@namzu/sdk 57.1.0 → 58.1.0

package/src/public-runtime.ts

@@ -485,6 +485,7 @@ export {
 	loadSkill,
 	resolveSkillChain,
 	SKILL_FRONTMATTER_KEYS,
+	SKILL_FRONTMATTER_TOLERATED_KEYS,
 	SkillCollisionError,
 	SkillRegistry,
 } from './skills/index.js'
@@ -1521,6 +1522,7 @@ export {
 	SKILL_INVOCATION_DEFAULT,
 	isInvocableBy,
 	skillInvocation,
+	skillModelDescription,
 } from './types/skills/index.js'
 
 // Reaching the web. Fetching ships guarded because its rules are about the

package/src/public-tools.ts

@@ -79,6 +79,8 @@ export {
 	backgroundTasksDisabled,
 	execHostShell,
 } from './tools/builtins/bash.js'
+// Authorization and execution must agree after a session carries its shell cwd.
+export { effectiveBashWorkingDirectory } from './tools/builtins/bash-cwd.js'
 export {
 	CODE_ANALYSIS_TOOL_NAME,
 	CodeAnalysisTool,

package/src/public-types.ts

@@ -231,8 +231,13 @@ export type {
 	SkippedAgentFile,
 } from './agents/file-definitions.js'
 export type {
+	HttpHookEntry,
+	PromptHookEntry,
 	ShellHookEntry,
 	ShellHookEvent,
+	ShellHookHandler,
+	ShellHookJudge,
+	ShellHookOnFailure,
 	ShellHookInput,
 	ShellHookOptions,
 	ShellHookOutcome,

package/src/runtime/query/executor.ts

@@ -14,6 +14,11 @@ import { ProbeVetoError } from '../../probe/errors.js'
 import { probe as defaultProbeRegistry } from '../../probe/registry.js'
 import type { ProbeEnforcement } from '../../probe/registry.js'
 import type { ActivityStore } from '../../store/activity/memory.js'
+import {
+	effectiveBashWorkingDirectory,
+	pinBashWorkingDirectory,
+} from '../../tools/builtins/bash-cwd.js'
+import { BashTool } from '../../tools/builtins/bash.js'
 import { fingerprintContent } from '../../tools/builtins/content-fingerprint.js'
 import { sandboxShellSpawn, withoutBashStartup } from '../../tools/command-shell.js'
 import { isAlwaysDestructive } from '../../tools/defineTool.js'
@@ -99,6 +104,9 @@ import {
 export type { EmitEvent } from './events.js'
 import type { EmitEvent, SessionEventDraft } from './events.js'
 
+/** Input and identity needed by the shared direct/nested safety checks. */
+type PreparedSafetyCall = Pick<PreparedDirectCall, 'kind' | 'toolName' | 'input'>
+
 export type PreparedDirectCall =
 	| {
 			readonly kind: 'ready'
@@ -708,6 +716,7 @@ export class ToolExecutor {
 	private parentSpan?: Span
 	private readonly toolCallBudget?: ToolCallBudget
 	private readonly preparedBatches = new WeakSet<PreparedToolBatch>()
+	private readonly preparedBashDirectories = new WeakMap<PreparedSafetyCall, string>()
 	/** Ephemeral proof of actual execution; restored messages do not acquire it. */
 	private readonly recordedObservations = new Map<
 		string,
@@ -1180,7 +1189,7 @@ export class ToolExecutor {
 	 * safety checks did not run is the one a person must look at.
 	 */
 	private async escalationOrUnfinished(
-		call: PreparedDirectCall,
+		call: PreparedSafetyCall,
 	): Promise<ToolCallEscalation | undefined> {
 		try {
 			return await this.escalationOf(call)
@@ -1212,12 +1221,19 @@ export class ToolExecutor {
 	 * roots is not mounted there to be approved. The escape is looked at only
 	 * WITH one, since without one there is nothing to escape.
 	 */
-	private async escalationOf(call: PreparedDirectCall): Promise<ToolCallEscalation | undefined> {
+	private async escalationOf(call: PreparedSafetyCall): Promise<ToolCallEscalation | undefined> {
 		if (call.kind === 'synthetic') return undefined
 		const tool = this.config.tools.get(call.toolName)
 		if (!tool || call.input === null || typeof call.input !== 'object') return undefined
 		const input = call.input as Record<string, unknown>
 		const sandboxed = this.sandboxed
+		const shellCwd =
+			tool.execute === BashTool.execute
+				? effectiveBashWorkingDirectory(this.config.sessionId, this.config.workingDirectory, {
+						sandboxed,
+					})
+				: undefined
+		if (shellCwd !== undefined) this.preparedBashDirectories.set(call, shellCwd)
 		let outsidePaths: string[] | undefined
 		if (
 			this.config.outsideRootAccess === 'review' &&
@@ -1240,7 +1256,7 @@ export class ToolExecutor {
 			tool.sandboxEscapeArgument !== undefined &&
 			input[tool.sandboxEscapeArgument] === true
 		const unknownProgram = this.unknownProgramOf(tool, input, sandboxed)
-		const reaches = await this.pathEscalationsOf(tool, input, sandboxed)
+		const reaches = await this.pathEscalationsOf(tool, input, sandboxed, shellCwd)
 		if (reaches.outsidePaths.length > 0) {
 			outsidePaths = [...new Set([...(outsidePaths ?? []), ...reaches.outsidePaths])]
 		}
@@ -1281,6 +1297,7 @@ export class ToolExecutor {
 		>,
 		input: Record<string, unknown>,
 		sandboxed: boolean,
+		shellCwd?: string,
 	): Promise<{
 		outsidePaths: readonly string[]
 		protectedPaths: readonly string[]
@@ -1303,6 +1320,7 @@ export class ToolExecutor {
 				const dialect = tool.commandDialect?.({ sandboxed }) ?? 'sh'
 				const found = await shellEscalations(line, dialect, {
 					roots,
+					...(shellCwd !== undefined ? { cwd: shellCwd } : {}),
 					reviewOutside: this.config.outsideRootAccess === 'review' && !sandboxed,
 				})
 				protectedPaths.push(...found.protectedPaths)
@@ -1598,6 +1616,10 @@ export class ToolExecutor {
 				...(this.config.toolPause ? { requestPause: this.config.toolPause(toolCall.id) } : {}),
 				report: (message: string, fraction?: number) => progress.report(message, fraction),
 			}
+			if (preparedCall) {
+				const cwd = this.preparedBashDirectories.get(preparedCall)
+				if (cwd !== undefined) pinBashWorkingDirectory(ctx, cwd)
+			}
 			const run = async () => {
 				try {
 					results[i] = await this.executeSingle(
@@ -1849,7 +1871,10 @@ export class ToolExecutor {
 		signal.throwIfAborted()
 		// Preparation detaches input synchronously before its first await.
 		// Admission must not add an earlier yield where the caller can mutate it.
-		const preparedCall = await this.prepareNestedCall(name, input, signal)
+		const preparedCall = {
+			...(await this.prepareNestedCall(name, input, signal)),
+			toolName: name,
+		}
 		signal.throwIfAborted()
 		if (this.toolCallBudget) {
 			const refusal = await this.toolCallBudget.admit(1, 'nested', signal)
@@ -1932,12 +1957,15 @@ export class ToolExecutor {
 		} catch {
 			needsApproval = true
 		}
-		if (needsApproval || (gateResult && gateResult.decision !== 'allow')) {
-			const reason = needsApproval
-				? `Blocked: "${name}" requires the person's approval for every call, and an approval cannot be requested from inside another tool. Call it directly.`
-				: gateResult?.decision === 'deny'
-					? `Blocked by the authorization gate: ${gateResult.reason}`
-					: `Blocked by the authorization gate: this nested call requires an explicit allow rule because an operator review cannot be opened from inside another tool. ${gateResult?.reason}`
+		const nestedEscalation = await this.escalationOrUnfinished(preparedCall)
+		if (nestedEscalation || needsApproval || (gateResult && gateResult.decision !== 'allow')) {
+			const reason = nestedEscalation
+				? 'Blocked: this nested call reaches a protected path, removal floor, outside-root boundary or another safety escalation. Call it directly so it can be reviewed.'
+				: needsApproval
+					? `Blocked: "${name}" requires the person's approval for every call, and an approval cannot be requested from inside another tool. Call it directly.`
+					: gateResult?.decision === 'deny'
+						? `Blocked by the authorization gate: ${gateResult.reason}`
+						: `Blocked by the authorization gate: this nested call requires an explicit allow rule because an operator review cannot be opened from inside another tool. ${gateResult?.reason}`
 			const output = deniedToolOutput(name, reason)
 			// Same fail-closed durability rule as a direct gate denial: if the
 			// configured session log cannot record the refusal, do not quietly carry
@@ -2010,6 +2038,8 @@ export class ToolExecutor {
 			report: (message: string, fraction?: number) => progress.report(message, fraction),
 		}
 
+		const nestedCwd = this.preparedBashDirectories.get(preparedCall)
+		if (nestedCwd !== undefined) pinBashWorkingDirectory(childContext, nestedCwd)
 		await this.emitEvent({
 			type: 'tool_executing',
 			turnId: this.config.turnId,

package/src/runtime/query/index.ts

@@ -553,6 +553,8 @@ export interface QueryParams {
 	allowedTools?: string[]
 	agentId: string
 	agentName: string
+	/** Application-owned agent kind for lifecycle hooks; defaults to agentName. */
+	agentType?: string
 	workingDirectory?: string
 	/**
 	 * Directories besides the working directory the file tools may reach,
@@ -1071,6 +1073,7 @@ export async function* query(params: QueryParams): AsyncGenerator<SessionEvent,
 		approvalPolicy,
 		eventTranslator,
 		executeUserInterruptHooks,
+		executeTurnFailureHooks,
 		pendingHistoryRepairs,
 		initialMessages,
 		historyIds,
@@ -1877,6 +1880,7 @@ export async function* query(params: QueryParams): AsyncGenerator<SessionEvent,
 			pluginManager: params.pluginManager,
 			...(params.parentSessionId !== undefined ? { parentSessionId: params.parentSessionId } : {}),
 			...(params.parentTurnId !== undefined ? { parentTurnId: params.parentTurnId } : {}),
+			agentType: params.agentType ?? params.agentName,
 		})
 
 		const tracer = getTracer()
@@ -2041,6 +2045,33 @@ export async function* query(params: QueryParams): AsyncGenerator<SessionEvent,
 					'namzu.runtime.resume_from_checkpoint': params.resumeFromCheckpoint ?? null,
 				})
 
+				// A child session is starting: its hooks may add context for the
+				// child's turn, before the child's first prompt is seen.
+				if (params.pluginManager && params.parentSessionId !== undefined) {
+					const startResults = await params.pluginManager.executeHooks(
+						'subagent_start',
+						{
+							turnId: ctx.turnId,
+							sessionId: params.sessionId,
+							parentSessionId: params.parentSessionId,
+							...(params.parentTurnId !== undefined ? { parentTurnId: params.parentTurnId } : {}),
+							agentType: params.agentType ?? params.agentName,
+							signal: ctx.abortController.signal,
+						},
+						eventTranslator.emitEvent,
+					)
+					const startAnnotations = applyLifecycleHookResults('subagent_start', startResults)
+					if (startAnnotations.length > 0) {
+						promptContributions.replace({
+							id: 'hooks:subagent_start',
+							placement: 'context',
+							render: () =>
+								`Context from the operator's hooks:\n\n${startAnnotations.join('\n\n')}`,
+						})
+					}
+					yield* eventTranslator.drainPending()
+				}
+
 				// The operator's prompt, before the model sees it. A hook may
 				// refuse it — the turn ends here, before a prompt is built — or add
 				// to what the model is told; the addition rides the prompt as a
@@ -2799,6 +2830,8 @@ export async function* query(params: QueryParams): AsyncGenerator<SessionEvent,
 				ctx.recorder.setSteps(iterationOrchestrator.getSteps())
 				await executeUserInterruptHooks(err)
 				yield* eventTranslator.drainPending()
+				await executeTurnFailureHooks(err)
+				yield* eventTranslator.drainPending()
 				yield* resultAssembler.handleError(err, rootSpan)
 			} finally {
 				// A pending acquisition is withdrawn and awaited first, so a handle

package/src/runtime/query/iteration/index.ts

@@ -79,7 +79,7 @@ import {
 } from './outstanding-work.js'
 import { runAdvisoryPhase } from './phases/advisory.js'
 import { runIterationCheckpoint } from './phases/checkpoint.js'
-import { compactionBreaker } from './phases/compaction-breaker.js'
+import { compactionBreaker, estimateRefillTokens } from './phases/compaction-breaker.js'
 import {
 	AUTOMATIC_COMPACTION_FAILED,
 	OVERFLOW_RELIEF_LIMIT,
@@ -319,7 +319,7 @@ export class IterationOrchestrator {
 		const feedback: string[] = []
 		const ask = async (
 			event: 'turn_end' | 'subagent_stop',
-			extra: { parentSessionId?: SessionId; parentTurnId?: TurnId },
+			extra: { parentSessionId?: SessionId; parentTurnId?: TurnId; agentType?: string },
 		): Promise<void> => {
 			const results = await manager.executeHooks(
 				event,
@@ -346,6 +346,7 @@ export class IterationOrchestrator {
 			await ask('subagent_stop', {
 				parentSessionId: this.ctx.parentSessionId,
 				...(this.ctx.parentTurnId !== undefined ? { parentTurnId: this.ctx.parentTurnId } : {}),
+				...(this.ctx.agentType !== undefined ? { agentType: this.ctx.agentType } : {}),
 			})
 			yield* this.ctx.drainPending()
 		}
@@ -1491,10 +1492,10 @@ export class IterationOrchestrator {
 						// Auto-continuation after an output-ceiling cutoff.
 						//
 						// Guards:
-						//   - `hasContent` so we don't loop forever on an
-						//     empty cutoff (a provider occasionally emits
-						//     `stop_reason: max_tokens` with no content
-						//     when an injected pre-fill blocks the model).
+						//   - An empty cutoff with no exposed reasoning only retries
+						//     under an explicit cap. Compatible endpoints can spend
+						//     the output allowance without exposing any text; without
+						//     a cap the legacy empty-completion fallback stays bounded.
 						//   - `!forceFinalize` so the forced-finalize path
 						//     never auto-continues — that path is invoked
 						//     specifically to extract a closing summary.
@@ -1507,16 +1508,18 @@ export class IterationOrchestrator {
 							!hasContent &&
 							(response.message.toolCalls?.length ?? 0) === 0 &&
 							(response.message.reasoning?.length ?? 0) > 0
+						const cap = this.ctx.maxOutputContinuations
+						const boundedEmptyCut =
+							!hasContent && cap !== undefined && Number.isSafeInteger(cap) && cap >= 0
 						if (
 							!forceFinalize &&
 							response.finishReason === 'length' &&
 							response.finishDetail !== 'context_window' &&
-							(hasContent || cutDuringReasoning)
+							(hasContent || cutDuringReasoning || boundedEmptyCut)
 						) {
 							// A host that opted in gets a cap on the nudges: a model that
 							// overruns its output limit every time would otherwise spend the
 							// whole turn on it. Past the cap the turn stops, and says why.
-							const cap = this.ctx.maxOutputContinuations
 							if (cap !== undefined && this.outputContinuations >= cap) {
 								this.ctx.log.warn('LLM kept hitting max_tokens — stopping the turn', {
 									[NAMZU.TURN_ID]: recorder.turnId,
@@ -1538,7 +1541,7 @@ export class IterationOrchestrator {
 							}
 							this.outputContinuations++
 							this.ctx.log.info(
-								cutDuringReasoning
+								cutDuringReasoning || boundedEmptyCut
 									? 'LLM hit max_tokens while reasoning — nudging to answer briefly'
 									: 'LLM hit max_tokens mid-text — auto-continuing',
 								{
@@ -1549,7 +1552,9 @@ export class IterationOrchestrator {
 							)
 							recorder.pushMessage(
 								createRuntimeContextMessage(
-									cutDuringReasoning ? REASONING_CUT_USER_MESSAGE : AUTO_CONTINUATION_USER_MESSAGE,
+									cutDuringReasoning || boundedEmptyCut
+										? REASONING_CUT_USER_MESSAGE
+										: AUTO_CONTINUATION_USER_MESSAGE,
 									'auto-continuation',
 								),
 							)
@@ -2176,6 +2181,7 @@ export class IterationOrchestrator {
 						}
 						// A rung that sheds too little to change the verdict is not worth a
 						// provider call; climb to the next one at once.
+						const tokensBeforeRelief = estimateRefillTokens(recorder.messages)
 						let shed = false
 						while (!shed && overflowReliefs < OVERFLOW_RELIEF_LIMIT) {
 							overflowReliefs++
@@ -2185,7 +2191,13 @@ export class IterationOrchestrator {
 							// Clearing results is a compaction too: only summaries and reducers
 							// recorded themselves, so a clear-only relief was invisible to the
 							// breaker.
-							compactionBreaker(this.ctx)?.recordCompaction(iterationNum)
+							// Record the whole ladder once, including any insufficient first
+							// rung, against the same estimator the refill check uses.
+							compactionBreaker(this.ctx)?.recordCompaction(
+								iterationNum,
+								tokensBeforeRelief,
+								estimateRefillTokens(recorder.messages),
+							)
 							this.ctx.log.info('Retrying the turn after relieving a context overflow', {
 								[NAMZU.TURN_ID]: recorder.turnId,
 								[NAMZU.ITERATION]: iterationNum,
@@ -2993,6 +3005,34 @@ export class IterationOrchestrator {
 				iteration: this.ctx.recorder.currentIteration,
 				messageId: finalMessageId,
 			})
+			// This call was collected, so it produced no live deltas. Publish
+			// its actual text before completion as the normal stream does;
+			// otherwise a streaming host can show the turn ending with no answer.
+			const parts = response.message.textParts
+			if (parts?.length) {
+				for (const part of parts) {
+					if (!part.text) continue
+					await this.ctx.emitEvent({
+						type: 'text_delta',
+						turnId: this.ctx.recorder.turnId,
+						iteration: this.ctx.recorder.currentIteration,
+						messageId: finalMessageId,
+						text: part.text,
+						textPart: {
+							id: part.id,
+							...(part.phase ? { phase: part.phase } : {}),
+						},
+					})
+				}
+			} else if (response.message.content) {
+				await this.ctx.emitEvent({
+					type: 'text_delta',
+					turnId: this.ctx.recorder.turnId,
+					iteration: this.ctx.recorder.currentIteration,
+					messageId: finalMessageId,
+					text: response.message.content,
+				})
+			}
 			await this.ctx.emitEvent({
 				type: 'message_completed',
 				turnId: this.ctx.recorder.turnId,

package/src/runtime/query/iteration/phases/compaction-breaker.ts

@@ -7,10 +7,10 @@
  *   and the turn carries on, silently as far as the person is concerned (a log
  *   line and a `breaker_open` event, no sentence); a pass the provider forces
  *   by rejecting the prompt is not gated, so the reactive ladder still runs.
- * - Three compactions in a row, each followed by the context filling back up
- *   within three iterations: something in the loop (a huge file read, a tool
- *   that prints without limit) refills the window faster than any summary can
- *   empty it. The turn stops, because carrying on only buys the same wall.
+ * - Three compactions in a row, each followed by the history regaining all
+ *   space shed within three iterations: something in the loop (a huge file
+ *   read, a tool that prints without limit) refills the window faster than a
+ *   summary can empty it. The turn stops, because carrying on buys the same wall.
  *
  * Off unless `compactionConfig.circuitBreaker` is true: stopping compaction,
  * and above all stopping a turn, is not something a host had before.
@@ -19,11 +19,31 @@
  * share a count.
  */
 
+import { estimateMessageTokens } from '../../../../compaction/token-estimate.js'
+import { type Message, isTurnContextEntry } from '../../../../types/message/index.js'
+import { isReminderMessage } from '../../reminders.js'
 import type { IterationContext } from './context.js'
 
+/**
+ * Conversation growth for the refill guard. Compaction sheds host reminders
+ * and recorded context so the host can announce them again; their return is
+ * not evidence of a tool refilling the window. Budgeting still includes them.
+ * Use provenance, not text that an operator or tool could happen to quote.
+ */
+export function estimateRefillTokens(messages: readonly Message[]): number {
+	return messages.reduce(
+		(total, message) =>
+			total +
+			(isReminderMessage(message) || isTurnContextEntry(message)
+				? 0
+				: estimateMessageTokens(message)),
+		0,
+	)
+}
+
 /** Consecutive failed passes after which automatic compaction stops. */
 export const COMPACTION_FAILURE_LIMIT = 3
-/** A compaction followed by a trigger sooner than this many iterations is a refill. */
+/** A full refill sooner than this many iterations counts toward the limit. */
 export const COMPACTION_REFILL_ITERATIONS = 3
 /** Consecutive refills that stop the turn. */
 export const COMPACTION_REFILL_LIMIT = 3
@@ -41,6 +61,8 @@ export class CompactionBreaker {
 	private refills = 0
 	private pendingRefills = 0
 	private lastCompactedIteration: number | undefined
+	private lastTokensBefore = 0
+	private lastTokensAfter = 0
 	private failureNoticeSent = false
 	private stopReason: string | undefined
 
@@ -69,18 +91,25 @@ export class CompactionBreaker {
 	 * A summary or reducer pass is about to run at `iteration`. True when it
 	 * would be the third refill in a row, in which case it must not run.
 	 */
-	wouldTrip(iteration: number): boolean {
+	wouldTrip(iteration: number, tokens: number): boolean {
+		// Iteration distance alone confuses continued pressure with a refill:
+		// a small reduction may leave the prompt above its trigger. Compare the
+		// same history estimator on both sides, never provider usage against an
+		// estimate. Count only when new context has replaced ALL the space shed.
+		const refilled = this.lastTokensAfter < this.lastTokensBefore && tokens >= this.lastTokensBefore
 		const quick =
 			this.lastCompactedIteration !== undefined &&
 			iteration - this.lastCompactedIteration < COMPACTION_REFILL_ITERATIONS
-		this.pendingRefills = quick ? this.refills + 1 : 0
+		this.pendingRefills = quick && refilled ? this.refills + 1 : 0
 		return this.pendingRefills >= COMPACTION_REFILL_LIMIT
 	}
 
-	/** The pass that `wouldTrip` allowed completed at `iteration`. */
-	recordCompaction(iteration: number): void {
+	/** The allowed pass completed; both sizes must use the same history estimator. */
+	recordCompaction(iteration: number, tokensBefore: number, tokensAfter: number): void {
 		this.refills = this.pendingRefills
 		this.lastCompactedIteration = iteration
+		this.lastTokensBefore = tokensBefore
+		this.lastTokensAfter = tokensAfter
 		this.recordRelief()
 	}
 

package/src/runtime/query/iteration/phases/compaction.ts

@@ -29,7 +29,11 @@ import { invariants } from '../../../../invariants/index.js'
 import { resolveTaskModel } from '../../../../model-router/task-router.js'
 import type { Message } from '../../../../types/message/index.js'
 import { applyLifecycleHookResults } from '../../plugin-hooks.js'
-import { COMPACTION_REFILL_MESSAGE, compactionBreaker } from './compaction-breaker.js'
+import {
+	COMPACTION_REFILL_MESSAGE,
+	compactionBreaker,
+	estimateRefillTokens,
+} from './compaction-breaker.js'
 import type { IterationContext } from './context.js'
 import { isWorkingMemoryMessage } from './working-memory.js'
 
@@ -443,7 +447,10 @@ export async function stopOnRefill(ctx: IterationContext): Promise<boolean> {
 	if (!breaker) return false
 	// Already announced: the turn is on its way out; do not say it twice.
 	if (breaker.stop !== undefined) return true
-	if (!breaker.wouldTrip(ctx.recorder.currentIteration)) return false
+	if (
+		!breaker.wouldTrip(ctx.recorder.currentIteration, estimateRefillTokens(ctx.recorder.messages))
+	)
+		return false
 	ctx.log.warn('Compaction keeps refilling — stopping the turn', {
 		[NAMZU.TURN_ID]: ctx.recorder.turnId,
 		[NAMZU.ITERATION]: ctx.recorder.currentIteration,
@@ -509,6 +516,7 @@ async function applyReducer(
 	const messages = ctx.recorder.messages
 	const before = messages.length
 	const beforeChars = totalChars(messages)
+	const beforeTokens = estimateRefillTokens(messages)
 
 	let next: readonly Message[] | undefined
 	try {
@@ -595,7 +603,11 @@ async function applyReducer(
 		reduction.contextWindowTokens,
 		measurement.windowSource,
 	)
-	compactionBreaker(ctx)?.recordCompaction(ctx.recorder.currentIteration)
+	compactionBreaker(ctx)?.recordCompaction(
+		ctx.recorder.currentIteration,
+		beforeTokens,
+		estimateRefillTokens(messages),
+	)
 }
 
 /**
@@ -716,7 +728,12 @@ async function runCompactionCheckInner(
 	// well before the summary trigger; every other strategy waits for it.
 	const salience = config.strategy === 'salience'
 	const maxOutputTokens = ctx.providerCapabilities?.maxOutputTokens
-	const trigger = resolveTriggerThreshold(config.triggerThreshold, budget, maxOutputTokens)
+	const trigger = resolveTriggerThreshold(
+		config.triggerThreshold,
+		budget,
+		maxOutputTokens,
+		config.autoCompactWindowTokens,
+	)
 	const startAt = salience ? Math.min(config.softTarget ?? DEFAULT_SOFT_TARGET, trigger) : trigger
 	if (!options?.force && usage < startAt) return
 
@@ -1122,6 +1139,7 @@ async function runCompactionCheckInner(
 
 	const live = ctx.recorder.messages
 	const oldCount = live.length
+	const beforeTokens = estimateRefillTokens(live)
 	// Retained history can survive in full while a summary adds another copy
 	// of its facts. Even an unretained span may be smaller than the cumulative
 	// summary. Compare both candidates with the same estimator, rather than
@@ -1196,5 +1214,9 @@ async function runCompactionCheckInner(
 		reachedResetThreshold: reachedReset,
 	})
 	await emitContextUsageSnapshot(ctx, newEstimate, budget, window.source)
-	compactionBreaker(ctx)?.recordCompaction(ctx.recorder.currentIteration)
+	compactionBreaker(ctx)?.recordCompaction(
+		ctx.recorder.currentIteration,
+		beforeTokens,
+		estimateRefillTokens(live),
+	)
 }

package/src/runtime/query/iteration/phases/context.ts

@@ -284,6 +284,8 @@ export interface IterationContext {
 	/** The delegating session, when this turn is a child's: `subagent_stop` names it. */
 	readonly parentSessionId?: import('../../../../types/ids/index.js').SessionId
 	readonly parentTurnId?: import('../../../../types/ids/index.js').TurnId
+	/** The agent this turn runs, named to `subagent_stop` hooks of a child. */
+	readonly agentType?: string
 
 	/**
 	 * Override for {@link PARK_RECORD_DELAY_MS}. Internal; tests set `0` to

package/src/runtime/query/iteration/phases/tool-review.ts

@@ -16,7 +16,9 @@ import type {
 	ReviewedExecution,
 	ToolCallDeclines,
 	ToolCallDenials,
+	ToolCallOutcome,
 } from '../../executor.js'
+import { applyLifecycleHookResults } from '../../plugin-hooks.js'
 import {
 	awaitProjectInstructionCallback,
 	replaceProjectInstructionSnapshot,
@@ -212,11 +214,81 @@ export async function* runToolReview(
 	/** Set only where a person's No is known, so a policy refusal never lands in it. */
 	let declines: ToolCallDeclines | undefined
 
+	/**
+	 * Tell `permission_denied` hooks about each call refused without a person's
+	 * No: a rule, the mode's policy, a classifier or a hook. Observational, so
+	 * a hook's answer changes nothing; one that throws is logged, not allowed to
+	 * fail the step.
+	 */
+	const announceRefusals = async (denials?: ToolCallDenials): Promise<void> => {
+		if (!ctx.pluginManager || !denials || denials.size === 0) return
+		for (const summary of toolCallSummaries) {
+			const reason = denials.get(summary.id)
+			if (reason === undefined || declines?.has(summary.id)) continue
+			if (ctx.abortController.signal.aborted) return
+			try {
+				await ctx.pluginManager.executeHooks(
+					'permission_denied',
+					{
+						sessionId: ctx.recorder.sessionId,
+						turnId: ctx.recorder.turnId,
+						toolName: summary.name,
+						toolInput: summary.input,
+						reason,
+						signal: ctx.abortController.signal,
+					},
+					ctx.emitEvent,
+				)
+			} catch (error) {
+				if (ctx.abortController.signal.aborted) return
+				ctx.log.warn('A permission_denied hook failed', {
+					'exception.message': error instanceof Error ? error.message : String(error),
+				})
+			}
+		}
+	}
+
+	/**
+	 * Tell `post_tool_batch` hooks that every call of this step has settled.
+	 * Fires once per step, before the next model request. A hook may ask for the
+	 * turn to stop once this step is done; an `error` fails the turn like any
+	 * other lifecycle hook.
+	 */
+	const announceBatch = async (outcomes: readonly ToolCallOutcome[]): Promise<void> => {
+		if (!ctx.pluginManager || ctx.abortController.signal.aborted) return
+		const inputs = new Map(toolCallSummaries.map((summary) => [summary.id, summary.input]))
+		const toolCalls = outcomes.map((outcome) => ({
+			toolCallId: outcome.toolCallId,
+			toolName: outcome.toolName,
+			toolInput: inputs.get(outcome.toolCallId),
+			output: outcome.output,
+			isError: outcome.isError === true,
+		}))
+		if (toolCalls.length === 0) return
+		const results = await ctx.pluginManager.executeHooks(
+			'post_tool_batch',
+			{
+				sessionId: ctx.recorder.sessionId,
+				turnId: ctx.recorder.turnId,
+				toolCalls,
+				signal: ctx.abortController.signal,
+			},
+			ctx.emitEvent,
+		)
+		applyLifecycleHookResults('post_tool_batch', results)
+		for (const result of results) {
+			if (result.action === 'continue' && result.halt) {
+				ctx.toolExecutor.requestHalt?.(result.halt.reason)
+			}
+		}
+	}
+
 	/** Executes the batch, answering every call, and appends the results. */
 	const settleBatch = async (
 		denials?: ToolCallDenials,
 		review?: ReviewedExecution,
 	): Promise<void> => {
+		await announceRefusals(denials)
 		const startedAt = Date.now()
 		const batch = await ctx.toolExecutor.executeBatch(
 			response,
@@ -228,6 +300,7 @@ export async function* runToolReview(
 		)
 		toolMs += Date.now() - startedAt
 		executed = batch.results
+		await announceBatch(batch.results)
 		// Registry receipts are ordered by actual completion, include nested
 		// dispatches, and exclude denials/recovered results. A successful possible
 		// mutation permits another experiment; unrelated reads cannot do so.
@@ -533,9 +606,7 @@ export async function* runToolReview(
 			toolCall.authorization = {
 				decision: gateResult.decision,
 				...(gateResult.reason ? { reason: gateResult.reason } : {}),
-				...(gateResult.decision === 'review' && (gateResult.matchedRule || hookAsked)
-					? { explicitReview: true as const }
-					: {}),
+				...(ruleAsked || hookAsked ? { explicitReview: true as const } : {}),
 				...(ruleAsked || hookAsked ? { askRule: true as const } : {}),
 				...(gateResult.decision === 'allow' && allowRuleScope(gateResult.matchedRule)
 					? { allowScope: allowRuleScope(gateResult.matchedRule) }