whale-code 6.4.0 → 6.5.1

package/dist/cli/services/server-tools.js

@@ -229,11 +229,9 @@ async function downloadSingleMedia(data, toolName, outDir, inputArgs) {
         }
         const buffer = Buffer.from(await resp.arrayBuffer());
         writeFileSync(localPath, buffer);
-        // Replace remote URL with local path — the LLM reports this, no URL needed
+        // Keep file_url for downstream tools (email, workflows) that need public URLs
         data.local_file = localPath;
         data.file_size = buffer.length;
-        // Remove fields that tempt the LLM to fabricate URLs
-        delete data.file_url;
         delete data.download;
     }
     catch (err) {
@@ -396,6 +394,177 @@ export async function executeServerTool(name, input, emitter) {
             serverArgs.audio_base64 = samples[0];
         }
     }
+    // ── Pre-process file_path(s) for media upload tool ──
+    // Same pattern as voice: read local files in-process so base64 never flows
+    // through shell output (which truncates at ~100K chars) or conversation context.
+    // Also intercept file_url that's actually a local path (agents confuse the two).
+    if (name === "media" && (input.action === "upload" || input.action === "bulk_upload")) {
+        const fileUrl = input.file_url;
+        if (fileUrl && (fileUrl.startsWith("/") || /^[A-Z]:\\/i.test(fileUrl)) && !input.file_path && !input.file_paths) {
+            input = { ...input, file_path: fileUrl };
+            delete input.file_url;
+        }
+    }
+    if (name === "media" && (input.action === "upload" || input.action === "bulk_upload") && (input.file_path || input.file_paths)) {
+        let paths = [];
+        if (Array.isArray(input.file_paths)) {
+            paths = input.file_paths;
+        }
+        else if (typeof input.file_path === "string") {
+            paths = [input.file_path];
+        }
+        if (paths.length > 0) {
+            const MAX_FILE_SIZE = 10_000_000; // 10MB per file
+            const MAX_BATCH_BYTES = 50_000_000; // 50MB total batch
+            const MAX_BATCH_COUNT = 50;
+            if (paths.length === 1) {
+                // ── Single file → standard upload action ──
+                const filePath = paths[0];
+                try {
+                    const buf = readFileSync(filePath);
+                    if (buf.length > MAX_FILE_SIZE) {
+                        return { success: false, output: `File too large: ${(buf.length / 1_000_000).toFixed(1)}MB (max 10MB). Compress or resize first.` };
+                    }
+                    const { file_path: _fp, file_paths: _fps, ...rest } = input;
+                    serverArgs = { ...rest, action: "upload", base64: buf.toString("base64") };
+                    if (!serverArgs.file_name) {
+                        const basename = filePath.split("/").pop() || filePath.split("\\").pop() || "";
+                        if (basename)
+                            serverArgs.file_name = basename;
+                    }
+                }
+                catch (err) {
+                    return { success: false, output: `Cannot read file "${filePath}": ${err.message || err}` };
+                }
+            }
+            else {
+                // ── Multiple files → bulk_upload action ──
+                const files = [];
+                const errors = [];
+                let totalBytes = 0;
+                for (const filePath of paths.slice(0, MAX_BATCH_COUNT)) {
+                    try {
+                        const buf = readFileSync(filePath);
+                        if (buf.length > MAX_FILE_SIZE) {
+                            errors.push(`${filePath.split("/").pop()}: ${(buf.length / 1_000_000).toFixed(1)}MB exceeds 10MB limit, skipped`);
+                            continue;
+                        }
+                        totalBytes += buf.length;
+                        if (totalBytes > MAX_BATCH_BYTES) {
+                            errors.push(`Batch limit reached (50MB) — remaining files skipped`);
+                            break;
+                        }
+                        const basename = filePath.split("/").pop() || filePath.split("\\").pop() || "file";
+                        files.push({ base64: buf.toString("base64"), file_name: basename });
+                    }
+                    catch (err) {
+                        errors.push(`${filePath.split("/").pop()}: ${err.message || "unreadable"}`);
+                    }
+                }
+                if (paths.length > MAX_BATCH_COUNT) {
+                    errors.push(`Only first ${MAX_BATCH_COUNT} files processed (${paths.length} provided)`);
+                }
+                if (files.length === 0) {
+                    return { success: false, output: `No valid files to upload. Errors:\n${errors.join("\n")}` };
+                }
+                const { file_path: _fp, file_paths: _fps, ...rest } = input;
+                serverArgs = { ...rest, action: "bulk_upload", files, _read_errors: errors.length > 0 ? errors : undefined };
+            }
+        }
+    }
+    // ── Pre-process file_path for media replace tool ──
+    // Same pattern as upload: read local file in-process, base64-encode for server.
+    if (name === "media" && input.action === "replace" && (input.file_path || (typeof input.file_url === "string" && input.file_url.startsWith("/")))) {
+        const localPath = (input.file_path || input.file_url);
+        try {
+            const buf = readFileSync(localPath);
+            if (buf.length > 10_000_000) {
+                return { success: false, output: `File too large: ${(buf.length / 1_000_000).toFixed(1)}MB (max 10MB). Compress or resize first.` };
+            }
+            const { file_path: _fp, file_url: _fu, ...rest } = input;
+            serverArgs = { ...rest, base64: buf.toString("base64") };
+            if (!serverArgs.file_name) {
+                const basename = localPath.split("/").pop() || localPath.split("\\").pop() || "";
+                if (basename)
+                    serverArgs.file_name = basename;
+            }
+        }
+        catch (err) {
+            return { success: false, output: `Cannot read file "${localPath}": ${err.message || err}` };
+        }
+    }
+    // ── Pre-process image_path for remove_bg tool ──
+    // Same pattern: read local image, send as image_base64.
+    if (name === "remove_bg" && (input.image_path || (typeof input.image_url === "string" && input.image_url.startsWith("/")))) {
+        const imgPath = (input.image_path || input.image_url);
+        try {
+            const buf = readFileSync(imgPath);
+            if (buf.length > 10_000_000) {
+                return { success: false, output: `Image too large: ${(buf.length / 1_000_000).toFixed(1)}MB (max 10MB).` };
+            }
+            const { image_path: _ip, image_url: _iu, ...rest } = input;
+            serverArgs = { ...rest, image_base64: buf.toString("base64") };
+        }
+        catch (err) {
+            return { success: false, output: `Cannot read image "${imgPath}": ${err.message || err}` };
+        }
+    }
+    // ── Pre-process file_path in email attachments ──
+    // Reads local files referenced in attachments[].file_path, converts to base64 content.
+    if (name === "email" && input.action === "send" && Array.isArray(input.attachments)) {
+        const rawAtts = input.attachments;
+        const hasLocalFiles = rawAtts.some(a => a.file_path || (typeof a.url === "string" && a.url.startsWith("/")));
+        if (hasLocalFiles) {
+            const processed = [];
+            for (const att of rawAtts) {
+                const localPath = att.file_path || (typeof att.url === "string" && att.url.startsWith("/") ? att.url : null);
+                if (localPath) {
+                    try {
+                        const buf = readFileSync(localPath);
+                        if (buf.length > 10_000_000) {
+                            return { success: false, output: `Attachment too large: ${localPath.split("/").pop()} is ${(buf.length / 1_000_000).toFixed(1)}MB (max 10MB).` };
+                        }
+                        const filename = att.filename || localPath.split("/").pop() || "attachment";
+                        processed.push({ filename, content: buf.toString("base64") });
+                    }
+                    catch (err) {
+                        return { success: false, output: `Cannot read attachment "${localPath}": ${err.message || err}` };
+                    }
+                }
+                else if (att.content && att.filename) {
+                    processed.push({ filename: att.filename, content: att.content });
+                }
+                else if (att.url && att.filename) {
+                    processed.push(att); // URL-based, let server fetch it
+                }
+            }
+            const { attachments: _a, ...rest } = input;
+            serverArgs = { ...rest, attachments: processed };
+        }
+    }
+    // ── Pre-process file_path for kali upload ──
+    // Reads local file and sends content as base64 to the kali box.
+    if (name === "kali" && input.action === "upload" && (input.file_path || input.local_path)) {
+        const localPath = (input.file_path || input.local_path);
+        if (localPath && !input.content) {
+            try {
+                const buf = readFileSync(localPath);
+                if (buf.length > 50_000_000) {
+                    return { success: false, output: `File too large for kali upload: ${(buf.length / 1_000_000).toFixed(1)}MB (max 50MB).` };
+                }
+                const { file_path: _fp, local_path: _lp, ...rest } = input;
+                serverArgs = { ...rest, content: buf.toString("base64"), encoding: "base64" };
+                // Auto-set remote path from filename if not provided
+                if (!serverArgs.path) {
+                    const basename = localPath.split("/").pop() || "upload";
+                    serverArgs.path = `/tmp/${basename}`;
+                }
+            }
+            catch (err) {
+                return { success: false, output: `Cannot read file "${localPath}": ${err.message || err}` };
+            }
+        }
+    }
     // ── Streaming path for kali exec actions ──
     // Uses NDJSON streaming to show live stdout/stderr in the CLI while the command runs.
     const isStreamable = name === "kali" && emitter &&
@@ -452,6 +621,9 @@ export async function executeServerTool(name, input, emitter) {
                                 emitter.emitToolOutput(name, p.data);
                             }
                         }
+                        else if (parsed.type === "status" && parsed.progress) {
+                            emitter.emitToolProgress(name, parsed.progress);
+                        }
                         else if (parsed.type === "result") {
                             finalResult = parsed;
                         }

package/dist/cli/services/subagent.js

@@ -11,11 +11,11 @@ import { readFileSync, existsSync, writeFileSync, mkdirSync, appendFileSync } fr
 import { join } from "path";
 import { homedir, tmpdir } from "os";
 import { LOCAL_TOOL_DEFINITIONS, } from "./local-tools.js";
-import { LoopDetector, estimateCostUsd } from "../../shared/agent-core.js";
+import { LoopDetector, estimateCostUsd, demoteSubagentModel } from "../../shared/agent-core.js";
 import { MODEL_MAP } from "../../shared/constants.js";
 import { loadServerToolDefinitions, } from "./server-tools.js";
 import { logSpan, generateSpanId, generateTraceId } from "./telemetry.js";
-import { loadClaudeMd, getModel } from "./agent-loop.js";
+import { loadClaudeMd } from "./agent-loop.js";
 import { getGlobalEmitter } from "./agent-events.js";
 import { getAgentDefinition } from "./agent-definitions.js";
 import { callAgentAPI, executeToolBlocks, extractTextBlocks, extractToolUseBlocks, getResponseText, yieldToEventLoop, yieldForRender, } from "./agent-worker-base.js";
@@ -283,8 +283,9 @@ function emitSubagentProgress(agentType, agentId, message, turn, toolName) {
 export async function runSubagent(options) {
     const { prompt, subagent_type, model, resume, max_turns, name, parentContext, parentTraceContext } = options;
     const agentId = resume || generateAgentId();
-    // Inherit parent model when not specified (Anthropic pattern)
-    const modelId = model ? MODEL_MAP[model] : getModel();
+    // Sub-agents default to Haiku for cost control — uses shared demotion logic
+    const demotedAlias = demoteSubagentModel(model, subagent_type);
+    const modelId = MODEL_MAP[demotedAlias] || MODEL_MAP["haiku"];
     const cwd = process.cwd();
     const systemPrompt = buildAgentPrompt(subagent_type, cwd);
     const startTime = Date.now();
@@ -634,8 +635,8 @@ Each agent completes autonomously and returns results.`,
             },
             model: {
                 type: "string",
-                enum: ["sonnet", "opus", "haiku"],
-                description: "Optional model override. If not specified, inherits from parent. Prefer haiku for quick, straightforward tasks to minimize cost and latency.",
+                enum: ["sonnet", "haiku"],
+                description: "Optional model. haiku (default) for fast tasks, sonnet for complex reasoning.",
             },
             resume: {
                 type: "string",

package/dist/cli/services/system-prompt.js

@@ -103,9 +103,11 @@ Consider the reversibility and blast radius of your actions:
   - model:"sonnet" — code analysis, multi-step research, plan design ($3/$15 per 1M tokens)
   - model:"opus" — complex reasoning, judgment calls ($5/$25 per 1M tokens, use sparingly)
 
-## Teams (team_create tool)
-- Do NOT use team_create for bug fixes or single-file changes — work directly. Teams are for large features with 3+ independent workstreams.
-- When creating teams, assign per-task models based on complexity. Most tasks should use haiku or sonnet.`;
+## Teams (team_create / team_auto)
+- Do NOT use teams for bug fixes or single-file changes — work directly. Teams are for large features with 3+ independent workstreams.
+- **team_auto**: Give it a single task string — it auto-decomposes into parallel sub-tasks with file ownership, runs them, and reviews results. Best for refactoring, audits, and multi-file features.
+- **team_create**: Use when you want explicit control over task breakdown, file assignments, and models.
+- When creating teams manually, assign per-task models based on complexity. Most tasks should use haiku or sonnet.`;
     if (hasServerTools) {
         const storeCtx = storeConfig.store_name ? ` All operations are scoped to the active store: **${storeConfig.store_name}**.` : "";
         toolSection += `

package/dist/cli/services/task-decomposer.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Task Decomposer — breaks a user request into N sub-tasks via Claude API.
+ *
+ * Scans the working directory to give the decomposer real filesystem context,
+ * so it can assign specific files/directories to each agent instead of duplicating tasks.
+ *
+ * Used by the Team system to auto-decompose tasks before assigning to teammates.
+ */
+export interface SubTask {
+    id: string;
+    role: string;
+    prompt: string;
+    cell_index: number;
+    depends_on: string[];
+}
+export interface DecompositionResult {
+    sub_tasks: SubTask[];
+    summary: string;
+}
+export declare function decomposeTask(task: string, opts?: {
+    maxCells?: number;
+    context?: string;
+    apiKey?: string;
+    model?: string;
+    workingDirectory?: string;
+}): Promise<DecompositionResult>;
+/**
+ * Scan decomposed sub-task prompts for suspicious patterns.
+ * Returns an array of human-readable warnings (empty = clean).
+ */
+export declare function sanitizePrompts(subTasks: Array<{
+    role: string;
+    prompt: string;
+    cell_index?: number;
+}>): string[];

package/dist/cli/services/task-decomposer.js

@@ -0,0 +1,199 @@
+/**
+ * Task Decomposer — breaks a user request into N sub-tasks via Claude API.
+ *
+ * Scans the working directory to give the decomposer real filesystem context,
+ * so it can assign specific files/directories to each agent instead of duplicating tasks.
+ *
+ * Used by the Team system to auto-decompose tasks before assigning to teammates.
+ */
+import Anthropic from "@anthropic-ai/sdk";
+import { randomUUID } from "node:crypto";
+import { readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { callWithRetry } from "./api-retry.js";
+// ── Constants ──
+const DECOMPOSE_FALLBACK_MODEL = "claude-haiku-4-5-20251001";
+const DECOMPOSE_MAX_TOKENS = 8192;
+/** Scan a directory tree up to `maxDepth`, returning a compact file listing. */
+function scanDirectory(dir, maxDepth = 3, maxEntries = 200) {
+    const lines = [];
+    let count = 0;
+    function walk(current, depth) {
+        if (depth > maxDepth || count >= maxEntries)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(current);
+        }
+        catch {
+            return;
+        }
+        const skip = new Set(["node_modules", ".git", ".next", "dist", "build", "__pycache__", ".cache", ".turbo", "coverage", ".DS_Store"]);
+        entries = entries.filter(e => !skip.has(e)).sort();
+        for (const entry of entries) {
+            if (count >= maxEntries)
+                break;
+            const fullPath = join(current, entry);
+            let isDir = false;
+            try {
+                isDir = statSync(fullPath).isDirectory();
+            }
+            catch {
+                continue;
+            }
+            const prefix = "  ".repeat(depth);
+            lines.push(`${prefix}${isDir ? `${entry}/` : entry}`);
+            count++;
+            if (isDir) {
+                walk(fullPath, depth + 1);
+            }
+        }
+    }
+    walk(dir, 0);
+    return lines.join("\n");
+}
+function buildSystemPrompt(maxCells) {
+    return `You are a task decomposition engine for a multi-agent coding system.
+
+Given a user request and the project's file structure, break it into up to ${maxCells} sub-tasks that can be executed by independent coding agents in parallel. Each agent runs in its own thread — it CANNOT see other agents' work until completion.
+
+CRITICAL RULES:
+- ALL sub-tasks MUST have depends_on: []
+- Every sub-task MUST target DIFFERENT files/directories — NEVER assign the same file to two agents
+- Each prompt MUST list the SPECIFIC files/directories that agent owns exclusively
+
+Each sub-task has:
+- role: one of "implementer", "tester", "reviewer", or "researcher"
+- prompt: the specific instruction for this agent (MUST include exact file paths from the project structure)
+- depends_on: ALWAYS [] (empty array)
+
+Decomposition strategy:
+1. Study the file structure provided. Identify the major areas/modules/directories.
+2. Partition the work so each agent owns a DISTINCT set of files. Example: Agent 0 handles src/components/Header.tsx + src/components/Nav.tsx, Agent 1 handles src/pages/Home.tsx + src/pages/About.tsx, etc.
+3. Each prompt MUST start with "Working directory: <path>" and list the exact files the agent should focus on.
+4. If the task involves auditing/reviewing, assign different directories to each agent.
+5. If the task involves refactoring, assign specific files to each agent — NEVER say "refactor all components."
+6. Fewer focused tasks > many vague tasks. Use 2-4 cells for medium tasks, 5-6 only for large codebases.
+7. DO NOT create a "planner" or "coordinator" task — each agent plans its own work within its scope.
+8. If the task is simple enough for 1-2 agents, use fewer. Don't pad to ${maxCells}.
+
+Respond with ONLY valid JSON:
+{
+  "summary": "One-line description of the split strategy",
+  "sub_tasks": [
+    { "role": "implementer", "prompt": "Working directory: /path/to/project\\n\\nYour scope: src/components/Header.tsx, src/components/Nav.tsx\\n\\nTask: ...", "depends_on": [] }
+  ]
+}`;
+}
+export async function decomposeTask(task, opts = {}) {
+    const maxCells = opts.maxCells || 6;
+    const apiKey = opts.apiKey || process.env.ANTHROPIC_API_KEY;
+    const model = opts.model || DECOMPOSE_FALLBACK_MODEL;
+    if (!apiKey) {
+        console.warn("[decomposer] No API key — falling back to single task");
+        return singleTaskFallback(task);
+    }
+    try {
+        const client = new Anthropic({ apiKey });
+        let fileTree = "";
+        if (opts.workingDirectory) {
+            try {
+                fileTree = scanDirectory(opts.workingDirectory);
+            }
+            catch (err) {
+                console.warn(`[decomposer] Failed to scan ${opts.workingDirectory}: ${err.message}`);
+            }
+        }
+        const parts = [];
+        if (opts.workingDirectory) {
+            parts.push(`Working directory: ${opts.workingDirectory}`);
+        }
+        if (fileTree) {
+            parts.push(`\nProject file structure:\n${fileTree}`);
+        }
+        if (opts.context) {
+            parts.push(`\nPrevious round context:\n${opts.context}`);
+        }
+        parts.push(`\nTask: ${task}`);
+        parts.push(`\nMax sub-tasks: ${maxCells}`);
+        const userMessage = parts.join("\n");
+        const response = await callWithRetry(() => client.messages.create({
+            model,
+            max_tokens: DECOMPOSE_MAX_TOKENS,
+            system: buildSystemPrompt(maxCells),
+            messages: [{ role: "user", content: userMessage }],
+        }), { label: "decomposer" });
+        const text = response.content
+            .filter((b) => b.type === "text")
+            .map(b => b.text)
+            .join("");
+        const jsonMatch = text.match(/\{[\s\S]*\}/);
+        if (!jsonMatch) {
+            console.warn("[decomposer] No JSON found in response — falling back to single task");
+            return singleTaskFallback(task);
+        }
+        const parsed = JSON.parse(jsonMatch[0]);
+        if (!parsed.sub_tasks?.length) {
+            return singleTaskFallback(task);
+        }
+        const subTasks = parsed.sub_tasks.slice(0, maxCells).map((st, i) => ({
+            id: randomUUID(),
+            role: st.role,
+            prompt: st.prompt,
+            cell_index: i,
+            depends_on: [],
+        }));
+        // Resolve depends_on from indices to UUIDs
+        for (let i = 0; i < subTasks.length; i++) {
+            const raw = parsed.sub_tasks[i];
+            subTasks[i].depends_on = (raw.depends_on || [])
+                .filter(idx => idx >= 0 && idx < subTasks.length && idx !== i)
+                .map(idx => subTasks[idx].id);
+        }
+        return {
+            sub_tasks: subTasks,
+            summary: parsed.summary,
+        };
+    }
+    catch (err) {
+        console.warn("[decomposer] API call failed — falling back to single task:", err.message);
+        return singleTaskFallback(task);
+    }
+}
+/**
+ * Scan decomposed sub-task prompts for suspicious patterns.
+ * Returns an array of human-readable warnings (empty = clean).
+ */
+export function sanitizePrompts(subTasks) {
+    const warnings = [];
+    const dangerous = [
+        { pattern: /rm\s+-rf\s+[\/~]/i, label: "rm -rf with absolute path" },
+        { pattern: /curl.*\|\s*(?:ba)?sh/i, label: "curl piped to shell" },
+        { pattern: /eval\s*\(/i, label: "eval()" },
+        { pattern: />\s*\/etc\//i, label: "write to /etc" },
+        { pattern: /chmod\s+777/i, label: "chmod 777" },
+        { pattern: /ssh\s+/i, label: "SSH command" },
+        { pattern: /scp\s+/i, label: "SCP command" },
+    ];
+    for (const st of subTasks) {
+        for (const { pattern, label } of dangerous) {
+            if (pattern.test(st.prompt)) {
+                const idx = st.cell_index ?? subTasks.indexOf(st);
+                warnings.push(`Task ${idx} (${st.role}): prompt contains suspicious pattern — ${label}`);
+            }
+        }
+    }
+    return warnings;
+}
+function singleTaskFallback(task) {
+    return {
+        sub_tasks: [{
+                id: randomUUID(),
+                role: "executor",
+                prompt: task,
+                cell_index: 0,
+                depends_on: [],
+            }],
+        summary: "Single agent execution",
+    };
+}

package/dist/cli/services/team-lead.d.ts

@@ -71,3 +71,21 @@ export declare class TeamLead extends EventEmitter {
     stop(): void;
 }
 export declare function runAgentTeam(config: TeamConfig): Promise<TeamResult>;
+export interface AutoTeamOptions {
+    maxTeammates?: number;
+    model?: "sonnet" | "opus" | "haiku";
+    workingDirectory?: string;
+    apiKey?: string;
+    review?: boolean;
+}
+/**
+ * Auto-decompose a task into sub-tasks and run them as a team.
+ *
+ * Uses Claude (haiku) to break the task into parallel sub-tasks with
+ * file ownership, then spawns a team to execute them. Optionally runs
+ * a lightweight review pass to summarize results and flag issues.
+ */
+export declare function runAutoTeam(task: string, opts?: AutoTeamOptions): Promise<TeamResult & {
+    review?: string;
+    warnings?: string[];
+}>;

package/dist/cli/services/team-lead.js

@@ -14,6 +14,8 @@ import { logSpan, generateTraceId, generateSpanId, getConversationId } from "./t
 import { resolveConfig } from "./config-store.js";
 import { getGlobalEmitter } from "./agent-events.js";
 import { getModelShortName } from "./agent-loop.js";
+import { decomposeTask, sanitizePrompts } from "./task-decomposer.js";
+import { callWithRetry } from "./api-retry.js";
 // ============================================================================
 // TEAM LEAD CLASS
 // ============================================================================
@@ -510,3 +512,81 @@ export async function runAgentTeam(config) {
     await lead.createTeam(config);
     return lead.runTeam();
 }
+/**
+ * Auto-decompose a task into sub-tasks and run them as a team.
+ *
+ * Uses Claude (haiku) to break the task into parallel sub-tasks with
+ * file ownership, then spawns a team to execute them. Optionally runs
+ * a lightweight review pass to summarize results and flag issues.
+ */
+export async function runAutoTeam(task, opts = {}) {
+    const maxTeammates = opts.maxTeammates ?? 4;
+    const model = opts.model || "sonnet";
+    const workingDirectory = opts.workingDirectory || process.cwd();
+    const shouldReview = opts.review !== false;
+    // 1. Decompose
+    const decomposition = await decomposeTask(task, {
+        maxCells: maxTeammates,
+        apiKey: opts.apiKey,
+        workingDirectory,
+    });
+    // 2. Sanitize prompts
+    const warnings = sanitizePrompts(decomposition.sub_tasks);
+    if (warnings.length > 0) {
+        console.warn(`[team] Sanitization warnings:\n${warnings.join("\n")}`);
+    }
+    // 3. Map sub-tasks to TeamConfig
+    const tasks = decomposition.sub_tasks.map(st => ({
+        description: st.prompt,
+        files: extractFiles(st.prompt),
+    }));
+    const config = {
+        name: decomposition.summary.slice(0, 60) || "Auto Team",
+        teammateCount: tasks.length,
+        model,
+        tasks,
+    };
+    // 4. Run team
+    const result = await runAgentTeam(config);
+    // 5. Optional review
+    let review;
+    if (shouldReview && result.taskResults.length > 0) {
+        review = await reviewResults(task, result, opts.apiKey);
+    }
+    return { ...result, review, warnings: warnings.length > 0 ? warnings : undefined };
+}
+/** Extract file paths mentioned in a sub-task prompt. */
+function extractFiles(prompt) {
+    const matches = prompt.match(/(?:^|\s)((?:src|lib|app|pages|components|test|spec|public)\/[\w./-]+)/gm);
+    return matches ? [...new Set(matches.map(m => m.trim()))] : [];
+}
+/** Lightweight review of team results using Claude haiku. */
+async function reviewResults(originalTask, result, apiKey) {
+    const key = apiKey || process.env.ANTHROPIC_API_KEY;
+    if (!key)
+        return undefined;
+    try {
+        const Anthropic = (await import("@anthropic-ai/sdk")).default;
+        const client = new Anthropic({ apiKey: key });
+        const taskSummaries = result.taskResults
+            .map((t, i) => `Task ${i + 1} [${t.status}]: ${t.description.slice(0, 100)}\nResult: ${t.result.slice(0, 200)}`)
+            .join("\n\n");
+        const response = await callWithRetry(() => client.messages.create({
+            model: "claude-haiku-4-5-20251001",
+            max_tokens: 1024,
+            system: "You are a code review assistant. Given the original task and the results from parallel agents, provide a brief (2-4 sentence) assessment: were the goals met? Any conflicts or gaps between agents' work? Any follow-up needed?",
+            messages: [{
+                    role: "user",
+                    content: `Original task: ${originalTask}\n\nTeam results (${result.taskResults.length} agents):\n${taskSummaries}`,
+                }],
+        }), { label: "team-review", maxRetries: 1 });
+        const text = response.content
+            .filter((b) => b.type === "text")
+            .map((b) => b.text)
+            .join("");
+        return text || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/cli/services/teammate.js

@@ -11,7 +11,7 @@ import { Worker, parentPort, workerData, isMainThread } from "worker_threads";
 import { fileURLToPath } from "url";
 import { loadTeam, claimTask, completeTask, failTask, getAvailableTasks, sendMessage, getUnreadMessages, markMessagesRead, updateTeammate, } from "./team-state.js";
 import { LoopDetector, estimateCostUsd } from "../../shared/agent-core.js";
-import { MODEL_MAP, getProvider } from "../../shared/constants.js";
+import { MODEL_MAP } from "../../shared/constants.js";
 import { LOCAL_TOOL_DEFINITIONS, } from "./local-tools.js";
 import { loadServerToolDefinitions, } from "./server-tools.js";
 import { getValidToken } from "./auth-service.js";
@@ -389,10 +389,10 @@ async function runTeammateLoop(data) {
             // Resolve per-task model: task-level → team default
             const taskModel = claimed.model || model;
             currentTaskModelId = MODEL_MAP[taskModel] || MODEL_MAP[model] || MODEL_MAP.opus;
-            // Enable thinking for capable models (Opus/Sonnet adaptive, others budget/disabled)
-            const taskProvider = getProvider(currentTaskModelId);
-            currentTaskThinking = (taskProvider === "anthropic" || taskProvider === "bedrock")
-                && (currentTaskModelId.includes("opus") || currentTaskModelId.includes("sonnet-4-6") || currentTaskModelId.includes("sonnet-4-5"));
+            // Disable thinking for teammates — with MAX_OUTPUT_TOKENS=16K, adaptive thinking
+            // burns 8-12K tokens on reasoning per turn, leaving only 4-8K for actual code output.
+            // This caused catastrophic token bloat (359K input tokens per task) and truncated responses.
+            currentTaskThinking = false;
             await updateTeammate(teamId, teammateId, { status: "working", currentTask: currentTaskId });
             report({ type: "task_started", teammateId, taskId: currentTaskId, content: claimed.description });
             // Start fresh conversation for new task

package/dist/cli/services/telemetry.d.ts

@@ -1,8 +1,9 @@
 /**
- * CLI Telemetry — fire-and-forget span logging to audit_logs
+ * CLI Telemetry — spans are buffered and flushed to the Fly.io server,
+ * which queues them into ClickHouse ai_spans.
  *
  * Session-scoped conversationId + auto-incrementing turnNumber.
- * Uses same column schema as executor.ts telemetry (trace_id, span_id, etc).
+ * Uses same column schema as server-side telemetry (trace_id, span_id, etc).
  * Never blocks or crashes the chat.
  */
 export interface ExecutionContext {
@@ -49,6 +50,11 @@ export declare function generateSpanId(): string;
 export declare function nextTurn(): number;
 export declare function createTurnContext(overrides?: Partial<ExecutionContext>): ExecutionContext;
 export declare function getTurnNumber(): number;
+/**
+ * Flush all buffered spans to the Fly.io server.
+ * Call this on session end or at shutdown.
+ */
+export declare function flushCliSpans(): void;
 export interface SpanOptions {
     action: string;
     severity?: "info" | "warn" | "error";