Parse and validate tool inputs at the Core boundary

Cargo.toml

@@ -66,6 +66,9 @@ url = "2"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
+# Schema validation
+jsonschema = { version = "0.50.1", default-features = false }
+
 # Internal crates
 aimux-core = { path = "aimux-core", version = "0.3.0" }
 aimux-providers = { path = "aimux-providers", version = "0.3.0" }

aimux-core/Cargo.toml

@@ -27,6 +27,7 @@ tokio-util = "0.7"
 httpdate = { workspace = true }
 rand = { workspace = true }
 base64 = "0.22"
+jsonschema = { workspace = true }
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "test-util"] }

aimux-core/src/content.rs

@@ -99,6 +99,11 @@ pub enum ContentPart {
         tool_name: String,
         /// Arguments as a JSON value (usually an object).
         input: Value,
+        /// Whether the tool call is executed by the provider rather than by
+        /// the client. This is part of the prompt contract because providers
+        /// need it to replay server tool calls on a later turn.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        provider_executed: Option<bool>,
         /// Provider-assigned thought signature (e.g. Google Gemini
         /// `thoughtSignature`). Must be echoed back verbatim on the follow-up
         /// turn when the tool result is sent.
@@ -161,6 +166,7 @@ impl ContentPart {
             tool_call_id: tool_call_id.into(),
             tool_name: tool_name.into(),
             input,
+            provider_executed: None,
             thought_signature: None,
             provider_options: None,
         }

aimux-core/src/error.rs

@@ -178,8 +178,36 @@ pub enum AiMuxError {
     #[error("invalid response data: {0}")]
     InvalidResponseData(String),
 
-    #[error("tool error: {0}")]
-    Tool(String),
+    /// A model requested a tool that was not present in the call's tool set.
+    /// Message templates for the three tool variants match the AI SDK verbatim
+    /// (`NoSuchToolError` / `InvalidToolInputError` / `ToolCallRepairError`):
+    /// the AI SDK feeds these strings back to the model as tool-error content,
+    /// so the wording — including the available-tools list — is contract.
+    #[error("Model tried to call unavailable tool '{tool_name}'. {}", no_such_tool_availability(.available_tools))]
+    NoSuchTool {
+        tool_name: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        available_tools: Option<Vec<String>>,
+        /// Original argument text, when supplied by the provider. Absent in
+        /// older serialized errors and errors constructed without a call.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        tool_input: Option<String>,
+    },
+
+    /// A tool call could not be parsed or did not satisfy its input schema.
+    #[error("Invalid input for tool {tool_name}: {cause}")]
+    InvalidToolInput {
+        tool_name: String,
+        tool_input: String,
+        cause: String,
+    },
+
+    /// The repair callback failed or returned a call that was still invalid.
+    #[error("Error repairing tool call: {cause}")]
+    ToolCallRepair {
+        original_error: Box<AiMuxError>,
+        cause: Box<AiMuxError>,
+    },
 
     #[error("invalid argument: {0}")]
     InvalidArgument(String),
@@ -228,6 +256,13 @@ pub enum AiMuxError {
     Other(String),
 }
 
+fn no_such_tool_availability(available_tools: &Option<Vec<String>>) -> String {
+    match available_tools {
+        Some(tools) => format!("Available tools: {}.", tools.join(", ")),
+        None => "No tools are available.".to_string(),
+    }
+}
+
 /// Canonical serde classification: syntactically broken/truncated JSON is a
 /// parse failure; well-formed JSON that violates the expected shape is invalid
 /// response data. `Io` has no transport context here, so it stays `JsonParse`;