muonroi-cli 1.8.3 → 1.8.5

package/dist/src/orchestrator/retry-classifier.js

@@ -1,11 +1,34 @@
 import { APICallError } from "@ai-sdk/provider";
+import { isProviderThinkingDegraded, markProviderThinkingDegrade } from "../providers/strategies/thinking-mode.js";
 import { STALL_ABORT_REASON } from "./stall-watchdog.js";
+/**
+ * Detect the generic, spec-undocumented param rejection from the z.ai GLM
+ * coding endpoint (HTTP 400 code 1210 "Invalid API parameter") and the
+ * opencode-go Console Go proxy (HTTP 400 invalid_request "Upstream request
+ * failed"). z.ai does NOT publish the exact constraint (verified 2026-07-02 vs
+ * docs.z.ai/api-reference/api-code — 1210 is an intentionally generic bucket),
+ * so no client transform can guarantee prevention. These are matched narrowly
+ * (400 + specific phrasing) so ordinary 400s stay non-transient.
+ */
+function isProviderParamReject(err) {
+    const status = APICallError.isInstance(err)
+        ? err.statusCode
+        : (err?.statusCode ??
+            err?.status);
+    if (status !== 400)
+        return false;
+    const message = err instanceof Error ? err.message : String(err);
+    const body = APICallError.isInstance(err) && typeof err.responseBody === "string" ? err.responseBody : "";
+    const hay = `${message}\n${body}`;
+    return /invalid api parameter|upstream request failed|unexpected end of JSON input|code"?\s*:?\s*1210/i.test(hay);
+}
 /**
  * Classifies a stream error as transient (safe to retry) or non-transient.
  *
  * Transient:
  *  - Network-level errors: ECONNREFUSED, ETIMEDOUT, ECONNRESET, EAI_AGAIN,
- *    "fetch failed", "Unable to connect", "socket hang up", "network"
+ *    "fetch failed", "Unable to connect", "socket hang up", "network",
+ *    "socket connection was closed unexpectedly" (Bun stream drop)
  *  - HTTP 408 (request timeout), 425 (too early), 429 (rate limit), 5xx
  *  - TypeError with "fetch failed" message (browser/bun/node fetch layer)
  *  - AbortSignal.timeout firing (err.name === "TimeoutError")
@@ -38,6 +61,19 @@ export function classifyStreamError(err, depth = 0) {
     if (e.name === "TimeoutError") {
         return { transient: true, reason: "timeout-error" };
     }
+    // z.ai / opencode-go generic param reject (1210 / "Upstream request failed"):
+    // give EXACTLY ONE retry with a degraded-but-valid body. The first sighting
+    // latches thinking OFF (markProviderThinkingDegrade) so the rebuilt request
+    // (factory re-invoked by withStreamRetry) sends the validator-safe shape;
+    // parallel tool_calls are already split by the transform. If it STILL rejects
+    // after we've degraded, stop retrying — the cause is beyond our client fix.
+    if (isProviderParamReject(err)) {
+        if (isProviderThinkingDegraded()) {
+            return { transient: false, reason: "provider-param-reject-after-degrade" };
+        }
+        markProviderThinkingDegrade();
+        return { transient: true, reason: "provider-param-reject-degrade-retry" };
+    }
     // AI SDK APICallError with statusCode
     if (APICallError.isInstance(err)) {
         const status = err.statusCode;
@@ -61,6 +97,10 @@ export function classifyStreamError(err, depth = 0) {
         }
     }
     const message = typeof e.message === "string" ? e.message : "";
+    // Rate limits (including wrapped messages from proxies like "Console Go")
+    if (/rate limit|rate-limited|429|too many requests/i.test(message)) {
+        return { transient: true, reason: "rate-limit-message" };
+    }
     // Malformed function/tool name errors — non-transient (own handler elsewhere)
     if (/invalid.*function.*name|function.*name.*invalid|malformed.*tool|NoSuchTool/i.test(message)) {
         return { transient: false, reason: "malformed-tool-name" };
@@ -86,7 +126,11 @@ function isTransientStatusCode(code) {
     return code === 408 || code === 425 || code === 429 || (code >= 500 && code <= 599);
 }
 function isTransientMessage(message) {
-    return /ECONNREFUSED|ETIMEDOUT|ECONNRESET|EAI_AGAIN|fetch failed|Unable to connect|network|socket hang up/i.test(message);
+    // "socket connection was closed unexpectedly" is Bun's fetch phrasing when a
+    // provider drops a streaming response mid-flight — a transient network drop,
+    // not a client error. Left unclassified it escapes as an unhandledRejection,
+    // which OpenTUI's handleError turns into an un-dismissable console overlay.
+    return /ECONNREFUSED|ETIMEDOUT|ECONNRESET|EAI_AGAIN|fetch failed|Unable to connect|network|socket hang up|socket connection was closed|socket.*closed unexpectedly/i.test(message);
 }
 /**
  * Parse Retry-After header value to milliseconds.

package/dist/src/orchestrator/safety-intercept.d.ts

@@ -0,0 +1,45 @@
+/**
+ * safety-intercept.ts — pure decision helpers for the tool-engine safety-block
+ * interceptor (tool-engine.ts). Extracted so the block-parse and the
+ * permission-mode policy are unit-testable in isolation from the giant
+ * executeToolEngine generator.
+ *
+ * Flow context: bash.execute / registry precheck emit a tool result whose text
+ * starts with `BLOCKED (<kind>): <reason>`. The tool-engine joins output+error,
+ * parses it here, and decides whether to auto-block, auto-allow (yolo), or show
+ * the safety-override askcard via deps.askSafetyOverride.
+ */
+import type { PermissionMode } from "../utils/permission-mode.js";
+import type { SafetyBlockKind } from "./safety-askcard.js";
+export interface ParsedSafetyBlock {
+    kind: SafetyBlockKind;
+    reason: string;
+}
+/**
+ * Parse a joined tool-result text into a safety block, or null when the text
+ * is not a BLOCKED marker.
+ *
+ * Tolerant of leading whitespace: when bash.execute returns `{error: "BLOCKED
+ * (...)"}` with no `output`, the joined text is the raw marker — but a result
+ * shape that carries an empty-string `output` produces a leading "\n" before
+ * the marker, which an anchored `/^BLOCKED/` would miss and silently drop the
+ * askcard (hard-stop with no prompt). Stripping leading whitespace first makes
+ * the parse robust to both shapes while still requiring the marker at the head
+ * of the (trimmed) text — so a command whose normal output merely mentions
+ * "BLOCKED (...)" mid-stream is not mistaken for a real block.
+ */
+export declare function parseSafetyBlock(outputText: string): ParsedSafetyBlock | null;
+/**
+ * Whether a parsed block should be auto-allowed (allow-once) without showing
+ * the askcard, given the active permission mode.
+ *
+ * Policy (confirmed with the user):
+ *   - `yolo` auto-allows lower-severity blocks (`git-safety`, `dangerous`) so
+ *     the "don't ask me" mode actually stops asking for routine guardrails.
+ *   - `catastrophic` ALWAYS shows the askcard, even in yolo — an irreversible
+ *     destroyer (rm -rf /dev, mkfs, sudo …) must never run unattended.
+ *   - `empty-bash` is handled separately (auto-block, no card) and never
+ *     reaches this policy.
+ *   - `safe` / `auto-edit` always show the card for any real block.
+ */
+export declare function shouldAutoAllowYolo(kind: SafetyBlockKind, mode: PermissionMode): boolean;

package/dist/src/orchestrator/safety-intercept.js

@@ -0,0 +1,55 @@
+/**
+ * safety-intercept.ts — pure decision helpers for the tool-engine safety-block
+ * interceptor (tool-engine.ts). Extracted so the block-parse and the
+ * permission-mode policy are unit-testable in isolation from the giant
+ * executeToolEngine generator.
+ *
+ * Flow context: bash.execute / registry precheck emit a tool result whose text
+ * starts with `BLOCKED (<kind>): <reason>`. The tool-engine joins output+error,
+ * parses it here, and decides whether to auto-block, auto-allow (yolo), or show
+ * the safety-override askcard via deps.askSafetyOverride.
+ */
+/**
+ * Parse a joined tool-result text into a safety block, or null when the text
+ * is not a BLOCKED marker.
+ *
+ * Tolerant of leading whitespace: when bash.execute returns `{error: "BLOCKED
+ * (...)"}` with no `output`, the joined text is the raw marker — but a result
+ * shape that carries an empty-string `output` produces a leading "\n" before
+ * the marker, which an anchored `/^BLOCKED/` would miss and silently drop the
+ * askcard (hard-stop with no prompt). Stripping leading whitespace first makes
+ * the parse robust to both shapes while still requiring the marker at the head
+ * of the (trimmed) text — so a command whose normal output merely mentions
+ * "BLOCKED (...)" mid-stream is not mistaken for a real block.
+ */
+export function parseSafetyBlock(outputText) {
+    if (typeof outputText !== "string")
+        return null;
+    const match = outputText.replace(/^\s+/, "").match(/^BLOCKED \(([^)]+)\):\s*(.*)/);
+    if (!match)
+        return null;
+    return { kind: match[1], reason: match[2] ?? "" };
+}
+/**
+ * Whether a parsed block should be auto-allowed (allow-once) without showing
+ * the askcard, given the active permission mode.
+ *
+ * Policy (confirmed with the user):
+ *   - `yolo` auto-allows lower-severity blocks (`git-safety`, `dangerous`) so
+ *     the "don't ask me" mode actually stops asking for routine guardrails.
+ *   - `catastrophic` ALWAYS shows the askcard, even in yolo — an irreversible
+ *     destroyer (rm -rf /dev, mkfs, sudo …) must never run unattended.
+ *   - `empty-bash` is handled separately (auto-block, no card) and never
+ *     reaches this policy.
+ *   - `safe` / `auto-edit` always show the card for any real block.
+ */
+export function shouldAutoAllowYolo(kind, mode) {
+    if (mode !== "yolo")
+        return false;
+    if (kind === "catastrophic")
+        return false;
+    if (kind === "empty-bash")
+        return false;
+    return true;
+}
+//# sourceMappingURL=safety-intercept.js.map

package/dist/src/orchestrator/scope-reminder.js

@@ -229,7 +229,7 @@ export function buildCheckpointReminder(iteration, hasEECheckpoint) {
  * compared `stripped.length` (a message count, ~tens) against a char-scaled
  * threshold (~156000), so the warning could never fire — session 2b7a10219499.
  */
-export function shouldPreWarnCompaction(promptChars, thresholdChars, ratio = 0.78) {
+export function shouldPreWarnCompaction(promptChars, thresholdChars, ratio = 0.6) {
     if (thresholdChars <= 0 || promptChars <= 0)
         return false;
     return promptChars >= Math.floor(thresholdChars * ratio);

package/dist/src/orchestrator/session-experience.d.ts

@@ -27,6 +27,7 @@ export interface ElisionRecord {
     chars: number;
     /** prepareStep step number at which it was elided. */
     step: number;
+    summary?: string;
 }
 export interface SessionExperience {
     compactions: number;
@@ -40,7 +41,7 @@ export interface SessionExperience {
 /** Record that B3/B4 compaction actually elided something at `step`. */
 export declare function recordCompaction(step: number): void;
 /** Record a single tool output the compactor rewrote into a stub. */
-export declare function recordElision(toolCallId: string, toolName: string, chars: number, step: number): void;
+export declare function recordElision(toolCallId: string, toolName: string, chars: number, step: number, summary?: string): void;
 /**
  * Record an ee_query rehydrate of an elided artifact, tagged by where it came
  * from. `unavailable` means the agent asked for an artifact that was neither in

package/dist/src/orchestrator/session-experience.js

@@ -38,7 +38,7 @@ export function recordCompaction(step) {
     state.lastCompactionStep = Number.isFinite(step) ? step : state.lastCompactionStep;
 }
 /** Record a single tool output the compactor rewrote into a stub. */
-export function recordElision(toolCallId, toolName, chars, step) {
+export function recordElision(toolCallId, toolName, chars, step, summary) {
     if (!toolCallId)
         return;
     state.elisions.push({
@@ -46,6 +46,7 @@ export function recordElision(toolCallId, toolName, chars, step) {
         toolName: toolName || "",
         chars: Number.isFinite(chars) && chars > 0 ? Math.floor(chars) : 0,
         step: Number.isFinite(step) ? step : 0,
+        summary,
     });
     // FIFO trim — keep the most recent MAX_ELISIONS.
     if (state.elisions.length > MAX_ELISIONS) {

package/dist/src/orchestrator/should-run-gate.d.ts

@@ -0,0 +1,5 @@
+export declare function shouldRunGate(pilCtx: {
+    intentKind?: string | null;
+    resumeDigest?: string | null;
+    activeRunId?: string | null;
+}, readPhase: () => string | null): boolean;

package/dist/src/orchestrator/should-run-gate.js

@@ -0,0 +1,18 @@
+// Keep the gate off pure chitchat, but ON for a resumed heavy task the classifier
+// mislabels as chitchat (continuation phrases — preprocessor.ts:118-134). Reading
+// STATE.md phase is the resume signal (execute phase = an active run).
+export function shouldRunGate(pilCtx, readPhase) {
+    if (pilCtx.intentKind !== "chitchat")
+        return true;
+    if (pilCtx.resumeDigest || pilCtx.activeRunId)
+        return true;
+    try {
+        return readPhase() === "execute";
+    }
+    catch (err) {
+        // Missing/corrupt .planning is the normal "no active run" case, not an error — treat as no run.
+        console.error(`[pil-gate] shouldRunGate readPhase failed (treating as no active run): ${err.message}`);
+        return false;
+    }
+}
+//# sourceMappingURL=should-run-gate.js.map

package/dist/src/orchestrator/stall-watchdog.d.ts

@@ -21,13 +21,34 @@
 export interface StallWatchdog {
     /** Combine this into the streamText abortSignal. */
     readonly signal: AbortSignal;
-    /** Call on every received stream chunk to reset the stall timer. */
+    /** Call on every received stream chunk to reset the any-activity stall timer. */
     pet(): void;
-    /** Stop the timer (call when the stream completes or errors). Idempotent. */
+    /**
+     * Call ONLY on real forward-progress chunks (a text-delta or a tool-call) to
+     * reset the no-forward-progress timer. No-op when the watchdog was created
+     * without a progressTimeoutMs. This is what makes the guard catch a reasoning
+     * model stuck in an endless chain-of-thought: `pet()` (called on EVERY chunk,
+     * including reasoning-delta) keeps the any-activity timer alive, but the
+     * progress timer only survives if actual output flows.
+     */
+    petProgress(): void;
+    /** Stop the timers (call when the stream completes or errors). Idempotent. */
     dispose(): void;
     /** True iff the watchdog aborted the stream because of a stall. */
     fired(): boolean;
 }
+/** Options for the second (no-forward-progress) timer of a stall watchdog. */
+export interface StallWatchdogProgressOpts {
+    /**
+     * If > 0, arm a SECOND timer that is reset only by petProgress() (real
+     * output), not by pet() (any chunk). Aborts the same signal when no forward
+     * progress happens for this long — catching runaway reasoning that keeps the
+     * any-activity timer alive with reasoning-delta chunks. <= 0 disables it.
+     */
+    progressTimeoutMs: number;
+    /** Called when the no-forward-progress timer fires (before abort). */
+    onProgressFire?: () => void;
+}
 export declare const STALL_ABORT_REASON = "provider-stall";
 /** User-facing message surfaced when the stall watchdog fires. */
 export declare const STALL_ERROR_MESSAGE: string;
@@ -109,4 +130,4 @@ export declare function shouldContinueAfterMidLoopStall(s: MidLoopStallState): b
  * (1-based): 500 → 1000 → 2000 → 4000 → 4000.
  */
 export declare function stallRepromptBackoffMs(attempt: number): number;
-export declare function createStallWatchdog(timeoutMs: number, onFire?: () => void): StallWatchdog;
+export declare function createStallWatchdog(timeoutMs: number, onFire?: () => void, progressOpts?: StallWatchdogProgressOpts): StallWatchdog;

package/dist/src/orchestrator/stall-watchdog.js

@@ -70,36 +70,63 @@ export function shouldContinueAfterMidLoopStall(s) {
 export function stallRepromptBackoffMs(attempt) {
     return Math.min(500 * 2 ** (Math.max(1, attempt) - 1), 4_000);
 }
-export function createStallWatchdog(timeoutMs, onFire) {
+export function createStallWatchdog(timeoutMs, onFire, progressOpts) {
     const controller = new AbortController();
     let firedFlag = false;
     let timer = null;
     const enabled = Number.isFinite(timeoutMs) && timeoutMs > 0;
+    const progressTimeoutMs = progressOpts?.progressTimeoutMs ?? 0;
+    const progressEnabled = Number.isFinite(progressTimeoutMs) && progressTimeoutMs > 0;
+    let progressTimer = null;
+    const fire = (onSpecificFire) => {
+        if (firedFlag)
+            return;
+        firedFlag = true;
+        // Stop the OTHER timer so it can't also fire after the abort (e.g. the
+        // any-activity stall timer that was armed just before the progress timer
+        // tripped — otherwise both onFire callbacks would run).
+        clearBoth();
+        // DOMException(TimeoutError) mirrors AbortSignal.timeout() semantics so
+        // downstream isAbortError-style checks treat it as an abort.
+        controller.abort(new DOMException(STALL_ABORT_REASON, "TimeoutError"));
+        try {
+            onSpecificFire?.();
+        }
+        catch {
+            /* callback must not break the watchdog */
+        }
+    };
     const arm = () => {
         if (!enabled)
             return;
-        timer = setTimeout(() => {
-            firedFlag = true;
-            // DOMException(TimeoutError) mirrors AbortSignal.timeout() semantics so
-            // downstream isAbortError-style checks treat it as an abort.
-            controller.abort(new DOMException(STALL_ABORT_REASON, "TimeoutError"));
-            try {
-                onFire?.();
-            }
-            catch {
-                /* callback must not break the watchdog */
-            }
-        }, timeoutMs);
+        timer = setTimeout(() => fire(onFire), timeoutMs);
         // Don't keep the event loop alive solely for the watchdog (Node).
         timer.unref?.();
     };
+    const armProgress = () => {
+        if (!progressEnabled)
+            return;
+        progressTimer = setTimeout(() => fire(progressOpts?.onProgressFire), progressTimeoutMs);
+        progressTimer.unref?.();
+    };
     const clear = () => {
         if (timer) {
             clearTimeout(timer);
             timer = null;
         }
     };
+    const clearProgress = () => {
+        if (progressTimer) {
+            clearTimeout(progressTimer);
+            progressTimer = null;
+        }
+    };
+    function clearBoth() {
+        clear();
+        clearProgress();
+    }
     arm();
+    armProgress();
     return {
         signal: controller.signal,
         pet() {
@@ -108,8 +135,15 @@ export function createStallWatchdog(timeoutMs, onFire) {
             clear();
             arm();
         },
+        petProgress() {
+            if (!progressEnabled || firedFlag)
+                return;
+            clearProgress();
+            armProgress();
+        },
         dispose() {
             clear();
+            clearProgress();
         },
         fired() {
             return firedFlag;

package/dist/src/orchestrator/stream-runner.js

@@ -25,7 +25,7 @@
 //   - C1 (DeepSeek cache split read)        — onFinish normalization
 //   - C3 (cross-turn dedup wrap)            — wrapToolSetWithDedup
 //   - F1 (sub-agent cumulative cap)         — wrapToolSetWithCap
-//   - siliconflow reasoning-strip           — taskCaps.sanitizeHistory
+//   - reasoning-strip (provider quirk)       — taskCaps.sanitizeHistory
 import { stepCountIs, streamText } from "ai";
 import { recordArtifact } from "../ee/artifact-cache.js";
 import { getDefaultEEClient } from "../ee/intercept.js";
@@ -36,14 +36,14 @@ import { injectCheapModelWorkbook, shouldInjectCheapModelWorkbook, subagentTaskT
 import { getProviderCapabilities } from "../providers/capabilities.js";
 import { getVisionGuidanceForTextOnly } from "../providers/mcp-vision-bridge.js";
 import { captureToolSchemas } from "../providers/patch-zod-schema.js";
-import { buildTurnProviderOptions, requireRuntimeProvider, resolveModelRuntime, shouldDropParam, } from "../providers/runtime.js";
+import { buildTurnProviderOptions, requireRuntimeProvider, resolveModelRuntime, resolveTemperatureParam, shouldDropParam, } from "../providers/runtime.js";
 import { needsVisionProxy } from "../providers/vision-proxy.js";
 import { wireDebug } from "../providers/wire-debug.js";
+import { statusBarStore } from "../state/status-bar-store.js";
 import { BashTool } from "../tools/bash.js";
 import { createBuiltinTools } from "../tools/registry.js";
-import { statusBarStore } from "../ui/status-bar/store.js";
 import { openUrl } from "../utils/open-url.js";
-import { getCurrentShellSettings, getProviderStallTimeoutMs, getSubAgentBudgetChars, getSubAgentCompactKeepLast, getSubAgentCompactThresholdChars, loadMcpServers, loadValidSubAgents, } from "../utils/settings.js";
+import { getCurrentShellSettings, getProviderProgressTimeoutMs, getProviderStallTimeoutMs, getSubAgentBudgetChars, getSubAgentCompactKeepLast, getSubAgentCompactThresholdChars, loadMcpServers, loadValidSubAgents, } from "../utils/settings.js";
 import { resolveShell } from "../utils/shell.js";
 import { prepareVerifySandbox } from "../verify/entrypoint.js";
 import { asNumber } from "./batch-utils.js";
@@ -58,7 +58,7 @@ import { attachReminderToMessages, buildScopeReminder, cadenceForSize, shouldInj
 import { recordCompaction, recordElision } from "./session-experience.js";
 import { createStallWatchdog, STALL_ERROR_MESSAGE } from "./stall-watchdog.js";
 import { wrapToolSetWithCap } from "./sub-agent-cap.js";
-import { compactSubAgentMessages, applyAnthropicPromptCaching } from "./subagent-compactor.js";
+import { applyAnthropicPromptCaching, compactSubAgentMessages } from "./subagent-compactor.js";
 import { combineAbortSignals, firstLine, formatSubagentActivity } from "./tool-utils.js";
 /**
  * StreamRunner — extracted sub-agent stream lifecycle.
@@ -137,23 +137,36 @@ export class StreamRunner {
         });
         // Resolve child model early so we can pass modelId to createBuiltinTools
         // (needed for vision-proxy tools: analyze_image / ask_vision_proxy).
-        const childModelId = normalizeModelId(isVision
-            ? VISION_MODEL
-            : isComputer
-                ? COMPUTER_MODEL
-                : custom
-                    ? custom.model
-                    : this.deps.resolveModelForTask(isExplore ? "explore" : isVerify || isVerifyDetect || isVerifyManifest ? "verify" : "general"));
+        const childModelId = normalizeModelId(request.modelId
+            ? request.modelId
+            : isVision
+                ? VISION_MODEL
+                : isComputer
+                    ? COMPUTER_MODEL
+                    : custom
+                        ? custom.model
+                        : this.deps.resolveModelForTask(isExplore ? "explore" : isVerify || isVerifyDetect || isVerifyManifest ? "verify" : "general"));
         // Mirror the file-local `createTools` wrapper from orchestrator.ts —
         // pass modelId so registry can inject analyze_image/ask_vision_proxy for
         // text-only child models (needsVisionProxy).
-        const childBaseToolsRaw = createBuiltinTools(childBash, childMode, { modelId: childModelId });
+        const childBaseToolsRaw = createBuiltinTools(childBash, childMode, {
+            modelId: childModelId,
+            sessionId: this.deps.getSessionId(),
+        });
         // Wrap with the cumulative cap so the sub-agent's tool loop cannot
         // accumulate unbounded tool_result tokens. See sub-agent-cap.ts for the
         // tiered compression schedule. The cap is per-invocation; each sub-agent
         // gets a fresh budget.
         const subAgentCapBudget = getSubAgentBudgetChars();
-        const subAgentCap = wrapToolSetWithCap(childBaseToolsRaw, { maxCumulativeChars: subAgentCapBudget });
+        const subAgentCap = wrapToolSetWithCap(childBaseToolsRaw, {
+            maxCumulativeChars: subAgentCapBudget,
+            // Opt-out toggle (default ON). The cap dedups identical tool outputs by
+            // content hash; set MUONROI_SUBAGENT_CAP_DEDUP=0 to disable. Used by the
+            // B3 compaction E2E, where the harness re-processes each tool result and
+            // the self-dedup would otherwise collapse distinct reads into pointer
+            // stubs before cumulative history can grow enough to trigger compaction.
+            dedupRepeatOutputs: process.env.MUONROI_SUBAGENT_CAP_DEDUP !== "0",
+        });
         // Phase C3: layer cross-turn dedup ON TOP of the per-invocation cap. The
         // cap sees raw output (for accurate cumulative accounting); dedup sees
         // the already-trimmed output that will actually reach the model.
@@ -255,7 +268,7 @@ export class StreamRunner {
         void signal;
         const childMessages = [{ role: "user", content: childPrompt }];
         // The main agent manages its sub-agents, so don't apply an arbitrary hard limit.
-        const maxSteps = request.maxToolRounds ?? (this.deps.getMaxToolRounds() * 2);
+        const maxSteps = request.maxToolRounds ?? this.deps.getMaxToolRounds() * 2;
         // F1 parity — derive per-turn providerOptions so the sub-agent OpenAI calls
         // carry a stable session-derived promptCacheKey (every tool round routes to
         // the same cache node, keeping the unchanging prefix cached). The top-level
@@ -328,7 +341,6 @@ export class StreamRunner {
         // already strips it via `dropParam`, the sub-agent path was missing
         // the same guard, causing G1: "Task failed: No output generated.").
         const childDropMaxOutput = shouldDropParam(childRuntime, "maxOutputTokens");
-        const childDropTemperature = shouldDropParam(childRuntime, "temperature");
         // Phase B3: compact older tool_results out of the running message history
         // before each AI SDK step. First step (stepNumber === 0) has no history
         // worth compacting; later steps are where cumulative input balloons.
@@ -346,8 +358,8 @@ export class StreamRunner {
                 providerOptions: childProviderOptions,
             });
         }
-        // SiliconFlow DeepSeek thinking-mode rejects assistant history with
-        // `reasoning` parts (HTTP 400 code 20015). The siliconflow capability
+        // Some DeepSeek thinking-mode endpoints reject assistant history with
+        // `reasoning` parts (HTTP 400 code 20015). A provider capability
         // override strips them; every other provider's capability is identity.
         const subMessagesForCall = taskCaps.sanitizeHistory(childMessages);
         // Phase 4 Plan 04 (4B) — mirror top-level scope-ceiling integration.
@@ -377,8 +389,26 @@ export class StreamRunner {
         // and is re-armed by stall.pet() on every chunk. Cheap models (which run
         // mostly as sub-agents via SAMR) hit this most.
         let stallTriggered = false;
+        // Second timer (progressTimeoutMs) is the no-forward-progress guard: the
+        // stall timer re-arms on EVERY chunk — including a reasoning model's
+        // `reasoning-delta` chunks — so a sub-agent stuck in an endless
+        // chain-of-thought keeps petting it and it never fires (observed live
+        // 2026-07-10: a deepseek-v4-flash sprint sub-agent churned reasoning for
+        // 30+ min, 1.4M input tokens, ZERO text/tool output; the 2-min stall
+        // watchdog never tripped). The progress timer is reset ONLY by
+        // stall.petProgress() on real output (text-delta / tool-call), so a runaway
+        // reasoning loop is aborted while a legitimately long reasoning burst that
+        // DOES eventually emit output survives. Both timers abort the same signal
+        // and set stallTriggered, so the existing surface-and-return path handles it.
         const stall = createStallWatchdog(getProviderStallTimeoutMs(), () => {
             stallTriggered = true;
+        }, {
+            progressTimeoutMs: getProviderProgressTimeoutMs(),
+            onProgressFire: () => {
+                stallTriggered = true;
+                console.error(`[stream-runner] sub-agent aborted: no text/tool output for ${getProviderProgressTimeoutMs()}ms ` +
+                    `(runaway reasoning / no forward progress) model=${childRuntime.modelId}`);
+            },
         });
         const result = streamText({
             model: childRuntime.model,
@@ -396,11 +426,11 @@ export class StreamRunner {
             prepareStep: ({ messages, stepNumber }) => {
                 if (stepNumber < 1)
                     return undefined;
-                // SiliconFlow internal multi-step loop: AI-SDK accumulates streamed
-                // reasoning parts into in-flight assistant history and re-POSTs them
-                // on the next step within the same streamText call — orchestrator-
-                // level strip at call setup never sees this. Strip per step too via
-                // the capability hook (identity for non-siliconflow providers).
+                // Internal multi-step loop: AI-SDK accumulates streamed reasoning
+                // parts into in-flight assistant history and re-POSTs them on the
+                // next step within the same streamText call — orchestrator-level
+                // strip at call setup never sees this. Strip per step too via the
+                // capability hook (identity for providers without the quirk).
                 const stripped = taskCaps.sanitizeHistory(messages);
                 // G1 + G2 — pass the sub-agent's model context window so the
                 // compactor can use a token-aware threshold and shrink the keep
@@ -428,17 +458,16 @@ export class StreamRunner {
                         break;
                     }
                 }
-                // Idea 4 persist for sub-agent elisions (best-effort; may lack full session but EE can still index the artifact content).
-                const persistSubArtifact = (toolCallId, toolName, fullContent, reason) => {
+                const persistSubArtifact = (toolCallId, toolName, fullContent, reason, summary) => {
                     // Local-first durable cache so ee_query rehydrates even when EE is down.
                     recordArtifact(toolCallId, toolName, fullContent);
-                    recordElision(toolCallId, toolName, fullContent.length, stepNumber);
+                    recordElision(toolCallId, toolName, fullContent.length, stepNumber, summary);
                     try {
                         getDefaultEEClient()
                             .extract({
                             transcript: fullContent.slice(0, 4000),
                             projectPath: process.cwd(),
-                            meta: { source: "tool-artifact", toolCallId, toolName, reason },
+                            meta: { source: "tool-artifact", toolCallId, toolName, reason, summary },
                         }, AbortSignal.timeout(600))
                             .catch(() => { });
                     }
@@ -494,7 +523,7 @@ export class StreamRunner {
                     return undefined;
                 return { messages: finalMessages };
             },
-            ...(childDropTemperature ? {} : { temperature: isExplore ? 0.2 : 0.5 }),
+            ...resolveTemperatureParam(childRuntime, isExplore ? 0.2 : 0.5),
             ...(childDropMaxOutput ? {} : { maxOutputTokens: Math.min(this.deps.getMaxTokens(), 8_192) }),
             ...(childProviderOptions ? { providerOptions: childProviderOptions } : {}),
             onFinish: ({ totalUsage, finishReason }) => {
@@ -557,6 +586,7 @@ export class StreamRunner {
                     });
                 }
                 if (part.type === "text-delta") {
+                    stall.petProgress(); // real forward progress — reset the no-progress guard
                     textDeltaCount++;
                     assistantText += part.text;
                     // Task 2.6b — emit llm-token (agent-mode only; high-volume, default-off per Phase 4).
@@ -576,6 +606,7 @@ export class StreamRunner {
                     continue;
                 }
                 if (part.type === "tool-call") {
+                    stall.petProgress(); // real forward progress — reset the no-progress guard
                     toolCallCount++;
                     lastActivity = formatSubagentActivity(part.toolName, part.input);
                     onActivity?.(lastActivity);
@@ -653,7 +684,9 @@ export class StreamRunner {
                         ...priorMessages,
                         {
                             role: "user",
-                            content: "You've reached your investigation budget and have not written your findings yet. Stop now — do NOT call any more tools. Write your final synthesis FOR THE PARENT AGENT: lead with the answer to the delegated task, cite the concrete file:line behind each claim, then note any gaps or the recommended next step. Be concise; the parent only ingests this message.",
+                            content: "You've reached your tool execution budget (max steps) for this turn and have not written your final answer yet. Stop now — do NOT call any more tools.\n\n" +
+                                "Option A: If you have enough findings, write your final synthesis FOR THE PARENT AGENT: lead with the answer to the delegated task, cite the concrete file:line behind each claim, then note any gaps or the recommended next step. Be concise; the parent only ingests this message.\n\n" +
+                                "Option B: If you need to continue working but are blocked by this limit, you can request the system to compact the context and start a fresh turn. To do this, reply with EXACTLY this format and nothing else:\n/compact <instructions on what to focus on after compaction>",
                         },
                     ],
                     tools: {},

package/dist/src/orchestrator/sub-agent-cap.d.ts

@@ -18,7 +18,19 @@
  * returns a fresh wrapper with its own counters. Don't share across
  * sub-agent runs.
  *
- * Tiers (default 120_000 chars cumulative ≈ ~30k tokens):
+ * BUDGET SOURCE — do not read the 120_000 below as "the sub-agent budget".
+ * DEFAULT_MAX_CUMULATIVE_CHARS (120_000) is only the fallback used when
+ * wrapToolSetWithCap() is called WITHOUT maxCumulativeChars. The wired
+ * budgets come from settings, not this constant:
+ *   - sub-agent (`task`) turns: getSubAgentBudgetChars() → default 240_000
+ *     (settings.ts), passed at stream-runner.ts.
+ *   - top-level orchestrator turn: getTopLevelToolBudgetChars() → default
+ *     400_000, wired at tool-engine.ts with looser 0.5/0.8 tier ratios.
+ * See docs/agent-harness/CONTEXT-CONTROL-LAYERS.md for how this cap relates
+ * to the other four context-control layers (compactor, rotation, reactive
+ * sub-session, top-level cap).
+ *
+ * Tiers (percentages of whichever budget is in effect, NOT of 120_000):
  *   < 30%   → pass through (A1's 32KB per-call cap already applied)
  *   30-70%  → truncate each new result to 8_000 chars head/tail
  *   70-100% → truncate to 2_000 chars head + "[budget low, finalize work]" note