ummaya 0.2.4 → 0.2.6

package/tui/src/tools/PowerShellTool/shellExecution.tsx

@@ -0,0 +1,258 @@
+import { feature } from 'bun:bundle';
+import * as React from 'react';
+import { getKairosActive } from '../../bootstrap/state.js';
+import { logEvent } from '../../services/analytics/index.js';
+import type { SetToolJSXFn } from '../../Tool.js';
+import type { AppState } from '../../state/AppState.js';
+import { backgroundExistingForegroundTask, markTaskNotified, registerForeground, spawnShellTask, unregisterForeground } from '../../tasks/LocalShellTask/LocalShellTask.js';
+import type { AgentId } from '../../types/ids.js';
+import { errorMessage as getErrorMessage } from '../../utils/errors.js';
+import { logError } from '../../utils/log.js';
+import { getPlatform } from '../../utils/platform.js';
+import { exec } from '../../utils/Shell.js';
+import type { ExecResult } from '../../utils/ShellCommand.js';
+import { getCachedPowerShellPath } from '../../utils/shell/powershellDetection.js';
+import { TaskOutput } from '../../utils/task/TaskOutput.js';
+import { shouldUseSandboxForShell } from '../BashTool/sandboxPolicy.js';
+import { loadBashUI } from '../BashTool/uiLoader.js';
+import { isAutobackgroundingAllowed, getCommandTypeForLogging } from './commandClassification.js';
+import { getDefaultTimeoutMs, getMaxTimeoutMs } from './prompt.js';
+import { isBackgroundTasksDisabled, type PowerShellToolInput } from './schemas.js';
+
+const PROGRESS_THRESHOLD_MS = 2000;
+const PROGRESS_INTERVAL_MS = 1000;
+const ASSISTANT_BLOCKING_BUDGET_MS = 15_000;
+
+export type PowerShellExecutionProgress = {
+  readonly type: 'progress'; readonly output: string; readonly fullOutput: string;
+  readonly elapsedTimeSeconds: number; readonly totalLines: number;
+  readonly totalBytes: number; readonly taskId?: string; readonly timeoutMs?: number;
+};
+
+type RunPowerShellCommandInput = {
+  readonly input: PowerShellToolInput; readonly abortController: AbortController;
+  readonly setAppState: (f: (prev: AppState) => AppState) => void;
+  readonly setToolJSX?: SetToolJSXFn; readonly preventCwdChanges?: boolean;
+  readonly isMainThread?: boolean; readonly toolUseId?: string; readonly agentId?: AgentId;
+};
+
+export async function* runPowerShellCommand({
+  input,
+  abortController,
+  setAppState,
+  setToolJSX,
+  preventCwdChanges,
+  isMainThread,
+  toolUseId,
+  agentId
+}: RunPowerShellCommandInput): AsyncGenerator<PowerShellExecutionProgress, ExecResult, void> {
+  const { command, description, timeout, run_in_background, dangerouslyDisableSandbox } = input;
+  const timeoutMs = Math.min(timeout || getDefaultTimeoutMs(), getMaxTimeoutMs());
+  let fullOutput = '';
+  let lastProgressOutput = '';
+  let lastTotalLines = 0;
+  let lastTotalBytes = 0;
+  const updateProgress = (lastLines: string, allLines: string, totalLines: number, totalBytes: number, isIncomplete: boolean): void => {
+    lastProgressOutput = lastLines;
+    fullOutput = allLines;
+    lastTotalLines = totalLines;
+    lastTotalBytes = isIncomplete ? totalBytes : 0;
+  };
+  const powershellPath = await getCachedPowerShellPath();
+  if (!powershellPath) {
+    return {
+      stdout: '',
+      stderr: 'PowerShell is not available on this system.',
+      code: 0,
+      interrupted: false
+    };
+  }
+  const shellCommand = await createShellCommand({ command, abortController, timeoutMs, preventCwdChanges, dangerouslyDisableSandbox, onProgress: updateProgress });
+  if (shellCommand.kind === 'preflight') {
+    return shellCommand.result;
+  }
+  const execution = shellCommand.value;
+  const resultPromise = execution.result;
+  let backgroundShellId: string | undefined = undefined;
+  let interruptBackgroundingStarted = false;
+  let assistantAutoBackgrounded = false;
+  let resolveProgress: (() => void) | null = null;
+  function createProgressSignal(): Promise<null> {
+    return new Promise<null>(resolve => {
+      resolveProgress = () => resolve(null);
+    });
+  }
+  async function spawnBackgroundTask(): Promise<string> {
+    const handle = await spawnShellTask({
+      command,
+      description: description || command,
+      shellCommand: execution,
+      toolUseId,
+      agentId
+    }, {
+      abortController,
+      getAppState: () => {
+        throw new Error('getAppState not available in runPowerShellCommand context');
+      },
+      setAppState
+    });
+    return handle.taskId;
+  }
+  function startBackgrounding(eventName: string, backgroundFn?: (shellId: string) => void): void {
+    if (foregroundTaskId) {
+      if (!backgroundExistingForegroundTask(foregroundTaskId, execution, description || command, setAppState, toolUseId)) {
+        return;
+      }
+      backgroundShellId = foregroundTaskId;
+      logEvent(eventName, { command_type: getCommandTypeForLogging(command) });
+      backgroundFn?.(foregroundTaskId);
+      return;
+    }
+    void spawnBackgroundTask().then(shellId => {
+      backgroundShellId = shellId;
+      const resolve = resolveProgress;
+      if (resolve) {
+        resolveProgress = null;
+        resolve();
+      }
+      logEvent(eventName, { command_type: getCommandTypeForLogging(command) });
+      backgroundFn?.(shellId);
+    });
+  }
+  const shouldAutoBackground = !isBackgroundTasksDisabled && isAutobackgroundingAllowed(command);
+  if (execution.onTimeout && shouldAutoBackground) {
+    execution.onTimeout(backgroundFn => startBackgrounding('tengu_powershell_command_timeout_backgrounded', backgroundFn));
+  }
+  if (feature('KAIROS') && getKairosActive() && isMainThread && !isBackgroundTasksDisabled && run_in_background !== true) {
+    setTimeout(() => {
+      if (execution.status === 'running' && backgroundShellId === undefined) {
+        assistantAutoBackgrounded = true;
+        startBackgrounding('tengu_powershell_command_assistant_auto_backgrounded');
+      }
+    }, ASSISTANT_BLOCKING_BUDGET_MS).unref();
+  }
+  if (run_in_background === true && !isBackgroundTasksDisabled) {
+    const shellId = await spawnBackgroundTask();
+    logEvent('tengu_powershell_command_explicitly_backgrounded', { command_type: getCommandTypeForLogging(command) });
+    return { stdout: '', stderr: '', code: 0, interrupted: false, backgroundTaskId: shellId };
+  }
+  TaskOutput.startPolling(execution.taskOutput.taskId);
+  const startTime = Date.now();
+  let nextProgressTime = startTime + PROGRESS_THRESHOLD_MS;
+  let foregroundTaskId: string | undefined = undefined;
+  try {
+    while (true) {
+      const result = await Promise.race([resultPromise, progressDelay(nextProgressTime), createProgressSignal()]);
+      if (result !== null) {
+        return finishCompletedPowerShellResult(result, execution, setAppState);
+      }
+      if (backgroundShellId) {
+        return { stdout: interruptBackgroundingStarted ? fullOutput : '', stderr: '', code: 0, interrupted: false, backgroundTaskId: backgroundShellId, assistantAutoBackgrounded };
+      }
+      if (abortController.signal.aborted && abortController.signal.reason === 'interrupt' && !interruptBackgroundingStarted) {
+        interruptBackgroundingStarted = true;
+        if (!isBackgroundTasksDisabled) {
+          startBackgrounding('tengu_powershell_command_interrupt_backgrounded');
+          continue;
+        }
+        execution.kill();
+      }
+      if (foregroundTaskId && execution.status === 'backgrounded') {
+        return { stdout: '', stderr: '', code: 0, interrupted: false, backgroundTaskId: foregroundTaskId, backgroundedByUser: true };
+      }
+      const elapsedSeconds = Math.floor((Date.now() - startTime) / 1000);
+      foregroundTaskId = maybeShowBackgroundHint({ command, description, execution, agentId, setAppState, setToolJSX, toolUseId, foregroundTaskId, backgroundShellId, elapsedSeconds });
+      yield { type: 'progress', fullOutput, output: lastProgressOutput, elapsedTimeSeconds: elapsedSeconds, totalLines: lastTotalLines, totalBytes: lastTotalBytes, taskId: execution.taskOutput.taskId, ...(timeout ? { timeoutMs } : undefined) };
+      nextProgressTime = Date.now() + PROGRESS_INTERVAL_MS;
+    }
+  } finally {
+    TaskOutput.stopPolling(execution.taskOutput.taskId);
+    if (!backgroundShellId && execution.status !== 'backgrounded') {
+      if (foregroundTaskId) unregisterForeground(foregroundTaskId, setAppState);
+      execution.cleanup();
+    }
+  }
+}
+
+type ShellCommand = Awaited<ReturnType<typeof exec>>;
+type ShellCommandResult =
+  | { readonly kind: 'ok'; readonly value: ShellCommand }
+  | { readonly kind: 'preflight'; readonly result: ExecResult };
+
+async function createShellCommand(input: {
+  readonly command: string;
+  readonly abortController: AbortController;
+  readonly timeoutMs: number;
+  readonly preventCwdChanges?: boolean;
+  readonly dangerouslyDisableSandbox?: boolean;
+  readonly onProgress: (lastLines: string, allLines: string, totalLines: number, totalBytes: number, isIncomplete: boolean) => void;
+}): Promise<ShellCommandResult> {
+  try {
+    const value = await exec(input.command, input.abortController.signal, 'powershell', {
+      timeout: input.timeoutMs,
+      onProgress: input.onProgress,
+      preventCwdChanges: input.preventCwdChanges,
+      shouldUseSandbox: getPlatform() === 'windows' ? false : shouldUseSandboxForShell(input),
+      shouldAutoBackground: !isBackgroundTasksDisabled && isAutobackgroundingAllowed(input.command)
+    });
+    return { kind: 'ok', value };
+  } catch (error) {
+    if (error instanceof Error) {
+      logError(error);
+      return { kind: 'preflight', result: { stdout: '', stderr: `Failed to execute PowerShell command: ${getErrorMessage(error)}`, code: 0, interrupted: false } };
+    }
+    throw error;
+  }
+}
+
+function progressDelay(nextProgressTime: number): Promise<null> {
+  const delayMs = Math.max(0, nextProgressTime - Date.now());
+  return new Promise<null>(resolve => setTimeout(done => done(null), delayMs, resolve).unref());
+}
+
+function finishCompletedPowerShellResult(result: ExecResult, shellCommand: ShellCommand, setAppState: (f: (prev: AppState) => AppState) => void): ExecResult {
+  if (result.backgroundTaskId === undefined) {
+    return result;
+  }
+  markTaskNotified(result.backgroundTaskId, setAppState);
+  const fixedResult: ExecResult = { ...result, backgroundTaskId: undefined };
+  const { taskOutput } = shellCommand;
+  if (taskOutput.stdoutToFile && !taskOutput.outputFileRedundant) {
+    fixedResult.outputFilePath = taskOutput.path;
+    fixedResult.outputFileSize = taskOutput.outputFileSize;
+    fixedResult.outputTaskId = taskOutput.taskId;
+  }
+  shellCommand.cleanup();
+  return fixedResult;
+}
+
+function maybeShowBackgroundHint(input: {
+  readonly command: string;
+  readonly description?: string;
+  readonly execution: ShellCommand;
+  readonly agentId?: AgentId;
+  readonly setAppState: (f: (prev: AppState) => AppState) => void;
+  readonly setToolJSX?: SetToolJSXFn;
+  readonly toolUseId?: string;
+  readonly foregroundTaskId?: string;
+  readonly backgroundShellId?: string;
+  readonly elapsedSeconds: number;
+}): string | undefined {
+  if (isBackgroundTasksDisabled || input.backgroundShellId !== undefined || input.elapsedSeconds < PROGRESS_THRESHOLD_MS / 1000 || !input.setToolJSX) {
+    return input.foregroundTaskId;
+  }
+  const foregroundTaskId = input.foregroundTaskId ?? registerForeground({
+    command: input.command,
+    description: input.description || input.command,
+    shellCommand: input.execution,
+    agentId: input.agentId
+  }, input.setAppState, input.toolUseId);
+  const { BackgroundHint } = loadBashUI();
+  input.setToolJSX({
+    jsx: <BackgroundHint />,
+    shouldHidePromptInput: false,
+    shouldContinueAnimation: true,
+    showSpinner: true
+  });
+  return foregroundTaskId;
+}

package/tui/src/tools/PowerShellTool/symlinkModeValidation.ts

@@ -0,0 +1,44 @@
+import { PS_TOKENIZER_DASH_CHARS } from '../../utils/powershell/parser.js'
+import { resolveToCanonical } from './readOnlyValidation.js'
+
+const LINK_ITEM_TYPES = new Set(['symboliclink', 'junction', 'hardlink'])
+
+function isItemTypeParamAbbrev(param: string): boolean {
+  return (
+    (param.length >= 3 && '-itemtype'.startsWith(param)) ||
+    (param.length >= 3 && '-type'.startsWith(param))
+  )
+}
+
+export function isSymlinkCreatingCommand(cmd: {
+  name: string
+  args: string[]
+}): boolean {
+  const canonical = resolveToCanonical(cmd.name)
+  if (canonical !== 'new-item') return false
+
+  for (let index = 0; index < cmd.args.length; index++) {
+    const raw = cmd.args[index] ?? ''
+    if (raw.length === 0) continue
+
+    const first = raw.charAt(0)
+    const normalized =
+      PS_TOKENIZER_DASH_CHARS.has(first) || first === '/'
+        ? '-' + raw.slice(1)
+        : raw
+    const lower = normalized.toLowerCase()
+    const colonIdx = lower.indexOf(':', 1)
+    const paramRaw = colonIdx > 0 ? lower.slice(0, colonIdx) : lower
+    const param = paramRaw.replace(/`/g, '')
+    if (!isItemTypeParamAbbrev(param)) continue
+
+    const rawVal =
+      colonIdx > 0
+        ? lower.slice(colonIdx + 1)
+        : (cmd.args[index + 1]?.toLowerCase() ?? '')
+    const value = rawVal.replace(/`/g, '').replace(/^['"]|['"]$/g, '')
+    if (LINK_ITEM_TYPES.has(value)) return true
+  }
+
+  return false
+}

package/tui/src/tools/PowerShellTool/uiLoader.ts

@@ -0,0 +1,37 @@
+import { createRequire } from 'node:module'
+
+type PowerShellUIRuntime = Pick<
+  typeof import('./UI.js'),
+  | 'renderToolResultMessage'
+  | 'renderToolUseErrorMessage'
+  | 'renderToolUseMessage'
+  | 'renderToolUseProgressMessage'
+  | 'renderToolUseQueuedMessage'
+>
+
+const requireModule = createRequire(import.meta.url)
+let cachedPowerShellUI: PowerShellUIRuntime | undefined
+
+function isPowerShellUIRuntime(
+  value: unknown,
+): value is PowerShellUIRuntime {
+  if (typeof value !== 'object' || value === null) return false
+  const module = value as Partial<Record<keyof PowerShellUIRuntime, unknown>>
+  return (
+    typeof module.renderToolResultMessage === 'function' &&
+    typeof module.renderToolUseErrorMessage === 'function' &&
+    typeof module.renderToolUseMessage === 'function' &&
+    typeof module.renderToolUseProgressMessage === 'function' &&
+    typeof module.renderToolUseQueuedMessage === 'function'
+  )
+}
+
+export function loadPowerShellUI(): PowerShellUIRuntime {
+  if (cachedPowerShellUI !== undefined) return cachedPowerShellUI
+  const loaded: unknown = requireModule('./UI.js')
+  if (!isPowerShellUIRuntime(loaded)) {
+    throw new Error('PowerShell UI module did not expose expected renderers')
+  }
+  cachedPowerShellUI = loaded
+  return loaded
+}

package/tui/src/tools/PowerShellTool/validation.ts

@@ -0,0 +1,39 @@
+import { feature } from 'bun:bundle';
+import type { ValidationResult } from '../../Tool.js';
+import { getPlatform } from '../../utils/platform.js';
+import {
+  areUnsandboxedShellCommandsAllowed,
+  isShellSandboxEnabledInSettings
+} from '../BashTool/sandboxPolicy.js';
+import { detectBlockedSleepPattern } from './commandClassification.js';
+import { isBackgroundTasksDisabled } from './schemas.js';
+import type { PowerShellToolInput } from './schemas.js';
+
+export const WINDOWS_SANDBOX_POLICY_REFUSAL = 'Enterprise policy requires sandboxing, but sandboxing is not available on native Windows. Shell command execution is blocked on this platform by policy.';
+
+export function isWindowsSandboxPolicyViolation(): boolean {
+  return getPlatform() === 'windows' && isShellSandboxEnabledInSettings() && !areUnsandboxedShellCommandsAllowed();
+}
+
+export async function validatePowerShellInput(input: PowerShellToolInput): Promise<ValidationResult> {
+  if (isWindowsSandboxPolicyViolation()) {
+    return {
+      result: false,
+      message: WINDOWS_SANDBOX_POLICY_REFUSAL,
+      errorCode: 11
+    };
+  }
+  if (feature('MONITOR_TOOL') && !isBackgroundTasksDisabled && !input.run_in_background) {
+    const sleepPattern = detectBlockedSleepPattern(input.command);
+    if (sleepPattern !== null) {
+      return {
+        result: false,
+        message: `Blocked: ${sleepPattern}. Run blocking commands in the background with run_in_background: true — you'll get a completion notification when done. For streaming events (watching logs, polling APIs), use the Monitor tool. If you genuinely need a delay (rate limiting, deliberate pacing), keep it under 2 seconds.`,
+        errorCode: 10
+      };
+    }
+  }
+  return {
+    result: true
+  };
+}

package/tui/src/tools/ReadMcpResourceTool/ReadMcpResourceTool.ts

@@ -12,6 +12,10 @@ import {
 } from '../../utils/mcpOutputStorage.js'
 import { jsonStringify } from '../../utils/slowOperations.js'
 import { isOutputLineTruncated } from '../../utils/terminal.js'
+import {
+  assertNonEmptyMcpResourceUri,
+  assertTrustedMcpServerForResourceAccess,
+} from '../MCPTool/trustPolicy.js'
 import { DESCRIPTION, PROMPT } from './prompt.js'
 import {
   renderToolResultMessage,
@@ -21,8 +25,16 @@ import {
 
 export const inputSchema = lazySchema(() =>
   z.object({
-    server: z.string().describe('The MCP server name'),
-    uri: z.string().describe('The resource URI to read'),
+    server: z
+      .string()
+      .trim()
+      .min(1, 'Server name cannot be empty')
+      .describe('The MCP server name'),
+    uri: z
+      .string()
+      .trim()
+      .min(1, 'Resource URI cannot be empty')
+      .describe('The resource URI to read'),
   }),
 )
 type InputSchema = ReturnType<typeof inputSchema>
@@ -72,8 +84,12 @@ export const ReadMcpResourceTool = buildTool({
   get outputSchema(): OutputSchema {
     return outputSchema()
   },
-  async call(input, { options: { mcpClients } }) {
+  async call(input, { options: { mcpClients }, getAppState }) {
     const { server: serverName, uri } = input
+    const permissionContext = getAppState().toolPermissionContext
+
+    assertTrustedMcpServerForResourceAccess(permissionContext, serverName)
+    assertNonEmptyMcpResourceUri(uri)
 
     const client = mcpClients.find(client => client.name === serverName)
 

package/tui/src/tools/ResolveLocationPrimitive/ResolveLocationPrimitive.ts

@@ -16,8 +16,6 @@ import {
   LOCATE_TOOL_PROMPT,
 } from './prompt.js'
 import { dispatchPrimitive } from '../_shared/dispatchPrimitive.js'
-import { validateKmaAviationToolChoice } from '../_shared/kmaAviationGuard.js'
-import { validateDirectPublicDataToolChoice } from '../_shared/directPublicDataGuard.js'
 import {
   renderVerboseInputJson,
   renderVerboseOutputJson,
@@ -269,7 +267,7 @@ export const ResolveLocationPrimitive = buildTool({
 
   isMcp: false,
 
-  async validateInput(input: z.infer<InputSchema>, context: ToolUseContext) {
+  async validateInput(input: z.infer<InputSchema>, _context: ToolUseContext) {
     if (isRootPrimitiveToolId(input.tool_id)) {
       return {
         result: false as const,
@@ -277,14 +275,6 @@ export const ResolveLocationPrimitive = buildTool({
         errorCode: 1,
       }
     }
-    const kmaAviationChoice = validateKmaAviationToolChoice(input.tool_id, context)
-    if (kmaAviationChoice) return kmaAviationChoice
-    const directPublicDataChoice = validateDirectPublicDataToolChoice(
-      input.tool_id,
-      context,
-      input.params,
-    )
-    if (directPublicDataChoice) return directPublicDataChoice
     return { result: true as const }
   },
 

package/tui/src/tools/ResolveLocationPrimitive/prompt.ts

@@ -12,18 +12,14 @@ export const LOCATE_TOOL_PROMPT = `Resolve Korean location phrases with concrete
 
 Preferred path:
 - Call concrete adapter functions directly after their schemas are loaded.
-- Examples: kakao_keyword_search({ query: "부산 사하구 다대1동" }) or kakao_coord_to_region({ lat: 35.115446, lon: 128.967669 })
 - Adapter schemas are progressively disclosed by ToolSearch or by backend top-K retrieval for the current citizen request.
 
 Legacy root wrapper:
 - If a concrete adapter function is not loaded and only the root primitive is available, locate accepts { tool_id, params } for old transcripts and compatibility paths.
 - tool_id must be a concrete locate adapter id from <available_adapters>, never "locate", "find", "check", or "send".
 - Invalid: locate({ tool_id: "locate", params: {...} })
-- Compatibility-only: locate({ tool_id: "kakao_address_search", params: { query: "부산 사하구 다대1동" } })
 
 Rules:
-- Use kakao_keyword_search for named places, campuses, stations, landmarks, hospitals, and POIs.
-- Coordinate-producing locate results may include KMA nx/ny; pass those exact values to KMA weather adapters that require nx and ny.
-- Use kakao_address_search or juso_adm_cd_lookup for structured road/jibun addresses and district text.
-- Use kakao_coord_to_region after a coordinate result when a downstream adapter needs q0/q1 or region names.
+- Use the concrete location adapter schema fields exactly.
+- Reuse exact coordinate, region, or administrative-code fields from successful location results when a downstream adapter requires them.
 - If the result is kind="error", do not invent coordinates or administrative codes.`

package/tui/src/tools/SkillTool/SkillTool.ts

@@ -523,7 +523,7 @@ export const SkillTool: Tool<InputSchema, Output, Progress> = buildTool({
     }
 
     // Auto-allow skills that only use safe properties.
-    // This is an allowlist: if a skill has any property NOT in this set with a
+    // This is an allowlist: if a skill includes a property NOT in this set with a
     // meaningful value, it requires permission. This ensures new properties added
     // in the future default to requiring permission.
     if (
@@ -869,7 +869,7 @@ export const SkillTool: Tool<InputSchema, Output, Progress> = buildTool({
 } satisfies ToolDef<InputSchema, Output, Progress>)
 
 // Allowlist of PromptCommand property keys that are safe and don't require permission.
-// If a skill has any property NOT in this set with a meaningful value, it requires
+// If a skill defines a property NOT in this set with a meaningful value, it requires
 // permission. This ensures new properties added to PromptCommand in the future
 // default to requiring permission until explicitly reviewed and added here.
 const SAFE_SKILL_PROPERTIES = new Set([

package/tui/src/tools/SubmitPrimitive/SubmitPrimitive.ts

@@ -27,6 +27,11 @@ import {
   resolveAdapter,
 } from '../../services/api/adapterManifest.js'
 import { dispatchPrimitive } from '../_shared/dispatchPrimitive.js'
+import {
+  applyDocumentVisualRenderGateToOutput,
+  isDocumentVisualRenderFailedOutput,
+  renderDocumentToolResultIfPresent,
+} from '../_shared/documentToolResultRender.js'
 import {
   renderVerboseInputJson,
   renderVerboseOutputJson,
@@ -63,7 +68,7 @@ const inputSchema = lazySchema(() =>
       tool_id: z
         .string()
         .min(1)
-        .describe('Registered send adapter identifier from <available_adapters>'),
+        .describe('Registered adapter identifier for a send adapter from <available_adapters>'),
       params: z
         .record(z.string(), z.unknown())
         .describe('Adapter-defined Pydantic-validated parameter body'),
@@ -253,19 +258,21 @@ export const SubmitPrimitive = buildTool({
   },
 
   mapToolResultToToolResultBlockParam(output, toolUseID) {
+    const gatedOutput = applyDocumentVisualRenderGateToOutput(output)
     // Spec 2521 (2026-05-02) — outbound_traces is UI-only (see Lookup).
     const llmContent =
-      typeof output === 'object' && output !== null
+      typeof gatedOutput === 'object' && gatedOutput !== null
         ? Object.fromEntries(
-            Object.entries(output as Record<string, unknown>).filter(
+            Object.entries(gatedOutput as Record<string, unknown>).filter(
               ([k]) => k !== 'outbound_traces',
             ),
           )
-        : output
+        : gatedOutput
     return {
       tool_use_id: toolUseID,
       type: 'tool_result',
       content: JSON.stringify(llmContent),
+      ...(isDocumentVisualRenderFailedOutput(gatedOutput) ? { is_error: true } : {}),
     }
   },
 
@@ -368,11 +375,16 @@ export const SubmitPrimitive = buildTool({
     _progress: unknown,
     options: { verbose: boolean; isTranscriptMode?: boolean } = { verbose: false },
   ) {
+    const gatedOutput = applyDocumentVisualRenderGateToOutput(output) as Output
+    const documentResult = renderDocumentToolResultIfPresent(gatedOutput, options)
+    if (documentResult !== null) {
+      return documentResult
+    }
     // Spec 2521 (2026-05-01 evening) — verbose / transcript mode surface
     // the full envelope JSON. CC BashTool/UI.tsx:renderToolResultMessage
     // pattern.
     if (options.verbose || options.isTranscriptMode) {
-      return renderVerboseOutputJson(output)
+      return renderVerboseOutputJson(gatedOutput)
     }
     // NOTE: This file is `.ts` (not `.tsx`); Bun runtime cannot parse JSX in
     // `.ts`. Use `React.createElement` for parity with the other 3 primitives.
@@ -381,11 +393,11 @@ export const SubmitPrimitive = buildTool({
     // rewrite, output.result is the actual send primitive output
     // (transaction_id / ministry / status / agency_handoff_url) unwrapped
     // from ToolResultEnvelope.result.
-    if (output.ok) {
-      return renderCompactPrimitiveResult(buildSubmitSuccessRows(output))
+    if (gatedOutput.ok) {
+      return renderCompactPrimitiveResult(buildSubmitSuccessRows(gatedOutput))
     }
 
-    return renderCompactPrimitiveResult(buildSubmitErrorRows(output))
+    return renderCompactPrimitiveResult(buildSubmitErrorRows(gatedOutput))
   },
 
   isResultTruncated(output: Output): boolean {
@@ -405,7 +417,8 @@ export const SubmitPrimitive = buildTool({
   async checkPermissions(_input) {
     return {
       behavior: 'ask' as const,
-      message: 'Permission delegation required: send a submission request to the agency. Continue?',
+      message:
+        '권한 위임 필요: 제출 요청을 기관에 전송합니다. 계속할까요? / Permission delegation required: send a submission request to the agency.',
     }
   },
 
@@ -413,12 +426,16 @@ export const SubmitPrimitive = buildTool({
    * Dispatch send call via real IPC bridge (T011 — stub replaced).
    */
   async call(input, context) {
-    return dispatchPrimitive<Output>({
+    const result = await dispatchPrimitive<Output>({
       primitive: 'send',
       args: input as Record<string, unknown>,
       context,
       registry: getOrCreatePendingCallRegistry(),
       bridge: getOrCreateUmmayaBridge(),
     })
+    return {
+      ...result,
+      data: applyDocumentVisualRenderGateToOutput(result.data) as Output,
+    }
   },
 } satisfies ToolDef<InputSchema, Output>)

package/tui/src/tools/TaskCreateTool/TaskCreateTool.ts

@@ -12,6 +12,7 @@ import {
   isTodoV2Enabled,
 } from '../../utils/tasks.js'
 import { getAgentName, getTeamName } from '../../utils/teammate.js'
+import { buildAgentSupportMetadata } from '../AgentTool/orchestrationSupport.js'
 import { TASK_CREATE_TOOL_NAME } from './constants.js'
 import { DESCRIPTION, getPrompt } from './prompt.js'
 
@@ -39,6 +40,10 @@ const outputSchema = lazySchema(() =>
       id: z.string(),
       subject: z.string(),
     }),
+    evidenceJoinKey: z.string(),
+    parentToolUseId: z.string(),
+    resumeToken: z.string(),
+    permissionFlow: z.literal('coordinator_parent_round_trip'),
   }),
 )
 type OutputSchema = ReturnType<typeof outputSchema>
@@ -124,15 +129,24 @@ export const TaskCreateTool = buildTool({
           id: taskId,
           subject,
         },
+        ...buildAgentSupportMetadata({
+          taskId,
+          parentToolUseId: context.toolUseId,
+        }),
       },
     }
   },
   mapToolResultToToolResultBlockParam(content, toolUseID) {
-    const { task } = content as Output
+    const { task, evidenceJoinKey, parentToolUseId, resumeToken, permissionFlow } =
+      outputSchema().parse(content)
     return {
       tool_use_id: toolUseID,
       type: 'tool_result',
-      content: `Task #${task.id} created successfully: ${task.subject}`,
+      content: `Task #${task.id} created successfully: ${task.subject}
+evidence_join_key: ${evidenceJoinKey}
+parent_tool_use_id: ${parentToolUseId}
+resume_token: ${resumeToken}
+permission_flow: ${permissionFlow}`,
     }
   },
 } satisfies ToolDef<InputSchema, Output>)