scalix 1.5.1 → 1.6.0

package/dist/agent.js

@@ -1,17 +1,21 @@
 import { ApiError } from './api-client.js';
 import { EventEmitter } from 'eventemitter3';
 import { randomUUID } from 'node:crypto';
-import { getToolPermissionWithArgs } from './sandbox.js';
+import { getToolPermissionWithArgs, getMaxImageSize, sandboxPathAsync } from './sandbox.js';
 import { logger } from './logger.js';
-import { DEFAULT_MODELS as FALLBACK_MODELS, DEFAULT_INSTRUCTIONS, DEFAULT_BASE_URL, AGENT_DEFAULTS, TOOL_DEFAULTS, BACKOFF_DEFAULTS, CONTEXT_DEFAULTS, SCALIX_PLATFORM_SECTION, SCALIX_CLOUD_RESOURCES_SECTION, SCALIX_NEUTRAL_POINTER, SCALIX_STEERING_ALWAYS_ON, modelSupportsVision, getModelSpec, maxOutputTokensForRequest, hasExplicitModelSpec } from './constants.js';
+import { DEFAULT_MODELS as FALLBACK_MODELS, DEFAULT_INSTRUCTIONS, DEFAULT_BASE_URL, AGENT_DEFAULTS, TOOL_DEFAULTS, BACKOFF_DEFAULTS, CONTEXT_DEFAULTS, SCALIX_PLATFORM_SECTION, SCALIX_CLOUD_RESOURCES_SECTION, SCALIX_DEPLOY_PLAYBOOK_SECTION, SCALIX_PLATFORM_PLAYBOOK_SECTION, SCALIX_NEUTRAL_POINTER, SCALIX_STEERING_ALWAYS_ON, modelSupportsVision, getModelSpec, maxOutputTokensForRequest, hasExplicitModelSpec } from './constants.js';
 import { estimateMessageTokens as estimateTokenCount, estimateTokens } from './token-counter.js';
 import { ContextManager } from './context-manager.js';
 import { zodToJsonSchema } from './tool-helper.js';
 import { ToolSelector } from './tool-selector.js';
 import { AgentReplay } from './agent-replay.js';
 import { loadHooks, runHooks } from './hooks.js';
+import { isWorkspaceTrusted } from './workspace-trust.js';
 import { setAgentToolConfig } from './tools-advanced.js';
+import { setCommandSandboxMode } from './tools.js';
+import { resolveCommandSandboxMode } from './command-sandbox.js';
 import { AgentRegistry, generateAgentId } from './agent-registry.js';
+import { getPreset } from './agent-presets.js';
 import { runVerification, VERIFY_DEFAULTS } from './auto-verify.js';
 import { ChangeTracker } from './change-tracker.js';
 import { detectPromptInjection, formatInjectionWarning } from './injection-detector.js';
@@ -21,6 +25,26 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { fetchCloudTools, callCloudTool, fetchMe, filterCatalogByScopes, buildCloudToolsPromptSection, cloudKeyRemedy } from './cloud.js';
 import { createChatClient, capabilitiesFor } from './providers/index.js';
+import { McpHub } from './mcp.js';
+import { BoardTurnRefresher } from './board-context.js';
+const SUPPORTED_PASTED_IMAGE_MIMES = new Set([
+    'image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/bmp', 'image/svg+xml',
+]);
+export function validatePastedImages(images) {
+    const maxSize = getMaxImageSize();
+    for (const image of images) {
+        const match = /^data:(image\/[a-z0-9.+-]+);base64,([a-z0-9+/=\s]+)$/i.exec(image);
+        if (!match || !SUPPORTED_PASTED_IMAGE_MIMES.has(match[1].toLowerCase())) {
+            throw new Error('Unsupported pasted image. Use PNG, JPEG, GIF, WebP, BMP, or SVG.');
+        }
+        const payload = match[2].replace(/\s/g, '');
+        const bytes = Math.floor(payload.length * 3 / 4)
+            - (payload.endsWith('==') ? 2 : payload.endsWith('=') ? 1 : 0);
+        if (bytes > maxSize) {
+            throw new Error(`Pasted image is too large (${Math.ceil(bytes / 1024 / 1024)}MB). Maximum is ${Math.floor(maxSize / 1024 / 1024)}MB.`);
+        }
+    }
+}
 /**
  * Marks an error that Agent has already announced through the 'error' event.
  * `send()` emits and then rethrows, so a caller that also prints from its catch
@@ -30,11 +54,10 @@ import { createChatClient, capabilitiesFor } from './providers/index.js';
 export const REPORTED_ERROR = Symbol.for('scalix.coder.reportedError');
 function transformToolsForApi(tools) {
     return tools
-        // type:'mcp' entries are decorative config for user-registered external
-        // MCP servers and never reach the API. Scalix Cloud platform tools bypass
-        // this path entirely: they are plain function tools (CloudPlatformTool,
-        // registered by refreshCloudTools) whose `parameters` pass through as-is.
-        .filter((t) => !('type' in t && t.type === 'mcp'))
+        // Everything here is a function tool. Remotely-backed ones — Scalix Cloud
+        // platform tools and MCP tool proxies — carry a ready-made JSON Schema in
+        // `parameters` that passes through as-is; local tools carry a Zod
+        // `inputSchema` that gets converted below.
         .map((t) => {
         const local = t;
         const fn = local.function ?? local;
@@ -149,9 +172,18 @@ export class Agent extends EventEmitter {
     configuredContextTokens;
     toolSelector = null;
     _aborted = false;
+    // Resolved when abort() fires — lets in-flight sleeps (retry backoff, tool
+    // confirmation) return immediately instead of ignoring cancellation.
+    _abortWaiters = new Set();
     _thinkingActive = false;
+    // Reasoning text accumulated across the current turn (all model calls) —
+    // what "what is the agent thinking" renders from.
+    _reasoningText = '';
     replay;
+    boardRefresher;
+    boardPrimed;
     hooks = [];
+    hooksSkipped = 0;
     instructionLoader;
     _abortController = null;
     modelFailures = new Map();
@@ -175,6 +207,7 @@ export class Agent extends EventEmitter {
     outputFormatInstructionIndex = null;
     cloudProjectId;
     cloudStatus = { state: 'no-key', toolCount: 0 };
+    mcpHub = null;
     providerId;
     capabilities;
     cloudApiKey;
@@ -225,6 +258,11 @@ export class Agent extends EventEmitter {
             workspaceRoot: config.workspaceRoot ?? process.cwd(),
         };
         this.cloudProjectId = config.cloudProjectId ?? process.env.SCALIX_PROJECT ?? undefined;
+        // OS-level command sandbox: the tool module is process-global, so every
+        // front end (CLI, IPC sessions, headless) inherits the mode the moment an
+        // agent is constructed. SCALIX_COMMAND_SANDBOX overrides the config value.
+        // Per-session override is deliberate — this is machine policy, not chat state.
+        setCommandSandboxMode(resolveCommandSandboxMode(config.commandSandbox, process.env.SCALIX_COMMAND_SANDBOX));
         this.contextManager = new ContextManager(config.contextManager);
         // Kept separately because syncContextLimit() overwrites the manager's own
         // value on every read and would otherwise have nothing to fall back to.
@@ -233,8 +271,28 @@ export class Agent extends EventEmitter {
             this.toolSelector = new ToolSelector();
             this.toolSelector.index(this.config.tools);
         }
+        // Crew board freshness (board-context.ts): baseline taken here, right
+        // after the system prompt embedded the board, so the first turnNote()
+        // only fires on real change. Fire-and-forget; send() awaits it.
+        this.boardRefresher = new BoardTurnRefresher(this.config.workspaceRoot ?? process.cwd());
+        this.boardPrimed = this.boardRefresher.prime().catch(() => { });
         this.replay = new AgentReplay(randomUUID().slice(0, 8), this.config.models[0]);
-        this.hooks = loadHooks();
+        // Hooks are shell commands read out of the project's own .scalix/hooks.json
+        // — exec surface, exactly like plugins and scoped rules, and named as such
+        // in workspace-trust.ts's own docstring. The gate existed; this call site
+        // just never asked. Parsing the file while untrusted is still fine and is
+        // what lets us say "3 hooks were skipped" instead of going quietly inert.
+        const projectHooks = loadHooks();
+        if (isWorkspaceTrusted()) {
+            this.hooks = projectHooks;
+        }
+        else {
+            this.hooks = [];
+            this.hooksSkipped = projectHooks.length;
+            if (projectHooks.length > 0) {
+                this.log.warn('Project hooks skipped — untrusted workspace', { count: projectHooks.length });
+            }
+        }
         this.instructionLoader = config.instructionLoader;
         if (config.autoVerify === true) {
             this.verifyConfig = { ...VERIFY_DEFAULTS };
@@ -354,6 +412,16 @@ export class Agent extends EventEmitter {
             message.includes('stream error') ||
             message.includes('try again'));
     }
+    setPreset(presetId) {
+        const preset = getPreset(presetId);
+        if (!preset)
+            throw new Error(`Unknown preset: ${presetId}`);
+        this.config.permissionMode = preset.permissionMode;
+        // We append the prompt to the base instructions
+        if (preset.systemPromptAdditions && !this.config.instructions.includes(preset.systemPromptAdditions)) {
+            this.config.instructions += '\n\n' + preset.systemPromptAdditions;
+        }
+    }
     isModelCircuitOpen(model) {
         const state = this.modelFailures.get(model);
         if (!state)
@@ -396,8 +464,14 @@ export class Agent extends EventEmitter {
         this.messages = [];
         this.verifyFailCounts.clear();
         this.modelFailures.clear();
+        // The old index points into the discarded history — keeping it would make
+        // the next addOutputFormatInstructions() overwrite an unrelated message.
+        this.outputFormatInstructionIndex = null;
+    }
+    loadMessages(messages) {
+        this.messages = [...messages];
+        this.outputFormatInstructionIndex = null;
     }
-    loadMessages(messages) { this.messages = [...messages]; }
     getInstructions() { return this.config.instructions; }
     setInstructions(instructions) { this.config.instructions = instructions; }
     getPermissionMode() { return this.config.permissionMode; }
@@ -580,6 +654,64 @@ export class Agent extends EventEmitter {
         if (this.toolSelector)
             this.toolSelector.index(this.config.tools);
     }
+    // ─── MCP servers ───
+    isMcpTool(t) {
+        return 'source' in t && t.source === 'mcp';
+    }
+    /**
+     * Take ownership of a connected hub and register its tools. The entrypoint
+     * connects (so a slow server delays startup, not the first message) and hands
+     * the hub over; the agent needs it so `add_mcp_server` can connect at runtime
+     * and so `close()` can shut the child processes down.
+     */
+    attachMcpHub(hub) {
+        this.mcpHub = hub;
+        this.syncMcpTools();
+    }
+    /** Replace the registered MCP proxies with whatever the hub currently holds. */
+    syncMcpTools() {
+        this.config.tools = this.config.tools.filter((t) => !this.isMcpTool(t));
+        if (this.mcpHub) {
+            const taken = new Set(this.config.tools.map((t) => t.function?.name || t.name).filter(Boolean));
+            for (const t of this.mcpHub.tools()) {
+                // A namespaced mcp__ name colliding with a local tool means two servers
+                // share a label; keep the first and say so rather than shadowing.
+                if (taken.has(t.name)) {
+                    this.log.warn('MCP tool name already taken — skipping', { tool: t.name, server: t.serverLabel });
+                    continue;
+                }
+                taken.add(t.name);
+                this.config.tools.push(t);
+            }
+        }
+        if (this.toolSelector)
+            this.toolSelector.index(this.config.tools);
+    }
+    /**
+     * Connect one server and register its tools immediately. Creates the hub if
+     * the entrypoint never attached one, so a runtime `add_mcp_server` works even
+     * when no config file existed at startup.
+     */
+    async connectMcpServer(config) {
+        if (!this.mcpHub)
+            this.mcpHub = new McpHub();
+        const [status] = await this.mcpHub.connect([config]);
+        this.syncMcpTools();
+        return status;
+    }
+    getMcpStatus() {
+        return this.mcpHub?.status() ?? [];
+    }
+    getMcpTools() {
+        return this.config.tools.filter((t) => this.isMcpTool(t));
+    }
+    /** Disconnect every MCP server. Call on shutdown — stdio servers are children. */
+    async closeMcp() {
+        const hub = this.mcpHub;
+        this.mcpHub = null;
+        this.config.tools = this.config.tools.filter((t) => !this.isMcpTool(t));
+        await hub?.close();
+    }
     // ─── Scalix Cloud platform tools ───
     isCloudTool(t) {
         return 'source' in t && t.source === 'scalix-cloud';
@@ -731,6 +863,20 @@ export class Agent extends EventEmitter {
     getReplay() { return this.replay; }
     getChangeTracker() { return this.changeTracker; }
     getHooks() { return this.hooks; }
+    /** How many project hooks the trust gate withheld. 0 when trusted. */
+    getSkippedHookCount() { return this.hooksSkipped; }
+    /**
+     * Re-read project hooks after the user trusts the workspace, so /trust picks
+     * them up in the same session rather than only after a restart. Returns the
+     * number now active.
+     */
+    reloadHooks() {
+        if (!isWorkspaceTrusted())
+            return 0;
+        this.hooks = loadHooks();
+        this.hooksSkipped = 0;
+        return this.hooks.length;
+    }
     getApiKey() { return this.config.apiKey; }
     getBaseUrl() { return this.client.baseURL; }
     getAgentId() { return this.agentId; }
@@ -773,6 +919,12 @@ export class Agent extends EventEmitter {
         return {
             apiKey: this.config.apiKey,
             baseUrl: this.client.baseURL,
+            // Sub-agents must inherit the provider itself, not just its URL: without
+            // it a BYOK session's sub-agent would default to provider 'scalix' while
+            // keeping the third-party baseUrl and 404 on <byok-host>/v1/ai/...
+            provider: this.providerId,
+            cloudApiKey: this.cloudApiKey,
+            cloudBaseUrl: this.cloudBaseUrl,
             models: this.config.models,
             permissionMode: this.config.permissionMode,
             confirmToolCall: this.config.confirmToolCall,
@@ -784,8 +936,26 @@ export class Agent extends EventEmitter {
             this._abortController.abort();
             this._abortController = null;
         }
+        const waiters = [...this._abortWaiters];
+        this._abortWaiters.clear();
+        for (const w of waiters)
+            w();
         this.emitThinkingEnd();
     }
+    /**
+     * Sleep that returns early when abort() fires. Unlike a bare setTimeout,
+     * cancellation during retry backoff or a confirmation wait is observed
+     * immediately rather than after the full delay.
+     */
+    abortableSleep(ms) {
+        if (this._aborted)
+            return Promise.resolve();
+        return new Promise((resolve) => {
+            const waiter = () => { clearTimeout(timer); resolve(); };
+            const timer = setTimeout(() => { this._abortWaiters.delete(waiter); resolve(); }, ms);
+            this._abortWaiters.add(waiter);
+        });
+    }
     removeModel(model) {
         const idx = this.config.models.indexOf(model);
         if (idx !== -1 && this.config.models.length > 1) {
@@ -808,7 +978,11 @@ export class Agent extends EventEmitter {
         const imageParts = [];
         for (const filePath of matches) {
             try {
-                const resolved = path.resolve(process.cwd(), filePath);
+                // @file mentions expand file contents into the prompt — route them
+                // through the same containment as read_file, and resolve against the
+                // configured workspace root (not necessarily process.cwd()).
+                const root = this.config.workspaceRoot ?? process.cwd();
+                const resolved = await sandboxPathAsync(path.resolve(root, filePath));
                 if (isImageFile(filePath)) {
                     const dataUrl = await encodeImageToDataUrl(resolved);
                     imageParts.push({ type: 'image_url', image_url: { url: dataUrl, detail: 'auto' } });
@@ -903,6 +1077,8 @@ export class Agent extends EventEmitter {
     async send(content, images) {
         this._aborted = false;
         this.groundingNudgeCount = 0;
+        if (images?.length)
+            validatePastedImages(images);
         const hasFileRefs = /@(?:[\w./-]+\/)?[\w.-]+\.\w+/.test(content);
         const expandedContent = hasFileRefs ? await this.expandFileReferences(content) : content;
         let finalContent = expandedContent;
@@ -922,9 +1098,28 @@ export class Agent extends EventEmitter {
         this.messages.push(userMessage);
         this.emit('message:user', userMessage);
         this._thinkingActive = true;
+        this._reasoningText = '';
         this.emit('thinking:start');
         this.truncateMessages();
         this.replay.record('user_message', { content });
+        // Crew board turn-refresh: the system prompt is assembled once per
+        // session, so a board that moved since then would go stale mid-thread.
+        // Runs AFTER the push — send()'s synchronous contract (user message in
+        // history and message:user emitted before the first await) is what the
+        // IDE paints on — with the note spliced in BEFORE the user message, so
+        // the member still reads the news before the ask. One file read per
+        // turn; a workspace with no BOARD.md never produces a note.
+        try {
+            await this.boardPrimed;
+            const boardNote = await this.boardRefresher.turnNote();
+            if (boardNote) {
+                const boardMessage = { role: 'system', content: boardNote };
+                const idx = this.messages.lastIndexOf(userMessage);
+                this.messages.splice(idx < 0 ? this.messages.length : idx, 0, boardMessage);
+                this.replay.record('board_refresh', { chars: boardNote.length });
+            }
+        }
+        catch { }
         const requestId = randomUUID().slice(0, 8);
         const reqLog = logger.child(requestId);
         reqLog.info('User message received', { length: content.length });
@@ -949,7 +1144,7 @@ export class Agent extends EventEmitter {
             // platform key is a dead end that doesn't touch the credential that failed.
             if (status === 401 && !error.message.includes('console.scalix.world') && !error.message.includes('/setup')) {
                 error.message += this.capabilities.platformTools
-                    ? ' — API key rejected. Create a new key at https://console.scalix.world/org/keys and update it via /setup.'
+                    ? ' — API key rejected. Create a new key at https://console.scalix.world/org/keys?utm_source=scalix-coder&utm_medium=cli and update it via /setup.'
                     : ` — API key rejected by ${this.client.baseURL}. Check the key for your provider and update it via /setup.`;
             }
             error.metadata = {
@@ -974,6 +1169,13 @@ export class Agent extends EventEmitter {
         let emptyTurnCount = 0;
         const MAX_EMPTY_TURNS = 5;
         let disableTools = false;
+        let _stepIndex = 0;
+        let _turnToolDurationMs = 0;
+        let _turnLlmStartMs = 0;
+        let _turnTtftMs = 0;
+        let _firstDeltaSeen = false;
+        let _turnInputTokens = 0;
+        let _turnOutputTokens = 0;
         let forceNonStreaming = false;
         while (turnCount < this.config.maxSteps) {
             if (this._aborted) {
@@ -983,6 +1185,15 @@ export class Agent extends EventEmitter {
             }
             this.checkInbox();
             turnCount++;
+            // Per-turn metrics reset here so streaming TTFT (and token/duration
+            // counters) reflect the turn that actually produced the final response,
+            // not the first turn of the request.
+            _turnToolDurationMs = 0;
+            _turnLlmStartMs = 0;
+            _turnTtftMs = 0;
+            _firstDeltaSeen = false;
+            _turnInputTokens = 0;
+            _turnOutputTokens = 0;
             let fullText = '';
             const toolCalls = new Map();
             try {
@@ -1039,6 +1250,9 @@ export class Agent extends EventEmitter {
                     if (!SCALIX_STEERING_ALWAYS_ON) {
                         effectiveInstructions += '\n\n' + SCALIX_PLATFORM_SECTION + '\n\n' + SCALIX_CLOUD_RESOURCES_SECTION;
                     }
+                    // Deploy-path and platform facts ride with the connection too —
+                    // outside the ALWAYS_ON guard so flipping that flag never drops them.
+                    effectiveInstructions += '\n\n' + SCALIX_DEPLOY_PLAYBOOK_SECTION + '\n\n' + SCALIX_PLATFORM_PLAYBOOK_SECTION;
                     const liveCloudTools = this.getCloudTools();
                     if (liveCloudTools.length > 0) {
                         effectiveInstructions += '\n\n' + buildCloudToolsPromptSection(liveCloudTools);
@@ -1054,11 +1268,14 @@ export class Agent extends EventEmitter {
                 // An endpoint that does not carry tool calls over SSE would answer an
                 // agentic turn in prose and lose the calls, so those turns go
                 // non-streaming there and the user watches a spinner instead of output.
-                // Text-only turns stream either way.
-                const useStreaming = !forceNonStreaming && (await this.streamsToolCalls()
+                // Text-only turns stream either way. The probe must never fail a turn:
+                // any error defaults to the conservative non-streaming answer.
+                const streams = await this.streamsToolCalls().catch(() => false);
+                const useStreaming = !forceNonStreaming && (streams
                     ? true
                     : (!apiTools || apiTools.length === 0) && !hasToolMessages);
                 if (useStreaming) {
+                    _turnLlmStartMs = Date.now();
                     const stream = await this.client.chatComplete({
                         model: currentModel,
                         messages: apiMessages,
@@ -1078,9 +1295,27 @@ export class Agent extends EventEmitter {
                         if (choice?.delta) {
                             const delta = choice.delta;
                             if (delta.content) {
+                                if (!_firstDeltaSeen) {
+                                    _turnTtftMs = Date.now() - _turnLlmStartMs;
+                                    _firstDeltaSeen = true;
+                                }
                                 fullText += delta.content;
                                 this.emit('stream:delta', delta.content, fullText);
                             }
+                            // Reasoning deltas (deepseek-reasoner, glm thinking models,
+                            // OpenRouter :thinking, the Scalix router's thinking_level) were
+                            // dropped — the "what is the agent thinking" display streams
+                            // from these. Some models emit reasoning unconditionally; when
+                            // it arrives after content started, re-open the thinking phase.
+                            const reasoningPiece = delta.reasoning_content ?? delta.reasoning ?? null;
+                            if (reasoningPiece) {
+                                if (!this._thinkingActive) {
+                                    this._thinkingActive = true;
+                                    this.emit('thinking:start');
+                                }
+                                this._reasoningText += reasoningPiece;
+                                this.emit('reasoning:update', this._reasoningText);
+                            }
                             if (delta.tool_calls) {
                                 for (const tc of delta.tool_calls) {
                                     const idx = tc.index ?? toolCalls.size;
@@ -1101,6 +1336,8 @@ export class Agent extends EventEmitter {
                             const inTok = chunk.usage.prompt_tokens ?? 0;
                             const outTok = chunk.usage.completion_tokens ?? 0;
                             const totalTok = chunk.usage.total_tokens ?? (inTok + outTok);
+                            _turnInputTokens = inTok;
+                            _turnOutputTokens = outTok;
                             const cost = chunk.usage.cost ?? 0;
                             this.emit('usage', {
                                 prompt_tokens: inTok,
@@ -1114,6 +1351,7 @@ export class Agent extends EventEmitter {
                     }
                 }
                 else {
+                    _turnLlmStartMs = Date.now();
                     this.emit('stream:start');
                     const result = await this.client.chatComplete({
                         model: currentModel,
@@ -1128,10 +1366,18 @@ export class Agent extends EventEmitter {
                     this.recordModelSuccess(currentModel);
                     const choice = result.choices?.[0];
                     if (choice?.message) {
+                        _turnTtftMs = Date.now() - _turnLlmStartMs;
+                        _firstDeltaSeen = true;
                         if (choice.message.content) {
                             fullText = choice.message.content;
                             this.emit('stream:delta', fullText, fullText);
                         }
+                        // Non-streaming path carries reasoning the same way.
+                        const msg = choice.message;
+                        if (msg.reasoning || msg.reasoning_content) {
+                            this._reasoningText += String(msg.reasoning_content ?? msg.reasoning ?? '');
+                            this.emit('reasoning:update', this._reasoningText);
+                        }
                         if (choice.message.tool_calls) {
                             for (const tc of choice.message.tool_calls) {
                                 toolCalls.set(toolCalls.size, {
@@ -1146,6 +1392,8 @@ export class Agent extends EventEmitter {
                         const inTok = result.usage.prompt_tokens ?? 0;
                         const outTok = result.usage.completion_tokens ?? 0;
                         const totalTok = result.usage.total_tokens ?? (inTok + outTok);
+                        _turnInputTokens = inTok;
+                        _turnOutputTokens = outTok;
                         const cost = result.usage.cost ?? 0;
                         this.emit('usage', {
                             prompt_tokens: inTok,
@@ -1212,10 +1460,16 @@ export class Agent extends EventEmitter {
                 this.messages.push(assistantMessage);
                 this.emit('message:assistant', assistantMessage);
                 if (resolvedToolCalls.length > 0) {
-                    for (const call of resolvedToolCalls) {
+                    // Multiple sub-agent spawns in one turn run concurrently — the
+                    // Kilo Code behavior for parallel Task calls. Every spawn is an
+                    // independent `agent` call, so sequencing them only adds wall-clock
+                    // time; any other tool mix stays sequential because write ordering
+                    // matters. Each call still goes through the same permission check,
+                    // confirmation, hooks and result plumbing as a solo call.
+                    const runCall = async (call) => {
                         if (this._aborted) {
                             reqLog.info('Agent aborted, skipping remaining tool calls');
-                            break;
+                            return;
                         }
                         const tool = this.config.tools.find((t) => (t.function?.name || t.name) === call.name);
                         let result;
@@ -1230,7 +1484,7 @@ export class Agent extends EventEmitter {
                                 this.emit('tool:blocked', call.name, 'Blocked by hook');
                                 this.messages.push({ role: 'tool', content: JSON.stringify(result), tool_call_id: call.id, name: call.name });
                                 this.emit('tool:result', call.name, result);
-                                continue;
+                                return;
                             }
                         }
                         // Parse tool arguments once, up front, so the permission decision,
@@ -1250,7 +1504,7 @@ export class Agent extends EventEmitter {
                                 this.emit('tool:blocked', call.name, 'Malformed arguments');
                                 this.messages.push({ role: 'tool', content: JSON.stringify(result), tool_call_id: call.id, name: call.name });
                                 this.emit('tool:result', call.name, result);
-                                continue;
+                                return;
                             }
                         }
                         // Args-aware permission so scoped allow/deny rules are enforced.
@@ -1266,7 +1520,7 @@ export class Agent extends EventEmitter {
                                 name: call.name,
                             });
                             this.emit('tool:result', call.name, result);
-                            continue;
+                            return;
                         }
                         if (permission === 'ask') {
                             if (!this.config.confirmToolCall) {
@@ -1284,24 +1538,36 @@ export class Agent extends EventEmitter {
                                         name: call.name,
                                     });
                                     this.emit('tool:result', call.name, result);
-                                    continue;
+                                    return;
                                 }
                             }
                             else {
                                 const args = parsedArgs;
                                 const CONFIRM_TIMEOUT_MS = 300_000;
                                 const confirmed = await new Promise((resolve) => {
-                                    const timer = setTimeout(() => resolve(false), CONFIRM_TIMEOUT_MS);
-                                    this.config.confirmToolCall(call.name, args).then((v) => {
+                                    let settled = false;
+                                    const done = (v) => {
+                                        if (settled)
+                                            return;
+                                        settled = true;
                                         clearTimeout(timer);
+                                        this._abortWaiters.delete(waiter);
                                         resolve(v);
+                                    };
+                                    // An abort during the wait denies the tool immediately; the
+                                    // loop's `if (this._aborted) break` below then exits —
+                                    // otherwise the loop parks here for up to 5 minutes.
+                                    const waiter = () => done(false);
+                                    const timer = setTimeout(() => done(false), CONFIRM_TIMEOUT_MS);
+                                    this._abortWaiters.add(waiter);
+                                    this.config.confirmToolCall(call.name, args).then((v) => {
+                                        done(v);
                                     }).catch(() => {
-                                        clearTimeout(timer);
-                                        resolve(false);
+                                        done(false);
                                     });
                                 });
                                 if (this._aborted)
-                                    break;
+                                    return;
                                 if (!confirmed) {
                                     result = { denied: true, message: `User denied execution of ${call.name}` };
                                     reqLog.info('Tool call denied by user', { tool: call.name });
@@ -1313,17 +1579,20 @@ export class Agent extends EventEmitter {
                                         name: call.name,
                                     });
                                     this.emit('tool:result', call.name, result);
-                                    continue;
+                                    return;
                                 }
                             }
                         }
                         const execFn = tool?.function?.execute ?? tool?.execute;
                         if (tool && typeof execFn === 'function') {
                             try {
-                                // Cloud platform tools get the raw args: their JSON Schemas are
-                                // authoritative (snake_case) and the gateway validates them —
-                                // injecting camelCase duplicates could fail server-side validation.
-                                const args = tool?.source === 'scalix-cloud'
+                                // Remotely-schema'd tools get the raw args: their JSON Schemas
+                                // are authoritative (snake_case) and the far side validates
+                                // them — injecting camelCase duplicates could fail that
+                                // validation. True for the Scalix Cloud gateway and equally for
+                                // any MCP server, which validates against its own inputSchema.
+                                const src = tool?.source;
+                                const args = (src === 'scalix-cloud' || src === 'mcp')
                                     ? parsedArgs
                                     : normalizeArgs(parsedArgs);
                                 // Validate against the very schema the model was shown. Nothing
@@ -1350,21 +1619,30 @@ export class Agent extends EventEmitter {
                                 const toolTimeout = (typeof args?.timeout === 'number' && args.timeout > 0)
                                     ? Math.min(args.timeout, TOOL_DEFAULTS.maxCommandTimeoutMs)
                                     : this.config.toolTimeoutMs;
+                                const toolStart = Date.now();
+                                this.emit('step:start', { stepIndex: _stepIndex, name: call.name, args: parsedArgs, startedAt: toolStart });
                                 result = await withTimeout(execFn(args, {
                                     context: {},
                                     workspaceRoot: this.config.workspaceRoot ?? process.cwd(),
                                     permissionMode: this.config.permissionMode,
                                     agentId: this.agentId,
-                                    agentConfig: {
-                                        apiKey: this.config.apiKey,
-                                        baseUrl: this.client.baseURL,
-                                        models: this.config.models,
-                                        permissionMode: this.config.permissionMode,
-                                        confirmToolCall: this.config.confirmToolCall,
-                                    },
+                                    agentConfig: this.getAgentConfig(),
                                 }), toolTimeout, call.name);
+                                const toolDurationMs = Date.now() - toolStart;
+                                _turnToolDurationMs += toolDurationMs;
+                                this.emit('step:done', { stepIndex: _stepIndex, name: call.name, durationMs: toolDurationMs, success: !result?.error });
+                                _stepIndex++;
+                                // The tool only persists the entry to mcp-services.json. Connect
+                                // it here too, so the server's tools are usable in this same
+                                // session instead of only after a restart — and report the
+                                // outcome back through the tool result, since a server that
+                                // won't answer is something the model needs to know now.
                                 if (call.name === 'add_mcp_server' && result?.success) {
-                                    this.addTool({ type: 'mcp', serverLabel: args.label, serverUrl: args.url });
+                                    const connected = await this.connectMcpServer({
+                                        serverLabel: args.label,
+                                        serverUrl: args.url,
+                                    });
+                                    result = { ...result, connected: connected.state === 'connected', tools: connected.toolCount, ...(connected.error ? { connectError: connected.error } : {}) };
                                 }
                             }
                             catch (e) {
@@ -1373,11 +1651,19 @@ export class Agent extends EventEmitter {
                             }
                         }
                         else {
-                            const availableNames = this.config.tools
+                            const allNames = this.config.tools
                                 .map((t) => t.function?.name || t.name)
-                                .filter(Boolean)
-                                .slice(0, 20);
-                            result = { error: `Tool "${call.name}" does not exist. Available tools: ${availableNames.join(', ')}. Do not invent tool names — only use tools from the list above, or respond with text directly.` };
+                                .filter(Boolean);
+                            // Near-matches first: an invented "scalix_build_list" must surface
+                            // the real scalix_* names. Blindly listing the first 20 registry
+                            // entries hid every platform tool and read as "those don't exist" —
+                            // the model then invented workarounds instead of correcting the name
+                            // (seen 2026-08-09: a deploy derailed into "make the repo public").
+                            const stem = call.name.toLowerCase().split(/[_-]/)[0];
+                            const near = stem.length >= 3 ? allNames.filter((n) => n.toLowerCase().includes(stem)) : [];
+                            const shown = [...new Set([...near, ...allNames])].slice(0, Math.max(20, Math.min(near.length, 40)));
+                            const omitted = allNames.length - shown.length;
+                            result = { error: `Tool "${call.name}" does not exist.${near.length ? ` Did you mean one of: ${near.slice(0, 40).join(', ')}?` : ''} Available tools: ${shown.join(', ')}${omitted > 0 ? `, plus ${omitted} more registered but not listed here` : ''}. Do not invent tool names — only use tools from the list above, or respond with text directly.` };
                         }
                         let resultStr;
                         try {
@@ -1480,9 +1766,33 @@ export class Agent extends EventEmitter {
                                 }
                             }
                         }
+                    };
+                    if (resolvedToolCalls.length > 1 && resolvedToolCalls.every((c) => c.name === 'agent')) {
+                        await Promise.all(resolvedToolCalls.map((c) => runCall(c).catch((err) => {
+                            reqLog.error('Sub-agent spawn failed', { tool: c.name, error: err?.message });
+                        })));
+                    }
+                    else {
+                        for (const call of resolvedToolCalls) {
+                            if (this._aborted) {
+                                reqLog.info('Agent aborted, skipping remaining tool calls');
+                                break;
+                            }
+                            await runCall(call);
+                        }
                     }
                     if (this._aborted)
                         return '[interrupted]';
+                    this.emit('turn:summary', {
+                        turnIndex: turnCount,
+                        steps: _stepIndex,
+                        llmDurationMs: Date.now() - _turnLlmStartMs,
+                        toolDurationMs: _turnToolDurationMs,
+                        ttftMs: _turnTtftMs,
+                        tokensPerSec: (Date.now() - _turnLlmStartMs) > 0 ? _turnOutputTokens / ((Date.now() - _turnLlmStartMs) / 1000) : 0,
+                        inputTokens: _turnInputTokens,
+                        outputTokens: _turnOutputTokens,
+                    });
                     continue;
                 }
                 if (this.groundingConfig?.enabled && this.groundingNudgeCount < this.groundingConfig.maxNudges) {
@@ -1502,10 +1812,29 @@ export class Agent extends EventEmitter {
                         }
                     }
                 }
+                this.emit('turn:summary', {
+                    turnIndex: turnCount,
+                    steps: _stepIndex,
+                    llmDurationMs: Date.now() - _turnLlmStartMs,
+                    toolDurationMs: _turnToolDurationMs,
+                    ttftMs: _turnTtftMs,
+                    tokensPerSec: (Date.now() - _turnLlmStartMs) > 0 ? _turnOutputTokens / ((Date.now() - _turnLlmStartMs) / 1000) : 0,
+                    inputTokens: _turnInputTokens,
+                    outputTokens: _turnOutputTokens,
+                });
                 return fullText;
             }
             catch (err) {
                 this._abortController = null;
+                // A user-initiated abort is not a model failure — recording it would
+                // open the circuit breaker after a few Escapes and silently rotate
+                // the user's model. An abort mid-request mirrors the between-iteration
+                // contract: deregister and return '[interrupted]'.
+                if (this._aborted || err?.name === 'AbortError') {
+                    reqLog.info('Agent aborted during request');
+                    this.deregisterFromRegistry('aborted');
+                    return '[interrupted]';
+                }
                 this.recordModelFailure(currentModel);
                 const errMsg = (err?.message || '').toLowerCase();
                 const isStreamError = errMsg.includes('stream') || errMsg.includes('sse') || errMsg.includes('no response body');
@@ -1513,7 +1842,7 @@ export class Agent extends EventEmitter {
                 if (isStreamError && !forceNonStreaming) {
                     forceNonStreaming = true;
                     reqLog.warn('Streaming failed, retrying with non-streaming mode', { error: err.message });
-                    await sleep(500);
+                    await this.abortableSleep(500);
                     continue;
                 }
                 if (this.shouldFallbackToNext(err) && retryAttempt < this.config.maxRetries && turnCount < this.config.maxSteps) {
@@ -1534,7 +1863,7 @@ export class Agent extends EventEmitter {
                         status: err instanceof ApiError ? err.status : undefined,
                         reason: err.message,
                     });
-                    await sleep(delay);
+                    await this.abortableSleep(delay);
                     currentModel = this.pickModel();
                     continue;
                 }