agentfootprint 10.8.0 → 10.9.0

package/dist/core/agent/stages/toolCalls.js

@@ -1,4 +1,31 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildToolCallsHandler = exports.producerCorpusOf = exports.notDispatchedResult = exports.pausedBatchOf = exports._resetPeriodUnjudgedWarnings = exports.composeReadSkillRefusal = exports.unknownToolResult = exports.notServedResult = exports.atMountedCursor = void 0;
+const refusal_js_1 = require("../findings/refusal.js");
+const admission_js_1 = require("../findings/admission.js");
 /**
  * toolCalls — pausable handler for executing the LLM-requested tool
  * calls in the agent's ReAct loop.
@@ -50,31 +77,6 @@
  * calls it with a valid Skill id, the next InjectionEngine pass
  * activates that Skill (lifetime: turn).
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildToolCallsHandler = exports.producerCorpusOf = exports.notDispatchedResult = exports.pausedBatchOf = exports._resetPeriodUnjudgedWarnings = exports.composeReadSkillRefusal = exports.unknownToolResult = exports.notServedResult = exports.atMountedCursor = void 0;
 const codeRunnerTool_js_1 = require("../../codeRunnerTool.js");
 const footprintjs_1 = require("footprintjs");
 const types_js_1 = require("../../../provider-contract/types.js");
@@ -2623,6 +2625,7 @@ function buildToolCallsHandler(deps) {
                 return { result: `credential error for '${need.credential}': ${reason}`, error: true };
             }
         }
+        let executed = false;
         try {
             // The time layer's dispatch moment — a resumed call is dispatched NOW,
             // so its `dispatchedAt` is the resume's, not the pause's.
@@ -2634,7 +2637,7 @@ function buildToolCallsHandler(deps) {
                 args = dispatched.args;
             // `let`, not `const`: the semantic projection below replaces the value
             // on the non-envelope path exactly as the batch loop does.
-            let result = await tool.execute(args, {
+            const executionContext = {
                 toolCallId,
                 iteration,
                 ...(callTime !== undefined && { time: callTime }),
@@ -2647,7 +2650,9 @@ function buildToolCallsHandler(deps) {
                 ...toolProgress(scope, { toolName, toolCallId, iteration }),
                 ...sessionContext(scope, toolName, toolCallId),
                 ...toolDispatchCtx(scope, { toolName, toolCallId, iteration }, env.signal),
-            });
+            };
+            executed = true;
+            let result = await tool.execute(args, executionContext);
             await endCall(toolCallId);
             // The typed effects channel (9.19.0) — same unwrap as the batch loop,
             // at this path's own execute boundary, so a resumed call's envelope is
@@ -2771,7 +2776,7 @@ function buildToolCallsHandler(deps) {
                     result: `tool '${toolName}' requested a pause while resuming an approved check-in, which is not supported`,
                     error: true,
                     // It ran — a tool that asked to pause had already started work.
-                    executed: true,
+                    executed,
                 };
             }
             // A tool that threw still RAN, and may have done half its work; the
@@ -2779,7 +2784,7 @@ function buildToolCallsHandler(deps) {
             return {
                 result: err instanceof Error ? err.message : String(err),
                 error: true,
-                executed: true,
+                executed,
             };
         }
     };
@@ -2809,12 +2814,40 @@ function buildToolCallsHandler(deps) {
                 ...scope.llmLatestToolCalls,
             ];
             const iteration = scope.iteration;
+            // ── STANDINGS OF EARLIER RESULTS AND REFERENCE ADMISSION ───────
+            // Freeze admission before batch asks, kept-answer consumption or any
+            // policy/credential callback. A sibling result never enlarges it.
+            const findingsPeels = deps.findings === true ? toolCalls.map(peelCall) : [];
+            const findingsRefusals = findingsPeels.map((peeled) => (0, admission_js_1.findingsReferenceRefusal)(peeled.findings, scope.findingsRequest?.[0], iteration, peeled.malformed));
+            if (deps.findings === true &&
+                findingsPeels.some((p) => p.findings !== undefined || p.malformed) &&
+                scope.findingsBatchRecordedAt !== iteration) {
+                const known = (0, offer_js_1.knownResults)([...(scope.history ?? [])], [...(scope.toolResults ?? [])]);
+                scope.findingsBatchRecordedAt = iteration;
+                (0, ledger_js_2.recordFindings)(scope, toolCalls.flatMap((tc, index) => findingsRefusals[index] === undefined
+                    ? []
+                    : [
+                        (0, refusal_js_1.referenceRefusalRow)({ toolCallId: tc.id }, iteration, (findingsPeels[index]?.malformed ?? 0) > 0, findingsPeels[index]?.malformed ? tc.args._findings : undefined),
+                    ]), turnStampOf(scope));
+                (0, ledger_js_2.recordFindings)(scope, (0, unsettled_js_1.withUnsettledRows)(toolCalls.flatMap((tc, index) => {
+                    const declared = findingsPeels[index]?.findings;
+                    return declared?.previous !== undefined
+                        ? (0, ledger_js_2.standingRowsFrom)(known, declared, { toolCallId: tc.id }, iteration, {
+                            witness: scope.findingsRequest?.[0],
+                        })
+                        : [];
+                }), known, () => [...(scope.coverageDeclared ?? [])]), turnStampOf(scope));
+            }
             // THE INPUTS LAYER'S HALF OF DISPATCH (honesty layer 2) — loaded through
             // `import()` only under the arm, so an unarmed batch awaits nothing new.
             const inputs = deps.inputsLayer === true ? await Promise.resolve().then(() => __importStar(require('../arguments/dispatch.js'))) : undefined;
             // THE INPUTS LAYER'S RESOLUTIONS for this batch — read only under the
             // arm, and only the entries resolved for THIS iteration.
             let resolutions = inputs?.resolutionsFor(scope, iteration);
+            if (resolutions !== undefined && findingsRefusals.some((item) => item !== undefined)) {
+                const refusedIds = new Set(toolCalls.filter((_, index) => findingsRefusals[index] !== undefined).map((tc) => tc.id));
+                resolutions = new Map([...resolutions].filter(([id]) => !refusedIds.has(id)));
+            }
             // A fill the layer took from an answer this turn KEPT (a call of the
             // batch that asked could not finish) is that answer's one use — dropped
             // before anything else (`arguments/dispatch.ts` · `dropUsedKept`).
@@ -2905,37 +2938,10 @@ function buildToolCallsHandler(deps) {
             // call to this same array). `lastToolResult` stays the last entry;
             // `on-tool-return` triggers and skill-graph routes read the batch.
             const batchResults = [];
-            // ── STANDINGS OF EARLIER RESULTS (9.101.0, `.findings()`) ─────────
-            // Every call in this batch may carry `_findings.previous`; ALL are
-            // recorded, in call order, by the judged result's id (a served fold
-            // takes the last). A named id is identified against the results the
-            // run can identify (`findings/offer.ts · knownResults`): the previous
-            // batch — `toolResults`, about to be reset one line down, so this is
-            // the last read of it — and every tool message on `history` as served
-            // to this call, the SAME list the offer was read from at the Tools
-            // mount, so an id copied from the offer resolves whichever batch it
-            // came from (9.102.0; before, only the last batch resolved and an
-            // offered older id filed as `unknownId`). Read through the same
-            // per-call peel the loop below applies (a tool that owns the name
-            // declares nothing). A ruled-out standing whose result THIS door
-            // recorded as an absence (`declareCoverage`'s rows on
-            // `coverageDeclared`, never a second reading of a return) AND the
-            // model was served as one (the served string — the door records the
-            // return before the after-tool chain, the ceiling and placement act,
-            // so a denied, refused or ticketed result files nothing) gets its
-            // `unsettled-by-absence` row immediately after it, in the same write,
-            // worded from what was served (9.113.0, `findings/unsettled.ts`; the
-            // key is read only for such a standing); the standing rows pass
-            // through untouched. Gated: unarmed, not one line runs.
-            if (deps.findings === true) {
-                const known = (0, offer_js_1.knownResults)([...(scope.history ?? [])], [...(scope.toolResults ?? [])]);
-                (0, ledger_js_2.recordFindings)(scope, (0, unsettled_js_1.withUnsettledRows)(toolCalls.flatMap((tc) => {
-                    const declared = peelCall(tc).findings;
-                    return declared?.previous !== undefined
-                        ? (0, ledger_js_2.standingRowsFrom)(known, declared, { toolCallId: tc.id }, iteration)
-                        : [];
-                }), known, () => [...(scope.coverageDeclared ?? [])]), turnStampOf(scope));
-            }
+            // Findings standings were preserved in the admission preflight, before
+            // the batch ask could pause. Their identity came from this response's
+            // immutable request witness, not this resetting result list. Absence
+            // interpretation still uses the existing known-results/coverage reader.
             scope.toolResults = [];
             // The results layer (honesty layer 3) judges each batch ONCE, at the
             // first loop-head visit after it ran — told apart from a re-entry by
@@ -2961,7 +2967,7 @@ function buildToolCallsHandler(deps) {
             // checker sees consistent identity across both gates.
             const runIdentity = scope.runIdentity;
             const env = scope.$getEnv();
-            for (const tc of toolCalls) {
+            for (const [callIndex, tc] of toolCalls.entries()) {
                 const emitSecurity = (0, toolSecurityEvents_js_1.bindToolSecurityEvents)(scope, { toolCallId: tc.id, iteration });
                 const resolved = resolveTool(tc.name);
                 const tool = resolved.tool;
@@ -2997,13 +3003,14 @@ function buildToolCallsHandler(deps) {
                     ...(toolCalls.length > 1 && { parallelCount: toolCalls.length }),
                 });
                 const startMs = Date.now();
-                let result;
-                let error;
+                const findingsRefusal = findingsRefusals[callIndex];
+                let result = findingsRefusal;
+                let error = findingsRefusal === undefined ? undefined : true;
                 /** The typed effects channel (9.19.0) — set only when the tool
                  *  returned a recognized result envelope; everything else keeps
                  *  today's path byte for byte. */
                 let toolEnvelope;
-                let toolStatus;
+                let toolStatus = findingsRefusal === undefined ? undefined : 'invalid';
                 // Permission gate — when a checker is configured, evaluate BEFORE
                 // executing the tool. Emits `permission.check` with the decision.
                 //
@@ -3044,7 +3051,7 @@ function buildToolCallsHandler(deps) {
                  *  judged on. Same reference as `args` unless a link rewrote (or the
                  *  inputs layer filled a value — then every filled key is named). */
                 let chainedArgs = runArgs;
-                let denied = false;
+                let denied = findingsRefusal !== undefined;
                 /** True once `tool.execute` has been entered — see `afterMoment`. */
                 let executed = false;
                 /** The tool's own `resultCeiling` refused this call's result (9.20.0)
@@ -3052,7 +3059,7 @@ function buildToolCallsHandler(deps) {
                  *  refusal's own instruction is to call again. */
                 let ceilingRefused = false;
                 let haltContext;
-                if (permissionChecker) {
+                if (!denied && permissionChecker) {
                     try {
                         // Sequence is derived from history at check time (not parallel
                         // state) — single source of truth, survives resumeOnError.
@@ -3253,7 +3260,7 @@ function buildToolCallsHandler(deps) {
                 // the layer NOT mounted — any call whose tool declares rules (fail
                 // closed). Neither applies to a tool that declares nothing — and
                 // neither awaits for one (`unmountedRules` answers it synchronously).
-                const unmounted = argsRejected ? undefined : unmountedRules(tool, tc.name);
+                const unmounted = denied || argsRejected ? undefined : unmountedRules(tool, tc.name);
                 warnUnmountedToolPeriod(tool, tc.name);
                 const rulesRefusal = argsRejected
                     ? undefined
@@ -3680,8 +3687,7 @@ function buildToolCallsHandler(deps) {
                             // Set BEFORE the await: a tool that throws has still run, and a
                             // tool that does not exist has not. This flag is the entire
                             // precondition of the after-tool moment below.
-                            executed = true;
-                            result = await tool.execute(callArgs, {
+                            const executionContext = {
                                 toolCallId: tc.id,
                                 iteration,
                                 ...(callTime !== undefined && { time: callTime }),
@@ -3694,7 +3700,9 @@ function buildToolCallsHandler(deps) {
                                 ...toolProgress(scope, { toolName: tc.name, toolCallId: tc.id, iteration }),
                                 ...sessionContext(scope, tc.name, tc.id),
                                 ...toolDispatchCtx(scope, { toolName: tc.name, toolCallId: tc.id, iteration }, env.signal),
-                            });
+                            };
+                            executed = true;
+                            result = await tool.execute(callArgs, executionContext);
                             // A code-runner tool leaves the SHAPE of what it just ran, keyed by
                             // this call. Taken and deleted here so the map cannot grow across
                             // a long run, and emitted from the dispatch loop rather than from
@@ -4349,6 +4357,7 @@ function buildToolCallsHandler(deps) {
                     content: resultStr,
                     toolCallId: tc.id,
                     toolName: tc.name,
+                    ...(deps.findings === true && !executed && { toolResultOrigin: 'not-entered' }),
                     ...(layerNote !== '' && { toolChars: deliveredResult.length }),
                     ...(tc.argumentsFailure !== undefined && {
                         toolArgumentsFailure: { ...tc.argumentsFailure },
@@ -4499,6 +4508,27 @@ function buildToolCallsHandler(deps) {
             if (deps.resultsLayer === true && scope.toolResultsIteration === undefined) {
                 scope.toolResultsIteration = scope.iteration;
             }
+            if (deps.findings === true) {
+                const proposed = [...scope.history]
+                    .reverse()
+                    .find((message) => message.role === 'assistant' &&
+                    message.toolCalls?.some((call) => call.id === toolCallId))
+                    ?.toolCalls?.filter((call) => call.id === toolCallId);
+                const declaration = proposed?.length === 1 ? peelCall(proposed[0]) : undefined;
+                const refusal = proposed?.length === 1
+                    ? (0, admission_js_1.findingsReferenceRefusal)(declaration?.findings, scope.findingsRequest?.[0], scope.iteration, declaration?.malformed)
+                    : JSON.stringify({
+                        refused: 'findings-reference',
+                        reason: 'The original paused proposal is unavailable or ambiguous.',
+                    });
+                if (refusal !== undefined) {
+                    scope.messageDeniedReason = refusal;
+                    scope.messageDeniedPhase = 'output';
+                    scope.messageDeniedBy = 'findings-reference-admission';
+                    scope.$break('findings reference refused the resumed proposal');
+                    return;
+                }
+            }
             // ── Middleware-ask decision path ─────────────────────────────────
             // Discriminated by `scope.pausedAsk`, restored from the checkpoint.
             //
@@ -4750,7 +4780,14 @@ function buildToolCallsHandler(deps) {
                 // siblings the pause left un-dispatched, each settled — never run.
                 const askSettlement = settleBatch([
                     ...scope.history,
-                    { role: 'tool', content: askResultStr, toolCallId, toolName },
+                    {
+                        role: 'tool',
+                        content: askResultStr,
+                        toolCallId,
+                        toolName,
+                        ...(deps.findings === true &&
+                            !toolRan && { toolResultOrigin: 'not-entered' }),
+                    },
                 ], { toolName, toolCallId });
                 const askHistory = askSettlement.history;
                 scope.history = askHistory;
@@ -4903,7 +4940,14 @@ function buildToolCallsHandler(deps) {
                 // The batch settlement (9.113.0) — the ask path's twin.
                 const decisionSettlement = settleBatch([
                     ...scope.history,
-                    { role: 'tool', content: decisionResultStr, toolCallId, toolName },
+                    {
+                        role: 'tool',
+                        content: decisionResultStr,
+                        toolCallId,
+                        toolName,
+                        ...(deps.findings === true &&
+                            !toolRan && { toolResultOrigin: 'not-entered' }),
+                    },
                 ], { toolName, toolCallId });
                 const decisionHistory = decisionSettlement.history;
                 scope.history = decisionHistory;
@@ -5020,7 +5064,14 @@ function buildToolCallsHandler(deps) {
                 // The batch settlement (9.113.0) — the ask path's twin.
                 const consentSettlement = settleBatch([
                     ...scope.history,
-                    { role: 'tool', content: consentResultStr, toolCallId, toolName },
+                    {
+                        role: 'tool',
+                        content: consentResultStr,
+                        toolCallId,
+                        toolName,
+                        ...(deps.findings === true &&
+                            dispatched.executed !== true && { toolResultOrigin: 'not-entered' }),
+                    },
                 ], { toolName, toolCallId });
                 const consentHistory = consentSettlement.history;
                 scope.history = consentHistory;