jaitus 0.3.4 → 0.3.5

package/README.md

@@ -94,49 +94,45 @@ changing a file or running a command, showing you exactly what it is about to do
 | `/hooks` | show lifecycle hooks |
 | `/tui [fullscreen\|default]` | switch renderer, relaunching with the conversation intact |
 | `/fork` | copy this conversation into a brand-new session |
-| `/theme [name]` | color theme: dark, light, daltonized, plain, auto |
-| `/scroll-speed [n]` | mouse-wheel speed, 0.25–10 |
+| `/theme [name]` | color theme: dark, light, ocean, daltonized, auto (the default: asks the terminal for its background colour) |
+| `/scroll-speed [n]` | mouse-wheel speed, 0.25–20 |
 | `/agent <task>` | run an isolated read-only side task |
 | `/cwd` | which directory the agent is working in |
 | `/clear` | start the conversation over |
 | `/undo` | drop the last exchange |
 | `/exit` | leave |
 
-Arrow keys, word-delete and history all work — history is kept in `~/.jaitus/history`
-and survives across sessions. Ctrl-C clears the line (or copies the selection,
-or interrupts a running turn) but never exits — only `/exit` leaves.
-
-Enter sends in one press — Tab completes a `/` command or `@` file without
-sending, Esc dismisses the suggestion first. `Ctrl+J`, `Shift+Enter` and
-`\+Enter` insert a newline. Up/Down (or `Ctrl+P`/`Ctrl+N`) moves inside a
-multiline prompt first, then through history. `Ctrl+R` searches history,
-`Shift+Tab` cycles permission modes, `Ctrl+T` shows session activity, `Ctrl+G`
-edits the draft in `$VISUAL`/`$EDITOR`, `Ctrl+S` stashes/recalls the draft,
-`Ctrl+_` undoes, `Ctrl+Y` pastes the last deletion, `Alt+B`/`F`/`D` do word
-jumps/edits, `?` on an empty prompt lists shortcuts. Large pastes collapse to
-`[Pasted text #N]` chips (full text still sends), `Ctrl+V` attaches a clipboard
-image, `:name:` inserts emoji, `! cmd &` or `Ctrl+B` backgrounds a command.
-
-Scrolling stays inside the app (alternate screen): `PgUp` /
-`PgDn` half a screen, `Ctrl+Home` / `Ctrl+End` top / bottom, mouse wheel a few
-lines. Scrolling up pauses auto-follow and shows new-message count — `Ctrl+End`
-or scroll to the bottom resumes. `JAITUS_SCROLL_SPEED` (1–20)
-multiplies wheel distance.
-`Ctrl+O` opens the transcript viewer: `/` searches, `n` / `N` next / previous,
-`j` / `k` lines, `Ctrl+u` / `Ctrl+d` half page, `Ctrl+b` / `Ctrl+f` / `Space`
-full page, `{` / `}` previous / next prompt, `g` / `G` ends, `[` dumps the full
-conversation to native scrollback for `Cmd+F` / tmux copy mode, `v` opens it in
-`$VISUAL` / `$EDITOR`, `q` / `Esc` returns.
-
-Drag selects inside the session and auto-copies on release (double-click word,
-triple-click line, `Shift+arrows` extends, `Ctrl+C` copies when a selection is
-active, `Ctrl+Shift+C` copies manually when auto-copy is off). Clipboard order:
-tmux buffer, `pbcopy` / `wl-copy` / `xclip` / `xsel` / `clip` / PowerShell
-`Set-Clipboard`, then OSC 52 over SSH. `jaitus config copyOnSelect on|off`
-toggles auto-copy. `JAITUS_DISABLE_MOUSE=1`
-keeps flicker-free rendering with native selection; `JAITUS_DISABLE_MOUSE_CLICKS=1`
-keeps wheel scrolling only. Hold `Shift` (`Option` in iTerm2, `Fn` in
-Terminal.app) for one-off native selection.
+Arrow keys, Home/End, `Ctrl+A`/`Ctrl+E`, `Ctrl+W` (delete a word), `Ctrl+U`/`Ctrl+K`
+(delete to the start/end) all work, and the cursor is drawn where you are typing.
+Prompt history is kept in `~/.jaitus/history` and carries over between sessions —
+Up/Down walk it. `Ctrl+C` copies a selection if there is one, otherwise interrupts a
+running turn or clears the line; it never exits — only `/exit` leaves.
+
+Enter sends. `Ctrl+J`, `Alt+Enter`, `Shift+Enter` (where the terminal reports it) and
+`\` then Enter insert a new line. Tab completes a `/` command or `@` file; Esc closes
+the suggestion list first (press Enter again to send what you typed), and twice on an
+empty prompt opens Rewind. `Shift+Tab` cycles permission modes, `Ctrl+P` opens the
+command palette, `Ctrl+L` clears the screen (the conversation stays — `/clear` starts
+over), `Ctrl+D` toggles debug details. `Ctrl+R` searches your past prompts (Enter
+puts the one you pick in the box, unsent); `Ctrl+O` searches the conversation and
+scrolls to the line you pick.
+
+**Pasting.** Right-click or `Ctrl+V` pastes the clipboard; a long paste becomes a
+`[#1 pasted 120 lines]` chip (the full text is sent). **Images:** drag an image file
+onto the terminal, paste a copied screenshot with `Alt+V`, type `/image path.png`, or
+mention `@screenshot.png` — each becomes an `[Image #N]` chip listed under the
+composer. Backspace over a chip removes it; only images whose chip is still in the
+message are sent. Screenshots over 3.5 MB are shrunk automatically.
+
+Scrolling stays inside the app: `PgUp`/`PgDn`, `Ctrl+Home`/`Ctrl+End`, the mouse wheel.
+Scrolling up pauses auto-follow; `Ctrl+End` (or a click in the conversation) returns
+to the live end. Panels (`/diff`, `/tasks`, `/help`) scroll with the arrows, PgUp/PgDn
+and the wheel.
+
+Drag selects and copies on release; double-click selects a word, triple-click a line.
+`jaitus config copyOnSelect off` turns auto-copy off — then `Ctrl+C` copies.
+`JAITUS_DISABLE_MOUSE=1` gives the terminal its own selection back. Hold `Shift`
+(`Option` in iTerm2) for a one-off native selection.
 
 ## Options
 

package/bin/jaitus.js

@@ -1,6 +1,14 @@
 #!/usr/bin/env node
 // The app is imported only after an unfinished update has completed: importing it
 // statically would load a half-installed copy and crash before any check could run.
+// Node 20 is the floor — checked FIRST: loading the app on an older Node crashed in its
+// dependencies before this friendly message could print.
+if (Number(process.versions.node.split('.')[0]) < 20) {
+  process.stderr.write(`jaitus needs Node 20 or newer (you have ${process.versions.node}).
+`);
+  process.exit(1);
+}
+
 import { waitForPendingUpdate } from '../src/pendingUpdate.js';
 
 await waitForPendingUpdate().catch(() => false);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jaitus",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Jaitus — a coding agent in your terminal.",
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "test": "node tests/source-sanity.js && node tests/rules.js && node tests/run.js && node tests/commands.js && node tests/login.js && node tests/session.js && node tests/openUrl.js && node tests/ink-tui.js && node tests/tui-render.js && node tests/mouse-e2e.js && node tests/environment.js && node tests/update.js && node tests/continuation.js && node tests/steps.js && node tests/context-budget.js",
+    "test": "node tests/source-sanity.js && node tests/rules.js && node tests/run.js && node tests/commands.js && node tests/login.js && node tests/session.js && node tests/openUrl.js && node tests/ink-tui.js && node tests/tui-render.js && node tests/mouse-e2e.js && node tests/environment.js && node tests/update.js && node tests/continuation.js && node tests/steps.js && node tests/files.js && node tests/processes.js && node tests/security.js && node tests/context-budget.js",
     "preview": "node scripts/tui-preview.js",
     "prepublishOnly": "npm test"
   },

package/src/agent/loop.js

@@ -35,6 +35,7 @@ import { fromResponse, fromGatewayBody } from '../errors.js';
 
 const MAX_ITERATIONS = 1000;
 const STUCK_REPEATS = 4;
+const POLLING_TOOLS = new Set(['background_read', 'background_list']);
 
 // Room for a long answer or a large file in one reply. The models behind Jaitus reason
 // before they answer, and that reasoning is spent from the same budget — at 8192 a long
@@ -53,6 +54,33 @@ export const CONTINUE_NOTE = 'Your previous reply was cut off before it finished
 // many times before it is reported.
 const NETWORK_RETRIES = 2;
 
+// Gateway answers that mean "not right now", not "no".
+const TRANSIENT_CODES = new Set(['busy', 'unavailable', 'timeout', 'interrupted', 'internal', 'maintenance']);
+const BUSY_RETRIES = 3;
+const MAX_RETRY_WAIT_MS = 30_000;
+
+/** How long to wait before retrying `e`, or null when it must not be retried. */
+export function retryDelay(e, attempt = 0) {
+  const code = e?.code;
+  const hinted = Number(e?.retryAfter) > 0 ? Number(e.retryAfter) * 1000 : null;
+  if (code === 'rate_limited') {
+    // A short window is waited out; a cap that resets in hours is a limit, not a blip.
+    if (hinted == null) return 2000 * (attempt + 1);
+    return hinted <= MAX_RETRY_WAIT_MS ? hinted : null;
+  }
+  if (!TRANSIENT_CODES.has(code) || code === 'internal') return null;
+  return Math.min(MAX_RETRY_WAIT_MS, hinted ?? 1500 * 2 ** attempt);
+}
+
+function sleepUnlessAborted(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) return resolve(false);
+    const t = setTimeout(() => { signal?.removeEventListener?.('abort', onAbort); resolve(true); }, ms);
+    const onAbort = () => { clearTimeout(t); resolve(false); };
+    signal?.addEventListener?.('abort', onAbort, { once: true });
+  });
+}
+
 /** opencode tool icon per tool, muted when done. ASCII twins included. */
 const TOOL_MARKS = {
   run_command: ['$', '$'], read_file: ['→', '>'], read_image: ['→', '>'],
@@ -163,6 +191,67 @@ ${project}
 </${CONTEXT_FILE}>`;
 }
 
+/**
+ * Every earlier image is sent again with every request, and the gateway accepts at most
+ * 10 MB per request — three or four screenshots into a conversation, every turn failed.
+ * The newest images are kept up to IMAGE_BUDGET bytes of base64; older ones are replaced
+ * by a line saying one was there. The history itself is not changed.
+ */
+/**
+ * Make a history well-formed after any interruption: every assistant tool_use has a
+ * tool_result in the next message. A run stopped by Esc, a failed permission prompt or
+ * a gateway error partway through could leave a tool call with no result — and both
+ * provider formats reject that, so every later request in the session failed. Missing
+ * results are filled in as "not run"; an assistant turn that ends the history with tool
+ * calls gets its results appended.
+ */
+export function repairToolPairs(messages) {
+  for (let i = 0; i < messages.length; i++) {
+    const m = messages[i];
+    if (m?.role !== 'assistant' || !Array.isArray(m.content)) continue;
+    const ids = m.content.filter((b) => b?.type === 'tool_use').map((b) => b.id);
+    if (!ids.length) continue;
+    const next = messages[i + 1];
+    const have = new Set(next?.role === 'user' && Array.isArray(next.content)
+      ? next.content.filter((b) => b?.type === 'tool_result').map((b) => b.tool_use_id) : []);
+    const missing = ids.filter((id) => !have.has(id));
+    if (!missing.length) continue;
+    const filled = missing.map((id) => result(id, 'Not run: the task was interrupted before this step.', true));
+    if (next?.role === 'user') {
+      const content = Array.isArray(next.content) ? next.content : [{ type: 'text', text: String(next.content ?? '') }];
+      const results = content.filter((b) => b?.type === 'tool_result');
+      const rest = content.filter((b) => b?.type !== 'tool_result');
+      messages[i + 1] = { ...next, content: [...results, ...filled, ...rest] };
+    } else {
+      messages.splice(i + 1, 0, { role: 'user', content: filled });
+    }
+  }
+  return messages;
+}
+
+export const IMAGE_BUDGET = 6_000_000;
+export function withinImageBudget(messages, budget = IMAGE_BUDGET) {
+  let used = 0;
+  let changed = false;
+  const out = messages.slice();
+  for (let i = out.length - 1; i >= 0; i--) {
+    const m = out[i];
+    if (!Array.isArray(m?.content) || !m.content.some((b) => b?.type === 'image')) continue;
+    // Walk this message's blocks newest-last, so within a message the later images win.
+    const kept = new Array(m.content.length);
+    for (let j = m.content.length - 1; j >= 0; j--) {
+      const b = m.content[j];
+      if (b?.type !== 'image') { kept[j] = b; continue; }
+      const size = String(b.source?.data || '').length;
+      if (used + size <= budget) { used += size; kept[j] = b; continue; }
+      kept[j] = { type: 'text', text: '[An image was attached here earlier; it is no longer included, to keep the request small.]' };
+      changed = true;
+    }
+    out[i] = { ...m, content: kept };
+  }
+  return changed ? out : messages;
+}
+
 /** One streamed request. Returns { content, stopReason, usage }. */
 async function streamTurn({ client, messages, model, system, tools, onText, onToolStart, signal }) {
   const res = await client.messages({
@@ -170,7 +259,7 @@ async function streamTurn({ client, messages, model, system, tools, onText, onTo
     max_tokens: MAX_OUTPUT_TOKENS,
     system: system || SYSTEM_PROMPT,
     tools,
-    messages,
+    messages: withinImageBudget(messages),
     stream: true,
   }, { signal });
 
@@ -274,7 +363,13 @@ async function streamTurn({ client, messages, model, system, tools, onText, onTo
     if (!blocks.size) throw e;
     cut = true;
   }
-  if (streamError) throw streamError;
+  if (streamError) {
+    // The provider dropped out after part of the answer had arrived. What arrived is
+    // kept and continued from, exactly as when OUR connection drops — it used to be
+    // thrown away with a "Something went wrong" and the task stopped.
+    if (blocks.size && TRANSIENT_CODES.has(streamError.code)) cut = true;
+    else throw streamError;
+  }
   if (cut || (!sawStop && !stopReason)) stopReason = 'cut';
 
   const content = [...blocks.entries()]
@@ -312,12 +407,17 @@ export async function runAgent({
   const totals = { input: 0, cached: 0, output: 0, tools: 0, context: 0 };
   // Read once per request, not per turn: an agent that rewrites JAITUS.md mid-task
   // should not change the rules it is being judged by halfway through.
-  const system = `${systemOverride || systemPrompt(cwd)}${extraSystem}`;
+  // The model is told when it is in plan mode — it used to find out only by having its
+  // writes refused, after it had already tried them.
+  const planNote = permissions?.mode === 'plan'
+    ? '\n\nPLAN MODE is on: you can read, list, search and fetch, but nothing you write and no command you run will be carried out. Investigate, then answer with a concrete plan (files, changes, order, risks). The user switches modes when they want it done.'
+    : '';
+  const system = `${systemOverride || systemPrompt(cwd)}${extraSystem}${planNote}`;
   const mcp = await discoverMcpTools(cwd).catch(() => []);
   // Subagents are offered only to the top-level agent. A subagent that can spawn
   // subagents is an unbounded fan-out on a metered gateway, and the depth that would
   // actually help — one — is the depth that is safe.
-  const subagent = subagents ? makeSubagentTool({ client, model, cwd, signal, tui }) : null;
+  const subagent = subagents ? makeSubagentTool({ client, model, cwd, signal, tui, permissions }) : null;
   const availableTools = [
     ...toolSchemas(),
     ...(subagent ? [{ name: subagent.name, description: subagent.description, input_schema: subagent.input_schema }] : []),
@@ -331,6 +431,8 @@ export async function runAgent({
 
   let continuations = 0;
   let networkRetries = 0;
+  let busyRetries = 0;
+  let planNoticeShown = false;
   // True while the previous reply is being continued: its text is still on screen as
   // one live message, and the continuation must extend it rather than start another.
   let continuing = false;
@@ -382,6 +484,21 @@ export async function runAgent({
         iteration -= 1;
         continue;
       }
+      // Busy, rate-limited for a moment, unavailable, timed out: the gateway says to
+      // back off and retry (it sends Retry-After), and nothing used to — one provider 429
+      // ended a task halfway. A limit (plan, free tier, a daily cap hours away) or a
+      // sign-in problem is never retried.
+      const wait = retryDelay(e, busyRetries);
+      if (!(signal?.aborted || e?.name === 'AbortError') && wait != null && busyRetries < BUSY_RETRIES) {
+        busyRetries += 1;
+        const secs = Math.max(1, Math.round(wait / 1000));
+        if (tui?.setStatus) tui.setStatus(`${c.yellow('!')} ${c.dim(`Jaitus is busy — trying again in ${secs}s (${busyRetries} of ${BUSY_RETRIES})`)}`);
+        const ok = await sleepUnlessAborted(wait, signal);
+        tui?.clearStatus?.();
+        if (!ok) return { ...totals, stopReason: 'interrupted' };
+        iteration -= 1;
+        continue;
+      }
       if (signal?.aborted || e?.name === 'AbortError') {
         if (tui) tui.flushStream();
         if (streamed && !silent) out('');
@@ -394,6 +511,14 @@ export async function runAgent({
     }
     spin.stop();
     networkRetries = 0;
+    busyRetries = 0;
+    // A reply the provider's content filter stopped is cut short; say so rather than
+    // letting half an answer pass for the whole one.
+    if (turn.stopReason === 'refusal') {
+      const why = 'The answer was stopped partway by a content filter. Rephrasing the request usually gets past it.';
+      if (tui?.notice) tui.notice(why, 'warn');
+      else if (!silent) out(c.yellow(`  ${why}`));
+    }
     const incomplete = turn.stopReason === 'max_tokens' || turn.stopReason === 'cut';
     // A tool call cut off halfway has JSON that is not whole; it is dropped and the model
     // is asked to make it again.
@@ -445,14 +570,18 @@ export async function runAgent({
 
     // Plan mode: read-only by decree. The turn's text still lands (the model can think
     // out loud), but nothing on disk or in a shell is allowed to happen.
-    const blockedInPlan = permissions.mode === 'plan' && calls.some((call) => toolMap[call.name]?.needsPermission);
-    if (blockedInPlan) {
-      messages.pop();
-      const note = c.yellow(`  ${glyph('⏸', '[II]')}  plan mode — writes and commands are blocked; read-only inspection can continue. Shift+Tab to a doing mode to act.`);
-      if (tui?.notice) tui.notice('plan mode — writes and commands are blocked; read-only inspection can continue. Shift+Tab to a doing mode to act.', 'warn');
-      else if (tui) tui.print(note);
-      else if (!silent) out(note);
-      return { ...totals, stopReason: 'plan_blocked' };
+    // web_fetch is not a write: in plan mode it goes to its own prompt instead of ending the turn.
+    // Plan mode: a write or command gets a "not run — plan instead" result, the reads in
+    // the same batch still run, and the turn — with the plan the model just wrote — stays
+    // in the history. It used to pop the whole turn, so "ok, do it" found no plan to do.
+    const planBlocked = permissions.mode === 'plan'
+      ? new Set(calls.filter((call) => toolMap[call.name]?.needsPermission && !toolMap[call.name]?.network).map((call) => call.id))
+      : new Set();
+    if (planBlocked.size && !planNoticeShown) {
+      planNoticeShown = true;
+      const text = 'Plan mode — writes and commands are not run; the agent can still read. Shift+Tab (or /code) to let it act.';
+      if (tui?.notice) tui.notice(text, 'warn');
+      else if (!silent) out(c.yellow(`  ${glyph('⏸', '[II]')}  ${text}`));
     }
 
     // Esc pressed while the model was mid-turn: stop before any more tools run.
@@ -466,6 +595,9 @@ export async function runAgent({
     // The same call, same input, nothing changed since: STUCK_REPEATS times is a loop.
     // Checked before running, so the repeat that proves it is not paid for again.
     const stuckOn = calls.find((call) => {
+      // Polling is supposed to repeat: background_read's own description says "poll
+      // this", and four polls of a starting dev server are not a loop.
+      if (POLLING_TOOLS.has(call.name)) return false;
       const key = `${changes}\u0000${call.name}\u0000${JSON.stringify(call.input ?? null)}`;
       const n = (repeats.get(key) || 0) + 1;
       repeats.set(key, n);
@@ -490,6 +622,16 @@ export async function runAgent({
       const tool = toolMap[call.name];
       totals.tools += 1;
 
+      // Esc during a batch stops the REST of it. The check used to run once before the
+      // batch, so after Esc the remaining calls still prompted and ran.
+      if (signal?.aborted) {
+        results.push(result(call.id, 'Not run: the user stopped the task.', true));
+        continue;
+      }
+      if (planBlocked.has(call.id)) {
+        results.push(result(call.id, 'Not run: plan mode is on, so nothing is written and no command runs. Finish investigating with read-only tools, then present your plan as your answer — the user will switch modes when they want it carried out.', true));
+        continue;
+      }
       if (!tool) {
         results.push(result(call.id, `No such tool: ${call.name}`, true));
         continue;
@@ -507,7 +649,7 @@ export async function runAgent({
       const row = tui?.tool?.({ name: call.name, label, status: 'waiting', file: call.input?.path });
 
       try {
-        await permissions.request(tool, call.input, { cwd, tui });
+        await permissions.request(tool, call.input, { cwd, tui, signal });
       } catch (e) {
         if (e instanceof PermissionDenied) {
           const declined = `  ${c.red(glyph('✗', 'x'))} ${c.dim('declined')}`;
@@ -517,9 +659,14 @@ export async function runAgent({
           tui?.recordActivity?.({ id: activityId, name: call.name, label, status: 'failed', detail: 'Permission declined by user.' });
           // Told to the model, not just the user: it needs to know to stop trying and
           // propose something else instead. A decision comment rides along verbatim.
-          const note = e.comment
-            ? `The user declined this action with this instruction, which overrides your plan: "${e.comment}". Do not retry the declined action; follow the instruction instead.`
-            : `The user declined this action. Do not retry it; ask what they would prefer.`;
+          // A run that could not ask (one-shot, a script) says so — "the user declined"
+          // was untrue there, and hid the hint about --yes from everyone.
+          if (e.headless) totals.denied = (totals.denied || 0) + 1;
+          const note = e.headless
+            ? `Not permitted in this run: ${e.message} Do not retry it; finish what you can without it and say what was left undone.`
+            : e.comment
+              ? `The user declined this action with this instruction, which overrides your plan: "${e.comment}". Do not retry the declined action; follow the instruction instead.`
+              : `The user declined this action. Do not retry it; ask what they would prefer.`;
           results.push(result(call.id, note, true));
           continue;
         }
@@ -552,7 +699,7 @@ export async function runAgent({
         } else if (journal && call.name === 'run_command') {
           journal.snapshotTracked(cwd);
         }
-        const output = await tool.run(call.input, { cwd });
+        const output = await tool.run(call.input, { cwd, signal });
         spin2.stop(); stopElapsed();
         const took = ((Date.now() - toolStarted) / 1000).toFixed(1);
         // opencode tool icons: $ shell, ← edits, → reads, ✱ search,
@@ -570,9 +717,16 @@ export async function runAgent({
         if (['write_file', 'edit_file'].includes(call.name)) changes += 1;
         // read_image: the pixels ride along as an image block in the tool-result
         // message, so the model actually sees the picture instead of a caption of it.
-        if (call.name === 'read_image' && !silent) {
-          const block = await readImageForModel(cwd, call.input?.path).catch(() => null);
-          if (block) results[results.length - 1] = { ...result(call.id, output, false), __images: [block] };
+        // read_image: the pixels ride along in this message, after the results. When no
+        // image can be attached the call FAILED and says why — it used to report success
+        // either way, and the model then described a picture it never saw.
+        if (call.name === 'read_image') {
+          let block = null;
+          let why = '';
+          try { block = await readImageForModel(cwd, call.input?.path); } catch (e) { why = e.message; }
+          results[results.length - 1] = block
+            ? { ...result(call.id, 'The image is attached to this message, after the tool results.', false), __images: [block] }
+            : result(call.id, why || 'The image could not be attached.', true);
         }
         // todo_write: the checklist is for the human — checkbox cells with progress.
         if (call.name === 'todo_write' && Array.isArray(call.input?.todos)) {
@@ -615,15 +769,19 @@ export async function runAgent({
       }
     }
 
-    // Image blocks ride in the same user message as their tool_result, each following
-    // the result it belongs to — that is the shape the vision API expects.
-    const withImages = [];
+    // Every tool_result first, then any images, in the same user message. Anthropic's
+    // format requires the results to lead the message; an image between two results
+    // (read_image followed by another call in one batch) was a rejected request.
+    const images = [];
     for (const r of results) {
-      withImages.push(r);
-      for (const img of r.__images || []) withImages.push(img);
+      for (const img of r.__images || []) images.push(img);
       delete r.__images;
     }
-    messages.push({ role: 'user', content: withImages });
+    messages.push({ role: 'user', content: [...results, ...images] });
+    if (signal?.aborted) {
+      if (!silent) out(c.yellow(`  ${glyph('⏹', '[x]')}  Interrupted.`));
+      return { ...totals, stopReason: 'interrupted' };
+    }
   }
 
   if (!silent) out(c.yellow(`\nStopped after ${maxIterations} steps — the safety limit for one request. Say "continue" to keep going.`));
@@ -643,7 +801,7 @@ export async function runAgent({
  * write and every shell command is refused no matter what the parent's mode is. A
  * subagent the user never sees must not be able to change the disk.
  */
-function makeSubagentTool({ client, model, cwd, signal, tui }) {
+function makeSubagentTool({ client, model, cwd, signal, tui, permissions = null }) {
   return {
     name: 'task',
     needsPermission: false,
@@ -670,7 +828,7 @@ function makeSubagentTool({ client, model, cwd, signal, tui }) {
         messages,
         model,
         cwd: runCwd || cwd,
-        permissions: createPermissions({ mode: 'plan' }),
+        permissions: permissions?.fork ? permissions.fork({ mode: 'plan', interactive: false }) : createPermissions({ mode: 'plan', interactive: false }),
         signal,
         tui: null,
         silent: true,

package/src/agent/permissions.js

@@ -32,7 +32,7 @@ const TOOL_ICONS = {
 
 export function createPermissions({
   autoApprove = false, mode = 'default', onModeChange = null,
-  allow = [], deny = [], onRulesChange = null,
+  allow = [], deny = [], onRulesChange = null, interactive = true,
 } = {}) {
   let current = autoApprove ? 'bypassPermissions' : (MODES.includes(mode) ? mode : mode === 'auto' ? 'bypassPermissions' : 'default');
   // Session rules live beside the saved ones and are never written to disk: "allow for
@@ -62,8 +62,23 @@ export function createPermissions({
     },
 
     /** What the rules say about this call, without asking. */
-    verdict(toolName, input) {
-      return decide({ allow: [...savedAllow, ...sessionAllow], deny: savedDeny }, toolName, input);
+    verdict(toolName, input, cwd = null) {
+      return decide({ allow: [...savedAllow, ...sessionAllow], deny: savedDeny }, toolName, input, { cwd });
+    },
+
+    /**
+     * The same rules, a different mode — for subagents and side commands (/review --fix,
+     * /btw, /test --fix). Those used to build fresh permissions with no user rules at
+     * all, so `deny run_command(git push:*)` did not apply inside them.
+     */
+    fork({ mode: nextMode = current, interactive: canAsk = interactive, allow: extraAllow = [] } = {}) {
+      return createPermissions({
+        mode: nextMode,
+        interactive: canAsk,
+        // Extra rules for this run only — /research allows web_fetch for itself.
+        allow: [...savedAllow, ...sessionAllow, ...extraAllow],
+        deny: savedDeny.filter((r) => !DEFAULT_DENY.includes(r)),
+      });
     },
 
     setMode(next) {
@@ -82,11 +97,11 @@ export function createPermissions({
     /**
      * @returns true to proceed. Throws PermissionDenied if the user says no.
      */
-    async request(tool, input, { cwd, tui = null } = {}) {
+    async request(tool, input, { cwd, tui = null, signal = null } = {}) {
       // A deny rule outranks everything, including bypass. Someone who wrote
       // `deny: ["run_command(git push:*)"]` and then turned on bypass to get through a
       // long refactor did not mean "except that one".
-      const verdict = api.verdict(tool.name, input);
+      const verdict = api.verdict(tool.name, input, cwd);
       if (verdict === 'deny') {
         throw new PermissionDenied(
           `A deny rule blocks ${tool.name}${subjectOf(tool.name, input) ? `: ${subjectOf(tool.name, input).slice(0, 80)}` : ''}. `
@@ -100,12 +115,17 @@ export function createPermissions({
 
       // Not a terminal — a script cannot answer, and silently proceeding would be the
       // worst possible reading of "no answer". In plan mode the same wall is the point.
-      if (!process.stdin.isTTY) {
-        throw new PermissionDenied(
+      // One-shot runs (-p, a task on the command line) are this case too even in a
+      // terminal: a prompt there wrote to stdout — into --output-format json — and waited
+      // for a key nobody saw.
+      if (!process.stdin.isTTY || !interactive) {
+        const err = new PermissionDenied(
           current === 'plan'
             ? 'Plan mode blocks every write and command. Shift+Tab out of plan mode, or run it with a mode that acts.'
-            : `${tool.name} needs permission, but there is no terminal to ask. Re-run with --yes to allow it.`
+            : `${tool.name} needs permission, and this run cannot ask. Re-run with --yes, or --permission-mode acceptEdits for file edits only.`
         );
+        err.headless = true;
+        throw err;
       }
 
       // Inside the TUI the ask is an inline panel pinned above the prompt
@@ -133,6 +153,7 @@ export function createPermissions({
           pills: true,
           title: 'Permission',
           tone: tool.name === 'run_command' ? 'danger' : undefined,
+          signal,
         });
         const value = answer && typeof answer === 'object' ? answer.value : answer;
         const comment = (answer?.comment || '').trim();
@@ -151,14 +172,16 @@ export function createPermissions({
 
       out(`  ${c.dim(`always → adds the rule ${c.bold(exact)}`)}`);
       const answer = await askKey(
-        `  ${c.dim('[y] Allow once   [s] this session   [a] always   [n] Reject  ›')} `,
+        `  ${c.dim('[y] Allow once   [s] this session   [a] always   [n] Reject (Enter)  ›')} `,
         ['y', 's', 'a', 'n', '\r']
       );
       out('');
 
       if (answer === 's') { api.addRule(exact); return true; }
       if (answer === 'a') { api.addRule(exact, { persist: true }); return true; }
-      if (answer === 'y' || answer === '\r') return true;
+      // Enter is the safe answer. It used to be "Allow once" — one stray key approved a
+      // command nobody had read.
+      if (answer === 'y') return true;
       throw new PermissionDenied(`You declined: ${tool.name}`);
     },
   };
@@ -176,13 +199,23 @@ function describeRule(rule) {
 /** The whole tool call as plain lines, for the TUI permission dialog. */
 function previewTextOf(tool, input) {
   const lines = [];
-  if (tool.name === 'run_command') lines.push(`$ ${input.command}`);
-  else if (tool.name === 'write_file') lines.push(...String(input.content ?? '').split('\n').slice(0, 12));
-  else if (tool.name === 'edit_file') {
-    for (const l of String(input.old ?? '').split('\n').slice(0, 6)) lines.push(`- ${l}`);
-    for (const l of String(input.new ?? '').split('\n').slice(0, 6)) lines.push(`+ ${l}`);
-  } else lines.push(JSON.stringify(input).slice(0, 200));
-  return lines.slice(0, 12);
+  const more = (all, shown) => (all > shown ? [`… ${all - shown} more line${all - shown === 1 ? '' : 's'}`] : []);
+  // A command is shown WHOLE — every line of it (the dialog wraps and, if it must, shows
+  // the start and the end). Content previews are samples, and say how much is left out.
+  if (tool.name === 'run_command' || tool.name === 'background_run') lines.push(...`$ ${input.command}`.split('\n'));
+  else if (tool.name === 'write_file') {
+    const all = String(input.content ?? '').split('\n');
+    lines.push(...all.slice(0, 12), ...more(all.length, 12));
+  } else if (tool.name === 'edit_file') {
+    const olds = String(input.old ?? '').split('\n');
+    const news = String(input.new ?? '').split('\n');
+    for (const l of olds.slice(0, 6)) lines.push(`- ${l}`);
+    lines.push(...more(olds.length, 6).map((l) => `- ${l}`));
+    for (const l of news.slice(0, 6)) lines.push(`+ ${l}`);
+    lines.push(...more(news.length, 6).map((l) => `+ ${l}`));
+  } else if (tool.name === 'web_fetch') lines.push(String(input.url ?? ''));
+  else lines.push(JSON.stringify(input).slice(0, 400));
+  return lines;
 }
 
 function describe(tool, input, cwd) {