voidx 3.7.1__tar.gz → 3.7.3__tar.gz

{voidx-3.7.1/src/voidx.egg-info → voidx-3.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: voidx
-Version: 3.7.1
+Version: 3.7.3
 Summary: A coding agent that quantifies everything and solves with tools, not fuzzy prompts.
 Author: chikhamx
 License: MIT

{voidx-3.7.1 → voidx-3.7.3}/src/tests/test_agent/graph/test_call_llm_compaction.py

@@ -19,6 +19,7 @@ from voidx.agent.task_state import TaskState, TodoRunState
 from voidx.config import Config, ModelConfig
 from voidx.agent.graph.compaction_coordinator import CompactionResult, PreflightCompactionResult
 from voidx.llm.compaction import CompactionSelection, SUMMARY_TEMPLATE
+from voidx.llm.usage import estimate_context_tokens
 from voidx.llm.message_markers import is_guidance_message
 from voidx.memory.context_frames import load_context_frames
 from voidx.memory.session import MessageRow, create_session, delete_session, save_message
@@ -181,6 +182,7 @@ async def test_call_llm_updates_usage_stats_across_turn_control_calls(tmp_path,
         "messages": [HumanMessage(content="hi")],
         "step_count": 0,
         "persona": "voidx",
+        "turn_state": "running",
     })
 
     assert result["step_count"] == 1
@@ -188,11 +190,38 @@ async def test_call_llm_updates_usage_stats_across_turn_control_calls(tmp_path,
     assert graph.model.calls == 2
     assert graph._usage_stats.last_input_tokens == 2
     assert graph._usage_stats.last_output_tokens == 1
+    assert graph._usage_stats.context_tokens == 2
     assert graph._usage_stats.total_input_tokens == 9
     assert graph._usage_stats.total_output_tokens == 4
     assert graph._usage_stats.total_calls == 2
 
 
+@pytest.mark.asyncio
+async def test_call_llm_fallback_context_estimate_includes_tool_schema(tmp_path, monkeypatch):
+    import voidx.agent.graph.core.llm as graph_module
+
+    monkeypatch.setattr(graph_module, "StreamingRenderer", FakeRenderer)
+
+    graph = VoidXGraph(
+        Config(
+            model=ModelConfig(provider="openai", model="gpt-4o"),
+            workspace=str(tmp_path),
+        ),
+        api_key=None,
+    )
+    graph.model = FakeStreamingModel()
+
+    await graph._call_llm({
+        "messages": [HumanMessage(content="hi")],
+        "step_count": 0,
+        "persona": "voidx",
+        "turn_state": "running",
+    })
+
+    messages_only = estimate_context_tokens(graph.model.messages, graph.config.model.model)
+    assert graph._usage_stats.context_tokens > messages_only
+
+
 @pytest.mark.asyncio
 async def test_call_llm_persists_context_frame_for_session(tmp_path, monkeypatch):
     import voidx.agent.graph.core.llm as graph_module
@@ -792,3 +821,23 @@ def test_llm_retry_delay_exponential_cap():
     assert _llm_retry_delay(8) == 60.0
     assert _llm_retry_delay(9) == 60.0
     assert _llm_retry_delay(10) == 60.0
+
+
+def test_clean_error_message():
+    from voidx.agent.graph.core.helpers import _clean_error_message
+
+    # Test case 1: OpenAI rate limit error with dict representation
+    exc1 = Exception("Error code: 402 - {'error': {'type': 'rate_limit_error', 'message': '每日额度超限: 当前 $50.813...'}}")
+    assert _clean_error_message(exc1) == "Error code: 402 - 每日额度超限: 当前 $50.813..."
+
+    # Test case 2: OpenAI error with json representation
+    exc2 = Exception('Error code: 400 - {"error": {"message": "Invalid prompt", "type": "invalid_request_error"}}')
+    assert _clean_error_message(exc2) == "Error code: 400 - Invalid prompt"
+
+    # Test case 3: Standard exception with no JSON/dict
+    exc3 = Exception("Connection refused")
+    assert _clean_error_message(exc3) == "Connection refused"
+
+    # Test case 4: Dict representation without error key
+    exc4 = Exception("Error: {'message': 'Something went wrong'}")
+    assert _clean_error_message(exc4) == "Error - Something went wrong"

voidx-3.7.3/src/tests/test_agent/graph/test_call_llm_structure.py

@@ -0,0 +1,12 @@
+"""Structure tests for the call_llm refactor."""
+
+import importlib
+
+
+def test_call_llm_helpers_live_in_core_modules():
+    for module_name in (
+        "voidx.agent.graph.core.loop",
+        "voidx.agent.graph.core.turn",
+        "voidx.agent.graph.core.context",
+    ):
+        assert importlib.import_module(module_name)

{voidx-3.7.1 → voidx-3.7.3}/src/tests/test_agent/graph/test_graph_authorization.py

@@ -72,6 +72,10 @@ def _result_task_state(result: dict) -> TaskState:
     return TaskState.model_validate(result["task_state"])
 
 
+def _asked_tool_calls(batch):
+    return [getattr(item, "tool_call", item) for item in batch]
+
+
 def _child_goal_resolution(
     goal_type: str = "feature",
     *,
@@ -141,7 +145,6 @@ def test_permission_decision_splits_readonly_and_implement_agents():
 @pytest.mark.asyncio
 async def test_graph_authorization_auto_allows_readonly_agent(tmp_path):
     graph = _graph(tmp_path)
-    graph._permission.approval_policy = "untrusted"
     approved, denied = await graph._authorize_tool_calls(
         [{
             "name": "agent",
@@ -191,7 +194,7 @@ async def test_graph_authorization_prompts_for_implement_agent(tmp_path):
 
     assert [tc["name"] for tc in approved] == ["agent"]
     assert denied == []
-    assert [[tc["args"]["goal_resolution"]["plan"]["join"] for tc in batch] for batch in asked] == [["tdd"]]
+    assert [[tc["args"]["goal_resolution"]["plan"]["join"] for tc in _asked_tool_calls(batch)] for batch in asked] == [["tdd"]]
 
 
 @pytest.mark.asyncio
@@ -210,10 +213,37 @@ async def test_graph_authorization_respects_session_deny_for_safe_bash(tmp_path)
     assert "Permission denied" in denied[0][1]
 
 
+@pytest.mark.asyncio
+async def test_graph_authorization_never_approves_mixed_blocked_batch(tmp_path):
+    graph = _graph(tmp_path)
+    graph._permission.permission_mode = "safe"
+    asked: list[list[object]] = []
+
+    async def approve(tool_calls):
+        asked.append(tool_calls)
+        return "y"
+
+    graph._ask_tool_permission = approve
+
+    approved, denied = await graph._authorize_tool_calls(
+        [
+            {"name": "bash", "args": {"command": "rm -rf /"}, "id": "blocked"},
+            {"name": "bash", "args": {"command": "echo $(date)"}, "id": "ask"},
+        ],
+        plan_mode=False,
+        session_id="test",
+    )
+
+    assert [call["id"] for call in approved] == ["ask"]
+    assert [call["id"] for call, _ in denied] == ["blocked"]
+    assert len(asked) == 2
+    assert [item.tool_call["id"] for item in asked[0]] == ["blocked"]
+    assert [item.tool_call["id"] for item in asked[1]] == ["ask"]
+
+
 @pytest.mark.asyncio
 async def test_graph_authorization_asks_for_write_by_active_workflow_gate(tmp_path):
     graph = _graph(tmp_path)
-    graph._permission.approval_policy = "on-request"
     asked: list[list[dict]] = []
 
     async def approve(tool_calls):
@@ -231,7 +261,7 @@ async def test_graph_authorization_asks_for_write_by_active_workflow_gate(tmp_pa
         ],
     )
 
-    assert [[call["id"] for call in batch] for batch in asked] == [["call_1"]]
+    assert [[call["id"] for call in _asked_tool_calls(batch)] for batch in asked] == [["call_1"]]
     assert [call["id"] for call in approved] == ["call_1"]
     assert denied == []
 
@@ -239,8 +269,7 @@ async def test_graph_authorization_asks_for_write_by_active_workflow_gate(tmp_pa
 @pytest.mark.asyncio
 async def test_graph_authorization_uses_current_workflow_gate_only(tmp_path):
     graph = _graph(tmp_path)
-    graph._permission.approval_policy = "on-request"
-
+    
     approved, denied = await graph._authorize_tool_calls(
         [{
             "name": "edit",
@@ -263,7 +292,6 @@ async def test_graph_authorization_uses_current_workflow_gate_only(tmp_path):
 @pytest.mark.asyncio
 async def test_graph_authorization_allows_plan_gate_doc_paths_only(tmp_path):
     graph = _graph(tmp_path)
-    graph._permission.approval_policy = "on-request"
     asked: list[list[dict]] = []
 
     async def deny(tool_calls):
@@ -294,7 +322,7 @@ async def test_graph_authorization_allows_plan_gate_doc_paths_only(tmp_path):
     )
 
     assert [call["id"] for call in approved] == ["call_docs"]
-    assert [[call["id"] for call in batch] for batch in asked] == [["call_src"]]
+    assert [[call["id"] for call in _asked_tool_calls(batch)] for batch in asked] == [["call_src"]]
     assert [call["id"] for call, _reason in denied] == ["call_src"]
     assert denied[0][1] == "User denied: replace"
 
@@ -302,8 +330,7 @@ async def test_graph_authorization_allows_plan_gate_doc_paths_only(tmp_path):
 @pytest.mark.asyncio
 async def test_graph_authorization_allowed_paths_match_nested_docs(tmp_path):
     graph = _graph(tmp_path)
-    graph._permission.approval_policy = "on-request"
-
+    
     approved, denied = await graph._authorize_tool_calls(
         [{
             "name": "edit",
@@ -325,8 +352,7 @@ async def test_graph_authorization_allowed_paths_match_nested_docs(tmp_path):
 @pytest.mark.asyncio
 async def test_graph_authorization_does_not_block_tools_outside_active_workflow_node_allowlist(tmp_path):
     graph = _graph(tmp_path)
-    graph._permission.approval_policy = "on-request"
-
+    
     approved, denied = await graph._authorize_tool_calls(
         [{
             "name": "todo",
@@ -348,7 +374,6 @@ async def test_graph_authorization_does_not_block_tools_outside_active_workflow_
 @pytest.mark.asyncio
 async def test_graph_authorization_asks_for_workflow_gate_tools_instead_of_denying(tmp_path):
     graph = _graph(tmp_path)
-    graph._permission.approval_policy = "on-request"
     asked: list[list[dict]] = []
 
     async def approve(tool_calls):
@@ -371,7 +396,7 @@ async def test_graph_authorization_asks_for_workflow_gate_tools_instead_of_denyi
         ],
     )
 
-    assert [[call["id"] for call in batch] for batch in asked] == [["call_src"]]
+    assert [[call["id"] for call in _asked_tool_calls(batch)] for batch in asked] == [["call_src"]]
     assert [call["id"] for call in approved] == ["call_src"]
     assert denied == []
 
@@ -379,7 +404,6 @@ async def test_graph_authorization_asks_for_workflow_gate_tools_instead_of_denyi
 @pytest.mark.asyncio
 async def test_graph_authorization_asks_for_persona_blocked_write(tmp_path):
     graph = _graph(tmp_path)
-    graph._permission.approval_policy = "on-request"
     asked: list[list[dict]] = []
 
     async def approve(tool_calls):
@@ -402,7 +426,6 @@ async def test_graph_authorization_asks_for_persona_blocked_write(tmp_path):
 @pytest.mark.asyncio
 async def test_permission_result_uses_transient_output(tmp_path):
     graph = _graph(tmp_path)
-    graph._permission.approval_policy = "untrusted"
     test_dock = BottomInputDock()
     set_dock(test_dock)
     test_dock.begin_capture()
@@ -470,6 +493,9 @@ async def test_permission_prompt_uses_dock_details_when_events_are_active(tmp_pa
             "name": "bash",
             "pattern": "npm install lodash",
             "args": {"command": "npm install lodash"},
+            "risk": None,
+            "allowed_scopes": [],
+            "default_scope": None,
         }]
         record = test_dock.status_record("permission:request")
         assert record is not None
@@ -480,3 +506,148 @@ async def test_permission_prompt_uses_dock_details_when_events_are_active(tmp_pa
         await graph._ui.events.stop()
         test_dock.deactivate()
         set_dock(None)
+
+
+@pytest.mark.asyncio
+async def test_read_only_permission_prompt_limits_choices_to_once(tmp_path):
+    graph = _graph(tmp_path)
+    graph._permission.set_permission_mode("read_only")
+    captured_choices = None
+
+    class FakeApp:
+        async def ask_choice(self, _prompt, choices, details=None):
+            nonlocal captured_choices
+            captured_choices = choices
+            return "y"
+
+    graph._app = FakeApp()
+
+    approved, denied = await graph._authorize_tool_calls(
+        [{"name": "bash", "args": {"command": "cat input.txt > output.txt"}, "id": "call_1"}],
+        plan_mode=False,
+        session_id="s",
+    )
+
+    assert [tc["name"] for tc in approved] == ["bash"]
+    assert denied == []
+    assert captured_choices == [
+        ("Yes", "y", "Allow this tool use once"),
+        ("No", "n", "Deny these tools"),
+    ]
+
+
+@pytest.mark.asyncio
+async def test_permission_prompt_details_include_risk_and_scopes(tmp_path):
+    graph = _graph(tmp_path)
+    graph._permission.set_permission_mode("safe")
+    received_details = None
+
+    class FakeApp:
+        async def ask_choice(self, _prompt, _choices, details=None):
+            nonlocal received_details
+            received_details = details
+            return "y"
+
+    graph._app = FakeApp()
+
+    approved, denied = await graph._authorize_tool_calls(
+        [{"name": "bash", "args": {"command": "npm install lodash"}, "id": "call_1"}],
+        plan_mode=False,
+        session_id="s",
+    )
+
+    assert [tc["name"] for tc in approved] == ["bash"]
+    assert denied == []
+    assert received_details == [{
+        "name": "bash",
+        "pattern": "npm install lodash",
+        "args": {"command": "npm install lodash"},
+        "risk": {
+            "level": "extreme",
+            "tags": ["dependency_install"],
+            "reason": "shell policy deferred: dependency install command",
+            "tool_name": "bash",
+            "pattern": "npm install lodash",
+        },
+        "allowed_scopes": ["once"],
+        "default_scope": "once",
+    }]
+
+
+@pytest.mark.asyncio
+async def test_graph_authorization_attaches_approved_risk_token_to_approved_shell_call(tmp_path):
+    graph = _graph(tmp_path)
+    graph._permission.set_permission_mode("read_only")
+    graph._permission.set_permission_mode("read_only")
+    
+    async def approve(_tool_calls):
+        return "y"
+
+    graph._ask_tool_permission = approve
+    command = "cat input.txt > output.txt"
+
+    approved, denied = await graph._authorize_tool_calls(
+        [{"name": "bash", "args": {"command": command}, "id": "call_1"}],
+        plan_mode=False,
+        session_id="s",
+    )
+
+    assert denied == []
+    assert approved[0]["metadata"]["approved_risk"] == {
+        "tool_name": "bash",
+        "pattern": command,
+        "risk_level": "extreme",
+        "tags": ["dynamic_shell"],
+        "reason": "shell policy deferred: compound shell syntax, compound shell operator",
+    }
+
+
+@pytest.mark.asyncio
+async def test_blocked_permission_prompt_only_acknowledges_and_denies_execution(tmp_path):
+    graph = _graph(tmp_path)
+    graph._permission.set_permission_mode("safe")
+    captured_choices = None
+    captured_details = None
+
+    class FakeApp:
+        async def ask_choice(self, _prompt, choices, details=None):
+            nonlocal captured_choices, captured_details
+            captured_choices = choices
+            captured_details = details
+            return "n"
+
+    graph._app = FakeApp()
+
+    approved, denied = await graph._authorize_tool_calls(
+        [{"name": "bash", "args": {"command": "sudo true"}, "id": "call_blocked"}],
+        plan_mode=False,
+        session_id="s",
+    )
+
+    assert approved == []
+    assert denied == [({"name": "bash", "args": {"command": "sudo true"}, "id": "call_blocked"}, "Blocked: sudo is blocked — privilege escalation")]
+    assert captured_choices == [("Do not run", "n", "This command is blocked")]
+    assert captured_details[0]["risk"]["level"] == "blocked"
+    assert captured_details[0]["allowed_scopes"] == []
+    assert captured_details[0]["default_scope"] is None
+
+
+@pytest.mark.asyncio
+async def test_blocked_permission_prompt_cannot_be_approved_with_yes(tmp_path):
+    graph = _graph(tmp_path)
+    graph._permission.set_permission_mode("safe")
+    
+    class FakeApp:
+        async def ask_choice(self, _prompt, _choices, details=None):
+            return "y"
+
+    graph._app = FakeApp()
+
+    approved, denied = await graph._authorize_tool_calls(
+        [{"name": "bash", "args": {"command": "sudo true"}, "id": "call_blocked"}],
+        plan_mode=False,
+        session_id="s",
+    )
+
+    assert approved == []
+    assert denied == [({"name": "bash", "args": {"command": "sudo true"}, "id": "call_blocked"}, "Blocked: sudo is blocked — privilege escalation")]

{voidx-3.7.1 → voidx-3.7.3}/src/tests/test_agent/graph/test_subagent_runner.py

@@ -72,6 +72,10 @@ def _result_task_state(result: dict) -> TaskState:
     return TaskState.model_validate(result["task_state"])
 
 
+def _asked_tool_calls(batch):
+    return [getattr(item, "tool_call", item) for item in batch]
+
+
 def _child_goal_resolution(
     goal_type: str = "feature",
     *,
@@ -319,7 +323,13 @@ async def test_subagent_runner_authorizes_with_child_interaction_mode(tmp_path,
 @pytest.mark.asyncio
 async def test_graph_authorization_does_not_treat_goal_as_read_only_mode(tmp_path):
     graph = _graph(tmp_path)
-    graph._permission.approval_policy = "on-request"
+    asked: list[list[dict]] = []
+
+    async def approve(tool_calls):
+        asked.append(tool_calls)
+        return "y"
+
+    graph._ask_tool_permission = approve
 
     approved, denied = await graph._authorize_tool_calls(
         [{"name": "edit", "args": {"file_path": "src/app.py"}, "id": "call_1"}],
@@ -331,6 +341,7 @@ async def test_graph_authorization_does_not_treat_goal_as_read_only_mode(tmp_pat
 
     assert [tc["name"] for tc in approved] == ["replace"]
     assert denied == []
+    assert [[tc["name"] for tc in _asked_tool_calls(batch)] for batch in asked] == [["replace"]]
 
 
 @pytest.mark.asyncio
@@ -369,7 +380,7 @@ async def test_graph_authorization_prompts_for_edit(tmp_path):
 
     assert [tc["name"] for tc in approved] == ["replace"]
     assert denied == []
-    assert [[tc["name"] for tc in batch] for batch in asked] == [["replace"]]
+    assert [[tc["name"] for tc in _asked_tool_calls(batch)] for batch in asked] == [["replace"]]
 
 
 @pytest.mark.asyncio
@@ -413,4 +424,4 @@ async def test_graph_authorization_prompts_for_unsafe_bash(tmp_path):
 
     assert [tc["name"] for tc in approved] == ["bash"]
     assert denied == []
-    assert [[tc["name"] for tc in batch] for batch in asked] == [["bash"]]
+    assert [[tc["name"] for tc in _asked_tool_calls(batch)] for batch in asked] == [["bash"]]

{voidx-3.7.1 → voidx-3.7.3}/src/tests/test_agent/graph/test_tool_execution_auth.py

@@ -135,7 +135,7 @@ def _tree_nodes(root):
 @pytest.mark.asyncio
 async def test_graph_on_request_auto_approves_need_ask_tools(tmp_path):
     graph = _graph(tmp_path)
-    graph._permission.approval_policy = "on-request"
+    graph._permission.permission_mode = "full_access"
 
     approved, denied = await graph._authorize_tool_calls(
         [{"name": "write", "args": {"file_path": "app.py", "op": "append", "new_string": "x"}, "id": "call_1"}],
@@ -149,10 +149,30 @@ async def test_graph_on_request_auto_approves_need_ask_tools(tmp_path):
 
 
 @pytest.mark.asyncio
-async def test_graph_on_failure_asks_unsafe_bash_before_prompt(tmp_path):
+async def test_full_access_auto_approves_write_without_implement_persona(tmp_path):
     graph = _graph(tmp_path)
-    graph._permission.approval_policy = "on-failure"
+    graph._permission.permission_mode = "full_access"
+
+    async def fail_if_asked(_tool_calls):
+        pytest.fail("full_access should not prompt for workspace edit")
+
+    graph._ask_tool_permission = fail_if_asked
+
+    approved, denied = await graph._authorize_tool_calls(
+        [{"name": "replace", "args": {"file_path": "app.py", "bounds": [{"line_no": 1, "anchor": "x"}], "new_string": "y"}, "id": "call_1"}],
+        runtime_persona="coordinate",
+        plan_mode=False,
+        session_id="test",
+    )
+
+    assert [tc["name"] for tc in approved] == ["replace"]
+    assert denied == []
+
 
+@pytest.mark.asyncio
+async def test_graph_on_failure_asks_unsafe_bash_before_prompt(tmp_path):
+    graph = _graph(tmp_path)
+    
     asked: list[dict] = []
 
     async def ask(tool_calls):

{voidx-3.7.1 → voidx-3.7.3}/src/tests/test_agent/graph/test_turn_control_e2e.py

@@ -102,6 +102,7 @@ async def test_regular_tool_call_resets_missing_turn_count(tmp_path, monkeypatch
         "messages": [HumanMessage(content="hello")],
         "step_count": 0,
         "persona": "coordinate",
+        "turn_state": "running",
     })
     # The regular tool call should route to execute, not end
     assert result1["messages"][0].tool_calls
@@ -113,6 +114,7 @@ async def test_regular_tool_call_resets_missing_turn_count(tmp_path, monkeypatch
         "messages": [HumanMessage(content="hello"), *result1["messages"]],
         "step_count": 1,
         "persona": "coordinate",
+        "turn_state": result1.get("turn_state", "running"),
     })
     assert result2["messages"][0].content == "Final answer."
     assert not result2["messages"][0].tool_calls
@@ -170,6 +172,7 @@ async def test_turn_call_never_emits_permission_or_execution_events(tmp_path, mo
         "messages": [HumanMessage(content="hello")],
         "step_count": 0,
         "persona": "coordinate",
+        "turn_state": "running",
     })
 
     # Check that no tool permission or tool execution events were emitted
@@ -195,6 +198,7 @@ async def test_successful_barrier_emits_one_committed_stream(tmp_path, monkeypat
         "messages": [HumanMessage(content="hello")],
         "step_count": 0,
         "persona": "coordinate",
+        "turn_state": "running",
     })
 
     msgs = result["messages"]
@@ -221,6 +225,7 @@ async def test_regular_tool_continues_after_turn_prompt(tmp_path, monkeypatch):
         "messages": [HumanMessage(content="hello")],
         "step_count": 0,
         "persona": "coordinate",
+        "turn_state": "running",
     })
 
     assert result["messages"][0].tool_calls

{voidx-3.7.1 → voidx-3.7.3}/src/tests/test_agent/graph/test_turn_control_integration.py

@@ -1,7 +1,7 @@
 """Integration tests for turn control inside _call_llm."""
 
 import pytest
-from langchain_core.messages import AIMessage, AIMessageChunk, HumanMessage
+from langchain_core.messages import AIMessage, AIMessageChunk, HumanMessage, ToolMessage
 
 from voidx.agent.graph import VoidXGraph
 from voidx.agent.graph.turn_control import TURN_TOOL_DEFINITION
@@ -291,11 +291,11 @@ async def test_regular_tool_call_routes_to_execute(tmp_path, monkeypatch):
     assert msgs[0].tool_calls[0]["name"] == "read"
 
 
-# ── Test 4: first plain-text triggers first completion prompt ───────────────
+# ── Test 4: first plain-text answer can complete immediately ────────────────
 
 
 @pytest.mark.asyncio
-async def test_first_plain_text_triggers_first_prompt_then_turn(tmp_path, monkeypatch):
+async def test_first_plain_text_commits_without_start_prompt(tmp_path, monkeypatch):
     model = ScriptedStreamingModel([
         [_text_chunk("Provisional answer.")],
         [_turn_call_chunk()],
@@ -311,11 +311,13 @@ async def test_first_plain_text_triggers_first_prompt_then_turn(tmp_path, monkey
     msgs = result["messages"]
     assert msgs[0].content == "Provisional answer."
     assert not msgs[0].tool_calls
-    assert model.call_index == 2
+    assert result["turn_state"] == "committed"
+    assert model.call_index == 1
+    assert len(model.received_messages) == 1
 
 
 @pytest.mark.asyncio
-async def test_missing_turn_reprompt_keeps_full_tool_set_and_appends_turn_prompt(tmp_path, monkeypatch):
+async def test_initial_plain_text_keeps_full_tool_set_without_reprompt(tmp_path, monkeypatch):
     model = ScriptedStreamingModel([
         [_text_chunk("Provisional answer.")],
         [_turn_call_chunk()],
@@ -329,12 +331,8 @@ async def test_missing_turn_reprompt_keeps_full_tool_set_and_appends_turn_prompt
     })
 
     assert result["messages"][0].content == "Provisional answer."
-    assert model.call_index == 2
-    turn_prompt_messages = model.received_messages[1]
-    assert any(
-        isinstance(msg, HumanMessage) and "operation='start'" in str(msg.content)
-        for msg in turn_prompt_messages
-    )
+    assert model.call_index == 1
+    assert len(model.received_messages) == 1
     tool_names = [tool["function"]["name"] for tool in model.bound_tools]
     assert "turn" in tool_names
     assert "read" in tool_names
@@ -352,6 +350,7 @@ async def test_regular_tool_after_turn_prompt_continues_without_committing_text(
         "messages": [HumanMessage(content="read x.py")],
         "step_count": 0,
         "persona": "coordinate",
+        "turn_state": "running",
     })
 
     assert result["messages"][0].tool_calls
@@ -384,7 +383,7 @@ async def test_decision_only_turn_with_text_is_rejected_before_stop(tmp_path, mo
 
 
 @pytest.mark.asyncio
-async def test_plain_text_prompts_start_then_stop_without_ui_leak(tmp_path, monkeypatch):
+async def test_initial_plain_text_commits_without_hidden_ui_followups(tmp_path, monkeypatch):
     RecordingRenderer.reset()
     model = ScriptedStreamingModel([
         [_text_chunk("First provisional.")],
@@ -400,10 +399,12 @@ async def test_plain_text_prompts_start_then_stop_without_ui_leak(tmp_path, monk
     })
 
     visible_text = "".join(RecordingRenderer.visible_text)
-    assert result["messages"][0].content == "Second provisional."
+    assert result["messages"][0].content == "First provisional."
     assert "First provisional." in visible_text
+    assert "Second provisional." not in visible_text
     assert RecordingRenderer.headless_values[0] is False
-    assert all(RecordingRenderer.headless_values[1:])
+    assert RecordingRenderer.headless_values == [False]
+    assert model.call_index == 1
 
 
 # ── Test 6: second plain-text fallback keeps latest response ────────────────
@@ -422,6 +423,7 @@ async def test_invalid_turn_continue_recovers_with_regular_tool(tmp_path, monkey
         "messages": [HumanMessage(content="hello")],
         "step_count": 0,
         "persona": "coordinate",
+        "turn_state": "running",
     })
 
     assert result["messages"][0].tool_calls
@@ -512,8 +514,8 @@ async def test_turn_with_non_empty_args_is_rejected(tmp_path, monkeypatch):
         }],
     )
     model = ScriptedStreamingModel([
-        [_text_chunk("answer")],
         [malformed_turn],
+        [_text_chunk("answer")],
         [_turn_call_chunk()],
     ])
     graph = _make_graph(tmp_path, model, monkeypatch)
@@ -623,7 +625,19 @@ async def test_start_prompt_injected_once_then_stop_prompt(tmp_path, monkeypatch
     graph = _make_graph(tmp_path, model, monkeypatch)
 
     result = await graph._call_llm({
-        "messages": [HumanMessage(content="hello")],
+        "messages": [
+            HumanMessage(content="hello"),
+            AIMessage(
+                content="",
+                tool_calls=[{
+                    "name": "read",
+                    "args": {"file_path": "x.py"},
+                    "id": "tc-prior",
+                    "type": "tool_call",
+                }],
+            ),
+            ToolMessage(content="ok", tool_call_id="tc-prior", name="read"),
+        ],
         "step_count": 0,
         "persona": "coordinate",
         "turn_state": "initial",