amicus 1.7.5 → 1.7.7

package/.claude-plugin/plugin.json

@@ -1,19 +1,40 @@
 {
   "name": "amicus",
-  "version": "1.7.5",
+  "version": "1.7.7",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
-  "author": { "name": "Christian Wagner" },
+  "author": {
+    "name": "Christian Wagner"
+  },
   "homepage": "https://bourbondog.github.io/amicus/",
   "repository": "https://github.com/BourbonDog/amicus",
   "bugs": "https://github.com/BourbonDog/amicus/issues",
   "license": "MIT",
-  "keywords": ["claude-code", "multi-model", "llm", "council", "second-opinion", "sidecar", "gemini", "gpt", "deepseek"],
-  "skills": ["./skills/sidecar", "./skills/second-opinion"],
+  "keywords": [
+    "claude-code",
+    "multi-model",
+    "llm",
+    "council",
+    "second-opinion",
+    "sidecar",
+    "gemini",
+    "gpt",
+    "deepseek"
+  ],
+  "skills": [
+    "./skills/sidecar",
+    "./skills/second-opinion"
+  ],
   "mcpServers": {
     "amicus": {
       "command": "npx",
-      "args": ["-y", "amicus@latest", "mcp"],
-      "env": { "AMICUS_SKIP_POSTINSTALL": "1" }
+      "args": [
+        "-y",
+        "amicus@latest",
+        "mcp"
+      ],
+      "env": {
+        "AMICUS_SKIP_POSTINSTALL": "1"
+      }
     }
   }
 }

package/CHANGELOG.md

@@ -5,6 +5,72 @@ All notable changes to Amicus are documented here. Format follows
 
 ## [Unreleased]
 
+## [1.7.7] - 2026-07-01
+
+Correctness patch from the 2026-07-01 full product review (multi-agent review, every finding adversarially
+verified against source), executed subagent-driven with per-task adversarial review plus a final whole-branch review.
+
+### Fixed
+- **Terminal errors now show their actionable hint.** Human-mode errors printed only the message while `--json`
+  carried a `hint` field; the hint now prints on a second `  → …` line. Budget-gate refusals finally tell you the
+  offending model, the threshold, and the `--max-cost` / `--no-cost-gate` overrides.
+- **Spawned sidecars no longer inherit Amicus's own MCP server.** The recursive-spawn guard only excluded a server
+  literally named `sidecar`, but the product registers as `amicus` — so every child model inherited the full
+  Amicus toolset and could spawn recursively. Children now exclude any inherited entry that *is* Amicus, matched
+  by name **or** by what the command actually runs (`amicus mcp`, `npx … amicus … mcp`, a `bin/amicus.js … mcp`
+  path). Note: this strip has no opt-out — a deliberately configured nested Amicus MCP entry is also removed from
+  spawned children.
+- **Shared-server crash detection actually works.** The crash/restart machinery listened on an event emitter the
+  real server handle never exposed, so it was dead code — a dead engine silently degraded every later session.
+  A pid liveness poll now drives detection and restart, and shutting down during the restart backoff cancels the
+  pending restart instead of spawning a server nobody asked for.
+
+### Changed
+- **`amicus continue` and `amicus resume` now report failures truthfully** (behavior change): error exits 1,
+  timeout exits 2, abort exits 130/143/2 — previously both always exited 0 and recorded the session as
+  `complete` even when the model errored or timed out. The session record now finalizes `error`/`timed-out`
+  accordingly (interactive sessions that legitimately end with an empty summary still finalize `complete`).
+  Scripts that gated on exit code 0 for these verbs will now see real failures.
+
+## [1.7.6] - 2026-07-01
+
+A second independent review (GLM 5.2), adversarially verified against source, then fixed across 11 lanes.
+20 of 22 confirmed findings fixed; 2 partial (deferred as follow-ups). Full unit suite green.
+
+### Security
+- **The `project`/`cwd` MCP input is now sandboxed.** Previously any caller could pass an arbitrary directory
+  (e.g. a system path) and Amicus would create session files and spawn a sidecar there. A new project-root
+  allow-list rejects out-of-bounds paths **before** any filesystem write or spawn, while still allowing paths
+  under your home directory, the current working directory, `AMICUS_PROJECT_DIR`/`AMICUS_PROJECT_ROOTS`, or the
+  MCP client's advertised root — so legitimate `--cwd` use is unaffected.
+- **Folded-back sidecar summaries are fenced as untrusted output.** `amicus_read`'s returned summary — produced
+  by an arbitrary model — is now wrapped in a read-only fence (mirroring the outbound conversation fence), so
+  model prose entering the orchestrator's context is marked as data, not instructions.
+- **The Electron content view no longer shares the privileged bridge.** The embedded OpenCode web view gets a
+  minimal preload that exposes nothing privileged, and IPC handlers validate the sender, so only the toolbar can
+  trigger update/settings actions.
+
+### Fixed
+- **A crashed OpenCode server is now detected.** The shared-server crash/restart machinery was unreachable (no
+  exit listener was ever attached); a server exit is now wired to the restart path.
+- **Session metadata is written atomically** (temp file + rename), so a crash mid-write can no longer corrupt
+  `metadata.json` and silently mask an abort marker.
+- **Port lookup works on Windows.** The stale-process cleanup used a hardcoded `lsof` (a no-op on Windows); it
+  now uses the cross-platform `netstat`-based lookup.
+- **A fan-out leg whose setup throws no longer sinks the whole wave** — the leg is turned into an error result
+  and `wave.json` is still written.
+- **The setup window can't hang on a spawn failure** — a spawn error now resolves cleanly instead of leaving the
+  launch promise pending forever, and the Electron child is killed on parent exit.
+- **Project-scoped `opencode.json` resolves against the target project**, not the launcher's working directory.
+- Smaller correctness/cleanup fixes: single-peer-agreed council findings now count as corroborated; unknown
+  council verdicts are guarded; tool-call turns render a summary instead of blank; quote-aware `--mcp` command
+  parsing; a model-object shape guard; a single shared duration formatter; timed mirror teardown; a lock on the
+  continuation session; and canonical session-route separators.
+
+### Known follow-ups
+- Fencing `amicus_council_tally`/`amicus_verdict` (they return JSON records, so they need a field-level fence).
+- Removing the now-dead top-level `tool_use` formatter branch (blocked on an unrelated test assertion).
+
 ## [1.7.5] - 2026-07-01
 
 A batch of fixes from an independent DeepSeek V4 Pro code review, each verified against source.

package/LICENSE

@@ -1,27 +1,7 @@
 MIT License
 
-Copyright (c) 2025 John Renaldi Claude Sidecar
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
-Copyright (c) 2026 Christian Wagner Amicus
+Copyright (c) 2026 Christian Wagner
+Copyright (c) 2025 John Renaldi
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -57,13 +57,37 @@ Claude is the orchestrator. The council and chat skills run *on top of* the engi
 
 ## Quick start
 
-**Install:**
+**Install** — pick whichever fits; all deliver the same CLI, MCP server, and both skills:
+
+**As a Claude Code plugin** — the most native path if you use Claude Code:
+
+```text
+/plugin marketplace add BourbonDog/amicus
+/plugin install amicus@bourbondog-amicus
+/reload-plugins
+```
+
+Claude Code registers the MCP server and both skills for you — nothing to configure. (The standalone Electron window is npm-only, and the first council/sidecar call downloads the OpenCode engine.)
+
+**With the install script** — macOS, Linux, or Windows (needs [Node.js](https://nodejs.org) ≥ 18):
+
+```bash
+# macOS / Linux
+curl -fsSL https://raw.githubusercontent.com/BourbonDog/amicus/main/install.sh | sh
+```
+
+```powershell
+# Windows (PowerShell)
+irm https://raw.githubusercontent.com/BourbonDog/amicus/main/install.ps1 | iex
+```
+
+**With npm** — the canonical path (needs [Node.js](https://nodejs.org) ≥ 18):
 
 ```bash
 npm install -g amicus
 ```
 
-The postinstall step auto-configures everything — no manual registration:
+For the **npm** and **install-script** paths, a postinstall auto-configures everything — no manual registration:
 
 - Registers the **MCP server** in Claude Code and in Claude Desktop / Cowork, so the Amicus tools appear natively.
 - Installs **both skills** into `~/.claude/skills/` — `second-opinion` (the council) and `sidecar` (the chat skill).

package/bin/amicus.js

@@ -95,10 +95,10 @@ async function main() {
         await handleList(args);
         break;
       case 'resume':
-        await handleResume(args);
+        exitCode = await handleResume(args);
         break;
       case 'continue':
-        await handleContinue(args);
+        exitCode = await handleContinue(args);
         break;
       case 'read':
         await handleRead(args);
@@ -188,7 +188,7 @@ async function handleResume(args) {
 
   const { resumeSidecar } = require('../src/index');
 
-  await resumeSidecar({
+  return await resumeSidecar({
     taskId,
     project: args.cwd,
     headless: args['no-ui'],
@@ -242,7 +242,7 @@ async function handleContinue(args) {
 
   const { continueSidecar } = require('../src/index');
 
-  await continueSidecar({
+  return await continueSidecar({
     taskId,
     newTaskId: args['task-id'],
     briefing: args.prompt || args.briefing,

package/electron/ipc-guard.js

@@ -0,0 +1,66 @@
+/**
+ * IPC Guard Helpers
+ *
+ * Small, pure helpers extracted from main.js so the security-sensitive bits are
+ * unit-testable (main.js itself runs heavy Electron side effects at import).
+ *
+ *  - isPrivilegedSender: pin privileged IPC handlers to the toolbar window so a
+ *    compromised/remote page in the OpenCode BrowserView cannot invoke them (M9).
+ *  - isAllowedContentNavigation: pin the OpenCode BrowserView to its localhost
+ *    origin so it cannot be navigated off to an attacker-controlled page (M9).
+ *  - handleFatalException: EPIPE stays a no-op; any other uncaught exception is
+ *    logged and then quits the app rather than leaving a wedged invisible shell
+ *    (L10).
+ */
+
+/**
+ * Whether an IPC event originated from the privileged toolbar window.
+ * @param {{ sender?: object }} event - The ipcMain event.
+ * @param {() => (object|null)} getToolbarWindow - Returns the toolbar BrowserWindow (or null).
+ * @returns {boolean} true only when the sender is the toolbar window's webContents.
+ */
+function isPrivilegedSender(event, getToolbarWindow) {
+  const win = getToolbarWindow();
+  if (!win || win.isDestroyed?.()) { return false; }
+  return Boolean(event && event.sender && event.sender === win.webContents);
+}
+
+/**
+ * Whether a navigation target is allowed for the OpenCode content BrowserView.
+ * Only the OpenCode localhost origin (any path) is permitted; everything else
+ * (external http(s), file:, etc.) is blocked. data: URLs are allowed so the
+ * in-app load-error page can render.
+ * @param {string} targetUrl - The URL the view is trying to navigate to.
+ * @param {string} allowedOrigin - e.g. 'http://localhost:4096'.
+ * @returns {boolean}
+ */
+function isAllowedContentNavigation(targetUrl, allowedOrigin) {
+  if (typeof targetUrl !== 'string' || !targetUrl) { return false; }
+  if (targetUrl.startsWith('data:')) { return true; }
+  try {
+    const target = new URL(targetUrl);
+    const allowed = new URL(allowedOrigin);
+    return target.origin === allowed.origin;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Handle a process 'uncaughtException'. EPIPE is a benign no-op; anything else
+ * is logged and then quits the app so a genuinely unexpected error cannot leave
+ * an invisible, silently-hung shell.
+ * @param {Error & { code?: string }} err
+ * @param {{ quit: () => void, log?: (err: Error) => void }} deps
+ */
+function handleFatalException(err, { quit, log } = {}) {
+  if (err && err.code === 'EPIPE') { return; }
+  if (log) {
+    log(err);
+  } else {
+    console.error('Uncaught exception:', err);
+  }
+  if (typeof quit === 'function') { quit(); }
+}
+
+module.exports = { isPrivilegedSender, isAllowedContentNavigation, handleFatalException };

package/electron/main.js

@@ -24,6 +24,11 @@ const { attachLoadFailsafe, buildLoadErrorHTML } = require('./load-failsafe');
 const { buildSessionRoute } = require('./session-route');
 const { buildOpencodeThemeCSS } = require('./opencode-theme');
 const { TOKENS } = require('../src/design/tokens');
+const {
+  isPrivilegedSender,
+  isAllowedContentNavigation,
+  handleFatalException,
+} = require('./ipc-guard');
 
 const ICON_PATH = path.join(__dirname, 'assets', 'icon.png');
 
@@ -39,8 +44,10 @@ process.stderr.on('error', (err) => {
   if (err.code === 'EPIPE') { return; }
 });
 process.on('uncaughtException', (err) => {
-  if (err.code === 'EPIPE') { return; }
-  console.error('Uncaught exception:', err);
+  // EPIPE stays a benign no-op; any other uncaught exception is logged and then
+  // quits the app so a genuinely unexpected error cannot leave a wedged,
+  // invisible shell hanging in the background (L10).
+  handleFatalException(err, { quit: () => app.quit() });
 });
 process.on('unhandledRejection', (reason) => {
   console.error('Unhandled rejection:', reason);
@@ -135,13 +142,26 @@ function createAmicusWindow() {
   mainWindow.loadURL(`data:text/html;charset=utf-8,${encodeURIComponent(toolbarHtml)}`);
   mainWindow.webContents.on('page-title-updated', (e) => e.preventDefault());
 
-  // BrowserView for OpenCode content
+  // BrowserView for OpenCode content. It uses a MINIMAL preload that exposes no
+  // privileged bridge — the OpenCode page must not be able to reach the fold /
+  // settings / update IPC (M9). The toolbar window keeps preload.js.
   contentView = new BrowserView({
     webPreferences: {
-      preload: path.join(__dirname, 'preload.js'),
+      preload: path.join(__dirname, 'preload-content.js'),
       contextIsolation: true, nodeIntegration: false,
     }
   });
+
+  // Pin the content view to the OpenCode localhost origin: block any attempt to
+  // navigate it off-origin or open new windows (defense-in-depth, M9). data:
+  // URLs (the in-app load-error page) are still allowed by the guard.
+  contentView.webContents.on('will-navigate', (event, targetUrl) => {
+    if (!isAllowedContentNavigation(targetUrl, OPENCODE_URL)) {
+      logger.warn('Blocked content-view navigation', { targetUrl });
+      event.preventDefault();
+    }
+  });
+  contentView.webContents.setWindowOpenHandler(() => ({ action: 'deny' }));
   // Load OpenCode off-screen first; only attach BrowserView after rebranding
   // to prevent the OpenCode logo/splash from flashing during load.
   mainWindow.on('resize', updateContentBounds);
@@ -400,25 +420,35 @@ function rebrandUI() {
 // IPC Handlers
 // ============================================================================
 
+// These handlers are privileged (fold/settings/update/resize). Only the toolbar
+// window may invoke them — the OpenCode content BrowserView must not (M9). The
+// content view no longer gets a bridge preload, but we still validate the
+// sender as belt-and-suspenders in case a future preload change reintroduces one.
+const fromToolbar = (event) => isPrivilegedSender(event, () => mainWindow);
+
 // Amicus mode: fold
-ipcMain.handle('sidecar:fold', () => {
+ipcMain.handle('sidecar:fold', (event) => {
+  if (!fromToolbar(event)) { return; }
   return foldHandler.triggerFold(mainWindow, contentView);
 });
 
 // Amicus mode: open settings in a child window
-ipcMain.handle('sidecar:open-settings', () => {
+ipcMain.handle('sidecar:open-settings', (event) => {
+  if (!fromToolbar(event)) { return; }
   createSettingsChildWindow();
 });
 
 // Update check
-ipcMain.handle('sidecar:get-update-info', async () => {
+ipcMain.handle('sidecar:get-update-info', async (event) => {
+  if (!fromToolbar(event)) { return null; }
   const { getUpdateInfo, initUpdateCheck } = require('../src/utils/updater');
   await initUpdateCheck();
   return getUpdateInfo();
 });
 
 // Perform update
-ipcMain.handle('sidecar:perform-update', async () => {
+ipcMain.handle('sidecar:perform-update', async (event) => {
+  if (!fromToolbar(event)) { return { success: false, error: 'unauthorized' }; }
   const { performUpdate } = require('../src/utils/updater');
   const result = await performUpdate();
   if (mainWindow && !mainWindow.isDestroyed()) {
@@ -428,7 +458,8 @@ ipcMain.handle('sidecar:perform-update', async () => {
 });
 
 // Resize toolbar area (called when update banner shows/hides)
-ipcMain.handle('sidecar:resize-toolbar', (_event, height) => {
+ipcMain.handle('sidecar:resize-toolbar', (event, height) => {
+  if (!fromToolbar(event)) { return; }
   currentToolbarH = height;
   updateContentBounds();
 });

package/electron/preload-content.js

@@ -0,0 +1,37 @@
+/**
+ * Content Preload - OpenCode BrowserView (minimal, no privileged bridge)
+ *
+ * The OpenCode Web UI is remote-ish content: it should NOT be able to reach the
+ * privileged sidecar IPC (fold/open-settings/perform-update/...). This preload
+ * therefore exposes NOTHING via contextBridge — it only injects the cosmetic
+ * branding CSS. The toolbar window keeps preload.js; the content view uses this.
+ *
+ * (M9 defense-in-depth: the toolbar and the content view no longer share the
+ * bridge-exposing preload.)
+ */
+
+/**
+ * Inject CSS to hide OpenCode branding and match the window background color to
+ * prevent a white flash on load. Cosmetic only — must never throw.
+ */
+function injectBrandingCss() {
+  try {
+    const style = document.createElement('style');
+    style.textContent = [
+      'html, body { background-color: var(--bg, #0a0a0a) !important; }',
+      '#root > div > header { display: none !important; }',
+      'svg[viewBox="0 0 234 42"] { display: none !important; }',
+    ].join('\n');
+    document.documentElement.appendChild(style);
+  } catch {
+    // cosmetic — a failed injection must not break the preload
+  }
+}
+
+// documentElement is still null while the preload evaluates; defer until the
+// DOM exists so the injection cannot null-deref.
+if (document.documentElement) {
+  injectBrandingCss();
+} else {
+  document.addEventListener('DOMContentLoaded', injectBrandingCss);
+}

package/electron/session-route.js

@@ -12,16 +12,23 @@
  *
  * Pure function: no electron, no fs, no process state. Safe to unit-test.
  *
+ * The directory is canonicalized before encoding so incidental separator
+ * differences (Windows '\\' vs '/', mixed/duplicate separators) produce the same
+ * route segment — otherwise OpenCode normalizing '/' vs '\\' would yield a
+ * mismatched base64url and a "session not found" route.
+ *
  * @param {string} baseUrl - OpenCode server base URL (e.g. http://localhost:4096)
  * @param {string} [sessionId] - OpenCode session id; falsy → return baseUrl only
  * @param {string} sessionDirectory - The directory the session is scoped to
  * @returns {string} Fully-qualified route URL, or baseUrl when no session id.
  */
+const { canonicalProjectPath } = require('../src/utils/project-path');
+
 function buildSessionRoute(baseUrl, sessionId, sessionDirectory) {
   if (!sessionId) {
     return baseUrl;
   }
-  const seg = Buffer.from(sessionDirectory).toString('base64url');
+  const seg = Buffer.from(canonicalProjectPath(sessionDirectory)).toString('base64url');
   return `${baseUrl}/${seg}/session/${sessionId}`;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "1.7.5",
+  "version": "1.7.7",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [
     "claude",

package/src/council/report-html.js

@@ -8,6 +8,7 @@
  */
 
 const { formatCost } = require('../utils/pricing');
+const { formatDuration } = require('../utils/format-duration');
 const { TIER_ORDER, SYMBOL } = require('./report');
 const { tokenCss } = require('../design/tokens');
 
@@ -29,7 +30,7 @@ function esc(s) {
     .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 }
 function num(v) { return (v === null || v === undefined) ? '—' : v.toFixed(2); }
-function dur(ms) { return (ms === null || ms === undefined) ? '—' : `${Math.round(ms / 1000)}s`; }
+function dur(ms) { return formatDuration(ms, '—'); }
 
 function renderHtml(m) {
   const h = m.header;

package/src/council/report.js

@@ -10,6 +10,7 @@
  */
 
 const { formatCost, sumWaveUsage } = require('../utils/pricing');
+const { formatDuration } = require('../utils/format-duration');
 
 const TIER_ORDER = ['Disputed', 'Contested', 'Confirmed', 'Singleton'];
 const SYMBOL = { agree: '✓', dispute: '✗', neutral: '–' };
@@ -49,7 +50,7 @@ function toModel(verdict, wave) {
 }
 
 function fmtNum(v) { return (v === null || v === undefined) ? '—' : v.toFixed(2); }
-function fmtDur(ms) { return (ms === null || ms === undefined) ? '—' : `${Math.round(ms / 1000)}s`; }
+function fmtDur(ms) { return formatDuration(ms, '—'); }
 
 function renderMd(m) {
   const h = m.header;

package/src/council/tally.js

@@ -5,6 +5,13 @@
  * Peers-only tier cascade. a/d are agree/dispute counts among PEER judges
  * (the raiser's own adjudication is excluded by the caller).
  * Exhaustive and mutually exclusive over all (a,d).
+ *
+ * Uncontested agreement is Confirmed: either a strong majority (a>=2 && a>d)
+ * or a lone corroborating peer with no dispute (a=1 && d===0). The latter must
+ * not rank weaker than a lone disputing peer (a=0,d=1, which is Contested); the
+ * `confidence` flag ('thin' when a+d<=1) is what separates single-peer
+ * corroboration from a multi-peer majority. Singleton is now reserved for the
+ * no-signal case (a=0,d=0).
  * @param {number} a - peer agree count
  * @param {number} d - peer dispute count
  * @returns {{tier:string, confidence:'thin'|'solid'}}
@@ -12,7 +19,7 @@
 function assignTier(a, d) {
   let tier;
   if (d >= 2 && d > a) { tier = 'Disputed'; }
-  else if (a >= 2 && a > d) { tier = 'Confirmed'; }
+  else if ((a >= 2 && a > d) || (a === 1 && d === 0)) { tier = 'Confirmed'; }
   else if (d >= 1) { tier = 'Contested'; }
   else { tier = 'Singleton'; }
   const confidence = (a + d <= 1) ? 'thin' : 'solid';
@@ -82,9 +89,17 @@ function tally(input) {
   }
   const outFindings = findings.map(f => {
     const votes = byFinding.get(f.id) || [];
-    const peers = votes.filter(v => v.judge !== f.raiser);
+    // Only exclude the raiser's own vote when a raiser is known; the raiser is
+    // populated by the orchestrator (not the reviewer JSON), so an unset raiser
+    // must not silently drop a real peer vote (L8).
+    const peers = f.raiser ? votes.filter(v => v.judge !== f.raiser) : votes;
     const basis = { a: 0, d: 0, n: 0 };
-    for (const v of peers) { basis[VERDICTS[v.verdict]] += 1; }
+    // Skip unknown verdict strings so a stray value can't corrupt the basis via
+    // basis[undefined] = NaN (L9).
+    for (const v of peers) {
+      const key = VERDICTS[v.verdict];
+      if (key !== undefined) { basis[key] += 1; }
+    }
     const { tier, confidence } = assignTier(basis.a, basis.d);
     return { id: f.id, raiser: f.raiser, severity: f.severity, tier, basis, confidence,
              tierOverride: null, adjudications: votes };

package/src/jsonl-parser.js

@@ -94,16 +94,45 @@ function extractContent(message) {
     return content;
   }
 
-  // Array content (Claude API format with text blocks)
+  // Array content (Claude API format with text/tool blocks). Text blocks pass
+  // through; non-text blocks (tool_use / tool_result) are summarized instead of
+  // dropped, so tool-only assistant turns don't render as an empty string.
   if (Array.isArray(content)) {
     return content
-      .map(block => block.text || '')
+      .map(block => summarizeBlock(block))
       .join('');
   }
 
   return '';
 }
 
+/**
+ * Summarize a single content block to a display string.
+ * Text blocks return their text; tool_use/tool_result blocks return a short
+ * placeholder so they aren't silently collapsed to '' by extractContent.
+ * @param {object} block - A Claude API content block
+ * @returns {string} Display text for the block
+ */
+function summarizeBlock(block) {
+  if (!block || typeof block !== 'object') {
+    return '';
+  }
+
+  if (typeof block.text === 'string') {
+    return block.text;
+  }
+
+  if (block.type === 'tool_use') {
+    return `[tool_use: ${block.name || 'unknown'}]`;
+  }
+
+  if (block.type === 'tool_result') {
+    return '[tool_result]';
+  }
+
+  return '';
+}
+
 /**
  * Format a single message for context output
  * Spec Reference: §5.3 Context Format