@andreprado/agentkit 0.1.0 → 0.2.0

package/src/runtime/inspect.ts

@@ -4,11 +4,6 @@ import type { AgentChannel, AgentProvider, AgentRuntime, AccessMode } from "../i
 import type { LoadedAgentCapsule } from "./config";
 import { loadAgentCapsule } from "./config";
 import { loadCapsuleEnv } from "./env";
-import {
-  createManagedComposioTools,
-  managedComposioRequiredSecrets,
-  resolveManagedComposioIntegrations,
-} from "./integrations/composio";
 import { resolveKnowledgeConfig } from "./knowledge/config";
 import { KNOWLEDGE_SEARCH_TOOL_NAME } from "./knowledge/tool";
 import { resolveRuntimeTimeZone } from "./prompt-context";
@@ -27,7 +22,6 @@ export type AgentInspectState = {
   };
   prompt: string;
   tools: string[];
-  integrations: AgentInspectIntegration[];
   channels: AgentInspectChannel[];
   transcription: {
     enabled: boolean;
@@ -67,16 +61,9 @@ export type AgentInspectState = {
       target: "bun";
       database: "sqlite" | "none";
     };
-    hosted: {
-      environment: "hosted";
-      target: "cloudflare";
-      database: "turso" | "none";
-      providerSupported: boolean;
-    };
     aliases: ["ctx.db", "ctx.database", "ctx.storage.sql"];
   };
   secrets: Record<string, SecretState>;
-  managedSecrets: string[];
   userSecrets: string[];
   skills: AgentInspectSkills;
   warnings: AgentInspectWarning[];
@@ -89,12 +76,6 @@ export type AgentInspectDatabase = {
     schema: string | null;
     migrations: string | null;
   };
-  hosted: {
-    driver: "none" | "turso";
-    provisioning: "none" | "agentkit-managed";
-    schema: string | null;
-    migrations: string | null;
-  };
 };
 
 export type AgentInspectChannel = {
@@ -127,15 +108,6 @@ export type AgentInspectWarning = {
   command?: string;
 };
 
-export type AgentInspectIntegration = {
-  name: string;
-  provider: "composio";
-  mode: "managed";
-  toolkits: string[];
-  tools: string[];
-  userId: string;
-};
-
 export async function inspectAgentCapsule(
   cwd = process.cwd(),
   env: Record<string, string | undefined> = process.env,
@@ -151,10 +123,9 @@ export function buildInspectState(
 ): AgentInspectState {
   const declaredSecrets = new Set(capsule.config.secrets);
   const knowledge = resolveKnowledgeConfig(capsule.config);
-  const integrationTools = createManagedComposioTools(capsule.config);
   const transcription = resolveTranscriptionConfig(capsule.config.transcription);
 
-  for (const tool of [...integrationTools, ...(capsule.config.tools ?? [])]) {
+  for (const tool of capsule.config.tools ?? []) {
     for (const secret of tool.secrets ?? []) {
       declaredSecrets.add(secret);
     }
@@ -174,10 +145,7 @@ export function buildInspectState(
     declaredSecrets.add(transcription.secret);
   }
 
-  const managedSecrets = managedCloudSecrets(capsule);
-  const managedSecretSet = new Set(managedSecrets);
   const userSecrets = Array.from(declaredSecrets)
-    .filter((secret) => !managedSecretSet.has(secret))
     .sort();
   const secrets: Record<string, SecretState> = {};
 
@@ -202,16 +170,7 @@ export function buildInspectState(
       }),
     },
     prompt: toCapsulePath(capsule.root, capsule.instructionsPath),
-    tools: [...integrationTools, ...(capsule.config.tools ?? [])].map((tool) => tool.name),
-    integrations: resolveManagedComposioIntegrations(capsule.config).map((integration) => ({
-      name: integration.name,
-      provider: integration.provider,
-      mode: integration.mode,
-      toolkits: integration.toolkits,
-      tools: integration.allowedTools,
-      userId: integration.userId,
-      confirmExternalWrites: integration.confirmExternalWrites !== false,
-    })),
+    tools: (capsule.config.tools ?? []).map((tool) => tool.name),
     channels: (capsule.config.channels ?? []).map((channel) => ({
       name: channel.name,
       type: channel.type,
@@ -264,16 +223,9 @@ export function buildInspectState(
         target: "bun",
         database: capsule.storagePath ? "sqlite" : "none",
       },
-      hosted: {
-        environment: "hosted",
-        target: "cloudflare",
-        database: database.hosted.driver === "turso" ? "turso" : "none",
-        providerSupported: true,
-      },
       aliases: ["ctx.db", "ctx.database", "ctx.storage.sql"],
     },
     secrets,
-    managedSecrets,
     userSecrets,
     skills,
     warnings,
@@ -287,8 +239,8 @@ function toCapsulePath(root: string, path: string): string {
 
 function inspectDatabase(capsule: LoadedAgentCapsule): AgentInspectDatabase {
   const database = capsule.config.storage.database;
-  const schema = database?.driver === "turso" && database.schema ? database.schema : null;
-  const migrations = database?.driver === "turso" ? database.migrations ?? "migrations" : null;
+  const schema = database?.driver === "sqlite" && database.schema ? database.schema : null;
+  const migrations = database?.driver === "sqlite" ? database.migrations ?? "migrations" : null;
 
   return {
     local: {
@@ -297,12 +249,6 @@ function inspectDatabase(capsule: LoadedAgentCapsule): AgentInspectDatabase {
       schema,
       migrations,
     },
-    hosted: {
-      driver: database?.driver === "turso" ? "turso" : "none",
-      provisioning: database?.driver === "turso" ? "agentkit-managed" : "none",
-      schema,
-      migrations,
-    },
   };
 }
 
@@ -333,6 +279,15 @@ function inspectWarnings(
 ): AgentInspectWarning[] {
   const warnings: AgentInspectWarning[] = [];
 
+  for (const channel of capsule.config.channels ?? []) {
+    if (channel.type === "discord" && channel.mode === "bot") {
+      warnings.push({
+        code: "discord_gateway_bridge_required",
+        message: `Discord channel "${channel.name}" uses bot mode, but AgentKit does not connect to the Gateway. Inviting the bot alone cannot deliver messages. Use interactions or run your own Gateway bridge to forward authenticated events.`,
+      });
+    }
+  }
+
   if (skills.status === "missing" || skills.status === "outdated") {
     warnings.push({
       code: "local_skills_outdated",
@@ -355,18 +310,3 @@ function inspectWarnings(
 
   return warnings;
 }
-
-function managedCloudSecrets(capsule: LoadedAgentCapsule): string[] {
-  const secrets = new Set<string>();
-
-  if (capsule.config.storage.database?.driver === "turso") {
-    secrets.add("TURSO_AUTH_TOKEN");
-    secrets.add("TURSO_DATABASE_URL");
-  }
-
-  for (const secret of managedComposioRequiredSecrets(capsule.config)) {
-    secrets.add(secret);
-  }
-
-  return Array.from(secrets).sort();
-}

package/src/runtime/knowledge/embeddings.ts

@@ -5,8 +5,15 @@ import { AgentKitError } from "../errors";
 
 export type EmbeddingProvider = {
   embed(input: string): Promise<number[]>;
+  /** Embeds inputs in as few provider requests as possible; results keep input order. */
+  embedMany(inputs: string[]): Promise<number[][]>;
 };
 
+// Each valid input is at most 8,192 tokens; 36 inputs cannot exceed the
+// 300,000-token request limit, even for long CSV rows or dense text.
+// ponytail: conservative batches; add token-aware packing if throughput needs it.
+const OPENAI_EMBEDDING_BATCH_SIZE = Math.floor(300_000 / 8_192);
+
 export type CreateEmbeddingProviderOptions = {
   config: ResolvedKnowledgeConfig["embedding"];
   env?: Record<string, string | undefined>;
@@ -23,13 +30,26 @@ export function createEmbeddingProvider(options: CreateEmbeddingProviderOptions)
       async embed(input) {
         return fakeEmbedding(input, options.config.dimensions ?? 32);
       },
+      async embedMany(inputs) {
+        return inputs.map((input) => fakeEmbedding(input, options.config.dimensions ?? 32));
+      },
     };
   }
 
   if (options.config.provider === "openai") {
     return {
       async embed(input) {
-        return openAiEmbedding(input, options);
+        const [embedding] = await openAiEmbeddings([input], options);
+        return embedding;
+      },
+      async embedMany(inputs) {
+        const embeddings: number[][] = [];
+
+        for (let start = 0; start < inputs.length; start += OPENAI_EMBEDDING_BATCH_SIZE) {
+          embeddings.push(...(await openAiEmbeddings(inputs.slice(start, start + OPENAI_EMBEDDING_BATCH_SIZE), options)));
+        }
+
+        return embeddings;
       },
     };
   }
@@ -74,7 +94,7 @@ export function cosineSimilarity(left: number[], right: number[]): number {
   return dot / (Math.sqrt(leftNorm) * Math.sqrt(rightNorm));
 }
 
-async function openAiEmbedding(input: string, options: CreateEmbeddingProviderOptions): Promise<number[]> {
+async function openAiEmbeddings(inputs: string[], options: CreateEmbeddingProviderOptions): Promise<number[][]> {
   const secretName = options.config.secret ?? "OPENAI_API_KEY";
   const apiKey = options.env?.[secretName] ?? process.env[secretName];
 
@@ -94,7 +114,7 @@ async function openAiEmbedding(input: string, options: CreateEmbeddingProviderOp
     },
     body: JSON.stringify({
       model: options.config.model ?? "text-embedding-3-small",
-      input,
+      input: inputs,
       encoding_format: "float",
       ...(options.config.dimensions ? { dimensions: options.config.dimensions } : {}),
     }),
@@ -109,13 +129,31 @@ async function openAiEmbedding(input: string, options: CreateEmbeddingProviderOp
   }
 
   const payload = await response.json();
-  const embedding = payload?.data?.[0]?.embedding;
+  const data: unknown[] = Array.isArray(payload?.data) ? payload.data : [];
+  const embeddings: number[][] = new Array(inputs.length);
+
+  for (const [position, item] of data.entries()) {
+    const record = item as { index?: unknown; embedding?: unknown };
+    const index = typeof record.index === "number" ? record.index : position;
+    const embedding = record.embedding;
+
+    if (
+      index >= 0 &&
+      index < inputs.length &&
+      Array.isArray(embedding) &&
+      embedding.every((value) => typeof value === "number")
+    ) {
+      embeddings[index] = embedding;
+    }
+  }
 
-  if (!Array.isArray(embedding) || embedding.some((value) => typeof value !== "number")) {
-    throw new AgentKitError("knowledge_embedding_failed", "OpenAI embedding response did not contain a numeric vector.");
+  for (let index = 0; index < inputs.length; index += 1) {
+    if (!embeddings[index]) {
+      throw new AgentKitError("knowledge_embedding_failed", "OpenAI embedding response did not contain a numeric vector.");
+    }
   }
 
-  return embedding;
+  return embeddings;
 }
 
 function normalizeVector(values: number[]): number[] {

package/src/runtime/knowledge/ingest.ts

@@ -151,7 +151,9 @@ async function ingestKnowledgeSources(
       }
     }
 
-    await checkpointLocalKnowledgeDatabase(db);
+    if (results.some((result) => result.status === "indexed")) {
+      await checkpointLocalKnowledgeDatabase(db);
+    }
   } finally {
     store.close();
   }
@@ -269,7 +271,7 @@ async function ingestKnowledgeSource(
   if (source.kind === "url") {
     throw new AgentKitError(
       "knowledge_source_unsupported",
-      "URL knowledge sources are planned for hosted ingestion. Local Knowledge currently supports .md, .txt, and .csv files.",
+      "URL knowledge ingestion is not supported. Local Knowledge currently supports .md, .txt, and .csv files.",
     );
   }
 
@@ -304,13 +306,28 @@ async function ingestKnowledgeSource(
     id: string;
   }> = [];
 
-  for (const chunk of chunks) {
-    const embedding = embeddingProvider ? await embeddingProvider.embed(chunk.content) : null;
+  const chunkHashes = chunks.map((chunk) => sha256(chunk.content));
+  const embeddingsByHash = embeddingProvider
+    ? await loadReusableChunkEmbeddings(db, sourceId, resolvedKnowledge)
+    : new Map<string, number[]>();
+
+  if (embeddingProvider) {
+    const missingHashes = [...new Set(chunkHashes.filter((hash) => !embeddingsByHash.has(hash)))];
+
+    if (missingHashes.length > 0) {
+      const contentByHash = new Map(chunks.map((chunk, index) => [chunkHashes[index], chunk.content]));
+      const embeddings = await embeddingProvider.embedMany(missingHashes.map((hash) => contentByHash.get(hash)!));
+      missingHashes.forEach((hash, index) => embeddingsByHash.set(hash, embeddings[index]));
+    }
+  }
+
+  for (const [index, chunk] of chunks.entries()) {
+    const contentSha256 = chunkHashes[index];
     embeddedChunks.push({
       chunk,
-      embedding,
-      contentSha256: sha256(chunk.content),
-      id: stableId("kchk", `${sourceId}:${chunk.ordinal}:${sha256(chunk.content)}`),
+      embedding: embeddingProvider ? embeddingsByHash.get(contentSha256) ?? null : null,
+      contentSha256,
+      id: stableId("kchk", `${sourceId}:${chunk.ordinal}:${contentSha256}`),
     });
   }
 
@@ -491,6 +508,52 @@ function capsuleRelativePath(root: string, absolutePath: string): string {
   return relativePath.split("\\").join("/");
 }
 
+// Chunks whose text is unchanged keep their stored vector, so editing one part
+// of a file only pays for embedding the chunks that actually changed.
+async function loadReusableChunkEmbeddings(
+  db: DatabaseRunner,
+  sourceId: string,
+  knowledge: ReturnType<typeof resolveKnowledgeConfig>,
+): Promise<Map<string, number[]>> {
+  const result = await db.query(
+    `
+    SELECT content_sha256, embedding_json
+    FROM agentkit_knowledge_chunks
+    WHERE source_id = ?
+      AND embedding_json IS NOT NULL
+      AND embedding_provider = ?
+      AND embedding_model = ?
+      AND (? IS NULL OR embedding_dimensions = ?)
+  `,
+    [
+      sourceId,
+      knowledge.embedding.provider,
+      knowledge.embedding.model,
+      knowledge.embedding.dimensions,
+      knowledge.embedding.dimensions,
+    ],
+  );
+  const embeddings = new Map<string, number[]>();
+
+  for (const row of result.rows) {
+    if (typeof row.content_sha256 !== "string" || typeof row.embedding_json !== "string") {
+      continue;
+    }
+
+    try {
+      const embedding = JSON.parse(row.embedding_json);
+
+      if (Array.isArray(embedding) && embedding.every((value) => typeof value === "number")) {
+        embeddings.set(row.content_sha256, embedding);
+      }
+    } catch {
+      // A corrupt stored vector is simply re-embedded.
+    }
+  }
+
+  return embeddings;
+}
+
 async function findExistingSource(db: DatabaseRunner, sourceKey: string): Promise<DatabaseRow | undefined> {
   const result = await db.query(
     "SELECT id, content_sha256, status FROM agentkit_knowledge_sources WHERE source_key = ?",

package/src/runtime/knowledge/tool.ts

@@ -1,10 +1,22 @@
 import type { AgentTool } from "../../index";
 import type { LoadedAgentCapsule } from "../config";
 import { resolveKnowledgeConfig } from "./config";
-import { searchKnowledge } from "./retrieve";
+import { searchKnowledge, type KnowledgeSearchResult } from "./retrieve";
 
 export const KNOWLEDGE_SEARCH_TOOL_NAME = "agentkit_search_knowledge";
 
+// Only the actual built-in tool may expose retrieval facts to the model.
+const knowledgeTools = new WeakSet<AgentTool>();
+
+export function knowledgeModelText(tool: AgentTool, output: unknown): string | undefined {
+  if (!knowledgeTools.has(tool)) return undefined;
+  const { results } = output as { results: Array<Pick<KnowledgeSearchResult, "content" | "source">> };
+  return results.map(({ content, source }) => {
+    const reference = [source.path, source.title, source.section, source.locator].filter(Boolean).join(" > ");
+    return `${content}\nSource: ${reference}`;
+  }).join("\n\n") || "No relevant Knowledge results found.";
+}
+
 export function createKnowledgeSearchTool(capsule: LoadedAgentCapsule): AgentTool | null {
   const knowledge = resolveKnowledgeConfig(capsule.config);
 
@@ -12,7 +24,7 @@ export function createKnowledgeSearchTool(capsule: LoadedAgentCapsule): AgentToo
     return null;
   }
 
-  return {
+  const tool: AgentTool = {
     name: KNOWLEDGE_SEARCH_TOOL_NAME,
     description: "Search the Agent Capsule's configured Knowledge sources for business-specific facts.",
     visibility: "internal",
@@ -61,4 +73,6 @@ export function createKnowledgeSearchTool(capsule: LoadedAgentCapsule): AgentToo
       };
     },
   };
+  knowledgeTools.add(tool);
+  return tool;
 }

package/src/runtime/knowledge/vector.ts

@@ -2,7 +2,7 @@ import { access } from "node:fs/promises";
 import { basename, dirname, extname, join } from "node:path";
 import { pathToFileURL } from "node:url";
 
-import { createClient } from "@libsql/client";
+import { createClient, type InStatement } from "@libsql/client";
 
 import type { DatabaseRow } from "../../index";
 
@@ -48,32 +48,6 @@ export async function rebuildLocalKnowledgeVectorIndex(options: {
   const dimensions = options.dimensions;
 
   try {
-    await vectorClient.batch(
-      [
-        `DROP INDEX IF EXISTS ${KNOWLEDGE_VECTOR_INDEX}`,
-        `DROP INDEX IF EXISTS ${KNOWLEDGE_VECTOR_SOURCE_INDEX}`,
-        `DROP TABLE IF EXISTS ${KNOWLEDGE_VECTOR_TABLE}`,
-        `
-          CREATE TABLE ${KNOWLEDGE_VECTOR_TABLE} (
-            id INTEGER PRIMARY KEY,
-            chunk_id TEXT NOT NULL UNIQUE,
-            source_id TEXT NOT NULL,
-            source_key TEXT NOT NULL,
-            content TEXT NOT NULL,
-            title TEXT,
-            section TEXT,
-            locator TEXT,
-            embedding F32_BLOB(${dimensions}) NOT NULL,
-            embedding_hash TEXT NOT NULL,
-            created_at TEXT NOT NULL
-          )
-        `,
-        `CREATE INDEX ${KNOWLEDGE_VECTOR_SOURCE_INDEX} ON ${KNOWLEDGE_VECTOR_TABLE}(source_id)`,
-        `CREATE INDEX ${KNOWLEDGE_VECTOR_INDEX} ON ${KNOWLEDGE_VECTOR_TABLE}(libsql_vector_idx(embedding, 'metric=cosine'))`,
-      ],
-      "write",
-    );
-
     const rows = await mainClient.execute({
       sql: `
         SELECT
@@ -97,7 +71,31 @@ export async function rebuildLocalKnowledgeVectorIndex(options: {
       args: [dimensions],
     });
 
-    let chunksIndexed = 0;
+    // Drop, recreate, and refill in one write batch so a failed rebuild never
+    // leaves a half-populated index behind, and inserts share one transaction.
+    const schemaStatements: InStatement[] = [
+      `DROP INDEX IF EXISTS ${KNOWLEDGE_VECTOR_INDEX}`,
+      `DROP INDEX IF EXISTS ${KNOWLEDGE_VECTOR_SOURCE_INDEX}`,
+      `DROP TABLE IF EXISTS ${KNOWLEDGE_VECTOR_TABLE}`,
+      `
+        CREATE TABLE ${KNOWLEDGE_VECTOR_TABLE} (
+          id INTEGER PRIMARY KEY,
+          chunk_id TEXT NOT NULL UNIQUE,
+          source_id TEXT NOT NULL,
+          source_key TEXT NOT NULL,
+          content TEXT NOT NULL,
+          title TEXT,
+          section TEXT,
+          locator TEXT,
+          embedding F32_BLOB(${dimensions}) NOT NULL,
+          embedding_hash TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        )
+      `,
+      `CREATE INDEX ${KNOWLEDGE_VECTOR_SOURCE_INDEX} ON ${KNOWLEDGE_VECTOR_TABLE}(source_id)`,
+      `CREATE INDEX ${KNOWLEDGE_VECTOR_INDEX} ON ${KNOWLEDGE_VECTOR_TABLE}(libsql_vector_idx(embedding, 'metric=cosine'))`,
+    ];
+    const inserts: InStatement[] = [];
 
     for (const row of rows.rows) {
       const chunkId = readString(row, "chunk_id");
@@ -112,7 +110,7 @@ export async function rebuildLocalKnowledgeVectorIndex(options: {
         continue;
       }
 
-      await vectorClient.execute({
+      inserts.push({
         sql: `
           INSERT INTO ${KNOWLEDGE_VECTOR_TABLE} (
             chunk_id,
@@ -141,9 +139,11 @@ export async function rebuildLocalKnowledgeVectorIndex(options: {
           createdAt,
         ],
       });
-      chunksIndexed += 1;
     }
 
+    await vectorClient.batch([...schemaStatements, ...inserts], "write");
+    const chunksIndexed = inserts.length;
+
     await vectorClient.execute("PRAGMA wal_checkpoint(TRUNCATE)").catch(() => undefined);
 
     return {
@@ -181,7 +181,7 @@ export async function searchLocalKnowledgeVectorRows(options: {
     const result = await client.execute({
       sql: `
         SELECT
-          c.id AS chunk_id,
+          c.chunk_id AS chunk_id,
           c.source_id AS source_id,
           c.content AS content,
           c.title AS title,

package/src/runtime/tool-runner.ts

@@ -1,8 +1,7 @@
 import { loadAgentCapsule } from "./config";
 import { openPreparedCapsuleStore } from "./database";
-import { loadCapsuleEnv } from "./env";
+import { collectSecretValues, loadCapsuleEnv } from "./env";
 import { isAgentKitError } from "./errors";
-import { createManagedComposioTools } from "./integrations/composio";
 import { buildRuntimeClockContext } from "./prompt-context";
 import { createToolRuntime, type ToolCallResult } from "./tools";
 
@@ -16,6 +15,7 @@ export type RunToolOptions = {
 export async function runToolFromCwd(cwd: string, options: RunToolOptions): Promise<ToolCallResult> {
   const capsule = await loadAgentCapsule(cwd);
   const env = await loadCapsuleEnv(capsule.root);
+  const secretValues = collectSecretValues(capsule.config, env);
   const { store } = await openPreparedCapsuleStore(capsule);
   const conversation = store.createConversation({
     agentName: capsule.config.name,
@@ -27,11 +27,12 @@ export async function runToolFromCwd(cwd: string, options: RunToolOptions): Prom
     model: capsule.config.provider.model,
   });
   const toolRuntime = createToolRuntime({
-    tools: [...createManagedComposioTools(capsule.config), ...(capsule.config.tools ?? [])],
+    tools: capsule.config.tools ?? [],
     store,
     runId: run.id,
     conversationId: conversation.id,
     env,
+    secretValues,
     signal: options.signal,
     clock: buildRuntimeClockContext({
       timeZone: capsule.config.timeZone,
@@ -64,6 +65,7 @@ export async function runToolFromCwd(cwd: string, options: RunToolOptions): Prom
       status: "failed",
       errorCode: isAgentKitError(error) ? error.code : "runtime_error",
       errorMessage: error instanceof Error ? error.message : String(error),
+      secretValues,
     });
 
     throw error;

package/src/runtime/tools.ts

@@ -1,6 +1,8 @@
 import type { AgentTool, JsonSchema, ToolContext, ToolRenderResult, ToolRuntimeContext } from "../index";
-import type { SqliteAgentKitStore } from "../storage/sqlite";
+import { redactSecrets, type SqliteAgentKitStore } from "../storage/sqlite";
 import { createLocalDatabaseRunner } from "./database";
+import { collectSecretValues } from "./env";
+import { knowledgeModelText } from "./knowledge/tool";
 import { AgentKitError } from "./errors";
 import type { RuntimeClockContext } from "./prompt-context";
 
@@ -16,6 +18,8 @@ export type ToolCallResult = {
   input: unknown;
   output: unknown;
   rendered?: ToolRenderResult;
+  // Redacted facts from built-in Knowledge only; never a user-facing renderer.
+  modelText?: string;
 };
 
 export type ToolRuntime = {
@@ -29,6 +33,7 @@ export type ToolRuntimeOptions = {
   runId: string;
   conversationId: string;
   env?: Record<string, string | undefined>;
+  secretValues?: string[];
   signal?: AbortSignal;
   defaultTimeoutMs?: number;
   runtime: ToolRuntimeContext;
@@ -63,7 +68,7 @@ async function executeToolCall(
 ): Promise<ToolCallResult> {
   let input: unknown = request.input ?? {};
   const tool = toolsByName.get(request.name);
-  const preliminarySecretValues = collectConfiguredSecretValues(tool, options.env ?? process.env);
+  const preliminarySecretValues = collectSecretValues(tool, options.env ?? process.env);
   const toolCall = options.store.createToolCall({
     runId: options.runId,
     conversationId: options.conversationId,
@@ -112,6 +117,7 @@ async function executeToolCall(
       secretValues,
     });
 
+    const modelText = knowledgeModelText(tool, output);
     return {
       id: toolCall.id,
       name: tool.name,
@@ -119,9 +125,10 @@ async function executeToolCall(
       input,
       output,
       ...(rendered ? { rendered } : {}),
+      ...(modelText !== undefined ? { modelText: redactSecrets(modelText, options.secretValues ?? secretValues) } : {}),
     };
   } catch (error) {
-    const secretValues = collectConfiguredSecretValues(tool, options.env ?? process.env);
+    const secretValues = collectSecretValues(tool, options.env ?? process.env);
 
     options.store.completeToolCall({
       toolCallId: toolCall.id,
@@ -287,17 +294,6 @@ function resolveToolSecrets(
   return { secrets, secretValues: Object.values(secrets) };
 }
 
-function collectConfiguredSecretValues(tool: AgentTool | undefined, env: Record<string, string | undefined>): string[] {
-  if (!tool) {
-    return [];
-  }
-
-  return (tool.secrets ?? []).flatMap((secretName) => {
-    const value = env[secretName];
-    return value ? [value] : [];
-  });
-}
-
 async function runToolWithTimeout(
   tool: AgentTool,
   input: unknown,