Parse and validate tool inputs at the Core boundary

Cargo.toml

@@ -69,6 +69,7 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
 # Schema / validation
 schemars = "0.8"
+jsonschema = { version = "0.50.1", default-features = false }
 
 # Proc-macro support
 proc-macro2 = "1"

aimux-core/Cargo.toml

@@ -19,6 +19,7 @@ tracing = { workspace = true }
 ts-rs = { workspace = true }
 tokio-util = "0.7"
 base64 = "0.22"
+jsonschema = { workspace = true }
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt"] }

aimux-core/src/content.rs

@@ -99,6 +99,11 @@ pub enum ContentPart {
         tool_name: String,
         /// Arguments as a JSON value (usually an object).
         input: Value,
+        /// Whether the tool call is executed by the provider rather than by
+        /// the client. This is part of the prompt contract because providers
+        /// need it to replay server tool calls on a later turn.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        provider_executed: Option<bool>,
         /// Provider-assigned thought signature (e.g. Google Gemini
         /// `thoughtSignature`). Must be echoed back verbatim on the follow-up
         /// turn when the tool result is sent.
@@ -161,6 +166,7 @@ impl ContentPart {
             tool_call_id: tool_call_id.into(),
             tool_name: tool_name.into(),
             input,
+            provider_executed: None,
             thought_signature: None,
             provider_options: None,
         }

aimux-core/src/error.rs

@@ -99,8 +99,32 @@ pub enum AiMuxError {
     #[error("invalid response data: {0}")]
     InvalidResponseData(String),
 
-    #[error("tool error: {0}")]
-    Tool(String),
+    /// A model requested a tool that was not present in the call's tool set.
+    /// Message templates for the three tool variants match the AI SDK verbatim
+    /// (`NoSuchToolError` / `InvalidToolInputError` / `ToolCallRepairError`):
+    /// the AI SDK feeds these strings back to the model as tool-error content,
+    /// so the wording — including the available-tools list — is contract.
+    #[error("Model tried to call unavailable tool '{tool_name}'. {}", no_such_tool_availability(.available_tools))]
+    NoSuchTool {
+        tool_name: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        available_tools: Option<Vec<String>>,
+    },
+
+    /// A tool call could not be parsed or did not satisfy its input schema.
+    #[error("Invalid input for tool {tool_name}: {cause}")]
+    InvalidToolInput {
+        tool_name: String,
+        tool_input: String,
+        cause: String,
+    },
+
+    /// The optional repair callback failed while handling an invalid call.
+    #[error("Error repairing tool call: {cause}")]
+    ToolCallRepair {
+        original_error: Box<AiMuxError>,
+        cause: Box<AiMuxError>,
+    },
 
     #[error("invalid argument: {0}")]
     InvalidArgument(String),
@@ -149,6 +173,13 @@ pub enum AiMuxError {
     Other(String),
 }
 
+fn no_such_tool_availability(available_tools: &Option<Vec<String>>) -> String {
+    match available_tools {
+        Some(tools) => format!("Available tools: {}.", tools.join(", ")),
+        None => "No tools are available.".to_string(),
+    }
+}
+
 /// Canonical serde classification: syntactically broken/truncated JSON is a
 /// parse failure; well-formed JSON that violates the expected shape is invalid
 /// response data. `Io` has no transport context here, so it stays `JsonParse`;