tool_executor.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: Apache-2.0
#include <entropic/mcp/tool_executor.h>
#include <entropic/mcp/tool_result_classify.h>
#include <entropic/mcp/utf8_sanitize.h>
#include <entropic/types/logging.h>
#include <entropic/types/run_scope.h>
 
#include <nlohmann/json.hpp>
 
#include <algorithm>
#include <chrono>
#include <memory>
#include <optional>
 
static auto logger = entropic::log::get("mcp.tool_executor");
 
namespace entropic {
 
ToolExecutor::ToolExecutor(
    ServerManager& server_manager,
    const LoopConfig& loop_config,
    EngineCallbacks& callbacks,
    ToolExecutorHooks hooks)
    : server_manager_(server_manager),
      loop_config_(loop_config),
      callbacks_(callbacks),
      hooks_(hooks) {}
 
void ToolExecutor::set_server_resolver(
    ServerManager* (*fn)(const std::string&, void*), void* user_data) {
    server_resolver_ = fn;
    server_resolver_data_ = user_data;
}
 
ServerManager& ToolExecutor::servers_for(
    const std::string& session_key) const {
    if (server_resolver_ != nullptr) {
        auto* resolved = server_resolver_(session_key, server_resolver_data_);
        if (resolved != nullptr) { return *resolved; }
    }
    return server_manager_;
}
 
void ToolExecutor::set_permission_persist(
    const PermissionPersistInterface& persist) {
    permission_persist_ = persist;
}
 
std::vector<Message> ToolExecutor::process_tool_calls(
    LoopContext& ctx,
    const std::vector<ToolCall>& tool_calls) {
    logger->info("Processing {} tool calls", tool_calls.size());
    ctx.state = AgentState::WAITING_TOOL;
    fire_state_callback(ctx);
 
    auto limited = sort_tool_calls(tool_calls);
    int eff_limit = ctx.effective_max_tool_calls_per_turn >= 0
        ? ctx.effective_max_tool_calls_per_turn
        : loop_config_.max_tool_calls_per_turn;
    truncate_to_limit(limited, eff_limit);
 
    std::vector<Message> results;
    for (const auto& call : limited) {
        auto msgs = process_single_call(ctx, call);
        for (auto& m : msgs) {
            results.push_back(std::move(m));
        }
        if (should_stop_batch(ctx, results)) {
            break;
        }
    }
 
    ctx.consecutive_errors = 0;
    return results;
}
 
std::vector<ToolCall> ToolExecutor::sort_tool_calls(
    const std::vector<ToolCall>& calls) {
    auto sorted = calls;
    std::stable_sort(sorted.begin(), sorted.end(),
        [](const ToolCall& a, const ToolCall& b) {
            bool a_delegate = (a.name == "entropic.delegate");
            bool b_delegate = (b.name == "entropic.delegate");
            return !a_delegate && b_delegate;
        });
    return sorted;
}
 
std::string ToolExecutor::check_duplicate(
    const LoopContext& ctx,
    const ToolCall& call) const {
    if (server_manager_.skip_duplicate_check(call.name)) {
        return "";
    }
    auto key = tool_call_key(call);
    auto it = ctx.recent_tool_calls.find(key);
    if (it != ctx.recent_tool_calls.end()) {
        return it->second;
    }
    return "";
}
 
Message ToolExecutor::handle_duplicate(
    LoopContext& ctx,
    const ToolCall& call,
    const std::string& previous_result) {
    ctx.consecutive_duplicate_attempts++;
    logger->warn("Duplicate tool call #{}: {}",
                 ctx.consecutive_duplicate_attempts, call.name);
 
    if (ctx.consecutive_duplicate_attempts >= 3) {
        return create_circuit_breaker_message();
    }
    return create_duplicate_message(call, previous_result);
}
 
bool ToolExecutor::check_approval(const ToolCall& call) {
    auto args_json = serialize_args(call);
    bool auto_ok = loop_config_.auto_approve_tools
                || server_manager_.is_explicitly_allowed(
                       call.name, args_json);
 
    bool approved = auto_ok;
    if (!approved && callbacks_.on_tool_call != nullptr) {
        auto call_json = serialize_tool_call(call);
        callbacks_.on_tool_call(call_json.c_str(),
                                callbacks_.user_data);
        approved = true;
    }
 
    // Hook: ON_PERMISSION_CHECK — informational (v1.9.1)
    if (hook_iface_.fire_info != nullptr) {
        std::string perm = approved ? "allowed" : "denied";
        std::string json = "{\"tool_name\":\""
            + call.name + "\",\"permission\":\"" + perm + "\"}";
        hook_iface_.fire_info(hook_iface_.registry,
            ENTROPIC_HOOK_ON_PERMISSION_CHECK, json.c_str());
    }
 
    if (!approved) {
        logger->warn("No approval callback — denying: {}", call.name);
    }
    return approved;
}
 
std::optional<Message> ToolExecutor::check_tier_allowed(
    const LoopContext& ctx, const ToolCall& call) const {
    // gh#83 (v2.5.2): enforce the locked tier's allowed_tools at
    // dispatch — not just at prompt-injection time. Without this a
    // model that emits an off-allowlist call (hallucinated, learned,
    // or cross-tier) has it dispatched normally; tier isolation was
    // advisory only. Pass through when: no tier locked, no map wired,
    // or the tier declares no allowlist (unrestricted).
    if (ctx.locked_tier.empty() || tier_allowed_tools_ == nullptr) {
        return std::nullopt;
    }
    auto it = tier_allowed_tools_->find(ctx.locked_tier);
    // Authorized when: tier has no allowlist entry, an empty allowlist
    // (unrestricted), or the call is in the list. Short-circuit eval
    // guards the `it->second` access against the end() case.
    bool authorized = it == tier_allowed_tools_->end()
                   || it->second.empty()
                   || std::find(it->second.begin(), it->second.end(),
                                call.name) != it->second.end();
    if (authorized) {
        return std::nullopt;
    }
    logger->warn("Tool '{}' not in tier '{}' allowed_tools — rejecting",
                 call.name, ctx.locked_tier);
    return create_denied_message(
        call, "tier '" + ctx.locked_tier + "' is not authorized to call '"
                  + call.name + "'");
}
 
static std::string check_required_fields(
    const nlohmann::json& schema,
    const nlohmann::json& args)
{
    for (const auto& req : schema.value("required",
                                         nlohmann::json::array())) {
        if (!args.contains(req.get<std::string>())) {
            return "Missing required argument: "
                 + req.get<std::string>();
        }
    }
    return "";
}
 
static std::string check_enum(
    const std::string& key,
    const nlohmann::json& allowed,
    const nlohmann::json& val)
{
    for (const auto& e : allowed) {
        if (e == val) { return ""; }
    }
    return "Invalid value for '" + key + "': "
         + val.dump() + ". Must be one of: " + allowed.dump();
}
 
static std::string check_type(
    const std::string& key,
    const std::string& type,
    const nlohmann::json& val)
{
    bool ok = (type == "string" && val.is_string())
           || (type == "integer" && val.is_number_integer())
           || (type == "number" && val.is_number())
           || (type == "boolean" && val.is_boolean())
           || (type == "array" && val.is_array())
           || (type == "object" && val.is_object());
    return ok ? "" : "Type mismatch for '" + key
                   + "': expected " + type;
}
 
static std::string check_range(
    const std::string& key,
    const nlohmann::json& prop,
    const nlohmann::json& val)
{
    std::string err;
    if (val.is_number() && prop.contains("minimum")
        && val.get<double>() < prop["minimum"].get<double>()) {
        err = "Value for '" + key + "' is " + val.dump()
            + ", below the minimum " + prop["minimum"].dump();
    } else if (val.is_number() && prop.contains("maximum")
               && val.get<double>() > prop["maximum"].get<double>()) {
        err = "Value for '" + key + "' is " + val.dump()
            + ", above the maximum " + prop["maximum"].dump();
    }
    return err;
}
 
static std::string check_property_constraints(
    const std::string& key,
    const nlohmann::json& prop,
    const nlohmann::json& val)
{
    std::string err;
    if (prop.contains("enum")) {
        err = check_enum(key, prop["enum"], val);
    }
    if (err.empty() && prop.contains("type")) {
        err = check_type(key, prop["type"].get<std::string>(), val);
    }
    return err.empty() ? check_range(key, prop, val) : err;
}
 
static std::string validate_tool_args(
    const std::string& schema_json,
    const nlohmann::json& args)
{
    auto schema = nlohmann::json::parse(schema_json, nullptr, false);
    if (!schema.is_object()) { return ""; }
 
    auto err = check_required_fields(schema, args);
    auto props = schema.value("properties", nlohmann::json::object());
    for (auto it = props.begin(); it != props.end() && err.empty(); ++it) {
        if (args.contains(it.key())) {
            err = check_property_constraints(
                it.key(), it.value(), args[it.key()]);
        }
    }
    return err;
}
 
static std::string parse_tool_result_text(const std::string& result_json) {
    try {
        auto j = nlohmann::json::parse(result_json);
        return j.value("result", result_json);
    } catch (...) {
        return result_json;
    }
}
 
std::pair<Message, std::string> ToolExecutor::execute_tool(
    LoopContext& ctx, const ToolCall& call) {
 
    auto args_json = serialize_args(call);
 
    if (callbacks_.on_tool_start != nullptr) {
        auto call_json = serialize_tool_call(call);
        callbacks_.on_tool_start(call_json.c_str(),
                                 callbacks_.user_data);
    }
 
    auto start = std::chrono::steady_clock::now();
    // Inbound boundary from MCP server subprocess. v2.1.0 (#47) introduced
    // this; v2.1.1 (#3) generalized it as one of several boundary-policy
    // sanitize sites — see include/entropic/mcp/utf8_sanitize.h for the
    // full policy. The earlier "trust downstream" assumption was wrong:
    // bytes also enter via the model token stream and the audit-replay
    // path; both now sanitize at their own boundaries.
    // gh#166 (v2.13.0): route to the RUNNING SESSION's workspace. This is
    // the call that touches the filesystem, so it is the one that must
    // land in the right repository; the metadata lookups above answer
    // schema/permission questions that are workspace-invariant for the
    // built-in servers and fail SAFE (unknown → WRITE required, no schema
    // → no validation skip that grants anything).
    std::string result_json;
    {
        RunSessionScope session_scope(ctx.session_key);
        result_json = mcp::sanitize_utf8(
            servers_for(ctx.session_key).execute(call.name, args_json));
    }
    auto end = std::chrono::steady_clock::now();
    auto ms = std::chrono::duration_cast<
        std::chrono::milliseconds>(end - start).count();
 
    ctx.metrics.tool_calls++;
 
    std::string result_text = parse_tool_result_text(result_json);
 
    // P1-11 (2.0.6-rc16): stash into history ring buffer so the
    // constitutional validator revision prompt (and diagnostic tools)
    // can surface prior-iteration tool calls without re-reading
    // messages[].
    record_tool_history(call, args_json, result_text, ms,
                        ctx.metrics.iterations);
 
    fire_tool_complete_callback(call, result_text, ms);
 
    Message msg;
    msg.role = "user";
    msg.content = result_text;
    msg.metadata["tool_call_id"] = call.id;
    msg.metadata["tool_name"] = call.name;
 
    return {std::move(msg), result_json};
}
 
void ToolExecutor::record_tool_history(const ToolCall& call,
                                       const std::string& args_json,
                                       const std::string& result_text,
                                       long long ms, int iteration) {
    ToolCallRecord rec;
    rec.sequence = ++history_seq_;
    rec.tool_name = call.name;
    rec.params_summary = summarize_params(args_json);
    rec.status = mcp::looks_like_tool_error(result_text)  // gh#190: one classifier
        ? "error" : "success";
    rec.result_summary = truncate_result(result_text, 200);
    rec.elapsed_ms = static_cast<double>(ms);
    rec.iteration = iteration;
    history_.record(rec);
}
 
std::string ToolExecutor::tool_call_key(const ToolCall& call) {
    // Sort arguments for consistent key. gh#143: seed an OBJECT, not a
    // default-constructed null — an argument-free call would otherwise
    // key as "<name>:null" instead of "<name>:{}".
    nlohmann::json args = nlohmann::json::object();
    for (const auto& [k, v] : call.arguments) {
        args[k] = v;
    }
    return call.name + ":" + args.dump();
}
 
void ToolExecutor::record_tool_call(
    LoopContext& ctx,
    const ToolCall& call,
    const std::string& result) {
    // Extract result text from JSON envelope
    std::string text = result;
    try {
        auto j = nlohmann::json::parse(result);
        text = j.value("result", result);
    } catch (...) {}
 
    auto key = tool_call_key(call);
 
    // Don't cache error results — but do COUNT them (v2.13.0). Caching the
    // text would poison a transient failure for the rest of the turn,
    // which v1.8.5 rightly avoided; counting bounds the repeat without
    // taking the retry away. check_repeated_failure reads this.
    // gh#190 (v2.14.0): ONE error classifier for every site. This used to
    // match only an "Error:" prefix, so a structured {"error": ...} result
    // read as success — it cleared the failure count and was cached.
    if (mcp::looks_like_tool_error(text)) {
        ctx.failed_tool_calls[key]++;
        return;
    }
    // A success clears the failure history for this exact call: whatever
    // was wrong is no longer wrong, and a later failure deserves its own
    // retry rather than inheriting a spent budget.
    ctx.failed_tool_calls.erase(key);
    ctx.recent_tool_calls[key] = text;
}
 
Message ToolExecutor::create_denied_message(
    const ToolCall& call,
    const std::string& reason) {
    Message msg;
    msg.role = "user";
    msg.content =
        "Tool `" + call.name + "` was denied: " + reason + "\n\n"
        "This tool is not available to you. Do NOT retry it. "
        "Use a different approach to accomplish your task.";
    return msg;
}
 
Message ToolExecutor::create_error_message(
    const ToolCall& call,
    const std::string& error) {
    Message msg;
    msg.role = "user";
    msg.content =
        "Tool `" + call.name + "` failed with error: " + error +
        "\n\nRECOVERY:\n"
        "- Check arguments are correct\n"
        "- Try a different approach\n"
        "- Do NOT retry with the same arguments";
    return msg;
}
 
// ── Private helpers ──────────────────────────────────────
 
void ToolExecutor::fire_state_callback(const LoopContext& ctx) {
    if (callbacks_.on_state_change != nullptr) {
        callbacks_.on_state_change(
            static_cast<int>(ctx.state), callbacks_.user_data);
    }
}
 
void ToolExecutor::truncate_to_limit(
    std::vector<ToolCall>& calls,
    int limit) const {
    auto lim = static_cast<size_t>(limit);
    if (calls.size() > lim) {
        calls.resize(lim);
    }
}
 
std::optional<Message> ToolExecutor::check_mcp_authorization(
    const LoopContext& ctx,
    const ToolCall& call) const {
    if (auth_mgr_ == nullptr) {
        return std::nullopt;
    }
    auto identity = ctx.locked_tier.empty()
                        ? "lead" : ctx.locked_tier;
    auto required = server_manager_.get_required_access_level(
        call.name);
    if (!auth_mgr_->is_enforced(identity) ||
        auth_mgr_->check_access(identity, call.name, required)) {
        return std::nullopt;
    }
    auto level_str = mcp_access_level_name(required);
    logger->warn("MCP key denied: {} requires {} for {}",
                 call.name, level_str, identity);
    Message msg;
    msg.role = "user";
    msg.content =
        "Tool `" + call.name + "` was denied: identity `"
        + identity + "` lacks " + level_str
        + " access.\n\n"
        "Your MCP key set does not authorize this tool. "
        "Use `entropic.delegate` to hand off to an identity "
        "that has the required access.";
    return msg;
}
 
std::optional<Message> ToolExecutor::check_dup_or_approval(
    LoopContext& ctx, const ToolCall& call) {
    auto dup_result = check_duplicate(ctx, call);
    if (!dup_result.empty()) {
        return handle_duplicate(ctx, call, dup_result);
    }
    ctx.consecutive_duplicate_attempts = 0;
    return check_approval(call)
        ? std::nullopt
        : std::optional{create_denied_message(
              call, "Permission denied")};
}
 
std::optional<Message> ToolExecutor::check_schema(
    const ToolCall& call) {
    auto schema = server_manager_.get_tool_schema(call.name);
    if (schema.empty()) { return std::nullopt; }
    auto args = nlohmann::json::parse(
        serialize_args(call), nullptr, false);
    auto err = args.is_discarded()
        ? std::string{} : validate_tool_args(schema, args);
    if (err.empty()) { return std::nullopt; }
    logger->warn("Tool '{}' argument validation failed: {}",
                 call.name, err);
    return create_denied_message(call, err);
}
 
PreconditionCheck ToolExecutor::check_call_preconditions(
    LoopContext& ctx, const ToolCall& call) {
    PreconditionCheck pc = check_spiral_blocks(ctx, call);
    if (pc.rejection.has_value()) {
        return pc;
    }
    if (auto r = check_schema(call); r.has_value()) {
        pc.rejection = std::move(r);
        pc.kind = ToolResultKind::rejected_schema;
    } else if (auto a = check_mcp_authorization(ctx, call);
               a.has_value()) {
        pc.rejection = std::move(a);
        pc.kind = ToolResultKind::rejected_precondition;
    } else if (auto t = check_tier_allowed(ctx, call); t.has_value()) {
        pc.rejection = std::move(t);
        pc.kind = ToolResultKind::rejected_unauthorized;  // gh#83
    } else if (auto dup = check_duplicate(ctx, call); !dup.empty()) {
        pc.rejection = handle_duplicate(ctx, call, dup);
        pc.kind = ToolResultKind::rejected_duplicate;
    } else {
        pc = check_approval_pc(ctx, call);
    }
    return pc;
}
 
PreconditionCheck ToolExecutor::check_approval_pc(
    LoopContext& ctx, const ToolCall& call) {
    PreconditionCheck pc;
    ctx.consecutive_duplicate_attempts = 0;
    if (!check_approval(call)) {
        pc.rejection = create_denied_message(
            call, "Permission denied");
        pc.kind = ToolResultKind::rejected_precondition;
    }
    return pc;
}
 
std::vector<Message> ToolExecutor::process_single_call(
    LoopContext& ctx, const ToolCall& incoming) {
    // gh#168 (v2.13.0): the PRE_TOOL_CALL hook may rewrite the call's
    // ARGUMENTS, so the executor works on its own copy — preconditions,
    // dispatch, the dup cache and the POST hook all then see one
    // consistent call rather than the model's superseded version.
    ToolCall call = incoming;
    // Hook: PRE_TOOL_CALL first — fires for every attempt, including
    // those that a precondition will reject. (E9, 2.0.6-rc19)
    if (fire_pre_tool_hook(ctx, call)) {
        auto msg = create_denied_message(call, "Cancelled by hook");
        // gh#84 (v2.5.1): stamp kind so the engine treats this as a
        // non-progress outcome for the thinking-budget reset.
        msg.metadata["result_kind"] =
            result_kind_to_string(ToolResultKind::rejected_precondition);
        fire_post_tool_hook(ctx, call, "", 0.0,
            ToolResultKind::rejected_precondition, msg);
        return {std::move(msg)};
    }
 
    auto pc = check_call_preconditions(ctx, call);
    if (pc.rejection.has_value()) {
        logger->info("Tool '{}' rejected by precondition (kind={})",
                     call.name, result_kind_to_string(pc.kind));
        // gh#84 (v2.5.1): stamp kind for the engine's budget decision.
        pc.rejection->metadata["result_kind"] =
            result_kind_to_string(pc.kind);
        fire_post_tool_hook(ctx, call, "", 0.0, pc.kind, *pc.rejection);
        return {std::move(*pc.rejection)};
    }
 
    auto exec_start = std::chrono::steady_clock::now();
    auto [msg, raw_result] = execute_tool(ctx, call);
    auto exec_ms = std::chrono::duration<double, std::milli>(
        std::chrono::steady_clock::now() - exec_start).count();
 
    finalize_tool_call(ctx, call, msg, raw_result, exec_ms);
 
    return {std::move(msg)};
}
 
static ToolResultKind classify_tool_result(const std::string& content) {
    if (mcp::looks_like_tool_error(content)) {
        return ToolResultKind::error;
    }
    if (mcp::is_effectively_empty(content)) {
        return ToolResultKind::ok_empty;
    }
    return ToolResultKind::ok;
}
 
void ToolExecutor::log_tool_call(LoopContext& ctx, const ToolCall& call,
                                 double exec_ms,
                                 const std::string& raw_result,
                                 ToolResultKind kind) {
    auto args_log = serialize_args(call);
    if (args_log.size() > 512) { args_log.resize(512); }
    logger->info("[tool_call] session='{}' iter={} tier={} tool={} args={} "
                 "elapsed_ms={:.0f} result_chars={} status={}",
                 ctx.session_key,
                 ctx.metrics.iterations,
                 ctx.locked_tier.empty() ? "lead" : ctx.locked_tier,
                 call.name, args_log, exec_ms,
                 raw_result.size(), result_kind_to_string(kind));
}
 
void ToolExecutor::finalize_tool_call(LoopContext& ctx, const ToolCall& call,
                                      Message& msg,
                                      const std::string& raw_result,
                                      double exec_ms) {
    // #46 (v2.1.0): cap result content at LoopConfig.max_tool_result_bytes
    // so a single runaway tool can't exhaust the context budget. Applied
    // BEFORE classification so kind reflects the bounded form, and BEFORE
    // record_tool_call so the duplicate cache stores what the model saw.
    apply_result_size_cap(msg.content);
    ctx.effective_tool_calls++;
    msg.metadata["added_at_iteration"] =
        std::to_string(ctx.metrics.iterations);
    record_tool_call(ctx, call, raw_result);
 
    // #44 (v2.1.0): honest byte-level signal — error trumps empty.
    ToolResultKind kind = classify_tool_result(msg.content);
    // gh#84 (v2.5.1): stamp the result kind on the message so the
    // engine can tell genuine progress (ok / ok_empty) from rejections
    // and errors when deciding whether to reset the thinking budget.
    msg.metadata["result_kind"] = result_kind_to_string(kind);
    fire_post_tool_hook(ctx, call, raw_result, exec_ms, kind, msg);
 
    // Demo ask #5 (v2.1.0): anti-spiral primitive. Track consecutive
    // same-tool calls; at threshold, populate pending_anti_spiral_warning
    // so the next turn's reminder tells the model to pivot or complete.
    update_anti_spiral_tracking(ctx, call.name);
 
    log_tool_call(ctx, call, exec_ms, raw_result, kind);
 
    extract_and_process_directives(ctx, raw_result);
    run_post_tool_hooks(ctx);
}
 
static bool pre_mod_renames_tool(const nlohmann::json& parsed,
                                 const std::string& tool_name) {
    auto it = parsed.find("tool_name");
    return it != parsed.end()
        && !(it->is_string() && it->get<std::string>() == tool_name);
}
 
static std::string pre_mod_refusal(const nlohmann::json& parsed,
                                   const std::string& tool_name) {
    std::string reason;
    if (!parsed.is_object()) {
        reason = "payload is not a JSON object";
    } else if (pre_mod_renames_tool(parsed, tool_name)) {
        reason = "payload changes the call's identity — a hook may "
                 "rewrite arguments, never the tool it routes to";
    } else if (!parsed.contains("args")
               || !parsed.at("args").is_object()) {
        reason = "payload carries no 'args' object";
    }
    return reason;
}
 
static void overwrite_call_arguments(ToolCall& call,
                                     const nlohmann::json& args) {
    call.arguments_json = args.dump();
    call.arguments.clear();
    for (const auto& [k, v] : args.items()) {
        call.arguments[k] = v.is_string() ? v.get<std::string>() : v.dump();
    }
}
 
bool ToolExecutor::apply_pre_tool_modification(ToolCall& call,
                                               const char* modified) {
    // A registered hook is a plugin .so — an external boundary in BOTH
    // directions (gh#3 / gh#111 / gh#132). Sanitize BEFORE the parse:
    // nlohmann rejects an ill-formed UTF-8 byte inside a string, so
    // sanitizing afterwards would refuse a payload that is merely dirty.
    const std::string sanitized = mcp::sanitize_utf8(modified);
    auto parsed = nlohmann::json::parse(sanitized, nullptr, false);
    std::string refusal = parsed.is_discarded()
        ? std::string{"payload is not valid JSON"}
        : pre_mod_refusal(parsed, call.name);
    if (!refusal.empty()) {
        logger->error(
            "[hook] PRE_TOOL_CALL modification REFUSED for '{}': {}. "
            "Dispatching the call with the model's own arguments. "
            "Payload: {}", call.name, refusal, sanitized);
        return false;
    }
    overwrite_call_arguments(call, parsed.at("args"));
    logger->info("[hook] PRE_TOOL_CALL rewrote args for '{}': {}",
                 call.name, call.arguments_json);
    return true;
}
 
bool ToolExecutor::fire_pre_tool_hook(
    const LoopContext& ctx, ToolCall& call) {
    if (hook_iface_.fire_pre == nullptr) { return false; }
    auto json = build_pre_tool_json(call, ctx.locked_tier,
                                    ctx.metrics.iterations);
    char* mod = nullptr;
    int rc = hook_iface_.fire_pre(hook_iface_.registry,
        ENTROPIC_HOOK_PRE_TOOL_CALL, json.c_str(), &mod);
    if (mod != nullptr) {
        if (rc == 0) { apply_pre_tool_modification(call, mod); }
        free(mod);
    }
    return rc != 0;
}
 
void ToolExecutor::apply_result_size_cap(std::string& content) const {
    mcp::truncate_to_cap(content, loop_config_.max_tool_result_bytes);
}
 
void ToolExecutor::update_anti_spiral_tracking(
    LoopContext& ctx, const std::string& tool_name) {
    if (tool_name == ctx.last_tool_name) {
        ++ctx.consecutive_same_tool_calls;
    } else {
        ctx.last_tool_name = tool_name;
        ctx.consecutive_same_tool_calls = 1;
    }
    if (ctx.consecutive_same_tool_calls
            >= loop_config_.max_consecutive_same_tool) {
        ctx.pending_anti_spiral_warning =
            tool_name + " has been called "
            + std::to_string(ctx.consecutive_same_tool_calls)
            + " times consecutively; pivot to a different tool or "
              "complete the task next turn.";
    }
}
 
int ToolExecutor::effective_hard_block_threshold() const {
    int configured = loop_config_.max_consecutive_same_tool_hard_block;
    if (configured < 0) {
        configured = loop_config_.max_consecutive_same_tool + 2;
    }
    return configured;
}
 
PreconditionCheck ToolExecutor::check_anti_spiral_hard_block(
    const LoopContext& ctx, const ToolCall& call) const {
    PreconditionCheck pc;
    int projected = (call.name == ctx.last_tool_name)
        ? (ctx.consecutive_same_tool_calls + 1)
        : 1;
    int threshold = effective_hard_block_threshold();
    if (projected >= threshold) {
        std::string text =
            "[anti-spiral] tool '" + call.name + "' blocked after "
            + std::to_string(projected)
            + " consecutive calls (threshold "
            + std::to_string(threshold)
            + "); pivot to a different tool or complete the task.";
        pc.rejection = create_denied_message(call, text);
        pc.kind = ToolResultKind::rejected_anti_spiral;
    }
    return pc;
}
 
PreconditionCheck ToolExecutor::check_repeated_failure(
    const LoopContext& ctx, const ToolCall& call) const {
    PreconditionCheck pc;
    auto it = ctx.failed_tool_calls.find(tool_call_key(call));
    if (it == ctx.failed_tool_calls.end()) {
        return pc;
    }
    int failures = it->second;
    if (failures + 1 >= loop_config_.max_identical_failures) {
        std::string text =
            "[repeated-failure] tool '" + call.name + "' has already failed "
            + std::to_string(failures)
            + " times with identical arguments; the failure is not "
              "transient. Change the arguments, try a different approach, "
              "or report that the task cannot be completed this way.";
        pc.rejection = create_denied_message(call, text);
        // Deliberately the EXISTING kind, not a new one: repeating a call
        // that keeps failing IS a spiral, and the nine result_kind strings
        // are a consumer contract (sassafras-class reads them). A tenth
        // kind would be a breaking change for a case this one describes.
        pc.kind = ToolResultKind::rejected_anti_spiral;
    }
    return pc;
}
 
PreconditionCheck ToolExecutor::check_spiral_blocks(
    const LoopContext& ctx, const ToolCall& call) const {
    // Both fire BEFORE schema/auth/dispatch (Issue #14, v2.1.4): they are
    // cheaper than those checks and short-circuit a tool the engine has
    // already decided to refuse. They are siblings, not duplicates — one
    // counts a tool NAME repeating, the other one exact call repeating
    // against an identical error, and neither sees the other's case.
    PreconditionCheck pc = check_anti_spiral_hard_block(ctx, call);
    if (pc.rejection.has_value()) {
        return pc;
    }
    return check_repeated_failure(ctx, call);
}
 
void ToolExecutor::fire_post_tool_hook(
    const LoopContext& ctx, const ToolCall& call,
    const std::string& raw_result, double elapsed_ms,
    ToolResultKind kind, Message& msg) {
    if (hook_iface_.fire_post == nullptr) { return; }
    auto json = build_post_tool_json(
        call, raw_result, elapsed_ms, ctx.locked_tier,
        ctx.metrics.iterations, kind);
    char* out = nullptr;
    hook_iface_.fire_post(hook_iface_.registry,
        ENTROPIC_HOOK_POST_TOOL_CALL, json.c_str(), &out);
    if (out != nullptr) {
        // gh#3 recurrence (gh#111, v2.9.7): a hook's transformed result is
        // an inbound boundary crossing a plugin .so, same class as
        // fire_post_generate_hook/fire_complete_hook in engine.cpp —
        // sanitize before it becomes msg.content.
        msg.content = mcp::sanitize_utf8(out);
        free(out);
    }
}
 
bool ToolExecutor::should_stop_batch(
    const LoopContext& ctx,
    const std::vector<Message>& /*results*/) const {
    return ctx.state == AgentState::COMPLETE
        || ctx.pending_delegation.has_value()
        || ctx.pending_pipeline.has_value()
        || ctx.consecutive_duplicate_attempts >= 3;
}
 
void ToolExecutor::run_post_tool_hooks(LoopContext& ctx) {
    if (hooks_.after_tool != nullptr) {
        hooks_.after_tool(ctx, hooks_.user_data);
    }
}
 
Message ToolExecutor::create_circuit_breaker_message() {
    Message msg;
    msg.role = "user";
    msg.content =
        "STOP: You have called the same tool 3 times with "
        "identical arguments. This indicates you are stuck. "
        "Please try a completely different approach or respond "
        "to the user explaining what's blocking you.";
    logger->error("Circuit breaker triggered");
    return msg;
}
 
Message ToolExecutor::create_duplicate_message(
    const ToolCall& call,
    const std::string& previous_result) {
    bool was_denied =
        previous_result.find("was denied") != std::string::npos
        || previous_result.find("not available") != std::string::npos;
 
    Message msg;
    msg.role = "user";
 
    if (was_denied) {
        msg.content =
            "Tool `" + call.name + "` is not available to you "
            "and retrying will not help. You MUST use a different "
            "approach. Do NOT call `" + call.name + "` again.";
    } else {
        msg.content =
            "Tool `" + call.name + "` was already called with "
            "the same arguments.\n\nPrevious result:\n" +
            previous_result +
            "\n\nDo NOT call this tool again. "
            "Use the previous result above.";
    }
    return msg;
}
 
std::string ToolExecutor::serialize_args(const ToolCall& call) {
    if (!call.arguments_json.empty()) {
        return call.arguments_json;
    }
    nlohmann::json args = nlohmann::json::object();
    for (const auto& [k, v] : call.arguments) {
        args[k] = v;
    }
    return args.dump();
}
 
std::string ToolExecutor::serialize_tool_call(const ToolCall& call) {
    nlohmann::json j;
    j["id"] = call.id;
    j["name"] = call.name;
    j["arguments"] = nlohmann::json::object();
    for (const auto& [k, v] : call.arguments) {
        j["arguments"][k] = v;
    }
    return j.dump();
}
 
void ToolExecutor::fire_tool_complete_callback(
    const ToolCall& call,
    const std::string& result,
    long long ms) {
    if (callbacks_.on_tool_complete == nullptr) {
        return;
    }
    auto call_json = serialize_tool_call(call);
    callbacks_.on_tool_complete(
        call_json.c_str(), result.c_str(),
        static_cast<double>(ms), callbacks_.user_data);
}
 
std::string ToolExecutor::build_post_tool_json(
    const ToolCall& call,
    const std::string& raw_result,
    double elapsed_ms,
    const std::string& tier,
    int iteration,
    ToolResultKind kind) {
    nlohmann::json ctx;
    ctx["tool_name"] = call.name;
    ctx["args"] = nlohmann::json::parse(serialize_args(call));
    ctx["elapsed_ms"] = elapsed_ms;
    ctx["tier"] = tier.empty() ? std::string{"lead"} : tier;
    ctx["iteration"] = iteration;
    ctx["result_kind"] = result_kind_to_string(kind);
    try {
        auto sr = nlohmann::json::parse(raw_result);
        ctx["result"] = sr.value("result", raw_result);
        ctx["directives"] = sr.value(
            "directives", nlohmann::json::array());
    } catch (...) {
        ctx["result"] = raw_result;
        ctx["directives"] = nlohmann::json::array();
    }
    return ctx.dump();
}
 
std::string ToolExecutor::build_pre_tool_json(
    const ToolCall& call,
    const std::string& tier,
    int iteration) {
    nlohmann::json j;
    j["tool_name"] = call.name;
    j["args"] = nlohmann::json::parse(serialize_args(call));
    j["tier"] = tier.empty() ? std::string{"lead"} : tier;
    j["iteration"] = iteration;
    return j.dump();
}
 
static std::vector<std::string> extract_pipeline_stages(
    const nlohmann::json& result_json) {
    std::vector<std::string> stages;
    if (!result_json.contains("stages")) { return stages; }
    for (const auto& s : result_json["stages"]) {
        stages.push_back(s.get<std::string>());
    }
    return stages;
}
 
static std::unique_ptr<Directive> build_complete_directive(
    const nlohmann::json& result_json) {
    auto cd = std::make_unique<CompleteDirective>(
        result_json.value("summary", ""));
    cd->coverage_gap = result_json.value("coverage_gap", false);
    cd->gap_description = result_json.value("gap_description", "");
    if (result_json.contains("suggested_files")
        && result_json["suggested_files"].is_array()) {
        cd->suggested_files =
            result_json["suggested_files"].get<std::vector<std::string>>();
    }
    return cd;
}
 
static std::vector<ContextRef> extract_context_refs(
    const nlohmann::json& result_json) {
    std::vector<ContextRef> refs;
    if (!result_json.contains("context")
        || !result_json["context"].is_array()) {
        return refs;
    }
    for (const auto& entry : result_json["context"]) {
        if (!entry.is_object()) { continue; }
        ContextRef ref;
        ref.path = entry.value("path", std::string{});
        if (ref.path.empty()) { continue; }
        ref.lines = entry.value("lines", std::string{});
        ref.note = entry.value("note", std::string{});
        refs.push_back(std::move(ref));
    }
    return refs;
}
 
static std::unique_ptr<Directive> build_directive(
    const nlohmann::json& d, const nlohmann::json& result_json) {
    auto type_str = d.value("type", "");
    std::unique_ptr<Directive> result;
    if (type_str == "stop_processing") {
        result = std::make_unique<StopProcessingDirective>();
    } else if (type_str == "delegate") {
        // gh#32 (v2.1.6): resume_delegation emits action=resume_delegation
        // with delegation_id but no target. The directive's target is
        // resolved later by the engine after loading the original
        // delegation's tier from storage.
        auto dl = std::make_unique<DelegateDirective>(
            result_json.value("target", ""),
            result_json.value("task", ""),
            result_json.value("max_turns", -1),
            result_json.value("delegation_id", ""));
        // gh#162 (v2.13.0): carry the lead's file references and the
        // resume-by-tier flag through to the engine.
        dl->context = extract_context_refs(result_json);
        dl->resume_by_target = result_json.value("resume_by_target", false);
        result = std::move(dl);
    } else if (type_str == "complete") {
        result = build_complete_directive(result_json);
    } else if (type_str == "pipeline") {
        auto pl = std::make_unique<PipelineDirective>(
            extract_pipeline_stages(result_json),
            result_json.value("task", ""));
        pl->context = extract_context_refs(result_json);  // gh#162
        result = std::move(pl);
    }
    return result;
}
 
static std::optional<std::pair<nlohmann::json, nlohmann::json>>
extract_directive_array(const std::string& raw_result) {
    auto resp = nlohmann::json::parse(raw_result, nullptr, false);
    if (!resp.is_object() || !resp.contains("directives")) {
        return std::nullopt;
    }
    auto dirs = resp["directives"];
    if (!dirs.is_array() || dirs.empty()) { return std::nullopt; }
    return std::make_pair(std::move(resp), std::move(dirs));
}
 
void ToolExecutor::extract_and_process_directives(
    LoopContext& ctx, const std::string& raw_result) {
    if (hooks_.process_directives == nullptr) { return; }
    auto extracted = extract_directive_array(raw_result);
    if (!extracted) { return; }
    auto& [resp, dirs] = *extracted;
 
    auto result_json = nlohmann::json::parse(
        resp.value("result", "{}"), nullptr, false);
 
    std::vector<std::unique_ptr<Directive>> owned;
    for (const auto& d : dirs) {
        auto directive = build_directive(d, result_json);
        if (directive) { owned.push_back(std::move(directive)); }
    }
    if (owned.empty()) { return; }
 
    std::vector<const Directive*> ptrs;
    ptrs.reserve(owned.size());
    for (const auto& d : owned) { ptrs.push_back(d.get()); }
    logger->info("Processing {} directives from tool result", ptrs.size());
    hooks_.process_directives(ctx, ptrs, hooks_.user_data);
}
 
} // namespace entropic