agen-vektor 0.3.15 → 0.3.16

package/README.md

@@ -1,90 +1,84 @@
-```
-████████████████████████████████████████████████
-█                                              █
-█           V E C T O R   A G E N T            █
-█                                              █
-████████████████████████████████████████████████
-```
+<div align="center">
+  <img src="assets/banner.svg" alt="VectorHead — will run commands on your behalf to help you build." width="720"/>
+</div>
 
 <div align="center">
 
 **AI Coding Agent for Linux & Termux** — a terminal-native coding agent that inspects your project, plans, edits code, runs commands and tests, and iterates until the task is done.
 
-![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20Termux-9EFC62?style=for-the-badge&labelColor=0b0f14)
-![Node](https://img.shields.io/badge/node-20%2B-339933?style=for-the-badge&labelColor=0b0f14)
-![License](https://img.shields.io/badge/license-MIT-3B82F6?style=for-the-badge&labelColor=0b0f14)
+[![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20Termux-9EFC62?style=for-the-badge&labelColor=0b0f14)](https://www.npmjs.com/package/agen-vektor)
+[![Node](https://img.shields.io/badge/node-20%2B-339933?style=for-the-badge&labelColor=0b0f14)](https://nodejs.org)
+[![npm](https://img.shields.io/npm/v/agen-vektor?style=for-the-badge&color=FF8534&labelColor=0b0f14)](https://www.npmjs.com/package/agen-vektor)
+[![License](https://img.shields.io/badge/license-MIT-3B82F6?style=for-the-badge&labelColor=0b0f14)](LICENSE)
 [![Tests](https://img.shields.io/github/actions/workflow/status/clickmamaheti-prog/vector-agent/ci.yml?style=for-the-badge&label=tests&labelColor=0b0f14)](https://github.com/clickmamaheti-prog/vector-agent/actions/workflows/ci.yml)
 
-</div>
-
----
+*Zero runtime dependencies · Free tier included · No telemetry*
 
-```
-VectorHead ● Ready                     deepseek-ai/DeepSeek-V4-Flash
-[09:41]
-Perbaiki error authentication pada project ini
-
-# Cek Auth      ← kuning (heading H1–H6, Freebuff palette)
-VectorHead akan memeriksa file auth, memperbaiki, lalu menjalankan test.
-[09:42]
-$ npm test
-  ... (2 more lines above)
-  3 tests passed
-╭─────────────────────────────────────────────────────────────────────────────╮
-│                                                                             │
-│  ▍ Enter a coding task or / for commands                                   │
-│                                                                             │
-╰─────────────────────────────────────────────────────────────────────────────╯
-● Ready                                          ● ask
-```
+</div>
 
-A Freebuff-style terminal UI with the EXACT Freebuff dark palette (`#9EFC62`
-green accents, markdown headings H1–H6 all yellow `#facc15`, inline code
-BOLD orange `#FF8534` on a `#374151` chip, links blue `#3B82F6`, fenced
-code `// lang` header `#5b647a` on a `#374151` slab, plain prose — quoted
-from [CodebuffAI/freebuff](https://github.com/CodebuffAI/freebuff)
-theme-system.ts + markdown-renderer.tsx), a compact agent-activity strip
-(⚙ tool calls), and a rounded input box with a block cursor — all rendered
-incrementally with no flicker.
+*A terminal UI that stays out of your way — chat, tool activity, and code
+render cleanly right where you work.*
 
 ## Contents
 
-- [Features](#features) · [Installation](#installation) · [Quick start](#quick-start) · [Command line](#command-line) · [TUI commands](#tui-commands)
-- [Provider configuration](#provider-configuration) · [Themes](#themes) · [Security model](#security-model) · [Privacy](#privacy) · [Architecture](#architecture) · [Development](#development)
-- [Testing](#testing) · [Troubleshooting](#troubleshooting) · [Roadmap](#roadmap) · [License](#license)
+- [Features](#features) · [Free tier](#free-tier-zero-config) · [Installation](#installation) · [Quick start](#quick-start) · [Command line](#command-line) · [TUI commands](#tui-commands)
+- [Provider configuration](#provider-configuration) · [Skills](#skills) · [Agent files](#agent-files) · [Themes](#themes) · [Security model](#security-model) · [Privacy](#privacy)
+- [Architecture](#architecture) · [Development](#development) · [Testing](#testing) · [Troubleshooting](#troubleshooting) · [Roadmap](#roadmap) · [License](#license)
 
 ## Features
 
 - **Interactive TUI** — chat, agent status, tool execution, diff viewer, input. Keyboard driven, mouse-aware, works on 80×24 terminals and survives resize. Scroll the chat with PgUp/PgDn, the mouse wheel, or ↑/↓ while the input line is empty.
 - **Agent loop** — plan → inspect → tool call → result → review → fix → retry until done (with an iteration cap).
 - **Tools** — read/write/edit files, list directories, search files, run shell commands, git, fetch web pages, and **live web search out of the box** (no key needed — searches relay through the VectorHead gateway; bring your own Exa/Serper/Brave key to use your own quota).
+- **Skills** — 14 bundled, agentskills.io-format skills with progressive disclosure (`list_skills` / `read_skill` tools, `/skills` in the TUI); drop your own into `~/.vector/skills/` or `.agents/skills/`.
+- **Agent files** — SOUL.md / MEMORY.md / USER.md / AGENTS.md auto-seeded in `~/.vector/` and injected into the system prompt (identity, notes, preferences, project rules).
 - **Security first** — command policy classifies every shell command (SAFE / ASK / DANGEROUS / BLOCKED), permission prompts before risky actions, `--yolo` mode with warnings, and API keys are never printed or persisted to sessions.
-- **Multi-provider** — OpenAI, Anthropic, Gemini, OpenRouter, Ollama, and any OpenAI-compatible custom endpoint.
+- **Multi-provider** — OpenAI, Anthropic, Gemini, OpenRouter, Ollama, and any OpenAI-compatible custom endpoint — unlimited side-by-side providers with per-provider keys, models and headers.
 - **Sessions & memory** — conversations persist to `~/.vector/sessions/`; a relaunch in the same project resumes the conversation automatically (agent keeps the last replies in context), `/continue` resumes any session, and `Ctrl+L`/`/clear` starts fresh.
 - **Context management** — only relevant context is sent to the model, with compaction (`/compact`).
 
+## Free tier (zero config)
+
+Install and chat — no account, no API key:
+
+```bash
+npm install -g agen-vektor
+vector
+```
+
+The default provider is **`vectorhead-free`** (model `glm-5.3-flash`, 40 free
+models via `/model`). The shared provider key stays server-side; web search
+works through the same gateway out of the box. Bring your own provider key at
+any time via `/connect`.
+
 ## Installation
 
 Requirements: **Node.js 20+** and **npm** (Termux: `pkg install nodejs`).
 
-### From source
+### One-shot installer (recommended)
 
-Clone this repo, then:
+No Node.js/npm yet? The installer sets up Node 20+ & npm (apt on Debian/Ubuntu,
+`pkg` on Termux) and then installs VectorHead for you:
 
 ```bash
-npm install
-npm run build
-npm link   # makes `vector` available on your PATH
+bash <(curl -fsSL https://raw.githubusercontent.com/clickmamaheti-prog/vector-agent/main/install.sh)
 ```
 
+### From npm
+
 ```bash
+npm install -g agen-vektor
 vector
 ```
 
-### From npm
+### From source
 
 ```bash
-npm install -g agen-vektor
+git clone https://github.com/clickmamaheti-prog/vector-agent
+cd vector-agent
+npm install
+npm run build
+npm link   # makes `vector` available on your PATH
 vector
 ```
 
@@ -127,22 +121,29 @@ vector
 | `vector --yolo` | Skip permission prompts for ask-level actions (with warning) |
 | `vector --version` / `--help` | Version / help |
 
+Generic environment variables: `VECTOR_API_KEY`, `VECTOR_API_URL`, `VECTOR_MODEL`, `VECTOR_PROVIDER`, `VECTOR_THEME`, `VECTOR_HOME`, `VECTOR_AUTO_APPROVE` (=1 auto-approves ASK-level permission prompts, for automated runs/tests; dangerous actions still prompt), `VECTOR_ASCII` (=1 forces ASCII safe mode — glyphs map to 1-column ASCII so CJK/Termux fonts never tear the layout; auto-on for zh/ja/ko locales and Termux, `=0` opts out on desktop).
+
 ## TUI commands
 
-Type `/` inside VectorHead:
+Type `/` inside VectorHead — suggestions filter as you type:
 
 | Command | Description |
 |---|---|
-| `/model` | Select a model |
-| `/theme` | Select a theme (OpenCode-style) |
-| `/provider` | Select a provider |
+| `/help` | Show help — `/help all` lists every command |
+| `/connect` | Configure provider: pick built-in / add custom API (`/provider`, `/setup` are aliases) |
 | `/provider-remove` | Remove the stored provider key (and custom URL/name) so you can re-enter fresh values |
+| `/model` | Select a model — auto-fetches the live model list from the provider |
+| `/theme` | Select a theme |
 | `/session` | Browse saved sessions |
+| `/session-name` | Set session name (arg optional) |
 | `/settings` | Show configuration |
 | `/status` | Show agent status |
 | `/clear` | Clear the conversation (keeps the session) |
 | `/new` | Start a fresh conversation — rotates to a brand-new session (the old one is kept on disk) |
+| `/reset` | Fresh conversation — old session file deleted from disk |
 | `/continue` | Continue the current/last session |
+| `/soul` `/memory` `/user` `/agents` | Edit agent files (SOUL/MEMORY/USER/AGENTS.md) |
+| `/skills` | List installed skills |
 | `/diff` | Show diff viewer |
 | `/git` | Run `git status` |
 | `/compact` | Compact context (truncate old messages) |
@@ -160,9 +161,7 @@ export GEMINI_API_KEY=...
 export OPENROUTER_API_KEY=...
 ```
 
-Or inside VectorHead: `/provider` → pick provider → paste key (stored masked in `~/.vector/credentials.json`, permissions `0600`).
-
-Generic variables: `VECTOR_API_KEY`, `VECTOR_API_URL`, `VECTOR_MODEL`, `VECTOR_PROVIDER`, `VECTOR_THEME`, `VECTOR_HOME`, `VECTOR_AUTO_APPROVE` (=1 auto-approves ASK-level permission prompts, for automated runs/tests; dangerous actions still prompt).
+Or inside VectorHead: `/connect` → pick provider → paste key (stored masked in `~/.vector/credentials.json`, permissions `0600`).
 
 ### Custom API (OpenAI-compatible)
 
@@ -174,12 +173,13 @@ vector --provider custom --model deepseek-v3
 
 The provider speaks `/v1/chat/completions` (and `/models`). Anthropic and Gemini protocols for custom endpoints are documented as adapters; OpenAI-compatible endpoints are fully supported.
 
-### Multiple custom providers (OpenCode-style)
+<details>
+<summary><b>Multiple custom providers</b></summary>
+
+<br>
 
 Any number of OpenAI-compatible providers can be defined side by side in
-`~/.vector/config.json` under `providers` — the same shape OpenCode uses in
-its `provider` section (minus the `npm` field, since every custom endpoint
-here is OpenAI-compatible):
+`~/.vector/config.json` under `providers`:
 
 ```jsonc
 {
@@ -190,7 +190,7 @@ here is OpenAI-compatible):
       "name": "BitDeer",
       "options": {
         "baseURL": "https://api-inference.bitdeer.ai/v1",
-        "apiKey": "{env:BITDEER_API_KEY}"   // or a plain key, or omit and store via /provider
+        "apiKey": "{env:BITDEER_API_KEY}"   // or a plain key, or omit and store via /connect
       },
       "models": {
         "deepseek-ai/DeepSeek-V4-Flash": { "name": "DeepSeek V4 Flash" }
@@ -219,33 +219,70 @@ here is OpenAI-compatible):
 
 - `provider` is the active id — a built-in, the legacy `custom` slot, or any
   key of `providers`. Keys are **per provider id**: store each under its own
-  id in `~/.vector/credentials.json` (0600) via `/provider`, inline them in
+  id in `~/.vector/credentials.json` (0600) via `/connect`, inline them in
   `options.apiKey`, or reference an env var with `"{env:NAME}"`.
 - `options.headers` adds extra HTTP headers to every request of that provider
   (e.g. a `User-Agent` required by a client-filtering gateway like
   AgentRouter). Values may be plain strings or `"{env:NAME}"` templates;
   headers referencing a missing env var are dropped.
 - `model` is the **default model** for that provider: when the provider
-  becomes active (`/provider`, `--provider`, or `VECTOR_PROVIDER`), the active
+  becomes active (`/connect`, `--provider`, or `VECTOR_PROVIDER`), the active
   model automatically follows it unless an explicit `--model` / `VECTOR_MODEL`
   was given. Handy when each provider speaks its own model ids (e.g.
   AgentRouter uses `deepseek-v4-flash` while BitDeer uses
   `deepseek-ai/DeepSeek-V4-Flash`).
-- `/provider` lists built-ins + every configured custom and offers
+- `/connect` lists built-ins + every configured custom and offers
   **Add custom provider** (id → name → base URL → key). `/model` then
   auto-discovers models from the endpoint's `/models` route and falls back
   to the `models` map above.
 - The old single-custom setup (`provider: "custom"` + `apiUrl`/`customName`
   + key under `custom`) keeps working unchanged.
 
-Switch at runtime with `/provider`, or per-run with
+Switch at runtime with `/connect`, or per-run with
 `VECTOR_PROVIDER=bitdeer vector …` / `--provider bitdeer`.
 
+</details>
+
+## Skills
+
+VectorHead ships a built-in skill system (agentskills.io format —
+YAML frontmatter + markdown body) with **progressive disclosure**: the agent
+sees a one-line catalog first and loads a skill's full body only when needed
+via the `list_skills` / `read_skill` tools.
+
+**14 bundled skills:** `verify-node-project`, `safe-git-workflow`,
+`debug-loop`, `fetch-docs`, `secure-secrets`, `systematic-debugging`,
+`test-driven-development`, `codebase-inspection`, `requesting-code-review`,
+`spike`, `simplify-code`, `grounded-citations`, `blocked-page-recovery`,
+`humanize-writing`.
+
+Install your own (multi-root resolution):
+
+| Root | Scope |
+|---|---|
+| `~/.vector/skills/<name>/SKILL.md` | personal — always active |
+| `<project>/.agents/skills/<name>/SKILL.md` | project — active when running from that project |
+| `~/.agents/skills/<name>/SKILL.md` | personal (standard `npx skills` layout) |
+
+Browse in the TUI with `/skills`.
+
+## Agent files
+
+Markdown files auto-seeded in `~/.vector/` (never overwritten by upgrades):
+
+| File | Purpose |
+|---|---|
+| `SOUL.md` | Agent identity — slot #1 of the system prompt |
+| `MEMORY.md` | Persistent notes the agent keeps across sessions |
+| `USER.md` | What the agent knows about you |
+| `AGENTS.md` | Project rules (also read from the project root, like this repo's own) |
+
+Edit via the TUI (`/soul`, `/memory`, `/user`, `/agents`) or any editor. Size is capped per file to keep prompts lean.
+
 ## Themes
 
-VectorHead adopts [OpenCode's theme system](https://opencode.ai/docs/themes/):
-select a built-in theme, or drop your own JSON files into
-`~/.vector/themes/` (same files OpenCode uses work verbatim).
+VectorHead has its own theme system: pick a built-in theme, or drop your
+own JSON files into `~/.vector/themes/` — no restart, applies on the fly.
 
 ```bash
 vector --theme tokyonight     # one-off
@@ -255,10 +292,13 @@ echo '{ "theme": "nord" }' >> ~/.vector/config.json   # (merge manually)
 # or env: export VECTOR_THEME=matrix
 ```
 
-Built-ins: `vectorhead` (default, the Exact Freebuff dark palette),
-`nord`, `tokyonight`, `gruvbox`, `catppuccin`, `one-dark`, `matrix`.
+Built-ins: `vectorhead` (default — the signature orange & gold VectorHead
+palette), `nord`, `tokyonight`, `gruvbox`, `catppuccin`, `one-dark`, `matrix`.
+
+<details>
+<summary><b>Custom themes</b></summary>
 
-### Custom themes
+<br>
 
 A theme is a JSON file with an optional `defs` block of reusable colors
 plus a semantic `theme` block. Color values may be hex (`#88C0D0`), ANSI
@@ -284,14 +324,16 @@ dark/light variants (`{ "dark": "#000", "light": "#fff" }`), or
 ```
 
 Save it as `~/.vector/themes/my-theme.json`, then `/theme` (or
-`vector --theme my-theme`) to use it. Semantic keys adopted from OpenCode
-and their effect here: `primary` (brand accent), `accent`/`markdownHeading`
+`vector --theme my-theme`) to use it. Semantic keys and their effect:
+`primary` (brand accent), `accent`/`markdownHeading`
 (headings, prompt), `text`, `textMuted`, `textFaint`, `markdownCode`,
 `border`/`borderActive`, `error`/`warning`/`success`/`info`, `diffAdded`/
 `diffRemoved`/`diffContext`, `backgroundPanel`/`backgroundElement`.
 Unknown keys and unresolvable colors are ignored, so partial themes keep
 the default palette for anything you don't override.
 
+</details>
+
 > Hex colors are emitted as truecolor (24-bit) escapes — terminals need
 > `COLORTERM=truecolor` for full fidelity (most modern terminals). ANSI
 > palette indexes and `vectorhead` work everywhere.
@@ -331,11 +373,11 @@ Every shell command is classified:
 src/
 ├── cli/          argument parsing, keyboard, bootstrap
 ├── tui/          terminal UI: chat, input, statusbar, diff, components
-├── agent/        agent loop, planner, context, memory, prompts, session
+├── agent/        agent loop, planner, context, memory, prompts, session, skills
 ├── providers/    AIProvider interface + OpenAI/Anthropic/Gemini/OpenRouter/Ollama/Custom
-├── tools/        tool registry + filesystem/shell/search/git/web
+├── tools/        tool registry + filesystem/shell/search/git/web/skills
 ├── security/     command policy + permission manager
-├── config/       config, credentials, model catalog
+├── config/       config, credentials, model catalog, free tier
 └── utils/        terminal (ANSI), logger, paths
 ```
 
@@ -361,19 +403,29 @@ npm run build
 
 ## Troubleshooting
 
-- **"No API key configured"** — set the relevant `*_API_KEY` env var or run `/provider` in the TUI.
+- **"No API key configured"** — set the relevant `*_API_KEY` env var or run `/connect` in the TUI. On the free tier this never appears — a default free provider is pre-configured.
 - **"401" / auth failed** — check the key, or for OpenRouter use `OPENROUTER_API_KEY`.
-- **Nothing happens on `vector` in Termux** — make sure your terminal is a TTY and TERM is set (e.g. `export TERM=xterm-256color`).
+- **"model not found" on the free tier** — the free catalog rotates; run `/model` to pick from the live list.
+- **"Rate limited (429) / cooling down"** — VectorHead retries automatically with backoff, and the free gateway cools down briefly instead of burning the shared key. Switch to another free model via `/model` and retry.
+- **Nothing happens on `vector` in Termux** — make sure your terminal is a TTY and TERM is set (e.g. `export TERM=xterm-256color`). If glyphs look broken (█ everywhere, torn logo), ASCII safe mode is already default-on; desktop users can opt back in with `VECTOR_ASCII=0`.
 - **Runs out of iterations** — raise `maxIterations` in `~/.vector/config.json` or refine the request.
-- **Rate limited (429)** — VectorHead retries automatically with backoff; wait and retry.
 
 ## Roadmap
 
-- Web search tool (provider-backed) behind the `web` abstraction
 - Interactive diff approval before edits in safe mode
 - Persistent permission rules per project
 - Windows support (WSL-focused)
 
+## Changelog
+
+### 0.3.15
+- **Thinking cards are segmented per completed agent step.** Reasoning for each step (think → tool → think → tool) now renders as its own `• Thinking` card instead of stacking every step's reasoning into one ever-growing card — stale reasoning no longer appears to "leak" below the live thinking preview during multi-step tasks like web research.
+- Streaming answers keep the guarded `mergeStreamDelta` accumulation across all providers (no more doubled final text on gateways that resend the full text).
+
+### 0.3.14
+- Removed the anonymous `device-id` / `X-Vector-Device` tracking pair entirely — no device identity is generated or sent.
+- Emoji-aware character widths: `/connect` picker borders align on CJK/emoji terminals.
+
 ## License
 
 [MIT](LICENSE)

package/dist/agent/loop.js

@@ -288,6 +288,46 @@ async function runAgentLoop(userRequest, opts, callbacks = {}) {
         // request history stay well-formed even if a provider regresses.
         result.toolCalls = result.toolCalls.filter((tc) => !!tc && typeof tc.name === 'string' && tc.name !== '');
         const hasToolCalls = result.toolCalls.length > 0;
+        // TOOL PENUTUP (aturan prompt Freebuff-style): suggest_followups,
+        // task_completed, render_ui — dipanggil BERSAMA teks jawaban final dalam
+        // respons yang sama. Eksekusinya di-sideload DI SINI — tanpa round-trip
+        // LLM lagi: dulu tool ini diperlakukan seperti tool biasa → loop memanggil
+        // model SEKALI LAGI sekadar menutup giliran (1 panggilan LLM terbuang per
+        // giliran) dan TUI menghidupkan kembali status "Thinking" + baris
+        // "Working…" DI BAWAH jawaban final yang sudah tampil (laporan user
+        // 2026-09-09: "sudah selesai tugas masih working"). Callback
+        // onToolCall/onToolResult TETAP ditembak agar kartu followups / ✓ Task
+        // Complete / tombol render_ui tetap ter-render; hanya status yang hilang.
+        const CLOSING_TOOLS = new Set(['suggest_followups', 'task_completed', 'render_ui']);
+        const closerCalls = hasToolCalls
+            ? result.toolCalls.filter((tc) => CLOSING_TOOLS.has(tc.name))
+            : [];
+        if (result.content.trim() && closerCalls.length > 0 && closerCalls.length === result.toolCalls.length) {
+            // History tetap well-formed: balasan + toolCalls + hasil tool-nya.
+            messages.push({ role: 'assistant', content: result.content, toolCalls: result.toolCalls });
+            for (const tc of closerCalls) {
+                callbacks.onToolCall?.(tc.name, tc.arguments, tc.id);
+                let toolResult;
+                try {
+                    toolResult = await tools.execute(tc.name, tc.arguments, {
+                        cwd,
+                        permissions,
+                        onActivity: callbacks.onActivity,
+                        maxOutput: 30_000,
+                    });
+                }
+                catch (err) {
+                    toolResult = { output: `ERROR: ${err.message}`, summary: 'tool error' };
+                }
+                callbacks.onToolResult?.(tc.name, toolResult.output, toolResult.data, tc.id);
+                messages.push({ role: 'tool', toolCallId: tc.id, name: tc.name, content: toolResult.output.slice(0, 40_000) });
+            }
+            finalContent = result.content;
+            callbacks.onStatus?.('Completed');
+            callbacks.onFinal?.({ ...result, reasoning: lastReasoning || result.reasoning });
+            lastReasoning = '';
+            return { content: finalContent, iterations, toolCalls: toolCalls + closerCalls.length, stopped, aborted, messages };
+        }
         // Streaming-free path: collect the assistant message and execute tools.
         messages.push({
             role: 'assistant',

package/dist/agent/skills.js

@@ -80,8 +80,20 @@ function parseFrontmatter(raw) {
     const yaml = m[1];
     const body = m[2].trim();
     const meta = { name: '', description: '' };
+    // Multi-line YAML values (folded `>` / literal `|`, e.g. community skills
+    // from `npx skills add` use `description: >` with indented continuation
+    // lines). Re-join each block into one logical `key: value` line so the
+    // simple line-based parser below keeps working unchanged.
+    const yamlFlat = yaml.replace(/^([a-zA-Z_-]+):[ \t]*([>|][+-]?\d*)[ \t]*\n((?:[ \t]+.*(?:\n|$))*)/gm, (_all, key, _ind, cont) => {
+        const joined = cont
+            .split('\n')
+            .map((l) => l.trim())
+            .filter(Boolean)
+            .join(' ');
+        return `${key}: ${joined}\n`;
+    });
     const simple = /^([a-zA-Z_-]+):\s*(.+?)\s*$/gm;
-    for (const match of yaml.matchAll(simple)) {
+    for (const match of yamlFlat.matchAll(simple)) {
         const key = match[1];
         const value = match[2].replace(/^['"]|['"]$/g, '');
         if (key === 'name')

package/dist/providers/anthropic.js

@@ -288,6 +288,19 @@ class AnthropicProvider {
                 },
             };
         }
+        catch (err) {
+            // Distinguish a USER interrupt (outer signal aborted → rethrow as-is;
+            // the loop marks the run 'Stopped') from OUR 180s deadline. The latter
+            // surfaced as a bare AbortError that withRetry refuses to retry — one
+            // slow response killed the whole run mid-task ("macet"). Same fix as
+            // openai-compat.ts: our deadline = retryable transport failure.
+            if (params.signal?.aborted)
+                throw err;
+            if (err.name === 'AbortError') {
+                throw new provider_1.ProviderError('Anthropic stream aborted by timeout (180s).', 0, true);
+            }
+            throw err;
+        }
         finally {
             clearTimeout(timer);
             if (params.signal)

package/dist/providers/gemini.js

@@ -130,26 +130,45 @@ class GeminiProvider {
         const alt = stream ? '&alt=sse' : '';
         return `${BASE}/models/${params.model}:${action}?key=${encodeURIComponent(key)}${alt}`;
     }
-    async post(params, stream) {
+    post(params, stream, signal) {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), 180_000);
         const onOuterAbort = () => controller.abort();
+        if (signal) {
+            if (signal.aborted)
+                controller.abort();
+            else
+                signal.addEventListener('abort', onOuterAbort);
+        }
         if (params.signal) {
             if (params.signal.aborted)
                 controller.abort();
             else
                 params.signal.addEventListener('abort', onOuterAbort);
         }
-        const res = await fetch(this.url(params, stream), {
+        const finish = (res) => {
+            clearTimeout(timer);
+            if (signal)
+                signal.removeEventListener('abort', onOuterAbort);
+            if (params.signal)
+                params.signal.removeEventListener('abort', onOuterAbort);
+            return { res };
+        };
+        return fetch(this.url(params, stream), {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(this.buildBody(params, stream)),
             signal: controller.signal,
+        })
+            .then(finish)
+            .catch((err) => {
+            clearTimeout(timer);
+            if (signal)
+                signal.removeEventListener('abort', onOuterAbort);
+            if (params.signal)
+                params.signal.removeEventListener('abort', onOuterAbort);
+            throw err;
         });
-        clearTimeout(timer);
-        if (params.signal)
-            params.signal.removeEventListener('abort', onOuterAbort);
-        return { res };
     }
     async chat(params) {
         const { res } = await this.post(params, false);
@@ -168,11 +187,46 @@ class GeminiProvider {
         };
     }
     async *stream(params) {
-        const { res } = await this.post(params, true);
-        if (!res.ok || !res.body) {
-            const text = await res.text().catch(() => '');
-            throw new provider_1.ProviderError(`Gemini HTTP ${res.status}: ${text.slice(0, 200)}`, res.status, res.status >= 500);
+        // Own abort wiring for the BODY phase: post() clears its 180s timer as
+        // soon as headers arrive, so a stream that connects and then STALLS
+        // forever had no deadline at all (spinner frozen). Body-phase aborts
+        // surface as a bare AbortError that withRetry refuses to retry — one
+        // stall killed the run mid-task ("macet"). Our deadline = retryable
+        // transport failure; a USER interrupt rethrows untouched.
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 180_000);
+        const onOuterAbort = () => controller.abort();
+        if (params.signal) {
+            if (params.signal.aborted)
+                controller.abort();
+            else
+                params.signal.addEventListener('abort', onOuterAbort);
+        }
+        try {
+            const posted = await this.post(params, true, controller.signal);
+            const res = posted.res;
+            if (!res.ok || !res.body) {
+                const text = await res.text().catch(() => '');
+                throw new provider_1.ProviderError(`Gemini HTTP ${res.status}: ${text.slice(0, 200)}`, res.status, res.status >= 500);
+            }
+            yield* this.consumeStream(res, params);
         }
+        catch (err) {
+            if (params.signal?.aborted)
+                throw err;
+            if (err.name === 'AbortError') {
+                throw new provider_1.ProviderError('Gemini stream stalled or aborted by timeout.', 0, true);
+            }
+            throw err;
+        }
+        finally {
+            clearTimeout(timer);
+            if (params.signal)
+                params.signal.removeEventListener('abort', onOuterAbort);
+        }
+    }
+    /** Consume the SSE body of an established streaming response. */
+    async *consumeStream(res, params) {
         const reader = res.body.getReader();
         const decoder = new TextDecoder();
         let buffer = '';

package/dist/providers/ollama.js

@@ -50,26 +50,45 @@ class OllamaProvider {
     capabilities() {
         return { streaming: true, tools: true, contextWindow: 128000 };
     }
-    async post(body, params) {
+    post(body, params, signal) {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), 180_000);
         const onOuterAbort = () => controller.abort();
+        if (signal) {
+            if (signal.aborted)
+                controller.abort();
+            else
+                signal.addEventListener('abort', onOuterAbort);
+        }
         if (params.signal) {
             if (params.signal.aborted)
                 controller.abort();
             else
                 params.signal.addEventListener('abort', onOuterAbort);
         }
-        const res = await fetch(`${baseUrl()}/api/chat`, {
+        const finish = (res) => {
+            clearTimeout(timer);
+            if (signal)
+                signal.removeEventListener('abort', onOuterAbort);
+            if (params.signal)
+                params.signal.removeEventListener('abort', onOuterAbort);
+            return { res };
+        };
+        return fetch(`${baseUrl()}/api/chat`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(body),
             signal: controller.signal,
+        })
+            .then(finish)
+            .catch((err) => {
+            clearTimeout(timer);
+            if (signal)
+                signal.removeEventListener('abort', onOuterAbort);
+            if (params.signal)
+                params.signal.removeEventListener('abort', onOuterAbort);
+            throw err;
         });
-        clearTimeout(timer);
-        if (params.signal)
-            params.signal.removeEventListener('abort', onOuterAbort);
-        return { res };
     }
     async chat(params) {
         const body = {
@@ -113,11 +132,44 @@ class OllamaProvider {
         };
         if (params.tools && params.tools.length > 0)
             body.tools = toToolDefs(params.tools);
-        const { res } = await this.post(body, params);
-        if (!res.ok || !res.body) {
-            const text = await res.text().catch(() => '');
-            throw new provider_1.ProviderError(`Ollama HTTP ${res.status}: ${text.slice(0, 200)}`, res.status, res.status >= 500);
+        // Own abort wiring for the BODY phase: post() clears its 180s timer when
+        // headers arrive, so a stream that connects then STALLS forever had no
+        // deadline. Same fix as openai-compat: our deadline = retryable
+        // transport failure; a USER interrupt rethrows untouched.
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 180_000);
+        const onOuterAbort = () => controller.abort();
+        if (params.signal) {
+            if (params.signal.aborted)
+                controller.abort();
+            else
+                params.signal.addEventListener('abort', onOuterAbort);
+        }
+        try {
+            const posted = await this.post(body, params, controller.signal);
+            const res = posted.res;
+            if (!res.ok || !res.body) {
+                const text = await res.text().catch(() => '');
+                throw new provider_1.ProviderError(`Ollama HTTP ${res.status}: ${text.slice(0, 200)}`, res.status, res.status >= 500);
+            }
+            yield* this.consumeStream(res, params);
+        }
+        catch (err) {
+            if (params.signal?.aborted)
+                throw err;
+            if (err.name === 'AbortError') {
+                throw new provider_1.ProviderError('Ollama stream stalled or aborted by timeout.', 0, true);
+            }
+            throw err;
         }
+        finally {
+            clearTimeout(timer);
+            if (params.signal)
+                params.signal.removeEventListener('abort', onOuterAbort);
+        }
+    }
+    /** Consume the NDJSON body of an established streaming response. */
+    async *consumeStream(res, params) {
         const reader = res.body.getReader();
         const decoder = new TextDecoder();
         let buffer = '';

package/dist/providers/provider.js

@@ -20,8 +20,19 @@ exports.withRetry = withRetry;
 function mergeStreamDelta(existing, delta) {
     if (!delta)
         return existing;
-    if (existing.endsWith(delta))
-        return existing; // repeat of the trailing chunk
+    if (existing.endsWith(delta)) {
+        // Repeat of the trailing chunk → treat as a resend and skip. KNOWN
+        // LIMITATION (deliberate, 2026-09-09 audit): a GENUINE next chunk that
+        // merely equals the tail (a model repeating a word across a chunk edge)
+        // is swallowed too — one repeated token lost. Distinguishing the two
+        // without per-connection framing is impossible: a tail resend of a full
+        // word ("Hello world" + "world") and a genuine repeat are
+        // byte-identical, and any seam heuristic that appends the latter also
+        // DOUBLES the former (the exact "dobel" bug this guard exists to
+        // prevent, 2026-09-08). Losing one token degrades gracefully; a doubled
+        // answer does not. Do not "fix" this without real stream framing.
+        return existing;
+    }
     if (existing.startsWith(delta))
         return existing; // earlier chunk re-emitted
     if (delta.startsWith(existing))
@@ -75,8 +86,19 @@ function friendlyApiError(err) {
         503: 'provider unavailable',
         504: 'timeout',
     };
-    if (status !== undefined && labelByStatus[status])
+    if (status !== undefined && labelByStatus[status]) {
+        // 400 is the ONE status whose body is usually the most actionable
+        // detail (strict-gateway protocol errors: "tool_calls without a
+        // response", "unknown tool_call_id", context too long). A generic
+        // "bad request" label hides exactly what the user needs to fix
+        // (agent dying mid-task, "macet", diagnostics). ProviderError already
+        // flattened newlines to one line — show the (capped) body instead.
+        if (status === 400 && raw && !labelByStatus[status].includes(raw.slice(0, 20))) {
+            const text = raw.length > 64 ? `${raw.slice(0, 63)}…` : raw;
+            return text;
+        }
         return labelByStatus[status];
+    }
     // Cut at the first `{` — everything from there on is a body dump.
     const noJson = raw.split('{')[0].trim();
     // Drop redundant `HTTP <code>:` / `<Name> HTTP <code>:` prefixes — the
@@ -97,6 +119,14 @@ onRetry, } = {}) {
             return await fn();
         }
         catch (err) {
+            // A user interrupt must never be retried — regardless of the error
+            // SHAPE it arrives in. Providers signal abort either as a DOM
+            // AbortError (fetch) or as a plain Error('aborted') (the loop's
+            // checkAbort convention); both were previously retryable here via the
+            // default-true branch, so Esc during a stall waited 1s/2s/4s before
+            // the abort was noticed ("Stopped" felt dead).
+            if (signal?.aborted)
+                throw err;
             attempt++;
             const retryable = err instanceof ProviderError
                 ? err.retryable

package/dist/tui/app.js

@@ -166,6 +166,17 @@ class App {
      *  turn's card (dulu: reanchor menarik LAGI batch lama ke dasar transkrip
      *  setiap giliran, jadi kartu followup lama "menempel" di bawah selamanya). */
     runFollowupMsgs = [];
+    /** Tool messages created during the CURRENT run — the boxed live panel
+     *  above the input renders ONLY these. The old panel scanned the WHOLE
+     *  transcript backwards with no run boundary, so the moment a new run
+     *  started (running=true, model still THINKING, no new tool yet) the
+     *  PREVIOUS run's shell/web-search cards re-appeared above the input —
+     *  "web-search/shell muncul di area thinking yang bukan tempatnya"
+     *  (laporan user 2026-09-08, live di VPS: panel penuh `$ Shell find ~ …`
+     *  dari run lama selagi run baru baru saja berpikir). Cleared per run
+     *  seperti runFollowupMsgs; kartu tetap tinggal di transkrip sebagai
+     *  riwayat. */
+    runToolMsgs = [];
     /** Message OBJECT of the last tool line (indexes shift when showWorking
      *  splices the previous working line out — see onToolCall). */
     lastToolMsg = null;
@@ -701,6 +712,7 @@ class App {
                 this.replyBubble = null;
                 this.wasAbortedByUser = false;
                 this.thinkingMsg = null;
+                this.runToolMsgs = [];
                 this.todoMsg = null;
                 this.todoSteps = [];
                 this.todoDone = 0;
@@ -1311,6 +1323,7 @@ class App {
         this.replyHandled = false;
         this.lastToolMsg = null;
         this.thinkingMsg = null;
+        this.runToolMsgs = [];
         // Model-driven todos: the plan's steps become a ☐/☑ checklist right
         // under the user's message, ticking off as tools complete.
         if (planSteps && planSteps.length > 0)
@@ -1404,6 +1417,13 @@ class App {
                 this.markDirty();
                 this.status = status;
                 this.statusColor = (0, theme_1.statusColor)(status);
+                // Tool PENUTUP (suggest_followups/task_completed/render_ui): setelah
+                // jawaban final tampil, status "Running …" TIDAK boleh menghidupkan
+                // kembali baris "Working…" di bawahnya (bug "sudah selesai masih
+                // working", laporan 2026-09-09). Loop kini men-sideload tool-tool ini
+                // tanpa status, tapi pagar tetap terpasang utk provider lama/edge case.
+                if (/^Running (suggest_followups|task_completed|render_ui)/.test(status))
+                    return;
                 // Just a clean "Working" line — the exact activity detail is shown
                 // by the per-tool lines (tool rows) and the bottom status bar, so the
                 // working line never reads "Working — Thinking…".
@@ -1468,6 +1488,7 @@ class App {
                             shell: { command, isRunning: true },
                         };
                         this.messages.push(msg);
+                        this.runToolMsgs.push(msg);
                         this.lastToolMsg = msg;
                         this.showWorking(`Working — ${(0, chat_1.toolIcon)(tool)} ${(0, chat_1.toolLabel)(tool)}`);
                         this.scrollToLatest();
@@ -1507,12 +1528,19 @@ class App {
                             },
                         };
                         this.messages.push(msg);
+                        this.runToolMsgs.push(msg);
                         this.lastToolMsg = msg;
                         this.showWorking(`Working — ${(0, chat_1.toolIcon)(tool)} ${(0, chat_1.toolLabel)(tool)}`);
                         this.scrollToLatest();
                         return;
                     }
                 }
+                // Tool PENUTUP (datang bersama jawaban final): TIDAK boleh membuat
+                // kartu tool + baris "Working…" baru di bawah jawaban — kartu
+                // followups / ✓ Task Complete / tombol UI-nya sendiri dirender oleh
+                // onToolResult (bug "selesai tapi masih working", laporan 2026-09-09).
+                if (tool === 'suggest_followups' || tool === 'task_completed' || tool === 'render_ui')
+                    return;
                 let preview = '';
                 try {
                     const parsed = JSON.parse(args);
@@ -1535,6 +1563,7 @@ class App {
                 if (id)
                     msg.toolCallId = id;
                 this.messages.push(msg);
+                this.runToolMsgs.push(msg);
                 this.lastToolMsg = msg;
                 this.showWorking(`Working — ${(0, chat_1.toolIcon)(tool)} ${(0, chat_1.toolLabel)(tool)}`);
                 this.scrollToLatest();
@@ -1607,7 +1636,17 @@ class App {
                     this.markDirty();
                     return;
                 }
-                if (this.lastToolMsg?.kind === 'tool') {
+                // Tool PENUTUP (suggest_followups/task_completed/render_ui): output
+                // teksnya TIDAK boleh menempel ke kartu tool LAMA — tool penutup
+                // tidak pernah membuat kartu sendiri (onToolCall early-return)
+                // sehingga `owner` masih menunjuk kartu tool terakhir run biasa;
+                // dulu `[task_completed] …` / `rendered button …` menempel DI BAWAH
+                // OUTPUT KARTU LAMA itu (regresi fix 2026-09-09, kelas bug sama dgn
+                // "web-shell muncul di tempat yang bukan tempatnya", fix eea7151).
+                // Blok render kartu penutup sendiri (group followups / tombol UI)
+                // ada DI BAWAH dan TETAP jalan — hanya preview yang di-skip.
+                const isClosingTool = tool === 'suggest_followups' || tool === 'task_completed' || tool === 'render_ui';
+                if (this.lastToolMsg?.kind === 'tool' && !isClosingTool) {
                     const lines = result
                         .split('\n')
                         .filter((l) => l.trim())
@@ -1677,6 +1716,11 @@ class App {
                     this.activeUiButton = w;
                     this.messages.push({ kind: 'ui', content: w.text, ui: w, ts: Date.now() });
                 }
+                // Tool penutup: kartunya (group followups / tombol UI) sudah
+                // dirender di atas — jangan hidupkan kembali baris "Working… ✓"
+                // setelah jawaban final, dan jangan tick checklist todo plan.
+                if (isClosingTool)
+                    return;
                 // A finished tool = one more plan step done: tick the next todo.
                 this.bumpTodo();
                 this.showWorking(`Working — ${(0, chat_1.toolIcon)(tool)} ${(0, chat_1.toolLabel)(tool)} ✓`);
@@ -1825,6 +1869,7 @@ class App {
             this.wasAbortedByUser = false;
             this.running = false;
             this.runStart = null;
+            this.runToolMsgs = [];
             // Re-snap to the REAL bottom: the transient Working bubble made the
             // max scroll several lines larger than the final transcript, so the
             // stored scroll could sit above the true max after the bubble is
@@ -2711,14 +2756,13 @@ class App {
         const n = this.recentToolCount();
         return n > 0 ? n + 2 : 0;
     }
-    /** Count of the most recent tool calls (≤ TOOL_PANEL_ROWS). */
+    /** Count of the most recent tool calls (≤ TOOL_PANEL_ROWS). Only tool
+     *  lines from the CURRENT run count — the panel must never resurrect the
+     *  previous run's shell/web-search cards (bug 2026-09-08: the old whole-
+     *  transcript scan re-showed them above the input during the new run's
+     *  THINKING phase, before any new tool existed). */
     recentToolCount() {
-        let n = 0;
-        for (let i = this.messages.length - 1; i >= 0 && n < TOOL_PANEL_ROWS; i--) {
-            if (this.messages[i].kind === 'tool')
-                n++;
-        }
-        return n;
+        return Math.min(this.runToolMsgs.length, TOOL_PANEL_ROWS);
     }
     /**
      * The recent-tool-calls panel content: one `· Tool args` line per call
@@ -2731,8 +2775,10 @@ class App {
             return [];
         const out = [];
         const inner = Math.max(8, cols - 4);
-        for (let i = this.messages.length - 1; i >= 0 && out.length < TOOL_PANEL_ROWS; i--) {
-            const m = this.messages[i];
+        // ONLY this run's tool lines (runToolMsgs), newest last — the panel is
+        // a LIVE indicator of the current work, not a history re-run.
+        for (let i = this.runToolMsgs.length - 1; i >= 0 && out.length < TOOL_PANEL_ROWS; i--) {
+            const m = this.runToolMsgs[i];
             if (m.kind !== 'tool')
                 continue;
             const args = (m.content.split('\n')[0] || '').trim();

package/install.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+#
+# VectorHead (agen-vektor) — one-shot installer for Debian/Ubuntu & Termux.
+#
+# What it does:
+#   1. Installs Node.js 20+ and npm when missing/too old
+#      (Termux: pkg; Debian/Ubuntu: apt, with NodeSource 20.x fallback when
+#       the distro ships an older node — e.g. Ubuntu 24.04 ships Node 18).
+#   2. Installs the agent globally:  npm i -g agen-vektor
+#   3. Verifies with `vector --version`.
+#
+# Usage:
+#   bash install.sh
+#
+set -euo pipefail
+
+MIN_MAJOR=20
+
+node_major() {
+  node -p 'Number(process.versions.node.split(".")[0])' 2>/dev/null || echo 0
+}
+
+need_node() {
+  command -v node >/dev/null 2>&1 || return 0
+  [ "$(node_major)" -lt "$MIN_MAJOR" ]
+}
+
+need_npm() {
+  ! command -v npm >/dev/null 2>&1
+}
+
+SUDO=""
+if [ "$(id -u 2>/dev/null || echo 1)" -ne 0 ] && command -v sudo >/dev/null 2>&1; then
+  SUDO="sudo"
+fi
+
+as_root() {
+  if [ -n "$SUDO" ]; then
+    $SUDO "$@"
+  else
+    "$@"
+  fi
+}
+
+say() { printf '\033[1;38;5;208m[vector]\033[0m %s\n' "$*"; }
+
+if ! need_node && ! need_npm; then
+  say "Node.js $(node -v) & npm sudah terpasang — skip instalasi sistem."
+else
+  if [ -n "${TERMUX_VERSION:-}" ] || [[ "${PREFIX:-}" == *com.termux* ]]; then
+    say "Termux terdeteksi — pkg update + install nodejs…"
+    pkg update -y
+    pkg install -y nodejs
+  elif command -v apt-get >/dev/null 2>&1; then
+    say "apt: update + install nodejs npm…"
+    export DEBIAN_FRONTEND=noninteractive
+    as_root apt-get update -y
+    as_root apt-get install -y curl ca-certificates gnupg nodejs npm || true
+    if need_node || need_npm; then
+      say "Node distro < ${MIN_MAJOR} atau npm hilang — pakai NodeSource ${MIN_MAJOR}.x…"
+      if [ -n "$SUDO" ]; then
+        curl -fsSL "https://deb.nodesource.com/setup_${MIN_MAJOR}.x" | $SUDO -E bash -
+      else
+        curl -fsSL "https://deb.nodesource.com/setup_${MIN_MAJOR}.x" | bash -
+      fi
+      as_root apt-get install -y nodejs
+    fi
+  else
+    say "Tidak ada apt-get — install Node.js ${MIN_MAJOR}+ manual dari https://nodejs.org lalu jalankan script ini lagi."
+    exit 1
+  fi
+fi
+
+if need_node || need_npm; then
+  say "Node/npm masih belum siap (node=$(command -v node >/dev/null && node -v || echo none), npm=$(command -v npm >/dev/null && echo yes || echo no))."
+  exit 1
+fi
+
+say "Install agen-vektor (global)…"
+npm install -g agen-vektor
+
+say "Selesai: $(vector --version 2>/dev/null || echo 'vector') — jalankan dengan perintah: vector"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agen-vektor",
-  "version": "0.3.15",
+  "version": "0.3.16",
   "description": "VectorHead (agen-vektor) — AI Coding Agent CLI/TUI for Linux & Termux. Multi-provider, tool calling, session, permission system.",
   "type": "commonjs",
   "bin": {
@@ -9,6 +9,7 @@
   "main": "dist/cli/index.js",
   "files": [
     "dist",
+    "install.sh",
     "README.md",
     "LICENSE"
   ],