@ouro.bot/cli 0.1.0-alpha.726 → 0.1.0-alpha.727

package/dist/heart/core.js

@@ -43,7 +43,10 @@ const provider_credentials_1 = require("./provider-credentials");
 const habit_session_1 = require("./habits/habit-session");
 const provider_attempt_1 = require("./provider-attempt");
 const openai_codex_token_1 = require("./providers/openai-codex-token");
-const _providerRuntimes = {
+// Cache only immutable provider construction inputs. ProviderRuntime owns
+// mutable per-turn state (for example Responses nativeInput), so every caller
+// must receive a fresh instance even when its binding fingerprint is unchanged.
+const _providerRuntimeFactories = {
     human: null,
     agent: null,
 };
@@ -108,12 +111,17 @@ function createProviderRegistry() {
     };
 }
 async function getProviderRuntime(facing = "human") {
+    let runtime = null;
     try {
         const { binding, fingerprint, credential } = await getProviderRuntimeFingerprint(facing);
-        const cached = _providerRuntimes[facing];
+        const cached = _providerRuntimeFactories[facing];
         if (!cached || cached.fingerprint !== fingerprint) {
-            const runtime = createProviderRegistry().resolve(binding.provider, binding.model, credential);
-            _providerRuntimes[facing] = runtime ? { fingerprint, runtime } : null;
+            const create = () => createProviderRegistry().resolve(binding.provider, binding.model, credential);
+            runtime = create();
+            _providerRuntimeFactories[facing] = runtime ? { fingerprint, create } : null;
+        }
+        else {
+            runtime = cached.create();
         }
     }
     catch (error) {
@@ -129,7 +137,7 @@ async function getProviderRuntime(facing = "human") {
         console.error(`\n[fatal] ${msg}\n`);
         throw error instanceof Error ? error : new Error(msg);
     }
-    if (!_providerRuntimes[facing]) {
+    if (!runtime) {
         const msg = "provider runtime could not be initialized.";
         (0, runtime_1.emitNervesEvent)({
             level: "error",
@@ -142,16 +150,16 @@ async function getProviderRuntime(facing = "human") {
         console.error(`\n[fatal] ${msg}\n`);
         throw new Error(msg);
     }
-    return _providerRuntimes[facing].runtime;
+    return runtime;
 }
 /**
- * Clear the cached provider runtime so the next access re-creates it from
- * current config. Runtime access also auto-refreshes when the selected
- * provider fingerprint changes on disk.
+ * Clear cached provider construction inputs so the next access re-reads them
+ * from current config. Runtime instances are always per-caller and are never
+ * shared across turns.
  */
 function resetProviderRuntime() {
-    _providerRuntimes.human = null;
-    _providerRuntimes.agent = null;
+    _providerRuntimeFactories.human = null;
+    _providerRuntimeFactories.agent = null;
 }
 function getModel(facing = "human") {
     return resolveRuntimeProviderBinding(facing).model;
@@ -348,11 +356,11 @@ async function habitToolBatchBlockReason(habitSession, toolCalls, delegatedOrigi
     }
     return null;
 }
-/** Chat-style channels expose the `speak` tool — outer human-conversation channels
- *  where mid-turn delivery is meaningful. The private runtime has `ponder`. MCP returns
- *  synchronously. Mail is batch. Anything else (unknown channel) treats as non-chat. */
+/** Channels that deliberately support mid-turn delivery expose `speak`.
+ *  BlueBubbles is final-only: its adapter owns one accepted visibility boundary.
+ *  The private runtime has `ponder`; MCP returns synchronously; mail is batch. */
 function isChatStyleChannel(channel) {
-    return channel === "cli" || channel === "teams" || channel === "bluebubbles" || channel === "voice";
+    return channel === "cli" || channel === "teams" || channel === "voice";
 }
 function bindCurrentIngressEvidenceLocator(toolList, evidence) {
     if (!evidence
@@ -392,35 +400,16 @@ const SOLE_CALL_REJECTION = {
     rest: "rejected: rest must be the only tool call. finish your work first, then call rest alone.",
 };
 function parseSettlePayload(argumentsText) {
-    try {
-        const parsed = JSON.parse(argumentsText);
-        const answer = typeof parsed?.answer === "string" ? parsed.answer : undefined;
-        const rawIntent = parsed?.intent;
-        const intent = rawIntent === "complete" || rawIntent === "blocked" || rawIntent === "direct_reply"
-            ? rawIntent
-            : undefined;
-        return { answer, intent };
-    }
-    catch {
-        return {};
-    }
-}
-function matchesRegisteredToolArgumentSchema(tool, args) {
-    const parameters = tool.function.parameters;
-    for (const requiredKey of parameters.required ?? []) {
-        if (!(requiredKey in args))
-            return false;
-    }
-    for (const [key, property] of Object.entries(parameters.properties)) {
-        const value = args[key];
-        if (value === undefined)
-            continue;
-        if (property.type === "string" && typeof value !== "string")
-            return false;
-        if (property.enum && !property.enum.includes(value))
-            return false;
-    }
-    return true;
+    const parsed = JSON.parse(argumentsText);
+    // Provider finalization validates settle.answer as a string before this
+    // terminal handling path. Keep this parser focused on projection instead
+    // of carrying an unreachable second shape check.
+    const answer = parsed.answer;
+    const rawIntent = parsed.intent;
+    const intent = rawIntent === "complete" || rawIntent === "blocked" || rawIntent === "direct_reply"
+        ? rawIntent
+        : undefined;
+    return { answer, intent };
 }
 function parsePonderPayload(argumentsText) {
     try {
@@ -620,9 +609,10 @@ function getSettleRetryError(mustResolveBeforeHandoff, intent, sawSteeringFollow
     }
     return null;
 }
-function upsertSystemPrompt(messages, systemText) {
+function upsertSystemPrompt(messages, systemText, protectedSystemMessages = []) {
     const systemMessage = { role: "system", content: systemText };
-    if (messages[0]?.role === "system") {
+    const protectedMessages = new Set(protectedSystemMessages.filter((message) => message.role === "system"));
+    if (messages[0]?.role === "system" && !protectedMessages.has(messages[0])) {
         messages[0] = systemMessage;
     }
     else {
@@ -808,11 +798,15 @@ function buildAuthFailureGuidance(provider, model, agentName, detail) {
     return lines.join("\n");
 }
 async function runAgent(messages, callbacks, channel, signal, options) {
+    const generatedMessages = [];
+    const pushGenerated = (...next) => {
+        messages.push(...next);
+        generatedMessages.push(...structuredClone(next));
+    };
     const facing = (0, friends_1.channelToFacing)(channel);
     let providerRuntime = await getProviderRuntime(facing);
     const provider = providerRuntime.id;
-    const restrictedReactionFeedback = options?.restrictedReactionFeedback === true;
-    const toolChoiceRequired = restrictedReactionFeedback ? true : options?.toolChoiceRequired ?? true;
+    const toolChoiceRequired = options?.toolChoiceRequired ?? true;
     const traceId = options?.traceId;
     (0, runtime_1.emitNervesEvent)({
         event: "engine.turn_start",
@@ -833,6 +827,52 @@ async function runAgent(messages, callbacks, channel, signal, options) {
     }
     const turnOrientationFrame = options?.orientationFrame
         ?? (channel ? (0, orientation_frame_1.buildOrientationFrame)({ channel, messages }) : undefined);
+    if (options?.requiredPromptEvidence) {
+        let structuralFloor;
+        try {
+            structuralFloor = (0, prompt_budget_1.assessRequiredPromptEvidenceBudget)({
+                messages,
+                requiredPromptEvidence: options.requiredPromptEvidence,
+                provider: providerRuntime.id,
+                model: providerRuntime.model,
+                contextWindowTokens: (0, config_1.getContextConfig)().maxTokens,
+            });
+        }
+        catch (error) {
+            const invalidEvidenceError = error instanceof Error ? error : new Error(String(error));
+            callbacks.onError(invalidEvidenceError, "terminal");
+            options.captureGeneratedMessages?.([]);
+            (0, runtime_1.emitNervesEvent)({
+                event: "engine.turn_end",
+                trace_id: traceId,
+                component: "engine",
+                message: "runAgent turn completed",
+                meta: { done: true, sawPonder: false, sawQuerySession: false, sawBridgeManage: false },
+            });
+            return {
+                outcome: "errored",
+                error: invalidEvidenceError,
+                errorClassification: "unknown",
+            };
+        }
+        if (structuralFloor.status === "required_evidence_over_budget") {
+            const budgetError = new Error(`required_evidence_over_budget: required current-turn evidence needs ${structuralFloor.estimatedTokens} tokens but the provider input limit is ${structuralFloor.budget.inputTokenLimit}`);
+            callbacks.onError(budgetError, "terminal");
+            options.captureGeneratedMessages?.([]);
+            (0, runtime_1.emitNervesEvent)({
+                event: "engine.turn_end",
+                trace_id: traceId,
+                component: "engine",
+                message: "runAgent turn completed",
+                meta: { done: true, sawPonder: false, sawQuerySession: false, sawBridgeManage: false },
+            });
+            return {
+                outcome: "errored",
+                error: budgetError,
+                errorClassification: "unknown",
+            };
+        }
+    }
     // Refresh system prompt at start of each turn when channel is provided.
     // If refresh fails, retain only a recognised stable prefix (or inject a
     // minimal safe fallback) so stale dynamic state cannot regain authority.
@@ -848,12 +888,22 @@ async function runAgent(messages, callbacks, channel, signal, options) {
             };
             const refreshed = await (0, prompt_1.buildSystem)(channel, buildSystemOptions, currentContext);
             structuredSystemPrompt = refreshed;
-            upsertSystemPrompt(messages, (0, prompt_1.flattenSystemPrompt)(refreshed));
+            upsertSystemPrompt(messages, (0, prompt_1.flattenSystemPrompt)(refreshed), [
+                ...(options?.promptOnlyEvidenceMessages ?? []),
+                ...(options?.requiredPromptEvidence?.verifiedPredecessorMessage
+                    ? [options.requiredPromptEvidence.verifiedPredecessorMessage]
+                    : []),
+            ]);
         }
         catch (error) {
             const hadExistingSystemPrompt = messages[0]?.role === "system" && typeof messages[0].content === "string";
             const fallback = repairFallbackSystemPrompt(turnOrientationFrame);
-            upsertSystemPrompt(messages, fallback);
+            upsertSystemPrompt(messages, fallback, [
+                ...(options?.promptOnlyEvidenceMessages ?? []),
+                ...(options?.requiredPromptEvidence?.verifiedPredecessorMessage
+                    ? [options.requiredPromptEvidence.verifiedPredecessorMessage]
+                    : []),
+            ]);
             (0, runtime_1.emitNervesEvent)({
                 level: "warn",
                 event: "mind.step_error",
@@ -939,25 +989,18 @@ async function runAgent(messages, callbacks, channel, signal, options) {
             },
         });
         stripLastToolCalls(messages);
+        stripLastToolCalls(generatedMessages);
         outcome = "errored";
         done = true;
     };
-    const finishRestrictedReactionFeedbackViolation = (reason) => {
-        callbacks.onClearText?.();
-        finishTerminalProviderError(new Error(`restricted reaction feedback failed closed: ${reason}`), "unknown");
-    };
     // Prevent MaxListenersExceeded warning — each iteration adds a listener
     try {
         require("events").setMaxListeners(50, signal);
     }
     catch { /* unsupported */ }
     const toolPreferences = currentContext?.friend?.toolPreferences;
-    const unboundBaseTools = restrictedReactionFeedback
-        ? (0, tools_1.getRestrictedReactionFeedbackTools)()
-        : options?.tools ?? (0, tools_1.getToolsForChannel)(channel ? (0, friends_1.getChannelCapabilities)(channel) : undefined, toolPreferences && Object.keys(toolPreferences).length > 0 ? toolPreferences : undefined, currentContext, providerRuntime.capabilities, options?.mcpManager, providerRuntime.model);
-    const baseTools = restrictedReactionFeedback
-        ? unboundBaseTools
-        : bindCurrentIngressEvidenceLocator(unboundBaseTools, options?.toolContext?.currentIngressEvidence);
+    const unboundBaseTools = options?.tools ?? (0, tools_1.getToolsForChannel)(channel ? (0, friends_1.getChannelCapabilities)(channel) : undefined, toolPreferences && Object.keys(toolPreferences).length > 0 ? toolPreferences : undefined, currentContext, providerRuntime.capabilities, options?.mcpManager, providerRuntime.model);
+    const baseTools = bindCurrentIngressEvidenceLocator(unboundBaseTools, options?.toolContext?.currentIngressEvidence);
     // Augment tool context with reasoning effort controls from provider
     const baseToolContext = options?.toolContext
         ?? (turnOrientationFrame ? { signin: async () => undefined, orientationFrame: turnOrientationFrame } : undefined);
@@ -1001,21 +1044,17 @@ async function runAgent(messages, callbacks, channel, signal, options) {
         const filteredBaseTools = isPrivateRuntimeChannel
             ? baseTools.filter((t) => privateRuntimeHabitCanSendMessage || t.function.name !== "send_message")
             : baseTools;
-        const activeTools = restrictedReactionFeedback
-            ? filteredBaseTools
-            : [
-                ...filteredBaseTools,
-                ...(augmentedToolContext?.noSend === true ? [] : [tools_1.ponderTool]),
-                ...(isPrivateRuntimeChannel && privateRuntimeHabitCanSurface ? [tools_2.surfaceToolDef] : []),
-                ...(isPrivateRuntimeChannel ? [tools_1.restTool] : []),
-                ...(!isPrivateRuntimeChannel ? [tools_1.observeTool] : []),
-                ...(!isPrivateRuntimeChannel ? [tools_1.settleTool] : []),
-                ...(isChatStyleChannel(channel ?? "") ? [tools_1.speakTool] : []),
-            ];
+        const activeTools = [
+            ...filteredBaseTools,
+            ...(augmentedToolContext?.noSend === true ? [] : [tools_1.ponderTool]),
+            ...(isPrivateRuntimeChannel && privateRuntimeHabitCanSurface ? [tools_2.surfaceToolDef] : []),
+            ...(isPrivateRuntimeChannel ? [tools_1.restTool] : []),
+            ...(!isPrivateRuntimeChannel ? [tools_1.observeTool] : []),
+            ...(!isPrivateRuntimeChannel ? [tools_1.settleTool] : []),
+            ...(isChatStyleChannel(channel ?? "") ? [tools_1.speakTool] : []),
+        ];
         const activeToolNames = new Set(activeTools.map((tool) => tool.function.name));
-        const steeringFollowUps = restrictedReactionFeedback
-            ? []
-            : options?.drainSteeringFollowUps?.() ?? [];
+        const steeringFollowUps = options?.drainSteeringFollowUps?.() ?? [];
         if (steeringFollowUps.length > 0) {
             const hasSupersedingFollowUp = steeringFollowUps.some((followUp) => followUp.effect === "clear_and_supersede");
             if (hasSupersedingFollowUp) {
@@ -1052,6 +1091,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                 try {
                     const promptBudget = (0, prompt_budget_1.applyPromptBudget)({
                         messages,
+                        requiredPromptEvidence: options?.requiredPromptEvidence,
                         provider: providerRuntime.id,
                         model: providerRuntime.model,
                         contextWindowTokens: (0, config_1.getContextConfig)().maxTokens,
@@ -1068,7 +1108,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         traceId,
                         toolChoiceRequired,
                         reasoningEffort: currentReasoningEffort,
-                        eagerSettleStreaming: !restrictedReactionFeedback,
+                        eagerSettleStreaming: true,
                         systemPrompt: structuredSystemPrompt,
                     });
                 }
@@ -1090,9 +1130,19 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                     if (isContextOverflow(error) && !overflowRetried) {
                         overflowRetried = true;
                         stripLastToolCalls(messages);
+                        stripLastToolCalls(generatedMessages);
                         const { maxTokens, contextMargin } = (0, config_1.getContextConfig)();
                         const trimmed = (0, context_1.trimMessages)(messages, maxTokens, contextMargin, maxTokens * 2);
-                        messages.splice(0, messages.length, ...trimmed);
+                        const requiredEvidence = options?.requiredPromptEvidence;
+                        const requiredMessages = new Set([
+                            ...(requiredEvidence?.verifiedPredecessorMessage ? [requiredEvidence.verifiedPredecessorMessage] : []),
+                            ...(requiredEvidence?.currentUserMessage ? [requiredEvidence.currentUserMessage] : []),
+                        ]);
+                        const trimmedMessages = new Set(trimmed);
+                        const overflowRetryMessages = requiredMessages.size === 0
+                            ? trimmed
+                            : messages.filter((message) => trimmedMessages.has(message) || requiredMessages.has(message));
+                        messages.splice(0, messages.length, ...overflowRetryMessages);
                         providerRuntime.resetTurnState(messages);
                         callbacks.onError(new Error("context trimmed, retrying..."), "transient");
                         return callProviderTurn();
@@ -1104,9 +1154,8 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                 operation: "turn",
                 provider: providerRuntime.id,
                 model: providerRuntime.model,
-                run: restrictedReactionFeedback ? callProviderTurn : callProviderTurnWithOverflowRecovery,
+                run: callProviderTurnWithOverflowRecovery,
                 classifyError: (error) => providerRuntime.classifyError(error),
-                ...(restrictedReactionFeedback ? { policy: { maxAttempts: 1 } } : {}),
                 onRetry: async (record, maxAttempts) => {
                     const delayMs = record.delayMs;
                     const seconds = delayMs / 1000;
@@ -1122,7 +1171,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             preserveCachedOnFailure: true,
                             providers: [record.provider],
                         });
-                        _providerRuntimes[facing] = null;
+                        _providerRuntimeFactories[facing] = null;
                         providerRuntime = await getProviderRuntime(facing);
                         providerRuntime.resetTurnState(messages);
                     }
@@ -1218,100 +1267,6 @@ async function runAgent(messages, callbacks, channel, signal, options) {
             if (hasPhaseAnnotation) {
                 msg.phase = isSoleSettle ? "settle" : "commentary";
             }
-            if (restrictedReactionFeedback) {
-                if (result.toolCalls.length !== 1) {
-                    streamCallbackBuffer?.discard();
-                    finishRestrictedReactionFeedbackViolation(result.toolCalls.length === 0
-                        ? "the provider returned no terminal tool"
-                        : "the provider returned a mixed or multiple-tool batch");
-                    continue;
-                }
-                const restrictedCall = result.toolCalls[0];
-                if (!activeToolNames.has(restrictedCall.name)) {
-                    streamCallbackBuffer?.discard();
-                    finishRestrictedReactionFeedbackViolation(`the provider returned unregistered tool ${JSON.stringify(restrictedCall.name)}`);
-                    continue;
-                }
-                let restrictedArgs = null;
-                try {
-                    const parsed = JSON.parse(restrictedCall.arguments);
-                    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-                        restrictedArgs = parsed;
-                    }
-                }
-                catch {
-                    restrictedArgs = null;
-                }
-                const registeredTool = activeTools.find((tool) => tool.function.name === restrictedCall.name);
-                const argumentsMatchSchema = restrictedArgs !== null
-                    && matchesRegisteredToolArgumentSchema(registeredTool, restrictedArgs);
-                const callbackArgs = (restrictedArgs ?? {});
-                if (restrictedCall.name === "settle") {
-                    const { answer, intent } = parseSettlePayload(restrictedCall.arguments);
-                    callbacks.onToolStart("settle", callbackArgs);
-                    if (!argumentsMatchSchema || answer === undefined || intent === "direct_reply") {
-                        callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", callbackArgs), false);
-                        streamCallbackBuffer?.discard();
-                        finishRestrictedReactionFeedbackViolation("settle arguments were malformed or requested continuation");
-                        continue;
-                    }
-                    streamCallbackBuffer?.discard();
-                    callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", callbackArgs), true);
-                    const completionIntent = intent === "blocked" ? "blocked" : "complete";
-                    completion = { answer, intent: completionIntent };
-                    callbacks.onClearText?.();
-                    callbacks.onTextChunk(answer);
-                    messages.push(msg);
-                    const delivered = "(delivered)";
-                    messages.push({ role: "tool", tool_call_id: restrictedCall.id, content: delivered });
-                    providerRuntime.appendToolOutput(restrictedCall.id, delivered);
-                    outcome = completionIntent === "blocked" ? "blocked" : "settled";
-                    done = true;
-                    continue;
-                }
-                if (!argumentsMatchSchema) {
-                    streamCallbackBuffer?.discard();
-                    finishRestrictedReactionFeedbackViolation(`${restrictedCall.name} arguments were malformed`);
-                    continue;
-                }
-                if (restrictedCall.name === "observe") {
-                    streamCallbackBuffer?.discard();
-                    callbacks.onClearText?.();
-                    callbacks.onToolStart("observe", callbackArgs);
-                    const reason = typeof callbackArgs.reason === "string" ? callbackArgs.reason : undefined;
-                    (0, runtime_1.emitNervesEvent)({
-                        component: "engine",
-                        event: "engine.observe",
-                        message: "agent observed without responding",
-                        meta: { ...(reason ? { reason } : {}) },
-                    });
-                    callbacks.onToolEnd("observe", (0, tools_1.summarizeArgs)("observe", callbackArgs), true);
-                    messages.push(msg);
-                    const silenced = "(silenced)";
-                    messages.push({ role: "tool", tool_call_id: restrictedCall.id, content: silenced });
-                    providerRuntime.appendToolOutput(restrictedCall.id, silenced);
-                    outcome = "observed";
-                    done = true;
-                    continue;
-                }
-                callbacks.onClearText?.();
-                callbacks.onToolStart("orientation_get", callbackArgs);
-                let orientationReadSucceeded = false;
-                try {
-                    const execToolFn = options?.execTool ?? tools_1.execTool;
-                    await execToolFn("orientation_get", callbackArgs, augmentedToolContext);
-                    orientationReadSucceeded = true;
-                }
-                catch {
-                    orientationReadSucceeded = false;
-                }
-                callbacks.onToolEnd("orientation_get", (0, tools_1.summarizeArgs)("orientation_get", callbackArgs), orientationReadSucceeded);
-                streamCallbackBuffer?.discard();
-                finishRestrictedReactionFeedbackViolation(orientationReadSucceeded
-                    ? "orientation_get completed but no terminal response can follow the single invocation"
-                    : "orientation_get failed");
-                continue;
-            }
             // Detect the MiniMax "only-thinking, no tool call" violation: no tool
             // calls returned, and the content is empty after stripping
             // <think>...</think> blocks. This is a narrow check — legitimate
@@ -1349,7 +1304,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                                 contentLength: result.content.length,
                             },
                         });
-                        messages.push(msg);
+                        pushGenerated(msg);
                         messages.push({
                             role: "user",
                             content: `${privateReturnTextAckRetryError} Emit the ponder(action=create, ...) tool call now, or ask a blocking clarification without saying the private work is queued.`,
@@ -1370,7 +1325,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         },
                     });
                     msg.content = blockedAnswer;
-                    messages.push(msg);
+                    pushGenerated(msg);
                     callbacks.onTextChunk(blockedAnswer);
                     completion = { answer: blockedAnswer, intent: "blocked" };
                     outcome = "blocked";
@@ -1398,7 +1353,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             contentLength: result.content.length,
                         },
                     });
-                    messages.push(msg);
+                    pushGenerated(msg);
                     messages.push({
                         role: "user",
                         content: isPrivateRuntimeChannel
@@ -1411,7 +1366,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                 }
                 // Legitimate text-only response, or cap reached — accept as-is.
                 await streamCallbackBuffer?.flush();
-                messages.push(msg);
+                pushGenerated(msg);
                 done = true;
             }
             else {
@@ -1421,10 +1376,10 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                 if (habitBlockReason) {
                     streamCallbackBuffer?.discard();
                     recordBlockedHabitSurfaceAttempts(habitSession, result.toolCalls, habitBlockReason);
-                    messages.push(msg);
+                    pushGenerated(msg);
                     const blockedOutput = `blocked: ${habitBlockReason}. No tool side effects from this assistant message were executed.`;
                     for (const call of result.toolCalls) {
-                        messages.push({ role: "tool", tool_call_id: call.id, content: blockedOutput });
+                        pushGenerated({ role: "tool", tool_call_id: call.id, content: blockedOutput });
                         providerRuntime.appendToolOutput(call.id, blockedOutput);
                     }
                     (0, runtime_1.emitNervesEvent)({
@@ -1470,9 +1425,9 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                     }
                     catch (error) {
                         callbacks.onToolEnd(soleTerminalCall.name, (0, tools_1.summarizeArgs)(soleTerminalCall.name, terminalArgs), false);
-                        messages.push(msg);
+                        pushGenerated(msg);
                         const failure = error instanceof Error ? `error: ${error.message}` : `error: ${String(error)}`;
-                        messages.push({ role: "tool", tool_call_id: soleTerminalCall.id, content: failure });
+                        pushGenerated({ role: "tool", tool_call_id: soleTerminalCall.id, content: failure });
                         providerRuntime.appendToolOutput(soleTerminalCall.id, failure);
                         callbacks.onTextChunk(failure);
                         completion = { answer: failure, intent: "blocked" };
@@ -1481,8 +1436,8 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         continue;
                     }
                     callbacks.onToolEnd(soleTerminalCall.name, (0, tools_1.summarizeArgs)(soleTerminalCall.name, terminalArgs), true);
-                    messages.push(msg);
-                    messages.push({ role: "tool", tool_call_id: soleTerminalCall.id, content: terminalResult });
+                    pushGenerated(msg);
+                    pushGenerated({ role: "tool", tool_call_id: soleTerminalCall.id, content: terminalResult });
                     providerRuntime.appendToolOutput(soleTerminalCall.id, terminalResult);
                     callbacks.onTextChunk(terminalResult);
                     completion = { answer: terminalResult, intent: "complete" };
@@ -1506,9 +1461,9 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         streamCallbackBuffer?.discard();
                         callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs), false);
                         callbacks.onClearText?.();
-                        messages.push(msg);
+                        pushGenerated(msg);
                         const gateMessage = "current held-work frame still has unsurfaced items — return each listed item with surface(delegationId=...) before you settle. Older transcript claims are historical; only the current held-work frame is the gate.";
-                        messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: gateMessage });
+                        pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: gateMessage });
                         providerRuntime.appendToolOutput(result.toolCalls[0].id, gateMessage);
                         continue;
                     }
@@ -1519,9 +1474,9 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                     if (isPrivateRuntimeChannel) {
                         streamCallbackBuffer?.discard();
                         callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs), true);
-                        messages.push(msg);
+                        pushGenerated(msg);
                         const settled = "(settled)";
-                        messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: settled });
+                        pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: settled });
                         providerRuntime.appendToolOutput(result.toolCalls[0].id, settled);
                         outcome = "settled";
                         done = true;
@@ -1559,15 +1514,15 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         };
                         // Retractable owners already hold the validated answer. Final-only
                         // owners receive it here, after every semantic continuation gate.
-                        messages.push(msg);
+                        pushGenerated(msg);
                         if (validDirectReply) {
                             const resumeWork = "direct reply delivered. resume the unresolved obligation now and keep working until you can finish or clearly report that you are blocked.";
-                            messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: resumeWork });
+                            pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: resumeWork });
                             providerRuntime.appendToolOutput(result.toolCalls[0].id, resumeWork);
                         }
                         else {
                             const delivered = "(delivered)";
-                            messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: delivered });
+                            pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: delivered });
                             providerRuntime.appendToolOutput(result.toolCalls[0].id, delivered);
                             outcome = intent === "blocked" ? "blocked" : "settled";
                             done = true;
@@ -1579,9 +1534,9 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         streamCallbackBuffer?.discard();
                         callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs), false);
                         callbacks.onClearText?.();
-                        messages.push(msg);
+                        pushGenerated(msg);
                         const toolRetryMessage = retryError;
-                        messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: toolRetryMessage });
+                        pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: toolRetryMessage });
                         providerRuntime.appendToolOutput(result.toolCalls[0].id, toolRetryMessage);
                     }
                     continue;
@@ -1608,9 +1563,9 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         meta: { ...(reason ? { reason } : {}) },
                     });
                     callbacks.onToolEnd("observe", (0, tools_1.summarizeArgs)("observe", observeArgs), true);
-                    messages.push(msg);
+                    pushGenerated(msg);
                     const silenced = "(silenced)";
-                    messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: silenced });
+                    pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: silenced });
                     providerRuntime.appendToolOutput(result.toolCalls[0].id, silenced);
                     outcome = "observed";
                     done = true;
@@ -1631,18 +1586,18 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                     const attentionQueue = augmentedToolContext?.delegatedOrigins;
                     if (attentionQueue && attentionQueue.length > 0) {
                         callbacks.onToolEnd("rest", (0, tools_1.summarizeArgs)("rest", restArgs), false);
-                        messages.push(msg);
+                        pushGenerated(msg);
                         const gateMessage = "current held-work frame still has unsurfaced items — return each listed item with surface(delegationId=...) before you rest. Older transcript claims are historical; only the current held-work frame is the gate.";
-                        messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: gateMessage });
+                        pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: gateMessage });
                         providerRuntime.appendToolOutput(result.toolCalls[0].id, gateMessage);
                         continue;
                     }
                     if (hasFreshPendingWork(options) && !freshWorkGateFired) {
                         freshWorkGateFired = true;
                         callbacks.onToolEnd("rest", (0, tools_1.summarizeArgs)("rest", restArgs), false);
-                        messages.push(msg);
+                        pushGenerated(msg);
                         const gateMessage = "fresh work arrived for me this turn — inspect the pending messages above and take the next concrete action before you rest.";
-                        messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: gateMessage });
+                        pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: gateMessage });
                         providerRuntime.appendToolOutput(result.toolCalls[0].id, gateMessage);
                         (0, runtime_1.emitNervesEvent)({
                             level: "info",
@@ -1654,9 +1609,9 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         continue;
                     }
                     callbacks.onToolEnd("rest", (0, tools_1.summarizeArgs)("rest", restArgs), true);
-                    messages.push(msg);
+                    pushGenerated(msg);
                     const ack = "(resting)";
-                    messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: ack });
+                    pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: ack });
                     providerRuntime.appendToolOutput(result.toolCalls[0].id, ack);
                     (0, runtime_1.emitNervesEvent)({
                         component: "engine",
@@ -1680,11 +1635,26 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                 else {
                     await streamCallbackBuffer?.flush();
                 }
-                messages.push(msg);
+                pushGenerated(msg);
                 // Execute tools (sole-call tools in mixed calls are rejected inline)
                 for (const tc of result.toolCalls) {
                     if (signal?.aborted)
                         break;
+                    if (tc.name === "speak" && !activeToolNames.has("speak")) {
+                        const rejection = "rejected: speak was not advertised for this channel; no outward message was sent.";
+                        callbacks.onToolStart(tc.name, {});
+                        callbacks.onToolEnd(tc.name, "", false);
+                        pushGenerated({ role: "tool", tool_call_id: tc.id, content: rejection });
+                        providerRuntime.appendToolOutput(tc.id, rejection);
+                        (0, runtime_1.emitNervesEvent)({
+                            level: "warn",
+                            component: "engine",
+                            event: "engine.unadvertised_speak_blocked",
+                            message: "blocked an unadvertised speak tool call",
+                            meta: { channel: String(channel) },
+                        });
+                        continue;
+                    }
                     // Reject sole-call tools when mixed with other tool calls
                     const terminalProjection = (0, tools_1.resolveToolDefinition)(tc.name)?.terminalProjection;
                     const soleCallRejection = SOLE_CALL_REJECTION[tc.name]
@@ -1692,7 +1662,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             ? `rejected: ${tc.name} must be the only tool call.`
                             : undefined);
                     if (soleCallRejection) {
-                        messages.push({ role: "tool", tool_call_id: tc.id, content: soleCallRejection });
+                        pushGenerated({ role: "tool", tool_call_id: tc.id, content: soleCallRejection });
                         providerRuntime.appendToolOutput(tc.id, soleCallRejection);
                         continue;
                     }
@@ -1710,7 +1680,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             const rejection = "private-return requests must use ponder, not send_message(friendId=self). Create a typed ponder packet with the marker/source request preserved, then only acknowledge that the private pass is queued.";
                             callbacks.onToolStart(tc.name, args);
                             callbacks.onToolEnd(tc.name, argSummary, false);
-                            messages.push({ role: "tool", tool_call_id: tc.id, content: rejection });
+                            pushGenerated({ role: "tool", tool_call_id: tc.id, content: rejection });
                             providerRuntime.appendToolOutput(tc.id, rejection);
                             continue;
                         }
@@ -1728,7 +1698,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         if (speakMessage.trim().length === 0) {
                             const err = "speak requires a non-empty `message` string.";
                             callbacks.onToolEnd("speak", argSummary, false);
-                            messages.push({ role: "tool", tool_call_id: tc.id, content: err });
+                            pushGenerated({ role: "tool", tool_call_id: tc.id, content: err });
                             providerRuntime.appendToolOutput(tc.id, err);
                             (0, runtime_1.emitNervesEvent)({
                                 level: "warn",
@@ -1750,7 +1720,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         if (speakDeliveryError) {
                             callbacks.onToolEnd("speak", argSummary, false);
                             const failMsg = `speak delivery failed: ${speakDeliveryError.message}. the message did not reach your friend; do not assume they saw it.`;
-                            messages.push({ role: "tool", tool_call_id: tc.id, content: failMsg });
+                            pushGenerated({ role: "tool", tool_call_id: tc.id, content: failMsg });
                             providerRuntime.appendToolOutput(tc.id, failMsg);
                             (0, runtime_1.emitNervesEvent)({
                                 level: "error",
@@ -1763,7 +1733,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         }
                         callbacks.onToolEnd("speak", argSummary, true);
                         const ack = "(spoken)";
-                        messages.push({ role: "tool", tool_call_id: tc.id, content: ack });
+                        pushGenerated({ role: "tool", tool_call_id: tc.id, content: ack });
                         providerRuntime.appendToolOutput(tc.id, ack);
                         (0, runtime_1.emitNervesEvent)({
                             component: "engine",
@@ -1928,7 +1898,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             toolResult = error instanceof Error ? error.message : String(error);
                         }
                         callbacks.onToolEnd(tc.name, argSummary, success);
-                        messages.push({ role: "tool", tool_call_id: tc.id, content: toolResult });
+                        pushGenerated({ role: "tool", tool_call_id: tc.id, content: toolResult });
                         providerRuntime.appendToolOutput(tc.id, toolResult);
                         continue;
                     }
@@ -1947,7 +1917,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         const rejection = `loop guard: ${toolLoop.message}`;
                         callbacks.onToolStart(tc.name, args);
                         callbacks.onToolEnd(tc.name, argSummary, false);
-                        messages.push({ role: "tool", tool_call_id: tc.id, content: rejection });
+                        pushGenerated({ role: "tool", tool_call_id: tc.id, content: rejection });
                         providerRuntime.appendToolOutput(tc.id, rejection);
                         continue;
                     }
@@ -1967,7 +1937,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                     toolResult = (0, tool_friction_1.rewriteToolResultForModel)(tc.name, toolResult, toolFrictionLedger);
                     (0, tool_loop_1.recordToolOutcome)(toolLoopState, tc.name, args, toolResult, success);
                     callbacks.onToolEnd(tc.name, (0, tools_1.buildToolResultSummary)(tc.name, args, toolResult, success), success);
-                    messages.push({ role: "tool", tool_call_id: tc.id, content: toolResult });
+                    pushGenerated({ role: "tool", tool_call_id: tc.id, content: toolResult });
                     providerRuntime.appendToolOutput(tc.id, toolResult);
                     callbacks.onToolResult?.(messages);
                 }
@@ -1977,6 +1947,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
             // Abort is not an error — just stop cleanly
             if (e instanceof provider_attempt_1.ProviderAttemptAbortError || signal?.aborted) {
                 stripLastToolCalls(messages);
+                stripLastToolCalls(generatedMessages);
                 outcome = "aborted";
                 break;
             }
@@ -1992,6 +1963,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
             finishTerminalProviderError(errorForClassification, providerClassification);
         }
     }
+    options?.captureGeneratedMessages?.(structuredClone(generatedMessages));
     (0, runtime_1.emitNervesEvent)({
         event: "engine.turn_end",
         trace_id: traceId,