@zackbart/connecta 0.24.4 → 0.25.0

package/dist/execute.js

@@ -1,14 +1,25 @@
+import { Cause, Duration, Effect, Exit } from "effect";
 import { z } from "zod";
+import { advertisedSchema } from "./advertised-schema.js";
 import { boundedDiscoveryText, CatalogService, DiscoveryPolicyError, flatSearchResult, } from "./catalog-service.js";
 import { errorResult, jsonResult } from "./meta-tools.js";
 import { guardExecuteResultValue, MAX_EXECUTE_LOG_CHARS, truncateExecuteText, } from "./executor-result.js";
 import { ExecutorAdmissionError, ExecutorExecutionError, isAdmittingExecutor, } from "./executor-admission.js";
 import { boundedEchoText, msg } from "./errors.js";
-import { InvocationFailure, InvocationService, } from "./invocation.js";
+import { InvocationFailure, InvocationService, timed, } from "./invocation.js";
+import { withoutProgramTerminator } from "./program-source.js";
+import { fromSignal, runEdge } from "./runtime/run.js";
 import { connectorGuide, connectorGuideRequired, connectorSkillName, hasConnectorGuides, } from "./skills.js";
 /** Keep one model-written program from amplifying into an unbounded fan-out. */
 const EXECUTE_MAX_HOST_CALLS = 20;
 const EXECUTE_HOST_CALL_TIMEOUT_MS = 15_000;
+/**
+ * The outer ceiling on one execution. It sits above both executors' own
+ * deadlines (QuickJS 30s, the Dynamic Worker 60s), so a healthy executor
+ * always reports its own timeout first and this fires only for one that
+ * never settles at all.
+ */
+const EXECUTE_WATCHDOG_MS = 120_000;
 /** Complete entries plus an exact omission count, all inside this byte cap. */
 export const CONNECTOR_INVENTORY_MAX_BYTES = 256;
 /**
@@ -266,6 +277,19 @@ function guestErrorPrelude(failureSecret) {
  * the program calls a tool or asks search/describe.
  */
 export async function buildSandboxProviders(registry, baseUrl, _logger, activity, limits = {}) {
+    return [sandboxProvider(registry, baseUrl, activity, limits)];
+}
+/**
+ * The `connecta` provider for one execution.
+ *
+ * Building it is synchronous and loads nothing. Each function is a Promise
+ * edge the executor awaits, and behind it one host call is one fiber: spend
+ * the budget, do the operation, and turn a typed failure into the frame the
+ * prelude rebuilds inside the guest. Nothing is shared between those fibers
+ * but the budget counter and this request's catalog, so a call the program
+ * never awaits cannot disturb the others.
+ */
+function sandboxProvider(registry, baseUrl, activity, limits) {
     // All host calls made by one execute_code invocation share a downstream
     // connection, while a later invocation receives a fresh request scope.
     const requestScope = {};
@@ -281,71 +305,67 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
     const maxHostCalls = Math.max(1, Math.trunc(limits.maxHostCalls ?? EXECUTE_MAX_HOST_CALLS));
     const hostCallTimeoutMs = Math.max(1, Math.trunc(limits.hostCallTimeoutMs ?? EXECUTE_HOST_CALL_TIMEOUT_MS));
     const failureSecret = guestFailureSecret();
+    const { signal, diagnostics } = limits;
     let hostCalls = 0;
-    // L4/M7: discovery and invocation spend the same budget; emit does not.
-    const spendHostCall = () => {
-        hostCalls++;
-        if (hostCalls > maxHostCalls) {
-            throw guestFailure("budget_exceeded", `execute_code host-call budget exceeded (${maxHostCalls} calls maximum)`);
-        }
-    };
+    // L4/M7: discovery and invocation spend the same budget, on entry; emit
+    // does not.
+    const spendHostCall = Effect.suspend(() => ++hostCalls > maxHostCalls
+        ? Effect.fail(guestFailure("budget_exceeded", `execute_code host-call budget exceeded (${maxHostCalls} calls maximum)`))
+        : Effect.void);
     const invocationContext = () => ({
         source: "execute_code",
         timeoutMs: hostCallTimeoutMs,
-        ...(limits.signal !== undefined ? { requestSignal: limits.signal } : {}),
+        ...(signal !== undefined ? { requestSignal: signal } : {}),
         unwrapResult: true,
     });
-    /**
-     * Discovery policy failures use the same thrown vocabulary as calls and
-     * utilities. The transport below reconstructs their code inside the guest.
-     */
-    const typedDiscovery = async (operation) => {
-        try {
-            return await operation();
-        }
-        catch (err) {
-            if (err instanceof DiscoveryPolicyError) {
-                throw guestFailure(err.code, err.message);
-            }
-            throw err;
-        }
-    };
-    const timedCatalog = async (operation, fn) => {
+    // A call brings its own cancellation: the invocation pipeline reads the
+    // run's signal, refuses a call that starts after it, and records the
+    // cancelled attempt in activity like any other outcome.
+    const call = (address, args) => spendHostCall.pipe(Effect.andThen(Effect.suspend(() => invocation.pipeline(String(address), args ?? {}, invocationContext()))), Effect.flatMap((outcome) => {
+        diagnostics?.recordCall(outcome);
+        return outcome.ok
+            ? Effect.succeed(outcome.value)
+            : Effect.fail(new InvocationFailure(outcome.error));
+    }));
+    // Discovery gets the same treatment from here (L2): once the run has
+    // ended no search or describe starts, and one still in flight fails
+    // `cancelled` instead of holding the program until its probe deadline.
+    // Policy failures use the same thrown vocabulary as calls and utilities;
+    // the transport below reconstructs their code inside the guest.
+    const discovery = (operation, read) => Effect.suspend(() => {
         const started = Date.now();
-        try {
-            spendHostCall();
-            const result = await fn();
-            limits.diagnostics?.recordCatalog(operation, Date.now() - started, true, result);
-            return result;
-        }
-        catch (err) {
-            limits.diagnostics?.recordCatalog(operation, Date.now() - started, false);
-            throw err;
-        }
-    };
-    const callAddress = async (address, args) => {
-        spendHostCall();
-        const outcome = await invocation.invoke(String(address), args ?? {}, invocationContext());
-        limits.diagnostics?.recordCall(outcome);
-        if (!outcome.ok)
-            throw new InvocationFailure(outcome.error);
-        return outcome.value;
-    };
-    const fns = {
-        call: (address, args) => callAddress(address, args),
+        const cancelled = () => guestFailure("cancelled", `connecta.${operation} was cancelled because the run ended.`);
+        const reading = Effect.tryPromise({
+            try: read,
+            catch: (err) => err instanceof DiscoveryPolicyError
+                ? guestFailure(err.code, err.message)
+                : err,
+        });
+        return spendHostCall.pipe(Effect.andThen(!signal
+            ? reading
+            : signal.aborted
+                ? Effect.fail(cancelled())
+                : Effect.raceAllFirst([
+                    reading,
+                    fromSignal(signal).pipe(Effect.mapError(cancelled)),
+                ])), Effect.onExit((exit) => Effect.sync(() => diagnostics?.recordCatalog(operation, Date.now() - started, Exit.isSuccess(exit), Exit.isSuccess(exit) ? exit.value : undefined))));
+    });
+    const operations = {
+        call,
         // Emission is a provider function, never an ExecuteResult field —
         // that is what keeps the Executor contract untouched and parity
         // structural (M8). It spends no host-call budget (M7); its own
         // budgets live in the collector.
-        emit: async (block) => {
-            if (!limits.emitCollector) {
-                throw guestFailure("unavailable", "connecta.emit is unavailable: no emission collector was configured for this execution", true);
-            }
-            limits.emitCollector.accept(block);
-        },
-        // Not `async`: a synchronous budget refusal must reject the same promise
-        // the transport wrapper awaits, or workerd reports an unhandled rejection.
-        search: (raw) => timedCatalog("search", () => typedDiscovery(async () => {
+        emit: (block) => Effect.try({
+            try: () => {
+                if (!limits.emitCollector) {
+                    throw guestFailure("unavailable", "connecta.emit is unavailable: no emission collector was configured for this execution", true);
+                }
+                limits.emitCollector.accept(block);
+            },
+            catch: (err) => err,
+        }),
+        search: (raw) => discovery("search", async () => {
             const args = (raw ?? {});
             const result = flatSearchResult(await catalog.search({
                 ...args,
@@ -353,230 +373,311 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
             }));
             boundedDiscoveryText(result, "Request a smaller limit, omit fullDescriptions, use compact schemas, or pass includeSchemaKeys: false.");
             return result;
-        })),
-        describe: (raw) => timedCatalog("describe", () => typedDiscovery(async () => {
+        }),
+        describe: (raw) => discovery("describe", async () => {
             const args = (raw ?? {});
             const result = { tools: await catalog.describe(args) };
             boundedDiscoveryText(result, 'Split the address list or use format: "compact".');
             return result;
-        })),
+        }),
     };
-    const transportedFns = Object.fromEntries(Object.entries(fns).map(([name, fn]) => [
-        name,
-        async (...args) => {
-            try {
-                return await fn(...args);
-            }
-            catch (err) {
-                if (err instanceof InvocationFailure) {
-                    const failure = boundedGuestFailure(err);
-                    const framed = framedGuestFailure(failureSecret, failure);
-                    limits.onInvocationFailure?.(failure);
-                    throw framed;
-                }
-                throw err;
-            }
-        },
-    ]));
-    return [
-        {
-            name: "connecta",
-            prelude: guestErrorPrelude(failureSecret),
-            fns: transportedFns,
-        },
+    // Every failure leaves through the same frame, so the prelude can rebuild
+    // a typed error however the host call failed — refused, over budget, or
+    // cancelled. Anything that is not an InvocationFailure crosses unchanged.
+    const framed = (err) => Effect.suspend(() => {
+        if (!(err instanceof InvocationFailure))
+            return Effect.fail(err);
+        const failure = boundedGuestFailure(err);
+        const frame = framedGuestFailure(failureSecret, failure);
+        limits.onInvocationFailure?.(failure);
+        return Effect.fail(frame);
+    });
+    return {
+        name: "connecta",
+        prelude: guestErrorPrelude(failureSecret),
+        fns: Object.fromEntries(Object.entries(operations).map(([name, operation]) => [
+            name,
+            (...args) => {
+                const settled = runEdge(Effect.suspend(() => operation(...args)).pipe(Effect.catch(framed)));
+                // The executor owns this promise, and a program may abandon a call
+                // that the run's end then cancels before anyone has awaited it.
+                // The rejection is still there for whoever does; it is just not an
+                // unhandled rejection of the host's, which workerd reports as soon
+                // as a microtask passes without a handler.
+                settled.catch(() => { });
+                return settled;
+            },
+        ])),
+    };
+}
+/**
+ * Await an executor's promise without trusting it to settle.
+ *
+ * An executor's deadline is its own business, and the Dynamic Worker's lives
+ * inside the sandbox: a wedged isolate never fires it, so the call never
+ * settles, the handler never returns, and the admission lease is held for
+ * good. Two of those fill the default code pool and every later execute_code
+ * queues behind them (executor hit this in production). An `acquire()` that
+ * ignores its signal holds a cancelled request the same way.
+ *
+ * So the host races the promise against the request's signal and, for a run,
+ * a ceiling of its own. Cancellation settles as the same `executor_cancelled`
+ * the QuickJS pool reports, unless the executor reports its own first; the
+ * ceiling as an untyped executor failure naming the key that sets it. Either
+ * way the handler returns and releases the lease, and the abandoned call
+ * keeps whatever it was doing: the QuickJS lease release recycles its child,
+ * a Dynamic Worker isolate runs on to its own deadline, and a lease granted
+ * after its request gave up goes to `late`. The result contract is untouched
+ * — this only decides when to stop waiting for one.
+ */
+function awaitExecutor(start, signal, options = {}) {
+    const contenders = [
+        Effect.suspend(() => {
+            let pending;
+            const settling = Effect.tryPromise({
+                try: () => (pending = Promise.resolve(start())),
+                catch: (err) => err,
+            });
+            const { late } = options;
+            return late
+                ? settling.pipe(Effect.onInterrupt(() => Effect.sync(() => {
+                    pending?.then(late, () => { });
+                })))
+                : settling;
+        }),
+        // An executor that honors the signal rejects in the abort event itself,
+        // with the logs it captured attached, and that report beats ours by one
+        // timer turn. (A 1ms sleep, not 0: Effect.sleep(0) waits a microtask,
+        // which the executor's promise chain can still lose to.)
+        fromSignal(signal).pipe(Effect.catch(() => Effect.sleep(Duration.millis(1))), Effect.andThen(Effect.fail(new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled.")))),
     ];
+    const { watchdog } = options;
+    if (watchdog) {
+        contenders.push(Effect.sleep(Duration.millis(watchdog.ms)).pipe(Effect.andThen(Effect.suspend(() => {
+            watchdog.logger.warn("[connecta] execute_code executor did not settle; run abandoned", { watchdogMs: watchdog.ms });
+            return Effect.fail(new Error(`sandbox unresponsive: no outcome within the ${watchdog.ms}ms ` +
+                "execute.watchdogMs ceiling, so the run was abandoned"));
+        }))));
+    }
+    return Effect.raceAllFirst(contenders);
+}
+/**
+ * The run's own signal, aborted however the run ends. It follows the
+ * caller's, and aborting it on the way out is what releases outstanding host
+ * waits and tells cooperative connectors to stop.
+ */
+function runSignal(caller) {
+    return Effect.acquireRelease(Effect.sync(() => {
+        const controller = new AbortController();
+        const forward = () => controller.abort(caller?.reason);
+        if (caller?.aborted)
+            forward();
+        else
+            caller?.addEventListener("abort", forward, { once: true });
+        return { controller, forward };
+    }), ({ controller, forward }) => Effect.sync(() => {
+        controller.abort();
+        caller?.removeEventListener("abort", forward);
+    })).pipe(Effect.map(({ controller }) => controller.signal));
+}
+/**
+ * An admitting executor's lease, released when the run's scope closes.
+ *
+ * `acquire()` is the executor's Promise, awaited as one on purpose. A queued
+ * request is handed its lease from inside whichever request released one, so
+ * a fiber resumed straight from the executor's admission queue would build
+ * this request's providers and run its program in the releasing request —
+ * which workerd refuses for any I/O. Awaiting the promise resumes it here.
+ */
+function leased(executor, signal) {
+    return Effect.acquireRelease(awaitExecutor(() => executor.acquire({ signal }), signal, {
+        late: (lease) => lease.release(),
+    }), (lease) => Effect.sync(() => lease.release()));
 }
 /** The execute_code handler. Exported for direct testing. */
 export function createExecuteTool(registry, baseUrl, executor, logger, activity, config = {}) {
-    return async ({ code, diagnostics: diagnosticsRequested }, options = {}) => {
-        const controller = new AbortController();
-        const forwardAbort = () => controller.abort(options.signal?.reason);
-        if (options.signal?.aborted)
-            forwardAbort();
-        else {
-            options.signal?.addEventListener("abort", forwardAbort, { once: true });
-        }
-        let lease;
-        let outcome;
-        const diagnostics = diagnosticsRequested ? new ExecuteDiagnostics() : undefined;
+    const watchdog = {
+        ms: resolveBudget(config.watchdogMs, EXECUTE_WATCHDOG_MS),
+        logger,
+    };
+    return ({ code, diagnostics: diagnosticsRequested }, options = {}) => runEdge(Effect.suspend(() => {
+        const diagnostics = diagnosticsRequested
+            ? new ExecuteDiagnostics()
+            : undefined;
         const emitted = new EmitCollector(resolveBudget(config.maxEmittedBytes, EXECUTE_MAX_EMITTED_BYTES), resolveBudget(config.maxEmittedBlocks, EXECUTE_MAX_EMITTED_BLOCKS), diagnostics);
         const invocationFailures = [];
-        try {
-            // Admission comes before provider construction: queued calls retain no
-            // catalogs, request scopes, or one-closure-per-tool provider arrays.
+        // The run's scope holds its signal and its lease. However the run
+        // ends — a result, a thrown executor, the watchdog, cancellation —
+        // closing it releases the lease and then aborts the signal, so
+        // nothing the run started outlives the request.
+        const run = Effect.gen(function* () {
+            const signal = yield* runSignal(options.signal);
+            // Admission comes before provider construction: queued calls retain
+            // no catalogs, request scopes, or provider closures.
+            let lease;
             if (isAdmittingExecutor(executor)) {
-                const admissionStarted = Date.now();
-                try {
-                    lease = await executor.acquire({ signal: controller.signal });
-                }
-                finally {
-                    if (diagnostics) {
-                        diagnostics.admissionMs = Date.now() - admissionStarted;
-                    }
-                }
+                lease = yield* timed((elapsed) => {
+                    if (diagnostics)
+                        diagnostics.admissionMs = elapsed;
+                }, leased(executor, signal));
                 if ((lease.waitMs ?? 0) > 0) {
                     logger.debug("[connecta] execute_code admitted after queue wait", {
                         waitMs: lease.waitMs,
                     });
                 }
             }
-            const setupStarted = Date.now();
-            let providers;
-            try {
-                providers = await buildSandboxProviders(registry, baseUrl, logger, activity, {
-                    signal: controller.signal,
-                    onInvocationFailure: (failure) => {
-                        invocationFailures.push(failure);
-                        if (invocationFailures.length > 64)
-                            invocationFailures.shift();
-                    },
-                    emitCollector: emitted,
-                    ...(diagnostics ? { diagnostics } : {}),
-                    discoveryConcurrency: config.discoveryConcurrency,
-                    probeTimeoutMs: config.probeTimeoutMs,
-                    maxHostCalls: config.maxHostCalls,
-                    hostCallTimeoutMs: config.hostCallTimeoutMs,
-                    defer: config.defer,
-                });
-            }
-            finally {
+            const provider = yield* timed((elapsed) => {
                 if (diagnostics)
-                    diagnostics.setupMs = Date.now() - setupStarted;
-            }
-            if (controller.signal.aborted) {
-                throw new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled during sandbox setup.");
+                    diagnostics.setupMs = elapsed;
+            }, Effect.sync(() => sandboxProvider(registry, baseUrl, activity, {
+                signal,
+                onInvocationFailure: (failure) => {
+                    invocationFailures.push(failure);
+                    if (invocationFailures.length > 64)
+                        invocationFailures.shift();
+                },
+                emitCollector: emitted,
+                ...(diagnostics ? { diagnostics } : {}),
+                discoveryConcurrency: config.discoveryConcurrency,
+                probeTimeoutMs: config.probeTimeoutMs,
+                maxHostCalls: config.maxHostCalls,
+                hostCallTimeoutMs: config.hostCallTimeoutMs,
+                defer: config.defer,
+            })));
+            if (signal.aborted) {
+                return yield* Effect.fail(new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled during sandbox setup."));
             }
-            const executorStarted = Date.now();
-            try {
-                outcome = lease
-                    ? await lease.execute(code, providers)
-                    : await executor.execute(code, providers);
-            }
-            finally {
-                if (diagnostics) {
-                    diagnostics.executorWallMs = Date.now() - executorStarted;
-                }
-            }
-        }
-        catch (err) {
-            const logs = err !== null && typeof err === "object" && "logs" in err
-                ? executeLogs(err.logs)
-                : undefined;
-            if (err instanceof ExecutorAdmissionError) {
-                if (err.code === "executor_overloaded") {
-                    logger.warn("[connecta] execute_code admission rejected", {
-                        code: err.code,
-                        retryAfterMs: err.retryAfterMs,
-                    });
-                }
-                return failureResponse(err.message, {
-                    logs,
-                    emitted: err instanceof ExecutorExecutionError ? emitted : undefined,
-                    diagnostics,
-                    code: {
-                        code: err.code,
-                        message: err.message,
-                        retryable: err.retryable,
-                        ...(err.retryAfterMs !== undefined
-                            ? { retryAfterMs: err.retryAfterMs }
-                            : {}),
-                    },
-                });
-            }
-            return failureResponse(`Executor failed: ${msg(err)}`, {
-                logs,
-                emitted,
-                diagnostics,
-                code: "executor_failed",
+            const admitted = lease;
+            // P1: a trailing `;` after the arrow expression breaks both
+            // executors' parenthesized evaluation. Strip it here, above them.
+            const program = withoutProgramTerminator(code);
+            return yield* timed((elapsed) => {
+                if (diagnostics)
+                    diagnostics.executorWallMs = elapsed;
+            }, awaitExecutor(() => admitted
+                ? admitted.execute(program, [provider])
+                : executor.execute(program, [provider]), signal, { watchdog }));
+        });
+        const reported = { emitted, diagnostics, invocationFailures };
+        return Effect.map(Effect.exit(Effect.scoped(run)), (exit) => Exit.isSuccess(exit)
+            ? finishedRun(exit.value, reported)
+            : failedRun(Cause.squash(exit.cause), logger, reported));
+    }));
+}
+/** An execution that never produced an ExecuteResult, as the model sees it. */
+function failedRun(err, logger, { emitted, diagnostics }) {
+    const logs = err !== null && typeof err === "object" && "logs" in err
+        ? executeLogs(err.logs)
+        : undefined;
+    if (err instanceof ExecutorAdmissionError) {
+        if (err.code === "executor_overloaded") {
+            logger.warn("[connecta] execute_code admission rejected", {
+                code: err.code,
+                retryAfterMs: err.retryAfterMs,
             });
         }
-        finally {
-            // A sandbox timeout or early return must also release any outstanding
-            // host waits and signal cooperative connectors to stop their work.
-            controller.abort();
-            lease?.release();
-            options.signal?.removeEventListener("abort", forwardAbort);
-        }
-        const logs = executeLogs(outcome.logs);
-        if (outcome.error !== undefined) {
-            // Executor bridges necessarily reduce thrown host errors to strings.
-            // Match that terminal string back to the request-local typed failure so
-            // an unhandled tool failure keeps the same structured contract as
-            // call_tool. Failures caught by model code never reach
-            // outcome.error and therefore remain under that code's control.
-            //
-            // An error the program let through unchanged matches exactly, and an
-            // exact match always wins: a program that wrapped one failure's message
-            // around another's must not have the wrong type attached. Containment is
-            // the fallback, so a wrapped message still reports its underlying type
-            // rather than losing it to prose.
-            let invocationFailure;
-            for (const match of [
-                (candidate) => outcome.error !== "" &&
-                    [candidate.message, guestFailureFrames.get(candidate)].includes(outcome.error),
-                (candidate) => [candidate.message, guestFailureFrames.get(candidate)].some((message) => 
-                // E6: empty or tiny prose cannot identify a wrapped failure.
-                message !== undefined &&
-                    message.length >= 8 &&
-                    outcome.error?.includes(message) === true),
-            ]) {
-                for (let i = invocationFailures.length - 1; i >= 0; i--) {
-                    const candidate = invocationFailures[i];
-                    if (candidate && match(candidate)) {
-                        invocationFailure = candidate;
-                        break;
-                    }
-                }
-                if (invocationFailure)
+        return failureResponse(err.message, {
+            logs,
+            emitted: err instanceof ExecutorExecutionError ? emitted : undefined,
+            diagnostics,
+            code: {
+                code: err.code,
+                message: err.message,
+                retryable: err.retryable,
+                ...(err.retryAfterMs !== undefined
+                    ? { retryAfterMs: err.retryAfterMs }
+                    : {}),
+            },
+        });
+    }
+    return failureResponse(`Executor failed: ${msg(err)}`, {
+        logs,
+        emitted,
+        diagnostics,
+        code: "executor_failed",
+    });
+}
+/** The response for an ExecuteResult: the program's error or its value. */
+function finishedRun(outcome, { emitted, diagnostics, invocationFailures }) {
+    const logs = executeLogs(outcome.logs);
+    if (outcome.error !== undefined) {
+        // Executor bridges necessarily reduce thrown host errors to strings.
+        // Match that terminal string back to the request-local typed failure so
+        // an unhandled tool failure keeps the same structured contract as
+        // call_tool. Failures caught by model code never reach
+        // outcome.error and therefore remain under that code's control.
+        //
+        // An error the program let through unchanged matches exactly, and an
+        // exact match always wins: a program that wrapped one failure's message
+        // around another's must not have the wrong type attached. Containment is
+        // the fallback, so a wrapped message still reports its underlying type
+        // rather than losing it to prose.
+        let invocationFailure;
+        for (const match of [
+            (candidate) => outcome.error !== "" &&
+                [candidate.message, guestFailureFrames.get(candidate)].includes(outcome.error),
+            (candidate) => [candidate.message, guestFailureFrames.get(candidate)].some((message) => 
+            // E6: empty or tiny prose cannot identify a wrapped failure.
+            message !== undefined &&
+                message.length >= 8 &&
+                outcome.error?.includes(message) === true),
+        ]) {
+            for (let i = invocationFailures.length - 1; i >= 0; i--) {
+                const candidate = invocationFailures[i];
+                if (candidate && match(candidate)) {
+                    invocationFailure = candidate;
                     break;
+                }
             }
-            if (invocationFailure) {
-                // E1/X11: return the same bounded details the guest received.
-                return failureResponse(invocationFailure.details.message, {
-                    logs,
-                    emitted,
-                    diagnostics,
-                    code: invocationFailure.details,
-                });
-            }
-            const message = `Error: ${outcome.error || "Execution failed without an error message."}`;
-            return failureResponse(message, {
-                logs,
-                emitted,
-                diagnostics,
-                code: "executor_failed",
-            });
-        }
-        // A result crossing back as a host BigInt (or otherwise unserializable
-        // value) makes JSON.stringify throw — keep that inside the structured
-        // error path so captured logs survive instead of a raw SDK 500.
-        let result;
-        try {
-            result = guardExecuteResultValue(outcome.result);
+            if (invocationFailure)
+                break;
         }
-        catch (err) {
-            const message = `Error: result is not JSON-serializable: ${msg(err)}`;
-            return failureResponse(message, {
+        if (invocationFailure) {
+            // E1/X11: return the same bounded details the guest received.
+            return failureResponse(invocationFailure.details.message, {
                 logs,
                 emitted,
                 diagnostics,
-                code: "executor_failed",
+                code: invocationFailure.details,
             });
         }
-        const response = jsonResult({
-            result,
-            ...(emitted.blocks.length > 0 ? { emitted: emitted.blocks.length } : {}),
-            ...(logs ? { logs } : {}),
-            ...(diagnostics ? { diagnostics: diagnostics.finish() } : {}),
+        const message = `Error: ${outcome.error || "Execution failed without an error message."}`;
+        return failureResponse(message, {
+            logs,
+            emitted,
+            diagnostics,
+            code: "executor_failed",
         });
-        if (emitted.blocks.length > 0) {
-            // Emitted image/audio blocks are valid MCP content that ToolResult's
-            // text-only typing does not model — the same acknowledged gap
-            // guardContent lives with for downstream block passthrough.
-            response.content.push(...emitted.blocks);
-        }
-        return response;
-    };
+    }
+    // A result crossing back as a host BigInt (or otherwise unserializable
+    // value) makes JSON.stringify throw — keep that inside the structured
+    // error path so captured logs survive instead of a raw SDK 500.
+    let result;
+    try {
+        result = guardExecuteResultValue(outcome.result);
+    }
+    catch (err) {
+        const message = `Error: result is not JSON-serializable: ${msg(err)}`;
+        return failureResponse(message, {
+            logs,
+            emitted,
+            diagnostics,
+            code: "executor_failed",
+        });
+    }
+    const response = jsonResult({
+        result,
+        ...(emitted.blocks.length > 0 ? { emitted: emitted.blocks.length } : {}),
+        ...(logs ? { logs } : {}),
+        ...(diagnostics ? { diagnostics: diagnostics.finish() } : {}),
+    });
+    if (emitted.blocks.length > 0) {
+        // Emitted image/audio blocks are valid MCP content that ToolResult's
+        // text-only typing does not model — the same acknowledged gap
+        // guardContent lives with for downstream block passthrough.
+        response.content.push(...emitted.blocks);
+    }
+    return response;
 }
 function executeLogs(value) {
     return Array.isArray(value) && value.length > 0 && value.every((entry) => typeof entry === "string")
@@ -662,6 +763,18 @@ Read relevant guides using top-level skills, not sandbox code. Write a plain-Jav
 - console.log(...) is captured. Return data for the client to render.
 
 No portable ambient capabilities. Return reduced JSON. If a provider result has an unfamiliar shape, return a small sample and continue in another call; never guess fields or use the whole text as an id. Top-level skills({ name: "usage" }): repair${connectorGuides ? ", guide handling" : ""}; skills({ name: "investigate" }): task planning.`;
+// Module scope, like the other six meta-tool inputs: its JSON Schema is
+// derived once per process. Budgets and connectors vary by deployment and
+// view, so they live in the description, never here.
+const EXECUTE_INPUT = advertisedSchema(z.object({
+    code: z
+        .string()
+        .describe("One complete JavaScript async arrow function that discovers, calls, and returns the reduced answer."),
+    diagnostics: z
+        .boolean()
+        .optional()
+        .describe("Add request-local, payload-free timing and result-size summaries."),
+}));
 /** Register the execute_code meta-tool. Only called when an executor is configured. */
 export function registerExecuteTool(server, registry, ctx) {
     // Resolved once so the description and the collector cannot disagree about
@@ -684,19 +797,12 @@ export function registerExecuteTool(server, registry, ctx) {
         maxEmittedBlocks: emitBudgets.maxBlocks,
         maxHostCalls: hostLimits.maxHostCalls,
         hostCallTimeoutMs: hostLimits.hostCallTimeoutMs,
+        watchdogMs: ctx.watchdogMs,
         defer: ctx.defer,
     });
     server.registerTool("execute_code", {
         description: executeDescription(emitBudgets, hostLimits, hasConnectorGuides(connectors), connectors),
-        inputSchema: z.object({
-            code: z
-                .string()
-                .describe("One complete JavaScript async arrow function that discovers, calls, and returns the reduced answer."),
-            diagnostics: z
-                .boolean()
-                .optional()
-                .describe("Add request-local, payload-free timing and result-size summaries."),
-        }),
+        inputSchema: EXECUTE_INPUT,
         // This hint describes connector calls, all explicitly read-only. The
         // supported executor constructions deny outbound access, filesystem,
         // and deployment config; X5 documents Dynamic runtime modules separately.