@superjackfruitlabs/salaam 0.0.3 → 0.0.5

package/dist/src/station-work.js

@@ -1,18 +1,32 @@
 import { spawn } from 'node:child_process';
-import { mkdirSync, mkdtempSync, writeFileSync, readFileSync, lstatSync, rmSync, chmodSync, } from 'node:fs';
+import { mkdirSync, mkdtempSync, writeFileSync, readFileSync, readdirSync, lstatSync, rmSync, chmodSync, } from 'node:fs';
 import { join } from 'node:path';
 import { processIdentity } from './supervisor.js';
 import { randomUUID } from 'node:crypto';
 import { canonical, digest, object, string, integer, ServiceError, } from './protocol.js';
 import { readStationConfig, stationUnavailable, stationPrivateFile, stationWorkspaceIdentity, } from './station-config.js';
 import { stationFileResult } from './station-files.js';
+import { runGrantCovers, runGrantPrefix } from './run-grants.js';
 import { StationSystemd } from './station-systemd.js';
 const hashes = /^[a-f0-9]{64}$/;
-class StationFilesDefiniteFailure extends ServiceError {
-    constructor() {
-        super('station_files_changed', 'Protected file primitive refused before mutation');
+export class StationFilesDefiniteFailure extends ServiceError {
+    constructor(code) {
+        super(code, 'Protected file primitive refused before mutation');
     }
 }
+/** A helper refusal that provably changed nothing, as the code recorded for it, or null. The
+ * helper writes station_request_invalid as exactly {version, ok, code} and only while decoding,
+ * before it executes anything; any other shape (an effect_state, extra fields) is not definite. */
+export function definiteHelperRefusal(exitCode, transportFailed, result) {
+    if (transportFailed || exitCode !== 1 || result.version !== 1 || result.ok !== false)
+        return null;
+    if (result.code === 'station_files_unavailable' && result.effect_state === 'not_started')
+        return 'station_files_changed';
+    if (result.code === 'station_request_invalid' &&
+        Object.keys(result).sort().join(',') === 'code,ok,version')
+        return 'station_request_invalid';
+    return null;
+}
 const terminal = (s) => ['returned', 'failed', 'outcome_unknown', 'cancelled'].includes(s);
 /** Root-only station controller. Writable source access stays behind the private
  * traversal-resistant node primitive; arbitrary checks get a separate OS identity,
@@ -24,6 +38,9 @@ export class StationWork {
     authority;
     reference;
     options;
+    /** "Approve for this run" grants and the task each session's run belongs to (service wiring). */
+    grants;
+    grantScope;
     config;
     configurationDigest;
     directory;
@@ -190,6 +207,14 @@ export class StationWork {
                 spawned = true;
                 try {
                     if (id) {
+                        // Own the process first: a guard that refuses below must still leave a pid and identity
+                        // that a stop can prove exited (staging card_06a619a3e2e94faf left a pid-less helper).
+                        const identity = processIdentity(child.pid);
+                        if (!identity)
+                            stationUnavailable();
+                        this.store.transaction(() => this.store.db
+                            .prepare("UPDATE station_calls SET helper_pid=?,helper_identity=?,helper_state='running' WHERE id=? AND helper_state='launching'")
+                            .run(child.pid, identity, id));
                         const c = this.get(id);
                         if (verificationGuard)
                             verificationGuard();
@@ -197,12 +222,6 @@ export class StationWork {
                             this.guard(c);
                         if (c.state !== 'dispatching')
                             stationUnavailable();
-                        const identity = processIdentity(child.pid);
-                        if (!identity)
-                            stationUnavailable();
-                        this.store.transaction(() => this.store.db
-                            .prepare("UPDATE station_calls SET helper_pid=?,helper_identity=?,helper_state='running' WHERE id=? AND helper_state='launching'")
-                            .run(child.pid, identity, id));
                     }
                     child.stdin.end(JSON.stringify({
                         version: 1,
@@ -262,13 +281,9 @@ export class StationWork {
                             stationUnavailable();
                     }
                     const result = object(JSON.parse(Buffer.concat(chunks).toString('utf8')));
-                    if (!failed &&
-                        code === 1 &&
-                        result.version === 1 &&
-                        result.ok === false &&
-                        result.code === 'station_files_unavailable' &&
-                        result.effect_state === 'not_started')
-                        throw new StationFilesDefiniteFailure();
+                    const refusal = definiteHelperRefusal(code, failed, result);
+                    if (refusal)
+                        throw new StationFilesDefiniteFailure(refusal);
                     if (failed || code !== 0 || result.version !== 1 || result.ok !== true)
                         stationUnavailable();
                     accept(stationFileResult({ ...request, root_identity: this.config.workspace_identity }, result));
@@ -288,14 +303,43 @@ export class StationWork {
             return error.code !== 'ESRCH';
         }
     }
+    /** Whether no process on this host runs the station file helper, proven from every /proc entry. */
+    noHelperProcess() {
+        if (process.platform !== 'linux')
+            return false;
+        for (const entry of readdirSync('/proc')) {
+            if (!/^\d+$/.test(entry))
+                continue;
+            let argv;
+            try {
+                argv = readFileSync(join('/proc', entry, 'cmdline'), 'utf8').split('\0');
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    continue;
+                return false;
+            }
+            if (argv.includes('salaam-station-files-v1'))
+                return false;
+        }
+        return true;
+    }
     async stopHelper(id) {
         const c = this.get(id);
         if (!c.helper_state || c.helper_state === 'none' || c.helper_state === 'stopped')
             return;
         this.files.get(id)?.abort();
         try {
-            if (!c.helper_pid || !c.helper_identity)
-                stationUnavailable();
+            if (!c.helper_pid || !c.helper_identity) {
+                // Recorded before the fix above: no pid to prove. Settle only when the whole process table
+                // holds no station helper; any live or unreadable process keeps the call fenced.
+                if (!this.noHelperProcess())
+                    stationUnavailable();
+                this.store.transaction(() => this.store.db
+                    .prepare("UPDATE station_calls SET helper_state='stopped',helper_stop_json=? WHERE id=?")
+                    .run(canonical({ version: 1, scope: 'host_process_table', method: 'no_helper_process' }), id));
+                return;
+            }
             if (this.processExists(c.helper_pid) || this.processExists(c.helper_pid, true)) {
                 if (processIdentity(c.helper_pid) !== c.helper_identity)
                     stationUnavailable();
@@ -483,7 +527,7 @@ export class StationWork {
         if (!['patch', 'check'].includes(kind))
             throw new ServiceError('invalid_field', 'Unsupported station mutation');
         const allowed = kind === 'patch'
-            ? ['action', 'path', 'expected_tree', 'expected_hash', 'content']
+            ? ['action', 'path', 'expected_tree', 'expected_hash', 'content', 'reason']
             : ['action', 'expected_tree', 'command'];
         if (Object.keys(args).some((k) => !allowed.includes(k)) ||
             typeof args.expected_tree !== 'string' ||
@@ -560,8 +604,250 @@ export class StationWork {
                 input_digest: row.input_digest,
             });
         });
+        const prepared = this.get(id);
+        if (kind === 'patch' && prepared.operation_id)
+            this.answerFromGrant(prepared.operation_id, session, args);
         return this.view(id);
     }
+    /** A write the run's grant covers is answered by it, checked again at decision time. The
+     * operation is still prepared, digest-bound and journaled on its own; deletes always ask. */
+    /** An agent's standing "Always allow" rule (pinned at admission or added by a renewal, dropped at the renewal that no
+     * longer lists it) answers a workspace write anywhere in the workspace, never a delete or a
+     * hidden path. Checked again at decision time, so a rule revoked meanwhile answers nothing. */
+    answerFromRule(operation, session, args) {
+        if (!runGrantCovers('', args))
+            return;
+        const live = () => this.authority.approvalRules(session).find((r) => r.scope === 'workspace-write');
+        const rule = live();
+        if (!rule)
+            return;
+        const approval = this.managed.forOperation(operation);
+        if (approval.state !== 'pending')
+            return;
+        this.managed.decide(approval.id, 'rule:' + operation, approval.revision, approval.operation_digest, 'approve', {
+            decidedBy: 'rule:' + rule.id,
+            receipt: { rule: 'agent-rule', rule_id: rule.id, set_by: rule.set_by },
+            authorize: () => {
+                if (live()?.id !== rule.id)
+                    throw new ServiceError('permission_changed', 'The approval rule no longer covers this write');
+            },
+        });
+    }
+    answerFromGrant(operation, session, args) {
+        if (!this.grants || !this.grantScope)
+            return;
+        const binding = this.authority.binding(session);
+        const prefix = runGrantPrefix(typeof binding?.run?.id === 'string' ? binding.run.id : '');
+        const live = () => {
+            const scope = this.grantScope(session);
+            if (!scope || !prefix || !runGrantCovers(prefix, args))
+                return null;
+            const g = this.grants.active({
+                session_id: session,
+                binding_digest: digest(binding),
+                ...scope,
+            });
+            return g;
+        };
+        const grant = live();
+        if (!grant)
+            return this.answerFromRule(operation, session, args);
+        const approval = this.managed.forOperation(operation);
+        if (approval.state !== 'pending')
+            return;
+        this.managed.decide(approval.id, 'run-grant:' + operation, approval.revision, approval.operation_digest, 'approve', {
+            decidedBy: 'run-grant:' + grant.id,
+            receipt: {
+                rule: 'run-grant',
+                grant_id: grant.id,
+                granted_by: grant.granted_by,
+                granted_on: grant.approval_id,
+            },
+            authorize: () => {
+                if (live()?.id !== grant.id)
+                    throw new ServiceError('permission_changed', 'The run grant no longer covers this write');
+            },
+        });
+    }
+    /** Item 11b: the restore journal. Each write is recorded before it is sent, so a daemon stop
+     * mid-restore leaves an honest unknown, never a silent effect. */
+    restoreTables() {
+        this.store.db.exec(`CREATE TABLE IF NOT EXISTS station_restores(
+      id TEXT PRIMARY KEY NOT NULL, session_id TEXT NOT NULL, request_id TEXT NOT NULL UNIQUE,
+      restore_digest TEXT NOT NULL, approved_by TEXT NOT NULL, state TEXT NOT NULL, receipt TEXT);
+    CREATE TABLE IF NOT EXISTS station_restore_writes(
+      restore_id TEXT NOT NULL REFERENCES station_restores(id), n INTEGER NOT NULL, path TEXT NOT NULL,
+      args_json TEXT NOT NULL, state TEXT NOT NULL, result_json TEXT, artifact_id TEXT,
+      PRIMARY KEY(restore_id, n));`);
+    }
+    /** Item 11b: the live workspace through the helper's closed verbs (inspect, search, read). A
+     * path is absent only when an exact search finds no entry for it; a file the helper refuses to
+     * read (too large, not text) is unreadable, never guessed. */
+    async live() {
+        const inspected = await this.helper({ action: 'inspect' });
+        return {
+            tree: String(inspected.tree_digest),
+            file: async (path) => {
+                let offset = 0, found = false;
+                while (offset !== null && !found) {
+                    const page = await this.helper({
+                        action: 'search',
+                        query: path,
+                        offset,
+                    });
+                    found = page.entries.some((e) => e.path === path);
+                    offset = page.next_offset ?? null;
+                }
+                if (!found)
+                    return { state: 'absent' };
+                try {
+                    const read = await this.helper({ action: 'read', path });
+                    return { state: 'content', content: String(read.content), sha256: String(read.sha256) };
+                }
+                catch {
+                    return { state: 'unreadable' };
+                }
+            },
+        };
+    }
+    /** Item 11b: the journal's answer for a restore request already seen, or null for a new one.
+     * A replay returns the saved receipt exactly; the same request for another restore is a
+     * conflict; an unfinished one says so. Checked before any plan is recomputed. */
+    replayed(session, request, restoreDigest) {
+        this.restoreTables();
+        const saved = this.store.db
+            .prepare('SELECT * FROM station_restores WHERE request_id=?')
+            .get(request);
+        if (!saved)
+            return null;
+        if (saved.restore_digest !== restoreDigest || saved.session_id !== session)
+            throw new ServiceError('request_conflict', 'This restore request was used for another restore');
+        if (saved.receipt)
+            return JSON.parse(String(saved.receipt));
+        throw new ServiceError('restore_unconfirmed', 'This restore did not finish; review it again');
+    }
+    /** At start: a restore write that was in flight has an unknown outcome; its restore is partial. */
+    recoverRestores() {
+        this.restoreTables();
+        this.store.transaction(() => {
+            for (const w of this.store.db
+                .prepare("SELECT restore_id,n FROM station_restore_writes WHERE state='dispatching'")
+                .all()) {
+                this.store.db
+                    .prepare("UPDATE station_restore_writes SET state='outcome_unknown' WHERE restore_id=? AND n=?")
+                    .run(String(w.restore_id), Number(w.n));
+                this.store.db
+                    .prepare("UPDATE station_restores SET state='partial' WHERE id=?")
+                    .run(String(w.restore_id));
+            }
+        });
+    }
+    /**
+     * Item 11b: restore files exactly as planned and approved, after the run has ended. The caller
+     * checks the ended run and the approval; this writes. It refuses a workspace whose live tree is
+     * not the reviewed one, then sends each write through the protected helper in order, chaining
+     * the expected tree and each file's current hash, with a receipt per file. The same request
+     * replays its receipt. A failure stops the restore; nothing is retried.
+     */
+    async restore(session, rootDigest, plan, request, approvedBy) {
+        this.restoreTables();
+        const saved = this.store.db
+            .prepare('SELECT * FROM station_restores WHERE request_id=?')
+            .get(request);
+        if (saved) {
+            if (saved.restore_digest !== plan.restore_digest || saved.session_id !== session)
+                throw new ServiceError('request_conflict', 'This restore request was used for another restore');
+            if (saved.receipt)
+                return JSON.parse(String(saved.receipt));
+            throw new ServiceError('restore_unconfirmed', 'This restore did not finish; review it again');
+        }
+        const live = (await this.helper({ action: 'inspect' }));
+        if (live.tree_digest !== plan.current_tree)
+            throw new ServiceError('restore_changed', 'The workspace changed since this restore was reviewed');
+        const id = randomUUID();
+        this.store.transaction(() => this.store.db
+            .prepare("INSERT INTO station_restores VALUES (?,?,?,?,?,'running',NULL)")
+            .run(id, session, request, plan.restore_digest, approvedBy));
+        let tree = plan.current_tree;
+        const done = [];
+        let stopped = null;
+        for (const [n, w] of plan.writes.entries()) {
+            const args = {
+                action: 'patch',
+                path: w.path,
+                expected_tree: tree,
+                expected_hash: w.expected_hash,
+                content: w.content,
+                // The helper accepts only a 64-hex request id: one per restore write, stable on replay.
+                request_id: digest({ restore: id, write: n }),
+                deadline_ms: Date.now() + 5000,
+            };
+            this.store.transaction(() => this.store.db
+                .prepare("INSERT INTO station_restore_writes VALUES (?,?,?,?,'dispatching',NULL,NULL)")
+                .run(id, n, w.path, canonical(args)));
+            let result;
+            try {
+                result = (await this.helper(args));
+            }
+            catch (error) {
+                const definite = error instanceof StationFilesDefiniteFailure;
+                this.store.transaction(() => this.store.db
+                    .prepare('UPDATE station_restore_writes SET state=?,result_json=? WHERE restore_id=? AND n=?')
+                    .run(definite ? 'failed' : 'outcome_unknown', canonical({
+                    code: definite ? error.code : 'station_execution_unconfirmed',
+                }), id, n));
+                stopped = w.path;
+                break;
+            }
+            const artifact = this.artifacts.prepare(session, canonical({
+                version: 1,
+                kind: 'station-restore-receipt',
+                restore_id: id,
+                request_id: request,
+                restore_digest: plan.restore_digest,
+                approved_by: approvedBy,
+                session_id: session,
+                root_digest: rootDigest,
+                configuration_digest: this.configurationDigest,
+                path: w.path,
+                patch: {
+                    content: w.content,
+                    expected_tree: args.expected_tree,
+                    expected_hash: w.expected_hash,
+                },
+                result,
+            }));
+            this.store.transaction(() => {
+                artifact.commit();
+                this.store.db
+                    .prepare("UPDATE station_restore_writes SET state='returned',result_json=?,artifact_id=? WHERE restore_id=? AND n=?")
+                    .run(canonical(result), artifact.id, id, n);
+            });
+            done.push({ path: w.path, artifact_id: artifact.id });
+            tree = String(result.tree_digest);
+        }
+        const receipt = {
+            version: 1,
+            state: stopped ? 'partial' : 'restored',
+            restore_id: id,
+            restore_digest: plan.restore_digest,
+            tree_digest: tree,
+            writes: done,
+            ...(stopped ? { stopped_at: stopped } : {}),
+        };
+        this.store.transaction(() => {
+            this.store.db
+                .prepare('UPDATE station_restores SET state=?,receipt=? WHERE id=?')
+                .run(receipt.state, canonical(receipt), id);
+            this.store.event(session, 'station.restored', {
+                restore_id: id,
+                restore_digest: plan.restore_digest,
+                approved_by: approvedBy,
+                state: receipt.state,
+            });
+        });
+        return receipt;
+    }
     run(id) {
         const c = this.get(id);
         if (terminal(c.state) || this.jobs.has(id))
@@ -592,7 +878,7 @@ export class StationWork {
             if (current.state === 'dispatching')
                 this.store.transaction(() => {
                     const definite = error instanceof StationFilesDefiniteFailure;
-                    this.change(current, current.kind === 'patch' && !definite ? 'outcome_unknown' : 'failed', { code: definite ? 'station_files_changed' : 'station_execution_unconfirmed' });
+                    this.change(current, current.kind === 'patch' && !definite ? 'outcome_unknown' : 'failed', { code: definite ? error.code : 'station_execution_unconfirmed' });
                     if (current.operation_id) {
                         if (definite)
                             this.managed.workspaceDefiniteFailureInTransaction(current.operation_id);
@@ -622,7 +908,13 @@ export class StationWork {
         this.guard(c);
         if (c.kind === 'patch') {
             const result = await this.helper({
-                ...args,
+                // Only the helper's own fields: it refuses any field it does not know (the agent's
+                // reason is for the approval detail and stays in the operation's arguments).
+                action: args.action,
+                path: args.path,
+                expected_tree: args.expected_tree,
+                expected_hash: args.expected_hash,
+                content: args.content,
                 request_id: id,
                 deadline_ms: Date.now() + this.authority.leaseWindow(c.session_id, c.root_digest, 5000),
             }, id);
@@ -807,6 +1099,7 @@ export class StationWork {
     }
     async initialize() {
         this.proven = false;
+        this.recoverRestores();
         for (const row of this.store.db
             .prepare("SELECT id FROM station_calls WHERE helper_state NOT IN ('none','stopped') ORDER BY rowid")
             .all())

package/dist/src/store.js

@@ -28,14 +28,20 @@ export class Store {
     cancelChildren;
     recordTaskMutation;
     taskGrantCheck;
+    /** Provenance: the OS identity that local tool effects run as. */
+    toolExecution;
     jobGrantCheck;
     taskModelAdmission;
     taskBudgetDenied;
+    /** A durable task's own attempts are bounded by the task's request limit, not the attempt default. */
+    taskAttemptRequestLimit;
     taskChildReserve;
     taskChildFinished;
     taskCommandAdmission;
     taskRemainingRuntime;
     committed = null;
+    activity = new Map();
+    openedAt = Date.now();
     constructor(path) {
         this.db = new DatabaseSync(path);
         if (path !== ':memory:')
@@ -341,6 +347,9 @@ export class Store {
         finally {
             this.committed = null;
         }
+        const now = Date.now();
+        for (const event of events)
+            this.activity.set(event.session_id, now);
         for (const event of events)
             this.changes.emit('event', event);
         return result;
@@ -417,6 +426,7 @@ export class Store {
                         local_workspace: true,
                         local_coding: local.coding === true,
                         output_cap: local.outputCap ?? true,
+                        ...(this.toolExecution ? { tool_execution: this.toolExecution } : {}),
                     }
                     : {}),
             }, requestId);
@@ -451,8 +461,11 @@ export class Store {
             throw new ServiceError('not_found', 'Session not found', 404);
         return { ...row, capabilities: JSON.parse(row.capabilities) };
     }
-    forkLocal(id, request, expected, controller, clone) {
-        return this.request('local-operator', request, { kind: 'fork', id, expected }, () => {
+    forkLocal(id, request, expected, controller, clone, 
+    /** A rewind forks from an earlier conversation leaf. */
+    at) {
+        const input = { kind: 'fork', id, expected, ...(at ? { leaf: at.leaf } : {}) };
+        return this.request('local-operator', request, input, () => {
             this.authorizeControl(id, controller);
             const source = this.session(id);
             if (source.revision !== expected)
@@ -468,12 +481,13 @@ export class Store {
             const file = clone(source, target);
             this.db
                 .prepare('INSERT INTO sessions(id,cwd,pi_session_id,pi_session_file,pi_cursor,pi_leaf) VALUES(?,?,?,?,?,?)')
-                .run(target, source.cwd, target, file, source.pi_cursor, source.pi_leaf);
+                .run(target, source.cwd, target, file, source.pi_cursor, at ? at.leaf : source.pi_leaf);
             this.event(target, 'session.created', {
                 cwd: source.cwd,
                 local_workspace: true,
                 local_coding: this.localCoding(id),
                 output_cap: this.localOutputCap(id) ?? true,
+                ...(this.toolExecution ? { tool_execution: this.toolExecution } : {}),
                 forked_from: id,
             }, request);
             const route = this.providerRoute(id);
@@ -482,7 +496,13 @@ export class Store {
             this.db
                 .prepare('INSERT INTO pi_entries SELECT ?,entry_id,payload FROM pi_entries WHERE session_id=?')
                 .run(target, id);
-            this.event(target, 'session.forked', { parent: id, parent_revision: expected, leaf: source.pi_leaf, cursor: source.pi_cursor }, request);
+            this.event(target, 'session.forked', {
+                parent: id,
+                parent_revision: expected,
+                leaf: at ? at.leaf : source.pi_leaf,
+                cursor: source.pi_cursor,
+                ...(at ? { rewound: true } : {}),
+            }, request);
             return this.session(target);
         });
     }
@@ -502,6 +522,21 @@ export class Store {
             return { name };
         });
     }
+    /** Wall-clock time of the last committed event for a session in this process, if any. */
+    lastActivity(id) {
+        return this.activity.get(id) ?? null;
+    }
+    /** The newest committed event in this process, or the time the store opened. */
+    lastActivityAny() {
+        return Math.max(this.openedAt, ...this.activity.values());
+    }
+    /** The newest prompt submitted to a session, for the session picker. */
+    lastPrompt(id) {
+        const row = this.db
+            .prepare('SELECT text FROM submissions WHERE session_id=? ORDER BY rowid DESC LIMIT 1')
+            .get(id);
+        return row?.text ?? null;
+    }
     sessions() {
         return this.db.prepare('SELECT id FROM sessions ORDER BY rowid').all().map((x) => this.session(x.id));
     }
@@ -554,6 +589,23 @@ export class Store {
             }
         });
     }
+    /**
+     * The one sanctioned route change: an operator switching model or thinking level in an
+     * interactive session between turns. Recorded as provider.route_changed; the worker restarts on
+     * the same Pi transcript with the new route.
+     */
+    switchRoute(id, route) {
+        return this.transaction(() => {
+            const from = this.providerRoute(id);
+            if (!from || !this.localWorkspace(id))
+                throw new ServiceError('route_switch_unavailable', 'Only interactive sessions can switch model mid-session', 409);
+            this.db
+                .prepare('UPDATE session_routes SET route=? WHERE session_id=?')
+                .run(canonical(route), id);
+            this.event(id, 'provider.route_changed', { from, to: route });
+            return { from, to: route };
+        });
+    }
     providerRoute(id) {
         const row = this.db.prepare('SELECT route FROM session_routes WHERE session_id=?').get(id);
         return row ? JSON.parse(row.route) : null;
@@ -901,6 +953,9 @@ export class Store {
         const lookup = this.db.prepare('SELECT payload FROM pi_entries WHERE session_id=? AND entry_id=?');
         let remaining = 256 * 1024;
         const messages = [];
+        // Walking back from the newest entry: tool calls belong just before the message that follows
+        // them, so a turn's calls are shown in place rather than gathered at the end.
+        let trailing = [];
         while (cursor &&
             !seen.has(cursor) &&
             seen.size < 10000 &&
@@ -915,6 +970,16 @@ export class Store {
             const message = entry.message;
             if (!message || !['user', 'assistant'].includes(message.role))
                 continue;
+            if (Array.isArray(message.content)) {
+                const calls = message.content
+                    .filter((part) => part.type === 'toolCall')
+                    .map((part) => String(part.id));
+                const later = messages.at(-1);
+                if (calls.length && later)
+                    later.tool_calls = [...calls, ...(later.tool_calls ?? [])];
+                else if (calls.length)
+                    trailing = [...calls, ...trailing];
+            }
             const text = typeof message.content === 'string'
                 ? message.content
                 : message.content
@@ -945,6 +1010,7 @@ export class Store {
             attempts: boundedAttempts,
             submissions: boundedSubmissions,
             messages: messages.reverse(),
+            ...(trailing.length ? { trailing_tool_calls: trailing } : {}),
             history_truncated: cursor !== null,
             approvals: this.approvals(id),
             operations: this.operations(id),