flowra 0.0.92.dev108__tar.gz → 0.0.92.dev110__tar.gz

{flowra-0.0.92.dev108 → flowra-0.0.92.dev110}/CHANGELOG.md

@@ -9,21 +9,25 @@ and this project adheres to [Semantic Versioning](https://semver.org).
 
 ### Added
 - **`BeforeToolCallsEvent`: answer a model message's tool calls before any
-  runs.** Emitted once per model message with tool calls, a single call
-  included, with every call of the message in `tool_uses`, a call the response cut off
-  included (an answer under its id is not used). A handler puts a
-  `ToolResult` into `results` under a call's id to answer that call itself:
-  it does not run, the other calls run as usual, and its result reaches the
-  model in the message's order. An answered call gets no
-  `BeforeToolCallEvent` and no `ToolCallSpan`; it goes through
-  `AfterToolCallEvent` and counts toward `max_consecutive_errors` like any
-  result. An error answered without an `error_kind` gets
-  `ToolErrorKind.EXECUTION`; a key that is not the id of a call in the message
-  raises `ValueError`. Answered calls are kept in the turn's state, so they
-  survive a resume before the results are collected.
+  runs.** It fires once per model message that has tool calls, even when it
+  has only one, and lists them in `tool_uses`. A handler puts a `ToolResult`
+  into `results` under a call's id: that call does not run, and the model gets
+  the handler's answer. Use it for a rule about the message as a whole, such as
+  a tool that must be called alone. Details in
+  [Pre-built events](docs/observability.md#pre-built-events).
 - **`AfterToolCallEvent.prefilled`**: true for a call answered in
   `BeforeToolCallsEvent`, so a handler can tell that the tool did not run.
 
+### Changed
+- **A call's answer carries an `error_kind` exactly when it is an error.** An
+  error that comes without a kind reaches `AfterToolCallEvent` and
+  `ToolCallSpan` as `ToolErrorKind.EXECUTION`, and an answer that is not an
+  error carries no kind. A consumer that tells an error by its kind now sees
+  every error. Details in [Error handling](docs/tools.md#errors-the-tool-chooses).
+- **A `BeforeToolCallEvent` handler that changes a call's `id` raises
+  `ValueError`.** The id ties a call to its result, so a replaced `tool_use`
+  keeps it.
+
 ## [0.0.91] - 2026-10-20
 
 ### Added

{flowra-0.0.92.dev108 → flowra-0.0.92.dev110}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: flowra
-Version: 0.0.92.dev108
+Version: 0.0.92.dev110
 Summary: Flowra — flow infrastructure for building stateful LLM agents
 Project-URL: Repository, https://github.com/anna-money/flowra
 Project-URL: Changelog, https://github.com/anna-money/flowra/blob/master/CHANGELOG.md

{flowra-0.0.92.dev108 → flowra-0.0.92.dev110}/context7.json

@@ -48,7 +48,7 @@
     "McpConnection connects to remote MCP servers for tool discovery over Streamable HTTP. McpConnection.snapshot() returns a frozen ToolRegistry; the tool list is refreshed in the background (server ttlMs, 60s default) with add_on_tools_changed(callback) for changes, and tools with invalid x-mcp-header annotations are dropped. Speaks both MCP protocol eras and detects on connect: stateless 2026-07-28 (no handshake/session; x-mcp-header args mirrored into Mcp-Param-* headers) and handshake-based 2025-03-26 to 2025-11-25 (any other version fails connect()). McpConnection.session (McpSession) exposes stateless: bool, protocol_version and session_id. A tool call needing client input (MRTR) returns a tool error; subscriptions/listen and MRTR are not implemented. McpConnection.call_tool(name, args, headers=..., meta=...) adds per-call HTTP headers and params._meta (kept on the reconnect retry; Content-Type/Accept/Mcp-* headers and the protocol's io.modelcontextprotocol/* _meta keys raise ValueError)",
     "ToolCallInfo (flowra.tools) carries per-call headers and meta, empty by default — flowra sets none itself. Fill them in a BeforeToolCallEvent handler (event.data.headers / event.data.meta); they are stored in ToolCallSpec, so a resumed call gets the same values (generate idempotency keys there, not in the tool). ToolCallAgent passes ToolCallInfo in services: MCP snapshot tools send them with tools/call, a @tool reads them by declaring an info: ToolCallInfo parameter",
     "ToolRegistry is immutable, accepts @tool-decorated functions or ExecutableTools: ToolRegistry([my_func, other_func])",
-    "TOOL ERRORS: the executor built by @tool catches the decorated function's exceptions (and argument validation/service binding errors) and returns ToolResult(content='Error: {e}', is_error=True, error_kind=EXECUTION, or SCHEMA_VALIDATION for invalid arguments) — so registry.execute and a direct get_tool(f).executor(...) call both return the error result. A ToolResult the function returns is the answer as it is (not serialized); ToolResult.content is str | list[TextBlock | MediaBlock], and ToolCallAgent puts its blocks into the ToolResultBlock as they are (metadata and transient kept; a str is one TextBlock; ToolResult.blocks / ToolResult.text). A '-> ToolResult' annotation gives no output_schema; '-> Answer | ToolResult' gives Answer's. raise ToolError(content, error_kind=EXECUTION) (str or blocks) to answer with an error the tool chose: the executor returns exc.result (is_error=True, content as written, no 'Error: ' prefix, no log); only the @tool executor answers it — an agent behind an agent tool returns ToolResult(is_error=True) instead, and a ToolError raised in an agent fails the run like any exception. InterruptedError is the exception: the executor raises it, and ToolCallAgent answers 'Tool execution interrupted'. ToolRegistry.execute does not catch: an exception from code around an executor (a wrapper via dataclasses.replace(tool, executor=...), a custom ExecutableTool executor) propagates through ToolCallAgent to AgentRuntime.run/resume as itself (session stays resumable); return ToolResult(is_error=True) from such code to answer the model. ToolCallAgent answers InterruptedError raised around a tool with 'Tool execution interrupted'. McpConnection never raises for a call, except ValueError for invalid per-call headers/_meta (set by a BeforeToolCallEvent handler, it fails the run and a resume repeats it, since the values are stored with the call): unknown/removed tools → UNKNOWN_TOOL; a result's MCP content comes back as blocks (text and resource text → TextBlock; image, audio and resource blob → MediaBlock; resource_link and unknown types → TextBlock with the block as JSON), with what the flowra block does not carry in metadata['mcp'] (text/image/audio: every field but type, content (text/data) and, for media, mimeType (annotations, _meta, any other), no metadata when none, so plain text is a plain TextBlock; resource: the whole block but the resource's text/blob, uri and mimeType under metadata['mcp']['resource']; resource_link and unknown types: type, annotations, _meta); a malformed block makes the response invalid; isError → the server's blocks, JSON-RPC errors → the server's text; transport failures → 'temporarily unavailable' (retried once if the reconnect succeeds); invalid responses → 'returned an invalid response', not retried. When one of several parallel steps (e.g. parallel tool calls) raises, the engine cancels and awaits its siblings, then re-raises the original exception (no ExceptionGroup). Agent tool executors (make_agent_tool/@agent_tool) answer invalid arguments with SCHEMA_VALIDATION/EXECUTION results like @tool; with valid arguments, one called outside ToolCallAgent raises RuntimeError",
+    "TOOL ERRORS: the executor built by @tool catches the decorated function's exceptions (and argument validation/service binding errors) and returns ToolResult(content='Error: {e}', is_error=True, error_kind=EXECUTION, or SCHEMA_VALIDATION for invalid arguments) — so registry.execute and a direct get_tool(f).executor(...) call both return the error result. A ToolResult the function returns is the answer as it is (not serialized), except that what hooks and spans see (ToolCallResult, AfterToolCallEvent, ToolCallSpan) carries an error_kind exactly when it is an error — EXECUTION for an error given without one, None for a non-error; ToolResult.content is str | list[TextBlock | MediaBlock], and ToolCallAgent puts its blocks into the ToolResultBlock as they are (metadata and transient kept; a str is one TextBlock; ToolResult.blocks / ToolResult.text). A '-> ToolResult' annotation gives no output_schema; '-> Answer | ToolResult' gives Answer's. raise ToolError(content, error_kind=EXECUTION) (str or blocks) to answer with an error the tool chose: the executor returns exc.result (is_error=True, content as written, no 'Error: ' prefix, no log); only the @tool executor answers it — an agent behind an agent tool returns ToolResult(is_error=True) instead, and a ToolError raised in an agent fails the run like any exception. InterruptedError is the exception: the executor raises it, and ToolCallAgent answers 'Tool execution interrupted'. ToolRegistry.execute does not catch: an exception from code around an executor (a wrapper via dataclasses.replace(tool, executor=...), a custom ExecutableTool executor) propagates through ToolCallAgent to AgentRuntime.run/resume as itself (session stays resumable); return ToolResult(is_error=True) from such code to answer the model. ToolCallAgent answers InterruptedError raised around a tool with 'Tool execution interrupted'. McpConnection never raises for a call, except ValueError for invalid per-call headers/_meta (set by a BeforeToolCallEvent handler, it fails the run and a resume repeats it, since the values are stored with the call): unknown/removed tools → UNKNOWN_TOOL; a result's MCP content comes back as blocks (text and resource text → TextBlock; image, audio and resource blob → MediaBlock; resource_link and unknown types → TextBlock with the block as JSON), with what the flowra block does not carry in metadata['mcp'] (text/image/audio: every field but type, content (text/data) and, for media, mimeType (annotations, _meta, any other), no metadata when none, so plain text is a plain TextBlock; resource: the whole block but the resource's text/blob, uri and mimeType under metadata['mcp']['resource']; resource_link and unknown types: type, annotations, _meta); a malformed block makes the response invalid; isError → the server's blocks, JSON-RPC errors → the server's text; transport failures → 'temporarily unavailable' (retried once if the reconnect succeeds); invalid responses → 'returned an invalid response', not retried. When one of several parallel steps (e.g. parallel tool calls) raises, the engine cancels and awaits its siblings, then re-raises the original exception (no ExceptionGroup). Agent tool executors (make_agent_tool/@agent_tool) answer invalid arguments with SCHEMA_VALIDATION/EXECUTION results like @tool; with valid arguments, one called outside ToolCallAgent raises RuntimeError",
     "ToolRegistry.builder() returns ToolRegistryBuilder with .add(source, prefix=..., filter=..., on_duplicate='error'|'skip') and .build() for composing registries from multiple sources. filter is a single Callable[[ExecutableTool], bool]; use the `tool_filter` module for common cases: tool_filter.INCLUDE_SUFFIX(*names) whitelists, tool_filter.EXCLUDE_SUFFIX(*names) blacklists (both match exact name or __name suffix), tool_filter.ALL_OF(*filters)/tool_filter.ANY_OF(*filters) compose. Import: from flowra.tools import tool_filter",
     "Duplicate tool names are detected eagerly at the ToolRegistryBuilder.add() call where the collision is introduced. Default on_duplicate='error' raises ValueError; on_duplicate='skip' silently drops repeats (first occurrence wins). ToolRegistry(...) constructor also raises on duplicate names. OnDuplicate type alias is exported from flowra.tools",
     "ToolRegistry is a ConfigValue[ToolRegistry | None] in ChatConfig and TurnConfig (field name: tools)",
@@ -134,7 +134,7 @@
     "RENDER: ChatConfig.render / TurnConfig.render (PromptRender = Callable[[Prompt], Prompt | Awaitable[Prompt]]; Prompt from flowra.lib.turn has system and messages) is called once per LLM call of the turn (not per fallback attempt), before LLMCaller, with the system messages and the conversation (history, then turn messages). What it returns is sent to every fallback link; each link's request_extensions apply after it, and each attempt's LLMCallSpan carries the request with them applied. Stored history and turn messages are not changed, so a marker block can be rendered from live state on each call; build new messages, never edit the given ones. Messages left with no blocks are not sent, none left at all is a ValueError before the call; a tool call must still be followed straight away by its results (Claude and OpenAI Chat Completions reject anything in between); an error in render is raised from the turn as is; an interrupt stops an async render and ends the turn INTERRUPTED",
     "TurnAgent lifecycle: __post_init__ emits TurnReadyEvent(context, turn_messages) — fires on both creation and crash recovery. ChatAgent subscribes and emits ConversationReadyEvent(conversation, context) with a Conversation view combining history + turn messages",
     "Conversation class (from flowra.lib.chat): read-only Sequence view over history + turn_messages. Supports len(), indexing, slicing, forward/reverse iteration. Live — reflects changes to underlying lists. Properties: history_len, turn_len. Method without_pending_tool_use() -> list[UserMessage | AssistantMessage] returns messages with ToolUseBlocks stripped from the last AssistantMessage (drops the message entirely if it becomes empty) — use it inside an agent-as-tool to feed the parent conversation to a child LLM call without the unresolved tool-use that spawned it",
-    "TurnAgent hook events: StartTurnEvent (messages, metadata — mutate messages to augment input), MessageAcceptedEvent, StartIterationEvent, TextReasoningEvent (each TextBlock with text in response), ThinkingEvent (each ThinkingBlock with text; not redacted or signature-only thoughts), ServerToolCallEvent (server-side tool call from intermediate messages, e.g. tool search), ServerToolResultEvent (server-side tool result), ResultMessageEvent, BeforeToolCallsEvent (once per model message with tool calls, before any runs; tool_uses is every call of the message, a cut-off call included (an answer under its id is not used); put a ToolResult into results under a call's id to answer it without running it — that call gets no BeforeToolCallEvent and no ToolCallSpan, its result goes through AfterToolCallEvent with prefilled=True and max_consecutive_errors in message order, an error without error_kind gets EXECUTION; a key not among the message's call ids raises ValueError), BeforeToolCallEvent (has tool_definition: ToolDefinition | None; mutable tool_use, headers, meta — see ToolCallInfo; not emitted for a call answered in BeforeToolCallsEvent), AfterToolCallEvent (fires after execution, and for a call answered in BeforeToolCallsEvent; has error_kind; prefilled is true for a call answered in BeforeToolCallsEvent; result is a single ToolResultBlock; append TextBlock/MediaBlock to additional_blocks to attach them to this call's result — they go at the end of its content, also when max_consecutive_errors replaces it, so they stay with their call and never land between the results of parallel calls; mark one transient to keep it out of saved history; being part of the result, a MediaBlock there takes the providers' rules for media in a tool result (Chat Completions raises, Gemini before 3 does not see it) and a transient block ends the non-transient cache prefix before the result). Delta events: TextDeltaEvent, ThinkingDeltaEvent (from flowra.lib.observability — shared with LLMCallAgent). UsageEvent emitted after each LLM call + subscribed to accumulate usage from child agents (e.g. agent_as_tool). Span-hooks: LLMCallSpan, ToolCallSpan. Request transforms (prompt caching, tool search) are NOT hooks — they live on LLMConfig.request_extensions. A conversation transform for every fallback link goes in ChatConfig.render / TurnConfig.render (see RENDER)",
+    "TurnAgent hook events: StartTurnEvent (messages, metadata — mutate messages to augment input), MessageAcceptedEvent, StartIterationEvent, TextReasoningEvent (each TextBlock with text in response), ThinkingEvent (each ThinkingBlock with text; not redacted or signature-only thoughts), ServerToolCallEvent (server-side tool call from intermediate messages, e.g. tool search), ServerToolResultEvent (server-side tool result), ResultMessageEvent, BeforeToolCallsEvent (once per model message that has tool calls, even when it has only one, before any runs; tool_uses is every call of the message, a cut-off call included (an answer under its id is not used); put a ToolResult into results under a call's id to answer it without running it — that call gets no BeforeToolCallEvent and no ToolCallSpan, its result goes through AfterToolCallEvent with prefilled=True and max_consecutive_errors in message order, an error without error_kind gets EXECUTION; an answered call is not looked up in the registry, so an answer to an unknown or denied tool reaches the model as given, not as Unknown tool; a key not among the message's call ids raises ValueError), BeforeToolCallEvent (has tool_definition: ToolDefinition | None; mutable tool_use (a replacement keeps the call's id; changing it raises ValueError), headers, meta — see ToolCallInfo; not emitted for a call answered in BeforeToolCallsEvent), AfterToolCallEvent (fires after execution, and for a call answered in BeforeToolCallsEvent; has error_kind; prefilled is true for a call answered in BeforeToolCallsEvent; result is a single ToolResultBlock; append TextBlock/MediaBlock to additional_blocks to attach them to this call's result — they go at the end of its content, also when max_consecutive_errors replaces it, so they stay with their call and never land between the results of parallel calls; mark one transient to keep it out of saved history; being part of the result, a MediaBlock there takes the providers' rules for media in a tool result (Chat Completions raises, Gemini before 3 does not see it) and a transient block ends the non-transient cache prefix before the result). Delta events: TextDeltaEvent, ThinkingDeltaEvent (from flowra.lib.observability — shared with LLMCallAgent). UsageEvent emitted after each LLM call + subscribed to accumulate usage from child agents (e.g. agent_as_tool). Span-hooks: LLMCallSpan, ToolCallSpan. Request transforms (prompt caching, tool search) are NOT hooks — they live on LLMConfig.request_extensions. A conversation transform for every fallback link goes in ChatConfig.render / TurnConfig.render (see RENDER)",
     "When TextDeltaEvent or ThinkingDeltaEvent handlers are registered, TurnAgent automatically uses provider.stream() instead of provider.call()",
 
     "AGENTS AS TOOLS: Tools can delegate to sub-agents via ToolCallAgentContext.call_agent(). make_agent_tool(AgentClass, name, description) creates an ExecutableTool with input_schema from spec type and output_schema from result type (ToolResult excluded). @agent_tool decorator marks an agent class as a tool, get_agent_tool() extracts the ExecutableTool. ToolCallAgent spawns the sub-agent and serializes its result as a ToolResultBlock. Agent tools can return ToolResult directly to signal errors to the parent LLM or answer with blocks (e.g. return ToolResult(content='...', is_error=True)) — the agent completes normally; with is_error=True the parent LLM sees a tool error and can retry. Compile-time validation: step return types must be a subset of Agent's generic result type parameter. The sub-agent must be declared by the agent running the tool or one of its registry ancestors (top level works); it receives services of its own registry ancestors, not the calling chat's (unless the chat is one of them)",

{flowra-0.0.92.dev108 → flowra-0.0.92.dev110}/docs/agents.md

@@ -808,9 +808,10 @@ Lifecycle events (from `flowra.lib.turn`):
 | `ResultMessageEvent`     | LLM finished (END_TURN)                  | `continue_messages`                           |
 
 A tool call cut off by the output limit appears in `BeforeToolCallsEvent` but
-fires no `BeforeToolCallEvent` or `AfterToolCallEvent`, and a call answered in
-`BeforeToolCallsEvent` does not run; see
-[Pre-built events](observability.md#pre-built-events) in Observability.
+fires no `BeforeToolCallEvent` or `AfterToolCallEvent`. A call a handler answers
+in `BeforeToolCallsEvent.results` does not run; it still fires
+`AfterToolCallEvent`. See [Pre-built events](observability.md#pre-built-events)
+in Observability.
 
 Streaming events (from `flowra.lib.observability`):
 

{flowra-0.0.92.dev108 → flowra-0.0.92.dev110}/docs/observability.md

@@ -69,21 +69,18 @@ def add_hint(event: Event[AfterToolCallEvent]) -> None:
 runtime.hooks.on(AfterToolCallEvent, add_hint)
 ```
 
-A tool call cut off by the output limit (see [TurnAgent](agents.md#turnagent)) is
-never executed. It gets an error result directly, with no `BeforeToolCallEvent`,
-`AfterToolCallEvent` or `ToolCallSpan`, so hooks that audit or rewrite tool
-results don't see it; it does appear in `BeforeToolCallsEvent.tool_uses`, and an
-answer put under its id is not used.
-
-`BeforeToolCallsEvent` fires once per model message with tool calls, a single
-call included, before any of them runs. A handler answers a call itself by
-putting a `ToolResult` into `results` under the call's id: that call does not
+`BeforeToolCallsEvent` fires once per model message that has tool calls, even
+when it has only one, before any of them runs. A handler answers a call itself
+by putting a `ToolResult` into `results` under the call's id: that call does not
 run, and the others run as usual. An answered call gets no `BeforeToolCallEvent`
 and no `ToolCallSpan`; its result goes through `AfterToolCallEvent` (with
 `prefilled=True`) and `max_consecutive_errors` like any other, in the message's
 order. An error answered without an `error_kind` arrives with
-`ToolErrorKind.EXECUTION`. A key that is not the id of a call in the message
-fails the step with `ValueError`.
+`ToolErrorKind.EXECUTION`, as any error a tool gives without one does. An
+answered call is not looked up in the registry, so a handler can answer a call
+to a tool that is unknown or denied: the model gets the handler's answer, not
+`Unknown tool`. A key that is not the id of a call in the message raises
+`ValueError`.
 
 ```python
 from flowra.agent import Event
@@ -104,6 +101,12 @@ def reply_alone(event: Event[BeforeToolCallsEvent]) -> None:
 runtime.hooks.on(BeforeToolCallsEvent, reply_alone)
 ```
 
+A tool call cut off by the output limit (see [TurnAgent](agents.md#turnagent)) is
+never executed. It gets an error result directly, with no `BeforeToolCallEvent`,
+`AfterToolCallEvent` or `ToolCallSpan`, so hooks that audit or rewrite tool
+results don't see it. It does appear in `BeforeToolCallsEvent.tool_uses`, but an
+answer put under its id is not used.
+
 A tool call that fails the run (an exception raised around a tool's executor,
 see [Error handling](tools.md#what-fails-the-run)) has no result:
 `AfterToolCallEvent` doesn't fire, and its `ToolCallSpan` closes with `error`
@@ -137,8 +140,10 @@ runtime = AgentRuntime(agents={...}, services={...})
 runtime.hooks.on(BeforeToolCallEvent, on_before_tool)
 ```
 
-A `BeforeToolCallEvent` handler can also fill `headers` and `meta` to pass
-per-call data to the tool — see [ToolCallInfo](tools.md#toolcallinfo).
+A `BeforeToolCallEvent` handler can replace `tool_use` to change a call's input,
+but the new block keeps the call's `id`: changing the id raises `ValueError`.
+It can also fill `headers` and `meta` to pass per-call data to the
+tool — see [ToolCallInfo](tools.md#toolcallinfo).
 
 Use `event.context.find_spec(SpecType)` to walk the execution stack and find
 the spec of a parent agent — useful for identifying which model or session is

{flowra-0.0.92.dev108 → flowra-0.0.92.dev110}/docs/tools.md

@@ -684,8 +684,11 @@ async def respond(params: RespondParams) -> Sent:
 `ToolError(content, error_kind=ToolErrorKind.EXECUTION)` takes a string or a
 list of blocks; `exc.result` is the `ToolResult` it stands for. Returning
 `ToolResult(content=..., is_error=True, error_kind=ToolErrorKind.EXECUTION)`
-gives the same answer (without `error_kind`, the model sees the same, but hooks
-and spans get `None`).
+gives the same answer. Without `error_kind`, an error still reaches hooks and
+spans as `EXECUTION`. What they receive (`ToolCallResult`, `AfterToolCallEvent`,
+`ToolCallSpan`) carries a kind exactly when it is an error, so there
+`error_kind is not None` and `is_error` never disagree. The `ToolResult` that
+`registry.execute` returns keeps the kind the tool gave it.
 
 `ToolError` is for `@tool` functions: only their executor answers it. An agent
 behind an [agent tool](#agents-as-tools) returns its error as a `ToolResult`

{flowra-0.0.92.dev108 → flowra-0.0.92.dev110}/flowra/lib/turn/agent.py

@@ -36,7 +36,7 @@ from ...llm import (
     Usage,
     UserMessage,
 )
-from ...tools import ToolErrorKind, ToolRegistry, ToolResult
+from ...tools import ToolRegistry
 from ..config_value import resolve_config_value
 from ..llm_caller import DEFAULT_LLM_CALLER, LLMCaller
 from ..observability import UsageEvent
@@ -64,9 +64,18 @@ __all__ = ["TurnAgent"]
 logger = logging.getLogger(__name__)
 
 
+@dataclasses.dataclass(frozen=True, slots=True, kw_only=True)
+class _AnsweredCalls:
+    """The calls a ``BeforeToolCallsEvent`` handler answered, with the ids of the message's calls that can run,
+    in the message's order."""
+
+    results: list[ToolCallResult]
+    call_order: list[str]
+
+
 class TurnAgent(Agent[TurnSpec, TurnResult]):
     __slots__ = (
-        "__answered_tool_results",
+        "__answered_calls",
         "__caller",
         "__config",
         "__consecutive_errors",
@@ -99,7 +108,7 @@ class TurnAgent(Agent[TurnSpec, TurnResult]):
         self.__usage = store.ephemeral.slot(Scalar[Usage | None], "usage")
         self.__consecutive_errors = store.ephemeral.slot(Scalar[dict[str, int]], "consecutive_errors")
         self.__incomplete_tool_result = store.ephemeral.slot(Scalar[ToolResultBlock | None], "incomplete_tool_result")
-        self.__answered_tool_results = store.ephemeral.slot(Scalar[list[ToolCallResult]], "answered_tool_results")
+        self.__answered_calls = store.ephemeral.slot(Scalar[_AnsweredCalls | None], "answered_calls")
         self.__interrupt = interrupt
         self.__context = TurnAgentContext()
         self.__config = config
@@ -294,9 +303,9 @@ class TurnAgent(Agent[TurnSpec, TurnResult]):
         consecutive_errors = dict(self.__consecutive_errors.get({}))
         max_consecutive = await resolve_config_value(self.__config.max_consecutive_errors)
 
-        answered = self.__answered_tool_results.get([])
-        answered_ids = {tc_result.tool_use.id for tc_result in answered}
-        collected = self.__in_message_order([*answered, *results]) if answered else results
+        answered = self.__answered_calls.get(None)
+        answered_ids = {tc_result.tool_use.id for tc_result in answered.results} if answered is not None else set()
+        collected = self.__in_call_order(answered, results) if answered is not None else results
         for tc_result in collected:
             after_event = await self.__hooks.emit(
                 AfterToolCallEvent(
@@ -341,8 +350,8 @@ class TurnAgent(Agent[TurnSpec, TurnResult]):
         if incomplete_result is not None:
             result_blocks.append(incomplete_result)
             self.__incomplete_tool_result.set(None)
-        if answered:
-            self.__answered_tool_results.set([])
+        if answered is not None:
+            self.__answered_calls.set(None)
 
         self.__consecutive_errors.set(consecutive_errors)
         user_message = UserMessage(blocks=list(result_blocks))
@@ -395,12 +404,14 @@ class TurnAgent(Agent[TurnSpec, TurnResult]):
                 raise ValueError(f"No tool call {tool_use_id!r} in this message")
         # Answers are taken from the calls that can run, so the cut-off call keeps its own error result
         answered = [
-            self.__answered_result(tool_use, calls_event.results[tool_use.id])
+            ToolCallResult.from_tool_result(tool_use, calls_event.results[tool_use.id])
             for tool_use in tool_uses
             if tool_use.id in calls_event.results
         ]
         if answered:
-            self.__answered_tool_results.set(answered)
+            self.__answered_calls.set(
+                _AnsweredCalls(results=answered, call_order=[tool_use.id for tool_use in tool_uses])
+            )
 
         amendments: dict[str, ToolUseBlock] = {}
         final_calls: list[BeforeToolCallEvent] = []
@@ -414,6 +425,11 @@ class TurnAgent(Agent[TurnSpec, TurnResult]):
                     context=self.__context,
                 )
             )
+            if before_event.tool_use.id != tool_use.id:
+                raise ValueError(
+                    f"A BeforeToolCallEvent handler changed the id of tool call {tool_use.id!r} to "
+                    f"{before_event.tool_use.id!r}; a call's id must stay as the model gave it"
+                )
             final_calls.append(before_event)
             if before_event.tool_use is not tool_use:
                 amendments[tool_use.id] = before_event.tool_use
@@ -443,22 +459,12 @@ class TurnAgent(Agent[TurnSpec, TurnResult]):
         ]
         return Spawn(children=children, then=self.collect_results)
 
-    def __in_message_order(self, results: list[ToolCallResult]) -> list[ToolCallResult]:
-        # Every collected call, answered or run, is one of the last assistant message in the turn
-        message = next(m for m in reversed(self.__turn_messages.get_all()) if isinstance(m, AssistantMessage))
-        position = {block.id: i for i, block in enumerate(message.blocks) if isinstance(block, ToolUseBlock)}
-        return sorted(results, key=lambda tc_result: position[tc_result.tool_use.id])
-
     @staticmethod
-    def __answered_result(tool_use: ToolUseBlock, result: ToolResult) -> ToolCallResult:
-        # Consumers tell an error by its kind: an error answered without one gets the default ToolError uses,
-        # and an answer that is not an error carries none
-        error_kind = (result.error_kind or ToolErrorKind.EXECUTION) if result.is_error else None
-        return ToolCallResult(
-            tool_use=tool_use,
-            result=ToolResultBlock(tool_use_id=tool_use.id, content=result.blocks, is_error=result.is_error),
-            error_kind=error_kind,
-        )
+    def __in_call_order(answered: _AnsweredCalls, results: list[ToolCallResult]) -> list[ToolCallResult]:
+        # By the order the message's calls had when they were made, kept beside the answers: it holds
+        # whatever the history looks like by the time the results are collected
+        position = {tool_use_id: i for i, tool_use_id in enumerate(answered.call_order)}
+        return sorted([*answered.results, *results], key=lambda tc_result: position[tc_result.tool_use.id])
 
     @staticmethod
     def __incomplete_tool_use_message(stop_reason: StopReason) -> str:

{flowra-0.0.92.dev108 → flowra-0.0.92.dev110}/flowra/lib/turn/hook_events.py

@@ -105,6 +105,8 @@ class BeforeToolCallsEvent:
     An answer under the cut-off call's id is not used: that call always gets its own error result.
     Put a ``ToolResult`` into ``results`` under a call's id to answer it without running it: the
     other calls run as usual, and the result reaches the model as that call's answer.
+    An answered call is not looked up in the registry, so a handler can answer a call to a tool that
+    is unknown or denied: the model gets the handler's answer, not ``Unknown tool``.
     """
 
     tool_uses: list[ToolUseBlock]
@@ -117,7 +119,8 @@ class BeforeToolCallEvent:
     """Emitted before each tool execution.
 
     Replace ``tool_use`` to modify tool parameters (e.g. sanitize input,
-    inject defaults).
+    inject defaults). The replacement keeps the call's ``id``: changing it
+    raises ``ValueError``.
 
     Fill ``headers`` and ``meta`` to pass per-call data the model never sees:
     MCP tools send them as HTTP headers and ``params._meta`` of the

{flowra-0.0.92.dev108 → flowra-0.0.92.dev110}/flowra/lib/turn/tool_call/agent.py

@@ -43,10 +43,29 @@ class ToolCallSpec:
 
 @dataclasses.dataclass(frozen=True, slots=True, kw_only=True)
 class ToolCallResult:
+    """A call's answer as the turn reads it.
+
+    ``error_kind`` is set exactly when ``result.is_error``: an error the tool gave no kind is ``EXECUTION``,
+    the kind ``ToolError`` defaults to, and an answer that is not an error carries none. Hooks and spans tell
+    an error by its kind, so the two never disagree.
+    """
+
     tool_use: ToolUseBlock
     result: ToolResultBlock
     error_kind: ToolErrorKind | None = None
 
+    def __post_init__(self) -> None:
+        error_kind = (self.error_kind or ToolErrorKind.EXECUTION) if self.result.is_error else None
+        object.__setattr__(self, "error_kind", error_kind)
+
+    @classmethod
+    def from_tool_result(cls, tool_use: ToolUseBlock, result: ToolResult) -> "ToolCallResult":
+        return cls(
+            tool_use=tool_use,
+            result=ToolResultBlock(tool_use_id=tool_use.id, content=result.blocks, is_error=result.is_error),
+            error_kind=result.error_kind,
+        )
+
 
 class ToolCallAgent(Agent[ToolCallSpec, ToolCallResult]):
     """Executes a single tool call and returns the result.
@@ -139,12 +158,7 @@ class ToolCallAgent(Agent[ToolCallSpec, ToolCallResult]):
                 then=self.collect_agent_result,
             )
 
-        result = ToolResultBlock(
-            tool_use_id=tool_use.id,
-            content=execution_result.blocks,
-            is_error=execution_result.is_error,
-        )
-        return ToolCallResult(tool_use=tool_use, result=result, error_kind=execution_result.error_kind)
+        return ToolCallResult.from_tool_result(tool_use, execution_result)
 
     @step("collect_agent_result")
     async def collect_agent_result(self, agent_result: Annotated[Any, agent_arg.CHILD]) -> ToolCallResult:
@@ -152,19 +166,9 @@ class ToolCallAgent(Agent[ToolCallSpec, ToolCallResult]):
         if isinstance(agent_result, Interrupted):
             return self.__error_result(tool_use, "Tool execution interrupted")
         if isinstance(agent_result, ToolResult):
-            result = ToolResultBlock(
-                tool_use_id=tool_use.id,
-                content=agent_result.blocks,
-                is_error=agent_result.is_error,
-            )
-            error_kind = agent_result.error_kind
-        else:
-            result = ToolResultBlock(
-                tool_use_id=tool_use.id,
-                content=[TextBlock(text=format_result(agent_result))],
-            )
-            error_kind = None
-        return ToolCallResult(tool_use=tool_use, result=result, error_kind=error_kind)
+            return ToolCallResult.from_tool_result(tool_use, agent_result)
+        result = ToolResultBlock(tool_use_id=tool_use.id, content=[TextBlock(text=format_result(agent_result))])
+        return ToolCallResult(tool_use=tool_use, result=result)
 
     @staticmethod
     def __error_result(tool_use: ToolUseBlock, content: str, error_kind: ToolErrorKind | None = None) -> ToolCallResult:

{flowra-0.0.92.dev108 → flowra-0.0.92.dev110}/flowra/version.py

@@ -1,4 +1,4 @@
 # Updated by CI/CD pipeline (the __version__ line only)
 __all__ = ["__version__"]
 
-__version__ = "0.0.92.dev108"
+__version__ = "0.0.92.dev110"

{flowra-0.0.92.dev108 → flowra-0.0.92.dev110}/tests/lib/test_tool_call_agent.py

@@ -7,8 +7,8 @@ from flowra.agent import AgentRuntime, InterruptedError
 from flowra.lib import LLMConfig
 from flowra.lib.turn import TurnConfig
 from flowra.lib.turn.tool_call import ToolCallAgent, ToolCallResult, ToolCallSpec
-from flowra.llm import LLMProvider, LLMRequest, LLMResponse, ToolUseBlock
-from flowra.tools import ToolRegistry, tool
+from flowra.llm import LLMProvider, LLMRequest, LLMResponse, ToolResultBlock, ToolUseBlock
+from flowra.tools import ToolErrorKind, ToolRegistry, ToolResult, tool
 
 
 class _UnusedProvider(LLMProvider):
@@ -37,6 +37,18 @@ def stopped_tool() -> str:
     raise InterruptedError
 
 
+@tool("refusing")
+def refusing_tool() -> ToolResult:
+    """Answer with an error of its own, naming no kind."""
+    return ToolResult(content="no", is_error=True)
+
+
+@tool("kind_without_error")
+def kind_without_error_tool() -> ToolResult:
+    """Answer successfully while naming a kind."""
+    return ToolResult(content="fine", error_kind=ToolErrorKind.EXECUTION)
+
+
 class TestToolCallAgent:
     async def test_execute_tool_call(self) -> None:
         registry = ToolRegistry([add_tool])
@@ -217,6 +229,7 @@ class TestToolCallAgent:
         assert result.result.tool_use_id == "call_2"
         assert result.result.text == "Tool execution interrupted"
         assert result.result.is_error is True
+        assert result.error_kind == ToolErrorKind.EXECUTION
 
     async def test_a_tool_that_raises_interrupted_is_interrupted_not_failed(
         self, caplog: pytest.LogCaptureFixture
@@ -242,3 +255,57 @@ class TestToolCallAgent:
         assert result.result.text == "Tool execution interrupted"
         assert result.result.is_error is True
         assert caplog.records == []
+
+    @pytest.mark.parametrize(
+        ("tool_name", "error_kind"),
+        [("refusing", ToolErrorKind.EXECUTION), ("kind_without_error", None)],
+    )
+    async def test_a_tool_answer_carries_a_kind_exactly_when_it_is_an_error(
+        self, tool_name: str, error_kind: ToolErrorKind | None
+    ) -> None:
+        runtime = AgentRuntime(
+            agents={"tool_call": ToolCallAgent},
+            services={
+                TurnConfig: TurnConfig(
+                    tools=ToolRegistry([refusing_tool, kind_without_error_tool]),
+                    llm_config=LLMConfig(provider=_UNUSED_PROVIDER, model="test"),
+                    system=[],
+                    history=[],
+                )
+            },
+        )
+
+        result = await runtime.run(
+            agent=ToolCallAgent, spec=ToolCallSpec(tool_use=ToolUseBlock(id="call_4", name=tool_name, input={}))
+        )
+
+        assert isinstance(result, ToolCallResult)
+        assert result.error_kind == error_kind
+
+
+class TestToolCallResult:
+    def test_an_error_without_a_kind_gets_execution(self) -> None:
+        result = ToolCallResult(
+            tool_use=ToolUseBlock(id="c", name="t", input={}),
+            result=ToolResultBlock(tool_use_id="c", content=[], is_error=True),
+        )
+
+        assert result.error_kind == ToolErrorKind.EXECUTION
+
+    def test_an_error_keeps_the_kind_it_has(self) -> None:
+        result = ToolCallResult(
+            tool_use=ToolUseBlock(id="c", name="t", input={}),
+            result=ToolResultBlock(tool_use_id="c", content=[], is_error=True),
+            error_kind=ToolErrorKind.SCHEMA_VALIDATION,
+        )
+
+        assert result.error_kind == ToolErrorKind.SCHEMA_VALIDATION
+
+    def test_an_answer_that_is_not_an_error_carries_no_kind(self) -> None:
+        result = ToolCallResult(
+            tool_use=ToolUseBlock(id="c", name="t", input={}),
+            result=ToolResultBlock(tool_use_id="c", content=[]),
+            error_kind=ToolErrorKind.EXECUTION,
+        )
+
+        assert result.error_kind is None