AbstractAgent 0.3.17__tar.gz → 0.3.19__tar.gz

{abstractagent-0.3.17/src/abstractagent.egg-info → abstractagent-0.3.19}/PKG-INFO

@@ -1,17 +1,17 @@
 Metadata-Version: 2.4
 Name: abstractagent
-Version: 0.3.17
+Version: 0.3.19
 Summary: Agent implementations using AbstractRuntime and AbstractCore
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: abstractcore[tools]>=2.13.41
+Requires-Dist: abstractcore[tools]>=2.25.0
 Requires-Dist: abstractruntime>=0.7.0
 Provides-Extra: apple
-Requires-Dist: abstractcore[all-apple]>=2.13.41; extra == "apple"
+Requires-Dist: abstractcore[all-apple]>=2.25.0; extra == "apple"
 Requires-Dist: abstractruntime[apple]>=0.7.0; extra == "apple"
 Provides-Extra: gpu
-Requires-Dist: abstractcore[all-gpu]>=2.13.41; extra == "gpu"
+Requires-Dist: abstractcore[all-gpu]>=2.25.0; extra == "gpu"
 Requires-Dist: abstractruntime[gpu]>=0.7.0; extra == "gpu"
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"

{abstractagent-0.3.17 → abstractagent-0.3.19}/pyproject.toml

@@ -4,22 +4,22 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "abstractagent"
-version = "0.3.17"
+version = "0.3.19"
 description = "Agent implementations using AbstractRuntime and AbstractCore"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "abstractcore[tools]>=2.13.41",
+    "abstractcore[tools]>=2.25.0",
     "abstractruntime>=0.7.0",
 ]
 
 [project.optional-dependencies]
 apple = [
-    "abstractcore[all-apple]>=2.13.41",
+    "abstractcore[all-apple]>=2.25.0",
     "abstractruntime[apple]>=0.7.0",
 ]
 gpu = [
-    "abstractcore[all-gpu]>=2.13.41",
+    "abstractcore[all-gpu]>=2.25.0",
     "abstractruntime[gpu]>=0.7.0",
 ]
 dev = [

{abstractagent-0.3.17 → abstractagent-0.3.19}/src/abstractagent/adapters/emit_inventory.py

@@ -85,6 +85,12 @@ REACT_STEPS = COMMON_STEPS | frozenset(
         "parse_retry_empty",
         "parse_retry_plan_only",
         "parse_retry_truncated",
+        # Tool-call format repair (2026-10-03, shipped round 14): AbstractCore
+        # reported `metadata.tool_call_error` (code invalid_tool_syntax |
+        # unavailable_tool) and accepted ZERO calls; the model is asked once
+        # more with the tool roster — payload {cycle, attempt, code}. At most
+        # two per turn; the third raises (the run fails with the sentence).
+        "parse_retry_tool_format",
         # 0017 work half (2026-07-21), nudge-then-stop (2026-08-21): fires on
         # every detection of a consecutive-identical or A-B-A-B tool-batch
         # streak; payload {kind: repeat|oscillation, span, key, answered,

{abstractagent-0.3.17 → abstractagent-0.3.19}/src/abstractagent/adapters/react_runtime.py

@@ -1446,6 +1446,10 @@ def reset_react_turn(run_vars: Dict[str, Any]) -> None:
             # retry stash is the same lifecycle class.
             "pending_media",
             "last_call_media",
+            # Tool-call format repair budget is per TURN (two retries each):
+            # without this pop, two format failures anywhere in a conversation
+            # made every later failing turn raise at once.
+            "tool_format_retries",
         ):
             temp.pop(key, None)
 
@@ -2496,6 +2500,36 @@ def create_react_workflow(
             emit("parse_tool_calls", {"count": len(tool_calls)})
             return StepPlan(node_id="parse", next_node="act")
 
+        # Core owns syntax recognition; the agent owns bounded recovery. Retry
+        # only when zero calls were accepted, so a partial batch is never replayed.
+        metadata = response.get("metadata") if isinstance(response, dict) else None
+        tool_error = metadata.get("tool_call_error") if isinstance(metadata, dict) else None
+        if isinstance(tool_error, dict) and tool_error.get("code") in {"invalid_tool_syntax", "unavailable_tool"}:
+            retries = int(temp.get("tool_format_retries", 0) or 0)
+            if retries >= 2 or cycle_i >= max_iterations:
+                raise RuntimeError("Tool-call format repair failed: no executable tool calls after bounded retries.")
+            specs = runtime_ns.get("tool_specs") or []
+            names = [str(spec["name"]) for spec in specs if isinstance(spec, dict) and spec.get("name")]
+            if not names:
+                raise RuntimeError("The model attempted a tool call, but this run has no tools configured.")
+            temp["tool_format_retries"] = retries + 1
+            _push_inbox(
+                runtime_ns,
+                "Your previous tool call was rejected; nothing was executed. "
+                "Use only the available tools: " + ", ".join(names) + ". "
+                # No format of our own: the tool-calling format is the one the
+                # request's instructions carry (native structured calls, or the
+                # provider's prompted text format) — a hard-coded text syntax
+                # here would teach a native tool-calling model the wrong one.
+                "Follow the tool-calling format and argument schemas supplied in the instructions, "
+                "with an actual available tool name and valid arguments. "
+                "Emit the corrected call now, or explain why you cannot complete the task without it.",
+            )
+            emit("parse_retry_tool_format", {"cycle": cycle_i, "attempt": retries + 1, "code": tool_error["code"]})
+            if last_call_media:
+                temp["pending_media"] = last_call_media
+            return StepPlan(node_id="parse", next_node="reason")
+
         # If the model hit an output limit, treat the step as incomplete and continue.
         # Retry-nudge lane honesty (iteration-3 adversary P0, 2026-07-19 — the
         # c2447 chrome class at the PARSE boundary): these nudges ride the

{abstractagent-0.3.17 → abstractagent-0.3.19}/src/abstractagent/sandbox/local.py

@@ -11,7 +11,7 @@ import os
 import subprocess
 import sys
 import time
-from typing import Optional
+from typing import Any, Optional
 
 from .interface import ExecutionResult
 
@@ -22,9 +22,14 @@ class LocalSandbox:
         *,
         cwd: Optional[str] = None,
         python_executable: Optional[str] = None,
+        command_sandbox: Any = None,
     ):
+        """`command_sandbox`: an AbstractCore `abstractcore.tools.sandbox.Sandbox` (round 12). When
+        given, the interpreter runs inside it (OS sandbox bound to the run's workspaces, the host's
+        scrubbed environment, a private TMPDIR); the caller refuses before when it `refuses`."""
         self._cwd = cwd or os.getcwd()
         self._python = python_executable or sys.executable
+        self._command_sandbox = command_sandbox
 
     def reset(self) -> None:
         # Stateless sandbox (new subprocess per call).
@@ -47,10 +52,19 @@ class LocalSandbox:
             except (TypeError, ValueError):
                 t = 0.0
             eff_timeout = t if t > 0 else None
+        argv = [self._python, "-c", code]
+        env = None
+        box = self._command_sandbox
+        if box is not None:
+            if box.kind == "unsandboxed":
+                env = box.env_for()
+            else:
+                argv, env = box.wrap(argv, self._cwd)
         try:
             completed = subprocess.run(
-                [self._python, "-c", code],
+                argv,
                 cwd=self._cwd,
+                env=env,
                 capture_output=True,
                 text=True,
                 timeout=eff_timeout,

{abstractagent-0.3.17 → abstractagent-0.3.19}/src/abstractagent/tools/code_execution.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+from typing import Optional
+
 from abstractcore.tools import tool
 
 
@@ -25,16 +27,30 @@ def _bound_output(text: str, *, max_chars: int) -> str:
     )
 
 
+# Round 12: the one sentence when the installed AbstractCore has no command sandbox.
+NO_CORE_SANDBOX = (
+    "Commands are refused: the installed AbstractCore has no command sandbox "
+    "(abstractcore.tools.sandbox, AbstractCore 2.25.0 or newer)."
+)
+
+
 @tool(
     name="execute_python",
-    description="Execute a Python snippet in a subprocess sandbox. Returns stdout/stderr/exit_code in full.",
+    description="Execute a Python snippet in a subprocess, sandboxed to this run's workspaces. Returns stdout/stderr/exit_code in full.",
     when_to_use="When you need to compute, inspect files, or transform data using Python code",
+    # Stamped by the host (AbstractRuntime) with the run's workspace set; never model-facing.
+    hide_args=["_sandbox"],
 )
-def execute_python(code: str, timeout_s: float = 0.0, max_output_chars: int = 0) -> dict:
+def execute_python(code: str, timeout_s: float = 0.0, max_output_chars: int = 0, _sandbox: Optional[dict] = None) -> dict:
     """Execute Python code in a local subprocess.
 
     Notes:
-    - This is a dev sandbox. It is not a hardened security boundary.
+    - Round 12: when the host stamps `_sandbox` (the run's effective workspace set), the
+      interpreter runs inside AbstractCore's OS sandbox (macOS sandbox-exec, Linux bwrap/Landlock),
+      starting in the run's private workspace with the host's scrubbed environment. No sandbox
+      on the host (or an AbstractCore without one) = refused (`error` carries the sentence,
+      nothing runs). A host that configured AbstractCore's command policy refuses an unstamped
+      call. Library use without a host policy runs as before.
     - `timeout_s <= 0` (the default) means NO timeout (ADR-0027: no low default
       timeouts on correctness-critical paths — a 10s default silently killed
       legitimate long computations and reported them as errors). Pass a positive
@@ -48,7 +64,24 @@ def execute_python(code: str, timeout_s: float = 0.0, max_output_chars: int = 0)
 
     from ..sandbox.local import LocalSandbox
 
-    sandbox = LocalSandbox()
+    try:
+        from abstractcore.tools import sandbox as core_sandbox
+    except ImportError:
+        return {"stdout": "", "stderr": "", "exit_code": 126, "duration_ms": 0.0, "error": NO_CORE_SANDBOX, "success": False}
+    box = core_sandbox.sandbox_for_tool_call(_sandbox)
+    if box.refuses:
+        return {
+            "stdout": "",
+            "stderr": "",
+            "exit_code": 126,
+            "duration_ms": 0.0,
+            "error": box.refusal(),
+            "success": False,
+            "sandbox": box.describe(),
+            "sandbox_line": box.rendered_line(),
+        }
+    bound = box if (box.spec is not None or box.kind != core_sandbox.KIND_UNSANDBOXED) else None
+    sandbox = LocalSandbox(cwd=box.spec.private_workspace if box.spec is not None else None, command_sandbox=bound)
     #[WARNING:TIMEOUT] caller-supplied only; <= 0 = unlimited (ADR-0027)
     timeout = float(timeout_s)
     result = sandbox.execute(code, timeout_s=timeout if timeout > 0 else None)
@@ -56,11 +89,15 @@ def execute_python(code: str, timeout_s: float = 0.0, max_output_chars: int = 0)
         cap = int(max_output_chars)
     except (TypeError, ValueError):
         cap = 0
-    return {
+    out = {
         "stdout": _bound_output(result.stdout, max_chars=cap),
         "stderr": _bound_output(result.stderr, max_chars=cap),
         "exit_code": int(result.exit_code),
         "duration_ms": float(result.duration_ms),
         "error": result.error,
     }
+    if bound is not None:
+        out["sandbox"] = bound.describe()
+        out["sandbox_line"] = bound.rendered_line()
+    return out
 

{abstractagent-0.3.17 → abstractagent-0.3.19/src/abstractagent.egg-info}/PKG-INFO

@@ -1,17 +1,17 @@
 Metadata-Version: 2.4
 Name: abstractagent
-Version: 0.3.17
+Version: 0.3.19
 Summary: Agent implementations using AbstractRuntime and AbstractCore
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: abstractcore[tools]>=2.13.41
+Requires-Dist: abstractcore[tools]>=2.25.0
 Requires-Dist: abstractruntime>=0.7.0
 Provides-Extra: apple
-Requires-Dist: abstractcore[all-apple]>=2.13.41; extra == "apple"
+Requires-Dist: abstractcore[all-apple]>=2.25.0; extra == "apple"
 Requires-Dist: abstractruntime[apple]>=0.7.0; extra == "apple"
 Provides-Extra: gpu
-Requires-Dist: abstractcore[all-gpu]>=2.13.41; extra == "gpu"
+Requires-Dist: abstractcore[all-gpu]>=2.25.0; extra == "gpu"
 Requires-Dist: abstractruntime[gpu]>=0.7.0; extra == "gpu"
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"

{abstractagent-0.3.17 → abstractagent-0.3.19}/src/abstractagent.egg-info/SOURCES.txt

@@ -63,6 +63,7 @@ tests/test_codeact_logic.py
 tests/test_codeact_runtime_verifier_policy.py
 tests/test_delegate_session_route_composition.py
 tests/test_emit_inventory_drift.py
+tests/test_execute_python_sandbox.py
 tests/test_gated_remainder_wave_2026_07_14.py
 tests/test_generation_params_media_policies.py
 tests/test_history_monster_clamp.py
@@ -102,6 +103,7 @@ tests/test_react_phase_grant_boundary.py
 tests/test_react_planish_heuristic.py
 tests/test_react_prompt_prefix_stability.py
 tests/test_react_sight_lane_media_fold.py
+tests/test_react_tool_format_retry.py
 tests/test_react_turn_byte_stability.py
 tests/test_react_verifier_and_plan.py
 tests/test_react_visit_composition.py

{abstractagent-0.3.17 → abstractagent-0.3.19}/src/abstractagent.egg-info/requires.txt

@@ -1,15 +1,15 @@
-abstractcore[tools]>=2.13.41
+abstractcore[tools]>=2.25.0
 abstractruntime>=0.7.0
 
 [apple]
-abstractcore[all-apple]>=2.13.41
+abstractcore[all-apple]>=2.25.0
 abstractruntime[apple]>=0.7.0
 
 [dev]
 pytest>=7.0
 
 [gpu]
-abstractcore[all-gpu]>=2.13.41
+abstractcore[all-gpu]>=2.25.0
 abstractruntime[gpu]>=0.7.0
 
 [test]

abstractagent-0.3.19/tests/test_execute_python_sandbox.py

@@ -0,0 +1,121 @@
+"""Round 12: execute_python runs inside AbstractCore's OS command sandbox.
+
+Real macOS tests (sandbox-exec) with scratch folders and markers; the runtime path
+(AbstractRuntime stamps `_sandbox` on the CodeAct tool call) is exercised end to end."""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+import pytest
+
+from abstractcore.tools import sandbox as core_sandbox
+from abstractcore.tools.sandbox import SandboxRow, SandboxSpec
+
+from abstractagent.tools.code_execution import NO_CORE_SANDBOX, execute_python
+
+MARK = "R12-AGENT-REFUSED-MARKER"
+
+macos_only = pytest.mark.skipif(
+    sys.platform != "darwin" or not os.access(core_sandbox.SANDBOX_EXEC, os.X_OK),
+    reason="real sandbox test: this host is not macOS with /usr/bin/sandbox-exec (Linux backends are tested in abstractcore)",
+)
+
+
+@pytest.fixture(autouse=True)
+def _fresh_host():
+    core_sandbox._reset_host_for_tests()
+    yield
+    core_sandbox._reset_host_for_tests()
+
+
+@pytest.fixture
+def t(tmp_path, monkeypatch):
+    root = Path(os.path.realpath(tmp_path))
+    for d in ("home", "priv", "refused", "rw"):
+        (root / d).mkdir()
+    (root / "refused/secret.txt").write_text(MARK)
+    monkeypatch.setenv("HOME", str(root / "home"))
+    return root
+
+
+def _stamp(t: Path, refused=True):
+    return SandboxSpec(
+        private_workspace=str(t / "priv"),
+        posture="any_except_denied",
+        allowed=(SandboxRow(str(t / "rw"), "rw"),),
+        refused=(str(t / "refused"),) if refused else (),
+    ).to_stamp()
+
+
+def test_sandbox_arg_is_hidden_from_the_model():
+    assert "_sandbox" not in execute_python._tool_definition.parameters
+
+
+@macos_only
+def test_refused_path_is_unreadable_from_python(t):
+    code = f"print(open({str(t / 'refused/secret.txt')!r}).read())"
+    res = execute_python(code, _sandbox=_stamp(t))
+    assert MARK not in res["stdout"] and res["exit_code"] != 0
+    assert "Operation not permitted" in res["stderr"]
+    assert res["sandbox"]["kind"] == "macos-sandbox-exec" and res["sandbox_line"] == "Sandbox: macOS sandbox-exec"
+    ok = execute_python(code, _sandbox=_stamp(t, refused=False))
+    assert MARK in ok["stdout"]  # positive control
+
+
+@macos_only
+def test_starts_in_the_private_workspace_with_a_private_tmpdir(t):
+    res = execute_python("import os,tempfile;open('w.txt','w').write('x');print(os.getcwd());print(tempfile.gettempdir())", _sandbox=_stamp(t))
+    assert res["stdout"].split() == [str(t / "priv"), str(t / "priv/.tmp")]
+    assert (t / "priv/w.txt").exists()
+
+
+def test_fail_closed_without_a_sandbox(t, monkeypatch):
+    monkeypatch.setattr(core_sandbox, "host_sandbox_kind", lambda posture="allowed_only": core_sandbox.KIND_NONE)
+    res = execute_python(f"open({str(t / 'priv/ran')!r},'w')", _sandbox=_stamp(t))
+    assert res["success"] is False and res["error"].startswith("Commands are not sandboxed on this gateway host")
+    assert not (t / "priv/ran").exists()
+
+
+def test_fail_closed_without_core_sandbox_module(t, monkeypatch):
+    import abstractcore.tools as core_tools
+
+    monkeypatch.setitem(sys.modules, "abstractcore.tools.sandbox", None)
+    monkeypatch.delattr(core_tools, "sandbox", raising=False)
+    res = execute_python(f"open({str(t / 'priv/ran')!r},'w')", _sandbox=_stamp(t))
+    assert res["success"] is False and res["error"] == NO_CORE_SANDBOX
+    assert not (t / "priv/ran").exists()
+
+
+def test_configured_host_refuses_unstamped_call(t):
+    core_sandbox.configure_host(env={"PATH": "/usr/bin:/bin"})
+    res = execute_python(f"open({str(t / 'priv/ran')!r},'w')")
+    assert res["success"] is False and res["error"] == core_sandbox.REFUSED_NO_SPEC
+    assert not (t / "priv/ran").exists()
+
+
+@macos_only
+def test_codeact_tool_call_through_the_runtime_is_sandboxed(t):
+    """A CodeAct-style TOOL_CALLS effect: the runtime stamps the run's workspaces on
+    execute_python; reading a refused workspace fails inside the sandbox."""
+    from abstractruntime.core.models import Effect, EffectType, RunState
+    from abstractruntime.integrations.abstractcore.effect_handlers import make_tool_calls_handler
+    from abstractruntime.integrations.abstractcore.tool_executor import MappingToolExecutor
+
+    handler = make_tool_calls_handler(tools=MappingToolExecutor.from_tools([execute_python]))
+    run_vars = {
+        "workspace_root": str(t / "priv"),
+        "workspace_access_mode": "all_except_ignored",
+        "workspace_allowed_paths": [str(t / "rw")],
+        "workspace_ignored_paths": str(t / "refused"),
+    }
+    run = RunState.new(workflow_id="wf", entry_node="n", session_id="s", vars=run_vars)
+    code = f"print(open({str(t / 'refused/secret.txt')!r}).read())"
+    effect = Effect(type=EffectType.TOOL_CALLS, payload={"tool_calls": [{"call_id": "c1", "name": "execute_python", "arguments": {"code": code, "_sandbox": {"private_workspace": "/", "posture": "any_except_denied"}}}]})
+    outcome = handler(run, effect, None)
+    res = outcome.result["results"][0]
+    out = res["output"]
+    assert MARK not in str(out)
+    assert out["sandbox"]["kind"] == "macos-sandbox-exec" and out["sandbox"]["refused"] == [str(t / "refused")]

{abstractagent-0.3.17 → abstractagent-0.3.19}/tests/test_packaging_profiles.py

@@ -18,7 +18,7 @@ def _project() -> dict:
 def test_base_dependency_floors_match_gateway_alignment() -> None:
     deps = set(_project()["dependencies"])
 
-    assert "abstractcore[tools]>=2.13.41" in deps
+    assert "abstractcore[tools]>=2.25.0" in deps
     assert "abstractruntime>=0.7.0" in deps
 
 
@@ -26,11 +26,11 @@ def test_hardware_profile_extras_are_core_runtime_cascades() -> None:
     extras = _project()["optional-dependencies"]
 
     assert set(extras["apple"]) == {
-        "abstractcore[all-apple]>=2.13.41",
+        "abstractcore[all-apple]>=2.25.0",
         "abstractruntime[apple]>=0.7.0",
     }
     assert set(extras["gpu"]) == {
-        "abstractcore[all-gpu]>=2.13.41",
+        "abstractcore[all-gpu]>=2.25.0",
         "abstractruntime[gpu]>=0.7.0",
     }
     assert "all-apple" not in extras

abstractagent-0.3.19/tests/test_react_tool_format_retry.py

@@ -0,0 +1,106 @@
+from typing import Any
+
+import pytest
+
+from abstractagent.adapters.react_runtime import create_react_workflow
+from abstractagent.logic.react import ReActLogic
+from abstractcore.tools import ToolDefinition
+from abstractruntime.core.models import EffectType, RunStatus
+from abstractruntime.core.runtime import EffectOutcome, Runtime
+from abstractruntime.storage.in_memory import InMemoryLedgerStore, InMemoryRunStore
+
+
+@pytest.mark.parametrize("recover", [False, True])
+def test_format_repair_is_bounded_and_never_executes_rejected_calls(recover):
+    requests: list[dict[str, Any]] = []
+    executed = []
+
+    def llm(run, effect, next_node):
+        requests.append(effect.payload)
+        if len(requests) > 1:
+            assert "nothing was executed" in str(effect.payload["messages"])
+            # The repair names no text format of its own (a native tool-calling
+            # provider must never be taught a text syntax): it points at the
+            # request's own instructions and lists the roster.
+            assert "<tool_call>" not in str(effect.payload["messages"])
+            assert "format and argument schemas supplied in the instructions" in str(effect.payload["messages"])
+            assert "Use only the available tools: web_search." in str(effect.payload["messages"])
+        if recover and len(requests) == 2:
+            return EffectOutcome.completed({"content": "", "tool_calls": [{"name": "web_search", "arguments": {"query": "test"}, "call_id": "one"}]})
+        if recover and len(requests) == 3:
+            return EffectOutcome.completed({"content": "Found it."})
+        return EffectOutcome.completed({"content": "Broken tool block", "metadata": {
+            "tool_call_error": {"code": "invalid_tool_syntax", "available_tools": ["web_search"]}}})
+
+    def tool(run, effect, next_node):
+        executed.extend(effect.payload["tool_calls"])
+        return EffectOutcome.completed({"mode": "executed", "results": [{"name": "web_search", "call_id": "one", "success": True, "output": "found"}]})
+
+    runtime = Runtime(run_store=InMemoryRunStore(), ledger_store=InMemoryLedgerStore(),
+                      effect_handlers={EffectType.LLM_CALL: llm, EffectType.TOOL_CALLS: tool})
+    workflow = create_react_workflow(logic=ReActLogic(tools=[ToolDefinition(name="web_search", description="Search", parameters={"query": {"type": "string"}})]),
+                                    workflow_id="format-repair", provider="stub", model="stub", allowed_tools=["web_search"])
+    rid = runtime.start(workflow=workflow, vars={"context": {"task": "Search", "messages": []}, "_runtime": {"inbox": []}})
+    def drive():
+        for _ in range(80):
+            state = runtime.tick(workflow=workflow, run_id=rid, max_steps=1)
+            if state.status in (RunStatus.COMPLETED, RunStatus.FAILED):
+                return state
+    if recover:
+        assert drive().status == RunStatus.COMPLETED
+    else:
+        # GatewayRunner persists planning exceptions as FAILED (tick_exception).
+        with pytest.raises(RuntimeError, match="format repair failed"):
+            drive()
+    assert len(requests) == 3
+    assert len(executed) == (1 if recover else 0)
+
+
+def test_format_repair_budget_is_per_turn_in_a_composed_conversation():
+    """Two turns of one run (visit composition): each turn has two rejected formats and
+    still recovers. Without `reset_react_turn` clearing `tool_format_retries`, turn 2's
+    first rejection would raise at once (the budget was per conversation)."""
+    from abstractagent.adapters.react_runtime import reset_react_turn
+    from abstractruntime.core.models import StepPlan
+    from abstractruntime.core.spec import WorkflowSpec
+
+    bad = {"content": "Broken tool block", "metadata": {"tool_call_error": {"code": "invalid_tool_syntax", "available_tools": ["web_search"]}}}
+    script = [bad, bad, {"content": "Answer one."}, bad, bad, {"content": "Answer two."}]
+    calls = {"n": 0}
+    events: list[str] = []
+    answers: list[str] = []
+
+    def llm(run, effect, next_node):
+        i = calls["n"]
+        calls["n"] += 1
+        return EffectOutcome.completed(dict(script[min(i, len(script) - 1)]))
+
+    react = create_react_workflow(
+        logic=ReActLogic(tools=[ToolDefinition(name="web_search", description="Search", parameters={"query": {"type": "string"}})]),
+        workflow_id="format-repair-turns", provider="stub", model="stub", allowed_tools=["web_search"],
+        final_next_node="park", on_step=lambda step, data: events.append(step),
+    )
+
+    def park(run, ctx):
+        temp = run.vars.get("_temp") or {}
+        answers.append(str(temp.get("final_answer") or ""))
+        if len(answers) >= 2:
+            return StepPlan(node_id="park", complete_output={"turns": len(answers)})
+        reset_react_turn(run.vars)
+        run.vars["context"]["messages"].append({"role": "user", "content": "Second message"})
+        return StepPlan(node_id="park", next_node="reason")
+
+    nodes = dict(react.nodes)
+    nodes["park"] = park
+    workflow = WorkflowSpec(workflow_id=react.workflow_id, entry_node=react.entry_node, nodes=nodes)
+    runtime = Runtime(run_store=InMemoryRunStore(), ledger_store=InMemoryLedgerStore(), effect_handlers={EffectType.LLM_CALL: llm})
+    rid = runtime.start(workflow=workflow, vars={"context": {"task": "First message", "messages": []}, "_runtime": {"inbox": []}})
+    state = None
+    for _ in range(120):
+        state = runtime.tick(workflow=workflow, run_id=rid, max_steps=1)
+        if state.status in (RunStatus.COMPLETED, RunStatus.FAILED):
+            break
+    assert state is not None and state.status == RunStatus.COMPLETED, state
+    assert answers == ["Answer one.", "Answer two."]
+    assert events.count("parse_retry_tool_format") == 4
+    assert calls["n"] == 6