@zackbart/connecta 0.23.0 → 0.24.1

package/dist/credential-rules.d.ts

@@ -0,0 +1,85 @@
+import type { Connector, ConnectorCredentialConfig } from "./types.js";
+/** Which hook a testable credential is checked with. */
+type CredentialTestMode = "single" | "multiple";
+/** Operator-safe explanation shared by every surface that detects shape drift. */
+export declare const STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR = "Stored credential fields do not match this connector's current declaration. Replace the credential before using or testing this connector.";
+export type StoredCredentialShape = {
+    state: "missing";
+} | {
+    state: "valid";
+    mode: CredentialTestMode;
+    /**
+     * Stored keys the connector no longer declares, sorted. Harmless — the
+     * credential works — but worth telling an operator about, since nothing
+     * else in `/ui` can show a field the declaration has stopped naming.
+     */
+    undeclared: string[];
+} | {
+    state: "mismatch";
+    mode: CredentialTestMode;
+    message: typeof STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR;
+};
+/**
+ * Compare a connector's current declaration with the keys in its stored
+ * credential. Values are deliberately ignored: callers may pass decrypted
+ * values or `/credentials`' masked field metadata and get the same answer.
+ *
+ * The test is CONTAINMENT, not equality: the stored key set is compatible when
+ * it holds every field currently declared — the reserved `value` key for a
+ * single-value declaration, every declared name for a named one. Anything the
+ * declaration asks for and the vault does not have is `mismatch`, which is
+ * precisely what a renamed field, a newly added field, or a swap between the
+ * two shapes produces. The swap needs no special case: `value` is never one of
+ * the declared names, so single→named and named→single each leave the declared
+ * side unsatisfied. An empty stored map (reachable through a hand-written
+ * plaintext) satisfies nothing and is a mismatch too.
+ *
+ * Extra keys are NOT drift. They are what *dropping* a field leaves behind, and
+ * every accessor a connector actually uses — `ctx.credential.get("apiKey")`,
+ * `getAll().apiKey` — keeps returning the right secret across that redeploy.
+ * Calling it drift would order an operator to re-enter a working secret that
+ * many providers will not reissue in readable form. The leftovers come back as
+ * `undeclared` instead, for a surface to mention without blocking anything.
+ */
+export declare function storedCredentialShape(config: ConnectorCredentialConfig, stored: Readonly<Record<string, unknown>> | null): StoredCredentialShape;
+/**
+ * The one sentence describing leftover stored fields, so every surface words it
+ * the same way. Names only — the values stay in the vault, and a field name from
+ * a previous declaration is not a secret. Deliberately reassuring: nothing is
+ * broken, and the only thing an operator gains by acting is that a connector
+ * iterating `getAll()` stops seeing a field its code no longer knows about.
+ */
+export declare function describeUndeclaredCredentialFields(fields: string[]): string;
+/** A declared credential shape whose only test hook cannot test it. */
+export interface CredentialTestMismatch {
+    /** The shape the connector declared. */
+    shape: CredentialTestMode;
+    /** The hook it implements, which that shape cannot use. */
+    hook: "testCredential" | "testCredentials";
+}
+export interface CredentialTestRule {
+    /** The hook to call, or null when this credential cannot be tested at all. */
+    mode: CredentialTestMode | null;
+    /** Set only when the sole implemented hook is the one the shape cannot use. */
+    mismatch?: CredentialTestMismatch;
+}
+/**
+ * The one rule deciding whether a connector's credential can be tested — read
+ * by /credentials' `testable` flag, by `POST /ui/credentials/<id>/test` when
+ * it picks a hook, and by the construction-time mismatch warning, so those
+ * three cannot drift apart.
+ *
+ * The declared credential *shape* selects the hook: named `credential.fields`
+ * are tested as a set by `testCredentials`, a single-value `credential` by
+ * `testCredential` on the vault's reserved `value` field. The other hook is
+ * never substituted — it would be handed a shape the connector never declared —
+ * so a connector implementing only the mismatched hook is not testable, and
+ * says so at construction rather than under an operator's click.
+ */
+export declare function credentialTestRule(connector: Pick<Connector, "credential" | "testCredential" | "testCredentials">): CredentialTestRule;
+/**
+ * One clause naming a mismatch, shared by the startup warning and the test
+ * route's 400 so an operator reads the same explanation in both places.
+ */
+export declare function describeCredentialTestMismatch(mismatch: CredentialTestMismatch): string;
+export {};

package/dist/credential-rules.js

@@ -0,0 +1,107 @@
+/** Operator-safe explanation shared by every surface that detects shape drift. */
+export const STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR = "Stored credential fields do not match this connector's current declaration. Replace the credential before using or testing this connector.";
+/**
+ * Compare a connector's current declaration with the keys in its stored
+ * credential. Values are deliberately ignored: callers may pass decrypted
+ * values or `/credentials`' masked field metadata and get the same answer.
+ *
+ * The test is CONTAINMENT, not equality: the stored key set is compatible when
+ * it holds every field currently declared — the reserved `value` key for a
+ * single-value declaration, every declared name for a named one. Anything the
+ * declaration asks for and the vault does not have is `mismatch`, which is
+ * precisely what a renamed field, a newly added field, or a swap between the
+ * two shapes produces. The swap needs no special case: `value` is never one of
+ * the declared names, so single→named and named→single each leave the declared
+ * side unsatisfied. An empty stored map (reachable through a hand-written
+ * plaintext) satisfies nothing and is a mismatch too.
+ *
+ * Extra keys are NOT drift. They are what *dropping* a field leaves behind, and
+ * every accessor a connector actually uses — `ctx.credential.get("apiKey")`,
+ * `getAll().apiKey` — keeps returning the right secret across that redeploy.
+ * Calling it drift would order an operator to re-enter a working secret that
+ * many providers will not reissue in readable form. The leftovers come back as
+ * `undeclared` instead, for a surface to mention without blocking anything.
+ */
+export function storedCredentialShape(config, stored) {
+    if (!stored)
+        return { state: "missing" };
+    const mode = config.fields?.length
+        ? "multiple"
+        : "single";
+    const declared = new Set(mode === "multiple" ? config.fields.map((field) => field.name) : ["value"]);
+    const actual = Object.keys(stored);
+    const present = new Set(actual);
+    for (const field of declared) {
+        if (!present.has(field)) {
+            return {
+                state: "mismatch",
+                mode,
+                message: STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR,
+            };
+        }
+    }
+    return {
+        state: "valid",
+        mode,
+        undeclared: actual.filter((field) => !declared.has(field)).sort(),
+    };
+}
+/** How many leftover field names an advisory names before it summarizes. */
+const UNDECLARED_SAMPLE = 5;
+/**
+ * The one sentence describing leftover stored fields, so every surface words it
+ * the same way. Names only — the values stay in the vault, and a field name from
+ * a previous declaration is not a secret. Deliberately reassuring: nothing is
+ * broken, and the only thing an operator gains by acting is that a connector
+ * iterating `getAll()` stops seeing a field its code no longer knows about.
+ */
+export function describeUndeclaredCredentialFields(fields) {
+    const shown = fields.slice(0, UNDECLARED_SAMPLE);
+    const rest = fields.length - shown.length;
+    const named = shown.join(", ") + (rest > 0 ? `, and ${rest} more` : "");
+    return fields.length === 1
+        ? `Stored credential also holds a field this connector no longer declares (${named}). It keeps working; replace the credential to drop it.`
+        : `Stored credential also holds fields this connector no longer declares (${named}). It keeps working; replace the credential to drop them.`;
+}
+/**
+ * The one rule deciding whether a connector's credential can be tested — read
+ * by /credentials' `testable` flag, by `POST /ui/credentials/<id>/test` when
+ * it picks a hook, and by the construction-time mismatch warning, so those
+ * three cannot drift apart.
+ *
+ * The declared credential *shape* selects the hook: named `credential.fields`
+ * are tested as a set by `testCredentials`, a single-value `credential` by
+ * `testCredential` on the vault's reserved `value` field. The other hook is
+ * never substituted — it would be handed a shape the connector never declared —
+ * so a connector implementing only the mismatched hook is not testable, and
+ * says so at construction rather than under an operator's click.
+ */
+export function credentialTestRule(connector) {
+    if (!connector.credential)
+        return { mode: null };
+    if (connector.credential.fields?.length) {
+        if (connector.testCredentials)
+            return { mode: "multiple" };
+        return connector.testCredential
+            ? { mode: null, mismatch: { shape: "multiple", hook: "testCredential" } }
+            : { mode: null };
+    }
+    if (connector.testCredential)
+        return { mode: "single" };
+    return connector.testCredentials
+        ? { mode: null, mismatch: { shape: "single", hook: "testCredentials" } }
+        : { mode: null };
+}
+/**
+ * One clause naming a mismatch, shared by the startup warning and the test
+ * route's 400 so an operator reads the same explanation in both places.
+ */
+export function describeCredentialTestMismatch(mismatch) {
+    return mismatch.shape === "multiple"
+        ? "it declares named credential fields, which only " +
+            "`testCredentials(values, ctx)` can test, but implements " +
+            "`testCredential`"
+        : "it declares a single-value credential, which only " +
+            "`testCredential(value, ctx)` can test, but implements " +
+            "`testCredentials`";
+}

package/dist/credentials.d.ts

@@ -1,107 +1,11 @@
-import type { Connector, ConnectorCredentialConfig, ConnectorCredentialValues, KVStorage } from "./types.js";
-interface CredentialFieldMetadata {
-    configured: true;
-    /** Only emitted when the value is long enough that four chars don't leak much. */
-    lastFour?: string;
-    updatedAt: string;
-}
-export interface CredentialMetadata {
-    configured: true;
-    /** Backward-compatible metadata for the reserved single credential field. */
-    lastFour?: string;
-    updatedAt: string;
-    /** Per-field masked metadata for named multi-value credentials. */
-    fields?: Record<string, CredentialFieldMetadata>;
-}
-/** Which hook a testable credential is checked with. */
-type CredentialTestMode = "single" | "multiple";
-/** Operator-safe explanation shared by every surface that detects shape drift. */
-export declare const STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR = "Stored credential fields do not match this connector's current declaration. Replace the credential before using or testing this connector.";
-export type StoredCredentialShape = {
-    state: "missing";
-} | {
-    state: "valid";
-    mode: CredentialTestMode;
-    /**
-     * Stored keys the connector no longer declares, sorted. Harmless — the
-     * credential works — but worth telling an operator about, since nothing
-     * else in `/ui` can show a field the declaration has stopped naming.
-     */
-    undeclared: string[];
-} | {
-    state: "mismatch";
-    mode: CredentialTestMode;
-    message: typeof STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR;
-};
-/**
- * Compare a connector's current declaration with the keys in its stored
- * credential. Values are deliberately ignored: callers may pass decrypted
- * values or `/credentials`' masked field metadata and get the same answer.
- *
- * The test is CONTAINMENT, not equality: the stored key set is compatible when
- * it holds every field currently declared — the reserved `value` key for a
- * single-value declaration, every declared name for a named one. Anything the
- * declaration asks for and the vault does not have is `mismatch`, which is
- * precisely what a renamed field, a newly added field, or a swap between the
- * two shapes produces. The swap needs no special case: `value` is never one of
- * the declared names, so single→named and named→single each leave the declared
- * side unsatisfied. An empty stored map (reachable through a hand-written
- * plaintext) satisfies nothing and is a mismatch too.
- *
- * Extra keys are NOT drift. They are what *dropping* a field leaves behind, and
- * every accessor a connector actually uses — `ctx.credential.get("apiKey")`,
- * `getAll().apiKey` — keeps returning the right secret across that redeploy.
- * Calling it drift would order an operator to re-enter a working secret that
- * many providers will not reissue in readable form. The leftovers come back as
- * `undeclared` instead, for a surface to mention without blocking anything.
- */
-export declare function storedCredentialShape(config: ConnectorCredentialConfig, stored: Readonly<Record<string, unknown>> | null): StoredCredentialShape;
-/**
- * The one sentence describing leftover stored fields, so every surface words it
- * the same way. Names only — the values stay in the vault, and a field name from
- * a previous declaration is not a secret. Deliberately reassuring: nothing is
- * broken, and the only thing an operator gains by acting is that a connector
- * iterating `getAll()` stops seeing a field its code no longer knows about.
- */
-export declare function describeUndeclaredCredentialFields(fields: string[]): string;
-/** A declared credential shape whose only test hook cannot test it. */
-export interface CredentialTestMismatch {
-    /** The shape the connector declared. */
-    shape: CredentialTestMode;
-    /** The hook it implements, which that shape cannot use. */
-    hook: "testCredential" | "testCredentials";
-}
-export interface CredentialTestRule {
-    /** The hook to call, or null when this credential cannot be tested at all. */
-    mode: CredentialTestMode | null;
-    /** Set only when the sole implemented hook is the one the shape cannot use. */
-    mismatch?: CredentialTestMismatch;
-}
-/**
- * The one rule deciding whether a connector's credential can be tested — read
- * by /credentials' `testable` flag, by `POST /ui/credentials/<id>/test` when
- * it picks a hook, and by the construction-time mismatch warning, so those
- * three cannot drift apart.
- *
- * The declared credential *shape* selects the hook: named `credential.fields`
- * are tested as a set by `testCredentials`, a single-value `credential` by
- * `testCredential` on the vault's reserved `value` field. The other hook is
- * never substituted — it would be handed a shape the connector never declared —
- * so a connector implementing only the mismatched hook is not testable, and
- * says so at construction rather than under an operator's click.
- */
-export declare function credentialTestRule(connector: Pick<Connector, "credential" | "testCredential" | "testCredentials">): CredentialTestRule;
-/**
- * One clause naming a mismatch, shared by the startup warning and the test
- * route's 400 so an operator reads the same explanation in both places.
- */
-export declare function describeCredentialTestMismatch(mismatch: CredentialTestMismatch): string;
+import type { CredentialMetadata, CredentialVault as Vault } from "./credential-contract.js";
+import type { ConnectorCredentialValues, KVStorage } from "./types.js";
 /**
  * Encrypted, connector-scoped credential vault over the deployment's existing
  * KVStorage. Only ciphertext enters KV; the AES-GCM key remains an environment
  * secret outside the store.
  */
-export declare class CredentialVault {
+export declare class CredentialVault implements Vault {
     private readonly storage;
     private readonly key;
     constructor(storage: KVStorage, encryptionKey: string);
@@ -114,4 +18,4 @@ export declare class CredentialVault {
     setAll(connectorId: string, values: ConnectorCredentialValues, updatedBy: string, owner?: string): Promise<CredentialMetadata>;
     delete(connectorId: string, owner?: string): Promise<void>;
 }
-export {};
+export declare function encryptedCredentialVault(storage: KVStorage, encryptionKey: string): Vault;

package/dist/credentials.js

@@ -3,113 +3,6 @@ const IV_BYTES = 12;
 const MAX_CREDENTIAL_BYTES = 16_384;
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
-/** Operator-safe explanation shared by every surface that detects shape drift. */
-export const STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR = "Stored credential fields do not match this connector's current declaration. Replace the credential before using or testing this connector.";
-/**
- * Compare a connector's current declaration with the keys in its stored
- * credential. Values are deliberately ignored: callers may pass decrypted
- * values or `/credentials`' masked field metadata and get the same answer.
- *
- * The test is CONTAINMENT, not equality: the stored key set is compatible when
- * it holds every field currently declared — the reserved `value` key for a
- * single-value declaration, every declared name for a named one. Anything the
- * declaration asks for and the vault does not have is `mismatch`, which is
- * precisely what a renamed field, a newly added field, or a swap between the
- * two shapes produces. The swap needs no special case: `value` is never one of
- * the declared names, so single→named and named→single each leave the declared
- * side unsatisfied. An empty stored map (reachable through a hand-written
- * plaintext) satisfies nothing and is a mismatch too.
- *
- * Extra keys are NOT drift. They are what *dropping* a field leaves behind, and
- * every accessor a connector actually uses — `ctx.credential.get("apiKey")`,
- * `getAll().apiKey` — keeps returning the right secret across that redeploy.
- * Calling it drift would order an operator to re-enter a working secret that
- * many providers will not reissue in readable form. The leftovers come back as
- * `undeclared` instead, for a surface to mention without blocking anything.
- */
-export function storedCredentialShape(config, stored) {
-    if (!stored)
-        return { state: "missing" };
-    const mode = config.fields?.length
-        ? "multiple"
-        : "single";
-    const declared = new Set(mode === "multiple" ? config.fields.map((field) => field.name) : ["value"]);
-    const actual = Object.keys(stored);
-    const present = new Set(actual);
-    for (const field of declared) {
-        if (!present.has(field)) {
-            return {
-                state: "mismatch",
-                mode,
-                message: STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR,
-            };
-        }
-    }
-    return {
-        state: "valid",
-        mode,
-        undeclared: actual.filter((field) => !declared.has(field)).sort(),
-    };
-}
-/** How many leftover field names an advisory names before it summarizes. */
-const UNDECLARED_SAMPLE = 5;
-/**
- * The one sentence describing leftover stored fields, so every surface words it
- * the same way. Names only — the values stay in the vault, and a field name from
- * a previous declaration is not a secret. Deliberately reassuring: nothing is
- * broken, and the only thing an operator gains by acting is that a connector
- * iterating `getAll()` stops seeing a field its code no longer knows about.
- */
-export function describeUndeclaredCredentialFields(fields) {
-    const shown = fields.slice(0, UNDECLARED_SAMPLE);
-    const rest = fields.length - shown.length;
-    const named = shown.join(", ") + (rest > 0 ? `, and ${rest} more` : "");
-    return fields.length === 1
-        ? `Stored credential also holds a field this connector no longer declares (${named}). It keeps working; replace the credential to drop it.`
-        : `Stored credential also holds fields this connector no longer declares (${named}). It keeps working; replace the credential to drop them.`;
-}
-/**
- * The one rule deciding whether a connector's credential can be tested — read
- * by /credentials' `testable` flag, by `POST /ui/credentials/<id>/test` when
- * it picks a hook, and by the construction-time mismatch warning, so those
- * three cannot drift apart.
- *
- * The declared credential *shape* selects the hook: named `credential.fields`
- * are tested as a set by `testCredentials`, a single-value `credential` by
- * `testCredential` on the vault's reserved `value` field. The other hook is
- * never substituted — it would be handed a shape the connector never declared —
- * so a connector implementing only the mismatched hook is not testable, and
- * says so at construction rather than under an operator's click.
- */
-export function credentialTestRule(connector) {
-    if (!connector.credential)
-        return { mode: null };
-    if (connector.credential.fields?.length) {
-        if (connector.testCredentials)
-            return { mode: "multiple" };
-        return connector.testCredential
-            ? { mode: null, mismatch: { shape: "multiple", hook: "testCredential" } }
-            : { mode: null };
-    }
-    if (connector.testCredential)
-        return { mode: "single" };
-    return connector.testCredentials
-        ? { mode: null, mismatch: { shape: "single", hook: "testCredentials" } }
-        : { mode: null };
-}
-/**
- * One clause naming a mismatch, shared by the startup warning and the test
- * route's 400 so an operator reads the same explanation in both places.
- */
-export function describeCredentialTestMismatch(mismatch) {
-    return mismatch.shape === "multiple"
-        ? "it declares named credential fields, which only " +
-            "`testCredentials(values, ctx)` can test, but implements " +
-            "`testCredential`"
-        : "it declares a single-value credential, which only " +
-            "`testCredential(value, ctx)` can test, but implements " +
-            "`testCredentials`";
-}
 function storageKey(connectorId, owner) {
     return owner
         ? `principal:${owner}:conn:${connectorId}:credential:v1`
@@ -290,3 +183,6 @@ export class CredentialVault {
         await this.storage.delete(storageKey(connectorId, owner));
     }
 }
+export function encryptedCredentialVault(storage, encryptionKey) {
+    return new CredentialVault(storage, encryptionKey);
+}

package/dist/execute.d.ts

@@ -117,6 +117,8 @@ export declare function createExecuteTool(registry: RegistryView, baseUrl: strin
     probeTimeoutMs?: number | undefined;
     maxEmittedBytes?: number | undefined;
     maxEmittedBlocks?: number | undefined;
+    maxHostCalls?: number | undefined;
+    hostCallTimeoutMs?: number | undefined;
     defer?: DeferredWork | undefined;
 }): ({ code, diagnostics: diagnosticsRequested }: {
     code: string;
@@ -143,6 +145,10 @@ export declare function registerExecuteTool(server: McpServer, registry: Registr
     maxEmittedBytes?: number | undefined;
     /** Block-count budget for connecta.emit. Default 32. */
     maxEmittedBlocks?: number | undefined;
+    /** Host calls one program may make. Default 20. */
+    maxHostCalls?: number | undefined;
+    /** Deadline per host call in milliseconds. Default 15_000. */
+    hostCallTimeoutMs?: number | undefined;
     defer?: DeferredWork | undefined;
 }): void;
 export {};

package/dist/execute.js

@@ -141,8 +141,8 @@ export class EmitCollector {
         this.diagnostics?.recordEmitted(this.blocks.length, this.bytes);
     }
 }
-/** A configured emit budget must be a finite number >= 1; anything else falls back. */
-function resolveEmitBudget(value, fallback) {
+/** A positive whole-number budget, or the default when the value is unusable. */
+function resolveBudget(value, fallback) {
     return typeof value === "number" && Number.isFinite(value) && value >= 1
         ? Math.trunc(value)
         : fallback;
@@ -349,7 +349,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
         let lease;
         let outcome;
         const diagnostics = diagnosticsRequested ? new ExecuteDiagnostics() : undefined;
-        const emitted = new EmitCollector(resolveEmitBudget(config.maxEmittedBytes, EXECUTE_MAX_EMITTED_BYTES), resolveEmitBudget(config.maxEmittedBlocks, EXECUTE_MAX_EMITTED_BLOCKS), diagnostics);
+        const emitted = new EmitCollector(resolveBudget(config.maxEmittedBytes, EXECUTE_MAX_EMITTED_BYTES), resolveBudget(config.maxEmittedBlocks, EXECUTE_MAX_EMITTED_BLOCKS), diagnostics);
         const invocationFailures = [];
         try {
             // Admission comes before provider construction: queued calls retain no
@@ -382,6 +382,8 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                     ...(diagnostics ? { diagnostics } : {}),
                     discoveryConcurrency: config.discoveryConcurrency,
                     probeTimeoutMs: config.probeTimeoutMs,
+                    maxHostCalls: config.maxHostCalls,
+                    hostCallTimeoutMs: config.hostCallTimeoutMs,
                     defer: config.defer,
                 });
             }
@@ -585,7 +587,7 @@ function connectorInventory(connectors) {
         return `${prefix}${shown.join(", ")}.`;
     return `${prefix}${shown.join(", ")}${shown.length > 0 ? "; " : ""}+${omitted} more.`;
 }
-const executeDescription = (emitBudgets, connectorGuides, connectors) => `Use the configured services below to answer the task. A known address uses call_tool. Unknown-address and wider read-only work uses one execute_code program for discovery, calls, and reduction. Do not return catalog matches alone. Only readOnlyHint: true tools are available. Limits: ${EXECUTE_MAX_HOST_CALLS} host calls, ${EXECUTE_HOST_CALL_TIMEOUT_MS / 1_000}s/host call.
+const executeDescription = (emitBudgets, hostLimits, connectorGuides, connectors) => `Use the configured services below to answer the task. A known address uses call_tool. Unknown-address and wider read-only work uses one execute_code program for discovery, calls, and reduction. Do not return catalog matches alone. Only readOnlyHint: true tools are available. Limits: ${hostLimits.maxHostCalls} host calls, ${hostLimits.hostCallTimeoutMs / 1_000}s/host call.
 
 ${connectorInventory(connectors)}
 
@@ -603,8 +605,14 @@ export function registerExecuteTool(server, registry, ctx) {
     // Resolved once so the description and the collector cannot disagree about
     // the budgets this deployment actually enforces.
     const emitBudgets = {
-        maxBytes: resolveEmitBudget(ctx.maxEmittedBytes, EXECUTE_MAX_EMITTED_BYTES),
-        maxBlocks: resolveEmitBudget(ctx.maxEmittedBlocks, EXECUTE_MAX_EMITTED_BLOCKS),
+        maxBytes: resolveBudget(ctx.maxEmittedBytes, EXECUTE_MAX_EMITTED_BYTES),
+        maxBlocks: resolveBudget(ctx.maxEmittedBlocks, EXECUTE_MAX_EMITTED_BLOCKS),
+    };
+    // Same rule for host-call limits: the description advertises exactly what
+    // the sandbox enforces, so a raised deadline is visible to the model.
+    const hostLimits = {
+        maxHostCalls: resolveBudget(ctx.maxHostCalls, EXECUTE_MAX_HOST_CALLS),
+        hostCallTimeoutMs: resolveBudget(ctx.hostCallTimeoutMs, EXECUTE_HOST_CALL_TIMEOUT_MS),
     };
     const connectors = registry.listConnectors();
     const handler = createExecuteTool(registry, ctx.baseUrl, ctx.executor, ctx.logger, ctx.activity, {
@@ -612,10 +620,12 @@ export function registerExecuteTool(server, registry, ctx) {
         probeTimeoutMs: ctx.probeTimeoutMs,
         maxEmittedBytes: emitBudgets.maxBytes,
         maxEmittedBlocks: emitBudgets.maxBlocks,
+        maxHostCalls: hostLimits.maxHostCalls,
+        hostCallTimeoutMs: hostLimits.hostCallTimeoutMs,
         defer: ctx.defer,
     });
     server.registerTool("execute_code", {
-        description: executeDescription(emitBudgets, hasConnectorGuides(connectors), connectors),
+        description: executeDescription(emitBudgets, hostLimits, hasConnectorGuides(connectors), connectors),
         inputSchema: z.object({
             code: z
                 .string()