muonroi-cli 1.7.2 → 1.8.0

package/dist/src/council/debate.js

@@ -31,6 +31,33 @@ const MAX_EMPTY_WITH_TOOLS = 2;
 const ABSOLUTE_MAX_ROUNDS = 8;
 /** Default initial round budget when the planner does not propose one. */
 const DEFAULT_PLANNED_ROUNDS = 3;
+/**
+ * Per-kind hard ceiling on debate rounds — the leader may extend up to this, never
+ * past it. Discussion-style debates (decision / evaluation / investigation) converge
+ * fast, so capping them at 3 stops a simple "X or Y?" from burning 5-8 rounds of
+ * diminishing returns. Observed live (2026-06-20): a Redis-vs-in-memory decision ran
+ * 5 rounds / ~10 min on a slow provider, and the leader's own round-5 note was
+ * "remaining disagreements are minor and further rounds would repeat established
+ * positions" — i.e. rounds 4-5 added latency, not signal. Greenfield exploration
+ * keeps more breadth (5). Kinds absent here fall back to ABSOLUTE_MAX_ROUNDS.
+ */
+const KIND_MAX_ROUNDS = {
+    implementation_plan: 3,
+    decision: 3,
+    evaluation: 3,
+    investigation: 3,
+    exploration: 5,
+};
+/**
+ * Resolve the initial round budget + hard ceiling from the plan's output-shape kind
+ * and the planner-proposed round count. Pure + exported for unit testing the cap.
+ */
+export function resolveDebateRoundBudget(planKind, plannedRounds) {
+    const kindCap = planKind !== undefined ? KIND_MAX_ROUNDS[planKind] : undefined;
+    const effectiveCeiling = Math.min(ABSOLUTE_MAX_ROUNDS, kindCap ?? ABSOLUTE_MAX_ROUNDS);
+    const maxRounds = Math.min(effectiveCeiling, Math.max(1, typeof plannedRounds === "number" && plannedRounds > 0 ? plannedRounds : DEFAULT_PLANNED_ROUNDS));
+    return { maxRounds, effectiveCeiling, kindCapped: kindCap !== undefined };
+}
 /** Cap on the size of a single archived position. Anything longer is
  * trimmed and reported via `length`. Mirrors the goal of keeping the
  * follow-up memory record small enough to be reloaded cheaply. */
@@ -42,6 +69,39 @@ function makeExcerpt(text) {
         length: trimmed.length,
     };
 }
+/**
+ * Emit the observe-only `council-turn-length` harness event for one fully-assembled
+ * speaker turn (opening statement or discussion turn). Reports char + word count so
+ * a harness can measure council verbosity per role/model/round — NO truncation, NO
+ * behaviour change. Best-effort: a no-op when the agent runtime is absent (normal
+ * user mode) or the event kind is filtered out (MUONROI_HARNESS_EVENTS). Uses the
+ * same globalThis.__muonroiAgentRuntime emitter as sprint-runner.ts.
+ */
+function emitCouncilTurnLength(args) {
+    try {
+        const ar = globalThis.__muonroiAgentRuntime;
+        if (!ar || typeof ar.emitEvent !== "function")
+            return;
+        const trimmed = args.text.trim();
+        ar.emitEvent({
+            t: "event",
+            kind: "council-turn-length",
+            role: args.role,
+            round: args.round,
+            charCount: trimmed.length,
+            wordCount: trimmed.length === 0 ? 0 : trimmed.split(/\s+/).filter(Boolean).length,
+            model: args.model,
+            correlationId: args.correlationId,
+        });
+    }
+    catch (err) {
+        // Observe-only telemetry — swallow so a harness hiccup can't break a debate turn.
+        // Logged only under MUONROI_DEBUG_HARNESS (No-Silent-Catch) to keep TUI output clean.
+        if (process.env.MUONROI_DEBUG_HARNESS === "1") {
+            console.error(`[council] council-turn-length emit failed: ${err?.message ?? String(err)}`);
+        }
+    }
+}
 /**
  * Lock-phrase detector. Counts what fraction of pair-turns in the latest round
  * contain explicit convergence signals. When ≥80% of pair-turns signal "lock",
@@ -215,6 +275,10 @@ async function debateWithRetry(llm, model, system, prompt, signal, traceCb, tool
 }
 export async function* runDebate(spec, config, llm) {
     const { leaderModelId, participants, conversationContext, signal, debatePlan } = config;
+    // Correlation id for the observe-only council-turn-length telemetry (groups
+    // per-turn length samples by run). sessionId in production; a stable literal
+    // for direct callers/tests that omit runId.
+    const turnCorrelationId = config.runId ?? "council";
     const researchSkipOverride = config.researchSkipOverride === true;
     const leaderNeedsResearch = config.leaderNeedsResearch;
     const internetFirst = config.internetFirst === true;
@@ -352,6 +416,13 @@ export async function* runDebate(spec, config, llm) {
                     attempts: o.attempts,
                 },
             };
+            emitCouncilTurnLength({
+                role: speakerRole,
+                round: 0,
+                text: o.position,
+                model: o.model,
+                correlationId: turnCorrelationId,
+            });
         }
     }
     yield phaseDone({
@@ -378,14 +449,9 @@ export async function* runDebate(spec, config, llm) {
     // absolute ceiling still applies there.
     let roundCount = 0;
     const planKind = debatePlan?.outputShape?.kind;
-    const KIND_MAX_ROUNDS = {
-        implementation_plan: 3,
-    };
-    const kindCap = planKind ? KIND_MAX_ROUNDS[planKind] : undefined;
-    const initialPlanned = debatePlan?.plannedRounds;
-    const effectiveCeiling = Math.min(ABSOLUTE_MAX_ROUNDS, kindCap ?? ABSOLUTE_MAX_ROUNDS);
-    let maxRounds = Math.min(effectiveCeiling, Math.max(1, typeof initialPlanned === "number" && initialPlanned > 0 ? initialPlanned : DEFAULT_PLANNED_ROUNDS));
-    const ceilingNote = kindCap
+    const { maxRounds: plannedMaxRounds, effectiveCeiling, kindCapped, } = resolveDebateRoundBudget(planKind, debatePlan?.plannedRounds);
+    let maxRounds = plannedMaxRounds;
+    const ceilingNote = kindCapped
         ? ` (hard ceiling ${effectiveCeiling} for ${planKind})`
         : ` (hard ceiling ${ABSOLUTE_MAX_ROUNDS})`;
     yield {
@@ -401,6 +467,13 @@ export async function* runDebate(spec, config, llm) {
     // — the LLM is clearly under provider stress and more rounds won't help.
     let consecutiveRoundFailures = 0;
     for (let round = 1; round <= maxRounds; round++) {
+        // User cancelled mid-debate — stop before spending another round of
+        // parallel pair LLM calls. The caller (runCouncil) re-checks the signal at
+        // its next phase boundary and skips synthesis too.
+        if (signal?.aborted) {
+            yield { type: "content", content: `\n> Debate cancelled by user.\n` };
+            break;
+        }
         roundCount = round;
         const p2Start = Date.now();
         const roundPhaseId = `phase:round-${round}`;
@@ -627,6 +700,13 @@ export async function* runDebate(spec, config, llm) {
                             attempts: chunk.attempts,
                         },
                     };
+                    emitCouncilTurnLength({
+                        role: speakerName,
+                        round,
+                        text: chunk.text,
+                        model: modelId,
+                        correlationId: turnCorrelationId,
+                    });
                 }
                 for (const trace of chunk.traces ?? []) {
                     yield { type: "council_status", content: trace };

package/dist/src/council/index.d.ts

@@ -1,10 +1,31 @@
 import type { ModelMessage } from "ai";
 import type { StreamChunk } from "../types/index.js";
 import type { CouncilLLM, CouncilStats, PreflightResponder, QuestionResponder } from "./types.js";
+/**
+ * Wrap a CouncilLLM so every `generate` call inherits the council-wide abort
+ * signal. The whole generate-based call path (clarifier, research-need eval,
+ * leader round-eval, opening statements, round summary, spec/plan synthesis,
+ * and the debate-planner retry) calls `llm.generate(...)` with NO signal arg —
+ * none of those sites thread one. Injecting it here in ONE place makes them all
+ * cancellable without touching each signature. `debate`/`research` already get
+ * `config.signal` explicitly, so they pass through unchanged.
+ *
+ * An explicit per-call signal (none exist today, but the param is there) wins
+ * over the injected one. Returns the original llm untouched when no signal is
+ * configured (e.g. the sprint-planner path, which has no user-abort signal).
+ */
+export declare function withCouncilSignal(llm: CouncilLLM, signal: AbortSignal | undefined): CouncilLLM;
 export interface RunCouncilOptions {
     skipClarification?: boolean;
     userModelMessage?: ModelMessage;
     signal?: AbortSignal;
+    /**
+     * Hard cap on clarification rounds for the explicit /council path. Defaults to
+     * EXPLICIT_COUNCIL_CLARIFY_ROUNDS (1). Callers that genuinely want the full
+     * multi-round ready-gate can raise it; auto-council/sprint pass
+     * skipClarification:true and never reach the clarifier regardless.
+     */
+    clarifyMaxRounds?: number;
     /** Working directory used to resolve the "current project" snapshot. */
     cwd?: string;
     /** Shared stats object from orchestrator — when provided, runCouncil uses it instead of a local one so stats.calls is accurate (Phase 14 CQ-01). */
@@ -15,8 +36,32 @@ export interface RunCouncilOptions {
      */
     runDir?: string;
 }
+export type PostDebateAction = "save_exit" | "generate_plan" | "refine" | "ask_followup" | "retry_synthesis";
+/**
+ * Decide the DEFAULT post-debate action surfaced as the recommended option.
+ * Extracted as a pure function so the policy is unit-testable.
+ *
+ * Issue #3 (post-debate default mismatch): when synthesis succeeded and no plan
+ * exists yet, only an `implementation_plan`-shaped debate should default to
+ * "generate_plan" (Lock plan & execute Sprint 1). For a `decision`, `evaluation`,
+ * `investigation`, or `exploration` debate the synthesis IS the deliverable — the
+ * user asked a question, not for code — so the default is `save_exit`. The
+ * generate_plan OPTION is still offered downstream; it's just no longer the
+ * pre-selected default for non-build topics.
+ */
+export declare function pickPostDebateRecommendation(input: {
+    synthesisFailed: boolean;
+    hasEmptySections: boolean;
+    refinementTopics: string[];
+    confidenceLevel: "high" | "medium" | "low";
+    hasPlan: boolean;
+    outputKind: string;
+}): {
+    value: PostDebateAction;
+    reason: string;
+};
 export declare function runCouncil(topic: string, sessionModelId: string, messages: Array<{
     role: string;
     content: string | unknown;
-}>, sessionId: string | undefined, llm: CouncilLLM, respondToQuestion: QuestionResponder, respondToPreflight: PreflightResponder, processMessageFn: (message: string) => AsyncGenerator<StreamChunk, void, unknown>, options?: RunCouncilOptions): AsyncGenerator<StreamChunk, string | null, unknown>;
+}>, sessionId: string | undefined, rawLlm: CouncilLLM, respondToQuestion: QuestionResponder, respondToPreflight: PreflightResponder, processMessageFn: (message: string) => AsyncGenerator<StreamChunk, void, unknown>, options?: RunCouncilOptions): AsyncGenerator<StreamChunk, string | null, unknown>;
 export type { ClarifiedSpec, CouncilLLM, CouncilParticipant, CouncilStats } from "./types.js";

package/dist/src/council/index.js

@@ -15,9 +15,91 @@ import { resolveLeaderModelDetailed, resolveParticipants } from "./leader.js";
 import { phaseDone, phaseStart } from "./phase-events.js";
 import { runPlanning } from "./planner.js";
 import { runPreflight } from "./preflight.js";
-export async function* runCouncil(topic, sessionModelId, messages, sessionId, llm, respondToQuestion, respondToPreflight, processMessageFn, options) {
+/**
+ * Wrap a CouncilLLM so every `generate` call inherits the council-wide abort
+ * signal. The whole generate-based call path (clarifier, research-need eval,
+ * leader round-eval, opening statements, round summary, spec/plan synthesis,
+ * and the debate-planner retry) calls `llm.generate(...)` with NO signal arg —
+ * none of those sites thread one. Injecting it here in ONE place makes them all
+ * cancellable without touching each signature. `debate`/`research` already get
+ * `config.signal` explicitly, so they pass through unchanged.
+ *
+ * An explicit per-call signal (none exist today, but the param is there) wins
+ * over the injected one. Returns the original llm untouched when no signal is
+ * configured (e.g. the sprint-planner path, which has no user-abort signal).
+ */
+export function withCouncilSignal(llm, signal) {
+    if (!signal)
+        return llm;
+    return {
+        ...llm,
+        generate: (modelId, system, prompt, maxTokens, onUsage, sig) => llm.generate(modelId, system, prompt, maxTokens, onUsage, sig ?? signal),
+    };
+}
+/**
+ * Explicit `/council …` is the ONLY caller that runs the clarifier — auto-council
+ * (message-processor) and the sprint-planner both pass `skipClarification: true`.
+ * Capping it to a single round (down from the ready-gate's MAX_CLARIFY_ROUNDS=12)
+ * stops the 2-3 rounds of follow-up askcards users hit on already-detailed topics
+ * (see project-council-subsystem memory). The per-round ready-gate has no
+ * production behavioural effect anyway — `spec.ready`/`confidenceScore`/
+ * `remainingGaps` are write-only — so its only real cost is the extra rounds.
+ * Round 0 still runs, so the user is asked the key questions exactly once.
+ */
+const EXPLICIT_COUNCIL_CLARIFY_ROUNDS = 1;
+/**
+ * Decide the DEFAULT post-debate action surfaced as the recommended option.
+ * Extracted as a pure function so the policy is unit-testable.
+ *
+ * Issue #3 (post-debate default mismatch): when synthesis succeeded and no plan
+ * exists yet, only an `implementation_plan`-shaped debate should default to
+ * "generate_plan" (Lock plan & execute Sprint 1). For a `decision`, `evaluation`,
+ * `investigation`, or `exploration` debate the synthesis IS the deliverable — the
+ * user asked a question, not for code — so the default is `save_exit`. The
+ * generate_plan OPTION is still offered downstream; it's just no longer the
+ * pre-selected default for non-build topics.
+ */
+export function pickPostDebateRecommendation(input) {
+    if (input.synthesisFailed) {
+        return {
+            value: "retry_synthesis",
+            reason: "Re-run synthesis with a compact prompt — usually clears provider-timeout failures.",
+        };
+    }
+    if (input.hasEmptySections) {
+        return { value: "refine", reason: `Fill in ${input.refinementTopics.length} section(s) the debate left empty.` };
+    }
+    if (input.confidenceLevel === "low") {
+        return {
+            value: "ask_followup",
+            reason: "Press the council on the weakest claims rather than accepting a thin synthesis.",
+        };
+    }
+    if (!input.hasPlan) {
+        return input.outputKind === "implementation_plan"
+            ? { value: "generate_plan", reason: "Convert the agreed outcome into concrete steps." }
+            : {
+                value: "save_exit",
+                reason: `This was a ${input.outputKind} debate — the synthesis above is the deliverable; save it.`,
+            };
+    }
+    return { value: "save_exit", reason: "Outcome looks solid — save and move on." };
+}
+export async function* runCouncil(topic, sessionModelId, messages, sessionId, rawLlm, respondToQuestion, respondToPreflight, processMessageFn, options) {
     const stats = options?.councilStats ?? { calls: 0, startMs: Date.now(), phases: [] };
     const costAware = isCouncilCostAware();
+    // Inject the user-abort signal into every generate-based sub-call (clarify,
+    // research-need, leader-eval, opening, summary, synthesis, debate-plan retry).
+    // No-op passthrough when options.signal is undefined.
+    const llm = withCouncilSignal(rawLlm, options?.signal);
+    // Hard-stop guard. Threading the signal into LLM calls makes them abortable,
+    // but every council sub-phase wraps its work in fail-open try/catch that
+    // swallows the resulting AbortError and returns normally — so without an
+    // explicit check at each phase boundary the loop would march on to the next
+    // phase after a cancel. `userAborted()` is checked between phases; when true
+    // the run stops cleanly rather than burning the remaining (debate, synthesis)
+    // LLM budget. Cancellation latency is bounded by one in-flight sub-call.
+    const userAborted = () => options?.signal?.aborted === true;
     // ── Resolve models ──────────────────────────────────────────────────────────
     const leaderResolution = await resolveLeaderModelDetailed(sessionModelId);
     const leaderModelId = leaderResolution.modelId;
@@ -50,6 +132,11 @@ export async function* runCouncil(topic, sessionModelId, messages, sessionId, ll
         : baseContext;
     const internetFirst = projectInfo.isEmpty;
     const active = participants.map((p) => ({ ...p, position: "" }));
+    if (userAborted()) {
+        yield { type: "content", content: "\n> Council cancelled by user.\n" };
+        yield { type: "done" };
+        return null;
+    }
     // ── Phase A + B loop: Clarify → Confirm ─────────────────────────────────────
     let spec = buildSpecFromTopic(topic, conversationContext);
     let approved = false;
@@ -76,7 +163,7 @@ export async function* runCouncil(topic, sessionModelId, messages, sessionId, ll
                     content: `\n> Clarification seeded by PIL (${pilSeed.length} gray-area question${pilSeed.length === 1 ? "" : "s"}).\n`,
                 };
             }
-            const clarifyGen = runClarification(topic, leaderModelId, conversationContext, respondToQuestion, llm, options?.signal, pilSeed, undefined, undefined, costAware);
+            const clarifyGen = runClarification(topic, leaderModelId, conversationContext, respondToQuestion, llm, options?.signal, pilSeed, options?.clarifyMaxRounds ?? EXPLICIT_COUNCIL_CLARIFY_ROUNDS, undefined, costAware);
             let clarifyResult;
             do {
                 clarifyResult = await clarifyGen.next();
@@ -90,6 +177,9 @@ export async function* runCouncil(topic, sessionModelId, messages, sessionId, ll
             spec = buildSpecFromTopic(topic, conversationContext);
             yield { type: "content", content: `\n> Auto-council: skipping clarification (PIL pre-classified).\n` };
         }
+        // Cancelled during clarification — don't pop the preflight approval card.
+        if (userAborted())
+            break;
         const researchNeeded = true;
         const preflightGen = runPreflight(spec, participants, researchNeeded, respondToPreflight, {
             repoEmpty: internetFirst,
@@ -105,6 +195,11 @@ export async function* runCouncil(topic, sessionModelId, messages, sessionId, ll
         approved = preflightResult.value;
     }
     stats.phases.push({ name: "clarify+preflight", durationMs: Date.now() - phaseAStart });
+    if (userAborted()) {
+        yield { type: "content", content: "\n> Council cancelled by user.\n" };
+        yield { type: "done" };
+        return null;
+    }
     // ── Research-need check + user override ────────────────────────────────────
     // Leader-LLM decides if research is required. If yes, give the user a chance
     // to skip — research is the slowest part of council and trivial questions
@@ -171,6 +266,11 @@ export async function* runCouncil(topic, sessionModelId, messages, sessionId, ll
             content: `\n> [Experience] ${eeResult.warnings.length} past warning(s) loaded — Experience Auditor will calibrate debate.\n`,
         };
     }
+    if (userAborted()) {
+        yield { type: "content", content: "\n> Council cancelled by user.\n" };
+        yield { type: "done" };
+        return null;
+    }
     // ── Phase B.5: Leader plans the debate (stances + output shape) ─────────────
     const planStartMs = Date.now();
     yield phaseStart({
@@ -179,7 +279,7 @@ export async function* runCouncil(topic, sessionModelId, messages, sessionId, ll
         label: "Debate plan",
         detail: "stances + output shape",
     });
-    const planGenerator = planDebate(spec, leaderModelId, llm, eeResult.warnings, experienceMode, pilCtx?.taskType ?? undefined, pilCtx?.complexityTier ?? undefined);
+    const planGenerator = planDebate(spec, leaderModelId, llm, eeResult.warnings, experienceMode, pilCtx?.taskType ?? undefined, pilCtx?.complexityTier ?? undefined, options?.signal);
     let planStep;
     do {
         planStep = await planGenerator.next();
@@ -222,6 +322,11 @@ export async function* runCouncil(topic, sessionModelId, messages, sessionId, ll
         active.length = debatePlan.stances.length;
     }
     stats.phases.push({ name: "plan_debate", durationMs: Date.now() - planStartMs });
+    if (userAborted()) {
+        yield { type: "content", content: "\n> Council cancelled by user.\n" };
+        yield { type: "done" };
+        return null;
+    }
     // ── Phase C: Dynamic Debate ─────────────────────────────────────────────────
     const debateStart = Date.now();
     const debateGen = runDebate(spec, {
@@ -235,6 +340,7 @@ export async function* runCouncil(topic, sessionModelId, messages, sessionId, ll
         leaderNeedsResearch,
         internetFirst,
         costAware,
+        runId: sessionId,
     }, llm);
     let debateResult;
     do {
@@ -270,6 +376,11 @@ export async function* runCouncil(topic, sessionModelId, messages, sessionId, ll
         durationMs: Date.now() - debateStart,
         data: { topic, roundCount: debateState.roundCount },
     });
+    if (userAborted()) {
+        yield { type: "content", content: "\n> Council cancelled by user — skipping synthesis.\n" };
+        yield { type: "done" };
+        return null;
+    }
     // ── Phase D: Plan ───────────────────────────────────────────────────────────
     const planStart = Date.now();
     const planGen = runPlanning(debateState, spec, debateState.active, leaderModelId, respondToPreflight, llm, debatePlan, pilCtx?.outputStyle ?? undefined);
@@ -338,22 +449,17 @@ export async function* runCouncil(topic, sessionModelId, messages, sessionId, ll
                     : confidenceLevel === "medium"
                         ? `⚠ Medium confidence (evidence density ${evidenceDensity.toFixed(2)})`
                         : `⚠ Low confidence (evidence density ${evidenceDensity.toFixed(2)})`;
-            // Recommendation surfaced to the user as the default action.
-            const recommendation = synthesisFailed
-                ? {
-                    value: "retry_synthesis",
-                    reason: "Re-run synthesis with a compact prompt — usually clears provider-timeout failures.",
-                }
-                : hasEmptySections
-                    ? { value: "refine", reason: `Fill in ${refinementTopics.length} section(s) the debate left empty.` }
-                    : confidenceLevel === "low"
-                        ? {
-                            value: "ask_followup",
-                            reason: "Press the council on the weakest claims rather than accepting a thin synthesis.",
-                        }
-                        : !hasPlan
-                            ? { value: "generate_plan", reason: "Convert the agreed outcome into concrete steps." }
-                            : { value: "save_exit", reason: "Outcome looks solid — save and move on." };
+            // Recommendation surfaced to the user as the default action. The
+            // implementation_plan-vs-decision/evaluation split lives in
+            // pickPostDebateRecommendation (issue #3 — see its doc comment).
+            const recommendation = pickPostDebateRecommendation({
+                synthesisFailed,
+                hasEmptySections,
+                refinementTopics,
+                confidenceLevel,
+                hasPlan: !!hasPlan,
+                outputKind: debatePlan.outputShape.kind,
+            });
             const baseOptions = [];
             if (synthesisFailed) {
                 baseOptions.push({

package/dist/src/council/llm.js

@@ -4,8 +4,8 @@ import { getDefaultEEClient } from "../ee/intercept.js";
 import { emitMatches } from "../ee/render.js";
 import { buildMcpToolSet } from "../mcp/runtime.js";
 import { getProviderCapabilities } from "../providers/capabilities.js";
-import { loadKeyForProvider } from "../providers/keychain.js";
-import { createProviderFactory, detectProviderForModel, resolveModelRuntime } from "../providers/runtime.js";
+import { loadKeyForProvider, ProviderKeyMissingError } from "../providers/keychain.js";
+import { createProviderFactoryAsync, detectProviderForModel, resolveModelRuntime } from "../providers/runtime.js";
 import { createBuiltinTools as createTools } from "../tools/registry.js";
 import { appendCostLog } from "../usage/cost-log.js";
 import { projectCostUSD } from "../usage/estimator.js";
@@ -13,6 +13,33 @@ import { withDeadlineRace, withTimeoutSignal } from "../utils/llm-deadline.js";
 import { loadMcpServers } from "../utils/settings.js";
 import { withVisibleRetry } from "../utils/visible-retry.js";
 import { buildResearchSystemPrompt } from "./prompts.js";
+/**
+ * Resolve a provider factory for a council sub-call, OAuth-aware.
+ *
+ * The council reachability gate (`isProviderReachable` in leader.ts) counts
+ * OAuth-authenticated providers as usable (via `getConfiguredProviders`), so a
+ * multi-provider roster can route a stance to an OAuth-only provider such as
+ * xai/grok. `loadKeyForProvider` is API-key-only and throws
+ * `ProviderKeyMissingError` for those — which previously surfaced as
+ * "[Error: No API key found for provider 'xai'.]" on every call of that stance,
+ * even though the provider was fully authenticated. Mirror the main
+ * orchestrator path: fall back to `createProviderFactoryAsync`, which loads +
+ * refreshes the stored OAuth bearer token. Only the expected missing-key case
+ * is swallowed; unexpected errors propagate.
+ */
+async function resolveCouncilFactory(providerId) {
+    let apiKey;
+    try {
+        apiKey = await loadKeyForProvider(providerId);
+    }
+    catch (err) {
+        if (!(err instanceof ProviderKeyMissingError))
+            throw err;
+        // OAuth-only provider — createProviderFactoryAsync injects the bearer token.
+    }
+    const { factory } = await createProviderFactoryAsync(providerId, apiKey ? { apiKey } : {});
+    return factory;
+}
 function getDebugLogPath() {
     const p = process.env.MUONROI_COUNCIL_DEBUG_LOG;
     return p && p.length > 0 ? p : null;
@@ -184,7 +211,7 @@ const COUNCIL_LLM_TIMEOUT_MS = (() => {
 // implementation. Imported at the top of this file.
 export function createCouncilLLM(bash, mode, sessionId, stats) {
     return {
-        async generate(modelId, system, prompt, maxTokens = 4096, onUsage) {
+        async generate(modelId, system, prompt, maxTokens = 4096, onUsage, signal) {
             const mock = getMockLlm();
             if (mock) {
                 stats.calls++;
@@ -192,11 +219,14 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                 return result.text;
             }
             const providerId = detectProviderForModel(modelId);
-            const key = await loadKeyForProvider(providerId);
-            const { factory } = createProviderFactory(providerId, { apiKey: key });
+            const factory = await resolveCouncilFactory(providerId);
             const runtime = resolveModelRuntime(factory, modelId);
             const t0 = Date.now();
-            const { signal: timedSignal, cleanup: cleanupTimeout } = withTimeoutSignal(undefined, COUNCIL_LLM_TIMEOUT_MS);
+            // Combine the user-abort signal (when threaded from runCouncil) with the
+            // per-call wall-clock deadline. Without the parent signal, an Esc/Ctrl-C
+            // during the longest generate calls (8192-token synthesis, clarify, leader
+            // eval) was a no-op — the call ran to completion or hit the 5-min timeout.
+            const { signal: timedSignal, cleanup: cleanupTimeout } = withTimeoutSignal(signal, COUNCIL_LLM_TIMEOUT_MS);
             try {
                 const result = await withDeadlineRace(() => withVisibleRetry(() => generateText({
                     model: runtime.model,
@@ -211,7 +241,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     maxRetries: 0,
                     ...(runtime.providerOptions ? { providerOptions: runtime.providerOptions } : {}),
                     abortSignal: timedSignal,
-                }), { label: "council.generate" }), COUNCIL_LLM_TIMEOUT_MS + 5_000, "council.generate");
+                }), { label: "council.generate" }), COUNCIL_LLM_TIMEOUT_MS + 5_000, "council.generate", signal);
                 cleanupTimeout();
                 stats.calls++;
                 const durMs = Date.now() - t0;
@@ -273,8 +303,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                 return { text: result.text, toolCalls: [] };
             }
             const providerId = detectProviderForModel(modelId);
-            const key = await loadKeyForProvider(providerId);
-            const { factory } = createProviderFactory(providerId, { apiKey: key });
+            const factory = await resolveCouncilFactory(providerId);
             const runtime = resolveModelRuntime(factory, modelId);
             // Verification tools — re-introduced after the no-tools fix (session
             // a7a5690d2049). The original failure was stepCountIs(4) + full toolset
@@ -352,7 +381,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     maxRetries: 0,
                     ...(runtime.providerOptions ? { providerOptions: runtime.providerOptions } : {}),
                     abortSignal: timedSignal,
-                }), { label: "council.debate" }), COUNCIL_LLM_TIMEOUT_MS + 5_000, "council.debate");
+                }), { label: "council.debate" }), COUNCIL_LLM_TIMEOUT_MS + 5_000, "council.debate", signal);
                 cleanupTimeout();
                 stats.calls++;
                 // No tool calls expected, but the AI SDK shape still has the field —
@@ -430,8 +459,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                 return result.text;
             }
             const providerId = detectProviderForModel(modelId);
-            const key = await loadKeyForProvider(providerId);
-            const { factory } = createProviderFactory(providerId, { apiKey: key });
+            const factory = await resolveCouncilFactory(providerId);
             const runtime = resolveModelRuntime(factory, modelId);
             const builtinTools = createTools(bash, mode);
             // CQ-03: Lazy MCP bundle per research call — fail-open so builtins remain available
@@ -488,7 +516,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     maxRetries: 0,
                     ...(runtime.providerOptions ? { providerOptions: runtime.providerOptions } : {}),
                     abortSignal: timedSignal,
-                }), { label: "council.research" }), researchTimeoutMs + 5_000, "council.research");
+                }), { label: "council.research" }), researchTimeoutMs + 5_000, "council.research", signal);
                 cleanupTimeout();
                 const researchUsage = logCouncilCost({
                     callsite: "council.research",