fix: gate tool execution on raw stream completion, not just JSON validity

packages/runtime/src/__tests__/ai-sdk-backend.test.ts

@@ -9316,6 +9316,11 @@ describe('AiSdkBackend RunTrace', () => {
           request: { messages: [] },
           continuation: 'none',
         }),
+        toolCallSafety: Promise.resolve({
+          hadRawArgumentEvidence: false,
+          proofs: new Map(),
+          atomicProofs: new Map(),
+        }),
       };
     };
 
@@ -12007,6 +12012,11 @@ describe('AiSdkBackend thinking persistence', () => {
         request: { messages: [] },
         continuation: 'none',
       }),
+      toolCallSafety: Promise.resolve({
+        hadRawArgumentEvidence: false,
+        proofs: new Map(),
+        atomicProofs: new Map(),
+      }),
     });
 
     for await (const event of backend.send({ turnId: 'turn-1', text: 'hi', context: [] })) {

packages/runtime/src/__tests__/deferred-guard.test.ts

@@ -138,7 +138,31 @@ describe('tool-availability execute-boundary guard', () => {
   test('keeps WriteStdin args exact across canonical ledgers and projects telemetry', async () => {
     const h = makeHarness();
     const implCalls: string[] = [];
-    const t = tool('WriteStdin', implCalls);
+    // The real WriteStdin tool (shell-tools.ts, buildWriteStdinTool) declares
+    // a heavyweight z.preprocess/refine schema enforcing PTY-specific business
+    // rules (ref format, input byte length, well-formed Unicode, ...) that
+    // this test has nothing to do with. `tool()`'s shared z.object({}) is
+    // wrong here for a different reason: ToolRuntime now executes the
+    // schema's own parsed value (see tool-runtime.ts), and an empty schema
+    // strips every key, which used to be masked only because the pre-fix
+    // ToolRuntime discarded that parsed value and executed the raw input
+    // instead. A schema matching WriteStdin's real field names, with no
+    // business-rule refinements, is what this test actually needs: proof
+    // that already-valid args pass through Runtime's plumbing unchanged, not
+    // a reproduction of WriteStdin's own validation.
+    const t: MakaTool = {
+      name: 'WriteStdin',
+      description: 'WriteStdin',
+      parameters: z.object({
+        ref: z.string(),
+        input: z.string(),
+        size: z.object({ cols: z.number(), rows: z.number() }),
+      }),
+      impl: () => {
+        implCalls.push('WriteStdin');
+        return { ok: true };
+      },
+    };
     const args = {
       ref: 'maka://runtime/background-tasks/pty-1',
       input: 'password=ordinary-audited-input\r',