@vanillagreen/pi-claude-bridge 1.2.0 → 1.4.0

package/src/index.ts

@@ -6,7 +6,7 @@ import type { Base64ImageSource, ContentBlockParam, MessageParam } from "@anthro
 import { createSession, deleteSession, openSession, repairToolPairing } from "cc-session-io";
 import { spawn as spawnProcess } from "child_process";
 import { createHash } from "crypto";
-import { accessSync, appendFileSync, constants as fsConstants, mkdirSync, readFileSync, realpathSync, statSync } from "fs";
+import { accessSync, appendFileSync, chmodSync, constants as fsConstants, mkdirSync, readFileSync, realpathSync, statSync } from "fs";
 import { resolve as pathResolve } from "path";
 import { homedir } from "os";
 import { delimiter, dirname, join } from "path";
@@ -16,7 +16,8 @@ import { MCP_SERVER_NAME, MCP_TOOL_PREFIX, extractSkillsBlock } from "./skills.j
 import { verifyWrittenSession as _verifyWrittenSession } from "./session-verify.js";
 import { extractAllToolResults as _extractAllToolResults, type McpResult } from "./extract-tool-results.js";
 import { QueryContext, ctx, stackDepth, pushContext, popContext } from "./query-state.js";
-import { loadConfig, type Config } from "./config.js";
+import { findUnpairedToolUses, summarizeMissingToolNames, type MissingToolResult } from "./tool-pairing-audit.js";
+import { loadConfig, normalizeEffortLevel, type Config } from "./config.js";
 import { extractAgentsAppend } from "./agents-md.js";
 import { buildPromptContextAppend } from "./prompt-context.js";
 import { jsonSchemaToZodShape } from "./typebox-to-zod.js";
@@ -33,13 +34,17 @@ const newAssistantMessageEventStream: () => AssistantMessageEventStream =
 
 const DEBUG = process.env.CLAUDE_BRIDGE_DEBUG === "1";
 const DEBUG_LOG_PATH = process.env.CLAUDE_BRIDGE_DEBUG_PATH || join(homedir(), ".pi", "agent", "claude-bridge.log");
-const DIAG_LOG_PATH = join(homedir(), ".pi", "agent", "claude-bridge-diag.log");
+const DEFAULT_DIAG_LOG_PATH = join(homedir(), ".pi", "agent", "claude-bridge-diag.log");
+
+function diagLogPath(): string {
+	return process.env.CLAUDE_BRIDGE_DIAG_PATH || DEFAULT_DIAG_LOG_PATH;
+}
 
 // Ensure log directories exist when debug is enabled
 if (DEBUG) {
 	try {
 		mkdirSync(dirname(DEBUG_LOG_PATH), { recursive: true });
-		mkdirSync(dirname(DIAG_LOG_PATH), { recursive: true });
+		mkdirSync(dirname(diagLogPath()), { recursive: true, mode: 0o700 });
 	} catch {
 		// If directory creation fails, debug functions will throw on first use
 	}
@@ -57,7 +62,7 @@ function debug(...args: unknown[]) {
 		return JSON.stringify(a);
 	};
 	const msg = args.map(fmt).join(" ");
-	appendFileSync(DEBUG_LOG_PATH, `[${ts}] [${moduleInstanceId}] ${msg}\n`);
+	try { appendFileSync(DEBUG_LOG_PATH, `[${ts}] [${moduleInstanceId}] ${msg}\n`); } catch { /* debug is best effort */ }
 }
 
 function executableFromPath(name: string): string | undefined {
@@ -342,10 +347,109 @@ function makeCliDebugOptions(tag: string): { debug?: boolean; debugFile?: string
 
 /** Unconditional diagnostic dump — for "should never happen" paths */
 function diagDump(label: string, data: Record<string, unknown>) {
-	const ts = new Date().toISOString();
-	const entry = { ts, moduleInstanceId, label, ...data };
-	appendFileSync(DIAG_LOG_PATH, JSON.stringify(entry) + "\n");
-	debug(`DIAG: ${label} (see ${DIAG_LOG_PATH})`);
+	try {
+		const ts = new Date().toISOString();
+		const entry = { ts, moduleInstanceId, label, ...data };
+		const path = diagLogPath();
+		try { mkdirSync(dirname(path), { recursive: true, mode: 0o700 }); } catch { /* best effort */ }
+		appendFileSync(path, JSON.stringify(entry) + "\n", { mode: 0o600 });
+		try { chmodSync(path, 0o600); } catch { /* best effort */ }
+		debug(`DIAG: ${label} (see ${path})`);
+	} catch (error) {
+		debug(`DIAG FAILED: ${label}`, error);
+	}
+}
+
+function safeNotify(message: string, level: "info" | "warning" | "error" = "warning"): void {
+	try { piUI?.notify(message, level); }
+	catch (error) { debug("notify failed:", error); }
+}
+
+function argKeys(args: Record<string, unknown> | undefined): string[] {
+	return Object.keys(args ?? {}).sort();
+}
+
+function safeToolCallSummary(calls: Array<{ id: string; toolName: string; arguments?: Record<string, unknown> }>): Array<{ id: string; toolName: string; argKeys: string[] }> {
+	return calls.map((call) => ({ id: call.id, toolName: call.toolName, argKeys: argKeys(call.arguments) }));
+}
+
+function compactToolNameSummary(names: Array<{ name: string; count: number }>, limit = 12): string[] {
+	const shown = names.slice(0, limit).map(({ name, count }) => count > 1 ? `${name}×${count}` : name);
+	if (names.length > limit) shown.push(`+${names.length - limit} more`);
+	return shown;
+}
+
+function reportSyntheticToolResultRepair(missing: MissingToolResult[], context: Record<string, unknown>): void {
+	try {
+		if (missing.length === 0) return;
+		const toolNames = summarizeMissingToolNames(missing);
+		const toolNameSummary = compactToolNameSummary(toolNames);
+		const sampledToolCallIds = missing.slice(0, 50).map((item) => item.id);
+		diagDump("repair_tool_pairing_synthetic_results", {
+			count: missing.length,
+			toolNames,
+			sampledToolCallIds,
+			missing: missing.slice(0, 50),
+			...context,
+		});
+		safeNotify(
+			`Claude bridge: ${missing.length} missing tool result(s) repaired with "[no tool result recorded]"` +
+			`${toolNameSummary.length ? ` for ${toolNameSummary.join(", ")}` : ""}. ` +
+			`Real tool output was lost before Claude session import; see ${diagLogPath()}.`,
+			"error",
+		);
+	} catch (error) {
+		debug("reportSyntheticToolResultRepair failed:", error);
+	}
+}
+
+export function reportToolResultMismatch(queryCtx: QueryContext, reason: string, cwd: string | undefined, opts: { forceRotate?: boolean } = {}): boolean {
+	try {
+		if (queryCtx.reportedToolResultMismatch) return false;
+		const progress = queryCtx.toolResultProgress();
+		const hasMismatch = progress.expectedCount > 0
+			? progress.unresolvedIds.length > 0 || progress.waitingCount > 0 || progress.queuedCount > 0 || progress.unmatchedResultCount > 0
+			: progress.waitingCount > 0 || progress.queuedCount > 0 || progress.unmatchedResultCount > 0;
+		if (!hasMismatch) return false;
+		queryCtx.reportedToolResultMismatch = true;
+		if (sharedSession) {
+			sharedSession = { ...sharedSession, needsRebuild: true, ...(opts.forceRotate ? { forceRotate: true } : {}) };
+		}
+		const toolNameSummary = compactToolNameSummary(progress.toolNames);
+		diagDump("tool_result_delivery_mismatch", {
+			reason,
+			cwd,
+			progress,
+			activeQueryExists: queryCtx.activeQuery !== null,
+			sharedSession: sharedSession ? {
+				sessionId: sharedSession.sessionId.slice(0, 8),
+				cursor: sharedSession.cursor,
+				needsRebuild: sharedSession.needsRebuild === true,
+				forceRotate: sharedSession.forceRotate === true,
+			} : null,
+		});
+		safeNotify(
+			`Claude bridge: tool result delivery interrupted during ${reason}; ` +
+			`delivered ${progress.deliveredCount}/${progress.expectedCount}, resolved ${progress.resolvedCount}/${progress.expectedCount}, ` +
+			`waiting=${progress.waitingCount}, queued=${progress.queuedCount}, unmatched=${progress.unmatchedResultCount}` +
+			`${toolNameSummary.length ? `, tools=${toolNameSummary.join(", ")}` : ""}. ` +
+			`Claude session will rebuild before the next turn; see ${diagLogPath()}.`,
+			"error",
+		);
+		return true;
+	} catch (error) {
+		debug("reportToolResultMismatch failed:", error);
+		return false;
+	}
+}
+
+export function __testSetBridgeIntegrityState(state: { ui?: Pick<ExtensionUIContext, "notify"> | null; sharedSession?: SessionState | null }): void {
+	if ("ui" in state) piUI = state.ui as ExtensionUIContext | undefined;
+	if ("sharedSession" in state) sharedSession = state.sharedSession ?? null;
+}
+
+export function __testGetBridgeIntegrityState(): { sharedSession: SessionState | null } {
+	return { sharedSession };
 }
 
 // --- Constants ---
@@ -426,6 +530,140 @@ let extensionApi: ExtensionAPI | undefined;
 let piUI: ExtensionUIContext | undefined;
 let extraUsageHelperInFlight: Promise<string> | null = null;
 
+const RATE_LIMIT_AUTO_RESUME_EVENT = "vstack:rate-limit";
+const RATE_LIMIT_TOKEN = "\x1b[31m[rate-limit]\x1b[39m";
+export const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 90_000;
+export const STREAM_IDLE_BACKOFF_HINT_MS = 60_000;
+export const STREAM_IDLE_TIMEOUT_ENV = "CLAUDE_BRIDGE_STREAM_IDLE_TIMEOUT";
+
+type TimerHandle = ReturnType<typeof setTimeout>;
+
+export interface StreamIdleWatchdogState {
+	activeQuery: unknown | null;
+	currentPiStream: AssistantMessageEventStream | null;
+	turnOutput: AssistantMessage | null;
+	turnSawStreamEvent: boolean;
+	turnStarted: boolean;
+}
+
+export interface StreamIdleTimeoutInfo {
+	idleMs: number;
+	timeoutMs: number;
+}
+
+export interface StreamIdleWatchdog {
+	dispose: () => void;
+	noteChunk: () => void;
+	refresh: () => void;
+	timedOut: () => boolean;
+}
+
+const activeStreamIdleWatchdogs = new WeakMap<QueryContext, StreamIdleWatchdog>();
+
+function parseDurationLiteralMs(value: string, defaultUnit: "ms" | "s" = "s"): number | undefined {
+	const text = value.trim().toLowerCase();
+	if (!text) return undefined;
+	if (["off", "false", "disabled", "disable"].includes(text)) return 0;
+	const match = text.match(/^(\d+(?:\.\d+)?)\s*(ms|msec|msecs|milliseconds?|s|sec|secs|seconds?|m|min|mins|minutes?)?$/i);
+	if (!match) return undefined;
+	const amount = Number(match[1]);
+	if (!Number.isFinite(amount) || amount < 0) return undefined;
+	const unit = (match[2] ?? defaultUnit).toLowerCase();
+	const multiplier = ["ms", "msec", "msecs", "millisecond", "milliseconds"].includes(unit)
+		? 1
+		: ["s", "sec", "secs", "second", "seconds"].includes(unit)
+			? 1000
+			: ["m", "min", "mins", "minute", "minutes"].includes(unit)
+				? 60_000
+				: undefined;
+	if (multiplier === undefined) return undefined;
+	const ms = Math.round(amount * multiplier);
+	return Number.isFinite(ms) ? ms : undefined;
+}
+
+export function streamIdleTimeoutMsFromEnv(env: NodeJS.ProcessEnv = process.env): number {
+	const raw = env[STREAM_IDLE_TIMEOUT_ENV]?.trim();
+	if (!raw) return DEFAULT_STREAM_IDLE_TIMEOUT_MS;
+	return parseDurationLiteralMs(raw, "s") ?? DEFAULT_STREAM_IDLE_TIMEOUT_MS;
+}
+
+function formatDurationShort(ms: number): string {
+	if (ms < 180_000 && ms % 1000 === 0) return `${ms / 1000}s`;
+	if (ms % 60_000 === 0) return `${ms / 60_000}m`;
+	if (ms % 1000 === 0) return `${ms / 1000}s`;
+	return `${ms}ms`;
+}
+
+export function buildStreamIdleTimeoutErrorMessage(timeoutMs: number): string {
+	return `Claude Code stream idle timeout after ${formatDurationShort(timeoutMs)} with no assistant/tool output; treating stalled stream as retryable 529 overloaded/rate limit condition. Retry after ${formatDurationShort(STREAM_IDLE_BACKOFF_HINT_MS)}.`;
+}
+
+export function createStreamIdleWatchdog({
+	clearTimer = (timer: TimerHandle) => clearTimeout(timer),
+	getState,
+	now = () => Date.now(),
+	onTimeout,
+	setTimer = (fn: () => void, delayMs: number) => setTimeout(fn, delayMs),
+	timeoutMs,
+}: {
+	clearTimer?: (timer: TimerHandle) => void;
+	getState: () => StreamIdleWatchdogState;
+	now?: () => number;
+	onTimeout: (info: StreamIdleTimeoutInfo) => void;
+	setTimer?: (fn: () => void, delayMs: number) => TimerHandle;
+	timeoutMs: number;
+}): StreamIdleWatchdog {
+	let disposed = false;
+	let lastChunkAt = now();
+	let timer: TimerHandle | null = null;
+	let didTimeout = false;
+
+	const clear = () => {
+		if (!timer) return;
+		try { clearTimer(timer); } catch { /* best effort */ }
+		timer = null;
+	};
+
+	const shouldMonitor = (state: StreamIdleWatchdogState): boolean => Boolean(
+		timeoutMs > 0
+		&& state.activeQuery
+		&& state.currentPiStream
+		&& state.turnOutput
+		&& !state.turnStarted
+		&& !state.turnSawStreamEvent,
+	);
+
+	const schedule = () => {
+		clear();
+		if (disposed || didTimeout || timeoutMs <= 0) return;
+		const state = getState();
+		if (!shouldMonitor(state)) return;
+		const turnStartedAt = typeof state.turnOutput?.timestamp === "number" ? state.turnOutput.timestamp : 0;
+		const idleStartedAt = Math.max(lastChunkAt, turnStartedAt);
+		const idleMs = Math.max(0, now() - idleStartedAt);
+		if (idleMs >= timeoutMs) {
+			didTimeout = true;
+			onTimeout({ idleMs, timeoutMs });
+			return;
+		}
+		timer = setTimer(schedule, Math.max(1, timeoutMs - idleMs));
+		(timer as { unref?: () => void }).unref?.();
+	};
+
+	return {
+		dispose: () => {
+			disposed = true;
+			clear();
+		},
+		noteChunk: () => {
+			lastChunkAt = now();
+			schedule();
+		},
+		refresh: schedule,
+		timedOut: () => didTimeout,
+	};
+}
+
 export function isExtraUsageRequiredMessage(value: unknown): boolean {
 	let text: string;
 	if (typeof value === "string") text = value;
@@ -437,6 +675,64 @@ export function isExtraUsageRequiredMessage(value: unknown): boolean {
 	return /extra[-\s]?usage|overage|extra usage billing|extra usage credits|1M context/i.test(text);
 }
 
+export function uniqueNonEmptyLines(values: unknown[]): string[] {
+	const seen = new Set<string>();
+	const out: string[] = [];
+	for (const value of values) {
+		const text = typeof value === "string" ? value.trim() : value == null ? "" : String(value).trim();
+		if (!text || seen.has(text)) continue;
+		seen.add(text);
+		out.push(text);
+	}
+	return out;
+}
+
+export function formatResetTimestamp(value: unknown): string {
+	const parsed = typeof value === "number" ? value : typeof value === "string" ? Date.parse(value) : Number.NaN;
+	if (!Number.isFinite(parsed)) return "unknown";
+	return new Date(parsed).toLocaleString(undefined, {
+		day: "numeric",
+		hour: "numeric",
+		minute: "2-digit",
+		month: "short",
+		second: "2-digit",
+		timeZoneName: "short",
+		year: "numeric",
+	});
+}
+
+export const ALLOWED_RATE_LIMIT_WARNING_UTILIZATION_THRESHOLD = 80;
+
+export function normalizeRateLimitUtilization(value: unknown): number | undefined {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return undefined;
+	if (value === 0) return 0;
+	// Claude SDK payloads have appeared as both fractions and percentages.
+	// Exact 1 is unit-ambiguous (1% vs 100%), so do not use it for allowed-warning copy.
+	if (value > 0 && value < 1) return value * 100;
+	if (value > 1 && value <= 100) return value;
+	return undefined;
+}
+
+function rateLimitTypeLabel(value: unknown): string {
+	const text = typeof value === "string" ? value.trim() : "";
+	return text || "unknown";
+}
+
+export function formatAllowedRateLimitWarning(info: { status?: unknown; utilization?: unknown; rateLimitType?: unknown } | null | undefined): string | undefined {
+	if (info?.status !== "allowed_warning") return undefined;
+	const utilization = normalizeRateLimitUtilization(info.utilization);
+	if (utilization === undefined || utilization < ALLOWED_RATE_LIMIT_WARNING_UTILIZATION_THRESHOLD) return undefined;
+	return `Claude rate limit warning: nearing ${rateLimitTypeLabel(info.rateLimitType)} limit; check Claude Code /usage for exact utilization.`;
+}
+
+function emitRateLimitEvent(payload: Record<string, unknown>): void {
+	try {
+		extensionApi?.events?.emit?.(RATE_LIMIT_AUTO_RESUME_EVENT, payload);
+	} catch {
+		// Cross-extension broker is best-effort only.
+	}
+}
+
 function extraUsageAllowed(config: Config): boolean {
 	return config.provider?.allowExtraUsage === true;
 }
@@ -641,6 +937,7 @@ function convertAndImportMessages(
 	session: ReturnType<typeof createSession>,
 	messages: Context["messages"],
 	customToolNameToSdk?: Map<string, string>,
+	cwd?: string,
 ): void {
 	const { anthropicMessages, sanitizedIds } = convertPiMessages(messages, customToolNameToSdk);
 
@@ -656,7 +953,17 @@ function convertAndImportMessages(
 			[...sanitizedIds.entries()].map(([orig, clean]) => orig === clean ? orig : `${orig}→${clean}`).join(", "));
 	}
 	// Pre-repair for debug logging; importMessages also repairs internally (idempotent).
+	const missingToolResults = findUnpairedToolUses(anthropicMessages);
 	const repaired = repairToolPairing(anthropicMessages);
+	if (missingToolResults.length > 0) {
+		reportSyntheticToolResultRepair(missingToolResults, {
+			cwd,
+			messageCount: messages.length,
+			anthropicMessageCount: anthropicMessages.length,
+			sessionId: session.sessionId,
+			jsonlPath: session.jsonlPath,
+		});
+	}
 	if (repaired.length !== anthropicMessages.length) {
 		debug(`convertAndImportMessages: repairToolPairing ${anthropicMessages.length} → ${repaired.length} msgs`);
 	}
@@ -854,7 +1161,7 @@ function syncSharedSession(
 		...(preserveId ? { sessionId: previousSessionId } : {}),
 		...(modelId ? { model: modelId } : {}),
 	});
-	convertAndImportMessages(session, priorMessages, customToolNameToSdk);
+	convertAndImportMessages(session, priorMessages, customToolNameToSdk, cwd);
 	session.save();
 	verifyWrittenSession(session.jsonlPath, session.sessionId, session.messages.length, cwd);
 	sharedSession = { sessionId: session.sessionId, cursor: priorMessages.length, cwd };
@@ -954,28 +1261,50 @@ function resolveMcpTools(context: Context, excludeToolName?: string): {
 
 // Creates an MCP server that bridges pi tools to the SDK. Each tool handler
 // blocks on a Promise until pi delivers the tool result via streamSimple.
-// Handlers are assigned toolCallIds from turnToolCallIds (populated when the SDK
-// emits tool_use blocks). Results are matched by ID, not position.
-// Handlers close over the captured `queryCtx`, ensuring they operate on the
-// correct query's state even across pushContext/popContext calls.
+// Handlers claim their tool_call id by matching the actual MCP call
+// (tool name + arguments) against the recorded tool_use blocks, then results
+// are matched by ID. Handlers close over the captured `queryCtx`, ensuring they
+// operate on the correct query's state even across pushContext/popContext calls.
 function buildMcpServers(tools: Tool[], queryCtx: QueryContext): Record<string, ReturnType<typeof createSdkMcpServer>> | undefined {
 	if (!tools.length) return undefined;
 	const mcpTools = tools.map((tool) => ({
 		name: tool.name,
 		description: tool.description,
 		inputSchema: jsonSchemaToZodShape(tool.parameters),
-		handler: async () => {
-			const toolCallId = queryCtx.turnToolCallIds[queryCtx.nextHandlerIdx++];
-			if (!toolCallId) debug(`WARNING: mcp handler ${tool.name} has no toolCallId (idx=${queryCtx.nextHandlerIdx - 1}, available=${queryCtx.turnToolCallIds.length})`);
+		handler: async (args?: Record<string, unknown>) => {
+			const mappedArgs = mapToolArgs(tool.name, args);
+			const claim = queryCtx.claimToolCall(tool.name, mappedArgs);
+			const toolCallId = claim.toolCallId;
+			if (!toolCallId) {
+				debug(`WARNING: mcp handler ${tool.name} has no toolCallId (available=${claim.available})`);
+				diagDump("tool_handler_unmatched", {
+					toolName: tool.name,
+					argKeys: argKeys(mappedArgs),
+					available: claim.available,
+					turnToolCallIds: queryCtx.turnToolCallIds,
+					turnToolCalls: safeToolCallSummary(queryCtx.turnToolCalls),
+				});
+				return { content: [{ type: "text", text: `Claude bridge internal error: no matching tool_call id for ${tool.name}` }], isError: true } satisfies McpResult;
+			}
+			if (claim.match !== "tool-args" || claim.ambiguous) {
+				debug(`mcp handler: ${tool.name} [${toolCallId}] claimed by ${claim.match}${claim.ambiguous ? " (ambiguous)" : ""}`);
+			}
 			if (toolCallId && queryCtx.pendingResults.has(toolCallId)) {
 				const result = queryCtx.pendingResults.get(toolCallId)!;
 				queryCtx.pendingResults.delete(toolCallId);
+				queryCtx.markToolResultResolved(toolCallId);
 				debug(`mcp handler: ${tool.name} [${toolCallId}] → resolved from queue (${queryCtx.pendingResults.size} remaining)`);
 				return result;
 			}
 			debug(`mcp handler: ${tool.name} [${toolCallId}] → waiting`);
 			return new Promise<McpResult>((resolve) => {
-				queryCtx.pendingToolCalls.set(toolCallId, { toolName: tool.name, resolve });
+				queryCtx.pendingToolCalls.set(toolCallId, {
+					toolName: tool.name,
+					resolve: (result) => {
+						queryCtx.markToolResultResolved(toolCallId);
+						resolve(result);
+					},
+				});
 			});
 		},
 	}));
@@ -1004,6 +1333,26 @@ const REASONING_TO_EFFORT: Record<string, EffortLevel> = {
 	minimal: "low", low: "low", medium: "medium", high: "high", xhigh: "max",
 };
 
+function normalizeEffortOverrideModelKey(value: string): string {
+	const key = value.trim().toLowerCase();
+	return key.startsWith(`${PROVIDER_ID}/`) ? key.slice(PROVIDER_ID.length + 1) : key;
+}
+
+export function resolveConfiguredEffort(
+	modelId: string,
+	reasoningEffort: EffortLevel | undefined,
+	providerConfig?: Config["provider"],
+): EffortLevel | undefined {
+	const target = normalizeEffortOverrideModelKey(modelId);
+	for (const [key, rawEffort] of Object.entries(providerConfig?.modelEffortOverrides ?? {})) {
+		const normalizedKey = normalizeEffortOverrideModelKey(key);
+		if (normalizedKey !== "*" && normalizedKey !== target) continue;
+		const effort = normalizeEffortLevel(rawEffort) as EffortLevel | undefined;
+		if (effort) return effort;
+	}
+	return (normalizeEffortLevel(providerConfig?.forceEffort) as EffortLevel | undefined) ?? reasoningEffort;
+}
+
 // --- Provider helpers: misc ---
 
 function mapStopReason(reason: string | undefined): "stop" | "length" | "toolUse" {
@@ -1054,24 +1403,28 @@ function finalizeCurrentStream(stopReason?: string): void {
 
 /** Maps Anthropic stream events to pi stream events (text, thinking, toolcall).
  *  On message_stop with tool_use: ends currentPiStream so pi can execute the tool. */
-function processStreamEvent(
+export function processStreamEvent(
 	message: SDKMessage,
 	customToolNameToPi: Map<string, string>,
 	model: Model<any>,
 ): void {
 	const c = ctx();
 	if (!c.currentPiStream || !c.turnOutput) return;
-	c.turnSawStreamEvent = true;
 	const event = (message as SDKMessage & { event: any }).event;
+	if (event?.type === "ping") return;
+	if (event?.type === "message_stop" && !c.turnSawToolCall) {
+		debug("processStreamEvent: ignoring bare message_stop with no streamed content/tool call");
+		return;
+	}
 
 	if (event?.type === "message_start") {
-		c.turnToolCallIds = [];
-		c.nextHandlerIdx = 0;
+		c.resetToolTracking();
 		if (event.message?.usage) updateUsage(c.turnOutput, event.message.usage, model);
 		return;
 	}
 
 	if (event?.type === "content_block_start") {
+		c.turnSawStreamEvent = true;
 		ensureTurnStarted();
 		if (event.content_block?.type === "text") {
 			c.turnBlocks.push({ type: "text", text: "", index: event.index });
@@ -1081,10 +1434,11 @@ function processStreamEvent(
 			c.currentPiStream!.push({ type: "thinking_start", contentIndex: c.turnBlocks.length - 1, partial: c.turnOutput });
 		} else if (event.content_block?.type === "tool_use") {
 			c.turnSawToolCall = true;
-			c.turnToolCallIds.push(event.content_block.id);
+			const mappedName = mapToolName(event.content_block.name, customToolNameToPi);
+			c.recordToolCall(event.content_block.id, mappedName, {});
 			c.turnBlocks.push({
 				type: "toolCall", id: event.content_block.id,
-				name: mapToolName(event.content_block.name, customToolNameToPi),
+				name: mappedName,
 				arguments: (event.content_block.input as Record<string, unknown>) ?? {},
 				partialJson: "", index: event.index,
 			});
@@ -1098,7 +1452,11 @@ function processStreamEvent(
 	if (event?.type === "content_block_delta") {
 		const index = c.turnBlocks.findIndex((b: any) => b.index === event.index);
 		const block = c.turnBlocks[index];
-		if (!block) return;
+		if (!block) {
+			debug("processStreamEvent: ignoring unmatched content_block_delta", event.index);
+			return;
+		}
+		c.turnSawStreamEvent = true;
 		if (event.delta?.type === "text_delta" && block.type === "text") {
 			block.text += event.delta.text;
 			c.currentPiStream!.push({ type: "text_delta", contentIndex: index, delta: event.delta.text, partial: c.turnOutput });
@@ -1120,7 +1478,11 @@ function processStreamEvent(
 	if (event?.type === "content_block_stop") {
 		const index = c.turnBlocks.findIndex((b: any) => b.index === event.index);
 		const block = c.turnBlocks[index];
-		if (!block) return;
+		if (!block) {
+			debug("processStreamEvent: ignoring unmatched content_block_stop", event.index);
+			return;
+		}
+		c.turnSawStreamEvent = true;
 		delete block.index;
 		if (block.type === "text") {
 			c.currentPiStream!.push({ type: "text_end", contentIndex: index, content: block.text, partial: c.turnOutput });
@@ -1131,6 +1493,7 @@ function processStreamEvent(
 			block.arguments = mapToolArgs(
 				block.name, parsePartialJson(block.partialJson, block.arguments),
 			);
+			c.updateToolCallArgs(block.id, block.arguments);
 			delete block.partialJson;
 			c.currentPiStream!.push({ type: "toolcall_end", contentIndex: index, toolCall: block, partial: c.turnOutput });
 		}
@@ -1169,13 +1532,73 @@ function processStreamEvent(
 // arrives before any stream_events, this is the primary content path. Must maintain
 // the same stream lifecycle as processStreamEvent — including ending the stream on
 // tool_use to prevent deadlock with the MCP handler.
-function processAssistantMessage(message: SDKMessage, model: Model<any>, customToolNameToPi: Map<string, string>): void {
+function appendMissingToolUsesFromAssistant(
+	assistantMsg: { content?: Array<any>; usage?: Record<string, number | undefined> },
+	model: Model<any>,
+	customToolNameToPi: Map<string, string>,
+): boolean {
+	const c = ctx();
+	if (!assistantMsg?.content) return false;
+	let sawToolUse = false;
+	for (const block of assistantMsg.content) {
+		if (block.type !== "tool_use") continue;
+		sawToolUse = true;
+		const existingIdx = c.turnBlocks.findIndex((b: any) => b.type === "toolCall" && b.id === block.id);
+		const name = mapToolName(block.name, customToolNameToPi);
+		const mappedArgs = mapToolArgs(name, block.input);
+		c.recordToolCall(block.id, name, mappedArgs);
+		if (existingIdx >= 0) {
+			const existing = c.turnBlocks[existingIdx] as any;
+			existing.name = name;
+			existing.arguments = mappedArgs;
+			c.updateToolCallArgs(block.id, mappedArgs);
+			if ("partialJson" in existing) {
+				delete existing.partialJson;
+				delete existing.index;
+				c.currentPiStream?.push({ type: "toolcall_end", contentIndex: existingIdx, toolCall: existing, partial: c.turnOutput });
+			}
+			continue;
+		}
+
+		ensureTurnStarted();
+		c.turnBlocks.push({
+			type: "toolCall", id: block.id,
+			name,
+			arguments: mappedArgs,
+		});
+		const idx = c.turnBlocks.length - 1;
+		const toolBlock = c.turnBlocks[idx];
+		c.currentPiStream?.push({ type: "toolcall_start", contentIndex: idx, partial: c.turnOutput });
+		c.currentPiStream?.push({ type: "toolcall_end", contentIndex: idx, toolCall: toolBlock as any, partial: c.turnOutput });
+	}
+	if (assistantMsg.usage && c.turnOutput) updateUsage(c.turnOutput, assistantMsg.usage, model);
+	return sawToolUse;
+}
+
+export function processAssistantMessage(message: SDKMessage, model: Model<any>, customToolNameToPi: Map<string, string>): void {
 	const c = ctx();
-	if (c.turnSawStreamEvent) return;
 	const assistantMsg = (message as any).message;
 	if (!assistantMsg?.content) return;
-	c.turnToolCallIds = [];
-	c.nextHandlerIdx = 0;
+	if (c.turnSawStreamEvent) {
+		// Claude Agent SDK can yield the completed assistant message before (or
+		// instead of) a stream_event message_stop for a tool-use turn. Treat that
+		// assistant message as a hard turn boundary so Pi executes the tool calls
+		// and the MCP handlers stay blocked until real tool results are delivered.
+		// Without this fallback, Claude Code can continue internally with empty MCP
+		// results and Pi only sees the real outputs one render cycle later.
+		if (appendMissingToolUsesFromAssistant(assistantMsg, model, customToolNameToPi)) {
+			c.turnSawToolCall = true;
+			if (c.currentPiStream && c.turnOutput) {
+				c.turnOutput.stopReason = "toolUse";
+				c.currentPiStream.push({ type: "done", reason: "toolUse", message: c.turnOutput });
+				c.currentPiStream.end();
+				c.currentPiStream = null;
+				debug("processAssistantMessage boundary: ended streamed tool_use turn from assistant message");
+			}
+		}
+		return;
+	}
+	c.resetToolTracking();
 	debug(`processAssistantMessage fallback: ${assistantMsg.content.length} blocks, types=${assistantMsg.content.map((b: any) => b.type).join(",")}`);
 	for (const block of assistantMsg.content) {
 		if (block.type === "text" && block.text) {
@@ -1195,11 +1618,12 @@ function processAssistantMessage(message: SDKMessage, model: Model<any>, customT
 		} else if (block.type === "tool_use") {
 			ensureTurnStarted();
 			c.turnSawToolCall = true;
-			c.turnToolCallIds.push(block.id);
-			const mappedArgs = mapToolArgs(mapToolName(block.name, customToolNameToPi), block.input);
+			const mappedName = mapToolName(block.name, customToolNameToPi);
+			const mappedArgs = mapToolArgs(mappedName, block.input);
+			c.recordToolCall(block.id, mappedName, mappedArgs);
 			c.turnBlocks.push({
 				type: "toolCall", id: block.id,
-				name: mapToolName(block.name, customToolNameToPi),
+				name: mappedName,
 				arguments: mappedArgs,
 			});
 			const idx = c.turnBlocks.length - 1;
@@ -1238,7 +1662,10 @@ async function consumeQuery(
 
 	for await (const message of sdkQuery) {
 		if (wasAborted()) break;
-		if (!ctx().currentPiStream || !ctx().turnOutput) continue;
+		const queryCtx = ctx();
+		activeStreamIdleWatchdogs.get(queryCtx)?.noteChunk();
+		if (!queryCtx.turnOutput) continue;
+		if (!queryCtx.currentPiStream && !(message.type === "assistant" && queryCtx.turnSawToolCall)) continue;
 
 		switch (message.type) {
 			case "stream_event":
@@ -1257,8 +1684,10 @@ async function consumeQuery(
 					ctx().currentPiStream?.push({ type: "text_delta", contentIndex: idx, delta: text, partial: ctx().turnOutput });
 					ctx().currentPiStream?.push({ type: "text_end", contentIndex: idx, content: text, partial: ctx().turnOutput });
 				} else if (message.subtype !== "success" && isExtraUsageRequiredMessage(message)) {
-					const errors = Array.isArray((message as any).errors) ? (message as any).errors.join("\n") : message.subtype;
+					const errorLines = Array.isArray((message as any).errors) ? uniqueNonEmptyLines((message as any).errors) : [];
+					const errors = errorLines.length > 0 ? errorLines.join("\n") : String(message.subtype ?? "Claude Code rate limit");
 					const openedExtraUsage = launchExtraUsageHelperIfAllowed(cwd, bridgeConfig, "result error");
+					ctx().handledTerminalError = true;
 					ctx().turnOutput.stopReason = "error";
 					ctx().turnOutput.errorMessage = `${errors}${openedExtraUsage ? "\n\nOpened Claude Code /extra-usage helper. Complete billing/admin flow in the browser, then retry the prompt." : "\n\nRun /claude-bridge:extra, or enable Allow extra usage helper in settings."}`;
 					ctx().currentPiStream?.push({ type: "error", reason: "error", error: ctx().turnOutput });
@@ -1277,12 +1706,25 @@ async function consumeQuery(
 				const info = (message as any).rate_limit_info;
 				debug("consumeQuery: rate_limit_event", JSON.stringify(info).slice(0, 300));
 				if (info?.status === "rejected") {
-					const resetsAt = info.resetsAt ? new Date(info.resetsAt).toLocaleTimeString() : "unknown";
+					const resetsAt = formatResetTimestamp(info.resetsAt);
+					const resetAtMs = typeof info.resetsAt === "string" ? Date.parse(info.resetsAt) : undefined;
 					const reason = `${info.rateLimitType ?? "unknown"} rate limit`;
 					const launchedExtraUsage = isExtraUsageRequiredMessage(info) && launchExtraUsageHelperIfAllowed(cwd, bridgeConfig, reason);
-					piUI?.notify(`Claude rate limited (${reason}) — resets at ${resetsAt}${launchedExtraUsage ? "; opened /extra-usage helper" : ""}`, "warning");
+					emitRateLimitEvent({
+						model: model.id,
+						provider: PROVIDER_ID,
+						rateLimitType: info.rateLimitType,
+						reason,
+						resetAt: info.resetsAt,
+						...(Number.isFinite(resetAtMs) ? { resetAtMs } : {}),
+						source: "claude-bridge",
+						status: "rejected",
+					});
+					piUI?.notify(`${RATE_LIMIT_TOKEN} Claude ${reason} hit — resets ${resetsAt}${launchedExtraUsage ? "; opened /extra-usage helper" : ""}`, "warning");
 				} else if (info?.status === "allowed_warning") {
-					piUI?.notify(`Claude rate limit warning: ${Math.round(info.utilization ?? 0)}% used (${info.rateLimitType ?? ""})`, "warning");
+					const warning = formatAllowedRateLimitWarning(info);
+					if (warning) piUI?.notify(warning, "warning");
+					else debug("consumeQuery: suppressed low/ambiguous allowed_warning rate_limit_event", JSON.stringify(info).slice(0, 300));
 				}
 				break;
 			}
@@ -1305,6 +1747,7 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 
 	// DEBUG: trace followUp message triggering
 	const lastMsgRole = context.messages[context.messages.length - 1]?.role;
+	const cwd = (options as { cwd?: string } | undefined)?.cwd ?? process.cwd();
 	debug(`provider: streamClaudeAgentSdk called, activeQuery=${!!ctx().activeQuery}, lastMsgRole=${lastMsgRole}, isReentrant=${ctx().activeQuery !== null}`);
 
 	// --- Tool result delivery ---
@@ -1312,30 +1755,49 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 	// (everything after the last assistant message) and match against waiting MCP
 	// handlers. Results that arrive before their handler get queued in pendingResults.
 	if (ctx().activeQuery) {
-		ctx().currentPiStream = stream;
-		ctx().resetTurnState(model);
+		const queryCtx = ctx();
+		queryCtx.currentPiStream = stream;
+		queryCtx.resetTurnState(model);
+		activeStreamIdleWatchdogs.get(queryCtx)?.refresh();
 		const allResults = extractAllToolResults(context);
-		debug(`provider: tool results, ${allResults.length} results, ${ctx().pendingToolCalls.size} waiting handlers, ctx.msgs=${context.messages.length}`);
+		debug(`provider: tool results, ${allResults.length} results, ${queryCtx.pendingToolCalls.size} waiting handlers, ctx.msgs=${context.messages.length}`);
+		const unmatchedResultIds: string[] = [];
 		for (const result of allResults) {
 			const id = result.toolCallId;
-			if (id && ctx().pendingToolCalls.has(id)) {
-				const pending = ctx().pendingToolCalls.get(id)!;
-				ctx().pendingToolCalls.delete(id);
+			if (id && !queryCtx.hasRecordedToolCall(id)) {
+				queryCtx.markToolResultUnmatched(id);
+				unmatchedResultIds.push(id);
+				debug(`ERROR: tool result [${id}] has no registered tool_call id; refusing to queue or deliver`);
+				continue;
+			}
+			queryCtx.markToolResultDelivered(id);
+			if (id && queryCtx.pendingToolCalls.has(id)) {
+				const pending = queryCtx.pendingToolCalls.get(id)!;
+				queryCtx.pendingToolCalls.delete(id);
 				debug(`provider: resolving ${pending.toolName} [${id}]${result.isError ? " (error)" : ""}`, JSON.stringify(result.content).slice(0, 200));
 				pending.resolve(result);
 			} else if (id) {
-				ctx().pendingResults.set(id, result);
-				debug(`provider: queued result [${id}] (${ctx().pendingResults.size} pending)`);
+				queryCtx.pendingResults.set(id, result);
+				debug(`provider: queued result [${id}] (${queryCtx.pendingResults.size} pending)`);
 			} else {
 				debug(`WARNING: tool result without toolCallId, cannot match`);
 			}
-			if (ctx().pendingToolCalls.size > 0 && ctx().pendingResults.size > 0) {
-				debug(`BUG: both maps non-empty! handlers=${ctx().pendingToolCalls.size} results=${ctx().pendingResults.size}`);
+			if (queryCtx.pendingToolCalls.size > 0 && queryCtx.pendingResults.size > 0) {
+				debug(`BUG: both maps non-empty! handlers=${queryCtx.pendingToolCalls.size} results=${queryCtx.pendingResults.size}`);
 			}
 		}
-		if (ctx().pendingToolCalls.size > 0) {
-			debug(`WARNING: ${ctx().pendingToolCalls.size} MCP handlers still waiting after delivering ${allResults.length} results`);
-			piUI?.notify(`Claude bridge: ${ctx().pendingToolCalls.size} tool handler(s) still waiting — provider may be stuck`, "warning");
+		if (unmatchedResultIds.length > 0) {
+			const errorResult: McpResult = {
+				content: [{ type: "text", text: `Claude bridge internal error: ${unmatchedResultIds.length} tool result(s) did not match any registered tool_call id. The turn was stopped to avoid delivering tool output to the wrong call. Unmatched ids: ${unmatchedResultIds.slice(0, 8).join(", ")}${unmatchedResultIds.length > 8 ? ", ..." : ""}` }],
+				isError: true,
+			};
+			for (const pending of queryCtx.pendingToolCalls.values()) pending.resolve(errorResult);
+			queryCtx.pendingToolCalls.clear();
+			reportToolResultMismatch(queryCtx, "unmatched tool result", cwd);
+		}
+		if (queryCtx.pendingToolCalls.size > 0) {
+			debug(`WARNING: ${queryCtx.pendingToolCalls.size} MCP handlers still waiting after delivering ${allResults.length} results`);
+			piUI?.notify(`Claude bridge: ${queryCtx.pendingToolCalls.size} tool handler(s) still waiting — provider may be stuck`, "warning");
 		}
 
 		// Detect user messages (steer/followUp) that pi injected into context
@@ -1355,7 +1817,7 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 		}
 
 		if (sharedSession) sharedSession.cursor = context.messages.length;
-		ctx().latestCursor = Math.max(ctx().latestCursor, context.messages.length);
+		queryCtx.latestCursor = Math.max(queryCtx.latestCursor, context.messages.length);
 		return stream;
 	}
 
@@ -1389,10 +1851,10 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 	ctx().pendingResults.clear();
 	ctx().deferredUserMessages = [];
 	ctx().resetTurnState(model);
+	ctx().resetToolTracking();
 	ctx().latestCursor = 0;
 
 	const { mcpTools, customToolNameToSdk, customToolNameToPi } = resolveMcpTools(context);
-	const cwd = (options as { cwd?: string } | undefined)?.cwd ?? process.cwd();
 	const promptBlocks = extractUserPromptBlocks(context.messages);
 	let promptText = extractUserPrompt(context.messages) ?? "";
 
@@ -1440,10 +1902,11 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 	// Prefer the model's own thinkingLevelMap when present (pi-ai 0.72+ ships
 	// per-model overrides — e.g. opus-4-7 wants xhigh→xhigh, not xhigh→max).
 	// Fall back to our generic table for older pi-ai or unmapped levels.
-	const effort = options?.reasoning
+	const requestedEffort = options?.reasoning
 		? ((model as any).thinkingLevelMap?.[options.reasoning] as EffortLevel | undefined)
 			?? REASONING_TO_EFFORT[options.reasoning]
 		: undefined;
+	const effort = resolveConfiguredEffort(model.id, requestedEffort, providerSettings);
 
 	const extraArgs: Record<string, string | null> = { model: model.id };
 	if (strictMcpConfigEnabled) extraArgs["strict-mcp-config"] = null;
@@ -1468,6 +1931,7 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 		...CLAUDE_BRIDGE_TOOL_ISOLATION,
 		permissionMode: "bypassPermissions",
 		includePartialMessages: true,
+		...(providerSettings.fastMode ? { settings: { fastMode: true } } : {}),
 		systemPrompt: {
 			type: "preset", preset: "claude_code",
 			append: systemPromptAppend ? systemPromptAppend : undefined,
@@ -1485,12 +1949,13 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 	debug("provider: fresh query",
 		`model=${model.id} msgs=${context.messages.length} tools=${mcpTools.length}`,
 		`resume=${resumeSessionId?.slice(0, 8) ?? "none"} effort=${effort ?? "default"}`,
-		`appendSys=${appendSystemPrompt} promptCtx=${promptContextAppend.labels.join(",") || "none"} strictMcp=${strictMcpConfigEnabled}`,
+		`appendSys=${appendSystemPrompt} promptCtx=${promptContextAppend.labels.join(",") || "none"} strictMcp=${strictMcpConfigEnabled} fastMode=${providerSettings.fastMode === true}`,
 		`claudeExec=${claudeExecutablePreflight ? `${claudeExecutablePreflight.fileType}:${claudeExecutablePreflight.path}` : "sdk-default"}`,
 		`prompt=${promptText.slice(0, 60)}${promptBlocks ? " [+images]" : ""}`);
 
 	// 3. Start SDK query and claim it for this context
 	let wasAborted = false;
+	let streamIdleTimedOut = false;
 	const sdkQuery = query({ prompt, options: queryOptions });
 	ctx().activeQuery = sdkQuery;
 
@@ -1503,10 +1968,62 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 		void sdkQuery.interrupt().catch(() => {});
 		try { sdkQuery.close(); } catch {}
 	};
+	const streamIdleTimeoutMs = streamIdleTimeoutMsFromEnv();
+	const streamIdleWatchdog = streamIdleTimeoutMs > 0
+		? createStreamIdleWatchdog({
+			getState: () => ({
+				activeQuery: abortCtx.activeQuery,
+				currentPiStream: abortCtx.currentPiStream,
+				turnOutput: abortCtx.turnOutput,
+				turnSawStreamEvent: abortCtx.turnSawStreamEvent,
+				turnStarted: abortCtx.turnStarted,
+			}),
+			onTimeout: ({ idleMs, timeoutMs }) => {
+				if (streamIdleTimedOut || wasAborted || options?.signal?.aborted || abortCtx.activeQuery !== sdkQuery) return;
+				streamIdleTimedOut = true;
+				abortCtx.deferredUserMessages = [];
+				abortCtx.handledTerminalError = true;
+				if (sharedSession) sharedSession = { ...sharedSession, needsRebuild: true, forceRotate: true };
+				const errorMessage = buildStreamIdleTimeoutErrorMessage(timeoutMs);
+				debug("provider: stream idle timeout", `model=${model.id}`, `timeout=${timeoutMs}`, `idle=${idleMs}`);
+				emitRateLimitEvent({
+					idleMs,
+					model: model.id,
+					provider: PROVIDER_ID,
+					rateLimitType: "stream_idle",
+					reason: "Claude Code stream idle timeout",
+					retryAfterMs: STREAM_IDLE_BACKOFF_HINT_MS,
+					source: "claude-bridge",
+					status: "rejected",
+					timeoutMs,
+				});
+				piUI?.notify(`${RATE_LIMIT_TOKEN} Claude stream idle timeout after ${formatDurationShort(timeoutMs)} — retrying via rate-limit backoff`, "warning");
+				if (abortCtx.turnOutput) {
+					abortCtx.turnOutput.stopReason = "error";
+					abortCtx.turnOutput.errorMessage = errorMessage;
+					Object.assign(abortCtx.turnOutput as AssistantMessage & Record<string, unknown>, {
+						rateLimitType: "stream_idle",
+						retryAfterMs: STREAM_IDLE_BACKOFF_HINT_MS,
+						streamIdleTimeoutMs: timeoutMs,
+					});
+				}
+				abortCtx.currentPiStream?.push({ type: "error", reason: "error", error: abortCtx.turnOutput! });
+				abortCtx.currentPiStream?.end();
+				abortCtx.currentPiStream = null;
+				requestAbort();
+			},
+			timeoutMs: streamIdleTimeoutMs,
+		})
+		: null;
+	if (streamIdleWatchdog) {
+		activeStreamIdleWatchdogs.set(abortCtx, streamIdleWatchdog);
+		streamIdleWatchdog.refresh();
+	}
 	const onAbort = () => {
 		wasAborted = true;
 		// Prevent stale deferred messages from being replayed by parent on pop
 		abortCtx.deferredUserMessages = [];
+		reportToolResultMismatch(abortCtx, "abort", cwd, { forceRotate: true });
 		for (const pending of abortCtx.pendingToolCalls.values()) { pending.resolve({ content: [{ type: "text", text: "Operation aborted" }] }); }
 		abortCtx.pendingToolCalls.clear();
 		abortCtx.pendingResults.clear();
@@ -1521,6 +2038,11 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 	consumeQuery(sdkQuery, customToolNameToPi, model, cwd, bridgeConfig, () => wasAborted)
 		.then(async ({ capturedSessionId }) => {
 			debug(`provider: consumeQuery completed, stopReason=${ctx().turnOutput?.stopReason}, error=${ctx().turnOutput?.errorMessage}, aborted=${wasAborted}`);
+			if (streamIdleTimedOut) {
+				abortCtx.deferredUserMessages = [];
+				debug("provider: stream idle timeout already surfaced; skipping normal completion");
+				return;
+			}
 
 			// --- Abort detection in normal completion path ---
 			if (wasAborted || options?.signal?.aborted) {
@@ -1553,6 +2075,7 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 					const steerPrompt = ctx().deferredUserMessages.shift()!;
 					debug(`provider: replaying deferred user message: ${steerPrompt.slice(0, 60)}`);
 					ctx().resetTurnState(model);
+					ctx().resetToolTracking();
 
 					const resumeId = sharedSession?.sessionId;
 					if (!resumeId) {
@@ -1588,13 +2111,18 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 		})
 		.catch((error) => {
 			debug(`provider: query error, model=${model.id}, aborted=${Boolean(options?.signal?.aborted)}, error=`, error);
-			const openedExtraUsage = isExtraUsageRequiredMessage(error) && launchExtraUsageHelperIfAllowed(cwd, bridgeConfig, "query error");
+			const suppressDuplicateError = ctx().handledTerminalError || streamIdleTimedOut;
+			const openedExtraUsage = !suppressDuplicateError && isExtraUsageRequiredMessage(error) && launchExtraUsageHelperIfAllowed(cwd, bridgeConfig, "query error");
 			if ((wasAborted || options?.signal?.aborted) && sharedSession) {
 				sharedSession = { ...sharedSession, needsRebuild: true, forceRotate: true };
 			} else {
 				sharedSession = null;
 			}
 			ctx().deferredUserMessages = [];
+			if (suppressDuplicateError) {
+				debug("provider: suppressing duplicate query error after terminal error was already emitted");
+				return;
+			}
 			if (ctx().turnOutput) {
 				ctx().turnOutput.stopReason = options?.signal?.aborted ? "aborted" : "error";
 				ctx().turnOutput.errorMessage = `${error instanceof Error ? error.message : String(error)}${openedExtraUsage ? "\n\nOpened Claude Code /extra-usage helper. Complete billing/admin flow in the browser, then retry the prompt." : ""}`;
@@ -1604,8 +2132,11 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 			ctx().currentPiStream = null;
 		})
 		.finally(() => {
+			streamIdleWatchdog?.dispose();
+			activeStreamIdleWatchdogs.delete(abortCtx);
 			if (options?.signal) options.signal.removeEventListener("abort", onAbort);
 			if (ctx().activeQuery === sdkQuery) {
+				reportToolResultMismatch(ctx(), "query teardown", cwd, { forceRotate: wasAborted || options?.signal?.aborted || streamIdleTimedOut });
 				// Drain pending handlers for this query
 				for (const pending of ctx().pendingToolCalls.values()) { pending.resolve({ content: [{ type: "text", text: "Query ended" }] }); }
 				ctx().pendingToolCalls.clear();
@@ -1741,6 +2272,9 @@ export default function (pi: ExtensionAPI) {
 	// triggers CC's autocompact-thrashing guard (issue #8). Force the next
 	// call down the REBUILD path so CC sees the current history.
 	const markRebuild = (event: string) => {
+		if (ctx().activeQuery) {
+			reportToolResultMismatch(ctx(), event, sharedSession?.cwd ?? process.cwd());
+		}
 		if (sharedSession) {
 			debug(`${event}: marking needsRebuild on session ${sharedSession.sessionId.slice(0, 8)}`);
 			sharedSession = { ...sharedSession, needsRebuild: true };