veryfront 0.1.1237 → 0.1.1239

package/esm/src/agent/runtime/index.js

@@ -14,6 +14,7 @@ import { getTextFromParts, } from "../types.js";
 import { ensureModelReady, resolveModel } from "../../provider/index.js";
 import { generateId } from "../../utils/id.js";
 import { detectPlatform, getPlatformCapabilities } from "../../platform/core-platform.js";
+import { canIdentifyProxyWithoutHooks, isProxyWithoutHooks, } from "../../platform/compat/error-introspection.js";
 import { createAgentMemory } from "../memory/index.js";
 import { serverLogger } from "../../utils/index.js";
 import { addSpanEvent, setActiveSpanErrorStatus as setOtelActiveSpanErrorStatus, setSpanAttributes, withSpan, } from "../../observability/tracing/otlp-setup.js";
@@ -22,13 +23,14 @@ import { convertToTextGenerationRuntimeRequestMessages } from "./text-generation
 import { convertToolsToRuntimeTools } from "./model-tool-converter.js";
 import { bindRuntimeRemoteToolSourcesToCredentialOwner, constrainRuntimeRemoteToolSources, getRuntimeRemoteToolSources, } from "./mcp-server-tool-sources.js";
 import { runWithRuntimeRemoteToolSources } from "./remote-tool-source-context.js";
-import { createStreamState, processStream, } from "./chat-stream-handler.js";
+import { announceStreamedToolCallInput, createStreamState, processStream, } from "./chat-stream-handler.js";
 import { repairToolCall } from "./repair-tool-call.js";
 import { MiddlewareChain } from "../middleware/chain.js";
 import { tryGetCacheKeyContext } from "../../cache/cache-key-builder.js";
 import { isLocalModelRuntime, supportsModelRuntimeToolCalling, } from "../../provider/runtime-inspection.js";
 import { generateText, streamText } from "../../runtime/runtime-bridge.js";
-import { captureStreamedToolCallInput, collectFinalStreamToolResults, collectGeneratedToolResults, createToolErrorMessage, createToolResultMessage, getProviderExecutedToolNames, getToolResultError, isRecoverablePlaceholderToolCall, isStreamedToolCallIncomplete, materializeStreamedToolCall, shouldContinueAfterStreamStep, } from "./tool-result-continuation.js";
+import { resolveAgentSystem } from "./effective-agent-system.js";
+import { captureStreamedToolCallInput, collectFinalStreamToolResults, collectGeneratedToolResults, createToolErrorMessage, createToolResultMessage, getProviderExecutedToolNames, getToolResultError, hasSubstantiveAssistantText, isInterruptedClientToolCall, isRecoverablePlaceholderToolCall, isStreamedToolCallIncomplete, materializeStreamedToolCall, shouldContinueAfterStreamStep, } from "./tool-result-continuation.js";
 import { enforceSkillPolicy, FORM_INPUT_TOOL_ID, LOAD_SKILL_TOOL_ID, SUBMITTED_FORM_INPUT_CONTEXT_KEY, } from "./skill-policy-enforcement.js";
 import { AgentLoopSkillState } from "./agent-loop-skill-state.js";
 import { markRuntimeGeneratedUserMessage } from "./runtime-message-origin.js";
@@ -36,7 +38,7 @@ import { getRuntimeAllowedRemoteTools, getRuntimeForwardedIntegrationToolDefs, g
 import { applySourceIntegrationPolicy, } from "../../integrations/source-policy.js";
 import { runWithRemoteIntegrationToolDiscoveryScope } from "../../integrations/remote-tools.js";
 import { prepareAgentRuntimeStep, withIntegrationToolDiscoveryStatus, } from "./agent-runtime-step.js";
-import { buildStreamedAssistantMessage } from "./streamed-assistant-message.js";
+import { buildStreamedAssistantMessage, isPersistedReasoningPart, } from "./streamed-assistant-message.js";
 import { flattenSystemInstructions, hasRuntimeToolInventory, withRuntimeToolInventory, } from "./tool-inventory.js";
 import { captureAgentRunRuntimeContext, withAgentRunRuntimeContext, withAgentRunRuntimeContextMetadata, } from "./run-runtime-context.js";
 // Re-export from submodules
@@ -74,15 +76,278 @@ import { DEFAULT_MAX_TOKENS, DEFAULT_TEMPERATURE, getModelMaxOutputTokens } from
 import { closeSSEStream, generateMessageId, sendSSE } from "./sse-utils.js";
 import { executeConfiguredTool, getAvailableTools, isDynamicTool, resolveConfiguredTool, } from "./tool-helpers.js";
 import { accumulateUsage, getMaxSteps, normalizeInput } from "./input-utils.js";
-import { resolveRuntimeModel } from "./model-resolution.js";
+import { resolveModelProviderOptionKey, resolveRuntimeModel } from "./model-resolution.js";
 import { stringifyToolError, throwIfAborted } from "./error-utils.js";
 import { resolveTemperatureParameter } from "./model-capabilities.js";
 import { applySkillDelegationOverridesToToolInput } from "./skill-delegation-overrides.js";
 import { resolveAgentModelTransport } from "./model-transport.js";
 import { buildRuntimeUsageTraceAttributes } from "./trace-usage.js";
-import { createToolExposureCheckpoint, createToolExposureState, searchToolExposure, TOOL_SEARCH_TOOL_NAME, } from "./tool-exposure.js";
+import { createToolExposureCheckpoint, createToolExposureState, createToolSearchDefinition, searchToolExposure, TOOL_SEARCH_TOOL_NAME, } from "./tool-exposure.js";
+const ArrayIsArray = Array.isArray;
+const cloneStructuredValue = globalThis.structuredClone;
+const IntrinsicWeakMap = WeakMap;
+const ObjectCreate = Object.create;
+const ObjectDefineProperty = Object.defineProperty;
+const ObjectGetOwnPropertyDescriptors = Object.getOwnPropertyDescriptors;
+const ObjectGetPrototypeOf = Object.getPrototypeOf;
+const ObjectPrototype = Object.prototype;
+const ReflectOwnKeys = Reflect.ownKeys;
 const logger = serverLogger.component("agent");
 const EVAL_RETAINED_SKILL_LOADER_TOOL_IDS = ["load_skill", "load_skill_reference"];
+function getStructuredCloneFailureFingerprint(error) {
+    if (!(error instanceof DOMException) || error.name !== "DataCloneError") {
+        return undefined;
+    }
+    return `${error.name}\u0000${error.message}`;
+}
+function captureOpaqueProxyCloneFailureFingerprints() {
+    const revokedArrayProxy = Proxy.revocable([], {});
+    revokedArrayProxy.revoke();
+    const probes = [
+        new Proxy({}, {}),
+        new Proxy([], {}),
+        new Proxy(ObjectCreate(null), {}),
+        revokedArrayProxy.proxy,
+    ];
+    const fingerprints = [];
+    for (const probe of probes) {
+        try {
+            cloneStructuredValue(probe);
+        }
+        catch (error) {
+            const fingerprint = getStructuredCloneFailureFingerprint(error);
+            if (fingerprint !== undefined && !fingerprints.includes(fingerprint)) {
+                fingerprints.push(fingerprint);
+            }
+        }
+    }
+    return fingerprints;
+}
+const OPAQUE_PROXY_CLONE_FAILURE_FINGERPRINTS = captureOpaqueProxyCloneFailureFingerprints();
+function isOpaqueProxyCloneFailure(error) {
+    const fingerprint = getStructuredCloneFailureFingerprint(error);
+    return fingerprint !== undefined &&
+        OPAQUE_PROXY_CLONE_FAILURE_FINGERPRINTS.includes(fingerprint);
+}
+function isArrayWithoutThrowing(value) {
+    try {
+        return ArrayIsArray(value);
+    }
+    catch {
+        return false;
+    }
+}
+function shouldRecoverOpaqueProxyContainer(value, fallback) {
+    return fallback === "root"
+        ? isArrayWithoutThrowing(value)
+        : fallback !== "opaque" && fallback !== "provider-metadata";
+}
+function getChildRuntimeStateCloneFallback(fallback, parentIsArray, key, providerOptionKey) {
+    if (fallback === "root" && parentIsArray) {
+        return "message";
+    }
+    if (fallback === "message" && key === "providerOptions") {
+        return "provider-options";
+    }
+    if (fallback === "provider-options" &&
+        (key === "anthropic" || key === "veryfront-cloud" || key === providerOptionKey)) {
+        return "provider-bucket";
+    }
+    if (fallback === "provider-bucket") {
+        return key === "cacheControl" ? "cache-control" : "provider-metadata";
+    }
+    if (fallback === "cache-control") {
+        return "provider-metadata";
+    }
+    return "opaque";
+}
+function isOrdinaryRecordPrototype(prototype) {
+    if (prototype === null || prototype === ObjectPrototype) {
+        return true;
+    }
+    if (isProxyWithoutHooks(prototype)) {
+        return false;
+    }
+    try {
+        return ObjectGetPrototypeOf(prototype) === null;
+    }
+    catch {
+        return false;
+    }
+}
+function cloneRuntimeStateMutableValue(value, clones, proxyDetectionAvailable, fallback, providerOptionKey) {
+    if (typeof value !== "object" || value === null) {
+        return value;
+    }
+    if (proxyDetectionAvailable && isProxyWithoutHooks(value)) {
+        return value;
+    }
+    const existing = clones.get(value);
+    if (existing !== undefined) {
+        return existing;
+    }
+    const inspectFrameworkContainer = shouldRecoverOpaqueProxyContainer(value, fallback);
+    if (!proxyDetectionAvailable && fallback === "provider-metadata") {
+        // Without host-level Proxy branding, unknown provider metadata cannot be
+        // reflected over safely. Keep it opaque instead of structured-cloning it,
+        // which would evaluate enumerable accessors. Known cacheControl metadata
+        // still follows the descriptor-first framework-container path.
+        return value;
+    }
+    if (!proxyDetectionAvailable && !inspectFrameworkContainer) {
+        try {
+            const clone = cloneStructuredValue(value);
+            clones.set(value, clone);
+            return clone;
+        }
+        catch (error) {
+            // Proxy branding is unavailable on browser and edge hosts. Compare the
+            // failure with trusted, host-local Proxy failures before reflecting over
+            // the value. Unlike matching engine-specific text, this remains valid
+            // across engines and localized exception messages. Framework-owned
+            // structured-system containers are copied from descriptors before this
+            // branch so metadata accessors stay inert. Unknown values still fail
+            // closed without reflective Proxy probes.
+            if (isOpaqueProxyCloneFailure(error)) {
+                return value;
+            }
+            if (getStructuredCloneFailureFingerprint(error) === undefined) {
+                return value;
+            }
+        }
+    }
+    const isArray = isArrayWithoutThrowing(value);
+    let prototype;
+    try {
+        prototype = ObjectGetPrototypeOf(value);
+    }
+    catch {
+        return value;
+    }
+    if (!isArray && !isOrdinaryRecordPrototype(prototype)) {
+        return value;
+    }
+    let descriptors;
+    try {
+        descriptors = ObjectGetOwnPropertyDescriptors(value);
+    }
+    catch {
+        return value;
+    }
+    const clone = isArray ? [] : ObjectCreate(prototype === null ? null : ObjectPrototype);
+    clones.set(value, clone);
+    const lengthDescriptor = isArray ? descriptors.length : undefined;
+    for (const key of ReflectOwnKeys(descriptors)) {
+        if (isArray && key === "length") {
+            continue;
+        }
+        const descriptor = descriptors[key];
+        if (!descriptor) {
+            continue;
+        }
+        if ("value" in descriptor) {
+            descriptor.value = cloneRuntimeStateMutableValue(descriptor.value, clones, proxyDetectionAvailable, getChildRuntimeStateCloneFallback(fallback, isArray, key, providerOptionKey), providerOptionKey);
+        }
+        ObjectDefineProperty(clone, key, descriptor);
+    }
+    if (lengthDescriptor) {
+        ObjectDefineProperty(clone, "length", lengthDescriptor);
+    }
+    return clone;
+}
+export function cloneRuntimeStateMutableData(value, proxyDetectionAvailable = canIdentifyProxyWithoutHooks, providerOptionKey) {
+    return cloneRuntimeStateMutableValue(value, new IntrinsicWeakMap(), proxyDetectionAvailable, "root", providerOptionKey);
+}
+function isTextSseChunk(chunk) {
+    const payload = new TextDecoder().decode(chunk);
+    if (!payload.startsWith("data: ")) {
+        return false;
+    }
+    try {
+        const event = JSON.parse(payload.slice("data: ".length));
+        return event.type === "text-start" || event.type === "text-delta" ||
+            event.type === "text-end";
+    }
+    catch {
+        return false;
+    }
+}
+function isTextEndSseChunk(chunk) {
+    const payload = new TextDecoder().decode(chunk);
+    if (!payload.startsWith("data: ")) {
+        return false;
+    }
+    try {
+        const event = JSON.parse(payload.slice("data: ".length));
+        return event.type === "text-end";
+    }
+    catch {
+        return false;
+    }
+}
+function textDeltaFromSseChunk(chunk) {
+    const payload = new TextDecoder().decode(chunk);
+    if (!payload.startsWith("data: ")) {
+        return undefined;
+    }
+    try {
+        const event = JSON.parse(payload.slice("data: ".length));
+        return event.type === "text-delta" && typeof event.delta === "string" ? event.delta : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function stripLeadingText(text, remainingPrefixLength) {
+    const consumedLength = Math.min(text.length, remainingPrefixLength);
+    return {
+        text: text.slice(consumedLength),
+        remainingPrefixLength: remainingPrefixLength - consumedLength,
+    };
+}
+function stripTextDeltaPrefixFromSseChunk(chunk, remainingPrefixLength, encoder) {
+    const payload = new TextDecoder().decode(chunk);
+    if (!payload.startsWith("data: ")) {
+        return { chunk, remainingPrefixLength };
+    }
+    try {
+        const event = JSON.parse(payload.slice("data: ".length));
+        if (event.type !== "text-delta" || typeof event.delta !== "string") {
+            return { chunk, remainingPrefixLength };
+        }
+        const stripped = stripLeadingText(event.delta, remainingPrefixLength);
+        if (stripped.text.length === 0) {
+            return { chunk: undefined, remainingPrefixLength: stripped.remainingPrefixLength };
+        }
+        return {
+            chunk: encoder.encode(`data: ${JSON.stringify({ ...event, delta: stripped.text })}\n\n`),
+            remainingPrefixLength: stripped.remainingPrefixLength,
+        };
+    }
+    catch {
+        return { chunk, remainingPrefixLength };
+    }
+}
+function rewriteRecoveryTextSseChunkId(chunk, fallbackId, encoder) {
+    const payload = new TextDecoder().decode(chunk);
+    if (!payload.startsWith("data: ")) {
+        return chunk;
+    }
+    try {
+        const event = JSON.parse(payload.slice("data: ".length));
+        if (event.type !== "text-start" && event.type !== "text-delta" &&
+            event.type !== "text-end") {
+            return chunk;
+        }
+        const id = typeof event.id === "string" && event.id.length > 0
+            ? `${event.id}:recovery`
+            : fallbackId;
+        return encoder.encode(`data: ${JSON.stringify({ ...event, id })}\n\n`);
+    }
+    catch {
+        return chunk;
+    }
+}
 function buildGeneratedAssistantMessage(response, metadata) {
     const parts = [];
     if (response.text)
@@ -212,13 +477,33 @@ const AGENT_WRITE_FINAL_RESPONSE_EXCLUDED_TOOL_NAMES = new Set([
 function shouldHideProjectToolAfterAgentWriteSuccess(toolName) {
     return AGENT_WRITE_FINAL_RESPONSE_EXCLUDED_TOOL_NAMES.has(toolName);
 }
-function applyAgentWriteFinalResponseGuard(plan) {
+function didReloadProjectAgentWriteTool(result) {
+    return result.matches.some((match) => match.status === "loaded" && shouldHideProjectToolAfterAgentWriteSuccess(match.name));
+}
+function compareToolNames(left, right) {
+    return left.name < right.name ? -1 : left.name > right.name ? 1 : 0;
+}
+function applyAgentWriteFinalResponseGuard(plan, options) {
     const keep = (tool) => !shouldHideProjectToolAfterAgentWriteSuccess(tool.name);
     for (const toolName of plan.loadedToolNames) {
         if (shouldHideProjectToolAfterAgentWriteSuccess(toolName)) {
             plan.loadedToolNames.delete(toolName);
         }
     }
+    if (options.reloadable) {
+        const guardedTools = plan.authorized.filter((tool) => !keep(tool));
+        const visible = plan.visible.filter(keep);
+        const deferredByName = new Map([...plan.deferred, ...guardedTools].map((tool) => [tool.name, tool]));
+        if (guardedTools.length > 0 &&
+            !visible.some((tool) => tool.name === TOOL_SEARCH_TOOL_NAME)) {
+            visible.push(createToolSearchDefinition());
+        }
+        return {
+            ...plan,
+            visible: visible.sort(compareToolNames),
+            deferred: [...deferredByName.values()].sort(compareToolNames),
+        };
+    }
     return {
         ...plan,
         authorized: plan.authorized.filter(keep),
@@ -226,11 +511,12 @@ function applyAgentWriteFinalResponseGuard(plan) {
         deferred: plan.deferred.filter(keep),
     };
 }
-function synchronizeRuntimeToolInventory(systemPrompt, runtimeTools) {
+function synchronizeRuntimeToolInventory(systemPrompt, runtimeTools, deferredTools = []) {
     if (!hasRuntimeToolInventory(systemPrompt)) {
         return systemPrompt;
     }
-    return flattenSystemInstructions(withRuntimeToolInventory(systemPrompt, Object.keys(runtimeTools ?? {}).sort()));
+    const instructions = withRuntimeToolInventory(systemPrompt, Object.keys(runtimeTools ?? {}).sort(), deferredTools);
+    return typeof systemPrompt === "string" ? flattenSystemInstructions(instructions) : instructions;
 }
 function parseToolResultJson(result) {
     try {
@@ -443,17 +729,23 @@ export class AgentRuntime {
             mode,
         });
     }
-    async resolveRuntimeState(messages, context, mode, step, systemPrompt) {
+    async resolveRuntimeState(messages, context, mode, step, systemPrompt, providerOptionKey) {
+        const structuredSystem = Array.isArray(systemPrompt) ? systemPrompt : undefined;
         const refreshed = await this.config.resolveRuntimeState?.({
             agentId: this.id,
             mode,
             step,
-            system: systemPrompt,
+            system: typeof systemPrompt === "string"
+                ? systemPrompt
+                : flattenSystemInstructions(systemPrompt),
+            ...(structuredSystem === undefined ? {} : {
+                structuredSystem: cloneRuntimeStateMutableData(structuredSystem, canIdentifyProxyWithoutHooks, providerOptionKey),
+            }),
             messages: [...messages],
             context,
         });
         return {
-            systemPrompt: refreshed?.system ?? systemPrompt,
+            systemPrompt: refreshed?.structuredSystem ?? refreshed?.system ?? systemPrompt,
             context: refreshed?.context ?? context,
         };
     }
@@ -504,7 +796,7 @@ export class AgentRuntime {
             });
             const inputMessages = normalizeInput(input);
             const messages = await this.prepareTurnMessages(inputMessages);
-            const systemPrompt = await this.resolveSystemPrompt();
+            const systemPrompt = await this.resolveSystemPrompt(transport.providerOptionKey);
             const agentContext = {
                 agentId: this.id,
                 model: resolvedModelString,
@@ -535,7 +827,7 @@ export class AgentRuntime {
         debugRuntimeModelRemap(requestedModel, resolvedModelString);
         const inputMessages = normalizeInput(messages);
         const memoryMessages = await this.prepareTurnMessages(inputMessages);
-        const systemPrompt = await this.resolveSystemPrompt();
+        const systemPrompt = await this.resolveSystemPrompt(transport.providerOptionKey);
         const encoder = new TextEncoder();
         const streamAbortController = new AbortController();
         const forwardAbort = () => {
@@ -698,6 +990,7 @@ export class AgentRuntime {
                     sandbox: undefined,
                 }
                 : runConfig;
+            const runtimeStepToolLoading = resolveRuntimeToolLoading(runtimeStepConfig);
             const allowedRemoteToolNames = hasToolReplacements
                 ? undefined
                 : getRuntimeAllowedRemoteTools(this.config);
@@ -735,7 +1028,8 @@ export class AgentRuntime {
                     allowedRemoteToolNames,
                     config: runtimeStepConfig,
                     effectiveModel,
-                    excludedToolNames: agentWriteFinalResponseToolGuardEnabled
+                    excludedToolNames: agentWriteFinalResponseToolGuardEnabled &&
+                        runtimeStepToolLoading.mode === "eager"
                         ? AGENT_WRITE_FINAL_RESPONSE_EXCLUDED_TOOL_NAMES
                         : undefined,
                     forwardedRemoteToolDefinitions,
@@ -743,6 +1037,8 @@ export class AgentRuntime {
                     supportsToolCalling,
                     messages: currentMessages,
                     mode: "generate",
+                    modelRuntime: languageModel,
+                    providerOptionKey: resolveModelProviderOptionKey(effectiveModel, languageModel),
                     providerToolNames: supportsToolCalling && !agentWriteFinalResponseToolGuardEnabled
                         ? providerTools
                         : [],
@@ -762,11 +1058,13 @@ export class AgentRuntime {
                 currentRuntimeContext = preparedStep.runtimeContext;
                 const toolContext = preparedStep.toolContext;
                 const effectiveToolExposurePlan = agentWriteFinalResponseToolGuardEnabled
-                    ? applyAgentWriteFinalResponseGuard(preparedStep.toolExposurePlan)
+                    ? applyAgentWriteFinalResponseGuard(preparedStep.toolExposurePlan, {
+                        reloadable: runtimeStepToolLoading.mode === "deferred",
+                    })
                     : preparedStep.toolExposurePlan;
                 const tools = effectiveToolExposurePlan.visible;
                 setSpanAttributes(loopSpan, {
-                    "tool.loading.mode": resolveRuntimeToolLoading(runtimeStepConfig).mode,
+                    "tool.loading.mode": runtimeStepToolLoading.mode,
                     "tool.loading.provenance": toolLoadingResolution.provenance,
                     "tool.catalog.authorized_count": preparedStep.toolExposurePlan.authorized.length,
                     "tool.catalog.visible_count": tools.length,
@@ -782,7 +1080,9 @@ export class AgentRuntime {
                     model: effectiveModel,
                     providerTools: stepProviderTools,
                 });
-                currentSystemPrompt = withIntegrationToolDiscoveryStatus(synchronizeRuntimeToolInventory(currentSystemPrompt, runtimeTools), preparedStep.integrationToolDiscovery);
+                currentSystemPrompt = withIntegrationToolDiscoveryStatus(synchronizeRuntimeToolInventory(currentSystemPrompt, runtimeTools, agentWriteFinalResponseToolGuardEnabled
+                    ? effectiveToolExposurePlan.deferred.filter((tool) => shouldHideProjectToolAfterAgentWriteSuccess(tool.name))
+                    : []), preparedStep.integrationToolDiscovery);
                 const response = await withSpan("agent.generate_text", async (span) => {
                     setSpanAttributes(span, {
                         "model.id": effectiveModel,
@@ -948,6 +1248,9 @@ export class AgentRuntime {
                                     plan: effectiveToolExposurePlan,
                                     state: toolExposureState,
                                 });
+                                if (didReloadProjectAgentWriteTool(search.result)) {
+                                    agentWriteFinalResponseToolGuardEnabled = false;
+                                }
                                 toolCall.status = "completed";
                                 toolCall.result = search.result;
                                 setSpanAttributes(toolSpan, {
@@ -1210,6 +1513,11 @@ export class AgentRuntime {
         let currentSystemPrompt = systemPrompt;
         let currentRuntimeContext = runtimeContext;
         let agentWriteFinalResponseToolGuardEnabled = false;
+        // One retry gives the model a chance to reconstruct a transport-truncated
+        // batch without allowing a repeatedly broken provider stream to loop.
+        let recoveredInterruptedLocalToolBatch = false;
+        let interruptedLocalToolBatchRecoveryStep;
+        let interruptedLocalToolBatchRecoveryText;
         for (let step = 0; step < maxSteps; step++) {
             throwIfAborted(abortSignal);
             sendSSE(controller, encoder, { type: "step-start" });
@@ -1224,7 +1532,8 @@ export class AgentRuntime {
                 allowedRemoteToolNames,
                 config: runtimeStepConfig,
                 effectiveModel,
-                excludedToolNames: agentWriteFinalResponseToolGuardEnabled
+                excludedToolNames: agentWriteFinalResponseToolGuardEnabled &&
+                    toolLoadingResolution.mode === "eager"
                     ? AGENT_WRITE_FINAL_RESPONSE_EXCLUDED_TOOL_NAMES
                     : undefined,
                 forwardedRemoteToolDefinitions,
@@ -1232,6 +1541,8 @@ export class AgentRuntime {
                 supportsToolCalling,
                 messages: currentMessages,
                 mode: "stream",
+                modelRuntime: languageModel,
+                providerOptionKey: resolveModelProviderOptionKey(effectiveModel, languageModel),
                 providerToolNames: supportsToolCalling && !agentWriteFinalResponseToolGuardEnabled
                     ? providerTools
                     : [],
@@ -1249,7 +1560,9 @@ export class AgentRuntime {
             currentRuntimeContext = preparedStep.runtimeContext;
             const toolContext = preparedStep.toolContext;
             const effectiveToolExposurePlan = agentWriteFinalResponseToolGuardEnabled
-                ? applyAgentWriteFinalResponseGuard(preparedStep.toolExposurePlan)
+                ? applyAgentWriteFinalResponseGuard(preparedStep.toolExposurePlan, {
+                    reloadable: toolLoadingResolution.mode === "deferred",
+                })
                 : preparedStep.toolExposurePlan;
             const tools = effectiveToolExposurePlan.visible;
             setOtelActiveSpanAttributes({
@@ -1268,7 +1581,9 @@ export class AgentRuntime {
                 model: effectiveModel,
                 providerTools: stepProviderTools,
             });
-            currentSystemPrompt = withIntegrationToolDiscoveryStatus(synchronizeRuntimeToolInventory(currentSystemPrompt, runtimeTools), preparedStep.integrationToolDiscovery);
+            currentSystemPrompt = withIntegrationToolDiscoveryStatus(synchronizeRuntimeToolInventory(currentSystemPrompt, runtimeTools, agentWriteFinalResponseToolGuardEnabled
+                ? effectiveToolExposurePlan.deferred.filter((tool) => shouldHideProjectToolAfterAgentWriteSuccess(tool.name))
+                : []), preparedStep.integrationToolDiscovery);
             const runtimeToolNames = Object.keys(runtimeTools ?? {}).sort();
             const temperature = this.resolveTemperature(temperatureModelString ?? effectiveModel, providerOptions);
             const maxOutputTokens = this.resolveMaxOutputTokens(effectiveModel, maxOutputTokensOverride);
@@ -1292,11 +1607,152 @@ export class AgentRuntime {
                 abortSignal: streamSignal,
             }));
             const state = createStreamState();
+            // Hold a possible replay only while it remains a prefix of the text the
+            // client already received. Once it diverges, resume live delivery.
+            const deferInterruptedRecoveryOutput = step === interruptedLocalToolBatchRecoveryStep &&
+                interruptedLocalToolBatchRecoveryText !== undefined;
+            const deferredRecoveryOutput = deferInterruptedRecoveryOutput ? [] : undefined;
+            const previousRecoveryText = interruptedLocalToolBatchRecoveryText ?? "";
+            let deferredRecoverySseText = "";
+            let deferredRecoveryCallbackText = "";
+            let releasedDeferredRecoveryOutput = false;
+            let releasedRecoveryReplacementTextPartId;
+            let suppressedRecoveryReplayTextLength = 0;
             const stepTextPartId = textPartId === undefined || step === 0
                 ? textPartId
                 : `${textPartId}:step:${step}`;
-            await processStream(streamSource, state, controller, encoder, stepTextPartId, {
-                onChunk: callbacks?.onChunk,
+            const replacementRecoveryTextPartId = stepTextPartId === undefined
+                ? `recovery:step:${step}`
+                : `${stepTextPartId}:recovery`;
+            const remainingRecoveryReplayText = () => previousRecoveryText.slice(suppressedRecoveryReplayTextLength);
+            const flushDeferredRecoveryOutput = (interruptedRecoveryPrefixLength, repeatsInterruptedRecoveryText, useReplacementTextPartId) => {
+                if (deferredRecoveryOutput === undefined)
+                    return;
+                let remainingSsePrefixLength = interruptedRecoveryPrefixLength;
+                let remainingCallbackPrefixLength = interruptedRecoveryPrefixLength;
+                for (const output of deferredRecoveryOutput) {
+                    if (repeatsInterruptedRecoveryText &&
+                        (output.kind === "callback" || output.isTextEvent)) {
+                        continue;
+                    }
+                    if (output.kind === "callback") {
+                        const stripped = stripLeadingText(output.chunk, remainingCallbackPrefixLength);
+                        remainingCallbackPrefixLength = stripped.remainingPrefixLength;
+                        if (stripped.text.length > 0) {
+                            callbacks?.onChunk?.(stripped.text);
+                        }
+                    }
+                    else {
+                        const textChunk = useReplacementTextPartId && output.isTextEvent
+                            ? rewriteRecoveryTextSseChunkId(output.chunk, replacementRecoveryTextPartId, encoder)
+                            : output.chunk;
+                        const stripped = output.isTextEvent
+                            ? stripTextDeltaPrefixFromSseChunk(textChunk, remainingSsePrefixLength, encoder)
+                            : { chunk: textChunk, remainingPrefixLength: remainingSsePrefixLength };
+                        remainingSsePrefixLength = stripped.remainingPrefixLength;
+                        if (stripped.chunk !== undefined) {
+                            controller.enqueue(stripped.chunk);
+                        }
+                    }
+                }
+                deferredRecoveryOutput.length = 0;
+            };
+            const releaseDeferredRecoveryOutputAfterDivergence = () => {
+                if (deferredRecoveryOutput === undefined || releasedDeferredRecoveryOutput)
+                    return;
+                const expectedReplayText = remainingRecoveryReplayText();
+                const sseDiverged = !expectedReplayText.startsWith(deferredRecoverySseText);
+                const callbackDiverged = callbacks?.onChunk === undefined ||
+                    !expectedReplayText.startsWith(deferredRecoveryCallbackText);
+                if (!sseDiverged || !callbackDiverged)
+                    return;
+                const observedRecoveryText = callbacks?.onChunk === undefined
+                    ? deferredRecoverySseText
+                    : deferredRecoveryCallbackText;
+                const extendsPreviousRecoveryText = observedRecoveryText.startsWith(expectedReplayText);
+                flushDeferredRecoveryOutput(extendsPreviousRecoveryText ? expectedReplayText.length : 0, false, !extendsPreviousRecoveryText && suppressedRecoveryReplayTextLength === 0);
+                if (extendsPreviousRecoveryText && suppressedRecoveryReplayTextLength > 0) {
+                    suppressedRecoveryReplayTextLength += expectedReplayText.length;
+                }
+                if (!extendsPreviousRecoveryText && suppressedRecoveryReplayTextLength === 0) {
+                    releasedRecoveryReplacementTextPartId = replacementRecoveryTextPartId;
+                }
+                releasedDeferredRecoveryOutput = true;
+            };
+            const releaseDeferredRecoveryOutputAfterExactReplay = (isTextEvent) => {
+                if (isTextEvent || deferredRecoveryOutput === undefined || releasedDeferredRecoveryOutput ||
+                    deferredRecoverySseText !== remainingRecoveryReplayText() ||
+                    (callbacks?.onChunk !== undefined &&
+                        deferredRecoveryCallbackText !== remainingRecoveryReplayText())) {
+                    return;
+                }
+                flushDeferredRecoveryOutput(remainingRecoveryReplayText().length, false, false);
+                releasedDeferredRecoveryOutput = true;
+            };
+            const releaseDeferredRecoveryNonTextOutput = (isTextEvent) => {
+                if (isTextEvent || deferredRecoveryOutput === undefined || releasedDeferredRecoveryOutput) {
+                    return;
+                }
+                const retainedOutput = deferredRecoveryOutput.filter((output) => output.kind === "callback" || output.isTextEvent);
+                for (const output of deferredRecoveryOutput) {
+                    if (output.kind === "sse" && !output.isTextEvent) {
+                        controller.enqueue(output.chunk);
+                    }
+                }
+                deferredRecoveryOutput.length = 0;
+                deferredRecoveryOutput.push(...retainedOutput);
+            };
+            const reconcileDeferredRecoveryTextSegment = (isTextEndEvent) => {
+                if (!isTextEndEvent || deferredRecoveryOutput === undefined ||
+                    releasedDeferredRecoveryOutput ||
+                    !remainingRecoveryReplayText().startsWith(deferredRecoverySseText) ||
+                    (callbacks?.onChunk !== undefined &&
+                        !remainingRecoveryReplayText().startsWith(deferredRecoveryCallbackText))) {
+                    return;
+                }
+                // A tool or reasoning event closes the current text segment. If that
+                // segment only replayed a prefix the client already received, discard
+                // it now and treat later text as a distinct segment. Otherwise retained
+                // prefix events could be released after the boundary when later text
+                // diverges, duplicating and reordering the replay.
+                suppressedRecoveryReplayTextLength += deferredRecoverySseText.length;
+                deferredRecoveryOutput.length = 0;
+                deferredRecoverySseText = "";
+                deferredRecoveryCallbackText = "";
+            };
+            const stepController = deferredRecoveryOutput === undefined ? controller : {
+                enqueue(chunk) {
+                    if (releasedDeferredRecoveryOutput) {
+                        controller.enqueue(releasedRecoveryReplacementTextPartId !== undefined
+                            ? rewriteRecoveryTextSseChunkId(chunk, releasedRecoveryReplacementTextPartId, encoder)
+                            : chunk);
+                        return;
+                    }
+                    deferredRecoverySseText += textDeltaFromSseChunk(chunk) ?? "";
+                    const isTextEvent = isTextSseChunk(chunk);
+                    deferredRecoveryOutput.push({
+                        kind: "sse",
+                        chunk,
+                        isTextEvent,
+                    });
+                    releaseDeferredRecoveryOutputAfterDivergence();
+                    releaseDeferredRecoveryOutputAfterExactReplay(isTextEvent);
+                    releaseDeferredRecoveryNonTextOutput(isTextEvent);
+                    reconcileDeferredRecoveryTextSegment(isTextEndSseChunk(chunk));
+                },
+            };
+            await processStream(streamSource, state, stepController, encoder, stepTextPartId, {
+                onChunk: deferredRecoveryOutput === undefined ? callbacks?.onChunk : (chunk) => {
+                    if (releasedDeferredRecoveryOutput) {
+                        callbacks?.onChunk?.(chunk);
+                        return;
+                    }
+                    deferredRecoveryCallbackText += chunk;
+                    if (callbacks?.onChunk !== undefined) {
+                        deferredRecoveryOutput.push({ kind: "callback", chunk });
+                    }
+                    releaseDeferredRecoveryOutputAfterDivergence();
+                },
                 onUsage: (usage) => accumulateUsage(totalUsage, usage),
                 providerExecutedToolNames: getProviderExecutedToolNames(runtimeTools),
                 availableToolNames: runtimeToolNames,
@@ -1312,19 +1768,79 @@ export class AgentRuntime {
                 },
             }, abortSignal);
             throwIfAborted(abortSignal);
+            const interruptedRecoveryPrefixLength = deferredRecoveryOutput === undefined
+                ? 0
+                : state.accumulatedText.startsWith(previousRecoveryText)
+                    ? previousRecoveryText.length
+                    : previousRecoveryText.startsWith(state.accumulatedText)
+                        ? state.accumulatedText.length
+                        : 0;
+            const recoveryPresentationPrefixLength = suppressedRecoveryReplayTextLength > 0
+                ? suppressedRecoveryReplayTextLength
+                : interruptedRecoveryPrefixLength;
+            const recoveryPresentationText = state.accumulatedText.slice(recoveryPresentationPrefixLength);
+            const repeatsInterruptedRecoveryText = interruptedRecoveryPrefixLength > 0 &&
+                recoveryPresentationText.length === 0;
+            if (deferredRecoveryOutput !== undefined && !releasedDeferredRecoveryOutput) {
+                flushDeferredRecoveryOutput(interruptedRecoveryPrefixLength, repeatsInterruptedRecoveryText, previousRecoveryText.length > 0 && interruptedRecoveryPrefixLength === 0 &&
+                    !repeatsInterruptedRecoveryText && state.accumulatedText.length > 0);
+            }
             finalFinishReason = state.finishReason ?? finalFinishReason;
-            const assistantMessage = buildStreamedAssistantMessage(state, {
+            const streamedToolCalls = Array.from(state.toolCalls.values());
+            const finalToolResults = collectFinalStreamToolResults(state);
+            // Recovery replays the whole step, so it also re-emits this step's
+            // reasoning — duplicating it in the live stream and in history, with a
+            // signature that no longer matches the replayed content. Reasoning that
+            // was persisted is reasoning the client already saw, so fail closed.
+            // This is a stopgap: reasoning is default-on across the hosted catalog,
+            // which makes recovery inert on most hosted paths. See #3736 for the
+            // reconciliation protocol that would let it run again.
+            const hasExposedReasoning = state.reasoningParts.some(isPersistedReasoningPart);
+            const canRecoverInterruptedLocalToolBatch = !recoveredInterruptedLocalToolBatch &&
+                step + 1 < maxSteps &&
+                !hasExposedReasoning;
+            const shouldContinue = shouldContinueAfterStreamStep(state, {
+                recoverInterruptedToolCalls: canRecoverInterruptedLocalToolBatch,
+            });
+            const shouldRecoverInterruptedLocalToolBatch = canRecoverInterruptedLocalToolBatch &&
+                shouldContinue &&
+                streamedToolCalls.some(isInterruptedClientToolCall);
+            // Exactly `shouldRecoverInterruptedLocalToolBatch` with the reasoning
+            // gate lifted: the batch this step would have replayed had it not
+            // already exposed reasoning. Re-asking is what separates "recovery was
+            // declined" from "this step merely carried reasoning";
+            // `shouldContinueAfterStreamStep` only reads state, so asking twice has
+            // no side effects, and the cheap conditions short-circuit ahead of it.
+            const declinedRecoveryForExposedReasoning = hasExposedReasoning &&
+                !recoveredInterruptedLocalToolBatch &&
+                step + 1 < maxSteps &&
+                streamedToolCalls.some(isInterruptedClientToolCall) &&
+                shouldContinueAfterStreamStep(state, { recoverInterruptedToolCalls: true });
+            if (declinedRecoveryForExposedReasoning) {
+                logger.warn("Declined interrupted local tool batch recovery after exposed reasoning", {
+                    step,
+                    toolName: streamedToolCalls.find(isInterruptedClientToolCall)?.name,
+                    reasoningPartCount: state.reasoningParts.filter(isPersistedReasoningPart).length,
+                });
+            }
+            const assistantMessage = buildStreamedAssistantMessage({
+                ...state,
+                accumulatedText: recoveryPresentationText,
+            }, {
                 id: `msg_${Date.now()}_${step}`,
                 timestamp: Date.now(),
+            }, {
+                preserveRecoverablePlaceholderToolCalls: shouldRecoverInterruptedLocalToolBatch ||
+                    !shouldContinue,
             });
             for (const tc of state.toolCalls.values()) {
                 const materialized = materializeStreamedToolCall(tc);
                 if (materialized.kind === "incomplete" && isRecoverablePlaceholderToolCall(tc)) {
                     // Provisional empty-object placeholder that never finalized. The
-                    // model never committed arguments. The assistant message builder
-                    // omits it when final text exists; otherwise it remains transparent
-                    // history while the loop recovers by re-calling the model. Surface no
-                    // termination warning or error.
+                    // model never committed arguments. Preserve it when recovery or
+                    // terminalization records a matching tool result; otherwise the
+                    // assistant message builder can omit it beside final text. Surface no
+                    // input warning or error for the provisional fragment.
                     continue;
                 }
                 if (materialized.kind === "incomplete") {
@@ -1357,10 +1873,22 @@ export class AgentRuntime {
                     });
                 }
             }
-            latestAssistantText = getTextFromParts(assistantMessage.parts);
+            const stepAssistantText = getTextFromParts(assistantMessage.parts);
+            if (step === interruptedLocalToolBatchRecoveryStep &&
+                suppressedRecoveryReplayTextLength > 0) {
+                latestAssistantText = `${previousRecoveryText}${recoveryPresentationText}`;
+            }
+            else if (step === interruptedLocalToolBatchRecoveryStep && interruptedRecoveryPrefixLength > 0) {
+                latestAssistantText = previousRecoveryText.startsWith(state.accumulatedText)
+                    ? previousRecoveryText
+                    : state.accumulatedText;
+            }
+            else if (hasSubstantiveAssistantText(stepAssistantText) ||
+                step !== interruptedLocalToolBatchRecoveryStep) {
+                latestAssistantText = stepAssistantText;
+            }
             currentMessages.push(assistantMessage);
             await this.memory.add(assistantMessage);
-            const finalToolResults = collectFinalStreamToolResults(state);
             const persistToolResult = async (toolResult) => {
                 if (currentStepToolResults.has(toolResult.toolCallId)) {
                     return;
@@ -1372,40 +1900,94 @@ export class AgentRuntime {
                 await this.memory.add(toolResultMessage);
                 currentStepToolResults.set(toolResult.toolCallId, toolResultMessage.parts[0]);
             };
-            if (!shouldContinueAfterStreamStep(state)) {
+            const recordIncompleteLocalToolError = async (toolCall, options = {}) => {
+                if (toolCall.providerExecuted === true ||
+                    !isStreamedToolCallIncomplete(toolCall) ||
+                    finalToolResults.has(toolCall.id)) {
+                    return false;
+                }
+                if (options.announceInput === true) {
+                    // An interrupted call never reached `tool-input-end`, so its
+                    // `tool-input-start` is still buffered and `inputAnnounced` is false
+                    // — which would suppress the `tool-output-error` below. On the
+                    // declined-recovery path that leaves the client with a reasoning
+                    // block and then nothing at all.
+                    //
+                    // The name is safe to publish here. `tool-call` is what can supersede
+                    // a name, and it also sets `inputAvailable`, which fails the guard
+                    // above — so reaching this line means no such event arrived and the
+                    // buffered name is the only one this call will ever have. It is the
+                    // same name recorded below and in the persisted assistant message,
+                    // so the card matches a reload. Announcing is idempotent, so a call
+                    // surfaced upstream is not reported twice.
+                    announceStreamedToolCallInput(controller, encoder, toolCall);
+                }
+                const incompleteToolCall = {
+                    id: toolCall.id,
+                    name: toolCall.name,
+                    args: {},
+                    ...(toolCall.arguments.length > 0 ? { inputText: toolCall.arguments } : {}),
+                    status: "pending",
+                };
+                await this.recordToolError(incompleteToolCall, `Stream terminated before tool-call event fired for "${toolCall.name}". ` +
+                    `Received ${toolCall.arguments.length} chars of partial tool-input deltas.`, controller, encoder, currentMessages, toolCalls, {
+                    emitSse: toolCall.inputAnnounced === true,
+                    includeInResponse: options.includeInResponse,
+                });
+                return true;
+            };
+            if (!shouldContinue) {
                 for (const toolResult of finalToolResults.values()) {
                     await persistToolResult(toolResult);
                 }
+                for (const toolCall of streamedToolCalls) {
+                    await recordIncompleteLocalToolError(toolCall, {
+                        announceInput: declinedRecoveryForExposedReasoning,
+                    });
+                }
                 sendSSE(controller, encoder, { type: "step-end" });
                 break;
             }
             this.status = "tool_execution";
-            const streamedToolCalls = Array.from(state.toolCalls.values());
+            if (shouldRecoverInterruptedLocalToolBatch) {
+                // Treat parallel local calls as one batch. Executing the finalized
+                // prefix here could apply only part of the model's intended mutation.
+                recoveredInterruptedLocalToolBatch = true;
+                interruptedLocalToolBatchRecoveryStep = step + 1;
+                interruptedLocalToolBatchRecoveryText = hasSubstantiveAssistantText(stepAssistantText)
+                    ? stepAssistantText
+                    : undefined;
+            }
             for (const tc of streamedToolCalls) {
                 throwIfAborted(abortSignal);
+                if (shouldRecoverInterruptedLocalToolBatch && tc.providerExecuted !== true) {
+                    if (await recordIncompleteLocalToolError(tc, { includeInResponse: false })) {
+                        continue;
+                    }
+                    const capturedInput = captureStreamedToolCallInput(tc);
+                    const interruptedBatchToolCall = {
+                        id: tc.id,
+                        name: tc.name,
+                        args: capturedInput.args,
+                        ...(capturedInput.inputText ? { inputText: capturedInput.inputText } : {}),
+                        status: "pending",
+                    };
+                    await this.recordToolError(interruptedBatchToolCall, "Tool execution skipped because another tool call in the same model step " +
+                        "was interrupted before its input completed.", controller, encoder, currentMessages, toolCalls);
+                    continue;
+                }
                 if (isRecoverablePlaceholderToolCall(tc)) {
-                    // Provisional empty-object placeholder that never finalized. The
-                    // model never committed arguments. At this point the continuation
-                    // gate has confirmed there is no final assistant text, so the loop
-                    // can continue and let the next model call recover the real tool
-                    // call without executing or surfacing a stream-termination error.
+                    // Provisional empty-object placeholder that never finalized. If the
+                    // bounded recovery path was unavailable, do not execute or surface
+                    // it as a committed call.
                     continue;
                 }
-                if (isStreamedToolCallIncomplete(tc)) {
+                if (await recordIncompleteLocalToolError(tc)) {
                     // Stream ended before the provider finalized this tool call. We
                     // cannot execute it, so record a distinct stream-termination error
                     // (not a tool-argument parse error) so the parent step and any
                     // upstream orchestrator (e.g. the child-fork watchdog) see a
                     // completed step with a clearly-labelled failure and can recover.
-                    const incompleteToolCall = {
-                        id: tc.id,
-                        name: tc.name,
-                        args: {},
-                        ...(tc.arguments.length > 0 ? { inputText: tc.arguments } : {}),
-                        status: "pending",
-                    };
-                    await this.recordToolError(incompleteToolCall, `Stream terminated before tool-call event fired for "${tc.name}". ` +
-                        `Received ${tc.arguments.length} chars of partial tool-input deltas.`, controller, encoder, currentMessages, toolCalls, { emitSse: tc.inputAnnounced === true });
                     continue;
                 }
                 const capturedInput = captureStreamedToolCallInput(tc);
@@ -1503,6 +2085,9 @@ export class AgentRuntime {
                             plan: effectiveToolExposurePlan,
                             state: toolExposureState,
                         });
+                        if (didReloadProjectAgentWriteTool(search.result)) {
+                            agentWriteFinalResponseToolGuardEnabled = false;
+                        }
                         toolCall.status = "completed";
                         toolCall.result = search.result;
                         toolCalls.push(toolCall);
@@ -1669,7 +2254,9 @@ export class AgentRuntime {
     async recordToolError(toolCall, errorStr, controller, encoder, currentMessages, toolCalls, options = {}) {
         toolCall.status = "error";
         toolCall.error = errorStr;
-        toolCalls.push(toolCall);
+        if (options.includeInResponse !== false) {
+            toolCalls.push(toolCall);
+        }
         if (options.emitSse !== false) {
             const dynamic = isDynamicTool(toolCall.name);
             sendSSE(controller, encoder, {
@@ -1686,13 +2273,11 @@ export class AgentRuntime {
     /**
      * Resolve system prompt (handle string or function)
      */
-    async resolveSystemPrompt() {
+    async resolveSystemPrompt(providerOptionKey) {
         const { system } = this.config;
-        if (typeof system === "string")
-            return system;
-        if (typeof system === "function")
-            return system();
-        return "You are a helpful assistant.";
+        if (system === undefined)
+            return "You are a helpful assistant.";
+        return await resolveAgentSystem(system, providerOptionKey);
     }
     /**
      * Compute max steps considering edge config and platform limits.