Add Opus 4.7 adaptive thinking, harden permission checks, fix TUI exit and confirmation scroll

Author: alexylon

CHANGELOG.md

@@ -4,14 +4,33 @@ All notable changes to Sofos are documented in this file.
 
 ## [Unreleased]
 
-### Changed
+### Added
 
-- **`read_file` output cap raised to ~256 KB** (64k tokens). Previously `read_file` shared the ~64 KB / 16k-token cap with `execute_bash` and `search_code`, which clipped mid-sized source files — generated code, JSON fixtures, long prompt templates — and forced the model into an extra range-reads round trip against the 200-iteration tool-loop budget. `execute_bash` stdout/stderr and `search_code` keep the 16k-token cap, since verbose test output and broad ripgrep patterns benefit from being forced to narrow rather than handing the model noise.
+- **Claude Opus 4.7 adaptive-thinking support.** Opus 4.7 rejects the legacy `{thinking: {type: "enabled", budget_tokens: N}}` request shape with HTTP 400; sofos now detects Opus 4.7 models and sends `{thinking: {type: "adaptive"}, output_config: {effort}}` instead. The `--thinking-budget` token count is meaningless for adaptive models (the server picks its own budget), so `/think on` maps to `effort: high` and `/think off` maps to `effort: low`. Adaptive is sent on every request — including when thinking is toggled off — so echoed thinking blocks from earlier turns still round-trip cleanly. Startup banner, TUI status line, and `/think` handlers all label the state as `Adaptive thinking effort: high|low` rather than showing a fake token count.
+- **Confirmation modal now fits on short terminals.** The 4-choice permission prompt (`Yes` / `Yes and remember` / `No` / `No and remember`) needs ~10 rows of chrome, which used to get clipped to just "Yes" on small inline viewports. The modal grows the viewport to fit when it can; when it can't, it drops the separators and hint row, and finally scrolls the choice list around the cursor with `▴` / `▾` cues on the nearest non-cursor row so the "I'm at the top/bottom of the list" signal doesn't fight the cursor glyph.
+- **Visible feedback on `/s` and `/n`** (safe-mode toggles). Previously silent on state changes and a total no-op when the mode was already active; now prints a one-line status (`Safe mode: enabled / read-only tools only; no writes or bash`, `Safe mode: disabled / all tools available`, or a dimmed `already enabled/disabled`).
+
+### Security
+
+- **`FOO=bar rm -rf /` no longer bypassed the forbidden-command check.** `extract_base_command` took the first whitespace-delimited token, which for a command starting with `KEY=value` env assignments was the assignment itself — meaning the real base command (`rm`) was never looked up against allow/deny lists. Leading POSIX-shaped env assignments are now skipped before the base-command lookup. Regression test added (`env_prefix_does_not_bypass_forbidden_base`).
+- **Forbidden-git detection now covers shell substitution boundaries.** `command_contains_op` only recognised `` ` ` ``, `;`, `&&`, `||`, `|` as command boundaries, so `` echo hi; `git push` ``, `echo $(git push)`, `(git push)`, and `{ git push; }` all slipped past the guarded-git list. Extended to cover backtick substitution, `$(…)` command substitution, `(…)` subshells, and `{…;}` groups. Regression test added (`command_contains_op_catches_shell_boundaries`).
+- **Clipboard paste is now bounded at 20 MB.** Matches the Anthropic Messages API ceiling on base64-encoded image bodies; an oversized screenshot is dropped (with a `tracing::warn!`) before it enters the conversation state, so a huge paste can't blow the session up with a confusing HTTP 400.
 
 ### Fixed
 
+- **"Goodbye!" no longer prints on the same line as the status row on exit.** The TUI left the cursor parked at the end of the status line; when the session summary short-circuited on zero usage, `print_goodbye` then printed `Goodbye!` flush against `… thinking: 5120 tok`. The teardown now emits an escape-newline on the no-summary path so the message always starts fresh.
+- **Safe-mode tool list now matches reality.** `SAFE_MODE_MESSAGE` told the model it had `list_directory, read_file and web_search`, but `get_read_only_tools()` actually exposes `list_directory, read_file, glob_files, web_fetch, web_search` (+ `search_code` when ripgrep is present). The model was being given a false toolset description on safe-mode entry.
+- **Corrupted session file on save no longer wipes the in-memory conversation.** `save_session` re-read the prior file to preserve `created_at`; if the file was unparseable (hand-edited, partial prior write, schema drift) the JSON error bubbled up and the current turn's messages were dropped on the floor. The stamp now falls back to `now` on any read/parse failure — losing a date is cheaper than losing the session. Regression test added (`save_session_survives_corrupted_prior_file`).
+- **Empty-signature thinking blocks no longer round-trip.** If a streamed thinking block ended without ever receiving a `signature_delta`, sofos pushed a `ContentBlock::Thinking { thinking: "", signature: "" }` into history — which the server would reject on the next turn with a signature-verification 400. The block is now dropped when the signature is empty; legitimate empty-thinking adaptive blocks (Opus 4.7 `display: "omitted"`, which still emit a real signature) continue to round-trip.
+- **`on_thinking_delta` no longer prints a bare `Thinking:` label** when the first delta is an empty string.
 - Prompt glyph (> or :) now correctly reflects the normal/safe modes.
 
+### Changed
+
+- **"User declined" prompt phrasing** now nudges the model to pivot rather than retry. The old `Command blocked by user: 'X'` read like a hard policy block and invited the model to reissue the same command. Replaced with `User declined 'X'. Propose a different approach or ask the user to clarify rather than retrying the same command.` at all three rejection sites.
+- **`/think` command wording aligned.** The startup banner used `Extended thinking: enabled`; `/think on` printed `Extended thinking enabled.`; `/think off` printed `Extended thinking disabled.`. Consolidated on `Extended thinking: enabled` / `Extended thinking: disabled` everywhere.
+- **`read_file` output cap raised to ~256 KB** (64k tokens). Previously `read_file` shared the ~64 KB / 16k-token cap with `execute_bash` and `search_code`, which clipped mid-sized source files — generated code, JSON fixtures, long prompt templates — and forced the model into an extra range-reads round trip against the 200-iteration tool-loop budget. `execute_bash` stdout/stderr and `search_code` keep the 16k-token cap, since verbose test output and broad ripgrep patterns benefit from being forced to narrow rather than handing the model noise.
+
 ## [0.2.2] - 2026-04-21
 
 ### Security

CLAUDE.md

@@ -0,0 +1 @@
+Use AGENTS.md as the single source of truth for all instructions.

README.md

@@ -176,14 +176,15 @@ Exit summary shows token usage and estimated cost (based on official API pricing
 Enable for complex reasoning tasks (disabled by default):
 
 ```bash
-sofos -t                                             # Default 5120 token budget (Claude only)
-sofos -t --thinking-budget 10000 --max-tokens 16000  # Custom budget (Claude only)
+sofos -t                                             # Default 5120 token budget (Claude 4.5 / 4.6)
+sofos -t --thinking-budget 10000 --max-tokens 16000  # Custom budget (Claude 4.5 / 4.6)
 ```
 
-**Note:** Extended thinking works with both Claude and OpenAI models. 
-For Claude, it enables the thinking protocol and `--thinking-budget` controls token allocation. 
-For OpenAI (gpt-5 models), `/think on` sets high reasoning effort and `/think off` sets low reasoning effort. 
-The `--thinking-budget` parameter only applies to Claude models.
+**Note:** Extended thinking works with both Claude and OpenAI models.
+
+- **Claude 4.5 / 4.6** uses a manual token budget controlled by `--thinking-budget` (default `5120`).
+- **Claude Opus 4.7** uses adaptive thinking — the server picks the budget based on the prompt, and sofos sends `effort: high` when thinking is on and `effort: low` when off. `--thinking-budget` is ignored for this model; the status line shows `effort: high|low` instead of a token count.
+- **OpenAI (gpt-5 models)** — `/think on` sets high reasoning effort and `/think off` sets low. `--thinking-budget` is ignored.
 
 ## Custom Instructions
 

src/api/anthropic.rs

@@ -10,6 +10,27 @@ const API_BASE: &str = "https://api.anthropic.com/v1";
 const API_VERSION: &str = "2023-06-01";
 const ANTHROPIC_BETA: &str = "token-efficient-tools-2025-02-19";
 
+/// Return true for models that *only* accept `thinking.type = "adaptive"`
+/// (paired with `output_config.effort`) and reject the legacy
+/// `{type: "enabled", budget_tokens: N}` shape with HTTP 400.
+///
+/// Currently Opus 4.7 is the sole member of this set; Sonnet/Opus 4.6 and
+/// older continue to accept manual budgets, so we keep them on the old path
+/// to preserve the user's `--thinking-budget` knob.
+pub fn requires_adaptive_thinking(model: &str) -> bool {
+    model.starts_with("claude-opus-4-7")
+}
+
+/// The string form of an "effort" level derived from the user's
+/// thinking-on/off toggle. Used both for Anthropic's `output_config.effort`
+/// (adaptive models) and OpenAI's `reasoning.effort` — the two APIs
+/// happen to share the same `high` / `low` vocabulary, so one helper
+/// keeps the request builder, TUI status line, startup banner, and
+/// `/think` messages in sync without each site hand-mapping the bool.
+pub fn effort_label(enable_thinking: bool) -> &'static str {
+    if enable_thinking { "high" } else { "low" }
+}
+
 #[derive(Clone)]
 pub struct AnthropicClient {
     client: reqwest::Client,
@@ -263,10 +284,20 @@ impl AnthropicClient {
                                 });
                             }
                             Some("thinking") => {
-                                content_blocks.push(ContentBlock::Thinking {
-                                    thinking: current_thinking.clone(),
-                                    signature: current_signature.clone(),
-                                });
+                                // Every legitimate thinking block the server emits
+                                // is paired with a signature. An empty signature
+                                // means no `signature_delta` ever arrived for this
+                                // block — echoing it back on the next turn would
+                                // fail server-side verification and 400 the whole
+                                // request. Drop the block; an empty-thinking
+                                // adaptive block *with* a real signature (Opus 4.7
+                                // `display: "omitted"`) is still preserved.
+                                if !current_signature.is_empty() {
+                                    content_blocks.push(ContentBlock::Thinking {
+                                        thinking: current_thinking.clone(),
+                                        signature: current_signature.clone(),
+                                    });
+                                }
                             }
                             Some("tool_use") => {
                                 let input = utils::parse_tool_arguments(
@@ -373,13 +404,58 @@ mod tests {
     fn test_thinking_serialization() {
         let thinking = Thinking::enabled(5120);
         assert_eq!(thinking.thinking_type, "enabled");
-        assert_eq!(thinking.budget_tokens, 5120);
+        assert_eq!(thinking.budget_tokens, Some(5120));
 
         let json = serde_json::to_value(&thinking).unwrap();
         assert_eq!(json["type"], "enabled");
         assert_eq!(json["budget_tokens"], 5120);
     }
 
+    #[test]
+    fn test_adaptive_thinking_serialization() {
+        let thinking = Thinking::adaptive();
+        let json = serde_json::to_value(&thinking).unwrap();
+        assert_eq!(json["type"], "adaptive");
+        // `budget_tokens` must be omitted for adaptive — Opus 4.7 rejects it.
+        assert!(json.get("budget_tokens").is_none());
+    }
+
+    #[test]
+    fn requires_adaptive_thinking_matches_opus_4_7_only() {
+        assert!(requires_adaptive_thinking("claude-opus-4-7"));
+        assert!(requires_adaptive_thinking("claude-opus-4-7-20260301"));
+        assert!(!requires_adaptive_thinking("claude-opus-4-6"));
+        assert!(!requires_adaptive_thinking("claude-sonnet-4-6"));
+        assert!(!requires_adaptive_thinking("claude-opus-4-5"));
+        assert!(!requires_adaptive_thinking(""));
+    }
+
+    #[test]
+    fn effort_label_maps_bool_to_high_low() {
+        assert_eq!(effort_label(true), "high");
+        assert_eq!(effort_label(false), "low");
+    }
+
+    #[test]
+    fn adaptive_request_sends_output_config_and_omits_budget() {
+        let request = CreateMessageRequest {
+            model: "claude-opus-4-7".to_string(),
+            max_tokens: 8192,
+            messages: vec![],
+            system: None,
+            tools: None,
+            stream: None,
+            thinking: Some(Thinking::adaptive()),
+            output_config: Some(OutputConfig::with_effort("high")),
+            reasoning: None,
+        };
+
+        let json = serde_json::to_value(&request).unwrap();
+        assert_eq!(json["thinking"]["type"], "adaptive");
+        assert!(json["thinking"].get("budget_tokens").is_none());
+        assert_eq!(json["output_config"]["effort"], "high");
+    }
+
     #[test]
     fn test_request_with_thinking() {
         let thinking = Some(Thinking::enabled(3000));
@@ -391,6 +467,7 @@ mod tests {
             tools: None,
             stream: None,
             thinking,
+            output_config: None,
             reasoning: None,
         };
 

src/api/types.rs

@@ -65,6 +65,8 @@ pub struct CreateMessageRequest {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub thinking: Option<Thinking>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_config: Option<OutputConfig>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub reasoning: Option<Reasoning>,
 }
 
@@ -145,14 +147,40 @@ pub enum ContentBlock {
 pub struct Thinking {
     #[serde(rename = "type")]
     pub thinking_type: String,
-    pub budget_tokens: u32,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub budget_tokens: Option<u32>,
 }
 
 impl Thinking {
     pub fn enabled(budget_tokens: u32) -> Self {
         Self {
             thinking_type: "enabled".to_string(),
-            budget_tokens,
+            budget_tokens: Some(budget_tokens),
+        }
+    }
+
+    /// Opus 4.7+ uses adaptive thinking: the server picks the budget based
+    /// on the prompt, and the caller expresses intent via
+    /// [`OutputConfig::effort`] on the request instead of a token count.
+    pub fn adaptive() -> Self {
+        Self {
+            thinking_type: "adaptive".to_string(),
+            budget_tokens: None,
+        }
+    }
+}
+
+/// Top-level `output_config` block on the Messages API. Currently used to
+/// set the `effort` level that pairs with adaptive thinking on Opus 4.7+.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OutputConfig {
+    pub effort: String,
+}
+
+impl OutputConfig {
+    pub fn with_effort(effort: impl Into<String>) -> Self {
+        Self {
+            effort: effort.into(),
         }
     }
 }

src/clipboard.rs

@@ -43,6 +43,14 @@ pub fn strip_paste_markers(input: &str) -> (String, Vec<usize>) {
     (cleaned.trim().to_string(), indices)
 }
 
+/// Ceiling on pasted clipboard images. Matches the 20 MB cap Anthropic
+/// imposes on base64-encoded image bodies in the Messages API — a
+/// larger screenshot would just get rejected at request time with a
+/// confusing 400. Checked on both the raw PNG buffer (encoder output)
+/// and the encoded base64 so a huge image never makes it into the
+/// conversation state.
+const MAX_CLIPBOARD_IMAGE_BYTES: usize = 20 * 1024 * 1024;
+
 pub fn get_clipboard_image() -> Option<PastedImage> {
     let mut clipboard = arboard::Clipboard::new().ok()?;
     let image = clipboard.get_image().ok()?;
@@ -60,8 +68,27 @@ pub fn get_clipboard_image() -> Option<PastedImage> {
         writer.write_image_data(&image.bytes).ok()?;
     }
 
+    if buf.len() > MAX_CLIPBOARD_IMAGE_BYTES {
+        tracing::warn!(
+            bytes = buf.len(),
+            limit = MAX_CLIPBOARD_IMAGE_BYTES,
+            "dropping oversized clipboard image"
+        );
+        return None;
+    }
+
+    let base64_data = STANDARD.encode(&buf);
+    if base64_data.len() > MAX_CLIPBOARD_IMAGE_BYTES {
+        tracing::warn!(
+            bytes = base64_data.len(),
+            limit = MAX_CLIPBOARD_IMAGE_BYTES,
+            "dropping clipboard image whose base64 form exceeds the API limit"
+        );
+        return None;
+    }
+
     Some(PastedImage {
         media_type: "image/png".to_string(),
-        base64_data: STANDARD.encode(&buf),
+        base64_data,
     })
 }

src/config.rs

@@ -62,10 +62,13 @@ impl SofosConfig {
     // No need for new() since Default::default() is the idiomatic way
 }
 
-/// Safe mode message shown to user and AI
+/// Safe mode message shown to user and AI. Must stay in sync with the
+/// tool set returned by `tools::get_read_only_tools()` (+ the optional
+/// `search_code` tool wired in when ripgrep is on PATH).
 pub const SAFE_MODE_MESSAGE: &str = "[SYSTEM: Safe (read-only) mode has been enabled. \
-                                     No file modifications or bash commands are allowed.\
-                                     Available tools: list_directory, read_file and web_search.]";
+                                     No file modifications or bash commands are allowed. \
+                                     Available tools: list_directory, read_file, glob_files, \
+                                     search_code (when ripgrep is installed), web_fetch, web_search.]";
 
 /// Normal mode message shown when switching from safe mode
 pub const NORMAL_MODE_MESSAGE: &str = "[SYSTEM: Normal (unrestricted) mode has been enabled. \

src/main.rs

@@ -101,11 +101,18 @@ fn main() -> Result<()> {
     startup_banner.push_str(&format!("{} {}\n", "Model:".bright_green(), cli.model));
 
     if matches!(client, LlmClient::OpenAI(_)) {
-        let effort = if cli.enable_thinking { "high" } else { "low" };
         startup_banner.push_str(&format!(
             "{} {}\n",
             "Reasoning effort:".bright_green(),
-            effort
+            crate::api::anthropic::effort_label(cli.enable_thinking)
+        ));
+    } else if crate::api::anthropic::requires_adaptive_thinking(&cli.model) {
+        // Opus 4.7 picks its own budget; advertising a token count would be
+        // a lie. Surface the `output_config.effort` we actually send.
+        startup_banner.push_str(&format!(
+            "{} {}\n",
+            "Adaptive thinking effort:".bright_green(),
+            crate::api::anthropic::effort_label(cli.enable_thinking)
         ));
     } else if cli.enable_thinking {
         startup_banner.push_str(&format!(