@pentoshi/clai 3.18.3 → 4.0.2

package/README.md

@@ -2,7 +2,7 @@
 
 > A fast, terminal-native AI agent that runs real tools — built to run on **free API tiers**, stay alive across rate limits with **multi-key + multi-provider switching**, and do serious work: **building, debugging, and scope-based pentesting / bug bounty**.
 
-`clai` is an agentic CLI. It doesn't just describe what to do — it edits files, runs shell commands, scans hosts, fetches HTTP evidence, keeps a durable task plan, and verifies its own work before claiming success. It runs entirely in your terminal with a full-screen console UI (and a classic line REPL fallback).
+`clai` is an agentic CLI. It doesn't just describe what to do — it edits files, runs shell commands, scans hosts, fetches HTTP evidence, keeps a durable task plan, and verifies its own work before claiming success. It runs in your terminal with three full surfaces — an OpenTUI full-screen console (default on macOS/Linux), a classic Ink UI (default on Windows), and a noninteractive stream renderer for prompts and pipes. The original line-by-line REPL is gone: every interactive surface is a full-screen app sharing the same features, commands, and session state.
 
 Two things make it practical for everyday use:
 
@@ -14,7 +14,7 @@ Two things make it practical for everyday use:
 ## Highlights
 
 - **Free-tier first.** 17 providers wired in, 7 cloud free tiers + local Ollama. The default provider is the **keyless Free** gateway (`free-1/deepseek-v4-flash-free`) so a fresh install runs at no cost with zero setup — no API key required.
-- **Multi-key smart switching.** Up to 10 keys per provider with a *sticky* active key and circular rotation on rate-limit / auth / quota / transient / 5xx / empty-response errors. Optional cross-provider fallback and a free-only filter.
+- **Multi-key smart switching.** Up to 10 keys per provider with a *sticky* active key and circular rotation on rate-limit / auth / quota / transient / 5xx / empty-response errors. Disable any key or endpoint row to skip it without deleting it. Optional cross-provider fallback and a free-only filter.
 - **Bring your own endpoint.** Deploy Kimi K3 (or Qwen / DeepSeek / GLM / GPT-OSS / your own fine-tune) to a [Modal](#modal--run-kimi-k3-on-your-own-endpoint-on-30month-of-free-credit) endpoint and drive it from clai on **$30/month of free compute credit**. Modal, Lightning AI and TokenRouter each keep a list of up to 10 base URLs with a sticky active one, so several deployments live side by side and you switch with one command — same editor, same ★ active row as keys.
 - **Scope-based pentesting.** Opt-in engagement scope with authorized/excluded targets, allowed phases, rate and concurrency ceilings, redirect and DNS-rebinding escape detection, and out-of-scope flagging — designed for authorized pentests and bug-bounty programs.
 - **Real building & debugging.** Scaffolds apps, edits code surgically, installs packages, runs builds/tests, starts dev servers as background jobs, and probes them before reporting success.
@@ -54,23 +54,21 @@ git clone https://github.com/pentoshi007/clai.git
 cd clai && npm install && npm run build && npm start
 ```
 
-Node.js ≥ 20. Type `clai` in any terminal to start.
+Node.js ≥ 22. Type `clai` in any terminal to start.
 
 ### Platform notes
 
-<table>
-<tr><th>Platform</th><th>Full-screen TUI (OpenTUI)</th><th>Classic REPL (<code>--classic</code>)</th></tr>
-<tr><td>macOS</td><td>✅ Full support</td><td>✅</td></tr>
-<tr><td>Linux</td><td>✅ Full support</td><td>✅</td></tr>
-<tr><td>Windows</td><td>❌ Not available yet</td><td>✅ Automatic fallback</td></tr>
-</table>
+| Environment | Default surface | Explicit alternative |
+|---|---|---|
+| Interactive macOS/Linux terminal at least 60×14 | OpenTUI full-screen console | `clai --classic` for the Ink UI |
+| Interactive Windows terminal | Classic Ink UI | `--ui classic` / `--classic` |
+| stdin or stdout is not a TTY | Noninteractive stream renderer | use a prompt or pipe stdin |
 
-**Windows:** OpenTUI's native renderer does not ship Windows binaries yet, so clai automatically starts in classic REPL mode — no extra flags needed. All core features (ask, agent, multi-key rotation, pentesting, plans, history) work identically; only the full-screen UI is absent.
-
-> **Note:** The standalone Windows binary (`clai.exe` via `install.ps1` / Scoop) may crash silently on some Windows builds. If `clai` returns without output after the raw-URL install, use the **npm method** instead — it is the most reliable way to run clai on Windows:
-> ```powershell
-> npm i -g @pentoshi/clai
-> ```
+**Windows:** the platform-selection code chooses the classic Ink UI before any Bun/OpenTUI
+startup probe. This repository's macOS validation does not claim Windows Terminal,
+PowerShell, cmd.exe/conhost, VS Code terminal, ConPTY, or Windows-binary runtime evidence;
+those target-host checks remain release gates. Use `clai --classic` explicitly when you want
+the same selection on any platform.
 
 **Linux — terminal recommendations for full mouse & hover support:**
 
@@ -200,7 +198,7 @@ clai unset modal --url                 # clear the URLs, keep the token pairs
 clai keys                              # every URL listed, ★ marks the active one
 ```
 
-Token pairs rotate on failure like any other provider's keys (the pair is stored as one `id:secret` string). Endpoints do **not** auto-rotate: a different Modal endpoint serves a different model, so switching is always an explicit choice. `MODAL_BASE_URL` overrides the stored list entirely.
+Token pairs rotate on failure like any other provider's keys (the pair is stored as one `id:secret` string). Endpoints fail over alongside them: on a rate limit, workspace/auth mismatch, quota error, or 5xx, clai tries the next stored endpoint with the next key, and the ★ active endpoint sticks to the one that worked, so the next run starts on the healthy URL. `MODAL_BASE_URL` overrides the stored list entirely.
 
 From inside the console, `/provider modal` walks the same setup in two prompts — endpoint URL first (shown in full, since it isn't a secret), then the token pair — and leaves the active provider untouched if you cancel.
 
@@ -253,11 +251,12 @@ clai provider                          # interactive provider/model picker
 clai unset groq                        # remove ALL keys for a provider
 ```
 
-In the console, **`/set`** opens a multi-row editor: add rows with `+`, remove rows, star a row to make it the active one, **Save**, or **Reset all**. Providers with their own base URL (Modal, Lightning AI, TokenRouter) get a second **endpoints** row in the `/set` picker that edits their URL list the same way — URLs are shown in full rather than masked, since they aren't secrets. `/set <provider> https://…` adds and activates one URL directly. **`/keys`** lists keys masked plus the active endpoint; **`/unset`** clears a provider.
+In the console, **`/set`** opens a multi-row editor: add rows with `+`, remove rows, star a row to make it the active one, or disable a row to skip it in rotation without deleting it (`d` in the classic UI, `Ctrl+D` or the ○ marker in OpenTUI) — then **Save**, or **Reset all**. Providers with their own base URL (Modal, Lightning AI, TokenRouter) get a second **endpoints** row in the `/set` picker that edits their URL list the same way — URLs are shown in full rather than masked, since they aren't secrets. `/set <provider> https://…` adds and activates one URL directly. **`/keys`** lists keys masked plus the active endpoint, marking disabled rows `(disabled)`; **`/unset`** clears a provider. Disabled entries are never tried until re-enabled, and disabling every key for a provider fails fast with a clear error instead of burning requests.
 
 ### Smart switching (how it stays up)
 
-- **Multi-key rotation** — up to **10 keys per provider**. The last key that worked is *sticky*; on failure clai rotates circularly to the next key.
+- **Multi-key rotation** — up to **10 keys per provider**. The last key that worked is *sticky*; on failure clai rotates circularly to the next key. Endpoint providers (Modal, Lightning AI, TokenRouter) fail over their stored endpoints alongside the keys, and the ★ active endpoint follows the one that worked.
+- **Disable without deleting** — toggle any key or endpoint row disabled in the `/set` editor and rotation skips it until you re-enable it.
 - **What triggers a switch** — HTTP 429 (rate limit), 401/403 (auth), 402 / quota / billing text, transient network errors, 500–504, and empty completions. Auth and quota errors switch **immediately** (no backoff wait); rate limits back off briefly first.
 - **Cross-provider fallback** *(opt-in)* — `/fallback on` lets clai try other configured providers after the active one is exhausted (only when running a provider's default model).
 - **Free-only mode** *(opt-in)* — `/freeonly on` excludes paid-cloud providers from the fallback chain, so you never accidentally spend.
@@ -353,7 +352,7 @@ You own authorization; clai still gates risk on every action:
 
 ## Terminal UI
 
-A full-screen console by default: streaming chat, nested tool cards (including `tool.batch` sub-calls), file diffs, a live plan pane, pickers, history, and secure masked key prompts. It falls back to a classic REPL when the terminal can't host the UI.
+The old line REPL has been removed — there are only full surfaces now. An OpenTUI full-screen console is selected for a sufficiently large interactive POSIX terminal. The classic Ink UI is selected on Windows, on smaller terminals, or with `--classic`; non-TTY prompts use the noninteractive stream renderer. In the classic UI, mouse reporting is on by default so wheel swipes scroll the live tail and panels instead of being misread as prompt-history keys; native text selection stays one modifier away (Shift/Option/Fn), and `CLAI_CLASSIC_MOUSE=0` turns mouse reporting off. The interactive surfaces provide streaming chat, nested tool cards (including `tool.batch` sub-calls), file diffs, a live plan pane, pickers, history, and secure masked key prompts.
 
 | Action | Key |
 |--------|-----|
@@ -400,9 +399,12 @@ Tool cards show the command/input clearly and keep long scan tails in an expanda
 ## CLI commands
 
 ```sh
-clai [prompt...]                       # interactive console, or one-shot with a prompt
+clai [prompt...]                       # interactive UI, or one-shot with a prompt
   --mode <ask|agent|plan>  --provider <p>  --model <m>
-  -y/--yes  --no-history  --classic  --ui <legacy|tui|v2>
+  -y/--yes  --no-history
+  --show-thinking  --verbose  --quiet    # one-shot stream controls
+  --tui  --classic
+  --ui <tui|v2|opentui|classic|legacy|ink> # aliases; ignored with a prompt
 
 clai set <provider> [key]              # --from-env <VAR> | --stdin | --url <url> (repeatable) | --skip-ping
 clai unset <provider>                  # remove all keys for a provider (--url = endpoint URLs instead)
@@ -422,6 +424,18 @@ clai scope <show|new|add|clear>        # engagement scope (new: --targets --excl
 clai privacy <status|on|off|retention|clear-history|clear-logs|clear-artifacts|clear-all>
 ```
 
+### One-shot output and exit status
+
+`clai "prompt"` and piped prompts use the noninteractive stream renderer. The final
+assistant answer is written to **stdout**; progress, tool cards, diffs, thinking (when
+`--show-thinking` is enabled), confirmations, and errors are written to **stderr**. `--quiet`
+suppresses progress while retaining the final answer on stdout, and `--verbose` expands tool
+output and diff hunks. `--no-history` disables persistence for that run.
+
+A completed, partially completed, blocked, or failed turn returns exit code `0`; an aborted
+turn returns `130`; an unhandled or loader error returns `1`. `--show-thinking` can also be
+enabled with `CLAI_SHOW_THINKING=1`.
+
 ---
 
 ## Built-in tools
@@ -514,8 +528,11 @@ npm install
 npm run dev          # run from source
 npm run typecheck
 npm run build
-npm test             # full vitest suite
+npm test             # full Vitest suite
+npm run test:classic:pty  # provider-independent POSIX PTY smoke
 npm run compile      # native binaries (Bun)
+npm run release:verify
+npm pack --dry-run
 ```
 
 ---
@@ -547,8 +564,11 @@ clai/
 │  ├─ tools/            # fs, shell, net, http, web, pentest, batch, plan
 │  ├─ safety/           # risk classifier + engagement (scope) policy
 │  ├─ store/            # config, history, keys, plans, scope
-│  ├─ tui-v2/           # full-screen OpenTUI console (primary)
-│  ├─ app/              # session controllers, commands, events
+│  ├─ ui-core/         # renderer-neutral state, actions, layout, rendering, and ports
+│  ├─ classic/         # React + Ink classic UI and POSIX terminal bootstrap
+│  ├─ tui-v2/           # OpenTUI full-screen renderer
+│  ├─ noninteractive/   # stdout/stderr-split one-shot stream renderer
+│  ├─ app/              # session controllers, commands, events, and ports
 │  └─ prompts/          # agent methodology (embedded for the compiled binary)
 ├─ install/ · manifests/
 └─ package.json

package/bin/postinstall-policy.mjs

@@ -0,0 +1,3 @@
+export function shouldSkipBunInstall(platform = process.platform) {
+  return platform === "win32";
+}

package/bin/postinstall.mjs

@@ -2,12 +2,13 @@
 /**
  * Postinstall script for @pentoshi/clai.
  * Automatically checks for Bun (required by OpenTUI) and installs it into
- * ~/.clai/bin/bun across Linux, macOS, and Windows if missing.
+ * ~/.clai/bin/bun across Linux and macOS if missing.
  */
 import { spawnSync } from "node:child_process";
 import { accessSync, chmodSync, constants, existsSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
+import { shouldSkipBunInstall } from "./postinstall-policy.mjs";
 
 function findBun() {
   const binName = process.platform === "win32" ? "bun.exe" : "bun";
@@ -40,7 +41,9 @@ function findBun() {
   return undefined;
 }
 
-if (!findBun() && process.env.CLAI_NO_BUN_AUTO_INSTALL !== "1") {
+const skipBunInstall = shouldSkipBunInstall();
+
+if (!skipBunInstall && !findBun() && process.env.CLAI_NO_BUN_AUTO_INSTALL !== "1") {
   const targetDir = join(homedir(), ".clai");
   const binName = process.platform === "win32" ? "bun.exe" : "bun";
   const targetBin = join(targetDir, "bin", binName);
@@ -106,7 +109,7 @@ if (!findBun() && process.env.CLAI_NO_BUN_AUTO_INSTALL !== "1") {
   }
 }
 
-if (!findBun()) {
+if (!skipBunInstall && !findBun()) {
   console.log(`
   Note: Bun was not installed during postinstall.
   clai will automatically install Bun on first launch.

package/dist/agent/confirm-port.d.ts

@@ -1,13 +1,10 @@
+import { restoreInteractiveStdin } from "../noninteractive/readline-prompts.js";
 import type { ToolCall } from "../types.js";
 import type { SessionPolicy } from "./session-policy.js";
+export { restoreInteractiveStdin };
 export interface ConfirmPort {
     confirmTool(call: ToolCall): Promise<boolean>;
     confirmPentest(): Promise<boolean>;
-    /**
-     * Ask whether to continue after a progress-governor pause (or similar).
-     * `reason` is shown when present so the user knows why work stalled.
-     */
-    confirmContinue?(steps: number, reason?: string): Promise<boolean>;
     /**
      * Ask whether to leave ask mode and run an action task in agent mode.
      * Optional so existing ports keep working; ask-mode handoff falls back to a
@@ -18,18 +15,9 @@ export interface ConfirmPort {
         tools: string[];
     }): Promise<boolean>;
 }
-/**
- * Re-assert raw mode AND resume stdin after an inquirer prompt
- * (confirm/password). inquirer's readline interface pauses stdin and
- * switches it to cooked mode when it closes; if we only flip raw mode back
- * on but leave stdin paused, no `keypress`/`data` events flow to the REPL's
- * ESC/Ctrl+C abort handler — so a long-running tool launched right after a
- * confirmation can no longer be aborted (the user had to kill the terminal).
- * Calling resume() restores the event flow.
- */
-export declare function restoreInteractiveStdin(): void;
-export declare const inquirerConfirmPort: ConfirmPort;
-export declare function inquirerSecretRequester(request: {
+/** Default port: readline prompts on the process stdio (06-ONESHOT.md §4). */
+export declare const stdioConfirmPort: ConfirmPort;
+export declare function stdioSecretRequester(request: {
     title: string;
     prompt: string;
 }): Promise<string | undefined>;

package/dist/agent/confirm-port.js

@@ -1,70 +1,13 @@
-import { confirm, password } from "@inquirer/prompts";
-import chalk from "chalk";
 import { getConfig } from "../store/config.js";
 import { isPentestToolCall } from "../safety/classifier.js";
-import { formatToolArgs } from "./tool-call-parser.js";
-/**
- * Re-assert raw mode AND resume stdin after an inquirer prompt
- * (confirm/password). inquirer's readline interface pauses stdin and
- * switches it to cooked mode when it closes; if we only flip raw mode back
- * on but leave stdin paused, no `keypress`/`data` events flow to the REPL's
- * ESC/Ctrl+C abort handler — so a long-running tool launched right after a
- * confirmation can no longer be aborted (the user had to kill the terminal).
- * Calling resume() restores the event flow.
- */
-export function restoreInteractiveStdin() {
-    if (!process.stdin.isTTY)
-        return;
-    try {
-        if (!process.stdin.isRaw) {
-            process.stdin.setRawMode(true);
-        }
-        process.stdin.resume();
-    }
-    catch {
-        /* ignore */
-    }
-}
-export const inquirerConfirmPort = {
-    async confirmTool(call) {
-        return confirm({
-            message: chalk.yellow(`  run ${call.name}: ${formatToolArgs(call)}?`),
-            default: true,
-        });
-    },
-    async confirmPentest() {
-        return confirm({
-            message: chalk.red("clai only assists with security testing on systems you own or have written permission to test. Confirm for this session?"),
-            default: false,
-        });
-    },
-    async confirmContinue(steps, reason) {
-        const why = reason?.trim() ? ` (${reason.trim()})` : "";
-        try {
-            return await confirm({
-                message: chalk.yellow(`  pause after ${steps} step${steps === 1 ? "" : "s"}${why} — continue or stop?`),
-                default: true,
-            });
-        }
-        finally {
-            restoreInteractiveStdin();
-        }
-    },
-    async confirmAgentSwitch(info) {
-        const tools = info.tools.length > 0 ? ` (${info.tools.join(", ")})` : "";
-        return confirm({
-            message: chalk.yellow(`  this needs agent mode${tools} — switch and run it?`),
-            default: true,
-        });
-    },
-};
-export async function inquirerSecretRequester(request) {
-    try {
-        return await password({ message: request.prompt || request.title });
-    }
-    finally {
-        restoreInteractiveStdin();
-    }
+import { createStdioConfirmPort, createStdioSecretPort, } from "../noninteractive/stdio-confirm-port.js";
+import { restoreInteractiveStdin } from "../noninteractive/readline-prompts.js";
+export { restoreInteractiveStdin };
+/** Default port: readline prompts on the process stdio (06-ONESHOT.md §4). */
+export const stdioConfirmPort = createStdioConfirmPort();
+const requestStdioSecret = createStdioSecretPort();
+export async function stdioSecretRequester(request) {
+    return requestStdioSecret(request);
 }
 export async function ensurePentestAuthorization(call, autoConfirm, session, confirmPort) {
     if (!isPentestToolCall(call))

package/dist/agent/confirm-port.js.map

@@ -1 +1 @@
-{"version":3,"file":"confirm-port.js","sourceRoot":"","sources":["../../src/agent/confirm-port.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG5D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAqBvD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO;IACjC,IAAI,CAAC;QACH,IAAI,CAAE,OAAO,CAAC,KAAiD,CAAC,KAAK,EAAE,CAAC;YACtE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAgB;IAC9C,KAAK,CAAC,WAAW,CAAC,IAAc;QAC9B,OAAO,OAAO,CAAC;YACb,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YACrE,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,cAAc;QAClB,OAAO,OAAO,CAAC;YACb,OAAO,EAAE,KAAK,CAAC,GAAG,CAChB,0HAA0H,CAC3H;YACD,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,MAAe;QAClD,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC;gBACnB,OAAO,EAAE,KAAK,CAAC,MAAM,CACnB,iBAAiB,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,sBAAsB,CACjF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,uBAAuB,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,IAGxB;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,OAAO,CAAC;YACb,OAAO,EAAE,KAAK,CAAC,MAAM,CACnB,0BAA0B,KAAK,uBAAuB,CACvD;YACD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAG7C;IACC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,uBAAuB,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAc,EACd,WAAoB,EACpB,OAAsB,EACtB,WAAwB;IAExB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACpD,6DAA6D;IAC7D,IAAI,MAAM,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC1C,+DAA+D;IAC/D,IAAI,OAAO,CAAC,iBAAiB,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAEjD,IAAI,WAAW,EAAE,CAAC;QAChB,sEAAsE;QACtE,oEAAoE;QACpE,OAAO,CAAC,iBAAiB,CAAC,KAAK,GAAG,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,CAAC;IAC9C,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,OAAO,CAAC,iBAAiB,CAAC,KAAK,GAAG,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAc,EACd,WAAoB,EACpB,OAAsB,EACtB,WAAwB,EACxB,OAAgD;IAEhD,6EAA6E;IAC7E,gDAAgD;IAChD,IAAI,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACvD,OAAO,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,uEAAuE;IACvE,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,OAAO,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"confirm-port.js","sourceRoot":"","sources":["../../src/agent/confirm-port.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAIhF,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAgBnC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAgB,sBAAsB,EAAE,CAAC;AAEtE,MAAM,kBAAkB,GAAG,qBAAqB,EAAE,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAG1C;IACC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAc,EACd,WAAoB,EACpB,OAAsB,EACtB,WAAwB;IAExB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACpD,6DAA6D;IAC7D,IAAI,MAAM,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC1C,+DAA+D;IAC/D,IAAI,OAAO,CAAC,iBAAiB,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAEjD,IAAI,WAAW,EAAE,CAAC;QAChB,sEAAsE;QACtE,oEAAoE;QACpE,OAAO,CAAC,iBAAiB,CAAC,KAAK,GAAG,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,CAAC;IAC9C,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,OAAO,CAAC,iBAAiB,CAAC,KAAK,GAAG,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAc,EACd,WAAoB,EACpB,OAAsB,EACtB,WAAwB,EACxB,OAAgD;IAEhD,6EAA6E;IAC7E,gDAAgD;IAChD,IAAI,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACvD,OAAO,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,uEAAuE;IACvE,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,OAAO,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC"}

package/dist/agent/evidence-governor.d.ts

@@ -1,5 +1,5 @@
 export type ProgressSignal = "none" | "activity" | "evidence" | "completion";
-export type GovernorRecommendation = "continue" | "reflect" | "paused_budget" | "succeeded";
+export type GovernorRecommendation = "continue" | "reflect" | "succeeded";
 export interface GovernorState {
     readonly schemaVersion: 2;
     readonly steps: number;

package/dist/agent/evidence-governor.js

@@ -48,7 +48,7 @@ export function governProgress(state, signal, metrics = {}) {
         resourcesUsed: state.resourcesUsed + resourceCost,
     };
     if (next.resourcesUsed >= policy.emergencyCeiling) {
-        return { state: next, shouldContinue: false, requireEvidence: true, recommendation: "paused_budget", reason: "emergency resource ceiling reached" };
+        return { state: next, shouldContinue: true, requireEvidence: true, recommendation: "reflect", reason: "resource ceiling reached; reassess before continuing" };
     }
     if (signal === "completion" && evidenceDelta > 0) {
         return { state: next, shouldContinue: false, requireEvidence: false, recommendation: "succeeded", reason: "completion supported by new evidence" };
@@ -57,7 +57,7 @@ export function governProgress(state, signal, metrics = {}) {
         return { state: next, shouldContinue: true, requireEvidence: true, recommendation: "reflect", reason: "completion requires new evidence" };
     }
     if (repetitiveNoDelta && next.consecutiveNoDelta >= policy.pauseAfterNoDelta) {
-        return { state: next, shouldContinue: false, requireEvidence: true, recommendation: "paused_budget", reason: "repetitive work produced no evidence or hypothesis progress" };
+        return { state: next, shouldContinue: true, requireEvidence: true, recommendation: "reflect", reason: "repetitive work produced no evidence or hypothesis progress; change approach" };
     }
     if (repetitiveNoDelta && next.consecutiveNoDelta >= policy.reflectionAfterNoDelta) {
         return { state: next, shouldContinue: true, requireEvidence: true, recommendation: "reflect", reason: "repetitive work requires reflection" };

package/dist/agent/evidence-governor.js.map

@@ -1 +1 @@
-{"version":3,"file":"evidence-governor.js","sourceRoot":"","sources":["../../src/agent/evidence-governor.ts"],"names":[],"mappings":"AAuCA,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,gBAAgB,EAAE,EAAE;IACpB,gBAAgB,EAAE,EAAE;IACpB,sBAAsB,EAAE,CAAC;IACzB,iBAAiB,EAAE,CAAC;IACpB,mBAAmB,EAAE,GAAG;CACzB,CAAC;AAEF,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,CAAC;QACR,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,kBAAkB,EAAE,CAAC;QACrB,aAAa,EAAE,CAAC;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAsB;IAC5C,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC7H,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClI,IAAI,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC7H,IAAI,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,sBAAsB;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC3I,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;AACvI,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAoB,EACpB,MAAsB,EACtB,UAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,uBAAuB,CAAC;IACzD,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,IAAI,aAAa,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3I,IAAI,eAAe,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAE3G,MAAM,UAAU,GAAG,aAAa,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,CAAC,UAAU,IAAI,eAAe,IAAI,MAAM,CAAC,mBAAmB,CAAC;IACvF,MAAM,IAAI,GAAkB;QAC1B,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa,GAAG,aAAa;QAClD,eAAe,EAAE,KAAK,CAAC,eAAe,GAAG,eAAe;QACxD,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,GAAG,CAAC;QACjE,aAAa,EAAE,KAAK,CAAC,aAAa,GAAG,YAAY;KAClD,CAAC;IAEF,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACtJ,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACrJ,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IAC7I,CAAC;IACD,IAAI,iBAAiB,IAAI,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;IAC/K,CAAC;IACD,IAAI,iBAAiB,IAAI,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAChJ,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IACzK,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC;AACrL,CAAC"}
+{"version":3,"file":"evidence-governor.js","sourceRoot":"","sources":["../../src/agent/evidence-governor.ts"],"names":[],"mappings":"AAuCA,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,gBAAgB,EAAE,EAAE;IACpB,gBAAgB,EAAE,EAAE;IACpB,sBAAsB,EAAE,CAAC;IACzB,iBAAiB,EAAE,CAAC;IACpB,mBAAmB,EAAE,GAAG;CACzB,CAAC;AAEF,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,CAAC;QACR,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,kBAAkB,EAAE,CAAC;QACrB,aAAa,EAAE,CAAC;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAsB;IAC5C,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC7H,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClI,IAAI,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC7H,IAAI,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,sBAAsB;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC3I,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;AACvI,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAoB,EACpB,MAAsB,EACtB,UAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,uBAAuB,CAAC;IACzD,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,IAAI,aAAa,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3I,IAAI,eAAe,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAE3G,MAAM,UAAU,GAAG,aAAa,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,CAAC,UAAU,IAAI,eAAe,IAAI,MAAM,CAAC,mBAAmB,CAAC;IACvF,MAAM,IAAI,GAAkB;QAC1B,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa,GAAG,aAAa;QAClD,eAAe,EAAE,KAAK,CAAC,eAAe,GAAG,eAAe;QACxD,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,GAAG,CAAC;QACjE,aAAa,EAAE,KAAK,CAAC,aAAa,GAAG,YAAY;KAClD,CAAC;IAEF,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IACjK,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACrJ,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IAC7I,CAAC;IACD,IAAI,iBAAiB,IAAI,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,8EAA8E,EAAE,CAAC;IACzL,CAAC;IACD,IAAI,iBAAiB,IAAI,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAChJ,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IACzK,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC;AACrL,CAAC"}

package/dist/agent/finalize-gate.d.ts

@@ -44,7 +44,6 @@ export interface FinalizeGateInput {
     sawServerTail: boolean;
     sawLocalHttpProbe: boolean;
     sawFailedLocalHttpProbe: boolean;
-    serverCriterionRequired: boolean;
     sawActivePentestTest: boolean;
     sawSuccessfulMutation: boolean;
     featureAppAsk: boolean;

package/dist/agent/finalize-gate.js

@@ -2,7 +2,7 @@
  * Pure finalize-time gate: pick the recovery nudge that must replace a final
  * answer, or nothing when the turn may finalize. No I/O, no budget mutation.
  */
-import { budgetRemaining, freestyleClaimsAppReady, looksLikeShallowPentestReport, recoveryForErrorDiagnosis, recoveryForFailedProbe, recoveryForMissingFeature, recoveryForMissingPlan, recoveryForNarration, recoveryForRuntimeVerify, recoveryForShallowPentest, } from "./must-continue.js";
+import { budgetRemaining, looksLikeShallowPentestReport, recoveryForErrorDiagnosis, recoveryForFailedProbe, recoveryForMissingFeature, recoveryForMissingPlan, recoveryForNarration, recoveryForShallowPentest, } from "./must-continue.js";
 import { looksLikeErrorDiagnosisWithFixIntent, looksLikePlanNarration, } from "./tool-call-parser.js";
 export function chooseFinalizeRecovery(input) {
     const { cleaned, recovery, toolsAttached, productiveSteps, plan } = input;
@@ -78,29 +78,11 @@ export function chooseFinalizeRecovery(input) {
     if (input.buildLike &&
         !input.pentestLike &&
         !input.pentestSession &&
-        budgetRemaining(recovery, "runtimeVerify") &&
-        (!input.featureAppAsk || input.sawFeatureImplWrite)) {
-        const planRuntimeOk = Boolean(plan && plan.hasVerifiedRuntime);
-        const sessionRuntimeOk = input.sawServerStart &&
-            (input.sawServerTail || input.sawLocalHttpProbe || planRuntimeOk);
-        if (!planRuntimeOk && !sessionRuntimeOk) {
-            const codingPlanFinished = Boolean(plan &&
-                input.planApproved &&
-                plan.kind !== "pentest" &&
-                plan.tasks.length > 0 &&
-                plan.tasks.every((task) => task.state === "done" || task.state === "skipped"));
-            const freestyleLocalAppDone = !input.planApproved &&
-                input.sawLocalAppMaterialWork &&
-                productiveSteps > 0 &&
-                freestyleClaimsAppReady(cleaned) &&
-                (input.projectRoot !== undefined ||
-                    /\b(?:npm|pnpm|yarn|bun)\s+run\s+dev\b/i.test(cleaned) ||
-                    /\bopen\s+http:\/\/localhost\b/i.test(cleaned));
-            if ((codingPlanFinished || freestyleLocalAppDone) &&
-                input.serverCriterionRequired) {
-                return recoveryForRuntimeVerify(input.projectRoot);
-            }
-        }
+        input.sawFailedLocalHttpProbe &&
+        !input.sawLocalHttpProbe &&
+        budgetRemaining(recovery, "failedProbe") &&
+        cleaned.trim().length > 0) {
+        return recoveryForFailedProbe();
     }
     if (input.buildLike &&
         !input.pentestLike &&

package/dist/agent/finalize-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"finalize-gate.js","sourceRoot":"","sources":["../../src/agent/finalize-gate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,6BAA6B,EAC7B,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,GAG1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oCAAoC,EACpC,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAsD/B,MAAM,UAAU,sBAAsB,CACpC,KAAwB;IAExB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAE1E,MAAM,YAAY,GAChB,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,eAAe,CAAC;QAC9C,CAAC,KAAK,CAAC,gBAAgB;QACvB,eAAe,KAAK,CAAC;QACrB,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,iBAAiB,GACrB,CAAC,KAAK,CAAC,qBAAqB;QAC5B,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAEhD,MAAM,2BAA2B,GAC/B,eAAe,KAAK,CAAC;QACrB,YAAY;QACZ,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,iBAAiB,CAAC;YAChD,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAC5B,CAAC,KAAK,CAAC,YAAY;YACjB,KAAK,CAAC,eAAe;YACrB,CAAC,KAAK,CAAC,cAAc,IAAI,iBAAiB,CAAC,CAAC;QAC9C,CAAC,KAAK,CAAC,YAAY,IAAI,iBAAiB,CAAC;QACzC,CAAC,KAAK,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAAC;IAC7C,IACE,KAAK,CAAC,WAAW;QACjB,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzB,2BAA2B,EAC3B,CAAC;QACD,IAAI,MAAkC,CAAC;QACvC,IAAI,iBAAiB,IAAI,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YAC/D,MAAM,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;QACpD,CAAC;aAAM,IACL,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;YACzC,KAAK,CAAC,eAAe;YACrB,KAAK,CAAC,YAAY,EAClB,CAAC;YACD,MAAM,GAAG,oBAAoB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAC5D,CAAC;aAAM,IACL,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;YACzC,KAAK,CAAC,eAAe,EACrB,CAAC;YACD,MAAM,GAAG,oBAAoB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;aAAM,IACL,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;YACzC,KAAK,CAAC,iBAAiB,EACvB,CAAC;YACD,MAAM,GAAG,oBAAoB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;aAAM,IACL,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;YACzC,KAAK,CAAC,aAAa;YACnB,YAAY,EACZ,CAAC;YACD,MAAM,GAAG,oBAAoB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;QACnE,CAAC;aAAM,IACL,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;YACzC,KAAK,CAAC,aAAa,EACnB,CAAC;YACD,MAAM,GAAG,oBAAoB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,oBAAoB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,IACE,KAAK,CAAC,UAAU;QAChB,CAAC,KAAK,CAAC,kBAAkB;QACzB,CAAC,KAAK,CAAC,kBAAkB;QACzB,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,EACtC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YACpC,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,IACE,KAAK,CAAC,SAAS;QACf,CAAC,KAAK,CAAC,WAAW;QAClB,CAAC,KAAK,CAAC,cAAc;QACrB,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,aAAa;QACnB,CAAC,KAAK,CAAC,mBAAmB;QAC1B,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,uBAAuB,CAAC;QACtD,eAAe,GAAG,CAAC;QACnB,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,EACxC,CAAC;QACD,OAAO,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,IACE,KAAK,CAAC,SAAS;QACf,CAAC,KAAK,CAAC,WAAW;QAClB,CAAC,KAAK,CAAC,cAAc;QACrB,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC;QAC1C,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,mBAAmB,CAAC,EACnD,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GACpB,KAAK,CAAC,cAAc;YACpB,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,iBAAiB,IAAI,aAAa,CAAC,CAAC;QACpE,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxC,MAAM,kBAAkB,GAAG,OAAO,CAChC,IAAI;gBACJ,KAAK,CAAC,YAAY;gBAClB,IAAI,CAAC,IAAI,KAAK,SAAS;gBACvB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBACrB,IAAI,CAAC,KAAK,CAAC,KAAK,CACd,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAC5D,CACF,CAAC;YACF,MAAM,qBAAqB,GACzB,CAAC,KAAK,CAAC,YAAY;gBACnB,KAAK,CAAC,uBAAuB;gBAC7B,eAAe,GAAG,CAAC;gBACnB,uBAAuB,CAAC,OAAO,CAAC;gBAChC,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS;oBAC9B,wCAAwC,CAAC,IAAI,CAAC,OAAO,CAAC;oBACtD,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,IACE,CAAC,kBAAkB,IAAI,qBAAqB,CAAC;gBAC7C,KAAK,CAAC,uBAAuB,EAC7B,CAAC;gBACD,OAAO,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IACE,KAAK,CAAC,SAAS;QACf,CAAC,KAAK,CAAC,WAAW;QAClB,CAAC,KAAK,CAAC,cAAc;QACrB,KAAK,CAAC,uBAAuB;QAC7B,CAAC,KAAK,CAAC,iBAAiB;QACxB,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC;QACxC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EACzB,CAAC;QACD,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED,IACE,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,cAAc,CAAC;QAC3C,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAC3C,6BAA6B,CAAC,OAAO,EAAE;YACrC,eAAe;YACf,aAAa,EAAE,KAAK,CAAC,oBAAoB;SAC1C,CAAC,EACF,CAAC;QACD,OAAO,yBAAyB,EAAE,CAAC;IACrC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"finalize-gate.js","sourceRoot":"","sources":["../../src/agent/finalize-gate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,eAAe,EACf,6BAA6B,EAC7B,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,GAG1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oCAAoC,EACpC,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAqD/B,MAAM,UAAU,sBAAsB,CACpC,KAAwB;IAExB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAE1E,MAAM,YAAY,GAChB,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,eAAe,CAAC;QAC9C,CAAC,KAAK,CAAC,gBAAgB;QACvB,eAAe,KAAK,CAAC;QACrB,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,iBAAiB,GACrB,CAAC,KAAK,CAAC,qBAAqB;QAC5B,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAEhD,MAAM,2BAA2B,GAC/B,eAAe,KAAK,CAAC;QACrB,YAAY;QACZ,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,iBAAiB,CAAC;YAChD,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAC5B,CAAC,KAAK,CAAC,YAAY;YACjB,KAAK,CAAC,eAAe;YACrB,CAAC,KAAK,CAAC,cAAc,IAAI,iBAAiB,CAAC,CAAC;QAC9C,CAAC,KAAK,CAAC,YAAY,IAAI,iBAAiB,CAAC;QACzC,CAAC,KAAK,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAAC;IAC7C,IACE,KAAK,CAAC,WAAW;QACjB,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzB,2BAA2B,EAC3B,CAAC;QACD,IAAI,MAAkC,CAAC;QACvC,IAAI,iBAAiB,IAAI,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YAC/D,MAAM,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;QACpD,CAAC;aAAM,IACL,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;YACzC,KAAK,CAAC,eAAe;YACrB,KAAK,CAAC,YAAY,EAClB,CAAC;YACD,MAAM,GAAG,oBAAoB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAC5D,CAAC;aAAM,IACL,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;YACzC,KAAK,CAAC,eAAe,EACrB,CAAC;YACD,MAAM,GAAG,oBAAoB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;aAAM,IACL,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;YACzC,KAAK,CAAC,iBAAiB,EACvB,CAAC;YACD,MAAM,GAAG,oBAAoB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;aAAM,IACL,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;YACzC,KAAK,CAAC,aAAa;YACnB,YAAY,EACZ,CAAC;YACD,MAAM,GAAG,oBAAoB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;QACnE,CAAC;aAAM,IACL,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC;YACzC,KAAK,CAAC,aAAa,EACnB,CAAC;YACD,MAAM,GAAG,oBAAoB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,oBAAoB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,IACE,KAAK,CAAC,UAAU;QAChB,CAAC,KAAK,CAAC,kBAAkB;QACzB,CAAC,KAAK,CAAC,kBAAkB;QACzB,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,EACtC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YACpC,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,IACE,KAAK,CAAC,SAAS;QACf,CAAC,KAAK,CAAC,WAAW;QAClB,CAAC,KAAK,CAAC,cAAc;QACrB,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,aAAa;QACnB,CAAC,KAAK,CAAC,mBAAmB;QAC1B,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,uBAAuB,CAAC;QACtD,eAAe,GAAG,CAAC;QACnB,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,EACxC,CAAC;QACD,OAAO,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,IACE,KAAK,CAAC,SAAS;QACf,CAAC,KAAK,CAAC,WAAW;QAClB,CAAC,KAAK,CAAC,cAAc;QACrB,KAAK,CAAC,uBAAuB;QAC7B,CAAC,KAAK,CAAC,iBAAiB;QACxB,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC;QACxC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EACzB,CAAC;QACD,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IACD,IACE,KAAK,CAAC,SAAS;QACf,CAAC,KAAK,CAAC,WAAW;QAClB,CAAC,KAAK,CAAC,cAAc;QACrB,KAAK,CAAC,uBAAuB;QAC7B,CAAC,KAAK,CAAC,iBAAiB;QACxB,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC;QACxC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EACzB,CAAC;QACD,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED,IACE,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,cAAc,CAAC;QAC3C,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAC3C,6BAA6B,CAAC,OAAO,EAAE;YACrC,eAAe;YACf,aAAa,EAAE,KAAK,CAAC,oBAAoB;SAC1C,CAAC,EACF,CAAC;QACD,OAAO,yBAAyB,EAAE,CAAC;IACrC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/agent/loop-guard.d.ts

@@ -48,6 +48,7 @@ export declare class LoopGuard {
     private consecutiveSequenceRepeats;
     private totalSequenceSuppressions;
     private sequenceRunCounts;
+    private sequenceOutcomes;
     private emptySuccessfulCalls;
     private failedReadRetryUsed;
     private successfulOutputs;

package/dist/agent/loop-guard.js

@@ -64,6 +64,7 @@ export class LoopGuard {
     consecutiveSequenceRepeats = 0;
     totalSequenceSuppressions = 0;
     sequenceRunCounts = new Map();
+    sequenceOutcomes = new Map();
     emptySuccessfulCalls = new Map();
     failedReadRetryUsed = new Set();
     successfulOutputs = new Map();
@@ -181,6 +182,29 @@ export class LoopGuard {
             this.lastActionSequenceOutcome = undefined;
             this.unchangedActionSequenceRuns = 0;
             this.consecutiveSequenceRepeats = 0;
+            const prior = this.sequenceOutcomes.get(signature);
+            if (prior && prior.unchangedRuns >= 3) {
+                this.totalSequenceSuppressions += 1;
+                return {
+                    suppress: true,
+                    terminal: this.totalSequenceSuppressions >= 4,
+                    repetitions: prior.unchangedRuns,
+                    totalSuppressions: this.totalSequenceSuppressions,
+                    oscillation: true,
+                    warn: false,
+                };
+            }
+            if (prior && prior.unchangedRuns >= 2) {
+                return {
+                    suppress: false,
+                    terminal: false,
+                    repetitions: prior.unchangedRuns,
+                    totalSuppressions: this.totalSequenceSuppressions,
+                    oscillation: true,
+                    warn: true,
+                    warnMessage: "This action sequence has returned after intervening actions and produced the same observable result repeatedly. Use the existing result or take a materially different action; another unchanged cycle will be blocked.",
+                };
+            }
             return none;
         }
         if (!this.lastActionSequenceEligible) {
@@ -260,6 +284,7 @@ export class LoopGuard {
             this.actionSequenceRepetitions = 0;
             this.lastActionSequenceOutcome = undefined;
             this.unchangedActionSequenceRuns = 0;
+            this.sequenceOutcomes.delete(signature);
             return;
         }
         if (this.sequenceNeedsOutcomeComparison(calls)) {
@@ -269,6 +294,11 @@ export class LoopGuard {
                 ? this.unchangedActionSequenceRuns + 1
                 : 1;
             this.lastActionSequenceOutcome = comparableOutcome;
+            const prior = this.sequenceOutcomes.get(signature);
+            this.sequenceOutcomes.set(signature, {
+                fingerprint: comparableOutcome,
+                unchangedRuns: prior?.fingerprint === comparableOutcome ? prior.unchangedRuns + 1 : 1,
+            });
         }
         this.sequenceRunCounts.set(signature, (this.sequenceRunCounts.get(signature) ?? 0) + 1);
     }
@@ -279,15 +309,18 @@ export class LoopGuard {
         return this.resetSequenceCountBySignature(signature);
     }
     resetSequenceCountBySignature(signature) {
-        if (!this.sequenceRunCounts.has(signature))
+        if (!this.sequenceRunCounts.has(signature) &&
+            !this.sequenceOutcomes.has(signature))
             return false;
         this.sequenceRunCounts.delete(signature);
+        this.sequenceOutcomes.delete(signature);
         this.actionSequenceRepetitions = 0;
         this.consecutiveSequenceRepeats = 0;
         return true;
     }
     resetAllSequenceCounts() {
         this.sequenceRunCounts.clear();
+        this.sequenceOutcomes.clear();
         this.actionSequenceRepetitions = 0;
         this.consecutiveSequenceRepeats = 0;
         this.lastActionSequenceOutcome = undefined;