@mono-agent/agent-runtime 0.19.1 → 0.20.0

package/src/agent/tools/shared/protected-filesystem.js

@@ -0,0 +1,150 @@
+// Protected-root filesystem operations must cross the native sandbox boundary.
+// A host-side path check cannot close a parent-symlink swap between authorization
+// and open(2); SRT evaluates the path at the actual child-process syscall.
+
+// @ts-check
+
+import { basename, isAbsolute, relative, resolve, sep } from "node:path";
+import { readToolRuntime } from "./runtime-context.js";
+import { runPreparedProcess } from "./process-runner.js";
+import { resolveSandboxPolicy } from "./tool-context.js";
+
+const PROTECTED_OPERATION_TIMEOUT_MS = 15_000;
+
+/**
+ * @param {{command: string, args?: string[], cwd?: string, env?: Record<string, string|undefined>}} command
+ * @param {{sandboxPolicy?: any, sandboxEngine?: any, ctx?: any, input?: string|Buffer, maxBufferBytes?: number}} [options]
+ * @returns {Promise<any|null>}
+ */
+export async function runProtectedFilesystemCommand(command, {
+  sandboxPolicy,
+  sandboxEngine,
+  ctx,
+  input,
+  maxBufferBytes,
+} = {}) {
+  const resolvedCtx = ctx ?? readToolRuntime();
+  const policy = resolveSandboxPolicy(resolvedCtx, sandboxPolicy);
+  if (!hasProtectedRoots(policy)) {
+    return null;
+  }
+  const sandbox = resolvedCtx.sandbox;
+  let prepared;
+  try {
+    prepared = await sandbox.prepareCommand({
+      policy,
+      engine: sandboxEngine ?? resolvedCtx.sandboxEngine ?? undefined,
+      command,
+    });
+    return await runPreparedProcess(prepared, {
+      timeoutMs: PROTECTED_OPERATION_TIMEOUT_MS,
+      ...(input === undefined ? {} : { input }),
+      ...(maxBufferBytes === undefined ? {} : { maxBufferBytes }),
+    });
+  } finally {
+    await prepared?.cleanup?.();
+  }
+}
+
+/** @param {any} policy */
+function hasProtectedRoots(policy) {
+  return policy !== undefined
+    && Array.isArray(policy.protectedRoots)
+    && policy.protectedRoots.length > 0;
+}
+
+/**
+ * Build a metadata-free operation plan rooted at a configured policy path.
+ * Search tools keep the model-controlled target as an argument; file helpers
+ * use the stable cwd with their absolute target. In both cases the host avoids
+ * target metadata and target-derived cwd resolution before SRT enforces policy.
+ *
+ * @param {string} target
+ * @param {{sandboxPolicy?: any, ctx?: any}} [options]
+ * @returns {{cwd: string, searchTarget: string}|null}
+ */
+export function protectedFilesystemTargetPlan(target, { sandboxPolicy, ctx } = {}) {
+  const resolvedCtx = ctx ?? readToolRuntime();
+  const policy = resolveSandboxPolicy(resolvedCtx, sandboxPolicy);
+  if (!hasProtectedRoots(policy)) return null;
+  const resolvedTarget = resolve(target);
+  const roots = [
+    policy.root,
+    ...(Array.isArray(policy.readableRoots) ? policy.readableRoots : []),
+    resolvedCtx.workspace,
+    resolvedCtx.repoRoot,
+    process.cwd(),
+  ];
+  const cwd = roots
+    .filter((root) => typeof root === "string" && root.length > 0)
+    .map((root) => resolve(root))
+    .find((root) => lexicallyContains(root, resolvedTarget))
+    ?? resolve(policy.root || resolvedCtx.workspace || resolvedCtx.repoRoot || process.cwd());
+  const rel = relative(cwd, resolvedTarget);
+  const searchTarget = rel === ""
+    ? "."
+    : (!rel.startsWith("..") && !isAbsolute(rel) ? rel : resolvedTarget);
+  return { cwd, searchTarget };
+}
+
+/** @param {string} searchTarget */
+export function protectedDirectorySearchTarget(searchTarget) {
+  return searchTarget.endsWith(sep) ? searchTarget : `${searchTarget}${sep}`;
+}
+
+/**
+ * Scope a target-relative user glob to ripgrep's stable host cwd.
+ * @param {string} pattern
+ * @param {string} searchTarget
+ */
+export function scopeProtectedSearchGlob(pattern, searchTarget) {
+  const normalizedTarget = normalizeSearchPath(searchTarget);
+  if (normalizedTarget === ".") return pattern;
+  const negated = pattern.startsWith("!");
+  const body = (negated ? pattern.slice(1) : pattern).replace(/^\.\//u, "").replace(/^\/+/u, "");
+  const prefix = normalizedTarget
+    .split("/")
+    .map((part) => part.replace(/[!\\*?\[\]{}]/gu, "\\$&"))
+    .join("/");
+  return `${negated ? "!" : ""}${prefix}/${body}`;
+}
+
+/**
+ * Restore the historical target-relative search output after ripgrep runs from
+ * the stable policy root.
+ * @param {string} line
+ * @param {string} searchTarget
+ */
+export function normalizeProtectedSearchLine(line, searchTarget) {
+  const normalizedLine = normalizeSearchPath(line).replace(/^\.\//u, "");
+  const normalizedTarget = normalizeSearchPath(searchTarget).replace(/^\.\//u, "");
+  if (normalizedTarget === ".") return normalizedLine;
+  if (normalizedLine === normalizedTarget) return basename(normalizedTarget);
+  if (normalizedLine.startsWith(`${normalizedTarget}/`)) {
+    return normalizedLine.slice(normalizedTarget.length + 1);
+  }
+  if (normalizedLine.startsWith(`${normalizedTarget}:`)) {
+    return `${basename(normalizedTarget)}${normalizedLine.slice(normalizedTarget.length)}`;
+  }
+  return normalizedLine;
+}
+
+/** @param {any} result */
+export function protectedCommandSucceeded(result) {
+  return result !== null
+    && result.code === 0
+    && result.signal === null
+    && result.spawnError === null
+    && result.timedOut === false
+    && result.bufferExceeded === false;
+}
+
+function normalizeSearchPath(path) {
+  const normalized = sep === "\\" ? String(path).replaceAll("\\", "/") : String(path);
+  return normalized.replace(/\/+$/u, "") || ".";
+}
+
+function lexicallyContains(root, target) {
+  const rel = relative(resolve(root), resolve(target));
+  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}

package/src/agent/tools/web-search.js

@@ -35,7 +35,16 @@ const KEYLESS_DEFAULT_THROTTLE = {
 // behind it has to actually work.
 const KEYLESS_BACKENDS = ["duckduckgo", "startpage"];
 // Markers that identify an interstitial/bot-gate body served with a 2xx status.
-const CHALLENGE_BODY_RE = /anomaly|unusual traffic|captcha|are you a robot|challenge-(?:platform|form)/iu;
+// The last two are Anubis, the proof-of-work gate Startpage now fronts its
+// results with. It says none of the classic things — no captcha, no anomaly,
+// just "Verifying your request..." — so without these it read as a clean 200
+// that happened to parse to nothing, which is exactly the lie this guard exists
+// to prevent.
+const CHALLENGE_BODY_RE =
+  /anomaly|unusual traffic|captcha|are you a robot|challenge-(?:platform|form)|anubis[_-]?challenge|verifying your request/iu;
+// Reasons SearXNG reports for an engine that is being throttled or gated rather
+// than merely erroring, e.g. "CAPTCHA", "too many requests", "Suspended: CAPTCHA".
+const SEARXNG_THROTTLE_REASON_RE = /captcha|too many requests|rate.?limit|suspend|blocked|denied/iu;
 // Statuses these engines use to say "you are sending too much", all of which
 // must put the backend into cooldown rather than be retried next search.
 const RATE_LIMIT_STATUSES = new Set([202, 403, 429]);
@@ -228,17 +237,22 @@ async function searchOneQuery(query, options) {
   // too. Reporting only the last one is what made a DuckDuckGo ban surface as
   // "startpage request failed: fetch failed" and sent diagnosis the wrong way.
   const failures = [];
+  // A genuinely empty 200 is a real answer, not a transport failure — but it is
+  // only worth returning once every backend has had its turn. Scoped to the whole
+  // chain, not just the keyless loop: an empty SearXNG answer used to short-
+  // circuit `auto` outright, so the fallbacks below could never rescue a query.
+  let emptySuccess = null;
   if (options.signal?.aborted) return abortedSearch(config.backend, failures);
   if (config.backend === "searxng" || (config.backend === "auto" && config.endpoint)) {
     const result = await searchSearxng(query, options);
-    if (result.ok || config.backend === "searxng") return { ...result, failures };
-    failures.push(result);
+    // Strict mode has nothing to fall through to, so its answer stands as-is.
+    if (config.backend === "searxng") return { ...result, failures };
+    if (result.ok && result.results.length > 0) return { ...result, failures };
+    if (result.ok) emptySuccess = result;
+    else failures.push(result);
     if (options.signal?.aborted) return abortedSearch(result.backend, failures);
   }
   if (config.backend === "keyless" || config.backend === "auto") {
-    // A genuinely empty 200 is a real answer, not a transport failure — but it
-    // is only worth returning once every backend has had its turn.
-    let emptySuccess = null;
     for (const backend of KEYLESS_BACKENDS) {
       if (options.signal?.aborted) return abortedSearch(backend, failures);
       if (backendInCooldown(backend)) {
@@ -254,14 +268,14 @@ async function searchOneQuery(query, options) {
       const result = await KEYLESS_RUNNERS[backend](query, options);
       if (result.ok) {
         if (result.results.length > 0) return { ...result, failures };
-        emptySuccess = result;
+        emptySuccess ??= result;
         continue;
       }
       // The cooldown is already open — rateLimited() sets it at detection.
       failures.push(result);
     }
-    if (emptySuccess) return { ...emptySuccess, failures };
   }
+  if (emptySuccess) return { ...emptySuccess, failures };
   return {
     ...(failures[failures.length - 1] || {
       ok: false,
@@ -385,6 +399,33 @@ async function searchSearxng(query, options) {
     const results = Array.isArray(data?.results)
       ? data.results.flatMap((entry) => normalizedResult(entry, "searxng"))
       : [];
+    // An instance whose engines are all captcha'd or suspended still answers
+    // `200 {"results": []}`, and `unresponsive_engines` is the only thing that
+    // tells that apart from a query nothing matched. Reading `results` alone is
+    // what let a completely dead instance report "No results." on every query
+    // for weeks. Naming each engine and its reason is what makes the next one
+    // diagnosable from the tool output instead of from the container logs.
+    //
+    // Counted on the RAW array, not the normalized one: results that all fail
+    // canonicalization are an unusable answer from working engines, which is a
+    // different fault and must not be blamed on the engines that did fail.
+    const unresponsive = normalizeUnresponsiveEngines(data?.unresponsive_engines);
+    if (!Array.isArray(data?.results) || (data.results.length === 0 && unresponsive.length > 0)) {
+      if (unresponsive.length === 0) {
+        return { ok: false, backend: "searxng", message: "SearXNG returned no results array.", retryable: false };
+      }
+      // Deliberately not "every engine failed": SearXNG lists only the engines
+      // that failed, so a working engine that simply matched nothing is
+      // indistinguishable here from one that was never queried.
+      const detail = unresponsive.map((entry) => `${entry.name}: ${entry.reason}`).join("; ");
+      return {
+        ok: false,
+        backend: "searxng",
+        message: `SearXNG returned no results and ${unresponsive.length === 1 ? "1 engine" : `${unresponsive.length} engines`} failed (${detail})`,
+        retryable: true,
+        rateLimited: unresponsive.some((entry) => SEARXNG_THROTTLE_REASON_RE.test(entry.reason)),
+      };
+    }
     return { ok: true, backend: "searxng", results };
   } catch (error) {
     return fetchFailure("searxng", error);
@@ -573,6 +614,20 @@ export function parseStartpageResults(html) {
   return results;
 }
 
+/**
+ * SearXNG reports each failed engine as a `[name, reason]` pair. Older builds
+ * and some forks send objects instead, so both shapes are accepted.
+ */
+function normalizeUnresponsiveEngines(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    const [name, reason] = Array.isArray(entry) ? entry : [entry?.name, entry?.error ?? entry?.reason];
+    const normalizedName = collapseWhitespace(name);
+    if (!normalizedName) return [];
+    return [{ name: normalizedName, reason: collapseWhitespace(reason) || "unknown error" }];
+  });
+}
+
 function normalizedResult(entry, backend) {
   if (!entry || typeof entry !== "object") return [];
   const url = canonicalizeSearchUrl(entry.url);

package/src/agent/tools/write.js

@@ -1,18 +1,64 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { MAX_WRITE_BYTES } from "./shared/constants.js";
-import { isWritablePathAllowed, resolveToolPath } from "./shared/path-resolver.js";
+import {
+  isWritablePathAllowed,
+  isWritablePathLexicallyAllowed,
+  resolveToolPath,
+} from "./shared/path-resolver.js";
+import {
+  protectedCommandSucceeded,
+  protectedFilesystemTargetPlan,
+  runProtectedFilesystemCommand,
+} from "./shared/protected-filesystem.js";
+
+const PROTECTED_WRITE_SOURCE = String.raw`
+"use strict";
+const { mkdirSync, writeFileSync } = require("node:fs");
+const { dirname } = require("node:path");
+const chunks = [];
+process.stdin.on("data", (chunk) => chunks.push(chunk));
+process.stdin.on("end", () => {
+  const target = process.argv[1];
+  mkdirSync(dirname(target), { recursive: true });
+  writeFileSync(target, Buffer.concat(chunks));
+});
+`;
 
 /**
  * @param {{file_path: string, content?: string, workdir?: string}} params
- * @param {{sandboxPolicy?: any, ctx?: any}} [options]
+ * @param {{sandboxPolicy?: any, sandboxEngine?: any, ctx?: any}} [options]
  */
-export async function writeToolImpl({ file_path, content, workdir }, { sandboxPolicy, ctx } = {}) {
+export async function writeToolImpl({ file_path, content, workdir }, { sandboxPolicy, sandboxEngine, ctx } = {}) {
   const target = resolveToolPath(file_path, workdir, ctx);
-  if (!isWritablePathAllowed(target, workdir, { sandboxPolicy, ctx })) return `Error: Path not allowed: ${file_path}`;
+  const pathOptions = { sandboxPolicy, ctx };
+  const protectedTarget = protectedFilesystemTargetPlan(target, { sandboxPolicy, ctx });
+  const protectedExecution = protectedTarget !== null;
+  if (protectedExecution) {
+    if (!isWritablePathLexicallyAllowed(target, workdir, pathOptions)) {
+      return "Error: Protected filesystem write was denied.";
+    }
+  } else if (!isWritablePathAllowed(target, workdir, pathOptions)) {
+    return `Error: Path not allowed: ${file_path}`;
+  }
   const bytes = Buffer.byteLength(content || "", "utf8");
   if (bytes > MAX_WRITE_BYTES) return `Error: Content too large (${bytes} bytes)`;
-  mkdirSync(dirname(target), { recursive: true });
-  writeFileSync(target, content || "", "utf8");
+  try {
+    if (protectedExecution) {
+      const protectedResult = await runProtectedFilesystemCommand({
+        command: process.execPath,
+        args: ["--input-type=commonjs", "--eval", PROTECTED_WRITE_SOURCE, target],
+        cwd: protectedTarget.cwd,
+      }, { sandboxPolicy, sandboxEngine, ctx, input: content || "" });
+      if (!protectedCommandSucceeded(protectedResult)) {
+        return "Error: Protected filesystem write was denied.";
+      }
+    } else {
+      mkdirSync(dirname(target), { recursive: true });
+      writeFileSync(target, content || "", "utf8");
+    }
+  } catch {
+    return "Error: Protected filesystem write was denied.";
+  }
   return `Successfully wrote ${bytes} bytes to ${target}`;
 }

package/src/ai/providers/acp.js

@@ -17,6 +17,7 @@ import {
   ownAcpSessionUpdateKind,
   sanitizeAcpHostValueWithStatus,
 } from "./acp-privacy.js";
+import { toolLifecycleMetadata } from "../tool-lifecycle.js";
 
 /** @param {any} callback @param {any} event */
 function emit(callback, event) {
@@ -189,6 +190,9 @@ function normalizeUpdate(update, state) {
               tool_use_id: publicValue(ownValue(protocolBody, "toolCallId")),
               content: typeof output === "string" ? output : JSON.stringify(jsonSafe(output)),
               is_error: ownValue(protocolBody, "status") === "failed",
+              tool_lifecycle: toolLifecycleMetadata(ownValue(protocolBody, "status") === "failed"
+                ? { state: "error", failure_kind: "runtime_error", detail_code: "acp_tool_failed" }
+                : { state: "success" }),
             }],
           },
         });

package/src/ai/providers/claude-cli.js

@@ -26,6 +26,7 @@ import {
 } from "./claude-sandbox.js";
 import { resolveSandboxPolicy } from "../../agent/tools/shared/tool-context.js";
 import { createClaudeSubagentActivityNormalizer } from "./claude-subagent-activity.js";
+import { toolLifecycleMetadata } from "../tool-lifecycle.js";
 
 const CODEX_CLI_SANDBOX_POLICY_UNSUPPORTED =
   "Direct Codex CLI cannot enforce mono-agent's native srt sandbox scopes. Remove the mono-agent sandbox policy or use a Pi runtime for exact readableRoots, writableRoots, denyWrite, and network rules.";
@@ -260,7 +261,8 @@ export function normalizeCliEvent(raw, context = {}) {
   if (raw.type === "assistant") {
     return thinkingBuffer ? thinkingBuffer.rehydrate(raw) : raw;
   }
-  if (raw.type === "user" || raw.type === "result" || raw.type === "error") return raw;
+  if (raw.type === "user") return annotateClaudeCliToolResults(raw);
+  if (raw.type === "result" || raw.type === "error") return raw;
   if (raw.type === "message" && raw.message) return { type: "assistant", message: raw.message };
   if (raw.type === "item.completed" && raw.item?.type === "agent_message" && typeof raw.item.text === "string") {
     return { type: "assistant", message: { content: [{ type: "text", text: raw.item.text }] } };
@@ -276,11 +278,42 @@ export function normalizeCliEvent(raw, context = {}) {
     return { type: "assistant", message: { content: [{ type: "tool_use", id: raw.id, name: raw.name, input: raw.input || raw.arguments }] } };
   }
   if (raw.type === "tool_result") {
-    return { type: "user", message: { content: [{ type: "tool_result", tool_use_id: raw.id || raw.tool_use_id, content: raw.output || raw.result || "" }] } };
+    const isError = raw.is_error === true;
+    return {
+      type: "user",
+      message: {
+        content: [{
+          type: "tool_result",
+          tool_use_id: raw.id || raw.tool_use_id,
+          content: raw.output || raw.result || "",
+          is_error: isError,
+          tool_lifecycle: toolLifecycleMetadata(isError
+            ? { state: "error", failure_kind: "runtime_error", detail_code: "claude_cli_tool_error" }
+            : { state: "success" }),
+        }],
+      },
+    };
   }
   return { type: "cli_event", raw };
 }
 
+/** Preserve Claude CLI's only trustworthy terminal distinction: tool_result is_error. */
+function annotateClaudeCliToolResults(raw) {
+  if (!raw?.message || !Array.isArray(raw.message.content)) return raw;
+  let changed = false;
+  const content = raw.message.content.map((block) => {
+    if (!block || block.type !== "tool_result") return block;
+    changed = true;
+    return {
+      ...block,
+      tool_lifecycle: toolLifecycleMetadata(block.is_error === true
+        ? { state: "error", failure_kind: "runtime_error", detail_code: "claude_cli_tool_error" }
+        : { state: "success" }),
+    };
+  });
+  return changed ? { ...raw, message: { ...raw.message, content } } : raw;
+}
+
 function textFromEvent(raw) {
   if (typeof raw?.text === "string") return raw.text;
   if (typeof raw?.item?.text === "string") return raw.item.text;

package/src/ai/providers/claude-sdk.js

@@ -19,6 +19,7 @@ import {
   claudeSandboxPolicyProblem,
 } from "./claude-sandbox.js";
 import { createClaudeSubagentActivityNormalizer } from "./claude-subagent-activity.js";
+import { toolLifecycleMetadata } from "../tool-lifecycle.js";
 
 const CLAUDE_EFFORT_LEVELS = new Set(["low", "medium", "high", "xhigh", "max"]);
 const CLAUDE_SETTING_SOURCES = new Set(["user", "project", "local"]);
@@ -383,6 +384,16 @@ function toolResultText(block) {
   try { return JSON.stringify(content); } catch { return String(content); }
 }
 
+function annotateClaudeToolLifecycles(event) {
+  if (event?.type !== "user" || !Array.isArray(event.message?.content)) return;
+  for (const block of event.message.content) {
+    if (!block || block.type !== "tool_result") continue;
+    block.tool_lifecycle = toolLifecycleMetadata(block.is_error === true
+      ? { state: "error", failure_kind: "runtime_error", detail_code: "claude_sdk_tool_error" }
+      : { state: "success" });
+  }
+}
+
 function structuredOutputRejectionFromEvent(event) {
   if (event?.type !== "user" || !Array.isArray(event.message?.content)) return null;
   for (const block of event.message.content) {
@@ -666,6 +677,7 @@ export async function generateClaudeResponse(systemPrompt, options) {
 
   function emitEvent(event) {
     if (!event) return;
+    annotateClaudeToolLifecycles(event);
     capturedEvents.push(event);
     onEvent(event);
   }

package/src/ai/providers/codex-app.js

@@ -15,6 +15,7 @@ import {
   isAllowAllToolPolicy,
   TOOL_POLICY_ALLOW_ALL_ONLY,
 } from "../runtime/tool-policy.js";
+import { toolLifecycleMetadata } from "../tool-lifecycle.js";
 
 const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
 const DEFAULT_THREAD_START_ATTEMPTS = 2;
@@ -535,6 +536,9 @@ function delay(ms, signal) {
   });
 }
 
+// `thread/start.sandbox` selects only the thread-level filesystem class; it
+// does not own network. `sandboxPolicyForRun()` supplies authoritative per-turn
+// networkAccess, per the app-server 0.147.0 / gpt-5.6-sol retained-thread matrix.
 function sandboxForRun(options) {
   if (options.codexNoToolsProbe === true) return "read-only";
   if (options.permissionMode === "bypassPermissions") return "danger-full-access";
@@ -553,11 +557,14 @@ function approvalPolicyForRun(options) {
 function sandboxPolicyForRun(options) {
   if (options.codexNoToolsProbe === true) return { type: "readOnly", networkAccess: false };
   if (options.permissionMode === "bypassPermissions") return { type: "dangerFullAccess" };
-  if (options.permissionMode === "plan") return { type: "readOnly", networkAccess: false };
+  // App-server 0.147.0 / gpt-5.6-sol retained-thread matrix proved per-turn
+  // networkAccess authoritative in both directions.
+  const networkAccess = options.codexSandboxNetworkAccess === true;
+  if (options.permissionMode === "plan") return { type: "readOnly", networkAccess };
   return {
     type: "workspaceWrite",
     writableRoots: [options.cwd || process.cwd()],
-    networkAccess: false,
+    networkAccess,
     excludeTmpdirEnvVar: false,
     excludeSlashTmp: false,
   };
@@ -1064,6 +1071,9 @@ function mapThreadItem(method, item) {
             ...(item.error ? { error: item.error } : {}),
           },
           is_error: item.status === "failed" || Boolean(item.error),
+          tool_lifecycle: toolLifecycleMetadata(item.status === "failed" || Boolean(item.error)
+            ? { state: "error", failure_kind: "runtime_error", detail_code: "codex_collab_failed" }
+            : { state: "success" }),
         }],
       },
     };
@@ -1090,6 +1100,9 @@ function mapThreadItem(method, item) {
           tool_use_id: item.id,
           content: item.contentItems || item.result || item.error || "",
           is_error: item.status === "failed" || item.success === false || Boolean(item.error),
+          tool_lifecycle: toolLifecycleMetadata(item.status === "failed" || item.success === false || Boolean(item.error)
+            ? { state: "error", failure_kind: "runtime_error", detail_code: "codex_dynamic_tool_failed" }
+            : { state: "success" }),
         }],
       },
     };

package/src/ai/providers/pi-native/stream-subscriber.js

@@ -14,6 +14,7 @@ import {
   streamContentKey,
 } from "../pi-events.js";
 import { contextUsageFromAssistantMessage } from "./result-builder.js";
+import { classifyPiToolResult, toolLifecycleMetadata } from "../../tool-lifecycle.js";
 
 function toolResultFileChange(result) {
   const fileChange = result?.details?.file_change;
@@ -66,6 +67,7 @@ function toolResultOutcome(result) {
  * @property {Set<unknown>} textDeltaIndexes
  * @property {Set<unknown>} thinkingDeltaIndexes
  * @property {Map<string, number>} toolStartTimes
+ * @property {Map<string, any>} toolApprovals
  * @property {number} turnCount
  * @property {number} toolResultsSeen
  * @property {string|null} lastToolName
@@ -128,7 +130,14 @@ export function createStreamSubscriber(runState, { onEvent, options, toolLimits,
       const input = eventToolArgs(event.toolName, event.args, { cwd: options.cwd, toolLimits });
       onEvent({
         type: "assistant",
-        message: { content: [{ type: "tool_use", id: event.toolCallId, name: event.toolName, input }] },
+        message: {
+          content: [{
+            type: "tool_use",
+            id: event.toolCallId,
+            name: event.toolName,
+            input,
+          }],
+        },
       });
     } else if (event.type === "tool_execution_update") {
       const input = eventToolArgs(event.toolName, event.args, { cwd: options.cwd, toolLimits });
@@ -143,6 +152,12 @@ export function createStreamSubscriber(runState, { onEvent, options, toolLimits,
       const resultContent = toolResultContent(event.result);
       const fileChange = toolResultFileChange(event.result);
       const outcome = toolResultOutcome(event.result);
+      const classification = classifyPiToolResult({
+        result: event.result,
+        isError: !!event.isError,
+        aborted: options.abortSignal?.aborted === true,
+        approval: runState.toolApprovals.get(event.toolCallId),
+      });
       if (!event.isError) runState.toolResultsSeen += 1;
       const startedAt = runState.toolStartTimes.get(event.toolCallId);
       if (startedAt !== undefined) {
@@ -154,8 +169,15 @@ export function createStreamSubscriber(runState, { onEvent, options, toolLimits,
           execution_ms: Date.now() - startedAt,
           is_error: !!event.isError,
           ...(outcome || {}),
+          tool_lifecycle: toolLifecycleMetadata({
+            state: classification.state,
+            failure_kind: classification.failureKind,
+            detail_code: classification.detailCode,
+          }),
         });
       }
+      runState.toolApprovals.delete(event.toolCallId);
+      const rawResult = compactToolRawResult(jsonSerializable(event.result, resultContent), resultContent);
       onEvent({
         type: "user",
         message: {
@@ -163,9 +185,14 @@ export function createStreamSubscriber(runState, { onEvent, options, toolLimits,
             type: "tool_result",
             tool_use_id: event.toolCallId,
             content: resultContent,
-            raw_result: compactToolRawResult(jsonSerializable(event.result, resultContent), resultContent),
+            raw_result: rawResult,
             ...(fileChange === null ? {} : { file_change: fileChange }),
             is_error: !!event.isError,
+            tool_lifecycle: toolLifecycleMetadata({
+              state: classification.state,
+              failure_kind: classification.failureKind,
+              detail_code: classification.detailCode,
+            }),
           }],
         },
       });

package/src/ai/providers/pi-native/turn-runner.js

@@ -120,6 +120,7 @@ export async function buildTurnTools(runState, {
       approvalModel: runtime.model?.id || runtime.model?.name || resolved.model,
       nodeReplController,
       webController,
+      processJobsController: options.processJobs,
       toolExecutionMode,
       subagents: options.subagents,
       // The child inherits the parent's route and workspace unless its profile
@@ -166,6 +167,8 @@ export async function buildTurnTools(runState, {
       sandboxPolicy: options.sandboxPolicy,
       sandboxEngine,
       ctx: runCtx,
+      mcpApps: options.mcpApps,
+      runId: runCtx?.runId,
     }));
   // Surface MCP init/list failures BOTH to the live event stream and to runtimeWarnings, so a
   // failed server (e.g. an stdio adapter-send child that closed on startup) lands in the run

package/src/ai/providers/pi-native.js

@@ -276,6 +276,7 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
     textDeltaIndexes: new Set(),
     thinkingDeltaIndexes: new Set(),
     toolStartTimes: new Map(),
+    toolApprovals: new Map(),
     turnCount: 0,
     toolResultsSeen: 0,
     lastToolName: null,
@@ -345,7 +346,12 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
   let structuredOutputFinalizationRetryFailed = false;
   const piTransport = resolvePiTransport(options.piTransport);
 
-  const onEvent = (event) => emitCaptured(events, options.onEvent, event);
+  const onEvent = (event) => {
+    if (event?.type === "tool_approval_denied" && typeof event.toolUseId === "string") {
+      runState.toolApprovals.set(event.toolUseId, event);
+    }
+    emitCaptured(events, options.onEvent, event);
+  };
   const approvalRiskTiers = {
     ...(options.toolRiskTiers || {}),
     ...(

package/src/ai/runtime/capabilities.js

@@ -9,6 +9,7 @@ export const COMMON_CAPABILITIES = {
   supports_session_resume: false,
   native_runtime_config: null,
   supports_mcp: true,
+  supports_mcp_apps: false,
   supports_skills: true,
   supports_builtin_tools: true,
   supports_live_input: true,
@@ -36,6 +37,7 @@ export const RUNTIME_CAPABILITIES = {
     // tool, so advertise no support rather than letting callers expect it.
     supports_native_subagents: false,
     supports_request_tool_environment: true,
+    supports_mcp_apps: true,
   },
   codex: {
     runtime: "cli",