@aexhq/sdk 0.40.14 → 0.40.16

package/dist/_contracts/asset-upload-helper.d.ts

@@ -9,10 +9,10 @@ export interface AssetUploadResponse {
 }
 /** Minimal fetch shape for direct-to-storage PUT requests. */
 export type AssetFetch = (input: string, init?: RequestInit) => Promise<AssetUploadResponse>;
-export declare const DIRECT_UPLOAD_MAX_ATTEMPTS = 3;
+export declare const DIRECT_UPLOAD_MAX_ATTEMPTS = 5;
 export declare const DIRECT_UPLOAD_INITIAL_DELAY_MS = 500;
 export declare const DIRECT_UPLOAD_MAX_DELAY_MS = 5000;
-export declare const DIRECT_UPLOAD_MAX_ELAPSED_MS = 30000;
+export declare const DIRECT_UPLOAD_MAX_ELAPSED_MS = 60000;
 export type AssetUploadSleep = (ms: number, signal?: AbortSignal) => Promise<void>;
 export interface AssetUploadRetryOptions {
     readonly maxAttempts?: number;

package/dist/_contracts/asset-upload-helper.js

@@ -1,9 +1,9 @@
 import { extractErrorCode, redactUrl } from "./sdk-errors.js";
 import { abortableSleep, computeRetryDelayMs, parseRetryAfterMs } from "./retry-core.js";
-export const DIRECT_UPLOAD_MAX_ATTEMPTS = 3;
+export const DIRECT_UPLOAD_MAX_ATTEMPTS = 5;
 export const DIRECT_UPLOAD_INITIAL_DELAY_MS = 500;
 export const DIRECT_UPLOAD_MAX_DELAY_MS = 5_000;
-export const DIRECT_UPLOAD_MAX_ELAPSED_MS = 30_000;
+export const DIRECT_UPLOAD_MAX_ELAPSED_MS = 60_000;
 export async function putDirectUploadWithRetry(fetchImpl, uploadUrl, init, options = {}) {
     const config = resolveAssetUploadRetryConfig(options);
     const sleep = options.sleep ?? abortableSleep;

package/dist/_contracts/http.d.ts

@@ -19,9 +19,10 @@ export interface HttpClientOptions {
     /** When set, every request emits a redacted one-line trace here. */
     readonly debug?: DebugSink;
     /**
-     * Retry transient transport failures for idempotent GET/HEAD requests.
+     * Retry transient transport failures for idempotent requests.
      * Disabled by default; host CLIs enable this so a single dropped API
-     * connection does not fail read-only commands.
+     * connection does not fail read-only commands or billable writes carrying
+     * an `Idempotency-Key`.
      */
     readonly retryTransientGets?: boolean | TransientGetRetryOptions;
 }

package/dist/_contracts/http.js

@@ -55,7 +55,7 @@ export class HttpClient {
             }
         }
         const method = methodOf(init.method);
-        const retry = retryForMethod(method, this.#retryTransientGets);
+        const retry = retryForRequest(method, headers, this.#retryTransientGets);
         const requestStartedMs = Date.now();
         for (let attempt = 1; attempt <= retry.maxAttempts; attempt += 1) {
             const startedMs = Date.now();
@@ -93,7 +93,7 @@ export class HttpClient {
             ...normalizeHeaders(init.headers)
         };
         const method = methodOf(init.method);
-        const retry = retryForMethod(method, this.#retryTransientGets);
+        const retry = retryForRequest(method, headers, this.#retryTransientGets);
         const requestStartedMs = Date.now();
         for (let attempt = 1; attempt <= retry.maxAttempts; attempt += 1) {
             const startedMs = Date.now();
@@ -152,12 +152,23 @@ function resolveTransientGetRetry(retry) {
 function methodOf(method) {
     return (method ?? "GET").toUpperCase();
 }
-function retryForMethod(method, retry) {
-    if (!retry || (method !== "GET" && method !== "HEAD")) {
+function retryForRequest(method, headers, retry) {
+    if (!retry || (!isMethodIdempotent(method) && !hasIdempotencyKey(headers))) {
         return { ...DEFAULT_TRANSIENT_GET_RETRY, maxAttempts: 1 };
     }
     return retry;
 }
+function isMethodIdempotent(method) {
+    return method === "GET" || method === "HEAD";
+}
+function hasIdempotencyKey(headers) {
+    for (const [name, value] of Object.entries(headers)) {
+        if (name.toLowerCase() === "idempotency-key" && value.trim().length > 0) {
+            return true;
+        }
+    }
+    return false;
+}
 function shouldRetryTransientRead(err, retry, attempt) {
     return attempt < retry.maxAttempts && transientReadErrorCode(err) !== undefined;
 }

package/dist/cli.mjs

@@ -2190,7 +2190,7 @@ var HttpClient = class {
       }
     }
     const method = methodOf(init.method);
-    const retry = retryForMethod(method, this.#retryTransientGets);
+    const retry = retryForRequest(method, headers, this.#retryTransientGets);
     const requestStartedMs = Date.now();
     for (let attempt = 1; attempt <= retry.maxAttempts; attempt += 1) {
       const startedMs = Date.now();
@@ -2227,7 +2227,7 @@ var HttpClient = class {
       ...normalizeHeaders(init.headers)
     };
     const method = methodOf(init.method);
-    const retry = retryForMethod(method, this.#retryTransientGets);
+    const retry = retryForRequest(method, headers, this.#retryTransientGets);
     const requestStartedMs = Date.now();
     for (let attempt = 1; attempt <= retry.maxAttempts; attempt += 1) {
       const startedMs = Date.now();
@@ -2285,12 +2285,23 @@ function resolveTransientGetRetry(retry) {
 function methodOf(method) {
   return (method ?? "GET").toUpperCase();
 }
-function retryForMethod(method, retry) {
-  if (!retry || method !== "GET" && method !== "HEAD") {
+function retryForRequest(method, headers, retry) {
+  if (!retry || !isMethodIdempotent(method) && !hasIdempotencyKey(headers)) {
     return { ...DEFAULT_TRANSIENT_GET_RETRY, maxAttempts: 1 };
   }
   return retry;
 }
+function isMethodIdempotent(method) {
+  return method === "GET" || method === "HEAD";
+}
+function hasIdempotencyKey(headers) {
+  for (const [name, value] of Object.entries(headers)) {
+    if (name.toLowerCase() === "idempotency-key" && value.trim().length > 0) {
+      return true;
+    }
+  }
+  return false;
+}
 function shouldRetryTransientRead(err2, retry, attempt) {
   return attempt < retry.maxAttempts && transientReadErrorCode(err2) !== void 0;
 }
@@ -4786,10 +4797,10 @@ function makeAbortError() {
 }
 
 // ../contracts/dist/asset-upload-helper.js
-var DIRECT_UPLOAD_MAX_ATTEMPTS = 3;
+var DIRECT_UPLOAD_MAX_ATTEMPTS = 5;
 var DIRECT_UPLOAD_INITIAL_DELAY_MS = 500;
 var DIRECT_UPLOAD_MAX_DELAY_MS = 5e3;
-var DIRECT_UPLOAD_MAX_ELAPSED_MS = 3e4;
+var DIRECT_UPLOAD_MAX_ELAPSED_MS = 6e4;
 async function putDirectUploadWithRetry(fetchImpl, uploadUrl, init, options = {}) {
   const config = resolveAssetUploadRetryConfig(options);
   const sleep5 = options.sleep ?? abortableSleep;

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-b09e07023815e06e45a5a0ecd6f9a241409eafcb79b7ea929d26e0bb1447c1a1  cli.mjs
+6a03ce618806a3cbd18663d4a1187106b1c6fecd4256e5f78d043b7480967505  cli.mjs

package/dist/version.d.ts

@@ -6,4 +6,4 @@
  *
  * Used by the (future) User-Agent header on outbound SDK requests.
  */
-export declare const SDK_VERSION = "0.40.14";
+export declare const SDK_VERSION = "0.40.16";

package/dist/version.js

@@ -6,5 +6,5 @@
  *
  * Used by the (future) User-Agent header on outbound SDK requests.
  */
-export const SDK_VERSION = "0.40.14";
+export const SDK_VERSION = "0.40.16";
 //# sourceMappingURL=version.js.map

package/docs/concepts/subagents.md

@@ -29,17 +29,20 @@ error). See [Credentials](../credentials.md).
 
 ## Depth and breadth limits
 
-Delegation is bounded by two server-enforced lineage limits:
+Delegation is bounded by server-enforced lineage budgets. The runtime is
+designed for broad fan-out, across hundreds and even thousands of concurrent
+child agents per root, and for high levels of recursive subagent depth. Exact
+operational limits are platform-managed and may change as the runtime scales.
 
-| Limit | Value | Behavior at the limit |
+| Limit | Runtime posture | Behavior at the limit |
 | --- | --- | --- |
-| Max depth | **5** — the root run is depth 0 and may spawn down to depth 5; a depth-5 run may not spawn further | The spawn is rejected with a `depth_exceeded` tool error (the parent keeps running). |
-| Concurrent children per lineage root | **1000** live (non-terminal) descendants by default; hard platform ceiling **4096** | Further spawns are refused until a child settles. |
+| Max recursive subagent depth | Supports high levels of nested delegation, bounded server-side. | A further spawn is rejected with a `depth_exceeded` tool error (the parent keeps running). |
+| Concurrent children per lineage root | Designed to scale across hundreds, even thousands, of live descendants, bounded server-side. | Further spawns are refused until a child settles. |
 
 The whole descendant subtree of one root shares a single depth and breadth
 budget, enforced server-side at every level — a grandchild spawn counts against
-the same root budget as a direct child. Values are mirrored in
-[Limits & quotas](../limits-and-quotas.md).
+the same root budget as a direct child. These budgets are not public per-session
+dials today.
 
 ## Where children run: `in-process` vs `container`
 
@@ -84,5 +87,5 @@ Every child — in-process or container — is a first-class run record:
 - Turn delegation off for a run by cherry-picking builtins without `subagent`
   (see [Agent tools](agent-tools.md)) or setting `includeBuiltinTools: false`.
 - A per-session spend cap (`overrides.maxSpendUsd`) bounds the parent's spend.
-- The depth/breadth limits above are platform defaults and are not settable
+- The depth/breadth budgets above are platform-managed and are not settable
   per-session today.

package/docs/defaults.md

@@ -48,10 +48,13 @@ For the hard ceilings and who can raise them, see
 
 ## Subagents
 
+Subagent breadth and depth are platform-managed budgets rather than fixed public
+numeric entitlements; exact operational values may change as capacity evolves.
+
 | Option | Default | How to override | Source |
 | --- | --- | --- | --- |
-| Concurrent child runs per lineage root | 1000 (live, non-terminal child runs) | Platform default (subagents run in-process; no public per-run override). Hard ceiling 4096. | `RUN_DEFAULT_MAX_CONCURRENT_CHILD_RUNS` |
-| Max subagent depth | 5 | Platform default (subagents run in-process; no public per-run override). | `RUN_MAX_PUBLIC_SUBAGENT_DEPTH` |
+| Concurrent child runs per lineage root | Platform-managed; designed to scale across hundreds, even thousands, of live child agents. | No public per-run override; contact support for unusually large workloads. | `RUN_DEFAULT_MAX_CONCURRENT_CHILD_RUNS` |
+| Max subagent depth | Platform-managed; supports high recursive subagent depth. | No public per-run override. | `RUN_MAX_PUBLIC_SUBAGENT_DEPTH` |
 
 ## Workspace
 

package/docs/limits-and-quotas.md

@@ -58,10 +58,15 @@ silently lost.
 
 ### Subagents (per run lineage)
 
+Subagent lineage bounds are enforced server-side but are intentionally not
+advertised as fixed public ceilings because capacity can change. The runtime
+posture is high fan-out and high recursive depth; exact admission is governed
+by the platform at spawn time.
+
 | Limit | Value | Source | Raisable? | Constant |
 | --- | --- | --- | --- | --- |
-| Max subagent depth (`subagent` tool) | 5 (a depth-5 lineage may not spawn deeper) | aex policy | No public per-run override (subagents run in-process) | `RUN_MAX_PUBLIC_SUBAGENT_DEPTH` |
-| Concurrent child runs per lineage root | 1000 live (non-terminal); hard ceiling 4096 | aex policy | No public per-run override (subagents run in-process) | `RUN_DEFAULT_MAX_CONCURRENT_CHILD_RUNS` |
+| Max subagent depth (`subagent` tool) | High recursive subagent depth, bounded server-side. | aex policy | No public per-run override (subagents run in-process) | `RUN_MAX_PUBLIC_SUBAGENT_DEPTH` |
+| Concurrent child runs per lineage root | Designed to scale across hundreds, even thousands, of live child agents, bounded server-side. | aex policy | No public per-run override (subagents run in-process) | `RUN_DEFAULT_MAX_CONCURRENT_CHILD_RUNS` |
 
 ### Retention (per run)
 
@@ -98,7 +103,7 @@ A few behaviours are worth knowing before you rely on the filesystem or RAM:
 | Limit | Value | Source | Raisable? | Constant |
 | --- | --- | --- | --- | --- |
 | Workspace storage cap | 500 GB (decimal; admins uncapped — not a customer entitlement) | Workspace default | Per-plane via env `AEX_WORKSPACE_STORAGE_CAP_BYTES` | `WORKSPACE_DEFAULT_STORAGE_CAP_BYTES` |
-| Max concurrent runs per workspace | Plan-based: **5** live (non-terminal) root runs on the free plan, **50** on Pro, **200** on Team; hard platform ceiling **200**. One more submit past the cap fails with `429 workspace_concurrency_exceeded` (see [Errors](errors.md)). Subagent children are governed separately by the per-lineage caps below. Read your effective cap from `aex.whoami().limits.maxConcurrentRuns`. | Workspace default (per plan) | Per-plan (upgrade) or per-workspace override (contact support), clamped to the 200 ceiling | `PLANS[planKey].maxConcurrentRuns` / `WORKSPACE_MAX_CONCURRENT_RUNS_CEILING` |
+| Max concurrent runs per workspace | Plan-based: **5** live (non-terminal) root runs on the free plan, **50** on Pro, **200** on Team; hard platform ceiling **200**. One more submit past the cap fails with `429 workspace_concurrency_exceeded` (see [Errors](errors.md)). Subagent children are governed separately by the platform-managed per-lineage budgets above. Read your effective cap from `aex.whoami().limits.maxConcurrentRuns`. | Workspace default (per plan) | Per-plan (upgrade) or per-workspace override (contact support), clamped to the 200 ceiling | `PLANS[planKey].maxConcurrentRuns` / `WORKSPACE_MAX_CONCURRENT_RUNS_CEILING` |
 | Monthly workspace spend cap | **$250** per rolling UTC calendar month by default; `0` = unlimited. A submit past the cap fails with `402 workspace_spend_cap_exceeded` (see [Errors](errors.md)). | Workspace default | Per-workspace override (contact support) | `WORKSPACE_DEFAULT_SPEND_CAP_USD` |
 | Skill bundle max compressed size (`.zip`) | 10 GiB (enforced at upload by the SDK and re-enforced server-side) | aex policy | No (hard ceiling) | `SKILL_BUNDLE_LIMITS.maxCompressedBytes` |
 | Skill bundle max decompressed size (sum of uncompressed file sizes) | 50 MB | aex policy | No (hard ceiling) | `SKILL_BUNDLE_LIMITS.maxDecompressedBytes` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexhq/sdk",
-  "version": "0.40.14",
+  "version": "0.40.16",
   "description": "TypeScript SDK for running autonomous agent sessions across providers (Anthropic, OpenAI, DeepSeek, Gemini, Mistral) behind one interface.",
   "license": "Apache-2.0",
   "repository": {