@oh-my-pi/pi-agent-core 17.0.9 → 17.1.1

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 ## [Unreleased]
 
+## [17.1.1] - 2026-07-24
+
+### Added
+
+- Added the provider-neutral native computer-call lifecycle, preserving observation outputs and input actions across pending and acknowledged tool results.
+
+### Changed
+
+- Queued steering no longer hard-aborts non-interruptible tools (e.g. `bash`): it aborts interruptible waits only and raises a cooperative steering signal (`ToolCallContext.steeringSignal`) that long-running tools may observe to finish early or background themselves. The mid-batch steering/IRC watch now runs for every tool batch instead of only batches containing an interruptible tool.
+
+## [17.1.0] - 2026-07-24
+
+### Added
+
+- Added support for tracking Cloudflare AI Gateway cache status (hit, miss, bypass, unknown) on chat spans.
+
+### Changed
+
+- Improved tool execution steering behavior: queued steering now cooperatively signals long-running, non-interruptible tools (via ToolCallContext.steeringSignal) to allow graceful early termination or backgrounding, rather than hard-aborting them.
+
+### Fixed
+
+- Fixed an out-of-memory (OOM) crash caused by an infinite loop when a steer or follow-up message was queued on an agent session with an empty transcript.
+- Fixed an issue where switching providers or models on a session could lose compacted history; the agent now correctly falls back to a portable local summary if the new model cannot replay the prior provider's remote-compaction payload.
+- Fixed a compaction failure with Anthropic models where serializing prior assistant reasoning inside <thinking> tags triggered reasoning_extraction refusals.
+
 ## [17.0.8] - 2026-07-22
 
 ### Fixed

package/dist/types/compaction/compaction.d.ts

@@ -280,7 +280,7 @@ export interface CompactionPreparation {
     /** Compaction settions from settings.jsonl	*/
     settings: CompactionSettings;
 }
-export declare function prepareCompaction(pathEntries: SessionEntry[], settings: CompactionSettings, compactionModels?: readonly Model[]): CompactionPreparation | undefined;
+export declare function prepareCompaction(pathEntries: SessionEntry[], settings: CompactionSettings, activeModel?: Model): CompactionPreparation | undefined;
 /**
  * Generate summaries for compaction using prepared data.
  * Returns CompactionResult - SessionManager adds id/parentId when saving.

package/dist/types/telemetry.d.ts

@@ -104,7 +104,9 @@ export declare const enum PiGenAIAttr {
     GatewayName = "pi.gen_ai.gateway.name",
     GatewayEndpoint = "pi.gen_ai.gateway.endpoint",
     GatewayCallId = "pi.gen_ai.gateway.call_id",
-    GatewayRoutedTo = "pi.gen_ai.gateway.routed_to"
+    GatewayRoutedTo = "pi.gen_ai.gateway.routed_to",
+    /** Cloudflare AI Gateway response-cache status (`cf-aig-cache-status`), never prompt-cache. */
+    GatewayResponseCacheStatus = "pi.gen_ai.gateway.response_cache.status"
 }
 /** GenAI operation names — values for {@link GenAIAttr.OperationName}. */
 export declare const GenAIOperation: {
@@ -413,6 +415,22 @@ export interface GatewayHeaderDetection {
  * {@link ProviderResponseMetadata.headers} produces.
  */
 export declare function detectGatewayFromHeaders(headers: Readonly<Record<string, string>> | undefined): GatewayHeaderDetection | undefined;
+/**
+ * Bounded Cloudflare AI Gateway response-cache statuses emitted on
+ * {@link PiGenAIAttr.GatewayResponseCacheStatus}. Distinct from provider
+ * prompt-cache token counters (`gen_ai.usage.cache_*`).
+ *
+ * Cloudflare documents `HIT` / `MISS` on `cf-aig-cache-status`; `bypass` covers
+ * skip-cache / CDN-aligned BYPASS values. Any other present value is `unknown`.
+ */
+export type GatewayResponseCacheStatus = "hit" | "miss" | "bypass" | "unknown";
+/**
+ * Classify Cloudflare AI Gateway `cf-aig-cache-status` into a bounded
+ * response-cache status. Returns `undefined` when the allow-listed header is
+ * absent so non-Cloudflare traffic stays unaffected. Does not read TTL,
+ * skip-cache, custom-key, or other Cloudflare headers.
+ */
+export declare function classifyGatewayResponseCacheStatus(headers: Readonly<Record<string, string>> | undefined): GatewayResponseCacheStatus | undefined;
 export interface ManualChatToolCallTelemetry {
     readonly toolCallId: string;
     readonly toolName: string;

package/dist/types/types.d.ts

@@ -1,4 +1,4 @@
-import type { ApiKey, AssistantMessage, AssistantMessageEvent, AssistantMessageEventStream, Context, Effort, ImageContent, Message, Model, ServiceTier, SimpleStreamOptions, Static, streamSimple, TextContent, Tool, ToolChoice, ToolResultMessage, TSchema } from "@oh-my-pi/pi-ai";
+import type { ApiKey, AssistantMessage, AssistantMessageEvent, AssistantMessageEventStream, Context, Effort, ImageContent, Message, Model, ServiceTier, SimpleStreamOptions, Static, streamSimple, TextContent, Tool, ToolCallProviderMetadata, ToolChoice, ToolResultMessage, ToolResultProviderMetadata, TSchema } from "@oh-my-pi/pi-ai";
 import type { Dialect } from "@oh-my-pi/pi-ai/dialect";
 import type { HarmonyAuditEvent } from "@oh-my-pi/pi-ai/utils/harmony-leak";
 import type { AppendOnlyContextManager } from "./append-only-context.js";
@@ -399,6 +399,17 @@ export interface ToolCallContext {
         id: string;
         name: string;
     }>;
+    /** Provider-native metadata for the current call, when present. */
+    providerMetadata?: ToolCallProviderMetadata;
+    /**
+     * Cooperative steering signal: aborted when a queued user/steering message
+     * (or an interrupting peer IRC) is detected while this tool batch runs.
+     * Unlike the hard abort signal it NEVER kills the tool — long-running
+     * tools MAY observe it (via `ctx.toolCall.steeringSignal`) to finish early
+     * or background themselves so the message injects promptly; ignoring it is
+     * always safe (the message injects at the next batch boundary).
+     */
+    steeringSignal?: AbortSignal;
 }
 /** A single tool-call content block emitted by an assistant message. */
 export type AgentToolCall = Extract<AssistantMessage["content"][number], {
@@ -428,6 +439,8 @@ export interface AfterToolCallResult {
     content?: (TextContent | ImageContent)[];
     /** If provided, replaces the tool result details payload in full. */
     details?: unknown;
+    /** If provided, replaces the provider-native result metadata in full. */
+    providerMetadata?: ToolResultProviderMetadata;
     /** If provided, replaces the error flag carried with the tool result. */
     isError?: boolean;
     /** If provided, replaces the contextually-useless flag carried with the tool result. */
@@ -503,6 +516,8 @@ export interface AgentToolResult<T = any, _TInput = unknown> {
     content: (TextContent | ImageContent)[];
     details?: T;
     isError?: boolean;
+    /** Provider-native metadata that must survive into history replay unchanged. */
+    providerMetadata?: ToolResultProviderMetadata;
     /** Marks the result as contextually useless: safe for compaction to elide once consumed (e.g. zero matches, wait timeout). Ignored when isError is set. */
     useless?: boolean;
 }
@@ -533,6 +548,7 @@ export type ToolLoadMode = "essential" | "discoverable";
  * - bare tier ("read" / "write" / "exec") — static classification.
  * - object form — adds a `reason` (shown in the prompt) and/or `override: true`
  *   (force-prompt even in modes that would otherwise auto-approve this tier).
+ *   `policy: "deny"` blocks the call at the approval gate.
  * - function — dynamic, given parsed args. Returns either form above.
  *
  * Omitted approvals are treated as "exec" by callers that enforce approvals.
@@ -541,6 +557,7 @@ export type ToolApprovalDecision = ToolTier | {
     tier: ToolTier;
     reason?: string;
     override?: boolean;
+    policy?: "allow" | "deny" | "prompt";
 };
 export type ToolApproval = ToolApprovalDecision | ((args: unknown) => ToolApprovalDecision);
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-agent-core",
-	"version": "17.0.9",
+	"version": "17.1.1",
 	"description": "General-purpose agent with transport abstraction, state management, and attachment support",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -35,12 +35,12 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@oh-my-pi/pi-ai": "17.0.9",
-		"@oh-my-pi/pi-catalog": "17.0.9",
-		"@oh-my-pi/pi-natives": "17.0.9",
-		"@oh-my-pi/pi-utils": "17.0.9",
-		"@oh-my-pi/pi-wire": "17.0.9",
-		"@oh-my-pi/snapcompact": "17.0.9",
+		"@oh-my-pi/pi-ai": "17.1.1",
+		"@oh-my-pi/pi-catalog": "17.1.1",
+		"@oh-my-pi/pi-natives": "17.1.1",
+		"@oh-my-pi/pi-utils": "17.1.1",
+		"@oh-my-pi/pi-wire": "17.1.1",
+		"@oh-my-pi/snapcompact": "17.1.1",
 		"@opentelemetry/api": "^1.9.1"
 	},
 	"devDependencies": {

package/src/agent-loop.ts

@@ -5,6 +5,8 @@
 import {
 	type AssistantMessage,
 	type AssistantMessageEvent,
+	type ComputerAction,
+	type ComputerSafetyCheck,
 	type Context,
 	EventStream,
 	isApiKeyResolver,
@@ -12,8 +14,10 @@ import {
 	seedApiKeyResolver,
 	streamSimple,
 	stripSchemaDescriptions,
+	type ToolCallProviderMetadata,
 	type ToolChoice,
 	type ToolResultMessage,
+	type ToolResultProviderMetadata,
 	type TSchema,
 	toolWireSchema,
 	validateToolArguments,
@@ -106,6 +110,7 @@ const MAX_SOFT_TOOL_ESCALATIONS = 3;
 function hardToolChoiceBlocks(choice: ToolChoice | undefined, requiredTool: string): boolean {
 	if (choice === undefined) return false;
 	if (typeof choice === "string") return choice === "none";
+	if (choice.type === "computer") return requiredTool !== "computer";
 	const name = choice.type === "tool" ? choice.name : "function" in choice ? choice.function.name : choice.name;
 	return name !== requiredTool;
 }
@@ -180,6 +185,160 @@ export function resolveOwnedDialectFromEnv(value: string | undefined): Dialect |
 type AssistantContentBlock = AssistantMessage["content"][number];
 type AssistantToolCallBlock = Extract<AssistantContentBlock, { type: "toolCall" }>;
 
+function snapshotComputerSafetyChecks(value: unknown): ComputerSafetyCheck[] | undefined {
+	if (!Array.isArray(value)) return undefined;
+	const checks: ComputerSafetyCheck[] = [];
+	for (const raw of value) {
+		if (!raw || typeof raw !== "object" || Array.isArray(raw)) return undefined;
+		const check = raw as Record<string, unknown>;
+		if (typeof check.id !== "string" || check.id.length === 0) return undefined;
+		if (check.code !== undefined && check.code !== null && typeof check.code !== "string") return undefined;
+		if (check.message !== undefined && check.message !== null && typeof check.message !== "string") return undefined;
+		checks.push({
+			id: check.id,
+			...(check.code !== undefined ? { code: check.code as string | null } : {}),
+			...(check.message !== undefined ? { message: check.message as string | null } : {}),
+		});
+	}
+	return checks;
+}
+
+function isFiniteCoordinate(value: unknown): value is number {
+	return typeof value === "number" && Number.isFinite(value);
+}
+
+function hasValidComputerKeys(value: unknown, optional: boolean): boolean {
+	return (
+		(optional && value === undefined) ||
+		value === null ||
+		(Array.isArray(value) && value.every(key => typeof key === "string"))
+	);
+}
+
+function snapshotComputerAction(value: unknown): ComputerAction | undefined {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+	const action = value as Record<string, unknown>;
+	switch (action.type) {
+		case "click":
+			if (
+				!(["left", "right", "wheel", "back", "forward"] as unknown[]).includes(action.button) ||
+				!isFiniteCoordinate(action.x) ||
+				!isFiniteCoordinate(action.y) ||
+				!hasValidComputerKeys(action.keys, true)
+			)
+				return undefined;
+			break;
+		case "double_click":
+			if (
+				!isFiniteCoordinate(action.x) ||
+				!isFiniteCoordinate(action.y) ||
+				!hasValidComputerKeys(action.keys, false)
+			)
+				return undefined;
+			break;
+		case "drag":
+			if (
+				!Array.isArray(action.path) ||
+				!action.path.every(
+					point =>
+						point &&
+						typeof point === "object" &&
+						isFiniteCoordinate((point as Record<string, unknown>).x) &&
+						isFiniteCoordinate((point as Record<string, unknown>).y),
+				) ||
+				!hasValidComputerKeys(action.keys, true)
+			)
+				return undefined;
+			break;
+		case "keypress":
+			if (!Array.isArray(action.keys) || !action.keys.every(key => typeof key === "string")) return undefined;
+			break;
+		case "move":
+			if (!isFiniteCoordinate(action.x) || !isFiniteCoordinate(action.y) || !hasValidComputerKeys(action.keys, true))
+				return undefined;
+			break;
+		case "screenshot":
+		case "wait":
+			break;
+		case "scroll":
+			if (
+				!isFiniteCoordinate(action.x) ||
+				!isFiniteCoordinate(action.y) ||
+				!isFiniteCoordinate(action.scroll_x) ||
+				!isFiniteCoordinate(action.scroll_y) ||
+				!hasValidComputerKeys(action.keys, true)
+			)
+				return undefined;
+			break;
+		case "type":
+			if (typeof action.text !== "string") return undefined;
+			break;
+		default:
+			return undefined;
+	}
+	return structuredCloneJSON(action) as ComputerAction;
+}
+
+function snapshotToolCallProviderMetadata(value: unknown): ToolCallProviderMetadata | undefined {
+	if (value === undefined) return undefined;
+	if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+	const metadata = value as Record<string, unknown>;
+	if (
+		metadata.type !== "computer" ||
+		typeof metadata.providerItemId !== "string" ||
+		metadata.providerItemId.length === 0
+	)
+		return undefined;
+	if (!Array.isArray(metadata.actions) || metadata.actions.length === 0) return undefined;
+	const actions = metadata.actions.map(snapshotComputerAction);
+	if (actions.some(action => action === undefined)) return undefined;
+	const pendingSafetyChecks = snapshotComputerSafetyChecks(metadata.pendingSafetyChecks);
+	if (!pendingSafetyChecks) return undefined;
+	return {
+		type: "computer",
+		providerItemId: metadata.providerItemId,
+		actions: actions as ComputerAction[],
+		pendingSafetyChecks,
+	};
+}
+
+function snapshotToolResultProviderMetadata(value: unknown): {
+	metadata?: ToolResultProviderMetadata;
+	malformed: boolean;
+} {
+	if (value === undefined) return { malformed: false };
+	if (!value || typeof value !== "object" || Array.isArray(value)) return { malformed: true };
+	const metadata = value as Record<string, unknown>;
+	if (
+		metadata.type !== "computer" ||
+		!metadata.screenshot ||
+		typeof metadata.screenshot !== "object" ||
+		Array.isArray(metadata.screenshot)
+	) {
+		return { malformed: true };
+	}
+	const screenshot = metadata.screenshot as Record<string, unknown>;
+	const hasImageUrl = Object.hasOwn(screenshot, "image_url");
+	const hasFileId = Object.hasOwn(screenshot, "file_id");
+	if (screenshot.type !== "computer_screenshot" || hasImageUrl === hasFileId) return { malformed: true };
+	if (hasImageUrl && (typeof screenshot.image_url !== "string" || screenshot.image_url.length === 0))
+		return { malformed: true };
+	if (hasFileId && (typeof screenshot.file_id !== "string" || screenshot.file_id.length === 0))
+		return { malformed: true };
+	const acknowledgedSafetyChecks = snapshotComputerSafetyChecks(metadata.acknowledgedSafetyChecks);
+	if (!acknowledgedSafetyChecks) return { malformed: true };
+	return {
+		malformed: false,
+		metadata: {
+			type: "computer",
+			screenshot: hasImageUrl
+				? { type: "computer_screenshot", image_url: screenshot.image_url as string }
+				: { type: "computer_screenshot", file_id: screenshot.file_id as string },
+			acknowledgedSafetyChecks,
+		},
+	};
+}
+
 function snapshotAssistantContentBlock(block: AssistantContentBlock): AssistantContentBlock {
 	switch (block.type) {
 		case "text":
@@ -192,7 +351,11 @@ function snapshotAssistantContentBlock(block: AssistantContentBlock): AssistantC
 		case "fallback":
 			return { ...block, from: { ...block.from }, to: { ...block.to } };
 		case "toolCall":
-			return { ...block, arguments: structuredCloneJSON(block.arguments) };
+			return {
+				...block,
+				arguments: structuredCloneJSON(block.arguments),
+				providerMetadata: snapshotToolCallProviderMetadata(block.providerMetadata),
+			};
 	}
 }
 
@@ -268,6 +431,10 @@ function coerceToolResult(raw: unknown): { result: AgentToolResult<unknown>; mal
 	const rawObj = raw && typeof raw === "object" ? (raw as Record<string, unknown>) : null;
 	const rawContent = rawObj?.content;
 	const details = rawObj && "details" in rawObj ? rawObj.details : {};
+	const providerMetadataResult = snapshotToolResultProviderMetadata(
+		rawObj && "providerMetadata" in rawObj ? rawObj.providerMetadata : undefined,
+	);
+	const providerMetadata = providerMetadataResult.metadata;
 	// Tools may flag a non-throwing failure on the result itself (e.g. an
 	// aggregator that catches per-entry errors and synthesizes a combined
 	// result). Preserve the flag so agent-loop can surface it on the wire.
@@ -312,7 +479,13 @@ function coerceToolResult(raw: unknown): { result: AgentToolResult<unknown>; mal
 			text: `Tool returned an invalid result: ${invalidBlocks} content block${invalidBlocks === 1 ? "" : "s"} had an unsupported shape.`,
 		});
 	}
-	const isError = explicitError || invalidBlocks > 0;
+	if (providerMetadataResult.malformed) {
+		content.push({
+			type: "text",
+			text: "Tool returned an invalid result: computer providerMetadata had an unsupported shape.",
+		});
+	}
+	const isError = explicitError || invalidBlocks > 0 || providerMetadataResult.malformed;
 	// Anthropic rejects tool_result blocks with is_error: true and empty content.
 	if (isError && !hasSubstantiveToolResultContent(content)) {
 		content.length = 0;
@@ -322,10 +495,11 @@ function coerceToolResult(raw: unknown): { result: AgentToolResult<unknown>; mal
 		result: {
 			content,
 			details,
+			providerMetadata,
 			...(isError ? { isError: true } : {}),
 			...(useless && !isError ? { useless: true } : {}),
 		},
-		malformed: invalidBlocks > 0,
+		malformed: invalidBlocks > 0 || providerMetadataResult.malformed,
 	};
 }
 
@@ -1817,13 +1991,18 @@ async function executeToolCalls(
 	const shouldInterruptImmediately = interruptMode !== "wait";
 	const steeringAbortController = new AbortController();
 	const ircAbortController = new AbortController();
-	// Interruptible tools observe steering + external + IRC aborts; every other
-	// tool only sees steering + external, so an IRC-only interrupt never kills a
-	// partially side-effecting foreground tool (e.g. `bash`) running alongside a
-	// pure wait (e.g. `job` poll).
-	const nonInterruptibleSignal: AbortSignal = signal
-		? AbortSignal.any([signal, steeringAbortController.signal])
-		: steeringAbortController.signal;
+	// Cooperative channel: aborted when queued steering (or an interrupting
+	// peer IRC) is detected mid-batch. Tools receive it via tool context
+	// (`ctx.steeringSignal`) and MAY react — e.g. an auto-backgroundable bash
+	// backgrounds itself so the message injects promptly — but it never kills
+	// anything; ignoring it is always safe.
+	const steeringSoftController = new AbortController();
+	// Interruptible tools (pure waits: hub wait, vibe) observe steering +
+	// external + IRC aborts. Every other tool sees ONLY the external signal:
+	// neither queued steering nor a peer IRC ever hard-kills a partially
+	// side-effecting foreground tool (e.g. `bash`) — those get the cooperative
+	// steeringSignal above, and the message injects at the next boundary.
+	const nonInterruptibleSignal: AbortSignal = signal ?? new AbortController().signal;
 	const interruptibleSignal: AbortSignal = signal
 		? AbortSignal.any([signal, steeringAbortController.signal, ircAbortController.signal])
 		: AbortSignal.any([steeringAbortController.signal, ircAbortController.signal]);
@@ -1889,13 +2068,16 @@ async function executeToolCalls(
 			}
 		}
 		if (steeringQueued) {
-			// Queued steering upgrades an in-flight IRC interrupt: it aborts the
-			// shared signal so foreground tools stop as they do for a user Esc.
+			// Queued steering hard-aborts only interruptible waits and raises the
+			// cooperative soft signal for everything else: the boundary dequeue
+			// below injects the message as soon as running tools finish (or
+			// background themselves), and not-yet-started tools are skipped.
 			// Idempotent — a second steer poll after the abort is a no-op.
 			if (!steeringAbortController.signal.aborted) {
 				interruptState.triggered = true;
 				interruptState.source = steeringSource ?? "unknown";
 				steeringAbortController.abort();
+				steeringSoftController.abort();
 			}
 			return;
 		}
@@ -1903,11 +2085,13 @@ async function executeToolCalls(
 		// must not re-abort, and (unlike steering above) never re-consume a queue.
 		if (interruptState.triggered) return;
 		if (hasIrcInterrupts && (await hasIrcInterrupts())) {
-			// Peer IRC only aborts interruptible waits: a foreground bash / write
-			// mid-execution keeps running so we never leave partial side effects.
+			// Peer IRC hard-aborts interruptible waits only; foreground tools keep
+			// running (no partial side effects) but get the cooperative soft
+			// signal so backgroundable work can step aside for the peer message.
 			interruptState.triggered = true;
 			interruptState.source = "irc";
 			ircAbortController.abort();
+			steeringSoftController.abort();
 		}
 	};
 
@@ -1937,6 +2121,7 @@ async function executeToolCalls(
 			toolName: toolCall.name,
 			content: result.content,
 			details: result.details,
+			providerMetadata: result.providerMetadata,
 			isError,
 			...(result.useless && !isError ? { useless: true } : {}),
 			timestamp: Date.now(),
@@ -2090,12 +2275,18 @@ async function executeToolCalls(
 					: effectiveArgs;
 				record.args = executionArgs;
 
+				// The cooperative steering signal rides the loop-owned
+				// ToolCallContext (surfacing as `ctx.toolCall.steeringSignal`):
+				// AgentToolContext itself is app-built via declaration merging, so
+				// the loop cannot construct or extend one structurally.
 				const toolContext = getToolContext
 					? getToolContext({
 							batchId,
 							index,
 							total: toolCalls.length,
 							toolCalls: toolCallInfos,
+							steeringSignal: steeringSoftController.signal,
+							providerMetadata: toolCall.providerMetadata,
 						})
 					: undefined;
 				const rawResult = await tool.execute(
@@ -2148,6 +2339,7 @@ async function executeToolCalls(
 							content: after.content ?? result.content,
 							details: after.details ?? result.details,
 							isError: after.isError ?? result.isError,
+							providerMetadata: after.providerMetadata ?? result.providerMetadata,
 							useless: after.useless ?? result.useless,
 						});
 						result = coerced.result;
@@ -2237,16 +2429,14 @@ async function executeToolCalls(
 		}
 	}
 
-	// While an interruptible tool call is in flight (e.g. a `hub` wait blocking
-	// on external work), queued steering or interrupting IRC would otherwise
-	// wait out the tool's own window. Poll only non-consuming queues and abort
-	// the shared tool signal so the boundary dequeue below injects the message
-	// promptly. Gated on immediate-interrupt mode + an interruptible call;
-	// checkSteering is idempotent (no-op once triggered).
+	// While tool calls are in flight, queued steering or interrupting IRC would
+	// otherwise wait out the tools' own window. Poll only non-consuming queues:
+	// detection hard-aborts interruptible waits, soft-signals cooperative tools
+	// (auto-background bash), and skips not-yet-started tools, so the boundary
+	// dequeue below injects the message promptly. Gated on immediate-interrupt
+	// mode; checkSteering is idempotent (no-op once triggered).
 	const watchSteeringWhileRunning =
-		shouldInterruptImmediately &&
-		(hasSteeringMessages !== undefined || hasIrcInterrupts !== undefined) &&
-		records.some(record => record.interruptible);
+		shouldInterruptImmediately && (hasSteeringMessages !== undefined || hasIrcInterrupts !== undefined);
 	const steeringWatchTimer = watchSteeringWhileRunning
 		? setInterval(() => void checkSteering(), STEERING_INTERRUPT_POLL_MS)
 		: undefined;

package/src/agent.ts

@@ -72,6 +72,9 @@ function refreshToolChoiceForActiveTools(
 	if (!toolChoice || typeof toolChoice === "string") {
 		return toolChoice;
 	}
+	if (toolChoice.type === "computer") {
+		return tools.some(tool => tool.native?.type === "computer") ? toolChoice : undefined;
+	}
 
 	const toolName =
 		toolChoice.type === "tool"
@@ -1047,6 +1050,22 @@ export class Agent {
 
 		const messages = this.#state.messages;
 		if (messages.length === 0) {
+			// An empty transcript has nothing to resume, but a queued steer/follow-up
+			// must still be delivered as the opening turn — mirroring the assistant-tail
+			// branch below. Throwing here leaves the message undeliverable, and idle-drain
+			// callers (AgentSession#scheduleQueuedMessageDrain) re-arm continue() on every
+			// microtask because hasQueuedMessages() never clears, spinning an unbounded
+			// allocation loop until OOM (issue #6344).
+			const queuedSteering = this.#dequeueSteeringMessages();
+			if (queuedSteering.length > 0) {
+				await this.#runLoop(queuedSteering, { skipInitialSteeringPoll: true });
+				return;
+			}
+			const queuedFollowUp = this.#dequeueFollowUpMessages();
+			if (queuedFollowUp.length > 0) {
+				await this.#runLoop(queuedFollowUp);
+				return;
+			}
 			throw new Error("No messages to continue from");
 		}
 		if (messages[messages.length - 1].role === "assistant") {

package/src/compaction/compaction.ts

@@ -1130,33 +1130,37 @@ export interface CompactionPreparation {
 }
 
 /**
- * Whether a prior compaction's preserve data can be carried forward by the
- * upcoming compaction. A local compaction (no remote preserve) always can — it
- * holds a real textual summary. A remote compaction (V2 or V1) only can when
- * some candidate model shares its provider AND remote replay is still enabled;
- * otherwise its provider-native replay is dead weight and only the opaque
- * placeholder summary survives, so the caller must re-expand the originals.
+ * Whether a prior remote compaction's provider-native replay can still be read
+ * by the active model — the model that assembles the request context on every
+ * turn. A local compaction (no remote preserve) always can: it holds a real
+ * textual summary. A remote compaction (V2 or V1) only can when the active model
+ * shares the blob's provider AND remote replay is still enabled; otherwise the
+ * active model's encoder drops the payload (see `getOpenAIResponsesHistoryPayload`)
+ * and only the opaque placeholder summary survives, so the caller must re-expand
+ * the originals into a portable local summary rather than strand that history.
+ *
+ * Judged against the ACTIVE model, not the compaction candidate set: a role
+ * model (e.g. `modelRoles.smol`) that still maps to the blob's provider does not
+ * let the active model replay it, so keying reuse on "any candidate shares the
+ * provider" left a provider-switched session permanently context-less (#6343).
  */
-function remotePreserveReusableByAny(
+function remotePreserveReusable(
 	preserveData: Record<string, unknown> | undefined,
-	models: readonly Model[],
+	activeModel: Model,
 	settings: CompactionSettings,
 ): boolean {
 	const remote = getCompactionV2PreserveData(preserveData) ?? getPreservedOpenAiRemoteCompactionData(preserveData);
 	if (!remote) return true;
 	if (settings.remoteEnabled === false) return false;
-	for (const model of models) {
-		if (remote.provider !== model.provider) continue;
-		const v2Ok = settings.remoteStreamingV2Enabled !== false && shouldUseCompactionV2Streaming(model);
-		if (v2Ok || shouldUseOpenAiRemoteCompaction(model)) return true;
-	}
-	return false;
+	if (remote.provider !== activeModel.provider) return false;
+	const v2Ok = settings.remoteStreamingV2Enabled !== false && shouldUseCompactionV2Streaming(activeModel);
+	return v2Ok || shouldUseOpenAiRemoteCompaction(activeModel);
 }
 
 export function prepareCompaction(
 	pathEntries: SessionEntry[],
 	settings: CompactionSettings,
-	compactionModels: readonly Model[] = [],
+	activeModel?: Model,
 ): CompactionPreparation | undefined {
 	if (pathEntries.length > 0 && pathEntries[pathEntries.length - 1].type === "compaction") {
 		return undefined;
@@ -1165,13 +1169,13 @@ export function prepareCompaction(
 	let prevCompactionIndex = -1;
 	for (let i = pathEntries.length - 1; i >= 0; i--) {
 		if (pathEntries[i].type !== "compaction") continue;
-		// Skip a prior remote compaction (V2 or V1) whose provider-native replay
-		// none of the upcoming compaction candidates can reuse: its summary is only
-		// an opaque placeholder, so re-expand its original messages and summarize
-		// them locally rather than stranding that history. compact() still reuses it
-		// when a candidate can (same provider, remote enabled).
+		// Skip a prior remote compaction (V2 or V1) whose provider-native replay the
+		// active model cannot read: its summary is only an opaque placeholder, so
+		// re-expand its original messages and summarize them locally rather than
+		// stranding that history. compact() still reuses the payload when the active
+		// model can replay it (same provider, remote enabled).
 		const entry = pathEntries[i] as CompactionEntry;
-		if (compactionModels.length > 0 && !remotePreserveReusableByAny(entry.preserveData, compactionModels, settings)) {
+		if (activeModel && !remotePreserveReusable(entry.preserveData, activeModel, settings)) {
 			continue;
 		}
 		prevCompactionIndex = i;
@@ -1502,7 +1506,7 @@ export async function compact(
 		// summarization so a successful remote compaction never pays for a second,
 		// redundant LLM round. If a LATER compaction cannot reuse this payload,
 		// prepareCompaction re-expands the original messages and summarizes them
-		// locally then (see remotePreserveReusableByAny).
+		// locally then (see remotePreserveReusable).
 		const usedTokens = getCompactionV2PreserveData(preserveData)?.usedTokens ?? 0;
 		summary =
 			"Remote compaction preserved provider-native history for this session." +

package/src/compaction/openai.ts

@@ -20,6 +20,7 @@ import { applyCodexResponsesLiteShape } from "@oh-my-pi/pi-ai/providers/openai-c
 import {
 	createOpenAICodexCompactionRequestContext,
 	createOpenAICodexCompatibilityMetadata,
+	getCodexAttestationHeader,
 } from "@oh-my-pi/pi-ai/providers/openai-codex-responses";
 import { parseAzureDeploymentNameMap, parseTextSignature } from "@oh-my-pi/pi-ai/providers/openai-shared";
 import { transformMessages } from "@oh-my-pi/pi-ai/providers/transform-messages";
@@ -43,7 +44,7 @@ import {
 	OPENAI_HEADER_VALUES,
 	OPENAI_HEADERS,
 } from "@oh-my-pi/pi-catalog/wire/codex";
-import { $env, logger, stringifyJson } from "@oh-my-pi/pi-utils";
+import { $env, logger, stringifyJson, structuredCloneJSON } from "@oh-my-pi/pi-utils";
 
 export * from "./compaction-v2-streaming";
 
@@ -254,6 +255,7 @@ function addOpenAiCallIds(
 	items: Array<Record<string, unknown>>,
 	knownCallIds: Set<string>,
 	customCallIds: Set<string>,
+	computerCallIds: Set<string>,
 ): void {
 	for (const item of items) {
 		if (typeof item.call_id !== "string") continue;
@@ -262,10 +264,57 @@ function addOpenAiCallIds(
 		} else if (item.type === "custom_tool_call") {
 			knownCallIds.add(item.call_id);
 			customCallIds.add(item.call_id);
+		} else if (item.type === "computer_call") {
+			knownCallIds.add(item.call_id);
+			computerCallIds.add(item.call_id);
 		}
 	}
 }
 
+function computerHistoryNote(item: Record<string, unknown>): Record<string, unknown> {
+	const serialized = stringifyJson(item) ?? "";
+	return {
+		type: "message",
+		id: `msg_${Bun.hash(`computer-history:${serialized}`).toString(36)}`,
+		role: "assistant",
+		content: [
+			{
+				type: "output_text",
+				text: `[Previous computer history unavailable to this model]: ${serialized}`,
+				annotations: [],
+			},
+		],
+		status: "completed",
+	};
+}
+
+function adaptComputerHistoryForCompaction(
+	items: Array<Record<string, unknown>>,
+	supportsComputerUse: boolean,
+): Array<Record<string, unknown>> {
+	if (supportsComputerUse) return items;
+	return items.map(item =>
+		item.type === "computer_call" || item.type === "computer_call_output" ? computerHistoryNote(item) : item,
+	);
+}
+
+function computerFailureNote(call: Record<string, unknown>, output: string): Record<string, unknown> {
+	const serialized = stringifyJson(call) ?? "";
+	return {
+		type: "message",
+		id: `msg_${Bun.hash(`computer-failure:${serialized}:${output}`).toString(36)}`,
+		role: "assistant",
+		content: [
+			{
+				type: "output_text",
+				text: `[Computer call failed before a screenshot was recorded]: ${serialized}${output ? `\n${output}` : ""}`,
+				annotations: [],
+			},
+		],
+		status: "completed",
+	};
+}
+
 // ============================================================================
 // Native history construction (responses-API shape)
 // ============================================================================
@@ -287,20 +336,32 @@ export function buildOpenAiNativeHistory(
 	model: Model,
 	previousReplacementHistory?: Array<Record<string, unknown>>,
 ): Array<Record<string, unknown>> {
-	const input: Array<Record<string, unknown>> = previousReplacementHistory ? [...previousReplacementHistory] : [];
+	const input: Array<Record<string, unknown>> = previousReplacementHistory
+		? adaptComputerHistoryForCompaction([...previousReplacementHistory], model.supportsComputerUse === true)
+		: [];
 	const transformedMessages = transformMessages(messages, model, id => normalizeOpenAiCompactionToolCallId(id));
 
 	let msgIndex = 0;
 	const knownCallIds = new Set<string>();
 	const customCallIds = new Set<string>();
-	addOpenAiCallIds(input, knownCallIds, customCallIds);
+	const computerCallIds = new Set<string>();
+	const demotedComputerCallIds = new Set<string>();
+	addOpenAiCallIds(input, knownCallIds, customCallIds, computerCallIds);
 	for (const message of transformedMessages) {
 		if (message.role === "user" || message.role === "developer") {
 			const providerPayload = (message as { providerPayload?: AssistantMessage["providerPayload"] }).providerPayload;
-			const historyItems = getOpenAIResponsesHistoryItems(providerPayload, model.provider);
-			if (historyItems) {
+			const rawHistoryItems = getOpenAIResponsesHistoryItems(providerPayload, model.provider);
+			if (rawHistoryItems) {
+				if (model.supportsComputerUse !== true) {
+					for (const item of rawHistoryItems) {
+						if (item.type === "computer_call" && typeof item.call_id === "string") {
+							demotedComputerCallIds.add(item.call_id);
+						}
+					}
+				}
+				const historyItems = adaptComputerHistoryForCompaction(rawHistoryItems, model.supportsComputerUse === true);
 				input.push(...historyItems);
-				addOpenAiCallIds(historyItems, knownCallIds, customCallIds);
+				addOpenAiCallIds(historyItems, knownCallIds, customCallIds, computerCallIds);
 				msgIndex++;
 				continue;
 			}
@@ -341,14 +402,27 @@ export function buildOpenAiNativeHistory(
 				assistant.provider,
 			);
 			if (providerPayload) {
+				if (!providerPayload.dt) demotedComputerCallIds.clear();
+				if (model.supportsComputerUse !== true) {
+					for (const item of providerPayload.items) {
+						if (item.type === "computer_call" && typeof item.call_id === "string") {
+							demotedComputerCallIds.add(item.call_id);
+						}
+					}
+				}
+				const historyItems = adaptComputerHistoryForCompaction(
+					providerPayload.items,
+					model.supportsComputerUse === true,
+				);
 				if (providerPayload.dt) {
-					input.push(...providerPayload.items);
-					addOpenAiCallIds(providerPayload.items, knownCallIds, customCallIds);
+					input.push(...historyItems);
+					addOpenAiCallIds(historyItems, knownCallIds, customCallIds, computerCallIds);
 				} else {
-					input.splice(0, input.length, ...providerPayload.items);
+					input.splice(0, input.length, ...historyItems);
 					knownCallIds.clear();
 					customCallIds.clear();
-					addOpenAiCallIds(input, knownCallIds, customCallIds);
+					computerCallIds.clear();
+					addOpenAiCallIds(input, knownCallIds, customCallIds, computerCallIds);
 				}
 				msgIndex++;
 				continue;
@@ -394,6 +468,25 @@ export function buildOpenAiNativeHistory(
 
 				if (block.type === "toolCall") {
 					const normalized = normalizeResponsesToolCallId(block.id, block.customWireName ? "ctc" : "fc");
+					if (block.providerMetadata?.type === "computer") {
+						const computerCall = {
+							type: "computer_call",
+							id: block.providerMetadata.providerItemId,
+							call_id: normalized.callId,
+							actions: structuredCloneJSON(block.providerMetadata.actions),
+							pending_safety_checks: structuredCloneJSON(block.providerMetadata.pendingSafetyChecks),
+							status: "completed",
+						};
+						if (model.supportsComputerUse !== true) {
+							input.push(computerHistoryNote(computerCall));
+							demotedComputerCallIds.add(normalized.callId);
+							continue;
+						}
+						knownCallIds.add(normalized.callId);
+						computerCallIds.add(normalized.callId);
+						input.push(computerCall);
+						continue;
+					}
 					let itemId: string | undefined = normalized.itemId;
 					if (
 						isDifferentModel &&
@@ -430,17 +523,58 @@ export function buildOpenAiNativeHistory(
 
 		if (message.role === "toolResult") {
 			const normalized = normalizeResponsesToolCallId(message.toolCallId);
-			if (!knownCallIds.has(normalized.callId)) {
-				msgIndex++;
-				continue;
-			}
-
 			const textOutput = message.content
 				.filter(block => block.type === "text")
 				.map(block => block.text)
 				.join("\n");
 			const hasImages = message.content.some(block => block.type === "image");
 			const outputText = textOutput.length > 0 ? textOutput : hasImages ? "(see attached image)" : "";
+			if (demotedComputerCallIds.has(normalized.callId)) {
+				const resultItem =
+					message.providerMetadata?.type === "computer"
+						? {
+								type: "computer_call_output",
+								call_id: normalized.callId,
+								output: structuredCloneJSON(message.providerMetadata.screenshot),
+								acknowledged_safety_checks: structuredCloneJSON(
+									message.providerMetadata.acknowledgedSafetyChecks,
+								),
+							}
+						: { type: "computer_call_output", call_id: normalized.callId, error: outputText };
+				input.push(computerHistoryNote(resultItem));
+				demotedComputerCallIds.delete(normalized.callId);
+				msgIndex++;
+				continue;
+			}
+			if (!knownCallIds.has(normalized.callId)) {
+				msgIndex++;
+				continue;
+			}
+			if (computerCallIds.has(normalized.callId)) {
+				if (message.providerMetadata?.type === "computer") {
+					input.push({
+						type: "computer_call_output",
+						call_id: normalized.callId,
+						output: structuredCloneJSON(message.providerMetadata.screenshot),
+						acknowledged_safety_checks: structuredCloneJSON(message.providerMetadata.acknowledgedSafetyChecks),
+					});
+					msgIndex++;
+					continue;
+				}
+
+				const callIndex = input.findLastIndex(
+					item => item.type === "computer_call" && item.call_id === normalized.callId,
+				);
+				if (callIndex >= 0) {
+					const [call] = input.splice(callIndex, 1);
+					if (call) input.splice(callIndex, 0, computerFailureNote(call, outputText));
+				}
+				knownCallIds.delete(normalized.callId);
+				computerCallIds.delete(normalized.callId);
+				msgIndex++;
+				continue;
+			}
+
 			input.push({
 				type: customCallIds.has(normalized.callId) ? "custom_tool_call_output" : "function_call_output",
 				call_id: normalized.callId,
@@ -517,6 +651,10 @@ export async function requestOpenAiRemoteCompaction(
 		if (accountId) {
 			headers[OPENAI_HEADERS.ACCOUNT_ID] = accountId;
 		}
+		const attestation = await getCodexAttestationHeader(accountId);
+		if (attestation) {
+			headers[OPENAI_HEADERS.ATTESTATION] = attestation;
+		}
 		headers[OPENAI_HEADERS.BETA] = OPENAI_HEADER_VALUES.BETA_RESPONSES;
 		headers[OPENAI_HEADERS.ORIGINATOR] = OPENAI_HEADER_VALUES.ORIGINATOR_CODEX;
 		Object.assign(

package/src/compaction/utils.ts

@@ -234,10 +234,21 @@ export function serializeConversation(messages: Message[], dialect?: Dialect): s
 		}
 	}
 	if (dialect) {
+		// Claude's classifier refuses inputs that reproduce the model's own
+		// reasoning as text ("reasoning_extraction"), and the anthropic dialect
+		// otherwise renders thinking verbatim inside <thinking> tags. Reasoning is
+		// ephemeral and low-signal for a summary, so drop it from Anthropic-target
+		// summary input. Other dialects (e.g. Harmony) carry reasoning natively in
+		// their transcript format and keep it.
+		const dropThinking = dialect === "anthropic";
 		const processed: Message[] = [];
 		for (const msg of messages) {
 			if (msg.role === "assistant") {
-				const content = msg.content.filter(block => block.type !== "toolCall" || !uselessCallIds.has(block.id));
+				const content = msg.content.filter(
+					block =>
+						(block.type !== "toolCall" || !uselessCallIds.has(block.id)) &&
+						(!dropThinking || block.type !== "thinking"),
+				);
 				if (content.length > 0) processed.push(content.length === msg.content.length ? msg : { ...msg, content });
 				continue;
 			}

package/src/telemetry.ts

@@ -157,6 +157,8 @@ export const enum PiGenAIAttr {
 	GatewayEndpoint = "pi.gen_ai.gateway.endpoint",
 	GatewayCallId = "pi.gen_ai.gateway.call_id",
 	GatewayRoutedTo = "pi.gen_ai.gateway.routed_to",
+	/** Cloudflare AI Gateway response-cache status (`cf-aig-cache-status`), never prompt-cache. */
+	GatewayResponseCacheStatus = "pi.gen_ai.gateway.response_cache.status",
 }
 
 /** GenAI operation names — values for {@link GenAIAttr.OperationName}. */
@@ -1278,17 +1280,56 @@ export function detectGatewayFromHeaders(
 	return undefined;
 }
 
+/**
+ * Bounded Cloudflare AI Gateway response-cache statuses emitted on
+ * {@link PiGenAIAttr.GatewayResponseCacheStatus}. Distinct from provider
+ * prompt-cache token counters (`gen_ai.usage.cache_*`).
+ *
+ * Cloudflare documents `HIT` / `MISS` on `cf-aig-cache-status`; `bypass` covers
+ * skip-cache / CDN-aligned BYPASS values. Any other present value is `unknown`.
+ */
+export type GatewayResponseCacheStatus = "hit" | "miss" | "bypass" | "unknown";
+
+/**
+ * Classify Cloudflare AI Gateway `cf-aig-cache-status` into a bounded
+ * response-cache status. Returns `undefined` when the allow-listed header is
+ * absent so non-Cloudflare traffic stays unaffected. Does not read TTL,
+ * skip-cache, custom-key, or other Cloudflare headers.
+ */
+export function classifyGatewayResponseCacheStatus(
+	headers: Readonly<Record<string, string>> | undefined,
+): GatewayResponseCacheStatus | undefined {
+	if (!headers) return undefined;
+	const raw = headers["cf-aig-cache-status"];
+	if (raw == null) return undefined;
+	switch (raw.trim().toLowerCase()) {
+		case "hit":
+			return "hit";
+		case "miss":
+			return "miss";
+		case "bypass":
+			return "bypass";
+		default:
+			return "unknown";
+	}
+}
+
 function applyGatewayAttributes(
 	span: Span,
 	headers: Readonly<Record<string, string>> | undefined,
 	baseUrl: string | undefined,
 ): void {
 	const gateway = detectGatewayFromHeaders(headers);
-	if (!gateway) return;
-	span.setAttribute(PiGenAIAttr.GatewayName, gateway.name);
-	if (baseUrl) span.setAttribute(PiGenAIAttr.GatewayEndpoint, baseUrl);
-	if (gateway.callId) span.setAttribute(PiGenAIAttr.GatewayCallId, gateway.callId);
-	if (gateway.routedTo) span.setAttribute(PiGenAIAttr.GatewayRoutedTo, gateway.routedTo);
+	if (gateway) {
+		span.setAttribute(PiGenAIAttr.GatewayName, gateway.name);
+		if (baseUrl) span.setAttribute(PiGenAIAttr.GatewayEndpoint, baseUrl);
+		if (gateway.callId) span.setAttribute(PiGenAIAttr.GatewayCallId, gateway.callId);
+		if (gateway.routedTo) span.setAttribute(PiGenAIAttr.GatewayRoutedTo, gateway.routedTo);
+	}
+	const responseCacheStatus = classifyGatewayResponseCacheStatus(headers);
+	if (responseCacheStatus) {
+		span.setAttribute(PiGenAIAttr.GatewayResponseCacheStatus, responseCacheStatus);
+	}
 }
 
 interface AppliedCostEstimate {

package/src/types.ts

@@ -14,8 +14,10 @@ import type {
 	streamSimple,
 	TextContent,
 	Tool,
+	ToolCallProviderMetadata,
 	ToolChoice,
 	ToolResultMessage,
+	ToolResultProviderMetadata,
 	TSchema,
 } from "@oh-my-pi/pi-ai";
 import type { Dialect } from "@oh-my-pi/pi-ai/dialect";
@@ -458,6 +460,17 @@ export interface ToolCallContext {
 	index: number;
 	total: number;
 	toolCalls: Array<{ id: string; name: string }>;
+	/** Provider-native metadata for the current call, when present. */
+	providerMetadata?: ToolCallProviderMetadata;
+	/**
+	 * Cooperative steering signal: aborted when a queued user/steering message
+	 * (or an interrupting peer IRC) is detected while this tool batch runs.
+	 * Unlike the hard abort signal it NEVER kills the tool — long-running
+	 * tools MAY observe it (via `ctx.toolCall.steeringSignal`) to finish early
+	 * or background themselves so the message injects promptly; ignoring it is
+	 * always safe (the message injects at the next batch boundary).
+	 */
+	steeringSignal?: AbortSignal;
 }
 
 /** A single tool-call content block emitted by an assistant message. */
@@ -488,6 +501,8 @@ export interface AfterToolCallResult {
 	content?: (TextContent | ImageContent)[];
 	/** If provided, replaces the tool result details payload in full. */
 	details?: unknown;
+	/** If provided, replaces the provider-native result metadata in full. */
+	providerMetadata?: ToolResultProviderMetadata;
 	/** If provided, replaces the error flag carried with the tool result. */
 	isError?: boolean;
 	/** If provided, replaces the contextually-useless flag carried with the tool result. */
@@ -574,6 +589,8 @@ export interface AgentToolResult<T = any, _TInput = unknown> {
 	// Marks a non-throwing failure (e.g. an aggregator catching per-entry errors).
 	// agent-loop honors this and surfaces it as a tool error on the wire.
 	isError?: boolean;
+	/** Provider-native metadata that must survive into history replay unchanged. */
+	providerMetadata?: ToolResultProviderMetadata;
 	/** Marks the result as contextually useless: safe for compaction to elide once consumed (e.g. zero matches, wait timeout). Ignored when isError is set. */
 	useless?: boolean;
 }
@@ -610,11 +627,14 @@ export type ToolLoadMode = "essential" | "discoverable";
  * - bare tier ("read" / "write" / "exec") — static classification.
  * - object form — adds a `reason` (shown in the prompt) and/or `override: true`
  *   (force-prompt even in modes that would otherwise auto-approve this tier).
+ *   `policy: "deny"` blocks the call at the approval gate.
  * - function — dynamic, given parsed args. Returns either form above.
  *
  * Omitted approvals are treated as "exec" by callers that enforce approvals.
  */
-export type ToolApprovalDecision = ToolTier | { tier: ToolTier; reason?: string; override?: boolean };
+export type ToolApprovalDecision =
+	| ToolTier
+	| { tier: ToolTier; reason?: string; override?: boolean; policy?: "allow" | "deny" | "prompt" };
 export type ToolApproval = ToolApprovalDecision | ((args: unknown) => ToolApprovalDecision);
 
 /**