@aexhq/sdk 0.39.0 → 0.40.1

package/docs/events.md

@@ -23,10 +23,12 @@ const events = await session.events().list();
 ```
 
 ```ts
-// Stream the RunEvent snapshot shape: yields each event once, stops when the
-// session parks. Backed by polling the aex events endpoint.
+// Stream events as guarded `AexEventView`s: yields each event once, stops when
+// the session parks. Backed by polling the aex events endpoint. Every surface —
+// list(), stream(), streamEnvelopes() — yields the same `AexEventView` with a
+// populated `sequence` and the `is*()` guard methods.
 for await (const event of session.events().stream({ intervalMs: 1000 })) {
-  if (event.type === "TEXT_MESSAGE_CONTENT") {
+  if (event.isTextMessage()) {
     // ...
   }
 }
@@ -79,8 +81,9 @@ They need a global `WebSocket` (Bun or Node ≥ 22).
 
 `aex wait` is the host mirror of `session.wait()`:
 it polls until the session parks and prints the final `Session` record. Exit `0`
-when the session parked cleanly (`idle`/`suspended`), `1` for any other park
-(`error` / a non-clean terminal status), and `3` when `--timeout` elapses first
+when the session parked cleanly (`idle`/`suspended`/`succeeded`), `1` for any
+non-clean terminal outcome (`failed`/`timed_out`/`cancelled`), and `3` when
+`--timeout` elapses first
 (a `--timeout` on `events --follow` / `run --follow` uses the same exit-`3`
 convention). Durations accept `ms`/`s`/`m`/`h` suffixes or a bare millisecond integer.
 
@@ -100,13 +103,34 @@ for await (const event of turn) {
   console.log(event.sequence, event.type);
 }
 
-const result = await turn.done(); // status is usually "idle"
+const result = await turn.done(); // status is the terminal outcome, e.g. "succeeded"
 ```
 
-The turn stream ends when it sees `aex.session.idle`, `aex.session.suspended`, or
-`aex.session.error` for that turn. `aex.run(config)` is a convenience wrapper
-over the same flow: it opens a session, sends `message` once, and returns the
-collected session turn. The returned `runId` is the session id.
+The turn stream ends on the turn's park terminal: a resumable
+`aex.session.idle` / `aex.session.suspended`, a terminal outcome
+`aex.session.succeeded` / `.failed` / `.timed_out` / `.cancelled`, or the held
+`aex.session.awaiting_approval`. (The bare `aex.session.error` park is retired —
+a failed turn is `failed`, a wall-clock kill `timed_out`, a cancel `cancelled`.)
+`aex.run(config)` is a convenience wrapper over the same flow: it opens a
+session, sends `message` once, and returns the collected session turn. The
+returned `runId` is the session id.
+
+## Per-token streaming (`outputMode: 'stream'`)
+
+Assistant-text granularity is controlled by `outputMode` on `openSession` / `run`:
+
+- **`buffered`** (the default) — the assistant text arrives coalesced as one
+  `TEXT_MESSAGE_CONTENT` event per message.
+- **`stream`** — on a **streamable** provider you also receive per-token
+  `TEXT_MESSAGE_CONTENT` **deltas** as the model produces them, and a coalesced
+  final `TEXT_MESSAGE_CONTENT` (the archived twin) always follows. Streamable
+  providers today are Anthropic and the OpenAI-chat-shaped providers (DeepSeek,
+  OpenAI, Mistral, OpenRouter, Doubao / Doubao China).
+
+Streaming is **capability-gated and fail-closed**: requesting `outputMode: 'stream'`
+on a provider that has no streaming producer (currently `gemini`) is a typed
+rejection at submission parse — **not** a silent downgrade to buffered. Choose a
+streamable provider or drop back to `buffered` explicitly.
 
 ## Terminal events vs. the run record
 
@@ -119,21 +143,30 @@ on how the turn ends:
   instead (see below). Expect `RUN_ERROR` on stream-level failures, and treat
   `RUN_FINISHED` — when it does appear — as a low-latency "stop the spinner"
   hint, not a read-consistency barrier.
-- **`aex.session.*` park terminals** — `CUSTOM` events named `aex.session.idle`,
-  `aex.session.suspended`, or `aex.session.error`. On the managed plane these
-  are what actually end a turn: the session parks with the matching status, and
-  by the time the park event is broadcast the session record has already
-  reached that status. This is the terminal you should expect from a managed
-  run's event stream.
-
-The SDK's helpers cover both families so you never have to switch on the plane:
-
-- `isRunTerminal(event)` — true for the AG-UI `RUN_FINISHED` / `RUN_ERROR` pair.
-- `isRunSettled(event)` — true for the `aex.run.settled` settle barrier **and**
+- **`aex.session.*` park terminals** — `CUSTOM` events carrying the turn's
+  OUTCOME: `aex.session.succeeded` / `aex.session.failed` / `aex.session.timed_out`
+  / `aex.session.cancelled`, or a resumable/held park `aex.session.idle` /
+  `aex.session.suspended` / `aex.session.awaiting_approval`. On the managed plane
+  these are what actually end a turn. The park event ends the RENDER; the settle
+  commit (cost + usage + the authoritative outcome) lands shortly after — which
+  is why `run()`/`done()` await settle by DEFAULT and return the outcome as
+  `result.status` with `result.costUsd`/`result.usage` always populated (never a
+  bare `idle`). Pass `await: 'park'` (on `run(...)` or `session.send(msg, {...})`)
+  to return early at the park event when you don't need cost/usage. `result.costUsd`
+  is aex runtime/storage spend and **excludes** your BYOK provider charges — price
+  those from `result.usage` token counts. Ending a raw stream on the park event is
+  fine for live UI; read the settled record (or the default await-settle result)
+  when you need cost/usage/outcome.
+
+Each event the stream yields carries method guards that cover both families so
+you never have to switch on the plane:
+
+- `event.isRunTerminal()` — true for the AG-UI `RUN_FINISHED` / `RUN_ERROR` pair.
+- `event.isRunSettled()` — true for the `aex.run.settled` settle barrier **and**
   for any `aex.session.*` park terminal. The managed plane does not broadcast a
   separate `aex.run.settled` barrier — the park event plays that role — so
-  `isRunSettled` is the one guard that reliably means "this stream is done and
-  the record is authoritative".
+  `event.isRunSettled()` is the one check that reliably means "this stream is done
+  and the record is authoritative".
 
 To read the authoritative status consistently, use one of:
 
@@ -154,8 +187,8 @@ for await (const event of session.events().streamEnvelopes({ settleConsistent: t
 const settled = await aex.sessions.get(session.id); // parked/terminal here
 ```
 
-`settleConsistent: true` makes the iterator end exactly when `isRunSettled(event)`
-first fires; on a raw stream, apply `isRunSettled(event)` yourself. What it
+`settleConsistent: true` makes the iterator end exactly when `event.isRunSettled()`
+first fires; on a raw stream, call `event.isRunSettled()` yourself. What it
 guarantees: when the stream ends, a subsequent `aex.sessions.get(id)` reads a
 parked/terminal status and `session.outputs().list()` is complete. Outputs are
 uploaded before the terminal is broadcast, so they are readable the moment the
@@ -175,34 +208,36 @@ const jsonl = await response.text();
 
 ## Event shape
 
-Events are typed as the discriminated `RunEvent` union for compatibility and as the versioned coordinator envelope for live consumers. aex records raw runtime/provider payloads **after** secret redaction and structural sanitization, so the bytes you see never contain provider keys, MCP credentials, or runtime secrets supplied when the session was opened.
+Every read and stream surface yields one canonical shape — the versioned coordinator envelope, wrapped as an `AexEventView` with a populated non-optional `sequence` and the `is*()` guard methods. `sequence` is **sparse by design** (it encodes journal position, not a dense 0..N counter), so resume by cursor VALUE (`from: lastSequence`), never by integer adjacency. Tool-call START and RESULT events share a `data.id` join key, exposed as `event.toolCallId()` on those views. aex records raw runtime/provider payloads **after** secret redaction and structural sanitization, so the bytes you see never contain provider keys, MCP credentials, or runtime secrets supplied when the session was opened.
 
 ## Typed helpers
 
-The package exports conservative type guards over run events:
+Every event the SDK yields — the turn stream (`session.send()`),
+`session.events().list()`, `session.events().streamEnvelopes()`, and
+`RunResult.events` — carries a type-guard **method** for each standardized event
+type, so you branch on the event without importing a free function or writing a
+raw `event.type === "…"` compare:
 
 ```ts
-import {
-  isRunStarted,
-  isRunFinished,
-  isRunError,
-  isRunTerminal,
-  isRunSettled,
-  isTextMessage,
-  isToolCallStart,
-  isToolCallResult,
-  isCustom,
-  isLog,
-  isEventChannel
-} from "@aexhq/sdk";
+for await (const event of session.send("Continue the task.")) {
+  if (event.isTextMessage()) {
+    process.stdout.write(event.data.text); // `data.text` is typed `string` here
+  } else if (event.isToolCallStart()) {
+    console.log("tool:", event.data.name); // `data.name` is typed `string` here
+  } else if (event.isRunError()) {
+    console.error("run error");
+  }
+}
 ```
 
-All guards test the `type` discriminant at runtime. `isTextMessage`,
-`isToolCallStart`, `isToolCallResult`, and `isRunFinished` operate on the loose
-`RunEvent` snapshot (`session.events().list()` / `RunResult.events`) and additionally NARROW
-`event.data` to the fields that event type carries — e.g. inside
-`if (isTextMessage(e))`, `e.data.text` is typed `string`. The lifecycle/channel
-guards (`isRunStarted`, `isRunError`, `isCustom`, `isLog`, …) operate on the
-coordinator envelope and narrow only the discriminant. Use `result.text` or
-`session.messages.all()` when you need assistant text without inspecting the
-event stream directly.
+The full method set: `isRunStarted()`, `isRunFinished()`, `isRunError()`,
+`isRunTerminal()`, `isTextMessage()`, `isToolCallStart()`, `isToolCallResult()`,
+`isCustom()`, `isLog()`, `isEventChannel()`, `isRunSettled()`, and
+`isFromSource(source)`. All test the `type` (or `channel`/`source`) discriminant
+at runtime. `isTextMessage()`, `isToolCallStart()`, and `isToolCallResult()` are
+TS type predicates: inside the guarded branch `event.data` NARROWS to that event
+type's payload fields (e.g. `event.data.text` is typed `string`). Annotate a
+narrowed event with the exported `TextMessageEventView` / `ToolCallStartEventView`
+/ `ToolCallResultEventView` types, or a raw event with `AexEventView`. Use
+`result.text` or `session.messages.all()` when you need assistant text without
+inspecting the event stream directly.

package/docs/limits-and-quotas.md

@@ -31,6 +31,7 @@ And whether you can **raise** it: per-run option, per-plan, or no.
 | MCP connect timeout (default) | 30 seconds | aex policy | Per-port via `connectTimeoutMs` | `RUN_DEFAULT_MCP_CONNECT_TIMEOUT_MS` |
 | MCP call timeout (default) | 30 minutes | aex policy | Per-port via `callTimeoutMs` | `RUN_DEFAULT_MCP_CALL_TIMEOUT_MS` |
 | Per-session spend cap | None by default; when set, the session is stopped once its spend would exceed the cap | aex policy | Per-session via `overrides.maxSpendUsd` (a positive USD amount) | — |
+| Max agent iterations (turns) per run | 20 by default; hard ceiling 200 | aex policy | Per-session via `overrides.maxTurns` (a positive integer, clamped to the ceiling) | `RUN_DEFAULT_MAX_TURNS` / `RUN_MAX_TURNS_CEILING` |
 
 ### Output capture (per run)
 
@@ -69,6 +70,29 @@ silently lost.
 | Per-run metadata record TTL | 24 hours | aex policy | No (hard ceiling) | `RUN_KV_RECORD_TTL_SECONDS` |
 | Per-run secret-envelope TTL | 24 hours | aex policy | No (hard ceiling) | `RUN_KV_SECRET_TTL_SECONDS` |
 
+## Sandbox (managed runtime)
+
+Each run executes in an ephemeral Linux container sized by the `runtime` preset.
+A few behaviours are worth knowing before you rely on the filesystem or RAM:
+
+- **Only `/workspace` persists across turns** of the same session. Everything
+  outside `/workspace` is reset between turns and is gone when the session ends —
+  write deliverables and any state you want to survive a turn under `/workspace`.
+- **The image is minimal.** Declare OS/language packages with
+  `environment.packages` so they are present deterministically at boot. A runtime
+  install inside the agent (`pip install`, `apt-get`) is best-effort and
+  **non-persistent** (reset next turn), and `pip` is subject to PEP 668
+  (`externally-managed-environment`) — prefer `environment.packages`, or a
+  virtualenv you create under `/workspace`.
+- **`/proc/meminfo` reports the HOST's RAM, not your preset's.** Your actual
+  memory ceiling is the preset's `memoryMb` (e.g. `shared-0.25x-1gb` = 1 GB, the
+  default; `shared-4x-12gb` = 12 GB). The presets are the SSoT in
+  [`packages/contracts/src/runtime-sizes.ts`](https://github.com/aexhq/aex/blob/main/packages/contracts/src/runtime-sizes.ts);
+  see [Defaults](defaults.md).
+- **The agent loop is bounded** by `maxTurns` (default 20, ceiling 200) — a
+  documented, per-run-overridable limit (see the Run scope table above and
+  `overrides.maxTurns`), not a silent cutoff.
+
 ## Workspace scope
 
 | Limit | Value | Source | Raisable? | Constant |

package/docs/networking.md

@@ -15,7 +15,13 @@ internet**. Outbound traffic is governed by **two layers**:
    (model providers, built-in tool endpoints, package registries, and related
    well-known development hosts such as `github.com`) and enforces a fixed SSRF
    deny-list: loopback, link-local, cloud-metadata, and other private ranges are
-   always blocked, including hostnames that resolve to those ranges.
+   blocked on the standard proxy path every normal HTTP client uses, including
+   hostnames that resolve to those ranges. Note: on the current managed (Fargate)
+   plane a subprocess that deliberately bypasses the proxy with a **raw socket**
+   can still reach the on-link task-metadata IP (`169.254.170.2`), which exposes
+   non-secret task identity (AWS account id via the task ARN, cluster/image ref)
+   — but **never IAM credentials** (the run's task role is unset, so the metadata
+   credential endpoint serves nothing) and never another tenant's data.
 
 Honest boundary statement: the per-run `allowedHosts` policy is enforced by the
 run's own runtime on the standard proxy path — it is **not** yet enforced at

package/docs/outputs.md

@@ -4,7 +4,7 @@ title: Outputs
 
 # Outputs
 
-Every session produces durable metadata (status, events, snapshots, cleanup state) and an outputs namespace. By default, managed runs capture every regular file the agent creates or modifies in the container: the runner snapshots the filesystem just before the agent starts, rescans it when the agent exits, and uploads the delta. There is no default or official output directory. Use `outputs.allowedDirs` only when you want to narrow capture to specific roots, and `outputs.deniedDirs` to subtract noise. `session.download()` returns the public session record — metadata, typed events, and captured output bytes — as a zip; the per-namespace verbs (`session.outputs().download()` / `session.events().download()` / `session.downloadMetadata()`) return one slice each.
+Every session produces durable metadata (status, events, cleanup state) and an outputs namespace. By default, managed runs capture the regular files present in the container when the agent exits, EXCLUDING the inputs the platform itself materialized for you (your mounted `files`/`skills`) — those are excluded by IDENTITY (their exact destination paths and skill-dir prefixes), not by any before/after timing comparison. There is no default or official output directory. Use `outputs.allowedDirs` only when you want to narrow capture to specific roots, and `outputs.deniedDirs` to subtract noise. `session.download()` returns the public session record — metadata, typed events, and captured output bytes — as a zip; the per-namespace verbs (`session.outputs().download()` / `session.events().download()` / `session.downloadMetadata()`) return one slice each.
 
 The output verbs below hang off the session's `outputs()` accessor
 (`session.outputs().list()`, `.read()`, `.download()`, …). Reach a handle from a
@@ -28,7 +28,7 @@ await session.download({ to: "./session.zip" });
 ```
 
 ```bash
-aex download <session-id> --out ./session.zip --api-key …
+npx aex download <session-id> --out ./session.zip --api-key …
 ```
 
 ## The three namespaces
@@ -133,6 +133,35 @@ Query fields compose with AND semantics:
 
 `session.outputs().findOne(query)` returns `null` when nothing matches and throws `RunStateError` when the query matches more than one output.
 
+## Searching outputs
+
+Search is metadata-only (reference hits — filename / extension / content type — no bytes). `filename` accepts a `string` (case-insensitive substring) or a `RegExp`. A content-shaped query (`content`/`text`/…) throws a typed "content search unsupported" rather than silently returning zero hits.
+
+```ts
+// One session's outputs:
+const hits = await session.outputs().search({ filename: /report/i });
+
+// Across every run in the workspace (or scope with runIds):
+const all = await aex.outputs.search({ extension: "md", runIds: ["run-a", "run-b"] });
+```
+
+Each hit is `{ runId, outputId, filename?, sizeBytes?, contentType? }`; read the bytes with `session.outputs().read(...)` / `.download(...)`.
+
+## CLI
+
+The `aex outputs` verb is a thin pass-through over the same SDK accessor, so every per-file operation has a subcommand (`npx aex` on a local install):
+
+```bash
+npx aex outputs <session-id>                          # list captured outputs (NDJSON)
+npx aex outputs read <session-id> <path>              # read one file as capped text (JSON)
+npx aex outputs download <session-id> <path> --out f  # download one file's raw bytes
+npx aex outputs link <session-id> <path>              # mint a temporary download URL (JSON)
+npx aex outputs find <session-id> --name S --ext E --type T
+npx aex outputs search --query S --ext E --run-id ID  # cross-run metadata search
+```
+
+`aex outputs search` (no session id) is the cross-run search (`aex.outputs.search`); the whole-namespace zip stays `aex download <session-id>`.
+
 ## Temporary output links
 
 Use `session.outputs().link(selectorOrQuery, options?)` when another process, browser, media tag, or downloader needs a direct artifact URL instead of bytes buffered through the SDK.
@@ -190,7 +219,7 @@ Validation:
 
 Runtime notes:
 
-- The managed runtime captures files by diffing the filesystem against a baseline snapshot taken just before the agent starts. Platform setup files, installed packages, and materialized inputs are already present before the baseline, so they are excluded by timing.
+- The managed runtime captures the regular files under the capture roots at terminal time, EXCLUDING the inputs the platform itself materialized (your mounted `files`/`skills`) by IDENTITY — their exact destination paths and skill-dir prefixes are threaded into the capture filter, so an untouched mounted input is never re-emitted as an output regardless of path policy or timing.
 - If you pass an explicit root that does not exist by terminal time, that root contributes no files.
 
 ## `outputs.deniedDirs` — subtract noise
@@ -208,10 +237,10 @@ aex.openSession({
 
 Mechanism (no platform-magical paths — this is honest):
 
-1. The hosted platform materializes the workspace, opens runtime logs, and records a filesystem baseline across the capture roots.
+1. The hosted platform materializes the workspace (your mounted `files`/`skills`) and records the exact destination paths + skill-dir prefixes it wrote.
 2. The agent runs normally. There is no extra model turn and no synthetic sync instruction.
-3. When the agent exits, the runner rescans the capture roots and finds files that are new or whose metadata changed.
-4. The runner uploads changed regular files to durable run artifact storage. Diagnostic log paths are routed to internal diagnostics under `runs/<runId>/internal/logs/`; other paths are routed to `outputs`.
+3. When the agent exits, the runner scans the capture roots and drops any file whose path is a materialized INPUT (exact path or under a materialized skill dir) — inputs are excluded by WHO PUT THEM THERE (the platform), not by timing.
+4. The runner uploads the remaining regular files to durable run artifact storage. Diagnostic log paths are routed to internal diagnostics under `runs/<runId>/internal/logs/`; other paths are routed to `outputs`.
 
 Cost: output capture does not add a model turn. The runner pays a filesystem scan and upload cost near the end of the run.
 
@@ -228,7 +257,7 @@ Metadata still gets the full treatment. aex captures every regular file the run
 
 ## Mid-session download semantics
 
-Mid-session calls are **best-effort and side-effect-free**: they expose whatever artifacts have already been uploaded. Files written by the agent are normally uploaded near terminal, after the filesystem diff. If you need the full output set, wait for the session to park and call `session.download()` again.
+Mid-session calls are **best-effort and side-effect-free**: they expose whatever artifacts have already been uploaded. Files written by the agent are normally uploaded near terminal, after the runner scans the capture roots. If you need the full output set, wait for the session to park and call `session.download()` again.
 
 ## Safety
 

package/docs/quickstart.md

@@ -16,9 +16,10 @@ This installs the TypeScript SDK exports and the bundled `aex` CLI.
 
 aex is currently in **invite-only beta**: workspaces and API keys are issued
 by the aex team — contact <support@aex.dev> for beta access. Once you have
-access, create a quickstart SDK token with `runs:read`, `runs:write`, and
-`outputs:read` in the dashboard at <https://aex.dev>. The examples also need
-your BYOK provider key for the model you choose. For the Claude examples below:
+access, create a quickstart SDK token with `runs:read`, `runs:write`,
+`outputs:read`, and `billing:read` in the dashboard at <https://aex.dev>. The
+examples also need your BYOK provider key for the model you choose. For the
+Claude examples below:
 
 ```bash
 export AEX_API_KEY="<your-aex-api-key>"
@@ -41,9 +42,16 @@ const session = await aex.openSession({
 });
 
 const first = await session.send("Write a short report and save it as a file.").done();
-console.log(first.status, first.text);
+console.log(first.status, first.costUsd, first.text);
 ```
 
+`send().done()` (and `run()`) **await settle by default**, so the result always
+carries a terminal `status` (`succeeded` / `failed` / `timed_out` / `cancelled`
+— never a bare `idle`) plus `costUsd` and `usage`. Pass `await: 'park'` to
+return early at the render-complete park event when you don't need cost/usage.
+`costUsd` is aex runtime/storage spend and **excludes** your BYOK provider
+charges — price those from `usage` token counts against your provider's rates.
+
 The session parks as `idle` between turns and automatically moves to
 `suspended` after the idle window. Keep the session id and resume later:
 
@@ -88,7 +96,8 @@ await turn.done();
 const messages = await session.messages().list();
 console.log(messages.at(-1)?.text);
 
-// Poll the record until the session parks (idle / suspended / error).
+// Poll the record until the session parks: a resumable `idle` / `suspended`,
+// or a terminal outcome (`succeeded` / `failed` / `timed_out` / `cancelled`).
 const record = await session.wait();
 console.log(record.status);
 
@@ -96,10 +105,11 @@ console.log(record.status);
 await session.download({ to: "./session.zip" });
 ```
 
-The same run from the bundled CLI:
+The same run from the bundled CLI (`npx aex` on a local install; or
+`npm i -g @aexhq/sdk` for a bare `aex`):
 
 ```bash
-aex run \
+npx aex run \
   --api-key "$AEX_API_KEY" \
   --anthropic-api-key "$ANTHROPIC_API_KEY" \
   --model claude-haiku-4-5 \

package/docs/run-config.md

@@ -14,9 +14,9 @@ Allowed fields:
 - `environment` - `{ networking?, packages?, variables? }`. Networking is open by default; set `networking.mode` to `limited` only when you want an allowlist. `variables` are merged into the in-container `RUNTIME.env` / `RUNTIME.json` mounts. (Run secrets go in `environment.secrets`, which carries live `Secret` instances and is not part of a shareable config.)
 - `runtime` - optional managed-runtime preset. Prefer `Sizes` in TypeScript.
 - `metadata` - non-secret structured metadata.
-- `overrides` - `{ idleTtl?, timeout?, maxSpendUsd? }`. `timeout` is an optional session deadline (e.g. `"30m"`, `"2h"`); `maxSpendUsd` stops the session once its spend would exceed the cap (see [Limits & quotas](limits-and-quotas.md)).
+- `overrides` - `{ idleTtl?, timeout?, maxSpendUsd?, maxTurns? }`. `timeout` is an optional session deadline (e.g. `"30m"`, `"2h"`); `maxSpendUsd` stops the session once its spend would exceed the cap; `maxTurns` caps the agent's iteration count for the turn (a positive integer — omit to accept the platform default of 20, clamped to the ceiling). See [Limits & quotas](limits-and-quotas.md).
 
-`message` (the one-shot `run` input), `agentsMd`, `files`, `outputs`, `tools`, `skills`, `includeBuiltinTools`, and `outputMode` are `openSession` / `run` options, not reusable run-config fields. They carry the turn input, bytes, capture behavior, or agent tool/output controls that belong on a concrete call. Skill bundles are `skills` entries built with `Skill.fromDir(...)`, `Skill.fromUrl(...)`, or the other `Skill.from*` factories, so they too are SDK-code options rather than config fields. Subagents are session-internal (the in-run `subagent` tool — see [Subagents](concepts/subagents.md)); there is no `parentRunId` option. The wire contract carries a per-run `limits` object (the exported `RunLimits` type: `maxConcurrentChildRuns`, `maxSubagentDepth`, `maxSpendUsd`), but the session surface exposes only its spend dial — set it with `overrides.maxSpendUsd`; the subagent depth/breadth dials are not settable per-session today and take the platform defaults.
+`message` (the one-shot `run` input), `agentsMd`, `files`, `outputs`, `tools`, `skills`, `includeBuiltinTools`, and `outputMode` are `openSession` / `run` options, not reusable run-config fields. They carry the turn input, bytes, capture behavior, or agent tool/output controls that belong on a concrete call. Skill bundles are `skills` entries built with `Skill.fromDir(...)`, `Skill.fromUrl(...)`, or the other `Skill.from*` factories, so they too are SDK-code options rather than config fields. Subagents are session-internal (the in-run `subagent` tool — see [Subagents](concepts/subagents.md)); there is no `parentRunId` option. The wire contract carries a per-run `limits` object (the exported `RunLimits` type: `maxConcurrentChildRuns`, `maxSubagentDepth`, `maxSpendUsd`, `maxTurns`), and the session surface exposes its spend and iteration dials via `overrides.maxSpendUsd` and `overrides.maxTurns`; the subagent depth/breadth dials are not settable per-session today and take the platform defaults.
 
 Secrets never live in run config. Pass provider keys through the top-level
 `apiKeys` map and runtime secrets through `environment.secrets` in the SDK, or
@@ -55,4 +55,4 @@ aex run --config ./run.json \
   --anthropic-api-key "$ANTHROPIC_API_KEY"
 ```
 
-...or as explicit flags (`--model`, `--system`, `--prompt`, `--mcp`, `--mcp-auth`, `--runtime-size`, `--run-timeout`, `--metadata`). The two modes are mutually exclusive.
+...or as explicit flags (`--model`, `--system`, `--prompt`, `--mcp`, `--mcp-auth`, `--runtime-size`, `--run-timeout`, `--metadata`). The two modes are mutually exclusive. Composition inputs attach with repeatable flags that map onto the SDK's `Skill`/`Tool`/`AgentsMd`/`File` factories: `--skill @bundle` (workspace skill), `--tool @tool.js` (custom tool module), `--agents-md @AGENTS.md`, and `--file @path` (mount a file into `/workspace`).

package/docs/secrets.md

@@ -118,3 +118,17 @@ await aex.secrets.delete("serper-api-key");
 
 The CLI supports per-run provider and MCP credentials. Workspace secret
 administration is exposed through the SDK.
+
+## Redaction Scope And Output Files
+
+Registered secret values are redacted from the run's **event stream** (both tool
+output and model-authored surfaces) — a value you inject via `environment.secrets`
+is masked regardless of its shape. Two surfaces are intentionally *not* scrubbed:
+
+- **Captured output files** (`outputs().download()` / `read()` / the `aex download`
+  zip) are returned **verbatim**. They are your run's own artifacts, so the platform
+  does not rewrite their bytes — if the agent writes a secret into a deliverable file,
+  that file contains it. Treat downloaded outputs as unredacted.
+- An **unregistered** secret (a credential the run produces itself and never declared
+  via `environment.secrets`) can only be masked heuristically by shape; register the
+  values you care about so they are masked by value.

package/examples/feature-tour.ts

@@ -22,7 +22,6 @@ import {
   BuiltinTools,
   File,
   isRateLimited,
-  isTextMessage,
   McpServer,
   Models,
   Providers,
@@ -200,12 +199,11 @@ for (;;) {
     break;
   }
   const event = next.value;
-  if (isTextMessage(event)) {
+  if (event.isTextMessage()) {
     process.stdout.write(event.data.text);
-  } else if (event.type === "TOOL_CALL_START") {
-    const name = typeof event.data.name === "string" ? event.data.name : "tool";
-    process.stdout.write(`\n[tool:start] ${name}\n`);
-  } else if (event.type === "TOOL_CALL_RESULT") {
+  } else if (event.isToolCallStart()) {
+    process.stdout.write(`\n[tool:start] ${event.data.name}\n`);
+  } else if (event.isToolCallResult()) {
     process.stdout.write("[tool:result]\n");
   }
 }

package/examples/spike-settle-latency.ts

@@ -0,0 +1,125 @@
+/**
+ * SPIKE (throwaway): measure the real park-event -> record-idle gap for interactive
+ * session turns. This is the extra wall-clock Option B (settle-consistent turn stream)
+ * would force onto EVERY turn: the turn stream currently ends on the RUN_FINISHED park
+ * event, but the session RECORD flips running->idle later, in the async settle lambda.
+ *
+ *   AEX_API_KEY=... DEEPSEEK_API_KEY=... AEX_API_URL=... bun packages/sdk/examples/spike-settle-latency.ts
+ *
+ * Optional: SPIKE_TURNS=8 (samples), SPIKE_POLL_MS=120 (record poll interval).
+ *
+ * Method per turn:
+ *   1) send a tiny prompt, stream events, capture t_runFinished at the RUN_FINISHED event
+ *      (this is where the default turn stream ends), then stop consuming.
+ *   2) tight-poll session.refresh() until status === "idle"; capture t_idle.
+ *   3) settleGapMs = t_idle - t_runFinished  <-- the Option B tax.
+ * The next turn is only sent AFTER idle, so each measurement is isolated (no reconcile).
+ */
+import { Aex, Models, Providers, Sizes } from "@aexhq/sdk";
+
+const apiKey = required("AEX_API_KEY");
+const deepseekKey = required("DEEPSEEK_API_KEY");
+const apiUrl = process.env.AEX_API_URL;
+const turns = Number(process.env.SPIKE_TURNS ?? "8");
+const pollMs = Number(process.env.SPIKE_POLL_MS ?? "120");
+
+const aex = new Aex({
+  apiKey,
+  ...(apiUrl ? { baseUrl: apiUrl } : {}),
+  retry: { maxAttempts: 4, initialDelayMs: 500, maxDelayMs: 10_000, maxElapsedMs: 90_000 }
+});
+
+console.log(`opening session (dev)...`);
+const session = await aex.openSession({
+  provider: Providers.DEEPSEEK,
+  model: Models.DEEPSEEK_V4_FLASH,
+  system: "Reply with a single short sentence. Never use tools or write files.",
+  includeBuiltinTools: false,
+  tools: [],
+  runtime: Sizes.SHARED_0_25X_1GB,
+  overrides: { idleTtl: "10m", timeout: "5m", maxSpendUsd: 1 },
+  apiKeys: { deepseek: deepseekKey }
+});
+console.log(`session: ${session.id}`);
+
+type Sample = { turn: number; turnMs: number; settleGapMs: number; polls: number; timedOut: boolean };
+const samples: Sample[] = [];
+
+for (let i = 0; i < turns; i++) {
+  const stream = session.send(`Say hello #${i + 1} in one short sentence.`);
+  const tStart = performance.now();
+  let tRunFinished = 0;
+  let errored = false;
+  for await (const event of stream) {
+    if (event.isRunError()) {
+      errored = true;
+      tRunFinished = performance.now();
+      break;
+    }
+    if (event.isRunFinished()) {
+      tRunFinished = performance.now();
+      break; // default turn stream would end HERE
+    }
+  }
+  if (tRunFinished === 0) tRunFinished = performance.now();
+  const turnMs = tRunFinished - tStart;
+
+  // Tight-poll the authoritative record until it leaves running.
+  let polls = 0;
+  let tIdle = 0;
+  let timedOut = false;
+  const deadline = performance.now() + 90_000;
+  for (;;) {
+    polls++;
+    const rec = await session.refresh().catch(() => undefined);
+    const status = rec?.status;
+    if (status === "idle" || status === "suspended" || status === "error") {
+      tIdle = performance.now();
+      break;
+    }
+    if (performance.now() >= deadline) {
+      tIdle = performance.now();
+      timedOut = true;
+      break;
+    }
+    await sleep(pollMs);
+  }
+  const settleGapMs = tIdle - tRunFinished;
+  samples.push({ turn: i + 1, turnMs, settleGapMs, polls, timedOut });
+  console.log(
+    `turn ${String(i + 1).padStart(2)}  turn=${fmt(turnMs)}  settleGap=${fmt(settleGapMs)}  polls=${polls}` +
+      (errored ? "  (RUN_ERROR)" : "") +
+      (timedOut ? "  (TIMEOUT>90s)" : "")
+  );
+}
+
+const gaps = samples.map((s) => s.settleGapMs).sort((a, b) => a - b);
+console.log("\n=== settle-gap distribution (park event -> record idle) ===");
+console.log(`n=${gaps.length}`);
+console.log(`min    ${fmt(gaps[0])}`);
+console.log(`median ${fmt(pct(gaps, 50))}`);
+console.log(`p90    ${fmt(pct(gaps, 90))}`);
+console.log(`max    ${fmt(gaps[gaps.length - 1])}`);
+console.log(`mean   ${fmt(gaps.reduce((a, b) => a + b, 0) / gaps.length)}`);
+console.log("\nInterpretation: settleGap is the per-turn latency Option B adds before the");
+console.log("caller regains control (the turn stream would block until the record is idle).");
+
+function pct(sorted: number[], p: number): number {
+  if (sorted.length === 0) return 0;
+  const idx = Math.min(sorted.length - 1, Math.floor((p / 100) * sorted.length));
+  return sorted[idx];
+}
+function fmt(ms: number): string {
+  return ms >= 1000 ? `${(ms / 1000).toFixed(2)}s` : `${Math.round(ms)}ms`;
+}
+function sleep(ms: number): Promise<void> {
+  return new Promise((r) => setTimeout(r, ms));
+}
+function required(name: string): string {
+  const v = process.env[name];
+  if (!v) {
+    console.error(`Missing env var ${name}`);
+    process.exit(1);
+  }
+  return v;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexhq/sdk",
-  "version": "0.39.0",
+  "version": "0.40.1",
   "description": "TypeScript SDK for running autonomous agent sessions across providers (Anthropic, OpenAI, DeepSeek, Gemini, Mistral) behind one interface.",
   "license": "Apache-2.0",
   "repository": {
@@ -27,7 +27,7 @@
   ],
   "scripts": {
     "build": "bun ../../scripts/with-generated-dist-lock.mjs bun run build:unlocked",
-    "build:unlocked": "bun ./scripts/clean-dist.mjs && bun run --cwd ../.. --filter @aexhq/contracts build && bun run --cwd ../.. --filter @aexhq/cli build && tsc -p tsconfig.build.json && bun ./scripts/bundle-cli.mjs && bun ./scripts/inline-contracts.mjs",
+    "build:unlocked": "bun ./scripts/clean-dist.mjs && bun run --cwd ../.. --filter @aexhq/contracts build && tsc -p tsconfig.build.json && bun run --cwd ../.. --filter @aexhq/cli build && bun ./scripts/bundle-cli.mjs && bun ./scripts/inline-contracts.mjs",
     "lint": "bun ../../scripts/with-generated-dist-lock.mjs bun run lint:unlocked",
     "lint:unlocked": "tsc --noEmit",
     "test": "bun run test:unit",
@@ -47,6 +47,7 @@
     "bun": ">=1.3.14"
   },
   "dependencies": {
-    "fflate": "0.8.2"
+    "fflate": "0.8.2",
+    "ignore": "7.0.5"
   }
 }