pulseed 0.6.5 → 0.6.6

package/dist/interface/chat/chat-runner-routes.js

@@ -1,19 +1,31 @@
 import { loadProviderConfig } from "../../base/llm/provider-config.js";
-import { extractPromptedToolCalls } from "../../orchestrator/execution/agent-loop/prompted-tool-protocol.js";
-import { verifyChatAction } from "./chat-verifier.js";
 import { collectGitDiffArtifact, formatToolActivity, } from "./chat-runner-support.js";
-import { resolveExecutionPolicy } from "../../orchestrator/execution/agent-loop/execution-policy.js";
+import { AgentLoopSessionStateCatalog } from "../../orchestrator/execution/agent-loop/agent-loop-session-db-store.js";
+import { resolveExecutionPolicy, } from "../../orchestrator/execution/agent-loop/execution-policy.js";
 import { createGatewaySetupStatusProvider } from "./gateway-setup-status.js";
 import { renderSystemPromptWithTurnContext, } from "./turn-context.js";
 import { buildChatModelRequest } from "./model-request-builder.js";
-import { createDiscordAdapterPlanDialogue, createTelegramConfirmWriteDialogue, SETUP_WRITE_CONFIRM_COMMAND, } from "./setup-dialogue.js";
-import { sameLanguageResponseInstruction, shouldRenderJapanese, } from "./turn-language.js";
+import { gateRuntimeEvidenceBoundFinalAnswer, mayRequireRuntimeEvidenceGate, } from "./runtime-evidence-gate.js";
+import { createDiscordAdapterPlanDialogue, createTelegramConfirmWriteDialogue, } from "./setup-dialogue.js";
 import { createOperationProgressItem } from "./operation-progress.js";
-import { createRunSpecStore, formatRunSpecSetupProposal } from "../../runtime/run-spec/index.js";
-import { buildStaticSystemPrompt } from "./grounding.js";
-const DEFAULT_TIMEOUT_MS = 120_000;
-const MAX_VERIFY_RETRIES = 2;
-const MAX_TOOL_LOOPS = 5;
+import { addUsageCounter, hasUsage, normalizeUsageCounter, usageFromLLMResponse, zeroUsageCounter, } from "./chat-usage.js";
+import { extractPromptedToolCalls, } from "../../orchestrator/execution/agent-loop/prompted-tool-protocol.js";
+import { formatTelegramConfigProgressDetail, formatTelegramConfigureGuidance, } from "./telegram-setup-guidance.js";
+export { buildTelegramSetupGuidanceData, formatTelegramConfigureGuidance, } from "./telegram-setup-guidance.js";
+const MAX_TOOL_LOOPS = 24;
+const GATEWAY_LOOP_WARNING_REPEAT_LIMIT = 2;
+const GATEWAY_LOOP_BLOCK_REPEAT_LIMIT = 4;
+const GATEWAY_POLL_WARNING_REPEAT_LIMIT = 3;
+const GATEWAY_POLL_BLOCK_REPEAT_LIMIT = 6;
+const GATEWAY_UNAVAILABLE_TOOL_GUIDANCE_LIMIT = 3;
+class ToolLoopTerminalError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "ToolLoopTerminalError";
+    }
+}
 export async function executeRuntimeControlRoute(host, route, runtimeControlContext, cwd, start) {
     if (!host.deps.runtimeControlService) {
         return {
@@ -45,94 +57,64 @@ export async function executeRuntimeControlRoute(host, route, runtimeControlCont
         elapsed_ms: Date.now() - start,
     };
 }
-export async function executeRunSpecDraftRoute(host, route, eventContext, assistantBuffer, history, start) {
-    const store = createRunSpecStore(host.deps.stateManager);
-    await store.save(route.draft);
-    const proposal = formatRunSpecSetupProposal(route.draft);
-    const output = [
-        proposal,
-        "",
-        "PulSeed prepared this as a typed long-running RunSpec draft. It has not started a daemon run.",
-        "Reply with approval to confirm, cancel to discard it, or provide updated workspace/deadline/metric details.",
-    ].join("\n");
-    await host.setPendingRunSpecConfirmation({
-        state: "pending",
-        spec: route.draft,
-        prompt: output,
-        createdAt: route.draft.created_at,
-        updatedAt: route.draft.updated_at,
-    });
-    host.eventBridge.emitCheckpoint("RunSpec confirmation pending", `${route.draft.id} is awaiting confirmation.`, eventContext, "route");
-    return persistDirectRouteResult(host, output, eventContext, assistantBuffer, history, start);
-}
-export function formatBlockedRuntimeControlRoute(route) {
-    if (route.reason === "runtime_control_unclassified") {
+export function formatBlockedRuntimeControlRoute(route, options = {}) {
+    if (options.mode === "diagnostic") {
+        if (route.reason === "runtime_control_unclassified") {
+            return [
+                "Runtime control was explicitly requested, but PulSeed could not derive a typed runtime-control operation from this turn.",
+                "The operation was not executed, and PulSeed will not fall back to shell tools for daemon or gateway lifecycle control.",
+            ].join("\n");
+        }
+        if (route.reason === "runtime_control_disallowed") {
+            return [
+                `Runtime control ${route.intent?.kind ?? "operation"} was recognized, but this chat surface is not authorized for runtime-control lifecycle actions.`,
+                "The operation was not executed, and PulSeed will not fall back to shell tools for daemon or gateway lifecycle control.",
+            ].join("\n");
+        }
         return [
-            "Runtime control was explicitly requested, but PulSeed could not derive a typed runtime-control operation from this turn.",
+            `Runtime control ${route.intent?.kind ?? "operation"} was recognized, but the runtime-control service is not available in this chat surface.`,
             "The operation was not executed, and PulSeed will not fall back to shell tools for daemon or gateway lifecycle control.",
         ].join("\n");
     }
+    if (route.reason === "runtime_control_unclassified") {
+        return [
+            "I recognized this as a request to inspect or control PulSeed, but I could not identify a supported safe action from this turn.",
+            "Nothing was executed, and PulSeed will not use shell commands as a workaround.",
+            "Use an authorized management channel if you need a live status check or runtime action.",
+        ].join("\n");
+    }
     if (route.reason === "runtime_control_disallowed") {
         return [
-            `Runtime control ${route.intent?.kind ?? "operation"} was recognized, but this chat surface is not authorized for runtime-control lifecycle actions.`,
-            "The operation was not executed, and PulSeed will not fall back to shell tools for daemon or gateway lifecycle control.",
+            "This chat is not authorized to inspect or control PulSeed's running state.",
+            "Nothing was executed, and PulSeed will not use shell commands as a workaround.",
+            "Use an authorized management channel if you need a live status check or runtime action.",
         ].join("\n");
     }
     return [
-        `Runtime control ${route.intent?.kind ?? "operation"} was recognized, but the runtime-control service is not available in this chat surface.`,
-        "The operation was not executed, and PulSeed will not fall back to shell tools for daemon or gateway lifecycle control.",
+        "This chat cannot reach PulSeed's authorized management service right now.",
+        "Nothing was executed, and PulSeed will not use shell commands as a workaround.",
+        "Use an authorized management channel if you need a live status check or runtime action.",
     ].join("\n");
 }
 export async function executeConfigureRoute(host, route, eventContext, assistantBuffer, history, start) {
     if (route.kind !== "configure") {
         throw new Error(`executeConfigureRoute received route kind ${route.kind}`);
     }
-    const output = await formatConfigureGuidance(host, route.intent.configure_target ?? "unknown", host.getSetupSecretIntake(), host.getTurnLanguageHint(), eventContext);
-    return persistDirectRouteResult(host, output, eventContext, assistantBuffer, history, start);
-}
-export async function executeClarifyRoute(host, _route, eventContext, assistantBuffer, history, start) {
-    const output = [
-        "I need one more detail before taking action.",
-        "",
-        "Tell me whether you want setup guidance, a configuration flow, or a code/test change.",
-    ].join("\n");
+    const output = await formatConfigureGuidance(host, route.configureTarget, host.getSetupSecretIntake(), host.getTurnLanguageHint(), eventContext);
     return persistDirectRouteResult(host, output, eventContext, assistantBuffer, history, start);
 }
-export async function executeAssistRoute(host, params) {
-    if (!host.deps.llmClient) {
-        return persistDirectRouteResult(host, "I can answer this as guidance, but no language model is configured for read-only chat.", params.eventContext, params.assistantBuffer, params.history, params.start);
-    }
-    host.eventBridge.emitCheckpoint("Read-only assist selected", "The message will be answered without coding-agent execution.", params.eventContext, "route");
-    const modelRequest = buildChatModelRequest({
-        purpose: "ordinary_chat",
-        turnContext: params.turnContext,
-        systemPrompt: [
-            params.turnContext.modelVisible.instructions.systemPrompt || buildStaticSystemPrompt(host.getProviderConfigBaseDir()),
-            "Answer read-only. Provide concise operational guidance. Do not ask to edit files or run commands unless the user explicitly asks for execution.",
-            sameLanguageResponseInstruction(host.getTurnLanguageHint()),
-        ].join(" "),
-        maxTokens: 1000,
-        temperature: 0,
-    });
-    const response = await sendLLMMessage(host, host.deps.llmClient, modelRequest.messages, {
-        ...modelRequest.options,
-    }, params.assistantBuffer, params.eventContext);
-    const usage = usageFromLLMResponse(response);
-    if (hasUsage(usage))
-        params.history.recordUsage("assist", usage);
-    return persistDirectRouteResult(host, params.assistantBuffer.text || response.content || "(no response)", params.eventContext, params.assistantBuffer, params.history, params.start);
-}
 export async function executeAgentLoopRoute(host, params) {
     const { resumeOnly, assistantBuffer, eventContext, history, gitRoot, activeAbortSignal, start, } = params;
     const turnContext = params.turnContext;
     const runtimeContext = turnContext.hostOnly.runtime.runtimeControlContext;
     try {
-        const resumeState = resumeOnly ? await loadResumableAgentLoopState(host) : null;
-        if (resumeOnly && !resumeState) {
+        const resumeStateResult = resumeOnly ? await loadResumableAgentLoopState(host) : null;
+        const resumeState = resumeStateResult?.kind === "loaded" ? resumeStateResult.state : null;
+        if (resumeOnly && resumeStateResult?.kind !== "loaded") {
             const elapsed_ms = Date.now() - start;
-            const output = await host.eventBridge.emitLifecycleErrorEventWithFallback("No resumable native agentloop state found.", assistantBuffer.text, eventContext, {
-                code: "resume_state_missing",
-                stoppedReason: "resume_state_missing",
+            const output = await host.eventBridge.emitLifecycleErrorEventWithFallback(resumeStateResult?.message ?? "I could not find a chat that can safely continue.", assistantBuffer.text, eventContext, {
+                code: resumeStateResult?.code ?? "resume_state_missing",
+                stoppedReason: resumeStateResult?.code ?? "resume_state_missing",
             }, host.deps.llmClient);
             host.eventBridge.emitLifecycleEndEvent("error", elapsed_ms, eventContext, false);
             return {
@@ -141,19 +123,30 @@ export async function executeAgentLoopRoute(host, params) {
                 elapsed_ms,
             };
         }
-        host.eventBridge.emitCheckpoint(resumeOnly ? "Session resumed" : "Agent loop started", resumeOnly
-            ? "Resumable agent-loop state is loaded."
-            : "The agent loop can now inspect, plan, edit, or verify with visible tool activity.", eventContext, "execution");
         host.eventBridge.emitActivity("lifecycle", "Calling model...", eventContext, "lifecycle:model");
         const result = await host.deps.chatAgentLoopRunner.execute({
             message: turnContext.modelVisible.prompts.basePrompt,
             cwd: turnContext.hostOnly.execution.executionCwd,
             goalId: turnContext.hostOnly.execution.goalId,
             history: turnContext.modelVisible.conversation.priorTurns,
-            eventSink: host.eventBridge.createAgentLoopEventSink(eventContext),
+            eventSink: host.eventBridge.createAgentLoopEventSink(eventContext, assistantBuffer, {
+                streamFinalCandidate: () => true,
+            }),
             approvalFn: agentLoopApprovalFn(host, runtimeContext),
             toolCallContext: {
                 executionPolicy: turnContext.hostOnly.execution.executionPolicy,
+                ...(host.deps.permissionGrantContext?.sessionId
+                    ? { sessionId: host.deps.permissionGrantContext.sessionId }
+                    : host.getConversationSessionId()
+                        ? { sessionId: host.getConversationSessionId() }
+                        : {}),
+                runId: turnContext.modelVisible.turn.runId,
+                turnId: turnContext.modelVisible.turn.turnId,
+                ...(host.deps.permissionGrantContext?.projectId ? { projectId: host.deps.permissionGrantContext.projectId } : {}),
+                ...(host.deps.permissionGrantStore ? { permissionGrantStore: host.deps.permissionGrantStore } : {}),
+                ...(host.deps.permissionWaitPlanStore ? { permissionWaitPlanStore: host.deps.permissionWaitPlanStore } : {}),
+                ...(host.deps.capabilityVerificationStore ? { capabilityVerificationStore: host.deps.capabilityVerificationStore } : {}),
+                ...(host.deps.capabilityExecutionResolver ? { capabilityExecutionResolver: host.deps.capabilityExecutionResolver } : {}),
                 ...(host.getConversationSessionId() ? { conversationSessionId: host.getConversationSessionId() } : {}),
                 providerConfigBaseDir: host.getProviderConfigBaseDir(),
                 setupSecretIntake: host.getSetupSecretIntake(),
@@ -171,7 +164,7 @@ export async function executeAgentLoopRoute(host, params) {
                 runtimeControlAllowed: turnContext.modelVisible.runtime.runtimeControlAllowed,
                 runtimeControlApprovalMode: turnContext.modelVisible.runtime.approvalMode,
             },
-            ...(host.getNativeAgentLoopStatePath() ? { resumeStatePath: host.getNativeAgentLoopStatePath() } : {}),
+            ...(host.getNativeAgentLoopSessionId() ? { resumeSessionId: host.getNativeAgentLoopSessionId() } : {}),
             ...(resumeState ? { resumeState } : {}),
             ...(resumeOnly ? { resumeOnly: true } : {}),
             systemPrompt: renderSystemPromptWithTurnContext(turnContext.modelVisible.instructions.agentLoopSystemPrompt, turnContext.modelVisible),
@@ -181,11 +174,30 @@ export async function executeAgentLoopRoute(host, params) {
         const agentLoopUsage = result.agentLoop?.usage
             ? normalizeUsageCounter(result.agentLoop.usage)
             : zeroUsageCounter();
+        if (result.agentLoop) {
+            history.setAgentLoopSessionIdentity({
+                sessionId: result.agentLoop.sessionId,
+                traceId: result.agentLoop.traceId,
+            });
+        }
         if (hasUsage(agentLoopUsage)) {
             history.recordUsage("agentloop", agentLoopUsage);
         }
+        if (result.output && shouldGateRuntimeEvidenceForTurn(turnContext)) {
+            const gate = await gateRuntimeEvidenceBoundFinalAnswer({
+                turnContext,
+                assistantOutput: result.output,
+                hasRuntimeEvidence: host.eventBridge.hasRuntimeEvidenceForTurn(eventContext),
+                runtimeEvidenceRefs: host.eventBridge.getRuntimeEvidenceRefsForTurn(eventContext),
+                llmClient: host.deps.runtimeEvidenceGateClient ?? host.deps.llmClient,
+            });
+            if (gate.blocked) {
+                host.eventBridge.emitCheckpoint("Runtime evidence required", gate.reason ?? "The final answer made an unverified runtime or workspace claim.", eventContext, "runtime-evidence");
+            }
+            result.output = gate.output;
+        }
         if (result.output) {
-            host.eventBridge.pushAssistantDelta(result.output, assistantBuffer, eventContext);
+            host.eventBridge.pushAssistantSnapshot(result.output, assistantBuffer, eventContext);
         }
         if (result.success) {
             const diffArtifact = await collectGitDiffArtifact(gitRoot);
@@ -193,8 +205,6 @@ export async function executeAgentLoopRoute(host, params) {
                 host.eventBridge.emitDiffArtifact(diffArtifact, eventContext);
             }
             await history.appendAssistantMessage(result.output);
-            host.eventBridge.emitCheckpoint("Response ready", "The agent-loop response has been persisted for this turn.", eventContext, "complete");
-            host.eventBridge.emitActivity("lifecycle", "Finalizing response...", eventContext, "lifecycle:finalizing");
             host.eventBridge.emitEvent({
                 type: "assistant_final",
                 text: result.output,
@@ -228,10 +238,18 @@ export async function executeAgentLoopRoute(host, params) {
         };
     }
 }
-export async function executeToolLoopRoute(host, params) {
+export async function executeGatewayModelLoopRoute(host, params) {
     try {
-        host.eventBridge.emitCheckpoint("Tool loop started", "The model will choose tools from the active catalog.", params.eventContext, "execution");
-        const toolResult = await executeWithTools(host, params.turnContext, params.eventContext, params.assistantBuffer, params.systemPrompt, params.executionGoalId, params.runtimeControlContext, params.start);
+        const shouldGateEvidence = shouldGateRuntimeEvidenceForTurn(params.turnContext);
+        const toolResult = await executeWithTools(host, params.turnContext, params.eventContext, params.assistantBuffer, params.systemPrompt, params.executionGoalId, params.runtimeControlContext, params.start, {
+            tools: host.deps.registry?.listAll() ?? [],
+            streamFinalText: true,
+            holdAssistantDelta: shouldGateEvidence
+                ? (candidate) => mayRequireRuntimeEvidenceGate(candidate)
+                : undefined,
+            abortSignal: params.activeAbortSignal,
+            timeoutMs: params.timeoutMs,
+        });
         const elapsed_ms = Date.now() - params.start;
         if (hasUsage(toolResult.usage)) {
             params.history.recordUsage("execution", toolResult.usage);
@@ -240,21 +258,42 @@ export async function executeToolLoopRoute(host, params) {
         if (diffArtifact) {
             host.eventBridge.emitDiffArtifact(diffArtifact, params.eventContext);
         }
-        await params.history.appendAssistantMessage(toolResult.output);
-        host.eventBridge.emitCheckpoint("Response ready", "The tool-loop response has been persisted for this turn.", params.eventContext, "complete");
-        host.eventBridge.emitActivity("lifecycle", "Finalizing response...", params.eventContext, "lifecycle:finalizing");
+        let output = toolResult.output;
+        if (shouldGateEvidence) {
+            const gate = await gateRuntimeEvidenceBoundFinalAnswer({
+                turnContext: params.turnContext,
+                assistantOutput: output,
+                hasRuntimeEvidence: host.eventBridge.hasRuntimeEvidenceForTurn(params.eventContext),
+                runtimeEvidenceRefs: host.eventBridge.getRuntimeEvidenceRefsForTurn(params.eventContext),
+                llmClient: host.deps.runtimeEvidenceGateClient ?? host.deps.llmClient,
+            });
+            if (gate.blocked) {
+                host.eventBridge.emitCheckpoint("Runtime evidence required", gate.reason ?? "The final answer made an unverified runtime or workspace claim.", params.eventContext, "runtime-evidence");
+            }
+            output = gate.output;
+        }
+        if (!params.assistantBuffer.text) {
+            host.eventBridge.pushAssistantDelta(output, params.assistantBuffer, params.eventContext);
+        }
+        else {
+            host.eventBridge.pushAssistantSnapshot(output, params.assistantBuffer, params.eventContext);
+        }
+        await params.history.appendAssistantMessage(output);
         host.eventBridge.emitEvent({
             type: "assistant_final",
-            text: toolResult.output,
+            text: output,
             persisted: true,
             ...host.eventBridge.eventBase(params.eventContext),
         });
         host.eventBridge.emitLifecycleEndEvent("completed", elapsed_ms, params.eventContext, true);
-        return { success: true, output: toolResult.output, elapsed_ms };
+        return { success: true, output, elapsed_ms };
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        const output = await host.eventBridge.emitLifecycleErrorEventWithFallback(message, params.assistantBuffer.text, params.eventContext, {}, host.deps.llmClient);
+        const evidence = err instanceof ToolLoopTerminalError
+            ? toolLoopTerminalEvidence(err)
+            : {};
+        const output = await host.eventBridge.emitLifecycleErrorEventWithFallback(message, params.assistantBuffer.text, params.eventContext, evidence, host.deps.llmClient);
         host.eventBridge.emitLifecycleEndEvent("error", Date.now() - params.start, params.eventContext, false);
         return {
             success: false,
@@ -263,134 +302,114 @@ export async function executeToolLoopRoute(host, params) {
         };
     }
 }
-export async function executeAdapterRoute(host, params) {
-    const task = {
-        prompt: params.turnContext.modelVisible.prompts.prompt,
-        timeout_ms: params.timeoutMs,
-        adapter_type: host.deps.adapter.adapterType,
-        cwd: params.turnContext.hostOnly.execution.cwd,
-        ...(params.systemPrompt ? {
-            system_prompt: renderSystemPromptWithTurnContext(params.turnContext.modelVisible.instructions.systemPrompt, params.turnContext.modelVisible),
-        } : {}),
-    };
-    const resolvedTimeoutMs = task.timeout_ms ?? DEFAULT_TIMEOUT_MS;
-    host.eventBridge.emitCheckpoint("Adapter started", "The configured adapter has the current prompt and project context.", params.eventContext, "execution");
-    host.eventBridge.emitActivity("lifecycle", "Calling adapter...", params.eventContext, "lifecycle:adapter");
-    const adapterPromise = host.deps.adapter.execute(task);
-    const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error(`Chat adapter timed out after ${resolvedTimeoutMs}ms`)), resolvedTimeoutMs));
-    let result;
-    try {
-        result = await Promise.race([adapterPromise, timeoutPromise]);
+export function resolveGatewayToolScopes(context = {}) {
+    const scopes = new Set([
+        "read_workspace",
+        "request_approval",
+    ]);
+    if (context.runtimeControlAllowed === true && context.runtimeControlApprovalMode !== "disallowed") {
+        scopes.add("authorized_runtime_control");
     }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        const output = await host.eventBridge.emitLifecycleErrorEventWithFallback(message, params.assistantBuffer.text, params.eventContext, {}, host.deps.llmClient);
-        const timeoutElapsedMs = Date.now() - params.start;
-        host.eventBridge.emitLifecycleEndEvent("error", timeoutElapsedMs, params.eventContext, false);
-        return {
-            success: false,
-            output,
-            elapsed_ms: timeoutElapsedMs,
-        };
+    return scopes;
+}
+export function selectGatewayModelLoopTools(tools, context = {}) {
+    const scopes = resolveGatewayToolScopes(context);
+    return tools.filter((tool) => isGatewayToolInScope(tool, scopes, context));
+}
+function isGatewayToolInScope(tool, scopes, context) {
+    if (tool.metadata.tags.includes("gateway:never"))
+        return false;
+    switch (tool.metadata.gatewayExposure ?? "never") {
+        case "default_safe":
+            return scopes.has("read_workspace")
+                && tool.metadata.isReadOnly
+                && tool.metadata.permissionLevel === "read_only"
+                && !tool.metadata.isDestructive;
+        case "approval_required":
+            return hasApprovedGatewayActionForTool(tool.metadata.name, context) && !tool.metadata.isReadOnly;
+        case "runtime_control":
+            return scopes.has("authorized_runtime_control");
+        case "never":
+            return false;
     }
-    if (!result.output && result.error) {
-        result = { ...result, output: `Error: ${result.error}` };
-    }
-    const elapsed_ms = Date.now() - params.start;
-    if (result.output) {
-        host.eventBridge.pushAssistantDelta(result.output, params.assistantBuffer, params.eventContext);
-    }
-    const diffArtifact = await collectGitDiffArtifact(params.gitRoot);
-    if (diffArtifact) {
-        let retries = 0;
-        const VERIFY_TIMEOUT_MS = 30_000;
-        host.eventBridge.emitCheckpoint("Changes detected", "Verification is starting because the turn changed the working tree.", params.eventContext, "changes");
-        host.eventBridge.emitActivity("lifecycle", "Checking result...", params.eventContext, "lifecycle:checking");
-        let verification = await Promise.race([
-            verifyChatAction(params.gitRoot, host.deps.toolExecutor, { force: true }),
-            new Promise((resolve) => setTimeout(() => resolve({ passed: true }), VERIFY_TIMEOUT_MS)),
-        ]);
-        while (!verification.passed && retries < MAX_VERIFY_RETRIES) {
-            retries++;
-            host.eventBridge.emitCheckpoint("Verification retry", `Attempt ${retries} of ${MAX_VERIFY_RETRIES} is repairing failed checks.`, params.eventContext, `verification-retry-${retries}`);
-            const retryPrompt = `The previous changes caused test failures. Please fix them.\n\nTest output:\n${verification.testOutput ?? verification.errors.join("\n")}`;
-            const retryTask = { ...task, prompt: retryPrompt };
-            result = await host.deps.adapter.execute(retryTask);
-            verification = await verifyChatAction(params.gitRoot, host.deps.toolExecutor, { force: true });
-        }
-        if (!verification.passed) {
-            const finalDiffArtifact = await collectGitDiffArtifact(params.gitRoot);
-            if (finalDiffArtifact) {
-                host.eventBridge.emitDiffArtifact(finalDiffArtifact, params.eventContext);
-            }
-            host.eventBridge.emitCheckpoint("Verification failed", `Checks are still failing after ${MAX_VERIFY_RETRIES} retries.`, params.eventContext, "verification");
-            const failureOutput = await host.eventBridge.emitLifecycleErrorEventWithFallback(`Changes applied but tests are still failing after ${MAX_VERIFY_RETRIES} retries.`, params.assistantBuffer.text, params.eventContext, {
-                code: "verification_failed",
-                signals: [{ kind: "verification", status: "failed" }],
-            }, host.deps.llmClient);
-            host.eventBridge.emitLifecycleEndEvent("error", Date.now() - params.start, params.eventContext, false);
-            return {
-                success: false,
-                output: `${failureOutput}\n\nTest output:\n${verification.testOutput ?? verification.errors.join("\n")}`.trim(),
-                elapsed_ms: Date.now() - params.start,
-            };
-        }
-        const finalDiffArtifact = await collectGitDiffArtifact(params.gitRoot);
-        if (finalDiffArtifact) {
-            host.eventBridge.emitDiffArtifact(finalDiffArtifact, params.eventContext);
+}
+function initialGatewayToolScopeContext(runtimeControlContext, turnContext) {
+    const turnRuntimeContext = turnContext.hostOnly.runtime.runtimeControlContext;
+    const runtimeControlApprovalMode = runtimeControlContext?.approvalMode
+        ?? turnRuntimeContext?.approvalMode
+        ?? turnContext.modelVisible.runtime.approvalMode;
+    const runtimeControlAllowed = runtimeControlContext?.allowed
+        ?? turnRuntimeContext?.allowed
+        ?? turnContext.modelVisible.runtime.runtimeControlAllowed;
+    return {
+        runtimeControlAllowed,
+        runtimeControlApprovalMode,
+    };
+}
+function hasApprovedGatewayActionForTool(toolName, context) {
+    const approvedActions = context.approvedGatewayActions ?? [];
+    if (approvedActions.length === 0)
+        return false;
+    const normalizedToolName = normalizeGatewayToolName(toolName);
+    for (const action of approvedActions) {
+        if (action.normalizedToolName === normalizedToolName) {
+            return true;
         }
-        host.eventBridge.emitCheckpoint("Verification passed", "Changed files passed the configured chat verification.", params.eventContext, "verification");
     }
-    if (result.success) {
-        await params.history.appendAssistantMessage(result.output);
-        host.eventBridge.emitCheckpoint("Response ready", "The assistant response has been persisted for this turn.", params.eventContext, "complete");
-        host.eventBridge.emitActivity("lifecycle", "Finalizing response...", params.eventContext, "lifecycle:finalizing");
-        host.eventBridge.emitEvent({
-            type: "assistant_final",
-            text: result.output,
-            persisted: true,
-            ...host.eventBridge.eventBase(params.eventContext),
-        });
-        host.eventBridge.emitLifecycleEndEvent("completed", elapsed_ms, params.eventContext, true);
-    }
-    else {
-        const partialText = params.assistantBuffer.text !== result.output ? params.assistantBuffer.text : "";
-        result.output = await host.eventBridge.emitLifecycleErrorEventWithFallback(result.output || result.error || "Unknown error", partialText, params.eventContext, {
-            stoppedReason: result.stopped_reason,
-            signals: [{
-                    kind: "adapter",
-                    adapterType: host.deps.adapter.adapterType,
-                    stoppedReason: result.stopped_reason,
-                }],
-        }, host.deps.llmClient);
-        host.eventBridge.emitLifecycleEndEvent("error", elapsed_ms, params.eventContext, false);
+    return false;
+}
+function selectDirectModelLoopTools(tools, turnContext, runtimeControlContext, scopeContext) {
+    if (!isGatewaySurfaceTurn(turnContext, runtimeControlContext)) {
+        return tools;
     }
-    return {
-        success: result.success,
-        output: result.output,
-        elapsed_ms,
-    };
+    return selectGatewayModelLoopTools(tools, scopeContext);
+}
+function isGatewaySurfaceTurn(turnContext, runtimeControlContext) {
+    return (runtimeControlContext?.replyTarget?.surface ?? turnContext.modelVisible.runtime.replyTarget?.surface) === "gateway";
 }
-async function executeWithTools(host, turnContext, eventContext, assistantBuffer, systemPrompt, goalId, runtimeControlContext, start) {
+async function executeWithTools(host, turnContext, eventContext, assistantBuffer, systemPrompt, goalId, runtimeControlContext, start, options = {
+    tools: host.deps.registry?.listAll() ?? [],
+    streamFinalText: true,
+}) {
     const llmClient = host.deps.llmClient;
+    if (!llmClient) {
+        throw new ToolLoopTerminalError("model_request_aborted", "Gateway model/tool loop cannot run because no language model client is configured.");
+    }
     const supportsNativeToolCalling = llmClient.supportsToolCalling?.() !== false;
+    const gatewayScopeContext = initialGatewayToolScopeContext(runtimeControlContext ?? null, turnContext);
+    const isGatewaySurface = isGatewaySurfaceTurn(turnContext, runtimeControlContext ?? null);
+    const currentVisibleTools = () => selectDirectModelLoopTools(options.tools, turnContext, runtimeControlContext ?? null, gatewayScopeContext);
+    const initialVisibleTools = currentVisibleTools();
     const initialModelRequest = buildChatModelRequest({
         purpose: "tool_call",
         turnContext,
         systemPrompt,
-        availableTools: host.deps.registry?.listAll() ?? [],
+        availableTools: initialVisibleTools,
         activatedTools: host.activatedTools,
         supportsNativeToolCalling,
     });
     const messages = [...initialModelRequest.messages];
-    const toolCallContext = await buildToolCallContext(host, goalId, runtimeControlContext, start, turnContext);
+    const startedAt = start ?? Date.now();
+    const deadlineAt = options.timeoutMs ? startedAt + options.timeoutMs : null;
+    if (isGatewaySurface && !supportsNativeToolCalling && initialVisibleTools.length > 0) {
+        throw new ToolLoopTerminalError("policy_blocked", "Gateway tools require a model provider with native tool-calling support. The current provider cannot preserve structured tool transcripts on this gateway surface.");
+    }
+    const toolCallContext = await buildToolCallContext(host, goalId, runtimeControlContext, start, turnContext, {
+        abortSignal: options.abortSignal,
+        timeoutMs: remainingTimeoutMs(deadlineAt),
+    });
     const usage = zeroUsageCounter();
+    let previousToolCycleFingerprint = null;
+    let repeatedToolCycleCount = 0;
+    const unavailableToolAttempts = new Map();
     for (let loop = 0; loop < MAX_TOOL_LOOPS; loop++) {
+        throwIfAbortedOrTimedOut(options.abortSignal, deadlineAt, "model_request");
+        const visibleTools = currentVisibleTools();
         const modelRequest = buildChatModelRequest({
             purpose: "tool_call",
             turnContext,
             systemPrompt,
-            availableTools: host.deps.registry?.listAll() ?? [],
+            availableTools: visibleTools,
             activatedTools: host.activatedTools,
             supportsNativeToolCalling,
             messages,
@@ -398,40 +417,44 @@ async function executeWithTools(host, turnContext, eventContext, assistantBuffer
         let response;
         try {
             host.eventBridge.emitActivity("lifecycle", "Calling model...", eventContext, "lifecycle:model");
-            response = await sendLLMMessage(host, llmClient, modelRequest.messages, modelRequest.options, assistantBuffer, eventContext);
+            response = await withAbortAndTimeout((execution) => sendLLMMessage(host, llmClient, modelRequest.messages, {
+                ...modelRequest.options,
+                abortSignal: execution.abortSignal,
+                ...(execution.timeoutMs !== undefined ? { timeoutMs: execution.timeoutMs } : {}),
+            }, assistantBuffer, eventContext, {
+                emitAssistantDeltas: options.streamFinalText && supportsNativeToolCalling,
+                holdAssistantDelta: options.holdAssistantDelta,
+            }), options.abortSignal, remainingTimeoutMs(deadlineAt), "model_request");
         }
         catch (err) {
+            if (err instanceof ToolLoopTerminalError)
+                throw err;
+            const interruption = terminalModelInterruptionFromError(err);
+            if (interruption)
+                throw interruption;
             console.error("[chat-runner] executeWithTools error:", err);
             const hint = err instanceof Error ? `: ${err.message}` : "";
             throw new Error(`Sorry, I encountered an error processing your request${hint}.`);
         }
         addUsageCounter(usage, usageFromLLMResponse(response));
-        const toolCalls = response.tool_calls?.length
-            ? response.tool_calls
-            : supportsNativeToolCalling
-                ? []
-                : extractPromptedToolCalls({
-                    content: response.content,
-                    tools: modelRequest.toolDefinitions,
-                    createId: () => `prompted-${loop}-${crypto.randomUUID()}`,
-                }).map((call) => ({
-                    id: call.id,
-                    type: "function",
-                    function: {
-                        name: call.name,
-                        arguments: JSON.stringify(call.input ?? {}),
-                    },
-                }));
-        if (!supportsNativeToolCalling && toolCalls.length > 0) {
-            assistantBuffer.text = "";
-        }
+        const nativeToolCalls = response.tool_calls?.length ? response.tool_calls : [];
+        const promptedToolCalls = !supportsNativeToolCalling && visibleTools.length > 0
+            ? extractPromptedToolCalls({
+                content: response.content,
+                tools: modelRequest.toolDefinitions,
+            }).map(promptedToolCallToLLMToolCall)
+            : [];
+        const toolCalls = nativeToolCalls.length > 0 ? nativeToolCalls : promptedToolCalls;
         if (toolCalls.length === 0) {
             return {
-                output: assistantBuffer.text || response.content || "(no response)",
+                output: response.content || assistantBuffer.text || "(no response)",
                 usage,
             };
         }
-        messages.push({ role: "assistant", content: response.content || "" });
+        messages.push(supportsNativeToolCalling
+            ? { role: "assistant", content: response.content || "", tool_calls: toolCalls }
+            : { role: "assistant", content: `Calling ${toolCalls.map((call) => call.function.name).join(", ")}` });
+        const toolCycleResults = [];
         for (const tc of toolCalls) {
             let args = {};
             try {
@@ -440,26 +463,474 @@ async function executeWithTools(host, turnContext, eventContext, assistantBuffer
             catch {
                 // ignore parse errors, use empty args
             }
-            const toolResult = await dispatchToolCall(host, tc.id, tc.function.name, args, toolCallContext, eventContext);
-            if (tc.function.name === "tool_search") {
+            const visibleToolsForCall = currentVisibleTools();
+            const resolvedTool = resolveGatewayToolCallName(tc.function.name, visibleToolsForCall);
+            if (!resolvedTool.allowed) {
+                const allowedToolNames = new Set(visibleToolsForCall.map((tool) => tool.metadata.name));
+                const unavailable = classifyUnavailableGatewayTool(tc.function.name, host.deps.registry?.listAll() ?? [], allowedToolNames);
+                const summary = formatUnavailableGatewayToolSummary(unavailable);
+                host.eventBridge.emitActivity("tool", formatToolActivity("Failed", tc.function.name, summary), eventContext, tc.id);
+                host.eventBridge.emitEvent({
+                    type: "tool_end",
+                    toolCallId: tc.id,
+                    toolName: tc.function.name,
+                    success: false,
+                    summary,
+                    durationMs: 0,
+                    ...host.eventBridge.eventBase(eventContext),
+                });
+                if (!unavailable.recoverable) {
+                    throw new ToolLoopTerminalError(unavailable.code, summary);
+                }
+                const toolResult = JSON.stringify({
+                    error: "unavailable_tool",
+                    denial_class: unavailable.denialClass,
+                    requested_tool: tc.function.name,
+                    message: summary,
+                });
+                messages.push({
+                    role: "tool",
+                    tool_call_id: tc.id,
+                    name: tc.function.name,
+                    content: toolResult,
+                });
+                const attemptKey = unavailable.normalizedName;
+                const attemptCount = (unavailableToolAttempts.get(attemptKey) ?? 0) + 1;
+                unavailableToolAttempts.set(attemptKey, attemptCount);
+                if (attemptCount >= GATEWAY_UNAVAILABLE_TOOL_GUIDANCE_LIMIT) {
+                    messages.push({
+                        role: "user",
+                        content: `The tool "${tc.function.name}" is unavailable in this gateway scope after ${attemptCount} attempts. Stop retrying that missing tool and answer without it.`,
+                    });
+                }
+                toolCycleResults.push({
+                    name: tc.function.name,
+                    args,
+                    result: toolResult,
+                    unavailableClass: unavailable.denialClass,
+                    polling: false,
+                });
+                continue;
+            }
+            throwIfAbortedOrTimedOut(options.abortSignal, deadlineAt, "tool_call");
+            const executableTool = findGatewayVisibleTool(resolvedTool.name, visibleToolsForCall);
+            if (!executableTool) {
+                throw new ToolLoopTerminalError("policy_blocked", `Tool ${tc.function.name} is blocked by host gateway policy.`);
+            }
+            const approvalBindingFailure = isGatewaySurface
+                ? gatewayApprovalBindingFailure(executableTool, args, gatewayScopeContext)
+                : null;
+            if (approvalBindingFailure) {
+                host.eventBridge.emitActivity("tool", formatToolActivity("Failed", executableTool.metadata.name, approvalBindingFailure), eventContext, tc.id);
+                host.eventBridge.emitEvent({
+                    type: "tool_end",
+                    toolCallId: tc.id,
+                    toolName: executableTool.metadata.name,
+                    success: false,
+                    summary: approvalBindingFailure,
+                    durationMs: 0,
+                    ...(executableTool.metadata.activityCategory ? { activityCategory: executableTool.metadata.activityCategory } : {}),
+                    ...host.eventBridge.eventBase(eventContext),
+                });
+                throw new ToolLoopTerminalError("policy_blocked", approvalBindingFailure);
+            }
+            const toolResult = await withAbortAndTimeout((execution) => dispatchToolCall(host, tc.id, resolvedTool.name, args, {
+                ...toolCallContext,
+                abortSignal: execution.abortSignal,
+                ...(execution.timeoutMs !== undefined ? { timeoutMs: execution.timeoutMs } : {}),
+                callId: tc.id,
+            }, eventContext), options.abortSignal, remainingTimeoutMs(deadlineAt), "tool_call");
+            if (resolvedTool.name === "tool_search") {
                 activateToolSearchResults(host.activatedTools, toolResult);
             }
-            messages.push({ role: "user", content: `Tool result for ${tc.function.name}:\n${toolResult}` });
+            applyGatewayApprovalScopeFromToolResult(resolvedTool.name, toolResult, gatewayScopeContext);
+            toolCycleResults.push({
+                name: resolvedTool.name,
+                args,
+                result: toolResult,
+                polling: isPollingGatewayTool(resolvedTool.name),
+            });
+            messages.push({
+                role: "tool",
+                tool_call_id: tc.id,
+                name: resolvedTool.name,
+                content: toolResult,
+            });
+        }
+        const toolCycleFingerprint = stableToolCycleFingerprint(toolCycleResults);
+        if (toolCycleFingerprint === previousToolCycleFingerprint) {
+            repeatedToolCycleCount++;
+            const limit = toolCycleResults.some((item) => item.polling)
+                ? GATEWAY_POLL_BLOCK_REPEAT_LIMIT
+                : GATEWAY_LOOP_BLOCK_REPEAT_LIMIT;
+            const warningLimit = toolCycleResults.some((item) => item.polling)
+                ? GATEWAY_POLL_WARNING_REPEAT_LIMIT
+                : GATEWAY_LOOP_WARNING_REPEAT_LIMIT;
+            if (repeatedToolCycleCount === warningLimit - 1) {
+                messages.push({
+                    role: "user",
+                    content: "The last gateway tool cycle repeated with identical arguments and identical output. If this is not making progress, stop retrying and answer from the available evidence.",
+                });
+            }
+            if (repeatedToolCycleCount >= limit - 1) {
+                throw new ToolLoopTerminalError("stalled_tool_loop", "The gateway model/tool loop repeated the same tool call and received the same result without making progress.");
+            }
+        }
+        else {
+            previousToolCycleFingerprint = toolCycleFingerprint;
+            repeatedToolCycleCount = 0;
+        }
+    }
+    throw new ToolLoopTerminalError("tool_loop_exhausted", `The gateway model/tool loop reached the maximum of ${MAX_TOOL_LOOPS} tool iterations without a final assistant answer.`);
+}
+function applyGatewayApprovalScopeFromToolResult(toolName, toolResult, scopeContext) {
+    if (toolName !== "ask-human")
+        return;
+    let parsed;
+    try {
+        parsed = JSON.parse(toolResult);
+    }
+    catch {
+        return;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return;
+    const record = parsed;
+    if (record["answer"] !== "approved")
+        return;
+    if (record["approval_scope"] !== "write"
+        && record["approval_scope"] !== "execute"
+        && record["approval_scope"] !== "durable_run") {
+        return;
+    }
+    const target = parseGatewayApprovalTarget(record["approval_target"]);
+    if (!target)
+        return;
+    const approvedAction = approvedGatewayActionFromTarget(target);
+    if (!approvedAction)
+        return;
+    scopeContext.approvedGatewayActions = [
+        ...(scopeContext.approvedGatewayActions ?? []),
+        approvedAction,
+    ];
+}
+function parseGatewayApprovalTarget(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    const toolName = typeof record["tool_name"] === "string" ? record["tool_name"].trim() : "";
+    if (!toolName)
+        return null;
+    const action = typeof record["action"] === "string" ? record["action"].trim() : "";
+    const args = isRecord(record["arguments"]) ? record["arguments"] : undefined;
+    return {
+        tool_name: toolName,
+        ...(action ? { action } : {}),
+        ...(args ? { arguments: args } : {}),
+    };
+}
+function approvedGatewayActionFromTarget(target) {
+    if (!target.arguments)
+        return null;
+    const toolName = target.tool_name.trim();
+    if (!toolName)
+        return null;
+    return {
+        toolName,
+        normalizedToolName: normalizeGatewayToolName(toolName),
+        ...(target.action ? { action: target.action } : {}),
+        argsFingerprint: stableJsonFingerprint(target.arguments),
+    };
+}
+function terminalModelInterruptionFromError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const normalized = message.toLowerCase();
+    if (normalized.includes("abort") || normalized.includes("cancel")) {
+        return new ToolLoopTerminalError("model_request_aborted", message);
+    }
+    if (normalized.includes("timeout") || normalized.includes("timed out")) {
+        return new ToolLoopTerminalError("model_request_timeout", message);
+    }
+    return null;
+}
+function resolveGatewayToolCallName(requestedName, tools) {
+    const trimmed = requestedName.trim();
+    if (!trimmed)
+        return { allowed: false };
+    if (tools.some((tool) => tool.metadata.name === trimmed)) {
+        return { allowed: true, name: trimmed };
+    }
+    const normalized = normalizeGatewayToolName(trimmed);
+    const matches = tools
+        .map((tool) => tool.metadata.name)
+        .filter((name) => normalizeGatewayToolName(name) === normalized);
+    return matches.length === 1 ? { allowed: true, name: matches[0] } : { allowed: false };
+}
+function findGatewayVisibleTool(requestedName, tools) {
+    const trimmed = requestedName.trim();
+    if (!trimmed)
+        return null;
+    const direct = tools.find((tool) => tool.metadata.name === trimmed);
+    if (direct)
+        return direct;
+    const normalized = normalizeGatewayToolName(trimmed);
+    return tools.find((tool) => normalizeGatewayToolName(tool.metadata.name) === normalized) ?? null;
+}
+function gatewayApprovalBindingFailure(tool, args, context) {
+    if (tool.metadata.gatewayExposure !== "approval_required")
+        return null;
+    if (tool.metadata.isReadOnly)
+        return null;
+    const normalizedToolName = normalizeGatewayToolName(tool.metadata.name);
+    const approvedActions = (context.approvedGatewayActions ?? [])
+        .filter((action) => action.normalizedToolName === normalizedToolName);
+    if (approvedActions.length === 0) {
+        return `Tool ${tool.metadata.name} requires explicit approval for this exact request before it can run on this gateway surface.`;
+    }
+    const argsFingerprint = stableJsonFingerprint(args);
+    if (approvedActions.some((action) => action.argsFingerprint === argsFingerprint)) {
+        return null;
+    }
+    return `Tool ${tool.metadata.name} was approved only for a different request. The current arguments do not match the approved approval_target.arguments.`;
+}
+function classifyUnavailableGatewayTool(requestedName, registeredTools, allowedToolNames) {
+    const normalizedName = normalizeGatewayToolName(requestedName);
+    const knownTool = registeredTools.find((tool) => normalizeGatewayToolName(tool.metadata.name) === normalizedName
+        || tool.metadata.aliases.some((alias) => normalizeGatewayToolName(alias) === normalizedName));
+    if (!knownTool) {
+        return {
+            denialClass: "unknown_tool",
+            normalizedName,
+            code: "policy_blocked",
+            recoverable: true,
+            requestedName,
+        };
+    }
+    if (allowedToolNames.has(knownTool.metadata.name)) {
+        return {
+            denialClass: "unknown_tool",
+            normalizedName,
+            code: "policy_blocked",
+            recoverable: true,
+            requestedName,
+        };
+    }
+    if (knownTool.metadata.gatewayExposure === "runtime_control") {
+        return {
+            denialClass: "runtime_control_unauthorized",
+            normalizedName,
+            code: "policy_blocked",
+            recoverable: false,
+            requestedName,
+        };
+    }
+    if (knownTool.metadata.permissionLevel === "write_local"
+        || knownTool.metadata.permissionLevel === "write_remote"
+        || knownTool.metadata.permissionLevel === "execute"
+        || knownTool.metadata.isDestructive) {
+        return {
+            denialClass: "approval_required",
+            normalizedName,
+            code: "policy_blocked",
+            recoverable: false,
+            requestedName,
+        };
+    }
+    const recoverable = knownTool.metadata.isReadOnly && knownTool.metadata.permissionLevel === "read_only";
+    return {
+        denialClass: recoverable ? "known_not_exposed" : "host_policy_denied",
+        normalizedName,
+        code: "policy_blocked",
+        recoverable,
+        requestedName,
+    };
+}
+function formatUnavailableGatewayToolSummary(input) {
+    switch (input.denialClass) {
+        case "unknown_tool":
+            return `Tool ${input.requestedName} is not available in this gateway scope. Use another available tool or answer without it.`;
+        case "known_not_exposed":
+            return `Tool ${input.requestedName} exists but is not exposed on this gateway surface. Use another available tool or answer without it.`;
+        case "approval_required":
+            return `Tool ${input.requestedName} requires explicit approval or a narrower setup state before it can be exposed on this gateway surface.`;
+        case "runtime_control_unauthorized":
+            return `Tool ${input.requestedName} requires runtime-control authorization and is not available for this gateway turn.`;
+        case "host_policy_denied":
+            return `Tool ${input.requestedName} is blocked by host gateway policy.`;
+    }
+}
+function promptedToolCallToLLMToolCall(call) {
+    return {
+        id: call.id,
+        type: "function",
+        function: {
+            name: call.name,
+            arguments: JSON.stringify(call.input ?? {}),
+        },
+    };
+}
+function normalizeGatewayToolName(name) {
+    return name.trim().toLowerCase().replace(/[.\-\s]+/g, "_");
+}
+function isPollingGatewayTool(name) {
+    return name.includes("observe")
+        || name.includes("status")
+        || name.includes("poll")
+        || name === "process_session_read"
+        || name === "process_status";
+}
+function remainingTimeoutMs(deadlineAt) {
+    if (deadlineAt === null)
+        return undefined;
+    return Math.max(0, deadlineAt - Date.now());
+}
+function throwIfAbortedOrTimedOut(abortSignal, deadlineAt, phase) {
+    if (abortSignal?.aborted) {
+        throw new ToolLoopTerminalError(phase === "model_request" ? "model_request_aborted" : "tool_call_aborted", phase === "model_request"
+            ? "The gateway model request was aborted before it completed."
+            : "The gateway tool call was aborted before it completed.");
+    }
+    const remaining = remainingTimeoutMs(deadlineAt);
+    if (remaining !== undefined && remaining <= 0) {
+        throw new ToolLoopTerminalError(phase === "model_request" ? "model_request_timeout" : "tool_call_timeout", phase === "model_request"
+            ? "The gateway model request timed out before it completed."
+            : "The gateway tool call timed out before it completed.");
+    }
+}
+async function withAbortAndTimeout(operation, abortSignal, timeoutMs, phase) {
+    throwIfAbortedOrTimedOut(abortSignal, timeoutMs === undefined ? null : Date.now() + timeoutMs, phase);
+    const controller = new AbortController();
+    let timeout;
+    let abortHandler;
+    const racers = [];
+    if (timeoutMs !== undefined) {
+        racers.push(new Promise((_, reject) => {
+            timeout = setTimeout(() => {
+                const err = new ToolLoopTerminalError(phase === "model_request" ? "model_request_timeout" : "tool_call_timeout", phase === "model_request"
+                    ? "The gateway model request timed out before it completed."
+                    : "The gateway tool call timed out before it completed.");
+                reject(err);
+                abortController(controller, err);
+            }, timeoutMs);
+        }));
+    }
+    if (abortSignal) {
+        racers.push(new Promise((_, reject) => {
+            if (abortSignal.aborted) {
+                const err = new ToolLoopTerminalError(phase === "model_request" ? "model_request_aborted" : "tool_call_aborted", phase === "model_request"
+                    ? "The gateway model request was aborted before it completed."
+                    : "The gateway tool call was aborted before it completed.");
+                reject(err);
+                abortController(controller, err);
+                return;
+            }
+            abortHandler = () => {
+                const err = new ToolLoopTerminalError(phase === "model_request" ? "model_request_aborted" : "tool_call_aborted", phase === "model_request"
+                    ? "The gateway model request was aborted before it completed."
+                    : "The gateway tool call was aborted before it completed.");
+                reject(err);
+                abortController(controller, err);
+            };
+            abortSignal.addEventListener("abort", abortHandler, { once: true });
+        }));
+    }
+    const operationPromise = operation({
+        abortSignal: controller.signal,
+        ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+    });
+    racers.unshift(operationPromise);
+    try {
+        return await Promise.race(racers);
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+        if (abortSignal && abortHandler) {
+            abortSignal.removeEventListener("abort", abortHandler);
         }
     }
-    const lastAssistant = [...messages].reverse().find(m => m.role === "assistant");
+}
+function abortController(controller, reason) {
+    if (controller.signal.aborted)
+        return;
+    controller.abort(reason);
+}
+function stableToolCycleFingerprint(results) {
+    return JSON.stringify(results.map((item) => ({
+        name: item.name,
+        args: stableJsonValue(item.args),
+        result: item.result,
+        unavailableClass: item.unavailableClass ?? null,
+    })));
+}
+function stableJsonFingerprint(value) {
+    return JSON.stringify(stableJsonValue(value));
+}
+function stableJsonValue(value) {
+    if (Array.isArray(value))
+        return value.map(stableJsonValue);
+    if (!value || typeof value !== "object")
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entry]) => [key, stableJsonValue(entry)]));
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function toolLoopTerminalEvidence(error) {
+    if (error.code === "approval_denied" || error.code === "policy_blocked") {
+        return {
+            code: error.code,
+            stoppedReason: error.code,
+            signals: [{
+                    kind: "approval",
+                    status: error.code === "approval_denied" ? "denied" : "blocked",
+                    code: error.code,
+                }],
+        };
+    }
+    const isInterruption = error.code === "model_request_timeout"
+        || error.code === "model_request_aborted"
+        || error.code === "tool_call_timeout"
+        || error.code === "tool_call_aborted";
+    const stoppedReason = error.code === "model_request_aborted" || error.code === "tool_call_aborted"
+        ? "aborted"
+        : isInterruption
+            ? "timeout"
+            : "stalled_tool_loop";
+    if (isInterruption) {
+        return {
+            code: error.code,
+            stoppedReason: error.code,
+            signals: [{
+                    kind: "runtime",
+                    stoppedReason,
+                    code: error.code,
+                }],
+        };
+    }
     return {
-        output: lastAssistant?.content || "I was unable to complete the request within the allowed tool call limit.",
-        usage,
+        code: error.code,
+        stoppedReason: error.code,
+        signals: [{
+                kind: "runtime",
+                operationState: "daemon_loop",
+                stoppedReason,
+                code: error.code,
+            }],
     };
 }
+function shouldGateRuntimeEvidenceForTurn(turnContext) {
+    return turnContext.modelVisible.tools.selectedRoute === "gateway_model_loop"
+        && turnContext.modelVisible.runtime.replyTarget?.surface === "gateway";
+}
 async function persistDirectRouteResult(host, output, eventContext, assistantBuffer, history, start) {
     const elapsed_ms = Date.now() - start;
     if (!assistantBuffer.text) {
         host.eventBridge.pushAssistantDelta(output, assistantBuffer, eventContext);
     }
     await history.appendAssistantMessage(output);
-    host.eventBridge.emitActivity("lifecycle", "Finalizing response...", eventContext, "lifecycle:finalizing");
     host.eventBridge.emitEvent({
         type: "assistant_final",
         text: output,
@@ -535,7 +1006,7 @@ async function formatConfigureGuidance(host, target, setupSecretIntake = null, l
                 pending_write: telegramSecret !== undefined,
             },
         }), eventContext);
-        return formatTelegramConfigureGuidance(status, suppliedTelegramToken, telegramSecret !== undefined, languageHint);
+        return formatTelegramConfigureGuidance(status, suppliedTelegramToken, telegramSecret !== undefined);
     }
     if (target === "gateway") {
         const discordSecret = setupSecretIntake?.suppliedSecrets.find((secret) => secret.kind === "discord_bot_token");
@@ -571,142 +1042,6 @@ async function formatConfigureGuidance(host, target, setupSecretIntake = null, l
         "Use `pulseed setup` for the main wizard, `pulseed gateway setup` for chat channels, or the channel-specific setup command when available.",
     ].join("\n");
 }
-function formatTelegramConfigProgressDetail(status) {
-    if (!status.config.exists)
-        return "Config file does not exist yet.";
-    if (!status.config.hasBotToken)
-        return "Config file exists, but no bot token is configured.";
-    if (!status.config.hasHomeChat)
-        return "Bot token is configured, but no home chat is set.";
-    return "Bot token and home chat are configured.";
-}
-export function formatTelegramConfigureGuidance(status, suppliedTelegramToken, pendingActionCreated, languageHint) {
-    const guidance = buildTelegramSetupGuidanceData(status, suppliedTelegramToken, pendingActionCreated);
-    const renderJa = shouldRenderJapanese(languageHint);
-    const lines = [
-        "Telegram gateway status",
-        "",
-        guidance.daemon.running
-            ? renderJa
-                ? `- Daemon: port ${guidance.daemon.port} で起動中です。gateway load state は ${guidance.gateway.load_state} です。`
-                : `- Daemon: running on port ${guidance.daemon.port}; gateway load state is ${guidance.gateway.load_state}.`
-            : renderJa
-                ? `- Daemon: port ${guidance.daemon.port} で応答していません。`
-                : `- Daemon: not responding on port ${guidance.daemon.port}.`,
-    ];
-    if (guidance.state === "unconfigured") {
-        lines.push(renderJa ? "- Telegram: まだ設定されていません。" : "- Telegram: not configured.", "", "Recommended command path:", "```sh", ...guidance.command_tokens.recommended_path, "```", "", renderJa
-            ? "@BotFather で bot を作成または開き、`pulseed telegram setup` で token を入力してください。"
-            : "Create or open a bot with @BotFather, then enter the token in `pulseed telegram setup`.");
-    }
-    else if (guidance.state === "partially_configured") {
-        lines.push(renderJa
-            ? "- Telegram config: bot token は設定済みですが、home chat が未設定です。"
-            : "- Telegram config: bot token is configured, but no home chat is set.", renderJa
-            ? `- Gateway loaded in daemon: ${guidance.gateway.load_state} です。`
-            : "- Gateway loaded in daemon: unknown from chat status.", "", "Next step:", renderJa
-            ? `- PulSeed の返信先にしたい Telegram chat から bot に \`${guidance.command_tokens.set_home}\` を送ってください。`
-            : `- Send \`${guidance.command_tokens.set_home}\` to the Telegram bot from the chat that should receive PulSeed replies.`, renderJa
-            ? "- その後 `pulseed daemon status` で gateway を確認してください。"
-            : "- Then run `pulseed daemon status` to verify the gateway.");
-    }
-    else {
-        lines.push(renderJa ? "- Telegram config: 設定済みです。" : "- Telegram config: configured.", guidance.config.has_home_chat
-            ? renderJa ? "- Home chat: 設定済みです。" : "- Home chat: configured."
-            : renderJa
-                ? `- Home chat: 未設定です。この bot が特定 chat に返信する必要がある場合は \`${guidance.command_tokens.set_home}\` を送ってください。`
-                : `- Home chat: not set; send \`${guidance.command_tokens.set_home}\` if this bot should reply into a specific chat.`, renderJa
-            ? `- Gateway loaded in daemon: ${guidance.gateway.load_state} です。`
-            : `- Gateway loaded in daemon: ${guidance.gateway.load_state}.`, "", "Verification:", renderJa ? "- Telegram bot にメッセージを送ってください。" : "- Send a message to the Telegram bot.", renderJa ? "- 配信されない場合は `pulseed daemon status` を実行してください。" : "- Run `pulseed daemon status` if delivery does not work.");
-    }
-    lines.push("", guidance.pending_write.exists
-        ? guidance.pending_write.replaces_existing_secret
-            ? renderJa
-                ? `この turn で Telegram bot token を受け取り、chat history と activity には redacted のまま保持しました。confirm すると既存の configured token を置き換えます。approval-gated config write を依頼するには \`${guidance.command_tokens.confirm_write}\` または自然文で承認してください。`
-                : `I received a Telegram bot token in this turn and kept it redacted from chat history and activity. Confirming will replace the existing configured token. Reply \`${guidance.command_tokens.confirm_write}\` or approve in natural language to request an approval-gated config write.`
-            : renderJa
-                ? `この turn で Telegram bot token を受け取り、chat history と activity には redacted のまま保持しました。approval-gated config write を依頼するには \`${guidance.command_tokens.confirm_write}\` または自然文で承認してください。`
-                : `I received a Telegram bot token in this turn and kept it redacted from chat history and activity. Reply \`${guidance.command_tokens.confirm_write}\` or approve in natural language to request an approval-gated config write.`
-        : suppliedTelegramToken
-            ? renderJa
-                ? "この turn で Telegram bot token を受け取り、chat history と activity には redacted のまま保持しましたが、setup action は準備できませんでした。"
-                : "I received a Telegram bot token in this turn and kept it redacted from chat history and activity, but no setup action could be prepared."
-            : renderJa
-                ? "chat-assisted setup を使う場合は、ここに token を貼ってください。PulSeed は history から redaction し、config 書き込み前に approval-gated confirmation を準備します。"
-                : "If you prefer chat-assisted setup, paste the token here; PulSeed will redact it from history and prepare an approval-gated confirmation before writing config.");
-    if (!guidance.daemon.running && guidance.state !== "unconfigured") {
-        lines.push("", renderJa
-            ? "config は daemon を起動または再起動するまで反映されません。"
-            : "The config will not take effect until the daemon is started or restarted.");
-    }
-    else if (guidance.daemon.running && guidance.state !== "unconfigured") {
-        lines.push("", renderJa
-            ? "chat-assisted setup で Telegram config を追加または変更した場合は、承認済み write 後に PulSeed が internal gateway refresh を要求します。"
-            : "If Telegram was configured or changed through chat-assisted setup, PulSeed will request an internal gateway refresh after the approved write.", renderJa
-            ? "PulSeed chat setup 以外で config を変更した場合、配信が最新 gateway config を拾わなければ `pulseed daemon restart` を実行してください。"
-            : "For config changes made outside PulSeed chat setup, run `pulseed daemon restart` if delivery does not pick up the updated gateway config.");
-    }
-    return lines.join("\n");
-}
-export function buildTelegramSetupGuidanceData(status, suppliedTelegramToken, pendingActionCreated) {
-    const nextAction = status.state === "unconfigured"
-        ? {
-            kind: "configure_bot_token",
-            required: true,
-            description: "Configure a Telegram bot token before gateway delivery can work.",
-        }
-        : !status.config.hasHomeChat
-            ? {
-                kind: "send_sethome",
-                required: true,
-                description: "Send /sethome from the Telegram chat that should receive PulSeed replies.",
-            }
-            : {
-                kind: "verify_delivery",
-                required: false,
-                description: "Send a Telegram message and inspect daemon status if delivery fails.",
-            };
-    return {
-        channel: "telegram",
-        state: status.state,
-        config_path: status.configPath,
-        daemon: { running: status.daemon.running, port: status.daemon.port },
-        gateway: { load_state: status.gateway.loadState },
-        config: {
-            exists: status.config.exists,
-            has_bot_token: status.config.hasBotToken,
-            has_home_chat: status.config.hasHomeChat,
-            allow_all: status.config.allowAll,
-            allowed_user_count: status.config.allowedUserCount,
-            runtime_control_allowed_user_count: status.config.runtimeControlAllowedUserCount,
-            identity_key_configured: status.config.identityKeyConfigured,
-        },
-        next_action: nextAction,
-        command_tokens: {
-            recommended_path: ["pulseed telegram setup", "pulseed gateway setup", "pulseed daemon start", "pulseed daemon status"],
-            confirm_write: SETUP_WRITE_CONFIRM_COMMAND,
-            set_home: "/sethome",
-        },
-        safety: {
-            writes_config: false,
-            writes_secret: false,
-            requires_approval_before_write: true,
-            shell_fallback_allowed: false,
-            access_closed_by_default: !status.config.allowAll && status.config.allowedUserCount === 0,
-        },
-        pending_write: {
-            exists: pendingActionCreated,
-            state: pendingActionCreated ? "confirm_write" : "none",
-            replaces_existing_secret: pendingActionCreated && status.config.hasBotToken,
-            secret_kind: pendingActionCreated ? "telegram_bot_token" : null,
-        },
-        redaction: {
-            raw_secret_in_summary: false,
-            raw_secret_in_data: false,
-            redaction_marker_present: suppliedTelegramToken,
-        },
-    };
-}
 async function dispatchToolCall(host, toolCallId, name, args, context, eventContext) {
     if (!host.deps.registry) {
         host.eventBridge.emitActivity("tool", formatToolActivity("Failed", name, "No tool registry configured"), eventContext, toolCallId);
@@ -803,7 +1138,7 @@ async function dispatchToolCall(host, toolCallId, name, args, context, eventCont
                         ...(activityCategory ? { activityCategory } : {}),
                         ...host.eventBridge.eventBase(eventContext),
                     });
-                    return `Tool ${name} not approved: ${permResult.reason}`;
+                    throw new ToolLoopTerminalError("approval_denied", `Tool ${name} not approved: ${permResult.reason}`);
                 }
             }
             host.eventBridge.emitEvent({
@@ -840,10 +1175,21 @@ async function dispatchToolCall(host, toolCallId, name, args, context, eventCont
             ...(activityCategory ? { activityCategory } : {}),
             ...host.eventBridge.eventBase(eventContext),
         });
+        const terminalToolFailure = terminalToolFailureFromResult(name, tool, result);
+        if (terminalToolFailure) {
+            throw terminalToolFailure;
+        }
         return result.data != null ? JSON.stringify(result.data) : (result.summary ?? "(no result)");
     }
     catch (err) {
+        if (err instanceof ToolLoopTerminalError) {
+            throw err;
+        }
         const message = err instanceof Error ? err.message : String(err);
+        const terminalInterruption = terminalToolInterruptionFromMessage(message);
+        if (terminalInterruption) {
+            throw terminalInterruption;
+        }
         const durationMs = Date.now() - startTime;
         host.deps.onToolEnd?.(name, { success: false, summary: message, durationMs });
         host.eventBridge.emitActivity("tool", formatToolActivity("Failed", name, message), eventContext, toolCallId);
@@ -860,27 +1206,69 @@ async function dispatchToolCall(host, toolCallId, name, args, context, eventCont
         return JSON.stringify({ error: `Tool ${name} failed: ${message}` });
     }
 }
-async function sendLLMMessage(host, llmClient, messages, options, assistantBuffer, eventContext) {
+function terminalToolInterruptionFromMessage(message) {
+    const normalized = message.toLowerCase();
+    if (normalized.includes("abort") || normalized.includes("cancel")) {
+        return new ToolLoopTerminalError("tool_call_aborted", message);
+    }
+    if (normalized.includes("timeout") || normalized.includes("timed out")) {
+        return new ToolLoopTerminalError("tool_call_timeout", message);
+    }
+    return null;
+}
+function terminalToolFailureFromResult(name, tool, result) {
+    if (result.success)
+        return null;
+    const reason = result.execution?.reason;
+    if (reason === "approval_denied") {
+        return new ToolLoopTerminalError("approval_denied", result.execution?.message ?? result.error ?? result.summary ?? `Tool ${name} was denied by approval policy.`);
+    }
+    if (reason === "policy_blocked"
+        && (tool.metadata.permissionLevel !== "read_only" || tool.metadata.isDestructive)) {
+        return new ToolLoopTerminalError("policy_blocked", result.execution?.message ?? result.error ?? result.summary ?? `Tool ${name} was blocked by policy.`);
+    }
+    return null;
+}
+async function sendLLMMessage(host, llmClient, messages, options, assistantBuffer, eventContext, behavior = {}) {
+    const emitAssistantDeltas = behavior.emitAssistantDeltas ?? true;
     let streamed = false;
+    let emitted = false;
+    let heldDelta = "";
+    const pushDeltaIfAllowed = (delta) => {
+        if (!emitAssistantDeltas)
+            return;
+        const nextDelta = `${heldDelta}${delta}`;
+        const candidate = `${assistantBuffer.text}${nextDelta}`;
+        if (behavior.holdAssistantDelta?.(candidate)) {
+            heldDelta = nextDelta;
+            return;
+        }
+        heldDelta = "";
+        emitted = true;
+        host.eventBridge.pushAssistantDelta(nextDelta, assistantBuffer, eventContext);
+    };
     if (llmClient.sendMessageStream) {
         const response = await llmClient.sendMessageStream(messages, options, {
             onTextDelta: (delta) => {
                 streamed = true;
-                host.eventBridge.pushAssistantDelta(delta, assistantBuffer, eventContext);
+                pushDeltaIfAllowed(delta);
             },
         });
-        if (!streamed && response.content) {
+        if (emitAssistantDeltas && !streamed && response.content) {
+            pushDeltaIfAllowed(response.content);
+        }
+        if (emitAssistantDeltas && !emitted && response.content && !behavior.holdAssistantDelta?.(response.content)) {
             host.eventBridge.pushAssistantDelta(response.content, assistantBuffer, eventContext);
         }
         return response;
     }
     const response = await llmClient.sendMessage(messages, options);
-    if (response.content) {
-        host.eventBridge.pushAssistantDelta(response.content, assistantBuffer, eventContext);
+    if (emitAssistantDeltas && response.content) {
+        pushDeltaIfAllowed(response.content);
     }
     return response;
 }
-async function buildToolCallContext(host, goalId = host.deps.goalId, runtimeControlContext, start, turnContext) {
+async function buildToolCallContext(host, goalId = host.deps.goalId, runtimeControlContext, start, turnContext, execution) {
     const executionPolicy = turnContext?.hostOnly.execution.executionPolicy ?? await host.getSessionExecutionPolicy();
     const runtimeContext = turnContext?.hostOnly.runtime.runtimeControlContext ?? runtimeControlContext;
     return {
@@ -890,6 +1278,20 @@ async function buildToolCallContext(host, goalId = host.deps.goalId, runtimeCont
         preApproved: false,
         approvalFn: agentLoopApprovalFn(host, runtimeContext),
         executionPolicy,
+        ...(host.deps.permissionGrantContext?.sessionId
+            ? { sessionId: host.deps.permissionGrantContext.sessionId }
+            : host.getConversationSessionId()
+                ? { sessionId: host.getConversationSessionId() }
+                : {}),
+        ...(turnContext?.modelVisible.turn.runId ? { runId: turnContext.modelVisible.turn.runId } : {}),
+        ...(turnContext?.modelVisible.turn.turnId ? { turnId: turnContext.modelVisible.turn.turnId } : {}),
+        ...(host.deps.permissionGrantContext?.projectId ? { projectId: host.deps.permissionGrantContext.projectId } : {}),
+        ...(host.deps.permissionGrantStore ? { permissionGrantStore: host.deps.permissionGrantStore } : {}),
+        ...(host.deps.permissionWaitPlanStore ? { permissionWaitPlanStore: host.deps.permissionWaitPlanStore } : {}),
+        ...(host.deps.capabilityVerificationStore ? { capabilityVerificationStore: host.deps.capabilityVerificationStore } : {}),
+        ...(host.deps.capabilityExecutionResolver ? { capabilityExecutionResolver: host.deps.capabilityExecutionResolver } : {}),
+        ...(execution?.abortSignal ? { abortSignal: execution.abortSignal } : {}),
+        ...(execution?.timeoutMs !== undefined ? { timeoutMs: execution.timeoutMs } : {}),
         ...(host.getConversationSessionId() ? { conversationSessionId: host.getConversationSessionId() } : {}),
         providerConfigBaseDir: host.getProviderConfigBaseDir(),
         setupSecretIntake: host.getSetupSecretIntake(),
@@ -923,32 +1325,42 @@ function agentLoopApprovalFn(host, runtimeControlContext) {
     };
 }
 async function loadResumableAgentLoopState(host) {
-    if (!host.getNativeAgentLoopStatePath())
-        return null;
-    const raw = await host.deps.stateManager.readRaw(host.getNativeAgentLoopStatePath());
-    if (!isAgentLoopSessionState(raw))
-        return null;
-    if (raw.status === "completed")
-        return null;
-    return {
-        ...raw,
-        messages: [...raw.messages],
-        calledTools: [...raw.calledTools],
-    };
+    const sessionId = host.getNativeAgentLoopSessionId();
+    if (!sessionId) {
+        return {
+            kind: "blocked",
+            code: "resume_state_missing",
+            message: formatMissingResumableChatStateMessage(),
+        };
+    }
+    const state = await new AgentLoopSessionStateCatalog(host.getProviderConfigBaseDir()).load(sessionId);
+    if (!state) {
+        return {
+            kind: "blocked",
+            code: "resume_state_missing",
+            message: formatMissingResumableChatStateMessage(),
+        };
+    }
+    if (state.status !== "running") {
+        return {
+            kind: "blocked",
+            code: "resume_state_not_resumable",
+            message: formatNonResumableAgentLoopStateMessage(state.status),
+        };
+    }
+    return { kind: "loaded", state };
 }
-function isAgentLoopSessionState(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const candidate = value;
-    return typeof candidate["sessionId"] === "string"
-        && typeof candidate["traceId"] === "string"
-        && typeof candidate["turnId"] === "string"
-        && typeof candidate["goalId"] === "string"
-        && typeof candidate["cwd"] === "string"
-        && typeof candidate["modelRef"] === "string"
-        && Array.isArray(candidate["messages"])
-        && Array.isArray(candidate["calledTools"])
-        && typeof candidate["status"] === "string";
+function formatMissingResumableChatStateMessage() {
+    return "I could not find a chat that can safely continue.";
+}
+function formatNonResumableAgentLoopStateMessage(status) {
+    if (status === "failed") {
+        return "The saved chat work stopped before it could safely continue; inspect what was running or start a new attempt.";
+    }
+    if (status === "completed") {
+        return "The saved chat work already completed; inspect what finished or start a new attempt.";
+    }
+    return "The saved chat work is not in a state PulSeed can safely continue; inspect what was running or start a new attempt.";
 }
 function activateToolSearchResults(activatedTools, toolResult) {
     try {
@@ -966,38 +1378,15 @@ function activateToolSearchResults(activatedTools, toolResult) {
         // Non-JSON result or unexpected shape — ignore
     }
 }
-function zeroUsageCounter() {
-    return { inputTokens: 0, outputTokens: 0, totalTokens: 0 };
-}
-function normalizeUsageCounter(usage) {
-    const inputTokens = Number.isFinite(usage.inputTokens) ? Math.max(0, Math.floor(usage.inputTokens)) : 0;
-    const outputTokens = Number.isFinite(usage.outputTokens) ? Math.max(0, Math.floor(usage.outputTokens)) : 0;
-    const totalTokens = Number.isFinite(usage.totalTokens)
-        ? Math.max(0, Math.floor(usage.totalTokens))
-        : inputTokens + outputTokens;
-    return { inputTokens, outputTokens, totalTokens };
-}
-function usageFromLLMResponse(response) {
-    const inputTokens = response.usage?.input_tokens ?? 0;
-    const outputTokens = response.usage?.output_tokens ?? 0;
-    return {
-        inputTokens,
-        outputTokens,
-        totalTokens: inputTokens + outputTokens,
-    };
-}
-function addUsageCounter(target, delta) {
-    const normalizedDelta = normalizeUsageCounter(delta);
-    target.inputTokens += normalizedDelta.inputTokens;
-    target.outputTokens += normalizedDelta.outputTokens;
-    target.totalTokens += normalizedDelta.totalTokens;
-}
-function hasUsage(usage) {
-    return usage.totalTokens > 0 || usage.inputTokens > 0 || usage.outputTokens > 0;
-}
-export async function resolveSessionExecutionPolicy(currentPolicy, sessionCwd) {
+export async function resolveSessionExecutionPolicy(currentPolicy, sessionCwd, defaultExecutionSecurity) {
     if (currentPolicy)
         return currentPolicy;
+    if (defaultExecutionSecurity) {
+        return resolveExecutionPolicy({
+            workspaceRoot: sessionCwd ?? process.cwd(),
+            security: defaultExecutionSecurity,
+        });
+    }
     const config = await loadProviderConfig({ saveMigration: false });
     return resolveExecutionPolicy({
         workspaceRoot: sessionCwd ?? process.cwd(),