- describe/preview now surface each tool's return type as Result<T> (alias
defined once in the prompt); the inline preview shows it too, so the model
sees a tool's result shape without a describe round-trip. T is the declared
outputSchema else unknown, with prose telling the model to inspect an unknown
result before assuming fields.
- renderType pretty mode emits JSDoc tags a TS type can't express: @default,
@format, @deprecated, @minItems/@maxItems (multi-line descriptions preserved).
- Attachments are now opaque handles: a tool's media becomes
{ type:'file', id, mime, filename?, bytes } with no inline bytes. Real bytes
stay host-side in a per-execution attachmentTable; the program propagates or
drops a handle (return it to surface the image to the model+user) but cannot
read or leak the base64. Documents the divergence from prior art in rune.md.
- Records the throw/catch (not errors-as-values) decision in rune.md.
tools.$rune.describe now returns { path, description, signature, input,
output? } with input/output as TypeScript instead of raw JSON Schema.
Rewrite renderType into a total, cycle-safe JSON-Schema -> TS renderer:
resolve local $refs (collapsing recursive refs to their name), render
enums/const as literals, anyOf/oneOf and nullable type arrays as unions,
allOf as an intersection (unwrapping the Pydantic allOf:[{$ref}] shape),
tuples, and additionalProperties as an index signature. Pretty mode emits
JSDoc (multi-line preserved) for described fields, with */ neutralized.
Falls back to any/object and never throws; depth-capped.
Docs updated; code-mode/renderType test coverage expanded.
Backend: code-mode execute now streams per-call progress. Metadata.toolCalls
becomes CallEntry[] ({ tool: dotted-path, status: running|completed|error })
and is published via ctx.metadata on every status change — when a child MCP
call starts and when it resolves/fails — so the tool part updates live.
TUI: add an Execute component (dispatched for the "execute" tool). Condensed
view shows a run header (spinner while running, ✓ when done) plus a live `↳`
line per child tool call, colored on failure; clicking toggles a syntax-
highlighted view of the program source. Unlike Task, there is no child session,
so the call list is sourced entirely from the streamed metadata.
The preview now reports its own comprehensiveness so the model knows when it
has the whole catalog vs. when it must search:
- Overall: "This is the COMPLETE list ..." when every tool fits the budget,
else "This is a PARTIAL list — X of Y tools are shown ...".
- Per namespace: a fully-shown server reads `- github (2 tools)`; a truncated
one is annotated `- alpha (70 tools, 31 shown)` or `- zeta (1 tool, none shown)`.
When complete, the model isn't pushed toward needless $rune.search calls; when
partial, exactly what's missing is unambiguous.
The preview previously showed name + prose per tool but no parameters, so
the model couldn't call a tool correctly without a $rune.describe round-trip
(or a failed guess — e.g. calling context7 resolve-library-id with only
libraryName, missing the required query). Replace the prose preview with a
compact, directly-callable input signature:
tools.context7["resolve-library-id"](input: { query: string; libraryName: string })
All namespaces are still always listed with counts; the budget now caps
inlined signatures, and the description states explicitly that any tool not
shown must be found via $rune.search/$rune.describe first. The full typed
signature (with the Promise return) and schemas remain $rune.describe-only.
The previous wording claimed attachment bytes 'aren't available in code',
but a tool result's { result, attachments } envelope is copied straight
into the sandbox (tool-runtime invoke -> checkedCopyIn), so attachment.url
is a real data: URL string the program can read and route — e.g. feed one
tool's media into another tool's input, which is exactly what code mode is
uniquely good at. Reword the description to say so. Still not the emit
pattern: only `result` becomes conversation text; returned attachments
lower to FileParts and nothing else in the sandbox re-enters the chat.
Add an integration test asserting the data URL is readable in-program.
- Reword the attachment line in the execute description: attachments are
opaque media handles you forward to the user, not byte-readable in code.
- Strip the hardcoded tools.$rune.search/describe block from the runtime's
instructions(): discovery is not a runtime feature (the embedder registers
and documents it), and the baked-in object-arg form contradicted code
mode's positional API. Removes the only prompt discrepancy.
- Make the runtime's unknown-tool suggestion generic instead of naming $rune.
Discovery is now documented in exactly one place (code-mode describe()).
Remove Rune's vestigial built-in $rune.search/$rune.describe (which only
saw effect-Schema Definitions, never our dynamic MCP tools) and the
reserved-namespace guard. Move our ranked search and typed describe under
tools.$rune.* — the runtime's own namespace, separate from MCP server
namespaces and collision-proof since $ never appears in a sanitized
server name. One discovery implementation, no dead code.
Replace the contiguous-substring search with tokenized, field-weighted
scoring adapted from the deferred-tool-search bridge (#34368): exact tool
name > path > description > indexed parameter text, summed across terms
and ranked by relevance. Index each tool's parameter names/descriptions
so tools are findable by their inputs. Keep the namespace filter and
{ items, total } shape. Add unit + end-to-end search tests.
Stand up an in-memory MCP server with text, structured (outputSchema),
image, and failing tools, wire it through convertTool + define, and
exercise search/describe, the result+attachments envelope, structured
composition, image forwarding/suppression, parallel calls, error
propagation, and per-call permission gating.
Always list every MCP namespace, then inline a preview of individual
tools (path + brief) until a character budget is hit; remaining
namespaces show counts only. Front-loads a useful slice of the catalog
to cut discovery round-trips without dumping the full tool list.
Replace the in-process AsyncFunction engine with Rune.execute. MCP tools
are exposed as a host-tool tree (tools.<server>.<tool>) plus top-level
search/describe; each call is permission-gated and coerced to the
{ result, attachments? } envelope. Raise data limits for base64 media.
This adds real sandboxing: host globals are isolated and runaway loops
terminate via the operation limit instead of hanging the event loop.
Expose mcp.defs() so code mode can read MCP outputSchema. Tool calls and
the final return now use one { result, attachments? } envelope; media
blocks become FilePart attachments. describe renders typed signatures
with the structured return type when an outputSchema is present.
Copy the Rune TS AST interpreter into the session package as the
foundation for code-mode execution. Add acorn as a dependency and
promote typescript to a runtime dependency (both required by Rune's
parser/transpile path). Fix effect beta.83 API drift (Schema.Defect
is now a function). Interpreter logic is unchanged; nothing imports
it yet.
Drop the MCP-instructions blending from the execute tool description; just
list namespace names and tool counts on the tool definition. The full server
instructions already live in the system prompt's <mcp_instructions>, and
per-tool detail is fetched on demand via tools.search/tools.describe.
Shrink the execute tool description to namespaces only (server name, tool
count, and a brief note reused from the server's MCP instructions) instead of
inlining every tool signature, so the prompt stays small for large catalogs.
Add in-sandbox discovery: `tools.search(query, { namespace?, limit? })` returns
ranked tool paths + descriptions, and `tools.describe(path)` returns the full
signature and input schema on demand (with tool_not_found suggestions). The
proxy is now recursive so both `tools.<server>.<tool>(args)` and the dotted
`tools[path](args)` returned by search resolve to the catalog key.
Expose connected MCP tools to code mode as per-server namespaces
(`tools.<server>.<tool>(args)`) and generate the execute tool description
from the catalog: one namespace block per server, each tool rendered with a
TypeScript-style input signature derived from its JSON schema plus its
description, and the calling convention stated up front.
The server/tool split is cosmetic; child-call routing re-joins the segments
into the existing flat catalog key, so it stays exact regardless of
underscores in server or tool names.
Add an experimental, off-by-default `execute` tool that runs LLM-authored
JavaScript with a `tools.<name>(args)` proxy over connected MCP tools. When
OPENCODE_EXPERIMENTAL_CODE_MODE is enabled and MCP tools are present, the
session exposes the single code-mode tool instead of registering each MCP
tool directly; child calls route through the native permission path.
Code mode is defined via the standard Tool.define/Tool.init machinery so it
inherits arg decoding and output truncation from the shared wrapper. Tool
results are reduced to structured content or text, and the program's return
value is coerced to text without failing on shape.
Note: execution currently uses an in-process AsyncFunction with no isolation
or timeout; sandboxing is tracked as follow-up work.
Aiden Cline