@kuralle-agents/core 0.6.1 → 0.7.1

package/README.md

@@ -99,17 +99,15 @@ Rule of thumb: if you're pasting more than ~20 lines of procedure into a system
 ```ts
 const triage = defineAgent({
   id: 'triage',
-  instructions: 'Route to the right specialist.',
   model: openai('gpt-4o-mini'),
   routes: [
     { agent: 'billing', when: 'billing question' },
-    { agent: 'support', when: 'support request' },
+    { agent: 'support', when: 'support request or anything else' },
   ],
-  routing: { mode: 'structured', default: 'support' },
 });
 ```
 
-`mode: 'structured'` routes via schema — the routing decision never surfaces to the user.
+With only `routes`/`agents` and no answering surface (no `instructions`/`flows`/`tools`), `triage` derives as a **pure dispatcher**: it silently classifies and routes. The decision is model-reasoned over the `when` descriptions and never surfaces to the user. Model every fallback as a normal route with a semantic `when` (e.g. "or anything else") — there is no `routing.default`. Optionally set `routing: { model }` to pick the control-reasoning model.
 
 ## Sessions
 

package/dist/capabilities/index.d.ts

@@ -141,11 +141,8 @@ export declare class CapabilityHost {
     /** Number of registered capabilities. */
     get capabilityCount(): number;
 }
-export { TriageCapability } from './TriageCapability.js';
 export { ExtractionCapability } from './ExtractionCapability.js';
 export type { ExtractionCapabilityConfig } from './ExtractionCapability.js';
-export { HandoffCapability } from './HandoffCapability.js';
-export type { HandoffTarget } from './HandoffCapability.js';
 export { GuardrailCapability } from './GuardrailCapability.js';
 export { AutoRetrieveCapability } from './AutoRetrieveCapability.js';
 export type { AutoRetrieveCapabilityConfig, RetrieveProvider } from './AutoRetrieveCapability.js';

package/dist/capabilities/index.js

@@ -116,9 +116,7 @@ function assemblePromptSections(basePrompt, sections) {
     return parts.join('\n\n');
 }
 // ─── Re-exports ──────────────────────────────────────────────────────────────
-export { TriageCapability } from './TriageCapability.js';
 export { ExtractionCapability } from './ExtractionCapability.js';
-export { HandoffCapability } from './HandoffCapability.js';
 export { GuardrailCapability } from './GuardrailCapability.js';
 export { AutoRetrieveCapability } from './AutoRetrieveCapability.js';
 export { PassThroughRefinement } from './refinement/PassThrough.js';

package/dist/flow/classifyControl.js

@@ -1,5 +1,6 @@
 import { isHandoffResult } from '../tools/handoff.js';
 import { isFinalResult } from '../tools/final.js';
+import { isEnterFlowResult } from '../tools/enterFlow.js';
 import { isEscalateResult, isRecoverResult } from '../tools/controlResults.js';
 export function classifyControl(result) {
     if (isHandoffResult(result)) {
@@ -9,6 +10,9 @@ export function classifyControl(result) {
             reason: result.reason,
         };
     }
+    if (isEnterFlowResult(result)) {
+        return { type: 'enterFlow', flowName: result.flowName, reason: result.reason };
+    }
     if (isFinalResult(result)) {
         return { type: 'end', reason: result.text };
     }

package/dist/flow/collectDigression.js

@@ -44,7 +44,6 @@ export async function runCollectDigression(options) {
         agent,
         run,
         model: agent.routing?.model ?? ctx.controlModel,
-        alwaysRoute: agent.routing?.always === true,
         excludeFlowNames: [activeFlowName],
     });
     if (selection.kind === 'route') {

package/dist/flow/controlEvaluator.js

@@ -9,6 +9,9 @@ function controlToTransition(control) {
             return { kind: 'escalate', reason: control.reason };
         case 'recover':
             return { kind: 'end', reason: control.reason ?? 'error_degraded' };
+        case 'enterFlow':
+            // enter_flow is host-turn-only; never injected into in-flow reply nodes.
+            throw new Error(`enter_flow control reached the in-flow evaluator (flow "${control.flowName}") — it is host-only`);
     }
 }
 export async function evaluateReplyControl(signal) {

package/dist/flow/flowControlTools.js

@@ -2,6 +2,7 @@
 export const FLOW_TRANSITION_CONTROL_TOOL_NAMES = new Set([
     'handoff',
     'transfer_to_agent',
+    'enter_flow',
     'final',
     'escalate',
     'recover',

package/dist/index.d.ts

@@ -60,8 +60,8 @@ export type { HandoffInputFilter, HandoffInputData, HandoffInputResult, } from '
 export { DefaultToolExecutor, DefaultConversationState, DefaultConversationEventLog, DefaultAgentStateController, createFoundation, } from './foundation/index.js';
 export type { ToolExecutor, ConversationState, ConversationEventLog, ConversationEvent, AgentStateController, Foundation, FoundationConfig, } from './foundation/index.js';
 export type * from './types/index.js';
-export { CapabilityHost, TriageCapability, ExtractionCapability, HandoffCapability, GuardrailCapability, AutoRetrieveCapability, PassThroughRefinement, PassThroughValidation, toGeminiDeclarations, toAISDKTools, } from './capabilities/index.js';
-export type { Capability, CapabilityAction, ExtractionToolResponseEnvelope, FlowReconfigureTransition, ToolDeclaration, PromptSection as CapabilityPromptSection, GeminiFunctionDeclaration, ExtractionCapabilityConfig, HandoffTarget, RetrieveProvider, AutoRetrieveCapabilityConfig, RefinementCapability, RefineInput, RefineDecision, ValidationCapability, ValidateInput, ValidateDecision, SourceRef, } from './capabilities/index.js';
+export { CapabilityHost, ExtractionCapability, GuardrailCapability, AutoRetrieveCapability, PassThroughRefinement, PassThroughValidation, toGeminiDeclarations, toAISDKTools, } from './capabilities/index.js';
+export type { Capability, CapabilityAction, ExtractionToolResponseEnvelope, FlowReconfigureTransition, ToolDeclaration, PromptSection as CapabilityPromptSection, GeminiFunctionDeclaration, ExtractionCapabilityConfig, RetrieveProvider, AutoRetrieveCapabilityConfig, RefinementCapability, RefineInput, RefineDecision, ValidationCapability, ValidateInput, ValidateDecision, SourceRef, } from './capabilities/index.js';
 export type { EscalationOutcome, EscalationReason } from './escalation/types.js';
 export { filterAuditEntries } from './audit/index.js';
 export type { AuditConfig, AuditEntryBase, AuditEntryType, AuditListOptions, AuditReplayOptions, ConversationAuditEntry, ConversationAuditLog, } from './audit/types.js';

package/dist/index.js

@@ -36,7 +36,7 @@ export { DEFAULT_CONTEXT_BUDGET, VOICE_CONTEXT_BUDGET, computeMessageHistoryBudg
 export { TokenAccumulator } from './runtime/TokenAccumulator.js';
 export { handoffFilters, removeToolHistory, keepRecentMessages, removeKeys, composeFilters, } from './runtime/handoffFilters.js';
 export { DefaultToolExecutor, DefaultConversationState, DefaultConversationEventLog, DefaultAgentStateController, createFoundation, } from './foundation/index.js';
-export { CapabilityHost, TriageCapability, ExtractionCapability, HandoffCapability, GuardrailCapability, AutoRetrieveCapability, PassThroughRefinement, PassThroughValidation, toGeminiDeclarations, toAISDKTools, } from './capabilities/index.js';
+export { CapabilityHost, ExtractionCapability, GuardrailCapability, AutoRetrieveCapability, PassThroughRefinement, PassThroughValidation, toGeminiDeclarations, toAISDKTools, } from './capabilities/index.js';
 export { filterAuditEntries } from './audit/index.js';
 export { defineAgent, defineFlow, reply, collect, action, decide, confirmGate, } from './authoring/index.js';
 export { defineTool } from './types/effectTool.js';

package/dist/runtime/Runtime.d.ts

@@ -10,7 +10,7 @@ import type { TurnHandle } from '../types/stream.js';
 import type { SignalDelivery } from './durable/types.js';
 import type { ResolvedSelection } from '../types/selection.js';
 import type { ConversationOutcome, ConversationOutcomeMarkedBy } from '../outcomes/types.js';
-import type { selectHostTarget } from './select.js';
+import type { classifyHostTarget, selectHostTarget } from './select.js';
 import type { KnowledgeProviderConfig } from '../types/voice.js';
 import type { MemoryService as V1MemoryService } from '../memory/MemoryService.js';
 import type { PersistentMemoryStore } from '../memory/blocks/types.js';
@@ -23,6 +23,8 @@ export interface HarnessConfig {
     terminalHandoffTargets?: string[];
     hooks?: Hooks;
     voiceMode?: boolean;
+    hostClassify?: typeof classifyHostTarget;
+    /** @deprecated Use hostClassify — test injection adapter for HostSelection stubs. */
     hostSelect?: typeof selectHostTarget;
     tools?: Record<string, AnyTool>;
     knowledge?: KnowledgeProviderConfig;

package/dist/runtime/Runtime.js

@@ -5,19 +5,18 @@ import { TextDriver } from './channels/TextDriver.js';
 import { createRunContext } from './ctx.js';
 import { createEventBus, createTurnHandle } from '../events/TurnHandle.js';
 import { CoreToolExecutor } from '../tools/effect/index.js';
-import { createFsTool } from '../tools/fs/createFsTool.js';
-import { wireAgentSkills } from '../skills/wireAgentSkills.js';
+import { buildAgentToolSurface } from './buildAgentToolSurface.js';
 import { hostLoop } from './hostLoop.js';
 import { isDegradableRuntimeError } from '../flow/degradableErrors.js';
 import { SAFE_DEGRADED_MESSAGE } from '../flow/degrade.js';
+import { adaptHostSelect } from './hostClassifyAdapter.js';
 import { openRun } from './openRun.js';
 import { closeRun } from './closeRun.js';
 import { SessionRunStore } from './durable/SessionRunStore.js';
 import { loadRecordedSteps } from './durable/replay.js';
 import { markSessionOutcome } from './outcomeMarking.js';
 import { resolveAgentPolicies } from './policies/resolvePolicies.js';
-import { buildAutoRetrieveProvider, buildKnowledgeProvider, buildMemoryService, runMemoryIngest, wireWorkingMemory, } from './grounding/index.js';
-import { resolveAgentWorkspace } from './resolveAgentWorkspace.js';
+import { buildAutoRetrieveProvider, buildKnowledgeProvider, buildMemoryService, runMemoryIngest, } from './grounding/index.js';
 import { SessionMutex } from './SessionMutex.js';
 export class Runtime {
     config;
@@ -65,38 +64,16 @@ export class Runtime {
                 sessionStore: this.sessionStore,
             });
             const policies = resolveAgentPolicies(opened.agent);
-            const agentTools = {
-                ...(this.config.tools ?? {}),
-                ...(opened.agent.tools ?? {}),
-                // Global tools (ADR 0001) are model-visible in speaking turns via the
-                // drivers; register their executors here too so a model call can actually
-                // run them. Visibility stays gated (not exposed during collect extraction).
-                ...(opened.agent.globalTools ?? {}),
-            };
-            const resolvedWorkspace = resolveAgentWorkspace(opened.agent.workspace);
-            if (resolvedWorkspace) {
-                agentTools.workspace = createFsTool({
-                    fs: resolvedWorkspace.fs,
-                    readOnly: resolvedWorkspace.readOnly,
-                });
-            }
-            const wiredWorkingMemory = await wireWorkingMemory(opened.agent, opened.session, this.config.defaultWorkingMemoryStore);
-            if (wiredWorkingMemory) {
-                agentTools.memory_block = wiredWorkingMemory.memoryBlockTool;
-            }
-            let skillPrompt;
-            let skillTools = {};
-            if (opened.agent.skills) {
-                const wired = await wireAgentSkills(opened.agent);
-                if (wired) {
-                    skillTools = wired.tools;
-                    Object.assign(agentTools, wired.tools);
-                    skillPrompt = wired.promptSections.map((s) => s.content).join('\n\n');
-                }
-            }
-            const workspaceTool = agentTools.workspace;
+            const knowledgeProvider = this.config.knowledge
+                ? buildKnowledgeProvider(this.config.knowledge)
+                : undefined;
+            const openingSurface = await buildAgentToolSurface(opened.agent, opened.session, {
+                configTools: this.config.tools,
+                knowledgeProvider,
+                defaultWorkingMemoryStore: this.config.defaultWorkingMemoryStore,
+            });
             const toolExecutor = new CoreToolExecutor({
-                tools: agentTools,
+                tools: openingSurface.executorTools,
                 enforcer: policies.enforcer,
                 agentId: opened.agent.id,
                 onInterim: (message) => {
@@ -112,9 +89,6 @@ export class Runtime {
             if (!model) {
                 throw new Error('Runtime requires agent.model or config.defaultModel');
             }
-            const knowledgeProvider = this.config.knowledge
-                ? buildKnowledgeProvider(this.config.knowledge)
-                : undefined;
             runCtx = await createRunContext({
                 session: opened.session,
                 runState: freshRunState,
@@ -136,23 +110,15 @@ export class Runtime {
                 memoryService: this.config.memoryService
                     ? buildMemoryService(this.config.memoryService, opened.agent)
                     : undefined,
-                fs: resolvedWorkspace?.fs,
+                fs: openingSurface.resolvedWorkspace?.fs,
             });
             // Agent base layer (ADR 0001): composed into every node turn by the drivers.
             runCtx.baseInstructions = opened.agent.instructions;
-            runCtx.globalTools = {
-                ...(opened.agent.globalTools ?? {}),
-                ...(workspaceTool && resolvedWorkspace?.readOnly !== false
-                    ? { workspace: workspaceTool }
-                    : {}),
-                ...skillTools,
-            };
+            runCtx.globalTools = openingSurface.globalTools;
             runCtx.outOfBandControl = opened.agent.experimental?.outOfBandControl ?? false;
-            runCtx.skillPrompt = skillPrompt;
-            runCtx.workingMemoryPrompt = wiredWorkingMemory?.promptSection;
-            runCtx.workingMemoryTools = wiredWorkingMemory
-                ? { memory_block: wiredWorkingMemory.memoryBlockTool }
-                : undefined;
+            runCtx.skillPrompt = openingSurface.skillPrompt;
+            runCtx.workingMemoryPrompt = openingSurface.workingMemoryPrompt;
+            runCtx.workingMemoryTools = openingSurface.workingMemoryTools;
             await this.hooks?.onStart?.(runCtx);
             const driver = opts.driver ?? new TextDriver();
             let activeAgent = opened.agent;
@@ -166,7 +132,8 @@ export class Runtime {
                         run: runCtx.runState,
                         driver,
                         ctx: runCtx,
-                        select: this.config.hostSelect,
+                        classify: this.config.hostClassify ??
+                            (this.config.hostSelect ? adaptHostSelect(this.config.hostSelect) : undefined),
                     });
                     if (loopResult.kind === 'handoff') {
                         if (this.terminalHandoffTargets.has(loopResult.to)) {
@@ -191,17 +158,22 @@ export class Runtime {
                         });
                         runCtx.runState.activeAgentId = loopResult.to;
                         activeAgent = target;
+                        const targetSurface = await buildAgentToolSurface(target, opened.session, {
+                            configTools: this.config.tools,
+                            knowledgeProvider,
+                            defaultWorkingMemoryStore: this.config.defaultWorkingMemoryStore,
+                        });
                         runCtx.autoRetrieve = knowledgeProvider
                             ? buildAutoRetrieveProvider(knowledgeProvider, target)
                             : undefined;
+                        runCtx.globalTools = targetSurface.globalTools;
+                        runCtx.skillPrompt = targetSurface.skillPrompt;
+                        runCtx.workingMemoryPrompt = targetSurface.workingMemoryPrompt;
+                        runCtx.workingMemoryTools = targetSurface.workingMemoryTools;
+                        runCtx.fs = targetSurface.resolvedWorkspace?.fs;
                         runCtx.memoryService = this.config.memoryService
                             ? buildMemoryService(this.config.memoryService, target)
                             : undefined;
-                        const targetWorkingMemory = await wireWorkingMemory(target, opened.session, this.config.defaultWorkingMemoryStore);
-                        runCtx.workingMemoryPrompt = targetWorkingMemory?.promptSection;
-                        runCtx.workingMemoryTools = targetWorkingMemory
-                            ? { memory_block: targetWorkingMemory.memoryBlockTool }
-                            : undefined;
                         await runCtx.runStore.putRunState(runCtx.runState);
                         continue;
                     }

package/dist/runtime/agentReply.d.ts

@@ -1,3 +1,4 @@
 import type { AgentConfig } from '../types/agentConfig.js';
 import type { ReplyNode } from '../types/flow.js';
-export declare function buildAgentReplyNode(agent: AgentConfig): ReplyNode;
+import type { RunState } from './durable/types.js';
+export declare function buildAgentReplyNode(agent: AgentConfig, run?: RunState): ReplyNode;

package/dist/runtime/agentReply.js

@@ -1,13 +1,24 @@
 import { buildToolSet } from '../tools/effect/defineTool.js';
-export function buildAgentReplyNode(agent) {
+import { deriveAgentShape } from './deriveAgent.js';
+import { buildHostControlTools } from './hostControlTools.js';
+export function buildAgentReplyNode(agent, run) {
+    const shape = deriveAgentShape(agent);
+    const tools = { ...agent.tools };
+    if (shape.isAnsweringAgent && run) {
+        Object.assign(tools, buildHostControlTools(agent, run));
+    }
     const label = agent.name ?? agent.id;
     const instructions = agent.instructions ??
-        `You are ${label}. Help the user concisely. Do not mention internal routing or flows.`;
+        (shape.isAnsweringAgent
+            ? `You are ${label}. Help the user concisely. Do not mention internal routing or flows. ` +
+                'If the user wants a specialist or a procedure, CALL the control tool (enter_flow or transfer_to_agent) — ' +
+                'do not first say a filler or acknowledgement like "Sure" or "One moment".'
+            : '');
     return {
         kind: 'reply',
         id: `${agent.id}__host`,
         instructions,
-        tools: agent.tools ? buildToolSet(agent.tools) : undefined,
+        tools: Object.keys(tools).length > 0 ? buildToolSet(tools) : undefined,
         model: agent.model,
     };
 }

package/dist/runtime/buildAgentToolSurface.d.ts

@@ -0,0 +1,20 @@
+import type { AgentConfig } from '../types/agentConfig.js';
+import type { Session } from '../types/session.js';
+import type { AnyTool } from '../types/effectTool.js';
+import type { PersistentMemoryStore } from '../memory/blocks/types.js';
+import type { KnowledgeProvider } from './KnowledgeProvider.js';
+import { type ResolvedAgentWorkspace } from './resolveAgentWorkspace.js';
+export interface AgentToolSurface {
+    executorTools: Record<string, AnyTool>;
+    globalTools: Record<string, AnyTool>;
+    workingMemoryTools?: Record<string, AnyTool>;
+    workingMemoryPrompt?: string;
+    skillPrompt?: string;
+    resolvedWorkspace?: ResolvedAgentWorkspace;
+}
+export interface BuildAgentToolSurfaceDeps {
+    configTools?: Record<string, AnyTool>;
+    knowledgeProvider?: KnowledgeProvider;
+    defaultWorkingMemoryStore?: PersistentMemoryStore;
+}
+export declare function buildAgentToolSurface(agent: AgentConfig, session: Session, deps: BuildAgentToolSurfaceDeps): Promise<AgentToolSurface>;

package/dist/runtime/buildAgentToolSurface.js

@@ -0,0 +1,56 @@
+import { createFsTool } from '../tools/fs/createFsTool.js';
+import { wireAgentSkills } from '../skills/wireAgentSkills.js';
+import { buildKnowledgeTool, wireWorkingMemory } from './grounding/index.js';
+import { resolveAgentWorkspace, } from './resolveAgentWorkspace.js';
+export async function buildAgentToolSurface(agent, session, deps) {
+    const executorTools = {
+        ...(deps.configTools ?? {}),
+        ...(agent.tools ?? {}),
+        ...(agent.globalTools ?? {}),
+    };
+    const resolvedWorkspace = resolveAgentWorkspace(agent.workspace);
+    let workspaceTool;
+    if (resolvedWorkspace) {
+        workspaceTool = createFsTool({
+            fs: resolvedWorkspace.fs,
+            readOnly: resolvedWorkspace.readOnly,
+        });
+        executorTools.workspace = workspaceTool;
+    }
+    const wiredWorkingMemory = await wireWorkingMemory(agent, session, deps.defaultWorkingMemoryStore);
+    if (wiredWorkingMemory) {
+        executorTools.memory_block = wiredWorkingMemory.memoryBlockTool;
+    }
+    let skillPrompt;
+    let skillTools = {};
+    if (agent.skills) {
+        const wired = await wireAgentSkills(agent);
+        if (wired) {
+            skillTools = wired.tools;
+            Object.assign(executorTools, wired.tools);
+            skillPrompt = wired.promptSections.map((s) => s.content).join('\n\n');
+        }
+    }
+    const knowledgeTool = deps.knowledgeProvider
+        ? buildKnowledgeTool(deps.knowledgeProvider, agent)
+        : undefined;
+    if (knowledgeTool) {
+        executorTools.knowledge_search = knowledgeTool;
+    }
+    const globalTools = {
+        ...(agent.globalTools ?? {}),
+        ...(workspaceTool && resolvedWorkspace?.readOnly !== false ? { workspace: workspaceTool } : {}),
+        ...skillTools,
+        ...(knowledgeTool ? { knowledge_search: knowledgeTool } : {}),
+    };
+    return {
+        executorTools,
+        globalTools,
+        workingMemoryPrompt: wiredWorkingMemory?.promptSection,
+        workingMemoryTools: wiredWorkingMemory
+            ? { memory_block: wiredWorkingMemory.memoryBlockTool }
+            : undefined,
+        skillPrompt,
+        resolvedWorkspace,
+    };
+}

package/dist/runtime/channels/TextDriver.d.ts

@@ -9,6 +9,7 @@ export interface TextDriverConfig {
     maxSteps?: number;
 }
 export declare class TextDriver implements ChannelDriver {
+    readonly outputCapability: "kuralle-controlled-text";
     private readonly toolDefs;
     private readonly maxSteps;
     constructor(config?: TextDriverConfig);

package/dist/runtime/channels/TextDriver.js

@@ -6,12 +6,13 @@ import { consumePendingUserInput } from './inputBuffer.js';
 import { runSilentExtraction } from './extractionTurn.js';
 import { applyPreTurnPolicies, applyPostTurnPolicies } from '../policies/agentTurn.js';
 import { resolveMaxSteps } from '../policies/limits.js';
-import { speakGated } from './streaming/speakGated.js';
+import { speakWithHostControl } from './streaming/hostControlSpeak.js';
 import { resolveStreamMode } from './streaming/mode.js';
 import { appendGatherBlocks, resolveNodeGatherScope, runGatherPhase } from '../grounding/index.js';
 import { isFlowTransitionControlTool } from '../../flow/flowControlTools.js';
 import { resolveStructuredDecide } from '../../flow/choiceMatch.js';
 export class TextDriver {
+    outputCapability = 'kuralle-controlled-text';
     toolDefs;
     maxSteps;
     constructor(config = {}) {
@@ -81,7 +82,11 @@ export class TextDriver {
                             args: call.input,
                             toolCallId: call.toolCallId,
                         });
-                        const { result: toolResult, control, failed } = await executeModelToolCall(ctx, { toolName: call.toolName, input: call.input, toolCallId: call.toolCallId }, node.localTools);
+                        const { result: toolResult, control, failed } = await executeModelToolCall(ctx, { toolName: call.toolName, input: call.input, toolCallId: call.toolCallId }, {
+                            ...ctx.globalTools,
+                            ...(ctx.workingMemoryTools ?? {}),
+                            ...node.localTools,
+                        });
                         out.toolResults.push({
                             name: call.toolName,
                             args: call.input,
@@ -108,24 +113,36 @@ export class TextDriver {
                 }
             },
         };
-        const spoken = await speakGated({
-            ctx,
-            mode,
-            turnId,
-            source,
-            runGate: async (text, _final) => {
-                const r = await applyPostTurnPolicies(ctx, text, toolCallsMade, gather.citations ?? []);
-                return {
-                    blocked: !r.proceed,
-                    text: r.proceed ? r.text : (r.blockedMessage ?? r.text),
-                    reason: r.control?.reason,
-                    control: r.control,
-                    confidence: r.confidence,
-                };
-            },
-        });
+        const runGate = async (text, _final) => {
+            const r = await applyPostTurnPolicies(ctx, text, toolCallsMade, gather.citations ?? []);
+            return {
+                blocked: !r.proceed,
+                text: r.proceed ? r.text : (r.blockedMessage ?? r.text),
+                reason: r.control?.reason,
+                control: r.control,
+                confidence: r.confidence,
+            };
+        };
+        const speakFn = node.hostControl
+            ? speakWithHostControl({
+                ctx,
+                mode,
+                turnId,
+                source,
+                runGate,
+                dispatchMode: node.hostControl.dispatchMode,
+                getToolControl: () => out.control,
+            })
+            : (await import('./streaming/speakGated.js')).speakGated({
+                ctx,
+                mode,
+                turnId,
+                source,
+                runGate,
+            });
+        const spoken = await speakFn;
         out.text = spoken.text;
-        out.control = spoken.control;
+        out.control = spoken.control ?? out.control;
         out.confidence = spoken.confidence;
         ctx.emit({ type: 'turn-end' });
         return out;

package/dist/runtime/channels/VoiceDriver.d.ts

@@ -12,6 +12,7 @@ export interface VoiceDriverConfig {
     maxSteps?: number;
 }
 export declare class VoiceDriver implements ChannelDriver {
+    readonly outputCapability: "native-realtime";
     private readonly client;
     private readonly toolDefs;
     private readonly maxSteps;

package/dist/runtime/channels/VoiceDriver.js

@@ -34,6 +34,7 @@ function emitNativeRealtimePostHocGate(ctx, client, gate) {
     client.requestResponse?.(gate.safeText);
 }
 export class VoiceDriver {
+    outputCapability = 'native-realtime';
     client;
     toolDefs;
     maxSteps;
@@ -128,7 +129,10 @@ export class VoiceDriver {
         transcript.close('complete');
         const spoken = await speakPromise;
         out.text = spoken.text;
-        out.control = spoken.control;
+        // Preserve host-control raised during provider tool execution (enter_flow /
+        // transfer_to_agent); the post-hoc gate must not clobber it (else native
+        // realtime silently drops valid routing). Same fix as TextDriver.
+        out.control = spoken.control ?? out.control;
         out.confidence = spoken.confidence;
         if (postHocGate) {
             // Advisory post-hoc gate: provider audio may already have played; correction does not un-speak it.
@@ -198,7 +202,11 @@ export class VoiceDriver {
             const onToolCall = (id, name, args) => {
                 void (async () => {
                     ctx.emit({ type: 'tool-call', toolName: name, args, toolCallId: id });
-                    const { result: toolResult, control, failed } = await executeModelToolCall(ctx, { toolName: name, input: args, toolCallId: id }, localTools);
+                    const { result: toolResult, control, failed } = await executeModelToolCall(ctx, { toolName: name, input: args, toolCallId: id }, {
+                        ...ctx.globalTools,
+                        ...(ctx.workingMemoryTools ?? {}),
+                        ...localTools,
+                    });
                     out.toolResults.push({ name, args, result: toolResult, toolCallId: id });
                     toolCallsMade.push({
                         toolCallId: id,

package/dist/runtime/channels/streaming/hostControlSpeak.d.ts

@@ -0,0 +1,30 @@
+import type { TurnControl } from '../../../types/channel.js';
+import type { RunContext } from '../../../types/run-context.js';
+import { type TokenSource, type GateOutcome } from './speakGated.js';
+import type { StreamMode } from './mode.js';
+/**
+ * Streaming dispatch gate. Its only job is to control EMISSION per dispatch mode
+ * and surface the model's own control tool — it does NOT consult the host guard.
+ * The guard has a single owner (`hostLoop`): when this returns empty text and no
+ * control, `hostLoop` runs the guard exactly once. Keeping the guard out of here
+ * avoids double-evaluation and keeps guard telemetry attributable.
+ *
+ * - relaxed: stream live; if the model's own control tool fires, cancel any
+ *   streamed text and return that control.
+ * - strict: emit NOTHING until the model's intent is known — buffer until the
+ *   first substantive token (answering → flush + stream the rest live) or source
+ *   end (no answer → return empty; `hostLoop` then guards with no leak).
+ */
+export declare function speakWithHostControl(args: {
+    ctx: RunContext;
+    mode: StreamMode;
+    turnId: string;
+    source: TokenSource;
+    runGate: (fullOrSentence: string, final: boolean) => Promise<GateOutcome>;
+    dispatchMode: 'strict' | 'relaxed';
+    getToolControl: () => TurnControl | undefined;
+}): Promise<{
+    text: string;
+    control?: TurnControl;
+    confidence?: number;
+}>;

package/dist/runtime/channels/streaming/hostControlSpeak.js

@@ -0,0 +1,80 @@
+import { speakGated } from './speakGated.js';
+/**
+ * Streaming dispatch gate. Its only job is to control EMISSION per dispatch mode
+ * and surface the model's own control tool — it does NOT consult the host guard.
+ * The guard has a single owner (`hostLoop`): when this returns empty text and no
+ * control, `hostLoop` runs the guard exactly once. Keeping the guard out of here
+ * avoids double-evaluation and keeps guard telemetry attributable.
+ *
+ * - relaxed: stream live; if the model's own control tool fires, cancel any
+ *   streamed text and return that control.
+ * - strict: emit NOTHING until the model's intent is known — buffer until the
+ *   first substantive token (answering → flush + stream the rest live) or source
+ *   end (no answer → return empty; `hostLoop` then guards with no leak).
+ */
+export async function speakWithHostControl(args) {
+    const { ctx, mode, turnId, source, runGate, dispatchMode, getToolControl } = args;
+    if (dispatchMode === 'strict') {
+        const it = source[Symbol.asyncIterator]();
+        const buffered = [];
+        let answered = false;
+        while (!getToolControl()) {
+            const r = await it.next();
+            if (r.done) {
+                break;
+            }
+            buffered.push(r.value);
+            if (r.value.delta.trim().length > 0) {
+                answered = true;
+                break;
+            }
+        }
+        const toolControl = getToolControl();
+        if (toolControl) {
+            return { text: '', control: toolControl };
+        }
+        // No substantive text → emit nothing; hostLoop owns the empty-turn guard.
+        if (!answered) {
+            return { text: '', control: undefined };
+        }
+        // Answering: flush the buffered prefix, then stream the remainder live.
+        const flushSource = {
+            async *[Symbol.asyncIterator]() {
+                for (const chunk of buffered) {
+                    yield chunk;
+                }
+                let cur = await it.next();
+                while (!cur.done) {
+                    if (getToolControl()) {
+                        return;
+                    }
+                    yield cur.value;
+                    cur = await it.next();
+                }
+            },
+        };
+        return speakGated({ ctx, mode, turnId, source: flushSource, runGate });
+    }
+    // Relaxed: stream live; stop if the model's own control tool fires.
+    let toolControl;
+    const wrappedSource = {
+        async *[Symbol.asyncIterator]() {
+            for await (const chunk of source) {
+                toolControl = getToolControl();
+                if (toolControl) {
+                    return;
+                }
+                yield chunk;
+            }
+        },
+    };
+    const spoken = await speakGated({ ctx, mode, turnId, source: wrappedSource, runGate });
+    toolControl = getToolControl();
+    if (toolControl) {
+        if (spoken.text) {
+            ctx.emit({ type: 'text-cancel', id: turnId, reason: 'host-control' });
+        }
+        return { text: '', control: toolControl };
+    }
+    return spoken;
+}