@namzu/sdk 2.0.0 → 3.0.0

package/src/runtime/query/iteration/phases/tool-review.ts

@@ -1,23 +1,61 @@
-import { createUserMessage } from '../../../../types/message/index.js'
 import type { ChatCompletionResponse } from '../../../../types/provider/index.js'
 import type { RunEvent } from '../../../../types/run/index.js'
 import type { VerificationGate } from '../../../../verification/index.js'
-import { type IterationContext, awaitDecisionOrAbort } from './context.js'
+import type { ToolCallDenials } from '../../executor.js'
+import { type IterationContext, awaitDecisionDurably } from './context.js'
 
 interface VerificationAwareContext extends IterationContext {
 	readonly verificationGate?: VerificationGate
 }
 
-export type ToolReviewOutcome = 'executed' | 'rejected' | 'stop'
+export type ToolReviewDecision = 'executed' | 'rejected' | 'stop'
 
+/**
+ * What the review produced. The tool outcomes travel with the decision so
+ * the loop can build a `StepResult` without re-deriving them from the
+ * messages it just pushed.
+ */
+export interface ToolReviewOutcome {
+	decision: ToolReviewDecision
+	results: readonly import('../../executor.js').ToolCallOutcome[]
+	/** Wall-clock spent executing tools in this review. */
+	durationMs: number
+}
+
+/**
+ * Run every tool call in `response` through the gate and (when the gate is
+ * inconclusive) a human, then hand the whole batch — approved and refused
+ * alike — to the executor.
+ *
+ * Two invariants this function is responsible for:
+ *
+ * 1. **Every `tool_use` is answered.** No branch may return without the
+ *    executor having produced a `tool_result` for each call, because an
+ *    unanswered `tool_use` makes the next provider request malformed. The
+ *    refusal reason rides inside the `tool_result`, which is also what
+ *    lets a rejection steer the model instead of just stopping it.
+ * 2. **A gate denial is never overridable by an approval.** A human
+ *    approving a batch approves the calls the gate left undecided — not
+ *    the ones it refused. Gate denials are threaded into every downstream
+ *    execution so no path can widen them.
+ */
 export async function* runToolReview(
 	ctx: VerificationAwareContext,
 	response: ChatCompletionResponse,
 	iterationNum: number,
 ): AsyncGenerator<RunEvent, ToolReviewOutcome> {
+	let executed: readonly import('../../executor.js').ToolCallOutcome[] = []
+	let toolMs = 0
+
+	const finish = (decision: ToolReviewDecision): ToolReviewOutcome => ({
+		decision,
+		results: executed,
+		durationMs: toolMs,
+	})
+
 	const toolCalls = response.message.toolCalls
 	if (!toolCalls || toolCalls.length === 0) {
-		return 'executed'
+		return finish('executed')
 	}
 
 	const toolCallSummaries = toolCalls.map((tc) => {
@@ -38,6 +76,36 @@ export async function* runToolReview(
 		}
 	})
 
+	/** Executes the batch, answering every call, and appends the results. */
+	const settle = async (denials?: ToolCallDenials): Promise<void> => {
+		const startedAt = Date.now()
+		const batch = await ctx.toolExecutor.executeBatch(response, denials)
+		toolMs += Date.now() - startedAt
+		executed = batch.results
+		for (const msg of batch.messages) {
+			ctx.runMgr.pushMessage(msg)
+		}
+	}
+
+	/** Every call denied for the same reason (human rejection, gate stop). */
+	const denyAll = (reason: string): ToolCallDenials =>
+		new Map(toolCalls.map((tc) => [tc.id, reason]))
+
+	// Gate-denied ids survive the whole function: a later human approval
+	// must not be able to release them.
+	const gateDenied = new Map<string, string>()
+
+	// The operator's policy runs FIRST, and a grant cannot overrule it.
+	//
+	// The grant short-circuit used to sit above this block and return, so a
+	// remembered approval skipped the gate entirely. The two are different
+	// authorities: a grant records that the USER said yes to a shape of
+	// call, and the gate encodes what the OPERATOR forbids. A tool-scoped
+	// grant matches any arguments, so approving `bash: git status` with
+	// `remember: ['bash']` — the scope the docs recommend — then let
+	// `bash: rm -rf /` through unevaluated, past a rule written to stop
+	// exactly that. The CLI already states the correct rule for its own
+	// bypass: the deny applies even when every prompt is skipped.
 	if (ctx.verificationGate) {
 		const gate = ctx.verificationGate
 		const gateResults = toolCallSummaries.map((tc) => ({
@@ -49,6 +117,12 @@ export async function* runToolReview(
 			}),
 		}))
 
+		for (const gr of gateResults) {
+			if (gr.gateResult.decision === 'deny') {
+				gateDenied.set(gr.toolCall.id, `Blocked by the verification gate: ${gr.gateResult.reason}`)
+			}
+		}
+
 		const allAllowed = gateResults.every((gr) => gr.gateResult.decision === 'allow')
 		const allDenied = gateResults.every((gr) => gr.gateResult.decision === 'deny')
 
@@ -56,24 +130,18 @@ export async function* runToolReview(
 			ctx.log.debug('Verification gate: all tool calls pre-approved', {
 				tools: gateResults.map((gr) => gr.toolCall.name),
 			})
-			const batch = await ctx.toolExecutor.executeBatch(response)
-			for (const msg of batch.messages) {
-				ctx.runMgr.pushMessage(msg)
-			}
-			return 'executed'
+			await settle()
+			yield* ctx.drainPending()
+			return finish('executed')
 		}
 
 		if (allDenied) {
-			const reasons = gateResults
-				.map((gr) => `${gr.toolCall.name}: ${gr.gateResult.reason}`)
-				.join('; ')
 			ctx.log.debug('Verification gate: all tool calls denied', {
 				tools: gateResults.map((gr) => gr.toolCall.name),
 			})
-			ctx.runMgr.pushMessage(
-				createUserMessage(`[SYSTEM] Tool calls blocked by verification gate: ${reasons}`),
-			)
-			return 'rejected'
+			await settle(gateDenied)
+			yield* ctx.drainPending()
+			return finish('rejected')
 		}
 
 		ctx.log.debug('Verification gate: mixed decisions, proceeding to review', {
@@ -84,6 +152,26 @@ export async function* runToolReview(
 		})
 	}
 
+	// Already approved, at a scope the approver chose — and nothing the
+	// operator's policy denied, because `gateDenied` is checked first.
+	// Re-asking about a call somebody has already said yes to is how an
+	// approval prompt becomes noise, and a noisy prompt gets answered with
+	// the widest option available: `bash: git status` re-prompted on every
+	// batch forever, and the only escape was a blanket session grant that
+	// also covered every destructive call.
+	if (
+		ctx.toolGrants &&
+		gateDenied.size === 0 &&
+		toolCallSummaries.every((tc) => ctx.toolGrants?.covers(tc))
+	) {
+		ctx.log.debug('Every tool call is covered by an approval already granted', {
+			tools: toolCallSummaries.map((tc) => tc.name),
+		})
+		await settle()
+		yield* ctx.drainPending()
+		return finish('executed')
+	}
+
 	const reviewCheckpoint = await ctx.checkpointMgr.create(ctx.runMgr, iterationNum)
 
 	await ctx.emitEvent({
@@ -94,7 +182,7 @@ export async function* runToolReview(
 	})
 	yield* ctx.drainPending()
 
-	const reviewDecision = await awaitDecisionOrAbort(ctx, {
+	const reviewDecision = await awaitDecisionDurably(ctx, reviewCheckpoint, {
 		type: 'tool_review',
 		runId: ctx.runMgr.id,
 		checkpointId: reviewCheckpoint.id,
@@ -110,9 +198,10 @@ export async function* runToolReview(
 			})
 			yield* ctx.drainPending()
 
-			const feedback = reviewDecision.feedback || 'User rejected the tool calls'
-			ctx.runMgr.pushMessage(createUserMessage(`[SYSTEM] Tool calls rejected: ${feedback}`))
-			return 'rejected'
+			const feedback = reviewDecision.feedback || 'The user rejected this tool call.'
+			await settle(denyAll(feedback))
+			yield* ctx.drainPending()
+			return finish('rejected')
 		}
 
 		case 'modify_tools': {
@@ -123,33 +212,26 @@ export async function* runToolReview(
 			})
 			yield* ctx.drainPending()
 
+			// Gate denials are the floor; per-call human denials add to them.
+			const denials = new Map(gateDenied)
+
 			for (const mod of reviewDecision.modifications) {
 				if (mod.action === 'modify' && mod.modifiedInput !== undefined) {
 					const tc = toolCalls.find((t) => t.id === mod.toolCallId)
-					if (tc) {
+					// A modification cannot resurrect a gate-denied call.
+					if (tc && !denials.has(tc.id)) {
 						tc.function.arguments = JSON.stringify(mod.modifiedInput)
 					}
 				}
+				if (mod.action === 'deny' && !denials.has(mod.toolCallId)) {
+					denials.set(mod.toolCallId, 'The user denied this tool call.')
+				}
 			}
 
-			const deniedIds = new Set(
-				reviewDecision.modifications.filter((m) => m.action === 'deny').map((m) => m.toolCallId),
-			)
-			const filteredToolCalls = toolCalls.filter((tc) => !deniedIds.has(tc.id))
-
-			if (filteredToolCalls.length === 0) {
-				ctx.runMgr.pushMessage(createUserMessage('[SYSTEM] All tool calls were denied by user'))
-				return 'rejected'
-			}
-
-			const batch = await ctx.toolExecutor.executeBatch({
-				...response,
-				message: { ...response.message, toolCalls: filteredToolCalls },
-			})
-			for (const msg of batch.messages) {
-				ctx.runMgr.pushMessage(msg)
-			}
-			return 'executed'
+			const everythingDenied = denials.size === toolCalls.length
+			await settle(denials)
+			yield* ctx.drainPending()
+			return finish(everythingDenied ? 'rejected' : 'executed')
 		}
 
 		case 'pause': {
@@ -166,7 +248,7 @@ export async function* runToolReview(
 			})
 			yield* ctx.drainPending()
 			ctx.runMgr.setStopReason('paused')
-			return 'stop'
+			return finish('stop')
 		}
 
 		case 'abort': {
@@ -178,11 +260,19 @@ export async function* runToolReview(
 			yield* ctx.drainPending()
 			ctx.runMgr.setStopReason('cancelled')
 			ctx.runMgr.markCancelled()
-			return 'stop'
+			return finish('stop')
 		}
 
 		case 'approve_tools':
 		case 'continue': {
+			// Recorded only on an EXPLICIT approval that asked for it. A
+			// denial, a non-response, or an approval that said nothing about
+			// scope leaves nothing behind — consent stays untransferable
+			// unless the approver chose to transfer it.
+			if (reviewDecision.action === 'approve_tools' && reviewDecision.remember) {
+				ctx.toolGrants?.grant(reviewDecision.remember)
+			}
+
 			await ctx.emitEvent({
 				type: 'tool_review_completed',
 				runId: ctx.runMgr.id,
@@ -190,11 +280,12 @@ export async function* runToolReview(
 			})
 			yield* ctx.drainPending()
 
-			const batch = await ctx.toolExecutor.executeBatch(response)
-			for (const msg of batch.messages) {
-				ctx.runMgr.pushMessage(msg)
-			}
-			return 'executed'
+			// `gateDenied` is non-empty only on the gate's mixed-decision
+			// path. Passing it here is what stops a human "approve" from
+			// executing calls the gate refused.
+			await settle(gateDenied)
+			yield* ctx.drainPending()
+			return finish('executed')
 		}
 
 		case 'approve_plan':
@@ -206,11 +297,9 @@ export async function* runToolReview(
 			ctx.log.warn('Unexpected plan decision during tool review', {
 				action: reviewDecision.action,
 			})
-			const batch = await ctx.toolExecutor.executeBatch(response)
-			for (const msg of batch.messages) {
-				ctx.runMgr.pushMessage(msg)
-			}
-			return 'executed'
+			await settle(gateDenied)
+			yield* ctx.drainPending()
+			return finish('executed')
 		}
 
 		default: {

package/src/runtime/query/iteration/phases/working-memory-compaction.test.ts

@@ -84,13 +84,25 @@ function makeCtx(opts: {
 			id: 'run_1' as RunId,
 			currentIteration: 3,
 			messages: opts.messages,
+			// Compaction prefers the provider's reported prompt size over the
+			// chars/4 heuristic; `undefined` keeps these cases on the estimate
+			// path they were written against.
+			lastPromptTokens: undefined,
+			clearLastPromptTokens: () => {},
+			accumulateUsage: () => {},
 		},
+		emitEvent: async () => {},
 	} as unknown as IterationContext
 }
 
 const WM_BLOCK =
 	'ARTIFACTS\n  • report.docx · Word document · 48.2 KB · imp:H\n       path: /mnt/user-data/outputs/report.docx'
 
+/** Messages can now carry content blocks; these cases are about text. */
+function asText(content: unknown): string {
+	return typeof content === 'string' ? content : ''
+}
+
 describe('Layer-B compaction seam (ses_055 #104)', () => {
 	it('FIRES on small contextWindowTokens with tokenBudget=0 AND preserves the pinned WM slot', async () => {
 		const messages = buildOverflowingMessages()
@@ -103,7 +115,7 @@ describe('Layer-B compaction seam (ses_055 #104)', () => {
 		await refreshWorkingMemory(ctx)
 		// The slot is pinned as the last leading system message (index 1).
 		expect(messages[1]?.role).toBe('system')
-		expect(messages[1]?.content?.startsWith(WORKING_MEMORY_HEADER)).toBe(true)
+		expect(asText(messages[1]?.content).startsWith(WORKING_MEMORY_HEADER)).toBe(true)
 
 		const before = messages.length
 		await runCompactionCheck(ctx)
@@ -111,11 +123,11 @@ describe('Layer-B compaction seam (ses_055 #104)', () => {
 		// (1) compaction fired: a [COMPACTED CONTEXT] message appeared and the
 		// transcript shrank.
 		expect(messages.length).toBeLessThan(before)
-		expect(messages.some((m) => m.content?.includes('[COMPACTED CONTEXT]'))).toBe(true)
+		expect(messages.some((m) => asText(m.content).includes('[COMPACTED CONTEXT]'))).toBe(true)
 
 		// (2) the pinned working-memory slot survived by header identity.
 		const wm = messages.filter(
-			(m) => m.role === 'system' && m.content?.startsWith(WORKING_MEMORY_HEADER),
+			(m) => m.role === 'system' && asText(m.content).startsWith(WORKING_MEMORY_HEADER),
 		)
 		expect(wm).toHaveLength(1)
 		expect(wm[0]?.content).toContain('report.docx')
@@ -130,7 +142,7 @@ describe('Layer-B compaction seam (ses_055 #104)', () => {
 
 		// budget = tokenBudget = 0 → guard returns; no compaction, no mutation.
 		expect(messages.length).toBe(before)
-		expect(messages.some((m) => m.content?.includes('[COMPACTED CONTEXT]'))).toBe(false)
+		expect(messages.some((m) => asText(m.content).includes('[COMPACTED CONTEXT]'))).toBe(false)
 	})
 
 	it('removes the slot when the provider returns an empty block', async () => {
@@ -141,7 +153,7 @@ describe('Layer-B compaction seam (ses_055 #104)', () => {
 			workingMemoryProvider: () => WM_BLOCK,
 		})
 		await refreshWorkingMemory(ctx)
-		expect(messages.some((m) => m.content?.startsWith(WORKING_MEMORY_HEADER))).toBe(true)
+		expect(messages.some((m) => asText(m.content).startsWith(WORKING_MEMORY_HEADER))).toBe(true)
 
 		// Same transcript, provider now returns blank ⇒ the slot is removed.
 		const blankCtx = makeCtx({
@@ -150,7 +162,7 @@ describe('Layer-B compaction seam (ses_055 #104)', () => {
 			workingMemoryProvider: () => '   ',
 		})
 		await refreshWorkingMemory(blankCtx)
-		expect(messages.some((m) => m.content?.startsWith(WORKING_MEMORY_HEADER))).toBe(false)
+		expect(messages.some((m) => asText(m.content).startsWith(WORKING_MEMORY_HEADER))).toBe(false)
 	})
 
 	it('keeps the prior slot when the provider throws (failure-isolated)', async () => {
@@ -171,7 +183,7 @@ describe('Layer-B compaction seam (ses_055 #104)', () => {
 		})
 		await refreshWorkingMemory(throwingCtx)
 		// Prior slot retained; run not broken.
-		expect(messages.some((m) => m.content?.startsWith(WORKING_MEMORY_HEADER))).toBe(true)
+		expect(messages.some((m) => asText(m.content).startsWith(WORKING_MEMORY_HEADER))).toBe(true)
 	})
 
 	it('does NOT orphan a tool_result when the recent-window cut splits a tool pair (C1)', async () => {
@@ -180,7 +192,7 @@ describe('Layer-B compaction seam (ses_055 #104)', () => {
 		// (index 4) but BEFORE... no — exactly ON its tool result (index 5), which
 		// a naive slice would keep in the recent window while dropping the
 		// assistant into the summarized older set → an orphaned tool_result at the
-		// head of the recent window → Anthropic 400. The fix snaps keepStart
+		// head of the recent window → a 400 from the wire. The fix snaps keepStart
 		// forward past the complete pair.
 		const toolCall = {
 			id: 't1',
@@ -203,7 +215,7 @@ describe('Layer-B compaction seam (ses_055 #104)', () => {
 		await runCompactionCheck(ctx)
 
 		// Compaction fired.
-		expect(messages.some((m) => m.content?.includes('[COMPACTED CONTEXT]'))).toBe(true)
+		expect(messages.some((m) => asText(m.content).includes('[COMPACTED CONTEXT]'))).toBe(true)
 		// The surviving transcript has NO dangling tool pair — the tool result
 		// whose assistant was summarized away was moved into the older set too,
 		// so no orphaned tool_result remains to 400 the next provider turn.