maka-agent 0.2.0-dev.47.20260922 → 0.2.0-dev.48.20260923

package/node_modules/@maka/core/package.json

@@ -6,6 +6,7 @@
   "type": "module",
   "sideEffects": false,
   "exports": {
+    "./executor-catalog": "./dist/executor-catalog.js",
     "./executor-id": "./dist/executor-id.js",
     "./durable-tool-result-projection": "./dist/durable-tool-result-projection.js",
     "./model-projection-transition": "./dist/model-projection-transition.js",
@@ -29,6 +30,7 @@
     "./provider-retry-countdown": "./dist/provider-retry-countdown.js",
     "./interaction": "./dist/interaction.js",
     "./session": "./dist/session.js",
+    "./turn-origin": "./dist/turn-origin.js",
     "./session-reference": "./dist/session-reference.js",
     "./session-revisions": "./dist/session-revisions.js",
     "./collaboration": "./dist/collaboration.js",

package/node_modules/@maka/mcp/dist/credential-coordinator.js

@@ -44,7 +44,10 @@ export class McpCredentialCoordinator {
      *
      * The optional signal fences an ABANDONED erase: a logout whose round
      * timed out must not resume later, adopt whatever record a newer login
-     * just stored as its basis, and tombstone the fresh tokens. */
+     * just stored as its basis, and tombstone the fresh tokens.
+     *
+     * `spare` must be decided here, on the lane's read: checked outside, a
+     * login could land between the check and the erase. */
     async erase(serverId, options = {}) {
         this.epochs.set(serverId, this.epoch(serverId) + 1);
         await this.run(serverId, async () => {
@@ -54,6 +57,8 @@ export class McpCredentialCoordinator {
             // storage read was in flight — committing past it would erase a
             // record the caller no longer owns.
             this.assertNotAbandoned(serverId, options.signal);
+            if (basis && options.spare?.(basis))
+                return;
             // Absence still gets a tombstone: a cross-process flow that captured
             // generation 0 on absence must not CAS its credentials back in after
             // this revocation.

package/node_modules/@maka/mcp/dist/index.js

@@ -17,7 +17,7 @@
  * under the License.
  */
 import { randomBytes } from 'node:crypto';
-import { auth, Client, extractWWWAuthenticateParams, LATEST_PROTOCOL_VERSION, CLIENT_CAPABILITIES_META_KEY, isInputRequiredResult, SdkErrorCode, SdkHttpError, SSEClientTransport, StreamableHTTPClientTransport, } from '@modelcontextprotocol/client';
+import { auth, validateAuthorizationResponseIssuer, Client, extractWWWAuthenticateParams, LATEST_PROTOCOL_VERSION, CLIENT_CAPABILITIES_META_KEY, isInputRequiredResult, SdkErrorCode, SdkHttpError, SSEClientTransport, StreamableHTTPClientTransport, } from '@modelcontextprotocol/client';
 import { StdioClientTransport } from '@modelcontextprotocol/client/stdio';
 import { setTimeout as delay } from 'node:timers/promises';
 import { containsMcpFormState, prepareMcpForm } from './form-elicitation.js';
@@ -34,7 +34,7 @@ import { McpToolCallPreparer } from './tool-output-validation.js';
 import { mapMcpToolProgress } from './tool-progress.js';
 import { McpCredentialCoordinator } from './credential-coordinator.js';
 import { assertTransportSecurity, urlProvenance, } from './transport-security.js';
-import { McpAuthRequiredError, McpOAuthProvider, } from './oauth.js';
+import { McpAuthRequiredError, McpOAuthProvider, authorizationCallbackError, mcpOAuthRecordBoundTo, } from './oauth.js';
 export { formatMcpDiagnosticText } from './diagnostic-text.js';
 export { McpToolCallError } from './tool-call-error.js';
 export { createCredentialMcpOAuthStorage, } from './credential-oauth-storage.js';
@@ -259,7 +259,7 @@ export class McpClientManager {
                         : undefined;
                 if (owed) {
                     try {
-                        await this.forgetAuthorization(serverId, owed);
+                        await this.forgetAuthorization(serverId, owed, { successor: serverConfig });
                     }
                     catch (error) {
                         await this.blockForCredentialCleanup(serverId, current, owed, error);
@@ -1272,7 +1272,6 @@ export class McpClientManager {
         }
     }
     async finishAuthorizationRound(serverId, callback, options = {}) {
-        const authorizationCode = callback.code;
         const { config } = this.requireRemoteEntry(serverId);
         // The immediate read doubles as the flow's generation/version pin.
         const storage = this.flowStorage(serverId, options.signal);
@@ -1298,6 +1297,25 @@ export class McpClientManager {
         if (record?.pendingServerUrl !== config.url) {
             throw new Error(`MCP server "${serverId}" changed its URL during authorization`);
         }
+        const metadata = record.discovery?.authorizationServerMetadata;
+        const expectedIssuer = metadata?.issuer ?? record.discovery?.authorizationServerUrl;
+        if (!expectedIssuer)
+            throw new Error('OAuth callback has no recorded issuer');
+        try {
+            validateAuthorizationResponseIssuer({
+                iss: callback.iss,
+                expectedIssuer: String(expectedIssuer),
+                issParameterSupported: metadata?.authorization_response_iss_parameter_supported === true,
+            });
+        }
+        catch {
+            // SDK errors echo the untrusted iss parameter; it must not cross IPC.
+            throw new Error('OAuth callback issuer validation failed');
+        }
+        if ('error' in callback) {
+            throw authorizationCallbackError(callback.error);
+        }
+        const authorizationCode = callback.code;
         const provider = new McpOAuthProvider({
             serverId,
             serverUrl: config.url,
@@ -1432,7 +1450,15 @@ export class McpClientManager {
             return;
         if (config && isMcpStdioConfig(config) && !(await this.coordinator.read(serverId)))
             return;
-        await this.coordinator.erase(serverId, options);
+        const { successor, ...eraseOptions } = options;
+        await this.coordinator.erase(serverId, {
+            ...eraseOptions,
+            // Another process may have applied the same change and signed in first.
+            ...(successor &&
+                !isMcpStdioConfig(successor) && {
+                spare: (record) => mcpOAuthRecordBoundTo(record, successor.url, successor.oauth),
+            }),
+        });
     }
     /** Drops stored tokens and registration, returning the server to needs-auth. */
     async clearAuthorization(serverId, options = {}) {

package/node_modules/@maka/mcp/dist/oauth.js

@@ -16,6 +16,25 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+import { createHash } from 'node:crypto';
+const OAUTH_ERROR_CODES = new Set([
+    'invalid_request',
+    'unauthorized_client',
+    'access_denied',
+    'unsupported_response_type',
+    'invalid_scope',
+    'server_error',
+    'temporarily_unavailable',
+    'invalid_client',
+    'invalid_grant',
+    'unsupported_grant_type',
+    'interaction_required',
+    'login_required',
+    'consent_required',
+]);
+export function authorizationCallbackError(code) {
+    return new Error(`Authorization failed: ${OAUTH_ERROR_CODES.has(code) ? code : 'unknown_error'}`);
+}
 export function createMemoryMcpOAuthStorage() {
     const records = new Map();
     return {
@@ -31,6 +50,16 @@ export function createMemoryMcpOAuthStorage() {
         },
     };
 }
+function mcpOAuthClientConfigHash(config) {
+    if (!config?.clientId)
+        return undefined;
+    return createHash('sha256')
+        .update(JSON.stringify([config.issuer, config.clientId, config.clientSecret]))
+        .digest('hex');
+}
+export function mcpOAuthRecordBoundTo(record, serverUrl, config) {
+    return (record.serverUrl === serverUrl && record.clientConfigHash === mcpOAuthClientConfigHash(config));
+}
 /** Thrown (via the SDK's UnauthorizedError path) when a background connect
  * would need the user in a browser. The manager maps it to `needs-auth`. */
 export class McpAuthRequiredError extends Error {
@@ -64,6 +93,9 @@ export class McpOAuthProvider {
         if (state)
             this.state = () => state;
     }
+    get clientConfigHash() {
+        return mcpOAuthClientConfigHash(this.options.config);
+    }
     get redirectUrl() {
         return this.options.interactive?.redirectUrl ?? BACKGROUND_REDIRECT_URL;
     }
@@ -82,10 +114,17 @@ export class McpOAuthProvider {
                 : {}),
         };
     }
-    async clientInformation() {
+    async clientInformation(context) {
         const configured = this.options.config;
         if (configured?.clientId) {
+            if (!configured.issuer) {
+                throw new Error(`MCP server "${this.options.serverId}" requires oauth.issuer for its pre-registered client`);
+            }
+            if (context && context.issuer !== configured.issuer) {
+                throw new Error(`MCP server "${this.options.serverId}" discovered a different OAuth issuer; reconfigure its client credentials`);
+            }
             return {
+                issuer: configured.issuer,
                 client_id: configured.clientId,
                 ...(configured.clientSecret ? { client_secret: configured.clientSecret } : {}),
             };
@@ -106,7 +145,13 @@ export class McpOAuthProvider {
         });
     }
     async tokens() {
-        return (await this.read()).tokens;
+        if (this.options.config?.clientId)
+            await this.clientInformation();
+        const record = await this.read();
+        const tokens = record.tokens;
+        if (this.options.config?.issuer && tokens?.issuer !== this.options.config.issuer)
+            return undefined;
+        return tokens;
     }
     async saveTokens(tokens) {
         await this.mutate((record) => {
@@ -148,9 +193,7 @@ export class McpOAuthProvider {
             // A dynamically registered client belongs to the authorization server
             // that issued it. When discovery moves the resource to a DIFFERENT
             // authorization server, carrying the old registration over would send
-            // one AS's client credentials (and any secret) to another. Static
-            // config-supplied clients are unaffected — they never live in the
-            // record.
+            // one AS's client credentials (and any secret) to another.
             const previousIssuer = record.discovery?.authorizationServerUrl;
             const nextIssuer = state.authorizationServerUrl;
             if (previousIssuer && nextIssuer && `${previousIssuer}` !== `${nextIssuer}`) {
@@ -217,7 +260,8 @@ export class McpOAuthProvider {
             record.pendingRedirectUrl ||
             record.pendingServerUrl ||
             record.pendingState;
-        return Boolean(boundable) && record.serverUrl !== this.options.serverUrl;
+        return (Boolean(boundable) &&
+            !mcpOAuthRecordBoundTo(record, this.options.serverUrl, this.options.config));
     }
     /** The same fail-closed binding rule as read(), applied to a mutation
      * basis: a record bound elsewhere contributes NOTHING to the new write —
@@ -239,6 +283,10 @@ export class McpOAuthProvider {
         const stamp = (record) => {
             apply(record);
             record.serverUrl = this.options.serverUrl;
+            if (this.clientConfigHash)
+                record.clientConfigHash = this.clientConfigHash;
+            else
+                delete record.clientConfigHash;
             return record;
         };
         // The coordinator-provided storage view makes read-apply-write one

package/node_modules/@maka/runtime/dist/agent-run-inspect.js

@@ -38,7 +38,7 @@ export async function inspectAgentRunReadModel(runStore, runtimeEventStore, opti
             diagnostics.push(inspectDiagnostic(invocation, 'runtime_terminal_missing', 'runtime ledger has no complete terminal RuntimeEvent fact'));
         }
     }
-    const projection = runtimeEvents.length > 0
+    const projection = runtimeEvents.length > 0 && options.includeProjection !== false
         ? projectRuntimeEventsToStoredMessages(runtimeEvents, { invocations: [invocation] })
         : undefined;
     if (projection) {

package/node_modules/@maka/runtime/dist/conversation-copy.js

@@ -23,6 +23,7 @@ import { decodePersistedToolResultContent } from '@maka/core/tool-result-record-
 import { isEmittedAgentRunEventType } from '@maka/core/agent-run';
 import { decodeModelCallAttempt, MODEL_CALL_ATTEMPT_EVENT_TYPE, } from '@maka/core/model-call-attempt';
 import { TOOL_RECOVERY_DECISION_FACT_KIND } from '@maka/core/tool-recovery-fact';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import { buildHistoryCompactCheckpoint, historyCompactSourceDigest, matchHistoryCompactCheckpointPrefix, validateHistoryCompactCheckpointShape, } from './history-compact-checkpoint.js';
 import { findCheckpointSummaryDefect } from './history-compact-summary-validation.js';
 import { isHistoryCompactContentEvent } from './history-compaction.js';
@@ -281,6 +282,20 @@ function assertConversationRuntimeLedgerCopySupported(run, runtimeEvents) {
     error.code = 'branch_runtime_fact_rewrite_unsupported';
     throw error;
 }
+/**
+ * Mirrors the T1 scanner's identity semantics: a call whose args are not
+ * strict JSON cannot authenticate, which the scanner surfaces as a
+ * `canonical_args_hash_conflict` rather than an exception — so the copy pass
+ * must see `undefined` there, not a thrown error.
+ */
+const tryCanonicalToolArgsHash = (toolName, args) => {
+    try {
+        return canonicalToolArgsHash(toolName, args);
+    }
+    catch {
+        return undefined;
+    }
+};
 export async function cloneConversationRuntimeLedger(input) {
     if (input.plan.sourceSessionId !== input.referenceMap.sourceSessionId) {
         throw new Error('Conversation copy plan does not belong to the source Session');
@@ -386,10 +401,22 @@ export async function cloneConversationRuntimeLedger(input) {
     };
     for (const sourceId of clonedEventBySourceId.keys())
         finishTarget(sourceId);
+    // The identity rewrite changes a copied call's canonical args, so the paired
+    // dispatch's recorded hash stops authenticating them and the copied ledger
+    // fails its own T1 re-scan. Collect the source and rewritten identities per
+    // (invocation, tool call) and re-authenticate the dispatches after the
+    // rewrite pass — but only when the source dispatch actually authenticated
+    // the source call. Stamping the rewritten identity over a mismatched hash
+    // would launder an already-corrupt source ledger into a valid-looking copy
+    // instead of preserving the corruption for the re-scan to reject (#5466
+    // review). Identity derivation mirrors the scanner's semantics: args that
+    // are not strict JSON cannot authenticate at all.
+    const rewrittenArgsIdentities = new Map();
     for (const event of clonedEventBySourceId.values()) {
         if (event.content?.kind === 'function_call' && event.content.name === 'Read') {
             const args = event.content.args;
-            if (args && typeof args === 'object' && 'path' in args && typeof args.path === 'string')
+            if (args && typeof args === 'object' && 'path' in args && typeof args.path === 'string') {
+                const sourceArgsHash = tryCanonicalToolArgsHash(event.content.name, args);
                 event.content = {
                     ...event.content,
                     args: {
@@ -397,19 +424,47 @@ export async function cloneConversationRuntimeLedger(input) {
                         ...rewriteReadInput(args, references, clonedEventBySourceId),
                     },
                 };
+                rewrittenArgsIdentities.set(`${event.invocationId}\u0000${event.content.id}`, {
+                    sourceArgsHash,
+                    rewrittenArgsHash: tryCanonicalToolArgsHash(event.content.name, event.content.args),
+                });
+            }
         }
         if (event.content?.kind === 'text')
             event.content.text = rewriteCopiedText(event.content.text, references, clonedEventBySourceId);
         if (event.content?.kind === 'function_call' && event.content.name === 'ArchiveRead') {
             const args = event.content.args;
             if (args && typeof args === 'object' && 'ref' in args && typeof args.ref === 'string') {
+                const sourceArgsHash = tryCanonicalToolArgsHash(event.content.name, args);
                 event.content = {
                     ...event.content,
                     args: { ...args, ref: rewriteLedgerArchiveText(args.ref, references) },
                 };
+                rewrittenArgsIdentities.set(`${event.invocationId}\u0000${event.content.id}`, {
+                    sourceArgsHash,
+                    rewrittenArgsHash: tryCanonicalToolArgsHash(event.content.name, event.content.args),
+                });
             }
         }
     }
+    if (rewrittenArgsIdentities.size > 0) {
+        for (const event of clonedEventBySourceId.values()) {
+            const dispatch = event.actions?.toolDispatch;
+            if (dispatch?.canonicalArgsHash === undefined)
+                continue;
+            const identity = rewrittenArgsIdentities.get(`${event.invocationId}\u0000${dispatch.providerToolCallId}`);
+            if (identity === undefined)
+                continue;
+            if (identity.sourceArgsHash !== dispatch.canonicalArgsHash)
+                continue;
+            if (identity.rewrittenArgsHash === undefined)
+                continue;
+            event.actions = {
+                ...event.actions,
+                toolDispatch: { ...dispatch, canonicalArgsHash: identity.rewrittenArgsHash },
+            };
+        }
+    }
     const preparedPlans = flattenedPlans.map((plan) => {
         const runId = runIds.get(plan.run.runId);
         const clonedOperationalEvents = plan.operationalEvents.flatMap((event) => {

package/node_modules/@maka/runtime/dist/mcp-tools.js

@@ -136,13 +136,20 @@ function mcpToolDescription(descriptor) {
 }
 export function mcpProxyToolName(serverId, toolName) {
     const raw = `mcp__${sanitizeNamePart(serverId)}__${sanitizeNamePart(toolName)}`;
-    if (raw.length <= MAX_PROVIDER_TOOL_NAME)
+    // Preserve existing simple names; hash identities whose spelling or separators are ambiguous.
+    if (raw.length <= MAX_PROVIDER_TOOL_NAME &&
+        sanitizeNamePart(serverId) === serverId &&
+        sanitizeNamePart(toolName) === toolName &&
+        !serverId.includes('__') &&
+        !toolName.includes('__'))
         return raw;
     const hash = createHash('sha256')
         .update(`${serverId}\0${toolName}`)
         .digest('hex')
         .slice(0, HASH_CHARS);
-    return `${raw.slice(0, MAX_PROVIDER_TOOL_NAME - HASH_CHARS - 2)}__${hash}`;
+    // A truncated name must not become another identity's unmodified name.
+    const hashed = `mcp_h__${sanitizeNamePart(serverId)}__${sanitizeNamePart(toolName)}`;
+    return `${hashed.slice(0, MAX_PROVIDER_TOOL_NAME - HASH_CHARS - 2)}__${hash}`;
 }
 function sanitizeNamePart(value) {
     const sanitized = value

package/node_modules/@maka/runtime/dist/plugin-executor-backend.js

@@ -17,12 +17,14 @@
  * under the License.
  */
 import { randomUUID } from 'node:crypto';
+import { redactSecrets } from '@maka/core/redaction';
 import { AsyncEventQueue } from './async-queue.js';
 /** Converts a small plugin executor contract into Maka's existing Run event stream. */
 export class PluginExecutorBackend {
     kind = 'plugin-executor';
     sessionId;
     #cwd;
+    #configuration;
     #instructions;
     #model;
     #thinkingLevel;
@@ -34,6 +36,7 @@ export class PluginExecutorBackend {
     constructor(input) {
         this.sessionId = input.sessionId;
         this.#cwd = input.cwd;
+        this.#configuration = input.configuration;
         this.#instructions = input.instructions;
         this.#model = input.model;
         this.#thinkingLevel = input.thinkingLevel;
@@ -86,6 +89,7 @@ export class PluginExecutorBackend {
         const turnId = input.turnId;
         let thinkingText = '';
         const toolUseIds = new Map();
+        const toolOutputSequences = new Map();
         let result;
         let failure;
         let failed = false;
@@ -99,6 +103,7 @@ export class PluginExecutorBackend {
                 cwd: this.#cwd,
                 ...(this.#model ? { model: this.#model } : {}),
                 reasoningEffort: this.#thinkingLevel ?? null,
+                ...(this.#configuration ? { configuration: this.#configuration } : {}),
                 ...(this.#instructions ? { instructions: this.#instructions } : {}),
                 ...(input.attachments ? { attachments: input.attachments } : {}),
                 ...(input.directoryReferences ? { directoryReferences: input.directoryReferences } : {}),
@@ -108,8 +113,9 @@ export class PluginExecutorBackend {
                 onEvent: (event) => {
                     if (event.type === 'thinking_delta')
                         thinkingText += event.text;
-                    this.#publishOutputEvent(turnId, messageId, event, toolUseIds, queue);
+                    this.#publishOutputEvent(turnId, messageId, event, toolUseIds, toolOutputSequences, queue);
                 },
+                onPermissionRequest: (request) => this.#requestPermission(input, request, signal, toolUseIds, queue),
             });
         }
         catch (error) {
@@ -130,6 +136,81 @@ export class PluginExecutorBackend {
         }
         this.#publishResult(turnId, messageId, result, queue);
     }
+    async #requestPermission(input, request, signal, toolUseIds, queue) {
+        const hosted = input.hostedInteraction;
+        if (!hosted || signal.aborted)
+            return { outcome: 'cancelled' };
+        const requestId = this.#newId();
+        const event = {
+            type: 'form_request',
+            id: this.#newId(),
+            turnId: input.turnId,
+            ts: this.#now(),
+            requestId,
+            toolUseId: toolUseIds.get(request.toolCallId) ?? request.toolCallId,
+            message: request.title,
+            requester: {
+                name: this.#binding.identity.displayName,
+                source: this.#binding.identity.extensionId,
+            },
+            fields: [
+                {
+                    kind: 'single_select',
+                    name: 'optionId',
+                    label: request.kind === 'question' ? 'Question' : 'Permission',
+                    required: true,
+                    options: request.options.map((option) => ({
+                        value: option.optionId,
+                        label: option.name,
+                    })),
+                },
+            ],
+        };
+        let settle;
+        const answer = new Promise((resolve) => {
+            settle = resolve;
+        });
+        let settled = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            settle(result);
+        };
+        const settlement = {
+            applyAnswer: async (result) => {
+                if (result.action !== 'accept')
+                    return finish({ outcome: 'cancelled' });
+                const selected = result.values.optionId;
+                if (typeof selected !== 'string' ||
+                    !request.options.some((option) => option.optionId === selected)) {
+                    return finish({ outcome: 'cancelled' });
+                }
+                finish({ outcome: 'selected', optionId: selected });
+            },
+            applyClosure: async () => finish({ outcome: 'cancelled' }),
+        };
+        let admission;
+        const onAbort = () => {
+            finish({ outcome: 'cancelled' });
+            void Promise.resolve().then(async () => {
+                await admission?.catch(() => undefined);
+                await hosted.withdrawFormRequest(requestId).catch(() => undefined);
+            });
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        try {
+            admission = hosted.admitFormRequest({ request: event, settlement });
+            await admission;
+            if (signal.aborted)
+                return { outcome: 'cancelled' };
+            queue.push(event);
+            return await answer;
+        }
+        finally {
+            signal.removeEventListener('abort', onAbort);
+        }
+    }
     #closeOptionalOutput(turnId, messageId, thinkingText, toolUseIds, queue) {
         if (thinkingText) {
             queue.push({
@@ -194,9 +275,10 @@ export class PluginExecutorBackend {
             turnId,
             ts: this.#now(),
             stopReason: 'user_stop',
+            ...(result.providerStopReason ? { providerStopReason: result.providerStopReason } : {}),
         });
     }
-    #publishOutputEvent(turnId, messageId, event, toolUseIds, queue) {
+    #publishOutputEvent(turnId, messageId, event, toolUseIds, toolOutputSequences, queue) {
         if (event.type === 'output_delta') {
             if (!event.text)
                 return;
@@ -239,6 +321,7 @@ export class PluginExecutorBackend {
             }
             const toolUseId = this.#newId();
             toolUseIds.set(event.toolCallId, toolUseId);
+            toolOutputSequences.set(event.toolCallId, 0);
             queue.push({
                 type: 'tool_start',
                 id: this.#newId(),
@@ -257,6 +340,31 @@ export class PluginExecutorBackend {
         const toolUseId = toolUseIds.get(event.toolCallId);
         if (!toolUseId)
             return;
+        if (event.type === 'tool_output_delta') {
+            if (!event.text)
+                return;
+            const chunk = redactSecrets(event.text);
+            if (!chunk)
+                return;
+            const now = this.#now();
+            const seq = (toolOutputSequences.get(event.toolCallId) ?? 0) + 1;
+            toolOutputSequences.set(event.toolCallId, seq);
+            queue.push({
+                type: 'tool_output_delta',
+                id: this.#newId(),
+                sessionId: this.sessionId,
+                turnId,
+                ts: now,
+                toolCallId: toolUseId,
+                toolUseId,
+                seq,
+                stream: event.stream ?? 'stdout',
+                chunk,
+                redacted: chunk !== event.text,
+                createdAt: now,
+            });
+            return;
+        }
         if (event.type === 'tool_progress') {
             if (!event.text)
                 return;
@@ -271,6 +379,7 @@ export class PluginExecutorBackend {
             return;
         }
         toolUseIds.delete(event.toolCallId);
+        toolOutputSequences.delete(event.toolCallId);
         queue.push({
             type: 'tool_result',
             id: this.#newId(),
@@ -279,7 +388,9 @@ export class PluginExecutorBackend {
             toolUseId,
             providerExecuted: true,
             isError: event.isError ?? false,
-            content: { kind: 'text', text: event.text },
+            content: event.content.kind === 'text'
+                ? event.content
+                : { kind: 'file_diff', paths: [...event.content.paths], diff: event.content.diff },
         });
     }
     #publishFailure(turnId, message, code, recoverable, queue) {
@@ -311,6 +422,8 @@ function cancellationEventReason(result) {
         return 'redirect';
     if (result.reason === 'timeout')
         return 'timeout';
+    if (result.reason === 'crash')
+        return 'crash';
     if (result.source === 'executor_retired')
         return 'crash';
     return 'user_stop';