test(ptc): pin provider usage guidance in recorded program schemas

snapshots/session/both-mode-turn/tool-schemas.expected.json

@@ -322,7 +322,7 @@
     },
     {
       "name": "run_code",
-      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the BODY of an async function (erasable syntax only; top-level `await` and `return` work), and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Only what you print or return is program output — curate it. Image-bearing subtool results are attached after the run. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
+      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the BODY of an async function (erasable syntax only; top-level `await` and `return` work), and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Only what you print or return is program output — curate it. Image-bearing subtool results are attached after the run. Each call runs in a fresh Node process. Node APIs are available through await import(...). Relative paths use the supplied working directory; process.env starts empty. Direct filesystem access follows this execution's sandbox policy. The working directory is the Session's current directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
       "parameters": {
         "type": "object",
         "properties": {

snapshots/session/ptc-node-read-only/tool-schemas.expected.json

@@ -2,7 +2,7 @@
   "initial": [
     {
       "name": "run_code",
-      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the BODY of an async function (erasable syntax only; top-level `await` and `return` work), and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Only what you print or return is program output — curate it. Image-bearing subtool results are attached after the run. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
+      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the BODY of an async function (erasable syntax only; top-level `await` and `return` work), and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Only what you print or return is program output — curate it. Image-bearing subtool results are attached after the run. Each call runs in a fresh Node process. Node APIs are available through await import(...). Relative paths use the supplied working directory; process.env starts empty. Direct filesystem access follows this execution's sandbox policy. The working directory is the Session's current directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
       "parameters": {
         "type": "object",
         "properties": {

snapshots/session/ptc-node-workspace/tool-schemas.expected.json

@@ -2,7 +2,7 @@
   "initial": [
     {
       "name": "run_code",
-      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the BODY of an async function (erasable syntax only; top-level `await` and `return` work), and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Only what you print or return is program output — curate it. Image-bearing subtool results are attached after the run. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
+      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the BODY of an async function (erasable syntax only; top-level `await` and `return` work), and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Only what you print or return is program output — curate it. Image-bearing subtool results are attached after the run. Each call runs in a fresh Node process. Node APIs are available through await import(...). Relative paths use the supplied working directory; process.env starts empty. Direct filesystem access follows this execution's sandbox policy. The working directory is the Session's current directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
       "parameters": {
         "type": "object",
         "properties": {

snapshots/session/ptc-turn/tool-schemas.expected.json

@@ -2,7 +2,7 @@
   "initial": [
     {
       "name": "run_code",
-      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the BODY of an async function (erasable syntax only; top-level `await` and `return` work), and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Only what you print or return is program output — curate it. Image-bearing subtool results are attached after the run. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
+      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the BODY of an async function (erasable syntax only; top-level `await` and `return` work), and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Only what you print or return is program output — curate it. Image-bearing subtool results are attached after the run. Each call runs in a fresh Node process. Node APIs are available through await import(...). Relative paths use the supplied working directory; process.env starts empty. Direct filesystem access follows this execution's sandbox policy. The working directory is the Session's current directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
       "parameters": {
         "type": "object",
         "properties": {

snapshots/web/ptc-escalation-approved/session.v3.jsonl

@@ -18,7 +18,7 @@
 {"type":"session/title","data":{"title":"Use run_code with timeoutMs 120000","messageSeqs":[12],"source":{"kind":"fallback"}}}
 {"type":"assistant/message","data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"reasoning","text":"The user wants me to use run_code with direct Node filesystem access to create approved.txt. Let me attempt the write under read-only sandbox first without escalation.\n\nLet me write the program.\n\nThe instruction says \"do not call nested tools\" — so inside run_code I should just use node:fs/promises directly, no tools.bash etc.\n\nLet me do that."},{"type":"tool-call","id":"call_00_p0f6uzlwMZsoKQfC837b1176","name":"run_code","arguments":"{\"code\": \"const fs = await import(\\\"node:fs/promises\\\");\\nconst cwd = process.cwd();\\nconst target = cwd + \\\"/approved.txt\\\";\\nawait fs.writeFile(target, \\\"approved\\\\n\\\");\\nconst back = await fs.readFile(target, \\\"utf8\\\");\\nreturn { cwd, target, content: back, bytes: Buffer.byteLength(back) };\", \"description\": \"Write approved.txt under read-only sandbox\", \"timeoutMs\": 120000}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:4}}"},"usage":{"inputTokens":1347,"outputTokens":230,"totalTokens":9001,"cacheReadTokens":7424,"reasoningTokens":77},"stream":[{"type":"chunk","time":1789145655763,"chunk":{"type":"block-start","index":0,"blockType":"reasoning"}},{"type":"reasoning-chunks","time0":1789145655763,"index":0,"dt":[114,16,1,0,0,10,0,1,0,14,1,9,1,0,0,10,0,0,0,16,0,12,0,12,1,10,1,0,0,0,12,0,0,0,1,13,0,0,0,13,16,1,12,0,8,0,0,17,0,0,0,8,0,0,0,13,0,13,13,0,0,22,0,0,0,5,0,13,0,0,12,0,0,0,0,18],"texts":["The"," user"," wants"," me"," to"," use"," run","_code"," with"," direct"," Node"," files","ystem"," access"," to"," create"," approved",".txt","."," Let"," me"," attempt"," the"," write"," under"," read","-only"," sand","box"," first"," without"," escalation",".\n\n","Let"," me"," write"," the"," program",".\n\n","The"," instruction"," says"," \"","do"," not"," call"," nested"," tools","\""," —"," so"," inside"," run","_code"," I"," should"," just"," use"," node",":","fs","/p","rom","ises"," directly",","," no"," tools",".b","ash"," etc",".\n\n","Let"," me"," do"," that","."]},{"type":"chunk","time":1789145656223,"chunk":{"type":"block-start","index":1,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":1789145656223,"index":1,"dt":[12,0,0,0,0,12,0,0,0,0,13,0,1,0,0,0,13,0,0,0,1,13,0,0,14,0,0,0,13,1,0,0,0,14,0,0,0,0,0,12,0,0,0,0,0,19,0,3,11,15,0,0,0,1,0,9,0,0,0,1,0,11,0,0,0,15,0,0,14,0,0,0,19,0,0,0,1,0,7,1,0,0,8,0,0,13,0,0,0,12,0,0,15,9,0,0,0,14,0,12,0,0,1,0,14,0,12],"id":"call_00_p0f6uzlwMZsoKQfC837b1176","name":"run_code","args":["","{","\"","code","\"",": ","\"","const"," fs"," ="," await"," import","(\\\"","node",":","fs","/p","rom","ises","\\\");\\n","const"," c","wd"," ="," process",".c","wd","();\\n","const"," target"," ="," c","wd"," +"," \\\"/","approved",".txt","\\\";\\n","await"," fs",".write","File","(target",","," \\\"","approved","\\\\n","\\\");\\n","const"," back"," ="," await"," fs",".read","File","(target",","," \\\"","utf","8","\\\");\\n","return"," {"," c","wd",","," target",","," content",":"," back",","," bytes",":"," Buffer",".byte","Length","(","back",")"," }",";","\"",", ","\"","description","\"",": ","\"","Write"," approved",".txt"," under"," read","-only"," sand","box","\"",", ","\"","time","out","Ms","\"",": ","120","000","}"]},{"type":"chunk","time":1789145656595,"chunk":{"type":"block-end","index":0,"block":{"type":"reasoning","text":"The user wants me to use run_code with direct Node filesystem access to create approved.txt. Let me attempt the write under read-only sandbox first without escalation.\n\nLet me write the program.\n\nThe instruction says \"do not call nested tools\" — so inside run_code I should just use node:fs/promises directly, no tools.bash etc.\n\nLet me do that."}}},{"type":"chunk","time":1789145656595,"chunk":{"type":"block-end","index":1,"block":{"type":"tool-call","id":"call_00_p0f6uzlwMZsoKQfC837b1176","name":"run_code","arguments":"{\"code\": \"const fs = await import(\\\"node:fs/promises\\\");\\nconst cwd = process.cwd();\\nconst target = cwd + \\\"/approved.txt\\\";\\nawait fs.writeFile(target, \\\"approved\\\\n\\\");\\nconst back = await fs.readFile(target, \\\"utf8\\\");\\nreturn { cwd, target, content: back, bytes: Buffer.byteLength(back) };\", \"description\": \"Write approved.txt under read-only sandbox\", \"timeoutMs\": 120000}"}}},{"type":"chunk","time":1789145656595,"chunk":{"type":"usage","usage":{"inputTokens":1347,"outputTokens":230,"totalTokens":9001,"cacheReadTokens":7424,"reasoningTokens":77}}},{"type":"chunk","time":1789145656595,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
 {"type":"tool/call","data":{"turn":1,"step":1,"callId":"call_00_p0f6uzlwMZsoKQfC837b1176","name":"run_code","arguments":"{\"code\": \"const fs = await import(\\\"node:fs/promises\\\");\\nconst cwd = process.cwd();\\nconst target = cwd + \\\"/approved.txt\\\";\\nawait fs.writeFile(target, \\\"approved\\\\n\\\");\\nconst back = await fs.readFile(target, \\\"utf8\\\");\\nreturn { cwd, target, content: back, bytes: Buffer.byteLength(back) };\", \"description\": \"Write approved.txt under read-only sandbox\", \"timeoutMs\": 120000}"}}
-{"type":"tool/result","data":{"turn":1,"step":1,"message":{"source":{"kind":"tool","callId":"call_00_p0f6uzlwMZsoKQfC837b1176"},"content":[{"type":"tool-result","toolCallId":"call_00_p0f6uzlwMZsoKQfC837b1176","content":[{"type":"text","text":"Error: code run failed (exception): Error: EPERM: operation not permitted, open '{{cwd}}/approved.txt'\n    at async open (node:internal/fs/promises:697:25)\n    at async Module.writeFile (node:internal/fs/promises:1317:14)\n    at async eval (eval at runProgram (file:///Users/cty/dsh-ptc-pr3/packages/code-runtime/code-runtime-node/lib/process.js:1029:31), <anonymous>:7:1)\n    at async runProgram (file:///Users/cty/dsh-ptc-pr3/packages/code-runtime/code-runtime-node/lib/process.js:1029:25)\n    at async runNodeMain (file:///Users/cty/dsh-ptc-pr3/packages/code-runtime/code-runtime-node/lib/process.js:1086:3)\n    at async file:///Users/cty/dsh-ptc-pr3/packages/code-runtime/code-runtime-node/lib/process.js:1105:1\nFile sandbox: read-only; enforcement: full; operation denied. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically."}],"isError":true}],"role":"user","id":"{{message:5}}"},"error":{"name":"CodeRunFailedError","code":"CODE_RUN_FAILED"}},"sourceEventSeqs":[18],"surfaceOp":"append"}
+{"type":"tool/result","data":{"turn":1,"step":1,"message":{"source":{"kind":"tool","callId":"call_00_p0f6uzlwMZsoKQfC837b1176"},"content":[{"type":"tool-result","toolCallId":"call_00_p0f6uzlwMZsoKQfC837b1176","content":[{"type":"text","text":"Error: code run failed (exception): Error: EPERM: operation not permitted, open '{{cwd}}/approved.txt'\n    at async open (node:internal/fs/promises:697:25)\n    at async Module.writeFile (node:internal/fs/promises:1317:14)\n    at async eval (eval at runProgram (file:///Users/cty/dsh-ptc-pr3/packages/code-runtime/code-runtime-node/lib/process.js:1030:31), <anonymous>:7:1)\n    at async runProgram (file:///Users/cty/dsh-ptc-pr3/packages/code-runtime/code-runtime-node/lib/process.js:1030:25)\n    at async runNodeMain (file:///Users/cty/dsh-ptc-pr3/packages/code-runtime/code-runtime-node/lib/process.js:1098:3)\nFile sandbox: read-only; enforcement: full; operation denied. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically."}],"isError":true}],"role":"user","id":"{{message:5}}"},"error":{"name":"CodeRunFailedError","code":"CODE_RUN_FAILED"}},"sourceEventSeqs":[18],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":1}}
 {"type":"step/start","data":{"turn":1,"step":2}}
 {"type":"assistant/message","data":{"turn":1,"step":2,"message":{"role":"assistant","content":[{"type":"reasoning","text":"The write was denied with EPERM under read-only sandbox. Now retry with sandbox_permissions \"workspace-write\" and the specified justification."},{"type":"text","text":"The read-only sandbox denied the write with `EPERM`. Retrying the same program with the requested escalation."},{"type":"tool-call","id":"call_00_mbdxC6SS8svc8XoECgMN3999","name":"run_code","arguments":"{\"code\": \"const fs = await import(\\\"node:fs/promises\\\");\\nconst cwd = process.cwd();\\nconst target = cwd + \\\"/approved.txt\\\";\\nawait fs.writeFile(target, \\\"approved\\\\n\\\");\\nconst back = await fs.readFile(target, \\\"utf8\\\");\\nreturn { cwd, target, content: back, bytes: Buffer.byteLength(back) };\", \"description\": \"Write approved.txt with workspace-write escalation\", \"timeoutMs\": 120000, \"sandbox_permissions\": \"workspace-write\", \"justification\": \"Create the file requested by the user\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:6}}"},"usage":{"inputTokens":401,"outputTokens":254,"totalTokens":9615,"cacheReadTokens":8960,"reasoningTokens":33},"stream":[{"type":"chunk","time":1789145657462,"chunk":{"type":"block-start","index":0,"blockType":"reasoning"}},{"type":"reasoning-chunks","time0":1789145657462,"index":0,"dt":[66,13,0,0,0,0,0,12,0,18,1,0,0,18,0,6,1,0,9,1,0,0,0,0,14,0,0,0,0,13,15,0],"texts":["The"," write"," was"," denied"," with"," E","PER","M"," under"," read","-only"," sand","box","."," Now"," ret","ry"," with"," sand","box","_per","missions"," \"","works","pace","-w","rite","\""," and"," the"," specified"," justification","."]},{"type":"chunk","time":1789145657649,"chunk":{"type":"block-start","index":1,"blockType":"text"}},{"type":"text-chunks","time0":1789145657649,"index":1,"dt":[0,12,0,13,0,0,0,1,0,13,1,0,0,0,0,21,9,1,0,0,0,13,0],"texts":["The"," read","-only"," sand","box"," denied"," the"," write"," with"," `","EP","ER","M","`."," Ret","rying"," the"," same"," program"," with"," the"," requested"," escalation","."]},{"type":"chunk","time":1789145657759,"chunk":{"type":"block-start","index":2,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":1789145657759,"index":2,"dt":[16,0,0,0,0,13,0,0,0,0,0,14,0,0,0,0,0,12,0,0,0,0,0,13,1,0,0,0,0,12,0,0,0,0,0,14,0,0,0,1,0,14,0,0,0,23,0,0,0,0,0,2,0,0,0,0,0,14,0,0,0,0,0,12,0,0,0,0,0,14,0,0,0,0,0,13,0,0,0,0,16,1,12,0,0,0,1,10,0,0,0,0,13,0,13,0,0,15,0,0,12,0,0,0,15,0,11,0,14,0,0,0,0,0,44,0,0,0,0,0,0,0,0,0,9,0,0,0,13,0,0,16,0,0,0,11],"id":"call_00_mbdxC6SS8svc8XoECgMN3999","name":"run_code","args":["","{","\"","code","\"",": ","\"","const"," fs"," ="," await"," import","(\\\"","node",":","fs","/p","rom","ises","\\\");\\n","const"," c","wd"," ="," process",".c","wd","();\\n","const"," target"," ="," c","wd"," +"," \\\"/","approved",".txt","\\\";\\n","await"," fs",".write","File","(target",","," \\\"","approved","\\\\n","\\\");\\n","const"," back"," ="," await"," fs",".read","File","(target",","," \\\"","utf","8","\\\");\\n","return"," {"," c","wd",","," target",","," content",":"," back",","," bytes",":"," Buffer",".byte","Length","(","back",")"," }",";","\"",", ","\"","description","\"",": ","\"","Write"," approved",".txt"," with"," workspace","-w","rite"," escalation","\"",", ","\"","time","out","Ms","\"",": ","120","000",", ","\"","sand","box","_per","missions","\"",": ","\"","works","pace","-w","rite","\"",", ","\"","just","ification","\"",": ","\"","Create"," the"," file"," requested"," by"," the"," user","\"","}"]},{"type":"chunk","time":1789145658191,"chunk":{"type":"block-end","index":0,"block":{"type":"reasoning","text":"The write was denied with EPERM under read-only sandbox. Now retry with sandbox_permissions \"workspace-write\" and the specified justification."}}},{"type":"chunk","time":1789145658191,"chunk":{"type":"block-end","index":1,"block":{"type":"text","text":"The read-only sandbox denied the write with `EPERM`. Retrying the same program with the requested escalation."}}},{"type":"chunk","time":1789145658191,"chunk":{"type":"block-end","index":2,"block":{"type":"tool-call","id":"call_00_mbdxC6SS8svc8XoECgMN3999","name":"run_code","arguments":"{\"code\": \"const fs = await import(\\\"node:fs/promises\\\");\\nconst cwd = process.cwd();\\nconst target = cwd + \\\"/approved.txt\\\";\\nawait fs.writeFile(target, \\\"approved\\\\n\\\");\\nconst back = await fs.readFile(target, \\\"utf8\\\");\\nreturn { cwd, target, content: back, bytes: Buffer.byteLength(back) };\", \"description\": \"Write approved.txt with workspace-write escalation\", \"timeoutMs\": 120000, \"sandbox_permissions\": \"workspace-write\", \"justification\": \"Create the file requested by the user\"}"}}},{"type":"chunk","time":1789145658191,"chunk":{"type":"usage","usage":{"inputTokens":401,"outputTokens":254,"totalTokens":9615,"cacheReadTokens":8960,"reasoningTokens":33}}},{"type":"chunk"Line truncated

snapshots/web/ptc-round/tool-schemas.expected.json

@@ -2,7 +2,7 @@
   "initial": [
     {
       "name": "run_code",
-      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the BODY of an async function (erasable syntax only; top-level `await` and `return` work), and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Only what you print or return is program output — curate it. Image-bearing subtool results are attached after the run. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
+      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the BODY of an async function (erasable syntax only; top-level `await` and `return` work), and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Only what you print or return is program output — curate it. Image-bearing subtool results are attached after the run. Each call runs in a fresh Node process. Node APIs are available through await import(...). Relative paths use the supplied working directory; process.env starts empty. Direct filesystem access follows this execution's sandbox policy. The working directory is the Session's current directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
       "parameters": {
         "type": "object",
         "properties": {