xdog-coding 2.4.3__tar.gz → 2.4.4__tar.gz

xdog_coding-2.4.3/README.md → xdog_coding-2.4.4/PKG-INFO

@@ -1,3 +1,35 @@
+Metadata-Version: 2.5
+Name: xdog-coding
+Version: 2.4.4
+Summary: Interactive coding agent CLI
+Project-URL: Homepage, https://xdog.942295.xyz
+Project-URL: Repository, https://github.com/litterzhang/xdog
+Project-URL: Documentation, https://xdog.942295.xyz
+Project-URL: Issues, https://github.com/litterzhang/xdog/issues
+Author: HugeMan
+License-Expression: AGPL-3.0-or-later
+License-File: LICENSE
+License-File: LICENSE-EXCEPTION.md
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Requires-Dist: agent-client-protocol<0.13,>=0.12.1; python_version < '3.15'
+Requires-Dist: click>=8.1.0
+Requires-Dist: pydantic>=2.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: xdog-agent>=2.4.4
+Requires-Dist: xdog-ai[openai]>=2.4.4
+Requires-Dist: xdog-tui>=2.4.4
+Provides-Extra: skills
+Requires-Dist: xdog-skills>=2.4.4; extra == 'skills'
+Description-Content-Type: text/markdown
+
 # xdog-coding
 
 > Platform scope: **Linux only**. Non-Linux adapters and native-platform support
@@ -2623,3 +2655,68 @@ and widget layouts are removed. Native approval and recovery reviews remain host
 owned; they expose no plugin layout or editor/session-mutation authority. Core TUI
 overlays, transcript fullscreen, Unicode, clipping, cursor and tool-approval behavior
 remain.
+
+## Session ownership and reliable shutdown
+
+Coding's TUI, print, SDK and ACP ingress share one session controller and Agent.
+Persistent writer locks live under `<sessions>/.owners`; they do not depend on
+`TMPDIR`. Short private Linux Unix socket/discovery files are separate, under
+`/tmp/xdog-coding-<uid>/<store-hash>`. Stop older Coding processes before upgrading:
+old binaries do not participate in this store-anchored writer-lock protocol. Do
+not run mixed old/new writers against the same session store.
+
+SDK applications should `await session.aclose()` in `finally`. Closure is
+idempotent, waits for actual child/Goal/extension/MCP cleanup, and reports cleanup
+errors only after attempting the other resources. Cancellation of a waiter does
+not abandon the underlying close. `session.dispose()` requests the same close
+and returns a concurrent Future; synchronous applications can wait on `.result()`.
+Do not block an asynchronous caller loop with `.result()`; await `aclose()` instead.
+Synchronous construction and controls can be called with `asyncio.to_thread` when
+used from an async application. A receiver accepting a queued message does not
+require message approval; existing approval applies to tool execution only.
+
+Automatic project instructions come **only** from the working directory's
+`AGENTS.md`, `.coding/INSTRUCTIONS.md` and `.coding/instructions.md`. There is no
+parent walk. Other harness configuration files are not automatic instruction
+sources; they remain ordinary files that users can explicitly read or attach under
+normal file-access and permission rules. There is no filename denylist.
+Each automatic source must be a regular UTF-8 file of at most 64 KiB; symlinks,
+special files and unreadable/oversized sources cause an explicit preparation error. Missing files are optional. These
+instructions are refreshed in owned off-loop preparation before a turn, reach the
+actual model prompt, and never grant tool permissions. The Agent alone renders
+skill indexes and session/turn-scoped bodies; loading a skill starts no observer,
+model, receiver or daemon.
+
+`CreateSessionOptions.thinking_level` is honored, including explicit `"off"`.
+Initial `allowed_tools` configuration is a **tool selection**, not authorization:
+absent/null falls through to a lower layer, `[]` selects no tools, and a nonempty
+list selects those configured names. Caller options/overrides take precedence
+over saved explicit choices, then project and global configuration. Choices are
+not unioned. Unavailable saved names do not create tools or gain authority later;
+normal permission checks still apply to the selected tools.
+
+The separate input history ledger has a common **64 MiB** read/write bound.
+Admission reserves final-state, batch-ID and bounded diagnostic space for every
+unfinished input; if it cannot fit, it is refused before acknowledgement. Errors
+retain up to 4096 characters with an explicit truncation marker; batch IDs are
+limited to 256 UTF-8 bytes. Accepted execution facts are never silently deleted.
+At capacity, explicitly start another session rather than automatically archiving
+or replaying requests. Recovery marks unfinished execution interrupted and never
+replays potentially executed tool effects automatically.
+
+Ordinary turn history uses one immutable, original-owner disk commit, off the
+model loop, before publishing saved state and completing producer receipts.
+File replacement synchronizes the file and parent directory. A failed or
+uncertain history commit retains the live executed tail and fences further turns;
+close and explicitly reload/inspect the saved state before continuing. Concurrent
+metadata revision conflicts fail closed instead of overwriting newer facts.
+These are local filesystem/process guarantees, not hardware power-loss
+exactly-once execution or an OS security sandbox. No existing user data is migrated
+or discarded automatically.
+
+Enabled extensions may declare a public slash name. The packaged `goal_ui`
+display exposes `/goals [GOAL_ID | page OFFSET]`; `/goal` remains the skill name.
+This is generic extension routing, not a Coding-specific Goal command. Public
+names appear in help/completion and cannot shadow builtin or skill commands;
+model tool names and permissions do not change. See
+`docs/extension-public-commands.md` for the shared Coding/Claw contract.

xdog_coding-2.4.3/PKG-INFO → xdog_coding-2.4.4/README.md

@@ -1,35 +1,3 @@
-Metadata-Version: 2.5
-Name: xdog-coding
-Version: 2.4.3
-Summary: Interactive coding agent CLI
-Project-URL: Homepage, https://xdog.942295.xyz
-Project-URL: Repository, https://github.com/litterzhang/xdog
-Project-URL: Documentation, https://xdog.942295.xyz
-Project-URL: Issues, https://github.com/litterzhang/xdog/issues
-Author: HugeMan
-License-Expression: AGPL-3.0-or-later
-License-File: LICENSE
-License-File: LICENSE-EXCEPTION.md
-Classifier: Development Status :: 5 - Production/Stable
-Classifier: Intended Audience :: Developers
-Classifier: Operating System :: POSIX :: Linux
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Topic :: Software Development :: Libraries
-Classifier: Typing :: Typed
-Requires-Python: >=3.12
-Requires-Dist: agent-client-protocol<0.13,>=0.12.1; python_version < '3.15'
-Requires-Dist: click>=8.1.0
-Requires-Dist: pydantic>=2.0
-Requires-Dist: pyyaml>=6.0
-Requires-Dist: xdog-agent>=2.4.3
-Requires-Dist: xdog-ai[openai]>=2.4.3
-Requires-Dist: xdog-tui>=2.4.3
-Provides-Extra: skills
-Requires-Dist: xdog-skills>=2.4.3; extra == 'skills'
-Description-Content-Type: text/markdown
-
 # xdog-coding
 
 > Platform scope: **Linux only**. Non-Linux adapters and native-platform support
@@ -2655,3 +2623,68 @@ and widget layouts are removed. Native approval and recovery reviews remain host
 owned; they expose no plugin layout or editor/session-mutation authority. Core TUI
 overlays, transcript fullscreen, Unicode, clipping, cursor and tool-approval behavior
 remain.
+
+## Session ownership and reliable shutdown
+
+Coding's TUI, print, SDK and ACP ingress share one session controller and Agent.
+Persistent writer locks live under `<sessions>/.owners`; they do not depend on
+`TMPDIR`. Short private Linux Unix socket/discovery files are separate, under
+`/tmp/xdog-coding-<uid>/<store-hash>`. Stop older Coding processes before upgrading:
+old binaries do not participate in this store-anchored writer-lock protocol. Do
+not run mixed old/new writers against the same session store.
+
+SDK applications should `await session.aclose()` in `finally`. Closure is
+idempotent, waits for actual child/Goal/extension/MCP cleanup, and reports cleanup
+errors only after attempting the other resources. Cancellation of a waiter does
+not abandon the underlying close. `session.dispose()` requests the same close
+and returns a concurrent Future; synchronous applications can wait on `.result()`.
+Do not block an asynchronous caller loop with `.result()`; await `aclose()` instead.
+Synchronous construction and controls can be called with `asyncio.to_thread` when
+used from an async application. A receiver accepting a queued message does not
+require message approval; existing approval applies to tool execution only.
+
+Automatic project instructions come **only** from the working directory's
+`AGENTS.md`, `.coding/INSTRUCTIONS.md` and `.coding/instructions.md`. There is no
+parent walk. Other harness configuration files are not automatic instruction
+sources; they remain ordinary files that users can explicitly read or attach under
+normal file-access and permission rules. There is no filename denylist.
+Each automatic source must be a regular UTF-8 file of at most 64 KiB; symlinks,
+special files and unreadable/oversized sources cause an explicit preparation error. Missing files are optional. These
+instructions are refreshed in owned off-loop preparation before a turn, reach the
+actual model prompt, and never grant tool permissions. The Agent alone renders
+skill indexes and session/turn-scoped bodies; loading a skill starts no observer,
+model, receiver or daemon.
+
+`CreateSessionOptions.thinking_level` is honored, including explicit `"off"`.
+Initial `allowed_tools` configuration is a **tool selection**, not authorization:
+absent/null falls through to a lower layer, `[]` selects no tools, and a nonempty
+list selects those configured names. Caller options/overrides take precedence
+over saved explicit choices, then project and global configuration. Choices are
+not unioned. Unavailable saved names do not create tools or gain authority later;
+normal permission checks still apply to the selected tools.
+
+The separate input history ledger has a common **64 MiB** read/write bound.
+Admission reserves final-state, batch-ID and bounded diagnostic space for every
+unfinished input; if it cannot fit, it is refused before acknowledgement. Errors
+retain up to 4096 characters with an explicit truncation marker; batch IDs are
+limited to 256 UTF-8 bytes. Accepted execution facts are never silently deleted.
+At capacity, explicitly start another session rather than automatically archiving
+or replaying requests. Recovery marks unfinished execution interrupted and never
+replays potentially executed tool effects automatically.
+
+Ordinary turn history uses one immutable, original-owner disk commit, off the
+model loop, before publishing saved state and completing producer receipts.
+File replacement synchronizes the file and parent directory. A failed or
+uncertain history commit retains the live executed tail and fences further turns;
+close and explicitly reload/inspect the saved state before continuing. Concurrent
+metadata revision conflicts fail closed instead of overwriting newer facts.
+These are local filesystem/process guarantees, not hardware power-loss
+exactly-once execution or an OS security sandbox. No existing user data is migrated
+or discarded automatically.
+
+Enabled extensions may declare a public slash name. The packaged `goal_ui`
+display exposes `/goals [GOAL_ID | page OFFSET]`; `/goal` remains the skill name.
+This is generic extension routing, not a Coding-specific Goal command. Public
+names appear in help/completion and cannot shadow builtin or skill commands;
+model tool names and permissions do not change. See
+`docs/extension-public-commands.md` for the shared Coding/Claw contract.

{xdog_coding-2.4.3 → xdog_coding-2.4.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "xdog-coding"
-version = "2.4.3"
+version = "2.4.4"
 description = "Interactive coding agent CLI"
 requires-python = ">=3.12"
 classifiers = [
@@ -22,17 +22,17 @@ readme = "README.md"
 license = "AGPL-3.0-or-later"
 license-files = ["LICENSE", "LICENSE-EXCEPTION.md"]
 dependencies = [
-    "xdog-ai[openai]>=2.4.3",
-    "xdog-agent>=2.4.3",
+    "xdog-ai[openai]>=2.4.4",
+    "xdog-agent>=2.4.4",
     "agent-client-protocol>=0.12.1,<0.13; python_version < '3.15'",
-    "xdog-tui>=2.4.3",
+    "xdog-tui>=2.4.4",
     "pyyaml>=6.0",
     "click>=8.1.0",
     "pydantic>=2.0",
 ]
 
 [project.optional-dependencies]
-skills = ["xdog-skills>=2.4.3"]
+skills = ["xdog-skills>=2.4.4"]
 
 [project.urls]
 Homepage = "https://xdog.942295.xyz"

{xdog_coding-2.4.3 → xdog_coding-2.4.4}/src/xdog/coding/__init__.py

@@ -1,3 +1,3 @@
 """coding - Interactive coding agent CLI."""
 
-__version__ = "2.4.3"
+__version__ = "2.4.4"

{xdog_coding-2.4.3 → xdog_coding-2.4.4}/src/xdog/coding/acp/backend.py

@@ -89,17 +89,19 @@ class CodingBackend:
         try:
             session = await asyncio.shield(task)
         except asyncio.CancelledError:
-            session = await task
-            session.dispose()
+            from xdog.agent.async_work import wait_owned
+            async def settle_construction() -> None:
+                late_session = await task
+                await late_session.aclose()
+            await wait_owned(asyncio.create_task(settle_construction(), name='coding-acp-canceled-construction'))
             raise
-        runtime = SessionRuntime(session, bound=False, router=self.router)
-        runtime.start()
         try:
+            runtime = SessionRuntime(session, bound=False, router=self.router)
+            runtime.start()
             from xdog.coding.acp.server import serve_local
-
             server = await serve_local(runtime)
         except BaseException:
-            await asyncio.wrap_future(runtime.close())
+            await session.aclose()
             raise
         self._owned[session.session_id] = peer.id, runtime, server
         ref = SessionRef(session.session_id, session.working_dir, runtime.controller.generation)
@@ -300,31 +302,51 @@ class CodingBackend:
                 await asyncio.wrap_future(running.controller.cancel(running.ticket.id, peer_id=peer.id))
 
     async def disconnect(self, peer: Peer) -> None:
-        await self._inbox.disconnect(peer)
+        from functools import partial
+
+        from xdog.agent.async_work import settle_cleanup
         pending = tuple(row for key, row in self._running.items() if key[0] == peer.id)
-        for row in pending:
-            if row.ticket is None and not row.task.cancelling():
-                row.task.cancel()
-        for controller in {row.controller for row in pending}:
-            await asyncio.wrap_future(controller.disconnect(peer.id))
-        tasks = [row.task for row in pending if row.task is not asyncio.current_task()]
-        if tasks:
-            for task in tasks:
-                if not task.done() and not task.cancelling():
-                    task.cancel()
-            await asyncio.gather(*tasks, return_exceptions=True)
-        for key, remote in tuple(self._remote.items()):
-            if key[0] == peer.id:
-                await remote.close()
-                del self._remote[key]
-        for identifier, (owner, runtime, server) in tuple(self._owned.items()):
-            if owner == peer.id:
-                await server.close()
-                await asyncio.wrap_future(runtime.close())
-                del self._owned[identifier]
-        for key in tuple(self._refs):
-            if key[0] == peer.id:
-                del self._refs[key]
+        async def ingress() -> None:
+            await self._inbox.disconnect(peer)
+        async def requests() -> None:
+            for row in pending:
+                if row.ticket is None and not row.task.cancelling():
+                    row.task.cancel()
+            async def disconnect(controller: SessionController) -> None:
+                await asyncio.wrap_future(controller.disconnect(peer.id))
+            async def join() -> None:
+                tasks = [row.task for row in pending if row.task is not asyncio.current_task()]
+                for task in tasks:
+                    if not task.done() and not task.cancelling():
+                        task.cancel()
+                if tasks:
+                    await asyncio.gather(*tasks, return_exceptions=True)
+            controllers = {row.controller for row in pending}
+            await settle_cleanup(*(partial(disconnect, controller) for controller in controllers),
+                                 join, message='ACP request retirement failed')
+        async def remote(key: tuple[str, str], attachment: AcpAttachment) -> None:
+            try:
+                await attachment.close()
+            finally:
+                self._remote.pop(key, None)
+        async def owned(identifier: str, runtime: SessionRuntime) -> None:
+            try:
+                # The session owns its CURRENT endpoint too. Closing the saved
+                # old endpoint first would bypass all remaining resource cleanup.
+                await runtime.session.aclose()
+            finally:
+                if runtime.session._lease is None:
+                    self._owned.pop(identifier, None)
+        async def references() -> None:
+            for key in tuple(self._refs):
+                if key[0] == peer.id:
+                    self._refs.pop(key, None)
+        owned_sessions = tuple(self._owned.items())
+        await settle_cleanup(ingress, requests,
+            *(partial(remote, key, attachment) for key, attachment in tuple(self._remote.items()) if key[0] == peer.id),
+            *(partial(owned, identifier, runtime) for identifier, (owner, runtime, _server) in owned_sessions
+              if owner == peer.id), references, message='ACP peer cleanup failed')
+
     async def extension(self, peer: Peer, method: str, params: dict[str, Any]) -> dict[str, Any]:
         if method in {'xdog/enqueue', 'xdog/inbox_status'}:
             target = params.get('session_id')

{xdog_coding-2.4.3 → xdog_coding-2.4.4}/src/xdog/coding/acp/server.py

@@ -22,6 +22,7 @@ class LocalServer:
         self.identity: tuple[int, int] | None = None
         self.server: asyncio.AbstractServer | None = None
         self.closing = False
+        self._closing: asyncio.Task[None] | None = None
         self.writers: set[asyncio.StreamWriter] = set()
         self.tasks: set[asyncio.Task[None]] = set()
 
@@ -47,24 +48,38 @@ class LocalServer:
             await writer.wait_closed()
 
     async def close(self) -> None:
-        self.closing = True
-        if self.server is not None:
-            self.server.close()
-        for writer in tuple(self.writers):
-            writer.close()
-        if self.server is not None:
-            # Python >=3.12 waits for client transports too; close them first.
-            await self.server.wait_closed()
-            self.server = None
-        if self.tasks:
-            await asyncio.gather(*tuple(self.tasks), return_exceptions=True)
-        path = self.record.address
-        if path.exists():
-            info = path.lstat()
-            if (stat.S_ISSOCK(info.st_mode) and info.st_uid == os.getuid()
-                    and (info.st_dev, info.st_ino) == self.identity):
-                path.unlink()
-        self.runtime.registry.remove(self.record)
+        from xdog.agent.async_work import wait_owned
+        if self._closing is None:
+            self.closing = True
+            self._closing = asyncio.create_task(self._close(), name='coding-endpoint-close')
+        await wait_owned(self._closing)
+
+    async def _close(self) -> None:
+        from xdog.agent.async_work import settle_cleanup
+        from xdog.coding.core.session_lifecycle import settle_sync
+        async def transports() -> None:
+            steps = [writer.close for writer in tuple(self.writers)]
+            if self.server is not None:
+                steps.insert(0, self.server.close)
+            settle_sync(*steps, message='ACP transport close failed')
+        async def server() -> None:
+            if self.server is not None:
+                await self.server.wait_closed()
+                self.server = None
+        async def peers() -> None:
+            if self.tasks:
+                # Disconnect/request errors are peer outcomes, not cleanup errors.
+                await asyncio.gather(*tuple(self.tasks), return_exceptions=True)
+        async def unlink() -> None:
+            path = self.record.address
+            if path.exists():
+                info = path.lstat()
+                if (stat.S_ISSOCK(info.st_mode) and info.st_uid == os.getuid()
+                        and (info.st_dev, info.st_ino) == self.identity):
+                    path.unlink()
+        async def registry() -> None:
+            self.runtime.registry.remove(self.record)
+        await settle_cleanup(transports, server, peers, unlink, registry, message='ACP endpoint cleanup failed')
 
 
 async def serve_local(runtime: SessionRuntime) -> LocalServer:

{xdog_coding-2.4.3 → xdog_coding-2.4.4}/src/xdog/coding/config.py

@@ -21,6 +21,20 @@ from typing import Any
 from pydantic import BaseModel, Field, field_validator
 
 
+class InvalidToolSelection(ValueError):
+    """Explicit invalid tool selection must not silently become all tools."""
+
+
+def validate_tool_selection(value: object) -> tuple[str, ...] | None:
+    if value is None:
+        return None
+    from xdog.agent.extensions.active_tools import names
+    try:
+        return names(value)
+    except (TypeError, ValueError) as exc:
+        raise InvalidToolSelection('allowed_tools must be a list of distinct tool names or null') from exc
+
+
 class InvalidBatchLimit(ValueError):
     """An explicit malformed owner setting must not fall back silently."""
 
@@ -37,7 +51,7 @@ def validate_max_messages_per_turn(value: object) -> int:
 
 MONOREPO_NAME = "xdog"
 APP_NAME = "coding"
-VERSION = "2.4.3"
+VERSION = "2.4.4"
 PROJECT_DIR_NAME = ".coding"
 ENV_OVERRIDE = "CODING_DIR"
 
@@ -202,7 +216,7 @@ class GlobalConfig(BaseModel):
     child_presets: Any = Field(default_factory=dict)
     mcp_servers: dict[str, Any] = Field(default_factory=dict)
     mcp_credential_backend: Any = 'file'  # Validated at the host boundary; never defaults on an invalid native choice.
-    allowed_tools: list[str] = Field(default_factory=list)
+    allowed_tools: list[str] | None = None
     custom_instructions: str = ""
 
     @classmethod
@@ -215,8 +229,10 @@ class GlobalConfig(BaseModel):
             raw = json.loads(target.read_text(encoding="utf-8"))
             if isinstance(raw, dict) and 'max_messages_per_turn' in raw:
                 validate_max_messages_per_turn(raw['max_messages_per_turn'])
+            if isinstance(raw, dict) and 'allowed_tools' in raw:
+                validate_tool_selection(raw['allowed_tools'])
             return cls.model_validate(raw)
-        except InvalidBatchLimit:
+        except (InvalidBatchLimit, InvalidToolSelection):
             raise
         except Exception:
             return cls()
@@ -248,7 +264,7 @@ class ProjectConfig(BaseModel):
     model: str | None = None
     thinking_level: str | None = None
     permission_mode: str | None = None
-    allowed_tools: list[str] = Field(default_factory=list)
+    allowed_tools: list[str] | None = None
     custom_instructions: str = ""
     extensions: list[str] = Field(default_factory=list)
     mcp_servers: dict[str, Any] = Field(default_factory=dict)
@@ -262,8 +278,10 @@ class ProjectConfig(BaseModel):
             raw = json.loads(target.read_text(encoding="utf-8"))
             if isinstance(raw, dict) and 'max_messages_per_turn' in raw:
                 validate_max_messages_per_turn(raw['max_messages_per_turn'])
+            if isinstance(raw, dict) and 'allowed_tools' in raw:
+                validate_tool_selection(raw['allowed_tools'])
             return cls.model_validate(raw)
-        except InvalidBatchLimit:
+        except (InvalidBatchLimit, InvalidToolSelection):
             raise
         except Exception:
             return cls()
@@ -280,7 +298,7 @@ class RuntimeConfig:
     model: str
     thinking_level: str
     permission_mode: str
-    allowed_tools: tuple[str, ...]
+    allowed_tools: tuple[str, ...] | None
     custom_instructions: str
     extensions: tuple[str, ...]
     working_dir: str
@@ -295,19 +313,23 @@ class RuntimeConfig:
         project_cfg: ProjectConfig | None = None,
         working_dir: Path | None = None,
         overrides: dict[str, Any] | None = None,
+        session_settings: dict[str, Any] | None = None,
     ) -> RuntimeConfig:
         """Merge global, project and CLI overrides into a single config."""
         ov = overrides or {}
         pcfg = project_cfg or ProjectConfig()
-        model = ov.get("model") or pcfg.model or global_cfg.default_model
-        thinking = ov.get("thinking_level") or pcfg.thinking_level or global_cfg.thinking_level
+        saved = session_settings or {}
+        model = ov.get('model') or saved.get('model') or pcfg.model or global_cfg.default_model
+        thinking = (ov.get('thinking_level') or saved.get('thinking_level')
+                    or pcfg.thinking_level or global_cfg.thinking_level)
         permission_mode = (
             ov.get("permission_mode")
             or pcfg.permission_mode
             or global_cfg.permission_mode
         )
 
-        merged_tools = list(global_cfg.allowed_tools) + list(pcfg.allowed_tools)
+        selection = next((value for value in (ov.get('allowed_tools'), saved.get('allowed_tools'),
+                         pcfg.allowed_tools, global_cfg.allowed_tools) if value is not None), None)
         merged_ext = list(global_cfg.extensions) + list(pcfg.extensions)
 
         instructions_parts: list[str] = []
@@ -320,13 +342,14 @@ class RuntimeConfig:
             model=model,
             thinking_level=thinking,
             permission_mode=permission_mode,
-            allowed_tools=tuple(merged_tools),
+            allowed_tools=validate_tool_selection(selection),
             custom_instructions="\n\n".join(instructions_parts),
             extensions=tuple(merged_ext),
             working_dir=str(working_dir or Path.cwd()),
             platform_info=PlatformInfo.detect(),
             max_messages_per_turn=validate_max_messages_per_turn(
                 ov['max_messages_per_turn'] if 'max_messages_per_turn' in ov else
+                saved['max_messages_per_turn'] if 'max_messages_per_turn' in saved else
                 pcfg.max_messages_per_turn if pcfg.max_messages_per_turn is not None else
                 global_cfg.max_messages_per_turn),
         )