@namzu/sdk 34.2.0 → 35.0.0

package/src/runtime/query/review-policy.ts

@@ -0,0 +1,231 @@
+/**
+ * How a run resolves the calls no rule decided.
+ *
+ * An authorization rule says what a tool may do. A review policy says what
+ * happens to everything the rules did not cover: the batch the gate routed
+ * to REVIEW. The two axes are separate on purpose — a rule is a durable
+ * statement an operator reviewed, and a mode is a property of ONE run, the
+ * difference between "we never force-push" and "this run is unattended".
+ *
+ * Only calls the gate routed to review arrive here. A rule that denied one
+ * already stopped it, and a rule that allowed one never asked. So a mode
+ * decides the undecided and can never reopen what a rule closed; a host's
+ * `--permission-mode` flag cannot widen a `deny`. That is the whole
+ * precedence story between a flag and a config file, in one sentence.
+ *
+ * This lived in the operator application as one closure. It moved here
+ * because none of it is about a terminal: the modes name kernel tools, the
+ * exemptions reason about kernel tools' blast radius, and a second host
+ * would otherwise write the same five branches and drift on the sixth.
+ * What a host supplies is the one thing the kernel cannot: how to ask a
+ * person (`prompt`).
+ */
+
+import type { ToolRegistry } from '../../registry/tool/execute.js'
+import { isTrustedReadOnly } from '../../tools/trusted-read-only.js'
+import type { HITLResumeDecision, ResumeHandler, ToolCallSummary } from '../../types/hitl/index.js'
+import type { ApprovalPolicy } from '../../types/hitl/policy.js'
+import { PLAN_MODE_REFUSAL } from '../../types/permission/index.js'
+
+export type ReviewMode =
+	/** Ask a person. The default when a `prompt` is supplied. */
+	| 'prompt'
+	/** Approve it. The default without a `prompt`, and what every headless run has always done. */
+	| 'auto'
+	/**
+	 * Approve a file edit, ask about everything else.
+	 *
+	 * The mode an operator watching the agent write code actually wants: an
+	 * `edit` or `write` inside the working directory is what they asked for
+	 * and is undoable with `git`, so a prompt on each one is a prompt they
+	 * answer `y` to forty times an hour — and a prompt that is always
+	 * answered the same way trains the hand to answer the next one, which is
+	 * the shell prompt, the same way. Shell commands, delegation and anything
+	 * a tool declares destructive still ask.
+	 */
+	| 'accept-edits'
+	/**
+	 * Read and think, do not act. A call that only reads is approved; a call
+	 * that would change anything is refused with feedback telling the model
+	 * to present its plan instead. The operator reads the plan and switches
+	 * mode to have it carried out — the switch IS the approval. The kernel's
+	 * `permissionMode: 'plan'` is the floor under this: it blocks a mutating
+	 * call at execution with no feedback, where this refuses it at review
+	 * with the words that make the model plan.
+	 */
+	| 'plan'
+	/**
+	 * Refuse it. Nothing runs unless a rule allowed it by name or pattern —
+	 * the allowlist is the whole permission surface, which is the only form
+	 * an unattended run can actually be reasoned about.
+	 */
+	| 'strict'
+
+export const REVIEW_MODES: readonly ReviewMode[] = [
+	'prompt',
+	'accept-edits',
+	'auto',
+	'strict',
+	'plan',
+]
+
+export function isReviewMode(value: unknown): value is ReviewMode {
+	return typeof value === 'string' && (REVIEW_MODES as readonly string[]).includes(value)
+}
+
+export { PLAN_MODE_REFUSAL }
+
+/** What the model is told when a call is refused under `strict`. */
+export const STRICT_MODE_REFUSAL =
+	'Refused: this run only permits tools an explicit rule allows, and no rule covers this call. Asking again will not change it — either the operator adds a rule, or this has to be done another way.'
+
+/** The tools `accept-edits` approves without asking. Everything else prompts. */
+export const ACCEPT_EDITS_TOOLS: ReadonlySet<string> = new Set(['edit', 'write'])
+
+/**
+ * Writes that skip review anyway, in spite of declaring `readOnly: false`.
+ *
+ * This is an OVERRIDE of the tool's own declaration, and it is named as one.
+ * The bar for an entry is that prompting would be unusable AND a bad write
+ * cannot reach beyond the agent's own bookkeeping:
+ *
+ * - `task_create` / `task_update` / `update_goal` — the model's own plan for
+ *   the current request, written several times per planning turn; asking
+ *   each time would put a consent dialog between the agent and its todo
+ *   list. What a bad write costs is a polluted task list, visible in the
+ *   transcript, and it grants nothing.
+ *
+ * `save_memory` is deliberately NOT here. Content saved now is retrievable
+ * by `search_memory` in a later session, so a tool result that talks the
+ * model into saving something reaches a future run's reasoning. A write
+ * that survives the process is not read-only under any reading.
+ */
+export const REVIEW_EXEMPT_WRITES: ReadonlySet<string> = new Set([
+	'task_create',
+	'task_update',
+	'update_goal',
+])
+
+/**
+ * Whether a call runs without review: it declares itself read-only and is
+ * trusted to say so, or it is a named exemption above.
+ *
+ * The read-only half comes from the tool's own declaration through
+ * `isTrustedReadOnly`, the predicate the authorization gate uses, never from
+ * a list of names kept here: a renamed tool would otherwise change posture
+ * with nothing to notice. A fetch declares itself read-only and is still a
+ * request leaving the machine to an address the model chose, so `network`
+ * tools are reviewed like a shell command. A tool the registry does not
+ * know, or one that declares nothing, is reviewed.
+ */
+export function isReviewExempt(
+	registry: Pick<ToolRegistry, 'get'>,
+	name: string,
+	input: unknown,
+): boolean {
+	if (REVIEW_EXEMPT_WRITES.has(name.toLowerCase())) return true
+	const tool = registry.get(name) ?? registry.get(name.toLowerCase())
+	if (tool?.category === 'network') return false
+	return isTrustedReadOnly(tool, input)
+}
+
+export type ReviewExemption = (name: string, input: unknown) => boolean
+
+/** A batch needs review when any call mutates state: flagged destructive, or not exempt. */
+export function batchNeedsReview(
+	toolCalls: readonly ToolCallSummary[],
+	exempt: ReviewExemption,
+): boolean {
+	return toolCalls.some((tc) => tc.isDestructive || !exempt(tc.name, tc.input))
+}
+
+/** The batch a person is asked about. */
+export interface ToolReviewRequest {
+	readonly toolCalls: readonly ToolCallSummary[]
+}
+
+export type ToolReviewAnswer =
+	| { readonly kind: 'approve' }
+	/** Approve, and stop asking for the rest of the run. */
+	| { readonly kind: 'approve-all' }
+	| { readonly kind: 'reject'; readonly feedback?: string }
+
+/** How a host asks a person. The one thing the kernel cannot supply. */
+export type ToolReviewPrompt = (request: ToolReviewRequest) => Promise<ToolReviewAnswer>
+
+export interface ReviewPolicyOptions {
+	/** Default `prompt` when a `prompt` is supplied, `auto` otherwise. */
+	readonly mode?: ReviewMode
+	readonly prompt?: ToolReviewPrompt
+	/** Which calls skip review; default `isReviewExempt` over `registry`, or nothing without one. */
+	readonly exempt?: ReviewExemption
+	readonly registry?: Pick<ToolRegistry, 'get'>
+	/**
+	 * Where "approve all" is remembered. A host that shows the state (a
+	 * badge saying the session is unattended) passes its own box so both
+	 * read the same fact; omitted, the policy keeps one privately.
+	 */
+	readonly remembered?: { all: boolean }
+}
+
+/** The handler behind `createReviewPolicy`, for a host that wants only the function. */
+export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHandler {
+	const { prompt, registry } = options
+	const mode: ReviewMode = options.mode ?? (prompt ? 'prompt' : 'auto')
+	const exempt: ReviewExemption =
+		options.exempt ??
+		(registry ? (name, input) => isReviewExempt(registry, name, input) : () => false)
+	const remembered = options.remembered ?? { all: false }
+	return async (request): Promise<HITLResumeDecision> => {
+		if (request.type !== 'tool_review') {
+			return request.type === 'plan_approval' ? { action: 'approve_plan' } : { action: 'continue' }
+		}
+		if (!batchNeedsReview(request.toolCalls, exempt)) {
+			return { action: 'approve_tools' }
+		}
+		// A batch of nothing but non-destructive file edits is the case
+		// `accept-edits` exists for. One shell call in the same batch and the
+		// whole batch asks — the operator reviews the batch as a unit, and a
+		// prompt that showed only the shell command while the edits went
+		// through beside it would be approving something it did not show.
+		if (
+			mode === 'accept-edits' &&
+			request.toolCalls.every(
+				(tc) => !tc.isDestructive && (ACCEPT_EDITS_TOOLS.has(tc.name) || exempt(tc.name, tc.input)),
+			)
+		) {
+			return { action: 'approve_tools' }
+		}
+		// Reads were approved above. Anything that reached here would change
+		// something, and plan mode's answer is the same every time: not now,
+		// tell the user what you would do.
+		if (mode === 'plan') return { action: 'reject_tools', feedback: PLAN_MODE_REFUSAL }
+		if (mode === 'strict') return { action: 'reject_tools', feedback: STRICT_MODE_REFUSAL }
+		if (mode === 'auto' || !prompt || remembered.all) {
+			return { action: 'approve_tools' }
+		}
+		const answer = await prompt({ toolCalls: request.toolCalls })
+		switch (answer.kind) {
+			case 'approve':
+				return { action: 'approve_tools' }
+			case 'approve-all':
+				remembered.all = true
+				return { action: 'approve_tools' }
+			case 'reject':
+				return {
+					action: 'reject_tools',
+					feedback: answer.feedback ?? 'User declined to run the proposed tool(s).',
+				}
+		}
+	}
+}
+
+/**
+ * The mode as an `ApprovalPolicy`, named after itself so a durable log can
+ * say which one approved a call. Swap it on a run's `RunApprovalPolicy`
+ * to change mode without ending the run.
+ */
+export function createReviewPolicy(options: ReviewPolicyOptions = {}): ApprovalPolicy {
+	const mode: ReviewMode = options.mode ?? (options.prompt ? 'prompt' : 'auto')
+	return { name: mode, handler: createReviewHandler({ ...options, mode }) }
+}

package/src/runtime/query/run-state.ts

@@ -53,6 +53,8 @@ export function captureRunState(
 		...(session.lastError ? { lastError: session.lastError } : {}),
 		messages: structuredClone(runMgr.messages),
 		tokenUsage: { ...runMgr.tokenUsage },
+		budgetBinding: runMgr.budget?.binding,
+		budgetAccountId: runMgr.budget?.accountId,
 		costInfo: { ...runMgr.costInfo },
 		currentIteration: runMgr.currentIteration,
 		startedAt,
@@ -114,6 +116,8 @@ export async function loadSelectedRunState(
 		status: 'running',
 		messages: checkpoint.messages,
 		tokenUsage: checkpoint.tokenUsage,
+		budgetBinding: checkpoint.budgetBinding,
+		budgetAccountId: checkpoint.budgetAccountId,
 		costInfo: checkpoint.costInfo,
 		currentIteration: checkpoint.guardState.iterationCount,
 		startedAt: checkpoint.createdAt - checkpoint.guardState.elapsedMs,

package/src/runtime/query/steering.ts

@@ -84,6 +84,38 @@ export class SteeringBinding implements SteeringChannel {
  * to be worked with rather than followed would inverting the very thing the
  * host is trying to do. Different party, different frame, on purpose.
  */
+/** The same slot as steering, for notices the kernel itself has to deliver. */
+export function attachNotice(
+	messages: readonly Message[],
+	channel: SteeringChannel | undefined,
+	format: (text: string) => string,
+): readonly Message[] {
+	if (!channel?.pending) return messages
+	let lastToolIndex = -1
+	for (let index = messages.length - 1; index >= 0; index--) {
+		if (messages[index]?.role === 'tool') {
+			lastToolIndex = index
+			break
+		}
+	}
+	if (lastToolIndex === -1) return messages
+	const text = channel.drain()
+	if (text === undefined) return messages
+	const target = messages[lastToolIndex] as Message
+	if (typeof target.content !== 'string') {
+		channel.steer(text)
+		return messages
+	}
+	const next = [...messages]
+	next[lastToolIndex] = { ...target, content: target.content + format(text) }
+	return next
+}
+
+/** What the model reads when a background job it started has ended. */
+export function formatJobNote(text: string): string {
+	return `\n\n[Background job update]\n${text}`
+}
+
 export function formatSteeringNote(text: string): string {
 	return `\n\n[Message from the operator, received while this tool was running]\n${text}`
 }

package/src/runtime/query/token-budget.ts

@@ -0,0 +1,127 @@
+import { join } from 'node:path'
+import type { TokenBudget } from '../../run/token-budget.js'
+import { DefaultPathBuilder } from '../../session/workspace/path-builder.js'
+import { DiskCheckpointStore } from '../../store/run/checkpoint-disk.js'
+import { openTokenBudget } from '../../store/run/token-budget-disk.js'
+import type { IterationCheckpoint } from '../../types/hitl/index.js'
+import type { RunId } from '../../types/ids/index.js'
+import type { RunState } from '../../types/run/state.js'
+import { validateTokenBudgetBinding } from '../../types/run/token-budget-store.js'
+import type { QueryParams } from './index.js'
+
+/** Resolve one authority before any model request or recovered tool dispatch. */
+export async function resolveQueryBudget(
+	params: QueryParams,
+	runId: RunId,
+	selected?: RunState,
+): Promise<TokenBudget> {
+	let saved: Pick<IterationCheckpoint, 'budgetBinding' | 'budgetAccountId'> | undefined = selected
+	if (params.resumeFromCheckpoint && !saved) {
+		const paths =
+			params.pathBuilder ??
+			new DefaultPathBuilder(join(params.workingDirectory ?? process.cwd(), '.namzu'))
+		const scope = {
+			tenantId: params.tenantId,
+			projectId: params.projectId,
+			sessionId: params.sessionId,
+			runId,
+			parentRunId: params.parentRunId,
+		}
+		const store =
+			params.checkpointStore ??
+			new DiskCheckpointStore(
+				{
+					baseDir: join(paths.sessionDir(params.projectId, params.sessionId), 'runs'),
+				},
+				scope,
+			)
+		saved = (await store.readCheckpoint(scope, params.resumeFromCheckpoint)) ?? undefined
+		if (!saved) throw new Error('Cannot restore a token budget from a missing checkpoint.')
+	}
+	const schedulerBudget = params.taskScheduler?.budget
+	if (params.taskScheduler && !schedulerBudget) {
+		throw new Error('A task scheduler must expose its shared token budget account.')
+	}
+	if (params.budget && schedulerBudget && params.budget !== schedulerBudget) {
+		throw new Error('Query and task scheduler must share the same token budget account.')
+	}
+	const provided = params.budget ?? schedulerBudget
+	const binding =
+		saved?.budgetBinding === undefined ? undefined : validateTokenBudgetBinding(saved.budgetBinding)
+	if (
+		binding &&
+		saved?.budgetAccountId !== undefined &&
+		saved.budgetAccountId !== binding.accountId
+	) {
+		throw new Error('Checkpoint token budget account references disagree.')
+	}
+	if (
+		binding &&
+		(binding.scope.tenantId !== params.tenantId || binding.scope.projectId !== params.projectId)
+	) {
+		throw new Error('Checkpoint token budget belongs to a different tenant or project.')
+	}
+	if (binding && binding.scope.runId === runId && binding.scope.sessionId !== params.sessionId) {
+		throw new Error('Checkpoint token budget belongs to a different root session.')
+	}
+	if (provided) {
+		const providedBinding = provided.binding
+		if (
+			providedBinding &&
+			(providedBinding.scope.tenantId !== params.tenantId ||
+				providedBinding.scope.projectId !== params.projectId ||
+				(providedBinding.scope.runId === runId &&
+					providedBinding.scope.sessionId !== params.sessionId))
+		) {
+			throw new Error('Supplied token budget belongs to a different root scope.')
+		}
+		if (saved?.budgetAccountId && saved.budgetAccountId !== provided.accountId) {
+			throw new Error('Resume requires the original token budget account.')
+		}
+		if (
+			binding &&
+			(binding.accountId !== provided.accountId || binding.scope.runId !== provided.rootRunId)
+		) {
+			throw new Error('Checkpoint and supplied token budget authority disagree.')
+		}
+		if (
+			binding &&
+			(!providedBinding ||
+				binding.scope.tenantId !== providedBinding.scope.tenantId ||
+				binding.scope.projectId !== providedBinding.scope.projectId ||
+				binding.scope.sessionId !== providedBinding.scope.sessionId ||
+				binding.scope.runId !== providedBinding.scope.runId)
+		) {
+			throw new Error('Checkpoint and supplied token budget root scopes disagree.')
+		}
+		provided.bindRun(runId)
+		narrowToRunLimit(provided, params.runConfig.tokenBudget)
+		return provided
+	}
+	if (saved?.budgetAccountId && !binding) {
+		throw new Error(
+			'This checkpoint used an in-memory token budget. Supply its current authoritative budget to resume.',
+		)
+	}
+	const budget = await openTokenBudget({
+		store: params.tokenBudgetStore,
+		pathBuilder: params.pathBuilder,
+		workingDirectory: params.workingDirectory,
+		scope: binding?.scope ?? {
+			tenantId: params.tenantId,
+			projectId: params.projectId,
+			sessionId: params.sessionId,
+			runId,
+		},
+		limit: binding && binding.scope.runId !== runId ? undefined : params.runConfig.tokenBudget,
+		accountId: binding?.accountId,
+		requireExisting: binding !== undefined,
+	})
+	budget.bindRun(runId)
+	narrowToRunLimit(budget, params.runConfig.tokenBudget)
+	return budget
+}
+
+function narrowToRunLimit(budget: TokenBudget, limit: number): void {
+	if (limit > 0 && (budget.limit === 0 || limit < budget.limit)) budget.narrow(limit)
+}

package/src/runtime/query/tool-output-budget.ts

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto'
 import { mkdirSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 
@@ -76,7 +77,14 @@ function boundedPreview(
 		'',
 	].join('\n')
 	const compactMiddle = '\n[... omitted ...]\n'
-	const middle = detailedMiddle.length < maxChars ? detailedMiddle : compactMiddle
+	const spillLine = recovery.split('\n').find((line) => line.startsWith(SPILL_MARKER))
+	const compactRecovery = spillLine ? `${compactMiddle}${spillLine}\n` : compactMiddle
+	const middle =
+		detailedMiddle.length < maxChars
+			? detailedMiddle
+			: compactRecovery.length < maxChars
+				? compactRecovery
+				: compactMiddle
 
 	// A host may deliberately set a tiny positive cap. At that point no
 	// truthful recovery sentence fits; the hard bound still wins.
@@ -123,7 +131,7 @@ export function describeDroppedContent(
 	if (counts.size === 0) return undefined
 
 	const parts = [...counts].map(([kind, n]) => (n === 1 ? `1 ${kind}` : `${n} ${kind} blocks`))
-	return `[${parts.join(', ')} omitted: this result was truncated, and the preview above no longer describes them.]`
+	return `[${parts.join(', ')} omitted from this model request.]`
 }
 
 /**
@@ -137,8 +145,7 @@ export function measureContentBytes(content: readonly unknown[] | unknown): numb
 	if (!Array.isArray(content)) return 0
 	let total = 0
 	for (const block of content as readonly Record<string, unknown>[]) {
-		if (typeof block?.data === 'string') total += block.data.length
-		else if (typeof block?.text === 'string') total += block.text.length
+		if (block?.type !== 'text' && typeof block?.data === 'string') total += block.data.length
 	}
 	return total
 }
@@ -148,6 +155,8 @@ export interface ApplyToolOutputBudgetOptions {
 	readonly toolUseId: string
 	readonly output: string
 	readonly maxChars: number
+	/** An omission notice that shares the text budget, never extends it. */
+	readonly notice?: string
 	/**
 	 * Directory to spill overflow into. When absent the output is
 	 * middle-elided instead — degraded, but never unbounded.
@@ -173,9 +182,20 @@ export interface ApplyToolOutputBudgetOptions {
 export function applyToolOutputBudget(opts: ApplyToolOutputBudgetOptions): ToolOutputBudgetResult {
 	const { output, maxChars } = opts
 	const originalLength = output.length
+	const limit = Number.isFinite(maxChars) && maxChars > 0 ? Math.floor(maxChars) : undefined
+	const notice = opts.notice
+		? limit === undefined
+			? opts.notice
+			: safeHead(opts.notice, limit)
+		: ''
+	const textBudget =
+		limit === undefined
+			? undefined
+			: Math.max(0, limit - notice.length - (notice && output ? 2 : 0))
+	const withNotice = (text: string) => [text, notice].filter(Boolean).join('\n\n')
 
-	if (!Number.isFinite(maxChars) || maxChars <= 0 || originalLength <= maxChars) {
-		return { output, originalLength, truncated: false }
+	if (textBudget === undefined || originalLength <= textBudget) {
+		return { output: withNotice(output), originalLength, truncated: false }
 	}
 
 	const spillPath = opts.spillDir
@@ -187,10 +207,10 @@ export function applyToolOutputBudget(opts: ApplyToolOutputBudgetOptions): ToolO
 				`${SPILL_MARKER} ${spillPath}`,
 				'Read a specific window with `read` (offset/limit) or search it with `grep`. Do NOT read it whole — that is what exceeded the budget.',
 			].join('\n')
-		: 'The full output was not retained. Re-run with a narrower query, a line range, or a filter.'
+		: 'The full output was not retained. Use a saved artifact or a read-only observation; do not repeat a state-changing action to recover its output.'
 
 	return {
-		output: boundedPreview(output, maxChars, opts.toolName, recovery),
+		output: withNotice(boundedPreview(output, textBudget, opts.toolName, recovery)),
 		originalLength,
 		truncated: true,
 		...(spillPath ? { spillPath } : {}),
@@ -214,8 +234,11 @@ function spill(
 		// which is the host's decision to make and not this function's to
 		// override.
 		mkdirSync(dir, { recursive: true, mode: 0o700 })
-		// The tool_use id is already unique per call and safe as a filename.
-		const path = join(dir, `${toolUseId}.txt`)
+		// Provider correlation IDs are opaque strings, not filesystem names.
+		// A digest preserves deterministic lookup without interpreting slashes,
+		// traversal segments or platform-specific path syntax from the provider.
+		const name = createHash('sha256').update(toolUseId).digest('hex')
+		const path = join(dir, `${name}.txt`)
 		// `wx`, not the default `w`. `w` creates-or-truncates and FOLLOWS a
 		// symlink, at a path anything that can write to this directory could
 		// predict and pre-plant — so the kernel would overwrite the symlink's

package/src/runtime/query/tool-pause.ts

@@ -1,7 +1,7 @@
 import type { HITLResumeDecision, ResumeHandler, UserQuestionData } from '../../types/hitl/index.js'
 import type { RunId } from '../../types/ids/index.js'
 import type { RequestToolPause, ToolPauseRequest } from '../../types/tool/index.js'
-import { asCheckpointId } from '../../utils/id.js'
+import { generateCheckpointId } from '../../utils/id.js'
 import type { PendingAnswers, QuestionParkRecorder } from './question-park.js'
 
 /**
@@ -121,7 +121,9 @@ export function createToolPause(deps: ToolPauseDeps): RequestToolPause {
 			(await deps.parkHandler({
 				type: 'user_question',
 				runId: deps.runId,
-				checkpointId: parkedAt ?? asCheckpointId(`cp_pause_${id}`),
+				// The question retains its correlation id; provider ids and pause
+				// names need not be safe components of a checkpoint storage key.
+				checkpointId: parkedAt ?? generateCheckpointId(),
 				question,
 			}))
 

package/src/runtime/query/tooling.ts

@@ -23,6 +23,8 @@ export interface ToolingBootstrapConfig {
 	tools: ToolRegistryContract
 	runId: RunId
 	workingDirectory: string
+	/** See `QueryParams.additionalDirectories`. */
+	additionalDirectories?: readonly string[]
 	/** A resolver, so an approval inside a run can change it. See the executor. */
 	permissionMode: PermissionMode | (() => PermissionMode)
 	env: Record<string, string>
@@ -33,6 +35,8 @@ export interface ToolingBootstrapConfig {
 	toolTimeoutMs?: number
 	/** Host-owned and shared; the executor binds it to this run. */
 	backgroundJobs?: BackgroundJobRegistry
+	/** See `QueryParams.backgroundJobOwner`. */
+	backgroundJobOwner?: string
 	/** Where the `skill` tool reads from. */
 	skills?: SkillRegistryRef
 	/** How this run reaches the web. */
@@ -63,6 +67,9 @@ export class ToolingBootstrap {
 				tools: config.tools,
 				runId: config.runId,
 				workingDirectory: config.workingDirectory,
+				...(config.additionalDirectories?.length
+					? { additionalDirectories: config.additionalDirectories }
+					: {}),
 				permissionMode: config.permissionMode,
 				env: config.env,
 				abortSignal: config.abortSignal,
@@ -70,6 +77,7 @@ export class ToolingBootstrap {
 				invocationState: config.invocationState,
 				pluginManager: config.pluginManager,
 				...(config.backgroundJobs ? { backgroundJobs: config.backgroundJobs } : {}),
+				...(config.backgroundJobOwner ? { backgroundJobOwner: config.backgroundJobOwner } : {}),
 				...(config.skills ? { skills: config.skills } : {}),
 				...(config.web ? { web: config.web } : {}),
 				...(config.toolTimeoutMs !== undefined ? { toolTimeoutMs: config.toolTimeoutMs } : {}),