@possumtech/rummy 2.1.0 → 2.2.1

package/src/agent/TurnExecutor.js

@@ -76,6 +76,7 @@ export default class TurnExecutor {
 				contextSize,
 				systemPrompt: null,
 				loopPrompt,
+				signal,
 			},
 		);
 		await this.#hooks.turn.started.emit({
@@ -88,14 +89,18 @@ export default class TurnExecutor {
 
 		await this.#hooks.processTurn(rummy);
 
-		const systemPrompt =
-			await this.#hooks.instructions.resolveSystemPrompt(rummy);
+		// Run persona feeds the assembly.system chain (persona plugin's
+		// participant at priority 150). Loaded once per turn; the system
+		// prompt is built directly by the chain — no resolveSystemPrompt
+		// indirection.
+		const runRow = await this.#db.get_run_by_id.get({ id: currentRunId });
 
 		const budgetCtx = {
 			runId: currentRunId,
 			loopId: currentLoopId,
 			turn,
-			systemPrompt,
+			systemPrompt: "",
+			persona: runRow.persona,
 			mode,
 			toolSet,
 			loopIteration,
@@ -103,6 +108,7 @@ export default class TurnExecutor {
 		const initial = await materializeContext({
 			db: this.#db,
 			hooks: this.#hooks,
+			entries: this.#entries,
 			contextSize,
 			...budgetCtx,
 		});
@@ -113,18 +119,22 @@ export default class TurnExecutor {
 			rowCount: initial.rows.length,
 		});
 
-		const budgetResult = await this.#hooks.budget.enforce({
-			contextSize,
-			messages: initial.messages,
-			rows: initial.rows,
-			lastPromptTokens: initial.lastContextTokens,
-			ctx: budgetCtx,
-			rummy,
-		});
-		const messages = budgetResult.messages;
-		const assembledTokens = budgetResult.assembledTokens;
+		const dispatchPacket = await this.#hooks.turn.beforeDispatch.filter(
+			{
+				contextSize,
+				messages: initial.messages,
+				rows: initial.rows,
+				lastPromptTokens: initial.lastContextTokens,
+				assembledTokens: 0,
+				ok: true,
+				overflow: null,
+			},
+			{ rummy, ctx: budgetCtx },
+		);
+		const messages = dispatchPacket.messages;
+		const assembledTokens = dispatchPacket.assembledTokens;
 
-		if (!budgetResult.ok) {
+		if (!dispatchPacket.ok) {
 			return {
 				turn,
 				turnId: turnRow.id,
@@ -133,11 +143,10 @@ export default class TurnExecutor {
 				updateText: null,
 				assembledTokens,
 				contextSize,
-				overflow: budgetResult.overflow,
+				overflow: dispatchPacket.overflow,
 			};
 		}
 
-		const runRow = await this.#db.get_run_by_id.get({ id: currentRunId });
 		const filteredMessages = await this.#hooks.llm.messages.filter(messages, {
 			model: requestedModel,
 			projectId,
@@ -180,6 +189,35 @@ export default class TurnExecutor {
 					contextSize,
 				};
 			}
+			// LLM fetch hit its per-call ceiling (provider's
+			// AbortSignal.timeout(FETCH_TIMEOUT) fired). Convert to a
+			// 504 strike so the loop continues — one timed-out turn is
+			// recoverable; MAX_STRIKES in a row abandon at 499. Without
+			// this catch the AbortError escapes to AgentLoop's outer
+			// catch and the run dies at status=500, losing all prior
+			// productive turns. signal.aborted being true means OUR
+			// controller fired (drain), not a fetch timeout — re-throw
+			// so AgentLoop ends the run cleanly at 499.
+			if (err?.name === "TimeoutError" || err?.name === "AbortError") {
+				if (signal?.aborted) throw err;
+				await this.#hooks.error.log.emit({
+					store: this.#entries,
+					runId: currentRunId,
+					turn,
+					loopId: currentLoopId,
+					message: `LLM call timed out: ${err.message}`,
+					status: 504,
+				});
+				return {
+					turn,
+					turnId: turnRow.id,
+					recorded: [],
+					summaryText: null,
+					updateText: null,
+					assembledTokens,
+					contextSize,
+				};
+			}
 			throw err;
 		}
 		const result = await this.#hooks.llm.response.filter(rawResult, {
@@ -196,6 +234,10 @@ export default class TurnExecutor {
 		const content = responseMessage?.content ? responseMessage.content : "";
 
 		const { commands, warnings, unparsed } = XmlParser.parse(content);
+		// Parser warnings are recovered emissions — the parser already
+		// corrected a mismatched/unclosed tag and produced commands. Log
+		// them so the model sees what happened, but don't strike: the
+		// turn's productive work is intact.
 		for (const w of warnings) {
 			await this.#hooks.error.log.emit({
 				store: this.#entries,
@@ -204,6 +246,7 @@ export default class TurnExecutor {
 				message: w,
 				loopId: currentLoopId,
 				status: 422,
+				soft: true,
 			});
 		}
 		if (commands.length === 0 && unparsed?.trim() && warnings.length === 0) {
@@ -217,6 +260,27 @@ export default class TurnExecutor {
 			});
 		}
 
+		// Contract floor: a turn without <update> is malformed; refuse to
+		// honor its side effects. Repetition loops, partial outputs, and
+		// other broken responses commonly emit actions without closure;
+		// dispatching them anyway lets a broken turn corrupt state. Skip
+		// recording AND dispatching when commands are present but no
+		// <update> closes the turn — the strike system still fires via
+		// turnErrors, model retries cleanly next turn.
+		const hasUpdate = commands.some((c) => c.name === "update");
+		const skipDispatch = commands.length > 0 && !hasUpdate;
+		if (skipDispatch) {
+			await this.#hooks.error.log.emit({
+				store: this.#entries,
+				runId: currentRunId,
+				turn,
+				loopId: currentLoopId,
+				message:
+					"Turn rejected: no <update> emitted. Actions are not honored unless the turn ends with an <update>.",
+				status: 422,
+			});
+		}
+
 		// Layer plugin reasoning contributions onto the API-provided seed.
 		if (responseMessage) {
 			const seed = responseMessage.reasoning_content
@@ -242,17 +306,19 @@ export default class TurnExecutor {
 			userMsg: userMsg?.content,
 		});
 
-		// PHASE 1: RECORD
+		// PHASE 1: RECORD (skipped when skipDispatch — broken turn, no side effects)
 		const recorded = [];
-		for (const cmd of commands) {
-			const entry = await this.#record(
-				currentRunId,
-				currentLoopId,
-				turn,
-				mode,
-				cmd,
-			);
-			if (entry) recorded.push(entry);
+		if (!skipDispatch) {
+			for (const cmd of commands) {
+				const entry = await this.#record(
+					currentRunId,
+					currentLoopId,
+					turn,
+					mode,
+					cmd,
+				);
+				if (entry) recorded.push(entry);
+			}
 		}
 
 		// PHASE 2: DISPATCH — sequential; abort-after-failure; proposals notify-and-await.
@@ -334,7 +400,7 @@ export default class TurnExecutor {
 			}
 		}
 
-		await this.#hooks.budget.postDispatch({
+		await this.#hooks.turn.dispatched.emit({
 			contextSize,
 			ctx: budgetCtx,
 			rummy,
@@ -379,8 +445,11 @@ export default class TurnExecutor {
 		if (cmd.path) rawTarget = cmd.path;
 		else if (cmd.command) rawTarget = cmd.command;
 		else if (cmd.question) rawTarget = cmd.question;
-		// Reject likely reasoning bleed: oversize or control chars in target.
-		if (rawTarget.length > 512 || /\p{Cc}/u.test(rawTarget)) {
+		// Reject reasoning-bleed in path-shaped fields only. cmd.command
+		// (sh/env shell scripts) and cmd.question (ask_user prose) are
+		// content fields where newlines/tabs/length are legitimate; the
+		// slugifier sanitizes them downstream when deriving the log path.
+		if (cmd.path && (cmd.path.length > 2048 || /\p{Cc}/u.test(cmd.path))) {
 			const rejectPath = await this.#entries.logPath(
 				runId,
 				turn,
@@ -391,7 +460,7 @@ export default class TurnExecutor {
 				runId,
 				turn,
 				path: rejectPath,
-				body: `Invalid path: too long or contains non-printing characters`,
+				body: "Invalid path.",
 				state: "failed",
 				outcome: "validation",
 				attributes: { action: scheme },

package/src/agent/XmlParser.js

@@ -1,6 +1,47 @@
-import { parseEditContent } from "../plugins/hedberg/edits.js";
-import { parseJsonEdit } from "../plugins/hedberg/normalize.js";
-import { parseSed } from "../plugins/hedberg/sed.js";
+import {
+	extractSingleHeredoc,
+	parseMarkerBody,
+} from "../lib/hedberg/marker.js";
+
+// Edit-marker body opacity. When `#findBodyEnd` is scanning a `<set>`
+// body and hits an opener, jump past the matching closer so tag-shaped
+// content inside the marker (`</set>`, `<get/>`, etc.) doesn't trigger
+// structural recovery.
+//
+// Two opener shapes are recognized for opacity:
+//   - `<<IDENT` — current edit syntax (parsed by marker.js).
+//   - `<<:::IDENT` — packet-rendering shape (engine emits via
+//     plugins/helpers.js). A model copy-pasting the packet shape into
+//     a `<set>` body should still get clean opacity even though
+//     marker.js routes such bodies to plain-body REPLACE.
+function skipBareMarker(s, pos) {
+	const m = s.slice(pos).match(/^<<([A-Z][A-Za-z0-9_]*)/);
+	if (!m) return null;
+	const ident = m[1];
+	const openerEnd = pos + m[0].length;
+	const escIdent = ident.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	const closerRe = new RegExp(`(?<=^|\\s)${escIdent}(?=[\\s<>]|$)`);
+	const cm = s.slice(openerEnd).match(closerRe);
+	if (!cm) return null;
+	return openerEnd + cm.index + cm[0].length;
+}
+
+function skipPacketMarker(s, pos) {
+	const m = s.slice(pos).match(/^<<:::([A-Za-z_][A-Za-z0-9_./-]*)/);
+	if (!m) return null;
+	const ident = m[1];
+	const openerEnd = pos + m[0].length;
+	const escIdent = ident.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	const closerRe = new RegExp(`:::${escIdent}(?![A-Za-z0-9_])`);
+	const cm = s.slice(openerEnd).match(closerRe);
+	if (!cm) return null;
+	return openerEnd + cm.index + cm[0].length;
+}
+
+function skipEditMarker(s, pos) {
+	if (s.startsWith("<<:::", pos)) return skipPacketMarker(s, pos);
+	return skipBareMarker(s, pos);
+}
 
 const STORE_TOOLS = new Set(["get", "rm", "set", "mv", "cp", "search"]);
 export const ALL_TOOLS = new Set([
@@ -14,69 +55,43 @@ export const ALL_TOOLS = new Set([
 
 // Per-tool resolution: missing canonical attribute is filled silently from the body.
 function resolveCommand(name, a, rawBody) {
+	// Generic heredoc affordance: any non-`<set>` plugin's body may be
+	// wrapped in a single `<<IDENT...IDENT` heredoc to opaquely contain
+	// multi-line scripts, tag-shaped prose, or content with special
+	// characters. Plugins consume the unwrapped inner body verbatim;
+	// the IDENT is exposed as `heredocIdent` on the command for plugins
+	// that want to act on the label. `<set>` is exempt because it does
+	// its own multi-op heredoc parsing via `parseMarkerBody`.
+	if (name !== "set") {
+		const heredoc = extractSingleHeredoc(rawBody);
+		if (heredoc) {
+			rawBody = heredoc.content;
+			a = { ...a, heredocIdent: heredoc.ident };
+		}
+	}
 	const trimmed = rawBody.trim();
 
 	if (name === "set") {
-		const hasEdit =
-			/<{3,12} SEARCH/.test(trimmed) ||
-			/>{3,12} REPLACE/.test(trimmed) ||
-			(trimmed.includes("@@") &&
-				(trimmed.includes("\n-") || trimmed.includes("\n+"))) ||
-			trimmed.includes("<old_text>");
-		if (hasEdit) {
-			const blocks = parseEditContent(rawBody);
-			if (blocks.length > 0) {
-				return {
-					name,
-					path: a.path,
-					body: a.body,
-					manifest: a.manifest,
-					blocks,
-				};
-			}
-		}
-		const jsonEdit = parseJsonEdit(trimmed);
-		if (jsonEdit) {
-			return { name, path: a.path, ...jsonEdit };
-		}
-		if (trimmed.startsWith("s/")) {
-			const blocks = parseSed(trimmed);
-			if (blocks?.length === 1) {
-				return {
-					name,
-					path: a.path,
-					search: blocks[0].search,
-					replace: blocks[0].replace,
-					flags: blocks[0].flags,
-					sed: true,
-				};
-			}
-			if (blocks?.length > 1) {
-				return { name, path: a.path, blocks };
-			}
-		}
-		if (a.search) {
-			const replace = a.replace ?? trimmed;
-			return {
-				name,
-				path: a.path,
-				body: a.body,
-				manifest: a.manifest,
-				search: a.search,
-				replace,
-			};
-		}
-		if (trimmed && a.body) {
-			return {
-				name,
-				path: a.path,
-				search: a.body,
-				replace: trimmed,
-				manifest: a.manifest,
-			};
-		}
-		const body = trimmed || a.body || "";
-		return { name, ...a, body };
+		// `search`/`replace` as attributes is no longer in the grammar;
+		// strip them so they can't sneak past via the attribute spread.
+		const { search: _s, replace: _r, ...rest } = a;
+		a = rest;
+
+		// Self-close / no-body: visibility/metadata op.
+		if (!trimmed) return { name, ...a, body: a.body || "" };
+
+		// Edit syntax (SPEC.md "Edit Syntax"): walks the body for
+		// `<<:::IDENT...:::IDENT` markers and returns an ordered op
+		// list. No markers → plain body, treated as full-replace.
+		// Non-keyword IDENTs (path-flavored, identifier-flavored)
+		// route to REPLACE so the model gets a working write whatever
+		// IDENT it picks.
+		const { ops, error } = parseMarkerBody(rawBody);
+		if (error) return { name, ...a, error };
+		if (ops) return { name, ...a, operations: ops };
+
+		// No markers — plain body, full-replace.
+		return { name, ...a, body: trimmed };
 	}
 
 	if (name === "update") {
@@ -85,55 +100,80 @@ function resolveCommand(name, a, rawBody) {
 		return { name, ...a, body, status };
 	}
 
+	// Body shorthand fallback: when the attribute is unset (undefined),
+	// fall back to the trimmed body. Empty-string attrs are preserved
+	// as-is — handlers validate. `||` would conflate the two cases.
+	const fromBody = trimmed === "" ? null : trimmed;
+
 	if (name === "get" || name === "rm") {
-		return { name, ...a, path: a.path || trimmed || null };
+		return { name, ...a, path: a.path ?? fromBody };
 	}
 
 	if (name === "search") {
-		const path = a.path || trimmed || null;
+		const path = a.path ?? fromBody;
 		const results = a.results ? Number(a.results) : null;
 		return { name, ...a, path, results };
 	}
 
 	if (name === "mv" || name === "cp") {
-		return { name, ...a, path: a.path, to: a.to || trimmed || null };
+		return { name, ...a, path: a.path, to: a.to ?? fromBody };
 	}
 
 	if (name === "sh" || name === "env") {
-		const command = a.command || trimmed || null;
+		const command = a.command ?? fromBody;
 		return { name, ...a, command };
 	}
 
 	if (name === "ask_user") {
-		const question = a.question || null;
-		const options = a.options || trimmed || null;
+		const question = a.question ?? null;
+		const options = a.options ?? fromBody;
 		return { name, ...a, question, options };
 	}
 
-	return { name, ...a, body: trimmed || a.body };
+	return { name, ...a, body: trimmed === "" ? a.body : trimmed };
 }
 
 const NAME_CHAR = /[a-zA-Z0-9_]/;
 const ATTR_KEY_CHAR = /[a-zA-Z0-9_:-]/;
 const WS = /\s/;
 
-// Recovery-tolerant tokenizer for rummy's closed set of tool tags.
+// Tokenizer for rummy's closed set of tool tags. Body opacity for closed
+// bodies; tail recovery for unclosed bodies.
 //
 // Design contract:
 //   - Tool tags (<get>, <set>, <sh>, ...) are the only syntactic special tags.
 //     Any other "<...>" sequence in OUTER text is treated as literal text.
-//   - Inside a tool tag's body, content is OPAQUE: only the matching close
-//     tag is recognized. Body may contain regex (`(?<!`), generics (`Vec<u8>`),
-//     HTML, XML, heredocs, comparison operators — none of it affects parsing.
-//   - Backtick spans (`...`) and triple-backtick fences (```...```) at the
-//     OUTER level neutralize tag-like content, mirroring the markdown
-//     convention that documentation about a tool isn't a tool call.
-//     Inside tool bodies this tracking does NOT apply (body opacity wins).
+//   - Inside a tool tag's body, content is OPAQUE: only the matching
+//     `</tagname>` close (depth-counted for same-name nesting) ends the
+//     body. Mismatched closes of OTHER tag names — `</env>`, `</mv>`,
+//     `</foo>` inside a `<set>` body — are body content, not structural
+//     signals.
+//   - Backtick spans (`...`) and triple-backtick fences (```...```)
+//     suppress tag recognition AT THE OUTER LEVEL ONLY (between tool
+//     calls). Documentation prose with backticked tag examples doesn't
+//     get parsed as commands. Inside tool bodies backticks are content;
+//     bodies that need opacity for tag-like content use the edit-syntax
+//     marker family (see SPEC.md "Edit Syntax"), which has no
+//     false-positive failure modes (unlike inside-body backtick
+//     tracking, which would suppress closing tags on bodies with stray
+//     unbalanced backticks).
+//   - Edit-syntax marker opacity (set only): `<<:::IDENT...:::IDENT`
+//     spans inside a `<set>` body are skipped during tag detection so
+//     content with `</set>` literals or marker-shaped text stays as
+//     body. Multiple markers per body supported; see marker.js.
 //   - Same-name nesting (`<set>...<set/>...</set>`) is depth-counted so
-//     nested examples don't prematurely close the outer.
-//   - Recovery: unclosed openers capture body to EOF + emit a warning.
-//     Orphan closes at outer level become text, no warning (body opacity
-//     means models legitimately write `</set>` in prose / summaries).
+//     nested examples don't prematurely close the outer. Same-name
+//     nesting also disables tail recovery — the model's intent is clearly
+//     opaque body content.
+//   - Unclosed openers (no matching close, no same-name nesting) try
+//     tail recovery: scan the captured body for the leftmost position
+//     whose suffix tokenizes cleanly into ≥1 well-formed tool calls
+//     with zero leftover text. If found, end the unclosed body there
+//     and let the trailing tags parse as proper siblings. The warning
+//     surfaces "Unclosed <name> — recovered N trailing tool call(s)"
+//     so the model can see what happened. If recovery finds nothing,
+//     capture body to EOF and emit "Unclosed <name> — content captured
+//     anyway".
 export default class XmlParser {
 	static MAX_COMMANDS = Number(process.env.RUMMY_MAX_COMMANDS);
 
@@ -197,11 +237,13 @@ export default class XmlParser {
 			const result = XmlParser.#findBodyEnd(s, name, openerEnd);
 			const body = s.slice(openerEnd, result.bodyEnd);
 			if (result.unclosed) {
-				warnings.push(`Unclosed <${name}> tag — content captured anyway`);
-			} else if (result.mismatchedCloseName) {
-				warnings.push(
-					`Mismatched </${result.mismatchedCloseName}> closing <${name}> — corrected to </${name}>`,
-				);
+				if (result.recoveredTailCount) {
+					warnings.push(
+						`Unclosed <${name}> tag — recovered ${result.recoveredTailCount} trailing tool call(s)`,
+					);
+				} else {
+					warnings.push(`Unclosed <${name}> tag — content captured anyway`);
+				}
 			}
 			commands.push(resolveCommand(name, attrs, body));
 			i = result.afterClose;
@@ -327,18 +369,42 @@ export default class XmlParser {
 
 	// Scans body content from `fromPos` until the matching `</name>` closer,
 	// counting depth so same-name nested examples don't prematurely close.
-	// Returns { bodyEnd, afterClose, unclosed, mismatchedCloseName }.
+	// Returns { bodyEnd, afterClose, unclosed }.
+	//
+	// Strict body opacity: only `</name>` (matching the open) and same-name
+	// nested opens affect parsing. Mismatched closes of OTHER tag names are
+	// body content, period.
+	//
+	// Backtick fences (`…`, ```…```) inside the body suppress all tag
+	// recognition — a markdown table cell containing `<set>` examples
+	// stays as content, not interpreted as a nested tag. This matches
+	// the outer-level convention and is the load-bearing reason a model
+	// can write documentation about rummy commands inside a deliverable
+	// body without breaking parsing.
 	//
-	// Mismatched-close recovery: if we encounter `</X>` where X != name and X
-	// is not a depth-counted nested tag, we use a balance heuristic to decide
-	// whether the orphan close was a typo (recover here) or legitimate body
-	// content (continue scanning). Specifically: count `</name>` minus
-	// `<name` in the rest of the string; if non-positive, no real close
-	// exists ahead and the orphan must be the intended close.
+	// If the matching close never arrives, emit "Unclosed" so the model
+	// sees a clear failure and corrects on the next turn.
 	static #findBodyEnd(s, name, fromPos) {
 		let depth = 1;
+		let sameNameNested = false;
 		let i = fromPos;
 		while (i < s.length) {
+			// Edit-syntax marker opacity: marker spans (bare `<<IDENT` or
+			// packet-shaped `<<:::IDENT`) are opaque — tag detection
+			// skips them so inner `</set>` and other tag-shaped content
+			// stays as body. Multiple markers per `<set>` body are
+			// supported; check on every iteration.
+			if (
+				name === "set" &&
+				(s.startsWith("<<:::", i) ||
+					(s.startsWith("<<", i) && /^[A-Z]/.test(s[i + 2] ?? "")))
+			) {
+				const skipTo = skipEditMarker(s, i);
+				if (skipTo != null) {
+					i = skipTo;
+					continue;
+				}
+			}
 			if (s[i] !== "<") {
 				i++;
 				continue;
@@ -360,35 +426,64 @@ export default class XmlParser {
 					i = k + 1;
 					continue;
 				}
-
-				if (isCloseTag && closeName.length > 0) {
-					const rest = s.slice(k + 1);
-					const closesAhead = (
-						rest.match(new RegExp(`<\\/${name}\\b\\s*>`, "g")) || []
-					).length;
-					const opensAhead = (rest.match(new RegExp(`<${name}\\b`, "g")) || [])
-						.length;
-					if (closesAhead - opensAhead < 1) {
-						return {
-							bodyEnd: i,
-							afterClose: k + 1,
-							unclosed: false,
-							mismatchedCloseName: closeName,
-						};
-					}
-				}
 			}
 			const opener = XmlParser.#matchOpener(s, i);
 			if (opener && opener.name === name && !opener.selfClose) {
 				depth++;
+				sameNameNested = true;
 				i = opener.end;
 				continue;
 			}
 			i++;
 		}
+		// Unclosed: try tail recovery, but only if the body never
+		// nested a same-name opener. Same-name nesting is the model
+		// deliberately using opaque body for examples (`<set>` writing
+		// docs about `<set>`); we trust the body content as authored.
+		// No nesting means a plain botched `</set>` — recovery is safe.
+		// If the body's tail is a clean sequence of one or more
+		// well-formed tool calls (zero leftover text), end the body
+		// at the start of that tail and let the outer tokenizer parse
+		// those calls as proper siblings. Closes the silent-swallow
+		// gap when a model botches `</set>` after SEARCH/REPLACE and
+		// emits trailing `<sh>` / `<update>`.
+		if (sameNameNested) {
+			return { bodyEnd: s.length, afterClose: s.length, unclosed: true };
+		}
+		const recovery = XmlParser.#findTailRecovery(s, fromPos);
+		if (recovery) {
+			return {
+				bodyEnd: recovery.tailStart,
+				afterClose: recovery.tailStart,
+				unclosed: true,
+				recoveredTailCount: recovery.commandCount,
+			};
+		}
 		return { bodyEnd: s.length, afterClose: s.length, unclosed: true };
 	}
 
+	// Scan body content for the leftmost position whose suffix tokenizes
+	// cleanly into ≥1 commands with no leftover non-whitespace text.
+	// Returns { tailStart, commandCount } or null. Only considers opener
+	// positions; treats the suffix as outer-level so backtick fences and
+	// tag recognition match the parent tokenizer's behavior.
+	static #findTailRecovery(s, fromPos) {
+		let best = null;
+		let i = fromPos;
+		while (i < s.length) {
+			if (s[i] === "<" && XmlParser.#matchOpener(s, i)) {
+				const suffix = s.slice(i);
+				const result = XmlParser.#tokenize(suffix, []);
+				if (result.commands.length > 0 && result.unparsed === "") {
+					best = { tailStart: i, commandCount: result.commands.length };
+					break;
+				}
+			}
+			i++;
+		}
+		return best;
+	}
+
 	// Translate native training-format tool calls into rummy XML silently.
 	static #normalizeToolCalls(content) {
 		// Gemma code-fenced XML.

package/src/agent/errors.js

@@ -1,3 +1,21 @@
+// Outcomes that record a failure but don't strike — findings the model
+// adapts to, not contract violations. `not_found` (model acted on an
+// entry that doesn't exist) and `conflict` (SEARCH text didn't match
+// current body) are recoverable: read the new state, try again.
+// `unparsed` (free text outside any tool tag — comments, "thinking
+// out loud" between tool calls) is non-actionable but not malicious;
+// the empty-turn failure mode is already caught by update plugin's
+// 422 "Missing update", so striking unparsed too is duplicative.
+// Hard outcomes (validation, permission, exit:N) DO strike. Shared
+// between error.js's verdict accumulator (recordedFailed gate) and
+// Entries' auto-failure hook (passes soft=true so error.log.emit
+// skips turn errors increment when the outcome is soft).
+export const SOFT_FAILURE_OUTCOMES = new Set([
+	"not_found",
+	"conflict",
+	"unparsed",
+]);
+
 // Writer tier excluded from scheme.writable_by; see SPEC writer_tiers.
 export class PermissionError extends Error {
 	constructor(scheme, writer, allowed) {
@@ -14,3 +32,20 @@ export class PermissionError extends Error {
 		this.allowed = [...allowed];
 	}
 }
+
+// Body length exceeded the entries.body CHECK constraint (RUMMY_ENTRY_SIZE_MAX
+// at create-time). Surfaced as a 413 strike. The cap value lives only in the
+// schema — JS does not duplicate it, because the database persists across
+// rummy invocations and the env var that built the schema may differ from
+// the env var seen by the running instance. Reporting body size is enough
+// for the model to adapt; operators can read the cap from the schema.
+export class EntryOverflowError extends Error {
+	constructor(path, size) {
+		super(
+			`413: entry "${path}" body ${size} bytes exceeds RUMMY_ENTRY_SIZE_MAX`,
+		);
+		this.name = "EntryOverflowError";
+		this.path = path;
+		this.size = size;
+	}
+}