@visorcraft/idlehands 1.3.7 → 1.3.9

package/dist/agent.js

@@ -1,29 +1,29 @@
-import { normalizeApprovalMode } from './shared/config-utils.js';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { generateMinimalDiff, toolResultSummary, execCommandFromSig, formatDurationMs, looksLikePlanningNarration, capTextByApproxTokens, isLikelyBinaryBuffer, sanitizePathsInMessage, digestToolResult, } from './agent/formatting.js';
+import { reviewArtifactKeys, looksLikeCodeReviewRequest, looksLikeReviewRetrievalRequest, retrievalAllowsStaleArtifact, parseReviewArtifactStalePolicy, parseReviewArtifact, reviewArtifactStaleReason, gitHead, normalizeModelsResponse, } from './agent/review-artifact.js';
+import { parseToolCallsFromContent, getMissingRequiredParams, getArgValidationIssues, stripMarkdownFences, parseJsonArgs, } from './agent/tool-calls.js';
+import { ToolLoopGuard } from './agent/tool-loop-guard.js';
 import { OpenAIClient } from './client.js';
-import { enforceContextBudget, stripThinking, estimateTokensFromMessages, estimateToolSchemaTokens } from './history.js';
-import * as tools from './tools.js';
-import { selectHarness } from './harnesses.js';
-import { BASE_MAX_TOKENS, deriveContextWindow, deriveGenerationParams, supportsVisionModel } from './model-customization.js';
-import { HookManager, loadHookPlugins } from './hooks/index.js';
-import { checkExecSafety, checkPathSafety } from './safety.js';
 import { loadProjectContext } from './context.js';
 import { loadGitContext, isGitDirty, stashWorkingTree } from './git.js';
+import { selectHarness } from './harnesses.js';
+import { enforceContextBudget, stripThinking, estimateTokensFromMessages, estimateToolSchemaTokens, } from './history.js';
+import { HookManager, loadHookPlugins } from './hooks/index.js';
 import { projectIndexKeys, parseIndexMeta, isFreshIndex, indexSummaryLine } from './indexer.js';
-import { ReplayStore } from './replay.js';
-import { VaultStore } from './vault.js';
 import { LensStore } from './lens.js';
-import { SYS_CONTEXT_SCHEMA, collectSnapshot } from './sys/context.js';
-import { MCPManager } from './mcp.js';
 import { LspManager, detectInstalledLspServers } from './lsp.js';
-import { generateMinimalDiff, toolResultSummary, execCommandFromSig, formatDurationMs, looksLikePlanningNarration, capTextByApproxTokens, isLikelyBinaryBuffer, sanitizePathsInMessage, digestToolResult, } from './agent/formatting.js';
-import { parseToolCallsFromContent, getMissingRequiredParams, getArgValidationIssues, stripMarkdownFences, parseJsonArgs } from './agent/tool-calls.js';
+import { MCPManager } from './mcp.js';
+import { BASE_MAX_TOKENS, deriveContextWindow, deriveGenerationParams, supportsVisionModel, } from './model-customization.js';
+import { ReplayStore } from './replay.js';
+import { checkExecSafety, checkPathSafety } from './safety.js';
+import { normalizeApprovalMode } from './shared/config-utils.js';
+import { SYS_CONTEXT_SCHEMA, collectSnapshot } from './sys/context.js';
 import { ToolError, ValidationError } from './tools/tool-error.js';
-import { ToolLoopGuard } from './agent/tool-loop-guard.js';
-export { parseToolCallsFromContent };
-import { reviewArtifactKeys, looksLikeCodeReviewRequest, looksLikeReviewRetrievalRequest, retrievalAllowsStaleArtifact, parseReviewArtifactStalePolicy, parseReviewArtifact, reviewArtifactStaleReason, gitHead, normalizeModelsResponse, } from './agent/review-artifact.js';
-import fs from 'node:fs/promises';
-import path from 'node:path';
+import * as tools from './tools.js';
 import { stateDir, timestampedId } from './utils.js';
+import { VaultStore } from './vault.js';
+export { parseToolCallsFromContent };
 function makeAbortController() {
     // Node 24: AbortController is global.
     return new AbortController();
@@ -32,7 +32,9 @@ const CACHED_EXEC_OBSERVATION_HINT = '[idlehands hint] Reused cached output for
 function looksLikeReadOnlyExecCommand(command) {
     // Strip leading `cd <path> &&` / `cd <path>;` prefixes — cd is read-only
     // navigation, the actual command that matters comes after.
-    let cmd = String(command || '').trim().toLowerCase();
+    let cmd = String(command || '')
+        .trim()
+        .toLowerCase();
     if (!cmd)
         return false;
     cmd = cmd.replace(/^(\s*cd\s+[^;&|]+\s*(?:&&|;)\s*)+/i, '').trim();
@@ -158,48 +160,66 @@ class AgentLoopBreak extends Error {
         this.name = 'AgentLoopBreak';
     }
 }
-const SYSTEM_PROMPT = `You are a coding agent with filesystem and shell access. Execute the user's request using the provided tools.
-
-Rules:
-- Work in the current directory. Use relative paths for all file operations.
-- Do the work directly. Do NOT use spawn_task to delegate the user's primary request — only use it for genuinely independent subtasks that benefit from parallel execution.
-- Never use spawn_task to bypass confirmation/safety restrictions (for example blocked package installs). If a command is blocked, adapt the plan or ask the user for approval mode changes.
-- Read the target file before editing. You need the exact text for search/replace.
-- Use read_file with search=... to jump to relevant code; avoid reading whole files.
-- Never call read_file/read_files/list_dir twice in a row with identical arguments (same path/options). Reuse the previous result instead.
-- Prefer apply_patch or edit_range for code edits (token-efficient). Use edit_file only when exact old_text replacement is necessary.
-- Tool-call arguments MUST be strict JSON (double-quoted keys/strings, no comments, no trailing commas).
-- edit_range example: {"path":"src/foo.ts","start_line":10,"end_line":14,"replacement":"line A\nline B"}
-- apply_patch example: {"patch":"--- a/src/foo.ts\n+++ b/src/foo.ts\n@@ -10,2 +10,2 @@\n-old\n+new","files":["src/foo.ts"]}
-- write_file is for new files or explicit full rewrites only. Existing non-empty files require overwrite=true/force=true.
-- Use insert_file for insertions (prepend/append/line).
-- Use exec to run commands, tests, builds; check results before reporting success.
-- When running commands in a subdirectory, use exec's cwd parameter — NOT "cd /path && cmd". Each exec call is a fresh shell; cd does not persist.
-- Batch work: read all files you need, then apply all edits, then verify.
-- Be concise. Report what you changed and why.
-- Do NOT read every file in a directory. Use search_files or exec with grep to locate relevant code first, then read only the files that match.
-- If search_files returns 0 matches, try a broader pattern or use: exec grep -rn "keyword" path/
-- Anton (the autonomous task runner) is ONLY activated when the user explicitly invokes /anton. Never self-activate as Anton or start processing task files on your own.
-
-Tool call format:
-- Use tool_calls. Do not write JSON tool invocations in your message text.
+const SYSTEM_PROMPT = `You are a coding agent with filesystem and shell access. Execute the user's request using the provided tools.
+
+Rules:
+- Work in the current directory. Use relative paths for all file operations.
+- Do the work directly. Do NOT use spawn_task to delegate the user's primary request — only use it for genuinely independent subtasks that benefit from parallel execution.
+- Never use spawn_task to bypass confirmation/safety restrictions (for example blocked package installs). If a command is blocked, adapt the plan or ask the user for approval mode changes.
+- Read the target file before editing. You need the exact text for search/replace.
+- Use read_file with search=... to jump to relevant code; avoid reading whole files.
+- Never call read_file/read_files/list_dir twice in a row with identical arguments (same path/options). Reuse the previous result instead.
+- Prefer apply_patch or edit_range for code edits (token-efficient). Use edit_file only when exact old_text replacement is necessary.
+- Tool-call arguments MUST be strict JSON (double-quoted keys/strings, no comments, no trailing commas).
+- edit_range example: {"path":"src/foo.ts","start_line":10,"end_line":14,"replacement":"line A\nline B"}
+- apply_patch example: {"patch":"--- a/src/foo.ts\n+++ b/src/foo.ts\n@@ -10,2 +10,2 @@\n-old\n+new","files":["src/foo.ts"]}
+- write_file is for new files or explicit full rewrites only. Existing non-empty files require overwrite=true/force=true.
+- Use insert_file for insertions (prepend/append/line).
+- Use exec to run commands, tests, builds; check results before reporting success.
+- When running commands in a subdirectory, use exec's cwd parameter — NOT "cd /path && cmd". Each exec call is a fresh shell; cd does not persist.
+- Batch work: read all files you need, then apply all edits, then verify.
+- Be concise. Report what you changed and why.
+- Do NOT read every file in a directory. Use search_files or exec with grep to locate relevant code first, then read only the files that match.
+- If search_files returns 0 matches, try a broader pattern or use: exec grep -rn "keyword" path/
+- Anton (the autonomous task runner) is ONLY activated when the user explicitly invokes /anton. Never self-activate as Anton or start processing task files on your own.
+
+Tool call format:
+- Use tool_calls. Do not write JSON tool invocations in your message text.
 `;
 const MCP_TOOLS_REQUEST_TOKEN = '[[MCP_TOOLS_REQUEST]]';
-const DEFAULT_SUB_AGENT_SYSTEM_PROMPT = `You are a focused coding sub-agent. Execute only the delegated task.
-- Work in the current directory. Use relative paths for all file operations.
-- Read the target file before editing. You need the exact text for search/replace.
-- Keep tool usage tight and efficient.
-- Prefer surgical edits over rewrites.
-- Do NOT create files outside the working directory unless explicitly requested.
-- When running commands in a subdirectory, use exec's cwd parameter — NOT "cd /path && cmd".
-- Run verification commands when relevant.
+const DEFAULT_SUB_AGENT_SYSTEM_PROMPT = `You are a focused coding sub-agent. Execute only the delegated task.
+- Work in the current directory. Use relative paths for all file operations.
+- Read the target file before editing. You need the exact text for search/replace.
+- Keep tool usage tight and efficient.
+- Prefer surgical edits over rewrites.
+- Do NOT create files outside the working directory unless explicitly requested.
+- When running commands in a subdirectory, use exec's cwd parameter — NOT "cd /path && cmd".
+- Run verification commands when relevant.
 - Return a concise outcome summary.`;
 const DEFAULT_SUB_AGENT_RESULT_TOKEN_CAP = 4000;
-const LSP_TOOL_NAMES = ['lsp_diagnostics', 'lsp_symbols', 'lsp_hover', 'lsp_definition', 'lsp_references'];
+const LSP_TOOL_NAMES = [
+    'lsp_diagnostics',
+    'lsp_symbols',
+    'lsp_hover',
+    'lsp_definition',
+    'lsp_references',
+];
 const LSP_TOOL_NAME_SET = new Set(LSP_TOOL_NAMES);
-const FILE_MUTATION_TOOL_SET = new Set(['edit_file', 'edit_range', 'apply_patch', 'write_file', 'insert_file']);
+const FILE_MUTATION_TOOL_SET = new Set([
+    'edit_file',
+    'edit_range',
+    'apply_patch',
+    'write_file',
+    'insert_file',
+]);
 /** Approval mode permissiveness ranking (lower = more restrictive). */
-const APPROVAL_MODE_RANK = { plan: 0, reject: 1, default: 2, 'auto-edit': 3, yolo: 4 };
+const APPROVAL_MODE_RANK = {
+    plan: 0,
+    reject: 1,
+    default: 2,
+    'auto-edit': 3,
+    yolo: 4,
+};
 /**
  * Cap a sub-agent's approval mode at the parent's level.
  * Sub-agents cannot escalate beyond the parent's approval mode.
@@ -284,11 +304,15 @@ function buildToolsSchema(opts) {
         type: 'object',
         additionalProperties: false,
         properties,
-        required
+        required,
     });
     const str = () => ({ type: 'string' });
     const bool = () => ({ type: 'boolean' });
-    const int = (min, max) => ({ type: 'integer', ...(min !== undefined && { minimum: min }), ...(max !== undefined && { maximum: max }) });
+    const int = (min, max) => ({
+        type: 'integer',
+        ...(min !== undefined && { minimum: min }),
+        ...(max !== undefined && { maximum: max }),
+    });
     const schemas = [
         // ────────────────────────────────────────────────────────────────────────────
         // Token-safe reads (require limit; allow plain output without per-line numbers)
@@ -338,7 +362,10 @@ function buildToolsSchema(opts) {
             function: {
                 name: 'write_file',
                 description: 'Write file (atomic, backup). Existing non-empty files require overwrite=true (or force=true).',
-                parameters: obj({ path: str(), content: str(), overwrite: bool(), force: bool() }, ['path', 'content']),
+                parameters: obj({ path: str(), content: str(), overwrite: bool(), force: bool() }, [
+                    'path',
+                    'content',
+                ]),
             },
         },
         {
@@ -371,7 +398,11 @@ function buildToolsSchema(opts) {
             function: {
                 name: 'edit_file',
                 description: 'Legacy exact replace (requires old_text). Prefer apply_patch/edit_range.',
-                parameters: obj({ path: str(), old_text: str(), new_text: str(), replace_all: bool() }, ['path', 'old_text', 'new_text']),
+                parameters: obj({ path: str(), old_text: str(), new_text: str(), replace_all: bool() }, [
+                    'path',
+                    'old_text',
+                    'new_text',
+                ]),
             },
         },
         {
@@ -398,7 +429,10 @@ function buildToolsSchema(opts) {
             function: {
                 name: 'search_files',
                 description: 'Search regex in files.',
-                parameters: obj({ pattern: str(), path: str(), include: str(), max_results: int(1, 100) }, ['pattern', 'path']),
+                parameters: obj({ pattern: str(), path: str(), include: str(), max_results: int(1, 100) }, [
+                    'pattern',
+                    'path',
+                ]),
             },
         },
         // ────────────────────────────────────────────────────────────────────────────
@@ -428,18 +462,42 @@ function buildToolsSchema(opts) {
                     max_tokens: int(),
                     timeout_sec: int(),
                     system_prompt: str(),
-                    approval_mode: { type: 'string', enum: ['plan', 'reject', 'default', 'auto-edit', 'yolo'] },
+                    approval_mode: {
+                        type: 'string',
+                        enum: ['plan', 'reject', 'default', 'auto-edit', 'yolo'],
+                    },
                 }, ['task']),
             },
         });
     }
     if (opts?.activeVaultTools) {
-        schemas.push({ type: 'function', function: { name: 'vault_search', description: 'Search vault.', parameters: obj({ query: str(), limit: int() }, ['query']) } }, { type: 'function', function: { name: 'vault_note', description: 'Write vault note.', parameters: obj({ key: str(), value: str() }, ['key', 'value']) } });
+        schemas.push({
+            type: 'function',
+            function: {
+                name: 'vault_search',
+                description: 'Search vault.',
+                parameters: obj({ query: str(), limit: int() }, ['query']),
+            },
+        }, {
+            type: 'function',
+            function: {
+                name: 'vault_note',
+                description: 'Write vault note.',
+                parameters: obj({ key: str(), value: str() }, ['key', 'value']),
+            },
+        });
     }
     else if (opts?.passiveVault) {
         // In passive mode, expose vault_search (read-only) so the model can recover
         // compacted context on demand, but don't expose vault_note (write).
-        schemas.push({ type: 'function', function: { name: 'vault_search', description: 'Search vault memory for earlier context that was compacted away. Use sparingly — only when you need to recall specific details from earlier in the conversation.', parameters: obj({ query: str(), limit: int() }, ['query']) } });
+        schemas.push({
+            type: 'function',
+            function: {
+                name: 'vault_search',
+                description: 'Search vault memory for earlier context that was compacted away. Use sparingly — only when you need to recall specific details from earlier in the conversation.',
+                parameters: obj({ query: str(), limit: int() }, ['query']),
+            },
+        });
     }
     // Phase 9: sys_context tool is only available in sys mode.
     if (opts?.sysMode) {
@@ -451,36 +509,48 @@ function buildToolsSchema(opts) {
             function: {
                 name: 'lsp_diagnostics',
                 description: 'Get LSP diagnostics (errors/warnings) for file or project.',
-                parameters: obj({ path: str(), severity: int() }, [])
-            }
+                parameters: obj({ path: str(), severity: int() }, []),
+            },
         }, {
             type: 'function',
             function: {
                 name: 'lsp_symbols',
                 description: 'List symbols (functions, classes, vars) in a file.',
-                parameters: obj({ path: str() }, ['path'])
-            }
+                parameters: obj({ path: str() }, ['path']),
+            },
         }, {
             type: 'function',
             function: {
                 name: 'lsp_hover',
                 description: 'Get type/docs for symbol at position.',
-                parameters: obj({ path: str(), line: int(), character: int() }, ['path', 'line', 'character'])
-            }
+                parameters: obj({ path: str(), line: int(), character: int() }, [
+                    'path',
+                    'line',
+                    'character',
+                ]),
+            },
         }, {
             type: 'function',
             function: {
                 name: 'lsp_definition',
                 description: 'Go to definition of symbol at position.',
-                parameters: obj({ path: str(), line: int(), character: int() }, ['path', 'line', 'character'])
-            }
+                parameters: obj({ path: str(), line: int(), character: int() }, [
+                    'path',
+                    'line',
+                    'character',
+                ]),
+            },
         }, {
             type: 'function',
             function: {
                 name: 'lsp_references',
                 description: 'Find all references to symbol at position.',
-                parameters: obj({ path: str(), line: int(), character: int(), max_results: int() }, ['path', 'line', 'character'])
-            }
+                parameters: obj({ path: str(), line: int(), character: int(), max_results: int() }, [
+                    'path',
+                    'line',
+                    'character',
+                ]),
+            },
         });
     }
     if (opts?.mcpTools?.length) {
@@ -489,7 +559,12 @@ function buildToolsSchema(opts) {
     return schemas;
 }
 function isReadOnlyTool(name) {
-    return name === 'read_file' || name === 'read_files' || name === 'list_dir' || name === 'search_files' || name === 'vault_search' || name === 'sys_context';
+    return (name === 'read_file' ||
+        name === 'read_files' ||
+        name === 'list_dir' ||
+        name === 'search_files' ||
+        name === 'vault_search' ||
+        name === 'sys_context');
 }
 /** Human-readable summary of what a blocked tool call would do. */
 function planModeSummary(name, args) {
@@ -544,20 +619,23 @@ export async function createSession(opts) {
     if (typeof cfg.response_timeout === 'number' && cfg.response_timeout > 0) {
         client.setResponseTimeout(cfg.response_timeout);
     }
-    if (typeof client.setConnectionTimeout === 'function' && typeof cfg.connection_timeout === 'number' && cfg.connection_timeout > 0) {
+    if (typeof client.setConnectionTimeout === 'function' &&
+        typeof cfg.connection_timeout === 'number' &&
+        cfg.connection_timeout > 0) {
         client.setConnectionTimeout(cfg.connection_timeout);
     }
-    if (typeof client.setInitialConnectionCheck === 'function' && typeof cfg.initial_connection_check === 'boolean') {
+    if (typeof client.setInitialConnectionCheck === 'function' &&
+        typeof cfg.initial_connection_check === 'boolean') {
         client.setInitialConnectionCheck(cfg.initial_connection_check);
     }
-    if (typeof client.setInitialConnectionProbeTimeout === 'function' && typeof cfg.initial_connection_timeout === 'number' && cfg.initial_connection_timeout > 0) {
+    if (typeof client.setInitialConnectionProbeTimeout === 'function' &&
+        typeof cfg.initial_connection_timeout === 'number' &&
+        cfg.initial_connection_timeout > 0) {
         client.setInitialConnectionProbeTimeout(cfg.initial_connection_timeout);
     }
     // Health check + model list (cheap, avoids wasting GPU on chat warmups if unreachable)
     let modelsList = normalizeModelsResponse(await client.models().catch(() => null));
-    let model = cfg.model && cfg.model.trim().length
-        ? cfg.model
-        : await autoPickModel(client, modelsList);
+    let model = cfg.model && cfg.model.trim().length ? cfg.model : await autoPickModel(client, modelsList);
     let harness = selectHarness(model, cfg.harness && cfg.harness.trim() ? cfg.harness.trim() : undefined);
     // Try to derive context window from /v1/models (if provided by server).
     const explicitContextWindow = cfg.context_window != null;
@@ -570,19 +648,22 @@ export async function createSession(opts) {
     let supportsVision = supportsVisionModel(model, modelMeta, harness);
     const sessionId = `session-${timestampedId()}`;
     const hookCfg = cfg.hooks ?? {};
-    const hookManager = opts.runtime?.hookManager ?? new HookManager({
-        enabled: hookCfg.enabled !== false,
-        strict: hookCfg.strict === true,
-        warnMs: hookCfg.warn_ms,
-        allowedCapabilities: Array.isArray(hookCfg.allow_capabilities) ? hookCfg.allow_capabilities : undefined,
-        context: () => ({
-            sessionId,
-            cwd: projectDir,
-            model,
-            harness: harness.id,
-            endpoint: cfg.endpoint,
-        }),
-    });
+    const hookManager = opts.runtime?.hookManager ??
+        new HookManager({
+            enabled: hookCfg.enabled !== false,
+            strict: hookCfg.strict === true,
+            warnMs: hookCfg.warn_ms,
+            allowedCapabilities: Array.isArray(hookCfg.allow_capabilities)
+                ? hookCfg.allow_capabilities
+                : undefined,
+            context: () => ({
+                sessionId,
+                cwd: projectDir,
+                model,
+                harness: harness.id,
+                endpoint: cfg.endpoint,
+            }),
+        });
     const emitDetached = (promise, eventName) => {
         void promise.catch((error) => {
             if (!process.env.IDLEHANDS_QUIET_WARNINGS) {
@@ -628,16 +709,33 @@ export async function createSession(opts) {
     const lensEnabled = cfg.trifecta?.enabled !== false && cfg.trifecta?.lens?.enabled !== false;
     const spawnTaskEnabled = opts.allowSpawnTask !== false && cfg.sub_agents?.enabled !== false;
     const mcpServers = Array.isArray(cfg.mcp?.servers) ? cfg.mcp.servers : [];
-    const mcpEnabledTools = Array.isArray(cfg.mcp?.enabled_tools) ? cfg.mcp?.enabled_tools : undefined;
+    const mcpEnabledTools = Array.isArray(cfg.mcp?.enabled_tools)
+        ? cfg.mcp?.enabled_tools
+        : undefined;
     const mcpToolBudget = Number.isFinite(cfg.mcp_tool_budget)
         ? Number(cfg.mcp_tool_budget)
-        : (Number.isFinite(cfg.mcp?.tool_budget) ? Number(cfg.mcp?.tool_budget) : 1000);
+        : Number.isFinite(cfg.mcp?.tool_budget)
+            ? Number(cfg.mcp?.tool_budget)
+            : 1000;
     const mcpCallTimeoutSec = Number.isFinite(cfg.mcp_call_timeout_sec)
         ? Number(cfg.mcp_call_timeout_sec)
-        : (Number.isFinite(cfg.mcp?.call_timeout_sec) ? Number(cfg.mcp?.call_timeout_sec) : 30);
+        : Number.isFinite(cfg.mcp?.call_timeout_sec)
+            ? Number(cfg.mcp?.call_timeout_sec)
+            : 30;
     const builtInToolNames = [
-        'read_file', 'read_files', 'write_file', 'apply_patch', 'edit_range', 'edit_file', 'insert_file',
-        'list_dir', 'search_files', 'exec', 'vault_search', 'vault_note', 'sys_context',
+        'read_file',
+        'read_files',
+        'write_file',
+        'apply_patch',
+        'edit_range',
+        'edit_file',
+        'insert_file',
+        'list_dir',
+        'search_files',
+        'exec',
+        'vault_search',
+        'vault_note',
+        'sys_context',
         ...(spawnTaskEnabled ? ['spawn_task'] : []),
     ];
     const mcpManager = mcpServers.length
@@ -693,9 +791,11 @@ export async function createSession(opts) {
         allowSpawnTask: spawnTaskEnabled,
     });
     const vault = vaultEnabled
-        ? (opts.runtime?.vault ?? new VaultStore({
-            immutableReviewArtifactsPerProject: cfg?.trifecta?.vault?.immutable_review_artifacts_per_project,
-        }))
+        ? (opts.runtime?.vault ??
+            new VaultStore({
+                immutableReviewArtifactsPerProject: cfg?.trifecta?.vault
+                    ?.immutable_review_artifacts_per_project,
+            }))
         : undefined;
     if (vault) {
         // Scope vault entries by project directory to prevent cross-project context leaks
@@ -764,12 +864,15 @@ export async function createSession(opts) {
         const lspServers = lspManager.listServers();
         const running = lspServers.filter((s) => s.running).length;
         sessionMeta += `\n\n[LSP] ${running} language server(s) active: ${lspServers.map((s) => `${s.language} (${s.command})`).join(', ')}.`;
-        sessionMeta += '\n[LSP] Use lsp_diagnostics, lsp_symbols, lsp_hover, lsp_definition, lsp_references tools for semantic code intelligence.';
+        sessionMeta +=
+            '\n[LSP] Use lsp_diagnostics, lsp_symbols, lsp_hover, lsp_definition, lsp_references tools for semantic code intelligence.';
         if (lensEnabled) {
-            sessionMeta += '\n[LSP+Lens] lsp_symbols combines semantic symbol data with structural Lens context when available.';
+            sessionMeta +=
+                '\n[LSP+Lens] lsp_symbols combines semantic symbol data with structural Lens context when available.';
         }
         if (lspCfg?.proactive_diagnostics !== false) {
-            sessionMeta += '\n[LSP] Proactive diagnostics enabled: errors will be reported automatically after file edits.';
+            sessionMeta +=
+                '\n[LSP] Proactive diagnostics enabled: errors will be reported automatically after file edits.';
         }
     }
     if (mcpManager) {
@@ -809,21 +912,26 @@ export async function createSession(opts) {
     if (harness.quirks.needsExplicitToolCallFormatReminder) {
         if (client.contentModeToolCalls) {
             // In content mode, tell the model to use JSON tool calls in its output
-            sessionMeta += '\n\nYou have access to the following tools. To call a tool, output a JSON block in your response like this:\n```json\n{"name": "tool_name", "arguments": {"param": "value"}}\n```\nAvailable tools:\n';
+            sessionMeta +=
+                '\n\nYou have access to the following tools. To call a tool, output a JSON block in your response like this:\n```json\n{"name": "tool_name", "arguments": {"param": "value"}}\n```\nAvailable tools:\n';
             const toolSchemas = getToolsSchema();
             for (const t of toolSchemas) {
                 const fn = t.function;
                 if (fn) {
                     const params = fn.parameters?.properties
-                        ? Object.entries(fn.parameters.properties).map(([k, v]) => `${k}: ${v.type ?? 'any'}`).join(', ')
+                        ? Object.entries(fn.parameters.properties)
+                            .map(([k, v]) => `${k}: ${v.type ?? 'any'}`)
+                            .join(', ')
                         : '';
                     sessionMeta += `- ${fn.name}(${params}): ${fn.description ?? ''}\n`;
                 }
             }
-            sessionMeta += '\nIMPORTANT: Output tool calls as JSON blocks in your message. Do NOT use the tool_calls API mechanism.\nIf you use XML/function tags (e.g. <function=name>), include a full JSON object of arguments between braces.';
+            sessionMeta +=
+                '\nIMPORTANT: Output tool calls as JSON blocks in your message. Do NOT use the tool_calls API mechanism.\nIf you use XML/function tags (e.g. <function=name>), include a full JSON object of arguments between braces.';
         }
         else {
-            sessionMeta += '\n\nIMPORTANT: Use the tool_calls mechanism to invoke tools. Do NOT write JSON tool invocations in your message text.';
+            sessionMeta +=
+                '\n\nIMPORTANT: Use the tool_calls mechanism to invoke tools. Do NOT write JSON tool invocations in your message text.';
         }
         // One-time tool-call template smoke test (first ask() call only, skip in content mode)
         if (!client.contentModeToolCalls && !client.__toolCallSmokeTested) {
@@ -859,9 +967,7 @@ export async function createSession(opts) {
         }
         return p;
     };
-    let messages = [
-        { role: 'system', content: buildEffectiveSystemPrompt() }
-    ];
+    let messages = [{ role: 'system', content: buildEffectiveSystemPrompt() }];
     let sessionMetaPending = sessionMeta;
     const setSystemPrompt = (prompt) => {
         const next = String(prompt ?? '').trim();
@@ -883,9 +989,7 @@ export async function createSession(opts) {
     };
     const reset = () => {
         const effective = buildEffectiveSystemPrompt();
-        messages = [
-            { role: 'system', content: effective }
-        ];
+        messages = [{ role: 'system', content: effective }];
         sessionMetaPending = sessionMeta;
         lastEditedPath = undefined;
         initialConnectionProbeDone = false;
@@ -962,7 +1066,9 @@ export async function createSession(opts) {
         }
         // Prevent using delegation to bypass package-install confirmation restrictions.
         const taskSafety = checkExecSafety(task);
-        if (!cfg.no_confirm && taskSafety.tier === 'cautious' && taskSafety.reason === 'package install/remove') {
+        if (!cfg.no_confirm &&
+            taskSafety.tier === 'cautious' &&
+            taskSafety.reason === 'package install/remove') {
             throw new Error('spawn_task: blocked — package install/remove is restricted in the current approval mode. ' +
                 'Do not delegate this to bypass confirmation requirements; ask the user to run with --no-confirm/--yolo instead.');
         }
@@ -971,39 +1077,43 @@ export async function createSession(opts) {
         const emitStatus = options?.emitStatus ?? (() => { });
         const maxIterations = Number.isFinite(args?.max_iterations)
             ? Math.max(1, Math.floor(Number(args.max_iterations)))
-            : (Number.isFinite(defaults.max_iterations)
+            : Number.isFinite(defaults.max_iterations)
                 ? Math.max(1, Math.floor(Number(defaults.max_iterations)))
-                : 50);
+                : 50;
         const timeoutSec = Number.isFinite(args?.timeout_sec)
             ? Math.max(1, Math.floor(Number(args.timeout_sec)))
-            : (Number.isFinite(defaults.timeout_sec)
+            : Number.isFinite(defaults.timeout_sec)
                 ? Math.max(1, Math.floor(Number(defaults.timeout_sec)))
-                : Math.max(60, cfg.timeout));
+                : Math.max(60, cfg.timeout);
         const subMaxTokens = Number.isFinite(args?.max_tokens)
             ? Math.max(128, Math.floor(Number(args.max_tokens)))
-            : (Number.isFinite(defaults.max_tokens)
+            : Number.isFinite(defaults.max_tokens)
                 ? Math.max(128, Math.floor(Number(defaults.max_tokens)))
-                : maxTokens);
+                : maxTokens;
         const resultTokenCap = Number.isFinite(defaults.result_token_cap)
             ? Math.max(256, Math.floor(Number(defaults.result_token_cap)))
             : DEFAULT_SUB_AGENT_RESULT_TOKEN_CAP;
         const parentApproval = cfg.approval_mode ?? 'default';
-        const rawApproval = normalizeApprovalMode(args?.approval_mode)
-            ?? normalizeApprovalMode(defaults.approval_mode)
-            ?? parentApproval;
+        const rawApproval = normalizeApprovalMode(args?.approval_mode) ??
+            normalizeApprovalMode(defaults.approval_mode) ??
+            parentApproval;
         // Sub-agents cannot escalate beyond the parent's approval mode.
         const approvalMode = capApprovalMode(rawApproval, parentApproval);
         const requestedModel = typeof args?.model === 'string' && args.model.trim()
             ? args.model.trim()
-            : (typeof defaults.model === 'string' && defaults.model.trim() ? defaults.model.trim() : model);
+            : typeof defaults.model === 'string' && defaults.model.trim()
+                ? defaults.model.trim()
+                : model;
         const requestedEndpoint = typeof args?.endpoint === 'string' && args.endpoint.trim()
             ? args.endpoint.trim()
-            : (typeof defaults.endpoint === 'string' && defaults.endpoint.trim() ? defaults.endpoint.trim() : cfg.endpoint);
+            : typeof defaults.endpoint === 'string' && defaults.endpoint.trim()
+                ? defaults.endpoint.trim()
+                : cfg.endpoint;
         const requestedSystemPrompt = typeof args?.system_prompt === 'string' && args.system_prompt.trim()
             ? args.system_prompt.trim()
-            : (typeof defaults.system_prompt === 'string' && defaults.system_prompt.trim()
+            : typeof defaults.system_prompt === 'string' && defaults.system_prompt.trim()
                 ? defaults.system_prompt.trim()
-                : DEFAULT_SUB_AGENT_SYSTEM_PROMPT);
+                : DEFAULT_SUB_AGENT_SYSTEM_PROMPT;
         const cwd = projectDir;
         const ctxFiles = await buildSubAgentContextBlock(cwd, args?.context_files);
         let delegatedInstruction = task;
@@ -1108,7 +1218,9 @@ export async function createSession(opts) {
                 `turns: ${subTurns}`,
                 `tool_calls: ${subToolCalls}`,
                 `files_changed: ${filesChanged.length ? filesChanged.join(', ') : 'none'}`,
-                capped.truncated ? `[sub-agent] summarized result capped to ~${resultTokenCap} tokens` : `[sub-agent] summarized result within cap`,
+                capped.truncated
+                    ? `[sub-agent] summarized result capped to ~${resultTokenCap} tokens`
+                    : `[sub-agent] summarized result within cap`,
                 `result:\n${capped.text}`,
             ].join('\n');
         });
@@ -1117,7 +1229,10 @@ export async function createSession(opts) {
     const buildToolCtx = (overrides) => {
         const defaultConfirmBridge = opts.confirmProvider
             ? async (prompt) => opts.confirmProvider.confirm({
-                tool: '', args: {}, summary: prompt, mode: cfg.approval_mode,
+                tool: '',
+                args: {},
+                summary: prompt,
+                mode: cfg.approval_mode,
             })
             : opts.confirm;
         return {
@@ -1136,7 +1251,10 @@ export async function createSession(opts) {
             vault,
             lens,
             signal: overrides?.signal ?? inFlight?.signal,
-            onMutation: overrides?.onMutation ?? ((absPath) => { lastEditedPath = absPath; }),
+            onMutation: overrides?.onMutation ??
+                ((absPath) => {
+                    lastEditedPath = absPath;
+                }),
         };
     };
     const buildLspLensSymbolOutput = async (filePathRaw) => {
@@ -1178,8 +1296,8 @@ export async function createSession(opts) {
         if (!planSteps.length)
             return ['No plan steps to execute.'];
         const toExec = index != null
-            ? planSteps.filter(s => s.index === index && s.blocked && !s.executed)
-            : planSteps.filter(s => s.blocked && !s.executed);
+            ? planSteps.filter((s) => s.index === index && s.blocked && !s.executed)
+            : planSteps.filter((s) => s.blocked && !s.executed);
         if (!toExec.length)
             return ['No pending blocked steps to execute.'];
         const ctx = buildToolCtx();
@@ -1271,9 +1389,7 @@ export async function createSession(opts) {
                 const toolCalls = m.tool_calls;
                 if (toolCalls?.length) {
                     for (const tc of toolCalls) {
-                        const args = typeof tc.function?.arguments === 'string'
-                            ? tc.function.arguments.slice(0, 200)
-                            : '';
+                        const args = typeof tc.function?.arguments === 'string' ? tc.function.arguments.slice(0, 200) : '';
                         parts.push(`[tool_call: ${tc.function?.name}(${args})]`);
                     }
                 }
@@ -1325,16 +1441,16 @@ export async function createSession(opts) {
         const hits = await vault.search(query, 4);
         if (!hits.length)
             return;
-        const lines = hits.map((r) => `${r.updatedAt} ${r.kind} ${r.key ?? r.tool ?? r.id} ${String(r.value ?? r.snippet ?? '').replace(/\s+/g, ' ').slice(0, 180)}`);
+        const lines = hits.map((r) => `${r.updatedAt} ${r.kind} ${r.key ?? r.tool ?? r.id} ${String(r.value ?? r.snippet ?? '')
+            .replace(/\s+/g, ' ')
+            .slice(0, 180)}`);
         if (!lines.length)
             return;
         lastVaultInjectionQuery = query;
-        const vaultContextHeader = vaultMode === 'passive'
-            ? '[Trifecta Vault (passive)]'
-            : '[Vault context after compaction]';
+        const vaultContextHeader = vaultMode === 'passive' ? '[Trifecta Vault (passive)]' : '[Vault context after compaction]';
         messages.push({
             role: 'user',
-            content: `${vaultContextHeader} Relevant entries for "${query}":\n${lines.join('\n')}`
+            content: `${vaultContextHeader} Relevant entries for "${query}":\n${lines.join('\n')}`,
         });
     };
     let compactionLockTail = Promise.resolve();
@@ -1402,9 +1518,11 @@ export async function createSession(opts) {
         }
     };
     const compactHistory = async (opts) => {
-        const reason = opts?.reason
-            ?? (opts?.hard ? 'manual hard compaction'
-                : opts?.force ? 'manual force compaction'
+        const reason = opts?.reason ??
+            (opts?.hard
+                ? 'manual hard compaction'
+                : opts?.force
+                    ? 'manual force compaction'
                     : 'manual compaction');
         return await runCompactionWithLock(reason, async () => {
             const beforeMessages = messages.length;
@@ -1430,8 +1548,12 @@ export async function createSession(opts) {
             let dropped = messages.filter((m) => !compactedByRefs.has(m));
             if (opts?.topic) {
                 const topic = opts.topic.toLowerCase();
-                dropped = dropped.filter((m) => !userContentToText(m.content ?? '').toLowerCase().includes(topic));
-                const keepFromTopic = messages.filter((m) => userContentToText(m.content ?? '').toLowerCase().includes(topic));
+                dropped = dropped.filter((m) => !userContentToText(m.content ?? '')
+                    .toLowerCase()
+                    .includes(topic));
+                const keepFromTopic = messages.filter((m) => userContentToText(m.content ?? '')
+                    .toLowerCase()
+                    .includes(topic));
                 compacted = [...compacted, ...keepFromTopic.filter((m) => !compactedByRefs.has(m))];
             }
             const archivedToolMessages = dropped.filter((m) => m.role === 'tool').length;
@@ -1447,7 +1569,10 @@ export async function createSession(opts) {
                             const m = messages[i];
                             if (m.role === 'user') {
                                 const text = userContentToText((m.content ?? '')).trim();
-                                if (text && !text.startsWith('[Trifecta Vault') && !text.startsWith('[Vault context') && text.length > 20) {
+                                if (text &&
+                                    !text.startsWith('[Trifecta Vault') &&
+                                    !text.startsWith('[Vault context') &&
+                                    text.length > 20) {
                                     userPromptToPreserve = text;
                                     break;
                                 }
@@ -1467,7 +1592,10 @@ export async function createSession(opts) {
                 // Update current context token count after compaction
                 currentContextTokens = estimateTokensFromMessages(compacted);
                 if (dropped.length) {
-                    messages.push({ role: 'system', content: buildCompactionSystemNote('manual', dropped.length) });
+                    messages.push({
+                        role: 'system',
+                        content: buildCompactionSystemNote('manual', dropped.length),
+                    });
                     await injectVaultContext().catch(() => { });
                     if (opts?.reason || opts?.force) {
                         injectCompactionReminder(opts?.reason ?? 'history compaction');
@@ -1495,7 +1623,10 @@ export async function createSession(opts) {
     let lastTurnMetrics;
     let lastServerHealth;
     let lastToolLoopStats = {
-        totalHistory: 0, signatures: [], outcomes: [], telemetry: {
+        totalHistory: 0,
+        signatures: [],
+        outcomes: [],
+        telemetry: {
             callsRegistered: 0,
             dedupedReplays: 0,
             readCacheLookups: 0,
@@ -1505,7 +1636,7 @@ export async function createSession(opts) {
             recoveryRecommended: 0,
             readCacheHitRate: 0,
             dedupeRate: 0,
-        }
+        },
     };
     let lastModelsProbeMs = 0;
     const capturesDir = path.join(stateDir(), 'captures');
@@ -1667,7 +1798,8 @@ export async function createSession(opts) {
         modelsList = normalizeModelsResponse(await client.models());
         const chosen = modelName?.trim()
             ? modelName.trim()
-            : (modelsList.data.find((m) => m.id === model)?.id ?? await autoPickModel(client, modelsList));
+            : (modelsList.data.find((m) => m.id === model)?.id ??
+                (await autoPickModel(client, modelsList)));
         setModel(chosen);
     };
     const captureOn = async (filePath) => {
@@ -1685,9 +1817,7 @@ export async function createSession(opts) {
         if (!lastCaptureRecord) {
             throw new Error('No captured request/response pair is available yet.');
         }
-        const target = filePath?.trim()
-            ? path.resolve(filePath)
-            : (capturePath || defaultCapturePath());
+        const target = filePath?.trim() ? path.resolve(filePath) : capturePath || defaultCapturePath();
         await appendCaptureRecord(lastCaptureRecord, target);
         return target;
     };
@@ -1741,7 +1871,7 @@ export async function createSession(opts) {
             const idx = Math.max(0, Math.min(sorted.length - 1, Math.floor((sorted.length - 1) * q)));
             return sorted[idx];
         };
-        const avg = (arr) => (arr.length ? arr.reduce((a, b) => a + b, 0) / arr.length : undefined);
+        const avg = (arr) => arr.length ? arr.reduce((a, b) => a + b, 0) / arr.length : undefined;
         return {
             turns: turnDurationsMs.length,
             totalTokens,
@@ -1810,7 +1940,7 @@ export async function createSession(opts) {
         setModel(nextModel);
         messages.push({
             role: 'system',
-            content: '[system] Model changed mid-session. Previous context may not transfer perfectly.'
+            content: '[system] Model changed mid-session. Previous context may not transfer perfectly.',
         });
         console.warn(`[model] Server model changed: ${previousModel} → ${nextModel} - switching harness to ${harness.id}`);
     };
@@ -1835,7 +1965,7 @@ export async function createSession(opts) {
             sessionMetaPending = null;
         }
         messages.push({ role: 'user', content: userContent });
-        const hookObj = typeof hooks === 'function' ? { onToken: hooks } : hooks ?? {};
+        const hookObj = typeof hooks === 'function' ? { onToken: hooks } : (hooks ?? {});
         let turns = 0;
         let toolCalls = 0;
         const askId = `ask-${timestampedId()}`;
@@ -1858,7 +1988,9 @@ export async function createSession(opts) {
             }
         };
         const isReadOnlyToolDynamic = (toolName) => {
-            return isReadOnlyTool(toolName) || LSP_TOOL_NAME_SET.has(toolName) || Boolean(mcpManager?.isToolReadOnly(toolName));
+            return (isReadOnlyTool(toolName) ||
+                LSP_TOOL_NAME_SET.has(toolName) ||
+                Boolean(mcpManager?.isToolReadOnly(toolName)));
         };
         const emitToolResult = async (result) => {
             await hookObj.onToolResult?.(result);
@@ -1886,16 +2018,15 @@ export async function createSession(opts) {
                         // Cap action list to prevent vault bloat on long sessions
                         const MAX_SUMMARY_ACTIONS = 30;
                         const cappedActions = actions.length > MAX_SUMMARY_ACTIONS
-                            ? [...actions.slice(0, MAX_SUMMARY_ACTIONS), `... and ${actions.length - MAX_SUMMARY_ACTIONS} more`]
+                            ? [
+                                ...actions.slice(0, MAX_SUMMARY_ACTIONS),
+                                `... and ${actions.length - MAX_SUMMARY_ACTIONS} more`,
+                            ]
                             : actions;
                         const userPrompt = lastAskInstructionText || '(unknown)';
-                        const userPromptSnippet = userPrompt.length > 120
-                            ? userPrompt.slice(0, 120) + '…'
-                            : userPrompt;
-                        const resultSnippet = finalText.length > 200
-                            ? finalText.slice(0, 200) + '…'
-                            : finalText;
-                        const summary = `User asked: ${userPromptSnippet}\nActions (${actions.length} tool calls, ${turns} turns):\n${cappedActions.map(a => `- ${a}`).join('\n')}\nResult: ${resultSnippet}`;
+                        const userPromptSnippet = userPrompt.length > 120 ? userPrompt.slice(0, 120) + '…' : userPrompt;
+                        const resultSnippet = finalText.length > 200 ? finalText.slice(0, 200) + '…' : finalText;
+                        const summary = `User asked: ${userPromptSnippet}\nActions (${actions.length} tool calls, ${turns} turns):\n${cappedActions.map((a) => `- ${a}`).join('\n')}\nResult: ${resultSnippet}`;
                         await vault.upsertNote(`turn_summary_${askId}`, summary, 'system');
                     }
                 }
@@ -1913,7 +2044,9 @@ export async function createSession(opts) {
         const reviewKeys = reviewArtifactKeys(projectDir);
         const retrievalRequested = looksLikeReviewRetrievalRequest(rawInstructionText);
         const shouldPersistReviewArtifact = looksLikeCodeReviewRequest(rawInstructionText) && !retrievalRequested;
-        if (!retrievalRequested && cfg.initial_connection_check !== false && !initialConnectionProbeDone) {
+        if (!retrievalRequested &&
+            cfg.initial_connection_check !== false &&
+            !initialConnectionProbeDone) {
             if (typeof client.probeConnection === 'function') {
                 await client.probeConnection();
                 initialConnectionProbeDone = true;
@@ -1924,9 +2057,7 @@ export async function createSession(opts) {
                 ? await vault.getLatestByKey(reviewKeys.latestKey, 'system').catch(() => null)
                 : null;
             const parsedArtifact = latest?.value ? parseReviewArtifact(latest.value) : null;
-            const artifact = parsedArtifact && parsedArtifact.projectId === reviewKeys.projectId
-                ? parsedArtifact
-                : null;
+            const artifact = parsedArtifact && parsedArtifact.projectId === reviewKeys.projectId ? parsedArtifact : null;
             if (artifact?.content?.trim()) {
                 const stale = reviewArtifactStaleReason(artifact, projectDir);
                 const stalePolicy = parseReviewArtifactStalePolicy(cfg?.trifecta?.vault?.stale_policy);
@@ -1943,9 +2074,7 @@ export async function createSession(opts) {
                     });
                     return await finalizeAsk(blocked);
                 }
-                const text = stale
-                    ? `${artifact.content}\n\n[artifact note] ${stale}`
-                    : artifact.content;
+                const text = stale ? `${artifact.content}\n\n[artifact note] ${stale}` : artifact.content;
                 messages.push({ role: 'assistant', content: text });
                 hookObj.onToken?.(text);
                 await emitTurnEnd({
@@ -2046,7 +2175,7 @@ export async function createSession(opts) {
         // pressure can replay the cached result instead of re-executing.
         const lastExecResultBySig = new Map();
         // Cache successful read_file/read_files/list_dir results by signature + mtime for invalidation.
-        const readFileCacheBySig = new Map();
+        const _readFileCacheBySig = new Map();
         const READ_FILE_CACHE_TOOLS = new Set(['read_file', 'read_files', 'list_dir']);
         const toolLoopGuard = new ToolLoopGuard({
             enabled: cfg.tool_loop_detection?.enabled,
@@ -2079,6 +2208,8 @@ export async function createSession(opts) {
         let toollessRecoveryUsed = false;
         // Prevent repeating the same "stop rerunning" reminder every turn.
         const readOnlyExecHintedSigs = new Set();
+        // Tool loop recovery: poisoned results and selective tool suppression.
+        const suppressedTools = new Set();
         // Keep a lightweight breadcrumb for diagnostics on partial failures.
         let lastSuccessfulTestRun = null;
         // One-time nudge to prevent post-success churn after green test runs.
@@ -2106,7 +2237,11 @@ export async function createSession(opts) {
         const compactToolMessageForHistory = async (toolCallId, rawContent) => {
             const toolName = toolNameByCallId.get(toolCallId) ?? 'tool';
             const toolArgs = toolArgsByCallId.get(toolCallId) ?? {};
-            const rawMsg = { role: 'tool', tool_call_id: toolCallId, content: rawContent };
+            const rawMsg = {
+                role: 'tool',
+                tool_call_id: toolCallId,
+                content: rawContent,
+            };
             // Persist full-fidelity output immediately so live context can stay small.
             if (vault && typeof vault.archiveToolResult === 'function') {
                 try {
@@ -2120,7 +2255,9 @@ export async function createSession(opts) {
             if (lens) {
                 try {
                     const lensCompact = await lens.summarizeToolOutput(rawContent, toolName, typeof toolArgs.path === 'string' ? String(toolArgs.path) : undefined);
-                    if (typeof lensCompact === 'string' && lensCompact.length && lensCompact.length < compact.length) {
+                    if (typeof lensCompact === 'string' &&
+                        lensCompact.length &&
+                        lensCompact.length < compact.length) {
                         compact = lensCompact;
                     }
                 }
@@ -2205,7 +2342,10 @@ export async function createSession(opts) {
                                 if (m.role === 'user') {
                                     const text = userContentToText((m.content ?? '')).trim();
                                     // Skip vault injection messages and short prompts
-                                    if (text && !text.startsWith('[Trifecta Vault') && !text.startsWith('[Vault context') && text.length > 20) {
+                                    if (text &&
+                                        !text.startsWith('[Trifecta Vault') &&
+                                        !text.startsWith('[Vault context') &&
+                                        text.length > 20) {
                                         userPromptToPreserve = text;
                                         break;
                                     }
@@ -2234,7 +2374,10 @@ export async function createSession(opts) {
                                 const resp = await client.chat({
                                     model,
                                     messages: [
-                                        { role: 'system', content: 'Summarize this agent session progress concisely. List: files read, key findings, decisions made, current approach. Be terse.' },
+                                        {
+                                            role: 'system',
+                                            content: 'Summarize this agent session progress concisely. List: files read, key findings, decisions made, current approach. Be terse.',
+                                        },
                                         { role: 'user', content: summaryContent },
                                     ],
                                     max_tokens: summaryMaxTokens,
@@ -2250,15 +2393,24 @@ export async function createSession(opts) {
                                     });
                                 }
                                 else {
-                                    messages.push({ role: 'system', content: buildCompactionSystemNote('auto', dropped.length) });
+                                    messages.push({
+                                        role: 'system',
+                                        content: buildCompactionSystemNote('auto', dropped.length),
+                                    });
                                 }
                             }
                             catch {
-                                messages.push({ role: 'system', content: buildCompactionSystemNote('auto', dropped.length) });
+                                messages.push({
+                                    role: 'system',
+                                    content: buildCompactionSystemNote('auto', dropped.length),
+                                });
                             }
                         }
                         else {
-                            messages.push({ role: 'system', content: buildCompactionSystemNote('auto', dropped.length) });
+                            messages.push({
+                                role: 'system',
+                                content: buildCompactionSystemNote('auto', dropped.length),
+                            });
                         }
                     }
                     // Update token count AFTER injections so downstream reads are accurate
@@ -2268,9 +2420,15 @@ export async function createSession(opts) {
                     // Emit compaction event for callers (e.g. Anton controller → Discord)
                     if (dropped.length) {
                         try {
-                            await hookObj.onCompaction?.({ droppedMessages: dropped.length, freedTokens, summaryUsed });
+                            await hookObj.onCompaction?.({
+                                droppedMessages: dropped.length,
+                                freedTokens,
+                                summaryUsed,
+                            });
+                        }
+                        catch {
+                            /* best effort */
                         }
-                        catch { /* best effort */ }
                         console.error(`[compaction] auto: dropped=${dropped.length} msgs, freed=~${freedTokens} tokens, summary=${summaryUsed}, remaining=${messages.length} msgs (~${currentContextTokens} tokens)`);
                     }
                     return {
@@ -2306,8 +2464,10 @@ export async function createSession(opts) {
                 let resp;
                 try {
                     try {
-                        const toolsForTurn = (cfg.no_tools || forceToollessRecoveryTurn) ? [] : getToolsSchema();
-                        const toolChoiceForTurn = (cfg.no_tools || forceToollessRecoveryTurn) ? 'none' : 'auto';
+                        const toolsForTurn = (cfg.no_tools || forceToollessRecoveryTurn)
+                            ? []
+                            : getToolsSchema().filter(t => !suppressedTools.has(t.function.name));
+                        const toolChoiceForTurn = cfg.no_tools || forceToollessRecoveryTurn ? 'none' : 'auto';
                         resp = await client.chatStream({
                             model,
                             messages,
@@ -2326,7 +2486,8 @@ export async function createSession(opts) {
                         overflowCompactionAttempts = 0;
                     }
                     catch (e) {
-                        if (isContextWindowExceededError(e) && overflowCompactionAttempts < MAX_OVERFLOW_COMPACTION_ATTEMPTS) {
+                        if (isContextWindowExceededError(e) &&
+                            overflowCompactionAttempts < MAX_OVERFLOW_COMPACTION_ATTEMPTS) {
                             overflowCompactionAttempts++;
                             const useHardCompaction = overflowCompactionAttempts > 1;
                             const compacted = await compactHistory({
@@ -2364,9 +2525,7 @@ export async function createSession(opts) {
                     ? promptTokensTurn / (ttftMs / 1000)
                     : undefined;
                 const genWindowMs = Math.max(1, ttcMs - (ttftMs ?? 0));
-                const tgTps = completionTokensTurn > 0
-                    ? completionTokensTurn / (genWindowMs / 1000)
-                    : undefined;
+                const tgTps = completionTokensTurn > 0 ? completionTokensTurn / (genWindowMs / 1000) : undefined;
                 if (ttcMs > 0)
                     turnDurationsMs.push(ttcMs);
                 if (ttftMs != null && ttftMs > 0)
@@ -2413,7 +2572,9 @@ export async function createSession(opts) {
                 // Conditionally strip thinking blocks based on harness config (§4i).
                 // Non-reasoning models (thinking.strip === false) never emit <think> blocks,
                 // so stripping is a no-op — but we skip the regex work entirely.
-                const st = harness.thinking.strip ? stripThinking(content) : { visible: content, thinking: '' };
+                const st = harness.thinking.strip
+                    ? stripThinking(content)
+                    : { visible: content, thinking: '' };
                 // Strip XML tool-call tag fragments that leak into visible narration
                 // when llama-server partially parses Qwen/Hermes XML tool calls.
                 const visible = st.visible
@@ -2431,7 +2592,9 @@ export async function createSession(opts) {
                 // For models with unreliable tool_calls arrays, validate entries and
                 // fall through to content parsing if they look malformed (§4i).
                 if (toolCallsArr?.length && !harness.toolCalls.reliableToolCallsArray) {
-                    const hasValid = toolCallsArr.some(tc => tc.function?.name && typeof tc.function.name === 'string' && tc.function.name.length > 0);
+                    const hasValid = toolCallsArr.some((tc) => tc.function?.name &&
+                        typeof tc.function.name === 'string' &&
+                        tc.function.name.length > 0);
                     if (!hasValid) {
                         if (cfg.verbose) {
                             console.warn(`[harness] tool_calls array present but no valid entries (reliableToolCallsArray=false), trying content fallback`);
@@ -2519,7 +2682,7 @@ export async function createSession(opts) {
                         const deduped = [];
                         for (const [, group] of byName) {
                             if (group.length > 1) {
-                                const maxArgs = Math.max(...group.map(g => g.argCount));
+                                const maxArgs = Math.max(...group.map((g) => g.argCount));
                                 // Drop entries with strictly fewer args than the richest (ghost duplicates).
                                 // Keep ALL entries that have the max arg count (genuine parallel calls).
                                 for (const g of group) {
@@ -2552,15 +2715,22 @@ export async function createSession(opts) {
                     const compactAssistantToolCallText = assistantToolCallText.length > 900
                         ? `${assistantToolCallText.slice(0, 900)}\n[history-compacted: assistant narration truncated before tool execution]`
                         : assistantToolCallText;
-                    messages.push({ role: 'assistant', content: compactAssistantToolCallText, tool_calls: originalToolCallsArr });
+                    messages.push({
+                        role: 'assistant',
+                        content: compactAssistantToolCallText,
+                        tool_calls: originalToolCallsArr,
+                    });
                     // sigCounts is scoped to the entire ask() run (see above)
                     // Bridge ConfirmationProvider → legacy confirm callback for tools.
                     // If a ConfirmationProvider is given, wrap it; otherwise fall back to raw callback.
                     // The bridge accepts an optional context object for rich confirm data.
                     const confirmBridge = opts.confirmProvider
                         ? async (prompt, bridgeCtx) => opts.confirmProvider.confirm({
-                            tool: bridgeCtx?.tool ?? '', args: bridgeCtx?.args ?? {}, summary: prompt,
-                            diff: bridgeCtx?.diff, mode: cfg.approval_mode,
+                            tool: bridgeCtx?.tool ?? '',
+                            args: bridgeCtx?.args ?? {},
+                            summary: prompt,
+                            diff: bridgeCtx?.diff,
+                            mode: cfg.approval_mode,
                         })
                         : opts.confirm;
                     const ctx = buildToolCtx({
@@ -2569,6 +2739,7 @@ export async function createSession(opts) {
                         onMutation: (absPath) => {
                             lastEditedPath = absPath;
                             mutationVersion++;
+                            suppressedTools.clear(); // file changed, re-enable all tools
                         },
                     });
                     // Tool-call argument parsing and validation logic
@@ -2611,6 +2782,8 @@ export async function createSession(opts) {
                     const replayExecSigs = new Set();
                     // Repeated read_file/read_files/list_dir calls can be served from cache.
                     const repeatedReadFileSigs = new Set();
+                    // Poisoned tool sigs: at consec >= 3, don't execute — return error instead.
+                    const poisonedToolSigs = new Set();
                     let shouldForceToollessRecovery = false;
                     const criticalLoopSigs = new Set();
                     for (const tc of toolCallsArr) {
@@ -2689,9 +2862,10 @@ export async function createSession(opts) {
                                 }
                                 if (count >= loopThreshold) {
                                     const sigArgs = sigMetaBySig.get(sig)?.args ?? {};
-                                    const command = typeof sigArgs?.command === 'string' ? String(sigArgs.command) : '';
-                                    const canReuseReadOnlyObservation = looksLikeReadOnlyExecCommand(command) &&
-                                        execObservationCacheBySig.has(sig);
+                                    const command = typeof sigArgs?.command === 'string'
+                                        ? String(sigArgs.command)
+                                        : '';
+                                    const canReuseReadOnlyObservation = looksLikeReadOnlyExecCommand(command) && execObservationCacheBySig.has(sig);
                                     if (canReuseReadOnlyObservation) {
                                         repeatedReadOnlyExecSigs.add(sig);
                                         if (!readOnlyExecHintedSigs.has(sig)) {
@@ -2701,7 +2875,9 @@ export async function createSession(opts) {
                                         continue;
                                     }
                                     const argsPreviewRaw = JSON.stringify(sigArgs);
-                                    const argsPreview = argsPreviewRaw.length > 220 ? argsPreviewRaw.slice(0, 220) + '…' : argsPreviewRaw;
+                                    const argsPreview = argsPreviewRaw.length > 220
+                                        ? argsPreviewRaw.slice(0, 220) + '…'
+                                        : argsPreviewRaw;
                                     throw new Error(`tool ${toolName}: identical call repeated ${loopThreshold}x across turns; breaking loop. ` +
                                         `args=${argsPreview}`);
                                 }
@@ -2743,21 +2919,17 @@ export async function createSession(opts) {
                                     }
                                 }
                             }
-                            // At 2x, serve from cache if available AND inject final warning
-                            if (consec >= 2 && isReadFileTool) {
-                                if (consec === 4) {
-                                    let resourceType = 'resource';
-                                    if (toolName === 'read_file')
-                                        resourceType = 'file';
-                                    else if (toolName === 'read_files')
-                                        resourceType = 'files';
-                                    else if (toolName === 'list_dir')
-                                        resourceType = 'directory';
-                                    messages.push({
-                                        role: 'system',
-                                        content: `CRITICAL: ${resourceType} unchanged. Move on NOW.`,
-                                    });
+                            // At consec >= 3: poison the result (don't execute, return error).
+                            // At consec >= 4: also suppress the tool from the schema entirely.
+                            if (consec >= 3) {
+                                poisonedToolSigs.add(sig);
+                                if (consec >= 4) {
+                                    suppressedTools.add(toolName);
                                 }
+                                continue;
+                            }
+                            // At 2x, serve from cache if available
+                            if (consec >= 2 && isReadFileTool) {
                                 const argsForSig = sigMetaBySig.get(sig)?.args ?? {};
                                 const replay = await toolLoopGuard.getReadCacheReplay(toolName, argsForSig, ctx.cwd);
                                 if (replay) {
@@ -2836,7 +3008,9 @@ export async function createSession(opts) {
                             throw new ToolError('invalid_args', `tool ${name}: arguments not valid JSON`, false, 'Return a valid JSON object for function.arguments.', { raw: rawArgs.slice(0, 200) });
                         }
                         if (args == null || typeof args !== 'object' || Array.isArray(args)) {
-                            throw new ValidationError([{ field: 'arguments', message: 'must be a JSON object', value: args }]);
+                            throw new ValidationError([
+                                { field: 'arguments', message: 'must be a JSON object', value: args },
+                            ]);
                         }
                         const builtInFn = tools[name];
                         const isLspTool = LSP_TOOL_NAME_SET.has(name);
@@ -2854,7 +3028,11 @@ export async function createSession(opts) {
                         if (builtInFn || isSpawnTask) {
                             const missing = getMissingRequiredParams(name, args);
                             if (missing.length) {
-                                throw new ValidationError(missing.map((m) => ({ field: m, message: 'required parameter is missing', value: undefined })));
+                                throw new ValidationError(missing.map((m) => ({
+                                    field: m,
+                                    message: 'required parameter is missing',
+                                    value: undefined,
+                                })));
                             }
                             const argIssues = getArgValidationIssues(name, args);
                             if (argIssues.length) {
@@ -2873,7 +3051,9 @@ export async function createSession(opts) {
                             }
                         }
                         if (FILE_MUTATION_TOOL_SET.has(name) && typeof args.path === 'string') {
-                            const absPath = args.path.startsWith('/') ? args.path : path.resolve(projectDir, args.path);
+                            const absPath = args.path.startsWith('/')
+                                ? args.path
+                                : path.resolve(projectDir, args.path);
                             // ── Pre-dispatch: block edits to files in a mutation spiral ──
                             if (fileMutationBlocked.has(absPath)) {
                                 const basename = path.basename(absPath);
@@ -2895,12 +3075,23 @@ export async function createSession(opts) {
                             // Fix 1: Hard cumulative budget — refuse reads past hard cap
                             if (cumulativeReadOnlyCalls > READ_BUDGET_HARD) {
                                 await emitToolCall({ id: callId, name, args });
-                                await emitToolResult({ id: callId, name, success: false, summary: 'read budget exhausted', result: '' });
-                                return { id: callId, content: `STOP: Read budget exhausted (${cumulativeReadOnlyCalls}/${READ_BUDGET_HARD} calls). Do NOT read more files. Use search_files or exec: grep -rn "pattern" path/ to find what you need.` };
+                                await emitToolResult({
+                                    id: callId,
+                                    name,
+                                    success: false,
+                                    summary: 'read budget exhausted',
+                                    result: '',
+                                });
+                                return {
+                                    id: callId,
+                                    content: `STOP: Read budget exhausted (${cumulativeReadOnlyCalls}/${READ_BUDGET_HARD} calls). Do NOT read more files. Use search_files or exec: grep -rn "pattern" path/ to find what you need.`,
+                                };
                             }
                             // Fix 2: Directory scan detection — counts unique files per dir (re-reads are OK)
                             if (filePath) {
-                                const absFilePath = filePath.startsWith('/') ? filePath : path.resolve(projectDir, filePath);
+                                const absFilePath = filePath.startsWith('/')
+                                    ? filePath
+                                    : path.resolve(projectDir, filePath);
                                 const parentDir = path.dirname(absFilePath);
                                 if (!readDirFiles.has(parentDir))
                                     readDirFiles.set(parentDir, new Set());
@@ -2911,8 +3102,17 @@ export async function createSession(opts) {
                                 }
                                 if (blockedDirs.has(parentDir) && uniqueCount > 8) {
                                     await emitToolCall({ id: callId, name, args });
-                                    await emitToolResult({ id: callId, name, success: false, summary: 'dir scan blocked', result: '' });
-                                    return { id: callId, content: `STOP: Directory scan detected — you've read ${uniqueCount} unique files from ${parentDir}/. Use search_files(pattern, '${parentDir}') or exec: grep -rn "pattern" ${parentDir}/ instead of reading files individually.` };
+                                    await emitToolResult({
+                                        id: callId,
+                                        name,
+                                        success: false,
+                                        summary: 'dir scan blocked',
+                                        result: '',
+                                    });
+                                    return {
+                                        id: callId,
+                                        content: `STOP: Directory scan detected — you've read ${uniqueCount} unique files from ${parentDir}/. Use search_files(pattern, '${parentDir}') or exec: grep -rn "pattern" ${parentDir}/ instead of reading files individually.`,
+                                    };
                                 }
                             }
                             // Fix 3: Same-search-term detection
@@ -2923,8 +3123,17 @@ export async function createSession(opts) {
                                 searchTermFiles.get(key).add(filePath);
                                 if (searchTermFiles.get(key).size >= 3) {
                                     await emitToolCall({ id: callId, name, args });
-                                    await emitToolResult({ id: callId, name, success: false, summary: 'use search_files', result: '' });
-                                    return { id: callId, content: `STOP: You've searched ${searchTermFiles.get(key).size} files for "${searchTerm}" one at a time. This is what search_files does in one call. Use: search_files(pattern="${searchTerm}", path=".") or exec: grep -rn "${searchTerm}" .` };
+                                    await emitToolResult({
+                                        id: callId,
+                                        name,
+                                        success: false,
+                                        summary: 'use search_files',
+                                        result: '',
+                                    });
+                                    return {
+                                        id: callId,
+                                        content: `STOP: You've searched ${searchTermFiles.get(key).size} files for "${searchTerm}" one at a time. This is what search_files does in one call. Use: search_files(pattern="${searchTerm}", path=".") or exec: grep -rn "${searchTerm}" .`,
+                                    };
                                 }
                             }
                         }
@@ -2943,22 +3152,40 @@ export async function createSession(opts) {
                             planSteps.push(step);
                             const blockedMsg = `[blocked: approval_mode=plan] Would ${summary}`;
                             // Notify via confirmProvider.showBlocked if available
-                            opts.confirmProvider?.showBlocked?.({ tool: name, args, reason: `plan mode: ${summary}` });
+                            opts.confirmProvider?.showBlocked?.({
+                                tool: name,
+                                args,
+                                reason: `plan mode: ${summary}`,
+                            });
                             // Hook: onToolCall + onToolResult for plan-blocked actions
                             await emitToolCall({ id: callId, name, args });
-                            await emitToolResult({ id: callId, name, success: true, summary: `⏸ ${summary} (blocked)`, result: blockedMsg });
+                            await emitToolResult({
+                                id: callId,
+                                name,
+                                success: true,
+                                summary: `⏸ ${summary} (blocked)`,
+                                result: blockedMsg,
+                            });
                             return { id: callId, content: blockedMsg };
                         }
                         // Hook: onToolCall (Phase 8.5)
                         await emitToolCall({ id: callId, name, args });
                         if (cfg.step_mode) {
                             const stepPrompt = `Step mode: execute ${name}(${JSON.stringify(args).slice(0, 200)}) ? [Y/n]`;
-                            const ok = confirmBridge ? await confirmBridge(stepPrompt, { tool: name, args }) : true;
+                            const ok = confirmBridge
+                                ? await confirmBridge(stepPrompt, { tool: name, args })
+                                : true;
                             if (!ok) {
                                 return { id: callId, content: '[skipped by user: step mode]' };
                             }
                         }
                         const sig = toolLoopGuard.computeSignature(name, args && typeof args === 'object' && !Array.isArray(args) ? args : {});
+                        // Poisoned tool call: don't execute, return error-like result.
+                        if (poisonedToolSigs.has(sig)) {
+                            const consec = consecutiveCounts.get(sig) ?? 3;
+                            const poisonMsg = `Error: This exact ${name} call has been repeated ${consec} times with identical arguments and results. The tool is temporarily disabled. Use the information you already have, or try a different approach.`;
+                            return { id: callId, content: poisonMsg };
+                        }
                         let content = '';
                         let reusedCachedReadOnlyExec = false;
                         let reusedCachedReadTool = false;
@@ -2997,7 +3224,9 @@ export async function createSession(opts) {
                                 };
                                 const value = await builtInFn(callCtx, args);
                                 content = typeof value === 'string' ? value : JSON.stringify(value);
-                                if (READ_FILE_CACHE_TOOLS.has(name) && typeof content === 'string' && !content.startsWith('ERROR:')) {
+                                if (READ_FILE_CACHE_TOOLS.has(name) &&
+                                    typeof content === 'string' &&
+                                    !content.startsWith('ERROR:')) {
                                     const baseCwd = typeof args?.cwd === 'string' ? String(args.cwd) : ctx.cwd;
                                     await toolLoopGuard.storeReadCache(name, args, baseCwd, content);
                                 }
@@ -3040,7 +3269,9 @@ export async function createSession(opts) {
                                 const mcpReadOnly = isReadOnlyToolDynamic(name);
                                 if (!cfg.step_mode && !ctx.noConfirm && !mcpReadOnly) {
                                     const prompt = `Execute MCP tool '${name}'? [Y/n]`;
-                                    const ok = confirmBridge ? await confirmBridge(prompt, { tool: name, args }) : true;
+                                    const ok = confirmBridge
+                                        ? await confirmBridge(prompt, { tool: name, args })
+                                        : true;
                                     if (!ok) {
                                         return { id: callId, content: '[skipped by user: approval]' };
                                     }
@@ -3064,7 +3295,13 @@ export async function createSession(opts) {
                         let summary = reusedCachedReadOnlyExec
                             ? 'cached read-only exec observation (unchanged)'
                             : toolResultSummary(name, args, content, true);
-                        const resultEvent = { id: callId, name, success: true, summary, result: content };
+                        const resultEvent = {
+                            id: callId,
+                            name,
+                            success: true,
+                            summary,
+                            result: content,
+                        };
                         // Phase 7: populate rich display fields
                         if (name === 'exec') {
                             try {
@@ -3114,14 +3351,18 @@ export async function createSession(opts) {
                                 const mutatedPath = typeof args.path === 'string' ? args.path : '';
                                 if (mutatedPath) {
                                     try {
-                                        const absPath = mutatedPath.startsWith('/') ? mutatedPath : path.join(projectDir, mutatedPath);
+                                        const absPath = mutatedPath.startsWith('/')
+                                            ? mutatedPath
+                                            : path.join(projectDir, mutatedPath);
                                         const fileText = await fs.readFile(absPath, 'utf8');
                                         await lspManager.ensureOpen(absPath, fileText);
                                         await lspManager.notifyDidSave(absPath, fileText);
                                         // Small delay so the server can process diagnostics
                                         await new Promise((r) => setTimeout(r, 200));
                                         const diags = await lspManager.getDiagnostics(absPath);
-                                        if (diags && !diags.startsWith('No diagnostics') && !diags.startsWith('[lsp] no language')) {
+                                        if (diags &&
+                                            !diags.startsWith('No diagnostics') &&
+                                            !diags.startsWith('[lsp] no language')) {
                                             content += `\n\n[lsp] Diagnostics after edit:\n${diags}`;
                                         }
                                     }
@@ -3139,7 +3380,9 @@ export async function createSession(opts) {
                         // Track edits to the same file. If the model keeps editing the same file
                         // over and over, it's likely in an edit→break→read→edit corruption spiral.
                         if (FILE_MUTATION_TOOL_SET.has(name) && toolSuccess && typeof args.path === 'string') {
-                            const absPath = args.path.startsWith('/') ? args.path : path.resolve(projectDir, args.path);
+                            const absPath = args.path.startsWith('/')
+                                ? args.path
+                                : path.resolve(projectDir, args.path);
                             const basename = path.basename(absPath);
                             // write_file = full rewrite. If the model is rewriting the file completely
                             // after being warned, give it a fresh chance (reset counter to 1).
@@ -3154,15 +3397,18 @@ export async function createSession(opts) {
                                 if (count >= FILE_MUTATION_BLOCK_THRESHOLD) {
                                     // Mark for pre-dispatch blocking on subsequent edits
                                     fileMutationBlocked.add(absPath);
-                                    content += `\n\n⚠️ BLOCKED: You have edited ${basename} ${count} times. Further edits to this file are now blocked. ` +
-                                        `Restore it with: exec { "command": "git checkout -- ${args.path}" }, then make ONE complete edit.`;
+                                    content +=
+                                        `\n\n⚠️ BLOCKED: You have edited ${basename} ${count} times. Further edits to this file are now blocked. ` +
+                                            `Restore it with: exec { "command": "git checkout -- ${args.path}" }, then make ONE complete edit.`;
                                 }
-                                else if (count >= FILE_MUTATION_WARN_THRESHOLD && !fileMutationWarned.has(absPath)) {
+                                else if (count >= FILE_MUTATION_WARN_THRESHOLD &&
+                                    !fileMutationWarned.has(absPath)) {
                                     fileMutationWarned.add(absPath);
-                                    content += `\n\n⚠️ WARNING: You have edited ${basename} ${count} times. ` +
-                                        'If the file is broken, STOP making incremental fixes. ' +
-                                        `Restore it with: exec { "command": "git checkout -- ${args.path}" }, ` +
-                                        'read the original file carefully, then make ONE complete edit. Do NOT continue patching.';
+                                    content +=
+                                        `\n\n⚠️ WARNING: You have edited ${basename} ${count} times. ` +
+                                            'If the file is broken, STOP making incremental fixes. ' +
+                                            `Restore it with: exec { "command": "git checkout -- ${args.path}" }, ` +
+                                            'read the original file carefully, then make ONE complete edit. Do NOT continue patching.';
                                 }
                             }
                         }
@@ -3203,9 +3449,9 @@ export async function createSession(opts) {
                         // Fast-fail repeated blocked command loops with accurate reason labeling.
                         // Applies to direct exec attempts and spawn_task delegation attempts.
                         if (tc.function.name === 'exec' || tc.function.name === 'spawn_task') {
-                            const blockedMatch = msg.match(/^exec:\s*blocked\s*\(([^)]+)\)\s*without --no-confirm\/--yolo:\s*(.*)$/i)
-                                || msg.match(/^(spawn_task):\s*blocked\s*—\s*(.*)$/i)
-                                || msg.match(/^exec:\s*blocked\s+(background command\b[^.]*)\./i);
+                            const blockedMatch = msg.match(/^exec:\s*blocked\s*\(([^)]+)\)\s*without --no-confirm\/--yolo:\s*(.*)$/i) ||
+                                msg.match(/^(spawn_task):\s*blocked\s*—\s*(.*)$/i) ||
+                                msg.match(/^exec:\s*blocked\s+(background command\b[^.]*)\./i);
                             if (blockedMatch) {
                                 const reason = (blockedMatch[1] || blockedMatch[2] || 'blocked command').trim();
                                 let parsedArgs = {};
@@ -3217,8 +3463,8 @@ export async function createSession(opts) {
                                     ? String(parsedArgs?.command ?? '')
                                     : String(parsedArgs?.task ?? '');
                                 const normalizedReason = reason.toLowerCase();
-                                const aggregateByReason = normalizedReason.includes('package install/remove')
-                                    || normalizedReason.includes('background command');
+                                const aggregateByReason = normalizedReason.includes('package install/remove') ||
+                                    normalizedReason.includes('background command');
                                 const sig = aggregateByReason
                                     ? `${tc.function.name}|${reason}`
                                     : `${tc.function.name}|${reason}|${cmd}`;
@@ -3279,7 +3525,7 @@ export async function createSession(opts) {
                             const callId = resolveCallId(tc);
                             results.push({
                                 id: callId,
-                                content: `STOP: Per-turn read limit (${READ_ONLY_PER_TURN_CAP}). Use search_files or exec with grep instead of reading files one by one.`
+                                content: `STOP: Per-turn read limit (${READ_ONLY_PER_TURN_CAP}). Use search_files or exec with grep instead of reading files one by one.`,
                             });
                         }
                         if (cfg.verbose) {
@@ -3293,8 +3539,7 @@ export async function createSession(opts) {
                         // Models that support parallel calls: read-only in parallel, mutations sequential
                         const readonly = toolCallsArr.filter((tc) => isReadOnlyToolDynamic(tc.function.name));
                         const others = toolCallsArr.filter((tc) => !isReadOnlyToolDynamic(tc.function.name));
-                        const ro = await Promise.all(readonly.map((tc) => runOne(tc)
-                            .catch((e) => catchToolError(e, tc))));
+                        const ro = await Promise.all(readonly.map((tc) => runOne(tc).catch((e) => catchToolError(e, tc))));
                         results.push(...ro);
                         for (const tc of others) {
                             if (ac.signal.aborted)
@@ -3352,7 +3597,7 @@ export async function createSession(opts) {
                     if (readOnlyExecTurnHints.length) {
                         const previews = readOnlyExecTurnHints
                             .slice(0, 2)
-                            .map((cmd) => cmd.length > 140 ? `${cmd.slice(0, 140)}…` : cmd)
+                            .map((cmd) => (cmd.length > 140 ? `${cmd.slice(0, 140)}…` : cmd))
                             .join(' | ');
                         messages.push({
                             role: 'user',
@@ -3393,7 +3638,9 @@ export async function createSession(opts) {
                     }
                     // ── Escalating cumulative read budget (§ anti-scan guardrails) ──
                     // Warn zone: append warnings to each read result when approaching the hard cap
-                    if (!readBudgetWarned && cumulativeReadOnlyCalls > READ_BUDGET_WARN && cumulativeReadOnlyCalls <= READ_BUDGET_HARD) {
+                    if (!readBudgetWarned &&
+                        cumulativeReadOnlyCalls > READ_BUDGET_WARN &&
+                        cumulativeReadOnlyCalls <= READ_BUDGET_HARD) {
                         readBudgetWarned = true;
                         messages.push({
                             role: 'user',
@@ -3433,7 +3680,7 @@ export async function createSession(opts) {
                     messages.push({ role: 'assistant', content: visible || content || '' });
                     messages.push({
                         role: 'user',
-                        content: '[system] MCP tools are now enabled for this task. Continue and call tools as needed.'
+                        content: '[system] MCP tools are now enabled for this task. Continue and call tools as needed.',
                     });
                     continue;
                 }
@@ -3452,7 +3699,7 @@ export async function createSession(opts) {
                             const clippedReminder = reminder.length > 1600 ? `${reminder.slice(0, 1600)}\n[truncated]` : reminder;
                             messages.push({
                                 role: 'user',
-                                content: `[system] Stuck narrating. Resume with tools.\nTask:\n${clippedReminder}`
+                                content: `[system] Stuck narrating. Resume with tools.\nTask:\n${clippedReminder}`,
                             });
                             await emitTurnEnd({
                                 turn: turns,
@@ -3474,7 +3721,7 @@ export async function createSession(opts) {
                         noToolNudgeUsed = true;
                         messages.push({
                             role: 'user',
-                            content: '[system] Use tools now or give final answer.'
+                            content: '[system] Use tools now or give final answer.',
                         });
                         await emitTurnEnd({
                             turn: turns,
@@ -3584,11 +3831,21 @@ export async function createSession(opts) {
     };
     // expose via getters so setModel() / reset() don't break references
     return {
-        get model() { return model; },
-        get harness() { return harness.id; },
-        get endpoint() { return cfg.endpoint; },
-        get contextWindow() { return contextWindow; },
-        get supportsVision() { return supportsVision; },
+        get model() {
+            return model;
+        },
+        get harness() {
+            return harness.id;
+        },
+        get endpoint() {
+            return cfg.endpoint;
+        },
+        get contextWindow() {
+            return contextWindow;
+        },
+        get supportsVision() {
+            return supportsVision;
+        },
         get messages() {
             return messages;
         },
@@ -3647,7 +3904,7 @@ export async function createSession(opts) {
         },
         executePlanStep,
         clearPlan,
-        compactHistory
+        compactHistory,
     };
 }
 export async function runAgent(opts) {
@@ -3656,7 +3913,7 @@ export async function runAgent(opts) {
         apiKey: opts.apiKey,
         confirm: opts.confirm,
         confirmProvider: opts.confirmProvider,
-        runtime: opts.runtime
+        runtime: opts.runtime,
     });
     return session.ask(opts.instruction, opts.onToken);
 }