agent-from-zero 0.34.2 → 0.35.0

package/dist/agent.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
+import { statusCommand } from "./status.js";
 import OpenAI from "openai"; // the API client
 import chalk from "chalk"; // terminal colors
 import readline from "node:readline/promises"; // promise-based terminal input
 import { createRequire } from "node:module"; // to read package.json for --version
 import { CONFIG, requireApiKey, saveGlobalSetting, PROJECT_SETTINGS_PATH, GLOBAL_SETTINGS_PATH } from "./config.js"; // provider-agnostic settings (.env loaded there)
 import { runLoop, TerminateReason, MAX_RETRIES, killAllSubAgents } from "./loop.js"; // the state machine
-import { buildSystemMessage } from "./prompt.js"; // the constitution + optional AGENT.md project memory
+import { buildSystemMessage, readProjectInstructions } from "./prompt.js"; // the constitution + optional AGENT.md project memory
 import { forgetFilesExcept, registerExternalTool } from "./tools.js"; // file-state reset + tool registration
 import { compactHistory, estimateHistoryTokens, COMPACT_AT } from "./context.js"; // for the manual /compact command
 import { newSessionId, saveSession, latestSession, listSessions, loadSession, setSessionTitle } from "./session.js"; // conversation persistence (project-local) + the /resume picker
@@ -14,6 +15,12 @@ import { initTelemetry, emit, statsReport } from "./telemetry.js"; // local-only
 import { runHooks } from "./hooks.js"; // SessionStart lifecycle hook
 import { connectMcpServers, listMcpServers, mcpActionsFor, runMcpAction } from "./mcp.js"; // external tool servers (MCP) + /mcp
 import { Judge } from "./judge.js"; // optional LLM permission classifier
+import { AutoMode } from "./auto.js";
+import { effortMenu, setEffort, selectedEffort } from "./effort.js";
+import { parseCli, applyCliOptions, readPrintPrompt, CliUsageError } from "./cli.js";
+import { reservePrintOutput, formatPrintResult } from "./print.js";
+import { FollowUpQueue } from "./follow-up.js";
+import { reviewDebugCommand } from "./auto-debug.js";
 import { isPlanMode, setPlanMode } from "./permissions.js"; // plan mode: research-only until the user approves a plan
 import { undoLast, clearUndo, sessionChanges } from "./undo.js"; // /undo + /diff: take back, or review, this session's writes
 import { clearTodos, getTodos, renderTodos } from "./todos.js"; // the agent's plan: /todos to view, cleared with the conversation
@@ -36,30 +43,46 @@ import { loadDurableJobs, startCronScheduler, stopCronScheduler, listJobs } from
 // package.json sits one level above both src/ (dev) and dist/ (built) — same path either way.
 const pkg = createRequire(import.meta.url)("../package.json");
 // ---- CLI arguments --------------------------------------------------------------
-// Tiny by design: a help text, a version, and a one-shot print mode. Anything
-// fancier belongs in settings files, not flags.
+// Process-local overrides share the same model/effort logic as the REPL.
 const USAGE = `mini-agent ${pkg.version} — a Claude Code-style CLI agent (any OpenAI-compatible model)
 
 Usage:
   mini-agent                 interactive session (REPL)
   mini-agent -r | --resume   continue the most recent session in this directory
   mini-agent -p "<task>"     one-shot: run a single task, print the result, exit
+  mini-agent exec "<task>"   alias for non-interactive print mode
+  cat file | mini-agent -p "<task>"  append piped text to the prompt
+  --prompt "<task>"          explicit prompt (instead of a positional prompt)
+  --model <id>               override the model for this run
+  --effort <level>           supported effort for this model, or default
+  --permission-mode <mode>  default | auto | bypassPermissions (this run only)
+  --dangerously-skip-permissions  alias for --permission-mode bypassPermissions
+  --output-format text|json  final answer or a JSON result (print mode only)
+  mini-agent --auto          review tool actions automatically (Jev or your current vendor)
   mini-agent -v | --version  print the version
   mini-agent -h | --help     this text
 
 Configuration (optional):
   ${GLOBAL_SETTINGS_PATH}   your defaults (model, baseURL, permissions, hooks)
   ${PROJECT_SETTINGS_PATH}   per-project rules — both layers apply, deny always wins
-  MINI_AGENT_API_KEY / MINI_AGENT_BASE_URL / MINI_AGENT_MODEL override everything.
+  MINI_AGENT_API_KEY / MINI_AGENT_BASE_URL / MINI_AGENT_MODEL override settings.
+  CLI model/effort flags override this run only; they never change saved settings.
+
+Print mode: options may precede or follow the prompt; use -- for literal flags.
+stdout contains only the final result; diagnostics go to stderr.
+Bypass skips approvals and AI review; hard denies, plan restrictions and hooks remain.
+Exit codes: 0 success, 1 execution failure, 2 invalid arguments, 130 interrupted.
 
 In a session, type /help for the in-session commands.`;
 // What we tell the user for every way a query can end. No raw stack traces.
 const EXIT_NOTES = {
+    [TerminateReason.ReviewLimit]: "Repeated automatic denials — stopped. Tell the agent how to proceed; prohibited actions were not executed.",
     [TerminateReason.CircuitBreaker]: "3 API failures in a row — stopping here instead of burning money.",
     [TerminateReason.RetryBudgetExhausted]: `${MAX_RETRIES} failed API calls in this query — giving up. Check your network and try again.`,
     [TerminateReason.RateLimitBudgetExhausted]: "The provider keeps rate-limiting us. Wait a minute, then try again.",
     [TerminateReason.ContextTooLong]: "The conversation no longer fits the model's context window, and compaction could not shrink it enough. Use /clear to start fresh.",
     [TerminateReason.CompactionFailed]: "Automatic compaction kept failing — stopping instead of looping. Use /clear to start fresh.",
+    [TerminateReason.ImageInputRejected]: "The provider rejected this image request. Check image limits and use /model to select a vision-capable model at your current vendor, then retry (images remain in the conversation).",
     [TerminateReason.FatalApiError]: "Unrecoverable API error — retrying would not help. Check your API key and request.",
     [TerminateReason.UserInterrupt]: "Interrupted — back at the prompt.",
 };
@@ -71,9 +94,13 @@ const SESSION_HELP = `commands:
   /model     switch model for THIS session: "/model" to pick from a list, "/model <name>" to set; "/model save <name>" to make it your default
   /stats     event counts for this session (local telemetry — nothing leaves this machine)
   /memory    show the durable facts the agent remembers about this project
+  /status    session usage and vendor account balance/cost
   /cost      tokens, cache hit rate and estimated spend this session (local)
   /mcp       list configured MCP servers + status; select one to authenticate / reconnect / disable
   /plan      toggle plan mode — research-only; the agent presents a plan you approve before any change
+  /effort [level]  list/select the current model’s supported reasoning effort
+  /auto      toggle auto mode — risky or uncertain actions still require approval
+  /auto debug [on|off|status]  inspect permission reviewer requests and replies
   /todos     show the agent's current task plan (it maintains one with todo_write on multi-step work)
   /bg        list background tasks this session (run_bash_background) and their status
   /team      list the agent team (spawn_teammate): each teammate's role, status, and pending inbox
@@ -88,39 +115,39 @@ const SESSION_HELP = `commands:
 
 keys (at the prompt):
   Ctrl+R     reveal the model's thinking for the last answer (collapsed behind a spinner by default)
-  Ctrl+T     reveal the folded tool-call trace for the last answer (read_file/search/… shown as a tally)
+  Ctrl+T     reveal the folded tool-call trace for the last answer (recent arguments and results)
   Tab        expand/collapse the most recent tool output`;
 // Injected when the user turns plan mode on, so the model knows the rules of the
 // mode it now lives in (the permission gate enforces them regardless).
 const PLAN_MODE_NOTICE = `[plan mode ON] Investigate this request using only read-only tools — read_file, search, and safe read-only shell (ls, cat, git status). Do NOT write files, edit, or run mutating commands; the permission gate will block them. When you have a concrete, ordered plan, call the exit_plan_mode tool with that plan. The user reviews and approves it before you make any change.`;
+let printOutput;
+let printCleanup;
 async function main() {
     // ---- Flag handling, before anything touches the network -----------------------
-    const argv = process.argv.slice(2); // everything after "mini-agent"
-    if (argv.includes("-v") || argv.includes("--version")) {
+    const cli = parseCli(process.argv.slice(2));
+    if (cli.version) {
         console.log(pkg.version); // just the number — script-friendly
         return;
     }
-    if (argv.includes("-h") || argv.includes("--help")) {
+    if (cli.help) {
         console.log(USAGE); // the full help text
         return;
     }
-    // Print mode: -p / --print takes the task from the remaining arguments.
-    const pIdx = argv.findIndex((a) => a === "-p" || a === "--print"); // where the flag sits
-    const printTask = pIdx >= 0 ? argv.slice(pIdx + 1).join(" ").trim() : null; // everything after it is the task
-    if (pIdx >= 0 && !printTask) {
-        console.error('Usage: mini-agent -p "<task>"'); // -p without a task is a usage error
-        process.exitCode = 2;
-        return;
+    applyCliOptions(cli);
+    const printTask = cli.print ? await readPrintPrompt(cli.prompt, process.stdin, !!process.stdin.isTTY) : null;
+    if (cli.print) {
+        printOutput = reservePrintOutput();
+        chalk.level = 0; // no terminal escapes in script diagnostics
     }
     // Interactive sessions default to the Ink REPL (a pinned input box, the
     // conversation scrolling above it — like Claude Code). It does its OWN full
     // setup (MCP, skills, judge, cost, hooks, session), so we hand off here before
     // the readline path below ever runs. Print mode (-p) is a non-interactive
-    // one-shot that streams to stdout, so it stays on the readline path. Set
+    // one-shot that writes its final result to stdout, so it stays on this path. Set
     // MINI_AGENT_NO_INK=1 to use the readline REPL below instead (a simpler
     // reference front-end, and an escape hatch for terminals Ink misbehaves in).
     if (printTask === null && process.env.MINI_AGENT_NO_INK !== "1") {
-        await launchInk({ resume: argv.includes("-r") || argv.includes("--resume") });
+        await launchInk({ resume: cli.resume });
         return;
     }
     requireApiKey(); // fail fast with instructions, not a stack trace from inside the SDK
@@ -132,7 +159,8 @@ async function main() {
     });
     // The system message is built ONCE per session: stable prefix = cache hits
     // on every request. Nothing session-specific may sneak into it later.
-    const systemMessage = buildSystemMessage();
+    const projectInstructions = readProjectInstructions();
+    const systemMessage = buildSystemMessage(projectInstructions);
     let messages = [{ role: "system", content: systemMessage }]; // the whole conversation lives here, across turns
     // ---- Session persistence ---------------------------------------------------------
     // Every conversation is snapshotted to .mini-agent/sessions/ after each turn;
@@ -141,7 +169,7 @@ async function main() {
     let sessionId = newSessionId(); // this session's identity (and file name)
     let initialTitle; // only a resumed session has one already
     const sessionStartedAt = Date.now(); // for the status line's elapsed clock
-    if (argv.includes("-r") || argv.includes("--resume")) {
+    if (cli.resume) {
         const prev = latestSession(); // newest snapshot in this directory, if any
         if (prev) {
             messages.push(...prev.messages); // the old conversation joins the fresh constitution
@@ -161,6 +189,13 @@ async function main() {
     // finish before the first model call so the tools appear in the manual. A
     // server that fails to start is skipped, never fatal.
     const disconnectMcp = await connectMcpServers();
+    if (cli.print)
+        printCleanup = () => {
+            stopCronScheduler();
+            killAllBackground();
+            killAllSubAgents();
+            disconnectMcp();
+        };
     process.on("exit", disconnectMcp); // best-effort cleanup of server subprocesses
     process.on("exit", killAllBackground); // Day 37: SIGKILL any background job (dev server, slow install) so it never outlives the agent as an orphan
     process.on("exit", killAllSubAgents); // mark any still-running sub-agents as killed so they don't leave pending promises
@@ -172,9 +207,12 @@ async function main() {
         console.log(chalk.dim(`(cron: ${cronCount} durable job${cronCount !== 1 ? "s" : ""} loaded)`));
     startCronScheduler();
     // The optional LLM permission judge, built once if a settings file enabled it.
-    const judge = CONFIG.judge.enabled ? new Judge(client, CONFIG.judge.model || CONFIG.model) : undefined;
+    const judge = CONFIG.judge.enabled && !CONFIG.bypassPermissions ? new Judge(client, CONFIG.judge.model || CONFIG.model) : undefined;
+    const autoMode = new AutoMode(client, { projectInstructions });
+    for (const notice of autoMode.startupNotices())
+        console.log(chalk.dim(notice));
     if (judge)
-        console.log(chalk.dim(`(permission judge on — model ${CONFIG.judge.model || CONFIG.model})`));
+        console.log(chalk.dim(`(permission judge on — ${autoMode.backend})`));
     // The remember tool: let the model save durable facts to long-term memory.
     // Registered like any tool, so it flows through the same permission gate.
     registerExternalTool(rememberTool);
@@ -220,13 +258,17 @@ async function main() {
             controller.abort(); // cancel the in-flight request
         });
         messages.push({ role: "user", content: printTask }); // the single task
+        autoMode.recordRequest(printTask);
         const result = await runLoop(messages, {
             client,
             model: CONFIG.model,
+            quiet: true, // final result only; no spinner, reasoning or intermediate prose
             signal: controller.signal,
             isInterrupted: () => interrupted,
             subAgentModel: CONFIG.subAgentModel, // delegated work may run on a different tier
             judge, // auto-allow clearly-safe commands even unattended (safer than blanket AUTO_APPROVE)
+            autoMode,
+            canPrompt: false,
             // Print mode never prompts: unattended means nobody can say yes.
             // MINI_AGENT_AUTO_APPROVE=1 still works for scripted use; hard denies
             // were enforced in permissions.ts long before this runs.
@@ -238,14 +280,18 @@ async function main() {
             },
         });
         saveSession(sessionId, CONFIG.model, messages); // print-mode runs are resumable too
+        await runHooks("SessionEnd", {});
         emit("agent_session_end"); // close the books
+        printOutput.write(formatPrintResult(cli.outputFormat, {
+            sessionId, model: CONFIG.model, effort: selectedEffort(CONFIG.model), result, usage: costMeter.snapshot(),
+        }));
         if (result.reason !== TerminateReason.Done) {
             console.error(chalk.yellow(EXIT_NOTES[result.reason])); // human note on stderr
             if (result.detail)
                 console.error(chalk.dim(result.detail.slice(0, 300))); // raw detail on stderr
             process.exitCode = result.reason === TerminateReason.UserInterrupt ? 130 : 1; // scripts can branch on this
         }
-        return; // the answer itself already streamed to stdout
+        return; // the outer finally closes scheduler/MCP handles so scripts can exit
     }
     // ---- Interactive session (REPL) -------------------------------------------------
     // The welcome box: who am I, which model and host am I on, and the basics.
@@ -260,6 +306,7 @@ async function main() {
     // Bonus: in a terminal, lines typed while a task runs queue up as the next
     // commands instead of vanishing.
     const pendingLines = []; // lines that arrived before anyone asked
+    const followUps = new FollowUpQueue();
     const lineWaiters = []; // askers waiting for a line
     let stdinDone = false; // has stdin ended?
     const history = []; // past prompts, for ↑/↓ recall in the editor
@@ -327,13 +374,34 @@ async function main() {
     };
     process.on("SIGINT", onSigint); // covers non-TTY runs
     rl.on("SIGINT", onSigint); // covers TTY raw mode, where readline swallows the signal itself
-    // Ask the human to approve a dangerous action — shares the session readline.
+    // Menus keep a text editor for follow-ups, sharing the session readline.
+    const enqueuePromptFollowUp = async (text) => {
+        if (!running) {
+            pendingLines.push(text);
+            return true;
+        }
+        const hook = await runHooks("UserPromptSubmit", { prompt: text });
+        if (hook.block)
+            return false;
+        const { augmented } = expandMentions(text);
+        followUps.enqueue({ text, content: augmented + (hook.stdout ? `\n\n[context added by a UserPromptSubmit hook]\n${hook.stdout}` : "") });
+        return true;
+    };
+    const select = async (options) => {
+        editing = true;
+        try {
+            return await promptSelect(rl, options, process.stdin, enqueuePromptFollowUp);
+        }
+        finally {
+            editing = false;
+        }
+    };
     // Fail closed: in a non-interactive session nobody can say yes, so the
     // answer is no. MINI_AGENT_AUTO_APPROVE=1 bypasses the QUESTION, but hard
     // denies were already enforced in permissions.ts before we get here.
     const confirm = async (question, toolName) => {
         console.log(chalk.yellow(`\n⚠ approval needed — ${question}`)); // always show what is being asked
-        if (process.env.MINI_AGENT_AUTO_APPROVE === "1") {
+        if (!autoMode.enabled && process.env.MINI_AGENT_AUTO_APPROVE === "1") {
             console.log(chalk.dim("  auto-approved (MINI_AGENT_AUTO_APPROVE=1)")); // bypass mode — say so out loud
             return true; // approve without asking
         }
@@ -344,9 +412,10 @@ async function main() {
         // Selecting beats typing: ↑/↓ + Enter instead of "type y/N". The middle
         // option lets the user stop being asked about this tool for the session.
         const allowLabel = toolName ? `Yes, and don't ask again for ${toolName} this session` : "Yes, and don't ask again this session";
-        const choice = await promptSelect(rl, ["Yes", allowLabel, "No — let me tell the agent what to do instead"]);
-        const approved = choice === 0 || choice === 1;
-        if (choice === 1 && toolName) {
+        const options = autoMode.enabled ? ["Yes, once", "No — let me tell the agent what to do instead"] : ["Yes", allowLabel, "No — let me tell the agent what to do instead"];
+        const choice = await select(options);
+        const approved = choice === 0 || (!autoMode.enabled && choice === 1);
+        if (!autoMode.enabled && choice === 1 && toolName) {
             CONFIG.permissions.allow.push(`tool:${toolName}`); // remember the grant for the rest of the session
             console.log(chalk.dim(`  won't ask again for ${toolName} this session`));
         }
@@ -359,7 +428,13 @@ async function main() {
     const askUser = async (questions) => {
         if (!process.stdin.isTTY)
             return null;
-        return promptForm(rl, questions);
+        editing = true;
+        try {
+            return await promptForm(rl, questions, process.stdin, enqueuePromptFollowUp);
+        }
+        finally {
+            editing = false;
+        }
     };
     // Ask the endpoint what models it serves (the OpenAI-compatible /models API).
     // Empty list on any failure — not every endpoint implements it, and a failed
@@ -410,7 +485,7 @@ async function main() {
             return;
         }
         console.log(chalk.dim("switch model (this session):"));
-        const choice = await promptSelect(rl, formatModelChoices(models, CONFIG.model));
+        const choice = await select(formatModelChoices(models, CONFIG.model));
         if (choice < 0 || models[choice] === CONFIG.model) {
             console.log(chalk.dim("(model unchanged)"));
             return;
@@ -443,14 +518,14 @@ async function main() {
             console.log(chalk.dim(`  ${label}`));
         if (!process.stdin.isTTY)
             return;
-        const choice = await promptSelect(rl, labels.map((l) => l.replace(/  ·  /g, " — ")));
+        const choice = await select(labels.map((l) => l.replace(/  ·  /g, " — ")));
         if (choice < 0) {
             console.log(chalk.dim("(cancelled)"));
             return;
         }
         const server = servers[choice];
         const actions = mcpActionsFor(server);
-        const actionChoice = await promptSelect(rl, actions.map((a) => a.label));
+        const actionChoice = await select(actions.map((a) => a.label));
         if (actionChoice < 0) {
             console.log(chalk.dim("(cancelled)"));
             return;
@@ -464,6 +539,41 @@ async function main() {
     };
     // Handle a /slash command. Returns true if the line was a command.
     const handleCommand = async (line) => {
+        if (line === "/status" || line.startsWith("/status ")) {
+            console.log(await statusCommand(line, costMeter));
+            return true;
+        }
+        if (line.startsWith("/skills "))
+            line = `/skill ${line.slice(8).trim()}`;
+        if (line === "/effort" || line.startsWith("/effort ")) {
+            const target = CONFIG.model;
+            const value = line.slice("/effort".length).trim();
+            if (value)
+                console.log(chalk.dim(setEffort(target, value)));
+            else {
+                const menu = effortMenu(target);
+                console.log(chalk.dim(menu.header));
+                if (menu.values.length) {
+                    if (!process.stdin.isTTY)
+                        console.log(menu.labels.join("\n"));
+                    else {
+                        const selected = await select(menu.labels);
+                        if (selected >= 0)
+                            console.log(chalk.dim(setEffort(target, menu.values[selected])));
+                    }
+                }
+            }
+            return true;
+        }
+        const debug = reviewDebugCommand(line);
+        if (debug !== null) {
+            console.log(chalk.dim(debug));
+            return true;
+        }
+        if (line === "/auto") {
+            console.log(chalk.dim(autoMode.toggle()));
+            return true;
+        }
         // /model takes an optional argument (/model <name>), so it can't be a plain
         // switch case — handle it before the exact-match switch.
         if (line === "/model" || line.startsWith("/model ")) {
@@ -484,11 +594,12 @@ async function main() {
                 return true;
             }
             messages.push({ role: "user", content: `Run the "${s.name}" skill.\n\n${skillInstructions(s)}` });
+            autoMode.recordRequest(`Run the "${s.name}" skill.`);
             console.log(chalk.dim(`(running skill: ${s.name})`));
             running = true;
             interrupted = false;
             controller = new AbortController();
-            const r = await runLoop(messages, { client, model: CONFIG.model, signal: controller.signal, isInterrupted: () => interrupted, confirm, askUser, subAgentModel: CONFIG.subAgentModel, judge });
+            const r = await runLoop(messages, { client, model: CONFIG.model, signal: controller.signal, isInterrupted: () => interrupted, confirm, askUser, followUps, onFollowUp: (text) => console.log(sentMessage(text)), subAgentModel: CONFIG.subAgentModel, judge, autoMode, canPrompt: !!process.stdin.isTTY });
             running = false;
             saveSession(sessionId, CONFIG.model, messages);
             if (r.reason !== TerminateReason.Done)
@@ -517,6 +628,7 @@ async function main() {
                 console.log(chalk.dim(SESSION_HELP)); // the command reference
                 return true;
             case "/clear":
+                autoMode.clearRequests();
                 messages = [{ role: "system", content: systemMessage }]; // drop everything but the constitution
                 forgetFilesExcept([]); // the file read-state belongs to the conversation — clear it too
                 clearUndo(); // a fresh conversation should not undo the previous one's writes
@@ -649,6 +761,7 @@ async function main() {
                     return true;
                 }
                 messages = [{ role: "system", content: systemMessage }, ...chosen.messages]; // fresh constitution + saved turns
+                autoMode.clearRequests(); // old transcripts do not preserve trustworthy input provenance
                 sessionId = chosen.id; // keep appending to the resumed session's file
                 titleAttempted = false; // a resumed session without a title gets one on its next message
                 pendingTitle = chosen.title;
@@ -748,7 +861,8 @@ async function main() {
             console.log(""); // one blank line separates the previous answer from the prompt
             footer = statusLine(CONFIG.model, path.basename(process.cwd()), gitBranch(), ctxPct, costMeter.cost(), Date.now() - sessionStartedAt); // status pinned below the prompt
         }
-        const line = (await readUserLine(framedPrompt(isPlanMode()), footer, sentMessage)).trim(); // next input (echoed as a sent message above), or "exit" on EOF
+        const prompt = autoMode.enabled && !isPlanMode() ? chalk.yellow("auto ❯ ") : framedPrompt(isPlanMode());
+        const line = (await readUserLine(prompt, footer, sentMessage)).trim(); // next input, or "exit" on EOF
         if (!line)
             continue; // empty line — just re-prompt
         if (line === "exit" || line === "quit") {
@@ -795,6 +909,7 @@ async function main() {
             }
         }
         messages.push({ role: "user", content: augmented + injected }); // the new turn (with any attached files + hook context) joins the shared history
+        autoMode.recordRequest(line); // original human text, before file/hook attachments
         clearReasoning(); // Ctrl+R should reveal THIS turn's thinking, not the previous answer's
         clearToolCalls(); // ...and Ctrl+T should reveal THIS turn's tool calls
         running = true; // Ctrl+C now means "interrupt the task"
@@ -807,8 +922,12 @@ async function main() {
             isInterrupted: () => interrupted, // for stopping between steps
             confirm, // for permission prompts
             askUser, // the multi-question form the model can pop
+            followUps,
+            onFollowUp: (text) => console.log(sentMessage(text)),
             subAgentModel: CONFIG.subAgentModel, // delegated work may run on a different tier
             judge, // optional LLM classifier for the "ask" middle ground
+            autoMode,
+            canPrompt: !!process.stdin.isTTY,
         });
         running = false; // back at the prompt — Ctrl+C means "exit" again
         saveSession(sessionId, CONFIG.model, messages, pendingTitle); // snapshot after every turn — crash-safe by construction
@@ -842,4 +961,10 @@ async function main() {
     tuiCleanup(); // restore terminal
     console.log(chalk.dim("bye.")); // a clean goodbye
 }
-main(); // kick everything off
+main().catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = error instanceof CliUsageError ? 2 : 1;
+}).finally(() => {
+    printCleanup?.();
+    printOutput?.restore();
+});

package/dist/auto-budget.js

@@ -0,0 +1,15 @@
+// One object per root task, shared by descendants and interrupt/resume. An
+// exhausted budget is sticky: a late successful worker cannot reopen the gate.
+export class AutoReviewBudget {
+    consecutive = 0;
+    total = 0;
+    stopped = false;
+    get exhausted() { return this.stopped; }
+    deny() {
+        this.total++;
+        this.consecutive++;
+        this.stopped ||= this.consecutive >= 3 || this.total >= 20;
+    }
+    executed() { if (!this.stopped)
+        this.consecutive = 0; }
+}

package/dist/auto-context.js

@@ -0,0 +1,125 @@
+import { execFileSync } from "node:child_process";
+const HISTORY_BYTES = 8000;
+const RESULT_BYTES = 2000;
+function resultEvidence(result) {
+    if (!result)
+        return {};
+    if (Buffer.byteLength(result, "utf8") <= RESULT_BYTES) {
+        try {
+            const value = JSON.parse(result);
+            if (value !== null && typeof value === "object")
+                return { resultData: value };
+        }
+        catch { /* prose is not structured evidence */ }
+    }
+    return { resultDataOmitted: true };
+}
+function projectInput(tool, args) {
+    try {
+        const value = JSON.parse(args);
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return value;
+        if (tool === "read_file")
+            return { path: value.path };
+        if (tool === "search")
+            return { pattern: value.pattern, path: value.path, file_glob: value.file_glob };
+        if (tool === "run_bash" || tool === "run_bash_background")
+            return { command: value.command };
+        return value; // retain edits, writes and opaque inputs without guessing relevance
+    }
+    catch {
+        return { malformedArguments: args };
+    }
+}
+// This projection deliberately cannot create user authorization. Only completed
+// tool-call/result pairs contribute context; queued sibling actions, assistant
+// prose and synthetic user-role notifications are excluded. Small structured
+// results retain target/effect evidence; arbitrary prose and large results do not.
+// User requests/project rules/current action are separately kept in full.
+export function reviewHistory(messages, inherited) {
+    const results = new Map();
+    for (const message of messages)
+        if (message.role === "tool") {
+            results.set(message.tool_call_id, typeof message.content === "string" ? message.content : "");
+        }
+    const actions = [...(inherited?.actions ?? [])];
+    for (const message of messages) {
+        if (message.role !== "assistant")
+            continue;
+        for (const call of message.tool_calls ?? []) {
+            if (call.type !== "function" || !results.has(call.id))
+                continue;
+            const result = results.get(call.id);
+            actions.push({ callId: call.id, tool: call.function.name, input: projectInput(call.function.name, call.function.arguments),
+                outcome: /^\[permission\] Auto-denied/.test(result) ? "auto_denied" : /^\[follow-up\]/.test(result) ? "skipped" : /^\[(?:permission|hook)\]/.test(result) ? "denied" : /^\[error\]/.test(result) ? "failed" : "returned", ...resultEvidence(result) });
+        }
+    }
+    let bytes = 0;
+    let start = actions.length;
+    while (start > 0) {
+        const size = Buffer.byteLength(JSON.stringify(actions[start - 1]), "utf8");
+        if (bytes + size > HISTORY_BYTES)
+            break; // keep a contiguous suffix, not misleading gaps
+        bytes += size;
+        start--;
+    }
+    return { actions: actions.slice(start), omittedActions: (inherited?.omittedActions ?? 0) + start };
+}
+// Only identity facts cross the new policy boundary. Small JSON is not trusted
+// simply because it is small. Keep nesting for provenance, discard prose and
+// instruction-shaped fields; these observations still cannot authorize actions.
+export function ruleHistory(history) {
+    const project = (value, depth = 0) => {
+        if (depth > 6 || !value || typeof value !== "object")
+            return undefined;
+        if (Array.isArray(value)) {
+            const entries = value.slice(0, 30).map((v) => project(v, depth + 1)).filter((v) => v !== undefined);
+            return entries.length ? entries : undefined;
+        }
+        const facts = {};
+        for (const [key, item] of Object.entries(value)) {
+            if (/^(id|user_id|channel_id|name|display_name|real_name|email|username)$/.test(key)
+                && typeof item === "string" && item.length <= 200 && !/[\r\n]/.test(item))
+                facts[key] = item;
+            else if (/^(results|users|members|data|profile)$/.test(key)) {
+                const nested = project(item, depth + 1);
+                if (nested !== undefined)
+                    facts[key] = nested;
+            }
+        }
+        return Object.keys(facts).length ? facts : undefined;
+    };
+    return { ...history, actions: history.actions.map(({ resultData, ...action }) => {
+            const facts = project(resultData);
+            return { ...action, ...(facts === undefined ? {} : { resultData: facts }),
+                ...(resultData !== undefined && JSON.stringify(facts) !== JSON.stringify(resultData) ? { resultDataOmitted: true } : {}) };
+        }) };
+}
+// Read once at startup. Later tool edits to git config must not expand the set
+// of established destinations. Do not send URL credentials/query tokens.
+export function startupRemotes(cwd) {
+    try {
+        const output = execFileSync("git", ["config", "--get-regexp", "^remote\\..*\\.(url|pushurl)$"], { cwd, encoding: "utf8", timeout: 1000, stdio: ["ignore", "pipe", "ignore"] });
+        return output.trim().split("\n").flatMap((line) => {
+            const entry = /^remote\.(.+)\.(url|pushurl) (.+)$/.exec(line);
+            if (!entry)
+                return [];
+            let value = entry[3];
+            try {
+                const url = new URL(value);
+                url.username = "";
+                url.password = "";
+                url.search = "";
+                url.hash = "";
+                value = url.toString();
+            }
+            catch {
+                value = value.replace(/^[^@/]+@/, "");
+            }
+            return [{ name: entry[1], kind: entry[2] === "pushurl" ? "push" : "fetch", url: value }];
+        });
+    }
+    catch {
+        return [];
+    }
+}