@zackbart/connecta 0.24.2 → 0.24.3

package/dist/connectors/remote-mcp.js

@@ -1,7 +1,7 @@
-import { Client, isInputRequiredResult, specTypeSchemas, StreamableHTTPClientTransport, UnauthorizedError, } from "@modelcontextprotocol/client";
+import { Client, ProtocolError, SdkHttpError, isInputRequiredResult, specTypeSchemas, StreamableHTTPClientTransport, UnauthorizedError, } from "@modelcontextprotocol/client";
 import { KvOAuthProvider, OAuthRefreshCoordinator, } from "../auth/downstream-oauth.js";
 import { MAX_CATALOG_TOOLS } from "../catalog-limits.js";
-import { ConnectorCallError, msg } from "../errors.js";
+import { boundedEchoText, ConnectorCallError, msg, unavailableCallError, } from "../errors.js";
 import { CONNECTA_VERSION } from "../version.js";
 /**
  * Apply a maintained provider's slot copy and header framing to credential
@@ -157,6 +157,28 @@ async function terminateSession(transport, logger, connectorId) {
         });
     });
 }
+/** Classify protocol/status facts; provider prose never decides retryability. */
+function downstreamCallError(error) {
+    if (error instanceof ProtocolError && error.code === -32602) {
+        return new ConnectorCallError("invalid_args", boundedEchoText(error.message));
+    }
+    if (error instanceof SdkHttpError && error.status >= 400 && error.status < 500) {
+        let message = error.message;
+        if (typeof error.data.text === "string") {
+            try {
+                const body = JSON.parse(error.data.text);
+                const detail = body?.message ?? body?.error?.message ?? body?.error_description;
+                if (typeof detail === "string")
+                    message = detail;
+            }
+            catch {
+                // Non-JSON refusals still retain a bounded diagnostic.
+            }
+        }
+        return new ConnectorCallError(error.status === 429 ? "rate_limited" : error.status === 408 ? "timeout" : "connector_call_failed", boundedEchoText(message));
+    }
+    return error;
+}
 const encoder = new TextEncoder();
 /** Base64 of a UTF-8 string, Web-API only so the core still runs on workerd. */
 function base64Utf8(value) {
@@ -266,10 +288,18 @@ export function redirectSafeFetch(connectorId, policy = "none", baseFetch = fetc
         const seen = new Set([current.href]);
         let hops = 0;
         while (true) {
-            const response = await baseFetch(current, {
-                ...init,
-                redirect: "manual",
-            });
+            let response;
+            try {
+                response = await baseFetch(current, {
+                    ...init,
+                    redirect: "manual",
+                });
+            }
+            catch (cause) {
+                if (cause instanceof ConnectorCallError)
+                    throw cause;
+                throw unavailableCallError(cause, current.href);
+            }
             if (!REDIRECT_STATUSES.has(response.status))
                 return response;
             const location = response.headers.get("location");
@@ -549,19 +579,38 @@ export function remoteMcp(id, opts) {
         state.credentialDigest = null;
         // `closed` is deliberately not cleared — see ConnectionState.
     };
-    const closeHalf = async (state) => {
+    // The context has no deferred-work hook. Detached exits start this bounded
+    // best-effort tail immediately; closeScope awaits its own tail so the core
+    // can pass it to the runtime's deferred channel.
+    const closingSessions = new WeakMap();
+    const closeConnection = (client, transport, logger) => {
+        const previous = transport && closingSessions.get(transport);
+        if (previous)
+            return previous;
+        const closing = (async () => {
+            try {
+                if (transport)
+                    await terminateSession(transport, logger, id);
+                if (client)
+                    await client.close();
+                else
+                    await transport?.close();
+            }
+            catch {
+                // Local close cannot replace the operation's result.
+            }
+        })();
+        // A connect can acquire a session after an early close. Deduplicate only
+        // once that session exists, so its late abandonment still sends DELETE.
+        if (transport?.sessionId)
+            closingSessions.set(transport, closing);
+        return closing;
+    };
+    const closeHalf = (state, ctx) => {
         const client = state.client;
         const transport = state.transport;
         reset(state);
-        try {
-            if (client)
-                await client.close();
-            else
-                await transport?.close();
-        }
-        catch {
-            // The discarded state remains authoritative if local close fails.
-        }
+        void closeConnection(client, transport, ctx.logger);
     };
     const ensureConnected = async (ctx, state) => {
         // A 401 after connect is a verdict for the whole request scope, not merely
@@ -581,7 +630,7 @@ export function remoteMcp(id, opts) {
             if (provider.isOperatorDisconnectedGeneration(oauthGeneration)) {
                 const connecting = state.connecting;
                 void connecting?.catch(() => { });
-                await closeHalf(state);
+                closeHalf(state, ctx);
                 throw operatorDisconnectedError();
             }
         }
@@ -592,7 +641,7 @@ export function remoteMcp(id, opts) {
             if (state.closed)
                 throw scopeEndedError();
             if (oauthGeneration !== state.connectedGeneration) {
-                reset(state);
+                closeHalf(state, ctx);
             }
         }
         // The static-credential counterpart of the epoch read above, and
@@ -618,7 +667,7 @@ export function remoteMcp(id, opts) {
                     throw scopeEndedError();
                 const connecting = state.connecting;
                 void connecting?.catch(() => { });
-                await closeHalf(state);
+                closeHalf(state, ctx);
             }
         }
         if (state.closed)
@@ -629,13 +678,8 @@ export function remoteMcp(id, opts) {
             let attempt;
             attempt = (async () => {
                 const ownsAttempt = () => state.connecting === attempt && !state.closed;
-                const abandon = async (owner) => {
-                    try {
-                        await owner.close();
-                    }
-                    catch {
-                        // The attempt is detached either way.
-                    }
+                const abandon = (client, transport) => {
+                    void closeConnection(client, transport, ctx.logger);
                     throw scopeEndedError();
                 };
                 // Let the assignment immediately below this async IIFE publish
@@ -666,7 +710,7 @@ export function remoteMcp(id, opts) {
                 });
                 const t = buildTransport(ctx, provider, credentialFramed);
                 if (!ownsAttempt())
-                    await abandon(t);
+                    abandon(null, t);
                 state.transport = t;
                 try {
                     await c.connect(t);
@@ -675,7 +719,7 @@ export function remoteMcp(id, opts) {
                     // that race anyway, close the resulting client rather than
                     // resurrecting a session in the detached state object.
                     if (!ownsAttempt())
-                        await abandon(c);
+                        abandon(c, t);
                     // A force re-auth that landed WHILE we were connecting wiped the
                     // credentials this client just bound to. Discard it rather than
                     // cache a stale-isolate connection.
@@ -685,24 +729,22 @@ export function remoteMcp(id, opts) {
                         // connect succeeded but before this client is cached. Discard the
                         // client on that side of the await too.
                         if (!ownsAttempt())
-                            await abandon(c);
+                            abandon(c, t);
                         if (generation !== genAtStart) {
-                            try {
-                                await c.close();
-                            }
-                            catch {
-                                // discarding either way
-                            }
+                            void closeConnection(c, t, ctx.logger);
                             throw new UnauthorizedError("Connector was re-authorized during connect; reconnect required.");
                         }
                     }
                     if (!ownsAttempt())
-                        await abandon(c);
+                        abandon(c, t);
                     state.client = c;
                     state.connectedGeneration = genAtStart;
                     state.authRequired = false;
                 }
                 catch (err) {
+                    void closeConnection(c, t, ctx.logger);
+                    if (ownsAttempt())
+                        state.transport = null;
                     // Only a real 401/UnauthorizedError means auth is the problem — a
                     // network error on an oauth connector must surface as "error", not
                     // "auth_required".
@@ -748,7 +790,7 @@ export function remoteMcp(id, opts) {
             // client/transport exists. Reset is unconditional because KV may already
             // be fenced behind a newer epoch after a cleanup error.
             void connecting?.catch(() => { });
-            await closeHalf(state);
+            closeHalf(state, ctx);
         }
     };
     const connector = {
@@ -976,7 +1018,7 @@ export function remoteMcp(id, opts) {
                         state.authRequired = true;
                     throw authRequiredError(err);
                 }
-                throw err;
+                throw downstreamCallError(err);
             }
         },
         async closeScope(ctx) {
@@ -993,20 +1035,7 @@ export function remoteMcp(id, opts) {
             const client = state.client;
             const transport = state.transport;
             reset(state);
-            // Ask the downstream to drop its session first — closing only aborts our
-            // side, and the DELETE that frees the server's rides on the very
-            // AbortSignal the close is about to trip.
-            if (transport)
-                await terminateSession(transport, ctx.logger, id);
-            // Client.close() owns its connected transport. During an unfinished or
-            // failed connect there is no cached client yet, so close the transport
-            // directly to abort/release that half-open session.
-            if (client) {
-                await client.close();
-            }
-            else {
-                await transport?.close();
-            }
+            await closeConnection(client, transport, ctx.logger);
         },
         async status(ctx) {
             const state = stateFor(ctx);
@@ -1054,7 +1083,9 @@ export function remoteMcp(id, opts) {
             }
             await provider.clearPending();
             // Reset so the next use reconnects with the freshly stored tokens.
-            reset(state);
+            if (!state.transport)
+                state.transport = t;
+            closeHalf(state, ctx);
         },
     };
     if (opts.auth?.type === "oauth") {

package/dist/errors.d.ts

@@ -39,6 +39,17 @@ export declare function boundedEchoText(value: string, maxBytes?: number): strin
 export declare function echoedCallArgs(args: unknown): {
     args?: unknown;
 };
+/** Optional transport diagnostics; never a URL path or raw runtime message. */
+interface UnavailableDetails {
+    /** HTTP(S) origin only, at most 253 UTF-8 bytes. */
+    host?: string;
+    /** Validated network errno or `timeout`, at most 32 bytes. */
+    code?: string;
+}
+/** Runtime fields only: provider prose cannot supply an errno or a deadline. */
+export declare function networkErrorCode(error: unknown): string | undefined;
+/** Use at a fetch boundary where the destination and transport failure are known. */
+export declare function unavailableCallError(cause: unknown, host?: string, message?: string): ConnectorCallError;
 /** Agent-visible recovery class attached only to `auth_required` failures. */
 export type AuthRecoveryMode = "oauth" | "operator_config" | "unavailable";
 /**
@@ -67,15 +78,20 @@ export declare class ConnectorCallError extends Error {
     readonly retryAfterMs: number | undefined;
     /** Bounded schema findings for `invalid_args`; never submitted values. */
     readonly validation: ArgumentValidationDetails | undefined;
+    /** Sanitized transport diagnostics for `unavailable` only. */
+    readonly details: UnavailableDetails | undefined;
     constructor(code: ConnectorCallErrorCode, message: string, opts?: {
         retryable?: boolean;
         retryAfterMs?: number;
         cause?: unknown;
         validation?: ArgumentValidationDetails;
+        details?: UnavailableDetails;
     });
 }
 /** The `error` object surfaced in value-mode call results and rejected promises. */
 export interface CallErrorDetails {
+    /** Sanitized transport diagnostics, absent when the runtime supplies none. */
+    details?: UnavailableDetails;
     code: string;
     message: string;
     retryable: boolean;
@@ -151,3 +167,4 @@ export declare function framingError(code: string, message: string): CallErrorDe
  */
 export declare function classifyCallError(err: unknown, fallbackCode?: string): CallErrorDetails;
 export declare function msg(err: unknown): string;
+export {};

package/dist/errors.js

@@ -102,6 +102,58 @@ function boundedValidation(details) {
         ...(truncated ? { truncated: true } : {}),
     };
 }
+const NETWORK_ERROR_CODES = new Set([
+    "ECONNREFUSED", "ENOTFOUND", "ECONNRESET", "ETIMEDOUT", "EAI_AGAIN",
+    "EAI_FAIL", "EHOSTUNREACH", "ENETUNREACH", "ENETDOWN", "EHOSTDOWN",
+    "ECONNABORTED", "EPIPE", "EACCES", "EPERM",
+    "UND_ERR_CONNECT_TIMEOUT", "UND_ERR_HEADERS_TIMEOUT", "UND_ERR_BODY_TIMEOUT",
+    "UND_ERR_SOCKET", "timeout",
+]);
+function networkCode(value) {
+    return typeof value === "string" && value.length <= 32 && NETWORK_ERROR_CODES.has(value)
+        ? value
+        : undefined;
+}
+function sanitizedUnavailableDetails(details) {
+    if (!details)
+        return undefined;
+    let host;
+    if (typeof details.host === "string") {
+        try {
+            const url = new URL(details.host);
+            if ((url.protocol === "https:" || url.protocol === "http:") &&
+                echoEncoder.encode(url.origin).length <= 253)
+                host = url.origin;
+        }
+        catch {
+            // An invalid or oversized origin is absent, never a clipped destination.
+        }
+    }
+    const code = networkCode(details.code);
+    return host || code ? { ...(host ? { host } : {}), ...(code ? { code } : {}) } : undefined;
+}
+/** Runtime fields only: provider prose cannot supply an errno or a deadline. */
+export function networkErrorCode(error) {
+    if (!error || typeof error !== "object")
+        return undefined;
+    if (error instanceof Error &&
+        (error.name === "AbortError" || error.name === "TimeoutError")) {
+        return "timeout";
+    }
+    const runtime = error;
+    const cause = runtime.cause;
+    return networkCode(runtime.code) ?? (cause && typeof cause === "object"
+        ? networkCode(cause.code)
+        : undefined);
+}
+/** Use at a fetch boundary where the destination and transport failure are known. */
+export function unavailableCallError(cause, host, message = "Could not reach the downstream service.") {
+    const code = networkErrorCode(cause);
+    return new ConnectorCallError("unavailable", message, {
+        cause,
+        details: { ...(host ? { host } : {}), ...(code ? { code } : {}) },
+    });
+}
 const RETRYABLE_BY_CODE = {
     timeout: true,
     rate_limited: true,
@@ -146,12 +198,16 @@ export class ConnectorCallError extends Error {
     retryAfterMs;
     /** Bounded schema findings for `invalid_args`; never submitted values. */
     validation;
+    /** Sanitized transport diagnostics for `unavailable` only. */
+    details;
     constructor(code, message, opts = {}) {
         super(message, opts.cause !== undefined ? { cause: opts.cause } : undefined);
         this.name = "ConnectorCallError";
         this.code = code;
         this.retryable = opts.retryable ?? RETRYABLE_BY_CODE[code];
         this.retryAfterMs = normalizeRetryAfterMs(opts.retryAfterMs);
+        this.details =
+            code === "unavailable" ? sanitizedUnavailableDetails(opts.details) : undefined;
         this.validation =
             code === "invalid_args" ? boundedValidation(opts.validation) : undefined;
     }
@@ -164,6 +220,7 @@ export class ConnectorCallError extends Error {
  * trusts the flag would cheerfully retry a refusal forever.
  */
 const NEVER_RETRYABLE_FRAMING = new Set([
+    "result_processing_failed",
     "unknown_address",
     "unknown_tool",
     "ambiguous_tool_alias",
@@ -203,6 +260,7 @@ export function classifyCallError(err, fallbackCode = "connector_call_failed") {
                 ? { retryAfterMs: err.retryAfterMs }
                 : {}),
             ...(err.validation ? { validation: err.validation } : {}),
+            ...(err.details ? { details: err.details } : {}),
         };
     }
     // An aborted fetch rejects with a DOMException named "AbortError" whose

package/dist/execute.js

@@ -130,7 +130,8 @@ export class EmitCollector {
     accept(raw) {
         const block = requireEmittedBlock(raw);
         if (this.blocks.length >= this.maxBlocks) {
-            throw guestFailure("budget_exceeded", `connecta.emit block-count budget exceeded: ${this.maxBlocks} block(s) maximum, 0 remaining`);
+            // M5: distinguish exhausted block slots from the remaining byte budget.
+            throw guestFailure("budget_exceeded", `connecta.emit block-count budget exceeded: ${this.maxBlocks} block(s) maximum, 0 blocks remaining; ${this.maxBytes - this.bytes} of ${this.maxBytes} serialized bytes remaining`);
         }
         const size = diagnosticsEncoder.encode(JSON.stringify(block)).byteLength;
         if (this.bytes + size > this.maxBytes) {
@@ -171,6 +172,48 @@ function guestFailureSecret() {
     crypto.getRandomValues(words);
     return Array.from(words, (word) => word.toString(16).padStart(8, "0")).join("");
 }
+/**
+ * E1/X11: bound the serialized frame, including JSON escapes, before transport.
+ * Keep optional recovery whole: clipping an address or echoed args could turn
+ * recovery into a different call. Oversized metadata is omitted instead.
+ */
+function boundedGuestFailure(failure) {
+    const boundText = (text, maxChars) => {
+        if (JSON.stringify(text).length <= maxChars)
+            return text;
+        let low = 0;
+        let high = Math.min(text.length, maxChars);
+        while (low < high) {
+            const mid = Math.ceil((low + high) / 2);
+            if (JSON.stringify(`${text.slice(0, mid)}…`).length <= maxChars)
+                low = mid;
+            else
+                high = mid - 1;
+        }
+        // Do not manufacture a lone surrogate when clipping a Unicode message.
+        if (low > 0 && /[\uD800-\uDBFF]/.test(text[low - 1]))
+            low--;
+        return `${text.slice(0, low)}…`;
+    };
+    let details = {
+        ...failure.details,
+        code: boundText(failure.details.code, 128),
+        message: boundText(failure.details.message, 2_000),
+    };
+    // 3,700 plus the prefix and 32-character secret stays below QuickJS's
+    // 4,000-character error bound, with room for bridge-added context.
+    if (JSON.stringify(details).length > 3_700) {
+        details = {
+            code: details.code,
+            message: details.message,
+            retryable: details.retryable,
+            ...(details.retryAfterMs !== undefined
+                ? { retryAfterMs: details.retryAfterMs }
+                : {}),
+        };
+    }
+    return new InvocationFailure(details);
+}
 function framedGuestFailure(secret, failure) {
     const framed = new InvocationFailure(failure.details);
     framed.message =
@@ -191,7 +234,8 @@ function guestErrorPrelude(failureSecret) {
   function ConnectaError(message, options) {
     let details;
     if (typeof message === "string" && startsWith(message, failurePrefix)) {
-      try { details = parse(slice(message, failurePrefix.length)); } catch {}
+      try { details = parse(slice(message, failurePrefix.length)); }
+      catch { message = "Invalid host failure frame."; }
     }
     const error = construct(
       NativeError,
@@ -238,17 +282,18 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
     const hostCallTimeoutMs = Math.max(1, Math.trunc(limits.hostCallTimeoutMs ?? EXECUTE_HOST_CALL_TIMEOUT_MS));
     const failureSecret = guestFailureSecret();
     let hostCalls = 0;
+    // L4/M7: discovery and invocation spend the same budget; emit does not.
+    const spendHostCall = () => {
+        hostCalls++;
+        if (hostCalls > maxHostCalls) {
+            throw guestFailure("budget_exceeded", `execute_code host-call budget exceeded (${maxHostCalls} calls maximum)`);
+        }
+    };
     const invocationContext = () => ({
         source: "execute_code",
         timeoutMs: hostCallTimeoutMs,
         ...(limits.signal !== undefined ? { requestSignal: limits.signal } : {}),
         unwrapResult: true,
-        beforeDispatch: () => {
-            hostCalls++;
-            if (hostCalls > maxHostCalls) {
-                throw guestFailure("budget_exceeded", `execute_code host-call budget exceeded (${maxHostCalls} calls maximum)`);
-            }
-        },
     });
     /**
      * Discovery policy failures use the same thrown vocabulary as calls and
@@ -268,6 +313,7 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
     const timedCatalog = async (operation, fn) => {
         const started = Date.now();
         try {
+            spendHostCall();
             const result = await fn();
             limits.diagnostics?.recordCatalog(operation, Date.now() - started, true, result);
             return result;
@@ -278,6 +324,7 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
         }
     };
     const callAddress = async (address, args) => {
+        spendHostCall();
         const outcome = await invocation.invoke(String(address), args ?? {}, invocationContext());
         limits.diagnostics?.recordCall(outcome);
         if (!outcome.ok)
@@ -296,7 +343,9 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
             }
             limits.emitCollector.accept(block);
         },
-        search: async (raw) => timedCatalog("search", () => typedDiscovery(async () => {
+        // Not `async`: a synchronous budget refusal must reject the same promise
+        // the transport wrapper awaits, or workerd reports an unhandled rejection.
+        search: (raw) => timedCatalog("search", () => typedDiscovery(async () => {
             const args = (raw ?? {});
             const result = flatSearchResult(await catalog.search({
                 ...args,
@@ -305,7 +354,7 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
             boundedDiscoveryText(result, "Request a smaller limit, omit fullDescriptions, use compact schemas, or pass includeSchemaKeys: false.");
             return result;
         })),
-        describe: async (raw) => timedCatalog("describe", () => typedDiscovery(async () => {
+        describe: (raw) => timedCatalog("describe", () => typedDiscovery(async () => {
             const args = (raw ?? {});
             const result = { tools: await catalog.describe(args) };
             boundedDiscoveryText(result, 'Split the address list or use format: "compact".');
@@ -320,8 +369,9 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
             }
             catch (err) {
                 if (err instanceof InvocationFailure) {
-                    const framed = framedGuestFailure(failureSecret, err);
-                    limits.onInvocationFailure?.(err);
+                    const failure = boundedGuestFailure(err);
+                    const framed = framedGuestFailure(failureSecret, failure);
+                    limits.onInvocationFailure?.(failure);
                     throw framed;
                 }
                 throw err;
@@ -377,6 +427,8 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                     signal: controller.signal,
                     onInvocationFailure: (failure) => {
                         invocationFailures.push(failure);
+                        if (invocationFailures.length > 64)
+                            invocationFailures.shift();
                     },
                     emitCollector: emitted,
                     ...(diagnostics ? { diagnostics } : {}),
@@ -407,6 +459,9 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
             }
         }
         catch (err) {
+            const logs = err !== null && typeof err === "object" && "logs" in err
+                ? executeLogs(err.logs)
+                : undefined;
             if (err instanceof ExecutorAdmissionError) {
                 if (err.code === "executor_overloaded") {
                     logger.warn("[connecta] execute_code admission rejected", {
@@ -415,6 +470,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                     });
                 }
                 return failureResponse(err.message, {
+                    logs,
                     emitted: err instanceof ExecutorExecutionError ? emitted : undefined,
                     diagnostics,
                     code: {
@@ -428,6 +484,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                 });
             }
             return failureResponse(`Executor failed: ${msg(err)}`, {
+                logs,
                 emitted,
                 diagnostics,
                 code: "executor_failed",
@@ -440,10 +497,8 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
             lease?.release();
             options.signal?.removeEventListener("abort", forwardAbort);
         }
-        const logs = outcome.logs && outcome.logs.length > 0
-            ? truncateExecuteText(outcome.logs.join("\n"), MAX_EXECUTE_LOG_CHARS)
-            : undefined;
-        if (outcome.error) {
+        const logs = executeLogs(outcome.logs);
+        if (outcome.error !== undefined) {
             // Executor bridges necessarily reduce thrown host errors to strings.
             // Match that terminal string back to the request-local typed failure so
             // an unhandled tool failure keeps the same structured contract as
@@ -457,8 +512,13 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
             // rather than losing it to prose.
             let invocationFailure;
             for (const match of [
-                (candidate) => [candidate.message, guestFailureFrames.get(candidate)].includes(outcome.error),
-                (candidate) => [candidate.message, guestFailureFrames.get(candidate)].some((message) => message !== undefined && outcome.error?.includes(message) === true),
+                (candidate) => outcome.error !== "" &&
+                    [candidate.message, guestFailureFrames.get(candidate)].includes(outcome.error),
+                (candidate) => [candidate.message, guestFailureFrames.get(candidate)].some((message) => 
+                // E6: empty or tiny prose cannot identify a wrapped failure.
+                message !== undefined &&
+                    message.length >= 8 &&
+                    outcome.error?.includes(message) === true),
             ]) {
                 for (let i = invocationFailures.length - 1; i >= 0; i--) {
                     const candidate = invocationFailures[i];
@@ -471,10 +531,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                     break;
             }
             if (invocationFailure) {
-                // Handed back whole, with no size guard of its own — the failure was
-                // framed with bounded caller text (`boundedEchoText`) precisely so
-                // this path never needs one. Adding a cap here instead would leave the
-                // top-level surfaces, which have the same amplification, uncovered.
+                // E1/X11: return the same bounded details the guest received.
                 return failureResponse(invocationFailure.details.message, {
                     logs,
                     emitted,
@@ -482,7 +539,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                     code: invocationFailure.details,
                 });
             }
-            const message = `Error: ${outcome.error}`;
+            const message = `Error: ${outcome.error || "Execution failed without an error message."}`;
             return failureResponse(message, {
                 logs,
                 emitted,
@@ -521,6 +578,11 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
         return response;
     };
 }
+function executeLogs(value) {
+    return Array.isArray(value) && value.length > 0 && value.every((entry) => typeof entry === "string")
+        ? truncateExecuteText(value.join("\n"), MAX_EXECUTE_LOG_CHARS)
+        : undefined;
+}
 function failureResponse(message, options) {
     const { logs, emitted, diagnostics, code } = options;
     if (diagnostics || typeof code !== "string") {

package/dist/executor-result.js

@@ -57,7 +57,9 @@ export function prepareExecuteResultForTransport(outcome) {
     // characters). Preserve that Executor-level shape; createExecuteTool applies
     // the smaller model-facing 4k presentation cap in the parent.
     const logs = outcome.logs && outcome.logs.length > 0 ? outcome.logs : undefined;
-    if (outcome.error) {
+    // An empty string is still a failure (E5): the parent renders a fixed
+    // message for it, but this transport must not turn it into a success.
+    if (outcome.error !== undefined) {
         return {
             result: undefined,
             error: outcome.error,

package/dist/executors/quickjs-child.js

@@ -59,7 +59,11 @@ async function run(payload) {
     activeJobId = payload.id;
     try {
         const providers = payload.providers.map(({ name, prelude }) => provider(name, payload.id, prelude));
-        const raw = await executeQuickJs(payload.code, providers, payload.options);
+        const raw = await executeQuickJs(payload.code, providers, payload.options, (entry) => send({
+            type: "log",
+            jobId: payload.id,
+            payloadJson: stringifyBounded(entry, "QuickJS log entry"),
+        }));
         const prepared = {
             outcome: prepareExecuteResultForTransport(raw),
             ...(raw.timedOut ? { timedOut: true } : {}),

package/dist/executors/quickjs-protocol.d.ts

@@ -29,6 +29,10 @@ export type ChildToParentMessage = {
     jobId: number;
     callId: number;
     payloadJson: string;
+} | {
+    type: "log";
+    jobId: number;
+    payloadJson: string;
 } | {
     type: "result";
     jobId: number;

package/dist/executors/quickjs-runtime.d.ts

@@ -22,4 +22,4 @@ export interface QuickJsExecutionResult extends ExecuteResult {
  * CPU accumulates only while evalCode/executePendingJobs is synchronously
  * driving QuickJS, so a slow downstream does not consume the short CPU budget.
  */
-export declare function executeQuickJs(code: string, providers: ExecutorProvider[], options: QuickJsRuntimeOptions): Promise<QuickJsExecutionResult>;
+export declare function executeQuickJs(code: string, providers: ExecutorProvider[], options: QuickJsRuntimeOptions, onLog?: (entry: string) => void): Promise<QuickJsExecutionResult>;