fix(ci): run all test jobs when invoked via workflow_call

When staging-ci.yml calls test.yml as a reusable workflow, the event
name is the caller's event (workflow_dispatch/schedule), not push or
pull_request. This caused telegram-tests, windows-build, wasm-wit-compat,
and docker-build to be skipped during staging promotion.

Add github.event_name == 'workflow_call' to each gated job's condition.

[skip-regression-check]

Co-Authored-By: Claude Opus 4.6 <[email protected]>

.env.example

@@ -115,6 +115,8 @@ AGENT_NAME=ironclaw
 AGENT_MAX_PARALLEL_JOBS=5
 AGENT_JOB_TIMEOUT_SECS=3600
 AGENT_STUCK_THRESHOLD_SECS=300
+# Maximum tokens per job (0 = unlimited, also settable via settings.json agent.max_tokens_per_job)
+# AGENT_MAX_TOKENS_PER_JOB=0
 # Enable planning phase before tool execution (default: true)
 AGENT_USE_PLANNING=true
 

.github/workflows/test.yml

@@ -43,6 +43,7 @@ jobs:
     name: Telegram Channel Tests
     if: >
       github.event_name == 'push' ||
+      github.event_name == 'workflow_call' ||
       (github.event_name == 'pull_request' && github.base_ref != 'staging')
     runs-on: ubuntu-latest
     steps:
@@ -58,6 +59,7 @@ jobs:
     name: Windows Build (${{ matrix.name }})
     if: >
       github.event_name == 'push' ||
+      github.event_name == 'workflow_call' ||
       (github.event_name == 'pull_request' && github.base_ref != 'staging')
     runs-on: windows-latest
     strategy:
@@ -85,6 +87,7 @@ jobs:
     name: WASM WIT Compatibility
     if: >
       github.event_name == 'push' ||
+      github.event_name == 'workflow_call' ||
       (github.event_name == 'pull_request' && github.base_ref != 'staging')
     runs-on: ubuntu-latest
     steps:
@@ -108,6 +111,7 @@ jobs:
     name: Docker Build
     if: >
       github.event_name == 'push' ||
+      github.event_name == 'workflow_call' ||
       (github.event_name == 'pull_request' && github.base_ref != 'staging')
     runs-on: ubuntu-latest
     steps:

CHANGELOG.md

@@ -7,81 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.17.0](https://github.com/nearai/ironclaw/compare/v0.16.1...v0.17.0) - 2026-03-10
-
-### Added
-
-- *(llm)* per-provider unsupported parameter filtering (#749, #728) ([#809](https://github.com/nearai/ironclaw/pull/809))
-- persist user_id in save_job and expose job_id on routine runs ([#709](https://github.com/nearai/ironclaw/pull/709))
-- *(ci)* chained promotion PRs with multi-agent Claude review ([#776](https://github.com/nearai/ironclaw/pull/776))
-- add background sandbox reaper for orphaned Docker containers ([#634](https://github.com/nearai/ironclaw/pull/634))
-- *(wasm)* lazy schema injection on WASM tool errors ([#638](https://github.com/nearai/ironclaw/pull/638))
-- add AWS Bedrock LLM provider via native Converse API ([#713](https://github.com/nearai/ironclaw/pull/713))
-- full image support across all channels ([#725](https://github.com/nearai/ironclaw/pull/725))
-- *(skills)* exclude_keywords veto in skill activation scoring ([#688](https://github.com/nearai/ironclaw/pull/688))
-- *(mcp)* transport abstraction, stdio/UDS transports, and OAuth fixes ([#721](https://github.com/nearai/ironclaw/pull/721))
-- add PID-based gateway lock to prevent multiple instances ([#717](https://github.com/nearai/ironclaw/pull/717))
-- configurable LLM request timeout via LLM_REQUEST_TIMEOUT_SECS ([#615](https://github.com/nearai/ironclaw/pull/615)) ([#630](https://github.com/nearai/ironclaw/pull/630))
-- *(timezone)* add timezone-aware session context ([#671](https://github.com/nearai/ironclaw/pull/671))
-- *(setup)* Anthropic OAuth onboarding with setup-token support ([#384](https://github.com/nearai/ironclaw/pull/384))
-- *(llm)* add Google Gemini, AWS Bedrock, io.net, Mistral, Yandex, and Cloudflare WS AI providers ([#676](https://github.com/nearai/ironclaw/pull/676))
-- unified thread model for web gateway ([#607](https://github.com/nearai/ironclaw/pull/607))
-- WASM channel attachments with LLM pipeline integration ([#596](https://github.com/nearai/ironclaw/pull/596))
-- enable Anthropic prompt caching via automatic cache_control injection ([#660](https://github.com/nearai/ironclaw/pull/660))
-- *(routines)* approval context for autonomous job execution ([#577](https://github.com/nearai/ironclaw/pull/577))
-- *(llm)* declarative provider registry ([#618](https://github.com/nearai/ironclaw/pull/618))
-- *(gateway)* show IronClaw version in status popover [skip-regression-check] ([#636](https://github.com/nearai/ironclaw/pull/636))
-- Wire memory hygiene retention policy into heartbeat loop ([#629](https://github.com/nearai/ironclaw/pull/629))
-
-### Fixed
-
-- *(ci)* run fmt + clippy on staging PRs, skip Windows clippy [skip-regression-check] ([#802](https://github.com/nearai/ironclaw/pull/802))
-- *(ci)* clean up staging pipeline — remove hacks, skip redundant checks [skip-regression-check] ([#794](https://github.com/nearai/ironclaw/pull/794))
-- *(ci)* secrets can't be used in step if conditions [skip-regression-check] ([#787](https://github.com/nearai/ironclaw/pull/787))
-- prevent irreversible context loss when compaction archive write fails ([#754](https://github.com/nearai/ironclaw/pull/754))
-- button styles ([#637](https://github.com/nearai/ironclaw/pull/637))
-- *(mcp)* JSON-RPC spec compliance — flexible id, correct notification format ([#685](https://github.com/nearai/ironclaw/pull/685))
-- preserve tool-call history across thread hydration ([#568](https://github.com/nearai/ironclaw/pull/568)) ([#670](https://github.com/nearai/ironclaw/pull/670))
-- CLI commands ignore runtime DATABASE_BACKEND when both features compiled ([#740](https://github.com/nearai/ironclaw/pull/740))
-- *(web)* prevent fetch error when hostname is an IP address in TEE check ([#672](https://github.com/nearai/ironclaw/pull/672))
-- add timezone conversion support to time tool ([#687](https://github.com/nearai/ironclaw/pull/687))
-- standardize libSQL timestamps as RFC 3339 UTC ([#683](https://github.com/nearai/ironclaw/pull/683))
-- *(docker)* bind postgres to localhost only ([#686](https://github.com/nearai/ironclaw/pull/686))
-- *(repl)* skip /quit on EOF when stdin is not a TTY ([#724](https://github.com/nearai/ironclaw/pull/724))
-- *(web)* prevent Enter key from sending message during IME composition ([#715](https://github.com/nearai/ironclaw/pull/715))
-- *(config)* init_secrets no longer overwrites entire config ([#726](https://github.com/nearai/ironclaw/pull/726))
-- *(cli)* status command ignores config.toml and settings.json ([#354](https://github.com/nearai/ironclaw/pull/354)) ([#734](https://github.com/nearai/ironclaw/pull/734))
-- *(setup)* preserve model name when re-running onboarding with same provider ([#600](https://github.com/nearai/ironclaw/pull/600)) ([#694](https://github.com/nearai/ironclaw/pull/694))
-- *(setup)* initialize secrets crypto for env-var security option ([#666](https://github.com/nearai/ironclaw/pull/666)) ([#706](https://github.com/nearai/ironclaw/pull/706))
-- persist /model selection across restarts ([#707](https://github.com/nearai/ironclaw/pull/707))
-- *(routines)* resolve message tool channel/target from per-job metadata ([#708](https://github.com/nearai/ironclaw/pull/708))
-- sanitize HTML error bodies from MCP servers to prevent web UI white screen ([#263](https://github.com/nearai/ironclaw/pull/263)) ([#656](https://github.com/nearai/ironclaw/pull/656))
-- prevent Instant duration overflow on Windows ([#657](https://github.com/nearai/ironclaw/pull/657)) ([#664](https://github.com/nearai/ironclaw/pull/664))
-- enable libsql remote + tls features for Turso cloud sync ([#587](https://github.com/nearai/ironclaw/pull/587))
-- *(tests)* replace hardcoded /tmp paths with tempdir + add 300 unit tests ([#659](https://github.com/nearai/ironclaw/pull/659))
-- *(llm)* nudge LLM when it expresses tool intent without calling tools ([#653](https://github.com/nearai/ironclaw/pull/653))
-- *(llm)* report zero cost for OpenRouter free-tier models ([#463](https://github.com/nearai/ironclaw/pull/463)) ([#613](https://github.com/nearai/ironclaw/pull/613))
-- reliable network tests and improved tool error messages ([#626](https://github.com/nearai/ironclaw/pull/626))
-- *(wasm)* use per-engine cache dirs on Windows to avoid file lock error ([#624](https://github.com/nearai/ironclaw/pull/624))
-- *(libsql)* support flexible embedding dimensions ([#534](https://github.com/nearai/ironclaw/pull/534))
-
-### Other
-
-- Restructure CLAUDE.md into modular rules + add pr-shepherd command ([#750](https://github.com/nearai/ironclaw/pull/750))
-- make src/llm/ self-contained for crate extraction ([#767](https://github.com/nearai/ironclaw/pull/767))
-- add simplified Chinese (zh-CN) README translation ([#488](https://github.com/nearai/ironclaw/pull/488))
-- *(job)* cover job tool validation and state transitions ([#681](https://github.com/nearai/ironclaw/pull/681))
-- *(agent)* wire TestRig job tools through the scheduler ([#716](https://github.com/nearai/ironclaw/pull/716))
-- Fix single-message mode to exit after one turn when background channels are enabled ([#719](https://github.com/nearai/ironclaw/pull/719))
-- remove dead code ([#648](https://github.com/nearai/ironclaw/pull/648)) ([#703](https://github.com/nearai/ironclaw/pull/703))
-- add reviewer-feedback guardrails (CLAUDE.md, pre-commit hook, skill) ([#665](https://github.com/nearai/ironclaw/pull/665))
-- update WASM artifact SHA256 checksums [skip ci] ([#631](https://github.com/nearai/ironclaw/pull/631))
-- add explanatory comments to coverage workflow ([#610](https://github.com/nearai/ironclaw/pull/610))
-- build system prompt once per turn, skip tools on force-text ([#583](https://github.com/nearai/ironclaw/pull/583))
-- add comprehensive subdirectory CLAUDE.md files and update root ([#589](https://github.com/nearai/ironclaw/pull/589))
-- Improve test infrastructure: StubChannel, gateway helpers, security tests, search edge cases ([#623](https://github.com/nearai/ironclaw/pull/623))
-- *(workspace)* regression test for document_path in search results ([#509](https://github.com/nearai/ironclaw/pull/509))
-
 ### Added
 
 - AWS Bedrock LLM provider via native Converse API with IAM and SSO auth support (feature-gated: `--features bedrock`)

Cargo.lock

@@ -3350,7 +3350,7 @@ dependencies = [
 
 [[package]]
 name = "ironclaw"
-version = "0.17.0"
+version = "0.16.1"
 dependencies = [
  "aes-gcm",
  "aho-corasick",

Cargo.toml

@@ -18,7 +18,7 @@ exclude = [
 
 [package]
 name = "ironclaw"
-version = "0.17.0"
+version = "0.16.1"
 edition = "2024"
 rust-version = "1.92"
 description = "Secure personal AI assistant that protects your data and expands its capabilities on the fly"

providers.json

@@ -9,9 +9,8 @@
     "api_key_required": true,
     "base_url_env": "OPENAI_BASE_URL",
     "model_env": "OPENAI_MODEL",
-    "default_model": "gpt-5-mini",
+    "default_model": "gpt-4o",
     "description": "OpenAI GPT models (direct API)",
-    "unsupported_params": ["temperature"],
     "setup": {
       "kind": "api_key",
       "secret_name": "llm_openai_api_key",
@@ -87,7 +86,6 @@
     "model_env": "TINFOIL_MODEL",
     "default_model": "kimi-k2-5",
     "description": "Tinfoil private inference (hardware-attested TEE)",
-    "unsupported_params": ["temperature"],
     "setup": {
       "kind": "api_key",
       "secret_name": "llm_tinfoil_api_key",

src/agent/dispatcher.rs

@@ -1205,6 +1205,7 @@ mod tests {
                 max_tool_iterations: 50,
                 auto_approve_tools: false,
                 default_timezone: "UTC".to_string(),
+                max_tokens_per_job: 0,
             },
             deps,
             Arc::new(ChannelManager::new()),
@@ -1263,6 +1264,96 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_always_approval_requirement_bypasses_session_auto_approve() {
+        // Regression test: even if tool is auto-approved in session,
+        // ApprovalRequirement::Always must still trigger approval.
+        use crate::tools::ApprovalRequirement;
+
+        let mut session = Session::new("user-1");
+        let tool_name = "tool_remove";
+
+        // Manually auto-approve tool_remove in this session
+        session.auto_approve_tool(tool_name);
+        assert!(
+            session.is_tool_auto_approved(tool_name),
+            "tool should be auto-approved"
+        );
+
+        // However, ApprovalRequirement::Always should always require approval
+        // This is verified by the dispatcher logic: Always => true (ignores session state)
+        let always_req = ApprovalRequirement::Always;
+        let requires_approval = match always_req {
+            ApprovalRequirement::Never => false,
+            ApprovalRequirement::UnlessAutoApproved => !session.is_tool_auto_approved(tool_name),
+            ApprovalRequirement::Always => true,
+        };
+
+        assert!(
+            requires_approval,
+            "ApprovalRequirement::Always must require approval even when tool is auto-approved"
+        );
+    }
+
+    #[test]
+    fn test_always_approval_requirement_vs_unless_auto_approved() {
+        // Verify the two requirements behave differently
+        use crate::tools::ApprovalRequirement;
+
+        let mut session = Session::new("user-2");
+        let tool_name = "http";
+
+        // Scenario 1: Tool is auto-approved
+        session.auto_approve_tool(tool_name);
+
+        // UnlessAutoApproved → doesn't require approval if auto-approved
+        let unless_req = ApprovalRequirement::UnlessAutoApproved;
+        let unless_needs = match unless_req {
+            ApprovalRequirement::Never => false,
+            ApprovalRequirement::UnlessAutoApproved => !session.is_tool_auto_approved(tool_name),
+            ApprovalRequirement::Always => true,
+        };
+        assert!(
+            !unless_needs,
+            "UnlessAutoApproved should not need approval when auto-approved"
+        );
+
+        // Always → always requires approval
+        let always_req = ApprovalRequirement::Always;
+        let always_needs = match always_req {
+            ApprovalRequirement::Never => false,
+            ApprovalRequirement::UnlessAutoApproved => !session.is_tool_auto_approved(tool_name),
+            ApprovalRequirement::Always => true,
+        };
+        assert!(
+            always_needs,
+            "Always must always require approval, even when auto-approved"
+        );
+
+        // Scenario 2: Tool is NOT auto-approved
+        let new_tool = "new_tool";
+        assert!(!session.is_tool_auto_approved(new_tool));
+
+        // UnlessAutoApproved → requires approval
+        let unless_needs = match unless_req {
+            ApprovalRequirement::Never => false,
+            ApprovalRequirement::UnlessAutoApproved => !session.is_tool_auto_approved(new_tool),
+            ApprovalRequirement::Always => true,
+        };
+        assert!(
+            unless_needs,
+            "UnlessAutoApproved should need approval when not auto-approved"
+        );
+
+        // Always → always requires approval
+        let always_needs = match always_req {
+            ApprovalRequirement::Never => false,
+            ApprovalRequirement::UnlessAutoApproved => !session.is_tool_auto_approved(new_tool),
+            ApprovalRequirement::Always => true,
+        };
+        assert!(always_needs, "Always must always require approval");
+    }
+
     #[test]
     fn test_pending_approval_serialization_backcompat_without_deferred_calls() {
         // PendingApproval from before the deferred_tool_calls field was added
@@ -1953,6 +2044,7 @@ mod tests {
                 max_tool_iterations,
                 auto_approve_tools: true,
                 default_timezone: "UTC".to_string(),
+                max_tokens_per_job: 0,
             },
             deps,
             Arc::new(ChannelManager::new()),
@@ -2069,6 +2161,7 @@ mod tests {
                     max_tool_iterations: max_iter,
                     auto_approve_tools: true,
                     default_timezone: "UTC".to_string(),
+                    max_tokens_per_job: 0,
                 },
                 deps,
                 Arc::new(ChannelManager::new()),

src/agent/scheduler.rs

@@ -160,6 +160,13 @@ impl Scheduler {
             .create_job_for_user(user_id, title, description)
             .await?;
 
+        // Apply token budget from config, allowing per-job metadata override.
+        let max_tokens = metadata
+            .as_ref()
+            .and_then(|m| m.get("max_tokens"))
+            .and_then(|v| v.as_u64())
+            .unwrap_or(self.config.max_tokens_per_job);
+
         // Apply metadata if provided
         if let Some(meta) = metadata {
             self.context_manager
@@ -169,6 +176,15 @@ impl Scheduler {
                 .await?;
         }
 
+        // Set token budget (separate update to avoid overwriting metadata)
+        if max_tokens > 0 {
+            self.context_manager
+                .update_context(job_id, |ctx| {
+                    ctx.max_tokens = max_tokens;
+                })
+                .await?;
+        }
+
         // Persist to DB before scheduling so the worker's FK references are valid
         if let Some(ref store) = self.store {
             let ctx = self.context_manager.get_context(job_id).await?;

src/agent/worker.rs

@@ -417,7 +417,8 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
 
             iteration += 1;
             if iteration > max_iterations {
-                self.mark_stuck("Maximum iterations exceeded").await?;
+                self.mark_failed("Maximum iterations exceeded: job hit the iteration cap")
+                    .await?;
                 return Ok(());
             }
 
@@ -437,7 +438,8 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                         "LLM rate limited during tool selection, backing off"
                     );
                     if consecutive_rate_limits >= MAX_CONSECUTIVE_RATE_LIMITS {
-                        self.mark_stuck("Persistent rate limiting").await?;
+                        self.mark_failed("Persistent rate limiting: exceeded retry limit")
+                            .await?;
                         return Ok(());
                     }
                     self.log_event(
@@ -467,7 +469,8 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                             "LLM rate limited during respond_with_tools, backing off"
                         );
                         if consecutive_rate_limits >= MAX_CONSECUTIVE_RATE_LIMITS {
-                            self.mark_stuck("Persistent rate limiting").await?;
+                            self.mark_failed("Persistent rate limiting: exceeded retry limit")
+                                .await?;
                             return Ok(());
                         }
                         self.log_event(
@@ -483,6 +486,20 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                     Err(e) => return Err(e.into()),
                 };
 
+                // Track token usage from LLM call against the job budget.
+                // NOTE: select_tools() also makes LLM calls but doesn't expose
+                // TokenUsage; only respond_with_tools() usage is tracked here.
+                let total_tokens = respond_output.usage.total() as u64;
+                if total_tokens > 0
+                    && let Err(msg) = self
+                        .context_manager()
+                        .update_context(self.job_id, |ctx| ctx.add_tokens(total_tokens))
+                        .await?
+                {
+                    self.mark_failed(&msg).await?;
+                    return Ok(());
+                }
+
                 match respond_output.result {
                     RespondResult::Text(response) => {
                         // Check for explicit completion phrases. Use word-boundary
@@ -1762,4 +1779,84 @@ mod tests {
             "Always tool should be allowed with permission"
         );
     }
+
+    #[tokio::test]
+    async fn test_token_budget_exceeded_fails_job() {
+        let worker = make_worker(vec![]).await;
+
+        // Transition to InProgress (required for mark_failed)
+        worker
+            .context_manager()
+            .update_context(worker.job_id, |ctx| {
+                ctx.transition_to(JobState::InProgress, None)
+            })
+            .await
+            .unwrap()
+            .unwrap();
+
+        // Set a token budget
+        worker
+            .context_manager()
+            .update_context(worker.job_id, |ctx| {
+                ctx.max_tokens = 100;
+            })
+            .await
+            .unwrap();
+
+        // Simulate adding tokens that exceed the budget
+        let budget_result = worker
+            .context_manager()
+            .update_context(worker.job_id, |ctx| ctx.add_tokens(200))
+            .await
+            .unwrap();
+
+        assert!(
+            budget_result.is_err(),
+            "Should return error when token budget exceeded"
+        );
+
+        // Verify that mark_failed transitions job to Failed
+        worker
+            .mark_failed(&budget_result.unwrap_err())
+            .await
+            .unwrap();
+        let ctx = worker
+            .context_manager()
+            .get_context(worker.job_id)
+            .await
+            .unwrap();
+        assert_eq!(ctx.state, JobState::Failed);
+    }
+
+    #[tokio::test]
+    async fn test_iteration_cap_marks_failed_not_stuck() {
+        let worker = make_worker(vec![]).await;
+
+        // Transition to InProgress (required for mark_failed)
+        worker
+            .context_manager()
+            .update_context(worker.job_id, |ctx| {
+                ctx.transition_to(JobState::InProgress, None)
+            })
+            .await
+            .unwrap()
+            .unwrap();
+
+        // Simulate what the execution loop does when max_iterations is exceeded
+        worker
+            .mark_failed("Maximum iterations exceeded: job hit the iteration cap")
+            .await
+            .unwrap();
+
+        let ctx = worker
+            .context_manager()
+            .get_context(worker.job_id)
+            .await
+            .unwrap();
+        assert_eq!(
+            ctx.state,
+            JobState::Failed,
+            "Iteration cap should transition to Failed, not Stuck"
+        );
+    }
 }

src/channels/web/handlers/jobs.rs

@@ -276,11 +276,25 @@ pub async fn jobs_cancel_handler(
         })));
     }
 
-    // Fall back to agent job cancellation via DB status update.
+    // Fall back to agent job cancellation: stop the worker via the scheduler
+    // (which updates the in-memory ContextManager AND aborts the task handle),
+    // then persist the status to the DB as a fallback.
     if let Some(ref store) = state.store
         && let Ok(Some(job)) = store.get_job(job_id).await
     {
         if job.state.is_active() {
+            // Try to stop via scheduler (aborts the worker task + updates
+            // in-memory ContextManager). This is best-effort — the job may
+            // not be in the scheduler map if it already finished.
+            if let Some(ref slot) = state.scheduler
+                && let Some(ref scheduler) = *slot.read().await
+            {
+                let _ = scheduler.stop(job_id).await;
+            }
+
+            // Always persist cancellation to the DB so the state is
+            // consistent even if the scheduler wasn't available or the
+            // job wasn't in its in-memory map.
             store
                 .update_job_status(
                     job_id,

src/config/agent.rs

@@ -29,6 +29,8 @@ pub struct AgentConfig {
     pub auto_approve_tools: bool,
     /// Default timezone for new sessions (IANA name, e.g. "America/New_York").
     pub default_timezone: String,
+    /// Maximum tokens per job (0 = unlimited).
+    pub max_tokens_per_job: u64,
 }
 
 impl AgentConfig {
@@ -50,6 +52,7 @@ impl AgentConfig {
             max_tool_iterations: 10,
             auto_approve_tools: true,
             default_timezone: "UTC".to_string(),
+            max_tokens_per_job: 0,
         }
     }
 
@@ -105,6 +108,10 @@ impl AgentConfig {
                 }
                 tz
             },
+            max_tokens_per_job: parse_optional_env(
+                "AGENT_MAX_TOKENS_PER_JOB",
+                settings.agent.max_tokens_per_job,
+            )?,
         })
     }
 }

src/config/llm.rs

@@ -209,7 +209,6 @@ impl LlmConfig {
             extra_headers_env,
             api_key_required,
             base_url_required,
-            unsupported_params,
         ) = if let Some(def) = def {
             (
                 def.id.as_str(),
@@ -222,7 +221,6 @@ impl LlmConfig {
                 def.extra_headers_env.as_deref(),
                 def.api_key_required,
                 def.base_url_required,
-                def.unsupported_params.clone(),
             )
         } else {
             // Absolute fallback: treat as generic openai_completions
@@ -237,7 +235,6 @@ impl LlmConfig {
                 Some("LLM_EXTRA_HEADERS"),
                 false,
                 true,
-                Vec::new(),
             )
         };
 
@@ -341,7 +338,6 @@ impl LlmConfig {
             extra_headers,
             oauth_token,
             cache_retention,
-            unsupported_params,
         })
     }
 }
@@ -628,12 +624,6 @@ mod tests {
         let provider = cfg.provider.expect("provider config should be present");
         assert_eq!(provider.base_url, "https://inference.tinfoil.sh/v1");
         assert_eq!(provider.model, "kimi-k2-5");
-        assert!(
-            provider
-                .unsupported_params
-                .contains(&"temperature".to_string()),
-            "tinfoil should propagate unsupported_params from registry"
-        );
     }
 
     #[test]

src/llm/anthropic_oauth.rs

@@ -6,8 +6,6 @@
 //!
 //! Pattern follows `nearai_chat.rs`: direct HTTP calls via `reqwest::Client`.
 
-use std::collections::HashSet;
-
 use async_trait::async_trait;
 use reqwest::Client;
 use rust_decimal::Decimal;
@@ -37,8 +35,6 @@ pub struct AnthropicOAuthProvider {
     model: String,
     base_url: Option<String>,
     active_model: std::sync::RwLock<String>,
-    /// Parameter names that this provider does not support.
-    unsupported_params: HashSet<String>,
 }
 
 impl AnthropicOAuthProvider {
@@ -65,45 +61,15 @@ impl AnthropicOAuthProvider {
             Some(config.base_url.clone())
         };
 
-        let unsupported_params: HashSet<String> =
-            config.unsupported_params.iter().cloned().collect();
-
         Ok(Self {
             client,
             token,
             model: config.model.clone(),
             base_url,
             active_model,
-            unsupported_params,
         })
     }
 
-    /// Strip unsupported fields from a `CompletionRequest` in place.
-    fn strip_unsupported_completion_params(&self, req: &mut CompletionRequest) {
-        if self.unsupported_params.is_empty() {
-            return;
-        }
-        if self.unsupported_params.contains("temperature") {
-            req.temperature = None;
-        }
-        if self.unsupported_params.contains("max_tokens") {
-            req.max_tokens = None;
-        }
-    }
-
-    /// Strip unsupported fields from a `ToolCompletionRequest` in place.
-    fn strip_unsupported_tool_params(&self, req: &mut ToolCompletionRequest) {
-        if self.unsupported_params.is_empty() {
-            return;
-        }
-        if self.unsupported_params.contains("temperature") {
-            req.temperature = None;
-        }
-        if self.unsupported_params.contains("max_tokens") {
-            req.max_tokens = None;
-        }
-    }
-
     fn api_url(&self) -> String {
         if let Some(ref base) = self.base_url {
             let base = base.trim_end_matches('/');
@@ -231,9 +197,8 @@ impl AnthropicOAuthProvider {
 
 #[async_trait]
 impl LlmProvider for AnthropicOAuthProvider {
-    async fn complete(&self, mut req: CompletionRequest) -> Result<CompletionResponse, LlmError> {
-        let model = req.model.take().unwrap_or_else(|| self.active_model_name());
-        self.strip_unsupported_completion_params(&mut req);
+    async fn complete(&self, req: CompletionRequest) -> Result<CompletionResponse, LlmError> {
+        let model = req.model.unwrap_or_else(|| self.active_model_name());
         let (system, messages) = convert_messages(req.messages);
 
         let request = AnthropicRequest {
@@ -268,10 +233,9 @@ impl LlmProvider for AnthropicOAuthProvider {
 
     async fn complete_with_tools(
         &self,
-        mut req: ToolCompletionRequest,
+        req: ToolCompletionRequest,
     ) -> Result<ToolCompletionResponse, LlmError> {
-        let model = req.model.take().unwrap_or_else(|| self.active_model_name());
-        self.strip_unsupported_tool_params(&mut req);
+        let model = req.model.unwrap_or_else(|| self.active_model_name());
         let (system, messages) = convert_messages(req.messages);
 
         let tools: Vec<AnthropicTool> = req

src/llm/config.rs

@@ -87,10 +87,6 @@ pub struct RegistryProviderConfig {
     pub oauth_token: Option<SecretString>,
     /// Prompt cache retention (Anthropic-specific).
     pub cache_retention: CacheRetention,
-    /// Parameter names that this provider does not support (e.g., `["temperature"]`).
-    /// Supported keys: `"temperature"`, `"max_tokens"`, `"stop_sequences"`.
-    /// Listed parameters are stripped from requests before sending to avoid 400 errors.
-    pub unsupported_params: Vec<String>,
 }
 
 /// Configuration for AWS Bedrock (native Converse API).

src/llm/mod.rs

@@ -228,9 +228,7 @@ fn create_openai_compat_from_registry(
         "Using OpenAI-compatible provider"
     );
 
-    let adapter = RigAdapter::new(model, &config.model)
-        .with_unsupported_params(config.unsupported_params.clone());
-    Ok(Arc::new(adapter))
+    Ok(Arc::new(RigAdapter::new(model, &config.model)))
 }
 
 fn create_anthropic_from_registry(
@@ -298,9 +296,7 @@ fn create_anthropic_from_registry(
     );
 
     Ok(Arc::new(
-        RigAdapter::new(model, &config.model)
-            .with_cache_retention(cache_retention)
-            .with_unsupported_params(config.unsupported_params.clone()),
+        RigAdapter::new(model, &config.model).with_cache_retention(cache_retention),
     ))
 }
 
@@ -328,9 +324,7 @@ fn create_ollama_from_registry(
         "Using Ollama provider"
     );
 
-    let adapter = RigAdapter::new(model, &config.model)
-        .with_unsupported_params(config.unsupported_params.clone());
-    Ok(Arc::new(adapter))
+    Ok(Arc::new(RigAdapter::new(model, &config.model)))
 }
 
 /// Create a cheap/fast LLM provider for lightweight tasks (heartbeat, routing, evaluation).

src/llm/registry.rs

@@ -152,11 +152,6 @@ pub struct ProviderDefinition {
     /// Setup wizard hints.
     #[serde(default)]
     pub setup: Option<SetupHint>,
-    /// Parameter names that this provider does not support (e.g., `["temperature"]`).
-    /// Supported keys: `"temperature"`, `"max_tokens"`, `"stop_sequences"`.
-    /// Listed parameters are stripped from requests before sending to avoid 400 errors.
-    #[serde(default)]
-    pub unsupported_params: Vec<String>,
 }
 
 /// Registry of known LLM providers.
@@ -383,7 +378,6 @@ mod tests {
             description: "Custom tinfoil".to_string(),
             extra_headers_env: None,
             setup: None,
-            unsupported_params: vec![],
         });
         let registry = ProviderRegistry::new(all);
         let tf = registry.find("tinfoil").expect("tinfoil should exist");
@@ -523,7 +517,6 @@ mod tests {
             description: "No setup".to_string(),
             extra_headers_env: None,
             setup: None, // no setup hint
-            unsupported_params: vec![],
         }];
 
         let registry = ProviderRegistry::new(providers.clone());
@@ -553,7 +546,6 @@ mod tests {
                 can_list_models: false,
                 models_filter: None,
             }),
-            unsupported_params: vec![],
         });
 
         let registry = ProviderRegistry::new(providers);
@@ -595,7 +587,6 @@ mod tests {
                     can_list_models: false,
                     models_filter: None,
                 }),
-                unsupported_params: vec![],
             },
             // User override removes setup
             ProviderDefinition {
@@ -612,7 +603,6 @@ mod tests {
                 description: "No setup now".to_string(),
                 extra_headers_env: None,
                 setup: None,
-                unsupported_params: vec![],
             },
         ];
 
@@ -650,7 +640,6 @@ mod tests {
                     display_name: "A".to_string(),
                     can_list_models: false,
                 }),
-                unsupported_params: vec![],
             },
             ProviderDefinition {
                 id: "bbb".to_string(),
@@ -669,7 +658,6 @@ mod tests {
                     display_name: "B".to_string(),
                     can_list_models: false,
                 }),
-                unsupported_params: vec![],
             },
             ProviderDefinition {
                 id: "ccc".to_string(),
@@ -688,7 +676,6 @@ mod tests {
                     display_name: "C".to_string(),
                     can_list_models: false,
                 }),
-                unsupported_params: vec![],
             },
             // User override for B
             ProviderDefinition {
@@ -708,7 +695,6 @@ mod tests {
                     display_name: "B".to_string(),
                     can_list_models: false,
                 }),
-                unsupported_params: vec![],
             },
         ];
 
@@ -722,48 +708,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn test_unsupported_params_deserialized() {
-        let providers: Vec<ProviderDefinition> =
-            serde_json::from_str(include_str!("../../providers.json")).unwrap();
-
-        // Tinfoil should have temperature in unsupported_params
-        let tinfoil = providers.iter().find(|p| p.id == "tinfoil").unwrap();
-        assert!(
-            tinfoil
-                .unsupported_params
-                .contains(&"temperature".to_string()),
-            "tinfoil should have 'temperature' in unsupported_params"
-        );
-
-        // OpenAI should also have temperature in unsupported_params
-        let openai = providers.iter().find(|p| p.id == "openai").unwrap();
-        assert!(
-            openai
-                .unsupported_params
-                .contains(&"temperature".to_string()),
-            "openai should have 'temperature' in unsupported_params"
-        );
-
-        // Providers without the field in JSON should deserialize to empty vec
-        let groq = providers.iter().find(|p| p.id == "groq").unwrap();
-        assert!(
-            groq.unsupported_params.is_empty(),
-            "groq should have empty unsupported_params (field absent in JSON)"
-        );
-
-        // Every non-empty entry should contain valid param names
-        for def in &providers {
-            for param in &def.unsupported_params {
-                assert!(
-                    !param.is_empty(),
-                    "{}: unsupported_params contains empty string",
-                    def.id
-                );
-            }
-        }
-    }
-
     #[test]
     fn test_all_builtin_api_key_providers_have_api_key_env() {
         // Every built-in provider with SetupHint::ApiKey must have api_key_env

src/llm/rig_adapter.rs

@@ -42,9 +42,6 @@ pub struct RigAdapter<M: CompletionModel> {
     /// via `additional_params` for Anthropic automatic caching. Also controls
     /// the cost multiplier for cache-creation tokens.
     cache_retention: CacheRetention,
-    /// Parameter names that this provider does not support (e.g., `"temperature"`).
-    /// These are stripped from requests before sending to avoid 400 errors.
-    unsupported_params: HashSet<String>,
 }
 
 impl<M: CompletionModel> RigAdapter<M> {
@@ -59,7 +56,6 @@ impl<M: CompletionModel> RigAdapter<M> {
             input_cost,
             output_cost,
             cache_retention: CacheRetention::None,
-            unsupported_params: HashSet::new(),
         }
     }
 
@@ -88,44 +84,6 @@ impl<M: CompletionModel> RigAdapter<M> {
         }
         self
     }
-
-    /// Set the list of unsupported parameter names for this provider.
-    ///
-    /// Parameters in this set are stripped from requests before sending.
-    /// Supported parameter names: `"temperature"`, `"max_tokens"`, `"stop_sequences"`.
-    pub fn with_unsupported_params(mut self, params: Vec<String>) -> Self {
-        self.unsupported_params = params.into_iter().collect();
-        self
-    }
-
-    /// Strip unsupported fields from a `CompletionRequest` in place.
-    fn strip_unsupported_completion_params(&self, req: &mut CompletionRequest) {
-        if self.unsupported_params.is_empty() {
-            return;
-        }
-        if self.unsupported_params.contains("temperature") {
-            req.temperature = None;
-        }
-        if self.unsupported_params.contains("max_tokens") {
-            req.max_tokens = None;
-        }
-        if self.unsupported_params.contains("stop_sequences") {
-            req.stop_sequences = None;
-        }
-    }
-
-    /// Strip unsupported fields from a `ToolCompletionRequest` in place.
-    fn strip_unsupported_tool_params(&self, req: &mut ToolCompletionRequest) {
-        if self.unsupported_params.is_empty() {
-            return;
-        }
-        if self.unsupported_params.contains("temperature") {
-            req.temperature = None;
-        }
-        if self.unsupported_params.contains("max_tokens") {
-            req.max_tokens = None;
-        }
-    }
 }
 
 // -- Type conversion helpers --
@@ -581,10 +539,7 @@ where
         }
     }
 
-    async fn complete(
-        &self,
-        mut request: CompletionRequest,
-    ) -> Result<CompletionResponse, LlmError> {
+    async fn complete(&self, request: CompletionRequest) -> Result<CompletionResponse, LlmError> {
         if let Some(requested_model) = request.model.as_deref()
             && requested_model != self.model_name.as_str()
         {
@@ -595,8 +550,6 @@ where
             );
         }
 
-        self.strip_unsupported_completion_params(&mut request);
-
         let mut messages = request.messages;
         crate::llm::provider::sanitize_tool_messages(&mut messages);
         let (preamble, history) = convert_messages(&messages);
@@ -646,7 +599,7 @@ where
 
     async fn complete_with_tools(
         &self,
-        mut request: ToolCompletionRequest,
+        request: ToolCompletionRequest,
     ) -> Result<ToolCompletionResponse, LlmError> {
         if let Some(requested_model) = request.model.as_deref()
             && requested_model != self.model_name.as_str()
@@ -658,8 +611,6 @@ where
             );
         }
 
-        self.strip_unsupported_tool_params(&mut request);
-
         let known_tool_names: HashSet<String> =
             request.tools.iter().map(|t| t.name.clone()).collect();
 
@@ -1205,97 +1156,4 @@ mod tests {
         assert!(!supports_prompt_cache("gpt-4o"));
         assert!(!supports_prompt_cache("llama3"));
     }
-
-    #[test]
-    fn test_with_unsupported_params_populates_set() {
-        use rig::client::CompletionClient;
-        use rig::providers::openai;
-
-        let client: openai::Client = openai::Client::builder()
-            .api_key("test-key")
-            .base_url("http://localhost:0")
-            .build()
-            .unwrap();
-        let client = client.completions_api();
-        let model = client.completion_model("test-model");
-        let adapter = RigAdapter::new(model, "test-model")
-            .with_unsupported_params(vec!["temperature".to_string()]);
-
-        assert!(adapter.unsupported_params.contains("temperature"));
-        assert!(!adapter.unsupported_params.contains("max_tokens"));
-    }
-
-    #[test]
-    fn test_strip_unsupported_completion_params() {
-        use rig::client::CompletionClient;
-        use rig::providers::openai;
-
-        let client: openai::Client = openai::Client::builder()
-            .api_key("test-key")
-            .base_url("http://localhost:0")
-            .build()
-            .unwrap();
-        let client = client.completions_api();
-        let model = client.completion_model("test-model");
-        let adapter = RigAdapter::new(model, "test-model").with_unsupported_params(vec![
-            "temperature".to_string(),
-            "stop_sequences".to_string(),
-        ]);
-
-        let mut req = CompletionRequest::new(vec![ChatMessage::user("hi")]);
-        req.temperature = Some(0.7);
-        req.max_tokens = Some(100);
-        req.stop_sequences = Some(vec!["STOP".to_string()]);
-
-        adapter.strip_unsupported_completion_params(&mut req);
-
-        assert!(req.temperature.is_none(), "temperature should be stripped");
-        assert_eq!(req.max_tokens, Some(100), "max_tokens should be preserved");
-        assert!(
-            req.stop_sequences.is_none(),
-            "stop_sequences should be stripped"
-        );
-    }
-
-    #[test]
-    fn test_strip_unsupported_tool_params() {
-        use rig::client::CompletionClient;
-        use rig::providers::openai;
-
-        let client: openai::Client = openai::Client::builder()
-            .api_key("test-key")
-            .base_url("http://localhost:0")
-            .build()
-            .unwrap();
-        let client = client.completions_api();
-        let model = client.completion_model("test-model");
-        let adapter = RigAdapter::new(model, "test-model")
-            .with_unsupported_params(vec!["temperature".to_string(), "max_tokens".to_string()]);
-
-        let mut req = ToolCompletionRequest::new(vec![ChatMessage::user("hi")], vec![]);
-        req.temperature = Some(0.5);
-        req.max_tokens = Some(200);
-
-        adapter.strip_unsupported_tool_params(&mut req);
-
-        assert!(req.temperature.is_none(), "temperature should be stripped");
-        assert!(req.max_tokens.is_none(), "max_tokens should be stripped");
-    }
-
-    #[test]
-    fn test_unsupported_params_empty_by_default() {
-        use rig::client::CompletionClient;
-        use rig::providers::openai;
-
-        let client: openai::Client = openai::Client::builder()
-            .api_key("test-key")
-            .base_url("http://localhost:0")
-            .build()
-            .unwrap();
-        let client = client.completions_api();
-        let model = client.completion_model("test-model");
-        let adapter = RigAdapter::new(model, "test-model");
-
-        assert!(adapter.unsupported_params.is_empty());
-    }
 }

src/settings.rs

@@ -386,6 +386,10 @@ pub struct AgentSettings {
     /// Default timezone for new sessions (IANA name, e.g. "America/New_York").
     #[serde(default = "default_timezone")]
     pub default_timezone: String,
+
+    /// Maximum tokens per job (0 = unlimited).
+    #[serde(default)]
+    pub max_tokens_per_job: u64,
 }
 
 fn default_agent_name() -> String {
@@ -442,6 +446,7 @@ impl Default for AgentSettings {
             max_tool_iterations: default_max_tool_iterations(),
             auto_approve_tools: false,
             default_timezone: default_timezone(),
+            max_tokens_per_job: 0,
         }
     }
 }

src/setup/wizard.rs

@@ -1573,46 +1573,18 @@ impl SetupWizard {
     }
 
     /// Fetch available models from the NEAR AI API.
+    ///
+    /// Uses [`build_nearai_model_fetch_config`] to construct the provider config,
+    /// which reads `NEARAI_API_KEY` from the environment when present.
     async fn fetch_nearai_models(&self) -> Vec<String> {
         let session = match self.session_manager {
             Some(ref s) => Arc::clone(s),
             None => return vec![],
         };
 
-        use crate::config::LlmConfig;
         use crate::llm::create_llm_provider;
 
-        let base_url = std::env::var("NEARAI_BASE_URL")
-            .unwrap_or_else(|_| "https://private.near.ai".to_string());
-        let auth_base_url = std::env::var("NEARAI_AUTH_URL")
-            .unwrap_or_else(|_| "https://private.near.ai".to_string());
-
-        let config = LlmConfig {
-            backend: "nearai".to_string(),
-            session: crate::llm::session::SessionConfig {
-                auth_base_url,
-                session_path: crate::config::llm::default_session_path(),
-            },
-            nearai: crate::config::NearAiConfig {
-                model: "dummy".to_string(),
-                cheap_model: None,
-                base_url,
-                api_key: None,
-                fallback_model: None,
-                max_retries: 3,
-                circuit_breaker_threshold: None,
-                circuit_breaker_recovery_secs: 30,
-                response_cache_enabled: false,
-                response_cache_ttl_secs: 3600,
-                response_cache_max_entries: 1000,
-                failover_cooldown_secs: 300,
-                failover_cooldown_threshold: 3,
-                smart_routing_cascade: true,
-            },
-            provider: None,
-            bedrock: None,
-            request_timeout_secs: 120,
-        };
+        let config = build_nearai_model_fetch_config();
 
         match create_llm_provider(&config, session).await {
             Ok(provider) => match provider.list_models().await {
@@ -3240,6 +3212,52 @@ async fn discover_wasm_channels(dir: &std::path::Path) -> Vec<(String, ChannelCa
 /// Mask an API key for display: show first 6 + last 4 chars.
 ///
 /// Uses char-based indexing to avoid panicking on multi-byte UTF-8.
+/// Build the `LlmConfig` used by `fetch_nearai_models` to list available models.
+///
+/// Reads `NEARAI_API_KEY` from the environment so that users who authenticated
+/// via Cloud API key (option 4) don't get re-prompted during model selection.
+fn build_nearai_model_fetch_config() -> crate::config::LlmConfig {
+    let base_url =
+        std::env::var("NEARAI_BASE_URL").unwrap_or_else(|_| "https://private.near.ai".to_string());
+    let auth_base_url =
+        std::env::var("NEARAI_AUTH_URL").unwrap_or_else(|_| "https://private.near.ai".to_string());
+
+    // If the user authenticated via API key (option 4), the key is stored
+    // as an env var. Pass it through so `resolve_bearer_token()` doesn't
+    // re-trigger the interactive auth prompt.
+    let api_key = std::env::var("NEARAI_API_KEY")
+        .ok()
+        .filter(|k| !k.is_empty())
+        .map(secrecy::SecretString::from);
+
+    crate::config::LlmConfig {
+        backend: "nearai".to_string(),
+        session: crate::llm::session::SessionConfig {
+            auth_base_url,
+            session_path: crate::config::llm::default_session_path(),
+        },
+        nearai: crate::config::NearAiConfig {
+            model: "dummy".to_string(),
+            cheap_model: None,
+            base_url,
+            api_key,
+            fallback_model: None,
+            max_retries: 3,
+            circuit_breaker_threshold: None,
+            circuit_breaker_recovery_secs: 30,
+            response_cache_enabled: false,
+            response_cache_ttl_secs: 3600,
+            response_cache_max_entries: 1000,
+            failover_cooldown_secs: 300,
+            failover_cooldown_threshold: 3,
+            smart_routing_cascade: true,
+        },
+        provider: None,
+        bedrock: None,
+        request_timeout_secs: 120,
+    }
+}
+
 fn mask_api_key(key: &str) -> String {
     let chars: Vec<char> = key.chars().collect();
     if chars.len() < 12 {
@@ -3640,6 +3658,14 @@ mod tests {
     }
 
     impl EnvGuard {
+        fn set(key: &'static str, value: &str) -> Self {
+            let original = std::env::var(key).ok();
+            unsafe {
+                std::env::set_var(key, value);
+            }
+            Self { key, original }
+        }
+
         fn clear(key: &'static str) -> Self {
             let original = std::env::var(key).ok();
             unsafe {
@@ -3787,7 +3813,6 @@ mod tests {
             description: "Custom provider with no setup wizard".to_string(),
             extra_headers_env: None,
             setup: None,
-            unsupported_params: vec![],
         });
         let registry = crate::llm::ProviderRegistry::new(providers);
 
@@ -3827,4 +3852,49 @@ mod tests {
         };
         assert!(settings.secrets_master_key_hex.is_some());
     }
+
+    /// Regression test for #799: `fetch_nearai_models` hardcoded `api_key: None`,
+    /// causing the auth prompt to re-appear during model selection when the user
+    /// had authenticated via NEAR AI Cloud API key (option 4).
+    #[test]
+    fn test_build_nearai_model_fetch_config_picks_up_api_key_env() {
+        use secrecy::ExposeSecret;
+
+        let _guard = EnvGuard::set("NEARAI_API_KEY", "test-cloud-api-key-12345");
+
+        let config = build_nearai_model_fetch_config();
+        assert!(
+            config.nearai.api_key.is_some(),
+            "config should include NEARAI_API_KEY from env"
+        );
+        assert_eq!(
+            config.nearai.api_key.as_ref().unwrap().expose_secret(),
+            "test-cloud-api-key-12345"
+        );
+    }
+
+    /// Regression test for #799: when NEARAI_API_KEY is absent or empty,
+    /// the config should have `api_key: None` (session token path).
+    #[test]
+    fn test_build_nearai_model_fetch_config_none_when_no_api_key() {
+        let _guard = EnvGuard::clear("NEARAI_API_KEY");
+
+        let config = build_nearai_model_fetch_config();
+        assert!(
+            config.nearai.api_key.is_none(),
+            "config should have no api_key when env var is absent"
+        );
+    }
+
+    /// Regression test for #799: empty NEARAI_API_KEY should be treated as absent.
+    #[test]
+    fn test_build_nearai_model_fetch_config_none_when_empty_api_key() {
+        let _guard = EnvGuard::set("NEARAI_API_KEY", "");
+
+        let config = build_nearai_model_fetch_config();
+        assert!(
+            config.nearai.api_key.is_none(),
+            "config should have no api_key when env var is empty"
+        );
+    }
 }

src/tools/builtin/extension_tools.rs

@@ -451,8 +451,8 @@ impl Tool for ToolRemoveTool {
     }
 
     fn description(&self) -> &str {
-        "Remove an installed extension (channel, tool, or MCP server). \
-         Unregisters tools and deletes configuration."
+        "Permanently remove an installed extension (channel, tool, or MCP server) from disk. \
+         This action cannot be undone — the WASM binary and configuration files will be deleted."
     }
 
     fn parameters_schema(&self) -> serde_json::Value {
@@ -492,7 +492,7 @@ impl Tool for ToolRemoveTool {
     }
 
     fn requires_approval(&self, _params: &serde_json::Value) -> ApprovalRequirement {
-        ApprovalRequirement::UnlessAutoApproved
+        ApprovalRequirement::Always
     }
 }
 
@@ -701,10 +701,38 @@ mod tests {
         assert_eq!(tool.name(), "tool_remove");
         assert_eq!(
             tool.requires_approval(&serde_json::json!({})),
-            ApprovalRequirement::UnlessAutoApproved
+            ApprovalRequirement::Always
         );
     }
 
+    #[test]
+    fn tool_remove_always_requires_approval_regardless_of_params() {
+        use crate::tools::tool::ApprovalRequirement;
+        let tool = ToolRemoveTool {
+            manager: test_manager_stub(),
+        };
+
+        let test_cases = vec![
+            ("no params", serde_json::json!({})),
+            ("empty name", serde_json::json!({"name": ""})),
+            ("slack", serde_json::json!({"name": "slack"})),
+            ("github-cli", serde_json::json!({"name": "github-cli"})),
+            (
+                "with extra fields",
+                serde_json::json!({"name": "tool", "extra": "field"}),
+            ),
+        ];
+
+        for (case_name, params) in test_cases {
+            assert_eq!(
+                tool.requires_approval(&params),
+                ApprovalRequirement::Always,
+                "tool_remove must always require approval for case: {}",
+                case_name
+            );
+        }
+    }
+
     #[test]
     fn test_tool_upgrade_schema() {
         use crate::tools::tool::ApprovalRequirement;

src/tools/builtin/skill_tools.rs

@@ -709,7 +709,8 @@ impl Tool for SkillRemoveTool {
     }
 
     fn description(&self) -> &str {
-        "Remove an installed skill by name. Only user-installed skills can be removed."
+        "Permanently remove an installed skill from disk. This action cannot be undone — \
+         the skill files will be deleted."
     }
 
     fn parameters_schema(&self) -> serde_json::Value {
@@ -770,7 +771,7 @@ impl Tool for SkillRemoveTool {
     }
 
     fn requires_approval(&self, _params: &serde_json::Value) -> ApprovalRequirement {
-        ApprovalRequirement::UnlessAutoApproved
+        ApprovalRequirement::Always
     }
 }
 
@@ -837,12 +838,41 @@ mod tests {
         assert_eq!(tool.name(), "skill_remove");
         assert_eq!(
             tool.requires_approval(&serde_json::json!({})),
-            ApprovalRequirement::UnlessAutoApproved
+            ApprovalRequirement::Always
         );
         let schema = tool.parameters_schema();
         assert!(schema["properties"].get("name").is_some());
     }
 
+    #[test]
+    fn skill_remove_always_requires_approval_regardless_of_params() {
+        use crate::tools::tool::ApprovalRequirement;
+        let tool = SkillRemoveTool::new(test_registry());
+
+        let test_cases = vec![
+            ("no params", serde_json::json!({})),
+            ("empty name", serde_json::json!({"name": ""})),
+            (
+                "deployment skill",
+                serde_json::json!({"name": "deployment"}),
+            ),
+            ("custom skill", serde_json::json!({"name": "custom-skill"})),
+            (
+                "with extra fields",
+                serde_json::json!({"name": "skill", "extra": "field"}),
+            ),
+        ];
+
+        for (case_name, params) in test_cases {
+            assert_eq!(
+                tool.requires_approval(&params),
+                ApprovalRequirement::Always,
+                "skill_remove must always require approval for case: {}",
+                case_name
+            );
+        }
+    }
+
     #[test]
     fn test_validate_fetch_url_allows_https() {
         assert!(super::validate_fetch_url("https://clawhub.ai/api/v1/download?slug=foo").is_ok());