@namzu/sdk 38.2.1 → 40.0.0

package/src/runtime/query/iteration/phases/advisory.ts

@@ -1,3 +1,4 @@
+import type { AdvisoryTurnContext } from '../../../../advisory/executor.js'
 import { serializeState } from '../../../../compaction/serializer.js'
 import { NAMZU } from '../../../../constants/telemetry/index.js'
 import type { AdvisoryRequest, TriggerEvaluationState } from '../../../../types/advisory/index.js'
@@ -47,6 +48,7 @@ export async function runAdvisoryPhase(
 	ctx: IterationContext,
 	iterationNum: number,
 	response: ChatCompletionResponse,
+	turn?: AdvisoryTurnContext,
 ): Promise<void> {
 	const advisoryCtx = ctx.advisoryCtx
 	if (!advisoryCtx) return
@@ -105,6 +107,7 @@ export async function runAdvisoryPhase(
 	try {
 		const executionResult = await advisoryCtx.executor.consult(advisor, request, {
 			messages: ctx.runMgr.messages,
+			...(turn ? { turn } : {}),
 			workingStateSummary,
 			toolCatalog: ctx.tools.toLLMTools(ctx.allowedTools),
 			iteration: iterationNum,

package/src/runtime/query/iteration/phases/context.ts

@@ -26,6 +26,7 @@ import type {
 	AgentRunConfig,
 	BeforeStep,
 	PrepareStepChain,
+	PrepareStepContext,
 	RunEvent,
 	StepResult,
 	StopCondition,
@@ -34,6 +35,7 @@ import type { StructuredOutputConfig } from '../../../../types/structured-output
 import type { TaskStore } from '../../../../types/task/index.js'
 import type { ToolRegistryContract } from '../../../../types/tool/index.js'
 import type { Logger } from '../../../../utils/logger.js'
+import type { AwaitedJobs } from '../../../jobs/awaited-jobs.js'
 import type { CheckpointManager } from '../../checkpoint.js'
 import type { EmitEvent } from '../../events.js'
 import type { ToolExecutor } from '../../executor.js'
@@ -135,6 +137,15 @@ export interface IterationContext {
 	readonly onSteeringDelivered?: (text: string) => void
 	/** Exit notices for the run's background jobs, drained into the next tool result. */
 	readonly jobNotices?: SteeringChannel
+	/**
+	 * Background jobs the model said it is waiting on, which is the only kind
+	 * the loop holds a finishing run open for.
+	 *
+	 * Absent means the loop behaves exactly as it did before this existed: a
+	 * job's exit still reaches the model as a notice on the next tool result,
+	 * and a run whose model stopped calling tools settles without waiting.
+	 */
+	readonly awaitedJobs?: AwaitedJobs
 	readonly checkpointMgr: CheckpointManager
 	readonly planManager: PlanManager
 
@@ -229,6 +240,7 @@ export interface IterationContext {
 
 	/** Host hook that shapes each step before the model call. */
 	readonly prepareStep?: PrepareStepChain
+	readonly captureRunEvidence?: PrepareStepContext['captureRunEvidence']
 	readonly beforeStep?: BeforeStep
 }
 

package/src/runtime/query/iteration/phases/tool-review.ts

@@ -150,6 +150,10 @@ export async function* runToolReview(
 				attachSteering(batch.messages, ctx.steering, ctx.onSteeringDelivered),
 				ctx.jobNotices,
 				formatJobNote,
+				// The exits that text accounts for have now been read, so the
+				// record of them stops being pending work. Left standing, it
+				// buys the model a turn the next time any job queues a notice.
+				() => ctx.awaitedJobs?.noticesDelivered(),
 			),
 			notices,
 		)) {
@@ -220,6 +224,9 @@ export async function* runToolReview(
 			toolCall.authorization = {
 				decision: gateResult.decision,
 				...(gateResult.reason ? { reason: gateResult.reason } : {}),
+				...(gateResult.decision === 'review' && gateResult.matchedRule
+					? { explicitReview: true as const }
+					: {}),
 			}
 		}
 

package/src/runtime/query/iteration/provider-rejected-image.ts

@@ -1,4 +1,5 @@
 import { isProviderRequestError } from '../../../provider/errors.js'
+import type { Message } from '../../../types/message/index.js'
 import type {
 	ChatCompletionParams,
 	LLMProvider,
@@ -42,7 +43,8 @@ function isAcceptedChunk(chunk: StreamChunk): boolean {
 			chunk.delta.citation ||
 			chunk.finishReason !== undefined ||
 			chunk.usage !== undefined ||
-			chunk.replayState !== undefined,
+			chunk.replayState !== undefined ||
+			chunk.textParts !== undefined,
 	)
 }
 
@@ -62,8 +64,10 @@ export async function* streamWithProviderRejectedImageRecovery(
 	provider: LLMProvider,
 	params: ChatCompletionParams,
 	onAccepted: (identity: RequestImageIdentity) => Promise<void>,
+	onRequest?: (messages: readonly Message[]) => void,
 ): AsyncIterable<StreamChunk> {
 	const candidate = findSingleRequestImage(params.messages)
+	onRequest?.(params.messages)
 	if (candidate === null) {
 		yield* provider.chatStream(params)
 		return
@@ -90,6 +94,7 @@ export async function* streamWithProviderRejectedImageRecovery(
 	}
 	let accepted = false
 	let retryReportedError = false
+	onRequest?.(retryParams.messages)
 	for await (const chunk of provider.chatStream(retryParams)) {
 		if (chunk.error !== undefined) retryReportedError = true
 		if (!accepted && isAcceptedChunk(chunk)) {

package/src/runtime/query/iteration/stream-turn.ts

@@ -4,6 +4,7 @@ import {
 	assertNativeStructuredOutputSupported,
 } from '../../../provider/capabilities.js'
 import { isProviderRequestError } from '../../../provider/errors.js'
+import { StreamTextAccumulator } from '../../../provider/stream-text.js'
 import { GENAI, NAMZU, chatSpanName, parentContext } from '../../../telemetry/attributes.js'
 import {
 	recordModelDuration,
@@ -14,7 +15,12 @@ import { getTracer } from '../../../telemetry/runtime-accessors.js'
 import { mergeTokenUsage } from '../../../types/common/index.js'
 import { NamzuError } from '../../../types/errors/index.js'
 import type { ToolUseId } from '../../../types/ids/index.js'
-import type { Citation, ReasoningBlock } from '../../../types/message/index.js'
+import type {
+	AssistantTextPart,
+	Citation,
+	Message,
+	ReasoningBlock,
+} from '../../../types/message/index.js'
 import { ProviderError } from '../../../types/provider/errors.js'
 import type {
 	ChatCompletionResponse,
@@ -54,6 +60,8 @@ function synthesizeMessageStopReason(
 export interface StreamingTurnResult {
 	response: ChatCompletionResponse
 	messageId: import('../../../types/ids/index.js').MessageId
+	/** Captured only for host review, at the provider-chain dispatch boundary. */
+	requestMessages?: readonly Message[]
 }
 
 /**
@@ -100,6 +108,7 @@ async function settleCancelledTurn(args: {
 	messageId: import('../../../types/ids/index.js').MessageId
 	usage: ChatCompletionResponse['usage']
 	text: string
+	textParts?: readonly AssistantTextPart[]
 	model: string
 	startedAt: number
 	span: Span
@@ -124,6 +133,7 @@ async function settleCancelledTurn(args: {
 			stopReason: 'cancelled',
 			usage: args.usage,
 			content: args.text || undefined,
+			...(args.textParts ? { textParts: args.textParts } : {}),
 		})
 	} catch {
 		// Best effort. The cancellation is the news.
@@ -156,6 +166,7 @@ export async function* streamProviderTurn(
 	imageRecovery?: {
 		readonly onAccepted: (identity: RequestImageIdentity) => Promise<void>
 	},
+	captureRequest = false,
 ): AsyncGenerator<RunEvent, StreamingTurnResult> {
 	assertNativeStructuredOutputSupported(provider, params)
 	assertHostedWebSearchSupported(provider, params)
@@ -181,7 +192,7 @@ export async function* streamProviderTurn(
 
 	let id = ''
 	const model = ''
-	let textBuf = ''
+	const text = new StreamTextAccumulator()
 	let finishReason: ChatCompletionResponse['finishReason'] = 'stop'
 	let usage: ChatCompletionResponse['usage'] = {
 		promptTokens: 0,
@@ -239,9 +250,21 @@ export async function* streamProviderTurn(
 		...params,
 		stream: true,
 	} satisfies import('../../../types/provider/index.js').ChatCompletionParams
+	let requestMessages: readonly Message[] | undefined
+	const observeRequest = captureRequest
+		? (messages: readonly Message[]) => {
+				requestMessages = structuredClone(messages)
+			}
+		: undefined
+	if (!imageRecovery) observeRequest?.(streamParams.messages)
 	const stream = (
 		imageRecovery
-			? streamWithProviderRejectedImageRecovery(provider, streamParams, imageRecovery.onAccepted)
+			? streamWithProviderRejectedImageRecovery(
+					provider,
+					streamParams,
+					imageRecovery.onAccepted,
+					observeRequest,
+				)
 			: provider.chatStream(streamParams)
 	) as AsyncIterable<StreamChunk>
 
@@ -328,6 +351,7 @@ export async function* streamProviderTurn(
 			}
 			if (!id && chunk.id) id = chunk.id
 			if (chunk.replayState !== undefined) replayState = chunk.replayState
+			text.push(chunk)
 
 			// The first delta of the turn, of ANY kind — text, reasoning or a
 			// tool call. namzu streams, so perceived latency is dominated by
@@ -401,13 +425,13 @@ export async function* streamProviderTurn(
 			}
 
 			if (chunk.delta.content) {
-				textBuf += chunk.delta.content
 				await emitEvent({
 					type: 'text_delta',
 					runId,
 					iteration,
 					messageId,
 					text: chunk.delta.content,
+					...(chunk.delta.textPart ? { textPart: chunk.delta.textPart } : {}),
 				})
 				yield* drainPending()
 			}
@@ -518,7 +542,8 @@ export async function* streamProviderTurn(
 				iteration,
 				messageId,
 				usage,
-				text: textBuf,
+				text: text.text,
+				textParts: text.textParts,
 				model: params.model,
 				startedAt: callStartedAt,
 				span: chatSpan,
@@ -661,7 +686,8 @@ export async function* streamProviderTurn(
 		messageId,
 		stopReason,
 		usage,
-		content: textBuf || undefined,
+		content: text.text || undefined,
+		...(text.textParts ? { textParts: text.textParts } : {}),
 	})
 	yield* drainPending()
 
@@ -714,7 +740,8 @@ export async function* streamProviderTurn(
 		model: model || params.model,
 		message: {
 			role: 'assistant',
-			content: textBuf.length > 0 ? textBuf : null,
+			content: text.text || null,
+			...(text.textParts ? { textParts: text.textParts } : {}),
 			toolCalls: toolCalls.length > 0 ? toolCalls : undefined,
 			...(reasoningBlocks.length > 0 ? { reasoning: reasoningBlocks } : {}),
 			...(replayState !== undefined ? { replayState } : {}),
@@ -746,5 +773,5 @@ export async function* streamProviderTurn(
 	chatSpan.setStatus({ code: SpanStatusCode.OK })
 	chatSpan.end()
 
-	return { response, messageId }
+	return { response, messageId, ...(requestMessages ? { requestMessages } : {}) }
 }

package/src/runtime/query/plugin-hooks.ts

@@ -59,3 +59,23 @@ export function applyLifecycleHookResults(
 	}
 	return annotations
 }
+
+/**
+ * What a `pre_tool_use` hook's SKIP goes back to the model as.
+ *
+ * A function rather than a template at the one call site, because the text is
+ * a SIGNAL as well as prose. A skipped call gets a non-error receipt — the
+ * hook refused it, nothing failed — so the transcript's only record that the
+ * tool never ran is this sentence. `file-evidence-replay.ts` reads it back to
+ * keep a skipped `write` from being replayed as a body the file now holds,
+ * and it can only do that while one function owns both the writing and the
+ * recognising.
+ */
+export function skippedToolResultText(toolName: string, reason: string): string {
+	return `Tool ${toolName} skipped by plugin: ${reason}`
+}
+
+/** Whether `content` is the receipt {@link skippedToolResultText} writes for `toolName`. */
+export function isSkippedToolResult(toolName: string, content: string): boolean {
+	return content.startsWith(skippedToolResultText(toolName, ''))
+}

package/src/runtime/query/repeat-call.ts

@@ -1,3 +1,4 @@
+import { createRuntimeContextMessage } from '../../types/message/index.js'
 import type { Message } from '../../types/message/index.js'
 import { stableStringify } from './tool-grants.js'
 
@@ -128,11 +129,24 @@ export class RepeatCallTracker {
 }
 
 /**
- * Rides the notice out on the last `tool_result` of the batch.
+ * Rides the notice out on the last `tool_result` of the batch, same slot
+ * steering uses: a `tool_use` block must be answered by a `tool_result` with
+ * the same id, so a user message wedged between them is rejected by the
+ * provider outright.
  *
- * The same and only legal slot steering uses: a `tool_use` block must be
- * answered by a `tool_result` with the same id, so a user message wedged
- * between them is rejected by the provider outright.
+ * That slot only exists when the trailing result's content is plain text. A
+ * result answered with structured content (an image, a document, an MCP
+ * block) has a shape the model reads positionally, and appending a string to
+ * it is either dropped or corrupts the block — this used to mean the notice
+ * was simply dropped, on the theory that an advisory costs nothing to lose.
+ * It costs more than a refusal would: `RepeatCallTracker.record` already
+ * marked the threshold as announced the moment it fired, so a notice lost
+ * here never comes back, unlike steering, which can requeue and wait for a
+ * later plain-text result. The fallback instead rides out as its own
+ * `runtime-context` message placed AFTER the complete tool-result batch —
+ * never between a `tool_use` and its `tool_result`, so provider-required
+ * adjacency still holds — carrying that provenance so it is never mistaken
+ * for operator input (see `isOperatorUserMessage` in `steering.ts`).
  */
 export function attachRepeatNotice(
 	messages: readonly Message[],
@@ -140,6 +154,8 @@ export function attachRepeatNotice(
 ): readonly Message[] {
 	if (notices.length === 0) return messages
 
+	const noticeText = notices.map((n) => n.text).join('\n')
+
 	let lastToolIndex = -1
 	for (let index = messages.length - 1; index >= 0; index--) {
 		if (messages[index]?.role === 'tool') {
@@ -147,19 +163,13 @@ export function attachRepeatNotice(
 			break
 		}
 	}
-	if (lastToolIndex === -1) return messages
-
-	const target = messages[lastToolIndex] as Message
-	// Text only, for the reason `attachSteering` gives: a result answered
-	// with structured content has a shape the model reads positionally, and
-	// appending a string to it is either dropped or corrupts the block. The
-	// notice is advisory, so dropping it costs nothing a refusal would.
-	if (typeof target.content !== 'string') return messages
-
-	const next = [...messages]
-	next[lastToolIndex] = {
-		...target,
-		content: `${target.content}\n\n${notices.map((n) => n.text).join('\n')}`,
+	const target = lastToolIndex === -1 ? undefined : (messages[lastToolIndex] as Message)
+
+	if (target && typeof target.content === 'string') {
+		const next = [...messages]
+		next[lastToolIndex] = { ...target, content: `${target.content}\n\n${noticeText}` }
+		return next
 	}
-	return next
+
+	return [...messages, createRuntimeContextMessage(noticeText, 'repeat-call')]
 }

package/src/runtime/query/resume-pending.ts

@@ -1,6 +1,7 @@
 import { isDeepStrictEqual } from 'node:util'
 
 import type { RunPersistence } from '../../manager/run/persistence.js'
+import { ToolExecutionCollector } from '../../store/run/tool-executions.js'
 import type {
 	CheckpointId,
 	HITLResumeDecision,
@@ -9,6 +10,7 @@ import type {
 } from '../../types/hitl/index.js'
 import type { AssistantMessage, Message, ToolCall } from '../../types/message/index.js'
 import type { ChatCompletionResponse } from '../../types/provider/index.js'
+import type { ToolExecutionSnapshot } from '../../types/run/store.js'
 import type { Logger } from '../../utils/logger.js'
 import type { PriorToolResults, ToolCallDenials, ToolExecutor } from './executor.js'
 import { PendingAnswers } from './question-park.js'
@@ -192,24 +194,11 @@ function planQuestionResume(
 }
 
 /**
- * Decide whether a checkpoint left behind a batch that was PART-WAY
- * through executing when the process died.
- *
- * The ordinary repair for an unanswered assistant turn — strip it and let
- * the model re-decide — is right when nothing ran: the calls were still
- * awaiting a decision, so re-deciding costs only a round trip. It is
- * exactly wrong when some of them already ran, because re-deciding means
- * re-executing, and a tool that charged a card does not become idempotent
- * on the second attempt.
- *
- * The discriminator is the transcript: a tool-review park records the
- * checkpoint BEFORE any execution, so it has no completed calls and takes
- * the cheap path unchanged. One or more completions means execution had
- * begun, which is a resume, not a fresh decision.
- *
- * The calls that did NOT complete are executed here for the first time,
- * through the ordinary executor — so every guard, permission check and
- * probe still applies to them.
+ * Preserve a restored batch's recorded and explicitly unknown outcomes.
+ * `completed` comes from recoverCompletedCalls: missing entries are eligible
+ * only after a complete scan establishes that they have no recorded start.
+ * A started tool with no trustworthy completion is carried as an unknown
+ * outcome, not executed again. An untouched batch uses ordinary history repair.
  */
 export function planCrashResume(
 	checkpoint: IterationCheckpoint,
@@ -219,13 +208,19 @@ export function planCrashResume(
 	const assistant = lastUnansweredBatch(checkpoint.messages)?.assistant
 	const calls = assistant?.toolCalls
 	if (!assistant || !calls || calls.length === 0) return null
+	// Only the current tail can be resumed in place. An older incomplete
+	// batch belongs to history repair; re-appending it would move its action
+	// past a newer operator message and silently reorder the conversation.
+	const ownerIndex = checkpoint.messages.lastIndexOf(assistant)
+	if (checkpoint.messages.slice(ownerIndex + 1).some((message) => message.role !== 'tool'))
+		return null
 
 	const done = calls.filter((tc) => completed.has(tc.id))
 	if (done.length === 0) return null
 
 	log.warn('Checkpoint holds a tool batch that was part-way through executing', {
 		'namzu.checkpoint.id': checkpoint.id,
-		'namzu.runtime.completed': done.length,
+		'namzu.runtime.recovered': done.length,
 		'namzu.runtime.total': calls.length,
 		'namzu.runtime.remaining': calls
 			.filter((tc) => !completed.has(tc.id))
@@ -336,37 +331,67 @@ function modifiedCallIds(decision: HITLResumeDecision): ReadonlySet<string> {
 }
 
 /**
- * Results the run already produced for calls in `toolCalls`.
- *
- * Read from the transcript, which records a `tool_completed` per tool as
- * it finishes — durable long before the batch settles. Scoped to the calls
- * being resumed so an id from an earlier turn can never answer this one.
- *
- * A failure to read is not fatal: the worst case is the behaviour that
- * existed before this recovery, and refusing to resume because a log could
- * not be read would be a strictly worse trade.
+ * Recover completed results and close interrupted calls with unknown outcomes.
+ * Only a complete execution scan can authorize the absence of a start record.
+ * Unreadable, partial or contradictory evidence never becomes permission to
+ * replay; an explicitly answered durable question may re-enter its own tool.
  */
 export async function recoverCompletedCalls(
 	runMgr: RunPersistence,
 	toolCalls: readonly ToolCall[],
 	log: Logger,
+	options: { answers?: PendingAnswers; signal?: AbortSignal } = {},
 ): Promise<Map<string, { result: string; isError: boolean }>> {
 	const recovered = new Map<string, { result: string; isError: boolean }>()
+	let snapshot: ToolExecutionSnapshot | undefined
 	try {
-		const completed = await runMgr.getRunStore().readCompletedTools()
-		for (const call of toolCalls) {
-			const record = completed.get(call.id)
-			if (record) recovered.set(call.id, { result: record.result, isError: record.isError })
+		const store = runMgr.getRunStore()
+		if (store.readToolExecutions) {
+			snapshot = await store.readToolExecutions(
+				toolCalls.map((call) => call.id),
+				options.signal,
+			)
+		} else {
+			const collector = new ToolExecutionCollector(
+				runMgr.id,
+				toolCalls.map((call) => call.id),
+			)
+			for (const event of await store.readEvents({ integrity: 'strict' })) {
+				options.signal?.throwIfAborted()
+				collector.accept(event)
+			}
+			snapshot = collector.finish()
 		}
 	} catch (error) {
+		if (options.signal?.aborted) throw error
 		log.warn('Could not read the transcript to recover completed tool calls', {
 			'exception.message': error instanceof Error ? error.message : String(error),
 		})
-		return new Map()
+	}
+	for (const call of toolCalls) {
+		const record = snapshot?.records.get(call.id)
+		if (
+			snapshot?.complete &&
+			(!record || (record.toolName === call.function.name && record.toolUseId === call.id))
+		) {
+			if (!record) continue // Complete evidence proves this call has no recorded start.
+			if (record.status === 'completed') {
+				recovered.set(call.id, { result: record.result, isError: record.isError })
+				continue
+			}
+		}
+		// The validated checkpoint and explicit answer own this re-entry even
+		// when the prior event store is unavailable. No sibling inherits it.
+		if ([...(options.answers?.entries() ?? [])].some(([id]) => isPauseForCall(id, call.id)))
+			continue
+		recovered.set(call.id, {
+			result: `Tool execution was interrupted and no trustworthy completion is available for \`${call.function.name}\`. Its outcome is unknown. This resume did not execute it again. Verify external state before deciding whether another call is needed; do not replay a state-changing action to recover its output.`,
+			isError: true,
+		})
 	}
 
 	if (recovered.size > 0) {
-		log.info('Recovered tool results from the transcript instead of re-executing', {
+		log.info('Restored recorded or unknown tool outcomes without re-executing', {
 			'namzu.runtime.recovered': recovered.size,
 			'namzu.runtime.of_calls': toolCalls.length,
 		})
@@ -452,13 +477,13 @@ function synthesizeResponse(assistant: AssistantMessage): ChatCompletionResponse
 }
 
 /**
- * Tool calls in the history that no `tool_result` answers.
- *
- * The set worth asking the transcript about: an already-answered call's
- * result is in the history and needs no recovery.
+ * All calls owned by the last incomplete batch. Applying a resume plan
+ * reconstructs that entire batch, including any partial results already in
+ * the checkpoint. Those answered siblings must also be recovered, or their
+ * missing prior-result entries would let the executor repeat them.
  */
-export function unansweredToolCalls(messages: readonly Message[]): ToolCall[] {
-	return lastUnansweredBatch(messages)?.unanswered ?? []
+export function interruptedToolCalls(messages: readonly Message[]): ToolCall[] {
+	return lastUnansweredBatch(messages)?.assistant.toolCalls ?? []
 }
 
 function lastUnansweredBatch(

package/src/runtime/query/review-policy.ts

@@ -1,9 +1,9 @@
 /**
- * How a run resolves the calls no rule decided.
+ * How a run resolves calls routed to review.
  *
  * An authorization rule says what a tool may do. A review policy says what
- * happens to everything the rules did not cover: the batch the gate routed
- * to REVIEW. The two axes are separate on purpose — a rule is a durable
+ * happens to calls the rules did not cover or explicitly routed to REVIEW.
+ * The two axes are separate on purpose — a rule is a durable
  * statement an operator reviewed, and a mode is a property of ONE run, the
  * difference between "we never force-push" and "this run is unattended".
  *
@@ -132,12 +132,14 @@ export function isReviewExempt(
 
 export type ReviewExemption = (name: string, input: unknown) => boolean
 
-/** A batch needs review when any call mutates state: flagged destructive, or not exempt. */
+/** Review explicit requests and calls that are destructive or not exempt. */
 export function batchNeedsReview(
 	toolCalls: readonly ToolCallSummary[],
 	exempt: ReviewExemption,
 ): boolean {
-	return toolCalls.some((tc) => tc.isDestructive || !exempt(tc.name, tc.input))
+	return toolCalls.some(
+		(tc) => tc.authorization?.explicitReview || tc.isDestructive || !exempt(tc.name, tc.input),
+	)
 }
 
 /** The batch a person is asked about. */
@@ -194,14 +196,16 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 		if (
 			mode === 'accept-edits' &&
 			request.toolCalls.every(
-				(tc) => !tc.isDestructive && (ACCEPT_EDITS_TOOLS.has(tc.name) || exempt(tc.name, tc.input)),
+				(tc) =>
+					!tc.authorization?.explicitReview &&
+					!tc.isDestructive &&
+					(ACCEPT_EDITS_TOOLS.has(tc.name) || exempt(tc.name, tc.input)),
 			)
 		) {
 			return { action: 'approve_tools' }
 		}
-		// Reads were approved above. Anything that reached here would change
-		// something, and plan mode's answer is the same every time: not now,
-		// tell the user what you would do.
+		// Ordinary reads were approved above. Remaining calls either change
+		// state or carry explicit review; plan mode does not grant that authority.
 		if (mode === 'plan') return { action: 'reject_tools', feedback: PLAN_MODE_REFUSAL }
 		if (mode === 'strict') return { action: 'reject_tools', feedback: STRICT_MODE_REFUSAL }
 		if (mode === 'auto' || !prompt || remembered.all) {

package/src/runtime/query/sandbox-lifecycle.ts

@@ -138,6 +138,9 @@ export async function acquireSandbox(options: {
 		runSignal.addEventListener('abort', onAbort, { once: true })
 	})
 	const timedOut = new Promise<{ readonly kind: 'timed_out'; readonly error: Error }>((resolve) => {
+		// An unlimited run still observes cancellation; Infinity must never reach
+		// setTimeout, where Node would coerce it to a one-millisecond deadline.
+		if (options.timeoutMs === Number.POSITIVE_INFINITY) return
 		timer = setTimeout(() => {
 			timeoutError = acquisitionTimeoutError(options.timeoutMs)
 			operationController.abort(timeoutError)

package/src/runtime/query/steering.ts

@@ -100,6 +100,16 @@ export function attachNotice(
 	messages: readonly Message[],
 	channel: SteeringChannel | undefined,
 	format: (text: string) => string,
+	/**
+	 * Told only when the text actually landed on a result the model will read.
+	 *
+	 * Not on the two paths above it: a batch with no tool result leaves the
+	 * notice queued, and a result whose content is not a string puts it back.
+	 * Draining is therefore not delivery, which matters to the caller that
+	 * keeps its own record of what the text accounts for — `AwaitedJobs`
+	 * drops an exit's entry here, and a premature drop would strand the exit.
+	 */
+	onDelivered?: () => void,
 ): readonly Message[] {
 	if (!channel?.pending) return messages
 	let lastToolIndex = -1
@@ -119,6 +129,7 @@ export function attachNotice(
 	}
 	const next = [...messages]
 	next[lastToolIndex] = { ...target, content: target.content + format(text) }
+	onDelivered?.()
 	return next
 }