codeshark-cli 0.1.1 → 0.1.4

package/PRIVACY.md

@@ -0,0 +1,73 @@
+# CodeShark Privacy Notice
+
+*Last updated: September 5, 2026*
+
+This notice describes how CodeShark handles information when you use the CLI,
+the CodeShark website, or the CodeShark community gateway.
+
+## The CLI
+
+CodeShark does not include analytics or telemetry by default. The CLI reads and
+writes files in the project directory you select, and it may execute commands
+there after you approve them. Local configuration can contain provider API keys.
+Protect your computer and configuration file; do not place secrets in prompts
+or project files that you send to an AI provider.
+
+## AI requests
+
+When you use the shared gateway, your prompts, selected tool definitions, and
+relevant conversation or file content are sent to the gateway and then to one
+or more upstream providers selected by the gateway, including OpenRouter,
+NVIDIA, Google, or
+other providers selected by that service. When you use your own provider key,
+requests go to the provider configured by you.
+
+AI providers may process, retain, or log requests under their own policies and
+terms. CodeShark cannot guarantee that prompts, generated output, IP addresses,
+or provider-side request metadata are never retained. Review the applicable
+provider documentation before sending confidential, personal, regulated, or
+proprietary information.
+
+## Gateway data
+
+The community gateway receives request data and network information needed to
+route requests, enforce rate limits, prevent abuse, and operate the service.
+The gateway implementation does not intentionally log prompt contents, but
+Cloudflare and upstream providers may process operational metadata according to
+their own policies. The gateway uses in-memory rate-limit state and does not
+promise a particular retention period.
+
+## API keys
+
+Keys entered into the CLI are stored locally in the CodeShark configuration
+file. On POSIX systems CodeShark attempts to set restrictive file permissions.
+On Windows, filesystem permissions depend on the account and machine settings;
+users should protect the configuration file and computer themselves. Keys sent
+to the shared gateway are held as server-side deployment secrets and are not
+returned to clients.
+
+## Your choices
+
+You can use a local Ollama provider to keep model requests on your machine, or
+configure your own provider directly. You can remove local configuration by
+deleting the path shown by your configuration setup. You can avoid the shared
+gateway by selecting another provider.
+
+## Website
+
+The static website does not intentionally collect form submissions or use
+analytics. External resources, including Google Fonts and npm links, may
+receive normal browser request metadata under their own policies.
+
+## Children and regulated data
+
+CodeShark is not designed for children or for handling health, payment,
+financial, educational, employment, export-controlled, or other regulated data.
+Do not send such information unless you have confirmed that the selected
+provider and your legal obligations permit it.
+
+## Changes and contact
+
+This notice may change as the service changes. For questions or privacy
+requests, open an issue in the CodeShark repository listed in `package.json`.
+This notice is informational and is not legal advice.

package/README.md

@@ -1,260 +1,125 @@
-# CodeShark 🦈
+# CODESHARK
 
-An open-source **terminal coding agent** with a pixel-shark mascot — five
-frontier models (GPT-5.6 Sol, DeepSeek-V4 Flash, GLM 5.3 Flash Thinking,
-Kimi-K3, Gemini 3.6 Flash) behind one OpenAI-compatible endpoint.
+An open-source coding agent that reads your project, plans the work, edits files, and runs commands—with your approval. Eight model choices, one familiar terminal.
 
-Run `codeshark banner --plain` to see the live mascot in your terminal: a dark
-grey head with black eyes, white teeth, and a red mouth.
-
-## How it works
-
-Everything routes through **UnoRouter** (`https://api.unorouter.com/v1`), one
-OpenAI-compatible endpoint. CodeShark ships with a zero-setup **community
-gateway**, so you can start without configuring anything; bring your own
-UnoRouter key whenever you want your own rate limits and private prompts.
-
-The gateway strictly serves only UnoRouter's `:free` lane identifiers — any
-other identifier is refused, so there is no paid path through the gateway.
+[Source code](https://github.com/ajashratripathi-crypto/codeshark-cli) | [Quick start](#quick-start) | [Models](#models) | [License](LICENSE)
 
 ## Quick start
 
-CodeShark is intentionally **project-folder-only**. You must select the folder
-that the agent is allowed to work in with `--folder` (or `--cwd`). It refuses to
-start chat, setup, model switching, key management, or a prompt without a real
-project folder.
-
-```bash
-# From a cloned checkout:
-npm install
-npm run build
-npm install -g .
-
-# Start CodeShark in the project folder:
-codeshark --folder .
-codeshark --folder . "explain this project"
+Requires **Node.js 18.17 or later** and npm.
 
-# Or select another folder from anywhere:
-codeshark --folder path/to/your-project
-codeshark --cwd path/to/your-project "fix the tests"
+### Install with npm
 
-# After the package is published:
-npx codeshark-cli       # run from any folder without a global install
+```bash
 npm install -g codeshark-cli
 ```
 
-Out of the box, CodeShark talks to the community gateway (which routes through
-UnoRouter), so there is **nothing to configure**. If you installed from a
-checkout and `codeshark` is not recognized yet, use `node dist/index.js
---folder .` or run `npm install -g .`. All file edits, searches, and commands
-stay inside the selected project folder.
-
-By using CodeShark you agree to the [Terms of Service](TERMS.md) — the first
-interactive start asks you to accept them once, and `codeshark terms` prints
-them anytime.
-
-### Setup: shared gateway or your own key?
-
-On first launch the CLI asks how you want to connect — and you can re-run it
-anytime with `codeshark setup`:
+Then open the project you want to work on:
 
-- **My own API key (recommended)** — typed into the terminal **hidden (never
-  echoed)**, stored only on your computer in a locked config file (`0600`
-  permissions), and never printed by CodeShark. Your own key means your own
-  rate limits and private prompts. One UnoRouter key unlocks all 5 models.
-- **Shared gateway** — no key on your computer at all; the gateway's keys live
-  as server-side secrets. Shared free lanes are rate-limited, so the gateway
-  **queues** bursts (you wait a moment instead of erroring) and fails over
-  between UnoRouter → OpenRouter → NVIDIA automatically.
-- **Local Ollama** — fully offline on your own machine.
-
-Your local keys are protected further by the password-locked key vault
-(`codeshark keys`) — scrypt-hashed password, session + CSRF tokens, and keys
-never appear in the page's HTML or the terminal.
+```bash
+cd path/to/your-project
+codeshark --folder .
+```
 
-## Usage
+Or send a task directly:
 
+```bash
+codeshark --folder . "explain this project"
+codeshark --folder . "find and fix the failing tests"
 ```
-codeshark --folder .                  interactive chat for this folder
-codeshark --folder . "fix the tests"  one-shot prompt for this folder
-codeshark banner                      just the mascot (no folder needed)
-codeshark --folder . setup            providers / keys wizard
-codeshark --folder . model            list the catalog and active model
-codeshark --folder . keys             open the local key vault
-```
 
-REPL commands: `/help` `/model` `/keys` `/key-status` `/setup` `/clear` `/quit`
-(Ctrl+C also quits). Read the terms anytime with `codeshark terms`. The `/keys` page listens only on `127.0.0.1`, requires a
-local password, and keeps key values hidden in password-style fields; the
-terminal status command only shows masked values.
-
-## Tools the agent can use
-
-- `read_file` / `write_file` / `edit_file` (strict: `oldString` must match **exactly once** or the edit is rejected)
-- `list_directory` / `glob` (`**`, `*`, `?`, `{a,b}`)
-- `code_search` (ripgrep when installed, dependency-free fallback otherwise)
-- `run_command` (bash / cmd, 30s timeout, output capped) — with a built-in
-  danger blocklist: `rm -rf`, `git push`, `sudo`, `curl | sh`, … are refused
-  unless you set `CODESHARK_ALLOW_DANGEROUS=1`
-- `finish` — the model signals completion with a summary
-
-## Providers & models
-
-Everything runs through **UnoRouter** (`https://api.unorouter.com/v1`), one
-OpenAI-compatible endpoint that routes to 45+ upstream providers — all five
-catalog models are served on its `:free` lanes. Switch anytime with
-`/model <name>` in the REPL (or `codeshark model <name>`).
-
-| Model | API identifier | Context | |
-| --- | --- | --- | --- |
-| Chat-GPT 5.6 Sol | `gpt-5.6-sol:free` | 400K | |
-| DeepSeek-V4 Flash | `deepseek-v4-flash-0731:free` | 256K | |
-| GLM 5.3 Flash Thinking | `glm-5.3-flash-thinking:free` | 1M | default |
-| Kimi-K3 | `kimi-k3:free` | 256K | |
-| Gemini 3.6 Flash | `gemini-3.6-flash:free` | 1M | |
-
-\* All models run through the zero-setup gateway without any key — nothing to
-configure.
-
-**Keys:**
-- UnoRouter → https://unorouter.com/en/tokens (one key, 200+ models — the only key you really need)
-- Google AI Studio → https://aistudio.google.com/apikey (`AIza…`)
-
-Run `codeshark setup` to paste a key and pick a default model — it tests the key
-live before saving.
-
-**Rate limits:** shared lanes throttle (~20 req/min, ~200/day). If you hit
-a 429, the agent tells you — wait a moment or switch models with `/model`.
-
-## Configuration
-
-`~/.codeshark.json` (env vars override):
-
-```json
-{
-  "provider": "unorouter",
-  "model": "unorouter/glm-5.3-flash-thinking",
-  "unorouterApiKey": "ur-…",
-  "openrouterApiKey": "sk-…",
-  "nvidiaApiKey": "nvapi-…",
-  "geminiApiKey": "AIza…",
-  "gatewayUrl": "https://your-gateway.workers.dev",
-  "ollamaBaseUrl": "http://127.0.0.1:11434/v1",
-  "ollamaModel": "qwen3-coder:30b",
-  "maxIterations": 25
-}
+Or run without a global installation:
+
+```bash
+npx codeshark-cli --folder .
 ```
 
-Env vars: `CODESHARK_MODEL`, `UNOROUTER_API_KEY`, `OPENROUTER_API_KEY`,
-`GEMINI_API_KEY`, `CODESHARK_GATEWAY_URL`, `CODESHARK_GATEWAY_KEY`,
-`CODESHARK_NO_COLOR`, `CODESHARK_NO_BANNER`, `CODESHARK_NO_LOADING`,
-`CODESHARK_ALLOW_DANGEROUS`.
+CodeShark works with project folders. Run it from your project directory or choose a folder with `--folder` or `--cwd`.
 
-## Run your own community gateway
+On first launch, follow the connection setup and accept the [Terms](TERMS.md). The shared gateway lets you start without a personal API key; its free lanes are shared, rate-limited, and subject to availability.
 
-Anyone can fork the repo and deploy their own gateway — the URL is configurable,
-so your users hit *your* gateway:
+### Install from source
 
 ```bash
-cd worker
-npx wrangler secret put UNOROUTER_API_KEY    # your UnoRouter key (primary), stays server-side
-npx wrangler secret put OPENROUTER_API_KEY   # optional: OpenRouter fallback key
-npx wrangler secret put NVIDIA_API_KEY       # optional: NVIDIA NIM fallback key (nvapi-…)
-npx wrangler deploy
+git clone https://github.com/ajashratripathi-crypto/codeshark-cli.git
+cd codeshark-cli
+npm install
+npm run build
+npm install -g .
 ```
 
-Then point CodeShark at it:
-
-```bash
-codeshark setup   # or edit ~/.codeshark.json: "gatewayUrl": "https://<you>.workers.dev"
+For contributors or anyone who prefers a local build. If the command is not recognized after building, use `node dist/index.js --folder .` from the checkout.
+
+## Everyday commands
+
+| Command | What it does |
+| --- | --- |
+| `codeshark --folder .` | Start an interactive session in this folder |
+| `codeshark --folder . "your task"` | Run a one-shot task |
+| `codeshark setup` | Configure your connection and model |
+| `codeshark model` | Show the model catalog |
+| `codeshark keys` | Open the password-protected local key vault |
+| `codeshark banner` | Print the CODESHARK banner |
+| `codeshark update` | Check for and install an npm update |
+| `codeshark terms` | Read the terms |
+
+Inside a conversation:
+
+```text
+/help       Show available commands
+/plan       Work through a plan
+/build      Switch to building
+/model      See model choices
+/keys       Open the local key vault
+/setup      Reconfigure your connection
+/clear      Clear the conversation
+/quit       End the session
 ```
 
-The gateway serves only `:free` model identifiers — it never routes anything
-paid — rate-limits per IP, adds CORS, and refuses any non-`:free` identifier.
-When a provider rate-limits (429), the gateway **waits and retries**, then
-hands off to the next configured provider (UnoRouter → OpenRouter → NVIDIA),
-and per-IP bursts **queue** (wait for a slot) instead of failing. Your keys are
-Worker secrets: never logged, never returned, never visible to users. Clients
-also retry 429s with backoff, so shared lanes feel smooth.
+For example, `/model deepseek-v4-flash` switches to DeepSeek-V4 Flash. Your selection is saved locally.
 
-## Architecture
+## Models
 
-```
-┌────────────┐   messages/tools   ┌──────────────────┐   OpenAI-compatible   ┌──────────────┐
-│  terminal  │ ─────────────────▶ │   agent loop      │ ───────────────────▶ │  provider    │
-│ (repl/cli) │ ◀───────────────── │ (tools, guard)    │ ◀─────────────────── │  chain       │
-└────────────┘   streamed text    └──────────────────┘   SSE stream          └──────┬───────┘
-                                                                                    │
-                                  gateway (Cloudflare Worker, :free only) ◀─────────┤
-                                  unorouter (:free, your key) ◀────────────────────┤
-                                  gemini ◀──────────────────────────────────────────┤
-                                  ollama (local) ◀──────────────────────────────────┘
-```
+The catalog is checked at startup, and unavailable models are marked. These context windows describe the configured catalog; availability depends on the connection and provider.
 
-- `src/provider/` — canonical `ChatClient` interface + adapters (OpenAI-compatible
-  shared core, UnoRouter, OpenRouter, NVIDIA NIM, Gemini conversion, Ollama)
-- `src/agent.ts` — the loop: model → tool calls → results → repeat (25-iteration guard)
-- `src/tools/` — file, search, and shell tools (zero dependencies)
-- `src/banner.ts` — the mascot, defined as a character grid
-- `worker/` — the Cloudflare Worker gateway
+| Model | Context | Selection command |
+| --- | --- | --- |
+| Chat-GPT 5.6 Sol | 400K | `/model gpt-5.6-sol` |
+| DeepSeek-V4 Flash | 256K | `/model deepseek-v4-flash` |
+| MiniMax M3 | 128K | `/model minimax-m3` |
+| **GLM 5.3 Flash Think Search — default** | **1M** | `/model glm-5.3-flash-think-search` |
+| Gemini 3.6 Flash | 1M | `/model gemini-3.6-flash` |
+| Sarvam 30B | 128K | `/model sarvam-30b` |
+| GPT-OSS 120B | 128K | `/model gpt-oss-120b` |
+| Nemotron 3 Ultra 550B A55B | 256K | `/model nemotron-3-ultra-550b-a55b` |
 
-## Share it with other computers
+## Connection and privacy
 
-Other people run your CodeShark the exact same way you do — through npm.
-Publish once, and anyone with Node.js 18+ can run it from any computer.
+Run `codeshark setup` to choose the shared gateway, your own API connection, or local Ollama. Provider keys are stored on your computer and are typed hidden during setup. `codeshark keys` opens a password-protected local page for managing them.
 
-The package name is `codeshark-cli` (npm's anti-squatting rules reserve the
-bare `codeshark` name, which is too similar to the existing `code-shark`
-package). The command you type stays `codeshark`:
+When you use hosted models, prompts and relevant project content are sent through your configured connection. A personal key does not make hosted processing local; the provider’s privacy and retention policies still apply. See the [Privacy Notice](PRIVACY.md) and [Terms](TERMS.md).
 
-```bash
-npm login                     # once per computer (create an npm account first)
-npm run typecheck && npm test
-npm pack --dry-run            # preview exactly what ships: dist/, README, LICENSE
-npm publish --access public   # publish version 0.1.0
-```
+Configuration is stored in `~/.codeshark.json`. Environment options include `CODESHARK_MODEL`, `CODESHARK_GATEWAY_URL`, `CODESHARK_GATEWAY_KEY`, `CODESHARK_NO_COLOR`, `CODESHARK_NO_BANNER`, and `CODESHARK_NO_UPDATE`.
 
-Bump the version for every release: `npm version patch` (or `minor`/`major`),
-then `npm publish` again.
-
-From that moment, on **any computer** with Node.js 18+:
+## Update
 
 ```bash
-npx codeshark-cli --folder .  # run instantly — no install needed
-npm install -g codeshark-cli  # or install it like a real CLI
-codeshark --folder .          # then use it anywhere
+npm install -g codeshark-cli@latest
 ```
 
-The person on the other computer needs no API key and no account — the model
-provider stays server-side, so it works out of the box. The agent only works
-inside the folder they open with `--folder`; it edits, searches, and runs
-commands there and nowhere else.
-
-Not ready to publish? `npm pack` produces a single `codeshark-<version>.tgz`
-file — send that one file and the receiver runs `npm install -g
-./codeshark-0.1.0.tgz`.
-
 ## Development
 
 ```bash
 npm install
-npm run typecheck     # tsc --noEmit
-npm test              # build + node:test (agent loop, tools, parsers, banner)
-npm run worker:build  # typecheck the gateway worker
+npm run build
+npm run typecheck
+npm test
 ```
 
-## Roadmap
+## License
 
-- [x] Mascot banner, REPL, one-shot mode, setup wizard
-- [x] UnoRouter provider: 5 frontier models, one key
-- [x] Agent loop with streaming + tool calling (UnoRouter/Gemini/Ollama/gateway)
-- [x] File, search, and shell tools with safety blocklist
-- [x] Cloudflare Worker gateway (`:free`-only, UnoRouter-routed)
-- [ ] Session memory / project context
-- [x] npm package metadata and `npx codeshark-cli`/global-install support (publish manually)
-- [ ] Approval prompts for sensitive commands
-- [ ] More providers (Groq, Cerebras, …)
+[MIT](LICENSE).
 
-## License
+## Provider details
 
-MIT. 🦈
+The current free catalog uses UnoRouter through an OpenAI-compatible connection. Configure your own key with `codeshark setup`. Additional adapters support OpenRouter, NVIDIA NIM, Gemini, and local Ollama.

package/TERMS.md

@@ -1,6 +1,6 @@
 # CodeShark Terms of Service
 
-*Last updated: September 4, 2026*
+*Last updated: September 5, 2026*
 
 By installing, downloading, or using CodeShark (the "Software"), you agree to
 these Terms of Service. If you do not agree, do not use the Software.
@@ -8,8 +8,9 @@ these Terms of Service. If you do not agree, do not use the Software.
 ## 1. What CodeShark is
 
 CodeShark is an open-source terminal coding agent. It can read, create, and
-edit files, run searches, and execute commands **inside the project folder you
-explicitly open with `--folder`**. It is a tool you operate — you are
+edit files, run searches, and execute commands **inside the current directory or
+the project folder selected with `--folder` or `--cwd`**. The selected path must
+be a directory, not an individual file. It is a tool you operate — you are
 responsible for choosing when and how it acts.
 
 ## 2. No warranty
@@ -36,10 +37,13 @@ routed through shared free-tier provider lanes. You agree to:
 
 ## 4. Your content
 
-You retain all rights to the prompts you enter and the files you edit. You are
-solely responsible for them. Do not paste passwords, API keys, or other secrets
-into prompts — they may pass through third-party providers. Prompts and
-generated content are not private; treat them accordingly.
+You retain rights you already hold in the prompts you enter and the files you
+edit. Rights in generated content depend on applicable law, originality, and
+the terms of the selected provider; CodeShark does not guarantee ownership or
+exclusivity of generated content. You are solely responsible for your content.
+Do not paste passwords, API keys, or other secrets into prompts — they may pass
+through third-party providers. Prompts and generated content are not private;
+treat them accordingly. See `PRIVACY.md` for more information.
 
 ## 5. Limitation of liability
 
@@ -50,23 +54,38 @@ content or executed commands. You use the Software entirely at your own risk.
 
 ## 6. API keys
 
-If you paste your own provider key, it is stored locally on your computer in a
-locked configuration file and is never printed by CodeShark. Keys configured on
-the shared gateway are stored as server-side secrets and are never exposed,
-logged, or returned to clients. You are responsible for protecting your own
-keys.
+If you paste your own provider key, CodeShark stores it locally and does not
+print it intentionally. CodeShark attempts restrictive permissions on POSIX
+systems; on Windows, protection depends on your account and machine settings.
+Keys configured on the shared gateway are deployment secrets and are not
+returned to clients. Third-party providers may process request data under their
+own terms. You are responsible for protecting your own keys.
 
-## 7. Changes
+## 7. Third-party services
+
+CodeShark may connect to third-party services, including model providers,
+Cloudflare, Google, and Ollama. Those services have separate terms,
+privacy policies, availability limits, model restrictions, and data practices.
+You are responsible for complying with the terms that apply to the provider
+and model you select. CodeShark does not represent or endorse those providers.
+
+## 8. Updates
+
+The CLI may check npm for a newer CodeShark release at startup and asks for
+confirmation before installing it. You can skip the check with
+`CODESHARK_NO_UPDATE=1` or run `codeshark update` manually.
+
+## 9. Changes
 
 These Terms may be updated at any time. Continued use of the Software after
 changes constitutes acceptance of the revised Terms.
 
-## 8. Termination
+## 10. Termination
 
 We may refuse or terminate access to the shared gateway at any time, with or
 without notice, for any reason — including violation of these Terms. The
 open-source Software itself remains available under its MIT license.
 
-## 9. Contact
+## 11. Contact
 
 For questions about these Terms, open an issue in the CodeShark repository.

package/dist/agent.js

@@ -8,15 +8,22 @@ import { DEFAULT_MAX_ITERATIONS } from "./config.js";
  */
 export async function runAgent(input, opts, events) {
     const maxIterations = opts.maxIterations ?? DEFAULT_MAX_ITERATIONS;
+    if (!Number.isSafeInteger(maxIterations) || maxIterations < 1)
+        throw new Error("maxIterations must be a positive integer.");
     const messages = opts.initialMessages ? [...opts.initialMessages] : [];
     const systemPrompt = opts.systemPrompt ?? defaultSystemPrompt(opts.cwd);
-    if (!messages.some((message) => message.role === "system")) {
+    const systemIndex = messages.findIndex((message) => message.role === "system");
+    if (systemIndex === -1) {
         messages.unshift({ role: "system", content: systemPrompt });
     }
+    else {
+        messages[systemIndex] = { role: "system", content: systemPrompt };
+    }
     messages.push({ role: "user", content: input });
-    const ctx = { cwd: opts.cwd, log: opts.debug };
+    const ctx = { cwd: opts.cwd, log: opts.debug, readOnly: opts.readOnly, signal: opts.signal };
     let lastError = null;
     for (let i = 0; i < maxIterations; i++) {
+        opts.signal?.throwIfAborted();
         let assistant = null;
         let streamedText = "";
         for (const client of opts.clients) {
@@ -32,11 +39,18 @@ export async function runAgent(input, opts, events) {
                 }
                 : undefined;
             try {
-                assistant = await client.chat(messages, opts.registry.schemas(), clientEvents);
+                assistant = await client.chat(messages, opts.registry.schemas(opts.readOnly), clientEvents, opts.signal);
+                if (assistant.role !== "assistant")
+                    throw new Error("Provider returned a non-assistant response.");
                 streamedText = clientStreamedText;
                 break;
             }
             catch (e) {
+                assistant = null;
+                opts.signal?.throwIfAborted();
+                // A partial answer is already visible; avoid mixing it with another provider's answer.
+                if (clientStreamedText)
+                    throw e;
                 lastError = e instanceof Error ? e : new Error(String(e));
                 opts.debug?.(`[provider] ${client.provider} failed: ${lastError.message}`);
             }
@@ -56,12 +70,28 @@ export async function runAgent(input, opts, events) {
             };
         }
         for (const call of calls) {
+            opts.signal?.throwIfAborted();
             if (call.name === "finish") {
                 const summary = typeof call.args.summary === "string" && call.args.summary.trim() ? call.args.summary.trim() : "Task complete.";
+                const remaining = calls.slice(calls.indexOf(call));
+                for (const pending of remaining) {
+                    messages.push({ role: "tool", content: pending === call ? summary : "Skipped because the task was finished.", toolCallId: pending.id, toolName: pending.name });
+                }
+                messages.push({ role: "assistant", content: summary });
                 return { text: summary, iterations: i + 1, history: messages };
             }
             opts.debug?.(`[tool] ${call.name}`);
             events?.onToolCall?.(call);
+            if (opts.approveToolCall && !(await opts.approveToolCall(call))) {
+                messages.push({
+                    role: "tool",
+                    content: `User denied the requested action: ${call.name}. Do not retry it unless the user asks again.`,
+                    toolCallId: call.id,
+                    toolName: call.name,
+                    isError: true,
+                });
+                continue;
+            }
             const result = await opts.registry.execute(call.name, call.args, ctx);
             messages.push({
                 role: "tool",