@namzu/sdk 59.0.0 → 60.1.0

package/src/runtime/query/iteration/index.ts

@@ -7,6 +7,8 @@ import { estimateMessageTokens } from '../../../compaction/token-estimate.js'
 import {
 	AUTO_CONTINUATION_USER_MESSAGE,
 	REASONING_CUT_USER_MESSAGE,
+	REFUSED_REPLY_CALL_RESULT,
+	REFUSED_REPLY_RETRY_MESSAGE,
 } from '../../../constants/continuation.js'
 import { CHARS_PER_TOKEN } from '../../../constants/limits.js'
 import {
@@ -37,6 +39,7 @@ import {
 	createAssistantMessage,
 	createRuntimeContextMessage,
 	createSystemMessage,
+	createToolMessage,
 } from '../../../types/message/index.js'
 import { classifyProviderError, readOutputOverflow } from '../../../types/provider/errors.js'
 import type { ChatCompletionResponse } from '../../../types/provider/index.js'
@@ -71,6 +74,7 @@ import {
 	projectRequestRichContent,
 } from '../request-rich-content.js'
 import { formatSteeringNote, isOperatorUserMessage } from '../steering.js'
+import { effortForModel } from './effort-clamp.js'
 import { parseNativeCandidate } from './native-output.js'
 import {
 	drainArrivedTaskCompletions,
@@ -225,7 +229,10 @@ export class IterationOrchestrator {
 	 * serving from the member it last moved to, so that member, not the head,
 	 * is the one whose reading of images counts.
 	 */
-	private servingModel(model: string): { readonly providerId: string; readonly model: string } {
+	private servingModel(model: string): {
+		readonly providerId: string
+		readonly model: string
+	} {
 		const serving = this.ctx.servingMember?.()
 		return {
 			providerId: serving?.providerId ?? this.ctx.provider.id,
@@ -291,6 +298,16 @@ export class IterationOrchestrator {
 	private stopDeferredForOutstandingWork = false
 	/** Nudges sent since the model last finished a call without hitting its output cap. */
 	private outputContinuations = 0
+	/**
+	 * The model a refused request moved to. Once set it replaces the model the
+	 * step asked for, for the rest of the turn: the request that was refused
+	 * would only be refused again.
+	 */
+	private refusalPinnedModel: string | undefined
+	/** The request has already been re-run on another model once this turn. */
+	private refusalFallbackUsed = false
+	/** The request has already been re-run on the same model once this turn. */
+	private refusalRetryUsed = false
 	/**
 	 * `turn_end` (and, for a child, `subagent_stop`) fired when the model
 	 * finished and no hook asked for more. `finalizeTurn` then does not fire
@@ -319,7 +336,11 @@ export class IterationOrchestrator {
 		const feedback: string[] = []
 		const ask = async (
 			event: 'turn_end' | 'subagent_stop',
-			extra: { parentSessionId?: SessionId; parentTurnId?: TurnId; agentType?: string },
+			extra: {
+				parentSessionId?: SessionId
+				parentTurnId?: TurnId
+				agentType?: string
+			},
 		): Promise<void> => {
 			const results = await manager.executeHooks(
 				event,
@@ -795,7 +816,7 @@ export class IterationOrchestrator {
 					// Preparation inference belongs to the turn, not the main-model step.
 					usageBefore = { ...recorder.tokenUsage }
 					costBefore = { ...recorder.costInfo }
-					stepModel = step.model ?? model
+					stepModel = this.refusalPinnedModel ?? step.model ?? model
 					await selectContextModel(shaping, stepModel)
 					// Preserve post-compaction preparation/recall semantics. A changed
 					// model needs a second check against its own window; never replay
@@ -824,7 +845,7 @@ export class IterationOrchestrator {
 					// still call any of them by name.
 					this.ctx.toolExecutor.setStepAllowedTools(stepAllowedTools)
 					const enforceToolInputSchema = enforcedModelInputToolNames(this.ctx.tools, llmTools)
-					stepModel = step.model ?? model
+					stepModel = this.refusalPinnedModel ?? step.model ?? model
 
 					// The closing directive is appended LAST, after every piece of
 					// request-only context below, so it is the final thing the model
@@ -1051,6 +1072,25 @@ export class IterationOrchestrator {
 						model: requestedMember.model ?? stepModel,
 						chainIndex: requestedMember.index,
 					}
+					// The turn's effort was chosen for the turn's own model. A request
+					// moved to another model (a refusal fallback, a live pick) carries
+					// the nearest level that model offers, for this request only.
+					let requestEffort = turnConfig.effort
+					if (requestEffort && stepModel !== model) {
+						requestEffort = effortForModel(
+							this.ctx.provider,
+							stepModel,
+							requestEffort,
+							turnConfig.thinking,
+						)
+						if (requestEffort !== turnConfig.effort) {
+							this.ctx.log.debug('Effort lowered to a level this model offers', {
+								'namzu.runtime.model': stepModel,
+								'namzu.runtime.effort_requested': turnConfig.effort,
+								'namzu.runtime.effort_used': requestEffort,
+							})
+						}
+					}
 					const operatorInputAtDispatch = this.latestUserMessage
 					const latestReviewUserMessage =
 						(this.ctx.reviewAnswer || this.ctx.structuredOutput?.review) && operatorInputAtDispatch
@@ -1092,7 +1132,7 @@ export class IterationOrchestrator {
 								outputCapOverride ?? step.maxResponseTokens ?? turnConfig.maxResponseTokens,
 							cacheControl: { type: 'auto' },
 							...(turnConfig.thinking ? { thinking: turnConfig.thinking } : {}),
-							...(turnConfig.effort ? { effort: turnConfig.effort } : {}),
+							...(requestEffort ? { effort: requestEffort } : {}),
 							...(!forceFinalize && turnConfig.webSearch
 								? { webSearch: turnConfig.webSearch }
 								: {}),
@@ -1247,6 +1287,34 @@ export class IterationOrchestrator {
 						...contextFigures,
 					})
 
+					// A reply the provider declined to give is its own case. It is not
+					// an empty completion: asking again with the same history on the
+					// same model is refused again, at the full price of the prompt.
+					// Recovered here, before the reply can enter the history.
+					if (response.finishReason === 'content_filter') {
+						iterSpan.setStatus({ code: SpanStatusCode.OK })
+						if (iterationActivity) {
+							this.ctx.activityStore.complete(iterationActivity.id, {
+								content: response.message.content,
+								hasToolCalls: false,
+							})
+						}
+						const outcome = yield* this.recoverFromRefusal({
+							response,
+							messageId,
+							stepModel,
+							servedBy,
+							forceFinalize,
+							limitStopReason: forceFinalize ? guardResult.stopReason : undefined,
+							iterationNum,
+							stepStartedAt,
+							usageBefore,
+							costBefore,
+						})
+						if (outcome === 'retry') continue
+						break
+					}
+
 					// Durable reasoning and its adapter-private replay envelope ride
 					// with the turn they belong to. Trimming therefore removes both;
 					// retaining them gives the target adapter enough evidence to
@@ -1681,7 +1749,10 @@ export class IterationOrchestrator {
 								[NAMZU.ITERATION]: iterationNum,
 								'namzu.runtime.finish_reason': response.finishReason,
 							})
-							closingStopReason = await this.requestFinalResponse(model, 'end_turn')
+							closingStopReason = await this.requestFinalResponse(
+								this.refusalPinnedModel ?? model,
+								'end_turn',
+							)
 							yield* this.ctx.drainPending()
 						}
 
@@ -2873,6 +2944,179 @@ export class IterationOrchestrator {
 		})
 	}
 
+	/**
+	 * A reply the provider declined to give.
+	 *
+	 * The refused reply never enters the history sent next, except on the
+	 * same-model retry, where the stopped partial reply stays so the model can
+	 * see what to avoid. At most one automatic retry of each kind per turn:
+	 *
+	 * 1. Another model of the same provider, when the provider names one and
+	 *    the host has not turned `refusalFallback` off. The model is kept for
+	 *    the rest of the turn and announced in a `model_refusal` event.
+	 * 2. The same model once more, only when the refused reply had partial
+	 *    text or tool calls: unfinished calls get an error result and the
+	 *    model is told the reply was stopped.
+	 * 3. Otherwise the turn settles `refused`.
+	 */
+	private async *recoverFromRefusal(input: {
+		response: ChatCompletionResponse
+		messageId: MessageId
+		stepModel: string
+		servedBy: StepProvenance
+		forceFinalize: boolean
+		/** The limit that asked for this closing step; it stays the reason the turn ended. */
+		limitStopReason?: StopReason | undefined
+		iterationNum: number
+		stepStartedAt: number
+		usageBefore: TokenUsage
+		costBefore: CostInfo
+	}): AsyncGenerator<SessionEvent, 'retry' | 'settled'> {
+		const { recorder } = this.ctx
+		const { response, servedBy, iterationNum } = input
+		const refusal = response.refusal ?? {}
+		const toolCalls = response.message.toolCalls ?? []
+		const hasPartial =
+			(response.message.content !== null && response.message.content.length > 0) ||
+			toolCalls.length > 0
+
+		this.ctx.log.warn('The model declined to answer', {
+			[NAMZU.TURN_ID]: recorder.turnId,
+			[NAMZU.ITERATION]: iterationNum,
+			'namzu.runtime.model': servedBy.model,
+			'namzu.runtime.refusal_category': refusal.category,
+			'namzu.runtime.has_partial_output': hasPartial,
+		})
+
+		const announce = async (outcome: 'fallback' | 'retry' | 'declined', fallbackModel?: string) => {
+			await this.ctx.emitEvent({
+				type: 'model_refusal',
+				turnId: recorder.turnId,
+				iteration: iterationNum,
+				model: servedBy.model,
+				providerId: servedBy.providerId,
+				outcome,
+				...(fallbackModel !== undefined ? { fallbackModel } : {}),
+				...(refusal.category ? { category: refusal.category } : {}),
+				...(refusal.explanation ? { explanation: refusal.explanation } : {}),
+			})
+		}
+		const closeIteration = async () => {
+			this.recordStep({
+				stepNumber: iterationNum,
+				model: input.stepModel,
+				servedBy,
+				messageId: input.messageId,
+				response,
+				toolResults: [],
+				toolExecutionMs: 0,
+				startedAt: input.stepStartedAt,
+				usageBefore: input.usageBefore,
+				costBefore: input.costBefore,
+			})
+			await this.ctx.emitEvent({
+				type: 'iteration_completed',
+				turnId: recorder.turnId,
+				iteration: iterationNum,
+				hasToolCalls: false,
+			})
+		}
+
+		if (this.ctx.abortController.signal.aborted) {
+			recorder.setStopReason('cancelled')
+			recorder.markCancelled()
+			await closeIteration()
+			yield* this.ctx.drainPending()
+			return 'settled'
+		}
+
+		if (!input.forceFinalize && !this.refusalFallbackUsed && this.ctx.refusalFallback !== 'off') {
+			const next = await this.refusalFallbackModel(input.stepModel, refusal)
+			if (next !== undefined) {
+				this.refusalFallbackUsed = true
+				this.refusalPinnedModel = next
+				await announce('fallback', next)
+				await closeIteration()
+				yield* this.ctx.drainPending()
+				return 'retry'
+			}
+		}
+
+		if (!input.forceFinalize && !this.refusalRetryUsed && hasPartial) {
+			this.refusalRetryUsed = true
+			recorder.pushMessage(
+				withStreamedMessageIdentity(
+					createAssistantMessage(
+						response.message.content,
+						toolCalls.length > 0 ? toolCalls : undefined,
+						response.message.reasoning,
+						response.message.citations,
+						{
+							type: 'model',
+							...servedBy,
+							...(response.message.replayState !== undefined
+								? { replayState: response.message.replayState }
+								: {}),
+						},
+						response.message.textParts,
+					),
+					input.messageId,
+				),
+			)
+			for (const call of toolCalls) {
+				recorder.pushMessage(createToolMessage(REFUSED_REPLY_CALL_RESULT, call.id, true))
+			}
+			recorder.pushMessage(
+				createRuntimeContextMessage(REFUSED_REPLY_RETRY_MESSAGE, 'refusal-retry'),
+			)
+			await announce('retry')
+			await closeIteration()
+			yield* this.ctx.drainPending()
+			return 'retry'
+		}
+
+		recorder.setLastError(
+			`${servedBy.model} declined to answer this message${refusal.explanation ? `: ${refusal.explanation}` : '.'}`,
+		)
+		// A closing step that a limit asked for keeps that limit as the reason
+		// the turn ended; the refusal is still announced.
+		recorder.setStopReason(input.limitStopReason ?? 'refused')
+		await announce('declined')
+		await closeIteration()
+		yield* this.ctx.drainPending()
+		return 'settled'
+	}
+
+	/**
+	 * Another model to try after `model` declined, or `undefined` when there is
+	 * none. Only the provider can say: it names its own recommendation or its
+	 * own declared order, checked against what this credential can serve. A
+	 * chain member declared with a model of its own cannot be swapped, because
+	 * the chain would put its own model back on the request.
+	 */
+	private async refusalFallbackModel(
+		model: string,
+		refusal: NonNullable<ChatCompletionResponse['refusal']>,
+	): Promise<string | undefined> {
+		if (this.ctx.servingMember?.()?.model !== undefined) return undefined
+		const pick = this.ctx.provider.refusalFallbackFor
+		if (!pick) return undefined
+		try {
+			const next = await pick.call(
+				this.ctx.provider,
+				model,
+				refusal,
+				this.ctx.abortController.signal,
+			)
+			return next !== undefined && next.length > 0 && next !== model ? next : undefined
+		} catch (err) {
+			this.ctx.log.warn('The provider could not name a model to retry a refusal on', {
+				'exception.message': toErrorMessage(err),
+			})
+			return undefined
+		}
+	}
+
 	private async requestFinalResponse(
 		model: string,
 		reason: StopReason,
@@ -2980,6 +3224,16 @@ export class IterationOrchestrator {
 				model: servedBy.model,
 			})
 
+			// A closing request the provider declined has nothing to add, and its
+			// empty reply must not be stored or sent again.
+			if (response.finishReason === 'content_filter') {
+				this.ctx.log.warn('The closing response was declined by the model', {
+					[NAMZU.TURN_ID]: this.ctx.recorder.turnId,
+					'namzu.runtime.model': servedBy.model,
+				})
+				return undefined
+			}
+
 			const finalMessageId = generateMessageId()
 			const assistantMsg = withStreamedMessageIdentity(
 				createAssistantMessage(

package/src/runtime/query/iteration/outstanding-work.ts

@@ -5,6 +5,7 @@ import type { TaskHandle } from '../../../types/agent/scheduler.js'
 import { createRuntimeContextMessage } from '../../../types/message/index.js'
 import type { SessionEvent } from '../../../types/session/index.js'
 import { readPositiveIntEnv } from '../../../utils/env.js'
+import { formatLateResults } from '../detached-calls.js'
 import { formatJobNote, formatMonitorNote } from '../steering.js'
 import type { IterationContext } from './phases/index.js'
 
@@ -165,7 +166,8 @@ export async function* holdForOutstandingWork(
 ): AsyncGenerator<SessionEvent, boolean> {
 	const inbox = ctx.completionInbox?.holdsTurn ? ctx.completionInbox : undefined
 	const jobs = ctx.awaitedJobs?.hasPendingWork ? ctx.awaitedJobs : undefined
-	if (!inbox && !jobs) return false
+	const detached = ctx.detachedCalls?.hasWork ? ctx.detachedCalls : undefined
+	if (!inbox && !jobs && !detached) return false
 
 	// Read HERE rather than from `forceFinalize`, which was sampled at the
 	// top of the iteration: one that has since crossed the finalize point
@@ -179,7 +181,7 @@ export async function* holdForOutstandingWork(
 	// to be running. A job therefore never shortens a wait, and it never
 	// lengthens one either: where a task is outstanding too, that is how
 	// long this turn was waiting anyway.
-	let graceMs = inbox ? settleGraceMs(remainingMs) : awaitedJobGraceMs(remainingMs)
+	let graceMs = inbox || detached ? settleGraceMs(remainingMs) : awaitedJobGraceMs(remainingMs)
 	// A monitor the turn owns is held for until the monitor itself ends, which
 	// its own deadline bounds; the two-minute job ceiling would walk away from
 	// a watch with most of its time left. As with a task, this only ever
@@ -207,6 +209,7 @@ export async function* holdForOutstandingWork(
 		await Promise.race([
 			...(inbox ? [inbox.waitForArrival(graceMs, waiting.signal)] : []),
 			...(jobs ? [jobs.waitForArrival(graceMs, waiting.signal)] : []),
+			...(detached ? [detached.waitForArrival(graceMs, waiting.signal)] : []),
 			...(ctx.waitForInbound ? [ctx.waitForInbound(waiting.signal)] : []),
 			...(ctx.durableInbound?.wait ? [ctx.durableInbound.wait(waiting.signal)] : []),
 		])
@@ -228,8 +231,14 @@ export async function* holdForOutstandingWork(
 	}
 	const exited = deliverAwaitedJobExits(ctx)
 	const monitored = deliverMonitorNotices(ctx)
+	const late = ctx.detachedCalls?.take() ?? []
+	if (late.length > 0) {
+		ctx.recorder.pushMessage(createRuntimeContextMessage(formatLateResults(late), 'job-exit'))
+	}
 	const inbound = await deliverInbound()
-	if (arrived.length === 0 && !exited && !monitored && inbound === 0) return false
+	if (arrived.length === 0 && !exited && !monitored && late.length === 0 && inbound === 0) {
+		return false
+	}
 	await ctx.emitEvent({
 		type: 'iteration_completed',
 		turnId: ctx.recorder.turnId,

package/src/runtime/query/iteration/phases/context.ts

@@ -40,6 +40,7 @@ import type { TaskStore } from '../../../../types/task/index.js'
 import type { Logger } from '../../../../utils/logger.js'
 import type { AwaitedJobs } from '../../../jobs/awaited-jobs.js'
 import type { CheckpointManager } from '../../checkpoint.js'
+import type { DetachedCalls } from '../../detached-calls.js'
 import type { EmitEvent } from '../../events.js'
 import type { ToolExecutor } from '../../executor.js'
 import type { GuardCoordinator } from '../../guard.js'
@@ -171,6 +172,12 @@ export interface IterationContext {
 	 * and a turn whose model stopped calling tools settles without waiting.
 	 */
 	readonly awaitedJobs?: AwaitedJobs
+	/**
+	 * Calls answered with a placeholder because the operator wrote while they
+	 * ran. Absent means no call is ever handed back and the operator's message
+	 * waits for the batch, as it always has.
+	 */
+	readonly detachedCalls?: DetachedCalls
 	readonly checkpointMgr: CheckpointManager
 	readonly planManager: PlanManager
 
@@ -217,6 +224,8 @@ export interface IterationContext {
 	readonly compactionConfig?: CompactionConfig
 	/** See `QueryParams.maxOutputContinuations`. */
 	readonly maxOutputContinuations?: number
+	/** See `QueryParams.refusalFallback`. */
+	readonly refusalFallback?: 'auto' | 'off'
 
 	/**
 	 * What the driver said this model's context window is, resolved once.

package/src/runtime/query/iteration/phases/tool-review.ts

@@ -7,10 +7,12 @@ import type {
 	ToolCallDeclined,
 	ToolCallSummary,
 } from '../../../../types/hitl/index.js'
+import { createRuntimeContextMessage } from '../../../../types/message/index.js'
 import type { ChatCompletionResponse } from '../../../../types/provider/index.js'
 import type { SessionEvent } from '../../../../types/session/index.js'
 import type { ShellDialect } from '../../../../types/tool/index.js'
 import { DECLINED_TOOL_CALL_FEEDBACK } from '../../declined.js'
+import { type BatchDetach, DETACH_AFTER_MS, formatLateResults } from '../../detached-calls.js'
 import type {
 	PreparedToolBatch,
 	ReviewedExecution,
@@ -65,6 +67,60 @@ function hookAskedReason(reason: string | undefined): string {
 		: 'a hook asked that a person approve this call'
 }
 
+/**
+ * Watch for the operator writing while this batch runs.
+ *
+ * The batch is handed back once a message has arrived and the batch has run for
+ * {@link DETACH_AFTER_MS}; a short call finishes first and nothing changes. The
+ * arrival signal is the host's `waitForOperator`, which fires for operator text
+ * only, so a host that supplies none never detaches a call and a notice from a
+ * child or a peer never does.
+ */
+function watchForOperator(
+	ctx: IterationContext,
+	startedAt: number,
+): { readonly detach: BatchDetach; stop(): void } | undefined {
+	const calls = ctx.detachedCalls
+	const wakes = calls?.waitForOperator ? [calls.waitForOperator] : []
+	if (!calls || wakes.length === 0) return undefined
+	const watching = new AbortController()
+	let timer: ReturnType<typeof setTimeout> | undefined
+	const requested = new Promise<void>((resolve) => {
+		const settled = Promise.race(
+			wakes.map((wake) => {
+				try {
+					return wake(watching.signal)
+				} catch {
+					return new Promise<void>(() => {})
+				}
+			}),
+		)
+		settled.then(
+			() => {
+				if (watching.signal.aborted) return
+				const wait = Math.max(0, startedAt + DETACH_AFTER_MS - Date.now())
+				timer = setTimeout(resolve, wait)
+			},
+			// An aborted wait is the batch ending, which is not a message.
+			() => {},
+		)
+	})
+	return {
+		detach: { requested, calls },
+		stop() {
+			watching.abort()
+			if (timer !== undefined) clearTimeout(timer)
+		},
+	}
+}
+
+/** The outcomes of calls that were handed back as still running and have since finished. */
+function takeLateResults(ctx: IterationContext) {
+	const outcomes = ctx.detachedCalls?.take()
+	if (!outcomes || outcomes.length === 0) return undefined
+	return createRuntimeContextMessage(formatLateResults(outcomes), 'job-exit')
+}
+
 export type ToolReviewDecision = 'executed' | 'rejected' | 'stop'
 
 /**
@@ -290,14 +346,21 @@ export async function* runToolReview(
 	): Promise<void> => {
 		await announceRefusals(denials)
 		const startedAt = Date.now()
-		const batch = await ctx.toolExecutor.executeBatch(
-			response,
-			withRepeatRefusals(denials),
-			undefined,
-			preparedBatch,
-			declines,
-			review,
-		)
+		const watch = watchForOperator(ctx, startedAt)
+		let batch: Awaited<ReturnType<typeof ctx.toolExecutor.executeBatch>>
+		try {
+			batch = await ctx.toolExecutor.executeBatch(
+				response,
+				withRepeatRefusals(denials),
+				undefined,
+				preparedBatch,
+				declines,
+				review,
+				watch?.detach,
+			)
+		} finally {
+			watch?.stop()
+		}
 		toolMs += Date.now() - startedAt
 		executed = batch.results
 		await announceBatch(batch.results)
@@ -369,6 +432,8 @@ export async function* runToolReview(
 			},
 		)
 		if (monitorNotice) ctx.recorder.pushMessage(monitorNotice)
+		const lateResults = takeLateResults(ctx)
+		if (lateResults) ctx.recorder.pushMessage(lateResults)
 		const credentialNotice = takeWithheldEnvNotice(ctx.recorder.messages, batch.observations)
 		if (credentialNotice) ctx.recorder.pushMessage(credentialNotice)
 		if (jobNoticeDelivered) ctx.onJobNoticeDelivered?.()

package/src/runtime/query/iteration/stream-turn.ts

@@ -284,6 +284,8 @@ export async function* streamProviderTurn(
 	let reportedFinishReason: ChatCompletionResponse['finishReason'] | undefined
 	// Which limit a 'length' finish reached, when it was the context window.
 	let finishDetail: ChatCompletionResponse['finishDetail']
+	// What the provider said about a refusal, kept with the finish that carried it.
+	let refusal: ChatCompletionResponse['refusal']
 	let usage: ChatCompletionResponse['usage'] = {
 		promptTokens: 0,
 		completionTokens: 0,
@@ -416,6 +418,7 @@ export async function* streamProviderTurn(
 		finishReason = 'stop'
 		reportedFinishReason = undefined
 		finishDetail = undefined
+		refusal = undefined
 		streamedLength = 0
 		lastOutputCall = undefined
 		usage = {
@@ -766,6 +769,7 @@ export async function* streamProviderTurn(
 				reportedFinishReason = chunk.finishReason
 				finishDetail = chunk.finishReason === 'length' ? chunk.finishDetail : undefined
 			}
+			if (chunk.refusal) refusal = chunk.refusal
 			// Merge (per-field max), not last-write-wins: a late usage frame that
 			// omits input/cache tokens must not zero the counts seen earlier in the
 			// stream, which would under-report this turn's accumulated usage.
@@ -1061,6 +1065,7 @@ export async function* streamProviderTurn(
 		},
 		finishReason: effectiveFinishReason,
 		...(effectiveFinishReason === 'length' && finishDetail ? { finishDetail } : {}),
+		...(effectiveFinishReason === 'content_filter' && refusal ? { refusal } : {}),
 		usage,
 	}
 

package/src/runtime/query/session-storage.ts

@@ -273,9 +273,14 @@ export function checkpointLogView(log: SessionLog): CheckpointLogView {
 	return {
 		async verifyThrough(scope, throughSeq, throughSha256) {
 			own(scope)
-			const read = await log.readAll({ mode: 'tolerant', throughSeq })
-			const entry = read.entries.at(-1)
-			return entry?.pointer.seq === throughSeq && entry.pointer.sha256 === throughSha256
+			// Stream the walk and keep only the last pointer: the chain is
+			// verified as it is read, and a long session must not be held in
+			// memory just to look at its final entry.
+			let last: { seq: number; sha256: string } | undefined
+			for await (const entry of log.read({ mode: 'tolerant', throughSeq })) {
+				last = entry.pointer
+			}
+			return last?.seq === throughSeq && last.sha256 === throughSha256
 		},
 		async writtenDocSha256(scope, checkpointId) {
 			own(scope)