@andreprado/agentkit 0.1.1 → 0.2.0

package/src/runtime/improve.ts

@@ -8,7 +8,7 @@ import { AgentKitError, isAgentKitError } from "./errors";
 import { runAgentMessageFromCwd } from "./chat";
 import { getConversationTraceFromCwd } from "./traces";
 
-export type ImproveSource = "local" | "deploy";
+export type ImproveSource = "local";
 
 export type ImproveTraceMessage = {
   role: "user" | "assistant" | "system" | "tool";
@@ -35,8 +35,6 @@ export type ImproveBundle = {
   created_at: string;
   source: ImproveSource;
   since?: string;
-  deploy_id?: string;
-  evidence?: unknown;
   traces: ImproveTracePacket[];
 };
 
@@ -71,16 +69,6 @@ export type ImproveReplayResult = {
   }>;
 };
 
-export type DeployImproveCollector = {
-  exportEvidence?(input: {
-    deployId: string;
-    since?: string;
-    conversationId?: string;
-  }): Promise<unknown | null>;
-  listConversations(): Promise<unknown>;
-  getTrace(conversationId: string): Promise<unknown>;
-};
-
 export async function collectLocalImproveBundle(
   cwd: string,
   options: {
@@ -112,69 +100,6 @@ export async function collectLocalImproveBundle(
   }, options.out);
 }
 
-export async function collectDeployImproveBundle(
-  cwd: string,
-  options: {
-    collector: DeployImproveCollector;
-    deployId: string;
-    since?: string;
-    conversationId?: string;
-    out?: string;
-  },
-): Promise<ImproveCollectResult> {
-  const root = await findAgentCapsuleRoot(cwd);
-
-  if (options.collector.exportEvidence) {
-    const exported = await options.collector.exportEvidence({
-      deployId: options.deployId,
-      ...(options.since ? { since: options.since } : {}),
-      ...(options.conversationId ? { conversationId: options.conversationId } : {}),
-    });
-
-    if (exported) {
-      const normalized = normalizeDeployEvidenceExport(exported);
-      const traces = await tracePacketsFromDeployEvidenceExport({
-        collector: options.collector,
-        deployId: options.deployId,
-        evidence: normalized,
-        source: "deploy",
-      });
-
-      return writeImproveBundle(root, {
-        schema_version: 1,
-        created_at: normalized.created_at ?? new Date().toISOString(),
-        source: "deploy",
-        deploy_id: options.deployId,
-        ...(options.since ? { since: options.since } : {}),
-        evidence: redactEvidenceValue(normalized.raw),
-        traces,
-      }, options.out);
-    }
-  }
-
-  const sinceDate = resolveSinceDate(options.since);
-  const summaries = options.conversationId
-    ? [{ id: options.conversationId }]
-    : normalizeConversationSummaries(await options.collector.listConversations()).filter((conversation) =>
-        sinceDate && conversation.updated_at ? dateIsOnOrAfter(conversation.updated_at, sinceDate) : true,
-      );
-  const traces: ImproveTracePacket[] = [];
-
-  for (const summary of summaries) {
-    const trace = await options.collector.getTrace(summary.id);
-    traces.push(tracePacketFromPayload("deploy", summary.id, trace));
-  }
-
-  return writeImproveBundle(root, {
-    schema_version: 1,
-    created_at: new Date().toISOString(),
-    source: "deploy",
-    deploy_id: options.deployId,
-    ...(options.since ? { since: options.since } : {}),
-    traces,
-  }, options.out);
-}
-
 export async function generateImproveEvals(
   cwd: string,
   options: {
@@ -319,7 +244,6 @@ async function writeImproveBundle(root: string, bundle: ImproveBundle, out?: str
       {
         created_at: bundle.created_at,
         source: bundle.source,
-        deploy_id: bundle.deploy_id ?? null,
         trace_count: bundle.traces.length,
         conversations: bundle.traces.map((trace) => ({
           trace_id: trace.id,
@@ -329,7 +253,6 @@ async function writeImproveBundle(root: string, bundle: ImproveBundle, out?: str
           messages: trace.trace.messages.length,
           runs: Array.isArray(trace.trace.runs) ? trace.trace.runs.length : 0,
         })),
-        evidence: summarizeImproveEvidence(bundle.evidence),
       },
       null,
       2,
@@ -350,160 +273,6 @@ async function writeImproveBundle(root: string, bundle: ImproveBundle, out?: str
   };
 }
 
-type NormalizedDeployEvidenceExport = {
-  created_at?: string;
-  deploy_id?: string;
-  traces: unknown[];
-  conversations: Array<{ id: string; updated_at?: string }>;
-  runs: unknown[];
-  raw: unknown;
-};
-
-function normalizeDeployEvidenceExport(payload: unknown): NormalizedDeployEvidenceExport {
-  const evidence = isRecord(payload) && isRecord(payload.evidence) ? payload.evidence : payload;
-
-  if (!isRecord(evidence)) {
-    throw new AgentKitError("deploy_improve_response_invalid", "Improve evidence export response was not an object.");
-  }
-
-  const traces = Array.isArray(evidence.traces) ? evidence.traces : [];
-  const conversations = Array.isArray(evidence.conversations)
-    ? evidence.conversations
-        .flatMap((conversation) => {
-          if (!isRecord(conversation)) {
-            return [];
-          }
-
-          const id = readString(conversation, "id") ?? readString(conversation, "conversation_id");
-
-          if (!id) {
-            return [];
-          }
-
-          const updatedAt = readString(conversation, "updated_at") ?? readString(conversation, "updatedAt");
-          return {
-            id,
-            ...(updatedAt ? { updated_at: updatedAt } : {}),
-          };
-        })
-    : [];
-
-  return {
-    created_at: readString(evidence, "created_at") ?? readString(evidence, "createdAt"),
-    deploy_id: readString(evidence, "deploy_id") ?? readString(evidence, "deployId"),
-    traces,
-    conversations,
-    runs: Array.isArray(evidence.runs) ? evidence.runs : [],
-    raw: evidence,
-  };
-}
-
-async function tracePacketsFromDeployEvidenceExport(input: {
-  collector: DeployImproveCollector;
-  deployId: string;
-  evidence: NormalizedDeployEvidenceExport;
-  source: ImproveSource;
-}): Promise<ImproveTracePacket[]> {
-  const traces: ImproveTracePacket[] = [];
-  const seenConversations = new Set<string>();
-
-  for (const rawTrace of input.evidence.traces) {
-    const trace = tracePacketFromPayload(input.source, input.deployId, rawTrace);
-    traces.push(trace);
-    seenConversations.add(trace.conversation_id);
-  }
-
-  for (const conversation of input.evidence.conversations) {
-    if (seenConversations.has(conversation.id)) {
-      continue;
-    }
-
-    try {
-      const trace = await input.collector.getTrace(conversation.id);
-      const packet = tracePacketFromPayload(input.source, conversation.id, trace);
-      traces.push(packet);
-      seenConversations.add(packet.conversation_id);
-    } catch {
-      traces.push(syntheticEvidenceTrace(input.source, conversation.id, {
-        updated_at: conversation.updated_at,
-        reason: "conversation trace was not available from the hosted runtime",
-      }));
-      seenConversations.add(conversation.id);
-    }
-  }
-
-  for (const run of input.evidence.runs) {
-    if (!isRecord(run)) {
-      continue;
-    }
-
-    const conversationId = readString(run, "conversation_id") ?? readString(run, "conversationId");
-
-    if (conversationId && seenConversations.has(conversationId)) {
-      continue;
-    }
-
-    const runId = readString(run, "id") ?? readString(run, "run_id") ?? `run_${shortHash(JSON.stringify(run))}`;
-    traces.push(syntheticEvidenceTrace(input.source, conversationId ?? runId, {
-      title: readString(run, "title") ?? runId,
-      updated_at: readString(run, "updated_at") ?? readString(run, "updatedAt"),
-      raw: run,
-    }));
-
-    if (conversationId) {
-      seenConversations.add(conversationId);
-    }
-  }
-
-  return traces;
-}
-
-function syntheticEvidenceTrace(
-  source: ImproveSource,
-  conversationId: string,
-  input: {
-    title?: string;
-    updated_at?: string;
-    reason?: string;
-    raw?: unknown;
-  },
-): ImproveTracePacket {
-  const safeConversationId = redactEvalText(conversationId);
-  const title = input.title ? redactEvalText(input.title) : "Hosted evidence";
-
-  return {
-    id: `trace_${slugify(title)}_${shortHash(`${source}:${conversationId}:${JSON.stringify(input.raw ?? input.reason ?? "")}`)}`,
-    source,
-    conversation_id: safeConversationId,
-    title,
-    updated_at: input.updated_at,
-    trace: {
-      messages: [
-        {
-          role: "system",
-          content: redactEvalText(input.reason ?? "Hosted evidence did not include replayable conversation messages."),
-          ...(input.updated_at ? { created_at: input.updated_at } : {}),
-        },
-      ],
-      raw: redactEvidenceValue(input.raw ?? input.reason ?? null),
-    },
-  };
-}
-
-function summarizeImproveEvidence(evidence: unknown): unknown {
-  if (!isRecord(evidence)) {
-    return evidence === undefined ? undefined : { available: true };
-  }
-
-  return {
-    deploy_id: readString(evidence, "deploy_id") ?? readString(evidence, "deployId") ?? null,
-    runs: Array.isArray(evidence.runs) ? evidence.runs.length : 0,
-    conversations: Array.isArray(evidence.conversations) ? evidence.conversations.length : 0,
-    deliveries: Array.isArray(evidence.deliveries) ? evidence.deliveries.length : 0,
-    deploy_events: Array.isArray(evidence.deploy_events) ? evidence.deploy_events.length : 0,
-  };
-}
-
 async function readImproveBundle(path: string): Promise<ImproveBundle> {
   const parsed = JSON.parse(await readFile(path, "utf8")) as unknown;
 
@@ -567,35 +336,6 @@ function resolveInsideCapsule(root: string, path: string, context: string): stri
   return resolved;
 }
 
-function normalizeConversationSummaries(payload: unknown): Array<{ id: string; updated_at?: string }> {
-  const conversations = Array.isArray(payload)
-    ? payload
-    : isRecord(payload) && Array.isArray(payload.conversations)
-      ? payload.conversations
-      : null;
-
-  if (!conversations) {
-    throw new AgentKitError("deploy_conversation_response_invalid", "Conversation list response did not include conversations.");
-  }
-
-  return conversations.map((conversation) => {
-    if (!isRecord(conversation)) {
-      throw new AgentKitError("deploy_conversation_response_invalid", "Conversation list contained a non-object entry.");
-    }
-
-    const id = readString(conversation, "id") ?? readString(conversation, "conversation_id");
-
-    if (!id) {
-      throw new AgentKitError("deploy_conversation_response_invalid", "Conversation list entry did not include an id.");
-    }
-
-    return {
-      id,
-      updated_at: readString(conversation, "updated_at") ?? readString(conversation, "updatedAt"),
-    };
-  });
-}
-
 function tracePacketFromPayload(source: ImproveSource, fallbackConversationId: string, payload: unknown): ImproveTracePacket {
   const trace = normalizeTracePayload(fallbackConversationId, payload);
   const safeConversationId = redactEvalText(trace.conversation_id);
@@ -628,7 +368,7 @@ function normalizeTracePayload(
   runs?: unknown[];
 } {
   if (!isRecord(payload)) {
-    throw new AgentKitError("deploy_conversation_response_invalid", "Conversation trace response was not an object.");
+    throw new AgentKitError("conversation_response_invalid", "Conversation trace response was not an object.");
   }
 
   const conversationId = readString(payload, "id") ?? readString(payload, "conversation_id") ?? fallbackConversationId;

package/src/runtime/inspect.ts

@@ -4,11 +4,6 @@ import type { AgentChannel, AgentProvider, AgentRuntime, AccessMode } from "../i
 import type { LoadedAgentCapsule } from "./config";
 import { loadAgentCapsule } from "./config";
 import { loadCapsuleEnv } from "./env";
-import {
-  createManagedComposioTools,
-  managedComposioRequiredSecrets,
-  resolveManagedComposioIntegrations,
-} from "./integrations/composio";
 import { resolveKnowledgeConfig } from "./knowledge/config";
 import { KNOWLEDGE_SEARCH_TOOL_NAME } from "./knowledge/tool";
 import { resolveRuntimeTimeZone } from "./prompt-context";
@@ -27,7 +22,6 @@ export type AgentInspectState = {
   };
   prompt: string;
   tools: string[];
-  integrations: AgentInspectIntegration[];
   channels: AgentInspectChannel[];
   transcription: {
     enabled: boolean;
@@ -67,16 +61,9 @@ export type AgentInspectState = {
       target: "bun";
       database: "sqlite" | "none";
     };
-    hosted: {
-      environment: "hosted";
-      target: "cloudflare";
-      database: "turso" | "none";
-      providerSupported: boolean;
-    };
     aliases: ["ctx.db", "ctx.database", "ctx.storage.sql"];
   };
   secrets: Record<string, SecretState>;
-  managedSecrets: string[];
   userSecrets: string[];
   skills: AgentInspectSkills;
   warnings: AgentInspectWarning[];
@@ -89,12 +76,6 @@ export type AgentInspectDatabase = {
     schema: string | null;
     migrations: string | null;
   };
-  hosted: {
-    driver: "none" | "turso";
-    provisioning: "none" | "agentkit-managed";
-    schema: string | null;
-    migrations: string | null;
-  };
 };
 
 export type AgentInspectChannel = {
@@ -127,15 +108,6 @@ export type AgentInspectWarning = {
   command?: string;
 };
 
-export type AgentInspectIntegration = {
-  name: string;
-  provider: "composio";
-  mode: "managed";
-  toolkits: string[];
-  tools: string[];
-  userId: string;
-};
-
 export async function inspectAgentCapsule(
   cwd = process.cwd(),
   env: Record<string, string | undefined> = process.env,
@@ -151,10 +123,9 @@ export function buildInspectState(
 ): AgentInspectState {
   const declaredSecrets = new Set(capsule.config.secrets);
   const knowledge = resolveKnowledgeConfig(capsule.config);
-  const integrationTools = createManagedComposioTools(capsule.config);
   const transcription = resolveTranscriptionConfig(capsule.config.transcription);
 
-  for (const tool of [...integrationTools, ...(capsule.config.tools ?? [])]) {
+  for (const tool of capsule.config.tools ?? []) {
     for (const secret of tool.secrets ?? []) {
       declaredSecrets.add(secret);
     }
@@ -174,10 +145,7 @@ export function buildInspectState(
     declaredSecrets.add(transcription.secret);
   }
 
-  const managedSecrets = managedCloudSecrets(capsule);
-  const managedSecretSet = new Set(managedSecrets);
   const userSecrets = Array.from(declaredSecrets)
-    .filter((secret) => !managedSecretSet.has(secret))
     .sort();
   const secrets: Record<string, SecretState> = {};
 
@@ -202,16 +170,7 @@ export function buildInspectState(
       }),
     },
     prompt: toCapsulePath(capsule.root, capsule.instructionsPath),
-    tools: [...integrationTools, ...(capsule.config.tools ?? [])].map((tool) => tool.name),
-    integrations: resolveManagedComposioIntegrations(capsule.config).map((integration) => ({
-      name: integration.name,
-      provider: integration.provider,
-      mode: integration.mode,
-      toolkits: integration.toolkits,
-      tools: integration.allowedTools,
-      userId: integration.userId,
-      confirmExternalWrites: integration.confirmExternalWrites !== false,
-    })),
+    tools: (capsule.config.tools ?? []).map((tool) => tool.name),
     channels: (capsule.config.channels ?? []).map((channel) => ({
       name: channel.name,
       type: channel.type,
@@ -264,16 +223,9 @@ export function buildInspectState(
         target: "bun",
         database: capsule.storagePath ? "sqlite" : "none",
       },
-      hosted: {
-        environment: "hosted",
-        target: "cloudflare",
-        database: database.hosted.driver === "turso" ? "turso" : "none",
-        providerSupported: true,
-      },
       aliases: ["ctx.db", "ctx.database", "ctx.storage.sql"],
     },
     secrets,
-    managedSecrets,
     userSecrets,
     skills,
     warnings,
@@ -287,8 +239,8 @@ function toCapsulePath(root: string, path: string): string {
 
 function inspectDatabase(capsule: LoadedAgentCapsule): AgentInspectDatabase {
   const database = capsule.config.storage.database;
-  const schema = database?.driver === "turso" && database.schema ? database.schema : null;
-  const migrations = database?.driver === "turso" ? database.migrations ?? "migrations" : null;
+  const schema = database?.driver === "sqlite" && database.schema ? database.schema : null;
+  const migrations = database?.driver === "sqlite" ? database.migrations ?? "migrations" : null;
 
   return {
     local: {
@@ -297,12 +249,6 @@ function inspectDatabase(capsule: LoadedAgentCapsule): AgentInspectDatabase {
       schema,
       migrations,
     },
-    hosted: {
-      driver: database?.driver === "turso" ? "turso" : "none",
-      provisioning: database?.driver === "turso" ? "agentkit-managed" : "none",
-      schema,
-      migrations,
-    },
   };
 }
 
@@ -333,6 +279,15 @@ function inspectWarnings(
 ): AgentInspectWarning[] {
   const warnings: AgentInspectWarning[] = [];
 
+  for (const channel of capsule.config.channels ?? []) {
+    if (channel.type === "discord" && channel.mode === "bot") {
+      warnings.push({
+        code: "discord_gateway_bridge_required",
+        message: `Discord channel "${channel.name}" uses bot mode, but AgentKit does not connect to the Gateway. Inviting the bot alone cannot deliver messages. Use interactions or run your own Gateway bridge to forward authenticated events.`,
+      });
+    }
+  }
+
   if (skills.status === "missing" || skills.status === "outdated") {
     warnings.push({
       code: "local_skills_outdated",
@@ -355,18 +310,3 @@ function inspectWarnings(
 
   return warnings;
 }
-
-function managedCloudSecrets(capsule: LoadedAgentCapsule): string[] {
-  const secrets = new Set<string>();
-
-  if (capsule.config.storage.database?.driver === "turso") {
-    secrets.add("TURSO_AUTH_TOKEN");
-    secrets.add("TURSO_DATABASE_URL");
-  }
-
-  for (const secret of managedComposioRequiredSecrets(capsule.config)) {
-    secrets.add(secret);
-  }
-
-  return Array.from(secrets).sort();
-}

package/src/runtime/knowledge/ingest.ts

@@ -271,7 +271,7 @@ async function ingestKnowledgeSource(
   if (source.kind === "url") {
     throw new AgentKitError(
       "knowledge_source_unsupported",
-      "URL knowledge sources are planned for hosted ingestion. Local Knowledge currently supports .md, .txt, and .csv files.",
+      "URL knowledge ingestion is not supported. Local Knowledge currently supports .md, .txt, and .csv files.",
     );
   }
 

package/src/runtime/knowledge/tool.ts

@@ -1,10 +1,22 @@
 import type { AgentTool } from "../../index";
 import type { LoadedAgentCapsule } from "../config";
 import { resolveKnowledgeConfig } from "./config";
-import { searchKnowledge } from "./retrieve";
+import { searchKnowledge, type KnowledgeSearchResult } from "./retrieve";
 
 export const KNOWLEDGE_SEARCH_TOOL_NAME = "agentkit_search_knowledge";
 
+// Only the actual built-in tool may expose retrieval facts to the model.
+const knowledgeTools = new WeakSet<AgentTool>();
+
+export function knowledgeModelText(tool: AgentTool, output: unknown): string | undefined {
+  if (!knowledgeTools.has(tool)) return undefined;
+  const { results } = output as { results: Array<Pick<KnowledgeSearchResult, "content" | "source">> };
+  return results.map(({ content, source }) => {
+    const reference = [source.path, source.title, source.section, source.locator].filter(Boolean).join(" > ");
+    return `${content}\nSource: ${reference}`;
+  }).join("\n\n") || "No relevant Knowledge results found.";
+}
+
 export function createKnowledgeSearchTool(capsule: LoadedAgentCapsule): AgentTool | null {
   const knowledge = resolveKnowledgeConfig(capsule.config);
 
@@ -12,7 +24,7 @@ export function createKnowledgeSearchTool(capsule: LoadedAgentCapsule): AgentToo
     return null;
   }
 
-  return {
+  const tool: AgentTool = {
     name: KNOWLEDGE_SEARCH_TOOL_NAME,
     description: "Search the Agent Capsule's configured Knowledge sources for business-specific facts.",
     visibility: "internal",
@@ -61,4 +73,6 @@ export function createKnowledgeSearchTool(capsule: LoadedAgentCapsule): AgentToo
       };
     },
   };
+  knowledgeTools.add(tool);
+  return tool;
 }

package/src/runtime/knowledge/vector.ts

@@ -181,7 +181,7 @@ export async function searchLocalKnowledgeVectorRows(options: {
     const result = await client.execute({
       sql: `
         SELECT
-          c.id AS chunk_id,
+          c.chunk_id AS chunk_id,
           c.source_id AS source_id,
           c.content AS content,
           c.title AS title,

package/src/runtime/tool-runner.ts

@@ -1,8 +1,7 @@
 import { loadAgentCapsule } from "./config";
 import { openPreparedCapsuleStore } from "./database";
-import { loadCapsuleEnv } from "./env";
+import { collectSecretValues, loadCapsuleEnv } from "./env";
 import { isAgentKitError } from "./errors";
-import { createManagedComposioTools } from "./integrations/composio";
 import { buildRuntimeClockContext } from "./prompt-context";
 import { createToolRuntime, type ToolCallResult } from "./tools";
 
@@ -16,6 +15,7 @@ export type RunToolOptions = {
 export async function runToolFromCwd(cwd: string, options: RunToolOptions): Promise<ToolCallResult> {
   const capsule = await loadAgentCapsule(cwd);
   const env = await loadCapsuleEnv(capsule.root);
+  const secretValues = collectSecretValues(capsule.config, env);
   const { store } = await openPreparedCapsuleStore(capsule);
   const conversation = store.createConversation({
     agentName: capsule.config.name,
@@ -27,11 +27,12 @@ export async function runToolFromCwd(cwd: string, options: RunToolOptions): Prom
     model: capsule.config.provider.model,
   });
   const toolRuntime = createToolRuntime({
-    tools: [...createManagedComposioTools(capsule.config), ...(capsule.config.tools ?? [])],
+    tools: capsule.config.tools ?? [],
     store,
     runId: run.id,
     conversationId: conversation.id,
     env,
+    secretValues,
     signal: options.signal,
     clock: buildRuntimeClockContext({
       timeZone: capsule.config.timeZone,
@@ -64,6 +65,7 @@ export async function runToolFromCwd(cwd: string, options: RunToolOptions): Prom
       status: "failed",
       errorCode: isAgentKitError(error) ? error.code : "runtime_error",
       errorMessage: error instanceof Error ? error.message : String(error),
+      secretValues,
     });
 
     throw error;

package/src/runtime/tools.ts

@@ -1,6 +1,8 @@
 import type { AgentTool, JsonSchema, ToolContext, ToolRenderResult, ToolRuntimeContext } from "../index";
-import type { SqliteAgentKitStore } from "../storage/sqlite";
+import { redactSecrets, type SqliteAgentKitStore } from "../storage/sqlite";
 import { createLocalDatabaseRunner } from "./database";
+import { collectSecretValues } from "./env";
+import { knowledgeModelText } from "./knowledge/tool";
 import { AgentKitError } from "./errors";
 import type { RuntimeClockContext } from "./prompt-context";
 
@@ -16,6 +18,8 @@ export type ToolCallResult = {
   input: unknown;
   output: unknown;
   rendered?: ToolRenderResult;
+  // Redacted facts from built-in Knowledge only; never a user-facing renderer.
+  modelText?: string;
 };
 
 export type ToolRuntime = {
@@ -29,6 +33,7 @@ export type ToolRuntimeOptions = {
   runId: string;
   conversationId: string;
   env?: Record<string, string | undefined>;
+  secretValues?: string[];
   signal?: AbortSignal;
   defaultTimeoutMs?: number;
   runtime: ToolRuntimeContext;
@@ -63,7 +68,7 @@ async function executeToolCall(
 ): Promise<ToolCallResult> {
   let input: unknown = request.input ?? {};
   const tool = toolsByName.get(request.name);
-  const preliminarySecretValues = collectConfiguredSecretValues(tool, options.env ?? process.env);
+  const preliminarySecretValues = collectSecretValues(tool, options.env ?? process.env);
   const toolCall = options.store.createToolCall({
     runId: options.runId,
     conversationId: options.conversationId,
@@ -112,6 +117,7 @@ async function executeToolCall(
       secretValues,
     });
 
+    const modelText = knowledgeModelText(tool, output);
     return {
       id: toolCall.id,
       name: tool.name,
@@ -119,9 +125,10 @@ async function executeToolCall(
       input,
       output,
       ...(rendered ? { rendered } : {}),
+      ...(modelText !== undefined ? { modelText: redactSecrets(modelText, options.secretValues ?? secretValues) } : {}),
     };
   } catch (error) {
-    const secretValues = collectConfiguredSecretValues(tool, options.env ?? process.env);
+    const secretValues = collectSecretValues(tool, options.env ?? process.env);
 
     options.store.completeToolCall({
       toolCallId: toolCall.id,
@@ -287,17 +294,6 @@ function resolveToolSecrets(
   return { secrets, secretValues: Object.values(secrets) };
 }
 
-function collectConfiguredSecretValues(tool: AgentTool | undefined, env: Record<string, string | undefined>): string[] {
-  if (!tool) {
-    return [];
-  }
-
-  return (tool.secrets ?? []).flatMap((secretName) => {
-    const value = env[secretName];
-    return value ? [value] : [];
-  });
-}
-
 async function runToolWithTimeout(
   tool: AgentTool,
   input: unknown,