@arnilo/prism 0.0.6 → 0.0.8

package/dist/run-ledger.js

@@ -0,0 +1,115 @@
+export const DEFAULT_LEDGER_BATCH_ENTRIES = 128;
+export const HARD_LEDGER_BATCH_ENTRIES = 4096;
+export const DEFAULT_LEDGER_BATCH_BYTES = 512 * 1024;
+export const HARD_LEDGER_BATCH_BYTES = 8 * 1024 * 1024;
+export const DEFAULT_LEDGER_BATCH_DELAY_MS = 25;
+export const HARD_LEDGER_BATCH_DELAY_MS = 60_000;
+function integer(value, fallback, hard, name) {
+    const selected = value ?? fallback;
+    if (!Number.isInteger(selected) || selected < 1 || selected > hard)
+        throw new RangeError(`${name} must be an integer in [1, ${hard}]`);
+    return selected;
+}
+function terminal(record) {
+    return record.status !== undefined && record.status !== "queued" && record.status !== "running";
+}
+/**
+ * Wrap any RunLedger with one bounded FIFO. Inputs must already be redacted, as required by RunLedger.
+ * `buffered` may lose accepted records on process crash; call `flush()` for acknowledgement.
+ */
+export function createBatchedRunLedger(target, options = {}) {
+    const maxBatchEntries = integer(options.maxBatchEntries, DEFAULT_LEDGER_BATCH_ENTRIES, HARD_LEDGER_BATCH_ENTRIES, "maxBatchEntries");
+    const maxBatchBytes = integer(options.maxBatchBytes, DEFAULT_LEDGER_BATCH_BYTES, HARD_LEDGER_BATCH_BYTES, "maxBatchBytes");
+    const maxBufferedEntries = integer(options.maxBufferedEntries, Math.min(HARD_LEDGER_BATCH_ENTRIES, maxBatchEntries * 2), HARD_LEDGER_BATCH_ENTRIES, "maxBufferedEntries");
+    const maxBufferedBytes = integer(options.maxBufferedBytes, Math.min(HARD_LEDGER_BATCH_BYTES, maxBatchBytes * 2), HARD_LEDGER_BATCH_BYTES, "maxBufferedBytes");
+    const maxDelayMs = integer(options.maxDelayMs, DEFAULT_LEDGER_BATCH_DELAY_MS, HARD_LEDGER_BATCH_DELAY_MS, "maxDelayMs");
+    const durability = options.durability ?? "flush_on_terminal";
+    const queue = [];
+    let bufferedBytes = 0;
+    let accepted = 0;
+    let flushed = 0;
+    let timer;
+    let flushChain = Promise.resolve();
+    let disposed = false;
+    const status = () => ({ accepted, flushed, buffered: queue.length });
+    const cancelTimer = () => { if (timer)
+        clearTimeout(timer); timer = undefined; };
+    const schedule = () => {
+        if (timer || disposed || queue.length === 0)
+            return;
+        timer = setTimeout(() => { timer = undefined; void flush().catch(() => undefined); }, maxDelayMs);
+        timer.unref?.();
+    };
+    const write = (item) => {
+        if (item.kind === "run")
+            return target.appendRun(item.record);
+        if (item.kind === "event")
+            return target.appendEvent(item.record);
+        if (item.kind === "tool")
+            return target.appendToolCall(item.record);
+        return target.appendUsage(item.record);
+    };
+    const flush = () => {
+        cancelTimer();
+        const operation = flushChain.then(async () => {
+            let entries = 0;
+            let bytes = 0;
+            while (queue.length) {
+                const item = queue[0];
+                if (entries && (entries >= maxBatchEntries || bytes + item.bytes > maxBatchBytes)) {
+                    entries = 0;
+                    bytes = 0;
+                }
+                await write(item);
+                queue.shift();
+                bufferedBytes -= item.bytes;
+                flushed += 1;
+                entries += 1;
+                bytes += item.bytes;
+            }
+            return status();
+        });
+        flushChain = operation.then(() => undefined, () => undefined);
+        return operation;
+    };
+    const enqueue = async (item) => {
+        if (disposed)
+            throw new Error("batched run ledger is disposed");
+        const bytes = Buffer.byteLength(JSON.stringify(item.record));
+        if (bytes > maxBatchBytes || bytes > maxBufferedBytes)
+            throw new RangeError("run ledger record exceeds byte limit");
+        if (queue.length >= maxBufferedEntries || bufferedBytes + bytes > maxBufferedBytes)
+            await flush();
+        queue.push({ ...item, bytes });
+        bufferedBytes += bytes;
+        accepted += 1;
+        if (durability === "write_through" || queue.length >= maxBatchEntries || bufferedBytes >= maxBatchBytes || (item.kind === "run" && terminal(item.record) && durability === "flush_on_terminal"))
+            await flush();
+        else
+            schedule();
+    };
+    return {
+        durability,
+        appendRun: (record) => enqueue({ kind: "run", record }),
+        appendEvent: (record) => enqueue({ kind: "event", record }),
+        appendToolCall: (record) => enqueue({ kind: "tool", record }),
+        appendUsage: (record) => enqueue({ kind: "usage", record }),
+        flush,
+        status,
+        async dispose(disposeOptions = {}) {
+            disposed = true;
+            cancelTimer();
+            if (disposeOptions.flush !== false)
+                await flush();
+            else {
+                await flushChain;
+                queue.length = 0;
+                bufferedBytes = 0;
+            }
+        },
+    };
+}
+export function isFlushableRunLedger(ledger) {
+    return "flush" in ledger && typeof ledger.flush === "function";
+}
+//# sourceMappingURL=run-ledger.js.map

package/dist/run-limits.d.ts

@@ -0,0 +1,34 @@
+import type { RunLimitBreach, RunLimitCounters, RunLimitName, RunLimits, Usage } from "./contracts.js";
+export declare const DEFAULT_RUN_LIMITS: Required<Omit<RunLimits, "maxCost">>;
+export declare const HARD_MAX_RUN_COST = 10000;
+export declare const HARD_RUN_LIMITS: Required<Omit<RunLimits, "maxCost">>;
+export declare class RunLimitError extends Error {
+    readonly breach: RunLimitBreach;
+    readonly code = "ERR_PRISM_RUN_LIMIT";
+    constructor(breach: RunLimitBreach);
+}
+export interface RunLimitTrackerOptions {
+    readonly onExceeded?: (breach: RunLimitBreach) => void;
+    /** Durable resumption restores cumulative counters and original wall deadline. */
+    readonly snapshot?: RunLimitCounters;
+    readonly deadlineAt?: string;
+}
+/** Validate one host-authored layer. Defaults are applied only after inheritance is resolved. */
+export declare function resolveRunLimits(agent?: RunLimits, run?: RunLimits): Readonly<Required<Omit<RunLimits, "maxCost">> & Pick<RunLimits, "maxCost">>;
+export declare class RunLimitTracker {
+    private readonly options;
+    readonly limits: Readonly<Required<Omit<RunLimits, "maxCost">> & Pick<RunLimits, "maxCost">>;
+    private readonly startedAt;
+    readonly deadlineAt: string;
+    private readonly counters;
+    private timer?;
+    private exceeded?;
+    constructor(limits: Readonly<Required<Omit<RunLimits, "maxCost">> & Pick<RunLimits, "maxCost">>, options?: RunLimitTrackerOptions);
+    get breach(): RunLimitBreach | undefined;
+    snapshot(): RunLimitCounters;
+    dispose(): void;
+    charge(limit: Exclude<RunLimitName, "maxCost">, delta?: number): void;
+    recordUsage(usage: Usage | undefined): void;
+    private exceed;
+}
+export declare function createRunLimitTracker(limits: RunLimits | undefined, options?: RunLimitTrackerOptions): RunLimitTracker;

package/dist/run-limits.js

@@ -0,0 +1,163 @@
+export const DEFAULT_RUN_LIMITS = Object.freeze({
+    maxTurns: 16,
+    maxProviderAttempts: 24,
+    maxToolRounds: 8,
+    maxToolCalls: 32,
+    maxWallTimeMs: 120_000,
+    maxRequestBytes: 8 * 1024 * 1024,
+    maxResponseBytes: 8 * 1024 * 1024,
+    maxInputTokens: 40_000,
+    maxOutputTokens: 10_000,
+    maxTotalTokens: 50_000,
+});
+export const HARD_MAX_RUN_COST = 10_000;
+export const HARD_RUN_LIMITS = Object.freeze({
+    maxTurns: 64,
+    maxProviderAttempts: 256,
+    maxToolRounds: 64,
+    maxToolCalls: 256,
+    maxWallTimeMs: 30 * 60_000,
+    maxRequestBytes: 64 * 1024 * 1024,
+    maxResponseBytes: 64 * 1024 * 1024,
+    maxInputTokens: 1_000_000,
+    maxOutputTokens: 250_000,
+    maxTotalTokens: 1_000_000,
+});
+const LIMIT_NAMES = Object.keys(DEFAULT_RUN_LIMITS);
+const COUNTER_FOR = {
+    maxTurns: "turns",
+    maxProviderAttempts: "providerAttempts",
+    maxToolRounds: "toolRounds",
+    maxToolCalls: "toolCalls",
+    maxWallTimeMs: "wallTimeMs",
+    maxRequestBytes: "requestBytes",
+    maxResponseBytes: "responseBytes",
+    maxInputTokens: "inputTokens",
+    maxOutputTokens: "outputTokens",
+    maxTotalTokens: "totalTokens",
+    maxCost: "cost",
+};
+export class RunLimitError extends Error {
+    breach;
+    code = "ERR_PRISM_RUN_LIMIT";
+    constructor(breach) {
+        super(`Run limit exceeded: ${breach.limit}`);
+        this.breach = breach;
+        this.name = "RunLimitError";
+    }
+}
+/** Validate one host-authored layer. Defaults are applied only after inheritance is resolved. */
+export function resolveRunLimits(agent, run) {
+    const base = agent ? validateLimits(agent) : undefined;
+    const override = run ? validateLimits(run) : undefined;
+    const resolved = { ...DEFAULT_RUN_LIMITS };
+    for (const name of LIMIT_NAMES) {
+        if (base?.[name] !== undefined)
+            resolved[name] = base[name];
+        if (override?.[name] !== undefined)
+            resolved[name] = base ? Math.min(resolved[name], override[name]) : override[name];
+    }
+    const maxCost = override?.maxCost ?? base?.maxCost;
+    return Object.freeze({ ...resolved, ...(maxCost ? { maxCost: base?.maxCost && override?.maxCost ? { amount: Math.min(base.maxCost.amount, override.maxCost.amount), currency: base.maxCost.currency === override.maxCost.currency ? base.maxCost.currency : failCurrency() } : maxCost } : {}) });
+}
+function failCurrency() { throw new TypeError("Run limit currencies must match when narrowed"); }
+function validateLimits(input) {
+    for (const name of LIMIT_NAMES) {
+        const value = input[name];
+        if (value === undefined)
+            continue;
+        if (!Number.isSafeInteger(value) || value < 1 || value > HARD_RUN_LIMITS[name]) {
+            throw new TypeError(`${name} must be a positive safe integer at most ${HARD_RUN_LIMITS[name]}`);
+        }
+    }
+    if (input.maxCost) {
+        const { amount, currency } = input.maxCost;
+        if (!Number.isFinite(amount) || amount < 0 || amount > HARD_MAX_RUN_COST || !currency.trim())
+            throw new TypeError(`maxCost requires a finite amount from 0 through ${HARD_MAX_RUN_COST} and currency`);
+    }
+    return input;
+}
+export class RunLimitTracker {
+    options;
+    limits;
+    startedAt = performance.now();
+    deadlineAt;
+    counters;
+    timer;
+    exceeded;
+    constructor(limits, options = {}) {
+        this.options = options;
+        this.limits = limits;
+        this.counters = { turns: 0, providerAttempts: 0, toolRounds: 0, toolCalls: 0, wallTimeMs: 0, requestBytes: 0, responseBytes: 0, inputTokens: 0, outputTokens: 0, totalTokens: 0, cost: 0, ...options.snapshot };
+        for (const [key, value] of Object.entries(this.counters)) {
+            if (!Number.isFinite(value) || value < 0 || (key !== "cost" && !Number.isSafeInteger(value))) {
+                throw new TypeError("Run limit snapshot must contain finite non-negative counters");
+            }
+        }
+        const deadline = options.deadlineAt ? Date.parse(options.deadlineAt) : Date.now() + limits.maxWallTimeMs;
+        if (!Number.isFinite(deadline))
+            throw new TypeError("Run limit deadlineAt is invalid");
+        this.deadlineAt = new Date(deadline).toISOString();
+        const remaining = Math.max(0, deadline - Date.now());
+        this.timer = setTimeout(() => this.exceed("maxWallTimeMs", limits.maxWallTimeMs), remaining);
+        this.timer.unref?.();
+        if (remaining === 0)
+            this.exceed("maxWallTimeMs", limits.maxWallTimeMs);
+    }
+    get breach() { return this.exceeded; }
+    snapshot() { return { ...this.counters, wallTimeMs: Math.min(this.limits.maxWallTimeMs, Math.ceil(performance.now() - this.startedAt)) }; }
+    dispose() { if (this.timer)
+        clearTimeout(this.timer); this.timer = undefined; }
+    charge(limit, delta = 1) {
+        if (!Number.isSafeInteger(delta) || delta < 0)
+            throw new TypeError("Run limit delta must be a non-negative safe integer");
+        const counter = COUNTER_FOR[limit];
+        const observed = this.counters[counter] + delta;
+        if (!Number.isSafeInteger(observed))
+            this.exceed(limit, Number.MAX_SAFE_INTEGER + 1);
+        this.counters[counter] = observed;
+        if (observed > this.limits[limit])
+            this.exceed(limit, observed);
+    }
+    recordUsage(usage) {
+        if (!usage) {
+            if (this.limits.maxCost)
+                this.exceed("maxCost", Number.POSITIVE_INFINITY);
+            return;
+        }
+        for (const key of ["inputTokens", "outputTokens", "totalTokens", "cacheReadTokens", "cacheWriteTokens"]) {
+            const value = usage[key];
+            if (value !== undefined && (!Number.isSafeInteger(value) || value < 0))
+                throw new TypeError(`Provider usage ${key} must be a non-negative safe integer`);
+        }
+        const total = usage.totalTokens ?? ((usage.inputTokens ?? 0) + (usage.outputTokens ?? 0));
+        if (!Number.isSafeInteger(total))
+            throw new TypeError("Provider usage totalTokens is invalid");
+        this.charge("maxInputTokens", usage.inputTokens ?? 0);
+        this.charge("maxOutputTokens", usage.outputTokens ?? 0);
+        this.charge("maxTotalTokens", total);
+        if (usage.cost !== undefined && (!Number.isFinite(usage.cost) || usage.cost < 0))
+            throw new TypeError("Provider usage cost must be finite and non-negative");
+        if (!this.limits.maxCost)
+            return;
+        if (usage.cost === undefined || usage.currency !== this.limits.maxCost.currency)
+            this.exceed("maxCost", Number.POSITIVE_INFINITY);
+        const observed = this.counters.cost + usage.cost;
+        this.counters.cost = observed;
+        if (observed > this.limits.maxCost.amount)
+            this.exceed("maxCost", observed);
+    }
+    exceed(limit, observed) {
+        if (!this.exceeded) {
+            const maximum = limit === "maxCost" ? this.limits.maxCost?.amount ?? 0 : this.limits[limit];
+            this.exceeded = { limit, maximum, observed, ...(limit === "maxCost" && this.limits.maxCost ? { currency: this.limits.maxCost.currency } : {}) };
+            this.options.onExceeded?.(this.exceeded);
+        }
+        if (limit !== "maxWallTimeMs")
+            throw new RunLimitError(this.exceeded);
+    }
+}
+export function createRunLimitTracker(limits, options) {
+    return new RunLimitTracker(resolveRunLimits(undefined, limits), options);
+}
+//# sourceMappingURL=run-limits.js.map

package/dist/secure-agent.d.ts

@@ -0,0 +1,3 @@
+import type { Agent, SecureAgentOptions } from "./contracts.js";
+/** Build an opt-in agent whose security-critical defaults cannot be replaced per run. */
+export declare function createSecureAgent(options: SecureAgentOptions): Agent;

package/dist/secure-agent.js

@@ -0,0 +1,63 @@
+import { createAgent } from "./agents.js";
+import { validateRunStateOptions } from "./agent-run-state.js";
+import { resolveRunLimits } from "./run-limits.js";
+import { createToolParameterValidator, createToolRegistry } from "./tools.js";
+/** Build an opt-in agent whose security-critical defaults cannot be replaced per run. */
+export function createSecureAgent(options) {
+    if (!options.id.trim())
+        throw new TypeError("Secure agent requires a non-empty id");
+    if (!options.definitionRevision.trim())
+        throw new TypeError("Secure agent requires a non-empty definitionRevision");
+    if (!options.redactor || typeof options.redactor.redact !== "function")
+        throw new TypeError("Secure agent requires a redactor");
+    if (!options.permission || typeof options.permission.check !== "function")
+        throw new TypeError("Secure agent requires a permission policy");
+    if (!options.trust || typeof options.trust.check !== "function")
+        throw new TypeError("Secure agent requires a trust policy");
+    if (!options.toolArgumentValidator || typeof options.toolArgumentValidator.validate !== "function")
+        throw new TypeError("Secure agent requires a tool argument validator");
+    if (!options.limits || Object.keys(options.limits).length === 0)
+        throw new TypeError("Secure agent requires explicit limits");
+    if (!options.ownership || !Object.values(options.ownership).some((value) => typeof value === "string" && value.trim()))
+        throw new TypeError("Secure agent requires non-empty ownership");
+    for (const tool of options.tools) {
+        if (!tool.name.trim())
+            throw new TypeError("Secure agent tool names must be non-empty");
+        if (!tool.parameters || Object.keys(tool.parameters).length === 0)
+            throw new TypeError(`Secure agent tool ${tool.name} requires a non-empty parameters schema`);
+    }
+    resolveRunLimits(options.limits);
+    const runState = Object.freeze({ ...options.runState, definitionRevision: options.definitionRevision, interruptBeforeTool: true });
+    validateRunStateOptions(runState);
+    const config = Object.freeze({
+        ...withoutSecureFields(options),
+        id: options.id,
+        tools: createToolRegistry(options.tools, { duplicate: "error" }),
+        validator: createToolParameterValidator(options.toolArgumentValidator, { missingSchema: "reject" }),
+        redactor: options.redactor,
+        permission: options.permission,
+        trust: options.trust,
+        ownership: Object.freeze({ ...options.ownership }),
+        limits: Object.freeze({ ...options.limits }),
+        guardrails: freezeGuardrails(options.guardrails),
+        runState,
+        secure: true,
+    });
+    return createAgent(config);
+}
+function withoutSecureFields(options) {
+    const { tools: _tools, toolArgumentValidator: _validator, redactor: _redactor, permission: _permission, trust: _trust, ownership: _ownership, limits: _limits, guardrails: _guardrails, definitionRevision: _revision, runState: _runState, ...config } = options;
+    return config;
+}
+function freezeGuardrails(guardrails) {
+    if (!guardrails)
+        return undefined;
+    return Object.freeze({
+        ...guardrails,
+        input: Object.freeze([...(guardrails.input ?? [])]),
+        output: Object.freeze([...(guardrails.output ?? [])]),
+        toolInput: Object.freeze([...(guardrails.toolInput ?? [])]),
+        toolOutput: Object.freeze([...(guardrails.toolOutput ?? [])]),
+    });
+}
+//# sourceMappingURL=secure-agent.js.map

package/dist/tools.d.ts

@@ -1,8 +1,9 @@
-import type { AgentEvent, ErrorInfo, JsonObject, OwnershipScope, RunLedger, ToolCallContent, ToolDefinition, ToolExecutionContext, ToolRegistry, ToolResult } from "./contracts.js";
+import type { AgentEvent, ErrorInfo, Guardrails, JsonObject, OwnershipScope, RunLedger, ToolCallContent, ToolDefinition, ToolExecutionContext, ToolRegistry, ToolResult } from "./contracts.js";
+import type { RunLimitTracker } from "./run-limits.js";
 import type { MiddlewareRegistry } from "./middleware.js";
 import { type SecretRedactor } from "./redaction.js";
 import { type DuplicateRegistrationOptions } from "./registry-options.js";
-import { type PermissionPolicy } from "./security.js";
+import { type PermissionPolicy, type TrustPolicy } from "./security.js";
 export interface ToolFilter {
     readonly allow?: readonly string[];
     readonly deny?: readonly string[];
@@ -33,12 +34,19 @@ export interface DispatchToolCallOptions {
     readonly filter?: ToolFilterInput;
     readonly middleware?: MiddlewareRegistry;
     readonly validate?: ToolValidator;
+    /** Adapter-specific policy check immediately before the tool side effect. */
+    readonly beforeExecute?: (call: ToolCallContent, tool: ToolDefinition, context: ToolExecutionContext) => void | Promise<void>;
     readonly emit?: (event: AgentEvent) => void | Promise<void>;
     readonly secrets?: readonly (string | undefined)[];
     readonly permission?: PermissionPolicy;
+    readonly trust?: TrustPolicy;
     readonly redactor?: SecretRedactor;
     readonly ledger?: RunLedger;
     readonly ownership?: OwnershipScope;
+    /** Tool stages run after middleware normalization and before side effects/exposure. */
+    readonly guardrails?: Guardrails;
+    /** Shared run tracker; direct hosts may supply one for their call scope. */
+    readonly limitTracker?: RunLimitTracker;
 }
 export interface ToolRegistryOptions extends DuplicateRegistrationOptions {
 }

package/dist/tools.js

@@ -1,8 +1,9 @@
 import { isJsonObject } from "./config.js";
 import { createId } from "./ids.js";
+import { GuardrailError, runGuardrails } from "./guardrails.js";
 import { errorToErrorInfo, redactRunLedgerRecord, redactSecrets } from "./redaction.js";
 import { assertCanRegister } from "./registry-options.js";
-import { assertPermission } from "./security.js";
+import { assertPermission, assertTrusted } from "./security.js";
 /** Wrap a schema adapter as the existing `ToolValidator` seam used by dispatch and the agent runtime. */
 export function createToolParameterValidator(validator, options = {}) {
     const missingSchema = options.missingSchema ?? "allow";
@@ -59,10 +60,28 @@ function toolExecutionMetadata(startedAt, status) {
 export async function dispatchToolCall(options) {
     const secrets = options.secrets ?? [];
     const startedAt = new Date().toISOString();
-    const precheck = await checkCall(options.call, options, startedAt);
-    if (precheck)
-        return precheck;
+    options.limitTracker?.charge("maxToolCalls");
     const mediatedCall = await (options.middleware?.run("tool_call", options.call) ?? options.call);
+    const inputGuards = await runGuardrails({
+        stage: "tool_input",
+        guardrails: options.guardrails,
+        value: mediatedCall,
+        context: {
+            sessionId: options.context.sessionId,
+            runId: options.context.runId,
+            toolCallId: mediatedCall.id,
+            toolName: mediatedCall.name,
+            metadata: options.context.metadata ?? {},
+            signal: options.context.signal,
+        },
+        redactor: options.redactor,
+        emit: options.emit,
+    });
+    if (inputGuards.terminal) {
+        if (inputGuards.terminal.action !== "block")
+            throw new GuardrailError(inputGuards.terminal);
+        return blocked(mediatedCall, options.context, "guardrail_blocked", { message: "Tool call blocked by guardrail" }, options, startedAt);
+    }
     const tool = options.registry.get(mediatedCall.name);
     const postcheck = await checkCall(mediatedCall, options, startedAt);
     if (postcheck)
@@ -89,6 +108,7 @@ export async function dispatchToolCall(options) {
         },
     };
     try {
+        await assertTrusted(options.trust, { kind: "tool", target: mediatedCall.name, capability: "execute", metadata: options.context.metadata });
         await assertPermission(options.permission, { kind: "tool", action: "execute", target: mediatedCall.name, metadata: options.context.metadata });
     }
     catch (error) {
@@ -97,11 +117,39 @@ export async function dispatchToolCall(options) {
     const validation = await options.validate?.(tool, mediatedCall.arguments, context);
     if (validation)
         return blocked(mediatedCall, context, "validation_failed", toErrorInfo(validation, secrets), options, startedAt);
+    try {
+        await options.beforeExecute?.(mediatedCall, tool, context);
+    }
+    catch (error) {
+        if (error?.code === "ERR_PRISM_AGENT_RUN_SUSPENDED")
+            throw error;
+        return blocked(mediatedCall, context, "execution_denied", errorToErrorInfo(error, secrets), options, startedAt);
+    }
     await options.emit?.({ type: "tool_execution_started", sessionId: context.sessionId, runId: context.runId, call: mediatedCall });
     await appendToolCallRecord(options, "started", mediatedCall, startedAt, {});
     try {
         const raw = await tool.execute(mediatedCall.arguments, context);
         const mediatedResult = await (options.middleware?.run("tool_result", raw) ?? raw);
+        const outputGuards = await runGuardrails({
+            stage: "tool_output",
+            guardrails: options.guardrails,
+            value: mediatedResult,
+            context: {
+                sessionId: context.sessionId,
+                runId: context.runId,
+                toolCallId: mediatedCall.id,
+                toolName: mediatedCall.name,
+                metadata: context.metadata ?? {},
+                signal: context.signal,
+            },
+            redactor: options.redactor,
+            emit: options.emit,
+        });
+        if (outputGuards.terminal) {
+            if (outputGuards.terminal.action !== "block")
+                throw new GuardrailError(outputGuards.terminal);
+            return blocked(mediatedCall, context, "guardrail_blocked", { message: "Tool result blocked by guardrail" }, options, startedAt);
+        }
         const result = options.redactor?.redact(mediatedResult) ?? mediatedResult;
         const finishedAt = new Date().toISOString();
         const metadata = toolExecutionMetadata(startedAt, "finished");
@@ -110,6 +158,8 @@ export async function dispatchToolCall(options) {
         return result;
     }
     catch (error) {
+        if (error instanceof GuardrailError)
+            throw error;
         const info = errorToErrorInfo(error, secrets);
         const result = { toolCallId: mediatedCall.id, name: mediatedCall.name, error: info };
         const finishedAt = new Date().toISOString();