@amodalai/runtime 0.2.0 → 0.2.1

package/dist/src/agent/loop.test.js

@@ -97,7 +97,6 @@ function makeMockContext(overrides) {
         logger,
         signal: new AbortController().signal,
         sessionId: 'test-session',
-        tenantId: 'test-tenant',
         user: { roles: ['user'] },
         systemPrompt: 'You are a helpful assistant.',
         messages: [],
@@ -108,6 +107,8 @@ function makeMockContext(overrides) {
         config: { ...DEFAULT_LOOP_CONFIG },
         compactionFailures: 0,
         preExecutionCache: new Map(),
+        confirmedCallIds: new Set(),
+        disabledToolsUntilTurn: new Map(),
         waitForConfirmation: vi.fn().mockResolvedValue(true),
         buildToolContext: vi.fn().mockReturnValue({
             request: vi.fn(),
@@ -117,7 +118,6 @@ function makeMockContext(overrides) {
             user: { roles: [] },
             signal: new AbortController().signal,
             sessionId: 'test-session',
-            tenantId: 'test-tenant',
         }),
         ...overrides,
     };
@@ -192,12 +192,14 @@ describe('handleThinking (via transition)', () => {
         expect(errorEvents.length).toBe(1);
     });
     it('detects loops with similar (not identical) parameters', async () => {
-        // Build messages where the same tool is called with slightly different params
+        // Build messages where the same tool is called with slightly different
+        // params. Use a non-pagination key (retry_count) — pagination keys
+        // (offset/limit/page/cursor) are treated as iteration, not loops.
         const messages = [];
         for (let i = 0; i < 8; i++) {
             messages.push({
                 role: 'assistant',
-                content: [{ type: 'tool-call', toolCallId: `c${i}`, toolName: 'search_api', input: { query: 'test', page: i } }],
+                content: [{ type: 'tool-call', toolCallId: `c${i}`, toolName: 'search_api', input: { query: 'test', retry_count: i } }],
             });
             messages.push({
                 role: 'tool',
@@ -212,6 +214,195 @@ describe('handleThinking (via transition)', () => {
             expect(result.next.reason).toBe('loop_detected');
         }
     });
+    it('does NOT detect pagination as a loop (offset/limit/page variants)', async () => {
+        // Agent walking a long file in chunks is legitimate iteration — same
+        // tool, same path, different offset. Must not trip the loop detector.
+        const messages = [];
+        for (let i = 0; i < 8; i++) {
+            messages.push({
+                role: 'assistant',
+                content: [{
+                        type: 'tool-call',
+                        toolCallId: `c${i}`,
+                        toolName: 'read_repo_file',
+                        input: { path: 'knowledge/big.md', offset: 1 + i * 2000, limit: 2000 },
+                    }],
+            });
+            messages.push({
+                role: 'tool',
+                content: [{ type: 'tool-result', toolCallId: `c${i}`, toolName: 'read_repo_file', output: { type: 'text', value: 'chunk' } }],
+            });
+        }
+        const ctx = makeMockContext();
+        const result = await transition({ type: 'thinking', messages }, ctx);
+        // Should NOT be done — the loop detector should have skipped these.
+        expect(result.next.type).not.toBe('done');
+    });
+    it('replaces old tool results with summarizer output when hook is set', async () => {
+        // Build 20 tool-result messages so clearing triggers (threshold=15 by default)
+        const messages = [];
+        for (let i = 0; i < 20; i++) {
+            messages.push({
+                role: 'tool',
+                content: [{
+                        type: 'tool-result',
+                        toolCallId: `c${i}`,
+                        toolName: 'search_api',
+                        output: { type: 'text', value: `result body ${i} with lots of content` },
+                    }],
+            });
+        }
+        const summarizer = vi.fn().mockResolvedValue('found 3 matching records');
+        const ctx = makeMockContext({ summarizeToolResult: summarizer });
+        await transition({ type: 'thinking', messages }, ctx);
+        // Summarizer should have been called for the cleared (non-kept) messages.
+        // threshold=15, keepRecent=5 → 15 cleared (all but the last 5).
+        expect(summarizer).toHaveBeenCalled();
+        expect(summarizer.mock.calls.length).toBe(15);
+        // Verify the summary is wired through — the messages passed to streamText
+        // should include the summary text in a cleared marker.
+        const streamTextCall = vi.mocked(ctx.provider.streamText).mock.calls[0][0];
+        const passedMessages = streamTextCall.messages;
+        const clearedMsg = passedMessages[0];
+        if (clearedMsg.role === 'tool' && Array.isArray(clearedMsg.content)) {
+            const part = clearedMsg.content[0];
+            if ('output' in part && part.output && typeof part.output === 'object' && 'value' in part.output) {
+                expect(String(part.output.value)).toContain('found 3 matching records');
+                expect(String(part.output.value)).toContain('search_api');
+            }
+        }
+    });
+    it('falls back to static marker when summarizer throws', async () => {
+        const messages = [];
+        for (let i = 0; i < 20; i++) {
+            messages.push({
+                role: 'tool',
+                content: [{
+                        type: 'tool-result',
+                        toolCallId: `c${i}`,
+                        toolName: 'flaky_tool',
+                        output: { type: 'text', value: `body ${i}` },
+                    }],
+            });
+        }
+        const summarizer = vi.fn().mockRejectedValue(new Error('haiku unavailable'));
+        const ctx = makeMockContext({ summarizeToolResult: summarizer });
+        await transition({ type: 'thinking', messages }, ctx);
+        // Summarizer was called but threw; we should still proceed with static marker
+        expect(summarizer).toHaveBeenCalled();
+        const streamTextCall = vi.mocked(ctx.provider.streamText).mock.calls[0][0];
+        const clearedMsg = streamTextCall.messages[0];
+        if (clearedMsg.role === 'tool' && Array.isArray(clearedMsg.content)) {
+            const part = clearedMsg.content[0];
+            if ('output' in part && part.output && typeof part.output === 'object' && 'value' in part.output) {
+                expect(String(part.output.value)).toContain('Tool result cleared');
+            }
+        }
+        // The failure should have been logged
+        expect(ctx.logger.warn).toHaveBeenCalledWith('tool_result_summarization_failed', expect.objectContaining({ tool: 'flaky_tool' }));
+    });
+    it('skips already-cleared messages (idempotent)', async () => {
+        // Already-cleared messages keep their original toolCallId (otherwise
+        // providers reject "orphaned" assistant tool-calls). Detection is by
+        // output-value prefix: "[Tool result cleared..." or "[Summary of ...".
+        const messages = [];
+        for (let i = 0; i < 20; i++) {
+            messages.push({
+                role: 'tool',
+                content: [{
+                        type: 'tool-result',
+                        toolCallId: `c${i}`,
+                        toolName: 'search_api',
+                        // First 15 are already-cleared (marker prefix); last 5 are fresh
+                        output: {
+                            type: 'text',
+                            value: i < 15 ? '[Tool result cleared to save context space]' : `body ${i}`,
+                        },
+                    }],
+            });
+        }
+        const summarizer = vi.fn().mockResolvedValue('summary');
+        const ctx = makeMockContext({ summarizeToolResult: summarizer });
+        await transition({ type: 'thinking', messages }, ctx);
+        // Clearing kicks in (20 > 15), but all 15 candidates are already cleared.
+        // Summarizer should NOT be called for already-cleared messages.
+        expect(summarizer).not.toHaveBeenCalled();
+    });
+    it('escalates at loopEscalationThreshold: stronger warn + removes looping tool', async () => {
+        // Build messages with 5 tool calls so count hits escalation (default=5)
+        // but not hard-stop (default=8).
+        const messages = [];
+        for (let i = 0; i < 5; i++) {
+            messages.push({
+                role: 'assistant',
+                content: [{ type: 'tool-call', toolCallId: `c${i}`, toolName: 'stuck_api', input: { q: 'same' } }],
+            });
+            messages.push({
+                role: 'tool',
+                content: [{ type: 'tool-result', toolCallId: `c${i}`, toolName: 'stuck_api', output: { type: 'text', value: 'no progress' } }],
+            });
+        }
+        // Registry has both the looping tool and another tool
+        const stuckTool = makeMockToolDef({ description: 'Stuck tool' });
+        const otherTool = makeMockToolDef({ description: 'Other tool' });
+        const registry = makeMockRegistry({ stuck_api: stuckTool, other_tool: otherTool });
+        const ctx = makeMockContext({ toolRegistry: registry });
+        const result = await transition({ type: 'thinking', messages }, ctx);
+        // Should still stream (not hard-stop)
+        expect(result.next.type).toBe('streaming');
+        // The escalation-level warn should have been logged
+        expect(ctx.logger.warn).toHaveBeenCalledWith('agent_loop_escalation', expect.objectContaining({ tool: 'stuck_api', count: 5 }));
+        // The looping tool should be EXCLUDED from this turn's tool set
+        const streamTextCall = vi.mocked(ctx.provider.streamText).mock.calls[0][0];
+        const passedTools = streamTextCall.tools;
+        expect(passedTools['stuck_api']).toBeUndefined();
+        expect(passedTools['other_tool']).toBeDefined();
+        // Escalation message should be appended
+        const lastMsg = streamTextCall.messages[streamTextCall.messages.length - 1];
+        expect(lastMsg.role).toBe('user');
+        if (typeof lastMsg.content === 'string') {
+            expect(lastMsg.content).toContain('temporarily disabled');
+            expect(lastMsg.content).toContain('stuck_api');
+        }
+        // The looping tool should be registered in the cooldown map, not just
+        // filtered once-off — so subsequent turns also skip it.
+        expect(ctx.disabledToolsUntilTurn.has('stuck_api')).toBe(true);
+    });
+    it('escalation cooldown keeps tool disabled across subsequent turns', async () => {
+        // Simulate a session where escalation fires at turn 5 with default
+        // cooldown of 3, then the agent moves on. The looping tool should be
+        // excluded from turns 5-7 and return at turn 8.
+        const stuckTool = makeMockToolDef({ description: 'Stuck tool' });
+        const otherTool = makeMockToolDef({ description: 'Other tool' });
+        const registry = makeMockRegistry({ stuck_api: stuckTool, other_tool: otherTool });
+        const ctx = makeMockContext({ toolRegistry: registry });
+        // Pre-populate the cooldown as if escalation fired at turn 5
+        ctx.turnCount = 4; // next turn will be 5
+        ctx.disabledToolsUntilTurn.set('stuck_api', 8); // disable until turn 8
+        // Turn 5: tool still disabled
+        await transition({ type: 'thinking', messages: [] }, ctx);
+        let streamTextCall = vi.mocked(ctx.provider.streamText).mock.calls[0][0];
+        let passedTools = streamTextCall.tools;
+        expect(passedTools['stuck_api']).toBeUndefined();
+        expect(passedTools['other_tool']).toBeDefined();
+        // Turn 6: still disabled
+        await transition({ type: 'thinking', messages: [] }, ctx);
+        streamTextCall = vi.mocked(ctx.provider.streamText).mock.calls[1][0];
+        passedTools = streamTextCall.tools;
+        expect(passedTools['stuck_api']).toBeUndefined();
+        // Turn 7: still disabled (turnCount=7, untilTurn=8)
+        await transition({ type: 'thinking', messages: [] }, ctx);
+        streamTextCall = vi.mocked(ctx.provider.streamText).mock.calls[2][0];
+        passedTools = streamTextCall.tools;
+        expect(passedTools['stuck_api']).toBeUndefined();
+        // Turn 8: cooldown expired — tool back in the set
+        await transition({ type: 'thinking', messages: [] }, ctx);
+        streamTextCall = vi.mocked(ctx.provider.streamText).mock.calls[3][0];
+        passedTools = streamTextCall.tools;
+        expect(passedTools['stuck_api']).toBeDefined();
+        // Map should be cleaned up after expiry
+        expect(ctx.disabledToolsUntilTurn.has('stuck_api')).toBe(false);
+    });
     it('injects warning when tool called 3+ times', async () => {
         const messages = [];
         for (let i = 0; i < 3; i++) {
@@ -231,7 +422,7 @@ describe('handleThinking (via transition)', () => {
         expect(result.next.type).toBe('streaming');
         const streamTextCall = vi.mocked(ctx.provider.streamText).mock.calls[0][0];
         const lastMsg = streamTextCall.messages[streamTextCall.messages.length - 1];
-        expect(lastMsg.role).toBe('system');
+        expect(lastMsg.role).toBe('user');
         if (typeof lastMsg.content === 'string') {
             expect(lastMsg.content).toContain('flaky_api');
             expect(lastMsg.content).toContain('3 times');
@@ -364,6 +555,86 @@ describe('handleExecuting (via transition)', () => {
         expect(startEvents.length).toBe(1);
         expect(resultEvents.length).toBe(1);
     });
+    it('routes requiresConfirmation tools through CONFIRMING on first pass', async () => {
+        const destructiveTool = makeMockToolDef({
+            execute: vi.fn().mockResolvedValue({ deleted: true }),
+            requiresConfirmation: true,
+        });
+        const registry = makeMockRegistry({ delete_repo: destructiveTool });
+        const ctx = makeMockContext({ toolRegistry: registry });
+        const state = {
+            type: 'executing',
+            queue: [],
+            current: { toolCallId: 'call-danger', toolName: 'delete_repo', args: { name: 'foo' } },
+            results: [],
+        };
+        const result = await transition(state, ctx);
+        expect(result.next.type).toBe('confirming');
+        expect(destructiveTool.execute).not.toHaveBeenCalled();
+        // ConfirmationRequired SSE event should be emitted
+        const confirmEvents = result.effects.filter((e) => e.type === SSEEventType.ConfirmationRequired);
+        expect(confirmEvents.length).toBe(1);
+    });
+    it('executes requiresConfirmation tools after approval (no re-confirm loop)', async () => {
+        const destructiveTool = makeMockToolDef({
+            execute: vi.fn().mockResolvedValue({ deleted: true }),
+            requiresConfirmation: true,
+        });
+        const registry = makeMockRegistry({ delete_repo: destructiveTool });
+        // Pre-populate confirmedCallIds as if CONFIRMING already approved this call
+        const ctx = makeMockContext({ toolRegistry: registry });
+        ctx.confirmedCallIds.add('call-approved');
+        const state = {
+            type: 'executing',
+            queue: [],
+            current: { toolCallId: 'call-approved', toolName: 'delete_repo', args: { name: 'foo' } },
+            results: [],
+        };
+        const result = await transition(state, ctx);
+        // Should execute this time, not route back to CONFIRMING
+        expect(result.next.type).toBe('thinking');
+        expect(destructiveTool.execute).toHaveBeenCalledTimes(1);
+    });
+    it('connection tool does NOT re-prompt after confirmedCallIds marks the call', async () => {
+        // Regression test for the latent infinite-loop bug: a connection tool
+        // whose ACL gate returns requiresConfirmation=true used to re-route back
+        // to CONFIRMING on every pass, since the permission checker has no
+        // notion of "already approved." confirmedCallIds fixes this.
+        const connectionTool = makeMockToolDef({
+            execute: vi.fn().mockResolvedValue({ ok: true }),
+            metadata: { category: 'connection', connection: 'github' },
+        });
+        const registry = makeMockRegistry({ request: connectionTool });
+        const ctx = makeMockContext({
+            toolRegistry: registry,
+            permissionChecker: {
+                check: vi.fn().mockReturnValue({
+                    allowed: true,
+                    requiresConfirmation: true,
+                    reason: 'Write to github requires confirmation',
+                }),
+            },
+        });
+        // Simulate: CONFIRMING has already approved this call
+        ctx.confirmedCallIds.add('call-gh-write');
+        const state = {
+            type: 'executing',
+            queue: [],
+            current: {
+                toolCallId: 'call-gh-write',
+                toolName: 'request',
+                args: { method: 'POST', endpoint: '/repos/foo', intent: 'confirmed_write' },
+            },
+            results: [],
+        };
+        const result = await transition(state, ctx);
+        // Should execute the connection tool instead of re-routing to CONFIRMING
+        expect(result.next.type).toBe('thinking');
+        expect(connectionTool.execute).toHaveBeenCalledTimes(1);
+        // No ConfirmationRequired SSE event should have been emitted
+        const confirmEvents = result.effects.filter((e) => e.type === SSEEventType.ConfirmationRequired);
+        expect(confirmEvents.length).toBe(0);
+    });
     it('transitions to compacting when context exceeds threshold', async () => {
         const tool = makeMockToolDef({
             // Return a large result to inflate context
@@ -540,6 +811,161 @@ describe('handleExecuting (via transition)', () => {
         // The cached result should be used — tool.execute should NOT be called again
         expect(readTool.execute).not.toHaveBeenCalled();
     });
+    // -------------------------------------------------------------------------
+    // Parallel tool calls: batch contiguous read-only calls
+    // -------------------------------------------------------------------------
+    it('batches contiguous read-only calls and runs them concurrently', async () => {
+        // Two read-only tools. Each sleeps before resolving. If batched in
+        // parallel, total wall time ≈ max(sleep). If sequential, ≈ sum(sleep).
+        const sleep = (ms) => new Promise((r) => setTimeout(() => r('ok'), ms));
+        const readA = makeMockToolDef({
+            readOnly: true,
+            execute: vi.fn(() => sleep(50)),
+        });
+        const readB = makeMockToolDef({
+            readOnly: true,
+            execute: vi.fn(() => sleep(50)),
+        });
+        const registry = makeMockRegistry({ read_a: readA, read_b: readB });
+        const ctx = makeMockContext({ toolRegistry: registry });
+        const state = {
+            type: 'executing',
+            queue: [{ toolCallId: 'call-b', toolName: 'read_b', args: {} }],
+            current: { toolCallId: 'call-a', toolName: 'read_a', args: {} },
+            results: [],
+        };
+        const startedAt = Date.now();
+        const result = await transition(state, ctx);
+        const elapsed = Date.now() - startedAt;
+        // Both executed
+        expect(readA.execute).toHaveBeenCalledTimes(1);
+        expect(readB.execute).toHaveBeenCalledTimes(1);
+        // Parallel: should finish in roughly one sleep, well under the sum
+        expect(elapsed).toBeLessThan(90);
+        // Batch drained the queue and transitioned to thinking in one step
+        expect(result.next.type).toBe('thinking');
+        // Both results appended to messages
+        const toolMessages = ctx.messages.filter((m) => m.role === 'tool');
+        expect(toolMessages).toHaveLength(2);
+        // Per-call SSE events emitted (2 start + 2 result)
+        const starts = result.effects.filter((e) => e.type === SSEEventType.ToolCallStart);
+        const results = result.effects.filter((e) => e.type === SSEEventType.ToolCallResult);
+        expect(starts).toHaveLength(2);
+        expect(results).toHaveLength(2);
+    });
+    it('stops batching at the first write (non-readOnly) tool', async () => {
+        const readTool = makeMockToolDef({ readOnly: true, execute: vi.fn().mockResolvedValue('r') });
+        const writeTool = makeMockToolDef({ readOnly: false, execute: vi.fn().mockResolvedValue('w') });
+        const registry = makeMockRegistry({ read: readTool, write: writeTool });
+        const ctx = makeMockContext({ toolRegistry: registry });
+        const state = {
+            type: 'executing',
+            queue: [
+                { toolCallId: 'call-read-2', toolName: 'read', args: {} },
+                { toolCallId: 'call-write', toolName: 'write', args: {} },
+                { toolCallId: 'call-read-3', toolName: 'read', args: {} },
+            ],
+            current: { toolCallId: 'call-read-1', toolName: 'read', args: {} },
+            results: [],
+        };
+        const result = await transition(state, ctx);
+        // Batched the two leading reads; the write stopped the batch
+        expect(readTool.execute).toHaveBeenCalledTimes(2);
+        expect(writeTool.execute).not.toHaveBeenCalled();
+        // Next state should process the write sequentially
+        expect(result.next.type).toBe('executing');
+        if (result.next.type === 'executing') {
+            expect(result.next.current.toolCallId).toBe('call-write');
+            expect(result.next.queue).toHaveLength(1);
+            expect(result.next.queue[0].toolCallId).toBe('call-read-3');
+        }
+    });
+    it('does not batch when the current call is a write', async () => {
+        const writeTool = makeMockToolDef({ readOnly: false, execute: vi.fn().mockResolvedValue('w') });
+        const readTool = makeMockToolDef({ readOnly: true, execute: vi.fn().mockResolvedValue('r') });
+        const registry = makeMockRegistry({ write: writeTool, read: readTool });
+        const ctx = makeMockContext({ toolRegistry: registry });
+        const state = {
+            type: 'executing',
+            queue: [{ toolCallId: 'call-read', toolName: 'read', args: {} }],
+            current: { toolCallId: 'call-write', toolName: 'write', args: {} },
+            results: [],
+        };
+        const result = await transition(state, ctx);
+        // Only write executes; read stays in queue for the next transition
+        expect(writeTool.execute).toHaveBeenCalledTimes(1);
+        expect(readTool.execute).not.toHaveBeenCalled();
+        expect(result.next.type).toBe('executing');
+        if (result.next.type === 'executing') {
+            expect(result.next.current.toolCallId).toBe('call-read');
+        }
+    });
+    it('does not batch connection tools (any call could transition to CONFIRMING)', async () => {
+        const connRead = makeMockToolDef({
+            readOnly: true,
+            execute: vi.fn().mockResolvedValue('x'),
+            metadata: { category: 'connection', connection: 'github' },
+        });
+        const registry = makeMockRegistry({ request: connRead });
+        const ctx = makeMockContext({ toolRegistry: registry });
+        const state = {
+            type: 'executing',
+            queue: [{ toolCallId: 'call-2', toolName: 'request', args: { method: 'GET', endpoint: '/x' } }],
+            current: { toolCallId: 'call-1', toolName: 'request', args: { method: 'GET', endpoint: '/y' } },
+            results: [],
+        };
+        const result = await transition(state, ctx);
+        // Only the first ran; the second stays queued for its own ACL check
+        expect(connRead.execute).toHaveBeenCalledTimes(1);
+        expect(result.next.type).toBe('executing');
+    });
+    it('does not batch read-only tools that require confirmation', async () => {
+        const gated = makeMockToolDef({
+            readOnly: true,
+            requiresConfirmation: true,
+            execute: vi.fn().mockResolvedValue('x'),
+        });
+        const registry = makeMockRegistry({ gated });
+        const ctx = makeMockContext({ toolRegistry: registry });
+        const state = {
+            type: 'executing',
+            queue: [{ toolCallId: 'call-2', toolName: 'gated', args: {} }],
+            current: { toolCallId: 'call-1', toolName: 'gated', args: {} },
+            results: [],
+        };
+        const result = await transition(state, ctx);
+        // Routes to CONFIRMING, no execution yet
+        expect(result.next.type).toBe('confirming');
+        expect(gated.execute).not.toHaveBeenCalled();
+    });
+    it('a failure in one batched call does not block the others', async () => {
+        const good = makeMockToolDef({ readOnly: true, execute: vi.fn().mockResolvedValue('ok') });
+        const bad = makeMockToolDef({
+            readOnly: true,
+            execute: vi.fn().mockRejectedValue(new Error('boom')),
+        });
+        const registry = makeMockRegistry({ good, bad });
+        const ctx = makeMockContext({ toolRegistry: registry });
+        const state = {
+            type: 'executing',
+            queue: [
+                { toolCallId: 'call-bad', toolName: 'bad', args: {} },
+                { toolCallId: 'call-good-2', toolName: 'good', args: {} },
+            ],
+            current: { toolCallId: 'call-good-1', toolName: 'good', args: {} },
+            results: [],
+        };
+        const result = await transition(state, ctx);
+        // All three tried, failure surfaced as an error tool-result for the bad one
+        expect(good.execute).toHaveBeenCalledTimes(2);
+        expect(bad.execute).toHaveBeenCalledTimes(1);
+        expect(result.next.type).toBe('thinking');
+        const toolMessages = ctx.messages.filter((m) => m.role === 'tool');
+        expect(toolMessages).toHaveLength(3);
+        // Error result is present in the SSE stream
+        const errorEvents = result.effects.filter((e) => e.type === SSEEventType.ToolCallResult && e.status === 'error');
+        expect(errorEvents).toHaveLength(1);
+    });
 });
 describe('handleConfirming (via transition)', () => {
     it('approved confirmation resumes executing', async () => {
@@ -571,6 +997,30 @@ describe('handleConfirming (via transition)', () => {
         // A denial message should have been appended
         expect(ctx.messages.length).toBeGreaterThan(0);
     });
+    it('approved confirmation marks the callId in ctx.confirmedCallIds', async () => {
+        const ctx = makeMockContext({
+            waitForConfirmation: vi.fn().mockResolvedValue(true),
+        });
+        const state = {
+            type: 'confirming',
+            call: { toolCallId: 'call-XYZ', toolName: 'delete_item', args: { id: '123' } },
+            remainingQueue: [],
+        };
+        await transition(state, ctx);
+        expect(ctx.confirmedCallIds.has('call-XYZ')).toBe(true);
+    });
+    it('denied confirmation does NOT mark callId as confirmed', async () => {
+        const ctx = makeMockContext({
+            waitForConfirmation: vi.fn().mockResolvedValue(false),
+        });
+        const state = {
+            type: 'confirming',
+            call: { toolCallId: 'call-DENIED', toolName: 'delete_item', args: { id: '123' } },
+            remainingQueue: [],
+        };
+        await transition(state, ctx);
+        expect(ctx.confirmedCallIds.has('call-DENIED')).toBe(false);
+    });
     it('intercepts dispatch_task and transitions to DISPATCHING', async () => {
         const dispatchTool = {
             description: 'Dispatch sub-task',
@@ -659,9 +1109,10 @@ describe('handleCompacting (via transition)', () => {
         if (result.next.type === 'thinking') {
             // Should have fewer messages (summary + recent turns)
             expect(result.next.messages.length).toBeLessThan(messages.length);
-            // First message should be the system summary
+            // First message should be the compaction summary (user role, not system,
+            // because Anthropic rejects system messages after user/assistant turns)
             const firstMsg = result.next.messages[0];
-            expect(firstMsg.role).toBe('system');
+            expect(firstMsg.role).toBe('user');
             const firstContent = firstMsg.content;
             expect(typeof firstContent === 'string' && firstContent.includes('Conversation Summary')).toBe(true);
         }
@@ -837,6 +1288,50 @@ describe('handleDispatching (via transition)', () => {
             agent: 'broken-agent',
         }));
     });
+    it('propagates parent remaining token budget to child', async () => {
+        // Parent has 100 budget, 90 already used → child should get 10.
+        // Child's first mock turn yields 150 tokens, which exceeds the child's
+        // 10-token budget; the child's outer loop catches it on the next check
+        // and stops with budget_exceeded. Parent usage reflects the child's
+        // consumed tokens once the child merges back.
+        const parentCtx = makeMockContext({
+            maxSessionTokens: 100,
+            usage: { inputTokens: 60, outputTokens: 30, totalTokens: 90 },
+        });
+        const result = await transition({
+            type: 'dispatching',
+            task: { agentName: 'starved-child', toolSubset: [], prompt: 'Do lots of work' },
+            toolCallId: 'tc-starved',
+            queue: [],
+            results: [],
+        }, parentCtx);
+        // Parent should resume (doesn't crash on child budget exhaustion)
+        expect(result.next.type).toBe('thinking');
+        // Child should have stopped early — its merged-back token usage should
+        // not massively exceed the original budget, because the check fires on
+        // the next outer loop iteration after the first 150-token turn.
+        // (It won't be zero — the first turn runs fully and merges — but it
+        // won't compound across many turns.)
+        expect(parentCtx.usage.totalTokens).toBeLessThanOrEqual(90 + 150 + 150);
+    });
+    it('child inherits unlimited budget when parent has no cap', async () => {
+        // No maxSessionTokens on parent → child should also have no cap (undefined).
+        // The child runs through normal termination (model_stop), not budget.
+        const parentCtx = makeMockContext({
+            // maxSessionTokens intentionally omitted
+            usage: { inputTokens: 500, outputTokens: 500, totalTokens: 1000 },
+        });
+        const result = await transition({
+            type: 'dispatching',
+            task: { agentName: 'unbounded-child', toolSubset: [], prompt: 'Go' },
+            toolCallId: 'tc-unbounded',
+            queue: [],
+            results: [],
+        }, parentCtx);
+        expect(result.next.type).toBe('thinking');
+        // No agent_loop_budget_exceeded log should have fired for the child
+        expect(parentCtx.logger.warn).not.toHaveBeenCalledWith('agent_loop_budget_exceeded', expect.anything());
+    });
 });
 // ---------------------------------------------------------------------------
 // 3. Integration: runAgent() full flow
@@ -974,6 +1469,76 @@ describe('runAgent', () => {
         // Turn count should not exceed maxTurns
         expect(ctx.turnCount).toBeLessThanOrEqual(3);
     });
+    it('token budget terminates the loop with reason=budget_exceeded', async () => {
+        const tool = makeMockToolDef();
+        const registry = makeMockRegistry({ loop_tool: tool });
+        // Each turn yields 15 tokens (10 in + 5 out). With maxSessionTokens=30, the loop
+        // should stop after the 2nd turn pushes cumulative usage past the cap.
+        const provider = {
+            model: 'test-model',
+            provider: 'test',
+            languageModel: {},
+            streamText: vi.fn(() => makeMockStream([
+                { type: 'tool-call', toolCallId: `c-${Date.now()}`, toolName: 'loop_tool', args: {} },
+                { type: 'finish', usage: makeUsage({ inputTokens: 10, outputTokens: 5, totalTokens: 15 }) },
+            ], '')),
+            generateText: vi.fn(),
+        };
+        const ctx = makeMockContext({
+            provider,
+            toolRegistry: registry,
+            maxTurns: 100,
+            maxSessionTokens: 30,
+        });
+        const events = [];
+        for await (const event of runAgent({
+            messages: [{ role: 'user', content: 'Burn tokens' }],
+            context: ctx,
+        })) {
+            events.push(event);
+        }
+        // Should have terminated on budget, not max_turns
+        const doneEvent = events[events.length - 1];
+        expect(doneEvent.type).toBe(SSEEventType.Done);
+        expect(ctx.turnCount).toBeLessThan(100);
+        expect(ctx.usage.totalTokens).toBeGreaterThanOrEqual(30);
+    });
+    it('undefined maxSessionTokens means no budget cap', async () => {
+        // Same infinite-tool-call provider as max_turns test, but with no
+        // maxSessionTokens set and a small maxTurns to bound the test. Verifies that
+        // undefined budget doesn't accidentally trip the check.
+        const tool = makeMockToolDef();
+        const registry = makeMockRegistry({ loop_tool: tool });
+        const provider = {
+            model: 'test-model',
+            provider: 'test',
+            languageModel: {},
+            streamText: vi.fn(() => makeMockStream([
+                { type: 'tool-call', toolCallId: `c-${Date.now()}`, toolName: 'loop_tool', args: {} },
+                { type: 'finish', usage: makeUsage({ inputTokens: 100, outputTokens: 100, totalTokens: 200 }) },
+            ], '')),
+            generateText: vi.fn(),
+        };
+        const ctx = makeMockContext({
+            provider,
+            toolRegistry: registry,
+            maxTurns: 2,
+            // maxSessionTokens intentionally omitted
+        });
+        const events = [];
+        for await (const event of runAgent({
+            messages: [{ role: 'user', content: 'Run' }],
+            context: ctx,
+        })) {
+            events.push(event);
+        }
+        // Should stop on max_turns, budget check should not interfere
+        const doneEvent = events[events.length - 1];
+        expect(doneEvent.type).toBe(SSEEventType.Done);
+        expect(ctx.usage.totalTokens).toBeGreaterThan(0);
+        // No budget-exceeded log should have been emitted
+        // (positive assertion: we reached max_turns, accumulating tokens beyond any tiny cap)
+    });
     it('done event always includes usage regardless of reason (G2)', async () => {
         // Abort immediately
         const abortController = new AbortController();
@@ -1019,7 +1584,6 @@ describe('runAgent', () => {
         }
         expect(ctx.logger.info).toHaveBeenCalledWith('agent_loop_start', expect.objectContaining({
             session: 'test-session',
-            tenant: 'test-tenant',
         }));
         expect(ctx.logger.info).toHaveBeenCalledWith('agent_loop_done', expect.objectContaining({
             session: 'test-session',