@pentoshi/clai 2.0.62 → 3.5.1

package/dist/agent/runner.js

@@ -11,7 +11,7 @@ import { classifyToolCall, isPentestToolCall, scopeHint, scopeTargetForToolCall,
 import { availableToolNames, normalizeToolCall, runToolCall, BATCH_SAFE_TOOLS, } from "../tools/registry.js";
 import { looksInteractiveStdin } from "../tools/shell.js";
 import { formatViewportHint, registerViewport } from "../ui/output-pane.js";
-import { compactMessagesWithSummary, estimateTokens, estimateMessagesTokens, COMPACTION_MEMORY_PREFIX, } from "./context-manager.js";
+import { compactMessagesWithSummary, estimateTokens, estimateMessagesTokens, AUTO_COMPACT_TOKEN_BUDGET, COMPACTION_MEMORY_PREFIX, } from "./context-manager.js";
 import { auditLog } from "../store/logs.js";
 import { loadProjectContext } from "../store/project.js";
 import { loadScope, isScopeActive, targetInScope } from "../store/scope.js";
@@ -24,7 +24,7 @@ import { analyzeTask } from "./task-analyzer.js";
 import { LoopGuard } from "./loop-guard.js";
 import { loadPlan } from "../store/plan.js";
 import { pathInsideSandbox, fsWrite } from "../tools/fs.js";
-import { stripSentinelTokens, parseToolCall, recognizeBareToolJson, looksLikeTruncatedToolCall, salvageTruncatedWrite, countToolFences, parseAllToolCalls, groupToolCallsForExecution, buildTurnHistory, collapseRepeatedText, textBeforeToolCall, formatToolArgs, looksLikePentestTask, looksLikeBuildTask, looksLikeInformationalQuery, looksLikeActionNarration, looksLikePlanNarration, requiresFreshWebSearch, freshnessGuardMessage, buildWorkflowDirective, pentestWorkflowDirective, shouldDimToolChatter, looksLikePromptLeak, } from "./tool-call-parser.js";
+import { stripSentinelTokens, parseToolCall, recognizeBareToolJson, looksLikeTruncatedToolCall, salvageTruncatedWrite, countToolFences, parseAllToolCalls, groupToolCallsForExecution, buildTurnHistory, collapseRepeatedText, textBeforeToolCall, formatToolArgs, looksLikePentestTask, looksLikeBuildTask, looksLikeInformationalQuery, looksLikeIdleOrSocialPrompt, looksLikeActionNarration, looksLikeWebActionNarration, looksLikePlanNarration, requiresFreshWebSearch, freshnessGuardMessage, buildWorkflowDirective, pentestWorkflowDirective, pentestNoLocalServerDirective, shouldDimToolChatter, looksLikePromptLeak, } from "./tool-call-parser.js";
 import { createSessionPolicy, isPreApprovalAllowedTool, isPlanApprovedByStatus, planHasOpenWork, isAbortError, shouldEnableImageOcr, } from "./session-policy.js";
 import { saveToolOutput, summarizeOutput, formatToolContext, } from "./tool-output-formatting.js";
 import { planContextMessage, handlePlanTool, } from "./plan-tool.js";
@@ -128,7 +128,17 @@ export async function runAgentLoop(prompt, options = {}) {
         stop: () => { },
     };
     const writeStatus = (text, rendered = chalk.dim(text)) => {
-        emit({ type: "status", text });
+        // Footer activity is single-line; strip classic stdout newlines/indents.
+        // Never surface /output path hints as activity (garbles the status bar).
+        let cleaned = text.replace(/\s+/g, " ").trim();
+        if (/\/output\b|open full output|Ctrl\+O or|\.clai\/outputs/i.test(cleaned)) {
+            return;
+        }
+        if (cleaned.length > 64) {
+            const short = cleaned.match(/^[\w./-]+/);
+            cleaned = short ? short[0] : cleaned.slice(0, 61) + "…";
+        }
+        emit({ type: "status", text: cleaned || "working" });
         if (writesDirectly)
             process.stdout.write(rendered);
     };
@@ -154,9 +164,14 @@ export async function runAgentLoop(prompt, options = {}) {
         if (writesDirectly)
             process.stdout.write(`${renderThinkingSummary(content)}\n`);
     };
-    const writeToolOutput = (id, chunk, rendered) => {
-        emit({ type: "tool-output", id, chunk });
-        if (writesDirectly)
+    const writeToolOutput = (id, chunk, rendered, options) => {
+        emit({
+            type: "tool-output",
+            id,
+            chunk,
+            ...(options?.replace ? { replace: true } : {}),
+        });
+        if (writesDirectly && rendered)
             process.stdout.write(rendered);
     };
     const writeToolCall = (id, call, rendered) => {
@@ -257,8 +272,13 @@ export async function runAgentLoop(prompt, options = {}) {
         // brand-new plan (the exact failure where "what do u know till now"
         // triggered explore→plan and created an unrelated "Enhance clai" plan).
         const informationalQuery = looksLikeInformationalQuery(prompt);
+        // Greetings / thanks / short acks must never force tools, plans, or
+        // freshness retries — a false "act don't narrate" path burned tokens on
+        // web.search recovery loops after a simple "hi".
+        const idleOrSocialPrompt = looksLikeIdleOrSocialPrompt(prompt);
         const freshWebSearchRequired = !buildLikeTurn &&
             !pentestLikeTurn &&
+            !idleOrSocialPrompt &&
             toolNames.includes("web.search") &&
             requiresFreshWebSearch(prompt);
         let provider = options.provider ?? config.defaultProvider;
@@ -307,7 +327,10 @@ export async function runAgentLoop(prompt, options = {}) {
         // what's already there, create a comprehensive multi-task plan, then
         // implement task by task until the goal is met. This mirrors how a careful
         // coding agent (Claude Code) operates.
-        if (buildLikeTurn && !activePlan && !informationalQuery) {
+        if (buildLikeTurn &&
+            !activePlan &&
+            !informationalQuery &&
+            !idleOrSocialPrompt) {
             systemSections.push(buildWorkflowDirective());
         }
         // Pentest / security engagements need a different shape than a coding
@@ -316,9 +339,22 @@ export async function runAgentLoop(prompt, options = {}) {
         // directive is only injected before a plan exists; once a plan is in
         // place (or being refined), the ACTIVE PLAN block already carries the
         // current task state and recon-vs-active-tool guidance.
-        if (pentestLikeTurn && !activePlan && !informationalQuery) {
+        if (pentestLikeTurn &&
+            !activePlan &&
+            !informationalQuery &&
+            !idleOrSocialPrompt) {
             systemSections.push(pentestWorkflowDirective());
         }
+        // Any remote/security engagement (even with an existing or completed plan)
+        // must never fall into the coding "start localhost dev server" habit.
+        const pentestSession = pentestLikeTurn ||
+            activePlan?.kind === "pentest" ||
+            (activePlan?.kind !== "coding" &&
+                Boolean(activePlan?.goal &&
+                    /pentest|vulnerab|recon|security assess|attack surface|red team/i.test(activePlan.goal)));
+        if (pentestSession && !idleOrSocialPrompt) {
+            systemSections.push(pentestNoLocalServerDirective());
+        }
         const renderedSystemPrompt = systemSections.join("\n\n");
         // Reserve most of a constrained model's input budget for the user message,
         // recent conversation, tool results, and provider framing. Dynamic project
@@ -711,6 +747,9 @@ export async function runAgentLoop(prompt, options = {}) {
             }
             parentSignal.throwIfAborted();
             options.onToolStart?.(call);
+            // Card was "queued" since writeToolCall; flip to running only when work starts.
+            emit({ type: "tool-start", id: toolEventId });
+            writeStatus(call.name, chalk.dim(`  → ${call.name}\n`));
             const interactiveCommand = (call.name === "shell.exec" &&
                 typeof call.args.command === "string" &&
                 looksInteractiveStdin(call.args.command)) ||
@@ -724,38 +763,20 @@ export async function runAgentLoop(prompt, options = {}) {
             parentSignal.addEventListener("abort", onParentAbort);
             let result;
             let liveBytes = 0;
-            const liveCap = 16_000;
-            let liveTruncatedNotified = false;
-            let lastProgressAt = 0;
             const shouldDimLive = !interactiveCommand;
-            const writeToolInfo = (text) => {
-                writeToolOutput(toolEventId, `${text}\n`, chalk.dim(`  ${text}\n`));
-            };
+            // Stream every live byte — never drop mid-run. After the tool finishes we
+            // still replace the spool with the authoritative full `result.output`.
             const printLive = (chunk) => {
                 if (call.name === "fs.read" ||
                     call.name === "fs.list" ||
                     call.name === "fs.search")
                     return;
-                if (liveBytes >= liveCap) {
-                    if (!liveTruncatedNotified) {
-                        liveTruncatedNotified = true;
-                        writeToolInfo("... live preview truncated, full output saved");
-                        writeToolInfo("(tool still running — ESC or Ctrl+C to abort)");
-                        lastProgressAt = Date.now();
-                    }
-                    const now = Date.now();
-                    if (now - lastProgressAt > 5_000) {
-                        lastProgressAt = now;
-                        writeToolOutput(toolEventId, ".", chalk.dim("."));
-                    }
+                if (!chunk)
                     return;
-                }
-                const remaining = liveCap - liveBytes;
-                const slice = chunk.length > remaining ? chunk.slice(0, remaining) : chunk;
-                liveBytes += slice.length;
-                const indented = slice.replace(/\r/g, "").replace(/\n(?!$)/g, "\n  ");
+                liveBytes += chunk.length;
+                const indented = chunk.replace(/\r/g, "").replace(/\n(?!$)/g, "\n  ");
                 const body = indented.startsWith("\n") ? indented : `  ${indented}`;
-                writeToolOutput(toolEventId, slice, shouldDimLive ? chalk.dim(body) : body);
+                writeToolOutput(toolEventId, chunk, shouldDimLive ? chalk.dim(body) : body);
             };
             const jobId = randomUUID().slice(0, 8);
             const backgroundJob = {
@@ -798,7 +819,7 @@ export async function runAgentLoop(prompt, options = {}) {
                     confirmed: true,
                     userPrompt: prompt,
                 });
-                if (liveBytes > 0 || liveTruncatedNotified) {
+                if (liveBytes > 0) {
                     writeToolOutput(toolEventId, "\n", "\n");
                 }
                 jobManager.updateJobStatus(jobId, result.ok ? "exited" : "failed", result.exitCode);
@@ -839,11 +860,10 @@ export async function runAgentLoop(prompt, options = {}) {
                 parentSignal.removeEventListener("abort", onParentAbort);
             }
             const output = result.output.trim();
-            const displayMax = 6_000;
+            // Always keep a full on-disk copy of tool output (any size) so the
+            // pager never depends on a truncated in-memory preview.
             const savedOutputPath = result.outputPath ??
-                (output.length > displayMax
-                    ? await saveToolOutput(call, output)
-                    : undefined);
+                (output ? await saveToolOutput(call, output) : undefined);
             const resultWithArtifact = {
                 ...result,
                 outputPath: savedOutputPath,
@@ -878,20 +898,30 @@ export async function runAgentLoop(prompt, options = {}) {
                 }
             }
             const statusIcon = result.ok ? chalk.green("  ✓") : chalk.red("  ✗");
-            writeToolOutput(toolEventId, result.ok ? "ok\n" : "failed\n", statusIcon + "\n");
+            // Classic stdout gets a short status glyph; the event stream / spool
+            // must NOT be polluted with "ok"/"failed" (the card already shows status).
+            if (writesDirectly) {
+                process.stdout.write(statusIcon + "\n");
+            }
             if (output) {
-                const displaySummary = summarizeOutput(output, displayMax);
-                const displayText = displaySummary.truncated
-                    ? `${displaySummary.text}${savedOutputPath ? chalk.dim(`\n  ... full output saved to ${savedOutputPath}`) : chalk.dim("\n  ... output truncated")}`
-                    : displaySummary.text;
-                if (liveBytes > 0) {
-                    if (savedOutputPath) {
-                        writeToolInfo(`full output saved to ${savedOutputPath}`);
-                    }
+                // Authoritative FULL body — replace any live stream so the pager
+                // never shows a truncated mid-run preview. Never cap for the UI.
+                const fullChunk = output.endsWith("\n") ? output : `${output}\n`;
+                if (!writesDirectly) {
+                    writeToolOutput(toolEventId, fullChunk, "", { replace: true });
                 }
                 else {
+                    // Classic stdout: short preview only; full text is on disk.
+                    const displayMax = 6_000;
+                    const displaySummary = summarizeOutput(output, displayMax);
+                    const displayText = displaySummary.truncated
+                        ? `${displaySummary.text}${savedOutputPath ? chalk.dim(`\n  ... full output saved to ${savedOutputPath}`) : ""}`
+                        : displaySummary.text;
                     const renderedOutput = indentAndWrapText(displayText);
-                    writeToolOutput(toolEventId, displayText, styleToolChatter(call, renderedOutput) + "\n");
+                    process.stdout.write(styleToolChatter(call, renderedOutput) + "\n");
+                    if (savedOutputPath && displaySummary.truncated) {
+                        process.stdout.write(chalk.dim(`  full output saved to ${savedOutputPath}\n`));
+                    }
                 }
             }
             if (output) {
@@ -901,9 +931,16 @@ export async function runAgentLoop(prompt, options = {}) {
                     artifactPath: savedOutputPath,
                     summary: contextOutput,
                 });
-                if (savedOutputPath) {
+                // Classic REPL only: short path notice. Never push long
+                // "Ctrl+O or /output last … (path)" strings into the TUI status
+                // footer — they collide with activity and garble the chrome.
+                if (writesDirectly && savedOutputPath) {
+                    const short = chalk.dim(`  saved ${savedOutputPath}\n`);
+                    process.stdout.write(short);
+                }
+                else if (writesDirectly) {
                     const viewportHint = `${formatViewportHint(viewport)}\n`;
-                    writeStatus(viewportHint, viewportHint);
+                    process.stdout.write(viewportHint);
                 }
             }
             return { ok: result.ok, call, result, contextOutput };
@@ -917,7 +954,6 @@ export async function runAgentLoop(prompt, options = {}) {
         // what is done, and what remains. The estimate is chars/4; the budget is
         // deliberately conservative so we compact a little early rather than hit a
         // provider context-window error mid-task.
-        const AUTO_COMPACT_TOKEN_BUDGET = 150_000;
         const AUTO_COMPACT_KEEP_RECENT = 6;
         let lastCompactionMsgCount = 0;
         const summarizeForCompaction = async (summaryPrompt) => {
@@ -953,6 +989,8 @@ export async function runAgentLoop(prompt, options = {}) {
                     return;
                 messages.splice(0, messages.length, ...result.messages);
                 loopGuard.resetReadOnly();
+                // Token stats BEFORE plan re-injection so the reduction is accurate.
+                const compactedTokens = estimateMessagesTokens(messages);
                 // Re-inject the live plan so the model keeps full plan awareness even
                 // after older turns (which carried the plan context) were summarized.
                 const livePlan = await loadPlan(session.sessionId).catch(() => undefined);
@@ -963,13 +1001,11 @@ export async function runAgentLoop(prompt, options = {}) {
                     });
                 }
                 lastCompactionMsgCount = messages.length;
-                // Report the compacted token count BEFORE plan re-injection so the
-                // compaction stats accurately show the reduction. Then report the
-                // final count (which is what the model actually receives) separately.
-                const compactedTokens = estimateMessagesTokens(messages);
+                // Final count the model actually receives (may include re-injected plan).
+                const afterTokens = estimateMessagesTokens(messages);
                 await auditLog("agent.compact", {
                     newLength: messages.length,
-                    estimatedTokens: compactedTokens,
+                    estimatedTokens: afterTokens,
                     reason,
                 });
                 // Extract the inserted compaction memory so we can surface the
@@ -981,12 +1017,12 @@ export async function runAgentLoop(prompt, options = {}) {
                 const summaryText = insertedSummary.startsWith(`${COMPACTION_MEMORY_PREFIX}\n\n`)
                     ? insertedText(insertedSummary, `${COMPACTION_MEMORY_PREFIX}\n\n`)
                     : insertedText(insertedSummary, COMPACTION_MEMORY_PREFIX);
-                const afterTokens = estimateMessagesTokens(messages);
-                writeCompacted(summaryText, beforeTokens, afterTokens);
+                // Card shows pre/post of the summarization; plan re-injection is noted.
+                writeCompacted(summaryText, beforeTokens, compactedTokens);
                 const planNote = afterTokens > compactedTokens
                     ? ` (compacted to ~${compactedTokens.toLocaleString()}, +plan → ~${afterTokens.toLocaleString()})`
                     : "";
-                writeNotice("info", `context auto-compacted to fit the window (~${beforeTokens.toLocaleString()} → ~${afterTokens.toLocaleString()} tokens${planNote})`, chalk.dim(`  ℹ context auto-compacted (~${beforeTokens.toLocaleString()} → ~${afterTokens.toLocaleString()} tokens${planNote})\n`));
+                writeNotice("info", `context auto-compacted to fit the window (~${beforeTokens.toLocaleString()} → ~${compactedTokens.toLocaleString()} tokens${planNote})`, chalk.dim(`  ℹ context auto-compacted (~${beforeTokens.toLocaleString()} → ~${compactedTokens.toLocaleString()} tokens${planNote})\n`));
             }
             catch (error) {
                 if (error instanceof Error &&
@@ -1111,10 +1147,11 @@ export async function runAgentLoop(prompt, options = {}) {
                     completion = await streamWithProvider({
                         provider,
                         model,
-                        // The selected model is the first choice, but an agent must not
-                        // end a turn with no answer if it only emits reasoning. Honor
-                        // the user's providerFallback setting for that recovery path.
-                        allowModelFallback: true,
+                        // Stay on the user's selected provider/model. Cross-provider
+                        // hops (e.g. bynara → gemini on a 429) only happen when the
+                        // user has explicitly enabled `providerFallback` AND this is
+                        // the provider's default model. Never force fallback mid-turn.
+                        allowModelFallback: false,
                         messages,
                         // MiniMax M3 degenerates at the generic agent temperature. The
                         // HTTP layer also applies its `top_p` override for both the
@@ -1379,15 +1416,19 @@ export async function runAgentLoop(prompt, options = {}) {
                                     const lineCount = salvaged.content.split("\n").length;
                                     writeNotice("info", `tool call was truncated — salvaged ${lineCount} lines and wrote to ${salvaged.path}`, chalk.cyan(`  ℹ tool call was truncated — salvaged ${lineCount} lines to ${salvaged.path}\n`));
                                     pushAssistantHistory(stripThinking(assistantText.visible).visible);
+                                    const priorBytes = Buffer.byteLength(salvaged.content, "utf8");
                                     messages.push({
                                         role: "user",
-                                        content: `Your fs.write tool call was cut off at the token limit, but the system salvaged the partial content and wrote ${lineCount} lines to ${salvaged.path}. ` +
-                                            `The file now exists with content up to: "${salvaged.lastLine}"\n\n` +
-                                            `CONTINUE writing the rest of the content using fs.append:\n` +
-                                            '```tool\n{"name":"fs.append","args":{"path":"' + salvaged.path + '","content":"...remaining content..."}}\n```\n' +
-                                            `Write the NEXT section of content starting from where it was cut off. ` +
-                                            `Keep each fs.append call to ~100 lines max so it fits in the output window. ` +
-                                            `Use multiple fs.append calls if needed. Do NOT re-write content that was already saved.`,
+                                        content: `Your fs.write tool call was cut off at the token limit, but the system salvaged the partial content and wrote ${lineCount} lines (${priorBytes} bytes) to ${salvaged.path}. ` +
+                                            `The file ends with: ${JSON.stringify(salvaged.lastLine)}\n\n` +
+                                            `CONTINUE with ONE large fs.append of the remaining content (prefer hundreds of lines per call — do NOT use tiny ~100-line chunks):\n` +
+                                            '```tool\n{"name":"fs.append","args":{"path":' +
+                                            JSON.stringify(salvaged.path) +
+                                            ',"expectedPriorBytes":' +
+                                            priorBytes +
+                                            ',"content":"...ONLY the remaining content not already on disk..."}}\n```\n' +
+                                            `expectedPriorBytes must match the receipt so append cannot double-write. ` +
+                                            `Do NOT re-read the full file; do NOT re-send content already saved.`,
                                     });
                                     continue;
                                 }
@@ -1402,12 +1443,12 @@ export async function runAgentLoop(prompt, options = {}) {
                             messages.push({
                                 role: "user",
                                 content: "Your previous tool call was cut off before it finished — the JSON was incomplete, so NOTHING ran. " +
-                                    "Your output token limit is ~32k tokens. For LARGE files (reports, docs, long code), you MUST write in chunks:\n" +
-                                    "1. Use fs.write to create the file with the FIRST ~100 lines\n" +
-                                    "2. Use fs.append to add the NEXT ~100 lines\n" +
-                                    "3. Repeat fs.append for each remaining section\n" +
-                                    "Keep your reasoning SHORT — emit the ```tool block as early as possible to maximize content space. " +
-                                    "Do NOT try to write the entire file in one call. Do NOT claim any file was written until a tool call actually succeeds.",
+                                    "Prefer ONE complete fs.write when it fits (~32k output tokens is a lot of file content if reasoning stays short). " +
+                                    "If the file is too large for one call:\n" +
+                                    "1. fs.write the first large section (as much as fits — hundreds+ of lines)\n" +
+                                    "2. fs.append the rest with expectedPriorBytes from the write receipt\n" +
+                                    "3. Repeat append only if still incomplete — large chunks, not ~100-line drips\n" +
+                                    "Keep reasoning SHORT — emit the ```tool block early. Do NOT claim a file was written until a tool call succeeds.",
                             });
                             continue;
                         }
@@ -1442,7 +1483,7 @@ export async function runAgentLoop(prompt, options = {}) {
                                         content: `The system extracted and wrote ${lineCount} lines to ${salvaged.path} from your malformed tool call. ` +
                                             `The file content ends at: "${salvaged.lastLine}"\n\n` +
                                             `If the file is complete, proceed with the next step. ` +
-                                            `If more content is needed, use fs.append to add the remaining sections (~100 lines per call).`,
+                                            `If more content is needed, use one large fs.append with expectedPriorBytes from the write receipt (not tiny chunks).`,
                                     });
                                     continue;
                                 }
@@ -1460,10 +1501,8 @@ export async function runAgentLoop(prompt, options = {}) {
                                 content: "Your previous message contained a ```tool block, but its JSON was INVALID, so NOTHING ran. " +
                                     "Common causes: unescaped newlines or quotes inside a string value, an extra or missing `}` / `]`, or content too large for the output window. " +
                                     'Re-emit ONE valid ```tool block of the exact form {"name":"<tool>","args":{...}} with balanced braces. ' +
-                                    "IMPORTANT: For large file content (reports, docs), write in chunks:\n" +
-                                    "1. fs.write with the FIRST ~100 lines only\n" +
-                                    "2. fs.append for each subsequent ~100-line section\n" +
-                                    "Keep reasoning SHORT to maximize output space for the tool call JSON. " +
+                                    "IMPORTANT: Prefer ONE complete fs.write when it fits. Keep reasoning SHORT. " +
+                                    "Only if the output window cuts you off, continue with large fs.append chunks + expectedPriorBytes. " +
                                     "Do NOT claim any file was written until a tool call actually succeeds.",
                             });
                             continue;
@@ -1481,6 +1520,7 @@ export async function runAgentLoop(prompt, options = {}) {
                     // final answer ends the turn with nothing done and no real plan saved.
                     // Nudge it to emit a real tool call, with a concrete example.
                     const narratedAction = looksLikeActionNarration(cleaned);
+                    const narratedWebAction = looksLikeWebActionNarration(cleaned);
                     // `activePlan` is the snapshot loaded at the start of this turn.
                     // A final task.update mutates and persists a separate plan instance,
                     // so re-read it here before deciding whether a final response should
@@ -1493,15 +1533,24 @@ export async function runAgentLoop(prompt, options = {}) {
                     const completedPlanDuringThisTurn = activePlan?.status !== "completed" &&
                         planStatusAtCompletion === "completed";
                     const planHasOpenWorkNow = planHasOpenWork(planStatusAtCompletion);
+                    // User-driven reasons to require tools this turn (build/pentest/
+                    // approved plan / freshness). Idle greetings never qualify.
+                    const userExpectsWork = freshWebSearchRequired ||
+                        (planHasOpenWorkNow && session.planApproved.value) ||
+                        (!informationalQuery &&
+                            !idleOrSocialPrompt &&
+                            (buildLikeTurn || pentestLikeTurn));
                     // History-inherited build/pentest intent only forces action when
-                    // THIS prompt is not itself a plain question. Once this turn has
-                    // completed its plan, however, its next visible response is the
-                    // final answer — not narration to recover into more work.
+                    // THIS prompt is not itself a plain question/idle turn. Narration
+                    // stalls ("I'll list the files") still force a tool when the user
+                    // is not asking an informational question — but capability menus
+                    // and greetings are filtered out by looksLikeActionNarration /
+                    // idleOrSocialPrompt so they cannot burn recovery turns.
                     const wantsAction = !completedPlanDuringThisTurn &&
-                        (narratedAction ||
-                            freshWebSearchRequired ||
-                            (planHasOpenWorkNow && session.planApproved.value) ||
-                            (!informationalQuery && (buildLikeTurn || pentestLikeTurn)));
+                        !idleOrSocialPrompt &&
+                        (userExpectsWork ||
+                            (narratedAction && !informationalQuery) ||
+                            (narratedWebAction && !informationalQuery));
                     const planNarrated = (buildLikeTurn || pentestLikeTurn) &&
                         !activePlan &&
                         looksLikePlanNarration(cleaned);
@@ -1528,14 +1577,20 @@ export async function runAgentLoop(prompt, options = {}) {
                                     "Every turn MUST contain a ```tool block until the task is done.";
                             writeNotice("warn", "described a security/pentest action but emitted no tool call — nudging it to run one", chalk.yellow("  ⚠ described a security/pentest action but emitted no tool call — nudging it to run one\n"));
                         }
-                        else if (!buildLikeTurn) {
+                        else if (freshWebSearchRequired || narratedWebAction) {
+                            // Web-specific recovery ONLY when the user asked for current
+                            // info or the model explicitly claimed a fetch/search step.
+                            // Previously every non-build stall used this path, so a "hi"
+                            // greeting that said "I'll start executing" was forced into
+                            // pointless web.search recovery loops.
                             nudge =
                                 "You wrote that you would fetch/search/read something but emitted NO ```tool block, so NOTHING ran. Do NOT narrate the next browsing step — DO it. Emit exactly one valid ```tool block now. If you know the exact page, use:\n" +
                                     '```tool\n{"name":"web.fetch","args":{"url":"https://example.com/page","responseMode":"readable"}}\n```\n' +
                                     "If you do not know the exact page URL, use web.search first. After the tool output, answer from the fetched page content.";
                             writeNotice("warn", "described a web action but emitted no tool call — nudging it to run one", chalk.yellow("  ⚠ described a web action but emitted no tool call — nudging it to run one\n"));
                         }
-                        else if (planNarrated || productiveSteps > 0) {
+                        else if (buildLikeTurn &&
+                            (planNarrated || productiveSteps > 0)) {
                             const kind = pentestLikeTurn ? "pentest" : "coding";
                             nudge =
                                 "You wrote the plan as PROSE but did NOT call plan.create, so no plan was saved and the user cannot /implement it. Emit it as a real tool call NOW — exactly one ```tool block:\n" +
@@ -1543,17 +1598,17 @@ export async function runAgentLoop(prompt, options = {}) {
                                     "Do not describe the plan again in prose — just emit the plan.create tool block.";
                             writeNotice("warn", "plan was written as text, not created — nudging it to call plan.create", chalk.yellow("  ⚠ plan was written as text, not created — nudging it to call plan.create\n"));
                         }
+                        else if (buildLikeTurn) {
+                            nudge =
+                                "You described what you will do but emitted NO ```tool block, so NOTHING actually happened — narration is not action. Emit a real tool call NOW. For this build task, explore first like this:\n" +
+                                    '```tool\n{"name":"fs.list","args":{"path":"."}}\n```\n' +
+                                    "Then read key files, and once you understand the directory, call plan.create. Every turn MUST contain a ```tool block until the task is done.";
+                            writeNotice("warn", "described an action but emitted no tool call — nudging it to run one", chalk.yellow("  ⚠ described an action but emitted no tool call — nudging it to run one\n"));
+                        }
                         else {
-                            if (pentestLikeTurn) {
-                                nudge =
-                                    "You described what you will do but emitted NO ```tool block, so NOTHING actually happened — narration is not action. Emit a real tool call NOW. For this pentest task, explore/recon first, then call plan.create. Every turn MUST contain a ```tool block until the task is done.";
-                            }
-                            else {
-                                nudge =
-                                    "You described what you will do but emitted NO ```tool block, so NOTHING actually happened — narration is not action. Emit a real tool call NOW. For this build task, explore first like this:\n" +
-                                        '```tool\n{"name":"fs.list","args":{"path":"."}}\n```\n' +
-                                        "Then read key files, and once you understand the directory, call plan.create. Every turn MUST contain a ```tool block until the task is done.";
-                            }
+                            // Generic non-build, non-web stall (e.g. "I'll list the files").
+                            nudge =
+                                "You described what you will do but emitted NO ```tool block, so NOTHING actually happened — narration is not action. Emit a real tool call NOW for the step you just described. Every turn that claims an action MUST contain a ```tool block.";
                             writeNotice("warn", "described an action but emitted no tool call — nudging it to run one", chalk.yellow("  ⚠ described an action but emitted no tool call — nudging it to run one\n"));
                         }
                         pushAssistantHistory(assistantText.visible);
@@ -1574,29 +1629,28 @@ export async function runAgentLoop(prompt, options = {}) {
                         continue;
                     }
                     // A passing build is not evidence that an app is serving requests.
-                    // On completed build plans, require start → logs → HTTP verification
-                    // before accepting the model's final claim.
+                    // On completed CODING build plans only, require start → logs → HTTP
+                    // verification. NEVER apply this to pentest/remote engagements — that
+                    // forced "npm run dev on the clai repo" after a finished web assessment.
                     if (buildLike &&
+                        !pentestLike &&
+                        !pentestSession &&
                         session.planApproved.value &&
                         (!sawServerStart || !sawServerTail || !sawLocalHttpProbe) &&
                         runtimeVerificationRetries < 2) {
                         const runtimePlan = await loadPlan(session.sessionId).catch(() => undefined);
-                        const tasksFinished = Boolean(runtimePlan &&
+                        const codingPlanFinished = Boolean(runtimePlan &&
+                            runtimePlan.kind !== "pentest" &&
                             runtimePlan.tasks.length > 0 &&
                             runtimePlan.tasks.every((task) => task.state === "done" || task.state === "skipped"));
-                        if (tasksFinished) {
+                        if (codingPlanFinished) {
                             runtimeVerificationRetries += 1;
                             pushAssistantHistory(assistantText.visible);
-                            const missing = [
-                                !sawServerStart ? "shell.start" : "",
-                                !sawServerTail ? "shell.tail" : "",
-                                !sawLocalHttpProbe
-                                    ? "a successful bounded localhost HTTP probe"
-                                    : "",
-                            ].filter(Boolean);
                             messages.push({
                                 role: "user",
-                                content: "Run the missing checks now. Keep the dev server/job running in the background so that the user can interact with the live application, and print the localhost link. Report whether it remains running truthfully.",
+                                content: "This is a CODING project only: run the missing local checks (shell.start + shell.tail + localhost HTTP probe). " +
+                                    "Keep the dev server running and print the localhost link. " +
+                                    "If this was a remote pentest, ignore this and finalize the report with no local server.",
                             });
                             continue;
                         }
@@ -1615,20 +1669,26 @@ export async function runAgentLoop(prompt, options = {}) {
                             const next = unfinished[0];
                             writeNotice("warn", `${unfinished.length} plan task(s) still unfinished — not accepting a "done" claim; resuming execution`, chalk.yellow(`  ⚠ ${unfinished.length} plan task(s) still unfinished — not accepting a "done" claim; resuming execution\n`));
                             pushAssistantHistory(assistantText.visible);
+                            const isPentestPlan = livePlan.kind === "pentest" || pentestSession;
                             let instruction = `Resume now with the NEXT task ${next.id} ("${next.title}"): `;
-                            if (next.state === "pending") {
-                                instruction += `call task.update {taskId:"${next.id}", state:"in_progress"}, then do the real work with a tool call (fs.writeMany / shell.exec / shell.start), VERIFY it, and mark it done. `;
+                            if (isPentestPlan) {
+                                instruction +=
+                                    `call task.update {taskId:"${next.id}", state:"in_progress"}, then do the recon/testing work ` +
+                                        `(dns/http/net.scan/http.fetch/tool.batch — NOT a local dev server), VERIFY with real tool output, ` +
+                                        `then task.update done. Do NOT shell.start / npm run dev / explore the clai workspace. `;
+                            }
+                            else if (next.state === "pending") {
+                                instruction += `call task.update {taskId:"${next.id}", state:"in_progress"}, then do the real work with a tool call (fs.writeMany / shell.exec / shell.start when building a local app), VERIFY it, and mark it done. `;
                             }
                             else {
-                                instruction += `do the real work with a tool call (fs.writeMany / shell.exec / shell.start) to complete it, VERIFY it, and mark it done (call task.update {taskId:"${next.id}", state:"done"}). `;
+                                instruction += `do the real work with a tool call (fs.writeMany / shell.exec / shell.start when building a local app) to complete it, VERIFY it, and mark it done (call task.update {taskId:"${next.id}", state:"done"}). `;
                             }
                             instruction += `Continue task by task until EVERY task is actually finished.`;
                             messages.push({
                                 role: "user",
                                 content: `You have NOT finished the approved plan: ${unfinished.length} task(s) remain ` +
                                     `(${unfinished.map((t) => `[${t.id}] ${t.title}`).join("; ")}). ` +
-                                    `Do NOT claim the work is complete, that files were created, or that a server is running ` +
-                                    `unless a tool call actually succeeded and you saw the output. ` +
+                                    `Do NOT claim the work is complete unless a tool call actually succeeded and you saw the output. ` +
                                     instruction,
                             });
                             continue;
@@ -1740,7 +1800,12 @@ export async function runAgentLoop(prompt, options = {}) {
                             `${omittedCallCount} were not run. After reviewing results, issue a small, prioritized next batch.`,
                     });
                 }
-                // Now emit only the calls that will actually execute, after thinking
+                // Notice BEFORE tool cards so the transcript reads:
+                // thinking → response → "N tool calls…" → tool cards (not tools then info).
+                if (allCalls.length > 1) {
+                    writeNotice("info", `${allCalls.length} tool calls in this message — running scoped (independent read-only lookups in parallel, everything else in order)`, chalk.dim(`  ℹ ${allCalls.length} tool calls — read-only lookups in parallel, the rest in order\n`));
+                }
+                // Emit only the calls that will actually execute, after thinking
                 // + assistant text so transcript order remains correct.
                 for (const deferred of activeDeferredToolCalls.slice(0, allCalls.length)) {
                     writeToolCall(deferred.eventId, deferred.call, deferred.rendered);
@@ -1750,9 +1815,6 @@ export async function runAgentLoop(prompt, options = {}) {
                         .map((c) => `\`\`\`tool\n${JSON.stringify(c)}\n\`\`\``)
                         .join("\n\n");
                 pushAssistantHistory(standardizedContent);
-                if (allCalls.length > 1) {
-                    writeNotice("info", `${allCalls.length} tool calls in this message — running scoped (independent read-only lookups in parallel, everything else in order)`, chalk.dim(`  ℹ ${allCalls.length} tool calls — read-only lookups in parallel, the rest in order\n`));
-                }
                 // Scoped-parallel batch execution
                 // The model may emit several calls in one message. We partition them,
                 // IN DOCUMENT ORDER, into segments:
@@ -1772,7 +1834,22 @@ export async function runAgentLoop(prompt, options = {}) {
                 // later recon from running; aborts, blocks, and sequential-barrier
                 // failures still stop the batch so the model can react safely.
                 const scopeForBatch = await loadScope().catch(() => undefined);
+                /**
+                 * Tools that may share a concurrent wave. Pure read-only BATCH_SAFE
+                 * tools always qualify when classified safe. Heavy discovery wrappers
+                 * (pentest.recon, net.context) also run concurrent with dns/http so
+                 * nmap does not serialize the entire recon wave.
+                 * net.scan stays a barrier when it needs confirm/sudo UX.
+                 */
                 const isParallelSafe = (c) => {
+                    if (c.name === "pentest.recon" ||
+                        c.name === "net.context" ||
+                        c.name === "tool.batch" ||
+                        c.name === "tool.check" ||
+                        c.name === "shell.jobs" ||
+                        c.name === "shell.tail") {
+                        return true;
+                    }
                     if (!BATCH_SAFE_TOOLS.has(c.name))
                         return false;
                     try {
@@ -1782,13 +1859,36 @@ export async function runAgentLoop(prompt, options = {}) {
                         return false;
                     }
                 };
-                const PARALLEL_LIMIT = 4;
+                /** Tools whose failure must NOT cancel sibling calls in this turn. */
+                const shouldSoftFailTool = (name) => {
+                    if (name === "tool.batch")
+                        return true;
+                    if (BATCH_SAFE_TOOLS.has(name))
+                        return true;
+                    if (name === "pentest.recon" ||
+                        name === "net.scan" ||
+                        name === "net.pingSweep" ||
+                        name === "net.context" ||
+                        name === "shell.jobs" ||
+                        name === "shell.tail" ||
+                        name === "tool.check") {
+                        return true;
+                    }
+                    return false;
+                };
+                // Recon waves often emit 6–10 lookups; 4 forced a second sequential wave.
+                const PARALLEL_LIMIT = 8;
                 let aborted = false;
                 let blocked = false;
                 let blockedResult = null;
                 let failed = false;
                 let awaitingPlanApproval = false;
+                /** Indices into allCalls that actually ran (got a tool-result). */
+                const executedIndices = new Set();
                 const recordResult = (res, continueAfterFailure = false) => {
+                    const idx = allCalls.indexOf(res.call);
+                    if (idx >= 0)
+                        executedIndices.add(idx);
                     messages.push({
                         role: "tool",
                         content: `Tool ${res.call.name} result (exit=${res.result.exitCode ?? 0}, ok=${res.result.ok}):\n${res.contextOutput}`,
@@ -1833,7 +1933,11 @@ export async function runAgentLoop(prompt, options = {}) {
                         }
                         const id = (idx >= 0 ? callIds[idx] : undefined) ?? `tool-${++nextToolEventId}`;
                         const res = await executeSingleTool(call, id, options.signal || new AbortController().signal);
-                        recordResult(res);
+                        // Soft-fail recon / read-only / discovery tools so a stalled
+                        // whois or failed lookup never cancels the rest of the turn with
+                        // "Cancelled — earlier tool in this batch failed."
+                        const softFail = shouldSoftFailTool(call.name);
+                        recordResult(res, softFail);
                     }
                     else {
                         // Concurrent group — assign ids in document order, then push their
@@ -1853,6 +1957,41 @@ export async function runAgentLoop(prompt, options = {}) {
                             recordResult(res, true);
                     }
                 }
+                // Cards were emitted for every call up front. If the batch stopped
+                // early (failure / abort / plan gate), any card still on "running"
+                // must get a terminal result so the TUI never spins forever.
+                for (let i = 0; i < allCalls.length; i += 1) {
+                    if (executedIndices.has(i))
+                        continue;
+                    const call = allCalls[i];
+                    if (i >= 0 && !callIds[i]) {
+                        callIds[i] = `tool-${++nextToolEventId}`;
+                    }
+                    const id = callIds[i];
+                    if (!alreadyPrintedIds.has(id)) {
+                        // Never shown in the transcript — skip.
+                        continue;
+                    }
+                    const reason = aborted
+                        ? "Cancelled — turn aborted before this call ran."
+                        : blocked
+                            ? "Cancelled — earlier tool was blocked or declined."
+                            : awaitingPlanApproval
+                                ? "Deferred — waiting for plan approval."
+                                : failed
+                                    ? "Cancelled — earlier tool in this batch failed."
+                                    : "Cancelled — not executed.";
+                    const result = {
+                        ok: false,
+                        output: reason,
+                        exitCode: 130,
+                    };
+                    emitToolResult(id, result, reason);
+                    messages.push({
+                        role: "tool",
+                        content: `Tool ${call.name} result (exit=130, ok=false):\n${reason}`,
+                    });
+                }
                 // plan.create is a hard transaction boundary. Its successful handler
                 // persists and displays the plan; returning immediately prevents a
                 // stale pre-loop activePlan snapshot from nudging a duplicate plan and