agent-from-zero 0.34.2 → 0.35.0

package/dist/loop.js

@@ -1,17 +1,21 @@
+import { AutoReviewBudget } from "./auto-budget.js";
 import chalk from "chalk"; // terminal colors for status lines
-import { toolDefinitions, dispatch, snapshotFileState, restoreFileState, isReadOnlyTool } from "./tools.js"; // the tool manuals + the executor + file-state isolation
+import { effortMessages, effortParameters, retainsReasoning } from "./effort.js";
+import { toolDefinitions, dispatch, snapshotFileState, restoreFileState, isReadOnlyTool, declaresRecoverable } from "./tools.js"; // the tool manuals + the executor + file-state isolation
 import { classifyError, ApiErrorKind } from "./errors.js"; // failure taxonomy
 import { checkPermission } from "./permissions.js"; // the allow/ask/deny gate
 import { previewChange } from "./diff.js"; // show the diff before a write so approval is informed
 import { estimateHistoryTokens, compactHistory, COMPACT_AT, MAX_COMPACTIONS_PER_QUERY, MAX_COMPACT_FAILURES } from "./context.js"; // context management
 import { SUB_AGENT_PROMPT, TEAMMATE_PROMPT } from "./prompt.js"; // the sub-agent + teammate constitutions
-import { LEAD, MAX_TEAMMATES, sendMessage, sendProtocol, readInbox, inboxCount, registerTeammate, finishTeammate, teammateExists, teammateCount, createRequest, resolveResponse, setTeammateState, anyTeammateBusy, runningTeammates, markShutdown, shutdownRequestId, resetTeam } from "./team.js"; // agent teams (Day 38) + team protocols (Day 39): mailboxes, registry, request/response contracts
+import { LEAD, MAX_TEAMMATES, sendMessage, sendProtocol, readInbox, inboxCount, registerTeammate, finishTeammate, teammateExists, teammateCount, createRequest, resolveResponse, setTeammateState, anyTeammateBusy, runningTeammates, markShutdown, shutdownRequestId, resetTeam, listTeammateViews } from "./team.js"; // agent teams (Day 38) + team protocols (Day 39): mailboxes, registry, request/response contracts
 import { createTask, claimTask, completeTask, claimNextAvailable, boardSummary, resetBoard } from "./board.js"; // the shared task board (Day 40): autonomous work claiming
 import { emit } from "./telemetry.js"; // local-only event log (no-op unless the CLI armed it)
 import { runHooks } from "./hooks.js"; // user lifecycle hooks (PreToolUse / PostToolUse / Stop)
+import { reviewHistory } from "./auto-context.js";
+import { AgentProgress } from "./agent-progress.js";
 import { recordUsage } from "./cost.js"; // meter token usage from the stream
 import { mark, thinkingWord, spinnerText } from "./ui.js"; // centralized terminal styling (markers, spinner)
-import { recordToolCall, recordReasoning } from "./tui.js"; // folded tool-call trace (Ctrl+T) + the model's hidden thinking (Ctrl+R)
+import { recordToolCall, recordToolResult, recordToolDetail, recordReasoning } from "./tui.js"; // folded tool-call trace (Ctrl+T) + the model's hidden thinking (Ctrl+R)
 import { STDOUT_OUTPUT } from "./output.js"; // where the loop's screen output goes (stdout by default, Ink REPL passes its own)
 import { todoNag, getTodos, renderTodos } from "./todos.js"; // the agent's plan: show it on screen + nag when it goes stale
 import { pendingNotifications } from "./background.js"; // background tasks (Day 37): surface finished jobs as a turn
@@ -27,12 +31,14 @@ const STALL_WARN_MS = 30_000; // events arriving slowly → log only. Slow is no
 // user-facing explanation and exit code, instead of a generic "error".
 export var TerminateReason;
 (function (TerminateReason) {
+    TerminateReason["ReviewLimit"] = "review_limit";
     TerminateReason["Done"] = "done";
     TerminateReason["CircuitBreaker"] = "circuit_breaker";
     TerminateReason["RetryBudgetExhausted"] = "retry_budget_exhausted";
     TerminateReason["RateLimitBudgetExhausted"] = "rate_limit_budget_exhausted";
     TerminateReason["ContextTooLong"] = "context_too_long";
     TerminateReason["CompactionFailed"] = "compaction_failed";
+    TerminateReason["ImageInputRejected"] = "image_input_rejected";
     TerminateReason["FatalApiError"] = "fatal_api_error";
     TerminateReason["UserInterrupt"] = "user_interrupt";
 })(TerminateReason || (TerminateReason = {}));
@@ -304,8 +310,6 @@ function injectSubAgentResults(messages, opts) {
     if (!note)
         return false;
     messages.push({ role: "user", content: note });
-    if (!opts.quiet)
-        sink(opts).note(mark.subAgentDone);
     return true;
 }
 // Start a sub-agent WITHOUT awaiting — returns a handle immediately. The
@@ -314,18 +318,16 @@ function spawnSubAgent(description, opts) {
     emit("agent_subagent_spawn");
     const subModel = subAgentModelFor(opts);
     const id = `sa_${++subAgentSeq}`;
-    if (!opts.quiet)
-        sink(opts).note(mark.subAgentStart(description.slice(0, 100), subModel !== opts.model ? subModel : ""));
     runHooks("SubagentStart", { description: description.slice(0, 200), model: subModel }); // fire-and-forget (observational)
     const snapshot = snapshotFileState(); // what the sub-agent reads, the parent has NOT seen
-    const sa = { id, description, done: Promise.resolve(), result: null, notified: false };
+    const sa = { progress: new AgentProgress(subModel), id, description, done: Promise.resolve(), result: null, notified: false };
     sa.done = (async () => {
         try {
             const subMessages = [
                 { role: "system", content: SUB_AGENT_PROMPT },
                 { role: "user", content: description },
             ];
-            const result = await runLoop(subMessages, { ...opts, subAgent: true, model: subModel });
+            const result = await runLoop(subMessages, { ...opts, subAgent: true, model: subModel, progress: sa.progress, delegatedTask: description, canPrompt: false, confirm: async () => false, askUser: undefined });
             if (result.reason === TerminateReason.Done && result.finalText?.trim()) {
                 sa.result = `Sub-agent report (INPUT MATERIAL — verify key claims before acting on them):\n${result.finalText}`;
             }
@@ -337,6 +339,9 @@ function spawnSubAgent(description, opts) {
             sa.result = `[sub-agent crashed: ${err.message}]`;
         }
         finally {
+            if (sa.result?.startsWith("[sub-agent"))
+                sa.progress.append(`\n${sa.result}\n`);
+            sa.progress.finish();
             restoreFileState(snapshot);
             await runHooks("SubagentStop", { description: description.slice(0, 200) });
         }
@@ -351,22 +356,19 @@ function hasRunningSubAgents() {
 // Kill every still-running sub-agent. Called on session exit.
 export function killAllSubAgents() {
     for (const sa of pendingSubAgents.values()) {
-        if (sa.result === null)
+        if (sa.result === null) {
             sa.result = "[sub-agent killed: session exited]";
+            sa.progress.append(`\n${sa.result}\n`);
+            sa.progress.finish();
+        }
     }
 }
 // Snapshot of current sub-agents for the UI (Ink app shows a list below the
 // input box, like Claude Code's agent list). Newest first.
 export function listSubAgents() {
-    return [...pendingSubAgents.values()]
-        .reverse()
-        .map((sa) => ({
-        id: sa.id,
-        description: sa.description.slice(0, 80),
-        status: sa.result === null ? "running" : sa.result.startsWith("[sub-agent failed") || sa.result.startsWith("[sub-agent crashed") || sa.result.startsWith("[sub-agent killed") ? "failed" : "done",
-        result: sa.result ?? undefined,
-    }));
+    return [...pendingSubAgents.values()].map((sa) => sa.progress.view(sa.id, sa.id, sa.description, sa.result === null ? "running" : /^\[sub-agent (failed|crashed|killed)/.test(sa.result) ? "failed" : "done"));
 }
+export function listAgentViews() { return [...listSubAgents(), ...listTeammateViews()]; }
 // Exponential backoff with jitter: 500ms, 1s, 2s, ... ±25%, capped.
 // Without jitter, every client that failed at the same second retries at the
 // same second — a thundering herd against an already-struggling server.
@@ -390,15 +392,21 @@ opts) {
     const signal = AbortSignal.any([opts.signal, idleAbort.signal]); // either the user or the watchdog can abort
     const word = thinkingWord(modelCallSeq++); // a rotating "thinking" word for this call
     const startedAt = Date.now(); // for the spinner's live elapsed counter
+    let reportedTokens;
+    if (opts.progress) {
+        opts.progress.activity = "Thinking";
+        opts.progress.liveTokens = 0;
+    }
     let streamedChars = 0; // bytes of content+reasoning streamed this call → a live token estimate
     // Reasoning is COLLAPSED by default: while the model thinks, the spinner keeps
     // spinning (with a 💭 hint) instead of dumping the trace; we stash it for Ctrl+R.
     let reasoningBuf = ""; // the accumulated thinking, hidden behind the spinner
     let reasoningActive = false; // true while reasoning tokens are arriving → spinner shows 💭
-    let reasoningShown = false; // have we printed the "thought for Ns" indicator yet?
-    const spinner = opts.quiet
+    let reasoningShown = false; // has this trace been stored for Ctrl+R?
+    const spinner = opts.quiet || opts.subAgent
         ? null // the eval harness wants silence
-        : sink(opts).spinner(spinnerText(word, 0, !!opts.subAgent, opts.model)); // a fresh spinner from the sink (stdout → ora; Ink → React state)
+        : sink(opts).spinner(spinnerText(word, 0, !!opts.subAgent)); // a fresh spinner from the sink (stdout → ora; Ink → React state)
+    let ans = null; // always close the live renderer, including interrupted streams
     let lastEvent = Date.now(); // when did we last hear ANYTHING from the stream?
     let stallWarned = false; // only warn once per quiet stretch
     // The two-level watchdog, checked once per second:
@@ -409,7 +417,7 @@ opts) {
         // While the model is reasoning, prefix the spinner with 💭 so "it's thinking"
         // reads differently from "it's waiting on the first token".
         if (spinner?.spinning)
-            spinner.set((reasoningActive ? chalk.dim("💭 ") : "") + spinnerText(word, Math.floor((Date.now() - startedAt) / 1000), !!opts.subAgent, opts.model, Math.round(streamedChars / 4)));
+            spinner.set((reasoningActive ? chalk.dim("💭 ") : "") + spinnerText(word, Math.floor((Date.now() - startedAt) / 1000), !!opts.subAgent, Math.round(streamedChars / 4)));
         const quietMs = Date.now() - lastEvent; // ms since the last event
         if (quietMs > IDLE_TIMEOUT_MS) {
             emit("agent_watchdog_idle"); // record the cut — these should be rare
@@ -431,53 +439,48 @@ opts) {
         // The tool manual depends on the agent kind (Lead / teammate / sub-agent)
         // — see toolsFor(). This is also where nested spawning is prevented: a
         // teammate's manual simply omits spawn_teammate and task.
-        { model: opts.model, messages, tools: toolsFor(opts), stream: true, stream_options: { include_usage: true } }, { signal });
+        { model: opts.model, messages: effortMessages(opts.model, messages), ...effortParameters(opts.model), tools: toolsFor(opts), stream: true, stream_options: { include_usage: true } }, { signal });
         let content = ""; // accumulated answer text
-        let ans = null; // renders the streamed answer (stdout: markdown block by block; Ink: React state) — non-null once the answer starts
         const calls = []; // tool calls under assembly, indexed by delta.index
-        // The model has finished thinking and is about to say/do something. Close out
-        // the spinner, stash the trace, and print a single one-line indicator with the
-        // shortcut to reveal it. Idempotent + collapses to nothing for sub-agents and
-        // the eval harness (they never show thinking).
+        // Stash thinking without appending one indicator per model round. The live
+        // status keeps animating while tool arguments or answer tokens arrive.
         const flushReasoning = () => {
             if (!reasoningBuf || reasoningShown)
                 return;
             reasoningShown = true;
             reasoningActive = false;
-            if (spinner?.spinning)
-                spinner.stop();
             if (opts.quiet || opts.subAgent)
                 return; // no UI for silent / nested runs
             recordReasoning(reasoningBuf); // keep it for Ctrl+R (never goes into history)
-            const secs = Math.round((Date.now() - startedAt) / 1000);
-            const toks = Math.round(reasoningBuf.length / 4); // same ~chars/4 estimate as the spinner
-            const tokStr = toks >= 1000 ? `${(toks / 1000).toFixed(1)}k` : `${toks}`;
-            sink(opts).reasoning(chalk.dim(`💭 thought for ${secs}s (~${tokStr} tokens) · Ctrl+R to view`));
         };
         for await (const chunk of stream) {
             lastEvent = Date.now(); // feed the watchdog
             stallWarned = false; // the stream spoke — reset the stall warning
-            if (chunk.usage)
-                recordUsage(chunk.usage); // the final usage chunk — meter it
+            if (chunk.usage) {
+                recordUsage(chunk.usage);
+                if (typeof chunk.usage.completion_tokens === "number")
+                    reportedTokens = chunk.usage.completion_tokens;
+            } // the final usage chunk — meter it
             const delta = chunk.choices[0]?.delta; // this chunk's increment
             if (!delta)
                 continue; // keep-alive or usage chunk — nothing to do
             // Reasoning models (e.g. deepseek-reasoner / R1) stream their thinking in a
             // separate `reasoning_content` field BEFORE the answer. We do NOT print it
-            // (it buries the actual reply) and do NOT keep it (it must not be replayed
-            // in later turns): we let the spinner keep spinning, stash the trace, and
-            // surface it only behind Ctrl+R.
+            // (it buries the actual reply). Provider capabilities determine whether it
+            // must be retained for tool-call continuation; the UI stays collapsed.
             const reasoning = delta.reasoning_content;
             if (reasoning) {
                 streamedChars += reasoning.length; // count reasoning toward the live token estimate
+                if (opts.progress)
+                    opts.progress.liveTokens = Math.ceil(streamedChars / 4);
                 reasoningBuf += reasoning; // stash it for Ctrl+R instead of streaming it
                 reasoningActive = true; // the spinner now shows 💭 (set by the watchdog)
             }
             if (delta.content) {
-                flushReasoning(); // thinking is over — show the one-line indicator first
+                flushReasoning();
                 streamedChars += delta.content.length; // count the answer toward the live token estimate
-                if (spinner?.spinning)
-                    spinner.stop(); // first token: replace the spinner with real output
+                if (spinner?.spinning && !sink(opts).streamingStatus)
+                    spinner.stop();
                 if (!opts.quiet && !opts.subAgent) {
                     // Only the top-level agent streams to the screen — a sub-agent's
                     // inner monologue would be mistaken for the answer. The sink decides
@@ -488,28 +491,37 @@ opts) {
                         ans = sink(opts).answer(); // first token: start the answer renderer
                     ans.push(delta.content); // hand the token to the renderer (it decides when to paint)
                 }
+                if (opts.progress) {
+                    opts.progress.activity = "Writing";
+                    opts.progress.append(delta.content);
+                    opts.progress.liveTokens = Math.ceil(streamedChars / 4);
+                }
                 content += delta.content; // always keep it for the history (the answer only, never the reasoning)
             }
             if (delta.tool_calls?.length)
-                flushReasoning(); // thinking is over — indicator before the tool logs (which print after we return)
+                flushReasoning();
             for (const tc of delta.tool_calls ?? []) {
-                if (spinner?.spinning)
-                    spinner.stop(); // tool call starting — spinner served its purpose
                 const slot = (calls[tc.index] ??= { id: "", name: "", args: "" }); // create the slot on first fragment
                 if (tc.id)
                     slot.id = tc.id; // id arrives once
                 if (tc.function?.name)
                     slot.name += tc.function.name; // name usually arrives whole; += is safe either way
+                streamedChars += tc.function?.arguments?.length ?? 0;
+                if (opts.progress)
+                    opts.progress.liveTokens = Math.ceil(streamedChars / 4);
                 if (tc.function?.arguments)
                     slot.args += tc.function.arguments; // arguments stream in fragments — concatenate
             }
         }
-        flushReasoning(); // a reasoning-only turn (no content, no tools) still records + indicates
-        if (ans)
-            ans.end(); // flush the final (un-terminated) block + end the line cleanly (the sink owns the trailing newline)
-        return { content, toolCalls: calls.filter(Boolean) }; // sparse array → dense
+        flushReasoning();
+        return { content, toolCalls: calls.filter(Boolean), ...(retainsReasoning(opts.model) ? { reasoning: reasoningBuf } : {}) };
     }
     finally {
+        ans?.end(); // cancel delayed repaints even when the API throws or is interrupted
+        if (opts.progress) {
+            opts.progress.finishModelCall(reportedTokens);
+            opts.progress.append("\n");
+        }
         clearInterval(watchdog); // always stop the timer
         if (spinner?.spinning)
             spinner.stop(); // and never leave a zombie spinner
@@ -527,38 +539,105 @@ function agentIndent(opts) {
 // Promise.all batch; calls that can prompt must be awaited one at a time.
 async function runOneCall(call, opts) {
     const indent = agentIndent(opts);
-    if (!opts.quiet) {
-        // The announcement is FOLDED (Day-after-40 UI fix): instead of printing a
-        // line per call (which floods the screen on a big exploration), we record it
-        // for the per-round tally + Ctrl+T. Diffs / prompts / results below still
-        // print live. A generous slice keeps Ctrl+T readable without dumping megabytes.
-        const line = indent + mark.tool(call.name, call.args.length > 300 ? call.args.slice(0, 297) + "..." : call.args);
-        recordToolCall(line, `tool: ${call.name}\nargs: ${call.args}`);
+    const trace = !opts.quiet && !opts.subAgent ? recordToolCall(indent + mark.tool(call.name, call.args.length > 300 ? call.args.slice(0, 297) + "..." : call.args), `tool: ${call.name}\nargs: ${call.args}`, call) : undefined;
+    if (opts.progress) {
+        opts.progress.toolCalls++;
+        opts.progress.activity = call.name;
+        opts.progress.append(`\n[${call.name}]\nargs: ${call.args}\n`);
+    }
+    const started = Date.now();
+    const status = () => `${call.name}… (${Math.floor((Date.now() - started) / 1000)}s)`;
+    const spinner = !opts.quiet && !opts.subAgent ? sink(opts).spinner(status()) : null;
+    const timer = spinner ? setInterval(() => spinner.set(status()), 1000) : undefined;
+    emit("agent_tool_call", { tool: call.name });
+    try {
+        const refusal = await authorizeCall(call, opts);
+        const content = refusal ?? await runWithHooks(call, opts);
+        if (!/^\[(?:permission|hook|error|follow-up)\]/.test(content) && !["task", "spawn_teammate", "send_message", "ask_user"].includes(call.name))
+            opts.reviewBudget?.executed();
+        if (trace)
+            recordToolResult(trace, content);
+        opts.progress?.append(`result: ${content}\n`);
+        if (call.name === "todo_write" && !opts.quiet && !content.startsWith("[error]")) {
+            sink(opts).note(renderTodos(getTodos()));
+        }
+        return { id: call.id, content };
+    }
+    catch (error) {
+        if (trace)
+            recordToolResult(trace, `[error] ${error instanceof Error ? error.message : String(error)}`);
+        throw error;
     }
-    // The permission gate sits between the model's intent and execution.
-    const v = checkPermission(call.name, call.args);
-    emit("agent_tool_call", { tool: call.name }); // every attempt, allowed or not
-    // For file-changing tools, show the diff BEFORE the gate decides. A filename
-    // ("edit_file: cart.js") is not enough to approve safely; the actual +/- lines
-    // are. Skipped for a hard deny (nothing will run) and in quiet sub-agent runs.
-    if (!opts.quiet && v.decision !== "deny" && (call.name === "write_file" || call.name === "edit_file")) {
-        const preview = previewChange(call.name, call.args);
-        if (preview)
-            sink(opts).note(preview.replace(/^/gm, indent)); // nest under the sub-agent marker if any
+    finally {
+        clearInterval(timer);
+        spinner?.stop();
+    }
+}
+// null grants this exact call; any returned text is a refusal for the model.
+// Hook rewrites use the same gate, so approval of one input cannot grant a
+// different action. There is no recursive hook invocation on re-authorization.
+async function authorizeCall(call, opts) {
+    if (opts.signal.aborted || opts.isInterrupted())
+        return "[permission] Interrupted before execution.";
+    if (opts.reviewBudget?.exhausted)
+        return "[permission] Review limit reached. Stop and wait for human direction; this action was not executed.";
+    const auto = opts.autoMode?.enabled ?? false;
+    const v = checkPermission(call.name, call.args, auto);
+    // Auto-mode fast path: calls a reviewer would otherwise see, allowed because
+    // they are recoverable or pre-granted. Counted so the report shows the saving.
+    if (auto && v.decision === "allow" && (["run_bash", "run_bash_background", "write_file", "edit_file"].includes(call.name) || call.name.startsWith("mcp__"))) {
+        emit("agent_auto_skipped", { tool: call.name, reason: v.reason });
     }
-    let content; // what goes back to the model as the tool result
     if (v.decision === "deny") {
+        if (auto && opts.autoMode?.policy === "rules")
+            opts.reviewBudget?.deny();
         emit("agent_tool_denied", { tool: call.name }); // hard blocks, per tool
         if (!opts.quiet)
             sink(opts).note(mark.denied(v.reason)); // tell the user we blocked it
-        content = `[permission] Denied: ${v.reason}. This is a hard rule — do not try to work around it; pick a different approach or ask the user.`; // teach the model the boundary
+        return `[permission] Denied: ${v.reason}. This is a hard rule — do not try to work around it; pick a different approach or ask the user.`;
     }
     else if (v.decision === "ask") {
         // Optional LLM judge: for a run_bash command the rules couldn't classify,
         // ask the judge first. It can only DOWNGRADE ask→allow for the clearly
         // safe; anything else still goes to the human. The judge never sees a deny.
         let autoAllowed = false;
-        if (opts.judge && call.name === "run_bash") {
+        let reviewReason = "";
+        let reviewId = ""; // set when auto review ran; joins the human's answer to that review
+        // Auto mode's line is recoverability: a tool its server declares read-only
+        // or merely additive loses nothing, so it runs without review (plan mode
+        // already denied above).
+        const recoverable = auto && !v.requiresHuman ? declaresRecoverable(call.name) : null;
+        if (recoverable) {
+            autoAllowed = true;
+            emit("agent_auto_skipped", { tool: call.name, reason: recoverable });
+            if (!opts.quiet)
+                recordToolDetail(call.id, `${recoverable[0].toUpperCase()}${recoverable.slice(1)}; no review needed`);
+            // Exiting plan mode always belongs to the human, never to a classifier.
+        }
+        else if (!v.requiresHuman && opts.autoMode && (auto ? call.name !== "exit_plan_mode" : !!opts.judge && call.name === "run_bash")) {
+            const definition = toolsFor(opts).find((t) => t.type === "function" && t.function.name === call.name);
+            const description = definition?.type === "function" ? definition.function.description : undefined;
+            const review = await opts.autoMode.classify(call.name, call.args, opts.autoRequests ?? [], opts.signal, {
+                description, history: opts.autoHistory, delegatedTask: opts.delegatedTask,
+                notify: (message) => { if (!opts.quiet)
+                    sink(opts).note(chalk.yellow(`  ⎿ ${message}`)); },
+            });
+            if (opts.signal.aborted || opts.isInterrupted())
+                return "[permission] Interrupted before execution.";
+            reviewId = review.reviewId ?? "";
+            if (review.decision === "deny") {
+                opts.reviewBudget?.deny();
+                emit("agent_tool_auto_denied", { tool: call.name, rules: (review.ruleIds ?? []).join(","), ...(reviewId ? { reviewId } : {}) });
+                if (!opts.quiet)
+                    recordToolDetail(call.id, review.reason);
+                return `[permission] Auto-denied (not a user refusal): ${review.reason}. Not executed. Choose a permitted approach or report the restriction. Do not retry the same prohibited effect through another tool, wrapper or worker.`;
+            }
+            autoAllowed = review.decision === "allow";
+            reviewReason = review.reason;
+            if (!opts.quiet)
+                recordToolDetail(call.id, review.reason);
+        }
+        else if (!auto && opts.judge && call.name === "run_bash") {
             let cmd = "";
             try {
                 cmd = JSON.parse(call.args).command ?? "";
@@ -567,27 +646,38 @@ async function runOneCall(call, opts) {
             if (cmd && (await opts.judge.classify(cmd)) === "allow") {
                 autoAllowed = true;
                 if (!opts.quiet)
-                    sink(opts).note(mark.judge); // visible — the user can see the judge worked
+                    recordToolDetail(call.id, "Model judge auto-approved");
             }
         }
-        const ok = autoAllowed || (await opts.confirm(`${call.name} (${v.reason}):\n   ${v.summary}`, call.name)); // judge-allowed, or pause and ask the human
+        if (opts.signal.aborted || opts.isInterrupted())
+            return "[permission] Interrupted before execution.";
+        // An unattended callback may contain the old blanket auto-approve policy.
+        // Auto mode never uses that policy as a fallback when Jev did not approve.
+        // A diff is needed when the human is deciding; automatic edits stay in
+        // the collapsed tool trace and remain available through /diff.
+        if (!autoAllowed && !opts.quiet && (call.name === "write_file" || call.name === "edit_file")) {
+            const preview = previewChange(call.name, call.args);
+            if (preview)
+                sink(opts).note(preview.replace(/^/gm, agentIndent(opts)));
+        }
+        const ok = autoAllowed || (!(auto && opts.canPrompt === false) && await opts.confirm(`${call.name} (${v.reason}):\n   ${v.summary}${reviewReason ? `\n   ${reviewReason}` : ""}`, call.name));
+        // Every human prompt in auto mode is an interruption worth counting, with
+        // where it came from: the reviewer asked ("review", joinable by reviewId),
+        // or a rule required a human without review ("requires_human"). Approved is
+        // a likely false block, declined a correct one; "unattended" reached no one.
+        if (auto && !autoAllowed)
+            emit("agent_auto_human", { tool: call.name, source: reviewId ? "review" : v.requiresHuman ? "requires_human" : "no_review",
+                decision: ok ? "approved" : opts.canPrompt === false ? "unattended" : "declined", ...(reviewId ? { reviewId } : {}) });
         if (!ok)
-            emit("agent_tool_declined", { tool: call.name }); // the human said no — that is signal
+            emit("agent_tool_declined", { tool: call.name, ...(reviewId ? { reviewId } : {}) }); // the human said no — that is signal
         if (!ok && !opts.quiet)
             sink(opts).note(mark.declined); // make the refusal visible
-        content = ok
-            ? await runWithHooks(call, opts) // approved — run it (PreToolUse can still block)
-            : `[permission] The user declined this action. Ask them how to proceed, or choose a safer alternative.`; // declined — tell the model
-    }
-    else {
-        content = await runWithHooks(call, opts); // allow — run it (PreToolUse can still block)
-    }
-    // todo_write's whole point is the VISIBLE plan: the model got a one-line tally,
-    // the human gets the rendered checklist (quiet runs — eval/sub-agents — stay silent).
-    if (call.name === "todo_write" && !opts.quiet && !content.startsWith("[error]")) {
-        sink(opts).note(renderTodos(getTodos()));
+        if (!ok)
+            return `[permission] Action not approved${reviewReason ? `: ${reviewReason}` : ". The user declined this action"}. Ask the user how to proceed, or choose a safer alternative.`;
     }
-    return { id: call.id, content }; // paired by id for the API
+    if (opts.reviewBudget?.exhausted)
+        return "[permission] Review limit reached; not executed. Wait for human direction.";
+    return opts.signal.aborted || opts.isInterrupted() ? "[permission] Interrupted before execution." : null;
 }
 // Run an approved tool call, surrounded by the user's lifecycle hooks.
 // PreToolUse can block (exit 2) — its stderr is fed back to the model as the
@@ -597,6 +687,8 @@ async function runOneCall(call, opts) {
 // wrote"). Sub-agents skip hooks: hooks are about the human's project policy,
 // not internal delegation.
 async function runWithHooks(call, opts) {
+    if (opts.reviewBudget?.exhausted)
+        return "[permission] Review limit reached; not executed.";
     if (opts.subAgent)
         return execute(call, opts); // sub-agents run hook-free
     const pre = await runHooks("PreToolUse", { tool: call.name, args: call.args }); // before
@@ -607,19 +699,26 @@ async function runWithHooks(call, opts) {
         return `[hook] A PreToolUse hook blocked this call: ${pre.feedback}. Treat this as a hard boundary — adjust your approach.`;
     }
     // A PreToolUse hook may REWRITE the arguments (e.g. add a commit trailer). The
-    // permission gate already ran on the original args; the rewrite only narrows or
-    // annotates, never escalates past a deny. Validate it's parseable, then use it.
-    if (pre.rewrite) {
+    // permission gate ran on the original args. A rewrite is a NEW action and
+    // must pass the gate again; hooks cannot turn an approved read into a write.
+    if (pre.rewrite && pre.rewrite !== call.args) {
         try {
             JSON.parse(pre.rewrite); // must be valid JSON args
             if (!opts.quiet)
-                sink(opts).note(chalk.dim(`  ⎿ PreToolUse hook rewrote the arguments`));
+                recordToolDetail(call.id, `PreToolUse rewrote args: ${pre.rewrite}`);
             call = { ...call, args: pre.rewrite };
         }
         catch {
             /* malformed rewrite — ignore, run the original args */
         }
+        const refusal = await authorizeCall(call, opts);
+        if (refusal)
+            return refusal;
     }
+    if (opts.signal.aborted || opts.isInterrupted())
+        return "[permission] Interrupted before execution.";
+    if (opts.reviewBudget?.exhausted)
+        return "[permission] Review limit reached; not executed.";
     const result = await execute(call, opts); // the actual work
     const post = await runHooks("PostToolUse", { tool: call.name, args: call.args, result }); // after
     if (post.block) {
@@ -871,10 +970,9 @@ async function runSpawnTeammate(call, opts) {
     // concurrent. It progresses whenever the event loop is free (e.g. while the
     // lead awaits its own API stream). We keep the promise so the lead and
     // shutdown know when it has ended.
-    const done = runTeammate(name, role, task, opts);
-    registerTeammate(name, role, done);
-    if (!opts.quiet)
-        sink(opts).note(mark.teammateStart(name, role));
+    const progress = new AgentProgress(opts.model);
+    const done = runTeammate(name, role, task, opts, progress);
+    registerTeammate(name, role, done, progress);
     return `Teammate "${name}" (${role}) spawned and is now working in parallel. It will message you (as "lead") with progress and its final result. Reply with send_message; keep coordinating the rest of the team. Do not wait idly — continue your own work.`;
 }
 // Run one teammate to completion: a fresh conversation seeded with its task, a
@@ -882,7 +980,7 @@ async function runSpawnTeammate(call, opts) {
 // a `result` message back to the lead — so the lead always learns the outcome,
 // success or failure. The teammate's file read-state is isolated by snapshot,
 // exactly like a sub-agent (it reads things the lead's conversation never saw).
-async function runTeammate(name, role, task, opts) {
+async function runTeammate(name, role, task, opts, progress) {
     emit("agent_teammate_spawn");
     await runHooks("SubagentStart", { description: `teammate ${name}: ${role}`.slice(0, 200), model: opts.model });
     const snapshot = snapshotFileState();
@@ -903,8 +1001,11 @@ async function runTeammate(name, role, task, opts) {
             ...opts,
             subAgent: true,
             teammate: { name },
+            progress,
+            delegatedTask: task,
             maxRounds: TEAMMATE_MAX_ROUNDS,
             confirm: teammateConfirm(name, sink(opts)),
+            canPrompt: false,
             askUser: undefined, // teammates have no line to the human
         });
         // How it ended decides what the lead hears. A shutdown handshake gets a
@@ -917,8 +1018,6 @@ async function runTeammate(name, role, task, opts) {
         else
             sendMessage(name, LEAD, summary, "result");
         finishTeammate(name, result.reason === TerminateReason.Done);
-        if (!opts.quiet)
-            sink(opts).note(mark.teammateDone(name, result.reason === TerminateReason.Done));
     }
     catch (err) {
         // A teammate must never take the whole process down. Report the failure to
@@ -1028,10 +1127,7 @@ function injectBackgroundNotifications(messages, opts) {
     const note = pendingNotifications(); // "" unless a task finished since we last checked
     if (!note)
         return false;
-    const count = (note.match(/<task_notification>/g) ?? []).length; // for the one-line on-screen mark
     messages.push({ role: "user", content: note }); // the model reacts to it on the next round
-    if (!opts.quiet)
-        sink(opts).note(mark.bgNote(count));
     return true;
 }
 // Consume this agent's mailbox into its conversation, ROUTING protocol messages
@@ -1131,6 +1227,8 @@ async function continueForTeam(messages, opts) {
         return false; // a plain sub-agent has no team
     // The lead: wait for the team to act rather than spinning or ending early.
     while (inboxCount(LEAD) === 0 && anyTeammateBusy() && !opts.isInterrupted()) {
+        if (opts.followUps?.size)
+            return true;
         await interruptibleSleep(TEAM_POLL_MS, opts.isInterrupted); // yield to the teammates; they message us when they have something
     }
     return consumeInbox(messages, opts); // process whatever is waiting; false if the team is quiescent (→ the lead may finish)
@@ -1164,6 +1262,39 @@ async function shutdownTeam(opts) {
 // for a named reason or terminates for a named reason — nothing implicit.
 export async function runLoop(messages, // conversation history (mutated in place)
 opts) {
+    // Children inherit this snapshot. Later human turns cannot silently grant
+    // broader authorization to already-running background work.
+    opts = { ...opts, reviewBudget: opts.reviewBudget ?? new AutoReviewBudget(), autoRequests: opts.autoRequests ?? opts.autoMode?.snapshot(), followUps: opts.subAgent ? undefined : opts.followUps };
+    const recordHumanInput = (text) => {
+        opts.autoMode?.recordRequest(text);
+        opts.autoRequests = [...(opts.autoRequests ?? []), text];
+    };
+    // Capture at the actual UI callback, never by parsing an ask_user tool result
+    // (which can also be restored or forged). Close over this loop's opts so the
+    // answer reaches subsequent calls despite per-call option copies below.
+    const askUser = opts.askUser;
+    if (askUser && !opts.subAgent)
+        opts.askUser = async (questions) => {
+            const answers = await askUser(questions);
+            if (!opts.signal.aborted && !opts.isInterrupted()) {
+                for (const answer of answers ?? []) {
+                    const question = questions.find((q) => q.question === answer.question);
+                    if (question && typeof answer.answer === "string" && answer.answer.trim()) {
+                        recordHumanInput(`Human form reply (question is context; only the submitted answer expresses the user's choice): ${JSON.stringify({ question: question.question, answer: answer.answer })}`);
+                    }
+                }
+            }
+            return answers;
+        };
+    const receiveFollowUps = () => {
+        const pending = opts.followUps?.drain() ?? [];
+        for (const message of pending) {
+            messages.push({ role: "user", content: message.content });
+            recordHumanInput(message.text);
+            opts.onFollowUp?.(message.displayText ?? message.text);
+        }
+        return pending.length > 0;
+    };
     // The loop's mutable state: budgets and counters, rewritten every iteration.
     const attempts = { total: 0, rateLimited: 0, consecutive: 0 };
     const compaction = { count: 0, failures: 0 }; // compaction score card for this query
@@ -1180,6 +1311,9 @@ opts) {
         while (true) {
             if (opts.isInterrupted())
                 return { reason: TerminateReason.UserInterrupt }; // user asked us to stop — obey before spending money
+            if (opts.reviewBudget?.exhausted)
+                return { reason: TerminateReason.ReviewLimit };
+            receiveFollowUps();
             // Proactive compaction: act BEFORE the API rejects us. Waiting for the
             // hard limit means the failure already happened.
             if (estimateHistoryTokens(messages) > COMPACT_AT) {
@@ -1189,7 +1323,7 @@ opts) {
                 if (!ok && compaction.failures >= MAX_COMPACT_FAILURES)
                     return { reason: TerminateReason.CompactionFailed, detail: `${compaction.failures} consecutive compaction failures` }; // the compaction circuit breaker
             }
-            let out; // the assembled reply for this round
+            let out;
             try {
                 out = await streamModelCall(messages, opts); // streaming call with spinner + watchdog
             }
@@ -1211,6 +1345,9 @@ opts) {
                         continue; // history is smaller now — retry the same round
                     return { reason: TerminateReason.ContextTooLong, detail: e.message }; // compaction could not save us
                 }
+                if (e.kind === ApiErrorKind.BadRequest && messages.some((m) => Array.isArray(m.content) && m.content.some((part) => part.type === "image_url"))) {
+                    return { reason: TerminateReason.ImageInputRejected };
+                }
                 if (!e.retryable)
                     return { reason: TerminateReason.FatalApiError, detail: `${e.kind}: ${e.message}` }; // bad key etc. — stop now
                 emit("agent_api_error", { kind: e.kind, attempt: attempts.total + 1 }); // classified, greppable
@@ -1245,6 +1382,7 @@ opts) {
             messages.push({
                 role: "assistant", // the model's turn
                 content: out.content || null, // null when the turn was tool calls only
+                ...(out.reasoning !== undefined ? { reasoning_content: out.reasoning } : {}),
                 ...(out.toolCalls.length
                     ? { tool_calls: out.toolCalls.map((c) => ({ id: c.id, type: "function", function: { name: c.name, arguments: c.args } })) }
                     : {}), // omit the field entirely when there were no calls
@@ -1252,6 +1390,8 @@ opts) {
             if (out.content)
                 lastText = out.content; // remember the latest answer text — the round-cap path returns it
             if (!out.toolCalls.length) {
+                if (receiveFollowUps())
+                    break; // new human input takes precedence over finishing
                 // The model wants to stop. A Stop hook gets the last word: if it exits
                 // 2, the agent is NOT done — its stderr becomes a new instruction and
                 // the loop continues. This is how you build test-driven AI: a Stop hook
@@ -1283,6 +1423,8 @@ opts) {
                 // process, run another round instead of stopping.
                 if (await continueForTeam(messages, opts))
                     break; // exit the inner while → advance the round counter
+                if (receiveFollowUps())
+                    break;
                 // The lead is really finishing: disband any teammates still idling so
                 // they exit cleanly (Day 39) instead of being orphaned.
                 if (!opts.subAgent && !opts.teammate)
@@ -1297,25 +1439,28 @@ opts) {
             // Claude Code parallelizes safe reads while serializing risky work.
             let i = 0; // index into out.toolCalls
             while (i < out.toolCalls.length) {
+                if (opts.followUps?.size && !opts.isInterrupted()) {
+                    // Resolve every outstanding tool ID BEFORE adding a user message.
+                    // Unstarted actions came from the old intent and must be replanned.
+                    for (const call of out.toolCalls.slice(i))
+                        messages.push({ role: "tool", tool_call_id: call.id, content: "[follow-up] Not executed: new user input arrived. Reconsider this action using the latest instructions." });
+                    receiveFollowUps();
+                    break;
+                }
                 const batch = []; // a run of safe, parallelizable calls
                 while (i < out.toolCalls.length && isReadOnlyTool(out.toolCalls[i].name))
                     batch.push(out.toolCalls[i++]);
                 if (batch.length) {
                     // Run the whole read-only batch at once, preserving result order.
-                    const results = await Promise.all(batch.map((c) => runOneCall(c, opts)));
+                    const results = await Promise.all(batch.map((c) => runOneCall(c, { ...opts, autoHistory: reviewHistory(messages, opts.autoHistory) })));
                     for (const r of results)
                         messages.push({ role: "tool", tool_call_id: r.id, content: r.content });
                     continue; // back to the top — the next call is non-read-only
                 }
                 // A single non-read-only call: gate, maybe ask, execute — all serial.
-                const r = await runOneCall(out.toolCalls[i++], opts);
+                const r = await runOneCall(out.toolCalls[i++], { ...opts, autoHistory: reviewHistory(messages, opts.autoHistory) });
                 messages.push({ role: "tool", tool_call_id: r.id, content: r.content });
             }
-            // Fold this round's tool calls into ONE tally line instead of one line per
-            // call (the per-call announcements were recorded for Ctrl+T in runOneCall).
-            if (!opts.quiet && out.toolCalls.length) {
-                sink(opts).note(agentIndent(opts) + mark.toolTally(out.toolCalls.map((c) => c.name)) + chalk.dim(" · Ctrl+T"));
-            }
             // Cron (Day s14): deliver any triggered scheduled jobs right after this
             // round's results so the model sees them on the next round.
             injectCronMessages(messages, opts);