chainlesschain 0.162.162 → 0.162.164

package/src/runtime/coding-agent-contract-shared.cjs

@@ -614,7 +614,7 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
           type: "string",
           enum: ["worktree"],
           description:
-            "Optional isolation mode: \"worktree\" runs the sub-agent in a fresh git worktree so its file edits land on an isolated branch (diff/merge summary comes back with the result).",
+            'Optional isolation mode: "worktree" runs the sub-agent in a fresh git worktree so its file edits land on an isolated branch (diff/merge summary comes back with the result).',
         },
       },
       required: ["task"],
@@ -959,6 +959,65 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
           type: "string",
           description: "Optional human label for list/cancel",
         },
+        expires: {
+          type: "string",
+          description:
+            "For wakeup/cron/monitor: retire the entry after this long if it hasn't fired (e.g. 2h, 7d); it then never fires",
+        },
+        jitter: {
+          type: "string",
+          description:
+            "For wakeup/cron/monitor: a random-but-stable spread (e.g. 30s) so entries sharing a schedule fan out instead of firing all at once",
+        },
+        permission_mode: {
+          type: "string",
+          enum: [
+            "plan",
+            "manual",
+            "default",
+            "acceptEdits",
+            "auto",
+            "dontAsk",
+            "bypassPermissions",
+          ],
+          description:
+            "For wakeup/cron: run the fired `cc agent` with this permission mode instead of the ambient one (e.g. `plan` for a read-only report, `manual` to gate every action)",
+        },
+        worktree: {
+          type: "boolean",
+          description:
+            "For wakeup/cron: run the fired `cc agent` in a fresh git worktree so its changes stay isolated",
+        },
+        max_turns: {
+          type: "number",
+          description:
+            "For wakeup/cron: cap the fired agent's loop iterations (a per-task budget)",
+        },
+        goal_condition: {
+          type: "string",
+          description:
+            "For wakeup/cron: run the fired agent to a completion condition, re-driving outer turns until met. Prefix exit-zero:/file-exists:/contains:/regex: (deterministic) or model:<desc> (model-judged). Invalid specs are dropped.",
+        },
+        max_outer_turns: {
+          type: "number",
+          description:
+            "For wakeup/cron with goal_condition: max outer re-drive turns (default 10, hard cap 100)",
+        },
+        goal_max_tokens: {
+          type: "number",
+          description:
+            "For wakeup/cron with goal_condition: token budget across outer turns",
+        },
+        goal_max_cost: {
+          type: "number",
+          description:
+            "For wakeup/cron with goal_condition: cost budget (USD) across outer turns",
+        },
+        goal_max_time: {
+          type: "number",
+          description:
+            "For wakeup/cron with goal_condition: wall-clock budget (ms) across outer turns",
+        },
         id: {
           type: "string",
           description: "For cancel: the schedule entry id to remove",

package/src/runtime/diagnostics.js

@@ -288,6 +288,66 @@ export async function collectDoctorReport() {
   };
 }
 
+/**
+ * Parse `git worktree list --porcelain` output into `{ path, branch }` entries.
+ *
+ * Pure (no I/O) so it can be unit-tested against fixed fixtures. A detached
+ * worktree has no `branch` line and yields `branch: null`.
+ */
+export function parseGitWorktrees(porcelain) {
+  if (!porcelain || typeof porcelain !== "string") return [];
+  const entries = [];
+  let cur = null;
+  for (const line of porcelain.split("\n")) {
+    const trimmed = line.trimEnd();
+    if (trimmed.startsWith("worktree ")) {
+      if (cur) entries.push(cur);
+      cur = { path: trimmed.slice("worktree ".length).trim(), branch: null };
+    } else if (trimmed.startsWith("branch ") && cur) {
+      cur.branch = trimmed
+        .slice("branch ".length)
+        .replace("refs/heads/", "")
+        .trim();
+    }
+  }
+  if (cur) entries.push(cur);
+  return entries;
+}
+
+/** Best-effort live git worktree list for the current repo. */
+export function collectWorktrees() {
+  return parseGitWorktrees(safeExec("git worktree list --porcelain"));
+}
+
+/**
+ * Map a doctor report + ambient runtime signals into the input contract of
+ * `buildDiagnosticBundle` (src/lib/diagnostic-bundle.js).
+ *
+ * Pure & deterministic aside from reading this process's own platform tags:
+ * the caller gathers live signals (env, worktrees, lockfiles) and passes them
+ * in, so the mapping itself is unit-testable. Session-runtime fields
+ * (connectionState, reconnectHistory, trace, redactionEvents) are absent from a
+ * cold `cc doctor` invocation and left to the bundle builder's safe defaults.
+ */
+export function buildDoctorDiagnosticInput(report, signals = {}) {
+  const r = report || {};
+  return {
+    version: r.version || null,
+    platform: {
+      os: process.platform,
+      arch: process.arch,
+      node: process.versions?.node || null,
+    },
+    ports: (Array.isArray(r.ports) ? r.ports : [])
+      .filter((p) => p && p.open)
+      .map((p) => ({ port: p.port, proto: p.name })),
+    worktrees: Array.isArray(signals.worktrees) ? signals.worktrees : [],
+    lockfiles: Array.isArray(signals.lockfiles) ? signals.lockfiles : [],
+    env: signals.env && typeof signals.env === "object" ? signals.env : {},
+    notes: signals.notes != null ? signals.notes : null,
+  };
+}
+
 /**
  * Collect a machine-readable status report.
  *

package/src/runtime/headless-runner.js

@@ -44,11 +44,20 @@ import {
   appendTokenUsage as jsonlAppendTokenUsage,
   appendToolCallCompact as jsonlAppendToolCallCompact,
   appendCompactEvent as jsonlAppendCompactEvent,
+  appendEvent as jsonlAppendEvent,
+  readEvents as jsonlReadEvents,
   rebuildMessages as jsonlRebuildMessages,
   sessionExists as jsonlSessionExists,
   getLastSessionId as jsonlGetLastSessionId,
   verifySession as jsonlVerifySession,
 } from "../harness/jsonl-session-store.js";
+import {
+  SideEffectLedger,
+  reconcileSideEffects,
+  classifyToolSideEffect,
+} from "../lib/side-effect-ledger.js";
+import { SIDE_EFFECT_LEDGER_EVENT } from "../lib/side-effect-ledger-store.js";
+import { operationIdempotencyKey } from "../lib/idempotency.js";
 import { expandFileRefsAsync } from "./file-ref-expander.js";
 import { composeSystemPrompt } from "./system-prompt.js";
 import { buildUserContent } from "../lib/image-input.js";
@@ -461,6 +470,8 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     appendToolCallCompact:
       deps.appendToolCallCompact || jsonlAppendToolCallCompact,
     appendCompactEvent: deps.appendCompactEvent || jsonlAppendCompactEvent,
+    appendEvent: deps.appendEvent || jsonlAppendEvent,
+    readEvents: deps.readEvents || jsonlReadEvents,
     getLastSessionId: deps.getLastSessionId || jsonlGetLastSessionId,
     verifySession: deps.verifySession || jsonlVerifySession,
   };
@@ -684,6 +695,81 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     }
   }
 
+  // ── P0-2: crash-safe side-effect ledger ────────────────────────────────
+  // Dangerous tools (file writes, opaque shell, git push, publish/schedule/
+  // notify/browser actions) are recorded prepare→start→commit|fail and the
+  // full snapshot persisted before the effect settles, so a worker killed
+  // mid-flight does NOT blindly replay an effect that may already have landed.
+  // Only active when persisting (an ephemeral/one-shot run can't be resumed);
+  // the byte-for-byte default path is untouched when no dangerous tool runs.
+  const sideEffectRunNonce = String(deps.now ? deps.now() : Date.now());
+  let sideEffectLedger = new SideEffectLedger({ clock: deps.now || null });
+  let sideEffectSeq = 0;
+  let currentSideEffectOpId = null;
+  let resumeSideEffectContext = null;
+  const persistSideEffectLedger = () => {
+    if (!persist) return;
+    try {
+      store.appendEvent(
+        sessionId,
+        SIDE_EFFECT_LEDGER_EVENT,
+        sideEffectLedger.toJSON(),
+      );
+    } catch {
+      // best-effort — never fail the run over ledger persistence
+    }
+  };
+  if (persist) {
+    try {
+      const events = store.readEvents(sessionId) || [];
+      for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (
+          e &&
+          e.type === SIDE_EFFECT_LEDGER_EVENT &&
+          e.data &&
+          Array.isArray(e.data.ops)
+        ) {
+          sideEffectLedger = SideEffectLedger.fromJSON(e.data, {
+            clock: deps.now || null,
+          });
+          break;
+        }
+      }
+    } catch {
+      // fresh ledger — best effort
+    }
+    // On resume, surface any operation that was in flight when the prior run
+    // died: its outcome is UNKNOWN, so the model is told to VERIFY before any
+    // replay rather than silently re-issue an irreversible effect.
+    if (resumeId) {
+      try {
+        const plan = reconcileSideEffects(sideEffectLedger);
+        if (plan.inspect.length > 0) {
+          const lines = plan.plans
+            .filter((p) => p.action === "inspect")
+            .map((p) => {
+              const op = sideEffectLedger.get(p.opId);
+              const kind = op?.kind || "unknown";
+              const key = op?.key ? ` (${op.key})` : "";
+              return `  • [${kind}]${key} — ${p.reason}`;
+            });
+          resumeSideEffectContext =
+            "Recovery notice — the previous run was interrupted while these " +
+            "irreversible operations were in flight; their outcome is UNKNOWN. " +
+            "Do NOT blindly re-run them. Verify whether each already took " +
+            "effect before repeating it, and ask the user if unsure:\n" +
+            lines.join("\n");
+          writeErr(
+            `⚠ ${plan.inspect.length} interrupted side-effect(s) need verification before replay (resume ${resumeId}).\n`,
+          );
+        }
+      } catch {
+        resumeSideEffectContext = null;
+      }
+    }
+  }
+
   // ── Wire the persistent ApprovalGate with our non-interactive confirmer
   // and force the session-policy tier dictated by --permission-mode. ──────
   let approvalGate = null;
@@ -744,12 +830,35 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     outputStyleBody = null;
   }
 
+  // Large-monorepo context lever: `instructionExcludes` (settings.json or an
+  // explicit caller/SDK option) suppresses cc.md/CLAUDE.md/AGENTS.md, path-scoped
+  // rules, and @imports that resolve into legacy/vendor/generated subtrees.
+  // Explicit option wins; otherwise union across the layered settings files.
+  let instructionExcludes = Array.isArray(options.instructionExcludes)
+    ? options.instructionExcludes
+    : null;
+  if (!instructionExcludes) {
+    try {
+      const { readStringArraySetting } =
+        await import("../lib/settings-loader.cjs");
+      const fromSettings = readStringArraySetting("instructionExcludes", {
+        cwd,
+        settingsFile: options.settingsFile,
+      });
+      if (fromSettings && fromSettings.length)
+        instructionExcludes = fromSettings;
+    } catch {
+      instructionExcludes = null; // fail-open
+    }
+  }
+
   const systemContent = composeSystemPrompt(
     buildSystemPrompt(cwd, { additionalDirectories }),
     {
       systemPrompt: options.systemPrompt,
       appendSystemPrompt: options.appendSystemPrompt,
       outputStyle: outputStyleBody,
+      instructionExcludes,
     },
   );
 
@@ -836,6 +945,9 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     ...(sessionStartContext
       ? [{ role: "system", content: sessionStartContext }]
       : []),
+    ...(resumeSideEffectContext
+      ? [{ role: "system", content: resumeSideEffectContext }]
+      : []),
     ...history,
     { role: "user", content: userMessageContent },
   ]);
@@ -1040,7 +1152,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     try {
       const { AsyncHookSupervisor } =
         await import("../lib/async-hook-supervisor.cjs");
-      _hookSupervisor = new AsyncHookSupervisor();
+      _hookSupervisor = new AsyncHookSupervisor({ persistStats: true });
     } catch {
       _hookSupervisor = null; // async hooks are best-effort
     }
@@ -1068,6 +1180,10 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     model,
     provider,
     recorder: _otlpRecorder,
+    // --otlp-content: opt in to stamping prompt CONTENT onto --otlp spans. Off by
+    // default → content stays redacted (agent-core omits it entirely, so default
+    // OTLP output is byte-identical). Only meaningful when a recorder is attached.
+    otlpIncludeContent: options.otlpContent === true,
     hookSupervisor: _hookSupervisor,
     // Extended thinking (Anthropic; opt-in via --think/--ultrathink). null/off
     // → chatWithTools sends no thinking field. thinkingBudget (--thinking-budget)
@@ -1091,6 +1207,13 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     approvalGate,
     permissionRules,
     settingsHooks,
+    // Seed the subagent-contract CEILING with this run's permission mode so a
+    // spawned sub-agent inherits/tightens from it (tighten-only): a
+    // `--permission-mode bypassPermissions` run can hand a child bypass (→ allow
+    // confirmer), a `--permission-mode plan` run clamps children to read-only,
+    // while a "default" run resolves children to "default" exactly as before
+    // (byte-identical — the previous null ceiling also yielded "default").
+    subAgentContract: { permissionMode: options.permissionMode || "default" },
     classifyAllShell,
     enabledToolNames,
     disabledTools,
@@ -1278,6 +1401,138 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     };
   };
 
+  // --goal-condition: session-level completion-condition engine (P1). After each
+  // outer turn an independent checker judges a completion CONDITION; if unmet and
+  // budget remains, a follow-up user turn re-drives the agent — until met
+  // (goal_completed) or a budget is exhausted (goal_exhausted). OPT-IN: when
+  // unset, `goalEngine` is null and the outer loop runs exactly once, so one-shot
+  // `cc agent -p` behavior is byte-for-byte unchanged.
+  let goalEngine = null;
+  let _goalHelpers = null;
+  let _goalTokensSeen = 0; // per-turn usage deltas (engine totals == run total)
+  let _goalCostSeen = 0;
+  // Model-judged conditions reuse the run's own model as an independent
+  // evaluator (mirrors --goal-assess). Overridable via deps for tests.
+  const _defaultGoalJudge = async (cond, transcript) => {
+    const { chatWithTools } = await import("./agent-core.js");
+    const { firstBalancedJson } = await import("../lib/json-schema-output.js");
+    const judgePrompt =
+      `You are judging whether a coding session met a completion condition.\n` +
+      `Condition: ${cond.text || cond.source}\n\n` +
+      `Latest assistant output:\n${String(transcript.finalText || "").slice(0, 2000)}\n\n` +
+      `Reply with STRICT JSON only: {"met": true|false, "reason": "<short>"}.`;
+    const r = await chatWithTools([{ role: "user", content: judgePrompt }], {
+      model,
+      provider,
+      baseUrl,
+      apiKey,
+      enabledToolNames: [],
+    });
+    const text = r?.message?.content || "";
+    let met = false;
+    let reason = "model judge returned no verdict";
+    const block = firstBalancedJson(text, "{");
+    if (block) {
+      try {
+        const parsed = JSON.parse(block);
+        met = parsed.met === true;
+        if (typeof parsed.reason === "string" && parsed.reason.trim())
+          reason = parsed.reason.trim();
+        else reason = met ? "condition met" : "condition not met";
+      } catch {
+        /* tolerant: a non-JSON verdict stays unmet */
+      }
+    }
+    return {
+      met,
+      reason,
+      evidence: { kind: "model", raw: text.slice(0, 200) },
+    };
+  };
+  // Persist the engine snapshot as a hash-chained `goal_snapshot` session event
+  // (best-effort, only when persisting). Re-read on --resume so an unfinished
+  // goal continues across processes with its outerTurns/tokens/cost/startedAtMs
+  // intact. rebuildMessages ignores this event type, so it never pollutes model
+  // context. Defined here so the outer loop can call it after each evaluate().
+  const persistGoalSnapshot = () => {
+    if (!persist || !goalEngine) return;
+    try {
+      store.appendEvent(sessionId, "goal_snapshot", goalEngine.snapshot());
+    } catch {
+      // best-effort — never fail the run over persistence
+    }
+  };
+  if (options.goalCondition) {
+    try {
+      const eng = await import("../lib/goal-condition-engine.js");
+      const goalNow = () => (deps.now ? deps.now() : Date.now());
+      // Cross-process resume: if the resumed session persisted an UNFINISHED
+      // goal, continue it (fromSnapshot keeps accumulated progress + startedAtMs)
+      // rather than starting fresh. A finished (done) snapshot is ignored — the
+      // prior goal already concluded, so --goal-condition begins a new cycle. On
+      // restore the persisted condition/budget win over freshly-passed flags, so
+      // a resume faithfully continues the same goal.
+      let restoredSnap = null;
+      if (resumeId) {
+        try {
+          const events = store.readEvents(resumeId) || [];
+          for (let i = events.length - 1; i >= 0; i--) {
+            const ev = events[i];
+            if (ev && ev.type === "goal_snapshot") {
+              const snap = ev.data;
+              if (snap && snap.state && snap.state.done !== true)
+                restoredSnap = snap;
+              break; // only the latest goal_snapshot matters
+            }
+          }
+        } catch {
+          restoredSnap = null; // unreadable transcript → start fresh
+        }
+      }
+      if (restoredSnap) {
+        goalEngine = eng.GoalConditionEngine.fromSnapshot(restoredSnap, {
+          now: goalNow,
+        });
+      } else {
+        goalEngine = new eng.GoalConditionEngine({
+          condition: options.goalCondition,
+          budget: {
+            maxOuterTurns: options.maxOuterTurns,
+            maxTokens: options.goalMaxTokens,
+            maxCostUsd: options.goalMaxCostUsd,
+            maxTimeMs: options.goalMaxTimeMs,
+          },
+          now: goalNow,
+        });
+      }
+      _goalHelpers = {
+        isDeterministicCondition: eng.isDeterministicCondition,
+        runDeterministicCheck: eng.runDeterministicCheck,
+        GOAL_DECISION: eng.GOAL_DECISION,
+      };
+      const started = goalEngine.start();
+      emitStream({
+        type: started.type,
+        condition: started.condition,
+        budget: started.budget,
+        resumed: Boolean(restoredSnap),
+      });
+      persistGoalSnapshot(); // checkpoint the starting/restored state
+      if (isText)
+        writeErr(
+          `  ◎ goal-condition ${restoredSnap ? "resumed" : "active"}: ` +
+            `${goalEngine.condition.source} ` +
+            `(outer turn ${goalEngine.state.outerTurns + 1}/` +
+            `${goalEngine.budget.maxOuterTurns})\n`,
+        );
+    } catch (err) {
+      // A bad spec should have been rejected at the command layer; fail-open so
+      // a malformed condition never aborts an otherwise-valid run.
+      goalEngine = null;
+      if (isText) writeErr(`  goal-condition ignored: ${err.message}\n`);
+    }
+  }
+
   // A Ctrl-C (SIGINT) / SIGTERM terminates Node WITHOUT unwinding the `finally`
   // below, so its background-task reaper is bypassed — a backgrounded run_shell
   // task (e.g. a dev server) this run spawned would be orphaned. Install a
@@ -1322,10 +1577,50 @@ export async function runAgentHeadless(options = {}, deps = {}) {
               args: event.args,
             });
             toolCalls.push({ tool: event.tool, args: event.args });
+            // P0-2: record an irreversible effect as STARTED (persisted before
+            // it settles) so a crash before the matching tool-result leaves a
+            // reconcilable "in flight" marker instead of a silent replay.
+            currentSideEffectOpId = null;
+            if (persist) {
+              const se = classifyToolSideEffect(event.tool, event.args);
+              if (se) {
+                const opId = `${sideEffectRunNonce}:${sideEffectSeq++}`;
+                currentSideEffectOpId = opId;
+                sideEffectLedger
+                  .prepare(opId, {
+                    kind: se.kind,
+                    key: se.key,
+                    // Content-addressed key: a resumed replay of the SAME effect
+                    // derives the SAME key, so an external provider can de-dupe
+                    // and countDuplicateCommittedEffects can measure `0` repeats.
+                    meta: {
+                      tool: event.tool,
+                      idempotencyKey: operationIdempotencyKey({
+                        tool: event.tool,
+                        args: event.args,
+                      }),
+                    },
+                  })
+                  .start(opId);
+                persistSideEffectLedger();
+              }
+            }
             break;
           }
           case "tool-result": {
             const err = event.error || event.result?.error || null;
+            // P0-2: settle the in-flight side-effect (commit on success, fail on
+            // a clean error) and persist the updated ledger snapshot.
+            if (persist && currentSideEffectOpId) {
+              if (err)
+                sideEffectLedger.fail(
+                  currentSideEffectOpId,
+                  String(err).slice(0, 200),
+                );
+              else sideEffectLedger.commit(currentSideEffectOpId);
+              persistSideEffectLedger();
+              currentSideEffectOpId = null;
+            }
             if (isText && err) writeErr(`  Error: ${err}\n`);
             emitStream({
               type: "tool_result",
@@ -1492,6 +1787,103 @@ export async function runAgentHeadless(options = {}, deps = {}) {
           );
         }
       }
+      // ── goal-condition re-drive (opt-in via --goal-condition) ─────────────
+      // After the turn settles (and any auto-rewake fix), evaluate the session
+      // completion condition. Unmet + budget remaining → append a follow-up user
+      // turn and re-drive; met → goal_completed; budget spent → goal_exhausted.
+      // Cost / max-turns exhaustion of the INNER loop stops here regardless.
+      if (
+        goalEngine &&
+        _goalHelpers &&
+        !goalEngine.done &&
+        !stopForCost &&
+        endReason !== "cost-budget-exhausted" &&
+        endReason !== "max_turns"
+      ) {
+        // Feed this turn's usage DELTA so the engine's totals equal the run's
+        // cumulative usage (recordTurnUsage accumulates).
+        const curTokens =
+          usage.input_tokens +
+          usage.output_tokens +
+          usage.cache_read_input_tokens +
+          usage.cache_creation_input_tokens;
+        const curCost = costBudget ? Number(costBudget.spentUsd) || 0 : 0;
+        goalEngine.recordTurnUsage({
+          tokens: curTokens - _goalTokensSeen,
+          costUsd: curCost - _goalCostSeen,
+        });
+        _goalTokensSeen = curTokens;
+        _goalCostSeen = curCost;
+
+        const cond = goalEngine.condition;
+        let evaluation;
+        try {
+          if (_goalHelpers.isDeterministicCondition(cond)) {
+            const gc = deps.goalCheck || {};
+            const spawnSync =
+              gc.spawnSync || (await import("node:child_process")).spawnSync;
+            const existsSync =
+              gc.existsSync || (await import("node:fs")).existsSync;
+            evaluation = _goalHelpers.runDeterministicCheck(cond, {
+              spawnSync,
+              existsSync,
+              cwd,
+              lastOutput: finalText,
+            });
+          } else {
+            const judge = deps.goalConditionJudge || _defaultGoalJudge;
+            evaluation = await judge(cond, {
+              prompt: options.prompt,
+              finalText,
+              toolCalls,
+            });
+          }
+        } catch (err) {
+          evaluation = {
+            met: false,
+            reason: `goal check failed: ${err.message}`,
+            evidence: { error: true },
+          };
+        }
+
+        const { decision, events } = goalEngine.evaluate(evaluation);
+        for (const ev of events) {
+          emitStream(ev);
+          if (isText) {
+            if (ev.type === "goal_completed")
+              writeErr(`  ✔ goal-condition met: ${ev.reason}\n`);
+            else if (ev.type === "goal_exhausted")
+              writeErr(
+                `  ⛔ goal-condition unmet (${ev.limit}): ${ev.reason}\n`,
+              );
+            else if (ev.type === "goal_evaluated")
+              writeErr(
+                `  ◎ goal-condition ${ev.met ? "met" : "not met"}: ${ev.reason}\n`,
+              );
+          }
+        }
+        // Checkpoint the post-evaluate state (outerTurns incremented, and
+        // done/outcome on a terminal decision) so a crash or Ctrl-C between here
+        // and the next turn still resumes at the right point.
+        persistGoalSnapshot();
+        if (decision === _goalHelpers.GOAL_DECISION.CONTINUE) {
+          messages.push({
+            role: "user",
+            content:
+              `The completion condition is not yet met: ${evaluation.reason}.\n` +
+              `Keep working toward: "${cond.source}". When you believe it is ` +
+              `satisfied, make sure it actually passes.`,
+          });
+          finalText = "";
+          endReason = "complete";
+          if (isText)
+            writeErr(
+              `  ↻ goal-condition re-drive — outer turn ${goalEngine.state.outerTurns + 1}\n`,
+            );
+          continue; // re-drive: run another outer turn
+        }
+        // complete | exhausted → fall through to the break below.
+      }
       break;
     }
   } catch (err) {