@rebon/cli-darwin-arm64 0.17.2 → 0.18.0

package/bin/compose-runtime/src/registry.mjs

@@ -0,0 +1,191 @@
+// What one Cordis entry registered, captured while it mounts.
+//
+// A Cordis plugin does not know the plugin plane exists: it calls
+// `ctx.tools.register(...)`, `ctx.llm.registerAdapter(...)`,
+// `ctx.systemPrompt.section(...)`, and the seats it calls are the ones that
+// have to turn those into something `plugin/load` can answer with. This is
+// where they put it.
+//
+// The sink reaches a seat through the registering context — `ctx[SINK]`, set
+// when the entry's context is derived — for the same reason the old ledger's
+// owner stamp did: it is read synchronously at registration time, so an async
+// interleaving cannot attribute one plugin's registration to another.
+//
+// Two rules it enforces, both borrowed from the host's own registrar because a
+// composition entry is a plugin and should not get a weaker contract:
+//
+//   * **Declared first.** A registration the load request did not declare is
+//     refused where the plugin made it, rather than arriving later as a ready
+//     report rebon has to reject.
+//   * **Registration closes.** Once the entry's fiber has resolved, the host
+//     has already been told what this plugin provides; a later registration
+//     would be a capability nothing downstream knows about.
+
+/** The key an entry's context carries its sink under. */
+export const SINK = Symbol.for('rebon.composeSink');
+/** The key an entry's context carries its plugin id under. */
+export const OWNER = Symbol.for('rebon.composeOwner');
+
+class RegistrationError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = 'RegistrationError';
+  }
+}
+
+export class RegistrationSink {
+  #sealed = false;
+
+  constructor(pluginId, declared = {}) {
+    this.pluginId = pluginId;
+    this.declared = {
+      services: new Set(declared.services ?? []),
+      eventTopics: new Set(declared.eventTopics ?? []),
+      llmProviders: new Set(declared.llmProviders ?? []),
+      tools: new Set(declared.tools ?? []),
+    };
+    /** Protocol-shaped registrations, answered by `plugin/load`. */
+    this.services = new Map();
+    this.topics = new Map();
+    this.llmProviders = new Map();
+    this.tools = new Map();
+    /** Handles on a session, handed out when a scope opens. */
+    this.scopeHandlers = [];
+    /** The sessions this plugin is currently attached to.
+     *
+     *  Every entry gets one of these, not just the ones that ask: it is how a
+     *  seat reaches rebon on behalf of code running outside any inbound call.
+     *  An agent loop drives its own turn, and the adapter it reaches for a
+     *  credential is running on the loop's schedule rather than answering
+     *  anything — but it is still that plugin's code, in that session, and the
+     *  call it makes should say so. */
+    this.sessions = new Set();
+    this.scopeHandlers.push((scopeCtx) => {
+      this.sessions.add(scopeCtx);
+      return () => this.sessions.delete(scopeCtx);
+    });
+    /** Facts with no protocol counterpart, fetched from the `compose` service. */
+    this.sections = [];
+    this.catalogs = new Map();
+    this.webProviders = [];
+  }
+
+  #admit(kind, name, declared) {
+    if (this.#sealed) {
+      throw new RegistrationError(
+        '[REGISTRATION_CLOSED]',
+        `${kind} ${JSON.stringify(name)} was registered after ${this.pluginId} finished loading`,
+      );
+    }
+    if (typeof name !== 'string' || name.length === 0) {
+      throw new RegistrationError('[WRONG_SHAPE]', `a ${kind} needs a non-empty name`);
+    }
+    if (!declared.has(name)) {
+      throw new RegistrationError(
+        '[UNAUTHORIZED_REGISTER]',
+        `${kind} ${JSON.stringify(name)} is not declared by ${this.pluginId}'s manifest`,
+      );
+    }
+  }
+
+  service(name, handler) {
+    this.#admit('service', name, this.declared.services);
+    this.services.set(name, handler);
+  }
+
+  topic(name, handler) {
+    this.#admit('topic', name, this.declared.eventTopics);
+    this.topics.set(name, handler);
+  }
+
+  llm(provider, handler) {
+    this.#admit('provider', provider, this.declared.llmProviders);
+    this.llmProviders.set(provider, handler);
+  }
+
+  tool(definition, handler) {
+    this.#admit('tool', definition?.name, this.declared.tools);
+    this.tools.set(definition.name, { definition, handler });
+  }
+
+  /// A handle on the session, for a plugin that acts rather than only answers.
+  ///
+  /// Not declared, because it is not a capability: every power the handle
+  /// carries is one of the declarations above, checked when it is used.
+  scope(handler) {
+    if (typeof handler !== 'function') {
+      throw new RegistrationError('[WRONG_SHAPE]', 'a scope handler must be a function');
+    }
+    this.scopeHandlers.push(handler);
+  }
+
+  // ---- extras ----------------------------------------------------------
+  //
+  // A model catalog, a prompt section and a web provider are things rebon
+  // needs and the protocol has no field for. They are reported by the
+  // composition's own `compose` service rather than by widening the ready
+  // report, which every plugin shares and only this one would use.
+
+  section(entry) {
+    this.sections.push(entry);
+  }
+
+  catalog(provider, catalog) {
+    this.catalogs.set(provider, catalog);
+  }
+
+  webProvider(kind, id, available) {
+    this.webProviders.push({ kind, id, available });
+  }
+
+  /// Closes registration and hands back what the host asked for.
+  seal() {
+    this.#sealed = true;
+    return this;
+  }
+
+  /// The `plugin/load` answer, in the shape the host's own loader produces.
+  loaded() {
+    return {
+      services: [...this.services.keys()],
+      eventTopics: [...this.topics.keys()],
+      llmProviders: [...this.llmProviders.keys()],
+      tools: [...this.tools.values()].map((entry) => entry.definition),
+      serviceHandlers: this.services,
+      topicHandlers: this.topics,
+      llmAdapters: this.llmProviders,
+      toolHandlers: new Map([...this.tools].map(([name, entry]) => [name, entry.handler])),
+      scopeHandlers: [...this.scopeHandlers],
+    };
+  }
+
+  /// What the `compose` service reports for this plugin.
+  report() {
+    return {
+      sections: this.sections.map((section) => ({ ...section })),
+      providers: [...this.catalogs].map(([provider, catalog]) => ({ provider, ...catalog })),
+      webProviders: this.webProviders.map((entry) => ({ ...entry })),
+    };
+  }
+}
+
+/// The session this plugin is attached to, if it is attached to one.
+///
+/// With more than one open, the first is used: a plugin acting on its own
+/// schedule is acting in one session, and which one is a fact about how rebon
+/// opened them rather than something guessable here.
+export function sessionOf(ctx) {
+  const sink = ctx?.[SINK];
+  if (sink === undefined) return undefined;
+  for (const session of sink.sessions) return session;
+  return undefined;
+}
+
+/// The sink the code currently registering belongs to, or undefined.
+///
+/// Undefined is normal: the built-in seats mount into the realm itself, and a
+/// seat calling another seat is not a registration by any plugin.
+export function sinkOf(ctx) {
+  return ctx?.[SINK];
+}

package/bin/compose-runtime/src/resolve.mjs

@@ -0,0 +1,115 @@
+// Module resolution for the composition, on real Node.
+//
+// Node has no import map, but it has `module.registerHooks()` — synchronous,
+// in-thread resolve/load hooks — and this is the composition's map written in
+// that vocabulary. There used to be a second map, in the deno_core host's
+// `build_import_map`, and a test here holding the two to the same specifier
+// set; that host is gone, so this is the only map there is.
+//
+// Two entries it does not carry, both from the deleted one and both in the
+// direction of deleting code:
+//
+//   * the four `node:` entries. `node:async_hooks`, `node:util/types`,
+//     `node:path` and `node:crypto` resolved to hand-written shims because bare
+//     deno_core has no standard library; real Node has all four.
+//   * `eventsource-parser/stream` resolves to this package's module rather than
+//     the vendored one. The vendored build is not the published package: it was
+//     rewritten against the "Mini streams" protocol the old host installed,
+//     because the published `EventSourceParserStream` extends the WHATWG
+//     `TransformStream` and bare deno_core has none. On real Node that
+//     rewrite breaks — `body.pipeThrough(new EventSourceParserStream())` throws
+//     `ERR_INVALID_ARG_TYPE` — so the upstream shape comes back. See
+//     `eventsource-stream.mjs`.
+import { registerHooks } from 'node:module';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { payloadDir } from './payload.mjs';
+
+/// Payload-relative module map, keyed by bare specifier.
+///
+/// Mirrors `build_import_map` entry for entry, minus the `node:` shims.
+export function payloadModules(dir) {
+  const at = (relative) => pathToFileURL(path.join(dir, relative)).href;
+  return new Map(Object.entries({
+    cordis: at('vendor/cordis/index.js'),
+    cosmokit: at('vendor/cosmokit/index.mjs'),
+    schemastery: at('vendor/schemastery/index.mjs'),
+    '@deepseek-ai/cordis': at('vendor/cordis/index.js'),
+    '@deepseek-ai/cosmokit': at('vendor/cosmokit/index.mjs'),
+    '@deepseek-ai/schemastery': at('vendor/schemastery/index.mjs'),
+    '@deepseek-ai/cordis-plugin-timer': at('vendor/dsh/timer.js'),
+    '@deepseek-ai/cordis-plugin-logger-console': at('vendor/dsh/logger-console.js'),
+    '@deepseek-ai/dsh-llm-deepseek': at('vendor/dsh/llm-deepseek.js'),
+    '@deepseek-ai/dsh-timeout': at('vendor/dsh/timeout.js'),
+    '@deepseek-ai/dsh-llm': at('compose/shims/dsh-llm.js'),
+    '@deepseek-ai/dsh-credentials': at('compose/shims/dsh-credentials.js'),
+    '@deepseek-ai/dsh-settings': at('compose/shims/dsh-settings.js'),
+    '@deepseek-ai/dsh-launch-environment': at('compose/shims/dsh-launch-environment.js'),
+    '@deepseek-ai/dsh-anonymous-user-id': at('compose/shims/dsh-anonymous-user-id.js'),
+    'eventsource-parser': at('vendor/eventsource-parser/index.js'),
+    '@deepseek-ai/dsh-tools': at('compose/shims/dsh-tools.js'),
+    '@deepseek-ai/dsh-tool-todo': at('vendor/dsh/tool-todo.js'),
+    zod: at('compose/shims/zod-lite.js'),
+    '@deepseek-ai/dsh-web': at('compose/shims/dsh-web.js'),
+    '@deepseek-ai/dsh-web-search-exa': at('vendor/dsh/web-search-exa.js'),
+    '@deepseek-ai/dsh-tool-web': at('vendor/dsh/tool-web.js'),
+    '@deepseek-ai/dsh-scope': at('vendor/dsh/scope.js'),
+    '@deepseek-ai/dsh-session': at('vendor/dsh/session.js'),
+    '@deepseek-ai/dsh-agent': at('vendor/dsh/agent.js'),
+    '@deepseek-ai/dsh-system-prompt': at('vendor/dsh/system-prompt.js'),
+    '@deepseek-ai/dsh-agent-loop': at('vendor/dsh/agent-loop.js'),
+  }));
+}
+
+/// Specifiers this package answers itself rather than from the payload.
+export function localModules() {
+  const at = (relative) => new URL(relative, import.meta.url).href;
+  return new Map(Object.entries({
+    rebon: at('./bridge.mjs'),
+    'eventsource-parser/stream': at('./eventsource-stream.mjs'),
+  }));
+}
+
+let installed;
+
+/// Installs the composition's module resolution, once per process.
+///
+/// `extraModules` is the embedder's own map (the `modules` half of a
+/// composition config: plugin name → absolute module file), which is how a
+/// plugin outside the vendored payload gets a name.
+///
+/// Returns the resolved map so callers can report what a specifier became
+/// without repeating the lookup rules.
+export function installModuleResolution({ dir = payloadDir(), extraModules = {} } = {}) {
+  const map = new Map([...payloadModules(dir), ...localModules()]);
+  for (const [name, file] of Object.entries(extraModules)) {
+    map.set(name, pathToFileURL(path.resolve(file)).href);
+  }
+  if (installed) {
+    // Hooks are process-wide and cannot be unregistered per call; re-running
+    // with a different map would leave two resolvers disagreeing about the
+    // same specifier, which is a debugging trap rather than a feature.
+    for (const [name, url] of map) installed.map.set(name, url);
+    return installed.map;
+  }
+
+  const payloadPrefix = pathToFileURL(dir.endsWith(path.sep) ? dir : dir + path.sep).href;
+  const state = { map };
+  registerHooks({
+    resolve(specifier, context, next) {
+      const mapped = state.map.get(specifier);
+      if (mapped !== undefined) return { url: mapped, format: 'module', shortCircuit: true };
+      return next(specifier, context);
+    },
+    // The payload's ESM is `.js` under no `package.json`, so Node's own rules
+    // read it as CommonJS and every `import` in it is a syntax error. The
+    // deno_core loader had no such ambiguity — everything it loaded was a
+    // module — so this is a fact about Node, not about the payload.
+    load(url, context, next) {
+      if (url.startsWith(payloadPrefix)) return next(url, { ...context, format: 'module' });
+      return next(url, context);
+    },
+  });
+  installed = state;
+  return state.map;
+}

package/bin/compose-runtime/src/systemprompt-runtime.mjs

@@ -0,0 +1,67 @@
+// The composition's `ctx.systemPrompt` seat, on the plugin plane.
+//
+// Ported from `js/compose/systemprompt-runtime.js`. The dsh-facing surface is
+// unchanged: plugins call `ctx.systemPrompt.section({name, order, text})` and
+// get the exact disposer back, duplicate names throw dsh's message, non-finite
+// orders throw dsh's TypeError.
+//
+// What changed is where the section goes. It used to be
+// `callService('system-prompt', 'register', …)` — a synchronous call into a
+// kernel living in the same process, compensated by an `unregister` in the
+// disposer. Neither survives a process boundary: the call has to be awaited and
+// the disposer cannot await. So a section is *reported*: collected here, handed
+// to rebon with the rest of the load report, and withdrawn when the plugin
+// unloads.
+//
+// Deliberately NOT provided (v1 honesty boundary, unchanged): provider-function
+// `text` (dsh resolves it per assembly with an AssembleContext this side does
+// not have — a static composition registers static text), `complete` sections
+// (replacing rebon's own prompt belongs to the loop seat, not a side door),
+// `context()` / variables / tool-order surfaces. All fail loudly rather than
+// silently degrade.
+import { Service } from 'cordis';
+import { sinkOf } from './registry.mjs';
+
+export default class RebonSystemPromptRuntime extends Service {
+  constructor(ctx) {
+    super(ctx, 'systemPrompt');
+    this.names = new Set();
+  }
+
+  /** Register one ordered prompt section; returns the exact disposer. */
+  section(entry) {
+    const name = entry?.name;
+    if (typeof name !== 'string' || name.trim().length === 0) {
+      throw new TypeError('systemPrompt.section: section.name must be a non-empty string');
+    }
+    if (!Number.isFinite(entry.order)) {
+      throw new TypeError(`prompt section "${name}" order must be a finite number`);
+    }
+    if (typeof entry.text === 'function') {
+      throw new Error(
+        `prompt section "${name}": provider-function text is not supported in the composition (register static text)`,
+      );
+    }
+    if (typeof entry.text !== 'string') {
+      throw new TypeError(`prompt section "${name}" text must be a string`);
+    }
+    if (entry.complete) {
+      throw new Error(
+        `prompt section "${name}": complete-section replacement is not supported in the composition`,
+      );
+    }
+    if (this.names.has(name)) {
+      throw new Error(`prompt section "${name}" is already registered in this scope`);
+    }
+    const runtime = this;
+    // Caller-fork RAII through the Service proxy (llm/tools/web same pattern):
+    // the registering plugin's disposal takes the section with it.
+    sinkOf(this.ctx)?.section({ name, order: entry.order, text: entry.text });
+    return this.ctx.effect(() => {
+      runtime.names.add(name);
+      return () => {
+        runtime.names.delete(name);
+      };
+    });
+  }
+}

package/bin/compose-runtime/src/tools-runtime.mjs

@@ -0,0 +1,239 @@
+// The composition's `ctx.tools` seat, on the plugin plane.
+//
+// Ported from `js/compose/tools-runtime.js`. The dsh-facing surface is
+// unchanged: plugins call `ctx.tools.register(defineTool({...}))` and get the
+// exact disposer back, definitions arrive with `parameters` already compiled to
+// JSON Schema and argument validation baked into `execute`, and the loop drives
+// tools through the symbol-keyed scheduler contract.
+//
+// What changed:
+//
+//   * **The serve pump is gone.** `registerServeTarget(name, …)` and
+//     `op_tool_serve_next` are replaced by the tool being a *declared* tool of
+//     the loading plugin, called back through `tool/call`. A tool is offered to
+//     a model, so the registration carries the description and input schema
+//     rather than a name alone — which is what the plane needs anyway.
+//   * **`callService('tool-registry', 'register', …)` is gone.** The tool is
+//     reported by `plugin/load` and withdrawn by `plugin/unload` draining, so
+//     the compensating `unregister` a disposer used to make — and could not
+//     have made across a process boundary — has nothing left to compensate.
+//     Shadowing a builtin name is rebon's judgement to make and rebon's to log;
+//     the composition no longer hears about it, which is why the warning that
+//     used to be printed here is not.
+//   * **`exec.agent.session.append` publishes.** It was a kernel event emitted
+//     from inside the isolate; it is `event/emit` now, declared as
+//     `publishedTopics`, and it is the reason a tool-providing plugin declares
+//     `compose:session/append`.
+import { Service } from 'cordis';
+import { TOOL_RUNTIME_SCHEDULER } from '@deepseek-ai/dsh-tools';
+import { invokeTool, publish, withCall } from './bridge.mjs';
+import { sinkOf } from './registry.mjs';
+
+/** The topic a tool body's session writes land on. */
+export const SESSION_APPEND_TOPIC = 'compose:session/append';
+
+/** Extract a `[BRACKET_CODE]` prefix from a seat error message, if any. */
+function bracketCode(message) {
+  const match = /^\[([A-Z_]+)\]/.exec(message);
+  return match ? match[1] : undefined;
+}
+
+/** Per-run context/conclusion collection installed by scheduler.prepare. */
+const runStates = new WeakMap();
+
+export default class RebonToolsRuntime extends Service {
+  constructor(ctx) {
+    super(ctx, 'tools');
+    this.names = new Set();
+    // Local definition table for the scheduler's in-composition dispatch
+    // (register() below keeps it in step with what rebon was told).
+    this.defs = new Map();
+  }
+
+  /**
+   * dsh scheduler contract.
+   *
+   * agent-loop's tool-calls scheduler drives tools through this symbol-keyed
+   * view (dsh's private loop↔tools seam, contract transcribed from
+   * packages/core/tools/src/index.ts:451). Dispatch resolution: a
+   * composition-registered definition runs here; anything else goes to rebon's
+   * own tools through `tool/invoke`, whose refusals (stable bracketed codes)
+   * come back as error RESULTS for the model, not crashes. v1 honesty
+   * boundary: no pre/post-execute pipeline — prepare always dispatches,
+   * finalize/finish pass through.
+   *
+   * A getter rather than a field on purpose: read through the Cordis Service
+   * proxy, `this.ctx` is the *caller's* context — the loop plugin driving the
+   * turn. That is the identity a `tool/invoke` made on the loop's own schedule
+   * has to carry, and capturing it here is the only place it is still known.
+   */
+  get [TOOL_RUNTIME_SCHEDULER]() {
+    const runtime = this;
+    const via = this.ctx;
+    return {
+      async prepare(exec) {
+        const state = { contexts: [], concluded: false };
+        const run = {
+          ...exec,
+          rootCallId: exec.rootCallId ?? exec.callId,
+          deferContext(message) {
+            state.contexts.push(message);
+          },
+          concludeTurn() {
+            state.concluded = true;
+          },
+        };
+        runStates.set(run, state);
+        return { kind: 'dispatch', exec: run };
+      },
+      dispatch: (exec) => runtime._dispatch(exec, via),
+      async finalize(_exec, result) {
+        return result;
+      },
+      finish(_exec, result) {
+        return result;
+      },
+    };
+  }
+
+  async _dispatch(exec, via) {
+    const state = runStates.get(exec) ?? { contexts: [], concluded: false };
+    try {
+      const def = this.defs.get(exec.name);
+      let content;
+      if (def !== undefined) {
+        const value = await def.execute(exec.arguments, exec);
+        content = def.output.render(exec.arguments, value);
+      } else {
+        const value = await invokeTool(exec.name, exec.arguments ?? {}, { via });
+        content = [{
+          type: 'text',
+          text: typeof value === 'string' ? value : JSON.stringify(value),
+        }];
+      }
+      return {
+        kind: 'final-result',
+        result: {
+          content,
+          isError: false,
+          ...(state.contexts.length > 0 ? { additionalContexts: state.contexts } : {}),
+          ...(state.concluded ? { concludesTurn: true } : {}),
+        },
+      };
+    } catch (error) {
+      const message = String(error?.message ?? error);
+      return {
+        kind: 'final-result',
+        result: {
+          content: [{ type: 'text', text: `Error: ${message}` }],
+          isError: true,
+          error: {
+            message,
+            info: {
+              name: error?.name ?? 'Error',
+              code: error?.code ?? bracketCode(message) ?? 'TOOL_FAILED',
+            },
+          },
+        },
+      };
+    }
+  }
+
+  /**
+   * dsh concurrency classification. v1: everything is exclusive — strictly
+   * serial scheduling is always semantically correct, and it sidesteps the
+   * parallel pool until `isConcurrencySafe` mapping is wired.
+   */
+  executionMode(_exec) {
+    return { kind: 'exclusive' };
+  }
+
+  /**
+   * Register one dsh-shaped tool definition. Mirrors dsh
+   * `ToolRuntime.register` validation; returns the exact disposer.
+   */
+  register(definition) {
+    const name = definition?.name;
+    if (typeof name !== 'string' || name.trim().length === 0) {
+      throw new TypeError('tools.register: definition.name must be a non-empty string');
+    }
+    const output = definition.output;
+    if (
+      output === undefined || typeof output !== 'object'
+      || typeof output.render !== 'function'
+    ) {
+      throw new TypeError(`tool "${name}" must declare output { schema, render }`);
+    }
+    if (typeof definition.execute !== 'function') {
+      throw new TypeError(`tool "${name}" must declare execute()`);
+    }
+    const timeoutMs = definition.timeoutMs;
+    if (timeoutMs !== undefined && (!Number.isFinite(timeoutMs) || timeoutMs <= 0)) {
+      throw new TypeError(`tool "${name}" timeoutMs must be a positive finite number`);
+    }
+    if (this.names.has(name)) {
+      throw new Error(`tool "${name}" is already registered in this scope`);
+    }
+    const runtime = this;
+    // `this.ctx` is the CALLER's context through the Service proxy, so the
+    // registration is attributed to the plugin that made it and the effect
+    // unwinds when that plugin disposes — Cordis RAII, llm-runtime same
+    // pattern. Read synchronously: which plugin is registering is a fact
+    // about now, and an await would let another one interleave.
+    const sink = sinkOf(this.ctx);
+    sink?.tool(
+      {
+        name,
+        description: String(definition.description ?? ''),
+        inputSchema: definition.parameters ?? { type: 'object' },
+      },
+      (input, callCtx) => withCall(callCtx, () => runtime._execute(name, input, callCtx)),
+    );
+    return this.ctx.effect(() => {
+      runtime.names.add(name);
+      runtime.defs.set(name, definition);
+      return () => {
+        runtime.names.delete(name);
+        runtime.defs.delete(name);
+      };
+    });
+  }
+
+  /// Runs one registered tool for a `tool/call`.
+  ///
+  /// Resolved through the live table rather than closing over the definition:
+  /// a tool whose plugin disposed it is gone, and answering with a body that
+  /// is no longer registered would make disposal a lie.
+  async _execute(name, input, callCtx) {
+    const definition = this.defs.get(name);
+    if (definition === undefined) {
+      const error = new Error(`tool "${name}" is no longer registered in this composition`);
+      error.code = '[STALE_PROVIDER]';
+      throw error;
+    }
+    const callId = `compose:${callCtx.scopeId ?? 'scope'}:${name}`;
+    const exec = {
+      callId,
+      rootCallId: callId,
+      name,
+      arguments: input,
+      signal: callCtx.signal,
+      // dsh tools write per-session facts through `exec.agent.session.append`.
+      // On the plane that is a published event: the tool is telling rebon
+      // something happened, and rebon decides who hears it.
+      agent: {
+        session: {
+          append(type, data) {
+            void publish(SESSION_APPEND_TOPIC, { type, data, tool: name, callId })
+              .catch(() => {});
+          },
+        },
+      },
+    };
+    // defineTool's execute validates arguments first (ToolArgsError with
+    // INVALID_ARGS semantics flows out as this call's terminal).
+    const value = await definition.execute(input, exec);
+    const content = definition.output.render(input, value);
+    return { content, isError: false };
+  }
+}