@iowarp/clio-coder 0.4.4 → 0.4.5

package/src/engine/antigravity/subprocess-runtime.ts

@@ -117,6 +117,15 @@ export function buildAgyArgs(input: WorkerRunInput, gateEnv: NodeJS.ProcessEnv =
 		"--disable-slash-commands",
 	];
 	if (input.wireModelId.trim().length > 0) args.push("--model", input.wireModelId.trim());
+	if (typeof input.sessionId === "string" && input.sessionId.length > 0) {
+		if (Buffer.byteLength(input.sessionId, "utf8") > MAX_CONVERSATION_ID_BYTES) {
+			throw new Error(`Antigravity sessionId exceeded ${MAX_CONVERSATION_ID_BYTES} bytes`);
+		}
+		if (/\p{Cc}/u.test(input.sessionId)) {
+			throw new Error("Antigravity sessionId must not contain control characters");
+		}
+		args.push("--conversation", input.sessionId);
+	}
 	return args;
 }
 
@@ -245,7 +254,12 @@ function emitTextDelta(emit: WorkerEventEmit, state: StreamState, delta: string)
 	} as AgentEvent);
 }
 
-async function readStream(child: AntigravityChildProcess, emit: WorkerEventEmit, state: StreamState): Promise<void> {
+async function readStream(
+	child: AntigravityChildProcess,
+	emit: WorkerEventEmit,
+	state: StreamState,
+	requestedConversationId: string | undefined,
+): Promise<void> {
 	for await (const bounded of readBoundedLines(child.stdout, {
 		maxLineBytes: ANTIGRAVITY_MAX_STREAM_LINE_BYTES,
 		maxTotalBytes: ANTIGRAVITY_MAX_STREAM_BYTES,
@@ -272,6 +286,9 @@ async function readStream(child: AntigravityChildProcess, emit: WorkerEventEmit,
 					break;
 				}
 				state.initSeen = true;
+				if (requestedConversationId && event.conversationId !== requestedConversationId) {
+					protocolFailure(state, "requested conversation was not resumed");
+				}
 				state.conversationId = boundedConversationId(event.conversationId);
 				if (event.model?.trim()) state.model = event.model.trim();
 				break;
@@ -354,8 +371,7 @@ function buildAssistantMessage(input: {
 		stopReason: input.aborted ? "aborted" : succeeded ? "stop" : "error",
 		timestamp: Date.now(),
 	} as AgentMessage & { role: "assistant" };
-	// Opaque provider observation only. This runtime never accepts it as a
-	// resumable Clio session id.
+	// Opaque provider observation only; callers must explicitly request resume.
 	if (input.conversationId) message.responseId = input.conversationId;
 	if (input.diagnostic) message.errorMessage = boundedExternalDiagnostic(input.diagnostic);
 	return message;
@@ -414,7 +430,7 @@ export function startAntigravityWorkerRun(
 		emit({ type: "agent_start" } as AgentEvent);
 		try {
 			const stderrPromise = readStderr(child);
-			const stdoutPromise = readStream(child, emit, streamState).catch((cause) => {
+			const stdoutPromise = readStream(child, emit, streamState, input.sessionId).catch((cause) => {
 				streamError = boundedExternalDiagnostic(cause instanceof Error ? cause.message : String(cause));
 				terminator.terminate();
 			});

package/src/engine/api-registry.ts

@@ -27,6 +27,7 @@ import "@earendil-works/pi-ai/providers/images/register-builtins";
 
 import { getEngineEnvApiKey } from "./env-api-keys.js";
 import { engineModels } from "./models.js";
+import { instrumentProviderCall } from "./provider-diagnostics.js";
 
 export interface EngineRegisteredApiProvider extends ProviderStreams {
 	api: Api;
@@ -134,7 +135,7 @@ function hasCloudflareAuth(options?: StreamOptions): boolean {
 	);
 }
 
-export function engineStream(
+function dispatchEngineStream(
 	model: Model<Api>,
 	context: Context,
 	options?: StreamOptions,
@@ -151,7 +152,7 @@ export function engineStream(
 	return resolved(model.api).stream(model, context, withEnvApiKey(model, options));
 }
 
-export function engineStreamSimple(
+function dispatchEngineStreamSimple(
 	model: Model<Api>,
 	context: Context,
 	options?: SimpleStreamOptions,
@@ -168,6 +169,22 @@ export function engineStreamSimple(
 	return resolved(model.api).streamSimple(model, context, withEnvApiKey(model, options));
 }
 
+export function engineStream(
+	model: Model<Api>,
+	context: Context,
+	options?: StreamOptions,
+): AssistantMessageEventStream {
+	return instrumentProviderCall(model, options, (effective) => dispatchEngineStream(model, context, effective));
+}
+
+export function engineStreamSimple(
+	model: Model<Api>,
+	context: Context,
+	options?: SimpleStreamOptions,
+): AssistantMessageEventStream {
+	return instrumentProviderCall(model, options, (effective) => dispatchEngineStreamSimple(model, context, effective));
+}
+
 export async function completeEngineSimple(
 	model: Model<Api>,
 	context: Context,

package/src/engine/apis/openai-completions.ts

@@ -297,13 +297,14 @@ function withLiteLLMRouteFailureAdvice(
 	(async () => {
 		try {
 			for await (const event of source) {
-				if (event.type === "error") {
+				if (event.type === "error" && event.reason !== "aborted" && event.error.stopReason !== "aborted") {
 					event.error.errorMessage = liteLLMRouteFailureMessage(event.error.errorMessage, metadata.targetId, model.id);
 				}
 				advised.push(event as AssistantMessageEvent);
 			}
 			advised.end();
 		} catch (err) {
+			if (err instanceof Error && err.name === "AbortError") throw err;
 			const message = err instanceof Error ? err.message : String(err);
 			throw new Error(liteLLMRouteFailureMessage(message, metadata.targetId, model.id));
 		}
@@ -922,11 +923,17 @@ function guardMalformedToolCalls(
 	(async () => {
 		try {
 			for await (const event of source) {
-				if (event.type === "toolcall_end") {
-					const required = requiredByTool.get(event.toolCall.name);
-					if (required && hasEmptyArguments(event.toolCall.arguments)) {
-						const message = malformedToolArgsMessage(model, event.toolCall.name, required);
-						const error = finalErrorFromPartial(event.partial, message);
+				// The final stop reason distinguishes malformed output from a token
+				// limit. pi rejects every call in a length-truncated message (even
+				// salvage-parsed arguments) and continues with error tool results.
+				// Turning that into an error here aborts the worker before recovery.
+				if (event.type === "done" && event.message.stopReason !== "length") {
+					const malformed = event.message.content.find(
+						(block) => block.type === "toolCall" && requiredByTool.has(block.name) && hasEmptyArguments(block.arguments),
+					);
+					if (malformed?.type === "toolCall") {
+						const message = malformedToolArgsMessage(model, malformed.name, requiredByTool.get(malformed.name) ?? []);
+						const error = finalErrorFromPartial(event.message, message);
 						guarded.push({ type: "error", reason: "error", error });
 						guarded.end(error);
 						return;

package/src/engine/apis/output-budget.ts

@@ -32,18 +32,38 @@ export function setGlobalDefaultMaxOutputTokens(value: number): void {
 
 /**
  * Tokens a preflight context check should hold back for the response: the
- * smaller of the model's advertised output limit and the default output
- * budget. The safety margin is deliberately not added here; at request time
+ * smaller of the model's advertised output limit and the configured output
+ * budget, falling back to the product default when no budget is configured.
+ * The safety margin is deliberately not added here; at request time
  * {@link remainingContextMaxTokens} subtracts it from the window and degrades
  * the output budget gracefully, so a hard preflight reservation of
  * limit + safety would compact earlier than the engine actually needs.
  */
-export function resolveReservedOutputTokens(maxOutputTokens?: number | null): number {
+export function resolveReservedOutputTokens(
+	maxOutputTokens?: number | null,
+	request?: { api: string; contextWindow: number; inputTokens: number },
+): number {
+	const requested = globalDefaultMaxOutputTokens > 0 ? globalDefaultMaxOutputTokens : DEFAULT_MAX_OUTPUT_TOKENS;
 	const limit =
 		typeof maxOutputTokens === "number" && Number.isFinite(maxOutputTokens) && maxOutputTokens > 0
 			? maxOutputTokens
-			: DEFAULT_MAX_OUTPUT_TOKENS;
-	return Math.min(limit, DEFAULT_MAX_OUTPUT_TOKENS);
+			: Number.POSITIVE_INFINITY;
+	const ceiling = Math.min(limit, requested);
+	// These Clio transports already reduce the wire ceiling to remaining room.
+	// Preflight must use that same allocation, rather than demanding room for
+	// the entire configured maximum (which may equal the context window).
+	// Other transports retain their existing reservation contract.
+	return request && (request.api === "openai-completions" || request.api === "ollama-native")
+		? clampOutputToRemainingContext(ceiling, request.contextWindow, request.inputTokens)
+		: ceiling;
+}
+
+function clampOutputToRemainingContext(ceiling: number, contextWindow: number, inputTokens: number): number {
+	const available =
+		contextWindow > 0 && Number.isFinite(contextWindow)
+			? Math.max(1, contextWindow - inputTokens - CONTEXT_BUDGET_SAFETY_TOKENS)
+			: Number.POSITIVE_INFINITY;
+	return Math.min(ceiling, available);
 }
 
 export function estimateInputTokensFromContext(context: Context): number {
@@ -59,15 +79,11 @@ export function remainingContextMaxTokens(
 	options: Pick<StreamOptions, "maxTokens"> | undefined,
 	limits?: { contextWindow?: number; maxOutputTokens?: number },
 ): number {
-	const safety = CONTEXT_BUDGET_SAFETY_TOKENS;
 	const inputTokens = estimateInputTokensFromContext(context);
 	const configuredContextWindow = model.contextWindow > 0 ? model.contextWindow : Number.POSITIVE_INFINITY;
 	const loadedContextWindow =
 		limits?.contextWindow !== undefined && limits.contextWindow > 0 ? limits.contextWindow : Number.POSITIVE_INFINITY;
 	const contextWindow = Math.min(configuredContextWindow, loadedContextWindow);
-	const budget = Number.isFinite(contextWindow)
-		? Math.max(1, contextWindow - inputTokens - safety)
-		: Number.POSITIVE_INFINITY;
 	const modelLimit = model.maxTokens > 0 ? model.maxTokens : Number.POSITIVE_INFINITY;
 	// Precedence for the requested ceiling when the caller gave no explicit
 	// maxTokens: a more-specific tool-turn limit, then the global default, then
@@ -84,6 +100,6 @@ export function remainingContextMaxTokens(
 					? modelLimit
 					: DEFAULT_MAX_OUTPUT_TOKENS;
 	const requested = options?.maxTokens ?? defaultLimit;
-	const resolved = Math.min(requested, modelLimit, budget);
+	const resolved = clampOutputToRemainingContext(Math.min(requested, modelLimit), contextWindow, inputTokens);
 	return Number.isFinite(resolved) ? resolved : DEFAULT_MAX_OUTPUT_TOKENS;
 }

package/src/engine/claude/sdk-runtime.ts

@@ -314,7 +314,7 @@ export interface ClaudeWorkerBudgetGate {
 }
 
 /** Canonical call counter shared by the SDK's PreToolUse/canUseTool mediation seam. */
-function createClaudeWorkerBudgetGate(
+export function createClaudeWorkerBudgetGate(
 	budget: WorkerBudget,
 	onBoundary: () => void,
 	onHardCap: () => void,
@@ -330,6 +330,7 @@ function createClaudeWorkerBudgetGate(
 	let admitted = 0;
 	let locked = false;
 	const phaseDecision = (canonicalToolName: string): { kind: "allow" } | { kind: "deny"; reason: string } => {
+		if (budget.mode === "advisory") return { kind: "allow" };
 		const reserveAdmits = isReserveAdmittedTool(canonicalToolName, deliveryTools);
 		if (locked || admitted >= budget.toolCalls) {
 			// Same rule the native guard applies: the soft budget ends discovery,
@@ -365,7 +366,7 @@ function createClaudeWorkerBudgetGate(
 	return {
 		attempt(canonicalToolName) {
 			attempts += 1;
-			if (attempts > budget.hardCap) {
+			if (budget.mode !== "advisory" && attempts > budget.hardCap) {
 				onHardCap();
 				return { kind: "deny", reason: `workerToolCallCap reached (${budget.hardCap}); abort run` };
 			}
@@ -381,7 +382,7 @@ function createClaudeWorkerBudgetGate(
 			// Locking here is what ends the work phase. A delivery-capable agent is
 			// not locked at its soft budget: it still owes the files it was
 			// dispatched to write, and hardCap in attempt() is its bound.
-			if (admitted >= budget.toolCalls && deliveryTools.length === 0) {
+			if (budget.mode !== "advisory" && admitted >= budget.toolCalls && deliveryTools.length === 0) {
 				locked = true;
 				onBoundary();
 			}

package/src/engine/env-api-keys.ts

@@ -12,6 +12,7 @@ const ENV_KEYS: Readonly<Record<string, string>> = {
 	"ant-ling": "ANT_LING_API_KEY",
 	"qwen-token-plan": "QWEN_TOKEN_PLAN_API_KEY",
 	"qwen-token-plan-cn": "QWEN_TOKEN_PLAN_CN_API_KEY",
+	"qwen-token-plan-individual": "QWEN_TOKEN_PLAN_API_KEY",
 	openai: "OPENAI_API_KEY",
 	"azure-openai-responses": "AZURE_OPENAI_API_KEY",
 	nvidia: "NVIDIA_API_KEY",
@@ -59,7 +60,7 @@ function apiKeyEnvVars(provider: string): readonly string[] | undefined {
 	return name ? [name] : undefined;
 }
 
-/** Synchronous provider-key discovery pinned to pi-ai 0.84's public behavior. */
+/** Synchronous provider-key discovery pinned to pi-ai 0.85's public behavior. */
 export function findEngineEnvKeys(provider: string, env?: ProviderEnv): string[] | undefined {
 	const names = apiKeyEnvVars(provider);
 	if (!names) return undefined;

package/src/engine/external-subprocess.ts

@@ -1,4 +1,4 @@
-import type { ChildProcessByStdio } from "node:child_process";
+import { type ChildProcessByStdio, spawn } from "node:child_process";
 import type { Readable } from "node:stream";
 
 import { boundedExternalDiagnostic } from "../core/external-diagnostic.js";
@@ -81,15 +81,18 @@ export interface ProcessTreeTerminator {
 	cleanup(): void;
 }
 
-/** POSIX process-group termination with a direct-child fallback; Windows is direct-child only. */
+/** POSIX process groups or Windows taskkill trees, with a direct-child fallback. */
 export function createProcessTreeTerminator(
 	child: { pid?: number | undefined; exitCode: number | null; kill(signal?: NodeJS.Signals): boolean },
 	graceMs = 1500,
+	options: { platform?: NodeJS.Platform; spawn?: typeof spawn } = {},
 ): ProcessTreeTerminator {
+	const platform = options.platform ?? process.platform;
+	const spawnKiller = options.spawn ?? spawn;
 	let sent = false;
 	let timer: ReturnType<typeof setTimeout> | null = null;
 	const signal = (name: NodeJS.Signals): void => {
-		if (child.pid && process.platform !== "win32") {
+		if (child.pid && platform !== "win32") {
 			try {
 				process.kill(-child.pid, name);
 				return;
@@ -97,6 +100,14 @@ export function createProcessTreeTerminator(
 				// The child may not have established its group yet.
 			}
 		}
+		if (platform === "win32" && child.pid !== undefined && Number.isSafeInteger(child.pid) && child.pid > 0) {
+			const args = ["/PID", String(child.pid), "/T", ...(name === "SIGKILL" ? ["/F"] : [])];
+			const killer = spawnKiller("taskkill.exe", args, { stdio: "ignore", windowsHide: true });
+			killer.once("error", () => {
+				if (child.exitCode === null) child.kill(name);
+			});
+			return;
+		}
 		if (child.exitCode !== null) return;
 		child.kill(name);
 	};

package/src/engine/loop-guard.ts

@@ -441,6 +441,8 @@ export interface CreateLoopGuardRegistrationOptions {
 	 * operator who can intervene; workers do not).
 	 */
 	toolCallCap?: number;
+	/** Observe estimated work without disabling tools; fault-loop detection remains active. */
+	toolBudgetAdvisory?: boolean;
 	/**
 	 * Worker only: successful exploration attempts allowed before a graceful,
 	 * text-only synthesis phase. Unlike {@link toolCallCap}, crossing this soft
@@ -523,8 +525,10 @@ export interface LoopGuardRegistration extends MiddlewareHookRegistration {
 
 export function createLoopGuardRegistration(options: CreateLoopGuardRegistrationOptions): LoopGuardRegistration {
 	const budget = options.turnBlockBudget ?? INTERACTIVE_LOOP_BLOCK_BUDGET;
-	const cap = options.toolCallCap;
+	const cap = options.toolBudgetAdvisory ? undefined : options.toolCallCap;
+	let advisoryEmitted = false;
 	let softLimit =
+		!options.toolBudgetAdvisory &&
 		options.toolCallSoftLimit !== undefined &&
 		Number.isSafeInteger(options.toolCallSoftLimit) &&
 		options.toolCallSoftLimit > 0 &&
@@ -561,7 +565,8 @@ export function createLoopGuardRegistration(options: CreateLoopGuardRegistration
 	 * has no cap and no bound here; it has an operator instead.
 	 */
 	let deniedAttempts = 0;
-	const denialBudget = cap === undefined ? undefined : Math.max(cap, WIDE_BATCH_DENIAL_FLOOR);
+	const denialBudget =
+		options.toolCallCap === undefined ? undefined : Math.max(options.toolCallCap, WIDE_BATCH_DENIAL_FLOOR);
 	const boundRunDenials = (
 		effects: ReadonlyArray<MiddlewareEffect>,
 		input: MiddlewareHookInput,
@@ -948,6 +953,18 @@ export function createLoopGuardRegistration(options: CreateLoopGuardRegistration
 				recordSuccessfulResult(input);
 				recordResultForStagnation(input);
 				const effects = [...crossArgumentResultEffects(input)];
+				if (
+					options.toolBudgetAdvisory &&
+					!advisoryEmitted &&
+					count >= (options.toolCallSoftLimit ?? options.toolCallCap ?? Infinity)
+				) {
+					advisoryEmitted = true;
+					effects.push({
+						kind: "annotate_tool_result",
+						message: `Advisory tool estimate reached (${count} calls). Reassess remaining work and finish the assignment; tools remain available. Explicit task requirements still apply.`,
+						severity: "warn",
+					});
+				}
 				if (
 					softReadReserveEntered &&
 					softLockout === null &&

package/src/engine/provider-diagnostics.ts

@@ -0,0 +1,129 @@
+import { randomUUID } from "node:crypto";
+import { closeSync, constants, fstatSync, openSync, writeFileSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import type { Api, AssistantMessageEventStream, Model, StreamOptions } from "@earendil-works/pi-ai";
+import { findEngineEnvKeys } from "./env-api-keys.js";
+
+/** Process-owned opt-in reaches every native engine call, including prewarm and workers. */
+export function instrumentProviderCall<T extends StreamOptions>(
+	model: Model<Api>,
+	options: T | undefined,
+	invoke: (options: T | undefined) => AssistantMessageEventStream,
+): AssistantMessageEventStream {
+	let effective = options;
+	if (model.api === "anthropic-messages" && options?.cacheRetention === undefined) {
+		const retention = process.env.CLIO_CODER_ANTHROPIC_CACHE_RETENTION;
+		if (retention !== undefined && retention !== "") {
+			if (retention !== "none" && retention !== "short" && retention !== "long") {
+				throw new Error("CLIO_CODER_ANTHROPIC_CACHE_RETENTION must be none, short, or long");
+			}
+			effective = { ...options, cacheRetention: retention } as T;
+		}
+	}
+	const path = process.env.CLIO_CODER_PROVIDER_DUMP_PATH;
+	if (!path) return invoke(effective);
+	const sink = openDump(path);
+	const payloads: unknown[] = [];
+	const redact = diagnosticSerializer(model, effective);
+	const callId = randomUUID();
+	const onPayload = effective?.onPayload;
+	const instrumented = {
+		...effective,
+		onPayload: async (payload: unknown, currentModel: Model<Api>) => {
+			// Caller-owned thinking/tool/schema patches finish first. Snapshot now:
+			// providers and callbacks can retain or mutate their objects afterward.
+			const replacement = await onPayload?.(payload, currentModel);
+			try {
+				payloads.push(JSON.parse(redact(replacement === undefined ? payload : replacement)));
+			} catch {
+				payloads.push({ diagnosticError: "payload could not be serialized" });
+			}
+			return replacement;
+		},
+	} as T;
+	const finish = (terminal: { response: unknown } | { error: string }) => {
+		try {
+			writeFileSync(sink, `${redact({ callId, api: model.api, model: model.id, payloads, ...terminal })}\n`, "utf8");
+		} catch {
+			// Diagnostics must not turn a completed provider call into a retry or
+			// inject content into the ledger. Report only the sink failure category.
+			process.emitWarning("Provider diagnostic dump could not be written", { code: "CLIO_CODER_PROVIDER_DUMP_FAILED" });
+		} finally {
+			try {
+				closeSync(sink);
+			} catch {
+				process.emitWarning("Provider diagnostic dump could not be closed", { code: "CLIO_CODER_PROVIDER_DUMP_FAILED" });
+			}
+		}
+	};
+	try {
+		const stream = invoke(instrumented);
+		// result() observes the existing terminal promise; it never consumes the
+		// event iterator that the agent and durable ledger projection own.
+		void stream.result().then(
+			(response) => finish({ response }),
+			(error) => finish({ error: String(error) }),
+		);
+		return stream;
+	} catch (error) {
+		finish({ error: error instanceof Error ? error.message : String(error) });
+		throw error;
+	}
+}
+
+/** Refuse insecure existing files instead of silently changing their permissions. */
+function openDump(path: string): number {
+	if (!isAbsolute(path)) throw new Error("CLIO_CODER_PROVIDER_DUMP_PATH must be an absolute file path");
+	const fd = openSync(
+		path,
+		constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK,
+		0o600,
+	);
+	try {
+		const stat = fstatSync(fd);
+		if (
+			!stat.isFile() ||
+			(stat.mode & 0o777) !== 0o600 ||
+			(process.getuid !== undefined && stat.uid !== process.getuid())
+		) {
+			throw new Error("CLIO_CODER_PROVIDER_DUMP_PATH must be an operator-owned regular file with mode 0600");
+		}
+		return fd;
+	} catch (error) {
+		closeSync(fd);
+		throw error;
+	}
+}
+
+function diagnosticSerializer(model: Model<Api>, options: StreamOptions | undefined): (value: unknown) => string {
+	const secrets = new Set<string>();
+	const ambientKeys = (findEngineEnvKeys(model.provider, options?.env) ?? []).map(
+		(name) => options?.env?.[name] || process.env[name],
+	);
+	for (const key of [options?.apiKey, ...ambientKeys]) {
+		if (key && key !== "<authenticated>") secrets.add(key);
+	}
+	for (const headers of [options?.headers, model.headers]) {
+		for (const [key, value] of Object.entries(headers ?? {})) {
+			if (typeof value === "string" && value.length > 0 && /auth|api[-_]?key|cookie|token|secret/iu.test(key)) {
+				secrets.add(value);
+				const token = value.match(/^(?:Bearer|Basic)\s+(.+)$/iu)?.[1];
+				if (token) secrets.add(token);
+			}
+		}
+	}
+	return (value) => {
+		// This is a body-level diagnostic, never an HTTP/auth/options dump. Keep
+		// nested tool schemas intact, including tools with a parameter named headers.
+		const body =
+			typeof value === "object" && value !== null && !Array.isArray(value)
+				? Object.fromEntries(
+						Object.entries(value).filter(([key]) => !/^(?:headers|env|apiKey|api_key|authorization)$/iu.test(key)),
+					)
+				: value;
+		let serialized = JSON.stringify(body);
+		if (serialized === undefined) serialized = "null";
+		for (const secret of secrets) serialized = serialized.replaceAll(JSON.stringify(secret).slice(1, -1), "[REDACTED]");
+		return serialized;
+	};
+}

package/src/engine/provider-payload.ts

@@ -150,7 +150,9 @@ export function patchToolChoiceNamedPayload(
 			if (Object.keys(outputConfig).length > 0) patched.output_config = outputConfig;
 			else delete patched.output_config;
 		}
-		return { ...patched, tools, tool_choice: { type: "tool", name: toolName } };
+		// Keep the cacheable schema prefix intact. The request-level choice
+		// already identifies the required tool; narrowing changes it twice.
+		return { ...patched, tool_choice: { type: "tool", name: toolName } };
 	}
 	if (model.api === "google-generative-ai" || model.api === "google-vertex") {
 		if (!isRecord(payload.config) || payload.config.tools === undefined || payload.config.tools === null)

package/src/engine/worker-runtime.ts

@@ -215,6 +215,14 @@ function assistantMessageText(message: AgentMessage | undefined): string | null
  */
 function isTerminalAssistantMessage(message: AgentMessage | undefined): boolean {
 	if (!isAssistantMessage(message)) return false;
+	// pi refuses truncated tool calls and continues with their error results.
+	// That turn has no final artifact/report to repair yet.
+	if (
+		message.stopReason === "length" &&
+		Array.isArray(message.content) &&
+		message.content.some((block) => block.type === "toolCall")
+	)
+		return false;
 	return message.stopReason !== "toolUse" && message.stopReason !== "error";
 }
 
@@ -442,6 +450,7 @@ export function startWorkerRun(input: WorkerRunInput, emit: WorkerEventEmit): Wo
 	const loopGuardRegistration = createLoopGuardRegistration({
 		safety,
 		toolCallCap: workerBudget.hardCap,
+		toolBudgetAdvisory: workerBudget.mode === "advisory",
 		toolCallSoftLimit: workerBudget.toolCalls,
 		// A worker's blocks all land in one run-long bucket, so the bound on
 		// them is a statement about this run's length, not about a turn.
@@ -600,6 +609,7 @@ export function startWorkerRun(input: WorkerRunInput, emit: WorkerEventEmit): Wo
 		invokeOptions: () => ({
 			correlationId: `worker-model-round-${workerModelRound}`,
 			toolResultMaxBytes: workerSettings.context.toolResultMaxBytes,
+			supportsImages: model.input.includes("image"),
 			...(agentSkillPolicy ? { pendingSkillPolicy: agentSkillPolicy } : {}),
 		}),
 	});
@@ -724,8 +734,9 @@ export function startWorkerRun(input: WorkerRunInput, emit: WorkerEventEmit): Wo
 							stopAfterToolResultCallId = null;
 						}
 					}
-					const revisionToolsAvailable = resultContractRevisionActive && !synthesisToolLock;
-					// A repair without preauthorized growth remains terminal and text-only.
+					const revisionToolsAvailable =
+						(workerBudget.mode === "advisory" || resultContractRevisionActive) && !synthesisToolLock;
+					// Legacy enforced budgets need preauthorized growth to retain repair tools.
 					if (!revisionToolsAvailable) synthesisToolLock = true;
 					// Delivered as a paired tool exchange, never a user turn. Templates
 					// that key history rendering off the last `user` message re-render

package/src/engine/worker-tools.ts

@@ -114,7 +114,11 @@ export function createWorkerSafety(options: WorkerSafetyOptions = {}): SafetyCon
 		},
 		scopes: { readonly: READONLY_SCOPE, workspace: WORKSPACE_SCOPE, confirmed: CONFIRMED_SCOPE },
 		isSubset,
-		policy: { metadata: (posture) => policyEngine.metadata(posture) },
+		policy: {
+			metadata: (posture) => policyEngine.metadata(posture),
+			allowsObservationPath: (path) =>
+				policyEngine.evaluate({ tool: "read", args: { path } }).reasonCode !== "path-policy:zeroAccessPaths",
+		},
 		audit: { recordCount: () => 0 },
 	};
 }

package/src/entry/extension-reload.ts

@@ -125,6 +125,7 @@ export function createExtensionReloadCoordinator(deps: ExtensionReloadCoordinato
 			workspaceRoot: workspace,
 			...(captured !== null ? { capturedSources: captured } : {}),
 			recordReceipt: deps.recordReceipt,
+			report: deps.report,
 			...(deps.runCommand !== undefined ? { runCommand: deps.runCommand } : {}),
 			...(deps.now !== undefined ? { now: deps.now } : {}),
 		});