core/cli+agent: run TTY confirms off the event loop

Max-rounds and destructive-tool prompts use asyncio.to_thread with
cancel paused on the main thread so multi-tool turns no longer look
like user cancel. Hooks may be sync or async.

tests/test_agent/test_loop.py

@@ -280,6 +280,48 @@ async def test_max_rounds_continue_hook() -> None:
     assert len(client.calls) == 3  # noqa: PLR2004
 
 
+async def test_max_rounds_async_continue_hook() -> None:
+    @tool
+    def ping() -> str:
+        return "pong"
+
+    registry = ToolRegistry([ping])
+    forever = _response(
+        AssistantChatMessage(
+            content="",
+            tool_calls=[
+                AssistantFunctionToolCall(
+                    id="c",
+                    function=AssistantFunctionTool(name="ping", arguments="{}"),
+                )
+            ],
+        )
+    )
+    final = _response(AssistantChatMessage(content="done"))
+    client = ScriptedClient([forever, forever, final])
+    messages: list[AnyChatMessage] = [UserChatMessage(content="x")]
+    asks: list[str] = []
+
+    async def on_limit(reason: str) -> bool:
+        asks.append(reason)
+        return True
+
+    events = [
+        e
+        async for e in run_chat_loop(
+            client,
+            messages,
+            model="m",
+            tools=registry,
+            max_rounds=2,
+            on_limit=on_limit,
+        )
+    ]
+    assert len(asks) == 1
+    assert any(isinstance(e, MaxRoundsEvent) and e.continued for e in events)
+    assert any(isinstance(e, TextDeltaEvent) and e.content == "done" for e in events)
+
+
 async def test_default_max_rounds_is_generous() -> None:
     from plyngent.agent.loop import DEFAULT_MAX_ROUNDS
 

tests/test_cli/test_interrupt.py

@@ -2,8 +2,12 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-from plyngent.cli.interrupt import allow_task_cancel, pause_task_cancel_for_prompt
-from plyngent.cli.limits import prompt_continue_limit
+from plyngent.cli.interrupt import (
+    allow_task_cancel,
+    pause_task_cancel_for_prompt,
+    run_in_prompt_thread,
+)
+from plyngent.cli.limits import prompt_continue_limit, prompt_continue_limit_async
 
 if TYPE_CHECKING:
     import pytest
@@ -23,3 +27,24 @@ def test_prompt_continue_limit_under_pause(monkeypatch: pytest.MonkeyPatch) -> N
 
     monkeypatch.setattr("click.confirm", _confirm)
     assert prompt_continue_limit("too many rounds") is True
+
+
+async def test_run_in_prompt_thread_pauses_cancel() -> None:
+    """Cancel is paused on the main thread for the whole to_thread call."""
+    assert allow_task_cancel() is True
+
+    def work() -> str:
+        return "ok"
+
+    # ContextVar may not propagate to worker threads; assert pause around the call.
+    result = await run_in_prompt_thread(work)
+    assert result == "ok"
+    assert allow_task_cancel() is True
+
+
+async def test_prompt_continue_limit_async(monkeypatch: pytest.MonkeyPatch) -> None:
+    def _confirm(*_a: object, **_k: object) -> bool:
+        return True
+
+    monkeypatch.setattr("click.confirm", _confirm)
+    assert await prompt_continue_limit_async("too many rounds") is True