withhold tools for standalone social turns

src/clean_agent_preview.py

@@ -1306,6 +1306,14 @@ def native_execution_limits(max_rounds):
     return round_limit, NATIVE_TOOL_CALL_LIMIT
 
 
+def standalone_social_turn(text):
+    """A complete social utterance cannot authorize a tool action."""
+    return bool(re.fullmatch(
+        r"\s*(?:hi|hey|hello|helo|hiya|thanks|thank you|good morning|good evening)"
+        r"[\s!.?]*", str(text or ''), re.I,
+    ))
+
+
 def interactive_execution_limit(max_rounds):
     """Bound interactive turns independently of long-running native jobs."""
     if max_rounds is None:
@@ -3745,6 +3753,8 @@ async def stream_preview(*, endpoint_url, model, messages, headers, turn_contrac
             suggestion_only=suggestion_target,
         )
     offered = compact_schemas(turn_contract.schemas())
+    if standalone_social_turn(direct_user_text):
+        offered = []
     external_schema_by_name = {
         str((schema.get('function') or {}).get('name') or ''): copy.deepcopy(schema)
         for schema in (external_tool_schemas or ())

tests/test_clean_agent_preview.py

@@ -319,6 +319,16 @@ def test_compact_preview_honors_configured_interactive_round_limit():
     assert interactive_execution_limit("invalid") == 8
 
 
+@pytest.mark.parametrize('text,expected', [
+    ('helo', True), ('Hello!', True), ('thanks', True),
+    ('hello, find the latest news', False), ('thanks, now open the source', False),
+    ('search for the song Hello', False),
+])
+def test_social_turn_requires_the_entire_request(text, expected):
+    from src.clean_agent_preview import standalone_social_turn
+    assert standalone_social_turn(text) is expected
+
+
 @pytest.mark.parametrize('prompt,expected', [
     ('Read /workspace/fixtures/paper.pdf and create /workspace/results.csv and /workspace/chart.png',
      ('/workspace/results.csv', '/workspace/chart.png')),