muonroi-cli 1.7.2 → 1.8.1

package/dist/src/orchestrator/pending-calls.js

@@ -22,6 +22,7 @@ import * as crypto from "node:crypto";
 import { promises as fs } from "node:fs";
 import * as path from "node:path";
 import { getSessionDir } from "../storage/session-dir.js";
+import { logger } from "../utils/logger.js";
 // ─── stableCallId ─────────────────────────────────────────────────────────────
 /**
  * Derives a deterministic call_id from (turnId, toolName, input).
@@ -160,7 +161,7 @@ export function createPendingCallsLog(sessionId) {
                         void finalExists;
                     }
                     catch (err) {
-                        console.warn(`[muonroi-cli] reconcile: could not clean staged path ${tmp}: ${err.message}`);
+                        logger.warn("orchestrator", `reconcile: could not clean staged path ${tmp}`, { error: err });
                     }
                 }
                 // Mark the entry as abandoned in the log.

package/dist/src/orchestrator/preprocessor.d.ts

@@ -0,0 +1,13 @@
+import { runPipeline } from "../pil/pipeline.js";
+import type { StreamChunk } from "../types/index.js";
+import type { MessageProcessorDeps } from "./message-processor.js";
+import { type ComplexitySize } from "./scope-ceiling.js";
+export interface PreprocessorResult {
+    pilCtx: Awaited<ReturnType<typeof runPipeline>>;
+    _stepCeiling: number;
+    _pilStart: number;
+    _naturalCeiling: number;
+    _ceilingTaskType: string;
+    _ceilingSize: ComplexitySize;
+}
+export declare function prepareTurnContext(deps: MessageProcessorDeps, userMessage: string, _budgetOverride: any): AsyncGenerator<StreamChunk, PreprocessorResult, unknown>;

package/dist/src/orchestrator/preprocessor.js

@@ -0,0 +1,146 @@
+import { runPipeline } from "../pil/pipeline.js";
+import { getSessionLastTask, recordSessionLastTask, resolveCeiling } from "./scope-ceiling.js";
+import { logger } from "../utils/logger.js";
+export async function* prepareTurnContext(deps, userMessage, _budgetOverride) {
+    // PIL: enrich prompt before pushing to messages (D-01, D-03, D-04)
+    // Promise.race timeout of 200ms is inside runPipeline — fail-open guaranteed
+    // --- PIL with discovery (interactive path) ---
+    const pilChunkQueue = [];
+    const pilResponder = deps.councilManager.createQuestionResponder();
+    const discoveryHandler = {
+        askQuestion: async (question) => {
+            pilChunkQueue.push({
+                type: "council_question",
+                content: question.question,
+                councilQuestion: question,
+            });
+            const text = await pilResponder(question.questionId);
+            return { questionId: question.questionId, text, kind: "choice" };
+        },
+    };
+    const _pilStart = Date.now();
+    let pilCtxResolved = null;
+    let pilDone = false;
+    const pilTask = (async () => {
+        try {
+            // Build Pass 4 LLM fallback closure using the orchestrator's already-
+            // constructed provider factory + current model. PIL stays ignorant of
+            // provider wiring — it just receives a `classify(prompt)` callback.
+            let llmFallback;
+            try {
+                const { createLlmClassifier } = await import("../pil/llm-classify.js");
+                llmFallback = createLlmClassifier(deps.requireProvider(), deps.modelId);
+            }
+            catch (err) {
+                logger.error("pil", "LLM fallback wiring failed", { error: err });
+            }
+            // Model-driven clarification proposer (for discovery interview).
+            // The actual task model (via the same provider + modelId) generates the
+            // questions based on raw + CLI enrichment. Then discovery asks user.
+            let clarificationProposer;
+            try {
+                const { createModelClarificationProposer } = await import("../pil/discovery.js");
+                clarificationProposer = createModelClarificationProposer(deps.requireProvider(), deps.modelId);
+            }
+            catch (err) {
+                logger.error("pil", "clarification proposer wiring failed", { error: err });
+            }
+            pilCtxResolved = await runPipeline(userMessage, {
+                resumeDigest: deps.getResumeDigest(),
+                activeRunId: deps.getActiveRunId(),
+                sessionId: deps.session?.id ?? null,
+                interactionHandler: discoveryHandler,
+                llmFallback,
+                clarificationProposer,
+                recentTurnsSummary: deps.buildRecentTurnsSummary(),
+            });
+        }
+        catch (err) {
+            pilCtxResolved = {
+                raw: userMessage,
+                enriched: userMessage,
+                taskType: null,
+                domain: null,
+                confidence: 0,
+                outputStyle: null,
+                tokenBudget: 500,
+                metrics: null,
+                layers: [],
+                gsdPhase: null,
+                activeRunId: null,
+                intentKind: null,
+                fallbackReason: err instanceof Error ? `orchestrator-catch:${err.name}` : "orchestrator-catch:unknown",
+            };
+        }
+        finally {
+            pilDone = true;
+        }
+    })();
+    while (!pilDone) {
+        while (pilChunkQueue.length > 0) {
+            yield pilChunkQueue.shift();
+        }
+        if (!pilDone) {
+            await new Promise((resolve) => setImmediate(resolve));
+        }
+    }
+    while (pilChunkQueue.length > 0) {
+        yield pilChunkQueue.shift();
+    }
+    await pilTask;
+    const pilCtx = pilCtxResolved;
+    // Phase 4 Plan 04 (4B) — resolve per-session step ceiling using
+    // (task_type × complexitySize) matrix. Override (from --budget-rounds N
+    // parsed earlier) wins. When the override differs from the natural
+    // ceiling, emit info toast so the user sees the explicit cap.
+    //
+    // Phase 5 Fix 2 — continuation phrases ("tiếp tục" / "continue") are
+    // classified `general/chitchat` by PIL Layer 1 Pass 0. Resolving the
+    // ceiling from that label collapses the budget to general × small = 5,
+    // which is wrong: the user wants the agent to RESUME the prior task,
+    // not start a generic chitchat. When this session has a recorded
+    // non-chitchat task row, inherit it for ceiling resolution. The Pass 0
+    // classification itself stays general so downstream code (style /
+    // chitchat skip / tools-empty optimization in `BUG-A guard`) reads the
+    // correct intent; only the ceiling row is borrowed.
+    const _pilTaskType = pilCtx.taskType ?? "general";
+    const _pilSize = pilCtx.complexitySize?.size ?? "medium";
+    const _sessionIdForLastTask = deps.session?.id ?? "";
+    const _isContinuationChitchat = _pilTaskType === "general" && pilCtx.intentKind === "chitchat" && _sessionIdForLastTask !== "";
+    const _lastTask = _isContinuationChitchat ? getSessionLastTask(_sessionIdForLastTask) : null;
+    const _ceilingTaskType = _lastTask?.taskType ?? _pilTaskType;
+    const _ceilingSize = _lastTask?.size ?? _pilSize;
+    const _naturalCeiling = resolveCeiling(_ceilingTaskType, _ceilingSize);
+    // Phase 5 Fix 4 (Option A) — make ceiling mutable so the stopWhen
+    // closure can bump it on auto-continue checkpoints. See checkpoint
+    // logic at dynamicStopWhen below for the bump policy.
+    const _stepCeiling = _budgetOverride.override ?? _naturalCeiling;
+    // Record this turn's task row for future continuation inheritance.
+    // Only non-chitchat task turns update the slot.
+    if (_sessionIdForLastTask && _pilTaskType !== "general" && pilCtx.intentKind === "task") {
+        recordSessionLastTask(_sessionIdForLastTask, _pilTaskType, _pilSize);
+    }
+    if (_budgetOverride.override !== undefined && _budgetOverride.override !== _naturalCeiling) {
+        try {
+            const _ar = globalThis.__muonroiAgentRuntime;
+            _ar?.emitEvent({
+                t: "event",
+                kind: "toast",
+                level: "info",
+                text: `override active: ceiling ${_budgetOverride.override}, default was ${_naturalCeiling} (task=${_ceilingTaskType}/size=${_ceilingSize})`,
+            });
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+    return {
+        pilCtx,
+        _stepCeiling,
+        _pilStart,
+        _naturalCeiling,
+        _ceilingTaskType,
+        _ceilingSize: _ceilingSize,
+    };
+}
+//# sourceMappingURL=preprocessor.js.map

package/dist/src/orchestrator/prompts.d.ts

@@ -1,6 +1,8 @@
 import type { AgentMode, TaskRequest } from "../types/index.js";
 import { type CustomSubagentConfig, type SandboxMode, type SandboxSettings } from "../utils/settings.js";
 export declare const MAX_TOOL_ROUNDS: number;
+export declare const HARD_MAX_TOOL_ROUNDS: number;
+export declare const MAX_LLM_CALLS_PER_TURN: number;
 export declare const VISION_MODEL = "grok-4-1-fast-reasoning";
 export declare const COMPUTER_MODEL = "grok-4.20-0309-reasoning";
 /**
@@ -55,6 +57,18 @@ export interface SystemPromptOptions {
      * PIL Layer 1 (intentKind === "chitchat").
      */
     chitchat?: boolean;
+    /**
+     * When true (sub-agent), skip CUSTOM INSTRUCTIONS, skills catalog, and
+     * native capabilities — sub-agents don't need project-level instructions
+     * and can't run the full toolset anyway. Cuts ~6K tokens per sub-agent turn.
+     */
+    subAgent?: boolean;
+    /**
+     * When true (tool-turn, i.e. second+ LLM call in the same user-turn tool
+     * loop), skip native-capabilities and skills sections that were already
+     * shown in the first call. Cuts ~4K tokens per tool round-trip.
+     */
+    toolTurn?: boolean;
 }
 /**
  * Render the LIVE per-turn MCP tool roster as a system-prompt block.
@@ -76,6 +90,8 @@ export interface SystemPromptOptions {
  */
 export declare function buildMcpCapabilityBlock(toolNames: readonly string[]): string;
 export declare function buildSystemPromptParts(cwd: string, mode: AgentMode, sandboxMode: SandboxMode, planContext?: string | null, subagents?: CustomSubagentConfig[], sandboxSettings?: SandboxSettings, providerId?: string, resumeDigest?: string | null, options?: SystemPromptOptions): SystemPromptParts;
+/** Reset the static prefix cache (for tests). */
+export declare function resetStaticPrefixCache(): void;
 export declare function buildSystemPrompt(cwd: string, mode: AgentMode, sandboxMode: SandboxMode, planContext?: string | null, subagents?: CustomSubagentConfig[], sandboxSettings?: SandboxSettings, providerId?: string, resumeDigest?: string | null, options?: SystemPromptOptions): string;
 export declare function buildSubagentPrompt(request: TaskRequest, cwd: string, custom: CustomSubagentConfig | null, sandboxMode: SandboxMode, subagents?: CustomSubagentConfig[], sandboxSettings?: SandboxSettings, providerId?: string): string;
 export declare function formatSandboxPromptSection(sandboxMode: SandboxMode, settings?: SandboxSettings): string;

package/dist/src/orchestrator/prompts.js

@@ -4,22 +4,67 @@ import { buildContractSection } from "../pil/agent-operating-contract.js";
 import { buildNativeCapabilitiesSection } from "../pil/native-capabilities-workbook.js";
 import { getProviderCapabilities } from "../providers/capabilities.js";
 import { loadCustomInstructions } from "../utils/instructions.js";
-import { loadValidSubAgents, } from "../utils/settings.js";
+import { logger } from "../utils/logger.js";
+import { loadUserSettings, loadValidSubAgents, } from "../utils/settings.js";
 import { resolveShell } from "../utils/shell.js";
 import { discoverSkills, formatSkillsForPrompt } from "../utils/skills.js";
-// F3 — hard cap on tool rounds per user turn. Default reduced 75 → 50
-// after session bca83bcbaad1 logged 178 tool calls in a single turn while
-// monotonically growing billed input. Env override allowed range 10..200.
+// F3a — hard cap on tool rounds per user turn. Reduced 100 → 40
+// after session 526a83cf22df logged 2.44M input tokens over 46 LLM calls
+// with 3 turns (seq 33/81/1) consuming 82% of tokens.
+// Env override allowed range 10..400.
+// Env override allowed range 10..400 (or up to 2000 in agent-first).
 function readMaxToolRoundsFromEnv() {
-    const raw = process.env.MUONROI_MAX_TOOL_ROUNDS;
+    const settings = loadUserSettings();
+    const agentFirst = settings.agentFirst !== false &&
+        process.env.MUONROI_AGENT_FIRST !== "0" &&
+        process.env.MUONROI_AGENT_FIRST !== "false";
+    const raw = process.env.MUONROI_MAX_TOOL_ROUNDS || settings.maxToolRounds;
     if (!raw)
-        return 12;
+        return agentFirst ? 200 : 40;
     const n = Number(raw);
     if (!Number.isFinite(n))
-        return 50;
-    return Math.max(10, Math.min(200, Math.floor(n)));
+        return agentFirst ? 200 : 40;
+    const maxLimit = agentFirst ? 2000 : 400;
+    return Math.max(10, Math.min(maxLimit, Math.floor(n)));
 }
 export const MAX_TOOL_ROUNDS = readMaxToolRoundsFromEnv();
+// F3b — HARD cap: absolute non-bumpable ceiling per user turn.
+// Fires AFTER the soft cap has been bumped by the user.
+// Env override allowed range 20..400 (or up to 3000 in agent-first).
+function readHardMaxToolRoundsFromEnv() {
+    const settings = loadUserSettings();
+    const agentFirst = settings.agentFirst !== false &&
+        process.env.MUONROI_AGENT_FIRST !== "0" &&
+        process.env.MUONROI_AGENT_FIRST !== "false";
+    const raw = process.env.MUONROI_HARD_MAX_TOOL_ROUNDS || settings.hardMaxToolRounds;
+    if (!raw)
+        return agentFirst ? 300 : 60;
+    const n = Number(raw);
+    if (!Number.isFinite(n))
+        return agentFirst ? 300 : 60;
+    const maxLimit = agentFirst ? 3000 : 400;
+    return Math.max(20, Math.min(maxLimit, Math.floor(n)));
+}
+export const HARD_MAX_TOOL_ROUNDS = readHardMaxToolRoundsFromEnv();
+// F3c — per-turn LLM call cap: how many streamText() invocations are
+// allowed per user turn.
+// Default 12 (or 100 in agent-first).
+// Env override MUONROI_MAX_LLM_CALLS_PER_TURN, range 3..100 (or up to 500 in agent-first).
+function readMaxLlmCallsPerTurn() {
+    const settings = loadUserSettings();
+    const agentFirst = settings.agentFirst !== false &&
+        process.env.MUONROI_AGENT_FIRST !== "0" &&
+        process.env.MUONROI_AGENT_FIRST !== "false";
+    const raw = process.env.MUONROI_MAX_LLM_CALLS_PER_TURN || settings.maxLlmCallsPerTurn;
+    if (!raw)
+        return agentFirst ? 100 : 12;
+    const n = Number(raw);
+    if (!Number.isFinite(n))
+        return agentFirst ? 100 : 12;
+    const maxLimit = agentFirst ? 500 : 100;
+    return Math.max(3, Math.min(maxLimit, Math.floor(n)));
+}
+export const MAX_LLM_CALLS_PER_TURN = readMaxLlmCallsPerTurn();
 export const VISION_MODEL = "grok-4-1-fast-reasoning";
 export const COMPUTER_MODEL = "grok-4.20-0309-reasoning";
 /**
@@ -62,9 +107,7 @@ export function detectProjectStack(cwd) {
         // Best-effort enrichment: a missing/unreadable cwd simply omits the stack
         // line (the ENVIRONMENT cwd line already surfaces "<unknown>"). Debug-gated
         // so prompt assembly never corrupts the TUI at startup.
-        if (process.env.MUONROI_DEBUG === "1") {
-            console.error(`[orchestrator/prompts] detectProjectStack failed for ${cwd}: ${err?.message}`);
-        }
+        logger.error("orchestrator", `detectProjectStack failed for ${cwd}`, { error: err });
         return "";
     }
     const has = (name) => entries.includes(name);
@@ -143,6 +186,7 @@ function buildEnvironmentBlock() {
         if (platform === "win32") {
             shellRules.push('- When a Windows-native command is genuinely needed, invoke it explicitly: `cmd.exe /c "command"` or `powershell -NoProfile -Command "command"`.');
         }
+        shellRules.push("- CRITICAL: Batch independent commands in ONE call with `&&` or `;` instead of N sequential calls — each extra call adds ~500 tokens of overhead and prevents cross-request cache reuse. Examples: `ls && cat file` or `a; b; c; d` instead of four separate bash calls.");
     }
     else if (shell.kind === "powershell") {
         shellRules.push("- The bash tool runs PowerShell. Use PowerShell cmdlets: Get-ChildItem, Select-String, Measure-Object, ConvertTo-Json, $env:VAR.", "- DO NOT use POSIX-only commands: grep, sed, awk, wc (use Select-String / Measure-Object / -split instead).", "- For pipe redirection, use PowerShell syntax: `cmd | Select-Object -First 10`, not `cmd | head -10`.");
@@ -272,11 +316,28 @@ IMPORTANT:
 - Use write_file only for new files or when most of the file is changing. For very large files (>500 lines), split into multiple edit_file calls or write smaller chunks.
 - Use read_file instead of cat/head/tail for reading files.
 - When the user asks for an automated recurring or one-time run, use the schedule tools instead of only describing the setup.
-- Commit incrementally (in any git repo, without being asked): the moment a cohesive, working chunk is finished and its checks pass, commit it before starting the next chunk. This is part of doing the work, not a separate request — prefer several small, logically-scoped commits over one large catch-all commit at the end. Group related file changes per commit; keep unrelated changes in separate commits.
-- Every commit message you create MUST end with this attribution line, verbatim, on its own final line: "Coding by - Muonroi-CLI".
+- If you have worked for a long time or hit a tool execution limit, DO NOT tell the user to move to a new session. Instead, advise them to run the \`/compact\` command to free up memory before continuing.
+- Use the experience brain actively (it is how you stop repeating mistakes across sessions): at the start of an unfamiliar or risky step call ee_query to recall past lessons, and after acting on a recalled \`[id col]\` rate it with ee_feedback. The MOMENT you hit a mistake / error / dead-end and find the working fix, call ee_write to save the lesson (the pitfall AND the fix, concise and generalizable) — it is embedded immediately and recallable via ee_query in this and future sessions. Saving a hard-won fix is part of doing the work, not optional.
+- Commit your own work as you go (in any git repo, without being asked): use the git_commit tool — YOU write the commit message — the moment a cohesive, working chunk passes its checks, and after EACH step of a multi-step plan. Prefer several small, logically-scoped commits with clear messages (describe WHAT changed) over one catch-all at the end. git_commit stages only the files you wrote, excludes secrets/artifacts, and appends the "Coding by - Muonroi-CLI" attribution for you. (Any commit you instead make by hand via bash must still end with that attribution line, verbatim, on its own final line.)
 - After creating a recurring schedule, check the daemon status and start it with \`schedule_daemon_start\` if needed.
 
-Be direct. Execute, don't just describe. Show results, not plans.`,
+
+Be direct. Execute, don't just describe. Show results, not plans.
+
+TOKEN BUDGET:
+- Each tool round sends ~17K system prompt tokens + accumulated tool results to the model.
+- Task(explore) / task(general) isolates context in a sub-agent — much cheaper than 5+ top-level rounds.
+- Consider: 1-2 rounds → direct; 3-5 rounds → consider task(explore); >5 rounds → should use task(explore).
+WORKFLOW RULES:
+- RESEARCH FIRST: Always prioritize research before proposing edits. DeepSeek and other models have knowledge cutoffs; do not assume you know the exact codebase structure or latest external libraries. Use 'grep', 'lsp', and 'read_file' to search the local codebase. Use MCP tools (like web search or documentation readers) to research external knowledge, APIs, or libraries. Use 'delegate' for deep background research. Read before you write.
+- CLARIFY GRAY AREAS: If the user's request is ambiguous or leaves critical design decisions unspecified, STOP and ask the user for clarification before writing code. Do not hallucinate requirements.
+
+SELF-LIMIT:
+- When you've read 5+ files and haven't concluded, summarize findings and propose next step instead of reading more.
+- BATCH TOOL CALLS: You MUST combine and invoke independent tool calls in parallel (e.g. read multiple files, or run grep and read a file concurrently) in a SINGLE turn. Do not wait for the result of one tool call before invoking another if you already know both are needed. This dramatically reduces conversation turns, roundtrip latency, and input token accumulation.
+- BATCH BASH COMMANDS: Combine independent commands into ONE bash call (a; b; c) rather than sequential single calls — each separate call adds ~500 tokens of overhead and prevents prompt-cache reuse across the session.
+- Read only specific file sections (start_line/end_line) instead of whole files.
+- When a clear direction emerges from the first 2-3 tool results, act on it — don't over-investigate.`,
     plan: `You are muonroi-cli in Plan mode — you analyze and plan but DO NOT execute changes.
 
 ${ENVIRONMENT}
@@ -386,40 +447,64 @@ export function buildMcpCapabilityBlock(toolNames) {
         "to bash or hand-write JSON-RPC to reach an MCP server:\n" +
         lines.join("\n"));
 }
-export function buildSystemPromptParts(cwd, mode, sandboxMode, planContext, subagents, sandboxSettings, providerId, resumeDigest, options) {
-    const chitchat = options?.chitchat === true;
+const _staticPrefixCache = new Map();
+const STATIC_PREFIX_CACHE_TTL_MS = 300_000; // 5 min — ample; inputs are session-stable
+function staticPrefixCacheKey(cwd, mode, providerId, isChitchat, subagentsHash, subAgent = false, toolTurn = false) {
+    return `${cwd}|${mode}|${providerId}|${isChitchat}|${subagentsHash}|${subAgent}|${toolTurn}`;
+}
+function computeStaticPrefix(cwd, mode, subagents, providerId, chitchat, subAgent = false, toolTurn = false) {
     const custom = loadCustomInstructions(cwd);
-    const customSection = custom
-        ? `\n\nCUSTOM INSTRUCTIONS:\n${custom}\n\nFollow the above alongside standard instructions.\n`
-        : "";
-    // Skip skills + subagents catalogs for chitchat — these are pure tool/agent
-    // routing context the model doesn't need to answer "Hi". On this codebase
-    // they account for ~3K tokens per call.
-    const skillsText = chitchat ? "" : formatSkillsForPrompt(discoverSkills(cwd));
+    const customSection = subAgent || !custom
+        ? ""
+        : `\n\nCUSTOM INSTRUCTIONS:\n${custom}\n\nFollow the above alongside standard instructions.\n`;
+    // Tool-turn: skip agent-skills catalog (~2K tokens) and native-capabilities block (~2K tokens).
+    // The agent was already shown these in the first call of this turn and does not need
+    // to re-read them on every tool round-trip.
+    const skillsText = chitchat || subAgent || toolTurn ? "" : formatSkillsForPrompt(discoverSkills(cwd));
     const skillsSection = skillsText ? `\n\n${skillsText}\n` : "";
     const subagentsSection = chitchat ? "" : formatCustomSubagentsPromptSection(subagents ?? loadValidSubAgents());
-    const sandboxSection = formatSandboxPromptSection(sandboxMode, sandboxSettings);
     let modePrompt = MODE_PROMPTS[mode];
-    // Phase 12.2-G5: defer the "is this an anthropic-style prompt or not?"
-    // decision to the provider capability. Default (no providerId) keeps the
-    // pre-G5 behaviour by treating the prompt as anthropic-native.
     if (!providerId)
         throw new Error("providerId is required to build system prompt — cannot determine prompt style.");
     const promptStyle = getProviderCapabilities(providerId).systemPromptStyle();
     if (promptStyle !== "anthropic") {
         modePrompt = stripToolsSection(modePrompt) + NON_ANTHROPIC_TOOL_PREAMBLE;
     }
-    // Front-load the Agent Operating Contract (all tiers) so the
-    // grounding/evidence discipline registers — the same rules buried in
-    // CUSTOM INSTRUCTIONS get underweighted when not front-loaded. Skipped for
-    // chitchat (no tools, no factual claims). See agent-operating-contract.ts.
+    // Agent mode: strip tool descriptions for tools rarely needed in coding tasks
+    // to reduce system-prompt bloat. The tools remain available via API.
+    if (mode === "agent") {
+        modePrompt = modePrompt.replace(/\n- (wallet_|paid_|fetch_payment|schedule_|generate_|computer_|search_x).*/g, "");
+    }
     const contractSection = buildContractSection({ chitchat });
-    // Native capability manifest (agent mode only) — gives the in-CLI agent a
-    // self-model of the tools, sub-agents, and CLI subsystems it has, so it
-    // wields them instead of reconstructing its own runtime by grepping source.
-    // See native-capabilities-workbook.ts (session d95113d3be09 motivation).
-    const nativeCapabilitiesSection = buildNativeCapabilitiesSection({ mode, chitchat });
-    const staticPrefix = `${contractSection}${nativeCapabilitiesSection}${modePrompt}${sandboxSection}${customSection}${skillsSection}${subagentsSection}`;
+    const nativeCapabilitiesSection = toolTurn ? "" : buildNativeCapabilitiesSection({ mode, chitchat });
+    const prefix = `${contractSection}${nativeCapabilitiesSection}${modePrompt}${customSection}${skillsSection}${subagentsSection}`;
+    return { prefix };
+}
+export function buildSystemPromptParts(cwd, mode, sandboxMode, planContext, subagents, sandboxSettings, providerId, resumeDigest, options) {
+    const chitchat = options?.chitchat === true;
+    const subAgent = options?.subAgent ?? false;
+    const toolTurn = options?.toolTurn === true;
+    const pid = providerId ?? "default";
+    // Subagents rarely change mid-session, but when they do we need a cache miss.
+    // JSON-stable stringify is fast for typical configs (< 10 entries, no circular refs).
+    const subagentsHash = subagents ? JSON.stringify(subagents) : "none";
+    // Try cache for the static prefix
+    const key = staticPrefixCacheKey(cwd, mode, pid, chitchat, subagentsHash, subAgent, toolTurn);
+    const now = Date.now();
+    const cached = _staticPrefixCache.get(key);
+    let staticPrefix;
+    if (cached && now - cached.cachedAt < STATIC_PREFIX_CACHE_TTL_MS) {
+        staticPrefix = cached.prefix;
+    }
+    else {
+        // Cache miss — compute and store
+        const result = computeStaticPrefix(cwd, mode, subagents, pid, chitchat, subAgent, toolTurn);
+        staticPrefix = result.prefix;
+        _staticPrefixCache.set(key, {
+            prefix: staticPrefix,
+            cachedAt: now,
+        });
+    }
     const planSection = planContext
         ? `\n\nAPPROVED PLAN:\nThe following plan has been approved by the user. Execute it now.\n${planContext}\n`
         : "";
@@ -429,6 +514,10 @@ export function buildSystemPromptParts(cwd, mode, sandboxMode, planContext, suba
     const dynamicSuffix = `${planSection}${resumeSection}\n\nCurrent working directory: ${cwd}`;
     return { staticPrefix, dynamicSuffix };
 }
+/** Reset the static prefix cache (for tests). */
+export function resetStaticPrefixCache() {
+    _staticPrefixCache.clear();
+}
 export function buildSystemPrompt(cwd, mode, sandboxMode, planContext, subagents, sandboxSettings, providerId, resumeDigest, options) {
     const { staticPrefix, dynamicSuffix } = buildSystemPromptParts(cwd, mode, sandboxMode, planContext, subagents, sandboxSettings, providerId, resumeDigest, options);
     return `${staticPrefix}${dynamicSuffix}`;
@@ -556,39 +645,13 @@ export function buildSubagentPrompt(request, cwd, custom, sandboxMode, subagents
         "",
         `Delegated task: ${request.description}`,
         "",
-        buildSystemPrompt(cwd, mode, sandboxMode, undefined, subagents, sandboxSettings, providerId),
+        buildSystemPrompt(cwd, mode, sandboxMode, undefined, subagents, sandboxSettings, providerId, undefined, {
+            subAgent: true,
+        }),
     ].join("\n");
 }
 export function formatSandboxPromptSection(sandboxMode, settings) {
-    if (sandboxMode === "off")
-        return "";
-    const s = settings ?? {};
-    let networkLine;
-    if (s.allowNet) {
-        networkLine = s.allowedHosts?.length
-            ? `- Network access is restricted to: ${s.allowedHosts.join(", ")}.`
-            : "- Network access is enabled.";
-    }
-    else {
-        networkLine = "- Network is disabled.";
-    }
-    const lines = [
-        "",
-        "SANDBOX MODE:",
-        "- Bash commands run inside a Shuru sandbox.",
-        networkLine,
-        "- The current workspace is mounted inside the sandbox at `/workspace`.",
-        "- Shell-side workspace file changes do not persist back to the host in this version.",
-        "- Use `read_file`, `edit_file`, and `write_file` for durable source edits.",
-        "- If a task needs a host-persistent shell mutation, explain that sandbox mode blocks that workflow and ask whether to disable sandbox mode.",
-    ];
-    if (s.ports?.length) {
-        lines.push(`- Port forwards: ${s.ports.join(", ")}.`);
-    }
-    if (s.from) {
-        lines.push(`- Starting from checkpoint: ${s.from}.`);
-    }
-    return lines.join("\n");
+    return "";
 }
 export function applyModelConstraints(system, modelId) {
     const modelInfo = getModelInfo(modelId);

package/dist/src/orchestrator/safety-askcard.d.ts

@@ -0,0 +1,66 @@
+/**
+ * src/orchestrator/safety-askcard.ts
+ *
+ * Plans an askcard layout when a tool call is blocked by the safety filter
+ * (catastrophic, dangerous, git-safety, empty-bash).
+ *
+ * The askcard gives the user a choice: allow the block once, or confirm the block.
+ *
+ * Pure — no React, no side effects. Unit-testable in isolation.
+ */
+export type SafetyBlockKind = "catastrophic" | "dangerous" | "git-safety" | "empty-bash";
+export interface SafetyBlockInfo {
+    kind: SafetyBlockKind;
+    /** The blocked command or tool call description */
+    blockedItem: string;
+    /** Human-readable reason from the filter */
+    reason: string;
+    /** Suggested "safe" alternative, if any */
+    alternative?: string;
+}
+export interface SafetyAskcardLayout {
+    /** Question shown in the dialog title */
+    question: string;
+    /** Detail text shown below the question */
+    detail: string;
+    /** Options in render order. First = default (Enter applies). */
+    options: SafetyAskcardOption[];
+    /** Index of the default-selected option (0 = first). */
+    defaultIndex: number;
+}
+export interface SafetyAskcardOption {
+    label: string;
+    value: SafetyAskResult;
+    description?: string;
+}
+export type SafetyAskResult = "allow-once" | "allow-session" | "block";
+/**
+ * Plan the askcard layout for a safety block.
+ * Pure function — easy to unit test and swap UI strategies.
+ */
+export declare function planSafetyAskcard(info: SafetyBlockInfo): SafetyAskcardLayout;
+/** Info passed to the safety-override handler when a tool block is detected. */
+export interface SafetyOverrideAskInfo {
+    kind: SafetyBlockKind;
+    /** The blocked tool name (e.g. "bash", "edit_file"). */
+    toolName: string;
+    /** The command/args that were blocked. */
+    blockedItem: string;
+    /** Human-readable reason from the filter. */
+    reason: string;
+    /** Source block kind tag for the agent to decide retry. */
+    source: "bash.execute" | "registry.precheck";
+}
+/** Verdict the UI returns after the user answers the askcard. */
+export type SafetyOverrideVerdict = {
+    action: "allow-once";
+} | {
+    action: "allow-session";
+} | {
+    action: "block";
+};
+/**
+ * Build a safe alternative suggestion for a blocked command.
+ * Returns null when no canned alternative exists.
+ */
+export declare function suggestAlternative(kind: SafetyBlockKind, command: string): string | undefined;

package/dist/src/orchestrator/safety-askcard.js

@@ -0,0 +1,74 @@
+/**
+ * src/orchestrator/safety-askcard.ts
+ *
+ * Plans an askcard layout when a tool call is blocked by the safety filter
+ * (catastrophic, dangerous, git-safety, empty-bash).
+ *
+ * The askcard gives the user a choice: allow the block once, or confirm the block.
+ *
+ * Pure — no React, no side effects. Unit-testable in isolation.
+ */
+const CATEGORY_LABELS = {
+    catastrophic: "Lỗi bảo mật nghiêm trọng",
+    dangerous: "Lệnh nguy hiểm",
+    "git-safety": "Git safety gate",
+    "empty-bash": "Bash call trống",
+};
+/**
+ * Plan the askcard layout for a safety block.
+ * Pure function — easy to unit test and swap UI strategies.
+ */
+export function planSafetyAskcard(info) {
+    const kindLabel = CATEGORY_LABELS[info.kind];
+    const cmdPreview = info.blockedItem.length > 120 ? `${info.blockedItem.slice(0, 117)}...` : info.blockedItem;
+    const question = `⚠️  ${kindLabel}: Cho phép thực thi?`;
+    const detailLines = [`Lệnh bị chặn: \`${cmdPreview}\``, `Lý do: ${info.reason}`];
+    if (info.alternative) {
+        detailLines.push(`Gợi ý thay thế: ${info.alternative}`);
+    }
+    const options = [
+        {
+            label: "Cho phép 1 lần (Allow once)",
+            value: "allow-once",
+            description: "Chỉ chạy lệnh này một lần duy nhất",
+        },
+        {
+            label: "Chặn (Block)",
+            value: "block",
+            description: "Không chạy lệnh này, trả về lỗi cho agent",
+        },
+    ];
+    // Allow-session only for less severe blocks
+    if (info.kind !== "catastrophic") {
+        options.splice(1, 0, {
+            label: "Cho phép cả phiên (Allow session)",
+            value: "allow-session",
+            description: "Cho phép tất cả lệnh tương tự trong phiên này",
+        });
+    }
+    return {
+        question,
+        detail: detailLines.join("\n"),
+        options,
+        defaultIndex: options.findIndex((o) => o.value === "block"),
+    };
+}
+/**
+ * Build a safe alternative suggestion for a blocked command.
+ * Returns null when no canned alternative exists.
+ */
+export function suggestAlternative(kind, command) {
+    if (kind === "empty-bash") {
+        return 'Provide a real command, e.g. {"command":"ls -la"}';
+    }
+    // sqlite3 / .db access on Windows
+    if (/sqlite3|\.db\b/i.test(command)) {
+        return "Use the filesystem MCP or write_file to read the DB file instead of shelling sqlite3";
+    }
+    // rm -rf patterns
+    if (/rm\s+-rf/i.test(command)) {
+        return "Explicitly list files to remove, or use move to trash";
+    }
+    return undefined;
+}
+//# sourceMappingURL=safety-askcard.js.map