@slopus/happy-agent-base 0.0.4 → 0.0.6

package/dist/AgentBase.js

@@ -1,11 +1,15 @@
 import { areProviderModelsCompatible } from "@slopus/happy-providers";
+import { createId } from "@paralleldrive/cuid2";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { Value } from "@sinclair/typebox/value";
 import { asyncLock, createContextNamespace, deterministicStringify, withLifetime, } from "@steve.kite/stdlib";
-import { withAgentContext, withAgentKV, withAgentRunKV } from "./AgentContexts.js";
+import { withAgentContext, withAgentKV, withAgentPermissionMode, withAgentRunKV, } from "./AgentContexts.js";
+import { agentConfig, ownAgentConfig, withAgentConfig } from "./AgentConfig.js";
 import { taskContextBeforeToolCall, withAgentTaskContext } from "./AgentTaskContext.js";
 import { AgentKV } from "./AgentKV.js";
 import { AGENT_BASE_PENDING_KEY, agentBasePendingStateOf, } from "./AgentBasePending.js";
+import { cuid2Schema, ownAgentMessageMetadata, ownAgentMetadata, } from "./AgentMetadata.js";
+import { DEFAULT_AGENT_PERMISSION_MODE, isAgentPermissionMode, } from "./AgentPermissionMode.js";
 import { AgentProviders } from "./AgentProviders.js";
 /** Race winner when an abort interrupts a wait on the stream or a running tool. */
 const ABORTED = Symbol("aborted");
@@ -24,6 +28,8 @@ const insideTurn = createContextNamespace("agentInsideTurn", []);
  * its own and outlives whatever happened to start it.
  */
 const insideLoops = new AsyncLocalStorage();
+/** Persistence locks held by the current asynchronous call chain, independent of Context. */
+const insidePersistenceLocks = new AsyncLocalStorage();
 /**
  * How long a close asked for from inside the agent's own run loop waits for the shutdown before
  * telling its caller it cannot be waited for. Long enough that a caller which has already let go
@@ -103,6 +109,20 @@ const INSIDE_CLOSE_REPORT_MS = 15;
  * capability released when the hook returns, so it cannot be retained to bypass the lock later.
  * A failing handoff rejects an incompatible switch outright rather than costing the history.
  *
+ * ## Permission modes
+ *
+ * How much of the machine the agent may touch travels with its messages, exactly like its model,
+ * and takes effect when the message is consumed rather than when it is queued: a response and the
+ * tools it dispatched are already running under the mode they were started with, and are left to
+ * finish under it. The mode is durable, so a restart resumes in the mode the conversation reached,
+ * and it is carried on every context the agent derives, so a hook or a tool reads what it is
+ * running under rather than being told.
+ *
+ * The loop enforces nothing. It has no idea what any particular tool touches, and a runtime that
+ * guessed would be wrong about tools it has never seen. Enforcement belongs to the features and
+ * tools that do know; the loop's whole part is to carry the mode, make its changes durable, and
+ * report them.
+ *
  * ## Recovery
  *
  * Whether a restart owes a response is decided by the last durable record: a consumed message, a
@@ -188,6 +208,8 @@ export class AgentBase {
     #baseCtx;
     /** The base context extended with the effective selection and the agent's key-value store. */
     #ctx;
+    /** The immutable configuration snapshot carried by every hook context. */
+    #config;
     /** The registry the provider ID is resolved through, each time a session is created. */
     #providers;
     /** The registry ID of the provider in force; durable, so a restart resumes on the same one. */
@@ -200,6 +222,11 @@ export class AgentBase {
     #effort;
     /** The service tier in force. */
     #serviceTier;
+    /**
+     * How much of the machine the agent may touch. Durable, so a restart resumes in the mode the
+     * conversation reached, and carried on every context the agent derives.
+     */
+    #permissionMode;
     /** The single set of hooks the run is observed by and its configuration extended from. */
     #hooks;
     /**
@@ -368,7 +395,8 @@ export class AgentBase {
      * by, so reading it here leaves the later stage writes nothing to learn from the store.
      */
     async #loadPendingState() {
-        await this.#persistenceLock.runInLock(this.#ctx, async (lockCtx) => {
+        await this.#runInPersistenceLock(this.#ctx, async (lockCtx) => {
+            await this.#loadConfig(lockCtx);
             const stored = await agentBasePendingStateOf(lockCtx, this.#persistence);
             this.#inherited = stored;
             this.#inheritedRead = true;
@@ -385,10 +413,11 @@ export class AgentBase {
      */
     constructor(ctx, options) {
         this.id = options.id;
+        this.#config = ownAgentConfig(agentConfig(ctx) ?? {});
         // An agent is its own lifetime. Whatever call happened to construct it — a tool of
         // another agent, most often — is not a loop this one runs inside, so an inherited
         // marker is dropped rather than carried into work that outlives that call.
-        this.#baseCtx = insideTurn.set(ctx, [options.id]);
+        this.#baseCtx = withAgentConfig(insideTurn.set(ctx, [options.id]), this.#config);
         this.#providers = options.providers;
         this.#providerId = options.provider;
         this.#persistence = options.persistence;
@@ -401,6 +430,7 @@ export class AgentBase {
         this.#model = options.model;
         this.#effort = options.effort;
         this.#serviceTier = options.serviceTier;
+        this.#permissionMode = options.permissionMode ?? DEFAULT_AGENT_PERMISSION_MODE;
         this.#kv = new AgentKV(this.#persistence, `kv.${options.id}.`);
         this.#runKV = this.#kv.scoped("run");
         // Everything the agent does — hooks and tool executions included — runs on a context
@@ -415,14 +445,34 @@ export class AgentBase {
      * the selection changes.
      */
     #deriveCtx() {
-        const ctx = withAgentContext(this.#baseCtx, {
+        return this.#hookContext(this.#baseCtx);
+    }
+    /** Add this agent's selection and stores to a caller context without losing its transaction. */
+    #hookContext(ctx) {
+        const selected = withAgentContext(ctx, this.#selection());
+        return withAgentRunKV(withAgentKV(selected, this.#kv), this.#runKV);
+    }
+    /** Load a directly owned configuration written by `updateMetadata`, when one exists. */
+    async #loadConfig(ctx) {
+        const stored = await this.#persistence.readValues(ctx, "agentConfig");
+        const exact = stored.find(({ key }) => key === "agentConfig")?.value;
+        if (exact === undefined)
+            return;
+        const config = ownAgentConfig(exact);
+        this.#config = config;
+        this.#baseCtx = withAgentConfig(this.#baseCtx, config);
+        this.#ctx = this.#deriveCtx();
+    }
+    /** Everything about what the agent is currently running on, as one value to carry. */
+    #selection() {
+        return {
             id: this.id,
             provider: this.#providerId,
             model: this.#model,
             effort: this.#effort,
             serviceTier: this.#serviceTier,
-        });
-        return withAgentRunKV(withAgentKV(ctx, this.#kv), this.#runKV);
+            permissionMode: this.#permissionMode,
+        };
     }
     /**
      * Whether the agent has anything left to do. This is the only thing about an agent's state
@@ -463,7 +513,7 @@ export class AgentBase {
             return undefined;
         }
         try {
-            return await this.#persistenceLock.runInLock(this.#ctx, async (lockCtx) => {
+            return await this.#runInPersistenceLock(this.#ctx, async (lockCtx) => {
                 if (!this.#inheritedRead) {
                     this.#inheritedRead = true;
                     this.#inherited = await agentBasePendingStateOf(lockCtx, this.#persistence);
@@ -519,19 +569,72 @@ export class AgentBase {
     async send(ctx, message, options) {
         await this.#offer(ctx, "send", message, options);
     }
+    /**
+     * Shallow-merge fields into this agent's immutable metadata. The complete AgentConfig and
+     * transactional hook writes commit together; observing hooks run only after that commit.
+     */
+    async updateMetadata(ctx, update) {
+        const ownedUpdate = ownAgentMetadata(update);
+        if (ownedUpdate === undefined)
+            throw new Error("The agent metadata is not valid.");
+        if (this.#closed)
+            throw new Error("The agent has been closed.");
+        if (insideTurn.get(ctx).includes(this.id) ||
+            this.#insideOwnLoop() ||
+            this.#insideOwnPersistenceLock()) {
+            throw new Error("Updating metadata from inside this agent's current operation would wait for " +
+                "that same operation to finish. Update it after the hook or tool returns.");
+        }
+        let change;
+        let next;
+        await this.#runInPersistenceLock(ctx, async (lockCtx) => {
+            const previousMetadata = ownAgentMetadata(this.#config.metadata ?? {});
+            const metadata = ownAgentMetadata({ ...previousMetadata, ...ownedUpdate });
+            if (previousMetadata === undefined || metadata === undefined) {
+                throw new Error("The agent metadata is not valid.");
+            }
+            next = ownAgentConfig({ ...this.#config, metadata });
+            change = {
+                agentId: this.id,
+                previousMetadata,
+                update: ownedUpdate,
+                metadata,
+            };
+            await this.#persistence.transaction(lockCtx, async (txCtx) => {
+                await this.#persistence.writeValue(txCtx, "agentConfig", next);
+                await this.#withTransactionalContext(withAgentConfig(txCtx, next), async (hookCtx) => await this.#hooks.metadataChangedTransact?.(this.#hookContext(hookCtx), change));
+            });
+            this.#config = next;
+            this.#baseCtx = withAgentConfig(this.#baseCtx, next);
+            this.#ctx = this.#deriveCtx();
+        });
+        await this.#invokeHookOn(this.#hookContext(withAgentConfig(ctx, next)), this.#hooks.metadataChanged, change);
+    }
     /**
      * Hand one message to a durable queue. The acceptance runs whether or not the caller waits
      * for it — an unwaited failure is still a message that never entered the conversation, and
      * the agent's own close still drains it, so nothing is dropped by not looking.
      */
     async #offer(ctx, kind, message, options) {
-        const { await: wait = false, ...settings } = options ?? {};
+        const { await: wait = false, id = createId(), metadata: suppliedMetadata, ...settings } = options ?? {};
+        if (!Value.Check(cuid2Schema, id)) {
+            throw new Error("The message ID must be a cuid2 identity.");
+        }
+        const metadata = ownAgentMessageMetadata(suppliedMetadata);
         // Refusing the flag rather than the operation: a closed agent and a re-entrant wait are
         // both caller mistakes, and both are reported before any work is started.
         this.#assertCanWait(ctx, wait, kind === "steering" ? "a steered message" : "a sent message");
         if (this.#closed)
             throw new Error("The agent has been closed.");
-        const accepted = this.#enqueue(ctx, [{ kind, message, options: settings }]);
+        const accepted = this.#enqueue(ctx, [
+            {
+                kind,
+                id,
+                message: structuredClone(message),
+                ...(metadata === undefined ? {} : { metadata }),
+                options: settings,
+            },
+        ]);
         if (wait)
             return accepted;
         accepted.catch(() => undefined);
@@ -559,6 +662,19 @@ export class AgentBase {
     #insideOwnLoop() {
         return insideLoops.getStore()?.includes(this.id) === true;
     }
+    /** Whether this call chain already holds this agent's persistence lock. */
+    #insideOwnPersistenceLock() {
+        return insidePersistenceLocks.getStore()?.includes(this.id) === true;
+    }
+    /** Hold the persistence lock while marking it independently of the caller's Context. */
+    async #runInPersistenceLock(ctx, work) {
+        return await this.#persistenceLock.runInLock(ctx, async (lockCtx) => {
+            const held = insidePersistenceLocks.getStore() ?? [];
+            return await insidePersistenceLocks.run([...held, this.id], async () => {
+                return await work(lockCtx);
+            });
+        });
+    }
     /**
      * Accept a batch of messages as one durable step. Every message is written under the same
      * hold of the persistence lock and inside one transaction, so a caller arriving while a
@@ -572,17 +688,25 @@ export class AgentBase {
             throw new Error("The agent has been closed.");
         // Admitted: from here on the messages are the agent's responsibility, and a close that
         // begins now waits for them rather than resolving over the top of them.
-        const admitted = this.#persistenceLock.runInLock(ctx, async (lockCtx) => {
+        const admitted = this.#runInPersistenceLock(ctx, async (lockCtx) => {
             const accepted = [];
             await this.#persistence.transaction(lockCtx, async (txCtx) => {
                 for (const request of batch) {
+                    const identityKey = `message.${request.id}`;
+                    if (!(await this.#persistence.writeValueIfAbsent(txCtx, identityKey, true))) {
+                        continue;
+                    }
                     const key = await this.#queueKey(txCtx, `${request.kind}.`);
                     await this.#persistence.writeValue(txCtx, key, {
+                        id: request.id,
                         message: request.message,
+                        ...(request.metadata === undefined ? {} : { metadata: request.metadata }),
                         options: request.options,
                     });
                     accepted.push({ key, request });
                 }
+                if (accepted.length === 0)
+                    return;
                 // Accepting a message is what makes the work owed: the same transaction that
                 // admits it records that the agent owes an answer, so a process that dies right
                 // here is discovered still owing it rather than looking idle over a full queue.
@@ -593,8 +717,16 @@ export class AgentBase {
                 // one replaces the queue arrays wholesale, and a reference taken before the wait
                 // would push the message into an array nobody reads again.
                 const queue = request.kind === "steering" ? this.#steering : this.#sends;
-                queue.push({ key, message: request.message, options: request.options });
+                queue.push({
+                    key,
+                    id: request.id,
+                    message: request.message,
+                    ...(request.metadata === undefined ? {} : { metadata: request.metadata }),
+                    options: request.options,
+                });
             }
+            if (accepted.length === 0)
+                return;
             this.#turnRequested = true;
             this.#startRun();
         });
@@ -936,7 +1068,7 @@ export class AgentBase {
                 // durable exactly as it was for the next attempt.
                 const loadFailure = await this.#ensureLoaded().then(() => undefined, (error) => error);
                 if (loadFailure !== undefined) {
-                    this.#emit({
+                    await this.#emit({
                         type: "done",
                         state: "error",
                         kind: "internal_error",
@@ -985,7 +1117,7 @@ export class AgentBase {
      */
     async #settleDurably() {
         try {
-            await this.#persistenceLock.runInLock(this.#ctx, (lockCtx) => this.#recordTransaction(lockCtx, async (txCtx) => {
+            await this.#runInPersistenceLock(this.#ctx, (lockCtx) => this.#recordTransaction(lockCtx, async (txCtx) => {
                 await this.#clearPending(txCtx);
                 await this.#invokeTransactionalSettle(txCtx);
                 // The run store is erased last, so a settling hook can still read what the
@@ -1138,9 +1270,21 @@ export class AgentBase {
                 this.#ensureCompaction().catch(() => undefined);
                 continue;
             }
+            const id = action.id ?? createId();
+            if (!Value.Check(cuid2Schema, id))
+                continue;
+            let metadata;
+            try {
+                metadata = ownAgentMessageMetadata(action.metadata);
+            }
+            catch {
+                continue;
+            }
             batch.push({
                 kind: action.type === "steer" ? "steering" : "send",
-                message: action.message,
+                id,
+                message: structuredClone(action.message),
+                ...(metadata === undefined ? {} : { metadata }),
                 options: {},
             });
         }
@@ -1187,7 +1331,8 @@ export class AgentBase {
             let needsInference = resumed.length > 0;
             if (!this.#recoveryChecked) {
                 this.#recoveryChecked = true;
-                needsInference ||= this.#resumesInterruptedRun();
+                if (await this.#resumesInterruptedRun())
+                    needsInference = true;
             }
             // Each cycle first drains the queues, then runs one inference. Steering injects at
             // every stop between responses and always outranks sends; sent messages inject
@@ -1206,12 +1351,12 @@ export class AgentBase {
                 if (abort.signal.aborted) {
                     const hasPendingWork = needsInference || this.#steering.length > 0 || this.#sends.length > 0;
                     if (hasPendingWork)
-                        this.#emit({ type: "done", state: "cancelled" });
+                        await this.#emit({ type: "done", state: "cancelled" });
                     break;
                 }
-                let injected = await this.#consumeQueue(this.#steering, this.#steeringMode, "steering.");
+                let injected = await this.#consumeQueue(this.#steering, this.#steeringMode, "steering");
                 if (!injected && !needsInference) {
-                    injected = await this.#consumeQueue(this.#sends, this.#sendMode, "send.");
+                    injected = await this.#consumeQueue(this.#sends, this.#sendMode, "send");
                 }
                 // Nothing to answer — a start() on an idle history, or the queues ran dry.
                 if (!injected && !needsInference)
@@ -1297,7 +1442,7 @@ export class AgentBase {
             }
         }
         catch (error) {
-            this.#emit({
+            await this.#emit({
                 type: "done",
                 state: "error",
                 kind: "internal_error",
@@ -1324,12 +1469,13 @@ export class AgentBase {
      * beginning of a block that will now never arrive is told to drop it. Only finished blocks
      * are persisted, so the conversation is intact and it is the view being corrected.
      */
-    #resumesInterruptedRun() {
+    async #resumesInterruptedRun() {
         const owed = this.#lastRecordType === "user" ||
             this.#lastRecordType === "tool" ||
             this.#lastRecordType === "system";
-        if (owed && this.#inherited?.stage === "inference")
-            this.#emit({ type: "block_reset" });
+        if (owed && this.#inherited?.stage === "inference") {
+            await this.#emit({ type: "block_reset" });
+        }
         return owed;
     }
     /** Load the durable state once. A failed load is not sticky: the next turn retries it. */
@@ -1349,7 +1495,7 @@ export class AgentBase {
         const previousTokens = this.#contextTokens;
         this.#contextTokens = tokens;
         try {
-            await this.#persistenceLock.runInLock(this.#ctx, async (lockCtx) => {
+            await this.#runInPersistenceLock(this.#ctx, async (lockCtx) => {
                 const write = (writeCtx) => tokens === undefined
                     ? this.#persistence.deleteValue(writeCtx, "context")
                     : this.#persistence.writeValue(writeCtx, "context", { tokens });
@@ -1400,10 +1546,11 @@ export class AgentBase {
                 throw new Error(result.message);
             }
             if (result.status === "completed") {
-                await this.#persistenceLock.runInLock(this.#ctx, async (lockCtx) => {
+                await this.#runInPersistenceLock(this.#ctx, async (lockCtx) => {
                     // Physically delete the superseded records and write the replacement —
                     // which keeps the messages that stay — in one atomic step.
                     await this.#recordTransaction(lockCtx, async (txCtx) => {
+                        await this.#deleteMessageIdentities(txCtx, await this.#persistence.load(txCtx));
                         await this.#persistence.clearRecords(txCtx);
                         await this.#persistence.append(txCtx, {
                             type: "compaction",
@@ -1443,7 +1590,7 @@ export class AgentBase {
             return true;
         let settled = false;
         try {
-            await this.#persistenceLock.runInLock(this.#ctx, async (lockCtx) => {
+            await this.#runInPersistenceLock(this.#ctx, async (lockCtx) => {
                 // A call the durable batch still holds belongs to the resume, which answers it
                 // properly — and re-executes it when the tool is durable. Settling it here as
                 // well would give the conversation two results for one call.
@@ -1457,6 +1604,10 @@ export class AgentBase {
                 await this.#recordTransaction(lockCtx, async (txCtx) => {
                     for (const result of results) {
                         await this.#appendRecord(txCtx, { type: "tool", message: result });
+                        // A result the conversation records is a result the hook sees, however
+                        // little of a run produced it. A hook that fails here leaves the calls
+                        // unsettled, which is what lets a later attempt answer them properly.
+                        await this.#invokeToolTransactHook(txCtx, result.callId, this.#hooks.afterToolCallTransact, result);
                     }
                 });
                 this.#messages.push(...results);
@@ -1475,6 +1626,14 @@ export class AgentBase {
     async #appendRecord(ctx, record) {
         await this.#persistence.append(ctx, record);
     }
+    /** Remove deduplication identities for user records a history replacement is deleting. */
+    async #deleteMessageIdentities(ctx, records) {
+        for (const record of records) {
+            if (record.type === "user") {
+                await this.#persistence.deleteValue(ctx, `message.${record.id}`);
+            }
+        }
+    }
     /**
      * A transaction whose pending-state cache unwinds with it.
      */
@@ -1508,7 +1667,7 @@ export class AgentBase {
             content: [{ type: "text", text: `The last turn failed: ${message}` }],
         };
         try {
-            await this.#persistenceLock.runInLock(this.#ctx, async (lockCtx) => {
+            await this.#runInPersistenceLock(this.#ctx, async (lockCtx) => {
                 await this.#appendRecord(lockCtx, { type: "system", message: failure });
                 this.#messages.push(failure);
             });
@@ -1521,9 +1680,17 @@ export class AgentBase {
      * Move the oldest queued message — or, in "all" mode, every queued message — into the main
      * context store and the in-memory history. The moves run in one transaction, so a message
      * is never durable in both stores or neither, and memory changes only after the commit.
-     */
-    async #consumeQueue(queue, mode, prefix) {
-        return await this.#persistenceLock.runInLock(this.#ctx, async (lockCtx) => {
+     *
+     * What the consumption has to announce is announced once the lock has been released. A hook
+     * told a message has landed may perfectly well answer by sending another one, and doing that
+     * while this still held the store lock would be the hook waiting for its own caller.
+     */
+    async #consumeQueue(queue, mode, kind) {
+        const prefix = `${kind}.`;
+        /** Filled in once the consumption has committed, and reported after the lock is released. */
+        const accepted = [];
+        let permissionChange;
+        const consumed = await this.#runInPersistenceLock(this.#ctx, async (lockCtx) => {
             if (queue.length === 0)
                 return false;
             // The durable queue, not memory, decides what is left to consume after a restart.
@@ -1542,6 +1709,7 @@ export class AgentBase {
             let model = this.#model;
             let effort = this.#effort;
             let serviceTier = this.#serviceTier;
+            let permissionMode = this.#permissionMode;
             let changed = false;
             for (const entry of batch) {
                 if (entry.options.provider !== undefined) {
@@ -1560,7 +1728,17 @@ export class AgentBase {
                     serviceTier = entry.options.serviceTier;
                     changed = true;
                 }
+                if (entry.options.permissionMode !== undefined) {
+                    permissionMode = entry.options.permissionMode;
+                    changed = true;
+                }
             }
+            // The mode the messages make effective, kept apart from the rest because it is the one
+            // setting with hooks of its own: a change is announced, and what a feature concludes
+            // from it commits with the message that carried it.
+            const modeChange = permissionMode === this.#permissionMode
+                ? undefined
+                : { previousMode: this.#permissionMode, mode: permissionMode };
             // A provider or model change is checked against the provider-model compatibility
             // matrix. An incompatible change resets the conversation: the history is erased
             // completely, the old provider session is destroyed, and the `modelChanged` hook
@@ -1610,6 +1788,7 @@ export class AgentBase {
                             model,
                             effort,
                             serviceTier,
+                            permissionMode,
                         }), committed.signal);
                         const changeCtx = withAgentRunKV(withAgentKV(changeLifetime, this.#kv), this.#runKV);
                         try {
@@ -1648,6 +1827,7 @@ export class AgentBase {
                     await this.#persistence.deleteValue(txCtx, entry.key);
                 }
                 if (reset) {
+                    await this.#deleteMessageIdentities(txCtx, await this.#persistence.load(txCtx));
                     await this.#persistence.clearRecords(txCtx);
                     // The erased conversation is what the measurement described.
                     await this.#persistence.deleteValue(txCtx, "context");
@@ -1661,7 +1841,9 @@ export class AgentBase {
                 for (const entry of batch) {
                     await this.#appendRecord(txCtx, {
                         type: "user",
+                        id: entry.id,
                         message: entry.message,
+                        ...(entry.metadata === undefined ? {} : { metadata: entry.metadata }),
                     });
                 }
                 if (changed) {
@@ -1670,13 +1852,38 @@ export class AgentBase {
                         ...(model === undefined ? {} : { model }),
                         ...(effort === undefined ? {} : { effort }),
                         ...(serviceTier === undefined ? {} : { serviceTier }),
+                        permissionMode,
                     });
                 }
                 // Consuming a message is precisely the act that makes an inference owed, so
                 // the two commit as one. A crash cannot land between them and leave a
                 // message in the conversation that nothing remembers having to answer.
                 await this.#recordPending(txCtx, { stage: "inference" });
+                // Last, so a hook writing its own account of the consumption sees a transaction
+                // holding all of it. The mode comes before the messages: it is what they were
+                // said under, and a listener recording them wants to know that first.
+                const selection = { provider, model, effort, serviceTier, permissionMode };
+                if (modeChange !== undefined) {
+                    await this.#invokeTransactHook(txCtx, selection, this.#hooks.permissionModeChangedTransact, modeChange);
+                }
+                for (const entry of batch) {
+                    await this.#invokeTransactHook(txCtx, selection, this.#hooks.messageAcceptedTransact, {
+                        id: entry.id,
+                        kind,
+                        message: entry.message,
+                        ...(entry.metadata === undefined ? {} : { metadata: entry.metadata }),
+                    });
+                }
             });
+            // Committed: from here the messages are part of the conversation, so what has to be
+            // announced about them is decided now and reported once the lock is released.
+            permissionChange = modeChange;
+            accepted.push(...batch.map((entry) => ({
+                id: entry.id,
+                kind,
+                message: entry.message,
+                ...(entry.metadata === undefined ? {} : { metadata: entry.metadata }),
+            })));
             queue.splice(0, count);
             if (reset) {
                 this.#messages = injected === undefined ? [] : [injected];
@@ -1696,10 +1903,31 @@ export class AgentBase {
                 this.#model = model;
                 this.#effort = effort;
                 this.#serviceTier = serviceTier;
+                this.#permissionMode = permissionMode;
                 this.#ctx = this.#deriveCtx();
             }
             return true;
         });
+        // Outside the lock, and on the agent's own context, which now carries whatever these
+        // messages made effective.
+        if (permissionChange !== undefined) {
+            await this.#invokeHook(this.#hooks.permissionModeChanged, permissionChange);
+        }
+        for (const message of accepted) {
+            await this.#invokeHook(this.#hooks.messageAccepted, message);
+        }
+        return consumed;
+    }
+    /**
+     * Call a hook that writes inside the consumption's transaction, on a context carrying the
+     * selection those messages made effective rather than the one they replaced. Its failure is
+     * not contained: it rolls the whole consumption back, leaving the messages queued.
+     */
+    async #invokeTransactHook(txCtx, selection, hook, argument) {
+        if (hook === undefined)
+            return;
+        const hookCtx = withAgentContext(txCtx, { id: this.id, ...selection });
+        await this.#withTransactionalContext(hookCtx, (liveCtx) => hook(liveCtx, argument));
     }
     /**
      * Replace the in-memory state with the durable one. The persistence lock guarantees every
@@ -1708,7 +1936,7 @@ export class AgentBase {
      * not-yet-consumed queues. Consecutive block records reassemble into one assistant message.
      */
     async #loadHistory() {
-        await this.#persistenceLock.runInLock(this.#ctx, async (lockCtx) => {
+        await this.#runInPersistenceLock(this.#ctx, async (lockCtx) => {
             const records = await this.#persistence.load(lockCtx);
             const last = records[records.length - 1];
             this.#lastRecordType = last?.type;
@@ -1725,7 +1953,17 @@ export class AgentBase {
             this.#contextTokens = measured?.tokens;
             const entry = (key, value) => {
                 const envelope = value;
-                return { key, message: envelope.message, options: envelope.options ?? {} };
+                if (!Value.Check(cuid2Schema, envelope.id)) {
+                    throw new Error(`The queued message under "${key}" has an invalid ID.`);
+                }
+                const metadata = ownAgentMessageMetadata(envelope.metadata);
+                return {
+                    key,
+                    id: envelope.id,
+                    message: envelope.message,
+                    ...(metadata === undefined ? {} : { metadata }),
+                    options: envelope.options ?? {},
+                };
             };
             this.#steering = steering.map(({ key, value }) => entry(key, value));
             this.#sends = sends.map(({ key, value }) => entry(key, value));
@@ -1738,6 +1976,13 @@ export class AgentBase {
                 this.#model = persisted.model;
                 this.#effort = persisted.effort;
                 this.#serviceTier = persisted.serviceTier;
+                // The permission mode is the one setting whose absence is not a decision: a record
+                // written before any message carried a mode says nothing about it, and a value
+                // that is not a mode at all says nothing either. Both keep the mode the agent was
+                // built with rather than running under something nothing can interpret.
+                if (isAgentPermissionMode(persisted.permissionMode)) {
+                    this.#permissionMode = persisted.permissionMode;
+                }
                 this.#ctx = this.#deriveCtx();
             }
             this.#pendingTools = pendingTools.map(({ key, value }) => ({
@@ -1774,7 +2019,7 @@ export class AgentBase {
      */
     async #runToolBatch(entries, resume, signal, abortPromise) {
         if (!resume) {
-            await this.#persistenceLock.runInLock(this.#ctx, (lockCtx) => this.#recordTransaction(lockCtx, async (txCtx) => {
+            await this.#runInPersistenceLock(this.#ctx, (lockCtx) => this.#recordTransaction(lockCtx, async (txCtx) => {
                 for (const entry of entries) {
                     await this.#persistence.writeValue(txCtx, entry.key, entry.call);
                 }
@@ -1782,6 +2027,11 @@ export class AgentBase {
                 // then never find calls owed with no record of a run owing them, nor a run
                 // recorded as running tools that were never written.
                 await this.#recordPending(txCtx, { stage: "tools" });
+                // Last, so a hook noting a call about to happen sees a transaction holding
+                // the whole batch it belongs to.
+                for (const entry of entries) {
+                    await this.#invokeToolTransactHook(txCtx, entry.call.callId, this.#hooks.beforeToolCallTransact, entry.call);
+                }
             }));
         }
         else {
@@ -1801,7 +2051,7 @@ export class AgentBase {
             if (commitFailed)
                 return;
             try {
-                await this.#persistenceLock.runInLock(this.#ctx, async (lockCtx) => {
+                await this.#runInPersistenceLock(this.#ctx, async (lockCtx) => {
                     while (committed < entries.length) {
                         const entry = entries[committed];
                         const result = results[committed];
@@ -1817,6 +2067,7 @@ export class AgentBase {
                             // stays: that is the tool's state, not the batch's bookkeeping, and
                             // an owner may still want to read what a finished call recorded.
                             await this.#persistence.deleteValue(txCtx, entry.key);
+                            await this.#invokeToolTransactHook(txCtx, entry.call.callId, this.#hooks.afterToolCallTransact, result);
                         });
                         this.#messages.push(result);
                         committed += 1;
@@ -1913,6 +2164,30 @@ export class AgentBase {
     #toolKey(index, callId) {
         return `tool.${String(index).padStart(6, "0")}.${callId}`;
     }
+    /**
+     * The scope one call owns: state persists under its own call ID, never in another call's
+     * scope, and the task context ends where the call was made. The execution and all four tool
+     * hooks share it, so what one of them writes about a call is where the others look for it.
+     */
+    #callScoped(ctx, callId) {
+        return withAgentTaskContext(withAgentRunKV(withAgentKV(ctx, this.#kv.scoped("call", callId)), this.#runKV.scoped("call", callId)), taskContextBeforeToolCall(this.#messages, callId));
+    }
+    /**
+     * Call a tool hook that writes inside a transaction of its own call's. The lifetime ends with
+     * the callback, so a context kept afterwards cannot outlive the transaction it belongs to.
+     * Its failure is not contained: it rolls that transaction back.
+     */
+    async #invokeToolTransactHook(txCtx, callId, hook, argument) {
+        if (hook === undefined)
+            return;
+        const lifetime = new AbortController();
+        try {
+            await hook(this.#callScoped(withLifetime(txCtx, lifetime.signal), callId), argument);
+        }
+        finally {
+            lifetime.abort();
+        }
+    }
     /**
      * Run one tool call; every failure becomes an error tool result instead of an exception.
      * The context carries the turn's abort signal as its lifetime, so a running tool can
@@ -1942,34 +2217,77 @@ export class AgentBase {
         if (tool.parameters !== undefined && !Value.Check(tool.parameters, args)) {
             return failure(`The arguments for "${call.name}" did not match its schema.`);
         }
+        const callCtx = this.#callScoped(ctx, call.callId);
+        // From here the call is one the two tool hooks bracket: a tool that exists, a call that
+        // finished, and arguments its schema accepts. A call refused before that reaches neither
+        // hook, because there is nothing yet to decide about or to report.
+        let ran = tool;
+        let ranArguments = args;
+        let outcome;
         try {
-            // A tool execution persists under its own call ID, never in another call's scope.
-            const callCtx = withAgentTaskContext(withAgentRunKV(withAgentKV(ctx, this.#kv.scoped("call", call.callId)), this.#runKV.scoped("call", call.callId)), taskContextBeforeToolCall(this.#messages, call.callId));
-            let executed;
-            const execute = () => (executed ??= Promise.resolve().then(async () => await tool.execute(callCtx, args)));
-            const result = this.#hooks.aroundToolExecution === undefined
-                ? await execute()
-                : await this.#hooks.aroundToolExecution(callCtx, {
+            const decision = await this.#hooks.beforeToolCall?.(callCtx, {
+                callId: call.callId,
+                tool,
+                arguments: args,
+            });
+            if (decision?.type === "answer") {
+                // The hook answered the model itself, so the tool never runs and there is no
+                // structured result — only what the model is told.
+                outcome = {
                     callId: call.callId,
                     tool,
                     arguments: args,
-                    execute,
-                });
-            if (!Value.Check(tool.returnType, result)) {
-                return failure(`Tool "${call.name}" returned an invalid result.`);
+                    content: [...decision.content],
+                    isError: decision.isError === true,
+                };
+            }
+            else {
+                if (decision?.tool !== undefined)
+                    ran = decision.tool;
+                if (decision?.arguments !== undefined)
+                    ranArguments = decision.arguments;
+                // An amended call is validated again: the schema that mattered is the one belonging
+                // to the tool that is about to run, on the arguments it is about to receive.
+                if ((ran !== tool || ranArguments !== args) &&
+                    ran.parameters !== undefined &&
+                    !Value.Check(ran.parameters, ranArguments)) {
+                    throw new Error(`The arguments for "${ran.name}" did not match its schema.`);
+                }
+                const runCtx = decision?.permissionMode === undefined
+                    ? callCtx
+                    : withAgentPermissionMode(callCtx, decision.permissionMode);
+                const result = await ran.execute(runCtx, ranArguments);
+                if (!Value.Check(ran.returnType, result)) {
+                    throw new Error(`Tool "${ran.name}" returned an invalid result.`);
+                }
+                outcome = {
+                    callId: call.callId,
+                    tool: ran,
+                    arguments: ranArguments,
+                    content: [...ran.toLLM(result)],
+                    isError: ran.isError?.(result) === true,
+                    result,
+                };
             }
-            const content = tool.toLLM(result);
-            const isError = tool.isError?.(result) === true;
-            return {
-                role: "tool",
-                callId: call.callId,
-                content: [...content],
-                ...(isError ? { isError: true } : {}),
-            };
         }
         catch (error) {
-            return failure(error instanceof Error ? error.message : String(error));
+            outcome = {
+                callId: call.callId,
+                tool: ran,
+                arguments: ranArguments,
+                content: [
+                    { type: "text", text: error instanceof Error ? error.message : String(error) },
+                ],
+                isError: true,
+            };
         }
+        await this.#invokeHookOn(callCtx, this.#hooks.afterToolCall, outcome);
+        return {
+            role: "tool",
+            callId: call.callId,
+            content: outcome.content,
+            ...(outcome.isError ? { isError: true } : {}),
+        };
     }
     /**
      * A key that sorts after every entry the queue already holds. The order comes from the store
@@ -2005,7 +2323,7 @@ export class AgentBase {
         const persist = async (event) => {
             if (event === undefined)
                 return;
-            await this.#persistenceLock.runInLock(this.#ctx, async (lockCtx) => {
+            await this.#runInPersistenceLock(this.#ctx, async (lockCtx) => {
                 if (this.#hooks.onEventTransact === undefined) {
                     await this.#appendRecord(lockCtx, { type: "block", block: event.block });
                 }
@@ -2030,7 +2348,7 @@ export class AgentBase {
                 const next = await Promise.race([iterator.next(), abortPromise]);
                 if (next === ABORTED) {
                     // Drop the unfinished block and end the turn.
-                    this.#emit({ type: "done", state: "cancelled" });
+                    await this.#emit({ type: "done", state: "cancelled" });
                     return { content: persisted, state: "cancelled" };
                 }
                 if (next.done === true) {
@@ -2038,7 +2356,7 @@ export class AgentBase {
                     break;
                 }
                 const event = next.value;
-                this.#emit(event);
+                await this.#emit(event);
                 switch (event.type) {
                     case "text_start":
                         content.push({ type: "text", text: "" });
@@ -2189,9 +2507,9 @@ export class AgentBase {
         return this.#session;
     }
     /** Report one stream event to the hooks. Hooks observe the stream; they never fail a run. */
-    #emit(event) {
+    async #emit(event) {
         try {
-            this.#hooks.onEvent?.(this.#ctx, event);
+            await this.#hooks.onEvent?.(this.#ctx, event);
         }
         catch {
             // Hooks observe the stream; they never fail a run.