fix(eve): project execution-denied tool results to provider-safe outputs at the model-call boundary

[iroiro147]

Summary

Fixes #1658.

When a HITL tool approval is denied, eve persists an execution-denied tool-result marker into the session transcript so the UI can render the denial and the action.result projection stays authoritative. On the next turn, that marker was replayed to the AI SDK provider adapter unrecognised, and OpenAI 400s the request:

Missing required parameter: 'input[N].output'

… permanently wedging the session — every subsequent turn replays the same marker and fails the same way.

Fix

Down-project the marker to a provider-safe error-text output on the model-call boundary only (new materializeExecutionDeniedToolResultsForModel(messages) in harness/model-call-messages.ts, wired into tool-loop.ts just before the agent call). Persisted history and the action.result projection keep the authoritative execution-denied shape with the original reason — the wire is translated, not the record.

Tests

• New model-call-messages.test.ts: 6 unit tests covering rewrite of execution-denied, reason embedding, pass-through by reference when nothing matches, and non-interference with other tool-result output shapes.
• Updated tool-loop.test.ts: the model now observes error-text for a denied approval while persisted parts keep execution-denied.
• Full harness unit suite passes: 49 files / 735 tests.

Local gates

• pnpm --filter eve exec vitest run --config vitest.unit.config.ts src/harness/... → all pass
• tsc --noEmit → clean (after pnpm --filter eve build:compiled for #compiled/* imports)
• oxlint --fix <files> → clean
• oxfmt <files> → clean
• pnpm guard:invariants → ok

CI status note

e2e-vercel jobs fail on fork PRs because VERCEL_TOKEN/VERCEL_ORG_ID/VERCEL_PROJECT_ID secrets are not exposed to fork runs — the fixture-deploy step exits with No existing credentials found. That matches the known fork-secret gap class (see also eve#1725 discussion). All other gates (local e2e, integration, scenario, tui, CI, bundle) pass.

[vercel]

@iroiro147 is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.

[iroiro147]

Note on the failures (≈44 jobs): these are the known fork-secret gap, not a regression from this change.

GitHub strips repository/org secrets from runs whose head is a fork, so VERCEL_TOKEN/VERCEL_ORG_ID/VERCEL_PROJECT_ID resolve to empty and every fixture deploy step exits with:

Error: No existing credentials found. Please run `vercel login` or pass "--token"

This matches the known blocker class tracked on eve#1725 / eve#1754 (test-tui fork-gap).

Local gates before opening:

• vitest --config vitest.unit.config.ts on harness: 735/735 pass (49 files), including model-call-messages.test.ts (6/6)
• tsc --noEmit: clean
• oxlint --fix / oxfmt: clean
• pnpm guard:invariants: ok

If a maintainer re-runs this on a branch with secrets available it should go green; otherwise the e2e-vercel failures are expected on fork PRs until the workflow is adjusted to skip them when secrets are absent.

[Rchie121]

Note on the failures (≈44 jobs): these are the known fork-secret gap, not a regression from this change.

GitHub strips repository/org secrets from runs whose head is a fork, so VERCEL_TOKEN/VERCEL_ORG_ID/VERCEL_PROJECT_ID resolve to empty and every fixture deploy step exits with:

Error: No existing credentials found. Please run `vercel login` or pass "--token"

This matches the known blocker class tracked on eve#1725 / eve#1754 (test-tui fork-gap).

Local gates before opening:

• vitest --config vitest.unit.config.ts on harness: 735/735 pass (49 files), including model-call-messages.test.ts (6/6)
• tsc --noEmit: clean
• oxlint --fix / oxfmt: clean
• pnpm guard:invariants: ok

If a maintainer re-runs this on a branch with secrets available it should go green; otherwise the e2e-vercel failures are expected on fork PRs until the workflow is adjusted to skip them when secrets are absent.

Absolutely this is only for maintainers