@namzu/sdk 51.1.0 → 52.1.0

package/src/provider/errors.ts

@@ -260,6 +260,19 @@ const OVERFLOW_BODY_PATTERNS: readonly RegExp[] = [
 	// length" — so a pattern anchored on "exceeded" misses it entirely.
 	/exceeds?\s+(?:the\s+)?(?:model'?s?\s+)?context\s+(?:length|window|size)/i,
 	/context\s+(?:length|window|size)\s+exceed/i,
+	// The reference terminal's own list matches the bare phrase "context
+	// window". Here it must sit next to a verb that says the request did not
+	// fit ("larger than the model context window of N tokens"), so a 400 that
+	// only names the window ("does not support this parameter with the 1M
+	// context window beta") stays an invalid request. The same pattern lives in
+	// `types/provider/errors.ts` (`codeFromMessage`), which also gates it on the
+	// status; keep them equal.
+	/(?:exceed\w*|too (?:long|large|big)|larger than|longer than|over the|beyond|maximum|overflow\w*)\b[^.]{0,60}context window|context window[^.]{0,60}\b(?:exceed\w*|too (?:long|large|big)|larger than|longer than|over the|beyond|maximum|overflow\w*)/i,
+	// "input length and `max_tokens` exceed context limit: A + B > C". The
+	// prompt may fit and only the requested output not; the loop tries a smaller
+	// `max_tokens` first (readOutputOverflow) and falls back to shedding history
+	// when there is no room for a useful reply, which needs this to classify.
+	/input length and `?max_tokens`? exceed context limit/i,
 ]
 
 /** Does this response body say the request did not fit the window? */

package/src/provider/fallback.ts

@@ -512,6 +512,16 @@ export function withProviderFallback(
 					member.provider.capabilities?.supportsHostedWebSearch === true &&
 					(member.provider.supportsHostedWebSearchFor?.(member.model ?? model, mode) ?? true),
 			),
+		// Answered for the member the next request goes to first, the one the
+		// cursor rests on (it never rewinds). Unlike the head's other
+		// declarations this costs nothing to keep current, and the head's answer
+		// would strip images from a vision member serving behind a text-only head.
+		// A request that falls over mid-call to a member that cannot read images is
+		// refused there, and the runtime sends it again without them.
+		supportsImageInputFor: (model: string) => {
+			const serving = members[cursor] ?? first
+			return serving.provider.supportsImageInputFor?.(serving.model ?? model) ?? true
+		},
 		reasoningEffortLevelsFor: (model: string, thinking?: ThinkingConfig) =>
 			commonReasoningEffortLevels(members, model, thinking),
 		// Present on the chain wrapper for the same reason the menu method is:

package/src/provider/idle-timeout.ts

@@ -218,6 +218,11 @@ export function withStreamIdleTimeout(
 						provider.supportsHostedWebSearchFor?.(model, mode) ?? false,
 				}
 			: {}),
+		...(provider.supportsImageInputFor
+			? {
+					supportsImageInputFor: (model: string) => provider.supportsImageInputFor?.(model) ?? true,
+				}
+			: {}),
 		...(provider.reasoningEffortLevelsFor
 			? {
 					reasoningEffortLevelsFor: (

package/src/provider/image-input-refusal.ts

@@ -0,0 +1,54 @@
+import { isProviderRequestError } from './errors.js'
+
+/**
+ * Wording providers use when they refuse a request because the MODEL reads text
+ * only. There is no shared error code for this: each vendor writes its own
+ * sentence, so the match is by phrase.
+ *
+ * Every pattern names the model's input as text-only, or says the model does not
+ * take image input at all. A 400 about one image (its size, its format, its URL)
+ * or about text somewhere else in the request (a tool message, an output
+ * format) is not this, and must not match: the caller drops every image and
+ * stops sending any to the model for the rest of the conversation.
+ */
+const IMAGE_INPUT_REFUSAL_PATTERNS: readonly RegExp[] = [
+	// Zen: "Beam supports text input only. This conversation contains an image."
+	/\btext\s+inputs?\s+only\b/i,
+	/\bonly\s+(?:supports?|accepts?)\s+text\s+inputs?\b/i,
+	/\bonly\s+text\s+inputs?\s+(?:is|are)\s+(?:supported|accepted|allowed)\b/i,
+	// "This model is text-only", "a text-only model"
+	/\btext[- ]only\s+model\b/i,
+	/\bmodel\b[^.;]{0,40}\bis\s+(?:a\s+)?text[- ]only\b/i,
+	// Local model servers: "<model> does not support images", "Model does not
+	// support images. Please use a model that does." Also "doesn't support vision",
+	// "does not support image input", "does not support multimodal inputs".
+	/\b(?:does\s?n[o'’]t|do\s+not|cannot|can[’']t)\s+(?:support|accept)\s+(?:images|vision)\b(?![/\w-])/i,
+	/\b(?:does\s?n[o'’]t|do\s+not|cannot|can[’']t)\s+(?:support|accept|process|handle)\s+(?:image|vision|multimodal|visual)\s+inputs?\b/i,
+	// A local inference server: "image input is not supported - hint: ... mmproj". The
+	// sentence must end there or name the model: "image input is not supported
+	// on streaming" is a restriction of the endpoint, not of the model.
+	/\b(?:image|vision|multimodal)\s+inputs?\s+(?:is|are)\s+(?:not\s+supported|unsupported)(?:\s+(?:by|for)\s+(?:this|the)\s+model)?\s*(?:$|[.;:,!)\-])/i,
+	/\bimages\s+(?:is|are)\s+not\s+supported(?:\s+(?:by|for)\s+(?:this|the)\s+model)?\s*(?:$|[.;:,!)\-])/i,
+	// A serving engine: "<model> is not a multimodal model"
+	/\bis\s+not\s+a\s+(?:multimodal|vision)\s+model\b/i,
+	// A chat-completions API: "Invalid content type. image_url is only supported by certain models."
+	/\bimage_url\b.{0,40}\bonly\s+supported\s+by\s+certain\s+models\b/i,
+	// A chat-completions server that only knows text parts: "unknown variant `image_url`, expected `text`"
+	/\bunknown\s+variant\s+\W?image_url\W?,?\s+expected\s+\W?text\b/i,
+]
+
+/** Whether a provider's refusal text says "this model cannot take images". */
+export function isImageInputRefusalMessage(text: string | undefined): boolean {
+	if (!text) return false
+	return IMAGE_INPUT_REFUSAL_PATTERNS.some((pattern) => pattern.test(text))
+}
+
+/**
+ * Whether `error` is a provider refusing the request because of an image it
+ * holds that the model cannot read. Resending the same request can never help;
+ * only removing the image or choosing a model that reads images does.
+ */
+export function isImageInputRefusal(error: unknown): boolean {
+	if (!isProviderRequestError(error) || error.kind !== 'bad_request') return false
+	return isImageInputRefusalMessage(error.detail ?? error.message)
+}

package/src/provider/index.ts

@@ -25,7 +25,9 @@ export { registerMock, MOCK_CAPABILITIES } from './mock-register.js'
 export {
 	PERMISSIVE_PROVIDER_CAPABILITIES,
 	resolveProviderCapabilities,
+	modelReadsImages,
 } from './capabilities.js'
+export { isImageInputRefusal, isImageInputRefusalMessage } from './image-input-refusal.js'
 export type { ResolvedProviderCapabilities } from './capabilities.js'
 export {
 	ProviderError,

package/src/provider/retry.ts

@@ -54,7 +54,8 @@ export interface ProviderRetryConfig extends BackoffPolicy {
 	 */
 	readonly retryAfter?: 'exact' | 'floor'
 	/**
-	 * Also retry a stream that failed AFTER it produced text or reasoning.
+	 * Also retry a stream that failed AFTER it produced text.
+	 * (A stream that produced only reasoning is always retried.)
 	 *
 	 * Off by default, because the decorator cannot un-emit: the consumer has
 	 * already seen those deltas. When on, the retry notice carries
@@ -82,11 +83,34 @@ export interface WithProviderRetryOptions {
 	readonly sleepFn?: (ms: number, signal?: AbortSignal) => Promise<void>
 }
 
+/**
+ * A chunk that carries a fragment of a reasoning block and nothing a consumer
+ * would have to take back: no text, tool call, hosted tool, citation or finish.
+ */
+function isReasoningOnly(chunk: StreamChunk): boolean {
+	const d = chunk.delta
+	return (
+		d.reasoning !== undefined &&
+		!d.content &&
+		!d.toolCalls?.length &&
+		d.toolCallEnd === undefined &&
+		d.hostedTool === undefined &&
+		d.citation === undefined &&
+		d.textPart === undefined &&
+		chunk.textParts === undefined &&
+		chunk.finishReason === undefined
+	)
+}
+
 /**
  * Wrap a provider so transient failures are retried with exponential
  * backoff and full jitter.
  *
- * **Retry only before the first content chunk.** Once a delta has been
+ * **Retry only before the first content chunk.** Reasoning-only chunks do
+ * not count as content: a stream that fails after yielding nothing but
+ * reasoning is retried, and the notice carries `restart: true` so the consumer
+ * drops the thinking the failed attempt showed (the turn replaces reasoning
+ * blocks by index, and clears them on a restart). Once a text or tool-call delta has been
  * yielded the consumer has already emitted `text_delta` events and
  * appended to its buffer, so restarting the request would duplicate
  * output. A mid-stream failure is therefore surfaced, not retried — the
@@ -129,6 +153,11 @@ export function withProviderRetry(
 	async function* chatStream(params: ChatCompletionParams): AsyncIterable<StreamChunk> {
 		for (let attempt = 0; ; attempt++) {
 			let produced = false
+			// Reasoning has streamed and nothing else has. The consumer holds
+			// reasoning by block index and has no text or tool call to repeat, so
+			// this is retryable without `retryMidStream`; the notice says
+			// `restart` so a host that showed the thinking drops it.
+			let reasoned = false
 			// A tool call or hosted tool began: past this point a restart could
 			// repeat work that is already underway, so it is never offered.
 			let acted = false
@@ -140,7 +169,10 @@ export function withProviderRetry(
 					const isErrorOnly =
 						chunk.error !== undefined && !chunk.delta.content && !chunk.delta.toolCalls?.length
 
-					if (!isErrorOnly) produced = true
+					if (!isErrorOnly) {
+						if (isReasoningOnly(chunk)) reasoned = true
+						else produced = true
+					}
 					if (chunk.delta.toolCalls?.length || chunk.delta.toolCallEnd || chunk.delta.hostedTool) {
 						acted = true
 					}
@@ -170,7 +202,8 @@ export function withProviderRetry(
 				const classified = classifyProviderError(err, provider.id)
 				const exhausted = attempt >= config.maxRetries
 
-				const restartable = produced && config.retryMidStream === true && !acted
+				const restartable =
+					(produced && config.retryMidStream === true && !acted) || (!produced && reasoned)
 				if ((produced && !restartable) || !classified.retryable || exhausted) {
 					log?.warn('Provider call failed', {
 						[GENAI.SYSTEM]: provider.id,
@@ -326,6 +359,11 @@ export function withProviderRetry(
 						provider.supportsHostedWebSearchFor?.(model, mode) ?? false,
 				}
 			: {}),
+		...(provider.supportsImageInputFor
+			? {
+					supportsImageInputFor: (model: string) => provider.supportsImageInputFor?.(model) ?? true,
+				}
+			: {}),
 		...(provider.reasoningEffortLevelsFor
 			? {
 					reasoningEffortLevelsFor: (

package/src/public-runtime.ts

@@ -318,6 +318,12 @@ export {
 	formatSteeringNote,
 } from './runtime/query/steering.js'
 export type { SteeringChannel } from './runtime/query/steering.js'
+// Hidden mid-conversation reminders a host feeds per model request (opt-in).
+export { isReminderMessage } from './runtime/query/reminders.js'
+export type {
+	ReminderContext,
+	ReminderSource,
+} from './runtime/query/reminders.js'
 export {
 	BidiSessionCloseTimeoutError,
 	createMockBidiProvider,
@@ -628,6 +634,7 @@ export {
 	runShellHook,
 	SHELL_HOOK_EVENTS,
 	SHELL_HOOKS_PLUGIN_ID,
+	shellHookIfMatches,
 	shellHookMatches,
 	shellHookVerdict,
 } from './plugin/index.js'
@@ -718,8 +725,11 @@ export {
 	isProviderError,
 	LazyProviderLoadError,
 	LazyProviderSyncCreateError,
+	isImageInputRefusal,
+	isImageInputRefusalMessage,
 	MOCK_CAPABILITIES,
 	MockLLMProvider,
+	modelReadsImages,
 	parseRetryAfterMs,
 	PERMISSIVE_PROVIDER_CAPABILITIES,
 	ProviderError,
@@ -1505,6 +1515,7 @@ export {
 // consumer (`SpanProcessorLike`, then `CompactNowInput` and `CompactionResult`).
 // The gate is the reason this is a list rather than a fourth accident.
 export type { ResolvedContextWindow } from './compaction/context-window.js'
+export { resolveTriggerThreshold } from './compaction/context-window.js'
 export type { CompactRegionInput } from './compaction/manual.js'
 export type {
 	CompactionVerificationOptions,

package/src/public-types.ts

@@ -204,6 +204,7 @@ export type {
 	Disposable,
 	RunAgentOptions,
 	RunAgentResult,
+	SupervisorResumeTarget,
 } from './agents/index.js'
 
 export type {
@@ -457,7 +458,10 @@ export type {
 
 export type {
 	GuardedFetchConfig,
+	WebContentExtractor,
+	WebExtractRequest,
 	WebFetchProvider,
+	WebFetchRedirectPolicy,
 	WebFetchRefusalReason,
 	WebFetchRequest,
 	WebFetchResult,

package/src/runtime/jobs/registry.ts

@@ -99,6 +99,21 @@ export interface StartJobParams {
 	 * expect stdin.
 	 */
 	readonly spawn?: () => JobProcess
+	/**
+	 * Output the process already wrote before the registry took it over, in
+	 * the order it was written. Used when a foreground command is moved to the
+	 * background, so a later `read` starts with what the model was shown.
+	 */
+	readonly initialOutput?: readonly {
+		readonly stream: 'stdout' | 'stderr'
+		readonly text: string
+	}[]
+	/**
+	 * `spawn` returned a process on THIS host that the host shell started (a
+	 * foreground command being moved to the background), so its bytes are
+	 * decoded the way a foreground command's are, not as a Linux guest's.
+	 */
+	readonly hostOutput?: boolean
 }
 
 export interface BackgroundJobRegistryConfig {
@@ -333,8 +348,12 @@ export class BackgroundJobRegistry {
 		// Raw bytes, decoded here: a Windows console writes its OEM code page.
 		// A process a sandbox started runs a Linux guest, so it is UTF-8.
 		const decoders = {
-			stdout: createHostOutputDecoder(params.spawn ? { platform: 'linux' } : {}),
-			stderr: createHostOutputDecoder(params.spawn ? { platform: 'linux' } : {}),
+			stdout: createHostOutputDecoder(
+				params.spawn && !params.hostOutput ? { platform: 'linux' } : {},
+			),
+			stderr: createHostOutputDecoder(
+				params.spawn && !params.hostOutput ? { platform: 'linux' } : {},
+			),
 		}
 		let startError: string | undefined
 		let settleStarted!: () => void
@@ -473,6 +492,7 @@ export class BackgroundJobRegistry {
 			const text = typeof data === 'string' ? data : decoders[stream].write(data)
 			if (text) append(text, stream)
 		}
+		for (const seed of params.initialOutput ?? []) append(seed.text, seed.stream)
 		child.stdout?.on('data', onData('stdout'))
 		child.stderr?.on('data', onData('stderr'))
 
@@ -855,6 +875,23 @@ export function bindOwner(
 					: {}),
 			})
 		},
+		// A foreground command that ran out of time, kept instead of killed.
+		// The same owner and cap as `start`; the process is the one already
+		// running, with what it has written so far.
+		adopt: (params: {
+			command: string
+			child: ReturnType<typeof spawn>
+			workingDirectory?: string
+			initialOutput?: StartJobParams['initialOutput']
+		}) =>
+			registry.start({
+				owner,
+				command: params.command,
+				workingDirectory: params.workingDirectory ?? defaults.workingDirectory ?? process.cwd(),
+				spawn: () => ({ child: params.child }),
+				hostOutput: true,
+				...(params.initialOutput ? { initialOutput: params.initialOutput } : {}),
+			}),
 		get: (id: string) => mine(id),
 		awaitStarted: (id: string) => {
 			mine(id)

package/src/runtime/query/deferred-sandbox.ts

@@ -0,0 +1,110 @@
+import type { Sandbox } from '../../types/sandbox/index.js'
+import type { SandboxAcquisitionResult } from './sandbox-lifecycle.js'
+
+/**
+ * When a turn starts acquiring its sandbox.
+ *
+ * - `'eager'`: before the input guardrails and the first model request, and the
+ *   turn waits for it. This is the behaviour every sandboxed turn had before
+ *   the option existed.
+ * - `'concurrent'`: at the same point, but the turn does not wait. The first
+ *   model request goes out while the provider allocates, and the first tool
+ *   call waits for the handle.
+ * - `'on-first-use'`: not until the first tool call needs one.
+ */
+export type SandboxAcquireMode = 'eager' | 'concurrent' | 'on-first-use'
+
+export type SandboxAcquisitionStop = Exclude<SandboxAcquisitionResult, { kind: 'created' }>
+
+/**
+ * A deferred acquisition ended without a sandbox for a reason the turn settles
+ * with a stop reason (`cancelled`, `timeout`), exactly as an eager acquisition
+ * does. A provider failure is not wrapped: it propagates as the provider's own
+ * error, as it does when the turn waits.
+ */
+export class SandboxAcquisitionStopped extends Error {
+	readonly acquisition: SandboxAcquisitionStop
+
+	constructor(acquisition: SandboxAcquisitionStop) {
+		super(
+			acquisition.kind === 'timed_out'
+				? acquisition.error.message
+				: 'Sandbox acquisition was cancelled before it finished',
+		)
+		this.name = 'SandboxAcquisitionStopped'
+		this.acquisition = acquisition
+	}
+}
+
+type Outcome = SandboxAcquisitionResult | { readonly kind: 'failed'; readonly error: unknown }
+
+export interface DeferredSandbox {
+	/** Start acquiring if nothing has yet. Idempotent. */
+	start(): void
+	/** Start if needed, then wait for the handle to be published. Throws when none will be. */
+	ensure(): Promise<void>
+	/**
+	 * Wait for an acquisition that was started. A no-op when none was, and when
+	 * the turn has already been cancelled (the loop settles that on its own).
+	 */
+	settle(): Promise<void>
+	/** Withdraw authority from a still-pending acquisition and wait until it has settled. Never throws. */
+	cancel(): Promise<void>
+}
+
+/**
+ * A sandbox acquisition that outlives the point that started it.
+ *
+ * `acquire` is the same lifecycle function an eager turn uses, so a late
+ * handle, a timeout and a cancellation are released by the machinery that
+ * already owns them. `publish` runs once, when (and only when) the handle
+ * arrived in time, so `sandbox_created` marks the moment of resolution.
+ */
+export function createDeferredSandbox(options: {
+	readonly turnSignal: AbortSignal
+	readonly acquire: (signal: AbortSignal) => Promise<SandboxAcquisitionResult>
+	readonly publish: (sandbox: Sandbox) => Promise<void>
+}): DeferredSandbox {
+	const controller = new AbortController()
+	const relay = (): void => controller.abort(options.turnSignal.reason)
+	if (options.turnSignal.aborted) relay()
+	else options.turnSignal.addEventListener('abort', relay, { once: true })
+
+	let outcome: Promise<Outcome> | undefined
+	const start = (): Promise<Outcome> => {
+		outcome ??= (async (): Promise<Outcome> => {
+			try {
+				const acquired = await options.acquire(controller.signal)
+				if (acquired.kind === 'created') await options.publish(acquired.sandbox)
+				return acquired
+			} catch (error) {
+				return { kind: 'failed', error }
+			}
+		})()
+		return outcome
+	}
+
+	const rethrow = (settled: Outcome): void => {
+		if (settled.kind === 'created') return
+		if (settled.kind === 'failed') throw settled.error
+		throw new SandboxAcquisitionStopped(settled)
+	}
+
+	return {
+		start: () => {
+			void start()
+		},
+		ensure: async () => rethrow(await start()),
+		settle: async () => {
+			if (outcome === undefined) return
+			const settled = await outcome
+			if (options.turnSignal.aborted) return
+			rethrow(settled)
+		},
+		cancel: async () => {
+			options.turnSignal.removeEventListener('abort', relay)
+			controller.abort()
+			if (outcome !== undefined) await outcome
+		},
+	}
+}

package/src/runtime/query/executor/tool-call-admission.ts

@@ -2,7 +2,7 @@ import { GENAI, NAMZU } from '../../../constants/telemetry/index.js'
 import { callableToolNames, formatToolNames } from '../../../registry/tool/callable.js'
 import { renderToolSchema } from '../../../registry/tool/schema.js'
 import type { ToolCall, ToolInputError } from '../../../types/message/index.js'
-import type { PluginHookResult } from '../../../types/plugin/index.js'
+import type { PluginHookPermission, PluginHookResult } from '../../../types/plugin/index.js'
 import type { ToolDefinition } from '../../../types/tool/index.js'
 import type { ToolCallRepair, ToolCallRepairReason } from '../../../types/tool/repair.js'
 import { awaitWithAbort } from '../../../utils/await-with-abort.js'
@@ -10,6 +10,7 @@ import { toErrorMessage } from '../../../utils/error.js'
 import type { Logger } from '../../../utils/logger.js'
 import type {
 	EmitEvent,
+	PreToolHookNotes,
 	PreToolHookOutcome,
 	PreparedDirectCall,
 	ToolExecutorConfig,
@@ -49,6 +50,11 @@ export interface ToolAdmissionHost {
 	 * step, which is the answer that sent a model round in a circle.
 	 */
 	readonly allowedTools: readonly string[] | undefined
+	/**
+	 * A hook asked for the turn to stop after the current step. Optional so a
+	 * host that builds an admission by hand (a test) need not say anything.
+	 */
+	readonly requestHalt?: (reason: string) => void
 }
 
 /**
@@ -89,7 +95,7 @@ export async function runPreToolHook(
 		signal,
 	)
 	signal.throwIfAborted()
-	return interpretPreToolResults(toolName, input, results)
+	return interpretPreToolResults(toolName, input, results, host.requestHalt)
 }
 
 export async function prepareDirectCall(
@@ -169,6 +175,7 @@ export async function prepareDirectCall(
 				...(providerInput && !truncationRepair && !preOutcome.modified && resolved.inputFailure
 					? { inputFailure: resolved.inputFailure }
 					: {}),
+				...hookNotesOf(preOutcome),
 			}
 		}
 		return {
@@ -321,6 +328,20 @@ export async function prepareDirectCall(
 		toolName,
 		input: preparation.prepared.input,
 		prepared: preparation.prepared,
+		...hookNotesOf(preOutcome),
+	}
+}
+
+/** The hook answers a ready or legacy call carries forward, or nothing. */
+function hookNotesOf(outcome: Extract<PreToolHookOutcome, { kind: 'continue' }>): {
+	hook?: PreToolHookNotes
+} {
+	if (outcome.permission === undefined && outcome.context === undefined) return {}
+	return {
+		hook: {
+			...(outcome.permission ? { permission: outcome.permission } : {}),
+			...(outcome.context !== undefined ? { context: outcome.context } : {}),
+		},
 	}
 }
 
@@ -328,29 +349,49 @@ function interpretPreToolResults(
 	toolName: string,
 	initialInput: unknown,
 	results: readonly PluginHookResult[],
+	requestHalt?: (reason: string) => void,
 ): PreToolHookOutcome {
 	let currentInput = initialInput
 	let modified = false
+	let permission: PluginHookPermission | undefined
+	const contexts: string[] = []
+	/** `ask` outranks `allow`: the stricter answer is the one that stands. */
+	const takePermission = (next: PluginHookPermission | undefined) => {
+		if (next === undefined) return
+		if (permission === undefined || (permission.decision === 'allow' && next.decision === 'ask')) {
+			permission = next
+		}
+	}
+	const withContext = (text: string): string =>
+		contexts.length === 0 ? text : `${text}\n\n${hookNote(contexts)}`
+	// The hooks ran side by side on the original input, and their answers are
+	// combined here. The first refusal (or failure) in registration order is the
+	// answer, whatever the others said; of several rewrites the last wins;
+	// `ask` outranks `allow`; every context is kept; every request to stop is
+	// passed on.
+	let refusal: { kind: 'skip' | 'error'; text: string } | undefined
 	for (const result of results) {
 		switch (result.action) {
 			case 'continue':
+				takePermission(result.permission)
+				if (result.context) contexts.push(result.context)
+				if (result.halt) requestHalt?.(result.halt.reason)
 				continue
 			case 'modify':
 				currentInput = result.input
 				modified = true
+				takePermission(result.permission)
+				if (result.context) contexts.push(result.context)
+				if (result.halt) requestHalt?.(result.halt.reason)
 				continue
 			case 'skip':
-				return {
-					kind: 'skip',
-					input: currentInput,
-					output: skippedToolResultText(toolName, result.reason),
-				}
+				if (result.context) contexts.push(result.context)
+				if (result.halt) requestHalt?.(result.halt.reason)
+				refusal ??= { kind: 'skip', text: skippedToolResultText(toolName, result.reason) }
+				continue
 			case 'error':
-				return {
-					kind: 'error',
-					input: currentInput,
-					output: `Error: ${result.message}`,
-				}
+				refusal ??= { kind: 'error', text: `Error: ${result.message}` }
+				continue
 			case 'retry':
 			case 'annotate':
 			// There is no result to replace yet. Rejecting loudly beats
@@ -367,9 +408,34 @@ function interpretPreToolResults(
 			}
 		}
 	}
-	return { kind: 'continue', input: currentInput, modified }
+	if (refusal) {
+		return {
+			kind: refusal.kind,
+			input: currentInput,
+			output: refusal.kind === 'skip' ? withContext(refusal.text) : refusal.text,
+		}
+	}
+	return {
+		kind: 'continue',
+		input: currentInput,
+		modified,
+		...(permission ? { permission } : {}),
+		...(contexts.length > 0 ? { context: contexts.join('\n') } : {}),
+	}
+}
+
+/**
+ * Hook text, framed so the model reads it as what a configured hook said and
+ * not as something the tool returned.
+ */
+export function hookNote(texts: readonly string[]): string {
+	const joined = texts.join('\n')
+	return `[Hook note]\n${joined.length > MAX_HOOK_NOTE_CHARS ? `${joined.slice(0, MAX_HOOK_NOTE_CHARS)}\n[truncated]` : joined}`
 }
 
+/** A hook's text is one more thing for the model to read; it gets a bound. */
+const MAX_HOOK_NOTE_CHARS = 8_000
+
 /**
  * Turn the call the model issued into a name and a parsed input, giving
  * a configured repairer one chance to fix it first.