the loop has no cap and no allowlist. the model asked for
wipe twice. wipe is not a tool you expose. without a
cap the loop would keep going; without an allowlist it
KeyErrors on the unknown name.
fix run_loop so it (1) iterates at most max_iters times
and (2) skips any tool_use whose name is not in allowlist.
return {"iters": <n>, "tool_calls": <ran>, "skipped": <skipped>}.
expected output:
iters=2 tool_calls=0 skipped=2
The break is on lines 14, 19, 26 — but read the whole snippet first.