fix: prevent agent tool protocol leakage

test/terminal-agent.test.mjs

@@ -88,3 +88,42 @@ test('proactive notifications observe cooldown', async () => {
   assert.equal(second.notify, false);
   assert.equal(second.suppressed, 'cooldown');
 });
+
+test('step exhaustion uses a final-only prompt and returns synthesized evidence', async () => {
+  const prompts = [];
+  let call = 0;
+  const provider = {
+    isConfigured: true,
+    async complete(system) {
+      prompts.push(system);
+      call++;
+      return call === 1
+        ? { text: JSON.stringify({ type: 'tool_call', tool: 'get_evidence', arguments: {}, rationale: 'Verify claim' }) }
+        : { text: JSON.stringify({ type: 'final', answer: 'The available evidence does not confirm the claim.', confidence: 'medium', evidence: ['evt-1'], notify: false, priority: 'routine' }) };
+    },
+  };
+  const agent = new TerminalAgent({
+    provider,
+    registry: new TerminalToolRegistry([{ name: 'get_evidence', handler: async () => [{ id: 'evt-1' }] }]),
+    maxSteps: 1,
+  });
+
+  const result = await agent.run('Is the claim confirmed?');
+  assert.equal(result.answer, 'The available evidence does not confirm the claim.');
+  assert.match(prompts[1], /Tool use is finished and unavailable/);
+  assert.doesNotMatch(prompts[1], /ALLOWLISTED TOOLS/);
+});
+
+test('repeated tool calls during finalization fail closed without leaking protocol JSON', async () => {
+  const provider = providerWith([{ type: 'tool_call', tool: 'get_evidence', arguments: {}, rationale: 'Keep searching' }]);
+  const agent = new TerminalAgent({
+    provider,
+    registry: new TerminalToolRegistry([{ name: 'get_evidence', handler: async () => [] }]),
+    maxSteps: 1,
+  });
+
+  const result = await agent.run('Wie sieht es mit dem Angriff aus?');
+  assert.match(result.answer, /nicht zuverlässig/);
+  assert.doesNotMatch(result.answer, /tool_call|get_evidence|rationale/i);
+  assert.equal(result.notify, false);
+});