@jungjaehoon/mama-os 0.32.0 → 0.32.2

package/dist/agent/agent-loop.js

@@ -54,11 +54,15 @@ const fs_1 = require("fs");
 const prompt_size_monitor_js_1 = require("./prompt-size-monitor.js");
 const skill_loader_js_1 = require("./skill-loader.js");
 const persistent_cli_adapter_js_1 = require("./persistent-cli-adapter.js");
+const cline_cli_adapter_js_1 = require("./cline-cli-adapter.js");
+const cline_native_tool_policy_js_1 = require("./cline-native-tool-policy.js");
 const runtime_process_js_1 = require("../multi-agent/runtime-process.js");
 const model_runner_js_1 = require("./model-runner.js");
 const gateway_tool_executor_js_1 = require("./gateway-tool-executor.js");
 const run_guard_js_1 = require("../envelope/run-guard.js");
 const tool_registry_js_1 = require("./tool-registry.js");
+const gateway_tool_catalog_js_1 = require("./gateway-tool-catalog.js");
+const private_connector_policy_js_1 = require("../connectors/private-connector-policy.js");
 const index_js_1 = require("./code-act/index.js");
 const index_js_2 = require("../concurrency/index.js");
 const session_pool_js_1 = require("./session-pool.js");
@@ -73,6 +77,14 @@ const pre_compact_handler_js_1 = require("./pre-compact-handler.js");
 const debugLogger = __importStar(require("@jungjaehoon/mama-core/debug-logger"));
 const { DebugLogger } = debugLogger;
 const logger = new DebugLogger('AgentLoop');
+const MODEL_RUNNER_AGENT_ERROR_CODES = {
+    timeout: 'NETWORK_ERROR',
+    crash: 'CLI_ERROR',
+    context_overflow: 'MAX_TOKENS',
+    auth_failure: 'AUTH_ERROR',
+    rate_limit: 'RATE_LIMIT',
+    unknown: 'CLI_ERROR',
+};
 /**
  * Default configuration
  */
@@ -85,6 +97,11 @@ const DEFAULT_TOOLS_CONFIG = {
     mcp: [],
     mcp_config: '~/.mama/mama-mcp-config.json',
 };
+const DEFAULT_PRIVATE_CONNECTOR_POLICY = (0, private_connector_policy_js_1.resolvePrivateConnectorPolicy)({
+    ok: true,
+    config: {},
+    enabledNames: [],
+});
 // Exported so the conductor test can PIN that 'conductor' is absent: the
 // conductor must run on its own session:operator:conductor lane, never the
 // global operator lane where Stage-2 workers serialize (deadlock topology).
@@ -309,33 +326,23 @@ function loadComposedSystemPrompt(verbose = false, context) {
  * Load Gateway Tools prompt from MD file
  * These tools are executed by GatewayToolExecutor, NOT MCP
  */
-// Cache gateway-tools.md content (static at runtime, no need to re-read)
-let _gatewayToolsCache = null;
-// Cache filtered versions keyed by sorted disallowed list
-const _filteredCache = new Map();
 function getGatewayToolsPrompt(disallowed) {
-    if (!_gatewayToolsCache) {
-        const gatewayToolsPath = (0, path_1.join)(__dirname, 'gateway-tools.md');
-        if ((0, fs_1.existsSync)(gatewayToolsPath)) {
-            _gatewayToolsCache = (0, fs_1.readFileSync)(gatewayToolsPath, 'utf-8');
-        }
-        else {
-            logger.warn('gateway-tools.md not found, using registry fallback');
-            _gatewayToolsCache = `# Gateway Tools\n\n${tool_registry_js_1.ToolRegistry.generateFallbackPrompt()}`;
-        }
-    }
-    if (!disallowed?.length)
-        return _gatewayToolsCache;
-    const cacheKey = [...disallowed].sort().join(',');
-    let filtered = _filteredCache.get(cacheKey);
-    if (!filtered) {
-        filtered = _gatewayToolsCache;
-        for (const tool of disallowed) {
-            filtered = filtered.replace(new RegExp(`^- \\*\\*${tool}\\*\\*.*$`, 'gm'), '');
-        }
-        _filteredCache.set(cacheKey, filtered);
-    }
-    return filtered;
+    return (0, gateway_tool_catalog_js_1.buildGatewayToolCatalog)({
+        surface: 'multi-agent-generic',
+        allowedTools: ['*'],
+        blockedTools: disallowed,
+        privateConnectorPolicy: DEFAULT_PRIVATE_CONNECTOR_POLICY,
+    }).prompt;
+}
+function getRunGatewayToolsPrompt(context, disallowed) {
+    return (0, gateway_tool_catalog_js_1.buildGatewayToolCatalog)({
+        surface: context
+            ? (0, private_connector_policy_js_1.resolvePrivatePrincipalSurface)({ agentContext: context })
+            : 'multi-agent-generic',
+        allowedTools: context?.role.allowedTools ?? ['*'],
+        blockedTools: [...(context?.role.blockedTools ?? []), ...(disallowed ?? [])],
+        privateConnectorPolicy: DEFAULT_PRIVATE_CONNECTOR_POLICY,
+    }).prompt;
 }
 const CANONICAL_CODE_ACT_HEADING = '## Code-Act: Gateway Tool Execution via Sandbox';
 const CODE_ACT_MCP_COMPAT_NAME = 'mcp__code-act__code_act';
@@ -370,26 +377,20 @@ function wrapGeneratedPromptSection(kind, content) {
 }
 function stripGenericGatewayToolsCatalog(systemPrompt) {
     const withoutMarked = stripMarkedPromptSection(systemPrompt, GENERATED_GATEWAY_TOOLS_START, GENERATED_GATEWAY_TOOLS_END);
-    const headingPattern = /^#{1,6}\s+Gateway Tools\s*$/gm;
-    let catalogStart = -1;
-    let match;
-    while ((match = headingPattern.exec(withoutMarked)) !== null) {
-        catalogStart = match.index;
-    }
+    const generatedCatalog = getGatewayToolsPrompt();
+    const catalogStart = withoutMarked.lastIndexOf(generatedCatalog);
     if (catalogStart < 0) {
         return withoutMarked;
     }
-    const catalog = withoutMarked.slice(catalogStart);
-    if (!catalog.includes('Call tools via JSON block:') || !catalog.includes('```tool_call')) {
+    const catalogEnd = catalogStart + generatedCatalog.length;
+    const startsAtLayerBoundary = catalogStart === 0 ||
+        /\r?\n\r?\n---[ \t]*\r?\n\r?\n$/.test(withoutMarked.slice(0, catalogStart));
+    const endsAtLayerBoundary = catalogEnd === withoutMarked.length ||
+        /^\r?\n\r?\n---[ \t]*\r?\n\r?\n/.test(withoutMarked.slice(catalogEnd));
+    if (!startsAtLayerBoundary || !endsAtLayerBoundary) {
         return withoutMarked;
     }
-    const generatedCatalog = getGatewayToolsPrompt();
-    if (withoutMarked.startsWith(generatedCatalog, catalogStart)) {
-        return removePromptSection(withoutMarked, catalogStart, catalogStart + generatedCatalog.length);
-    }
-    const boundedSeparator = catalog.match(/\r?\n\r?\n---[ \t]*\r?\n\r?\n/);
-    const sectionEnd = boundedSeparator?.index ?? catalog.length;
-    return removePromptSection(withoutMarked, catalogStart, catalogStart + sectionEnd);
+    return removePromptSection(withoutMarked, catalogStart, catalogEnd);
 }
 function stripTrailingCanonicalCodeActSection(systemPrompt) {
     const withoutMarked = stripMarkedPromptSection(systemPrompt, GENERATED_CODE_ACT_START, GENERATED_CODE_ACT_END);
@@ -515,6 +516,11 @@ class AgentLoop {
     // overlapping owner chat) would steal each other's callbacks and leak tiers
     // if these were instance fields.
     disallowedTools;
+    clineNativeAllowedTools;
+    clineNativeDisallowedTools;
+    clineNativePolicyConfigured;
+    clineAllowSpawnAgent;
+    clineAllowAgentTeams;
     constructor(_oauthManager, options = {}, _clientOptions, executorOptions) {
         // Initialize tools config (hybrid Gateway/MCP routing)
         this.toolsConfig = {
@@ -534,7 +540,9 @@ class AgentLoop {
         const useGatewayMode = gatewayTools.includes('*') || gatewayTools.length > 0;
         const useMCPMode = mcpTools.includes('*') || mcpTools.length > 0;
         this.useCodeAct = options.useCodeAct ?? false;
-        this.isGatewayMode = useGatewayMode || (options.backend === 'codex' && this.useCodeAct);
+        this.isGatewayMode =
+            useGatewayMode ||
+                ((options.backend === 'codex' || options.backend === 'cline') && this.useCodeAct);
         this.disallowedTools = this.useCodeAct
             ? options.disallowedTools
             : [
@@ -544,6 +552,13 @@ class AgentLoop {
                     CODE_ACT_MCP_COMPAT_NAME,
                 ]),
             ];
+        this.clineNativeAllowedTools = [...(options.clineNativeAllowedTools ?? [])];
+        this.clineNativeDisallowedTools = [...(options.clineNativeDisallowedTools ?? [])];
+        this.clineNativePolicyConfigured =
+            options.clineNativeAllowedTools !== undefined ||
+                options.clineNativeDisallowedTools !== undefined;
+        this.clineAllowSpawnAgent = options.clineAllowSpawnAgent ?? false;
+        this.clineAllowAgentTeams = options.clineAllowAgentTeams ?? false;
         if (useGatewayMode && useMCPMode) {
             logger.debug('🔀 Hybrid mode: Gateway + MCP tools enabled');
         }
@@ -647,7 +662,7 @@ class AgentLoop {
                 promptLayers.push({ name: 'codeAct', content: codeActPrompt, priority: 2 });
             }
             else if (!this.useCodeAct && backend !== 'codex') {
-                const gatewayToolsPrompt = getGatewayToolsPrompt(this.disallowedTools);
+                const gatewayToolsPrompt = getRunGatewayToolsPrompt(options.agentContext, this.disallowedTools);
                 if (gatewayToolsPrompt) {
                     promptLayers.push({
                         name: 'gatewayTools',
@@ -700,6 +715,25 @@ class AgentLoop {
             });
             logger.debug('Codex app-server backend enabled');
         }
+        else if (this.backend === 'cline') {
+            const workspaceDir = options.clineCwd ?? (0, path_1.join)((0, os_1.homedir)(), '.mama', 'workspace');
+            if (!(0, fs_1.existsSync)(workspaceDir)) {
+                (0, fs_1.mkdirSync)(workspaceDir, { recursive: true });
+            }
+            this.agent = new cline_cli_adapter_js_1.ClineCLIAdapter({
+                command: options.clineCommand,
+                provider: options.clineProvider ?? 'cline',
+                model: options.model,
+                systemPrompt: defaultSystemPrompt,
+                cwd: workspaceDir,
+                // Cline receives MAMA CodeAct as a session-bound Hub custom tool.
+                // Its shared daemon owns native MCP settings independently.
+                dataDir: options.clineDataDir,
+                requestTimeout: options.timeoutMs,
+                sessionId,
+            });
+            logger.debug('Cline CLI backend enabled');
+        }
         else {
             // Claude backend: always use PersistentCLI for fast responses (~2-3s vs ~16-30s)
             this.persistentCLI = new persistent_cli_adapter_js_1.PersistentCLIAdapter({
@@ -938,6 +972,12 @@ class AgentLoop {
         if (this.stopped) {
             throw new types_js_1.AgentError('Agent loop is stopping', 'AGENT_STOPPED', undefined, false);
         }
+        if (options?.agentContext) {
+            options = {
+                ...options,
+                agentContext: this.mcpExecutor.projectPrivateAgentContext(options.agentContext),
+            };
+        }
         const runScope = {
             streamCallbacks: options?.streamCallbacks,
             tier: 1,
@@ -984,8 +1024,20 @@ class AgentLoop {
         let ownedSession = false;
         // Set session ID on the agent
         // Claude PersistentCLI: process alive → CONTINUE (stdin message), process dead → NEW (spawn with --session-id)
-        // Codex: threadId alive → CONTINUE (codex-reply), threadId null → NEW (codex tool)
+        // Codex/Cline: durable runtime session alive → CONTINUE, missing → NEW.
         const isCodex = this.backend === 'codex';
+        const isCline = this.backend === 'cline';
+        const isDurableRuntime = isCodex || isCline;
+        const clineRole = options?.agentContext?.role;
+        const clineAllowedTools = this.clineNativePolicyConfigured
+            ? this.clineNativeAllowedTools
+            : (0, cline_native_tool_policy_js_1.projectClineNativeTools)(clineRole?.allowedTools);
+        const clineDisallowedTools = this.clineNativePolicyConfigured
+            ? this.clineNativeDisallowedTools
+            : (0, cline_native_tool_policy_js_1.projectClineNativeTools)(clineRole?.blockedTools);
+        const clineDelegationBlocked = clineRole?.blockedTools?.includes('delegate') ?? false;
+        const clineAllowSpawnAgent = this.clineAllowSpawnAgent && !clineDelegationBlocked;
+        const clineAllowAgentTeams = this.clineAllowAgentTeams && !clineDelegationBlocked;
         const codeActPolicy = this.useCodeAct
             ? (0, index_js_1.projectCodeActToolPolicy)({
                 tier: runScope.tier,
@@ -998,12 +1050,12 @@ class AgentLoop {
             })
             : undefined;
         const outerCodeActAllowed = this.useCodeAct && roleAllowsOuterCodeAct(options?.agentContext?.role, this.disallowedTools);
-        const effectiveSessionPolicyFingerprint = isCodex && codeActPolicy
+        const effectiveSessionPolicyFingerprint = isDurableRuntime && codeActPolicy
             ? combineCodeActSessionPolicyFingerprint(options?.sessionPolicyFingerprint, codeActPolicy)
             : options?.sessionPolicyFingerprint;
         let resolvedCliSessionId = options?.cliSessionId ?? null;
         const sessionLabel = (isNew) => {
-            if (isCodex) {
+            if (isDurableRuntime) {
                 return isNew ? 'NEW thread' : 'CONTINUE thread';
             }
             return isNew ? 'NEW process' : 'CONTINUE session';
@@ -1012,7 +1064,7 @@ class AgentLoop {
             // Session routing travels per prompt() call via resolvedCliSessionId - no
             // shared-adapter mutation (setSessionId re-pointed channelKey/currentProcess
             // across awaits, cross-wiring concurrent lanes).
-            console.log(`[AgentLoop] [${isCodex ? 'codex' : 'claude'}] ${channelKey} (${sessionLabel(sessionIsNew)})`);
+            console.log(`[AgentLoop] [${this.backend}] ${channelKey} (${sessionLabel(sessionIsNew)})`);
         }
         else if (options?.freshSession) {
             // Stateless lanes (operator reports): session context is a cache, not
@@ -1023,7 +1075,7 @@ class AgentLoop {
             sessionIsNew = true;
             ownedSession = true;
             resolvedCliSessionId = cliSessionId;
-            console.log(`[AgentLoop] [${isCodex ? 'codex' : 'claude'}] ${channelKey} (FRESH session - stateless lane)`);
+            console.log(`[AgentLoop] [${this.backend}] ${channelKey} (FRESH session - stateless lane)`);
         }
         else {
             // Fallback: get session from pool (for direct AgentLoop usage)
@@ -1036,7 +1088,7 @@ class AgentLoop {
             ownedSession = true;
             resolvedCliSessionId = cliSessionId;
             // Per-call routing via resolvedCliSessionId - no shared-adapter mutation.
-            console.log(`[AgentLoop] [${isCodex ? 'codex' : 'claude'}] ${channelKey} (${sessionLabel(isNew)})`);
+            console.log(`[AgentLoop] [${this.backend}] ${channelKey} (${sessionLabel(isNew)})`);
         }
         try {
             if (this.shouldBeginModelRun(options)) {
@@ -1050,7 +1102,7 @@ class AgentLoop {
             let nativeToolCallCount = 0;
             let nativeConsecutiveToolCalls = 0;
             let nativeLastToolSignature = '';
-            const hostToolBridge = isCodex && this.isGatewayMode
+            const hostToolBridge = isDurableRuntime && this.isGatewayMode
                 ? {
                     tools: this.useCodeAct
                         ? outerCodeActAllowed
@@ -1092,13 +1144,18 @@ class AgentLoop {
                             name: call.name,
                             input: call.input,
                         };
-                        history.push({ role: 'assistant', content: [toolUse] });
-                        runScope.onTurn?.({
-                            turn,
-                            role: 'assistant',
-                            content: [toolUse],
-                            stopReason: 'tool_use',
-                        });
+                        // Codex does not return completed host exchanges, so record them
+                        // here. Cline reports the paired custom-tool exchange from its Hub
+                        // event stream and AgentLoop appends it exactly once below.
+                        if (isCodex) {
+                            history.push({ role: 'assistant', content: [toolUse] });
+                            runScope.onTurn?.({
+                                turn,
+                                role: 'assistant',
+                                content: [toolUse],
+                                stopReason: 'tool_use',
+                            });
+                        }
                         const callExecutionContext = toolExecutionContext
                             ? {
                                 ...toolExecutionContext,
@@ -1118,13 +1175,15 @@ class AgentLoop {
                         if (!toolResult.terminalCode) {
                             callSignal.throwIfAborted();
                         }
-                        const persistedToolResult = historyToolResult(toolResult);
-                        history.push({ role: 'user', content: [persistedToolResult] });
-                        runScope.onTurn?.({
-                            turn,
-                            role: 'user',
-                            content: [persistedToolResult],
-                        });
+                        if (isCodex) {
+                            const persistedToolResult = historyToolResult(toolResult);
+                            history.push({ role: 'user', content: [persistedToolResult] });
+                            runScope.onTurn?.({
+                                turn,
+                                role: 'user',
+                                content: [persistedToolResult],
+                            });
+                        }
                         return {
                             content: toolResult.content,
                             isError: toolResult.is_error === true,
@@ -1144,7 +1203,7 @@ class AgentLoop {
                     if (outerCodeActAllowed) {
                         const policy = codeActPolicy;
                         const typeDefs = index_js_1.TypeDefinitionGenerator.generate(policy);
-                        gatewayToolsPrompt = wrapGeneratedPromptSection('codeAct', (0, index_js_1.getCodeActInstructions)(isCodex ? 'codex' : 'claude', policy.names) +
+                        gatewayToolsPrompt = wrapGeneratedPromptSection('codeAct', (0, index_js_1.getCodeActInstructions)(this.backend, policy.names) +
                             '\n```typescript\n' +
                             typeDefs +
                             '\n```');
@@ -1153,12 +1212,23 @@ class AgentLoop {
                 else if (this.isGatewayMode && !isCodex) {
                     baseSystemPrompt = stripDisabledCodeActGuidance(baseSystemPrompt);
                     if (!isResumingSession) {
-                        // Non-CodeAct callers may already embed the generic gateway catalog.
-                        const alreadyHasTools = baseSystemPrompt.includes('# Gateway Tools') ||
-                            baseSystemPrompt.includes('# Code Execution') ||
-                            baseSystemPrompt.includes('## Code-Act');
-                        if (!alreadyHasTools) {
-                            gatewayToolsPrompt = wrapGeneratedPromptSection('gatewayTools', getGatewayToolsPrompt(this.disallowedTools));
+                        if (options?.gatewayToolsPrompt !== undefined) {
+                            // A short-lived caller may carry a more specific final policy than
+                            // the process-wide default. Replace the host-generated constructor
+                            // catalog with that exact policy-keyed catalog for this run.
+                            baseSystemPrompt = stripGenericGatewayToolsCatalog(baseSystemPrompt);
+                            if (options.gatewayToolsPrompt) {
+                                gatewayToolsPrompt = wrapGeneratedPromptSection('gatewayTools', options.gatewayToolsPrompt);
+                            }
+                        }
+                        else {
+                            // Non-CodeAct callers may already embed the generic gateway catalog.
+                            const alreadyHasTools = baseSystemPrompt.includes('# Gateway Tools') ||
+                                baseSystemPrompt.includes('# Code Execution') ||
+                                baseSystemPrompt.includes('## Code-Act');
+                            if (!alreadyHasTools) {
+                                gatewayToolsPrompt = wrapGeneratedPromptSection('gatewayTools', getRunGatewayToolsPrompt(options?.agentContext, this.disallowedTools));
+                            }
                         }
                     }
                 }
@@ -1193,22 +1263,30 @@ class AgentLoop {
                 return effectivePrompt;
             };
             let perCallSystemPrompt;
-            if (options?.systemPrompt || (this.isGatewayMode && this.useCodeAct)) {
+            if (isCline && this.isGatewayMode && this.useCodeAct && !sessionIsNew) {
+                // TG-05: a compatible Cline Hub session ignores the per-call system prompt.
+                // Keep the continuation stub cheap; missing/mismatched sessions rebuild the
+                // complete policy lazily through freshSessionSystemPrompt below.
+                perCallSystemPrompt = options?.systemPrompt ?? this.defaultSystemPrompt;
+            }
+            else if (options?.systemPrompt ||
+                options?.gatewayToolsPrompt !== undefined ||
+                (this.isGatewayMode && this.useCodeAct)) {
                 perCallSystemPrompt = prepareSystemPrompt(options?.systemPrompt, options?.resumeSession === true);
             }
             else {
                 perCallSystemPrompt = this.defaultSystemPrompt;
                 console.log(`[AgentLoop] No systemPrompt in options - using spawn default for this call`);
             }
-            // Codex re-anchors a rehydrated durable thread through thread/resume's
-            // baseInstructions rather than replaying instructions as user text. A CONTINUE
+            // Durable backends re-anchor a lost session with the complete current policy.
+            // A CONTINUE
             // turn's per-call prompt is deliberately minimal (message-router
             // buildMinimalResumePrompt), so resuming with it would REPLACE the thread's full
             // policy with a stub - only freshSessionSystemPrompt rebuilds the complete one.
             // That rebuild costs an embedding search, so hand the backend a lazy builder it
             // invokes only inside the resume branch; a live thread never pays for it.
             const freshSystemPromptBuilder = options?.freshSessionSystemPrompt;
-            const resumeInstructions = isCodex && freshSystemPromptBuilder
+            const resumeInstructions = isDurableRuntime && freshSystemPromptBuilder
                 ? async () => prepareSystemPrompt(await freshSystemPromptBuilder(), false)
                 : undefined;
             // Reset StopContinuation state for this channel to prevent leaking
@@ -1266,24 +1344,27 @@ class AgentLoop {
                 };
                 let piResult;
                 // Claude: First turn → --session-id (inject system prompt), subsequent → --resume
-                // Codex: resumeSession only controls threadId reset (false=new thread, true=continue)
-                let shouldResume = isCodex
+                // Codex/Cline: resumeSession controls durable session reset/continuation.
+                let shouldResume = isDurableRuntime
                     ? turn > 1 || (options?.freshSession === true ? false : (options?.resumeSession ?? true))
                     : !sessionIsNew || turn > 1;
                 let requestSystemPrompt = perCallSystemPrompt;
-                let provisionalCodexSessionId;
-                // Both Claude PersistentCLI and Codex app-server preserve context - only send new messages
+                let provisionalDurableSessionId;
+                // All three backends preserve context and receive only the new user message.
                 const promptText = this.formatLastMessageOnly(history);
                 const promptStart = Date.now();
                 const throwFinalCliError = (error) => {
                     const normalizedError = error instanceof Error ? error : new Error(String(error));
+                    const modelRunnerErrorCode = normalizedError instanceof model_runner_js_1.ModelRunnerError
+                        ? MODEL_RUNNER_AGENT_ERROR_CODES[normalizedError.code]
+                        : undefined;
                     const errorType = normalizedError instanceof types_js_1.McpResultMissingError ||
                         normalizedError instanceof types_js_1.McpCompletedMutationInterruptedError ||
                         normalizedError instanceof types_js_1.ClaudeToolStreamProtocolError
                         ? normalizedError.code
                         : normalizedError instanceof model_runner_js_1.HostToolTerminalError
                             ? normalizedError.terminalCode
-                            : 'CLI_ERROR';
+                            : (modelRunnerErrorCode ?? 'CLI_ERROR');
                     this.onMetric?.('prompt_error', 1, {
                         backend: this.backend,
                         error_type: errorType,
@@ -1297,12 +1378,15 @@ class AgentLoop {
                     if (normalizedError instanceof model_runner_js_1.HostToolTerminalError) {
                         throw new types_js_1.AgentError(normalizedError.message, normalizedError.terminalCode, normalizedError, false);
                     }
+                    if (normalizedError instanceof model_runner_js_1.HostToolAbortError) {
+                        throw new types_js_1.AgentError(normalizedError.message, 'CLI_ERROR', normalizedError, false);
+                    }
                     if (normalizedError instanceof types_js_1.McpResultMissingError ||
                         normalizedError instanceof types_js_1.McpCompletedMutationInterruptedError ||
                         normalizedError instanceof types_js_1.ClaudeToolStreamProtocolError) {
                         throw new types_js_1.AgentError(normalizedError.message, normalizedError.code, normalizedError, false);
                     }
-                    throw new types_js_1.AgentError(`CLI error: ${normalizedError.message}`, 'CLI_ERROR', normalizedError, true);
+                    throw new types_js_1.AgentError(`CLI error: ${normalizedError.message}`, modelRunnerErrorCode ?? 'CLI_ERROR', normalizedError, normalizedError instanceof model_runner_js_1.ModelRunnerError ? normalizedError.retryable : true);
                 };
                 const appendCompletedToolExchanges = (exchanges) => {
                     for (const exchange of exchanges) {
@@ -1322,7 +1406,7 @@ class AgentLoop {
                     }
                 };
                 try {
-                    const durablePolicyStatus = isCodex && turn === 1 && shouldResume
+                    const durablePolicyStatus = isDurableRuntime && turn === 1 && shouldResume
                         ? this.agent.getSessionPolicyStatus?.({
                             model: options?.model,
                             resumeSession: true,
@@ -1332,15 +1416,23 @@ class AgentLoop {
                             sessionId: resolvedCliSessionId ?? undefined,
                             requestTimeout: options?.requestTimeoutMs,
                             hostToolBridge,
+                            ...(isCline
+                                ? {
+                                    allowedTools: clineAllowedTools,
+                                    disallowedTools: clineDisallowedTools,
+                                    allowSpawnAgent: clineAllowSpawnAgent,
+                                    allowAgentTeams: clineAllowAgentTeams,
+                                }
+                                : {}),
                         })
                         : undefined;
                     if (durablePolicyStatus === 'mismatch' || durablePolicyStatus === 'missing') {
-                        console.log(`[AgentLoop] Codex durable session ${durablePolicyStatus}; ` +
+                        console.log(`[AgentLoop] ${this.backend} durable session ${durablePolicyStatus}; ` +
                             'opening the full policy before model request');
                         const newSessionId = this.sessionPool.resetSession(channelKey);
                         options?.onCliSessionReset?.(newSessionId);
                         resolvedCliSessionId = newSessionId;
-                        provisionalCodexSessionId = newSessionId;
+                        provisionalDurableSessionId = newSessionId;
                         try {
                             if (options?.freshSessionSystemPrompt) {
                                 requestSystemPrompt = prepareSystemPrompt(await options.freshSessionSystemPrompt(), false);
@@ -1348,7 +1440,7 @@ class AgentLoop {
                         }
                         catch (rebuildError) {
                             this.sessionPool.invalidateSession(channelKey, newSessionId);
-                            provisionalCodexSessionId = undefined;
+                            provisionalDurableSessionId = undefined;
                             attemptReportedError =
                                 rebuildError instanceof Error ? rebuildError : new Error(String(rebuildError));
                             throw rebuildError;
@@ -1368,13 +1460,21 @@ class AgentLoop {
                         requestTimeout: options?.requestTimeoutMs,
                         hostToolBridge,
                         toolExecutionContext,
+                        ...(isCline
+                            ? {
+                                allowedTools: clineAllowedTools,
+                                disallowedTools: clineDisallowedTools,
+                                allowSpawnAgent: clineAllowSpawnAgent,
+                                allowAgentTeams: clineAllowAgentTeams,
+                            }
+                            : {}),
                     });
-                    provisionalCodexSessionId = undefined;
+                    provisionalDurableSessionId = undefined;
                 }
                 catch (error) {
-                    if (provisionalCodexSessionId) {
-                        this.sessionPool.invalidateSession(channelKey, provisionalCodexSessionId);
-                        provisionalCodexSessionId = undefined;
+                    if (provisionalDurableSessionId) {
+                        this.sessionPool.invalidateSession(channelKey, provisionalDurableSessionId);
+                        provisionalDurableSessionId = undefined;
                     }
                     const errorMessage = error instanceof Error ? error.message : String(error);
                     console.error(`[AgentLoop] ${this.backend} CLI error:`, errorMessage);
@@ -1386,13 +1486,18 @@ class AgentLoop {
                         appendCompletedToolExchanges(error.completedToolExchanges);
                         throwFinalCliError(error);
                     }
+                    if (error instanceof model_runner_js_1.HostToolAbortError && error.completedToolExchanges.length > 0) {
+                        appendCompletedToolExchanges(error.completedToolExchanges);
+                        throwFinalCliError(error);
+                    }
                     // Check if this is a recoverable session error
                     // 1. "No conversation found" - CLI session was lost (daemon restart, timeout)
                     // 2. "Session ID already in use" - concurrent request conflict
                     // 3. "Prompt is too long" - session context exceeded API limits
                     const isSessionNotFound = errorMessage.includes('No conversation found with session ID');
                     const isSessionInUse = errorMessage.includes('is already in use');
-                    const isPromptTooLong = errorMessage.includes('Prompt is too long') ||
+                    const isPromptTooLong = (error instanceof model_runner_js_1.ModelRunnerError && error.code === 'context_overflow') ||
+                        errorMessage.includes('Prompt is too long') ||
                         errorMessage.includes('prompt is too long') ||
                         errorMessage.includes('request_too_large') ||
                         errorMessage.includes('context window') ||
@@ -1423,16 +1528,16 @@ class AgentLoop {
                         // Per-call routing: hand the new id to this prompt() and update the
                         // resolved id so later turns follow it - no shared-adapter mutation.
                         resolvedCliSessionId = newSessionId;
-                        // A policy mismatch can occur on a resumed MessageRouter session,
-                        // whose per-call prompt is intentionally minimal. Rebuild the full
-                        // policy prompt before opening the replacement durable thread.
+                        // A recoverable durable-session error can occur on a resumed
+                        // MessageRouter session whose per-call prompt is intentionally minimal.
+                        // Rebuild the full policy before opening every replacement session.
                         let resetSystemPrompt = perCallSystemPrompt;
                         try {
                             // Discard the recoverable first-attempt error before any reset
                             // preparation. A prompt rebuild or retry failure must surface
                             // its own final error, never the mismatch that triggered it.
                             attemptReportedError = undefined;
-                            if (isCodexPolicyMismatch && options?.freshSessionSystemPrompt) {
+                            if (options?.freshSessionSystemPrompt) {
                                 resetSystemPrompt = prepareSystemPrompt(await options.freshSessionSystemPrompt(), false);
                             }
                             piResult = await this.agent.prompt(promptText, callbacks, {
@@ -1446,6 +1551,14 @@ class AgentLoop {
                                 requestTimeout: options?.requestTimeoutMs,
                                 hostToolBridge,
                                 toolExecutionContext,
+                                ...(isCline
+                                    ? {
+                                        allowedTools: clineAllowedTools,
+                                        disallowedTools: clineDisallowedTools,
+                                        allowSpawnAgent: clineAllowSpawnAgent,
+                                        allowAgentTeams: clineAllowAgentTeams,
+                                    }
+                                    : {}),
                             });
                         }
                         catch (retryError) {
@@ -1483,7 +1596,7 @@ class AgentLoop {
                 const contentBlocks = [];
                 let parsedToolCalls = [];
                 // Parse tool_call / code_act blocks from text response (Gateway Tools mode ONLY)
-                if (this.isGatewayMode && !isCodex) {
+                if (this.isGatewayMode && !isDurableRuntime) {
                     parsedToolCalls = this.parseToolCallsFromText(piResult.response || '');
                     // Code-Act: parse ```js blocks only if enabled
                     if (this.useCodeAct) {
@@ -1560,9 +1673,9 @@ class AgentLoop {
                         // Ignore recording errors - never break the agent loop
                     }
                 }
-                // Track tokens in session pool for auto-reset at 80% context
-                const tokenBackend = this.backend === 'codex' ? 'codex' : 'claude';
-                const tokenStatus = this.sessionPool.updateTokens(channelKey, response.usage.input_tokens, tokenBackend);
+                // Preserve the SessionPool usage-status contract. Billing telemetry is
+                // recorded above; durable runtimes own model-aware compaction.
+                const tokenStatus = this.sessionPool.updateTokens(channelKey, response.usage.input_tokens, this.backend);
                 // Claude's MCP server may already have executed these tool calls while the
                 // prompt was streaming. Preserve the observed exchange in conversation
                 // order, but never put the completed tool_use back into executeTools().
@@ -1578,7 +1691,8 @@ class AgentLoop {
                 if (piResult.terminalError) {
                     throwFinalCliError(new model_runner_js_1.HostToolTerminalError(piResult.terminalError.code, piResult.terminalError.message));
                 }
-                // PreCompact: inject compaction summary when approaching context limit
+                // PreCompact remains available for a future authoritative occupancy
+                // signal. Runtime-owned sessions do not infer one from usage telemetry.
                 if (tokenStatus.nearThreshold && this.preCompactHandler && !runScope.preCompactInjected) {
                     runScope.preCompactInjected = true;
                     try {
@@ -1793,6 +1907,9 @@ class AgentLoop {
                 ...(options?.sourceTurnId ? { sourceTurnId: options.sourceTurnId } : {}),
                 ...(options?.sourceMessageRef ? { sourceMessageRef: options.sourceMessageRef } : {}),
                 ...(resolvedCliSessionId ? { cliSessionId: resolvedCliSessionId } : {}),
+                ...(options?.workorderAttemptId !== undefined
+                    ? { workorderAttemptId: options.workorderAttemptId }
+                    : {}),
             },
         };
     }
@@ -2003,6 +2120,7 @@ class AgentLoop {
      * Persistent CLI maintains context automatically, so we only send the new message
      */
     formatLastMessageOnly(history) {
+        const imageReaderTool = this.backend === 'cline' ? 'read_files' : this.backend === 'codex' ? 'view_image' : 'Read';
         // Find the last user message in the history
         for (let i = history.length - 1; i >= 0; i--) {
             const msg = history[i];
@@ -2022,9 +2140,9 @@ class AgentLoop {
                         else if (block.type === 'image' && block.localPath) {
                             parts.push(`⚠️ CRITICAL: The user has uploaded an image file.\n` +
                                 `Image path: ${block.localPath}\n` +
-                                `You MUST call the Read tool on "${block.localPath}" to view this image FIRST.\n` +
+                                `You MUST call the ${imageReaderTool} tool on "${block.localPath}" to view this image FIRST.\n` +
                                 `DO NOT describe or guess the image contents without reading it.\n` +
-                                `DO NOT say you cannot read images - the Read tool supports image files.`);
+                                `DO NOT say you cannot read images - ${imageReaderTool} supports image files.`);
                         }
                         else if (block.type === 'image' && block.source?.data) {
                             // Base64-encoded image — save to disk so persistent CLI can read it
@@ -2048,9 +2166,9 @@ class AgentLoop {
                                 fs.writeFileSync(imagePath, Buffer.from(block.source.data, 'base64'));
                                 parts.push(`⚠️ CRITICAL: The user has uploaded an image file.\n` +
                                     `Image path: ${imagePath}\n` +
-                                    `You MUST call the Read tool on "${imagePath}" to view this image FIRST.\n` +
+                                    `You MUST call the ${imageReaderTool} tool on "${imagePath}" to view this image FIRST.\n` +
                                     `DO NOT describe or guess the image contents without reading it.\n` +
-                                    `DO NOT say you cannot read images - the Read tool supports image files.`);
+                                    `DO NOT say you cannot read images - ${imageReaderTool} supports image files.`);
                             }
                             catch {
                                 parts.push('[Image attached but could not be processed]');