maka-agent 0.2.0-dev.4.20260830 → 0.2.0-dev.41.20260918

package/node_modules/@openai/agents-core/dist/runner/blockedOutputPersistence.mjs

@@ -4,17 +4,24 @@ import { getToolCallName, getToolCallNamespace, getToolCallQualifiedName, getFun
 import { getToolSearchExecution, getToolSearchMatchKey, getToolSearchOutputReplacementKey, getToolSearchProviderCallId, } from "../tooling.mjs";
 import { FunctionCallItem as FunctionCallItemSchema, FunctionCallResultItem as FunctionCallResultItemSchema, } from "../types/protocol.mjs";
 import { Usage } from "../usage.mjs";
-import { sanitizeBlockedOutputGuardrailResults, sanitizeBlockedToolOutputGuardrailResults, } from "./guardrails.mjs";
+import { toSmartString } from "../utils/smartString.mjs";
+import { getSerializedOutputGuardrailResults, sanitizeBlockedOutputGuardrailResults, sanitizeBlockedToolOutputGuardrailResults, replaceSanitizedOutputGuardrailMessages, } from "./guardrails.mjs";
 import { invalidateOutputItemNormalization } from "./items.mjs";
 import { getToolResultCorrelationForCall, getToolResultCorrelationForResult, getToolResultCorrelationKey, } from "./toolResultCorrelation.mjs";
 import { addLoadedToolNamesFromToolSearchOutput } from "./toolSearch.mjs";
-export const OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT = 'Output withheld by an output guardrail.';
+import { OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT } from "./outputGuardrailBlockedMessage.mjs";
 const currentResponseToolOutputGuardrailResultStarts = new WeakMap();
 export function captureCurrentResponseToolOutputGuardrailResultStart(state, overwrite) {
     if (overwrite || !currentResponseToolOutputGuardrailResultStarts.has(state)) {
         currentResponseToolOutputGuardrailResultStarts.set(state, state._toolOutputGuardrailResults.length);
     }
 }
+export function getCurrentResponseToolOutputGuardrailResultStart(state) {
+    return currentResponseToolOutputGuardrailResultStarts.get(state);
+}
+export function restoreCurrentResponseToolOutputGuardrailResultStart(state, startIndex) {
+    currentResponseToolOutputGuardrailResultStarts.set(state, startIndex);
+}
 function currentCompletedToolRuns(state) {
     const responseCalls = getResponseOutput(currentResponse(state))?.filter((item) => item.type === 'function_call');
     const processedRuns = state._lastProcessedResponse?.functions ?? [];
@@ -49,21 +56,130 @@ function currentTerminalToolRuns(state) {
     }
     return completedRuns;
 }
+function currentDeclarativeTerminalToolOutput(state) {
+    const behavior = state._currentAgent.toolUseBehavior;
+    if (behavior === 'run_llm_again' ||
+        typeof behavior === 'function' ||
+        state._currentStep?.type !== 'next_step_final_output') {
+        return undefined;
+    }
+    const completedRuns = currentTerminalToolRuns(state);
+    const selectedRun = behavior === 'stop_on_first_tool'
+        ? completedRuns[0]
+        : completedRuns.find((run) => behavior.stopAtToolNames.some((toolName) => matchesFunctionToolName(run.tool, toolName)));
+    const callId = selectedRun?.toolCall.callId;
+    const outputItem = callId
+        ? state._completedToolInvocationEvidence
+            .get(state._currentAgent)
+            ?.get(callId)?.items[1]
+        : undefined;
+    return outputItem instanceof RunToolCallOutputItem
+        ? toSmartString(outputItem.output)
+        : undefined;
+}
+export function hasPersistedToolOutput(state) {
+    return state._generatedItems
+        .slice(0, state._currentTurnPersistedItemCount)
+        .some((item) => item.type === 'tool_call_output_item');
+}
+export function hasPendingApprovedToolInputCompaction(state) {
+    return state._pendingSessionWrite?.phase === 'compaction_pending';
+}
+export function hasDeterministicTerminalToolOutputSource(state) {
+    return (state._currentStep?.type === 'next_step_final_output' &&
+        currentDeclarativeTerminalToolOutput(state) === state._currentStep.output);
+}
 export function hasTerminalToolOutputSource(state) {
     return (state._finalOutputSource === 'tool_result' ||
         (state._finalOutputSource === undefined &&
             state._serializedCurrentStep === state._currentStep &&
             currentTerminalToolRuns(state).length > 0));
 }
-export function sanitizeBlockedTerminalToolOutput(state, outputGuardrailResultStart, completedOutputGuardrailTripwireResult, observedOutputGuardrailResults, tripwire, ownedOutputGuardrailResults) {
+export function sanitizeBlockedTerminalToolOutput(state, outputGuardrailResultStart, completedOutputGuardrailTripwireResult, observedOutputGuardrailResults, tripwire, ownedOutputGuardrailResults, resolveBlockedMessage, signal, onBlockedOutput) {
     if (!hasTerminalToolOutputSource(state) ||
         !completedOutputGuardrailTripwireResult) {
         return false;
     }
+    onBlockedOutput?.();
     redactBlockedResponseToolOutputs(state);
-    sanitizeBlockedOutputGuardrailResults(state, outputGuardrailResultStart, OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT, observedOutputGuardrailResults, tripwire, ownedOutputGuardrailResults);
+    const sanitizedOutputGuardrailResults = sanitizeBlockedOutputGuardrailResults(state, outputGuardrailResultStart, OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT, observedOutputGuardrailResults, tripwire, ownedOutputGuardrailResults);
     sanitizeBlockedToolOutputGuardrailResults(state, currentResponseToolOutputGuardrailResultStarts.get(state) ?? 0, OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT);
-    return true;
+    if (!resolveBlockedMessage) {
+        return OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT;
+    }
+    const blockedOutputGuardrailResult = completedOutputGuardrailTripwireResult;
+    let guardrailName = 'output_guardrail';
+    try {
+        const candidate = blockedOutputGuardrailResult.guardrail.name;
+        if (typeof candidate === 'string' && candidate.length > 0) {
+            guardrailName = candidate;
+        }
+    }
+    catch {
+        // Keep the safe fallback name when caller-owned metadata is unreadable.
+    }
+    signal?.throwIfAborted();
+    return awaitBlockedMessageWithAbort(resolveBlockedMessage(guardrailName), signal)
+        .then((blockedMessage) => {
+        signal?.throwIfAborted();
+        if (typeof blockedMessage !== 'string' ||
+            blockedMessage.length === 0 ||
+            blockedMessage === OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT) {
+            return OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT;
+        }
+        redactBlockedResponseToolOutputs(state, blockedMessage);
+        replaceSanitizedOutputGuardrailMessages(state, sanitizedOutputGuardrailResults, blockedMessage, tripwire);
+        return blockedMessage;
+    })
+        .catch(() => {
+        signal?.throwIfAborted();
+        return OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT;
+    });
+}
+function awaitBlockedMessageWithAbort(promise, signal) {
+    if (!signal) {
+        return promise;
+    }
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const cleanup = () => {
+            signal.removeEventListener('abort', onAbort);
+        };
+        const onAbort = () => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            try {
+                signal.throwIfAborted();
+            }
+            catch (error) {
+                reject(error);
+            }
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        if (signal.aborted) {
+            onAbort();
+            return;
+        }
+        promise.then((value) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            resolve(value);
+        }, (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            reject(error);
+        });
+    });
 }
 export function shouldDeferInterruptedSessionItems(state, hasOutputGuardrail) {
     return (state._currentStep?.type === 'next_step_interruption' &&
@@ -81,14 +197,29 @@ export function assertResumedSessionOutputGuardrailSafety(state, session, hasOut
         throw new UserError('Cannot resume this serialized terminal output because terminal tool output provenance could not be verified after the tool behavior changed. Continue the live RunState or start a new run from safe input.');
     }
     const shouldDefer = shouldDeferInterruptedSessionItems(state, hasOutputGuardrail);
+    let restoredSelection;
     if (state._serializedCurrentStep !== undefined && shouldDefer) {
         const responseOutput = getResponseOutput(currentResponse(state));
-        if (session !== undefined ||
-            state._toolOutputGuardrailResults.length > 0 ||
-            !responseOutput ||
+        restoredSelection = responseOutput
+            ? currentRunItemSelection(state, responseOutput)
+            : undefined;
+        if (!responseOutput ||
             responseOutput.some((item) => item.type !== 'function_call') ||
-            !currentRunItemSelection(state, responseOutput).proven) {
-            throw new UserError('Cannot resume this serialized output-bearing approval checkpoint because current-response provenance was not preserved. Start a new run from safe input.');
+            !restoredSelection?.proven ||
+            getCurrentResponseToolOutputGuardrailResultStart(state) === undefined) {
+            const reasons = [
+                !responseOutput ? 'missing response output' : undefined,
+                responseOutput?.some((item) => item.type !== 'function_call')
+                    ? 'non-function response item'
+                    : undefined,
+                !restoredSelection?.proven
+                    ? 'unproven generated-item range'
+                    : undefined,
+                getCurrentResponseToolOutputGuardrailResultStart(state) === undefined
+                    ? 'missing guardrail-result boundary'
+                    : undefined,
+            ].filter((reason) => reason !== undefined);
+            throw new UserError(`Cannot resume this serialized output-bearing approval checkpoint because current-response provenance was not preserved (${reasons.join(', ')}). Start a new run from safe input.`);
         }
     }
     if (session === undefined) {
@@ -101,9 +232,11 @@ export function assertResumedSessionOutputGuardrailSafety(state, session, hasOut
         return;
     }
     const currentCallIds = new Set((state._lastProcessedResponse?.functions ?? []).map((run) => run.toolCall.callId));
-    const currentStart = state._generatedItems.findIndex((item) => item instanceof RunToolCallItem &&
-        item.rawItem.type === 'function_call' &&
-        currentCallIds.has(item.rawItem.callId));
+    const currentStart = restoredSelection
+        ? state._generatedItems.length - restoredSelection.primary.length
+        : state._generatedItems.findIndex((item) => item instanceof RunToolCallItem &&
+            item.rawItem.type === 'function_call' &&
+            currentCallIds.has(item.rawItem.callId));
     const firstOutputIndex = state._generatedItems.findIndex((item, index) => index >= currentStart && item instanceof RunToolCallOutputItem);
     if (currentStart >= 0 &&
         firstOutputIndex === state._currentTurnPersistedItemCount &&
@@ -667,14 +800,14 @@ function buildCanonicalFunctionCall(rawItem) {
         ...optionalField('caller', parsed.caller),
     });
 }
-export function buildBlockedToolOutputRawItem(rawItem) {
+export function buildBlockedToolOutputRawItem(rawItem, blockedMessage = OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT) {
     const parsed = FunctionCallResultItemSchema.parse(rawItem);
     return FunctionCallResultItemSchema.parse({
         type: 'function_call_result',
         name: parsed.name,
         ...optionalField('namespace', parsed.namespace),
         callId: parsed.callId,
-        output: OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT,
+        output: blockedMessage,
         ...optionalField('id', parsed.id),
         ...optionalField('status', parsed.status),
     });
@@ -796,7 +929,50 @@ function boundedCurrentFunctionResponseStart(generated, responseOutput) {
     }
     return start;
 }
+function restoredCurrentRunItemSelection(state, responseOutput) {
+    if (state._serializedCurrentStep !== state._currentStep ||
+        state._currentStep?.type !== 'next_step_interruption') {
+        return undefined;
+    }
+    const generated = state._generatedItems;
+    const processed = state._lastProcessedResponse?.newItems ?? [];
+    // A valid schema 1.20 restore relinks these wrappers. Do not fall back to structural
+    // equality for an approval checkpoint whose serialized ownership was absent or invalid.
+    const responseKeys = responseOutput.map(functionCallKey);
+    if (getCurrentResponseToolOutputGuardrailResultStart(state) === undefined ||
+        processed.length === 0 ||
+        processed.length !== responseKeys.length ||
+        responseKeys.some((key) => key === undefined) ||
+        processed.some((item, index) => !(item instanceof RunToolCallItem) ||
+            item.rawItem.type !== 'function_call' ||
+            functionCallKey(item.rawItem) !== responseKeys[index])) {
+        const fallbackStart = Math.min(state._currentTurnPersistedItemCount, generated.length);
+        const fallback = generated.slice(fallbackStart);
+        return { primary: fallback, aliases: fallback, proven: false };
+    }
+    const matchingStarts = [];
+    for (let start = 0; start <= generated.length - processed.length; start += 1) {
+        if (processed.every((item, offset) => generated[start + offset] === item)) {
+            matchingStarts.push(start);
+        }
+    }
+    const start = matchingStarts.length === 1 ? matchingStarts[0] : undefined;
+    const processedEnd = start === undefined ? undefined : start + processed.length;
+    const interruptionIndexes = state._currentStep.data.interruptions.map((interruption) => generated.flatMap((item, index) => item === interruption ? [index] : []));
+    if (start === undefined ||
+        interruptionIndexes.some((indexes) => indexes.length !== 1 || indexes[0] < (processedEnd ?? Infinity))) {
+        const fallbackStart = Math.min(state._currentTurnPersistedItemCount, generated.length);
+        const fallback = generated.slice(fallbackStart);
+        return { primary: fallback, aliases: fallback, proven: false };
+    }
+    const primary = generated.slice(start);
+    return { primary, aliases: primary, proven: true };
+}
 function currentRunItemSelection(state, responseOutput) {
+    const restoredSelection = restoredCurrentRunItemSelection(state, responseOutput);
+    if (restoredSelection) {
+        return restoredSelection;
+    }
     const generated = state._generatedItems.slice();
     const responseObjects = new Set(responseOutput);
     const processed = state._lastProcessedResponse?.newItems ?? [];
@@ -847,55 +1023,6 @@ function currentRunItemSelection(state, responseOutput) {
         }
         return { primary, aliases, proven: true };
     }
-    if (state._currentStep?.type === 'next_step_interruption' &&
-        processed.length > 0 &&
-        processed.length === responseOutput.length &&
-        processed.length * 2 <= generated.length &&
-        processed.every((item, index) => item instanceof RunToolCallItem &&
-            item.rawItem.type === 'function_call' &&
-            functionCallKey(item.rawItem) ===
-                functionCallKey(responseOutput[index]))) {
-        const interruptionCount = state._currentStep.data.interruptions.length;
-        const currentSuffix = generated.slice(-processed.length * 2);
-        const callItems = currentSuffix.slice(0, processed.length);
-        const outcomeItems = currentSuffix.slice(processed.length);
-        const responseKeys = new Set(responseOutput.map(functionCallKey));
-        const outcomeKeys = new Set();
-        let approvalCount = 0;
-        const outcomesAreBounded = outcomeItems.every((item) => {
-            if (item.type === 'tool_approval_item') {
-                if (!('rawItem' in item) || item.rawItem.type !== 'function_call') {
-                    return false;
-                }
-                approvalCount += 1;
-                const key = functionCallKey(item.rawItem);
-                if (!key || !responseKeys.has(key) || outcomeKeys.has(key))
-                    return false;
-                outcomeKeys.add(key);
-                return true;
-            }
-            if (!(item instanceof RunToolCallOutputItem) ||
-                item.rawItem.type !== 'function_call_result') {
-                return false;
-            }
-            const key = functionResultKey(item.rawItem);
-            if (!key || !responseKeys.has(key) || outcomeKeys.has(key))
-                return false;
-            outcomeKeys.add(key);
-            return true;
-        });
-        if (responseKeys.size === responseOutput.length &&
-            outcomeKeys.size === responseOutput.length &&
-            approvalCount === interruptionCount &&
-            outcomesAreBounded &&
-            functionRunItemSequenceIsPrefix(callItems, processed)) {
-            return {
-                primary: currentSuffix,
-                aliases: [...currentSuffix, ...processed],
-                proven: true,
-            };
-        }
-    }
     if (state._currentTurnBlockedSessionStartIndex !== undefined) {
         const blockedStart = Math.min(state._currentTurnBlockedSessionStartIndex, generated.length);
         return {
@@ -908,7 +1035,7 @@ function currentRunItemSelection(state, responseOutput) {
     const fallback = generated.slice(fallbackStart);
     return { primary: fallback, aliases: fallback, proven: false };
 }
-function buildCurrentFunctionPairPlan(state, responseOutput, selection) {
+function buildCurrentFunctionPairPlan(state, responseOutput, selection, blockedMessage = OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT) {
     if (!selection.proven)
         return undefined;
     try {
@@ -936,7 +1063,7 @@ function buildCurrentFunctionPairPlan(state, responseOutput, selection) {
                     return undefined;
                 callKeys.push(key);
                 callIndexes.set(key, index);
-                sanitizedItems.push(new RunToolCallItem(buildCanonicalFunctionCall(item.rawItem), item.agent));
+                sanitizedItems.push(new RunToolCallItem(buildCanonicalFunctionCall(item.rawItem), item.agent, item.functionToolStateKey));
                 continue;
             }
             if (item instanceof RunToolCallOutputItem &&
@@ -946,7 +1073,7 @@ function buildCurrentFunctionPairPlan(state, responseOutput, selection) {
                     return undefined;
                 resultKeys.push(key);
                 resultIndexes.set(key, index);
-                sanitizedItems.push(new RunToolCallOutputItem(buildBlockedToolOutputRawItem(item.rawItem), item.agent, OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT, undefined, item.executionStatus));
+                sanitizedItems.push(new RunToolCallOutputItem(buildBlockedToolOutputRawItem(item.rawItem, blockedMessage), item.agent, blockedMessage, undefined, item.executionStatus));
                 continue;
             }
             return undefined;
@@ -987,11 +1114,11 @@ function buildCurrentFunctionPairPlan(state, responseOutput, selection) {
                 const replacement = sanitizedItems[index];
                 if (replacement instanceof RunToolCallItem &&
                     item instanceof RunToolCallItem) {
-                    replacements.set(item, new RunToolCallItem(replacement.rawItem, item.agent));
+                    replacements.set(item, new RunToolCallItem(replacement.rawItem, item.agent, replacement.functionToolStateKey));
                 }
                 else if (replacement instanceof RunToolCallOutputItem &&
                     item instanceof RunToolCallOutputItem) {
-                    replacements.set(item, new RunToolCallOutputItem(replacement.rawItem, item.agent, OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT, undefined, replacement.executionStatus));
+                    replacements.set(item, new RunToolCallOutputItem(replacement.rawItem, item.agent, blockedMessage, undefined, replacement.executionStatus));
                 }
                 else {
                     return undefined;
@@ -1097,6 +1224,7 @@ function replaceCurrentResponse(state, response, output) {
     if (!replacedResponse &&
         state._serializedCurrentStep !== undefined &&
         state._serializedCurrentStep === state._currentStep &&
+        state._currentStep?.type === 'next_step_final_output' &&
         state._modelResponses.length > 0) {
         const archivedResponse = state._modelResponses.at(-1);
         try {
@@ -1113,9 +1241,9 @@ function replaceCurrentResponse(state, response, output) {
     if (state._lastTurnResponse === response)
         state._lastTurnResponse = replacement;
 }
-function markBlockedState(state) {
+function markBlockedState(state, blockedMessage) {
     if (state._currentStep?.type === 'next_step_final_output') {
-        state._currentStep.output = OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT;
+        state._currentStep.output = blockedMessage;
     }
     invalidateOutputItemNormalization(state._generatedItems);
     if (state._lastProcessedResponse) {
@@ -1123,12 +1251,12 @@ function markBlockedState(state) {
     }
 }
 /** Replaces a rejected function response with allowlisted replay-safe values. */
-export function redactBlockedResponseToolOutputs(state) {
+export function redactBlockedResponseToolOutputs(state, blockedMessage = OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT) {
     const response = currentResponse(state);
     const responseOutput = getResponseOutput(response);
     const selection = currentRunItemSelection(state, responseOutput ?? []);
     const plan = response && responseOutput
-        ? buildCurrentFunctionPairPlan(state, responseOutput, selection)
+        ? buildCurrentFunctionPairPlan(state, responseOutput, selection, blockedMessage)
         : undefined;
     if (!plan) {
         const replacements = new Map();
@@ -1137,12 +1265,12 @@ export function redactBlockedResponseToolOutputs(state) {
         replaceRunItems(state, replacements, responseOutput, []);
         if (response)
             replaceCurrentResponse(state, response, []);
-        markBlockedState(state);
+        markBlockedState(state, blockedMessage);
         return selection.aliases.length > 0 || response !== undefined;
     }
     replaceRunItems(state, plan.replacements, responseOutput, plan.responseOutput);
     replaceCurrentResponse(state, response, plan.responseOutput);
-    markBlockedState(state);
+    markBlockedState(state, blockedMessage);
     return plan.replacements.size > 0 || plan.responseOutput.length > 0;
 }
 export function getBlockedOutputSessionSnapshotRunItems(state) {
@@ -1150,20 +1278,83 @@ export function getBlockedOutputSessionSnapshotRunItems(state) {
     if (!responseOutput)
         return [];
     const selection = currentRunItemSelection(state, responseOutput);
-    const plan = buildCurrentFunctionPairPlan(state, responseOutput, selection);
+    const blockedMessage = state._currentStep?.type === 'next_step_final_output' &&
+        typeof state._currentStep.output === 'string' &&
+        state._currentStep.output.length > 0
+        ? state._currentStep.output
+        : OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT;
+    const plan = buildCurrentFunctionPairPlan(state, responseOutput, selection, blockedMessage);
     return plan?.sanitizedItems ?? [];
 }
 export function isCanonicalBlockedOutputPayload(item) {
+    return isCanonicalBlockedOutputPayloadForMessage(item, OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT);
+}
+function isCanonicalBlockedOutputPayloadForMessage(item, blockedMessage) {
     if (item?.type !== 'function_call_result')
         return false;
     try {
         return (JSON.stringify(item) ===
-            JSON.stringify(buildBlockedToolOutputRawItem(item)));
+            JSON.stringify(buildBlockedToolOutputRawItem(item, blockedMessage)));
     }
     catch {
         return false;
     }
 }
+/** Returns a custom blocked message only when the restored response owns its canonical payload. */
+function getCanonicalSerializedOutputGuardrailBlockedMessage(state) {
+    if (state._serializedCurrentStep !== state._currentStep ||
+        state._currentStep?.type !== 'next_step_final_output' ||
+        typeof state._currentStep.output !== 'string' ||
+        state._currentStep.output.length === 0 ||
+        state._currentStep.output === OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT) {
+        return undefined;
+    }
+    const blockedMessage = state._currentStep.output;
+    const responseOutput = getResponseOutput(currentResponse(state));
+    if (!responseOutput)
+        return undefined;
+    const selection = currentRunItemSelection(state, responseOutput);
+    const plan = buildCurrentFunctionPairPlan(state, responseOutput, selection, blockedMessage);
+    if (!plan ||
+        JSON.stringify(responseOutput) !== JSON.stringify(plan.responseOutput)) {
+        return undefined;
+    }
+    for (const [item, canonicalItem] of plan.replacements) {
+        if (item instanceof RunToolCallItem &&
+            canonicalItem instanceof RunToolCallItem) {
+            if (JSON.stringify(item.rawItem) !== JSON.stringify(canonicalItem.rawItem)) {
+                return undefined;
+            }
+            continue;
+        }
+        if (item instanceof RunToolCallOutputItem &&
+            canonicalItem instanceof RunToolCallOutputItem) {
+            if (item.output !== blockedMessage ||
+                item.customData !== undefined ||
+                !isCanonicalBlockedOutputPayloadForMessage(item.rawItem, blockedMessage)) {
+                return undefined;
+            }
+            continue;
+        }
+        return undefined;
+    }
+    return blockedMessage;
+}
+/** Neutralizes a canonical restored placeholder without trusting serialized guardrail identity. */
+export function normalizeSerializedOutputGuardrailBlockedMessage(state) {
+    const blockedMessage = getCanonicalSerializedOutputGuardrailBlockedMessage(state);
+    if (!blockedMessage ||
+        !state._outputGuardrailResults.some((result) => result.agent === state._currentAgent &&
+            result.agentOutput === blockedMessage &&
+            result.output.tripwireTriggered === true &&
+            result.output.outputInfo === undefined)) {
+        return;
+    }
+    const ownedResults = getSerializedOutputGuardrailResults(state, blockedMessage);
+    // A saved verdict only identifies data to neutralize; current guards must rerun.
+    redactBlockedResponseToolOutputs(state);
+    replaceSanitizedOutputGuardrailMessages(state, ownedResults, OUTPUT_GUARDRAIL_BLOCKED_TOOL_OUTPUT);
+}
 export function hasOutputBearingApprovalCheckpoint(state) {
     const responseOutput = getResponseOutput(currentResponse(state));
     if (!responseOutput)

package/node_modules/@openai/agents-core/dist/runner/conversation.js

@@ -5,6 +5,7 @@ exports.getServerConversationOwner = getServerConversationOwner;
 exports.applyCallModelInputFilter = applyCallModelInputFilter;
 const errors_1 = require("../errors.js");
 const items_1 = require("../items.js");
+const toolSearchAttribution_1 = require("./toolSearchAttribution.js");
 const context_1 = require("../tracing/context.js");
 const items_2 = require("./items.js");
 const toolResultCorrelation_1 = require("./toolResultCorrelation.js");
@@ -220,6 +221,12 @@ function consumeCorrelationCount(counts, correlation) {
     counts.set(key, remaining - 1);
     return true;
 }
+// SDK discovery ownership does not change the item already stored by the provider.
+function getServerItemKey(item) {
+    return (0, items_2.getAgentInputItemKey)(item.type === 'tool_search_output'
+        ? (0, toolSearchAttribution_1.attributeToolSearchOutput)(item, undefined)
+        : item);
+}
 /**
  * Tracks which items have already been sent to or received from the Responses API when the caller
  * supplies `conversationId`/`previousResponseId`. This ensures we only send the delta each turn.
@@ -265,7 +272,7 @@ class ServerConversationTracker {
             for (const item of response.output) {
                 if (item && typeof item === 'object') {
                     this.serverItems.add(item);
-                    serverItemKeys.add((0, items_2.getAgentInputItemKey)(item));
+                    serverItemKeys.add(getServerItemKey(item));
                 }
             }
         }
@@ -288,7 +295,7 @@ class ServerConversationTracker {
                 if (!rawItem || typeof rawItem !== 'object') {
                     continue;
                 }
-                const rawItemKey = (0, items_2.getAgentInputItemKey)(rawItem);
+                const rawItemKey = getServerItemKey(rawItem);
                 if (item instanceof items_1.RunInputItem) {
                     this.sentItems.add(rawItem);
                     continue;
@@ -309,7 +316,7 @@ class ServerConversationTracker {
      * Records the raw items returned by the server so future delta calculations skip them.
      * Also captures the latest response identifier to chain follow-up calls when possible.
      */
-    trackServerItems(modelResponse) {
+    trackServerItems(modelResponse, processedItems = []) {
         if (!modelResponse) {
             return;
         }
@@ -318,6 +325,18 @@ class ServerConversationTracker {
                 this.serverItems.add(item);
             }
         }
+        const searchOutputs = processedItems.filter((item) => item instanceof items_1.RunToolSearchOutputItem);
+        if (searchOutputs.length > 0) {
+            const serverSearchKeys = new Set(modelResponse.output
+                .filter((item) => item.type === 'tool_search_output')
+                .map(getServerItemKey));
+            // A client-generated result is unsent unless the response actually contains that output.
+            for (const item of searchOutputs) {
+                if (serverSearchKeys.has(getServerItemKey(item.rawItem))) {
+                    this.serverItems.add(item.rawItem);
+                }
+            }
+        }
         if (!this.conversationId && modelResponse.responseId) {
             this.previousResponseId = modelResponse.responseId;
         }

package/node_modules/@openai/agents-core/dist/runner/conversation.mjs

@@ -1,5 +1,6 @@
 import { UserError } from "../errors.mjs";
-import { RunInputItem } from "../items.mjs";
+import { RunInputItem, RunToolSearchOutputItem } from "../items.mjs";
+import { attributeToolSearchOutput } from "./toolSearchAttribution.mjs";
 import { addErrorToCurrentSpan } from "../tracing/context.mjs";
 import { buildAgentInputPool, deduplicateAgentInputItemsPreferringLatest, extractOutputItemsFromRunItems, getAgentInputItemKey, removeAgentInputFromPool, takeAgentInputFromPool, toAgentInputList, } from "./items.mjs";
 import { getToolResultCorrelationForResult, getToolResultCorrelationKey, getUnresolvedToolResultCorrelationsForResponse, } from "./toolResultCorrelation.mjs";
@@ -214,6 +215,12 @@ function consumeCorrelationCount(counts, correlation) {
     counts.set(key, remaining - 1);
     return true;
 }
+// SDK discovery ownership does not change the item already stored by the provider.
+function getServerItemKey(item) {
+    return getAgentInputItemKey(item.type === 'tool_search_output'
+        ? attributeToolSearchOutput(item, undefined)
+        : item);
+}
 /**
  * Tracks which items have already been sent to or received from the Responses API when the caller
  * supplies `conversationId`/`previousResponseId`. This ensures we only send the delta each turn.
@@ -259,7 +266,7 @@ export class ServerConversationTracker {
             for (const item of response.output) {
                 if (item && typeof item === 'object') {
                     this.serverItems.add(item);
-                    serverItemKeys.add(getAgentInputItemKey(item));
+                    serverItemKeys.add(getServerItemKey(item));
                 }
             }
         }
@@ -282,7 +289,7 @@ export class ServerConversationTracker {
                 if (!rawItem || typeof rawItem !== 'object') {
                     continue;
                 }
-                const rawItemKey = getAgentInputItemKey(rawItem);
+                const rawItemKey = getServerItemKey(rawItem);
                 if (item instanceof RunInputItem) {
                     this.sentItems.add(rawItem);
                     continue;
@@ -303,7 +310,7 @@ export class ServerConversationTracker {
      * Records the raw items returned by the server so future delta calculations skip them.
      * Also captures the latest response identifier to chain follow-up calls when possible.
      */
-    trackServerItems(modelResponse) {
+    trackServerItems(modelResponse, processedItems = []) {
         if (!modelResponse) {
             return;
         }
@@ -312,6 +319,18 @@ export class ServerConversationTracker {
                 this.serverItems.add(item);
             }
         }
+        const searchOutputs = processedItems.filter((item) => item instanceof RunToolSearchOutputItem);
+        if (searchOutputs.length > 0) {
+            const serverSearchKeys = new Set(modelResponse.output
+                .filter((item) => item.type === 'tool_search_output')
+                .map(getServerItemKey));
+            // A client-generated result is unsent unless the response actually contains that output.
+            for (const item of searchOutputs) {
+                if (serverSearchKeys.has(getServerItemKey(item.rawItem))) {
+                    this.serverItems.add(item.rawItem);
+                }
+            }
+        }
         if (!this.conversationId && modelResponse.responseId) {
             this.previousResponseId = modelResponse.responseId;
         }