@agent-native/core 0.122.4 → 0.123.0

package/dist/agent/production-agent.js

@@ -5,6 +5,7 @@ import { parseA2AAgentActivityPart } from "../a2a/activity.js";
 import { isAgentActionStopError, } from "../action.js";
 import { readAppState } from "../application-state/script-helpers.js";
 import { isReadOnlyShellCommand } from "../coding-tools/index.js";
+import { getDbExec } from "../db/client.js";
 import { extensionIdFromPathname } from "../extensions/path.js";
 import { preUploadAttachments } from "../file-upload/pre-upload-attachments.js";
 import { isMcpActionResult } from "../mcp-client/app-result.js";
@@ -19,6 +20,7 @@ import { getRequestRunContext, ensureRequestRunContext, getRequestContext, getRe
 import { fireInternalDispatch } from "../server/self-dispatch.js";
 import { isReasoningEffort, normalizeReasoningEffortForRequest, stepDownReasoningEffort, } from "../shared/reasoning-effort.js";
 import { actionPreparationContinuationNote } from "./action-continuation-guidance.js";
+import { drainAgentWarnings, formatAgentWarningsForToolResult, } from "./action-warnings.js";
 import { buildSystemManifestSections, readContextXraySystemSections, } from "./context-xray/manifest.js";
 import { AGENT_CHAT_BACKGROUND_RUN_FIELD, AGENT_CHAT_PROCESS_RUN_PATH, backgroundRuntimeDiagnosticDetail, dispatchPathTargetsNetlifyBackgroundFunction, isAgentChatDurableBackgroundEnabled, isAgentChatForegroundSelfChainEnabled, isInBackgroundFunctionRuntime, resolveAgentChatProcessRunDispatchPath, shouldUseBackgroundFunctionTimeoutForWorker, } from "./durable-background.js";
 import { applyContextXrayTransformForIteration } from "./engine/context-directives-transform.js";
@@ -30,13 +32,13 @@ import { PROVIDER_TO_ENV } from "./engine/provider-env-vars.js";
 import { loadPriorTurnToolCallJournal } from "./engine/tool-call-journal-seed.js";
 import { backfillEngineMessagesToolResults, stringifyToolUseInputForGateway, unmatchedToolResultReplayText, } from "./engine/translate-anthropic.js";
 import { EngineError } from "./engine/types.js";
-import { getDefaultMaxIterations, MAX_AGENT_MAX_ITERATIONS, MIN_AGENT_MAX_ITERATIONS, normalizeMaxIterations, readAgentLoopSettings, } from "./loop-settings.js";
+import { getDefaultMaxIterations, getDefaultMaxRunInputTokens, MAX_AGENT_MAX_ITERATIONS, MIN_AGENT_MAX_ITERATIONS, normalizeMaxIterations, normalizeMaxRunInputTokens, readAgentLoopSettings, } from "./loop-settings.js";
 import { maybeCompactThread, buildObservationalContext, hasObservationalMemory, serializeObservationalMemoryBlock, } from "./observational-memory/index.js";
 import { ProcessorChain, TripWire, toolCallsFromContent, } from "./processors.js";
-import { startRun, subscribeToRun, getActiveRunForThread, getActiveRunForThreadAsync, getRun, abortRun, abortRunDurably, tryClaimRunSlot, isHostedRuntime, resolveRunSoftTimeoutMs, } from "./run-manager.js";
-import { writeLedgerEntry, readLedgerEntry, clearLedgerForThread, insertRun, isTurnAborted, markRunAborted, updateRunHeartbeat, updateRunStatusIfRunning, setRunError, setRunTerminalReason, claimBackgroundRun, readBackgroundRunClaim, recordRunDiagnostic, countRunsForTurn, RUN_DIAG_STAGE, UNCLAIMED_BACKGROUND_RUN_GRACE_MS, } from "./run-store.js";
+import { startRun, subscribeToRun, getActiveRunForThread, getActiveRunForThreadAsync, getRun, abortRun, abortRunDurably, tryClaimRunSlot, isHostedRuntime, resolveRunSoftTimeoutMs, resolveRunToolTimeoutCeilingMs, } from "./run-manager.js";
+import { writeLedgerEntry, readLedgerEntry, clearLedgerForThread, insertRun, insertRunEvent, isTurnAborted, markRunAborted, updateRunHeartbeat, updateRunStatusIfRunning, setRunError, setRunTerminalReason, claimBackgroundRun, readBackgroundRunClaim, recordRunDiagnostic, countRunsForTurn, RUN_DIAG_STAGE, UNCLAIMED_BACKGROUND_RUN_GRACE_MS, } from "./run-store.js";
 import { buildCurrentTimeUserContext } from "./runtime-context.js";
-import { findCompletedJournalEntry } from "./tool-call-journal.js";
+import { findCompletedJournalEntry, } from "./tool-call-journal.js";
 import { redactSensitiveFields, sanitizeToolErrorText, sanitizeToolErrorValue, } from "./tool-error-redaction.js";
 import { describeToolResultImages, extractAgentImagesFromActionResult, } from "./tool-result-images.js";
 import { createToolSearchEntry, TOOL_SEARCH_ACTION_NAME, } from "./tool-search.js";
@@ -600,9 +602,11 @@ const MODEL_STREAM_NO_PROGRESS_TIMEOUT_MS = 90_000;
  * around 40s, so that watchdog could never actually fire: the run died as a
  * silent platform kill instead of a recoverable checkpoint (observed: ~40s of
  * "Contacting model" with zero tokens, then a hard timeout with no
- * auto_continue ever emitted). Once ANY event (including a heartbeat) has
- * been observed for this model call, subsequent gaps revert to the normal 90s
- * watchdog — this only guards the "nothing has happened yet" window.
+ * auto_continue ever emitted). Once a real model event has been observed for
+ * this model call, subsequent gaps revert to the normal 90s watchdog — this
+ * only guards the "nothing has happened yet" window. A `gateway-heartbeat`
+ * does NOT count as that first event (it proves the transport is up, not that
+ * the model started); it is excluded from stream progress for the same reason.
  *
  * ORDERING INVARIANT (each bound must stay strictly smaller than the next —
  * do not change one without re-checking the others). This cap exists ONLY
@@ -636,6 +640,16 @@ const MAX_RESOURCE_INVENTORY_ITEMS = 40;
 const MAX_RESOURCE_INVENTORY_DESCRIPTION_CHARS = 160;
 const MAX_INLINE_SKILL_REFERENCE_CHARS = 40_000;
 const SOURCE_SWEEP_TOOL_CALL_THRESHOLD = 12;
+/**
+ * Serialized-byte threshold at which a run reports how much tool schema
+ * `expandActiveTools` has loaded on top of its starting set. Expansion is
+ * monotonic — schemas added mid-turn are never released — and failing runs
+ * carry ~3.4x the event payload of clean ones, but that is a correlation, not
+ * a cause. Measure first; a cap or LRU eviction can only be sized safely once
+ * the real distribution is known (dropping a tool the model is about to call
+ * is worse than a large request).
+ */
+const EXPANDED_TOOL_SCHEMA_WARN_BYTES = 32_000;
 /**
  * Hard cap on the `<current-screen>` block injected into EVERY user message.
  *
@@ -812,6 +826,40 @@ export function trimOldToolResults(messages, keepTail = CONTEXT_TRIM_KEEP_TAIL)
     });
     return trimmed ? result : null;
 }
+/** Upper bound (jitter included) on what `retryDelay(attempt)` will sleep. */
+function maxRetryDelayMs(attempt) {
+    return RETRY_BASE_DELAY_MS * Math.pow(2, attempt) * 1.1;
+}
+/**
+ * Wall-clock left in this invocation's soft-timeout budget, measured from
+ * `startedAt`. `Infinity` off the hosted soft-timeout regime (local dev,
+ * self-hosted), where runs are genuinely unbounded. Uses the same ceiling
+ * `startRun` sizes the round to, so budget math here can't disagree with the
+ * soft timeout that actually aborts the run.
+ */
+export function remainingRunBudgetMs(startedAt) {
+    const ceilingMs = resolveRunSoftTimeoutMs(undefined, {
+        useHostedDefault: true,
+        backgroundFunction: isInBackgroundFunctionRuntime(),
+    });
+    if (ceilingMs <= 0)
+        return Number.POSITIVE_INFINITY;
+    return ceilingMs - (Date.now() - startedAt);
+}
+/**
+ * Whether one more engine retry — its backoff sleep, plus a minimal window for
+ * the resume layer above — still fits in the run budget. Count-based retries
+ * alone burn the entire hosted foreground budget on a deterministic failure
+ * (observed: every failing run spent all 3 retries, ~14s of it asleep, and
+ * left nothing for recovery).
+ */
+function hasBudgetForEngineRetry(startedAt, attempt) {
+    const remainingMs = remainingRunBudgetMs(startedAt);
+    if (remainingMs === Number.POSITIVE_INFINITY)
+        return true;
+    return (remainingMs - maxRetryDelayMs(attempt) >=
+        SELF_CHAIN_MIN_CONTINUATION_BUDGET_MS);
+}
 /** Wait with exponential backoff, respecting abort signal */
 function retryDelay(attempt, signal) {
     const baseMs = RETRY_BASE_DELAY_MS * Math.pow(2, attempt);
@@ -1563,8 +1611,55 @@ async function applyObservationalMemoryToContext(messages, opts) {
         return messages;
     }
 }
-function seedReadOnlyToolResultsFromHistory(messages, actions) {
+/**
+ * Cross-chunk read-only result cache seed.
+ *
+ * A chained continuation chunk rebuilds `messages` without the prior chunk's
+ * tool results, so `seedReadOnlyToolResultsFromHistory` sees nothing and every
+ * read-only tool (run-code, provider-api-request, tool-search, every research
+ * tool) re-executes from scratch. Their only cross-chunk protection was the
+ * prompt-level resume note, which truncates each result to 400 chars — a
+ * 50,000-char run-code result came back as 400 chars, leaving the model no
+ * option but to re-run it. Re-executed reads were the dominant term in
+ * production spend.
+ *
+ * The full `tool_done` result IS in the durable run ledger, so seed the same
+ * cache the in-run duplicate guard uses. The tool layer then serves the real
+ * result while the prompt note keeps its short summary.
+ *
+ * Staleness is bounded to the CURRENT TURN: the journal is built from
+ * `getCurrentTurnEventsForThread`, so nothing older than the user's current
+ * request can be replayed, and a successful write inside the turn clears the
+ * cache exactly as it does for in-chunk reads.
+ */
+function seedReadOnlyToolResultsFromJournal(journal, actions) {
     const cache = new Map();
+    if (!journal)
+        return cache;
+    for (const entry of journal.completed) {
+        const action = actions[entry.tool];
+        if (action?.readOnly !== true) {
+            // Mirror the live loop: a completed write invalidates every cached read.
+            cache.clear();
+            continue;
+        }
+        if (action.dedupe === false)
+            continue;
+        const result = entry.result ?? "";
+        if (!isReusableReadOnlyToolResult({
+            type: "tool-result",
+            toolCallId: "",
+            toolName: entry.tool,
+            content: result,
+        })) {
+            continue;
+        }
+        cache.set(toolCallCacheKey(entry.tool, entry.input), result);
+    }
+    return cache;
+}
+function seedReadOnlyToolResultsFromHistory(messages, actions, seed) {
+    const cache = new Map(seed);
     if (!isInternalContinuationTurn(messages))
         return cache;
     // Scoped to the current turn only (same slice as
@@ -1754,6 +1849,21 @@ export function isCachedToolResultVisibleInContext(contextMessages, toolCall, ca
 const INTERRUPTED_TOOL_RESULT_MARKER = "Interrupted before this tool returned a result.";
 const MAX_WRITE_TOOL_INTERRUPTIONS = 2;
 const MAX_IDENTICAL_TOOL_ERRORS = 3;
+/**
+ * Identical (tool, arguments) invocations tolerated in one turn before the turn
+ * is stopped, whether or not they errored.
+ *
+ * This is the guard that distinguishes a spiral from deep work. Volume ceilings
+ * cannot: prod contains a legitimate 117-tool-call analysis alongside turns that
+ * issued 39 identical `run-code` webFetches and 43 identical `docs-search`
+ * calls. Repetition is what separates them, so repetition is what we bound —
+ * leaving genuinely long analyses free to keep making NEW calls.
+ *
+ * Above `MAX_IDENTICAL_TOOL_ERRORS` (3) because a repeated SUCCESS is weaker
+ * evidence of a loop than a repeated failure: a few identical reads can be a
+ * legitimate re-check after a write.
+ */
+export const MAX_IDENTICAL_TOOL_CALLS = 8;
 function seedWriteToolInterruptionsFromHistory(messages, actions) {
     const interruptions = new Map();
     if (!isInternalContinuationTurn(messages))
@@ -1966,6 +2076,14 @@ const DEFAULT_INITIAL_TOOL_NAMES = new Set([
     "docs-search",
     "get-framework-context",
     "read-attachment",
+    // The `<available-apps>` prompt block names these two BY NAME on the same
+    // request, and "which app should I use for this?" is answered on turn one or
+    // not at all. Omitting them made the model read the instruction, find no
+    // schema, and answer from its own assumptions instead of spending a
+    // tool-search turn — so users were told a capability did not exist while a
+    // sibling app owned it.
+    "describe-workspace-apps",
+    "call-agent",
 ]);
 function isDefaultInitialToolName(name) {
     return DEFAULT_INITIAL_TOOL_NAMES.has(name);
@@ -2487,11 +2605,14 @@ function validateRawToolInput(entry, input) {
  */
 export async function runAgentLoop(opts) {
     const { engine, model, systemPrompt, tools, availableTools, messages, actions, send, signal, } = opts;
+    const budgetStartedAt = opts.budgetStartedAt ?? Date.now();
     const finalResponseGuardRequestText = opts.finalResponseGuardRequestText ??
         resolveFinalResponseGuardRequestText(messages);
     const availableToolMap = new Map((availableTools ?? tools).map((tool) => [tool.name, tool]));
     const activeToolNames = new Set(tools.map((tool) => tool.name));
     let activeTools = tools;
+    let expandedToolSchemaBytes = 0;
+    let reportedExpandedToolSchemaBytes = false;
     const expandActiveTools = (names) => {
         const added = [];
         for (const name of names) {
@@ -2501,11 +2622,17 @@ export async function runAgentLoop(opts) {
             if (!tool)
                 continue;
             activeToolNames.add(name);
+            expandedToolSchemaBytes += JSON.stringify(tool).length;
             added.push(name);
         }
         if (added.length > 0) {
             activeTools = (availableTools ?? tools).filter((tool) => activeToolNames.has(tool.name));
         }
+        if (!reportedExpandedToolSchemaBytes &&
+            expandedToolSchemaBytes > EXPANDED_TOOL_SCHEMA_WARN_BYTES) {
+            reportedExpandedToolSchemaBytes = true;
+            console.warn(`[agent-loop] expanded tool schemas reached ${expandedToolSchemaBytes} bytes across ${activeToolNames.size} active tools (runId=${opts.runId ?? "none"})`);
+        }
         return added;
     };
     expandActiveTools(extractToolSearchResultNamesFromMessages(messages));
@@ -2522,6 +2649,19 @@ export async function runAgentLoop(opts) {
         model,
     };
     const maxIterations = normalizeMaxIterations(opts.maxIterations, getDefaultMaxIterations());
+    const maxRunInputTokens = normalizeMaxRunInputTokens(opts.maxRunInputTokens, getDefaultMaxRunInputTokens());
+    const priorTurnInputTokens = typeof opts.priorTurnInputTokens === "number" &&
+        Number.isFinite(opts.priorTurnInputTokens)
+        ? Math.max(0, opts.priorTurnInputTokens)
+        : 0;
+    // A per-tool timeout above the chunk's own soft timeout can never fire — the
+    // chunk boundary always wins — so the 12-minute default is dead code on a
+    // ~40s hosted foreground chunk. Background-function runs resolve to a ~13min
+    // ceiling and keep the default unchanged.
+    const runToolTimeoutCeilingMs = resolveRunToolTimeoutCeilingMs(resolveRunSoftTimeoutMs(undefined, {
+        useHostedDefault: true,
+        backgroundFunction: isInBackgroundFunctionRuntime(),
+    }));
     const toolCallHistory = [];
     const sourceSweepToolCallHistory = seedSourceSweepToolCallsFromHistory(messages, actions);
     let sourceSweepDelegationGuardActive = hasExhaustedSourceSweepBudget({
@@ -2534,22 +2674,26 @@ export async function runAgentLoop(opts) {
         runCtx.toolCalls = toolCallHistory;
         runCtx.toolResults = toolResultHistory;
     }
-    const readOnlyToolResultCache = seedReadOnlyToolResultsFromHistory(messages, actions);
-    const duplicateReadOnlyToolCalls = seedDuplicateReadOnlyToolCallsFromHistory(messages, actions);
-    const writeToolInterruptions = seedWriteToolInterruptionsFromHistory(messages, actions);
-    const repeatedToolErrors = new Map();
     // Tool-call journal hard-block (resume safety). See
     // `loadPriorTurnToolCallJournal` for the full rationale — snapshotted ONCE
     // here, before any tool runs in this chunk, and its prior-chunk tool
     // calls/results are folded into `toolCallHistory` / `toolResultHistory` so
     // final response guards see evidence from earlier chunks of this turn.
     const consumedJournalKeys = new Set();
-    const { toolCallJournal, priorToolCalls: journaledPriorToolCalls, priorToolResults: journaledPriorToolResults, } = await loadPriorTurnToolCallJournal(opts.threadId);
+    const { toolCallJournal, priorToolCalls: journaledPriorToolCalls, priorToolResults: journaledPriorToolResults, } = await loadPriorTurnToolCallJournal(opts.threadId, opts.turnId);
     toolCallHistory.push(...journaledPriorToolCalls);
     toolResultHistory.push(...journaledPriorToolResults);
+    const readOnlyToolResultCache = seedReadOnlyToolResultsFromHistory(messages, actions, seedReadOnlyToolResultsFromJournal(toolCallJournal, actions));
+    const duplicateReadOnlyToolCalls = seedDuplicateReadOnlyToolCallsFromHistory(messages, actions);
+    const writeToolInterruptions = seedWriteToolInterruptionsFromHistory(messages, actions);
+    const repeatedToolErrors = new Map();
+    const repeatedToolCalls = new Map();
     let finalGuardRetries = 0;
     let emptyFinalResponseRetries = 0;
     let iterations = 0;
+    // `loop_limit` and `done` share one terminal-event slot in run-manager, so a
+    // trailing `done` would overwrite the boundary the continuation logic reads.
+    let endedAtLoopLimit = false;
     // Overridden (raised tokens, lowered effort) only after an empty-final-
     // response retry below — kept separate from `opts.maxOutputTokens`/
     // `opts.reasoningEffort` so the very first attempt is unaffected and later
@@ -2576,9 +2720,25 @@ export async function runAgentLoop(opts) {
     while (true) {
         if (signal.aborted)
             break;
+        const turnInputTokens = priorTurnInputTokens + usage.inputTokens;
+        if (turnInputTokens > maxRunInputTokens) {
+            // Terminal for the whole TURN, not a chunk boundary: emitting
+            // `loop_limit` here would hand off to a successor chunk that inherits the
+            // same exhausted total and immediately re-terminate, burning the run
+            // ledger 25 times over.
+            emitTripwire(new TripWire(`I stopped because this request consumed ${turnInputTokens.toLocaleString()} input tokens, past the ${maxRunInputTokens.toLocaleString()} budget for a single turn. ` +
+                `Anything already completed above is saved. Please retry as a smaller, more specific follow-up.`, { processor: "run-input-token-budget" }));
+            break;
+        }
+        // Terminal, NOT a nudge-and-reset: the run ends at `loop_limit` and the
+        // durable per-turn ledger (or the client's own continuation) decides
+        // whether the turn gets another chunk. Resetting the counter in-process
+        // made the budget unenforceable and meant this event was never emitted,
+        // even though run-manager, thread-data-builder and the client all handle it.
         if (++iterations > maxIterations) {
-            appendAgentLoopContinuation(messages, "loop_limit");
-            iterations = 1;
+            send({ type: "loop_limit", maxIterations });
+            endedAtLoopLimit = true;
+            break;
         }
         let assistantContent;
         let streamedAssistantText = "";
@@ -2639,10 +2799,10 @@ export async function runAgentLoop(opts) {
                 let zeroByteToolInputRestart;
                 let endedForNoProgress = false;
                 let lastModelStreamProgressAt = Date.now();
-                // FIX 2: true once ANY engine-stream event (including a heartbeat)
-                // has been retrieved for THIS model call — gates
-                // `FOREGROUND_FIRST_MODEL_EVENT_TIMEOUT_MS` below to only the first
-                // await on a fresh `engine.stream()` call, never subsequent gaps.
+                // FIX 2: true once a real (non-heartbeat) engine-stream event has been
+                // retrieved for THIS model call — gates
+                // `FOREGROUND_FIRST_MODEL_EVENT_TIMEOUT_MS` below to the window before
+                // the model has produced anything, never subsequent gaps.
                 let hasReceivedFirstEngineEvent = false;
                 // Resolved once per model-call attempt (not per event) so a single
                 // call's deadline math can't observe the runtime predicates changing
@@ -2818,17 +2978,17 @@ export async function runAgentLoop(opts) {
                             eventIteratorDone = true;
                             break;
                         }
-                        // FIX 2: only the deadline for THIS await could have been
-                        // tightened by FOREGROUND_FIRST_MODEL_EVENT_TIMEOUT_MS — every
-                        // subsequent call in this model call reverts to the normal 90s
-                        // watchdog regardless of what kind of event this turned out to be.
-                        hasReceivedFirstEngineEvent = true;
                         const event = nextEvent.value;
                         if (hasNoProgressStalled()) {
                             checkpointNoProgress();
                             break;
                         }
+                        // A gateway keepalive proves the transport is up, not that the
+                        // model started: it must not release the 25s first-model-event cap
+                        // any more than it counts as stream progress, or an endless
+                        // keepalive stream rides the unreachable 90s watchdog instead.
                         if (event.type !== "gateway-heartbeat") {
+                            hasReceivedFirstEngineEvent = true;
                             lastModelStreamProgressAt = Date.now();
                         }
                         // In-loop processor seam (stream hook). Each chunk is offered to every
@@ -2939,10 +3099,18 @@ export async function runAgentLoop(opts) {
                             assistantContent = event.parts;
                         }
                         else if (event.type === "usage") {
-                            usage.inputTokens += event.inputTokens;
-                            usage.outputTokens += event.outputTokens;
-                            usage.cacheReadTokens += event.cacheReadTokens ?? 0;
-                            usage.cacheWriteTokens += event.cacheWriteTokens ?? 0;
+                            const eventUsage = {
+                                inputTokens: event.inputTokens,
+                                outputTokens: event.outputTokens,
+                                cacheReadTokens: event.cacheReadTokens ?? 0,
+                                cacheWriteTokens: event.cacheWriteTokens ?? 0,
+                                model,
+                            };
+                            usage.inputTokens += eventUsage.inputTokens;
+                            usage.outputTokens += eventUsage.outputTokens;
+                            usage.cacheReadTokens += eventUsage.cacheReadTokens;
+                            usage.cacheWriteTokens += eventUsage.cacheWriteTokens;
+                            opts.onUsage?.(eventUsage);
                         }
                         else if (event.type === "stop") {
                             terminalStopReason = event.reason;
@@ -3003,7 +3171,9 @@ export async function runAgentLoop(opts) {
                     }
                     throw new EngineError("Conversation has grown too long. The agent tried to recover automatically but the context is still too large. You can continue in a new chat, or ask the agent to summarize the conversation and continue.", { errorCode: "context_length_exceeded" });
                 }
-                if (retry < maxRetriesForError(err) && isRetryableError(err)) {
+                if (retry < maxRetriesForError(err) &&
+                    isRetryableError(err) &&
+                    hasBudgetForEngineRetry(budgetStartedAt, retry)) {
                     // Clear partial text from the failed attempt so the retry
                     // doesn't produce garbled duplicate output. Keep the retry itself
                     // silent so transient provider/backend failures do not leak into
@@ -3211,12 +3381,28 @@ export async function runAgentLoop(opts) {
         emptyFinalResponseRetries = 0;
         flushUnstreamedAssistantText();
         let requestedActionStop = null;
+        const noteRepeatedToolCall = (toolName, input) => {
+            const key = toolCallCacheKey(toolName, input);
+            const count = (repeatedToolCalls.get(key) ?? 0) + 1;
+            repeatedToolCalls.set(key, count);
+            if (count < MAX_IDENTICAL_TOOL_CALLS)
+                return;
+            requestedActionStop ??= {
+                message: `Stopped because ${toolName} was called ${count} times with identical arguments in one turn, ` +
+                    `which means the same step is repeating rather than making progress. ` +
+                    `Everything completed before this point is preserved above.`,
+                errorCode: "repeated_tool_call",
+            };
+        };
         // Human-in-the-loop approvals granted by the user for this turn (opt-in;
         // empty for the overwhelming majority of turns). Keyed by the stable
         // tool-call approval key so a re-issued continuation can let an approved
         // call run. The model cannot populate this — it comes from the request.
         const approvedToolCallKeys = new Set(opts.approvedToolCalls ?? []);
         const runToolCall = async (toolCall) => {
+            // Counted before any journal/cache short-circuit: serving a repeat from
+            // cache still means the model is asking the same question again.
+            noteRepeatedToolCall(toolCall.name, toolCall.input);
             const actionEntry = actions[toolCall.name];
             const placeholderNormalization = actionEntry
                 ? normalizeOptionalToolPlaceholders(actionEntry.tool.parameters, toolCall.input)
@@ -3456,9 +3642,12 @@ export async function runAgentLoop(opts) {
             // run-manager still aborts foreground hosted runs around 40s, while
             // background runs get nearly the full 15-minute function budget.
             const DEFAULT_TOOL_TIMEOUT_MS = 12 * 60_000;
-            const toolTimeoutMs = actionEntry.timeoutMs ??
+            const requestedToolTimeoutMs = actionEntry.timeoutMs ??
                 opts.toolLimits?.timeoutMs ??
                 DEFAULT_TOOL_TIMEOUT_MS;
+            const toolTimeoutMs = runToolTimeoutCeilingMs > 0
+                ? Math.min(requestedToolTimeoutMs, runToolTimeoutCeilingMs)
+                : requestedToolTimeoutMs;
             const toolMaxResultChars = actionEntry.maxResultChars ??
                 opts.toolLimits?.maxResultChars ??
                 DEFAULT_TOOL_RESULT_CHARS;
@@ -3474,6 +3663,12 @@ export async function runAgentLoop(opts) {
             // calls with no completed journal entry are completely unaffected). The
             // snapshot was taken before this chunk's tools ran, so it can only match a
             // PRIOR completion, never one from the current chunk.
+            //
+            // Read-only tools take the OTHER half of this protection:
+            // `seedReadOnlyToolResultsFromJournal` puts their journaled results into
+            // `readOnlyToolResultCache`, so the duplicate-read guard below serves them
+            // as a cache hit (respecting `dedupe: false` and write invalidation)
+            // instead of re-executing.
             if (!actionEntry.readOnly && toolCallJournal) {
                 const journaled = findCompletedJournalEntry(toolCallJournal, toolCall.name, toolCall.input, consumedJournalKeys);
                 if (journaled) {
@@ -3905,6 +4100,14 @@ export async function runAgentLoop(opts) {
             if (isError) {
                 result = finalizeToolErrorResult(result);
             }
+            // Side-channel warnings raised anywhere inside the action's call stack
+            // (see `action-warnings.ts`). Drained here rather than in the success
+            // branch so an action that warns and then throws still surfaces it, and
+            // so nothing stays pending to bleed into a later tool's result.
+            const agentWarnings = drainAgentWarnings();
+            if (agentWarnings.length > 0) {
+                result = `${result}\n\n${formatAgentWarningsForToolResult(agentWarnings)}`;
+            }
             // Auto-refresh the UI after a successful mutating tool call. Any action
             // that isn't explicitly read-only is assumed to mutate. The client's
             // useDbSync listener sees a change event with source:"action" and
@@ -4037,7 +4240,7 @@ export async function runAgentLoop(opts) {
         }
         return usage;
     }
-    if (!signal.aborted) {
+    if (!signal.aborted && !endedAtLoopLimit) {
         // In-loop processor seam (result hook). Fires once at clean run end with the
         // final assistant text so processors (e.g. a proof-of-done gate) can record
         // a verdict. A result-hook abort cannot un-finish a completed run, so a
@@ -4263,6 +4466,7 @@ export async function runAgentLoopWithMainChatInternalContinuations(opts) {
         usage.cacheWriteTokens += next.cacheWriteTokens;
         usage.model = next.model;
     };
+    const budgetStartedAt = opts.budgetStartedAt ?? Date.now();
     const resumeResumableErrorsInProcess = opts.resumeResumableErrorsInProcess === true;
     const maxContinuations = typeof opts.maxContinuations === "number" && opts.maxContinuations > 0
         ? opts.maxContinuations
@@ -4285,19 +4489,26 @@ export async function runAgentLoopWithMainChatInternalContinuations(opts) {
         try {
             const nextUsage = await runAgentLoop({
                 ...opts,
+                budgetStartedAt,
                 send,
                 finalResponseGuardRequestText,
             });
             addUsage(nextUsage);
         }
         catch (err) {
-            // Preserve exact prior behavior unless explicitly opted in: an aborted
-            // signal (real soft-timeout / user stop) or a non-resumable error is
-            // always rethrown, and when `resumeResumableErrorsInProcess` is not
-            // set, EVERY thrown error is rethrown exactly as before.
-            if (!resumeResumableErrorsInProcess ||
-                opts.signal.aborted ||
-                !isResumableEngineError(err)) {
+            // An aborted signal (real soft-timeout / user stop) or a non-resumable
+            // error is always rethrown.
+            if (opts.signal.aborted || !isResumableEngineError(err))
+                throw err;
+            // A caller with a proven long budget (`resumeResumableErrorsInProcess`)
+            // always resumes here. Everyone else — notably the foreground chat turn,
+            // where a resumable transport error previously ALWAYS propagated and in
+            // practice was never resumed by any other layer — resumes too, but only
+            // while enough wall-clock remains to attempt it without being cut off
+            // mid-stream by the platform wall.
+            if (!resumeResumableErrorsInProcess &&
+                remainingRunBudgetMs(budgetStartedAt) <
+                    SELF_CHAIN_MIN_CONTINUATION_BUDGET_MS) {
                 throw err;
             }
             continuationReason = continuationReasonForResumableError(err);
@@ -4432,6 +4643,8 @@ export async function claimBackgroundWorkerRunEarly(opts) {
     const insert = opts.deps?.insertRun ?? insertRun;
     const claim = opts.deps?.claimBackgroundRun ?? claimBackgroundRun;
     const heartbeat = opts.deps?.updateRunHeartbeat ?? updateRunHeartbeat;
+    const turnAborted = opts.deps?.isTurnAborted ?? isTurnAborted;
+    const abortRun = opts.deps?.markRunAborted ?? markRunAborted;
     const threadId = typeof opts.threadId === "string" && opts.threadId.trim()
         ? opts.threadId.trim()
         : opts.runId;
@@ -4447,11 +4660,21 @@ export async function claimBackgroundWorkerRunEarly(opts) {
     ]
         .filter(Boolean)
         .join(" ")).catch(() => { });
+    // A failed durable abort read is fail-closed: never let a worker execute
+    // after cancellation just because the database was temporarily unreadable.
+    if (await turnAborted(threadId, turnId).catch(() => true)) {
+        await abortRun(opts.runId, "user").catch(() => { });
+        return { claimed: false, skipped: "turn-aborted" };
+    }
     if (opts.continuationCount > 0) {
         await insert(opts.runId, threadId, turnId, {
             dispatchMode: "background",
         }).catch(() => { });
     }
+    if (await turnAborted(threadId, turnId).catch(() => true)) {
+        await abortRun(opts.runId, "user").catch(() => { });
+        return { claimed: false, skipped: "turn-aborted" };
+    }
     const won = await claim(opts.runId);
     if (!won) {
         await record(opts.runId, RUN_DIAG_STAGE.workerClaimLost).catch(() => { });
@@ -4459,8 +4682,82 @@ export async function claimBackgroundWorkerRunEarly(opts) {
     }
     await record(opts.runId, RUN_DIAG_STAGE.workerClaimed).catch(() => { });
     await heartbeat(opts.runId).catch(() => { });
+    if (await turnAborted(threadId, turnId).catch(() => true)) {
+        await abortRun(opts.runId, "user").catch(() => { });
+        return { claimed: false, skipped: "turn-aborted" };
+    }
     return { claimed: true };
 }
+/**
+ * Wall-clock ceiling on a single logical turn. The run-count ledger alone is
+ * not a time bound: in durable mode each of the ~25 permitted chunks may burn
+ * ~780s, so the ledger's real worst case is over five hours (production has an
+ * observed 2h34m turn). Nobody is waiting that long, and every minute past
+ * this point is spend on a request the user has abandoned.
+ */
+export const MAX_TURN_WALL_CLOCK_MS = 90 * 60_000;
+/**
+ * Request-body field carrying the turn's running input-token total across
+ * chunks. It rides the BODY (not the background-run marker) because the marker
+ * is stripped from `continuationBody` on every handoff while the body is the
+ * successor's persisted rehydration payload.
+ */
+export const AGENT_CHAT_TURN_INPUT_TOKENS_FIELD = "__agentNativeTurnInputTokens";
+/**
+ * First `started_at` for a logical turn — the turn's true wall-clock origin
+ * (`agent_runs.started_at` is never bumped by heartbeats). Returns null when
+ * the turn has no rows or the read fails, in which case the deadline simply
+ * does not apply and the run-count ledger remains the only bound.
+ *
+ * Costs one extra round trip per chain. Folding `MIN(started_at)` into
+ * `countRunsForTurn`'s existing SELECT in run-store.ts would remove it.
+ */
+async function readTurnStartedAt(threadId, turnId) {
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT MIN(started_at) AS turn_started_at FROM agent_runs WHERE thread_id = ? AND turn_id = ?`,
+        args: [threadId, turnId],
+    });
+    const raw = rows?.[0]
+        ?.turn_started_at;
+    const startedAt = Number(raw);
+    return Number.isFinite(startedAt) && startedAt > 0 ? startedAt : null;
+}
+/**
+ * Append a user-visible assistant text event to a live run from outside the
+ * agent loop. The budget-exhaustion paths below terminate a turn that has
+ * already done real work; without this the user sees only a bare
+ * `turn_continuation_budget_exhausted` error string and every completed tool
+ * result looks discarded. Best-effort — a failed ledger write must not turn a
+ * budget stop into a thrown error.
+ */
+async function emitRunText(run, text) {
+    const runEvent = {
+        seq: run.events.length,
+        event: { type: "text", text },
+    };
+    run.events.push(runEvent);
+    for (const subscriber of run.subscribers) {
+        try {
+            subscriber(runEvent);
+        }
+        catch { }
+    }
+    await insertRunEvent(run.runId, runEvent.seq, JSON.stringify(runEvent.event)).catch(() => { });
+}
+/**
+ * One sentence naming what the turn actually finished, derived from the same
+ * per-turn journal the resume note uses (no new ledger read shape).
+ */
+async function describeTurnProgress(threadId, turnId) {
+    const { toolCallJournal } = await loadPriorTurnToolCallJournal(threadId, turnId);
+    const completed = toolCallJournal?.completed ?? [];
+    if (completed.length === 0)
+        return "No steps had completed yet.";
+    const names = [...new Set(completed.map((entry) => entry.tool))];
+    const shown = names.slice(0, 8).join(", ");
+    return (`${completed.length} step(s) completed before I stopped (${shown}` +
+        `${names.length > 8 ? ", …" : ""}). Their results are in the messages above.`);
+}
 /**
  * Sizes the dispatch retry budget by *remaining wall-clock capacity*, not by
  * dispatch TARGET — the two are independent concerns. `chainViaDurableBackground`
@@ -4632,11 +4929,15 @@ export const MAX_NESTED_SELF_DISPATCH_DEPTH = 6;
 export async function chainServerDrivenContinuation(opts) {
     const d = {
         countRunsForTurn: opts.deps?.countRunsForTurn ?? countRunsForTurn,
+        readTurnStartedAt: opts.deps?.readTurnStartedAt ?? readTurnStartedAt,
+        isTurnAborted: opts.deps?.isTurnAborted ?? isTurnAborted,
+        emitRunText: opts.deps?.emitRunText ?? emitRunText,
         insertRun: opts.deps?.insertRun ?? insertRun,
         fireInternalDispatch: opts.deps?.fireInternalDispatch ?? fireInternalDispatch,
         readBackgroundRunClaim: opts.deps?.readBackgroundRunClaim ?? readBackgroundRunClaim,
         updateRunHeartbeat: opts.deps?.updateRunHeartbeat ?? updateRunHeartbeat,
         updateRunStatusIfRunning: opts.deps?.updateRunStatusIfRunning ?? updateRunStatusIfRunning,
+        markRunAborted: opts.deps?.markRunAborted ?? markRunAborted,
         setRunTerminalReason: opts.deps?.setRunTerminalReason ?? setRunTerminalReason,
         recordRunDiagnostic: opts.deps?.recordRunDiagnostic ?? recordRunDiagnostic,
         markBackgroundContinuationChunkTerminal: opts.deps?.markBackgroundContinuationChunkTerminal ??
@@ -4656,17 +4957,35 @@ export async function chainServerDrivenContinuation(opts) {
     const turnRunCount = await d
         .countRunsForTurn(effectiveThreadId, effectiveTurnId)
         .catch(() => null);
-    if (turnRunCount !== null &&
-        turnRunCount > MAX_BACKGROUND_RUN_CONTINUATIONS + 5) {
-        console.error(`[agent-chat] turn ${effectiveTurnId} consumed ${turnRunCount} runs — refusing to chain further`, runId);
+    const stopTurn = async (terminalReason, logLine, userMessage) => {
+        console.error(`[agent-chat] ${logLine}`, runId);
+        const progress = await describeTurnProgress(effectiveThreadId, effectiveTurnId).catch(() => "");
+        await d
+            .emitRunText(run, progress ? `${userMessage}\n\n${progress}` : userMessage)
+            .catch(() => { });
         const statusUpdated = await d
             .updateRunStatusIfRunning(runId, "errored")
             .catch(() => false);
         if (statusUpdated) {
-            await d
-                .setRunTerminalReason(runId, "turn_continuation_budget_exhausted")
-                .catch(() => { });
+            await d.setRunTerminalReason(runId, terminalReason).catch(() => { });
         }
+    };
+    if (turnRunCount !== null &&
+        turnRunCount > MAX_BACKGROUND_RUN_CONTINUATIONS + 5) {
+        await stopTurn("turn_continuation_budget_exhausted", `turn ${effectiveTurnId} consumed ${turnRunCount} runs — refusing to chain further`, `I stopped after ${turnRunCount} internal continuations without finishing this request.`);
+        return;
+    }
+    // WALL-CLOCK CEILING. The run-count ledger above bounds chunks, not time: in
+    // durable mode 25 chunks x ~780s is over five hours, and prod has an observed
+    // 2h34m turn. Measured from the turn's FIRST run row, so it survives every
+    // recovery path exactly like the run count does.
+    const turnStartedAt = await d
+        .readTurnStartedAt(effectiveThreadId, effectiveTurnId)
+        .catch(() => null);
+    const turnElapsedMs = turnStartedAt === null ? 0 : Date.now() - turnStartedAt;
+    if (turnElapsedMs > MAX_TURN_WALL_CLOCK_MS) {
+        const elapsedMinutes = Math.round(turnElapsedMs / 60_000);
+        await stopTurn("turn_wall_clock_budget_exhausted", `turn ${effectiveTurnId} ran ${elapsedMinutes}min (limit ${Math.round(MAX_TURN_WALL_CLOCK_MS / 60_000)}min) — refusing to chain further`, `I stopped after ${elapsedMinutes} minutes without finishing this request.`);
         return;
     }
     // Mint the next chunk's runId here and sign the dispatch token over it, so
@@ -4698,9 +5017,18 @@ export async function chainServerDrivenContinuation(opts) {
     const continuationBody = {
         ...opts.requestBody,
         internalContinuation: true,
+        ...(typeof opts.turnInputTokens === "number"
+            ? { [AGENT_CHAT_TURN_INPUT_TOKENS_FIELD]: opts.turnInputTokens }
+            : {}),
     };
     delete continuationBody[AGENT_CHAT_BACKGROUND_RUN_FIELD];
     try {
+        if (await d
+            .isTurnAborted(effectiveThreadId, effectiveTurnId)
+            .catch(() => true)) {
+            await d.markRunAborted(runId, "user").catch(() => { });
+            return;
+        }
         await d
             .recordRunDiagnostic(runId, RUN_DIAG_STAGE.workerSetupStep, `chain_dispatch_start nextRunId=${nextRunId} reason=${continuationReason} path=${continuationDispatchPath}`)
             .catch(() => { });
@@ -4734,6 +5062,14 @@ export async function chainServerDrivenContinuation(opts) {
                 .catch(() => { });
             console.error("[agent-chat] continuation insertRun failed; dispatching with inline body:", insertErr instanceof Error ? insertErr.message : insertErr);
         }
+        if (await d
+            .isTurnAborted(effectiveThreadId, effectiveTurnId)
+            .catch(() => true)) {
+            if (nextRowInserted)
+                await d.markRunAborted(nextRunId, "user").catch(() => { });
+            await d.markRunAborted(runId, "user").catch(() => { });
+            return;
+        }
         const dispatchBody = nextRowInserted
             ? {
                 internalContinuation: true,
@@ -4827,8 +5163,13 @@ export async function chainServerDrivenContinuation(opts) {
                 console.error(`[agent-chat] background continuation dispatch deferred (${deferralClassification}); leaving the pre-inserted successor for the unclaimed-run sweep to redispatch:`, lastDispatchErr instanceof Error
                     ? lastDispatchErr.message
                     : lastDispatchErr);
+                // `completed`, not `errored`: this chunk's work IS durably persisted
+                // and a successor row exists for the sweep to redispatch. Only the
+                // handoff attempt failed, and the terminal reason already says so —
+                // recording the chunk as errored made a recoverable deferral look like
+                // a failed turn everywhere run status is read.
                 const statusUpdated = await d
-                    .updateRunStatusIfRunning(runId, "errored")
+                    .updateRunStatusIfRunning(runId, "completed")
                     .catch(() => false);
                 if (statusUpdated) {
                     await d
@@ -5514,6 +5855,8 @@ export function createProductionAgentHandler(options) {
             defaultMaxIterations: getDefaultMaxIterations(),
             minMaxIterations: MIN_AGENT_MAX_ITERATIONS,
             maxMaxIterations: MAX_AGENT_MAX_ITERATIONS,
+            maxRunInputTokens: getDefaultMaxRunInputTokens(),
+            defaultMaxRunInputTokens: getDefaultMaxRunInputTokens(),
             scope: "default",
             source: "default",
         };
@@ -5652,10 +5995,22 @@ export function createProductionAgentHandler(options) {
             : typeof requestTurnId === "string" && requestTurnId.trim()
                 ? requestTurnId.trim()
                 : runId;
+        if (isBackgroundWorker &&
+            (await isTurnAborted(effectiveThreadId, effectiveTurnId).catch(() => true))) {
+            await markRunAborted(runId, "user").catch(() => { });
+            return { ok: true, stopped: true };
+        }
         const messageToPersist = typeof requestDisplayMessage === "string" &&
             requestDisplayMessage.trim().length > 0
             ? requestDisplayMessage
             : requestMessage;
+        // Running per-turn input-token total. Seeded from the predecessor chunk's
+        // body, advanced by this chunk's own usage, and handed to the successor so
+        // the token ceiling bounds the TURN rather than resetting every chunk.
+        const priorTurnInputTokensFromBody = Number(body[AGENT_CHAT_TURN_INPUT_TOKENS_FIELD]);
+        let turnInputTokens = Number.isFinite(priorTurnInputTokensFromBody)
+            ? Math.max(0, priorTurnInputTokensFromBody)
+            : 0;
         // Server-driven background continuation: when the background worker re-fired
         // itself at a soft-timeout boundary (a chained continuation chunk), rebuild
         // the conversation from the persisted thread_data so the next chunk resumes
@@ -5761,6 +6116,16 @@ export function createProductionAgentHandler(options) {
                     // the Authorization Bearer HMAC is preserved either way.
                     path: backgroundDispatchPath,
                     taskId: runId,
+                    // A Netlify background function 202s on enqueue in well under a
+                    // second, so a 404/401/508 from it is an IMMEDIATE, knowable failure.
+                    // Fire-and-forget recorded those as `dispatched = true` and the user
+                    // waited out the claim grace for a worker that never existed. Only
+                    // for a real background-function target: a regular-function target
+                    // replies only after the successor chunk finishes, so awaiting it
+                    // would time out on every healthy dispatch.
+                    ...(expectsNetlifyBackgroundFunction
+                        ? { awaitResponse: true, responseTimeoutMs: 5_000 }
+                        : {}),
                     // When the row (and its persisted payload) landed, send only the
                     // marker — the worker rehydrates the body from dispatch_payload
                     // (`payloadRef`), keeping the self-POST far under Netlify's 256KB
@@ -6023,6 +6388,7 @@ export function createProductionAgentHandler(options) {
                         effectiveTurnId,
                         requestBody: body,
                         backgroundContinuationCount,
+                        turnInputTokens,
                         // Re-evaluate the durable gate rather than keying off
                         // isBackgroundWorker: a successor chunk of a FOREGROUND
                         // self-chain re-enters as a worker too, and must keep
@@ -6234,6 +6600,9 @@ export function createProductionAgentHandler(options) {
                                 cacheWriteTokens: subUsage.cacheWriteTokens,
                                 model: subUsage.model,
                                 label: `custom-agent:${ref.name}`,
+                                runId,
+                                threadId: effectiveThreadId,
+                                taskId: effectiveTurnId,
                             });
                         }
                         catch { }
@@ -6326,6 +6695,13 @@ export function createProductionAgentHandler(options) {
                 : typeof message === "string" && message.trim().length > 0
                     ? message
                     : undefined;
+            const turnUsage = {
+                inputTokens: 0,
+                outputTokens: 0,
+                cacheReadTokens: 0,
+                cacheWriteTokens: 0,
+                model: effectiveModel,
+            };
             const agentLoopOpts = {
                 engine,
                 model: effectiveModel,
@@ -6338,6 +6714,13 @@ export function createProductionAgentHandler(options) {
                 actions: requestActions,
                 send,
                 signal,
+                onUsage: (usage) => {
+                    turnUsage.inputTokens += usage.inputTokens;
+                    turnUsage.outputTokens += usage.outputTokens;
+                    turnUsage.cacheReadTokens += usage.cacheReadTokens;
+                    turnUsage.cacheWriteTokens += usage.cacheWriteTokens;
+                    turnUsage.model = usage.model;
+                },
                 ownerEmail,
                 orgId: getRequestOrgId() ?? null,
                 attachments: requestAttachments,
@@ -6350,6 +6733,8 @@ export function createProductionAgentHandler(options) {
                 providerOptions: options.providerOptions,
                 executionMode: requestMode,
                 maxIterations: loopSettings.maxIterations,
+                maxRunInputTokens: loopSettings.maxRunInputTokens,
+                priorTurnInputTokens: turnInputTokens,
                 finalResponseGuard: options.finalResponseGuard,
                 finalResponseGuardRequestText: messageToPersist,
                 ...(options.toolLimits ? { toolLimits: options.toolLimits } : {}),
@@ -6388,91 +6773,99 @@ export function createProductionAgentHandler(options) {
                     : {}),
             };
             send({ type: "activity", label: "Contacting model" });
-            // loopUsage is always assigned — either via instrumentAgentLoop or
-            // runAgentLoop before use below. The definite-assignment guard is
-            // conservative because the try/catch makes the control flow non-obvious.
-            let loopUsage = undefined;
             let instrumented = false;
             try {
-                const { getObservabilityConfig, instrumentAgentLoop } = await import("../observability/traces.js");
-                const obsConfig = await getObservabilityConfig();
-                if (obsConfig.enabled) {
-                    instrumented = true;
-                    loopUsage = await instrumentAgentLoop({
-                        runAgentLoop: runAgentLoopWithMainChatInternalContinuations,
-                        loopOpts: agentLoopOpts,
-                        runId,
-                        threadId: threadId ?? null,
-                        userId: ownerEmail,
-                        config: obsConfig,
-                        metadata: {
+                try {
+                    const { getObservabilityConfig, instrumentAgentLoop } = await import("../observability/traces.js");
+                    const obsConfig = await getObservabilityConfig();
+                    if (obsConfig.enabled) {
+                        instrumented = true;
+                        await instrumentAgentLoop({
+                            runAgentLoop: runAgentLoopWithMainChatInternalContinuations,
+                            loopOpts: agentLoopOpts,
+                            runId,
+                            threadId: threadId ?? null,
+                            userId: ownerEmail,
+                            config: obsConfig,
+                            metadata: {
+                                modelSelectionSource,
+                                ...(experimentAssignments.length > 0
+                                    ? { experimentAssignments }
+                                    : {}),
+                            },
+                            experimentAssignments,
                             modelSelectionSource,
-                            ...(experimentAssignments.length > 0
-                                ? { experimentAssignments }
-                                : {}),
-                        },
-                        experimentAssignments,
-                        modelSelectionSource,
-                        sentimentInput: shouldInferSentimentForTurn({
-                            internalContinuation: Boolean(internalContinuation),
-                            isBackgroundWorker,
-                            backgroundContinuationCount,
-                            hasUserText: Boolean(userVisibleSentimentInput),
-                        })
-                            ? userVisibleSentimentInput
-                            : undefined,
-                        classifyError: () => {
-                            if (agentLoopOpts.signal.aborted &&
-                                agentLoopOpts.signal.reason === "run_timeout") {
-                                return {
-                                    status: "success",
-                                    errorMessage: null,
-                                    metadata: {
-                                        terminalReason: "run_timeout",
-                                        recoverableContinuation: true,
-                                    },
-                                };
-                            }
-                            return null;
-                        },
-                    });
+                            sentimentInput: shouldInferSentimentForTurn({
+                                internalContinuation: Boolean(internalContinuation),
+                                isBackgroundWorker,
+                                backgroundContinuationCount,
+                                hasUserText: Boolean(userVisibleSentimentInput),
+                            })
+                                ? userVisibleSentimentInput
+                                : undefined,
+                            classifyError: () => {
+                                if (agentLoopOpts.signal.aborted &&
+                                    agentLoopOpts.signal.reason === "run_timeout") {
+                                    return {
+                                        status: "success",
+                                        errorMessage: null,
+                                        metadata: {
+                                            terminalReason: "run_timeout",
+                                            recoverableContinuation: true,
+                                        },
+                                    };
+                                }
+                                return null;
+                            },
+                        });
+                    }
                 }
-            }
-            catch (err) {
-                // If instrumentation setup failed, fall through to uninstrumented.
-                // If the agent loop itself failed (via instrumentAgentLoop), re-throw.
-                if (instrumented)
-                    throw err;
-            }
-            if (!instrumented) {
-                loopUsage =
+                catch (err) {
+                    // If instrumentation setup failed, fall through to uninstrumented.
+                    // If the agent loop itself failed, re-throw after the outer finally
+                    // records any usage events that arrived before the failure.
+                    if (instrumented)
+                        throw err;
+                }
+                if (!instrumented) {
                     await runAgentLoopWithMainChatInternalContinuations(agentLoopOpts);
-            }
-            // Record token usage for cost monitoring so the Usage panel in
-            // settings works in every mode, including local dev.
-            try {
-                const ownerEmail = options.resolveOwnerEmail
-                    ? await options.resolveOwnerEmail(event)
-                    : getRequestUserEmail();
-                if (ownerEmail &&
-                    (loopUsage.inputTokens > 0 ||
-                        loopUsage.outputTokens > 0 ||
-                        loopUsage.cacheReadTokens > 0 ||
-                        loopUsage.cacheWriteTokens > 0)) {
-                    const { recordUsage } = await import("../usage/store.js");
-                    await recordUsage({
-                        ownerEmail,
-                        inputTokens: loopUsage.inputTokens,
-                        outputTokens: loopUsage.outputTokens,
-                        cacheReadTokens: loopUsage.cacheReadTokens,
-                        cacheWriteTokens: loopUsage.cacheWriteTokens,
-                        model: loopUsage.model,
-                        label: body.usageLabel || "chat",
-                    });
                 }
             }
-            catch {
-                // Usage recording failed — don't break the run
+            finally {
+                // Advance and persist usage even when the provider aborts the loop
+                // before its promise resolves; the per-event accumulator is the only
+                // durable view of those partial model calls.
+                turnInputTokens += turnUsage.inputTokens;
+                try {
+                    const resolvedOwnerEmail = options.resolveOwnerEmail
+                        ? await options.resolveOwnerEmail(event)
+                        : getRequestUserEmail();
+                    if (resolvedOwnerEmail &&
+                        (turnUsage.inputTokens > 0 ||
+                            turnUsage.outputTokens > 0 ||
+                            turnUsage.cacheReadTokens > 0 ||
+                            turnUsage.cacheWriteTokens > 0)) {
+                        const { recordUsage } = await import("../usage/store.js");
+                        await recordUsage({
+                            ownerEmail: resolvedOwnerEmail,
+                            inputTokens: turnUsage.inputTokens,
+                            outputTokens: turnUsage.outputTokens,
+                            cacheReadTokens: turnUsage.cacheReadTokens,
+                            cacheWriteTokens: turnUsage.cacheWriteTokens,
+                            model: turnUsage.model,
+                            label: body.usageLabel || "chat",
+                            // token_usage has had run_id/thread_id/task_id since it was
+                            // created and every row was NULL on all three, so no spend could
+                            // be tied back to a run, thread, or outcome.
+                            runId,
+                            threadId: effectiveThreadId,
+                            taskId: effectiveTurnId,
+                        });
+                    }
+                }
+                catch {
+                    // Usage recording failed — don't break the run
+                }
             }
         }, handleRunComplete, {
             // A synchronous self-chain chunk with enough remaining budget gets