@trenchwork/erosolar 1.1.62 → 1.2.0

package/dist/headless/interactiveShell.js

@@ -13,9 +13,8 @@
  * - Ctrl+C to interrupt
  */
 import { stdin, stdout, exit } from 'node:process';
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
-import { resolve, dirname, join, relative } from 'node:path';
-import { homedir } from 'node:os';
+import { readFileSync } from 'node:fs';
+import { resolve, dirname, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { exec as childExec } from 'node:child_process';
 import { promisify } from 'node:util';
@@ -32,7 +31,10 @@ import { resolveProfileConfig } from '../config.js';
 import { createAgentController } from '../runtime/agentController.js';
 import { expandFileMentions, listWorkspaceFiles } from '../core/fileMentions.js';
 import { resolveWorkspaceCaptureOptions, buildWorkspaceContext } from '../workspace.js';
-import { loadAllSecrets, listSecretDefinitions, setSecretValue, getSecretValue } from '../core/secretStore.js';
+import { loadAllSecrets, listSecretDefinitions, setSecretValue, getSecretValue, getSecretDefinition, classifyKeyEntry } from '../core/secretStore.js';
+import { resolveKeyMode, keyModeLine, setPreferOwnKeys, clearHostedSession, loginViaLoopback } from '../core/hostedAuth.js';
+import { appendMemoryNote } from '../tools/memoryTools.js';
+import { recordDeepSeekUsage, getUsage, TAVILY_MONTHLY_FREE, TAVILY_ONE_TIME_BONUS } from '../core/usage.js';
 import { listSessions, loadSessionById, saveSessionSnapshot } from '../core/sessionStore.js';
 import { relativeTime } from '../core/relativeTime.js';
 import { getModelContextInfo } from '../core/contextWindow.js';
@@ -48,6 +50,10 @@ import { setDebugMode, debugSnippet } from '../utils/debugLogger.js';
 const exec = promisify(childExec);
 import { ensureNextSteps } from '../core/finalResponseFormatter.js';
 import { getTaskCompletionDetector, detectFailingTestOrBuild } from '../core/taskCompletionDetector.js';
+import { TurnGovernor, pendingTodos, nextTodoPrompt } from '../core/turnGovernor.js';
+import { FailureRegistry } from '../core/failureRegistry.js';
+import { buildAdversarialCorrectionPrompt, MAX_ADVERSARIAL_CORRECTIONS } from '../core/adversarialCorrection.js';
+import { getCurrentTodos } from '../tools/todoTools.js';
 import { checkForUpdates, performBackgroundUpdate } from '../core/updateChecker.js';
 import { startNewRun } from '../tools/fileChangeTracker.js';
 import { onSudoPasswordNeeded, offSudoPasswordNeeded, provideSudoPassword } from '../core/sudoPasswordManager.js';
@@ -143,13 +149,20 @@ function getVersion() {
 }
 /** Inner content of the welcome box (plain, no border/colour). */
 function welcomeBodyLines(input) {
-    const body = ['✻ Welcome to Erosolar Coder', ''];
-    if (!input.hasApiKey) {
-        body.push('⚠ No API key configured', '', 'Get your key: https://platform.deepseek.com/', 'Set your key: /key YOUR_API_KEY');
+    const title = input.version ? `✻ Welcome to Erosolar Coder ${input.version}` : '✻ Welcome to Erosolar Coder';
+    const body = [title, ''];
+    const mode = input.keyMode ?? (input.hasApiKey ? 'own' : 'none');
+    if (mode === 'hosted') {
+        // Signed in — running on hosted keys. The mode line names the account so
+        // it's unmistakable this is NOT the user's own key.
+        body.push(input.keyModeLine ?? 'Signed in · using hosted keys');
     }
-    else {
+    else if (mode === 'own') {
         body.push(`${input.model} · ${input.provider}`, `Key: ${input.maskedKey} · /help for commands`);
     }
+    else {
+        body.push('⚠ No DeepSeek API key configured', '', '/login       Sign in with Google for hosted keys', '', 'Or bring your own:', '  /key sk-…    DeepSeek (required) · platform.deepseek.com', '  /key tvly-…  Tavily web search (optional) · tavily.com');
+    }
     if (input.cwd)
         body.push(`cwd: ${input.cwd}`);
     return body;
@@ -272,9 +285,26 @@ class InteractiveShell {
     };
     pendingModelSwitch = null;
     currentResponseBuffer = '';
+    // The turn's final assistant text, captured BEFORE currentResponseBuffer is
+    // cleared on message.complete. The auto-continue refusal/completion/governor
+    // reads run in the `finally`, AFTER that clear, so reading the buffer there saw
+    // '' and blinded them (completion detection + safety-refusal both need the
+    // text). This mirrors the buffer's content but is never cleared mid-turn.
+    finalResponseText = '';
     // Store original prompt for auto-continuation
     originalPromptForAutoContinue = null;
     // (Pinned prompt removed per request — field intentionally absent.)
+    // Bounds + stall-detects the auto-continue loop per user request, and drives
+    // continuation from the live TODO plan (see src/core/turnGovernor.ts). Reset
+    // when a fresh user prompt arrives.
+    autoGovernor = new TurnGovernor();
+    // Remembers recurring error signatures across auto-continue turns so the
+    // agent stops re-trying the same dead end (see src/core/failureRegistry.ts).
+    failureRegistry = new FailureRegistry();
+    // Adversarial auto-correction: how many bounded re-fixes the reviewer has
+    // triggered for the CURRENT user request (capped). Reset on a fresh prompt;
+    // the findings themselves are a per-turn local in processPrompt.
+    adversarialCorrectionCount = 0;
     constructor(controller, profile, profileConfig, workingDir) {
         this.controller = controller;
         this.profile = profile;
@@ -345,6 +375,8 @@ class InteractiveShell {
             // Esc interrupts a running turn (handleInterrupt no-ops when idle), so
             // the spinner's "esc to interrupt" is real. Ctrl+C still works too.
             onEscape: () => this.handleInterrupt(),
+            onShowShortcuts: () => this.showKeyboardShortcuts(),
+            onDismissPanel: () => this.dismissInlinePanel(),
         });
         // Register cleanup callback for graceful shutdown
         onShutdown(() => {
@@ -492,12 +524,16 @@ class InteractiveShell {
         // WHICH lines appear; here we draw the same box with brand colour.
         const flare = chalk.hex('#ff6a1f');
         const wire = chalk.hex('#3a362e');
+        const keyStatus = resolveKeyMode();
         const body = welcomeBodyLines({
             hasApiKey,
             maskedKey: hasApiKey ? maskApiKey(apiKey) : '',
             model: this.profileConfig.model,
             provider: this.profileConfig.provider,
             cwd: this.workingDir,
+            keyMode: keyStatus.mode,
+            keyModeLine: keyModeLine(keyStatus),
+            version: `v${version}`,
         });
         const boxed = roundedBox(body, (cell) => cell.replace('✻', flare('✻')), (s) => wire(s));
         const welcomeContent = ['', ...updateLines, ...boxed, ''].join('\n');
@@ -791,26 +827,19 @@ class InteractiveShell {
         const lower = trimmed.toLowerCase();
         // /model and /secrets were removed: Erosolar is locked to deepseek-v4-pro
         // on max thought (no model switching), and /key is the one key you set.
-        // Handle /key - shortcut to set DEEPSEEK_API_KEY
+        // Handle /key — set your own DeepSeek OR Tavily API key. Routed by prefix:
+        // `sk-…` → DeepSeek (the model), `tvly-…` → Tavily (web search). Explicit
+        // `/key tavily <k>` / `/key deepseek <k>` also work. Bring-your-own-key is
+        // the model; both are stored in the OS-permission secret store.
         if (lower === '/key' || lower.startsWith('/key ')) {
-            const parts = trimmed.split(/\s+/);
-            const keyValue = parts[1];
             const renderer = this.promptController?.getRenderer();
-            if (keyValue) {
-                // Direct file write - most reliable method
+            const arg = trimmed.slice('/key'.length).trim();
+            const entry = classifyKeyEntry(arg);
+            if (entry) {
                 try {
-                    const secretDir = join(homedir(), '.erosolar');
-                    const secretFile = join(secretDir, 'secrets.json');
-                    mkdirSync(secretDir, { recursive: true });
-                    const existing = existsSync(secretFile)
-                        ? JSON.parse(readFileSync(secretFile, 'utf-8'))
-                        : {};
-                    existing['DEEPSEEK_API_KEY'] = keyValue;
-                    writeFileSync(secretFile, JSON.stringify(existing, null, 2) + '\n');
-                    // Also set in process.env for immediate use
-                    process.env['DEEPSEEK_API_KEY'] = keyValue;
-                    // Show confirmation via renderer
-                    renderer?.addEvent('system', chalk.green('✓ DEEPSEEK_API_KEY saved'));
+                    setSecretValue(entry.id, entry.value);
+                    const label = getSecretDefinition(entry.id)?.label ?? entry.id;
+                    renderer?.addEvent('system', chalk.green(`✓ ${label} saved`));
                 }
                 catch (error) {
                     const msg = error instanceof Error ? error.message : String(error);
@@ -818,11 +847,38 @@ class InteractiveShell {
                 }
             }
             else {
-                // Show usage hint
-                renderer?.addEvent('system', chalk.yellow('Usage: /key YOUR_API_KEY'));
+                renderer?.addEvent('system', chalk.yellow('Usage: /key sk-… (DeepSeek) or /key tvly-… (Tavily web search)'));
             }
             return true;
         }
+        // /account — show the active key source (hosted vs your own) and switch
+        // between them. `/account own` forces your own keys even while signed in;
+        // `/account hosted` returns to hosted. Hosted keys come from sign-in
+        // (server-side, never baked into this client) — see core/hostedAuth.ts.
+        if (lower === '/account' || lower.startsWith('/account ')) {
+            const r = this.promptController?.getRenderer();
+            const arg = trimmed.slice('/account'.length).trim().toLowerCase();
+            if (arg === 'own')
+                setPreferOwnKeys(true);
+            else if (arg === 'hosted')
+                setPreferOwnKeys(false);
+            if (arg === 'own' || arg === 'hosted')
+                void this.showWelcome(); // banner reflects the switch
+            r?.addEvent('system', this.accountStatusText(resolveKeyMode()));
+            return true;
+        }
+        // /login — Google sign-in via ero.solar (loopback OAuth) to unlock hosted keys.
+        if (lower === '/login' || lower === '/signin') {
+            void this.handleLogin();
+            return true;
+        }
+        // /logout — drop the hosted session (back to your own keys, or none).
+        if (lower === '/logout' || lower === '/signout') {
+            clearHostedSession();
+            this.promptController?.getRenderer()?.addEvent('system', chalk.green('✓ Signed out — using your own keys.'));
+            void this.showWelcome();
+            return true;
+        }
         // /update — check npm for a newer version and upgrade in-shell.
         if (lower === '/update' || lower === '/upgrade') {
             void this.handleUpdateCommand();
@@ -866,6 +922,13 @@ class InteractiveShell {
             this.showContext();
             return true;
         }
+        // /cost — DeepSeek tokens + Tavily searches consumed (this session + all
+        // time), and the hosted free-pool reference. Account-wide remaining is a
+        // backend number shown in the ero.solar portal.
+        if (lower === '/cost' || lower === '/spend') {
+            this.showUsage();
+            return true;
+        }
         // /diff — review the files the agent changed this run, as colored diffs.
         if (lower === '/diff' || lower === '/changes') {
             this.showDiff();
@@ -1406,6 +1469,29 @@ class InteractiveShell {
         this.promptController.setInlinePanel(lines);
         this.scheduleInlinePanelDismiss();
     }
+    /** /cost — DeepSeek tokens + Tavily searches consumed (this install). */
+    showUsage() {
+        if (!this.promptController?.supportsInlinePanel()) {
+            this.promptController?.setStatusMessage('Use /cost in interactive mode');
+            setTimeout(() => this.promptController?.setStatusMessage(null), 3000);
+            return;
+        }
+        const { session, cumulative } = getUsage();
+        const label = (s) => chalk.hex('#ffb142')(s.padEnd(9));
+        const dim = (s) => chalk.dim(s);
+        const ds = (u) => `${formatTokenCount(u.deepseekInputTokens)} in · ${formatTokenCount(u.deepseekOutputTokens)} out`;
+        const lines = [
+            chalk.bold.hex('#ece6da')('Usage') + dim('  (press any key to dismiss)'),
+            '',
+            label('DeepSeek') + dim(`${ds(cumulative)}   ·   this session ${ds(session)}`),
+            label('Tavily') + dim(`${cumulative.tavilySearches} searches   ·   this session ${session.tavilySearches}`),
+            '',
+            dim(`Hosted free pool: Tavily ${TAVILY_MONTHLY_FREE.toLocaleString('en-US')}/mo + ${TAVILY_ONE_TIME_BONUS.toLocaleString('en-US')} one-time bonus.`),
+            dim('Account-wide totals + remaining show in the ero.solar portal after sign-in.'),
+        ];
+        this.promptController.setInlinePanel(lines);
+        this.scheduleInlinePanelDismiss();
+    }
     /**
      * /diff — review every file the agent changed this run as a colored diff,
      * in a dismissable panel. Reads each file's original content from the change
@@ -1489,6 +1575,54 @@ class InteractiveShell {
         revertAllChanges(this.workingDir); // restores/deletes on disk + clears tracking
         renderer?.addEvent('system', chalk.green('✓ ' + rewindResultLine(restored, deleted)));
     }
+    /** One-line summary of the active key source for /account. */
+    accountStatusText(s) {
+        if (s.mode === 'hosted') {
+            return chalk.green(`Hosted keys · signed in as ${s.email}.`) +
+                chalk.dim(` /account own to use your own · /logout to sign out.`);
+        }
+        if (s.mode === 'own') {
+            return chalk.green(`Your own keys · DeepSeek${s.ownTavily ? ' + Tavily' : ''}.`) +
+                chalk.dim(s.signedIn ? ` /account hosted to use hosted keys.` : ` /login to use hosted keys.`);
+        }
+        return chalk.yellow('No keys configured.') +
+            chalk.dim(' /login for hosted keys, or set your own: /key sk-… (and /key tvly-…).');
+    }
+    /**
+     * /login — Google sign-in via ero.solar. Opens the browser to the SSO URL and
+     * runs a one-shot 127.0.0.1 loopback server that captures the redirect with
+     * the short-lived token (see core/hostedAuth.ts). On success the CLI is on
+     * hosted keys; no key ever touches this client.
+     */
+    async handleLogin() {
+        const r = this.promptController?.getRenderer();
+        const status = resolveKeyMode();
+        if (status.signedIn) {
+            r?.addEvent('system', chalk.green(`Already signed in as ${status.email}.`) +
+                chalk.dim(' /logout to sign out · /account to switch key source.'));
+            return;
+        }
+        r?.addEvent('system', chalk.dim('Opening ero.solar sign-in in your browser — finish there, then return here…'));
+        const result = await loginViaLoopback({ open: (url) => this.openInBrowser(url) });
+        if (result.ok && result.session) {
+            r?.addEvent('system', chalk.green(`✓ Signed in as ${result.session.email} — using hosted keys.`));
+            void this.showWelcome();
+        }
+        else {
+            r?.addEvent('system', chalk.yellow(`Sign-in didn't complete: ${result.error ?? 'unknown error'}.`) +
+                chalk.dim(' Retry /login, or use /key sk-… for your own key.'));
+        }
+    }
+    /** Best-effort open a URL in the OS browser; also prints it as a fallback. */
+    openInBrowser(url) {
+        const opener = process.platform === 'darwin' ? 'open'
+            : process.platform === 'win32' ? 'start ""'
+                : 'xdg-open';
+        // url is built by loginViaLoopback (no user input) and JSON-quoted, so the
+        // `&` in the query string can't break out of the argument.
+        childExec(`${opener} ${JSON.stringify(url)}`, () => { });
+        this.promptController?.getRenderer()?.addEvent('system', chalk.dim(`If the browser didn't open: ${url}`));
+    }
     showHelp() {
         if (!this.promptController?.supportsInlinePanel()) {
             this.promptController?.setStatusMessage('Help: /key sk-… (everything else is automatic)');
@@ -1503,14 +1637,20 @@ class InteractiveShell {
         const lines = [
             chalk.bold.hex('#ece6da')('Erosolar Coder') + dim('  (press any key to dismiss)'),
             '',
-            cmd('/key sk-…') + dim('   Set your DeepSeek API key'),
+            cmd('/login') + dim('       Sign in with Google (ero.solar) to use hosted keys'),
+            cmd('/key sk-…') + dim('     Set your DeepSeek API key (required)'),
+            cmd('/key tvly-…') + dim('   Set your Tavily key for web search (optional)'),
+            cmd('/account') + dim('      Show / switch key source (hosted vs your own)'),
             cmd('/update') + dim('      Check npm and upgrade to the latest version'),
             cmd('/resume') + dim('      Restore a previous conversation'),
             cmd('/context') + dim('     Show context-window usage'),
+            cmd('/cost') + dim('        DeepSeek tokens + Tavily searches consumed'),
             cmd('/diff') + dim('        Review changes made this run'),
             cmd('/rewind') + dim('      Undo this run\'s file changes'),
             '',
-            dim('Everything else runs automatically for max performance —'),
+            dim('Prefixes: ') + cmd('@file') + dim(' attach · ') + cmd('!cmd') + dim(' run shell · ') + cmd('#note') + dim(' save to memory'),
+            '',
+            dim('Everything else runs automatically —'),
             dim('deepseek-v4-pro · max thought · ultracode · adversarial verifier, all on.'),
             dim('Shift+Tab cycles permission mode · Ctrl+D exits · ? for shortcuts'),
         ];
@@ -1609,6 +1749,19 @@ class InteractiveShell {
             void this.runLocalCommand(trimmed.slice(1).trim());
             return;
         }
+        // `#note` — quick-capture a note to persistent project memory (Claude Code
+        // parity), no model round-trip. Lands in .erosolar/memory/ where the agent
+        // reads it on later sessions.
+        if (trimmed.startsWith('#')) {
+            this.dismissInlinePanel();
+            const note = trimmed.slice(1).trim();
+            const r = this.promptController?.getRenderer();
+            if (appendMemoryNote(this.workingDir, note))
+                r?.addEvent('system', chalk.green('✓ Saved to memory'));
+            else
+                r?.addEvent('system', chalk.yellow('Usage: #<note to remember>'));
+            return;
+        }
         // Dismiss inline panel for regular user prompts
         this.dismissInlinePanel();
         // Live follow-up queue (Claude Code parity): a prompt typed while the agent
@@ -1645,18 +1798,29 @@ class InteractiveShell {
             // A fresh user prompt clears any prior interrupt state — this is new
             // work the user actually wants done.
             this.userInterruptedRun = false;
+            // Fresh user request → start a new auto-continue turn budget + failure log.
+            this.autoGovernor.reset();
+            this.failureRegistry.reset();
+            this.adversarialCorrectionCount = 0;
             // Pinned-prompt persistence removed per request — no longer
             // displayed above the chat box.
         }
         enterCriticalSection();
         this.isProcessing = true;
         this.currentResponseBuffer = '';
+        this.finalResponseText = '';
         this.promptController?.setStreaming(true);
         this.promptController?.setStatusMessage('Analyzing request…');
         const renderer = this.promptController?.getRenderer();
         let episodeSuccess = false;
         const toolsUsed = [];
         const filesModified = [];
+        // Tail of this turn's tool outputs (where TS/test/build errors land), so the
+        // failure registry + governor see real error text, not just the narration.
+        let turnToolOutput = '';
+        // Reviewer findings from THIS turn (set by the adversarial.findings event),
+        // used in the finally to drive a bounded auto-correction.
+        let turnAdversarialFindings = null;
         // Track reasoning content for fallback when response is empty
         let reasoningBuffer = '';
         // Track reasoning-only time to prevent models from reasoning forever without action
@@ -1713,6 +1877,7 @@ class InteractiveShell {
                     case 'message.start':
                         // AI has started processing - update status to show activity
                         this.currentResponseBuffer = '';
+                        this.finalResponseText = '';
                         reasoningBuffer = '';
                         reasoningOnlyStartTime = null; // Reset on new message
                         this.promptController?.setStatusMessage('Thinking...');
@@ -1720,6 +1885,7 @@ class InteractiveShell {
                     case 'message.delta':
                         // Stream content as it arrives
                         this.currentResponseBuffer += event.content ?? '';
+                        this.finalResponseText += event.content ?? '';
                         if (renderer) {
                             renderer.addEvent('stream', event.content);
                         }
@@ -1784,6 +1950,9 @@ class InteractiveShell {
                                 }
                             }
                             renderer.addEvent('response', '\n');
+                            // Capture the authoritative final text BEFORE the buffer is cleared
+                            // (the finally's auto-continue reads run after this clear).
+                            this.finalResponseText = sourceText || this.finalResponseText;
                         }
                         this.currentResponseBuffer = '';
                         break;
@@ -1820,6 +1989,11 @@ class InteractiveShell {
                         if (isHitlToolName(event.toolName)) {
                             hitlDepth = Math.max(0, hitlDepth - 1);
                         }
+                        // Keep the tail of tool output for the failure registry / governor
+                        // (errors land here, not in the assistant narration).
+                        if (typeof event.result === 'string' && event.result) {
+                            turnToolOutput = (turnToolOutput + '\n' + event.result).slice(-16000);
+                        }
                         // Clear the activity label; the agent is thinking again.
                         this.promptController?.setStatusMessage('Thinking…');
                         // Reset reasoning timer after tool completes
@@ -1857,6 +2031,8 @@ class InteractiveShell {
                         }
                         break;
                     case 'usage': {
+                        // Meter cumulative DeepSeek consumption for /usage + the portal.
+                        recordDeepSeekUsage(event.inputTokens, event.outputTokens);
                         // inputTokens = exactly what occupies the context window this turn.
                         // The real model window (not a hardcoded guess) is the denominator
                         // so "% context left" reflects the actual model.
@@ -1883,6 +2059,11 @@ class InteractiveShell {
                             elapsedMs: event.elapsedMs,
                         })));
                         break;
+                    case 'adversarial.findings':
+                        // The reviewer refuted this turn's draft — remember it so the
+                        // auto-continue loop can run a bounded re-fix (handled in finally).
+                        turnAdversarialFindings = event.findings;
+                        break;
                     case 'context.compacted': {
                         // The conversation was auto-compacted to stay within the window —
                         // surface it as a dim note (Claude Code parity) instead of silently.
@@ -2007,7 +2188,7 @@ class InteractiveShell {
             // model declines the request, the request is *done* — auto-continue
             // would just resubmit "continue" and start a new spinner cycle, which
             // is what produced the stuck "Thinking… (4m N s)" timer the user saw.
-            const refusedTurn = isSafetyRefusal(this.currentResponseBuffer);
+            const refusedTurn = isSafetyRefusal(this.finalResponseText);
             this.isProcessing = false;
             this.promptController?.setStreaming(false);
             this.promptController?.setStatusMessage(null);
@@ -2028,6 +2209,10 @@ class InteractiveShell {
             r?.setQueuedPrompts([]);
             // Note: pendingPrompts may still have items if a drain just started
             // a new processPrompt; the new run will manage the list.
+            // Snapshot this turn's full output (tool results + narration) BEFORE the
+            // buffer is cleared — the auto-continue governor + failure registry need
+            // the real error text, which the reset below would otherwise wipe.
+            const combinedTurnOutput = (turnToolOutput + '\n' + this.finalResponseText).slice(-16000);
             this.currentResponseBuffer = '';
             // Autosave the conversation so /resume has something to restore. Each
             // turn updates the same snapshot in place (keyed by this.sessionId).
@@ -2059,20 +2244,55 @@ class InteractiveShell {
                 if (autoMode !== 'off') {
                     // Check if original user prompt is fully completed
                     const detector = getTaskCompletionDetector();
-                    const analysis = detector.analyzeCompletion(this.currentResponseBuffer, toolsUsed);
-                    // Continue until task is complete
-                    if (!analysis.isComplete) {
+                    const analysis = detector.analyzeCompletion(this.finalResponseText, toolsUsed);
+                    // Record this turn with the governor (bounds the loop + detects a
+                    // stall: the same tools/files/failure repeating with no new progress)
+                    // and the failure registry (catches the same error recurring across
+                    // NON-consecutive turns — a thrash the stall check would miss).
+                    this.autoGovernor.recordTurn({
+                        toolsUsed,
+                        filesModified,
+                        failingSignal: detectFailingTestOrBuild(combinedTurnOutput),
+                    });
+                    this.failureRegistry.trackTurn(combinedTurnOutput);
+                    const gov = this.autoGovernor.check();
+                    const failureNudge = this.failureRegistry.nudge();
+                    const todos = getCurrentTodos();
+                    const pending = pendingTodos(todos);
+                    if (gov.stop) {
+                        // Yield to the user WITH state instead of thrashing forever.
+                        const note = gov.reason === 'limit'
+                            ? `Paused after ${gov.turn} auto-continue turns (turn limit).${pending.length ? ` ${pending.length} task${pending.length === 1 ? '' : 's'} still pending` : ''} — say "continue" to keep going.`
+                            : `Paused: no new progress over the last few turns (same actions repeating).${pending.length ? ` ${pending.length} task${pending.length === 1 ? '' : 's'} pending` : ''} — tell me how to proceed.`;
+                        this.promptController?.getRenderer()?.addEvent('system', chalk.dim(note));
+                        this.promptController?.setStatusMessage(null);
+                        this.originalPromptForAutoContinue = null;
+                    }
+                    else if (turnAdversarialFindings && this.adversarialCorrectionCount < MAX_ADVERSARIAL_CORRECTIONS) {
+                        // The reviewer refuted this turn's draft — re-run the FULL tool loop
+                        // to actually fix the findings (not just show the caveat), bounded
+                        // by the governor + this per-request cap.
+                        this.adversarialCorrectionCount += 1;
+                        this.promptController?.setStatusMessage('Addressing reviewer findings…');
+                        await new Promise(resolve => setTimeout(resolve, 300));
+                        await this.processPrompt(buildAdversarialCorrectionPrompt(turnAdversarialFindings));
+                    }
+                    else if (!analysis.isComplete || pending.length > 0) {
+                        // Continue — but only stop when the LIVE PLAN is also clear: pending
+                        // todos force a continue even if the response sounded "done".
                         this.promptController?.setStatusMessage('Continuing...');
                         await new Promise(resolve => setTimeout(resolve, 500));
-                        // Generate auto-continue prompt using stored original prompt
-                        const autoPrompt = this.generateAutoContinuePrompt(this.originalPromptForAutoContinue || '', this.currentResponseBuffer, toolsUsed);
-                        if (autoPrompt) {
-                            await this.processPrompt(autoPrompt);
-                        }
-                        else {
-                            // Default continue if no specific auto-prompt generated
-                            await this.processPrompt('continue');
-                        }
+                        // Prefer the plan's next task; fall back to the response heuristic.
+                        const base = nextTodoPrompt(todos)
+                            ?? this.generateAutoContinuePrompt(this.originalPromptForAutoContinue || '', combinedTurnOutput, toolsUsed)
+                            ?? 'continue';
+                        // When a failure keeps recurring, lead with the change-approach nudge.
+                        // Keep an IMPORTANT: prefix so this counts as an auto-continue (not a
+                        // fresh user prompt, which would reset the governor).
+                        const autoPrompt = failureNudge
+                            ? `IMPORTANT: ${failureNudge}\n\n${base.replace(/^IMPORTANT:\s*/, '')}`
+                            : base;
+                        await this.processPrompt(autoPrompt);
                     }
                     else {
                         this.promptController?.setStatusMessage('Task complete');