reasonix 0.25.0 → 0.26.0

package/dist/index.js

@@ -47,8 +47,8 @@ function computeWait(attempt, initial, cap, retryAfter) {
 }
 function sleep(ms, signal) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve9, reject) => {
-    const timer = setTimeout(resolve9, ms);
+  return new Promise((resolve10, reject) => {
+    const timer = setTimeout(resolve10, ms);
     if (signal) {
       const onAbort = () => {
         clearTimeout(timer);
@@ -451,6 +451,54 @@ function resolveTemperatures(budget, custom) {
   return out;
 }
 
+// src/core/pause-gate.ts
+var PauseGate = class {
+  _nextId = 0;
+  _pending = /* @__PURE__ */ new Map();
+  _listeners = /* @__PURE__ */ new Set();
+  /** Block until the user responds. Takes a named options object so the
+   *  kind and payload fields don't get confused at the call site. */
+  ask(opts) {
+    const { kind, payload } = opts;
+    if (this._listeners.size === 0) {
+      throw new Error(
+        `${kind}: no confirmation listener registered \u2014 cannot prompt the user. This tool can only be used inside an interactive Reasonix session.`
+      );
+    }
+    return new Promise((resolve10) => {
+      const id = this._nextId++;
+      const request = { id, kind, payload };
+      this._pending.set(id, { resolve: resolve10, request });
+      for (const fn of this._listeners) {
+        try {
+          fn(request);
+        } catch {
+        }
+      }
+    });
+  }
+  /** Resolve a pending request. Called by the App's modal callback. */
+  resolve(id, data) {
+    const p = this._pending.get(id);
+    if (!p) return;
+    this._pending.delete(id);
+    p.resolve(data);
+  }
+  /** Subscribe to new pause requests. Returns an unsubscribe function. */
+  on(fn) {
+    this._listeners.add(fn);
+    return () => {
+      this._listeners.delete(fn);
+    };
+  }
+  /** Current pending request, if any (polling fallback). */
+  get current() {
+    for (const [, p] of this._pending) return p.request;
+    return null;
+  }
+};
+var pauseGate = new PauseGate();
+
 // src/hooks.ts
 import { spawn } from "child_process";
 import { existsSync, readFileSync } from "fs";
@@ -523,7 +571,7 @@ function matchesTool(hook, toolName) {
 }
 var HOOK_OUTPUT_CAP_BYTES = 256 * 1024;
 function defaultSpawner(input) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const child = spawn(input.command, {
       cwd: input.cwd,
       shell: true,
@@ -568,7 +616,7 @@ function defaultSpawner(input) {
     child.stderr.on("data", (chunk) => onChunk("stderr", chunk));
     child.once("error", (err) => {
       clearTimeout(timer);
-      resolve9({
+      resolve10({
         exitCode: null,
         stdout: Buffer.concat(stdoutChunks).toString("utf8"),
         stderr: Buffer.concat(stderrChunks).toString("utf8"),
@@ -579,7 +627,7 @@ function defaultSpawner(input) {
     });
     child.once("close", (code) => {
       clearTimeout(timer);
-      resolve9({
+      resolve10({
         exitCode: code,
         stdout: Buffer.concat(stdoutChunks).toString("utf8").trim(),
         stderr: Buffer.concat(stderrChunks).toString("utf8").trim(),
@@ -989,7 +1037,10 @@ var ToolRegistry = class {
       }
     }
     try {
-      const result = await tool.fn(args, { signal: opts.signal });
+      const result = await tool.fn(args, {
+        signal: opts.signal,
+        confirmationGate: opts.confirmationGate
+      });
       const str = typeof result === "string" ? result : JSON.stringify(result);
       let clipped = str;
       if (opts.maxResultTokens !== void 0) {
@@ -1193,98 +1244,6 @@ function blockToString(block) {
   return `[unknown block: ${JSON.stringify(block)}]`;
 }
 
-// src/memory/runtime.ts
-import { createHash } from "crypto";
-var ImmutablePrefix = class {
-  system;
-  /** Each `addTool` costs one cache-miss turn — DeepSeek's prefix cache is keyed by full tool list. */
-  _toolSpecs;
-  fewShots;
-  /** Invalidated only via `addTool`; bypassing it leaves cache stale → fingerprint diverges from sent prefix. */
-  _fingerprintCache = null;
-  constructor(opts) {
-    this.system = opts.system;
-    this._toolSpecs = [...opts.toolSpecs ?? []];
-    this.fewShots = Object.freeze([...opts.fewShots ?? []]);
-  }
-  get toolSpecs() {
-    return this._toolSpecs;
-  }
-  toMessages() {
-    return [{ role: "system", content: this.system }, ...this.fewShots.map((m) => ({ ...m }))];
-  }
-  tools() {
-    return this._toolSpecs.map((t) => structuredClone(t));
-  }
-  addTool(spec) {
-    const name = spec.function?.name;
-    if (!name) return false;
-    if (this._toolSpecs.some((t) => t.function?.name === name)) return false;
-    this._toolSpecs.push(spec);
-    this._fingerprintCache = null;
-    return true;
-  }
-  get fingerprint() {
-    if (this._fingerprintCache !== null) return this._fingerprintCache;
-    this._fingerprintCache = this.computeFingerprint();
-    return this._fingerprintCache;
-  }
-  /** Dev/test only — throws on cache drift, which always means a non-`addTool` mutation slipped in. */
-  verifyFingerprint() {
-    const fresh = this.computeFingerprint();
-    if (this._fingerprintCache !== null && this._fingerprintCache !== fresh) {
-      throw new Error(
-        `ImmutablePrefix fingerprint drift: cached=${this._fingerprintCache}, fresh=${fresh}. A mutation path bypassed addTool's cache invalidation \u2014 DeepSeek will see prefix churn that the TUI / transcript log don't know about.`
-      );
-    }
-    this._fingerprintCache = fresh;
-    return fresh;
-  }
-  computeFingerprint() {
-    const blob = JSON.stringify({
-      system: this.system,
-      tools: this._toolSpecs,
-      shots: this.fewShots
-    });
-    return createHash("sha256").update(blob).digest("hex").slice(0, 16);
-  }
-};
-var AppendOnlyLog = class {
-  _entries = [];
-  append(message) {
-    if (!message || typeof message !== "object" || !("role" in message)) {
-      throw new Error(`invalid log entry: ${JSON.stringify(message)}`);
-    }
-    this._entries.push(message);
-  }
-  extend(messages) {
-    for (const m of messages) this.append(m);
-  }
-  /** The one append-only-breaking path — reserved for `/compact` + recovery. Use `append()` otherwise. */
-  compactInPlace(replacement) {
-    this._entries = [...replacement];
-  }
-  get entries() {
-    return this._entries;
-  }
-  toMessages() {
-    return this._entries.map((e) => ({ ...e }));
-  }
-  get length() {
-    return this._entries.length;
-  }
-};
-var VolatileScratch = class {
-  reasoning = null;
-  planState = null;
-  notes = [];
-  reset() {
-    this.reasoning = null;
-    this.planState = null;
-    this.notes = [];
-  }
-};
-
 // src/memory/session.ts
 import { execFileSync } from "child_process";
 import {
@@ -1415,6 +1374,338 @@ function countLines(path2) {
   }
 }
 
+// src/telemetry/stats.ts
+var DEEPSEEK_PRICING = {
+  "deepseek-v4-flash": { inputCacheHit: 0.028, inputCacheMiss: 0.139, output: 0.278 },
+  "deepseek-v4-pro": { inputCacheHit: 0.139, inputCacheMiss: 1.667, output: 3.333 },
+  // Compat aliases — priced as v4-flash per the deprecation notice.
+  "deepseek-chat": { inputCacheHit: 0.028, inputCacheMiss: 0.139, output: 0.278 },
+  "deepseek-reasoner": { inputCacheHit: 0.028, inputCacheMiss: 0.139, output: 0.278 }
+};
+var CLAUDE_SONNET_PRICING = { input: 3, output: 15 };
+var DEEPSEEK_CONTEXT_TOKENS = {
+  "deepseek-v4-flash": 1e6,
+  "deepseek-v4-pro": 1e6,
+  "deepseek-chat": 1e6,
+  "deepseek-reasoner": 1e6
+};
+var DEFAULT_CONTEXT_TOKENS = 131072;
+function costUsd(model, usage) {
+  const p = DEEPSEEK_PRICING[model];
+  if (!p) return 0;
+  return (usage.promptCacheHitTokens * p.inputCacheHit + usage.promptCacheMissTokens * p.inputCacheMiss + usage.completionTokens * p.output) / 1e6;
+}
+function inputCostUsd(model, usage) {
+  const p = DEEPSEEK_PRICING[model];
+  if (!p) return 0;
+  return (usage.promptCacheHitTokens * p.inputCacheHit + usage.promptCacheMissTokens * p.inputCacheMiss) / 1e6;
+}
+function outputCostUsd(model, usage) {
+  const p = DEEPSEEK_PRICING[model];
+  if (!p) return 0;
+  return usage.completionTokens * p.output / 1e6;
+}
+function cacheSavingsUsd(model, hitTokens) {
+  if (hitTokens <= 0) return 0;
+  const p = DEEPSEEK_PRICING[model];
+  if (!p) return 0;
+  return hitTokens * (p.inputCacheMiss - p.inputCacheHit) / 1e6;
+}
+function claudeEquivalentCost(usage) {
+  return (usage.promptTokens * CLAUDE_SONNET_PRICING.input + usage.completionTokens * CLAUDE_SONNET_PRICING.output) / 1e6;
+}
+var SessionStats = class {
+  turns = [];
+  record(turn, model, usage) {
+    const cost = costUsd(model, usage);
+    const stats = {
+      turn,
+      model,
+      usage,
+      cost,
+      cacheHitRatio: usage.cacheHitRatio
+    };
+    this.turns.push(stats);
+    return stats;
+  }
+  get totalCost() {
+    return this.turns.reduce((sum, t) => sum + t.cost, 0);
+  }
+  get totalClaudeEquivalent() {
+    return this.turns.reduce((sum, t) => sum + claudeEquivalentCost(t.usage), 0);
+  }
+  get savingsVsClaude() {
+    const c = this.totalClaudeEquivalent;
+    return c > 0 ? 1 - this.totalCost / c : 0;
+  }
+  get totalInputCost() {
+    return this.turns.reduce((sum, t) => sum + inputCostUsd(t.model, t.usage), 0);
+  }
+  get totalOutputCost() {
+    return this.turns.reduce((sum, t) => sum + outputCostUsd(t.model, t.usage), 0);
+  }
+  get aggregateCacheHitRatio() {
+    let hit = 0;
+    let miss = 0;
+    for (const t of this.turns) {
+      hit += t.usage.promptCacheHitTokens;
+      miss += t.usage.promptCacheMissTokens;
+    }
+    const denom = hit + miss;
+    return denom > 0 ? hit / denom : 0;
+  }
+  summary() {
+    const last = this.turns[this.turns.length - 1];
+    return {
+      turns: this.turns.length,
+      totalCostUsd: round(this.totalCost, 6),
+      totalInputCostUsd: round(this.totalInputCost, 6),
+      totalOutputCostUsd: round(this.totalOutputCost, 6),
+      claudeEquivalentUsd: round(this.totalClaudeEquivalent, 6),
+      savingsVsClaudePct: round(this.savingsVsClaude * 100, 2),
+      cacheHitRatio: round(this.aggregateCacheHitRatio, 4),
+      lastPromptTokens: last?.usage.promptTokens ?? 0,
+      lastTurnCostUsd: round(last?.cost ?? 0, 6)
+    };
+  }
+};
+function round(n, digits) {
+  const f = 10 ** digits;
+  return Math.round(n * f) / f;
+}
+
+// src/context-manager.ts
+var HISTORY_FOLD_THRESHOLD = 0.5;
+var HISTORY_FOLD_TAIL_FRACTION = 0.2;
+var HISTORY_FOLD_AGGRESSIVE_THRESHOLD = 0.7;
+var HISTORY_FOLD_AGGRESSIVE_TAIL_FRACTION = 0.1;
+var HISTORY_FOLD_MIN_SAVINGS_FRACTION = 0.3;
+var FORCE_SUMMARY_THRESHOLD = 0.8;
+var PREFLIGHT_EMERGENCY_THRESHOLD = 0.95;
+var HISTORY_FOLD_MARKER = "[CONVERSATION HISTORY SUMMARY \u2014 earlier turns folded for context efficiency]\n\n";
+var ContextManager = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  /** Decision after a turn's response — fold, exit with summary, or carry on. */
+  decideAfterUsage(usage, model, alreadyFoldedThisTurn) {
+    const ctxMax = DEEPSEEK_CONTEXT_TOKENS[model] ?? DEFAULT_CONTEXT_TOKENS;
+    if (!usage) return { kind: "none", promptTokens: 0, ctxMax, ratio: 0 };
+    const ratio = usage.promptTokens / ctxMax;
+    const base = { promptTokens: usage.promptTokens, ctxMax, ratio };
+    if (ratio > FORCE_SUMMARY_THRESHOLD) {
+      return { kind: "exit-with-summary", ...base };
+    }
+    if (alreadyFoldedThisTurn) return { kind: "none", ...base };
+    if (ratio > HISTORY_FOLD_AGGRESSIVE_THRESHOLD) {
+      return {
+        kind: "fold",
+        ...base,
+        tailBudget: Math.floor(ctxMax * HISTORY_FOLD_AGGRESSIVE_TAIL_FRACTION),
+        aggressive: true
+      };
+    }
+    if (ratio > HISTORY_FOLD_THRESHOLD) {
+      return {
+        kind: "fold",
+        ...base,
+        tailBudget: Math.floor(ctxMax * HISTORY_FOLD_TAIL_FRACTION),
+        aggressive: false
+      };
+    }
+    return { kind: "none", ...base };
+  }
+  /** Local-side preflight before sending a request — catches oversized payloads early. */
+  decidePreflight(messages, toolSpecs, model) {
+    const ctxMax = DEEPSEEK_CONTEXT_TOKENS[model] ?? DEFAULT_CONTEXT_TOKENS;
+    const estimate = estimateRequestTokens(messages, toolSpecs ?? null);
+    return {
+      needsAction: estimate / ctxMax > PREFLIGHT_EMERGENCY_THRESHOLD,
+      estimateTokens: estimate,
+      ctxMax
+    };
+  }
+  /** Replace older turns with one summary message; keep tail within keepRecentTokens budget. */
+  async fold(model, opts) {
+    const ctxMax = DEEPSEEK_CONTEXT_TOKENS[model] ?? DEFAULT_CONTEXT_TOKENS;
+    const tailBudget = opts?.keepRecentTokens ?? Math.floor(ctxMax * HISTORY_FOLD_TAIL_FRACTION);
+    const all = this.deps.log.toMessages();
+    const noop = {
+      folded: false,
+      beforeMessages: all.length,
+      afterMessages: all.length,
+      summaryChars: 0
+    };
+    if (all.length === 0) return noop;
+    const tokenCounts = all.map((m) => estimateConversationTokens([m]));
+    const totalTokens = tokenCounts.reduce((a, b) => a + b, 0);
+    let cumTokens = 0;
+    let boundary = all.length;
+    for (let i = all.length - 1; i >= 0; i--) {
+      if (cumTokens + tokenCounts[i] > tailBudget) break;
+      cumTokens += tokenCounts[i];
+      if (all[i].role === "user") boundary = i;
+    }
+    if (boundary <= 0) return noop;
+    const head = all.slice(0, boundary);
+    const tail = all.slice(boundary);
+    const headTokens = totalTokens - cumTokens;
+    if (headTokens < totalTokens * HISTORY_FOLD_MIN_SAVINGS_FRACTION) return noop;
+    const summary = await this.summarizeForFold(head);
+    if (!summary) return noop;
+    const summaryMsg = {
+      role: "assistant",
+      content: HISTORY_FOLD_MARKER + summary
+    };
+    const replacement = [summaryMsg, ...tail];
+    this.deps.log.compactInPlace(replacement);
+    this.persistRewrite(replacement);
+    return {
+      folded: true,
+      beforeMessages: all.length,
+      afterMessages: replacement.length,
+      summaryChars: summary.length
+    };
+  }
+  /** Drop a trailing in-flight assistant-with-tool_calls before a forced summary. Tail-only mutation; prefix cache safe. */
+  trimTrailingToolCalls() {
+    const tail = this.deps.log.entries[this.deps.log.entries.length - 1];
+    if (!tail || tail.role !== "assistant" || !Array.isArray(tail.tool_calls) || tail.tool_calls.length === 0) {
+      return false;
+    }
+    const kept = this.deps.log.entries.slice(0, -1);
+    this.deps.log.compactInPlace([...kept]);
+    this.persistRewrite([...kept]);
+    return true;
+  }
+  async summarizeForFold(messagesToSummarize) {
+    const summaryModel = "deepseek-v4-flash";
+    const systemPrompt = "You compress conversation history for a coding agent. Output one prose recap that preserves: the user's overall goal, decisions and conclusions reached, files inspected or modified, important tool results still relevant to ongoing work, and any open todos. Skip turn-by-turn play-by-play. No tool calls, no markdown headings, no SEARCH/REPLACE blocks \u2014 plain prose only.";
+    const healed = healLoadedMessages(messagesToSummarize, DEFAULT_MAX_RESULT_CHARS).messages;
+    const messages = [
+      { role: "system", content: systemPrompt },
+      ...healed,
+      {
+        role: "user",
+        content: "Summarize the conversation above as plain prose. This summary replaces the original turns to free context \u2014 make it self-contained."
+      }
+    ];
+    try {
+      const resp = await this.deps.client.chat({
+        model: summaryModel,
+        messages,
+        signal: this.deps.getAbortSignal(),
+        thinking: thinkingModeForModel(summaryModel),
+        reasoningEffort: "high"
+      });
+      this.deps.stats.record(this.deps.getCurrentTurn(), summaryModel, resp.usage ?? new Usage());
+      return stripHallucinatedToolMarkup((resp.content ?? "").trim());
+    } catch {
+      return "";
+    }
+  }
+  persistRewrite(messages) {
+    if (!this.deps.sessionName) return;
+    try {
+      rewriteSession(this.deps.sessionName, messages);
+    } catch {
+    }
+  }
+};
+
+// src/memory/runtime.ts
+import { createHash } from "crypto";
+var ImmutablePrefix = class {
+  system;
+  /** Each `addTool` costs one cache-miss turn — DeepSeek's prefix cache is keyed by full tool list. */
+  _toolSpecs;
+  fewShots;
+  /** Invalidated only via `addTool`; bypassing it leaves cache stale → fingerprint diverges from sent prefix. */
+  _fingerprintCache = null;
+  constructor(opts) {
+    this.system = opts.system;
+    this._toolSpecs = [...opts.toolSpecs ?? []];
+    this.fewShots = Object.freeze([...opts.fewShots ?? []]);
+  }
+  get toolSpecs() {
+    return this._toolSpecs;
+  }
+  toMessages() {
+    return [{ role: "system", content: this.system }, ...this.fewShots.map((m) => ({ ...m }))];
+  }
+  tools() {
+    return this._toolSpecs.map((t) => structuredClone(t));
+  }
+  addTool(spec) {
+    const name = spec.function?.name;
+    if (!name) return false;
+    if (this._toolSpecs.some((t) => t.function?.name === name)) return false;
+    this._toolSpecs.push(spec);
+    this._fingerprintCache = null;
+    return true;
+  }
+  get fingerprint() {
+    if (this._fingerprintCache !== null) return this._fingerprintCache;
+    this._fingerprintCache = this.computeFingerprint();
+    return this._fingerprintCache;
+  }
+  /** Dev/test only — throws on cache drift, which always means a non-`addTool` mutation slipped in. */
+  verifyFingerprint() {
+    const fresh = this.computeFingerprint();
+    if (this._fingerprintCache !== null && this._fingerprintCache !== fresh) {
+      throw new Error(
+        `ImmutablePrefix fingerprint drift: cached=${this._fingerprintCache}, fresh=${fresh}. A mutation path bypassed addTool's cache invalidation \u2014 DeepSeek will see prefix churn that the TUI / transcript log don't know about.`
+      );
+    }
+    this._fingerprintCache = fresh;
+    return fresh;
+  }
+  computeFingerprint() {
+    const blob = JSON.stringify({
+      system: this.system,
+      tools: this._toolSpecs,
+      shots: this.fewShots
+    });
+    return createHash("sha256").update(blob).digest("hex").slice(0, 16);
+  }
+};
+var AppendOnlyLog = class {
+  _entries = [];
+  append(message) {
+    if (!message || typeof message !== "object" || !("role" in message)) {
+      throw new Error(`invalid log entry: ${JSON.stringify(message)}`);
+    }
+    this._entries.push(message);
+  }
+  extend(messages) {
+    for (const m of messages) this.append(m);
+  }
+  /** The one append-only-breaking path — reserved for `/compact` + recovery. Use `append()` otherwise. */
+  compactInPlace(replacement) {
+    this._entries = [...replacement];
+  }
+  get entries() {
+    return this._entries;
+  }
+  toMessages() {
+    return this._entries.map((e) => ({ ...e }));
+  }
+  get length() {
+    return this._entries.length;
+  }
+};
+var VolatileScratch = class {
+  reasoning = null;
+  planState = null;
+  notes = [];
+  reset() {
+    this.reasoning = null;
+    this.planState = null;
+    this.notes = [];
+  }
+};
+
 // src/repair/scavenge.ts
 function scavengeToolCalls(reasoningContent, opts) {
   if (!reasoningContent) return { calls: [], notes: [] };
@@ -1716,109 +2007,7 @@ function signature(call) {
   return `${call.function?.name ?? ""}::${call.function?.arguments ?? ""}`;
 }
 
-// src/telemetry/stats.ts
-var DEEPSEEK_PRICING = {
-  "deepseek-v4-flash": { inputCacheHit: 0.028, inputCacheMiss: 0.139, output: 0.278 },
-  "deepseek-v4-pro": { inputCacheHit: 0.139, inputCacheMiss: 1.667, output: 3.333 },
-  // Compat aliases — priced as v4-flash per the deprecation notice.
-  "deepseek-chat": { inputCacheHit: 0.028, inputCacheMiss: 0.139, output: 0.278 },
-  "deepseek-reasoner": { inputCacheHit: 0.028, inputCacheMiss: 0.139, output: 0.278 }
-};
-var CLAUDE_SONNET_PRICING = { input: 3, output: 15 };
-var DEEPSEEK_CONTEXT_TOKENS = {
-  "deepseek-v4-flash": 1e6,
-  "deepseek-v4-pro": 1e6,
-  "deepseek-chat": 1e6,
-  "deepseek-reasoner": 1e6
-};
-var DEFAULT_CONTEXT_TOKENS = 131072;
-function costUsd(model, usage) {
-  const p = DEEPSEEK_PRICING[model];
-  if (!p) return 0;
-  return (usage.promptCacheHitTokens * p.inputCacheHit + usage.promptCacheMissTokens * p.inputCacheMiss + usage.completionTokens * p.output) / 1e6;
-}
-function inputCostUsd(model, usage) {
-  const p = DEEPSEEK_PRICING[model];
-  if (!p) return 0;
-  return (usage.promptCacheHitTokens * p.inputCacheHit + usage.promptCacheMissTokens * p.inputCacheMiss) / 1e6;
-}
-function outputCostUsd(model, usage) {
-  const p = DEEPSEEK_PRICING[model];
-  if (!p) return 0;
-  return usage.completionTokens * p.output / 1e6;
-}
-function cacheSavingsUsd(model, hitTokens) {
-  if (hitTokens <= 0) return 0;
-  const p = DEEPSEEK_PRICING[model];
-  if (!p) return 0;
-  return hitTokens * (p.inputCacheMiss - p.inputCacheHit) / 1e6;
-}
-function claudeEquivalentCost(usage) {
-  return (usage.promptTokens * CLAUDE_SONNET_PRICING.input + usage.completionTokens * CLAUDE_SONNET_PRICING.output) / 1e6;
-}
-var SessionStats = class {
-  turns = [];
-  record(turn, model, usage) {
-    const cost = costUsd(model, usage);
-    const stats = {
-      turn,
-      model,
-      usage,
-      cost,
-      cacheHitRatio: usage.cacheHitRatio
-    };
-    this.turns.push(stats);
-    return stats;
-  }
-  get totalCost() {
-    return this.turns.reduce((sum, t) => sum + t.cost, 0);
-  }
-  get totalClaudeEquivalent() {
-    return this.turns.reduce((sum, t) => sum + claudeEquivalentCost(t.usage), 0);
-  }
-  get savingsVsClaude() {
-    const c = this.totalClaudeEquivalent;
-    return c > 0 ? 1 - this.totalCost / c : 0;
-  }
-  get totalInputCost() {
-    return this.turns.reduce((sum, t) => sum + inputCostUsd(t.model, t.usage), 0);
-  }
-  get totalOutputCost() {
-    return this.turns.reduce((sum, t) => sum + outputCostUsd(t.model, t.usage), 0);
-  }
-  get aggregateCacheHitRatio() {
-    let hit = 0;
-    let miss = 0;
-    for (const t of this.turns) {
-      hit += t.usage.promptCacheHitTokens;
-      miss += t.usage.promptCacheMissTokens;
-    }
-    const denom = hit + miss;
-    return denom > 0 ? hit / denom : 0;
-  }
-  summary() {
-    const last = this.turns[this.turns.length - 1];
-    return {
-      turns: this.turns.length,
-      totalCostUsd: round(this.totalCost, 6),
-      totalInputCostUsd: round(this.totalInputCost, 6),
-      totalOutputCostUsd: round(this.totalOutputCost, 6),
-      claudeEquivalentUsd: round(this.totalClaudeEquivalent, 6),
-      savingsVsClaudePct: round(this.savingsVsClaude * 100, 2),
-      cacheHitRatio: round(this.aggregateCacheHitRatio, 4),
-      lastPromptTokens: last?.usage.promptTokens ?? 0,
-      lastTurnCostUsd: round(last?.cost ?? 0, 6)
-    };
-  }
-};
-function round(n, digits) {
-  const f = 10 ** digits;
-  return Math.round(n * f) / f;
-}
-
 // src/loop.ts
-var ARGS_COMPACT_THRESHOLD_TOKENS = 800;
-var TURN_END_RESULT_CAP_TOKENS = 3e3;
 var FAILURE_ESCALATION_THRESHOLD = 3;
 var ESCALATION_MODEL = "deepseek-v4-pro";
 var NEEDS_PRO_MARKER_PREFIX = "<<<NEEDS_PRO";
@@ -1849,6 +2038,8 @@ var CacheFirstLoop = class {
   sessionName;
   hooks;
   hookCwd;
+  /** PauseGate bridge — defaults to singleton, injectable for tests. */
+  confirmationGate;
   /** Number of messages that were pre-loaded from the session file. */
   resumedMessageCount;
   _turn = 0;
@@ -1860,6 +2051,8 @@ var CacheFirstLoop = class {
   _turnFailureCount = 0;
   _turnFailureTypes = {};
   _turnSelfCorrected = false;
+  _foldedThisTurn = false;
+  context;
   constructor(opts) {
     this.client = opts.client;
     this.prefix = opts.prefix;
@@ -1871,6 +2064,7 @@ var CacheFirstLoop = class {
     this.maxToolIters = opts.maxToolIters ?? 64;
     this.hooks = opts.hooks ?? [];
     this.hookCwd = opts.hookCwd ?? process.cwd();
+    this.confirmationGate = opts.confirmationGate ?? pauseGate;
     if (typeof opts.branch === "number") {
       this.branchOptions = { budget: opts.branch };
     } else if (opts.branch && typeof opts.branch === "object") {
@@ -1933,54 +2127,18 @@ var CacheFirstLoop = class {
     } else {
       this.resumedMessageCount = 0;
     }
+    this.context = new ContextManager({
+      client: this.client,
+      log: this.log,
+      stats: this.stats,
+      sessionName: this.sessionName,
+      getAbortSignal: () => this._turnAbort.signal,
+      getCurrentTurn: () => this._turn
+    });
   }
-  /** Shrink huge edit_file/write_file args post-dispatch — tool result already explains. */
-  compactToolCallArgsAfterResponse() {
-    const before = this.log.toMessages();
-    const { messages, healedCount } = shrinkOversizedToolCallArgsByTokens(
-      before,
-      ARGS_COMPACT_THRESHOLD_TOKENS
-    );
-    if (healedCount === 0) return;
-    this.log.compactInPlace(messages);
-    if (this.sessionName) {
-      try {
-        rewriteSession(this.sessionName, messages);
-      } catch {
-      }
-    }
-  }
-  /** Preventive end-of-turn shrink — trim big results before they ride into the next prompt. */
-  autoCompactToolResultsOnTurnEnd() {
-    const before = this.log.toMessages();
-    const shrunk = shrinkOversizedToolResultsByTokens(before, TURN_END_RESULT_CAP_TOKENS);
-    if (shrunk.healedCount === 0) return;
-    this.log.compactInPlace(shrunk.messages);
-    if (this.sessionName) {
-      try {
-        rewriteSession(this.sessionName, shrunk.messages);
-      } catch {
-      }
-    }
-  }
-  compact(maxTokens = 4e3) {
-    const before = this.log.toMessages();
-    const resultsPass = shrinkOversizedToolResultsByTokens(before, maxTokens);
-    const argsPass = shrinkOversizedToolCallArgsByTokens(resultsPass.messages, maxTokens);
-    const messages = argsPass.messages;
-    const healedCount = resultsPass.healedCount + argsPass.healedCount;
-    const tokensSaved = resultsPass.tokensSaved + argsPass.tokensSaved;
-    const charsSaved = resultsPass.charsSaved + argsPass.charsSaved;
-    if (healedCount > 0) {
-      this.log.compactInPlace(messages);
-      if (this.sessionName) {
-        try {
-          rewriteSession(this.sessionName, messages);
-        } catch {
-        }
-      }
-    }
-    return { healedCount, tokensSaved, charsSaved };
+  /** Replace older turns with one summary message; keep tail within keepRecentTokens budget. */
+  async compactHistory(opts) {
+    return this.context.fold(this.model, opts);
   }
   appendAndPersist(message) {
     this.log.append(message);
@@ -2178,6 +2336,7 @@ var CacheFirstLoop = class {
     this._turnFailureTypes = {};
     this._turnSelfCorrected = false;
     this._escalateThisTurn = false;
+    this._foldedThisTurn = false;
     let armedConsumed = false;
     if (this._proArmedForNextTurn) {
       this._escalateThisTurn = true;
@@ -2214,7 +2373,6 @@ var CacheFirstLoop = class {
           content: stoppedMsg,
           forcedSummary: true
         };
-        this.autoCompactToolResultsOnTurnEnd();
         yield { turn: this._turn, role: "done", content: stoppedMsg };
         this._turnAbort = new AbortController();
         return;
@@ -2236,26 +2394,31 @@ var CacheFirstLoop = class {
       }
       let messages = this.buildMessages(pendingUser);
       {
-        const ctxMax2 = DEEPSEEK_CONTEXT_TOKENS[this.model] ?? DEFAULT_CONTEXT_TOKENS;
-        const estimate = estimateRequestTokens(messages, this.prefix.toolSpecs);
-        if (estimate / ctxMax2 > 0.95) {
-          const result = this.compact(1e3);
-          if (result.healedCount > 0) {
+        const decision2 = this.context.decidePreflight(messages, this.prefix.toolSpecs, this.model);
+        if (decision2.needsAction) {
+          const { estimateTokens: estimate, ctxMax } = decision2;
+          yield {
+            turn: this._turn,
+            role: "status",
+            content: "preflight: context near full, attempting fold\u2026"
+          };
+          const result = await this.context.fold(this.model);
+          if (result.folded) {
             yield {
               turn: this._turn,
               role: "warning",
-              content: `preflight: request ~${estimate.toLocaleString()}/${ctxMax2.toLocaleString()} tokens (${Math.round(
-                estimate / ctxMax2 * 100
-              )}%) \u2014 pre-compacted ${result.healedCount} tool result(s), saved ${result.tokensSaved.toLocaleString()} tokens. Sending.`
+              content: `preflight: request ~${estimate.toLocaleString()}/${ctxMax.toLocaleString()} tokens (${Math.round(
+                estimate / ctxMax * 100
+              )}%) \u2014 folded ${result.beforeMessages} messages \u2192 ${result.afterMessages} (summary ${result.summaryChars} chars). Sending.`
             };
             messages = this.buildMessages(pendingUser);
           } else {
             yield {
               turn: this._turn,
               role: "warning",
-              content: `preflight: request ~${estimate.toLocaleString()}/${ctxMax2.toLocaleString()} tokens (${Math.round(
-                estimate / ctxMax2 * 100
-              )}%) and nothing to auto-compact \u2014 DeepSeek will likely 400. Run /forget or /clear to start fresh.`
+              content: `preflight: request ~${estimate.toLocaleString()}/${ctxMax.toLocaleString()} tokens (${Math.round(
+                estimate / ctxMax * 100
+              )}%) and nothing left to fold \u2014 DeepSeek will likely 400. Run /clear or /new to start fresh.`
             };
           }
         }
@@ -2310,8 +2473,8 @@ var CacheFirstLoop = class {
             }
           );
           for (let k = 0; k < budget; k++) {
-            const sample = queue.shift() ?? await new Promise((resolve9) => {
-              waiter = resolve9;
+            const sample = queue.shift() ?? await new Promise((resolve10) => {
+              waiter = resolve10;
             });
             yield {
               turn: this._turn,
@@ -2450,7 +2613,6 @@ var CacheFirstLoop = class {
         }
       } catch (err) {
         if (signal.aborted) {
-          this.autoCompactToolResultsOnTurnEnd();
           yield { turn: this._turn, role: "done", content: "" };
           this._turnAbort = new AbortController();
           return;
@@ -2568,60 +2730,43 @@ var CacheFirstLoop = class {
           yield* this.forceSummaryAfterIterLimit({ reason: "stuck" });
           return;
         }
-        this.autoCompactToolResultsOnTurnEnd();
         yield { turn: this._turn, role: "done", content: assistantContent };
         return;
       }
-      const ctxMax = DEEPSEEK_CONTEXT_TOKENS[this.model] ?? DEFAULT_CONTEXT_TOKENS;
-      if (usage) {
-        const ratio = usage.promptTokens / ctxMax;
-        if (ratio > 0.4 && ratio <= 0.8) {
-          const before = usage.promptTokens;
-          const soft = this.compact(4e3);
-          if (soft.healedCount > 0) {
-            const after = Math.max(0, before - soft.tokensSaved);
-            yield {
-              turn: this._turn,
-              role: "warning",
-              content: `context ${before.toLocaleString()}/${ctxMax.toLocaleString()} (${Math.round(
-                ratio * 100
-              )}%) \u2014 proactively compacted ${soft.healedCount} tool result(s) to 4k tokens, saved ${soft.tokensSaved.toLocaleString()} tokens (now ~${after.toLocaleString()}). Staying ahead of the 80% guard.`
-            };
-          }
-        }
-      }
-      if (usage && usage.promptTokens / ctxMax > 0.8) {
-        const before = usage.promptTokens;
-        const compactResult = this.compact(1e3);
-        if (compactResult.healedCount > 0) {
-          const after = Math.max(0, before - compactResult.tokensSaved);
-          yield {
-            turn: this._turn,
-            role: "warning",
-            content: `context ${before.toLocaleString()}/${ctxMax.toLocaleString()} \u2014 auto-compacted ${compactResult.healedCount} oversized tool result(s), saved ${compactResult.tokensSaved.toLocaleString()} tokens (now ~${after.toLocaleString()}). Continuing.`
-          };
-        } else {
+      const decision = this.context.decideAfterUsage(usage, this.model, this._foldedThisTurn);
+      if (decision.kind === "fold") {
+        this._foldedThisTurn = true;
+        const before = decision.promptTokens;
+        const ctxMax = decision.ctxMax;
+        const aggressiveTag = decision.aggressive ? " (aggressive)" : "";
+        yield {
+          turn: this._turn,
+          role: "status",
+          content: `compacting history${aggressiveTag}\u2026`
+        };
+        const result = await this.compactHistory({ keepRecentTokens: decision.tailBudget });
+        if (result.folded) {
           yield {
             turn: this._turn,
             role: "warning",
-            content: `context ${before.toLocaleString()}/${ctxMax.toLocaleString()} (${Math.round(
-              before / ctxMax * 100
-            )}%) \u2014 nothing to auto-compact. Forcing summary from what was gathered.`
-          };
-          const tail = this.log.entries[this.log.entries.length - 1];
-          if (tail && tail.role === "assistant" && Array.isArray(tail.tool_calls) && tail.tool_calls.length > 0) {
-            const kept = this.log.entries.slice(0, -1);
-            this.log.compactInPlace([...kept]);
-            if (this.sessionName) {
-              try {
-                rewriteSession(this.sessionName, kept);
-              } catch {
-              }
-            }
-          }
-          yield* this.forceSummaryAfterIterLimit({ reason: "context-guard" });
-          return;
+            content: `context ${before.toLocaleString()}/${ctxMax.toLocaleString()} (${Math.round(
+              before / ctxMax * 100
+            )}%) \u2014 ${decision.aggressive ? "aggressively folded" : "folded"} ${result.beforeMessages} messages \u2192 ${result.afterMessages} (summary ${result.summaryChars} chars). Continuing.`
+          };
         }
+      } else if (decision.kind === "exit-with-summary") {
+        const before = decision.promptTokens;
+        const ctxMax = decision.ctxMax;
+        yield {
+          turn: this._turn,
+          role: "warning",
+          content: `context ${before.toLocaleString()}/${ctxMax.toLocaleString()} (${Math.round(
+            before / ctxMax * 100
+          )}%) \u2014 forcing summary from what was gathered. Run /compact, /clear, or /new to reset.`
+        };
+        this.context.trimTrailingToolCalls();
+        yield* this.forceSummaryAfterIterLimit({ reason: "context-guard" });
+        return;
       }
       for (const call of repairedCalls) {
         const name = call.function?.name ?? "";
@@ -2653,7 +2798,8 @@ ${reason}`;
         } else {
           result = await this.tools.dispatch(name, args, {
             signal,
-            maxResultTokens: DEFAULT_MAX_RESULT_TOKENS
+            maxResultTokens: DEFAULT_MAX_RESULT_TOKENS,
+            confirmationGate: this.confirmationGate
           });
           const postReport = await runHooks({
             hooks: this.hooks,
@@ -2673,7 +2819,6 @@ ${reason}`;
           name,
           content: result
         });
-        this.compactToolCallArgsAfterResponse();
         if (this.noteToolFailureSignal(result)) {
           yield {
             turn: this._turn,
@@ -2732,7 +2877,6 @@ ${summary}`;
         stats: summaryStats,
         forcedSummary: true
       };
-      this.autoCompactToolResultsOnTurnEnd();
       yield { turn: this._turn, role: "done", content: summary };
     } catch (err) {
       const label = errorLabelFor(opts.reason, this.maxToolIters);
@@ -2742,7 +2886,6 @@ ${summary}`;
         content: "",
         error: `${label} and the fallback summary call failed: ${err.message}. Run /clear and retry with a narrower question, or raise --max-tool-iters.`
       };
-      this.autoCompactToolResultsOnTurnEnd();
       yield { turn: this._turn, role: "done", content: "" };
     }
   }
@@ -2871,56 +3014,6 @@ function shrinkOversizedToolResultsByTokens(messages, maxTokens) {
   });
   return { messages: out, healedCount, tokensSaved, charsSaved };
 }
-function shrinkOversizedToolCallArgsByTokens(messages, maxTokens) {
-  let healedCount = 0;
-  let tokensSaved = 0;
-  let charsSaved = 0;
-  const out = messages.map((msg) => {
-    if (msg.role !== "assistant" || !Array.isArray(msg.tool_calls)) return msg;
-    let changed = false;
-    const newCalls = msg.tool_calls.map((call) => {
-      const args = call.function?.arguments;
-      if (typeof args !== "string" || args.length <= maxTokens) return call;
-      const beforeTokens = countTokens(args);
-      if (beforeTokens <= maxTokens) return call;
-      const shrunk = shrinkJsonLongStrings(args);
-      const afterTokens = countTokens(shrunk);
-      if (afterTokens >= beforeTokens) return call;
-      changed = true;
-      healedCount += 1;
-      tokensSaved += beforeTokens - afterTokens;
-      charsSaved += args.length - shrunk.length;
-      return { ...call, function: { ...call.function, arguments: shrunk } };
-    });
-    if (!changed) return msg;
-    return { ...msg, tool_calls: newCalls };
-  });
-  return { messages: out, healedCount, tokensSaved, charsSaved };
-}
-function shrinkJsonLongStrings(jsonStr) {
-  let parsed;
-  try {
-    parsed = JSON.parse(jsonStr);
-  } catch {
-    const head = jsonStr.slice(0, 200);
-    return `${head}\u2026[shrunk: ${jsonStr.length} chars, unparsed]`;
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return jsonStr;
-  }
-  const LONG_THRESHOLD = 300;
-  const input = parsed;
-  const output = {};
-  for (const [k, v] of Object.entries(input)) {
-    if (typeof v === "string" && v.length > LONG_THRESHOLD) {
-      const newlines = v.match(/\n/g)?.length ?? 0;
-      output[k] = `[\u2026shrunk: ${v.length} chars, ${newlines} lines \u2014 tool already responded, see result]`;
-    } else {
-      output[k] = v;
-    }
-  }
-  return JSON.stringify(output);
-}
 function fixToolCallPairing(messages) {
   const out = [];
   let droppedAssistantCalls = 0;
@@ -4876,7 +4969,7 @@ function registerChoiceTool(registry, opts = {}) {
       },
       required: ["question", "options"]
     },
-    fn: async (args) => {
+    fn: async (args, ctx) => {
       const question = (args?.question ?? "").trim();
       if (!question) {
         throw new Error(
@@ -4896,7 +4989,13 @@ function registerChoiceTool(registry, opts = {}) {
       }
       const allowCustom = args?.allowCustom === true;
       opts.onChoiceRequested?.(question, options);
-      throw new ChoiceRequestedError(question, options, allowCustom);
+      const verdict = await (ctx?.confirmationGate ?? pauseGate).ask({
+        kind: "choice",
+        payload: { question, options, allowCustom }
+      });
+      if (verdict.type === "pick") return `user picked: ${verdict.optionId}`;
+      if (verdict.type === "text") return `user answered: ${verdict.text}`;
+      return "user cancelled the choice";
     }
   });
   return registry;
@@ -5013,7 +5112,7 @@ function registerSubmitPlan(registry, opts) {
       },
       required: ["plan"]
     },
-    fn: async (args) => {
+    fn: async (args, ctx) => {
       const plan = (args?.plan ?? "").trim();
       if (!plan) {
         throw new Error("submit_plan: empty plan \u2014 write a markdown plan and try again.");
@@ -5021,7 +5120,13 @@ function registerSubmitPlan(registry, opts) {
       const steps = sanitizeSteps(args?.steps);
       const summary = typeof args?.summary === "string" ? args.summary.trim() || void 0 : void 0;
       opts.onPlanSubmitted?.(plan, steps);
-      throw new PlanProposedError(plan, steps, summary);
+      const verdict = await (ctx?.confirmationGate ?? pauseGate).ask({
+        kind: "plan_proposed",
+        payload: { plan, steps, summary }
+      });
+      if (verdict.type === "approve") return "plan approved";
+      if (verdict.type === "refine") throw new Error("user requested refinement");
+      throw new Error("plan cancelled");
     }
   });
 }
@@ -5052,7 +5157,7 @@ function registerMarkStepComplete(registry, opts) {
       },
       required: ["stepId", "result"]
     },
-    fn: async (args) => {
+    fn: async (args, ctx) => {
       const stepId = (args?.stepId ?? "").trim();
       const result = (args?.result ?? "").trim();
       if (!stepId) {
@@ -5069,7 +5174,16 @@ function registerMarkStepComplete(registry, opts) {
       if (title) update.title = title;
       if (notes) update.notes = notes;
       opts.onStepCompleted?.(update);
-      return update;
+      const verdict = await (ctx?.confirmationGate ?? pauseGate).ask({
+        kind: "plan_checkpoint",
+        payload: { stepId, title, result, notes }
+      });
+      if (verdict.type === "continue") return JSON.stringify(update);
+      if (verdict.type === "revise") {
+        if (verdict.feedback) return `revision requested: ${verdict.feedback}`;
+        throw new Error("user requested revision at checkpoint");
+      }
+      throw new Error("user stopped at checkpoint");
     }
   });
 }
@@ -5097,7 +5211,7 @@ function registerRevisePlan(registry, opts) {
       },
       required: ["reason", "remainingSteps"]
     },
-    fn: async (args) => {
+    fn: async (args, ctx) => {
       const reason = (args?.reason ?? "").trim();
       if (!reason) {
         throw new Error(
@@ -5112,7 +5226,13 @@ function registerRevisePlan(registry, opts) {
       }
       const summary = typeof args?.summary === "string" ? args.summary.trim() || void 0 : void 0;
       opts.onPlanRevisionProposed?.(reason, remainingSteps, summary);
-      throw new PlanRevisionProposedError(reason, remainingSteps, summary);
+      const verdict = await (ctx?.confirmationGate ?? pauseGate).ask({
+        kind: "plan_revision",
+        payload: { reason, remainingSteps, summary }
+      });
+      if (verdict.type === "accepted") return "revision accepted";
+      if (verdict.type === "rejected") throw new Error("revision rejected");
+      throw new Error("revision cancelled");
     }
   });
 }
@@ -5367,9 +5487,63 @@ function forkRegistryExcluding(parent, exclude) {
 }
 
 // src/tools/shell.ts
-import { spawn as spawn3, spawnSync } from "child_process";
+import { spawn as spawn4, spawnSync } from "child_process";
 import { existsSync as existsSync8, statSync as statSync4 } from "fs";
-import * as pathMod3 from "path";
+import * as pathMod4 from "path";
+
+// src/config.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname4, join as join9 } from "path";
+function defaultConfigPath() {
+  return join9(homedir5(), ".reasonix", "config.json");
+}
+function readConfig(path2 = defaultConfigPath()) {
+  try {
+    const raw = readFileSync9(path2, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object") return parsed;
+  } catch {
+  }
+  return {};
+}
+function writeConfig(cfg, path2 = defaultConfigPath()) {
+  mkdirSync3(dirname4(path2), { recursive: true });
+  writeFileSync3(path2, JSON.stringify(cfg, null, 2), "utf8");
+  try {
+    chmodSync2(path2, 384);
+  } catch {
+  }
+}
+function loadApiKey(path2 = defaultConfigPath()) {
+  if (process.env.DEEPSEEK_API_KEY) return process.env.DEEPSEEK_API_KEY;
+  return readConfig(path2).apiKey;
+}
+function saveApiKey(key, path2 = defaultConfigPath()) {
+  const cfg = readConfig(path2);
+  cfg.apiKey = key.trim();
+  writeConfig(cfg, path2);
+}
+function addProjectShellAllowed(rootDir, prefix, path2 = defaultConfigPath()) {
+  const trimmed = prefix.trim();
+  if (!trimmed) return;
+  const cfg = readConfig(path2);
+  if (!cfg.projects) cfg.projects = {};
+  if (!cfg.projects[rootDir]) cfg.projects[rootDir] = {};
+  const existing = cfg.projects[rootDir].shellAllowed ?? [];
+  if (existing.includes(trimmed)) return;
+  cfg.projects[rootDir].shellAllowed = [...existing, trimmed];
+  writeConfig(cfg, path2);
+}
+function isPlausibleKey(key) {
+  const trimmed = key.trim();
+  return /^sk-[A-Za-z0-9_-]{16,}$/.test(trimmed);
+}
+function redactKey(key) {
+  if (!key) return "";
+  if (key.length <= 12) return "****";
+  return `${key.slice(0, 6)}\u2026${key.slice(-4)}`;
+}
 
 // src/tools/jobs.ts
 import { spawn as spawn2 } from "child_process";
@@ -5659,6 +5833,417 @@ function snapshot(job) {
   };
 }
 
+// src/tools/shell-chain.ts
+import { spawn as spawn3 } from "child_process";
+import { closeSync, openSync } from "fs";
+import * as pathMod3 from "path";
+var UnsupportedSyntaxError = class extends Error {
+  constructor(detail) {
+    super(`run_command: ${detail}`);
+    this.name = "UnsupportedSyntaxError";
+  }
+};
+function splitOnChainOps(cmd) {
+  const segs = [];
+  const ops = [];
+  let segStart = 0;
+  let i = 0;
+  let quote = null;
+  let atTokenStart = true;
+  while (i < cmd.length) {
+    const ch = cmd[i];
+    if (quote) {
+      if (ch === quote) quote = null;
+      else if (ch === "\\" && quote === '"' && i + 1 < cmd.length) i++;
+      i++;
+      atTokenStart = false;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      i++;
+      atTokenStart = false;
+      continue;
+    }
+    if (ch === " " || ch === "	") {
+      i++;
+      atTokenStart = true;
+      continue;
+    }
+    if (atTokenStart) {
+      let op = null;
+      let opLen = 0;
+      const next = cmd[i + 1];
+      if (ch === "|" && next === "|") {
+        op = "||";
+        opLen = 2;
+      } else if (ch === "&" && next === "&") {
+        op = "&&";
+        opLen = 2;
+      } else if (ch === "|") {
+        op = "|";
+        opLen = 1;
+      } else if (ch === ";") {
+        op = ";";
+        opLen = 1;
+      }
+      if (op !== null) {
+        segs.push(cmd.slice(segStart, i));
+        ops.push(op);
+        i += opLen;
+        segStart = i;
+        atTokenStart = true;
+        continue;
+      }
+    }
+    i++;
+    atTokenStart = false;
+  }
+  segs.push(cmd.slice(segStart));
+  return { segs, ops };
+}
+function parseSegment(segStr) {
+  const argv = [];
+  const redirects = [];
+  let cur = "";
+  let curHasContent = false;
+  let pending = null;
+  let quote = null;
+  const flush = () => {
+    if (!curHasContent && cur.length === 0) return;
+    if (pending) {
+      redirects.push({ kind: pending, target: cur });
+      pending = null;
+    } else {
+      argv.push(cur);
+    }
+    cur = "";
+    curHasContent = false;
+  };
+  let i = 0;
+  while (i < segStr.length) {
+    const ch = segStr[i];
+    if (quote) {
+      if (ch === quote) {
+        quote = null;
+      } else if (ch === "\\" && quote === '"' && i + 1 < segStr.length) {
+        cur += segStr[++i] ?? "";
+        curHasContent = true;
+      } else {
+        cur += ch;
+        curHasContent = true;
+      }
+      i++;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      curHasContent = true;
+      i++;
+      continue;
+    }
+    if (ch === " " || ch === "	") {
+      flush();
+      i++;
+      continue;
+    }
+    if (cur.length === 0 && !curHasContent) {
+      const remaining = segStr.slice(i);
+      let matched = null;
+      if (remaining.startsWith("2>&1")) matched = { op: "2>&1", len: 4 };
+      else if (remaining.startsWith("&>")) matched = { op: "&>", len: 2 };
+      else if (remaining.startsWith("2>>")) matched = { op: "2>>", len: 3 };
+      else if (remaining.startsWith("2>")) matched = { op: "2>", len: 2 };
+      else if (remaining.startsWith(">>")) matched = { op: ">>", len: 2 };
+      else if (remaining.startsWith(">")) matched = { op: ">", len: 1 };
+      else if (remaining.startsWith("<<")) {
+        throw new UnsupportedSyntaxError(
+          `shell operator "<<" is not supported \u2014 heredoc / here-string is not implemented; pass input via a "<" file or the binary's --input flag`
+        );
+      } else if (remaining.startsWith("<")) matched = { op: "<", len: 1 };
+      if (matched) {
+        if (pending !== null) {
+          throw new UnsupportedSyntaxError(
+            `redirect "${pending}" is missing a target file before "${matched.op}"`
+          );
+        }
+        if (matched.op === "2>&1") {
+          redirects.push({ kind: "2>&1", target: "" });
+        } else {
+          pending = matched.op;
+        }
+        i += matched.len;
+        continue;
+      }
+      if (ch === "&") {
+        throw new UnsupportedSyntaxError(
+          'shell operator "&" is not supported \u2014 background runs need run_background, not run_command. Wrap a literal `&` arg in quotes.'
+        );
+      }
+    }
+    cur += ch;
+    curHasContent = true;
+    i++;
+  }
+  if (quote) throw new Error(`unclosed ${quote} in command`);
+  flush();
+  if (pending) throw new UnsupportedSyntaxError(`redirect "${pending}" is missing a target file`);
+  if (argv.length === 0 && redirects.length > 0) {
+    throw new UnsupportedSyntaxError(
+      "redirect without a command \u2014 segment must have at least one program argument"
+    );
+  }
+  validateRedirectFds(redirects);
+  return { argv, redirects };
+}
+function validateRedirectFds(redirects) {
+  let stdin = 0;
+  let stdout = 0;
+  let stderr = 0;
+  for (const r of redirects) {
+    if (r.kind === "<") stdin++;
+    else if (r.kind === ">" || r.kind === ">>") stdout++;
+    else if (r.kind === "2>" || r.kind === "2>>" || r.kind === "2>&1") stderr++;
+    else if (r.kind === "&>") {
+      stdout++;
+      stderr++;
+    }
+  }
+  if (stdin > 1) throw new UnsupportedSyntaxError("multiple `<` stdin redirects in one segment");
+  if (stdout > 1)
+    throw new UnsupportedSyntaxError(
+      "multiple stdout redirects in one segment (`>` / `>>` / `&>` conflict)"
+    );
+  if (stderr > 1)
+    throw new UnsupportedSyntaxError(
+      "multiple stderr redirects in one segment (`2>` / `2>>` / `&>` / `2>&1` conflict)"
+    );
+}
+function parseCommandChain(cmd) {
+  const { segs, ops } = splitOnChainOps(cmd);
+  const segments = [];
+  for (let i = 0; i < segs.length; i++) {
+    const trimmed = segs[i].trim();
+    if (trimmed.length === 0) {
+      const op = i === 0 ? ops[0] : ops[i - 1];
+      throw new UnsupportedSyntaxError(
+        i === 0 ? `empty segment before "${op}"` : i === segs.length - 1 ? `chain ends with "${op}"` : `empty segment between "${ops[i - 1]}" and "${ops[i]}"`
+      );
+    }
+    segments.push(parseSegment(trimmed));
+  }
+  if (ops.length === 0 && segments[0].redirects.length === 0) return null;
+  return { segments, ops };
+}
+function chainAllowed(chain, isAllowed2) {
+  for (const seg of chain.segments) {
+    if (!isAllowed2(seg.argv.join(" "))) return false;
+  }
+  return true;
+}
+function groupChain(chain) {
+  const groups = [{ segments: [chain.segments[0]], opBefore: null }];
+  for (let i = 0; i < chain.ops.length; i++) {
+    const op = chain.ops[i];
+    const next = chain.segments[i + 1];
+    if (op === "|") {
+      groups[groups.length - 1].segments.push(next);
+    } else {
+      groups.push({ segments: [next], opBefore: op });
+    }
+  }
+  return groups;
+}
+async function runChain(chain, opts) {
+  const groups = groupChain(chain);
+  const buf = new OutputBuffer(opts.maxOutputChars * 2 * 4);
+  const deadline = Date.now() + opts.timeoutSec * 1e3;
+  let lastExit = 0;
+  let timedOut = false;
+  for (const group of groups) {
+    if (group.opBefore === "&&" && lastExit !== 0) continue;
+    if (group.opBefore === "||" && lastExit === 0) continue;
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) {
+      timedOut = true;
+      break;
+    }
+    const result = await runPipeGroup(group.segments, {
+      cwd: opts.cwd,
+      timeoutMs: remainingMs,
+      buf,
+      signal: opts.signal
+    });
+    lastExit = result.exitCode;
+    if (result.timedOut) {
+      timedOut = true;
+      break;
+    }
+    if (opts.signal?.aborted) break;
+  }
+  const output = buf.toString();
+  const truncated = output.length > opts.maxOutputChars ? `${output.slice(0, opts.maxOutputChars)}
+
+[\u2026 truncated ${output.length - opts.maxOutputChars} chars \u2026]` : output;
+  return { exitCode: lastExit, output: truncated, timedOut };
+}
+function openRedirects(redirects, cwd) {
+  let stdinFd = null;
+  let stdoutFd = null;
+  let stderrFd = null;
+  let mergeStderrToStdout = false;
+  let bothFd = null;
+  const toClose = [];
+  const open = (target, flags) => {
+    const resolved = pathMod3.resolve(cwd, target);
+    const fd = openSync(resolved, flags);
+    toClose.push(fd);
+    return fd;
+  };
+  for (const r of redirects) {
+    if (r.kind === "<") stdinFd = open(r.target, "r");
+    else if (r.kind === ">") stdoutFd = open(r.target, "w");
+    else if (r.kind === ">>") stdoutFd = open(r.target, "a");
+    else if (r.kind === "2>") stderrFd = open(r.target, "w");
+    else if (r.kind === "2>>") stderrFd = open(r.target, "a");
+    else if (r.kind === "&>") {
+      bothFd = open(r.target, "w");
+      stdoutFd = bothFd;
+      stderrFd = bothFd;
+    } else if (r.kind === "2>&1") {
+      mergeStderrToStdout = true;
+    }
+  }
+  return { stdinFd, stdoutFd, stderrFd, mergeStderrToStdout, toClose };
+}
+async function runPipeGroup(segments, opts) {
+  const env = { ...process.env, PYTHONIOENCODING: "utf-8", PYTHONUTF8: "1" };
+  const children = [];
+  const allFds = [];
+  let timedOut = false;
+  const killAll = () => {
+    for (const c of children) killProcessTree2(c);
+  };
+  const killTimer = setTimeout(() => {
+    timedOut = true;
+    killAll();
+  }, opts.timeoutMs);
+  const onAbort = () => killAll();
+  if (opts.signal?.aborted) {
+    onAbort();
+  } else {
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+  }
+  try {
+    for (let i = 0; i < segments.length; i++) {
+      const isFirst = i === 0;
+      const isLast = i === segments.length - 1;
+      const seg = segments[i];
+      const io = openRedirects(seg.redirects, opts.cwd);
+      allFds.push(...io.toClose);
+      const { bin, args, spawnOverrides } = prepareSpawn(seg.argv);
+      const stdoutSpec = io.stdoutFd !== null ? io.stdoutFd : "pipe";
+      const stderrSpec = io.stderrFd !== null ? io.stderrFd : io.mergeStderrToStdout ? stdoutSpec : "pipe";
+      const stdinSpec = io.stdinFd !== null ? io.stdinFd : isFirst ? "ignore" : "pipe";
+      const spawnOpts = {
+        cwd: opts.cwd,
+        shell: false,
+        windowsHide: true,
+        env,
+        stdio: [stdinSpec, stdoutSpec, stderrSpec],
+        ...spawnOverrides
+      };
+      let child;
+      try {
+        child = spawn3(bin, args, spawnOpts);
+      } catch (err) {
+        for (const fd of allFds) tryClose(fd);
+        killAll();
+        clearTimeout(killTimer);
+        opts.signal?.removeEventListener("abort", onAbort);
+        throw err;
+      }
+      children.push(child);
+      if (!isFirst && io.stdinFd === null) {
+        const prev = children[i - 1];
+        prev.stdout?.on("error", () => {
+        });
+        child.stdin?.on("error", () => {
+        });
+        const prevMergesStderr = segments[i - 1].redirects.some((r) => r.kind === "2>&1") && !!prev.stderr;
+        if (prevMergesStderr && prev.stderr) {
+          prev.stderr.on("error", () => {
+          });
+          let openSources = 2;
+          const closeIfDone = () => {
+            if (--openSources === 0) child.stdin?.end();
+          };
+          prev.stdout?.pipe(child.stdin, { end: false });
+          prev.stderr.pipe(child.stdin, { end: false });
+          prev.stdout?.once("end", closeIfDone);
+          prev.stderr.once("end", closeIfDone);
+        } else {
+          prev.stdout?.pipe(child.stdin);
+        }
+      }
+      if (child.stderr && io.stderrFd === null && !(io.mergeStderrToStdout && !isLast)) {
+        child.stderr.on("data", (chunk) => opts.buf.push(toBuf(chunk)));
+      }
+      if (isLast && child.stdout && io.stdoutFd === null) {
+        child.stdout.on("data", (chunk) => opts.buf.push(toBuf(chunk)));
+        if (io.mergeStderrToStdout && child.stderr && io.stderrFd === null) {
+          child.stderr.removeAllListeners("data");
+          child.stderr.on("data", (chunk) => opts.buf.push(toBuf(chunk)));
+        }
+      }
+    }
+    const exits = await Promise.all(
+      children.map(
+        (c) => new Promise((resolve10) => {
+          c.once("error", () => resolve10(null));
+          c.once("close", (code) => resolve10(code));
+        })
+      )
+    );
+    return { exitCode: exits[exits.length - 1] ?? null, timedOut };
+  } finally {
+    for (const fd of allFds) tryClose(fd);
+    clearTimeout(killTimer);
+    opts.signal?.removeEventListener("abort", onAbort);
+  }
+}
+function tryClose(fd) {
+  try {
+    closeSync(fd);
+  } catch {
+  }
+}
+function toBuf(chunk) {
+  return typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+}
+var OutputBuffer = class {
+  constructor(cap) {
+    this.cap = cap;
+  }
+  cap;
+  chunks = [];
+  bytes = 0;
+  push(b) {
+    if (this.bytes >= this.cap) return;
+    const remaining = this.cap - this.bytes;
+    if (b.length > remaining) {
+      this.chunks.push(b.subarray(0, remaining));
+      this.bytes = this.cap;
+    } else {
+      this.chunks.push(b);
+      this.bytes += b.length;
+    }
+  }
+  toString() {
+    return smartDecodeOutput(Buffer.concat(this.chunks));
+  }
+};
+
 // src/tools/shell.ts
 function killProcessTree2(child) {
   if (!child.pid || child.killed) return;
@@ -5830,17 +6415,31 @@ function isAllowed(cmd, extra = []) {
   }
   return false;
 }
+function isCommandAllowed(cmd, extra = []) {
+  let chain;
+  try {
+    chain = parseCommandChain(cmd);
+  } catch {
+    return false;
+  }
+  if (chain === null) return isAllowed(cmd, extra);
+  return chainAllowed(chain, (seg) => isAllowed(seg, extra));
+}
 async function runCommand(cmd, opts) {
+  const timeoutSec = opts.timeoutSec ?? DEFAULT_TIMEOUT_SEC;
+  const maxChars = opts.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
   const argv = tokenizeCommand(cmd);
   if (argv.length === 0) throw new Error("run_command: empty command");
-  const operator = detectShellOperator(cmd);
-  if (operator !== null) {
-    throw new Error(
-      `run_command: shell operator "${operator}" is not supported \u2014 this tool spawns one process, no shell expansion. Split into separate run_command calls and combine the output in your reasoning (e.g. instead of \`grep foo *.ts | wc -l\`, call \`grep -c foo *.ts\` or two separate commands). To pass "${operator}" as a literal argument, wrap it in quotes.`
-    );
+  const chain = parseCommandChain(cmd);
+  if (chain !== null) {
+    return await runChain(chain, {
+      cwd: opts.cwd,
+      timeoutSec,
+      maxOutputChars: maxChars,
+      signal: opts.signal
+    });
   }
-  const timeoutMs = (opts.timeoutSec ?? DEFAULT_TIMEOUT_SEC) * 1e3;
-  const maxChars = opts.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
+  const timeoutMs = timeoutSec * 1e3;
   const spawnOpts = {
     cwd: opts.cwd,
     shell: false,
@@ -5858,10 +6457,10 @@ async function runCommand(cmd, opts) {
   };
   const { bin, args, spawnOverrides } = prepareSpawn(argv);
   const effectiveSpawnOpts = { ...spawnOpts, ...spawnOverrides };
-  return await new Promise((resolve9, reject) => {
+  return await new Promise((resolve10, reject) => {
     let child;
     try {
-      child = spawn3(bin, args, effectiveSpawnOpts);
+      child = spawn4(bin, args, effectiveSpawnOpts);
     } catch (err) {
       reject(err);
       return;
@@ -5912,7 +6511,7 @@ async function runCommand(cmd, opts) {
       const output = buf.length > maxChars ? `${buf.slice(0, maxChars)}
 
 [\u2026 truncated ${buf.length - maxChars} chars \u2026]` : buf;
-      resolve9({ exitCode: code, output, timedOut });
+      resolve10({ exitCode: code, output, timedOut });
     });
   });
 }
@@ -5934,16 +6533,16 @@ function resolveExecutable(cmd, opts = {}) {
   const platform = opts.platform ?? process.platform;
   if (platform !== "win32") return cmd;
   if (!cmd) return cmd;
-  if (cmd.includes("/") || cmd.includes("\\") || pathMod3.isAbsolute(cmd)) return cmd;
-  if (pathMod3.extname(cmd)) return cmd;
+  if (cmd.includes("/") || cmd.includes("\\") || pathMod4.isAbsolute(cmd)) return cmd;
+  if (pathMod4.extname(cmd)) return cmd;
   const env = opts.env ?? process.env;
   const pathExt = (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").map((e) => e.trim()).filter(Boolean);
-  const delimiter2 = opts.pathDelimiter ?? (platform === "win32" ? ";" : pathMod3.delimiter);
+  const delimiter2 = opts.pathDelimiter ?? (platform === "win32" ? ";" : pathMod4.delimiter);
   const pathDirs = (env.PATH ?? "").split(delimiter2).filter(Boolean);
   const isFile = opts.isFile ?? defaultIsFile;
   for (const dir of pathDirs) {
     for (const ext of pathExt) {
-      const full = pathMod3.win32.join(dir, cmd + ext);
+      const full = pathMod4.win32.join(dir, cmd + ext);
       if (isFile(full)) return full;
     }
   }
@@ -6013,8 +6612,8 @@ function withUtf8Codepage(cmdline) {
 function isBareWindowsName(s) {
   if (!s) return false;
   if (s.includes("/") || s.includes("\\")) return false;
-  if (pathMod3.isAbsolute(s)) return false;
-  if (pathMod3.extname(s)) return false;
+  if (pathMod4.isAbsolute(s)) return false;
+  if (pathMod4.extname(s)) return false;
   return true;
 }
 function quoteForCmdExe(arg) {
@@ -6033,7 +6632,7 @@ var NeedsConfirmationError = class extends Error {
   }
 };
 function registerShellTools(registry, opts) {
-  const rootDir = pathMod3.resolve(opts.rootDir);
+  const rootDir = pathMod4.resolve(opts.rootDir);
   const timeoutSec = opts.timeoutSec ?? DEFAULT_TIMEOUT_SEC;
   const maxOutputChars = opts.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
   const jobs = opts.jobs ?? new JobRegistry();
@@ -6044,7 +6643,7 @@ function registerShellTools(registry, opts) {
   const isAllowAll = typeof opts.allowAll === "function" ? opts.allowAll : () => opts.allowAll === true;
   registry.register({
     name: "run_command",
-    description: "Run a shell command in the project root and return its combined stdout+stderr.\n\nConstraints (read these before the first call):\n\u2022 ONE process per call, NO shell expansion. `&&`, `||`, `|`, `;`, `>`, `<`, `2>&1` are all rejected up-front \u2014 split into separate calls and combine results in reasoning. Example: instead of `grep foo *.ts | wc -l`, use `grep -c foo *.ts`; instead of `cd sub && npm test`, use `npm test --prefix sub` (or whatever --cwd flag the binary accepts).\n\u2022 `cd` DOES NOT PERSIST between calls \u2014 each call spawns a fresh process rooted at the project. If a tool needs a subdirectory, pass it via the tool's own flag (`npm --prefix`, `cargo -C`, `git -C`, `pytest tests/\u2026`), NOT via a preceding `cd`.\n\u2022 Avoid commands with unbounded output (`netstat -ano`, `find /`, etc.) \u2014 they waste tokens. Filter at source: `netstat -ano -p TCP`, `find src -name '*.ts'`, `grep -c`, `wc -l`.\n\nCommon read-only inspection and test/lint/typecheck commands run immediately; anything that could mutate state, install dependencies, or touch the network is refused until the user confirms it in the TUI. Prefer this over asking the user to run a command manually \u2014 after edits, run the project's tests to verify.",
+    description: "Run a shell command in the project root and return its combined stdout+stderr.\n\nConstraints (read these before the first call):\n\u2022 Chain operators `|`, `||`, `&&`, `;` ARE supported \u2014 parsed natively, no shell invoked, so semantics are identical on Windows / macOS / Linux. Each chain segment is allowlist-checked individually: `git status | grep main` runs if both halves are allowed.\n\u2022 File redirects ARE supported: `>` truncate, `>>` append, `<` stdin from file, `2>` / `2>>` stderr to file, `2>&1` merge stderr\u2192stdout, `&>` both to file. Targets resolve relative to the project root. At most one redirect per fd per segment.\n\u2022 Background `&`, heredoc `<<`, command substitution `$(\u2026)`, subshells `(\u2026)`, and process substitution `<(\u2026)` are NOT supported. Wrap a literal `&` arg in quotes; for input use a `<` file or the binary's own --input flag.\n\u2022 Env-var expansion `$VAR` is NOT performed \u2014 `$VAR` is passed as a literal string. Use the binary's own --env flag or substitute the value yourself.\n\u2022 `cd` DOES NOT PERSIST between calls \u2014 each call spawns a fresh process rooted at the project. If a tool needs a subdirectory, pass it via the tool's own flag (`npm --prefix`, `cargo -C`, `git -C`, `pytest tests/\u2026`), NOT via a preceding `cd`.\n\u2022 Glob patterns (`*.ts`) are passed through as literal arguments \u2014 no shell expansion. Use `grep -r`, `rg`, `find -name`, etc.\n\u2022 Avoid commands with unbounded output (`netstat -ano`, `find /`, etc.) \u2014 they waste tokens. Filter at source: `netstat -ano -p TCP`, `find src -name '*.ts'`, `grep -c`, `wc -l`.\n\nCommon read-only inspection and test/lint/typecheck commands run immediately; anything that could mutate state, install dependencies, or touch the network is refused until the user confirms it in the TUI. Prefer this over asking the user to run a command manually \u2014 after edits, run the project's tests to verify.",
     // Plan-mode gate: allow allowlisted commands through (git status,
     // cargo check, ls, grep …) so the model can actually investigate
     // during planning. Anything that would otherwise trigger a
@@ -6053,14 +6652,14 @@ function registerShellTools(registry, opts) {
       if (isAllowAll()) return true;
       const cmd = typeof args?.command === "string" ? args.command.trim() : "";
       if (!cmd) return false;
-      return isAllowed(cmd, getExtraAllowed());
+      return isCommandAllowed(cmd, getExtraAllowed());
     },
     parameters: {
       type: "object",
       properties: {
         command: {
           type: "string",
-          description: 'Full command line. Tokenized with POSIX-ish quoting; no shell expansion. Pipes (`|`), redirects (`>`, `<`, `2>`), and `&&`/`||` chaining are rejected with an error \u2014 split into separate calls instead. To pass an operator character as a literal argument (e.g. a regex), wrap it in quotes: `grep "a|b" file.txt`.'
+          description: 'Full command line. POSIX-ish quoting. Chain operators `|`, `||`, `&&`, `;` and file redirects `>` / `>>` / `<` / `2>` / `2>>` / `2>&1` / `&>` work natively (no shell). Background `&`, heredoc `<<`, env-var expansion `$VAR`, and command substitution `$(\u2026)` are rejected (or passed through as literal in the case of `$VAR`). To pass an operator character as a literal argument (e.g. a regex), wrap it in quotes: `grep "a|b" file.txt`.'
         },
         timeoutSec: {
           type: "integer",
@@ -6072,8 +6671,17 @@ function registerShellTools(registry, opts) {
     fn: async (args, ctx) => {
       const cmd = args.command.trim();
       if (!cmd) throw new Error("run_command: empty command");
-      if (!isAllowAll() && !isAllowed(cmd, getExtraAllowed())) {
-        throw new NeedsConfirmationError(cmd);
+      if (!isAllowAll() && !isCommandAllowed(cmd, getExtraAllowed())) {
+        const gate = ctx?.confirmationGate ?? pauseGate;
+        const choice = await gate.ask({ kind: "run_command", payload: { command: cmd } });
+        if (choice.type === "deny") {
+          throw new Error(
+            `user denied: ${cmd}${choice.denyContext ? ` \u2014 ${choice.denyContext}` : ""}`
+          );
+        }
+        if (choice.type === "always_allow") {
+          addProjectShellAllowed(rootDir, choice.prefix);
+        }
       }
       const effectiveTimeout = Math.max(1, Math.min(600, args.timeoutSec ?? timeoutSec));
       const result = await runCommand(cmd, {
@@ -6105,8 +6713,17 @@ function registerShellTools(registry, opts) {
     fn: async (args, ctx) => {
       const cmd = args.command.trim();
       if (!cmd) throw new Error("run_background: empty command");
-      if (!isAllowAll() && !isAllowed(cmd, getExtraAllowed())) {
-        throw new NeedsConfirmationError(cmd);
+      if (!isAllowAll() && !isCommandAllowed(cmd, getExtraAllowed())) {
+        const gate = ctx?.confirmationGate ?? pauseGate;
+        const choice = await gate.ask({ kind: "run_background", payload: { command: cmd } });
+        if (choice.type === "deny") {
+          throw new Error(
+            `user denied: ${cmd}${choice.denyContext ? ` \u2014 ${choice.denyContext}` : ""}`
+          );
+        }
+        if (choice.type === "always_allow") {
+          addProjectShellAllowed(rootDir, choice.prefix);
+        }
       }
       const result = await jobs.start(cmd, {
         cwd: rootDir,
@@ -6435,12 +7052,12 @@ ${i + 1}. ${r.title}`);
 }
 
 // src/env.ts
-import { readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve7 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve8 } from "path";
 function loadDotenv(path2 = ".env") {
   let raw;
   try {
-    raw = readFileSync9(resolve7(process.cwd(), path2), "utf8");
+    raw = readFileSync10(resolve8(process.cwd(), path2), "utf8");
   } catch {
     return;
   }
@@ -6459,7 +7076,7 @@ function loadDotenv(path2 = ".env") {
 }
 
 // src/transcript/log.ts
-import { createWriteStream, readFileSync as readFileSync10 } from "fs";
+import { createWriteStream, readFileSync as readFileSync11 } from "fs";
 function recordFromLoopEvent(ev, extra) {
   const rec = {
     ts: (/* @__PURE__ */ new Date()).toISOString(),
@@ -6510,7 +7127,7 @@ function openTranscriptFile(path2, meta) {
   return stream;
 }
 function readTranscript(path2) {
-  const raw = readFileSync10(path2, "utf8");
+  const raw = readFileSync11(path2, "utf8");
   return parseTranscript(raw);
 }
 function isPlanStateEmptyShape(s) {
@@ -6957,25 +7574,25 @@ function truncate(s, n) {
 }
 
 // src/version.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname4, join as join9 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync12, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname5, join as join10 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var REGISTRY_URL = "https://registry.npmjs.org/reasonix/latest";
 var LATEST_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var LATEST_FETCH_TIMEOUT_MS = 2e3;
 function readPackageVersion() {
   try {
-    let dir = dirname4(fileURLToPath2(import.meta.url));
+    let dir = dirname5(fileURLToPath2(import.meta.url));
     for (let i = 0; i < 6; i++) {
-      const p = join9(dir, "package.json");
+      const p = join10(dir, "package.json");
       if (existsSync9(p)) {
-        const pkg = JSON.parse(readFileSync11(p, "utf8"));
+        const pkg = JSON.parse(readFileSync12(p, "utf8"));
         if (pkg?.name === "reasonix" && typeof pkg.version === "string") {
           return pkg.version;
         }
       }
-      const parent = dirname4(dir);
+      const parent = dirname5(dir);
       if (parent === dir) break;
       dir = parent;
     }
@@ -6985,11 +7602,11 @@ function readPackageVersion() {
 }
 var VERSION = readPackageVersion();
 function cachePath(homeDirOverride) {
-  return join9(homeDirOverride ?? homedir5(), ".reasonix", "version-cache.json");
+  return join10(homeDirOverride ?? homedir6(), ".reasonix", "version-cache.json");
 }
 function readCache(homeDirOverride) {
   try {
-    const raw = readFileSync11(cachePath(homeDirOverride), "utf8");
+    const raw = readFileSync12(cachePath(homeDirOverride), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed.version === "string" && typeof parsed.checkedAt === "number") {
       return parsed;
@@ -7001,8 +7618,8 @@ function readCache(homeDirOverride) {
 function writeCache(entry, homeDirOverride) {
   try {
     const p = cachePath(homeDirOverride);
-    mkdirSync3(dirname4(p), { recursive: true });
-    writeFileSync3(p, JSON.stringify(entry), "utf8");
+    mkdirSync4(dirname5(p), { recursive: true });
+    writeFileSync4(p, JSON.stringify(entry), "utf8");
   } catch {
   }
 }
@@ -7194,7 +7811,7 @@ var McpClient = class {
     const id = this.nextId++;
     const frame = { jsonrpc: "2.0", id, method, params };
     let abortHandler = null;
-    const promise = new Promise((resolve9, reject) => {
+    const promise = new Promise((resolve10, reject) => {
       const timeout = setTimeout(() => {
         this.pending.delete(id);
         if (abortHandler && signal) signal.removeEventListener("abort", abortHandler);
@@ -7203,7 +7820,7 @@ var McpClient = class {
         );
       }, this.requestTimeoutMs);
       this.pending.set(id, {
-        resolve: resolve9,
+        resolve: resolve10,
         reject,
         timeout
       });
@@ -7228,9 +7845,12 @@ var McpClient = class {
         signal.addEventListener("abort", abortHandler, { once: true });
       }
     });
+    promise.catch(() => void 0);
     try {
-      await this.transport.send(frame);
+      await Promise.race([this.transport.send(frame), promise.then(() => void 0)]);
     } catch (err) {
+      const pending = this.pending.get(id);
+      if (pending) clearTimeout(pending.timeout);
       this.pending.delete(id);
       if (abortHandler && signal) signal.removeEventListener("abort", abortHandler);
       throw err;
@@ -7285,7 +7905,7 @@ var McpClient = class {
 };
 
 // src/mcp/stdio.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 var StdioTransport = class {
   child;
   queue = [];
@@ -7300,14 +7920,14 @@ var StdioTransport = class {
         opts.command,
         ...(opts.args ?? []).map((a) => quoteArg(a, process.platform === "win32"))
       ].join(" ");
-      this.child = spawn4(line, [], {
+      this.child = spawn5(line, [], {
         env,
         cwd: opts.cwd,
         stdio: ["pipe", "pipe", "inherit"],
         shell: true
       });
     } else {
-      this.child = spawn4(opts.command, opts.args ?? [], {
+      this.child = spawn5(opts.command, opts.args ?? [], {
         env,
         cwd: opts.cwd,
         stdio: ["pipe", "pipe", "inherit"]
@@ -7326,12 +7946,12 @@ var StdioTransport = class {
   }
   async send(message) {
     if (this.closed) throw new Error("MCP transport is closed");
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       const line = `${JSON.stringify(message)}
 `;
       this.child.stdin.write(line, "utf8", (err) => {
         if (err) reject(err);
-        else resolve9();
+        else resolve10();
       });
     });
   }
@@ -7342,8 +7962,8 @@ var StdioTransport = class {
         continue;
       }
       if (this.closed) return;
-      const next = await new Promise((resolve9) => {
-        this.waiters.push(resolve9);
+      const next = await new Promise((resolve10) => {
+        this.waiters.push(resolve10);
       });
       if (next === null) return;
       yield next;
@@ -7412,8 +8032,8 @@ var SseTransport = class {
   constructor(opts) {
     this.url = opts.url;
     this.headers = opts.headers ?? {};
-    this.endpointReady = new Promise((resolve9, reject) => {
-      this.resolveEndpoint = resolve9;
+    this.endpointReady = new Promise((resolve10, reject) => {
+      this.resolveEndpoint = resolve10;
       this.rejectEndpoint = reject;
     });
     this.endpointReady.catch(() => void 0);
@@ -7440,8 +8060,8 @@ var SseTransport = class {
         continue;
       }
       if (this.closed) return;
-      const next = await new Promise((resolve9) => {
-        this.waiters.push(resolve9);
+      const next = await new Promise((resolve10) => {
+        this.waiters.push(resolve10);
       });
       if (next === null) return;
       yield next;
@@ -7627,8 +8247,8 @@ var StreamableHttpTransport = class {
         continue;
       }
       if (this.closed) return;
-      const next = await new Promise((resolve9) => {
-        this.waiters.push(resolve9);
+      const next = await new Promise((resolve10) => {
+        this.waiters.push(resolve10);
       });
       if (next === null) return;
       yield next;
@@ -7798,8 +8418,8 @@ async function trySection(load) {
 }
 
 // src/code/edit-blocks.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync12, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname5, resolve as resolve8 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync13, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname6, resolve as resolve9 } from "path";
 var BLOCK_RE = /^(\S[^\n]*)\n<{7} SEARCH\n([\s\S]*?)\n?={7}\n([\s\S]*?)\n?>{7} REPLACE/gm;
 function parseEditBlocks(text) {
   const out = [];
@@ -7817,8 +8437,8 @@ function parseEditBlocks(text) {
   return out;
 }
 function applyEditBlock(block, rootDir) {
-  const absRoot = resolve8(rootDir);
-  const absTarget = resolve8(absRoot, block.path);
+  const absRoot = resolve9(rootDir);
+  const absTarget = resolve9(absRoot, block.path);
   if (absTarget !== absRoot && !absTarget.startsWith(`${absRoot}${sep()}`)) {
     return {
       path: block.path,
@@ -7837,11 +8457,11 @@ function applyEditBlock(block, rootDir) {
           message: "file does not exist; to create it, use an empty SEARCH block"
         };
       }
-      mkdirSync4(dirname5(absTarget), { recursive: true });
-      writeFileSync4(absTarget, block.replace, "utf8");
+      mkdirSync5(dirname6(absTarget), { recursive: true });
+      writeFileSync5(absTarget, block.replace, "utf8");
       return { path: block.path, status: "created" };
     }
-    const content = readFileSync12(absTarget, "utf8");
+    const content = readFileSync13(absTarget, "utf8");
     if (searchEmpty) {
       return {
         path: block.path,
@@ -7861,7 +8481,7 @@ function applyEditBlock(block, rootDir) {
       };
     }
     const replaced = `${content.slice(0, idx)}${adaptedReplace}${content.slice(idx + adaptedSearch.length)}`;
-    writeFileSync4(absTarget, replaced, "utf8");
+    writeFileSync5(absTarget, replaced, "utf8");
     return { path: block.path, status: "applied" };
   } catch (err) {
     return { path: block.path, status: "error", message: err.message };
@@ -7871,19 +8491,19 @@ function applyEditBlocks(blocks, rootDir) {
   return blocks.map((b) => applyEditBlock(b, rootDir));
 }
 function snapshotBeforeEdits(blocks, rootDir) {
-  const absRoot = resolve8(rootDir);
+  const absRoot = resolve9(rootDir);
   const seen = /* @__PURE__ */ new Set();
   const snapshots = [];
   for (const b of blocks) {
     if (seen.has(b.path)) continue;
     seen.add(b.path);
-    const abs = resolve8(absRoot, b.path);
+    const abs = resolve9(absRoot, b.path);
     if (!existsSync10(abs)) {
       snapshots.push({ path: b.path, prevContent: null });
       continue;
     }
     try {
-      snapshots.push({ path: b.path, prevContent: readFileSync12(abs, "utf8") });
+      snapshots.push({ path: b.path, prevContent: readFileSync13(abs, "utf8") });
     } catch {
       snapshots.push({ path: b.path, prevContent: null });
     }
@@ -7891,9 +8511,9 @@ function snapshotBeforeEdits(blocks, rootDir) {
   return snapshots;
 }
 function restoreSnapshots(snapshots, rootDir) {
-  const absRoot = resolve8(rootDir);
+  const absRoot = resolve9(rootDir);
   return snapshots.map((snap) => {
-    const abs = resolve8(absRoot, snap.path);
+    const abs = resolve9(absRoot, snap.path);
     if (abs !== absRoot && !abs.startsWith(`${absRoot}${sep()}`)) {
       return {
         path: snap.path,
@@ -7910,7 +8530,7 @@ function restoreSnapshots(snapshots, rootDir) {
           message: "removed (the edit had created it)"
         };
       }
-      writeFileSync4(abs, snap.prevContent, "utf8");
+      writeFileSync5(abs, snap.prevContent, "utf8");
       return {
         path: snap.path,
         status: "applied",
@@ -7929,8 +8549,8 @@ function lineEndingOf(text) {
 }
 
 // src/code/prompt.ts
-import { existsSync as existsSync11, readFileSync as readFileSync13 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync14 } from "fs";
+import { join as join11 } from "path";
 var CODE_SYSTEM_PROMPT = `You are Reasonix Code, a coding assistant. You have filesystem tools (read_file, write_file, edit_file, list_directory, directory_tree, search_files, search_content, get_file_info) rooted at the user's working directory, plus run_command / run_background for shell.
 
 # Cite or shut up \u2014 non-negotiable
@@ -8132,12 +8752,12 @@ If \`semantic_search\` returns nothing useful (low scores, off-topic), THEN fall
 function codeSystemPrompt(rootDir, opts = {}) {
   const base = opts.hasSemanticSearch ? `${CODE_SYSTEM_PROMPT}${SEMANTIC_SEARCH_ROUTING}` : CODE_SYSTEM_PROMPT;
   const withMemory = applyMemoryStack(base, rootDir);
-  const gitignorePath = join10(rootDir, ".gitignore");
+  const gitignorePath = join11(rootDir, ".gitignore");
   let result = withMemory;
   if (existsSync11(gitignorePath)) {
     let content;
     try {
-      content = readFileSync13(gitignorePath, "utf8");
+      content = readFileSync14(gitignorePath, "utf8");
     } catch {
     }
     if (content !== void 0) {
@@ -8167,49 +8787,6 @@ ${appendParts.join("\n\n")}`;
   return result;
 }
 
-// src/config.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync5, readFileSync as readFileSync14, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname6, join as join11 } from "path";
-function defaultConfigPath() {
-  return join11(homedir6(), ".reasonix", "config.json");
-}
-function readConfig(path2 = defaultConfigPath()) {
-  try {
-    const raw = readFileSync14(path2, "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === "object") return parsed;
-  } catch {
-  }
-  return {};
-}
-function writeConfig(cfg, path2 = defaultConfigPath()) {
-  mkdirSync5(dirname6(path2), { recursive: true });
-  writeFileSync5(path2, JSON.stringify(cfg, null, 2), "utf8");
-  try {
-    chmodSync2(path2, 384);
-  } catch {
-  }
-}
-function loadApiKey(path2 = defaultConfigPath()) {
-  if (process.env.DEEPSEEK_API_KEY) return process.env.DEEPSEEK_API_KEY;
-  return readConfig(path2).apiKey;
-}
-function saveApiKey(key, path2 = defaultConfigPath()) {
-  const cfg = readConfig(path2);
-  cfg.apiKey = key.trim();
-  writeConfig(cfg, path2);
-}
-function isPlausibleKey(key) {
-  const trimmed = key.trim();
-  return /^sk-[A-Za-z0-9_-]{16,}$/.test(trimmed);
-}
-function redactKey(key) {
-  if (!key) return "";
-  if (key.length <= 12) return "****";
-  return `${key.slice(0, 6)}\u2026${key.slice(-4)}`;
-}
-
 // src/telemetry/usage.ts
 import {
   appendFileSync as appendFileSync2,