@zackbart/connecta 0.24.2 → 0.24.4

package/dist/execute.js

@@ -130,7 +130,8 @@ export class EmitCollector {
     accept(raw) {
         const block = requireEmittedBlock(raw);
         if (this.blocks.length >= this.maxBlocks) {
-            throw guestFailure("budget_exceeded", `connecta.emit block-count budget exceeded: ${this.maxBlocks} block(s) maximum, 0 remaining`);
+            // M5: distinguish exhausted block slots from the remaining byte budget.
+            throw guestFailure("budget_exceeded", `connecta.emit block-count budget exceeded: ${this.maxBlocks} block(s) maximum, 0 blocks remaining; ${this.maxBytes - this.bytes} of ${this.maxBytes} serialized bytes remaining`);
         }
         const size = diagnosticsEncoder.encode(JSON.stringify(block)).byteLength;
         if (this.bytes + size > this.maxBytes) {
@@ -171,6 +172,48 @@ function guestFailureSecret() {
     crypto.getRandomValues(words);
     return Array.from(words, (word) => word.toString(16).padStart(8, "0")).join("");
 }
+/**
+ * E1/X11: bound the serialized frame, including JSON escapes, before transport.
+ * Keep optional recovery whole: clipping an address or echoed args could turn
+ * recovery into a different call. Oversized metadata is omitted instead.
+ */
+function boundedGuestFailure(failure) {
+    const boundText = (text, maxChars) => {
+        if (JSON.stringify(text).length <= maxChars)
+            return text;
+        let low = 0;
+        let high = Math.min(text.length, maxChars);
+        while (low < high) {
+            const mid = Math.ceil((low + high) / 2);
+            if (JSON.stringify(`${text.slice(0, mid)}…`).length <= maxChars)
+                low = mid;
+            else
+                high = mid - 1;
+        }
+        // Do not manufacture a lone surrogate when clipping a Unicode message.
+        if (low > 0 && /[\uD800-\uDBFF]/.test(text[low - 1]))
+            low--;
+        return `${text.slice(0, low)}…`;
+    };
+    let details = {
+        ...failure.details,
+        code: boundText(failure.details.code, 128),
+        message: boundText(failure.details.message, 2_000),
+    };
+    // 3,700 plus the prefix and 32-character secret stays below QuickJS's
+    // 4,000-character error bound, with room for bridge-added context.
+    if (JSON.stringify(details).length > 3_700) {
+        details = {
+            code: details.code,
+            message: details.message,
+            retryable: details.retryable,
+            ...(details.retryAfterMs !== undefined
+                ? { retryAfterMs: details.retryAfterMs }
+                : {}),
+        };
+    }
+    return new InvocationFailure(details);
+}
 function framedGuestFailure(secret, failure) {
     const framed = new InvocationFailure(failure.details);
     framed.message =
@@ -191,7 +234,8 @@ function guestErrorPrelude(failureSecret) {
   function ConnectaError(message, options) {
     let details;
     if (typeof message === "string" && startsWith(message, failurePrefix)) {
-      try { details = parse(slice(message, failurePrefix.length)); } catch {}
+      try { details = parse(slice(message, failurePrefix.length)); }
+      catch { message = "Invalid host failure frame."; }
     }
     const error = construct(
       NativeError,
@@ -238,17 +282,18 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
     const hostCallTimeoutMs = Math.max(1, Math.trunc(limits.hostCallTimeoutMs ?? EXECUTE_HOST_CALL_TIMEOUT_MS));
     const failureSecret = guestFailureSecret();
     let hostCalls = 0;
+    // L4/M7: discovery and invocation spend the same budget; emit does not.
+    const spendHostCall = () => {
+        hostCalls++;
+        if (hostCalls > maxHostCalls) {
+            throw guestFailure("budget_exceeded", `execute_code host-call budget exceeded (${maxHostCalls} calls maximum)`);
+        }
+    };
     const invocationContext = () => ({
         source: "execute_code",
         timeoutMs: hostCallTimeoutMs,
         ...(limits.signal !== undefined ? { requestSignal: limits.signal } : {}),
         unwrapResult: true,
-        beforeDispatch: () => {
-            hostCalls++;
-            if (hostCalls > maxHostCalls) {
-                throw guestFailure("budget_exceeded", `execute_code host-call budget exceeded (${maxHostCalls} calls maximum)`);
-            }
-        },
     });
     /**
      * Discovery policy failures use the same thrown vocabulary as calls and
@@ -268,6 +313,7 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
     const timedCatalog = async (operation, fn) => {
         const started = Date.now();
         try {
+            spendHostCall();
             const result = await fn();
             limits.diagnostics?.recordCatalog(operation, Date.now() - started, true, result);
             return result;
@@ -278,6 +324,7 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
         }
     };
     const callAddress = async (address, args) => {
+        spendHostCall();
         const outcome = await invocation.invoke(String(address), args ?? {}, invocationContext());
         limits.diagnostics?.recordCall(outcome);
         if (!outcome.ok)
@@ -296,7 +343,9 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
             }
             limits.emitCollector.accept(block);
         },
-        search: async (raw) => timedCatalog("search", () => typedDiscovery(async () => {
+        // Not `async`: a synchronous budget refusal must reject the same promise
+        // the transport wrapper awaits, or workerd reports an unhandled rejection.
+        search: (raw) => timedCatalog("search", () => typedDiscovery(async () => {
             const args = (raw ?? {});
             const result = flatSearchResult(await catalog.search({
                 ...args,
@@ -305,7 +354,7 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
             boundedDiscoveryText(result, "Request a smaller limit, omit fullDescriptions, use compact schemas, or pass includeSchemaKeys: false.");
             return result;
         })),
-        describe: async (raw) => timedCatalog("describe", () => typedDiscovery(async () => {
+        describe: (raw) => timedCatalog("describe", () => typedDiscovery(async () => {
             const args = (raw ?? {});
             const result = { tools: await catalog.describe(args) };
             boundedDiscoveryText(result, 'Split the address list or use format: "compact".');
@@ -320,8 +369,9 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
             }
             catch (err) {
                 if (err instanceof InvocationFailure) {
-                    const framed = framedGuestFailure(failureSecret, err);
-                    limits.onInvocationFailure?.(err);
+                    const failure = boundedGuestFailure(err);
+                    const framed = framedGuestFailure(failureSecret, failure);
+                    limits.onInvocationFailure?.(failure);
                     throw framed;
                 }
                 throw err;
@@ -377,6 +427,8 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                     signal: controller.signal,
                     onInvocationFailure: (failure) => {
                         invocationFailures.push(failure);
+                        if (invocationFailures.length > 64)
+                            invocationFailures.shift();
                     },
                     emitCollector: emitted,
                     ...(diagnostics ? { diagnostics } : {}),
@@ -407,6 +459,9 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
             }
         }
         catch (err) {
+            const logs = err !== null && typeof err === "object" && "logs" in err
+                ? executeLogs(err.logs)
+                : undefined;
             if (err instanceof ExecutorAdmissionError) {
                 if (err.code === "executor_overloaded") {
                     logger.warn("[connecta] execute_code admission rejected", {
@@ -415,6 +470,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                     });
                 }
                 return failureResponse(err.message, {
+                    logs,
                     emitted: err instanceof ExecutorExecutionError ? emitted : undefined,
                     diagnostics,
                     code: {
@@ -428,6 +484,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                 });
             }
             return failureResponse(`Executor failed: ${msg(err)}`, {
+                logs,
                 emitted,
                 diagnostics,
                 code: "executor_failed",
@@ -440,10 +497,8 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
             lease?.release();
             options.signal?.removeEventListener("abort", forwardAbort);
         }
-        const logs = outcome.logs && outcome.logs.length > 0
-            ? truncateExecuteText(outcome.logs.join("\n"), MAX_EXECUTE_LOG_CHARS)
-            : undefined;
-        if (outcome.error) {
+        const logs = executeLogs(outcome.logs);
+        if (outcome.error !== undefined) {
             // Executor bridges necessarily reduce thrown host errors to strings.
             // Match that terminal string back to the request-local typed failure so
             // an unhandled tool failure keeps the same structured contract as
@@ -457,8 +512,13 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
             // rather than losing it to prose.
             let invocationFailure;
             for (const match of [
-                (candidate) => [candidate.message, guestFailureFrames.get(candidate)].includes(outcome.error),
-                (candidate) => [candidate.message, guestFailureFrames.get(candidate)].some((message) => message !== undefined && outcome.error?.includes(message) === true),
+                (candidate) => outcome.error !== "" &&
+                    [candidate.message, guestFailureFrames.get(candidate)].includes(outcome.error),
+                (candidate) => [candidate.message, guestFailureFrames.get(candidate)].some((message) => 
+                // E6: empty or tiny prose cannot identify a wrapped failure.
+                message !== undefined &&
+                    message.length >= 8 &&
+                    outcome.error?.includes(message) === true),
             ]) {
                 for (let i = invocationFailures.length - 1; i >= 0; i--) {
                     const candidate = invocationFailures[i];
@@ -471,10 +531,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                     break;
             }
             if (invocationFailure) {
-                // Handed back whole, with no size guard of its own — the failure was
-                // framed with bounded caller text (`boundedEchoText`) precisely so
-                // this path never needs one. Adding a cap here instead would leave the
-                // top-level surfaces, which have the same amplification, uncovered.
+                // E1/X11: return the same bounded details the guest received.
                 return failureResponse(invocationFailure.details.message, {
                     logs,
                     emitted,
@@ -482,7 +539,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                     code: invocationFailure.details,
                 });
             }
-            const message = `Error: ${outcome.error}`;
+            const message = `Error: ${outcome.error || "Execution failed without an error message."}`;
             return failureResponse(message, {
                 logs,
                 emitted,
@@ -521,6 +578,11 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
         return response;
     };
 }
+function executeLogs(value) {
+    return Array.isArray(value) && value.length > 0 && value.every((entry) => typeof entry === "string")
+        ? truncateExecuteText(value.join("\n"), MAX_EXECUTE_LOG_CHARS)
+        : undefined;
+}
 function failureResponse(message, options) {
     const { logs, emitted, diagnostics, code } = options;
     if (diagnostics || typeof code !== "string") {

package/dist/executor-result.js

@@ -57,7 +57,9 @@ export function prepareExecuteResultForTransport(outcome) {
     // characters). Preserve that Executor-level shape; createExecuteTool applies
     // the smaller model-facing 4k presentation cap in the parent.
     const logs = outcome.logs && outcome.logs.length > 0 ? outcome.logs : undefined;
-    if (outcome.error) {
+    // An empty string is still a failure (E5): the parent renders a fixed
+    // message for it, but this transport must not turn it into a success.
+    if (outcome.error !== undefined) {
         return {
             result: undefined,
             error: outcome.error,

package/dist/executors/quickjs-child.js

@@ -59,7 +59,11 @@ async function run(payload) {
     activeJobId = payload.id;
     try {
         const providers = payload.providers.map(({ name, prelude }) => provider(name, payload.id, prelude));
-        const raw = await executeQuickJs(payload.code, providers, payload.options);
+        const raw = await executeQuickJs(payload.code, providers, payload.options, (entry) => send({
+            type: "log",
+            jobId: payload.id,
+            payloadJson: stringifyBounded(entry, "QuickJS log entry"),
+        }));
         const prepared = {
             outcome: prepareExecuteResultForTransport(raw),
             ...(raw.timedOut ? { timedOut: true } : {}),

package/dist/executors/quickjs-protocol.d.ts

@@ -29,6 +29,10 @@ export type ChildToParentMessage = {
     jobId: number;
     callId: number;
     payloadJson: string;
+} | {
+    type: "log";
+    jobId: number;
+    payloadJson: string;
 } | {
     type: "result";
     jobId: number;

package/dist/executors/quickjs-runtime.d.ts

@@ -22,4 +22,4 @@ export interface QuickJsExecutionResult extends ExecuteResult {
  * CPU accumulates only while evalCode/executePendingJobs is synchronously
  * driving QuickJS, so a slow downstream does not consume the short CPU budget.
  */
-export declare function executeQuickJs(code: string, providers: ExecutorProvider[], options: QuickJsRuntimeOptions): Promise<QuickJsExecutionResult>;
+export declare function executeQuickJs(code: string, providers: ExecutorProvider[], options: QuickJsRuntimeOptions, onLog?: (entry: string) => void): Promise<QuickJsExecutionResult>;

package/dist/executors/quickjs-runtime.js

@@ -80,30 +80,43 @@ export function normalizeCode(code) {
  * and fail closed there.
  */
 function setupScript(providers) {
+    // X11: raw replies carry an authenticated frame. Capture the bridge and
+    // codec before guest code runs, and expose only the decoded provider calls.
     const lines = [
-        `globalThis.console = (() => {
-  const fmt = (x) => { if (typeof x === "string") return x; try { return JSON.stringify(x); } catch { return String(x); } };
-  const emit = (...a) => __log(a.map(fmt).join(" "));
-  return { log: emit, info: emit, warn: emit, error: emit, debug: emit };
-})();`,
-        `globalThis.__invoke = async (ns, fn, args) => {
-  const r = JSON.parse(await __call(ns, fn, JSON.stringify(args)));
-  if (!r.ok) throw new Error(r.error);
-  return r.value;
-};`,
-        `globalThis.__namespace = (ns) => Object.freeze(new Proxy(Object.create(null), {
-  get: (_target, key) => typeof key === "string" ? (...args) => __invoke(ns, key, args) : undefined
-}));`,
+        `(() => {
+  const call = globalThis.__call;
+  const log = globalThis.__log;
+  const parse = JSON.parse;
+  const stringify = JSON.stringify;
+  const freeze = Object.freeze;
+  const ProxyConstructor = Proxy;
+  const create = Object.create;
+  delete globalThis.__call;
+  delete globalThis.__log;
+  globalThis.console = (() => {
+    const fmt = (x) => { if (typeof x === "string") return x; try { return stringify(x); } catch { return String(x); } };
+    const emit = (...a) => log(a.map(fmt).join(" "));
+    return { log: emit, info: emit, warn: emit, error: emit, debug: emit };
+  })();
+  const invoke = async (ns, fn, args) => {
+    const r = parse(await call(ns, fn, stringify(args)));
+    if (!r.ok) throw new GuestError(r.error);
+    return r.value;
+  };
+  const namespace = (ns) => freeze(new ProxyConstructor(create(null), {
+    get: (_target, key) => typeof key === "string" ? (...args) => invoke(ns, key, args) : undefined
+  }));`,
     ];
     for (const p of providers) {
         const ns = JSON.stringify(p.name);
-        lines.push(`globalThis[${ns}] = __namespace(${ns});`);
+        lines.push(`globalThis[${ns}] = namespace(${ns});`);
     }
     for (const p of providers) {
         if (p.prelude)
             lines.push(p.prelude);
     }
-    lines.push(`delete globalThis.__namespace;`);
+    lines.push(`const GuestError = globalThis.Error;
+})();`);
     return lines.join("\n");
 }
 /** True when a dumped error is QuickJS's deadline-interrupt signal. */
@@ -145,7 +158,7 @@ function waitForHostOrDeadline(waitForSettle, remainingMs) {
         });
     });
 }
-function installBridge(ctx, providers, logs) {
+function installBridge(ctx, providers, logs, onLog) {
     const bridge = {
         pending: 0,
         aborted: false,
@@ -156,13 +169,17 @@ function installBridge(ctx, providers, logs) {
     // Keep both the in-memory character budget and the twice-JSON-encoded
     // transport budget. Reserve enough byte budget for whichever truncation
     // marker ends the stream.
+    const captureLog = (entry) => {
+        logs.push(entry);
+        onLog?.(entry);
+    };
     let logTotalChars = 0;
     let logTotalTransportBytes = 0;
     let logBudgetSpent = false;
     const logFn = ctx.newFunction("__log", (h) => {
         if (logs.length >= MAX_LOG_ENTRIES) {
             if (logs.length === MAX_LOG_ENTRIES) {
-                logs.push(LOG_ENTRY_LIMIT_MARKER);
+                captureLog(LOG_ENTRY_LIMIT_MARKER);
             }
             return;
         }
@@ -178,11 +195,11 @@ function installBridge(ctx, providers, logs) {
         if (logTotalChars + entry.length > MAX_LOG_TOTAL_CHARS ||
             logTotalTransportBytes + entryTransportBytes >
                 MAX_QUICKJS_LOG_TRANSPORT_BYTES - MAX_LOG_MARKER_TRANSPORT_BYTES) {
-            logs.push(LOG_SIZE_LIMIT_MARKER);
+            captureLog(LOG_SIZE_LIMIT_MARKER);
             logBudgetSpent = true;
             return;
         }
-        logs.push(entry);
+        captureLog(entry);
         logTotalChars += entry.length;
         logTotalTransportBytes += entryTransportBytes;
     });
@@ -248,7 +265,7 @@ function installBridge(ctx, providers, logs) {
  * CPU accumulates only while evalCode/executePendingJobs is synchronously
  * driving QuickJS, so a slow downstream does not consume the short CPU budget.
  */
-export async function executeQuickJs(code, providers, options) {
+export async function executeQuickJs(code, providers, options, onLog) {
     const { timeoutMs, cpuTimeMs, memoryLimitBytes, maxStackSizeBytes } = options;
     const QuickJS = await getQuickJS();
     const ctx = QuickJS.newContext();
@@ -282,7 +299,7 @@ export async function executeQuickJs(code, providers, options) {
         return wallInterrupted || cpuInterrupted;
     });
     const logs = [];
-    const bridge = installBridge(ctx, providers, logs);
+    const bridge = installBridge(ctx, providers, logs, onLog);
     const finish = (r) => {
         bridge.aborted = true;
         // Outstanding host calls still hold deferred-promise handles; their

package/dist/executors/quickjs.js

@@ -7,6 +7,7 @@ import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { AdmissionController, ExecutorAdmissionError, ExecutorExecutionError, } from "../executor-admission.js";
 import { msg } from "../errors.js";
+import { MAX_EXECUTE_LOG_CHARS } from "../executor-result.js";
 import { hostCallLabel, MAX_QUICKJS_IPC_BYTES, MAX_QUICKJS_HOST_RPC_BYTES, serializedBytes, stringifyBounded, } from "./quickjs-protocol.js";
 export { normalizeCode } from "./quickjs-runtime.js";
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -55,9 +56,14 @@ function nonNegativeWhole(value, fallback, name) {
     return resolved;
 }
 function errorPayload(error) {
+    // X11: a partial authenticated frame exposes its secret instead of decoding.
+    // Refuse it whole if a host ever bypasses execute.ts's framing bound.
+    const message = error.length > MAX_ERROR_CHARS && error.includes("\u001econnecta-error:")
+        ? `Host failure exceeded the ${MAX_ERROR_CHARS}-character bridge limit.`
+        : error.slice(0, MAX_ERROR_CHARS);
     return JSON.stringify({
         ok: false,
-        error: error.slice(0, MAX_ERROR_CHARS),
+        error: message,
     });
 }
 function delay(ms, signal) {
@@ -217,14 +223,13 @@ class QuickJsChildPool {
         child.channel?.ref();
         return new Promise((resolve, reject) => {
             const wallTimer = setTimeout(() => {
-                this.resolveActive(slot, {
-                    result: undefined,
-                    error: `QuickJS child exceeded the ${this.runtimeOptions.timeoutMs}ms wall budget and was terminated.`,
-                });
+                this.rejectActive(slot, new Error(`QuickJS child exceeded the ${this.runtimeOptions.timeoutMs}ms wall budget and was terminated.`));
                 this.recycle(slot);
             }, this.runtimeOptions.timeoutMs + CHILD_EXIT_GRACE_MS);
             const active = {
                 id,
+                logs: [],
+                logChars: 0,
                 providers: providerMap,
                 resolve,
                 reject,
@@ -328,7 +333,7 @@ class QuickJsChildPool {
                 return;
             this.recordCrash(slot);
             const error = childExitError(`QuickJS child exited unexpectedly (${exitDescription}).`, stderrTail);
-            this.resolveActive(slot, { result: undefined, error: error.message });
+            this.rejectActive(slot, error);
         });
         child.unref();
         child.channel?.unref();
@@ -350,19 +355,39 @@ class QuickJsChildPool {
             return;
         if (typeof message.payloadJson !== "string")
             return;
+        if (message.type === "log") {
+            if (message.jobId !== active.id)
+                return;
+            // Keep one extra character so the presentation layer can signal loss.
+            // The final reply owns complete successful logs; this prefix survives
+            // only when that reply cannot arrive. Bound even a compromised child.
+            if (active.logChars >= MAX_EXECUTE_LOG_CHARS + 1)
+                return;
+            if (serializedBytes(message.payloadJson) > MAX_QUICKJS_IPC_BYTES)
+                return;
+            try {
+                stringifyBounded(message, "QuickJS log IPC envelope");
+                const entry = JSON.parse(message.payloadJson);
+                if (typeof entry !== "string")
+                    return;
+                const separator = active.logs.length > 0 ? 1 : 0;
+                const retained = entry.slice(0, MAX_EXECUTE_LOG_CHARS + 1 - active.logChars - separator);
+                active.logs.push(retained);
+                active.logChars += separator + retained.length;
+            }
+            catch { /* Malformed log messages carry no output. */ }
+            return;
+        }
         if (message.type === "host-call") {
             if (message.jobId !== active.id)
                 return;
-            await this.handleHostCall(child, active, message);
+            await this.handleHostCall(slot, child, active, message);
             return;
         }
         if (message.type !== "result" || message.jobId !== active.id)
             return;
         if (serializedBytes(message.payloadJson) > MAX_QUICKJS_IPC_BYTES) {
-            this.resolveActive(slot, {
-                result: undefined,
-                error: "QuickJS execution result exceeded the IPC limit.",
-            });
+            this.rejectActive(slot, new Error("QuickJS execution result exceeded the IPC limit."));
             this.recycle(slot);
             return;
         }
@@ -380,14 +405,11 @@ class QuickJsChildPool {
             }
         }
         catch (err) {
-            this.resolveActive(slot, {
-                result: undefined,
-                error: `QuickJS child returned an invalid result: ${msg(err)}`,
-            });
+            this.rejectActive(slot, new Error(`QuickJS child returned an invalid result: ${msg(err)}`));
             this.recycle(slot);
         }
     }
-    async handleHostCall(child, active, message) {
+    async handleHostCall(slot, child, active, message) {
         let payloadJson;
         try {
             if (serializedBytes(message.payloadJson) >
@@ -422,35 +444,54 @@ class QuickJsChildPool {
         catch (err) {
             payloadJson = errorPayload(msg(err));
         }
-        if (!child.connected)
+        if (!child.connected || slot.active !== active)
             return;
+        const response = {
+            type: "host-result",
+            jobId: message.jobId,
+            callId: message.callId,
+            payloadJson,
+        };
         try {
-            const response = {
-                type: "host-result",
-                jobId: message.jobId,
-                callId: message.callId,
-                payloadJson,
-            };
             stringifyBounded(response, "QuickJS host-result IPC envelope");
-            child.send(response);
         }
         catch {
-            // The execution has already ended or the child is exiting. Its exit
-            // handler owns the structured failure for any still-active job.
+            // L6/X10: settle the rejected call even if the outer encoding overflows.
+            response.payloadJson = errorPayload(`QuickJS host-result IPC envelope could not be serialized within the ${MAX_QUICKJS_IPC_BYTES}-byte IPC limit.`);
+        }
+        const failedSend = (error) => {
+            if (!error || slot.active !== active)
+                return;
+            this.rejectActive(slot, error);
+            this.recycle(slot);
+        };
+        try {
+            stringifyBounded(response, "QuickJS host-result IPC envelope");
+            child.send(response, failedSend);
+        }
+        catch (err) {
+            failedSend(err instanceof Error ? err : new Error(msg(err)));
         }
     }
     resolveActive(slot, outcome) {
         const active = slot.active;
         if (!active)
             return;
+        // Never concatenate the stream with the final reply: those entries are
+        // the same logs. A normal reply retains its existing full log contract.
+        const resolved = outcome.logs === undefined && active.logs.length > 0
+            ? { ...outcome, logs: active.logs }
+            : outcome;
         this.clearActive(slot, active);
-        active.resolve(outcome);
+        active.resolve(resolved);
     }
     rejectActive(slot, error) {
         const active = slot.active;
         if (!active)
             return;
         this.clearActive(slot, active);
+        if (active.logs.length > 0)
+            Object.assign(error, { logs: active.logs });
         active.reject(error);
     }
     clearActive(slot, active) {

package/dist/index.d.ts

@@ -51,6 +51,13 @@ export interface ConnectaCallsConfig {
      */
     maxResultBytes?: number;
 }
+/** Runtime-wide bounds for transient direct-call result paging. */
+export interface ConnectaResultsConfig {
+    /** Stored bytes, including the paging envelope. Default 8 MiB. Zero disables stashing. */
+    maxStashBytes?: number;
+    /** Stored or in-flight entries. Default 64. Zero disables stashing. */
+    maxStashEntries?: number;
+}
 /** Budgets for execute_code programs: host calls and rich output (`connecta.emit`). */
 export interface ConnectaExecuteConfig {
     /**
@@ -149,6 +156,11 @@ export interface ConnectaConfig {
      * HTTPS URL also redirects matching inbound HTTP requests to HTTPS.
      */
     publicUrl?: string;
+    /**
+     * Exact browser MCP origins, or "*". Defaults to publicUrl's origin and
+     * HTTP(S) loopback origins at any port. Originless clients are admitted.
+     */
+    allowedOrigins?: readonly string[] | "*";
     /** Optional recorder and reader, created by activityHistory() from /activity. */
     activity?: ActivityModule;
     /** Replaceable owner-partitioned credential storage. Omit for config-owned secrets. */
@@ -159,6 +171,8 @@ export interface ConnectaConfig {
     discovery?: ConnectaDiscoveryConfig;
     /** Deployment-wide call deadlines and result paging threshold. */
     calls?: ConnectaCallsConfig;
+    /** Runtime-wide transient result stash limits, shared across subjects. */
+    results?: ConnectaResultsConfig;
     /** Budgets for the `connecta.emit` rich-output channel in execute_code. */
     execute?: ConnectaExecuteConfig;
     /** Bounded MCP and fallback code-mode admission. */
@@ -208,5 +222,5 @@ export { CONNECTA_VERSION } from "./version.js";
 export type { Registry } from "./registry.js";
 export type { RemoteMcpOptions, RemoteMcpAuth, RemoteMcpRedirectPolicy, } from "./connectors/remote-mcp.js";
 export type { ApiOptions, ApiTool } from "./connectors/api.js";
-export type { CatalogDriftCounts, CatalogDriftReport, ConnectaBranding, Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCredentialValues, ConnectorContext, ConnectorUsageGuide, ConnectorStatus, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, InboundAuthRuntimeContext, UiAuthConfig, AuthResult, AuthenticatedIdentity, IdentityReference, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
+export type { CatalogDriftCounts, CatalogDriftReport, ConnectaBranding, ConnectaTheme, Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCredentialValues, ConnectorContext, ConnectorUsageGuide, ConnectorStatus, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, InboundAuthRuntimeContext, UiAuthConfig, AuthResult, AuthenticatedIdentity, IdentityReference, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
 export type { ActivityActor, ActivityCallSource, ActivityOutcome, ActivityPage, ActivityReadActor, ActivityReadEvent, ActivityReader, ActivityReadGate, ActivityReadPage, ActivitySink, ActivityStore, AgentFriction, CatalogDriftActivityEvent, ToolCallActivityEvent, } from "./activity.js";