solid_loop 0.0.4 → 0.0.5

data/app/services/solid_loop/adapters/native.rb

@@ -3,12 +3,14 @@ module SolidLoop
     class Native
       attr_writer :on_chunk_proc
 
-      def initialize(base_url:, api_token:, payload:, streaming: false, reasoning_strategies: [], dialect: nil, model_name: nil, fallback_messages_text: "", read_timeout: nil, cancellation_check: nil)
+      def initialize(base_url:, api_token:, payload:, streaming: false, reasoning_strategies: nil, dialect: nil, model_name: nil, fallback_messages_text: "", read_timeout: nil, cancellation_check: nil)
         @base_url = base_url
         @api_token = api_token
         @payload = payload
         @streaming = streaming
-        @reasoning_strategies = Array(reasoning_strategies)
+        # nil is meaningful and must survive: it means "let the dialect choose",
+        # which is not the same as [] ("send no reasoning back").
+        @reasoning_strategies = reasoning_strategies.nil? ? nil : Array(reasoning_strategies)
         @model_name = model_name
         @fallback_messages_text = fallback_messages_text
         # Single coherent read-timeout source: when no explicit
@@ -31,13 +33,14 @@ module SolidLoop
         @last_ui_update_at = Time.current
         @first_token_at = nil
         @content_started_at = nil
+        # Latched true the moment a chunk is handed to the caller; forbids retry
+        # from then on (see emit_chunk_event / retry_allowed?).
+        @emitted_to_caller = false
         @aggregator = SolidLoop::SseStreamAggregator.new
       end
 
       def call
-        @request_started_at = Time.current
-
-        @dialect.apply_reasoning_strategies!(@payload[:messages], @reasoning_strategies)
+        reasoning_carried = @dialect.apply_reasoning_strategies!(@payload[:messages], @reasoning_strategies)
         final_payload = @dialect.respond_to?(:render_payload) ? @dialect.render_payload(@payload) : @payload
         url = build_url
 
@@ -54,26 +57,39 @@ module SolidLoop
           f.adapter Faraday.default_adapter
         end
 
-        caller_thread = Thread.current
-        stop_watchdog = false
-        _watchdog = build_watchdog(caller_thread, stop_flag: -> { stop_watchdog })
+        attempt = 0
+        loop do
+          attempt += 1
+          # Per-attempt reset, so ttft/duration and the aggregated stream describe
+          # the attempt that actually produced the answer, not the discarded ones.
+          # Retries themselves stay visible in the wire log.
+          reset_attempt_state!
 
-        begin
-          @response = conn.post do |req|
-            req.headers = headers
-            req.body = final_payload.to_json
-
-            if @streaming
-              req.options.on_data = proc do |chunk, _overall_received_bytes|
-                @debug_buffer.write(chunk)
-                @first_token_at ||= Time.current
-                data = parse_stream_chunk(chunk)
-                emit_chunk_event(data)
-              end
-            end
+          transient = nil
+          begin
+            post_once(conn, headers, final_payload)
+            transient = retry_after_seconds(@response) if retryable_response?(@response)
+          rescue Faraday::ConnectionFailed => e
+            # The connection never established, so no bytes reached the caller and
+            # the request provably did not execute — safe to repeat. A
+            # Faraday::TimeoutError is deliberately NOT caught: we already waited
+            # the full read_timeout, the request may well have been served, and
+            # repeating it would multiply the turn's wall clock.
+            raise e unless retry_allowed?(attempt)
+
+            @log_buffer.puts("retry: attempt #{attempt} failed with #{e.class}: #{e.message}")
+            wait_before_retry(backoff_delay(attempt))
+            next
           end
-        ensure
-          stop_watchdog = true
+
+          break unless transient
+          break unless retry_allowed?(attempt)
+
+          @log_buffer.puts(
+            "retry: attempt #{attempt} got HTTP #{@response.status}" \
+            "#{transient == :backoff ? '' : " (Retry-After: #{transient}s)"}"
+          )
+          wait_before_retry(transient == :backoff ? backoff_delay(attempt) : transient)
         end
 
         duration = (Time.current - @request_started_at).to_f
@@ -95,6 +111,8 @@ module SolidLoop
           fallback_messages_text: @fallback_messages_text
         )
 
+        annotate_reasoning_carry!(normalized_data, reasoning_carried)
+
         {
           response: @response,
           normalized_data: normalized_data,
@@ -117,6 +135,24 @@ module SolidLoop
 
       private
 
+      # Records what this request's prompt spent on reasoning from earlier turns,
+      # so the cost is a number on the message rather than something a host has
+      # to reconstruct from message lengths after the fact. `inline_chars` is the
+      # part welded into `content` — the part every provider bills.
+      def annotate_reasoning_carry!(normalized_data, carried)
+        return unless normalized_data.is_a?(Hash) && carried.is_a?(Hash)
+        return if carried[:chars].to_i.zero?
+
+        normalized_data[:metadata] = (normalized_data[:metadata] || {}).merge(
+          "reasoning_carried" => {
+            "messages" => carried[:messages].to_i,
+            "chars" => carried[:chars].to_i,
+            "inline_chars" => carried[:inline_chars].to_i,
+            "tokens_est" => carried[:chars].to_i / 4
+          }
+        )
+      end
+
       def build_watchdog(target_thread, stop_flag:)
         return nil unless @cancellation_check
 
@@ -163,8 +199,105 @@ module SolidLoop
         )
 
         @on_chunk_proc&.call(data[:content], data[:reasoning], data[:tool_calls], metrics)
+        # The retry gate: once a chunk has reached the caller, the assistant
+        # message shell already holds partial content and re-sending would
+        # concatenate two generations. Set at the exact call site, not merely on
+        # "bytes arrived" — a streamed ERROR body arrives as bytes but never
+        # reaches the caller, and that case must stay retryable.
+        @emitted_to_caller = true
         @last_ui_update_at = Time.current
       end
+
+      def post_once(conn, headers, final_payload)
+        caller_thread = Thread.current
+        stop_watchdog = false
+        _watchdog = build_watchdog(caller_thread, stop_flag: -> { stop_watchdog })
+
+        @response = conn.post do |req|
+          req.headers = headers
+          req.body = final_payload.to_json
+
+          if @streaming
+            req.options.on_data = proc do |chunk, _overall_received_bytes|
+              @debug_buffer.write(chunk)
+              @first_token_at ||= Time.current
+              data = parse_stream_chunk(chunk)
+              emit_chunk_event(data)
+            end
+          end
+        end
+      ensure
+        stop_watchdog = true
+      end
+
+      # Everything an attempt accumulates, cleared so a retry starts from zero.
+      # @emitted_to_caller is NOT reset — it is the irreversible "the shell has
+      # been written to" latch that forbids any further retry.
+      def reset_attempt_state!
+        @request_started_at = Time.current
+        @first_token_at     = nil
+        @content_started_at = nil
+        @last_ui_update_at  = Time.current
+        @aggregator         = SolidLoop::SseStreamAggregator.new
+        @debug_buffer       = StringIO.new
+        @response           = nil
+      end
+
+      def retry_allowed?(attempt)
+        return false if @emitted_to_caller
+
+        attempt <= SolidLoop.config.llm_retries
+      end
+
+      def retryable_response?(response)
+        response && SolidLoop.config.llm_retry_statuses.include?(response.status)
+      end
+
+      # The provider's own instruction, capped — or :backoff to fall back to the
+      # exponential curve. Accepts both RFC 9110 forms: delta-seconds and an
+      # HTTP-date.
+      def retry_after_seconds(response)
+        raw = response.headers&.[]("retry-after") || response.headers&.[]("Retry-After")
+        return :backoff if raw.blank?
+
+        seconds =
+          if raw.to_s.strip.match?(/\A\d+(\.\d+)?\z/)
+            raw.to_f
+          else
+            begin
+              (Time.httpdate(raw.to_s) - Time.current).to_f
+            rescue ArgumentError
+              nil
+            end
+          end
+
+        return :backoff if seconds.nil?
+
+        [ [ seconds, 0.0 ].max, SolidLoop.config.llm_retry_max_delay ].min
+      end
+
+      def backoff_delay(attempt)
+        delay = SolidLoop.config.llm_retry_base_delay * (2**(attempt - 1))
+        [ delay, SolidLoop.config.llm_retry_max_delay ].min
+      end
+
+      # Waits in short slices so a pause/stop issued during the backoff is
+      # honored within a second rather than after the full delay — the same
+      # cancellation contract the in-flight watchdog provides.
+      def wait_before_retry(seconds)
+        deadline = Time.current + seconds.to_f
+        while Time.current < deadline
+          if @cancellation_check
+            active = begin
+              @cancellation_check.call
+            rescue StandardError
+              true # can't determine status (e.g. test transactions) — assume active
+            end
+            raise SolidLoop::CancellationError, "Loop cancelled during retry backoff" unless active
+          end
+          sleep([ 0.25, deadline - Time.current ].min)
+        end
+      end
     end
   end
 end

data/app/services/solid_loop/dialects/anthropic.rb

@@ -3,6 +3,16 @@
 module SolidLoop
   module Dialects
     class Anthropic
+      # Anthropic REQUIRES max_tokens on every request (unlike the OpenAI
+      # dialect, where an absent key lets the provider pick), so this dialect
+      # must supply one when the agent did not. 64k matches the recommended
+      # default for STREAMING requests, which is what SolidLoop does by default
+      # (`Base#streaming?` is true) — a low cap truncates a turn mid-`tool_use`,
+      # which costs a whole agent step, not just a sentence. Current Claude
+      # models accept up to 128k output tokens; override per agent via
+      # `Base#max_tokens` when you want a tighter ceiling.
+      DEFAULT_MAX_TOKENS = 64_000
+
       def completion_url(base_url)
         base_url.to_s.gsub(/\/+$/, "") + "/v1/messages"
       end
@@ -13,13 +23,23 @@ module SolidLoop
         h
       end
 
+      # Anthropic's native shape is a `thinking` content block carrying the
+      # signature the server issued with it. That signature is the whole point:
+      # Anthropic verifies it, so a replayed thought is provably the model's own
+      # and does not have to be re-billed as ordinary text in the body. Messages
+      # with no captured signature (anything written before this dialect started
+      # storing one) send no reasoning rather than a block that would 400.
+      def default_reasoning_strategies
+        [ :anthropic_signed ]
+      end
+
       def apply_reasoning_strategies!(messages, strategies)
-        return unless messages.is_a?(Array)
+        return SolidLoop::Dialects::ReasoningPacker.empty_report unless messages.is_a?(Array)
 
-        filtered = strategies.reject { |s| s == :gemini_signed }
-        messages.each do |msg|
-          SolidLoop::Dialects::ReasoningPacker.pack(msg, filtered)
-        end
+        strategies = default_reasoning_strategies if strategies.nil?
+
+        filtered = Array(strategies).reject { |s| s == :gemini_signed }
+        SolidLoop::Dialects::ReasoningPacker.pack_all(messages, filtered)
       end
 
       def render_payload(payload)
@@ -31,13 +51,19 @@ module SolidLoop
 
         anthropic_payload = {
           model:      payload[:model],
-          max_tokens: payload[:max_tokens] || 8096,
+          max_tokens: payload[:max_tokens] || DEFAULT_MAX_TOKENS,
           messages:   merge_tool_results(non_system.map { |m| map_message(m) })
         }.compact
 
         anthropic_payload[:system]      = system_msg[:content] if system_msg
         anthropic_payload[:temperature] = payload[:temperature] if payload[:temperature]
 
+        # Anthropic nests the effort level inside output_config rather than
+        # taking a top-level parameter the way OpenAI-compatible endpoints do.
+        if payload[:reasoning_effort].present?
+          anthropic_payload[:output_config] = { effort: payload[:reasoning_effort].to_s }
+        end
+
         if payload[:tools]&.any?
           anthropic_payload[:tools] = payload[:tools].map { |t| map_tool(t) }
         end
@@ -55,7 +81,10 @@ module SolidLoop
         {
           content:    text_block&.dig("text"),
           reasoning:  thinking_block&.dig("thinking"),
-          tool_calls: map_tool_calls(tool_blocks)
+          tool_calls: map_tool_calls(tool_blocks),
+          # Kept under the same metadata key the Gemini dialect uses, so
+          # MessageBuilding has one place to read a signature from.
+          metadata:   { "thought_signature" => thinking_block&.dig("signature") }.compact
         }
       end
 
@@ -74,7 +103,7 @@ module SolidLoop
           reasoning:  res[:reasoning],
           tool_calls: res[:tool_calls],
           usage:      usage_data,
-          metadata:   { "model" => data["model"].presence }.compact
+          metadata:   res[:metadata].merge({ "model" => data["model"].presence }.compact)
         }
       end
 
@@ -94,8 +123,12 @@ module SolidLoop
           }
         when "assistant"
           content = []
-          content << { type: "thinking", thinking: m[:_sl_reasoning] } if m[:_sl_reasoning].present?
-          content << { type: "text", text: m[:content] }               if m[:content].present?
+          # The thinking block must come first, and must carry its signature —
+          # the packer only sets the pair together (see ReasoningPacker).
+          if m[:thinking].present?
+            content << { type: "thinking", thinking: m[:thinking], signature: m[:thinking_signature] }
+          end
+          content << { type: "text", text: m[:content] } if m[:content].present?
 
           if m[:tool_calls].present?
             m[:tool_calls].each do |tc|

data/app/services/solid_loop/dialects/gemini.rb

@@ -16,7 +16,11 @@ module SolidLoop
           contents: payload[:messages].map { |m| map_message(m) },
           generationConfig: {
             temperature: payload[:temperature],
-            maxOutputTokens: payload[:max_tokens]
+            maxOutputTokens: payload[:max_tokens],
+            # Gemini 3+ takes a discrete thinkingLevel, upper-cased, nested under
+            # thinkingConfig. (Gemini 2.5 instead takes a numeric thinkingBudget,
+            # and the two are mutually exclusive — sending both is a 400.)
+            thinkingConfig: thinking_config(payload)
           }.compact
         }
         if payload[:tools]&.any?
@@ -25,34 +29,70 @@ module SolidLoop
         gemini_payload
       end
 
+      def thinking_config(payload)
+        return nil if payload[:reasoning_effort].blank?
+
+        { thinkingLevel: payload[:reasoning_effort].to_s.upcase }
+      end
+
+      # `:gemini_signed` is the shape this API wants: a `thought` part carrying
+      # the `thoughtSignature` Gemini issued with it. Messages with no captured
+      # signature send no reasoning rather than an unsigned part Gemini cannot
+      # replay.
+      def default_reasoning_strategies
+        [ :gemini_signed ]
+      end
+
       def apply_reasoning_strategies!(messages, strategies)
-        return unless messages.is_a?(Array)
+        return SolidLoop::Dialects::ReasoningPacker.empty_report unless messages.is_a?(Array)
+
+        strategies = default_reasoning_strategies if strategies.nil?
 
         # Gemini filter: only keep gemini-specific and universal XML strategies
-        filtered = strategies.select { |s| [:gemini_signed, :xml, :xml!].include?(s) }
+        filtered = Array(strategies).select { |s| [ :gemini_signed, :xml, :xml! ].include?(s) }
 
-        messages.each do |msg|
-          SolidLoop::Dialects::ReasoningPacker.pack(msg, filtered)
-        end
+        SolidLoop::Dialects::ReasoningPacker.pack_all(messages, filtered)
       end
 
+      # `thought` on a Part is a BOOLEAN flag, not the text: a thought part is
+      # `{ "thought" => true, "text" => "..." }`, and its text lives in the same
+      # `text` key an ordinary answer uses. Reading `part["thought"]` as the
+      # reasoning yields `true`, and taking the first part with a `text` yields
+      # the thought summary as the visible answer — the reasoning and the reply
+      # swap places. Thought parts are therefore filtered out before the answer
+      # is read, and only their `text` is collected as reasoning.
       def extract_message_data(data)
         candidate = data.dig("candidates", 0) || {}
         content_obj = candidate.dig("content") || {}
         parts = content_obj.dig("parts") || []
 
-        text_part = parts.find { |p| p["text"].present? }
-        thought_part = parts.find { |p| p["thought"].present? }
+        thought_parts, answer_parts = parts.partition { |p| p["thought"] }
+        text_part = answer_parts.find { |p| p["text"].present? }
         tool_calls_part = parts.select { |p| p["functionCall"].present? }
+        reasoning = thought_parts.filter_map { |p| p["text"].presence }.join
 
         {
           content: text_part&.dig("text"),
-          reasoning: thought_part&.dig("thought"),
+          reasoning: reasoning.presence,
           tool_calls: map_tool_calls_from_gemini(tool_calls_part),
-          metadata: { thought_signature: candidate.dig("thoughtSignature") }.compact
+          metadata: { "thought_signature" => extract_thought_signature(parts) }.compact
         }
       end
 
+      # The signature rides on a Part, never on the candidate — usually the
+      # thought part, but on a tool-calling turn Gemini attaches it to the
+      # `functionCall` part instead.
+      def extract_thought_signature(parts)
+        parts.each do |part|
+          signature = part["thoughtSignature"] ||
+                      part["thought_signature"] ||
+                      part.dig("functionCall", "thoughtSignature") ||
+                      part.dig("functionCall", "thought_signature")
+          return signature if signature.present?
+        end
+        nil
+      end
+
       def normalize_response(data, fallback_text: "", fallback_messages_text: "")
         res = extract_message_data(data)
 
@@ -83,11 +123,11 @@ module SolidLoop
         end
 
         parts = []
-        thought = m[:thought] || m[:_sl_reasoning]
-        if thought.present?
-          thought_part = { thought: thought }
-          thought_part[:thoughtSignature] = m[:thought_signature] if m[:thought_signature].present?
-          parts << thought_part
+        if m[:thought].present?
+          # `thought: true` flags the part; the text goes in `text`, exactly as
+          # it arrived. The packer only sets :thought together with its
+          # signature (see ReasoningPacker).
+          parts << { thought: true, text: m[:thought], thoughtSignature: m[:thought_signature] }.compact
         end
         parts << { text: m[:content] } if m[:content].present?
 

data/app/services/solid_loop/dialects/open_ai.rb

@@ -11,15 +11,27 @@ module SolidLoop
         api_token.present? ? { "Authorization" => "Bearer #{api_token}" } : {}
       end
 
+      # The Chat Completions schema has a slot for this — `reasoning_content` on
+      # the assistant message, the mirror of the field the server answers with —
+      # so use it rather than welding `<think>` into the body. Measured against
+      # vLLM's /tokenize on the Qwen3 template, the same six-message
+      # conversation costs 1438 prompt tokens welded and 108 in the field; the
+      # template drops the field from history, which is what Qwen3's own
+      # guidance asks for. Hosts whose provider strips the field can set
+      # `reasoning_strategies` back to `[:xml]`.
+      def default_reasoning_strategies
+        [ "reasoning_content" ]
+      end
+
       def apply_reasoning_strategies!(messages, strategies)
-        return unless messages.is_a?(Array)
+        return SolidLoop::Dialects::ReasoningPacker.empty_report unless messages.is_a?(Array)
+
+        strategies = default_reasoning_strategies if strategies.nil?
 
         # OpenAI filter: remove Gemini-specific strategies, allow XML and string fields
-        filtered = strategies.reject { |s| s == :gemini_signed }
+        filtered = Array(strategies).reject { |s| s == :gemini_signed }
 
-        messages.each do |msg|
-          SolidLoop::Dialects::ReasoningPacker.pack(msg, filtered)
-        end
+        SolidLoop::Dialects::ReasoningPacker.pack_all(messages, filtered)
       end
 
       def extract_message_data(data)

data/app/services/solid_loop/dialects/reasoning_packer.rb

@@ -3,30 +3,95 @@
 module SolidLoop
   module Dialects
     class ReasoningPacker
+      # An empty carry report: no reasoning was sent back with this request.
+      NOTHING_CARRIED = { chars: 0, inline_chars: 0 }.freeze
+
+      # Strategies whose wire shape is only valid with the signature the
+      # provider issued alongside the reasoning.
+      SIGNED_STRATEGIES = %i[gemini_signed anthropic_signed].freeze
+
+      # Applies the configured strategies to a whole message array and reports
+      # what the prompt is now carrying. The report is the point: reasoning
+      # welded into `content` is charged as prompt tokens on every subsequent
+      # turn and compounds, and until it is counted nobody notices. A measured
+      # agent loop on Qwen3 was spending 40% of its context window on repacked
+      # thoughts the chat template then discarded.
+      def self.pack_all(messages, strategies)
+        return empty_report unless messages.is_a?(Array)
+
+        strategies = Array(strategies)
+        report = empty_report
+        messages.each do |msg|
+          carried = pack(msg, strategies)
+          next if carried[:chars].zero?
+
+          report[:chars]        += carried[:chars]
+          report[:inline_chars] += carried[:inline_chars]
+          report[:messages]     += 1
+        end
+        report
+      end
+
+      # Packs one message. Returns what it carried, in characters — `chars` is
+      # everything sent back in any shape, `inline_chars` only the part welded
+      # into `content`, which every provider bills.
       def self.pack(msg, strategies)
         reasoning = msg.delete(:_sl_reasoning)
         signature = msg.delete(:_sl_signature)
-        return if reasoning.blank?
+        return NOTHING_CARRIED.dup if reasoning.blank?
+
+        # A native strategy only counts as active when it can actually fire.
+        # Both signed shapes are rejected by their provider without a valid
+        # signature — Anthropic verifies it, Gemini requires it on the part — so
+        # an unsigned message falls through to whatever else was configured
+        # rather than being sent in a shape that 400s.
+        native_fires = strategies.any? { |s| SIGNED_STRATEGIES.include?(s) } && signature.present?
 
-        # 1. Determine if we have any native/specific strategies present in the array
-        # Excluding XML and string-based fields
-        has_native_strategy = strategies.any? { |s| s == :gemini_signed }
+        carried = 0
+        inline  = 0
 
         strategies.each do |strategy|
           case strategy
           when :xml
-            # Apply universal fallback ONLY if no native strategy is active
-            apply_xml!(msg, reasoning) unless has_native_strategy
+            # Apply universal fallback ONLY if a native strategy actually fired
+            next if native_fires
+
+            apply_xml!(msg, reasoning)
+            inline = reasoning.length
+            carried = reasoning.length
           when :xml!
             # FORCE XML wrapping regardless of other strategies
             apply_xml!(msg, reasoning)
+            inline = reasoning.length
+            carried = reasoning.length
           when :gemini_signed
+            # An unsigned thought cannot go back to Gemini at all: the signature
+            # is what makes the part replayable. Sending the text without it is
+            # worse than sending nothing, so drop it.
+            next if signature.blank?
+
             msg[:thought] = reasoning
-            msg[:thought_signature] = signature if signature.present?
+            msg[:thought_signature] = signature
+            carried = reasoning.length
+          when :anthropic_signed
+            # Anthropic verifies the signature server-side and rejects a
+            # thinking block whose signature is missing or does not match.
+            next if signature.blank?
+
+            msg[:thinking] = reasoning
+            msg[:thinking_signature] = signature
+            carried = reasoning.length
           when String
             msg[strategy.to_sym] = reasoning
+            carried = reasoning.length
           end
         end
+
+        { chars: carried, inline_chars: inline }
+      end
+
+      def self.empty_report
+        { chars: 0, inline_chars: 0, messages: 0 }
       end
 
       def self.apply_xml!(msg, reasoning)

data/app/services/solid_loop/llm_usage_parser/llama.rb

@@ -1,12 +1,27 @@
 module SolidLoop
   class LlmUsageParser
+    # llama.cpp's `timings` block. The field names are a trap: `prompt_n` counts
+    # only the tokens this request actually had to PROCESS, while `cache_n`
+    # counts the ones served from its prompt cache. The full prompt is their sum.
+    #
+    # Reading `prompt_n` as the prompt (as this did) understates every turn of a
+    # long conversation by the whole reused prefix, and the error compounds: in a
+    # 30-turn agent loop the recorded prompt fell to a few hundred tokens while
+    # the real context was near 37k. The signature is unmistakable in the data —
+    # `cache_n` of each turn equals the previous turn's true total, and 127 of
+    # 169 recorded turns had `cache_n > prompt_n`, which is impossible if
+    # `prompt_n` were the whole prompt.
     class Llama
       def self.call(timings)
+        fresh  = timings["prompt_n"].to_i
+        cached = timings["cache_n"].to_i
+        prompt = fresh + cached
+
         {
-          tokens_prompt: timings["prompt_n"].to_i,
+          tokens_prompt: prompt,
           tokens_completion: timings["predicted_n"].to_i,
-          tokens_total: timings["prompt_n"].to_i + timings["predicted_n"].to_i,
-          tokens_prompt_cached: timings["cache_n"].to_i,
+          tokens_total: prompt + timings["predicted_n"].to_i,
+          tokens_prompt_cached: cached,
           tps: timings["predicted_per_second"].to_f.round(2)
         }
       end

data/app/services/solid_loop/mcp_session_initializer.rb

@@ -164,6 +164,7 @@ module SolidLoop
     end
 
     def fail_loop(error_msg)
+      error_msg = SolidLoop::Redaction.redact_credentials(error_msg)
       # Cleanup 4 — every non-`running` target must clear the LLM lease
       # (lease_expires_at) so the DB CHECK holds and the reaper doesn't re-select
       # a terminal row. Failing during MCP init happens while the loop is still

data/app/services/solid_loop/middlewares/agent_initialization.rb

@@ -23,7 +23,7 @@ module SolidLoop
           max_steps:    loop.step_count >= agent.max_steps,
           max_total_tokens: loop.tokens_total >= agent.max_total_tokens,
           max_cost:     loop.cost >= agent.max_cost.to_d,
-          max_duration: loop.created_at <= agent.max_duration.ago
+          max_duration: loop.work_duration >= agent.max_duration.to_i
         }
 
         violated = checks.select { |_, hit| hit }

data/app/services/solid_loop/middlewares/error_handling.rb

@@ -32,7 +32,11 @@ module SolidLoop
       end
 
       def handle_exception(env, e)
-        error_msg = "#{e.class}: #{e.message}"
+        # Redacted BEFORE it is persisted: `loop.error_message` is surfaced in the
+        # admin UI and by hosts' own APIs, and a Faraday error message embeds the
+        # request URL — which carries the API key for the Gemini dialect
+        # (`?key=…`). Same rule set as the wire log. See SolidLoop::Redaction.
+        error_msg = SolidLoop::Redaction.redact_credentials("#{e.class}: #{e.message}")
         Rails.logger.error "ERROR IN MIDDLEWARE CHAIN: #{error_msg}\n#{e.backtrace.take(10).join("\n")}"
 
         if e.is_a?(SolidLoop::CancellationError)

data/app/services/solid_loop/middlewares/event_logging.rb

@@ -90,10 +90,10 @@ module SolidLoop
         env.event.save!
       end
 
+      # Shared with Middlewares::ErrorHandling so the wire log and the persisted
+      # error text obey the SAME rules. See SolidLoop::Redaction.
       def redact_credentials(value)
-        value.to_s
-          .gsub(/(Authorization|x-api-key|api-key):[^\r\n]*/i, "\\1: [REDACTED]")
-          .gsub(/([?&](?:key|api_key|api-key)=)[^&\s]*/i, "\\1[REDACTED]")
+        SolidLoop::Redaction.redact_credentials(value)
       end
     end
   end