@zackbart/connecta 0.28.1 → 0.30.0

package/dist/execute.js

@@ -1,21 +1,29 @@
-import { Cause, Duration, Effect, Exit } from "effect";
+import { GUEST_API_DECLARATION } from "./usage-guide.js";
+import { bindMcpClient } from "./mcp-client-context.js";
+import { CONFIG_DEFAULTS } from "./config-defaults.js";
+import { Cause, Deferred, Duration, Effect, Exit } from "effect";
 import { z } from "zod";
 import { advertisedSchema } from "./advertised-schema.js";
 import { boundedDiscoveryText, CatalogService, DiscoveryPolicyError, flatSearchResult, } from "./catalog-service.js";
-import { errorResult, jsonResult } from "./meta-tools.js";
-import { guardExecuteResultValue, MAX_EXECUTE_LOG_CHARS, truncateExecuteText, } from "./executor-result.js";
-import { ExecutorAdmissionError, ExecutorExecutionError, isAdmittingExecutor, } from "./executor-admission.js";
-import { boundedEchoText, msg } from "./errors.js";
-import { DEFAULT_MAX_WRITES, ExemptWrites, writeStateOf, } from "./exempt-writes.js";
-import { InvocationFailure, InvocationService, timed, } from "./invocation.js";
+import { createMetaTools, guardProgramReturn, jsonResult, pageProgramResult, } from "./meta-tools.js";
+import { PROGRAM_RESULT_INLINE_BYTES, PROGRAM_RESULT_PAGE_BYTES, PROGRAM_RESULT_WIRE_BYTES, } from "./program-result.js";
+import { MAX_EXECUTE_LOG_CHARS, MAX_EXECUTE_RESULT_CHARS, truncateExecuteText } from "./executor-result.js";
+import { ExecutorAdmissionError, ExecutorExecutionError, isAdmittingExecutor } from "./executor-admission.js";
+import { boundedEchoText, ConnectorCallError, msg } from "./errors.js";
+import { DEFAULT_MAX_WRITES, ProgramWrites, writeStateOf } from "./program-writes.js";
+import { InvocationFailure, InvocationService, timed } from "./invocation.js";
+import { guestPrelude, programError, wrapGuestProgram } from "./guest-runtime.js";
+import { EXECUTE_OUTPUT } from "./meta-output.js";
 import { normalizeProgramSource } from "./program-source.js";
-import { underAnySignal } from "./timeout.js";
-import { isApprovalExempt, NO_EXEMPTIONS, } from "./tool-safety.js";
-import { fromSignal, runEdge } from "./runtime/run.js";
-import { connectorGuide, connectorGuideRequired, connectorSkillName, hasConnectorGuides, } from "./skills.js";
+import { readResource } from "./resource-read.js";
+import { agentOutputOperations, redactAgentOutput, sentSecretsForRequest } from "./sent-secrets.js";
+import { normalizeTimeoutMs, underAnySignal } from "./timeout.js";
+import { fromSignal, runEdge, withDeadlineEffect } from "./runtime/run.js";
+import { closeScope } from "./runtime/connector-scope.js";
+import { connectorGuide, connectorGuideRequired, connectorSkillName, hasConnectorGuides, SkillsRegistry, } from "./skills.js";
 /** Keep one model-written program from amplifying into an unbounded fan-out. */
-const EXECUTE_MAX_HOST_CALLS = 20;
-const EXECUTE_HOST_CALL_TIMEOUT_MS = 15_000;
+const EXECUTE_MAX_HOST_CALLS = CONFIG_DEFAULTS.execute.maxHostCalls;
+const EXECUTE_HOST_CALL_TIMEOUT_MS = CONFIG_DEFAULTS.execute.hostCallTimeoutMs;
 /** Above every program in the recorded evals, below the QuickJS IPC ceiling. */
 const EXECUTE_MAX_CODE_BYTES = 64 * 1024;
 /**
@@ -24,7 +32,7 @@ const EXECUTE_MAX_CODE_BYTES = 64 * 1024;
  * always reports its own timeout first and this fires only for one that
  * never settles at all.
  */
-const EXECUTE_WATCHDOG_MS = 120_000;
+const EXECUTE_WATCHDOG_MS = CONFIG_DEFAULTS.execute.watchdogMs;
 /** Complete entries plus an exact omission count, all inside this byte cap. */
 export const CONNECTOR_INVENTORY_MAX_BYTES = 256;
 /**
@@ -34,8 +42,9 @@ export const CONNECTOR_INVENTORY_MAX_BYTES = 256;
  * two or three real screenshots after base64's 4/3 inflation, well short of a
  * file-hosting ambition (design record M5).
  */
-export const EXECUTE_MAX_EMITTED_BYTES = 4_000_000;
-export const EXECUTE_MAX_EMITTED_BLOCKS = 32;
+export const EXECUTE_MAX_EMITTED_BYTES = CONFIG_DEFAULTS.execute.maxEmittedBytes;
+export const EXECUTE_MAX_EMITTED_BLOCKS = CONFIG_DEFAULTS.execute.maxEmittedBlocks;
+const CALL_SIGNATURE = "Use connecta.call(address, args?, { timeoutMs? }) or connecta.call({ address, args?, timeoutMs? }). address must be a canonical connector.tool string.";
 const diagnosticsEncoder = new TextEncoder();
 class ExecuteDiagnostics {
     started = Date.now();
@@ -85,6 +94,15 @@ class ExecuteDiagnostics {
         stats.catalogMs += outcome.timing.catalogMs;
         stats.connectorMs += outcome.timing.connectorMs;
     }
+    recordRead(durationMs, connectorMs, ok, value) {
+        const stats = this.stats("read");
+        stats.count++;
+        stats.failures += ok ? 0 : 1;
+        stats.durationMs += durationMs;
+        stats.connectorMs += connectorMs;
+        if (ok)
+            stats.resultBytes += serializedDiagnosticBytes(value);
+    }
     finish() {
         const operations = [...this.operations.values()];
         return {
@@ -101,6 +119,10 @@ class ExecuteDiagnostics {
         };
     }
 }
+/**
+ * Guest-authored blocks exclude pointers (INV-3). Native call blocks are
+ * retained on the host and forwarded only through request-local references.
+ */
 const EMIT_SHAPE_HINT = '{ type: "text", text } or { type: "image" | "audio", data (base64), mimeType }';
 /**
  * Strict M1 validation: required fields present and string-valued, nothing
@@ -130,6 +152,19 @@ function requireEmittedBlock(raw) {
     if (extra.length > 0) {
         throw guestFailure("invalid_args", `connecta.emit block carries unsupported field(s) ${extra.map((key) => JSON.stringify(key)).join(", ")}; a "${String(block.type)}" block is exactly { ${fields.join(", ")} }`);
     }
+    if (block.type === "image") {
+        if (!["image/png", "image/jpeg", "image/gif", "image/webp"].includes(block.mimeType)) {
+            throw guestFailure("invalid_args", "connecta.emit image mimeType must be image/png, image/jpeg, image/gif, or image/webp.");
+        }
+        const data = block.data;
+        // RFC 4648 alphabet, complete quads and canonical padding, including zero
+        // pad bits. Decode only the last quad; validation does not copy the image.
+        if (!data.length ||
+            !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(data) ||
+            btoa(atob(data.slice(-4))) !== data.slice(-4)) {
+            throw guestFailure("invalid_args", "connecta.emit image data must be nonempty, strict base64 with canonical padding.");
+        }
+    }
     return raw;
 }
 export class EmitCollector {
@@ -138,38 +173,157 @@ export class EmitCollector {
     diagnostics;
     blocks = [];
     bytes = 0;
+    textChars = 0;
     constructor(maxBytes, maxBlocks, diagnostics) {
         this.maxBytes = maxBytes;
         this.maxBlocks = maxBlocks;
         this.diagnostics = diagnostics;
     }
     accept(raw) {
-        const block = requireEmittedBlock(raw);
-        if (this.blocks.length >= this.maxBlocks) {
-            // M5: distinguish exhausted block slots from the remaining byte budget.
-            throw guestFailure("budget_exceeded", `connecta.emit block-count budget exceeded: ${this.maxBlocks} block(s) maximum, 0 blocks remaining; ${this.maxBytes - this.bytes} of ${this.maxBytes} serialized bytes remaining`);
-        }
-        const size = diagnosticsEncoder.encode(JSON.stringify(block)).byteLength;
-        if (this.bytes + size > this.maxBytes) {
-            throw guestFailure("budget_exceeded", `connecta.emit byte budget exceeded: block is ${size} serialized bytes with ${this.maxBytes - this.bytes} of ${this.maxBytes} remaining`);
+        this.acceptNative([requireEmittedBlock(raw)]);
+    }
+    /** Only the host's retained downstream result may enter this path. */
+    acceptNative(blocks) {
+        let bytes = this.bytes;
+        let textChars = this.textChars;
+        let count = this.blocks.length;
+        for (const block of blocks) {
+            if (count >= this.maxBlocks) {
+                throw guestFailure("budget_exceeded", `connecta.emit block-count budget exceeded: ${this.maxBlocks} block(s) maximum, 0 blocks remaining; ${this.maxBytes - bytes} of ${this.maxBytes} serialized bytes remaining`);
+            }
+            const serialized = JSON.stringify(block);
+            const size = diagnosticsEncoder.encode(serialized).byteLength;
+            if (bytes + size > this.maxBytes) {
+                throw guestFailure("budget_exceeded", `connecta.emit byte budget exceeded: block is ${size} serialized bytes with ${this.maxBytes - bytes} of ${this.maxBytes} remaining`);
+            }
+            textChars += block.type === "text" ? serialized.length : 0;
+            // Embedded resource text shares the result cap too; binary blobs use
+            // the transport budget, just like images and audio.
+            if (block.type === "resource" && "text" in block.resource)
+                textChars += serialized.length;
+            if (textChars > MAX_EXECUTE_RESULT_CHARS - 512) {
+                throw guestFailure("result_too_large", "Emitted text shares the 24,000-character program result limit. Reduce the text before emitting it.");
+            }
+            count++;
+            bytes += size;
         }
-        this.blocks.push(block);
-        this.bytes += size;
+        this.textChars = textChars;
+        this.bytes = bytes;
+        this.blocks.push(...blocks);
         this.diagnostics?.recordEmitted(this.blocks.length, this.bytes);
     }
 }
+/** Bound both JSON size and object amplification before retaining native blocks. */
+class NativePresentationLimit extends Error {
+}
+function boundedNativeValue(value, maxBytes, copy) {
+    let bytes = 0;
+    let nodes = 0;
+    // Empty objects cost only two JSON bytes but much more heap. Derive the
+    // allocation ceiling from the transport budget, with a fixed stack ceiling.
+    const maxNodes = Math.floor(Math.min(maxBytes, PROGRAM_RESULT_INLINE_BYTES) / 32);
+    const active = new Set();
+    const charge = (size) => {
+        bytes += size;
+        if (bytes > maxBytes)
+            throw new NativePresentationLimit();
+    };
+    const string = (text) => {
+        // Count JSON escapes and UTF-8 directly, without allocating a potentially
+        // six-times-larger escaped string or byte buffer just to reject it.
+        if (text.length > maxBytes - bytes)
+            throw new NativePresentationLimit();
+        charge(2);
+        for (let i = 0; i < text.length; i++) {
+            const unit = text.charCodeAt(i);
+            if (unit === 34 || unit === 92 || unit === 8 || unit === 9 || unit === 10 || unit === 12 || unit === 13)
+                charge(2);
+            else if (unit < 32)
+                charge(6);
+            else if (unit < 128)
+                charge(1);
+            else if (unit < 2048)
+                charge(2);
+            else if (unit >= 0xd800 &&
+                unit <= 0xdbff &&
+                text.charCodeAt(i + 1) >= 0xdc00 &&
+                text.charCodeAt(i + 1) <= 0xdfff) {
+                charge(4);
+                i++;
+            }
+            else
+                charge(unit >= 0xd800 && unit <= 0xdfff ? 6 : 3);
+        }
+    };
+    const visit = (item, depth) => {
+        if (++nodes > maxNodes || depth > 64)
+            throw new NativePresentationLimit();
+        if (typeof item === "string") {
+            string(item);
+            return item;
+        }
+        if (item === null || typeof item === "boolean" || typeof item === "number") {
+            charge(JSON.stringify(item).length);
+            return item;
+        }
+        if (typeof item !== "object" || active.has(item))
+            throw new NativePresentationLimit();
+        const array = Array.isArray(item);
+        if (![array ? Array.prototype : Object.prototype, null].includes(Object.getPrototypeOf(item)))
+            throw new NativePresentationLimit();
+        const jsonHook = Object.getOwnPropertyDescriptor(item, "toJSON");
+        if (jsonHook && (!("value" in jsonHook) || typeof jsonHook.value === "function"))
+            throw new NativePresentationLimit();
+        active.add(item);
+        charge(2);
+        if (array) {
+            if (item.length > maxNodes - nodes)
+                throw new NativePresentationLimit();
+            const result = copy ? [] : undefined;
+            for (let i = 0; i < item.length; i++) {
+                if (i)
+                    charge(1);
+                const descriptor = Object.getOwnPropertyDescriptor(item, String(i));
+                if (descriptor && !("value" in descriptor))
+                    throw new NativePresentationLimit();
+                const child = visit(descriptor?.value ?? null, depth + 1);
+                result?.push(child);
+            }
+            active.delete(item);
+            return result;
+        }
+        const result = copy ? {} : undefined;
+        let first = true;
+        for (const key in item) {
+            const descriptor = Object.getOwnPropertyDescriptor(item, key);
+            if (!descriptor?.enumerable)
+                continue;
+            if (!("value" in descriptor))
+                throw new NativePresentationLimit();
+            if (descriptor.value === undefined)
+                continue;
+            if (!first)
+                charge(1);
+            first = false;
+            string(key);
+            charge(1);
+            const child = visit(descriptor.value, depth + 1);
+            if (result)
+                Object.defineProperty(result, key, { value: child, enumerable: true, writable: true, configurable: true });
+        }
+        active.delete(item);
+        return result;
+    };
+    return { value: visit(value, 0), bytes };
+}
 /** A positive whole-number budget, or the default when the value is unusable. */
 function resolveBudget(value, fallback) {
-    return typeof value === "number" && Number.isFinite(value) && value >= 1
-        ? Math.trunc(value)
-        : fallback;
+    return typeof value === "number" && Number.isFinite(value) && value >= 1 ? Math.trunc(value) : fallback;
 }
 function serializedDiagnosticBytes(value) {
     try {
         const text = JSON.stringify(value);
-        return text === undefined
-            ? 0
-            : diagnosticsEncoder.encode(text).byteLength;
+        return text === undefined ? 0 : diagnosticsEncoder.encode(text).byteLength;
     }
     catch {
         // The executor's normal result guard owns the error. Diagnostics must
@@ -180,16 +334,8 @@ function serializedDiagnosticBytes(value) {
 function guestFailure(code, message, retryable = false) {
     return new InvocationFailure({ code, message, retryable });
 }
-const GUEST_FAILURE_FRAME = "\u001econnecta-error:";
-const guestFailureFrames = new WeakMap();
-/** Per-execution secret: guest prose cannot collide with this host frame. */
-function guestFailureSecret() {
-    const words = new Uint32Array(4);
-    crypto.getRandomValues(words);
-    return Array.from(words, (word) => word.toString(16).padStart(8, "0")).join("");
-}
 /**
- * E1/X11: bound the serialized frame, including JSON escapes, before transport.
+ * E1/X11: bound typed host failure metadata, including JSON escapes, before transport.
  * Keep optional recovery whole: clipping an address or echoed args could turn
  * recovery into a different call. Oversized metadata is omitted instead.
  */
@@ -216,67 +362,17 @@ function boundedGuestFailure(failure) {
         code: boundText(failure.details.code, 128),
         message: boundText(failure.details.message, 2_000),
     };
-    // 3,700 plus the prefix and 32-character secret stays below QuickJS's
-    // 4,000-character error bound, with room for bridge-added context.
+    // Keep typed metadata below the executor bridge bound.
     if (JSON.stringify(details).length > 3_700) {
         details = {
             code: details.code,
             message: details.message,
             retryable: details.retryable,
-            ...(details.retryAfterMs !== undefined
-                ? { retryAfterMs: details.retryAfterMs }
-                : {}),
+            ...(details.retryAfterMs !== undefined ? { retryAfterMs: details.retryAfterMs } : {}),
         };
     }
     return new InvocationFailure(details);
 }
-function framedGuestFailure(secret, failure) {
-    const framed = new InvocationFailure(failure.details);
-    framed.message =
-        `${GUEST_FAILURE_FRAME}${secret}:${JSON.stringify(failure.details)}`;
-    guestFailureFrames.set(failure, framed.message);
-    return framed;
-}
-/** Rebuild host failures as guest errors without exposing the private frame. */
-function guestErrorPrelude(failureSecret) {
-    return `((failurePrefix) => {
-  const NativeError = globalThis.Error;
-  const startsWith = Function.prototype.call.bind(String.prototype.startsWith);
-  const slice = Function.prototype.call.bind(String.prototype.slice);
-  const parse = JSON.parse;
-  const freeze = Object.freeze;
-  const defineProperties = Object.defineProperties;
-  const construct = Reflect.construct;
-  function ConnectaError(message, options) {
-    let details;
-    if (typeof message === "string" && startsWith(message, failurePrefix)) {
-      try { details = parse(slice(message, failurePrefix.length)); }
-      catch { message = "Invalid host failure frame."; }
-    }
-    const error = construct(
-      NativeError,
-      options === undefined ? [details ? details.message : message] : [details ? details.message : message, options],
-      new.target || NativeError
-    );
-    if (details) {
-      freeze(details);
-      defineProperties(error, {
-        code: { value: details.code, enumerable: true },
-        retryable: { value: details.retryable, enumerable: true },
-        details: { value: details, enumerable: true }
-      });
-    }
-    return error;
-  }
-  ConnectaError.prototype = NativeError.prototype;
-  Object.setPrototypeOf(ConnectaError, NativeError);
-  Object.defineProperty(globalThis, "Error", {
-    value: ConnectaError,
-    writable: false,
-    configurable: false
-  });
-})(${JSON.stringify(`${GUEST_FAILURE_FRAME}${failureSecret}:`)});`;
-}
 /**
  * Expose one host provider and typed guest errors. Catalogs load only when
  * the program calls a tool or asks search/describe.
@@ -284,58 +380,172 @@ function guestErrorPrelude(failureSecret) {
 export async function buildSandboxProviders(registry, baseUrl, _logger, activity, limits = {}) {
     return [sandboxProvider(registry, baseUrl, activity, limits)];
 }
+/** Numeric accounting only; no addresses, arguments, or results. */
+class HostCallBudgetExceeded extends InvocationFailure {
+    hostCalls;
+    constructor(hostCalls, maxHostCalls) {
+        super({
+            code: "budget_exceeded",
+            message: `execute_code host-call budget exceeded (${maxHostCalls} calls maximum)`,
+            retryable: false,
+        });
+        this.hostCalls = hostCalls;
+    }
+}
 /**
  * The `connecta` provider for one execution.
  *
  * Building it is synchronous and loads nothing. Each function is a Promise
  * edge the executor awaits, and behind it one host call is one fiber: spend
- * the budget, do the operation, and turn a typed failure into the frame the
- * prelude rebuilds inside the guest. Nothing is shared between those fibers
- * but the budget counters and this request's catalog, so a call the program
- * never awaits cannot disturb the others.
+ * the budget, do the operation, and retain a typed failure for the
+ * executor bridge to rebuild inside the guest. Nothing is shared between those fibers
+ * but the budget counters and this request's catalog. Budget exhaustion ends
+ * the whole run, including calls the program never awaits.
  */
-function sandboxProvider(registry, baseUrl, activity, limits) {
+function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {}) {
+    const sentSecrets = sentSecretsForRequest(requestScope, limits.sentSecrets);
     // All host calls made by one execute_code invocation share a downstream
     // connection, while a later invocation receives a fresh request scope.
-    const requestScope = {};
+    const hostAccessSignal = limits.dispatchController
+        ? AbortSignal.any([limits.dispatchController.signal, ...(limits.signal ? [limits.signal] : [])])
+        : limits.signal;
     const catalog = new CatalogService(registry, baseUrl, {
         requestScope,
+        requestSignal: hostAccessSignal,
         // A program that just missed an address cannot call search_tools.
         searchRoute: "connecta.search",
         concurrency: limits.discoveryConcurrency,
         probeTimeoutMs: limits.probeTimeoutMs,
         defer: limits.defer,
-        approval: limits.approval,
     });
     const invocation = new InvocationService(registry, catalog, activity);
     const maxHostCalls = Math.max(1, Math.trunc(limits.maxHostCalls ?? EXECUTE_MAX_HOST_CALLS));
     const hostCallTimeoutMs = Math.max(1, Math.trunc(limits.hostCallTimeoutMs ?? EXECUTE_HOST_CALL_TIMEOUT_MS));
-    const failureSecret = guestFailureSecret();
-    const { signal, diagnostics, exemptWrites } = limits;
-    let hostCalls = 0;
-    // L4/M7: discovery and invocation spend the same budget, on entry; emit
-    // does not.
-    const spendHostCall = Effect.suspend(() => ++hostCalls > maxHostCalls
-        ? Effect.fail(guestFailure("budget_exceeded", `execute_code host-call budget exceeded (${maxHostCalls} calls maximum)`))
-        : Effect.void);
-    const approval = limits.approval ?? NO_EXEMPTIONS;
+    const { signal, diagnostics, programWrites } = limits;
+    const hostCalls = limits.hostCalls ?? { attempted: 0, admitted: 0, succeeded: 0, failed: 0 };
+    let budgetFailure;
+    let emitAttempts = 0;
+    const maxEmitAttempts = Math.max(EXECUTE_MAX_EMITTED_BLOCKS, limits.emitCollector?.maxBlocks ?? EXECUTE_MAX_EMITTED_BLOCKS) * 4;
+    // A rejected bridge promise is catchable in both sandboxes. End the host
+    // run instead and leave that bridge pending: an awaiting guest cannot catch
+    // the refusal and loop. Later calls, including emit, lose host access too.
+    const stopped = new Promise((_resolve, reject) => {
+        const ended = () => reject(new Error("The host run ended."));
+        if (signal?.aborted)
+            ended();
+        else
+            signal?.addEventListener("abort", ended, { once: true });
+    });
+    // Stay pending until the lease has disposed the sandbox, then settle the
+    // abandoned host RPC waits without retaining request resources forever.
+    stopped.catch(() => { });
     const maxWrites = resolveBudget(limits.maxWrites, DEFAULT_MAX_WRITES);
     let writes = 0;
-    /**
-     * The write gate covers exactly the config-exempt calls (#566): each spends
-     * the write budget and is tracked until it settles (`ExemptWrites`), so the
-     * play can wait for it rather than abort it. Every other write keeps E4's
-     * refusal, ahead of validation, so the host's prompt on
-     * call_destructive_tool stays the only approval there is.
-     */
-    const invocationContext = (sending) => ({
+    // These are transfer cursors only. All result bytes live in the existing stash.
+    const transfers = new Map();
+    const nativeResults = new Map();
+    const transportResult = (value) => {
+        if (value.format === "paged") {
+            const handle = value;
+            if (handle.resultId && handle.totalBytes <= PROGRAM_RESULT_INLINE_BYTES) {
+                const transfer = `transfer:${crypto.randomUUID()}`;
+                transfers.set(transfer, { id: handle.resultId, offset: 0 });
+                return { transfer, handle };
+            }
+        }
+        return value;
+    };
+    /** Budget and account for writes admitted by the pool trust decision. */
+    const invocationContext = (sending, timeoutMs) => ({
         source: "execute_code",
-        timeoutMs: hostCallTimeoutMs,
+        sentSecrets,
+        timeoutMs,
         ...(signal !== undefined ? { requestSignal: signal } : {}),
+        ...(limits.dispatchController ? { dispatchSignal: limits.dispatchController.signal } : {}),
         unwrapResult: true,
-        gates: (target) => isApprovalExempt(approval, target.connector, target.toolName, target.definition),
-        writeGate: (target) => Effect.sync(() => {
-            if (exemptWrites?.isClosed) {
+        trust: limits.trust,
+        processResult: async (value, resolved, secrets, format, raw) => {
+            const page = (data, valueFormat, wireBytes) => pageProgramResult(registry, baseUrl, resolved, data, valueFormat, secrets, limits.trust, requestScope, wireBytes);
+            const envelope = resolved.connector.kind === "mcp" && raw !== null && typeof raw === "object"
+                ? raw
+                : undefined;
+            const dataKey = envelope
+                ? "toolResult" in envelope
+                    ? "toolResult"
+                    : envelope.structuredContent !== undefined
+                        ? "structuredContent"
+                        : undefined
+                : undefined;
+            // Preserve #788 before even inspecting presentation. Paging serializes
+            // the structured value synchronously; no native metadata is visited.
+            if (dataKey !== undefined &&
+                diagnosticsEncoder.encode(JSON.stringify(value)).byteLength > PROGRAM_RESULT_INLINE_BYTES) {
+                return page(value, format, PROGRAM_RESULT_WIRE_BYTES - 1024);
+            }
+            const content = envelope?.content;
+            if (!Array.isArray(content) ||
+                !content.some((block) => block && ["image", "audio", "resource", "resource_link"].includes(block.type))) {
+                return transportResult(await page(value, format));
+            }
+            const unavailablePresentation = () => ({
+                format: "paged",
+                valueFormat: "json",
+                totalBytes: 0,
+                truncated: true,
+                hint: "Paging is unavailable. Native presentation exceeds byte, node or depth limits, or is not acyclic JSON. Reduce the downstream presentation before forwarding it.",
+            });
+            let snapshot;
+            let retained;
+            try {
+                // Oversized but bounded envelopes may still use the existing stash.
+                // Measure without copying them; only inline native blocks are retained.
+                const measured = boundedNativeValue(envelope, Math.max(EXECUTE_MAX_EMITTED_BYTES, limits.emitCollector?.maxBytes ?? 0), false);
+                if (measured.bytes <= PROGRAM_RESULT_INLINE_BYTES) {
+                    retained = boundedNativeValue(content, PROGRAM_RESULT_INLINE_BYTES, true).value;
+                    snapshot = { ...envelope, content: retained };
+                }
+                else {
+                    snapshot = envelope;
+                }
+            }
+            catch (error) {
+                if (!(error instanceof NativePresentationLimit))
+                    throw error;
+                const result = dataKey === undefined ? undefined : transportResult(await page(value, format));
+                const notice = unavailablePresentation();
+                return result ? { value: result, native: { value: notice } } : notice;
+            }
+            // Snapshot blocks before either stash operation yields. Start both
+            // serializations now so an oversized presentation's pages also own the
+            // original bytes even if the structured-data stash pauses.
+            const resultPending = dataKey === undefined ? undefined : page(value, format, PROGRAM_RESULT_WIRE_BYTES - 1024);
+            const nativePending = page(snapshot, "json");
+            const result = await resultPending;
+            const native = await nativePending;
+            let valueResult;
+            if (native.format === "paged") {
+                valueResult = result ? transportResult(result) : undefined;
+                if (!native.resultId || native.totalBytes > PROGRAM_RESULT_INLINE_BYTES) {
+                    return valueResult ? { value: valueResult, native: { value: native } } : native;
+                }
+            }
+            // Redaction can shrink an oversized original below the inline cap. It
+            // still has no retained snapshot: keep its handle, never mint a ref to
+            // absent or connector-owned blocks.
+            if (!retained) {
+                const notice = native.format === "paged" ? native : unavailablePresentation();
+                const valueResult = result ? transportResult(result) : undefined;
+                return valueResult ? { value: valueResult, native: { value: notice } } : notice;
+            }
+            const ref = crypto.randomUUID();
+            nativeResults.set(ref, retained);
+            return {
+                ...(valueResult ? { value: valueResult } : {}),
+                native: { ref, value: transportResult(native), dataKey },
+            };
+        },
+        beforeWrite: (target) => Effect.sync(() => {
+            if (programWrites?.isClosed) {
                 return {
                     kind: "refuse",
                     error: {
@@ -357,24 +567,75 @@ function sandboxProvider(registry, baseUrl, activity, limits) {
                 };
             }
             writes++;
-            if (exemptWrites)
-                sending.settle = exemptWrites.begin();
+            if (programWrites)
+                sending.settle = programWrites.begin();
             return { kind: "dispatch" };
         }),
     });
     // A call brings its own cancellation: the invocation pipeline reads the
     // run's signal, refuses a call that starts after it, and records the
     // cancelled attempt in activity like any other outcome.
-    const call = (address, args) => Effect.gen(function* () {
-        yield* spendHostCall;
-        // An exempt write settles here — unknown if the call never returned an
-        // outcome.
+    const call = (address, args, options) => Effect.gen(function* () {
+        let timeout;
+        if (address !== null && typeof address === "object" && !Array.isArray(address)) {
+            const request = address;
+            if (args !== undefined ||
+                options !== undefined ||
+                Object.keys(request).some((key) => !["address", "args", "timeoutMs"].includes(key))) {
+                return yield* Effect.fail(guestFailure("invalid_args", CALL_SIGNATURE));
+            }
+            address = request.address;
+            args = request.args;
+            timeout = request.timeoutMs;
+        }
+        else if (options !== undefined) {
+            if (!options ||
+                typeof options !== "object" ||
+                Array.isArray(options) ||
+                Object.keys(options).some((key) => key !== "timeoutMs")) {
+                return yield* Effect.fail(guestFailure("invalid_args", CALL_SIGNATURE));
+            }
+            timeout = options.timeoutMs;
+        }
+        if (typeof address !== "string" ||
+            (timeout !== undefined && (typeof timeout !== "number" || !Number.isSafeInteger(timeout) || timeout < 1))) {
+            return yield* Effect.fail(guestFailure("invalid_args", CALL_SIGNATURE));
+        }
+        const requestedMs = normalizeTimeoutMs(timeout) ??
+            normalizeTimeoutMs(limits.defaultToolTimeoutMs) ??
+            hostCallTimeoutMs;
+        const timeoutMs = Math.min(requestedMs, Math.max(1, (limits.programDeadlineAt ?? Infinity) - Date.now()));
+        // A trusted-pool write settles here — unknown if the call never returned an
+        // outcome. Credentials are filtered from arguments; submitted private values are not.
         const sending = {};
-        const outcome = yield* invocation.pipeline(String(address), args ?? {}, invocationContext(sending)).pipe(Effect.onExit((exit) => Effect.sync(() => sending.settle?.(Exit.isSuccess(exit) ? writeStateOf(exit.value) : "unknown"))));
+        const outcome = yield* invocation
+            .pipeline(address, sentSecrets.redactCredentials(args ?? {}), invocationContext(sending, timeoutMs))
+            .pipe(Effect.onExit((exit) => Effect.sync(() => sending.settle?.(Exit.isSuccess(exit) ? writeStateOf(exit.value) : "unknown"))));
+        if (outcome.resolved) {
+            const resolved = outcome.resolved;
+            limits.resultDependencies?.push({
+                connector: resolved.connector.id,
+                tool: resolved.definition.name,
+                classification: outcome.dispatched && resolved.definition.classification !== "read" ? "write" : "read",
+                // A refusal exposes catalog metadata, not a completed write's result.
+                ...(!outcome.dispatched ? { access: "catalog" } : {}),
+            });
+        }
+        else {
+            // Resolution failures can expose a catalog error or connector metadata
+            // without ever finding a tool. Such bytes depend on connector visibility,
+            // not on the existence of the requested (possibly unknown) tool.
+            const target = registry.resolveAddress(address);
+            if (target)
+                catalogDependency(target.connector.id);
+            if (!outcome.ok)
+                for (const connector of outcome.error.configuredConnectors ?? [])
+                    catalogDependency(connector);
+        }
         diagnostics?.recordCall(outcome);
-        return outcome.ok
-            ? outcome.value
-            : yield* Effect.fail(new InvocationFailure(outcome.error));
+        if (!outcome.ok)
+            return yield* Effect.fail(new InvocationFailure(outcome.error));
+        return outcome.value;
     });
     // Discovery gets the same treatment from here (L2): once the run has
     // ended no search or describe starts, and one still in flight fails
@@ -386,21 +647,117 @@ function sandboxProvider(registry, baseUrl, activity, limits) {
         const cancelled = () => guestFailure("cancelled", `connecta.${operation} was cancelled because the run ended.`);
         const reading = Effect.tryPromise({
             try: read,
-            catch: (err) => err instanceof DiscoveryPolicyError
-                ? guestFailure(err.code, err.message)
-                : err,
+            catch: (err) => (err instanceof DiscoveryPolicyError ? guestFailure(err.code, err.message) : err),
         });
-        return spendHostCall.pipe(Effect.andThen(!signal
+        return (!hostAccessSignal
             ? reading
-            : signal.aborted
+            : hostAccessSignal.aborted
                 ? Effect.fail(cancelled())
-                : Effect.raceAllFirst([
-                    reading,
-                    fromSignal(signal).pipe(Effect.mapError(cancelled)),
-                ])), Effect.onExit((exit) => Effect.sync(() => diagnostics?.recordCatalog(operation, Date.now() - started, Exit.isSuccess(exit), Exit.isSuccess(exit) ? exit.value : undefined))));
+                : Effect.raceAllFirst([reading, fromSignal(hostAccessSignal).pipe(Effect.mapError(cancelled))])).pipe(Effect.onExit((exit) => Effect.sync(() => diagnostics?.recordCatalog(operation, Date.now() - started, Exit.isSuccess(exit), Exit.isSuccess(exit) ? exit.value : undefined))));
+    });
+    const meta = createMetaTools(registry, baseUrl, {
+        trust: limits.trust,
+        requestScope,
+        onResultRead: (dependencies) => limits.resultDependencies?.push(...dependencies),
     });
+    const catalogDependency = (connector, tool) => {
+        if (registry.getConnector(connector))
+            limits.resultDependencies?.push({
+                connector,
+                ...(tool ? { tool } : {}),
+                classification: "read",
+                access: "catalog",
+            });
+    };
+    const catalogAddressDependency = (address) => {
+        const resolved = registry.resolveAddress(address);
+        if (resolved)
+            catalogDependency(resolved.connector.id, resolved.toolName);
+    };
     const operations = {
         call,
+        result: (id, options, signal) => Effect.tryPromise({
+            try: async () => {
+                const transfer = typeof id === "string" ? transfers.get(id) : undefined;
+                const transferId = id;
+                if (transfer) {
+                    id = transfer.id;
+                    options = { offset: transfer.offset, maxBytes: PROGRAM_RESULT_PAGE_BYTES };
+                }
+                else if (id !== null && typeof id === "object" && !Array.isArray(id)) {
+                    id = id.resultId;
+                }
+                if (typeof id !== "string" ||
+                    (!options && options !== undefined) ||
+                    (options !== undefined && (typeof options !== "object" || Array.isArray(options)))) {
+                    throw guestFailure("invalid_args", "Use connecta.result(handleOrId, { page?, offset?, maxBytes? }).");
+                }
+                const args = { ...(options ?? {}) };
+                if (Object.keys(args).some((key) => !["page", "offset", "maxBytes"].includes(key)) ||
+                    (args.page !== undefined &&
+                        (typeof args.page !== "number" ||
+                            !Number.isSafeInteger(args.page) ||
+                            args.page < 0 ||
+                            args.offset !== undefined)) ||
+                    (args.offset !== undefined &&
+                        (typeof args.offset !== "number" || !Number.isSafeInteger(args.offset) || args.offset < 0)) ||
+                    (args.maxBytes !== undefined &&
+                        (typeof args.maxBytes !== "number" || !Number.isSafeInteger(args.maxBytes) || args.maxBytes < 1))) {
+                    throw guestFailure("invalid_args", "Use connecta.result(handleOrId, { page?, offset?, maxBytes? }) with whole page/offset >= 0 and maxBytes >= 1; page and offset are mutually exclusive.");
+                }
+                // A page must fit every shipped bridge even when the connector cap is raised.
+                args.maxBytes = Math.min(args.maxBytes ?? PROGRAM_RESULT_PAGE_BYTES, PROGRAM_RESULT_PAGE_BYTES);
+                const page = await meta.readResult({ id, ...args }, { signal: signal });
+                if (page.isError)
+                    throw new InvocationFailure((page.structuredContent?.error ?? {
+                        code: "not_found",
+                        message: page.content[0]?.text ?? "Result unavailable.",
+                        retryable: false,
+                    }));
+                if (transfer) {
+                    if (page.structuredContent?.hasMore)
+                        transfer.offset = page.structuredContent.nextOffset;
+                    else
+                        transfers.delete(transferId);
+                }
+                return page.structuredContent;
+            },
+            catch: (err) => err,
+        }),
+        skill: (name, _options, utilitySignal) => Effect.tryPromise({
+            try: async () => {
+                if (typeof name !== "string")
+                    throw guestFailure("invalid_args", "Use connecta.skill(name) with an exact skill name.");
+                const skills = new SkillsRegistry(registry, baseUrl, {
+                    requestScope,
+                    requestSignal: utilitySignal ?? hostAccessSignal,
+                    onRead: (connector, source) => limits.resultDependencies?.push({
+                        connector: connector.id,
+                        classification: "read",
+                        ...(source === "local" ? { access: "catalog" } : {}),
+                    }),
+                    probeTimeoutMs: limits.probeTimeoutMs,
+                    defer: limits.defer,
+                });
+                return { name, format: "text", text: await skills.text(name) };
+            },
+            catch: (err) => err instanceof ConnectorCallError ? guestFailure(err.code, err.message, err.code === "unavailable") : err,
+        }),
+        read: (uri) => Effect.suspend(() => {
+            const started = Date.now();
+            let connectorMs = 0;
+            return readResource(registry, uri, {
+                baseUrl,
+                requestScope,
+                sentSecrets,
+                timeoutMs: hostCallTimeoutMs,
+                onResolved: (connector) => limits.resultDependencies?.push({ connector: connector.id, classification: "read" }),
+                onConnectorTime: (elapsed) => {
+                    connectorMs += elapsed;
+                },
+                ...(hostAccessSignal ? { signal: hostAccessSignal } : {}),
+            }).pipe(Effect.onExit((exit) => Effect.sync(() => diagnostics?.recordRead(Date.now() - started, connectorMs, Exit.isSuccess(exit), Exit.isSuccess(exit) ? exit.value : undefined))));
+        }),
         // Emission is a provider function, never an ExecuteResult field —
         // that is what keeps the Executor contract untouched and parity
         // structural (M8). It spends no host-call budget (M7); its own
@@ -410,7 +767,26 @@ function sandboxProvider(registry, baseUrl, activity, limits) {
                 if (!limits.emitCollector) {
                     throw guestFailure("unavailable", "connecta.emit is unavailable: no emission collector was configured for this execution", true);
                 }
-                limits.emitCollector.accept(block);
+                if (block !== null && typeof block === "object" && "contentResult" in block) {
+                    throw guestFailure("result_too_large", "Native content is not inline; page result.contentResult with connecta.result and reduce it before emitting.");
+                }
+                if (block !== null && typeof block === "object" && !Array.isArray(block) && "ref" in block) {
+                    const reference = block;
+                    const native = typeof reference.ref === "string" ? nativeResults.get(reference.ref) : undefined;
+                    if (!native ||
+                        Object.keys(reference).some((key) => !["ref", "index"].includes(key)) ||
+                        (reference.index !== undefined &&
+                            (typeof reference.index !== "number" ||
+                                !Number.isSafeInteger(reference.index) ||
+                                reference.index < 0 ||
+                                reference.index >= native.length))) {
+                        throw guestFailure("invalid_args", "connecta.emit requires a native result from this program's connecta.call.");
+                    }
+                    const blocks = reference.index === undefined ? native : [native[reference.index]];
+                    limits.emitCollector.acceptNative(sentSecrets.redact(blocks));
+                }
+                else
+                    limits.emitCollector.accept(sentSecrets.redact(block));
             },
             catch: (err) => err,
         }),
@@ -418,37 +794,122 @@ function sandboxProvider(registry, baseUrl, activity, limits) {
             const args = (raw ?? {});
             const result = flatSearchResult(await catalog.search({
                 ...args,
+                includeSchemas: args.includeSchemas ?? "json",
                 includeSchemaKeys: args.includeSchemaKeys !== false,
             }));
             boundedDiscoveryText(result, "Request a smaller limit, omit fullDescriptions, use compact schemas, or pass includeSchemaKeys: false.");
+            for (const tool of result.tools)
+                catalogAddressDependency(tool.address);
+            for (const error of result.catalogErrors)
+                catalogDependency(error.connector);
+            for (const connector of result.absence?.configuredConnectors ?? [])
+                catalogDependency(connector);
+            for (const connector of result.queryAnalysis?.configuredConnectors ?? [])
+                catalogDependency(connector);
+            if (result.queryAnalysis?.connectorScope)
+                catalogDependency(result.queryAnalysis.connectorScope);
             return result;
         }),
         describe: (raw) => discovery("describe", async () => {
             const args = (raw ?? {});
-            const result = { tools: await catalog.describe(args) };
+            const result = { tools: await catalog.describe({ ...args, format: args.format ?? "json" }) };
             boundedDiscoveryText(result, 'Split the address list or use format: "compact".');
+            for (const tool of result.tools) {
+                if (!tool.error)
+                    catalogAddressDependency(tool.address);
+                else {
+                    const resolved = registry.resolveAddress(tool.address);
+                    if (resolved)
+                        catalogDependency(resolved.connector.id);
+                    for (const connector of tool.errorDetails?.configuredConnectors ?? [])
+                        catalogDependency(connector);
+                    for (const suggestion of tool.errorDetails?.suggestions ?? [])
+                        catalogAddressDependency(suggestion);
+                }
+            }
             return result;
         }),
     };
-    // Every failure leaves through the same frame, so the prelude can rebuild
-    // a typed error however the host call failed — refused, over budget, or
-    // cancelled. Anything that is not an InvocationFailure crosses unchanged.
-    const framed = (err) => Effect.suspend(() => {
+    // Recoverable failures remain typed at the host-owned executor bridge. Terminal host-budget exhaustion bypasses it.
+    // Anything that is not an InvocationFailure crosses unchanged.
+    const typedFailure = (err) => Effect.suspend(() => {
         if (!(err instanceof InvocationFailure))
             return Effect.fail(err);
-        const failure = boundedGuestFailure(err);
-        const frame = framedGuestFailure(failureSecret, failure);
-        limits.onInvocationFailure?.(failure);
-        return Effect.fail(frame);
+        const failure = boundedGuestFailure(redactAgentOutput(sentSecrets, err));
+        return Effect.fail(failure);
     });
     return {
         name: "connecta",
         // Trusted host code the program runs after and cannot undo.
-        prelude: guestErrorPrelude(failureSecret),
+        prelude: guestPrelude(),
         fns: Object.fromEntries(Object.entries(operations).map(([name, operation]) => [
             name,
             (...args) => {
-                const settled = runEdge(Effect.suspend(() => operation(...args)).pipe(Effect.catch(framed)));
+                if (budgetFailure)
+                    return stopped;
+                // Invalid emits still allocate guest promises and typed rejections.
+                // Bound those attempts without consuming the invocation budget or discarding identities.
+                if (name === "emit" && ++emitAttempts > maxEmitAttempts) {
+                    budgetFailure = guestFailure("budget_exceeded", `execute_code emission-attempt budget exceeded (${maxEmitAttempts} attempts maximum).`);
+                    programWrites?.close();
+                    limits.dispatchController?.abort();
+                    limits.onHostCallBudgetExceeded?.(budgetFailure);
+                    return stopped;
+                }
+                // L4/M7: spend on entry, before even invalid arguments are checked;
+                // emit has a separate budget and never spends this one.
+                // Transparent transfer pages consume the already-admitted call, not guest host calls.
+                const counted = name !== "emit" && !(name === "result" && typeof args[0] === "string" && transfers.has(args[0]));
+                if (counted && ++hostCalls.attempted > maxHostCalls) {
+                    hostCalls.failed++;
+                    budgetFailure = new HostCallBudgetExceeded(hostCalls, maxHostCalls);
+                    programWrites?.close();
+                    limits.dispatchController?.abort();
+                    limits.onHostCallBudgetExceeded?.(budgetFailure);
+                    return stopped;
+                }
+                if (counted)
+                    hostCalls.admitted++;
+                const started = Date.now();
+                const utility = name === "result" || name === "skill";
+                const invoke = Effect.suspend(() => operation(...args));
+                const guarded = utility
+                    ? withDeadlineEffect((utilitySignal) => Effect.suspend(() => operation(args[0], args[1], utilitySignal)), {
+                        timeoutMs: hostCallTimeoutMs,
+                        ...(hostAccessSignal ? { signal: hostAccessSignal } : {}),
+                        timeoutError: guestFailure("timeout", `connecta.${name} timed out.`),
+                    })
+                    : invoke;
+                const settled = runEdge(guarded.pipe(Effect.catch((error) => {
+                    if (utility && hostAccessSignal?.aborted)
+                        return typedFailure(guestFailure("cancelled", `connecta.${name} was cancelled because the run ended.`));
+                    if (utility && error instanceof InvocationFailure && error.code === "timeout") {
+                        const elapsedMs = Date.now() - started;
+                        const message = `Operation "connecta.${name}" timed out during ${name === "result" ? "result storage" : "skill lookup"} after ${elapsedMs}ms (effective deadline ${hostCallTimeoutMs}ms).`;
+                        return typedFailure(new InvocationFailure({
+                            code: "timeout",
+                            message,
+                            retryable: true,
+                            details: {
+                                operation: `connecta.${name}`,
+                                stage: name === "result" ? "result storage" : "skill lookup",
+                                elapsedMs,
+                                deadlineMs: hostCallTimeoutMs,
+                            },
+                        }));
+                    }
+                    return typedFailure(error);
+                }))).then((value) => {
+                    if (counted)
+                        hostCalls.succeeded++;
+                    return budgetFailure ? stopped : redactAgentOutput(sentSecrets, value);
+                }, (err) => {
+                    if (counted)
+                        hostCalls.failed++;
+                    if (budgetFailure)
+                        return stopped;
+                    throw redactAgentOutput(sentSecrets, err);
+                });
                 // The executor owns this promise, and a program may abandon a call
                 // that the run's end then cancels before anyone has awaited it.
                 // The rejection is still there for whoever does; it is just not an
@@ -476,11 +937,12 @@ function sandboxProvider(registry, baseUrl, activity, limits) {
  * ceiling as an untyped executor failure naming the key that sets it. Either
  * way the handler returns and releases the lease, and the abandoned call
  * keeps whatever it was doing: the QuickJS lease release recycles its child,
- * a Dynamic Worker isolate runs on to its own deadline, and a lease granted
- * after its request gave up goes to `late`. The result contract is untouched
+ * the Worker adapter disposes its handles without waiting for the guest. A
+ * lease granted after its request gave up goes to `late`. The result contract is untouched
  * — this only decides when to stop waiting for one.
  */
 function awaitExecutor(start, signal, options = {}) {
+    const started = Date.now();
     const contenders = [
         Effect.suspend(() => {
             let pending;
@@ -501,12 +963,21 @@ function awaitExecutor(start, signal, options = {}) {
         // which the executor's promise chain can still lose to.)
         fromSignal(signal).pipe(Effect.catch(() => Effect.sleep(Duration.millis(1))), Effect.andThen(Effect.fail(new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled.")))),
     ];
+    if (options.terminal)
+        contenders.push(options.terminal);
     const { watchdog } = options;
     if (watchdog) {
         contenders.push(Effect.sleep(Duration.millis(watchdog.ms)).pipe(Effect.andThen(Effect.suspend(() => {
-            watchdog.logger.warn("[connecta] execute_code executor did not settle; run abandoned", { watchdogMs: watchdog.ms });
-            return Effect.fail(new Error(`sandbox unresponsive: no outcome within the ${watchdog.ms}ms ` +
-                "execute.watchdogMs ceiling, so the run was abandoned"));
+            watchdog.logger.warn("[connecta] execute_code executor did not settle; run abandoned", {
+                watchdogMs: watchdog.ms,
+            });
+            const elapsedMs = Date.now() - started;
+            return Effect.fail(new InvocationFailure({
+                code: "timeout",
+                message: `Operation "execute_code" timed out during sandbox watchdog after ${elapsedMs}ms (effective deadline ${watchdog.ms}ms); sandbox unresponsive.`,
+                retryable: false,
+                details: { operation: "execute_code", stage: "sandbox watchdog", elapsedMs, deadlineMs: watchdog.ms },
+            }));
         }))));
     }
     return Effect.raceAllFirst(contenders);
@@ -540,44 +1011,40 @@ function runSignal(caller) {
  * which workerd refuses for any I/O. Awaiting the promise resumes it here.
  */
 function leased(executor, signal) {
-    return Effect.acquireRelease(awaitExecutor(() => executor.acquire({ signal }), signal, {
+    return Effect.acquireRelease(awaitExecutor(() => executor.acquire({ signal, wait: true }), signal, {
         late: (lease) => lease.release(),
     }), (lease) => Effect.sync(() => lease.release()));
 }
-/** Room for the executor queue a run waits in before its watchdog starts. */
-const RUN_CLAIM_SLACK_MS = 10_000;
-/**
- * How long one run may take before whoever claimed it may give up on it: the
- * watchdog, one more host-call deadline for an exempt write the play drains,
- * and queue slack. Artifact refresh leases its claim for this long.
- */
-export function runClaimMs(config) {
-    return resolveBudget(config.watchdogMs, EXECUTE_WATCHDOG_MS) +
-        resolveBudget(config.hostCallTimeoutMs, EXECUTE_HOST_CALL_TIMEOUT_MS) +
-        RUN_CLAIM_SLACK_MS;
-}
-/** The execute_code handler. Exported for direct testing and artifact refresh. */
+/** The execute_code handler. Exported for direct testing. */
 export function createExecuteTool(registry, baseUrl, executor, logger, activity, config = {}) {
     const watchdog = {
         ms: resolveBudget(config.watchdogMs, EXECUTE_WATCHDOG_MS),
         logger,
     };
     const hostCallTimeoutMs = resolveBudget(config.hostCallTimeoutMs, EXECUTE_HOST_CALL_TIMEOUT_MS);
-    const play = (program, diagnosticsRequested, callerSignal) => Effect.suspend(() => {
-        const diagnostics = diagnosticsRequested
-            ? new ExecuteDiagnostics()
-            : undefined;
+    const play = (program, diagnosticsRequested, callerSignal, requestScope) => Effect.suspend(() => {
+        const sentSecrets = sentSecretsForRequest(requestScope);
+        const diagnostics = diagnosticsRequested ? new ExecuteDiagnostics() : undefined;
         const emitted = new EmitCollector(resolveBudget(config.maxEmittedBytes, EXECUTE_MAX_EMITTED_BYTES), resolveBudget(config.maxEmittedBlocks, EXECUTE_MAX_EMITTED_BLOCKS), diagnostics);
-        const invocationFailures = [];
-        const exemptWrites = new ExemptWrites();
+        const hostCalls = { attempted: 0, admitted: 0, succeeded: 0, failed: 0 };
+        const programWrites = new ProgramWrites();
+        const resultDependencies = [];
+        const dispatchController = new AbortController();
+        const terminal = Deferred.makeUnsafe();
+        let budgetFailure;
+        let executorLogs;
         // The run's scope holds its signal and its lease. However the run
         // ends — a result, a thrown executor, the watchdog, cancellation —
         // closing it releases the lease and then aborts the signal, so
         // nothing the run started outlives the request.
         const run = Effect.gen(function* () {
+            // Per-call signals cancel individual fetches, but do not close the
+            // shared transport. Close its scope after the run's signal ends, on
+            // every exit, using the existing bounded cleanup and deferred tail.
+            yield* Effect.addFinalizer(() => Effect.forEach(registry.listConnectors(), (connector) => closeScope(connector, registry.contextFor(connector.id, baseUrl, requestScope), config.defer), { concurrency: "unbounded", discard: true }));
             const signal = yield* runSignal(callerSignal);
             // Admission comes before provider construction: queued calls retain
-            // no catalogs, request scopes, or provider closures.
+            // no catalogs or provider closures.
             let lease;
             if (isAdmittingExecutor(executor)) {
                 lease = yield* timed((elapsed) => {
@@ -594,11 +1061,12 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                 if (diagnostics)
                     diagnostics.setupMs = elapsed;
             }, Effect.sync(() => sandboxProvider(registry, baseUrl, activity, {
+                sentSecrets,
                 signal,
-                onInvocationFailure: (failure) => {
-                    invocationFailures.push(failure);
-                    if (invocationFailures.length > 64)
-                        invocationFailures.shift();
+                hostCalls,
+                onHostCallBudgetExceeded: (failure) => {
+                    budgetFailure = failure;
+                    Deferred.doneUnsafe(terminal, Effect.fail(failure));
                 },
                 emitCollector: emitted,
                 ...(diagnostics ? { diagnostics } : {}),
@@ -606,62 +1074,111 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                 probeTimeoutMs: config.probeTimeoutMs,
                 maxHostCalls: config.maxHostCalls,
                 hostCallTimeoutMs,
+                defaultToolTimeoutMs: config.defaultToolTimeoutMs,
+                programDeadlineAt: Date.now() + watchdog.ms,
                 defer: config.defer,
-                approval: config.approval,
+                trust: config.trust,
                 maxWrites: config.maxWrites,
-                exemptWrites,
-            })));
+                programWrites,
+                resultDependencies,
+                dispatchController,
+            }, requestScope)));
             if (signal.aborted) {
                 return yield* Effect.fail(new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled during sandbox setup."));
             }
             const admitted = lease;
-            // An exempt write may still be on the wire when the program settles:
+            // A trusted-pool write may still be on the wire when the program settles:
             // close, so a write gated after this is not sent, then let the ones
             // already dispatched finish before the scope aborts them — an
             // abandoned write would be one whose outcome nobody knows.
             return yield* timed((elapsed) => {
                 if (diagnostics)
                     diagnostics.executorWallMs = elapsed;
-            }, awaitExecutor(() => admitted
-                ? admitted.execute(program, [provider])
-                : executor.execute(program, [provider]), signal, { watchdog }).pipe(Effect.ensuring(Effect.suspend(() => {
-                exemptWrites.close();
-                return exemptWrites.drain();
+            }, awaitExecutor(() => (admitted
+                ? admitted.execute(wrapGuestProgram(program), [provider])
+                : executor.execute(wrapGuestProgram(program), [provider])).then((outcome) => {
+                executorLogs = sentSecrets.redact(outcome?.logs, "prose");
+                return sentSecrets.redact(outcome);
+            }, (err) => {
+                if (err !== null && typeof err === "object" && "logs" in err) {
+                    executorLogs = sentSecrets.redact(err.logs, "prose");
+                }
+                throw sentSecrets.redact(err);
+            }), signal, { watchdog, terminal: Deferred.await(terminal) }).pipe(Effect.ensuring(Effect.suspend(() => {
+                programWrites.close();
+                dispatchController.abort();
+                return programWrites.drain();
             }))));
         });
-        const reported = { emitted, diagnostics, invocationFailures };
-        return Effect.map(Effect.exit(Effect.scoped(run)), (exit) => {
-            if (Exit.isFailure(exit)) {
-                return exemptWrites.finish(failedRun(Cause.squash(exit.cause), logger, reported));
-            }
-            const finished = finishedRun(exit.value, reported);
-            if (config.failOnInvocationFailure && invocationFailures.length > 0) {
-                const refusal = invocationFailures[0];
-                return failureResponse(refusal.details.message, {
-                    code: refusal.details,
+        const reported = {
+            emitted,
+            diagnostics,
+            program,
+            guardResult: (value, maxChars) => guardProgramReturn(value, registry, baseUrl, [...new Map(resultDependencies.map((dependency) => [JSON.stringify(dependency), dependency])).values()], sentSecrets, config.trust, logger, maxChars, programWrites.hasSucceeded),
+        };
+        const exited = Effect.exit(Effect.scoped(run)).pipe(Effect.flatMap((exit) => 
+        // Releasing a QuickJS lease ends its child and rejects execute() with
+        // the retained log prefix. Give that report one timer turn, just as
+        // cancellation does in awaitExecutor; never wait on a Worker isolate.
+        budgetFailure ? Effect.sleep(Duration.millis(1)).pipe(Effect.as(exit)) : Effect.succeed(exit)));
+        return Effect.map(Effect.flatMap(exited, (exit) => {
+            // A synchronous fire-and-forget burst can also settle its executor in
+            // this turn. The host's terminal refusal always wins over that value.
+            if (budgetFailure instanceof HostCallBudgetExceeded) {
+                const failed = failureResponse(budgetFailure.details.message, {
+                    code: budgetFailure.details,
+                    logs: executeLogs(executorLogs),
+                    emitted,
+                    diagnostics,
                 });
+                return Effect.succeed(failed);
             }
-            return exemptWrites.finish(finished);
-        });
+            if (Exit.isFailure(exit)) {
+                return Effect.succeed(failedRun(redactAgentOutput(sentSecrets, Cause.squash(exit.cause)), logger, reported));
+            }
+            return Effect.promise(() => finishedRun(redactAgentOutput(sentSecrets, exit.value), reported));
+        }), (unfinished) => {
+            // Every run response passes through write accounting.
+            const response = programWrites.finish(unfinished);
+            // Calls abandoned by the guest are failed when the run cancels them.
+            const counts = { ...hostCalls, failed: hostCalls.attempted - hostCalls.succeeded };
+            response.structuredContent = { ...response.structuredContent, hostCalls: counts };
+            if (response.content[0]?.type === "text")
+                response.content[0].text = JSON.stringify(response.structuredContent);
+            return response;
+        }).pipe(Effect.map((result) => redactAgentOutput(sentSecrets, result)));
     });
-    return ({ code, diagnostics }, options = {}) => {
-        // A code-unit count above the cap is already too large in UTF-8. Check
-        // that first so a huge direct-call string is never encoded in full.
-        if (code.length > EXECUTE_MAX_CODE_BYTES ||
-            new TextEncoder().encode(code).byteLength > EXECUTE_MAX_CODE_BYTES) {
-            const message = `execute_code code exceeds the ${EXECUTE_MAX_CODE_BYTES}-byte UTF-8 limit.`;
-            return Promise.resolve(failureResponse(message, {
-                code: { code: "invalid_args", message, retryable: false },
-            }));
-        }
-        return runEdge(Effect.suspend(() => play(normalizeProgramSource(code), diagnostics, options.signal)));
-    };
+    return agentOutputOperations((requestScope) => ({
+        execute: ({ code, diagnostics }, options = {}) => {
+            // A code-unit count above the cap is already too large in UTF-8. Check
+            // that first so a huge direct-call string is never encoded in full.
+            if (code.length > EXECUTE_MAX_CODE_BYTES ||
+                new TextEncoder().encode(code).byteLength > EXECUTE_MAX_CODE_BYTES) {
+                const message = `execute_code code exceeds the ${EXECUTE_MAX_CODE_BYTES}-byte UTF-8 limit.`;
+                const response = failureResponse(message, { code: { code: "invalid_args", message, retryable: false } });
+                response.structuredContent = {
+                    ...response.structuredContent,
+                    hostCalls: { attempted: 0, admitted: 0, succeeded: 0, failed: 0 },
+                };
+                response.content[0].text = JSON.stringify(response.structuredContent);
+                return Promise.resolve(response);
+            }
+            return runEdge(Effect.suspend(() => play(normalizeProgramSource(code), diagnostics, options.signal, requestScope)));
+        },
+    }), config.requestScope).execute;
 }
 /** An execution that never produced an ExecuteResult, as the model sees it. */
-function failedRun(err, logger, { emitted, diagnostics }) {
-    const logs = err !== null && typeof err === "object" && "logs" in err
-        ? executeLogs(err.logs)
-        : undefined;
+function failedRun(err, logger, { emitted, diagnostics, program }) {
+    const logs = err !== null && typeof err === "object" && "logs" in err ? executeLogs(err.logs) : undefined;
+    if (err instanceof InvocationFailure)
+        return failureResponse(err.details.message, { logs, emitted, diagnostics, code: err.details });
+    if (err instanceof SyntaxError)
+        return failureResponse(err.message, {
+            logs,
+            emitted,
+            diagnostics,
+            code: programError({ name: "SyntaxError", message: err.message }, program),
+        });
     if (err instanceof ExecutorAdmissionError) {
         if (err.code === "executor_overloaded") {
             logger.warn("[connecta] execute_code admission rejected", {
@@ -677,9 +1194,7 @@ function failedRun(err, logger, { emitted, diagnostics }) {
                 code: err.code,
                 message: err.message,
                 retryable: err.retryable,
-                ...(err.retryAfterMs !== undefined
-                    ? { retryAfterMs: err.retryAfterMs }
-                    : {}),
+                ...(err.retryAfterMs !== undefined ? { retryAfterMs: err.retryAfterMs } : {}),
             },
         });
     }
@@ -691,7 +1206,7 @@ function failedRun(err, logger, { emitted, diagnostics }) {
     });
 }
 /** The response for an ExecuteResult: the program's error or its value. */
-function finishedRun(outcome, { emitted, diagnostics, invocationFailures }) {
+async function finishedRun(outcome, { emitted, diagnostics, program, guardResult }) {
     if (outcome === null || typeof outcome !== "object" || Array.isArray(outcome)) {
         return failureResponse("Executor failed: expected an ExecuteResult object.", {
             emitted,
@@ -709,52 +1224,32 @@ function finishedRun(outcome, { emitted, diagnostics, invocationFailures }) {
         });
     }
     if (outcome.error !== undefined) {
-        // Executor bridges necessarily reduce thrown host errors to strings.
-        // Match that terminal string back to the request-local typed failure so
-        // an unhandled tool failure keeps the same structured contract as
-        // call_tool. Failures caught by model code never reach
-        // outcome.error and therefore remain under that code's control.
-        //
-        // An error the program let through unchanged matches exactly, and an
-        // exact match always wins: a program that wrapped one failure's message
-        // around another's must not have the wrong type attached. Containment is
-        // the fallback, so a wrapped message still reports its underlying type
-        // rather than losing it to prose.
-        let invocationFailure;
-        for (const match of [
-            (candidate) => outcome.error !== "" &&
-                [candidate.message, guestFailureFrames.get(candidate)].includes(outcome.error),
-            (candidate) => [candidate.message, guestFailureFrames.get(candidate)].some((message) => 
-            // E6: empty or tiny prose cannot identify a wrapped failure.
-            message !== undefined &&
-                message.length >= 8 &&
-                outcome.error?.includes(message) === true),
-        ]) {
-            for (let i = invocationFailures.length - 1; i >= 0; i--) {
-                const candidate = invocationFailures[i];
-                if (candidate && match(candidate)) {
-                    invocationFailure = candidate;
-                    break;
-                }
-            }
-            if (invocationFailure)
-                break;
-        }
-        if (invocationFailure) {
-            // E1/X11: return the same bounded details the guest received.
-            return failureResponse(invocationFailure.details.message, {
+        const failure = outcome.failure?.call;
+        if (outcome.failure?.timeout) {
+            const { elapsedMs, deadlineMs } = outcome.failure.timeout;
+            const message = `Operation "execute_code" timed out during sandbox after ${elapsedMs}ms (effective deadline ${deadlineMs}ms).`;
+            return failureResponse(message, {
                 logs,
                 emitted,
                 diagnostics,
-                code: invocationFailure.details,
+                code: {
+                    code: "timeout",
+                    message,
+                    retryable: false,
+                    details: { operation: "execute_code", stage: "sandbox", elapsedMs, deadlineMs },
+                },
             });
         }
-        const message = `Error: ${outcome.error || "Execution failed without an error message."}`;
-        return failureResponse(message, {
+        return failureResponse(failure?.message ?? outcome.error, {
             logs,
             emitted,
             diagnostics,
-            code: "executor_failed",
+            code: failure ??
+                programError({
+                    name: outcome.failure?.name ?? /^(SyntaxError|ReferenceError|TypeError|RangeError):/.exec(outcome.error)?.[1],
+                    message: outcome.error || "Execution failed without an error message.",
+                    ...(outcome.failure?.line !== undefined ? { line: outcome.failure.line - 1 } : {}),
+                }, program),
         });
     }
     // A result crossing back as a host BigInt (or otherwise unserializable
@@ -762,7 +1257,7 @@ function finishedRun(outcome, { emitted, diagnostics, invocationFailures }) {
     // error path so captured logs survive instead of a raw SDK 500.
     let result;
     try {
-        result = guardExecuteResultValue(outcome.result);
+        result = await guardResult(outcome.result, MAX_EXECUTE_RESULT_CHARS - emitted.textChars);
     }
     catch (err) {
         const message = `Error: result is not JSON-serializable: ${msg(err)}`;
@@ -794,33 +1289,20 @@ function executeLogs(value) {
 }
 function failureResponse(message, options) {
     const { logs, emitted, diagnostics, code } = options;
-    if (diagnostics || typeof code !== "string") {
-        const result = jsonResult({
-            error: typeof code === "string"
-                ? { code, message, retryable: false }
-                : code,
-            ...(logs ? { logs } : {}),
-            ...(emitted ? discardedEmits(emitted) : {}),
-            ...(diagnostics ? { diagnostics: diagnostics.finish() } : {}),
-        });
-        result.isError = true;
-        return result;
-    }
-    return errorResult(`${message}${logs ? `\n\nLogs:\n${logs}` : ""}${emitted ? discardedEmitsText(emitted) : ""}`);
+    const result = jsonResult({
+        error: typeof code === "string" ? { code, message, retryable: false } : code,
+        ...(logs ? { logs } : {}),
+        ...(emitted ? discardedEmits(emitted) : {}),
+        ...(diagnostics ? { diagnostics: diagnostics.finish() } : {}),
+    });
+    result.isError = true;
+    return result;
 }
 /**
  * A failed program delivers no blocks and reports how many were discarded.
  */
 function discardedEmits(emitted) {
-    return emitted.blocks.length > 0
-        ? { emittedDiscarded: emitted.blocks.length }
-        : {};
-}
-/** The same visibility for the plain-text error paths. */
-function discardedEmitsText(emitted) {
-    return emitted.blocks.length > 0
-        ? `\n\nemittedDiscarded: ${emitted.blocks.length}`
-        : "";
+    return emitted.blocks.length > 0 ? { emittedDiscarded: emitted.blocks.length } : {};
 }
 function connectorInventory(connectors) {
     const prefix = "Connectors: ";
@@ -829,14 +1311,10 @@ function connectorInventory(connectors) {
     const entries = connectors.map((connector) => {
         const address = connector.id;
         const title = connector.title?.replace(/\s+/g, " ").trim();
-        const label = title && title !== connector.id
-            ? `${address}: ${boundedEchoText(title, 45)}`
-            : address;
+        const label = title && title !== connector.id ? `${address}: ${boundedEchoText(title, 45)}` : address;
         if (!connectorGuide(connector))
             return label;
-        const requirement = connectorGuideRequired(connector)
-            ? "required guide"
-            : "guide";
+        const requirement = connectorGuideRequired(connector) ? "required guide" : "guide";
         return `${label} (${requirement} ${connectorSkillName(connector.id)})`;
     });
     const shown = [];
@@ -858,29 +1336,26 @@ function connectorInventory(connectors) {
         return `${prefix}${shown.join(", ")}.`;
     return `${prefix}${shown.join(", ")}${shown.length > 0 ? "; " : ""}+${omitted} more.`;
 }
-const executeDescription = (emitBudgets, hostLimits, connectorGuides, connectors, maxWrites) => `Use the configured services below to answer the task. A known address uses call_tool. Unknown-address and wider read-only work uses one execute_code program for discovery, calls, and reduction. Do not return catalog matches alone. Only readOnlyHint: true tools and config-exempt writes are available; any other write goes through call_destructive_tool. Limits: ${hostLimits.maxHostCalls} host calls, ${maxWrites} exempt writes, ${hostLimits.hostCallTimeoutMs / 1_000}s/host call.
-
+const executeDescription = (emitBudgets, hostLimits, connectorGuides, connectors, maxWrites, trust) => `One known read: call_tool. One known write: call_destructive_tool. Everything else: execute_code. ${trust === "trusted" ? "Trusted pool: programs may read and write; the host approves the program as a write." : "Read-only pool: programs read; writes use call_destructive_tool."} Limits: ${hostLimits.maxHostCalls} host calls, ${maxWrites} writes, ${hostLimits.hostCallTimeoutMs / 1_000}s/host call.
 ${connectorInventory(connectors)}
 
-Read guides with top-level skills. Write async () => { ... } using the global connecta:
-- connecta.search({ connector, query, safety: "readOnly", includeSchemas: "json" }) returns { tools }. Search operations separately; choose by connectorTitle and schema.required/.properties, never guessed fields. Compact schemas are text.
-- connecta.describe({ address }) clarifies schemas.
-- connecta.call(address, args) returns the provider value directly.
-- Use Promise.all for independent calls, or Promise.allSettled to retain failures. Check status; missing values are unknown, never false or zero.
-- connecta.emit(block): { type: "text", text } or { type: "image" | "audio", data (base64), mimeType }; success-only, ${emitBudgets.maxBlocks} blocks/${emitBudgets.maxBytes} bytes. console.log(...) is captured.
+Use async () => { ... }, no arguments. No portable ambient capabilities. API:
+\`\`\`ts
+declare const connecta: {
+${GUEST_API_DECLARATION}
+};
+\`\`\`
+Search: {tools}, catalogErrors. JSON schemas default; compact text. Calls: {data, format:"json"|"text"}; >1 MiB: paged handle. Oversized returns: resultId/nextAction. connecta.result pages; UTF-8 byte offsets. allSettled keeps typed errors; host budget_exceeded ends the run.
 
-No portable ambient capabilities. Return reduced JSON. Sample unfamiliar reads. Reduce a one-time write's full result here, or use a direct call and get_result paging; never repeat it to recover output. Never guess fields or use the whole text as an id. Top-level skills({ name: "usage" }): repair${connectorGuides ? ", guide handling" : ""}; skills({ name: "investigate" }): task planning.`;
-// Module scope, like the other six meta-tool inputs: its JSON Schema is
+Never repeat writes for output. emit(result) or emit(block) from result.content forwards MCP blocks. Authored: text/base64 image/audio; no await. Caps: ${emitBudgets.maxBlocks} blocks/${emitBudgets.maxBytes} bytes. Text shares result cap. skills({ name: "investigate" }): workflow; skills({ name: "usage" }): repair${connectorGuides ? ", guide handling" : ""}.`;
+// Module scope, like the other five meta-tool inputs: its JSON Schema is
 // derived once per process. Budgets and connectors vary by deployment and
 // view, so they live in the description, never here.
 const EXECUTE_INPUT = advertisedSchema(z.object({
     code: z
         .string()
         .describe("One complete zero-argument JavaScript async arrow: async () => { ... }. Use the provided connecta global to discover, call, and return the reduced answer. At most 65,536 UTF-8 bytes."),
-    diagnostics: z
-        .boolean()
-        .optional()
-        .describe("Add request-local, payload-free timing and result-size summaries."),
+    diagnostics: z.boolean().optional().describe("Add request-local, payload-free timing and result-size summaries."),
 }));
 /** Register the execute_code meta-tool. Only called when an executor is configured. */
 export function registerExecuteTool(server, registry, ctx) {
@@ -899,6 +1374,7 @@ export function registerExecuteTool(server, registry, ctx) {
     const connectors = registry.listConnectors();
     const maxWrites = resolveBudget(ctx.maxWrites, DEFAULT_MAX_WRITES);
     const execute = createExecuteTool(registry, ctx.baseUrl, ctx.executor, ctx.logger, ctx.activity, {
+        defaultToolTimeoutMs: ctx.defaultToolTimeoutMs,
         discoveryConcurrency: ctx.discoveryConcurrency,
         probeTimeoutMs: ctx.probeTimeoutMs,
         maxEmittedBytes: emitBudgets.maxBytes,
@@ -907,25 +1383,29 @@ export function registerExecuteTool(server, registry, ctx) {
         hostCallTimeoutMs: hostLimits.hostCallTimeoutMs,
         watchdogMs: ctx.watchdogMs,
         defer: ctx.defer,
-        approval: ctx.approval,
+        trust: ctx.trust,
         maxWrites,
+        requestScope: ctx.requestScope,
     });
     server.registerTool("execute_code", {
-        description: executeDescription(emitBudgets, hostLimits, hasConnectorGuides(connectors), connectors, maxWrites),
+        description: executeDescription(emitBudgets, {
+            ...hostLimits,
+            hostCallTimeoutMs: normalizeTimeoutMs(ctx.defaultToolTimeoutMs) ?? hostLimits.hostCallTimeoutMs,
+        }, hasConnectorGuides(connectors), connectors, maxWrites, ctx.trust ?? "read-only"),
         inputSchema: EXECUTE_INPUT,
-        // This hint describes connector calls: only explicitly read-only ones
-        // run here, plus the writes config exempts from asking (W12) — the
-        // deployment's decision, which no annotation can make for it. Any
-        // other write is refused (E4) and crosses call_destructive_tool, which
-        // is annotated destructive. The supported executor constructions deny
-        // outbound access, filesystem, and deployment config; X5 documents
-        // Dynamic runtime modules separately.
+        outputSchema: EXECUTE_OUTPUT,
+        // The host sees execute_code as a write only on a trusted endpoint.
         annotations: {
-            readOnlyHint: true,
-            destructiveHint: false,
+            readOnlyHint: ctx.trust !== "trusted",
+            destructiveHint: ctx.trust === "trusted",
             openWorldHint: true,
         },
-    }, (args, extra) => underAnySignal([extra.mcpReq.signal, ctx.requestSignal], (signal) => execute(args, {
-        signal,
-    })));
+    }, (args, extra) => {
+        if (ctx.client)
+            bindMcpClient(extra, ctx.client, ctx.activity);
+        const run = () => underAnySignal([extra.mcpReq.signal, ctx.requestSignal], (signal) => execute(args, {
+            signal,
+        }));
+        return ctx.authElicitation ? ctx.authElicitation.run("execute_code", args, extra, run) : run();
+    });
 }