@zackbart/connecta 0.24.4 → 0.26.0

package/dist/execute.js

@@ -1,14 +1,31 @@
+import { Cause, Deferred, Duration, Effect, Exit } from "effect";
 import { z } from "zod";
+import { advertisedSchema } from "./advertised-schema.js";
 import { boundedDiscoveryText, CatalogService, DiscoveryPolicyError, flatSearchResult, } from "./catalog-service.js";
 import { errorResult, jsonResult } from "./meta-tools.js";
 import { guardExecuteResultValue, MAX_EXECUTE_LOG_CHARS, truncateExecuteText, } from "./executor-result.js";
 import { ExecutorAdmissionError, ExecutorExecutionError, isAdmittingExecutor, } from "./executor-admission.js";
 import { boundedEchoText, msg } from "./errors.js";
-import { InvocationFailure, InvocationService, } from "./invocation.js";
+import { InvocationFailure, InvocationService, timed, } from "./invocation.js";
+import { normalizeProgramSource } from "./program-source.js";
+import { DEFAULT_MAX_WRITES, ExemptWrites, MIN_STORAGE_TIMEOUT_MS, RunState, writeStateOf, } from "./resumable.js";
+import { journalKey } from "./run-journal.js";
+import { underAnySignal } from "./timeout.js";
+import { isApprovalExempt, NO_EXEMPTIONS, } from "./tool-safety.js";
+import { fromSignal, runEdge } from "./runtime/run.js";
 import { connectorGuide, connectorGuideRequired, connectorSkillName, hasConnectorGuides, } from "./skills.js";
 /** Keep one model-written program from amplifying into an unbounded fan-out. */
 const EXECUTE_MAX_HOST_CALLS = 20;
 const EXECUTE_HOST_CALL_TIMEOUT_MS = 15_000;
+/** Above every program in the recorded evals, below the QuickJS IPC ceiling. */
+const EXECUTE_MAX_CODE_BYTES = 64 * 1024;
+/**
+ * The outer ceiling on one execution. It sits above both executors' own
+ * deadlines (QuickJS 30s, the Dynamic Worker 60s), so a healthy executor
+ * always reports its own timeout first and this fires only for one that
+ * never settles at all.
+ */
+const EXECUTE_WATCHDOG_MS = 120_000;
 /** Complete entries plus an exact omission count, all inside this byte cap. */
 export const CONNECTOR_INVENTORY_MAX_BYTES = 256;
 /**
@@ -261,11 +278,147 @@ function guestErrorPrelude(failureSecret) {
   });
 })(${JSON.stringify(`${GUEST_FAILURE_FRAME}${failureSecret}:`)});`;
 }
+/** A clock read now and a seed drawn from the host's CSPRNG. */
+function freshEnvironment() {
+    const words = new Uint32Array(4);
+    crypto.getRandomValues(words);
+    return {
+        clockMs: Date.now(),
+        seed: [words[0] ?? 0, words[1] ?? 0, words[2] ?? 0, words[3] ?? 0],
+    };
+}
+/**
+ * Trusted guest code installing the pinned clock and stream, evaluated after
+ * the error prelude and before the program. Every replacement is locked the
+ * way `Error` is — non-writable and non-configurable — so a program can read
+ * the pinned values and nothing else.
+ *
+ * `Date` becomes a wrapper whose argument-free forms (`new Date()`, `Date()`,
+ * `Date.now()`) read the pinned instant; with arguments it is the native
+ * constructor, and instances are ordinary dates. The native constructor's own
+ * `now` and the prototype's `constructor` are pinned too, so the usual ways
+ * back to it read the same instant. `Math.random` is sfc32 over the seed:
+ * small, fast, and specified in a few lines anyone can check. Where the
+ * runtime has them (a Dynamic Worker; QuickJS has neither), `crypto`'s
+ * `getRandomValues` and `randomUUID` draw from the same stream and
+ * `performance.now()` stays at 0, the run's start. None of that makes
+ * `crypto` contract (`P2`): it only keeps a Workers-only program from being
+ * the one that cannot replay.
+ */
+function pinnedEnvironmentPrelude(environment) {
+    return `((clock, seed) => {
+  const NativeDate = globalThis.Date;
+  const construct = Reflect.construct;
+  const defineProperty = Object.defineProperty;
+  const lock = (target, key, value) => defineProperty(target, key, {
+    value, writable: false, enumerable: false, configurable: false
+  });
+  let a = seed[0] | 0, b = seed[1] | 0, c = seed[2] | 0, d = seed[3] | 0;
+  const next = () => {
+    const t = (((a + b) | 0) + d) | 0;
+    d = (d + 1) | 0;
+    a = b ^ (b >>> 9);
+    b = (c + (c << 3)) | 0;
+    c = (c << 21) | (c >>> 11);
+    c = (c + t) | 0;
+    return t >>> 0;
+  };
+  const now = function now() { return clock; };
+  function Date(...args) {
+    if (new.target === undefined) return new NativeDate(clock).toString();
+    return construct(NativeDate, args.length === 0 ? [clock] : args, new.target);
+  }
+  Date.prototype = NativeDate.prototype;
+  lock(Date, "now", now);
+  lock(Date, "parse", NativeDate.parse);
+  lock(Date, "UTC", NativeDate.UTC);
+  lock(NativeDate, "now", now);
+  lock(NativeDate.prototype, "constructor", Date);
+  lock(globalThis, "Date", Date);
+  lock(Math, "random", function random() { return next() / 4294967296; });
+  // Lock the replacement on the object and on its prototype, where the
+  // native method lives: \`Object.getPrototypeOf(crypto).getRandomValues\`
+  // would otherwise still reach the real stream. A prototype the runtime
+  // will not let us redefine keeps its native method (\`tryLock\`), and a
+  // program that uses it diverges on replay rather than sending anything.
+  const tryLock = (target, key, value) => {
+    try { lock(target, key, value); } catch {}
+  };
+  if (typeof crypto === "object" && crypto !== null) {
+    const getRandomValues = function getRandomValues(array) {
+      const bytes = new Uint8Array(array.buffer, array.byteOffset, array.byteLength);
+      for (let i = 0; i < bytes.length; i++) bytes[i] = next() >>> 24;
+      return array;
+    };
+    const randomUUID = function randomUUID() {
+      const bytes = getRandomValues(new Uint8Array(16));
+      bytes[6] = (bytes[6] & 0x0f) | 0x40;
+      bytes[8] = (bytes[8] & 0x3f) | 0x80;
+      let hex = "";
+      for (let i = 0; i < 16; i++) {
+        hex += (bytes[i] + 0x100).toString(16).slice(1);
+        if (i === 3 || i === 5 || i === 7 || i === 9) hex += "-";
+      }
+      return hex;
+    };
+    lock(crypto, "getRandomValues", getRandomValues);
+    lock(crypto, "randomUUID", randomUUID);
+    const cryptoProto = Object.getPrototypeOf(crypto);
+    if (cryptoProto) {
+      tryLock(cryptoProto, "getRandomValues", getRandomValues);
+      tryLock(cryptoProto, "randomUUID", randomUUID);
+    }
+  }
+  if (typeof performance === "object" && performance !== null) {
+    const perfNow = function now() { return 0; };
+    lock(performance, "now", perfNow);
+    const performanceProto = Object.getPrototypeOf(performance);
+    if (performanceProto) tryLock(performanceProto, "now", perfNow);
+  }
+  // An Intl formatter asked for "now" (no date) reads the native clock.
+  if (typeof Intl === "object" && Intl !== null && typeof Intl.DateTimeFormat === "function") {
+    const proto = Intl.DateTimeFormat.prototype;
+    const formatGetter = Object.getOwnPropertyDescriptor(proto, "format");
+    if (formatGetter && typeof formatGetter.get === "function") {
+      const nativeFormat = formatGetter.get;
+      try {
+        defineProperty(proto, "format", {
+          get() {
+            const bound = nativeFormat.call(this);
+            return function format(date) { return bound(date === undefined ? clock : date); };
+          },
+          enumerable: false,
+          configurable: false,
+        });
+      } catch {}
+    }
+    const nativeFormatToParts = proto.formatToParts;
+    if (typeof nativeFormatToParts === "function") {
+      tryLock(proto, "formatToParts", function formatToParts(date) {
+        return nativeFormatToParts.call(this, date === undefined ? clock : date);
+      });
+    }
+  }
+})(${JSON.stringify(environment.clockMs)}, ${JSON.stringify([...environment.seed])});`;
+}
 /**
  * Expose one host provider and typed guest errors. Catalogs load only when
  * the program calls a tool or asks search/describe.
  */
 export async function buildSandboxProviders(registry, baseUrl, _logger, activity, limits = {}) {
+    return [sandboxProvider(registry, baseUrl, activity, limits)];
+}
+/**
+ * The `connecta` provider for one execution.
+ *
+ * Building it is synchronous and loads nothing. Each function is a Promise
+ * edge the executor awaits, and behind it one host call is one fiber: spend
+ * the budget, do the operation, and turn a typed failure into the frame the
+ * prelude rebuilds inside the guest. Nothing is shared between those fibers
+ * but the budget counter and this request's catalog, so a call the program
+ * never awaits cannot disturb the others.
+ */
+function sandboxProvider(registry, baseUrl, activity, limits) {
     // All host calls made by one execute_code invocation share a downstream
     // connection, while a later invocation receives a fresh request scope.
     const requestScope = {};
@@ -276,76 +429,208 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
         concurrency: limits.discoveryConcurrency,
         probeTimeoutMs: limits.probeTimeoutMs,
         defer: limits.defer,
+        approval: limits.approval,
     });
     const invocation = new InvocationService(registry, catalog, activity);
     const maxHostCalls = Math.max(1, Math.trunc(limits.maxHostCalls ?? EXECUTE_MAX_HOST_CALLS));
     const hostCallTimeoutMs = Math.max(1, Math.trunc(limits.hostCallTimeoutMs ?? EXECUTE_HOST_CALL_TIMEOUT_MS));
     const failureSecret = guestFailureSecret();
+    const { signal, diagnostics } = limits;
     let hostCalls = 0;
-    // L4/M7: discovery and invocation spend the same budget; emit does not.
-    const spendHostCall = () => {
-        hostCalls++;
-        if (hostCalls > maxHostCalls) {
-            throw guestFailure("budget_exceeded", `execute_code host-call budget exceeded (${maxHostCalls} calls maximum)`);
-        }
-    };
-    const invocationContext = () => ({
-        source: "execute_code",
+    // L4/M7: discovery and invocation spend the same budget, on entry; emit
+    // does not.
+    const spendHostCall = Effect.suspend(() => ++hostCalls > maxHostCalls
+        ? Effect.fail(guestFailure("budget_exceeded", `execute_code host-call budget exceeded (${maxHostCalls} calls maximum)`))
+        : Effect.void);
+    const { runState, exemptWrites } = limits;
+    const approval = limits.approval ?? NO_EXEMPTIONS;
+    const maxWrites = resolveBudget(limits.maxWrites, DEFAULT_MAX_WRITES);
+    let exemptWriteCount = 0;
+    /**
+     * Without resumable writes nothing can pause, but a config exemption
+     * (#566) still lets its writes run: the gate covers exactly the exempt
+     * calls, spends the write budget on each, and every other write keeps
+     * E4's refusal, ahead of validation as it always was. A dispatched write
+     * is tracked until it settles (`ExemptWrites`), so the play can wait for
+     * it rather than abort it.
+     */
+    const exemptOnly = (sending) => ({
+        gates: (target) => isApprovalExempt(approval, target.connector, target.toolName, target.definition),
+        writeGate: (target) => Effect.sync(() => {
+            if (exemptWrites?.isClosed) {
+                return {
+                    kind: "refuse",
+                    error: {
+                        code: "cancelled",
+                        message: "The program had already returned, so this write was not sent.",
+                        retryable: false,
+                    },
+                    activity: "none",
+                };
+            }
+            if (exemptWriteCount >= maxWrites) {
+                return {
+                    kind: "refuse",
+                    error: {
+                        code: "budget_exceeded",
+                        message: `execute_code write budget exceeded (${maxWrites} writes maximum, execute.maxWrites); ${target.connector.id}.${target.toolName} was not sent`,
+                        retryable: false,
+                    },
+                };
+            }
+            exemptWriteCount++;
+            if (exemptWrites)
+                sending.settle = exemptWrites.begin();
+            return { kind: "dispatch" };
+        }),
+    });
+    const invocationContext = (seq, key, sending) => ({
+        source: runState?.source ?? "execute_code",
         timeoutMs: hostCallTimeoutMs,
-        ...(limits.signal !== undefined ? { requestSignal: limits.signal } : {}),
+        ...(signal !== undefined ? { requestSignal: signal } : {}),
         unwrapResult: true,
+        // With resumable writes, a consequential call reaches the run's gate
+        // instead of the flat E4 refusal, and a read's decision is marked the
+        // moment it passes the same point.
+        ...(runState && seq !== undefined && key !== undefined
+            ? {
+                beforeDispatch: () => runState.decide(seq),
+                writeGate: (target, args) => runState.gate(seq, key, target, args),
+            }
+            : runState
+                ? {}
+                : exemptOnly(sending)),
     });
     /**
-     * Discovery policy failures use the same thrown vocabulary as calls and
-     * utilities. The transport below reconstructs their code inside the guest.
+     * The front of every numbered host call once resumable writes are on: a
+     * stopped run makes no call at all (not journaled, no activity), a
+     * recorded one is answered from the journal before the budget-free part
+     * of the path, and one the journal cannot account for is divergence.
+     * Replayed calls spend the host-call budget again, so a play's total is
+     * the run's total and nothing is counted twice.
      */
-    const typedDiscovery = async (operation) => {
-        try {
-            return await operation();
+    const fromJournal = (seq, op, address, args) => Effect.gen(function* () {
+        const halted = runState?.halted();
+        if (halted)
+            return yield* Effect.fail(halted);
+        yield* spendHostCall;
+        if (!runState || seq === undefined)
+            return { kind: "live", key: undefined };
+        const key = journalKey(op, address, args);
+        const found = runState.lookup(key);
+        if (found.kind === "diverged") {
+            return yield* Effect.fail(runState.diverge(found.reason));
         }
-        catch (err) {
-            if (err instanceof DiscoveryPolicyError) {
-                throw guestFailure(err.code, err.message);
+        if (found.kind === "live")
+            return { kind: "live", key };
+        runState.decide(seq);
+        const { outcome } = found.entry;
+        return outcome.ok
+            ? { kind: "replayed", value: outcome.value }
+            : yield* Effect.fail(new InvocationFailure(outcome.error));
+    });
+    // A call brings its own cancellation: the invocation pipeline reads the
+    // run's signal, refuses a call that starts after it, and records the
+    // cancelled attempt in activity like any other outcome.
+    const call = (seq, address, args) => Effect.gen(function* () {
+        const addressText = String(address);
+        const callArgs = args ?? {};
+        const front = yield* fromJournal(seq, "call", addressText, callArgs);
+        if (front.kind === "replayed")
+            return front.value;
+        // An exempt write dispatched without a run state settles here —
+        // unknown if the call never returned an outcome.
+        const sending = {};
+        const outcome = yield* invocation.pipeline(addressText, callArgs, invocationContext(seq, front.key, sending)).pipe(Effect.onExit((exit) => Effect.sync(() => sending.settle?.(Exit.isSuccess(exit) ? writeStateOf(exit.value) : "unknown"))));
+        diagnostics?.recordCall(outcome);
+        if (runState && seq !== undefined && front.key !== undefined) {
+            if (runState.isLiveWrite(seq)) {
+                const resolved = outcome.resolved;
+                const replaced = yield* runState.settleWrite(seq, front.key, {
+                    address: resolved
+                        ? `${resolved.connector.id}.${resolved.toolName}`
+                        : addressText,
+                    args: callArgs,
+                }, outcome);
+                if (replaced)
+                    return yield* Effect.fail(replaced);
+            }
+            else {
+                runState.record(seq, "call", front.key, outcome.ok
+                    ? { ok: true, value: outcome.value }
+                    : { ok: false, error: outcome.error });
             }
-            throw err;
         }
-    };
-    const timedCatalog = async (operation, fn) => {
+        return outcome.ok
+            ? outcome.value
+            : yield* Effect.fail(new InvocationFailure(outcome.error));
+    });
+    // Discovery gets the same treatment from here (L2): once the run has
+    // ended no search or describe starts, and one still in flight fails
+    // `cancelled` instead of holding the program until its probe deadline.
+    // Policy failures use the same thrown vocabulary as calls and utilities;
+    // the transport below reconstructs their code inside the guest.
+    const discovery = (operation, seq, raw, read) => Effect.suspend(() => {
         const started = Date.now();
-        try {
-            spendHostCall();
-            const result = await fn();
-            limits.diagnostics?.recordCatalog(operation, Date.now() - started, true, result);
-            return result;
-        }
-        catch (err) {
-            limits.diagnostics?.recordCatalog(operation, Date.now() - started, false);
-            throw err;
-        }
-    };
-    const callAddress = async (address, args) => {
-        spendHostCall();
-        const outcome = await invocation.invoke(String(address), args ?? {}, invocationContext());
-        limits.diagnostics?.recordCall(outcome);
-        if (!outcome.ok)
-            throw new InvocationFailure(outcome.error);
-        return outcome.value;
-    };
-    const fns = {
-        call: (address, args) => callAddress(address, args),
+        const cancelled = () => guestFailure("cancelled", `connecta.${operation} was cancelled because the run ended.`);
+        const reading = Effect.tryPromise({
+            try: read,
+            catch: (err) => err instanceof DiscoveryPolicyError
+                ? guestFailure(err.code, err.message)
+                : err,
+        });
+        return fromJournal(seq, operation, "", raw ?? {}).pipe(Effect.flatMap((front) => {
+            if (front.kind === "replayed")
+                return Effect.succeed(front.value);
+            const live = (!signal
+                ? reading
+                : signal.aborted
+                    ? Effect.fail(cancelled())
+                    : Effect.raceAllFirst([
+                        reading,
+                        fromSignal(signal).pipe(Effect.mapError(cancelled)),
+                    ])).pipe(Effect.onExit((exit) => Effect.sync(() => {
+                if (!runState || seq === undefined || front.key === undefined)
+                    return;
+                // Typed outcomes replay; an untyped throw is a bug, not an
+                // answer, and is not journaled — so a replay that re-issues
+                // the call before repeating the approved write finds no record
+                // and fails `execution_diverged`.
+                if (Exit.isSuccess(exit)) {
+                    runState.record(seq, operation, front.key, {
+                        ok: true,
+                        value: exit.value,
+                    });
+                    return;
+                }
+                const error = Cause.squash(exit.cause);
+                if (error instanceof InvocationFailure) {
+                    runState.record(seq, operation, front.key, {
+                        ok: false,
+                        error: error.details,
+                    });
+                }
+            })));
+            return live;
+        }), Effect.onExit((exit) => Effect.sync(() => diagnostics?.recordCatalog(operation, Date.now() - started, Exit.isSuccess(exit), Exit.isSuccess(exit) ? exit.value : undefined))));
+    });
+    const operations = {
+        call,
         // Emission is a provider function, never an ExecuteResult field —
         // that is what keeps the Executor contract untouched and parity
         // structural (M8). It spends no host-call budget (M7); its own
-        // budgets live in the collector.
-        emit: async (block) => {
-            if (!limits.emitCollector) {
-                throw guestFailure("unavailable", "connecta.emit is unavailable: no emission collector was configured for this execution", true);
-            }
-            limits.emitCollector.accept(block);
-        },
-        // Not `async`: a synchronous budget refusal must reject the same promise
-        // the transport wrapper awaits, or workerd reports an unhandled rejection.
-        search: (raw) => timedCatalog("search", () => typedDiscovery(async () => {
+        // budgets live in the collector. It is never journaled: a replay emits
+        // again, and only the play that completes delivers.
+        emit: (_seq, block) => Effect.try({
+            try: () => {
+                if (!limits.emitCollector) {
+                    throw guestFailure("unavailable", "connecta.emit is unavailable: no emission collector was configured for this execution", true);
+                }
+                limits.emitCollector.accept(block);
+            },
+            catch: (err) => err,
+        }),
+        search: (seq, raw) => discovery("search", seq, raw, async () => {
             const args = (raw ?? {});
             const result = flatSearchResult(await catalog.search({
                 ...args,
@@ -353,230 +638,413 @@ export async function buildSandboxProviders(registry, baseUrl, _logger, activity
             }));
             boundedDiscoveryText(result, "Request a smaller limit, omit fullDescriptions, use compact schemas, or pass includeSchemaKeys: false.");
             return result;
-        })),
-        describe: (raw) => timedCatalog("describe", () => typedDiscovery(async () => {
+        }),
+        describe: (seq, raw) => discovery("describe", seq, raw, async () => {
             const args = (raw ?? {});
             const result = { tools: await catalog.describe(args) };
             boundedDiscoveryText(result, 'Split the address list or use format: "compact".');
             return result;
-        })),
+        }),
     };
-    const transportedFns = Object.fromEntries(Object.entries(fns).map(([name, fn]) => [
-        name,
-        async (...args) => {
-            try {
-                return await fn(...args);
-            }
-            catch (err) {
-                if (err instanceof InvocationFailure) {
-                    const failure = boundedGuestFailure(err);
-                    const framed = framedGuestFailure(failureSecret, failure);
-                    limits.onInvocationFailure?.(failure);
-                    throw framed;
-                }
-                throw err;
-            }
-        },
-    ]));
-    return [
-        {
-            name: "connecta",
-            prelude: guestErrorPrelude(failureSecret),
-            fns: transportedFns,
-        },
+    // Every failure leaves through the same frame, so the prelude can rebuild
+    // a typed error however the host call failed — refused, over budget, or
+    // cancelled. Anything that is not an InvocationFailure crosses unchanged.
+    const framed = (err) => Effect.suspend(() => {
+        if (!(err instanceof InvocationFailure))
+            return Effect.fail(err);
+        const failure = boundedGuestFailure(err);
+        const frame = framedGuestFailure(failureSecret, failure);
+        limits.onInvocationFailure?.(failure);
+        return Effect.fail(frame);
+    });
+    return {
+        name: "connecta",
+        // Typed errors first, then the pinned clock and randomness: both are
+        // trusted host code the program runs after and cannot undo.
+        prelude: `${guestErrorPrelude(failureSecret)}\n${pinnedEnvironmentPrelude(runState?.environment ?? limits.environment ?? freshEnvironment())}`,
+        fns: Object.fromEntries(Object.entries(operations).map(([name, operation]) => [
+            name,
+            (...args) => {
+                // Numbered here, synchronously, as the program makes the call: the
+                // numbering is the program's own issue order, which is what makes
+                // a pause point and a replay reproducible.
+                const seq = runState && name !== "emit" ? runState.begin() : undefined;
+                const settled = runEdge(Effect.suspend(() => operation(seq, ...args)).pipe(Effect.catch(framed), Effect.ensuring(Effect.sync(() => {
+                    if (seq !== undefined)
+                        runState?.decide(seq);
+                }))));
+                if (seq !== undefined)
+                    runState?.track(seq, settled);
+                // The executor owns this promise, and a program may abandon a call
+                // that the run's end then cancels before anyone has awaited it.
+                // The rejection is still there for whoever does; it is just not an
+                // unhandled rejection of the host's, which workerd reports as soon
+                // as a microtask passes without a handler.
+                settled.catch(() => { });
+                return settled;
+            },
+        ])),
+    };
+}
+/**
+ * Await an executor's promise without trusting it to settle.
+ *
+ * An executor's deadline is its own business, and the Dynamic Worker's lives
+ * inside the sandbox: a wedged isolate never fires it, so the call never
+ * settles, the handler never returns, and the admission lease is held for
+ * good. Two of those fill the default code pool and every later execute_code
+ * queues behind them (executor hit this in production). An `acquire()` that
+ * ignores its signal holds a cancelled request the same way.
+ *
+ * So the host races the promise against the request's signal and, for a run,
+ * a ceiling of its own. Cancellation settles as the same `executor_cancelled`
+ * the QuickJS pool reports, unless the executor reports its own first; the
+ * ceiling as an untyped executor failure naming the key that sets it. Either
+ * way the handler returns and releases the lease, and the abandoned call
+ * keeps whatever it was doing: the QuickJS lease release recycles its child,
+ * a Dynamic Worker isolate runs on to its own deadline, and a lease granted
+ * after its request gave up goes to `late`. The result contract is untouched
+ * — this only decides when to stop waiting for one.
+ */
+function awaitExecutor(start, signal, options = {}) {
+    const contenders = [
+        Effect.suspend(() => {
+            let pending;
+            const settling = Effect.tryPromise({
+                try: () => (pending = Promise.resolve(start())),
+                catch: (err) => err,
+            });
+            const { late } = options;
+            return late
+                ? settling.pipe(Effect.onInterrupt(() => Effect.sync(() => {
+                    pending?.then(late, () => { });
+                })))
+                : settling;
+        }),
+        // An executor that honors the signal rejects in the abort event itself,
+        // with the logs it captured attached, and that report beats ours by one
+        // timer turn. (A 1ms sleep, not 0: Effect.sleep(0) waits a microtask,
+        // which the executor's promise chain can still lose to.)
+        fromSignal(signal).pipe(Effect.catch(() => Effect.sleep(Duration.millis(1))), Effect.andThen(Effect.fail(new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled.")))),
     ];
+    const { watchdog } = options;
+    if (watchdog) {
+        contenders.push(Effect.sleep(Duration.millis(watchdog.ms)).pipe(Effect.andThen(Effect.suspend(() => {
+            watchdog.logger.warn("[connecta] execute_code executor did not settle; run abandoned", { watchdogMs: watchdog.ms });
+            return Effect.fail(new Error(`sandbox unresponsive: no outcome within the ${watchdog.ms}ms ` +
+                "execute.watchdogMs ceiling, so the run was abandoned"));
+        }))));
+    }
+    return Effect.raceAllFirst(contenders);
 }
-/** The execute_code handler. Exported for direct testing. */
-export function createExecuteTool(registry, baseUrl, executor, logger, activity, config = {}) {
-    return async ({ code, diagnostics: diagnosticsRequested }, options = {}) => {
+/**
+ * The run's own signal, aborted however the run ends. It follows the
+ * caller's, and aborting it on the way out is what releases outstanding host
+ * waits and tells cooperative connectors to stop.
+ */
+function runSignal(caller) {
+    return Effect.acquireRelease(Effect.sync(() => {
         const controller = new AbortController();
-        const forwardAbort = () => controller.abort(options.signal?.reason);
-        if (options.signal?.aborted)
-            forwardAbort();
-        else {
-            options.signal?.addEventListener("abort", forwardAbort, { once: true });
-        }
-        let lease;
-        let outcome;
-        const diagnostics = diagnosticsRequested ? new ExecuteDiagnostics() : undefined;
+        const forward = () => controller.abort(caller?.reason);
+        if (caller?.aborted)
+            forward();
+        else
+            caller?.addEventListener("abort", forward, { once: true });
+        return { controller, forward };
+    }), ({ controller, forward }) => Effect.sync(() => {
+        controller.abort();
+        caller?.removeEventListener("abort", forward);
+    })).pipe(Effect.map(({ controller }) => controller.signal));
+}
+/**
+ * An admitting executor's lease, released when the run's scope closes.
+ *
+ * `acquire()` is the executor's Promise, awaited as one on purpose. A queued
+ * request is handed its lease from inside whichever request released one, so
+ * a fiber resumed straight from the executor's admission queue would build
+ * this request's providers and run its program in the releasing request —
+ * which workerd refuses for any I/O. Awaiting the promise resumes it here.
+ */
+function leased(executor, signal) {
+    return Effect.acquireRelease(awaitExecutor(() => executor.acquire({ signal }), signal, {
+        late: (lease) => lease.release(),
+    }), (lease) => Effect.sync(() => lease.release()));
+}
+/**
+ * Room a claim leaves beyond the watchdog and one host-call deadline, for the
+ * executor queue a resumed play waits in first. Only liveness rides on it: a
+ * claim that lapses early lets a takeover start, and the write-ahead mark
+ * still keeps any write from being sent twice.
+ */
+const CLAIM_SLACK_MS = 10_000;
+/** The runner behind both program tools. */
+export function createProgramRunner(registry, baseUrl, executor, logger, activity, config = {}) {
+    const watchdog = {
+        ms: resolveBudget(config.watchdogMs, EXECUTE_WATCHDOG_MS),
+        logger,
+    };
+    const hostCallTimeoutMs = resolveBudget(config.hostCallTimeoutMs, EXECUTE_HOST_CALL_TIMEOUT_MS);
+    const storageTimeoutMs = resolveBudget(config.storageTimeoutMs, Math.max(hostCallTimeoutMs, MIN_STORAGE_TIMEOUT_MS));
+    /**
+     * One play of a program. Without a run state it is the execute_code run it
+     * always was. With one, the play also ends when the run stops — a pause or
+     * a typed failure — and then waits for what is still on the wire, persists
+     * what it must, and discards the program's own result.
+     */
+    const play = (program, runState, diagnosticsRequested, callerSignal) => Effect.suspend(() => {
+        const diagnostics = diagnosticsRequested
+            ? new ExecuteDiagnostics()
+            : undefined;
         const emitted = new EmitCollector(resolveBudget(config.maxEmittedBytes, EXECUTE_MAX_EMITTED_BYTES), resolveBudget(config.maxEmittedBlocks, EXECUTE_MAX_EMITTED_BLOCKS), diagnostics);
         const invocationFailures = [];
-        try {
-            // Admission comes before provider construction: queued calls retain no
-            // catalogs, request scopes, or one-closure-per-tool provider arrays.
+        const exemptWrites = runState ? undefined : new ExemptWrites();
+        // The run's scope holds its signal and its lease. However the run
+        // ends — a result, a thrown executor, the watchdog, cancellation —
+        // closing it releases the lease and then aborts the signal, so
+        // nothing the run started outlives the request.
+        const run = Effect.gen(function* () {
+            const signal = yield* runSignal(callerSignal);
+            // Admission comes before provider construction: queued calls retain
+            // no catalogs, request scopes, or provider closures.
+            let lease;
             if (isAdmittingExecutor(executor)) {
-                const admissionStarted = Date.now();
-                try {
-                    lease = await executor.acquire({ signal: controller.signal });
-                }
-                finally {
-                    if (diagnostics) {
-                        diagnostics.admissionMs = Date.now() - admissionStarted;
-                    }
-                }
+                lease = yield* timed((elapsed) => {
+                    if (diagnostics)
+                        diagnostics.admissionMs = elapsed;
+                }, leased(executor, signal));
                 if ((lease.waitMs ?? 0) > 0) {
                     logger.debug("[connecta] execute_code admitted after queue wait", {
                         waitMs: lease.waitMs,
                     });
                 }
             }
-            const setupStarted = Date.now();
-            let providers;
-            try {
-                providers = await buildSandboxProviders(registry, baseUrl, logger, activity, {
-                    signal: controller.signal,
-                    onInvocationFailure: (failure) => {
-                        invocationFailures.push(failure);
-                        if (invocationFailures.length > 64)
-                            invocationFailures.shift();
-                    },
-                    emitCollector: emitted,
-                    ...(diagnostics ? { diagnostics } : {}),
-                    discoveryConcurrency: config.discoveryConcurrency,
-                    probeTimeoutMs: config.probeTimeoutMs,
-                    maxHostCalls: config.maxHostCalls,
-                    hostCallTimeoutMs: config.hostCallTimeoutMs,
-                    defer: config.defer,
-                });
-            }
-            finally {
+            const provider = yield* timed((elapsed) => {
                 if (diagnostics)
-                    diagnostics.setupMs = Date.now() - setupStarted;
+                    diagnostics.setupMs = elapsed;
+            }, Effect.sync(() => sandboxProvider(registry, baseUrl, activity, {
+                signal,
+                onInvocationFailure: (failure) => {
+                    invocationFailures.push(failure);
+                    if (invocationFailures.length > 64)
+                        invocationFailures.shift();
+                },
+                emitCollector: emitted,
+                ...(diagnostics ? { diagnostics } : {}),
+                discoveryConcurrency: config.discoveryConcurrency,
+                probeTimeoutMs: config.probeTimeoutMs,
+                maxHostCalls: config.maxHostCalls,
+                hostCallTimeoutMs,
+                defer: config.defer,
+                environment: config.environment,
+                runState,
+                approval: config.approval,
+                maxWrites: config.maxWrites,
+                exemptWrites,
+            })));
+            if (signal.aborted) {
+                return yield* Effect.fail(new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled during sandbox setup."));
             }
-            if (controller.signal.aborted) {
-                throw new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled during sandbox setup.");
+            const admitted = lease;
+            const executing = awaitExecutor(() => admitted
+                ? admitted.execute(program, [provider])
+                : executor.execute(program, [provider]), signal, { watchdog }).pipe(Effect.map((settled) => ({ settled })));
+            if (!runState) {
+                // Nothing pauses, but an exempt write may be on the wire: close,
+                // then let it finish before the scope aborts it.
+                return yield* timed((elapsed) => {
+                    if (diagnostics)
+                        diagnostics.executorWallMs = elapsed;
+                }, executing.pipe(Effect.ensuring(Effect.suspend(() => {
+                    exemptWrites?.close();
+                    return exemptWrites?.drain() ?? Effect.void;
+                }))));
             }
-            const executorStarted = Date.now();
-            try {
-                outcome = lease
-                    ? await lease.execute(code, providers)
-                    : await executor.execute(code, providers);
+            // The run stopping wins the race as soon as its gate decides, before
+            // the program even sees the rejection. Either way the play closes —
+            // a write gated after this is not sent — and what is still on the
+            // wire finishes before the scope aborts it: every call after a stop,
+            // since each is journaled, and every write otherwise, since an
+            // abandoned write would be an unknown one.
+            const ended = yield* timed((elapsed) => {
+                if (diagnostics)
+                    diagnostics.executorWallMs = elapsed;
+            }, Effect.raceFirst(executing, Deferred.await(runState.stopped).pipe(Effect.map((stop) => ({ stop })))).pipe(Effect.ensuring(Effect.suspend(() => {
+                runState.close();
+                return runState.drain("writes");
+            }))));
+            if ("stop" in ended)
+                yield* runState.drain("all");
+            return ended;
+        });
+        const reported = { emitted, diagnostics, invocationFailures };
+        return Effect.flatMap(Effect.exit(Effect.scoped(run)), (exit) => {
+            if (Exit.isFailure(exit)) {
+                const failed = failedRun(Cause.squash(exit.cause), logger, reported);
+                return runState
+                    ? runState.finishExecutorFailure(failed)
+                    : Effect.succeed(exemptWrites?.finish(failed) ?? failed);
             }
-            finally {
-                if (diagnostics) {
-                    diagnostics.executorWallMs = Date.now() - executorStarted;
-                }
+            const ended = exit.value;
+            if ("stop" in ended) {
+                return runState
+                    ? runState.finishStopped()
+                    : Effect.die(new Error("a run without state cannot stop"));
             }
-        }
-        catch (err) {
-            const logs = err !== null && typeof err === "object" && "logs" in err
-                ? executeLogs(err.logs)
-                : undefined;
-            if (err instanceof ExecutorAdmissionError) {
-                if (err.code === "executor_overloaded") {
-                    logger.warn("[connecta] execute_code admission rejected", {
-                        code: err.code,
-                        retryAfterMs: err.retryAfterMs,
-                    });
-                }
-                return failureResponse(err.message, {
-                    logs,
-                    emitted: err instanceof ExecutorExecutionError ? emitted : undefined,
-                    diagnostics,
-                    code: {
-                        code: err.code,
-                        message: err.message,
-                        retryable: err.retryable,
-                        ...(err.retryAfterMs !== undefined
-                            ? { retryAfterMs: err.retryAfterMs }
-                            : {}),
-                    },
-                });
+            const finished = finishedRun(ended.settled, reported);
+            if (config.failOnInvocationFailure && invocationFailures.length > 0) {
+                const refusal = invocationFailures[0];
+                return Effect.succeed(failureResponse(refusal.details.message, {
+                    code: refusal.details,
+                }));
             }
-            return failureResponse(`Executor failed: ${msg(err)}`, {
-                logs,
-                emitted,
-                diagnostics,
-                code: "executor_failed",
+            return runState
+                ? runState.finishSettled(finished)
+                : Effect.succeed(exemptWrites?.finish(finished) ?? finished);
+        });
+    });
+    return {
+        claimMs: watchdog.ms + hostCallTimeoutMs + CLAIM_SLACK_MS,
+        storageTimeoutMs,
+        execute: ({ code, diagnostics }, options = {}) => {
+            // A code-unit count above the cap is already too large in UTF-8. Check
+            // that first so a huge direct-call string is never encoded in full.
+            if (code.length > EXECUTE_MAX_CODE_BYTES ||
+                new TextEncoder().encode(code).byteLength > EXECUTE_MAX_CODE_BYTES) {
+                const message = `execute_code code exceeds the ${EXECUTE_MAX_CODE_BYTES}-byte UTF-8 limit.`;
+                return Promise.resolve(failureResponse(message, {
+                    code: { code: "invalid_args", message, retryable: false },
+                }));
+            }
+            return runEdge(Effect.suspend(() => {
+                const program = normalizeProgramSource(code);
+                const storage = config.resumable ? registry.resultsStorage() : undefined;
+                const runState = config.resumable && storage?.compareAndSet
+                    ? RunState.fresh(storage, program, config.environment ?? freshEnvironment(), config.resumable, storageTimeoutMs)
+                    : undefined;
+                return play(program, runState, diagnostics, options.signal);
+            }));
+        },
+        replay: (runState, signal) => play(runState.program, runState, false, signal),
+    };
+}
+/** The execute_code handler. Exported for direct testing. */
+export function createExecuteTool(registry, baseUrl, executor, logger, activity, config = {}) {
+    return createProgramRunner(registry, baseUrl, executor, logger, activity, config).execute;
+}
+/** An execution that never produced an ExecuteResult, as the model sees it. */
+function failedRun(err, logger, { emitted, diagnostics }) {
+    const logs = err !== null && typeof err === "object" && "logs" in err
+        ? executeLogs(err.logs)
+        : undefined;
+    if (err instanceof ExecutorAdmissionError) {
+        if (err.code === "executor_overloaded") {
+            logger.warn("[connecta] execute_code admission rejected", {
+                code: err.code,
+                retryAfterMs: err.retryAfterMs,
             });
         }
-        finally {
-            // A sandbox timeout or early return must also release any outstanding
-            // host waits and signal cooperative connectors to stop their work.
-            controller.abort();
-            lease?.release();
-            options.signal?.removeEventListener("abort", forwardAbort);
-        }
-        const logs = executeLogs(outcome.logs);
-        if (outcome.error !== undefined) {
-            // Executor bridges necessarily reduce thrown host errors to strings.
-            // Match that terminal string back to the request-local typed failure so
-            // an unhandled tool failure keeps the same structured contract as
-            // call_tool. Failures caught by model code never reach
-            // outcome.error and therefore remain under that code's control.
-            //
-            // An error the program let through unchanged matches exactly, and an
-            // exact match always wins: a program that wrapped one failure's message
-            // around another's must not have the wrong type attached. Containment is
-            // the fallback, so a wrapped message still reports its underlying type
-            // rather than losing it to prose.
-            let invocationFailure;
-            for (const match of [
-                (candidate) => outcome.error !== "" &&
-                    [candidate.message, guestFailureFrames.get(candidate)].includes(outcome.error),
-                (candidate) => [candidate.message, guestFailureFrames.get(candidate)].some((message) => 
-                // E6: empty or tiny prose cannot identify a wrapped failure.
-                message !== undefined &&
-                    message.length >= 8 &&
-                    outcome.error?.includes(message) === true),
-            ]) {
-                for (let i = invocationFailures.length - 1; i >= 0; i--) {
-                    const candidate = invocationFailures[i];
-                    if (candidate && match(candidate)) {
-                        invocationFailure = candidate;
-                        break;
-                    }
-                }
-                if (invocationFailure)
+        return failureResponse(err.message, {
+            logs,
+            emitted: err instanceof ExecutorExecutionError ? emitted : undefined,
+            diagnostics,
+            code: {
+                code: err.code,
+                message: err.message,
+                retryable: err.retryable,
+                ...(err.retryAfterMs !== undefined
+                    ? { retryAfterMs: err.retryAfterMs }
+                    : {}),
+            },
+        });
+    }
+    return failureResponse(`Executor failed: ${msg(err)}`, {
+        logs,
+        emitted,
+        diagnostics,
+        code: "executor_failed",
+    });
+}
+/** The response for an ExecuteResult: the program's error or its value. */
+function finishedRun(outcome, { emitted, diagnostics, invocationFailures }) {
+    const logs = executeLogs(outcome.logs);
+    if (outcome.error !== undefined) {
+        // Executor bridges necessarily reduce thrown host errors to strings.
+        // Match that terminal string back to the request-local typed failure so
+        // an unhandled tool failure keeps the same structured contract as
+        // call_tool. Failures caught by model code never reach
+        // outcome.error and therefore remain under that code's control.
+        //
+        // An error the program let through unchanged matches exactly, and an
+        // exact match always wins: a program that wrapped one failure's message
+        // around another's must not have the wrong type attached. Containment is
+        // the fallback, so a wrapped message still reports its underlying type
+        // rather than losing it to prose.
+        let invocationFailure;
+        for (const match of [
+            (candidate) => outcome.error !== "" &&
+                [candidate.message, guestFailureFrames.get(candidate)].includes(outcome.error),
+            (candidate) => [candidate.message, guestFailureFrames.get(candidate)].some((message) => 
+            // E6: empty or tiny prose cannot identify a wrapped failure.
+            message !== undefined &&
+                message.length >= 8 &&
+                outcome.error?.includes(message) === true),
+        ]) {
+            for (let i = invocationFailures.length - 1; i >= 0; i--) {
+                const candidate = invocationFailures[i];
+                if (candidate && match(candidate)) {
+                    invocationFailure = candidate;
                     break;
+                }
             }
-            if (invocationFailure) {
-                // E1/X11: return the same bounded details the guest received.
-                return failureResponse(invocationFailure.details.message, {
-                    logs,
-                    emitted,
-                    diagnostics,
-                    code: invocationFailure.details,
-                });
-            }
-            const message = `Error: ${outcome.error || "Execution failed without an error message."}`;
-            return failureResponse(message, {
-                logs,
-                emitted,
-                diagnostics,
-                code: "executor_failed",
-            });
-        }
-        // A result crossing back as a host BigInt (or otherwise unserializable
-        // value) makes JSON.stringify throw — keep that inside the structured
-        // error path so captured logs survive instead of a raw SDK 500.
-        let result;
-        try {
-            result = guardExecuteResultValue(outcome.result);
+            if (invocationFailure)
+                break;
         }
-        catch (err) {
-            const message = `Error: result is not JSON-serializable: ${msg(err)}`;
-            return failureResponse(message, {
+        if (invocationFailure) {
+            // E1/X11: return the same bounded details the guest received.
+            return failureResponse(invocationFailure.details.message, {
                 logs,
                 emitted,
                 diagnostics,
-                code: "executor_failed",
+                code: invocationFailure.details,
             });
         }
-        const response = jsonResult({
-            result,
-            ...(emitted.blocks.length > 0 ? { emitted: emitted.blocks.length } : {}),
-            ...(logs ? { logs } : {}),
-            ...(diagnostics ? { diagnostics: diagnostics.finish() } : {}),
+        const message = `Error: ${outcome.error || "Execution failed without an error message."}`;
+        return failureResponse(message, {
+            logs,
+            emitted,
+            diagnostics,
+            code: "executor_failed",
         });
-        if (emitted.blocks.length > 0) {
-            // Emitted image/audio blocks are valid MCP content that ToolResult's
-            // text-only typing does not model — the same acknowledged gap
-            // guardContent lives with for downstream block passthrough.
-            response.content.push(...emitted.blocks);
-        }
-        return response;
-    };
+    }
+    // A result crossing back as a host BigInt (or otherwise unserializable
+    // value) makes JSON.stringify throw — keep that inside the structured
+    // error path so captured logs survive instead of a raw SDK 500.
+    let result;
+    try {
+        result = guardExecuteResultValue(outcome.result);
+    }
+    catch (err) {
+        const message = `Error: result is not JSON-serializable: ${msg(err)}`;
+        return failureResponse(message, {
+            logs,
+            emitted,
+            diagnostics,
+            code: "executor_failed",
+        });
+    }
+    const response = jsonResult({
+        result,
+        ...(emitted.blocks.length > 0 ? { emitted: emitted.blocks.length } : {}),
+        ...(logs ? { logs } : {}),
+        ...(diagnostics ? { diagnostics: diagnostics.finish() } : {}),
+    });
+    if (emitted.blocks.length > 0) {
+        // Emitted image/audio blocks are valid MCP content that ToolResult's
+        // text-only typing does not model — the same acknowledged gap
+        // guardContent lives with for downstream block passthrough.
+        response.content.push(...emitted.blocks);
+    }
+    return response;
 }
 function executeLogs(value) {
     return Array.isArray(value) && value.length > 0 && value.every((entry) => typeof entry === "string")
@@ -649,12 +1117,14 @@ function connectorInventory(connectors) {
         return `${prefix}${shown.join(", ")}.`;
     return `${prefix}${shown.join(", ")}${shown.length > 0 ? "; " : ""}+${omitted} more.`;
 }
-const executeDescription = (emitBudgets, hostLimits, connectorGuides, connectors) => `Use the configured services below to answer the task. A known address uses call_tool. Unknown-address and wider read-only work uses one execute_code program for discovery, calls, and reduction. Do not return catalog matches alone. Only readOnlyHint: true tools are available. Limits: ${hostLimits.maxHostCalls} host calls, ${hostLimits.hostCallTimeoutMs / 1_000}s/host call.
+const executeDescription = (emitBudgets, hostLimits, connectorGuides, connectors, resumable) => `Use the configured services below to answer the task. A known address uses call_tool. Unknown-address and wider ${resumable ? "work, writes included," : "read-only work"} uses one execute_code program for discovery, calls, and reduction. Do not return catalog matches alone. ${resumable
+    ? `Writes pause for resume_execution. Limits: ${hostLimits.maxHostCalls} host calls, ${resumable.maxWrites} writes`
+    : `Only readOnlyHint: true tools are available. Limits: ${hostLimits.maxHostCalls} host calls`}, ${hostLimits.hostCallTimeoutMs / 1_000}s/host call.
 
 ${connectorInventory(connectors)}
 
-Read relevant guides using top-level skills, not sandbox code. Write a plain-JavaScript async arrow:
-- connecta.search({ connector, query, safety: "readOnly", includeSchemas: "json" }) returns { tools }. Search each operation separately; choose by connectorTitle and schemas. Use schema.required and .properties to build args, never guessed fields. Compact schemas are text.
+Read guides with top-level skills. Write JavaScript as async () => { ... }; connecta is global, not a parameter:
+- connecta.search({ connector, query, ${resumable ? "" : 'safety: "readOnly", '}includeSchemas: "json" }) returns { tools }. Search each operation separately; choose by connectorTitle and schemas. Use schema.required and .properties to build args, never guessed fields. Compact schemas are text.
 - connecta.describe({ address }) returns { tools } for unclear schemas.
 - connecta.call(address, args) returns the provider value directly.
 - Use Promise.all for independent calls, or Promise.allSettled to retain failures. Check status before reading value; rejected calls and missing fields are unknown, never false or zero.
@@ -662,6 +1132,18 @@ Read relevant guides using top-level skills, not sandbox code. Write a plain-Jav
 - console.log(...) is captured. Return data for the client to render.
 
 No portable ambient capabilities. Return reduced JSON. If a provider result has an unfamiliar shape, return a small sample and continue in another call; never guess fields or use the whole text as an id. Top-level skills({ name: "usage" }): repair${connectorGuides ? ", guide handling" : ""}; skills({ name: "investigate" }): task planning.`;
+// Module scope, like the other six meta-tool inputs: its JSON Schema is
+// derived once per process. Budgets and connectors vary by deployment and
+// view, so they live in the description, never here.
+const EXECUTE_INPUT = advertisedSchema(z.object({
+    code: z
+        .string()
+        .describe("One complete zero-argument JavaScript async arrow: async () => { ... }. Use the provided connecta global to discover, call, and return the reduced answer. At most 65,536 UTF-8 bytes."),
+    diagnostics: z
+        .boolean()
+        .optional()
+        .describe("Add request-local, payload-free timing and result-size summaries."),
+}));
 /** Register the execute_code meta-tool. Only called when an executor is configured. */
 export function registerExecuteTool(server, registry, ctx) {
     // Resolved once so the description and the collector cannot disagree about
@@ -677,54 +1159,35 @@ export function registerExecuteTool(server, registry, ctx) {
         hostCallTimeoutMs: resolveBudget(ctx.hostCallTimeoutMs, EXECUTE_HOST_CALL_TIMEOUT_MS),
     };
     const connectors = registry.listConnectors();
-    const handler = createExecuteTool(registry, ctx.baseUrl, ctx.executor, ctx.logger, ctx.activity, {
+    const runner = createProgramRunner(registry, ctx.baseUrl, ctx.executor, ctx.logger, ctx.activity, {
         discoveryConcurrency: ctx.discoveryConcurrency,
         probeTimeoutMs: ctx.probeTimeoutMs,
         maxEmittedBytes: emitBudgets.maxBytes,
         maxEmittedBlocks: emitBudgets.maxBlocks,
         maxHostCalls: hostLimits.maxHostCalls,
         hostCallTimeoutMs: hostLimits.hostCallTimeoutMs,
+        watchdogMs: ctx.watchdogMs,
         defer: ctx.defer,
+        resumable: ctx.resumable,
+        approval: ctx.approval,
+        maxWrites: ctx.maxWrites,
     });
     server.registerTool("execute_code", {
-        description: executeDescription(emitBudgets, hostLimits, hasConnectorGuides(connectors), connectors),
-        inputSchema: z.object({
-            code: z
-                .string()
-                .describe("One complete JavaScript async arrow function that discovers, calls, and returns the reduced answer."),
-            diagnostics: z
-                .boolean()
-                .optional()
-                .describe("Add request-local, payload-free timing and result-size summaries."),
-        }),
-        // This hint describes connector calls, all explicitly read-only. The
-        // supported executor constructions deny outbound access, filesystem,
-        // and deployment config; X5 documents Dynamic runtime modules separately.
+        description: executeDescription(emitBudgets, hostLimits, hasConnectorGuides(connectors), connectors, ctx.resumable),
+        inputSchema: EXECUTE_INPUT,
+        // This hint describes connector calls: only explicitly read-only ones
+        // run here, and any other call pauses the run unsent (W1) — the write
+        // itself runs inside resume_execution, which is annotated destructive.
+        // The supported executor constructions deny outbound access,
+        // filesystem, and deployment config; X5 documents Dynamic runtime
+        // modules separately.
         annotations: {
             readOnlyHint: true,
             destructiveHint: false,
             openWorldHint: true,
         },
-    }, async (args, extra) => {
-        const controller = new AbortController();
-        const signals = [extra.mcpReq.signal, ctx.requestSignal].filter((signal) => signal !== undefined);
-        const forwarders = signals.map((signal) => {
-            const forward = () => controller.abort(signal.reason);
-            if (signal.aborted)
-                forward();
-            else
-                signal.addEventListener("abort", forward, { once: true });
-            return { signal, forward };
-        });
-        try {
-            return await handler(args, {
-                signal: controller.signal,
-            });
-        }
-        finally {
-            for (const { signal, forward } of forwarders) {
-                signal.removeEventListener("abort", forward);
-            }
-        }
-    });
+    }, (args, extra) => underAnySignal([extra.mcpReq.signal, ctx.requestSignal], (signal) => runner.execute(args, {
+        signal,
+    })));
+    return runner;
 }