ant:invoke>"
+                    ? "</ant:invoke>"
+                    : "</tool_call>";
+        const re = new RegExp(open.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") +
+            "[\\s\\S]*?(?:<tool>)?\\s*(\\{[\\s\\S]*?\\})\\s*" +
+            close.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i");
+        const match = text.match(re);
+        if (match?.[1]) {
+            const call = tryParseCall(match[1]);
+            if (call)
+                return call;
+        }
+    }
+    // Pattern 3: a recognized opener is present but there is no matching close
+    // (model forgot it, or the stream was cut). Use a balanced brace scan from
+    // the first `{` after the opener so nested args survive, then try to parse.
+    const openerMatch = XML_BLOCK_OPENERS.exec(text);
+    if (openerMatch) {
+        const after = text.slice(openerMatch.index + openerMatch[0].length);
+        const json = extractBalancedJson(after);
+        if (json) {
+            const call = tryParseCall(json);
+            if (call)
+                return call;
+        }
+        // Also try the <name>...</name><arguments>{...}</arguments> tag shape
+        // without a closing wrapper (Hermes/Qwen often omit it).
+        const tagShape = after.match(/<name>\s*([\w.]+?)\s*<\/name>\s*<(?:args|arguments|parameters)>\s*(\{[\s\S]*?\})\s*<\/(?:args|arguments|parameters)>/i);
+        if (tagShape?.[1] && tagShape?.[2]) {
+            try {
+                const args = JSON.parse(preprocessJson(tagShape[2]));
+                return { name: tagShape[1], args: args };
+            }
+            catch { }
+        }
     }
     return undefined;
 }
@@ -568,8 +779,32 @@ export function parseAllToolCalls(text) {
         if (call)
             found.push({ index: m.index, call });
     }
+    // Bare <function=name>…</function> blocks (no <tool_call> wrapper) — some
+    // models emit one or several of these. Route each through parseXmlToolCall
+    // so the <parameter=…> args are decoded. Skip any that overlap a
+    // <tool_call> block already captured above (avoid double-counting).
+    const fnRe = /<function=[\w.]+?>[\s\S]*?<\/function>/gi;
+    while ((m = fnRe.exec(text)) !== null) {
+        const alreadyCaptured = found.some((f) => m.index >= f.index && m.index < f.index + 12);
+        const overlapsToolCall = /<tool_call>/i.test(text.slice(Math.max(0, m.index - 24), m.index));
+        if (alreadyCaptured || overlapsToolCall)
+            continue;
+        const call = parseXmlToolCall(m[0]);
+        if (call)
+            found.push({ index: m.index, call });
+    }
     found.sort((a, b) => a.index - b.index);
-    return found.map((f) => f.call);
+    // De-duplicate calls that two different matchers picked up at (nearly) the
+    // same spot so a single XML call isn't executed twice.
+    const deduped = [];
+    for (const entry of found) {
+        if (deduped.some((d) => sameToolCall(d.call, entry.call) &&
+            Math.abs(d.index - entry.index) < 64)) {
+            continue;
+        }
+        deduped.push(entry);
+    }
+    return deduped.map((f) => f.call);
 }
 /** Structural equality for two tool calls (name + canonical args JSON). */
 export function sameToolCall(a, b) {
@@ -582,6 +817,54 @@ export function sameToolCall(a, b) {
         return false;
     }
 }
+/**
+ * Partition a batch of tool calls (in document order) into execution groups.
+ * A run of consecutive parallel-safe calls forms one group to be run
+ * concurrently (bounded by maxGroupSize); every non-parallel-safe call is its
+ * own single-element group, i.e. a sequential barrier. Because plan updates
+ * and side-effecting tools are never parallel-safe, they always split the
+ * batch — which keeps parallelism scoped within a single task and prevents
+ * plan-state races and overlapping writes.
+ */
+export function groupToolCallsForExecution(calls, isParallelSafe, maxGroupSize = 4) {
+    const groups = [];
+    let cursor = 0;
+    while (cursor < calls.length) {
+        const group = [calls[cursor]];
+        if (isParallelSafe(calls[cursor])) {
+            let j = cursor + 1;
+            while (j < calls.length &&
+                group.length < maxGroupSize &&
+                isParallelSafe(calls[j])) {
+                group.push(calls[j]);
+                j += 1;
+            }
+        }
+        groups.push(group);
+        cursor += group.length;
+    }
+    return groups;
+}
+/**
+ * Build the conversation to hand back to the caller at turn end. Strips system
+ * prompts (they're re-added each turn) but keeps the user turn plus every
+ * assistant tool-call and tool result, then appends the final answer if it
+ * isn't already the last message. Persisting this is what lets a resumed
+ * session give the model back what it actually did — commands, outputs, and
+ * results — instead of only its prose answers.
+ */
+export function buildTurnHistory(messages, answer) {
+    // Drop system messages (the main prompt, plan context, and reflections are
+    // all re-injected each turn) EXCEPT compacted session memory, which is the
+    // only record of summarized older turns and must survive a resume.
+    const convo = messages.filter((m) => m.role !== "system" || isCompactionMemoryMessage(m));
+    const last = convo[convo.length - 1];
+    if (answer &&
+        !(last && last.role === "assistant" && last.content === answer)) {
+        convo.push({ role: "assistant", content: answer });
+    }
+    return convo;
+}
 /**
  * Collapse pathological repetition before a message is stored in history.
  * Some models degenerate into emitting the same short phrase hundreds of
@@ -621,7 +904,7 @@ function textBeforeToolCall(text) {
     }
     return text.trim();
 }
-function formatToolArgs(call) {
+export function formatToolArgs(call) {
     if (call.name === "shell.exec")
         return String(call.args.command ?? "");
     if (call.name === "net.scan")
@@ -844,17 +1127,17 @@ function buildWorkflowDirective() {
         "1. EXPLORE: fs.list the working directory (and key subdirs) to see what already exists. Use tool.batch to parallelize reads.",
         "2. UNDERSTAND: fs.read the files that matter (like package.json for js related and same for other languages too, config, entry points, existing components). Detect the existing stack/tooling and MATCH it. If the dir is empty or only has a stub, start fresh with a sensible modern default and say so.",
         "3. PLAN: call plan.create with a COMPREHENSIVE plan — a detailed `detail` (stack chosen and WHY, architecture, how you'll verify) and 4-8 SEPARATE, ordered, high-quality tasks. The FIRST task initializes the project (scaffolder); the MIDDLE tasks MUST implement the ACTUAL FEATURE the user asked for by REPLACING the scaffolder's boilerplate (e.g. rewrite src/App.jsx into the real todo/blog/etc. UI, add components, state, styles); the LAST task verifies with a build. Scaffolding + install + run ALONE is NOT acceptable — that just leaves the Vite starter page. Each task is one distinct, verifiable action. Then STOP and wait for the user to /implement.",
-        "4. IMPLEMENT: once approved, work task by task in STRICT ORDER. For each task: call task.update {taskId, state:'in_progress'} → do the real work → VERIFY it actually succeeded (read a file you wrote, check the command's exit/output) → call task.update {taskId, state:'done'}, then move to the NEXT task. You MAY emit several tool calls in one message and they run in order, top to bottom (the batch STOPS if one fails). A clean rhythm is: task.update in_progress + the work + task.update done together. Keep going until EVERY task is done. Do NOT claim work you didn't actually run.",
+        "4. IMPLEMENT: once approved, work task by task in STRICT ORDER. For each task: call task.update {taskId, state:'in_progress'} → do the real work → VERIFY it actually succeeded (read a file you wrote, check the command's exit/output) → call task.update {taskId, state:'done'}, then move to the NEXT task. You MAY emit several tool calls in one message; they run in document order (independent read-only lookups run in parallel, while task.update and any write/command runs one at a time), and the batch STOPS if one fails. Keep every batch scoped to ONE task. A clean rhythm is: task.update in_progress + the work + task.update done together. Keep going until EVERY task is done. Do NOT claim work you didn't actually run.",
         "",
         "INITIALIZE WITH THE OFFICIAL SCAFFOLDER FIRST (do NOT hand-write build configs):",
-        "- React/Vue/Svelte/vanilla → `npm create vite@latest <appname> -- --template react` (templates: react, react-ts, vue, vue-ts, svelte, vanilla). Next.js → `npx --yes create-next-app@latest <appname> --yes --eslint --no-tailwind --app --src-dir --import-alias \"@/*\"`. Node API → `npm init -y`.",
+        '- React/Vue/Svelte/vanilla → `npm create vite@latest <appname> -- --template react` (templates: react, react-ts, vue, vue-ts, svelte, vanilla). Next.js → `npx --yes create-next-app@latest <appname> --yes --eslint --no-tailwind --app --src-dir --import-alias "@/*"`. Node API → `npm init -y`.',
         "- GET THE TEMPLATE FLAG RIGHT. With `npm create vite@latest NAME -- --template react` the `--` IS required (it forwards --template to create-vite). With `npx create-vite@latest NAME --template react` do NOT add `--` (npx passes args straight through, so `-- --template react` makes npx DROP the flag and you silently get the WRONG, vanilla template). Pick ONE form and keep the template flag attached. After scaffolding, fs.read the generated index.html / src entry to CONFIRM you got React (a src/main.jsx + App.jsx, not a vanilla main.js/counter.js). If it's the wrong template, delete the folder and re-run with the correct command.",
         "- RUN SCAFFOLDERS NON-INTERACTIVELY and into a NEW SUBFOLDER (`<appname>`). Scaffolders REFUSE to run in a non-empty directory and then print 'Operation cancelled' — and the current dir frequently already has a file like .DS_Store. So scaffold into a subfolder (always works). `--yes` does NOT fix the non-empty-dir cancel; a subfolder does. NEVER background a scaffolder with `&` or pipe `yes |` into it.",
-        "- If a scaffolder cannot be driven non-interactively or keeps failing, FALL BACK to hand-writing a minimal Vite setup (package.json with \"type\":\"module\", @vitejs/plugin-react, index.html that loads /src/main.jsx, src/main.jsx, src/App.jsx) then `npm install`. That never prompts and you control every file.",
+        '- If a scaffolder cannot be driven non-interactively or keeps failing, FALL BACK to hand-writing a minimal Vite setup (package.json with "type":"module", @vitejs/plugin-react, index.html that loads /src/main.jsx, src/main.jsx, src/App.jsx) then `npm install`. That never prompts and you control every file.',
         "- VERIFY the init actually worked before marking the task done: fs.read package.json (it must now exist AND list react + react-dom) and fs.read index.html (it must reference your jsx entry). 'Operation cancelled' / non-zero exit means the task FAILED — do not proceed as if it succeeded.",
         "",
         "CRITICAL RULES during IMPLEMENTATION:",
-        "- You may batch tool calls: emit one or several ```tool blocks in a message and they run in order, top to bottom. If any call fails, the rest of that batch is cancelled so you can react — so order dependent steps correctly and keep batches focused. A good batch is task.update(in_progress) + the work + task.update(done) for ONE task.",
+        "- You may batch tool calls: emit one or several ```tool blocks in a message. They run in document order — independent READ-ONLY lookups (fs.read/list/search, dns/whois, http.fetch GET, web.search/fetch, sysinfo) run in parallel, while task.update and any write/command (fs.write*, shell.exec, pkg.install, net.scan) run one at a time. If any call fails, the rest of that batch is cancelled so you can react — so order dependent steps correctly and keep every batch scoped to ONE task. A good batch is task.update(in_progress) + the work + task.update(done) for ONE task.",
         "- Do NOT re-explore. Step 1 (EXPLORE) was already completed during planning. Start executing the first pending task immediately.",
         "- ONE task at a time, in ORDER. Do NOT skip ahead to task 3 before task 2 is done.",
         "- KEEP EACH FILE SMALL ENOUGH TO WRITE IN ONE CALL. If a fs.write is reported as 'cut off (output too long)', the file was NOT fully written and is likely broken/invalid — re-write it, splitting a large component into smaller files if needed. NEVER leave a half-written file and move on.",
@@ -1033,15 +1316,51 @@ function summarizeOutput(output, maxChars = 8_000) {
         truncated: true,
     };
 }
+// Tools whose output is the actual content the model needs verbatim (file
+// bodies, listings, search hits). Running these through the security-signal
+// `genericReducer` was wrong: it ranks lines by pentest keywords and drops
+// the rest, so source code came back as a fragmentary head+tail — the model
+// saw a "truncated" file and kept re-reading it in wasted retries. For these
+// we pass the raw content through (up to a generous cap) and point the model
+// at the saved artifact when it exceeds the cap.
+const PASSTHROUGH_TOOLS = new Set([
+    "fs.read",
+    "fs.list",
+    "fs.search",
+    "fs.edit",
+    "pdf.read",
+]);
+const PASSTHROUGH_CAP_CHARS = 400_000;
+// web.fetch/http.fetch pull in arbitrary third-party pages/API responses that
+// can be hundreds of KB (e.g. a large OpenAPI spec). Unlike local files the
+// model asked to read, this content is never bounded by the user's own
+// project, so it must be capped like every other tool's context output —
+// otherwise a single fetch can single-handedly blow the context budget and
+// starve the model of room to actually respond (observed as empty/garbled
+// completions on smaller-context-window models after a big fetch).
+const WEB_FETCH_CAP_CHARS = 20_000;
 function formatToolContext(call, result) {
     const output = result.output.trim();
     if (!output)
         return "";
     if (call.name === "web.fetch" || call.name === "http.fetch") {
+        const { text, truncated } = summarizeOutput(output, WEB_FETCH_CAP_CHARS);
+        if (!truncated)
+            return text;
         const saved = result.outputPath
-            ? `\nFull output saved to: ${result.outputPath}`
-            : "";
-        return `${output}${saved}`.trim();
+            ? `\n\n[Response exceeds ${WEB_FETCH_CAP_CHARS.toLocaleString()} chars; showing the head and tail. The FULL response is saved at: ${result.outputPath} — re-fetch a narrower URL or read the saved file if you need the middle.]`
+            : `\n\n[Response exceeds ${WEB_FETCH_CAP_CHARS.toLocaleString()} chars; only head and tail shown.]`;
+        return `${text}${saved}`.trim();
+    }
+    // Pass-through tools: never reduce — the model needs the real content.
+    if (PASSTHROUGH_TOOLS.has(call.name)) {
+        const { text, truncated } = summarizeOutput(output, PASSTHROUGH_CAP_CHARS);
+        if (!truncated)
+            return text;
+        const saved = result.outputPath
+            ? `\n\n[File content exceeds ${PASSTHROUGH_CAP_CHARS.toLocaleString()} chars; showing the head and tail. The FULL content is saved at: ${result.outputPath} — re-read specific line ranges with fs.read if you need the middle.]`
+            : `\n\n[File content exceeds ${PASSTHROUGH_CAP_CHARS.toLocaleString()} chars; only head and tail shown. Read it in smaller chunks if the middle is needed.]`;
+        return `${text}${saved}`.trim();
     }
     let reduced;
     try {
@@ -1083,6 +1402,13 @@ const inquirerConfirmPort = {
             default: true,
         });
     },
+    async confirmAgentSwitch(info) {
+        const tools = info.tools.length > 0 ? ` (${info.tools.join(", ")})` : "";
+        return confirm({
+            message: chalk.yellow(`  this needs agent mode${tools} — switch and run it?`),
+            default: true,
+        });
+    },
 };
 async function ensurePentestAuthorization(call, autoConfirm, session, confirmPort) {
     if (!isPentestToolCall(call))
@@ -1247,6 +1573,24 @@ async function handlePlanTool(call, session, ctx) {
             modelNote: `task.update failed: state must be one of ${validStates.join(", ")}.`,
         };
     }
+    // Only one task may be in_progress at a time. This forces genuine
+    // task-by-task execution: the model must close (done/failed/skipped) the
+    // current task before opening the next one, instead of leaving a task
+    // "in_progress" as an umbrella while it quietly works through the rest
+    // of the plan underneath it.
+    if (stateRaw === "in_progress") {
+        const otherInProgress = plan.tasks.find((t) => t.id !== taskId && t.state === "in_progress");
+        if (otherInProgress) {
+            return {
+                handled: true,
+                ok: false,
+                display: chalk.red(`  \u2717 task.update: task [${otherInProgress.id}] "${otherInProgress.title}" is still in_progress\n`),
+                modelNote: `task.update failed: task [${otherInProgress.id}] "${otherInProgress.title}" is still in_progress. ` +
+                    "Finish it first \u2014 call task.update with state 'done' (or 'failed'/'skipped' with a note) " +
+                    `for [${otherInProgress.id}] before starting [${taskId}].`,
+            };
+        }
+    }
     const ok = markTask(plan, taskId, stateRaw, note);
     if (!ok) {
         const ids = plan.tasks.map((t) => t.id).join(", ");
@@ -1351,7 +1695,19 @@ export async function runAgentLoop(prompt, options = {}) {
         }
         emit(event);
     };
+    // Points at the live message array so finishTurn can hand the full
+    // conversation back to the caller. Assigned once `messages` is built below;
+    // all later mutations are in-place so this reference stays current.
+    let liveMessages = [];
     const finishTurn = (answer, steps) => {
+        if (options.onMessages) {
+            try {
+                options.onMessages(buildTurnHistory(liveMessages, answer));
+            }
+            catch {
+                // Persisting history must never break the turn.
+            }
+        }
         emit({ type: "turn-end", finalAnswer: answer, steps });
         return answer;
     };
@@ -1417,6 +1773,7 @@ export async function runAgentLoop(prompt, options = {}) {
             ...(options.history ?? []),
             userMessage,
         ];
+        liveMessages = messages;
         const recoveryUserMessage = (content) => {
             const message = { role: "user", content };
             if (options.images && options.images.length > 0) {
@@ -1513,12 +1870,14 @@ export async function runAgentLoop(prompt, options = {}) {
             promise: Promise.resolve(),
             async acquire() {
                 let release = () => { };
-                const next = new Promise((r) => { release = r; });
+                const next = new Promise((r) => {
+                    release = r;
+                });
                 const current = this.promise;
                 this.promise = current.then(() => next);
                 await current;
                 return release;
-            }
+            },
         };
         async function executeSingleTool(rawCall, toolEventId, parentSignal) {
             let call = normalizeToolCall(rawCall);
@@ -1537,20 +1896,34 @@ export async function runAgentLoop(prompt, options = {}) {
                 const reason = `${call.name} was already called with the same arguments — ${isWrite ? "moving on" : "forcing summary"}`;
                 writeNotice("warn", reason, chalk.yellow(`  ⚠ ${reason}\n`));
                 const result = { ok: false, output: reason, exitCode: 1 };
-                return { ok: false, call, result, contextOutput: reason, blockOrCancel: true };
+                return {
+                    ok: false,
+                    call,
+                    result,
+                    contextOutput: reason,
+                    blockOrCancel: true,
+                };
             }
             if (loopCheck.reason) {
                 writeNotice("info", loopCheck.reason, chalk.dim(`  ℹ ${loopCheck.reason}\n`));
             }
             if (call.name === "plan.create" || call.name === "task.update") {
-                const planResult = await handlePlanTool(call, session, { loopGuard, step });
+                const planResult = await handlePlanTool(call, session, {
+                    loopGuard,
+                    step,
+                });
                 if (planResult.handled) {
                     loopGuard.recordAttempt(step, call.name, call.args, planResult.ok, 0);
                     if (planResult.plan) {
                         writePlanUpdate(planResult.plan, planResult.display);
                     }
                     const result = { ok: planResult.ok, output: planResult.modelNote };
-                    return { ok: planResult.ok, call, result, contextOutput: planResult.modelNote };
+                    return {
+                        ok: planResult.ok,
+                        call,
+                        result,
+                        contextOutput: planResult.modelNote,
+                    };
                 }
             }
             const scope = await loadScope();
@@ -1566,7 +1939,45 @@ export async function runAgentLoop(prompt, options = {}) {
                 const reason = `plan awaiting approval — ${call.name} is blocked until you /implement (or /discard)`;
                 writeNotice("warn", reason, chalk.yellow(`  ⚠ ${reason}\n`));
                 const result = { ok: false, output: reason, exitCode: 1 };
-                return { ok: false, call, result, contextOutput: reason, blockOrCancel: true };
+                return {
+                    ok: false,
+                    call,
+                    result,
+                    contextOutput: reason,
+                    blockOrCancel: true,
+                };
+            }
+            // ── Task-scoped execution gate ───────────────────────────────────
+            // Once a plan is approved, every non-plan tool call must run while
+            // exactly one task is "in_progress". This stops a model from batching
+            // tool calls for many/all tasks in one turn and only touching task
+            // state at the very end (or never) — the failure mode where a model
+            // claimed most tasks "done" in prose without ever recording it in the
+            // plan. Multiple tool calls per task are still fine; they just must be
+            // bracketed by task.update in_progress → (work) → task.update done.
+            if (session.planApproved.value) {
+                const livePlanForGate = await loadPlan(session.sessionId).catch(() => undefined);
+                if (livePlanForGate) {
+                    const unfinished = livePlanForGate.tasks.some((t) => t.state === "pending" || t.state === "in_progress");
+                    const inProgress = livePlanForGate.tasks.find((t) => t.state === "in_progress");
+                    if (unfinished && !inProgress) {
+                        const nextPending = livePlanForGate.tasks.find((t) => t.state === "pending");
+                        const reason = nextPending
+                            ? `${call.name} blocked — no task is in_progress. Call task.update {taskId:"${nextPending.id}", state:"in_progress"} before doing any work for it.`
+                            : `${call.name} blocked — no task is in_progress.`;
+                        writeNotice("warn", reason, chalk.yellow(`  ⚠ ${reason}\n`));
+                        const result = { ok: false, output: reason, exitCode: 1 };
+                        // Recoverable ordering mistake (NOT a user/session control gate):
+                        // feed the reason back so the model marks the task in_progress and
+                        // retries within the same turn, rather than ending the turn.
+                        return {
+                            ok: false,
+                            call,
+                            result,
+                            contextOutput: `${reason}\nThis tool did NOT run. Emit task.update {state:"in_progress"} for the task first, then the work.`,
+                        };
+                    }
+                }
             }
             if (call.name === "web.search") {
                 sawFreshWebSearch = true;
@@ -1580,9 +1991,20 @@ export async function runAgentLoop(prompt, options = {}) {
             }
             if (decision.level === "block") {
                 writeToolBlocked(toolEventId, call.name, decision.reason, chalk.red(`  ✗ blocked: ${decision.reason}`) + "\n");
-                const lastAnswer = `Blocked: ${call.name} — ${decision.reason}`;
-                const result = { ok: false, output: lastAnswer, exitCode: 1 };
-                return { ok: false, call, result, contextOutput: lastAnswer, lastAnswer, blockOrCancel: true };
+                const message = `Blocked: ${call.name} — ${decision.reason}`;
+                const result = { ok: false, output: message, exitCode: 1 };
+                // Safety classifier blocks are recoverable model mistakes: feed the
+                // failed result back to the model and let it choose a safer next step
+                // instead of ending the entire agent turn. Hard workflow gates
+                // (plan not approved, task not in_progress, auth declined, aborts)
+                // still use blockOrCancel above/below because continuing would violate
+                // user/session control rather than merely correcting a bad command.
+                return {
+                    ok: false,
+                    call,
+                    result,
+                    contextOutput: `${message}\nThis tool call did not run. Continue the task using a safer allowed method; do not retry the same blocked command unchanged.`,
+                };
             }
             let authorized = true;
             let pentestJustConfirmed = false;
@@ -1598,7 +2020,14 @@ export async function runAgentLoop(prompt, options = {}) {
                     const lastAnswer = "Pentest authorization not confirmed.";
                     writeToolBlocked(toolEventId, call.name, lastAnswer, chalk.red(`  ✗ ${lastAnswer}`) + "\n");
                     const result = { ok: false, output: lastAnswer, exitCode: 1 };
-                    return { ok: false, call, result, contextOutput: lastAnswer, lastAnswer, blockOrCancel: true };
+                    return {
+                        ok: false,
+                        call,
+                        result,
+                        contextOutput: lastAnswer,
+                        lastAnswer,
+                        blockOrCancel: true,
+                    };
                 }
                 if (needsPentestAuth) {
                     pentestJustConfirmed = true;
@@ -1608,9 +2037,17 @@ export async function runAgentLoop(prompt, options = {}) {
                     !isPreApprovalAllowedTool(call.name)) {
                     const pathArg = typeof call.args.path === "string" ? call.args.path : undefined;
                     if (pathArg) {
-                        const expandHomeLocal = (p) => p.startsWith("~/") || p.startsWith("~\\") ? join(homedir(), p.slice(2)) : p === "~" ? homedir() : p;
+                        const expandHomeLocal = (p) => p.startsWith("~/") || p.startsWith("~\\")
+                            ? join(homedir(), p.slice(2))
+                            : p === "~"
+                                ? homedir()
+                                : p;
                         const resolved = resolve(expandHomeLocal(pathArg));
-                        const mode = (call.name === "fs.read" || call.name === "fs.list" || call.name === "fs.search") ? "read" : "write";
+                        const mode = call.name === "fs.read" ||
+                            call.name === "fs.list" ||
+                            call.name === "fs.search"
+                            ? "read"
+                            : "write";
                         if (!pathInsideSandbox(resolved, mode)) {
                             forceManualConfirm = true;
                         }
@@ -1623,7 +2060,14 @@ export async function runAgentLoop(prompt, options = {}) {
                         const lastAnswer = "Cancelled.";
                         writeNotice("warn", "cancelled", chalk.yellow(`  ✗ cancelled`) + "\n");
                         const result = { ok: false, output: lastAnswer, exitCode: 1 };
-                        return { ok: false, call, result, contextOutput: lastAnswer, lastAnswer, blockOrCancel: true };
+                        return {
+                            ok: false,
+                            call,
+                            result,
+                            contextOutput: lastAnswer,
+                            lastAnswer,
+                            blockOrCancel: true,
+                        };
                     }
                 }
             }
@@ -1715,7 +2159,13 @@ export async function runAgentLoop(prompt, options = {}) {
                 jobManager.updateJobStatus(jobId, "failed", 1);
                 if (isAbortError(toolError, toolAc.signal)) {
                     writeAbort();
-                    return { ok: false, call, result: { ok: false, output: "Aborted." }, contextOutput: "Aborted.", lastAnswer: "Aborted." };
+                    return {
+                        ok: false,
+                        call,
+                        result: { ok: false, output: "Aborted." },
+                        contextOutput: "Aborted.",
+                        lastAnswer: "Aborted.",
+                    };
                 }
                 const errMsg = toolError instanceof Error ? toolError.message : String(toolError);
                 result = { ok: false, output: `Tool error: ${errMsg}`, exitCode: 1 };
@@ -1794,6 +2244,81 @@ export async function runAgentLoop(prompt, options = {}) {
             }
             return { ok: result.ok, call, result, contextOutput };
         }
+        // ── Automatic context compaction ───────────────────────────────────────
+        // As a long turn accumulates tool outputs and reasoning, the context can
+        // grow past what the model can hold. We proactively summarize the older
+        // turns into a single continuation memory (the SAME model-written summary
+        // the /compact command uses — never a mechanical transcript dump) and then
+        // re-inject the ACTIVE PLAN so the agent never loses track of the plan,
+        // what is done, and what remains. The estimate is chars/4; the budget is
+        // deliberately conservative so we compact a little early rather than hit a
+        // provider context-window error mid-task.
+        const AUTO_COMPACT_TOKEN_BUDGET = 60_000;
+        const AUTO_COMPACT_KEEP_RECENT = 12;
+        let lastCompactionMsgCount = 0;
+        const summarizeForCompaction = async (summaryPrompt) => {
+            const response = await completeWithProvider({
+                provider,
+                model,
+                messages: [
+                    {
+                        role: "system",
+                        content: "You compress conversation history into an accurate, concise continuation memory for another assistant.",
+                    },
+                    { role: "user", content: summaryPrompt },
+                ],
+                temperature: 0.1,
+                maxTokens: 2_048,
+                signal: options.signal,
+            });
+            return response.text;
+        };
+        async function maybeAutoCompact(reason, force = false) {
+            const beforeTokens = estimateMessagesTokens(messages);
+            if (!force && beforeTokens < AUTO_COMPACT_TOKEN_BUDGET)
+                return;
+            if (messages.length <= AUTO_COMPACT_KEEP_RECENT + 2)
+                return;
+            // Avoid compaction loops: don't re-compact until enough new messages have
+            // accumulated since the last compaction.
+            if (messages.length <= lastCompactionMsgCount + 4)
+                return;
+            try {
+                const result = await compactMessagesWithSummary(messages, summarizeForCompaction, { budgetTokens: 0, keepRecent: AUTO_COMPACT_KEEP_RECENT });
+                if (!result.summarized || result.afterTokens >= beforeTokens)
+                    return;
+                messages.splice(0, messages.length, ...result.messages);
+                loopGuard.resetReadOnly();
+                // Re-inject the live plan so the model keeps full plan awareness even
+                // after older turns (which carried the plan context) were summarized.
+                const livePlan = await loadPlan(session.sessionId).catch(() => undefined);
+                if (livePlan) {
+                    messages.push({
+                        role: "system",
+                        content: planContextMessage(livePlan, session.planApproved.value),
+                    });
+                }
+                lastCompactionMsgCount = messages.length;
+                const afterTokens = estimateMessagesTokens(messages);
+                await auditLog("agent.compact", {
+                    newLength: messages.length,
+                    estimatedTokens: afterTokens,
+                    reason,
+                });
+                writeNotice("info", `context auto-compacted to fit the window (~${beforeTokens.toLocaleString()} → ~${afterTokens.toLocaleString()} tokens)`, chalk.dim(`  ℹ context auto-compacted (~${beforeTokens.toLocaleString()} → ~${afterTokens.toLocaleString()} tokens)\n`));
+            }
+            catch (error) {
+                if (error instanceof Error &&
+                    (error.name === "AbortError" || error.message.includes("aborted"))) {
+                    throw error;
+                }
+                // Summarization failed — DO NOT fall back to a mechanical dump. Keep the
+                // current context and continue; we'll try again as it keeps growing.
+                await auditLog("agent.compact.failed", {
+                    reason: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
         for (let iteration = 0; iteration < maxIterations; iteration += 1) {
             // `step` is the productive-step index (used for display + audit). It only
             // advances when the previous iteration actually executed a tool.
@@ -1815,25 +2340,19 @@ export async function runAgentLoop(prompt, options = {}) {
                     const extension = Math.max(40, maxSteps);
                     stepBudget += extension;
                     maxIterations = stepBudget * 3;
-                    // Compact older messages to free context space.
-                    const compacted = compactMessages(messages, { budgetTokens: 0, keepRecent: 12 });
-                    if (compacted.length < messages.length) {
-                        messages.splice(0, messages.length, ...compacted);
-                        loopGuard.resetReadOnly();
-                        await auditLog("agent.compact", {
-                            newLength: messages.length,
-                            estimatedTokens: estimateMessagesTokens(messages),
-                            reason: "step-budget-continue",
-                        });
-                    }
+                    // Compact older messages (model-written summary, no mechanical dump)
+                    // to free context space for the next chunk of work.
+                    await maybeAutoCompact("step-budget-continue", true);
                     // Inject a progress summary so the model stays focused.
                     const livePlan = await loadPlan(session.sessionId).catch(() => undefined);
                     let progressNote = "The step limit was reached and the user chose to continue. ";
-                    progressNote += "Review what you have accomplished so far and continue with the NEXT unfinished step. ";
-                    progressNote += "Do NOT repeat work already done. Do NOT re-fetch pages or re-run scans whose results you already have.";
+                    progressNote +=
+                        "Review what you have accomplished so far and continue with the NEXT unfinished step. ";
+                    progressNote +=
+                        "Do NOT repeat work already done. Do NOT re-fetch pages or re-run scans whose results you already have.";
                     if (livePlan) {
-                        const doneTasks = livePlan.tasks.filter(t => t.state === "done");
-                        const pendingTasks = livePlan.tasks.filter(t => t.state === "pending" || t.state === "in_progress");
+                        const doneTasks = livePlan.tasks.filter((t) => t.state === "done");
+                        const pendingTasks = livePlan.tasks.filter((t) => t.state === "pending" || t.state === "in_progress");
                         progressNote += `\n\nPlan progress: ${doneTasks.length}/${livePlan.tasks.length} tasks done.`;
                         if (pendingTasks.length > 0) {
                             progressNote += ` Next: ${pendingTasks[0].id} — "${pendingTasks[0].title}".`;
@@ -1867,6 +2386,10 @@ export async function runAgentLoop(prompt, options = {}) {
                 writeStatus(batchStatus, chalk.dim(batchStatus));
             }
             else {
+                // Before a fresh model round-trip, proactively compact if the context has
+                // grown too large, so we never hit a provider context-window error and the
+                // model keeps a clean, plan-aware memory.
+                await maybeAutoCompact("auto-token-budget");
                 // Buffer LLM output so tool JSON and hidden thinking are not printed raw.
                 // Status messages (rate-limit retries, fallback hints) still surface live.
                 // A spinner gives the user feedback during long thinking phases on
@@ -1950,6 +2473,16 @@ export async function runAgentLoop(prompt, options = {}) {
                 deltaParser?.finish();
                 const assistantTextResult = rememberThinkingFromText(completion.text);
                 assistantText = assistantTextResult;
+                // Commit thinking to the transcript IMMEDIATELY, before any of the
+                // branches below decide to `continue` (retry a malformed tool call,
+                // nudge for narration, guard premature completion, etc). Previously
+                // writeThinkingBlock was only called from a few terminal branches, so
+                // any retry path silently dropped the model's reasoning — the user
+                // would see the live "thinking…" preview during streaming and then
+                // watch it vanish with nothing committed once the turn moved on.
+                if (assistantText.hasThinking) {
+                    writeThinkingBlock(assistantText.thinkContent);
+                }
                 // Try visible text first, then thinking content — some models (e.g. glm-5.1)
                 // wrap tool calls inside  considering tags, so stripThinking removes them
                 // into thinkContent and visible becomes empty. Recovering from thinkContent
@@ -1977,7 +2510,6 @@ export async function runAgentLoop(prompt, options = {}) {
                     emptyVisibleRetries += 1;
                     if (emptyVisibleRetries <= 3) {
                         if (assistantText.hasThinking) {
-                            writeThinkingBlock(assistantText.thinkContent);
                             writeNotice("warn", "model produced only thinking — nudging it to take action", chalk.yellow("  ⚠ model produced only thinking — nudging it to take action\n"));
                         }
                         else {
@@ -2041,7 +2573,10 @@ export async function runAgentLoop(prompt, options = {}) {
                         bareToolJsonRetries += 1;
                         if (bareToolJsonRetries <= 3) {
                             writeNotice("warn", "tool call missing its name/fence — asking the model to re-emit a proper ```tool block", chalk.yellow("  ⚠ tool call missing its name/fence — asking the model to re-emit a proper ```tool block\n"));
-                            messages.push({ role: "assistant", content: assistantText.visible });
+                            messages.push({
+                                role: "assistant",
+                                content: assistantText.visible,
+                            });
                             messages.push(recoveryUserMessage(buildLikeTurn && !activePlan
                                 ? "Your previous message was a bare JSON args object with no tool name and no ```tool fence, so NOTHING ran. " +
                                     "This is a BUILD/SCAFFOLD task with NO plan yet. " +
@@ -2063,7 +2598,10 @@ export async function runAgentLoop(prompt, options = {}) {
                     // model to retry the tool call in a clean JSON format.
                     if (/<\|tool_call(?:s_section)?_begin\|>|<\|tool_call_argument_begin\|>/i.test(assistantText.visible)) {
                         writeNotice("warn", "tool call was malformed or cut off — asking the model to retry in JSON form", chalk.yellow("  ⚠ tool call was malformed or cut off — asking the model to retry in JSON form\n"));
-                        messages.push({ role: "assistant", content: assistantText.visible });
+                        messages.push({
+                            role: "assistant",
+                            content: assistantText.visible,
+                        });
                         messages.push(recoveryUserMessage("Your previous tool call was malformed or truncated. " +
                             "Reply with ONLY a fenced ```tool block containing valid JSON " +
                             'of the form `{"name": "<tool>", "args": { ... }}`. ' +
@@ -2078,7 +2616,10 @@ export async function runAgentLoop(prompt, options = {}) {
                         truncatedToolRetries += 1;
                         if (truncatedToolRetries <= 3) {
                             writeNotice("warn", "tool call was cut off (output too long) — asking the model to retry in smaller pieces", chalk.yellow("  ⚠ tool call was cut off (output too long) — asking the model to retry in smaller pieces\n"));
-                            messages.push({ role: "assistant", content: assistantText.visible });
+                            messages.push({
+                                role: "assistant",
+                                content: assistantText.visible,
+                            });
                             messages.push({
                                 role: "user",
                                 content: "Your previous tool call was cut off before it finished — the JSON was incomplete, so NOTHING ran. " +
@@ -2105,7 +2646,10 @@ export async function runAgentLoop(prompt, options = {}) {
                         malformedFenceRetries += 1;
                         if (malformedFenceRetries <= 3) {
                             writeNotice("warn", "tool block present but its JSON didn't parse — asking the model to re-emit valid JSON", chalk.yellow("  ⚠ tool block present but its JSON didn't parse — asking the model to re-emit valid JSON\n"));
-                            messages.push({ role: "assistant", content: assistantText.visible });
+                            messages.push({
+                                role: "assistant",
+                                content: assistantText.visible,
+                            });
                             messages.push({
                                 role: "user",
                                 content: "Your previous message contained a ```tool block, but its JSON was INVALID, so NOTHING ran. " +
@@ -2138,9 +2682,7 @@ export async function runAgentLoop(prompt, options = {}) {
                     if (wantsAction &&
                         cleaned.trim().length > 0 &&
                         actionIntentRetries < 3 &&
-                        (productiveSteps === 0 ||
-                            planNarrated ||
-                            narratedAction)) {
+                        (productiveSteps === 0 || planNarrated || narratedAction)) {
                         actionIntentRetries += 1;
                         let nudge;
                         if (activePlan && session.planApproved.value) {
@@ -2179,14 +2721,22 @@ export async function runAgentLoop(prompt, options = {}) {
                                     "Then read key files, and once you understand the directory, call plan.create. Every turn MUST contain a ```tool block until the task is done.";
                             writeNotice("warn", "described an action but emitted no tool call — nudging it to run one", chalk.yellow("  ⚠ described an action but emitted no tool call — nudging it to run one\n"));
                         }
-                        messages.push({ role: "assistant", content: assistantText.visible });
+                        messages.push({
+                            role: "assistant",
+                            content: assistantText.visible,
+                        });
                         messages.push(recoveryUserMessage(nudge));
                         continue;
                     }
-                    if (freshWebSearchRequired && !sawFreshWebSearch && !freshnessRetryUsed) {
+                    if (freshWebSearchRequired &&
+                        !sawFreshWebSearch &&
+                        !freshnessRetryUsed) {
                         freshnessRetryUsed = true;
                         writeNotice("info", "current-info question detected — searching the web before answering", chalk.dim("  ℹ current-info question detected — searching the web before answering\n"));
-                        messages.push({ role: "assistant", content: assistantText.visible });
+                        messages.push({
+                            role: "assistant",
+                            content: assistantText.visible,
+                        });
                         messages.push({
                             role: "user",
                             content: freshnessGuardMessage() +
@@ -2207,7 +2757,10 @@ export async function runAgentLoop(prompt, options = {}) {
                             prematureCompletionRetries += 1;
                             const next = unfinished[0];
                             writeNotice("warn", `${unfinished.length} plan task(s) still unfinished — not accepting a "done" claim; resuming execution`, chalk.yellow(`  ⚠ ${unfinished.length} plan task(s) still unfinished — not accepting a "done" claim; resuming execution\n`));
-                            messages.push({ role: "assistant", content: assistantText.visible });
+                            messages.push({
+                                role: "assistant",
+                                content: assistantText.visible,
+                            });
                             messages.push({
                                 role: "user",
                                 content: `You have NOT finished the approved plan: ${unfinished.length} task(s) remain ` +
@@ -2248,9 +2801,6 @@ export async function runAgentLoop(prompt, options = {}) {
                     if (completionWarning) {
                         writeNotice("warn", completionWarningText, completionWarning);
                     }
-                    if (assistantText.hasThinking) {
-                        writeThinkingBlock(assistantText.thinkContent);
-                    }
                     await auditLog("agent.final", { provider, model, steps: step + 1 });
                     lastAnswer = cleaned;
                     return finishTurn(lastAnswer, step + 1);
@@ -2263,44 +2813,86 @@ export async function runAgentLoop(prompt, options = {}) {
                 if (beforeTool) {
                     writeAssistantMessage(beforeTool);
                 }
-                if (assistantText.hasThinking) {
-                    writeThinkingBlock(assistantText.thinkContent);
-                }
                 let allCalls = parseAllToolCalls(assistantText.visible || assistantText.thinkContent);
                 if (allCalls.length === 0 && call) {
                     allCalls = [call];
                 }
                 const standardizedContent = (beforeTool ? beforeTool.trim() + "\n\n" : "") +
-                    allCalls.map(c => `\`\`\`tool\n${JSON.stringify(c)}\n\`\`\``).join("\n\n");
+                    allCalls
+                        .map((c) => `\`\`\`tool\n${JSON.stringify(c)}\n\`\`\``)
+                        .join("\n\n");
                 messages.push({
                     role: "assistant",
                     content: standardizedContent,
                 });
                 if (allCalls.length > 1) {
-                    writeNotice("info", `${allCalls.length} tool calls in this message — running them in parallel`, chalk.dim(`  ℹ ${allCalls.length} tool calls in this message — running them in parallel\n`));
+                    writeNotice("info", `${allCalls.length} tool calls in this message — running scoped (independent read-only lookups in parallel, everything else in order)`, chalk.dim(`  ℹ ${allCalls.length} tool calls — read-only lookups in parallel, the rest in order\n`));
                 }
-                // Execute all calls in parallel
-                const toolPromises = allCalls.map((c) => {
-                    const id = `tool-${++nextToolEventId}`;
-                    return executeSingleTool(c, id, options.signal || new AbortController().signal);
-                });
-                const results = await Promise.all(toolPromises);
+                // ── Scoped-parallel batch execution ────────────────────────────────
+                // The model may emit several calls in one message. We partition them,
+                // IN DOCUMENT ORDER, into segments:
+                //   • A run of consecutive READ-ONLY, safe-classified calls (the same
+                //     allowlist tool.batch uses) executes CONCURRENTLY — this is where
+                //     independent lookups within a single task fan out (e.g. whois +
+                //     dns + http.fetch during recon).
+                //   • Every other call (plan.create/task.update, and any mutating or
+                //     confirm-level tool: fs.write*, shell.exec, pkg.install, net.scan)
+                //     runs ALONE as a sequential barrier.
+                // Because task.update is never parallel-safe, it always acts as a
+                // barrier: it commits before the work it gates and after the work it
+                // closes. That keeps execution strictly task-by-task and eliminates the
+                // plan-state races / overlapping writes that a blanket Promise.all
+                // caused, while still letting one task's independent lookups run in
+                // parallel. The whole batch stops on the first abort, block, or failure
+                // so the model always sees and reacts to an error.
+                const scopeForBatch = await loadScope().catch(() => undefined);
+                const isParallelSafe = (c) => {
+                    if (!BATCH_SAFE_TOOLS.has(c.name))
+                        return false;
+                    try {
+                        return (classifyToolCall(c, { scope: scopeForBatch }).level === "safe");
+                    }
+                    catch {
+                        return false;
+                    }
+                };
+                const PARALLEL_LIMIT = 4;
                 let aborted = false;
                 let blocked = false;
                 let blockedResult = null;
-                for (const res of results) {
-                    if (res.lastAnswer === "Aborted.") {
-                        aborted = true;
-                    }
-                    if (res.blockOrCancel) {
-                        blocked = true;
-                        blockedResult = res;
-                    }
+                let failed = false;
+                const recordResult = (res) => {
                     messages.push({
                         role: "tool",
                         content: `Tool ${res.call.name} result (exit=${res.result.exitCode ?? 0}, ok=${res.result.ok}):\n${res.contextOutput}`,
                     });
                     productiveSteps += 1;
+                    if (res.lastAnswer === "Aborted.")
+                        aborted = true;
+                    else if (res.blockOrCancel) {
+                        blocked = true;
+                        blockedResult = res;
+                    }
+                    else if (!res.ok)
+                        failed = true;
+                };
+                const groups = groupToolCallsForExecution(allCalls, isParallelSafe, PARALLEL_LIMIT);
+                for (const group of groups) {
+                    if (aborted || blocked || failed)
+                        break;
+                    if (group.length === 1) {
+                        const id = `tool-${++nextToolEventId}`;
+                        const res = await executeSingleTool(group[0], id, options.signal || new AbortController().signal);
+                        recordResult(res);
+                    }
+                    else {
+                        // Concurrent group — assign ids in document order, then push their
+                        // results in document order for a stable transcript.
+                        const ids = group.map(() => `tool-${++nextToolEventId}`);
+                        const results = await Promise.all(group.map((c, k) => executeSingleTool(c, ids[k], options.signal || new AbortController().signal)));
+                        for (const res of results)
+                            recordResult(res);
+                    }
                 }
                 if (aborted) {
                     lastAnswer = "Aborted.";
@@ -2311,20 +2903,12 @@ export async function runAgentLoop(prompt, options = {}) {
                     lastAnswer = blockedResult.lastAnswer || "Blocked or Cancelled.";
                     return finishTurn(lastAnswer, productiveSteps);
                 }
-                // Compact older messages when the running estimate exceeds budget
-                if (estimateMessagesTokens(messages) > 32_000) {
-                    const compacted = compactMessages(messages, { keepRecent: 12 });
-                    if (compacted.length < messages.length) {
-                        messages.splice(0, messages.length, ...compacted);
-                        // Reset read-only tool counters so the model can re-fetch data
-                        // whose results were compacted away.
-                        loopGuard.resetReadOnly();
-                        await auditLog("agent.compact", {
-                            newLength: messages.length,
-                            estimatedTokens: estimateMessagesTokens(messages),
-                        });
-                    }
-                }
+                // A plain failure just stops the remaining calls; we fall through so
+                // the model sees the failed tool's output and decides what to do next.
+                // Compact older messages when the running estimate exceeds budget. Uses
+                // the model-written summary path (with plan re-injection) — never a
+                // mechanical transcript dump.
+                await maybeAutoCompact("post-tool-token-budget");
             }
         }
         // maxIterations ceiling reached (safety net — normally the step budget