praxis-agent 0.27.0 → 0.28.0

package/dist/application/session-service.js

@@ -16,6 +16,7 @@ import { selectClaudeSchemaAdapter, } from '../compatibility/claude/schema.js';
 import { findUnresolvedClaudeToolCalls, getClaudeContentBlocks, } from '../compatibility/claude/tool-links.js';
 import { createClaudeAgentSettingEntry, createClaudeHookAttachmentEntries, createClaudeLastPromptEntry, createClaudeRuleAttachmentEntry, translateProviderEvents, } from '../compatibility/claude/translation.js';
 import { AgentRunCancelledError, AgentRuntime, } from '../core/runtime.js';
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 import { BackgroundTaskRuntime, } from './background-task-runtime.js';
 import { usageCostUsd } from '../core/usage.js';
 import { ContextBudget, ContextRecoveryPlanner, estimateModelRequestTokens, isPromptTooLongError, } from '../core/context-budget.js';
@@ -61,6 +62,7 @@ function mainAgentToolNames(tools, agent) {
 }
 const emptyToolRegistry = {
     definitions: () => [],
+    schedulingPolicy: () => ({ concurrency: 'exclusive' }),
     prepare: async (call) => call,
     execute: async () => ({ content: '', isError: false }),
 };
@@ -943,6 +945,7 @@ export class ClaudeSessionService {
                         (rightIndex < 0 ? preferredOrder.length : rightIndex));
                 });
             },
+            schedulingPolicy: (call) => resolveToolSchedulingPolicy(capabilityRegistry, call),
             prepare: (call, context) => capabilityRegistry.prepare(call, context),
             execute: (call, context) => capabilityRegistry.execute(call, context),
         };
@@ -2316,6 +2319,10 @@ export class ClaudeSessionService {
             const fileHistoryTools = fileHistory && interactiveMessageTools
                 ? {
                     definitions: () => interactiveMessageTools.definitions(),
+                    schedulingPolicy: (call) => ({
+                        ...resolveToolSchedulingPolicy(interactiveMessageTools, call),
+                        startAfterAssistant: true,
+                    }),
                     prepare: (call, context) => interactiveMessageTools.prepare(call, context),
                     execute: async (call, context) => {
                         const path = call.name === 'Write' || call.name === 'Edit'
@@ -3083,7 +3090,7 @@ export class ClaudeSessionService {
                     toolResultDirectory,
                     observer,
                     ...(this.options.effort ? { effort: this.options.effort } : {}),
-                    ...(this.options.maxModelTurns
+                    ...(this.options.maxModelTurns !== undefined
                         ? { maxModelTurns: this.options.maxModelTurns }
                         : {}),
                     ...(this.options.betas?.length ? { betas: this.options.betas } : {}),

package/dist/application/subagent-service.d.ts

@@ -45,6 +45,7 @@ export declare class StructuredOutputRegistry implements ToolRegistry {
         value: unknown;
     } | undefined);
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy(call: ModelToolCall): import("../core/runtime.js").ToolSchedulingPolicy;
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
 }

package/dist/application/subagent-service.js

@@ -11,6 +11,7 @@ import { createClaudeHookAttachmentEntries, translateProviderEvents, } from '../
 import { injectFirstUserMessageContext, } from '../core/context.js';
 import { ContextBudget } from '../core/context-budget.js';
 import { AgentRuntime, } from '../core/runtime.js';
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 import { BUILTIN_STATUSLINE_AGENT_PATH, } from '../extensions/claude-extensions.js';
 import { ClaudeHookToolCoordinator } from '../hooks/claude-hook-tools.js';
 import { ClaudeSidechainStore } from '../persistence/claude-sidechain-store.js';
@@ -26,6 +27,7 @@ const DEFAULT_MAX_OUTPUT_BYTES = 1024 * 1024;
 const SIDECHAIN_DISCOVERY_MAX_DEPTH = 4;
 const structuredOnlyTools = {
     definitions: () => [],
+    schedulingPolicy: () => ({ concurrency: 'exclusive' }),
     prepare: async (call) => call,
     execute: async () => ({ content: '', isError: false }),
 };
@@ -68,6 +70,12 @@ export class StructuredOutputRegistry {
                 ]),
         ];
     }
+    schedulingPolicy(call) {
+        if (call.name === 'StructuredOutput') {
+            return { concurrency: 'exclusive' };
+        }
+        return resolveToolSchedulingPolicy(this.base, call);
+    }
     prepare(call, context) {
         if (call.name !== 'StructuredOutput')
             return this.base.prepare(call, context);
@@ -106,6 +114,12 @@ class RestrictedToolRegistry {
             .definitions()
             .filter((definition) => this.allowed.has(definition.name));
     }
+    schedulingPolicy(call) {
+        if (!this.allowed.has(call.name)) {
+            return { concurrency: 'exclusive' };
+        }
+        return resolveToolSchedulingPolicy(this.base, call);
+    }
     prepare(call, context) {
         if (!this.allowed.has(call.name))
             throw new Error(`Tool ${call.name} is unavailable to this agent`);
@@ -1353,7 +1367,9 @@ export class ClaudeSubagentExecutor {
         const runtime = new AgentRuntime(options.provider, emit, {
             tools: runtimeTools,
             permissions: runtimePermissions,
-            maxModelTurns: customAgent?.maxTurns ?? 16,
+            ...(customAgent?.maxTurns === undefined
+                ? {}
+                : { maxModelTurns: customAgent.maxTurns }),
             maxModelOutputBytes: this.options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES,
             maxToolCallsPerTurn: 32,
             maxToolInputBytes: 1024 * 1024,
@@ -1647,6 +1663,12 @@ class ClaudeSubagentToolRegistry {
             ...ordinary.slice(insertionIndex),
         ];
     }
+    schedulingPolicy(call) {
+        if (['Agent', 'SendMessage', 'TaskOutput', 'TaskStop'].includes(call.name)) {
+            return { concurrency: 'exclusive', cancelOnInterrupt: true };
+        }
+        return resolveToolSchedulingPolicy(this.base, call);
+    }
     async prepare(call, context) {
         if (call.name === 'Agent')
             return this.executor.prepare(call, this.depth);

package/dist/core/runtime.d.ts

@@ -322,8 +322,15 @@ export interface ToolExecutionContext {
     permissionPhase?: 'request' | 'execute';
     permissionApproved?: boolean;
 }
+export interface ToolSchedulingPolicy {
+    concurrency: 'concurrent' | 'exclusive';
+    cancelOnInterrupt?: boolean;
+    abortGroupOnError?: boolean;
+    startAfterAssistant?: boolean;
+}
 export interface ToolRegistry {
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy?(call: ModelToolCall): ToolSchedulingPolicy;
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
 }
@@ -514,6 +521,9 @@ export declare class AgentRuntime {
     recoverToolCalls(calls: readonly ModelToolCall[], request: AgentToolRecoveryRequest): Promise<ToolExecutionResult[]>;
     executeDirectToolCall(call: ModelToolCall, request: AgentToolRecoveryRequest): Promise<ToolExecutionResult>;
     private completeToolCall;
+    private executeScheduledToolCall;
+    private presentToolResult;
+    private persistToolCall;
     private executeTool;
     private requireRecoveryApproval;
     private cancel;

package/dist/core/runtime.js

@@ -1,3 +1,5 @@
+import { ToolExecutionScheduler } from './tool-execution-scheduler.js';
+import { resolveToolSchedulingPolicy } from './tool-scheduling-policy.js';
 const permissionDecisionSources = new WeakMap();
 const autoModePermissionOutcomes = new WeakMap();
 export function annotatePermissionDecision(decision, source) {
@@ -274,13 +276,23 @@ export class AgentRuntime {
         const definitions = this.provider.capabilities.tools
             ? (this.options.tools?.definitions() ?? [])
             : [];
-        const maxModelTurns = request.maxModelTurns ?? this.options.maxModelTurns ?? 16;
+        const maxModelTurns = request.maxModelTurns ?? this.options.maxModelTurns;
+        if (maxModelTurns !== undefined &&
+            (!Number.isSafeInteger(maxModelTurns) || maxModelTurns <= 0)) {
+            throw new TypeError('maxModelTurns must be a positive integer');
+        }
         const maxModelOutputBytes = this.options.maxModelOutputBytes ?? 1024 * 1024;
         const maxToolCallsPerTurn = this.options.maxToolCallsPerTurn ?? 32;
         const maxToolInputBytes = this.options.maxToolInputBytes ?? 1024 * 1024;
         let pendingToolUseSummary;
         try {
-            for (let turn = 0; turn < maxModelTurns; turn += 1) {
+            let modelTurns = 0;
+            while (true) {
+                if (request.signal?.aborted)
+                    return this.cancel();
+                if (maxModelTurns !== undefined && modelTurns >= maxModelTurns) {
+                    throw new Error(`Maximum model turns of ${maxModelTurns} exceeded`);
+                }
                 if (pendingToolUseSummary) {
                     const summaryRequest = pendingToolUseSummary;
                     pendingToolUseSummary = undefined;
@@ -326,6 +338,7 @@ export class AgentRuntime {
                     spent >= this.options.maxBudgetUsd) {
                     throw new Error(`Maximum budget of $${this.options.maxBudgetUsd.toFixed(6)} exceeded`);
                 }
+                modelTurns += 1;
                 this.emit({ type: 'state', state: 'awaiting-model' });
                 const providerRequest = {
                     messages: prepareProviderMessages(messages, this.provider.capabilities.images === true, this.provider.capabilities.documents === true),
@@ -347,6 +360,25 @@ export class AgentRuntime {
                 let streaming = false;
                 const toolCalls = [];
                 let terminalReason;
+                const toolScheduler = new ToolExecutionScheduler({
+                    ...(request.signal ? { parentSignal: request.signal } : {}),
+                    execute: (call, signal) => this.executeScheduledToolCall(call, request, messages, signal),
+                    isError: (result) => result.isError,
+                    cancelledResult: (call, reason) => ({
+                        content: `${call.name} cancelled: ${reason instanceof Error ? reason.message : String(reason)}`,
+                        isError: true,
+                    }),
+                    failedResult: (call, reason) => ({
+                        content: `${call.name} failed: ${reason instanceof Error ? reason.message : String(reason)}`,
+                        isError: true,
+                    }),
+                    resultCompleted: (call, result) => this.presentToolResult(call, result),
+                });
+                const failScheduledTurn = async (error) => {
+                    toolScheduler.abort(error);
+                    await toolScheduler.settle().catch(() => undefined);
+                    throw error;
+                };
                 const apiStartedAt = request.collectMetrics ? performance.now() : 0;
                 let turnApiDurationMs = 0;
                 let turnApiDurationWithoutRetriesMs;
@@ -422,6 +454,7 @@ export class AgentRuntime {
                             }
                             toolCalls.push(event.call);
                             this.emit(event);
+                            toolScheduler.schedule(event.call, resolveToolSchedulingPolicy(this.options.tools, event.call));
                         }
                         else if (event.type === 'terminal') {
                             terminalReason = event.reason;
@@ -433,6 +466,19 @@ export class AgentRuntime {
                         }
                     }
                 }
+                catch (error) {
+                    if (!request.signal?.aborted &&
+                        !(error instanceof AgentRunCancelledError)) {
+                        toolScheduler.abort(error);
+                    }
+                    else {
+                        toolScheduler.releaseExclusiveTools();
+                    }
+                    await toolScheduler.settle().catch(() => undefined);
+                    if (request.signal?.aborted)
+                        return this.cancel();
+                    throw error;
+                }
                 finally {
                     if (request.collectMetrics) {
                         turnApiDurationMs = Math.max(0, performance.now() - apiStartedAt);
@@ -442,15 +488,15 @@ export class AgentRuntime {
                 }
                 if (this.provider.capabilities.terminalReasons === true &&
                     terminalReason === undefined) {
-                    throw new ModelProviderError('Provider stream ended without a terminal reason', { retryable: true });
+                    return failScheduledTurn(new ModelProviderError('Provider stream ended without a terminal reason', { retryable: true }));
                 }
                 if (terminalReason === 'tool_use' && toolCalls.length === 0) {
-                    throw new ModelProviderError('Provider reported tool_use without a completed tool call', { retryable: false });
+                    return failScheduledTurn(new ModelProviderError('Provider reported tool_use without a completed tool call', { retryable: false }));
                 }
                 if (terminalReason !== undefined &&
                     terminalReason !== 'tool_use' &&
                     toolCalls.length > 0) {
-                    throw new ModelProviderError(`Provider reported ${terminalReason} with completed tool calls`, { retryable: false });
+                    return failScheduledTurn(new ModelProviderError(`Provider reported ${terminalReason} with completed tool calls`, { retryable: false }));
                 }
                 if (request.collectMetrics) {
                     const turnApiDurationWithoutRetriesMsResolved = turnApiDurationWithoutRetriesMs ?? turnApiDurationMs;
@@ -480,8 +526,14 @@ export class AgentRuntime {
                         ...(thinkingBlocks.length > 0 ? { thinkingBlocks } : {}),
                         toolCalls,
                     };
-                await request.observer?.assistantCompleted(assistantMessage);
+                try {
+                    await request.observer?.assistantCompleted(assistantMessage);
+                }
+                catch (error) {
+                    return failScheduledTurn(error);
+                }
                 messages.push(assistantMessage);
+                toolScheduler.releaseExclusiveTools();
                 if (toolCalls.length === 0) {
                     const stopResult = (await request.onStop?.(text)) ?? [];
                     const stopBatch = Array.isArray(stopResult)
@@ -547,10 +599,11 @@ export class AgentRuntime {
                         ...(linesRemoved === 0 ? {} : { linesRemoved }),
                     };
                 }
+                const scheduledToolResults = await toolScheduler.settle();
                 const followUpUserMessages = [];
                 const completedTools = [];
-                for (const call of toolCalls) {
-                    const result = await this.completeToolCall(call, request, messages);
+                for (const { call, result } of scheduledToolResults) {
+                    await this.persistToolCall(call, result, request);
                     completedTools.push({
                         name: call.name,
                         input: call.input,
@@ -584,6 +637,10 @@ export class AgentRuntime {
                     });
                     followUpUserMessages.push(...(result.followUpUserMessages ?? []));
                 }
+                const toolFailure = toolScheduler.failure;
+                if (toolFailure) {
+                    throw toolFailure.error;
+                }
                 if (this.options.generateToolUseSummary) {
                     const summarySignal = request.signal ?? new AbortController().signal;
                     pendingToolUseSummary = {
@@ -609,7 +666,6 @@ export class AgentRuntime {
                     messages.splice(0, messages.length, ...reloadedMessages);
                 }
             }
-            throw new Error(`Agent exceeded ${maxModelTurns} model turns`);
         }
         catch (error) {
             if (request.signal?.aborted)
@@ -659,19 +715,38 @@ export class AgentRuntime {
         return result;
     }
     async completeToolCall(call, request, messages = request.messages ?? [], emitPresentation = true) {
+        const signal = request.signal ?? new AbortController().signal;
+        let result;
+        try {
+            result = await this.executeScheduledToolCall(call, request, messages, signal, emitPresentation);
+        }
+        catch (error) {
+            if (request.signal?.aborted)
+                return this.cancel();
+            throw error;
+        }
+        if (emitPresentation)
+            this.presentToolResult(call, result);
+        await this.persistToolCall(call, result, request);
+        return result;
+    }
+    async executeScheduledToolCall(call, request, messages, signal, emitPresentation = true) {
         const startedAt = performance.now();
-        const emitProgress = () => this.emit({
+        const emitProgress = (elapsedTimeSeconds) => this.emit({
             type: 'tool-progress',
             toolUseId: call.id,
             toolName: call.name,
-            elapsedTimeSeconds: Math.max(0, Math.round(((performance.now() - startedAt) / 1000) * 1000) / 1000),
+            elapsedTimeSeconds: elapsedTimeSeconds ??
+                Math.max(0, Math.round(((performance.now() - startedAt) / 1000) * 1000) / 1000),
         });
         const progressTimer = emitPresentation
             ? setInterval(emitProgress, 1000)
             : undefined;
         progressTimer?.unref();
         try {
-            const executed = await this.executeTool(call, request, messages);
+            if (emitPresentation)
+                emitProgress(0);
+            const executed = await this.executeTool(call, { ...request, signal }, messages);
             const unsupportedImages = executed.images?.length && this.provider.capabilities.images !== true;
             const unsupportedDocuments = executed.documents?.length &&
                 this.provider.capabilities.documents !== true;
@@ -690,16 +765,8 @@ export class AgentRuntime {
                         : {}),
                 }
                 : executed;
-            this.emit({ type: 'state', state: 'persisting-results' });
-            await request.observer?.toolCompleted(call, result);
             if (emitPresentation) {
                 emitProgress();
-                this.emit({
-                    type: 'tool-result',
-                    callId: call.id,
-                    content: result.content,
-                    isError: result.isError,
-                });
             }
             return result;
         }
@@ -708,6 +775,18 @@ export class AgentRuntime {
                 clearInterval(progressTimer);
         }
     }
+    presentToolResult(call, result) {
+        this.emit({
+            type: 'tool-result',
+            callId: call.id,
+            content: result.content,
+            isError: result.isError,
+        });
+    }
+    async persistToolCall(call, result, request) {
+        this.emit({ type: 'state', state: 'persisting-results' });
+        await request.observer?.toolCompleted(call, result);
+    }
     async executeTool(call, request, messages) {
         const tools = this.options.tools;
         const permissions = this.options.permissions;
@@ -808,8 +887,9 @@ export class AgentRuntime {
                         : 'Permission approval was not provided');
             return { content: reason, isError: true };
         }
-        if (request.signal?.aborted)
-            return this.cancel();
+        if (request.signal?.aborted) {
+            throw request.signal.reason ?? new AgentRunCancelledError();
+        }
         this.emit({ type: 'state', state: 'executing-tools' });
         context.permissionPhase = 'execute';
         context.permissionApproved = true;
@@ -829,8 +909,9 @@ export class AgentRuntime {
             };
         }
         catch (error) {
-            if (request.signal?.aborted)
-                return this.cancel();
+            if (request.signal?.aborted) {
+                throw request.signal.reason ?? new AgentRunCancelledError();
+            }
             const durationToolMs = Math.max(0, performance.now() - toolStartedAt);
             return {
                 content: error instanceof Error ? error.message : String(error),
@@ -840,13 +921,15 @@ export class AgentRuntime {
         }
     }
     async requireRecoveryApproval(call, request) {
-        if (request.signal?.aborted)
-            return this.cancel();
+        if (request.signal?.aborted) {
+            throw request.signal.reason ?? new AgentRunCancelledError();
+        }
         if (request.approveRecovery && !(await request.approveRecovery(call))) {
             throw new Error(`Tool call ${call.id} recovery was declined`);
         }
-        if (request.signal?.aborted)
-            return this.cancel();
+        if (request.signal?.aborted) {
+            throw request.signal.reason ?? new AgentRunCancelledError();
+        }
     }
     cancel() {
         this.emit({ type: 'state', state: 'cancelled' });

package/dist/core/tool-execution-scheduler.d.ts

@@ -0,0 +1,38 @@
+import type { ModelToolCall, ToolSchedulingPolicy } from './runtime.js';
+interface ScheduledToolResult<TResult> {
+    call: ModelToolCall;
+    result: TResult;
+}
+interface ToolExecutionSchedulerOptions<TResult> {
+    parentSignal?: AbortSignal;
+    execute(call: ModelToolCall, signal: AbortSignal): Promise<TResult>;
+    isError(result: TResult): boolean;
+    cancelledResult(call: ModelToolCall, reason: unknown): TResult;
+    failedResult(call: ModelToolCall, reason: unknown): TResult;
+    resultCompleted(call: ModelToolCall, result: TResult): void;
+}
+export declare class ToolExecutionScheduler<TResult> {
+    private readonly options;
+    private readonly groupController;
+    private readonly exclusiveStart;
+    private releaseExclusiveStart;
+    private exclusiveStarted;
+    private hasFailure;
+    private firstFailure;
+    private readonly scheduled;
+    private readonly completionOrder;
+    private precedingBarrier;
+    private concurrentGroup;
+    constructor(options: ToolExecutionSchedulerOptions<TResult>);
+    schedule(call: ModelToolCall, policy: ToolSchedulingPolicy): void;
+    abort(reason?: unknown): void;
+    releaseExclusiveTools(): void;
+    settle(): Promise<readonly ScheduledToolResult<TResult>[]>;
+    get failure(): {
+        error: unknown;
+    } | undefined;
+    private record;
+    private executionSignal;
+}
+export {};
+//# sourceMappingURL=tool-execution-scheduler.d.ts.map

package/dist/core/tool-execution-scheduler.js

@@ -0,0 +1,95 @@
+const settled = Promise.resolve();
+export class ToolExecutionScheduler {
+    options;
+    groupController = new AbortController();
+    exclusiveStart;
+    releaseExclusiveStart;
+    exclusiveStarted = false;
+    hasFailure = false;
+    firstFailure;
+    scheduled = [];
+    completionOrder = [];
+    precedingBarrier = settled;
+    concurrentGroup = [];
+    constructor(options) {
+        this.options = options;
+        this.exclusiveStart = new Promise((resolve) => {
+            this.releaseExclusiveStart = resolve;
+        });
+    }
+    schedule(call, policy) {
+        const predecessors = policy.concurrency === 'exclusive'
+            ? Promise.allSettled([
+                ...(policy.startAfterAssistant ? [this.exclusiveStart] : []),
+                this.precedingBarrier,
+                ...this.concurrentGroup,
+            ]).then(() => undefined)
+            : this.precedingBarrier;
+        const signal = this.executionSignal(policy);
+        const execution = predecessors.then(async () => {
+            let result;
+            try {
+                if (signal.aborted)
+                    throw signal.reason;
+                result = await this.options.execute(call, signal);
+                if (signal.aborted)
+                    throw signal.reason;
+            }
+            catch (error) {
+                if (signal.aborted) {
+                    result = this.options.cancelledResult(call, error);
+                }
+                else {
+                    if (!this.hasFailure) {
+                        this.hasFailure = true;
+                        this.firstFailure = error;
+                    }
+                    result = this.options.failedResult(call, error);
+                }
+            }
+            this.record(call, result);
+            if (policy.abortGroupOnError && this.options.isError(result)) {
+                this.groupController.abort(new Error(`Tool ${call.name} failed; cancelling streamed siblings`));
+            }
+        });
+        this.scheduled.push(execution);
+        if (policy.concurrency === 'exclusive') {
+            this.precedingBarrier = execution.catch(() => undefined);
+            this.concurrentGroup = [];
+        }
+        else {
+            this.concurrentGroup.push(execution.catch(() => undefined));
+        }
+    }
+    abort(reason) {
+        this.releaseExclusiveTools();
+        this.groupController.abort(reason);
+    }
+    releaseExclusiveTools() {
+        if (this.exclusiveStarted)
+            return;
+        this.exclusiveStarted = true;
+        this.releaseExclusiveStart();
+    }
+    async settle() {
+        await Promise.all(this.scheduled);
+        return this.completionOrder;
+    }
+    get failure() {
+        return this.hasFailure ? { error: this.firstFailure } : undefined;
+    }
+    record(call, result) {
+        this.completionOrder.push({ call, result });
+        this.options.resultCompleted(call, result);
+    }
+    executionSignal(policy) {
+        const signals = [this.groupController.signal];
+        if (policy.cancelOnInterrupt && this.options.parentSignal) {
+            signals.push(this.options.parentSignal);
+        }
+        return signals.length === 1
+            ? this.groupController.signal
+            : AbortSignal.any(signals);
+    }
+}
+//# sourceMappingURL=tool-execution-scheduler.js.map

package/dist/core/tool-scheduling-policy.d.ts

@@ -0,0 +1,4 @@
+import type { ModelToolCall, ToolRegistry, ToolSchedulingPolicy } from './runtime.js';
+export declare const exclusiveToolSchedulingPolicy: ToolSchedulingPolicy;
+export declare function resolveToolSchedulingPolicy(tools: ToolRegistry | undefined, call: ModelToolCall): ToolSchedulingPolicy;
+//# sourceMappingURL=tool-scheduling-policy.d.ts.map

package/dist/core/tool-scheduling-policy.js

@@ -0,0 +1,24 @@
+export const exclusiveToolSchedulingPolicy = {
+    concurrency: 'exclusive',
+};
+export function resolveToolSchedulingPolicy(tools, call) {
+    try {
+        const policy = tools?.schedulingPolicy?.(structuredClone(call));
+        if (!policy ||
+            (policy.concurrency !== 'concurrent' &&
+                policy.concurrency !== 'exclusive') ||
+            (policy.cancelOnInterrupt !== undefined &&
+                typeof policy.cancelOnInterrupt !== 'boolean') ||
+            (policy.abortGroupOnError !== undefined &&
+                typeof policy.abortGroupOnError !== 'boolean') ||
+            (policy.startAfterAssistant !== undefined &&
+                typeof policy.startAfterAssistant !== 'boolean')) {
+            return exclusiveToolSchedulingPolicy;
+        }
+        return policy;
+    }
+    catch {
+        return exclusiveToolSchedulingPolicy;
+    }
+}
+//# sourceMappingURL=tool-scheduling-policy.js.map

package/dist/extensions/claude-extension-tools.d.ts

@@ -5,6 +5,7 @@ export declare class ClaudeExtensionToolRegistry implements ToolRegistry {
     private readonly catalog;
     constructor(base: ToolRegistry, catalog: ClaudeExtensionCatalog);
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy(call: ModelToolCall): import("../core/runtime.js").ToolSchedulingPolicy;
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
 }

package/dist/extensions/claude-extension-tools.js

@@ -1,3 +1,4 @@
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 function skillInput(call) {
     const skill = call.input.skill;
     const args = call.input.args ?? '';
@@ -39,6 +40,11 @@ export class ClaudeExtensionToolRegistry {
             },
         ];
     }
+    schedulingPolicy(call) {
+        if (call.name === 'Skill')
+            return { concurrency: 'exclusive' };
+        return resolveToolSchedulingPolicy(this.base, call);
+    }
     async prepare(call, context) {
         if (call.name !== 'Skill')
             return this.base.prepare(call, context);

package/dist/hooks/claude-hook-tools.d.ts

@@ -19,6 +19,10 @@ export declare class ClaudeHookToolCoordinator implements ToolRegistry, Permissi
     private readonly prepared;
     constructor(options: ClaudeHookToolCoordinatorOptions);
     definitions(): readonly import("../core/runtime.js").ModelToolDefinition[];
+    schedulingPolicy(): {
+        concurrency: "exclusive";
+        startAfterAssistant: boolean;
+    };
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     resolve(call: ModelToolCall, context?: PermissionResolutionContext): Promise<PermissionDecision>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;

package/dist/hooks/claude-hook-tools.js

@@ -7,6 +7,12 @@ export class ClaudeHookToolCoordinator {
     definitions() {
         return this.options.tools.definitions();
     }
+    schedulingPolicy() {
+        return {
+            concurrency: 'exclusive',
+            startAfterAssistant: true,
+        };
+    }
     async prepare(call, context) {
         const outcome = await this.options.hooks.run({
             ...this.options.session,

package/dist/mcp/claude-mcp-tools.d.ts

@@ -102,6 +102,7 @@ export declare class ClaudeMcpToolRegistry implements ToolRegistry, ClaudeMcpRun
     private constructor();
     static connect(options: ClaudeMcpToolRegistryOptions): Promise<ClaudeMcpToolRegistry>;
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy(call: ModelToolCall): import("../core/runtime.js").ToolSchedulingPolicy;
     serverStatuses(): readonly ClaudeMcpServerStatus[];
     inspect(): Promise<readonly ClaudeMcpServerStatus[]>;
     reconnect(name: string): Promise<void>;

package/dist/mcp/claude-mcp-tools.js

@@ -7,6 +7,8 @@ import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { ElicitRequestSchema, ElicitationCompleteNotificationSchema, PromptListChangedNotificationSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 import { redactSensitiveError, redactSensitiveText, redactSensitiveValue, sanitizeChildEnvironment, sensitiveEnvironmentValues, } from '../platform/sensitive-data.js';
 import { parsePermissionUpdates } from '../permissions/permission-updates.js';
 import { loadMcpOAuthProvider, mcpOAuthServerIdentity, } from './claude-mcp-oauth.js';
@@ -77,6 +79,28 @@ const MCP_RESOURCE_TOOL_DEFINITIONS = [
         },
     },
 ];
+const schedulingAjv = new Ajv2020({ strict: false, validateFormats: false });
+function schedulingInputValidator(schema) {
+    try {
+        const validate = schedulingAjv.compile(schema);
+        return (input) => validate(input) === true;
+    }
+    catch {
+        return undefined;
+    }
+}
+function mcpResourceSchedulingInputIsValid(call) {
+    const keys = Object.keys(call.input);
+    if (call.name === 'ListMcpResourcesTool') {
+        return (keys.every((name) => name === 'server') &&
+            (call.input.server === undefined || typeof call.input.server === 'string'));
+    }
+    return ((call.name === 'ReadMcpResourceDirTool' ||
+        call.name === 'ReadMcpResourceTool') &&
+        keys.every((name) => name === 'server' || name === 'uri') &&
+        typeof call.input.server === 'string' &&
+        typeof call.input.uri === 'string');
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -687,6 +711,21 @@ export class ClaudeMcpToolRegistry {
             ...(this.resourceServers.size > 0 ? MCP_RESOURCE_TOOL_DEFINITIONS : []),
         ];
     }
+    schedulingPolicy(call) {
+        if (MCP_RESOURCE_TOOL_DEFINITIONS.some((definition) => definition.name === call.name)) {
+            return mcpResourceSchedulingInputIsValid(call)
+                ? { concurrency: 'concurrent', cancelOnInterrupt: true }
+                : { concurrency: 'exclusive', cancelOnInterrupt: true };
+        }
+        const connected = this.connectedTools.get(call.name);
+        if (connected) {
+            return connected.readOnly &&
+                connected.schedulingInputIsValid?.(call.input)
+                ? { concurrency: 'concurrent', cancelOnInterrupt: true }
+                : { concurrency: 'exclusive', cancelOnInterrupt: true };
+        }
+        return resolveToolSchedulingPolicy(this.options.base, call);
+    }
     serverStatuses() {
         return [...this.statuses.values()].map(({ name, status }) => ({
             name,
@@ -1070,10 +1109,13 @@ export class ClaudeMcpToolRegistry {
                 if (this.connectedTools.has(name) || connectedTools.has(name)) {
                     throw new Error(`Duplicate MCP tool ${name}`);
                 }
+                const inputIsValid = schedulingInputValidator(tool.inputSchema);
                 connectedTools.set(name, {
                     client,
                     serverName,
                     toolName: tool.name,
+                    readOnly: tool.annotations?.readOnlyHint === true,
+                    ...(inputIsValid ? { schedulingInputIsValid: inputIsValid } : {}),
                     sensitiveValues,
                     definition: {
                         name,

package/dist/permissions/claude-permission-resolver.js

@@ -9,7 +9,7 @@ import { shellPermissionMatchCandidates } from './bash-normalization.js';
 import { pathIsInsideRoots, validateBashPathSafety, } from './bash-path-safety.js';
 import { validateSedSafety } from './sed-safety.js';
 import { parseShellRule, shellRuleMatches } from './shell-rule-matching.js';
-import { effectiveAdditionalDirectories, effectivePermissionMode, filePermissionSuggestions, permissionRuleValueFromString, permissionRuleValueToString, shellCommandIsReadOnly, shellPermissionSuggestions, shellSubcommands, skillPermissionSuggestions, } from './permission-updates.js';
+import { effectiveAdditionalDirectories, effectivePermissionMode, filePermissionSuggestions, permissionRuleValueFromString, permissionRuleValueToString, shellInputIsReadOnly, shellPermissionSuggestions, shellSubcommands, skillPermissionSuggestions, } from './permission-updates.js';
 const DEFAULT_BEHAVIOR = {
     Agent: 'allow',
     SendMessage: 'allow',
@@ -536,8 +536,8 @@ export class ClaudePermissionResolver {
         if (command &&
             (permissionMode !== 'auto' || !this.shouldClassify(call)) &&
             subcommands.length > 0 &&
-            subcommands.every((subcommand) => shellCommandIsReadOnly(subcommand) ||
-                matchingRule('allow', subcommandCall(subcommand)) !== undefined)) {
+            (shellInputIsReadOnly(command) ||
+                subcommands.every((subcommand) => matchingRule('allow', subcommandCall(subcommand)) !== undefined))) {
             return annotatePermissionDecision({ behavior: 'allow' }, 'rule');
         }
         const filePath = FILE_TOOLS.has(call.name) ? permissionTarget(call) : null;

package/dist/permissions/permission-updates.d.ts

@@ -11,6 +11,7 @@ export declare function readDirectoryPermissionUpdate(path: string, cwd: string,
 export declare function filePermissionSuggestions(path: string, cwd: string, operation: 'read' | 'write', mode: PermissionMode, outsideWorkingDirectory: boolean, pathsToCheck?: readonly string[], targetIsDirectory?: boolean): readonly PermissionUpdate[];
 export declare function shellSubcommands(command: string, shell?: 'bash' | 'powershell'): readonly string[];
 export declare function shellCommandIsReadOnly(command: string): boolean;
+export declare function shellInputIsReadOnly(command: string): boolean;
 export declare function shellPermissionSuggestions(toolName: 'Bash' | 'PowerShell', command: string, include?: (subcommand: string) => boolean): readonly PermissionUpdate[];
 export declare function skillPermissionSuggestions(skill: string): readonly PermissionUpdate[];
 //# sourceMappingURL=permission-updates.d.ts.map

package/dist/permissions/permission-updates.js

@@ -281,11 +281,23 @@ const READ_ONLY_SHELL_COMMANDS = new Set([
 function commandName(command) {
     return command.trim().split(/\s+/u)[0] ?? '';
 }
+const AMBIGUOUS_SHELL_SYNTAX = /[<>`$*?[\]{}~]/u;
 export function shellCommandIsReadOnly(command) {
-    if (/[<>`]|$\(|\|\||&&|[;|\n\r]/u.test(command))
+    if (AMBIGUOUS_SHELL_SYNTAX.test(command) || /[&;|\n\r]/u.test(command)) {
         return false;
+    }
     return READ_ONLY_SHELL_COMMANDS.has(commandName(command));
 }
+export function shellInputIsReadOnly(command) {
+    if (AMBIGUOUS_SHELL_SYNTAX.test(command) ||
+        /(^|[^&])&($|[^&])/u.test(command)) {
+        return false;
+    }
+    const analysis = analyzeBashCommands(command);
+    return (analysis.parsed &&
+        analysis.commands.length > 0 &&
+        analysis.commands.every(shellCommandIsReadOnly));
+}
 export function shellPermissionSuggestions(toolName, command, include = () => true) {
     const parts = shellSubcommands(command, toolName === 'Bash' ? 'bash' : 'powershell');
     const candidates = (parts.length > 0 ? parts : [command]).filter((part) => !shellCommandIsReadOnly(part) && include(part));

package/dist/tools/claude-capabilities.d.ts

@@ -72,6 +72,7 @@ export declare class ClaudeCapabilityToolRegistry implements ToolRegistry {
     private readonly capabilities;
     constructor(base: ToolRegistry, capabilities: ReadonlySet<string>);
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy(call: ModelToolCall): import("../core/runtime.js").ToolSchedulingPolicy;
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
     private assertEnabled;

package/dist/tools/claude-capabilities.js

@@ -1,3 +1,4 @@
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 /** Stable environment names. Explicit input booleans override these. */
 export const CLAUDE_CODE_ENABLE_TASKS = 'CLAUDE_CODE_ENABLE_TASKS';
 export const CLAUDE_CODE_DISABLE_CRON = 'CLAUDE_CODE_DISABLE_CRON';
@@ -170,6 +171,10 @@ export class ClaudeCapabilityToolRegistry {
     definitions() {
         return filterClaudeToolDefinitions(this.base.definitions(), this.capabilities);
     }
+    schedulingPolicy(call) {
+        this.assertEnabled(call.name);
+        return resolveToolSchedulingPolicy(this.base, call);
+    }
     async prepare(call, context) {
         this.assertEnabled(call.name);
         return this.base.prepare(call, context);

package/dist/tools/claude-interactive-tools.js

@@ -1,5 +1,6 @@
 import { mkdir, readFile, realpath } from 'node:fs/promises';
 import { basename, dirname, join, resolve } from 'node:path';
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 const ASK_USER_QUESTION = {
     name: 'AskUserQuestion',
     description: "Use this tool only when you are blocked on a decision that is genuinely the user's to make: one you cannot resolve from the request, the code, or sensible defaults. Users can always provide custom text. Use multiSelect for non-exclusive choices. In plan mode, use this tool to clarify requirements before ExitPlanMode; do not use it to request plan approval.",
@@ -197,6 +198,12 @@ class ClaudeInteractiveToolRegistry {
             ...INTERACTIVE_DEFINITIONS.filter(({ name }) => this.manager.enabledNames.has(name)),
         ];
     }
+    schedulingPolicy(call) {
+        if (this.manager.enabledNames.has(call.name)) {
+            return { concurrency: 'exclusive', cancelOnInterrupt: true };
+        }
+        return resolveToolSchedulingPolicy(this.base, call);
+    }
     async prepare(call, context) {
         return this.manager.enabledNames.has(call.name)
             ? call

package/dist/tools/claude-lsp-tool.js

@@ -4,6 +4,7 @@ import { homedir } from 'node:os';
 import { extname, resolve, sep } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { promisify } from 'node:util';
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 import { redactSensitiveText, sanitizeChildEnvironment, sensitiveEnvironmentValues, } from '../platform/sensitive-data.js';
 import { formatClaudeLspResult } from './claude-lsp-formatters.js';
 const MAX_MESSAGE_BYTES = 8 * 1024 * 1024;
@@ -730,6 +731,12 @@ class ClaudeLspToolRegistry {
     definitions() {
         return [...this.base.definitions(), LSP_DEFINITION];
     }
+    schedulingPolicy(call) {
+        if (call.name === 'LSP') {
+            return { concurrency: 'exclusive', cancelOnInterrupt: true };
+        }
+        return resolveToolSchedulingPolicy(this.base, call);
+    }
     prepare(call, context) {
         return call.name === 'LSP'
             ? Promise.resolve(call)

package/dist/tools/claude-scheduled-tools.d.ts

@@ -16,6 +16,7 @@ export declare class ClaudeScheduledToolRegistry implements ToolRegistry {
     private readonly now;
     constructor(options: ClaudeScheduledToolRegistryOptions);
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy(call: ModelToolCall): import("../core/runtime.js").ToolSchedulingPolicy;
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
 }

package/dist/tools/claude-scheduled-tools.js

@@ -1,3 +1,4 @@
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 const SCHEMA = 'https://json-schema.org/draft/2020-12/schema';
 const CRON_CREATE_DESCRIPTION = `Schedule a prompt to be enqueued at a future time. Use for both recurring schedules and one-shot reminders.
 
@@ -191,6 +192,12 @@ export class ClaudeScheduledToolRegistry {
             ...scheduledDefinitions.filter(({ name }) => (this.enabled?.has(name) ?? true) && !existing.has(name)),
         ];
     }
+    schedulingPolicy(call) {
+        if (DEFINITION_NAMES.has(call.name)) {
+            return { concurrency: 'exclusive', cancelOnInterrupt: true };
+        }
+        return resolveToolSchedulingPolicy(this.options.base, call);
+    }
     async prepare(call, context) {
         if (!DEFINITION_NAMES.has(call.name)) {
             return this.options.base.prepare(call, context);

package/dist/tools/claude-task-tools.d.ts

@@ -22,6 +22,7 @@ export declare class ClaudeTaskToolRegistry implements ToolRegistry {
     stopBackgroundTask(taskId: string): Promise<BackgroundBashToolResult>;
     isEnabled(name: string): boolean;
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy(call: ModelToolCall): import("../core/runtime.js").ToolSchedulingPolicy;
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
     notifications(waitForRunning: boolean): Promise<string[]>;

package/dist/tools/claude-task-tools.js

@@ -1,4 +1,5 @@
 import { resolve } from 'node:path';
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 import { BackgroundBashManager, } from '../application/background-bash-manager.js';
 import { isBackgroundBashTaskId } from '../application/background-task-id.js';
 import { ClaudeTaskStore, } from '../persistence/claude-task-store.js';
@@ -260,6 +261,16 @@ export class ClaudeTaskToolRegistry {
             ...TASK_DEFINITIONS.filter(({ name }) => this.isEnabled(name) && !existing.has(name)),
         ];
     }
+    schedulingPolicy(call) {
+        if (call.name !== 'Bash' &&
+            !TASK_DEFINITIONS.some(({ name }) => name === call.name)) {
+            return resolveToolSchedulingPolicy(this.options.base, call);
+        }
+        if (call.name === 'Bash' && call.input.run_in_background !== true) {
+            return resolveToolSchedulingPolicy(this.options.base, call);
+        }
+        return { concurrency: 'exclusive', cancelOnInterrupt: true };
+    }
     async prepare(call, context) {
         if (call.name === 'Bash') {
             return this.prepareBash(call, context);

package/dist/tools/claude-user-message.d.ts

@@ -10,6 +10,7 @@ export declare class ClaudeUserMessageToolRegistry implements ToolRegistry {
     private readonly onMessage;
     constructor(base: ToolRegistry, onMessage: (message: UserMessage) => void);
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy(call: ModelToolCall): import("../core/runtime.js").ToolSchedulingPolicy;
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
 }

package/dist/tools/claude-user-message.js

@@ -1,5 +1,6 @@
 import { stat } from 'node:fs/promises';
 import { extname, resolve } from 'node:path';
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 export const CLAUDE_USER_MESSAGE_PROMPT = 'When brief mode is enabled, SendUserMessage is the primary user-visible reply channel. Use it for the answer, progress checkpoints, and blockers. Set status to normal for a direct reply and proactive for an unsolicited update.';
 const DEFINITION = {
     name: 'SendUserMessage',
@@ -42,6 +43,12 @@ export class ClaudeUserMessageToolRegistry {
     definitions() {
         return [...this.base.definitions(), DEFINITION];
     }
+    schedulingPolicy(call) {
+        if (call.name === DEFINITION.name) {
+            return { concurrency: 'exclusive', cancelOnInterrupt: true };
+        }
+        return resolveToolSchedulingPolicy(this.base, call);
+    }
     prepare(call, context) {
         if (call.name !== DEFINITION.name)
             return this.base.prepare(call, context);

package/dist/tools/claude-workflow-tools.d.ts

@@ -21,6 +21,7 @@ export declare class ClaudeWorkflowToolRegistry implements ToolRegistry {
     private readonly prepared;
     constructor(options: ClaudeWorkflowToolRegistryOptions);
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy(call: ModelToolCall): import("../core/runtime.js").ToolSchedulingPolicy;
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
     private resolveSource;

package/dist/tools/claude-workflow-tools.js

@@ -1,5 +1,6 @@
 import { readFile } from 'node:fs/promises';
 import { isAbsolute, resolve } from 'node:path';
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 import { parseWorkflowScript, } from '../application/workflow-manager.js';
 const MAX_SCRIPT_BYTES = 524_288;
 function workflowDefinition(dataPlane) {
@@ -91,6 +92,12 @@ export class ClaudeWorkflowToolRegistry {
         }
         return [...base, workflowDefinition(this.options.dataPlane ?? 'claude')];
     }
+    schedulingPolicy(call) {
+        if (['Workflow', 'TaskOutput', 'TaskStop'].includes(call.name)) {
+            return { concurrency: 'exclusive', cancelOnInterrupt: true };
+        }
+        return resolveToolSchedulingPolicy(this.options.base, call);
+    }
     async prepare(call, context) {
         if (call.name === 'TaskOutput' || call.name === 'TaskStop') {
             const taskId = call.input.task_id ?? call.input.shell_id;

package/dist/tools/claude-worktree-tools.d.ts

@@ -12,6 +12,7 @@ export declare class ClaudeWorktreeToolRegistry implements ToolRegistry {
         dataPlane?: DataPlane;
     });
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy(call: ModelToolCall): import("../core/runtime.js").ToolSchedulingPolicy;
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
 }

package/dist/tools/claude-worktree-tools.js

@@ -1,3 +1,4 @@
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 const ENTER_DEFINITION = {
     name: 'EnterWorktree',
     description: 'Create or enter an isolated Git worktree and switch the current session into it.',
@@ -96,6 +97,12 @@ export class ClaudeWorktreeToolRegistry {
             ...definitions.filter((definition) => this.enabled.has(definition.name) && !existing.has(definition.name)),
         ];
     }
+    schedulingPolicy(call) {
+        if (['EnterWorktree', 'ExitWorktree'].includes(call.name)) {
+            return { concurrency: 'exclusive', cancelOnInterrupt: true };
+        }
+        return resolveToolSchedulingPolicy(this.options.base, call);
+    }
     async prepare(call, context) {
         if (call.name === 'EnterWorktree' && this.enabled.has(call.name)) {
             const input = objectInput(call);

package/dist/tools/filtered-tool-registry.d.ts

@@ -9,6 +9,7 @@ export declare class FilteredToolRegistry implements ToolRegistry {
     private readonly enabledNames;
     constructor(base: ToolRegistry, options?: FilteredToolRegistryOptions);
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy(call: ModelToolCall): import("../core/runtime.js").ToolSchedulingPolicy;
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
     private assertEnabled;

package/dist/tools/filtered-tool-registry.js

@@ -1,3 +1,4 @@
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 function exactToolNames(rules) {
     return new Set(rules.flatMap((rule) => {
         const match = /^([A-Za-z][\w-]*)$/.exec(rule);
@@ -34,6 +35,10 @@ export class FilteredToolRegistry {
             return definition;
         });
     }
+    schedulingPolicy(call) {
+        this.assertEnabled(call.name);
+        return resolveToolSchedulingPolicy(this.base, call);
+    }
     async prepare(call, context) {
         this.assertEnabled(call.name);
         return this.base.prepare(call, context);

package/dist/tools/local-tools.d.ts

@@ -53,6 +53,23 @@ export declare class LocalToolRegistry implements ToolRegistry {
     private assertProtectedBashCommand;
     private currentCwd;
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy(call: ModelToolCall): {
+        concurrency: "concurrent";
+        cancelOnInterrupt: boolean;
+        abortGroupOnError?: never;
+    } | {
+        concurrency: "concurrent";
+        cancelOnInterrupt: boolean;
+        abortGroupOnError: boolean;
+    } | {
+        abortGroupOnError?: boolean;
+        concurrency: "exclusive";
+        cancelOnInterrupt: boolean;
+    } | {
+        concurrency: "exclusive";
+        cancelOnInterrupt?: never;
+        abortGroupOnError?: never;
+    };
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
     private workspacePath;

package/dist/tools/local-tools.js

@@ -11,7 +11,7 @@ import { editNotebook, formatNotebookForRead } from './notebook.js';
 import { openPdf } from './pdf.js';
 import { validateBashPathSafety } from '../permissions/bash-path-safety.js';
 import { protectedWritePathReason } from '../permissions/bypass-immune-paths.js';
-import { effectiveAdditionalDirectories } from '../permissions/permission-updates.js';
+import { effectiveAdditionalDirectories, shellInputIsReadOnly, } from '../permissions/permission-updates.js';
 const REPORT_FINDINGS_DEFINITION = {
     name: 'ReportFindings',
     description: "Report code-review findings as a typed list so the host UI can render them. Use this only when the active code-review instructions tell you to report findings with this tool; otherwise follow whatever output format those instructions specify. When reporting a review's results, call it once with the verified findings ranked most-severe first (empty array if nothing survived verification) and do not also print the findings as text. When re-reporting after applying fixes (only if the apply instructions ask for it), set outcome on each finding to what actually happened.",
@@ -277,6 +277,64 @@ function optionalNonNegativeInteger(input, name) {
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+function hasOnlyInputKeys(input, allowed) {
+    const names = new Set(allowed);
+    return Object.keys(input).every((name) => names.has(name));
+}
+function localSchedulingInputIsValid(call) {
+    try {
+        if (call.name === 'Read') {
+            stringInput(call.input, 'file_path');
+            optionalNonNegativeInteger(call.input, 'offset');
+            optionalPositiveInteger(call.input, 'limit');
+            optionalString(call.input, 'pages');
+            return hasOnlyInputKeys(call.input, [
+                'file_path',
+                'offset',
+                'limit',
+                'pages',
+            ]);
+        }
+        if (call.name === 'Glob') {
+            stringInput(call.input, 'pattern', true);
+            optionalString(call.input, 'path');
+            return hasOnlyInputKeys(call.input, ['pattern', 'path']);
+        }
+        if (call.name === 'Grep') {
+            stringInput(call.input, 'pattern');
+            optionalString(call.input, 'path');
+            optionalString(call.input, 'glob');
+            return hasOnlyInputKeys(call.input, ['pattern', 'path', 'glob']);
+        }
+        if (call.name === 'Bash') {
+            stringInput(call.input, 'command');
+            optionalPositiveInteger(call.input, 'timeout');
+            const description = call.input.description;
+            const background = call.input.run_in_background;
+            const disableSandbox = call.input.dangerouslyDisableSandbox;
+            if (description !== undefined && typeof description !== 'string') {
+                return false;
+            }
+            if (background !== undefined && typeof background !== 'boolean') {
+                return false;
+            }
+            if (disableSandbox !== undefined && typeof disableSandbox !== 'boolean') {
+                return false;
+            }
+            return hasOnlyInputKeys(call.input, [
+                'command',
+                'timeout',
+                'description',
+                'run_in_background',
+                'dangerouslyDisableSandbox',
+            ]);
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
 const REPORT_LEVELS = ['low', 'medium', 'high', 'xhigh', 'max'];
 const REPORT_VERDICTS = ['CONFIRMED', 'PLAUSIBLE'];
 const REPORT_OUTCOMES = ['fixed', 'skipped', 'no_change_needed'];
@@ -535,6 +593,33 @@ export class LocalToolRegistry {
             }
             : definition);
     }
+    schedulingPolicy(call) {
+        if (['Read', 'Glob', 'Grep'].includes(call.name) &&
+            localSchedulingInputIsValid(call)) {
+            return { concurrency: 'concurrent', cancelOnInterrupt: true };
+        }
+        if (call.name === 'Bash' &&
+            localSchedulingInputIsValid(call) &&
+            call.input.run_in_background !== true &&
+            typeof call.input.command === 'string' &&
+            shellInputIsReadOnly(call.input.command)) {
+            return {
+                concurrency: 'concurrent',
+                cancelOnInterrupt: true,
+                abortGroupOnError: true,
+            };
+        }
+        if (TOOL_DEFINITIONS.some(({ name }) => name === call.name)) {
+            return {
+                concurrency: 'exclusive',
+                cancelOnInterrupt: true,
+                ...(call.name === 'Bash' ? { abortGroupOnError: true } : {}),
+            };
+        }
+        return {
+            concurrency: 'exclusive',
+        };
+    }
     async prepare(call, context) {
         if (context.signal?.aborted)
             throw abortError();

package/dist/tools/web.d.ts

@@ -36,6 +36,7 @@ export declare class WebToolRegistry implements ToolRegistry {
     private cacheBytes;
     constructor(options: WebToolRegistryOptions);
     definitions(): readonly ModelToolDefinition[];
+    schedulingPolicy(call: ModelToolCall): import("../core/runtime.js").ToolSchedulingPolicy;
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
     private webFetch;

package/dist/tools/web.js

@@ -6,6 +6,7 @@ import { isIP } from 'node:net';
 import { join } from 'node:path';
 import ipaddr from 'ipaddr.js';
 import TurndownService from 'turndown';
+import { resolveToolSchedulingPolicy } from '../core/tool-scheduling-policy.js';
 const MAX_URL_LENGTH = 2_000;
 const MAX_MARKDOWN_LENGTH = 100_000;
 const DEFAULT_MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
@@ -273,6 +274,24 @@ function parseWebSearchInput(input) {
         ...(blockedDomains ? { blockedDomains } : {}),
     };
 }
+function webSchedulingInputIsValid(call) {
+    try {
+        if (call.name === 'WebFetch') {
+            parseWebFetchInput(call.input);
+            return Object.keys(call.input).every((name) => name === 'url' || name === 'prompt');
+        }
+        if (call.name === 'WebSearch') {
+            parseWebSearchInput(call.input);
+            return Object.keys(call.input).every((name) => name === 'query' ||
+                name === 'allowed_domains' ||
+                name === 'blocked_domains');
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
 function normalizedAddress(value) {
     const parsed = ipaddr.parse(value);
     return parsed instanceof ipaddr.IPv6 && parsed.isIPv4MappedAddress()
@@ -475,6 +494,14 @@ export class WebToolRegistry {
                 : []),
         ];
     }
+    schedulingPolicy(call) {
+        if (call.name === 'WebFetch' || call.name === 'WebSearch') {
+            return webSchedulingInputIsValid(call)
+                ? { concurrency: 'concurrent', cancelOnInterrupt: true }
+                : { concurrency: 'exclusive', cancelOnInterrupt: true };
+        }
+        return resolveToolSchedulingPolicy(this.options.base, call);
+    }
     async prepare(call, context) {
         if (context.signal?.aborted)
             throw abortError();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",