@zackbart/connecta 0.28.1 → 0.29.0

package/dist/execute.js

@@ -1,21 +1,28 @@
-import { Cause, Duration, Effect, Exit } from "effect";
+import { GUEST_API_DECLARATION } from "./usage-guide.js";
+import { bindMcpClient } from "./mcp-client-context.js";
+import { CONFIG_DEFAULTS } from "./config-defaults.js";
+import { Cause, Deferred, Duration, Effect, Exit } from "effect";
 import { z } from "zod";
 import { advertisedSchema } from "./advertised-schema.js";
 import { boundedDiscoveryText, CatalogService, DiscoveryPolicyError, flatSearchResult, } from "./catalog-service.js";
-import { errorResult, jsonResult } from "./meta-tools.js";
-import { guardExecuteResultValue, MAX_EXECUTE_LOG_CHARS, truncateExecuteText, } from "./executor-result.js";
-import { ExecutorAdmissionError, ExecutorExecutionError, isAdmittingExecutor, } from "./executor-admission.js";
-import { boundedEchoText, msg } from "./errors.js";
-import { DEFAULT_MAX_WRITES, ExemptWrites, writeStateOf, } from "./exempt-writes.js";
-import { InvocationFailure, InvocationService, timed, } from "./invocation.js";
+import { createMetaTools, jsonResult } from "./meta-tools.js";
+import { guardExecuteResultValue, MAX_EXECUTE_LOG_CHARS, MAX_EXECUTE_RESULT_CHARS, truncateExecuteText, } from "./executor-result.js";
+import { ExecutorAdmissionError, ExecutorExecutionError, isAdmittingExecutor } from "./executor-admission.js";
+import { boundedEchoText, ConnectorCallError, msg } from "./errors.js";
+import { DEFAULT_MAX_WRITES, ProgramWrites, writeStateOf } from "./program-writes.js";
+import { InvocationFailure, InvocationService, timed } from "./invocation.js";
+import { guestPrelude, programError, wrapGuestProgram } from "./guest-runtime.js";
+import { EXECUTE_OUTPUT } from "./meta-output.js";
 import { normalizeProgramSource } from "./program-source.js";
-import { underAnySignal } from "./timeout.js";
-import { isApprovalExempt, NO_EXEMPTIONS, } from "./tool-safety.js";
-import { fromSignal, runEdge } from "./runtime/run.js";
-import { connectorGuide, connectorGuideRequired, connectorSkillName, hasConnectorGuides, } from "./skills.js";
+import { readResource } from "./resource-read.js";
+import { agentOutputOperations, redactAgentOutput, sentSecretsForRequest } from "./sent-secrets.js";
+import { normalizeTimeoutMs, underAnySignal } from "./timeout.js";
+import { fromSignal, runEdge, withDeadlineEffect } from "./runtime/run.js";
+import { closeScope } from "./runtime/connector-scope.js";
+import { connectorGuide, connectorGuideRequired, connectorSkillName, hasConnectorGuides, SkillsRegistry, } from "./skills.js";
 /** Keep one model-written program from amplifying into an unbounded fan-out. */
-const EXECUTE_MAX_HOST_CALLS = 20;
-const EXECUTE_HOST_CALL_TIMEOUT_MS = 15_000;
+const EXECUTE_MAX_HOST_CALLS = CONFIG_DEFAULTS.execute.maxHostCalls;
+const EXECUTE_HOST_CALL_TIMEOUT_MS = CONFIG_DEFAULTS.execute.hostCallTimeoutMs;
 /** Above every program in the recorded evals, below the QuickJS IPC ceiling. */
 const EXECUTE_MAX_CODE_BYTES = 64 * 1024;
 /**
@@ -24,7 +31,7 @@ const EXECUTE_MAX_CODE_BYTES = 64 * 1024;
  * always reports its own timeout first and this fires only for one that
  * never settles at all.
  */
-const EXECUTE_WATCHDOG_MS = 120_000;
+const EXECUTE_WATCHDOG_MS = CONFIG_DEFAULTS.execute.watchdogMs;
 /** Complete entries plus an exact omission count, all inside this byte cap. */
 export const CONNECTOR_INVENTORY_MAX_BYTES = 256;
 /**
@@ -34,8 +41,9 @@ export const CONNECTOR_INVENTORY_MAX_BYTES = 256;
  * two or three real screenshots after base64's 4/3 inflation, well short of a
  * file-hosting ambition (design record M5).
  */
-export const EXECUTE_MAX_EMITTED_BYTES = 4_000_000;
-export const EXECUTE_MAX_EMITTED_BLOCKS = 32;
+export const EXECUTE_MAX_EMITTED_BYTES = CONFIG_DEFAULTS.execute.maxEmittedBytes;
+export const EXECUTE_MAX_EMITTED_BLOCKS = CONFIG_DEFAULTS.execute.maxEmittedBlocks;
+const CALL_SIGNATURE = "Use connecta.call(address, args?, { timeoutMs? }) or connecta.call({ address, args?, timeoutMs? }). address must be a canonical connector.tool string.";
 const diagnosticsEncoder = new TextEncoder();
 class ExecuteDiagnostics {
     started = Date.now();
@@ -85,6 +93,15 @@ class ExecuteDiagnostics {
         stats.catalogMs += outcome.timing.catalogMs;
         stats.connectorMs += outcome.timing.connectorMs;
     }
+    recordRead(durationMs, connectorMs, ok, value) {
+        const stats = this.stats("read");
+        stats.count++;
+        stats.failures += ok ? 0 : 1;
+        stats.durationMs += durationMs;
+        stats.connectorMs += connectorMs;
+        if (ok)
+            stats.resultBytes += serializedDiagnosticBytes(value);
+    }
     finish() {
         const operations = [...this.operations.values()];
         return {
@@ -130,6 +147,19 @@ function requireEmittedBlock(raw) {
     if (extra.length > 0) {
         throw guestFailure("invalid_args", `connecta.emit block carries unsupported field(s) ${extra.map((key) => JSON.stringify(key)).join(", ")}; a "${String(block.type)}" block is exactly { ${fields.join(", ")} }`);
     }
+    if (block.type === "image") {
+        if (!["image/png", "image/jpeg", "image/gif", "image/webp"].includes(block.mimeType)) {
+            throw guestFailure("invalid_args", "connecta.emit image mimeType must be image/png, image/jpeg, image/gif, or image/webp.");
+        }
+        const data = block.data;
+        // RFC 4648 alphabet, complete quads and canonical padding, including zero
+        // pad bits. Decode only the last quad; validation does not copy the image.
+        if (!data.length ||
+            !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(data) ||
+            btoa(atob(data.slice(-4))) !== data.slice(-4)) {
+            throw guestFailure("invalid_args", "connecta.emit image data must be nonempty, strict base64 with canonical padding.");
+        }
+    }
     return raw;
 }
 export class EmitCollector {
@@ -138,6 +168,7 @@ export class EmitCollector {
     diagnostics;
     blocks = [];
     bytes = 0;
+    textChars = 0;
     constructor(maxBytes, maxBlocks, diagnostics) {
         this.maxBytes = maxBytes;
         this.maxBlocks = maxBlocks;
@@ -153,6 +184,12 @@ export class EmitCollector {
         if (this.bytes + size > this.maxBytes) {
             throw guestFailure("budget_exceeded", `connecta.emit byte budget exceeded: block is ${size} serialized bytes with ${this.maxBytes - this.bytes} of ${this.maxBytes} remaining`);
         }
+        const textChars = block.type === "text" ? JSON.stringify(block).length : 0;
+        // Reserve space for a reduced result envelope even if text fills the budget.
+        if (this.textChars + textChars > MAX_EXECUTE_RESULT_CHARS - 512) {
+            throw guestFailure("result_too_large", "Emitted text shares the 24,000-character program result limit. Reduce the text before emitting it.");
+        }
+        this.textChars += textChars;
         this.blocks.push(block);
         this.bytes += size;
         this.diagnostics?.recordEmitted(this.blocks.length, this.bytes);
@@ -160,16 +197,12 @@ export class EmitCollector {
 }
 /** A positive whole-number budget, or the default when the value is unusable. */
 function resolveBudget(value, fallback) {
-    return typeof value === "number" && Number.isFinite(value) && value >= 1
-        ? Math.trunc(value)
-        : fallback;
+    return typeof value === "number" && Number.isFinite(value) && value >= 1 ? Math.trunc(value) : fallback;
 }
 function serializedDiagnosticBytes(value) {
     try {
         const text = JSON.stringify(value);
-        return text === undefined
-            ? 0
-            : diagnosticsEncoder.encode(text).byteLength;
+        return text === undefined ? 0 : diagnosticsEncoder.encode(text).byteLength;
     }
     catch {
         // The executor's normal result guard owns the error. Diagnostics must
@@ -180,16 +213,8 @@ function serializedDiagnosticBytes(value) {
 function guestFailure(code, message, retryable = false) {
     return new InvocationFailure({ code, message, retryable });
 }
-const GUEST_FAILURE_FRAME = "\u001econnecta-error:";
-const guestFailureFrames = new WeakMap();
-/** Per-execution secret: guest prose cannot collide with this host frame. */
-function guestFailureSecret() {
-    const words = new Uint32Array(4);
-    crypto.getRandomValues(words);
-    return Array.from(words, (word) => word.toString(16).padStart(8, "0")).join("");
-}
 /**
- * E1/X11: bound the serialized frame, including JSON escapes, before transport.
+ * E1/X11: bound typed host failure metadata, including JSON escapes, before transport.
  * Keep optional recovery whole: clipping an address or echoed args could turn
  * recovery into a different call. Oversized metadata is omitted instead.
  */
@@ -216,67 +241,17 @@ function boundedGuestFailure(failure) {
         code: boundText(failure.details.code, 128),
         message: boundText(failure.details.message, 2_000),
     };
-    // 3,700 plus the prefix and 32-character secret stays below QuickJS's
-    // 4,000-character error bound, with room for bridge-added context.
+    // Keep typed metadata below the executor bridge bound.
     if (JSON.stringify(details).length > 3_700) {
         details = {
             code: details.code,
             message: details.message,
             retryable: details.retryable,
-            ...(details.retryAfterMs !== undefined
-                ? { retryAfterMs: details.retryAfterMs }
-                : {}),
+            ...(details.retryAfterMs !== undefined ? { retryAfterMs: details.retryAfterMs } : {}),
         };
     }
     return new InvocationFailure(details);
 }
-function framedGuestFailure(secret, failure) {
-    const framed = new InvocationFailure(failure.details);
-    framed.message =
-        `${GUEST_FAILURE_FRAME}${secret}:${JSON.stringify(failure.details)}`;
-    guestFailureFrames.set(failure, framed.message);
-    return framed;
-}
-/** Rebuild host failures as guest errors without exposing the private frame. */
-function guestErrorPrelude(failureSecret) {
-    return `((failurePrefix) => {
-  const NativeError = globalThis.Error;
-  const startsWith = Function.prototype.call.bind(String.prototype.startsWith);
-  const slice = Function.prototype.call.bind(String.prototype.slice);
-  const parse = JSON.parse;
-  const freeze = Object.freeze;
-  const defineProperties = Object.defineProperties;
-  const construct = Reflect.construct;
-  function ConnectaError(message, options) {
-    let details;
-    if (typeof message === "string" && startsWith(message, failurePrefix)) {
-      try { details = parse(slice(message, failurePrefix.length)); }
-      catch { message = "Invalid host failure frame."; }
-    }
-    const error = construct(
-      NativeError,
-      options === undefined ? [details ? details.message : message] : [details ? details.message : message, options],
-      new.target || NativeError
-    );
-    if (details) {
-      freeze(details);
-      defineProperties(error, {
-        code: { value: details.code, enumerable: true },
-        retryable: { value: details.retryable, enumerable: true },
-        details: { value: details, enumerable: true }
-      });
-    }
-    return error;
-  }
-  ConnectaError.prototype = NativeError.prototype;
-  Object.setPrototypeOf(ConnectaError, NativeError);
-  Object.defineProperty(globalThis, "Error", {
-    value: ConnectaError,
-    writable: false,
-    configurable: false
-  });
-})(${JSON.stringify(`${GUEST_FAILURE_FRAME}${failureSecret}:`)});`;
-}
 /**
  * Expose one host provider and typed guest errors. Catalogs load only when
  * the program calls a tool or asks search/describe.
@@ -284,58 +259,78 @@ function guestErrorPrelude(failureSecret) {
 export async function buildSandboxProviders(registry, baseUrl, _logger, activity, limits = {}) {
     return [sandboxProvider(registry, baseUrl, activity, limits)];
 }
+/** Numeric accounting only; no addresses, arguments, or results. */
+class HostCallBudgetExceeded extends InvocationFailure {
+    hostCalls;
+    constructor(hostCalls, maxHostCalls) {
+        super({
+            code: "budget_exceeded",
+            message: `execute_code host-call budget exceeded (${maxHostCalls} calls maximum)`,
+            retryable: false,
+        });
+        this.hostCalls = hostCalls;
+    }
+}
 /**
  * The `connecta` provider for one execution.
  *
  * Building it is synchronous and loads nothing. Each function is a Promise
  * edge the executor awaits, and behind it one host call is one fiber: spend
- * the budget, do the operation, and turn a typed failure into the frame the
- * prelude rebuilds inside the guest. Nothing is shared between those fibers
- * but the budget counters and this request's catalog, so a call the program
- * never awaits cannot disturb the others.
+ * the budget, do the operation, and retain a typed failure for the
+ * executor bridge to rebuild inside the guest. Nothing is shared between those fibers
+ * but the budget counters and this request's catalog. Budget exhaustion ends
+ * the whole run, including calls the program never awaits.
  */
-function sandboxProvider(registry, baseUrl, activity, limits) {
+function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {}) {
+    const sentSecrets = sentSecretsForRequest(requestScope, limits.sentSecrets);
     // All host calls made by one execute_code invocation share a downstream
     // connection, while a later invocation receives a fresh request scope.
-    const requestScope = {};
+    const hostAccessSignal = limits.dispatchController
+        ? AbortSignal.any([limits.dispatchController.signal, ...(limits.signal ? [limits.signal] : [])])
+        : limits.signal;
     const catalog = new CatalogService(registry, baseUrl, {
         requestScope,
+        requestSignal: hostAccessSignal,
         // A program that just missed an address cannot call search_tools.
         searchRoute: "connecta.search",
         concurrency: limits.discoveryConcurrency,
         probeTimeoutMs: limits.probeTimeoutMs,
         defer: limits.defer,
-        approval: limits.approval,
     });
     const invocation = new InvocationService(registry, catalog, activity);
     const maxHostCalls = Math.max(1, Math.trunc(limits.maxHostCalls ?? EXECUTE_MAX_HOST_CALLS));
     const hostCallTimeoutMs = Math.max(1, Math.trunc(limits.hostCallTimeoutMs ?? EXECUTE_HOST_CALL_TIMEOUT_MS));
-    const failureSecret = guestFailureSecret();
-    const { signal, diagnostics, exemptWrites } = limits;
-    let hostCalls = 0;
-    // L4/M7: discovery and invocation spend the same budget, on entry; emit
-    // does not.
-    const spendHostCall = Effect.suspend(() => ++hostCalls > maxHostCalls
-        ? Effect.fail(guestFailure("budget_exceeded", `execute_code host-call budget exceeded (${maxHostCalls} calls maximum)`))
-        : Effect.void);
-    const approval = limits.approval ?? NO_EXEMPTIONS;
+    const { signal, diagnostics, programWrites } = limits;
+    const hostCalls = limits.hostCalls ?? { attempted: 0, admitted: 0, succeeded: 0, failed: 0 };
+    let budgetFailure;
+    let emitAttempts = 0;
+    const maxEmitAttempts = Math.max(EXECUTE_MAX_EMITTED_BLOCKS, limits.emitCollector?.maxBlocks ?? EXECUTE_MAX_EMITTED_BLOCKS) * 4;
+    // A rejected bridge promise is catchable in both sandboxes. End the host
+    // run instead and leave that bridge pending: an awaiting guest cannot catch
+    // the refusal and loop. Later calls, including emit, lose host access too.
+    const stopped = new Promise((_resolve, reject) => {
+        const ended = () => reject(new Error("The host run ended."));
+        if (signal?.aborted)
+            ended();
+        else
+            signal?.addEventListener("abort", ended, { once: true });
+    });
+    // Stay pending until the lease has disposed the sandbox, then settle the
+    // abandoned host RPC waits without retaining request resources forever.
+    stopped.catch(() => { });
     const maxWrites = resolveBudget(limits.maxWrites, DEFAULT_MAX_WRITES);
     let writes = 0;
-    /**
-     * The write gate covers exactly the config-exempt calls (#566): each spends
-     * the write budget and is tracked until it settles (`ExemptWrites`), so the
-     * play can wait for it rather than abort it. Every other write keeps E4's
-     * refusal, ahead of validation, so the host's prompt on
-     * call_destructive_tool stays the only approval there is.
-     */
-    const invocationContext = (sending) => ({
+    /** Budget and account for writes admitted by the pool trust decision. */
+    const invocationContext = (sending, timeoutMs) => ({
         source: "execute_code",
-        timeoutMs: hostCallTimeoutMs,
+        sentSecrets,
+        timeoutMs,
         ...(signal !== undefined ? { requestSignal: signal } : {}),
+        ...(limits.dispatchController ? { dispatchSignal: limits.dispatchController.signal } : {}),
         unwrapResult: true,
-        gates: (target) => isApprovalExempt(approval, target.connector, target.toolName, target.definition),
-        writeGate: (target) => Effect.sync(() => {
-            if (exemptWrites?.isClosed) {
+        trust: limits.trust,
+        beforeWrite: (target) => Effect.sync(() => {
+            if (programWrites?.isClosed) {
                 return {
                     kind: "refuse",
                     error: {
@@ -357,23 +352,53 @@ function sandboxProvider(registry, baseUrl, activity, limits) {
                 };
             }
             writes++;
-            if (exemptWrites)
-                sending.settle = exemptWrites.begin();
+            if (programWrites)
+                sending.settle = programWrites.begin();
             return { kind: "dispatch" };
         }),
     });
     // A call brings its own cancellation: the invocation pipeline reads the
     // run's signal, refuses a call that starts after it, and records the
     // cancelled attempt in activity like any other outcome.
-    const call = (address, args) => Effect.gen(function* () {
-        yield* spendHostCall;
-        // An exempt write settles here — unknown if the call never returned an
+    const call = (address, args, options) => Effect.gen(function* () {
+        let timeout;
+        if (address !== null && typeof address === "object" && !Array.isArray(address)) {
+            const request = address;
+            if (args !== undefined ||
+                options !== undefined ||
+                Object.keys(request).some((key) => !["address", "args", "timeoutMs"].includes(key))) {
+                return yield* Effect.fail(guestFailure("invalid_args", CALL_SIGNATURE));
+            }
+            address = request.address;
+            args = request.args;
+            timeout = request.timeoutMs;
+        }
+        else if (options !== undefined) {
+            if (!options ||
+                typeof options !== "object" ||
+                Array.isArray(options) ||
+                Object.keys(options).some((key) => key !== "timeoutMs")) {
+                return yield* Effect.fail(guestFailure("invalid_args", CALL_SIGNATURE));
+            }
+            timeout = options.timeoutMs;
+        }
+        if (typeof address !== "string" ||
+            (timeout !== undefined && (typeof timeout !== "number" || !Number.isSafeInteger(timeout) || timeout < 1))) {
+            return yield* Effect.fail(guestFailure("invalid_args", CALL_SIGNATURE));
+        }
+        const requestedMs = normalizeTimeoutMs(timeout) ??
+            normalizeTimeoutMs(limits.defaultToolTimeoutMs) ??
+            hostCallTimeoutMs;
+        const timeoutMs = Math.min(requestedMs, Math.max(1, (limits.programDeadlineAt ?? Infinity) - Date.now()));
+        // A trusted-pool write settles here — unknown if the call never returned an
         // outcome.
         const sending = {};
-        const outcome = yield* invocation.pipeline(String(address), args ?? {}, invocationContext(sending)).pipe(Effect.onExit((exit) => Effect.sync(() => sending.settle?.(Exit.isSuccess(exit) ? writeStateOf(exit.value) : "unknown"))));
+        const outcome = yield* invocation
+            .pipeline(address, sentSecrets.redact(args ?? {}), invocationContext(sending, timeoutMs))
+            .pipe(Effect.onExit((exit) => Effect.sync(() => sending.settle?.(Exit.isSuccess(exit) ? writeStateOf(exit.value) : "unknown"))));
         diagnostics?.recordCall(outcome);
         return outcome.ok
-            ? outcome.value
+            ? { data: outcome.value, format: outcome.format }
             : yield* Effect.fail(new InvocationFailure(outcome.error));
     });
     // Discovery gets the same treatment from here (L2): once the run has
@@ -386,21 +411,71 @@ function sandboxProvider(registry, baseUrl, activity, limits) {
         const cancelled = () => guestFailure("cancelled", `connecta.${operation} was cancelled because the run ended.`);
         const reading = Effect.tryPromise({
             try: read,
-            catch: (err) => err instanceof DiscoveryPolicyError
-                ? guestFailure(err.code, err.message)
-                : err,
+            catch: (err) => (err instanceof DiscoveryPolicyError ? guestFailure(err.code, err.message) : err),
         });
-        return spendHostCall.pipe(Effect.andThen(!signal
+        return (!hostAccessSignal
             ? reading
-            : signal.aborted
+            : hostAccessSignal.aborted
                 ? Effect.fail(cancelled())
-                : Effect.raceAllFirst([
-                    reading,
-                    fromSignal(signal).pipe(Effect.mapError(cancelled)),
-                ])), Effect.onExit((exit) => Effect.sync(() => diagnostics?.recordCatalog(operation, Date.now() - started, Exit.isSuccess(exit), Exit.isSuccess(exit) ? exit.value : undefined))));
+                : Effect.raceAllFirst([reading, fromSignal(hostAccessSignal).pipe(Effect.mapError(cancelled))])).pipe(Effect.onExit((exit) => Effect.sync(() => diagnostics?.recordCatalog(operation, Date.now() - started, Exit.isSuccess(exit), Exit.isSuccess(exit) ? exit.value : undefined))));
     });
+    const meta = createMetaTools(registry, baseUrl, { trust: limits.trust, requestScope });
     const operations = {
         call,
+        result: (id, options, signal) => Effect.tryPromise({
+            try: async () => {
+                if (typeof id !== "string" ||
+                    (!options && options !== undefined) ||
+                    (options !== undefined && (typeof options !== "object" || Array.isArray(options)))) {
+                    throw guestFailure("invalid_args", "Use connecta.result(id, { offset?, maxBytes? }).");
+                }
+                const args = (options ?? {});
+                if (Object.keys(args).some((key) => !["offset", "maxBytes"].includes(key)) ||
+                    (args.offset !== undefined &&
+                        (typeof args.offset !== "number" || !Number.isSafeInteger(args.offset) || args.offset < 0)) ||
+                    (args.maxBytes !== undefined &&
+                        (typeof args.maxBytes !== "number" || !Number.isSafeInteger(args.maxBytes) || args.maxBytes < 1))) {
+                    throw guestFailure("invalid_args", "Use connecta.result(id, { offset?, maxBytes? }) with whole byte offsets >= 0 and maxBytes >= 1.");
+                }
+                const page = await meta.readResult({ id, ...args }, { signal: signal });
+                if (page.isError)
+                    throw new InvocationFailure((page.structuredContent?.error ?? {
+                        code: "not_found",
+                        message: page.content[0]?.text ?? "Result unavailable.",
+                        retryable: false,
+                    }));
+                return page.structuredContent;
+            },
+            catch: (err) => err,
+        }),
+        skill: (name, _options, utilitySignal) => Effect.tryPromise({
+            try: async () => {
+                if (typeof name !== "string")
+                    throw guestFailure("invalid_args", "Use connecta.skill(name) with an exact skill name.");
+                const skills = new SkillsRegistry(registry, baseUrl, {
+                    requestScope,
+                    requestSignal: utilitySignal ?? hostAccessSignal,
+                    probeTimeoutMs: limits.probeTimeoutMs,
+                    defer: limits.defer,
+                });
+                return { name, format: "text", text: await skills.text(name) };
+            },
+            catch: (err) => err instanceof ConnectorCallError ? guestFailure(err.code, err.message, err.code === "unavailable") : err,
+        }),
+        read: (uri) => Effect.suspend(() => {
+            const started = Date.now();
+            let connectorMs = 0;
+            return readResource(registry, uri, {
+                baseUrl,
+                requestScope,
+                sentSecrets,
+                timeoutMs: hostCallTimeoutMs,
+                onConnectorTime: (elapsed) => {
+                    connectorMs += elapsed;
+                },
+                ...(hostAccessSignal ? { signal: hostAccessSignal } : {}),
+            }).pipe(Effect.onExit((exit) => Effect.sync(() => diagnostics?.recordRead(Date.now() - started, connectorMs, Exit.isSuccess(exit), Exit.isSuccess(exit) ? exit.value : undefined))));
+        }),
         // Emission is a provider function, never an ExecuteResult field —
         // that is what keeps the Executor contract untouched and parity
         // structural (M8). It spends no host-call budget (M7); its own
@@ -410,7 +485,7 @@ function sandboxProvider(registry, baseUrl, activity, limits) {
                 if (!limits.emitCollector) {
                     throw guestFailure("unavailable", "connecta.emit is unavailable: no emission collector was configured for this execution", true);
                 }
-                limits.emitCollector.accept(block);
+                limits.emitCollector.accept(sentSecrets.redact(block));
             },
             catch: (err) => err,
         }),
@@ -418,6 +493,7 @@ function sandboxProvider(registry, baseUrl, activity, limits) {
             const args = (raw ?? {});
             const result = flatSearchResult(await catalog.search({
                 ...args,
+                includeSchemas: args.includeSchemas ?? "json",
                 includeSchemaKeys: args.includeSchemaKeys !== false,
             }));
             boundedDiscoveryText(result, "Request a smaller limit, omit fullDescriptions, use compact schemas, or pass includeSchemaKeys: false.");
@@ -425,30 +501,90 @@ function sandboxProvider(registry, baseUrl, activity, limits) {
         }),
         describe: (raw) => discovery("describe", async () => {
             const args = (raw ?? {});
-            const result = { tools: await catalog.describe(args) };
+            const result = { tools: await catalog.describe({ ...args, format: args.format ?? "json" }) };
             boundedDiscoveryText(result, 'Split the address list or use format: "compact".');
             return result;
         }),
     };
-    // Every failure leaves through the same frame, so the prelude can rebuild
-    // a typed error however the host call failed — refused, over budget, or
-    // cancelled. Anything that is not an InvocationFailure crosses unchanged.
-    const framed = (err) => Effect.suspend(() => {
+    // Recoverable failures remain typed at the host-owned executor bridge. Terminal host-budget exhaustion bypasses it.
+    // Anything that is not an InvocationFailure crosses unchanged.
+    const typedFailure = (err) => Effect.suspend(() => {
         if (!(err instanceof InvocationFailure))
             return Effect.fail(err);
-        const failure = boundedGuestFailure(err);
-        const frame = framedGuestFailure(failureSecret, failure);
-        limits.onInvocationFailure?.(failure);
-        return Effect.fail(frame);
+        const failure = boundedGuestFailure(sentSecrets.redact(err));
+        return Effect.fail(failure);
     });
     return {
         name: "connecta",
         // Trusted host code the program runs after and cannot undo.
-        prelude: guestErrorPrelude(failureSecret),
+        prelude: guestPrelude(),
         fns: Object.fromEntries(Object.entries(operations).map(([name, operation]) => [
             name,
             (...args) => {
-                const settled = runEdge(Effect.suspend(() => operation(...args)).pipe(Effect.catch(framed)));
+                if (budgetFailure)
+                    return stopped;
+                // Invalid emits still allocate guest promises and typed rejections.
+                // Bound those attempts without consuming the invocation budget or discarding identities.
+                if (name === "emit" && ++emitAttempts > maxEmitAttempts) {
+                    budgetFailure = guestFailure("budget_exceeded", `execute_code emission-attempt budget exceeded (${maxEmitAttempts} attempts maximum).`);
+                    programWrites?.close();
+                    limits.dispatchController?.abort();
+                    limits.onHostCallBudgetExceeded?.(budgetFailure);
+                    return stopped;
+                }
+                // L4/M7: spend on entry, before even invalid arguments are checked;
+                // emit has a separate budget and never spends this one.
+                const counted = name !== "emit";
+                if (counted && ++hostCalls.attempted > maxHostCalls) {
+                    hostCalls.failed++;
+                    budgetFailure = new HostCallBudgetExceeded(hostCalls, maxHostCalls);
+                    programWrites?.close();
+                    limits.dispatchController?.abort();
+                    limits.onHostCallBudgetExceeded?.(budgetFailure);
+                    return stopped;
+                }
+                if (counted)
+                    hostCalls.admitted++;
+                const started = Date.now();
+                const utility = name === "result" || name === "skill";
+                const invoke = Effect.suspend(() => operation(...args));
+                const guarded = utility
+                    ? withDeadlineEffect((utilitySignal) => Effect.suspend(() => operation(args[0], args[1], utilitySignal)), {
+                        timeoutMs: hostCallTimeoutMs,
+                        ...(hostAccessSignal ? { signal: hostAccessSignal } : {}),
+                        timeoutError: guestFailure("timeout", `connecta.${name} timed out.`),
+                    })
+                    : invoke;
+                const settled = runEdge(guarded.pipe(Effect.catch((error) => {
+                    if (utility && hostAccessSignal?.aborted)
+                        return typedFailure(guestFailure("cancelled", `connecta.${name} was cancelled because the run ended.`));
+                    if (utility && error instanceof InvocationFailure && error.code === "timeout") {
+                        const elapsedMs = Date.now() - started;
+                        const message = `Operation "connecta.${name}" timed out during ${name === "result" ? "result storage" : "skill lookup"} after ${elapsedMs}ms (effective deadline ${hostCallTimeoutMs}ms).`;
+                        return typedFailure(new InvocationFailure({
+                            code: "timeout",
+                            message,
+                            retryable: true,
+                            details: {
+                                operation: `connecta.${name}`,
+                                stage: name === "result" ? "result storage" : "skill lookup",
+                                elapsedMs,
+                                deadlineMs: hostCallTimeoutMs,
+                            },
+                        }));
+                    }
+                    return typedFailure(error);
+                }))).then((value) => {
+                    if (counted)
+                        hostCalls.succeeded++;
+                    return budgetFailure ? stopped : redactAgentOutput(sentSecrets, value);
+                }, (err) => {
+                    if (counted)
+                        hostCalls.failed++;
+                    if (budgetFailure)
+                        return stopped;
+                    throw redactAgentOutput(sentSecrets, err);
+                });
                 // The executor owns this promise, and a program may abandon a call
                 // that the run's end then cancels before anyone has awaited it.
                 // The rejection is still there for whoever does; it is just not an
@@ -476,11 +612,12 @@ function sandboxProvider(registry, baseUrl, activity, limits) {
  * ceiling as an untyped executor failure naming the key that sets it. Either
  * way the handler returns and releases the lease, and the abandoned call
  * keeps whatever it was doing: the QuickJS lease release recycles its child,
- * a Dynamic Worker isolate runs on to its own deadline, and a lease granted
- * after its request gave up goes to `late`. The result contract is untouched
+ * the Worker adapter disposes its handles without waiting for the guest. A
+ * lease granted after its request gave up goes to `late`. The result contract is untouched
  * — this only decides when to stop waiting for one.
  */
 function awaitExecutor(start, signal, options = {}) {
+    const started = Date.now();
     const contenders = [
         Effect.suspend(() => {
             let pending;
@@ -501,12 +638,21 @@ function awaitExecutor(start, signal, options = {}) {
         // which the executor's promise chain can still lose to.)
         fromSignal(signal).pipe(Effect.catch(() => Effect.sleep(Duration.millis(1))), Effect.andThen(Effect.fail(new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled.")))),
     ];
+    if (options.terminal)
+        contenders.push(options.terminal);
     const { watchdog } = options;
     if (watchdog) {
         contenders.push(Effect.sleep(Duration.millis(watchdog.ms)).pipe(Effect.andThen(Effect.suspend(() => {
-            watchdog.logger.warn("[connecta] execute_code executor did not settle; run abandoned", { watchdogMs: watchdog.ms });
-            return Effect.fail(new Error(`sandbox unresponsive: no outcome within the ${watchdog.ms}ms ` +
-                "execute.watchdogMs ceiling, so the run was abandoned"));
+            watchdog.logger.warn("[connecta] execute_code executor did not settle; run abandoned", {
+                watchdogMs: watchdog.ms,
+            });
+            const elapsedMs = Date.now() - started;
+            return Effect.fail(new InvocationFailure({
+                code: "timeout",
+                message: `Operation "execute_code" timed out during sandbox watchdog after ${elapsedMs}ms (effective deadline ${watchdog.ms}ms); sandbox unresponsive.`,
+                retryable: false,
+                details: { operation: "execute_code", stage: "sandbox watchdog", elapsedMs, deadlineMs: watchdog.ms },
+            }));
         }))));
     }
     return Effect.raceAllFirst(contenders);
@@ -540,44 +686,39 @@ function runSignal(caller) {
  * which workerd refuses for any I/O. Awaiting the promise resumes it here.
  */
 function leased(executor, signal) {
-    return Effect.acquireRelease(awaitExecutor(() => executor.acquire({ signal }), signal, {
+    return Effect.acquireRelease(awaitExecutor(() => executor.acquire({ signal, wait: true }), signal, {
         late: (lease) => lease.release(),
     }), (lease) => Effect.sync(() => lease.release()));
 }
-/** Room for the executor queue a run waits in before its watchdog starts. */
-const RUN_CLAIM_SLACK_MS = 10_000;
-/**
- * How long one run may take before whoever claimed it may give up on it: the
- * watchdog, one more host-call deadline for an exempt write the play drains,
- * and queue slack. Artifact refresh leases its claim for this long.
- */
-export function runClaimMs(config) {
-    return resolveBudget(config.watchdogMs, EXECUTE_WATCHDOG_MS) +
-        resolveBudget(config.hostCallTimeoutMs, EXECUTE_HOST_CALL_TIMEOUT_MS) +
-        RUN_CLAIM_SLACK_MS;
-}
-/** The execute_code handler. Exported for direct testing and artifact refresh. */
+/** The execute_code handler. Exported for direct testing. */
 export function createExecuteTool(registry, baseUrl, executor, logger, activity, config = {}) {
     const watchdog = {
         ms: resolveBudget(config.watchdogMs, EXECUTE_WATCHDOG_MS),
         logger,
     };
     const hostCallTimeoutMs = resolveBudget(config.hostCallTimeoutMs, EXECUTE_HOST_CALL_TIMEOUT_MS);
-    const play = (program, diagnosticsRequested, callerSignal) => Effect.suspend(() => {
-        const diagnostics = diagnosticsRequested
-            ? new ExecuteDiagnostics()
-            : undefined;
+    const play = (program, diagnosticsRequested, callerSignal, requestScope) => Effect.suspend(() => {
+        const sentSecrets = sentSecretsForRequest(requestScope);
+        const diagnostics = diagnosticsRequested ? new ExecuteDiagnostics() : undefined;
         const emitted = new EmitCollector(resolveBudget(config.maxEmittedBytes, EXECUTE_MAX_EMITTED_BYTES), resolveBudget(config.maxEmittedBlocks, EXECUTE_MAX_EMITTED_BLOCKS), diagnostics);
-        const invocationFailures = [];
-        const exemptWrites = new ExemptWrites();
+        const hostCalls = { attempted: 0, admitted: 0, succeeded: 0, failed: 0 };
+        const programWrites = new ProgramWrites();
+        const dispatchController = new AbortController();
+        const terminal = Deferred.makeUnsafe();
+        let budgetFailure;
+        let executorLogs;
         // The run's scope holds its signal and its lease. However the run
         // ends — a result, a thrown executor, the watchdog, cancellation —
         // closing it releases the lease and then aborts the signal, so
         // nothing the run started outlives the request.
         const run = Effect.gen(function* () {
+            // Per-call signals cancel individual fetches, but do not close the
+            // shared transport. Close its scope after the run's signal ends, on
+            // every exit, using the existing bounded cleanup and deferred tail.
+            yield* Effect.addFinalizer(() => Effect.forEach(registry.listConnectors(), (connector) => closeScope(connector, registry.contextFor(connector.id, baseUrl, requestScope), config.defer), { concurrency: "unbounded", discard: true }));
             const signal = yield* runSignal(callerSignal);
             // Admission comes before provider construction: queued calls retain
-            // no catalogs, request scopes, or provider closures.
+            // no catalogs or provider closures.
             let lease;
             if (isAdmittingExecutor(executor)) {
                 lease = yield* timed((elapsed) => {
@@ -594,11 +735,12 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                 if (diagnostics)
                     diagnostics.setupMs = elapsed;
             }, Effect.sync(() => sandboxProvider(registry, baseUrl, activity, {
+                sentSecrets,
                 signal,
-                onInvocationFailure: (failure) => {
-                    invocationFailures.push(failure);
-                    if (invocationFailures.length > 64)
-                        invocationFailures.shift();
+                hostCalls,
+                onHostCallBudgetExceeded: (failure) => {
+                    budgetFailure = failure;
+                    Deferred.doneUnsafe(terminal, Effect.fail(failure));
                 },
                 emitCollector: emitted,
                 ...(diagnostics ? { diagnostics } : {}),
@@ -606,62 +748,105 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                 probeTimeoutMs: config.probeTimeoutMs,
                 maxHostCalls: config.maxHostCalls,
                 hostCallTimeoutMs,
+                defaultToolTimeoutMs: config.defaultToolTimeoutMs,
+                programDeadlineAt: Date.now() + watchdog.ms,
                 defer: config.defer,
-                approval: config.approval,
+                trust: config.trust,
                 maxWrites: config.maxWrites,
-                exemptWrites,
-            })));
+                programWrites,
+                dispatchController,
+            }, requestScope)));
             if (signal.aborted) {
                 return yield* Effect.fail(new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled during sandbox setup."));
             }
             const admitted = lease;
-            // An exempt write may still be on the wire when the program settles:
+            // A trusted-pool write may still be on the wire when the program settles:
             // close, so a write gated after this is not sent, then let the ones
             // already dispatched finish before the scope aborts them — an
             // abandoned write would be one whose outcome nobody knows.
             return yield* timed((elapsed) => {
                 if (diagnostics)
                     diagnostics.executorWallMs = elapsed;
-            }, awaitExecutor(() => admitted
-                ? admitted.execute(program, [provider])
-                : executor.execute(program, [provider]), signal, { watchdog }).pipe(Effect.ensuring(Effect.suspend(() => {
-                exemptWrites.close();
-                return exemptWrites.drain();
+            }, awaitExecutor(() => (admitted
+                ? admitted.execute(wrapGuestProgram(program), [provider])
+                : executor.execute(wrapGuestProgram(program), [provider])).then((outcome) => {
+                executorLogs = sentSecrets.redact(outcome?.logs);
+                return sentSecrets.redact(outcome);
+            }, (err) => {
+                if (err !== null && typeof err === "object" && "logs" in err) {
+                    executorLogs = sentSecrets.redact(err.logs);
+                }
+                throw sentSecrets.redact(err);
+            }), signal, { watchdog, terminal: Deferred.await(terminal) }).pipe(Effect.ensuring(Effect.suspend(() => {
+                programWrites.close();
+                dispatchController.abort();
+                return programWrites.drain();
             }))));
         });
-        const reported = { emitted, diagnostics, invocationFailures };
-        return Effect.map(Effect.exit(Effect.scoped(run)), (exit) => {
-            if (Exit.isFailure(exit)) {
-                return exemptWrites.finish(failedRun(Cause.squash(exit.cause), logger, reported));
-            }
-            const finished = finishedRun(exit.value, reported);
-            if (config.failOnInvocationFailure && invocationFailures.length > 0) {
-                const refusal = invocationFailures[0];
-                return failureResponse(refusal.details.message, {
-                    code: refusal.details,
+        const reported = { emitted, diagnostics, program };
+        const exited = Effect.exit(Effect.scoped(run)).pipe(Effect.flatMap((exit) => 
+        // Releasing a QuickJS lease ends its child and rejects execute() with
+        // the retained log prefix. Give that report one timer turn, just as
+        // cancellation does in awaitExecutor; never wait on a Worker isolate.
+        budgetFailure ? Effect.sleep(Duration.millis(1)).pipe(Effect.as(exit)) : Effect.succeed(exit)));
+        return Effect.map(Effect.map(exited, (exit) => {
+            // A synchronous fire-and-forget burst can also settle its executor in
+            // this turn. The host's terminal refusal always wins over that value.
+            if (budgetFailure instanceof HostCallBudgetExceeded) {
+                const failed = failureResponse(budgetFailure.details.message, {
+                    code: budgetFailure.details,
+                    logs: executeLogs(executorLogs),
+                    emitted,
+                    diagnostics,
                 });
+                return failed;
             }
-            return exemptWrites.finish(finished);
-        });
+            if (Exit.isFailure(exit)) {
+                return failedRun(sentSecrets.redact(Cause.squash(exit.cause)), logger, reported);
+            }
+            return finishedRun(sentSecrets.redact(exit.value), reported);
+        }), (unfinished) => {
+            // Every run response passes through write accounting.
+            const response = programWrites.finish(unfinished);
+            // Calls abandoned by the guest are failed when the run cancels them.
+            const counts = { ...hostCalls, failed: hostCalls.attempted - hostCalls.succeeded };
+            response.structuredContent = { ...response.structuredContent, hostCalls: counts };
+            if (response.content[0]?.type === "text")
+                response.content[0].text = JSON.stringify(response.structuredContent);
+            return response;
+        }).pipe(Effect.map((result) => redactAgentOutput(sentSecrets, result)));
     });
-    return ({ code, diagnostics }, options = {}) => {
-        // A code-unit count above the cap is already too large in UTF-8. Check
-        // that first so a huge direct-call string is never encoded in full.
-        if (code.length > EXECUTE_MAX_CODE_BYTES ||
-            new TextEncoder().encode(code).byteLength > EXECUTE_MAX_CODE_BYTES) {
-            const message = `execute_code code exceeds the ${EXECUTE_MAX_CODE_BYTES}-byte UTF-8 limit.`;
-            return Promise.resolve(failureResponse(message, {
-                code: { code: "invalid_args", message, retryable: false },
-            }));
-        }
-        return runEdge(Effect.suspend(() => play(normalizeProgramSource(code), diagnostics, options.signal)));
-    };
+    return agentOutputOperations((requestScope) => ({
+        execute: ({ code, diagnostics }, options = {}) => {
+            // A code-unit count above the cap is already too large in UTF-8. Check
+            // that first so a huge direct-call string is never encoded in full.
+            if (code.length > EXECUTE_MAX_CODE_BYTES ||
+                new TextEncoder().encode(code).byteLength > EXECUTE_MAX_CODE_BYTES) {
+                const message = `execute_code code exceeds the ${EXECUTE_MAX_CODE_BYTES}-byte UTF-8 limit.`;
+                const response = failureResponse(message, { code: { code: "invalid_args", message, retryable: false } });
+                response.structuredContent = {
+                    ...response.structuredContent,
+                    hostCalls: { attempted: 0, admitted: 0, succeeded: 0, failed: 0 },
+                };
+                response.content[0].text = JSON.stringify(response.structuredContent);
+                return Promise.resolve(response);
+            }
+            return runEdge(Effect.suspend(() => play(normalizeProgramSource(code), diagnostics, options.signal, requestScope)));
+        },
+    }), config.requestScope).execute;
 }
 /** An execution that never produced an ExecuteResult, as the model sees it. */
-function failedRun(err, logger, { emitted, diagnostics }) {
-    const logs = err !== null && typeof err === "object" && "logs" in err
-        ? executeLogs(err.logs)
-        : undefined;
+function failedRun(err, logger, { emitted, diagnostics, program }) {
+    const logs = err !== null && typeof err === "object" && "logs" in err ? executeLogs(err.logs) : undefined;
+    if (err instanceof InvocationFailure)
+        return failureResponse(err.details.message, { logs, emitted, diagnostics, code: err.details });
+    if (err instanceof SyntaxError)
+        return failureResponse(err.message, {
+            logs,
+            emitted,
+            diagnostics,
+            code: programError({ name: "SyntaxError", message: err.message }, program),
+        });
     if (err instanceof ExecutorAdmissionError) {
         if (err.code === "executor_overloaded") {
             logger.warn("[connecta] execute_code admission rejected", {
@@ -677,9 +862,7 @@ function failedRun(err, logger, { emitted, diagnostics }) {
                 code: err.code,
                 message: err.message,
                 retryable: err.retryable,
-                ...(err.retryAfterMs !== undefined
-                    ? { retryAfterMs: err.retryAfterMs }
-                    : {}),
+                ...(err.retryAfterMs !== undefined ? { retryAfterMs: err.retryAfterMs } : {}),
             },
         });
     }
@@ -691,7 +874,7 @@ function failedRun(err, logger, { emitted, diagnostics }) {
     });
 }
 /** The response for an ExecuteResult: the program's error or its value. */
-function finishedRun(outcome, { emitted, diagnostics, invocationFailures }) {
+function finishedRun(outcome, { emitted, diagnostics, program }) {
     if (outcome === null || typeof outcome !== "object" || Array.isArray(outcome)) {
         return failureResponse("Executor failed: expected an ExecuteResult object.", {
             emitted,
@@ -709,52 +892,32 @@ function finishedRun(outcome, { emitted, diagnostics, invocationFailures }) {
         });
     }
     if (outcome.error !== undefined) {
-        // Executor bridges necessarily reduce thrown host errors to strings.
-        // Match that terminal string back to the request-local typed failure so
-        // an unhandled tool failure keeps the same structured contract as
-        // call_tool. Failures caught by model code never reach
-        // outcome.error and therefore remain under that code's control.
-        //
-        // An error the program let through unchanged matches exactly, and an
-        // exact match always wins: a program that wrapped one failure's message
-        // around another's must not have the wrong type attached. Containment is
-        // the fallback, so a wrapped message still reports its underlying type
-        // rather than losing it to prose.
-        let invocationFailure;
-        for (const match of [
-            (candidate) => outcome.error !== "" &&
-                [candidate.message, guestFailureFrames.get(candidate)].includes(outcome.error),
-            (candidate) => [candidate.message, guestFailureFrames.get(candidate)].some((message) => 
-            // E6: empty or tiny prose cannot identify a wrapped failure.
-            message !== undefined &&
-                message.length >= 8 &&
-                outcome.error?.includes(message) === true),
-        ]) {
-            for (let i = invocationFailures.length - 1; i >= 0; i--) {
-                const candidate = invocationFailures[i];
-                if (candidate && match(candidate)) {
-                    invocationFailure = candidate;
-                    break;
-                }
-            }
-            if (invocationFailure)
-                break;
-        }
-        if (invocationFailure) {
-            // E1/X11: return the same bounded details the guest received.
-            return failureResponse(invocationFailure.details.message, {
+        const failure = outcome.failure?.call;
+        if (outcome.failure?.timeout) {
+            const { elapsedMs, deadlineMs } = outcome.failure.timeout;
+            const message = `Operation "execute_code" timed out during sandbox after ${elapsedMs}ms (effective deadline ${deadlineMs}ms).`;
+            return failureResponse(message, {
                 logs,
                 emitted,
                 diagnostics,
-                code: invocationFailure.details,
+                code: {
+                    code: "timeout",
+                    message,
+                    retryable: false,
+                    details: { operation: "execute_code", stage: "sandbox", elapsedMs, deadlineMs },
+                },
             });
         }
-        const message = `Error: ${outcome.error || "Execution failed without an error message."}`;
-        return failureResponse(message, {
+        return failureResponse(failure?.message ?? outcome.error, {
             logs,
             emitted,
             diagnostics,
-            code: "executor_failed",
+            code: failure ??
+                programError({
+                    name: outcome.failure?.name ?? /^(SyntaxError|ReferenceError|TypeError|RangeError):/.exec(outcome.error)?.[1],
+                    message: outcome.error || "Execution failed without an error message.",
+                    ...(outcome.failure?.line !== undefined ? { line: outcome.failure.line - 1 } : {}),
+                }, program),
         });
     }
     // A result crossing back as a host BigInt (or otherwise unserializable
@@ -762,7 +925,7 @@ function finishedRun(outcome, { emitted, diagnostics, invocationFailures }) {
     // error path so captured logs survive instead of a raw SDK 500.
     let result;
     try {
-        result = guardExecuteResultValue(outcome.result);
+        result = guardExecuteResultValue(outcome.result, MAX_EXECUTE_RESULT_CHARS - emitted.textChars);
     }
     catch (err) {
         const message = `Error: result is not JSON-serializable: ${msg(err)}`;
@@ -794,33 +957,20 @@ function executeLogs(value) {
 }
 function failureResponse(message, options) {
     const { logs, emitted, diagnostics, code } = options;
-    if (diagnostics || typeof code !== "string") {
-        const result = jsonResult({
-            error: typeof code === "string"
-                ? { code, message, retryable: false }
-                : code,
-            ...(logs ? { logs } : {}),
-            ...(emitted ? discardedEmits(emitted) : {}),
-            ...(diagnostics ? { diagnostics: diagnostics.finish() } : {}),
-        });
-        result.isError = true;
-        return result;
-    }
-    return errorResult(`${message}${logs ? `\n\nLogs:\n${logs}` : ""}${emitted ? discardedEmitsText(emitted) : ""}`);
+    const result = jsonResult({
+        error: typeof code === "string" ? { code, message, retryable: false } : code,
+        ...(logs ? { logs } : {}),
+        ...(emitted ? discardedEmits(emitted) : {}),
+        ...(diagnostics ? { diagnostics: diagnostics.finish() } : {}),
+    });
+    result.isError = true;
+    return result;
 }
 /**
  * A failed program delivers no blocks and reports how many were discarded.
  */
 function discardedEmits(emitted) {
-    return emitted.blocks.length > 0
-        ? { emittedDiscarded: emitted.blocks.length }
-        : {};
-}
-/** The same visibility for the plain-text error paths. */
-function discardedEmitsText(emitted) {
-    return emitted.blocks.length > 0
-        ? `\n\nemittedDiscarded: ${emitted.blocks.length}`
-        : "";
+    return emitted.blocks.length > 0 ? { emittedDiscarded: emitted.blocks.length } : {};
 }
 function connectorInventory(connectors) {
     const prefix = "Connectors: ";
@@ -829,14 +979,10 @@ function connectorInventory(connectors) {
     const entries = connectors.map((connector) => {
         const address = connector.id;
         const title = connector.title?.replace(/\s+/g, " ").trim();
-        const label = title && title !== connector.id
-            ? `${address}: ${boundedEchoText(title, 45)}`
-            : address;
+        const label = title && title !== connector.id ? `${address}: ${boundedEchoText(title, 45)}` : address;
         if (!connectorGuide(connector))
             return label;
-        const requirement = connectorGuideRequired(connector)
-            ? "required guide"
-            : "guide";
+        const requirement = connectorGuideRequired(connector) ? "required guide" : "guide";
         return `${label} (${requirement} ${connectorSkillName(connector.id)})`;
     });
     const shown = [];
@@ -858,29 +1004,26 @@ function connectorInventory(connectors) {
         return `${prefix}${shown.join(", ")}.`;
     return `${prefix}${shown.join(", ")}${shown.length > 0 ? "; " : ""}+${omitted} more.`;
 }
-const executeDescription = (emitBudgets, hostLimits, connectorGuides, connectors, maxWrites) => `Use the configured services below to answer the task. A known address uses call_tool. Unknown-address and wider read-only work uses one execute_code program for discovery, calls, and reduction. Do not return catalog matches alone. Only readOnlyHint: true tools and config-exempt writes are available; any other write goes through call_destructive_tool. Limits: ${hostLimits.maxHostCalls} host calls, ${maxWrites} exempt writes, ${hostLimits.hostCallTimeoutMs / 1_000}s/host call.
-
+const executeDescription = (emitBudgets, hostLimits, connectorGuides, connectors, maxWrites, trust) => `One known read: call_tool. One known write: call_destructive_tool. Everything else: execute_code. ${trust === "trusted" ? "Trusted pool: programs may read and write; the host approves the program as a write." : "Read-only pool: programs read; writes use call_destructive_tool."} Limits: ${hostLimits.maxHostCalls} host calls, ${maxWrites} writes, ${hostLimits.hostCallTimeoutMs / 1_000}s/host call.
 ${connectorInventory(connectors)}
 
-Read guides with top-level skills. Write async () => { ... } using the global connecta:
-- connecta.search({ connector, query, safety: "readOnly", includeSchemas: "json" }) returns { tools }. Search operations separately; choose by connectorTitle and schema.required/.properties, never guessed fields. Compact schemas are text.
-- connecta.describe({ address }) clarifies schemas.
-- connecta.call(address, args) returns the provider value directly.
-- Use Promise.all for independent calls, or Promise.allSettled to retain failures. Check status; missing values are unknown, never false or zero.
-- connecta.emit(block): { type: "text", text } or { type: "image" | "audio", data (base64), mimeType }; success-only, ${emitBudgets.maxBlocks} blocks/${emitBudgets.maxBytes} bytes. console.log(...) is captured.
+Use async () => { ... }, no arguments, with the connecta global. No portable ambient capabilities. API notation:
+\`\`\`ts
+declare const connecta: {
+${GUEST_API_DECLARATION}
+};
+\`\`\`
+Discovery: { tools }; check search catalogErrors/absence. JSON schemas default; compact is text. GuestResult is { data, format: "json" | "text" }; inspect format before fields. Pages: text, hasMore, nextOffset in UTF-8 bytes. Promise.allSettled keeps typed failures. Host-call budget_exceeded is terminal, even through catch/allSettled. Runs report hostCalls.
 
-No portable ambient capabilities. Return reduced JSON. Sample unfamiliar reads. Reduce a one-time write's full result here, or use a direct call and get_result paging; never repeat it to recover output. Never guess fields or use the whole text as an id. Top-level skills({ name: "usage" }): repair${connectorGuides ? ", guide handling" : ""}; skills({ name: "investigate" }): task planning.`;
-// Module scope, like the other six meta-tool inputs: its JSON Schema is
+Reduce JSON. Never repeat writes for output. emit: text or base64 image/audio, safe without await, ${emitBudgets.maxBlocks} blocks/${emitBudgets.maxBytes} bytes. Text shares the result cap. skills({ name: "investigate" }): workflow; skills({ name: "usage" }): repair${connectorGuides ? ", guide handling" : ""}.`;
+// Module scope, like the other five meta-tool inputs: its JSON Schema is
 // derived once per process. Budgets and connectors vary by deployment and
 // view, so they live in the description, never here.
 const EXECUTE_INPUT = advertisedSchema(z.object({
     code: z
         .string()
         .describe("One complete zero-argument JavaScript async arrow: async () => { ... }. Use the provided connecta global to discover, call, and return the reduced answer. At most 65,536 UTF-8 bytes."),
-    diagnostics: z
-        .boolean()
-        .optional()
-        .describe("Add request-local, payload-free timing and result-size summaries."),
+    diagnostics: z.boolean().optional().describe("Add request-local, payload-free timing and result-size summaries."),
 }));
 /** Register the execute_code meta-tool. Only called when an executor is configured. */
 export function registerExecuteTool(server, registry, ctx) {
@@ -899,6 +1042,7 @@ export function registerExecuteTool(server, registry, ctx) {
     const connectors = registry.listConnectors();
     const maxWrites = resolveBudget(ctx.maxWrites, DEFAULT_MAX_WRITES);
     const execute = createExecuteTool(registry, ctx.baseUrl, ctx.executor, ctx.logger, ctx.activity, {
+        defaultToolTimeoutMs: ctx.defaultToolTimeoutMs,
         discoveryConcurrency: ctx.discoveryConcurrency,
         probeTimeoutMs: ctx.probeTimeoutMs,
         maxEmittedBytes: emitBudgets.maxBytes,
@@ -907,25 +1051,29 @@ export function registerExecuteTool(server, registry, ctx) {
         hostCallTimeoutMs: hostLimits.hostCallTimeoutMs,
         watchdogMs: ctx.watchdogMs,
         defer: ctx.defer,
-        approval: ctx.approval,
+        trust: ctx.trust,
         maxWrites,
+        requestScope: ctx.requestScope,
     });
     server.registerTool("execute_code", {
-        description: executeDescription(emitBudgets, hostLimits, hasConnectorGuides(connectors), connectors, maxWrites),
+        description: executeDescription(emitBudgets, {
+            ...hostLimits,
+            hostCallTimeoutMs: normalizeTimeoutMs(ctx.defaultToolTimeoutMs) ?? hostLimits.hostCallTimeoutMs,
+        }, hasConnectorGuides(connectors), connectors, maxWrites, ctx.trust ?? "read-only"),
         inputSchema: EXECUTE_INPUT,
-        // This hint describes connector calls: only explicitly read-only ones
-        // run here, plus the writes config exempts from asking (W12) — the
-        // deployment's decision, which no annotation can make for it. Any
-        // other write is refused (E4) and crosses call_destructive_tool, which
-        // is annotated destructive. The supported executor constructions deny
-        // outbound access, filesystem, and deployment config; X5 documents
-        // Dynamic runtime modules separately.
+        outputSchema: EXECUTE_OUTPUT,
+        // The host sees execute_code as a write only on a trusted endpoint.
         annotations: {
-            readOnlyHint: true,
-            destructiveHint: false,
+            readOnlyHint: ctx.trust !== "trusted",
+            destructiveHint: ctx.trust === "trusted",
             openWorldHint: true,
         },
-    }, (args, extra) => underAnySignal([extra.mcpReq.signal, ctx.requestSignal], (signal) => execute(args, {
-        signal,
-    })));
+    }, (args, extra) => {
+        if (ctx.client)
+            bindMcpClient(extra, ctx.client, ctx.activity);
+        const run = () => underAnySignal([extra.mcpReq.signal, ctx.requestSignal], (signal) => execute(args, {
+            signal,
+        }));
+        return ctx.authElicitation ? ctx.authElicitation.run("execute_code", args, extra, run) : run();
+    });
 }