paimon 0.2.3__tar.gz → 0.2.4__tar.gz

{paimon-0.2.3/paimon.egg-info → paimon-0.2.4}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: paimon
-Version: 0.2.3
+Version: 0.2.4
 Summary: A minimal code agent built on pydantic-ai + textual
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: pydantic-ai-slim[anthropic,openai]>=2.17.0
+Requires-Dist: pydantic-ai-slim[anthropic,openai]>=2.31.0
 Requires-Dist: textual>=8.2.7
 Requires-Dist: textual-serve>=1.1.3
 Dynamic: license-file
@@ -110,3 +110,7 @@ paimon --profile work               # a separately configured account
 Each profile keeps its model settings in `~/.config/paimon/<name>/config.json`, written by the first launch or by `paimon login`. Sessions live in `~/.local/share/paimon/sessions/`. File changes render nicer if [delta](https://github.com/dandavison/delta) is installed.
 
 Read and edit modes run a small set of clearly read-only commands (`ls`, `cat`, `git status`, …) without asking; `--strict` turns that off. **This is a guardrail against agent mistakes, not a security boundary.** For real isolation, run Paimon inside a container or VM.
+
+## Telemetry
+
+Each launch sends one anonymous event to Google Analytics: a random install id, the launch mode, the version, the OS name and the configured provider and model name. Nothing from your sessions, prompts, files or credentials is included. Set `PAIMON_NO_TELEMETRY=1` or `DO_NOT_TRACK=1` to turn it off.

{paimon-0.2.3 → paimon-0.2.4}/README.md

@@ -98,3 +98,7 @@ paimon --profile work               # a separately configured account
 Each profile keeps its model settings in `~/.config/paimon/<name>/config.json`, written by the first launch or by `paimon login`. Sessions live in `~/.local/share/paimon/sessions/`. File changes render nicer if [delta](https://github.com/dandavison/delta) is installed.
 
 Read and edit modes run a small set of clearly read-only commands (`ls`, `cat`, `git status`, …) without asking; `--strict` turns that off. **This is a guardrail against agent mistakes, not a security boundary.** For real isolation, run Paimon inside a container or VM.
+
+## Telemetry
+
+Each launch sends one anonymous event to Google Analytics: a random install id, the launch mode, the version, the OS name and the configured provider and model name. Nothing from your sessions, prompts, files or credentials is included. Set `PAIMON_NO_TELEMETRY=1` or `DO_NOT_TRACK=1` to turn it off.

{paimon-0.2.3 → paimon-0.2.4}/README.zh-CN.md

@@ -98,3 +98,7 @@ paimon --profile work               # 单独配置的另一个账号
 每个 profile 的模型设置保存在 `~/.config/paimon/<name>/config.json`，由首次启动或 `paimon login` 写入。会话存放在 `~/.local/share/paimon/sessions/`。安装 [delta](https://github.com/dandavison/delta) 后文件改动的展示效果更好。
 
 read 和 edit 模式会不经询问执行一小组明确只读的命令（`ls`、`cat`、`git status` 等），`--strict` 可以关掉。**这是防止 agent 失误的护栏，不是安全边界。** 需要真正的隔离时，请在容器或虚拟机中运行 Paimon。
+
+## 遥测
+
+每次启动会向 Google Analytics 发送一条匿名事件：随机生成的安装 id、启动方式、版本号、操作系统名称，以及配置的 provider 和模型名。会话、提示词、文件和密钥一概不上报。设置 `PAIMON_NO_TELEMETRY=1` 或 `DO_NOT_TRACK=1` 可以关闭。

{paimon-0.2.3 → paimon-0.2.4}/paimon/agent.py

@@ -107,6 +107,15 @@ class RequestStats:
     cache_write_tokens: int = 0
 
 
+@dataclass
+class ToolBudgetExhausted:
+    """The turn hit its tool-call budget: the remaining calls were refused
+    with an explicit result and the turn ends without another model request.
+    """
+
+    limit: int
+
+
 @dataclass
 class TurnEnd:
     pass
@@ -161,9 +170,9 @@ class AgentsNotice:
 # on isinstance; the alias exists so a type checker can flag an unhandled one.
 AgentEvent = (
     TextDelta | ReasoningDelta | ToolStart | ToolEnd | TodosUpdate
-    | SessionHandoff | RequestStats | TurnEnd | ContextCompacted
-    | ContextCompactionFailed | ModelRetry | UserInput | CompactionNotice
-    | AgentsNotice
+    | SessionHandoff | RequestStats | ToolBudgetExhausted | TurnEnd
+    | ContextCompacted | ContextCompactionFailed | ModelRetry | UserInput
+    | CompactionNotice | AgentsNotice
 )
 
 
@@ -184,12 +193,14 @@ def replay_events(messages: list[ModelMessage]) -> list[AgentEvent]:
     """Persisted messages replayed as the events a live ``Agent.run`` yields.
 
     Lets a UI render resumed history through the same code path as live turns.
+    Tools run serially, so each call replays as its ToolStart immediately
+    followed by its ToolEnd (looked up in the next request), matching the live
+    order — not all starts of a batch first. The persisted ``outcome`` field
+    restores denied styling.
     """
     events: list[AgentEvent] = []
-    # write_todos calls whose arguments never made a todo update: they were
-    # rejected live as a normal tool error, so they replay as one.
-    rejected_todos: set[str] = set()
-    for message in messages:
+    consumed: set[str] = set()  # tool returns already replayed with their call
+    for index, message in enumerate(messages):
         if is_summary_message(message):
             events.append(CompactionNotice())
             continue
@@ -200,11 +211,20 @@ def replay_events(messages: list[ModelMessage]) -> list[AgentEvent]:
             for part in message.parts:
                 if isinstance(part, UserPromptPart) and isinstance(part.content, str) and part.content:
                     events.append(UserInput(part.content))
-                elif isinstance(part, ToolReturnPart) and (part.tool_name != "write_todos"
-                                                           or part.tool_call_id in rejected_todos):
+                elif (isinstance(part, ToolReturnPart)
+                      and part.tool_call_id not in consumed
+                      and part.tool_name != "write_todos"):
+                    # A return whose call is gone (compaction cut mid-turn):
+                    # better an unpaired result than a silent hole.
                     events.append(ToolEnd(part.tool_call_id, part.tool_name,
-                                          str(part.content or "(no output)")))
+                                          str(part.content or "(no output)"),
+                                          denied=part.outcome == "denied"))
         elif isinstance(message, ModelResponse):
+            following = messages[index + 1] if index + 1 < len(messages) else None
+            returns: dict[str, ToolReturnPart] = {}
+            if isinstance(following, ModelRequest):
+                returns = {part.tool_call_id: part for part in following.parts
+                           if isinstance(part, ToolReturnPart)}
             for part in message.parts:
                 if isinstance(part, ThinkingPart) and part.content:
                     events.append(ReasoningDelta(part.content))
@@ -212,23 +232,37 @@ def replay_events(messages: list[ModelMessage]) -> list[AgentEvent]:
                     events.append(TextDelta(part.content))
                 elif isinstance(part, ToolCallPart):
                     args = _parse_args(part.args)
-                    todos = (tools.normalize_todos(args.get("todos"))
-                             if part.tool_name == "write_todos" else None)
-                    if todos is not None:
-                        events.append(TodosUpdate(todos))
-                    else:
-                        if part.tool_name == "write_todos":
-                            rejected_todos.add(part.tool_call_id)
-                        events.append(ToolStart(part.tool_call_id, part.tool_name, args))
+                    result = returns.get(part.tool_call_id)
+                    if result is not None:
+                        consumed.add(part.tool_call_id)
+                    if part.tool_name == "write_todos":
+                        todos = tools.normalize_todos(args.get("todos"))
+                        # Live, a write_todos that actually ran yields only a
+                        # TodosUpdate; one that was rejected or never executed
+                        # yields a normal failed call.
+                        if todos is not None and (result is None or result.outcome == "success"):
+                            events.append(TodosUpdate(todos))
+                            continue
+                    events.append(ToolStart(part.tool_call_id, part.tool_name, args))
+                    if result is not None:
+                        events.append(ToolEnd(part.tool_call_id, part.tool_name,
+                                              str(result.content or "(no output)"),
+                                              denied=result.outcome == "denied"))
     return events
 
 
 def _strip_foreign_thinking(history: list[ModelMessage], model: Model) -> list[ModelMessage]:
-    """Drop thinking parts produced by a different provider/model.
+    """Adapt thinking parts produced by a different provider/model.
 
     Preserved thinking is only valid replayed verbatim to the model that
-    produced it; other endpoints may reject or misread it (cf. pi's
-    transformMessages: same model keeps thinking, a changed model strips it).
+    produced it, so a foreign message's readable thinking is converted to a
+    plain text block — the rationale it carries is still context — while its
+    signatures and encrypted/redacted payloads are dropped, never sent to a
+    provider that did not produce them (cf. pi's transformMessages, which
+    converts rather than deletes readable thinking).
+
+    Only the request being built is touched; the persisted history keeps the
+    original parts.
     """
     current = (model.system, model.model_name)
     sanitized: list[ModelMessage] = []
@@ -236,9 +270,16 @@ def _strip_foreign_thinking(history: list[ModelMessage], model: Model) -> list[M
         if (isinstance(message, ModelResponse)
                 and (message.provider_name, message.model_name) != current
                 and any(isinstance(part, ThinkingPart) for part in message.parts)):
-            message = dataclasses.replace(
-                message, parts=[part for part in message.parts if not isinstance(part, ThinkingPart)]
-            )
+            parts = []
+            for part in message.parts:
+                if not isinstance(part, ThinkingPart):
+                    parts.append(part)
+                elif part.content:
+                    parts.append(TextPart(content=f"<thinking>\n{part.content}\n</thinking>"))
+                # else: encrypted or redacted thinking with nothing readable
+            if not parts:
+                continue  # nothing a different provider can use
+            message = dataclasses.replace(message, parts=parts)
         sanitized.append(message)
     return sanitized
 
@@ -289,8 +330,9 @@ class Agent:
         # None where nobody can type while a turn runs (headless, tests).
         self.pending: Optional[PendingFn] = None
         # Per-agent tool state, kept off the tool functions so one agent's
-        # shell overflow files stay invisible to the next one.
-        self.tool_context = tools.ToolContext()
+        # shell overflow files stay invisible to the next one. The session
+        # rides along for the history tools.
+        self.tool_context = tools.ToolContext(session=session)
         self.todos: list[dict] = []
         self.session = session
         self.system_prompt = system_prompt
@@ -300,6 +342,12 @@ class Agent:
         self.tool_schemas = tools.schemas(self.toolset)
         self._tool_definitions = tools.definitions(self.toolset)
         self._cached_model: Optional[tuple[tuple, Model]] = None
+        # (history length, provider-reported tokens) after the last completed
+        # request: the authoritative context size at that point, used by
+        # count_context_tokens so the chars/4 heuristic only covers what was
+        # appended since. None until a request reports usage, and again after
+        # compaction reshapes the history.
+        self._usage_anchor: Optional[tuple[int, int]] = None
 
     @classmethod
     def open(cls, cwd: Optional[Path] = None, *, session: Optional[Session] = None,
@@ -313,7 +361,12 @@ class Agent:
 
         ``append_system_prompt`` is added to the end of a new session's system
         prompt and persisted with it, so a resumed session keeps it. Resuming
-        with it set raises ``ValueError``: the persisted prompt is immutable.
+        with it set raises ``ValueError``: the persisted role is immutable.
+        The dynamic parts of the prompt (date, environment, AGENTS.md) are
+        rebuilt on resume — a session picked up months later must not keep
+        telling the model the old date or stale project rules — and when they
+        changed, the rebuilt snapshot is appended to the log, so it always
+        records the prompt each turn actually ran with.
         ``parent`` marks the new session as a subagent's, which keeps it out of
         the session listings its parent shows up in.
 
@@ -334,14 +387,21 @@ class Agent:
         # Agent is returned to unlock it, so the lock is released here.
         try:
             if is_new:
+                appended = append_system_prompt.strip() if append_system_prompt else None
                 system_prompt = build_system_prompt(cwd)
-                if append_system_prompt:
-                    system_prompt += f"\n\n{append_system_prompt.strip()}"
-                session.append_system_prompt(system_prompt)
+                if appended:
+                    system_prompt += f"\n\n{appended}"
+                session.append_system_prompt(system_prompt, appended=appended)
             else:
-                system_prompt = session.system_prompt()
-                if system_prompt is None:
+                session.require_supported_format()
+                stored, appended = session.system_prompt_parts()
+                if stored is None:
                     raise SessionIncompleteError("Session does not contain a persisted system prompt")
+                system_prompt = build_system_prompt(cwd)
+                if appended:
+                    system_prompt += f"\n\n{appended}"
+                if system_prompt != stored:
+                    session.append_system_prompt(system_prompt, appended=appended)
             return cls(session, system_prompt, cwd=cwd, confirm=confirm, mode=mode,
                        config=config, toolset=toolset, model_override=model_override)
         except BaseException:
@@ -380,7 +440,8 @@ class Agent:
         name = self.model_name
         if not name:
             raise NoModelError("No model configured; log in first")
-        key = (name, self.config.api_base, self.config.api_key)
+        api_base, api_key = self.config.provider_auth(name)
+        key = (name, api_base, api_key)
         if self._cached_model is None or self._cached_model[0] != key:
             self._cached_model = (key, build_model(*key))
         return self._cached_model[1]
@@ -405,11 +466,11 @@ class Agent:
         the recent window, and so returns None on a history short enough that
         there is nothing to summarize.
         """
+        window = compaction.context_window(self.model_name,
+                                           self.config.compaction_context_window)
         if not force:
             if not self.config.compaction_enabled:
                 return None
-            window = compaction.context_window(self.model_name,
-                                               self.config.compaction_context_window)
             # Nothing to compare against, so counting would be wasted work: an
             # unknown window disables auto-compaction outright.
             if window is None:
@@ -427,6 +488,7 @@ class Agent:
             tokens_before=tokens_before,
             tool_schemas=self.tool_schemas,
             system_prompt=self.system_prompt,
+            window=window,
         )
         if result is None:
             return None
@@ -435,17 +497,33 @@ class Agent:
         # append-message invariant (see _append_message) still holds afterwards.
         self.session.append_compaction(result.summary, result.kept_messages, result.tokens_before)
         self.history = result.messages
+        # The provider's count described the old context; drop the anchor so
+        # the fresh estimate below covers the compacted shape.
+        self._usage_anchor = None
         result.tokens_after = await self.count_context_tokens()
         return result
 
     async def count_context_tokens(self) -> int:
-        """Estimate the tokens of everything the next request would send.
-
-        Off the event loop: the count serializes the whole history, which is
-        hundreds of kilobytes on a long session.  It runs at the top of every
-        model step, and every agent shares one loop, so counting inline stalls
-        every other agent's streaming output for as long as it takes.
+        """Tokens of everything the next request would send.
+
+        Anchored on the provider-reported usage of the last completed request
+        when one exists — the provider's own count is authoritative and
+        already includes the system prompt and tool schemas — with the chars/4
+        heuristic applied only to messages appended since. Without an anchor
+        the heuristic covers everything.
+
+        Off the event loop: the count serializes history, which is hundreds of
+        kilobytes on a long session.  It runs at the top of every model step,
+        and every agent shares one loop, so counting inline stalls every other
+        agent's streaming output for as long as it takes.
         """
+        anchor = self._usage_anchor
+        if anchor is not None and anchor[0] <= len(self.history):
+            index, tokens = anchor
+            suffix = list(self.history[index:])
+            if not suffix:
+                return tokens
+            return tokens + await asyncio.to_thread(compaction.count_tokens, suffix)
         return await asyncio.to_thread(
             compaction.count_tokens, list(self.history), self.tool_schemas, self.system_prompt)
 
@@ -493,11 +571,13 @@ class Agent:
             yield ToolStart(call.tool_call_id, call.tool_name, args)
             slot.content = ("Error: 'todos' must be an array of "
                             "{content, status} objects.")
+            slot.outcome = "failed"
             persist()
             yield ToolEnd(call.tool_call_id, call.tool_name, slot.content)
             return
         self.todos = todos
         slot.content = tools.render_todos(self.todos)
+        slot.outcome = "success"
         persist()
         yield TodosUpdate(list(self.todos))
 
@@ -511,16 +591,19 @@ class Agent:
         prompt_text = str(args.get("prompt") or "").strip()
         if not prompt_text:
             slot.content = "Error: prompt is required."
+            slot.outcome = "failed"
             persist()
             yield ToolEnd(call.tool_call_id, call.tool_name, slot.content)
             return
         if not await self._permitted(call.tool_name, args):
             slot.content = "User denied this operation."
+            slot.outcome = "denied"
             persist()
             yield ToolEnd(call.tool_call_id, call.tool_name, slot.content, denied=True)
             return
         slot.content = ("Handoff accepted: this session ended here and a new "
                         "session continued with the provided prompt.")
+        slot.outcome = "success"
         persist()
         yield ToolEnd(call.tool_call_id, call.tool_name, slot.content)
         yield SessionHandoff(prompt_text)
@@ -552,13 +635,16 @@ class Agent:
         if self.supervisor is None:
             slot.content = ("Error: this only works in the interactive UI; "
                             "do the work yourself instead.")
+            slot.outcome = "failed"
         elif not await self._permitted(call.tool_name, args):
             slot.content = "User denied this operation."
+            slot.outcome = "denied"
             persist()
             yield ToolEnd(call.tool_call_id, call.tool_name, slot.content, denied=True)
             return
         else:
             slot.content = await self.supervisor.handle(call.tool_name, args, caller=self)
+            slot.outcome = "success"
         persist()
         yield ToolEnd(call.tool_call_id, call.tool_name, slot.content)
 
@@ -573,12 +659,20 @@ class Agent:
         "stop_job": _run_supervised,
     }
 
-    async def run(self, user_input: str, *, expand: bool = True) -> AsyncIterator[AgentEvent]:
+    async def run(self, user_input: str, *, expand: bool = True,
+                  max_tool_calls: Optional[int] = None) -> AsyncIterator[AgentEvent]:
         """Run one user turn to completion, yielding events along the way.
 
         ``expand=False`` skips @path expansion, for callers that assembled the
         prompt themselves and must not have unrelated text rewritten (piped
         stdin, where a line like ``@foo.py`` is data rather than a mention).
+
+        ``max_tool_calls`` bounds the tool calls this turn may execute. It is
+        enforced here, where every ToolCallPart is dispatched — including the
+        agent-handled tools like write_todos that produce no ToolStart — so no
+        tool can slip past the budget. On the budget every remaining call gets
+        an explicit refusal persisted as its result, ToolBudgetExhausted is
+        yielded and the turn ends.
         """
         prompt = expand_mentions(user_input, self.cwd) if expand else user_input
         # Agents this session started report in here, at the top of the next
@@ -590,6 +684,44 @@ class Agent:
             self._append_message(agents_message(summary))
             yield AgentsNotice(summary)
         self._append_message(ModelRequest(parts=[UserPromptPart(content=prompt)]))
+
+        # Every turn leaves exactly one terminal ``turn_end`` record in the
+        # session: success, error (with the exception), max_tool_calls or
+        # interrupted. The record is not a message, so it reaches audits and
+        # ``paimon log`` without an error or a partial answer ever being
+        # replayed to the model as a normal assistant response.
+        outcome_recorded = False
+
+        def record_outcome(outcome: str, *, error: Optional[str] = None,
+                           partial_text: Optional[str] = None) -> None:
+            nonlocal outcome_recorded
+            if outcome_recorded:
+                return
+            outcome_recorded = True
+            self.session.append_meta("turn_end", outcome=outcome, error=error,
+                                     partial_text=partial_text)
+
+        try:
+            async for event in self._run(record_outcome, max_tool_calls):
+                yield event
+            # A session handoff is the one path that ends the loop without
+            # its own record; it ended the turn deliberately.
+            record_outcome("success")
+        except asyncio.CancelledError:
+            record_outcome("interrupted")
+            raise
+        except GeneratorExit:
+            # The consumer abandoned the turn mid-iteration.
+            record_outcome("interrupted")
+            raise
+        except Exception as exc:
+            record_outcome("error", error=f"{type(exc).__name__}: {exc}")
+            raise
+
+    async def _run(self, record_outcome: Callable[..., None],
+                   max_tool_calls: Optional[int]) -> AsyncIterator[AgentEvent]:
+        """The model/tool loop of one turn; ``run`` wraps it to guarantee the
+        terminal ``turn_end`` record whatever way the turn ends."""
         # A compaction that failed for a transient reason is retried on the
         # next step of this turn — the context only keeps growing, so giving
         # up on the first rate limit disables the safety net exactly when it
@@ -597,6 +729,11 @@ class Agent:
         # for the rest of the turn instead of paying for it every step.
         compaction_off = False
         compaction_failures = 0
+        calls_made = 0  # every dispatched ToolCallPart counts, whatever its kind
+        # A provider context-overflow error triggers one forced compaction and
+        # one retry per turn; a second overflow means compaction cannot make
+        # the request fit, and retrying again would loop.
+        overflow_retried = False
 
         while True:
             # Messages the user queued while this turn was already running.
@@ -616,6 +753,7 @@ class Agent:
                     compaction_failures += 1
                     compaction_off = (not retry.is_transient(exc)
                                       or compaction_failures >= _MAX_COMPACTION_FAILURES)
+                    self.session.append_meta("compaction_failed", error=str(exc))
                     yield ContextCompactionFailed(str(exc))
                 else:
                     compaction_failures = 0
@@ -623,10 +761,14 @@ class Agent:
                         yield ContextCompacted(compacted.tokens_before, compacted.tokens_after)
 
             model = self._model()
-            request_messages: list[ModelMessage] = [
-                ModelRequest(parts=[SystemPromptPart(content=self.system_prompt)]),
-                *_strip_foreign_thinking(self.history, model),
-            ]
+
+            def build_request() -> list[ModelMessage]:
+                return [
+                    ModelRequest(parts=[SystemPromptPart(content=self.system_prompt)]),
+                    *_strip_foreign_thinking(self.history, model),  # noqa: B023 — rebuilt each step
+                ]
+
+            request_messages = build_request()
             parameters = ModelRequestParameters(
                 function_tools=self._tool_definitions, allow_text_output=True
             )
@@ -677,29 +819,60 @@ class Agent:
                                                      usage.cache_write_tokens)
                     break
                 except asyncio.CancelledError:
-                    # Interrupted mid-stream: keep partial text but drop incomplete
-                    # tool calls and thinking (Z.ai-style preserved thinking must be
-                    # replayed complete or not at all) so the history stays valid.
-                    self._append_message(ModelResponse(
-                        parts=[TextPart(content=content or "(interrupted)")],
-                        model_name=model.model_name,
-                        provider_name=model.system,
-                    ))
+                    # Interrupted mid-stream: the partial text is persisted in
+                    # the turn_end record for the log, but no ModelResponse is
+                    # appended — a truncated answer replayed as a completed
+                    # one misleads both the resumed UI and the model, and a
+                    # history ending on the user request stays resumable.
+                    record_outcome("interrupted", partial_text=content or None)
                     raise
                 except Exception as exc:  # noqa: BLE001 — classified by retry.is_transient
                     attempt += 1
+                    if (not started and not overflow_retried
+                            and retry.is_context_overflow(exc)):
+                        # The provider says the request exceeded the window:
+                        # compact and retry once, with an audit record of the
+                        # overflow that triggered it.
+                        overflow_retried = True
+                        self.session.append_meta("context_overflow",
+                                                 error=f"{type(exc).__name__}: {exc}")
+                        try:
+                            compacted = await self._maybe_compact(force=True)
+                        except Exception as compact_exc:  # noqa: BLE001 — original error still raises below
+                            self.session.append_meta("compaction_failed",
+                                                     error=str(compact_exc))
+                            compacted = None
+                        if compacted:
+                            yield ContextCompacted(compacted.tokens_before,
+                                                   compacted.tokens_after)
+                            request_messages = build_request()
+                            continue
                     if started or attempt >= retry.MAX_ATTEMPTS or not retry.is_transient(exc):
+                        # Recorded here rather than in run()'s outer boundary
+                        # because only this scope still holds the partial text
+                        # the user already saw streaming.
+                        record_outcome("error", error=f"{type(exc).__name__}: {exc}",
+                                       partial_text=content or None)
                         raise
                     delay = retry.backoff(attempt)
+                    self.session.append_meta("model_retry", attempt=attempt,
+                                             error=retry.describe(exc))
                     yield ModelRetry(attempt, retry.MAX_ATTEMPTS, delay, retry.describe(exc))
                     await asyncio.sleep(delay)
 
             self._append_message(response)
+            usage = response.usage
+            if usage.input_tokens:
+                # The provider's own count of this request plus its response —
+                # the authoritative context size at this history length.
+                self._usage_anchor = (len(self.history),
+                                      usage.input_tokens + (usage.output_tokens or 0))
             if stats is not None:
                 yield stats
 
             calls = [part for part in response.parts if isinstance(part, ToolCallPart)]
             if not calls:
+                record_outcome("success")
                 yield TurnEnd()
                 return
 
@@ -709,7 +882,7 @@ class Agent:
             # keep this placeholder.
             returns = [
                 ToolReturnPart(tool_name=call.tool_name, content="Interrupted by user.",
-                               tool_call_id=call.tool_call_id)
+                               tool_call_id=call.tool_call_id, outcome="interrupted")
                 for call in calls
             ]
             tool_request = ModelRequest(parts=returns)
@@ -719,16 +892,44 @@ class Agent:
                 """Re-persist the tool request with the slots filled so far."""
                 self._replace_message(record_id, tool_request)
 
+            budget_hit = False
             for slot, call in zip(returns, calls):
                 args = _parse_args(call.args)
                 name = call.tool_name
 
+                # The budget check comes before any dispatch, agent-handled
+                # tools included: a refused call never executes, and its slot
+                # records why instead of a generic interrupted placeholder.
+                if max_tool_calls is not None and calls_made >= max_tool_calls:
+                    budget_hit = True
+                    yield ToolStart(call.tool_call_id, name, args)
+                    slot.content = (f"Not executed: the run reached its tool call "
+                                    f"budget (max_tool_calls={max_tool_calls}).")
+                    persist()
+                    yield ToolEnd(call.tool_call_id, name, slot.content)
+                    continue
+                calls_made += 1
+
                 # A name outside this agent's tool set is rejected before the
                 # agent-handled table below, so excluding write_todos or
                 # start_new_session from a toolset actually disables them.
                 if name not in self.toolset:
                     yield ToolStart(call.tool_call_id, name, args)
                     slot.content = f"Error: unknown tool {name!r}"
+                    slot.outcome = "failed"
+                    persist()
+                    yield ToolEnd(call.tool_call_id, name, slot.content)
+                    continue
+
+                # One schema validation for every call — before gating and
+                # before the agent-handled dispatch below — so a malformed
+                # argument is a tool error the model can react to, never an
+                # exception ending the turn (TOOLS-1).
+                invalid = tools.validate_args(name, args, self.toolset)
+                if invalid is not None:
+                    yield ToolStart(call.tool_call_id, name, args)
+                    slot.content = f"Error: invalid arguments for {name}: {invalid}"
+                    slot.outcome = "failed"
                     persist()
                     yield ToolEnd(call.tool_call_id, name, slot.content)
                     continue
@@ -750,6 +951,12 @@ class Agent:
                                                       ctx=self.tool_context)
 
                 slot.content = result
+                slot.outcome = "denied" if denied else "success"
                 persist()
                 yield ToolEnd(call.tool_call_id, name, result, denied=denied)
+
+            if budget_hit:
+                record_outcome("max_tool_calls")
+                yield ToolBudgetExhausted(max_tool_calls)
+                return
             # loop again so the model can react to tool results

{paimon-0.2.3 → paimon-0.2.4}/paimon/cli.py

@@ -7,6 +7,7 @@ from pathlib import Path
 
 from . import commands
 from . import headless as headless_mode
+from . import telemetry
 from .agent import Agent
 from .app import PaimonApp
 from .config import Config
@@ -20,6 +21,7 @@ def main() -> None:
     # argument sets and none of the launch-mode logic below applies to them.
     argv = sys.argv[1:]
     if argv and argv[0] in commands.REGISTRY:
+        telemetry.record_launch(argv[0])
         sys.exit(commands.REGISTRY[argv[0]](argv[1:]))
 
     parser = argparse.ArgumentParser(
@@ -84,6 +86,9 @@ def main() -> None:
     except ValueError as exc:
         parser.error(str(exc))
     except PaimonError as exc:
+        if args.output_format != "text":
+            # Machine formats promise init/result lines even for this failure.
+            sys.exit(headless_mode.fail(str(exc), args.output_format))
         print(f"paimon: {exc}", file=sys.stderr)
         sys.exit(1)
     if args.strict:
@@ -114,6 +119,7 @@ def main() -> None:
         if args.profile:
             flags += ["--profile", args.profile]
         command = shlex.join([sys.executable, "-m", "paimon", *flags])
+        telemetry.record_launch("web", model=args.model or config.model)
         Server(command, port=args.port).serve()
         return
 
@@ -153,6 +159,7 @@ def main() -> None:
         piped = headless_mode.read_stdin() if piped_stdin else ""
         if not (args.prompt or "").strip() and not piped.strip():
             parser.error("nothing to do: pass a prompt to --print or pipe one on stdin")
+        telemetry.record_launch("headless", model=args.model or config.model)
         sys.exit(headless_mode.run(
             prompt=args.prompt or "", piped=piped, cwd=Path.cwd(), mode=args.mode,
             session=resume_session, output_format=args.output_format, config=config,
@@ -162,6 +169,9 @@ def main() -> None:
 
     if args.model:
         config.model = args.model
+    # The --tui relaunch under --web was already counted by the server.
+    if not args.tui:
+        telemetry.record_launch("tui", model=config.model)
     try:
         agent = Agent.open(cwd=Path.cwd(), session=resume_session, mode=args.mode, config=config)
     except SessionError as exc: