@namzu/sdk 6.0.0 → 6.2.0

package/src/registry/tool/dialect.ts

@@ -116,10 +116,17 @@ function to2020(value: unknown): unknown {
 			continue
 		}
 		if (key === 'additionalItems') {
-			// Only meaningful alongside an array-form `items`, where 2020-12
-			// calls the same thing `items`. `false` is the default in both
-			// dialects once `prefixItems` is set, so it carries nothing.
-			if (Array.isArray(node.items) && child !== false) out.items = to2020(child)
+			// Only meaningful alongside an array-form `items`, and 2020-12
+			// calls the same thing `items`.
+			//
+			// `false` is carried across, and the first version of this dropped
+			// it on the reasoning that a closed tuple is 2020-12's default. It
+			// is not: with `prefixItems` set and no `items`, elements past the
+			// tuple are UNCONSTRAINED. Dropping the `false` therefore turned a
+			// closed tuple into an open one — a schema the author wrote to
+			// forbid a third element silently began to allow any. The wire
+			// accepts `items: false`, measured, so nothing was gained by it.
+			if (Array.isArray(node.items)) out.items = to2020(child)
 			continue
 		}
 		out[key] = to2020(child)

package/src/registry/tool/execute.ts

@@ -438,6 +438,41 @@ Executable tool names, descriptions, and JSON input schemas are attached through
 					}
 				}
 
+				// A turn that was narrowed may only call what it was narrowed to.
+				//
+				// This used to be enforced nowhere. `allowedTools` decided which
+				// schemas went into the request and was then carried into this
+				// context and read by nothing, so the restriction was a statement
+				// about the menu rather than about the kitchen: a model that named
+				// a withheld tool — from earlier context, from a gateway holding
+				// its own tool list, from a replayed cache prefix — had it run.
+				// The type says "restrict which tools the model may call"; this is
+				// the line that makes that true.
+				//
+				// Absent means unrestricted. An EMPTY list does not: it is a turn
+				// that may call nothing, and treating it as "no restriction" is
+				// the fail-open reading this codebase has already been bitten by
+				// once, in the delegate roster.
+				const allowed = context.allowedTools
+				if (allowed !== undefined && !allowed.includes(toolName)) {
+					const msg = `Tool "${toolName}" is not available on this step. Available: ${allowed.length > 0 ? allowed.join(', ') : '(none)'}`
+					this.log.warn('Blocked a tool outside the step allow-list', {
+						tool: toolName,
+						allowed: allowed.length,
+					})
+					span.setAttributes({
+						[NAMZU.TOOL_SUCCESS]: false,
+						[NAMZU.TOOL_ERROR]: msg,
+					})
+					span.setStatus({ code: SpanStatusCode.ERROR, message: msg })
+					return {
+						success: false,
+						output: '',
+						error: msg,
+						permissionDenied: true,
+					}
+				}
+
 				const mode = context.permissionContext?.mode ?? 'auto'
 				if (mode === 'plan') {
 					const isReadOnly = tool.isReadOnly ? tool.isReadOnly(rawInput) : false

package/src/runtime/query/__tests__/completion-notification.test.ts

@@ -0,0 +1,196 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { z } from 'zod'
+
+import { CompletionInbox } from '../../../gateway/completion-inbox.js'
+import { ToolRegistry } from '../../../registry/tool/execute.js'
+import { defineTool } from '../../../tools/defineTool.js'
+import type { TaskHandle } from '../../../types/agent/gateway.js'
+import type { SessionId, TaskId, TenantId } from '../../../types/ids/index.js'
+import { createUserMessage } from '../../../types/message/index.js'
+import type { LLMProvider, StreamChunk } from '../../../types/provider/index.js'
+import type { ProjectId, ThreadId } from '../../../types/session/ids.js'
+import { drainQuery } from '../index.js'
+
+/**
+ * The last link, and the one most likely to be built and never wired.
+ *
+ * `CompletionInbox` can queue an unclaimed completion and format it, and the
+ * coordinator tools can decline to claim one — but none of that reaches the
+ * model unless the iteration loop actually drains the inbox into the
+ * transcript. A mechanism that is declared, threaded through types, and
+ * driven by nothing is precisely the shape of the defect this whole change
+ * exists to fix, so the drain gets its own test at the loop level rather
+ * than being assumed from its parts.
+ */
+
+const ZERO_USAGE = {
+	promptTokens: 0,
+	completionTokens: 0,
+	totalTokens: 0,
+	cachedTokens: 0,
+	cacheWriteTokens: 0,
+}
+
+/** Calls a tool once, then answers. Two turns is all the drain needs. */
+class ToolThenAnswerProvider implements LLMProvider {
+	readonly id = 'tool-then-answer'
+	readonly name = 'Tool Then Answer Provider'
+	calls = 0
+
+	async *chatStream(): AsyncIterable<StreamChunk> {
+		this.calls += 1
+
+		if (this.calls === 1) {
+			yield {
+				id: 'msg_1',
+				delta: {
+					toolCalls: [
+						{
+							index: 0,
+							id: 'toolu_noop_1',
+							type: 'function',
+							function: { name: 'noop', arguments: '{}' },
+						},
+					],
+				},
+			}
+			yield {
+				id: 'msg_1',
+				delta: {},
+				finishReason: 'tool_calls',
+				usage: ZERO_USAGE,
+			}
+			return
+		}
+
+		yield { id: 'msg_2', delta: { content: 'Done.' } }
+		yield { id: 'msg_2', delta: {}, finishReason: 'stop', usage: ZERO_USAGE }
+	}
+}
+
+const noop = defineTool({
+	name: 'noop',
+	description: 'does nothing',
+	inputSchema: z.object({}),
+	category: 'analysis',
+	permissions: [],
+	readOnly: true,
+	destructive: false,
+	concurrencySafe: true,
+	async execute() {
+		return { success: true, output: 'ok' }
+	},
+})
+
+function completed(taskId: string, result: string): TaskHandle {
+	return {
+		taskId: taskId as TaskId,
+		agentId: 'reviewer',
+		state: 'completed',
+		createdAt: 1_000,
+		completedAt: 4_000,
+		result: { status: 'completed', result } as TaskHandle['result'],
+	}
+}
+
+const workdirs: string[] = []
+afterEach(async () => {
+	await Promise.all(workdirs.map((dir) => rm(dir, { recursive: true, force: true })))
+	workdirs.length = 0
+})
+
+async function runWith(inbox: CompletionInbox | undefined): Promise<string[]> {
+	const workingDirectory = await mkdtemp(join(tmpdir(), 'namzu-completion-'))
+	workdirs.push(workingDirectory)
+
+	const tools = new ToolRegistry()
+	tools.register(noop)
+
+	const run = await drainQuery({
+		provider: new ToolThenAnswerProvider(),
+		tools,
+		...(inbox ? { completionInbox: inbox } : {}),
+		agentId: 'agent_test',
+		agentName: 'Test Agent',
+		messages: [createUserMessage('delegate and report')],
+		workingDirectory,
+		runConfig: {
+			model: 'mock-model',
+			timeoutMs: 10_000,
+			tokenBudget: 100_000,
+			maxIterations: 4,
+			maxResponseTokens: 256,
+		},
+		sessionId: 'ses_completion' as SessionId,
+		threadId: 'thd_completion' as ThreadId,
+		projectId: 'prj_completion' as ProjectId,
+		tenantId: 'tnt_completion' as TenantId,
+	})
+
+	return run.messages
+		.filter((m) => m.role === 'user')
+		.map((m) => (typeof m.content === 'string' ? m.content : JSON.stringify(m.content)))
+}
+
+describe('an unclaimed completion reaches the transcript', () => {
+	it('injects the notification as a user message the next turn can read', async () => {
+		const inbox = new CompletionInbox()
+		// Settled by a gateway before the turn ended, with nothing waiting on
+		// it — the abandoned-launch case.
+		inbox.attach({
+			onTaskCompleted: (cb: (h: TaskHandle) => void) => {
+				cb(completed('tsk_late', 'the worker finished after the wait was abandoned'))
+				return () => {}
+			},
+		} as never)
+
+		const userMessages = await runWith(inbox)
+		const notification = userMessages.find((m) => m.includes('task-notification'))
+
+		expect(notification).toBeDefined()
+		expect(notification).toContain('tsk_late')
+		expect(notification).toContain('the worker finished after the wait was abandoned')
+	})
+
+	it('drains it exactly once, however many turns follow', async () => {
+		const inbox = new CompletionInbox()
+		inbox.attach({
+			onTaskCompleted: (cb: (h: TaskHandle) => void) => {
+				cb(completed('tsk_late', 'only once'))
+				return () => {}
+			},
+		} as never)
+
+		const userMessages = await runWith(inbox)
+
+		expect(userMessages.filter((m) => m.includes('task-notification'))).toHaveLength(1)
+	})
+
+	it('says nothing when every completion was already delivered', async () => {
+		// The `dc16d58` regression at the loop level: a blocking `create_task`
+		// claims its own completion, so the transcript must stay clean.
+		const inbox = new CompletionInbox()
+		inbox.attach({
+			onTaskCompleted: (cb: (h: TaskHandle) => void) => {
+				cb(completed('tsk_awaited', 'delivered as a tool_result'))
+				return () => {}
+			},
+		} as never)
+		inbox.claim('tsk_awaited' as TaskId)
+
+		const userMessages = await runWith(inbox)
+
+		expect(userMessages.some((m) => m.includes('task-notification'))).toBe(false)
+	})
+
+	it('runs unchanged with no inbox at all', async () => {
+		// The kernel must not require one: a host on the old wiring keeps
+		// working, it just never hears about abandoned completions.
+		const userMessages = await runWith(undefined)
+
+		expect(userMessages.some((m) => m.includes('task-notification'))).toBe(false)
+	})
+})

package/src/runtime/query/__tests__/run-survives-its-own-park.proc-test.ts

@@ -0,0 +1,127 @@
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { afterEach, describe, expect, it } from 'vitest'
+
+/**
+ * A run has to survive its own waiting.
+ *
+ * Every HITL park went through a timer that was deliberately `unref`'d, so a
+ * pending park-recorder could never hold a process open after the run
+ * settled. The intent was right and the scope was wrong: the run AWAITS that
+ * timer, mid-turn, on every park. An unref'd timer does not keep Node's loop
+ * alive — so once the decision resolved and the run sat out the rest of the
+ * delay, the loop had nothing ref'd left in it and the process exited. Mid
+ * turn. Exit code 0. No terminal event, no error, and nothing done.
+ *
+ * The headless surfaces could not finish a turn at all: the first tool call
+ * completed and the process ended.
+ *
+ * **This test spawns a child process on purpose.** In-process it is
+ * unwritable — a test runner holds the event loop open for the whole file,
+ * which is the exact prop that hid this for as long as it was hidden. Every
+ * existing test passed throughout. If you are tempted to rewrite this as an
+ * ordinary `drainQuery` call because spawning is slow, that rewrite is the
+ * bug coming back.
+ *
+ * It loads the BUILT entry point, because that is what a consumer loads and
+ * because a child process cannot resolve TypeScript. The `test:proc` script
+ * therefore builds first — a stale `dist` reports a failure that has nothing
+ * to do with the code under test, and would report a pass just as
+ * confidently.
+ */
+
+const workdirs: string[] = []
+afterEach(() => {
+	for (const dir of workdirs) rmSync(dir, { recursive: true, force: true })
+	workdirs.length = 0
+})
+
+/**
+ * A scripted provider and a run, in a file with no test runner under it.
+ *
+ * Two turns: one tool call, then an answer. The park happens between them,
+ * which is where the process used to die.
+ */
+const SCRIPT = `
+import { pathToFileURL } from 'node:url'
+const sdk = await import(pathToFileURL(process.argv[2]).href)
+const { ToolRegistry, drainQuery, defineTool } = sdk
+const { z } = await import(pathToFileURL(process.argv[3]).href)
+
+const ZERO = { promptTokens: 0, completionTokens: 0, totalTokens: 0, cachedTokens: 0, cacheWriteTokens: 0 }
+
+let calls = 0
+const provider = {
+  id: 'scripted',
+  name: 'Scripted',
+  async *chatStream() {
+    calls += 1
+    if (calls === 1) {
+      yield { id: 'm1', delta: { toolCalls: [{ index: 0, id: 't1', type: 'function', function: { name: 'ping', arguments: '{}' } }] } }
+      yield { id: 'm1', delta: {}, finishReason: 'tool_calls', usage: ZERO }
+      return
+    }
+    yield { id: 'm2', delta: { content: 'answered' } }
+    yield { id: 'm2', delta: {}, finishReason: 'stop', usage: ZERO }
+  },
+}
+
+const tools = new ToolRegistry()
+tools.register(defineTool({
+  name: 'ping',
+  description: 'pings',
+  inputSchema: z.object({}),
+  category: 'analysis',
+  permissions: [],
+  readOnly: true,
+  destructive: false,
+  concurrencySafe: true,
+  async execute() { return { success: true, output: 'pong' } },
+}))
+
+let last = '(none)'
+drainQuery({
+  provider,
+  tools,
+  agentId: 'a',
+  agentName: 'A',
+  messages: [{ role: 'user', content: 'go', timestamp: Date.now() }],
+  workingDirectory: process.argv[4],
+  runConfig: { model: 'm', timeoutMs: 20000, tokenBudget: 10000, maxIterations: 4, maxResponseTokens: 128 },
+  sessionId: 'ses_x', threadId: 'thd_x', projectId: 'prj_x', tenantId: 'tnt_x',
+}, (e) => { last = e.type }).then(
+  (run) => console.log('RESULT ' + JSON.stringify({ status: run.status, stop: run.stopReason, last })),
+  (err) => console.log('THREW ' + (err?.message ?? err)),
+)
+process.on('exit', () => console.log('LAST ' + last))
+`
+
+describe('a run outlives its own HITL park', () => {
+	it('finishes in a process with nothing else holding the event loop open', () => {
+		const dir = mkdtempSync(join(tmpdir(), 'namzu-park-'))
+		workdirs.push(dir)
+		const script = join(dir, 'run.mjs')
+		writeFileSync(script, SCRIPT)
+
+		// `fileURLToPath`, not `pathname` with the leading slash stripped. That
+		// stripping is right on Windows, where `pathname` is `/C:/…`, and wrong
+		// everywhere else, where it turns an absolute POSIX path into a
+		// relative one — which is how this passed locally and failed in CI with
+		// the repo root pasted in front of itself.
+		const sdkEntry = fileURLToPath(new URL('../../../../dist/index.js', import.meta.url))
+		const zodEntry = require.resolve('zod')
+
+		const out = execFileSync(process.execPath, [script, sdkEntry, zodEntry, dir], {
+			encoding: 'utf8',
+			timeout: 60_000,
+		})
+
+		// The run reached its own end rather than the process reaching it first.
+		expect(out, `the run did not complete:\n${out}`).toContain('RESULT ')
+		expect(out).toContain('"status":"completed"')
+		expect(out).toContain('"last":"run_completed"')
+	}, 90_000)
+})

package/src/runtime/query/__tests__/step-allow-list.test.ts

@@ -0,0 +1,205 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { z } from 'zod'
+
+import { ToolRegistry } from '../../../registry/tool/execute.js'
+import { defineTool } from '../../../tools/defineTool.js'
+import type { SessionId, TenantId } from '../../../types/ids/index.js'
+import { createUserMessage } from '../../../types/message/index.js'
+import type { LLMProvider, StreamChunk } from '../../../types/provider/index.js'
+import type { ProjectId, ThreadId } from '../../../types/session/ids.js'
+import { drainQuery } from '../index.js'
+
+/**
+ * Narrowing a step has to narrow what RUNS, not only what is offered.
+ *
+ * `prepareStep.activeTools` says "restrict which tools the model may call
+ * this step, by name", and for a while it did nothing of the sort: it chose
+ * which schemas went into the request, was copied into the tool context, and
+ * was read by nobody on the execution path. A model that named a withheld
+ * tool had it run — and a model does name one, from a repeated call earlier
+ * in the context, from a gateway carrying its own tool list, or from a
+ * replayed cache prefix.
+ *
+ * These tests call the withheld tool deliberately, which is the only way to
+ * tell an enforced restriction from a presentational one. Every existing test
+ * asked the model nicely and so could not have caught this.
+ */
+
+const ZERO_USAGE = {
+	promptTokens: 0,
+	completionTokens: 0,
+	totalTokens: 0,
+	cachedTokens: 0,
+	cacheWriteTokens: 0,
+}
+
+let danger = 0
+
+const readOnly = defineTool({
+	name: 'read_only',
+	description: 'observes',
+	inputSchema: z.object({}),
+	category: 'analysis',
+	permissions: [],
+	readOnly: true,
+	destructive: false,
+	concurrencySafe: true,
+	async execute() {
+		return { success: true, output: 'observed' }
+	},
+})
+
+const dangerous = defineTool({
+	name: 'danger',
+	description: 'mutates',
+	inputSchema: z.object({}),
+	category: 'custom',
+	permissions: [],
+	readOnly: false,
+	destructive: true,
+	concurrencySafe: false,
+	async execute() {
+		danger += 1
+		return { success: true, output: 'the withheld tool ran' }
+	},
+})
+
+/** Calls whichever tool it is told to, then answers. */
+class NamesTool implements LLMProvider {
+	readonly id = 'names-tool'
+	readonly name = 'Names Tool Provider'
+	calls = 0
+	offered: string[][] = []
+
+	constructor(private readonly toolName: string) {}
+
+	async *chatStream(params: {
+		tools?: { function: { name: string } }[]
+	}): AsyncIterable<StreamChunk> {
+		this.calls += 1
+		this.offered.push((params.tools ?? []).map((t) => t.function.name))
+
+		if (this.calls === 1) {
+			yield {
+				id: 'msg_1',
+				delta: {
+					toolCalls: [
+						{
+							index: 0,
+							id: 'toolu_1',
+							type: 'function',
+							function: { name: this.toolName, arguments: '{}' },
+						},
+					],
+				},
+			}
+			yield { id: 'msg_1', delta: {}, finishReason: 'tool_calls', usage: ZERO_USAGE }
+			return
+		}
+
+		yield { id: 'msg_2', delta: { content: 'done' } }
+		yield { id: 'msg_2', delta: {}, finishReason: 'stop', usage: ZERO_USAGE }
+	}
+}
+
+const workdirs: string[] = []
+afterEach(async () => {
+	await Promise.all(workdirs.map((dir) => rm(dir, { recursive: true, force: true })))
+	workdirs.length = 0
+	danger = 0
+})
+
+async function run(opts: {
+	names: string
+	allowedTools?: string[]
+	activeTools?: string[]
+}): Promise<{ offered: string[][]; output: string }> {
+	const workingDirectory = await mkdtemp(join(tmpdir(), 'namzu-allow-'))
+	workdirs.push(workingDirectory)
+
+	const tools = new ToolRegistry()
+	tools.register(readOnly)
+	tools.register(dangerous)
+
+	const provider = new NamesTool(opts.names)
+	let output = ''
+
+	await drainQuery(
+		{
+			provider,
+			tools,
+			...(opts.allowedTools ? { allowedTools: opts.allowedTools } : {}),
+			...(opts.activeTools
+				? { prepareStep: () => ({ activeTools: opts.activeTools as string[] }) }
+				: {}),
+			agentId: 'agent_test',
+			agentName: 'Test Agent',
+			messages: [createUserMessage('go')],
+			workingDirectory,
+			runConfig: {
+				model: 'mock-model',
+				timeoutMs: 10_000,
+				tokenBudget: 100_000,
+				maxIterations: 3,
+				maxResponseTokens: 256,
+			},
+			sessionId: 'ses_allow' as SessionId,
+			threadId: 'thd_allow' as ThreadId,
+			projectId: 'prj_allow' as ProjectId,
+			tenantId: 'tnt_allow' as TenantId,
+		},
+		(event) => {
+			if (event.type === 'tool_completed') output += event.result ?? ''
+		},
+	)
+
+	return { offered: provider.offered, output }
+}
+
+describe('a narrowed step narrows what can run, not just what is shown', () => {
+	it('refuses a tool the step withheld, even when the model names it', async () => {
+		const { offered, output } = await run({ names: 'danger', activeTools: ['read_only'] })
+
+		// The request really was narrowed — otherwise this test proves nothing
+		// about enforcement, only about the model's manners.
+		expect(offered[0]).toEqual(['read_only'])
+		// And the call was refused rather than executed.
+		expect(danger, 'the withheld tool executed').toBe(0)
+		expect(output).toContain('not available on this step')
+	})
+
+	it('refuses a tool outside the run-level list too', async () => {
+		const { output } = await run({ names: 'danger', allowedTools: ['read_only'] })
+
+		expect(danger).toBe(0)
+		expect(output).toContain('not available on this step')
+	})
+
+	it('still runs a tool that is on the list', async () => {
+		const { output } = await run({ names: 'read_only', activeTools: ['read_only'] })
+
+		expect(output).toContain('observed')
+	})
+
+	it('leaves an unnarrowed run alone', async () => {
+		// Absent means unrestricted. A run that never narrows anything must not
+		// suddenly start refusing its own tools.
+		const { output } = await run({ names: 'danger' })
+
+		expect(danger).toBe(1)
+		expect(output).toContain('the withheld tool ran')
+	})
+
+	it('treats an empty list as "nothing", not as "no restriction"', async () => {
+		// The fail-open reading this codebase has already been bitten by once,
+		// in the delegate roster: an empty allow-list IS the answer, and
+		// degrading it to "unrestricted" is how a closed list becomes open.
+		const { output } = await run({ names: 'danger', activeTools: [] })
+
+		expect(danger).toBe(0)
+		expect(output).toContain('(none)')
+	})
+})

package/src/runtime/query/executor.ts

@@ -205,6 +205,8 @@ export class ToolExecutor {
 	private workingStateManager?: WorkingStateManager
 	private probes: ProbeRegistry
 	private parentSpan?: Span
+	/** Set per turn by the orchestrator; see {@link setStepAllowedTools}. */
+	private stepAllowedTools?: readonly string[]
 	private readonly readPaths: Set<string> = new Set()
 	private readonly readFingerprints: Map<string, string> = new Map()
 	private readonly fileReadTracker: FileReadTracker = {
@@ -251,6 +253,21 @@ export class ToolExecutor {
 		this.parentSpan = span
 	}
 
+	/**
+	 * Narrow what this turn may call, or clear the narrowing.
+	 *
+	 * Re-set each turn by the orchestrator for the same reason the parent span
+	 * is: `prepareStep` can hand a different list to every step, and the run's
+	 * own `allowedTools` is only the default when a step names none.
+	 *
+	 * Without this the executor could only ever see the RUN-level list, so a
+	 * per-step narrowing reached the request that was sent and nothing else —
+	 * the model was shown fewer tools and could still call all of them.
+	 */
+	setStepAllowedTools(names: readonly string[] | undefined): void {
+		this.stepAllowedTools = names
+	}
+
 	/**
 	 * Answer every `tool_use` block in `response` with exactly one
 	 * `tool_result`.
@@ -424,7 +441,10 @@ export class ToolExecutor {
 			},
 			invocationState: this.config.invocationState,
 			toolRegistry: this.config.tools,
-			allowedTools: this.config.allowedTools,
+			// The step's list wins where it has one; the run's is the default.
+			// Same precedence the request already uses when it decides which
+			// schemas to send, so the menu and the kitchen agree.
+			allowedTools: this.stepAllowedTools ?? this.config.allowedTools,
 			sandbox: this.config.sandbox,
 			fileReadTracker: this.fileReadTracker,
 			...(this.parentSpan ? { parentSpan: this.parentSpan } : {}),

package/src/runtime/query/index.ts

@@ -410,6 +410,16 @@ export interface QueryParams {
 
 	taskGateway?: import('../../types/agent/gateway.js').TaskGateway
 
+	/**
+	 * Where a worker completion goes when no tool call is waiting for it.
+	 *
+	 * Supplied by whoever built the coordinator tools, because the tools and
+	 * this loop have to share one inbox: the tools claim what they deliver,
+	 * and the loop delivers what is left. Omitted, the loop drains nothing and
+	 * the behaviour is exactly what it was before the inbox existed.
+	 */
+	completionInbox?: import('../../gateway/completion-inbox.js').CompletionInbox
+
 	launchedTasks?: Map<
 		import('../../types/ids/index.js').TaskId,
 		import('./iteration/phases/context.js').LaunchedTaskMeta
@@ -842,6 +852,7 @@ export async function* query(params: QueryParams): AsyncGenerator<RunEvent, Run>
 		checkpointMgr,
 		planManager: ctx.planManager,
 		taskGateway: params.taskGateway,
+		completionInbox: params.completionInbox,
 		taskStore: params.taskStore,
 		launchedTasks: params.launchedTasks ?? new Map(),
 		// Run-scoped. An approval is a statement about this run's work;