jeopi-cli 16.2.22 → 16.2.24

package/dist/types/advisor/runtime.d.ts

@@ -47,14 +47,22 @@ export interface AdvisorRuntimeHost {
     beginAdvisorUpdate?(): void;
     /** Surface a non-recovering advisor failure to the host UI without adding model-visible context. */
     notifyFailure?(error: unknown): void;
+    /** Surface a one-time notice that thinking was stripped from advisor renders after a provider refusal. */
+    notifyThinkingStripped?(): void;
 }
+/** Construction-time tuning for {@link AdvisorRuntime}. */
+export interface AdvisorRuntimeOptions {
+    /** Render the primary's thinking blocks into advisor deltas (default true). */
+    includeThinking?: boolean;
+}
+export declare function isRefusalError(error: unknown): boolean;
 export declare class AdvisorRuntime {
     #private;
     private readonly agent;
     private readonly host;
     private readonly retryDelayMs;
     disposed: boolean;
-    constructor(agent: AdvisorAgent, host: AdvisorRuntimeHost, retryDelayMs?: number);
+    constructor(agent: AdvisorAgent, host: AdvisorRuntimeHost, retryDelayMs?: number, options?: AdvisorRuntimeOptions);
     get backlog(): number;
     onTurnEnd(messages?: AgentMessage[]): void;
     waitForCatchup(maxMs: number, threshold: number, signal?: AbortSignal): Promise<void>;

package/dist/types/cli/update-cli.d.ts

@@ -64,6 +64,43 @@ export declare function getLatestRelease(): Promise<ReleaseInfo>;
  * registries resolve to `undefined` so startup never blocks on the check.
  */
 export declare function fetchNewerPublishedVersion(currentVersion: string): Promise<string | undefined>;
+/** Minimal published GitHub release shape used by the update-notes and registry-lag helpers. */
+export interface GitHubReleaseSummary {
+    version: string;
+    body: string;
+}
+/**
+ * Parse a GitHub releases API response into {@link GitHubReleaseSummary}
+ * entries, keeping only published (non-draft, non-prerelease) releases whose
+ * tag matches the `vX.Y.Z` convention. Split out from {@link fetchGitHubReleases}
+ * so the response-shape handling is independently testable without a network
+ * call.
+ */
+export declare function parseGitHubReleases(data: unknown): GitHubReleaseSummary[];
+/**
+ * Collect release-note bodies for versions in `(currentVersion, targetVersion]`,
+ * newest first. Backs the "what changed" block `jeopi update` prints under the
+ * "New version available" line, so a user several versions behind sees every
+ * intervening release, not just the newest body.
+ */
+export declare function selectReleaseNotesInRange(releases: readonly GitHubReleaseSummary[], currentVersion: string, targetVersion: string): GitHubReleaseSummary[];
+/**
+ * Render selected release notes as plain indented text, capped at `maxLines`.
+ * HTML comments (release template scaffolding) are stripped; a truncated
+ * rendering ends with a pointer at the releases page.
+ */
+export declare function formatReleaseNotes(notes: readonly GitHubReleaseSummary[], maxLines?: number): string;
+/**
+ * Detect a published GitHub release the npm registry has not served yet.
+ *
+ * When the release pipeline dies between the GitHub Release and the npm
+ * publish job (or npm credentials are missing so the publish silently
+ * no-ops), the npm `latest` this updater trusts stays behind while GitHub
+ * advances — and `jeopi update` would report "Already up to date" with no
+ * hint that a newer release exists. Returns the newest GitHub version
+ * strictly above `npmVersion`, else `undefined`.
+ */
+export declare function detectRegistryLag(npmVersion: string, releases: readonly GitHubReleaseSummary[]): string | undefined;
 interface BunInstallCachePruneResult {
     scannedPackages: number;
     removedEntries: number;

package/dist/types/config/settings-schema.d.ts

@@ -187,6 +187,17 @@ export declare const SETTINGS_SCHEMA: {
             readonly condition: "advisorEnabled";
         };
     };
+    readonly "advisor.includeThinking": {
+        readonly type: "boolean";
+        readonly default: true;
+        readonly ui: {
+            readonly tab: "model";
+            readonly group: "Advisor";
+            readonly label: "Advisor Sees Thinking";
+            readonly description: "Include the primary agent's thinking blocks in advisor transcript updates. Some provider classifiers (e.g. Anthropic's reasoning_extraction) refuse payloads that replay thinking as text; the advisor also auto-disables this for the session after such a refusal.";
+            readonly condition: "advisorEnabled";
+        };
+    };
     readonly "advisor.syncBacklog": {
         readonly type: "enum";
         readonly values: readonly ["off", "1", "3", "5"];
@@ -1602,7 +1613,7 @@ export declare const SETTINGS_SCHEMA: {
             readonly tab: "interaction";
             readonly group: "Startup & Updates";
             readonly label: "Check for Updates";
-            readonly description: "Check for jeopi updates on startup";
+            readonly description: "Check for jeopi updates on startup and periodically during long sessions";
         };
     };
     readonly "marketplace.autoUpdate": {

package/dist/types/extensibility/plugins/loader.d.ts

@@ -37,19 +37,19 @@ export declare function resolvePluginHookPaths(plugin: InstalledPlugin): string[
 export declare function resolvePluginCommandPaths(plugin: InstalledPlugin): string[];
 export declare function resolvePluginExtensionPaths(plugin: InstalledPlugin): string[];
 /**
- * Get all tool paths from all enabled plugins.
+ * Get all tool paths from all enabled *and trusted* plugins.
  */
 export declare function getAllPluginToolPaths(cwd: string): Promise<string[]>;
 /**
- * Get all hook paths from all enabled plugins.
+ * Get all hook paths from all enabled *and trusted* plugins.
  */
 export declare function getAllPluginHookPaths(cwd: string): Promise<string[]>;
 /**
- * Get all command paths from all enabled plugins.
+ * Get all command paths from all enabled *and trusted* plugins.
  */
 export declare function getAllPluginCommandPaths(cwd: string): Promise<string[]>;
 /**
- * Get all extension module paths from all enabled plugins.
+ * Get all extension module paths from all enabled *and trusted* plugins.
  */
 export declare function getAllPluginExtensionPaths(cwd: string): Promise<string[]>;
 /**

package/dist/types/extensibility/plugins/trust.d.ts

@@ -0,0 +1,30 @@
+export type PluginTrustDecision = "granted" | "denied";
+/**
+ * Resolver for "do you trust this plugin?" consent.
+ *
+ * Return values mirror {@link import("../../tools/report-tool-issue").AutoQaConsentHandler}:
+ *   - `true`  — trusted; load for this run and persist.
+ *   - `false` — untrusted; skip for this run and persist.
+ *   - `null`  — dismissed without a decision; skip this run only, re-prompt next time.
+ */
+export type PluginTrustHandler = (plugin: {
+    name: string;
+    version: string;
+}) => Promise<boolean | null>;
+export declare function pluginTrustKey(plugin: {
+    name: string;
+    version: string;
+}): string;
+/** Register the interactive trust-prompt handler. Passing `null` clears it (teardown). */
+export declare function setPluginTrustHandler(handler: PluginTrustHandler | null): void;
+/** Test-only: reset all in-memory trust state. Never call from production code. */
+export declare function __resetPluginTrustForTests(): void;
+/**
+ * Resolve whether `plugin` is trusted to load. Never throws — handler errors
+ * degrade to "denied for this call" without caching, so a later invocation
+ * (e.g. after the user fixes their terminal) can re-prompt.
+ */
+export declare function resolvePluginTrust(plugin: {
+    name: string;
+    version: string;
+}): Promise<boolean>;

package/dist/types/goals/completion-evidence.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Validation for the `evidence` argument the `complete` goal-tool op requires.
+ *
+ * Code-level counterpart to the prompt rule ("call `complete` only when the goal is
+ * actually done and verified" — `prompts/tools/goal.md`, `goal-continuation.md`).
+ * Before this, "call complete" was pure self-attestation: a model under budget
+ * pressure or scope-shrink temptation could close a goal with zero code-level
+ * friction. This does not (cannot) verify the claim is *true* — that still requires
+ * the model to have actually checked the repo state — but it forces the model to
+ * commit to a specific, non-trivial claim that a human reviewing the transcript can
+ * hold it to, and it rejects the exact rubber-stamp phrases the prompt already
+ * tells the model never to use as a reason to complete.
+ */
+/** Below this length, evidence can't meaningfully describe what was verified. */
+export declare const MIN_COMPLETION_EVIDENCE_LENGTH = 15;
+/**
+ * Validate that `evidence` is a substantive, non-generic completion claim.
+ * Returns the trimmed evidence on success; throws a plain `Error` describing
+ * what's missing otherwise (callers map this to their own error type).
+ */
+export declare function assertSubstantiveCompletionEvidence(evidence: string | undefined): string;

package/dist/types/goals/runtime.d.ts

@@ -63,7 +63,7 @@ export declare class GoalRuntime {
     resumeGoal(): Promise<GoalModeState>;
     pauseGoal(): Promise<GoalModeState | undefined>;
     dropGoal(): Promise<Goal | undefined>;
-    completeGoalFromTool(): Promise<Goal>;
+    completeGoalFromTool(evidence: string): Promise<Goal>;
     buildActivePrompt(): string | undefined;
     buildContinuationPrompt(): string | undefined;
 }

package/dist/types/goals/state.d.ts

@@ -9,6 +9,9 @@ export interface Goal {
     timeUsedSeconds: number;
     createdAt: number;
     updatedAt: number;
+    /** Set only when status transitions to "complete"; the caller's verification claim
+     * (see `goals/completion-evidence.ts`). Absent for goals that never completed. */
+    completionEvidence?: string;
 }
 export interface GoalModeState {
     enabled: boolean;

package/dist/types/goals/tools/goal-tool.d.ts

@@ -8,6 +8,7 @@ declare const goalSchema: import("arktype/internal/variants/object.ts").ObjectTy
     op: "complete" | "create" | "drop" | "get" | "resume";
     objective?: string | undefined;
     token_budget?: number | undefined;
+    evidence?: string | undefined;
 }, {}>;
 export type GoalToolInput = typeof goalSchema.infer;
 export interface GoalToolResponse {
@@ -27,6 +28,7 @@ export declare class GoalTool implements AgentTool<typeof goalSchema, GoalToolDe
         op: "complete" | "create" | "drop" | "get" | "resume";
         objective?: string | undefined;
         token_budget?: number | undefined;
+        evidence?: string | undefined;
     }, {}>;
     readonly strict = true;
     readonly intent: "omit";

package/dist/types/main.d.ts

@@ -12,6 +12,26 @@ import { type SessionInfo } from "./session/session-listing";
 import { SessionManager } from "./session/session-manager";
 type RunAcpMode = (createSession: AcpSessionFactory) => Promise<never>;
 export declare function writeStartupNotice(parsedArgs: Pick<Args, "mode">, text: string): void;
+/**
+ * How often a long-running interactive session rechecks the registry after the
+ * initial startup check. A session started before a release ships never
+ * re-queries on its own otherwise — `checkForNewVersion` only ever ran once at
+ * launch, so the "Update Available" banner stayed invisible until the user
+ * restarted, even hours into a session with a newer version already published.
+ */
+export declare const VERSION_RECHECK_INTERVAL_MS: number;
+/**
+ * Show the update banner exactly once per newer version — `lastNotified` is
+ * the version already surfaced (or the running version, before any notice),
+ * so a recheck that still resolves to the same newer version does not
+ * re-post the banner every interval tick. Returns the version to remember as
+ * `lastNotified` for the next call.
+ *
+ * Re-checks `startup.checkUpdate` at call time (not just inside
+ * `checkForNewVersion`): `/settings` can disable update checks while an
+ * in-flight fetch's promise was still pending.
+ */
+export declare function notifyIfNewerVersion(mode: Pick<InteractiveMode, "showNewVersionNotification">, newVersion: string | undefined, lastNotified: string): string;
 export interface InteractiveModeNotify {
     kind: "warn" | "error" | "info";
     message: string;

package/dist/types/mnemopi/state.d.ts

@@ -127,4 +127,5 @@ export declare class MnemopiSessionState {
 }
 export declare function getMnemopiScopedDbPaths(config: MnemopiBackendConfig): readonly string[];
 export declare function getMnemopiScopedBanks(config: MnemopiBackendConfig): readonly string[];
+export declare function formatRecallBlock(results: RecallResult[]): string;
 export {};

package/dist/types/session/agent-session.d.ts

@@ -42,7 +42,7 @@ import { type IrcMessage } from "../irc/bus";
 import { type MnemopiSessionState } from "../mnemopi/state";
 import type { PlanModeState } from "../plan-mode/state";
 import { type SecretObfuscator } from "../secrets/obfuscator";
-import type { CriticGateState } from "../task/critic-gate";
+import type { ApprovedPlanHash, CriticGateState } from "../task/critic-gate";
 import { type ConfiguredThinkingLevel } from "../thinking";
 import { type DiscoverableTool, type DiscoverableToolSearchIndex } from "../tool-discovery/tool-index";
 import type { CheckpointState, CompletedRewindState } from "../tools/checkpoint";
@@ -710,6 +710,8 @@ export declare class AgentSession {
     setPlanModeState(state: PlanModeState | undefined): void;
     getCriticGateState(): CriticGateState | undefined;
     setCriticGateState(state: CriticGateState | undefined): void;
+    getApprovedPlanHash(): ApprovedPlanHash | undefined;
+    setApprovedPlanHash(hash: ApprovedPlanHash | undefined): void;
     getGoalModeState(): GoalModeState | undefined;
     setGoalModeState(state: GoalModeState | undefined): void;
     get goalRuntime(): GoalRuntime;

package/dist/types/task/critic-gate.d.ts

@@ -22,6 +22,15 @@
  * input, even re-submitting to `critic` is refused — the agent must stop and
  * report the surviving gaps instead of burning tokens on convergence-free
  * re-planning.
+ *
+ * `okay` clearing the gate is not the whole story: nothing previously stopped
+ * the plan file from being edited *after* the critic approved it and *before*
+ * a non-read-only agent executes it (a TOCTOU window — jeo-code closes the
+ * same gap with a `sha256(planContent) === consensus_hash` pin in
+ * `team.ts`/`approve.ts`). {@link ApprovedPlanHash} / {@link hashPlanContent} /
+ * {@link planIntegrityMismatchMessage} port that pin: the caller records the
+ * approved plan's hash when a verdict resolves `okay`, and re-checks it
+ * immediately before spawning a non-read-only agent.
  */
 /** Agent name whose structured verdicts drive the gate. */
 export declare const CRITIC_AGENT_NAME = "critic";
@@ -74,3 +83,28 @@ export declare function evaluateCriticGateSpawn(state: CriticGateState | undefin
  * check that before invoking this.
  */
 export declare function criticGateWriteMessage(state: CriticGateState): string;
+/** Canonical `local://` path for the plan the `/jeo` workflow gates on (see `prompts/agents/jeo.md`). */
+export declare const GATED_PLAN_LOCAL_URL = "local://jeo-plan.md";
+/** Hash of the plan content a critic verdict of `okay` approved, so a later
+ *  spawn gate can detect the plan changing out from under an already-`okay`
+ *  verdict. Held by the parent session alongside (but independent of)
+ *  {@link CriticGateState} — it survives the gate clearing on `okay`, which is
+ *  exactly when it starts mattering. */
+export interface ApprovedPlanHash {
+    /** sha256 hex digest of the plan content at the moment of the `okay` verdict. */
+    hash: string;
+    /** Agent id of the critic run that approved this content. */
+    agentId: string;
+    /** Epoch ms when the verdict was recorded. */
+    at: number;
+}
+/** Stable hash of plan content for {@link ApprovedPlanHash} pinning. Not a
+ *  cryptographic integrity boundary (the model can read its own hash target) —
+ *  it exists to catch accidental or incidental drift between critic approval
+ *  and execution, the same threat model as jeo-code's `consensus_hash`. */
+export declare function hashPlanContent(content: string): string;
+/**
+ * Error text for a non-read-only spawn attempted when the plan content no
+ * longer matches what the critic approved (edited after `okay`, or deleted).
+ */
+export declare function planIntegrityMismatchMessage(approved: ApprovedPlanHash): string;

package/dist/types/tools/builtin-names.d.ts

@@ -1,4 +1,4 @@
-export declare const BUILTIN_TOOL_NAMES: readonly ["read", "bash", "edit", "ast_grep", "ast_edit", "ask", "debug", "eval", "ssh", "github", "glob", "grep", "lsp", "inspect_image", "browser", "checkpoint", "rewind", "task", "job", "irc", "todo", "web_search", "search_tool_bm25", "write", "memory_edit", "retain", "recall", "reflect", "learn", "manage_skill"];
+export declare const BUILTIN_TOOL_NAMES: readonly ["read", "bash", "edit", "ast_grep", "ast_edit", "ask", "debug", "eval", "ssh", "github", "glob", "grep", "lsp", "inspect_image", "browser", "checkpoint", "rewind", "task", "job", "irc", "subagent", "todo", "web_search", "search_tool_bm25", "write", "memory_edit", "retain", "recall", "reflect", "learn", "manage_skill"];
 export type BuiltinToolName = (typeof BUILTIN_TOOL_NAMES)[number];
 /** Return the canonical tool name for current and legacy built-in tool IDs. */
 export declare function normalizeToolName(name: string): string;

package/dist/types/tools/index.d.ts

@@ -19,7 +19,7 @@ import type { ClientBridge } from "../session/client-bridge";
 import type { CustomMessage } from "../session/messages";
 import type { UsageStatistics } from "../session/session-entries";
 import type { ToolChoiceQueue } from "../session/tool-choice-queue";
-import type { CriticGateState } from "../task/critic-gate";
+import type { ApprovedPlanHash, CriticGateState } from "../task/critic-gate";
 import type { AgentOutputManager } from "../task/output-manager";
 import type { DiscoverableTool, DiscoverableToolSearchIndex } from "../tool-discovery/tool-index";
 import type { EventBus } from "../utils/event-bus";
@@ -61,6 +61,7 @@ export * from "./resolve";
 export * from "./review";
 export * from "./search-tool-bm25";
 export * from "./ssh";
+export * from "./subagent";
 export * from "./todo";
 export * from "./tts";
 export * from "./write";
@@ -229,6 +230,10 @@ export interface ToolSession {
     getCriticGateState?: () => CriticGateState | undefined;
     /** Replace the critic gate state (undefined clears the gate). */
     setCriticGateState?: (state: CriticGateState | undefined) => void;
+    /** Plan content hash a critic verdict of `okay` approved (see `task/critic-gate.ts`); survives the gate clearing on `okay` so a later spawn can detect post-approval plan drift. */
+    getApprovedPlanHash?: () => ApprovedPlanHash | undefined;
+    /** Replace the approved-plan hash (undefined clears it). */
+    setApprovedPlanHash?: (hash: ApprovedPlanHash | undefined) => void;
     /** Goal mode state (if active or paused) */
     getGoalModeState?: () => GoalModeState | undefined;
     /** Goal runtime for the active agent session. */

package/dist/types/tools/subagent.d.ts

@@ -0,0 +1,70 @@
+import type { AgentTool, AgentToolContext, AgentToolResult, AgentToolUpdateCallback } from "jeopi-agent-core";
+import type { ToolSession } from "./index";
+import { isIrcEnabled } from "./irc";
+/** Same audience as `irc`: a subagent always has peers; a top-level session has peers only if it can still spawn via `task`. */
+export declare const isSubagentToolEnabled: typeof isIrcEnabled;
+declare const subagentSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    action: "await" | "cancel" | "inspect" | "list" | "pause" | "resume" | "steer";
+    id?: string | undefined;
+    ids?: string[] | undefined;
+    limit?: number | undefined;
+    verbosity?: "full" | "preview" | "receipt" | undefined;
+    message?: string | undefined;
+    pause?: boolean | undefined;
+    timeout_ms?: number | undefined;
+}, {}>;
+type SubagentParams = typeof subagentSchema.infer;
+export type SubagentStatus = "queued" | "running" | "paused" | "completed" | "failed" | "cancelled" | "not_found";
+export interface SubagentSnapshot {
+    id: string;
+    status: SubagentStatus;
+    /** True when the underlying agent session is still resident (idle/parked) and addressable via a follow-up `resume`/`steer`. */
+    resumable: boolean;
+    label: string;
+    durationMs: number;
+    displayName?: string;
+    activity?: string;
+    resultText?: string;
+    errorText?: string;
+}
+export interface SubagentToolDetails {
+    action: SubagentParams["action"];
+    subagents: SubagentSnapshot[];
+    /** Present when `limit` truncated the result set. */
+    truncated?: number;
+    cancelled?: {
+        id: string;
+        status: "cancelled" | "not_found" | "already_completed";
+    }[];
+    receipt?: {
+        to: string;
+        outcome: "injected" | "woken" | "revived" | "failed";
+        error?: string;
+    };
+}
+export declare class SubagentTool implements AgentTool<typeof subagentSchema, SubagentToolDetails> {
+    #private;
+    private readonly session;
+    readonly name = "subagent";
+    readonly approval: "read";
+    readonly label = "Subagent";
+    readonly summary = "List, inspect, await, cancel, pause, resume, and steer background task subagents";
+    readonly description: string;
+    readonly parameters: import("arktype/internal/variants/object.ts").ObjectType<{
+        action: "await" | "cancel" | "inspect" | "list" | "pause" | "resume" | "steer";
+        id?: string | undefined;
+        ids?: string[] | undefined;
+        limit?: number | undefined;
+        verbosity?: "full" | "preview" | "receipt" | undefined;
+        message?: string | undefined;
+        pause?: boolean | undefined;
+        timeout_ms?: number | undefined;
+    }, {}>;
+    readonly strict = true;
+    readonly interruptible = true;
+    readonly loadMode = "discoverable";
+    constructor(session: ToolSession);
+    static createIf(session: ToolSession): SubagentTool | null;
+    execute(_toolCallId: string, params: SubagentParams, signal?: AbortSignal, onUpdate?: AgentToolUpdateCallback<SubagentToolDetails>, _context?: AgentToolContext): Promise<AgentToolResult<SubagentToolDetails>>;
+}
+export {};

package/dist/types/tools/subagent.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "jeopi-cli",
-	"version": "16.2.22",
+	"version": "16.2.24",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/akillness/jeopi",
 	"author": "Can Boluk",
@@ -56,17 +56,17 @@
 		"@agentclientprotocol/sdk": "0.25.0",
 		"@babel/parser": "^7.29.7",
 		"@mozilla/readability": "^0.6.0",
-		"jeopi-hashline": "16.2.22",
-		"jeopi-stats": "16.2.22",
-		"jeopi-agent-core": "16.2.22",
-		"jeopi-ai": "16.2.22",
-		"jeopi-catalog": "16.2.22",
-		"jeopi-mnemopi": "16.2.22",
-		"jeopi-natives": "16.2.22",
-		"jeopi-tui": "16.2.22",
-		"jeopi-utils": "16.2.22",
-		"jeopi-wire": "16.2.22",
-		"jeopi-snapcompact": "16.2.22",
+		"jeopi-hashline": "16.2.24",
+		"jeopi-stats": "16.2.24",
+		"jeopi-agent-core": "16.2.24",
+		"jeopi-ai": "16.2.24",
+		"jeopi-catalog": "16.2.24",
+		"jeopi-mnemopi": "16.2.24",
+		"jeopi-natives": "16.2.24",
+		"jeopi-tui": "16.2.24",
+		"jeopi-utils": "16.2.24",
+		"jeopi-wire": "16.2.24",
+		"jeopi-snapcompact": "16.2.24",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/context-async-hooks": "^2.7.1",
 		"@opentelemetry/exporter-trace-otlp-proto": "^0.218.0",

package/src/advisor/__tests__/advisor.test.ts

@@ -26,6 +26,7 @@ import {
 	isAdvisorInterruptImmuneTurnActive,
 	isAdvisorTranscriptName,
 	isInterruptingSeverity,
+	isRefusalError,
 	resolveAdvisorDeliveryChannel,
 	type WatchdogConfigDoc,
 } from "..";
@@ -1312,6 +1313,178 @@ describe("advisor", () => {
 			expect(state.messages).toHaveLength(2);
 		});
 
+		it("strips thinking and retries once when the provider refuses the payload (reasoning_extraction)", async () => {
+			const promptInputs: string[] = [];
+			const strippedNotices: number[] = [];
+			let refuseNext = true;
+			const agent: AdvisorAgent = {
+				prompt: async input => {
+					promptInputs.push(input);
+					if (refuseNext) {
+						refuseNext = false;
+						throw new Error(
+							"Refusal (reasoning_extraction): This request was blocked as it seems to violate Anthropic's Terms of Service restrictions on reverse engineering or duplicating model outputs.",
+						);
+					}
+				},
+				abort: () => {},
+				reset: () => {},
+				state: { messages: [] },
+			};
+			const thinking = "secret chain of thought the classifier flags";
+			const messages: AgentMessage[] = [
+				{ role: "user", content: "do the thing", timestamp: 1 } as AgentMessage,
+				{
+					role: "assistant",
+					content: [
+						{ type: "thinking", thinking },
+						{ type: "text", text: "done" },
+					],
+					timestamp: 2,
+				} as AgentMessage,
+			];
+			const host: AdvisorRuntimeHost = {
+				snapshotMessages: () => messages,
+				enqueueAdvice: () => {},
+				notifyThinkingStripped: () => strippedNotices.push(1),
+			};
+			const runtime = new AdvisorRuntime(agent, host, 0);
+
+			runtime.onTurnEnd(messages);
+			await Bun.sleep(0);
+			await Bun.sleep(0);
+
+			// First attempt carried thinking; the refusal triggered exactly one
+			// stripped re-render instead of a blind identical retry.
+			expect(promptInputs).toHaveLength(2);
+			expect(promptInputs[0]).toContain("_thinking:_");
+			expect(promptInputs[0]).toContain(thinking);
+			expect(promptInputs[1]).not.toContain("_thinking:_");
+			expect(promptInputs[1]).not.toContain(thinking);
+			expect(promptInputs[1]).toContain("done");
+			expect(strippedNotices).toHaveLength(1);
+			expect(runtime.backlog).toBe(0);
+
+			// Thinking stays latched off for subsequent turns.
+			messages.push({
+				role: "assistant",
+				content: [
+					{ type: "thinking", thinking: "later thoughts" },
+					{ type: "text", text: "next" },
+				],
+				timestamp: 3,
+			} as AgentMessage);
+			runtime.onTurnEnd(messages);
+			await Bun.sleep(0);
+			expect(promptInputs).toHaveLength(3);
+			expect(promptInputs[2]).not.toContain("later thoughts");
+			expect(strippedNotices).toHaveLength(1);
+		});
+
+		it("skips the degrade path when thinking is disabled at construction and falls through to the watchdog", async () => {
+			const promptInputs: string[] = [];
+			const strippedNotices: number[] = [];
+			const failures: unknown[] = [];
+			const agent: AdvisorAgent = {
+				prompt: async input => {
+					promptInputs.push(input);
+					throw new Error("Refusal (reasoning_extraction): blocked");
+				},
+				abort: () => {},
+				reset: () => {},
+				state: { messages: [] },
+			};
+			const messages: AgentMessage[] = [
+				{ role: "user", content: "start", timestamp: 1 } as AgentMessage,
+				{
+					role: "assistant",
+					content: [
+						{ type: "thinking", thinking: "hidden reasoning" },
+						{ type: "text", text: "visible" },
+					],
+					timestamp: 2,
+				} as AgentMessage,
+			];
+			const host: AdvisorRuntimeHost = {
+				snapshotMessages: () => messages,
+				enqueueAdvice: () => {},
+				notifyFailure: error => failures.push(error),
+				notifyThinkingStripped: () => strippedNotices.push(1),
+			};
+			const runtime = new AdvisorRuntime(agent, host, 0, { includeThinking: false });
+
+			runtime.onTurnEnd(messages);
+			await Bun.sleep(0);
+			await Bun.sleep(0);
+			await Bun.sleep(0);
+
+			// Thinking never rendered, so there is nothing to strip: the refusal is
+			// handled by the normal 3-strike watchdog, not an infinite degrade loop.
+			expect(promptInputs).toHaveLength(3);
+			for (const input of promptInputs) {
+				expect(input).not.toContain("hidden reasoning");
+			}
+			expect(strippedNotices).toHaveLength(0);
+			expect(failures).toHaveLength(1);
+			expect(runtime.backlog).toBe(0);
+		});
+
+		it("trips the watchdog when refusals persist after the thinking strip", async () => {
+			const promptInputs: string[] = [];
+			const strippedNotices: number[] = [];
+			const failures: unknown[] = [];
+			const agent: AdvisorAgent = {
+				prompt: async input => {
+					promptInputs.push(input);
+					throw new Error("Refusal (reasoning_extraction): still blocked");
+				},
+				abort: () => {},
+				reset: () => {},
+				state: { messages: [] },
+			};
+			const messages: AgentMessage[] = [
+				{ role: "user", content: "start", timestamp: 1 } as AgentMessage,
+				{
+					role: "assistant",
+					content: [
+						{ type: "thinking", thinking: "flagged reasoning" },
+						{ type: "text", text: "visible" },
+					],
+					timestamp: 2,
+				} as AgentMessage,
+			];
+			const host: AdvisorRuntimeHost = {
+				snapshotMessages: () => messages,
+				enqueueAdvice: () => {},
+				notifyFailure: error => failures.push(error),
+				notifyThinkingStripped: () => strippedNotices.push(1),
+			};
+			const runtime = new AdvisorRuntime(agent, host, 0);
+
+			runtime.onTurnEnd(messages);
+			for (let i = 0; i < 6; i++) await Bun.sleep(0);
+
+			// 1 refused attempt with thinking + 3 stripped attempts → watchdog drop.
+			// The strip fires exactly once; there is no auto-recovery loop.
+			expect(promptInputs).toHaveLength(4);
+			expect(promptInputs[0]).toContain("_thinking:_");
+			expect(promptInputs[1]).not.toContain("_thinking:_");
+			expect(strippedNotices).toHaveLength(1);
+			expect(failures).toHaveLength(1);
+			expect(runtime.backlog).toBe(0);
+		});
+
+		it("classifies pi-ai refusal message shapes without matching ordinary errors", () => {
+			expect(isRefusalError(new Error("Refusal (reasoning_extraction): blocked by ToS"))).toBe(true);
+			expect(isRefusalError(new Error("Refusal (no details provided)"))).toBe(true);
+			expect(isRefusalError(new Error("Refusal: something"))).toBe(true);
+			expect(isRefusalError(new Error("Refusal"))).toBe(true);
+			expect(isRefusalError("Error: Refusal (reasoning_extraction): blocked")).toBe(true);
+			expect(isRefusalError(new Error("404 No endpoints available"))).toBe(false);
+			expect(isRefusalError(new Error("Refusals are handled elsewhere"))).toBe(false);
+			expect(isRefusalError(new Error("stream timeout"))).toBe(false);
+		});
+
 		it("drops the in-flight batch when a reset aborts the advisor prompt", async () => {
 			const promptInputs: string[] = [];
 			const { promise: firstPromptStarted, resolve: startFirstPrompt } = Promise.withResolvers<void>();