minimal-agent 0.18.9 → 0.18.11

package/src/loop/toolExecutor.js

@@ -0,0 +1,304 @@
+import { dirname, resolve } from 'node:path';
+import { countTextTokens } from '../context/tokenCounter.js';
+import { loadProjectPromptInstructions } from '../prompts/projectInstructions.js';
+import { acquireSubagentLease, normalizeWriteScopes } from '../tools/agent/coordinator.js';
+import { isReadOnlyShellCommand } from '../tools/bash/semantics.js';
+import { capabilityForToolName } from '../tools/capabilities.js';
+import { getToolGateDetails } from '../tools/index.js';
+import { resolveToolPath } from '../tools/shared/fileUtils.js';
+import { advisorSemanticsFor } from './toolSemantics.js';
+/** One batch's execution boundary. Scheduling and history writes belong to callers. */
+export function createToolExecutor(input) {
+    const { options, runtimeContext, toolCallContext, currentEffectiveToolSet, advisorCoordinator, stallGuard, modelEnvironmentCwd, observedRuleScopes, pendingRuleScopes, currentUserMessageId, executeToolFn, } = input;
+    const { signal, sessionState } = options;
+    // Convert tool execution failures/aborts into results; host hook failures are
+    // not a successful tool outcome and may propagate to the batch boundary.
+    const failureReviews = [];
+    const runOneImpl = async (tc, reportProgress, advisorConsultation) => {
+        let started = false;
+        try {
+            const handoff = options.agentHandoff?.current();
+            if (handoff && handoff.kind !== 'help')
+                return {
+                    tc,
+                    result: {
+                        ok: false,
+                        disposition: 'deferred',
+                        error: '子任务已经提交交接，本批后续调用未执行',
+                    },
+                };
+            if (signal?.aborted || options.hasQueuedInput?.()) {
+                return {
+                    tc,
+                    result: { ok: false, disposition: 'deferred', error: 'aborted' },
+                };
+            }
+            const advisorAvailable = currentEffectiveToolSet.names.has('Advisor');
+            if (!advisorAvailable && stallGuard.shouldReject(tc)) {
+                return {
+                    tc,
+                    result: {
+                        ok: false,
+                        disposition: 'deferred',
+                        error: '检测到同一工具和参数已连续两次返回相同失败；第三次调用已在执行前拒绝，请改变输入或改用其他路径。',
+                        recovery: 'change-input',
+                        sensitivity: 'public',
+                    },
+                };
+            }
+            // The model-visible catalog and the execution boundary are the same set.
+            // A provider may still emit a stale or fabricated tool call; return a
+            // recoverable result so the model can choose an available path.
+            if (!currentEffectiveToolSet.names.has(tc.function.name)) {
+                const boundary = options.toolBoundaryLabel ?? '当前宿主授权';
+                const visible = [...currentEffectiveToolSet.names];
+                const availableHint = visible.length
+                    ? `（可用：${visible.slice(0, 12).join('、')}${visible.length > 12 ? '…' : ''}）`
+                    : '（本轮没有可用工具）';
+                const deniedReason = tc.function.name === 'Agent'
+                    ? '当前上下文不允许调用 Agent；请直接完成子任务或改用已提供的工具'
+                    : `工具 ${tc.function.name} 不在${boundary}的有效工具集中${availableHint}，请改用已提供的工具继续任务`;
+                return {
+                    tc,
+                    result: {
+                        ok: false,
+                        error: deniedReason,
+                        recovery: 'change-input',
+                        sensitivity: 'public',
+                    },
+                };
+            }
+            const checkpoint = options.advisorCheckpoints === false
+                ? { allow: true }
+                : advisorCoordinator.beforeTool(tc, {
+                    ...advisorSemanticsFor(tc, toolCallContext, currentEffectiveToolSet.tools.find((tool) => tool.name === tc.function.name), { treatVerificationAsReadOnly: true }),
+                    retriesFailure: stallGuard.shouldReject(tc),
+                });
+            if (!checkpoint.allow) {
+                return { tc, result: checkpoint.deferred };
+            }
+            // 工具执行闸门：宿主注入后覆盖所有工具，包括只读工具。deny → 把 reason 当
+            // tool_result 回填，模型据此改道/如实报告，不抛异常不中断整轮。宿主异常一律 deny。
+            // Keep the host gate's side-effect classification identical to the
+            // Advisor classification. Shell tools are generic in their schema but
+            // individual commands can be deterministic read-only diagnostics.
+            let isReadOnly = currentEffectiveToolSet.tools.find((tool) => tool.name === tc.function.name)?.isReadOnly === true;
+            if (tc.function.name === 'Bash' || tc.function.name === 'PowerShell') {
+                try {
+                    const input = JSON.parse(tc.function.arguments || '{}');
+                    if (typeof input.command === 'string')
+                        isReadOnly = isReadOnlyShellCommand(input.command);
+                }
+                catch {
+                    isReadOnly = false;
+                }
+            }
+            const effectiveToolGate = runtimeContext.toolGate ?? options.toolGate;
+            if (effectiveToolGate) {
+                let decision;
+                try {
+                    const gateDetails = getToolGateDetails(tc.function.name, tc.function.arguments, {
+                        ...toolCallContext,
+                        cwd: sessionState?.activeWorktree?.path ?? toolCallContext.cwd,
+                        toolCallId: tc.id,
+                        reportProgress,
+                    });
+                    decision = await effectiveToolGate({
+                        name: tc.function.name,
+                        argsJson: tc.function.arguments,
+                        isReadOnly,
+                        toolCallId: tc.id,
+                        ...gateDetails,
+                    }, signal);
+                }
+                catch {
+                    decision = {
+                        allow: false,
+                        reason: '工具执行审批失败（宿主异常）',
+                    };
+                }
+                if (!decision.allow) {
+                    return { tc, result: { ok: false, error: decision.reason } };
+                }
+            }
+            if (signal?.aborted || options.hasQueuedInput?.()) {
+                return {
+                    tc,
+                    result: { ok: false, disposition: 'deferred', error: 'aborted' },
+                };
+            }
+            // 浅拷贝填入本次调用的 toolCallId：进度按调用实例路由（并行同名工具不串扰）。
+            // advisorCalls/agentCalls 是共享对象引用，计数仍全轮共享，不受拷贝影响。
+            const executionCwd = sessionState?.activeWorktree?.path ?? toolCallContext.cwd;
+            if (executionCwd !== modelEnvironmentCwd)
+                return {
+                    tc,
+                    result: {
+                        ok: false,
+                        disposition: 'deferred',
+                        error: '执行环境已改变，本批调用依据旧目录生成，尚未执行。请等待刷新环境和项目规则后重新生成调用。',
+                    },
+                };
+            // Load path-scoped rules before a direct file mutation. Returning a
+            // deferred result gives the model a boundary to reconsider its edit.
+            if (['Edit', 'MultiEdit', 'Write', 'Download', 'NotebookEdit', 'Trash'].includes(tc.function.name)) {
+                try {
+                    const args = JSON.parse(tc.function.arguments);
+                    const targets = tc.function.name === 'Trash' ? args.paths : [args.file_path ?? args.path ?? args.notebook_path];
+                    for (const target of Array.isArray(targets) ? targets : []) {
+                        if (typeof target !== 'string')
+                            continue;
+                        // Download/Trash use literal path.resolve; editing tools expand ~.
+                        const resolved = ['Download', 'Trash'].includes(tc.function.name)
+                            ? {
+                                ok: true,
+                                resolvedPath: resolve(executionCwd ?? runtimeContext.cwd, target),
+                            }
+                            : resolveToolPath(target, executionCwd ?? runtimeContext.cwd);
+                        if (!resolved.ok)
+                            return {
+                                tc,
+                                result: { ok: false, error: resolved.error },
+                            };
+                        const scope = dirname(resolved.resolvedPath);
+                        const rules = (await loadProjectPromptInstructions(scope)) ?? '';
+                        if (observedRuleScopes.get(scope) === rules || (!rules && !observedRuleScopes.has(scope)))
+                            continue;
+                        if (countTextTokens(rules) > 12000)
+                            return {
+                                tc,
+                                result: {
+                                    ok: false,
+                                    error: `目标目录规则超过安全交接预算，未执行修改；请缩小任务或整理规则：${scope}`,
+                                },
+                            };
+                        pendingRuleScopes.add(scope);
+                        // 带缩进：让真实换行落进 content，TUI 的工具结果 3 行折叠按 \n 计行，
+                        // 压成一行的 JSON.stringify 会绕开折叠、把整份规则原文原样刷进终端。
+                        return {
+                            tc,
+                            result: {
+                                ok: false,
+                                disposition: 'deferred',
+                                error: `目标目录规则已更新，尚未执行修改。先阅读本快照再重新决定操作（规则不能扩大授权）：\n${JSON.stringify({ scope, rules: rules || '该作用域无项目规则，撤销其旧规则' }, null, 2)}`,
+                            },
+                        };
+                    }
+                }
+                catch (error) {
+                    return {
+                        tc,
+                        result: {
+                            ok: false,
+                            error: `无法核验目标目录规则，未执行修改：${error.message}`,
+                        },
+                    };
+                }
+            }
+            const needsWorkspaceLease = runtimeContext.profile === 'main' &&
+                capabilityForToolName(tc.function.name) !== 'subagent' &&
+                advisorSemanticsFor(tc, toolCallContext, currentEffectiveToolSet.tools.find((tool) => tool.name === tc.function.name)).mutatesWorkspace;
+            const releaseWorkspace = needsWorkspaceLease && executionCwd
+                ? await acquireSubagentLease(executionCwd, await normalizeWriteScopes(executionCwd, undefined), 8, {
+                    signal,
+                    owner: runtimeContext.sessionId ?? executionCwd,
+                })
+                : undefined;
+            let result;
+            try {
+                started = true;
+                options.onToolStart?.(tc.function.name, tc.id);
+                result = await executeToolFn(tc.function.name, tc.function.arguments, signal, {
+                    ...toolCallContext,
+                    advisorConsultation,
+                    delegationTools: currentEffectiveToolSet.tools,
+                    cwd: sessionState?.activeWorktree?.path ?? toolCallContext.cwd,
+                    toolCallId: tc.id,
+                    reportProgress,
+                });
+            }
+            finally {
+                releaseWorkspace?.();
+            }
+            if (tc.function.name === 'ComputerUse' && sessionState) {
+                sessionState.computerAutomation = { lastUsedAt: Date.now() };
+            }
+            const downloadableArtifact = result.ok && result.metadata?.kind === 'browser_download' ? result.metadata.artifact : undefined;
+            const formalManifest = result.ok && result.metadata?.kind === 'result_manifest' ? result.metadata.manifest : downloadableArtifact;
+            if (formalManifest &&
+                (tc.function.name === 'PresentResult' || downloadableArtifact) &&
+                options.commitFormalDelivery) {
+                try {
+                    await options.commitFormalDelivery({
+                        toolCallId: tc.id,
+                        turnId: currentUserMessageId,
+                        manifest: formalManifest,
+                    });
+                }
+                catch (error) {
+                    result = {
+                        ok: false,
+                        error: `正式交付未能可靠保存：${error.message}`,
+                        recovery: 'retry',
+                        sensitivity: 'local',
+                    };
+                }
+            }
+            if (tc.function.name === 'Advisor' || tc.function.name === 'AdvisorDecision') {
+                // 串行批次内下一项可能就是 AdvisorDecision/受保护写入，必须立即推进协调器状态。
+                advisorCoordinator.observeToolResult(tc, result);
+            }
+            started = false;
+            options.onToolEnd?.(tc.id, false);
+            return { tc, result };
+        }
+        catch (e) {
+            const wasAborted = e.name === 'AbortError';
+            if (started)
+                options.onToolEnd?.(tc.id, wasAborted);
+            if (wasAborted) {
+                return { tc, result: { ok: false, error: 'aborted' } };
+            }
+            return {
+                tc,
+                result: { ok: false, error: e.message },
+            };
+        }
+    };
+    const runOne = async (tc, reportProgress) => {
+        // Also settle denied/invalid/unavailable calls that never reached the
+        // provider adapter. This records a real attempt, not an ignored reminder.
+        let consultation;
+        if (tc.function.name === 'Advisor') {
+            let reason;
+            try {
+                reason = JSON.parse(tc.function.arguments).reason;
+            }
+            catch {
+                /* validation handles malformed input */
+            }
+            consultation = advisorCoordinator.beginConsultation(reason);
+        }
+        const outcome = await runOneImpl(tc, reportProgress, consultation);
+        if (consultation &&
+            outcome.result.metadata?.kind !== 'advisor_consultation' &&
+            !(!outcome.result.ok && outcome.result.error === 'aborted')) {
+            outcome.result = {
+                ...outcome.result,
+                metadata: advisorCoordinator.finishConsultation(consultation, outcome.result.ok),
+            };
+        }
+        const metadata = outcome.result.metadata;
+        if ((metadata?.kind === 'advisor_decision' && outcome.result.ok) || metadata?.kind === 'advisor_consultation') {
+            if (metadata.checkpoint === 'stalled')
+                stallGuard.completeReview(metadata.checkpointKey.split(':').at(-1));
+        }
+        const failure = stallGuard.observeAttempt(tc, outcome.result);
+        if (failure.stalled && failure.signature) {
+            failureReviews.push(failure);
+            advisorCoordinator.requireFailureReview(failure.signature, failure.attempts ?? []);
+        }
+        return outcome;
+    };
+    return { runOne, failureReviews };
+}

package/src/loop/toolExecutor.ts

@@ -0,0 +1,363 @@
+import { dirname, resolve } from 'node:path';
+import type { AdvisorCoordinator } from '../advisor/advisorCoordinator.js';
+import { countTextTokens } from '../context/tokenCounter.js';
+import { StallGuard, type StallObservation } from '../harness/stallGuard.js';
+import { loadProjectPromptInstructions } from '../prompts/projectInstructions.js';
+import type { AgentRuntimeContext } from '../runtime/agentRuntimeContext.js';
+import { acquireSubagentLease, normalizeWriteScopes } from '../tools/agent/coordinator.js';
+import { isReadOnlyShellCommand } from '../tools/bash/semantics.js';
+import { capabilityForToolName } from '../tools/capabilities.js';
+import type { EffectiveToolSet } from '../tools/effectiveToolSet.js';
+import { getToolGateDetails } from '../tools/index.js';
+import { resolveToolPath } from '../tools/shared/fileUtils.js';
+import type { ToolCall, ToolCallContext, ToolResult } from '../types.js';
+import type { RunQueryOptions } from './options.js';
+import { advisorSemanticsFor } from './toolSemantics.js';
+export type WorkerOutcome = {
+  tc: ToolCall;
+  result: ToolResult;
+};
+
+interface ToolExecutorInput {
+  options: Pick<RunQueryOptions,
+    'signal' | 'sessionState' | 'agentHandoff' | 'hasQueuedInput' |
+    'advisorCheckpoints' | 'toolBoundaryLabel' | 'toolGate' |
+    'onToolStart' | 'onToolEnd' | 'commitFormalDelivery'>;
+  runtimeContext: AgentRuntimeContext;
+  toolCallContext: ToolCallContext;
+  currentEffectiveToolSet: EffectiveToolSet;
+  advisorCoordinator: AdvisorCoordinator;
+  stallGuard: StallGuard;
+  modelEnvironmentCwd: string;
+  observedRuleScopes: Map<string, string>;
+  pendingRuleScopes: Set<string>;
+  currentUserMessageId: string;
+  executeToolFn: NonNullable<RunQueryOptions['executeTool']>;
+}
+/** One batch's execution boundary. Scheduling and history writes belong to callers. */
+export function createToolExecutor(input: ToolExecutorInput) {
+  const {
+    options,
+    runtimeContext,
+    toolCallContext,
+    currentEffectiveToolSet,
+    advisorCoordinator,
+    stallGuard,
+    modelEnvironmentCwd,
+    observedRuleScopes,
+    pendingRuleScopes,
+    currentUserMessageId,
+    executeToolFn,
+  } = input;
+  const { signal, sessionState } = options;
+  // Convert tool execution failures/aborts into results; host hook failures are
+  // not a successful tool outcome and may propagate to the batch boundary.
+  const failureReviews: StallObservation[] = [];
+  const runOneImpl = async (
+    tc: ToolCall,
+    reportProgress?: (message: string, detail?: import('../types.js').ToolProgressDetail) => void,
+    advisorConsultation?: import('../types.js').AdvisorConsultationMetadata,
+  ): Promise<WorkerOutcome> => {
+    let started = false;
+    try {
+      const handoff = options.agentHandoff?.current();
+      if (handoff && handoff.kind !== 'help')
+        return {
+          tc,
+          result: {
+            ok: false,
+            disposition: 'deferred',
+            error: '子任务已经提交交接，本批后续调用未执行',
+          },
+        };
+      if (signal?.aborted || options.hasQueuedInput?.()) {
+        return {
+          tc,
+          result: { ok: false, disposition: 'deferred', error: 'aborted' },
+        };
+      }
+      const advisorAvailable = currentEffectiveToolSet.names.has('Advisor');
+      if (!advisorAvailable && stallGuard.shouldReject(tc)) {
+        return {
+          tc,
+          result: {
+            ok: false as const,
+            disposition: 'deferred',
+            error: '检测到同一工具和参数已连续两次返回相同失败；第三次调用已在执行前拒绝，请改变输入或改用其他路径。',
+            recovery: 'change-input',
+            sensitivity: 'public',
+          },
+        };
+      }
+      // The model-visible catalog and the execution boundary are the same set.
+      // A provider may still emit a stale or fabricated tool call; return a
+      // recoverable result so the model can choose an available path.
+      if (!currentEffectiveToolSet.names.has(tc.function.name)) {
+        const boundary = options.toolBoundaryLabel ?? '当前宿主授权';
+        const visible = [...currentEffectiveToolSet.names];
+        const availableHint = visible.length
+          ? `（可用：${visible.slice(0, 12).join('、')}${visible.length > 12 ? '…' : ''}）`
+          : '（本轮没有可用工具）';
+        const deniedReason =
+          tc.function.name === 'Agent'
+            ? '当前上下文不允许调用 Agent；请直接完成子任务或改用已提供的工具'
+            : `工具 ${tc.function.name} 不在${boundary}的有效工具集中${availableHint}，请改用已提供的工具继续任务`;
+        return {
+          tc,
+          result: {
+            ok: false as const,
+            error: deniedReason,
+            recovery: 'change-input',
+            sensitivity: 'public',
+          },
+        };
+      }
+      const checkpoint =
+        options.advisorCheckpoints === false
+          ? { allow: true as const }
+          : advisorCoordinator.beforeTool(tc, {
+              ...advisorSemanticsFor(
+                tc,
+                toolCallContext,
+                currentEffectiveToolSet.tools.find((tool) => tool.name === tc.function.name),
+                { treatVerificationAsReadOnly: true },
+              ),
+              retriesFailure: stallGuard.shouldReject(tc),
+            });
+      if (!checkpoint.allow) {
+        return { tc, result: checkpoint.deferred! };
+      }
+      // 工具执行闸门：宿主注入后覆盖所有工具，包括只读工具。deny → 把 reason 当
+      // tool_result 回填，模型据此改道/如实报告，不抛异常不中断整轮。宿主异常一律 deny。
+      // Keep the host gate's side-effect classification identical to the
+      // Advisor classification. Shell tools are generic in their schema but
+      // individual commands can be deterministic read-only diagnostics.
+      let isReadOnly =
+        currentEffectiveToolSet.tools.find((tool) => tool.name === tc.function.name)?.isReadOnly === true;
+      if (tc.function.name === 'Bash' || tc.function.name === 'PowerShell') {
+        try {
+          const input = JSON.parse(tc.function.arguments || '{}') as {
+            command?: unknown;
+          };
+          if (typeof input.command === 'string') isReadOnly = isReadOnlyShellCommand(input.command);
+        } catch {
+          isReadOnly = false;
+        }
+      }
+      const effectiveToolGate = runtimeContext.toolGate ?? options.toolGate;
+      if (effectiveToolGate) {
+        let decision;
+        try {
+          const gateDetails = getToolGateDetails(tc.function.name, tc.function.arguments, {
+            ...toolCallContext,
+            cwd: sessionState?.activeWorktree?.path ?? toolCallContext.cwd,
+            toolCallId: tc.id,
+            reportProgress,
+          });
+          decision = await effectiveToolGate(
+            {
+              name: tc.function.name,
+              argsJson: tc.function.arguments,
+              isReadOnly,
+              toolCallId: tc.id,
+              ...gateDetails,
+            },
+            signal,
+          );
+        } catch {
+          decision = {
+            allow: false as const,
+            reason: '工具执行审批失败（宿主异常）',
+          };
+        }
+        if (!decision.allow) {
+          return { tc, result: { ok: false as const, error: decision.reason } };
+        }
+      }
+      if (signal?.aborted || options.hasQueuedInput?.()) {
+        return {
+          tc,
+          result: { ok: false, disposition: 'deferred', error: 'aborted' },
+        };
+      }
+      // 浅拷贝填入本次调用的 toolCallId：进度按调用实例路由（并行同名工具不串扰）。
+      // advisorCalls/agentCalls 是共享对象引用，计数仍全轮共享，不受拷贝影响。
+      const executionCwd = sessionState?.activeWorktree?.path ?? toolCallContext.cwd;
+      if (executionCwd !== modelEnvironmentCwd)
+        return {
+          tc,
+          result: {
+            ok: false as const,
+            disposition: 'deferred' as const,
+            error: '执行环境已改变，本批调用依据旧目录生成，尚未执行。请等待刷新环境和项目规则后重新生成调用。',
+          },
+        };
+      // Load path-scoped rules before a direct file mutation. Returning a
+      // deferred result gives the model a boundary to reconsider its edit.
+      if (['Edit', 'MultiEdit', 'Write', 'Download', 'NotebookEdit', 'Trash'].includes(tc.function.name)) {
+        try {
+          const args = JSON.parse(tc.function.arguments);
+          const targets =
+            tc.function.name === 'Trash' ? args.paths : [args.file_path ?? args.path ?? args.notebook_path];
+          for (const target of Array.isArray(targets) ? targets : []) {
+            if (typeof target !== 'string') continue;
+            // Download/Trash use literal path.resolve; editing tools expand ~.
+            const resolved = ['Download', 'Trash'].includes(tc.function.name)
+              ? {
+                  ok: true as const,
+                  resolvedPath: resolve(executionCwd ?? runtimeContext.cwd, target),
+                }
+              : resolveToolPath(target, executionCwd ?? runtimeContext.cwd);
+            if (!resolved.ok)
+              return {
+                tc,
+                result: { ok: false as const, error: resolved.error },
+              };
+            const scope = dirname(resolved.resolvedPath);
+            const rules = (await loadProjectPromptInstructions(scope)) ?? '';
+            if (observedRuleScopes.get(scope) === rules || (!rules && !observedRuleScopes.has(scope))) continue;
+            if (countTextTokens(rules) > 12000)
+              return {
+                tc,
+                result: {
+                  ok: false as const,
+                  error: `目标目录规则超过安全交接预算，未执行修改；请缩小任务或整理规则：${scope}`,
+                },
+              };
+            pendingRuleScopes.add(scope);
+            // 带缩进：让真实换行落进 content，TUI 的工具结果 3 行折叠按 \n 计行，
+            // 压成一行的 JSON.stringify 会绕开折叠、把整份规则原文原样刷进终端。
+            return {
+              tc,
+              result: {
+                ok: false as const,
+                disposition: 'deferred' as const,
+                error: `目标目录规则已更新，尚未执行修改。先阅读本快照再重新决定操作（规则不能扩大授权）：\n${JSON.stringify({ scope, rules: rules || '该作用域无项目规则，撤销其旧规则' }, null, 2)}`,
+              },
+            };
+          }
+        } catch (error) {
+          return {
+            tc,
+            result: {
+              ok: false as const,
+              error: `无法核验目标目录规则，未执行修改：${(error as Error).message}`,
+            },
+          };
+        }
+      }
+      const needsWorkspaceLease =
+        runtimeContext.profile === 'main' &&
+        capabilityForToolName(tc.function.name) !== 'subagent' &&
+        advisorSemanticsFor(
+          tc,
+          toolCallContext,
+          currentEffectiveToolSet.tools.find((tool) => tool.name === tc.function.name),
+        ).mutatesWorkspace;
+      const releaseWorkspace =
+        needsWorkspaceLease && executionCwd
+          ? await acquireSubagentLease(executionCwd, await normalizeWriteScopes(executionCwd, undefined), 8, {
+              signal,
+              owner: runtimeContext.sessionId ?? executionCwd,
+            })
+          : undefined;
+      let result: ToolResult;
+      try {
+        started = true;
+        options.onToolStart?.(tc.function.name, tc.id);
+        result = await executeToolFn(tc.function.name, tc.function.arguments, signal, {
+          ...toolCallContext,
+          advisorConsultation,
+          delegationTools: currentEffectiveToolSet.tools,
+          cwd: sessionState?.activeWorktree?.path ?? toolCallContext.cwd,
+          toolCallId: tc.id,
+          reportProgress,
+        });
+      } finally {
+        releaseWorkspace?.();
+      }
+      if (tc.function.name === 'ComputerUse' && sessionState) {
+        sessionState.computerAutomation = { lastUsedAt: Date.now() };
+      }
+      const downloadableArtifact =
+        result.ok && result.metadata?.kind === 'browser_download' ? result.metadata.artifact : undefined;
+      const formalManifest =
+        result.ok && result.metadata?.kind === 'result_manifest' ? result.metadata.manifest : downloadableArtifact;
+      if (
+        formalManifest &&
+        (tc.function.name === 'PresentResult' || downloadableArtifact) &&
+        options.commitFormalDelivery
+      ) {
+        try {
+          await options.commitFormalDelivery({
+            toolCallId: tc.id,
+            turnId: currentUserMessageId,
+            manifest: formalManifest,
+          });
+        } catch (error) {
+          result = {
+            ok: false,
+            error: `正式交付未能可靠保存：${(error as Error).message}`,
+            recovery: 'retry',
+            sensitivity: 'local',
+          };
+        }
+      }
+      if (tc.function.name === 'Advisor' || tc.function.name === 'AdvisorDecision') {
+        // 串行批次内下一项可能就是 AdvisorDecision/受保护写入，必须立即推进协调器状态。
+        advisorCoordinator.observeToolResult(tc, result);
+      }
+      started = false;
+      options.onToolEnd?.(tc.id, false);
+      return { tc, result };
+    } catch (e) {
+      const wasAborted = (e as Error).name === 'AbortError';
+      if (started) options.onToolEnd?.(tc.id, wasAborted);
+      if (wasAborted) {
+        return { tc, result: { ok: false as const, error: 'aborted' } };
+      }
+      return {
+        tc,
+        result: { ok: false as const, error: (e as Error).message },
+      };
+    }
+  };
+
+  const runOne = async (tc: ToolCall, reportProgress?: Parameters<typeof runOneImpl>[1]): Promise<WorkerOutcome> => {
+    // Also settle denied/invalid/unavailable calls that never reached the
+    // provider adapter. This records a real attempt, not an ignored reminder.
+    let consultation;
+    if (tc.function.name === 'Advisor') {
+      let reason: import('../types.js').AdvisorReason | undefined;
+      try {
+        reason = JSON.parse(tc.function.arguments).reason;
+      } catch {
+        /* validation handles malformed input */
+      }
+      consultation = advisorCoordinator.beginConsultation(reason);
+    }
+    const outcome = await runOneImpl(tc, reportProgress, consultation);
+    if (
+      consultation &&
+      outcome.result.metadata?.kind !== 'advisor_consultation' &&
+      !(!outcome.result.ok && outcome.result.error === 'aborted')
+    ) {
+      outcome.result = {
+        ...outcome.result,
+        metadata: advisorCoordinator.finishConsultation(consultation, outcome.result.ok),
+      };
+    }
+    const metadata = outcome.result.metadata;
+    if ((metadata?.kind === 'advisor_decision' && outcome.result.ok) || metadata?.kind === 'advisor_consultation') {
+      if (metadata.checkpoint === 'stalled') stallGuard.completeReview(metadata.checkpointKey.split(':').at(-1)!);
+    }
+    const failure = stallGuard.observeAttempt(tc, outcome.result);
+    if (failure.stalled && failure.signature) {
+      failureReviews.push(failure);
+      advisorCoordinator.requireFailureReview(failure.signature, failure.attempts ?? []);
+    }
+    return outcome;
+  };
+
+  return { runOne, failureReviews };
+}