@agent-compose/sdk 0.8.4 → 0.8.6

package/dist/request-context/request-context.d.ts

@@ -1,7 +1,7 @@
 /**
  * RequestContext — one typed bag carrying tenant identity + freeform
  * per-run state across the boundary between server, dispatch, runner,
- * workflow body, agent loop, and (future) processors.
+ * workflow body, agent loop, and processors.
  *
  * Two halves:
  *

package/dist/runtimes/_cli-agent.d.ts

@@ -4,7 +4,7 @@
  * contract.
  *
  * This is a different *mechanism* from the other runtimes: `claudeRuntime`
- * drives the Anthropic Agent SDK and `vercelRuntime` drives the Vercel AI SDK,
+ * drives the Anthropic Agent SDK and `createVercelRuntime` drives the Vercel AI SDK,
  * but a CLI-agent runtime spawns the provider's own CLI (`codex exec --json`,
  * `amp -x --stream-json`) — the CLI brings its own agent loop + tools, and we
  * only stream-parse the events it prints. Codex and Amp are the first two; this
@@ -60,6 +60,29 @@ export declare function runnerBusySentinelFragment(busyPath: string, tasksPath:
  *  `date +%s%3N` in the same exec, so host clock skew is irrelevant) is
  *  stale: three missed writes. */
 export declare const RUNNER_HEARTBEAT_STALE_MS: number;
+/** The sh fragment the heartbeat subshell runs each beat to rewrite the
+ *  pulse file: `<guest epoch ms>,<cpu jiffies>,<written bytes>,<procs>`
+ *  for every process in the runner's own session (the setsid tree — the
+ *  CLI, its foreground tool, their children). Comma-separated so the
+ *  probe can carry it as ONE whitespace-delimited field. Exported for
+ *  tests. */
+export declare function toolPulseFragment(pulsePath: string): string;
+/** One tool-run pulse sample, parsed off the probe's trailing field. */
+export interface TurnToolPulse {
+    /** Guest epoch ms when the sample was written. */
+    atMs: number;
+    /** Aggregate utime+stime jiffies across the runner's session. */
+    cpuJiffies: number;
+    /** Aggregate written bytes (wchar) across the runner's session. */
+    ioBytes: number;
+    /** Live processes in the session. */
+    procs: number;
+}
+/** Parse the pulse token (`at,cpu,io,procs`). Null on anything malformed —
+ *  evidence-absent, never an error. Exported for tests. */
+export declare function parseToolPulseToken(token: string): TurnToolPulse | null;
+/** Bound on the pulse token read (4 numeric fields + commas). */
+export declare const TOOL_PULSE_TOKEN_MAX_CHARS = 96;
 /** Watchdog cadence while a tail stream is attached. Each tick is one fresh
  *  short exec; a healthy stream makes every tick a no-op. */
 export declare const TAIL_WATCHDOG_INTERVAL_MS = 15000;
@@ -75,12 +98,42 @@ export declare const TAIL_ABANDON_AFTER_STREAM_DEATHS = 3;
  *  (envd HTTP, ~65ms RTT), consumed from the byte offset. Latency-tuned:
  *  this is the degraded path, correctness never depends on it being fast. */
 export declare const DURABLE_POLL_INTERVAL_MS = 1000;
-/** The claude CLI's stderr complaint when `--resume <id>` names a thread
- *  that does not exist on this machine (the 2026-08-18 split-brain
- *  forensic). When a nonzero exit's stderr carries it, the transport
- *  surfaces the stderr as the turn's LAST error event even though a bare
- *  result error already streamed — the consumer's classifier needs the
- *  specific complaint, not the generic `error_during_execution` token. */
+/** Consecutive provider-attested "sandbox gone" probe failures ⇒ dead. */
+export declare const PROBE_DEATH_GONE_STREAK = 3;
+/** Not-found evidence must also persist this long (guards a momentary
+ *  control-plane 404 blip from killing a live turn). */
+export declare const PROBE_DEATH_GONE_WINDOW_MS = 15000;
+/** Consecutive GENERIC probe-transport failures (timeouts, connection
+ *  faults) ⇒ dead — only together with the window below. */
+export declare const PROBE_DEATH_FAIL_STREAK = 20;
+/** …and the failure run must span at least this long with zero durable
+ *  evidence of any kind. */
+export declare const PROBE_DEATH_FAIL_WINDOW_MS = 120000;
+/** Provider evidence that the SANDBOX itself is gone — E2B's
+ *  SandboxNotFoundError / NotFoundError classes (matched by name so no
+ *  provider import rides in the runtime layer), or their messages after any
+ *  wrapping ("Paused sandbox X not found" was run 3's exact shape). */
+export declare function isSandboxGoneError(err: unknown): boolean;
+/** One probe-failure run's bookkeeping (reset to zeros on ANY evidence). */
+export interface ProbeDeathState {
+    /** Consecutive probe execs that THREW (no verdict at all). */
+    failStreak: number;
+    /** Consecutive throws that were provider "sandbox gone" evidence. */
+    goneStreak: number;
+    /** Wall-clock start of the current failure run (0 = no run). */
+    firstFailAtMs: number;
+}
+/** The death-door decision, pure for tests. Null = keep polling. */
+export declare function probeDeathVerdict(s: ProbeDeathState, nowMs: number): "dead-gone" | "dead-silent" | null;
+/** The CLI's stderr complaint when the thread it was told to resume does
+ *  not exist on this machine: claude's `--resume <id>` "No conversation
+ *  found with session ID" (the 2026-08-18 split-brain forensic) and
+ *  opencode's `--session <id>` "Error: Session not found" (in the CLI's
+ *  red-bold ANSI dressing; 1.18.34). When a nonzero exit's stderr carries
+ *  it, the transport surfaces the stderr as the turn's LAST error event
+ *  even though a bare result error already streamed — the consumer's
+ *  classifier needs the specific complaint, not the generic
+ *  `error_during_execution` token. */
 export declare const RESUME_TARGET_MISSING_STDERR: RegExp;
 /** One durable-trio reading, parsed from the probe exec's single line. */
 export interface TurnProbeReading {
@@ -99,6 +152,10 @@ export interface TurnProbeReading {
      *  sample yet, or a garbled token — evidence-absent, never an error.
      *  Telemetry-only: no liveness verdict may ever read it. */
     perf?: GuestPerfSample;
+    /** Latest tool-run pulse (the `.pulse` token field, 2026-08-29), when the
+     *  guest wrote one AND it parsed clean. Telemetry-only, same rule as
+     *  `perf`: no liveness verdict may ever read it. */
+    pulse?: TurnToolPulse;
 }
 /** The probe exec: one line, six fields, always exit 0 — faults surface as
  *  parse failures, not exec failures. Reads the guest's own clock in the
@@ -112,6 +169,7 @@ export declare function turnLivenessProbeCommand(paths: {
     perfPath: string;
     pid: number;
     sentinel: string;
+    pulsePath?: string;
 }): string;
 /** Parse the probe's line. Null = unusable output (a wedged or faulted exec)
  *  — the caller treats that as "probe-failed", never as a verdict. The
@@ -138,10 +196,31 @@ export declare const INJECT_FEEDER_RESULT_TAIL_BYTES = 262144;
 export declare const INJECT_ACK_POLL_ATTEMPTS = 30;
 export declare const INJECT_ACK_POLL_SECONDS = "0.5";
 export declare const INJECT_ACK_EXEC_TIMEOUT_MS = 25000;
+/** How the guest recognises the CLI's terminal `result` event in the durable
+ *  .out: a line that carries the `"type":"result"` pair and does not open
+ *  with another event's type, as an awk condition over `$0` (POSIX awk, so
+ *  dash, busybox and the macOS test hosts read it alike). The CLI does not
+ *  keep its key order: 2.1.212 wrote `{"type":"result",…` but 2.1.278 and
+ *  later write the pair near the END of the object
+ *  (`{"duration_api_ms":…,"result":"…","type":"result","duration_ms":…}`), so
+ *  the anchored prefix the resident contract used matched nothing on the
+ *  pinned 2.1.283. Every other event the CLI writes opens with its own type
+ *  (`{"type":"assistant",…`, `{"type":"stream_event",…`), which keeps a tool
+ *  call whose input holds the same pair from counting; tool output and model
+ *  text ride inside JSON strings, where the quotes are escaped. */
+export declare const CLI_RESULT_LINE_AWK: string;
 /** The in-guest feeder fragment, prepended to the detached wrapper script.
  *  Runs inside the setsid session (group-kill reaps it) and keys its loop to
  *  the wrapper's own pid (`$$`), like the heartbeat subshell. Exported for
- *  tests. */
+ *  tests.
+ *
+ *  The forward is GUARDED: the fed and delivered counters advance only
+ *  when `sed` wrote the lines. The loop keys on the wrapper, which outlives
+ *  a CLI that died without a result line by the sentinel write and the
+ *  exit push; in that window the FIFO has no reader, `sed` dies of SIGPIPE,
+ *  and an unguarded counter still advanced, so the ack exited 0 for a line
+ *  nobody could read and the settle sealed it (review C1). Guarded, the ack
+ *  sees no advance and exits 4 or 5, and the message stays owed. */
 export declare function streamInputFeederFragment(paths: {
     promptPath: string;
     fifoPath: string;
@@ -160,13 +239,25 @@ export declare function streamInputFeederFragment(paths: {
  *  activity) MUST wrap through here — the wrapper rides only the wire to
  *  the model; the stored conversation row keeps the user's raw text.
  *  The text is pinned by tests: change it deliberately or not at all. */
-export declare function wrapMidTurnUserMessage(text: string): string;
+export declare function wrapMidTurnUserMessage(text: string, opts?: MidTurnEnvelopeOptions): string;
+/** Who a mid-turn message speaks for, when it is not the session user.
+ *  `relayedFrom` = the display name of the person whose own words an agent
+ *  relayed verbatim; `fromOwnerAgent` = the thread agent that owns this
+ *  worker, in its own words; both absent = the session user's own message. */
+export interface MidTurnEnvelopeOptions {
+    relayedFrom?: string | null;
+    fromOwnerAgent?: boolean;
+}
 /** The one delivery-ack exec `injectUserMessage` runs: append the message
  *  line to the durable inbox, then wait for the feeder's delivered counter
- *  to cover it. Exit 0 = delivered into the CLI's stdin pre-result; 4 = the
- *  runner died first; 5 = not delivered within the ack window (feeder
- *  stopped on the result, or the guest is crawling) — both non-zero exits
- *  mean "leave the message owed". Exported for tests. */
+ *  to cover it. Exit 0 = written into the CLI's stdin pipe pre-result,
+ *  which is NOT "the model saw it": the CLI surfaces the line at its next
+ *  tool boundary, so a kill before then loses it, and the settle's kill
+ *  terminals hold the anchor at the pre-inject dispatch head for that
+ *  reason (review D8). 4 = the runner died first; 5 = not forwarded within
+ *  the ack window (the feeder is not forwarding: it stopped on the result,
+ *  the resident turn gate is closed, or the guest is crawling). Both
+ *  non-zero exits mean "leave the message owed". Exported for tests. */
 export declare function injectAppendAndAckCommand(args: {
     line: string;
     target: number;
@@ -174,6 +265,60 @@ export declare function injectAppendAndAckCommand(args: {
     inboxPath: string;
     deliveredPath: string;
 }): string;
+/** stdin is a live message stream: the FIFO feeder above delivers the prompt
+ *  line first and inbox lines after (claude: `--input-format stream-json`). */
+export interface StdinStreamInputSpec {
+    transport: "stdin-stream";
+    /** Serialise the opening prompt into ONE stream-input stdin line
+     *  (claude: a stream-json user message). No trailing newline — the
+     *  transport owns line framing. */
+    promptLine(prompt: string): string;
+    /** Serialise one mid-turn user message into ONE stdin line. No
+     *  trailing newline. */
+    messageLine(text: string): string;
+    /** Serialise ONE in-band interrupt control line (claude: a stream-json
+     *  `control_request` with subtype "interrupt") — the ESC equivalent.
+     *  The CLI's control layer handles these immediately, MID-STEP
+     *  included: the running tool call aborts (its tool_result records the
+     *  harness's own rejection text), the run ends with an
+     *  `error_during_execution` result within ~100ms, and the session file
+     *  stays `--resume`-able with the whole turn context. Verified live
+     *  against claude 2.1.236. Absent → the runtime has no in-band
+     *  interrupt; callers fall back to kill semantics. */
+    interruptLine?(requestId: string): string;
+}
+/** The CLI hands the inbox to the model itself, through a hook it runs after
+ *  each tool call it completes (codex: the platform's PostToolUse command
+ *  hook, CODEX_MID_TURN_HOOK_COMMAND in codex.ts). The launch creates the
+ *  inbox and exports its paths into the CLI's environment
+ *  (toolHookInboxFragment); the hook reads them back, prints the unfed lines
+ *  as its additional context for the model and advances the delivered
+ *  counter. stdin stays the plain prompt file, so there is no in-band
+ *  interrupt on this transport. */
+export interface ToolHookInputSpec {
+    transport: "tool-hook";
+    /** Serialise one mid-turn user message into ONE inbox line the hook can
+     *  splice into its JSON output without decoding: a JSON string literal. */
+    messageLine(text: string): string;
+}
+export type MidTurnInputSpec = StdinStreamInputSpec | ToolHookInputSpec;
+/** The stdin-stream transport of a spec, or undefined. The FIFO feeder, the
+ *  resident harness, the prewarm lane and the in-band interrupt exist only
+ *  for this transport; the inject lane itself reads `midTurnInput`. */
+export declare function stdinStreamInputOf(spec: Pick<CliAgentSpec, "midTurnInput">): StdinStreamInputSpec | undefined;
+/** The environment the tool-hook lane hands the CLI, and so the hook: codex
+ *  runs a command hook with the CLI process's own environment (codex-rs
+ *  hooks/src/registry.rs Hooks::new, engine/command_runner.rs at
+ *  rust-v0.160.0). The turn's inbox and delivered-counter paths. */
+export declare const MID_TURN_INBOX_ENV = "AC_MID_TURN_INBOX";
+export declare const MID_TURN_DELIVERED_ENV = "AC_MID_TURN_DELIVERED";
+/** The tool-hook lane's launch fragment, prepended to the detached wrapper
+ *  script (the shell the CLI starts in): a fresh inbox, the counter at 0,
+ *  and both paths exported for the hook. Exported for tests. */
+export declare function toolHookInboxFragment(paths: {
+    inboxPath: string;
+    deliveredPath: string;
+}): string;
 /** SIGTERM grace before escalation: attempts × sleep = 5s. */
 export declare const REAP_TERM_WAIT_ATTEMPTS = 20;
 /** Post-SIGKILL confirm window: attempts × sleep = 2s (a KILLed process only
@@ -196,33 +341,63 @@ export declare function reapKillAndConfirmCommand(pid: number): string;
 export declare const RESIDENT_IDLE_TTL_S = 240;
 /** Watchdog poll cadence (seconds). */
 export declare const RESIDENT_WATCHDOG_POLL_S = 15;
-/** Anchored prefix of the CLI's terminal result event line. Anchoring keeps
- *  the guest-side counts honest against tool output that merely CONTAINS
- *  the substring; a serialization-order change fails SAFE (parity check
- *  refuses adoption → cold launch — a latency cost, never correctness). */
-export declare const RESIDENT_RESULT_LINE_PREFIX = "{\"type\":\"result\"";
+/** Shell command printing how many result lines the durable .out holds —
+ *  the guest's turn accounting (feeder gate, idle check, adoption parity).
+ *  Prints nothing when the file is missing: callers default an empty count
+ *  to 0. */
+export declare function cliResultCountCommand(outPath: string): string;
 /** One bounded exec printing the count of result lines at or past
  *  `fromByte` (0-based) in the durable .out. Always exits 0; stdout is the
  *  count (a missing file reads as 0). Hint-grade by design. */
 export declare function residentResultCountCommand(outPath: string, fromByte?: number): string;
+/** One bounded exec reporting the LAST result line in the durable .out
+ *  window [`fromByte`, `toByte`): prints `none` (no result line), `error`
+ *  (its `is_error` is true) or `ok`. Always exits 0 and never prints the
+ *  line itself. The harvest's confirm for a resident result the tailer never
+ *  parsed (review C2): a count alone cannot say whether the turn failed. The
+ *  whole line is searched for `"is_error":true`, wherever the CLI put it
+ *  (key order is not fixed). `toByte` bounds the window to bytes a drain
+ *  already walked past, so a result the drain never reached (or a line still
+ *  being written past its line-aligned offset) is not confirmed; omitted,
+ *  the window runs to the end of the file. A window with `toByte <= fromByte`
+ *  is empty. */
+export declare function residentLastResultCommand(outPath: string, fromByte?: number, toByte?: number): string;
 /** The resident feeder: `streamInputFeederFragment` with the result-break
- *  REPLACED by the end-file break — the ONLY guest-contract change the
- *  resident shape needs (verified live by the spec's probe: two messages,
- *  one process, one session file, graceful exit on `.end`). */
+ *  REPLACED by the end-file break (verified live by the spec's probe: two
+ *  messages, one process, one session file, graceful exit on `.end`), plus
+ *  the TURN GATE: inbox lines are forwarded only while a delivered turn is
+ *  still unanswered (the result count in .out is below `.served`),
+ *  the same two numbers the idle predicate reads. Without the gate, a line
+ *  appended after the turn's result line but before the server settled the
+ *  turn was fed into the idle CLI, started a turn nobody tails, and was
+ *  acked as delivered: the message was never answered, and the extra result
+ *  line broke the next adoption's parity. With the gate that line stays
+ *  unfed, the inject ack exits 5, and the message stays owed for the
+ *  follow-up turn. Adoption bumps `.served` BEFORE it appends, so the next
+ *  turn's prompt still flows. The count is a full-file grep, re-run
+ *  only on a poll that has unfed lines AND a changed (.out size, .served)
+ *  pair, so an idle resident holding a gated line never rescans. The
+ *  forward is guarded like the plain feeder's: the counters advance only
+ *  when `sed` wrote the lines into the FIFO. */
 export declare function residentFeederFragment(paths: {
     promptPath: string;
     fifoPath: string;
     inboxPath: string;
     deliveredPath: string;
     endPath: string;
+    outPath: string;
+    servedPath: string;
 }): string;
-/** Sets `ac_idle` (1 = between turns: every delivered turn has its result
- *  and the inbox is fully fed). Embedded by the watchdog and the resident
- *  heartbeat gate — one idle predicate, stated once. */
+/** Sets `ac_idle` (1 = between turns: every delivered turn has its result).
+ *  Embedded by the watchdog and the resident heartbeat gate: one idle
+ *  predicate, stated once. Unfed inbox lines do not make a resident busy:
+ *  the feeder's turn gate forwards a line only while results < served, so
+ *  a line still unfed once results >= served is held until the next
+ *  adoption bumps `.served` (a message that raced the result, owed on the
+ *  server). Reading it as work would keep the heartbeat fresh and the
+ *  watchdog quiet for as long as the line sat there. */
 export declare function residentIdleCheckFragment(paths: {
     outPath: string;
-    inboxPath: string;
-    deliveredPath: string;
     servedPath: string;
 }): string;
 /** Guest idle watchdog: reap the whole process group after
@@ -247,8 +422,6 @@ export declare function residentIdleCheckFragment(paths: {
  *  process existence). */
 export declare function residentIdleWatchdogFragment(paths: {
     outPath: string;
-    inboxPath: string;
-    deliveredPath: string;
     servedPath: string;
 }): string;
 /** Exit-event doorbell with the turnId read from a guest FILE at push time
@@ -286,6 +459,13 @@ export declare const INSTALL_PROBE_TIMEOUT_MS = 30000;
  *  detached launch — the session images bake only `claude`, so codex/
  *  opencode/cursor/droid MUST be installable at launch on a fresh machine. */
 export declare const CLI_INSTALL_TIMEOUT_MS = 300000;
+/** Recover the detached runner's pid from its durable pidfile after the
+ *  launch exec's STREAM died (deadline_exceeded, canceled context, any wire
+ *  fault). Reads over the file transport with a short retry so the race
+ *  where the launch shell is still writing the pidfile is absorbed.
+ *  Exported for the server's workflow-lane launch (turn-workflow/tailer.ts
+ *  launchDetachedRunner), which recovers the same way. */
+export declare function recoverLaunchPid(read: (path: string) => Promise<string>, pidPath: string): Promise<number>;
 /** Single-quote a value for safe interpolation into a `sh -c` command line. */
 export declare function shellQuote(value: string): string;
 /** $HOME-relative path of the platform-managed session env file. The server
@@ -299,6 +479,16 @@ export declare const SESSION_ENV_FILE_RELPATH = ".agent-compose/session-env.sh";
  *  when no env file is configured. Errors are swallowed — a missing or
  *  unreadable file must never fail a turn. */
 export declare function sessionEnvSourceFragment(relPath: string | undefined): string;
+/** Shell command printing a fingerprint of the session env file's current
+ *  bytes (POSIX `cksum`), or `absent` when there is no file. A resident
+ *  records it next to its prompt immediately BEFORE sourcing the file, and
+ *  an adoption compares the file's fingerprint at that moment with it: a
+ *  fresh launch would source the file as it is now, the resident only ever
+ *  saw the one it started with. Recording before the source keeps the
+ *  comparison conservative — a write that lands between the two reads as a
+ *  change. The guest file is the one truth every replica writes to, so the
+ *  verdict never depends on which server process wrote it. */
+export declare function sessionEnvFingerprintCommand(relPath: string): string;
 /** The per-turn model-credential source fragment (`RuntimeOptions.
  *  credEnvFile` — an ABSOLUTE guest path), or "" when none is configured.
  *  Sourced AFTER the session env file so the turn actor's credential wins.
@@ -403,9 +593,9 @@ export interface CliAgentSpec {
      *  `effort` is present only when the caller configured a reasoning effort
      *  AND the spec has a real knob for it (see `CliReasoningEffort`).
      *  `streamInput` is true when the durable transport is feeding stdin as a
-     *  live message stream (see `CliAgentSpec.streamInput`): `promptPath` is
-     *  then the FIFO the feeder writes, and the CLI must be invoked in its
-     *  stream-input mode (claude: `--input-format stream-json`). */
+     *  live message stream (the "stdin-stream" `midTurnInput` transport):
+     *  `promptPath` is then the FIFO the feeder writes, and the CLI must be
+     *  invoked in its stream-input mode (claude: `--input-format stream-json`). */
     buildCommand(args: {
         promptPath: string;
         sessionId?: string;
@@ -447,27 +637,15 @@ export interface CliAgentSpec {
         args: string[];
         env?: Record<string, string>;
     };
-    /** Mid-turn STREAM-INPUT support (the delivery half of
-     *  `injectUserMessage`). When present AND the durable detached transport
-     *  is in play, the CLI's stdin is fed from a FIFO by an in-guest feeder:
-     *  the prompt line first, then any lines appended to the turn's durable
-     *  inbox file — so a steering-capable CLI (claude: queued user input is
-     *  folded into the RUNNING turn at the next tool boundary; verified live
-     *  against claude 2.1.233) receives user messages while the turn runs.
-     *  The feeder stops at the CLI's terminal result line (a message that
-     *  races the result is NOT forwarded — it stays owed) and closes the
-     *  FIFO, which is what ends the CLI process (stream-input CLIs exit on
-     *  stdin EOF, not after a result). Absent → the prompt file is the whole
-     *  stdin, exactly as before. */
-    streamInput?: {
-        /** Serialise the opening prompt into ONE stream-input stdin line
-         *  (claude: a stream-json user message). No trailing newline — the
-         *  transport owns line framing. */
-        promptLine(prompt: string): string;
-        /** Serialise one mid-turn user message into ONE stdin line. No
-         *  trailing newline. */
-        messageLine(text: string): string;
-    };
+    /** Mid-turn INPUT support (the delivery half of `injectUserMessage`): how
+     *  a line appended to the turn's durable inbox reaches the CLI while its
+     *  turn runs — see the transports above. Engages only on the durable
+     *  detached transport (the inbox, the delivered counter and the feeder or
+     *  hook live in the guest; single-exec transports keep the plain
+     *  prompt-file stdin). Absent → the runtime cannot take a message
+     *  mid-turn: every inject answers "unsupported" and the message waits for
+     *  the turn boundary. */
+    midTurnInput?: MidTurnInputSpec;
 }
 export declare class CliAgentRunner implements ModelExecutionContract {
     private readonly sandbox;
@@ -527,15 +705,57 @@ export declare class CliAgentRunner implements ModelExecutionContract {
      *  answers "unsupported" and the caller leaves the message owed. `chain`
      *  serializes appends so each delivery targets a deterministic line count. */
     private turnInject;
+    /** The CURRENT turn's detached-runner wrapper pid (the setsid group
+     *  leader echoed by the launch / recovered from the durable pidfile) —
+     *  durable-transport turns only. Null between turns and on transports
+     *  without a detached guest. See the contract doc (types/runtime.ts). */
+    private turnPid;
+    /** Advisory guest-pid identity for the live turn's runner tree — see the
+     *  contract doc (types/runtime.ts). Never a liveness verdict. */
+    currentRunnerPid(): number | null;
+    /** Safe-to-persist durable byte offset — end of the last line whose
+     *  messages have ALL been yielded (boot-time turn adoption; contract in
+     *  types/runtime.ts). One line behind the parse cursor by design. */
+    private turnConsumedOffset;
+    /** End offset of the line currently being yielded from — promoted to
+     *  `turnConsumedOffset` when the NEXT line is pulled (or at stream end). */
+    private turnPendingLineEnd;
+    currentTurnDurableOffset(): number | null;
     /** Deliver one user message INTO the live turn — see the contract doc
      *  (types/runtime.ts). Appends a stream-input line to the turn's durable
      *  inbox and waits for the in-guest feeder's delivered-counter ack; only
-     *  an acked forward (pre-result, into the CLI's stdin) reports
-     *  "delivered". Guest exit 5 (ack window exhausted with the runner still
-     *  alive — a CLI that is not draining stdin mid-step) reports "pending":
-     *  the appended line may still be read when the current step finishes,
-     *  but it was NOT seen yet. Never throws. */
-    injectUserMessage(text: string): Promise<"delivered" | "pending" | "closed" | "unsupported">;
+     *  an acked forward (pre-result, written into the CLI's stdin pipe)
+     *  reports "delivered", and even then the model reads the line only at
+     *  its next tool boundary (review D8). Guest exit 5 (ack window exhausted
+     *  with the runner still alive: the feeder is not forwarding) reports
+     *  "pending": the appended line may still be forwarded later, but it was
+     *  NOT seen yet. Never throws. */
+    injectUserMessage(text: string, opts?: MidTurnEnvelopeOptions): Promise<"delivered" | "pending" | "closed" | "unsupported">;
+    /** Request an in-band step interrupt of the LIVE turn — the ESC
+     *  equivalent; see the contract doc (types/runtime.ts). Appends the
+     *  spec's interrupt control line to the turn's durable inbox; the guest
+     *  feeder forwards it into the CLI's stdin, whose control layer handles
+     *  it immediately — MID-STEP included, unlike queued user messages (the
+     *  inject "pending" wall applies to turn-loop consumption, not the
+     *  control layer). Only "delivered" means the control line reached the
+     *  CLI's stdin; callers escalate anything else to kill semantics. Never
+     *  throws. */
+    interruptTurn(): Promise<"delivered" | "pending" | "closed" | "unsupported">;
+    /** The one durable append+ack path both mid-turn producers share
+     *  (`injectUserMessage`'s enveloped message line, `interruptTurn`'s raw
+     *  control line). Serialized on the inject chain so every append targets
+     *  a deterministic inbox line count. */
+    private appendTurnStreamLine;
+    /** The most recent probe reading's tool-run pulse (2026-08-29), plus the
+     *  guest clock it was read against — telemetry only, refreshed by each
+     *  `probeTurnLiveness` call. Null between turns / before any probe. */
+    private lastTurnPulse;
+    /** Peek the newest tool-run pulse the durable probe carried — the
+     *  executor's evidence ticker reads it AFTER its liveness check to fan
+     *  the tool-progress fact to clients. Never probes on its own. */
+    peekTurnPulse(): (TurnToolPulse & {
+        guestNowMs: number;
+    }) | null;
     /** Durable three-valued liveness for the current turn — see the contract
      *  doc (types/runtime.ts). Never throws; never blocks past the probe's
      *  explicit exec timeout. */

package/dist/runtimes/claude-code.d.ts

@@ -33,7 +33,7 @@
  *     sessions this is the gateway-minted session virtual key pointed at the
  *     token-metering gateway's Anthropic passthrough (ADR-0039).
  */
-import type { AgentMessageTaskNotification } from "../index.js";
+import type { AgentMessage, AgentMessageCompaction, AgentMessageModelUsage, AgentMessagePlanLimits, AgentMessageTaskNotification, AgentMessageTaskProgress } from "../index.js";
 import { type CliAgentSpec, type CliReasoningEffort } from "./_cli-agent.js";
 /** Pinned Claude Code ACP adapter (Zed's npm shim — `claude` has no native
  *  ACP mode). Pinned EXACT, not a range: the adapter's README warns of
@@ -46,12 +46,54 @@ export declare const CLAUDE_CODE_ACP_ADAPTER = "@zed-industries/claude-code-acp@
  *  is skipped, absent fields stay absent, everything is clamped. Exported
  *  for tests. */
 export declare function parseTaskNotifications(text: string, timestamp: string): AgentMessageTaskNotification[];
+/** One user-role TEXT blob from the stream, mapped with sidechain awareness.
+ *  Task-notification blocks parse into structure wherever they appear (their
+ *  arrival side is resume-dependent — see the transport notes above). What
+ *  remains is then split by attribution: TOP-LEVEL text (no parent id) stays
+ *  unmapped exactly as before — prompt echoes and system reminders are not
+ *  agent output. SIDECHAIN text (parent id present) is a message landing in
+ *  a child subagent's thread — a delivered SendMessage steer — and forwards
+ *  as `subagent_user_message`, except harness plumbing (`<system-reminder>`
+ *  wrappers the CLI injects into child threads), which no renderer should
+ *  see. Exported for tests. */
+export declare function sidechainAwareUserText(text: string, parentToolUseId: string | undefined, timestamp: string): AgentMessage[];
 /** One `system`/`task_notification` stream-json event mapped onto the same
  *  structured message the XML parse produces, or null when the event names
  *  no task id. Pure and tolerant over untrusted harness JSON: absent fields
  *  stay absent, everything is clamped; `output_file` (internal plumbing) is
  *  deliberately not forwarded. Exported for tests. */
 export declare function parseSystemTaskNotification(p: Record<string, unknown>, timestamp: string): AgentMessageTaskNotification | null;
+/** One `system`/`task_progress` event mapped onto the structured progress
+ *  message, or null only when it names no task. Workflow tasks carry the
+ *  cumulative `workflow_progress` entries; a plain background Agent-task
+ *  heartbeat (no workflow entries — verified live on 2.1.241, ~10s cadence
+ *  while the task runs) forwards with `workflow: []` so the platform can
+ *  DECLARE the running task as session background work (the delegation-
+ *  survives-the-human contract: parks, user interrupts, and supersedes all
+ *  read the declared-children registry). Completion evidence still rides
+ *  `task_notification`. Pure and tolerant over untrusted harness JSON:
+ *  malformed entries are skipped, everything is clamped (phases keep the
+ *  FIRST 32 — they are seeded up front; agents keep the LAST 128 — late
+ *  spawns matter more than a long-settled prefix). Exported for tests. */
+export declare function parseSystemTaskProgress(p: Record<string, unknown>, timestamp: string): AgentMessageTaskProgress | null;
+/** One `system` event of the compaction family mapped onto the structured
+ *  lifecycle message, or null when the event is not compaction-shaped (a
+ *  plain `status` event with neither the compacting status nor a
+ *  compact_result stays unmapped). Pure and tolerant over untrusted harness
+ *  JSON. Exported for tests. */
+export declare function parseSystemCompaction(p: Record<string, unknown>, timestamp: string): AgentMessageCompaction | null;
+/** One `rate_limit_event` mapped onto the structured plan-limits message,
+ *  or null when the event names no recognisable status. Pure and tolerant
+ *  over untrusted harness JSON: every field is forwarded only when present
+ *  and well-typed; nothing is defaulted or invented. Exported for tests. */
+export declare function parsePlanLimits(p: Record<string, unknown>, timestamp: string): AgentMessagePlanLimits | null;
+/** The terminal result's per-model report (`result.modelUsage`, keyed by
+ *  the raw model string) mapped onto the protocol's per-model shape, or
+ *  undefined when the result carries none. Counts the harness did not
+ *  report stay absent (the four classes default to 0 only when the entry
+ *  exists at all — an entry IS a report of that model). Pure; exported for
+ *  tests. */
+export declare function parseModelUsage(raw: unknown): Record<string, AgentMessageModelUsage> | undefined;
 /** Claude Code's real reasoning knob is its own `--effort <level>` flag
  *  (low|medium|high|xhigh|max — verified against `claude -p --help`). The
  *  CliReasoningEffort union IS the CLI's vocabulary, so the level rides the
@@ -60,6 +102,53 @@ export declare function parseSystemTaskNotification(p: Record<string, unknown>,
  *  `MAX_THINKING_TOKENS` env mapping is gone: the CLI deprecated it (treated
  *  as on/off on current models) and it could never express xhigh/max. */
 export declare const CLAUDE_CODE_EFFORT_LEVELS: readonly CliReasoningEffort[];
+/** The Bash PreToolUse hook rtk installs for Claude Code (`rtk init -g
+ *  --hook-only` writes exactly this entry — matcher `Bash`, command
+ *  `rtk hook claude` — into ~/.claude/settings.json; the image bakes
+ *  RTK_VERSION, sandbox/baked-clis.ts, which this payload was run against).
+ *  `rtk hook claude` reads the PreToolUse JSON on stdin and, when it has a
+ *  filter for the command, answers with `updatedInput` rewriting `git
+ *  status` to `rtk git status` (ls, find, grep, test runners, bun, curl,
+ *  docker, …), so the model reads rtk's compact output. A command it
+ *  cannot compress — an unknown tool, a pipe into one, command or process
+ *  substitution, a heredoc, a file redirect, anything already prefixed
+ *  `rtk`, or a `RTK_DISABLED=1` prefix — gets no output and exit 0, which
+ *  Claude Code treats as "no decision": the original command runs
+ *  unchanged (all verified against the binary).
+ *
+ *  The wrapper fails OPEN both ways. `command -v` covers images without
+ *  rtk (the devbox, a bare Vercel VM): there a bare `rtk hook claude` would
+ *  fail every Bash call's hook with exit 127 — non-blocking, but a stderr
+ *  warning per call; rtk's own legacy shell hook degraded the same way
+ *  ("binary not found: exit 0"). The trailing `exit 0` covers an rtk that
+ *  cannot answer: Claude Code treats a PreToolUse hook's exit 2 as a BLOCK
+ *  of the tool call with stderr fed to the model, and clap exits 2 with
+ *  its usage for a subcommand it does not know — which is how the codex
+ *  hook (RTK_CODEX_HOOK_COMMAND, codex.ts) blocked every codex shell
+ *  command on 2026-10-03, when the image's rtk was a cache-served 0.45.0.
+ *  rtk's hooks never exit non-zero on purpose, so a non-zero exit is a
+ *  broken rtk, and the compressor must never cost the worker its shell:
+ *  the exit code is dropped, and the smoke gate's rtk-hook-rewrite check
+ *  is what proves the rewrite itself. */
+export declare const RTK_BASH_HOOK_COMMAND = "command -v rtk >/dev/null 2>&1 && rtk hook claude; exit 0";
+/** Settings every platform `claude` launch passes as `--settings` (inline
+ *  JSON). Claude Code MERGES hook entries across its settings sources
+ *  instead of replacing them (user → project → local → flag → managed), so
+ *  this rides beside whatever the machine's own ~/.claude/settings.json
+ *  carries, and nothing is written to that file — the right outcome, since
+ *  the server never owns it: home carry tar-restores it whole across
+ *  machines and the image capture strips it as personal state. */
+export declare const CLAUDE_CODE_PLATFORM_SETTINGS: {
+    readonly hooks: {
+        readonly PreToolUse: readonly [{
+            readonly matcher: "Bash";
+            readonly hooks: readonly [{
+                readonly type: "command";
+                readonly command: "command -v rtk >/dev/null 2>&1 && rtk hook claude; exit 0";
+            }];
+        }];
+    };
+};
 export declare const claudeCodeSpec: CliAgentSpec;
 export interface ClaudeCodeRuntimeConfig {
     /** Claude model id (`--model`). Omit to use the CLI's configured default. */

package/dist/runtimes/claude.d.ts

@@ -1,4 +1,4 @@
-/** Claude Agent SDK runtime — replaces the old Claude CLI subprocess runtime. */
+/** Claude Agent SDK runtime. */
 import { type ThinkingConfig } from "@anthropic-ai/claude-agent-sdk";
 import type { AgentMessage, ModelExecutionContract, RuntimeOptions, SandboxProvider, ToolCallGateResult } from "../index.js";
 import type { ProcessorContext, ToolCall } from "../processors/processor.js";