bmalph 2.7.5 → 2.7.7

package/ralph/ralph_loop.sh

@@ -40,9 +40,32 @@ _env_MAX_CALLS_PER_HOUR="${MAX_CALLS_PER_HOUR:-}"
 _env_CLAUDE_TIMEOUT_MINUTES="${CLAUDE_TIMEOUT_MINUTES:-}"
 _env_CLAUDE_OUTPUT_FORMAT="${CLAUDE_OUTPUT_FORMAT:-}"
 _env_CLAUDE_ALLOWED_TOOLS="${CLAUDE_ALLOWED_TOOLS:-}"
+_env_has_CLAUDE_PERMISSION_MODE="${CLAUDE_PERMISSION_MODE+x}"
+_env_CLAUDE_PERMISSION_MODE="${CLAUDE_PERMISSION_MODE:-}"
 _env_CLAUDE_USE_CONTINUE="${CLAUDE_USE_CONTINUE:-}"
 _env_CLAUDE_SESSION_EXPIRY_HOURS="${CLAUDE_SESSION_EXPIRY_HOURS:-}"
+_env_ALLOWED_TOOLS="${ALLOWED_TOOLS:-}"
+_env_SESSION_CONTINUITY="${SESSION_CONTINUITY:-}"
+_env_SESSION_EXPIRY_HOURS="${SESSION_EXPIRY_HOURS:-}"
+_env_PERMISSION_DENIAL_MODE="${PERMISSION_DENIAL_MODE:-}"
+_env_RALPH_VERBOSE="${RALPH_VERBOSE:-}"
 _env_VERBOSE_PROGRESS="${VERBOSE_PROGRESS:-}"
+
+# CLI flags are parsed before main() runs, so capture explicit values separately.
+_CLI_MAX_CALLS_PER_HOUR="${_CLI_MAX_CALLS_PER_HOUR:-}"
+_CLI_CLAUDE_TIMEOUT_MINUTES="${_CLI_CLAUDE_TIMEOUT_MINUTES:-}"
+_CLI_CLAUDE_OUTPUT_FORMAT="${_CLI_CLAUDE_OUTPUT_FORMAT:-}"
+_CLI_ALLOWED_TOOLS="${_CLI_ALLOWED_TOOLS:-}"
+_CLI_SESSION_CONTINUITY="${_CLI_SESSION_CONTINUITY:-}"
+_CLI_SESSION_EXPIRY_HOURS="${_CLI_SESSION_EXPIRY_HOURS:-}"
+_CLI_VERBOSE_PROGRESS="${_CLI_VERBOSE_PROGRESS:-}"
+_cli_MAX_CALLS_PER_HOUR="${MAX_CALLS_PER_HOUR:-}"
+_cli_CLAUDE_TIMEOUT_MINUTES="${CLAUDE_TIMEOUT_MINUTES:-}"
+_cli_CLAUDE_OUTPUT_FORMAT="${CLAUDE_OUTPUT_FORMAT:-}"
+_cli_CLAUDE_ALLOWED_TOOLS="${CLAUDE_ALLOWED_TOOLS:-}"
+_cli_CLAUDE_USE_CONTINUE="${CLAUDE_USE_CONTINUE:-}"
+_cli_CLAUDE_SESSION_EXPIRY_HOURS="${CLAUDE_SESSION_EXPIRY_HOURS:-}"
+_cli_VERBOSE_PROGRESS="${VERBOSE_PROGRESS:-}"
 _env_CB_COOLDOWN_MINUTES="${CB_COOLDOWN_MINUTES:-}"
 _env_CB_AUTO_RESET="${CB_AUTO_RESET:-}"
 
@@ -50,11 +73,15 @@ _env_CB_AUTO_RESET="${CB_AUTO_RESET:-}"
 MAX_CALLS_PER_HOUR="${MAX_CALLS_PER_HOUR:-100}"
 VERBOSE_PROGRESS="${VERBOSE_PROGRESS:-false}"
 CLAUDE_TIMEOUT_MINUTES="${CLAUDE_TIMEOUT_MINUTES:-15}"
+DEFAULT_CLAUDE_ALLOWED_TOOLS="Write,Read,Edit,MultiEdit,Glob,Grep,Task,TodoWrite,WebFetch,WebSearch,EnterPlanMode,ExitPlanMode,NotebookEdit,Bash"
+DEFAULT_PERMISSION_DENIAL_MODE="continue"
 
 # Modern Claude CLI configuration (Phase 1.1)
 CLAUDE_OUTPUT_FORMAT="${CLAUDE_OUTPUT_FORMAT:-json}"
-CLAUDE_ALLOWED_TOOLS="${CLAUDE_ALLOWED_TOOLS:-Write,Read,Edit,Bash(git *),Bash(npm *),Bash(pytest)}"
+CLAUDE_ALLOWED_TOOLS="${CLAUDE_ALLOWED_TOOLS:-$DEFAULT_CLAUDE_ALLOWED_TOOLS}"
+CLAUDE_PERMISSION_MODE="${CLAUDE_PERMISSION_MODE:-bypassPermissions}"
 CLAUDE_USE_CONTINUE="${CLAUDE_USE_CONTINUE:-true}"
+PERMISSION_DENIAL_MODE="${PERMISSION_DENIAL_MODE:-$DEFAULT_PERMISSION_DENIAL_MODE}"
 CLAUDE_SESSION_FILE="$RALPH_DIR/.claude_session_id" # Session ID persistence file
 CLAUDE_MIN_VERSION="2.0.76"              # Minimum required Claude CLI version
 
@@ -80,6 +107,9 @@ VALID_TOOL_PATTERNS=(
     "TodoWrite"
     "WebFetch"
     "WebSearch"
+    "AskUserQuestion"
+    "EnterPlanMode"
+    "ExitPlanMode"
     "Bash"
     "Bash(git *)"
     "Bash(npm *)"
@@ -88,6 +118,8 @@ VALID_TOOL_PATTERNS=(
     "Bash(node *)"
     "NotebookEdit"
 )
+ALLOWED_TOOLS_IGNORED_WARNED=false
+PERMISSION_DENIAL_ACTION=""
 
 # Exit detection configuration
 EXIT_SIGNALS_FILE="$RALPH_DIR/.exit_signals"
@@ -131,7 +163,9 @@ resolve_ralphrc_file() {
 #   - MAX_CALLS_PER_HOUR
 #   - CLAUDE_TIMEOUT_MINUTES
 #   - CLAUDE_OUTPUT_FORMAT
-#   - ALLOWED_TOOLS (mapped to CLAUDE_ALLOWED_TOOLS)
+#   - CLAUDE_PERMISSION_MODE
+#   - ALLOWED_TOOLS (mapped to CLAUDE_ALLOWED_TOOLS for Claude Code only)
+#   - PERMISSION_DENIAL_MODE
 #   - SESSION_CONTINUITY (mapped to CLAUDE_USE_CONTINUE)
 #   - SESSION_EXPIRY_HOURS (mapped to CLAUDE_SESSION_EXPIRY_HOURS)
 #   - CB_NO_PROGRESS_THRESHOLD
@@ -155,6 +189,9 @@ load_ralphrc() {
     if [[ -n "${ALLOWED_TOOLS:-}" ]]; then
         CLAUDE_ALLOWED_TOOLS="$ALLOWED_TOOLS"
     fi
+    if [[ -n "${PERMISSION_DENIAL_MODE:-}" ]]; then
+        PERMISSION_DENIAL_MODE="$PERMISSION_DENIAL_MODE"
+    fi
     if [[ -n "${SESSION_CONTINUITY:-}" ]]; then
         CLAUDE_USE_CONTINUE="$SESSION_CONTINUITY"
     fi
@@ -167,22 +204,57 @@ load_ralphrc() {
 
     # Restore ONLY values that were explicitly set via environment variables
     # (not script defaults). The _env_* variables were captured BEFORE defaults were set.
-    # If _env_* is non-empty, the user explicitly set it in their environment.
+    # Internal CLAUDE_* variables are kept for backward compatibility.
     [[ -n "$_env_MAX_CALLS_PER_HOUR" ]] && MAX_CALLS_PER_HOUR="$_env_MAX_CALLS_PER_HOUR"
     [[ -n "$_env_CLAUDE_TIMEOUT_MINUTES" ]] && CLAUDE_TIMEOUT_MINUTES="$_env_CLAUDE_TIMEOUT_MINUTES"
     [[ -n "$_env_CLAUDE_OUTPUT_FORMAT" ]] && CLAUDE_OUTPUT_FORMAT="$_env_CLAUDE_OUTPUT_FORMAT"
     [[ -n "$_env_CLAUDE_ALLOWED_TOOLS" ]] && CLAUDE_ALLOWED_TOOLS="$_env_CLAUDE_ALLOWED_TOOLS"
+    if [[ "$_env_has_CLAUDE_PERMISSION_MODE" == "x" ]]; then
+        CLAUDE_PERMISSION_MODE="$_env_CLAUDE_PERMISSION_MODE"
+    fi
     [[ -n "$_env_CLAUDE_USE_CONTINUE" ]] && CLAUDE_USE_CONTINUE="$_env_CLAUDE_USE_CONTINUE"
     [[ -n "$_env_CLAUDE_SESSION_EXPIRY_HOURS" ]] && CLAUDE_SESSION_EXPIRY_HOURS="$_env_CLAUDE_SESSION_EXPIRY_HOURS"
+    [[ -n "$_env_PERMISSION_DENIAL_MODE" ]] && PERMISSION_DENIAL_MODE="$_env_PERMISSION_DENIAL_MODE"
     [[ -n "$_env_VERBOSE_PROGRESS" ]] && VERBOSE_PROGRESS="$_env_VERBOSE_PROGRESS"
+
+    # Public aliases are the preferred external interface and win over the
+    # legacy internal environment variables when both are explicitly set.
+    [[ -n "$_env_ALLOWED_TOOLS" ]] && CLAUDE_ALLOWED_TOOLS="$_env_ALLOWED_TOOLS"
+    [[ -n "$_env_SESSION_CONTINUITY" ]] && CLAUDE_USE_CONTINUE="$_env_SESSION_CONTINUITY"
+    [[ -n "$_env_SESSION_EXPIRY_HOURS" ]] && CLAUDE_SESSION_EXPIRY_HOURS="$_env_SESSION_EXPIRY_HOURS"
+    [[ -n "$_env_RALPH_VERBOSE" ]] && VERBOSE_PROGRESS="$_env_RALPH_VERBOSE"
+
+    # CLI flags are the highest-priority runtime inputs because they are
+    # parsed before main() and would otherwise be overwritten by .ralphrc.
+    # Keep every config-backed CLI flag here so the precedence contract stays
+    # consistent: CLI > public env aliases > internal env vars > config.
+    [[ "$_CLI_MAX_CALLS_PER_HOUR" == "true" ]] && MAX_CALLS_PER_HOUR="$_cli_MAX_CALLS_PER_HOUR"
+    [[ "$_CLI_CLAUDE_TIMEOUT_MINUTES" == "true" ]] && CLAUDE_TIMEOUT_MINUTES="$_cli_CLAUDE_TIMEOUT_MINUTES"
+    [[ "$_CLI_CLAUDE_OUTPUT_FORMAT" == "true" ]] && CLAUDE_OUTPUT_FORMAT="$_cli_CLAUDE_OUTPUT_FORMAT"
+    [[ "$_CLI_ALLOWED_TOOLS" == "true" ]] && CLAUDE_ALLOWED_TOOLS="$_cli_CLAUDE_ALLOWED_TOOLS"
+    [[ "$_CLI_SESSION_CONTINUITY" == "true" ]] && CLAUDE_USE_CONTINUE="$_cli_CLAUDE_USE_CONTINUE"
+    [[ "$_CLI_SESSION_EXPIRY_HOURS" == "true" ]] && CLAUDE_SESSION_EXPIRY_HOURS="$_cli_CLAUDE_SESSION_EXPIRY_HOURS"
+    [[ "$_CLI_VERBOSE_PROGRESS" == "true" ]] && VERBOSE_PROGRESS="$_cli_VERBOSE_PROGRESS"
     [[ -n "$_env_CB_COOLDOWN_MINUTES" ]] && CB_COOLDOWN_MINUTES="$_env_CB_COOLDOWN_MINUTES"
     [[ -n "$_env_CB_AUTO_RESET" ]] && CB_AUTO_RESET="$_env_CB_AUTO_RESET"
 
+    normalize_claude_permission_mode
     RALPHRC_FILE="$config_file"
     RALPHRC_LOADED=true
     return 0
 }
 
+driver_supports_tool_allowlist() {
+    return 1
+}
+
+driver_permission_denial_help() {
+    echo "  - Review the active driver's permission or approval settings."
+    echo "  - ALLOWED_TOOLS in $RALPHRC_FILE only applies to the Claude Code driver."
+    echo "  - Keep CLAUDE_PERMISSION_MODE=bypassPermissions for unattended Claude Code loops."
+    echo "  - After updating permissions, reset the session and restart the loop."
+}
+
 # Source platform driver
 load_platform_driver() {
     local driver_file="$SCRIPT_DIR/drivers/${PLATFORM_DRIVER}.sh"
@@ -323,8 +395,8 @@ setup_tmux_session() {
     if [[ "$CLAUDE_TIMEOUT_MINUTES" != "15" ]]; then
         ralph_cmd="$ralph_cmd --timeout $CLAUDE_TIMEOUT_MINUTES"
     fi
-    # Forward --allowed-tools if non-default
-    if [[ "$CLAUDE_ALLOWED_TOOLS" != "Write,Read,Edit,Bash(git *),Bash(npm *),Bash(pytest)" ]]; then
+    # Forward --allowed-tools only for drivers that support tool allowlists
+    if driver_supports_tool_allowlist && [[ "$CLAUDE_ALLOWED_TOOLS" != "$DEFAULT_CLAUDE_ALLOWED_TOOLS" ]]; then
         ralph_cmd="$ralph_cmd --allowed-tools '$CLAUDE_ALLOWED_TOOLS'"
     fi
     # Forward --no-continue if session continuity disabled
@@ -443,6 +515,175 @@ update_status() {
         }' > "$STATUS_FILE"
 }
 
+validate_permission_denial_mode() {
+    local mode=$1
+
+    case "$mode" in
+        continue|halt|threshold)
+            return 0
+            ;;
+        *)
+            echo "Error: Invalid PERMISSION_DENIAL_MODE: '$mode'"
+            echo "Valid modes: continue halt threshold"
+            return 1
+            ;;
+    esac
+}
+
+normalize_claude_permission_mode() {
+    if [[ -z "${CLAUDE_PERMISSION_MODE:-}" ]]; then
+        CLAUDE_PERMISSION_MODE="bypassPermissions"
+    fi
+}
+
+validate_claude_permission_mode() {
+    local mode=$1
+
+    case "$mode" in
+        auto|acceptEdits|bypassPermissions|default|dontAsk|plan)
+            return 0
+            ;;
+        *)
+            echo "Error: Invalid CLAUDE_PERMISSION_MODE: '$mode'"
+            echo "Valid modes: auto acceptEdits bypassPermissions default dontAsk plan"
+            return 1
+            ;;
+    esac
+}
+
+warn_if_allowed_tools_ignored() {
+    if driver_supports_tool_allowlist; then
+        return 0
+    fi
+
+    if [[ "$ALLOWED_TOOLS_IGNORED_WARNED" == "true" ]]; then
+        return 0
+    fi
+
+    if [[ "${_CLI_ALLOWED_TOOLS:-}" == "true" || "$CLAUDE_ALLOWED_TOOLS" != "$DEFAULT_CLAUDE_ALLOWED_TOOLS" ]]; then
+        log_status "WARN" "ALLOWED_TOOLS/--allowed-tools is ignored by $DRIVER_DISPLAY_NAME."
+        ALLOWED_TOOLS_IGNORED_WARNED=true
+    fi
+
+    return 0
+}
+
+show_current_allowed_tools() {
+    if ! driver_supports_tool_allowlist; then
+        return 0
+    fi
+
+    if [[ -f "$RALPHRC_FILE" ]]; then
+        local current_tools=$(grep "^ALLOWED_TOOLS=" "$RALPHRC_FILE" 2>/dev/null | cut -d= -f2- | tr -d '"')
+        if [[ -n "$current_tools" ]]; then
+            echo -e "${BLUE}Current ALLOWED_TOOLS:${NC} $current_tools"
+            echo ""
+        fi
+    fi
+
+    return 0
+}
+
+response_analysis_has_permission_denials() {
+    if [[ ! -f "$RESPONSE_ANALYSIS_FILE" ]]; then
+        return 1
+    fi
+
+    local has_permission_denials
+    has_permission_denials=$(jq -r '.analysis.has_permission_denials // false' "$RESPONSE_ANALYSIS_FILE" 2>/dev/null || echo "false")
+
+    [[ "$has_permission_denials" == "true" ]]
+}
+
+get_response_analysis_denied_commands() {
+    if [[ ! -f "$RESPONSE_ANALYSIS_FILE" ]]; then
+        echo "unknown"
+        return 0
+    fi
+
+    jq -r '.analysis.denied_commands | join(", ")' "$RESPONSE_ANALYSIS_FILE" 2>/dev/null || echo "unknown"
+}
+
+clear_response_analysis_permission_denials() {
+    if [[ ! -f "$RESPONSE_ANALYSIS_FILE" ]]; then
+        return 0
+    fi
+
+    local tmp_file="$RESPONSE_ANALYSIS_FILE.tmp"
+    if jq '
+        (.analysis //= {}) |
+        .analysis.has_completion_signal = false |
+        .analysis.exit_signal = false |
+        .analysis.has_permission_denials = false |
+        .analysis.permission_denial_count = 0 |
+        .analysis.denied_commands = []
+    ' "$RESPONSE_ANALYSIS_FILE" > "$tmp_file" 2>/dev/null; then
+        mv "$tmp_file" "$RESPONSE_ANALYSIS_FILE"
+        return 0
+    fi
+
+    rm -f "$tmp_file" 2>/dev/null
+    return 1
+}
+
+handle_permission_denial() {
+    local loop_count=$1
+    local denied_cmds=${2:-unknown}
+    local calls_made
+    calls_made=$(cat "$CALL_COUNT_FILE" 2>/dev/null || echo "0")
+    PERMISSION_DENIAL_ACTION=""
+
+    case "$PERMISSION_DENIAL_MODE" in
+        continue|threshold)
+            log_status "WARN" "🚫 Permission denied in loop #$loop_count: $denied_cmds"
+            log_status "WARN" "PERMISSION_DENIAL_MODE=$PERMISSION_DENIAL_MODE - continuing execution"
+            update_status "$loop_count" "$calls_made" "permission_denied" "running"
+            PERMISSION_DENIAL_ACTION="continue"
+            return 0
+            ;;
+        halt)
+            log_status "ERROR" "🚫 Permission denied - halting loop"
+            reset_session "permission_denied"
+            update_status "$loop_count" "$calls_made" "permission_denied" "halted" "permission_denied"
+
+            echo ""
+            echo -e "${RED}╔════════════════════════════════════════════════════════════╗${NC}"
+            echo -e "${RED}║  PERMISSION DENIED - Loop Halted                          ║${NC}"
+            echo -e "${RED}╚════════════════════════════════════════════════════════════╝${NC}"
+            echo ""
+            echo -e "${YELLOW}$DRIVER_DISPLAY_NAME was denied permission to execute commands.${NC}"
+            echo ""
+            echo -e "${YELLOW}To fix this:${NC}"
+            driver_permission_denial_help
+            echo ""
+            show_current_allowed_tools
+            PERMISSION_DENIAL_ACTION="halt"
+            return 0
+            ;;
+    esac
+
+    return 1
+}
+
+consume_current_loop_permission_denial() {
+    local loop_count=$1
+    PERMISSION_DENIAL_ACTION=""
+
+    if ! response_analysis_has_permission_denials; then
+        return 1
+    fi
+
+    local denied_cmds
+    denied_cmds=$(get_response_analysis_denied_commands)
+
+    if ! clear_response_analysis_permission_denials; then
+        log_status "WARN" "Failed to clear permission denial markers from response analysis"
+    fi
+
+    handle_permission_denial "$loop_count" "$denied_cmds"
+    return 0
+}
+
 # Check if we can make another call
 can_make_call() {
     local calls_made=0
@@ -487,6 +728,74 @@ wait_for_reset() {
     log_status "SUCCESS" "Rate limit reset! Ready for new calls."
 }
 
+count_fix_plan_checkboxes() {
+    local fix_plan_file="${1:-$RALPH_DIR/@fix_plan.md}"
+    local completed_items=0
+    local uncompleted_items=0
+    local total_items=0
+
+    if [[ -f "$fix_plan_file" ]]; then
+        uncompleted_items=$(grep -cE "^[[:space:]]*- \[ \]" "$fix_plan_file" 2>/dev/null || true)
+        [[ -z "$uncompleted_items" ]] && uncompleted_items=0
+        completed_items=$(grep -cE "^[[:space:]]*- \[[xX]\]" "$fix_plan_file" 2>/dev/null || true)
+        [[ -z "$completed_items" ]] && completed_items=0
+    fi
+
+    total_items=$((completed_items + uncompleted_items))
+    printf '%s %s %s\n' "$completed_items" "$uncompleted_items" "$total_items"
+}
+
+enforce_fix_plan_progress_tracking() {
+    local analysis_file=$1
+    local completed_before=$2
+    local completed_after=$3
+
+    if [[ ! -f "$analysis_file" ]]; then
+        return 0
+    fi
+
+    local claimed_tasks
+    claimed_tasks=$(jq -r '.analysis.tasks_completed_this_loop // 0' "$analysis_file" 2>/dev/null || echo "0")
+    if [[ ! "$claimed_tasks" =~ ^-?[0-9]+$ ]]; then
+        claimed_tasks=0
+    fi
+
+    local fix_plan_completed_delta=$((completed_after - completed_before))
+    local has_progress_tracking_mismatch=false
+    if [[ $claimed_tasks -ne $fix_plan_completed_delta || $claimed_tasks -gt 1 || $fix_plan_completed_delta -gt 1 || $fix_plan_completed_delta -lt 0 ]]; then
+        has_progress_tracking_mismatch=true
+    fi
+
+    local tmp_file="$analysis_file.tmp"
+    if jq \
+        --argjson claimed_tasks "$claimed_tasks" \
+        --argjson fix_plan_completed_delta "$fix_plan_completed_delta" \
+        --argjson has_progress_tracking_mismatch "$has_progress_tracking_mismatch" \
+        '
+            (.analysis //= {}) |
+            .analysis.tasks_completed_this_loop = $claimed_tasks |
+            .analysis.fix_plan_completed_delta = $fix_plan_completed_delta |
+            .analysis.has_progress_tracking_mismatch = $has_progress_tracking_mismatch |
+            if $has_progress_tracking_mismatch then
+                .analysis.has_completion_signal = false |
+                .analysis.exit_signal = false
+            else
+                .
+            end
+        ' "$analysis_file" > "$tmp_file" 2>/dev/null; then
+        mv "$tmp_file" "$analysis_file"
+    else
+        rm -f "$tmp_file" 2>/dev/null
+        return 0
+    fi
+
+    if [[ "$has_progress_tracking_mismatch" == "true" ]]; then
+        log_status "WARN" "Progress tracking mismatch: claimed $claimed_tasks completed task(s) but checkbox delta was $fix_plan_completed_delta. Completion signals suppressed for this loop."
+    fi
+
+    return 0
+}
+
 # Check if we should gracefully exit
 should_exit_gracefully() {
     
@@ -508,21 +817,6 @@ should_exit_gracefully() {
 
     # Check for exit conditions
 
-    # 0. Permission denials (highest priority - Issue #101)
-    # When Claude Code is denied permission to run commands, halt immediately
-    # to allow user to update .ralphrc ALLOWED_TOOLS configuration
-    if [[ -f "$RESPONSE_ANALYSIS_FILE" ]]; then
-        local has_permission_denials=$(jq -r '.analysis.has_permission_denials // false' "$RESPONSE_ANALYSIS_FILE" 2>/dev/null || echo "false")
-        if [[ "$has_permission_denials" == "true" ]]; then
-            local denied_count=$(jq -r '.analysis.permission_denial_count // 0' "$RESPONSE_ANALYSIS_FILE" 2>/dev/null || echo "0")
-            local denied_cmds=$(jq -r '.analysis.denied_commands | join(", ")' "$RESPONSE_ANALYSIS_FILE" 2>/dev/null || echo "unknown")
-            log_status "WARN" "🚫 Permission denied for $denied_count command(s): $denied_cmds"
-            log_status "WARN" "Update ALLOWED_TOOLS in .ralphrc to include the required tools"
-            echo "permission_denied"
-            return 0
-        fi
-    fi
-
     # 1. Too many consecutive test-only loops
     if [[ $recent_test_loops -ge $MAX_CONSECUTIVE_TEST_LOOPS ]]; then
         log_status "WARN" "Exit condition: Too many test-focused loops ($recent_test_loops >= $MAX_CONSECUTIVE_TEST_LOOPS)"
@@ -568,11 +862,10 @@ should_exit_gracefully() {
     # Fix #144: Only match valid markdown checkboxes, not date entries like [2026-01-29]
     # Valid patterns: "- [ ]" (uncompleted) and "- [x]" or "- [X]" (completed)
     if [[ -f "$RALPH_DIR/@fix_plan.md" ]]; then
-        local uncompleted_items=$(grep -cE "^[[:space:]]*- \[ \]" "$RALPH_DIR/@fix_plan.md" 2>/dev/null || true)
-        [[ -z "$uncompleted_items" ]] && uncompleted_items=0
-        local completed_items=$(grep -cE "^[[:space:]]*- \[[xX]\]" "$RALPH_DIR/@fix_plan.md" 2>/dev/null || true)
-        [[ -z "$completed_items" ]] && completed_items=0
-        local total_items=$((uncompleted_items + completed_items))
+        local completed_items=0
+        local uncompleted_items=0
+        local total_items=0
+        read -r completed_items uncompleted_items total_items < <(count_fix_plan_checkboxes "$RALPH_DIR/@fix_plan.md")
 
         if [[ $total_items -gt 0 ]] && [[ $completed_items -eq $total_items ]]; then
             log_status "WARN" "Exit condition: All @fix_plan.md items completed ($completed_items/$total_items)" >&2
@@ -677,8 +970,10 @@ build_loop_context() {
     # Extract incomplete tasks from @fix_plan.md
     # Bug #3 Fix: Support indented markdown checkboxes with [[:space:]]* pattern
     if [[ -f "$RALPH_DIR/@fix_plan.md" ]]; then
-        local incomplete_tasks=$(grep -cE "^[[:space:]]*- \[ \]" "$RALPH_DIR/@fix_plan.md" 2>/dev/null || true)
-        [[ -z "$incomplete_tasks" ]] && incomplete_tasks=0
+        local completed_tasks=0
+        local incomplete_tasks=0
+        local total_tasks=0
+        read -r completed_tasks incomplete_tasks total_tasks < <(count_fix_plan_checkboxes "$RALPH_DIR/@fix_plan.md")
         context+="Remaining tasks: ${incomplete_tasks}. "
     fi
 
@@ -810,6 +1105,7 @@ save_claude_session() {
         session_id=$(extract_session_id_from_output "$output_file" 2>/dev/null || echo "")
         if [[ -n "$session_id" && "$session_id" != "null" ]]; then
             echo "$session_id" > "$CLAUDE_SESSION_FILE"
+            sync_ralph_session_with_driver "$session_id"
             log_status "INFO" "Saved session: ${session_id:0:20}..."
         fi
     fi
@@ -819,6 +1115,101 @@ save_claude_session() {
 # SESSION LIFECYCLE MANAGEMENT FUNCTIONS (Phase 1.2)
 # =============================================================================
 
+write_active_ralph_session() {
+    local session_id=$1
+    local created_at=$2
+    local last_used=${3:-$created_at}
+
+    jq -n \
+        --arg session_id "$session_id" \
+        --arg created_at "$created_at" \
+        --arg last_used "$last_used" \
+        '{
+            session_id: $session_id,
+            created_at: $created_at,
+            last_used: $last_used
+        }' > "$RALPH_SESSION_FILE"
+}
+
+write_inactive_ralph_session() {
+    local reset_at=$1
+    local reset_reason=$2
+
+    jq -n \
+        --arg session_id "" \
+        --arg reset_at "$reset_at" \
+        --arg reset_reason "$reset_reason" \
+        '{
+            session_id: $session_id,
+            reset_at: $reset_at,
+            reset_reason: $reset_reason
+        }' > "$RALPH_SESSION_FILE"
+}
+
+get_ralph_session_state() {
+    if [[ ! -f "$RALPH_SESSION_FILE" ]]; then
+        echo "missing"
+        return 0
+    fi
+
+    if ! jq empty "$RALPH_SESSION_FILE" 2>/dev/null; then
+        echo "invalid"
+        return 0
+    fi
+
+    local session_id_type
+    session_id_type=$(
+        jq -r 'if has("session_id") then (.session_id | type) else "missing" end' \
+            "$RALPH_SESSION_FILE" 2>/dev/null
+    ) || {
+        echo "invalid"
+        return 0
+    }
+
+    if [[ "$session_id_type" != "string" ]]; then
+        echo "invalid"
+        return 0
+    fi
+
+    local session_id
+    session_id=$(jq -r '.session_id' "$RALPH_SESSION_FILE" 2>/dev/null) || {
+        echo "invalid"
+        return 0
+    }
+
+    if [[ "$session_id" == "" ]]; then
+        echo "inactive"
+        return 0
+    fi
+
+    local created_at_type
+    created_at_type=$(
+        jq -r 'if has("created_at") then (.created_at | type) else "missing" end' \
+            "$RALPH_SESSION_FILE" 2>/dev/null
+    ) || {
+        echo "invalid"
+        return 0
+    }
+
+    if [[ "$created_at_type" != "string" ]]; then
+        echo "invalid"
+        return 0
+    fi
+
+    local created_at
+    created_at=$(jq -r '.created_at' "$RALPH_SESSION_FILE" 2>/dev/null) || {
+        echo "invalid"
+        return 0
+    }
+
+    if ! is_usable_ralph_session_created_at "$created_at"; then
+        echo "invalid"
+        return 0
+    fi
+
+    echo "active"
+}
+
 # Get current session ID from Ralph session file
 # Returns: session ID string or empty if not found
 get_session_id() {
@@ -840,6 +1231,65 @@ get_session_id() {
     return 0
 }
 
+is_usable_ralph_session_created_at() {
+    local created_at=$1
+    if [[ -z "$created_at" || "$created_at" == "null" ]]; then
+        return 1
+    fi
+
+    local created_at_epoch
+    created_at_epoch=$(parse_iso_to_epoch_strict "$created_at") || return 1
+
+    local now_epoch
+    now_epoch=$(get_epoch_seconds)
+
+    [[ "$created_at_epoch" -le "$now_epoch" ]]
+}
+
+get_active_session_created_at() {
+    if [[ "$(get_ralph_session_state)" != "active" ]]; then
+        echo ""
+        return 0
+    fi
+
+    local created_at
+    created_at=$(jq -r '.created_at // ""' "$RALPH_SESSION_FILE" 2>/dev/null)
+    if [[ "$created_at" == "null" ]]; then
+        created_at=""
+    fi
+
+    if ! is_usable_ralph_session_created_at "$created_at"; then
+        echo ""
+        return 0
+    fi
+
+    echo "$created_at"
+}
+
+sync_ralph_session_with_driver() {
+    local driver_session_id=$1
+    if [[ -z "$driver_session_id" || "$driver_session_id" == "null" ]]; then
+        return 0
+    fi
+
+    local ts
+    ts=$(get_iso_timestamp)
+
+    if [[ "$(get_ralph_session_state)" == "active" ]]; then
+        local current_session_id
+        current_session_id=$(get_session_id)
+        local current_created_at
+        current_created_at=$(get_active_session_created_at)
+
+        if [[ "$current_session_id" == "$driver_session_id" && -n "$current_created_at" ]]; then
+            write_active_ralph_session "$driver_session_id" "$current_created_at" "$ts"
+            return 0
+        fi
+    fi
+
+    write_active_ralph_session "$driver_session_id" "$ts" "$ts"
+}
+
 # Reset session with reason logging
 # Usage: reset_session "reason_for_reset"
 reset_session() {
@@ -849,20 +1299,7 @@ reset_session() {
     local reset_timestamp
     reset_timestamp=$(get_iso_timestamp)
 
-    # Always create/overwrite the session file using jq for safe JSON escaping
-    jq -n \
-        --arg session_id "" \
-        --arg created_at "" \
-        --arg last_used "" \
-        --arg reset_at "$reset_timestamp" \
-        --arg reset_reason "$reason" \
-        '{
-            session_id: $session_id,
-            created_at: $created_at,
-            last_used: $last_used,
-            reset_at: $reset_at,
-            reset_reason: $reset_reason
-        }' > "$RALPH_SESSION_FILE"
+    write_inactive_ralph_session "$reset_timestamp" "$reason"
 
     # Also clear the Claude session file for consistency
     rm -f "$CLAUDE_SESSION_FILE" 2>/dev/null
@@ -951,67 +1388,39 @@ init_session_tracking() {
     local ts
     ts=$(get_iso_timestamp)
 
-    # Create session file if it doesn't exist
-    if [[ ! -f "$RALPH_SESSION_FILE" ]]; then
-        local new_session_id
-        new_session_id=$(generate_session_id)
-
-        jq -n \
-            --arg session_id "$new_session_id" \
-            --arg created_at "$ts" \
-            --arg last_used "$ts" \
-            --arg reset_at "" \
-            --arg reset_reason "" \
-            '{
-                session_id: $session_id,
-                created_at: $created_at,
-                last_used: $last_used,
-                reset_at: $reset_at,
-                reset_reason: $reset_reason
-            }' > "$RALPH_SESSION_FILE"
-
-        log_status "INFO" "Initialized session tracking (session: $new_session_id)"
+    local session_state
+    session_state=$(get_ralph_session_state)
+    if [[ "$session_state" == "active" ]]; then
         return 0
     fi
 
-    # Validate existing session file
-    if ! jq empty "$RALPH_SESSION_FILE" 2>/dev/null; then
+    if [[ "$session_state" == "invalid" ]]; then
         log_status "WARN" "Corrupted session file detected, recreating..."
-        local new_session_id
-        new_session_id=$(generate_session_id)
-
-        jq -n \
-            --arg session_id "$new_session_id" \
-            --arg created_at "$ts" \
-            --arg last_used "$ts" \
-            --arg reset_at "$ts" \
-            --arg reset_reason "corrupted_file_recovery" \
-            '{
-                session_id: $session_id,
-                created_at: $created_at,
-                last_used: $last_used,
-                reset_at: $reset_at,
-                reset_reason: $reset_reason
-            }' > "$RALPH_SESSION_FILE"
     fi
+
+    local new_session_id
+    new_session_id=$(generate_session_id)
+    write_active_ralph_session "$new_session_id" "$ts" "$ts"
+
+    log_status "INFO" "Initialized session tracking (session: $new_session_id)"
 }
 
 # Update last_used timestamp in session file (called on each loop iteration)
 update_session_last_used() {
-    if [[ ! -f "$RALPH_SESSION_FILE" ]]; then
+    if [[ "$(get_ralph_session_state)" != "active" ]]; then
         return 0
     fi
 
     local ts
     ts=$(get_iso_timestamp)
 
-    # Update last_used in existing session file
-    local updated
-    updated=$(jq --arg last_used "$ts" '.last_used = $last_used' "$RALPH_SESSION_FILE" 2>/dev/null)
-    local jq_status=$?
+    local session_id
+    session_id=$(get_session_id)
+    local created_at
+    created_at=$(get_active_session_created_at)
 
-    if [[ $jq_status -eq 0 && -n "$updated" ]]; then
-        echo "$updated" > "$RALPH_SESSION_FILE"
+    if [[ -n "$session_id" && -n "$created_at" ]]; then
+        write_active_ralph_session "$session_id" "$created_at" "$ts"
     fi
 }
 
@@ -1072,6 +1481,8 @@ execute_claude_code() {
     local loop_count=$1
     local calls_made=$(cat "$CALL_COUNT_FILE" 2>/dev/null || echo "0")
     calls_made=$((calls_made + 1))
+    local fix_plan_completed_before=0
+    read -r fix_plan_completed_before _ _ < <(count_fix_plan_checkboxes "$RALPH_DIR/@fix_plan.md")
 
     # Fix #141: Capture git HEAD SHA at loop start to detect commits as progress
     # Store in file for access by progress detection after Claude execution
@@ -1326,6 +1737,10 @@ EOF
         analyze_response "$output_file" "$loop_count"
         local analysis_exit_code=$?
 
+        local fix_plan_completed_after=0
+        read -r fix_plan_completed_after _ _ < <(count_fix_plan_checkboxes "$RALPH_DIR/@fix_plan.md")
+        enforce_fix_plan_progress_tracking "$RESPONSE_ANALYSIS_FILE" "$fix_plan_completed_before" "$fix_plan_completed_after"
+
         # Update exit signals based on analysis
         update_exit_signals
 
@@ -1435,11 +1850,31 @@ loop_count=0
 main() {
     initialize_runtime_context
 
-    # Validate --allowed-tools now that platform-specific VALID_TOOL_PATTERNS are loaded
-    if [[ "${_CLI_ALLOWED_TOOLS:-}" == "true" ]] && ! validate_allowed_tools "$CLAUDE_ALLOWED_TOOLS"; then
+    if ! validate_permission_denial_mode "$PERMISSION_DENIAL_MODE"; then
         exit 1
     fi
 
+    if [[ "$(driver_name)" == "claude-code" ]]; then
+        normalize_claude_permission_mode
+
+        if ! validate_claude_permission_mode "$CLAUDE_PERMISSION_MODE"; then
+            exit 1
+        fi
+    fi
+
+    if driver_supports_tool_allowlist; then
+        # Validate --allowed-tools now that platform-specific VALID_TOOL_PATTERNS are loaded
+        if [[ "${_CLI_ALLOWED_TOOLS:-}" == "true" ]] && ! validate_allowed_tools "$CLAUDE_ALLOWED_TOOLS"; then
+            exit 1
+        fi
+    else
+        warn_if_allowed_tools_ignored
+    fi
+
+    if [[ "${_CLI_ALLOWED_TOOLS:-}" == "true" ]] && ! driver_supports_tool_allowlist; then
+        _CLI_ALLOWED_TOOLS=""
+    fi
+
     log_status "SUCCESS" "🚀 Ralph loop starting with $DRIVER_DISPLAY_NAME"
     log_status "INFO" "Max calls per hour: $MAX_CALLS_PER_HOUR"
     log_status "INFO" "Logs: $LOG_DIR/ | Docs: $DOCS_DIR/ | Status: $STATUS_FILE"
@@ -1531,45 +1966,6 @@ main() {
         # Check for graceful exit conditions
         local exit_reason=$(should_exit_gracefully)
         if [[ "$exit_reason" != "" ]]; then
-            # Handle permission_denied specially (Issue #101)
-            if [[ "$exit_reason" == "permission_denied" ]]; then
-                log_status "ERROR" "🚫 Permission denied - halting loop"
-                reset_session "permission_denied"
-                update_status "$loop_count" "$(cat "$CALL_COUNT_FILE")" "permission_denied" "halted" "permission_denied"
-
-                # Display helpful guidance for resolving permission issues
-                echo ""
-                echo -e "${RED}╔════════════════════════════════════════════════════════════╗${NC}"
-                echo -e "${RED}║  PERMISSION DENIED - Loop Halted                          ║${NC}"
-                echo -e "${RED}╚════════════════════════════════════════════════════════════╝${NC}"
-                echo ""
-                echo -e "${YELLOW}$DRIVER_DISPLAY_NAME was denied permission to execute commands.${NC}"
-                echo ""
-                echo -e "${YELLOW}To fix this:${NC}"
-                echo "  1. Edit .ralphrc and update ALLOWED_TOOLS to include the required tools"
-                echo "  2. Common patterns:"
-                echo "     - Bash(npm *)     - All npm commands"
-                echo "     - Bash(npm install) - Only npm install"
-                echo "     - Bash(pnpm *)    - All pnpm commands"
-                echo "     - Bash(yarn *)    - All yarn commands"
-                echo ""
-                echo -e "${YELLOW}After updating .ralphrc:${NC}"
-                echo "  bash .ralph/ralph_loop.sh --reset-session  # Clear stale session state"
-                echo "  bmalph run                                 # Restart the loop"
-                echo ""
-
-                # Show current ALLOWED_TOOLS if .ralphrc exists
-                if [[ -f ".ralphrc" ]]; then
-                    local current_tools=$(grep "^ALLOWED_TOOLS=" ".ralphrc" 2>/dev/null | cut -d= -f2- | tr -d '"')
-                    if [[ -n "$current_tools" ]]; then
-                        echo -e "${BLUE}Current ALLOWED_TOOLS:${NC} $current_tools"
-                        echo ""
-                    fi
-                fi
-
-                break
-            fi
-
             log_status "SUCCESS" "🏁 Graceful exit triggered: $exit_reason"
             reset_session "project_complete"
             update_status "$loop_count" "$(cat "$CALL_COUNT_FILE")" "graceful_exit" "completed" "$exit_reason"
@@ -1591,6 +1987,17 @@ main() {
         local exec_result=$?
         
         if [ $exec_result -eq 0 ]; then
+            if consume_current_loop_permission_denial "$loop_count"; then
+                if [[ "$PERMISSION_DENIAL_ACTION" == "halt" ]]; then
+                    break
+                fi
+
+                # Brief pause between loops when the denial was recorded but
+                # policy allows Ralph to continue.
+                sleep 5
+                continue
+            fi
+
             update_status "$loop_count" "$(cat "$CALL_COUNT_FILE")" "completed" "success"
 
             # Brief pause between successful executions
@@ -1676,7 +2083,7 @@ Options:
 Modern CLI Options (Phase 1.1):
     --output-format FORMAT  Set driver output format: json or text (default: $CLAUDE_OUTPUT_FORMAT)
                             Note: --live mode requires JSON and will auto-switch
-    --allowed-tools TOOLS   Comma-separated list of allowed tools (default: $CLAUDE_ALLOWED_TOOLS)
+    --allowed-tools TOOLS   Claude Code only. Ignored by codex, cursor, and copilot
     --no-continue           Disable session continuity across loops
     --session-expiry HOURS  Set session expiration time in hours (default: $CLAUDE_SESSION_EXPIRY_HOURS)
 
@@ -1722,6 +2129,8 @@ while [[ $# -gt 0 ]]; do
             ;;
         -c|--calls)
             MAX_CALLS_PER_HOUR="$2"
+            _cli_MAX_CALLS_PER_HOUR="$MAX_CALLS_PER_HOUR"
+            _CLI_MAX_CALLS_PER_HOUR=true
             shift 2
             ;;
         -p|--prompt)
@@ -1743,6 +2152,8 @@ while [[ $# -gt 0 ]]; do
             ;;
         -v|--verbose)
             VERBOSE_PROGRESS=true
+            _cli_VERBOSE_PROGRESS="$VERBOSE_PROGRESS"
+            _CLI_VERBOSE_PROGRESS=true
             shift
             ;;
         -l|--live)
@@ -1752,6 +2163,8 @@ while [[ $# -gt 0 ]]; do
         -t|--timeout)
             if [[ "$2" =~ ^[1-9][0-9]*$ ]] && [[ "$2" -le 120 ]]; then
                 CLAUDE_TIMEOUT_MINUTES="$2"
+                _cli_CLAUDE_TIMEOUT_MINUTES="$CLAUDE_TIMEOUT_MINUTES"
+                _CLI_CLAUDE_TIMEOUT_MINUTES=true
             else
                 echo "Error: Timeout must be a positive integer between 1 and 120 minutes"
                 exit 1
@@ -1785,6 +2198,8 @@ while [[ $# -gt 0 ]]; do
         --output-format)
             if [[ "$2" == "json" || "$2" == "text" ]]; then
                 CLAUDE_OUTPUT_FORMAT="$2"
+                _cli_CLAUDE_OUTPUT_FORMAT="$CLAUDE_OUTPUT_FORMAT"
+                _CLI_CLAUDE_OUTPUT_FORMAT=true
             else
                 echo "Error: --output-format must be 'json' or 'text'"
                 exit 1
@@ -1793,11 +2208,14 @@ while [[ $# -gt 0 ]]; do
             ;;
         --allowed-tools)
             CLAUDE_ALLOWED_TOOLS="$2"
+            _cli_CLAUDE_ALLOWED_TOOLS="$2"
             _CLI_ALLOWED_TOOLS=true
             shift 2
             ;;
         --no-continue)
             CLAUDE_USE_CONTINUE=false
+            _cli_CLAUDE_USE_CONTINUE="$CLAUDE_USE_CONTINUE"
+            _CLI_SESSION_CONTINUITY=true
             shift
             ;;
         --session-expiry)
@@ -1806,6 +2224,8 @@ while [[ $# -gt 0 ]]; do
                 exit 1
             fi
             CLAUDE_SESSION_EXPIRY_HOURS="$2"
+            _cli_CLAUDE_SESSION_EXPIRY_HOURS="$2"
+            _CLI_SESSION_EXPIRY_HOURS=true
             shift 2
             ;;
         --auto-reset-circuit)