@gt-fe/eap-runtime 0.0.34 → 0.0.35

package/dist/api/handlers/stream.handler.js

@@ -21,6 +21,7 @@
  */
 import { buildHitlWaitingTaskOutput, buildTurnTranscriptFromStreamEvents, loadModelFacingHistory, turnGraphMessagesAfterCompression, applyStreamReasoningEvent, applyStreamTextDelta, createStreamAssistantBuckets, createStreamReasoningState, resolvedStreamReasoning, visibleStreamAssistantText, streamAssistantTexts, messageRecordsToGraphMessages, persistHitlWaitingPlaceholder, persistTurnTranscript, persistUserTurnMessage, appendTerminalToolResult, } from '../../session/persist-turn-messages.js';
 import { collectPublicArtifactLinks, collectPublicArtifactLinksFromEvent, injectPublicArtifactLinks, mergeArtifactLinks, } from '../../tool/inject-public-artifact-links.js';
+import { correctEmployeeVisibleReply, employeeStreamClose, takeEmployeeVisibleEvents, } from '../../tool/mcp-tool-exposure.js';
 import { SessionBudgetExhaustedError } from '../../token/session-budget-checker.js';
 import { TokenBudgetExhaustedError } from '../../token/token-budget-guard.js';
 import { recordTaskTokenUsages } from '../../token/record-task-token-usage.js';
@@ -332,8 +333,10 @@ export class StreamOrchestrator {
                 collectPublicArtifactLinksFromEvent(runtimeEvent.type, runtimeEvent.payload, artifactLinks);
                 applyStreamReasoningEvent(reasoningState, runtimeEvent.type, runtimeEvent.payload);
                 applyStreamTextDelta(assistantBuckets, runtimeEvent.type, runtimeEvent.payload);
-                if (shouldEmitTokenSse(tokenDetail, runtimeEvent.type)) {
-                    emitter.emit(this.runtimeEventToSSE(runtimeEvent, correlationId, taskId));
+                for (const visibleEvent of takeEmployeeVisibleEvents(runtimeEvent.type, runtimeEvent.payload)) {
+                    if (shouldEmitTokenSse(tokenDetail, visibleEvent.type)) {
+                        emitter.emit(this.runtimeEventToSSE({ ...runtimeEvent, type: visibleEvent.type, payload: visibleEvent.payload }, correlationId, taskId));
+                    }
                 }
             }
         }
@@ -398,12 +401,14 @@ export class StreamOrchestrator {
         }
         // ─── Step 7: 发送结束事件序列 ───
         const tokenStats = this.tokenStatsService.getTaskStats(taskId);
-        const visible = visibleStreamAssistantText(assistantBuckets);
+        const rawVisible = visibleStreamAssistantText(assistantBuckets);
+        const visible = correctEmployeeVisibleReply(rawVisible, toolResults);
         const links = mergeArtifactLinks(artifactLinks, collectPublicArtifactLinks(toolResults));
         const { injected, suffix } = injectPublicArtifactLinks(visible, links);
-        if (suffix) {
+        const close = employeeStreamClose({ raw: rawVisible, tools: toolResults, suffix });
+        for (const content of close.chunks) {
             emitter.emit(this.buildSSEEvent('response.chunk', correlationId, taskId, {
-                content: suffix,
+                content,
                 format: 'text',
             }));
         }
@@ -442,7 +447,7 @@ export class StreamOrchestrator {
             messages: buildTurnTranscriptFromStreamEvents({
                 pendingToolCalls,
                 toolResults,
-                assistantTexts: suffix ? undefined : streamAssistantTexts(assistantBuckets),
+                assistantTexts: close.persistCorrected ? undefined : streamAssistantTexts(assistantBuckets),
                 assistantText: injected,
                 finishPoints: graph.finishPoints,
                 toolCallReasoningContent,

package/dist/graph/adapters/langgraph.adapter.js

@@ -23,7 +23,8 @@ import { ToolResultInjector } from '../../tool/tool-result-injector.js';
 import { fileArtifactFromToolOutput } from '../../tool/file-artifact.js';
 import { EchoLLMProvider } from '../../providers/echo-llm-provider.js';
 import { ConditionEvaluator } from '../condition-evaluator.js';
-import { SystemPromptBuilder, buildSkillCatalog, loadedToolsToApiTools, resolveLlmPromptInputs, spokenName } from '../../tool/system-prompt-builder.js';
+import { SystemPromptBuilder, buildSkillCatalog, resolveLlmPromptInputs, spokenName } from '../../tool/system-prompt-builder.js';
+import { correctEmployeeVisibleReply, lastAssistantTextSinceLastUser, exposureScopeId, exposedNamesForScope, forcedToolName, holdEmployeeTextForUnnamedMcp, resolveModelToolSurface, shouldDropUnsettledEmployeeText, toolFactsSinceLastUser, } from '../../tool/mcp-tool-exposure.js';
 import { resolveJailFromState, resolveJailRoots } from '../../tool/harness-primitives.js';
 import os from 'node:os';
 import { bindSelectedSkill } from '../nodes/skill-bind-node.js';
@@ -417,7 +418,7 @@ export class LangGraphAdapter {
                 });
             }
         }
-        if (progress.status === 'started') {
+        if (progress.status === 'started' && (!progress.quiet || progress.modelOnly)) {
             stream.sink({
                 type: 'tool.called',
                 taskId,
@@ -429,19 +430,22 @@ export class LangGraphAdapter {
                     ...(progress.toolset ? { toolset: progress.toolset } : {}),
                     ...(progress.toolVersion ? { toolVersion: progress.toolVersion } : {}),
                     arguments: progress.arguments ?? {},
+                    ...(progress.modelOnly ? { modelOnly: true } : {}),
                     ...loc,
                 },
             });
         }
         // resolvedPath / skillDirs 只给上面 classifySkillFile；inSkillSubgraph 只给 skill.started 去重。不进对话流。
-        const { resolvedPath: _resolvedPath, skillDirs: _skillDirs, inSkillSubgraph: _inSkillSubgraph, ...progressView } = progress;
-        stream.sink({
-            type: 'tool.progress',
-            taskId,
-            correlationId,
-            timestamp,
-            payload: progressView,
-        });
+        const { resolvedPath: _resolvedPath, skillDirs: _skillDirs, inSkillSubgraph: _inSkillSubgraph, modelOnly: _modelOnly, ...progressView } = progress;
+        if (!progress.quiet) {
+            stream.sink({
+                type: 'tool.progress',
+                taskId,
+                correlationId,
+                timestamp,
+                payload: progressView,
+            });
+        }
         if (progress.status === 'completed') {
             stream.sink({
                 type: 'tool.result',
@@ -456,6 +460,7 @@ export class LangGraphAdapter {
                     success: true,
                     ...(progress.file ? { file: progress.file } : {}),
                     ...(progress.files?.length ? { files: progress.files } : {}),
+                    ...(progress.modelOnly ? { modelOnly: true } : {}),
                     ...loc,
                 },
             });
@@ -472,6 +477,7 @@ export class LangGraphAdapter {
                     ...(progress.toolset ? { toolset: progress.toolset } : {}),
                     error: progress.error ?? 'Unknown error',
                     willRetry: progress.willRetry === true,
+                    ...(progress.modelOnly ? { modelOnly: true } : {}),
                     ...(progress.content ? { content: progress.content } : {}),
                     ...(progress.file ? { file: progress.file } : {}),
                     ...(progress.files?.length ? { files: progress.files } : {}),
@@ -545,6 +551,9 @@ export class LangGraphAdapter {
                 checkpointNs: ephemeral(undefined),
                 skillIsolateContext: ephemeral(undefined),
                 loadedTools: ephemeral(undefined),
+                exposedMcpTools: ephemeral(undefined),
+                exposedMcpScopeId: ephemeral(undefined),
+                sentMcpToolNames: ephemeral(undefined),
                 loadedSkills: ephemeral(undefined),
                 skillDefinitions: ephemeral(undefined),
                 skillInput: ephemeral(undefined),
@@ -770,10 +779,8 @@ export class LangGraphAdapter {
         }
         const duration = Date.now() - startTime;
         const messages = Array.isArray(result['messages']) ? result['messages'] : [];
-        const lastMessage = messages[messages.length - 1];
-        const output = typeof lastMessage === 'object' && lastMessage !== null && 'content' in lastMessage
-            ? String(lastMessage.content)
-            : '';
+        const rawOutput = lastAssistantTextSinceLastUser(messages);
+        const output = correctEmployeeVisibleReply(rawOutput, toolFactsSinceLastUser(messages));
         // ── Token 累计：从 __llmTokenUsage 数组累加器读取每轮 LLM 明细 + 汇总
         //    数组由 channel reducer 自动累加（每次 LLM 节点追加一条）。
         const llmUsageArray = Array.isArray(result['__llmTokenUsage'])
@@ -798,6 +805,12 @@ export class LangGraphAdapter {
                     : state.messages,
                 userId: state.userId,
                 loadedTools: state.loadedTools ?? result.loadedTools,
+                exposedMcpTools: Array.isArray(result['exposedMcpTools'])
+                    ? result['exposedMcpTools']
+                    : state.exposedMcpTools,
+                exposedMcpScopeId: typeof result['exposedMcpScopeId'] === 'string'
+                    ? result['exposedMcpScopeId']
+                    : state.exposedMcpScopeId,
                 forceToolServer: state.forceToolServer ?? result.forceToolServer,
                 executionContext: state.executionContext ?? result.executionContext,
             },
@@ -1202,10 +1215,18 @@ export class LangGraphAdapter {
                 agentSystemPrompt: state['agentSystemPrompt'],
                 nodePrompt: resolvedPrompt,
             });
+            const surface = resolveModelToolSurface({
+                loadedTools,
+                disableTools,
+                exposedNames: exposedNamesForScope(state['exposedMcpTools'], state['exposedMcpScopeId'], exposureScopeId({ sessionId: state['sessionId'], taskId: state['taskId'] })),
+                forcedName: forcedToolName(baseConfig.toolChoice),
+            });
+            const sentMcpToolNames = surface.apiTools.map((tool) => tool.function.name);
             const assembled = this.systemPromptBuilder.build({
                 agentPrompt: promptInputs.agentPrompt,
                 nodePrompt: promptInputs.nodePrompt,
                 skillCatalog: catalog,
+                mcpToolIndex: surface.mcpToolIndex,
                 agentName,
                 agentCode,
                 userId,
@@ -1214,7 +1235,10 @@ export class LangGraphAdapter {
                 jailRoots,
                 skillDirs,
             });
-            const apiTools = disableTools ? [] : loadedToolsToApiTools(loadedTools);
+            const apiTools = surface.apiTools;
+            const sentTools = disableTools
+                ? undefined
+                : (apiTools.length > 0 ? apiTools : baseConfig.tools);
             const finalConfig = {
                 ...baseConfig,
                 systemPrompt: assembled.text,
@@ -1226,7 +1250,7 @@ export class LangGraphAdapter {
                     agentCode,
                     correlationId: typeof state['correlationId'] === 'string' ? state['correlationId'] : undefined,
                 },
-                tools: disableTools ? undefined : (apiTools.length > 0 ? apiTools : baseConfig.tools),
+                tools: sentTools,
                 toolChoice: disableTools ? 'none' : baseConfig.toolChoice,
             };
             // 流式旁路：有本次 stream 袋时启用 LLM token 推送；silent 节点不推给用户
@@ -1237,22 +1261,28 @@ export class LangGraphAdapter {
                 stream.streamedTextThisTurn = false;
                 stream.reasoningChunkIndex = 0;
             }
+            const holdEmployeeText = holdEmployeeTextForUnnamedMcp(loadedTools, sentMcpToolNames);
+            const heldDeltas = [];
             const llmNode = new LLMNode(node.id, finalConfig, this.llmProvider, enableStream, enableStream
                 ? (delta) => {
                     const live = getExecutionStream();
                     if (!live)
                         return;
+                    if (holdEmployeeText) {
+                        heldDeltas.push(delta);
+                        return;
+                    }
                     emitLlmStreamDelta(live, node.id, finalConfig.model, delta);
                 }
                 : undefined, this.interceptors);
-            const toolsForSpan = disableTools || !loadedTools
-                ? undefined
-                : Object.values(loadedTools).map((t) => ({
-                    name: t.name,
-                    ...(t.manifest.description?.trim()
-                        ? { description: t.manifest.description.trim() }
+            const toolsForSpan = sentTools && sentTools.length > 0
+                ? sentTools.map((tool) => ({
+                    name: tool.function.name,
+                    ...(tool.function.description?.trim()
+                        ? { description: tool.function.description.trim() }
                         : {}),
-                }));
+                }))
+                : undefined;
             // 组装后再 createNode：input 必须是发给模型的 system/tools/messages；completeNode 不能补 input。
             return withGraphSpan(state, {
                 name: node.id,
@@ -1266,12 +1296,31 @@ export class LangGraphAdapter {
                 },
             }, async () => {
                 const next = await llmNode.execute(state);
-                if (enableStream) {
+                let dropEmployeeText = false;
+                if (enableStream && holdEmployeeText) {
+                    const added = Array.isArray(next.messages) ? next.messages[0] : undefined;
+                    const calls = added && typeof added === 'object' && Array.isArray(added.toolCalls)
+                        ? added.toolCalls
+                        : [];
+                    dropEmployeeText = shouldDropUnsettledEmployeeText(calls, loadedTools, sentMcpToolNames);
+                    const live = getExecutionStream();
+                    if (dropEmployeeText) {
+                        // 挡住 updates 再把这段正文补发成 response.chunk。
+                        if (live)
+                            live.streamedTextThisTurn = true;
+                    }
+                    else if (live) {
+                        for (const delta of heldDeltas)
+                            emitLlmStreamDelta(live, node.id, finalConfig.model, delta);
+                    }
+                }
+                if (enableStream && !dropEmployeeText) {
                     emitReasoningCompletedIfAny(getExecutionStream(), node.id, next);
                 }
                 const hydratedUpdate = loadedTools && loadedTools !== loadedToolsBase ? { loadedTools } : {};
+                const sentUpdate = { sentMcpToolNames };
                 if (!silent)
-                    return { ...next, ...hydratedUpdate };
+                    return { ...next, ...hydratedUpdate, ...sentUpdate };
                 const added = Array.isArray(next.messages) ? next.messages[0] : undefined;
                 const raw = added && typeof added === 'object' && typeof added.content === 'string'
                     ? added.content
@@ -1281,6 +1330,7 @@ export class LangGraphAdapter {
                     messages: [],
                     silentOutput: raw,
                     ...hydratedUpdate,
+                    ...sentUpdate,
                 };
             }, { outputFrom: llmSpanOutputFromResult });
         };

package/dist/graph/adapters/subgraph-compiler.js

@@ -15,6 +15,7 @@ import { resolveExecutionTrace, warnTraceSpanFailure, } from '../execution-trace
 import { skillSpanFields, skillTraceIdentity } from './skill-entry-span.js';
 import { filterLoadedToolsForSkill, spokenName, } from '../../tool/system-prompt-builder.js';
 import { unwrapHitlPaused } from '../hitl/hitl-handler.js';
+import { exposureScopeId, exposedNamesForScope, mergeExposed } from '../../tool/mcp-tool-exposure.js';
 import { pickContextFields } from '../../token/context-window.js';
 import { assertSkillIoIfEnabled, coerceSkillInputFromMessages, } from '../../registry/skill-io-guard.js';
 import { isolatedSkillMessages, isolatedSkillOutput, } from './skill-isolate.js';
@@ -163,6 +164,15 @@ export class SubGraphCompiler {
                     skillIsolateContext: isolateContext || undefined,
                     executionContext: state['executionContext'],
                     loadedTools: scopedTools,
+                    exposedMcpTools: Array.isArray(state['exposedMcpTools'])
+                        ? state['exposedMcpTools']
+                        : undefined,
+                    exposedMcpScopeId: typeof state['exposedMcpScopeId'] === 'string'
+                        ? state['exposedMcpScopeId']
+                        : undefined,
+                    sentMcpToolNames: Array.isArray(state['sentMcpToolNames'])
+                        ? state['sentMcpToolNames']
+                        : undefined,
                     loadedSkills: state['loadedSkills'],
                     skillDefinitions: defs,
                     agentSystemPrompt: typeof state['agentSystemPrompt'] === 'string'
@@ -234,10 +244,25 @@ export class SubGraphCompiler {
                     undefined;
                 const parentNodeId = options?.parentNodeId
                     || (dsl.name ? `subgraph:${dsl.name}` : 'subgraph');
+                const parentScope = exposureScopeId({
+                    sessionId: state['sessionId'],
+                    taskId: state['taskId'],
+                });
+                const childScope = result.finalState?.exposedMcpScopeId;
+                const parentNames = exposedNamesForScope(state['exposedMcpTools'], state['exposedMcpScopeId'], parentScope);
+                const childNames = childScope === parentScope && Array.isArray(result.finalState?.exposedMcpTools)
+                    ? result.finalState.exposedMcpTools
+                    : [];
                 return {
                     messages: outputMessages,
                     currentNode: parentNodeId,
                     historyPath: [parentNodeId],
+                    ...(parentScope
+                        ? {
+                            exposedMcpTools: mergeExposed(parentNames, childNames),
+                            exposedMcpScopeId: parentScope,
+                        }
+                        : {}),
                     ...(nestedLastSpanId ? { lastSpanId: nestedLastSpanId } : {}),
                     ...(Array.isArray(perNode) && perNode.length > 0
                         ? {

package/dist/graph/contracts/executable-graph.d.ts

@@ -197,6 +197,15 @@ export interface GraphState {
     ragSources?: string[];
     /** GraphLoader 注入：toolName → 运行期 manifest 引用 */
     loadedTools?: import('../../tool/loaded-tool-definition.js').LoadedToolMap;
+    /**
+     * 本会话已点名、下一次模型调用要带完整参数的 MCP 工具名。
+     * 与 exposedMcpScopeId 一起用。有 sessionId 时按会话，否则按 taskId。新会话不沿用。
+     */
+    exposedMcpTools?: string[];
+    /** 与 exposedMcpTools 对应的 sessionId，没有 sessionId 时是 taskId。 */
+    exposedMcpScopeId?: string;
+    /** 上一轮实际发给模型的工具名。工具节点用它判断没点名的 MCP 调用。 */
+    sentMcpToolNames?: string[];
     /** GraphLoader 注入：已装配 Skill 列表 */
     loadedSkills?: import('../../tool/system-prompt-builder.js').LoadedSkillInfo[];
     /** GraphLoader 注入：skillId → 完整定义（子图解析 / prompt） */

package/dist/graph/nodes/llm-node.js

@@ -14,6 +14,7 @@ import { buildContextUsage, turnSectionChars } from '../../token/context-window.
 import { isAbortError } from '../../tool/timeout.js';
 import { emitRuntimeLog } from '../../common/logger.js';
 import { decideBeforeModel, } from '../../execution/interceptors.js';
+import { projectHistoryForModelTools } from '../../tool/mcp-tool-exposure.js';
 // ─────────────────────────────────────────────
 // Default retry config
 // ─────────────────────────────────────────────
@@ -84,7 +85,8 @@ export class LLMNode {
         if (gate.action === 'deny') {
             throw new Error(gate.reason);
         }
-        const messagesForModel = gate.messages ?? messagesWithSystem;
+        const toolNames = new Set((this.config.tools ?? []).map((tool) => tool.function.name));
+        const messagesForModel = projectHistoryForModelTools(gate.messages ?? messagesWithSystem, toolNames);
         const startedAt = Date.now();
         // 带重试的 LLM 调用
         const response = await this.invokeWithRetry(messagesForModel);

package/dist/graph/nodes/tool-node.d.ts

@@ -58,6 +58,10 @@ export interface ToolNodeProgress {
     toolVersion?: string;
     /** 本失败后是否还会再试。缺省 false */
     willRetry?: boolean;
+    /** 不发 tool.progress。tool_search 仍发 tool.result，供最终回复判断。 */
+    quiet?: boolean;
+    /** 只给模型。不进员工 SSE。未点名的调用用这个。 */
+    modelOnly?: boolean;
 }
 export declare class ToolNode {
     private readonly orchestrator;

package/dist/graph/nodes/tool-node.js

@@ -17,6 +17,7 @@ import { isHitlDecision, unwrapHitlPaused } from '../hitl/hitl-handler.js';
 import { ToolConfirmationInterceptor } from '../../tool/tool-confirmation.js';
 import { resolveCheckpointThreadId } from '../../session/persist-turn-messages.js';
 import { mcpToolsetCode, toolTraceIdentity } from '../../tool/mcp-list.js';
+import { exposureScopeId, exposedNamesForScope, isUnloadedDeferredCall, mcpNamesToExpose, mergeExposed, partitionToolSearchCalls, runToolSearch, unloadedCallToolContent, } from '../../tool/mcp-tool-exposure.js';
 import { resolveExecutionTrace, warnTraceSpanFailure, } from '../execution-trace-context.js';
 import { emitRuntimeLog } from '../../common/logger.js';
 import { toolResultHasArtifacts } from '../../tool/inject-public-artifact-links.js';
@@ -36,6 +37,28 @@ function skillDirsFromState(state) {
         .filter((skill) => Boolean(skill.bundlePath))
         .map((skill) => ({ skillId: skill.skillId, bundlePath: skill.bundlePath }));
 }
+function exposureUpdate(state, searchCalls, businessNames, loadedTools, alreadyInTools) {
+    const scopeId = exposureScopeId({ sessionId: state['sessionId'], taskId: state['taskId'] });
+    const existing = exposedNamesForScope(state['exposedMcpTools'], state['exposedMcpScopeId'], scopeId);
+    const messagesById = new Map();
+    const searchExpose = [];
+    for (const call of searchCalls) {
+        const outcome = runToolSearch(call.arguments, loadedTools, alreadyInTools);
+        searchExpose.push(...outcome.expose);
+        messagesById.set(call.id, {
+            role: 'tool',
+            content: outcome.content,
+            toolCallId: call.id,
+            toolName: call.name,
+            success: true,
+        });
+    }
+    return {
+        messagesById,
+        exposedMcpTools: mergeExposed(existing, mcpNamesToExpose(loadedTools, searchExpose, businessNames)),
+        exposedMcpScopeId: scopeId,
+    };
+}
 export class ToolNode {
     orchestrator;
     injector;
@@ -83,6 +106,15 @@ export class ToolNode {
             return state;
         }
         const loadedTools = state['loadedTools'];
+        const partitioned = partitionToolSearchCalls(lastAssistantMessage.toolCalls, loadedTools);
+        const sentMcpToolNames = Array.isArray(state['sentMcpToolNames'])
+            ? state['sentMcpToolNames']
+            : undefined;
+        const blockedCalls = partitioned.deferActive
+            ? partitioned.business.filter((call) => isUnloadedDeferredCall(loadedTools?.[call.name], sentMcpToolNames))
+            : [];
+        const blockedIds = new Set(blockedCalls.map((call) => call.id));
+        const executableCalls = partitioned.business.filter((call) => !blockedIds.has(call.id));
         const skillDirs = skillDirsFromState(state);
         const jail = resolveJailFromState({
             agentDir: state['agentDir'],
@@ -92,13 +124,13 @@ export class ToolNode {
             skillDefinitions: state['skillDefinitions'],
         });
         const jailExtraRoots = jail.extraRoots ?? [];
-        const batchCalls = lastAssistantMessage.toolCalls.map((tc) => ({
+        const batchCalls = executableCalls.map((tc) => ({
             name: tc.name,
             arguments: tc.arguments,
         }));
         const boundSkill = typeof state['activatedSkill'] === 'string' ? state['activatedSkill'] : undefined;
         // 4. 转换为 ToolCallRequest[]（附带 manifest 路由字段）
-        const requests = lastAssistantMessage.toolCalls.map((tc) => {
+        const requests = executableCalls.map((tc) => {
             const loaded = loadedTools?.[tc.name];
             const toolsetCode = mcpToolsetCode(loaded);
             const correlationId = String(state['correlationId'] ?? tc.id);
@@ -170,6 +202,84 @@ export class ToolNode {
             ? state['hitlToolCallId']
             : undefined;
         const confirmationCount = requests.filter((req) => confirmationTools.has(req.toolName)).length;
+        // 点名先记进本轮返回值。HITL 抛出时这次返回作废，恢复后本节点会再跑一遍并带上这些名字。
+        const exposure = partitioned.deferActive
+            ? exposureUpdate(state, partitioned.search, partitioned.business.map((call) => call.name), loadedTools, sentMcpToolNames)
+            : undefined;
+        const blockedMessages = new Map();
+        const sideSpanIds = [];
+        const recordSideSpan = async (name, callId, input, output, notExecuted) => {
+            if (!traceCollector || !traceId)
+                return;
+            try {
+                const parentNodeId = typeof state['skillSpanId'] === 'string' && state['skillSpanId']
+                    ? state['skillSpanId']
+                    : undefined;
+                const spanId = await traceCollector.createNode({
+                    traceId,
+                    name,
+                    type: 'tool',
+                    parentNodeId,
+                    agentCode: agentCode || undefined,
+                    input,
+                    metadata: {
+                        toolCallId: callId,
+                        ...(notExecuted ? { notExecuted: true } : {}),
+                    },
+                });
+                sideSpanIds.push(spanId);
+                await traceCollector.completeNode(spanId, {
+                    status: notExecuted ? 'failed' : 'completed',
+                    output,
+                    ...(notExecuted ? { error: output } : {}),
+                });
+            }
+            catch (err) {
+                warnTraceSpanFailure('createNode', { type: 'tool', name, traceId, toolCallId: callId }, err);
+            }
+        };
+        for (const call of partitioned.search) {
+            const content = exposure?.messagesById.get(call.id)?.content ?? '';
+            emitProgress({
+                toolCallId: call.id,
+                toolName: call.name,
+                status: 'completed',
+                arguments: call.arguments,
+                content,
+                quiet: true,
+                modelOnly: true,
+            });
+            await recordSideSpan(call.name, call.id, call.arguments, content, false);
+        }
+        for (const call of blockedCalls) {
+            const content = unloadedCallToolContent(call.name);
+            blockedMessages.set(call.id, {
+                role: 'tool',
+                content,
+                toolCallId: call.id,
+                toolName: call.name,
+                success: false,
+            });
+            emitProgress({
+                toolCallId: call.id,
+                toolName: call.name,
+                status: 'started',
+                arguments: call.arguments,
+                quiet: true,
+                modelOnly: true,
+            });
+            emitProgress({
+                toolCallId: call.id,
+                toolName: call.name,
+                status: 'error',
+                arguments: call.arguments,
+                error: content,
+                content,
+                quiet: true,
+                modelOnly: true,
+            });
+            await recordSideSpan(call.name, call.id, call.arguments, content, true);
+        }
         // 5. 并行执行所有 Tool 调用（附 Trace span）
         const spanIds = await Promise.all(requests.map(async (req) => {
             const reusePausedSpan = Boolean(resumeToolSpanId) &&
@@ -443,11 +553,29 @@ export class ToolNode {
             ...('file' in result && result.file ? { file: result.file } : {}),
             ...('files' in result && result.files?.length ? { files: result.files } : {}),
         }));
-        const lastSpanId = [...spanIds].reverse().find((id) => Boolean(id));
+        const lastSpanId = [...spanIds, ...sideSpanIds].reverse().find((id) => Boolean(id));
+        const orderedMessages = (exposure && partitioned.intercept) || blockedMessages.size > 0
+            ? lastAssistantMessage.toolCalls.map((call) => {
+                const searched = exposure?.messagesById.get(call.id);
+                if (searched)
+                    return searched;
+                const blocked = blockedMessages.get(call.id);
+                if (blocked)
+                    return blocked;
+                const business = toolMessages.find((message) => message.toolCallId === call.id);
+                return business;
+            })
+            : toolMessages;
         return {
-            messages: toolMessages,
+            messages: orderedMessages,
             currentNode: nodeId,
             ...(lastSpanId ? { lastSpanId } : {}),
+            ...(exposure
+                ? {
+                    exposedMcpTools: exposure.exposedMcpTools,
+                    exposedMcpScopeId: exposure.exposedMcpScopeId,
+                }
+                : {}),
         };
     }
     // ─────────────────────────────────────────────

package/dist/registry/graph-loader.js

@@ -270,6 +270,15 @@ function resolveMcpServer(manifest) {
     }
     return undefined;
 }
+/** 门户把同一次注册的「用户确认」写在每个 tools[] 上。MCP 不展开这份清单，占位记录读这个值。 */
+function mcpToolsRequireConfirmation(manifest) {
+    const tools = manifest.tools;
+    if (!Array.isArray(tools))
+        return false;
+    return tools.some((tool) => Boolean(tool &&
+        typeof tool === 'object' &&
+        tool.requireConfirmation));
+}
 function mcpDiscoverStub(pre, options) {
     const m = pre.manifest;
     const server = resolveMcpServer(m);
@@ -306,7 +315,7 @@ function mcpDiscoverStub(pre, options) {
             dataScope: normalizeDataScope(m.permissions && typeof m.permissions === 'object' && !Array.isArray(m.permissions)
                 ? m.permissions.dataScope
                 : m.dataScope),
-            requireConfirmation: false,
+            requireConfirmation: mcpToolsRequireConfirmation(m),
             execution,
         },
     };