euron-code 0.5.1__tar.gz → 0.5.2__tar.gz

{euron_code-0.5.1 → euron_code-0.5.2}/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.5.2 (2026-11-05)
+
+Security and reliability fixes from pre-launch testing.
+
+- Bypass mode (`--yolo`) now asks before any command that names a path outside your project, including
+  quoted paths and paths in your home folder.
+- Files that usually hold secrets (such as `.env`) are never sent with your message without a yes.
+- An answer that comes back empty is asked for once more instead of ending silently; `-p` always prints a
+  result, and JSON mode reports errors as JSON.
+- Hindi, emoji and other non-English text print correctly when output is piped on Windows.
+- Long tasks no longer stop early as a false "loop", or with an unfinished task list.
+- Reuse planning picks the right components and records every reused source.
+
 ## 0.5.1 (2026-11-05)
 
 - Running `euron` again right after a run finished no longer says Euron Code is already running for

{euron_code-0.5.1 → euron_code-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: euron-code
-Version: 0.5.1
+Version: 0.5.2
 Summary: Euron Code: an agentic coding assistant in your terminal for Euron Plus and Super 30 students.
 Project-URL: Homepage, https://euron.one/code-agent
 Author-email: Euron <contact@euron.one>

{euron_code-0.5.1 → euron_code-0.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "euron-code"
-version = "0.5.1"
+version = "0.5.2"
 description = "Euron Code: an agentic coding assistant in your terminal for Euron Plus and Super 30 students."
 readme = "README.md"
 requires-python = ">=3.9"

{euron_code-0.5.1 → euron_code-0.5.2}/src/euron_code/__init__.py

@@ -1,3 +1,3 @@
 """Euron Code: an agentic coding assistant for the terminal."""
 
-__version__ = "0.5.1"
+__version__ = "0.5.2"

{euron_code-0.5.1 → euron_code-0.5.2}/src/euron_code/agent.py

@@ -167,7 +167,9 @@ class Agent:
         self.pending_images: List[Dict[str, Any]] = []  # image_url parts for the next prompt
         self.pending_image_paths: List[Path] = []  # their local files (a photo may belong on the page)
         self._placeholder_nudged = False
+        self._ctx_note_band = 0  # 10% band of the last small "Context was N% full" note
         self.pending_paths: List[Path] = []  # /attach, /paste-image: attached to the next prompt
+        self._notice_nudged = False  # one THIRD_PARTY_NOTICES nudge per prompt
         self.memory_files: List[memory.MemoryFile] = []
         self.rules = rules.RuleSet([])
         self.skills: Dict[str, skills.Skill] = {}
@@ -319,6 +321,7 @@ class Agent:
         errorlog.get().task_id = self.client.task_id
         self._nudged = False
         self._placeholder_nudged = False
+        self._notice_nudged = False
         for r in self._run_hooks("UserPromptSubmit", {"prompt": user_text}):
             if r.code == 2:
                 self.ui.warn("A UserPromptSubmit hook blocked this prompt: " + (r.stderr.strip() or "(no reason given)"))
@@ -379,8 +382,11 @@ class Agent:
         continues = 0  # answer cut by the output limit, continued automatically
         cut_tools = 0
         effort_retry = False
+        empty_retry = False  # one retry when the model answers with nothing at all
         partial = ""  # text of an answer that is being continued
         todos_before = list(self.ctx.todos)
+        todo_nudged = False  # one "your task list is not finished" nudge per request
+        todos_at_start = list(self.ctx.todos)
         while True:
             if max_turns and turns >= max_turns:
                 return TurnResult(last_text, "max_turns", turns)
@@ -433,6 +439,15 @@ class Agent:
                         self._append({"role": "user", "content": prompts.ANSWER_NUDGE})
                         self._effort_once = "low"
                         continue
+            if (not resp.tool_calls and not (partial + resp.content).strip() and not empty_retry
+                    and not self.is_subagent):
+                # the model ended the turn without a word (seen live): ask once instead of
+                # printing nothing and exiting 0
+                empty_retry = True
+                self._append({"role": "assistant", "content": "(empty reply)"})
+                self._append({"role": "user", "content": prompts.EMPTY_NUDGE})
+                self.ui.dim("(the answer came back empty; asking again)")
+                continue
             msg: Dict[str, Any] = {"role": "assistant", "content": resp.content}
             if resp.tool_calls:
                 msg["tool_calls"] = resp.tool_calls
@@ -455,11 +470,29 @@ class Agent:
                     self._append({"role": "user", "content": prompts.PLACEHOLDER_NUDGE.format(where=where)})
                     self.ui.dim("(asking Euron Code to replace placeholder text with your details)")
                     continue
+                missing = self._missing_notices() if not self._notice_nudged and not self.is_subagent else ""
+                if missing:
+                    self._notice_nudged = True
+                    self._append({"role": "user", "content": prompts.NOTICE_NUDGE.format(repos=missing)})
+                    self.ui.dim("(asking Euron Code to record the reused sources in THIRD_PARTY_NOTICES.md)")
+                    continue
                 if self._needs_verify_nudge():
                     self._nudged = True
                     self._append({"role": "user", "content": prompts.verify_nudge(self.test_command)})
                     self.ui.dim("(asking Euron Code to check its change)")
                     continue
+                open_todos = [t for t in self.ctx.todos if isinstance(t, dict)
+                              and t.get("status") in ("pending", "in_progress")]
+                if (open_todos and self.ctx.todos != todos_at_start and not todo_nudged and not self.is_subagent
+                        and self.permissions.mode != "plan"
+                        and len((resp.content or "").strip()) < 400):
+                    # QA 2026-11-05: a portfolio build ended on "Scaffolding the Next.js project now..." with 6 of 6
+                    # todos open and no file written; exit 0, nothing built
+                    todo_nudged = True
+                    self._append({"role": "user", "content": prompts.TODO_NUDGE.format(
+                        todos="; ".join(str(t.get("content"))[:80] for t in open_todos[:5]))})
+                    self.ui.dim("(the task list is not finished; asking Euron Code to continue)")
+                    continue
                 if not self.is_subagent:
                     self._footer()
                 return TurnResult(partial + resp.content, "end_turn", turns)
@@ -755,7 +788,11 @@ class Agent:
             args = str(fn.get("arguments"))
         failed = content.startswith("Error") or (content.startswith("Exit code: ") and
                                                  not content.startswith("Exit code: 0"))
-        key = (fn.get("name"), args, failed, content[:300] if failed else "")
+        # A failing run is "the same" only when its start AND its end match (numbers ignored, so timings
+        # do not hide a real loop). QA 2026-11-05: pytest printed the same 300-char warning first every time,
+        # so 15 failed / collection error / 4 failed counted as one call failing 5 times and the turn stopped.
+        key = (fn.get("name"), args, failed,
+               (content[:300], re.sub(r"\d+", "N", content[-300:])) if failed else "")
         n = self._calls[key] = self._calls.get(key, 0) + 1
         if failed:
             if n >= LOOP_STOP_AT:
@@ -879,6 +916,9 @@ class Agent:
         model call), so the model starts from proven code whatever it would have chosen; and put the
         user's photo into the project. Returns text for the end of the user message."""
         from euron_code.tools import erie
+        # only what the user typed: an attached document's text ("The service must expose GET /health")
+        # turned a question about it into a build request (QA 2026-11-05)
+        user_text = re.sub(r'<attached-file path="[^"]*">.*?</attached-file>', " ", user_text, flags=re.S)
         if not erie.is_build_request(user_text):
             return ""
         out = ""
@@ -942,6 +982,36 @@ class Agent:
                 hits.append(f"{rel} ({', '.join(found[:3])})")
         return "; ".join(hits[:6])
 
+    def _missing_notices(self) -> str:
+        """Repos read this prompt that a changed file names (an "Adapted from owner/repo" header) but that
+        THIRD_PARTY_NOTICES.md does not list. QA 2026-11-05: a portfolio's Hero said "Adapted from
+        euron-sde-team/euron-open-multi-tenant-lms (MIT)" and the notices file had no entry for it."""
+        from euron_code import licensing
+        repos = list(dict.fromkeys(r for r, _, _ in self.ledger.get("reused") or []))
+        if not repos:
+            return ""
+        try:
+            notices = (self.root / licensing.NOTICES_FILE).read_text(encoding="utf-8", errors="ignore")
+        except OSError:
+            notices = ""
+        listed = {ln[3:].strip().lower() for ln in notices.splitlines() if ln.startswith("## ")}
+        todo = [r for r in repos if r.lower() not in listed]
+        if not todo:
+            return ""
+        named = []
+        for rel in self.files_changed():
+            p = self.root / rel
+            if p.name == licensing.NOTICES_FILE:
+                continue
+            try:
+                if not p.is_file() or p.stat().st_size > 400_000:
+                    continue
+                text = p.read_text(encoding="utf-8", errors="ignore")
+            except OSError:
+                continue
+            named += [r for r in todo if r in text and r not in named]
+        return ", ".join(named[:6])
+
     def _verified(self) -> bool:
         if not self.ledger["edits"]:
             return True
@@ -960,7 +1030,10 @@ class Agent:
         """Local report after a prompt that changed files (shown to the user, not sent to the model)."""
         changed = self.files_changed()
         reused = self.ledger.get("reused") or []
-        planned = [c for c in self.reuse_report() if c["decision"] in ("REUSE", "ADAPT")]
+        read_repos = {r for r, _, _ in reused}
+        # "x reused from repo" only when that repo was actually read (QA 2026-11-05: a question about two
+        # attached documents printed "Reuse plan: api reused from euron-open-smart-router" with nothing read)
+        planned = [c for c in self.reuse_report() if c["decision"] in ("REUSE", "ADAPT") and c.get("repo") in read_repos]
         if planned:
             self._phase("Integration completed")
             self.ui.dim("Reuse plan: " + "; ".join(f"{c['component']} {_PAST.get(c['decision'], c['decision'].lower())} from {c['repo']} "
@@ -1193,7 +1266,14 @@ class Agent:
             self.savings.add("micro", saved)
             self._persist_compaction()
             after = self.context_usage()
-            if before - after >= 2000 or before * 100 // self.usable_window >= 60:
+            pct = before * 100 // self.usable_window
+            if pct < 60:
+                self._ctx_note_band = 0
+            # above 60% the note came on EVERY step, even for 32 freed tokens (QA 2026-11-05: 11 lines in one
+            # build); now a small clearing is shown once per 10% band
+            if before - after >= 2000 or (pct >= 60 and pct // 10 > self._ctx_note_band):
+                if before - after < 2000:
+                    self._ctx_note_band = pct // 10
                 self.ui.dim(f"Context was {before * 100 // self.usable_window}% full: cleared {len(ids)} tool "
                             f"output(s), freed {max(0, before - after):,} tokens, now "
                             f"{after * 100 // self.usable_window}%.")
@@ -1243,7 +1323,11 @@ class Agent:
             if not manual:
                 context.elide_old_tool_outputs(self.messages, keep_last=1, min_chars=300)
                 self._persist_compaction()
-            self.ui.warn("Nothing older to summarise; the current turn alone is large. Consider /clear.")
+            if len(users) <= 1:  # the first message itself is too big: /clear cannot help
+                self.ui.warn("Your message alone is too large for the context. Put long text in a file and "
+                             "mention it with @file instead.")
+            else:
+                self.ui.warn("Nothing older to summarise; the current turn alone is large. Consider /clear.")
             return False
         old = self.messages[1:cut]
         recent = self.messages[cut:]
@@ -1459,6 +1543,10 @@ class Agent:
                 self.pending_image_paths.append(p)
                 attachments.privacy_notice_once(self.ui)
                 return None
+            from euron_code.permissions import is_sensitive
+            if is_sensitive(p) and not self._consent_to_secret(p):
+                return (f"(not attached: {self.ctx.rel(p)} looks like a secrets file, so its contents were not "
+                        "sent. Do not read it unless the user asks you to.)")
             if documents.is_document(p):
                 return documents.extract(p, cap_tokens=cap)
             data = p.read_bytes()[:8192]
@@ -1469,6 +1557,19 @@ class Agent:
         except (ToolError, documents.DocumentError, OSError) as e:
             return f"(could not attach: {e})"
 
+    def _consent_to_secret(self, p: Path) -> bool:
+        """A .env / key / credentials file named in a prompt (typed or dragged, @ or a bare absolute
+        path) is only sent after a yes. QA 2026-11-05: "the values are in C:\\Users\\me\\app\\.env" uploaded
+        the file's contents without a question, in default mode and from outside the project."""
+        rel = self.ctx.rel(p)
+        if not getattr(self.ui, "interactive", False):
+            self.ui.warn(f"Not attached: {rel} looks like a secrets file (its contents would be sent with your "
+                         "message). Attach it in an interactive session if you mean to.")
+            return False
+        choice = self.ui.ask_permission(f"Attach {rel}? It looks like a secrets file: its contents are sent with "
+                                        "your message.", None, [("y", "yes"), ("n", "no")])
+        return choice == "y"
+
     # ---------------------------------------------------------- sub-agent
     def run_subagent(self, prompt: str) -> str:
         sub_ui = _SubagentUI(self.ui)

{euron_code-0.5.1 → euron_code-0.5.2}/src/euron_code/api.py

@@ -58,6 +58,10 @@ class AuthError(EuronError):
 SIGNED_IN_ELSEWHERE_MESSAGE = ("You signed in to Euron Code on another device, so this one was signed out. "
                                "One login at a time: signing in on a new computer signs out the old one.")
 SESSION_IN_USE_MESSAGE = "Euron Code is running for your account in another terminal or computer."
+#: shown instead of the gateway's raw text, which named the model's context size and the serving
+#: stack's parameters (QA 2026-11-05, a 100 KB prompt)
+CONTEXT_TOO_LONG_MESSAGE = ("This request is too long for Euron Code to read in one go. Put long text in a file in "
+                            "your project and mention it with @file (it is then read in parts), or split the request.")
 
 
 class NotEntitledError(EuronError):
@@ -208,7 +212,9 @@ def error_from_body(status: int, body: Any, retry_after: Optional[float] = None)
     if status == 413 or code == "context_length_exceeded" or (
         status == 400 and "context length" in message.lower()
     ):
-        return ContextTooLongError(message, **kw)
+        e = ContextTooLongError(CONTEXT_TOO_LONG_MESSAGE, **kw)
+        e.detail = message  # the gateway's own text, never shown
+        return e
     if status == 503:
         return BusyError(message, **kw)
     if status == 429:

{euron_code-0.5.1 → euron_code-0.5.2}/src/euron_code/cli.py

@@ -27,11 +27,27 @@ def _fix_windows_console() -> None:
     for stream in (sys.stdout, sys.stderr):
         try:
             if stream and hasattr(stream, "reconfigure") and (stream.encoding or "").lower() not in ("utf-8", "utf8"):
-                stream.reconfigure(errors="replace")
+                if not stream.isatty():
+                    # redirected to a file or pipe: write UTF-8. With the legacy code page, Hindi and emoji
+                    # answers came out as "???" (QA 2026-11-05: `euron -p ... > out.txt` lost every character)
+                    stream.reconfigure(encoding="utf-8", errors="replace")
+                else:
+                    stream.reconfigure(errors="replace")
         except Exception:
             pass
 
 
+def _positive_int(raw: str) -> int:
+    """--max-turns: 0 silently meant "no limit" and -1 stopped before the first step."""
+    try:
+        n = int(raw)
+    except ValueError:
+        raise argparse.ArgumentTypeError(f"expected a whole number, got {raw!r}") from None
+    if n < 1:
+        raise argparse.ArgumentTypeError("must be 1 or more")
+    return n
+
+
 def main_parser() -> argparse.ArgumentParser:
     p = argparse.ArgumentParser(
         prog="euron",
@@ -43,7 +59,7 @@ def main_parser() -> argparse.ArgumentParser:
     p.add_argument("-p", "--print", dest="print_mode", action="store_true",
                    help="Non-interactive: run the prompt, print the result, exit.")
     p.add_argument("--output-format", choices=["text", "json"], default="text", help="With -p: text or json.")
-    p.add_argument("--max-turns", type=int, default=None, help="Maximum model steps for this run.")
+    p.add_argument("--max-turns", type=_positive_int, default=None, help="Maximum model steps for this run.")
     p.add_argument("--model", default=None, help="Model id (default: your account's default model).")
     p.add_argument("-c", "--continue", dest="cont", action="store_true", help="Continue the latest session in this folder.")
     p.add_argument("-r", "--resume", nargs="?", const="", default=None, metavar="ID",
@@ -280,15 +296,26 @@ def run_config(ui, args) -> int:
 # ---------------------------------------------------------------- main session
 
 def run_main(args) -> int:
-    from euron_code.agent import Agent
-    from euron_code.permissions import Permissions
-
     root = config.find_project_root()
     settings = config.load_settings(root)
     if args.print_mode:
         ui = QuietUI(verbose=args.verbose)
     else:
         ui = UI(reasoning=str(settings.get("reasoning") or "collapse"))
+    code = _run_session(args, ui, root, settings)
+    if (args.print_mode and args.output_format == "json" and code != EXIT_OK
+            and not getattr(ui, "result_written", False)):
+        # a failure before the turn started (no prompt, not logged in, unreachable): scripts still get JSON
+        msg = getattr(ui, "last_error", None) or "Euron Code could not start."
+        sys.stdout.write(json.dumps({"type": "result", "subtype": "error", "is_error": True, "result": "",
+                                     "exit_code": code, "error": {"message": msg}}, ensure_ascii=False) + "\n")
+        sys.stdout.flush()
+    return code
+
+
+def _run_session(args, ui, root, settings) -> int:
+    from euron_code.agent import Agent
+    from euron_code.permissions import Permissions
 
     prompt = args.prompt
     if args.print_mode:
@@ -491,7 +518,7 @@ def run_print(agent, ui, client, prompt: str, args, session) -> int:
             "type": "result",
             "subtype": "success" if code == 0 else ("error_max_turns" if code == EXIT_MAX_TURNS else "error"),
             "is_error": code != 0,
-            "result": res.text,
+            "result": (res.text or "").lstrip("\r\n"),
             "stop_reason": res.stop_reason,
             "num_turns": res.turns,
             "session_id": session.id,
@@ -510,8 +537,9 @@ def run_print(agent, ui, client, prompt: str, args, session) -> int:
             out["error"] = {"code": err.code, "status": err.status, "message": message}
         sys.stdout.write(json.dumps(out, ensure_ascii=False) + "\n")
     else:
-        if res.text:
-            sys.stdout.write(res.text.rstrip() + "\n")
+        if res.text and res.text.strip():
+            sys.stdout.write(res.text.strip("\r\n").rstrip() + "\n")  # no leading blank lines before the answer
+    ui.result_written = True
     sys.stdout.flush()
     return code
 

{euron_code-0.5.1 → euron_code-0.5.2}/src/euron_code/permissions.py

@@ -177,6 +177,9 @@ DESTRUCTIVE = [re.compile(p, re.IGNORECASE) for p in (
     r"\bmkfs(\.\w+)?\b", r"\bdd\s+if=", r"\b(shutdown|reboot|halt|poweroff)\b", r"\bformat\s+[a-z]:",
     r"\b(del|erase)\s+(/[a-z]\s+)*/s\b", r"\b(rd|rmdir)\s+(/[a-z]\s+)*/s\b",
     r"\bRemove-Item\b.*-Recurse\b.*(?:~|\$HOME|\$env:USERPROFILE|[A-Za-z]:\\?\s*$|\s/\s*$)",
+    # the home folder named BEFORE -Recurse as well (QA 2026-11-05: `Remove-Item -Path "$env:USERPROFILE\x"
+    # -Recurse -Force` deleted a folder outside the project in bypass mode)
+    r"\bRemove-Item\b.*(?:~|\$HOME|\$env:USERPROFILE|%USERPROFILE%).*\s-Recurse\b",
     r"\bchmod\s+-R\s+0?777\b", r":\(\)\s*\{\s*:\|:&\s*\};", r"\bdrop\s+(database|schema)\b",
     r"\b(curl|wget|iwr|irm|Invoke-WebRequest|Invoke-RestMethod)\b[^|;]*\|\s*(sudo\s+)?(ba|z)?sh\b",
     r"\b(curl|wget|iwr|irm|Invoke-WebRequest|Invoke-RestMethod)\b[^|;]*\|\s*(iex|Invoke-Expression|python3?)\b",
@@ -204,6 +207,9 @@ def outside_paths(command: str, roots: List[Path]) -> List[str]:
     for seg in _segments(command.replace(">", " ").replace("<", " ")):
         for tok in _tokens(seg):
             for part in [tok] + tok.split("=")[1:]:
+                # shlex keeps the quotes on Windows (posix=False), so a quoted path ("C:\x", "$env:USERPROFILE\x")
+                # was never seen as a path and skipped this guard (QA 2026-11-05)
+                part = part.strip().strip('"').strip("'")
                 if not _PATHLIKE.match(part) or (os.name == "nt" and _WIN_SWITCH.match(part)):
                     continue
                 if part.startswith("/dev/") or part in ("/dev/null", "NUL"):

{euron_code-0.5.1 → euron_code-0.5.2}/src/euron_code/prompts.py

@@ -71,16 +71,25 @@ Do not invent anything. Do not call tools. Plain text or Markdown, at most about
 PLACEHOLDER_NUDGE = ("These files still contain placeholder text: {where}. Replace it with the details the user gave "
                      "(name, photo, email, links). If the user did not give a detail, remove it or ask for it.")
 
+NOTICE_NUDGE = ("Your files say they reuse code from {repos}, but THIRD_PARTY_NOTICES.md has no entry for it. "
+                "Record each one with add_third_party_notice (source, licence, the files that use it), then finish. "
+                "If you did not actually use that code, remove the attribution comment instead.")
+
 BUILD_NOTE = ("[Build request: start with find_reusable (split it into 1-8 components) and follow its "
               "REUSE / ADAPT / GENERATE decisions before writing code.]")
 
 CONTINUE_NUDGE = "Continue exactly where you stopped. Do not repeat what you already wrote."
 
+TODO_NUDGE = ("You stopped, but your task list is not finished: {todos}. Continue now with the next item. If you "
+              "cannot finish it, say exactly what is left and why.")
+
 CUT_TOOL_NUDGE = ("Your last tool call was cut off by the output limit, so it was not run. Make the change in smaller "
                   "steps: use edit_file for targeted edits, or write the file in parts (create it with the first part, "
                   "then add the rest with edit_file).")
 
 ANSWER_NUDGE = "Answer now, briefly, with what you have. Do not deliberate further."
+EMPTY_NUDGE = ("Your last reply was empty. Reply to the user now: answer the request, or say briefly what "
+               "you did and what is left.")
 
 
 INIT_PROMPT = """Write (or improve) EURON.md at the project root: the memory file Euron Code reads at the start of every session. Keep it short (under ~70 lines): every line costs tokens in every future request.

{euron_code-0.5.1 → euron_code-0.5.2}/src/euron_code/tools/erie.py

@@ -40,21 +40,26 @@ UI_WORDS = re.compile(r"\b(website|site|portfolio|landing|page|pages|ui|frontend
                       r"resume|cv|shop|store|form|react|next\.?js|vue|svelte|html|css|tailwind)\b", re.I)
 # (component name, keyword pattern, query); UI queries get "react tsx component" so Euron's TS/TSX kits match
 _PARTS = [
-    ("hero", r"portfolio|landing|personal|resume|cv|about me|profile", "hero section with name photo and intro"),
-    ("projects", r"portfolio|projects|work|case stud", "projects grid cards"),
-    ("navbar", r"website|site|portfolio|landing|page|pages|blog|shop|store|dashboard", "responsive navbar"),
-    ("contact", r"contact|portfolio|landing|email|form", "contact form"),
-    ("dashboard", r"dashboard|admin|analytics|chart", "dashboard layout charts cards"),
-    ("blog", r"\bblog|posts|articles", "blog post list and markdown rendering"),
-    ("cart", r"shop|store|cart|checkout|e-?commerce", "shopping cart and checkout"),
-    ("auth", r"login|signup|sign up|sign in|auth|jwt|oauth|account", "login signup jwt authentication"),
-    ("api", r"\bapi\b|backend|server|crud|endpoint|rest|fastapi|flask|django|express", "rest api crud endpoints"),
-    ("database", r"database|\bdb\b|postgres|sqlite|mongo|prisma|orm|crud", "database models and queries"),
-    ("payments", r"payment|razorpay|stripe|subscription", "payment integration"),
-    ("chat", r"chat|chatbot|\bbot\b|assistant|llm|rag", "chat ui and llm integration"),
-    ("upload", r"upload|file storage|s3|image upload", "file upload"),
-    ("scraper", r"scrap|crawl", "web scraper"),
-    ("cli", r"\bcli\b|command[- ]line|terminal tool", "command line interface"),
+    # whole words only (QA 2026-11-05: "rag" in "storage" gave a todo API a chat component; "orm" in "form",
+    # "rest" in "interest", "work" in "framework", "auth" in "author", "form" in "platform" did the same)
+    ("hero", r"\b(portfolio|landing|personal|resume|cv|about me|profile)s?\b", "hero section with name photo and intro"),
+    ("projects", r"\b(portfolio|projects?|work|case stud(y|ies))\b", "projects grid cards"),
+    ("navbar", r"\b(website|site|portfolio|landing|page|blog|shop|store|dashboard)s?\b", "responsive navbar"),
+    ("contact", r"\b(contact|portfolio|landing|email|form)s?\b", "contact form"),
+    ("dashboard", r"\b(dashboard|admin|analytics|chart)s?\b", "dashboard layout charts cards"),
+    ("blog", r"\b(blog|posts|articles)\b", "blog post list and markdown rendering"),
+    ("cart", r"\b(shop|store|cart|checkout|e-?commerce)\b", "shopping cart and checkout"),
+    ("auth", r"\b(login|signup|sign up|sign in|auth|authentication|authenticate|authorization|jwt|oauth|accounts?)\b",
+     "login signup jwt authentication"),
+    ("api", r"\b(api|apis|backend|server|crud|endpoints?|rest|restful|fastapi|flask|django|express)\b",
+     "rest api crud endpoints"),
+    ("database", r"\b(database|db|postgres|postgresql|sqlite|sqlite3|mongo|mongodb|prisma|orm|crud)\b",
+     "database models and queries"),
+    ("payments", r"\b(payments?|razorpay|stripe|subscriptions?)\b", "payment integration"),
+    ("chat", r"\b(chat|chatbot|bot|assistant|llm|rag)s?\b", "chat ui and llm integration"),
+    ("upload", r"\b(uploads?|uploading|file storage|s3|image upload)\b", "file upload"),
+    ("scraper", r"\b(scrap\w*|crawl\w*)\b", "web scraper"),
+    ("cli", r"\b(cli|command[- ]line|terminal tool)\b", "command line interface"),
 ]
 
 
@@ -186,6 +191,12 @@ def _indexed(tier: Any) -> bool:
         return False
 
 
+#: QA 2026-11-05: the engine marked an unrelated test file REUSE (0.92) for a word-count CLI; the model saw it was
+#: unrelated, wrote its own code, and still added a licence header and a THIRD_PARTY_NOTICES entry for it.
+UNRELATED_NOTE = (" If those files turn out to be unrelated to this component, write it yourself instead and add "
+                  "no licence header or notice for them.")
+
+
 def instructions(c: Dict[str, Any]) -> str:
     cand = c.get("candidate") or {}
     d = c.get("decision")
@@ -195,10 +206,10 @@ def instructions(c: Dict[str, Any]) -> str:
     if d == "REUSE":
         return (f"- {c['name']}: REUSE {repo} {', '.join(paths[:4])} - read them with {tool}, integrate with "
                 "minimal edits, keep the licence header; once its files are written, record it once with "
-                "add_third_party_notice.")
+                "add_third_party_notice." + UNRELATED_NOTE)
     if d == "ADAPT":
         return (f"- {c['name']}: ADAPT {repo} {', '.join(paths[:4])} - read with {tool}, then modify it to fit; keep "
-                "the attribution.")
+                "the attribution." + UNRELATED_NOTE)
     return f"- {c['name']}: GENERATE - write it yourself ({c.get('reason') or 'no suitable reusable code'})."
 
 

{euron_code-0.5.1 → euron_code-0.5.2}/src/euron_code/tools/oss.py

@@ -149,7 +149,7 @@ class OssRead(Tool):
 
 class AddThirdPartyNotice(Tool):
     name = "add_third_party_notice"
-    description = 'Record a reused source in THIRD_PARTY_NOTICES.md (once per repo).'
+    description = 'Record a source you copied or adapted code from in THIRD_PARTY_NOTICES.md (once per repo).'
     parameters = {
         "type": "object",
         "properties": {

{euron_code-0.5.1 → euron_code-0.5.2}/src/euron_code/ui.py

@@ -324,6 +324,16 @@ class QuietUI(UI):
     def __init__(self, verbose: bool = False):
         super().__init__(reasoning="hide", stderr=True)
         self.verbose = verbose
+        self.last_error: Optional[str] = None  # for the -p JSON result when the run cannot start
+        self.result_written = False
+
+    def error(self, msg: str) -> None:
+        self.last_error = msg
+        super().error(msg)
+
+    def exact(self, msg: str) -> None:
+        self.last_error = msg
+        super().exact(msg)
 
     def reasoning(self, text: str) -> None:
         pass
@@ -361,8 +371,11 @@ class QuietUI(UI):
             time.sleep(min(0.1, max(0.0, end - time.monotonic())))
 
     def ask_permission(self, title, detail, options) -> str:
-        self.console.print(Text(f"Denied (non-interactive, use --allowed-tools or --yolo): {title}",
-                                style="yellow"))
+        # even --yolo asks for paths outside the project and destructive commands: say so instead of
+        # suggesting --yolo to someone who already used it (QA 2026-11-05)
+        self.console.print(Text(f"Denied (non-interactive): {title} Edits and commands inside the project can be "
+                                "allowed with --allowed-tools or --yolo; paths outside the project and destructive "
+                                "commands need a yes in an interactive session.", style="yellow"))
         return "n"
 
 

{euron_code-0.5.1 → euron_code-0.5.2}/tests/mock_gateway.py

@@ -36,8 +36,13 @@ Error scenarios are chosen by a tag in the user's message, e.g. "[mock:rate]":
   erie        ERIE: find_reusable (slugify REUSE, money ADAPT, cli GENERATE), reads the pinned files, writes a small
               price-list app from them plus tests, records the notice, runs pytest, answers
   slowtool    runs `python -c "import time; time.sleep(N)"` (N from "[mock:slowtool N]"), then answers
+  todostop    writes a 2-item task list, then stops on "Scaffolding the project now..."; finishes when nudged
+  todostopalways  the same, but never finishes
   disabled    503 code_agent_disabled
   simple      a plain text answer, no tools
+  emptyonce   an empty answer (no text, no tools) until the CLI asks again, then two blank lines and "ok"
+  emptyalways an empty answer every time
+  hindi       a Hindi word and an emoji
   longtask    reads big.txt 400 lines at a time until the end (to force auto-compaction)
   (no tag)    the default edit script on calc.py / test_calc.py
 
@@ -316,6 +321,23 @@ def script_reply(scenario: str, messages: List[Dict[str, Any]], body: Optional[D
                                      "start": 1, "end": 5})]}
         return {"reasoning": "", "content": "Found Euron's hybrid_search; I will adapt it and keep the MIT notice.",
                 "tool_calls": []}
+    if scenario == "nonotice":  # QA 2026-11-05: adapted code with a header, but no THIRD_PARTY_NOTICES entry
+        if "THIRD_PARTY_NOTICES.md has no entry" in last_user and last is None:
+            return {"reasoning": "", "content": "", "tool_calls": [_tool_call(
+                "add_third_party_notice", {"source": "euron-sde-team/euron-rag-kit", "license": "MIT",
+                                           "files": "retrieve.py"})]}
+        if last is None:
+            return {"reasoning": "", "content": "", "tool_calls": [_tool_call(
+                "euron_reuse_read", {"repo": "euron-sde-team/euron-rag-kit", "path": "src/rag/retrieve.py",
+                                     "start": 1, "end": 5})]}
+        if last == "euron_reuse_read":
+            return {"reasoning": "", "content": "", "tool_calls": [_tool_call(
+                "write_file", {"path": "retrieve.py", "content": "# Adapted from euron-sde-team/euron-rag-kit (MIT)\n"
+                                                                 "def hybrid_search(q):\n    return [q]\n"})]}
+        if last == "write_file":
+            return {"reasoning": "", "content": "", "tool_calls": [_tool_call(
+                "bash", {"command": "python -c \"import retrieve\"", "description": "Check it imports"})]}
+        return {"reasoning": "", "content": "Adapted hybrid_search into retrieve.py.", "tool_calls": []}
     if scenario == "noverify":  # edits, then answers without running anything
         if last_user.startswith("You changed files but did not run anything"):
             return {"reasoning": "", "content": "I could not run tests here; I re-read the change and it is correct.",
@@ -341,10 +363,31 @@ def script_reply(scenario: str, messages: List[Dict[str, Any]], body: Optional[D
         if (body or {}).get("reasoning_effort") == "low":
             return {"reasoning": "short thought", "content": "Answer after less thinking.", "tool_calls": []}
         return {"reasoning": "thinking " * 200, "content": "", "tool_calls": [], "finish": "length"}
+    if scenario == "hindi":
+        return {"reasoning": "short thought", "content": "चार \U0001F3AF", "tool_calls": []}
+    if scenario in ("emptyonce", "emptyalways"):
+        # the live model sometimes ends a turn with no text at all (QA 2026-11-05)
+        nudged = any("Your last reply was empty" in str(m.get("content") or "") for m in messages
+                     if m.get("role") == "user")
+        if scenario == "emptyonce" and nudged:
+            return {"reasoning": "short thought", "content": "\n\nok", "tool_calls": []}
+        return {"reasoning": "short thought", "content": "", "tool_calls": []}
     if scenario == "simple" or scenario == "rate" or scenario == "busy" or scenario == "queue_full" \
             or scenario == "ctx" or scenario == "keepalive" or scenario == "queued" or scenario == "noimages":
         return {"reasoning": REASONING_TEXT, "content": "Hello from the MOCK gateway. Nothing to change.",
                 "tool_calls": []}
+    if scenario in ("todostop", "todostopalways"):  # QA 2026-11-05: plans, then stops on "doing it now..."
+        if last_user.startswith("You stopped, but your task list is not finished") and scenario == "todostop":
+            if last is None:
+                return {"reasoning": "", "content": "", "tool_calls": [_tool_call("todo_write", {"todos": [
+                    {"content": "scaffold the app", "status": "completed"},
+                    {"content": "write the hero", "status": "completed"}]})]}
+            return {"reasoning": "", "content": "Built the app.", "tool_calls": []}
+        if last is None and "task list is not finished" not in last_user:
+            return {"reasoning": "", "content": "", "tool_calls": [_tool_call("todo_write", {"todos": [
+                {"content": "scaffold the app", "status": "in_progress"},
+                {"content": "write the hero", "status": "pending"}]})]}
+        return {"reasoning": "", "content": "Scaffolding the project now...", "tool_calls": []}
     if scenario == "slowtool":
         if last is None:
             secs = re.findall(r"\[mock:slowtool (\d+(?:\.\d+)?)\]", " ".join(