@sema-agent/core 7.50.2 → 7.51.0

package/dist/core/untrusted-egress.js

@@ -1,8 +1,9 @@
 import { delimitUntrusted, neutralizeForFence } from "./untrusted-text.js";
-import { egressPasses, runRedactionPasses } from "./arg-summary.js";
-import { CREDENTIAL_VOCABULARY, egressPassGroups, URI_SCHEME_SOURCE } from "./credential-vocabulary.js";
+import { egressPasses, runRedactionPasses } from "./redaction-passes.js";
+import { CREDENTIAL_VOCABULARY, egressPassGroups, isSensitiveRecordKey, URI_SCHEME_SOURCE } from "./credential-vocabulary.js";
+import { isErrorLike, readMember, thrownText } from "./thrown-value.js";
 import { sliceHeadSafe } from "./surrogate-safe-slice.js";
-export { summarizeRedactions } from "./arg-summary.js";
+export { summarizeRedactions } from "./redaction-passes.js";
 const URL_OF_ANY_PROTOCOL = new RegExp(String.raw `${URI_SCHEME_SOURCE}:\/\/[^\s"'\`]+`, "gi");
 const BARE_USERNAME_MAX_LEN = 20;
 function redactUserinfo(scheme, userinfoWithAt) {
@@ -18,16 +19,126 @@ function redactUserinfo(scheme, userinfoWithAt) {
 const SECRET_TIER_PASSES = egressPasses(egressPassGroups(CREDENTIAL_VOCABULARY), {
     "url-credentials": (_m, scheme, userinfo) => redactUserinfo(scheme, userinfo),
 });
-export function redactSecrets(s, report) {
-    return runRedactionPasses(s, SECRET_TIER_PASSES, report);
-}
 const HOST_LEAK_PASSES = [
     ...SECRET_TIER_PASSES,
     { kind: "url", confidence: "medium", marker: "[redacted-url]", source: "untrusted-egress", re: URL_OF_ANY_PROTOCOL, replace: "[redacted-url]" },
     { kind: "fs-path", confidence: "low", marker: "[redacted-path]", source: "untrusted-egress", re: /(?:\/[A-Za-z0-9_.-]+){2,}/g, replace: "[redacted-path]" },
 ];
+const TIER_PASSES = { "same-principal": SECRET_TIER_PASSES, human: HOST_LEAK_PASSES };
+export function egressText(tier, text, report) {
+    return runRedactionPasses(text, TIER_PASSES[tier], report);
+}
+export function egressThrownText(tier, err) {
+    return egressText(tier, thrownText(err));
+}
+export function redactSecrets(s, report) {
+    return egressText("same-principal", s, report);
+}
 export function redactHostLeaks(s, report) {
-    return runRedactionPasses(s, HOST_LEAK_PASSES, report);
+    return egressText("human", s, report);
+}
+const VALUE_DEPTH_MAX = 32;
+const VALUE_MEMBERS_MAX = 2_000;
+const WHOLE = "[redacted]";
+export function egressValue(tier, value) {
+    const snapshots = new Map();
+    let budget = VALUE_MEMBERS_MAX;
+    const ownKeys = (o, all) => {
+        try {
+            return all ? Reflect.ownKeys(o) : Object.keys(o);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const prototypeOf = (o) => {
+        try {
+            return Object.getPrototypeOf(o);
+        }
+        catch {
+            return Object.prototype;
+        }
+    };
+    const readOwn = (o, key) => {
+        try {
+            const d = Reflect.getOwnPropertyDescriptor(o, key);
+            if (d === undefined)
+                return { value: undefined, enumerable: true };
+            return { value: "value" in d ? d.value : d.get?.call(o), enumerable: d.enumerable ?? true };
+        }
+        catch {
+            return { value: undefined, enumerable: true };
+        }
+    };
+    const member = (read, depth, name) => {
+        const out = pass(read, depth + 1, name);
+        return typeof out === "string" && isSensitiveRecordKey(name) ? WHOLE : out;
+    };
+    const fill = (o, depth, keys, snapshot) => {
+        snapshots.set(o, snapshot);
+        for (const key of keys ?? []) {
+            if (budget-- <= 0)
+                break;
+            const read = readOwn(o, key);
+            const name = typeof key === "string" ? egressText(tier, key) : key;
+            Object.defineProperty(snapshot, name, { value: member(read.value, depth, typeof key === "string" ? key : ""), enumerable: read.enumerable, writable: true, configurable: true });
+        }
+        return snapshot;
+    };
+    const errorSnapshot = (o, depth) => {
+        const snapshot = new Error();
+        for (const key of Reflect.ownKeys(snapshot))
+            Reflect.deleteProperty(snapshot, key);
+        fill(o, depth, ownKeys(o, true), snapshot);
+        for (const key of ["name", "message", "code", "stack"]) {
+            if (Object.prototype.hasOwnProperty.call(snapshot, key))
+                continue;
+            const read = readMember(o, key);
+            if (read !== undefined && typeof read !== "function")
+                Object.defineProperty(snapshot, key, { value: member(read, depth, key), enumerable: false, writable: true, configurable: true });
+        }
+        return snapshot;
+    };
+    function pass(v, depth, key) {
+        if (typeof v === "string")
+            return egressText(tier, v);
+        if (typeof v === "function")
+            return undefined;
+        if (typeof v !== "object" || v === null)
+            return v;
+        const known = snapshots.get(v);
+        if (known !== undefined)
+            return known;
+        if (depth >= VALUE_DEPTH_MAX)
+            return WHOLE;
+        if (isErrorLike(v))
+            return errorSnapshot(v, depth);
+        const toJSON = readMember(v, "toJSON");
+        if (typeof toJSON === "function") {
+            let reading;
+            try {
+                reading = toJSON.call(v, key);
+            }
+            catch {
+                return WHOLE;
+            }
+            if (reading !== v) {
+                const out = pass(reading, depth + 1, key);
+                snapshots.set(v, out);
+                return out;
+            }
+        }
+        const array = (() => {
+            try {
+                return Array.isArray(v);
+            }
+            catch {
+                return false;
+            }
+        })();
+        return fill(v, depth, ownKeys(v, false), array ? [] : prototypeOf(v) === null ? Object.create(null) : {});
+    }
+    return pass(value, 0, "");
 }
 const REDACTION_MARKER_RE = /\[redacted(?:-[a-z]+)?\]/g;
 function countRedactionMarkers(s) {
@@ -85,10 +196,10 @@ function boundedString(value, max, redact) {
     return out;
 }
 export function boundedRedactedSummary(value, max) {
-    return boundedString(value, max, redactSecrets);
+    return boundedString(value, max, (s) => egressText("same-principal", s));
 }
 export function untrustedEgressForHuman(value, opts) {
-    const source = boundedString(value, Number.POSITIVE_INFINITY, redactHostLeaks);
+    const source = boundedString(value, Number.POSITIVE_INFINITY, (s) => egressText("human", s));
     const probe = (budget) => {
         const bounded = boundedString(source, budget, (s) => s);
         return { bounded, overflow: [...neutralizeForFence(bounded)].length - opts.max };

package/dist/core/untrusted-text.js

@@ -378,6 +378,22 @@ export const ENGINE_ENVELOPES = Object.freeze([
         fenced: false,
         disclosed: false,
     },
+    ...[
+        "additional_skills_reminder", "application_details", "artifacts", "ask_user_question_tool", "citation_requirements",
+        "claude_behavior", "computer_use", "env", "evenhandedness", "examples", "file_creation_advice", "file_handling_rules",
+        "good_file_sharing_examples", "high_level_computer_use_explanation", "knowledge_cutoff", "legal_and_financial_advice",
+        "lists_and_bullets", "notes_on_user_uploaded_files", "package_management", "producing_outputs", "product_information",
+        "refusal_handling", "responding_to_mistakes_and_criticism", "sharing_files", "strong", "suggesting_claude_actions",
+        "todo_list_tool", "tone_and_formatting", "tool_result_safety", "unnecessary_computer_use_avoidance", "user_wellbeing",
+        "verification_step", "web_content_restrictions", "working_with_user_files",
+    ].map((tag) => ({
+        tag,
+        kind: "not-an-envelope",
+        mint: "prompts/cowork.ts — the Cowork base template's own section markup",
+        guard: "no run-supplied bytes reach it: the template is a constant rendered section by section, and its only fills are the two directory placeholders, engine facts",
+        fenced: false,
+        disclosed: false,
+    })),
 ]);
 const ENVELOPES_BY_TAG = new Map(ENGINE_ENVELOPES.map((e) => [e.tag, e]));
 export function engineEnvelope(tag) {

package/dist/core/wiring-manifest.d.ts

@@ -646,16 +646,30 @@ export declare function deriveAskEffective(form: AskSeamForm, parkEffective: boo
  */
 export declare function askSeatEffective(manifest: Pick<WiringManifest, "ask" | "parkLane">): AskEffective;
 /**
- * Does an ask this leg hands on carrying `requiresRealApproval` reach a PERSON — never an automatic yes? The leg's
- * APPROVAL SEAT, read off the ONE ask derivation above, never re-derived: `human_reachable` (a live approver) and
- * `park_only` (the durable park; where the park cannot take the ask, a blanket seat behind it refuses the bit) are a
- * person; `auto_allow`, `auto_deny` and `unresolved` are nobody (the last the fail-closed reading). The auto-mode
- * classifier stations read it to decide where a classification that could not rule goes: to that person (the ask
- * carrying the bit), or refused.
+ * WHERE an ask carrying `requiresRealApproval` goes from a station — the closed set of the ONE approval-seat decision:
+ * `live_approver` (a live approver callback answers it now), `durable_park` (it parks for a person to answer later),
+ * `none` (nobody can: a blanket policy seat, no seat, or a run that declared nobody can be asked — each only when no park
+ * lane is armed, since an armed park is the deployment's own statement that an answer can wait for a person — or a word that cannot be
+ * resolved — the fail-closed reading).
  */
-export declare function askReachesPerson(ask: {
+export declare const APPROVAL_ROUTES: readonly ["live_approver", "durable_park", "none"];
+export type ApprovalRoute = (typeof APPROVAL_ROUTES)[number];
+/**
+ * The APPROVAL SEAT as a route, read off the ONE ask derivation above, never re-derived: `human_reachable` ⇒
+ * `live_approver`; `park_only` ⇒ `durable_park` (where the park cannot take the ask, a blanket seat behind it refuses the
+ * bit); `auto_allow`, `auto_deny` and `unresolved` ⇒ `none`. Every station that forks on "does a handed-on ask reach a
+ * person" reads this word — the leg's gate from the leg's seat word ({@link askSeatEffective}), an ancestor's frozen seat
+ * through {@link frozenApproverRoute} — and the fork, its observer and the sentence a person reads all read the same word.
+ */
+export declare function approvalRouteOf(ask: {
     readonly effective?: AskEffective;
-}): boolean;
+}): ApprovalRoute;
+/**
+ * The route from an ancestor's FROZEN approver (the inherited fold's station): the same table read with that seat's own
+ * form and no park — the inherited station resolves at the frozen seat, whose only road to a person is a live callback
+ * (the leg's park is reached only through a live approver's `unavailable`), so a blanket or absent frozen seat is `none`.
+ */
+export declare function frozenApproverRoute(onAsk: OnAsk | undefined): ApprovalRoute;
 export declare function deriveWiringManifest(facts: WiringFacts): WiringManifest;
 /** A run's approval seat as its one resolution froze it: the value every reader that needs the approver itself reads
  *  (`undefined` when nothing on this run can be asked), the form the manifest reports and every reader of the word derives

package/dist/core/wiring-manifest.js

@@ -81,16 +81,18 @@ export function deriveAskEffective(form, parkEffective, mode) {
 export function askSeatEffective(manifest) {
     return deriveAskEffective(manifest.ask.form, manifest.parkLane.effective);
 }
-export function askReachesPerson(ask) {
+export const APPROVAL_ROUTES = Object.freeze(["live_approver", "durable_park", "none"]);
+export function approvalRouteOf(ask) {
     const effective = ask.effective ?? "unresolved";
     switch (effective) {
         case "human_reachable":
+            return "live_approver";
         case "park_only":
-            return true;
+            return "durable_park";
         case "auto_allow":
         case "auto_deny":
         case "unresolved":
-            return false;
+            return "none";
         default: {
             const _exhaustive = effective;
             void _exhaustive;
@@ -98,6 +100,12 @@ export function askReachesPerson(ask) {
         }
     }
 }
+export function frozenApproverRoute(onAsk) {
+    return approvalRouteOf({ effective: deriveAskEffective(askSeamFormOf(onAsk) ?? "absent", false) });
+}
+function askSeamFormOf(v) {
+    return typeof v === "function" ? "callback" : v === "allow" ? "allow" : v === "deny" ? "deny" : v === undefined ? "absent" : undefined;
+}
 function deriveParkLane(facts) {
     if (!facts.parkCapable) {
         return { capable: false, effective: false, reasons: ["no_checkpoint_store"] };
@@ -235,7 +243,7 @@ export function resolveAskSeat(spec, deps) {
     if (seat === undefined)
         return Object.freeze(reach === undefined ? { value: undefined, form: "absent" } : { value: undefined, form: "declared_none", reach });
     const v = seat.value;
-    const form = typeof v === "function" ? "callback" : v === "allow" ? "allow" : v === "deny" ? "deny" : undefined;
+    const form = askSeamFormOf(v);
     if (form === undefined) {
         const e = new Error(`the resolved onAsk seat (${seat.provenance}) holds ${JSON.stringify(v)} — not an OnAsk ` +
             `("allow" | "deny" | approver function); refusing to classify it.`);

package/dist/engine/harness/agent-harness.d.ts

@@ -310,6 +310,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     private abortResultDetails?;
     private loopTrace?;
     private onToolInputValidationFault?;
+    private onToolMediaRefused?;
     private resilience?;
     private maxToolConcurrency?;
     private streamingToolExecution?;
@@ -538,7 +539,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     /**
      * Finalize a call this harness's caller executed OUTSIDE a turn (a resumed, already-approved call) exactly as the
      * loop finalizes its own: the same {@link finalizeToolOutcome} over the same `tool_result` emit, so the call meets the
-     * same handlers, the same patch application and the same throwing-hook posture as a live one.
+     * same handlers, the same patch application, the same throwing-hook posture and the same media admission as a live one.
      */
     finalizeToolCall(toolCall: AgentToolCall, args: unknown, executed: ExecutedToolCallOutcome): Promise<ExecutedToolCallOutcome & {
         toolCall: AgentToolCall;

package/dist/engine/harness/agent-harness.js

@@ -294,6 +294,7 @@ export class AgentHarness {
     abortResultDetails;
     loopTrace;
     onToolInputValidationFault;
+    onToolMediaRefused;
     resilience;
     maxToolConcurrency;
     streamingToolExecution;
@@ -329,6 +330,7 @@ export class AgentHarness {
         this.abortResultDetails = options.abortResultDetails;
         this.loopTrace = options.loopTrace;
         this.onToolInputValidationFault = options.onToolInputValidationFault;
+        this.onToolMediaRefused = options.onToolMediaRefused;
         this.resilience = options.resilience;
         this.maxToolConcurrency = options.maxToolConcurrency;
         this.streamingToolExecution = options.streamingToolExecution;
@@ -640,6 +642,7 @@ export class AgentHarness {
             ...(this.stallTimeoutsPerCall !== undefined ? { stallTimeoutsPerCall: this.stallTimeoutsPerCall } : {}),
             ...(this.abortResultDetails !== undefined ? { abortResultDetails: this.abortResultDetails } : {}),
             ...(this.onToolInputValidationFault !== undefined ? { onToolInputValidationFault: this.onToolInputValidationFault } : {}),
+            ...(this.onToolMediaRefused !== undefined ? { onToolMediaRefused: this.onToolMediaRefused } : {}),
             ...(this.resilience !== undefined ? { resilience: this.resilience } : {}),
             ...(this.maxToolConcurrency !== undefined ? { maxToolConcurrency: this.maxToolConcurrency } : {}),
             ...(this.streamingToolExecution === true && (this.getHandlers("tool_call")?.size ?? 0) === 0
@@ -1231,7 +1234,7 @@ export class AgentHarness {
         return patch;
     }
     finalizeToolCall(toolCall, args, executed) {
-        return finalizeToolOutcome(toolCall, executed, (result, isError) => this.afterToolCallHook(toolCall, args, result, isError));
+        return finalizeToolOutcome(toolCall, executed, (result, isError) => this.afterToolCallHook(toolCall, args, result, isError), this.onToolMediaRefused);
     }
     getModel() {
         return this.model;

package/dist/engine/harness/types.d.ts

@@ -1444,6 +1444,9 @@ export interface AgentHarnessOptions<TSkill extends Skill = Skill, TPromptTempla
     /** Loop-config pass-through — see `AgentLoopConfig.onToolInputValidationFault` (a throwing
      *  `AgentTool.validateInput` is read as no verdict and disclosed here). */
     onToolInputValidationFault?: import("../loop/types.js").AgentLoopConfig["onToolInputValidationFault"];
+    /** Loop-config pass-through — see `AgentLoopConfig.onToolMediaRefused` (the tool-result seat's account of the media it
+     *  refused); the harness's own finalization of a resumed approved call reports through the same sink. */
+    onToolMediaRefused?: import("../loop/types.js").AgentLoopConfig["onToolMediaRefused"];
     /**
      * design/131 (拍): per-task resilience intent flags, forwarded to every provider
      * call (`StreamOptions.resilience`) so the deployment's decorator stack (degrading / failover /

package/dist/engine/llm/types.d.ts

@@ -1020,21 +1020,19 @@ export interface RouteCredential {
      *  knob+header pair counts as ONE deployment credential — see `resolveRouteCredential`). */
     carrierBag?: RouteCarrierBag;
 }
-/** The deployment half of the pairing judgment: the brain construction config's DECLARED root.
- *  Absent/empty ⇒ the deployment did not declare its credential's URL half (the unpinned
- *  quick-start posture — see `adjudicateModelRoute`). */
+/** The deployment half of the pairing judgment: the root the brain sends to when an entry names none —
+ *  its construction config's DECLARED root (`baseUrl`), else the lane's own default endpoint
+ *  (`laneDefault`, a constant the brain owns; absent for a lane with no default). That root is the
+ *  deployment credential's one root (see `adjudicateModelRoute`). */
 export interface RoutePairingConfig {
     baseUrl?: string;
+    laneDefault?: string;
 }
 /** How an OK verdict is paired.
  *  - `"per-model"` — per-model credential, paired by construction.
- *  - `"paired"` — deployment credential on the deployment's own declared root.
- *  - `"unpinned"` — deployment credential whose URL half is UNDECLARED (no `config.baseUrl`): allowed
- *    for compatibility with single-endpoint configs (key on config, URL on the model), but the pairing
- *    is unverifiable — a multi-entry deployment in this posture should declare `config.baseUrl` or move
- *    to per-model credentials. Surfaced (not refused) so read faces can annotate it.
+ *  - `"paired"` — deployment credential on the deployment's own root (declared, or the lane default).
  *  - `"keyless"` — no credential anywhere; nothing to protect. */
-export type RoutePairingPosture = "per-model" | "paired" | "unpinned" | "keyless";
+export type RoutePairingPosture = "per-model" | "paired" | "keyless";
 /** Machine codes an adjudication refusal carries (minted here, forwarded verbatim by consumers). */
 export type RouteRefusalCode = "route.credential_mismatch" | "route.credential_missing";
 /** The structured account of a refusal — the two halves and the fix, every URL a DISPLAY spelling. */

package/dist/engine/loop/agent-loop.d.ts

@@ -183,10 +183,15 @@ export declare const TOOL_INPUT_VALIDATION_TIMEOUT_MS = 10000;
  * The post-execution half EVERY executed tool call passes through — the loop's own calls here, and a call
  * the harness executed outside a turn (a resumed approved call, `AgentHarness.finalizeToolCall`) through the
  * same function, so the two cannot drift into two dialects of one finalization: the `afterToolCall` patch
- * (content / details / terminate / isError), the D4 posture on a throwing hook, and the delivery mark.
- * `after` absent ⇒ the executed outcome stands as is (same object).
+ * (content / details / terminate / isError), the D4 posture on a throwing hook, the delivery mark, and last
+ * the media admission — the tool-result seat every supply of media reaches after the last hand that can change
+ * it (`admitToolResultMedia`): a refused block becomes its text placeholder in the result, and `onMediaRefused`
+ * hears the call's refusals once. `after` absent and no media ⇒ the executed outcome stands as is (same object).
  */
-export declare function finalizeToolOutcome<C>(toolCall: C, executed: ExecutedToolCallOutcome, after: ((result: AgentToolResult<unknown>, isError: boolean) => Promise<AfterToolCallResult | undefined>) | undefined): Promise<ExecutedToolCallOutcome & {
+export declare function finalizeToolOutcome<C extends {
+    id: string;
+    name: string;
+}>(toolCall: C, executed: ExecutedToolCallOutcome, after: ((result: AgentToolResult<unknown>, isError: boolean) => Promise<AfterToolCallResult | undefined>) | undefined, onMediaRefused?: AgentLoopConfig["onToolMediaRefused"]): Promise<ExecutedToolCallOutcome & {
     toolCall: C;
 }>;
 export {};

package/dist/engine/loop/agent-loop.js

@@ -3,7 +3,9 @@ import { truncateError } from "../../core/tool-errors.js";
 import { judgeToolNameMiss, mountedToolNames } from "../../core/tool-name-aliases.js";
 import { INTERRUPTED_BY_USER_FOR_TOOL_USE_MARKER, INTERRUPTED_BY_USER_MARKER, } from "../../core/session-reconcile.js";
 import { resolveAgentCoreStreamFn } from "./runtime-deps.js";
-import { isErrorLike, readMember, thrownMarksOf, thrownText } from "../../core/thrown-value.js";
+import { isErrorLike, readMember, thrownMarksOf } from "../../core/thrown-value.js";
+import { egressThrownText, egressValue } from "../../core/untrusted-egress.js";
+import { admitToolResultMedia } from "../../tools/fs/image-admission.js";
 function appendTextDeltaToAssistantMessage(message, contentIndex, delta) {
     const content = [...message.content];
     const currentContent = content[contentIndex];
@@ -1111,7 +1113,7 @@ class StreamToolExecutor {
                 this.retainCancellation(error);
             entry.immediate = {
                 kind: "immediate",
-                result: createErrorToolResult(thrownText(error), error),
+                result: thrownErrorToolResult(error),
                 isError: true,
             };
         }
@@ -1374,7 +1376,7 @@ async function prepareToolCall(currentContext, assistantMessage, toolCall, confi
     catch (error) {
         return {
             kind: "immediate",
-            result: createErrorToolResult(thrownText(error), error),
+            result: thrownErrorToolResult(error),
             isError: true,
         };
     }
@@ -1415,7 +1417,7 @@ async function executePreparedToolCall(prepared, signal, emit, abortResultDetail
         }
         catch (error) {
             outcome = {
-                result: createErrorToolResult(thrownText(error), error),
+                result: thrownErrorToolResult(error),
                 isError: true,
             };
         }
@@ -1425,7 +1427,7 @@ async function executePreparedToolCall(prepared, signal, emit, abortResultDetail
             return outcome;
         const reason = deliveryFailure.reason;
         const details = annotateDeliveryFailure(outcome.result, {
-            message: thrownText(reason),
+            message: egressThrownText("same-principal", reason),
         });
         return details === UNANNOTATED ? outcome : { result: { ...outcome.result, details }, isError: outcome.isError };
     })();
@@ -1497,7 +1499,7 @@ async function executePreparedWithDisclosure(currentContext, assistantMessage, p
         if (isAbortSemanticsError(error))
             throw error;
         executed = {
-            result: createErrorToolResult(`[tool execution harness failed: ${thrownText(error)}]`, error),
+            result: thrownErrorToolResult(error, (words) => `[tool execution harness failed: ${words}]`),
             isError: true,
         };
     }
@@ -1506,9 +1508,9 @@ async function executePreparedWithDisclosure(currentContext, assistantMessage, p
 function finalizeExecutedToolCall(currentContext, assistantMessage, prepared, executed, config, signal) {
     return finalizeToolOutcome(prepared.toolCall, executed, config.afterToolCall === undefined
         ? undefined
-        : (result, isError) => config.afterToolCall({ assistantMessage, toolCall: prepared.toolCall, args: prepared.args, result, isError, context: currentContext }, signal));
+        : (result, isError) => config.afterToolCall({ assistantMessage, toolCall: prepared.toolCall, args: prepared.args, result, isError, context: currentContext }, signal), config.onToolMediaRefused);
 }
-export async function finalizeToolOutcome(toolCall, executed, after) {
+export async function finalizeToolOutcome(toolCall, executed, after, onMediaRefused) {
     let result = executed.result;
     let isError = executed.isError;
     const deliveryMark = readDeliveryFailureMark(executed.result.details);
@@ -1525,7 +1527,7 @@ export async function finalizeToolOutcome(toolCall, executed, after) {
             }
         }
         catch (error) {
-            const note = truncateError(`[post-tool processing failed (the tool already executed): ${thrownText(error)}]`);
+            const note = truncateError(`[post-tool processing failed (the tool already executed): ${egressThrownText("same-principal", error)}]`);
             result = { ...result, content: [...result.content, { type: "text", text: note }] };
         }
         if (deliveryMark !== undefined && readDeliveryFailureMark(result.details) === undefined) {
@@ -1534,6 +1536,18 @@ export async function finalizeToolOutcome(toolCall, executed, after) {
                 result = { ...result, details };
         }
     }
+    const admitting = admitToolResultMedia(result.content, toolCall.name);
+    if (admitting !== undefined) {
+        const admitted = await admitting;
+        result = { ...result, content: admitted.content };
+        if (admitted.refused.length > 0) {
+            try {
+                onMediaRefused?.({ toolName: toolCall.name, toolCallId: toolCall.id, refused: admitted.refused });
+            }
+            catch {
+            }
+        }
+    }
     return { toolCall, result, isError };
 }
 function safeAbortDetails(fn) {
@@ -1563,6 +1577,9 @@ function createErrorToolResult(message, source) {
         details,
     };
 }
+function thrownErrorToolResult(error, frame = (words) => words) {
+    return createErrorToolResult(frame(egressThrownText("same-principal", error)), { details: egressValue("same-principal", thrownMarksOf(error)) });
+}
 async function emitToolExecutionEnd(finalized, emit) {
     await emit({
         type: "tool_execution_end",

package/dist/engine/loop/types.d.ts

@@ -566,6 +566,16 @@ export interface AgentLoopConfig extends SimpleStreamOptions {
         toolCallId: string;
         error: unknown;
     }) => void;
+    /**
+     * Told, once per executed call, of the media blocks the tool-result seat refused (`admitToolResultMedia`, the last step
+     * of the post-execution half): each already stands in the result as a text placeholder naming the tool and the refusal,
+     * so this is the run's account of it, not a decision. Advisory: a throwing sink changes nothing.
+     */
+    onToolMediaRefused?: (info: {
+        toolName: string;
+        toolCallId: string;
+        refused: readonly import("../../tools/fs/image-admission.js").ToolResultMediaRefusal[];
+    }) => void;
     /**
      * Called after a tool finishes executing, before `tool_execution_end` and tool-result message events are emitted.
      *