@gt-fe/eap-runtime 0.0.10 → 0.0.12

package/dist/tool/harness-primitives.js

@@ -2,15 +2,18 @@
  * 平台默认 Harness 原语：read_file / write_file / execute_command。
  *
  * 不写进 agent.manifest.toolsets。同名业务工具优先（问数 file-io 等）。
- * 读：工作目录 + 技能包 + EAP_LOCAL_SKILLS_DIR + FILE_IO_ROOT。
- * 写：仅工作目录，且不跟随符号链接。
- * 命令：cwd 落在 jail 内；环境变量白名单，不继承 process.env。
+ * 写：`users/<userId>/`（含用户自己的 skills）。
+ * 读：写根 + 已装配 `preinstall/tools`、`preinstall/skills`。
+ * 命令：cwd 仅写根。技能包只读，EAP_SKILL_DIR 为整包绝对根（不限 scripts/）。不把预装拷进用户装配槽。
+ * 开发态可选 overlay：`EAP_LOCAL_SKILLS_DIR` / `EAP_LOCAL_TOOLS_DIR`（只读）。
  */
 import { spawn } from 'node:child_process';
 import { constants as fsConstants, realpathSync } from 'node:fs';
 import { mkdir, open, readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { BUILTIN_TOOL_SOURCE, DEFAULT_BUILTIN_TIMEOUT_MS, MAX_BUILTIN_TIMEOUT_MS, clampBuiltinTimeout, isBuiltinToolExecution, resolveBuiltinToolsConfig, } from '@gt-fe/eap-contracts';
+import { ensureInterpreterShims, formatSpawnError, killProcessTree, resolveShellSpawn, sandboxEnv, spawnOptionsFor, substituteSkillDir, } from './harness-command.js';
+import { expandSkillScriptRefs, isSkillEntryFile } from './skill-script-refs.js';
 function builtinConfig() {
     return resolveBuiltinToolsConfig(process.env);
 }
@@ -29,7 +32,7 @@ function harnessDefinitions() {
             manifest: {
                 id: 'builtin:read_file',
                 name: 'read_file',
-                description: '读取工作目录或技能目录内的文本。要用某个技能时读该技能文件夹下的 SKILL.md。超限会截断并注明。',
+                description: '读取当前用户目录或预装 tools/skills 内的文本。要用某个技能时读该技能文件夹下的 SKILL.md。超限会截断并注明。',
                 ...common,
             },
             inputSchema: {
@@ -48,7 +51,7 @@ function harnessDefinitions() {
             manifest: {
                 id: 'builtin:write_file',
                 name: 'write_file',
-                description: '写入工作目录内的文本文件。技能目录只读，禁止写出 jail。',
+                description: '写入当前用户目录（含用户自己的 skills）。预装 tools / skills 只读。',
                 ...common,
             },
             inputSchema: {
@@ -66,7 +69,7 @@ function harnessDefinitions() {
             manifest: {
                 id: 'builtin:execute_command',
                 name: 'execute_command',
-                description: `在 jail 内执行命令（跑技能包 scripts、pip 等）。默认超时 ${DEFAULT_BUILTIN_TIMEOUT_MS}ms，可用 timeoutMs 延长，上限 ${MAX_BUILTIN_TIMEOUT_MS}ms。不继承密钥环境变量。`,
+                description: `用本机 shell 在用户目录执行命令（Windows cmd.exe，其它 /bin/sh）。技能包只读，用 EAP_SKILL_DIR 加包内相对路径跑文件（不限 scripts/）。python/python3、node/nodejs、sh/bash 经 shim。默认超时 ${DEFAULT_BUILTIN_TIMEOUT_MS}ms，可用 timeoutMs 延长，上限 ${MAX_BUILTIN_TIMEOUT_MS}ms。不继承密钥。`,
                 ...common,
             },
             inputSchema: {
@@ -74,7 +77,7 @@ function harnessDefinitions() {
                 required: ['command'],
                 properties: {
                     command: { type: 'string' },
-                    cwd: { type: 'string', description: '相对工作目录的子目录，可选' },
+                    cwd: { type: 'string', description: '用户目录内的子目录，可选；省略则用户目录。不能是预装技能/工具包' },
                     timeoutMs: {
                         type: 'integer',
                         description: `超时毫秒。省略则 ${DEFAULT_BUILTIN_TIMEOUT_MS}。上限 ${MAX_BUILTIN_TIMEOUT_MS}。`,
@@ -99,9 +102,63 @@ export function mergeHarnessPrimitives(loadedTools) {
 export function assembleLoadedTools(loadedTools) {
     return mergeHarnessPrimitives(loadedTools);
 }
-function defaultExtraRoots() {
-    const extra = [path.resolve(process.cwd(), 'skills')];
-    for (const key of ['EAP_LOCAL_SKILLS_DIR', 'FILE_IO_ROOT']) {
+const MISSING_USER_DIR = '缺少用户目录，拒绝该操作';
+const PROTECTED_WRITE_NAMES = new Set(['.assembly.json', 'assembly.json', '.ready']);
+/** `{agentDir}/users/<userId>`（写根；含用户 skills） */
+export function resolveUserDir(agentDir, userId) {
+    const dir = agentDir.trim();
+    const uid = userId.trim();
+    if (!dir || !uid) {
+        throw new Error(MISSING_USER_DIR);
+    }
+    if (uid === '.' || uid === '..' || /[\\/]/.test(uid)) {
+        throw new Error('非法用户标识');
+    }
+    return path.resolve(dir, 'users', uid);
+}
+export function collectToolBundlePaths(loadedTools) {
+    const roots = [];
+    for (const def of Object.values(loadedTools ?? {})) {
+        const execution = def.manifest.execution;
+        if (!execution || typeof execution !== 'object' || Array.isArray(execution))
+            continue;
+        const bundlePath = execution.bundlePath;
+        if (typeof bundlePath !== 'string' || !bundlePath.trim())
+            continue;
+        if (!roots.includes(bundlePath))
+            roots.push(bundlePath);
+    }
+    return roots;
+}
+export function resolveJailFromState(state) {
+    const execUser = state.executionContext?.userId;
+    const userId = (typeof execUser === 'string' && execUser.trim()) ||
+        (typeof state.userId === 'string' && state.userId.trim()) ||
+        '';
+    const agentDir = typeof state.agentDir === 'string' ? state.agentDir.trim() : '';
+    const extraRoots = [];
+    for (const skill of Object.values(state.skillDefinitions ?? {})) {
+        if (skill.bundlePath)
+            extraRoots.push(skill.bundlePath);
+    }
+    extraRoots.push(...collectToolBundlePaths(state.loadedTools));
+    const scoped = agentDir
+        ? extraRoots.filter((root) => isPreinstallExtraRoot(agentDir, root))
+        : [];
+    return {
+        workdir: agentDir && userId ? resolveUserDir(agentDir, userId) : undefined,
+        extraRoots: scoped,
+    };
+}
+function deploymentAllowsLocalOverlay() {
+    const ctx = process.env.EAP_DEPLOYMENT_CONTEXT?.trim();
+    return ctx === 'dev' || ctx === 'desktop';
+}
+function devOverlayRoots() {
+    if (!deploymentAllowsLocalOverlay())
+        return [];
+    const extra = [];
+    for (const key of ['EAP_LOCAL_SKILLS_DIR', 'EAP_LOCAL_TOOLS_DIR']) {
         const value = process.env[key]?.trim();
         if (value)
             extra.push(value);
@@ -117,8 +174,12 @@ function tryRealpath(p) {
     }
 }
 export function resolveJailRoots(options) {
-    const workdir = path.resolve(options?.workdir ?? process.cwd());
-    const candidates = [workdir, ...defaultExtraRoots(), ...(options?.extraRoots ?? [])];
+    const workdir = options?.workdir?.trim() ? path.resolve(options.workdir) : undefined;
+    const candidates = [
+        ...(workdir ? [workdir] : []),
+        ...devOverlayRoots(),
+        ...(options?.extraRoots ?? []),
+    ];
     const roots = [];
     for (const raw of candidates) {
         const resolved = path.resolve(raw);
@@ -128,27 +189,6 @@ export function resolveJailRoots(options) {
     }
     return roots;
 }
-function sandboxEnv(workdir, cwd, allowlist) {
-    const env = {
-        PATH: process.env.PATH ?? '/usr/bin:/bin:/usr/local/bin',
-        LANG: process.env.LANG ?? 'C.UTF-8',
-        LC_ALL: process.env.LC_ALL ?? process.env.LANG ?? 'C.UTF-8',
-        HOME: workdir,
-        TMPDIR: workdir,
-        TMP: workdir,
-        TEMP: workdir,
-        PWD: cwd,
-    };
-    const pinned = new Set(['HOME', 'TMPDIR', 'TMP', 'TEMP', 'PWD']);
-    for (const key of allowlist) {
-        if (pinned.has(key))
-            continue;
-        const value = process.env[key];
-        if (value !== undefined)
-            env[key] = value;
-    }
-    return env;
-}
 async function writeFileNoFollow(target, content) {
     const flags = fsConstants.O_WRONLY |
         fsConstants.O_CREAT |
@@ -176,6 +216,28 @@ function isInsideRoot(candidate, root) {
     const rel = path.relative(root, candidate);
     return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
 }
+function realOrResolve(p) {
+    return tryRealpath(p) ?? path.resolve(p);
+}
+/** 路径落在写根外的 extraRoot 时，返回该 extraRoot。 */
+export function extraRootContaining(abs, extraRoots, workdir) {
+    const target = realOrResolve(abs);
+    const work = realOrResolve(workdir);
+    if (isInsideRoot(target, work))
+        return undefined;
+    for (const raw of extraRoots) {
+        const root = realOrResolve(raw);
+        if (isInsideRoot(target, root))
+            return root;
+    }
+    return undefined;
+}
+function isPreinstallExtraRoot(agentDir, root) {
+    const resolved = path.resolve(root);
+    const tools = path.resolve(agentDir, 'preinstall', 'tools');
+    const skills = path.resolve(agentDir, 'preinstall', 'skills');
+    return isInsideRoot(resolved, tools) || isInsideRoot(resolved, skills);
+}
 function resolveViaExistingAncestor(abs) {
     const suffix = [];
     let cur = abs;
@@ -195,8 +257,15 @@ export function resolveJailedPath(requested, roots, opts) {
     if (!trimmed || trimmed.includes('\0')) {
         throw new Error('非法路径');
     }
-    const workdir = roots[0] ?? path.resolve(process.cwd());
-    const abs = path.isAbsolute(trimmed) ? path.normalize(trimmed) : path.resolve(workdir, trimmed);
+    const relativeBase = opts?.relativeBase?.trim()
+        ? path.resolve(opts.relativeBase)
+        : undefined;
+    if (!path.isAbsolute(trimmed) && !relativeBase) {
+        throw new Error(MISSING_USER_DIR);
+    }
+    const abs = path.isAbsolute(trimmed)
+        ? path.normalize(trimmed)
+        : path.resolve(relativeBase, trimmed);
     const existing = tryRealpath(abs);
     if (opts?.mustExist && !existing) {
         throw new Error(`文件不存在：${trimmed}`);
@@ -233,12 +302,28 @@ export class HarnessPrimitiveExecutor {
         this.workdir = options?.workdir;
         this.extraRoots = options?.extraRoots;
     }
+    workdirFor(request) {
+        const fromRequest = request.jailWorkdir?.trim();
+        if (fromRequest)
+            return path.resolve(fromRequest);
+        return this.workdir?.trim() ? path.resolve(this.workdir) : undefined;
+    }
     rootsFor(request) {
         return resolveJailRoots({
-            workdir: this.workdir,
-            extraRoots: [...(this.extraRoots ?? []), ...(request.jailExtraRoots ?? [])],
+            workdir: this.workdirFor(request),
+            extraRoots: this.extraRootsFor(request),
         });
     }
+    extraRootsFor(request) {
+        return [...(this.extraRoots ?? []), ...(request.jailExtraRoots ?? [])];
+    }
+    requireWorkdir(request) {
+        const workdir = this.workdirFor(request);
+        if (!workdir) {
+            throw new Error(MISSING_USER_DIR);
+        }
+        return tryRealpath(workdir) ?? workdir;
+    }
     async execute(request) {
         try {
             switch (request.toolName) {
@@ -258,7 +343,12 @@ export class HarnessPrimitiveExecutor {
     }
     async readFile(request) {
         const filePath = String(request.arguments.path ?? request.arguments.file ?? '');
-        const target = resolveJailedPath(filePath, this.rootsFor(request), { mustExist: true });
+        const workdir = this.workdirFor(request);
+        const relativeBase = workdir ? (tryRealpath(workdir) ?? path.resolve(workdir)) : undefined;
+        const target = resolveJailedPath(filePath, this.rootsFor(request), {
+            mustExist: true,
+            relativeBase,
+        });
         const buf = await readFile(target);
         const config = builtinConfig();
         const lines = buf.toString('utf8').split('\n');
@@ -286,42 +376,59 @@ export class HarnessPrimitiveExecutor {
         if (notes.length > 0) {
             text = `${text}\n[${notes.join('; ')}]`;
         }
+        if (isSkillEntryFile(target)) {
+            text = expandSkillScriptRefs(text, path.dirname(target));
+        }
         return ok(request, text);
     }
     async writeFile(request) {
         const filePath = String(request.arguments.path ?? '');
         const content = String(request.arguments.content ?? '');
-        const workdir = this.rootsFor(request)[0];
+        const workdir = this.requireWorkdir(request);
         const writeRoots = [workdir];
-        const target = resolveJailedPath(filePath, writeRoots);
+        const jailed = { relativeBase: workdir };
+        const target = resolveJailedPath(filePath, writeRoots, jailed);
+        if (PROTECTED_WRITE_NAMES.has(path.basename(target))) {
+            throw new Error(`禁止写入平台文件：${path.basename(target)}`);
+        }
         await mkdir(path.dirname(target), { recursive: true });
-        const recast = resolveJailedPath(filePath, writeRoots);
+        const recast = resolveJailedPath(filePath, writeRoots, jailed);
+        if (PROTECTED_WRITE_NAMES.has(path.basename(recast))) {
+            throw new Error(`禁止写入平台文件：${path.basename(recast)}`);
+        }
         await writeFileNoFollow(recast, content);
         return ok(request, JSON.stringify({ ok: true, path: path.relative(workdir, recast) }));
     }
     async executeCommand(request) {
-        const command = String(request.arguments.command ?? '').trim();
+        const command = substituteSkillDir(String(request.arguments.command ?? '').trim(), request.skillDir);
         if (!command)
             return fail(request, 'command 不能为空');
-        const roots = this.rootsFor(request);
-        const workdir = roots[0];
+        const workdir = this.requireWorkdir(request);
+        await mkdir(workdir, { recursive: true });
         const cwdArg = request.arguments.cwd != null ? String(request.arguments.cwd) : workdir;
-        const cwd = resolveJailedPath(cwdArg, roots, { mustExist: true });
+        const cwd = resolveJailedPath(cwdArg, [workdir], {
+            mustExist: true,
+            relativeBase: workdir,
+        });
         const config = builtinConfig();
         const timeoutMs = clampBuiltinTimeout(request.arguments.timeoutMs, config);
         const maxOutput = config.maxOutputBytes;
+        const shell = resolveShellSpawn(command);
+        const shimDir = ensureInterpreterShims(workdir);
+        const env = sandboxEnv(workdir, cwd, config.envAllowlist, shimDir, request.skillDir);
         const output = await new Promise((resolve, reject) => {
-            const child = spawn('/bin/sh', ['-c', command], {
+            const child = spawn(shell.file, shell.args, {
                 cwd,
-                env: sandboxEnv(workdir, cwd, config.envAllowlist),
+                env,
                 stdio: ['ignore', 'pipe', 'pipe'],
+                ...spawnOptionsFor(shell),
             });
             let stdout = Buffer.alloc(0);
             let stderr = Buffer.alloc(0);
             let stdoutTruncated = false;
             let stderrTruncated = false;
             const timer = setTimeout(() => {
-                child.kill('SIGKILL');
+                killProcessTree(child);
                 reject(new Error(`命令超时（${timeoutMs}ms）`));
             }, timeoutMs);
             child.stdout?.on('data', (chunk) => {
@@ -344,7 +451,7 @@ export class HarnessPrimitiveExecutor {
             });
             child.on('error', (err) => {
                 clearTimeout(timer);
-                reject(err);
+                reject(formatSpawnError(err, shell.file));
             });
             child.on('close', (code) => {
                 clearTimeout(timer);

package/dist/tool/http-tool-executor.js

@@ -4,40 +4,45 @@
  * @see docs/contracts/tool-execution.md §2
  * @see docs/contracts/cross-service-api.md §4.6
  */
+import { ErrorCodes } from '@gt-fe/eap-contracts';
+import { abortOrTimeoutMessage, isAbortError } from './timeout.js';
 function mapGatewayHttpError(status, body, statusText) {
     const code = body?.error?.code;
-    const message = body?.error?.message ?? body?.message ?? statusText;
+    const bodyMessage = [body?.error?.message, body?.message].find((s) => typeof s === 'string' && s.trim()) ?? '';
+    const message = bodyMessage ||
+        (typeof statusText === 'string' && statusText.trim()) ||
+        '';
     if (status === 403) {
         return {
-            error: message,
+            error: bodyMessage || '用户无该 Tool 执行权限',
             errorCode: code ?? 'NO_PERMISSION',
             retryable: false,
         };
     }
     if (status === 429) {
         return {
-            error: message,
+            error: message || `HTTP ${status}`,
             errorCode: code ?? 'RATE_LIMITED',
             retryable: body?.error?.retryable ?? true,
         };
     }
     if (status === 503) {
         return {
-            error: message,
+            error: message || `HTTP ${status}`,
             errorCode: code ?? 'CIRCUIT_OPEN',
             retryable: body?.error?.retryable ?? true,
         };
     }
     if (status === 404) {
         return {
-            error: message,
+            error: message || `HTTP ${status}`,
             errorCode: code ?? 'TOOL_NOT_FOUND',
             retryable: false,
         };
     }
     if (status === 400) {
         return {
-            error: message,
+            error: message || `HTTP ${status}`,
             errorCode: code ?? 'INVALID_ARGUMENTS',
             retryable: false,
         };
@@ -132,25 +137,15 @@ export class HttpToolExecutor {
         }
         catch (error) {
             clearTimeout(timeoutId);
-            if (error instanceof Error && error.name === 'AbortError') {
-                return {
-                    toolCallId: request.toolCallId,
-                    toolName: request.toolName,
-                    content: '',
-                    success: false,
-                    error: `Request timeout after ${this.timeout}ms`,
-                    errorCode: 'EXECUTION_FAILED',
-                    runtime: 'server',
-                };
-            }
-            const message = error instanceof Error ? error.message : 'Unknown network error';
+            const timeoutSec = Math.max(1, Math.round(this.timeout / 1000));
+            const aborted = isAbortError(error);
             return {
                 toolCallId: request.toolCallId,
                 toolName: request.toolName,
                 content: '',
                 success: false,
-                error: message,
-                errorCode: 'EXECUTION_FAILED',
+                error: abortOrTimeoutMessage(error, timeoutSec),
+                errorCode: aborted ? ErrorCodes.TOOL_TIMEOUT : 'EXECUTION_FAILED',
                 runtime: 'server',
             };
         }

package/dist/tool/index.d.ts

@@ -7,12 +7,13 @@ export { LocalToolExecutor, isLocalPreferredExecution, resolveCodeExecutionFromR
 export { DevMcpExecutor, type DevMcpExecutorOptions, } from './dev-mcp-executor.js';
 export { DevHttpExecutor, buildHttpToolUrl, resolveHttpExecutionFromRequest, type DevHttpExecution, } from './dev-http-executor.js';
 export { DevToolExecutor, type DevToolExecutorOptions } from './dev-tool-executor.js';
-export { MockToolExecutor, type MockToolExecutorOptions, } from './mock-tool-executor.js';
 export { LocalMcpClient, type ILocalMcpClient, type LocalMcpInvokeContext, type LocalMcpInvokeResult, } from './local-mcp-client.js';
 export { fileArtifactFromToolOutput, extractFileReference, resolveFileArtifact, type FileArtifact, } from './file-artifact.js';
 export { ToolExecutionRouter, type DeploymentContext, type ToolExecutionRouterOptions, } from './tool-execution-router.js';
 export { createToolExecutor, EmptyInstallStore, type CreateToolExecutorOptions, } from './create-tool-executor.js';
-export { assembleLoadedTools, mergeHarnessPrimitives as mergeBuiltinTools, withHarnessPrimitives as withBuiltinTools, HarnessPrimitiveExecutor as BuiltinToolExecutor, type HarnessJailOptions as BuiltinJailOptions, } from './harness-primitives.js';
+export { assembleLoadedTools, mergeHarnessPrimitives as mergeBuiltinTools, withHarnessPrimitives as withBuiltinTools, HarnessPrimitiveExecutor as BuiltinToolExecutor, resolveUserDir, resolveJailFromState, collectToolBundlePaths, type HarnessJailOptions as BuiltinJailOptions, } from './harness-primitives.js';
+export { resolveShellSpawn, shellNameFor, commandDialectLines, findPythonInterpreter, findNodeInterpreter, ensureInterpreterShims, substituteSkillDir, } from './harness-command.js';
+export { expandSkillScriptRefs, isSkillEntryFile, EAP_SKILL_DIR_ENV, } from './skill-script-refs.js';
 export { ToolResultInjector, type ToolMessage, } from './tool-result-injector.js';
 export { ToolEventEmitter } from './tool-event-emitter.js';
 export { ToolConfirmationInterceptor } from './tool-confirmation.js';

package/dist/tool/index.js

@@ -6,12 +6,13 @@ export { LocalToolExecutor, isLocalPreferredExecution, resolveCodeExecutionFromR
 export { DevMcpExecutor, } from './dev-mcp-executor.js';
 export { DevHttpExecutor, buildHttpToolUrl, resolveHttpExecutionFromRequest, } from './dev-http-executor.js';
 export { DevToolExecutor } from './dev-tool-executor.js';
-export { MockToolExecutor, } from './mock-tool-executor.js';
 export { LocalMcpClient, } from './local-mcp-client.js';
 export { fileArtifactFromToolOutput, extractFileReference, resolveFileArtifact, } from './file-artifact.js';
 export { ToolExecutionRouter, } from './tool-execution-router.js';
 export { createToolExecutor, EmptyInstallStore, } from './create-tool-executor.js';
-export { assembleLoadedTools, mergeHarnessPrimitives as mergeBuiltinTools, withHarnessPrimitives as withBuiltinTools, HarnessPrimitiveExecutor as BuiltinToolExecutor, } from './harness-primitives.js';
+export { assembleLoadedTools, mergeHarnessPrimitives as mergeBuiltinTools, withHarnessPrimitives as withBuiltinTools, HarnessPrimitiveExecutor as BuiltinToolExecutor, resolveUserDir, resolveJailFromState, collectToolBundlePaths, } from './harness-primitives.js';
+export { resolveShellSpawn, shellNameFor, commandDialectLines, findPythonInterpreter, findNodeInterpreter, ensureInterpreterShims, substituteSkillDir, } from './harness-command.js';
+export { expandSkillScriptRefs, isSkillEntryFile, EAP_SKILL_DIR_ENV, } from './skill-script-refs.js';
 export { ToolResultInjector, } from './tool-result-injector.js';
 export { ToolEventEmitter } from './tool-event-emitter.js';
 export { ToolConfirmationInterceptor } from './tool-confirmation.js';

package/dist/tool/local-mcp-client.js

@@ -6,6 +6,7 @@
  */
 import { spawn } from 'node:child_process';
 import readline from 'node:readline';
+import { isAbortError, resolveToolTimeoutSec, toToolTimeoutMs, toolTimeoutErrorMessage, } from './timeout.js';
 import { fileArtifactFromToolOutput, fileBasesFromEnv } from './file-artifact.js';
 export function formatMcpOutput(result) {
     const r = result;
@@ -70,10 +71,13 @@ function withUserMeta(params, userId) {
 function rpcStdio(session, method, params) {
     const id = session.nextId++;
     const timeoutMs = session.timeoutMs;
+    const timeoutSec = Math.max(1, Math.round(timeoutMs / 1000));
     return new Promise((resolve, reject) => {
         const timer = setTimeout(() => {
             session.pending.delete(id);
-            reject(new Error(`MCP RPC timeout: ${method}`));
+            const err = new Error(toolTimeoutErrorMessage(timeoutSec));
+            err.name = 'TimeoutError';
+            reject(err);
         }, timeoutMs);
         session.pending.set(id, {
             resolve: (v) => { clearTimeout(timer); resolve(v); },
@@ -86,7 +90,7 @@ async function invokeStdio(execution, args, context) {
     const { server } = execution;
     const command = server.command ?? 'node';
     const spawnArgs = server.args ?? [];
-    const timeoutMs = execution.timeout ?? 30_000;
+    const timeoutMs = toToolTimeoutMs(execution.timeout);
     const userId = resolveUserId(execution, context);
     const child = spawn(command, spawnArgs, {
         stdio: ['pipe', 'pipe', 'pipe'],
@@ -138,12 +142,32 @@ async function invokeStdio(execution, args, context) {
         rl.close();
     }
 }
+async function postMcp(url, headers, payload, signal) {
+    const response = await fetch(url, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(payload),
+        signal,
+    });
+    const sessionId = response.headers.get('mcp-session-id') ?? undefined;
+    const raw = await response.text();
+    if (!response.ok) {
+        const snippet = raw.replace(/\s+/g, ' ').trim().slice(0, 240);
+        throw new Error(`MCP HTTP ${response.status}: ${response.statusText}${snippet ? ` ${snippet}` : ''}`);
+    }
+    const body = parseMcpHttpBody(raw);
+    if (body.error) {
+        throw new Error(body.error.message ?? 'MCP HTTP error');
+    }
+    return { body, sessionId };
+}
 async function invokeStreamableHttp(execution, args, context) {
     const url = expandEnvRefs(execution.server.url);
     if (!url) {
         throw new Error('streamable_http MCP requires server.url');
     }
-    const timeoutMs = execution.timeout ?? 30_000;
+    const timeoutSec = resolveToolTimeoutSec(execution.timeout);
+    const timeoutMs = toToolTimeoutMs(timeoutSec);
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     const userId = resolveUserId(execution, context);
@@ -161,28 +185,35 @@ async function invokeStreamableHttp(execution, args, context) {
     if (userId) {
         headers.userId = userId;
     }
-    const body = {
-        jsonrpc: '2.0',
-        id: 1,
-        method: 'tools/call',
-        params: withUserMeta({ name: execution.toolName, arguments: args }, userId),
-    };
     try {
-        const response = await fetch(url, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify(body),
-            signal: controller.signal,
-        });
-        if (!response.ok) {
-            throw new Error(`MCP HTTP ${response.status}: ${response.statusText}`);
-        }
-        const raw = await response.text();
-        const payload = parseMcpHttpBody(raw);
-        if (payload.error) {
-            throw new Error(payload.error.message ?? 'MCP HTTP error');
+        const init = await postMcp(url, headers, {
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'initialize',
+            params: {
+                protocolVersion: '2024-11-05',
+                capabilities: {},
+                clientInfo: { name: 'eap-runtime-local', version: '0.1.0' },
+            },
+        }, controller.signal);
+        const callHeaders = { ...headers };
+        if (init.sessionId)
+            callHeaders['mcp-session-id'] = init.sessionId;
+        const call = await postMcp(url, callHeaders, {
+            jsonrpc: '2.0',
+            id: 2,
+            method: 'tools/call',
+            params: withUserMeta({ name: execution.toolName, arguments: args }, userId),
+        }, controller.signal);
+        return toInvokeResult(call.body.result, execution.server.env);
+    }
+    catch (err) {
+        if (isAbortError(err)) {
+            const timeoutErr = new Error(toolTimeoutErrorMessage(timeoutSec));
+            timeoutErr.name = 'TimeoutError';
+            throw timeoutErr;
         }
-        return toInvokeResult(payload.result, execution.server.env);
+        throw err instanceof Error ? err : new Error(String(err));
     }
     finally {
         clearTimeout(timer);

package/dist/tool/local-tool-executor.js

@@ -7,7 +7,8 @@
 import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
-import { resolveReadyInstallByToolName, resolveMcpExecutionFromInstall, resolveCodeHandlerFromInstall, } from '@gt-fe/eap-contracts';
+import { ErrorCodes, resolveReadyInstallByToolName, resolveMcpExecutionFromInstall, resolveCodeHandlerFromInstall, } from '@gt-fe/eap-contracts';
+import { isAbortError, toToolTimeoutMs, toolTimeoutErrorMessage } from './timeout.js';
 import { fileArtifactFromToolOutput, fileBasesFromEnv } from './file-artifact.js';
 import { LocalMcpClient } from './local-mcp-client.js';
 /**
@@ -66,7 +67,9 @@ function runHandler(handlerPath, input, timeoutMs, execution) {
         };
         const timer = setTimeout(() => {
             child.kill('SIGKILL');
-            finish(() => reject(new Error(`Local tool timeout after ${timeoutMs}ms`)));
+            const timeoutErr = new Error(toolTimeoutErrorMessage(Math.max(1, Math.round(timeoutMs / 1000))));
+            timeoutErr.name = 'TimeoutError';
+            finish(() => reject(timeoutErr));
         }, timeoutMs);
         child.stdout.on('data', (d) => { stdout += d.toString(); });
         child.stderr.on('data', (d) => { stderr += d.toString(); });
@@ -112,7 +115,7 @@ export function resolveCodeExecutionFromRequest(request) {
     const handler = typeof e.handler === 'string' ? e.handler : '';
     const command = typeof e.command === 'string' ? e.command : undefined;
     const args = Array.isArray(e.args) ? e.args.map(String) : undefined;
-    const timeoutMs = typeof e.timeout === 'number' && e.timeout > 0 ? e.timeout : undefined;
+    const timeoutMs = typeof e.timeout === 'number' && e.timeout > 0 ? toToolTimeoutMs(e.timeout) : undefined;
     if (runtime === 'executable') {
         const handlerPath = handler
             ? (path.isAbsolute(handler) || !bundlePath
@@ -181,14 +184,14 @@ export class LocalToolExecutor {
             };
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
+            const aborted = isAbortError(error);
             return {
                 toolCallId: request.toolCallId,
                 toolName: request.toolName,
                 content: '',
                 success: false,
-                error: message,
-                errorCode: 'EXECUTION_FAILED',
+                error: error instanceof Error ? error.message : String(error),
+                errorCode: aborted ? ErrorCodes.TOOL_TIMEOUT : 'EXECUTION_FAILED',
                 runtime: 'local',
             };
         }
@@ -203,6 +206,7 @@ export class LocalToolExecutor {
             handlerPath,
             runtime: execution?.runtime,
             args: execution?.args,
+            timeoutMs: typeof execution?.timeout === 'number' ? toToolTimeoutMs(execution.timeout) : undefined,
         });
     }
     async executeMcp(request, install) {
@@ -232,14 +236,14 @@ export class LocalToolExecutor {
             };
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
+            const aborted = isAbortError(error);
             return {
                 toolCallId: request.toolCallId,
                 toolName: request.toolName,
                 content: '',
                 success: false,
-                error: message,
-                errorCode: 'EXECUTION_FAILED',
+                error: error instanceof Error ? error.message : String(error),
+                errorCode: aborted ? ErrorCodes.TOOL_TIMEOUT : 'EXECUTION_FAILED',
                 runtime: 'local',
             };
         }