Prefix the unknown-tool error with the "cannot" convention and drop
the duplicate wrap around executeSingleTool: that helper already wraps
its generic error path, so the outer wrap produced messages shaped like
"cannot execute tool X: cannot execute tool X: ...".
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
MaxTurns is the only agent bound compared against a counter that is
serialised in the checkpoint (Turns). When config drifts between save
and restore -- typically because a deploy changed WithMaxTurns or a
different build of the agent is registered by name -- cp.Turns can
exceed agent.maxTurns on the resumed run, which previously surfaced
as a warning log and then a MaxTurnsExceededError on the first
iteration of the resumed coreLoop.
Capture MaxTurns in the new AgentConfig on every save, and on
restore clone the registry-resolved agent with WithMaxTurns applied
from the snapshot. The override flows through the outer Restore path
and through both inner-agent resolution sites in
restoreNestedSuspended and restoreAwaitingApproval, so nested
runs get the same treatment. Other loop bounds
(maxEmptyOutputRetries, maxToolDepth) reset per turn / per tool
depth and stay intentionally live so deploys can tune them without
invalidating in-flight checkpoints. Live references (tools, hooks,
LLM client, approval callbacks, guardrails) are not snapshotted for
the same reason.
With the snapshot in place, the "restored agent run has already
reached max turns" warning at the top of continueFromMessages is
structurally unreachable -- the live agent's bound is now the same
value cp.Turns was bounded by at save time -- and is removed.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
executeParallel ignored SuspendedError when checkpoint was nil,
treating it as a normal tool error. Nested suspension propagation
also dropped the in-memory checkpoint when persistence failed,
making runs non-resumable.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Poll-based supervisor that claims PENDING agent runs with FOR UPDATE
SKIP LOCKED, runs them with lease-based heartbeat, and handles
graceful shutdown. On infrastructure stop the row stays RUNNING so
stale recovery resets it to PENDING on restart; Restore picks up
from the last checkpoint. Heartbeat loss cancels execution without
committing a terminal status.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Restore loads a checkpoint from the store, resolves the agent from
a registry, and re-enters coreLoop. Handles suspended, nested
suspended (concurrent inner restore), and awaiting-approval states.
Partial progress is saved when some inner agents complete while
others remain suspended.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
coreLoop now saves incremental checkpoints after each tool-call turn
and checks a cooperative stop signal at turn boundaries. SuspendedError
is handled in finishRun, executeParallel, and executeSingleTool.
Approval-interrupted checkpoints are persisted for both flat and
nested interruptions.
Introduce RunOption, WithCheckpointStore, RunWithOpts, ResumeWithOpts,
and RunStreamedWithOpts so callers can provide checkpoint storage.
Add StreamEventSuspended and OnRunRestore hook.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Introduce Checkpoint, CheckpointStore, SuspendedError, AgentRegistry,
and CompletedCall types. Add cooperative stop signal via context.
Export CompletedCall (was unexported completedCall) so checkpoints
can reference completed tool results. Add JSON tags to ToolResult
and ApprovalResult for checkpoint serialization.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
Inline comments are more targeted than excluding the entire file
from secret scanning. Remove the .trufflehog.yml exclude file and
the --exclude-paths flag from the workflow.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Skip empty fingerprints in SystemPromptLeakGuardrail to prevent blank
values from flagging every message. Replace overly broad "sk-" pattern
in SensitiveDataGuardrail with specific LLM provider prefixes
("sk-proj-" for OpenAI, "sk-ant-" for Anthropic) to avoid false
positives on common words like "risk-based" or "task-management".
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Introduce a pkg/agent/guardrail package with three guardrails that
can be composed into any agent:
- PromptInjectionGuardrail: LLM-based input classifier that detects
prompt injection attempts before the agent processes them.
- SensitiveDataGuardrail: pattern-based output check for leaked
tokens, keys, connection strings, and raw SQL.
- SystemPromptLeakGuardrail: configurable output check that detects
system prompt content in responses using caller-provided
fingerprints.
The classifier prompt is embedded from a plain text file for easy
review and editing.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
JSON null unmarshals into an empty string, so the presence-only
key check let {"input":null} through, running the nested agent
with a blank user message.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
executeSingleTool had three exit paths but only the success path
emitted all end signals. The interrupted path (nested agent
approval) skipped OnToolEnd and StreamEventToolEnd entirely,
leaving hook consumers with an unpaired OnToolStart. The error
path also missed StreamEventToolEnd and AgentHooks.OnToolEnd.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
When an MCP server sets StructuredContent without populating
Content with TextContent entries, extractMCPContent returned
an empty string, making successful tool calls look empty to
the agent. Now the function serializes StructuredContent as
JSON when no text parts are found.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
reflect.TypeOf on a nil interface value returns nil, causing a
panic when Kind() is called. Use reflect.TypeFor[T]() instead,
which resolves the type directly from the type parameter.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Fix Wait draining events from concurrent consumers
Wait() was ranging over the public Events channel, competing
with any concurrent reader for events. Callers that streamed
events in one goroutine and called Wait() in another would
lose an arbitrary subset of events. Wait now only blocks on
the done channel; the result fields are already visible thanks
to the close ordering (set fields → close events → close done).
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
jsonSchemaFor panicked on unsupported types, which meant
FunctionTool, NewOutputType, and RunTyped would crash the
process during setup rather than returning a normal error.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
The agentTool.Execute method accepted {} despite the schema
marking input as required. Unlike functionTool, it skipped
required-field validation, silently sending an empty message
to the sub-agent.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
When the LLM returns tool calls after a handoff in the same
assistant message, they were silently dropped. This left
orphaned tool_call entries without matching tool-result
messages, causing protocol errors on the next LLM turn.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
