@polpo-ai/node 0.15.143 → 0.16.0

package/dist/adapters/loop-engine.js

@@ -188,6 +188,7 @@ export function spawnLoopEngine(agentConfig, task, cwd, ctx) {
     const start = Date.now();
     let alive = true;
     const abortController = new AbortController();
+    const toolCleanups = new Set();
     const steering = ctx?.steering
         ?? (ctx?.resumeState?.steering
             ? InMemorySteeringController.fromSnapshot(ctx.resumeState.steering)
@@ -321,549 +322,562 @@ export function spawnLoopEngine(agentConfig, task, cwd, ctx) {
      */
     async function runLoopSession(options) {
         const { sessionAgent, loopName, loop, contextPrompt } = options;
-        const resume = usableResumeState(options.resume, loopName);
-        const inject = ctx?.inject;
-        // Inject path (chat-via-executeRun, F1c): use the completions route's
-        // already-resolved model/prompt/tools/messages instead of re-resolving from
-        // the AgentConfig — parity by construction. Every branch below is
-        // inject-gated so the task path stays byte-identical.
-        let model;
-        let providerOptions;
-        let systemPrompt;
-        let maxTurns;
-        let toolSet;
-        let toolByName = new Map();
-        // Tools value handed to compaction's token estimator (JSON.stringify'd); MUST
-        // match the chat path's shape so the compaction trigger point is identical.
-        let compactionTools;
-        let resolvedModelSelection;
-        const compactionMode = inject?.compactionMode ?? "task";
-        if (inject) {
-            model = inject.model;
-            providerOptions = inject.providerOptions;
-            systemPrompt = inject.systemPrompt;
-            maxTurns = inject.maxTurns;
-            toolSet = inject.toolSet;
-            compactionTools = inject.compactionTools;
-        }
-        else {
-            const prep = prepareSpawn(sessionAgent, cwd, ctx);
-            model = prep.model;
-            resolvedModelSelection = prep.modelSelection;
-            providerOptions = prep.providerOptions;
-            systemPrompt = contextPrompt
-                ? `${prep.systemPrompt}\n\n${contextPrompt}`
-                : prep.systemPrompt;
-            maxTurns = loop.maxTurns ?? prep.maxTurns;
-            const allPolpoTools = await buildAgentTools(sessionAgent, cwd, prep, ctx);
-            toolByName = new Map(allPolpoTools.map((t) => [t.name, t]));
-            toolSet = toToolDeclarations(allPolpoTools);
-            compactionTools = allPolpoTools.map((t) => ({ description: t.description ?? "" }));
-        }
-        const primaryResolved = { model, providerOptions };
-        const modelSelection = inject?.modelSelection ??
-            resolvedModelSelection ??
-            modelSelectionForResolvedModel(model);
-        const contextTrust = inject?.contextTrust ?? ctx?.contextTrust ?? "off";
-        const outputSchema = loop.output?.schema;
-        const modelOutput = inject?.output ?? (outputSchema !== undefined
-            ? modelOutputForJsonSchema(outputSchema, `loop_${loopName}_output`)
-            : undefined);
-        const hasStructuredOutput = modelOutput !== undefined;
-        // Conversation state owned by the host, exactly like the legacy loop.
-        // On resume the recorded history (already containing tool-call and
-        // tool-result pairs from completed turns) replaces the fresh prompt —
-        // side-effects replay from recorded results, they never re-execute.
-        let messages = normalizeResponseMessagesForHistory(inject
-            ? [...inject.seedMessages]
-            : resume
-                ? [...resume.history]
-                : [{
-                        role: "user",
-                        content: options.initialUserMessage ?? buildPrompt(task, ctx?.promptContextSegments, ctx?.contextTrust),
-                    }]);
-        if (contextTrust === "enforce") {
-            messages = protectRuntimeToolResultMessages(messages);
-        }
-        let lastStepText = "";
-        let accumText = resume?.accumText ?? "";
-        let completedStructuredOutput = false;
-        const providerToolResults = new Map();
-        const renderProviderResult = (value) => {
-            if (typeof value === "string")
-                return value;
-            if (value === undefined)
-                return "";
-            try {
-                return JSON.stringify(value);
-            }
-            catch {
-                return String(value);
-            }
-        };
-        const summarize = async (msgs, compactionPrompt) => {
-            const response = await generateText({
-                model: model.aiModel,
-                system: compactionPrompt,
-                messages: prepareModelMessagesForTransport(msgs, model.aiModel),
-                maxOutputTokens: model.maxTokens,
-                abortSignal: abortController.signal,
-                providerOptions,
-            });
-            return response.text;
-        };
-        // ── LoopRunner model callback: one model turn per runner step ──
-        const modelStep = async () => {
-            // Abort between turns mirrors the legacy `if (aborted) break`:
-            // report no tool calls so the runner stops cleanly (exit 0).
-            if (abortController.signal.aborted) {
-                return { text: "", toolCalls: [] };
+        let sessionCleanup;
+        try {
+            const resume = usableResumeState(options.resume, loopName);
+            const inject = ctx?.inject;
+            // Inject path (chat-via-executeRun, F1c): use the completions route's
+            // already-resolved model/prompt/tools/messages instead of re-resolving from
+            // the AgentConfig — parity by construction. Every branch below is
+            // inject-gated so the task path stays byte-identical.
+            let model;
+            let providerOptions;
+            let systemPrompt;
+            let maxTurns;
+            let toolSet;
+            let toolByName = new Map();
+            // Tools value handed to compaction's token estimator (JSON.stringify'd); MUST
+            // match the chat path's shape so the compaction trigger point is identical.
+            let compactionTools;
+            let resolvedModelSelection;
+            const compactionMode = inject?.compactionMode ?? "task";
+            if (inject) {
+                model = inject.model;
+                providerOptions = inject.providerOptions;
+                systemPrompt = inject.systemPrompt;
+                maxTurns = inject.maxTurns;
+                toolSet = inject.toolSet;
+                compactionTools = inject.compactionTools;
             }
-            // Context compaction — same call, same config, same quirks as the
-            // legacy engine (see engine-behavior characterization tests).
-            const compactionResult = await compactIfNeeded({
-                systemPrompt,
-                messages,
-                tools: (inject?.activeCompactionTools?.() ?? compactionTools),
-                config: {
-                    contextWindow: model.contextWindow ?? 200_000,
-                    maxOutputTokens: model.maxTokens ?? 8192,
-                },
-                summarize,
-                mode: compactionMode,
-                onCompaction: (event) => {
-                    emitTranscript({
-                        type: "compaction",
-                        phase: event.phase,
-                        tokensBefore: event.tokensBefore,
-                        tokensAfter: event.tokensAfter,
-                        tokensReclaimed: event.tokensReclaimed,
-                        messagesBefore: event.messagesBefore,
-                        messagesAfter: event.messagesAfter,
-                        toolOutputsPruned: event.toolOutputsPruned,
-                        summary: event.summary,
-                    });
-                },
-            });
-            if (compactionResult.compacted) {
-                messages = normalizeResponseMessagesForHistory(compactionResult.messages);
+            else {
+                const prep = prepareSpawn(sessionAgent, cwd, ctx);
+                model = prep.model;
+                resolvedModelSelection = prep.modelSelection;
+                providerOptions = prep.providerOptions;
+                systemPrompt = contextPrompt
+                    ? `${prep.systemPrompt}\n\n${contextPrompt}`
+                    : prep.systemPrompt;
+                maxTurns = loop.maxTurns ?? prep.maxTurns;
+                const resolved = await buildAgentTools(sessionAgent, cwd, prep, ctx, { signal: abortController.signal,
+                    policy: { loop: options.projectAllowedTools, step: loop.allowedTools ?? loop.tools } });
+                toolCleanups.add(resolved.cleanup);
+                sessionCleanup = resolved.cleanup;
+                const allPolpoTools = resolved.tools;
+                toolByName = new Map(allPolpoTools.map((t) => [t.name, t]));
+                toolSet = toToolDeclarations(allPolpoTools);
+                compactionTools = allPolpoTools.map((t) => ({ description: t.description ?? "" }));
             }
-            messages = normalizeResponseMessagesForHistory(messages);
+            const primaryResolved = { model, providerOptions };
+            const modelSelection = inject?.modelSelection ??
+                resolvedModelSelection ??
+                modelSelectionForResolvedModel(model);
+            const contextTrust = inject?.contextTrust ?? ctx?.contextTrust ?? "off";
+            const outputSchema = loop.output?.schema;
+            const modelOutput = inject?.output ?? (outputSchema !== undefined
+                ? modelOutputForJsonSchema(outputSchema, `loop_${loopName}_output`)
+                : undefined);
+            const hasStructuredOutput = modelOutput !== undefined;
+            // Conversation state owned by the host, exactly like the legacy loop.
+            // On resume the recorded history (already containing tool-call and
+            // tool-result pairs from completed turns) replaces the fresh prompt —
+            // side-effects replay from recorded results, they never re-execute.
+            let messages = normalizeResponseMessagesForHistory(inject
+                ? [...inject.seedMessages]
+                : resume
+                    ? [...resume.history]
+                    : [{
+                            role: "user",
+                            content: options.initialUserMessage ?? buildPrompt(task, ctx?.promptContextSegments, ctx?.contextTrust),
+                        }]);
             if (contextTrust === "enforce") {
                 messages = protectRuntimeToolResultMessages(messages);
             }
-            let stepText = "";
-            // Chat injections stream a structured answer's raw JSON as it arrives;
-            // the validated serialization still follows once the step completes.
-            const structuredGate = inject && hasStructuredOutput
-                ? new StructuredOutputDeltaGate()
-                : undefined;
-            const toolCalls = [];
-            const seenModelToolCallIds = new Set();
-            const resolvedAttempts = new Map();
-            let turn;
-            try {
-                turn = await runModelPolicyTurn({
-                    selection: modelSelection,
-                    resolveAttempt: async (attempt) => {
-                        const resolvedAttempt = attempt.index === 0
-                            ? primaryResolved
-                            : inject
-                                ? await inject.resolveModelAttempt?.(attempt.model)
-                                : resolveSpawnModelAttempt(sessionAgent, attempt.model, ctx);
-                        if (!resolvedAttempt) {
-                            throw new Error(`No model resolver is available for fallback "${attempt.model}"`);
-                        }
-                        resolvedAttempts.set(attempt.index, resolvedAttempt);
-                        return {
-                            model: resolvedAttempt.model.aiModel,
-                            maxOutputTokens: resolvedAttempt.model.maxTokens,
-                            providerOptions: resolvedAttempt.providerOptions,
-                        };
-                    },
-                    preserveSingleAttemptError: true,
-                    system: systemPrompt,
-                    messages,
-                    tools: toolSet,
-                    ...(inject?.activeToolNames ? { activeTools: inject.activeToolNames() } : {}),
-                    ...(inject?.toolChoice ? { toolChoice: inject.toolChoice } : {}),
-                    ...(inject?.parallelToolCalls !== undefined
-                        ? { parallelToolCalls: inject.parallelToolCalls }
-                        : {}),
-                    ...(hasStructuredOutput ? { output: modelOutput } : {}),
+            let lastStepText = "";
+            let accumText = resume?.accumText ?? "";
+            let completedStructuredOutput = false;
+            const providerToolResults = new Map();
+            const renderProviderResult = (value) => {
+                if (typeof value === "string")
+                    return value;
+                if (value === undefined)
+                    return "";
+                try {
+                    return JSON.stringify(value);
+                }
+                catch {
+                    return String(value);
+                }
+            };
+            const summarize = async (msgs, compactionPrompt) => {
+                const response = await generateText({
+                    model: model.aiModel,
+                    system: compactionPrompt,
+                    messages: prepareModelMessagesForTransport(msgs, model.aiModel),
+                    maxOutputTokens: model.maxTokens,
                     abortSignal: abortController.signal,
-                }, (event) => {
-                    switch (event.type) {
-                        case "reasoning-delta": {
-                            // Chat parity (F1c): surface model reasoning as a thinking delta.
-                            if (inject) {
-                                try {
-                                    ctx?.onDelta?.({ text: event.text, kind: "reasoning" });
-                                }
-                                catch { /* subscriber can't sink the run */ }
+                    providerOptions,
+                });
+                return response.text;
+            };
+            // ── LoopRunner model callback: one model turn per runner step ──
+            const modelStep = async () => {
+                // Abort between turns mirrors the legacy `if (aborted) break`:
+                // report no tool calls so the runner stops cleanly (exit 0).
+                if (abortController.signal.aborted) {
+                    return { text: "", toolCalls: [] };
+                }
+                // Context compaction — same call, same config, same quirks as the
+                // legacy engine (see engine-behavior characterization tests).
+                const compactionResult = await compactIfNeeded({
+                    systemPrompt,
+                    messages,
+                    tools: (inject?.activeCompactionTools?.() ?? compactionTools),
+                    config: {
+                        contextWindow: model.contextWindow ?? 200_000,
+                        maxOutputTokens: model.maxTokens ?? 8192,
+                    },
+                    summarize,
+                    mode: compactionMode,
+                    onCompaction: (event) => {
+                        emitTranscript({
+                            type: "compaction",
+                            phase: event.phase,
+                            tokensBefore: event.tokensBefore,
+                            tokensAfter: event.tokensAfter,
+                            tokensReclaimed: event.tokensReclaimed,
+                            messagesBefore: event.messagesBefore,
+                            messagesAfter: event.messagesAfter,
+                            toolOutputsPruned: event.toolOutputsPruned,
+                            summary: event.summary,
+                        });
+                    },
+                });
+                if (compactionResult.compacted) {
+                    messages = normalizeResponseMessagesForHistory(compactionResult.messages);
+                }
+                messages = normalizeResponseMessagesForHistory(messages);
+                if (contextTrust === "enforce") {
+                    messages = protectRuntimeToolResultMessages(messages);
+                }
+                let stepText = "";
+                // Chat injections stream a structured answer's raw JSON as it arrives;
+                // the validated serialization still follows once the step completes.
+                const structuredGate = inject && hasStructuredOutput
+                    ? new StructuredOutputDeltaGate()
+                    : undefined;
+                const toolCalls = [];
+                const seenModelToolCallIds = new Set();
+                const resolvedAttempts = new Map();
+                let turn;
+                try {
+                    turn = await runModelPolicyTurn({
+                        selection: modelSelection,
+                        resolveAttempt: async (attempt) => {
+                            const resolvedAttempt = attempt.index === 0
+                                ? primaryResolved
+                                : inject
+                                    ? await inject.resolveModelAttempt?.(attempt.model)
+                                    : resolveSpawnModelAttempt(sessionAgent, attempt.model, ctx);
+                            if (!resolvedAttempt) {
+                                throw new Error(`No model resolver is available for fallback "${attempt.model}"`);
                             }
-                            break;
-                        }
-                        case "text-delta": {
-                            stepText += event.text;
-                            // F1b: token-level streaming sink (separate from onTranscript, which
-                            // stays turn-granularity for persistence). Best-effort.
-                            if (!hasStructuredOutput) {
-                                try {
-                                    ctx?.onDelta?.({ text: event.text });
+                            resolvedAttempts.set(attempt.index, resolvedAttempt);
+                            return {
+                                model: resolvedAttempt.model.aiModel,
+                                maxOutputTokens: resolvedAttempt.model.maxTokens,
+                                providerOptions: resolvedAttempt.providerOptions,
+                            };
+                        },
+                        preserveSingleAttemptError: true,
+                        system: systemPrompt,
+                        messages,
+                        tools: toolSet,
+                        ...(inject?.activeToolNames ? { activeTools: inject.activeToolNames() } : {}),
+                        ...(inject?.toolChoice ? { toolChoice: inject.toolChoice } : {}),
+                        ...(inject?.parallelToolCalls !== undefined
+                            ? { parallelToolCalls: inject.parallelToolCalls }
+                            : {}),
+                        ...(hasStructuredOutput ? { output: modelOutput } : {}),
+                        abortSignal: abortController.signal,
+                    }, (event) => {
+                        switch (event.type) {
+                            case "reasoning-delta": {
+                                // Chat parity (F1c): surface model reasoning as a thinking delta.
+                                if (inject) {
+                                    try {
+                                        ctx?.onDelta?.({ text: event.text, kind: "reasoning" });
+                                    }
+                                    catch { /* subscriber can't sink the run */ }
                                 }
-                                catch { /* a delta subscriber can't sink the run */ }
+                                break;
                             }
-                            else {
-                                const structuredText = structuredGate?.push(event.text);
-                                if (structuredText) {
+                            case "text-delta": {
+                                stepText += event.text;
+                                // F1b: token-level streaming sink (separate from onTranscript, which
+                                // stays turn-granularity for persistence). Best-effort.
+                                if (!hasStructuredOutput) {
                                     try {
-                                        ctx?.onDelta?.({ text: structuredText, kind: "structured" });
+                                        ctx?.onDelta?.({ text: event.text });
                                     }
                                     catch { /* a delta subscriber can't sink the run */ }
                                 }
+                                else {
+                                    const structuredText = structuredGate?.push(event.text);
+                                    if (structuredText) {
+                                        try {
+                                            ctx?.onDelta?.({ text: structuredText, kind: "structured" });
+                                        }
+                                        catch { /* a delta subscriber can't sink the run */ }
+                                    }
+                                }
+                                break;
                             }
-                            break;
-                        }
-                        case "tool-input-start": {
-                            // Chat parity (F1c): "preparing" tool state before args stream in.
-                            if (inject)
-                                emitTranscript({ type: "tool_input_start", toolId: event.id, tool: event.name });
-                            break;
-                        }
-                        case "tool-input-delta": {
-                            // Chat parity (F1c): forward raw argument text while it streams so
-                            // the run path exposes the same live tool-call details as inline.
-                            if (inject)
-                                emitTranscript({ type: "tool_input_delta", toolId: event.id, delta: event.delta });
-                            break;
-                        }
-                        case "tool-input-aborted": {
-                            if (inject) {
-                                emitTranscript({
-                                    type: "tool_input_interrupted",
-                                    toolId: event.id,
-                                    tool: event.name,
-                                    error: event.error,
-                                });
+                            case "tool-input-start": {
+                                // Chat parity (F1c): "preparing" tool state before args stream in.
+                                if (inject)
+                                    emitTranscript({ type: "tool_input_start", toolId: event.id, tool: event.name });
+                                break;
                             }
-                            break;
-                        }
-                        case "tool-call": {
-                            if (!event.id || seenModelToolCallIds.has(event.id))
+                            case "tool-input-delta": {
+                                // Chat parity (F1c): forward raw argument text while it streams so
+                                // the run path exposes the same live tool-call details as inline.
+                                if (inject)
+                                    emitTranscript({ type: "tool_input_delta", toolId: event.id, delta: event.delta });
                                 break;
-                            seenModelToolCallIds.add(event.id);
-                            activity.toolCalls++;
-                            activity.lastTool = event.name;
-                            activity.lastUpdate = new Date().toISOString();
-                            if (event.invalid) {
-                                const detail = event.error instanceof Error
-                                    ? event.error.message
-                                    : typeof event.error === "string"
-                                        ? event.error
-                                        : "Tool arguments do not match the declared input schema.";
-                                // Keep the call in the loop so the SDK-provided tool error in
-                                // responseMessages reaches the next model turn, but never emit a
-                                // local calling event or dispatch it to an executor.
+                            }
+                            case "tool-input-aborted": {
+                                if (inject) {
+                                    emitTranscript({
+                                        type: "tool_input_interrupted",
+                                        toolId: event.id,
+                                        tool: event.name,
+                                        error: event.error,
+                                    });
+                                }
+                                break;
+                            }
+                            case "tool-call": {
+                                if (!event.id || seenModelToolCallIds.has(event.id))
+                                    break;
+                                seenModelToolCallIds.add(event.id);
+                                activity.toolCalls++;
+                                activity.lastTool = event.name;
+                                activity.lastUpdate = new Date().toISOString();
+                                if (event.invalid) {
+                                    const detail = event.error instanceof Error
+                                        ? event.error.message
+                                        : typeof event.error === "string"
+                                            ? event.error
+                                            : "Tool arguments do not match the declared input schema.";
+                                    // Keep the call in the loop so the SDK-provided tool error in
+                                    // responseMessages reaches the next model turn, but never emit a
+                                    // local calling event or dispatch it to an executor.
+                                    toolCalls.push({
+                                        id: event.id,
+                                        name: event.name,
+                                        args: (event.args ?? {}),
+                                        inputValidationError: `Error: Invalid tool arguments: ${detail}`,
+                                    });
+                                    break;
+                                }
+                                // Chat parity (F1c): a client-side tool ends the server loop and is
+                                // returned to the caller to execute — never dispatched here. Not
+                                // pushing it to toolCalls ⇒ the turn ends with no executable tools.
+                                if (inject && inject.clientSideToolNames.has(event.name)) {
+                                    emitTranscript({
+                                        type: "client_tool_call",
+                                        toolId: event.id,
+                                        tool: event.name,
+                                        input: event.args,
+                                    });
+                                    break;
+                                }
+                                // Background task transcripts keep their historical use,use,result
+                                // ordering. Interactive chat defers tool_use until executeTool so
+                                // local calls are emitted calling,result one at a time, exactly like
+                                // the inline completions handler. Provider tools never emit a local
+                                // calling event because the model provider executes them.
+                                if (!inject) {
+                                    emitTranscript({
+                                        type: "tool_use",
+                                        tool: event.name,
+                                        toolId: event.id,
+                                        input: event.args,
+                                    });
+                                }
                                 toolCalls.push({
                                     id: event.id,
                                     name: event.name,
                                     args: (event.args ?? {}),
-                                    inputValidationError: `Error: Invalid tool arguments: ${detail}`,
                                 });
                                 break;
                             }
-                            // Chat parity (F1c): a client-side tool ends the server loop and is
-                            // returned to the caller to execute — never dispatched here. Not
-                            // pushing it to toolCalls ⇒ the turn ends with no executable tools.
-                            if (inject && inject.clientSideToolNames.has(event.name)) {
-                                emitTranscript({
-                                    type: "client_tool_call",
-                                    toolId: event.id,
-                                    tool: event.name,
-                                    input: event.args,
-                                });
+                            case "tool-result": {
+                                if (inject?.providerToolNames.has(event.name)) {
+                                    providerToolResults.set(event.id, {
+                                        content: renderProviderResult(event.output),
+                                        isError: false,
+                                    });
+                                }
                                 break;
                             }
-                            // Background task transcripts keep their historical use,use,result
-                            // ordering. Interactive chat defers tool_use until executeTool so
-                            // local calls are emitted calling,result one at a time, exactly like
-                            // the inline completions handler. Provider tools never emit a local
-                            // calling event because the model provider executes them.
-                            if (!inject) {
-                                emitTranscript({
-                                    type: "tool_use",
-                                    tool: event.name,
-                                    toolId: event.id,
-                                    input: event.args,
-                                });
-                            }
-                            toolCalls.push({
-                                id: event.id,
-                                name: event.name,
-                                args: (event.args ?? {}),
-                            });
-                            break;
-                        }
-                        case "tool-result": {
-                            if (inject?.providerToolNames.has(event.name)) {
-                                providerToolResults.set(event.id, {
-                                    content: renderProviderResult(event.output),
-                                    isError: false,
-                                });
+                            case "tool-error": {
+                                if (inject?.providerToolNames.has(event.name)) {
+                                    providerToolResults.set(event.id, {
+                                        content: renderProviderResult(event.error),
+                                        isError: true,
+                                    });
+                                }
+                                break;
                             }
-                            break;
-                        }
-                        case "tool-error": {
-                            if (inject?.providerToolNames.has(event.name)) {
-                                providerToolResults.set(event.id, {
-                                    content: renderProviderResult(event.error),
-                                    isError: true,
-                                });
+                            case "finish": {
+                                if (inject && event.finishReason === "error") {
+                                    emitTranscript({
+                                        type: "error",
+                                        message: "Model returned an error",
+                                        error: { message: "Model returned an error", type: "model_error" },
+                                    });
+                                }
+                                break;
                             }
-                            break;
-                        }
-                        case "finish": {
-                            if (inject && event.finishReason === "error") {
+                            case "error": {
+                                const normalized = classifyRuntimeError(event.error);
                                 emitTranscript({
                                     type: "error",
-                                    message: "Model returned an error",
-                                    error: { message: "Model returned an error", type: "model_error" },
+                                    message: normalized.message ?? "Unknown model runtime error",
+                                    error: runtimeErrorMetadata(event.error),
                                 });
+                                break;
                             }
-                            break;
-                        }
-                        case "error": {
-                            const normalized = classifyRuntimeError(event.error);
-                            emitTranscript({
-                                type: "error",
-                                message: normalized.message ?? "Unknown model runtime error",
-                                error: runtimeErrorMetadata(event.error),
-                            });
-                            break;
                         }
+                    });
+                }
+                catch (error) {
+                    if (outputSchema !== undefined && isStructuredModelOutputError(error)) {
+                        throw new LoopAgentOutputError("loop_agent_output_invalid", loopName, `Agent step ${JSON.stringify(loopName)} did not produce valid structured output`, { phase: "model_output" }, { cause: error });
                     }
-                });
-            }
-            catch (error) {
-                if (outputSchema !== undefined && isStructuredModelOutputError(error)) {
-                    throw new LoopAgentOutputError("loop_agent_output_invalid", loopName, `Agent step ${JSON.stringify(loopName)} did not produce valid structured output`, { phase: "model_output" }, { cause: error });
+                    throw error;
                 }
-                throw error;
-            }
-            const stepUsage = turn.usage;
-            const selectedResolved = resolvedAttempts.get(turn.selectedAttempt.index);
-            if (selectedResolved) {
-                model = selectedResolved.model;
-                providerOptions = selectedResolved.providerOptions;
-            }
-            if (stepUsage) {
-                activity.totalTokens += (stepUsage.totalTokens ?? 0);
-            }
-            activity.lastUpdate = new Date().toISOString();
-            if (structuredGate?.streamed && toolCalls.length > 0) {
-                try {
-                    ctx?.onDelta?.({ text: "", kind: "structured-reset" });
+                const stepUsage = turn.usage;
+                const selectedResolved = resolvedAttempts.get(turn.selectedAttempt.index);
+                if (selectedResolved) {
+                    model = selectedResolved.model;
+                    providerOptions = selectedResolved.providerOptions;
                 }
-                catch { /* a delta subscriber can't sink the run */ }
-            }
-            let rawText;
-            if (hasStructuredOutput) {
-                if (toolCalls.length === 0 && turn.output !== undefined) {
-                    if (outputSchema !== undefined) {
-                        const prepared = prepareLoopAgentOutput(loopName, turn.output, outputSchema);
-                        rawText = prepared.serialized;
-                        completedStructuredOutput = true;
+                if (stepUsage) {
+                    activity.totalTokens += (stepUsage.totalTokens ?? 0);
+                }
+                activity.lastUpdate = new Date().toISOString();
+                if (structuredGate?.streamed && toolCalls.length > 0) {
+                    try {
+                        ctx?.onDelta?.({ text: "", kind: "structured-reset" });
+                    }
+                    catch { /* a delta subscriber can't sink the run */ }
+                }
+                let rawText;
+                if (hasStructuredOutput) {
+                    if (toolCalls.length === 0 && turn.output !== undefined) {
+                        if (outputSchema !== undefined) {
+                            const prepared = prepareLoopAgentOutput(loopName, turn.output, outputSchema);
+                            rawText = prepared.serialized;
+                            completedStructuredOutput = true;
+                        }
+                        else {
+                            rawText = JSON.stringify(turn.output);
+                        }
                     }
                     else {
-                        rawText = JSON.stringify(turn.output);
+                        rawText = "";
                     }
                 }
                 else {
-                    rawText = "";
+                    rawText = stepText || (toolCalls.length === 0 ? turn.text : "");
                 }
-            }
-            else {
-                rawText = stepText || (toolCalls.length === 0 ? turn.text : "");
-            }
-            const guardedText = rawText && ctx?.runOutputPolicy
-                ? (await ctx.runOutputPolicy.evaluate({
-                    output: rawText,
-                    mode: ctx.runOutputPolicyMode ?? "enforce",
-                    context: {
-                        agent: sessionAgent.name,
-                        runId: ctx.runId,
-                        source: "task",
-                        surface: "task",
-                    },
-                    signal: abortController.signal,
-                })).output
-                : rawText;
-            if (hasStructuredOutput && toolCalls.length === 0 && guardedText) {
-                try {
-                    ctx?.onDelta?.({ text: guardedText });
+                const guardedText = rawText && ctx?.runOutputPolicy
+                    ? (await ctx.runOutputPolicy.evaluate({
+                        output: rawText,
+                        mode: ctx.runOutputPolicyMode ?? "enforce",
+                        context: {
+                            agent: sessionAgent.name,
+                            runId: ctx.runId,
+                            source: "task",
+                            surface: "task",
+                        },
+                        signal: abortController.signal,
+                    })).output
+                    : rawText;
+                if (hasStructuredOutput && toolCalls.length === 0 && guardedText) {
+                    try {
+                        ctx?.onDelta?.({ text: guardedText });
+                    }
+                    catch { /* a delta subscriber can't sink the run */ }
                 }
-                catch { /* a delta subscriber can't sink the run */ }
-            }
-            if (guardedText) {
-                activity.summary = guardedText.slice(0, 200);
-                emitTranscript({ type: "assistant", text: guardedText });
-                accumText += guardedText;
-            }
-            lastStepText = guardedText;
-            // Append the assistant message (with its tool-call parts) to history.
-            const normalizedResponseMessages = normalizeResponseMessagesForHistory(turn.responseMessages);
-            const responseMessages = guardedText !== rawText
-                ? replaceAssistantText(normalizedResponseMessages, guardedText)
-                : normalizedResponseMessages;
-            messages.push(...(contextTrust === "enforce"
-                ? protectRuntimeToolResultMessages(responseMessages)
-                : responseMessages));
-            // Chat parity (F1c): surface per-turn usage + provider metadata so the
-            // driver can accumulate them for onCompletionFinished, matching chat.
-            if (inject) {
-                emitTranscript({
-                    type: "usage",
-                    usage: stepUsage,
-                    providerMetadata: turn.providerMetadata,
-                });
-            }
-            return { text: guardedText, toolCalls, usage: stepUsage };
-        };
-        // ── LoopRunner tool executor: dispatch + history append ──
-        const executeTool = async (toolCall) => {
-            if (toolCall.inputValidationError) {
-                emitTranscript({
-                    type: "tool_result",
-                    toolId: toolCall.id,
-                    tool: toolCall.name,
-                    content: toolCall.inputValidationError,
-                    isError: true,
-                    invalid: true,
-                });
-                // AI SDK already included the corresponding tool-error output in
-                // turn.responseMessages; do not append a duplicate history message.
-                return toolCall.inputValidationError;
-            }
-            let llmText;
-            let isError;
-            if (inject) {
-                // Chat parity (F1c): dispatch via the route's own executor and emit the
-                // FULL result (no 2000-char task truncation). Provider-executed tools
-                // are already resolved by the model provider: record their result for
-                // observability, but never dispatch them through the local executor.
-                if (inject.providerToolNames.has(toolCall.name)) {
-                    const providerResult = providerToolResults.get(toolCall.id) ?? { content: "", isError: false };
+                if (guardedText) {
+                    activity.summary = guardedText.slice(0, 200);
+                    emitTranscript({ type: "assistant", text: guardedText });
+                    accumText += guardedText;
+                }
+                lastStepText = guardedText;
+                // Append the assistant message (with its tool-call parts) to history.
+                const normalizedResponseMessages = normalizeResponseMessagesForHistory(turn.responseMessages);
+                const responseMessages = guardedText !== rawText
+                    ? replaceAssistantText(normalizedResponseMessages, guardedText)
+                    : normalizedResponseMessages;
+                messages.push(...(contextTrust === "enforce"
+                    ? protectRuntimeToolResultMessages(responseMessages)
+                    : responseMessages));
+                // Chat parity (F1c): surface per-turn usage + provider metadata so the
+                // driver can accumulate them for onCompletionFinished, matching chat.
+                if (inject) {
+                    emitTranscript({
+                        type: "usage",
+                        usage: stepUsage,
+                        providerMetadata: turn.providerMetadata,
+                    });
+                }
+                return { text: guardedText, toolCalls, usage: stepUsage };
+            };
+            // ── LoopRunner tool executor: dispatch + history append ──
+            const executeTool = async (toolCall) => {
+                if (toolCall.inputValidationError) {
                     emitTranscript({
                         type: "tool_result",
                         toolId: toolCall.id,
                         tool: toolCall.name,
-                        input: toolCall.args,
-                        content: providerResult.content,
-                        isError: providerResult.isError,
-                        providerExecuted: true,
+                        content: toolCall.inputValidationError,
+                        isError: true,
+                        invalid: true,
                     });
-                    return "";
+                    // AI SDK already included the corresponding tool-error output in
+                    // turn.responseMessages; do not append a duplicate history message.
+                    return toolCall.inputValidationError;
                 }
-                emitTranscript({
-                    type: "tool_use",
-                    tool: toolCall.name,
-                    toolId: toolCall.id,
-                    input: toolCall.args,
-                });
-                llmText = await inject.executor(toolCall.name, toolCall.args, {
-                    callId: toolCall.id,
-                    signal: abortController.signal,
-                });
-                isError = llmText.startsWith("Error:");
-                emitTranscript({ type: "tool_result", toolId: toolCall.id, tool: toolCall.name, content: llmText, isError });
-            }
-            else {
-                ({ llmText, isError } = await performToolCall(toolByName.get(toolCall.name), toolCall));
-            }
-            return llmText;
-        };
-        // ── Durable turns: one checkpoint write per completed turn ──
-        // Emitted at end-of-turn, so `messages` is post-tool-execution and
-        // post-compaction by construction (compaction rewrites `messages` at
-        // the START of a model step). The JSON round-trip here pins store
-        // fidelity: what a resumed run sees is exactly what survives JSON.
-        const checkpointCreatedAt = resume?.createdAt ?? new Date().toISOString();
-        const onTurnCheckpoint = options.onCheckpoint
-            ? async ({ turn, steering }) => {
-                const serialized = JSON.stringify({ messages, steering });
-                if (serialized.length > MAX_CHECKPOINT_BYTES)
-                    return; // keep the previous checkpoint
-                const checkpoint = JSON.parse(serialized);
-                await options.onCheckpoint({
-                    context: {},
-                    steps: [],
-                    loopName,
-                    turn,
-                    history: checkpoint.messages,
-                    accumText,
-                    steering: checkpoint.steering,
-                    createdAt: checkpointCreatedAt,
-                    updatedAt: new Date().toISOString(),
-                });
-            }
-            : undefined;
-        const runner = new LoopRunner();
-        await runner.run({
-            agent: sessionAgent,
-            loop: { ...loop, name: loopName },
-            maxTurns,
-            startTurn: resume ? resume.turn + 1 : 0,
-            model: modelStep,
-            executeTool,
-            parallelToolCalls: inject?.parallelToolCalls,
-            onToolResults: (toolResults) => {
-                for (const { toolCall, result, isError } of toolResults) {
-                    // AI SDK already persisted provider-executed results and invalid
-                    // argument errors in responseMessages. Only local results belong
-                    // in this host-owned ordered append.
-                    if (toolCall.inputValidationError || inject?.providerToolNames.has(toolCall.name)) {
-                        continue;
+                let llmText;
+                let isError;
+                if (inject) {
+                    // Chat parity (F1c): dispatch via the route's own executor and emit the
+                    // FULL result (no 2000-char task truncation). Provider-executed tools
+                    // are already resolved by the model provider: record their result for
+                    // observability, but never dispatch them through the local executor.
+                    if (inject.providerToolNames.has(toolCall.name)) {
+                        const providerResult = providerToolResults.get(toolCall.id) ?? { content: "", isError: false };
+                        emitTranscript({
+                            type: "tool_result",
+                            toolId: toolCall.id,
+                            tool: toolCall.name,
+                            input: toolCall.args,
+                            content: providerResult.content,
+                            isError: providerResult.isError,
+                            providerExecuted: true,
+                        });
+                        return "";
                     }
-                    const modelResult = contextTrust === "enforce"
-                        ? renderRuntimeToolResult(toolCall.name, toolCall.id, result)
-                        : result;
-                    messages.push({
-                        role: "tool",
-                        content: [{
-                                type: "tool-result",
-                                toolCallId: toolCall.id,
-                                toolName: toolCall.name,
-                                output: isError
-                                    ? { type: "error-text", value: modelResult }
-                                    : { type: "text", value: modelResult },
-                            }],
+                    emitTranscript({
+                        type: "tool_use",
+                        tool: toolCall.name,
+                        toolId: toolCall.id,
+                        input: toolCall.args,
+                    });
+                    llmText = await inject.executor(toolCall.name, toolCall.args, {
+                        callId: toolCall.id,
+                        signal: abortController.signal,
                     });
+                    isError = llmText.startsWith("Error:");
+                    emitTranscript({ type: "tool_result", toolId: toolCall.id, tool: toolCall.name, content: llmText, isError });
                 }
-            },
-            steering,
-            onSteering: async (steeringMessages) => {
-                for (const message of steeringMessages) {
-                    messages.push(toSteeringModelMessage(message));
-                    emitTranscript({
-                        type: "steering",
-                        messageId: message.id,
-                        mode: message.mode,
-                        text: message.content.text,
-                        attachments: (message.content.attachments ?? []).map((attachment) => ({
-                            type: attachment.type,
-                            mediaType: attachment.mediaType,
-                            name: attachment.name,
-                        })),
+                else {
+                    ({ llmText, isError } = await performToolCall(toolByName.get(toolCall.name), toolCall));
+                }
+                return llmText;
+            };
+            // ── Durable turns: one checkpoint write per completed turn ──
+            // Emitted at end-of-turn, so `messages` is post-tool-execution and
+            // post-compaction by construction (compaction rewrites `messages` at
+            // the START of a model step). The JSON round-trip here pins store
+            // fidelity: what a resumed run sees is exactly what survives JSON.
+            const checkpointCreatedAt = resume?.createdAt ?? new Date().toISOString();
+            const onTurnCheckpoint = options.onCheckpoint
+                ? async ({ turn, steering }) => {
+                    const serialized = JSON.stringify({ messages, steering });
+                    if (serialized.length > MAX_CHECKPOINT_BYTES)
+                        return; // keep the previous checkpoint
+                    const checkpoint = JSON.parse(serialized);
+                    await options.onCheckpoint({
+                        context: {},
+                        steps: [],
+                        loopName,
+                        turn,
+                        history: checkpoint.messages,
+                        accumText,
+                        steering: checkpoint.steering,
+                        createdAt: checkpointCreatedAt,
+                        updatedAt: new Date().toISOString(),
                     });
                 }
-            },
-            onTurnCheckpoint,
-        });
-        if (outputSchema !== undefined && !completedStructuredOutput) {
-            throw new LoopAgentOutputError("loop_agent_output_invalid", loopName, `Agent step ${JSON.stringify(loopName)} exhausted maxTurns before producing structured output`, { phase: "max_turns" });
+                : undefined;
+            const runner = new LoopRunner();
+            await runner.run({
+                agent: sessionAgent,
+                loop: { ...loop, name: loopName },
+                maxTurns,
+                startTurn: resume ? resume.turn + 1 : 0,
+                model: modelStep,
+                executeTool,
+                parallelToolCalls: inject?.parallelToolCalls,
+                onToolResults: (toolResults) => {
+                    for (const { toolCall, result, isError } of toolResults) {
+                        // AI SDK already persisted provider-executed results and invalid
+                        // argument errors in responseMessages. Only local results belong
+                        // in this host-owned ordered append.
+                        if (toolCall.inputValidationError || inject?.providerToolNames.has(toolCall.name)) {
+                            continue;
+                        }
+                        const modelResult = contextTrust === "enforce"
+                            ? renderRuntimeToolResult(toolCall.name, toolCall.id, result)
+                            : result;
+                        messages.push({
+                            role: "tool",
+                            content: [{
+                                    type: "tool-result",
+                                    toolCallId: toolCall.id,
+                                    toolName: toolCall.name,
+                                    output: isError
+                                        ? { type: "error-text", value: modelResult }
+                                        : { type: "text", value: modelResult },
+                                }],
+                        });
+                    }
+                },
+                steering,
+                onSteering: async (steeringMessages) => {
+                    for (const message of steeringMessages) {
+                        messages.push(toSteeringModelMessage(message));
+                        emitTranscript({
+                            type: "steering",
+                            messageId: message.id,
+                            mode: message.mode,
+                            text: message.content.text,
+                            attachments: (message.content.attachments ?? []).map((attachment) => ({
+                                type: attachment.type,
+                                mediaType: attachment.mediaType,
+                                name: attachment.name,
+                            })),
+                        });
+                    }
+                },
+                onTurnCheckpoint,
+            });
+            if (outputSchema !== undefined && !completedStructuredOutput) {
+                throw new LoopAgentOutputError("loop_agent_output_invalid", loopName, `Agent step ${JSON.stringify(loopName)} exhausted maxTurns before producing structured output`, { phase: "max_turns" });
+            }
+            return { lastText: lastStepText, accumText };
+        }
+        finally {
+            if (sessionCleanup) {
+                await sessionCleanup().catch(() => undefined);
+                toolCleanups.delete(sessionCleanup);
+            }
         }
-        return { lastText: lastStepText, accumText };
     }
     /**
      * Run a project loop graph (.polpo/loops/<name>.json) through the
@@ -893,8 +907,10 @@ export function spawnLoopEngine(agentConfig, task, cwd, ctx) {
         const getBaseTools = () => {
             baseToolsPromise ??= (async () => {
                 const prep = prepareSpawn(agentConfig, cwd, ctx);
-                const tools = await buildAgentTools(agentConfig, cwd, prep, ctx);
-                return new Map(tools.map((t) => [t.name, t]));
+                const resolved = await buildAgentTools(agentConfig, cwd, prep, ctx, { signal: abortController.signal,
+                    policy: { loop: projectLoop.allowedTools } });
+                toolCleanups.add(resolved.cleanup);
+                return new Map(resolved.tools.map((t) => [t.name, t]));
             })();
             return baseToolsPromise;
         };
@@ -983,6 +999,7 @@ export function spawnLoopEngine(agentConfig, task, cwd, ctx) {
                 const stepAgent = buildLoopStepAgent(agentConfig, name, loop);
                 const session = await runLoopSession({
                     sessionAgent: stepAgent,
+                    projectAllowedTools: projectLoop.allowedTools,
                     loopName: name,
                     loop,
                     contextPrompt: agentInput
@@ -1127,6 +1144,8 @@ export function spawnLoopEngine(agentConfig, task, cwd, ctx) {
             };
         }
         finally {
+            await Promise.allSettled([...toolCleanups].map(cleanup => cleanup()));
+            toolCleanups.clear();
             steering.signal.removeEventListener("abort", onSteeringAbort);
             steering.close();
             // Close agent-browser session (profile data auto-persisted by --profile).