Follow-up to PR #1.  After deploying yesterday's sanitizer to a live Claude
Max OAuth account, Extra Usage continued to creep up.  Investigation showed
that internal tool schemas (delegate_task, cronjob) carry harness phrasing
in their descriptions and per-parameter docs, which get serialized into the
Anthropic 'tools' request field on every call and read by the harness
classifier.

PR #1 only walked 'system' and 'messages' — 'tools' was untouched.  This
extends the single-boundary sanitizer to cover the third payload field.

Changes:

- New _sanitize_tools_for_oauth(tools) — walks the Anthropic tools list and
  rewrites top-level 'description' on every tool.
- New _sanitize_json_schema_descriptions_for_oauth(schema) — recursively
  walks 'properties', 'items', 'oneOf'/'anyOf'/'allOf', and nested object
  types so per-parameter descriptions are scrubbed too. Only the
  human-readable 'description' fields are touched; types, enum values, and
  field names are left alone so the schema continues to validate.
- build_anthropic_kwargs(is_oauth=True) now calls _sanitize_tools_for_oauth
  on the converted Anthropic tools right after the system/messages pass.
- Tool *names* are intentionally not rewritten — the mcp_ prefix added
  elsewhere is required for Anthropic compatibility, and renaming would
  break tool dispatch on the agent side.

Tests:

- Adds 3 regression tests in TestOAuthSanitizer covering: full delegate_task
  + cronjob round trip with bytes-constructed dirty fingerprints, empty/None
  guards on the helper, and JSON Schema combinator (oneOf) recursion.
- The bytes-constructed-fingerprints pattern is intentional: by building
  the dirty input strings from raw bytes inside the test, the test source
  file itself ships clean (no harness phrasing in plain text inside the
  repo), while still exercising the sanitizer end-to-end.

Test results: 130 passed (was 127).

Co-authored-by: Jean Clawd <jeanclawdai@proton.me>

…#13354)

Classic-CLI /steer typed during an active agent run was queued through
self._pending_input alongside ordinary user input.  process_loop, which
drains that queue, is blocked inside self.chat() for the entire run,
so the queued command was not pulled until AFTER _agent_running had
flipped back to False — at which point process_command() took the idle
fallback ("No agent running; queued as next turn") and delivered the
steer as an ordinary next-turn user message.

From Utku's bug report on PR NousResearch#13205: mid-run /steer arrived minutes
later at the end of the turn as a /queue-style message, completely
defeating its purpose.

Fix: add _should_handle_steer_command_inline() gating — when
_agent_running is True and the user typed /steer, dispatch
process_command(text) directly from the prompt_toolkit Enter handler
on the UI thread instead of queueing.  This mirrors the existing
_should_handle_model_command_inline() pattern for /model and is
safe because agent.steer() is thread-safe (uses _pending_steer_lock,
no prompt_toolkit state mutation, instant return).

No changes to the idle-path behavior: /steer typed with no active
agent still takes the normal queue-and-drain route so the fallback
"No agent running; queued as next turn" message is preserved.

Validation:
- 7 new unit tests in tests/cli/test_cli_steer_busy_path.py covering
  the detector, dispatch path, and idle-path control behavior.
- All 21 existing tests in tests/run_agent/test_steer.py still pass.
- Live PTY end-to-end test with real agent + real openrouter model:
    22:36:22 API call #1 (model requested execute_code)
    22:36:26 ENTER FIRED: agent_running=True, text='/steer ...'
    22:36:26 INLINE STEER DISPATCH fired
    22:36:43 agent.log: 'Delivered /steer to agent after tool batch'
    22:36:44 API call #2 included the steer; response contained marker
  Same test on the tip of main without this fix shows the steer
  landing as a new user turn ~20s after the run ended.

The MCP circuit breaker previously had no path back to the closed
state: once _server_error_counts[srv] reached _CIRCUIT_BREAKER_THRESHOLD
the gate short-circuited every subsequent call, so the only reset
path (on successful call) was unreachable. A single transient
3-failure blip (bad network, server restart, expired token) permanently
disabled every tool on that MCP server for the rest of the agent
session.

Introduce a classic closed/open/half-open state machine:

- Track a per-server breaker-open timestamp in _server_breaker_opened_at
  alongside the existing failure count.
- Add _CIRCUIT_BREAKER_COOLDOWN_SEC (60s). Once the count reaches
  threshold, calls short-circuit for the cooldown window.
- After the cooldown elapses, the *next* call falls through as a
  half-open probe that actually hits the session. Success resets the
  breaker via _reset_server_error; failure re-bumps the count via
  _bump_server_error, which re-stamps the open timestamp and re-arms
  the cooldown.

The error message now includes the live failure count and an
"Auto-retry available in ~Ns" hint so the model knows the breaker
will self-heal rather than giving up on the tool for the whole
session.

Covers tests 1 (half-opens after cooldown) and 2 (reopens on probe
failure); test 3 (cleared on reconnect) still fails pending fix #2.