muonroi-cli 1.7.2 → 1.8.0

package/dist/src/orchestrator/prompts.js

@@ -7,17 +7,17 @@ import { loadCustomInstructions } from "../utils/instructions.js";
 import { loadValidSubAgents, } from "../utils/settings.js";
 import { resolveShell } from "../utils/shell.js";
 import { discoverSkills, formatSkillsForPrompt } from "../utils/skills.js";
-// F3 — hard cap on tool rounds per user turn. Default reduced 75 → 50
+// F3 — hard cap on tool rounds per user turn. Default reduced 400 → 100
 // after session bca83bcbaad1 logged 178 tool calls in a single turn while
-// monotonically growing billed input. Env override allowed range 10..200.
+// monotonically growing billed input. Env override allowed range 10..400.
 function readMaxToolRoundsFromEnv() {
     const raw = process.env.MUONROI_MAX_TOOL_ROUNDS;
     if (!raw)
-        return 12;
+        return 100;
     const n = Number(raw);
     if (!Number.isFinite(n))
-        return 50;
-    return Math.max(10, Math.min(200, Math.floor(n)));
+        return 100;
+    return Math.max(10, Math.min(400, Math.floor(n)));
 }
 export const MAX_TOOL_ROUNDS = readMaxToolRoundsFromEnv();
 export const VISION_MODEL = "grok-4-1-fast-reasoning";
@@ -143,6 +143,7 @@ function buildEnvironmentBlock() {
         if (platform === "win32") {
             shellRules.push('- When a Windows-native command is genuinely needed, invoke it explicitly: `cmd.exe /c "command"` or `powershell -NoProfile -Command "command"`.');
         }
+        shellRules.push("- CRITICAL: Batch independent commands in ONE call with `&&` or `;` instead of N sequential calls — each extra call adds ~500 tokens of overhead and prevents cross-request cache reuse. Examples: `ls && cat file` or `a; b; c; d` instead of four separate bash calls.");
     }
     else if (shell.kind === "powershell") {
         shellRules.push("- The bash tool runs PowerShell. Use PowerShell cmdlets: Get-ChildItem, Select-String, Measure-Object, ConvertTo-Json, $env:VAR.", "- DO NOT use POSIX-only commands: grep, sed, awk, wc (use Select-String / Measure-Object / -split instead).", "- For pipe redirection, use PowerShell syntax: `cmd | Select-Object -First 10`, not `cmd | head -10`.");
@@ -272,11 +273,28 @@ IMPORTANT:
 - Use write_file only for new files or when most of the file is changing. For very large files (>500 lines), split into multiple edit_file calls or write smaller chunks.
 - Use read_file instead of cat/head/tail for reading files.
 - When the user asks for an automated recurring or one-time run, use the schedule tools instead of only describing the setup.
-- Commit incrementally (in any git repo, without being asked): the moment a cohesive, working chunk is finished and its checks pass, commit it before starting the next chunk. This is part of doing the work, not a separate request — prefer several small, logically-scoped commits over one large catch-all commit at the end. Group related file changes per commit; keep unrelated changes in separate commits.
-- Every commit message you create MUST end with this attribution line, verbatim, on its own final line: "Coding by - Muonroi-CLI".
+- If you have worked for a long time or hit a tool execution limit, DO NOT tell the user to move to a new session. Instead, advise them to run the \`/compact\` command to free up memory before continuing.
+- Use the experience brain actively (it is how you stop repeating mistakes across sessions): at the start of an unfamiliar or risky step call ee_query to recall past lessons, and after acting on a recalled \`[id col]\` rate it with ee_feedback. The MOMENT you hit a mistake / error / dead-end and find the working fix, call ee_write to save the lesson (the pitfall AND the fix, concise and generalizable) — it is embedded immediately and recallable via ee_query in this and future sessions. Saving a hard-won fix is part of doing the work, not optional.
+- Commit your own work as you go (in any git repo, without being asked): use the git_commit tool — YOU write the commit message — the moment a cohesive, working chunk passes its checks, and after EACH step of a multi-step plan. Prefer several small, logically-scoped commits with clear messages (describe WHAT changed) over one catch-all at the end. git_commit stages only the files you wrote, excludes secrets/artifacts, and appends the "Coding by - Muonroi-CLI" attribution for you. (Any commit you instead make by hand via bash must still end with that attribution line, verbatim, on its own final line.)
 - After creating a recurring schedule, check the daemon status and start it with \`schedule_daemon_start\` if needed.
 
-Be direct. Execute, don't just describe. Show results, not plans.`,
+
+Be direct. Execute, don't just describe. Show results, not plans.
+
+TOKEN BUDGET:
+- Each tool round sends ~17K system prompt tokens + accumulated tool results to the model.
+- Task(explore) / task(general) isolates context in a sub-agent — much cheaper than 5+ top-level rounds.
+- Consider: 1-2 rounds → direct; 3-5 rounds → consider task(explore); >5 rounds → should use task(explore).
+WORKFLOW RULES:
+- RESEARCH FIRST: Always prioritize research before proposing edits. DeepSeek and other models have knowledge cutoffs; do not assume you know the exact codebase structure or latest external libraries. Use 'grep', 'lsp', and 'read_file' to search the local codebase. Use MCP tools (like web search or documentation readers) to research external knowledge, APIs, or libraries. Use 'delegate' for deep background research. Read before you write.
+- CLARIFY GRAY AREAS: If the user's request is ambiguous or leaves critical design decisions unspecified, STOP and ask the user for clarification before writing code. Do not hallucinate requirements.
+
+SELF-LIMIT:
+- When you've read 5+ files and haven't concluded, summarize findings and propose next step instead of reading more.
+- BATCH TOOL CALLS: You MUST combine and invoke independent tool calls in parallel (e.g. read multiple files, or run grep and read a file concurrently) in a SINGLE turn. Do not wait for the result of one tool call before invoking another if you already know both are needed. This dramatically reduces conversation turns, roundtrip latency, and input token accumulation.
+- BATCH BASH COMMANDS: Combine independent commands into ONE bash call (a; b; c) rather than sequential single calls — each separate call adds ~500 tokens of overhead and prevents prompt-cache reuse across the session.
+- Read only specific file sections (start_line/end_line) instead of whole files.
+- When a clear direction emerges from the first 2-3 tool results, act on it — don't over-investigate.`,
     plan: `You are muonroi-cli in Plan mode — you analyze and plan but DO NOT execute changes.
 
 ${ENVIRONMENT}
@@ -386,40 +404,60 @@ export function buildMcpCapabilityBlock(toolNames) {
         "to bash or hand-write JSON-RPC to reach an MCP server:\n" +
         lines.join("\n"));
 }
-export function buildSystemPromptParts(cwd, mode, sandboxMode, planContext, subagents, sandboxSettings, providerId, resumeDigest, options) {
-    const chitchat = options?.chitchat === true;
+const _staticPrefixCache = new Map();
+const STATIC_PREFIX_CACHE_TTL_MS = 300_000; // 5 min — ample; inputs are session-stable
+function staticPrefixCacheKey(cwd, mode, providerId, isChitchat, subagentsHash, subAgent = false) {
+    return `${cwd}|${mode}|${providerId}|${isChitchat}|${subagentsHash}|${subAgent}`;
+}
+function computeStaticPrefix(cwd, mode, subagents, providerId, chitchat, subAgent = false) {
     const custom = loadCustomInstructions(cwd);
-    const customSection = custom
-        ? `\n\nCUSTOM INSTRUCTIONS:\n${custom}\n\nFollow the above alongside standard instructions.\n`
-        : "";
-    // Skip skills + subagents catalogs for chitchat — these are pure tool/agent
-    // routing context the model doesn't need to answer "Hi". On this codebase
-    // they account for ~3K tokens per call.
-    const skillsText = chitchat ? "" : formatSkillsForPrompt(discoverSkills(cwd));
+    const customSection = subAgent || !custom
+        ? ""
+        : `\n\nCUSTOM INSTRUCTIONS:\n${custom}\n\nFollow the above alongside standard instructions.\n`;
+    const skillsText = chitchat || subAgent ? "" : formatSkillsForPrompt(discoverSkills(cwd));
     const skillsSection = skillsText ? `\n\n${skillsText}\n` : "";
     const subagentsSection = chitchat ? "" : formatCustomSubagentsPromptSection(subagents ?? loadValidSubAgents());
-    const sandboxSection = formatSandboxPromptSection(sandboxMode, sandboxSettings);
     let modePrompt = MODE_PROMPTS[mode];
-    // Phase 12.2-G5: defer the "is this an anthropic-style prompt or not?"
-    // decision to the provider capability. Default (no providerId) keeps the
-    // pre-G5 behaviour by treating the prompt as anthropic-native.
     if (!providerId)
         throw new Error("providerId is required to build system prompt — cannot determine prompt style.");
     const promptStyle = getProviderCapabilities(providerId).systemPromptStyle();
     if (promptStyle !== "anthropic") {
         modePrompt = stripToolsSection(modePrompt) + NON_ANTHROPIC_TOOL_PREAMBLE;
     }
-    // Front-load the Agent Operating Contract (all tiers) so the
-    // grounding/evidence discipline registers — the same rules buried in
-    // CUSTOM INSTRUCTIONS get underweighted when not front-loaded. Skipped for
-    // chitchat (no tools, no factual claims). See agent-operating-contract.ts.
+    // Agent mode: strip tool descriptions for tools rarely needed in coding tasks
+    // to reduce system-prompt bloat. The tools remain available via API.
+    if (mode === "agent") {
+        modePrompt = modePrompt.replace(/\n- (wallet_|paid_|fetch_payment|schedule_|generate_|computer_|search_x).*/g, "");
+    }
     const contractSection = buildContractSection({ chitchat });
-    // Native capability manifest (agent mode only) — gives the in-CLI agent a
-    // self-model of the tools, sub-agents, and CLI subsystems it has, so it
-    // wields them instead of reconstructing its own runtime by grepping source.
-    // See native-capabilities-workbook.ts (session d95113d3be09 motivation).
     const nativeCapabilitiesSection = buildNativeCapabilitiesSection({ mode, chitchat });
-    const staticPrefix = `${contractSection}${nativeCapabilitiesSection}${modePrompt}${sandboxSection}${customSection}${skillsSection}${subagentsSection}`;
+    const prefix = `${contractSection}${nativeCapabilitiesSection}${modePrompt}${customSection}${skillsSection}${subagentsSection}`;
+    return { prefix };
+}
+export function buildSystemPromptParts(cwd, mode, sandboxMode, planContext, subagents, sandboxSettings, providerId, resumeDigest, options) {
+    const chitchat = options?.chitchat === true;
+    const subAgent = options?.subAgent ?? false;
+    const pid = providerId ?? "default";
+    // Subagents rarely change mid-session, but when they do we need a cache miss.
+    // JSON-stable stringify is fast for typical configs (< 10 entries, no circular refs).
+    const subagentsHash = subagents ? JSON.stringify(subagents) : "none";
+    // Try cache for the static prefix
+    const key = staticPrefixCacheKey(cwd, mode, pid, chitchat, subagentsHash, subAgent);
+    const now = Date.now();
+    const cached = _staticPrefixCache.get(key);
+    let staticPrefix;
+    if (cached && now - cached.cachedAt < STATIC_PREFIX_CACHE_TTL_MS) {
+        staticPrefix = cached.prefix;
+    }
+    else {
+        // Cache miss — compute and store
+        const result = computeStaticPrefix(cwd, mode, subagents, pid, chitchat, subAgent);
+        staticPrefix = result.prefix;
+        _staticPrefixCache.set(key, {
+            prefix: staticPrefix,
+            cachedAt: now,
+        });
+    }
     const planSection = planContext
         ? `\n\nAPPROVED PLAN:\nThe following plan has been approved by the user. Execute it now.\n${planContext}\n`
         : "";
@@ -429,6 +467,10 @@ export function buildSystemPromptParts(cwd, mode, sandboxMode, planContext, suba
     const dynamicSuffix = `${planSection}${resumeSection}\n\nCurrent working directory: ${cwd}`;
     return { staticPrefix, dynamicSuffix };
 }
+/** Reset the static prefix cache (for tests). */
+export function resetStaticPrefixCache() {
+    _staticPrefixCache.clear();
+}
 export function buildSystemPrompt(cwd, mode, sandboxMode, planContext, subagents, sandboxSettings, providerId, resumeDigest, options) {
     const { staticPrefix, dynamicSuffix } = buildSystemPromptParts(cwd, mode, sandboxMode, planContext, subagents, sandboxSettings, providerId, resumeDigest, options);
     return `${staticPrefix}${dynamicSuffix}`;
@@ -556,39 +598,13 @@ export function buildSubagentPrompt(request, cwd, custom, sandboxMode, subagents
         "",
         `Delegated task: ${request.description}`,
         "",
-        buildSystemPrompt(cwd, mode, sandboxMode, undefined, subagents, sandboxSettings, providerId),
+        buildSystemPrompt(cwd, mode, sandboxMode, undefined, subagents, sandboxSettings, providerId, undefined, {
+            subAgent: true,
+        }),
     ].join("\n");
 }
 export function formatSandboxPromptSection(sandboxMode, settings) {
-    if (sandboxMode === "off")
-        return "";
-    const s = settings ?? {};
-    let networkLine;
-    if (s.allowNet) {
-        networkLine = s.allowedHosts?.length
-            ? `- Network access is restricted to: ${s.allowedHosts.join(", ")}.`
-            : "- Network access is enabled.";
-    }
-    else {
-        networkLine = "- Network is disabled.";
-    }
-    const lines = [
-        "",
-        "SANDBOX MODE:",
-        "- Bash commands run inside a Shuru sandbox.",
-        networkLine,
-        "- The current workspace is mounted inside the sandbox at `/workspace`.",
-        "- Shell-side workspace file changes do not persist back to the host in this version.",
-        "- Use `read_file`, `edit_file`, and `write_file` for durable source edits.",
-        "- If a task needs a host-persistent shell mutation, explain that sandbox mode blocks that workflow and ask whether to disable sandbox mode.",
-    ];
-    if (s.ports?.length) {
-        lines.push(`- Port forwards: ${s.ports.join(", ")}.`);
-    }
-    if (s.from) {
-        lines.push(`- Starting from checkpoint: ${s.from}.`);
-    }
-    return lines.join("\n");
+    return "";
 }
 export function applyModelConstraints(system, modelId) {
     const modelInfo = getModelInfo(modelId);

package/dist/src/orchestrator/safety-askcard.d.ts

@@ -0,0 +1,66 @@
+/**
+ * src/orchestrator/safety-askcard.ts
+ *
+ * Plans an askcard layout when a tool call is blocked by the safety filter
+ * (catastrophic, dangerous, git-safety, empty-bash).
+ *
+ * The askcard gives the user a choice: allow the block once, or confirm the block.
+ *
+ * Pure — no React, no side effects. Unit-testable in isolation.
+ */
+export type SafetyBlockKind = "catastrophic" | "dangerous" | "git-safety" | "empty-bash";
+export interface SafetyBlockInfo {
+    kind: SafetyBlockKind;
+    /** The blocked command or tool call description */
+    blockedItem: string;
+    /** Human-readable reason from the filter */
+    reason: string;
+    /** Suggested "safe" alternative, if any */
+    alternative?: string;
+}
+export interface SafetyAskcardLayout {
+    /** Question shown in the dialog title */
+    question: string;
+    /** Detail text shown below the question */
+    detail: string;
+    /** Options in render order. First = default (Enter applies). */
+    options: SafetyAskcardOption[];
+    /** Index of the default-selected option (0 = first). */
+    defaultIndex: number;
+}
+export interface SafetyAskcardOption {
+    label: string;
+    value: SafetyAskResult;
+    description?: string;
+}
+export type SafetyAskResult = "allow-once" | "allow-session" | "block";
+/**
+ * Plan the askcard layout for a safety block.
+ * Pure function — easy to unit test and swap UI strategies.
+ */
+export declare function planSafetyAskcard(info: SafetyBlockInfo): SafetyAskcardLayout;
+/** Info passed to the safety-override handler when a tool block is detected. */
+export interface SafetyOverrideAskInfo {
+    kind: SafetyBlockKind;
+    /** The blocked tool name (e.g. "bash", "edit_file"). */
+    toolName: string;
+    /** The command/args that were blocked. */
+    blockedItem: string;
+    /** Human-readable reason from the filter. */
+    reason: string;
+    /** Source block kind tag for the agent to decide retry. */
+    source: "bash.execute" | "registry.precheck";
+}
+/** Verdict the UI returns after the user answers the askcard. */
+export type SafetyOverrideVerdict = {
+    action: "allow-once";
+} | {
+    action: "allow-session";
+} | {
+    action: "block";
+};
+/**
+ * Build a safe alternative suggestion for a blocked command.
+ * Returns null when no canned alternative exists.
+ */
+export declare function suggestAlternative(kind: SafetyBlockKind, command: string): string | undefined;

package/dist/src/orchestrator/safety-askcard.js

@@ -0,0 +1,74 @@
+/**
+ * src/orchestrator/safety-askcard.ts
+ *
+ * Plans an askcard layout when a tool call is blocked by the safety filter
+ * (catastrophic, dangerous, git-safety, empty-bash).
+ *
+ * The askcard gives the user a choice: allow the block once, or confirm the block.
+ *
+ * Pure — no React, no side effects. Unit-testable in isolation.
+ */
+const CATEGORY_LABELS = {
+    catastrophic: "Lỗi bảo mật nghiêm trọng",
+    dangerous: "Lệnh nguy hiểm",
+    "git-safety": "Git safety gate",
+    "empty-bash": "Bash call trống",
+};
+/**
+ * Plan the askcard layout for a safety block.
+ * Pure function — easy to unit test and swap UI strategies.
+ */
+export function planSafetyAskcard(info) {
+    const kindLabel = CATEGORY_LABELS[info.kind];
+    const cmdPreview = info.blockedItem.length > 120 ? `${info.blockedItem.slice(0, 117)}...` : info.blockedItem;
+    const question = `⚠️  ${kindLabel}: Cho phép thực thi?`;
+    const detailLines = [`Lệnh bị chặn: \`${cmdPreview}\``, `Lý do: ${info.reason}`];
+    if (info.alternative) {
+        detailLines.push(`Gợi ý thay thế: ${info.alternative}`);
+    }
+    const options = [
+        {
+            label: "Cho phép 1 lần (Allow once)",
+            value: "allow-once",
+            description: "Chỉ chạy lệnh này một lần duy nhất",
+        },
+        {
+            label: "Chặn (Block)",
+            value: "block",
+            description: "Không chạy lệnh này, trả về lỗi cho agent",
+        },
+    ];
+    // Allow-session only for less severe blocks
+    if (info.kind !== "catastrophic") {
+        options.splice(1, 0, {
+            label: "Cho phép cả phiên (Allow session)",
+            value: "allow-session",
+            description: "Cho phép tất cả lệnh tương tự trong phiên này",
+        });
+    }
+    return {
+        question,
+        detail: detailLines.join("\n"),
+        options,
+        defaultIndex: options.findIndex((o) => o.value === "block"),
+    };
+}
+/**
+ * Build a safe alternative suggestion for a blocked command.
+ * Returns null when no canned alternative exists.
+ */
+export function suggestAlternative(kind, command) {
+    if (kind === "empty-bash") {
+        return 'Provide a real command, e.g. {"command":"ls -la"}';
+    }
+    // sqlite3 / .db access on Windows
+    if (/sqlite3|\.db\b/i.test(command)) {
+        return "Use the filesystem MCP or write_file to read the DB file instead of shelling sqlite3";
+    }
+    // rm -rf patterns
+    if (/rm\s+-rf/i.test(command)) {
+        return "Explicitly list files to remove, or use move to trash";
+    }
+    return undefined;
+}
+//# sourceMappingURL=safety-askcard.js.map

package/dist/src/orchestrator/sandbox.test.js

@@ -39,21 +39,23 @@ afterEach(() => {
     vi.doUnmock("../storage/index.js");
 });
 describe("Agent sandbox mode", { timeout: 30_000 }, () => {
-    it("can switch sandbox mode at runtime", async () => {
+    it("can switch sandbox mode at runtime — always 'off' (sandbox removed)", async () => {
         const { Agent } = await importAgentModule();
         const agent = new Agent(undefined, undefined, undefined, undefined, {
             persistSession: false,
             sandboxMode: "off",
         });
         expect(agent.getSandboxMode()).toBe("off");
+        // Sandbox has been removed: setSandboxMode is a no-op stub.
+        // The mode remains "off" regardless of what is passed.
         agent.setSandboxMode("shuru");
-        expect(agent.getSandboxMode()).toBe("shuru");
+        expect(agent.getSandboxMode()).toBe("off");
     });
-    it("passes sandbox mode into background delegations", async () => {
+    it("passes sandbox mode into background delegations — always 'off' (sandbox removed)", async () => {
         const { Agent } = await importAgentModule();
         const agent = new Agent(undefined, undefined, undefined, undefined, {
             persistSession: false,
-            sandboxMode: "shuru",
+            sandboxMode: "shuru", // accepted for back-compat but ignored
         });
         const startMock = vi.fn(async () => ({ success: true, output: "ok" }));
         agent.delegations.start = startMock;
@@ -62,7 +64,8 @@ describe("Agent sandbox mode", { timeout: 30_000 }, () => {
             description: "Inspect",
             prompt: "Look around",
         });
-        expect(startMock).toHaveBeenCalledWith(expect.objectContaining({ agent: "explore" }), expect.objectContaining({ sandboxMode: "shuru" }));
+        // Sandbox removed: delegations always receive sandboxMode: "off".
+        expect(startMock).toHaveBeenCalledWith(expect.objectContaining({ agent: "explore" }), expect.objectContaining({ sandboxMode: "off" }));
     });
     it("can get and set sandbox settings", async () => {
         const { Agent } = await importAgentModule();

package/dist/src/orchestrator/scope-ceiling.js

@@ -80,7 +80,7 @@ export function parseBudgetOverride(raw) {
         return { override: undefined, cleanedPrompt: raw };
     // Strip the entire matched segment including its leading/trailing whitespace
     // and re-collapse the surrounding spaces.
-    const cleaned = (raw.slice(0, match.index ?? 0) + " " + raw.slice((match.index ?? 0) + match[0].length))
+    const cleaned = `${raw.slice(0, match.index ?? 0)} ${raw.slice((match.index ?? 0) + match[0].length)}`
         .replace(/\s+/g, " ")
         .trim();
     return { override: n, cleanedPrompt: cleaned };

package/dist/src/orchestrator/stall-watchdog.d.ts

@@ -57,6 +57,53 @@ export interface StallRepromptState {
  * effects) so it is unit-testable in isolation from the orchestrator loop.
  */
 export declare function shouldRepromptStall(s: StallRepromptState): boolean;
+/** Inputs to the mid-loop stall continuation decision — see {@link shouldContinueAfterMidLoopStall}. */
+export interface MidLoopStallState {
+    /** The watchdog fired for this attempt. */
+    stallTriggered: boolean;
+    /**
+     * Real content parts received across the WHOLE streamText attempt (all steps).
+     * `> 0` proves earlier tool steps already ran — so this is NOT a time-to-first-
+     * byte stall (that case is handled by {@link shouldRepromptStall}).
+     */
+    chunksThisAttempt: number;
+    /**
+     * Real content parts received since the last step boundary (reset in
+     * `prepareStep`). `0` means the in-flight step's provider request produced no
+     * byte before the watchdog fired — a dead socket on a SINGLE step, with every
+     * prior step fully completed. Safe to continue: the completed steps'
+     * assistant+tool messages are appended to history before re-issuing, so no
+     * tool is re-run and no text is duplicated.
+     */
+    chunksThisStep: number;
+    /** How many mid-loop continuations have already happened this turn. */
+    retryCount: number;
+    /** Configured cap (getProviderStallRetries); 0 disables continuation. */
+    maxRetries: number;
+    /** True on genuine user cancel (never continue over a cancel). */
+    aborted: boolean;
+}
+/**
+ * Decide whether a fired stall watchdog should CONTINUE the turn (append the
+ * completed steps' messages, then re-issue streamText to resume from the
+ * stalled step) instead of falling through to the partial-answer rescue.
+ *
+ * This is the mid-loop counterpart to {@link shouldRepromptStall}. The TTFB
+ * re-prompt restarts the WHOLE request from the original prompt, so it is gated
+ * on `chunksThisAttempt === 0` to avoid re-running tools. Continuation instead
+ * preserves all completed steps in history (assistant tool-calls + their
+ * tool-results), so re-issuing cannot re-run a tool — making it safe even when
+ * earlier steps had side effects (writes, commits).
+ *
+ * Qualifies ONLY when: the watchdog fired, earlier steps ran
+ * (`chunksThisAttempt > 0`), the CURRENT step produced nothing
+ * (`chunksThisStep === 0` → a clean dead socket, no partial text to duplicate),
+ * under the retry cap, and not a user cancel. A step that emitted partial text
+ * then stalled (`chunksThisStep > 0`) falls through to rescue instead, since
+ * re-issuing would duplicate that partial output. Pure (no side effects) so it
+ * is unit-testable in isolation from the orchestrator loop.
+ */
+export declare function shouldContinueAfterMidLoopStall(s: MidLoopStallState): boolean;
 /**
  * Exponential backoff (ms, capped at 4s) before the Nth stall re-prompt
  * (1-based): 500 → 1000 → 2000 → 4000 → 4000.

package/dist/src/orchestrator/stall-watchdog.js

@@ -40,6 +40,29 @@ export function shouldRepromptStall(s) {
         s.assistantTextEmpty &&
         !s.aborted);
 }
+/**
+ * Decide whether a fired stall watchdog should CONTINUE the turn (append the
+ * completed steps' messages, then re-issue streamText to resume from the
+ * stalled step) instead of falling through to the partial-answer rescue.
+ *
+ * This is the mid-loop counterpart to {@link shouldRepromptStall}. The TTFB
+ * re-prompt restarts the WHOLE request from the original prompt, so it is gated
+ * on `chunksThisAttempt === 0` to avoid re-running tools. Continuation instead
+ * preserves all completed steps in history (assistant tool-calls + their
+ * tool-results), so re-issuing cannot re-run a tool — making it safe even when
+ * earlier steps had side effects (writes, commits).
+ *
+ * Qualifies ONLY when: the watchdog fired, earlier steps ran
+ * (`chunksThisAttempt > 0`), the CURRENT step produced nothing
+ * (`chunksThisStep === 0` → a clean dead socket, no partial text to duplicate),
+ * under the retry cap, and not a user cancel. A step that emitted partial text
+ * then stalled (`chunksThisStep > 0`) falls through to rescue instead, since
+ * re-issuing would duplicate that partial output. Pure (no side effects) so it
+ * is unit-testable in isolation from the orchestrator loop.
+ */
+export function shouldContinueAfterMidLoopStall(s) {
+    return (s.stallTriggered && s.chunksThisAttempt > 0 && s.chunksThisStep === 0 && s.retryCount < s.maxRetries && !s.aborted);
+}
 /**
  * Exponential backoff (ms, capped at 4s) before the Nth stall re-prompt
  * (1-based): 500 → 1000 → 2000 → 4000 → 4000.

package/dist/src/orchestrator/stall-watchdog.test.js

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { createStallWatchdog, STALL_ABORT_REASON, shouldRepromptStall, stallRepromptBackoffMs, } from "./stall-watchdog.js";
+import { createStallWatchdog, STALL_ABORT_REASON, shouldContinueAfterMidLoopStall, shouldRepromptStall, stallRepromptBackoffMs, } from "./stall-watchdog.js";
 describe("createStallWatchdog", () => {
     beforeEach(() => vi.useFakeTimers());
     afterEach(() => vi.useRealTimers());
@@ -103,6 +103,41 @@ describe("shouldRepromptStall", () => {
         expect(shouldRepromptStall(ttfb({ aborted: true }))).toBe(false);
     });
 });
+describe("shouldContinueAfterMidLoopStall", () => {
+    // A clean mid-loop dead socket: watchdog fired AFTER earlier steps ran
+    // (chunksThisAttempt > 0), but the in-flight step produced nothing
+    // (chunksThisStep === 0). The ONLY shape that continues. Distinct from the
+    // TTFB re-prompt, which requires chunksThisAttempt === 0.
+    const midLoop = (over = {}) => ({
+        stallTriggered: true,
+        chunksThisAttempt: 132, // 66 prior steps' worth of chunks
+        chunksThisStep: 0,
+        retryCount: 0,
+        maxRetries: 1,
+        aborted: false,
+        ...over,
+    });
+    it("continues a mid-loop dead-socket stall under the cap", () => {
+        expect(shouldContinueAfterMidLoopStall(midLoop())).toBe(true);
+    });
+    it("does NOT continue when the watchdog never fired", () => {
+        expect(shouldContinueAfterMidLoopStall(midLoop({ stallTriggered: false }))).toBe(false);
+    });
+    it("does NOT continue a time-to-first-byte stall (chunksThisAttempt === 0 → TTFB re-prompt owns it)", () => {
+        expect(shouldContinueAfterMidLoopStall(midLoop({ chunksThisAttempt: 0 }))).toBe(false);
+    });
+    it("does NOT continue when the stalled step already emitted output (would duplicate)", () => {
+        expect(shouldContinueAfterMidLoopStall(midLoop({ chunksThisStep: 3 }))).toBe(false);
+    });
+    it("does NOT continue once the retry cap is reached", () => {
+        expect(shouldContinueAfterMidLoopStall(midLoop({ retryCount: 1, maxRetries: 1 }))).toBe(false);
+        // maxRetries=0 means the feature is disabled — never continue.
+        expect(shouldContinueAfterMidLoopStall(midLoop({ retryCount: 0, maxRetries: 0 }))).toBe(false);
+    });
+    it("does NOT continue over a genuine user cancel", () => {
+        expect(shouldContinueAfterMidLoopStall(midLoop({ aborted: true }))).toBe(false);
+    });
+});
 describe("stallRepromptBackoffMs", () => {
     it("grows exponentially and caps at 4s", () => {
         expect(stallRepromptBackoffMs(1)).toBe(500);