amicus 1.7.4 → 1.7.6

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "1.7.4",
+  "version": "1.7.6",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": { "name": "Christian Wagner" },
   "homepage": "https://bourbondog.github.io/amicus/",

package/CHANGELOG.md

@@ -5,6 +5,82 @@ All notable changes to Amicus are documented here. Format follows
 
 ## [Unreleased]
 
+## [1.7.6] - 2026-07-01
+
+A second independent review (GLM 5.2), adversarially verified against source, then fixed across 11 lanes.
+20 of 22 confirmed findings fixed; 2 partial (deferred as follow-ups). Full unit suite green.
+
+### Security
+- **The `project`/`cwd` MCP input is now sandboxed.** Previously any caller could pass an arbitrary directory
+  (e.g. a system path) and Amicus would create session files and spawn a sidecar there. A new project-root
+  allow-list rejects out-of-bounds paths **before** any filesystem write or spawn, while still allowing paths
+  under your home directory, the current working directory, `AMICUS_PROJECT_DIR`/`AMICUS_PROJECT_ROOTS`, or the
+  MCP client's advertised root — so legitimate `--cwd` use is unaffected.
+- **Folded-back sidecar summaries are fenced as untrusted output.** `amicus_read`'s returned summary — produced
+  by an arbitrary model — is now wrapped in a read-only fence (mirroring the outbound conversation fence), so
+  model prose entering the orchestrator's context is marked as data, not instructions.
+- **The Electron content view no longer shares the privileged bridge.** The embedded OpenCode web view gets a
+  minimal preload that exposes nothing privileged, and IPC handlers validate the sender, so only the toolbar can
+  trigger update/settings actions.
+
+### Fixed
+- **A crashed OpenCode server is now detected.** The shared-server crash/restart machinery was unreachable (no
+  exit listener was ever attached); a server exit is now wired to the restart path.
+- **Session metadata is written atomically** (temp file + rename), so a crash mid-write can no longer corrupt
+  `metadata.json` and silently mask an abort marker.
+- **Port lookup works on Windows.** The stale-process cleanup used a hardcoded `lsof` (a no-op on Windows); it
+  now uses the cross-platform `netstat`-based lookup.
+- **A fan-out leg whose setup throws no longer sinks the whole wave** — the leg is turned into an error result
+  and `wave.json` is still written.
+- **The setup window can't hang on a spawn failure** — a spawn error now resolves cleanly instead of leaving the
+  launch promise pending forever, and the Electron child is killed on parent exit.
+- **Project-scoped `opencode.json` resolves against the target project**, not the launcher's working directory.
+- Smaller correctness/cleanup fixes: single-peer-agreed council findings now count as corroborated; unknown
+  council verdicts are guarded; tool-call turns render a summary instead of blank; quote-aware `--mcp` command
+  parsing; a model-object shape guard; a single shared duration formatter; timed mirror teardown; a lock on the
+  continuation session; and canonical session-route separators.
+
+### Known follow-ups
+- Fencing `amicus_council_tally`/`amicus_verdict` (they return JSON records, so they need a field-level fence).
+- Removing the now-dead top-level `tool_use` formatter branch (blocked on an unrelated test assertion).
+
+## [1.7.5] - 2026-07-01
+
+A batch of fixes from an independent DeepSeek V4 Pro code review, each verified against source.
+
+### Fixed
+- **Long prompts no longer truncate on Windows.** The `amicus_start` and `amicus_continue` MCP
+  handlers passed the full prompt inline on the spawned command line, which silently truncated once
+  it crossed Windows's ~32 KB argument cap — so a sidecar could run against a corrupted briefing with
+  no error. Both paths now write the prompt to a `briefing.md` in the session directory and pass
+  `--prompt-file`, matching the existing fanout handler; the CLI `continue` command learned
+  `--prompt-file` as well.
+- **`getMessages` no longer masks SDK error responses.** An error-shaped response with no `data`
+  array was indistinguishable from "zero messages" in the poll loop; it now logs a warning carrying
+  the session id and surfaced error while still returning `[]`.
+- **`getSessionDir` rejects path-traversal task ids.** A defense-in-depth containment guard (the same
+  check style used elsewhere in the codebase) throws on a task id that would escape the sessions dir.
+- **Cross-platform `auth.json` discovery.** The one-time OpenCode key-import path was hardcoded to the
+  Unix XDG location; it now probes `$XDG_DATA_HOME`, `~/.local/share`, and `%APPDATA%` (Windows) and
+  uses the first that exists.
+
+### Changed
+- **The fold-completion marker is harder to spoof.** A bare `[SIDECAR_FOLD]` echoed mid-output (e.g. a
+  model reproducing these instructions or summarizing a prior sidecar session) no longer forces a
+  premature fold — the marker now completes a run only when it is the final non-empty line of output,
+  with the existing idle/timeout fallbacks unchanged so a run can never hang.
+- **The conversation-mirror tool-call buffer is bounded.** Capped at 2000 entries with a separate
+  dedup set, so a very long tool-heavy session can't grow it without limit.
+- **Unknown `--no-*` flags are treated as boolean.** They no longer swallow the following positional
+  argument (`--no-x=value` still records its inline value; allowlisted flags are unchanged).
+- **`--prompt-file` validation is order-independent.** `validateStartArgs` now resolves the prompt
+  source itself, so validation no longer depends on the handler having resolved it first.
+
+### Docs
+- **Corrected the `tiktoken` dependency note.** It is declared but unused; token sizing uses a
+  `length/4` heuristic. Added caveat comments at both estimators. (Removing the unused dependency is
+  tracked as a follow-up.)
+
 ## [1.7.4] - 2026-06-30
 
 ### Fixed

package/bin/amicus.js

@@ -215,6 +215,19 @@ async function handleContinue(args) {
     process.exit(1);
   }
 
+  // BL-1: accept --prompt-file (XOR --prompt) so the MCP handler can pass a long
+  // follow-up prompt via file, dodging the ~32KB Windows command-line cap.
+  if (args['prompt-file'] !== undefined) {
+    const { resolvePromptSource } = require('../src/utils/prompt-source');
+    const promptRes = resolvePromptSource(args);
+    if (promptRes.error) {
+      console.error(promptRes.error);
+      process.exit(1);
+    }
+    args.prompt = promptRes.prompt;
+    delete args['prompt-file'];
+  }
+
   if (!args.prompt && !args.briefing) {
     console.error('Error: --prompt is required for continue');
     process.exit(1);

package/electron/ipc-guard.js

@@ -0,0 +1,66 @@
+/**
+ * IPC Guard Helpers
+ *
+ * Small, pure helpers extracted from main.js so the security-sensitive bits are
+ * unit-testable (main.js itself runs heavy Electron side effects at import).
+ *
+ *  - isPrivilegedSender: pin privileged IPC handlers to the toolbar window so a
+ *    compromised/remote page in the OpenCode BrowserView cannot invoke them (M9).
+ *  - isAllowedContentNavigation: pin the OpenCode BrowserView to its localhost
+ *    origin so it cannot be navigated off to an attacker-controlled page (M9).
+ *  - handleFatalException: EPIPE stays a no-op; any other uncaught exception is
+ *    logged and then quits the app rather than leaving a wedged invisible shell
+ *    (L10).
+ */
+
+/**
+ * Whether an IPC event originated from the privileged toolbar window.
+ * @param {{ sender?: object }} event - The ipcMain event.
+ * @param {() => (object|null)} getToolbarWindow - Returns the toolbar BrowserWindow (or null).
+ * @returns {boolean} true only when the sender is the toolbar window's webContents.
+ */
+function isPrivilegedSender(event, getToolbarWindow) {
+  const win = getToolbarWindow();
+  if (!win || win.isDestroyed?.()) { return false; }
+  return Boolean(event && event.sender && event.sender === win.webContents);
+}
+
+/**
+ * Whether a navigation target is allowed for the OpenCode content BrowserView.
+ * Only the OpenCode localhost origin (any path) is permitted; everything else
+ * (external http(s), file:, etc.) is blocked. data: URLs are allowed so the
+ * in-app load-error page can render.
+ * @param {string} targetUrl - The URL the view is trying to navigate to.
+ * @param {string} allowedOrigin - e.g. 'http://localhost:4096'.
+ * @returns {boolean}
+ */
+function isAllowedContentNavigation(targetUrl, allowedOrigin) {
+  if (typeof targetUrl !== 'string' || !targetUrl) { return false; }
+  if (targetUrl.startsWith('data:')) { return true; }
+  try {
+    const target = new URL(targetUrl);
+    const allowed = new URL(allowedOrigin);
+    return target.origin === allowed.origin;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Handle a process 'uncaughtException'. EPIPE is a benign no-op; anything else
+ * is logged and then quits the app so a genuinely unexpected error cannot leave
+ * an invisible, silently-hung shell.
+ * @param {Error & { code?: string }} err
+ * @param {{ quit: () => void, log?: (err: Error) => void }} deps
+ */
+function handleFatalException(err, { quit, log } = {}) {
+  if (err && err.code === 'EPIPE') { return; }
+  if (log) {
+    log(err);
+  } else {
+    console.error('Uncaught exception:', err);
+  }
+  if (typeof quit === 'function') { quit(); }
+}
+
+module.exports = { isPrivilegedSender, isAllowedContentNavigation, handleFatalException };

package/electron/main.js

@@ -24,6 +24,11 @@ const { attachLoadFailsafe, buildLoadErrorHTML } = require('./load-failsafe');
 const { buildSessionRoute } = require('./session-route');
 const { buildOpencodeThemeCSS } = require('./opencode-theme');
 const { TOKENS } = require('../src/design/tokens');
+const {
+  isPrivilegedSender,
+  isAllowedContentNavigation,
+  handleFatalException,
+} = require('./ipc-guard');
 
 const ICON_PATH = path.join(__dirname, 'assets', 'icon.png');
 
@@ -39,8 +44,10 @@ process.stderr.on('error', (err) => {
   if (err.code === 'EPIPE') { return; }
 });
 process.on('uncaughtException', (err) => {
-  if (err.code === 'EPIPE') { return; }
-  console.error('Uncaught exception:', err);
+  // EPIPE stays a benign no-op; any other uncaught exception is logged and then
+  // quits the app so a genuinely unexpected error cannot leave a wedged,
+  // invisible shell hanging in the background (L10).
+  handleFatalException(err, { quit: () => app.quit() });
 });
 process.on('unhandledRejection', (reason) => {
   console.error('Unhandled rejection:', reason);
@@ -135,13 +142,26 @@ function createAmicusWindow() {
   mainWindow.loadURL(`data:text/html;charset=utf-8,${encodeURIComponent(toolbarHtml)}`);
   mainWindow.webContents.on('page-title-updated', (e) => e.preventDefault());
 
-  // BrowserView for OpenCode content
+  // BrowserView for OpenCode content. It uses a MINIMAL preload that exposes no
+  // privileged bridge — the OpenCode page must not be able to reach the fold /
+  // settings / update IPC (M9). The toolbar window keeps preload.js.
   contentView = new BrowserView({
     webPreferences: {
-      preload: path.join(__dirname, 'preload.js'),
+      preload: path.join(__dirname, 'preload-content.js'),
       contextIsolation: true, nodeIntegration: false,
     }
   });
+
+  // Pin the content view to the OpenCode localhost origin: block any attempt to
+  // navigate it off-origin or open new windows (defense-in-depth, M9). data:
+  // URLs (the in-app load-error page) are still allowed by the guard.
+  contentView.webContents.on('will-navigate', (event, targetUrl) => {
+    if (!isAllowedContentNavigation(targetUrl, OPENCODE_URL)) {
+      logger.warn('Blocked content-view navigation', { targetUrl });
+      event.preventDefault();
+    }
+  });
+  contentView.webContents.setWindowOpenHandler(() => ({ action: 'deny' }));
   // Load OpenCode off-screen first; only attach BrowserView after rebranding
   // to prevent the OpenCode logo/splash from flashing during load.
   mainWindow.on('resize', updateContentBounds);
@@ -400,25 +420,35 @@ function rebrandUI() {
 // IPC Handlers
 // ============================================================================
 
+// These handlers are privileged (fold/settings/update/resize). Only the toolbar
+// window may invoke them — the OpenCode content BrowserView must not (M9). The
+// content view no longer gets a bridge preload, but we still validate the
+// sender as belt-and-suspenders in case a future preload change reintroduces one.
+const fromToolbar = (event) => isPrivilegedSender(event, () => mainWindow);
+
 // Amicus mode: fold
-ipcMain.handle('sidecar:fold', () => {
+ipcMain.handle('sidecar:fold', (event) => {
+  if (!fromToolbar(event)) { return; }
   return foldHandler.triggerFold(mainWindow, contentView);
 });
 
 // Amicus mode: open settings in a child window
-ipcMain.handle('sidecar:open-settings', () => {
+ipcMain.handle('sidecar:open-settings', (event) => {
+  if (!fromToolbar(event)) { return; }
   createSettingsChildWindow();
 });
 
 // Update check
-ipcMain.handle('sidecar:get-update-info', async () => {
+ipcMain.handle('sidecar:get-update-info', async (event) => {
+  if (!fromToolbar(event)) { return null; }
   const { getUpdateInfo, initUpdateCheck } = require('../src/utils/updater');
   await initUpdateCheck();
   return getUpdateInfo();
 });
 
 // Perform update
-ipcMain.handle('sidecar:perform-update', async () => {
+ipcMain.handle('sidecar:perform-update', async (event) => {
+  if (!fromToolbar(event)) { return { success: false, error: 'unauthorized' }; }
   const { performUpdate } = require('../src/utils/updater');
   const result = await performUpdate();
   if (mainWindow && !mainWindow.isDestroyed()) {
@@ -428,7 +458,8 @@ ipcMain.handle('sidecar:perform-update', async () => {
 });
 
 // Resize toolbar area (called when update banner shows/hides)
-ipcMain.handle('sidecar:resize-toolbar', (_event, height) => {
+ipcMain.handle('sidecar:resize-toolbar', (event, height) => {
+  if (!fromToolbar(event)) { return; }
   currentToolbarH = height;
   updateContentBounds();
 });

package/electron/preload-content.js

@@ -0,0 +1,37 @@
+/**
+ * Content Preload - OpenCode BrowserView (minimal, no privileged bridge)
+ *
+ * The OpenCode Web UI is remote-ish content: it should NOT be able to reach the
+ * privileged sidecar IPC (fold/open-settings/perform-update/...). This preload
+ * therefore exposes NOTHING via contextBridge — it only injects the cosmetic
+ * branding CSS. The toolbar window keeps preload.js; the content view uses this.
+ *
+ * (M9 defense-in-depth: the toolbar and the content view no longer share the
+ * bridge-exposing preload.)
+ */
+
+/**
+ * Inject CSS to hide OpenCode branding and match the window background color to
+ * prevent a white flash on load. Cosmetic only — must never throw.
+ */
+function injectBrandingCss() {
+  try {
+    const style = document.createElement('style');
+    style.textContent = [
+      'html, body { background-color: var(--bg, #0a0a0a) !important; }',
+      '#root > div > header { display: none !important; }',
+      'svg[viewBox="0 0 234 42"] { display: none !important; }',
+    ].join('\n');
+    document.documentElement.appendChild(style);
+  } catch {
+    // cosmetic — a failed injection must not break the preload
+  }
+}
+
+// documentElement is still null while the preload evaluates; defer until the
+// DOM exists so the injection cannot null-deref.
+if (document.documentElement) {
+  injectBrandingCss();
+} else {
+  document.addEventListener('DOMContentLoaded', injectBrandingCss);
+}

package/electron/session-route.js

@@ -12,16 +12,23 @@
  *
  * Pure function: no electron, no fs, no process state. Safe to unit-test.
  *
+ * The directory is canonicalized before encoding so incidental separator
+ * differences (Windows '\\' vs '/', mixed/duplicate separators) produce the same
+ * route segment — otherwise OpenCode normalizing '/' vs '\\' would yield a
+ * mismatched base64url and a "session not found" route.
+ *
  * @param {string} baseUrl - OpenCode server base URL (e.g. http://localhost:4096)
  * @param {string} [sessionId] - OpenCode session id; falsy → return baseUrl only
  * @param {string} sessionDirectory - The directory the session is scoped to
  * @returns {string} Fully-qualified route URL, or baseUrl when no session id.
  */
+const { canonicalProjectPath } = require('../src/utils/project-path');
+
 function buildSessionRoute(baseUrl, sessionId, sessionDirectory) {
   if (!sessionId) {
     return baseUrl;
   }
-  const seg = Buffer.from(sessionDirectory).toString('base64url');
+  const seg = Buffer.from(canonicalProjectPath(sessionDirectory)).toString('base64url');
   return `${baseUrl}/${seg}/session/${sessionId}`;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "1.7.4",
+  "version": "1.7.6",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [
     "claude",

package/src/cli-handlers-run.js

@@ -28,6 +28,10 @@ async function handleStart(args) {
     const promptRes = resolvePromptSource(args);
     if (promptRes.error) { process.exit(failJson(useJson, { code: ERROR_CODES.MISSING_PROMPT, message: promptRes.error })); }
     args.prompt = promptRes.prompt;
+    // Drop --prompt-file now that it's resolved: validateStartArgs' self-contained
+    // guard would otherwise re-run resolvePromptSource with both prompt and
+    // prompt-file set and trip its mutually-exclusive branch.
+    delete args['prompt-file'];
   }
   if (args.json && !args['no-ui']) {
     process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --json requires --no-ui' }));

package/src/cli.js

@@ -16,6 +16,7 @@ const {
   validateApiKey,
   validateThinkingLevel
 } = require('./utils/validators');
+const { resolvePromptSource } = require('./utils/prompt-source');
 const { logger } = require('./utils/logger');
 
 /**
@@ -78,6 +79,14 @@ function parseArgs(argv) {
         continue;
       }
 
+      // Unknown negation flags: known --no-* flags are already handled by
+      // isBooleanFlag() above; treat any *unregistered* --no-* token as a
+      // boolean so it can never swallow the following positional as a value.
+      if (key.startsWith('no-')) {
+        result[key] = true;
+        continue;
+      }
+
       // Options with values
       if (next && !next.startsWith('--')) {
         result[key] = parseValue(key, next);
@@ -153,6 +162,19 @@ function parseValue(key, value) {
  * @returns {{ valid: boolean, error?: string }}
  */
 function validateStartArgs(args) {
+  // Resolve the prompt source (--prompt XOR --prompt-file) here so validation
+  // is self-contained and order-independent: a caller need not have run
+  // resolvePromptSource() first. Skipped when args.prompt is already a plain
+  // string (the classic path / already-resolved by handleStart), so the empty
+  // '' case still falls through to the presence/content checks below.
+  if (args['prompt-file'] !== undefined || args.prompt === undefined || args.prompt === true) {
+    const res = resolvePromptSource(args);
+    if (res.error) {
+      return { valid: false, code: 'MISSING_PROMPT', error: res.error };
+    }
+    args.prompt = res.prompt;
+  }
+
   // Required: --prompt (presence check)
   if (!args.prompt) {
     return { valid: false, error: 'Error: --prompt is required' };

package/src/context-compression.js

@@ -28,6 +28,8 @@ function estimateTokenCount(text) {
     return 0;
   }
 
+  // Intentional cheap heuristic — not a real BPE tokenizer; under/over-counts
+  // for CJK, code, and punctuation-dense text. (ceil, vs floor in context.js.)
   return Math.ceil(text.length / 4);
 }
 

package/src/context.js

@@ -52,7 +52,8 @@ function estimateTokens(text) {
   if (!text || typeof text !== 'string') {
     return 0;
   }
-  // Spec specifies ~4 chars per token
+  // Intentional cheap heuristic (spec §5.3: ~4 chars/token). Not a real BPE
+  // tokenizer — under/over-counts for CJK, code, and punctuation-dense text.
   return Math.floor(text.length / 4);
 }
 

package/src/council/report-html.js

@@ -8,6 +8,7 @@
  */
 
 const { formatCost } = require('../utils/pricing');
+const { formatDuration } = require('../utils/format-duration');
 const { TIER_ORDER, SYMBOL } = require('./report');
 const { tokenCss } = require('../design/tokens');
 
@@ -29,7 +30,7 @@ function esc(s) {
     .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 }
 function num(v) { return (v === null || v === undefined) ? '—' : v.toFixed(2); }
-function dur(ms) { return (ms === null || ms === undefined) ? '—' : `${Math.round(ms / 1000)}s`; }
+function dur(ms) { return formatDuration(ms, '—'); }
 
 function renderHtml(m) {
   const h = m.header;

package/src/council/report.js

@@ -10,6 +10,7 @@
  */
 
 const { formatCost, sumWaveUsage } = require('../utils/pricing');
+const { formatDuration } = require('../utils/format-duration');
 
 const TIER_ORDER = ['Disputed', 'Contested', 'Confirmed', 'Singleton'];
 const SYMBOL = { agree: '✓', dispute: '✗', neutral: '–' };
@@ -49,7 +50,7 @@ function toModel(verdict, wave) {
 }
 
 function fmtNum(v) { return (v === null || v === undefined) ? '—' : v.toFixed(2); }
-function fmtDur(ms) { return (ms === null || ms === undefined) ? '—' : `${Math.round(ms / 1000)}s`; }
+function fmtDur(ms) { return formatDuration(ms, '—'); }
 
 function renderMd(m) {
   const h = m.header;

package/src/council/tally.js

@@ -5,6 +5,13 @@
  * Peers-only tier cascade. a/d are agree/dispute counts among PEER judges
  * (the raiser's own adjudication is excluded by the caller).
  * Exhaustive and mutually exclusive over all (a,d).
+ *
+ * Uncontested agreement is Confirmed: either a strong majority (a>=2 && a>d)
+ * or a lone corroborating peer with no dispute (a=1 && d===0). The latter must
+ * not rank weaker than a lone disputing peer (a=0,d=1, which is Contested); the
+ * `confidence` flag ('thin' when a+d<=1) is what separates single-peer
+ * corroboration from a multi-peer majority. Singleton is now reserved for the
+ * no-signal case (a=0,d=0).
  * @param {number} a - peer agree count
  * @param {number} d - peer dispute count
  * @returns {{tier:string, confidence:'thin'|'solid'}}
@@ -12,7 +19,7 @@
 function assignTier(a, d) {
   let tier;
   if (d >= 2 && d > a) { tier = 'Disputed'; }
-  else if (a >= 2 && a > d) { tier = 'Confirmed'; }
+  else if ((a >= 2 && a > d) || (a === 1 && d === 0)) { tier = 'Confirmed'; }
   else if (d >= 1) { tier = 'Contested'; }
   else { tier = 'Singleton'; }
   const confidence = (a + d <= 1) ? 'thin' : 'solid';
@@ -82,9 +89,17 @@ function tally(input) {
   }
   const outFindings = findings.map(f => {
     const votes = byFinding.get(f.id) || [];
-    const peers = votes.filter(v => v.judge !== f.raiser);
+    // Only exclude the raiser's own vote when a raiser is known; the raiser is
+    // populated by the orchestrator (not the reviewer JSON), so an unset raiser
+    // must not silently drop a real peer vote (L8).
+    const peers = f.raiser ? votes.filter(v => v.judge !== f.raiser) : votes;
     const basis = { a: 0, d: 0, n: 0 };
-    for (const v of peers) { basis[VERDICTS[v.verdict]] += 1; }
+    // Skip unknown verdict strings so a stray value can't corrupt the basis via
+    // basis[undefined] = NaN (L9).
+    for (const v of peers) {
+      const key = VERDICTS[v.verdict];
+      if (key !== undefined) { basis[key] += 1; }
+    }
     const { tier, confidence } = assignTier(basis.a, basis.d);
     return { id: f.id, raiser: f.raiser, severity: f.severity, tier, basis, confidence,
              tierOverride: null, adjudications: votes };

package/src/headless.js

@@ -21,6 +21,27 @@ const { createMirrorState, mirrorMessages, logMessage } = require('./sidecar/con
 const FOLD_MARKER = '[SIDECAR_FOLD]';
 const COMPLETE_MARKER = FOLD_MARKER; // backward compat
 
+/**
+ * #BL-7: the fold marker is the fixed public string [SIDECAR_FOLD]. A model can
+ * legitimately emit it on its own line mid-output — summarizing a prior sidecar,
+ * reproducing these instructions, or from scraped content — which used to force a
+ * PREMATURE fold. Harden by requiring the marker to be the FINAL non-empty line
+ * of the output: a standalone marker followed by MORE content is treated as
+ * echoed prose, not a completion signal. Only the true trailing marker folds.
+ *
+ * @param {string} output - Accumulated assistant output
+ * @returns {number} char index where the trailing marker line begins, or -1
+ */
+function findTrailingFoldMarker(output) {
+  if (!output) { return -1; }
+  // The marker must be the last non-empty line: it sits alone on its line
+  // (only intra-line whitespace around it) and NOTHING but whitespace follows
+  // to the end of the string. The `(?![\s\S]*\S)` lookahead pins it to the true
+  // end — a bare marker followed by more prose is echoed content, not a signal.
+  const m = /^[^\S\r\n]*\[SIDECAR_FOLD\][^\S\r\n]*$(?![\s\S]*\S)/m.exec(output);
+  return m ? m.index : -1;
+}
+
 /**
  * Default timeout: 15 minutes per spec §6.2
  */
@@ -399,10 +420,11 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
           elapsed: Date.now() - startTime
         });
 
-        // Check for completion marker on its own line (not inline in prose).
-        // Models may mention [SIDECAR_FOLD] when describing code — only treat
-        // it as a signal when it appears as a standalone line.
-        if (/^\s*\[SIDECAR_FOLD\]\s*$/m.test(mirror.output)) {
+        // Check for the completion marker as the FINAL non-empty line (#BL-7).
+        // Models may emit [SIDECAR_FOLD] on its own line mid-output (echoing a
+        // prior sidecar, these instructions, or scraped content) — only treat
+        // it as a completion signal when nothing but blank lines follow it.
+        if (findTrailingFoldMarker(mirror.output) !== -1) {
           completed = true;
           break;
         }
@@ -608,7 +630,7 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
 }
 
 /**
- * Extract summary from output (everything before [SIDECAR_FOLD])
+ * Extract summary from output (everything before the trailing [SIDECAR_FOLD])
  * Spec Reference: §6.2 - Return summary (everything before [SIDECAR_FOLD])
  *
  * @param {string} output - Raw output from OpenCode
@@ -619,13 +641,13 @@ function extractSummary(output) {
     return '';
   }
 
-  // Split on the fold marker only when it appears on its own line.
-  // Models may mention [SIDECAR_FOLD] inline when describing code —
-  // only treat it as a delimiter when standalone.
-  const markerRegex = /^\s*\[SIDECAR_FOLD\]\s*$/m;
-  const match = output.match(markerRegex);
-  if (match) {
-    return output.slice(0, match.index).trim();
+  // Split on the fold marker only when it is the FINAL non-empty line (#BL-7).
+  // A [SIDECAR_FOLD] echoed mid-output (describing code, reproducing these
+  // instructions, or from scraped content) is NOT a delimiter — keep it as
+  // content. Only the true trailing marker is stripped.
+  const idx = findTrailingFoldMarker(output);
+  if (idx !== -1) {
+    return output.slice(0, idx).trim();
   }
   return output.trim();
 }
@@ -659,6 +681,7 @@ module.exports = {
   waitForServer,
   withTimeout,
   extractSummary,
+  findTrailingFoldMarker,
   formatFoldOutput,
   DEFAULT_TIMEOUT,
   FOLD_MARKER,

package/src/jsonl-parser.js

@@ -94,16 +94,45 @@ function extractContent(message) {
     return content;
   }
 
-  // Array content (Claude API format with text blocks)
+  // Array content (Claude API format with text/tool blocks). Text blocks pass
+  // through; non-text blocks (tool_use / tool_result) are summarized instead of
+  // dropped, so tool-only assistant turns don't render as an empty string.
   if (Array.isArray(content)) {
     return content
-      .map(block => block.text || '')
+      .map(block => summarizeBlock(block))
       .join('');
   }
 
   return '';
 }
 
+/**
+ * Summarize a single content block to a display string.
+ * Text blocks return their text; tool_use/tool_result blocks return a short
+ * placeholder so they aren't silently collapsed to '' by extractContent.
+ * @param {object} block - A Claude API content block
+ * @returns {string} Display text for the block
+ */
+function summarizeBlock(block) {
+  if (!block || typeof block !== 'object') {
+    return '';
+  }
+
+  if (typeof block.text === 'string') {
+    return block.text;
+  }
+
+  if (block.type === 'tool_use') {
+    return `[tool_use: ${block.name || 'unknown'}]`;
+  }
+
+  if (block.type === 'tool_result') {
+    return '[tool_result]';
+  }
+
+  return '';
+}
+
 /**
  * Format a single message for context output
  * Spec Reference: §5.3 Context Format