@namzu/sdk 61.4.0 → 62.0.0

package/src/runtime/query/iteration/stream-turn.ts

@@ -4,6 +4,7 @@ import {
 	assertNativeStructuredOutputSupported,
 } from '../../../provider/capabilities.js'
 import { ProviderRequestError, isProviderRequestError } from '../../../provider/errors.js'
+import { StepStopped } from '../../../provider/step-stopped.js'
 import { StreamTextAccumulator } from '../../../provider/stream-text.js'
 import {
 	INTERLEAVED_TOOL_INPUT_PARSE_ERROR,
@@ -120,6 +121,8 @@ export interface StreamingTurnResult {
 	messageId: import('../../../types/ids/index.js').MessageId
 	/** Captured only for host review, at the provider-chain dispatch boundary. */
 	requestMessages?: readonly Message[]
+	/** The step was cut short because its reasoning reached the cap before it acted. */
+	reasoningCapped?: boolean
 }
 
 /**
@@ -249,6 +252,12 @@ export async function* streamProviderTurn(
 	captureRequest = false,
 	/** The session the turn belongs to, named on the chat span as `gen_ai.conversation.id`. */
 	sessionId?: import('../../../types/ids/index.js').SessionId,
+	/**
+	 * The most characters of reasoning this step may stream before it has made a
+	 * call. When it is reached the request is stopped on purpose (the abort carries
+	 * a {@link StepStopped} reason) and the step ends with what it produced so far.
+	 */
+	reasoningCapChars?: number,
 ): AsyncGenerator<SessionEvent, StreamingTurnResult> {
 	assertNativeStructuredOutputSupported(provider, params)
 	assertHostedWebSearchSupported(provider, params)
@@ -355,8 +364,20 @@ export async function* streamProviderTurn(
 	/** The stream broke tool-call framing; nothing it sent becomes a tool call. */
 	let framingViolated = false
 
+	// The step's own stop: aborting it ends the request without being a caller's
+	// Stop, so the turn is not cancelled by it.
+	const stepStop = new AbortController()
+	let reasoningCapped = false
+	let reasoningStreamed = 0
 	const streamParams = {
 		...params,
+		...(reasoningCapChars !== undefined
+			? {
+					signal: params.signal
+						? AbortSignal.any([params.signal, stepStop.signal])
+						: stepStop.signal,
+				}
+			: {}),
 		stream: true,
 	} satisfies import('../../../types/provider/index.js').ChatCompletionParams
 	let requestMessages: readonly Message[] | undefined
@@ -420,6 +441,7 @@ export async function* streamProviderTurn(
 		finishDetail = undefined
 		refusal = undefined
 		streamedLength = 0
+		reasoningStreamed = 0
 		lastOutputCall = undefined
 		usage = {
 			promptTokens: 0,
@@ -554,6 +576,7 @@ export async function* streamProviderTurn(
 				if (reasoning.text) {
 					bucket.text += reasoning.text
 					streamedLength += reasoning.text.length
+					reasoningStreamed += reasoning.text.length
 					await emitEvent({
 						type: 'reasoning_delta',
 						turnId,
@@ -576,6 +599,28 @@ export async function* streamProviderTurn(
 					})
 					yield* drainPending()
 				}
+				// Reasoning that reaches the cap before any call has begun ends the step.
+				if (
+					reasoningCapChars !== undefined &&
+					reasoningStreamed >= reasoningCapChars &&
+					toolBuckets.size === 0
+				) {
+					reasoningCapped = true
+					if (!reasoning.done) {
+						await emitEvent({
+							type: 'reasoning_completed',
+							turnId,
+							iteration,
+							messageId,
+							blockIndex: reasoning.index,
+							...(bucket.text ? { text: bucket.text } : {}),
+							signed: bucket.signature !== undefined,
+						})
+						yield* drainPending()
+					}
+					stepStop.abort(new StepStopped())
+					break
+				}
 			}
 
 			if (chunk.delta.content) {
@@ -1091,5 +1136,10 @@ export async function* streamProviderTurn(
 	chatSpan.setStatus({ code: SpanStatusCode.OK })
 	chatSpan.end()
 
-	return { response, messageId, ...(requestMessages ? { requestMessages } : {}) }
+	return {
+		response,
+		messageId,
+		...(requestMessages ? { requestMessages } : {}),
+		...(reasoningCapped ? { reasoningCapped } : {}),
+	}
 }

package/src/runtime/query/resume-pending.ts

@@ -248,7 +248,7 @@ function derivePartialDenials(
 			for (const call of asked) {
 				const mods = decision.modifications.filter((mod) => mod.toolCallId === call.id)
 				if (mods.some((mod) => mod.action === 'deny'))
-					denials.set(call.id, DECLINED_TOOL_CALL_FEEDBACK)
+					denials.set(call.id, decision.policyRefusals?.[call.id] ?? DECLINED_TOOL_CALL_FEEDBACK)
 				else if (!mods.some((mod) => mod.action === 'approve')) {
 					denials.set(
 						call.id,
@@ -280,7 +280,8 @@ function derivePartialDeclines(
 		const denied = asked.filter(
 			(call) =>
 				!gateDenied.has(call.id) &&
-				decision.modifications.some((mod) => mod.toolCallId === call.id && mod.action === 'deny'),
+				decision.modifications.some((mod) => mod.toolCallId === call.id && mod.action === 'deny') &&
+				decision.policyRefusals?.[call.id] === undefined,
 		)
 		if (denied.length > 0) return new Map(denied.map((call) => [call.id, {}]))
 	}
@@ -833,7 +834,10 @@ function derriveDeclines(
 	}
 	if (decision.action === 'modify_tools') {
 		const denied = decision.modifications.filter(
-			(mod) => mod.action === 'deny' && !gateDenied.has(mod.toolCallId),
+			(mod) =>
+				mod.action === 'deny' &&
+				!gateDenied.has(mod.toolCallId) &&
+				decision.policyRefusals?.[mod.toolCallId] === undefined,
 		)
 		if (denied.length > 0) return new Map(denied.map((mod) => [mod.toolCallId, {}]))
 	}
@@ -868,7 +872,10 @@ function derriveDenials(
 			const denials = new Map<string, string>()
 			for (const mod of decision.modifications) {
 				if (mod.action === 'deny') {
-					denials.set(mod.toolCallId, DECLINED_TOOL_CALL_FEEDBACK)
+					denials.set(
+						mod.toolCallId,
+						decision.policyRefusals?.[mod.toolCallId] ?? DECLINED_TOOL_CALL_FEEDBACK,
+					)
 				}
 			}
 			for (const mod of decision.modifications) {

package/src/runtime/query/review-policy.ts

@@ -21,6 +21,9 @@
  * person (`prompt`).
  */
 
+import { homedir } from 'node:os'
+import { dirname, parse } from 'node:path'
+
 import { unknownProgramInLine } from '../../authorization/program.js'
 import type { ShellWord } from '../../authorization/shell-lexer.js'
 import {
@@ -38,6 +41,7 @@ import type {
 	ResumeHandler,
 	ToolCallDeclined,
 	ToolCallSummary,
+	ToolModification,
 } from '../../types/hitl/index.js'
 import type { ApprovalPolicy } from '../../types/hitl/policy.js'
 import type { SessionId, TurnId } from '../../types/ids/index.js'
@@ -242,7 +246,7 @@ function onlyReadsOutsideRoots(
  * one that needed a person is dropped would run a plan with a hole in it.
  */
 export const SANDBOX_ESCAPE_UNATTENDED_REFUSAL =
-	'Refused: a call in this batch asks to run outside the sandbox, which needs a person to confirm it each time, and nobody can be asked in this session. Nothing in this batch ran. Run the command inside the sandbox, or resend the other calls without the escape.'
+	'Refused: this call asks to run outside the sandbox, which needs a person to confirm it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Run the command inside the sandbox instead.'
 
 /**
  * What the model is told when a batch reaches a path outside the turn's roots
@@ -254,7 +258,7 @@ export const SANDBOX_ESCAPE_UNATTENDED_REFUSAL =
  * the CLI's `--add-dir`), where an operator wrote the directory down.
  */
 export const OUTSIDE_ROOTS_UNATTENDED_REFUSAL =
-	"Refused: a call in this batch reaches a path outside the working directory and the added directories, which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Stay inside the working directory, or tell the user which directory you need so they can add it to the session (the CLI's --add-dir)."
+	"Refused: this call reaches a path outside the working directory and the directories added to this session, which needs a person to approve it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Use a path inside the working directory, or tell the user which directory you need so they can start the session with it added (the CLI's --add-dir)."
 
 /**
  * What the model is told when a batch carries a call the tool itself
@@ -265,7 +269,7 @@ export const OUTSIDE_ROOTS_UNATTENDED_REFUSAL =
  * remembered grant can stand in for the person it names.
  */
 export const REQUIRES_APPROVAL_UNATTENDED_REFUSAL =
-	"Refused: a call in this batch is one the tool itself declared always needs a person's approval, and nobody can be asked in this session. Nothing in this batch ran. This cannot be granted by a rule, an automation mode, a remembered approval or a skill; run it in a session where a person can be asked."
+	"Refused: this call is one the tool itself declared always needs a person's approval, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. This cannot be granted by a rule, an automation mode, a remembered approval or a skill; run it in a session where a person can be asked."
 
 /**
  * What the model is told when a batch runs a command whose own program name
@@ -277,7 +281,7 @@ export const REQUIRES_APPROVAL_UNATTENDED_REFUSAL =
  * "unattended allow" for this.
  */
 export const UNKNOWN_PROGRAM_UNATTENDED_REFUSAL =
-	'Refused: a call in this batch runs a command whose own program name is decided at runtime (a substitution or a variable stands for it), which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Write the program name literally; compute what needs computing in the arguments instead.'
+	'Refused: this call runs a command whose own program name is decided at runtime (a substitution or a variable stands for it), which needs a person to approve it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Write the program name literally; compute what needs computing in the arguments instead.'
 
 /**
  * What the model is told when a batch writes a protected path (a git hook, a
@@ -289,7 +293,7 @@ export const UNKNOWN_PROGRAM_UNATTENDED_REFUSAL =
  * existed (a mode, a rule, "approve all") is not an answer about it.
  */
 export const PROTECTED_PATH_UNATTENDED_REFUSAL =
-	"Refused: a call in this batch writes a protected path (a git hook or config, a shell startup file, editor or tool configuration, or the project's .namzu directory), which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Leave those files alone, or tell the user what change you need so they can make it."
+	"Refused: this call writes a protected path (a git hook or config, a shell startup file, editor or tool configuration, or the project's .namzu directory), which needs a person to approve it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Leave those files alone, or tell the user what change you need so they can make it."
 
 /**
  * What the model is told when a batch removes something catastrophic (the
@@ -297,21 +301,21 @@ export const PROTECTED_PATH_UNATTENDED_REFUSAL =
  * across directories, a target a variable may empty) and nobody can be asked.
  */
 export const DANGEROUS_REMOVAL_UNATTENDED_REFUSAL =
-	'Refused: a call in this batch removes something this check treats as catastrophic (the file system root, a top-level or home directory, the working directory or a parent of it, a glob across directories, or a target a variable or substitution may leave empty), which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Name the exact directory to remove with a literal path.'
+	'Refused: this call removes something this check treats as catastrophic (the file system root, a top-level or home directory, the working directory or a parent of it, a glob across directories, or a target a variable or substitution may leave empty), which needs a person to approve it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Name the exact directory to remove with a literal path.'
 
 /**
  * What the model is told when a batch carries a call a rule or a hook asked a
  * person to approve and nobody can be asked.
  */
 export const ASK_RULE_UNATTENDED_REFUSAL =
-	'Refused: a call in this batch is one a rule or a hook says a person must approve, and nobody can be asked in this session. Nothing in this batch ran. Run it in a session where a person can be asked, or have the operator change the rule.'
+	'Refused: this call is one a rule or a hook says a person must approve, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Run it in a session where a person can be asked, or have the operator change the rule.'
 
 /**
  * What the model is told when the checks that decide whether a call reaches
  * past its boundary did not finish and nobody can be asked.
  */
 export const UNFINISHED_CHECK_UNATTENDED_REFUSAL =
-	'Refused: the safety checks on a call in this batch did not finish, so it cannot be shown to be safe, and a person has to approve it and nobody can be asked in this session. Nothing in this batch ran. Try a simpler form of the call.'
+	'Refused: the safety checks on this call did not finish, so it cannot be shown to be safe, and a person has to approve it and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Try a simpler form of the call.'
 
 /** What the model is told when the conversation is too long for the classifier to read. */
 export const CLASSIFIER_TRANSCRIPT_TOO_LONG_FEEDBACK =
@@ -534,6 +538,37 @@ export interface ScreenConsentRecord {
 	readonly sessions: Set<string>
 }
 
+/** The directory to name for a path the guard stopped: the path itself unless it looks like a file. */
+function directoryToAllow(path: string): string {
+	const last = path.split(/[\\/]/).pop() ?? ''
+	return last.includes('.') ? dirname(path) : path
+}
+
+/** The outside-the-roots refusal, naming the directory and the way to allow it. */
+export function outsideRootsRefusal(toolCalls: readonly ToolCallSummary[]): string {
+	const paths = [...new Set(toolCalls.flatMap((tc) => tc.escalation?.outsidePaths ?? []))]
+	if (paths.length === 0) return OUTSIDE_ROOTS_UNATTENDED_REFUSAL
+	const blocked = `${OUTSIDE_ROOTS_UNATTENDED_REFUSAL} Blocked: ${paths.slice(0, 3).join(', ')}.`
+	const directories = [...new Set(paths.map(directoryToAllow))]
+	// A directory that is the file system root or the home directory is too wide to
+	// suggest adding; a path directly under the root is more often a mistyped name.
+	const wide = new Set([parse(directories[0] ?? '/').root, homedir()])
+	const addable = directories.filter((d) => !wide.has(d)).slice(0, 3)
+	if (addable.length === 0) {
+		return `${blocked} It sits directly under a directory too wide to add; if the name is a typo, use a path inside the working directory or the system temp directory.`
+	}
+	return `${blocked} To allow it, the user starts the session with ${addable.map((d) => `--add-dir ${d}`).join(' ')}.`
+}
+
+/** The catastrophic-removal refusal with the one-line reason the check found. */
+export function dangerousRemovalRefusal(toolCalls: readonly ToolCallSummary[]): string {
+	const why = toolCalls.find((tc) => tc.escalation?.dangerousRemoval !== undefined)?.escalation
+		?.dangerousRemoval
+	return why === undefined
+		? DANGEROUS_REMOVAL_UNATTENDED_REFUSAL
+		: `${DANGEROUS_REMOVAL_UNATTENDED_REFUSAL} Why: ${why}.`
+}
+
 /**
  * Whether the call writes a protected path, removes something catastrophic, or
  * could not be checked.
@@ -552,7 +587,7 @@ function floorRefusal(toolCalls: readonly ToolCallSummary[]): string {
 		return PROTECTED_PATH_UNATTENDED_REFUSAL
 	}
 	return toolCalls.some((tc) => tc.escalation?.dangerousRemoval !== undefined)
-		? DANGEROUS_REMOVAL_UNATTENDED_REFUSAL
+		? dangerousRemovalRefusal(toolCalls)
 		: UNFINISHED_CHECK_UNATTENDED_REFUSAL
 }
 
@@ -589,6 +624,39 @@ function isBypassImmune(tc: ToolCallSummary): boolean {
 	)
 }
 
+/** The slice of a reviewed call {@link mustAskPerson} reads; a `ToolCallSummary` fits it. */
+export interface MustAskCall {
+	readonly escalation?: unknown
+	readonly requiresApproval?: boolean
+	readonly authorization?: { readonly explicitReview?: boolean; readonly askRule?: boolean }
+	readonly hookPermission?: { readonly decision?: string }
+}
+
+/**
+ * Whether a standing "yes" (a remembered `approve-all`, or a host's own
+ * "allow for this conversation") must not cover this call: it exists to put a
+ * question to a person.
+ *
+ * It crosses the turn's boundary in any way (a sandbox escape, a path outside
+ * the roots, a protected path, a catastrophic removal, a program nobody can
+ * name, a check that did not finish), its tool needs a yes on every call, or a
+ * rule or a hook asked for a person. `escalation` is tested as a whole rather
+ * than field by field, so a kind of escalation added later is asked about
+ * before anyone remembers to list it. A call that reaches the first look at
+ * the screen is asked about too; that is a property of the request
+ * (`ToolReviewRequest.screenConsent`), so a host adds it where it builds the
+ * ask.
+ */
+export function mustAskPerson(call: MustAskCall): boolean {
+	return (
+		call.escalation !== undefined ||
+		call.requiresApproval === true ||
+		call.authorization?.explicitReview === true ||
+		call.authorization?.askRule === true ||
+		call.hookPermission?.decision === 'ask'
+	)
+}
+
 /** The refusal for the first immune thing in a batch nobody can be asked about, or undefined. */
 function immuneRefusal(
 	toolCalls: readonly ToolCallSummary[],
@@ -601,7 +669,7 @@ function immuneRefusal(
 		return PROTECTED_PATH_UNATTENDED_REFUSAL
 	}
 	if (toolCalls.some((tc) => tc.escalation?.dangerousRemoval !== undefined)) {
-		return DANGEROUS_REMOVAL_UNATTENDED_REFUSAL
+		return dangerousRemovalRefusal(toolCalls)
 	}
 	if (toolCalls.some((tc) => tc.escalation?.unfinishedCheck !== undefined)) {
 		return UNFINISHED_CHECK_UNATTENDED_REFUSAL
@@ -994,7 +1062,20 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 		return acceptEditsAllows(tc, sessionId)
 	}
 
-	return async (request, context?: ResumeContext): Promise<HITLResumeDecision> => {
+	// Decisions that refuse one call and say so. The wrapper below splits a batch on
+	// this mark, never on the wording of the refusal.
+	const perCallRefusals = new WeakSet<object>()
+	const callRefusal = (feedback: string): HITLResumeDecision => {
+		const decision: HITLResumeDecision = { action: 'reject_tools', feedback }
+		perCallRefusals.add(decision)
+		return decision
+	}
+
+	const decide = async (
+		request: Parameters<ResumeHandler>[0],
+		context?: ResumeContext,
+		classified = false,
+	): Promise<HITLResumeDecision> => {
 		if (request.type !== 'tool_review') {
 			return request.type === 'plan_approval' ? { action: 'approve_plan' } : { action: 'continue' }
 		}
@@ -1128,7 +1209,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 			}
 			const live = request.toolCalls.filter((tc) => tc.authorization?.decision !== 'deny')
 			const escapes = live.filter((tc) => tc.escalation?.sandboxEscape === true).map((tc) => tc.id)
-			if (mode === 'classify') {
+			if (mode === 'classify' && !classified) {
 				const classifier = options.classifier as AutoReviewClassifier
 				const transcript = context?.transcript() ?? []
 				for (const tc of live) {
@@ -1180,7 +1261,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 			if (!live.some(isBypassImmune)) return { action: 'approve_tools' }
 			if (!prompt) {
 				const refusal = immuneRefusal(live, options.unattendedSandboxEscape === 'allow')
-				if (refusal !== undefined) return { action: 'reject_tools', feedback: refusal }
+				if (refusal !== undefined) return callRefusal(refusal)
 				return {
 					action: 'approve_tools',
 					...(escapes.length > 0 ? { confirmedEscalations: escapes } : {}),
@@ -1200,22 +1281,22 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 		if (escapes.length > 0) {
 			if (!prompt) {
 				if (options.unattendedSandboxEscape !== 'allow') {
-					return { action: 'reject_tools', feedback: SANDBOX_ESCAPE_UNATTENDED_REFUSAL }
+					return callRefusal(SANDBOX_ESCAPE_UNATTENDED_REFUSAL)
 				}
 				// This opt-in confirms only the sandbox escape. A different call in
 				// the batch, or another boundary on this same call, still needs a
 				// person; the early return must not approve that boundary too.
 				if (request.toolCalls.some(reachesAFloor)) {
-					return { action: 'reject_tools', feedback: floorRefusal(request.toolCalls) }
+					return callRefusal(floorRefusal(request.toolCalls))
 				}
 				if (request.toolCalls.some((tc) => (tc.escalation?.outsidePaths?.length ?? 0) > 0)) {
-					return { action: 'reject_tools', feedback: OUTSIDE_ROOTS_UNATTENDED_REFUSAL }
+					return callRefusal(outsideRootsRefusal(request.toolCalls))
 				}
 				if (request.toolCalls.some((tc) => tc.requiresApproval === true)) {
-					return { action: 'reject_tools', feedback: REQUIRES_APPROVAL_UNATTENDED_REFUSAL }
+					return callRefusal(REQUIRES_APPROVAL_UNATTENDED_REFUSAL)
 				}
 				if (request.toolCalls.some((tc) => tc.escalation?.unknownProgram !== undefined)) {
-					return { action: 'reject_tools', feedback: UNKNOWN_PROGRAM_UNATTENDED_REFUSAL }
+					return callRefusal(UNKNOWN_PROGRAM_UNATTENDED_REFUSAL)
 				}
 				return { action: 'approve_tools', confirmedEscalations: escapes }
 			}
@@ -1238,7 +1319,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 		// far: `auto` and a remembered "approve all" were answers given before
 		// the call existed. With nobody to ask it is refused, not approved.
 		if (request.toolCalls.some(reachesAFloor)) {
-			if (!prompt) return { action: 'reject_tools', feedback: floorRefusal(request.toolCalls) }
+			if (!prompt) return callRefusal(floorRefusal(request.toolCalls))
 			const answer = await ask()
 			if (answer.kind === 'reject') {
 				return {
@@ -1257,7 +1338,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 		// given about tools, before this path was named, and neither saw it.
 		// With nobody to ask it is refused, not approved.
 		if (request.toolCalls.some((tc) => (tc.escalation?.outsidePaths?.length ?? 0) > 0)) {
-			if (!prompt) return { action: 'reject_tools', feedback: OUTSIDE_ROOTS_UNATTENDED_REFUSAL }
+			if (!prompt) return callRefusal(outsideRootsRefusal(request.toolCalls))
 			const answer = await ask()
 			if (answer.kind === 'reject') {
 				return {
@@ -1278,7 +1359,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 		// declaration travels with the tool, and no rule, mode or remembered
 		// grant was ever an answer to IT specifically.
 		if (request.toolCalls.some((tc) => tc.requiresApproval === true)) {
-			if (!prompt) return { action: 'reject_tools', feedback: REQUIRES_APPROVAL_UNATTENDED_REFUSAL }
+			if (!prompt) return callRefusal(REQUIRES_APPROVAL_UNATTENDED_REFUSAL)
 			const answer = await ask()
 			if (answer.kind === 'reject') {
 				return {
@@ -1299,7 +1380,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 		// escape — an operator who wants this can only write the program
 		// name literally.
 		if (request.toolCalls.some((tc) => tc.escalation?.unknownProgram !== undefined)) {
-			if (!prompt) return { action: 'reject_tools', feedback: UNKNOWN_PROGRAM_UNATTENDED_REFUSAL }
+			if (!prompt) return callRefusal(UNKNOWN_PROGRAM_UNATTENDED_REFUSAL)
 			const answer = await ask()
 			if (answer.kind === 'reject') {
 				return {
@@ -1312,7 +1393,10 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 			if (answer.kind === 'approve-all') remembered.all = true
 			return { action: 'approve_tools' }
 		}
-		if (mode === 'auto' || !prompt || remembered.all) {
+		// A remembered "approve all" answers ordinary calls. A call a rule or a
+		// hook asked a person about exists to put its own question, which the
+		// latch was never an answer to (`mustAskPerson`): it goes on to ask.
+		if (mode === 'auto' || !prompt || (remembered.all && !request.toolCalls.some(mustAskPerson))) {
 			return { action: 'approve_tools' }
 		}
 		// Every call a person would be asked about is one a skill loaded in
@@ -1350,7 +1434,10 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 			case 'approve':
 				return { action: 'approve_tools' }
 			case 'approve-all':
-				remembered.all = true
+				// A rule's or a hook's question was put to this person once; an
+				// "approve all" to it approves it and leaves the latch as it was,
+				// as the ACP bridge does.
+				if (!request.toolCalls.some(mustAskPerson)) remembered.all = true
 				return { action: 'approve_tools' }
 			case 'reject':
 				return {
@@ -1361,6 +1448,52 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 				}
 		}
 	}
+	// With nobody to ask, a refusal that belongs to one call is that call's
+	// alone. The batch is not refused for it: each call is decided on its own,
+	// the ones that pass run, and the one that does not gets its own reason.
+	// Without this a single stray path in a parallel batch costs the turn every
+	// other call in it.
+	return async (request, context?: ResumeContext): Promise<HITLResumeDecision> => {
+		const whole = await decide(request, context)
+		if (
+			whole.action !== 'reject_tools' ||
+			prompt ||
+			request.type !== 'tool_review' ||
+			request.toolCalls.length < 2 ||
+			!perCallRefusals.has(whole)
+		) {
+			return whole
+		}
+		// The whole-batch pass has already put every call to the classifier (it
+		// refuses only after all of them were allowed), so the per-call passes do
+		// not ask it again. One at a time: no pass races another on shared state.
+		const alone: HITLResumeDecision[] = []
+		for (const tc of request.toolCalls) {
+			alone.push(await decide({ ...request, toolCalls: [tc] }, context, true))
+		}
+		const modifications: ToolModification[] = []
+		const policyRefusals: Record<string, string> = {}
+		const confirmed: string[] = []
+		for (const [i, decision] of alone.entries()) {
+			const id = (request.toolCalls[i] as ToolCallSummary).id
+			if (decision.action === 'approve_tools') {
+				modifications.push({ toolCallId: id, action: 'approve' })
+				confirmed.push(...(decision.confirmedEscalations ?? []))
+			} else if (decision.action === 'reject_tools' && !decision.endTurn && !decision.declined) {
+				modifications.push({ toolCallId: id, action: 'deny' })
+				policyRefusals[id] = decision.feedback
+			} else {
+				return whole
+			}
+		}
+		if (Object.keys(policyRefusals).length === 0) return whole
+		return {
+			action: 'modify_tools',
+			modifications,
+			policyRefusals,
+			...(confirmed.length > 0 ? { confirmedEscalations: confirmed } : {}),
+		}
+	}
 }
 
 /**

package/src/runtime/query/turn/completion-audit.ts

@@ -0,0 +1,71 @@
+/**
+ * The completion audit: before a turn that edited files is allowed to end,
+ * check from the turn's own record whether anything was run to check the
+ * edits. It judges what happened, not what the model says happened.
+ *
+ * It blocks at most once per turn. After the one reminder the turn may end
+ * however it likes, so the audit can never trap a run.
+ */
+
+/** Tools that write to the project regardless of their input. */
+const WRITING_TOOLS = new Set(['edit', 'write', 'apply_patch', 'notebook_edit'])
+
+/**
+ * A command that checks work: a project runner invoked with a test, lint,
+ * typecheck, format-check or build target, or a checker invoked directly.
+ */
+const RUNNER =
+	/\b(?:npm|pnpm|yarn|bun|npx|make|cargo|go|dotnet|gradle|gradlew|mvn|deno|just|task|uv|poetry|tox|nox|rake|bundle)\b[^|;&\n]*\b(?:test|tests|lint|check|typecheck|type-check|verify|build|vet|clippy|fmt)\b/i
+const DIRECT =
+	/(?:^|[\s;&|(])(?:vitest|jest|pytest|mocha|tsc|eslint|biome|prettier|ruff|mypy|pyright|flake8|golangci-lint|rubocop|phpunit|node\s+--test)(?=$|[\s;&|)])/i
+
+/** Whether a shell command is one that checks work. */
+export function isVerificationCommand(command: string): boolean {
+	return RUNNER.test(command) || DIRECT.test(command)
+}
+
+/** Said to the model once, when it tries to end a turn that changed files and checked nothing. */
+export const COMPLETION_AUDIT_MESSAGE =
+	"Files were changed in this turn and nothing was run afterwards to check them. Before you finish: rerun the reproduction of the defect, if there was one; run the project's tests and its lint or format check; confirm the diff holds only what was asked; name any throwaway file you made. Then give your answer, stating what you ran and what you did not run. If a check cannot be run here, say which and why."
+
+/** A finished tool call as the audit sees it. */
+export interface AuditedCall {
+	readonly toolName: string
+	/** The call's parsed input, when it had one. */
+	readonly input?: unknown
+	readonly isError?: boolean
+}
+
+export class CompletionAudit {
+	private edited = false
+	private checkedSinceEdit = false
+	private blocked = false
+
+	/** Feed the calls of one finished step, in order. */
+	observe(calls: readonly AuditedCall[]): void {
+		for (const call of calls) {
+			if (call.isError) continue
+			if (WRITING_TOOLS.has(call.toolName)) {
+				this.edited = true
+				this.checkedSinceEdit = false
+				continue
+			}
+			if (call.toolName === 'bash' && this.edited) {
+				const command = (call.input as { command?: unknown } | undefined)?.command
+				if (typeof command === 'string' && isVerificationCommand(command)) {
+					this.checkedSinceEdit = true
+				}
+			}
+		}
+	}
+
+	/**
+	 * Whether the turn must be held back from ending. True at most once: asking
+	 * records the block.
+	 */
+	takeBlock(): boolean {
+		if (this.blocked || !this.edited || this.checkedSinceEdit) return false
+		this.blocked = true
+		return true
+	}
+}