muonroi-cli 1.8.5 → 1.9.0

package/dist/src/orchestrator/orchestrator.js

@@ -13,7 +13,7 @@ import { getModelInfo, normalizeModelId } from "../models/registry.js";
 import { getProviderCapabilities } from "../providers/capabilities.js";
 import { apiBaseFor } from "../providers/endpoints.js";
 import { loadKeyForProvider } from "../providers/keychain.js";
-import { createProviderFactory, createProviderFactoryAsync, detectProviderForModel, requireRuntimeProvider, resolveModelRuntime as resolveRuntime, resolveTemperatureParam, } from "../providers/runtime.js";
+import { createProviderFactory, createProviderFactoryAsync, detectProviderForModel, requireRuntimeProvider, resolveModelRuntime, resolveTemperatureParam, } from "../providers/runtime.js";
 import { ALL_PROVIDER_IDS } from "../providers/types.js";
 import { statusBarStore } from "../state/status-bar-store.js";
 import { appendCompaction, appendMessages, appendSystemMessage, buildChatEntries, getLastTodoWriteArgs, getNextMessageSequence, getSessionChainInfos, getSessionTotalTokens, loadSessionChainTranscriptState, logInteraction, markMessageCompleted, persistApprovedPlan, recordUsageEvent, SessionStore, } from "../storage/index.js";
@@ -30,6 +30,7 @@ import { runSideQuestion } from "../utils/side-question.js";
 import { buildVerifyDetectPrompt, inferVerifyProjectProfile, normalizeVerifyRecipe, shouldTrustDeterministicRecipe, } from "../verify/entrypoint.js";
 import { runVerifyOrchestration } from "../verify/orchestrator.js";
 import { COUNCIL_COLOR_BG, COUNCIL_COLOR_RESET, COUNCIL_ROLE_COLORS, } from "./agent-options.js";
+import { ASK_USER_DISMISSED } from "./ask-user.js";
 import { AUTO_COMMIT_ATTRIBUTION, isAutoCommitEnabled, maybeAutoCommitTurn, snapshotDirtyPaths, } from "./auto-commit.js";
 import { BatchTurnRunner } from "./batch-turn-runner.js";
 import { accumulateUsage, buildAssistantBatchMessage, buildBatchChatCompletionRequest, buildBatchName, buildToolBatchMessage, extractJsonObject, getBatchUsage, hasUsage, parseToolArgumentsOrRaw, toLocalToolCall, } from "./batch-utils.js";
@@ -38,6 +39,7 @@ import { CouncilManager } from "./council-manager.js";
 import { CrossTurnDedup, isCrossTurnDedupEnabled } from "./cross-turn-dedup.js";
 import { DelegationManager } from "./delegations.js";
 import { loadFlowResumeDigest } from "./flow-resume.js";
+import { beginInteractivePause, endInteractivePause, isInteractivePaused } from "./interactive-pause.js";
 import { MessageProcessor } from "./message-processor.js";
 import { lastPersistedSeq } from "./message-seq.js";
 import { buildSystemPrompt, HARD_MAX_TOOL_ROUNDS, MAX_TOOL_ROUNDS } from "./prompts.js";
@@ -109,10 +111,10 @@ function sanitizeTitle(raw) {
  * Generate a session title with a single lightweight LLM call on the current
  * session model. Falls back to a truncated first-message title on any failure.
  */
-async function genTitle(provider, userMessage, modelId) {
+async function genTitle(userMessage, modelId) {
     try {
         const { generateText } = await import("ai");
-        const runtime = resolveModelRuntime(provider, modelId);
+        const runtime = resolveModelRuntime(modelId);
         const snippet = userMessage.length > 1500 ? `${userMessage.slice(0, 1500)}…` : userMessage;
         const { text, usage } = await generateText({
             model: runtime.model,
@@ -133,13 +135,6 @@ async function genTitle(provider, userMessage, modelId) {
     }
     return { title: fallbackTitle(userMessage), modelId };
 }
-/**
- * Resolve a model ID to a runnable AI SDK LanguageModel.
- * Uses the Anthropic provider factory created by createProvider().
- */
-function resolveModelRuntime(provider, modelId) {
-    return resolveRuntime(provider, modelId);
-}
 async function toolSetToBatchTools(_tools) {
     // Batch API not supported with Anthropic in Phase 0. Phase 1 may add this.
     throw new Error("Batch API not available in Phase 0. Use standard streaming mode.");
@@ -403,7 +398,22 @@ export class Agent {
     getActiveRunId() {
         return this._activeRunId;
     }
-    setModel(model) {
+    /**
+     * Point the agent at `model`, re-resolving the provider when the new model
+     * belongs to a different one.
+     *
+     * EVERY path that changes `this.modelId` must go through here. Changing the
+     * id alone leaves `providerId` / `provider` / `baseURL` / `apiKey` describing
+     * the PREVIOUS provider, so the next turn POSTs the new model to the old
+     * provider's endpoint — which rejects it as unknown (session 0c6728ba1a25:
+     * `gpt-5.4` sent to api.x.ai → 404 "The model gpt-5.4 does not exist", a
+     * wiring bug that reads like a bad model name). `setMode` used to do exactly
+     * that; it now calls this too.
+     *
+     * Session persistence is NOT done here — callers own that, because setMode
+     * writes mode+model together.
+     */
+    _applyModelId(model) {
         this.modelId = normalizeModelId(model);
         const newProviderId = detectProviderForModel(this.modelId);
         if (newProviderId !== this.providerId) {
@@ -437,6 +447,9 @@ export class Agent {
             this.provider = null;
             this._oauthInitDone = false;
         }
+    }
+    setModel(model) {
+        this._applyModelId(model);
         if (this.sessionStore && this.session) {
             this.sessionStore.setModel(this.session.id, this.modelId);
             this.session = this.sessionStore.getRequiredSession(this.session.id);
@@ -464,7 +477,11 @@ export class Agent {
             this.mode = mode;
             const modeModel = getModeSpecificModel(mode);
             if (modeModel) {
-                this.modelId = normalizeModelId(modeModel);
+                // Via _applyModelId, NOT a bare `this.modelId = ...`: a mode-specific
+                // model can belong to a different provider than the session's, and
+                // assigning the id alone would leave provider/baseURL/apiKey pointing at
+                // the old one — the cross-wire class in _applyModelId's docstring.
+                this._applyModelId(modeModel);
             }
             if (this.sessionStore && this.session) {
                 this.sessionStore.setMode(this.session.id, mode);
@@ -565,7 +582,7 @@ export class Agent {
         if (!provider) {
             return "New session";
         }
-        const generated = await genTitle(provider, userMessage, this.modelId);
+        const generated = await genTitle(userMessage, this.modelId);
         this.recordUsage(generated.usage, "title", generated.modelId);
         if (this.sessionStore && this.session && !this.session.title && generated.title) {
             this.sessionStore.setTitle(this.session.id, generated.title);
@@ -598,7 +615,7 @@ export class Agent {
             charBudget -= snippet.length;
         }
         const conversationContext = contextParts.join("\n\n");
-        const result = await runSideQuestion(question, this.provider, this.modelId, conversationContext, signal);
+        const result = await runSideQuestion(question, this.modelId, conversationContext, signal);
         this.recordUsage(result.usage, "other");
         return result;
     }
@@ -660,6 +677,15 @@ export class Agent {
     setSafetyOverrideHandler(fn) {
         this._safetyOverrideHandler = fn;
     }
+    // ask_user handler — set by the UI (app.tsx). Invoked when the model calls the
+    // `ask_user` tool: the UI surfaces an agent-authored card and resolves with the
+    // human's answer string, which becomes the tool result. When unset (headless
+    // without an answerer), the tool returns the dismissed sentinel so the agent
+    // still continues from its own judgment.
+    _askUserHandler = null;
+    setAskUserHandler(fn) {
+        this._askUserHandler = fn;
+    }
     respondToToolApproval(approvalId, approved) {
         const toolApprovalResponse = {
             role: "tool",
@@ -1190,7 +1216,6 @@ export class Agent {
     async runTaskRequest(request, onActivity, abortSignal) {
         const provider = this.requireProvider();
         const deps = {
-            getProvider: () => provider,
             resolveModelForTask: (task) => this._resolveModelForTask(task),
             getModelId: () => this.modelId,
             getProviderId: () => this.providerId,
@@ -1422,7 +1447,7 @@ export class Agent {
         // Phase 1: ask the compaction proposer model whether to compact and what to keep/drop.
         // Only compact if the model says yes. On error/skip, fall back to heuristic.
         const compactModelId = this._resolveCompactModel();
-        const proposal = await proposeCompaction(provider, compactModelId, this.messages, signal);
+        const proposal = await proposeCompaction(compactModelId, this.messages, signal);
         if (proposal !== null) {
             // Model decided — compact only if model says shouldCompact
             if (force) {
@@ -1485,7 +1510,7 @@ export class Agent {
         const customInstructions = isSubSession
             ? "This is a temporary sub-session. Under sub-sessions, it is CRITICAL to preserve active files being worked on, compiler/linter error states, and exact line coordinates in the summary. Do not omit details of files edited, tests run, or compiler diagnostics, as the model needs this specific context to continue working without re-reading the files."
             : undefined;
-        const { summary, usage: compactUsage } = await generateCompactionSummary(provider, compactModelId, preparation, customInstructions, signal);
+        const { summary, usage: compactUsage } = await generateCompactionSummary(compactModelId, preparation, customInstructions, signal);
         // Record compaction call in cost-log — bypasses recordUsage because
         // compaction returns usage separately and isn't routed through the
         // status-bar / usage event pipeline (intentional: it's overhead, not user spend).
@@ -1652,7 +1677,7 @@ export class Agent {
     // Council v2 — Clarify → Confirm → Debate → Plan → Execute
     // ========================================================================
     async *runCouncilV2(topic, options) {
-        const { runCouncil, postDebateContinuation } = await import("../council/index.js");
+        const { runCouncil, buildNeutralPostCouncilContinuation } = await import("../council/index.js");
         const { createCouncilLLM } = await import("../council/llm.js");
         const councilStats = { calls: 0, startMs: Date.now(), phases: [] };
         const llm = createCouncilLLM(this.bash, this.mode, this.session?.id, councilStats);
@@ -1702,6 +1727,9 @@ export class Agent {
                 cwd: this.bash.getCwd(),
                 councilStats, // NEW — share orchestrator's stats object with runCouncil (Phase 14 CQ-01)
                 signal,
+                // convene_council path — suppress ALL hardcoded post-debate decision
+                // surface; the agent decides what happens after the synthesis.
+                convenePath: options?.convenePath,
                 // When the Context Rail is active it carries leader/panel/cost as
                 // ambient sidebar rows, so suppress the duplicate inline summary.
                 suppressInlineMeta: isContextRailEnabled(),
@@ -1753,7 +1781,12 @@ export class Agent {
             // fires ONLY on the top-level slash path, never when nested inside
             // processMessage (auto-council) or drained by the runDebate tool — those
             // callers manage their own continuation.
-            const continuationPrompt = ownsController && synthesis ? postDebateContinuation(chosenAction, synthesis) : null;
+            // convenePath suppresses the hardcoded card (chosenAction stays undefined),
+            // so always hand the synthesis to a normal agent turn via the neutral
+            // continuation and let the agent decide. ownsController scopes this to the
+            // top-level /council slash path (auto-council nests with ownsController
+            // false and continues in tool-engine instead).
+            const continuationPrompt = ownsController && synthesis ? buildNeutralPostCouncilContinuation(synthesis) || null : null;
             const isBuildContinuation = chosenAction === "implement" || chosenAction === "generate_plan";
             if (continuationPrompt && isBuildContinuation && process.env.MUONROI_COUNCIL_ISOLATE_IMPL !== "0") {
                 // #1 — build the council decision in an ISOLATED sub-agent instead of
@@ -1839,6 +1872,7 @@ export class Agent {
                             idleMs,
                             totalMs,
                             label: "council continuation turn",
+                            shouldSuppressFire: isInteractivePaused,
                         });
                     }
                     catch (err) {
@@ -1881,12 +1915,45 @@ export class Agent {
             phases: [],
         };
         const llm = createCouncilLLM(this.bash, this.mode, this.session?.id, productStats);
-        const processMessageFn = (m) => this.processMessage(m, options?.observer);
+        // Autonomous-execution permission for the product loop. /ideal's consent
+        // boundary is the preflight plan-approval askcard; once the PO approves the
+        // plan, the sprint IMPLEMENT turn must apply its own file-op mutations without
+        // a per-tool approval prompt. In `safe` mode a Write/Edit surfaces a
+        // tool_approval_request and awaits respondToToolApproval — but in the driven
+        // product-loop context nothing answers it and no approval askcard renders, so
+        // the impl turn wedges forever right after finishReason:tool-calls (observed
+        // live 2026-07-14: 0 files written across grok/opencode/deepseek + isolated &
+        // streamed paths — tool-engine.ts:2997). Elevating safe→auto-edit for the turn
+        // auto-approves file ops (yolo stays yolo); catastrophic bash stays hard-blocked
+        // by permission-mode's CATASTROPHIC_PATTERNS regardless of mode.
+        const self = this;
+        const processMessageFn = (m) => (async function* () {
+            const prev = self.permissionMode;
+            if (self.permissionMode === "safe")
+                self.permissionMode = "auto-edit";
+            try {
+                yield* self.processMessage(m, options?.observer);
+            }
+            finally {
+                self.permissionMode = prev;
+            }
+        })();
         // Isolated bounded task-runner bridge for the sprint implement stage: a fresh
         // child context (getSubAgentBudgetChars cap, independent compaction) that does
         // NOT inherit this turn's council-debate history — the root fix for the live
         // ctx-overflow wedge. Returns a compact ToolResult (absorbed, no parent bloat).
-        const runIsolatedTask = (request) => this.runTaskRequest(request, undefined, this.abortController?.signal);
+        // Same autonomous-permission elevation as the streamed path above.
+        const runIsolatedTask = async (request) => {
+            const prev = self.permissionMode;
+            if (self.permissionMode === "safe")
+                self.permissionMode = "auto-edit";
+            try {
+                return await this.runTaskRequest(request, undefined, this.abortController?.signal);
+            }
+            finally {
+                self.permissionMode = prev;
+            }
+        };
         const flowDir = nodePath.join(this.bash.getCwd(), ".muonroi-flow");
         // P2.7 (LLM-first — no-regex routing): the work-depth tier that decides
         // /ideal's route is judged by the MODEL (the same depthTier the PIL Layer-1
@@ -1903,7 +1970,15 @@ export class Agent {
             let depth = "standard";
             try {
                 const { createLlmClassifier } = await import("../pil/llm-classify.js");
-                const classify = createLlmClassifier(this.requireProvider(), this.modelId);
+                const { probeRepoGrounding } = await import("../pil/repo-grounding-probe.js");
+                const { getRepoStructureHints } = await import("../pil/repo-structure-hints.js");
+                const classify = createLlmClassifier(this.modelId, {
+                    routeFastTier: true,
+                    // /ideal routing needs a reliable depth verdict; allow cross-provider
+                    // fallback so an agentic/no-fast-tier session model (e.g. xai) doesn't
+                    // strand the classify at fail-open. Bounded by CLASSIFY_TOTAL_BUDGET_MS.
+                    crossProviderFallback: true,
+                });
                 const res = await classify(payload.idea);
                 if (res?.depthTier) {
                     depth = res.depthTier;
@@ -1916,32 +1991,72 @@ export class Agent {
                 // LLM-first clarity signal — feeds the downstream interview as a hint.
                 if (res?.needsClarification === true)
                     needsClarification = true;
+                // Design B — deterministic repo-grounding probe. Trigger on Layer-1
+                // OUTPUT (ambiguity), NOT a prompt regex: run only when the verdict is
+                // non-trivial (depth !== "quick") OR low-confidence, so a well-specified
+                // trivial task still hot-paths on one cheap call. The probe itself is
+                // deterministic (REPO_DEEP_MAP index + bounded on-disk reads, no LLM).
+                // Once it runs its MEASURED facts drive routing — confidence is
+                // trigger-only and can no longer override grounding.
+                const lowConfidence = (res?.confidence ?? 1) < 0.7;
+                if (depth !== "quick" || lowConfidence) {
+                    try {
+                        const hints = getRepoStructureHints(process.cwd());
+                        const probe = probeRepoGrounding(payload.idea, hints, { cwd: process.cwd() });
+                        if (probe.ran) {
+                            // Invariant: probe ran AND zero matched files, or a symbol
+                            // collision → route INTO Council (the arbiter). Never direct-
+                            // dispatch from weak grounding.
+                            if (probe.groundingUncertainty) {
+                                needsClarification = true;
+                                depth = depth === "quick" ? "standard" : depth;
+                            }
+                            // Measured size escalation: a large grounded surface routes heavy
+                            // regardless of the sentence-level classify verdict.
+                            if (probe.bucket === "large")
+                                depth = "heavy";
+                            console.error(`[ideal/route] grounding probe: files=${probe.matchedFiles} loc=${probe.totalLoc} ` +
+                                `dirs=${probe.matchedDirs} collision=${probe.collision} bucket=${probe.bucket} ` +
+                                `uncertainty=${probe.groundingUncertainty} → depth=${depth}`);
+                        }
+                    }
+                    catch (err) {
+                        // Fail-open: a probe hiccup must never block /ideal (No-Silent-Catch).
+                        console.error(`[ideal/route] grounding probe failed, ignoring: ${err?.message}`);
+                    }
+                }
             }
             catch (err) {
                 // Fail-open: never block /ideal on a classify hiccup (No-Silent-Catch).
                 console.error(`[ideal/route] depth classify failed, defaulting to "standard": ${err?.message}`);
             }
-            // The cheap 8-word classify above is only a HINT for the downstream GSD
-            // depth pipeline — it is NOT a routing gate. It was too noisy to gate the
-            // council decision: the SAME architectural prompt scored `heavy` on one run
-            // and `standard` the next, so routing flip-flopped between full Council and
-            // a straight-to-Edit maint-edit that skipped the debate. /ideal is the
-            // DELIBERATE path — it must ALWAYS run the full Council/loop-driver
-            // pipeline, in this order:
-            //   1. scan the source (discovery/scoping) to understand what the user's
-            //      request actually touches,
-            //   2. interview the user (AskCard — adaptive: only asks what the source
-            //      can't answer, so an existing repo isn't dragged through 6 questions),
-            //   3. leader-tier complexity assessment + debate INSIDE that flow, AFTER
-            //      scope is understood — never a "no debate" verdict from a bare-prompt
-            //      guess.
-            // So we force Council for every /ideal start; the fast classify only
-            // seeds depth/clarity hints for that flow. Explicit `--maintain` still opts
-            // out of Council (handled at the top of runProductLoop dispatch).
+            // Council routing gate (model-signal, no hardcoded depth→council table).
+            //
+            // History: /ideal used to force Council UNCONDITIONALLY because the cheap
+            // classify was too noisy to gate on — the SAME architectural prompt scored
+            // `heavy` on one run and `standard` the next, so routing flip-flopped. That
+            // noise was root-caused (2026-07-15, harness-measured): the session model
+            // could be an agentic model (e.g. grok-composer) that ignores the terse
+            // 8-word classify contract and emits task-planning prose → null → fail-open
+            // "standard"; and stream errors were swallowed into the same null. Both are
+            // now fixed in llm-classify.ts (cross-provider route to a keyed instruction-
+            // follower + No-Silent-Catch error surfacing), so the depth/clarity signal
+            // is reliable enough to gate on.
+            //
+            // Gate: only a genuinely TRIVIAL /ideal — the model says depth=quick AND
+            // not-underspecified — skips Council and takes the product-loop hot-path
+            // (single sprint, no debate; index.ts complexity==="low" branch). Anything
+            // else (standard, heavy, or any underspecified request) still runs the full
+            // Council/loop-driver pipeline: scan source → adaptive interview → leader-
+            // tier assessment + debate AFTER scope is understood. When the model is
+            // uncertain (null depth → "medium") it routes INTO Council, the arbiter —
+            // never a hardcoded default. Explicit `--maintain` still opts out entirely.
             complexity = depth === "heavy" ? "high" : depth === "quick" ? "low" : "medium";
             sufficiencyMissing = undefined;
             if (payload.flags.mode !== "maintain") {
-                routeForceCouncil = true;
+                const trivial = depth === "quick" && needsClarification !== true;
+                if (!trivial)
+                    routeForceCouncil = true;
             }
         }
         const gen = runProductLoop({
@@ -2552,7 +2667,7 @@ export class Agent {
                 // continuation ("ok làm phần đó đi") is judged in isolation and can be
                 // mis-routed as a fresh/unrelated task. Passing contextInfo also turns
                 // on the session-size metadata block the ROTATE_SESSION rule relies on.
-                const routeResult = await classifySubSessionAction(this.requireProvider(), this.modelId, userMessage, {
+                const routeResult = await classifySubSessionAction(this.modelId, userMessage, {
                     currentChars,
                     threshold,
                     recentTurns: this._buildRecentTurnsSummary(),
@@ -2596,7 +2711,7 @@ export class Agent {
                 const { deliberateCompact } = await import("../flow/compaction/index.js");
                 const { getDatabase } = await import("../storage/db.js");
                 const { appendCompaction, getNextMessageSequence } = await import("../storage/transcript.js");
-                const cr = await deliberateCompact(flowDir, this.messages, "", 4096, this.requireProvider(), this.modelId);
+                const cr = await deliberateCompact(flowDir, this.messages, "", 4096, this.modelId);
                 const newSession = this.sessionStore.createSession(this.modelId, this.mode, this.bash.getCwd());
                 const db = getDatabase();
                 this.sessionStore.linkChild(newSession.id, parentSessionId, "rotation");
@@ -2753,6 +2868,7 @@ export class Agent {
                             idleMs: turnIdleMs,
                             totalMs: turnTotalMs,
                             label: "assistant turn",
+                            shouldSuppressFire: isInteractivePaused,
                         });
                     }
                     catch (stallErr) {
@@ -3031,9 +3147,8 @@ export class Agent {
                     `${serializedParent}\n\n` +
                     `Provide clear, actionable guidance to resolve the child's query.`;
                 const { generateText } = await import("ai");
-                const provider = self.requireProvider();
                 const modelId = self.modelId;
-                const runtime = resolveModelRuntime(provider, modelId);
+                const runtime = resolveModelRuntime(modelId);
                 const result = await generateText({
                     model: runtime.model,
                     system: systemPrompt,
@@ -3090,6 +3205,25 @@ export class Agent {
                     return { action: "block" };
                 }
             },
+            askUser: async (info) => {
+                const h = self._askUserHandler;
+                if (!h) {
+                    logger.warn("orchestrator", "askUser called but no handler registered — returning dismissed sentinel");
+                    return ASK_USER_DISMISSED;
+                }
+                // Hold both watchdogs open while the human answers (see interactive-pause.ts).
+                beginInteractivePause();
+                try {
+                    return await h(info);
+                }
+                catch (err) {
+                    logger.error("orchestrator", "askUser crashed", { error: err });
+                    return ASK_USER_DISMISSED;
+                }
+                finally {
+                    endInteractivePause();
+                }
+            },
             runCouncilV2: (msg, opts) => self.runCouncilV2(msg, opts),
             processMessage: (msg, obs, imgs) => self.processMessage(msg, obs, imgs),
             processMessageBatchTurn: (args) => self.processMessageBatchTurn(args),
@@ -3213,14 +3347,34 @@ export class Agent {
         //      and must be re-resolved from the NEW provider's own credentials.
         const providerDeferred = this.provider === null;
         const keyIsSentinelOrEmpty = !this.apiKey || this.apiKey === "oauth";
-        if (!providerDeferred && !keyIsSentinelOrEmpty)
-            return;
         try {
-            const { listOAuthProviderIds } = await import("../providers/auth/registry.js");
+            const { listOAuthProviderIds, getOAuthProviderConfig } = await import("../providers/auth/registry.js");
             const ids = await listOAuthProviderIds();
-            // OAuth path: the provider supports OAuth AND we don't hold a real API
-            // key, so inject subscription tokens as Bearer headers.
-            if (ids.includes(this.providerId) && keyIsSentinelOrEmpty) {
+            const oauthCapable = ids.includes(this.providerId);
+            // One auth mode per provider (OAuth XOR API key): if this OAuth-capable
+            // provider has a live token, OAuth wins OUTRIGHT — even over a real held
+            // API key. This is the shadowing-bug fix: a stale sk-proj key must not
+            // beat a valid ChatGPT OAuth login. Check token presence BEFORE the
+            // early-out so a held key can no longer suppress OAuth.
+            let hasOAuthTokens = false;
+            if (oauthCapable) {
+                try {
+                    const cfg = await getOAuthProviderConfig(this.providerId);
+                    const tokens = cfg ? await cfg.loadTokensWithRefresh().catch(() => null) : null;
+                    hasOAuthTokens = !!tokens?.accessToken;
+                }
+                catch {
+                    hasOAuthTokens = false;
+                }
+            }
+            // Nothing to do only when: no OAuth token, a real key is held, and the
+            // provider was not deferred by a model switch.
+            if (!hasOAuthTokens && !providerDeferred && !keyIsSentinelOrEmpty)
+                return;
+            // OAuth path: inject subscription tokens as Bearer headers. Taken when a
+            // token exists (override a held key), OR when no real key is held for an
+            // OAuth-capable provider.
+            if (oauthCapable && (hasOAuthTokens || keyIsSentinelOrEmpty)) {
                 const effectiveBaseURL = this.baseURL &&
                     this.baseURL !== (await import("../providers/endpoints.js").then((m) => m.apiBaseFor("anthropic")))
                     ? this.baseURL

package/dist/src/orchestrator/preprocessor.js

@@ -29,7 +29,7 @@ export async function* prepareTurnContext(deps, userMessage, _budgetOverride) {
             let llmFallback;
             try {
                 const { createLlmClassifier } = await import("../pil/llm-classify.js");
-                llmFallback = createLlmClassifier(deps.requireProvider(), deps.modelId);
+                llmFallback = createLlmClassifier(deps.modelId, { routeFastTier: true });
             }
             catch (err) {
                 logger.error("pil", "LLM fallback wiring failed", { error: err });
@@ -40,7 +40,7 @@ export async function* prepareTurnContext(deps, userMessage, _budgetOverride) {
             let clarificationProposer;
             try {
                 const { createModelClarificationProposer } = await import("../pil/discovery.js");
-                clarificationProposer = createModelClarificationProposer(deps.requireProvider(), deps.modelId);
+                clarificationProposer = createModelClarificationProposer(deps.modelId);
             }
             catch (err) {
                 logger.error("pil", "clarification proposer wiring failed", { error: err });

package/dist/src/orchestrator/safety-askcard.d.ts

@@ -8,7 +8,7 @@
  *
  * Pure — no React, no side effects. Unit-testable in isolation.
  */
-export type SafetyBlockKind = "catastrophic" | "dangerous" | "git-safety" | "empty-bash";
+export type SafetyBlockKind = "catastrophic" | "destructive-revert" | "dangerous" | "git-safety" | "empty-bash";
 export interface SafetyBlockInfo {
     kind: SafetyBlockKind;
     /** The blocked command or tool call description */

package/dist/src/orchestrator/safety-askcard.js

@@ -10,6 +10,7 @@
  */
 const CATEGORY_LABELS = {
     catastrophic: "Lỗi bảo mật nghiêm trọng",
+    "destructive-revert": "Hủy thay đổi chưa lưu (không thể hoàn tác)",
     dangerous: "Lệnh nguy hiểm",
     "git-safety": "Git safety gate",
     "empty-bash": "Bash call trống",
@@ -38,8 +39,10 @@ export function planSafetyAskcard(info) {
             description: "Không chạy lệnh này, trả về lỗi cho agent",
         },
     ];
-    // Allow-session only for less severe blocks
-    if (info.kind !== "catastrophic") {
+    // Allow-session only for less severe blocks. A destructive-revert (discards
+    // uncommitted work irreversibly) is treated like catastrophic: allow-once
+    // only, never a blanket session allow.
+    if (info.kind !== "catastrophic" && info.kind !== "destructive-revert") {
         options.splice(1, 0, {
             label: "Cho phép cả phiên (Allow session)",
             value: "allow-session",

package/dist/src/orchestrator/safety-intercept.d.ts

@@ -38,6 +38,11 @@ export declare function parseSafetyBlock(outputText: string): ParsedSafetyBlock
  *     the "don't ask me" mode actually stops asking for routine guardrails.
  *   - `catastrophic` ALWAYS shows the askcard, even in yolo — an irreversible
  *     destroyer (rm -rf /dev, mkfs, sudo …) must never run unattended.
+ *   - `destructive-revert` ALWAYS shows the askcard, even in yolo — discarding
+ *     uncommitted work (git checkout --/restore/reset --hard/clean, rm of a
+ *     tracked file) is irreversible; headless it hard-blocks. This is the guard
+ *     that stops an autonomous /ideal sub-agent from silently reverting the
+ *     user's unrelated working-tree changes.
  *   - `empty-bash` is handled separately (auto-block, no card) and never
  *     reaches this policy.
  *   - `safe` / `auto-edit` always show the card for any real block.

package/dist/src/orchestrator/safety-intercept.js

@@ -39,6 +39,11 @@ export function parseSafetyBlock(outputText) {
  *     the "don't ask me" mode actually stops asking for routine guardrails.
  *   - `catastrophic` ALWAYS shows the askcard, even in yolo — an irreversible
  *     destroyer (rm -rf /dev, mkfs, sudo …) must never run unattended.
+ *   - `destructive-revert` ALWAYS shows the askcard, even in yolo — discarding
+ *     uncommitted work (git checkout --/restore/reset --hard/clean, rm of a
+ *     tracked file) is irreversible; headless it hard-blocks. This is the guard
+ *     that stops an autonomous /ideal sub-agent from silently reverting the
+ *     user's unrelated working-tree changes.
  *   - `empty-bash` is handled separately (auto-block, no card) and never
  *     reaches this policy.
  *   - `safe` / `auto-edit` always show the card for any real block.
@@ -48,6 +53,8 @@ export function shouldAutoAllowYolo(kind, mode) {
         return false;
     if (kind === "catastrophic")
         return false;
+    if (kind === "destructive-revert")
+        return false;
     if (kind === "empty-bash")
         return false;
     return true;

package/dist/src/orchestrator/stall-watchdog.d.ts

@@ -130,4 +130,11 @@ export declare function shouldContinueAfterMidLoopStall(s: MidLoopStallState): b
  * (1-based): 500 → 1000 → 2000 → 4000 → 4000.
  */
 export declare function stallRepromptBackoffMs(attempt: number): number;
-export declare function createStallWatchdog(timeoutMs: number, onFire?: () => void, progressOpts?: StallWatchdogProgressOpts): StallWatchdog;
+export declare function createStallWatchdog(timeoutMs: number, onFire?: () => void, progressOpts?: StallWatchdogProgressOpts, 
+/**
+ * Optional gate consulted the instant a timer would fire. When it returns
+ * true the watchdog RE-ARMS instead of aborting — used to hold the stream
+ * open while a blocking interactive card (`ask_user`) awaits a human, without
+ * counting that wait as a provider stall.
+ */
+shouldSuppressFire?: () => boolean): StallWatchdog;

package/dist/src/orchestrator/stall-watchdog.js

@@ -70,7 +70,14 @@ export function shouldContinueAfterMidLoopStall(s) {
 export function stallRepromptBackoffMs(attempt) {
     return Math.min(500 * 2 ** (Math.max(1, attempt) - 1), 4_000);
 }
-export function createStallWatchdog(timeoutMs, onFire, progressOpts) {
+export function createStallWatchdog(timeoutMs, onFire, progressOpts, 
+/**
+ * Optional gate consulted the instant a timer would fire. When it returns
+ * true the watchdog RE-ARMS instead of aborting — used to hold the stream
+ * open while a blocking interactive card (`ask_user`) awaits a human, without
+ * counting that wait as a provider stall.
+ */
+shouldSuppressFire) {
     const controller = new AbortController();
     let firedFlag = false;
     let timer = null;
@@ -99,14 +106,28 @@ export function createStallWatchdog(timeoutMs, onFire, progressOpts) {
     const arm = () => {
         if (!enabled)
             return;
-        timer = setTimeout(() => fire(onFire), timeoutMs);
+        timer = setTimeout(() => {
+            // Hold open (re-arm) while an interactive card blocks the turn — the
+            // human is thinking, not a stalled provider.
+            if (shouldSuppressFire?.()) {
+                arm();
+                return;
+            }
+            fire(onFire);
+        }, timeoutMs);
         // Don't keep the event loop alive solely for the watchdog (Node).
         timer.unref?.();
     };
     const armProgress = () => {
         if (!progressEnabled)
             return;
-        progressTimer = setTimeout(() => fire(progressOpts?.onProgressFire), progressTimeoutMs);
+        progressTimer = setTimeout(() => {
+            if (shouldSuppressFire?.()) {
+                armProgress();
+                return;
+            }
+            fire(progressOpts?.onProgressFire);
+        }, progressTimeoutMs);
         progressTimer.unref?.();
     };
     const clear = () => {

package/dist/src/orchestrator/stream-runner.d.ts

@@ -3,7 +3,6 @@ import { type ResolvedModelRuntime } from "../providers/runtime.js";
 import type { ProviderId } from "../providers/types.js";
 import { BashTool } from "../tools/bash.js";
 import type { AgentMode, TaskRequest, ToolResult } from "../types/index.js";
-import type { LegacyProvider } from "./agent-options.js";
 import type { CrossTurnDedup } from "./cross-turn-dedup.js";
 import type { ReadPathBudget } from "./read-path-budget.js";
 /**
@@ -11,8 +10,6 @@ import type { ReadPathBudget } from "./read-path-budget.js";
  * without holding a circular reference. Mirrors the CouncilManager DI pattern.
  */
 export interface StreamRunnerDeps {
-    /** Current top-level provider instance (already validated). */
-    getProvider(): LegacyProvider;
     /** Resolve a specific task tier's model id (uses Agent's role config). */
     resolveModelForTask(task: "compact" | "explore" | "general" | "title" | "verify"): string;
     /** Top-level model id (for routed_from telemetry). */
@@ -108,6 +105,19 @@ export type SetupOutcome = {
     kind: "prepared";
     prepared: PreparedSubAgentCall;
 } | SetupShortCircuit;
+/**
+ * Emit one sub-agent diagnostic line (MUONROI_DEBUG_SUBAGENT=1).
+ *
+ * Writes to the file named by MUONROI_SUBAGENT_DEBUG_LOG when set, else stderr.
+ * The file sink exists because stderr is a dead end for the case this
+ * diagnostic was written for: under the MCP harness the TUI runs as a child
+ * whose stderr nobody reads (opentui-spawn.ts consumes only the fd3/named-pipe
+ * stream), so every line went into a pipe no one drains. G1 — "Task failed: No
+ * output generated" — was named, given this flag, and never diagnosed, because
+ * the diagnostic could not reach whoever turned it on. Mirrors the working
+ * MUONROI_COUNCIL_DEBUG_LOG sink in council/llm.ts.
+ */
+export declare function writeSubagentDebug(enabled: boolean, line: string): void;
 /**
  * StreamRunner — extracted sub-agent stream lifecycle.
  *