@zackbart/connecta 0.34.0 → 0.35.0

package/dist/errors.d.ts

@@ -13,7 +13,7 @@ export type ConnectorCallErrorCode = "timeout" | "auth_required" | "downstream_o
  * re-authorizing, or repairing arguments, and a program looping over ids can
  * continue past it where `connector_call_failed` would abort. Map a status
  * here only where the provider distinguishes absence from a permission gap —
- * where it does not (Notion's `object_not_found` covers both), the honest
+ * where one status covers both, the honest
  * code stays `connector_call_failed` or `auth_required` with a message that
  * states the ambiguity (H11).
  */
@@ -89,7 +89,11 @@ export declare function echoedCallArgs(args: unknown, schema?: JsonSchema): {
 };
 /** Optional transport diagnostics; never a URL path or raw runtime message. */
 interface UnavailableDetails {
-    /** Guest program diagnostics; returned to the agent, never operator records. */
+    /**
+     * An error class label: a guest program's, or the class of the caller's own
+     * abort reason behind a direct write whose outcome is unknown. Returned to
+     * the agent, never operator records.
+     */
     name?: string;
     line?: number | null;
     hint?: string;
@@ -139,6 +143,8 @@ export declare class WithheldTextError extends Error {
 }
 /** Agent-visible recovery class for downstream credential failures. */
 export type AuthRecoveryMode = "oauth" | "operator_config" | "unavailable";
+/** Runtime membership in the closed connector taxonomy, checked against its exhaustive table. */
+export declare function isConnectorCallErrorCode(value: unknown): value is ConnectorCallErrorCode;
 /**
  * Throw from `Connector.callTool` (or anything beneath it) to classify a
  * failure exactly. Untyped errors are non-retryable unless a runtime errno
@@ -166,13 +172,24 @@ export declare class ConnectorCallError extends Error {
     /** Bounded schema findings for `invalid_args`; never submitted values. */
     readonly validation: ArgumentValidationDetails | undefined;
     readonly repair: ArgumentRepairDetails | undefined;
-    /** Sanitized transport diagnostics for `unavailable` only. */
+    /**
+     * Sanitized transport diagnostics, for `unavailable` and for a write whose
+     * outcome is unknown (a timeout's errno, an abort's class).
+     */
     readonly details: UnavailableDetails | undefined;
     /**
      * For `conflict` only: where each thing the write touched stands now, e.g.
      * `{ revision: 12, view: 7 }`. Bounded to 20 whole-number entries.
      */
     readonly current: Readonly<Record<string, number>> | undefined;
+    /**
+     * `"unknown"` when the write this call sent may have taken effect, whatever
+     * `code` says: an authorization verdict reached after the downstream already
+     * had the write (a 401, unless the vendor's reviewed evidence says it
+     * authenticates first, or a renewal that failed after one) is still an
+     * unknown outcome (INV-9). Undefined when the code alone tells the outcome.
+     */
+    readonly writeOutcome: "unknown" | undefined;
     constructor(code: ConnectorCallErrorCode, message: string, opts?: {
         retryable?: boolean;
         retryAfterMs?: number;
@@ -181,6 +198,7 @@ export declare class ConnectorCallError extends Error {
         repair?: ArgumentRepairDetails;
         details?: UnavailableDetails;
         current?: Readonly<Record<string, number>>;
+        writeOutcome?: "unknown";
     });
 }
 /** Secret-free payload returned by authorize_connector and auth failures. */
@@ -218,10 +236,15 @@ export interface CallErrorDetails extends Partial<AuthorizationHandoff> {
     connector?: string;
     /** Canonical downstream address the agent may retry after recovery. */
     operation?: string;
-    /** Which safe recovery path `authorize_connector` will return. */
+    /** Safe recovery path for this authentication failure. */
     recovery?: AuthRecoveryMode;
     /** An auth failure followed a write's downstream send. Reconcile before retry. */
     reconciliationRequired?: true;
+    /**
+     * The write this call sent may have taken effect, whatever `code` says (see
+     * {@link ConnectorCallError.writeOutcome}). Check its target before repeating it.
+     */
+    writeOutcome?: "unknown";
     /** The single model-facing entry point for every credential class. */
     nextAction?: {
         tool: "authorize_connector";
@@ -282,7 +305,10 @@ export interface CallErrorDetails extends Partial<AuthorizationHandoff> {
         args?: unknown;
         argsOmitted?: true;
         argsRedacted?: true;
-        /** Facts the connector recorded before dispatch, such as a generated `idempotencyKey`. */
+        /**
+         * Facts the connector recorded before dispatch, such as a generated
+         * `idempotencyKey`: diagnostics. `retry` says when reusing the key is safe.
+         */
         recovery?: Readonly<Record<string, string>>;
     };
     /** Explicit retry guidance; recovery never retries or mutates by itself. */
@@ -290,7 +316,62 @@ export interface CallErrorDetails extends Partial<AuthorizationHandoff> {
 }
 /** Retryability of connecta framing depends only on its code. */
 export declare function framingError(code: ClassificationCode, message: string): CallErrorDetails;
-/** Typed connector verdicts and runtime facts only. Prose never changes a verdict. */
+/**
+ * Attach advice to send the call again (a rate limit's " Back off before
+ * retrying.", a token error's ", then retry authorization") to `error` as a
+ * segment of its own: `error.message` never contains it. It holds for a read
+ * and a known refusal, so output composes it ({@link withResendAdvice}) only
+ * there, after the outcome is decided. No redaction or rewording of the
+ * message can then hide it from removal on a write whose outcome is unknown
+ * (INV-9). A segment that opens a sentence (" Wait…") follows the message;
+ * any other is a clause, placed before the message's closing period.
+ */
+export declare function resendAdvice<T extends object>(error: T, advice: string): T;
+/** The resend advice attached to `from`, if any. */
+export declare function resendAdviceOf(from: unknown): string | undefined;
+export interface KeyResendAdvice {
+    /** The key the advice names, as it was sent. */
+    key: string;
+    advice: string;
+}
+/**
+ * Attach advice that reusing `key` with the same arguments cannot repeat the
+ * write, a segment of its own like {@link resendAdvice}. It holds only where
+ * that key protects the whole logical call (`keyProtectsCall`): one
+ * boundary entered, one write sent, carrying `key`. Attach it only once the
+ * call's ledger shows a dispatched request carrying `key`: a key generated
+ * but never sent protects nothing. Two places compose it. The invocation
+ * sees the whole call and composes it for a served call once
+ * `keyProtectsCall` holds. {@link classifyCallError} composes it for a
+ * dispatched direct call, which has no invocation: only the one boundary that
+ * sent the keyed request attaches it, and any boundary above that one
+ * finalizes the write as unknown, which drops it. Either way the key stays in
+ * the message as a diagnostic.
+ */
+export declare function keyResendAdvice<T extends object>(error: T, key: string, advice: string): T;
+/** The key-reuse advice attached to `from`, if any. */
+export declare function keyResendAdviceOf(from: unknown): KeyResendAdvice | undefined;
+/**
+ * Keep `from`'s resend advice, key-reuse advice included, on `to`, a copy or
+ * rewording of it (redaction, a provider's recovery words). A write already
+ * marked unknown never takes it.
+ */
+export declare function carryResendAdvice(from: unknown, to: unknown): void;
+/** `message` with resend `advice` composed in. Only output calls this. */
+export declare function withResendAdvice(message: string, advice: string | undefined): string;
+/**
+ * Typed connector verdicts and runtime facts only. Prose never changes a
+ * verdict. The message carries the error's resend advice unless its write's
+ * outcome is unknown. This is a direct caller's view, outside any logical
+ * call: key-reuse advice is here only because the one boundary that sent the
+ * keyed request attached it to its own failure, and any boundary above it
+ * finalizes the write as unknown. An invocation composes advice itself.
+ */
 export declare function classifyCallError(err: unknown, fallbackCode?: ClassificationCode): CallErrorDetails;
+/**
+ * {@link classifyCallError} without the resend advice, for a caller that
+ * decides the outcome first and composes the advice only where it holds.
+ */
+export declare function classifyWithoutAdvice(err: unknown, fallbackCode?: ClassificationCode): CallErrorDetails;
 export declare function msg(err: unknown): string;
 export {};

package/dist/errors.js

@@ -1,6 +1,7 @@
 // Typed failure contract for connector tool calls. Web-API only — no node:
 // imports here.
 import { redactCallArguments } from "./argument-redaction.js";
+import { followRedactedCopies } from "./redaction-identity.js";
 const CLASSIFICATION_CODE_TABLE = {
     timeout: true,
     auth_required: true,
@@ -192,6 +193,8 @@ export const NETWORK_ERROR_CODES = new Set([
 function networkCode(value) {
     return typeof value === "string" && value.length <= 32 && NETWORK_ERROR_CODES.has(value) ? value : undefined;
 }
+/** An error class label, as `errorLabel` reports one. */
+const ERROR_CLASS = /^[A-Z][A-Za-z]{0,63}$/;
 function sanitizedUnavailableDetails(details) {
     if (!details)
         return undefined;
@@ -207,7 +210,10 @@ function sanitizedUnavailableDetails(details) {
         }
     }
     const code = networkCode(details.code);
-    return host || code ? { ...(host ? { host } : {}), ...(code ? { code } : {}) } : undefined;
+    const name = typeof details.name === "string" && ERROR_CLASS.test(details.name) ? details.name : undefined;
+    return host || code || name
+        ? { ...(name ? { name } : {}), ...(host ? { host } : {}), ...(code ? { code } : {}) }
+        : undefined;
 }
 /** Runtime fields only: provider prose cannot supply an errno or a deadline. */
 export function networkErrorCode(error) {
@@ -282,6 +288,10 @@ const RETRYABLE_BY_CODE = {
     input_required_limit: false,
     connector_call_failed: false,
 };
+/** Runtime membership in the closed connector taxonomy, checked against its exhaustive table. */
+export function isConnectorCallErrorCode(value) {
+    return typeof value === "string" && Object.hasOwn(RETRYABLE_BY_CODE, value);
+}
 /** Entries a conflict's `current` map may carry. */
 const MAX_CURRENT_ENTRIES = 20;
 const MAX_CURRENT_KEY_CHARS = 128;
@@ -337,23 +347,36 @@ export class ConnectorCallError extends Error {
     /** Bounded schema findings for `invalid_args`; never submitted values. */
     validation;
     repair;
-    /** Sanitized transport diagnostics for `unavailable` only. */
+    /**
+     * Sanitized transport diagnostics, for `unavailable` and for a write whose
+     * outcome is unknown (a timeout's errno, an abort's class).
+     */
     details;
     /**
      * For `conflict` only: where each thing the write touched stands now, e.g.
      * `{ revision: 12, view: 7 }`. Bounded to 20 whole-number entries.
      */
     current;
+    /**
+     * `"unknown"` when the write this call sent may have taken effect, whatever
+     * `code` says: an authorization verdict reached after the downstream already
+     * had the write (a 401, unless the vendor's reviewed evidence says it
+     * authenticates first, or a renewal that failed after one) is still an
+     * unknown outcome (INV-9). Undefined when the code alone tells the outcome.
+     */
+    writeOutcome;
     constructor(code, message, opts = {}) {
         super(message, opts.cause !== undefined ? { cause: opts.cause } : undefined);
         this.name = "ConnectorCallError";
         this.code = code;
         this.retryable = opts.retryable ?? RETRYABLE_BY_CODE[code];
         this.retryAfterMs = normalizeRetryAfterMs(opts.retryAfterMs);
-        this.details = code === "unavailable" ? sanitizedUnavailableDetails(opts.details) : undefined;
+        this.details =
+            code === "unavailable" || opts.writeOutcome === "unknown" ? sanitizedUnavailableDetails(opts.details) : undefined;
         this.validation = code === "invalid_args" ? boundedValidation(opts.validation) : undefined;
         this.repair = code === "invalid_args" ? boundedRepair(opts.repair) : undefined;
         this.current = code === "conflict" ? boundedCurrent(opts.current) : undefined;
+        this.writeOutcome = opts.writeOutcome === "unknown" ? "unknown" : undefined;
     }
 }
 /** Retryability of connecta framing depends only on its code. */
@@ -364,8 +387,94 @@ export function framingError(code, message) {
         retryable: code === "timeout" || code === "unavailable" || code === "rate_limited",
     };
 }
-/** Typed connector verdicts and runtime facts only. Prose never changes a verdict. */
+// Advice to send a call again, kept beside its failure and never inside the
+// failure's message. See resendAdvice.
+const resendAdvices = followRedactedCopies(new WeakMap());
+/**
+ * Attach advice to send the call again (a rate limit's " Back off before
+ * retrying.", a token error's ", then retry authorization") to `error` as a
+ * segment of its own: `error.message` never contains it. It holds for a read
+ * and a known refusal, so output composes it ({@link withResendAdvice}) only
+ * there, after the outcome is decided. No redaction or rewording of the
+ * message can then hide it from removal on a write whose outcome is unknown
+ * (INV-9). A segment that opens a sentence (" Wait…") follows the message;
+ * any other is a clause, placed before the message's closing period.
+ */
+export function resendAdvice(error, advice) {
+    resendAdvices.set(error, advice);
+    return error;
+}
+/** The resend advice attached to `from`, if any. */
+export function resendAdviceOf(from) {
+    return from !== null && typeof from === "object" ? resendAdvices.get(from) : undefined;
+}
+// Advice that reusing an idempotency key cannot repeat the write, kept apart
+// from the failure's message and its other resend advice. See keyResendAdvice.
+const keyAdvices = followRedactedCopies(new WeakMap());
+/**
+ * Attach advice that reusing `key` with the same arguments cannot repeat the
+ * write, a segment of its own like {@link resendAdvice}. It holds only where
+ * that key protects the whole logical call (`keyProtectsCall`): one
+ * boundary entered, one write sent, carrying `key`. Attach it only once the
+ * call's ledger shows a dispatched request carrying `key`: a key generated
+ * but never sent protects nothing. Two places compose it. The invocation
+ * sees the whole call and composes it for a served call once
+ * `keyProtectsCall` holds. {@link classifyCallError} composes it for a
+ * dispatched direct call, which has no invocation: only the one boundary that
+ * sent the keyed request attaches it, and any boundary above that one
+ * finalizes the write as unknown, which drops it. Either way the key stays in
+ * the message as a diagnostic.
+ */
+export function keyResendAdvice(error, key, advice) {
+    keyAdvices.set(error, { key, advice });
+    return error;
+}
+/** The key-reuse advice attached to `from`, if any. */
+export function keyResendAdviceOf(from) {
+    return from !== null && typeof from === "object" ? keyAdvices.get(from) : undefined;
+}
+/**
+ * Keep `from`'s resend advice, key-reuse advice included, on `to`, a copy or
+ * rewording of it (redaction, a provider's recovery words). A write already
+ * marked unknown never takes it.
+ */
+export function carryResendAdvice(from, to) {
+    if (!(to instanceof Error) || to.writeOutcome === "unknown")
+        return;
+    const advice = resendAdviceOf(from);
+    const keyed = keyResendAdviceOf(from);
+    if (advice !== undefined && !resendAdvices.has(to))
+        resendAdvices.set(to, advice);
+    if (keyed !== undefined && !keyAdvices.has(to))
+        keyAdvices.set(to, keyed);
+}
+/** `message` with resend `advice` composed in. Only output calls this. */
+export function withResendAdvice(message, advice) {
+    if (advice === undefined)
+        return message;
+    return /^ [A-Z]/.test(advice) || !message.endsWith(".") ? message + advice : `${message.slice(0, -1)}${advice}.`;
+}
+/**
+ * Typed connector verdicts and runtime facts only. Prose never changes a
+ * verdict. The message carries the error's resend advice unless its write's
+ * outcome is unknown. This is a direct caller's view, outside any logical
+ * call: key-reuse advice is here only because the one boundary that sent the
+ * keyed request attached it to its own failure, and any boundary above it
+ * finalizes the write as unknown. An invocation composes advice itself.
+ */
 export function classifyCallError(err, fallbackCode = "connector_call_failed") {
+    const details = classifyWithoutAdvice(err, fallbackCode);
+    if (details.writeOutcome !== "unknown") {
+        details.message = withResendAdvice(details.message, keyResendAdviceOf(err)?.advice);
+        details.message = withResendAdvice(details.message, resendAdviceOf(err));
+    }
+    return details;
+}
+/**
+ * {@link classifyCallError} without the resend advice, for a caller that
+ * decides the outcome first and composes the advice only where it holds.
+ */
+export function classifyWithoutAdvice(err, fallbackCode = "connector_call_failed") {
     if (err instanceof ConnectorCallError) {
         return {
             code: err.code,
@@ -376,6 +485,7 @@ export function classifyCallError(err, fallbackCode = "connector_call_failed") {
             ...(err.repair ? { repair: err.repair } : {}),
             ...(err.details ? { details: err.details } : {}),
             ...(err.current ? { current: err.current } : {}),
+            ...(err.writeOutcome ? { writeOutcome: err.writeOutcome } : {}),
         };
     }
     if (err instanceof WithheldTextError) {

package/dist/execute.js

@@ -1,8 +1,10 @@
+import { authCall, authInvoke, authMethod } from "./auth/native.js";
+import { nativeRecovery } from "./native-recovery.js";
 import { GUEST_API_DECLARATION } from "./usage-guide.js";
 import { bindMcpClient } from "./mcp-client-context.js";
 import { CONFIG_DEFAULTS } from "./config-defaults.js";
 import { Cause, Deferred, Duration, Effect, Exit } from "effect";
-import { z } from "zod";
+import * as z from "zod";
 import { advertisedSchema } from "./advertised-schema.js";
 import { boundedDiscoveryText, CatalogService, DiscoveryPolicyError, flatSearchResult, } from "./catalog-service.js";
 import { createMetaTools, guardProgramReturn, jsonResult, pageProgramResult, } from "./meta-tools.js";
@@ -17,9 +19,10 @@ import { EXECUTE_OUTPUT } from "./meta-output.js";
 import { normalizeProgramSource } from "./program-source.js";
 import { readResource } from "./resource-read.js";
 import { agentOutputOperations, redactAgentOutput, sentSecretsForRequest } from "./sent-secrets.js";
-import { normalizeTimeoutMs, underAnySignal } from "./timeout.js";
+import { normalizeTimeoutMs } from "./timeout.js";
 import { fromSignal, runEdge, withDeadlineEffect } from "./runtime/run.js";
 import { closeScope } from "./runtime/connector-scope.js";
+import { executorProgram } from "./runtime/executor.js";
 import { connectorGuide, connectorGuideRequired, connectorSkillName, hasConnectorGuides, SkillsRegistry, } from "./skills.js";
 /** Keep one model-written program from amplifying into an unbounded fan-out. */
 const EXECUTE_MAX_HOST_CALLS = CONFIG_DEFAULTS.execute.maxHostCalls;
@@ -558,7 +561,8 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                     unrecorded: true,
                 };
             }
-            if (writes >= maxWrites) {
+            const budgeted = target.definition.classification !== "read";
+            if (budgeted && writes >= maxWrites) {
                 return {
                     kind: "refuse",
                     error: {
@@ -568,7 +572,8 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                     },
                 };
             }
-            writes++;
+            if (budgeted)
+                writes++;
             if (programWrites)
                 sending.settle = programWrites.begin();
             return { kind: "dispatch" };
@@ -678,7 +683,7 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
     };
     const operations = {
         call,
-        result: (id, options, signal) => Effect.tryPromise({
+        result: (id, options, signal, onStage) => Effect.tryPromise({
             try: async () => {
                 const transfer = typeof id === "string" ? transfers.get(id) : undefined;
                 const transferId = id;
@@ -709,7 +714,10 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                 }
                 // A page must fit every shipped bridge even when the connector cap is raised.
                 args.maxBytes = Math.min(args.maxBytes ?? PROGRAM_RESULT_PAGE_BYTES, PROGRAM_RESULT_PAGE_BYTES);
-                const page = await meta.readResult({ id, ...args }, { signal: signal });
+                const page = await meta.readResult({ id, ...args }, {
+                    signal: signal,
+                    onStage: onStage,
+                });
                 if (page.isError)
                     throw new InvocationFailure((page.structuredContent?.error ?? {
                         code: "not_found",
@@ -864,9 +872,12 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                     hostCalls.admitted++;
                 const started = Date.now();
                 const utility = name === "result" || name === "skill";
+                let stage = name === "result" ? "result storage" : "skill lookup";
                 const invoke = Effect.suspend(() => operation(...args));
                 const guarded = utility
-                    ? withDeadlineEffect((utilitySignal) => Effect.suspend(() => operation(args[0], args[1], utilitySignal)), {
+                    ? withDeadlineEffect((utilitySignal) => Effect.suspend(() => operation(args[0], args[1], utilitySignal, (current) => {
+                        stage = current;
+                    })), {
                         timeoutMs: hostCallTimeoutMs,
                         ...(hostAccessSignal ? { signal: hostAccessSignal } : {}),
                         timeoutError: guestFailure("timeout", `connecta.${name} timed out.`),
@@ -877,14 +888,14 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                         return typedFailure(guestFailure("cancelled", `connecta.${name} was cancelled because the run ended.`));
                     if (utility && error instanceof InvocationFailure && error.code === "timeout") {
                         const elapsedMs = Date.now() - started;
-                        const message = `Operation "connecta.${name}" timed out during ${name === "result" ? "result storage" : "skill lookup"} after ${elapsedMs}ms (effective deadline ${hostCallTimeoutMs}ms).`;
+                        const message = `Operation "connecta.${name}" timed out during ${stage} after ${elapsedMs}ms (effective deadline ${hostCallTimeoutMs}ms).`;
                         return typedFailure(new InvocationFailure({
                             code: "timeout",
                             message,
                             retryable: true,
                             details: {
                                 operation: `connecta.${name}`,
-                                stage: name === "result" ? "result storage" : "skill lookup",
+                                stage,
                                 elapsedMs,
                                 deadlineMs: hostCallTimeoutMs,
                             },
@@ -914,7 +925,7 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
     };
 }
 /**
- * Await an executor's promise without trusting it to settle.
+ * Await executor work without trusting it to settle.
  *
  * An executor's deadline is its own business, and the Dynamic Worker's lives
  * inside the sandbox: a wedged isolate never fires it, so the call never
@@ -927,28 +938,33 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
  * a ceiling of its own. Cancellation settles as the same `executor_cancelled`
  * the QuickJS pool reports, unless the executor reports its own first; the
  * ceiling as an untyped executor failure naming the key that sets it. Either
- * way the handler returns and releases the lease, and the abandoned call
- * keeps whatever it was doing: the QuickJS lease release recycles its child,
- * the Worker adapter disposes its handles without waiting for the guest. A
- * lease granted after its request gave up goes to `late`. The result contract is untouched
- * — this only decides when to stop waiting for one.
+ * way the handler releases the lease. Losing native programs are interrupted
+ * and their finalizers awaited, so native interruption cleanup must remain
+ * synchronous or bounded to avoid delaying the watchdog or terminal response.
+ * Custom Promise leaves may continue, with late settlements still observed;
+ * lease release recycles the QuickJS child or disposes Worker handles without
+ * waiting for the guest. A lease granted after its request gave up goes to
+ * `late`. The result contract is untouched — this only decides when to stop
+ * waiting for one.
  */
 function awaitExecutor(start, signal, options = {}) {
     const started = Date.now();
     const contenders = [
-        Effect.suspend(() => {
-            let pending;
-            const settling = Effect.tryPromise({
-                try: () => (pending = Promise.resolve(start())),
-                catch: (err) => err,
-            });
-            const { late } = options;
-            return late
-                ? settling.pipe(Effect.onInterrupt(() => Effect.sync(() => {
-                    pending?.then(late, () => { });
-                })))
-                : settling;
-        }),
+        typeof start !== "function"
+            ? start
+            : Effect.suspend(() => {
+                let pending;
+                const settling = Effect.tryPromise({
+                    try: () => (pending = Promise.resolve(start())),
+                    catch: (err) => err,
+                });
+                const { late } = options;
+                return late
+                    ? settling.pipe(Effect.onInterrupt(() => Effect.sync(() => {
+                        pending?.then(late, () => { });
+                    })))
+                    : settling;
+            }),
         // An executor that honors the signal rejects in the abort event itself,
         // with the logs it captured attached, and that report beats ours by one
         // timer turn. (A 1ms sleep, not 0: Effect.sleep(0) waits a microtask,
@@ -1086,17 +1102,18 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
             return yield* timed((elapsed) => {
                 if (diagnostics)
                     diagnostics.executorWallMs = elapsed;
-            }, awaitExecutor(() => (admitted
-                ? admitted.execute(wrapGuestProgram(program), [provider])
-                : executor.execute(wrapGuestProgram(program), [provider])).then((outcome) => {
-                executorLogs = sentSecrets.redact(outcome?.logs, "prose");
-                return sentSecrets.redact(outcome);
-            }, (err) => {
-                if (err !== null && typeof err === "object" && "logs" in err) {
-                    executorLogs = sentSecrets.redact(err.logs, "prose");
-                }
-                throw sentSecrets.redact(err);
-            }), signal, { watchdog, terminal: Deferred.await(terminal) }).pipe(Effect.ensuring(Effect.suspend(() => {
+            }, awaitExecutor(executorProgram(admitted ?? executor, wrapGuestProgram(program), [provider], {
+                result: (outcome) => {
+                    executorLogs = sentSecrets.redact(outcome?.logs);
+                },
+                error: (err) => {
+                    if (err !== null && typeof err === "object" && "logs" in err)
+                        executorLogs = sentSecrets.redact(err.logs);
+                },
+                interrupted: (logs) => {
+                    executorLogs = sentSecrets.redact(logs);
+                },
+            }).pipe(Effect.map((outcome) => sentSecrets.redact(outcome)), Effect.mapError((error) => sentSecrets.redact(error))), signal, { watchdog, terminal: Deferred.await(terminal) }).pipe(Effect.ensuring(Effect.suspend(() => {
                 programWrites.close();
                 dispatchController.abort();
                 return programWrites.drain();
@@ -1141,7 +1158,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
         }).pipe(Effect.map((result) => redactAgentOutput(sentSecrets, result)));
     });
     return agentOutputOperations((requestScope) => ({
-        execute: ({ code, diagnostics }, options = {}) => {
+        execute: authMethod(({ code, diagnostics }, options = {}) => {
             // A code-unit count above the cap is already too large in UTF-8. Check
             // that first so a huge direct-call string is never encoded in full.
             if (code.length > EXECUTE_MAX_CODE_BYTES ||
@@ -1153,10 +1170,10 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                     hostCalls: { attempted: 0, admitted: 0, succeeded: 0, failed: 0 },
                 };
                 response.content[0].text = JSON.stringify(response.structuredContent);
-                return Promise.resolve(response);
+                return Effect.succeed(response);
             }
-            return runEdge(Effect.suspend(() => play(normalizeProgramSource(code), diagnostics, options.signal, requestScope)));
-        },
+            return Effect.suspend(() => play(normalizeProgramSource(code), diagnostics, options.signal, requestScope));
+        }),
     }), config.requestScope).execute;
 }
 /** An execution that never produced an ExecuteResult, as the model sees it. */
@@ -1328,7 +1345,7 @@ function connectorInventory(connectors) {
         return `${prefix}${shown.join(", ")}.`;
     return `${prefix}${shown.join(", ")}${shown.length > 0 ? "; " : ""}+${omitted} more.`;
 }
-const executeDescription = (emitBudgets, hostLimits, connectorGuides, connectors, maxWrites, readOnly) => `${readOnly ? "One known read: call_tool. Everything else: execute_code. Read-only endpoint: search and describe omit write tools, and every write call is refused." : "One known read: call_tool. One known write: call_destructive_tool. Everything else: execute_code. Writable endpoint: programs may read and write; the client approves."} Limits: ${hostLimits.maxHostCalls} host calls, ${readOnly ? "" : `${maxWrites} writes, `}${hostLimits.hostCallTimeoutMs / 1_000}s/host call.
+const executeDescription = (emitBudgets, hostLimits, connectorGuides, connectors, maxWrites, readOnly, native = false) => `${native ? `Call tools directly; combine work here using their program addresses. ${readOnly ? "Read-only endpoint: writes are omitted and refused." : "Writable endpoint: programs may read and write; the client approves."}` : readOnly ? "One known read: call_tool. Everything else: execute_code. Read-only endpoint: search and describe omit write tools, and every write call is refused." : "One known read: call_tool. One known write: call_destructive_tool. Everything else: execute_code. Writable endpoint: programs may read and write; the client approves."} Limits: ${hostLimits.maxHostCalls} host calls, ${readOnly ? "" : `${maxWrites} writes, `}${hostLimits.hostCallTimeoutMs / 1_000}s/host call.
 ${connectorInventory(connectors)}
 
 Use async () => { ... }, no arguments. No portable ambient capabilities. API:
@@ -1383,7 +1400,7 @@ export function registerExecuteTool(server, registry, ctx) {
         description: executeDescription(emitBudgets, {
             ...hostLimits,
             hostCallTimeoutMs: normalizeTimeoutMs(ctx.defaultToolTimeoutMs) ?? hostLimits.hostCallTimeoutMs,
-        }, hasConnectorGuides(connectors), connectors, maxWrites, ctx.readOnly === true),
+        }, hasConnectorGuides(connectors), connectors, maxWrites, ctx.readOnly === true, ctx.native === true),
         inputSchema: EXECUTE_INPUT,
         outputSchema: EXECUTE_OUTPUT,
         // The client sees execute_code as a write exactly when the endpoint writes.
@@ -1392,12 +1409,32 @@ export function registerExecuteTool(server, registry, ctx) {
             destructiveHint: ctx.readOnly !== true,
             openWorldHint: true,
         },
-    }, (args, extra) => {
+    }, authMethod((args, extra) => Effect.gen(function* () {
         if (ctx.client)
             bindMcpClient(extra, ctx.client, ctx.activity);
-        const run = () => underAnySignal([extra.mcpReq.signal, ctx.requestSignal], (signal) => execute(args, {
-            signal,
+        const run = authMethod(() => Effect.suspend(() => {
+            const controller = new AbortController();
+            const forwarders = [extra.mcpReq.signal, ctx.requestSignal]
+                .filter((signal) => signal !== undefined)
+                .map((signal) => {
+                const forward = () => controller.abort(signal.reason);
+                if (signal.aborted)
+                    forward();
+                else
+                    signal.addEventListener("abort", forward, { once: true });
+                return { signal, forward };
+            });
+            return authCall(execute, [
+                args,
+                { signal: controller.signal },
+            ]).pipe(Effect.ensuring(Effect.sync(() => {
+                for (const { signal, forward } of forwarders)
+                    signal.removeEventListener("abort", forward);
+            })));
         }));
-        return ctx.authElicitation ? ctx.authElicitation.run("execute_code", args, extra, run) : run();
-    });
+        const result = yield* ctx.authElicitation
+            ? authInvoke(ctx.authElicitation, "run", ["execute_code", args, extra, run])
+            : authCall(run, []);
+        return ctx.native ? nativeRecovery(result, true) : result;
+    })));
 }

package/dist/executor-admission.js

@@ -1,6 +1,7 @@
 import { Deferred, Duration, Effect } from "effect";
 import { admit, provideAdmissionProgram } from "./runtime/admission.js";
 import { fromSignal, runEdge } from "./runtime/run.js";
+import { keepErrorName } from "./redaction-identity.js";
 /**
  * A stable, machine-readable admission failure. Overload is retryable; caller
  * cancellation and shutdown are terminal for this invocation.
@@ -19,6 +20,7 @@ export class ExecutorAdmissionError extends Error {
         }
     }
 }
+keepErrorName(ExecutorAdmissionError, "ExecutorAdmissionError");
 /**
  * A lifecycle failure after the sandbox started running. It keeps the stable
  * admission-error envelope while letting response assembly distinguish work
@@ -30,6 +32,7 @@ export class ExecutorExecutionError extends ExecutorAdmissionError {
         this.name = "ExecutorExecutionError";
     }
 }
+keepErrorName(ExecutorExecutionError, "ExecutorExecutionError");
 function positiveWhole(value, name) {
     if (!Number.isFinite(value) || !Number.isInteger(value) || value < 1) {
         throw new TypeError(`${name} must be a positive whole number.`);