@namzu/sdk 51.1.0 → 52.1.0

package/src/bridge/acp/update.ts

@@ -49,6 +49,7 @@ const STOP_REASONS: Readonly<Record<string, AcpStopReason>> = {
 	plan_rejected: 'refused',
 	answer_rejected: 'refused',
 	structured_output_failed: 'error',
+	output_limit: 'error',
 	error: 'error',
 	provider_error: 'error',
 }

package/src/compaction/context-window.ts

@@ -105,6 +105,47 @@ export function lookupContextWindow(model: string | undefined): number | undefin
 	return undefined
 }
 
+/** Output room the trigger keeps free: the model's output cap, at most this many tokens. */
+export const TRIGGER_OUTPUT_RESERVE_CAP_TOKENS = 20_000
+/** Extra headroom below the reserved window before a summary is due. */
+export const TRIGGER_BUFFER_TOKENS = 13_000
+/**
+ * The derived trigger never drops below this fraction of the window. The
+ * reference subtracts 33,000 tokens outright; on a window under about 66,000
+ * that is most of it (or more than all of it), and a summary on every
+ * iteration is not a trigger.
+ */
+export const MIN_DERIVED_TRIGGER_FRACTION = 0.5
+
+/**
+ * The fraction of the window at which older history is summarised.
+ *
+ * A host that set `triggerThreshold` gets exactly that. Otherwise the
+ * trigger is the one Claude Code uses: the window, less room kept for the
+ * reply (the model's output cap, at most 20,000 tokens), less a 13,000-token
+ * buffer. On a 200,000-token window that is 167,000 tokens (83.5%); on a
+ * 1,000,000-token window, 967,000 (96.7%).
+ *
+ * `maxOutputTokens` is what the driver declares for the model; absent, the
+ * full 20,000 is reserved.
+ */
+export function resolveTriggerThreshold(
+	configured: number | undefined,
+	windowTokens: number,
+	maxOutputTokens?: number,
+): number {
+	if (configured !== undefined) return configured
+	if (!(windowTokens > 0)) return MIN_DERIVED_TRIGGER_FRACTION
+	const reserve = Math.min(
+		maxOutputTokens !== undefined && maxOutputTokens > 0
+			? maxOutputTokens
+			: TRIGGER_OUTPUT_RESERVE_CAP_TOKENS,
+		TRIGGER_OUTPUT_RESERVE_CAP_TOKENS,
+	)
+	const fraction = (windowTokens - reserve - TRIGGER_BUFFER_TOKENS) / windowTokens
+	return Math.min(1, Math.max(MIN_DERIVED_TRIGGER_FRACTION, fraction))
+}
+
 export interface ResolvedContextWindow {
 	readonly tokens: number
 	/**

package/src/compaction/manual.ts

@@ -198,7 +198,11 @@ export async function compactNow(input: CompactNowInput): Promise<CompactionResu
 			usage = accumulateTokenUsage(usage, reported)
 		},
 		input.model ?? '',
-		{ signal: input.signal, streamIdleTimeoutMs: input.streamIdleTimeoutMs },
+		{
+			signal: input.signal,
+			streamIdleTimeoutMs: input.streamIdleTimeoutMs,
+			instructions: input.instructions,
+		},
 	)
 
 	const { messages, summary } = splice(preservedSystem, body, retainedOlder, plan.recentMessages)
@@ -281,7 +285,11 @@ export async function compactRegion(input: CompactRegionInput): Promise<Compacti
 			usage = accumulateTokenUsage(usage, reported)
 		},
 		input.model ?? '',
-		{ signal: input.signal, streamIdleTimeoutMs: input.streamIdleTimeoutMs },
+		{
+			signal: input.signal,
+			streamIdleTimeoutMs: input.streamIdleTimeoutMs,
+			instructions: input.instructions,
+		},
 	)
 
 	// Same cross-run ownership as compactNow: a selected region has been

package/src/compaction/plan.ts

@@ -1,5 +1,6 @@
 import type { CompactionConfig } from '../config/runtime.js'
 import type { Message } from '../types/message/index.js'
+import { resolveTriggerThreshold } from './context-window.js'
 import { findSafeTrimIndex } from './dangling.js'
 import { buildGoal } from './salience/goal.js'
 import { scoreMessages } from './salience/score.js'
@@ -64,6 +65,8 @@ export interface CompactionPlanInput {
 	readonly messages: readonly Message[]
 	readonly config: CompactionConfig
 	readonly contextWindowTokens: number
+	/** The model's output cap, when known; sizes the derived trigger. */
+	readonly maxOutputTokens?: number
 	readonly estimatedTokens: number
 	readonly force?: boolean
 	/**
@@ -137,6 +140,8 @@ export function planSalienceWorkingSet(input: {
 	readonly messages: readonly Message[]
 	readonly config: CompactionConfig
 	readonly contextWindowTokens: number
+	/** The model's output cap, when known; sizes the derived trigger. */
+	readonly maxOutputTokens?: number
 	readonly estimatedTokens: number
 	readonly openTasks?: readonly string[]
 }): Extract<CompactionPlan, { kind: 'cleared' }> & { readonly working: WorkingSetPlan } {
@@ -161,7 +166,9 @@ export function planSalienceWorkingSet(input: {
 		stubbedCount: working.stubbedCount,
 		charsReclaimed: working.charsReclaimed,
 		reclaimedTokens: working.reclaimedTokens,
-		reliefWasEnough: (estimatedTokens - working.reclaimedTokens) / budget < config.triggerThreshold,
+		reliefWasEnough:
+			(estimatedTokens - working.reclaimedTokens) / budget <
+			resolveTriggerThreshold(config.triggerThreshold, budget, input.maxOutputTokens),
 		working,
 	}
 }
@@ -189,7 +196,9 @@ export function planCompaction(input: CompactionPlanInput): CompactionPlan {
 			// would declare success after clearing one result and hand back a
 			// history that overflows again on the retry.
 			const reliefWasEnough =
-				!input.force && (estimatedTokens - reclaimedTokens) / budget < config.triggerThreshold
+				!input.force &&
+				(estimatedTokens - reclaimedTokens) / budget <
+					resolveTriggerThreshold(config.triggerThreshold, budget, input.maxOutputTokens)
 			return {
 				kind: 'cleared',
 				messages: edit.messages,

package/src/compaction/verifier.ts

@@ -3,6 +3,7 @@ import { collectChatCompletion } from '../provider/collect-chat-completion.js'
 import { resolveStreamIdleTimeoutMs, withStreamIdleTimeout } from '../provider/idle-timeout.js'
 import type { TokenUsage } from '../types/common/index.js'
 import type { Message, MessageAttachment, ToolResultBlock } from '../types/message/index.js'
+import { classifyProviderError } from '../types/provider/errors.js'
 import type { LLMProvider } from '../types/provider/interface.js'
 import type { WorkingStateManager } from './manager.js'
 import { serializeState } from './serializer.js'
@@ -85,6 +86,23 @@ function* conversationExcerpt(messages: readonly Message[]): Generator<string> {
 	}
 }
 
+/** Verifier requests dropped to a shorter excerpt before the extracted state stands alone. */
+const MAX_VERIFIER_HEAD_TRUNCATIONS = 3
+
+/** What stands where the older half of a verifier excerpt was cut. */
+const EXCERPT_TRUNCATED_PLACEHOLDER = '[earlier conversation truncated for compaction retry]'
+
+/** Drop the older half of an excerpt, keeping the newer half behind a placeholder. */
+function truncateExcerptHead(excerpt: string): string {
+	const body = excerpt.startsWith(EXCERPT_TRUNCATED_PLACEHOLDER)
+		? excerpt.slice(EXCERPT_TRUNCATED_PLACEHOLDER.length).trimStart()
+		: excerpt
+	let kept = body.slice(Math.floor(body.length / 2))
+	const first = kept.charCodeAt(0)
+	if (first >= 0xdc00 && first <= 0xdfff) kept = kept.slice(1)
+	return `${EXCERPT_TRUNCATED_PLACEHOLDER}\n\n${kept}`
+}
+
 function truncateMessages(messages: readonly Message[], budget: number): string {
 	if (budget <= 0) return ''
 	const parts: string[] = []
@@ -127,6 +145,26 @@ export interface CompactionVerificationOptions {
 	 * only for explicit unbounded compatibility.
 	 */
 	readonly streamIdleTimeoutMs?: number
+	/**
+	 * What the person asked the summary to pay attention to, in their words
+	 * (`/compact keep the failing test names`). Given to the verifier model as
+	 * a request to add whatever of it the extracted state lacks. Naming
+	 * instructions makes the model step run even when `llmVerification` is off,
+	 * because it is the only step that can act on free text.
+	 */
+	readonly instructions?: string
+}
+
+/** Longest instruction text passed on; a pasted page is not an instruction. */
+export const MAX_COMPACTION_INSTRUCTIONS_CHARS = 2_000
+
+function withInstructions(prompt: string, instructions: string | undefined): string {
+	const text = instructions?.trim().slice(0, MAX_COMPACTION_INSTRUCTIONS_CHARS)
+	if (!text) return prompt
+	return `${prompt}
+
+The person who asked for this summary also said what it must keep: ${text}
+Treat that as part of "important information". If the structured state lacks something it asks for and the excerpt has it, list that too.`
 }
 
 export async function buildVerifiedSummary(
@@ -157,6 +195,7 @@ export async function buildVerifiedSummary(
 		onUsage,
 		model,
 		options.signal,
+		options.instructions,
 	)
 }
 
@@ -174,6 +213,7 @@ export async function buildVerifiedSummaryWithBoundedProvider(
 	onUsage?: UsageSink,
 	model?: string,
 	signal?: AbortSignal,
+	instructions?: string,
 ): Promise<string> {
 	signal?.throwIfAborted()
 	return await buildVerifiedSummaryWithProvider(
@@ -184,6 +224,7 @@ export async function buildVerifiedSummaryWithBoundedProvider(
 		onUsage,
 		model,
 		signal,
+		instructions,
 	)
 }
 
@@ -195,14 +236,16 @@ async function buildVerifiedSummaryWithProvider(
 	onUsage?: UsageSink,
 	model?: string,
 	signal?: AbortSignal,
+	instructions?: string,
 ): Promise<string> {
 	const serialized = serializeState(manager.getState())
+	const steered = Boolean(instructions?.trim())
 
-	if (manager.slotCount() >= config.richStateThreshold) {
+	if (!steered && manager.slotCount() >= config.richStateThreshold) {
 		return serialized
 	}
 
-	if (!config.llmVerification) {
+	if (!steered && !config.llmVerification) {
 		return serialized
 	}
 
@@ -212,26 +255,45 @@ async function buildVerifiedSummaryWithProvider(
 		return serialized
 	}
 
-	const verificationMessages: Message[] = [
-		{
-			role: 'system' as const,
-			content: VERIFICATION_PROMPT,
-		},
-		{
-			role: 'user' as const,
-			content: `## Structured State\n\n${serialized}\n\n## Conversation Excerpt\n\n${conversationExcerpt}`,
-		},
-	]
-
-	const response = await collectChatCompletion(
-		provider.chatStream({
-			model: model ?? '',
-			messages: verificationMessages,
-			maxTokens: config.llmVerificationMaxTokens,
-			temperature: 0,
-			...(signal ? { signal } : {}),
-		}),
-	)
+	// The verifier's own request can overflow a small window. The reference
+	// terminal answers that with a ladder: send less, and when nothing is left to
+	// cut, work from everything it already has. Here "less" is the older half of
+	// the excerpt dropped behind a placeholder, at most three times, and
+	// "everything it already has" is the extracted state, which the verifier only
+	// ever adds to.
+	let excerpt = conversationExcerpt
+	let truncations = 0
+	let response: Awaited<ReturnType<typeof collectChatCompletion>>
+	for (;;) {
+		const verificationMessages: Message[] = [
+			{
+				role: 'system' as const,
+				content: withInstructions(VERIFICATION_PROMPT, instructions),
+			},
+			{
+				role: 'user' as const,
+				content: `## Structured State\n\n${serialized}\n\n## Conversation Excerpt\n\n${excerpt}`,
+			},
+		]
+		try {
+			response = await collectChatCompletion(
+				provider.chatStream({
+					model: model ?? '',
+					messages: verificationMessages,
+					maxTokens: config.llmVerificationMaxTokens,
+					temperature: 0,
+					...(signal ? { signal } : {}),
+				}),
+			)
+			break
+		} catch (error) {
+			if (signal?.aborted) throw error
+			if (classifyProviderError(error).code !== 'context_length_exceeded') throw error
+			if (truncations >= MAX_VERIFIER_HEAD_TRUNCATIONS) return serialized
+			truncations++
+			excerpt = truncateExcerptHead(excerpt)
+		}
+	}
 
 	onUsage?.(response.usage)
 

package/src/config/runtime.ts

@@ -41,8 +41,16 @@ export const CompactionConfigSchema = z.object({
 	 * window-pressure instead of being a silent no-op.
 	 */
 	contextWindowTokens: z.number().int().positive().optional(),
-	/** Fraction of the context window at which a compaction pass fires. */
-	triggerThreshold: z.number().min(0).max(1).default(0.7),
+	/**
+	 * Fraction of the context window at which older history is summarised.
+	 *
+	 * Absent, the trigger is derived from the window: the window less room for
+	 * the reply (the model's output cap, at most 20,000 tokens) less a
+	 * 13,000-token buffer, so 83.5% of a 200,000-token window and 96.7% of a
+	 * 1,000,000-token one (see `resolveTriggerThreshold`). It used to default
+	 * to a flat `0.7`; pass that to keep the earlier behaviour.
+	 */
+	triggerThreshold: z.number().min(0).max(1).optional(),
 	/**
 	 * Fraction the pass must get the context BELOW to be worth keeping.
 	 *
@@ -58,6 +66,19 @@ export const CompactionConfigSchema = z.object({
 	 * failure mode once the trigger actually fires.
 	 */
 	resetThreshold: z.number().min(0).max(1).default(0.4),
+	/**
+	 * Give up on automatic compaction when it stops working.
+	 *
+	 * Three failed passes in a row switch it off for the rest of the turn.
+	 * Three compactions in a row, each followed by the window filling again
+	 * within three iterations, stop the turn: the loop refills the context
+	 * faster than a summary can empty it. Each is announced once, as a
+	 * `compaction_failed` event.
+	 *
+	 * Off unless set. Without it a pass that sheds nothing is retried on every
+	 * iteration, and a turn that refills the window is never stopped for it.
+	 */
+	circuitBreaker: z.boolean().optional(),
 	keepRecentMessages: z.number().int().positive().default(4),
 	/**
 	 * Size the retained tail by TOKENS instead of by message count.

package/src/connector/web/guarded-fetch.ts

@@ -8,6 +8,7 @@ import {
 	validateConnectorMaxResponseBytes,
 	validateConnectorTimeoutMs,
 } from '../http-operation.js'
+import { isSameSiteRedirect } from './page.js'
 import {
 	type WebFetchProvider,
 	WebFetchRefusedError,
@@ -304,6 +305,31 @@ export class GuardedFetchProvider implements WebFetchProvider {
 					const next = new URL(location, current)
 					cancelResponseBody(response, new Error('following redirect'))
 					operation.throwIfStopped()
+					if (request.redirects === 'same-host' && !isSameSiteRedirect(current, next)) {
+						// Handed back, not followed. It is still checked: a caller that
+						// goes there next goes through this guard again, but a target
+						// that can never be fetched is better refused here than offered.
+						try {
+							await this.assertAllowed(next.toString(), operation)
+						} catch (err) {
+							operation.throwIfStopped()
+							if (err instanceof WebFetchRefusedError) {
+								throw new WebFetchRefusedError(
+									`A redirect from "${current.toString()}" pointed at "${next.toString()}", which was refused: ${err.message}`,
+									{ url: next.toString(), reason: 'redirect-target' },
+								)
+							}
+							throw err
+						}
+						return {
+							url: current.toString(),
+							status: response.status,
+							body: '',
+							truncated: false,
+							redirects,
+							redirect: { url: next.toString(), status: response.status },
+						}
+					}
 					try {
 						current = await this.assertAllowed(next.toString(), operation)
 					} catch (err) {

package/src/connector/web/index.ts

@@ -6,7 +6,10 @@ export { GuardedFetchProvider, isPrivateAddress } from './guarded-fetch.js'
 export type { GuardedFetchConfig } from './guarded-fetch.js'
 export { WebFetchRefusedError } from './types.js'
 export type {
+	WebContentExtractor,
+	WebExtractRequest,
 	WebFetchProvider,
+	WebFetchRedirectPolicy,
 	WebFetchRefusalReason,
 	WebFetchRequest,
 	WebFetchResult,

package/src/connector/web/page.ts

@@ -0,0 +1,130 @@
+/**
+ * What `web_fetch` does with a page after the guard has let it through:
+ * decide which redirects stay on the same site, turn HTML into markdown, and
+ * keep a page for a quarter of an hour so a second question about it does not
+ * fetch it again.
+ *
+ * None of it touches the network or a model. The guard (`guarded-fetch.ts`)
+ * decides what may be fetched; this decides what the model is shown.
+ */
+
+/** How long a fetched page is kept. */
+export const WEB_PAGE_CACHE_TTL_MS = 15 * 60 * 1000
+/** Most the cache holds, counted in bytes of page text. */
+export const WEB_PAGE_CACHE_MAX_BYTES = 50 * 1024 * 1024
+/** Most HTML handed to the converter; the rest is dropped with a marker. */
+export const WEB_PAGE_CONVERT_MAX_CHARS = 1024 * 1024
+/** Most page text a model is asked about in one call. */
+export const WEB_PAGE_MODEL_MAX_CHARS = 100_000
+/** Marker the reference-shaped cuts end with. */
+export const WEB_PAGE_TRUNCATED_MARKER = '[Content truncated due to length...]'
+
+/**
+ * A redirect stays on the site when only the path or query changes (and
+ * `www.` comes or goes). `http:` to `https:` on the same host and default
+ * port is the same site too: the reference upgrades every URL to `https:`
+ * before it asks, so that hop never reaches it.
+ */
+export function isSameSiteRedirect(from: URL, to: URL): boolean {
+	const upgrade = from.protocol === 'http:' && to.protocol === 'https:'
+	if (to.protocol !== from.protocol && !upgrade) return false
+	if (to.port !== from.port) return false
+	if (to.username !== '' || to.password !== '') return false
+	const bare = (host: string): string => host.replace(/^www\./u, '')
+	return bare(to.hostname) === bare(from.hostname)
+}
+
+type Converter = { turndown(html: string): string }
+let converter: Promise<Converter> | undefined
+
+function loadConverter(): Promise<Converter> {
+	converter ??= import('turndown').then((module) => {
+		const Turndown = module.default
+		const service = new Turndown()
+		service.remove(['style', 'script', 'noscript', 'iframe'])
+		return service
+	})
+	return converter
+}
+
+/**
+ * HTML as markdown. Style, script, noscript and iframe elements are dropped,
+ * and the input is cut at {@link WEB_PAGE_CONVERT_MAX_CHARS}. Never throws: a
+ * page the converter cannot read comes back as the HTML it was.
+ */
+export async function htmlToMarkdown(html: string): Promise<string> {
+	try {
+		const markdown = (await loadConverter()).turndown(html.slice(0, WEB_PAGE_CONVERT_MAX_CHARS))
+		return html.length > WEB_PAGE_CONVERT_MAX_CHARS
+			? `${markdown}\n\n${WEB_PAGE_TRUNCATED_MARKER}`
+			: markdown
+	} catch {
+		return html
+	}
+}
+
+export interface CachedPage {
+	readonly content: string
+	readonly status: number
+	readonly contentType?: string
+	/** Where the fetch ended up. */
+	readonly url: string
+	readonly redirects: readonly string[]
+	readonly truncated: boolean
+	/** Bytes of text the page held before conversion. */
+	readonly bytes: number
+}
+
+interface Entry {
+	readonly page: CachedPage
+	readonly expiresAt: number
+	readonly size: number
+}
+
+/**
+ * Pages by the URL that was asked for, for {@link WEB_PAGE_CACHE_TTL_MS}.
+ * Least recently used goes first when the byte cap is reached. The clock is
+ * `Date.now`, so a test with fake timers moves it.
+ */
+export class WebPageCache {
+	private readonly entries = new Map<string, Entry>()
+	private bytes = 0
+
+	constructor(
+		private readonly ttlMs: number = WEB_PAGE_CACHE_TTL_MS,
+		private readonly maxBytes: number = WEB_PAGE_CACHE_MAX_BYTES,
+	) {}
+
+	get(url: string): CachedPage | undefined {
+		const entry = this.entries.get(url)
+		if (entry === undefined) return undefined
+		if (entry.expiresAt <= Date.now()) {
+			this.remove(url)
+			return undefined
+		}
+		// Re-inserted so the map's order is the order of use.
+		this.entries.delete(url)
+		this.entries.set(url, entry)
+		return entry.page
+	}
+
+	set(url: string, page: CachedPage): void {
+		this.remove(url)
+		const size = Math.max(1, Buffer.byteLength(page.content, 'utf8'))
+		if (size > this.maxBytes) return
+		this.entries.set(url, { page, expiresAt: Date.now() + this.ttlMs, size })
+		this.bytes += size
+		for (const [oldest, entry] of this.entries) {
+			if (this.bytes <= this.maxBytes) break
+			this.entries.delete(oldest)
+			this.bytes -= entry.size
+		}
+	}
+
+	private remove(url: string): void {
+		const entry = this.entries.get(url)
+		if (entry === undefined) return
+		this.entries.delete(url)
+		this.bytes -= entry.size
+	}
+}

package/src/connector/web/types.ts

@@ -15,11 +15,25 @@
  * `GuardedFetchProvider` for what "guarded" is doing the work of.
  */
 
+/**
+ * What a fetch does with a redirect.
+ *
+ * `follow` (the default) follows each hop after checking it. `same-host`
+ * follows only a hop that stays on the same site (same scheme and port,
+ * same host up to a leading `www.`, no credentials) and hands any other back
+ * unfollowed in {@link WebFetchResult.redirect}, so the caller decides whether
+ * to go there: a page that moved to another host is not the page that was
+ * asked for.
+ */
+export type WebFetchRedirectPolicy = 'follow' | 'same-host'
+
 export interface WebFetchRequest {
 	readonly url: string
 	/** Extra headers. The provider may refuse or strip some; see the guard. */
 	readonly headers?: Readonly<Record<string, string>>
 	readonly signal?: AbortSignal
+	/** Defaults to `follow`. A provider that does not know `same-host` follows. */
+	readonly redirects?: WebFetchRedirectPolicy
 }
 
 export interface WebFetchResult {
@@ -38,6 +52,12 @@ export interface WebFetchResult {
 	readonly truncated: boolean
 	/** Every URL in the redirect chain, in order, including the final one. */
 	readonly redirects: readonly string[]
+	/**
+	 * A redirect that was not followed (see {@link WebFetchRedirectPolicy}).
+	 * `url` is where the server pointed, already checked against the same
+	 * rules as any fetch, and `body` is empty.
+	 */
+	readonly redirect?: { readonly url: string; readonly status: number }
 }
 
 /** Why a fetch was refused before it left the process. */
@@ -62,6 +82,33 @@ export interface WebFetchProvider {
 	fetch(request: WebFetchRequest): Promise<WebFetchResult>
 }
 
+/** One question about one page, for a model to answer. */
+export interface WebExtractRequest {
+	readonly url: string
+	/** What the caller wants from the page. */
+	readonly prompt: string
+	/** The page as markdown (or its raw text), already cut to the size a model should read. */
+	readonly content: string
+	/** The system instruction to run `body` under. */
+	readonly instruction: string
+	/** The user message: the page and the question, built by the tool. */
+	readonly body: string
+	readonly signal?: AbortSignal
+	readonly sessionId: string
+	readonly turnId: string
+}
+
+/**
+ * Answers a prompt from a page with a small model.
+ *
+ * Supplied by the host: this kernel runs no model of its own here. Resolves
+ * the answer, or `undefined` / rejects when it cannot; `web_fetch` then
+ * returns the page itself, as it did before there was an extractor.
+ */
+export interface WebContentExtractor {
+	extract(request: WebExtractRequest): Promise<string | undefined>
+}
+
 export interface WebSearchRequest {
 	readonly query: string
 	readonly limit?: number

package/src/constants/continuation.ts

@@ -19,3 +19,13 @@
  */
 export const AUTO_CONTINUATION_USER_MESSAGE =
 	'Continue exactly where you left off. Do not repeat content you already wrote — pick up at the next token.'
+
+/**
+ * The nudge for a reply cut off while the model was still reasoning, before
+ * it wrote any text or called a tool. There is no partial answer to pick up,
+ * so this one asks for a shorter think instead of a continuation. Like
+ * {@link AUTO_CONTINUATION_USER_MESSAGE}, it is transparent when a turn's
+ * result is assembled.
+ */
+export const REASONING_CUT_USER_MESSAGE =
+	'The output limit was reached while you were still reasoning, before any text or tool call. Continue from the conversation above: think much more briefly and give your answer or next tool call well within the limit.'

package/src/constants/plugin/index.ts

@@ -34,7 +34,7 @@ export const MAX_CONNECTORS_PER_PLUGIN = 10
 export const MAX_PERSONAS_PER_PLUGIN = 5
 
 /** Hook execution */
-export const HOOK_TIMEOUT_MS = 5_000
+export const HOOK_TIMEOUT_MS = 600_000
 
 /**
  * Priority a hook gets when it does not declare one.

package/src/manager/agent/lifecycle.ts

@@ -346,6 +346,16 @@ export class AgentManager {
 		return this.startMessage(options, context, listener)
 	}
 
+	/**
+	 * The refusal for a delegation past the depth limit. It tells the model what
+	 * to do instead (the reference terminal's rule): a bare limit leaves it
+	 * retrying the same spawn, while an instruction to do the work itself ends the
+	 * attempt. The limit is `AgentManagerConfig.maxDepth`; there is no env override.
+	 */
+	private depthLimitMessage(depth: number): string {
+		return `Max task depth ${this.config.maxDepth} exceeded (current: ${depth}). Do this task yourself with your own tools instead of delegating it to another agent.`
+	}
+
 	private async enqueueMessage(
 		options: SendMessageOptions,
 		context: AgentTaskContext,
@@ -353,7 +363,7 @@ export class AgentManager {
 	): Promise<AgentTask> {
 		context.parentAbortController.signal.throwIfAborted()
 		if (context.depth >= this.config.maxDepth)
-			throw new Error(`Max task depth ${this.config.maxDepth} exceeded`)
+			throw new Error(this.depthLimitMessage(context.depth))
 		if (options.tenantId !== context.tenantId)
 			throw new Error('Tenant mismatch: cross-tenant spawn rejected')
 		const definition = this.registry.getOrThrow(options.agentId)
@@ -527,9 +537,7 @@ export class AgentManager {
 		await options.beforeStart?.()
 		queuedTask?.childAbortController.signal.throwIfAborted()
 		if (context.depth >= this.config.maxDepth) {
-			throw new Error(
-				`Max task depth ${this.config.maxDepth} exceeded (current: ${context.depth}). Recursive agent delegation is limited to prevent resource exhaustion.`,
-			)
+			throw new Error(this.depthLimitMessage(context.depth))
 		}
 
 		if (options.tenantId !== context.tenantId) {

package/src/manager/session/turn-recorder.ts

@@ -1,4 +1,7 @@
-import { AUTO_CONTINUATION_USER_MESSAGE } from '../../constants/continuation.js'
+import {
+	AUTO_CONTINUATION_USER_MESSAGE,
+	REASONING_CUT_USER_MESSAGE,
+} from '../../constants/continuation.js'
 import { EMPTY_TOKEN_USAGE } from '../../constants/limits.js'
 import { NAMZU } from '../../constants/telemetry/index.js'
 import { resolveModelPricing } from '../../pricing/index.js'
@@ -567,7 +570,12 @@ export class TurnRecorder {
 				if (msg.content !== null) chunks.push(msg.content)
 				continue
 			}
-			if (msg.role === 'user' && msg.content === AUTO_CONTINUATION_USER_MESSAGE) continue
+			if (
+				msg.role === 'user' &&
+				(msg.content === AUTO_CONTINUATION_USER_MESSAGE ||
+					msg.content === REASONING_CUT_USER_MESSAGE)
+			)
+				continue
 			break
 		}
 		if (chunks.length > 0) this.#turn.result = chunks.reverse().join('')