@zackbart/connecta 0.29.0 → 0.30.0

package/dist/execute.js

@@ -5,8 +5,9 @@ import { Cause, Deferred, Duration, Effect, Exit } from "effect";
 import { z } from "zod";
 import { advertisedSchema } from "./advertised-schema.js";
 import { boundedDiscoveryText, CatalogService, DiscoveryPolicyError, flatSearchResult, } from "./catalog-service.js";
-import { createMetaTools, jsonResult } from "./meta-tools.js";
-import { guardExecuteResultValue, MAX_EXECUTE_LOG_CHARS, MAX_EXECUTE_RESULT_CHARS, truncateExecuteText, } from "./executor-result.js";
+import { createMetaTools, guardProgramReturn, jsonResult, pageProgramResult, } from "./meta-tools.js";
+import { PROGRAM_RESULT_INLINE_BYTES, PROGRAM_RESULT_PAGE_BYTES, PROGRAM_RESULT_WIRE_BYTES, } from "./program-result.js";
+import { MAX_EXECUTE_LOG_CHARS, MAX_EXECUTE_RESULT_CHARS, truncateExecuteText } from "./executor-result.js";
 import { ExecutorAdmissionError, ExecutorExecutionError, isAdmittingExecutor } from "./executor-admission.js";
 import { boundedEchoText, ConnectorCallError, msg } from "./errors.js";
 import { DEFAULT_MAX_WRITES, ProgramWrites, writeStateOf } from "./program-writes.js";
@@ -118,6 +119,10 @@ class ExecuteDiagnostics {
         };
     }
 }
+/**
+ * Guest-authored blocks exclude pointers (INV-3). Native call blocks are
+ * retained on the host and forwarded only through request-local references.
+ */
 const EMIT_SHAPE_HINT = '{ type: "text", text } or { type: "image" | "audio", data (base64), mimeType }';
 /**
  * Strict M1 validation: required fields present and string-valued, nothing
@@ -175,26 +180,142 @@ export class EmitCollector {
         this.diagnostics = diagnostics;
     }
     accept(raw) {
-        const block = requireEmittedBlock(raw);
-        if (this.blocks.length >= this.maxBlocks) {
-            // M5: distinguish exhausted block slots from the remaining byte budget.
-            throw guestFailure("budget_exceeded", `connecta.emit block-count budget exceeded: ${this.maxBlocks} block(s) maximum, 0 blocks remaining; ${this.maxBytes - this.bytes} of ${this.maxBytes} serialized bytes remaining`);
-        }
-        const size = diagnosticsEncoder.encode(JSON.stringify(block)).byteLength;
-        if (this.bytes + size > this.maxBytes) {
-            throw guestFailure("budget_exceeded", `connecta.emit byte budget exceeded: block is ${size} serialized bytes with ${this.maxBytes - this.bytes} of ${this.maxBytes} remaining`);
-        }
-        const textChars = block.type === "text" ? JSON.stringify(block).length : 0;
-        // Reserve space for a reduced result envelope even if text fills the budget.
-        if (this.textChars + textChars > MAX_EXECUTE_RESULT_CHARS - 512) {
-            throw guestFailure("result_too_large", "Emitted text shares the 24,000-character program result limit. Reduce the text before emitting it.");
+        this.acceptNative([requireEmittedBlock(raw)]);
+    }
+    /** Only the host's retained downstream result may enter this path. */
+    acceptNative(blocks) {
+        let bytes = this.bytes;
+        let textChars = this.textChars;
+        let count = this.blocks.length;
+        for (const block of blocks) {
+            if (count >= this.maxBlocks) {
+                throw guestFailure("budget_exceeded", `connecta.emit block-count budget exceeded: ${this.maxBlocks} block(s) maximum, 0 blocks remaining; ${this.maxBytes - bytes} of ${this.maxBytes} serialized bytes remaining`);
+            }
+            const serialized = JSON.stringify(block);
+            const size = diagnosticsEncoder.encode(serialized).byteLength;
+            if (bytes + size > this.maxBytes) {
+                throw guestFailure("budget_exceeded", `connecta.emit byte budget exceeded: block is ${size} serialized bytes with ${this.maxBytes - bytes} of ${this.maxBytes} remaining`);
+            }
+            textChars += block.type === "text" ? serialized.length : 0;
+            // Embedded resource text shares the result cap too; binary blobs use
+            // the transport budget, just like images and audio.
+            if (block.type === "resource" && "text" in block.resource)
+                textChars += serialized.length;
+            if (textChars > MAX_EXECUTE_RESULT_CHARS - 512) {
+                throw guestFailure("result_too_large", "Emitted text shares the 24,000-character program result limit. Reduce the text before emitting it.");
+            }
+            count++;
+            bytes += size;
         }
-        this.textChars += textChars;
-        this.blocks.push(block);
-        this.bytes += size;
+        this.textChars = textChars;
+        this.bytes = bytes;
+        this.blocks.push(...blocks);
         this.diagnostics?.recordEmitted(this.blocks.length, this.bytes);
     }
 }
+/** Bound both JSON size and object amplification before retaining native blocks. */
+class NativePresentationLimit extends Error {
+}
+function boundedNativeValue(value, maxBytes, copy) {
+    let bytes = 0;
+    let nodes = 0;
+    // Empty objects cost only two JSON bytes but much more heap. Derive the
+    // allocation ceiling from the transport budget, with a fixed stack ceiling.
+    const maxNodes = Math.floor(Math.min(maxBytes, PROGRAM_RESULT_INLINE_BYTES) / 32);
+    const active = new Set();
+    const charge = (size) => {
+        bytes += size;
+        if (bytes > maxBytes)
+            throw new NativePresentationLimit();
+    };
+    const string = (text) => {
+        // Count JSON escapes and UTF-8 directly, without allocating a potentially
+        // six-times-larger escaped string or byte buffer just to reject it.
+        if (text.length > maxBytes - bytes)
+            throw new NativePresentationLimit();
+        charge(2);
+        for (let i = 0; i < text.length; i++) {
+            const unit = text.charCodeAt(i);
+            if (unit === 34 || unit === 92 || unit === 8 || unit === 9 || unit === 10 || unit === 12 || unit === 13)
+                charge(2);
+            else if (unit < 32)
+                charge(6);
+            else if (unit < 128)
+                charge(1);
+            else if (unit < 2048)
+                charge(2);
+            else if (unit >= 0xd800 &&
+                unit <= 0xdbff &&
+                text.charCodeAt(i + 1) >= 0xdc00 &&
+                text.charCodeAt(i + 1) <= 0xdfff) {
+                charge(4);
+                i++;
+            }
+            else
+                charge(unit >= 0xd800 && unit <= 0xdfff ? 6 : 3);
+        }
+    };
+    const visit = (item, depth) => {
+        if (++nodes > maxNodes || depth > 64)
+            throw new NativePresentationLimit();
+        if (typeof item === "string") {
+            string(item);
+            return item;
+        }
+        if (item === null || typeof item === "boolean" || typeof item === "number") {
+            charge(JSON.stringify(item).length);
+            return item;
+        }
+        if (typeof item !== "object" || active.has(item))
+            throw new NativePresentationLimit();
+        const array = Array.isArray(item);
+        if (![array ? Array.prototype : Object.prototype, null].includes(Object.getPrototypeOf(item)))
+            throw new NativePresentationLimit();
+        const jsonHook = Object.getOwnPropertyDescriptor(item, "toJSON");
+        if (jsonHook && (!("value" in jsonHook) || typeof jsonHook.value === "function"))
+            throw new NativePresentationLimit();
+        active.add(item);
+        charge(2);
+        if (array) {
+            if (item.length > maxNodes - nodes)
+                throw new NativePresentationLimit();
+            const result = copy ? [] : undefined;
+            for (let i = 0; i < item.length; i++) {
+                if (i)
+                    charge(1);
+                const descriptor = Object.getOwnPropertyDescriptor(item, String(i));
+                if (descriptor && !("value" in descriptor))
+                    throw new NativePresentationLimit();
+                const child = visit(descriptor?.value ?? null, depth + 1);
+                result?.push(child);
+            }
+            active.delete(item);
+            return result;
+        }
+        const result = copy ? {} : undefined;
+        let first = true;
+        for (const key in item) {
+            const descriptor = Object.getOwnPropertyDescriptor(item, key);
+            if (!descriptor?.enumerable)
+                continue;
+            if (!("value" in descriptor))
+                throw new NativePresentationLimit();
+            if (descriptor.value === undefined)
+                continue;
+            if (!first)
+                charge(1);
+            first = false;
+            string(key);
+            charge(1);
+            const child = visit(descriptor.value, depth + 1);
+            if (result)
+                Object.defineProperty(result, key, { value: child, enumerable: true, writable: true, configurable: true });
+        }
+        active.delete(item);
+        return result;
+    };
+    return { value: visit(value, 0), bytes };
+}
 /** A positive whole-number budget, or the default when the value is unusable. */
 function resolveBudget(value, fallback) {
     return typeof value === "number" && Number.isFinite(value) && value >= 1 ? Math.trunc(value) : fallback;
@@ -320,6 +441,20 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
     stopped.catch(() => { });
     const maxWrites = resolveBudget(limits.maxWrites, DEFAULT_MAX_WRITES);
     let writes = 0;
+    // These are transfer cursors only. All result bytes live in the existing stash.
+    const transfers = new Map();
+    const nativeResults = new Map();
+    const transportResult = (value) => {
+        if (value.format === "paged") {
+            const handle = value;
+            if (handle.resultId && handle.totalBytes <= PROGRAM_RESULT_INLINE_BYTES) {
+                const transfer = `transfer:${crypto.randomUUID()}`;
+                transfers.set(transfer, { id: handle.resultId, offset: 0 });
+                return { transfer, handle };
+            }
+        }
+        return value;
+    };
     /** Budget and account for writes admitted by the pool trust decision. */
     const invocationContext = (sending, timeoutMs) => ({
         source: "execute_code",
@@ -329,6 +464,86 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
         ...(limits.dispatchController ? { dispatchSignal: limits.dispatchController.signal } : {}),
         unwrapResult: true,
         trust: limits.trust,
+        processResult: async (value, resolved, secrets, format, raw) => {
+            const page = (data, valueFormat, wireBytes) => pageProgramResult(registry, baseUrl, resolved, data, valueFormat, secrets, limits.trust, requestScope, wireBytes);
+            const envelope = resolved.connector.kind === "mcp" && raw !== null && typeof raw === "object"
+                ? raw
+                : undefined;
+            const dataKey = envelope
+                ? "toolResult" in envelope
+                    ? "toolResult"
+                    : envelope.structuredContent !== undefined
+                        ? "structuredContent"
+                        : undefined
+                : undefined;
+            // Preserve #788 before even inspecting presentation. Paging serializes
+            // the structured value synchronously; no native metadata is visited.
+            if (dataKey !== undefined &&
+                diagnosticsEncoder.encode(JSON.stringify(value)).byteLength > PROGRAM_RESULT_INLINE_BYTES) {
+                return page(value, format, PROGRAM_RESULT_WIRE_BYTES - 1024);
+            }
+            const content = envelope?.content;
+            if (!Array.isArray(content) ||
+                !content.some((block) => block && ["image", "audio", "resource", "resource_link"].includes(block.type))) {
+                return transportResult(await page(value, format));
+            }
+            const unavailablePresentation = () => ({
+                format: "paged",
+                valueFormat: "json",
+                totalBytes: 0,
+                truncated: true,
+                hint: "Paging is unavailable. Native presentation exceeds byte, node or depth limits, or is not acyclic JSON. Reduce the downstream presentation before forwarding it.",
+            });
+            let snapshot;
+            let retained;
+            try {
+                // Oversized but bounded envelopes may still use the existing stash.
+                // Measure without copying them; only inline native blocks are retained.
+                const measured = boundedNativeValue(envelope, Math.max(EXECUTE_MAX_EMITTED_BYTES, limits.emitCollector?.maxBytes ?? 0), false);
+                if (measured.bytes <= PROGRAM_RESULT_INLINE_BYTES) {
+                    retained = boundedNativeValue(content, PROGRAM_RESULT_INLINE_BYTES, true).value;
+                    snapshot = { ...envelope, content: retained };
+                }
+                else {
+                    snapshot = envelope;
+                }
+            }
+            catch (error) {
+                if (!(error instanceof NativePresentationLimit))
+                    throw error;
+                const result = dataKey === undefined ? undefined : transportResult(await page(value, format));
+                const notice = unavailablePresentation();
+                return result ? { value: result, native: { value: notice } } : notice;
+            }
+            // Snapshot blocks before either stash operation yields. Start both
+            // serializations now so an oversized presentation's pages also own the
+            // original bytes even if the structured-data stash pauses.
+            const resultPending = dataKey === undefined ? undefined : page(value, format, PROGRAM_RESULT_WIRE_BYTES - 1024);
+            const nativePending = page(snapshot, "json");
+            const result = await resultPending;
+            const native = await nativePending;
+            let valueResult;
+            if (native.format === "paged") {
+                valueResult = result ? transportResult(result) : undefined;
+                if (!native.resultId || native.totalBytes > PROGRAM_RESULT_INLINE_BYTES) {
+                    return valueResult ? { value: valueResult, native: { value: native } } : native;
+                }
+            }
+            // Redaction can shrink an oversized original below the inline cap. It
+            // still has no retained snapshot: keep its handle, never mint a ref to
+            // absent or connector-owned blocks.
+            if (!retained) {
+                const notice = native.format === "paged" ? native : unavailablePresentation();
+                const valueResult = result ? transportResult(result) : undefined;
+                return valueResult ? { value: valueResult, native: { value: notice } } : notice;
+            }
+            const ref = crypto.randomUUID();
+            nativeResults.set(ref, retained);
+            return {
+                ...(valueResult ? { value: valueResult } : {}),
+                native: { ref, value: transportResult(native), dataKey },
+            };
+        },
         beforeWrite: (target) => Effect.sync(() => {
             if (programWrites?.isClosed) {
                 return {
@@ -391,15 +606,36 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
             hostCallTimeoutMs;
         const timeoutMs = Math.min(requestedMs, Math.max(1, (limits.programDeadlineAt ?? Infinity) - Date.now()));
         // A trusted-pool write settles here — unknown if the call never returned an
-        // outcome.
+        // outcome. Credentials are filtered from arguments; submitted private values are not.
         const sending = {};
         const outcome = yield* invocation
-            .pipeline(address, sentSecrets.redact(args ?? {}), invocationContext(sending, timeoutMs))
+            .pipeline(address, sentSecrets.redactCredentials(args ?? {}), invocationContext(sending, timeoutMs))
             .pipe(Effect.onExit((exit) => Effect.sync(() => sending.settle?.(Exit.isSuccess(exit) ? writeStateOf(exit.value) : "unknown"))));
+        if (outcome.resolved) {
+            const resolved = outcome.resolved;
+            limits.resultDependencies?.push({
+                connector: resolved.connector.id,
+                tool: resolved.definition.name,
+                classification: outcome.dispatched && resolved.definition.classification !== "read" ? "write" : "read",
+                // A refusal exposes catalog metadata, not a completed write's result.
+                ...(!outcome.dispatched ? { access: "catalog" } : {}),
+            });
+        }
+        else {
+            // Resolution failures can expose a catalog error or connector metadata
+            // without ever finding a tool. Such bytes depend on connector visibility,
+            // not on the existence of the requested (possibly unknown) tool.
+            const target = registry.resolveAddress(address);
+            if (target)
+                catalogDependency(target.connector.id);
+            if (!outcome.ok)
+                for (const connector of outcome.error.configuredConnectors ?? [])
+                    catalogDependency(connector);
+        }
         diagnostics?.recordCall(outcome);
-        return outcome.ok
-            ? { data: outcome.value, format: outcome.format }
-            : yield* Effect.fail(new InvocationFailure(outcome.error));
+        if (!outcome.ok)
+            return yield* Effect.fail(new InvocationFailure(outcome.error));
+        return outcome.value;
     });
     // Discovery gets the same treatment from here (L2): once the run has
     // ended no search or describe starts, and one still in flight fails
@@ -419,24 +655,58 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                 ? Effect.fail(cancelled())
                 : Effect.raceAllFirst([reading, fromSignal(hostAccessSignal).pipe(Effect.mapError(cancelled))])).pipe(Effect.onExit((exit) => Effect.sync(() => diagnostics?.recordCatalog(operation, Date.now() - started, Exit.isSuccess(exit), Exit.isSuccess(exit) ? exit.value : undefined))));
     });
-    const meta = createMetaTools(registry, baseUrl, { trust: limits.trust, requestScope });
+    const meta = createMetaTools(registry, baseUrl, {
+        trust: limits.trust,
+        requestScope,
+        onResultRead: (dependencies) => limits.resultDependencies?.push(...dependencies),
+    });
+    const catalogDependency = (connector, tool) => {
+        if (registry.getConnector(connector))
+            limits.resultDependencies?.push({
+                connector,
+                ...(tool ? { tool } : {}),
+                classification: "read",
+                access: "catalog",
+            });
+    };
+    const catalogAddressDependency = (address) => {
+        const resolved = registry.resolveAddress(address);
+        if (resolved)
+            catalogDependency(resolved.connector.id, resolved.toolName);
+    };
     const operations = {
         call,
         result: (id, options, signal) => Effect.tryPromise({
             try: async () => {
+                const transfer = typeof id === "string" ? transfers.get(id) : undefined;
+                const transferId = id;
+                if (transfer) {
+                    id = transfer.id;
+                    options = { offset: transfer.offset, maxBytes: PROGRAM_RESULT_PAGE_BYTES };
+                }
+                else if (id !== null && typeof id === "object" && !Array.isArray(id)) {
+                    id = id.resultId;
+                }
                 if (typeof id !== "string" ||
                     (!options && options !== undefined) ||
                     (options !== undefined && (typeof options !== "object" || Array.isArray(options)))) {
-                    throw guestFailure("invalid_args", "Use connecta.result(id, { offset?, maxBytes? }).");
+                    throw guestFailure("invalid_args", "Use connecta.result(handleOrId, { page?, offset?, maxBytes? }).");
                 }
-                const args = (options ?? {});
-                if (Object.keys(args).some((key) => !["offset", "maxBytes"].includes(key)) ||
+                const args = { ...(options ?? {}) };
+                if (Object.keys(args).some((key) => !["page", "offset", "maxBytes"].includes(key)) ||
+                    (args.page !== undefined &&
+                        (typeof args.page !== "number" ||
+                            !Number.isSafeInteger(args.page) ||
+                            args.page < 0 ||
+                            args.offset !== undefined)) ||
                     (args.offset !== undefined &&
                         (typeof args.offset !== "number" || !Number.isSafeInteger(args.offset) || args.offset < 0)) ||
                     (args.maxBytes !== undefined &&
                         (typeof args.maxBytes !== "number" || !Number.isSafeInteger(args.maxBytes) || args.maxBytes < 1))) {
-                    throw guestFailure("invalid_args", "Use connecta.result(id, { offset?, maxBytes? }) with whole byte offsets >= 0 and maxBytes >= 1.");
+                    throw guestFailure("invalid_args", "Use connecta.result(handleOrId, { page?, offset?, maxBytes? }) with whole page/offset >= 0 and maxBytes >= 1; page and offset are mutually exclusive.");
                 }
+                // A page must fit every shipped bridge even when the connector cap is raised.
+                args.maxBytes = Math.min(args.maxBytes ?? PROGRAM_RESULT_PAGE_BYTES, PROGRAM_RESULT_PAGE_BYTES);
                 const page = await meta.readResult({ id, ...args }, { signal: signal });
                 if (page.isError)
                     throw new InvocationFailure((page.structuredContent?.error ?? {
@@ -444,6 +714,12 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                         message: page.content[0]?.text ?? "Result unavailable.",
                         retryable: false,
                     }));
+                if (transfer) {
+                    if (page.structuredContent?.hasMore)
+                        transfer.offset = page.structuredContent.nextOffset;
+                    else
+                        transfers.delete(transferId);
+                }
                 return page.structuredContent;
             },
             catch: (err) => err,
@@ -455,6 +731,11 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                 const skills = new SkillsRegistry(registry, baseUrl, {
                     requestScope,
                     requestSignal: utilitySignal ?? hostAccessSignal,
+                    onRead: (connector, source) => limits.resultDependencies?.push({
+                        connector: connector.id,
+                        classification: "read",
+                        ...(source === "local" ? { access: "catalog" } : {}),
+                    }),
                     probeTimeoutMs: limits.probeTimeoutMs,
                     defer: limits.defer,
                 });
@@ -470,6 +751,7 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                 requestScope,
                 sentSecrets,
                 timeoutMs: hostCallTimeoutMs,
+                onResolved: (connector) => limits.resultDependencies?.push({ connector: connector.id, classification: "read" }),
                 onConnectorTime: (elapsed) => {
                     connectorMs += elapsed;
                 },
@@ -485,7 +767,26 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                 if (!limits.emitCollector) {
                     throw guestFailure("unavailable", "connecta.emit is unavailable: no emission collector was configured for this execution", true);
                 }
-                limits.emitCollector.accept(sentSecrets.redact(block));
+                if (block !== null && typeof block === "object" && "contentResult" in block) {
+                    throw guestFailure("result_too_large", "Native content is not inline; page result.contentResult with connecta.result and reduce it before emitting.");
+                }
+                if (block !== null && typeof block === "object" && !Array.isArray(block) && "ref" in block) {
+                    const reference = block;
+                    const native = typeof reference.ref === "string" ? nativeResults.get(reference.ref) : undefined;
+                    if (!native ||
+                        Object.keys(reference).some((key) => !["ref", "index"].includes(key)) ||
+                        (reference.index !== undefined &&
+                            (typeof reference.index !== "number" ||
+                                !Number.isSafeInteger(reference.index) ||
+                                reference.index < 0 ||
+                                reference.index >= native.length))) {
+                        throw guestFailure("invalid_args", "connecta.emit requires a native result from this program's connecta.call.");
+                    }
+                    const blocks = reference.index === undefined ? native : [native[reference.index]];
+                    limits.emitCollector.acceptNative(sentSecrets.redact(blocks));
+                }
+                else
+                    limits.emitCollector.accept(sentSecrets.redact(block));
             },
             catch: (err) => err,
         }),
@@ -497,12 +798,35 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                 includeSchemaKeys: args.includeSchemaKeys !== false,
             }));
             boundedDiscoveryText(result, "Request a smaller limit, omit fullDescriptions, use compact schemas, or pass includeSchemaKeys: false.");
+            for (const tool of result.tools)
+                catalogAddressDependency(tool.address);
+            for (const error of result.catalogErrors)
+                catalogDependency(error.connector);
+            for (const connector of result.absence?.configuredConnectors ?? [])
+                catalogDependency(connector);
+            for (const connector of result.queryAnalysis?.configuredConnectors ?? [])
+                catalogDependency(connector);
+            if (result.queryAnalysis?.connectorScope)
+                catalogDependency(result.queryAnalysis.connectorScope);
             return result;
         }),
         describe: (raw) => discovery("describe", async () => {
             const args = (raw ?? {});
             const result = { tools: await catalog.describe({ ...args, format: args.format ?? "json" }) };
             boundedDiscoveryText(result, 'Split the address list or use format: "compact".');
+            for (const tool of result.tools) {
+                if (!tool.error)
+                    catalogAddressDependency(tool.address);
+                else {
+                    const resolved = registry.resolveAddress(tool.address);
+                    if (resolved)
+                        catalogDependency(resolved.connector.id);
+                    for (const connector of tool.errorDetails?.configuredConnectors ?? [])
+                        catalogDependency(connector);
+                    for (const suggestion of tool.errorDetails?.suggestions ?? [])
+                        catalogAddressDependency(suggestion);
+                }
+            }
             return result;
         }),
     };
@@ -511,7 +835,7 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
     const typedFailure = (err) => Effect.suspend(() => {
         if (!(err instanceof InvocationFailure))
             return Effect.fail(err);
-        const failure = boundedGuestFailure(sentSecrets.redact(err));
+        const failure = boundedGuestFailure(redactAgentOutput(sentSecrets, err));
         return Effect.fail(failure);
     });
     return {
@@ -534,7 +858,8 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                 }
                 // L4/M7: spend on entry, before even invalid arguments are checked;
                 // emit has a separate budget and never spends this one.
-                const counted = name !== "emit";
+                // Transparent transfer pages consume the already-admitted call, not guest host calls.
+                const counted = name !== "emit" && !(name === "result" && typeof args[0] === "string" && transfers.has(args[0]));
                 if (counted && ++hostCalls.attempted > maxHostCalls) {
                     hostCalls.failed++;
                     budgetFailure = new HostCallBudgetExceeded(hostCalls, maxHostCalls);
@@ -703,6 +1028,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
         const emitted = new EmitCollector(resolveBudget(config.maxEmittedBytes, EXECUTE_MAX_EMITTED_BYTES), resolveBudget(config.maxEmittedBlocks, EXECUTE_MAX_EMITTED_BLOCKS), diagnostics);
         const hostCalls = { attempted: 0, admitted: 0, succeeded: 0, failed: 0 };
         const programWrites = new ProgramWrites();
+        const resultDependencies = [];
         const dispatchController = new AbortController();
         const terminal = Deferred.makeUnsafe();
         let budgetFailure;
@@ -754,6 +1080,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                 trust: config.trust,
                 maxWrites: config.maxWrites,
                 programWrites,
+                resultDependencies,
                 dispatchController,
             }, requestScope)));
             if (signal.aborted) {
@@ -770,11 +1097,11 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
             }, awaitExecutor(() => (admitted
                 ? admitted.execute(wrapGuestProgram(program), [provider])
                 : executor.execute(wrapGuestProgram(program), [provider])).then((outcome) => {
-                executorLogs = sentSecrets.redact(outcome?.logs);
+                executorLogs = sentSecrets.redact(outcome?.logs, "prose");
                 return sentSecrets.redact(outcome);
             }, (err) => {
                 if (err !== null && typeof err === "object" && "logs" in err) {
-                    executorLogs = sentSecrets.redact(err.logs);
+                    executorLogs = sentSecrets.redact(err.logs, "prose");
                 }
                 throw sentSecrets.redact(err);
             }), signal, { watchdog, terminal: Deferred.await(terminal) }).pipe(Effect.ensuring(Effect.suspend(() => {
@@ -783,13 +1110,18 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                 return programWrites.drain();
             }))));
         });
-        const reported = { emitted, diagnostics, program };
+        const reported = {
+            emitted,
+            diagnostics,
+            program,
+            guardResult: (value, maxChars) => guardProgramReturn(value, registry, baseUrl, [...new Map(resultDependencies.map((dependency) => [JSON.stringify(dependency), dependency])).values()], sentSecrets, config.trust, logger, maxChars, programWrites.hasSucceeded),
+        };
         const exited = Effect.exit(Effect.scoped(run)).pipe(Effect.flatMap((exit) => 
         // Releasing a QuickJS lease ends its child and rejects execute() with
         // the retained log prefix. Give that report one timer turn, just as
         // cancellation does in awaitExecutor; never wait on a Worker isolate.
         budgetFailure ? Effect.sleep(Duration.millis(1)).pipe(Effect.as(exit)) : Effect.succeed(exit)));
-        return Effect.map(Effect.map(exited, (exit) => {
+        return Effect.map(Effect.flatMap(exited, (exit) => {
             // A synchronous fire-and-forget burst can also settle its executor in
             // this turn. The host's terminal refusal always wins over that value.
             if (budgetFailure instanceof HostCallBudgetExceeded) {
@@ -799,12 +1131,12 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                     emitted,
                     diagnostics,
                 });
-                return failed;
+                return Effect.succeed(failed);
             }
             if (Exit.isFailure(exit)) {
-                return failedRun(sentSecrets.redact(Cause.squash(exit.cause)), logger, reported);
+                return Effect.succeed(failedRun(redactAgentOutput(sentSecrets, Cause.squash(exit.cause)), logger, reported));
             }
-            return finishedRun(sentSecrets.redact(exit.value), reported);
+            return Effect.promise(() => finishedRun(redactAgentOutput(sentSecrets, exit.value), reported));
         }), (unfinished) => {
             // Every run response passes through write accounting.
             const response = programWrites.finish(unfinished);
@@ -874,7 +1206,7 @@ function failedRun(err, logger, { emitted, diagnostics, program }) {
     });
 }
 /** The response for an ExecuteResult: the program's error or its value. */
-function finishedRun(outcome, { emitted, diagnostics, program }) {
+async function finishedRun(outcome, { emitted, diagnostics, program, guardResult }) {
     if (outcome === null || typeof outcome !== "object" || Array.isArray(outcome)) {
         return failureResponse("Executor failed: expected an ExecuteResult object.", {
             emitted,
@@ -925,7 +1257,7 @@ function finishedRun(outcome, { emitted, diagnostics, program }) {
     // error path so captured logs survive instead of a raw SDK 500.
     let result;
     try {
-        result = guardExecuteResultValue(outcome.result, MAX_EXECUTE_RESULT_CHARS - emitted.textChars);
+        result = await guardResult(outcome.result, MAX_EXECUTE_RESULT_CHARS - emitted.textChars);
     }
     catch (err) {
         const message = `Error: result is not JSON-serializable: ${msg(err)}`;
@@ -1007,15 +1339,15 @@ function connectorInventory(connectors) {
 const executeDescription = (emitBudgets, hostLimits, connectorGuides, connectors, maxWrites, trust) => `One known read: call_tool. One known write: call_destructive_tool. Everything else: execute_code. ${trust === "trusted" ? "Trusted pool: programs may read and write; the host approves the program as a write." : "Read-only pool: programs read; writes use call_destructive_tool."} Limits: ${hostLimits.maxHostCalls} host calls, ${maxWrites} writes, ${hostLimits.hostCallTimeoutMs / 1_000}s/host call.
 ${connectorInventory(connectors)}
 
-Use async () => { ... }, no arguments, with the connecta global. No portable ambient capabilities. API notation:
+Use async () => { ... }, no arguments. No portable ambient capabilities. API:
 \`\`\`ts
 declare const connecta: {
 ${GUEST_API_DECLARATION}
 };
 \`\`\`
-Discovery: { tools }; check search catalogErrors/absence. JSON schemas default; compact is text. GuestResult is { data, format: "json" | "text" }; inspect format before fields. Pages: text, hasMore, nextOffset in UTF-8 bytes. Promise.allSettled keeps typed failures. Host-call budget_exceeded is terminal, even through catch/allSettled. Runs report hostCalls.
+Search: {tools}, catalogErrors. JSON schemas default; compact text. Calls: {data, format:"json"|"text"}; >1 MiB: paged handle. Oversized returns: resultId/nextAction. connecta.result pages; UTF-8 byte offsets. allSettled keeps typed errors; host budget_exceeded ends the run.
 
-Reduce JSON. Never repeat writes for output. emit: text or base64 image/audio, safe without await, ${emitBudgets.maxBlocks} blocks/${emitBudgets.maxBytes} bytes. Text shares the result cap. skills({ name: "investigate" }): workflow; skills({ name: "usage" }): repair${connectorGuides ? ", guide handling" : ""}.`;
+Never repeat writes for output. emit(result) or emit(block) from result.content forwards MCP blocks. Authored: text/base64 image/audio; no await. Caps: ${emitBudgets.maxBlocks} blocks/${emitBudgets.maxBytes} bytes. Text shares result cap. skills({ name: "investigate" }): workflow; skills({ name: "usage" }): repair${connectorGuides ? ", guide handling" : ""}.`;
 // Module scope, like the other five meta-tool inputs: its JSON Schema is
 // derived once per process. Budgets and connectors vary by deployment and
 // view, so they live in the description, never here.