@agent-compose/sdk 0.8.3 → 0.8.4

package/dist/agent/agent-loop.d.ts

@@ -80,13 +80,17 @@ export type AgentMessageSummary = {
  *  an agent.message event (the terminating `text` carries the whole block) —
  *  the loop filters it before summarizing. `task_notification` is filtered
  *  too: it is session-transport metadata (a parent harness's background-task
- *  completion echo), not the agent's own output. */
+ *  completion echo), not the agent's own output. `harness_notice` likewise:
+ *  harness-composed advisory text (synthetic assistant messages), never the
+ *  agent speaking. */
 type DurableAgentMessage = Exclude<AgentMessage, {
     type: "text_delta";
 } | {
     type: "usage_delta";
 } | {
     type: "task_notification";
+} | {
+    type: "harness_notice";
 }>;
 export declare function summarizeAgentMessage(msg: DurableAgentMessage): AgentMessageSummary;
 export type AgentLifecycleEvent = {

package/dist/index.d.ts

@@ -24,7 +24,7 @@ export { RequestContext, ReservedKeyError, NonSerialisableValueError, AC_RESERVE
 export type { RequestContextReserved, RequestContextWire, } from "./request-context/index.js";
 export { Verdict, runProcessorChain, denyTools, humanApproval, requireScope, redactPattern, createGatePauseProcessor, createAskHumanProcessor, ASK_USER_QUESTION_TOOL, } from "./processors/index.js";
 export type { Processor, ProcessorContext, ProcessorVerdict, ToolCall, GatePausePolicy, GatePauseApproval, GatePauseConnection, } from "./processors/index.js";
-export type { AgentMessage, AgentMessageInit, AgentMessageText, AgentMessageThinking, AgentMessageToolUse, AgentMessageToolResult, AgentMessageDone, AgentMessageError, AgentMessageUsage, AgentMessageTaskNotification, AgentStatus, } from "./types/protocol.js";
+export type { AgentMessage, AgentMessageInit, AgentMessageText, AgentMessageThinking, AgentMessageToolUse, AgentMessageToolResult, AgentMessageDone, AgentMessageError, AgentMessageUsage, AgentMessageTaskNotification, AgentMessageHarnessNotice, AgentStatus, } from "./types/protocol.js";
 export type { SandboxProvider, DesktopSandboxProvider, SandboxPtyOpts, SandboxPtyHandle, } from "./types/sandbox.js";
 export { AgentComposeClient } from "./client.js";
 export type { RegisterResult, RegisterWorkflowInput, RuntimeSourceInput, TemplateSourceRef, InvokeWorkflowOptions, InvokeAndWaitOptions, InvokeResult, FundingChoice, InlineWorkflowPayload, InvokeInlineOptions, InvokeInlineAndWaitOptions, ListSnapshotsOptions, TemplateRow, ListTemplatesOptions, CreateFactoryInput, UpdateFactoryInput, SecretOptions, SetSecretResult, SecretListEntry, SessionSecretEntry, SessionSecretInput, SessionSecretRequestCreated, SessionSecretRequestStatus, CreateApiKeyInput, StreamRunLogsOptions, TeamMember, Mention, CreateMentionsInput, EventSubjectType, EventRow, ReportEventInput, ListEventsOptions, ListEventsResult, RunLogLine, ListRunLogsOptions, RunListEntry, ListRunsOptions, RunDetail, FundingLane, RunFundingStamp, RunFundingUsageRow, RunFundingResponse, RunStepUsage, RunStepUsageResponse, RegisteredRuntime, RunState, RunStatus, FactoryRow, SnapshotListEntry, SnapshotListResponse, ApiKey, ApiKeyCreated, ListApiKeysOptions, ApiKeyPage, UsageRollupRow, UsageResponse, CancelRunResponse, RequestAgentPauseOptions, RequestAgentPauseResponse, SendAgentMessageOptions, SendAgentMessageResponse, AnswerSteerOptions, ResumePauseOptions, ResumePauseResponse, ResumePauseSuccess, ResumePausePending, ResumePauseActor, ConversationMessagePart, ConversationRow, ConversationMessageRow, ConversationsPage, ConversationDetail, ConversationThread, ConversationPageContext, SendConversationMessageInput, SendConversationMessageResult, UnnotifiedMention, ConversationTurnState, ConversationPresenceSnapshot, StreamConversationOptions, AgentListRow, CreateCloudSessionInput, CloudSessionCreated, SessionPreview, PreviewOpened, OpenPreviewInput, SessionForked, BackgroundWorkHeld, SessionFileChange, SessionChangeSet, SessionChangeStats, SessionDiffReviewBound, ReviewSuggestion, ReviewSuggestionInput, ReviewNotesPublished, ReviewGitCredential, SessionReviewDocument, ReviewSuggestionDecision, ReviewSuggestionDecisions, SessionMergeReportDetail, SessionMergeReport, SessionMergeGated, SessionDiscardReport, SessionPreflightFileRow, SessionChangePreflight, SessionRebaseReport, DriveMountSession, CreateDriveMountSessionInput, ChannelSessionStatus, ChannelSessionRow, ChannelSessionsResponse, SessionChannelMessagePosted, SessionDirectMessageSent, BranchClaimInfo, BranchClaimGranted, BranchClaimsReleased, BranchClaimState, SessionPerfBucket, SessionPerfHistoryPage, FactoryPerfSummary, FactoryFileSearchRow, FactoryFolderSearchRow, SearchFactoryFilesOptions, FactoryFileSearchResult, PublicFileLinkState, FactoryFileListRow, ListFactoryFilesOptions, FactoryFileListPage, ConversationMemberRole, ConversationMember, DocumentCapability, TemplateCapability, ScopeGrant, ArtifactScope, RunContext, SetScopeGrantsInput, SetTemplateScopeInput, TemplateDetail, Project, ProjectsPage, ProjectRole, ProjectMember, ProjectObject, ProjectObjectsPage, ProjectSkippedFile, ProjectPreviewFile, ProjectAddPreview, AddProjectObjectInput, AddProjectObjectResult, RefreshProjectObjectResult, ComplianceScopeKind, ComplianceStatus, ComplianceSession, ComplianceAccess, RequestComplianceSessionInput, ListComplianceSessionsOptions, ComplianceSessionsPage, ListComplianceAccessesOptions, ComplianceAccessesPage, } from "./client.js";
@@ -51,7 +51,7 @@ export { createCodexRuntime, codexSpec } from "./runtimes/codex.js";
 export type { CodexRuntimeConfig, CodexReasoningEffort } from "./runtimes/codex.js";
 export { default as codexRuntime } from "./runtimes/codex.js";
 export type { CliReasoningEffort } from "./runtimes/_cli-agent.js";
-export { shellQuote, uniquePromptPath, turnLivenessProbeCommand, parseTurnProbeOutput, livenessVerdictFromReading, runnerBusySentinelFragment, exitEventPushCommand, injectAppendAndAckCommand, INJECT_ACK_EXEC_TIMEOUT_MS, streamInputFeederFragment, sessionEnvSourceFragment, credEnvSourceFragment, residentFeederFragment, residentIdleCheckFragment, residentIdleWatchdogFragment, residentResultCountCommand, deferredExitEventPushCommand, RESIDENT_IDLE_TTL_S, RESIDENT_WATCHDOG_POLL_S, RESIDENT_RESULT_LINE_PREFIX, SESSION_ENV_FILE_RELPATH, LAUNCH_EXEC_TIMEOUT_MS, TURN_PROBE_TIMEOUT_MS, INSTALL_PROBE_TIMEOUT_MS, CLI_INSTALL_TIMEOUT_MS, RUNNER_HEARTBEAT_INTERVAL_SECONDS, RUNNER_HEARTBEAT_STALE_MS, } from "./runtimes/_cli-agent.js";
+export { shellQuote, uniquePromptPath, turnLivenessProbeCommand, parseTurnProbeOutput, livenessVerdictFromReading, runnerBusySentinelFragment, exitEventPushCommand, injectAppendAndAckCommand, INJECT_ACK_EXEC_TIMEOUT_MS, wrapMidTurnUserMessage, streamInputFeederFragment, sessionEnvSourceFragment, credEnvSourceFragment, residentFeederFragment, residentIdleCheckFragment, residentIdleWatchdogFragment, residentResultCountCommand, deferredExitEventPushCommand, RESIDENT_IDLE_TTL_S, RESIDENT_WATCHDOG_POLL_S, RESIDENT_RESULT_LINE_PREFIX, SESSION_ENV_FILE_RELPATH, LAUNCH_EXEC_TIMEOUT_MS, TURN_PROBE_TIMEOUT_MS, INSTALL_PROBE_TIMEOUT_MS, CLI_INSTALL_TIMEOUT_MS, RUNNER_HEARTBEAT_INTERVAL_SECONDS, RUNNER_HEARTBEAT_STALE_MS, } from "./runtimes/_cli-agent.js";
 export type { TurnProbeReading, CliAgentSpec } from "./runtimes/_cli-agent.js";
 export { perfSamplerFunctionFragment, standalonePerfProbeCommand, parsePerfToken, parsePerfProbeOutput, PERF_SAMPLE_EVERY_BEATS, PERF_PROBE_WINDOW_SECONDS, PERF_TOKEN_MAX_CHARS, } from "./agent/perf-sampler.js";
 export type { GuestPerfSample } from "./agent/perf-sampler.js";
@@ -73,7 +73,7 @@ export { default as claudeCodeRuntime } from "./runtimes/claude-code.js";
 export { bashTool, codingTools, editTool, readTool, writeTool } from "./tools/index.js";
 export type { CodingTool } from "./tools/index.js";
 export type { RunEvent } from "./types/events.js";
-export { createSandbox, reconnectSandbox, killAllSandboxes, killSandboxById, getSandboxQuotas, listOwnedSandboxes, deleteSandboxSnapshot, snapshotResolves, makeSandboxProvider, makeDesktopSandboxProvider, parseSseExecStream, AGENT_COMPOSE_TAG, SANDBOX_SIZES, SANDBOX_MACHINES, SANDBOX_VCPUS, DEFAULT_SANDBOX_SIZE, SESSION_DEFAULT_SANDBOX_SIZE, E2B_TEMPLATE_SIZES, E2B_MAX_VCPUS, E2B_MAX_MEMORY_MB, VERCEL_MEMORY_MB_PER_VCPU, isE2bSupportedSize, isVercelSupportedSize, sandboxSizeLabel, e2bMachineSpec, e2bBaseTemplate, e2bAgentEnvTemplate, isPlatformE2bTemplateAlias, E2B_DEVBOX_TEMPLATE, E2B_DEVBOX_SPEC, E2B_DEVBOX_RECIPE_VERSION, e2bDevboxTemplateRef } from "./sandbox.js";
+export { createSandbox, reconnectSandbox, killAllSandboxes, killSandboxById, getSandboxQuotas, listOwnedSandboxes, deleteSandboxSnapshot, snapshotResolves, makeSandboxProvider, makeDesktopSandboxProvider, parseSseExecStream, AGENT_COMPOSE_TAG, SANDBOX_SIZES, SANDBOX_MACHINES, SANDBOX_VCPUS, DEFAULT_SANDBOX_SIZE, SESSION_DEFAULT_SANDBOX_SIZE, E2B_TEMPLATE_SIZES, E2B_MAX_VCPUS, E2B_MAX_MEMORY_MB, VERCEL_MEMORY_MB_PER_VCPU, isE2bSupportedSize, isVercelSupportedSize, sandboxSizeLabel, e2bMachineSpec, e2bBaseTemplate, e2bAgentEnvTemplate, e2bMaxSandboxMs, isPlatformE2bTemplateAlias, E2B_DEVBOX_TEMPLATE, E2B_DEVBOX_SPEC, E2B_DEVBOX_RECIPE_VERSION, e2bDevboxTemplateRef } from "./sandbox.js";
 export { SandboxUnavailableError, SANDBOX_UNAVAILABLE_PREFIX } from "./sandbox-errors.js";
 export type { SandboxCreateOpts, SandboxNetworkPolicy, SandboxNetworkHeaderTransform, SandboxNetworkAllowRule, SandboxNetworkSubnetPolicy, SandboxProviderName, SandboxQuotaResult, OwnedSandboxResult, OwnedSandbox, SandboxSize, ParseSseExecStreamOptions, SandboxCommandRunOptions, SandboxCommandResult, } from "./sandbox.js";
 export type { SandboxResources, DriveMergePolicy } from "./types/workflow-metadata.js";

package/dist/index.js

@@ -3413,7 +3413,7 @@ Re-emit the COMPLETE corrected <response> JSON now: every required field present
           continue;
         }
         const msg = outputVerdict.value;
-        if (msg.type === "text_delta" || msg.type === "usage_delta" || msg.type === "task_notification")
+        if (msg.type === "text_delta" || msg.type === "usage_delta" || msg.type === "task_notification" || msg.type === "harness_notice")
           continue;
         opts.onAgentEvent?.(iteration, msg);
         const summary = summarizeAgentMessage(msg);
@@ -4038,6 +4038,13 @@ function streamInputFeederFragment(paths) {
   const q2 = shellQuote;
   return `rm -f ${q2(paths.fifoPath)}; mkfifo ${q2(paths.fifoPath)}; ` + `: > ${q2(paths.inboxPath)}; echo 0 > ${q2(paths.deliveredPath)}; ` + `( cat ${q2(paths.promptPath)}; ac_fed=0; while kill -0 "$$" 2>/dev/null; do ` + `if tail -c ${INJECT_FEEDER_RESULT_TAIL_BYTES} ${q2(paths.outPath)} 2>/dev/null | grep -q '"type":"result"'; then break; fi; ` + `ac_lines=$(wc -l < ${q2(paths.inboxPath)} 2>/dev/null || echo 0); ac_lines=\${ac_lines:-0}; ` + `if [ "$ac_lines" -gt "$ac_fed" ]; then ` + `sed -n "$((ac_fed+1)),$((ac_lines))p" ${q2(paths.inboxPath)}; ac_fed=$ac_lines; ` + `echo "$ac_fed" > ${q2(paths.deliveredPath)}; fi; ` + `sleep ${INJECT_FEEDER_POLL_SECONDS}; done ) > ${q2(paths.fifoPath)} 2>/dev/null </dev/null & `;
 }
+function wrapMidTurnUserMessage(text) {
+  return `The user sent a new message while you were working:
+
+` + text + `
+
+Address the message above as you continue this turn.`;
+}
 function injectAppendAndAckCommand(args) {
   const q2 = shellQuote;
   return `printf '%s\\n' ${q2(args.line)} >> ${q2(args.inboxPath)}; i=0; ` + `while [ "$i" -lt ${INJECT_ACK_POLL_ATTEMPTS} ]; do ` + `d=$(cat ${q2(args.deliveredPath)} 2>/dev/null || echo 0); ` + `[ "\${d:-0}" -ge ${args.target} ] && exit 0; ` + `kill -0 ${args.pid} 2>/dev/null || exit 4; ` + `sleep ${INJECT_ACK_POLL_SECONDS}; i=$((i+1)); done; exit 5`;
@@ -4172,7 +4179,7 @@ class CliAgentRunner {
     const streamInput = this.spec.streamInput;
     if (!inject || !streamInput || this.guestDetached)
       return "unsupported";
-    const line = streamInput.messageLine(text);
+    const line = streamInput.messageLine(wrapMidTurnUserMessage(text));
     const attempt = inject.chain.then(async () => {
       if (this.turnInject !== inject)
         return "closed";
@@ -5115,10 +5122,11 @@ var claudeCodeSpec = {
     switch (p.type) {
       case "assistant": {
         const message = p.message;
+        const synthetic = message?.model === "<synthetic>";
         const blocks2 = Array.isArray(message?.content) ? message.content : [];
         return blocks2.flatMap((b) => {
           if (b.type === "text" && typeof b.text === "string" && b.text.length > 0) {
-            return [{ type: "text", text: b.text, timestamp: ts }];
+            return [{ type: synthetic ? "harness_notice" : "text", text: b.text, timestamp: ts }];
           }
           if (b.type === "thinking" && typeof b.thinking === "string" && b.thinking.length > 0) {
             return [{ type: "thinking", text: b.thinking, timestamp: ts }];
@@ -5434,6 +5442,7 @@ function makeSandboxProvider(sb) {
 function e2bMaxSandboxMs() {
   return Number(process.env.E2B_MAX_SANDBOX_MS) || 60 * 60 * 1000;
 }
+var e2bExtendClampWarned = false;
 function wrapE2bBackgroundProcess(handle) {
   return {
     pid: handle.pid,
@@ -5527,7 +5536,12 @@ function makeE2bSandboxProvider(sb) {
       return { resumeHandle: sb.sandboxId };
     },
     async extendLifetime(ms) {
-      await sb.setTimeout(Math.min(ms, e2bMaxSandboxMs()));
+      const maxMs = e2bMaxSandboxMs();
+      if (ms > maxMs && !e2bExtendClampWarned) {
+        e2bExtendClampWarned = true;
+        console.warn(`[sandbox] e2b lifetime extension clamped: requested ${ms}ms exceeds the plan cap ${maxMs}ms — ` + `the kill-clock backstop fires at the cap, not the requested horizon. Raise E2B_MAX_SANDBOX_MS on plans that allow more.`);
+      }
+      await sb.setTimeout(Math.min(ms, maxMs));
     },
     async updateNetworkPolicy(policy) {
       await sb.updateNetwork(toE2bNetwork(policy));
@@ -5559,6 +5573,7 @@ var e2bProviderDef = {
     const sandboxOpts = {
       ...rest,
       timeoutMs: Math.min(timeoutMs, maxMs),
+      lifecycle: { onTimeout: "pause", autoResume: true },
       ...networkPolicy ? { network: toE2bNetwork(networkPolicy) } : {}
     };
     const resolvedSize = size ?? DEFAULT_SANDBOX_SIZE;
@@ -8976,6 +8991,7 @@ function createDisplayPromoter(ctx = {}) {
 export {
   writeTool,
   writeAgentContext,
+  wrapMidTurnUserMessage,
   uniquePromptPath,
   turnLivenessProbeCommand,
   streamInputFeederFragment,
@@ -9053,6 +9069,7 @@ export {
   explainBundleFailure,
   exitEventPushCommand,
   editTool,
+  e2bMaxSandboxMs,
   e2bMachineSpec,
   e2bDevboxTemplateRef,
   e2bBaseTemplate,

package/dist/runtimes/_cli-agent.d.ts

@@ -149,6 +149,18 @@ export declare function streamInputFeederFragment(paths: {
     deliveredPath: string;
     outPath: string;
 }): string;
+/** The instructional envelope around a user message delivered INTO a
+ *  running turn. Claude Code's own interactive harness wraps queued
+ *  mid-turn input with an explicit "address this as you continue"
+ *  instruction; a bare `--input-format stream-json` line carries no such
+ *  framing, so an injected message reads like any other transcript text
+ *  and the model tends to continue its work narration without
+ *  acknowledging it. Every mid-turn inject producer (the runner's
+ *  `injectUserMessage` and the workflow lane's `deliverInjectedMessage`
+ *  activity) MUST wrap through here — the wrapper rides only the wire to
+ *  the model; the stored conversation row keeps the user's raw text.
+ *  The text is pinned by tests: change it deliberately or not at all. */
+export declare function wrapMidTurnUserMessage(text: string): string;
 /** The one delivery-ack exec `injectUserMessage` runs: append the message
  *  line to the durable inbox, then wait for the feeder's delivered counter
  *  to cover it. Exit 0 = delivered into the CLI's stdin pre-result; 4 = the

package/dist/runtimes/openai-desktop.js

@@ -3413,7 +3413,7 @@ Re-emit the COMPLETE corrected <response> JSON now: every required field present
           continue;
         }
         const msg = outputVerdict.value;
-        if (msg.type === "text_delta" || msg.type === "usage_delta" || msg.type === "task_notification")
+        if (msg.type === "text_delta" || msg.type === "usage_delta" || msg.type === "task_notification" || msg.type === "harness_notice")
           continue;
         opts.onAgentEvent?.(iteration, msg);
         const summary = summarizeAgentMessage(msg);
@@ -4038,6 +4038,13 @@ function streamInputFeederFragment(paths) {
   const q2 = shellQuote;
   return `rm -f ${q2(paths.fifoPath)}; mkfifo ${q2(paths.fifoPath)}; ` + `: > ${q2(paths.inboxPath)}; echo 0 > ${q2(paths.deliveredPath)}; ` + `( cat ${q2(paths.promptPath)}; ac_fed=0; while kill -0 "$$" 2>/dev/null; do ` + `if tail -c ${INJECT_FEEDER_RESULT_TAIL_BYTES} ${q2(paths.outPath)} 2>/dev/null | grep -q '"type":"result"'; then break; fi; ` + `ac_lines=$(wc -l < ${q2(paths.inboxPath)} 2>/dev/null || echo 0); ac_lines=\${ac_lines:-0}; ` + `if [ "$ac_lines" -gt "$ac_fed" ]; then ` + `sed -n "$((ac_fed+1)),$((ac_lines))p" ${q2(paths.inboxPath)}; ac_fed=$ac_lines; ` + `echo "$ac_fed" > ${q2(paths.deliveredPath)}; fi; ` + `sleep ${INJECT_FEEDER_POLL_SECONDS}; done ) > ${q2(paths.fifoPath)} 2>/dev/null </dev/null & `;
 }
+function wrapMidTurnUserMessage(text) {
+  return `The user sent a new message while you were working:
+
+` + text + `
+
+Address the message above as you continue this turn.`;
+}
 function injectAppendAndAckCommand(args) {
   const q2 = shellQuote;
   return `printf '%s\\n' ${q2(args.line)} >> ${q2(args.inboxPath)}; i=0; ` + `while [ "$i" -lt ${INJECT_ACK_POLL_ATTEMPTS} ]; do ` + `d=$(cat ${q2(args.deliveredPath)} 2>/dev/null || echo 0); ` + `[ "\${d:-0}" -ge ${args.target} ] && exit 0; ` + `kill -0 ${args.pid} 2>/dev/null || exit 4; ` + `sleep ${INJECT_ACK_POLL_SECONDS}; i=$((i+1)); done; exit 5`;
@@ -4172,7 +4179,7 @@ class CliAgentRunner {
     const streamInput = this.spec.streamInput;
     if (!inject || !streamInput || this.guestDetached)
       return "unsupported";
-    const line = streamInput.messageLine(text);
+    const line = streamInput.messageLine(wrapMidTurnUserMessage(text));
     const attempt = inject.chain.then(async () => {
       if (this.turnInject !== inject)
         return "closed";
@@ -5115,10 +5122,11 @@ var claudeCodeSpec = {
     switch (p.type) {
       case "assistant": {
         const message = p.message;
+        const synthetic = message?.model === "<synthetic>";
         const blocks2 = Array.isArray(message?.content) ? message.content : [];
         return blocks2.flatMap((b) => {
           if (b.type === "text" && typeof b.text === "string" && b.text.length > 0) {
-            return [{ type: "text", text: b.text, timestamp: ts }];
+            return [{ type: synthetic ? "harness_notice" : "text", text: b.text, timestamp: ts }];
           }
           if (b.type === "thinking" && typeof b.thinking === "string" && b.thinking.length > 0) {
             return [{ type: "thinking", text: b.thinking, timestamp: ts }];
@@ -5434,6 +5442,7 @@ function makeSandboxProvider(sb) {
 function e2bMaxSandboxMs() {
   return Number(process.env.E2B_MAX_SANDBOX_MS) || 60 * 60 * 1000;
 }
+var e2bExtendClampWarned = false;
 function wrapE2bBackgroundProcess(handle) {
   return {
     pid: handle.pid,
@@ -5527,7 +5536,12 @@ function makeE2bSandboxProvider(sb) {
       return { resumeHandle: sb.sandboxId };
     },
     async extendLifetime(ms) {
-      await sb.setTimeout(Math.min(ms, e2bMaxSandboxMs()));
+      const maxMs = e2bMaxSandboxMs();
+      if (ms > maxMs && !e2bExtendClampWarned) {
+        e2bExtendClampWarned = true;
+        console.warn(`[sandbox] e2b lifetime extension clamped: requested ${ms}ms exceeds the plan cap ${maxMs}ms — ` + `the kill-clock backstop fires at the cap, not the requested horizon. Raise E2B_MAX_SANDBOX_MS on plans that allow more.`);
+      }
+      await sb.setTimeout(Math.min(ms, maxMs));
     },
     async updateNetworkPolicy(policy) {
       await sb.updateNetwork(toE2bNetwork(policy));
@@ -5559,6 +5573,7 @@ var e2bProviderDef = {
     const sandboxOpts = {
       ...rest,
       timeoutMs: Math.min(timeoutMs, maxMs),
+      lifecycle: { onTimeout: "pause", autoResume: true },
       ...networkPolicy ? { network: toE2bNetwork(networkPolicy) } : {}
     };
     const resolvedSize = size ?? DEFAULT_SANDBOX_SIZE;

package/dist/sandbox.d.ts

@@ -20,7 +20,7 @@ export { AGENT_COMPOSE_TAG } from "./sandbox/provider-def.js";
 export type { SandboxCreateOpts, OwnedSandbox } from "./sandbox/provider-def.js";
 export { parseSseExecStream } from "./sandbox/exec-stream.js";
 export type { ParseSseExecStreamOptions } from "./sandbox/exec-stream.js";
-export { makeSandboxProvider } from "./sandbox/providers/e2b.js";
+export { makeSandboxProvider, e2bMaxSandboxMs } from "./sandbox/providers/e2b.js";
 export { makeDesktopSandboxProvider } from "./sandbox/providers/desktop.js";
 export { VERCEL_MAX_TAGS, buildVercelTags } from "./sandbox/providers/vercel.js";
 export { makeLocalSandboxProvider } from "./sandbox/providers/local.js";

package/dist/types/protocol.d.ts

@@ -144,7 +144,19 @@ export interface AgentMessageTaskNotification extends AgentMessageBase {
         durationMs?: number;
     };
 }
-export type AgentMessage = AgentMessageInit | AgentMessageText | AgentMessageTextDelta | AgentMessageThinking | AgentMessageToolUse | AgentMessageToolResult | AgentMessageDone | AgentMessageError | AgentMessageUsage | AgentMessageUsageDelta | AgentMessagePlan | AgentMessageTaskNotification;
+/** HARNESS-authored notice text — content the CLI composed itself rather
+ *  than the model speaking: slash-command stdout, model/skills advisories,
+ *  queued-input notes. claude-code marks these structurally (assistant
+ *  events whose `message.model` is `"<synthetic>"`), and the normaliser
+ *  forwards them under this kind so downstream persists them as collapsed
+ *  system notices instead of agent prose (the 2026-08-22 "(session model)"
+ *  / skills-reminder leak: harness plumbing rendered as message content).
+ *  Additive kind: existing producers never emit it. */
+export interface AgentMessageHarnessNotice extends AgentMessageBase {
+    type: "harness_notice";
+    text: string;
+}
+export type AgentMessage = AgentMessageInit | AgentMessageText | AgentMessageTextDelta | AgentMessageThinking | AgentMessageToolUse | AgentMessageToolResult | AgentMessageDone | AgentMessageError | AgentMessageUsage | AgentMessageUsageDelta | AgentMessagePlan | AgentMessageTaskNotification | AgentMessageHarnessNotice;
 /** Status block the agent emits to signal iteration completion or blockers. */
 export interface AgentStatus {
     summary: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-compose/sdk",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "description": "Client library for agent-compose — define agents, runtimes, and workflows, and invoke them against an agent-compose server.",
   "license": "MIT",
   "repository": {

package/src/agent/agent-loop.ts

@@ -93,10 +93,13 @@ function preview(value: unknown): string {
  *  an agent.message event (the terminating `text` carries the whole block) —
  *  the loop filters it before summarizing. `task_notification` is filtered
  *  too: it is session-transport metadata (a parent harness's background-task
- *  completion echo), not the agent's own output. */
+ *  completion echo), not the agent's own output. `harness_notice` likewise:
+ *  harness-composed advisory text (synthetic assistant messages), never the
+ *  agent speaking. */
 type DurableAgentMessage = Exclude<
   AgentMessage,
   { type: "text_delta" } | { type: "usage_delta" } | { type: "task_notification" }
+  | { type: "harness_notice" }
 >;
 
 export function summarizeAgentMessage(msg: DurableAgentMessage): AgentMessageSummary {
@@ -484,8 +487,10 @@ export async function agentLoop<TResponse = unknown>(opts: AgentLoopOpts<TRespon
       }
       const msg = outputVerdict.value;
       // A processor cannot re-introduce a live-only chunk; task
-      // notifications are transport metadata, never loop output.
-      if (msg.type === "text_delta" || msg.type === "usage_delta" || msg.type === "task_notification") continue;
+      // notifications and harness notices are transport metadata, never
+      // loop output.
+      if (msg.type === "text_delta" || msg.type === "usage_delta"
+        || msg.type === "task_notification" || msg.type === "harness_notice") continue;
       opts.onAgentEvent?.(iteration, msg);
       // Usage summaries carry the resolved model so the server can price
       // token rows per model without correlating back to agent.spawned.

package/src/index.ts

@@ -101,6 +101,7 @@ export type {
   AgentMessageError,
   AgentMessageUsage,
   AgentMessageTaskNotification,
+  AgentMessageHarnessNotice,
   AgentStatus,
 } from "./types/protocol.js";
 
@@ -266,7 +267,7 @@ export {
   shellQuote, uniquePromptPath,
   turnLivenessProbeCommand, parseTurnProbeOutput, livenessVerdictFromReading,
   runnerBusySentinelFragment, exitEventPushCommand,
-  injectAppendAndAckCommand, INJECT_ACK_EXEC_TIMEOUT_MS,
+  injectAppendAndAckCommand, INJECT_ACK_EXEC_TIMEOUT_MS, wrapMidTurnUserMessage,
   streamInputFeederFragment, sessionEnvSourceFragment, credEnvSourceFragment,
   residentFeederFragment, residentIdleCheckFragment, residentIdleWatchdogFragment,
   residentResultCountCommand, deferredExitEventPushCommand,
@@ -323,7 +324,7 @@ export { createSandbox, reconnectSandbox, killAllSandboxes, killSandboxById,
   E2B_TEMPLATE_SIZES, E2B_MAX_VCPUS, E2B_MAX_MEMORY_MB,
   VERCEL_MEMORY_MB_PER_VCPU,
   isE2bSupportedSize, isVercelSupportedSize, sandboxSizeLabel,
-  e2bMachineSpec, e2bBaseTemplate, e2bAgentEnvTemplate,
+  e2bMachineSpec, e2bBaseTemplate, e2bAgentEnvTemplate, e2bMaxSandboxMs,
   isPlatformE2bTemplateAlias,
   // ADR-0038 "Computer" — the per-member persistent desktop machine template.
   E2B_DEVBOX_TEMPLATE, E2B_DEVBOX_SPEC, E2B_DEVBOX_RECIPE_VERSION,

package/src/runtimes/_cli-agent.ts

@@ -252,6 +252,23 @@ export function streamInputFeederFragment(paths: {
     + `sleep ${INJECT_FEEDER_POLL_SECONDS}; done ) > ${q(paths.fifoPath)} 2>/dev/null </dev/null & `;
 }
 
+/** The instructional envelope around a user message delivered INTO a
+ *  running turn. Claude Code's own interactive harness wraps queued
+ *  mid-turn input with an explicit "address this as you continue"
+ *  instruction; a bare `--input-format stream-json` line carries no such
+ *  framing, so an injected message reads like any other transcript text
+ *  and the model tends to continue its work narration without
+ *  acknowledging it. Every mid-turn inject producer (the runner's
+ *  `injectUserMessage` and the workflow lane's `deliverInjectedMessage`
+ *  activity) MUST wrap through here — the wrapper rides only the wire to
+ *  the model; the stored conversation row keeps the user's raw text.
+ *  The text is pinned by tests: change it deliberately or not at all. */
+export function wrapMidTurnUserMessage(text: string): string {
+  return "The user sent a new message while you were working:\n\n"
+    + text
+    + "\n\nAddress the message above as you continue this turn.";
+}
+
 /** The one delivery-ack exec `injectUserMessage` runs: append the message
  *  line to the durable inbox, then wait for the feeder's delivered counter
  *  to cover it. Exit 0 = delivered into the CLI's stdin pre-result; 4 = the
@@ -823,7 +840,10 @@ export class CliAgentRunner implements ModelExecutionContract {
     const inject = this.turnInject;
     const streamInput = this.spec.streamInput;
     if (!inject || !streamInput || this.guestDetached) return "unsupported";
-    const line = streamInput.messageLine(text);
+    // The address-this envelope (wrapMidTurnUserMessage): a raw injected
+    // line carries no framing, and the model continues its narration
+    // without acknowledging the message.
+    const line = streamInput.messageLine(wrapMidTurnUserMessage(text));
     const attempt = inject.chain.then(async (): Promise<"delivered" | "pending" | "closed"> => {
       if (this.turnInject !== inject) return "closed";
       // The append lands whether or not the ack times out, so the target

package/src/runtimes/claude-code.ts

@@ -291,11 +291,20 @@ export const claudeCodeSpec: CliAgentSpec = {
     switch (p.type) {
       // Assistant API message: content blocks → text / thinking / tool_use.
       case "assistant": {
-        const message = p.message as { content?: ClaudeContentBlock[] } | undefined;
+        const message = p.message as { content?: ClaudeContentBlock[]; model?: unknown } | undefined;
+        // HARNESS-synthesized assistant messages: the CLI stamps
+        // `message.model: "<synthetic>"` on content it composed itself —
+        // slash-command stdout, model/skills advisories — never the model
+        // speaking (verified live on claude 2.1.212 and 2.1.236: /model and
+        // /context output both arrive this way). Their text forwards as
+        // `harness_notice` so downstream renders it as a quiet system note
+        // instead of agent prose (the 2026-08-22 plumbing-as-content leak).
+        // Structural marker only — no content sniffing.
+        const synthetic = message?.model === "<synthetic>";
         const blocks = Array.isArray(message?.content) ? message.content : [];
         return blocks.flatMap((b): AgentMessage[] => {
           if (b.type === "text" && typeof b.text === "string" && b.text.length > 0) {
-            return [{ type: "text", text: b.text, timestamp: ts }];
+            return [{ type: synthetic ? "harness_notice" : "text", text: b.text, timestamp: ts }];
           }
           if (b.type === "thinking" && typeof b.thinking === "string" && b.thinking.length > 0) {
             return [{ type: "thinking", text: b.thinking, timestamp: ts }];

package/src/sandbox/providers/e2b.ts

@@ -104,6 +104,9 @@ export function e2bMaxSandboxMs(): number {
   return Number(process.env.E2B_MAX_SANDBOX_MS) || 60 * 60 * 1000;
 }
 
+/** Once-per-process latch for the extendLifetime clamp warning below. */
+let e2bExtendClampWarned = false;
+
 /** Wrap an E2B `CommandHandle` as a provider-agnostic background process.
  *  `wait()` is normalised NOT to throw on a non-zero exit (mirroring the
  *  `commands.run` contract in `makeSandboxProvider`) so callers branch on
@@ -245,7 +248,20 @@ function makeE2bSandboxProvider(sb: Sandbox): SandboxProvider {
     // the create timeout — an over-cap push would 400 and leave the OLD
     // (possibly short) deadline standing.
     async extendLifetime(ms) {
-      await sb.setTimeout(Math.min(ms, e2bMaxSandboxMs()));
+      const maxMs = e2bMaxSandboxMs();
+      if (ms > maxMs && !e2bExtendClampWarned) {
+        // Once per process, not per extension: every far-horizon push clamps
+        // identically, and the fact worth surfacing is the CONFIGURATION —
+        // the server believes it bought `ms` of kill-clock slack but the
+        // plan cap silently shortens it, so the "orphan backstop" can reap
+        // a machine the platform still considers covered.
+        e2bExtendClampWarned = true;
+        console.warn(
+          `[sandbox] e2b lifetime extension clamped: requested ${ms}ms exceeds the plan cap ${maxMs}ms — ` +
+          `the kill-clock backstop fires at the cap, not the requested horizon. Raise E2B_MAX_SANDBOX_MS on plans that allow more.`,
+        );
+      }
+      await sb.setTimeout(Math.min(ms, maxMs));
     },
     // Push a freshly-resolved egress policy onto the live sandbox via E2B's
     // native `updateNetwork` — the E2B analogue of Vercel's `update({
@@ -317,6 +333,15 @@ export const e2bProviderDef: SandboxProviderDef = {
     const sandboxOpts = {
       ...rest,
       timeoutMs: Math.min(timeoutMs, maxMs),
+      // Lifetime-deadline expiry PAUSES instead of killing, and the next
+      // incoming connection auto-resumes (recycle forensics 2026-08-23:
+      // uncontrolled kill-clock loss was the dominant machine-end cause
+      // ~60:1 — under this policy a missed extension becomes a resumable
+      // park our redial paths revive). CREATE-time policy, persistent for
+      // the sandbox's life — connect() takes no lifecycle. NOTE: this is
+      // e2b's `lifecycle` contract, NOT the deprecated `autoPause` flag
+      // (which the create body would silently drop).
+      lifecycle: { onTimeout: "pause" as const, autoResume: true },
       ...(networkPolicy ? { network: toE2bNetwork(networkPolicy) } : {}),
     };
     // Boot template resolution, in priority order:
@@ -339,6 +364,9 @@ export const e2bProviderDef: SandboxProviderDef = {
     );
   },
   reconnect: async (sandboxId) => makeE2bSandboxProvider(
+    // The pause-on-timeout policy is create-time and persistent — connect
+    // takes no lifecycle options (the old per-connect autoPause flag is
+    // deprecated API-side).
     await Sandbox.connect(sandboxId, { apiKey: process.env.E2B_API_KEY ?? "", timeoutMs: 60 * 60 * 1000 }),
   ),
   killAll: async () => {

package/src/sandbox.ts

@@ -54,7 +54,7 @@ export type { SandboxCreateOpts, OwnedSandbox } from "./sandbox/provider-def.js"
 export { parseSseExecStream } from "./sandbox/exec-stream.js";
 export type { ParseSseExecStreamOptions } from "./sandbox/exec-stream.js";
 
-export { makeSandboxProvider } from "./sandbox/providers/e2b.js";
+export { makeSandboxProvider, e2bMaxSandboxMs } from "./sandbox/providers/e2b.js";
 export { makeDesktopSandboxProvider } from "./sandbox/providers/desktop.js";
 export { VERCEL_MAX_TAGS, buildVercelTags } from "./sandbox/providers/vercel.js";
 export { makeLocalSandboxProvider } from "./sandbox/providers/local.js";

package/src/types/protocol.ts

@@ -147,6 +147,19 @@ export interface AgentMessageTaskNotification extends AgentMessageBase {
   usage?: { tokens?: number; toolUses?: number; durationMs?: number };
 }
 
+/** HARNESS-authored notice text — content the CLI composed itself rather
+ *  than the model speaking: slash-command stdout, model/skills advisories,
+ *  queued-input notes. claude-code marks these structurally (assistant
+ *  events whose `message.model` is `"<synthetic>"`), and the normaliser
+ *  forwards them under this kind so downstream persists them as collapsed
+ *  system notices instead of agent prose (the 2026-08-22 "(session model)"
+ *  / skills-reminder leak: harness plumbing rendered as message content).
+ *  Additive kind: existing producers never emit it. */
+export interface AgentMessageHarnessNotice extends AgentMessageBase {
+  type: "harness_notice";
+  text: string;
+}
+
 export type AgentMessage =
   | AgentMessageInit
   | AgentMessageText
@@ -159,7 +172,8 @@ export type AgentMessage =
   | AgentMessageUsage
   | AgentMessageUsageDelta
   | AgentMessagePlan
-  | AgentMessageTaskNotification;
+  | AgentMessageTaskNotification
+  | AgentMessageHarnessNotice;
 
 /** Status block the agent emits to signal iteration completion or blockers. */
 export interface AgentStatus {