@trenchwork/coder 1.5.6 → 1.5.8

package/dist/headless/interactiveShell.js

@@ -20,6 +20,7 @@ import { exec as childExec } from 'node:child_process';
 import { promisify } from 'node:util';
 import chalk from 'chalk';
 import { getHITL, hitlEvents, setDecisionPresenter } from '../core/hitl.js';
+import { formatErrorForDisplay } from '../core/errorDisplay.js';
 // Connector imports removed — CLI is local-only, no GitHub gate.
 // Stub functions (antiTermination removed)
 const initializeProtection = (_config) => { };
@@ -105,9 +106,21 @@ async function* iterateWithTimeout(iterator, timeoutMs, onTimeout) {
                 result = await pending;
             }
             else {
-                // Race between pending result and timeout
-                const timeoutPromise = new Promise((resolve) => setTimeout(() => resolve({ __timeout: true }), timeoutMs));
-                result = await Promise.race([pending, timeoutPromise]);
+                // Race between pending result and timeout. The timer MUST be cleared
+                // once the race settles: Promise.race does not cancel losers, so the
+                // old discarded timer id left one live 10-minute timer PER CONSUMED
+                // EVENT — tens of thousands of armed timers (and ~15MB of pinned
+                // closures) per fast-streaming turn, holding the event loop open.
+                let timeoutId;
+                const timeoutPromise = new Promise((resolve) => {
+                    timeoutId = setTimeout(() => resolve({ __timeout: true }), timeoutMs);
+                });
+                try {
+                    result = await Promise.race([pending, timeoutPromise]);
+                }
+                finally {
+                    clearTimeout(timeoutId);
+                }
             }
             if ('__timeout' in result) {
                 onTimeout?.();
@@ -155,7 +168,10 @@ function welcomeBodyLines(input) {
     const body = [title, ''];
     const mode = input.keyMode ?? (input.hasApiKey ? 'own' : 'none');
     if (mode === 'own') {
-        body.push(`${input.model} · ${input.provider}`, `Key: ${input.maskedKey} · /help for commands`);
+        // §7 shape: model + /help, then cwd. No provider chip (redundant with
+        // the model name) and no key material in chrome — Claude Code never
+        // surfaces credentials in the banner; /keys still shows the masked key.
+        body.push(`${input.model} · /help for commands`);
     }
     else {
         body.push('⚠ No DeepSeek API key configured', '', '  /key sk-…    DeepSeek (required) · platform.deepseek.com', '  /key tvly-…  Tavily web search (optional) · tavily.com');
@@ -190,7 +206,9 @@ function roundedBox(content, paint = (s) => s, border = (s) => s) {
  * WHICH lines appear.
  */
 export function composeWelcomeLines(input) {
-    return ['', ...(input.updateLines ?? []), ...roundedBox(welcomeBodyLines(input)), ''];
+    // No trailing blank: ChatStatic already adds the §1 one-line gap before the
+    // next block — a built-in trailing blank made it a double gap.
+    return ['', ...(input.updateLines ?? []), ...roundedBox(welcomeBodyLines(input))];
 }
 /**
  * Run the fully interactive shell with rich UI.
@@ -285,6 +303,11 @@ class InteractiveShell {
     };
     pendingModelSwitch = null;
     currentResponseBuffer = '';
+    // What this turn already rendered as an 'error' — dedupes the event-vs-
+    // rejection double print of the same provider failure.
+    lastShownTurnError = null;
+    // One-time per session: real prompt_tokens exceeded the configured window.
+    warnedWindowDrift = false;
     // The turn's final assistant text, captured BEFORE currentResponseBuffer is
     // cleared on message.complete. The auto-continue refusal/completion/governor
     // reads run in the `finally`, AFTER that clear, so reading the buffer there saw
@@ -491,31 +514,25 @@ class InteractiveShell {
                 return key.slice(0, 3) + '...' + key.slice(-3);
             return key.slice(0, 6) + '...' + key.slice(-4);
         };
-        // Update check runs for everyone (no account required), with a hard
-        // race-timeout so a slow registry never delays the banner.
-        const updateLines = [];
-        const updatePromise = Promise.race([
-            checkForUpdates(version).catch(() => null),
-            new Promise((resolve) => setTimeout(() => resolve(null), 2000)),
-        ]);
-        // Resolve the update check BEFORE composing the welcome lines — the
-        // previous order built welcomeLines with `...updateLines` (the array
-        // was empty at that point) and only populated updateLines afterwards,
-        // so the upgrade banner literally never rendered. Bug shipped before
-        // the scoped-package rename made the check return wrong data anyway.
-        const updateInfo = await updatePromise;
-        if (updateInfo?.updateAvailable) {
+        // Update check: NEVER gates the banner. The old order awaited an
+        // `npm view` subprocess (a full network round trip, up to the 2s cap, on
+        // EVERY launch) before the welcome box — and before any queued startup
+        // prompt — rendered. Now the banner renders immediately and the update
+        // offer arrives as a follow-up system line when the check resolves.
+        void checkForUpdates(version).then((updateInfo) => {
+            if (!updateInfo?.updateAvailable || this.shouldExit)
+                return;
             // Detect + OFFER (don't force) — the user applies it in-shell with
             // /update. Auto-installing on every startup ran `npm i -g` without
             // consent and could fail silently; making it user-initiated is clearer.
             this.pendingUpdate = updateInfo;
-            updateLines.push(chalk.cyan('  ⬆ ') +
+            this.promptController?.getRenderer()?.addEvent('system', chalk.cyan('⬆ ') +
                 chalk.dim('Update available: ') +
                 chalk.yellow(`v${updateInfo.current}`) +
                 chalk.dim(' → ') +
                 chalk.green(`v${updateInfo.latest}`) +
                 chalk.dim(' · type ') + chalk.hex('#ffd666')('/update') + chalk.dim(' to upgrade'));
-        }
+        }).catch(() => { });
         // Clean, minimal welcome — a sparkle + the essentials in a rounded box,
         // mirroring Claude Code. The pure composeWelcomeLines() is the contract for
         // WHICH lines appear; here we draw the same box with brand colour.
@@ -533,7 +550,10 @@ class InteractiveShell {
             version: `v${version}`,
         });
         const boxed = roundedBox(body, (cell) => cell.replace('✻', starlight('✻')), (s) => wire(s));
-        const welcomeContent = ['', ...updateLines, ...boxed, ''].join('\n');
+        // No leading/trailing '' sentinels: the banner string used to embed its
+        // own blank lines AND ChatStatic adds marginTop on the next block — a
+        // double-blank gap (§1 violation) around every banner.
+        const welcomeContent = boxed.join('\n');
         // Use renderer event system instead of direct stdout writes
         renderer.addEvent('banner', welcomeContent);
         // Update renderer meta with model info
@@ -808,12 +828,16 @@ class InteractiveShell {
                 maxBuffer: 4 * 1024 * 1024,
             });
             const output = [out, stderr].filter(Boolean).join('').trim() || '(no output)';
-            renderer?.addEvent('tool', `$ ${command}\n${output}`);
+            // §2/§3: header and result are separate blocks — one combined 'tool'
+            // event rendered the whole output bold as if it were the tool name.
+            renderer?.addEvent('tool', `$ ${command}`);
+            renderer?.addEvent('tool-result', formatToolResult('bash', output, { command }));
         }
         catch (error) {
             const err = error;
             const output = [err.stdout, err.stderr, err.message].filter(Boolean).join('\n').trim();
-            renderer?.addEvent('error', `$ ${command}\n${output || 'command failed'}`);
+            renderer?.addEvent('tool', `$ ${command}`);
+            renderer?.addEvent('error', formatToolError(output || 'command failed'));
         }
         finally {
             this.promptController?.setStatusMessage(null);
@@ -1441,7 +1465,6 @@ class InteractiveShell {
             dim(`System prompt ~${formatTokenCount(usage.systemTokens)} · conversation ~${formatTokenCount(usage.conversationTokens)} · ${usage.messageCount} messages`),
         ];
         this.promptController.setInlinePanel(lines);
-        this.scheduleInlinePanelDismiss();
     }
     /** /cost — DeepSeek tokens + Tavily searches consumed (this install). */
     showUsage() {
@@ -1460,10 +1483,12 @@ class InteractiveShell {
             label('DeepSeek') + dim(`${ds(cumulative)}   ·   this session ${ds(session)}`),
             label('Tavily') + dim(`${cumulative.tavilySearches} searches   ·   this session ${session.tavilySearches}`),
             '',
-            dim(`Tavily free pool: ${TAVILY_MONTHLY_FREE.toLocaleString('en-US')}/mo + ${TAVILY_ONE_TIME_BONUS.toLocaleString('en-US')} one-time bonus (shared proxy; set your own key for unlimited).`),
+            // Two ≤78-col lines — the single-sentence version measured 97 cols and
+            // word-wrapped onto an unindented row at the default 80-col terminal.
+            dim(`Tavily free pool: ${TAVILY_MONTHLY_FREE.toLocaleString('en-US')}/mo + ${TAVILY_ONE_TIME_BONUS.toLocaleString('en-US')} one-time bonus (shared proxy).`),
+            dim('Set your own key for unlimited: /key tvly-…'),
         ];
         this.promptController.setInlinePanel(lines);
-        this.scheduleInlinePanelDismiss();
     }
     /**
      * /diff — review every file the agent changed this run as a colored diff,
@@ -1509,7 +1534,6 @@ class InteractiveShell {
             ...panel.lines,
         ];
         this.promptController.setInlinePanel(lines);
-        this.scheduleInlinePanelDismiss();
     }
     /**
      * /rewind — restore the files changed this run. Two-step: bare `/rewind`
@@ -1578,7 +1602,6 @@ class InteractiveShell {
             dim('Shift+Tab cycles permission mode · Ctrl+D exits · ? for shortcuts'),
         ];
         this.promptController.setInlinePanel(lines);
-        this.scheduleInlinePanelDismiss();
     }
     showKeyboardShortcuts() {
         if (!this.promptController?.supportsInlinePanel()) {
@@ -1588,6 +1611,10 @@ class InteractiveShell {
         }
         const kb = (key) => chalk.hex('#ffd666')(key);
         const desc = (text) => chalk.dim(text);
+        // Pad the PLAIN key text before colouring so the description column is
+        // grid-aligned — hand-counted spaces inside coloured templates drifted
+        // by 1-2 cols per row.
+        const row = (keys, text) => `  ${kb(keys.padEnd(14))}${desc(text)}`;
         // Only shortcuts the Ink Prompt (src/ui/ink/Prompt.tsx) actually
         // implements are listed — advertising keys the input handler ignores
         // would be a deceptive panel (Glasswing transparency).
@@ -1595,52 +1622,35 @@ class InteractiveShell {
             chalk.bold.hex('#e8e9ed')('Keyboard Shortcuts') + chalk.dim('  (press any key to dismiss)'),
             '',
             chalk.hex('#64d2ff')('Navigation'),
-            `  ${kb('Ctrl+A')} / ${kb('Home')}  ${desc('Move to start of line')}`,
-            `  ${kb('Ctrl+E')} / ${kb('End')}   ${desc('Move to end of line')}`,
-            `  ${kb('←')} / ${kb('→')}        ${desc('Move cursor')}`,
-            `  ${kb('↑')} / ${kb('↓')}        ${desc('Prompt history (older / newer)')}`,
-            `  ${kb('Ctrl+R')}        ${desc('Reverse-search prompt history')}`,
+            row('Ctrl+A / Home', 'Move to start of line'),
+            row('Ctrl+E / End', 'Move to end of line'),
+            row('← / →', 'Move cursor'),
+            row('↑ / ↓', 'Prompt history (older / newer)'),
+            row('Ctrl+R', 'Reverse-search prompt history'),
             '',
             chalk.hex('#64d2ff')('Editing'),
-            `  ${kb('Ctrl+U')}  ${desc('Delete to start of line')}`,
-            `  ${kb('Ctrl+W')}  ${desc('Delete word backward')}`,
-            `  ${kb('Ctrl+K')}  ${desc('Delete to end of line')}`,
+            row('Ctrl+U', 'Delete to start of line'),
+            row('Ctrl+W', 'Delete word backward'),
+            row('Ctrl+K', 'Delete to end of line'),
             '',
             chalk.hex('#64d2ff')('Modes'),
-            `  ${kb('Shift+Tab')}  ${desc('Cycle permission mode (default · accept edits · plan)')}`,
-            `  ${kb('Ctrl+O')}     ${desc('Expand the last truncated tool result')}`,
+            row('Shift+Tab', 'Cycle permission mode (default · accept edits · plan)'),
+            row('Ctrl+O', 'Expand the last truncated tool result'),
             '',
             chalk.hex('#64d2ff')('Completion'),
-            `  ${kb('@')}          ${desc('Autocomplete a file (↑/↓ · Tab/Enter); its content is inlined for the agent')}`,
-            `  ${kb('/')}          ${desc('Autocomplete a command (↑/↓ · Tab to complete; Enter runs it)')}`,
+            row('@', 'Autocomplete a file; its content is inlined for the agent'),
+            row('/', 'Autocomplete a command (↑/↓ · Tab to complete; Enter runs it)'),
             '',
             chalk.hex('#64d2ff')('Control'),
-            `  ${kb('Ctrl+C')}  ${desc('Clear input / interrupt')}`,
-            `  ${kb('Ctrl+D')}  ${desc('Exit (when empty)')}`,
+            row('Ctrl+C', 'Clear input / interrupt'),
+            row('Ctrl+D', 'Exit (when empty)'),
         ];
         this.promptController.setInlinePanel(lines);
-        this.scheduleInlinePanelDismiss();
-    }
-    /**
-     * Auto-dismiss inline panel after timeout or on next input.
-     */
-    inlinePanelDismissTimer = null;
-    scheduleInlinePanelDismiss() {
-        // Clear any existing timer
-        if (this.inlinePanelDismissTimer) {
-            clearTimeout(this.inlinePanelDismissTimer);
-        }
-        // Auto-dismiss after 8 seconds
-        this.inlinePanelDismissTimer = setTimeout(() => {
-            this.promptController?.clearInlinePanel();
-            this.inlinePanelDismissTimer = null;
-        }, 8000);
     }
+    // Panels dismiss on the next keypress (Prompt → onDismissPanel), never on a
+    // timer: the old 8s auto-dismiss yanked /context and /help mid-read, which
+    // Claude Code never does.
     dismissInlinePanel() {
-        if (this.inlinePanelDismissTimer) {
-            clearTimeout(this.inlinePanelDismissTimer);
-            this.inlinePanelDismissTimer = null;
-        }
         this.promptController?.clearInlinePanel();
     }
     handleSubmit(text) {
@@ -1699,7 +1709,15 @@ class InteractiveShell {
             renderer?.setQueuedPrompts(this.pendingPrompts.slice());
             return;
         }
-        void this.processPrompt(trimmed);
+        void this.processPrompt(trimmed).catch((e) => {
+            // processPrompt handles its own errors; this is the last net so a
+            // rejection can't reach the global unhandledRejection handler (which
+            // exits the CLI with code 1).
+            try {
+                this.promptController?.getRenderer()?.addEvent('error', formatErrorForDisplay(e instanceof Error ? e.message : String(e)));
+            }
+            catch { /* ignore */ }
+        });
     }
     /**
      * Dequeue and run the next live follow-up, if any: commit its user line to
@@ -1754,6 +1772,10 @@ class InteractiveShell {
             // displayed above the chat box.
         }
         enterCriticalSection();
+        // Per-turn dedupe latch for error display: a provider failure arrives
+        // both as an 'error' event AND as the sink rejection thrown out of the
+        // event loop — without the latch the same message printed twice.
+        this.lastShownTurnError = null;
         this.isProcessing = true;
         this.currentResponseBuffer = '';
         this.finalResponseText = '';
@@ -1776,6 +1798,12 @@ class InteractiveShell {
         let reasoningTimedOut = false;
         let stepTimedOut = false;
         let hitlDepth = 0;
+        // The `⏺ Tool(arg)` header most recently emitted into history, or null
+        // once any other event rendered after it. With PARALLEL tools the
+        // start/start/complete/complete interleave glued tool B's result under
+        // tool A's header (§3); tool.complete re-emits its own header when it
+        // isn't the last thing on screen.
+        let lastToolHeaderEmitted = null;
         // Track total prompt processing time to prevent infinite loops
         const promptStartTime = Date.now();
         const TOTAL_PROMPT_TIMEOUT_MS = 24 * 60 * 60 * 1000; // 24 hours max for entire prompt without meaningful content
@@ -1910,6 +1938,7 @@ class InteractiveShell {
                                 }
                             }
                             renderer.addEvent('response', '\n');
+                            lastToolHeaderEmitted = null; // prose rendered since the last header
                             // Capture the authoritative final text BEFORE the buffer is cleared
                             // (the finally's auto-continue reads run after this clear).
                             this.finalResponseText = sourceText || this.finalResponseText;
@@ -1940,7 +1969,9 @@ class InteractiveShell {
                         // (subagent.start/complete) are the visible surface instead of a
                         // raw `parallel_agents({"tasks":…})` JSON dump.
                         if (renderer && toolName !== 'parallel_agents') {
-                            renderer.addEvent('tool', formatToolCall(toolName, args, this.workingDir));
+                            const header = formatToolCall(toolName, args, this.workingDir);
+                            renderer.addEvent('tool', header);
+                            lastToolHeaderEmitted = header;
                         }
                         this.promptController?.setStatusMessage(toolActivityLabel(toolName, args, this.workingDir));
                         break;
@@ -1964,6 +1995,16 @@ class InteractiveShell {
                         if (event.result && typeof event.result === 'string' && event.result.trim() && renderer) {
                             const params = event.parameters;
                             const summary = formatToolResult(event.toolName, event.result, params);
+                            // Pair the ⎿ result with ITS call: if another tool's header (or
+                            // any other event) rendered since this tool's start, re-emit
+                            // this call's header so the result lands under the right one.
+                            if (event.toolName !== 'parallel_agents') {
+                                const ownHeader = formatToolCall(event.toolName, params, this.workingDir);
+                                if (lastToolHeaderEmitted !== ownHeader) {
+                                    renderer.addEvent('tool', ownHeader);
+                                }
+                                lastToolHeaderEmitted = null; // a result now sits below the header
+                            }
                             renderer.addEvent('tool-result', summary);
                             // Remember the full result so Ctrl+O can expand it — but only
                             // when the summary actually truncated (the `(ctrl+o to expand)`
@@ -1983,11 +2024,18 @@ class InteractiveShell {
                         if (renderer) {
                             // Red `  ⎿  Error: …` line, mirroring a failed tool result.
                             renderer.addEvent('error', formatToolError(event.error));
+                            lastToolHeaderEmitted = null;
                         }
                         break;
                     case 'error':
                         if (renderer) {
-                            renderer.addEvent('error', event.error);
+                            // Compact display (no multi-KB HTML/JSON walls) + remember what
+                            // was shown so the catch below doesn't print it a second time —
+                            // the same failure also arrives as the sink rejection.
+                            const shown = formatErrorForDisplay(event.error);
+                            this.lastShownTurnError = shown;
+                            renderer.addEvent('error', shown);
+                            lastToolHeaderEmitted = null;
                         }
                         break;
                     case 'usage': {
@@ -2005,6 +2053,17 @@ class InteractiveShell {
                             this.lastInputTokens = contextTokens;
                         }
                         const windowTokens = getModelContextInfo(this.profileConfig.model).contextWindow;
+                        // Window-drift self-report: the provider's prompt_tokens is REAL
+                        // API data — if it ever exceeds the configured window, the static
+                        // context table is provably stale (this exact drift hid the
+                        // 131k-vs-1M bug; the meter clamps to 100% so nothing else
+                        // surfaces it). DeepSeek's /models returns no window metadata
+                        // (probed), so this is the only runtime verification available.
+                        if (!this.warnedWindowDrift &&
+                            typeof contextTokens === 'number' && contextTokens > windowTokens) {
+                            this.warnedWindowDrift = true;
+                            renderer?.addEvent('system', chalk.dim(`Note: the provider reports ${contextTokens.toLocaleString('en-US')} input tokens — more than the configured ${windowTokens.toLocaleString('en-US')}-token window for ${this.profileConfig.model}. The context table is likely stale; context % may be wrong.`));
+                        }
                         this.promptController?.setMetaStatus({
                             outputTokens: this.turnTokenMeter.current(),
                             contextTokens,
@@ -2118,7 +2177,14 @@ class InteractiveShell {
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
             if (renderer) {
-                renderer.addEvent('error', message);
+                // Same failure usually already arrived (and rendered) as the turn's
+                // 'error' event — the sink queues the event BEFORE rejecting. Skip
+                // the duplicate; render compactly when it really is new.
+                const shown = formatErrorForDisplay(message);
+                if (shown !== this.lastShownTurnError) {
+                    this.lastShownTurnError = shown;
+                    renderer.addEvent('error', shown);
+                }
             }
             // Fallback: If we have reasoning content but no response was generated, synthesize one
             if (!episodeSuccess && shouldSynthesizeFromReasoning({ hasReceivedResponseContent, finalResponseText: this.finalResponseText, currentResponseBuffer: this.currentResponseBuffer, reasoningBuffer })) {
@@ -2185,80 +2251,96 @@ class InteractiveShell {
             // Process any queued follow-up — single source of truth (drainNextQueuedPrompt).
             // This takes priority over auto-continue: a user's explicit follow-up runs
             // before the loop decides the original task is "complete".
-            if (await this.drainNextQueuedPrompt()) {
-                // handled
-            }
-            else if (refusedTurn) {
-                // Refusal terminates the turn. Don't re-prompt the model — the
-                // user's request is finished from the agent's side. Clear the
-                // stored "original prompt" so a stray Alt+G later doesn't pick
-                // up where this turn left off.
-                this.originalPromptForAutoContinue = null;
-            }
-            else if (!this.shouldExit && !this.userInterruptedRun) {
-                // Auto mode: keep running until user's prompt is fully completed.
-                // Skipped after a Ctrl+C interrupt so we don't immediately resume
-                // the work the user just cancelled.
-                const autoMode = this.promptController?.getAutoMode() ?? 'off';
-                if (autoMode !== 'off') {
-                    // Check if original user prompt is fully completed
-                    const detector = getTaskCompletionDetector();
-                    const analysis = detector.analyzeCompletion(this.finalResponseText, toolsUsed);
-                    // Record this turn with the governor (bounds the loop + detects a
-                    // stall: the same tools/files/failure repeating with no new progress)
-                    // and the failure registry (catches the same error recurring across
-                    // NON-consecutive turns — a thrash the stall check would miss).
-                    this.autoGovernor.recordTurn({
-                        toolsUsed,
-                        filesModified,
-                        failingSignal: detectFailingTestOrBuild(combinedTurnOutput),
-                    });
-                    this.failureRegistry.trackTurn(combinedTurnOutput);
-                    const gov = this.autoGovernor.check();
-                    const failureNudge = this.failureRegistry.nudge();
-                    const todos = getCurrentTodos();
-                    const pending = pendingTodos(todos);
-                    if (gov.stop) {
-                        // Yield to the user WITH state instead of thrashing forever.
-                        const note = gov.reason === 'limit'
-                            ? `Paused after ${gov.turn} auto-continue turns (turn limit).${pending.length ? ` ${pending.length} task${pending.length === 1 ? '' : 's'} still pending` : ''} — say "continue" to keep going.`
-                            : `Paused: no new progress over the last few turns (same actions repeating).${pending.length ? ` ${pending.length} task${pending.length === 1 ? '' : 's'} pending` : ''} — tell me how to proceed.`;
-                        this.promptController?.getRenderer()?.addEvent('system', chalk.dim(note));
-                        this.promptController?.setStatusMessage(null);
-                        this.originalPromptForAutoContinue = null;
-                    }
-                    else if (turnAdversarialFindings && this.adversarialCorrectionCount < MAX_ADVERSARIAL_CORRECTIONS) {
-                        // The reviewer refuted this turn's draft — re-run the FULL tool loop
-                        // to actually fix the findings (not just show the caveat), bounded
-                        // by the governor + this per-request cap.
-                        this.adversarialCorrectionCount += 1;
-                        this.promptController?.setStatusMessage('Addressing reviewer findings…');
-                        await new Promise(resolve => setTimeout(resolve, 300));
-                        await this.processPrompt(buildAdversarialCorrectionPrompt(turnAdversarialFindings));
-                    }
-                    else if (!analysis.isComplete || pending.length > 0) {
-                        // Continue — but only stop when the LIVE PLAN is also clear: pending
-                        // todos force a continue even if the response sounded "done".
-                        this.promptController?.setStatusMessage('Continuing...');
-                        await new Promise(resolve => setTimeout(resolve, 500));
-                        // Prefer the plan's next task; fall back to the response heuristic.
-                        const base = nextTodoPrompt(todos)
-                            ?? this.generateAutoContinuePrompt(this.originalPromptForAutoContinue || '', combinedTurnOutput, toolsUsed)
-                            ?? 'continue';
-                        // When a failure keeps recurring, lead with the change-approach nudge.
-                        // Keep an IMPORTANT: prefix so this counts as an auto-continue (not a
-                        // fresh user prompt, which would reset the governor).
-                        const autoPrompt = failureNudge
-                            ? `IMPORTANT: ${failureNudge}\n\n${base.replace(/^IMPORTANT:\s*/, '')}`
-                            : base;
-                        await this.processPrompt(autoPrompt);
-                    }
-                    else {
-                        this.promptController?.setStatusMessage('Task complete');
-                        setTimeout(() => this.promptController?.setStatusMessage(null), 2000);
+            //
+            // GUARDED: processPrompt is launched fire-and-forget (void) and the
+            // global unhandledRejection handler exits the whole CLI with code 1 —
+            // an exception anywhere in this post-turn pipeline (drain, completion
+            // heuristics, governor, renderer calls) must degrade to an error line,
+            // never kill the live session.
+            try {
+                if (await this.drainNextQueuedPrompt()) {
+                    // handled
+                }
+                else if (refusedTurn) {
+                    // Refusal terminates the turn. Don't re-prompt the model — the
+                    // user's request is finished from the agent's side. Clear the
+                    // stored "original prompt" so a stray Alt+G later doesn't pick
+                    // up where this turn left off.
+                    this.originalPromptForAutoContinue = null;
+                }
+                else if (!this.shouldExit && !this.userInterruptedRun) {
+                    // Auto mode: keep running until user's prompt is fully completed.
+                    // Skipped after a Ctrl+C interrupt so we don't immediately resume
+                    // the work the user just cancelled.
+                    const autoMode = this.promptController?.getAutoMode() ?? 'off';
+                    if (autoMode !== 'off') {
+                        // Check if original user prompt is fully completed
+                        const detector = getTaskCompletionDetector();
+                        const analysis = detector.analyzeCompletion(this.finalResponseText, toolsUsed);
+                        // Record this turn with the governor (bounds the loop + detects a
+                        // stall: the same tools/files/failure repeating with no new progress)
+                        // and the failure registry (catches the same error recurring across
+                        // NON-consecutive turns — a thrash the stall check would miss).
+                        this.autoGovernor.recordTurn({
+                            toolsUsed,
+                            filesModified,
+                            failingSignal: detectFailingTestOrBuild(combinedTurnOutput),
+                        });
+                        this.failureRegistry.trackTurn(combinedTurnOutput);
+                        const gov = this.autoGovernor.check();
+                        const failureNudge = this.failureRegistry.nudge();
+                        const todos = getCurrentTodos();
+                        const pending = pendingTodos(todos);
+                        if (gov.stop) {
+                            // Yield to the user WITH state instead of thrashing forever.
+                            const note = gov.reason === 'limit'
+                                ? `Paused after ${gov.turn} auto-continue turns (turn limit).${pending.length ? ` ${pending.length} task${pending.length === 1 ? '' : 's'} still pending` : ''} — say "continue" to keep going.`
+                                : `Paused: no new progress over the last few turns (same actions repeating).${pending.length ? ` ${pending.length} task${pending.length === 1 ? '' : 's'} pending` : ''} — tell me how to proceed.`;
+                            this.promptController?.getRenderer()?.addEvent('system', chalk.dim(note));
+                            this.promptController?.setStatusMessage(null);
+                            this.originalPromptForAutoContinue = null;
+                        }
+                        else if (turnAdversarialFindings && this.adversarialCorrectionCount < MAX_ADVERSARIAL_CORRECTIONS) {
+                            // The reviewer refuted this turn's draft — re-run the FULL tool loop
+                            // to actually fix the findings (not just show the caveat), bounded
+                            // by the governor + this per-request cap.
+                            this.adversarialCorrectionCount += 1;
+                            this.promptController?.setStatusMessage('Addressing reviewer findings…');
+                            await new Promise(resolve => setTimeout(resolve, 300));
+                            await this.processPrompt(buildAdversarialCorrectionPrompt(turnAdversarialFindings));
+                        }
+                        else if (!analysis.isComplete || pending.length > 0) {
+                            // Continue — but only stop when the LIVE PLAN is also clear: pending
+                            // todos force a continue even if the response sounded "done".
+                            this.promptController?.setStatusMessage('Continuing...');
+                            await new Promise(resolve => setTimeout(resolve, 500));
+                            // Prefer the plan's next task; fall back to the response heuristic.
+                            const base = nextTodoPrompt(todos)
+                                ?? this.generateAutoContinuePrompt(this.originalPromptForAutoContinue || '', combinedTurnOutput, toolsUsed)
+                                ?? 'continue';
+                            // When a failure keeps recurring, lead with the change-approach nudge.
+                            // Keep an IMPORTANT: prefix so this counts as an auto-continue (not a
+                            // fresh user prompt, which would reset the governor).
+                            const autoPrompt = failureNudge
+                                ? `IMPORTANT: ${failureNudge}\n\n${base.replace(/^IMPORTANT:\s*/, '')}`
+                                : base;
+                            await this.processPrompt(autoPrompt);
+                        }
+                        else {
+                            this.promptController?.setStatusMessage('Task complete');
+                            setTimeout(() => this.promptController?.setStatusMessage(null), 2000);
+                        }
                     }
                 }
             }
+            catch (postTurnError) {
+                const msg = postTurnError instanceof Error ? postTurnError.message : String(postTurnError);
+                try {
+                    this.promptController?.getRenderer()?.addEvent('error', formatErrorForDisplay(msg));
+                    this.promptController?.setStatusMessage(null);
+                }
+                catch { /* renderer down — nothing more to do */ }
+            }
         }
     }
     generateAutoContinuePrompt(originalPrompt, response, toolsUsed) {