@sigrun/sigrun 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -5,6 +5,61 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.0] - 2026-11-06
+
+### Added
+
+- Jobs editor in the `core/jobs` view: a New job form (prompt jobs, schedule cron/every/once,
+  model + thinking pickers from the served catalogue), Edit/Delete for api jobs (edit preserves
+  conversation/deliver/runSharing/task targets; clearing the description removes it), details
+  and provenance rows (Defined in / Owner / action fields) with a read-only callout for declared
+  (`file:`/`ext:`) jobs, and the job description as the sidebar row subtitle.
+- `description` on `JobSpec` (optional, trimmed, ≤ 500 chars) for every job source — settings.json
+  boot-gates an invalid one; an extension's declaration quarantines.
+- TUI: extension views (Jobs, Skills, every extension surface) now render in the main pane with
+  key routing, Esc back-to-list/close, overlay-aware Esc, notice flashes on the status bar, and
+  block navigation (row activation, page actions like New job, post-action navigation) — plus a
+  fix for the TUI ext-transport URL builder (suffix routes were appended after `?params=`).
+- Live refresh for principal-scoped views (`core/jobs`, `core/skills`, curator): both clients'
+  surface hubs now dispatch `surface.changed` by (slug, id) instead of a client-side params hash
+  that never matched the server's principal-scoped key — background job runs now appear in an
+  open view without a reload.
+
+## [0.9.0] - 2026-11-05
+
+### Added
+
+- Decision providers: a factory result's `decisionProviders` contributes typed-question models
+  (noul / choice / score) keyed in `auth.json` with a `credentialEnv` fallback; credentials write
+  through `PUT/DELETE /v1/providers/:id/credential` (a decision-only id re-reads readiness
+  instead of refreshing). `host.decisions.evaluate` (never throws; validated against the wire
+  schema and the model's limits; a 15 s deadline capped by `server.decisions.timeoutMs` /
+  `SIGRUN_DECISION_TIMEOUT_MS`), the `decisionModel` setting (live), decision entries with
+  `kind` + model ids on `GET /v1/providers`, a `decisions` projection on `GET /v1/meta`, and the
+  opt-in `decision_evaluate` tool (`decisions.tool`, default false). Docs:
+  "Contributing decision providers" in docs/extending.md.
+- `host.jobs.activeRun(conversationId)`: the job whose fire is CURRENTLY running in a
+  conversation (both fire shapes), with its effective owner — the unattended-run marker
+  extensions need to route destructive calls. Fixed-conversation fires settle their runs via the
+  submission's `job:` requestId (no meta stamp; a fire into an existing conversation does not
+  mark its later runs job-driven).
+- `host.models.complete(input)`: one-shot chat completions for extensions (no conversation);
+  explicit model → `namingModel` → default, `role: "utility"`, a 60 s default timeout, both the
+  timer and the caller's signal bounding the wait.
+- Declinable interaction records: `declinable: true` marks a pending record declinable;
+  `POST /v1/conversations/:id/interactions/:callId/decline` (write access) settles it
+  `skipped` with `declinedVia: "button"` (404 `no_such_interaction` / 404 `not_pending` /
+  409 `not_declinable`); `host.declineInteraction(conversationId, callId, context, {user})`
+  is the extension-side peer; `interactionSettled` payloads carry `declinedVia`. Declining
+  sweeps the record's unread secret delivery inside the same commit.
+- Interactive tools: a factory result's `interactiveTools` names the registered tools that
+  need a human present. Core hides them in job-run conversations (`conversation: "new"`
+  fires, `host.conversations.create({job})`) and curator runs (digest agents exclude them;
+  every run's `allow` list loses them with one warning; fork reviews keep them listed for
+  prompt-cache parity and the gate blocks a call instead). `host.jobs.isJobRun` tells an
+  interactive tool's execute whether the current run is job-driven (a job firing into an
+  existing conversation is not covered by the creation-time filter — refuse there).
+
 ## [0.8.0] - 2026-11-04
 
 Core notices: a per-user notice system for extensions. An extension posts a short notice
@@ -91,93 +146,6 @@ fresh-eyes clean-room install verification.
 
 - Release-pin bump to 0.6.1 (root, shared, tui, sandbox platform packages, chart appVersion, compose defaults).
 
-## [Unreleased]
-
-### Added
-- **Core notices** — a per-user message channel with buttons. An
-  extension posts a short notice to ONE directory user through
-  `host.notices` (`post`/`clear`/`list`); `noticeActions` on the factory
-  result declares the handlers its `extension` buttons may name. A
-  notice is title + body + up to three actions (`navigate`, `open` —
-  https only, `extension`), bounded by `NOTICE_LIMITS` and capped at 10
-  per extension / 50 per user. Nothing expires on a timer: a notice
-  clears on its ✕, the user's next prompt in that conversation, a
-  navigate/open button, a successful extension action, Clear all, the
-  posting extension's `clear`, or eviction past a cap. Nobody but the
-  addressed user ever sees one (a foreign id answers 404, never 403),
-  forks never copy them, and a revoked share drops that conversation's
-  notices on the next read. `GET /v1/notices`,
-  `POST /v1/notices/{id}/dismiss`, `POST /v1/notices/dismiss-all`,
-  `POST /v1/notices/{id}/actions/{actionId}`, and the user-only
-  `notice.changed` event. Store: `<dataDir>/users/<user>/notices.json`
-  (inside the `data` backup section).
-- **Notices UI** — a bell with a count on every tab (rail on desktop,
-  tab header on phones), a notices pane that docks on Chats and slides
-  over every other tab, an inline stack above the composer (at most
-  three, then "N more"), and a 6 s peek that never takes focus. The TUI
-  gains an inline line, a status-bar count, and an overlay
-  (`ctrl+g` / `gN` / `M-N`).
-- **Ambient buttons work (webui).** The webui's ambient renderer now
-  dispatches `navigate` and `open` actions (links open with
-  `rel="noopener noreferrer"`) instead of dropping them. The TUI's
-  ambient dispatcher is wired the same way but has no production caller
-  yet.
-- **Views are tabs (webui).** The webui shell registers views as rail
-  tabs with remembered routes; the chat view keeps the conversation
-  list and right panel to itself. Below the tablet breakpoint a phone
-  bottom tab bar (with a More sheet) replaces the rail.
-- **`page.selection`** — a server-declared, presentation-only
-  list-first drill-in for compact widths (`{selected, back}` on a
-  `page`; webui and TUI render it, `toText` ignores it).
-- **Core views.** Core attaches its own view surfaces under the
-  reserved `core` slug and lists them as `coreViews` (one
-  `CoreViewInfo {id, title, icon, refreshMs?}` per view) on
-  `/v1/extensions` and `/v1/meta`; they are never `extensions[]` rows,
-  so the health dot is unaffected. `job.changed` now bumps every
-  rendered core/jobs instance.
-- **The Jobs tab** (`core/jobs`): the jobs surface as a core blocks
-  view — sidebar of the caller-visible jobs, drill-in with summary,
-  paged runs and revisions (a selected revision diffs its spec JSON
-  against the previous one), Run now / Reset state for write access,
-  and per-row navigation into a run's conversation. The Jobs panel is
-  gone.
-- **The Skills tab** (`core/skills`): every skill root the deployment
-  serves — Workspace / Learned / Config dir (the deployment-wide
-  `<config-dir>/skills/`, read-only) / one group per installed package
-  (`· <pkg>`, with a per-row package badge) / Deleted — with shadowing visible, owned-skill CRUD, per-skill git
-  history (25 entries per page, per-file diffs, restore), deleted-skill
-  restore, and per-user overlays as the only write to the read-only
-  shared roots. Some surface actions return `navigate`; the webui
-  applies that navigation, the TUI does not yet (a known channel gap).
-- **Every-root skill discovery** (`src/skills/roots.ts`): workspace,
-  learned, user dir, and every installed package's skills listed in one
-  pass, with precedence/shadowing resolution and symlink-safe reads.
-- **GitHistory** (`src/history/git.ts`) — isolated local git for
-  sigrun-owned history stores: execFile with explicit `--git-dir` /
-  `--work-tree`, a hermetic git env, per-repo locking, and fail-soft
-  writes (a broken repo is quarantined aside and re-initialized;
-  mutations never fail because history did).
-- **Curation stores on git** (Task 9): each user's learned skills,
-  overlays, and curator state live in a per-user git history repo; the
-  change feed's `actor` widens to `"outside"` and its `id`/`before`/
-  `after` are commit SHAs. A once-per-process migration imports the
-  pre-git store (the legacy files are left read-only, outside the
-  repo's pathspec).
-- **Workspace skills history** (Task 10): the workspace `skills/`
-  tree gets its own per-user repo (git dir outside the work tree),
-  caught up on settled runs and tab opens; ownerless conversations
-  skip it.
-
-### Changed
-- **The curation seal**: workspaces and grants that sit inside or
-  contain a user's `curation/` tree are rejected; boot revalidates
-  stored records and names each failing one loudly. A user whose
-  workspace was the bare user area loses agent tools until an admin
-  re-points it: `PATCH /v1/users/<u> {"workspace": "<userArea>/workspace"}`.
-  History tamper-resistance holds under active sandbox isolation; a
-  single-user install without isolation runs the agent unsandboxed
-  (the existing trust model).
-
 ## [0.6.0] - 2026-11-02
 
 ### Added

package/dist/config.js

@@ -20,6 +20,28 @@ import { deriveUsername, isUsernameKey } from "@sigrun/shared/usernames";
 export const DEFAULT_MODEL_ENV = "SIGRUN_DEFAULT_MODEL";
 /** Deprecated alias for {@link DEFAULT_MODEL_ENV} (warns once per boot). */
 export const DEPRECATED_MODEL_ENV = "SIGRUN_MODEL";
+/**
+ * The published-hook call deadline (knowledge C7, Task 2):
+ * `SIGRUN_PUBLISHED_HOOK_DEADLINE`, over the file's
+ * `server.publishedHookDeadlineMs`, default 30000 ms. Its own knob, NOT
+ * the memory-seam `SIGRUN_HOOK_DEADLINE` (hook calls can sit on the
+ * reply path; the memory knob tunes background handlers). A positive
+ * integer; `parseMemorySeamCount`'s posture (fail loud, `""` is unset).
+ */
+export const PUBLISHED_HOOK_DEADLINE_ENV = "SIGRUN_PUBLISHED_HOOK_DEADLINE";
+/** The published-hook deadline default (30 s). */
+export const DEFAULT_PUBLISHED_HOOK_DEADLINE_MS = 30_000;
+/**
+ * The decision-provider call timeout (warden Task 6):
+ * `SIGRUN_DECISION_TIMEOUT_MS`, over the file's
+ * `server.decisions.timeoutMs`, default 15000 ms — both the default AND
+ * the cap for one `host.decisions.evaluate` call (`min(timeoutMs, cap)`).
+ * A positive integer; `parseMemorySeamCount`'s posture (fail loud,
+ * `""` is unset).
+ */
+export const DECISION_TIMEOUT_ENV = "SIGRUN_DECISION_TIMEOUT_MS";
+/** The decision timeout default (15 s). */
+export const DEFAULT_DECISION_TIMEOUT_MS = 15_000;
 /** The provider id used when the model spec carries no `provider/` prefix. */
 export const DEFAULT_PROVIDER = "openai";
 /**
@@ -820,6 +842,8 @@ export function resolvedServerSection(config) {
         ...(webui === undefined ? {} : { webui }),
         compaction: { ...config.compaction },
         memorySeam: { ...config.memorySeam },
+        publishedHookDeadlineMs: config.publishedHookDeadlineMs,
+        decisions: { ...config.decisions },
         isolation: { ...config.isolation },
         providers: { ...config.providers },
         ...(auth === undefined ? {} : { auth }),
@@ -860,6 +884,8 @@ export function resolvedServerSection(config) {
  * | `SIGRUN_IDLE_THRESHOLD` | `memorySeam.idleThresholdMs` |
  * | `SIGRUN_WORKER_DEADLINE` | `memorySeam.workerDeadlineMs` |
  * | `SIGRUN_QUEUE_MAX` | `memorySeam.queueMax` |
+ * | `SIGRUN_PUBLISHED_HOOK_DEADLINE` | `publishedHookDeadlineMs` |
+ * | `SIGRUN_DECISION_TIMEOUT_MS` | `decisions.timeoutMs` |
  * | `SIGRUN_ISOLATION` | `isolation.mode` |
  * | `SIGRUN_PROVIDER_REFRESH_MINUTES` | `providers.refreshIntervalMinutes` |
  * | `SIGRUN_BACKUP_*` | `backup` |
@@ -917,6 +943,14 @@ export function envServerSection(env) {
     });
     if (memorySeam !== undefined)
         section.memorySeam = memorySeam;
+    const publishedHookDeadlineMs = parseMemorySeamCount(env, PUBLISHED_HOOK_DEADLINE_ENV);
+    if (publishedHookDeadlineMs !== undefined) {
+        section.publishedHookDeadlineMs = publishedHookDeadlineMs;
+    }
+    const decisionTimeoutMs = parseMemorySeamCount(env, DECISION_TIMEOUT_ENV);
+    if (decisionTimeoutMs !== undefined) {
+        section.decisions = { timeoutMs: decisionTimeoutMs };
+    }
     const isolationMode = parseIsolationMode(env);
     if (isolationMode !== undefined)
         section.isolation = { mode: isolationMode };
@@ -1020,6 +1054,11 @@ export function effectiveServerSection(env, fileServer, config) {
         "memorySeam",
         "queueMax",
     ]);
+    emit("publishedHookDeadlineMs", config.publishedHookDeadlineMs, ["publishedHookDeadlineMs"]);
+    emit("decisions.timeoutMs", config.decisions.timeoutMs, [
+        "decisions",
+        "timeoutMs",
+    ]);
     emit("auth.sessionDays", config.auth.sessionDays, ["auth", "sessionDays"]);
     emit("isolation.mode", config.isolation.mode, ["isolation", "mode"]);
     emit("isolation.osUsers", config.isolation.osUsers, ["isolation", "osUsers"]);
@@ -1173,6 +1212,14 @@ export function loadConfig(env, settingsFile) {
         backupStaleAfterHours: server?.backup?.staleAfterHours ?? DEFAULT_BACKUP_STALE_AFTER_HOURS,
         compaction: parseCompaction(env, server?.compaction),
         memorySeam: parseMemorySeam(env, server?.memorySeam),
+        publishedHookDeadlineMs: parseMemorySeamCount(env, PUBLISHED_HOOK_DEADLINE_ENV) ??
+            server?.publishedHookDeadlineMs ??
+            DEFAULT_PUBLISHED_HOOK_DEADLINE_MS,
+        decisions: {
+            timeoutMs: parseMemorySeamCount(env, DECISION_TIMEOUT_ENV) ??
+                server?.decisions?.timeoutMs ??
+                DEFAULT_DECISION_TIMEOUT_MS,
+        },
         isolation: parseIsolation(env, server?.isolation),
         providers: {
             refreshIntervalMinutes: parseRefreshIntervalMinutes(env, server?.providers?.refreshIntervalMinutes),

package/dist/curation/host.js

@@ -25,6 +25,8 @@ import { digestRunRun, forkReviewRun, setChangeTargetResolver } from "./runs.js"
 import { resolveUpstream } from "./overlays.js";
 import { jobSkillRefs } from "../jobs/skills-refs.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
+/** Per-target bound for one `wantsReview` answer (C5). */
+const WANTS_REVIEW_BOUND_MS = 2000;
 /** modelCallsSince's entry-page size (cursor-walked, never a cap). */
 const MODEL_CALLS_PAGE = 500;
 /** Scan bound for the cursor walk: a broken cursor loops, a count does not. */
@@ -62,7 +64,14 @@ export function createCurationHost(deps) {
      */
     const digestFor = async (user, input, tools, deadline) => {
         const remaining = Math.max(1, deadline - Date.now());
-        return await digestRunRun({ harness, registry }, user, {
+        const runDeps = {
+            harness,
+            registry,
+            ...(deps.interactiveTools === undefined
+                ? {}
+                : { interactiveTools: deps.interactiveTools }),
+        };
+        return await digestRunRun(runDeps, user, {
             instruction: input,
             allow: tools,
             maxToolCalls: 8,
@@ -151,37 +160,83 @@ export function createCurationHost(deps) {
             return await takeHints(conversation, BACKGROUND_CONTEXT);
         },
         async targets(user, id) {
-            // The selection filter: a target is served for a conversation
-            // only when EVERY listed tool is model-visible in that
-            // conversation's resolved agent. No id: every target.
-            const visible = id === undefined ? undefined : await modelVisibleTools(id);
-            const result = [];
-            for (const target of curation.targets()) {
-                if (visible !== undefined) {
-                    if (target.tools.some((tool) => !visible.has(tool)))
-                        continue;
+            // The projection drops the C5 callbacks (the info is data —
+            // readTools rides only when the target declared it).
+            return (await servedTargets(user, id)).map((target) => ({
+                id: target.id,
+                tools: target.tools,
+                ...(target.readTools.length === 0
+                    ? {}
+                    : { readTools: target.readTools }),
+                guidance: target.guidance,
+                maintain: target.maintain,
+            }));
+        },
+        async wantsReview(user, id) {
+            // C5: any ONE served target requesting a review is enough. Each
+            // target's answer is bounded — a throw or a slow target counts
+            // as `false` with one log line naming the target (the review
+            // loop must never stall on one target's clock).
+            for (const target of await servedTargets(user, id)) {
+                if (target.wantsReview === undefined)
+                    continue;
+                let wants = false;
+                try {
+                    wants = await bounded(Promise.resolve(target.wantsReview(user, id)));
                 }
-                const guidance = await target.guidance(user);
-                if (guidance.length === 0)
+                catch (error) {
+                    console.warn(`curation: wantsReview of ${target.id} failed: ${error instanceof Error ? error.message : String(error)}`);
                     continue;
-                result.push({
-                    id: target.id,
-                    tools: [...target.tools],
-                    guidance: [...guidance],
-                    maintain: target.maintain !== undefined,
-                });
+                }
+                if (wants === true)
+                    return true;
             }
-            return result;
+            return false;
         },
         async tools(id) {
             const visible = await modelVisibleTools(id);
             return [...visible];
         },
         async forkReview(id, opts) {
-            return await forkReviewRun({ harness, registry }, id, opts);
+            const result = await forkReviewRun({
+                harness,
+                registry,
+                ...(deps.interactiveTools === undefined
+                    ? {}
+                    : { interactiveTools: deps.interactiveTools }),
+            }, id, opts);
+            // C5: after a COMPLETED review, tell every served target the
+            // review consumed its hints — the target's signal to retire
+            // them (errors caught and logged; a target never blocks the
+            // result). Owner read from the conversation's SessionMetaDoc,
+            // as the run driver does; other statuses and an ownerless
+            // conversation fire nothing.
+            if (result.status !== "completed")
+                return result;
+            const meta = await harness.snapshot(SessionMetaDoc, id, BACKGROUND_CONTEXT);
+            const owner = meta?.owner;
+            if (owner === undefined)
+                return result;
+            for (const target of await servedTargets(owner, id)) {
+                if (target.reviewed === undefined)
+                    continue;
+                try {
+                    await target.reviewed(owner, id);
+                }
+                catch (error) {
+                    console.warn(`curation: reviewed of ${target.id} failed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            return result;
         },
         async digestRun(user, opts) {
-            return await digestRunRun({ harness, registry }, user, opts, deps.defaultModel, deps.defaultAgent);
+            return await digestRunRun({
+                harness,
+                registry,
+                ...(deps.interactiveTools === undefined
+                    ? {}
+                    : { interactiveTools: deps.interactiveTools }),
+            }, user, opts, deps.defaultModel, deps.defaultAgent);
         },
         async maintain(user, targetId, budget) {
             const target = curation
@@ -280,6 +335,55 @@ export function createCurationHost(deps) {
         const agent = await conversation.agent(BACKGROUND_CONTEXT);
         return new Set(agent.tools.map((tool) => tool.name));
     }
+    /**
+     * The targets served for `(user, id)`: the selection filter (every
+     * listed tool — `tools` AND `readTools` — model-visible) and the
+     * guidance filter (`[]` = unavailable for the user), projected for
+     * the caller. No id: every target (selection-independent).
+     */
+    async function servedTargets(user, id) {
+        const visible = id === undefined ? undefined : await modelVisibleTools(id);
+        const result = [];
+        for (const target of curation.targets()) {
+            if (visible !== undefined) {
+                if (target.tools.some((tool) => !visible.has(tool)))
+                    continue;
+                if ((target.readTools ?? []).some((tool) => !visible.has(tool))) {
+                    continue;
+                }
+            }
+            const guidance = await target.guidance(user);
+            if (guidance.length === 0)
+                continue;
+            result.push({
+                id: target.id,
+                tools: [...target.tools],
+                readTools: [...(target.readTools ?? [])],
+                guidance: [...guidance],
+                maintain: target.maintain !== undefined,
+                ...(target.wantsReview === undefined
+                    ? {}
+                    : { wantsReview: target.wantsReview }),
+                ...(target.reviewed === undefined
+                    ? {}
+                    : { reviewed: target.reviewed }),
+            });
+        }
+        return result;
+    }
+    /** Bound one target answer at the C5 deadline; rejects past it. */
+    async function bounded(answer) {
+        return await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => reject(new Error("wantsReview timed out")), WANTS_REVIEW_BOUND_MS);
+            answer.then((value) => {
+                clearTimeout(timer);
+                resolve(value === true);
+            }, (error) => {
+                clearTimeout(timer);
+                reject(error instanceof Error ? error : new Error(String(error)));
+            });
+        });
+    }
     /** The feed entries one review caused (newest-first walk). */
     async function feedOf(store, reviewId) {
         const found = [];

package/dist/curation/runs.js

@@ -42,6 +42,7 @@ import { ensureRequestId, recordAuthor } from "./attribution.js";
 import { isInternal, markInternal } from "./internal.js";
 import { curationRun, CurationRunDoc } from "./run-doc.js";
 import { CURATION_GATE_EXTENSION } from "./gate.js";
+import { excludeInteractiveTools, withoutInteractive, } from "../harness/interactive-tools.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
 /** The target-id resolver for collected changes (the host installs it). */
 let targetOfTool = (tool) => tool === "skill_manage" ? "sigrun.skills" : `tool:${tool}`;
@@ -495,7 +496,12 @@ async function answerText(conversation, answer) {
  * when the parent refuses.
  */
 export async function forkReviewRun(deps, id, opts) {
-    checkRunOpts(opts);
+    // Ask-user Task 3: the allow list loses interactive tools BEFORE the
+    // non-empty check (an all-interactive list still fails loudly, with
+    // the strip warning logged first). Fork reviews KEEP them listed
+    // (cache parity) — the gate blocks a call instead.
+    const allow = withoutInteractive(opts.allow, deps.interactiveTools ?? new Set(), console.warn, "fork review");
+    checkRunOpts({ ...opts, allow });
     const { harness } = deps;
     const parent = await harness.conversation(id, BACKGROUND_CONTEXT);
     if (parent === undefined) {
@@ -537,7 +543,7 @@ export async function forkReviewRun(deps, id, opts) {
             const doc = await tx.doc(CurationRunDoc, forkId);
             doc.user = owner;
             doc.reviewId = opts.reviewId;
-            doc.allow = [...opts.allow];
+            doc.allow = [...allow];
             doc.parent = id;
             // The fork's copied meta carries the parent's sharing; an
             // internal run is nobody's shared copy (A2's invisibility
@@ -561,7 +567,8 @@ export async function forkReviewRun(deps, id, opts) {
  * default + gate, same run doc and driver.
  */
 export async function digestRunRun(deps, user, opts, defaultModel, defaultAgent) {
-    checkRunOpts(opts);
+    const allow = withoutInteractive(opts.allow, deps.interactiveTools ?? new Set(), console.warn, "digest run");
+    checkRunOpts({ ...opts, allow });
     const { harness } = deps;
     const conversation = await harness.createConversation({
         ownership: { kind: "ownerless" },
@@ -576,10 +583,14 @@ export async function digestRunRun(deps, user, opts, defaultModel, defaultAgent)
         },
         init: async (tx, id) => {
             await markInternal(tx, id, user);
+            // Ask-user Task 3: the digest conversation's fresh agent
+            // selection loses the interactive tools (the tool is never
+            // listed, so the model never tries).
+            await excludeInteractiveTools(tx, id, deps.interactiveTools ?? new Set());
             const doc = await tx.doc(CurationRunDoc, id);
             doc.user = user;
             doc.reviewId = opts.reviewId;
-            doc.allow = [...opts.allow];
+            doc.allow = [...allow];
         },
     }, BACKGROUND_CONTEXT);
     return await driveRun(deps, async () => conversation, { ...opts, instruction: opts.input });