@namzu/sdk 27.1.0 → 28.0.0

package/src/runtime/query/executor.ts

@@ -1,13 +1,16 @@
 import type { Span } from '@opentelemetry/api'
 import { extractFromToolCall, extractFromToolResult } from '../../compaction/extractor.js'
 import type { WorkingStateManager } from '../../compaction/manager.js'
+import { GENAI, NAMZU } from '../../constants/telemetry/index.js'
 import type { PluginLifecycleManager } from '../../plugin/lifecycle.js'
 import { buildProbeContext } from '../../probe/context.js'
 import { ProbeVetoError } from '../../probe/errors.js'
-import { type ProbeRegistry, probe as defaultProbeRegistry } from '../../probe/registry.js'
+import { probe as defaultProbeRegistry } from '../../probe/registry.js'
+import type { ProbeEnforcement } from '../../probe/registry.js'
 import { renderToolSchema } from '../../registry/tool/schema.js'
 import type { ActivityStore } from '../../store/activity/memory.js'
 import { fingerprintContent } from '../../tools/builtins/content-fingerprint.js'
+import { SKILL_TOOL_NAME } from '../../tools/builtins/skill.js'
 import type { RunId, ToolUseId } from '../../types/ids/index.js'
 import type { InvocationState } from '../../types/invocation/index.js'
 import {
@@ -24,6 +27,7 @@ import type { Sandbox } from '../../types/sandbox/index.js'
 import type {
 	FileReadTracker,
 	RequestToolPause,
+	SkillRegistryRef,
 	ToolContext,
 	ToolRegistryContract,
 	ToolResult,
@@ -36,8 +40,10 @@ import type {
 import { abortReasonText } from '../../utils/abort.js'
 import { type BackoffPolicy, backoffWithJitter, sleep } from '../../utils/backoff.js'
 import { toErrorMessage } from '../../utils/error.js'
+import { generateToolCallId } from '../../utils/id.js'
 import type { Logger } from '../../utils/logger.js'
 import { compressShellOutput } from '../../utils/shell-compress.js'
+import { type BackgroundJobRegistry, bindOwner } from '../jobs/registry.js'
 import {
 	DEFAULT_MAX_TOOL_OUTPUT_CHARS,
 	applyToolOutputBudget,
@@ -114,11 +120,45 @@ export interface ToolExecutorConfig {
 	tools: ToolRegistryContract
 	runId: RunId
 	workingDirectory: string
-	permissionMode: PermissionMode
+	/**
+	 * Read LIVE, not frozen at run start.
+	 *
+	 * The mode used to be resolved once per run and copied in here, so
+	 * leaving plan mode meant ending the run — discarding the in-flight step
+	 * and the tool-schema context to change one enum. A function lets an
+	 * approval flip it inside the same conversation.
+	 *
+	 * Sampled ONCE per batch and held for it: a toggle landing between two
+	 * calls the model issued together would half-apply, and a batch where
+	 * the first write is refused and the second succeeds is not a state
+	 * anyone can reason about.
+	 */
+	permissionMode: PermissionMode | (() => PermissionMode)
 	env: Record<string, string>
 	abortSignal: AbortSignal
 	allowedTools?: readonly string[]
 	sandbox?: Sandbox
+	/**
+	 * Where background jobs this run starts are held.
+	 *
+	 * The registry is host-owned and shared; the executor binds it to THIS
+	 * run's id before a tool ever sees it, so a tool cannot start a job
+	 * billed to another run, nor read or kill one. Absent means the host
+	 * offers no background mode, and `bash run_in_background` refuses rather
+	 * than falling back to `cmd &` — see `runtime/jobs/registry.ts` for why
+	 * that fallback is a lie rather than a lesser version.
+	 */
+	backgroundJobs?: BackgroundJobRegistry
+
+	/**
+	 * Where the `skill` tool reads from.
+	 *
+	 * Structural (`SkillRegistryRef`) rather than `SkillRegistry`, because
+	 * this config is host-facing and a host may hold its skills anywhere.
+	 */
+	skills?: SkillRegistryRef
+	/** How this run reaches the web. See `ToolContext.web`. */
+	web?: ToolContext['web']
 	invocationState?: InvocationState
 	pluginManager?: PluginLifecycleManager
 	/** Run-level default deadline; per-tool `timeoutMs` overrides it. */
@@ -256,7 +296,7 @@ export class ToolExecutor {
 	private emitEvent: EmitEvent
 	private log: Logger
 	private workingStateManager?: WorkingStateManager
-	private probes: ProbeRegistry
+	private probes: ProbeEnforcement
 	private parentSpan?: Span
 	/** Set per turn by the orchestrator; see {@link setStepAllowedTools}. */
 	private stepAllowedTools?: readonly string[]
@@ -280,7 +320,7 @@ export class ToolExecutor {
 		activityStore: ActivityStore,
 		emitEvent: EmitEvent,
 		log: Logger,
-		probes: ProbeRegistry = defaultProbeRegistry,
+		probes: ProbeEnforcement = defaultProbeRegistry,
 	) {
 		this.config = config
 		this.activityStore = activityStore
@@ -336,6 +376,78 @@ export class ToolExecutor {
 	 * the universal contract across providers: an unanswered `tool_use`
 	 * is a protocol violation, not a decline.
 	 */
+	/**
+	 * The mode sampled for the batch currently running, if one is.
+	 *
+	 * Belt-and-braces, and worth saying so. The per-batch property is
+	 * ALREADY structural: `buildToolContext()` runs once per batch and every
+	 * per-call context spreads its result, so the mode is read once whether
+	 * or not this field exists — removing it is an equivalent mutation
+	 * today, measured.
+	 *
+	 * Kept because that guarantee is incidental to where the context happens
+	 * to be built. Moving `permissionContext` into the per-call spread is a
+	 * plausible refactor and would silently make the read per-call, which is
+	 * a batch where the first write is refused and the second succeeds.
+	 */
+	private batchMode?: PermissionMode
+
+	/**
+	 * The tool scope a loaded skill declared, and the batch it applies from.
+	 *
+	 * `allowed-tools` was parsed, stored and rendered into the prompt, and
+	 * read by nothing — advice phrased as a declaration. This is what makes
+	 * it a restriction, on the same line that already enforces the step's
+	 * list, because a narrowing the model can decline is not one.
+	 *
+	 * Two fields rather than one, and the second is the point: a skill
+	 * loaded MID-batch must not retroactively refuse the calls the model
+	 * issued alongside it. The model chose that batch under the old scope,
+	 * and refusing half of it teaches nothing except that tools fail at
+	 * random. `adoptedInBatch` is compared against the batch counter, so the
+	 * scope takes effect from the next one.
+	 *
+	 * **`adoptedInBatch` is redundant TODAY and kept deliberately**, the same
+	 * bargain `batchMode` above documents. `buildToolContext()` runs once per
+	 * batch, so every call in a batch already shares one `allowedTools` array
+	 * computed before any of them could adopt anything — remove this
+	 * comparison and no test changes, because the guarantee currently comes
+	 * from where the context happens to be built rather than from here.
+	 * Moving the context into the per-call spread is a plausible refactor,
+	 * and it would silently produce a batch whose second half is refused for
+	 * a scope its first half installed. That is precisely the incoherent
+	 * batch this line exists to make impossible.
+	 */
+	private skillScope?: { skill: string; allowedTools: readonly string[]; adoptedInBatch: number }
+	private batchCounter = 0
+
+	/**
+	 * The step's list, narrowed by any skill scope in force.
+	 *
+	 * An INTERSECTION, never a replacement: a skill cannot hand the model a
+	 * tool the step withheld. Widening has to be unexpressible rather than
+	 * discouraged — the same rule `CreateTaskOptions.toolScope` states for
+	 * delegation, and for the same reason: a skill file is content, and
+	 * content that can grant tools is a privilege-escalation surface wearing
+	 * the word "scope".
+	 *
+	 * The `skill` tool itself always survives. A skill that narrowed the
+	 * model out of reaching for another skill would be a one-way door, and
+	 * the tool reads instructions and changes nothing.
+	 */
+	private effectiveAllowedTools(): readonly string[] | undefined {
+		const base = this.stepAllowedTools ?? this.config.allowedTools
+		const scope = this.skillScope
+		if (!scope || scope.adoptedInBatch >= this.batchCounter) return base
+		const narrowed = new Set([...scope.allowedTools, SKILL_TOOL_NAME])
+		return base === undefined ? [...narrowed] : base.filter((name) => narrowed.has(name))
+	}
+
+	private resolvePermissionMode(): PermissionMode {
+		const configured = this.config.permissionMode
+		return typeof configured === 'function' ? configured() : configured
+	}
+
 	async executeBatch(
 		response: ChatCompletionResponse,
 		denials?: ToolCallDenials,
@@ -346,12 +458,31 @@ export class ToolExecutor {
 			return { messages: [], results: [] }
 		}
 
+		this.batchCounter += 1
+
+		// Sampled here, once, and held for every call below. See the note on
+		// `permissionMode` in the config type.
+		this.batchMode = this.resolvePermissionMode()
+		try {
+			return await this.runBatch(toolCalls, denials, prior)
+		} finally {
+			// Cleared so a later single execution outside a batch resolves
+			// live rather than inheriting the last batch's sample.
+			this.batchMode = undefined
+		}
+	}
+
+	private async runBatch(
+		toolCalls: readonly ToolCall[],
+		denials?: ToolCallDenials,
+		prior?: PriorToolResults,
+	): Promise<ToolExecutionBatch> {
 		this.log.debug('Executing tool batch', {
-			runId: this.config.runId,
-			toolCount: toolCalls.length,
-			deniedCount: denials?.size ?? 0,
-			recoveredCount: prior?.size ?? 0,
-			tools: toolCalls.map((tc) => tc.function.name),
+			[NAMZU.RUN_ID]: this.config.runId,
+			'namzu.runtime.tool_count': toolCalls.length,
+			'namzu.runtime.denied_count': denials?.size ?? 0,
+			'namzu.runtime.recovered_count': prior?.size ?? 0,
+			'namzu.tool.names': toolCalls.map((tc) => tc.function.name),
 		})
 
 		// One context per call so each execution can see its own
@@ -409,6 +540,11 @@ export class ToolExecutor {
 			const ctx: ToolContext = {
 				...baseContext,
 				toolUseId: toolCall.id,
+				// Overridden per call, so a nested dispatch can name the call
+				// that made it. The base context has no `toolUseId`, and a
+				// closure built there would report every nested call as
+				// parentless.
+				dispatchTool: (name, input) => this.dispatchNested(name, input, ctx),
 				// Per-call for the same reason: a pause has to be routed back
 				// to the call that raised it, and a batch can raise several.
 				...(this.config.toolPause ? { requestPause: this.config.toolPause(toolCall.id) } : {}),
@@ -480,15 +616,68 @@ export class ToolExecutor {
 		return { messages, results }
 	}
 
+	/**
+	 * Run a tool on behalf of another tool, and put it on the record.
+	 *
+	 * These used to go straight to `registry.execute`, so they reached the
+	 * permission gate and reached the event stream not at all — a run whose
+	 * transcript showed one `run_code` call and nothing about the eleven
+	 * writes it performed is a transcript nobody can audit.
+	 *
+	 * `via` names the dispatching call rather than merely marking this one
+	 * nested, and that is the load-bearing part: without it a consumer
+	 * counting tool calls double-counts the parent AND each child, and one
+	 * rendering a timeline draws eleven siblings where there is one call with
+	 * eleven children.
+	 */
+	private async dispatchNested(
+		name: string,
+		input: unknown,
+		context: ToolContext,
+	): Promise<ToolResult> {
+		const parent = context.toolUseId
+		const via = parent ? { tool: name, toolUseId: parent as ToolUseId } : undefined
+		// Its own id, minted here. Reusing the parent's would make two
+		// different calls indistinguishable in any log keyed by it, which is
+		// exactly how a nested write gets attributed to the program that ran
+		// it rather than to itself.
+		const nestedId = generateToolCallId() as unknown as ToolUseId
+		const startedAt = Date.now()
+
+		await this.emitEvent({
+			type: 'tool_executing',
+			runId: this.config.runId,
+			toolUseId: nestedId,
+			toolName: name,
+			input,
+			...(via ? { via } : {}),
+		})
+
+		const result = await this.config.tools.execute(name, input, context)
+
+		await this.emitEvent({
+			type: 'tool_completed',
+			runId: this.config.runId,
+			toolUseId: nestedId,
+			toolName: name,
+			result: result.success ? result.output : (result.error ?? 'failed'),
+			isError: !result.success,
+			durationMs: Date.now() - startedAt,
+			...(via ? { via } : {}),
+		})
+
+		return result
+	}
+
 	private buildToolContext(): ToolContext {
-		return {
+		const context: ToolContext = {
 			runId: this.config.runId,
 			workingDirectory: this.config.workingDirectory,
 			abortSignal: this.config.abortSignal,
 			env: this.config.env,
 			log: (level, message) => this.log[level](message),
 			permissionContext: {
-				mode: this.config.permissionMode,
+				mode: this.batchMode ?? this.resolvePermissionMode(),
 				runId: this.config.runId,
 				workingDirectory: this.config.workingDirectory,
 			},
@@ -497,11 +686,39 @@ export class ToolExecutor {
 			// The step's list wins where it has one; the run's is the default.
 			// Same precedence the request already uses when it decides which
 			// schemas to send, so the menu and the kitchen agree.
-			allowedTools: this.stepAllowedTools ?? this.config.allowedTools,
+			allowedTools: this.effectiveAllowedTools(),
+			// Recorded, not applied here: a skill loaded during this batch
+			// narrows the NEXT one. See `skillScope`.
+			adoptSkillScope: (scope) => {
+				this.skillScope = { ...scope, adoptedInBatch: this.batchCounter }
+			},
+			...(this.config.skills ? { skills: this.config.skills } : {}),
+			...(this.config.web ? { web: this.config.web } : {}),
+			// The SAME registry and the SAME context a model-issued call
+			// takes. Not a parallel path: a second dispatch is a second place
+			// for the permission gate to be forgotten, and the one that forgot
+			// it would be the one a model reached through a program.
+			// Bound to the BASE context, which has no `toolUseId` — a caller
+			// dispatching outside a batch has no parent call to name. The
+			// per-call context below overrides it with one that does; see
+			// `dispatchNested`.
+			dispatchTool: (name, input) => this.dispatchNested(name, input, context),
 			sandbox: this.config.sandbox,
 			fileReadTracker: this.fileReadTracker,
+			// Bound to this run, once. Binding here rather than passing the
+			// owner from the tool is what makes the scoping structural: there
+			// is no argument a tool could pass to reach another run's jobs.
+			...(this.config.backgroundJobs
+				? {
+						backgroundJobs: bindOwner(this.config.backgroundJobs, this.config.runId, {
+							workingDirectory: this.config.workingDirectory,
+							env: this.config.env,
+						}),
+					}
+				: {}),
 			...(this.parentSpan ? { parentSpan: this.parentSpan } : {}),
 		}
+		return context
 	}
 
 	private async executeSingle(
@@ -625,10 +842,10 @@ export class ToolExecutor {
 			const reason = vetoOutcome.reason ?? 'no reason provided'
 			const veto = new ProbeVetoError(probeName, reason, 'tool_executing')
 			this.log.warn('Tool call denied by probe', {
-				runId: this.config.runId,
-				tool: toolName,
-				probeName,
-				reason,
+				[NAMZU.RUN_ID]: this.config.runId,
+				[GENAI.TOOL_NAME]: toolName,
+				'namzu.runtime.probe_name': probeName,
+				'namzu.runtime.reason': reason,
 			})
 			if (activity) {
 				this.activityStore.fail(activity.id, veto.message)
@@ -725,13 +942,13 @@ export class ToolExecutor {
 			const delayMs = backoffWithJitter(attempt - 1, backoff)
 
 			this.log.info('Retrying a failed tool call', {
-				runId: this.config.runId,
-				tool: toolName,
-				attempt,
-				budget,
-				requestedByHook: post.retry,
-				delayMs,
-				error: result.error,
+				[NAMZU.RUN_ID]: this.config.runId,
+				[GENAI.TOOL_NAME]: toolName,
+				'namzu.retry.attempt': attempt,
+				'namzu.runtime.budget': budget,
+				'namzu.runtime.requested_by_hook': post.retry,
+				'namzu.runtime.delay_ms': delayMs,
+				'exception.message': result.error,
 			})
 
 			try {
@@ -768,17 +985,17 @@ export class ToolExecutor {
 			spillDir: this.config.toolOutputDir,
 			onError: (message) =>
 				this.log.warn('Failed to spill oversized tool output', {
-					runId: this.config.runId,
-					tool: toolName,
-					error: message,
+					[NAMZU.RUN_ID]: this.config.runId,
+					[GENAI.TOOL_NAME]: toolName,
+					'exception.message': message,
 				}),
 		})
 		if (budgeted.truncated) {
 			this.log.warn('Tool output exceeded the model-visible budget', {
-				runId: this.config.runId,
-				tool: toolName,
-				originalLength: budgeted.originalLength,
-				spillPath: budgeted.spillPath,
+				[NAMZU.RUN_ID]: this.config.runId,
+				[GENAI.TOOL_NAME]: toolName,
+				'namzu.runtime.original_length': budgeted.originalLength,
+				'namzu.runtime.spill_path': budgeted.spillPath,
 			})
 		}
 		output = budgeted.output
@@ -811,17 +1028,17 @@ export class ToolExecutor {
 
 		if (result.success) {
 			this.log.debug('Tool executed successfully', {
-				runId: this.config.runId,
-				tool: toolName,
-				durationMs,
-				outputLength: output.length,
+				[NAMZU.RUN_ID]: this.config.runId,
+				[GENAI.TOOL_NAME]: toolName,
+				'namzu.duration_ms': durationMs,
+				'namzu.runtime.output_length': output.length,
 			})
 		} else {
 			this.log.warn('Tool execution failed', {
-				runId: this.config.runId,
-				tool: toolName,
-				durationMs,
-				error: result.error ?? 'unknown',
+				[NAMZU.RUN_ID]: this.config.runId,
+				[GENAI.TOOL_NAME]: toolName,
+				'namzu.duration_ms': durationMs,
+				'exception.message': result.error ?? 'unknown',
 			})
 		}
 
@@ -954,9 +1171,9 @@ export class ToolExecutor {
 
 			if (outcome === 'timeout') {
 				this.log.warn('Tool timed out', {
-					runId: this.config.runId,
-					tool: toolName,
-					timeoutMs,
+					[NAMZU.RUN_ID]: this.config.runId,
+					[GENAI.TOOL_NAME]: toolName,
+					'namzu.runtime.timeout_ms': timeoutMs,
 				})
 				return {
 					success: false,
@@ -1084,10 +1301,12 @@ export class ToolExecutor {
 			}
 
 			this.log.info('Repaired a malformed tool call', {
-				runId: this.config.runId,
-				tool: toolName,
-				reason: failure.reason,
-				...(repair.toolName && repair.toolName !== toolName ? { repairedTo: repair.toolName } : {}),
+				[NAMZU.RUN_ID]: this.config.runId,
+				[GENAI.TOOL_NAME]: toolName,
+				'namzu.runtime.reason': failure.reason,
+				...(repair.toolName && repair.toolName !== toolName
+					? { 'namzu.runtime.repaired_to': repair.toolName }
+					: {}),
 			})
 			toolName = repair.toolName ?? toolName
 			raw = repair.arguments
@@ -1117,9 +1336,9 @@ export class ToolExecutor {
 		)
 		if (repair) {
 			this.log.info('Repaired a tool call whose input stream was truncated', {
-				runId: this.config.runId,
-				tool: toolName,
-				partialLength: partial.length,
+				[NAMZU.RUN_ID]: this.config.runId,
+				[GENAI.TOOL_NAME]: toolName,
+				'namzu.runtime.partial_length': partial.length,
 			})
 		}
 		return repair
@@ -1185,9 +1404,9 @@ export class ToolExecutor {
 			// failed run: the original error is still a perfectly good answer
 			// to give the model.
 			this.log.error('repairToolCall threw — falling back to the original error', {
-				runId: this.config.runId,
-				tool: toolName,
-				error: toErrorMessage(err),
+				[NAMZU.RUN_ID]: this.config.runId,
+				[GENAI.TOOL_NAME]: toolName,
+				'exception.message': toErrorMessage(err),
 			})
 			return null
 		}
@@ -1215,9 +1434,9 @@ export class ToolExecutor {
 		} catch (err) {
 			const message = toErrorMessage(err)
 			this.log.warn('Tool execution threw', {
-				runId: this.config.runId,
-				tool: toolName,
-				error: message,
+				[NAMZU.RUN_ID]: this.config.runId,
+				[GENAI.TOOL_NAME]: toolName,
+				'exception.message': message,
 			})
 			return { success: false, output: '', error: message }
 		}
@@ -1298,10 +1517,10 @@ export class ToolExecutor {
 		const output = deniedToolOutput(toolName, reason)
 
 		this.log.info('Tool call denied — synthesizing tool_result', {
-			runId: this.config.runId,
-			tool: toolName,
-			toolUseId: toolCall.id,
-			reason,
+			[NAMZU.RUN_ID]: this.config.runId,
+			[GENAI.TOOL_NAME]: toolName,
+			'namzu.runtime.tool_use_id': toolCall.id,
+			'namzu.runtime.reason': reason,
 		})
 
 		const activity = this.activityStore.create({
@@ -1396,10 +1615,10 @@ export class ToolExecutor {
 		if (size <= cap) return content
 
 		this.log.warn('Tool result content exceeded the rich-content budget', {
-			runId: this.config.runId,
-			tool: toolName,
-			contentBytes: size,
-			cap,
+			[NAMZU.RUN_ID]: this.config.runId,
+			[GENAI.TOOL_NAME]: toolName,
+			'namzu.runtime.content_bytes': size,
+			'namzu.runtime.cap': cap,
 		})
 
 		const described = describeDroppedContent(content)
@@ -1422,10 +1641,12 @@ export class ToolExecutor {
 		const compressed = compressShellOutput(output)
 		if (compressed.length < output.length) {
 			this.log.debug('Shell output compressed', {
-				tool: toolName,
-				originalLength: output.length,
-				compressedLength: compressed.length,
-				reductionPercent: Math.round((1 - compressed.length / output.length) * 100),
+				[GENAI.TOOL_NAME]: toolName,
+				'namzu.runtime.original_length': output.length,
+				'namzu.runtime.compressed_length': compressed.length,
+				'namzu.runtime.reduction_percent': Math.round(
+					(1 - compressed.length / output.length) * 100,
+				),
 			})
 		}
 		return compressed

package/src/runtime/query/guardrail-presets.ts

@@ -1,3 +1,4 @@
+import { OUTPUT_SECRET_PATTERNS } from '../../constants/secret-patterns.js'
 import type {
 	GuardrailVerdict,
 	NamedGuardrail,
@@ -9,21 +10,17 @@ import type {
 /**
  * Patterns for credentials that must never leave a run.
  *
- * Deliberately narrow and prefix-anchored. A loose "looks like a secret"
- * regex over agent output produces false positives on ordinary code, and a
- * redactor that fires on the wrong thing gets switched off — at which
- * point it protects nothing.
+ * Deliberately narrow and prefix-anchored, unchanged by the move to
+ * `constants/secret-patterns.ts`: a loose "looks like a secret" regex over
+ * agent output produces false positives on ordinary code, and a redactor
+ * that fires on the wrong thing gets switched off — at which point it
+ * protects nothing. The wider, field-name-aware set `provider/errors.ts`
+ * needs lives in the same leaf module as `LOG_SECRET_PATTERNS`; it is not
+ * used here because a false positive on THIS boundary rewrites the
+ * caller's answer, and a false positive there only costs a redacted log
+ * value.
  */
-const SECRET_PATTERNS: ReadonlyArray<readonly [label: string, pattern: RegExp]> = [
-	['aws-access-key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g],
-	['github-token', /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g],
-	['openai-key', /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g],
-	['anthropic-key', /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g],
-	['slack-token', /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g],
-	['google-api-key', /\bAIza[0-9A-Za-z_-]{35}\b/g],
-	['private-key-block', /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/g],
-	['jwt', /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g],
-]
+const SECRET_PATTERNS = OUTPUT_SECRET_PATTERNS
 
 export interface SecretRedactionOptions {
 	/**

package/src/runtime/query/guardrails.ts

@@ -1,3 +1,4 @@
+import { NAMZU } from '../../constants/telemetry/index.js'
 import type {
 	GuardrailVerdict,
 	InputGuardrailContext,
@@ -46,9 +47,9 @@ export async function runInputGuardrails(
 		const verdict = await safely(() => check(ctx), nameOf({ name }, index), log)
 		if (verdict.action === 'block') {
 			log.warn('Input guardrail blocked the run', {
-				runId: ctx.runId,
-				guardrail: nameOf({ name }, index),
-				reason: verdict.reason,
+				[NAMZU.RUN_ID]: ctx.runId,
+				'namzu.guardrail.name': nameOf({ name }, index),
+				'namzu.runtime.reason': verdict.reason,
 			})
 			return { blocked: true, name: nameOf({ name }, index), reason: verdict.reason }
 		}
@@ -57,8 +58,8 @@ export async function runInputGuardrails(
 		// different (and worse) feature than refusing it.
 		if (verdict.action === 'rewrite') {
 			log.warn('Input guardrail returned `rewrite`, which is not supported on input — ignoring', {
-				runId: ctx.runId,
-				guardrail: nameOf({ name }, index),
+				[NAMZU.RUN_ID]: ctx.runId,
+				'namzu.guardrail.name': nameOf({ name }, index),
 			})
 		}
 	}
@@ -99,18 +100,18 @@ export async function runOutputGuardrails(
 
 		if (verdict.action === 'block') {
 			log.warn('Output guardrail blocked the result', {
-				runId: ctx.runId,
-				guardrail: nameOf({ name }, index),
-				reason: verdict.reason,
+				[NAMZU.RUN_ID]: ctx.runId,
+				'namzu.guardrail.name': nameOf({ name }, index),
+				'namzu.runtime.reason': verdict.reason,
 			})
 			return { blocked: true, name: nameOf({ name }, index), reason: verdict.reason }
 		}
 
 		if (verdict.action === 'rewrite') {
 			log.info('Output guardrail rewrote the result', {
-				runId: ctx.runId,
-				guardrail: nameOf({ name }, index),
-				reason: verdict.reason,
+				[NAMZU.RUN_ID]: ctx.runId,
+				'namzu.guardrail.name': nameOf({ name }, index),
+				'namzu.runtime.reason': verdict.reason,
 			})
 			current = verdict.output
 			rewritten = true
@@ -138,7 +139,10 @@ async function safely(
 		return await run()
 	} catch (err) {
 		const reason = `guardrail "${name}" threw: ${toErrorMessage(err)}`
-		log.error('Guardrail threw — failing closed', { guardrail: name, error: toErrorMessage(err) })
+		log.error('Guardrail threw — failing closed', {
+			'namzu.guardrail.name': name,
+			'exception.message': toErrorMessage(err),
+		})
 		return { action: 'block', reason }
 	}
 }