@vellumai/assistant 0.10.0 → 0.10.1-staging.1

package/src/tools/executor.ts

@@ -525,13 +525,21 @@ export { isSideEffectTool } from "./side-effects.js";
  *
  * Shell tools (`bash`, `host_bash`) manage their own timeouts with SIGKILL
  * on expiry. We add a 5s buffer so the shell's own deadline fires first and
- * handles cleanup before the executor wrapper trips. Non-shell tools use
- * the generic `toolExecutionTimeoutSec` configuration value.
+ * handles cleanup before the executor wrapper trips.
+ *
+ * `ask_question` blocks on user input inside `execute()` via `QuestionPrompter`,
+ * which waits up to `permissionTimeoutSec`. We give the wrapper the same 5s
+ * buffer over that deadline so the prompter's own timeout fires first and
+ * returns its clean "User did not respond within timeout" result — otherwise
+ * the shorter generic budget trips first, orphaning the still-pending prompt
+ * behind the confusing "may still be running in the background" error.
+ *
+ * All other tools use the generic `toolExecutionTimeoutSec` configuration value.
  *
  * Consumed by `executeInternal` via `executeWithTimeout`, which is the
  * sole enforcer of the per-tool budget.
  */
-function computePerToolTimeoutMs(
+export function computePerToolTimeoutMs(
   name: string,
   input: Record<string, unknown>,
 ): number {
@@ -547,6 +555,10 @@ function computePerToolTimeoutMs(
     );
     return (shellTimeoutSec + 5) * 1000;
   }
+  if (name === "ask_question") {
+    const { permissionTimeoutSec } = getConfig().timeouts;
+    return (permissionTimeoutSec + 5) * 1000;
+  }
   const rawTimeoutSec = getConfig().timeouts.toolExecutionTimeoutSec;
   return safeTimeoutMs(rawTimeoutSec);
 }

package/src/tools/host-terminal/host-shell.ts

@@ -35,7 +35,10 @@ import {
   registerBackgroundTool,
   removeBackgroundTool,
 } from "../background-tool-registry.js";
-import { formatShellOutput } from "../shared/shell-output.js";
+import {
+  formatShellOutput,
+  MAX_OUTPUT_LENGTH,
+} from "../shared/shell-output.js";
 import { buildSanitizedEnv } from "../terminal/safe-env.js";
 import type {
   ToolContext,
@@ -296,13 +299,20 @@ export const hostShellTool = {
 
         proxyPromise
           .then((result) => {
-            const hint = result.isError
-              ? `Background host command failed (id=${bgId}):\n${result.content}`
-              : `Background host command completed (id=${bgId}):\n${result.content || "(no output)"}`;
+            const framing = result.isError
+              ? `Background host command failed (id=${bgId}):`
+              : `Background host command completed (id=${bgId}):`;
             void wakeAgentForOpportunity({
               conversationId: context.conversationId,
-              hint,
+              hint: framing,
               source: "background-tool",
+              persistTriggerAsEvent: true,
+              untrustedOutput: {
+                content: result.content || "(no output)",
+                source: "tool_result",
+                // Preserve formatShellOutput's recovery marker (see shell.ts).
+                maxChars: MAX_OUTPUT_LENGTH * 2,
+              },
             });
           })
           .catch((err) => {
@@ -310,6 +320,7 @@ export const hostShellTool = {
               conversationId: context.conversationId,
               hint: `Background host command failed (id=${bgId}): ${err instanceof Error ? err.message : String(err)}`,
               source: "background-tool",
+              persistTriggerAsEvent: true,
             });
           })
           .finally(() => removeBackgroundTool(bgId));
@@ -440,13 +451,20 @@ export const hostShellTool = {
           timedOut,
           timeoutSec,
         );
-        const hint = result.isError
-          ? `Background host command failed (id=${bgId}):\n${result.content}`
-          : `Background host command completed (id=${bgId}):\n${result.content || "(no output)"}`;
+        const framing = result.isError
+          ? `Background host command failed (id=${bgId}):`
+          : `Background host command completed (id=${bgId}):`;
         void wakeAgentForOpportunity({
           conversationId: context.conversationId,
-          hint,
+          hint: framing,
           source: "background-tool",
+          persistTriggerAsEvent: true,
+          untrustedOutput: {
+            content: result.content || "(no output)",
+            source: "tool_result",
+            // Preserve formatShellOutput's recovery marker (see shell.ts).
+            maxChars: MAX_OUTPUT_LENGTH * 2,
+          },
         });
         removeBackgroundTool(bgId);
       });
@@ -459,6 +477,7 @@ export const hostShellTool = {
           conversationId: context.conversationId,
           hint: `Background host command failed (id=${bgId}): ${err.message}`,
           source: "background-tool",
+          persistTriggerAsEvent: true,
         });
         removeBackgroundTool(bgId);
       });

package/src/tools/memory/register.test.ts

@@ -348,3 +348,35 @@ describe("rememberTool.execute — PKB re-index enqueue", () => {
     expect(archiveContents).toContain("enqueue will throw");
   });
 });
+
+describe("rememberTool.execute — batch (array) content", () => {
+  beforeEach(() => {
+    enqueueCalls.length = 0;
+    enqueueShouldThrow = false;
+  });
+
+  test("records every fact from an array and enqueues per file, not per fact", async () => {
+    const result = await rememberTool.execute(
+      { content: ["batch fact A", "batch fact B"] },
+      makeContext(),
+    );
+    expect(result.isError).toBe(false);
+
+    const pkbRoot = join(tmpWorkspace, "pkb");
+    const bufferContents = readFileSync(join(pkbRoot, "buffer.md"), "utf-8");
+    expect(bufferContents).toContain("batch fact A");
+    expect(bufferContents).toContain("batch fact B");
+
+    // buffer + archive, regardless of how many facts the call carried.
+    expect(enqueueCalls).toHaveLength(2);
+  });
+
+  test("rejects an all-blank array without writing or enqueueing", async () => {
+    const result = await rememberTool.execute(
+      { content: ["  ", ""] },
+      makeContext(),
+    );
+    expect(result.isError).toBe(true);
+    expect(enqueueCalls).toHaveLength(0);
+  });
+});

package/src/tools/skills/load.ts

@@ -39,6 +39,17 @@ const INLINE_COMMAND_ELIGIBLE_SOURCES = new Set([
   "workspace",
 ]);
 
+/** Matches raw `` !`...` `` inline command tokens in a skill body. */
+const INLINE_COMMAND_TOKEN_PATTERN = /!`[^`]*`/g;
+
+/**
+ * Replacement for inline command tokens when they are not rendered during
+ * disk-pressure cleanup mode — keeps the raw tokens out of the prompt without
+ * executing any shell.
+ */
+const INLINE_COMMAND_CLEANUP_STUB =
+  "[inline command skipped: storage cleanup mode]";
+
 const log = getLogger("skill-load");
 
 /**
@@ -159,11 +170,18 @@ export const skillLoadTool = {
       };
     }
 
+    // During disk-pressure cleanup mode, skill_load must not produce side
+    // effects: no auto-install (workspace writes / `bun install`) and no inline
+    // command execution. Instructions are still returned so the assistant can
+    // load the system-storage-cleanup skill (and any already-installed skill).
+    const cleanupMode = context.diskPressureCleanupModeActive === true;
+
     let loaded = loadSkillBySelector(selector);
 
     // Auto-install from catalog if the skill isn't found locally
     if (
       !loaded.skill &&
+      !cleanupMode &&
       (loaded.errorCode === "not_found" || loaded.errorCode === "empty_catalog")
     ) {
       try {
@@ -221,6 +239,10 @@ export const skillLoadTool = {
         const missing = collectAllMissing(skill.id, catalogIndex);
         if (missing.size === 0) break;
 
+        // Under the disk-pressure lock, never auto-install missing includes
+        // (that writes to the workspace). Leave them advisory ("not loaded").
+        if (cleanupMode) break;
+
         // Lazily resolve catalog on first round with missing includes
         if (!remoteCatalog) {
           try {
@@ -289,7 +311,19 @@ export const skillLoadTool = {
     const hasInlineCommands =
       skill.inlineCommandExpansions && skill.inlineCommandExpansions.length > 0;
 
-    if (hasInlineCommands) {
+    if (hasInlineCommands && cleanupMode) {
+      // Under the disk-pressure lock, loading a skill must not execute shell.
+      // Strip inline command tokens instead of rendering them; the rest of the
+      // instructions are still returned.
+      body = body.replace(
+        INLINE_COMMAND_TOKEN_PATTERN,
+        INLINE_COMMAND_CLEANUP_STUB,
+      );
+      log.info(
+        { skillId: skill.id },
+        "Skipped inline command expansion during disk pressure cleanup mode",
+      );
+    } else if (hasInlineCommands) {
       if (skill.source === "extra" || skill.source === "plugin") {
         // Third-party skill roots — `extra` dirs and skills shipped inside
         // installed plugins — are out of scope for inline command expansion.
@@ -368,7 +402,14 @@ export const skillLoadTool = {
             childLoaded.skill.inlineCommandExpansions &&
             childLoaded.skill.inlineCommandExpansions.length > 0;
 
-          if (childHasInlineCommands) {
+          if (childHasInlineCommands && cleanupMode) {
+            // No shell execution under the disk-pressure lock — strip the
+            // child's inline command tokens rather than rendering them.
+            childBody = childBody.replace(
+              INLINE_COMMAND_TOKEN_PATTERN,
+              INLINE_COMMAND_CLEANUP_STUB,
+            );
+          } else if (childHasInlineCommands) {
             if (
               childLoaded.skill.source === "extra" ||
               childLoaded.skill.source === "plugin"

package/src/tools/subagent/spawn.ts

@@ -1,7 +1,6 @@
 import { validateInferenceProfileKey } from "../../config/inference-profile-validation.js";
 import { resolveDefaultProfileKey } from "../../config/llm-resolver.js";
 import { getConfig } from "../../config/loader.js";
-import { AUTO_PROFILE_KEY } from "../../config/seed-inference-profiles.js";
 import { findConversation } from "../../daemon/conversation-registry.js";
 import { getConversationOverrideProfile } from "../../memory/conversation-crud.js";
 import type { Message } from "../../providers/types.js";
@@ -96,9 +95,9 @@ export async function executeSubagentSpawn(
 
   // The subagent runs as its own background conversation, so the agent
   // loop's background-skip rule would zero out any inherited profile.
-  // Pass the parent's profile explicitly via `SubagentConfig` so
-  // `SubagentManager.spawn` forwards it back into the subagent's
-  // `runAgentLoop` call as `options.overrideProfile`.
+  // Forward the invoker's profile explicitly via `SubagentConfig` so
+  // `SubagentManager.spawn` passes it into the subagent's `runAgentLoop` as
+  // `options.overrideProfile`.
   //
   // Resolution order: an explicit spawn-time profile, then the per-turn
   // `context.overrideProfile` (populated by `runAgentLoopImpl` from its
@@ -128,12 +127,7 @@ export async function executeSubagentSpawn(
         context.invokingCallSite ?? "mainAgent",
         getConfig().llm,
       );
-    // Skip the metadata-only "auto" key: forwarding it collapses the child to
-    // `llm.default`, whereas the invoker's own auto base IS the `subagentSpawn`
-    // default — so leaving this undefined keeps the child on that default.
-    if (inheritedCandidate !== AUTO_PROFILE_KEY) {
-      inheritedOverrideProfile = inheritedCandidate;
-    }
+    inheritedOverrideProfile = inheritedCandidate;
   }
 
   try {

package/src/tools/terminal/shell.ts

@@ -24,7 +24,10 @@ import {
   getSessionEnv,
 } from "../network/script-proxy/index.js";
 import { registerTool } from "../registry.js";
-import { formatShellOutput } from "../shared/shell-output.js";
+import {
+  formatShellOutput,
+  MAX_OUTPUT_LENGTH,
+} from "../shared/shell-output.js";
 import type {
   ProxyEnvVars,
   ToolContext,
@@ -406,11 +409,19 @@ export const shellTool = {
           timeoutSec,
         );
 
-        const hint = `Background command completed (id=${bgId}, exit=${code ?? "unknown"}):\n${fmtResult.content}`;
+        const framing = `Background command completed (id=${bgId}, exit=${code ?? "unknown"}):`;
         void wakeAgentForOpportunity({
           conversationId: context.conversationId,
-          hint,
+          hint: framing,
           source: "background-tool",
+          persistTriggerAsEvent: true,
+          untrustedOutput: {
+            content: fmtResult.content,
+            source: "tool_result",
+            // Already bounded + recovery-marked by formatShellOutput; a larger
+            // budget keeps wrapUntrustedContent from re-truncating the marker.
+            maxChars: MAX_OUTPUT_LENGTH * 2,
+          },
         });
       });
 
@@ -433,11 +444,11 @@ export const shellTool = {
           spawnError: err.message,
         });
 
-        const hint = `Background command failed (id=${bgId}): ${err.message}`;
         void wakeAgentForOpportunity({
           conversationId: context.conversationId,
-          hint,
+          hint: `Background command failed (id=${bgId}): ${err.message}`,
           source: "background-tool",
+          persistTriggerAsEvent: true,
         });
       });
 

package/src/tools/types.ts

@@ -26,6 +26,7 @@ export const DISK_PRESSURE_CLEANUP_TOOL_NAMES: ReadonlySet<string> = new Set([
   "file_read",
   "file_list",
   "host_file_read",
+  "skill_load",
   "background_tool_list",
   "background_tool_cancel",
 ]);

package/src/util/fs-watcher-error.ts

@@ -0,0 +1,36 @@
+/**
+ * Shared `'error'`-event handler for `fs.watch()` FSWatchers.
+ *
+ * An `FSWatcher` is an EventEmitter. When the underlying inotify/FSEvents
+ * backend fails *after* the watch was established — e.g. ENOSPC when the
+ * kernel's `fs.inotify.max_user_watches` limit is exhausted while walking a
+ * recursive watch into a large subtree (a plugin's `node_modules`), or ENXIO
+ * when a Unix socket file appears in a watched directory — the failure is
+ * delivered asynchronously as an `'error'` event rather than a synchronous
+ * throw from `watch()`. An emitter with no `'error'` listener rethrows, which
+ * surfaces as an `uncaughtException` and takes the whole daemon down (→
+ * CrashLoopBackOff).
+ *
+ * Attaching this handler degrades the failure to "this watcher stops
+ * delivering events", in line with the daemon startup philosophy: a subsystem
+ * failure must never crash the process.
+ */
+
+import type { FSWatcher } from "node:fs";
+
+import type { Logger } from "pino";
+
+/**
+ * Attach a resilient `'error'` listener so async FSWatcher failures are logged
+ * instead of crashing the process. Pass the owning module's logger and the
+ * watched directory for diagnostic context.
+ */
+export function attachFsWatcherErrorHandler(
+  watcher: FSWatcher,
+  log: Logger,
+  dir: string,
+): void {
+  watcher.on("error", (err) => {
+    log.warn({ err, dir }, "FSWatcher error (non-fatal, continuing)");
+  });
+}

package/src/util/logs-db-path.ts

@@ -0,0 +1,22 @@
+import { join } from "node:path";
+
+import { getDataDir } from "./platform.js";
+
+/**
+ * Path to the dedicated SQLite file that houses heavy append-only tables
+ * (LLM request logs, and other log/event tables over time). It lives in the
+ * same `data/db` directory as the main DB and is opened on its own connection
+ * (see `getLogsDb()` in `memory/db-connection.ts`). Splitting these tables into
+ * their own file keeps the main DB — and its WAL — small and lets the two files
+ * VACUUM/checkpoint independently.
+ *
+ * Kept in its own leaf module rather than alongside `getDbPath()` in
+ * `platform.ts`: `platform.ts` is imported very early and widely, and adding an
+ * export to it that low-level consumers (e.g. `db-connection.ts`) pull in
+ * across the daemon's large, cyclic import graph trips a Bun link-order bug
+ * ("Export named 'getLogsDbPath' not found"). Isolating it here keeps
+ * `platform.ts`'s module shape stable.
+ */
+export function getLogsDbPath(): string {
+  return join(getDataDir(), "db", "assistant-logs.db");
+}

package/src/util/memory-db-path.ts

@@ -0,0 +1,23 @@
+import { join } from "node:path";
+
+import { getDataDir } from "./platform.js";
+
+/**
+ * Path to the dedicated SQLite file that houses the high-churn memory
+ * subsystem tables (starting with the `memory_jobs` work queue). It lives in
+ * the same `data/db` directory as the main DB and is opened on its own
+ * connection (see `getMemoryDb()` in `memory/db-connection.ts`). Splitting
+ * these tables into their own file keeps the main DB — and its WAL — small and
+ * lets the two files VACUUM/checkpoint independently, so a runaway queue can no
+ * longer bloat the main database.
+ *
+ * Kept in its own leaf module rather than alongside `getDbPath()` in
+ * `platform.ts`: `platform.ts` is imported very early and widely, and adding an
+ * export to it that low-level consumers (e.g. `db-connection.ts`) pull in
+ * across the daemon's large, cyclic import graph trips a Bun link-order bug
+ * ("Export named 'getMemoryDbPath' not found"). Isolating it here keeps
+ * `platform.ts`'s module shape stable — same reasoning as `logs-db-path.ts`.
+ */
+export function getMemoryDbPath(): string {
+  return join(getDataDir(), "db", "assistant-memory.db");
+}

package/src/watcher/providers/gmail.ts

@@ -9,6 +9,7 @@
 import {
   batchGetMessages,
   getProfile,
+  GMAIL_REQUIRED_SCOPES,
   listMessages,
 } from "../../messaging/providers/gmail/client.js";
 import type { GmailMessage } from "../../messaging/providers/gmail/types.js";
@@ -118,7 +119,9 @@ export const gmailProvider: WatcherProvider = {
   requiredCredentialService: "google",
 
   async getInitialWatermark(credentialService: string): Promise<string> {
-    const connection = await resolveOAuthConnection(credentialService);
+    const connection = await resolveOAuthConnection(credentialService, {
+      requiredScopes: GMAIL_REQUIRED_SCOPES,
+    });
     const profile = await getProfile(connection);
     if (!profile.historyId) {
       throw new Error("Gmail profile did not return a historyId");
@@ -132,7 +135,9 @@ export const gmailProvider: WatcherProvider = {
     _config: Record<string, unknown>,
     _watcherKey: string,
   ): Promise<FetchResult> {
-    const connection = await resolveOAuthConnection(credentialService);
+    const connection = await resolveOAuthConnection(credentialService, {
+      requiredScopes: GMAIL_REQUIRED_SCOPES,
+    });
 
     if (!watermark) {
       // No watermark — get initial position, return no items

package/src/workflows/engine-integration.test.ts

@@ -186,7 +186,7 @@ import {
 } from "./journal-store.js";
 import { runLeaf } from "./leaf-runner.js";
 
-initializeDb();
+await initializeDb();
 
 // ---------------------------------------------------------------------------
 // Shared fixtures

package/src/workflows/engine.test.ts

@@ -24,7 +24,7 @@ import {
 import * as journalStore from "./journal-store.js";
 import type { LeafResult, RunLeafOptions } from "./leaf-runner.js";
 
-initializeDb();
+await initializeDb();
 
 function resetTables(): void {
   getSqlite().exec("DELETE FROM workflow_journal");

package/src/workflows/engine.ts

@@ -638,6 +638,11 @@ export async function executeWorkflow(
   let inputTokens = existing ? existing.inputTokens : 0;
   let outputTokens = existing ? existing.outputTokens : 0;
   let capExceeded = false;
+  // Warn ONCE per run (not per leaf) the first time a schema leaf is launched:
+  // schema leaves run with no tools, so a judge panel that correctly passes its
+  // content inline shouldn't get a wall of warnings, but the author still gets a
+  // visible signal that these leaves cannot read.
+  let warnedSchemaLeafNoTools = false;
 
   /** Persist live counters so `getRun` reports them mid-flight. */
   const flushCounters = (): void => {
@@ -697,6 +702,23 @@ export async function executeWorkflow(
       // resolved capabilities always include a non-empty read-only baseline, so
       // forward `tools` only on the tool-leaf path; a schema leaf runs with none.
       const isSchemaLeaf = leafOpts.schema !== undefined;
+      if (isSchemaLeaf && !warnedSchemaLeafNoTools) {
+        warnedSchemaLeafNoTools = true;
+        // The forced-tool-choice structured-output path forwards NO tools, so a
+        // schema leaf has no file_read/file_list/recall/web_search — it cannot
+        // read files or look anything up. A schema leaf told to "read these
+        // files and compare" will answer from the model's prior, not real data
+        // (the source of confabulated output). Anything it must judge has to be
+        // passed inline in its prompt. Surfaced once per run as a backstop; the
+        // primary guidance lives in the workflows skill the author reads first.
+        log.warn(
+          { runId },
+          "Schema leaves run with NO tools (no file_read/file_list/recall/" +
+            "web_search) — they cannot read files or recall memory. Pass any " +
+            "content a schema leaf must judge INLINE in its prompt; a schema " +
+            "leaf asked to read or look something up will confabulate.",
+        );
+      }
       const result = await leafRunner({
         prompt,
         ...(leafOpts.label !== undefined ? { label: leafOpts.label } : {}),

package/src/workflows/fanout-load.test.ts

@@ -63,7 +63,7 @@ describe.skipIf(!apiKey)(
     test(
       "200-leaf fan-out at default concurrency does not rate-limit-collapse",
       async () => {
-        initializeDb();
+        await initializeDb();
 
         // Non-trivial per-leaf context mirrors the real fan-out shape: each
         // leaf judges a distinct synthetic record, not a one-token prompt.

package/src/workflows/journal-store.test.ts

@@ -22,7 +22,7 @@ import {
   updateRun,
 } from "./journal-store.js";
 
-initializeDb();
+await initializeDb();
 
 const DAY_MS = 24 * 60 * 60 * 1000;
 

package/src/workflows/leaf-runner.test.ts

@@ -150,7 +150,7 @@ import type { Tool, ToolContext, ToolExecutionResult } from "../tools/types.js";
 import { getWorkspaceDir } from "../util/platform.js";
 import { runLeaf, WorkflowUnknownProfileError } from "./leaf-runner.js";
 
-initializeDb();
+await initializeDb();
 
 const trustContext = {
   sourceChannel: "vellum" as const,
@@ -511,6 +511,45 @@ describe("runLeaf — tool path", () => {
   });
 });
 
+describe("runLeaf — tool path fails loud on empty output", () => {
+  test("rethrows a swallowed provider rejection instead of returning empty", async () => {
+    // The agent loop does not throw out of run() on a provider rejection — it
+    // emits an `error` event and returns with no assistant text. An empty
+    // responseQueue makes the mocked provider reject on the first call, which
+    // the real AgentLoop swallows. Before the fix runToolLeaf returned
+    // `{ output: "" }` (a phantom success the engine scored as completed); now
+    // the leaf rethrows the captured error so the engine journals it failed.
+    responseQueue = [];
+
+    await expect(
+      runLeaf({ prompt: "do work", tools: [], trustContext }),
+    ).rejects.toThrow(/responseQueue exhausted/);
+  });
+
+  test("throws when the model produces no output text", async () => {
+    // A clean end_turn with empty text is still a failure for a leaf whose
+    // contract is to return a result — surfacing it lets `map`/`parallel`
+    // yield null rather than a silent empty success.
+    responseQueue = [
+      {
+        content: [{ type: "text", text: "   " }],
+        model: "test",
+        usage: { inputTokens: 4, outputTokens: 0 },
+        stopReason: "end_turn",
+      },
+    ];
+
+    await expect(
+      runLeaf({
+        prompt: "do work",
+        tools: [],
+        label: "empty-leaf",
+        trustContext,
+      }),
+    ).rejects.toThrow(/produced no output text/);
+  });
+});
+
 describe("runLeaf — no persistence", () => {
   test("creates no conversation rows and no workspace files", async () => {
     const tmp = mkdtempSync(join(tmpdir(), "leaf-runner-test-"));

package/src/workflows/leaf-runner.ts

@@ -449,12 +449,22 @@ async function runToolLeaf(
   let inputTokens = 0;
   let outputTokens = 0;
   let toolCallCount = 0;
+  // The agent loop is shared with the main-agent path: on a terminal provider
+  // rejection it does NOT throw out of `run()` — it emits an `error` event and
+  // returns with no assistant text, leaving the main loop's event consumer to
+  // surface it. A leaf has no such consumer, so capture the terminal error here
+  // and rethrow it below; otherwise a swallowed rejection becomes an empty
+  // `output` the engine scores as success — a whole fan-out "completes" having
+  // produced nothing (`clustersAuthored: 0` with an empty failure list).
+  let loopError: Error | undefined;
   const onEvent = (event: AgentEvent): void => {
     if (event.type === "usage") {
       inputTokens += event.inputTokens;
       outputTokens += event.outputTokens;
     } else if (event.type === "tool_use") {
       toolCallCount += 1;
+    } else if (event.type === "error") {
+      loopError = event.error;
     }
   };
 
@@ -467,8 +477,23 @@ async function runToolLeaf(
     ...(overrideProfile !== undefined ? { overrideProfile } : {}),
   });
 
+  const output = finalAssistantText(result.history);
+  // Fail loud on a leaf that produced nothing. A captured terminal error is
+  // rethrown verbatim (the real failure); empty output with no error means the
+  // model emitted no text — still a failure for a leaf whose contract is to
+  // return a result. Either way the leaf rejects, so the engine journals it
+  // `failed` and `map`/`parallel` yield `null` instead of a phantom success.
+  if (output.length === 0) {
+    throw (
+      loopError ??
+      new Error(
+        `Workflow tool leaf "${opts.label ?? "tool"}" produced no output text.`,
+      )
+    );
+  }
+
   return {
-    output: finalAssistantText(result.history),
+    output,
     inputTokens,
     outputTokens,
     toolCallCount,