@alexkroman1/aai-cli 7.0.0 → 8.0.0

package/dist/templates/travel-concierge/agent.test.ts

@@ -28,6 +28,7 @@ import {
   activeAssistant,
   FLIGHTS,
   gateFlow,
+  type SpecialistId,
   tripProjection,
   tripSlot,
   tripView,
@@ -50,6 +51,20 @@ function stateOf(ctx: ToolContext) {
   return tripSlot.get(ctx);
 }
 
+/**
+ * Put the call at a desk the way the model has to: through that desk's own
+ * delegation tool.
+ *
+ * Every desk tool checks the stack first (`requireDesk`) and refuses from
+ * anywhere else, so a spec driving one has to stand where the model would. It is
+ * one line per test rather than a shared `beforeEach` deliberately — which desk
+ * a tool belongs to is what the block below is about, so it stays visible at the
+ * call site.
+ */
+const atDesk = async (id: SpecialistId, ctx: ToolContext): Promise<void> => {
+  await run(`to_${id}_assistant`, { request: "what the caller asked for" }, ctx);
+};
+
 // ─── 1. The dialog stack ─────────────────────────────────────────────────────
 
 describe("dialog stack (routing.ts)", () => {
@@ -98,6 +113,72 @@ describe("dialog stack (routing.ts)", () => {
   });
 });
 
+// ─── 1b. The desk gate ───────────────────────────────────────────────────────
+//
+// What their graph gets from binding a tool set per node, and what this port
+// used to only ask the prompt for. The eval (`agent.eval.test.ts`) is what
+// measured the asking losing — 0 of 5 live runs, the model searching hotels
+// while the stack said `primary` — so these are the tests that make the stack
+// binding rather than descriptive.
+
+describe("the desk gate (requireDesk)", () => {
+  const DESK_TOOLS = [
+    ["search_flights", { route: "Boston" }, "flight"],
+    ["update_ticket", { flightId: "LX52" }, "flight"],
+    ["cancel_ticket", {}, "flight"],
+    ["search_hotels", { city: "Boston" }, "hotel"],
+    ["book_hotel", { hotelId: "H1", nights: 2 }, "hotel"],
+    ["search_car_rentals", { city: "Boston" }, "car_rental"],
+    ["book_car_rental", { carId: "C2", days: 3 }, "car_rental"],
+    ["search_excursions", { city: "Boston" }, "excursion"],
+    ["book_excursion", { excursionId: "E2" }, "excursion"],
+  ] as const;
+
+  test.each(DESK_TOOLS)("%s refuses at the concierge desk", async (name, args, desk) => {
+    const ctx = makeCtx();
+    const refused = (await run(name, args, ctx)) as { error?: string };
+    // The refusal NAMES the way in, which is what the model recovers from
+    // inside the same turn — a bare "not allowed" would leave it guessing.
+    expect(refused.error).toContain(`to_${desk}_assistant`);
+    // And nothing happened: no search result, no staging, no stack movement.
+    expect(stateOf(ctx).pending).toBeNull();
+    expect(activeAssistant(stateOf(ctx))).toBe("primary");
+    expect(gateFlow.position(ctx).state).toBe("browsing");
+  });
+
+  test.each(DESK_TOOLS)("%s refuses from ANOTHER desk", async (name, args, desk) => {
+    const ctx = makeCtx();
+    // The excursions desk for anything that is not its own, and the flight desk
+    // for the excursion tools — so every case really is a wrong desk rather
+    // than a coincidence of ordering.
+    const wrong = desk === "excursion" ? "flight" : "excursion";
+    await atDesk(wrong, ctx);
+    const refused = (await run(name, args, ctx)) as { error?: string };
+    expect(refused.error).toContain(`to_${desk}_assistant`);
+    expect(refused.error).toContain(desk === "excursion" ? "flight desk" : "excursions desk");
+    expect(stateOf(ctx).pending).toBeNull();
+  });
+
+  test.each(DESK_TOOLS)("%s works once its own desk holds the call", async (name, args, desk) => {
+    // The other half, and the one that makes the block above non-vacuous: a
+    // gate that refused everywhere would pass every assertion up to here.
+    const ctx = makeCtx();
+    await atDesk(desk, ctx);
+    expect(await run(name, args, ctx)).not.toMatchObject({
+      error: expect.stringContaining("belongs to the"),
+    });
+  });
+
+  test("the concierge's own tools are NOT gated", async () => {
+    // `lookup_booking` is the concierge's, and the gate must not make the desk
+    // unable to answer "what am I holding?" from wherever the call is.
+    const ctx = makeCtx();
+    await atDesk("hotel", ctx);
+    const booking = (await run("lookup_booking", ctx)) as { passenger: string };
+    expect(booking.passenger).toBe("Nadia Rossi");
+  });
+});
+
 // ─── 2. The confirmation gate ────────────────────────────────────────────────
 //
 // Their graph halts before a sensitive tool (`interrupt_before`) and resumes on
@@ -107,13 +188,14 @@ describe("dialog stack (routing.ts)", () => {
 
 describe("sensitive tools stage rather than act", () => {
   test.each([
-    ["update_ticket", { flightId: "LX52" }],
-    ["cancel_ticket", {}],
-    ["book_hotel", { hotelId: "H1", nights: 2 }],
-    ["book_car_rental", { carId: "C2", days: 3 }],
-    ["book_excursion", { excursionId: "E2" }],
-  ])("%s changes nothing on its own", async (name, args) => {
+    ["update_ticket", { flightId: "LX52" }, "flight"],
+    ["cancel_ticket", {}, "flight"],
+    ["book_hotel", { hotelId: "H1", nights: 2 }, "hotel"],
+    ["book_car_rental", { carId: "C2", days: 3 }, "car_rental"],
+    ["book_excursion", { excursionId: "E2" }, "excursion"],
+  ] as const)("%s changes nothing on its own", async (name, args, desk) => {
     const ctx = makeCtx();
+    await atDesk(desk, ctx);
     const before = structuredClone(stateOf(ctx));
 
     const staged = (await run(name, args, ctx)) as { awaitingConfirmation: boolean };
@@ -127,6 +209,7 @@ describe("sensitive tools stage rather than act", () => {
 
   test("confirm_action applies the staged change, and only then", async () => {
     const ctx = makeCtx();
+    await atDesk("hotel", ctx);
     await run("book_hotel", { hotelId: "H1", nights: 3 }, ctx);
 
     // Staging moved the gate, in the same window it wrote `pending`.
@@ -160,6 +243,7 @@ describe("sensitive tools stage rather than act", () => {
 
   test("cancel_action drops the staged change and leaves the booking alone", async () => {
     const ctx = makeCtx();
+    await atDesk("flight", ctx);
     await run("update_ticket", { flightId: "LX54" }, ctx);
     const dropped = okPosition<{ discarded: string }>(await run("cancel_action", ctx));
     expect(dropped.result.discarded).toContain("LX54");
@@ -177,6 +261,7 @@ describe("sensitive tools stage rather than act", () => {
     // Refused where the model can still recover — before the caller is asked to
     // confirm a flight the airline does not fly.
     const ctx = makeCtx();
+    await atDesk("flight", ctx);
     expect(await run("update_ticket", { flightId: "ZZ99" }, ctx)).toEqual({
       error: "No flight ZZ99 in the schedule.",
     });
@@ -185,6 +270,7 @@ describe("sensitive tools stage rather than act", () => {
 
   test("cancelling the ticket makes a later ticket change impossible", async () => {
     const ctx = makeCtx();
+    await atDesk("flight", ctx);
     await run("cancel_ticket", ctx);
     await run("confirm_action", ctx);
     expect(stateOf(ctx).ticket).toBeNull();
@@ -197,17 +283,22 @@ describe("sensitive tools stage rather than act", () => {
 
   test("a second staging is REFUSED rather than overwriting the first", async () => {
     // The LLM loop runs a step's tool calls concurrently, so two sensitive
-    // tools in one step is ordinary: the model hears "move my flight and book
-    // the hotel" and emits both. Assigning `pending` unconditionally made the
+    // tools in one step is ordinary: the model hears "move my flight and cancel
+    // the old one" and emits both. Assigning `pending` unconditionally made the
     // second win — both answered `awaitingConfirmation`, the caller said yes
     // once, and one of the two changes was silently dropped forever.
     const ctx = makeCtx();
+    await atDesk("flight", ctx);
     const first = (await run("update_ticket", { flightId: "LX52" }, ctx)) as {
       awaitingConfirmation: boolean;
     };
     expect(first.awaitingConfirmation).toBe(true);
 
-    const second = (await run("book_hotel", { hotelId: "H1", nights: 2 }, ctx)) as {
+    // Both from ONE desk, which is what a concurrent pair looks like now that
+    // `requireDesk` is enforced. Another desk's tool would be refused by the
+    // DESK gate first, which is a different refusal and would leave this one
+    // unexercised.
+    const second = (await run("cancel_ticket", ctx)) as {
       error: string;
     };
     // The refusal NAMES what is already waiting, which is what lets the model
@@ -226,7 +317,8 @@ describe("sensitive tools stage rather than act", () => {
     expect(applied.applied).toContain("LX52");
     expect(stateOf(ctx).bookings).toEqual([]);
 
-    // Once the queue is clear, the hotel can be staged after all.
+    // Once the queue is clear, the next desk's booking can be staged after all.
+    await atDesk("hotel", ctx);
     const retried = (await run("book_hotel", { hotelId: "H1", nights: 2 }, ctx)) as {
       awaitingConfirmation: boolean;
     };
@@ -235,8 +327,10 @@ describe("sensitive tools stage rather than act", () => {
 
   test("cancel_action clears the block, so a declined change does not wedge the desk", async () => {
     const ctx = makeCtx();
+    await atDesk("car_rental", ctx);
     await run("book_car_rental", { carId: "C2", days: 3 }, ctx);
     await run("cancel_action", ctx);
+    await atDesk("excursion", ctx);
     const staged = (await run("book_excursion", { excursionId: "E2" }, ctx)) as {
       awaitingConfirmation: boolean;
     };
@@ -272,6 +366,7 @@ describe("sensitive tools stage rather than act", () => {
 describe("search tools", () => {
   test("an unmatched route widens to the whole schedule rather than answering nothing", async () => {
     const ctx = makeCtx();
+    await atDesk("flight", ctx);
     const hit = (await run("search_flights", { route: "Zurich to Boston" }, ctx)) as {
       widened: boolean;
       flights: unknown[];
@@ -289,6 +384,7 @@ describe("search tools", () => {
 
   test("hotels come back cheapest first, and a ceiling filters them", async () => {
     const ctx = makeCtx();
+    await atDesk("hotel", ctx);
     const all = (await run("search_hotels", { city: "Boston" }, ctx)) as {
       hotels: { perNight: string }[];
     };
@@ -303,6 +399,7 @@ describe("search tools", () => {
 
   test("an excursion keyword that matches nothing falls back to the city", async () => {
     const ctx = makeCtx();
+    await atDesk("excursion", ctx);
     const result = (await run("search_excursions", { city: "Boston", keyword: "skiing" }, ctx)) as {
       widened: boolean;
       excursions: unknown[];
@@ -313,6 +410,7 @@ describe("search tools", () => {
 
   test("lookup_booking reports the ticket the caller is actually holding", async () => {
     const ctx = makeCtx();
+    await atDesk("flight", ctx);
     await run("update_ticket", { flightId: "LX52" }, ctx);
     await run("confirm_action", ctx);
     const booking = (await run("lookup_booking", ctx)) as {
@@ -357,8 +455,10 @@ describe("tripView projection", () => {
 
   test("totals every confirmed booking", async () => {
     const ctx = makeCtx();
+    await atDesk("hotel", ctx);
     await run("book_hotel", { hotelId: "H3", nights: 2 }, ctx); // 2 × 180
     await run("confirm_action", ctx);
+    await atDesk("excursion", ctx);
     await run("book_excursion", { excursionId: "E1" }, ctx); // 35
     await run("confirm_action", ctx);
 

package/dist/templates/travel-concierge/agent.ts

@@ -7,15 +7,24 @@ import { tripProjection } from "./shared.ts";
  * two mechanisms worth reading for are the dialog stack (`routing.ts`) and the
  * confirmation gate (`stageAction` / `confirm_action`).
  *
- * **Every tool in `tools/` belongs to this one agent — the delegation is in the
- * PROMPT, not in the tool list.** Their graph gives each specialist node its
- * own bound tool set, so a specialist physically cannot call another desk's
- * tools. A voice session has one model with one tool list for its whole life,
- * so the specialist's brief arrives as a tool result and the narrowing is
- * something the model is asked to honour rather than something the runtime
- * enforces. That is the honest limit of the port, and it is why
- * `complete_or_escalate` is described the way it is: the stack is what the
- * caller and the sidebar can both see, even when the model reaches past it.
+ * **Every tool in `tools/` belongs to this one agent, and the delegation is
+ * ENFORCED anyway.** Their graph gives each specialist node its own bound tool
+ * set, so a specialist physically cannot call another desk's tools. A voice
+ * session has one model with one tool list for its whole life, so a list cannot
+ * be narrowed here — but a TOOL can refuse, which is the same guarantee by a
+ * route that works mid-call: every desk tool checks the stack first
+ * (`requireDesk` in `shared.ts`) and answers a `ToolFailure` naming the
+ * `to_…_assistant` to call. So the position the sidebar renders is always the
+ * position the work is being done at, and the specialist's brief has always
+ * been read before that desk's first search.
+ *
+ * This used to be asked for in the prompt instead, described here as the honest
+ * limit of the port. It was measured and the prompt lost — 0 of 5 live runs, the
+ * model searching hotels from the concierge desk every time — so the eval case
+ * that predicted it (`agent.eval.test.ts`, "a hotel request goes to the hotel
+ * desk") is what turned the narrowing into a mechanism. `complete_or_escalate`
+ * is still described the way it is for the other half of the reason: the stack
+ * is what the caller and the sidebar can both see.
  */
 export default agent({
   name: "Swiss Air Concierge",

package/dist/templates/travel-concierge/shared.ts

@@ -14,6 +14,7 @@
  * | `ToFlightBookingAssistant` & friends (delegation tools) | the four tools {@link SPECIALISTS} generates in `routing.ts` |
  * | `CompleteOrEscalate` | `complete_or_escalate`, which pops the same stack |
  * | `interrupt_before=["…_sensitive_tools"]` | {@link stageAction} + `confirm_action` |
+ * | a specialist node's BOUND tool set | {@link requireDesk}, checked by every desk tool |
  * | `fetch_user_flight_information` (sqlite) | `lookup_booking` over {@link seedTrip} |
  *
  * **The dialog stack is what keeps a long call on the rails.** Their insight is
@@ -23,7 +24,9 @@
  * session's prompt is fixed at connect — so the specialist's brief arrives as
  * the DELEGATION TOOL'S RESULT, which is the last thing the model reads before
  * it answers. The stack itself is real state either way, which is what
- * `complete_or_escalate` pops and what the sidebar renders.
+ * `complete_or_escalate` pops and what the sidebar renders — and what
+ * {@link requireDesk} makes binding, so the position is never merely a label on
+ * work that happened somewhere else.
  *
  * **`interrupt_before` becomes a spoken confirmation, and that is not a
  * downgrade.** Their graph halts before a sensitive tool and waits for a human
@@ -207,6 +210,19 @@ export interface Specialist {
   instructions: string;
 }
 
+/**
+ * Each brief spells the STAGE-then-read-back ORDER out, and that is a fix
+ * measured rather than a preference.
+ *
+ * The flight desk's used to say "read the fare change back to the caller before
+ * you change a ticket", which is true of `confirm_action` and reads as a rule
+ * about `update_ticket` — and live, that is how it was read: the desk searched,
+ * quoted a fare it had not staged, waited for a yes, and then called
+ * `confirm_action` with nothing waiting for it. Two of three runs never staged
+ * anything at all. The sentence to read back IS the staging tool's return
+ * value, so a brief that puts the read-back first describes a call the desk
+ * cannot make.
+ */
 export const SPECIALISTS: Record<SpecialistId, Specialist> = {
   flight: {
     title: "flight desk",
@@ -214,9 +230,22 @@ export const SPECIALISTS: Record<SpecialistId, Specialist> = {
       "You are now the flight desk. Handle searching and changing flights only.",
       "Search before you quote anything, and be persistent: if the first search",
       "finds nothing, widen it rather than telling the caller there is nothing.",
-      "Read the flight number, the day, the departure time and the fare change",
-      "back to the caller before you change a ticket. A ticket is only changed",
-      "once confirm_action has run.",
+      "update_ticket is a QUOTE, not a change: it moves nothing, so call it as",
+      "soon as you know which flight they want and never ask permission first.",
+      "Changing a ticket is TWO steps and never one: call update_ticket first —",
+      "it changes nothing and hands you the sentence to say — then read the",
+      "flight number, the day, the departure time and the fare change back to",
+      "the caller and ask them plainly to confirm. A ticket is only changed once",
+      "confirm_action has run, and confirm_action has nothing to apply until",
+      "update_ticket has staged it.",
+      "Never quote a departure time or a fare you did not just read out of a",
+      "tool result, and never end a turn on 'shall I confirm?' with nothing",
+      "staged: update_ticket goes out in the SAME turn as that question, before",
+      "you stop. There is nothing for a yes to apply until it has.",
+      "Your next action, right now, is a TOOL and not a sentence: call",
+      "update_ticket if you already know which flight they want, or",
+      "search_flights if you do not. Do not speak until one of them has",
+      "answered — anything you would say before that is invented.",
       "If the caller wants a hotel, a car or something to do, or changes their",
       "mind, call complete_or_escalate instead of improvising.",
     ].join(" "),
@@ -227,8 +256,18 @@ export const SPECIALISTS: Record<SpecialistId, Specialist> = {
       "You are now the hotel desk. Handle searching and booking hotels only.",
       "Ask which city and roughly what budget, then search. Offer at most three",
       "options out loud, cheapest first, with the neighbourhood and nightly rate.",
-      "Confirm the hotel, the number of nights and the total before booking.",
-      "A room is only held once confirm_action has run.",
+      "book_hotel is a QUOTE, not a change: it holds nothing, so call it as",
+      "soon as you know what the caller wants and never ask permission",
+      "first.",
+      "Booking is TWO steps and never one: call book_hotel first — it holds",
+      "nothing and hands you the sentence to say — then read the hotel, the",
+      "number of nights and the total back and ask them to confirm. A room is",
+      "only held once confirm_action has run, and confirm_action has nothing to",
+      "apply until book_hotel has staged it.",
+      "Your next action, right now, is a TOOL and not a sentence: call",
+      "book_hotel if you already know which room and how many nights, or",
+      "search_hotels if you do not. Do not speak until one of them has",
+      "answered — anything you would say before that is invented.",
       "If the caller wants flights, a car or an excursion, call",
       "complete_or_escalate.",
     ].join(" "),
@@ -238,8 +277,19 @@ export const SPECIALISTS: Record<SpecialistId, Specialist> = {
     instructions: [
       "You are now the car rental desk. Handle searching and booking cars only.",
       "Ask the city and how many days, then search. Name the vendor, the tier",
-      "and the daily rate, and confirm the total before booking.",
-      "A car is only reserved once confirm_action has run.",
+      "and the daily rate.",
+      "book_car_rental is a QUOTE, not a change: it holds nothing, so call it as",
+      "soon as you know what the caller wants and never ask permission",
+      "first.",
+      "Reserving is TWO steps and never one: call book_car_rental first — it",
+      "reserves nothing and hands you the sentence to say — then read the total",
+      "back and ask them to confirm. A car is only reserved once confirm_action",
+      "has run, and confirm_action has nothing to apply until book_car_rental",
+      "has staged it.",
+      "Your next action, right now, is a TOOL and not a sentence: call",
+      "book_car_rental if you already know which car and how many days, or",
+      "search_car_rentals if you do not. Do not speak until one of them has",
+      "answered — anything you would say before that is invented.",
       "If the caller wants flights, a hotel or an excursion, call",
       "complete_or_escalate.",
     ].join(" "),
@@ -251,7 +301,17 @@ export const SPECIALISTS: Record<SpecialistId, Specialist> = {
       "to do only. Ask the city and what kind of thing they enjoy, then search.",
       "Describe two or three options in a sentence each — this is the part of",
       "the call a caller actually wants to hear about.",
-      "A booking is only made once confirm_action has run.",
+      "book_excursion is a QUOTE, not a change: it holds nothing, so call it as",
+      "soon as you know what the caller wants and never ask permission",
+      "first.",
+      "Booking is TWO steps and never one: call book_excursion first — it books",
+      "nothing and hands you the sentence to say — then read it back and ask",
+      "them to confirm. A booking is only made once confirm_action has run, and",
+      "confirm_action has nothing to apply until book_excursion has staged it.",
+      "Your next action, right now, is a TOOL and not a sentence: call",
+      "book_excursion if you already know which one they want, or",
+      "search_excursions if you do not. Do not speak until one of them has",
+      "answered — anything you would say before that is invented.",
       "If the caller wants flights, a hotel or a car, call complete_or_escalate.",
     ].join(" "),
   },
@@ -347,6 +407,47 @@ export function note(state: TripState, entry: string): void {
   pushCapped(state.log, entry, MAX_LOG_ENTRIES);
 }
 
+// ─── The desk gate ───────────────────────────────────────────────────────────
+
+/**
+ * Is the call at `id`'s desk? A {@link ToolFailure} naming the way in if not.
+ *
+ * **This is the narrowing their graph gets for free, and it used to be prose.**
+ * Each specialist node there binds its own tool set, so a node physically cannot
+ * call another desk's tools; a voice session has ONE model with ONE tool list
+ * for its whole life, so for a long time the stack was real state that the model
+ * was merely ASKED to respect — `agent.ts` said so in place, and this guide's
+ * own eval predicted the failure. Measured: the prompt lost 0 of 5 live runs.
+ * The caller said "I need a hotel in Boston" and the model called
+ * `search_hotels` at the concierge desk every time, so `dialogState` said
+ * `primary` while the call was plainly doing hotel work — a stack the sidebar
+ * renders and nothing keeps true.
+ *
+ * A tool list cannot be narrowed mid-session, but a tool can REFUSE, and a
+ * refusal is a thing the model recovers from inside the same turn: it reads the
+ * failure, calls `to_hotel_assistant`, gets the desk's brief, and searches. So
+ * the delegation is now structural — every desk tool is reachable only from its
+ * own desk — and the brief the delegation returns is guaranteed to have been
+ * read before any of that desk's work happens, which was the whole point of
+ * handing it back as a tool result.
+ *
+ * It costs one wasted round trip the first time the model reaches past the
+ * stack, which is the right price: the alternative is a desk whose position is
+ * decoration.
+ */
+export function requireDesk(state: FrozenTripState, id: SpecialistId): ToolFailure | undefined {
+  const at = activeAssistant(state);
+  if (at === id) return undefined;
+  const here = at === "primary" ? "the main concierge" : SPECIALISTS[at].title;
+  return {
+    error:
+      `That tool belongs to the ${SPECIALISTS[id].title} and this call is at ${here}. ` +
+      `Nothing was searched, staged or booked. Call to_${id}_assistant with what the ` +
+      "caller asked for — its answer is that desk's brief — and then call this tool again. " +
+      "Do not tell the caller about any of this; they should hear one continuous conversation.",
+  };
+}
+
 // ─── The confirmation gate ───────────────────────────────────────────────────
 
 /**

package/dist/templates/travel-concierge/system-prompt.md

@@ -10,15 +10,21 @@ You do not do the specialist work yourself. There are four desks, and each one h
 How to run a call:
 
 - Start with `lookup_booking` so you know who you are speaking to and what they are holding.
-- The moment the caller raises something a desk owns, hand it over with that desk's tool and pass along what they asked for. Do not mention the transfer — the caller should hear one continuous conversation.
+- **A desk's tools only work while the call is at that desk, and they refuse from anywhere else.** So the moment the caller raises something a desk owns — flights, hotels, cars, excursions — your very next tool call is that desk's `to_…_assistant`, passing along what they asked for. Never a search or a booking first: at the concierge desk those refuse, and you have spent the caller's time on nothing.
+- Do not mention the transfer — the caller should hear one continuous conversation.
 - The desk's reply tells you how it works. Follow it until it is done, then use `complete_or_escalate` to come back.
 - Answer small talk, general questions and anything about the existing booking yourself.
 
 Confirming changes — this part matters:
 
 - Every tool that would change a booking stages the change instead of making it. Nothing has happened until `confirm_action` runs.
+- **Staging is a QUOTE, not a change, so it needs no permission.** `update_ticket`, `book_hotel`, `book_car_rental` and `book_excursion` price the request and hand you the sentence to say; they move nothing. Call the staging tool as soon as you know what the caller wants — you are getting them a quote, not doing the thing — and never ask whether you may.
+- **So the staging tool comes before the question, always.** "Shall I confirm?" is a question about a staged change, so the tool that stages it runs first and its answer is what you read back. Asking before staging is asking about something that does not exist, and the yes it earns has nothing to apply.
+- **Never end a turn on "shall I confirm?" with nothing staged.** The staging call and that question belong to the same turn: stage, then ask, in that order, before you stop. If you have already asked and the caller says anything other than no, stage it now — asking a second time does not stage it either, and a caller who has to repeat themselves is a caller nobody is helping.
+- **Never say a time, a fare or a total that did not come out of a tool result on this call**, and never say you are doing something — "I'll move your ticket", "I'm booking that" — before the tool that stages it has answered. If you need a number you have not got, call the desk's search first.
 - When a tool answers with `awaitingConfirmation`, read the change back in your own words and ask a yes-or-no question. Say the price.
 - If the caller says yes, call `confirm_action`. If they say no, or want different details, call `cancel_action`.
+- **`confirm_action` only ever answers a read-back you have just given.** If no tool has answered `awaitingConfirmation` on this call, there is nothing staged, `confirm_action` will refuse, and the caller's request is still waiting to be done — reach for the tool that stages it instead. A caller who says "yes" or "go ahead" before anything is staged is agreeing to the request they already made, not to a read-back.
 - Never call `confirm_action` on your own initiative, and never claim something is booked before it has run.
 
 Voice manners: numbers spoken out ("six forty" not "$640.00"), flight numbers letter by letter when reading them back, and one question at a time.

package/dist/templates/travel-concierge/tools/book_car_rental.ts

@@ -1,16 +1,19 @@
 import { z } from "zod";
-import { stageAction, tripSlot } from "../shared.ts";
+import { requireDesk, stageAction, tripSlot } from "../shared.ts";
 
 /** SENSITIVE — their `book_car_rental`, staged rather than applied. */
 export default tripSlot.updateTool({
   description:
-    "Reserve a rental car. This does NOT reserve anything yet — it stages the " +
-    "reservation so you can read the total back and hear a yes.",
+    "The CAR RENTAL DESK's booking tool: reserve a rental car. Only usable while the call " +
+    "is at that desk. This does NOT reserve anything yet — it stages the reservation so " +
+    "you can read the total back and hear a yes.",
   inputSchema: z.object({
     carId: z.string().max(20).describe("The car id from search_car_rentals, e.g. 'C2'"),
     days: z.number().int().min(1).max(60).describe("How many days"),
   }),
   execute(args, trip, ctx) {
+    const offDesk = requireDesk(trip, "car_rental");
+    if (offDesk) return offDesk;
     return stageAction(ctx, trip, {
       kind: "book_car",
       carId: args.carId.toUpperCase(),

package/dist/templates/travel-concierge/tools/book_excursion.ts

@@ -1,15 +1,18 @@
 import { z } from "zod";
-import { stageAction, tripSlot } from "../shared.ts";
+import { requireDesk, stageAction, tripSlot } from "../shared.ts";
 
 /** SENSITIVE — their `book_excursion`, staged rather than applied. */
 export default tripSlot.updateTool({
   description:
-    "Book an excursion. This does NOT book anything yet — it stages the " +
-    "booking so you can read it back and hear a yes.",
+    "The EXCURSIONS DESK's booking tool: book an excursion. Only usable while the call is " +
+    "at that desk. This does NOT book anything yet — it stages the booking so you can read " +
+    "it back and hear a yes.",
   inputSchema: z.object({
     excursionId: z.string().max(20).describe("The excursion id from search_excursions, e.g. 'E2'"),
   }),
   execute(args, trip, ctx) {
+    const offDesk = requireDesk(trip, "excursion");
+    if (offDesk) return offDesk;
     return stageAction(ctx, trip, {
       kind: "book_excursion",
       excursionId: args.excursionId.toUpperCase(),

package/dist/templates/travel-concierge/tools/book_hotel.ts

@@ -1,16 +1,19 @@
 import { z } from "zod";
-import { stageAction, tripSlot } from "../shared.ts";
+import { requireDesk, stageAction, tripSlot } from "../shared.ts";
 
 /** SENSITIVE — their `book_hotel`, staged rather than applied. */
 export default tripSlot.updateTool({
   description:
-    "Hold a hotel room. This does NOT book anything yet — it stages the " +
-    "booking so you can read the total back and hear a yes.",
+    "The HOTEL DESK's booking tool: hold a hotel room. Only usable while the call is at " +
+    "that desk. This does NOT book anything yet — it stages the booking so you can read " +
+    "the total back and hear a yes.",
   inputSchema: z.object({
     hotelId: z.string().max(20).describe("The hotel id from search_hotels, e.g. 'H1'"),
     nights: z.number().int().min(1).max(30).describe("How many nights"),
   }),
   execute(args, trip, ctx) {
+    const offDesk = requireDesk(trip, "hotel");
+    if (offDesk) return offDesk;
     return stageAction(ctx, trip, {
       kind: "book_hotel",
       hotelId: args.hotelId.toUpperCase(),

package/dist/templates/travel-concierge/tools/cancel_ticket.ts

@@ -1,4 +1,4 @@
-import { stageAction, tripSlot } from "../shared.ts";
+import { requireDesk, stageAction, tripSlot } from "../shared.ts";
 
 /**
  * SENSITIVE — their `cancel_ticket`. The most destructive thing on the call and
@@ -7,9 +7,12 @@ import { stageAction, tripSlot } from "../shared.ts";
  */
 export default tripSlot.updateTool({
   description:
-    "Cancel the caller's ticket outright. This does NOT cancel anything yet — " +
-    "it stages the cancellation so you can read it back and hear a yes.",
+    "The FLIGHT DESK's cancellation tool: cancel the caller's ticket outright. Only usable " +
+    "while the call is at that desk. This does NOT cancel anything yet — it stages the " +
+    "cancellation so you can read it back and hear a yes.",
   execute(_args, trip, ctx) {
+    const offDesk = requireDesk(trip, "flight");
+    if (offDesk) return offDesk;
     if (!trip.ticket) return { error: "There is no ticket to cancel." };
     return stageAction(ctx, trip, { kind: "cancel_ticket" });
   },

package/dist/templates/travel-concierge/tools/search_car_rentals.ts

@@ -1,15 +1,19 @@
-import { tool } from "@alexkroman1/aai";
 import { z } from "zod";
-import { CAR_RENTALS, formatPrice } from "../shared.ts";
+import { CAR_RENTALS, formatPrice, requireDesk, tripSlot } from "../shared.ts";
 
 /** Their `search_car_rentals`, by city and tier. */
-export default tool({
-  description: "Search rental cars by city, and optionally by tier (compact, midsize, suv).",
+export default tripSlot.tool({
+  description:
+    "The CAR RENTAL DESK's search: cars by city, and optionally by tier (compact, midsize, " +
+    "suv). Only usable while the call is at that desk — from anywhere else it refuses, so " +
+    "call to_car_rental_assistant first.",
   inputSchema: z.object({
     city: z.string().max(80).describe("City to search, e.g. 'Boston'"),
     tier: z.string().max(40).describe("compact, midsize or suv").optional(),
   }),
-  execute(args) {
+  execute(args, trip) {
+    const offDesk = requireDesk(trip, "car_rental");
+    if (offDesk) return offDesk;
     const city = args.city.trim().toLowerCase();
     const tier = args.tier?.trim().toLowerCase();
     const cars = CAR_RENTALS.filter(

package/dist/templates/travel-concierge/tools/search_excursions.ts

@@ -1,11 +1,13 @@
-import { tool } from "@alexkroman1/aai";
 import { z } from "zod";
-import { EXCURSIONS, formatPrice } from "../shared.ts";
+import { EXCURSIONS, formatPrice, requireDesk, tripSlot } from "../shared.ts";
 
 /** Their `search_trip_recommendations` — city plus a loose keyword, matched
  *  against the name and the kind so "boat" and "sail" both land. */
-export default tool({
-  description: "Find things to do in a city. The keyword is optional and matched loosely.",
+export default tripSlot.tool({
+  description:
+    "The EXCURSIONS DESK's search: things to do in a city, with an optional keyword matched " +
+    "loosely. Only usable while the call is at that desk — from anywhere else it refuses, so " +
+    "call to_excursion_assistant first.",
   inputSchema: z.object({
     city: z.string().max(80).describe("City to search, e.g. 'Boston'"),
     keyword: z
@@ -14,7 +16,9 @@ export default tool({
       .describe("What they enjoy, e.g. 'food', 'boat', 'history'")
       .optional(),
   }),
-  execute(args) {
+  execute(args, trip) {
+    const offDesk = requireDesk(trip, "excursion");
+    if (offDesk) return offDesk;
     const city = args.city.trim().toLowerCase();
     const keyword = args.keyword?.trim().toLowerCase();
     const inCity = EXCURSIONS.filter((e) => e.city.toLowerCase().includes(city));