lazyclaw 4.2.0 → 4.2.2

package/channels/slack.mjs

@@ -31,6 +31,32 @@ export class SlackError extends Error {
   }
 }
 
+// Decide whether a Socket Mode event should drive a handler call.
+// Pulled out of dispatchEvent so we can unit-test the filter without
+// standing up a WebSocket. Returns false (= skip) for:
+//   - non-objects / null
+//   - the bot's own message in any of the four wire shapes Slack uses
+//     (legacy bot_id, legacy bot_message subtype, modern bot_profile.id,
+//     or the message.user field matching our cached auth.test user_id —
+//     this last one is the chat:write.customize trap that caused the
+//     v4.2.0 listener-loop)
+//   - non-message-shaped events (we only handle `message` and
+//     `app_mention`)
+//   - empty / whitespace-only text bodies (defense in depth so a
+//     stray blocks-only post can't loop us back into "(empty message)"
+//     fallback)
+export function shouldDispatchEvent(event, { selfUserId = null, selfBotId = null } = {}) {
+  if (!event || typeof event !== 'object') return false;
+  if (event.bot_id || event.subtype === 'bot_message') return false;
+  if (selfUserId && event.user === selfUserId) return false;
+  if (selfBotId && event.bot_id === selfBotId) return false;
+  if (selfBotId && event.bot_profile && event.bot_profile.id === selfBotId) return false;
+  if (event.type !== 'app_mention' && event.type !== 'message') return false;
+  const text = typeof event.text === 'string' ? event.text : '';
+  if (text.trim() === '') return false;
+  return true;
+}
+
 export function readSlackEnv(env = process.env) {
   const out = {
     botToken: env.SLACK_BOT_TOKEN || null,
@@ -81,7 +107,11 @@ export class SlackChannel extends Channel {
 
   // Called by Socket Mode wiring (or tests) for every inbound message
   // routed to this app. The handler returns the bot's reply; the
-  // adapter posts it back to Slack in the same thread.
+  // adapter posts it back to Slack in the same thread. A null /
+  // empty-string reply skips the send entirely (Phase 19.2) so a
+  // handler that decided to stay silent — e.g. the listener dropping
+  // an empty-after-mention-strip inbound — doesn't leak a "(empty
+  // reply)" placeholder into the channel.
   async _simulateInbound(text, threadId) {
     let reply;
     try {
@@ -94,6 +124,7 @@ export class SlackChannel extends Channel {
       await this.send(threadId, `(error: ${err?.message || err})`);
       return;
     }
+    if (reply == null || (typeof reply === 'string' && reply.trim() === '')) return;
     await this.send(threadId, reply);
   }
 
@@ -187,6 +218,37 @@ export class SlackChannel extends Channel {
       return json.url;
     };
 
+    // Resolve our own identity so dispatchEvent can refuse loops where
+    // the router posted a message with chat:write.customize (Slack
+    // strips bot_id / subtype from those events, so the original
+    // filter missed them and we replied to ourselves). Best-effort —
+    // a failed auth.test leaves the filter relying on the legacy
+    // bot_id / subtype check; better than refusing to start.
+    let selfUserId = null;
+    let selfBotId = null;
+    try {
+      const authUrl = `${apiBase}/auth.test`;
+      const r = await fetch(authUrl, {
+        method: 'POST',
+        headers: {
+          'Authorization': `Bearer ${this._env.botToken}`,
+          'Content-Type': 'application/x-www-form-urlencoded',
+        },
+      });
+      if (r.ok) {
+        const j = await r.json().catch(() => ({}));
+        if (j && j.ok) {
+          selfUserId = j.user_id || null;
+          selfBotId = j.bot_id || null;
+          logger(`[slack] auth.test OK — self user=${selfUserId} bot=${selfBotId}\n`);
+        }
+      }
+    } catch (err) {
+      logger(`[slack] auth.test failed: ${err?.message || err}\n`);
+    }
+    this._selfUserId = selfUserId;
+    this._selfBotId = selfBotId;
+
     // (channel, ts) dedupe — a single user message can fire both
     // `message` and `app_mention` events in the same channel. Both
     // arrive as separate Socket Mode envelopes (different envelope_id),
@@ -209,10 +271,15 @@ export class SlackChannel extends Channel {
     };
 
     const dispatchEvent = async (event) => {
-      if (!event || typeof event !== 'object') return;
-      // Skip the bot's own messages so we don't loop on our own replies.
-      if (event.bot_id || event.subtype === 'bot_message') return;
-      if (event.type !== 'app_mention' && event.type !== 'message') return;
+      if (!shouldDispatchEvent(event, { selfUserId: this._selfUserId, selfBotId: this._selfBotId })) {
+        // shouldDispatchEvent already encodes the "skip the bot's own
+        // chat:write.customize message" trap that caused the v4.2.0
+        // listener loop. Bail before the reaction / handler call.
+        if (event && (event.type === 'message' || event.type === 'app_mention')) {
+          logger(`[slack] skipping ${event.type} from ${event.channel || '?'}:${event.ts || '?'}\n`);
+        }
+        return;
+      }
       // For DMs (`im`) channel_type is 'im'; for channel mentions we only
       // get app_mention events. Either way we have channel + ts.
       const text = typeof event.text === 'string' ? event.text : '';
@@ -227,16 +294,10 @@ export class SlackChannel extends Channel {
       const threadId = `${channel}:${replyTs}`;
       logger(`[slack] inbound ${event.type} from ${channel} (${text.length} chars)\n`);
 
-      // Immediate acknowledgement so the user sees the bot picked up the
-      // message before the LLM finishes. Prefer a reaction (no message
-      // spam); fall back to a transient text reply when the workspace
-      // doesn't grant reactions:write.
-      const eyesOk = await this._reaction('add', channel, sourceTs, 'eyes');
-      if (!eyesOk) {
-        logger(`[slack] reactions:write missing — falling back to text ack\n`);
-        try { await this.send(threadId, '_확인해보겠습니다…_'); }
-        catch (err) { logger(`[slack] text ack failed: ${err?.message || err}\n`); }
-      }
+      // Immediate acknowledgement. _ackInbound is silent when
+      // reactions:write is missing (Phase 19.2 — no more text-ack
+      // spam).
+      const eyesOk = await this._ackInbound(channel, sourceTs, logger);
 
       try {
         await this._simulateInbound(text, threadId);
@@ -329,6 +390,24 @@ export class SlackChannel extends Channel {
     return this._socketHandle;
   }
 
+  // Mark an inbound message as "being worked on" without spamming the
+  // channel. Tries the :eyes: reaction first (silent UX). When
+  // reactions:write is missing we used to fall back to a text post
+  // ("확인해보겠습니다…") which doubled the noise per turn; Phase 19.2
+  // dropped that fallback so the channel stays clean when the scope
+  // is unavailable. The operator can flip reactions:write on at any
+  // time to bring the visible signal back.
+  //
+  // Exposed as a method (not closure-private in dispatchEvent) so the
+  // listener-noise unit tests can drive it directly.
+  async _ackInbound(channel, sourceTs, logger = () => {}) {
+    const eyesOk = await this._reaction('add', channel, sourceTs, 'eyes');
+    if (!eyesOk) {
+      logger('[slack] reactions:write missing — silent ack only (no text fallback)\n');
+    }
+    return eyesOk;
+  }
+
   // Best-effort chat.delete — used by typing-indicator workflows where
   // we post a placeholder and want to clean it up. Returns true on
   // success, silent false otherwise.

package/cli.mjs

@@ -1484,145 +1484,78 @@ function _attachGhostAutocomplete(rl) {
 // Width-management rule: every inner line is forced through
 // `.padEnd(W)` so a stray width miscount can't punch the right
 // border off the box (which is exactly the bug v3.99.5 shipped:
-// two of the inner lines were 33 cols vs the others' 32, so the
-// ╮ rendered into the next line).
-// v3.99.29 — 8-bit crab mascot (Claude Design crab sheet). Strict
-// 17-wide canvas, 12 rows, so every row aligns in any monospace font.
-// Layout: short eye-stalks (●) at cols 4 & 12, a red carapace dome
-// (╭──╮ … ╰──╯) worn like a hood, an orange face box at cols 4-12
-// with two dot-eyes + a mouth, two yellow legs (┃) below. State →
-// expression: idle 기본 · working 화남(연기) focused+smoke · done
-// 미소 smile+sparkle · error 경고/놀람 shocked+alert. Colour is
-// two-tone (red shell / orange face / yellow legs) — NOT white — so
-// it reads like the pixel sprite even in a plain terminal.
-const _MASCOT_W = 17;
-const _MASCOT_BIG = {
-  idle: [
-    '    ╷       ╷    ',
-    '    ●       ●    ',
-    '  ╭───────────╮  ',
-    '  │           │  ',
-    '  │           │  ',
-    '  ╰───────────╯  ',
-    '    ╭───────╮    ',
-    '    │ ●   ● │    ',
-    '    │  ───  │    ',
-    '    ╰───────╯    ',
-    '     ┃     ┃     ',
-    '     ┗┛   ┗┛     ',
-  ],
-  working: [
-    ' °  ╷       ╷  ° ',
-    '    ●       ●    ',
-    '  ╭───────────╮  ',
-    ' ╱╲│         │╱╲ ',
-    '  │           │  ',
-    '  ╰───────────╯  ',
-    '    ╭───────╮    ',
-    '    │ ─   ─ │    ',
-    '    │  ═══  │    ',
-    '    ╰───────╯    ',
-    '     ┃     ┃     ',
-    '     ┗┛   ┗┛     ',
-  ],
-  done: [
-    ' ✦  ╷       ╷  ✦ ',
-    '    ●       ●    ',
-    '  ╭───────────╮  ',
-    '  │           │  ',
-    '  │           │  ',
-    '  ╰───────────╯  ',
-    '    ╭───────╮    ',
-    '    │ ^   ^ │    ',
-    '    │  ‿‿‿  │    ',
-    '    ╰───────╯    ',
-    '     ┃     ┃     ',
-    '     ┗┛   ┗┛     ',
-  ],
-  error: [
-    ' \\   ╷     ╷   / ',
-    '  !  ●     ●  !  ',
-    '  ╭───────────╮  ',
-    '  │           │  ',
-    '  │           │  ',
-    '  ╰───────────╯  ',
-    '    ╭───────╮    ',
-    '    │ O   O │    ',
-    '    │  ╭─╮  │    ',
-    '    ╰───────╯    ',
-    '     ┃     ┃     ',
-    '     ┗┛   ┗┛     ',
-  ],
-};
-const _MASCOT_TINY = {
-  idle:    ' ●   ● \n(│ ─ │)\n  ┃ ┃  ',
-  working: ' ●   ● \n(│ ═ │)°\n  ┃ ┃  ',
-  done:    ' ^   ^ \n(│ ‿ │)✦\n  ┃ ┃  ',
-  error:   ' O   O \n(│╭╮│)!\n  ┃ ┃  ',
-};
+// v4.2.2 — boxed figlet "lazy" wordmark, single-colour orange. The
+// previous mixed-colour banner (helmet-red letter art + ink-beige
+// caption) read as "two banners glued together" because the colour
+// changed mid-box. We use one warm orange (#F08246) for everything —
+// border, letter art, caption — so the eye reads it as one badge.
+//
+// Letter art is figlet "standard" (6 rows) rather than the v3.99.11
+// "small" (4 rows), because small renders as a pixel mush in most
+// terminal fonts. Standard's strokes are wide enough that the
+// letters read as `l a z y` even at small terminal sizes.
+//
+// Layout invariant: every inner row is exactly INNER_W visible cells
+// (no double-width glyphs, all chars are 1 cell in any monospace
+// font), so the right edge `│` always lands in the same column.
+//
+// _renderMascot / _renderMascotTiny are kept as stubs so any leftover
+// caller doesn't crash; no state-coloured art is produced any more.
 
-// Crab palette — true colour. Shell red, face orange, legs yellow.
-// Kept as wrappers so the banner caller can compose rows freely.
-const _MC_RED = (s) => `\x1b[38;2;219;59;43m${s}\x1b[0m`;
-const _MC_ORG = (s) => `\x1b[38;2;239;131;48m${s}\x1b[0m`;
-const _MC_YEL = (s) => `\x1b[38;2;242;169;59m${s}\x1b[0m`;
-
-// Two-tone renderer: rows 6-9 are the orange face box (interior cols
-// 4-12 inked orange, the rest of the row red); rows 10-11 are the
-// yellow legs; everything else is the red carapace. Box-drawing and
-// the accent glyphs are all single BMP code points, so slice() index
-// == visual column and the alignment survives the colour wrap.
-function _renderMascot(state) {
-  const rows = _MASCOT_BIG[state] || _MASCOT_BIG.idle;
-  return rows.map((r, i) => {
-    if (i >= 6 && i <= 9) return _MC_RED(r.slice(0, 4)) + _MC_ORG(r.slice(4, 13)) + _MC_RED(r.slice(13));
-    if (i >= 10) return _MC_YEL(r);
-    return _MC_RED(r);
-  });
+const _ORANGE_RGB = '241;130;70';  // #F18246
+function _orange(s) { return `\x1b[38;2;${_ORANGE_RGB}m${s}\x1b[0m`; }
+
+function _renderMascot() {
+  return ['lazyclaw'];
 }
 
-// Tiny inline mascot — picked up by chat/agent helpers when they want
-// to flash a one-line status without re-rendering the whole banner.
-// Returns a string; callers add their own newline. Inked crab-red so
-// it stays on-brand wherever it's spliced in.
-function _renderMascotTiny(state) {
-  return _MC_RED(_MASCOT_TINY[state] || _MASCOT_TINY.idle);
+function _renderMascotTiny() {
+  return 'lazyclaw';
 }
 
+// figlet "standard" "lazy", trimmed of leading blank line. Each row
+// is left-padded by two spaces inside the box, and every row is then
+// padded to INNER_W cells.
+const _LAZY_STANDARD = [
+  ' _                  ',
+  '| | __ _ _____   _  ',
+  '| |/ _` |_  / | | | ',
+  '| | (_| |/ /| |_| | ',
+  '|_|\\__,_/___|\\__, | ',
+  '             |___/  ',
+];
+
+const _INNER_W = 32;  // 2 left pad + 20 letter art + caption headroom
+
 function _renderBanner(version) {
-  const ink = (s) => `\x1b[38;2;241;234;217m${s}\x1b[0m`;
-  const dim = (s) => `\x1b[2m${s}\x1b[0m`;
   const v = String(version || '?.?.?');
-  const left = _renderMascot('idle');
-  const right = [
-    '',
-    '',
-    '',
-    `   ${ink('lazyclaw')}  ${dim('v' + v)}`,
-    `   ${dim('a sleepy 8-bit')}`,
-    `   ${dim('terminal assistant')}`,
-    '',
-    '',
-    '',
-    '',
-    '',
-    '',
+  const cap = `  LazyClaw  v${v}`;
+  const padInner = (s) => '  ' + s.padEnd(_INNER_W - 2, ' ');
+  const wrap = (inner) => _orange('│') + _orange(inner) + _orange('│');
+  const top = _orange('╭' + '─'.repeat(_INNER_W) + '╮');
+  const bot = _orange('╰' + '─'.repeat(_INNER_W) + '╯');
+  return [
+    top,
+    ..._LAZY_STANDARD.map((row) => wrap(padInner(row))),
+    wrap(padInner(cap)),
+    bot,
   ];
-  return left.map((l, i) => '  ' + l + (right[i] || ''));
 }
 
 function _printChatBanner(activeProvName, activeModel, version) {
   if (!process.stdout.isTTY) return;
-  const dim = (s) => `\x1b[2m${s}\x1b[0m`;
-  const ok = (s) => `\x1b[32m${s}\x1b[0m`;
+  // Single-hue header: labels dim-orange, values/emphasis full-orange, so the
+  // four caption rows below the box read as part of the same warm badge.
+  const dimOrange = (s) => `\x1b[2m\x1b[38;2;${_ORANGE_RGB}m${s}\x1b[0m`;
+  const orange = _orange;
   const lines = [
     '',
     ..._renderBanner(version),
     '',
-    `  ${dim('provider ·')} ${ok(activeProvName)}`,
-    `  ${dim('model    ·')} ${ok(activeModel || '(default)')}`,
-    `  ${dim('slash    ·')} /help · /model · /provider · /exit`,
-    `  ${dim('hint     ·')} → ${dim('to accept the suggested command,')} Tab ${dim('to cycle')}`,
+    `  ${dimOrange('provider ·')} ${orange(activeProvName)}`,
+    `  ${dimOrange('model    ·')} ${orange(activeModel || '(default)')}`,
+    `  ${dimOrange('slash    ·')} ${orange('/help · /model · /provider · /exit')}`,
+    `  ${dimOrange('hint     ·')} ${orange('→')} ${dimOrange('to accept the suggested command,')} ${orange('Tab')} ${dimOrange('to cycle')}`,
     '',
   ];
   process.stdout.write(lines.join('\n') + '\n');
@@ -4935,7 +4868,15 @@ async function cmdSlack(sub, positional, flags = {}) {
 
   const handler = async ({ threadId, text }) => {
     const cleaned = String(text || '').replace(/<@[A-Z0-9]+>/g, '').trim();
-    if (!cleaned) return '(empty message)';
+    // Phase 19.2: never post a placeholder ("(empty message)" / "(empty
+    // reply)") into the thread — those leaked through as visible noise
+    // when listener self-message echoes happened. Return null and let
+    // _simulateInbound's guard drop the send. Real provider errors
+    // still surface so the operator knows something went wrong.
+    if (!cleaned) {
+      process.stderr.write('[slack] dropping empty inbound (after mention strip)\n');
+      return null;
+    }
     const msgs = threadMsgs.get(threadId) || [];
     msgs.push({ role: 'user', content: cleaned });
     let acc = '';
@@ -4953,7 +4894,11 @@ async function cmdSlack(sub, positional, flags = {}) {
     msgs.push({ role: 'assistant', content: acc });
     if (msgs.length > MAX_TURNS) msgs.splice(0, msgs.length - MAX_TURNS);
     threadMsgs.set(threadId, msgs);
-    return acc || '(empty reply)';
+    if (!acc.trim()) {
+      process.stderr.write('[slack] provider returned empty text — not posting\n');
+      return null;
+    }
+    return acc;
   };
 
   const { SlackChannel } = await import('./channels/slack.mjs');

package/mas/agent_memory.mjs

@@ -179,9 +179,10 @@ export async function reflectOnce({ agent, task, apiKey, baseUrl, fetchImpl, max
 
 async function pickAdapter(provider) {
   switch (provider) {
-    case 'anthropic': return await import('../providers/tool_use/anthropic.mjs');
-    case 'openai':    return await import('../providers/tool_use/openai.mjs');
-    case 'gemini':    return await import('../providers/tool_use/gemini.mjs');
+    case 'anthropic':  return await import('../providers/tool_use/anthropic.mjs');
+    case 'openai':     return await import('../providers/tool_use/openai.mjs');
+    case 'gemini':     return await import('../providers/tool_use/gemini.mjs');
+    case 'claude-cli': return await import('../providers/tool_use/claude_cli.mjs');
     default:
       throw new AgentMemoryError(`provider "${provider}" does not support reflection`, 'AGENT_MEMORY_NO_PROVIDER');
   }

package/mas/agent_turn.mjs

@@ -24,6 +24,7 @@ import { listToolSchemas, runTool, ToolError } from './tool_runner.mjs';
 import * as anthropic from '../providers/tool_use/anthropic.mjs';
 import * as openai from '../providers/tool_use/openai.mjs';
 import * as gemini from '../providers/tool_use/gemini.mjs';
+import * as claudeCli from '../providers/tool_use/claude_cli.mjs';
 
 export class AgentTurnError extends Error {
   constructor(message, code) {
@@ -37,9 +38,14 @@ const DEFAULT_MAX_ITERATIONS = 10;
 
 function adapterFor(provider) {
   switch (provider) {
-    case 'anthropic': return { ...anthropic, toolSchemas: anthropic.toAnthropicTools };
-    case 'openai':    return { ...openai,    toolSchemas: openai.toOpenAITools };
-    case 'gemini':    return { ...gemini,    toolSchemas: gemini.toGeminiTools };
+    case 'anthropic':  return { ...anthropic,  toolSchemas: anthropic.toAnthropicTools };
+    case 'openai':     return { ...openai,     toolSchemas: openai.toOpenAITools };
+    case 'gemini':     return { ...gemini,     toolSchemas: gemini.toGeminiTools };
+    // claude-cli runs the tool-use loop INSIDE the binary. Our adapter
+    // resolves every call to kind:'final' so the mention router still
+    // gets a normalised reply, even though no tool_calls envelope is
+    // ever observed.
+    case 'claude-cli': return { ...claudeCli, toolSchemas: (s) => s };
     default:
       throw new AgentTurnError(`provider "${provider}" does not support tool-use yet`, 'PROVIDER_UNSUPPORTED');
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lazyclaw",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "description": "Lazy, elegant terminal CLI for chatting with Claude / OpenAI / Gemini / Ollama, orchestrating multi-step LLM workflows, and running multi-agent Slack teams with cross-task memory. Banner-on-launch, slash-command ghost autocomplete, persistent sessions, local HTTP gateway.",
   "keywords": [
     "claude",

package/providers/tool_use/claude_cli.mjs

@@ -0,0 +1,215 @@
+// claude-cli tool-use adapter (Phase 19).
+//
+// Unlike the API-based adapters, this one wraps the official `claude`
+// CLI (Claude Code). The CLI runs the *entire* tool-use loop inside
+// itself — bash, edit, read, write, grep, etc. — and emits a single
+// final text answer. From lazyclaw's mention-router perspective every
+// call resolves to `{ kind: 'final', text }` after one iteration, so
+// the multi-agent handoff still works (we just lose lazyclaw's audit
+// log for tools claude ran on its own; the CLI keeps its own log).
+//
+// Wiring choices:
+//   - --output-format stream-json + --verbose so we can accumulate
+//     text deltas exactly like providers/claude_cli.mjs does (proven
+//     parser, no second JSON shape to maintain).
+//   - --permission-mode bypassPermissions because spec §10 #6 ships
+//     destructive-pattern confirmation OFF by default. Audit log
+//     still captures every tool the CLI runs (via the CLI's own
+//     telemetry — we don't double-write here).
+//   - --tools maps the lazyclaw whitelist into claude's built-in
+//     names (bash → Bash, etc.). When the whitelist is empty we pass
+//     `""` so tools are fully disabled.
+//   - --system-prompt carries the agent role + memory + team metadata
+//     the mention router builds.
+//   - LAZYCLAW_CLAUDE_BIN overrides the binary path so tests can
+//     point at a deterministic shim script.
+
+import { spawn } from 'node:child_process';
+
+const DEFAULT_BIN = 'claude';
+const LAZYCLAW_TO_CLAUDE_TOOL = {
+  bash: 'Bash',
+  read: 'Read',
+  write: 'Write',
+  grep: 'Grep',
+  web_search: 'WebSearch',
+  web_fetch: 'WebFetch',
+};
+
+export class ClaudeCliToolUseError extends Error {
+  constructor(message, code, body) {
+    super(message);
+    this.name = 'ClaudeCliToolUseError';
+    this.code = code || 'CLAUDE_CLI_ERR';
+    if (body) this.body = body;
+  }
+}
+
+// The schemas value from listToolSchemas comes in lazyclaw form; claude
+// expects a comma-separated string of its OWN built-in tool names.
+// Returning a string rather than an array lets us pass it as a single
+// CLI argument unchanged. An empty string is meaningful — it disables
+// all tools — so callers should distinguish "no tools whitelisted" from
+// "tools field omitted".
+export function toClaudeTools(schemas) {
+  if (!Array.isArray(schemas) || schemas.length === 0) return '';
+  const names = schemas
+    .map((s) => LAZYCLAW_TO_CLAUDE_TOOL[s?.name])
+    .filter(Boolean);
+  return [...new Set(names)].join(',');
+}
+
+export function normalizeHistory(turns) {
+  return Array.isArray(turns) ? [...turns] : [];
+}
+
+export function initialUserMessage(text) {
+  return { role: 'user', content: String(text) };
+}
+
+// Build the single prompt string the CLI sees. Concatenate every
+// non-system message, prefixing prior assistant turns with a "[prior]
+// " marker so the model can tell them apart from the live user turn.
+// Mirrors the established pattern in providers/claude_cli.mjs.
+function buildPrompt(messages) {
+  const lastUser = [...messages].reverse().find((m) => m && m.role === 'user');
+  if (!lastUser) return '';
+  const history = messages
+    .filter((m) => m !== lastUser && m && m.role !== 'system')
+    .map((m) => {
+      const tag = m.role === 'assistant' ? '[prior assistant]' : '[prior user]';
+      return `${tag} ${typeof m.content === 'string' ? m.content : JSON.stringify(m.content)}`;
+    })
+    .join('\n\n');
+  return history ? `${history}\n\n${lastUser.content}` : String(lastUser.content);
+}
+
+function extractTextDelta(obj) {
+  if (!obj || typeof obj !== 'object') return '';
+  if (obj.type !== 'stream_event') return '';
+  const ev = obj.event || {};
+  if (ev.type === 'content_block_delta') {
+    const d = ev.delta || {};
+    if (d.type === 'text_delta' && typeof d.text === 'string') return d.text;
+  }
+  return '';
+}
+
+// Walk stream-json output to completion, accumulating text deltas, and
+// return the final concatenated reply. The CLI also emits an
+// 'assistant' record carrying the full message content; we fall back
+// to that when no `stream_event` deltas were observed (some claude
+// versions only emit the consolidated record).
+async function readUntilDone(proc) {
+  return new Promise((resolve, reject) => {
+    let stdout = '';
+    let stderr = '';
+    let acc = '';
+    let assistantFallback = '';
+    let resultText = '';
+    proc.stdout.setEncoding('utf8');
+    proc.stderr.setEncoding('utf8');
+    proc.stdout.on('data', (chunk) => {
+      stdout += chunk;
+      let nl;
+      while ((nl = stdout.indexOf('\n')) >= 0) {
+        const line = stdout.slice(0, nl).trim();
+        stdout = stdout.slice(nl + 1);
+        if (!line) continue;
+        let obj;
+        try { obj = JSON.parse(line); } catch { continue; }
+        const delta = extractTextDelta(obj);
+        if (delta) acc += delta;
+        // Fallback: consolidated assistant content block (no streaming).
+        if (obj?.type === 'assistant' && obj?.message?.content) {
+          for (const block of obj.message.content) {
+            if (block?.type === 'text' && typeof block.text === 'string') {
+              assistantFallback += block.text;
+            }
+          }
+        }
+        if (obj?.type === 'result' && typeof obj.result === 'string') {
+          resultText = obj.result;
+        }
+      }
+    });
+    proc.stderr.on('data', (chunk) => { stderr += chunk; });
+    proc.on('error', reject);
+    proc.on('close', (code) => {
+      if (code !== 0) {
+        return reject(new ClaudeCliToolUseError(`claude CLI exit ${code}: ${stderr.slice(0, 300)}`, 'CLAUDE_CLI_EXIT', stderr));
+      }
+      // Prefer accumulated stream deltas; fall back to the assistant
+      // record or the final result text when streaming was disabled.
+      const text = acc || assistantFallback || resultText || '';
+      resolve(text);
+    });
+  });
+}
+
+export async function callOnce({
+  messages,
+  tools = [],
+  model,
+  apiKey,           // unused — the CLI authenticates itself
+  system,
+  baseUrl,          // unused
+  fetchImpl,        // unused
+  signal,
+  bin,
+  cwd,
+  permissionMode = 'bypassPermissions',
+} = {}) {
+  if (!Array.isArray(messages) || messages.length === 0) {
+    throw new ClaudeCliToolUseError('messages[] is required and non-empty', 'NO_MESSAGES');
+  }
+  const prompt = buildPrompt(messages);
+  if (!prompt) {
+    throw new ClaudeCliToolUseError('messages produced an empty prompt', 'NO_PROMPT');
+  }
+  const args = [
+    '-p', prompt,
+    '--output-format', 'stream-json',
+    '--include-partial-messages',
+    '--verbose',
+    '--permission-mode', permissionMode,
+  ];
+  if (model) args.push('--model', model);
+  if (system && String(system).trim()) {
+    args.push('--system-prompt', String(system));
+  }
+  // Phase 19: pass the lazyclaw whitelist through to claude's --tools
+  // even when empty (an empty string explicitly disables every tool).
+  const toolsArg = toClaudeTools(tools);
+  args.push('--tools', toolsArg);
+
+  const binPath = bin || process.env.LAZYCLAW_CLAUDE_BIN || DEFAULT_BIN;
+  let proc;
+  try {
+    proc = spawn(binPath, args, {
+      cwd: cwd || process.cwd(),
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: process.env,
+    });
+  } catch (err) {
+    if (err?.code === 'ENOENT') {
+      throw new ClaudeCliToolUseError(`claude CLI binary not found at "${binPath}"`, 'CLAUDE_CLI_NOT_FOUND');
+    }
+    throw err;
+  }
+  const onAbort = () => { try { proc.kill('SIGTERM'); } catch { /* gone */ } };
+  if (signal) signal.addEventListener('abort', onAbort);
+  try {
+    const text = await readUntilDone(proc);
+    return { kind: 'final', text, raw: null };
+  } finally {
+    if (signal) signal.removeEventListener('abort', onAbort);
+  }
+}
+
+// The CLI handles tools internally — these helpers exist to keep the
+// adapter surface symmetrical with anthropic/openai/gemini. Neither
+// path is actually exercised at runtime because callOnce always
+// returns kind:'final'.
+export function assistantTurnMessages(_resp) { return []; }
+export function toolResultMessages(_results) { return []; }