noah-code 0.2.4__tar.gz → 0.3.0__tar.gz

{noah_code-0.2.4 → noah_code-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: noah-code
-Version: 0.2.4
+Version: 0.3.0
 Summary: Noah Code terminal coding agent, built on NVIDIA OO Agents (NOOA)
 Project-URL: Homepage, https://github.com/skundu42/noah-code
 Project-URL: Documentation, https://github.com/skundu42/noah-code#readme
@@ -40,6 +40,7 @@ Provides-Extra: mcp
 Requires-Dist: nooa[mcp]==0.0.9; extra == 'mcp'
 Provides-Extra: tracing
 Requires-Dist: nooa[tracing]==0.0.9; extra == 'tracing'
+Requires-Dist: opentelemetry-exporter-otlp-proto-http<2.0.0,>=1.44.0; extra == 'tracing'
 Description-Content-Type: text/markdown
 
 <div align="center">

{noah_code-0.2.4 → noah_code-0.3.0}/docs/configuration.md

@@ -179,8 +179,19 @@ target_chars = 2500
 
 [tracing]
 enabled = true
-# By default JSONL traces live inside each session directory.
+# Local traces remain available without a collector.
+jsonl_enabled = true
 # jsonl_dir = "~/.local/share/noah-code/traces"
+# Send traces, metrics, and structured logs over OTLP/HTTP.
+# otlp_endpoint = "http://localhost:4318"
+logs_enabled = true
+metrics_enabled = true
+# Sensitive agent content is excluded unless explicitly opted in.
+capture_content = false
+max_span_attributes = 256
+max_attribute_length = 4096
+metric_export_interval_millis = 30000
+export_timeout_millis = 5000
 
 [updates]
 auto_install = false
@@ -199,6 +210,12 @@ Supported environment overrides include:
 - `NOAH_CODE_UNSAFE_INPROCESS`
 - `NOAH_CODE_AUTO_UPDATE`
 
+OpenTelemetry's standard environment variables are also honored. In particular,
+`OTEL_EXPORTER_OTLP_ENDPOINT` enables remote traces, metrics, and logs without storing an endpoint
+in Noah configuration. Signal-specific endpoint variables and `OTEL_EXPORTER_OTLP_HEADERS` are
+supported by the OTLP exporters; keep authentication headers in the environment or a collector
+secret store rather than TOML.
+
 Repository-controlled configuration cannot weaken the host trust boundary. Project config is
 ignored for `auto_approve`, `budget`, `efficiency`, `enabled_skills`, `hooks`, `lsp`, `mcp`,
 `permission_rules`, `processes`, `reliability`, `session_dir`, `tracing`, `updates`, and

{noah_code-0.2.4 → noah_code-0.3.0}/docs/extensions.md

@@ -149,8 +149,47 @@ local executables; define them only in `~/.config/noah-code/config.toml`.
 
 ## Tracing
 
-Noah Code integrates with NOOA tracing. Tracing is enabled by default, and JSONL output goes into
-the active session directory unless
-`tracing.jsonl_dir` selects another trusted location. Use `/trace` to inspect the destination and
-`/health` to inspect bounded runtime-event and artifact state. Trace files count toward the total
-session-storage quota when they use the default location.
+Noah Code emits OpenTelemetry traces for the complete agent invocation and NOOA/OpenInference child
+spans for model generations and tool execution. Local JSONL traces are enabled by default and go
+into the active session directory unless `tracing.jsonl_dir` selects another trusted location.
+Use `/trace` to inspect active destinations and `/health` to inspect bounded runtime-event and
+artifact state. Trace files count toward the session-storage quota when they use the default path.
+
+Set an OTLP/HTTP collector endpoint to additionally export batched traces, metrics, and structured
+logs:
+
+```toml
+[tracing]
+otlp_endpoint = "http://localhost:4318"
+logs_enabled = true
+metrics_enabled = true
+capture_content = false
+```
+
+Install the `tracing` extra when Noah was installed without the standard installer. Configured
+remote endpoints must use HTTPS; plain HTTP is accepted only for a loopback collector.
+
+Or use standard OpenTelemetry environment configuration:
+
+```bash
+export OTEL_EXPORTER_OTLP_ENDPOINT=https://collector.example.com
+export OTEL_EXPORTER_OTLP_HEADERS='authorization=Bearer%20...'
+```
+
+Operational telemetry includes agent/LLM/tool duration, token usage, cached and reasoning token
+counts, estimated cost, retries, outcomes, model/provider names, and trace-correlated lifecycle
+events. Metric labels deliberately exclude session IDs, run IDs, workspace paths, prompts, and tool
+targets to avoid high-cardinality series.
+
+Content capture is off by default. Prompt and response messages, reasoning, generated code, tool
+arguments/results, exception messages, stack traces, and file contents are removed at the exporter
+boundary. `capture_content = true` is intended only for controlled development environments; values
+and span attribute counts remain bounded, and NOOA's secret scrubber still runs before export. For
+production, keep content disabled and apply an allowlist/redaction processor in the collector as a
+second boundary.
+
+The emitted standard instruments include `gen_ai.invoke_agent.duration`,
+`gen_ai.client.operation.duration`, and `gen_ai.client.token.usage`. Noah-specific instruments cover
+estimated cost, retries, and tool execution counts/duration. Export is best-effort and batched;
+collector failure never blocks or fails an agent turn, and providers are flushed during orderly
+shutdown.

noah_code-0.3.0/docs/releases/v0.3.0.md

@@ -0,0 +1,75 @@
+# Noah Code v0.3.0
+
+This release adds production-grade OpenTelemetry observability, more control over long-running
+agents, and a broad hardening pass across permissions, updates, sessions, worktrees, language
+servers, and persisted tool state.
+
+## Observability
+
+- Added privacy-first OpenTelemetry support for the complete agent lifecycle, with OTLP/HTTP
+  export of traces, metrics, and structured logs alongside the existing local JSONL traces.
+- Added standard GenAI instruments for agent and model duration and token usage, plus Noah-specific
+  cost, retry, and tool-execution metrics with deliberately low-cardinality labels.
+- Content capture remains off by default. Exporters strip prompts, responses, reasoning, tool
+  arguments and results, exception details, host identity, and repository metadata unless content
+  capture is explicitly enabled; exported values and attribute counts remain bounded.
+- Added secure collector configuration through `[tracing]` and standard OpenTelemetry environment
+  variables. Remote collectors require HTTPS, while plain HTTP remains available for loopback
+  development collectors.
+
+## Agent controls and permissions
+
+- Added `--max-iterations` and `NOAH_CODE_MAX_ITERATIONS` so larger or slower models can be given a
+  higher per-request tool-call budget than the default of 40.
+- Added an explicit `--yolo` mode and matching configuration option for fully unrestricted local
+  operation. This bypasses every permission check, including secret, plan-mode, and destructive
+  command protections, and should only be used in an appropriately isolated environment.
+- Added `run(..., read_only=True)` for trusted execution of whitelisted inspection commands inside
+  the sandbox.
+- Read-only pipelines such as `git show | sed` and `rg | sort | wc` are now recognized when every
+  segment is independently read-only. Stream discards to `/dev/null` are also accepted without
+  weakening protections for file redirection or control-flow chains.
+- Repaired disk-destruction deny rules so raw device writes are rejected correctly, and placed
+  ordinary `dd` use on the elevated-risk approval floor.
+- Closed a concurrent approval race that could show duplicate prompts or miss a newly registered
+  session rule.
+
+## Reliability and correctness
+
+- Hardened language-server lifecycle management against timeout races, dead readers, failed
+  startup, and zombie processes; stale servers are now terminated and reaped before restart.
+- Host shutdown now completes all teardown steps even under cancellation, and session switches
+  validate their targets before releasing the active session.
+- Damaged session metadata and partially corrupted undo/redo journals now degrade to clear recovery
+  errors or skip only the affected records instead of crashing startup.
+- Managed tool output is published atomically by content hash, with clean recovery from disk-full
+  and concurrent-writer races.
+- Durable background-process log rotation now preserves the latest output line even when the final
+  pipe read contains only a small trailing fragment.
+- Auto-update state paths, network reads, and version parsing are hardened, and a stale-aware lock
+  prevents concurrent processes from running duplicate upgrades.
+- Orphaned worktrees whose directories were removed outside Noah can now be pruned and cleaned up.
+- Git and GitHub helpers now turn missing binaries, timeouts, authentication failures, and network
+  failures into actionable user-facing errors.
+- Fixed question timeout and background-process stdin races, bounded HTTP 429 retries using
+  `Retry-After`, and excluded skipped HTML blocks such as `noscript` from fetched page text.
+- Non-finite cost and token reports can no longer disable budget enforcement or crash accounting.
+
+## Agent guidance and tests
+
+- Refined the model-facing tool guidance for synchronous messages, `return_result`, safe read-only
+  execution, forbidden imports, edit arguments, and iteration-limit recovery to avoid wasted turns.
+- Expanded coverage across permissions, web transport, updates, snapshots, tool output, worktrees,
+  process jobs, Git, GitHub, sessions, LSP lifecycle, budgets, and host teardown.
+
+## Upgrade
+
+Existing managed installations can run:
+
+```bash
+noah update
+```
+
+New installations can use the one-command installer from the README.
+
+**Full changelog:** https://github.com/skundu42/noah-code/compare/v0.2.4...v0.3.0

{noah_code-0.2.4 → noah_code-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "noah-code"
-version = "0.2.4"
+version = "0.3.0"
 description = "Noah Code terminal coding agent, built on NVIDIA OO Agents (NOOA)"
 readme = "README.md"
 requires-python = ">=3.12,<3.14"
@@ -57,6 +57,7 @@ mcp = [
 ]
 tracing = [
     "nooa[tracing]==0.0.9",
+    "opentelemetry-exporter-otlp-proto-http>=1.44.0,<2.0.0",
 ]
 
 [project.scripts]

{noah_code-0.2.4 → noah_code-0.3.0}/src/noah_code/__init__.py

@@ -1,3 +1,3 @@
 """Noah Code: terminal coding agent on NVIDIA OO Agents."""
 
-__version__ = "0.2.4"
+__version__ = "0.3.0"

{noah_code-0.2.4 → noah_code-0.3.0}/src/noah_code/agent.py

@@ -124,6 +124,7 @@ class _PermissionSandboxedExecutor(SandboxedExecutor):
             ("ws", "read_output"),
             ("ws", "replace"),
             ("ws", "run"),
+            ("ws", "run_trusted_readonly"),
             ("ws", "search"),
             ("ws", "write"),
             ("ws", "write_file"),
@@ -469,6 +470,7 @@ class CodingAgent(InteractiveAgent):
             config.permission_rules,
             mode=config.mode,
             auto_approve=config.auto_approve,
+            yolo=config.yolo,
         )
         self._engine.mode = config.mode
         self._approvals = approvals or ApprovalBroker(
@@ -859,6 +861,11 @@ class CodingAgent(InteractiveAgent):
         in the notification. Understand the requested end state before acting.
         Conversational questions are first-class: answer them with
         ``self.message(...)`` then return DONE. Do not emit bare assistant prose.
+        IMPORTANT: ``self.message(...)`` is SYNCHRONOUS — call it WITHOUT
+        ``await`` (``self.message("...")``). Prefixing ``await`` raises
+        ``TypeError: object NoneType can't be used in 'await' expression``
+        because it returns ``None``. All ``self.ws.*``, ``self.web.*``,
+        ``self.lsp.*``, ``self.processes.*`` calls ARE async and need ``await``.
 
         Minimal tool cookbook:
         - ``await self.ws.list("**/*.py")`` lists files.
@@ -866,7 +873,10 @@ class CodingAgent(InteractiveAgent):
         - ``match = await self.ws.read("path.py", lines=(10, 30))`` returns an
           editable Match; ``await self.ws.replace(match, "replacement")`` edits it.
         - ``await self.ws.edit("path.py", "unique old text", "new text")`` is the
-          simple string-edit form. ``await self.ws.write("new.py", content)`` creates files.
+          simple string-edit form and takes exactly three arguments (path, old,
+          new); two-argument calls are invalid. For a Match from read(), edit
+          with ``await self.ws.replace(match, "replacement")`` instead.
+          ``await self.ws.write("new.py", content)`` creates files.
         - Prefer ``await self.ws.apply_patch(changes)`` for coherent edits. Each change is
           ``{"path": ..., "old": exact_text_or_None, "new": replacement_or_None}``;
           one call validates and atomically commits the full batch.
@@ -878,6 +888,19 @@ class CodingAgent(InteractiveAgent):
           long-running commands. Consume logs by cursor; do not poll without new work.
         - ``result = await self.ws.run("pytest -q")`` runs validation; inspect
           ``result.returncode``, ``result.stdout``, and ``result.stderr``.
+          ``read_only=True`` skips approval ONLY for commands the engine
+          recognizes as read-only (``git status/log/diff/show``, ``rg``,
+          ``grep``, ``ls``, ``find`` (no -delete/-exec), ``head``, ``tail``,
+          ``wc``, ``sed``, ``awk``, ``sort``, ``uniq``, ``cut``, ``tr``,
+          ``tac``, ``column``, ``pwd``, ``file``, ``stat``, ``test``). It is
+          REJECTED for anything else — including ``pytest``, ``uv``, ``python``,
+          and build commands — so do NOT pass ``read_only=True`` for those; run
+          them with plain ``await self.ws.run(cmd)`` (YOLO auto-approves;
+          ``--auto`` prompts).
+        - If the host was launched with ``--yolo``, every approval is granted
+          automatically without prompting. That mode exists for throwaway or
+          sandboxed environments only; do not assume it is active — write code
+          that works under normal permission gating.
         - ``await self.web.fetch(url)`` reads a page; ``await self.web.search(query)``
           searches the public web. Both are read-only and allowed by default.
         - ``await self.github.list()`` / ``view(number)`` inspect pull requests.
@@ -919,10 +942,28 @@ class CodingAgent(InteractiveAgent):
           or mutating ``gh pr`` through the shell.
         - Do not read secrets or expose sensitive environment values.
 
+        Forbidden inside sandboxed code cells (do NOT attempt - they always fail
+        and burn turns): ``import os``, ``import sys``, ``import subprocess``,
+        ``import shutil``, ``import nooa``, ``import noah_code``, and any of
+        ``eval()``, ``exec()``, ``compile()``, ``__import__()``. If you need to
+        run shell logic or a host feature, do it with ``self.ws.run(...)``
+        (read-only shell is auto-approved), ``self.web``, ``self.lsp``, or the
+        dedicated tools - never by importing a blocked module. Use
+        ``self.ws.inspect(...)`` on Python data; do not try to reach host
+        objects from a cell.
+
         Return exactly one valid RespondResult:
         - DONE - request complete
         - NEED_INPUT - user input genuinely required
         - WAIT - a registered background job is still running
+
+        To end the turn, call ``return_result(RespondReason.DONE,
+        explanation="...")`` — ``return_result`` takes a ``RespondReason``
+        and an ``explanation`` string, NEVER a bare string as ``result=``
+        (that raises ``return_result validation error: 'result' has wrong
+        type``). To show the user text, call the synchronous
+        ``self.message("...")`` first (no ``await``), then
+        ``return_result(RespondReason.DONE, explanation="summary")``.
         """
         ...
 

{noah_code-0.2.4 → noah_code-0.3.0}/src/noah_code/approvals.py

@@ -85,15 +85,6 @@ class ApprovalBroker:
             raise PermissionError(
                 f"rejected [{decision.category}] {decision.target}: {decision.reason}"
             )
-        if choice == ApprovalChoice.SESSION:
-            self._engine.add_session_rule(
-                PermissionRule(
-                    category=decision.category,
-                    pattern=decision.remember_pattern,
-                    action="allow",
-                    reason="remembered for session",
-                )
-            )
 
     async def _ask(self, decision: PermissionDecision) -> ApprovalChoice:
         req_id = str(uuid.uuid4())
@@ -128,7 +119,28 @@ class ApprovalBroker:
             async def _resolve() -> None:
                 try:
                     async with self._ui_lock:
-                        choice = await handler(request)
+                        # A concurrent twin of this request may have just been
+                        # granted a session-wide allow. Re-check before putting
+                        # a second identical prompt in front of the user, and
+                        # register new session rules inside the same critical
+                        # section so queued twins observe them immediately.
+                        fresh = self._engine.decide(decision.category, decision.target)
+                        if fresh.allowed:
+                            choice = ApprovalChoice.ONCE
+                        else:
+                            choice = await handler(request)
+                            if (
+                                choice == ApprovalChoice.SESSION
+                                and not fut.done()
+                            ):
+                                self._engine.add_session_rule(
+                                    PermissionRule(
+                                        category=decision.category,
+                                        pattern=decision.remember_pattern,
+                                        action="allow",
+                                        reason="remembered for session",
+                                    )
+                                )
                 except Exception as exc:
                     if not fut.done():
                         fut.set_exception(exc)

{noah_code-0.2.4 → noah_code-0.3.0}/src/noah_code/budget.py

@@ -14,6 +14,7 @@ Enforcement points:
 from __future__ import annotations
 
 import asyncio
+import math
 import threading
 import time
 from typing import Any
@@ -25,6 +26,30 @@ class BudgetExceeded(RuntimeError):
     """Raised when a configured session cap would be exceeded."""
 
 
+def _sanitize_tokens(value: Any) -> int:
+    """Garbage-proof a token count; providers occasionally report NaN/inf."""
+
+    try:
+        number = float(value)
+    except (TypeError, ValueError):
+        return 0
+    if not math.isfinite(number):
+        return 0
+    return max(int(number), 0)
+
+
+def _sanitize_cost(value: Any) -> float:
+    """Drop NaN/garbage cost, keep +inf so a broken pricing feed fails closed."""
+
+    try:
+        number = float(value)
+    except (TypeError, ValueError):
+        return 0.0
+    if math.isnan(number):
+        return 0.0
+    return max(number, 0.0)
+
+
 class BudgetGuard:
     """Thread-safe accumulator against optional token/cost/wall-clock caps."""
 
@@ -66,9 +91,9 @@ class BudgetGuard:
         cost_usd: float = 0.0,
     ) -> None:
         with self._lock:
-            self._prompt_tokens += max(int(prompt_tokens), 0)
-            self._completion_tokens += max(int(completion_tokens), 0)
-            self._cost_usd += max(float(cost_usd), 0.0)
+            self._prompt_tokens += _sanitize_tokens(prompt_tokens)
+            self._completion_tokens += _sanitize_tokens(completion_tokens)
+            self._cost_usd += _sanitize_cost(cost_usd)
 
     def enforce(self) -> None:
         """Raise BudgetExceeded when any configured cap is breached."""
@@ -92,7 +117,7 @@ class BudgetGuard:
         """
 
         with self._lock:
-            self._cost_usd = max(self._cost_usd, max(float(total_cost_usd), 0.0))
+            self._cost_usd = max(self._cost_usd, _sanitize_cost(total_cost_usd))
         self.enforce()
 
     def observe_cost_usd(self, total_cost_usd: float) -> None:
@@ -104,7 +129,7 @@ class BudgetGuard:
         """
 
         with self._lock:
-            self._cost_usd = max(self._cost_usd, max(float(total_cost_usd), 0.0))
+            self._cost_usd = max(self._cost_usd, _sanitize_cost(total_cost_usd))
             if self.exceeded is None:
                 self.exceeded = self._breach()
 
@@ -143,9 +168,9 @@ class BudgetGuard:
         if not data:
             return
         with self._lock:
-            self._prompt_tokens = max(int(data.get("prompt_tokens", 0)), 0)
-            self._completion_tokens = max(int(data.get("completion_tokens", 0)), 0)
-            self._cost_usd = max(float(data.get("cost_usd", 0.0)), 0.0)
+            self._prompt_tokens = _sanitize_tokens(data.get("prompt_tokens", 0))
+            self._completion_tokens = _sanitize_tokens(data.get("completion_tokens", 0))
+            self._cost_usd = _sanitize_cost(data.get("cost_usd", 0.0))
             started_at = float(data.get("started_at", time.time()))
             self._started_wall = min(started_at, time.time())
             elapsed = max(time.time() - self._started_wall, 0.0)
@@ -176,7 +201,7 @@ def _cost_from_response(response: Any, usage: dict[str, Any]) -> float:
             import litellm
 
             cost = litellm.completion_cost(completion_response=raw)
-        return max(float(cost or 0.0), 0.0)
+        return _sanitize_cost(cost)
     except Exception:  # noqa: BLE001 - pricing must never break a turn
         return 0.0
 
@@ -192,12 +217,19 @@ def _usage_from_response(response: Any) -> tuple[int, int, float]:
 
     usage = getattr(response, "usage", None)
     usage_dict = usage if isinstance(usage, dict) else {}
-    prompt = int(usage_dict.get("prompt_tokens") or usage_dict.get("input_tokens") or 0)
-    completion = int(usage_dict.get("completion_tokens") or usage_dict.get("output_tokens") or 0)
+    prompt = _sanitize_tokens(usage_dict.get("prompt_tokens") or usage_dict.get("input_tokens"))
+    completion = _sanitize_tokens(
+        usage_dict.get("completion_tokens") or usage_dict.get("output_tokens")
+    )
     cost = _cost_from_response(response, usage_dict)
     try:
         if isinstance(usage, dict):
-            usage.setdefault("cost_usd", cost)
+            existing = usage.get("cost_usd")
+            if existing is None or not math.isfinite(float(existing)):
+                # Never leave provider-reported NaN/inf on the telemetry seam.
+                usage["cost_usd"] = cost
+            else:
+                usage.setdefault("cost_usd", cost)
         elif cost > 0.0:
             response.usage = {"cost_usd": cost}
     except Exception:  # noqa: BLE001 - telemetry must never break a turn

{noah_code-0.2.4 → noah_code-0.3.0}/src/noah_code/cli.py

@@ -79,6 +79,11 @@ def _common_options(fn):  # noqa: ANN001
         is_flag=True,
         help="Auto-approve routine asks (never overrides deny or elevated-risk approval)",
     )(fn)
+    fn = click.option(
+        "--yolo",
+        is_flag=True,
+        help="Skip all approvals and permission checks (dangerous; for isolated/throwaway environments)",
+    )(fn)
     fn = click.option("--model", "model", default=None, help="Override the model for this launch")(
         fn
     )
@@ -88,6 +93,13 @@ def _common_options(fn):  # noqa: ANN001
         default=None,
         help="Reasoning effort for compatible models; default lets the provider decide",
     )(fn)
+    fn = click.option(
+        "--max-iterations",
+        "max_iterations",
+        type=click.IntRange(min=1),
+        default=None,
+        help="Cap model tool-call turns per user request (default 40; budgets still brake)",
+    )(fn)
     return fn
 
 
@@ -151,7 +163,9 @@ def interactive_cmd(
     model: str | None,
     reasoning_effort: str | None,
     auto: bool,
+    yolo: bool,
     mode: str | None,
+    max_iterations: int | None,
     continue_session: bool,
     session_id: str | None,
     use_console: bool,
@@ -169,9 +183,11 @@ def interactive_cmd(
             model=model,
             reasoning_effort=reasoning_effort,
             auto=auto,
+            yolo=yolo,
+            mode=mode,
+            max_iterations=max_iterations,
             continue_session=continue_session,
             session_id=session_id,
-            mode=mode,
             use_console=use_console,
             unsafe_inprocess_code_execution=unsafe_inprocess_code_execution,
         )
@@ -196,7 +212,9 @@ def run_cmd(
     model: str | None,
     reasoning_effort: str | None,
     auto: bool,
+    yolo: bool,
     mode: str | None,
+    max_iterations: int | None,
     session_id: str | None,
     unsafe_inprocess_code_execution: bool,
 ) -> None:
@@ -208,7 +226,9 @@ def run_cmd(
             model=model,
             reasoning_effort=reasoning_effort,
             auto=auto,
+            yolo=yolo,
             mode=mode,
+            max_iterations=max_iterations,
             session_id=session_id,
             unsafe_inprocess_code_execution=unsafe_inprocess_code_execution,
         )
@@ -793,7 +813,9 @@ async def _prepare(
     model: str | None,
     reasoning_effort: str | None,
     auto: bool,
+    yolo: bool,
     mode: str | None,
+    max_iterations: int | None = None,
     continue_session: bool = False,
     session_id: str | None = None,
     frontend: Literal["tui", "console"] | None = None,
@@ -813,6 +835,10 @@ async def _prepare(
         overrides["reasoning_effort"] = reasoning_effort
     if auto:
         overrides["auto_approve"] = True
+    if yolo:
+        overrides["yolo"] = True
+    if max_iterations is not None:
+        overrides["max_iterations"] = max_iterations
     if mode:
         overrides["mode"] = mode
     if frontend is not None:
@@ -859,9 +885,11 @@ async def _interactive(
     model: str | None,
     reasoning_effort: str | None,
     auto: bool,
+    yolo: bool,
+    mode: str | None,
+    max_iterations: int | None,
     continue_session: bool,
     session_id: str | None,
-    mode: str | None,
     use_console: bool,
     unsafe_inprocess_code_execution: bool,
 ) -> int:
@@ -882,7 +910,9 @@ async def _interactive(
         model=model,
         reasoning_effort=reasoning_effort,
         auto=auto,
+        yolo=yolo,
         mode=mode,
+        max_iterations=max_iterations,
         continue_session=continue_session,
         session_id=session_id,
         frontend=frontend,
@@ -906,7 +936,9 @@ async def _interactive(
             model=model,
             reasoning_effort=reasoning_effort,
             auto=auto,
+            yolo=yolo,
             mode=mode,
+            max_iterations=max_iterations,
             continue_session=continue_session,
             session_id=session_id,
             frontend=frontend,
@@ -925,12 +957,17 @@ async def _interactive(
             and config.model == NoahCodeConfig().model
         )
         try:
-            return await host.run_tui(onboarding_required=onboarding_required)
-        except RuntimeError as exc:
-            click.echo(f"error: {exc}", err=True)
-            return EXIT_CONFIG
-        except KeyboardInterrupt:
-            return EXIT_SIGINT
+            try:
+                return await host.run_tui(onboarding_required=onboarding_required)
+            except RuntimeError as exc:
+                click.echo(f"error: {exc}", err=True)
+                return EXIT_CONFIG
+            except KeyboardInterrupt:
+                return EXIT_SIGINT
+        finally:
+            # run_tui closes itself, but an import failure or a close that was
+            # cut short by cancellation must not leak leases, storage, or tools.
+            await host.close()
     host = AgentHost(
         workspace,
         config,
@@ -939,9 +976,12 @@ async def _interactive(
         ui=ConsoleUI(markdown=config.ui.markdown),
     )
     try:
-        return await host.run_interactive()
-    except KeyboardInterrupt:
-        return EXIT_SIGINT
+        try:
+            return await host.run_interactive()
+        except KeyboardInterrupt:
+            return EXIT_SIGINT
+    finally:
+        await host.close()
 
 
 async def _run_session(
@@ -951,7 +991,9 @@ async def _run_session(
     model: str | None,
     reasoning_effort: str | None,
     auto: bool,
+    yolo: bool,
     mode: str | None,
+    max_iterations: int | None,
     session_id: str | None,
     unsafe_inprocess_code_execution: bool,
 ) -> int:
@@ -962,7 +1004,9 @@ async def _run_session(
         model=model,
         reasoning_effort=reasoning_effort,
         auto=auto,
+        yolo=yolo,
         mode=mode,
+        max_iterations=max_iterations,
         session_id=session_id,
         frontend="console",
         unsafe_inprocess_code_execution=unsafe_inprocess_code_execution,