@ouro.bot/cli 0.1.0-alpha.810 → 0.1.0-alpha.811

package/dist/heart/core.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_PROVIDER_ITERATIONS = void 0;
 exports.validateToolCallBatchAtProductionBoundary = validateToolCallBatchAtProductionBoundary;
 exports.createProviderRegistry = createProviderRegistry;
+exports.getProviderRuntime = getProviderRuntime;
 exports.resetProviderRuntime = resetProviderRuntime;
 exports.getModel = getModel;
 exports.getProvider = getProvider;
@@ -22,8 +23,8 @@ const identity_1 = require("./identity");
 const tools_1 = require("../repertoire/tools");
 const tool_arguments_1 = require("../repertoire/tool-arguments");
 const session_events_1 = require("./session-events");
+const tool_approval_1 = require("./tool-approval");
 const friends_1 = require("@ouro.bot/friends");
-const tools_2 = require("../repertoire/tools");
 const streaming_1 = require("./streaming");
 const runtime_1 = require("../nerves/runtime");
 function validateToolCallBatchAtProductionBoundary(calls, activeTools) {
@@ -73,15 +74,15 @@ const _providerRuntimeFactories = {
 function providerLaneForFacing(facing) {
     return facing === "human" ? "outward" : "inner";
 }
-function resolveRuntimeProviderBinding(facing) {
+function resolveRuntimeProviderBinding(facing, owner) {
     const lane = providerLaneForFacing(facing);
-    const config = (0, identity_1.loadAgentConfig)();
+    const config = (0, identity_1.loadAgentConfig)(owner);
     const facingConfig = facing === "human" ? config.humanFacing : config.agentFacing;
     return { lane, provider: facingConfig.provider, model: facingConfig.model };
 }
-async function getProviderRuntimeFingerprint(facing) {
-    const agentName = (0, identity_2.getAgentName)();
-    const binding = resolveRuntimeProviderBinding(facing);
+async function getProviderRuntimeFingerprint(facing, owner) {
+    const agentName = owner?.agentName ?? (0, identity_2.getAgentName)();
+    const binding = resolveRuntimeProviderBinding(facing, owner);
     const credential = await (0, provider_credentials_1.readProviderCredentialRecord)(agentName, binding.provider);
     if (!credential.ok) {
         throw new Error([
@@ -103,6 +104,7 @@ async function getProviderRuntimeFingerprint(facing) {
     return {
         binding,
         fingerprint: JSON.stringify({
+            ...(owner ? { agentName: owner.agentName, agentRoot: owner.agentRoot } : {}),
             lane: binding.lane,
             provider: binding.provider,
             model: binding.model,
@@ -133,10 +135,11 @@ function createProviderRegistry() {
         },
     };
 }
-async function getProviderRuntime(facing = "human") {
+async function getProviderRuntime(facing = "human", owner) {
+    const scope = owner ? { agentName: owner.agentName, agentRoot: owner.agentRoot } : undefined;
     let runtime = null;
     try {
-        const { binding, fingerprint, credential } = await getProviderRuntimeFingerprint(facing);
+        const { binding, fingerprint, credential } = await getProviderRuntimeFingerprint(facing, scope);
         const cached = _providerRuntimeFactories[facing];
         if (!cached || cached.fingerprint !== fingerprint) {
             const create = () => createProviderRegistry().resolve(binding.provider, binding.model, credential);
@@ -323,15 +326,25 @@ async function resumeApprovalContinuation(options) {
         await options.persist(materialized.messages);
         await options.markContinuationMaterialized();
     }
-    if (!materialized.resumeProvider) {
-        await options.deliver(materialized.directNotice);
+    const currentOptions = options.revalidate ? await options.revalidate()
+        : options.runAgentOptions?.toolContext?.relationshipAuthorization ? null : options.runAgentOptions;
+    if (!materialized.resumeProvider || currentOptions === null) {
+        if (currentOptions === null)
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn", component: "engine", event: "engine.approval_continuation_authority_block",
+                message: "approval continuation has no current relationship authority",
+                meta: { approvalId: options.record.approvalId, state: options.record.state },
+            });
+        const effect = options.record.state === "succeeded" ? "the approved action completed"
+            : options.record.state === "failed" ? "the approved action failed" : "the protected action was not executed";
+        await options.deliver(materialized.directNotice ?? `${effect}; current relationship access is unavailable, so no model continuation was run`);
         await options.completeContinuation();
         return { outcome: "terminal_notice", messages: materialized.messages };
     }
     const outward = { value: "" };
     const callbacks = continuationCallbacks(options.callbacks, outward);
     await options.markContinuationAttempted();
-    const result = await options.runAgent(materialized.messages, callbacks, options.channel, options.signal, options.runAgentOptions);
+    const result = await options.runAgent(materialized.messages, callbacks, options.channel, options.signal, currentOptions);
     if (result.outcome === "suspended") {
         await options.completeContinuation();
         return { outcome: result.outcome, messages: materialized.messages, suspension: result.suspension };
@@ -406,7 +419,7 @@ function recordBlockedHabitSurfaceAttempts(habitSession, toolCalls, reason) {
         });
     }
 }
-async function habitToolBatchBlockReason(habitSession, toolCalls, delegatedOrigins) {
+async function habitToolBatchBlockReason(habitSession, toolCalls, delegatedOrigins, selection) {
     if (!habitSession)
         return null;
     const granted = new Set(habitSession.toolPolicy.grantedTools);
@@ -420,7 +433,7 @@ async function habitToolBatchBlockReason(habitSession, toolCalls, delegatedOrigi
             return `habit tool '${call.name}' was not granted to this habit session`;
         // The canonical pre-batch schema gate guarantees object arguments here.
         const args = JSON.parse(call.arguments);
-        const riskProfile = (0, tools_1.riskProfileForToolName)(call.name, args);
+        const riskProfile = (0, tools_1.riskProfileForToolName)(call.name, args, selection);
         if (!riskProfile)
             return `habit tool '${call.name}' does not have a known executable risk profile`;
         const externalMutation = highRiskExternalMutation(riskProfile);
@@ -569,7 +582,7 @@ function requiredToolResultSucceeded(name, content, args, validate) {
         return false;
     return validate?.(name, content, args) ?? true;
 }
-function effectFingerprint(name, rawArguments) {
+function effectFingerprint(name, rawArguments, selection) {
     let args;
     try {
         const parsed = JSON.parse(rawArguments);
@@ -580,13 +593,13 @@ function effectFingerprint(name, rawArguments) {
     catch {
         return null;
     }
-    const profile = (0, tools_1.riskProfileForToolName)(name, args);
+    const profile = (0, tools_1.riskProfileForToolName)(name, args, selection);
     if (!profile || profile.mutates === "none")
         return null;
     delete args.expectedVersion;
     return (0, tool_arguments_1.digestJson)({ name, args });
 }
-function historicalFailedEffectsForExactRepeatedRequest(messages) {
+function historicalFailedEffectsForExactRepeatedRequest(messages, selection) {
     const userRequests = [];
     for (let index = 0; index < messages.length; index += 1) {
         const message = messages[index];
@@ -611,7 +624,7 @@ function historicalFailedEffectsForExactRepeatedRequest(messages) {
             for (const call of message.tool_calls) {
                 if (call.type !== "function" || !call.id || !call.function.name)
                     continue;
-                const fingerprint = effectFingerprint(call.function.name, call.function.arguments);
+                const fingerprint = effectFingerprint(call.function.name, call.function.arguments, selection);
                 if (fingerprint)
                     effectsByCallId.set(call.id, { name: call.function.name, fingerprint });
             }
@@ -964,7 +977,10 @@ async function runAgent(messages, callbacks, channel, signal, options) {
         }
     };
     const facing = (0, friends_1.channelToFacing)(channel);
-    let providerRuntime = options?.providerRuntimeOverride ?? await getProviderRuntime(facing);
+    const owner = options?.toolContext?.agentName && options.toolContext.agentRoot
+        ? { agentName: options.toolContext.agentName, agentRoot: options.toolContext.agentRoot }
+        : undefined;
+    let providerRuntime = options?.providerRuntimeOverride ?? await getProviderRuntime(facing, owner);
     const provider = providerRuntime.id;
     const toolChoiceRequired = options?.hardDisableTools ? false : options?.toolChoiceRequired ?? true;
     const traceId = options?.traceId;
@@ -1085,7 +1101,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
         await (0, kept_notes_1.injectKeptNotes)(messages, {
             channel,
             friend: currentContext?.friend,
-            judge: async (input) => (0, kept_notes_1.createKeptNotesJudge)(await getProviderRuntime("agent"), signal)(input),
+            judge: async (input) => (0, kept_notes_1.createKeptNotesJudge)(await getProviderRuntime("agent", owner), signal)(input),
             signal,
             traceId,
         });
@@ -1121,7 +1137,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
     // a ponder packet created the return obligation in this turn.
     let noToolCallRetries = 0;
     const NO_TOOL_CALL_MAX_RETRIES = 2;
-    let unresolvedHistoricalEffects = historicalFailedEffectsForExactRepeatedRequest(messages);
+    let unresolvedHistoricalEffects = [];
     let historicalToolFailureRetries = 0;
     let providerIterations = 0;
     const requiredToolCallNames = [...new Set(options?.requiredToolCalls?.names ?? [])];
@@ -1189,38 +1205,62 @@ async function runAgent(messages, callbacks, channel, signal, options) {
         require("events").setMaxListeners(50, signal);
     }
     catch { /* unsupported */ }
-    const toolPreferences = currentContext?.friend?.toolPreferences;
-    const unboundBaseTools = options?.tools ?? (0, tools_1.getToolsForChannel)(channel ? (0, friends_1.getChannelCapabilities)(channel) : undefined, toolPreferences && Object.keys(toolPreferences).length > 0 ? toolPreferences : undefined, currentContext, providerRuntime.capabilities, options?.mcpManager, providerRuntime.model);
-    const relationshipToolNames = options?.toolContext?.relationshipAuthorization?.advertisedToolNames;
-    const relationshipScopedTools = relationshipToolNames
-        ? unboundBaseTools.filter((tool) => relationshipToolNames.includes(tool.function.name))
-        : unboundBaseTools;
-    const baseTools = bindCurrentIngressEvidenceLocator(relationshipScopedTools, options?.toolContext?.currentIngressEvidence);
-    // Augment tool context with reasoning effort controls from provider
-    const baseToolContext = options?.toolContext
-        ?? (turnOrientationFrame ? { signin: async () => undefined, orientationFrame: turnOrientationFrame } : undefined);
-    const habitSession = options?.habitSession ?? baseToolContext?.habitSession;
-    const augmentedToolContext = baseToolContext
-        ? {
+    try {
+        const toolPreferences = currentContext?.friend?.toolPreferences;
+        const filterTrustedTools = (tools, selected) => tools.filter((tool) => !selected.engine.some((engine) => engine.function.name === tool.function.name)
+            && (channel !== "inner" || options?.toolProfile === "sanctuary-health-private" || !["send_message", "surface"].includes(tool.function.name)
+                || selected.ordinary.some((definition) => definition.tool.function.name === tool.function.name)));
+        const selectCurrentTools = () => {
+            if (options?.hardDisableTools)
+                return Object.freeze({ ordinary: Object.freeze([]), engine: Object.freeze([]) });
+            const selected = (0, tools_1.selectToolsForChannel)(channel ? (0, friends_1.getChannelCapabilities)(channel) : undefined, toolPreferences, currentContext, providerRuntime.capabilities, options?.mcpManager, providerRuntime.model, { ...options?.toolContext, ...(options?.habitSession ? { habitSession: options.habitSession } : {}) });
+            const ordinary = options?.tools !== undefined && !options.toolContext?.relationshipAuthorization
+                ? filterTrustedTools(options.tools, selected).flatMap((tool) => {
+                    const definition = (0, tools_1.resolveToolDefinition)(tool.function.name, selected) ?? (0, tools_1.resolveToolDefinition)(tool.function.name);
+                    return definition ? [{ ...definition, tool }] : [];
+                })
+                : selected.ordinary;
+            const bound = bindCurrentIngressEvidenceLocator(ordinary.map((definition) => definition.tool), options?.toolContext?.currentIngressEvidence);
+            return Object.freeze({
+                ordinary: Object.freeze(ordinary.map((definition, index) => definition.tool === bound[index]
+                    ? definition : Object.freeze({ ...definition, tool: bound[index] }))),
+                engine: selected.engine,
+            });
+        };
+        let toolSelection = selectCurrentTools();
+        const relationship = options?.toolContext?.relationshipAuthorization;
+        if (!options?.hardDisableTools && options?.tools !== undefined) {
+            if (relationship) {
+                toolSelection = (0, tools_1.reduceToolSelection)(toolSelection, options.tools);
+            }
+        }
+        const unboundBaseTools = !options?.hardDisableTools && !relationship && options?.tools
+            ? filterTrustedTools(options.tools, toolSelection)
+            : toolSelection.ordinary.map((definition) => definition.tool);
+        const relationshipToolNames = options?.toolContext?.relationshipAuthorization?.advertisedToolNames;
+        const relationshipScopedTools = relationshipToolNames
+            ? unboundBaseTools.filter((tool) => relationshipToolNames.includes(tool.function.name))
+            : unboundBaseTools;
+        const baseTools = bindCurrentIngressEvidenceLocator(relationshipScopedTools, options?.toolContext?.currentIngressEvidence);
+        // Augment tool context with reasoning effort controls from provider
+        const baseToolContext = options?.toolContext
+            ?? { signin: async () => undefined, ...(turnOrientationFrame ? { orientationFrame: turnOrientationFrame } : {}) };
+        const habitSession = options?.habitSession ?? baseToolContext?.habitSession;
+        const augmentedToolContext = {
             ...baseToolContext,
             supportedReasoningEfforts: providerRuntime.supportedReasoningEfforts,
             setReasoningEffort: (level) => { currentReasoningEffort = level; },
             activeWorkFrame: options?.activeWorkFrame,
             orientationFrame: turnOrientationFrame ?? baseToolContext.orientationFrame,
             ...(habitSession ? { habitSession } : {}),
-        }
-        : habitSession
-            ? {
-                signin: async () => undefined,
-                habitSession,
-                supportedReasoningEfforts: providerRuntime.supportedReasoningEfforts,
-                setReasoningEffort: (level) => { currentReasoningEffort = level; },
-            }
-            : undefined;
-    // Rebase provider-owned turn state from canonical messages at user-turn start.
-    // This prevents stale provider caches from replaying prior-turn context.
-    providerRuntime.resetTurnState(messages);
-    try {
+            toolSelection,
+            selectCurrentTools,
+        };
+        const trustedToolContext = options?.toolContext || turnOrientationFrame || habitSession ? augmentedToolContext : undefined;
+        unresolvedHistoricalEffects = historicalFailedEffectsForExactRepeatedRequest(messages, toolSelection);
+        // Rebase provider-owned turn state from canonical messages at user-turn start.
+        // This prevents stale provider caches from replaying prior-turn context.
+        providerRuntime.resetTurnState(messages);
         while (!done) {
             // Channel-based tool filtering:
             // - Private runtime: exclude send_message (delivery via surface), observe (no one to observe)
@@ -1231,23 +1271,9 @@ async function runAgent(messages, callbacks, channel, signal, options) {
             // Private runtime gets restTool instead of settleTool (rest = end turn, gated by attention queue).
             // toolChoiceRequired only controls whether tool_choice: "required" is set in the API call.
             const isPrivateRuntimeChannel = channel === "inner";
-            const privateRuntimeHabitCanSendMessage = isPrivateRuntimeChannel
-                && habitSession?.toolPolicy.outwardMessagingAllowed === true
-                && habitSession.toolPolicy.grantedTools.includes("send_message");
-            const privateRuntimeHabitCanSurface = isPrivateRuntimeChannel
-                && (!habitSession || (habitSession.toolPolicy.outwardMessagingAllowed === true
-                    && habitSession.toolPolicy.grantedTools.includes("surface")));
-            const filteredBaseTools = isPrivateRuntimeChannel
-                ? baseTools.filter((t) => privateRuntimeHabitCanSendMessage || t.function.name !== "send_message")
-                : baseTools;
             const unscopedOrdinaryActiveTools = [
-                ...filteredBaseTools,
-                ...(augmentedToolContext?.noSend === true ? [] : [tools_1.ponderTool]),
-                ...(isPrivateRuntimeChannel && privateRuntimeHabitCanSurface ? [tools_2.surfaceToolDef] : []),
-                ...(isPrivateRuntimeChannel ? [tools_1.restTool] : []),
-                ...(!isPrivateRuntimeChannel ? [tools_1.observeTool] : []),
-                ...(!isPrivateRuntimeChannel ? [tools_1.settleTool] : []),
-                ...(isChatStyleChannel(channel ?? "") ? [tools_1.speakTool] : []),
+                ...baseTools,
+                ...toolSelection.engine,
             ];
             const ordinaryActiveTools = relationshipToolNames
                 ? unscopedOrdinaryActiveTools.filter((tool) => relationshipToolNames.includes(tool.function.name))
@@ -1325,7 +1351,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                     callbacks.onModelStart();
                     turnCallbackBufferRef.current = habitSession
                         ? createHabitCallbackBuffer(callbacks)
-                        : callbacks.settleOutputMode === "final_only"
+                        : callbacks.settleOutputMode === "final_only" || relationship !== undefined
                             ? createFinalOnlyTextBuffer(callbacks)
                             : null;
                     try {
@@ -1390,18 +1416,19 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         const seconds = delayMs / 1000;
                         const cause = RETRY_LABELS[record.classification];
                         try {
+                            const agentName = owner?.agentName ?? (0, identity_2.getAgentName)();
                             if (record.provider === "openai-codex" && record.classification === "auth-failure") {
-                                await (0, openai_codex_token_1.refreshOpenAICodexProviderCredentials)((0, identity_2.getAgentName)(), {
+                                await (0, openai_codex_token_1.refreshOpenAICodexProviderCredentials)(agentName, {
                                     force: true,
                                     reason: "turn-auth-failure",
                                 });
                             }
-                            await (0, provider_credentials_1.refreshProviderCredentialPool)((0, identity_2.getAgentName)(), {
+                            await (0, provider_credentials_1.refreshProviderCredentialPool)(agentName, {
                                 preserveCachedOnFailure: true,
                                 providers: [record.provider],
                             });
                             _providerRuntimeFactories[facing] = null;
-                            providerRuntime = await getProviderRuntime(facing);
+                            providerRuntime = await getProviderRuntime(facing, owner);
                             providerRuntime.resetTurnState(attemptMessages);
                         }
                         catch (refreshError) {
@@ -1712,7 +1739,21 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         entry.call,
                         entry.validated.arguments,
                     ]));
-                    const habitBlockReason = await habitToolBatchBlockReason(habitSession, result.toolCalls, augmentedToolContext?.delegatedOrigins);
+                    const preflightRejections = new Map();
+                    for (const entry of validCalls) {
+                        if (!relationship && !toolSelection.engine.some((tool) => tool.function.name === entry.call.name))
+                            continue;
+                        const prepared = await (0, tools_1.preflightToolCall)(entry.call.name, validatedCallArguments.get(entry.call), augmentedToolContext);
+                        if (prepared.kind !== "ready")
+                            preflightRejections.set(entry.call.id, prepared.text);
+                    }
+                    if (preflightRejections.size > 0) {
+                        streamCallbackBuffer?.discard();
+                        rejectToolBatch(msg, result.toolCalls.map((call) => preflightRejections.get(call.id)
+                            ?? "rejected: another call in this batch failed current authorization; no handler was executed."));
+                        continue;
+                    }
+                    const habitBlockReason = await habitToolBatchBlockReason(habitSession, result.toolCalls, augmentedToolContext?.delegatedOrigins, toolSelection);
                     if (habitBlockReason) {
                         streamCallbackBuffer?.discard();
                         recordBlockedHabitSurfaceAttempts(habitSession, result.toolCalls, habitBlockReason);
@@ -1728,7 +1769,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         continue;
                     }
                     const soleViolation = result.toolCalls.length > 1
-                        ? result.toolCalls.find((call) => SOLE_CALL_REJECTION[call.name] !== undefined || (0, tools_1.resolveToolDefinition)(call.name)?.terminalProjection?.requiresSoleCall === true)
+                        ? result.toolCalls.find((call) => SOLE_CALL_REJECTION[call.name] !== undefined || (0, tools_1.resolveToolDefinition)(call.name, toolSelection)?.terminalProjection?.requiresSoleCall === true)
                         : undefined;
                     if (soleViolation) {
                         streamCallbackBuffer?.discard();
@@ -1740,7 +1781,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         ? result.toolCalls[0]
                         : null;
                     const soleTerminalProjection = soleTerminalCall
-                        ? (0, tools_1.resolveToolDefinition)(soleTerminalCall.name)?.terminalProjection
+                        ? (0, tools_1.resolveToolDefinition)(soleTerminalCall.name, toolSelection)?.terminalProjection
                         : undefined;
                     if (soleTerminalCall && soleTerminalProjection?.mode === "verbatim") {
                         const terminalArgs = validatedCallArguments.get(soleTerminalCall);
@@ -1755,29 +1796,30 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             callbacks.onClearText?.();
                         callbacks.onToolStart(soleTerminalCall.name, terminalArgs);
                         let terminalResult;
+                        let terminalSucceeded = false;
                         try {
-                            const execToolFn = options?.execTool ?? tools_1.execTool;
-                            terminalResult = await execToolFn(soleTerminalCall.name, terminalArgs, augmentedToolContext);
+                            if (options?.execTool && !relationship) {
+                                terminalResult = await options.execTool(soleTerminalCall.name, terminalArgs, trustedToolContext);
+                                terminalSucceeded = true;
+                            }
+                            else {
+                                const execution = await (0, tools_1.executeTool)(soleTerminalCall.name, terminalArgs, augmentedToolContext, options?.execTool);
+                                terminalResult = "error" in execution
+                                    ? `error: ${execution.error instanceof Error ? execution.error.message : String(execution.error)}`
+                                    : execution.text;
+                                terminalSucceeded = execution.kind === "handler_succeeded";
+                            }
                         }
                         catch (error) {
-                            callbacks.onToolEnd(soleTerminalCall.name, (0, tools_1.summarizeArgs)(soleTerminalCall.name, terminalArgs), false);
-                            pushGenerated(msg);
-                            const failure = error instanceof Error ? `error: ${error.message}` : `error: ${String(error)}`;
-                            pushGenerated({ role: "tool", tool_call_id: soleTerminalCall.id, content: failure });
-                            providerRuntime.appendToolOutput(soleTerminalCall.id, failure);
-                            callbacks.onTextChunk(failure);
-                            completion = { answer: failure, intent: "blocked" };
-                            outcome = "blocked";
-                            done = true;
-                            continue;
+                            terminalResult = error instanceof Error ? `error: ${error.message}` : `error: ${String(error)}`;
                         }
-                        callbacks.onToolEnd(soleTerminalCall.name, (0, tools_1.summarizeArgs)(soleTerminalCall.name, terminalArgs), true);
+                        callbacks.onToolEnd(soleTerminalCall.name, (0, tools_1.summarizeArgs)(soleTerminalCall.name, terminalArgs, toolSelection), terminalSucceeded);
                         pushGenerated(msg);
                         pushGenerated({ role: "tool", tool_call_id: soleTerminalCall.id, content: terminalResult });
                         providerRuntime.appendToolOutput(soleTerminalCall.id, terminalResult);
                         callbacks.onTextChunk(terminalResult);
-                        completion = { answer: terminalResult, intent: "complete" };
-                        outcome = "settled";
+                        completion = { answer: terminalResult, intent: terminalSucceeded ? "complete" : "blocked" };
+                        outcome = terminalSucceeded ? "settled" : "blocked";
                         done = true;
                         continue;
                     }
@@ -1788,7 +1830,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         const requiredToolCallsGate = pendingRequiredToolCalls();
                         if (requiredToolCallsGate) {
                             streamCallbackBuffer?.discard();
-                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs), false);
+                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), false);
                             callbacks.onClearText?.();
                             queueRequiredCorrection(msg, requiredToolCallsGate.message, "before required tool calls completed");
                             (0, runtime_1.emitNervesEvent)({
@@ -1804,7 +1846,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         const attentionQueue = augmentedToolContext?.delegatedOrigins;
                         if (isPrivateRuntimeChannel && attentionQueue && attentionQueue.length > 0) {
                             streamCallbackBuffer?.discard();
-                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs), false);
+                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), false);
                             callbacks.onClearText?.();
                             const gateMessage = "current held-work frame still has unsurfaced items — return each listed item with surface(delegationId=...) before you settle. Older transcript claims are historical; only the current held-work frame is the gate.";
                             rejectToolBatch(msg, [gateMessage]);
@@ -1816,7 +1858,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         const requiredAnswerRejection = options?.requiredToolCalls?.validateTerminalAnswer?.(answer);
                         if (requiredAnswerRejection) {
                             streamCallbackBuffer?.discard();
-                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs), false);
+                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), false);
                             callbacks.onClearText?.();
                             queueRequiredCorrection(msg, requiredAnswerRejection, "before required terminal answer validation completed");
                             (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.required_tool_answer_rejected", message: "unsupported settle answer rejected after required reads", meta: { answerLength: answer.length } });
@@ -1825,7 +1867,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         // Private-runtime settle: no CompletionMetadata, "(settled)" ack
                         if (isPrivateRuntimeChannel) {
                             streamCallbackBuffer?.discard();
-                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs), true);
+                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), true);
                             pushGenerated(msg);
                             const settled = "(settled)";
                             pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: settled });
@@ -1854,12 +1896,12 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                                 await streamCallbackBuffer?.flush();
                             }
                             catch (error) {
-                                callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs), false);
+                                callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), false);
                                 streamCallbackBuffer?.discard();
                                 finishTerminalProviderError(new streaming_1.SettleFinalizationCallbackError(error), "unknown");
                                 continue;
                             }
-                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs), true);
+                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), true);
                             completion = {
                                 answer: deliveredAnswer,
                                 intent: validDirectReply ? "direct_reply" : intent === "blocked" ? "blocked" : "complete",
@@ -1884,7 +1926,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             // The payload is structurally final, but a semantic continuation
                             // gate rejected it. Return that exact gate reason to the model.
                             streamCallbackBuffer?.discard();
-                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs), false);
+                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), false);
                             callbacks.onClearText?.();
                             rejectToolBatch(msg, [retryError]);
                         }
@@ -1905,7 +1947,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             message: "agent observed without responding",
                             meta: { ...(reason ? { reason } : {}) },
                         });
-                        callbacks.onToolEnd("observe", (0, tools_1.summarizeArgs)("observe", observeArgs), true);
+                        callbacks.onToolEnd("observe", (0, tools_1.summarizeArgs)("observe", observeArgs, toolSelection), true);
                         pushGenerated(msg);
                         const silenced = "(silenced)";
                         pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: silenced });
@@ -1923,14 +1965,14 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         // Attention queue gate: reject rest if items remain
                         const attentionQueue = augmentedToolContext?.delegatedOrigins;
                         if (attentionQueue && attentionQueue.length > 0) {
-                            callbacks.onToolEnd("rest", (0, tools_1.summarizeArgs)("rest", restArgs), false);
+                            callbacks.onToolEnd("rest", (0, tools_1.summarizeArgs)("rest", restArgs, toolSelection), false);
                             const gateMessage = "current held-work frame still has unsurfaced items — return each listed item with surface(delegationId=...) before you rest. Older transcript claims are historical; only the current held-work frame is the gate.";
                             rejectToolBatch(msg, [gateMessage]);
                             continue;
                         }
                         if (hasFreshPendingWork(options) && !freshWorkGateFired) {
                             freshWorkGateFired = true;
-                            callbacks.onToolEnd("rest", (0, tools_1.summarizeArgs)("rest", restArgs), false);
+                            callbacks.onToolEnd("rest", (0, tools_1.summarizeArgs)("rest", restArgs, toolSelection), false);
                             const gateMessage = "fresh work arrived for me this turn — inspect the pending messages above and take the next concrete action before you rest.";
                             rejectToolBatch(msg, [gateMessage]);
                             (0, runtime_1.emitNervesEvent)({
@@ -1942,7 +1984,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             });
                             continue;
                         }
-                        callbacks.onToolEnd("rest", (0, tools_1.summarizeArgs)("rest", restArgs), true);
+                        callbacks.onToolEnd("rest", (0, tools_1.summarizeArgs)("rest", restArgs, toolSelection), true);
                         pushGenerated(msg);
                         const ack = "(resting)";
                         pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: ack });
@@ -1968,7 +2010,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         streamCallbackBuffer?.discard();
                         for (const rejection of requiredDispatchRejections.values()) {
                             callbacks.onToolStart(rejection.name, rejection.args);
-                            callbacks.onToolEnd(rejection.name, (0, tools_1.summarizeArgs)(rejection.name, rejection.args), false);
+                            callbacks.onToolEnd(rejection.name, (0, tools_1.summarizeArgs)(rejection.name, rejection.args, toolSelection), false);
                             options?.toolBoundaryObserver?.({
                                 name: rejection.name, reason: "dependency_rejected",
                                 globallyResolvable: typeof (0, tools_1.resolveToolDefinition)(rejection.name)?.handler === "function",
@@ -1987,7 +2029,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                     const executionRejections = new Map();
                     for (const entry of validCalls) {
                         const args = validatedCallArguments.get(entry.call);
-                        const fingerprint = effectFingerprint(entry.call.name, entry.call.arguments);
+                        const fingerprint = effectFingerprint(entry.call.name, entry.call.arguments, toolSelection);
                         if (forcingHistoricalEffect && fingerprint && !unresolvedHistoricalEffects.some((effect) => effect.fingerprint === fingerprint)) {
                             executionRejections.set(entry.call.id, "rejected: this turn is retrying an unresolved historical effect, and these mutation arguments do not match it. Read current state or retry the exact failed effect.");
                         }
@@ -2007,7 +2049,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                                 continue;
                             const args = validatedCallArguments.get(entry.call);
                             callbacks.onToolStart(entry.call.name, args);
-                            callbacks.onToolEnd(entry.call.name, (0, tools_1.summarizeArgs)(entry.call.name, args), false);
+                            callbacks.onToolEnd(entry.call.name, (0, tools_1.summarizeArgs)(entry.call.name, args, toolSelection), false);
                         }
                         rejectToolBatch(msg, result.toolCalls.map((call) => executionRejections.get(call.id)
                             ?? "rejected: another call in this batch was inadmissible; no handler was executed."));
@@ -2048,11 +2090,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             continue;
                         }
                         streamCallbackBuffer?.discard();
-                        const toolDigest = (0, tool_arguments_1.digestJson)({
-                            name: protectedCall.call.name,
-                            schemaDigest: protectedCall.validated.schemaDigest,
-                            policyId: protectedCall.policy.policyId,
-                        });
+                        const toolDigest = (0, tool_approval_1.digestApprovalToolDefinition)((0, tools_1.resolveToolDefinition)(protectedCall.call.name, toolSelection), protectedCall.validated.schemaDigest, protectedCall.policy.policyId);
                         const policyDigest = (0, tool_arguments_1.digestJson)({
                             policyId: protectedCall.policy.policyId,
                             actionClass: protectedCall.policy.actionClass,
@@ -2094,7 +2132,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         if (signal?.aborted)
                             break;
                         const args = validatedCallArguments.get(tc);
-                        const currentEffectFingerprint = effectFingerprint(tc.name, tc.arguments);
+                        const currentEffectFingerprint = effectFingerprint(tc.name, tc.arguments, toolSelection);
                         if (tc.name === "send_message" && args.friendId === "self") {
                             sawSendMessageSelf = true;
                         }
@@ -2102,7 +2140,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             // The canonical pre-batch schema gate guarantees a required string.
                             const speakArgs = JSON.parse(tc.arguments);
                             const speakMessage = speakArgs.message;
-                            const argSummary = (0, tools_1.summarizeArgs)("speak", { message: speakMessage });
+                            const argSummary = (0, tools_1.summarizeArgs)("speak", { message: speakMessage }, toolSelection);
                             callbacks.onToolStart("speak", { message: speakMessage });
                             if (speakMessage.trim().length === 0) {
                                 const err = "speak requires a non-empty `message` string.";
@@ -2154,7 +2192,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         }
                         if (tc.name === "ponder") {
                             const parsedArgs = normalizeLegacyPonderArgs(parsePonderPayload(tc.arguments));
-                            const argSummary = (0, tools_1.summarizeArgs)(tc.name, parsedArgs);
+                            const argSummary = (0, tools_1.summarizeArgs)(tc.name, parsedArgs, toolSelection);
                             callbacks.onToolStart(tc.name, parsedArgs);
                             let toolResult;
                             let success = false;
@@ -2320,19 +2358,28 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         callbacks.onToolStart(tc.name, args);
                         let toolResult;
                         let success;
+                        let invoked = false;
                         try {
-                            const execToolFn = options?.execTool ?? tools_1.execTool;
                             const routineActionSelection = approvalCalls.find((entry) => entry.call.id === tc.id)?.routineActionSelection;
                             const executionToolContext = routineActionSelection && augmentedToolContext ? { ...augmentedToolContext, routineActionSelection } : augmentedToolContext;
-                            if (requiredToolCallNames.includes(tc.name) && !options?.requiredToolCalls?.requireSuccessfulResults)
-                                dispatchedRequiredToolCalls.add(tc.name);
-                            toolResult = await execToolFn(tc.name, args, executionToolContext);
-                            success = true;
+                            if (options?.execTool && !relationship) {
+                                invoked = true;
+                                toolResult = await options.execTool(tc.name, args, trustedToolContext);
+                                success = true;
+                            }
+                            else {
+                                const execution = await (0, tools_1.executeTool)(tc.name, args, executionToolContext, options?.execTool);
+                                invoked = execution.kind !== "rejected_before_handler";
+                                success = execution.kind === "handler_succeeded";
+                                toolResult = "error" in execution ? `error: ${execution.error}` : execution.text;
+                            }
                         }
                         catch (e) {
                             toolResult = `error: ${e}`;
                             success = false;
                         }
+                        if (invoked && requiredToolCallNames.includes(tc.name) && !options?.requiredToolCalls?.requireSuccessfulResults)
+                            dispatchedRequiredToolCalls.add(tc.name);
                         const modelResult = (0, tool_friction_1.rewriteToolResultForModel)(tc.name, toolResult, toolFrictionLedger);
                         pushGenerated({ role: "tool", tool_call_id: tc.id, content: modelResult });
                         providerRuntime.appendToolOutput(tc.id, modelResult);
@@ -2355,17 +2402,17 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         if (success && currentEffectFingerprint && !toolResultIndicatesFailure(toolResult)) {
                             unresolvedHistoricalEffects = unresolvedHistoricalEffects.filter((effect) => effect.fingerprint !== currentEffectFingerprint);
                         }
-                        const resolvedRiskProfile = (0, tools_1.resolveToolDefinition)(tc.name)?.riskProfile;
+                        const resolvedRiskProfile = (0, tools_1.resolveToolDefinition)(tc.name, toolSelection)?.riskProfile;
                         const toolRiskProfile = typeof resolvedRiskProfile === "function" ? resolvedRiskProfile(args) : resolvedRiskProfile;
                         options?.toolBoundaryObserver?.({
                             name: tc.name,
                             reason: "dispatched",
-                            globallyResolvable: typeof (0, tools_1.resolveToolDefinition)(tc.name)?.handler === "function",
-                            invoked: true,
+                            globallyResolvable: typeof (0, tools_1.resolveToolDefinition)(tc.name, toolSelection)?.handler === "function",
+                            invoked,
                             sideEffect: success && toolRiskProfile?.mutates !== "none",
                         });
                         (0, tool_loop_1.recordToolOutcome)(toolLoopState, tc.name, args, modelResult, success);
-                        callbacks.onToolEnd(tc.name, (0, tools_1.buildToolResultSummary)(tc.name, args, modelResult, success), success);
+                        callbacks.onToolEnd(tc.name, (0, tools_1.buildToolResultSummary)(tc.name, args, modelResult, success, toolSelection), success);
                         callbacks.onToolResult?.(messages);
                     }
                 }
@@ -2391,6 +2438,11 @@ async function runAgent(messages, callbacks, channel, signal, options) {
             }
         }
     }
+    catch (error) {
+        if (!(error instanceof tools_1.ToolSelectionError))
+            throw error;
+        finishTerminalProviderError(error, "unknown");
+    }
     finally {
         nextAttemptControls = [];
         rejectedAttempt = [];