maka-agent 0.2.0-dev.3.20260830 → 0.2.0-dev.31.20260913

package/node_modules/@maka/runtime/dist/tool-runtime.js

@@ -19,8 +19,10 @@
 import { decodeCanonicalToolResultContent } from '@maka/core/tool-result-record-schema';
 import { projectAgentSwarmResult } from '@maka/core/agent-swarm';
 import { projectToolActivityArgs } from '@maka/core/tool-activity-args';
+import { resolveCollaborationPermissionMode } from '@maka/core/collaboration';
 import { serializedByteLength } from '@maka/core/serialized-byte-length';
 import { encodeToolStepProgress, ToolOutcomeUnknownError } from '@maka/core/events';
+import { isInteractionAnswerValidForRequest, projectInteractionFormRequest, } from '@maka/core/interaction';
 import { computerUseModelCallArgs } from '@maka/core/computer-use';
 import { redactSecrets } from '@maka/core/redaction';
 import { decodeRuntimeEvent, MANAGED_MUTATION_EXECUTION_PROFILE_V1_DIGEST, MANAGED_MUTATION_EXECUTION_PROFILE_V1_SPEC, TOOL_BOUNDARY_PROTOCOL_V1, } from '@maka/core/runtime-event';
@@ -32,7 +34,8 @@ import { truncateToolOutput } from './tool-output.js';
 import { stableHash } from './request-shape.js';
 import { classifyError } from './provider-error-classification.js';
 import { AwaitRegistry } from './await-registry.js';
-import { jsonValue } from './tool-result-output.js';
+import { compatibilityToolResultProjection, encodeDefaultDurableToolResultOutput, encodeDurableToolResultOutput, encodeDurableToolResultOutputWithArtifacts, } from './durable-tool-result-projection.js';
+import { DURABLE_TOOL_RESULT_PROJECTION_FAILURE, } from '@maka/core/durable-tool-result-projection';
 import { buildToolOperationId, canonicalToolArgsHash, } from './runtime-commit-sink.js';
 import { AdmissionLimiter } from './admission-limiter.js';
 import { SandboxCommandError, sandboxErrorMetadata, serializeSandboxError, } from './sandbox/errors.js';
@@ -56,6 +59,7 @@ export const LOOP_GATE_IDENTICAL_THRESHOLD = 3;
 const SANDBOX_BOUNDARY_FAILURE_ROUND_LIMIT = 3;
 const SUBAGENT_TOOL_LIMIT_MESSAGE = '子代理并发过多：同一轮最多 5 个子代理。请等待已有任务完成后再继续。';
 const CLIENT_CAPABILITY_BOUNDARY_MESSAGE = 'Client Capability tools require the Bypass execution boundary because their client-side effects cannot be sandboxed by the Host. Switch this Session to Bypass and retry.';
+const CLIENT_CAPABILITY_PREPARATION_MESSAGE = 'Client Capability tool is missing its Host admission preparation contract.';
 function composeChildAbortSignal(invocationSignal, childSignal) {
     if (!childSignal || childSignal === invocationSignal)
         return invocationSignal;
@@ -89,10 +93,12 @@ export class ToolRuntime {
     input;
     sandboxBoundaryRequests = new AwaitRegistry();
     userQuestions = new AwaitRegistry();
+    userForms = new AwaitRegistry();
     turnId;
     hostedInteraction;
     sandboxBoundaryClosureDeferred = false;
     questionClosureDeferred = false;
+    formClosureDeferred = false;
     activeSubagentToolCount = 0;
     childAgentRunLimiter = new AdmissionLimiter(MAX_ACTIVE_CHILD_AGENT_RUNS_PER_TURN);
     /**
@@ -124,12 +130,16 @@ export class ToolRuntime {
     durableToolAttempts = new Map();
     activeToolSettlements = new Set();
     readExecutionBoundary;
+    readPermissionMode;
     stepAdmissions = new Map();
     constructor(input) {
         this.input = input;
         if (!input.readExecutionBoundary) {
             throw new Error('ToolRuntime requires explicit execution boundary authority');
         }
+        if (!input.readPermissionMode) {
+            throw new Error('ToolRuntime requires explicit permission mode authority');
+        }
         const hosted = input.hostedInteraction;
         if (hosted && (hosted.sessionId !== input.sessionId || hosted.turnId !== input.turnId)) {
             throw new RuntimeInteractionInvariantError(`ToolRuntime received a mismatched hosted Interaction Run for turn ${input.turnId}`);
@@ -137,6 +147,23 @@ export class ToolRuntime {
         this.turnId = input.turnId;
         this.hostedInteraction = hosted;
         this.readExecutionBoundary = input.readExecutionBoundary;
+        this.sandboxBoundaryDenied = input.inheritedSandboxBoundaryDenied === true;
+        this.readPermissionMode = input.readPermissionMode;
+    }
+    /**
+     * The permission mode in force for this dispatch.
+     *
+     * A Bypass boundary is an unambiguous live grant. A managed boundary is not:
+     * an approved path or network expansion changes its structural display mode
+     * without changing the mode the user selected. Keep that selection live in
+     * its own authority, then apply the collaboration overlay for this backend.
+     */
+    async livePermissionMode(boundary) {
+        const permissionMode = boundary.kind === 'bypass' ? 'bypass' : await this.readPermissionMode();
+        return resolveCollaborationPermissionMode({
+            collaborationMode: this.input.header.collaborationMode ?? 'agent',
+            permissionMode,
+        });
     }
     async endTurn(reason = 'completed') {
         const turnId = this.turnId;
@@ -160,6 +187,7 @@ export class ToolRuntime {
                         sessionId: this.input.sessionId,
                         requestId,
                         decision: 'deny',
+                        closureReason: reason === 'aborted' ? 'turn_stopped' : 'turn_terminal',
                     });
                 }));
                 for (const result of results) {
@@ -169,6 +197,7 @@ export class ToolRuntime {
             }
         }
         const hasHostedPending = this.userQuestions.entries().some(([, question]) => question.hosted);
+        const hasHostedFormPending = this.userForms.entries().some(([, form]) => form.hosted);
         if (hasHostedBoundaryPending) {
             this.sandboxBoundaryClosureDeferred = true;
             this.finishDeferredSandboxBoundaryTurnClosure();
@@ -185,6 +214,14 @@ export class ToolRuntime {
             this.userQuestions.close((requestId) => new Error(`Turn ${turnId} ${reason} before user question ${requestId} was answered`));
             this.questionClosureDeferred = false;
         }
+        if (hasHostedFormPending) {
+            this.formClosureDeferred = true;
+            this.finishDeferredFormTurnClosure();
+        }
+        else {
+            this.userForms.close((requestId) => new Error(`Turn ${turnId} ${reason} before user form ${requestId} was answered`));
+            this.formClosureDeferred = false;
+        }
         this.resetTurnState();
         // The stop path settles the run's terminal fact right after the
         // backend's stop resolves, and that stop awaits this method. Unwinds
@@ -213,6 +250,20 @@ export class ToolRuntime {
         }
         return this.settleUserQuestionAnswer(turnId, response, pending);
     }
+    respondToUserForm(response) {
+        if (!response || typeof response.requestId !== 'string') {
+            throw new Error('Invalid user form response');
+        }
+        const pending = this.userForms
+            .entries()
+            .find(([requestId]) => requestId === response.requestId)?.[1];
+        if (!pending)
+            return false;
+        if (pending.hosted) {
+            throw new RuntimeInteractionInvariantError(`Hosted form ${response.requestId} must settle through its captured continuation`);
+        }
+        return this.settleUserFormAnswer(response, pending);
+    }
     async respondToSandboxBoundaryResponse(response) {
         if (!this.sandboxBoundaryRequests.has(response.requestId))
             return false;
@@ -248,51 +299,40 @@ export class ToolRuntime {
         this.finishDeferredQuestionTurnClosure();
         return resolved;
     }
+    settleUserFormAnswer(response, pending) {
+        const answer = response.action === 'accept'
+            ? { kind: 'form', action: 'accept', values: response.values }
+            : { kind: 'form', action: response.action };
+        if (!isInteractionAnswerValidForRequest(pending.request, answer)) {
+            throw new Error('Invalid user form response');
+        }
+        const resolved = this.userForms.resolve(response.requestId, response) !== null;
+        this.finishDeferredFormTurnClosure();
+        return resolved;
+    }
     closeUserQuestion(turnId, requestId, reason) {
         const closed = this.userQuestions.reject(requestId, new RuntimeInteractionClosedError(requestId, reason)) !==
             null;
         this.finishDeferredQuestionTurnClosure();
         return closed;
     }
+    closeUserForm(requestId, reason) {
+        const closed = this.userForms.reject(requestId, new RuntimeInteractionClosedError(requestId, reason)) !==
+            null;
+        this.finishDeferredFormTurnClosure();
+        return closed;
+    }
     pendingUserQuestionCount() {
         return this.userQuestions.pendingCount();
     }
+    pendingUserFormCount() {
+        return this.userForms.pendingCount();
+    }
     /**
      * Settle one resolved Maka tool call. Tool/business failures resolve with a
      * provider-facing error output; durable runtime commit failures still reject.
      */
     async settleToolCall(call) {
-        const settlement = await this.settleToolCallRaw(call);
-        const modelOutput = settlement.providerError
-            ? call.tool.providerTool?.kind === 'openai-apply-patch'
-                ? {
-                    type: 'json',
-                    value: { status: 'failed', output: settlement.providerError },
-                }
-                : { type: 'error-text', value: new Error(settlement.providerError).toString() }
-            : call.tool.toModelOutput
-                ? await call.tool.toModelOutput({
-                    toolCallId: call.toolCallId,
-                    input: call.input,
-                    output: settlement.result,
-                })
-                : this.input.materializeDefaultToolResultOutput
-                    ? await this.input.materializeDefaultToolResultOutput({
-                        toolCallId: call.toolCallId,
-                        output: settlement.result,
-                    })
-                    : typeof settlement.result === 'string'
-                        ? { type: 'text', value: settlement.result }
-                        : { type: 'json', value: jsonValue(settlement.result) };
-        return { result: settlement.result, modelOutput };
-    }
-    /**
-     * Settle a tool without producing provider-visible output. Runtime-owned
-     * nested calls use this path because their result is consumed by Code Mode,
-     * not sent as a provider tool-result part; materializing it could spend
-     * turn-scoped provider resources such as the image budget.
-     */
-    async settleToolCallRaw(call) {
         const settlement = this.performToolSettlement(call);
         // Tracked so endTurn can wait out unwinds already in flight (#2253):
         // their T2 outcomes must land before the stop path settles the run's
@@ -317,6 +357,42 @@ export class ToolRuntime {
         const providerError = providerToolErrorMessage(result);
         return { result, ...(providerError ? { providerError } : {}) };
     }
+    projectToolResult(tool, turnId, toolCallId, input, result) {
+        try {
+            const providerError = providerToolErrorMessage(result);
+            if (providerError) {
+                return encodeDurableToolResultOutput(tool.providerTool?.kind === 'openai-apply-patch'
+                    ? {
+                        type: 'json',
+                        value: { status: 'failed', output: providerError },
+                    }
+                    : { type: 'error-text', value: new Error(providerError).toString() }, this.input.sessionId);
+            }
+            if (!tool.toModelOutput) {
+                return encodeDefaultDurableToolResultOutput(result, this.input.sessionId);
+            }
+            const output = tool.toModelOutput({ toolCallId, input, output: result });
+            if (output === undefined)
+                return encodeDefaultDurableToolResultOutput(result, this.input.sessionId);
+            // Projection is deliberately synchronous and total at the tool boundary.
+            // Fail closed for untyped/plugin implementations that violate the
+            // contract so a completed effect can never be stranded before T2.
+            if (isPromiseLike(output)) {
+                return DURABLE_TOOL_RESULT_PROJECTION_FAILURE;
+            }
+            const encode = (resolved) => encodeDurableToolResultOutputWithArtifacts(resolved, this.input.sessionId, this.input.prepareDurableProjectionArtifact
+                ? ({ bytes, mediaType }) => this.input.prepareDurableProjectionArtifact({
+                    turnId,
+                    bytes,
+                    mediaType,
+                })
+                : undefined);
+            return encode(output);
+        }
+        catch {
+            return DURABLE_TOOL_RESULT_PROJECTION_FAILURE;
+        }
+    }
     /**
      * Install the per-step tool-availability gating used at the execute boundary.
      * The backend recomputes the active snapshot before each step; the guard in
@@ -414,7 +490,7 @@ export class ToolRuntime {
         this.lastFailedToolCallBoundaryKind = boundaryKind;
         this.lastFailedToolCallBoundaryDetails = boundaryDetails;
     }
-    async writeSyntheticToolResult(toolUseId, turnId, text, queue, sandboxDenial, sandboxFailure, uncertainOutcome, activityIdentity = {}, attempt) {
+    async writeSyntheticToolResult(toolUseId, turnId, toolName, text, queue, sandboxDenial, sandboxFailure, uncertainOutcome, activityIdentity = {}, attempt) {
         const content = {
             kind: 'text',
             text: formatSyntheticToolErrorText(text),
@@ -431,18 +507,14 @@ export class ToolRuntime {
         // identity_conflict. The map lookup remains for the pre-dispatch
         // guards, where no attempt exists and no identity is owed.
         const durableAttempt = attempt ?? this.durableToolAttempts.get(durableAttemptKey(turnId, toolUseId));
-        const durableOutcome = await durableAttempt?.commitOutcome(content, true);
-        const msg = {
-            type: 'tool_result',
-            id: this.input.newId(),
-            turnId,
-            ts: this.input.now(),
-            toolUseId,
+        const modelProjection = compatibilityToolResultProjection({
+            kind: 'function_response',
+            id: toolUseId,
+            name: toolName,
+            result: content,
             isError: true,
-            content,
-            ...activityIdentity,
-        };
-        await this.input.appendMessage(msg);
+        }, this.input.sessionId) ?? DURABLE_TOOL_RESULT_PROJECTION_FAILURE;
+        const durableOutcome = await durableAttempt?.commitOutcome(content, true, modelProjection);
         queue.push({
             type: 'tool_result',
             id: durableOutcome?.id ?? this.input.newId(),
@@ -452,6 +524,7 @@ export class ToolRuntime {
             ...(durableOutcome ? { operationId: durableOutcome.operationId } : {}),
             isError: true,
             content,
+            modelProjection,
             ...activityIdentity,
         });
     }
@@ -589,21 +662,31 @@ export class ToolRuntime {
             ...(tool.displayName ? { displayName: tool.displayName } : {}),
             ...(stepId !== undefined ? { stepId } : {}),
         };
-        let pushedCallEvent;
-        const pushCallEvent = (lane) => {
-            // Idempotent by construction: one call, one call event, whichever lane
-            // asks for it first. A second ask cannot mint a second id.
-            if (pushedCallEvent)
-                return pushedCallEvent;
+        let callEvent;
+        const buildCallEvent = (lane) => {
+            if (callEvent)
+                return callEvent;
             const operationId = lane === 'dispatch' ? dispatchOperationId : undefined;
-            const event = {
+            callEvent = {
                 ...callEventFacts,
                 id: operationId ? `${operationId}_call` : this.input.newId(),
                 ...(operationId ? { operationId } : {}),
             };
+            return callEvent;
+        };
+        let callEventPublished = false;
+        const publishCallEvent = (event) => {
+            if (callEventPublished)
+                return;
             queue.push(event);
-            pushedCallEvent = event;
-            return event;
+            callEventPublished = true;
+        };
+        const emitToolStartedTrace = () => {
+            trace?.emit('tool', 'tool_started', 'Tool execution started', {
+                toolUseId,
+                toolName: tool.name,
+                ...(tool.categoryHint !== undefined ? { categoryHint: tool.categoryHint } : {}),
+            });
         };
         /**
          * One pre-dispatch refusal: the call fact on the generic lane, then the
@@ -611,32 +694,10 @@ export class ToolRuntime {
          * through here so the pair can never be split across lanes again.
          */
         const refuseBeforeDispatch = async (text, sandboxFailure) => {
-            pushCallEvent('preflight');
-            await this.writeSyntheticToolResult(toolUseId, turnId, text, queue, undefined, sandboxFailure, undefined, activityIdentity);
-        };
-        const callMsg = {
-            type: 'tool_call',
-            id: toolUseId,
-            turnId,
-            ts: now,
-            toolName: tool.name,
-            ...activityIdentity,
-            ...(tool.activityKind ? { activityKind: tool.activityKind } : {}),
-            ...(tool.displayName ? { displayName: tool.displayName } : {}),
-            args: structuredClone(persistedArgs),
-            ...(ctx.providerOptions !== undefined
-                ? { providerOptions: structuredClone(ctx.providerOptions) }
-                : {}),
-            // Persist the same step id the tool_start event carries so the UI
-            // timeline and post-restart backfill can pair this call with its step.
-            ...(stepId !== undefined ? { stepId } : {}),
+            publishCallEvent(buildCallEvent('preflight'));
+            emitToolStartedTrace();
+            await this.writeSyntheticToolResult(toolUseId, turnId, tool.name, text, queue, undefined, sandboxFailure, undefined, activityIdentity);
         };
-        await this.input.appendMessage(callMsg);
-        trace?.emit('tool', 'tool_started', 'Tool execution started', {
-            toolUseId,
-            toolName: tool.name,
-            ...(tool.categoryHint !== undefined ? { categoryHint: tool.categoryHint } : {}),
-        });
         if (admissionFailure) {
             const boundaryKind = boundaryAuthorityAttempt ? 'invalid' : undefined;
             if (boundaryKind) {
@@ -771,9 +832,12 @@ export class ToolRuntime {
             return this.errorReturn(reason);
         }
         let clientCapabilityBoundary;
-        if (tool.categoryHint === 'client_capability') {
+        let clientCapabilityPermissionMode;
+        let preparedExecution;
+        if (tool.hostAdmission === 'client_capability') {
             try {
                 clientCapabilityBoundary = await this.readExecutionBoundary();
+                clientCapabilityPermissionMode = await this.livePermissionMode(clientCapabilityBoundary);
             }
             catch (error) {
                 const reason = formatSyntheticToolErrorText(error);
@@ -787,8 +851,13 @@ export class ToolRuntime {
                 this.recordLoopGateOutcome(callSignature, true);
                 return this.errorReturn(reason);
             }
-            if (clientCapabilityBoundary.kind !== 'bypass') {
-                await refuseBeforeDispatch(CLIENT_CAPABILITY_BOUNDARY_MESSAGE, {
+            const admissionFailure = !tool.prepareExecution
+                ? CLIENT_CAPABILITY_PREPARATION_MESSAGE
+                : clientCapabilityBoundary.kind !== 'bypass' && clientCapabilityPermissionMode !== 'ask'
+                    ? CLIENT_CAPABILITY_BOUNDARY_MESSAGE
+                    : undefined;
+            if (admissionFailure) {
+                await refuseBeforeDispatch(admissionFailure, {
                     reason: 'requires_bypass',
                     source: 'client_capability',
                 });
@@ -799,7 +868,39 @@ export class ToolRuntime {
                     errorClass: 'ClientCapabilityBoundary',
                 });
                 this.recordLoopGateOutcome(callSignature, true);
-                return this.errorReturn(CLIENT_CAPABILITY_BOUNDARY_MESSAGE);
+                return this.errorReturn(admissionFailure);
+            }
+            // Narrowed by admissionFailure above; Bypass still prepares so the
+            // provider cannot regain a direct pre-T1 dispatch path.
+            const prepareExecution = tool.prepareExecution;
+            const pauseTarget = this.input.getPermissionPauseTarget();
+            pauseTarget?.pause();
+            try {
+                preparedExecution = await prepareExecution(structuredClone(executionArgs), {
+                    sessionId: this.input.sessionId,
+                    turnId,
+                    ...(runId ? { runId } : {}),
+                    cwd: this.input.header.cwd,
+                    executionBoundary: clientCapabilityBoundary,
+                    permissionMode: clientCapabilityPermissionMode,
+                    toolCallId: toolUseId,
+                    abortSignal: ctx.abortSignal,
+                });
+            }
+            catch (error) {
+                const reason = formatSyntheticToolErrorText(error);
+                await refuseBeforeDispatch(reason);
+                trace?.emit('tool', 'tool_failed', 'Client Capability preparation failed', {
+                    toolUseId,
+                    toolName: tool.name,
+                    status: 'error',
+                    errorClass: 'ClientCapabilityPreparation',
+                });
+                this.recordLoopGateOutcome(callSignature, true);
+                return this.errorReturn(reason);
+            }
+            finally {
+                pauseTarget?.resume();
             }
         }
         let managedMutationAdmission;
@@ -832,6 +933,7 @@ export class ToolRuntime {
         }
         const reservedSubagentSlot = this.reserveSubagentSlot(tool);
         if (!reservedSubagentSlot) {
+            await preparedExecution?.cancel();
             await disposeManagedMutationAdmission(managedMutationAdmission);
             trace?.emit('tool', 'tool_failed', 'Tool execution rejected by runtime limit', {
                 toolUseId,
@@ -847,7 +949,7 @@ export class ToolRuntime {
         try {
             durableAttempt = await this.prepareDurableToolAttempt({
                 tool,
-                startEvent: pushCallEvent('dispatch'),
+                startEvent: buildCallEvent('dispatch'),
                 persistedArgs,
                 modelFacingArgs,
                 abortSignal: ctx.abortSignal,
@@ -859,11 +961,14 @@ export class ToolRuntime {
             });
         }
         catch (error) {
+            await preparedExecution?.cancel();
             if (reservedSubagentSlot)
                 this.releaseSubagentSlot(tool);
             await disposeManagedMutationAdmission(managedMutationAdmission);
             throw error;
         }
+        publishCallEvent(buildCallEvent('dispatch'));
+        emitToolStartedTrace();
         if (durableAttempt) {
             this.durableToolAttempts.set(durableAttemptKey(turnId, toolUseId), durableAttempt);
         }
@@ -898,7 +1003,8 @@ export class ToolRuntime {
             try {
                 const runId = this.input.runId;
                 const executionBoundary = clientCapabilityBoundary ?? (await this.readExecutionBoundary());
-                const invokeTool = () => tool.impl(structuredClone(executionArgs), {
+                const permissionMode = clientCapabilityPermissionMode ?? (await this.livePermissionMode(executionBoundary));
+                const toolContext = {
                     sessionId: this.input.sessionId,
                     turnId,
                     ...(runId ? { runId } : {}),
@@ -907,11 +1013,11 @@ export class ToolRuntime {
                         : {}),
                     cwd: this.input.header.cwd,
                     executionBoundary,
-                    permissionMode: this.input.header.permissionMode,
+                    permissionMode,
                     toolCallId: toolUseId,
                     // The id the call event actually carries, not the candidate: by here
                     // `prepareDurableToolAttempt` has pushed it on the dispatch lane.
-                    ...(pushedCallEvent?.operationId ? { operationId: pushedCallEvent.operationId } : {}),
+                    ...(callEvent?.operationId ? { operationId: callEvent.operationId } : {}),
                     abortSignal: ctx.abortSignal,
                     emitOutput: output.emit,
                     emitProgress: (current, total) => {
@@ -951,8 +1057,12 @@ export class ToolRuntime {
                         activityIdentity,
                     }),
                     askUserQuestion: (questions) => this.askUserQuestion(turnId, toolUseId, questions, ctx.abortSignal, queue),
+                    requestUserForm: (form, options) => this.requestUserForm(turnId, toolUseId, form, ctx.abortSignal, queue, options?.cancellationSignal),
                     requestSandboxBoundary: (expansion, justification) => this.requestSandboxBoundary(turnId, toolUseId, expansion, justification, ctx.abortSignal, queue),
-                });
+                };
+                const invokeTool = () => preparedExecution
+                    ? preparedExecution.execute(toolContext)
+                    : tool.impl(structuredClone(executionArgs), toolContext);
                 const invokeManagedTransform = () => tool.managedMutationTransform(structuredClone(executionArgs));
                 const prepareOperationValue = async (immutableSnapshot = false) => {
                     const rawResult = await (immutableSnapshot ? invokeManagedTransform() : invokeTool());
@@ -967,10 +1077,13 @@ export class ToolRuntime {
                     const content = immutableSnapshot
                         ? Object.freeze(coerceResultContent(result))
                         : coerceResultContent(result);
+                    const projected = this.projectToolResult(tool, turnId, toolUseId, executionArgs, result);
+                    const modelProjection = isPromiseLike(projected) ? await projected : projected;
                     const outcome = {
                         content,
                         isError: deriveToolResultStatus(content, result) !== 'success',
                         durationMs: this.input.now() - startedAt,
+                        modelProjection,
                     };
                     const value = {
                         result,
@@ -1001,6 +1114,7 @@ export class ToolRuntime {
                                     content: value.outcome.content,
                                     isError: value.outcome.isError,
                                     durationMs: value.outcome.durationMs,
+                                    modelProjection: value.outcome.modelProjection,
                                 };
                             }
                             finally {
@@ -1072,7 +1186,7 @@ export class ToolRuntime {
                 }
                 const { result, outcome } = settledExecution.value;
                 output.flush();
-                const { content, durationMs } = outcome;
+                const { content, durationMs, modelProjection } = outcome;
                 // Keep the full provider-facing terminal classification. `isError` is
                 // sufficient for the durable response envelope, but it intentionally
                 // collapses `aborted` into an error bit and therefore cannot drive live
@@ -1083,10 +1197,10 @@ export class ToolRuntime {
                     if (!durableAttempt) {
                         throw new RuntimeManagedMutationUnsettledError(new Error('Managed mutation settlement has no durable T1 attempt'));
                     }
-                    durableOutcome = durableAttempt.adoptCommittedOutcome(settledExecution.durableOutcome, content, outcome.isError, durationMs);
+                    durableOutcome = durableAttempt.adoptCommittedOutcome(settledExecution.durableOutcome, content, outcome.isError, modelProjection, durationMs);
                 }
                 else {
-                    durableOutcome = await durableAttempt?.commitOutcome(content, outcome.isError, durationMs);
+                    durableOutcome = await durableAttempt?.commitOutcome(content, outcome.isError, modelProjection, durationMs);
                 }
                 if (hasSandboxDenial(content)) {
                     const denialKey = sandboxDenialKey(tool.name, this.input.header.cwd, executionArgs);
@@ -1102,18 +1216,6 @@ export class ToolRuntime {
                         commandHash: denialKey,
                     });
                 }
-                const resultMsg = {
-                    type: 'tool_result',
-                    id: this.input.newId(),
-                    turnId,
-                    ts: this.input.now(),
-                    toolUseId,
-                    isError: toolResultStatus !== 'success',
-                    content,
-                    durationMs,
-                    ...activityIdentity,
-                };
-                await this.input.appendMessage(resultMsg);
                 queue.push({
                     type: 'tool_result',
                     id: durableOutcome?.id ?? this.input.newId(),
@@ -1123,6 +1225,7 @@ export class ToolRuntime {
                     ...(durableOutcome ? { operationId: durableOutcome.operationId } : {}),
                     isError: toolResultStatus !== 'success',
                     content,
+                    modelProjection,
                     durationMs,
                     ...activityIdentity,
                 });
@@ -1217,19 +1320,10 @@ export class ToolRuntime {
                     });
                 }
                 const durationMs = Math.max(0, this.input.now() - startedAt);
-                const durableOutcome = await durableAttempt?.commitOutcome(terminalFailure.content, true, durationMs);
-                const resultMsg = {
-                    type: 'tool_result',
-                    id: this.input.newId(),
-                    turnId,
-                    ts: this.input.now(),
-                    toolUseId,
-                    isError: true,
-                    content: terminalFailure.content,
-                    durationMs,
-                    ...activityIdentity,
-                };
-                await this.input.appendMessage(resultMsg);
+                const terminalResult = this.errorReturn(terminalFailure.message);
+                const projected = this.projectToolResult(tool, turnId, toolUseId, executionArgs, terminalFailure.content);
+                const modelProjection = isPromiseLike(projected) ? await projected : projected;
+                const durableOutcome = await durableAttempt?.commitOutcome(terminalFailure.content, true, modelProjection, durationMs);
                 queue.push({
                     type: 'tool_result',
                     id: durableOutcome?.id ?? this.input.newId(),
@@ -1239,6 +1333,7 @@ export class ToolRuntime {
                     ...(durableOutcome ? { operationId: durableOutcome.operationId } : {}),
                     isError: true,
                     content: terminalFailure.content,
+                    modelProjection,
                     durationMs,
                     ...activityIdentity,
                 });
@@ -1268,7 +1363,7 @@ export class ToolRuntime {
                     errorClass,
                     ...(sandboxError ? { sandbox: sandboxError } : {}),
                 });
-                return this.errorReturn(terminalFailure.message);
+                return terminalResult;
             }
             const msg = err instanceof ToolResultLimitError
                 ? err.message
@@ -1277,7 +1372,7 @@ export class ToolRuntime {
                     : uncertainOutcome
                         ? `outcome_unknown: ${formatSyntheticToolErrorText(err)}`
                         : formatSyntheticToolErrorText(err);
-            await this.writeSyntheticToolResult(toolUseId, turnId, msg, queue, sandboxDenialSignalFromError(err), attemptBoundaryDetails, uncertainOutcome, activityIdentity, durableAttempt);
+            await this.writeSyntheticToolResult(toolUseId, turnId, tool.name, msg, queue, sandboxDenialSignalFromError(err), attemptBoundaryDetails, uncertainOutcome, activityIdentity, durableAttempt);
             this.input.recordToolInvocation?.({
                 sessionId: this.input.sessionId,
                 turnId,
@@ -1385,6 +1480,7 @@ export class ToolRuntime {
             actions: {
                 toolDispatch: {
                     protocol: TOOL_BOUNDARY_PROTOCOL_V1,
+                    resultProjectionVersion: 1,
                     operationId,
                     providerToolCallId: input.startEvent.toolUseId,
                     toolName: input.tool.name,
@@ -1440,7 +1536,7 @@ export class ToolRuntime {
         catch (error) {
             throw new RuntimeCommitBoundaryError('T1', error);
         }
-        const buildResponseEvent = (result, isError, durationMs, ts) => ({
+        const buildResponseEvent = (result, isError, modelProjection, durationMs, ts) => ({
             id: `${operationId}_response`,
             invocationId,
             runId,
@@ -1458,6 +1554,7 @@ export class ToolRuntime {
                 name: input.tool.name,
                 result,
                 ...(isError ? { isError: true } : {}),
+                modelProjection,
             },
             refs: {
                 operationId,
@@ -1475,10 +1572,10 @@ export class ToolRuntime {
         return {
             operationId,
             responseEventId: `${operationId}_response`,
-            commitOutcome: async (result, isError, durationMs) => {
+            commitOutcome: async (result, isError, modelProjection, durationMs) => {
                 if (committedOutcome)
                     return committedOutcome;
-                const responseEvent = buildResponseEvent(result, isError, durationMs, this.input.now());
+                const responseEvent = buildResponseEvent(result, isError, modelProjection, durationMs, this.input.now());
                 try {
                     await sink.commitToolOutcome({
                         operationId,
@@ -1488,6 +1585,18 @@ export class ToolRuntime {
                     });
                 }
                 catch (error) {
+                    try {
+                        await input.tool.compensateDurableOutcomeCommitFailure?.({
+                            result,
+                            isError,
+                            sessionId: this.input.sessionId,
+                            operationId,
+                        });
+                    }
+                    catch {
+                        // T2 remains authoritative. Compensation is deliberately best-effort
+                        // and must never replace the persistence failure that triggered it.
+                    }
                     throw new RuntimeCommitBoundaryError('T2', error);
                 }
                 committedOutcome = {
@@ -1498,10 +1607,10 @@ export class ToolRuntime {
                 this.durableToolAttempts.delete(durableAttemptKey(input.startEvent.turnId, input.startEvent.toolUseId));
                 return committedOutcome;
             },
-            adoptCommittedOutcome: (event, result, isError, durationMs) => {
+            adoptCommittedOutcome: (event, result, isError, modelProjection, durationMs) => {
                 if (committedOutcome)
                     return committedOutcome;
-                const expected = buildResponseEvent(result, isError, durationMs, event.ts);
+                const expected = buildResponseEvent(result, isError, modelProjection, durationMs, event.ts);
                 if (!Number.isFinite(event.ts) || !isDeepStrictEqual(event, expected)) {
                     throw new RuntimeCommitBoundaryError('T2', new Error('Managed mutation settlement returned a mismatched durable outcome'));
                 }
@@ -1680,6 +1789,112 @@ export class ToolRuntime {
                 : {}),
         };
     }
+    async requestUserForm(turnId, toolUseId, form, abortSignal, queue, producerCancellationSignal) {
+        const interactionSignal = composeChildAbortSignal(abortSignal, producerCancellationSignal);
+        throwIfAborted(interactionSignal);
+        const hostedRun = this.interactionRun();
+        const requestId = this.input.newId();
+        const request = projectInteractionFormRequest({ toolUseId, ...form });
+        const parked = this.userForms.park(requestId, {
+            toolUseId,
+            request,
+            hosted: hostedRun !== undefined,
+        });
+        const onAbort = () => {
+            if (hostedRun)
+                return;
+            this.userForms.reject(requestId, abortErrorFromSignal(abortSignal));
+            this.finishDeferredFormTurnClosure();
+        };
+        let hostedAdmission;
+        let producerWithdrawal;
+        const onProducerCancellation = () => {
+            if (abortSignal.aborted)
+                return;
+            if (hostedRun) {
+                producerWithdrawal ??= Promise.resolve().then(async () => {
+                    try {
+                        await hostedAdmission;
+                    }
+                    catch {
+                        return;
+                    }
+                    await hostedRun.withdrawFormRequest(requestId);
+                });
+            }
+            else if (producerCancellationSignal) {
+                this.userForms.reject(requestId, abortErrorFromSignal(producerCancellationSignal));
+                this.finishDeferredFormTurnClosure();
+            }
+        };
+        abortSignal.addEventListener('abort', onAbort, { once: true });
+        producerCancellationSignal?.addEventListener('abort', onProducerCancellation, { once: true });
+        if (hostedRun)
+            void parked.catch(() => undefined);
+        try {
+            const requestEvent = {
+                type: 'form_request',
+                id: this.input.newId(),
+                turnId,
+                ts: this.input.now(),
+                requestId,
+                toolUseId,
+                message: request.message,
+                requester: request.requester,
+                fields: request.fields,
+            };
+            if (hostedRun) {
+                const settlement = this.createFormSettlement(turnId, requestId);
+                const admission = Promise.resolve().then(() => hostedRun.admitFormRequest({ request: requestEvent, settlement }));
+                hostedAdmission = admission;
+                try {
+                    await racePromiseWithAbort(admission, interactionSignal);
+                }
+                catch (error) {
+                    if (interactionSignal.aborted) {
+                        void admission.catch((admissionError) => {
+                            this.userForms.reject(requestId, admissionError instanceof Error
+                                ? admissionError
+                                : new RuntimeInteractionFailStopError(`Could not confirm admission for form ${requestId}`, admissionError));
+                            this.finishDeferredFormTurnClosure();
+                        });
+                        throw abortErrorFromSignal(interactionSignal);
+                    }
+                    this.userForms.reject(requestId, error instanceof Error
+                        ? error
+                        : new RuntimeInteractionFailStopError(`Could not confirm admission for form ${requestId}`, error));
+                    this.finishDeferredFormTurnClosure();
+                    await parked.catch(() => undefined);
+                    throw interactionAuthorityError(`Could not confirm admission for form ${requestId}`, error);
+                }
+            }
+            throwIfAborted(interactionSignal);
+            queue.push(requestEvent);
+            const response = await racePromiseWithAbort(parked, interactionSignal);
+            throwIfAborted(interactionSignal);
+            const answerAck = {
+                type: 'form_answer_ack',
+                id: this.input.newId(),
+                turnId,
+                ts: this.input.now(),
+                requestId,
+                toolUseId,
+            };
+            if (hostedRun)
+                await this.publishHostedSettlementAck(queue, answerAck);
+            else
+                queue.push(answerAck);
+            return response.action === 'accept'
+                ? { action: 'accept', values: response.values }
+                : { action: response.action };
+        }
+        finally {
+            abortSignal.removeEventListener('abort', onAbort);
+            producerCancellationSignal?.removeEventListener('abort', onProducerCancellation);
+            if (producerWithdrawal)
+                await producerWithdrawal;
+        }
+    }
     async askUserQuestion(turnId, toolUseId, questions, abortSignal, queue) {
         throwIfAborted(abortSignal);
         const hostedRun = this.interactionRun();
@@ -1886,6 +2101,7 @@ export class ToolRuntime {
                     sessionId: this.input.sessionId,
                     requestId,
                     decision: 'deny',
+                    closureReason: 'turn_stopped',
                 }).then(() => undefined));
             }
         };
@@ -1989,6 +2205,13 @@ export class ToolRuntime {
         this.questionClosureDeferred = false;
         this.userQuestions.close((requestId) => new RuntimeInteractionInvariantError(`Hosted question ${requestId} escaped exact Run closure`));
     }
+    finishDeferredFormTurnClosure() {
+        const turnId = this.turnId;
+        if (!this.formClosureDeferred || this.userForms.pendingCount() !== 0)
+            return;
+        this.formClosureDeferred = false;
+        this.userForms.close((requestId) => new RuntimeInteractionInvariantError(`Hosted form ${requestId} escaped exact Run closure for turn ${turnId}`));
+    }
     finishDeferredSandboxBoundaryTurnClosure() {
         const turnId = this.turnId;
         if (!this.sandboxBoundaryClosureDeferred || this.sandboxBoundaryRequests.pendingCount() !== 0) {
@@ -2038,6 +2261,29 @@ export class ToolRuntime {
             },
         });
     }
+    createFormSettlement(turnId, requestId) {
+        return Object.freeze({
+            applyAnswer: async (answer) => {
+                if (Object.hasOwn(answer, 'requestId')) {
+                    throw new RuntimeInteractionInvariantError(`Form settlement ${requestId} received a routed answer`);
+                }
+                const pending = this.userForms
+                    .entries()
+                    .find(([candidateId]) => candidateId === requestId)?.[1];
+                const response = answer.action === 'accept'
+                    ? { requestId, action: 'accept', values: answer.values }
+                    : { requestId, action: answer.action };
+                if (!pending || !this.settleUserFormAnswer(response, pending)) {
+                    throw new RuntimeInteractionInvariantError(`Form settlement did not take ${requestId} from turn ${turnId}`);
+                }
+            },
+            applyClosure: async (reason) => {
+                if (!this.closeUserForm(requestId, reason)) {
+                    throw new RuntimeInteractionInvariantError(`Form closure did not take ${requestId} from turn ${turnId}`);
+                }
+            },
+        });
+    }
 }
 async function validateDeclaredToolArgs(parameters, args) {
     if (!parameters || (typeof parameters !== 'object' && typeof parameters !== 'function')) {
@@ -2367,6 +2613,7 @@ function normalizeManagedMutationSettlement(settlement, maxResultBytes) {
     const response = durableOutcome.content;
     const expectedError = kind === 'operation_failed_no_effect_committed';
     if (response?.kind !== 'function_response' ||
+        response.modelProjection === undefined ||
         (expectedError ? response.isError !== true : response.isError === true)) {
         throw new Error('Managed no-effect settlement has the wrong durable outcome state');
     }
@@ -2374,6 +2621,7 @@ function normalizeManagedMutationSettlement(settlement, maxResultBytes) {
     const outcome = Object.freeze({
         content,
         isError: expectedError,
+        modelProjection: response.modelProjection,
         durationMs: typeof durableOutcome.actions?.stateDelta?.durationMs === 'number'
             ? durableOutcome.actions.stateDelta.durationMs
             : 0,
@@ -2584,14 +2832,14 @@ function coerceTerminalFailure(tool, cwd, args, err) {
     const command = args && typeof args === 'object' && typeof args.command === 'string'
         ? args.command
         : '';
-    const stdout = redactSecrets(String(error.stdout ?? ''));
-    const stderr = redactSecrets(String(error.stderr ?? ''));
+    const stdout = String(error.stdout ?? '');
+    const stderr = String(error.stderr ?? '');
     const sandboxDenied = error.reason === 'sandbox_denial' && error.sandboxed === true;
     return {
         content: {
             kind: 'terminal',
             cwd,
-            cmd: redactSecrets(command),
+            cmd: command,
             status: error.code === 124 ? 'timed_out' : error.code === 130 ? 'cancelled' : 'failed',
             exitCode: error.code,
             output: {
@@ -2600,7 +2848,7 @@ function coerceTerminalFailure(tool, cwd, args, err) {
                 stderr,
                 stdoutTruncated: error.stdoutTruncated === true,
                 stderrTruncated: error.stderrTruncated === true,
-                redacted: stdout !== String(error.stdout ?? '') || stderr !== String(error.stderr ?? ''),
+                redacted: false,
             },
             ...(sandboxDenied
                 ? {
@@ -2770,6 +3018,12 @@ function providerToolErrorMessage(output) {
     }
     return record.error;
 }
+function isPromiseLike(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'then' in value &&
+        typeof value.then === 'function');
+}
 function summarizeArgs(toolName, args) {
     const projected = toolName === 'WebSearch'
         ? projectWebSearchTelemetryArgs(args)