chainlesschain 0.166.41 → 0.166.43

package/src/lib/remote-read-loop-guard.js

@@ -67,7 +67,7 @@ function urlTarget(value) {
   }
   if (url.hostname === "github.com") {
     const pr =
-      /^\/([^/]+\/[^/]+)\/(?:pulls\/?|pull\/(\d+)(?:\/(?:files|commits))?\/?|pull\/(\d+)\.(?:diff|patch))$/.exec(
+      /^\/([^/]+\/[^/]+)\/(?:pulls\/?|pull\/(\d+)(?:\/(?:files|commits|checks))?\/?|pull\/(\d+)\.(?:diff|patch))$/.exec(
         url.pathname,
       );
     if (pr) return pullRequestTarget(pr[1], pr[2] || pr[3]);
@@ -221,6 +221,19 @@ export class RemoteReadLoopGuard {
   }
 
   record(tool, result, args = {}) {
+    if (result?.code === "CC_TOOL_RECOVERY_PAUSED") {
+      // A provider can ignore omitted tool definitions. Count that attempt
+      // without replacing the actual failure/evidence with our own denial.
+      const key = remoteReadTarget(tool, args)?.key || this.activeKey;
+      const entry = this.targets.get(key);
+      if (entry?.tool === tool && entry.repeats >= RECOVERY_AFTER) {
+        entry.repeats++;
+        entry.recoveryOffered = true;
+        this.activeKey = key;
+        this.revision++;
+      }
+      return;
+    }
     const failed = failedResult(result);
     const policy = result?.shellCommandPolicy;
     const gitRepositoryKey = `git-repository:${createHash("sha256")
@@ -302,15 +315,37 @@ export class RemoteReadLoopGuard {
             highWater: result.offset + content.length,
           }
         : null;
-    const sameSnapshot = page && page.snapshotId === previous?.page?.snapshotId;
-    const advanced = sameSnapshot && page.highWater > previous.page.highWater;
-    if (sameSnapshot)
-      page.highWater = Math.max(page.highWater, previous.page.highWater);
+    // Keep coverage per snapshot: rotating PR details/files/checks or changing
+    // an already-read window's length does not produce new evidence. Intervals
+    // (not just a high-water mark) still allow reading previously skipped gaps.
+    const snapshots = previous?.snapshots || new Map();
+    const ranges = page ? snapshots.get(page.snapshotId) : null;
+    const covered =
+      page &&
+      ranges?.some(
+        ([start, end]) => start <= page.offset && end >= page.highWater,
+      );
+    const advanced = page && ranges && !covered;
+    if (page) {
+      const merged = [];
+      for (const range of [
+        ...(ranges || []),
+        [page.offset, page.highWater],
+      ].sort((a, b) => a[0] - b[0])) {
+        const last = merged.at(-1);
+        if (last && last[1] >= range[0]) last[1] = Math.max(last[1], range[1]);
+        else merged.push([...range]);
+      }
+      snapshots.delete(page.snapshotId);
+      snapshots.set(page.snapshotId, merged.slice(-32));
+      while (snapshots.size > 16)
+        snapshots.delete(snapshots.keys().next().value);
+    }
     // Changed error wording or switching web/gh must not buy another retry
     // budget for the same failed target. Successful fresh evidence resets it.
     const repeats = failed
       ? (previous?.repeats || 0) + 1
-      : target.github && digests.has(digest) && !advanced
+      : target.github && (covered || (digests.has(digest) && !advanced))
         ? previous.repeats + 1
         : 0;
     if (!failed) {
@@ -325,6 +360,7 @@ export class RemoteReadLoopGuard {
       repeats,
       digest,
       digests,
+      snapshots,
       page,
       recoveryOffered: repeats > 0 && previous?.recoveryOffered === true,
       evidence: excerpt(
@@ -393,11 +429,34 @@ export class RemoteReadLoopGuard {
     this.offeredRevision = this.revision;
     const entry = this.targets.get(this.activeKey);
     entry.recoveryOffered = true;
+    // Keep the shell available for local reproduction and validation. Only
+    // repeated reads of the stalled remote target are narrowed below.
+    if (entry.tool === "run_shell" && entry.github) return [];
     return [entry.tool];
   }
 
+  shouldPause(tool, args = {}) {
+    const target = remoteReadTarget(tool, args);
+    const entry = target && this.targets.get(target.key);
+    return !!(
+      entry?.github &&
+      entry.recoveryOffered &&
+      entry.repeats >= RECOVERY_AFTER
+    );
+  }
+
   get workflowHint() {
     const active = this.targets.get(this.activeKey);
+    if (active?.github && !active.pullRequest) {
+      return (
+        "GitHub Actions investigation: use the retained run/job facts to identify the first failed step and its relevant local implementation. " +
+        "An aggregate or incomplete-matrix gate can be a downstream symptom; inspect the dependency jobs' conclusions before assuming that the gate itself is wrong. " +
+        "When a job is cancelled or logs are unavailable, record that fact and the command error; do not cycle through the same web page and log downloads. " +
+        "Use one focused run/job metadata query to resolve the missing status or cancellation reason, then inspect the relevant workflow and make the justified, authorized fix with validation. " +
+        "If available evidence cannot establish a fix, report the specific missing evidence and what was verified. Do not disable a release or safety gate just to make CI pass. " +
+        "For a research/review request, synthesize the findings without unsolicited edits; for monitoring, use status queries instead of repeated logs."
+      );
+    }
     if (
       !active?.pullRequest &&
       !(

package/src/lib/task-progress-tracker.js

@@ -24,6 +24,8 @@ export const TASK_RECOVERY_TOOLS = [
   "todo_write",
   "spawn_sub_agent",
   "tool_search",
+  "web_fetch",
+  "web_search",
 ];
 
 // The runtime admits at most 32 spawned agents plus the root. Keep bounded
@@ -34,6 +36,27 @@ function boundedText(value, limit) {
   return typeof value === "string" ? value.slice(0, limit) : "";
 }
 
+// Status queries remain executable (including intentional monitoring), but
+// fetching a different status page is not an implementation or verification.
+// Classification affects progress guidance only, never command authorization.
+function isRemoteInspectionCommand(command) {
+  if (typeof command !== "string") return false;
+  if (
+    /(?:^|[\s;&|])gh(?:\.exe)?\s+(?:run\s+(?:view|list|watch)|pr\s+(?:view|list|diff|checks)|auth\s+status)\b/i.test(
+      command,
+    )
+  )
+    return true;
+  return (
+    /(?:^|[\s;&|])gh(?:\.exe)?\s+api\s/i.test(command) &&
+    /(?:https:\/\/api\.github\.com\/)?\/?repos\/[\w.-]+\/[\w.-]+\/(?:actions|pulls|compare|releases|commits|check-runs|check-suites)\b/i.test(
+      command,
+    ) &&
+    !/(?:^|\s)(?:--method|-X)(?:=|\s*)["']?(?!GET\b)\w+/i.test(command) &&
+    !/(?:^|\s)(?:(?:--field|--raw-field|--input)(?:=|\s)|-[fF])/.test(command)
+  );
+}
+
 function remember(map, key, value, limit) {
   map.delete(key);
   map.set(key, value);
@@ -44,7 +67,7 @@ function remember(map, key, value, limit) {
  * Run-tree exploration accounting, separate from file coverage and permissions.
  * This object is shared by parent/child loops, not serialized into model input.
  * New file pages advance coverage but do not reset the exploration counter.
- * Interventions are advisory / one-request tool narrowing, never completion
+ * Interventions are advisory / progress-scoped tool narrowing, never completion
  * verdicts or a hard deadline for legitimate research and monitoring tasks.
  */
 export class TaskProgressTracker {
@@ -57,6 +80,8 @@ export class TaskProgressTracker {
     this.plans = new Map();
     this.childFindings = new Map();
     this.lastActions = [];
+    this.remoteInspections = [];
+    this.localFindings = [];
   }
 
   retainChildResult(id, result, owner = "root") {
@@ -96,6 +121,32 @@ export class TaskProgressTracker {
         typeof args.old_string === "string" &&
         args.old_string === args.new_string);
 
+    if (!failed && (tool === "search_files" || tool === "read_file")) {
+      const evidence = result.content ?? result.matches ?? result.output;
+      const excerpt = boundedText(
+        typeof evidence === "string" ? evidence : JSON.stringify(evidence),
+        1000,
+      );
+      if (excerpt) {
+        const entry = {
+          owner,
+          tool,
+          path: boundedText(args.path || result.path, 320),
+          query: boundedText(args.pattern, 200),
+          range: result.range,
+          excerpt,
+        };
+        const owned = [
+          ...this.localFindings.filter((item) => item.owner === owner),
+          entry,
+        ].slice(-4);
+        this.localFindings = [
+          ...this.localFindings.filter((item) => item.owner !== owner),
+          ...owned,
+        ].slice(-MAX_CHECKPOINT_OWNERS * 4);
+      }
+    }
+
     if (tool === "spawn_sub_agent")
       this.retainChildResult(result?.subAgentId, result, owner);
     if (tool === "todo_write" && !failed && Array.isArray(args.todos)) {
@@ -120,8 +171,29 @@ export class TaskProgressTracker {
       // fingerprints affect guidance only: every authorized command still runs.
       const output = boundedText(result?.output ?? result?.stdout, 30000);
       const digest = createHash("sha256").update(output).digest("hex");
+      const remoteInspection =
+        tool === "run_shell" && isRemoteInspectionCommand(args.command);
+      if (remoteInspection) {
+        // A status observation is still useful evidence after compaction. Keep
+        // it apart from actions so remembering it never resets recovery.
+        const owned = [
+          ...this.remoteInspections.filter((entry) => entry.owner === owner),
+          {
+            owner,
+            command: boundedText(args.command, 320),
+            output: boundedText(output, 1200),
+            error: boundedText(result?.error || result?.stderr, 400),
+            failed,
+          },
+        ].slice(-4);
+        this.remoteInspections = [
+          ...this.remoteInspections.filter((entry) => entry.owner !== owner),
+          ...owned,
+        ].slice(-MAX_CHECKPOINT_OWNERS * 4);
+      }
       exploration =
         !!remoteReadTarget(tool, args) ||
+        remoteInspection ||
         output.length >= 8000 ||
         this.commandOutputs.has(digest);
       if (!failed) remember(this.commandOutputs, digest, true, 64);
@@ -179,11 +251,14 @@ export class TaskProgressTracker {
       guidance:
         message +
         " For an implementation task, make the smallest justified, authorized change and validate it. " +
+        "For a bug fix, state the observed failure, your leading root-cause hypothesis and the smallest test that can disprove it. Run that focused reproduction or diagnostic next; use its actual output to choose the next step. Do not keep reading adjacent files without naming the specific missing fact. A timeout alone does not establish that increasing the timeout is the fix. " +
         "For research/review, synthesize evidence-backed findings; do not write files merely to clear this warning. " +
         "If evidence is insufficient, name the exact missing fact and use a focused search or bounded computation. " +
         "Do not restart general investigation, rewrite the plan, or delegate the same research. " +
         "A child exhausting its budget is not task completion. Preserve useful partial findings and continue the original task. " +
-        "Normal tool availability resumes on the next model turn. Never claim completion without satisfying the user's request.",
+        "During recovery, broad discovery stays paused until an actionable tool outcome; a focused search, another status query or a failed command does not end recovery. " +
+        "Use search_files for an exact missing local fact or run a bounded computation/verification, then act on the result. " +
+        "Never claim completion without satisfying the user's request.",
     };
   }
 
@@ -191,14 +266,27 @@ export class TaskProgressTracker {
     if (
       !this.plans.size &&
       !this.childFindings.size &&
-      !this.lastActions.length
+      !this.lastActions.length &&
+      !this.remoteInspections.length &&
+      !this.localFindings.length
     )
       return null;
     const checkpoint = {
       bounded: true,
+      recentLocalFindings: this.localFindings
+        .filter((entry) => entry.owner === owner)
+        .map(({ owner: _owner, ...entry }) => entry),
       recentToolOutcomes: this.lastActions
         .filter((entry) => entry.owner === owner)
         .map(({ tool, path, output }) => ({ tool, path, output })),
+      recentRemoteInspections: this.remoteInspections
+        .filter((entry) => entry.owner === owner)
+        .map(({ command, output, error, failed }) => ({
+          command,
+          output,
+          error,
+          failed,
+        })),
       reportedPlans: this.plans.has(owner)
         ? [{ todos: this.plans.get(owner) }]
         : [],
@@ -209,7 +297,9 @@ export class TaskProgressTracker {
     // Only counters are inherited across isolated child contracts. Source
     // material belongs to the loop that observed it or received the child result.
     if (
+      !checkpoint.recentLocalFindings.length &&
       !checkpoint.recentToolOutcomes.length &&
+      !checkpoint.recentRemoteInspections.length &&
       !checkpoint.reportedPlans.length &&
       !checkpoint.childFindings.length
     )
@@ -218,6 +308,10 @@ export class TaskProgressTracker {
       if (checkpoint.reportedPlans.length > 1) checkpoint.reportedPlans.pop();
       else if (checkpoint.childFindings.length)
         checkpoint.childFindings.shift();
+      else if (checkpoint.recentLocalFindings.length)
+        checkpoint.recentLocalFindings.shift();
+      else if (checkpoint.recentRemoteInspections.length)
+        checkpoint.recentRemoteInspections.shift();
       else if (checkpoint.recentToolOutcomes.length)
         checkpoint.recentToolOutcomes.shift();
       else checkpoint.reportedPlans.pop();

package/src/lib/text-file-search.js

@@ -54,6 +54,17 @@ export function searchTextFile(file, options = {}) {
     const finish = (result) => {
       if (settled) return;
       settled = true;
+      if (
+        !result.error &&
+        !regex &&
+        result.matches?.length === 0 &&
+        /[|^$]|\\[bdsw]|\.\*/i.test(pattern)
+      ) {
+        result = {
+          ...result,
+          hint: "No literal matches. This pattern contains regex syntax, but this search used literal matching. If alternation or regex was intended, set regex: true; otherwise search one exact symbol. Do not infer that the symbols are absent from this result.",
+        };
+      }
       clearTimeout(timer);
       Promise.resolve(worker?.terminate())
         .catch(() => {})

package/src/runtime/agent-core.js

@@ -22,6 +22,12 @@ import {
 } from "../lib/read-file-page.js";
 import { ReadFileLoopGuard } from "../lib/read-file-loop-guard.js";
 import { RemoteReadLoopGuard } from "../lib/remote-read-loop-guard.js";
+import {
+  isPrActionRequest,
+  PR_ACTION_GUIDANCE,
+  PR_INVESTIGATION_LIMIT,
+  PR_INVESTIGATION_EXIT_GUIDANCE,
+} from "../lib/pr-investigation-policy.js";
 import {
   findExplicitPrCloseIntent,
   prCloseActionDirective,
@@ -1098,6 +1104,8 @@ Key behaviors:
 - When asked to create something, use write_file to create it
 - When asked to remove or rename a file, use delete_file or move_file so the filesystem intent is explicit and reviewable
 - When asked to run/test something, use run_shell to execute it
+- For a bug fix, retain the failing test/file and exact error, inspect the relevant code, then state a root-cause hypothesis and run the smallest reproduction or diagnostic that can disprove it. Base the next step on actual output. Do not repeatedly read adjacent files without identifying a specific missing fact. Validate the fix with the failing case and report what remains unverified.
+- For CI log retrieval, inspect command stderr before retrying. Match syntax to the actual shell: Windows PowerShell 5 does not support &&, cmd treats single quotes literally, and head is not a Windows builtin. Prefer a plain gh metadata/log command without jq or pipelines first, then inspect the saved output. Never switch shells to bypass a policy denial.
 - For long-running commands (builds, full test suites, dev servers) set run_shell { run_in_background: true } to get a task_id back immediately, then poll output and completion with check_shell { task_id }. Kill a backgrounded server with check_shell { task_id, kill: true } when finished
 - When asked about git status, diff, log, or other repository operations, use the git tool instead of run_shell
 - When asked about files or code, use search_files to locate relevant sections, then read_file with offset/limit. Follow nextRead for large files. Reuse unchanged content already in context instead of repeatedly reading the same page; re-read when the file changes or the earlier content is no longer available.
@@ -13936,6 +13944,7 @@ export async function* agentLoop(messages, options) {
   let emptyThinkingReprompted = false;
   const readFileLoopGuard = new ReadFileLoopGuard();
   const remoteReadLoopGuard = new RemoteReadLoopGuard();
+  const prActionTask = isPrActionRequest(messages);
   // Keep an explicit user-requested PR close action alive even if the
   // conversation is compacted down to tool evidence. It is guidance only;
   // the ordinary execution approval remains mandatory for every close.
@@ -14550,8 +14559,15 @@ export async function* agentLoop(messages, options) {
     const newProgressIntervention =
       progressIntervention &&
       progressIntervention.key !== lastTaskProgressIntervention;
-    const taskRecoveryTurn =
-      newProgressIntervention && progressIntervention.recovery;
+    // Warnings are deduplicated, recovery is not. A search or failed command
+    // must not restore broad discovery on the very next model request.
+    const taskRecoveryTurn = progressIntervention?.recovery === true;
+    const prInvestigationExhausted =
+      prActionTask &&
+      taskProgressTracker.explorationCalls >= PR_INVESTIGATION_LIMIT;
+    const taskRecoveryTools = TASK_RECOVERY_TOOLS.filter(
+      (tool) => tool !== "read_file" || !readFileLoopGuard.hasRecoveryReads,
+    );
     if (newProgressIntervention) {
       lastTaskProgressIntervention = progressIntervention.key;
       // Reuse the existing warning event so CLI, REPL and IDE clients all show
@@ -14561,24 +14577,31 @@ export async function* agentLoop(messages, options) {
         message:
           progressIntervention.message +
           (taskRecoveryTurn
-            ? " Broad reading and new delegation are paused for one model turn."
+            ? " Broad reading, web discovery and new delegation remain paused until an actionable tool outcome."
             : ""),
       };
     }
-    const iterationToolOptions =
-      readRecoveryTurn || taskRecoveryTurn || remoteRecoveryTools.length
-        ? {
-            ...effectiveToolOptions,
-            disabledTools: [
-              ...new Set([
-                ...(effectiveToolOptions.disabledTools || []),
-                ...(readRecoveryTurn ? ["read_file"] : []),
-                ...(taskRecoveryTurn ? TASK_RECOVERY_TOOLS : []),
-                ...remoteRecoveryTools,
-              ]),
-            ],
-          }
-        : effectiveToolOptions;
+    const pausedTools = new Set([
+      ...(readRecoveryTurn ? ["read_file"] : []),
+      ...(taskRecoveryTurn ? taskRecoveryTools : []),
+      ...remoteRecoveryTools,
+      ...(prInvestigationExhausted
+        ? getEffectiveToolDefinitions(effectiveToolOptions).map(
+            (tool) => tool.function.name,
+          )
+        : []),
+    ]);
+    const iterationToolOptions = pausedTools.size
+      ? {
+          ...effectiveToolOptions,
+          disabledTools: [
+            ...new Set([
+              ...(effectiveToolOptions.disabledTools || []),
+              ...pausedTools,
+            ]),
+          ],
+        }
+      : effectiveToolOptions;
     const readContext = [
       readFileLoopGuard.findingsHint,
       readFileLoopGuard.progressHint,
@@ -14628,7 +14651,20 @@ export async function* agentLoop(messages, options) {
       }
     }
     const contextMemoryTrustedSystemIndexes = [];
-    if (remoteReadLoopGuard.recoveryHint || remoteReadLoopGuard.workflowHint) {
+    if (prActionTask && !prInvestigationExhausted) {
+      callMessages = [
+        ...callMessages,
+        {
+          role: "system",
+          content: PR_ACTION_GUIDANCE,
+        },
+      ];
+      contextMemoryTrustedSystemIndexes.push(callMessages.length - 1);
+    }
+    if (
+      !prInvestigationExhausted &&
+      (remoteReadLoopGuard.recoveryHint || remoteReadLoopGuard.workflowHint)
+    ) {
       callMessages = [
         ...callMessages,
         {
@@ -14643,14 +14679,14 @@ export async function* agentLoop(messages, options) {
       ];
       contextMemoryTrustedSystemIndexes.push(callMessages.length - 1);
     }
-    if (prCloseDirective) {
+    if (prCloseDirective && !prInvestigationExhausted) {
       callMessages = [
         ...callMessages,
         { role: "system", content: prCloseDirective },
       ];
       contextMemoryTrustedSystemIndexes.push(callMessages.length - 1);
     }
-    if (progressIntervention) {
+    if (progressIntervention && !prInvestigationExhausted) {
       callMessages = [
         ...callMessages,
         {
@@ -14658,13 +14694,13 @@ export async function* agentLoop(messages, options) {
           content:
             progressIntervention.guidance +
             (taskRecoveryTurn
-              ? " One-turn recovery: read_file, list_dir, todo_write, spawn_sub_agent and tool_search are omitted for this request only."
+              ? ` Recovery remains active: ${taskRecoveryTools.join(", ")} are omitted until an actionable tool outcome. Only unfinished, already-started file scans may continue; new whole-file discovery is paused. Focused search, authorized changes and verification remain available.`
               : ""),
         },
       ];
       contextMemoryTrustedSystemIndexes.push(callMessages.length - 1);
     }
-    if (readRecoveryTurn) {
+    if (readRecoveryTurn && !prInvestigationExhausted) {
       callMessages = [
         ...callMessages,
         {
@@ -14675,7 +14711,7 @@ export async function* agentLoop(messages, options) {
       ];
       contextMemoryTrustedSystemIndexes.push(callMessages.length - 1);
     }
-    if (readFileLoopGuard.recoveryHint) {
+    if (readFileLoopGuard.recoveryHint && !prInvestigationExhausted) {
       callMessages = [
         ...callMessages,
         { role: "system", content: readFileLoopGuard.recoveryHint },
@@ -14705,6 +14741,14 @@ export async function* agentLoop(messages, options) {
       }
     }
 
+    if (prInvestigationExhausted) {
+      callMessages = [
+        ...callMessages,
+        { role: "system", content: PR_INVESTIGATION_EXIT_GUIDANCE },
+      ];
+      contextMemoryTrustedSystemIndexes.push(callMessages.length - 1);
+    }
+
     // Per-span unified ids (P2 observability): the run-level default attributes
     // stamp session/agent/workflow ids on every span, but turn/prompt ids are
     // per-iteration. A "turn" is one model iteration of the run; "prompt" is the
@@ -14930,6 +14974,38 @@ export async function* agentLoop(messages, options) {
     }
 
     const toolCalls = msg.tool_calls;
+    if (prInvestigationExhausted) {
+      // Exactly one synthesis request, even if the provider ignores the empty
+      // tool set or a Stop hook normally asks to continue. Settle usage first;
+      // do not insert unexecuted calls or turn a safety stop into completion.
+      await _awaitBackgroundUsageSettlement(
+        backgroundSubAgents,
+        backgroundUsageFailureState,
+      );
+      yield* _drainSubAgentUsage(subAgentUsageSink);
+      if (toolCalls?.length) {
+        const error = new Error(
+          "PR investigation stopped after repeated exploration without an actionable outcome; the task is incomplete. " +
+            "The model requested more tools after the final synthesis instruction. Retained evidence: " +
+            (
+              taskProgressTracker.checkpointFor(runId) ||
+              remoteReadLoopGuard.findingsHint ||
+              "No verified findings."
+            ).slice(0, 2000),
+        );
+        error.code = "CC_AGENT_PR_INVESTIGATION_STALLED";
+        throw error;
+      }
+      yield {
+        type: "response-complete",
+        content:
+          "PR investigation stopped without completing the task.\n\n" +
+          (msg.content ||
+            "No actionable outcome was produced; use the retained findings to identify the missing prerequisite."),
+      };
+      yield { type: "run-ended", runId, reason: "pr-investigation-stalled" };
+      return;
+    }
     if (Array.isArray(toolCalls) && toolCalls.length > 0) {
       // Allocate missing provider IDs once, before transcript insertion and
       // any evidence or execution boundary. This is only local correlation,
@@ -15131,12 +15207,15 @@ export async function* agentLoop(messages, options) {
     // session (concurrent prompts would race), or `parallelReadOnlyTools: false`
     // falls through to the strictly sequential loop below.
     const parallelReads =
+      !remoteReadLoopGuard.recoveryHint &&
       options.parallelReadOnlyTools !== false &&
+      !taskRecoveryTurn &&
       toolCalls.length > 1 &&
       !toolContext.permissionConfirm &&
       toolCalls.every(
         (c) =>
           typeof c?.function?.name === "string" &&
+          !pausedTools.has(c.function.name) &&
           _CHECKPOINT_READ_ONLY.has(c.function.name),
       );
     if (parallelReads) {
@@ -15363,9 +15442,37 @@ export async function* agentLoop(messages, options) {
       // hook, or observationally stronger `tool-executing` event. The same
       // preflight runs again inside executeTool to prevent call-site drift.
       const earlyAuthorityDenial =
+        (pausedTools.has(toolName) ||
+        remoteReadLoopGuard.shouldPause(toolName, toolArgs) ||
+        (taskRecoveryTurn &&
+          toolName === "read_file" &&
+          !(
+            typeof toolArgs?.path === "string" &&
+            readFileLoopGuard.canContinue(
+              path.resolve(toolContext.cwd || process.cwd(), toolArgs.path),
+              toolArgs,
+            )
+          ))
+          ? {
+              success: false,
+              code: "CC_TOOL_RECOVERY_PAUSED",
+              error: `${toolName} is paused for loop recovery and was not executed. Use retained findings for an authorized action or report the specific blocker; do not repeat or disguise this call.`,
+            }
+          : null) ||
         explicitPrCloseActionGuard.admission(toolName, toolArgs) ||
         preflightToolExecutionAuthority(toolName, toolArgs, toolContext);
       if (earlyAuthorityDenial) {
+        remoteReadLoopGuard.record(toolName, earlyAuthorityDenial, toolArgs);
+        readFileLoopGuard.record(
+          toolName,
+          earlyAuthorityDenial,
+          taskProgressTracker.record(
+            toolName,
+            earlyAuthorityDenial,
+            toolArgs,
+            runId,
+          ),
+        );
         const resultStr = capToolResultString(
           safeStringifyToolResult(earlyAuthorityDenial),
         );

package/src/runtime/agent-runtime.js

@@ -17,6 +17,7 @@ import { ChainlessChainWSServer } from "../gateways/ws/ws-server.js";
 import { WSSessionManager } from "../gateways/ws/ws-session-gateway.js";
 import { attachTopicHandlers } from "../gateways/ws/topic-handler-attachment.js";
 import { createMcpTopicHandlers } from "../gateways/ws/mcp-topic-handlers.js";
+import { createEvolutionDeploymentTopicHandlers } from "../gateways/ws/evolution-deployment-topic-handlers.js";
 import { PtyManager } from "../gateways/terminal/PtyManager.js";
 import { createTerminalHandlers } from "../gateways/terminal/terminal-handlers.js";
 import { createWebUIServer } from "../gateways/ui/web-ui-server.js";
@@ -807,6 +808,7 @@ export class AgentRuntime {
           configStore: mcpConfigStore,
           cwd: workspacePolicyCwd,
         }),
+        ...createEvolutionDeploymentTopicHandlers(),
       },
     });
     wsBroadcastRef.current = attached.broadcast;