agentfootprint 13.0.0 → 14.0.0

package/dist/core/agent/stages/toolCalls/execution/credentialAdmission.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.admitToolCredential = void 0;
+const consent_js_1 = require("../../../../../identity/consent.js");
+const reportingCredentials_js_1 = require("../decorators/reportingCredentials.js");
+/** Existing credentialAdmission body; original guard and native pause return stay with the handler. */
+async function admitToolCredential(scope, deps, frame) {
+    frame.emitSecurity('agentfootprint.credential.requested', {
+        service: frame.need.credential,
+        ...(frame.need.mode && { mode: frame.need.mode }),
+    });
+    try {
+        const cred = await frame.credentialsIn(scope, frame.need.credential).getCredential({
+            service: frame.need.credential,
+            ...(frame.need.scopes && { scopes: frame.need.scopes }),
+            ...(frame.need.mode && { mode: frame.need.mode }),
+            ...(frame.runIdentity && {
+                identity: {
+                    ...(frame.runIdentity.principal && { principal: frame.runIdentity.principal }),
+                    ...(frame.runIdentity.tenant && { tenant: frame.runIdentity.tenant }),
+                },
+            }),
+        });
+        if (cred.status === 'issued') {
+            frame.authorization.resolvedCredential = cred.credential;
+            frame.emitSecurity('agentfootprint.credential.acquired', {
+                service: frame.need.credential,
+                kind: cred.credential.kind,
+                ...(cred.expiresAt !== undefined && { expiresAt: cred.expiresAt }),
+            });
+            deps.clearConsentOutstanding?.(frame.need.credential);
+        }
+        else {
+            frame.authorization.credentialBlocked = true;
+            // The event has ALWAYS carried `{ service, sessionId }` and
+            // never the URL (6.11.0's contract). That was right; what was
+            // wrong was the tool-result string below, which carried the URL
+            // to the one party that cannot click it and to every channel
+            // built to preserve tool output.
+            frame.emitSecurity('agentfootprint.credential.authorization_required', {
+                service: frame.need.credential,
+                sessionId: cred.sessionId,
+            });
+            // In a batch whose one human question was the inputs layer's
+            // ask, there is no second pause to give: the model is told, as
+            // under `'tell-model'` (`oneQuestionAsked`).
+            if (frame.onAuthorizationRequired === 'pause' && !frame.oneQuestionAsked) {
+                // Consent is unfinished work, and unfinished work is a pause
+                // — the same wire the check-in gate and a middleware `ask`
+                // ride. Commit partial state so resume() finds history
+                // intact; the proposed args ride the checkpoint so the tool
+                // can run once the person has consented.
+                scope.history = frame.newHistory;
+                scope.pausedToolCallId = frame.tc.id;
+                scope.pausedToolName = frame.tc.name;
+                scope.pausedToolStartMs = frame.startMs;
+                scope.pausedCredential = true;
+                scope.pausedCredentialArgs = frame.callArguments.callArgs;
+                scope.pausedCredentialService = frame.need.credential;
+                // Same carrier as the middleware-ask pause (9.92.0).
+                if (frame.resolved.party !== undefined)
+                    scope.pausedToolParty = frame.resolved.party;
+                // Open until the person consents: `submitted`, without the text.
+                frame.fileScript(scope, {
+                    tool: frame.tool,
+                    toolName: frame.tc.name,
+                    toolCallId: frame.tc.id,
+                    iteration: frame.iteration,
+                    proposed: frame.proposedProgram,
+                    submitted: frame.programOfCall(frame.tool, frame.callArguments.callArgs),
+                    settlement: 'not-entered',
+                    paused: true,
+                });
+                // A defined return value triggers the footprintjs pause; this
+                // object becomes the checkpoint's pauseData, and standingAgent's
+                // describePause hands it to the caller as `PendingAsk`.
+                // `CONSENT_PAUSE_KEY` is what lets `pause.request` withhold
+                // the URL from the event stream by name.
+                return {
+                    toolCallId: frame.tc.id,
+                    toolName: frame.tc.name,
+                    question: (0, consent_js_1.consentQuestion)(frame.need.credential, frame.tc.name),
+                    [consent_js_1.CONSENT_PAUSE_KEY]: {
+                        service: frame.need.credential,
+                        authorizationUrl: cred.authorizationUrl,
+                        sessionId: cred.sessionId,
+                    },
+                };
+            }
+            // `'tell-model'`: the model reads a refusal naming the service
+            // and never the URL, and may route around the block. The turn
+            // cannot report a clean completion — the record goes out on the
+            // side channel and `Agent.finalizeResult` raises.
+            frame.outcome.error = true;
+            frame.outcome.result = (0, consent_js_1.modelRefusal)(frame.need.credential);
+            // Under `'pause'`, reached only in the batch that asked: the
+            // person's answers the call carried are kept, so a call the
+            // model proposes again runs with them and pauses for consent
+            // in a batch that asked nothing (its sentence stays the
+            // credential's own — the service is the subject).
+            if (frame.onAuthorizationRequired === 'pause') {
+                frame.askedLayer?.keepAnswers(scope, frame.tc.name, frame.resolution, frame.tool, frame.callArguments.callArgs);
+            }
+            deps.reportConsentOutstanding?.({
+                service: frame.need.credential,
+                authorizationUrl: cred.authorizationUrl,
+                sessionId: cred.sessionId,
+                tool: frame.tc.name,
+                iteration: frame.iteration,
+            });
+        }
+    }
+    catch (credErr) {
+        frame.authorization.credentialBlocked = true;
+        frame.outcome.error = true;
+        const reason = credErr instanceof Error ? credErr.message : String(credErr);
+        frame.emitSecurity('agentfootprint.credential.failed', {
+            service: frame.need.credential,
+            reason,
+            tool: frame.tc.name,
+            ...((0, reportingCredentials_js_1.errorClassOf)(credErr) !== undefined && { errorClass: (0, reportingCredentials_js_1.errorClassOf)(credErr) }),
+        });
+        frame.outcome.result = `credential error for '${frame.need.credential}': ${reason}`;
+    }
+    return undefined;
+}
+exports.admitToolCredential = admitToolCredential;
+//# sourceMappingURL=credentialAdmission.js.map

package/dist/core/agent/stages/toolCalls/execution/credentialAdmission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialAdmission.js","sourceRoot":"","sources":["../../../../../../src/core/agent/stages/toolCalls/execution/credentialAdmission.ts"],"names":[],"mappings":";;;AAIA,mEAK4C;AAO5C,mFAAqE;AA+BrE,uGAAuG;AAChG,KAAK,UAAU,mBAAmB,CACvC,KAA6B,EAC7B,IAAwF,EACxF,KAA+B;IAE/B,KAAK,CAAC,YAAY,CAAC,qCAAqC,EAAE;QACxD,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;QAC9B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,aAAa,CAAC;YACjF,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;YAC9B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI;gBACvB,QAAQ,EAAE;oBACR,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;oBAC9E,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;iBACtE;aACF,CAAC;SACH,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,KAAK,CAAC,aAAa,CAAC,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC;YACzD,KAAK,CAAC,YAAY,CAAC,oCAAoC,EAAE;gBACvD,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;gBAC9B,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;gBAC1B,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;aACnE,CAAC,CAAC;YACH,IAAI,CAAC,uBAAuB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,aAAa,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC7C,4DAA4D;YAC5D,8DAA8D;YAC9D,gEAAgE;YAChE,6DAA6D;YAC7D,iCAAiC;YACjC,KAAK,CAAC,YAAY,CAAC,kDAAkD,EAAE;gBACrE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;gBAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YACH,6DAA6D;YAC7D,+DAA+D;YAC/D,6CAA6C;YAC7C,IAAI,KAAK,CAAC,uBAAuB,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBACzE,6DAA6D;gBAC7D,2DAA2D;gBAC3D,uDAAuD;gBACvD,4DAA4D;gBAC5D,yCAAyC;gBACzC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC;gBACjC,KAAK,CAAC,gBAAgB,GAAG,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBACrC,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC;gBACrC,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC;gBACxC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAC9B,KAAK,CAAC,oBAAoB,GAAG,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC;gBAC1D,KAAK,CAAC,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;gBACtD,qDAAqD;gBACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS;oBAAE,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACrF,iEAAiE;gBACjE,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE;oBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;oBACvB,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;oBACvB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK,CAAC,eAAe;oBAC/B,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC;oBACxE,UAAU,EAAE,aAAa;oBACzB,MAAM,EAAE,IAAI;iBACb,CAAC,CAAC;gBACH,8DAA8D;gBAC9D,iEAAiE;gBACjE,wDAAwD;gBACxD,4DAA4D;gBAC5D,yCAAyC;gBACzC,OAAO;oBACL,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;oBACvB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;oBACvB,QAAQ,EAAE,IAAA,4BAAe,EAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC;oBAC/D,CAAC,8BAAiB,CAAC,EAAE;wBACnB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;wBAC9B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;wBACvC,SAAS,EAAE,IAAI,CAAC,SAAS;qBAC1B;iBACF,CAAC;YACJ,CAAC;YACD,+DAA+D;YAC/D,8DAA8D;YAC9D,gEAAgE;YAChE,kDAAkD;YAClD,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;YAC3B,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAA,yBAAY,EAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3D,6DAA6D;YAC7D,4DAA4D;YAC5D,6DAA6D;YAC7D,wDAAwD;YACxD,kDAAkD;YAClD,IAAI,KAAK,CAAC,uBAAuB,KAAK,OAAO,EAAE,CAAC;gBAC9C,KAAK,CAAC,UAAU,EAAE,WAAW,CAC3B,KAAK,EACL,KAAK,CAAC,EAAE,CAAC,IAAI,EACb,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,aAAa,CAAC,QAAQ,CAC7B,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBAC9B,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;gBAC9B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;gBACnB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QACjB,KAAK,CAAC,aAAa,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC7C,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5E,KAAK,CAAC,YAAY,CAAC,kCAAkC,EAAE;YACrD,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;YAC9B,MAAM;YACN,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACnB,GAAG,CAAC,IAAA,sCAAY,EAAC,OAAO,CAAC,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAA,sCAAY,EAAC,OAAO,CAAC,EAAE,CAAC;SAClF,CAAC,CAAC;QACH,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,yBAAyB,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,CAAC;IACtF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA9HD,kDA8HC"}

package/dist/core/agent/stages/toolCalls/execution/credentialsOperations.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildToolCredentialsOperations = void 0;
+const requestContext_js_1 = require("../../../../../identity/requestContext.js");
+/** Compose the existing credentials callbacks once for this handler. */
+function buildToolCredentialsOperations(deps, links) {
+    // The provider a call in `scope` is handed: bound to THAT run's request
+    // (or to none), whatever the call itself presents — and only for the one
+    // service the tool DECLARES. A tool reaches a request credential through its
+    // own `needs`, never another service's through the pull path.
+    const credentialsIn = (scope, service) => (0, requestContext_js_1.bindRequest)(links.baseCredentials, deps.currentRequest?.(scope), service);
+    return { credentialsIn };
+}
+exports.buildToolCredentialsOperations = buildToolCredentialsOperations;
+//# sourceMappingURL=credentialsOperations.js.map

package/dist/core/agent/stages/toolCalls/execution/credentialsOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialsOperations.js","sourceRoot":"","sources":["../../../../../../src/core/agent/stages/toolCalls/execution/credentialsOperations.ts"],"names":[],"mappings":";;;AAEA,iFAAwE;AAOxE,wEAAwE;AACxE,SAAgB,8BAA8B,CAC5C,IAAkD,EAClD,KAAqC;IAErC,wEAAwE;IACxE,yEAAyE;IACzE,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,OAA2B,EAAsB,EAAE,CACvF,IAAA,+BAAW,EAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAE5E,OAAO,EAAE,aAAa,EAAE,CAAC;AAC3B,CAAC;AAZD,wEAYC"}

package/dist/core/agent/stages/toolCalls/execution/deliveredResult.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.landCallResult = void 0;
+const repeatedCall_js_1 = require("../../../repeatedCall.js");
+const capture_js_1 = require("../../../negativeClaims/capture.js");
+const unscopedRun_js_1 = require("../helpers/unscopedRun.js");
+const typedEmit_js_1 = require("../../../../../recorders/core/typedEmit.js");
+/** The existing synchronous deliveredResult phase; no new await or checkpoint carrier. */
+function landCallResult(scope, deps, frame) {
+    // The tool's OWN answer, before any framework suffix joins it — what
+    // the repeated-call ledger fingerprints. Fingerprinting the decorated
+    // string instead would compare our own additions (a step that advanced
+    // once, an effect note) and miss the repeat they decorate.
+    const deliveredResult = frame.delivery.resultStr;
+    if (deps.negativeClaimsArmed === true)
+        frame.delivery.resultStr = (0, capture_js_1.serveNegativeHandle)(scope, frame.execution.negativeDispatch?.resultId, frame.delivery.resultStr);
+    const hasNegativeNote = frame.delivery.resultStr !== deliveredResult;
+    // ── Step boundary (9.18.0): advance decided, then decorate, THEN
+    // push — the suffix must be part of the one past every reader sees
+    // (history, `lastToolResult`, the batch), never spliced in later.
+    // `stream.tool_end` above keeps reporting the tool's own truth.
+    if (deps.stepPlanFor) {
+        // The activation intro: an ACCEPTED read_skill pick of a stepped
+        // skill says where the procedure starts (recency channel §1).
+        if (frame.tc.name === 'read_skill' &&
+            !frame.outcome.error &&
+            !frame.execution.denied &&
+            !frame.skillRoute.skillRejected) {
+            const pickedId = frame.callArguments.callArgs.id;
+            if (typeof pickedId === 'string' && pickedId.length > 0) {
+                frame.delivery.resultStr += frame.readSkillStepIntroFor(pickedId);
+            }
+        }
+        // The advance: only a call that RAN clean completes a step — an
+        // error result never advances (the pointer holds; the model
+        // retries, skips with a reason, or routes around), and neither
+        // does a permission denial, a gate refusal, or a ceiling refusal
+        // (the model holds no data and was told to call again — advancing
+        // would contradict the refusal's own instruction).
+        if (frame.execution.executed &&
+            !frame.outcome.error &&
+            !frame.execution.denied &&
+            !frame.skillRoute.skillRejected &&
+            !frame.execution.ceilingRefused) {
+            frame.delivery.resultStr += frame.applyStepReturn(scope, {
+                toolName: frame.tc.name,
+                toolCallId: frame.tc.id,
+                iteration: frame.iteration,
+            });
+        }
+    }
+    // ── Typed tool effects (9.19.0) — judged in call order ──────────
+    // Only for a call that RAN clean and returned an envelope. Refusal
+    // notes join the model-visible result AFTER the cap (framework
+    // truth, the step-suffix precedent); accepted effects speak through
+    // what they do — the cursor move, the delivered instruction — and
+    // through `tools.effect` on the record.
+    if (frame.outcome.toolEnvelope !== undefined &&
+        frame.execution.executed &&
+        !frame.outcome.error &&
+        !frame.execution.denied) {
+        frame.delivery.resultStr += frame.applyToolEffects(scope, { toolName: frame.tc.name, toolCallId: frame.tc.id, iteration: frame.iteration }, frame.outcome.toolEnvelope, frame.transitionState);
+    }
+    // ── Repeated-call nudge (9.26.0) ───────────────────────────────
+    // The framework is the only party that watched all three landings, so
+    // it is the only one that can say so. A NOTE on the result — the call
+    // ran, nothing was refused, and a later identical call is not blocked.
+    // Only for a call that RAN: a permission denial, a gate rejection and
+    // a ceiling refusal each already teach their own lesson, and stacking
+    // a second one would bury it.
+    //
+    // Only this batch-loop dispatch gets the nudge. The other dispatch
+    // owners are `resolveCredentialAndExecute` above (resume),
+    // `../../../toolDispatch.ts` · `agentToolDispatch` (inner calls),
+    // `mcp/mcpServe.ts` (external MCP clients), and
+    // `trace-toolpack/traceToolpack.ts` · `callTraceTool` (offline).
+    // Inner calls are the outer call's work, not another model turn.
+    // The other doors never see a live multi-turn conversation the way
+    // this loop does — a resumed check-in is a single call with no
+    // "again" to notice, an MCP-served call has no ledger to be a run's
+    // (the caller IS the loop, elsewhere), and a trace replay is judging
+    // a run that already happened, not steering one in flight. Wiring
+    // any of them would mean a second ledger with its own eviction and
+    // its own idea of "this run", for a door that cannot act on the note
+    // even if it fired one. Keep it this way.
+    if (deps.repeatedCallNudge !== false &&
+        frame.execution.executed &&
+        !frame.execution.denied &&
+        !frame.skillRoute.skillRejected) {
+        // Counted beside the run, never inside its state: a tracked write is
+        // a commit-log entry, a snapshot key, a narrative line and a row in
+        // every recording, and a turn that repeats NOTHING must stay
+        // byte-identical to the release before this one. `currentRun()` is
+        // the same accessor `ctx.runId` is composed from — one answer to
+        // "which run is this", not a second spelling of it.
+        const runKey = frame.runFactsOf(scope)?.runId ?? unscopedRun_js_1.UNSCOPED_RUN;
+        // `repeatedWhen: 'arguments'` (9.62.0) — read off the RESOLVED tool,
+        // never off the call: only the tool's own definition knows whether
+        // its result is signal or a stamp (a fresh version/timestamp/cursor
+        // that changes on every call by design). `tool` here is the same
+        // lookup the credential/wants/execute steps above already used for
+        // this call, so a tool with no static or provider match (`tool ===
+        // undefined`, already handled earlier as an error path before this
+        // point is reachable) never reads `.repeatedWhen` on `undefined`.
+        const repeatMode = frame.tool?.repeatedWhen === 'arguments' ? 'arguments' : undefined;
+        const repeat = (0, repeatedCall_js_1.noteRepeatedCall)(frame.repeatLedgers.read(runKey), frame.tc.name, frame.callArguments.callArgs, deliveredResult, repeatMode);
+        frame.repeatLedgers.write(runKey, repeat.ledger);
+        if (repeat.note !== undefined) {
+            frame.delivery.resultStr += repeat.note;
+            (0, typedEmit_js_1.typedEmit)(scope, 'agentfootprint.tools.repeated_call', {
+                toolName: frame.tc.name,
+                toolCallId: frame.tc.id,
+                iteration: frame.iteration,
+                occurrences: repeat.occurrences,
+                argsFingerprint: repeat.argsFingerprint,
+                resultFingerprint: repeat.resultFingerprint,
+                ...(repeat.mode !== undefined && { mode: repeat.mode }),
+            });
+        }
+    }
+    // ── The inputs layer's note (honesty layer 2) — LAST, after every
+    // other suffix, and only for a call that RAN on a value the library
+    // filled: one clause per fill the call really ran with
+    // (`arguments/dispatch.ts` · `fillsThatRan` — a middleware may have
+    // rewritten one). The message then carries `toolChars` (the tool's own
+    // bytes), so every reader of a result's content as the TOOL's words
+    // reads through the cut (`lib/toolBytes.ts` · `toolBytesOf`): a value
+    // that sits only in the library's note grounds nothing and hides no
+    // reading of the result. Under declared sources an answered clause
+    // also says a later call may cite the answer (`arguments/serve.ts` ·
+    // `ANSWERED_SOURCE_CLAUSE`).
+    const layerNote = frame.inputs !== undefined && frame.execution.executed
+        ? frame.inputs.noteFor(frame.tc.name, frame.tool, frame.resolution, frame.callArguments.callArgs, frame.args, frame.noteOptionsFor(frame.tool), scope)
+        : '';
+    if (layerNote !== '')
+        frame.delivery.resultStr += layerNote;
+    frame.newHistory.push({
+        role: 'tool',
+        content: frame.delivery.resultStr,
+        toolCallId: frame.tc.id,
+        toolName: frame.tc.name,
+        ...(deps.findings === true &&
+            !frame.execution.executed && { toolResultOrigin: 'not-entered' }),
+        ...((layerNote !== '' || hasNegativeNote) && { toolChars: deliveredResult.length }),
+        ...(frame.tc.argumentsFailure !== undefined && {
+            toolArgumentsFailure: { ...frame.tc.argumentsFailure },
+        }),
+    });
+    // ── Dynamic ReAct wiring ───────────────────────────────
+    //
+    // (1) `lastToolResult` drives `on-tool-return` Injection
+    //     triggers — the InjectionEngine's NEXT pass will see
+    //     this and activate any matching Instructions. Since
+    //     9.16.0 the WHOLE batch rides `toolResults` beside it
+    //     (call order preserved), so an earlier parallel call's
+    //     routing implication is no longer overwritten by a
+    //     later sibling's.
+    scope.lastToolResult = {
+        toolName: frame.tc.name,
+        result: frame.delivery.resultStr,
+        ...(frame.outcome.toolStatus !== undefined && { status: frame.outcome.toolStatus }),
+    };
+    frame.batchResults.push({
+        toolName: frame.tc.name,
+        result: frame.delivery.resultStr,
+        toolCallId: frame.tc.id,
+        ...(frame.outcome.toolStatus !== undefined && { status: frame.outcome.toolStatus }),
+    });
+    scope.toolResults = [...frame.batchResults];
+}
+exports.landCallResult = landCallResult;
+//# sourceMappingURL=deliveredResult.js.map

package/dist/core/agent/stages/toolCalls/execution/deliveredResult.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliveredResult.js","sourceRoot":"","sources":["../../../../../../src/core/agent/stages/toolCalls/execution/deliveredResult.ts"],"names":[],"mappings":";;;AAYA,8DAAsF;AAMtF,mEAAyE;AACzE,8DAAyD;AACzD,6EAAuE;AAiCvE,0FAA0F;AAC1F,SAAgB,cAAc,CAC5B,KAA6B,EAC7B,IAGC,EACD,KAA0B;IAE1B,qEAAqE;IACrE,sEAAsE;IACtE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;IACjD,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI;QACnC,KAAK,CAAC,QAAQ,CAAC,SAAS,GAAG,IAAA,gCAAmB,EAC5C,KAAK,EACL,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE,QAAQ,EAC1C,KAAK,CAAC,QAAQ,CAAC,SAAS,CACzB,CAAC;IACJ,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,eAAe,CAAC;IAErE,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,gEAAgE;IAChE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,iEAAiE;QACjE,8DAA8D;QAC9D,IACE,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY;YAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK;YACpB,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM;YACvB,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,EAC/B,CAAC;YACD,MAAM,QAAQ,GAAI,KAAK,CAAC,aAAa,CAAC,QAA6B,CAAC,EAAE,CAAC;YACvE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxD,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QACD,gEAAgE;QAChE,4DAA4D;QAC5D,+DAA+D;QAC/D,iEAAiE;QACjE,kEAAkE;QAClE,mDAAmD;QACnD,IACE,KAAK,CAAC,SAAS,CAAC,QAAQ;YACxB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK;YACpB,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM;YACvB,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa;YAC/B,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,EAC/B,CAAC;YACD,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE;gBACvD,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;gBACvB,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;gBACvB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,mEAAmE;IACnE,+DAA+D;IAC/D,oEAAoE;IACpE,kEAAkE;IAClE,wCAAwC;IACxC,IACE,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;QACxC,KAAK,CAAC,SAAS,CAAC,QAAQ;QACxB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK;QACpB,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EACvB,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,gBAAgB,CAChD,KAAK,EACL,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAChF,KAAK,CAAC,OAAO,CAAC,YAAY,EAC1B,KAAK,CAAC,eAAe,CACtB,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,8BAA8B;IAC9B,EAAE;IACF,mEAAmE;IACnE,2DAA2D;IAC3D,kEAAkE;IAClE,gDAAgD;IAChD,iEAAiE;IACjE,iEAAiE;IACjE,mEAAmE;IACnE,+DAA+D;IAC/D,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,mEAAmE;IACnE,qEAAqE;IACrE,0CAA0C;IAC1C,IACE,IAAI,CAAC,iBAAiB,KAAK,KAAK;QAChC,KAAK,CAAC,SAAS,CAAC,QAAQ;QACxB,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM;QACvB,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,EAC/B,CAAC;QACD,qEAAqE;QACrE,oEAAoE;QACpE,6DAA6D;QAC7D,mEAAmE;QACnE,iEAAiE;QACjE,oDAAoD;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,6BAAY,CAAC;QAC9D,qEAAqE;QACrE,mEAAmE;QACnE,oEAAoE;QACpE,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,MAAM,MAAM,GAAG,IAAA,kCAAgB,EAC7B,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAChC,KAAK,CAAC,EAAE,CAAC,IAAI,EACb,KAAK,CAAC,aAAa,CAAC,QAAQ,EAC5B,eAAe,EACf,UAAU,CACX,CAAC;QACF,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC;YACxC,IAAA,wBAAS,EAAC,KAAK,EAAE,oCAAoC,EAAE;gBACrD,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;gBACvB,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;gBACvB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,oEAAoE;IACpE,uDAAuD;IACvD,oEAAoE;IACpE,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,6BAA6B;IAC7B,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ;QACpD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAClB,KAAK,CAAC,EAAE,CAAC,IAAI,EACb,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,aAAa,CAAC,QAAQ,EAC5B,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAChC,KAAK,CACN;QACH,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,SAAS,KAAK,EAAE;QAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,SAAS,CAAC;IAC5D,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACjC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;QACvB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;QACvB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI;YACxB,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,gBAAgB,EAAE,aAAsB,EAAE,CAAC;QAC5E,GAAG,CAAC,CAAC,SAAS,KAAK,EAAE,IAAI,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC;QACnF,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,KAAK,SAAS,IAAI;YAC7C,oBAAoB,EAAE,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,gBAAgB,EAAE;SACvD,CAAC;KACH,CAAC,CAAC;IAEH,0DAA0D;IAC1D,EAAE;IACF,yDAAyD;IACzD,0DAA0D;IAC1D,yDAAyD;IACzD,2DAA2D;IAC3D,4DAA4D;IAC5D,wDAAwD;IACxD,uBAAuB;IACvB,KAAK,CAAC,cAAc,GAAG;QACrB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;QACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QAChC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;KACpF,CAAC;IACF,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;QACtB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;QACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QAChC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;QACvB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;KACpF,CAAC,CAAC;IACH,KAAK,CAAC,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;AAC9C,CAAC;AA5MD,wCA4MC"}