dsh-plugin-prompt-tool 2.1.0 → 3.0.0

package/engine/actions/index.mjs

@@ -4,13 +4,14 @@ import { ACTION_KINDS } from './catalog.mjs'
 import { actionSupportsWhen, actionExecutionPoint, createTurnBudget, withWhen, channelBinder } from './registration.mjs'
 import { prepareInjectText } from './inject-text.mjs'
 import { prepareAssembly } from './assembly.mjs'
-import { prepareDecision } from './decision.mjs'
+import { prepareToolGate } from './tool-gate.mjs'
+import { prepareToolResult } from './tool-result.mjs'
 import { prepareAppendContext } from './append-context.mjs'
-import { prepareGuard } from './guard.mjs'
-import { prepareSdkStrip } from './sdk-strip.mjs'
 import { prepareRequestParams } from './request-params.mjs'
+import { prepareStreamOutput } from './stream-output.mjs'
 import { prepareInboxPrepend } from './inbox-prepend.mjs'
 import { preparePreStepFilter } from './pre-step-filter.mjs'
+import { prepareToolVisibility } from './tool-visibility.mjs'
 export { ACTION_KINDS, ACTION_DEGRADE } from './catalog.mjs'
 export { actionSupportsWhen, actionExecutionPoint } from './registration.mjs'
 const DEFAULT_PLUGIN = 'prompt-actions'
@@ -18,13 +19,14 @@ const DEFAULT_PLUGIN = 'prompt-actions'
 const PREPARERS = {
   'inject-text': prepareInjectText,
   assembly: prepareAssembly,
-  decision: prepareDecision,
+  'tool-gate': prepareToolGate,
+  'tool-result': prepareToolResult,
   'append-context': prepareAppendContext,
-  guard: prepareGuard,
-  'sdk-strip': prepareSdkStrip,
   'request-params': prepareRequestParams,
+  'stream-output': prepareStreamOutput,
   'inbox-prepend': prepareInboxPrepend,
   'pre-step-filter': preparePreStepFilter,
+  'tool-visibility': prepareToolVisibility,
 }
 
 /**
@@ -32,7 +34,7 @@ const PREPARERS = {
  *
  * @param action `{ kind, id?, ... }`，形状见 {@link ACTION_KINDS}。
  * @param options.plugin 调用方插件名（错误消息 / 告警 / disposer 标签），与
- *   `mountTriggers(ctx, declarations, { plugin })` 同一约定；缺省 `prompt-actions`。
+ *   与规则运行时 `mountRuleSources` 同一约定；缺省 `prompt-actions`。
  * @param options.warnOnce 复用宿主模块的告警器；缺省为本文件自己的 warnOnce。
  * @param options.when 可选判定：不命中（非 `true`）即放行下游、不执行本动作。仅对
  *   {@link ON_REGISTERED_KINDS} 里的动作有效；对 `inject-text` / `guard` 传它会挂载期报错
@@ -40,6 +42,7 @@ const PREPARERS = {
  * @param options.prepend 让本动作落在宿主 waterfall 的**最外层**（否决型动作需要）。同样只对
  *   `ON_REGISTERED_KINDS` 有效；它表达的是**位置**，不承担声明之间的排序。
  * @param options.promptConfigOptions 宿主提供的 createPromptConfigs 选项（模板基准和策略目录），不从动作数据读取。
+ * @param options.agent 当前挂载 scope 的真实 Agent；受众限定的固定系统段必须显式提供。
  * @returns 已校验的动作类别与调用方插件名。
  */
 export function validateActionOptions(action, options = {}) {
@@ -72,14 +75,17 @@ export function prepareAction(action, options = {}) {
   return (ctx) => {
     const warnOnce = options.warnOnce ?? createWarnOnce(ctx, plugin)
     const budget = createTurnBudget(max)
-    const on = withWhen(options.on ?? channelBinder(ctx, kind, plugin, options.prepend === true), options.when, warnOnce, phase)
     const disposers = []
     const collect = (disposer) => { if (typeof disposer === 'function') disposers.push(disposer) }
+    const missHandlers = []
+    const onMiss = (callback) => { if (typeof callback === 'function') missHandlers.push(callback) }
+    const missAll = (...args) => { for (const callback of missHandlers) { try { callback(...args) } catch { /* 撤销失败不得反过来打断装配 */ } } }
+    const on = withWhen(options.on ?? channelBinder(ctx, kind, plugin, options.prepend === true), options.when, warnOnce, phase, missAll)
     // 每轮预算的轮边界由 durable 事件驱动（与谓词的 observe 同一事件源，但**独立记账**：
     // 预算是「本动作生效次数」，不是 durable 事件计数）。
     if (budget !== undefined) collect(ctx.on('session/event', (session, event) => budget.observe(session, event)))
     const take = (subject) => budget?.take(subject) ?? true
-    bind?.(ctx, { warnOnce, on, collect, take })
+    bind?.(ctx, { warnOnce, on, collect, take, onMiss, agent: options.agent })
     const dispose = () => {
       for (const release of disposers.splice(0)) {
         try {
@@ -90,6 +96,8 @@ export function prepareAction(action, options = {}) {
       }
     }
     keepDisposer(ctx, dispose, `${plugin}: action ${labelOf(action)}`)
+    // 调用方（rule-runtime）把 miss 挂到该动作的条目上；没有回调时保持 undefined。
+    dispose.miss = missHandlers.length === 0 ? undefined : missAll
     return dispose
   }
 }

package/engine/actions/inject-text.mjs

@@ -1,6 +1,8 @@
-import { applyPromptConfigs } from '../executor.mjs'
+import { applyPromptConfigSources } from '../executor.mjs'
+import { createPreStepSource, presetSourceId } from '../pre-step-source.mjs'
 import { wireLayers } from '../layers.mjs'
 import { createPromptConfigs } from '../schema.mjs'
+import { actionExecutionPoint } from './registration.mjs'
 
 export function prepareInjectText(action, plugin, promptConfigOptions) {
   const source = action.config
@@ -10,13 +12,31 @@ export function prepareInjectText(action, plugin, promptConfigOptions) {
   if (typeof source.layer !== 'string' || source.layer.length === 0) {
     throw new TypeError(`${plugin}: inject-text config.layer is required (九层之一)`)
   }
+  // 层→注册点的判据只有 `actionExecutionPoint` 一处：没有通道的层必须在这里**显式拒绝**，
+  // 否则公开 API 的 inject-text 会静默变成「配了没效果」（原先它落到已删的 tool-pipeline 分派）。
+  actionExecutionPoint(action)
   // 纯声明复用提示词配置编译；函数仅来自已有编程接口，不写回可序列化声明。
   const config = typeof source.resolve === 'function' ? source : createPromptConfigs([source], promptConfigOptions)[0]
-  return (ctx, { warnOnce, collect }) => {
+  return (ctx, { warnOnce, collect, agent }) => {
     if (config.layer === 'pre-step') {
-      collect(applyPromptConfigs(ctx, [config], action.options ?? {}))
+      const options = action.options ?? {}
+      const sourceId = typeof options.sourceId === 'string' && options.sourceId.length > 0
+        ? options.sourceId
+        : presetSourceId(config.id)
+      const source = createPreStepSource({
+        sourceId,
+        ctx,
+        configs: [config],
+        onOutcome: options.onOutcome,
+        promotion: options.promotion,
+      })
+      collect(applyPromptConfigSources([source], {
+        agent,
+        ...(options.prepend === undefined ? {} : { prepend: options.prepend }),
+        ...(options.layers === undefined ? {} : { layers: options.layers }),
+      }))
       return
     }
-    collect(wireLayers(ctx, [config], warnOnce))
+    collect(wireLayers(ctx, [config], warnOnce, { agent }))
   }
 }

package/engine/actions/pre-step-filter.mjs

@@ -1,4 +1,5 @@
 import { NAME_LIST, labelOf } from './shared.mjs'
+import { isPluginKind } from '../source-kind.mjs'
 
 export function preparePreStepFilter(action, plugin) {
   const label = labelOf(action)
@@ -36,10 +37,8 @@ export function preparePreStepFilter(action, plugin) {
       if (blockPlugins !== undefined) {
         messages = messages.filter((message) => {
           const source = message?.source
-          // v4 起插件来源的 kind 是生产者名（`plugin:<name>`），旧日志才有裸 `plugin`：
-          // 只认其中一种，换代后这道「按 source.plugin 精确屏蔽」的逃生阀会静默失效。
-          const isPlugin = source?.kind === 'plugin'
-            || (typeof source?.kind === 'string' && source.kind.startsWith('plugin:'))
+          // 插件来源（v4 或旧日志）的判定收在 source-kind；漏掉会让 blockPlugins 逃生阀静默失效。
+          const isPlugin = isPluginKind(source?.kind)
           if (!isPlugin) return true
           const name = source?.plugin
           // 只认插件自报的字符串身份；非字符串一律不拦（宁可少拦，不可误删上下文）。

package/engine/actions/registration.mjs

@@ -1,5 +1,6 @@
 import { MAX_TRACKED_SESSIONS } from '../shared.mjs'
 import { subjectOf } from '../conditions/subject.mjs'
+import { INJECTION_CHANNELS } from '../schema.mjs'
 import { ACTION_KINDS } from './catalog.mjs'
 
 export function channelBinder(ctx, kind, plugin, prepend) {
@@ -14,7 +15,7 @@ export function channelBinder(ctx, kind, plugin, prepend) {
   }
 }
 
-const ON_REGISTERED_KINDS = new Set(['assembly', 'decision', 'append-context', 'sdk-strip', 'request-params', 'inbox-prepend', 'pre-step-filter'])
+const ON_REGISTERED_KINDS = new Set(['assembly', 'tool-gate', 'tool-result', 'append-context', 'request-params', 'stream-output', 'inbox-prepend', 'pre-step-filter', 'tool-visibility'])
 
 /** 编辑目录与注册校验共用支持面；不另给客户端维护一份名单。 */
 export const actionSupportsWhen = (kind) => ON_REGISTERED_KINDS.has(kind)
@@ -25,10 +26,7 @@ export const actionSupportsWhen = (kind) => ON_REGISTERED_KINDS.has(kind)
  *
  * 依据（`@deepseek-ai/dsh-agent/lib/types/runtime-types.d.ts` 的逐事件 `@mode` 注释）：
  * **只有 `waterfall` 才有 `next`**；`agent/pre-step`／`agent/request` 是 waterfall，
- * 而 `agent/inbox/inserted`（B7 新增动作的通道）是 **emit**、
- * `agent/turn-stopping`（既有 append-context「续跑」的通道）是 **serial**——
- * 两者都没有 `next`。第三项此前是个隐患：`append-context(continue)` 一旦带 `when`，
- * 旧实现会把 `turn` 当成 `next` 调掉。
+ * 而 `agent/inbox/inserted` 是 **emit**，`agent/turn-stopping` 是 **serial**，两者没有 `next`。
  */
 export const NEXT_FREE_CHANNELS = new Set([
   'session/event',
@@ -38,30 +36,18 @@ export const NEXT_FREE_CHANNELS = new Set([
 
 /** 动作的固定执行点；声明编译与 when 接线共用，不能用声明字段改变注册器。 */
 export function actionExecutionPoint(action) {
-  if (action.kind === 'decision') {
-    return { channel: action.phase === 'post' ? 'tools/post-execute' : 'tools/pre-execute', phase: 'before-next' }
-  }
-  if (action.kind === 'append-context') {
-    return action.mode === 'continue'
-      ? { channel: 'agent/turn-stopping', phase: 'before-next' }
-      : { channel: 'tools/post-execute', phase: 'after-next' }
-  }
+  if (action.kind === 'tool-gate') return { channel: 'tools/pre-execute', phase: 'before-next' }
+  if (action.kind === 'tool-result') return { channel: 'tools/post-execute', phase: 'before-next' }
+  if (action.kind === 'append-context') return { channel: 'tools/post-execute', phase: 'after-next' }
+  if (action.kind === 'stream-output') return { channel: 'llm/stream', phase: 'before-next' }
   if (action.kind === 'inject-text') {
+    // 层→注册点由 schema 的 LAYER_DEFINITIONS 派生（`INJECTION_CHANNELS`），不在此另写层表。
     const layer = action.config?.layer
-    const channel = {
-      'pre-step': 'agent/pre-step',
-      'system-section': 'system-prompt/assemble',
-      'runtime-context': 'system-prompt/assemble',
-      'agent-request': 'agent/request',
-      'llm-stream': 'llm/stream',
-      'turn-stop': 'agent/turn-stopping',
-      'subagent-start': 'subagent/start',
-      'subagent-end': 'subagent/end',
-    }[layer]
-    if (channel === undefined) {
-      throw new TypeError(`inject-text layer ${JSON.stringify(layer)} has no single trigger channel; tool-pipeline uses separate decision actions`)
+    const point = INJECTION_CHANNELS[layer]
+    if (point === undefined) {
+      throw new TypeError(`inject-text layer ${JSON.stringify(layer)} has no single trigger channel — 该层在工具链上不可注入，请改用 tool-gate / append-context 动作`)
     }
-    return { channel, phase: ['pre-step', 'agent-request'].includes(layer) ? 'after-next' : 'before-next' }
+    return point
   }
   const channel = ACTION_KINDS[action.kind].events[0]
   return { channel, phase: NEXT_FREE_CHANNELS.has(channel) ? 'before-next' : 'after-next' }
@@ -131,8 +117,9 @@ export function createTurnBudget(max) {
  * 并行调用不越过预算（见 `deliberation-gate.mjs` 的注释），无条件 `await` 会破坏它。
  * 返回 Promise 的谓词退回异步路径——声明编译出的谓词恒同步，这条兜底是给手写调用方的。
  */
-export function withWhen(on, when, warnOnce, phase) {
+export function withWhen(on, when, warnOnce, phase, onMiss) {
   if (typeof when !== 'function') return on
+  const miss = () => { if (typeof onMiss === 'function') onMiss() }
   // 注意参数个数：`on` 的签名是 `(event, handler, options)`——包装后的处理器必须占据
   // **第二个**位置，多传一个参数会把 options 挤到错位（首版就踩了这个，被测试抓出）。
   return (event, handler, options) => on(event, (...args) => {
@@ -143,7 +130,12 @@ export function withWhen(on, when, warnOnce, phase) {
     // 事件参数表：按通道归一后再交给谓词——否则除 `names` 外，各原语在真实载荷上都
     // 取不到它们要的域（`phase` 曾因此恒为「已晋升」、`count` 恒 0）。
     const evaluate = (invoke, fallback) => {
-      const decide = (decided) => decided === true ? invoke() : fallback()
+      const decide = (decided) => {
+        if (decided === true) return invoke()
+        // 动作级 when 为假也是「本轮没命中」：撤销型动作要在这里收手，不能留下上一轮的闸。
+        miss()
+        return fallback()
+      }
       const failed = (error) => {
         warnOnce(`when predicate failed: ${String(error?.message ?? error)}`)
         return fallback()

package/engine/actions/request-params.mjs

@@ -1,5 +1,20 @@
 import { labelOf } from './shared.mjs'
-import { applyAgentRequestParams, matchesAgentScope } from '../layers.mjs'
+import { matchesAgentScope } from '../layers.mjs'
+import { assertReplacePatch } from '../schema.mjs'
+
+/** 浅合并或整体替换；unset 只删除值仍等于声明期望的键，保留其他来源的覆盖。 */
+function applyAgentRequestParams(params, base) {
+  const patch = params.patch ?? {}
+  if (params.replace === true) return { ...patch }
+  const merged = { ...base, ...patch }
+  let result
+  for (const [key, expected] of Object.entries(params.unset ?? {})) {
+    if (!Object.is(merged[key], expected)) continue
+    result ??= { ...merged }
+    delete result[key]
+  }
+  return result ?? merged
+}
 
 export function prepareRequestParams(action, plugin) {
   const label = labelOf(action)
@@ -11,9 +26,14 @@ export function prepareRequestParams(action, plugin) {
   if (unset !== undefined && (unset === null || typeof unset !== 'object' || Array.isArray(unset))) {
     throw new TypeError(`${plugin}: ${label}.unset must be an object of { key: expectedValue }`)
   }
+  // 只接受布尔值，避免错误配置静默退化为浅合并。
+  if (action.replace !== undefined && typeof action.replace !== 'boolean') {
+    throw new TypeError(`${plugin}: ${label}.replace must be a boolean (省略 = false) — got ${JSON.stringify(action.replace)}`)
+  }
   if (action.replace === true && unset !== undefined) {
     throw new TypeError(`${plugin}: ${label} cannot combine replace with unset — 整体替换没有可比较的下游值`)
   }
+  assertReplacePatch(patch, action.replace, `${plugin}: ${label}.patch`)
   const params = { ...(patch !== undefined ? { patch } : {}), ...(unset !== undefined ? { unset } : {}), ...(action.replace === true ? { replace: true } : {}) }
   return (_ctx, { warnOnce, on, collect, take }) => collect(on('agent/request', async (payload, next) => {
     const base = await next()

package/engine/actions/shared.mjs

@@ -1,5 +1,4 @@
 import { stringList } from '../fields.mjs'
-import { parseToolNames } from '../shared.mjs'
 export const RUN_CODE = 'run_code'
 
 export const NAME_LIST = stringList({ as: 'set', dedupe: true, allowEmpty: true })
@@ -20,16 +19,14 @@ export const labelOf = (action) => (typeof action?.id === 'string' && action.id.
 export function createMask(source, label, plugin, allowExtra) {
   const allow = NAME_LIST.parse(source?.allow, plugin, `${label}.allow`)
   const deny = NAME_LIST.parse(source?.deny, plugin, `${label}.deny`)
-  if (allow !== undefined && deny !== undefined) {
-    throw new TypeError(`${plugin}: ${label} cannot combine allow with deny`)
-  }
+  // allow 与 deny 可以同时给：官方 ToolRestriction 就是 and/or，判据是「先按 allow 保留，
+  // 再按 deny 剔除」（deepseek-harness packages/core/tools/src/index.ts:701-706、759-765）。
   if (allow === undefined && deny === undefined && allowExtra === undefined) {
     throw new TypeError(`${plugin}: ${label} needs allow and/or deny — 空名单无法表达「剔哪些工具」`)
   }
   // `run_code` 是 PTC 呈现**唯一**的可调用入口（见本文件顶部）。把它写进 **deny** 名单会让
-  // 整个 PTC 面失效，一律挂载期拒绝。写进 **allow** 名单相反是**必需**的：allow 是
-  // fail-closed（未列出即剔出），不点名它就会被连带剔掉——PTC 预设因此失去唯一入口。
-  // 2026-09-22 用户拍板：allow 模式允许点名它（旧模块本就能把它写进白名单）。
+  // 整个 PTC 面失效，一律挂载期拒绝。allow 名单不必点名它：它是保留传输，不属于可裁剪的
+  // 工具面；旧模块、tool-surface 这类 native 收窄声明因此可以直接与 PTC 共存。
   if (deny?.has(RUN_CODE)) {
     throw new TypeError(`${plugin}: ${label}.deny must not name the reserved ${RUN_CODE} transport — it is the only callable entry of the PTC presentation`)
   }
@@ -50,6 +47,8 @@ export function createMask(source, label, plugin, allowExtra) {
     /** 与 tool-filter 的名单判据 / Layer.admits 同一判据（tool-filter 模块已删除，判据保留）。 */
     blocks: (toolName) => {
       if (typeof toolName !== 'string' || toolName.length === 0) return false
+      // 保留传输不参与任何名单：allow 没点名也必须留下，deny 已在挂载期拒绝。
+      if (toolName === RUN_CODE) return false
       if (deny !== undefined && deny.has(toolName)) return true
       if (allowExtra?.has(toolName) === true) return false
       // 声明了 allow、或声明了 allowFrom（= 白名单模式，静态名单视为空集），未点名即裁掉。
@@ -58,13 +57,23 @@ export function createMask(source, label, plugin, allowExtra) {
   }
 }
 
+/**
+ * 工具可见面的单一判据：装配目录、`tools:sdk` 正文与执行闸共用同一份 fail-open 决定。
+ *
+ * `available` = 目录名 ∪ SDK 正文名；`required` = 静态 allow ∪ 动态解锁项，再剔掉
+ * `run_code`（保留传输）与 `mask.blocks()` 为真的名字（deny 覆盖者不该被要求存在）。
+ * 缺项时三面必须一起放宽——只放宽一面会让模型看到的与能调的不一致。
+ */
+export function toolSurfacePlan(mask, available) {
+  // 动作层的挂载期校验（prepareToolVisibility）已拒绝 requireMatch + 无 allow。
+  const required = mask.requireMatch
+    ? [...new Set([...(mask.allow ?? []), ...(mask.allowExtra ?? [])])].filter((name) => name !== RUN_CODE && !mask.blocks(name))
+    : []
+  const missing = required.filter((name) => !available.has(name))
+  return { failOpen: missing.length > 0, missing }
+}
+
 export function requireString(value, label, plugin) {
   if (typeof value !== 'string') throw new TypeError(`${plugin}: ${label} must be a string`)
   return value
 }
-
-export function toolNameSet(value, plugin, field) {
-  if (value === undefined) return undefined
-  const names = NAME_LIST.parse(typeof value === 'string' ? parseToolNames(value) : value, plugin, field)
-  return names !== undefined && names.size > 0 ? names : undefined
-}

package/engine/actions/stream-output.mjs

@@ -0,0 +1,26 @@
+import { labelOf } from './shared.mjs'
+import { subjectOf } from '../conditions/subject.mjs'
+
+async function* replacedStream(text) {
+  yield { type: 'block-start', index: 0, blockType: 'text' }
+  yield { type: 'text-delta', index: 0, text }
+  yield { type: 'block-end', index: 0, block: { type: 'text', text } }
+}
+
+export function prepareStreamOutput(action, plugin) {
+  const label = labelOf(action)
+  const mode = action.mode ?? 'pass'
+  if (!['pass', 'replace'].includes(mode)) throw new TypeError(`${plugin}: ${label}.mode must be pass or replace`)
+  if (action.text !== undefined && typeof action.text !== 'string') throw new TypeError(`${plugin}: ${label}.text must be a string`)
+  const text = action.text ?? ''
+  return (ctx, { on, collect, take, warnOnce }) => collect(on('llm/stream', (options, next) => {
+    if (mode !== 'replace' || text.length === 0) return next()
+    try {
+      const agent = subjectOf('llm/stream', [options], warnOnce, ctx).agent
+      if (take({ agent })) return replacedStream(text)
+    } catch (error) {
+      warnOnce(`${plugin}: stream-output action ${label} failed: ${String(error?.message ?? error)}`)
+    }
+    return next()
+  }))
+}

package/engine/actions/tool-gate.mjs

@@ -0,0 +1,31 @@
+import { labelOf } from './shared.mjs'
+
+/**
+ * tool-gate —— 工具执行前的裁决（pre 相）。
+ *
+ * 从原 `decision` 拆出：字段只保留这一相真正读的键，写错相位就是未知字段而不是静默失效。
+ * 异常与条件未命中一律走 `next()`（放行）——裁决 bug 不该卡死调用。
+ */
+export function prepareToolGate(action, plugin) {
+  const label = labelOf(action)
+  const decision = action.decision ?? 'allow'
+  if (!['allow', 'deny', 'ask'].includes(decision)) {
+    throw new TypeError(`${plugin}: ${label}.decision must be one of allow, deny, ask`)
+  }
+  if (action.reason !== undefined && typeof action.reason !== 'string') {
+    throw new TypeError(`${plugin}: ${label}.reason must be a string`)
+  }
+  return (_ctx, { warnOnce, on, collect, take }) => collect(on('tools/pre-execute', async (exec, next) => {
+    try {
+      if (decision === 'allow') return next()
+      // `||` 而非 `??`：空串是「取引擎缺省」的中性值，不是「无解释的拒绝」。
+      const outcome = decision === 'deny'
+        ? { kind: 'deny', reason: String(action.reason || `${label}: denied by action`) }
+        : { kind: 'ask' }
+      return take(exec) ? outcome : next()
+    } catch (error) {
+      warnOnce(`${plugin}: tool-gate action ${label} failed: ${String(error?.message ?? error)}`)
+      return next()
+    }
+  }))
+}

package/engine/actions/tool-result.mjs

@@ -0,0 +1,36 @@
+import { labelOf } from './shared.mjs'
+
+/**
+ * tool-result —— 工具结果结算后的处理（post 相）。
+ *
+ * 从原 `decision` 拆出：只读这一相的字段。`text` 仅 replace / block 使用；
+ * 异常一律 `next()`（接受），绝不让结果处理把工具调用变成失败。
+ */
+export function prepareToolResult(action, plugin) {
+  const label = labelOf(action)
+  const mode = action.action ?? 'accept'
+  if (!['accept', 'replace', 'block'].includes(mode)) {
+    throw new TypeError(`${plugin}: ${label}.action must be one of accept, replace, block`)
+  }
+  if (action.text !== undefined && typeof action.text !== 'string') {
+    throw new TypeError(`${plugin}: ${label}.text must be a string`)
+  }
+  const text = typeof action.text === 'string' ? action.text : ''
+  return (_ctx, { warnOnce, on, collect, take }) => collect(on('tools/post-execute', async (exec, result, next) => {
+    try {
+      if (mode === 'accept') return next()
+      if (mode === 'replace' && text.length > 0) {
+        if (!take(exec)) return next()
+        return { kind: 'accept', content: [{ type: 'text', text }] }
+      }
+      if (mode === 'block') {
+        if (!take(exec)) return next()
+        return { kind: 'block', feedback: [{ type: 'text', text: text.length > 0 ? text : `${label}: blocked by action` }] }
+      }
+      return next()
+    } catch (error) {
+      warnOnce(`${plugin}: tool-result action ${label} failed: ${String(error?.message ?? error)}`)
+      return next()
+    }
+  }))
+}