@namzu/sdk 49.0.0 → 50.1.0

package/dist/runtime/query/executor.js

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 import { unknownProgramInLine } from '../../authorization/program.js';
 import { compileSkillGrant } from '../../authorization/skill-grant.js';
@@ -17,11 +18,13 @@ import { backoffWithJitter, sleep } from '../../utils/backoff.js';
 import { toErrorMessage } from '../../utils/error.js';
 import { generateToolCallId } from '../../utils/id.js';
 import { compressShellOutput } from '../../utils/shell-compress.js';
+import { parseStructuredResultJson } from '../../utils/structured-result-json.js';
 import { bindOwner } from '../jobs/registry.js';
-import { formatFailedToolOutput, isUnregistered, prepareDirectCall, repairTruncatedCall, resolveCall, runPreToolHook, unknownToolMessage, unreadableToolCallMessage, } from './executor/tool-call-admission.js';
+import { formatFailedToolOutput, isUnregistered, prepareDirectCall, runPreToolHook, unknownToolMessage, } from './executor/tool-call-admission.js';
 import { describeVisibleFileEvidence } from './file-evidence-context.js';
 import { seedObservationLedger } from './file-evidence-seed.js';
 import { DEFAULT_TOOL_RESULT_GUARDRAILS } from './guardrail-presets.js';
+import { savedPresentation } from './saved-presentation.js';
 import { ToolCallBudget, assertMaxToolCalls } from './tool-call-budget.js';
 import { DEFAULT_MAX_TOOL_OUTPUT_CHARS, applyToolOutputBudget, describeDroppedContent, measureContentBytes, } from './tool-output-budget.js';
 function assertUniqueToolCallIds(toolCalls) {
@@ -175,6 +178,8 @@ export const DEFAULT_TOOL_RETRY_BACKOFF = {
     initialDelayMs: 500,
     maxDelayMs: 16_000,
 };
+/** A person's note is kept whole up to this many characters. */
+export const DECLINED_NOTE_MAX_CHARS = 4_000;
 /**
  * Model-visible text for a tool call that was never executed.
  *
@@ -184,6 +189,20 @@ export const DEFAULT_TOOL_RETRY_BACKOFF = {
  * the reason here is also what makes rejection *steer* — the model reads
  * it in the slot it already attends to for tool outcomes.
  */
+/**
+ * The kind of refusal a call met, for the person's view. A command that asks
+ * for administrator rights is named as that; everything else is a plain block.
+ * Read from the call's own argument, never from the refusal's wording.
+ */
+function refusalFacts(toolName, input) {
+    const command = input && typeof input === 'object' ? input.command : undefined;
+    const elevated = typeof command === 'string' && /(^|[\s;&|(])(sudo|doas)\b/.test(command);
+    return {
+        kind: 'failure',
+        reason: elevated ? 'needs_administrator' : 'blocked',
+        subject: toolName,
+    };
+}
 export function deniedToolOutput(toolName, reason) {
     return `Error: Tool "${toolName}" was not executed. ${reason}`;
 }
@@ -202,6 +221,8 @@ export class ToolExecutor {
     parentSpan;
     toolCallBudget;
     preparedBatches = new WeakSet();
+    /** Ephemeral proof of actual execution; restored messages do not acquire it. */
+    recordedObservations = new Map();
     /** Set per turn by the orchestrator; see {@link setStepAllowedTools}. */
     stepAllowedTools;
     fileReadTracker;
@@ -225,6 +246,43 @@ export class ToolExecutor {
     setSandbox(sandbox) {
         this.config = { ...this.config, sandbox };
     }
+    /** Classify only the exact successful result executed by this executor. */
+    recordedObservationKey(call, message) {
+        const recorded = this.recordedObservations.get(call.id);
+        return recorded !== undefined &&
+            message.toolCallId === call.id &&
+            !message.isError &&
+            typeof message.content === 'string' &&
+            this.config.tools.get(recorded.toolName) === recorded.definition &&
+            recorded.fingerprint === this.observationFingerprint(call, message.content)
+            ? recorded.inputFingerprint
+            : undefined;
+    }
+    observationFingerprint(call, content) {
+        return createHash('sha256')
+            .update(JSON.stringify([call.function.name, call.function.arguments, content]))
+            .digest('hex');
+    }
+    recordExecutedObservation(call, toolName, definition, input, content) {
+        if (typeof content !== 'string' || this.config.tools.get(toolName) !== definition)
+            return;
+        try {
+            if (definition.isReadOnly?.(input) !== true || definition.isDestructive?.(input) === true)
+                return;
+            this.recordedObservations.set(call.id, {
+                toolName,
+                definition,
+                fingerprint: this.observationFingerprint(call, content),
+                inputFingerprint: createHash('sha256')
+                    .update(JSON.stringify([toolName, input]))
+                    .digest('hex'),
+            });
+        }
+        catch {
+            // Classification is advisory. A broken predicate preserves the
+            // full evidence instead of failing an already completed call.
+        }
+    }
     /**
      * Rebuild this turn's observation ledger from history a resume restored.
      *
@@ -440,17 +498,18 @@ export class ToolExecutor {
      * The returned projection is what policy and a human review; execution later
      * consumes the registry-owned preparations rather than parsing again.
      */
-    async prepareBatchForReview(response) {
+    async prepareBatchForReview(response, hostModifiedCallIds) {
         assertUniqueToolCallIds(response.message.toolCalls ?? []);
         const calls = new Map();
         const escalations = new Map();
         for (const toolCall of response.message.toolCalls ?? []) {
-            const call = await prepareDirectCall(this.admissionHost(), toolCall);
+            const call = await prepareDirectCall(this.admissionHost(), toolCall, !hostModifiedCallIds?.has(toolCall.id));
             calls.set(toolCall.id, call);
             const escalation = await this.escalationOf(call);
             if (escalation)
                 escalations.set(toolCall.id, escalation);
         }
+        this.config.abortSignal.throwIfAborted();
         return this.publishPreparedBatch(calls, escalations);
     }
     /**
@@ -526,7 +585,7 @@ export class ToolExecutor {
         const escalations = new Map(previous.escalations);
         for (const toolCall of response.message.toolCalls ?? []) {
             if (changedCallIds.has(toolCall.id)) {
-                const call = await prepareDirectCall(this.admissionHost(), toolCall);
+                const call = await prepareDirectCall(this.admissionHost(), toolCall, false);
                 calls.set(toolCall.id, call);
                 const escalation = await this.escalationOf(call);
                 if (escalation)
@@ -535,6 +594,7 @@ export class ToolExecutor {
                     escalations.delete(toolCall.id);
             }
         }
+        this.config.abortSignal.throwIfAborted();
         return this.publishPreparedBatch(calls, escalations);
     }
     publishPreparedBatch(calls, escalations) {
@@ -557,7 +617,7 @@ export class ToolExecutor {
         this.preparedBatches.add(batch);
         return batch;
     }
-    async executeBatch(response, denials, prior, preparedBatch) {
+    async executeBatch(response, denials, prior, preparedBatch, declines) {
         const toolCalls = response.message.toolCalls;
         if (!toolCalls) {
             return { messages: [], results: [], observations: [] };
@@ -579,9 +639,9 @@ export class ToolExecutor {
                 for (const call of toolCalls)
                     if (!refused.has(call.id))
                         refused.set(call.id, refusal);
-                return await this.runBatch(toolCalls, refused, prior, owned);
+                return await this.runBatch(toolCalls, refused, prior, owned, declines);
             }
-            return await this.runBatch(toolCalls, denials, prior, owned);
+            return await this.runBatch(toolCalls, denials, prior, owned, declines);
         }
         finally {
             // Cleared so a later single execution outside a batch resolves
@@ -589,7 +649,7 @@ export class ToolExecutor {
             this.batchMode = undefined;
         }
     }
-    async runBatch(toolCalls, denials, prior, preparedBatch) {
+    async runBatch(toolCalls, denials, prior, preparedBatch, declines) {
         this.log.debug('Executing tool batch', {
             [NAMZU.TURN_ID]: this.config.turnId,
             'namzu.runtime.tool_count': toolCalls.length,
@@ -600,6 +660,8 @@ export class ToolExecutor {
         // One context per call so each execution can see its own
         // `toolUseId`. The base context is built once; we spread + add
         // per-call to keep allocations cheap.
+        for (const call of toolCalls)
+            this.recordedObservations.delete(call.id);
         const observations = [];
         const recordObservation = (observation) => {
             observations.push(observation);
@@ -664,6 +726,11 @@ export class ToolExecutor {
                     toolName: toolCall.function.name,
                     output: recovered.result,
                     isError: recovered.isError,
+                    ...(recovered.inputFailure ? { inputFailure: recovered.inputFailure } : {}),
+                    ...(recovered.skipped ? { skipped: true } : {}),
+                    ...(recovered.structuredResultJson !== undefined
+                        ? { structuredResultJson: recovered.structuredResultJson }
+                        : {}),
                 };
                 if (isBarrier)
                     schedule(async () => { }, true, true);
@@ -675,7 +742,7 @@ export class ToolExecutor {
                 // message so the assistant turn stays fully answered. They can
                 // overlap other calls within a segment, respecting its barriers.
                 schedule(async () => {
-                    results[i] = await this.recordDenial(toolCall, denialReason, preparedCall);
+                    results[i] = await this.recordDenial(toolCall, denialReason, preparedCall, declines?.get(toolCall.id));
                 }, true, isBarrier);
                 return;
             }
@@ -850,6 +917,7 @@ export class ToolExecutor {
                 toolName: name,
                 result: preparedCall.message,
                 isError: preparedCall.isError,
+                ...(preparedCall.skipped ? { skipped: true } : {}),
                 durationMs: Date.now() - startedAt,
                 outputLength: preparedCall.message.length,
                 ...(via ? { via } : {}),
@@ -865,10 +933,24 @@ export class ToolExecutor {
             commandDialect: this.commandDialect(name),
             toolSource: this.toolSource(name),
         });
-        if (gateResult && gateResult.decision !== 'allow') {
-            const reason = gateResult.decision === 'deny'
-                ? `Blocked by the authorization gate: ${gateResult.reason}`
-                : `Blocked by the authorization gate: this nested call requires an explicit allow rule because an operator review cannot be opened from inside another tool. ${gateResult.reason}`;
+        // A tool that declares `requiresApproval` for this input needs a person's
+        // yes for every call, and no rule outranks that. An operator review cannot
+        // be opened from inside another tool, so a nested call to it is refused
+        // even when a rule allows it (the direct path turns that allow into a review).
+        const nestedTool = this.config.tools.get(name);
+        let needsApproval = false;
+        try {
+            needsApproval = nestedTool?.requiresApproval?.(preparedInput) === true;
+        }
+        catch {
+            needsApproval = true;
+        }
+        if (needsApproval || (gateResult && gateResult.decision !== 'allow')) {
+            const reason = needsApproval
+                ? `Blocked: "${name}" requires the person's approval for every call, and an approval cannot be requested from inside another tool. Call it directly.`
+                : gateResult?.decision === 'deny'
+                    ? `Blocked by the authorization gate: ${gateResult.reason}`
+                    : `Blocked by the authorization gate: this nested call requires an explicit allow rule because an operator review cannot be opened from inside another tool. ${gateResult?.reason}`;
             const output = deniedToolOutput(name, reason);
             // Same fail-closed durability rule as a direct gate denial: if the
             // configured session log cannot record the refusal, do not quietly carry
@@ -1004,7 +1086,8 @@ export class ToolExecutor {
             toolUseId: nestedId,
             toolName: name,
             result: budgeted.output,
-            ...(!budgeted.truncated ? this.resultPresentation(name, preparedInput, result) : {}),
+            ...this.resultPresentation(name, preparedInput, result, budgeted.truncated),
+            ...(result.facts !== undefined ? { facts: result.facts } : {}),
             isError: !result.success,
             durationMs: Date.now() - startedAt,
             outputLength: budgeted.originalLength,
@@ -1024,25 +1107,30 @@ export class ToolExecutor {
         });
         return visibleResult;
     }
-    resultPresentation(name, input, result) {
+    resultPresentation(name, input, result, savedOnly = false) {
         try {
             const view = this.config.tools.get(name)?.presentResult?.(input, result);
             // A failed call carries one view only: the person's No on the tool's
             // own screen, which a host draws as cancelled rather than failed and
             // cannot tell apart from the result text alone.
             if (!result.success) {
-                return view?.kind === 'generic' && view.outcome === 'cancelled'
-                    ? {
+                if (!savedOnly && view?.kind === 'generic' && view.outcome === 'cancelled')
+                    return {
                         presentation: {
                             kind: 'generic',
                             label: view.label,
                             outcome: 'cancelled',
                         },
-                    }
-                    : {};
+                    };
+                const saved = savedPresentation(input, this.config.tools.get(name)?.presentCall?.(input), undefined);
+                return saved ? { savedPresentation: saved } : {};
+            }
+            if (savedOnly || view?.kind !== 'diff') {
+                // Journal-only: the live event keeps drawing the real result.
+                const tool = this.config.tools.get(name);
+                const saved = savedPresentation(input, tool?.presentCall?.(input), view);
+                return saved ? { savedPresentation: saved } : {};
             }
-            if (view?.kind !== 'diff')
-                return {};
             const serialized = JSON.stringify(view);
             if (serialized.length > (this.config.maxToolOutputChars ?? DEFAULT_MAX_TOOL_OUTPUT_CHARS))
                 return {};
@@ -1147,104 +1235,38 @@ export class ToolExecutor {
         let toolName = preparedCall?.toolName ?? toolCall.function.name;
         let input;
         let prepared;
+        let inputFailure;
         if (preparedCall?.kind === 'ready' || preparedCall?.kind === 'legacy') {
             input = preparedCall.input;
             prepared = preparedCall.kind === 'ready' ? preparedCall.prepared : undefined;
+            if (preparedCall.kind === 'legacy')
+                inputFailure = preparedCall.inputFailure;
         }
         else {
-            // A stream that cut off mid-JSON is the case `repairToolCall` exists
-            // for, and it used to be the one case that never reached it: this
-            // branch returned before `resolveCall` ran, so the motivating failure
-            // was answered with a generic hint while the configured repairer sat
-            // unused. Offer it the partial buffer first.
-            const truncationRepair = toolCall.metadata?.inputTruncated === true
-                ? await repairTruncatedCall(this.admissionHost(), toolCall, toolName)
-                : null;
-            if (toolCall.metadata?.inputTruncated === true && !truncationRepair) {
-                const message = unreadableToolCallMessage(this.admissionHost(), toolCall, toolName);
-                await this.emitEvent({
-                    type: 'tool_executing',
-                    turnId: this.config.turnId,
-                    toolUseId: toolCall.id,
-                    toolName,
-                    input: {},
-                });
-                await this.emitEvent({
-                    type: 'tool_completed',
-                    turnId: this.config.turnId,
-                    toolUseId: toolCall.id,
-                    toolName,
-                    result: message,
-                    isError: true,
-                });
-                return {
-                    toolCallId: toolCall.id,
-                    toolName,
-                    output: message,
-                    isError: true,
-                };
-            }
-            // A malformed call used to cost a full model round trip to fix: the
-            // error went back as a `tool_result`, the model re-read the whole
-            // context and tried again. A host that can repair it locally turns
-            // that into nothing. No-op when no repairer is configured.
-            const resolved = await resolveCall(this.admissionHost(), truncationRepair
-                ? {
-                    ...toolCall,
-                    function: {
-                        ...toolCall.function,
-                        name: truncationRepair.toolName ?? toolName,
-                        arguments: truncationRepair.arguments,
-                    },
-                    metadata: {},
-                }
-                : toolCall);
-            toolName = resolved.toolName;
-            if (!resolved.ok) {
-                // malformed JSON args used to return without ever
-                // emitting tool_executing or tool_completed, leaving UI cards
-                // orphaned in `streaming_input`. Emit the executing→completed
-                // terminal pair so the card lifecycle closes.
-                const message = resolved.message;
-                await this.emitEvent({
-                    type: 'tool_executing',
-                    turnId: this.config.turnId,
-                    toolUseId: toolCall.id,
-                    toolName,
-                    input: {},
-                });
-                await this.emitEvent({
-                    type: 'tool_completed',
-                    turnId: this.config.turnId,
-                    toolUseId: toolCall.id,
-                    toolName,
-                    result: message,
-                    isError: true,
-                });
-                return {
-                    toolCallId: toolCall.id,
-                    toolName,
-                    output: message,
-                    isError: true,
-                };
-            }
-            input = resolved.input;
-            let preOutcome;
+            // The unreviewed executor path uses the same preparation as a
+            // reviewed call. Parsing here and again in the registry would run
+            // transforms twice and reject asynchronous schemas.
+            let admitted;
             try {
-                preOutcome = await runPreToolHook(this.admissionHost(), toolName, input);
+                admitted = await prepareDirectCall(this.admissionHost(), toolCall);
+                this.config.abortSignal.throwIfAborted();
             }
             catch (error) {
                 if (!this.config.abortSignal.aborted)
                     throw error;
-                // A later call's interrupted preparation must not reject the batch
-                // that already holds an earlier call's settled side-effect receipt.
-                return this.recordCancelledBeforeExecution(toolCall.id, toolName, input);
-            }
-            if (preOutcome.kind === 'skip' || preOutcome.kind === 'error') {
-                return this.recordSyntheticHookOutcome(toolCall.id, toolName, preOutcome.input, preOutcome);
+                // Keep earlier settled siblings' receipts when a later
+                // preparation is interrupted.
+                return this.recordCancelledBeforeExecution(toolCall.id, toolName, {});
             }
-            input = preOutcome.input;
+            if (admitted.kind === 'synthetic')
+                return this.recordSyntheticPreparation(admitted);
+            toolName = admitted.toolName;
+            input = admitted.input;
+            prepared = admitted.kind === 'ready' ? admitted.prepared : undefined;
+            if (admitted.kind === 'legacy')
+                inputFailure = admitted.inputFailure;
         }
+        const executedDefinition = this.config.tools.get(toolName);
         const activity = this.activityStore.create({
             type: 'tool_call',
             description: toolName,
@@ -1440,6 +1462,27 @@ export class ToolExecutor {
         }
         const maxToolOutputChars = this.config.maxToolOutputChars ?? DEFAULT_MAX_TOOL_OUTPUT_CHARS;
         const sourceOutput = output;
+        // This owner-bound channel follows the selected receipt after both result
+        // screening and post-tool replacement. ToolResult.data and raw input can
+        // still carry pre-redaction values and must never be promoted here.
+        let structuredResultJson;
+        if (prepared &&
+            executedDefinition !== undefined &&
+            executedDefinition === this.config.durableStructuredOutputTool &&
+            toolName === 'structured_output' &&
+            toolCall.function.name === 'structured_output' &&
+            result.success &&
+            !postOverride?.isError &&
+            !this.config.abortSignal.aborted) {
+            try {
+                parseStructuredResultJson(sourceOutput);
+                structuredResultJson = sourceOutput;
+            }
+            catch {
+                // Keep the completion receipt: malformed host output fails at the
+                // normal candidate-integrity boundary, never as a schema correction.
+            }
+        }
         // Compression is opportunistic and shell-only; the budget is the
         // hard bound that applies to every final tool result, including a
         // post-tool hook's replacement and the rich-content omission notice.
@@ -1479,6 +1522,9 @@ export class ToolExecutor {
         // unusable: the model was told a successful call had gone wrong, and
         // routed around it.
         const effectiveIsError = !result.success || (postOverride?.isError ?? false);
+        const visibleInputFailure = !result.success && !postOverride && !this.config.abortSignal.aborted
+            ? inputFailure
+            : undefined;
         if (this.workingStateManager) {
             extractFromToolResult(this.workingStateManager, toolName, output, effectiveIsError);
             for (const pin of this.config.abortSignal.aborted ? [] : (result.workingState ?? [])) {
@@ -1534,16 +1580,23 @@ export class ToolExecutor {
         // call it has already removed. Detached work reporting after a timeout is
         // ignored because close() also revokes the publisher.
         await settleProgress();
+        if (this.config.abortSignal.aborted)
+            structuredResultJson = undefined;
         await this.emitEvent({
             type: 'tool_completed',
             turnId: this.config.turnId,
             toolUseId: toolCall.id,
             toolName,
             result: output,
-            ...(!postOverride && !budgeted.truncated && rawOutput === output
-                ? this.resultPresentation(toolName, input, result)
-                : {}),
+            // The result view only describes an output the host will show as is; the
+            // saved label never depended on the output, so it is kept regardless.
+            ...this.resultPresentation(toolName, input, result, Boolean(postOverride) || budgeted.truncated || rawOutput !== output),
+            // Typed fields for the person's view. A replaced output is a redaction
+            // the host chose, and a structured copy of the original would undo it.
+            ...(result.facts !== undefined && !postOverride ? { facts: result.facts } : {}),
             isError: effectiveIsError,
+            ...(visibleInputFailure ? { inputFailure: visibleInputFailure } : {}),
+            ...(structuredResultJson !== undefined ? { structuredResultJson } : {}),
             durationMs,
             // Pre-truncation size, so a host can show "returned 2.1 MB" even
             // though the model only ever saw a preview.
@@ -1560,11 +1613,16 @@ export class ToolExecutor {
             input,
             result,
         });
+        if (prepared && executedDefinition && !effectiveIsError && !this.config.abortSignal.aborted) {
+            this.recordExecutedObservation(toolCall, toolName, executedDefinition, input, modelContent ?? output);
+        }
         return {
             toolCallId: toolCall.id,
             toolName,
             output,
             isError: effectiveIsError,
+            ...(visibleInputFailure ? { inputFailure: visibleInputFailure } : {}),
+            ...(structuredResultJson !== undefined ? { structuredResultJson } : {}),
             // Rich content follows the override's own decision.
             //
             // An ERROR override drops it: the payload is no longer the tool's,
@@ -1765,7 +1823,8 @@ export class ToolExecutor {
         };
     }
     async prepareNestedCall(toolName, input, signal) {
-        const prepare = this.config.tools.prepareExecution;
+        signal.throwIfAborted();
+        const prepare = this.config.tools.prepareExecutionAsync ?? this.config.tools.prepareExecution;
         const executePrepared = this.config.tools.executePrepared;
         if (typeof prepare !== 'function' || typeof executePrepared !== 'function') {
             if (this.config.authorizationGate) {
@@ -1783,15 +1842,18 @@ export class ToolExecutor {
                     input: preOutcome.input,
                     message: preOutcome.output,
                     isError: preOutcome.kind === 'error',
+                    ...(preOutcome.kind === 'skip' ? { skipped: true } : {}),
                 };
             }
             return { kind: 'legacy', input: preOutcome.input };
         }
         let preparation;
         try {
-            preparation = prepare.call(this.config.tools, toolName, input);
+            preparation = await prepare.call(this.config.tools, toolName, input, signal);
+            signal.throwIfAborted();
         }
         catch (err) {
+            signal.throwIfAborted();
             // A name the registry does not hold is answered with what this step
             // can call, as a model's own call is; the registry's "Not found"
             // lists everything it holds.
@@ -1820,6 +1882,7 @@ export class ToolExecutor {
                 input: preOutcome.input,
                 message: preOutcome.output,
                 isError: preOutcome.kind === 'error',
+                ...(preOutcome.kind === 'skip' ? { skipped: true } : {}),
             };
         }
         if (!preOutcome.modified) {
@@ -1829,7 +1892,8 @@ export class ToolExecutor {
                 prepared: preparation.prepared,
             };
         }
-        const modified = prepare.call(this.config.tools, toolName, preOutcome.input);
+        const modified = await prepare.call(this.config.tools, toolName, preOutcome.input, signal);
+        signal.throwIfAborted();
         if (!modified.success) {
             return {
                 kind: 'synthetic',
@@ -1949,7 +2013,7 @@ export class ToolExecutor {
      * execution so UI cards reach a terminal state instead of hanging in
      * `executing`, and records a failed activity for the trace.
      */
-    async recordDenial(toolCall, reason, preparedCall) {
+    async recordDenial(toolCall, reason, preparedCall, declined) {
         const toolName = preparedCall?.toolName ?? toolCall.function.name;
         let input = preparedCall?.input ?? {};
         if (!preparedCall) {
@@ -1991,10 +2055,51 @@ export class ToolExecutor {
             toolUseId: toolCall.id,
             toolName,
             result: output,
+            // Recorded only for a person's No. Every other refusal keeps the
+            // shape it always had: no presentation at all.
+            ...(declined ? { presentation: this.declinedPresentation(toolName, input, declined) } : {}),
+            // A refusal by policy says what kind it was; the person's own No is
+            // already carried by the presentation above.
+            ...(declined ? {} : { facts: refusalFacts(toolName, input) }),
             isError: true,
         });
         return { toolCallId: toolCall.id, toolName, output, isError: true };
     }
+    /**
+     * What a host replays for a call the person declined. The label names the
+     * target of the call (a path, a command) and nothing is inferred from the
+     * refusal text: the note comes from the review answer.
+     */
+    declinedPresentation(toolName, input, declined) {
+        let target;
+        try {
+            const view = this.config.tools.get(toolName)?.presentCall?.(input);
+            const text = view?.kind === 'generic'
+                ? view.label
+                : view?.kind === 'diff'
+                    ? view.path || view.label
+                    : view?.kind === 'terminal'
+                        ? view.command
+                        : undefined;
+            target = text
+                ?.split(/\r?\n/)
+                .find((line) => line.trim())
+                ?.trim()
+                .slice(0, 200);
+        }
+        catch {
+            // A presentation hook must not turn a refusal into a failure.
+        }
+        // Cut by code point so a surrogate pair is never split.
+        const note = Array.from(declined.note?.trim() ?? '')
+            .slice(0, DECLINED_NOTE_MAX_CHARS)
+            .join('');
+        return {
+            kind: 'generic',
+            label: target || toolName,
+            declined: note ? { note } : {},
+        };
+    }
     recordCancelledBeforeExecution(toolCallId, toolName, input) {
         const reason = abortReasonText(this.config.abortSignal.reason);
         return this.recordSyntheticHookOutcome(toolCallId, toolName, input, {
@@ -2033,18 +2138,26 @@ export class ToolExecutor {
             toolName,
             result: outcome.output,
             isError: outcome.kind === 'error',
+            ...(outcome.facts ? { facts: outcome.facts } : {}),
+            ...(outcome.inputFailure ? { inputFailure: outcome.inputFailure } : {}),
+            ...(outcome.skipped ? { skipped: true } : {}),
         });
         return {
             toolCallId,
             toolName,
             output: outcome.output,
             isError: outcome.kind === 'error',
+            ...(outcome.inputFailure ? { inputFailure: outcome.inputFailure } : {}),
+            ...(outcome.skipped ? { skipped: true } : {}),
         };
     }
     recordSyntheticPreparation(call) {
         return this.recordSyntheticHookOutcome(call.toolCall.id, call.toolName, call.input, {
             kind: call.isError ? 'error' : 'skip',
             output: call.message,
+            ...(call.facts ? { facts: call.facts } : {}),
+            ...(call.inputFailure ? { inputFailure: call.inputFailure } : {}),
+            ...(call.skipped ? { skipped: true } : {}),
         });
     }
     /**