@zhivex-ai/core 0.19.0 → 1.0.0

package/dist/agent.js

@@ -1,14 +1,17 @@
 import { createHash } from "node:crypto";
 import { createAgentApprovalMessage, getAgentApprovalRequests } from "./agent-approval.js";
 import { createAgentHandoffMessage } from "./agent-handoff.js";
+import { createAgentExecutionEnvironmentBinding, fingerprintAgentHarness } from "./agent-harness.js";
 import { AGENT_RUN_STATE_SCHEMA_VERSION, normalizeAgentRunState } from "./agent-state.js";
 import { BoundedReplayBroadcast } from "./bounded-broadcast.js";
-import { ConflictError, GuardrailTriggeredError, ValidationError } from "./errors.js";
+import { ConflictError, GuardrailTriggeredError, UnsupportedFeatureError, ValidationError } from "./errors.js";
 import { aggregateTokenUsage, generateText, getGenerateTextStepTiming, normalizeMessages, streamText } from "./generate-text.js";
-import { isCallableToolDefinition, serializeJsonValue } from "./messages.js";
+import { createTextMessage, isCallableToolDefinition, serializeJsonValue } from "./messages.js";
 import { mergeAbortSignals } from "./runtime.js";
 import { evaluateAgentBudgetPreflight, getAgentBudgetStatus } from "./safety-policy.js";
 import { createSecureId } from "./secure-id.js";
+import { createStructuredOutputPrompt } from "./structured-output-prompt.js";
+import { ToolExecutionSuspendedError } from "./tool-execution-suspension.js";
 import { toToolSet } from "./tool-registry.js";
 import { z } from "zod";
 const randomId = createSecureId;
@@ -26,6 +29,26 @@ const joinInstructions = (...parts) => {
     const content = parts.map((part) => part?.trim()).filter((part) => Boolean(part));
     return content.length ? content.join("\n\n") : undefined;
 };
+const resolveAgentOutputMode = (agent) => {
+    if (!agent.outputSchema) {
+        return undefined;
+    }
+    const requested = agent.outputMode ?? "auto";
+    if (requested === "native" && !agent.model.capabilities.structuredOutput) {
+        throw new UnsupportedFeatureError(`Model "${agent.model.provider}/${agent.model.modelId}" does not support native structured output.`);
+    }
+    return requested === "auto"
+        ? agent.model.capabilities.structuredOutput
+            ? "native"
+            : "prompted"
+        : requested;
+};
+const promptedOutputInstruction = (agent) => agent.outputSchema && resolveAgentOutputMode(agent) === "prompted"
+    ? createStructuredOutputPrompt(agent.outputSchema, {
+        name: agent.outputName,
+        description: agent.outputDescription
+    })
+    : undefined;
 const hasToolCalls = (messages) => messages.some((message) => message.parts.some((part) => part.type === "tool-call"));
 const snapshotRequest = (request, messageOffset = 0, messages = request.messages) => ({
     messageOffset,
@@ -48,9 +71,20 @@ const snapshotResponse = (response) => ({
     usage: response.usage
 });
 const countToolCalls = (messages) => messages.reduce((total, message) => total + message.parts.filter((part) => part.type === "tool-call").length, 0);
+const messagePrefixLength = (prefix, messages) => {
+    if (prefix.length > messages.length) {
+        return 0;
+    }
+    for (let index = 0; index < prefix.length; index += 1) {
+        if (JSON.stringify(prefix[index]) !== JSON.stringify(messages[index])) {
+            return 0;
+        }
+    }
+    return prefix.length;
+};
 const mapSteps = (steps, offset, toolResults) => {
     let toolResultCursor = 0;
-    let previousMessageCount = 0;
+    let previousMessages = [];
     return steps.map((step, index) => {
         const response = snapshotResponse(step.response);
         const toolCallCount = countToolCalls(response.messages);
@@ -58,9 +92,9 @@ const mapSteps = (steps, offset, toolResults) => {
         toolResultCursor += toolCallCount;
         const timing = getGenerateTextStepTiming(step.request);
         const finishedAt = timing?.finishedAt ?? Date.now();
-        const messageOffset = index === 0 ? 0 : previousMessageCount;
+        const messageOffset = index === 0 ? 0 : messagePrefixLength(previousMessages, step.request.messages);
         const incrementalMessages = step.request.messages.slice(messageOffset);
-        previousMessageCount = step.request.messages.length;
+        previousMessages = step.request.messages;
         return {
             index: offset + index + 1,
             status: "completed",
@@ -79,6 +113,9 @@ const cloneMetadata = (...values) => {
 const toOutput = (state) => ({
     status: state.status,
     outputText: state.outputText,
+    finalOutput: state.status === "completed" && state.finalOutput !== undefined
+        ? state.finalOutput
+        : undefined,
     finishReason: state.finishReason,
     providerFinishReason: state.providerFinishReason,
     usage: state.usage,
@@ -90,7 +127,7 @@ const toOutput = (state) => ({
 });
 const normalizeApprovalStatus = (status) => status === "suspended" ? "waiting_approval" : status;
 const cloneState = (state) => JSON.parse(JSON.stringify(normalizeAgentRunState(state)));
-const createBaseState = (provider, modelId, initialMessages, maxSteps, metadata, agentId, runId, handoff, parentRunId, idempotencyKey, scope) => {
+const createBaseState = (provider, modelId, initialMessages, maxSteps, metadata, agentId, runId, handoff, parentRunId, idempotencyKey, scope, outputMode, harness, executionEnvironment) => {
     const startedAt = Date.now();
     return {
         schemaVersion: AGENT_RUN_STATE_SCHEMA_VERSION,
@@ -102,6 +139,8 @@ const createBaseState = (provider, modelId, initialMessages, maxSteps, metadata,
         parentRunId: parentRunId ?? handoff?.fromRunId,
         provider,
         modelId,
+        harness,
+        executionEnvironment,
         status: "running",
         messages: initialMessages,
         steps: [],
@@ -109,7 +148,10 @@ const createBaseState = (provider, modelId, initialMessages, maxSteps, metadata,
         currentStep: 0,
         maxSteps,
         outputText: "",
+        outputMode,
         pendingApprovals: [],
+        approvalHistory: [],
+        compactions: [],
         metadata,
         handoff,
         startedAt,
@@ -198,7 +240,7 @@ const prepareFreshMessages = async (agent, input, runId) => {
     let messages = normalizeMessages({
         prompt: input.prompt,
         messages: input.messages,
-        system: joinInstructions(agent.instructions, input.system)
+        system: joinInstructions(agent.instructions, input.system, promptedOutputInstruction(agent))
     });
     const handoffMessages = input.handoff
         ? [createAgentHandoffMessage(input.handoff), ...input.handoff.contextMessages.filter((message) => message.role !== "system")]
@@ -218,11 +260,17 @@ const prepareFreshMessages = async (agent, input, runId) => {
         memoryMessages
     };
 };
-const applyApprovalResponses = (messages, approvals, pendingApprovals) => {
+const localApprovalResolutionPayload = (inputDigest, approve, reason) => JSON.stringify({
+    inputDigest,
+    approve,
+    reason: reason ?? null
+});
+const applyApprovalResponses = async (messages, approvals, pendingApprovals, approvalHistory = [], signer) => {
     if (!approvals?.length) {
         return {
             messages,
-            pendingApprovals
+            pendingApprovals,
+            approvalHistory
         };
     }
     const pendingById = new Map(pendingApprovals.map((approval) => [approval.id, approval]));
@@ -235,17 +283,85 @@ const applyApprovalResponses = (messages, approvals, pendingApprovals) => {
             throw new ValidationError(`Approval request "${approval.approvalRequestId}" belongs to provider "${pending.provider}", not "${approval.provider}".`);
         }
     }
+    const providerApprovals = approvals.filter((approval) => {
+        const pending = pendingById.get(approval.approvalRequestId);
+        return pending?.kind === undefined || pending.kind === "provider";
+    });
+    const localResolutions = [];
+    const subagentResolutions = [];
+    for (const approval of approvals) {
+        const pending = pendingById.get(approval.approvalRequestId);
+        if (!pending) {
+            continue;
+        }
+        if (pending.kind === "subagent") {
+            subagentResolutions.push({
+                requestId: pending.id,
+                kind: "subagent",
+                provider: pending.provider,
+                approve: approval.approve,
+                reason: approval.reason,
+                toolCallId: pending.toolCallId,
+                childRunId: pending.childRunId,
+                childAgentId: pending.childAgentId,
+                childApprovalRequestId: pending.childApprovalRequestId,
+                resolvedAt: Date.now()
+            });
+            continue;
+        }
+        if (pending.kind !== "local-tool") {
+            continue;
+        }
+        if (signer) {
+            if (!pending.inputDigest || !pending.signature) {
+                throw new ValidationError(`Approval request "${pending.id}" is missing its required signature.`);
+            }
+            const requestSignatureValid = signer.verify
+                ? await signer.verify(pending.inputDigest, pending.signature)
+                : (await signer.sign(pending.inputDigest)) === pending.signature;
+            if (!requestSignatureValid) {
+                throw new ValidationError(`Approval request "${pending.id}" has an invalid signature.`);
+            }
+        }
+        const resolutionSignature = signer && pending.inputDigest
+            ? await signer.sign(localApprovalResolutionPayload(pending.inputDigest, approval.approve, approval.reason))
+            : undefined;
+        localResolutions.push({
+            requestId: pending.id,
+            kind: "local-tool",
+            provider: pending.provider,
+            approve: approval.approve,
+            reason: approval.reason,
+            toolCallId: pending.toolCallId,
+            step: pending.step,
+            inputDigest: pending.inputDigest,
+            toolVersion: pending.toolVersion,
+            signature: resolutionSignature,
+            resolvedAt: Date.now()
+        });
+    }
     return {
-        messages: [...messages, createAgentApprovalMessage(approvals)],
-        pendingApprovals: pendingApprovals.filter((pending) => !approvals.some((approval) => approval.approvalRequestId === pending.id))
+        messages: providerApprovals.length
+            ? [...messages, createAgentApprovalMessage(providerApprovals)]
+            : messages,
+        pendingApprovals: pendingApprovals.filter((pending) => !approvals.some((approval) => approval.approvalRequestId === pending.id)),
+        approvalHistory: [
+            ...approvalHistory.filter((existing) => !localResolutions.some((resolution) => resolution.requestId === existing.requestId) &&
+                !subagentResolutions.some((resolution) => resolution.requestId === existing.requestId)),
+            ...localResolutions,
+            ...subagentResolutions
+        ]
     };
 };
-const finalizeState = (state, result, newSteps, newToolResults) => {
+const finalizeState = (agent, state, result, newSteps, newToolResults) => {
     const nextCurrentStep = state.currentStep + newSteps.length;
     const exhausted = nextCurrentStep >= state.maxSteps;
     const lastStep = newSteps.at(-1);
     const unresolvedToolCalls = lastStep?.response ? hasToolCalls(lastStep.response.messages) : false;
-    const pendingApprovals = getAgentApprovalRequests(newSteps.flatMap((step) => step.response?.messages ?? []));
+    const pendingApprovals = [
+        ...(result.approvalRequests ?? []),
+        ...getAgentApprovalRequests(newSteps.flatMap((step) => step.response?.messages ?? []))
+    ];
     if (pendingApprovals.length) {
         state.status = "waiting_approval";
         state.error = undefined;
@@ -272,6 +388,23 @@ const finalizeState = (state, result, newSteps, newToolResults) => {
     state.toolResults = [...state.toolResults, ...newToolResults];
     state.currentStep = nextCurrentStep;
     state.outputText = result.text;
+    if (state.status === "completed") {
+        const terminalText = result.steps.at(-1)?.response.text ?? result.text;
+        if (agent.outputSchema) {
+            let parsedJson;
+            try {
+                parsedJson = JSON.parse(terminalText);
+            }
+            catch (error) {
+                throw new ValidationError("Agent final output is not valid JSON.", { cause: error });
+            }
+            const parsedOutput = agent.outputSchema.safeParse(parsedJson);
+            if (!parsedOutput.success) {
+                throw new ValidationError(`Agent final output validation failed: ${parsedOutput.error.message}`);
+            }
+            state.finalOutput = serializeJsonValue(parsedOutput.data);
+        }
+    }
     state.finishReason = result.finishReason;
     state.providerFinishReason = result.providerFinishReason;
     state.usage = aggregateTokenUsage([state.usage, result.usage]);
@@ -293,6 +426,7 @@ const defaultSubAgentToolName = (agent) => {
 const countToolCallsInSteps = (steps) => steps.reduce((total, step) => total + countToolCalls(step.response?.messages ?? []), 0);
 const countToolErrors = (toolResults) => toolResults.filter((result) => result.isError).length;
 export const createSubAgentTool = (options) => {
+    const runtimeState = options.runtimeState;
     const toolName = options.toolName ?? options.name ?? defaultSubAgentToolName(options.agent);
     const metadata = {
         type: "subagent"
@@ -313,7 +447,7 @@ export const createSubAgentTool = (options) => {
         schema: subAgentToolInputSchema,
         requiresApproval: options.requiresApproval,
         metadata: cloneMetadata(metadata, options.metadata),
-        execute: async (input) => {
+        execute: async (input, executionContext) => {
             await options.onStart?.({
                 toolName,
                 childAgentId: options.agent.id,
@@ -328,14 +462,38 @@ export const createSubAgentTool = (options) => {
             if (options.parentAgentId) {
                 childMetadata.parentAgentId = options.parentAgentId;
             }
-            const output = await runAgent(options.agent, {
-                prompt: input.prompt,
-                system: joinInstructions(options.system, input.system),
-                parentRunId: options.parentRunId,
-                scope: options.scope,
-                maxSteps: options.maxSteps,
-                metadata: cloneMetadata(options.metadata, childMetadata)
-            });
+            const toolCallId = executionContext?.toolCall.id;
+            const checkpoint = runtimeState?.childRuns?.find((childRun) => childRun.toolCallId === toolCallId && childRun.resumeState);
+            const childApprovalResponses = checkpoint
+                ? (runtimeState?.approvalHistory ?? [])
+                    .filter((resolution) => resolution.kind === "subagent" &&
+                    resolution.toolCallId === toolCallId &&
+                    resolution.childRunId === checkpoint.runId &&
+                    resolution.childApprovalRequestId)
+                    .map((resolution) => ({
+                    provider: resolution.provider,
+                    approvalRequestId: resolution.childApprovalRequestId,
+                    approve: resolution.approve,
+                    reason: resolution.reason
+                }))
+                : [];
+            const output = checkpoint?.resumeState
+                ? await resumeAgent(options.agent, {
+                    state: checkpoint.resumeState,
+                    approvals: childApprovalResponses,
+                    scope: options.scope,
+                    context: executionContext?.context,
+                    maxSteps: options.maxSteps
+                })
+                : await runAgent(options.agent, {
+                    prompt: input.prompt,
+                    system: joinInstructions(options.system, input.system),
+                    parentRunId: options.parentRunId,
+                    scope: options.scope,
+                    context: executionContext?.context,
+                    maxSteps: options.maxSteps,
+                    metadata: cloneMetadata(options.metadata, childMetadata)
+                });
             const childRun = {
                 runId: output.state.runId,
                 status: output.status,
@@ -344,6 +502,9 @@ export const createSubAgentTool = (options) => {
                 toolCalls: countToolCallsInSteps(output.steps),
                 toolErrors: countToolErrors(output.toolResults)
             };
+            if (toolCallId) {
+                childRun.toolCallId = toolCallId;
+            }
             if (output.state.agentId) {
                 childRun.agentId = output.state.agentId;
             }
@@ -366,7 +527,38 @@ export const createSubAgentTool = (options) => {
             if (output.state.metadata) {
                 childRun.metadata = output.state.metadata;
             }
+            if (output.status === "waiting_approval" && output.state.pendingApprovals.length) {
+                childRun.resumeState = output.state;
+            }
             await options.onFinish?.(childRun);
+            if (childRun.resumeState) {
+                const approvals = childRun.resumeState.pendingApprovals.map((approval) => {
+                    const id = `subapproval_${createHash("sha256")
+                        .update(`${options.parentRunId ?? ""}\0${toolCallId ?? ""}\0${childRun.runId}\0${approval.id}`)
+                        .digest("hex")}`;
+                    return {
+                        kind: "subagent",
+                        provider: approval.provider,
+                        id,
+                        name: approval.name,
+                        arguments: approval.arguments,
+                        serverLabel: approval.serverLabel,
+                        toolCallId,
+                        step: executionContext?.step,
+                        childRunId: childRun.runId,
+                        childAgentId: childRun.agentId,
+                        childApprovalRequestId: approval.id,
+                        rawData: {
+                            type: "subagent_approval_request",
+                            childRunId: childRun.runId,
+                            childAgentId: childRun.agentId ?? null,
+                            childApprovalRequestId: approval.id,
+                            approval: approval.rawData
+                        }
+                    };
+                });
+                throw new ToolExecutionSuspendedError(approvals);
+            }
             return serializeJsonValue(childRun);
         }
     };
@@ -477,7 +669,71 @@ const runGuardrails = async (agent, state, stage, guardrails, requestFactory) =>
     }
     return undefined;
 };
+const bindDurableRuntime = (agent, input, state, executionEnvironment) => {
+    const policy = {
+        ...(agent.policy ?? {}),
+        ...(input.policy ?? {})
+    };
+    if (state.harness && !agent.harness) {
+        throw new ConflictError(`Agent run "${state.runId}" is bound to harness "${state.harness.id}", but the current agent has no harness binding.`);
+    }
+    if (state.harness && agent.harness) {
+        if (state.harness.id !== agent.harness.id ||
+            state.harness.version !== agent.harness.version ||
+            state.harness.fingerprint !== agent.harness.fingerprint) {
+            throw new ConflictError(`Agent run "${state.runId}" was created by a different harness fingerprint.`);
+        }
+    }
+    else if (!state.harness && agent.harness) {
+        if (!policy?.allowLegacyHarnessResume) {
+            throw new ConflictError(`Agent run "${state.runId}" predates harness binding; set allowLegacyHarnessResume only for an explicit migration.`);
+        }
+        state.harness = agent.harness;
+    }
+    if (state.executionEnvironment && !executionEnvironment) {
+        throw new ConflictError(`Agent run "${state.runId}" is bound to execution environment "${state.executionEnvironment.environmentId}".`);
+    }
+    if (state.executionEnvironment && executionEnvironment) {
+        if (state.executionEnvironment.environmentId !== executionEnvironment.environmentId ||
+            state.executionEnvironment.environmentVersion !== executionEnvironment.environmentVersion ||
+            state.executionEnvironment.fingerprint !== executionEnvironment.fingerprint ||
+            state.executionEnvironment.workspaceId !== executionEnvironment.workspaceId) {
+            throw new ConflictError(`Agent run "${state.runId}" was created in a different execution environment.`);
+        }
+    }
+    else if (!state.executionEnvironment && executionEnvironment) {
+        if (!policy?.allowLegacyExecutionEnvironmentResume) {
+            throw new ConflictError(`Agent run "${state.runId}" predates execution-environment binding; enable the explicit migration policy to resume it.`);
+        }
+        state.executionEnvironment = executionEnvironment;
+    }
+};
+const validateHarnessBinding = (binding) => {
+    if (!binding) {
+        return;
+    }
+    if (binding.schemaVersion !== 1 ||
+        binding.algorithm !== "sha256" ||
+        !binding.id ||
+        !binding.version ||
+        !/^sha256:[0-9a-f]{64}$/.test(binding.fingerprint)) {
+        throw new ValidationError("Agent harness binding is invalid.");
+    }
+};
 const resolveContext = async (agent, input) => {
+    validateHarnessBinding(agent.harness);
+    const executionEnvironment = input.executionEnvironment ?? agent.executionEnvironment;
+    const executionEnvironmentBinding = executionEnvironment
+        ? createAgentExecutionEnvironmentBinding(executionEnvironment.manifest)
+        : undefined;
+    let parsedContext = input.context;
+    if (agent.contextSchema) {
+        const result = await agent.contextSchema.safeParseAsync(input.context);
+        if (!result.success) {
+            throw new ValidationError(`Invalid agent context: ${result.error.message}`);
+        }
+        parsedContext = result.data;
+    }
     ensureValidIdempotencyInput(input, agent.store);
     const inputScope = input.scope ?? input.handoff?.scope;
     ensureValidScope(inputScope);
@@ -494,7 +750,7 @@ const resolveContext = async (agent, input) => {
         const maxSteps = Math.max(1, input.maxSteps ?? agent.maxSteps ?? 1);
         const metadata = cloneMetadata(agent.metadata, input.metadata, input.handoff?.metadata);
         const prepared = await prepareFreshMessages(agent, input, runId);
-        const candidate = createBaseState(agent.model.provider, agent.model.modelId, prepared.messages, maxSteps, metadata, agent.id, runId, input.handoff, input.parentRunId, input.idempotencyKey, inputScope);
+        const candidate = createBaseState(agent.model.provider, agent.model.modelId, prepared.messages, maxSteps, metadata, agent.id, runId, input.handoff, input.parentRunId, input.idempotencyKey, inputScope, resolveAgentOutputMode(agent), agent.harness, executionEnvironmentBinding);
         const claim = await agent.store.claimIdempotencyKey(candidate);
         if (claim.claimed) {
             return {
@@ -502,6 +758,8 @@ const resolveContext = async (agent, input) => {
                 messages: prepared.messages,
                 remainingSteps: maxSteps,
                 memoryMessages: prepared.memoryMessages,
+                context: parsedContext,
+                executionEnvironment,
                 fresh: true
             };
         }
@@ -516,8 +774,9 @@ const resolveContext = async (agent, input) => {
     ensureValidStateInput(normalizedInput);
     const metadata = cloneMetadata(agent.metadata, loadedState?.metadata, input.metadata, input.handoff?.metadata);
     if (loadedState) {
+        bindDurableRuntime(agent, input, loadedState, executionEnvironmentBinding);
         const maxSteps = input.maxSteps ?? loadedState.maxSteps;
-        const resumed = applyApprovalResponses(loadedState.messages, input.approvals, loadedState.pendingApprovals);
+        const resumed = await applyApprovalResponses(loadedState.messages, input.approvals, loadedState.pendingApprovals, loadedState.approvalHistory, agent.toolApprovalSigner);
         return {
             state: {
                 ...loadedState,
@@ -531,12 +790,15 @@ const resolveContext = async (agent, input) => {
                 maxSteps,
                 messages: resumed.messages,
                 pendingApprovals: resumed.pendingApprovals,
+                approvalHistory: resumed.approvalHistory,
                 metadata,
                 updatedAt: Date.now()
             },
             messages: resumed.messages,
             remainingSteps: Math.max(0, maxSteps - loadedState.currentStep),
             memoryMessages: [],
+            context: parsedContext,
+            executionEnvironment,
             fresh: false
         };
     }
@@ -544,10 +806,12 @@ const resolveContext = async (agent, input) => {
     const maxSteps = Math.max(1, input.maxSteps ?? agent.maxSteps ?? 1);
     const prepared = await prepareFreshMessages(agent, input, runId);
     return {
-        state: createBaseState(agent.model.provider, agent.model.modelId, prepared.messages, maxSteps, metadata, agent.id, runId, input.handoff, input.parentRunId, input.idempotencyKey, inputScope),
+        state: createBaseState(agent.model.provider, agent.model.modelId, prepared.messages, maxSteps, metadata, agent.id, runId, input.handoff, input.parentRunId, input.idempotencyKey, inputScope, resolveAgentOutputMode(agent), agent.harness, executionEnvironmentBinding),
         messages: prepared.messages,
         remainingSteps: maxSteps,
         memoryMessages: prepared.memoryMessages,
+        context: parsedContext,
+        executionEnvironment,
         fresh: true
     };
 };
@@ -566,6 +830,57 @@ const canonicalJson = (value) => {
 const durableToolCallId = (runId, step, providerToolCallId, toolName, input) => `tool_${createHash("sha256")
     .update(`${runId}\0${step}\0${providerToolCallId}\0${toolName}\0${canonicalJson(input)}`)
     .digest("hex")}`;
+const wrapToolWithExecutionEnvironment = (tool, session) => {
+    const authorize = async (input, context, phase) => session.authorize({
+        manifest: session.manifest,
+        binding: session.binding,
+        tool,
+        toolCall: context.toolCall,
+        input,
+        context,
+        phase
+    });
+    const environmentGuardrail = async ({ input, context }) => {
+        const decision = await authorize(input, context, "preflight");
+        return decision.decision === "deny"
+            ? {
+                triggered: true,
+                reason: decision.reason,
+                metadata: decision.metadata
+            }
+            : undefined;
+    };
+    return {
+        ...tool,
+        approvalVersion: [
+            tool.approvalVersion,
+            `environment:${session.binding.fingerprint}`
+        ].filter(Boolean).join("|"),
+        inputGuardrails: [
+            environmentGuardrail,
+            ...(tool.inputGuardrails ?? [])
+        ],
+        execute: async (input, context) => {
+            if (!context) {
+                throw new ValidationError(`Tool "${tool.name}" requires an execution environment context.`);
+            }
+            const decision = await authorize(input, context, "execute");
+            if (decision.decision === "deny") {
+                throw new GuardrailTriggeredError("tool-input", decision.reason, { metadata: decision.metadata });
+            }
+            const request = {
+                manifest: session.manifest,
+                binding: session.binding,
+                tool,
+                toolCall: context.toolCall,
+                input,
+                context,
+                phase: "execute"
+            };
+            return session.execute(request, () => tool.execute(input, context));
+        }
+    };
+};
 const wrapToolWithJournal = (agent, state, tool) => {
     const store = agent.store;
     if (!store?.claimToolExecution || !store.loadToolExecution || !store.completeToolExecution) {
@@ -637,14 +952,141 @@ const wrapToolWithJournal = (agent, state, tool) => {
         }
     };
 };
-const createGenerateOptions = (agent, state, input, messages, maxSteps, abortSignal = input.abortSignal) => {
+const defaultEstimateInputTokens = (messages) => Math.ceil(new TextEncoder().encode(JSON.stringify(messages)).byteLength / 4);
+const validateCompactionOptions = (options) => {
+    if (options.maxMessages !== undefined &&
+        (!Number.isSafeInteger(options.maxMessages) || options.maxMessages < 2)) {
+        throw new ValidationError("Agent compaction maxMessages must be an integer greater than or equal to 2.");
+    }
+    if (options.maxEstimatedInputTokens !== undefined &&
+        (!Number.isSafeInteger(options.maxEstimatedInputTokens) || options.maxEstimatedInputTokens < 1)) {
+        throw new ValidationError("Agent compaction maxEstimatedInputTokens must be a positive integer.");
+    }
+    if (options.keepRecentMessages !== undefined &&
+        (!Number.isSafeInteger(options.keepRecentMessages) || options.keepRecentMessages < 1)) {
+        throw new ValidationError("Agent compaction keepRecentMessages must be a positive integer.");
+    }
+    if (options.maxMessages === undefined && options.maxEstimatedInputTokens === undefined) {
+        throw new ValidationError("Agent compaction requires maxMessages or maxEstimatedInputTokens.");
+    }
+};
+const compactAgentMessages = async (options, state, messages, beforeStep, context, abortSignal) => {
+    validateCompactionOptions(options);
+    if (state.pendingApprovals.length) {
+        return undefined;
+    }
+    const estimateTokens = options.estimateTokens ?? defaultEstimateInputTokens;
+    const estimatedTokensBefore = estimateTokens(messages);
+    const reasons = [];
+    if (options.maxMessages !== undefined && messages.length > options.maxMessages) {
+        reasons.push("message-count");
+    }
+    if (options.maxEstimatedInputTokens !== undefined &&
+        estimatedTokensBefore > options.maxEstimatedInputTokens) {
+        reasons.push("estimated-input-tokens");
+    }
+    if (!reasons.length) {
+        return undefined;
+    }
+    let systemCount = 0;
+    while (messages[systemCount]?.role === "system") {
+        systemCount += 1;
+    }
+    const maxTailForMessageLimit = options.maxMessages === undefined
+        ? Number.POSITIVE_INFINITY
+        : Math.max(1, options.maxMessages - systemCount - 1);
+    const keepRecentMessages = Math.min(options.keepRecentMessages ?? 8, maxTailForMessageLimit);
+    let cut = Math.max(systemCount, messages.length - keepRecentMessages);
+    while (cut > systemCount && messages[cut]?.role === "tool") {
+        cut -= 1;
+    }
+    if (cut <= systemCount) {
+        throw new ValidationError("Agent compaction cannot satisfy its limits without removing protected messages.");
+    }
+    const compactedMessages = structuredClone(messages.slice(systemCount, cut));
+    const retainedMessages = structuredClone(messages.slice(cut));
+    const sourceDigest = fingerprintAgentHarness(messages);
+    const id = `cmp_${createHash("sha256")
+        .update(`${state.runId}\0${beforeStep}\0${sourceDigest}`)
+        .digest("hex")}`;
+    const result = await options.compactor({
+        runId: state.runId,
+        agentId: state.agentId,
+        scope: state.scope,
+        beforeStep,
+        context,
+        messages: compactedMessages,
+        retainedMessages,
+        reasons,
+        estimatedTokensBefore,
+        sourceDigest,
+        idempotencyKey: id,
+        metadata: state.metadata,
+        abortSignal
+    });
+    const summary = result.summary.trim();
+    if (!summary) {
+        throw new ValidationError("Agent compactor returned an empty summary.");
+    }
+    const compacted = [
+        ...structuredClone(messages.slice(0, systemCount)),
+        createTextMessage("assistant", `[Compacted prior conversation]\n${summary}`),
+        ...retainedMessages
+    ];
+    const estimatedTokensAfter = estimateTokens(compacted);
+    if (compacted.length >= messages.length || estimatedTokensAfter >= estimatedTokensBefore) {
+        throw new ValidationError("Agent compaction must reduce both message count and estimated input tokens.");
+    }
+    if (options.maxMessages !== undefined && compacted.length > options.maxMessages) {
+        throw new ValidationError("Agent compaction result still exceeds maxMessages.");
+    }
+    if (options.maxEstimatedInputTokens !== undefined &&
+        estimatedTokensAfter > options.maxEstimatedInputTokens) {
+        throw new ValidationError("Agent compaction result still exceeds maxEstimatedInputTokens.");
+    }
+    const resultDigest = fingerprintAgentHarness(compacted);
+    return {
+        messages: compacted,
+        record: {
+            id,
+            beforeStep,
+            createdAt: Date.now(),
+            reasons,
+            sourceDigest,
+            resultDigest,
+            summaryDigest: fingerprintAgentHarness(summary),
+            summary,
+            messageCountBefore: messages.length,
+            messageCountAfter: compacted.length,
+            compactedMessageCount: compactedMessages.length,
+            retainedMessageCount: retainedMessages.length,
+            estimatedTokensBefore,
+            estimatedTokensAfter,
+            usage: result.usage,
+            metadata: result.metadata
+        }
+    };
+};
+const createGenerateOptions = (agent, state, input, messages, maxSteps, context, executionEnvironmentSession, abortSignal = input.abortSignal, onCompaction) => {
     const tools = { ...(toToolSet(input.tools ?? agent.tools) ?? {}) };
     for (const subagent of agent.subagents ?? []) {
         const subagentTool = createSubAgentTool({
             ...subagent,
+            agent: {
+                ...subagent.agent,
+                store: subagent.agent.store ?? agent.store,
+                memory: subagent.agent.memory ?? agent.memory,
+                executionEnvironment: subagent.agent.executionEnvironment ??
+                    input.executionEnvironment ??
+                    agent.executionEnvironment,
+                compaction: subagent.agent.compaction ?? (input.compaction === false
+                    ? undefined
+                    : input.compaction ?? agent.compaction)
+            },
             parentRunId: state.runId,
             parentAgentId: state.agentId,
             scope: state.scope,
+            runtimeState: state,
             onStart: async ({ toolName, childAgentId }) => {
                 await emitTelemetryEvent(agent, {
                     type: "subagent-start",
@@ -655,7 +1097,12 @@ const createGenerateOptions = (agent, state, input, messages, maxSteps, abortSig
                 });
             },
             onFinish: async (childRun) => {
-                state.childRuns = [...(state.childRuns ?? []), childRun];
+                state.childRuns = [
+                    ...(state.childRuns ?? []).filter((existing) => childRun.toolCallId
+                        ? existing.toolCallId !== childRun.toolCallId
+                        : existing.runId !== childRun.runId),
+                    childRun
+                ];
                 await emitTelemetryEvent(agent, {
                     type: "subagent-finish",
                     runId: state.runId,
@@ -671,12 +1118,20 @@ const createGenerateOptions = (agent, state, input, messages, maxSteps, abortSig
     }
     for (const [name, tool] of Object.entries(tools)) {
         if (isCallableToolDefinition(tool)) {
-            tools[name] = wrapToolWithJournal(agent, state, tool);
+            const environmentTool = executionEnvironmentSession
+                ? wrapToolWithExecutionEnvironment(tool, executionEnvironmentSession)
+                : tool;
+            tools[name] = tool.metadata?.type === "subagent"
+                ? environmentTool
+                : wrapToolWithJournal(agent, state, environmentTool);
         }
     }
     const finalTools = Object.keys(tools).length ? tools : undefined;
     const budget = input.policy?.budget ?? agent.policy?.budget;
     const runPolicy = resolveRunPolicy(agent, input);
+    const compaction = input.compaction === false
+        ? undefined
+        : input.compaction ?? agent.compaction;
     let checkpointState = cloneState(state);
     let reservedToolCalls = 0;
     const requestedMaxTokens = input.maxTokens ?? agent.maxTokens;
@@ -687,16 +1142,62 @@ const createGenerateOptions = (agent, state, input, messages, maxSteps, abortSig
         budgetStatus?.remaining.totalTokens
     ].filter((value) => value !== undefined);
     const maxTokens = tokenCeilings.length ? Math.min(...tokenCeilings) : undefined;
+    const requestedToolExecution = input.toolExecution ?? agent.toolExecution;
+    const toolExecution = agent.subagents?.length
+        ? {
+            ...requestedToolExecution,
+            parallel: false,
+            maxConcurrency: 1
+        }
+        : requestedToolExecution;
     return {
         model: agent.model,
         messages,
         tools: finalTools,
         toolChoice: input.toolChoice,
-        toolExecution: input.toolExecution ?? agent.toolExecution,
+        toolExecution,
         toolApprovalPolicy: input.toolApprovalPolicy ?? agent.toolApprovalPolicy,
+        toolApprovalSigner: agent.toolApprovalSigner,
+        toolApprovalResolutions: state.approvalHistory,
+        toolContext: {
+            context,
+            runId: state.runId,
+            agentId: state.agentId,
+            scope: state.scope,
+            metadata: state.metadata,
+            executionEnvironment: executionEnvironmentSession
+        },
         onToolApprovalDecision: async (event) => {
             await emitToolApprovalTelemetry(agent, state, event);
         },
+        prepareModelMessages: compaction
+            ? async ({ messages: activeMessages, step }) => {
+                const compacted = await compactAgentMessages(compaction, checkpointState, activeMessages, step, context, abortSignal);
+                if (!compacted) {
+                    return undefined;
+                }
+                checkpointState = {
+                    ...checkpointState,
+                    messages: compacted.messages,
+                    usage: aggregateTokenUsage([
+                        checkpointState.usage,
+                        compacted.record.usage
+                    ]),
+                    compactions: [
+                        ...(checkpointState.compactions ?? []).filter((existing) => existing.id !== compacted.record.id),
+                        compacted.record
+                    ],
+                    updatedAt: Date.now()
+                };
+                state.messages = compacted.messages;
+                state.usage = checkpointState.usage;
+                state.compactions = checkpointState.compactions;
+                await persistState(agent, checkpointState, runPolicy);
+                state.revision = checkpointState.revision;
+                await onCompaction?.(compacted.record);
+                return compacted.messages;
+            }
+            : undefined,
         onBeforeModelStep: ({ step }) => {
             if (!budget)
                 return;
@@ -711,12 +1212,19 @@ const createGenerateOptions = (agent, state, input, messages, maxSteps, abortSig
                 });
             }
         },
-        onModelStep: async ({ request, response, step, toolCalls }) => {
+        onModelStep: async ({ request, response, step, toolCalls, approvalRequests }) => {
             if (!agent.store)
                 return;
             const responseSnapshot = snapshotResponse(response);
-            const approvals = getAgentApprovalRequests(responseSnapshot.messages);
-            const requestOffset = Math.min(checkpointState.messages.length, request.messages.length);
+            const approvals = [
+                ...approvalRequests,
+                ...getAgentApprovalRequests(responseSnapshot.messages)
+            ];
+            const crossedCompactionBoundary = checkpointState.compactions?.some((record) => record.beforeStep === step &&
+                record.resultDigest === fingerprintAgentHarness(request.messages));
+            const requestOffset = crossedCompactionBoundary
+                ? 0
+                : messagePrefixLength(checkpointState.messages, request.messages);
             const timing = getGenerateTextStepTiming(request);
             const finishedAt = timing?.finishedAt ?? Date.now();
             const checkpointStep = {
@@ -787,6 +1295,14 @@ const createGenerateOptions = (agent, state, input, messages, maxSteps, abortSig
         temperature: input.temperature ?? agent.temperature,
         maxTokens,
         reasoning: input.reasoning ?? agent.reasoning,
+        structuredOutput: agent.outputSchema && resolveAgentOutputMode(agent) === "native"
+            ? {
+                schema: agent.outputSchema,
+                mode: "native",
+                name: agent.outputName,
+                description: agent.outputDescription
+            }
+            : undefined,
         providerOptions: input.providerOptions ?? agent.providerOptions,
         abortSignal,
         timeoutMs: input.timeoutMs,
@@ -863,6 +1379,36 @@ const createAgentAbortContext = (inputAbortSignal, policy) => {
         isTimedOut: () => timedOut
     };
 };
+const acquireExecutionEnvironment = async (environment, state, context, abortSignal) => {
+    if (!environment) {
+        return undefined;
+    }
+    const expected = state.executionEnvironment;
+    if (!expected) {
+        throw new ConflictError(`Agent run "${state.runId}" has no durable execution-environment binding.`);
+    }
+    const session = await environment.acquire({
+        runId: state.runId,
+        agentId: state.agentId,
+        scope: state.scope,
+        context,
+        metadata: state.metadata,
+        abortSignal
+    });
+    const manifestBinding = createAgentExecutionEnvironmentBinding(session.manifest);
+    if (session.binding.environmentId !== expected.environmentId ||
+        session.binding.environmentVersion !== expected.environmentVersion ||
+        session.binding.fingerprint !== expected.fingerprint ||
+        session.binding.workspaceId !== expected.workspaceId ||
+        manifestBinding.fingerprint !== expected.fingerprint) {
+        await session.release?.({
+            status: "failed",
+            error: { message: "Execution environment returned a binding that differs from the durable run." }
+        });
+        throw new ConflictError(`Execution environment binding changed for agent run "${state.runId}".`);
+    }
+    return session;
+};
 const acquireAgentExecutionLease = async (agent, state, policy) => {
     const store = agent.store;
     if (policy?.leaseMode === "disabled" || !store?.acquireLease || !store.renewLease || !store.releaseLease) {
@@ -997,17 +1543,26 @@ export class Agent {
     id;
     model;
     instructions;
+    contextSchema;
     tools;
     maxSteps;
     temperature;
     maxTokens;
     reasoning;
+    outputSchema;
+    outputMode;
+    outputName;
+    outputDescription;
     toolExecution;
     toolApprovalPolicy;
+    toolApprovalSigner;
     inputGuardrails;
     outputGuardrails;
     providerOptions;
     subagents;
+    harness;
+    executionEnvironment;
+    compaction;
     policy;
     metadata;
     store;
@@ -1023,17 +1578,26 @@ export class Agent {
             id: this.id,
             model: this.model,
             instructions: this.instructions,
+            contextSchema: this.contextSchema,
             tools: this.tools,
             maxSteps: this.maxSteps,
             temperature: this.temperature,
             maxTokens: this.maxTokens,
             reasoning: this.reasoning,
+            outputSchema: this.outputSchema,
+            outputMode: this.outputMode,
+            outputName: this.outputName,
+            outputDescription: this.outputDescription,
             toolExecution: this.toolExecution,
             toolApprovalPolicy: this.toolApprovalPolicy,
+            toolApprovalSigner: this.toolApprovalSigner,
             inputGuardrails: this.inputGuardrails,
             outputGuardrails: this.outputGuardrails,
             providerOptions: this.providerOptions,
             subagents: this.subagents,
+            harness: this.harness,
+            executionEnvironment: this.executionEnvironment,
+            compaction: this.compaction,
             policy: this.policy,
             metadata: this.metadata,
             store: this.store,
@@ -1058,6 +1622,8 @@ export const prepareSubagentsForAgent = (agent, options = {}) => {
     const onTelemetryEvent = options.onTelemetryEvent ?? agent.onTelemetryEvent;
     const toolApprovalPolicy = options.toolApprovalPolicy ?? agent.toolApprovalPolicy;
     const toolExecution = options.toolExecution ?? agent.toolExecution;
+    const executionEnvironment = options.executionEnvironment ?? agent.executionEnvironment;
+    const compaction = options.compaction ?? agent.compaction;
     const defaultMetadata = cloneMetadata(agent.metadata, options.metadata);
     return {
         ...agent,
@@ -1072,6 +1638,8 @@ export const prepareSubagentsForAgent = (agent, options = {}) => {
                 onTelemetryEvent: subagent.agent.onTelemetryEvent ?? onTelemetryEvent,
                 toolApprovalPolicy: subagent.agent.toolApprovalPolicy ?? toolApprovalPolicy,
                 toolExecution: subagent.agent.toolExecution ?? toolExecution,
+                executionEnvironment: subagent.agent.executionEnvironment ?? executionEnvironment,
+                compaction: subagent.agent.compaction ?? compaction,
                 metadata: cloneMetadata(defaultMetadata, subagent.agent.metadata)
             }
         }))
@@ -1222,7 +1790,7 @@ export const runAgent = async (agent, input = {}) => {
         context.state.status = currentStatus;
         return toOutput(context.state);
     }
-    if (currentStatus === "waiting_approval" && context.state.pendingApprovals.length > 0 && !input.approvals?.length) {
+    if (currentStatus === "waiting_approval" && context.state.pendingApprovals.length > 0) {
         context.state.status = currentStatus;
         return toOutput(context.state);
     }
@@ -1264,6 +1832,7 @@ export const runAgent = async (agent, input = {}) => {
         inputGuardrail = await runGuardrails(agent, context.state, "input", agent.inputGuardrails, () => ({
             runId: context.state.runId,
             agentId: context.state.agentId,
+            context: context.context,
             state: cloneState(context.state),
             messages: context.messages,
             metadata: context.state.metadata
@@ -1293,10 +1862,21 @@ export const runAgent = async (agent, input = {}) => {
         throw error;
     }
     const abortContext = createAgentAbortContext(mergeAbortSignals(input.abortSignal, executionLease.signal), policy);
+    let executionEnvironmentSession;
+    let executionEnvironmentStatus = "failed";
+    let executionEnvironmentError;
+    try {
+        executionEnvironmentSession = await acquireExecutionEnvironment(context.executionEnvironment, context.state, context.context, abortContext.signal);
+    }
+    catch (error) {
+        await executionLease.release();
+        throw error;
+    }
     try {
-        const result = await withAgentPolicyTimeout(generateText(createGenerateOptions(agent, context.state, input, context.messages, context.remainingSteps, abortContext.signal)), abortContext);
+        const result = await withAgentPolicyTimeout(generateText(createGenerateOptions(agent, context.state, input, context.messages, context.remainingSteps, context.context, executionEnvironmentSession, abortContext.signal)), abortContext);
         const cancelled = executionLease.cancelledState();
         if (cancelled) {
+            executionEnvironmentStatus = cancelled.status;
             await emitRunFinishTelemetry(agent, cancelled);
             return toOutput(cancelled);
         }
@@ -1304,10 +1884,11 @@ export const runAgent = async (agent, input = {}) => {
             throw new ConflictError(`Agent run "${context.state.runId}" lost its worker lease.`);
         }
         const newSteps = mapSteps(result.steps, context.state.currentStep, result.toolResults);
-        let output = finalizeState(context.state, result, newSteps, result.toolResults);
+        let output = finalizeState(agent, context.state, result, newSteps, result.toolResults);
         const outputGuardrail = await runGuardrails(agent, output.state, "output", agent.outputGuardrails, () => ({
             runId: output.state.runId,
             agentId: output.state.agentId,
+            context: context.context,
             state: cloneState(output.state),
             output,
             metadata: output.state.metadata
@@ -1316,14 +1897,22 @@ export const runAgent = async (agent, input = {}) => {
             output = toOutput(applyGuardrailFailure(output.state, "output", outputGuardrail));
         }
         await emitFinalizedStepTelemetry(agent, output.state, newSteps);
-        await emitApprovalTelemetry(agent, output.state, approvalsFromEvents(newSteps.flatMap((step) => step.response?.messages ?? [])));
+        await emitApprovalTelemetry(agent, output.state, [
+            ...(result.approvalRequests ?? []),
+            ...approvalsFromEvents(newSteps.flatMap((step) => step.response?.messages ?? []))
+        ]);
         await persistState(agent, output.state, policy);
         await emitRunFinishTelemetry(agent, output.state);
+        executionEnvironmentStatus = output.status;
         return output;
     }
     catch (error) {
+        executionEnvironmentError = {
+            message: error instanceof Error ? error.message : String(error)
+        };
         const cancelled = executionLease.cancelledState();
         if (cancelled) {
+            executionEnvironmentStatus = cancelled.status;
             await emitRunFinishTelemetry(agent, cancelled);
             return toOutput(cancelled);
         }
@@ -1339,6 +1928,7 @@ export const runAgent = async (agent, input = {}) => {
             const timedOutState = createTerminalState(durableState, status, message);
             await persistState(agent, timedOutState, policy);
             await emitRunFinishTelemetry(agent, timedOutState);
+            executionEnvironmentStatus = timedOutState.status;
             return toOutput(timedOutState);
         }
         const durableState = agent.store
@@ -1347,9 +1937,14 @@ export const runAgent = async (agent, input = {}) => {
         const failedState = createFailedState(durableState, error instanceof Error ? error.message : String(error));
         await persistState(agent, failedState, policy);
         await emitRunFinishTelemetry(agent, failedState);
+        executionEnvironmentStatus = failedState.status;
         throw error;
     }
     finally {
+        await executionEnvironmentSession?.release?.({
+            status: executionEnvironmentStatus,
+            error: executionEnvironmentError
+        });
         await executionLease.release();
     }
 };
@@ -1360,6 +1955,7 @@ export const streamAgent = (agent, input = {}) => {
     });
     const publish = (event, terminal = false) => broadcast.publish(event, { terminal });
     let activeLease;
+    let activeExecutionEnvironment;
     const runner = (async () => {
         const context = await resolveContext(agent, input);
         const currentStatus = normalizeApprovalStatus(context.state.status);
@@ -1382,7 +1978,7 @@ export const streamAgent = (agent, input = {}) => {
                 textStream: emptyAsyncIterable()
             };
         }
-        if (currentStatus === "waiting_approval" && context.state.pendingApprovals.length > 0 && !input.approvals?.length) {
+        if (currentStatus === "waiting_approval" && context.state.pendingApprovals.length > 0) {
             context.state.status = currentStatus;
             broadcast.close();
             return {
@@ -1433,6 +2029,7 @@ export const streamAgent = (agent, input = {}) => {
             inputGuardrail = await runGuardrails(agent, context.state, "input", agent.inputGuardrails, () => ({
                 runId: context.state.runId,
                 agentId: context.state.agentId,
+                context: context.context,
                 state: cloneState(context.state),
                 messages: context.messages,
                 metadata: context.state.metadata
@@ -1486,11 +2083,48 @@ export const streamAgent = (agent, input = {}) => {
             stepIndex: context.state.currentStep + 1
         });
         const abortContext = createAgentAbortContext(mergeAbortSignals(input.abortSignal, executionLease.signal), policy);
-        const streamResult = streamText(createGenerateOptions(agent, context.state, input, context.messages, context.remainingSteps, abortContext.signal));
+        const executionEnvironmentSession = await acquireExecutionEnvironment(context.executionEnvironment, context.state, context.context, abortContext.signal);
+        activeExecutionEnvironment = executionEnvironmentSession;
+        let executionEnvironmentStatus = "failed";
+        let executionEnvironmentError;
+        let streamResult;
+        try {
+            streamResult = streamText(createGenerateOptions(agent, context.state, input, context.messages, context.remainingSteps, context.context, executionEnvironmentSession, abortContext.signal, async (record) => {
+                await publish({
+                    type: "agent-compaction",
+                    compaction: record
+                });
+            }));
+        }
+        catch (error) {
+            executionEnvironmentError = {
+                message: error instanceof Error ? error.message : String(error)
+            };
+            await executionEnvironmentSession?.release?.({
+                status: "failed",
+                error: executionEnvironmentError
+            });
+            activeExecutionEnvironment = undefined;
+            await executionLease.release();
+            throw error;
+        }
         const approvalRequests = [];
         const eventRelay = (async () => {
             for await (const event of streamResult.eventStream) {
                 await publish(event);
+                if (event.type === "tool-approval-request") {
+                    approvalRequests.push(event.approval);
+                    await publish({
+                        type: "agent-approval-request",
+                        approval: event.approval
+                    });
+                    await emitTelemetryEvent(agent, {
+                        type: "approval-request",
+                        runId: context.state.runId,
+                        agentId: context.state.agentId,
+                        approval: event.approval
+                    });
+                }
                 if (event.type === "provider-data" &&
                     typeof event.data === "object" &&
                     event.data !== null &&
@@ -1526,6 +2160,7 @@ export const streamAgent = (agent, input = {}) => {
                 const final = await withAgentPolicyTimeout(eventRelay.then(() => streamResult.collect()), abortContext);
                 const cancelled = executionLease.cancelledState();
                 if (cancelled) {
+                    executionEnvironmentStatus = cancelled.status;
                     await emitRunFinishTelemetry(agent, cancelled);
                     await publish({
                         type: "agent-run-finish",
@@ -1541,10 +2176,11 @@ export const streamAgent = (agent, input = {}) => {
                     throw conflict;
                 }
                 const newSteps = mapSteps(final.steps, context.state.currentStep, final.toolResults);
-                let result = finalizeState(context.state, final, newSteps, final.toolResults);
+                let result = finalizeState(agent, context.state, final, newSteps, final.toolResults);
                 const outputGuardrail = await runGuardrails(agent, result.state, "output", agent.outputGuardrails, () => ({
                     runId: result.state.runId,
                     agentId: result.state.agentId,
+                    context: context.context,
                     state: cloneState(result.state),
                     output: result,
                     metadata: result.state.metadata
@@ -1574,11 +2210,16 @@ export const streamAgent = (agent, input = {}) => {
                     state: result.state
                 }, true);
                 broadcast.close();
+                executionEnvironmentStatus = result.status;
                 return result;
             }
             catch (error) {
+                executionEnvironmentError = {
+                    message: error instanceof Error ? error.message : String(error)
+                };
                 const cancelled = executionLease.cancelledState();
                 if (cancelled) {
+                    executionEnvironmentStatus = cancelled.status;
                     await emitRunFinishTelemetry(agent, cancelled);
                     await publish({
                         type: "agent-run-finish",
@@ -1612,6 +2253,7 @@ export const streamAgent = (agent, input = {}) => {
                         state: timedOutState
                     }, true);
                     broadcast.close();
+                    executionEnvironmentStatus = timedOutState.status;
                     return toOutput(timedOutState);
                 }
                 const durableState = agent.store
@@ -1630,9 +2272,15 @@ export const streamAgent = (agent, input = {}) => {
                     state: failedState
                 }, true);
                 broadcast.close();
+                executionEnvironmentStatus = failedState.status;
                 throw error;
             }
             finally {
+                await executionEnvironmentSession?.release?.({
+                    status: executionEnvironmentStatus,
+                    error: executionEnvironmentError
+                });
+                activeExecutionEnvironment = undefined;
                 await executionLease.release();
             }
         })();
@@ -1641,6 +2289,11 @@ export const streamAgent = (agent, input = {}) => {
             textStream: streamResult.textStream
         };
     })().catch(async (error) => {
+        await activeExecutionEnvironment?.release?.({
+            status: "failed",
+            error: { message: error instanceof Error ? error.message : String(error) }
+        });
+        activeExecutionEnvironment = undefined;
         await activeLease?.release();
         broadcast.fail(error);
         throw error;