@agent-native/core 0.132.1 → 0.133.0

package/corpus/core/src/agent/engine/error-detail.ts

@@ -8,9 +8,6 @@
  * `.cause`. Recording `err.message` alone makes every one of them
  * indistinguishable after the fact, which is how a whole class of production
  * failures becomes undiagnosable.
- *
- * Classification (`isConnectionError`, `isRetryableError`) must keep matching
- * on the bare `err.message` — this is for the RECORDED detail only.
  */
 const DEFAULT_MAX_CAUSE_LINKS = 4;
 const MAX_CAUSE_LINK_CHARS = 200;
@@ -37,3 +34,187 @@ export function describeErrorWithCauses(
   }
   return links.length > 0 ? `${head} (cause: ${links.join(" <- ")})` : head;
 }
+
+/**
+ * The single provider-transport-failure classifier. Every layer that decides
+ * "is this a network blip?" — engine error codes, run-level retry, Sentry
+ * suppression — must call THIS, on `describeErrorWithCauses(err)` rather than
+ * on a bare `err.message`.
+ *
+ * Four divergent copies of this predicate existed, and they disagreed on
+ * exactly the string production actually throws. The AI SDK's `RetryError`
+ * reports `"Failed after 2 attempts. Last error: Cannot connect to API: …"`,
+ * so a copy anchored with `startsWith` scored it as unclassified while a copy
+ * using `includes` scored it as retryable. The result was a split brain: the
+ * agent loop retried the turn, but the run persisted `error_code = 'unknown'`,
+ * which the client does not list as auto-recoverable — so a transient TLS
+ * reset ended the user's chat with a dead error instead of resuming. That one
+ * mismatch accounted for ~150 failed production runs in a week.
+ *
+ * Substring matching is deliberate: the real message is always a provider SDK
+ * wrapper around the transport error, never bare, and the wrapper prefix
+ * differs per SDK and per version.
+ */
+export function isProviderConnectionErrorMessage(message: string): boolean {
+  const normalized = message.toLowerCase();
+  return (
+    normalized.includes("connection error") ||
+    normalized.includes("cannot connect to api")
+  );
+}
+
+/** `isProviderConnectionErrorMessage` over an error's full cause chain. */
+export function isProviderConnectionError(err: unknown): boolean {
+  return isProviderConnectionErrorMessage(describeErrorWithCauses(err));
+}
+
+/** Classification fields an AI SDK provider failure carries. */
+export interface ProviderErrorClassification {
+  errorCode?: string;
+  statusCode?: number;
+  providerRetryable?: boolean;
+}
+
+/**
+ * Classify a provider error from the AI SDK, whichever way it surfaced.
+ *
+ * `streamText` does not throw for a failed provider request — it emits an
+ * `error` part on `fullStream` — so there are two arrival paths, and only the
+ * thrown one used to be classified. The stream-part path discarded
+ * `statusCode`, `errorCode`, and `isRetryable` entirely, which is why every
+ * provider HTTP failure on an ai-sdk engine landed as `unknown`: a 429 was only
+ * retried if its prose happened to contain "rate_limit", and a
+ * 100%-reproducible config 400 was indistinguishable from any other unclassified
+ * failure, so it had no signature to alert on. Both call sites go through here.
+ *
+ * `timedOut` is the caller's own first-event deadline, which only the streaming
+ * path can know.
+ */
+export function classifyProviderError(
+  err: unknown,
+  timedOut = false,
+): ProviderErrorClassification {
+  // The AI SDK wraps exhausted retries in RetryError and keeps the final
+  // APICallError on `lastError`.
+  const wrapped = err as { lastError?: unknown } | null;
+  const providerError = (
+    wrapped?.lastError instanceof Error ? wrapped.lastError : err
+  ) as {
+    statusCode?: unknown;
+    isRetryable?: unknown;
+    message?: unknown;
+  } | null;
+
+  const statusCode =
+    typeof providerError?.statusCode === "number"
+      ? providerError.statusCode
+      : undefined;
+
+  // Classify on the cause chain of the ORIGINAL error, not the unwrapped one:
+  // when RetryError does not expose `lastError` as an Error the unwrap falls
+  // back to the wrapper, whose message ("Failed after 2 attempts. Last error:
+  // …") only *embeds* the transport failure. Matching the wrapper is the point.
+  const described = describeErrorWithCauses(err);
+  const isConnectionError =
+    !timedOut &&
+    statusCode === undefined &&
+    (isProviderConnectionErrorMessage(described) ||
+      isProviderConnectionErrorMessage(
+        typeof providerError?.message === "string"
+          ? providerError.message
+          : String(providerError),
+      ));
+
+  const providerRetryable =
+    typeof providerError?.isRetryable === "boolean"
+      ? providerError.isRetryable
+      : isConnectionError || timedOut
+        ? true
+        : undefined;
+
+  return {
+    // Tag every known status as `http_<status>` (not just 401) so a rate limit
+    // surfaces as `http_429`: the structured statusCode drives turn-level
+    // retries, but run-level continuation keys off the errorCode.
+    ...(statusCode !== undefined
+      ? { errorCode: `http_${statusCode}`, statusCode }
+      : isConnectionError || timedOut
+        ? { errorCode: "provider_network_error" }
+        : // Nothing structured — fall back to reading the message, so a
+          // stream-part 529/timeout is not silently unclassified.
+          (() => {
+            const code = classifyTerminalErrorCode(described);
+            return code ? { errorCode: code } : {};
+          })()),
+    ...(providerRetryable !== undefined ? { providerRetryable } : {}),
+  };
+}
+
+/**
+ * Last-resort error code for a terminal error that reached persistence with no
+ * structured code. Persisting `"unknown"` is not a neutral default: the client
+ * auto-recovers a fixed list of transport codes, so an unclassified transient
+ * blip ends the user's chat while the identical failure carrying its real code
+ * resumes. Over four days that gap was 28% of ALL production chat turns.
+ *
+ * The invariant is NOT "only transport failures may be named". It is: a code
+ * returned here must be absent from the client's recoverable list unless a
+ * fresh attempt genuinely helps. Naming a deterministic failure is what stops
+ * it from reaching the user as raw provider text and hiding inside `unknown`;
+ * naming it *recoverable* is what buys a retry spiral. Those are different
+ * decisions, and `error-detail.spec.ts` asserts the deterministic codes below
+ * stay non-recoverable.
+ */
+export function classifyTerminalErrorCode(
+  message: string | undefined,
+): string | undefined {
+  if (!message) return undefined;
+  const msg = message.toLowerCase();
+  if (isProviderConnectionErrorMessage(msg)) return "provider_network_error";
+  // Word-bounded: request ids and hashes routinely contain a bare "529".
+  if (msg.includes("overloaded") || /\b529\b/.test(msg)) {
+    return "overloaded_error";
+  }
+  if (msg.includes("too many requests") || /\b429\b/.test(msg)) {
+    return "http_429";
+  }
+  if (
+    msg.includes("timed out") ||
+    msg.includes("timeout") ||
+    msg.includes("too much time has passed without sending any data")
+  ) {
+    return "timeout";
+  }
+  if (msg.includes("stream ended without a stop event")) {
+    return "builder_gateway_network_error";
+  }
+  // Deterministic below this line — named so they stop landing in `unknown`,
+  // never retried. Both were measured against the 13 prod app DBs over
+  // 2026-07-24..31: 27 turns/week and 14 turns/week respectively, each with
+  // exactly 1.00 runs/turn, i.e. the chat died on the first attempt showing
+  // the raw provider sentence.
+  //
+  // The request side already avoids emitting reasoning_effort alongside tools
+  // (see ai-sdk-engine.ts). This classifies the failure for the paths that
+  // still reach the provider — another gateway, a stale deploy — so it reads
+  // as a configuration problem rather than a mystery.
+  if (
+    msg.includes("reasoning_effort are not supported") ||
+    msg.includes("reasoning_effort to 'none'") ||
+    (msg.includes("reasoning_effort") &&
+      (msg.includes("tools") || msg.includes("function")))
+  ) {
+    return "provider_config_error";
+  }
+  if (msg.includes("missing authentication header") || msg === "unauthorized") {
+    return "authentication_error";
+  }
+  if (
+    /(?:err_)?ssl|tlsv?\d|tls handshake|ssl routines|econnreset|econnrefused|und_err_socket|socket hang up/i.test(
+      message,
+    )
+  ) {
+    return "provider_network_error";
+  }
+  return undefined;
+}

package/corpus/core/src/agent/engine/failure-taxonomy.ts

@@ -0,0 +1,123 @@
+import { classifyTerminalErrorCode } from "./error-detail.js";
+
+export const AGENT_FAILURE_TAXONOMY_CODES = [
+  "provider_network_error",
+  "provider_config_error",
+  "overloaded_error",
+  "authentication_error",
+  "unknown",
+] as const;
+
+export type AgentFailureTaxonomyCode =
+  (typeof AGENT_FAILURE_TAXONOMY_CODES)[number];
+
+export type AgentFailureRegime = "interactive" | "scheduled";
+
+export interface AgentFailureTaxonomy {
+  code: AgentFailureTaxonomyCode;
+  label: string;
+  regime: AgentFailureRegime;
+  source: "error_code" | "error_detail" | "unknown";
+}
+
+const LABELS: Record<AgentFailureTaxonomyCode, string> = {
+  provider_network_error: "SSL/TLS provider transport drop",
+  provider_config_error: "Model reasoning_effort with tools",
+  overloaded_error: "Provider overloaded_error",
+  authentication_error: "Missing provider authentication",
+  unknown: "Unclassified failure",
+};
+
+function knownCode(value: unknown): AgentFailureTaxonomyCode | undefined {
+  const normalized =
+    typeof value === "string" ? value.trim().toLowerCase() : "";
+  if (
+    normalized === "provider_network_error" ||
+    normalized === "connection_error" ||
+    normalized === "network_error" ||
+    normalized === "ssl_error" ||
+    normalized === "tls_error"
+  ) {
+    return "provider_network_error";
+  }
+  if (
+    normalized === "provider_config_error" ||
+    normalized === "reasoning_effort_tools"
+  ) {
+    return "provider_config_error";
+  }
+  if (
+    normalized === "overloaded_error" ||
+    normalized === "provider_overloaded"
+  ) {
+    return "overloaded_error";
+  }
+  if (
+    normalized === "authentication_error" ||
+    normalized === "missing_authentication_header" ||
+    normalized === "http_401" ||
+    normalized === "unauthorized"
+  ) {
+    return "authentication_error";
+  }
+  return undefined;
+}
+
+/**
+ * Classify the production failure families used by the Factory triage queue.
+ * The regime is deliberately derived from the durable run id, not inferred
+ * from prose: scheduled runs use the `job-` namespace and interactive runs do
+ * not. This keeps a healthy chat sample from hiding a scheduled outage.
+ */
+export function classifyAgentFailure(input: {
+  runId?: unknown;
+  errorCode?: unknown;
+  errorDetail?: unknown;
+  terminalReason?: unknown;
+  terminalEvent?: unknown;
+  regime?: AgentFailureRegime;
+}): AgentFailureTaxonomy {
+  const regime =
+    input.regime ??
+    (typeof input.runId === "string" && input.runId.startsWith("job-")
+      ? "scheduled"
+      : "interactive");
+  const explicit = knownCode(input.errorCode);
+  if (explicit) {
+    return {
+      code: explicit,
+      label: LABELS[explicit],
+      regime,
+      source: "error_code",
+    };
+  }
+
+  const evidence = [
+    input.errorCode,
+    input.errorDetail,
+    input.terminalReason,
+    input.terminalEvent,
+  ].filter((value) => value !== undefined && value !== null);
+  for (const value of evidence) {
+    const text =
+      typeof value === "string"
+        ? value
+        : (JSON.stringify(value) ?? String(value));
+    const classified = knownCode(classifyTerminalErrorCode(text));
+    if (classified) {
+      return {
+        code: classified,
+        label: LABELS[classified],
+        regime,
+        source: "error_detail",
+      };
+    }
+  }
+
+  return {
+    code: "unknown",
+    label: LABELS.unknown,
+    regime,
+    source: "unknown",
+  };
+}

package/corpus/core/src/agent/engine/index.ts

@@ -25,6 +25,7 @@ export {
   getConfiguredEngineNameForRequest,
   getStoredModelForEngine,
   normalizeModelForEngine,
+  resolveDelegatedRunModel,
   resolveEnginePreservesCustomModels,
   type NormalizeModelOptions,
   detectEngineFromEnv,
@@ -54,3 +55,10 @@ export {
 } from "./anthropic-engine.js";
 export { createAISDKEngine, type AISDKProvider } from "./ai-sdk-engine.js";
 export { registerBuiltinEngines } from "./builtin.js";
+export {
+  AGENT_FAILURE_TAXONOMY_CODES,
+  classifyAgentFailure,
+  type AgentFailureRegime,
+  type AgentFailureTaxonomy,
+  type AgentFailureTaxonomyCode,
+} from "./failure-taxonomy.js";

package/corpus/core/src/agent/engine/registry.ts

@@ -13,6 +13,7 @@ import { createRequire } from "node:module";
 import {
   assertCredentialStoreReadable,
   canUseDeployCredentialFallbackForRequest,
+  getBuilderCredentialAuthFailure,
   getProviderCredentialAuthFailure,
   readDeployCredentialEnv,
   resolveBuilderCredentialsDetailed,
@@ -272,6 +273,70 @@ export function normalizeModelForEngine(
   );
 }
 
+type ModelResolvableEngine = Pick<
+  AgentEngine,
+  "name" | "defaultModel" | "supportedModels" | "preserveCustomModels"
+>;
+
+/**
+ * Bound an untrusted, caller-supplied model preference to this engine's own
+ * catalog. Returns `undefined` — never a substitute — when the hint names
+ * anything the engine does not already offer, so a peer can never move the run
+ * to a different provider, an unknown id, or a capability tier this engine was
+ * not going to serve on its own.
+ */
+function resolveModelHintForEngine(
+  engine: ModelResolvableEngine,
+  hint: string | null | undefined,
+): string | undefined {
+  const candidate = typeof hint === "string" ? hint.trim() : "";
+  if (!candidate || candidate === "auto") return undefined;
+  // An engine with no catalog, or one that passes custom ids through verbatim
+  // (an OpenAI-compatible gateway), cannot prove membership — so it takes no
+  // hint at all rather than forwarding an unverifiable id to a provider.
+  if (engine.preserveCustomModels || engine.supportedModels.length === 0) {
+    return undefined;
+  }
+  const normalized = normalizeModelForEngine(engine, candidate);
+  // `normalizeModelForEngine` answers `defaultModel` both for "this IS the
+  // default" and for "no idea what this is", so an unmatched hint is only
+  // distinguishable by re-checking the raw candidate. Anything else it returns
+  // is a real catalog hit.
+  const matched =
+    normalized === engine.defaultModel
+      ? engine.supportedModels.includes(candidate)
+      : engine.supportedModels.includes(normalized);
+  return matched ? normalized : undefined;
+}
+
+/**
+ * Model for a delegated (A2A) run, in strict precedence: the receiving app's
+ * explicit configuration, then its own stored setting, then the caller's hint,
+ * then the engine default. An app that pins a model keeps it; a hint only fills
+ * the gap where the receiver would otherwise take a default it never chose.
+ *
+ * A rejected hint is logged and dropped — a delegated run must never fail over
+ * a preference.
+ */
+export function resolveDelegatedRunModel(
+  engine: ModelResolvableEngine,
+  options: {
+    explicitModel?: string | null;
+    storedModel?: string | null;
+    callerModelHint?: string | null;
+  },
+): string {
+  const own = options.explicitModel ?? options.storedModel;
+  if (own) return normalizeModelForEngine(engine, own);
+  const hinted = resolveModelHintForEngine(engine, options.callerModelHint);
+  if (!hinted && options.callerModelHint) {
+    console.log(
+      `[a2a] Ignoring caller model hint "${options.callerModelHint}" — not offered by engine ${engine.name}`,
+    );
+  }
+  return normalizeModelForEngine(engine, hinted ?? engine.defaultModel);
+}
+
 /**
  * Whether models saved or read for this engine ENTRY should be preserved
  * verbatim instead of normalized against the built-in catalog.
@@ -360,10 +425,7 @@ export function detectEngineFromEnv(): AgentEngineEntry | null {
   return null;
 }
 
-async function envKeyUsableForEntry(
-  entry: AgentEngineEntry,
-  key: string,
-): Promise<boolean> {
+async function envKeyUsableForEntry(key: string): Promise<boolean> {
   if (
     !(
       canUseDeployCredentialFallbackForRequest(key) &&
@@ -372,19 +434,41 @@ async function envKeyUsableForEntry(
   ) {
     return false;
   }
-  if (entry.name === "builder") {
-    return true;
-  }
   const value = readDeployCredentialEnv(key);
   if (!value) return false;
   return !(await getProviderCredentialAuthFailure({ key, value }));
 }
 
+/**
+ * Builder's deploy-env fallback is checked as a pair, not per-key: the
+ * auth-failure marker is fingerprinted from privateKey+publicKey together
+ * (see `builderCredentialFingerprint`), so a single-key lookup can never
+ * match it. Without this, a rejected deploy-level Builder key would keep
+ * reporting "usable" through this env-only path forever — the same class of
+ * bug as the per-scope check in `credential-provider.ts`'s
+ * `isCompleteBuilderConnection`.
+ */
+async function hasUsableBuilderEnvKeys(): Promise<boolean> {
+  const privateKey = canUseDeployCredentialFallbackForRequest(
+    "BUILDER_PRIVATE_KEY",
+  )
+    ? readDeployCredentialEnv("BUILDER_PRIVATE_KEY")
+    : null;
+  const publicKey = canUseDeployCredentialFallbackForRequest(
+    "BUILDER_PUBLIC_KEY",
+  )
+    ? readDeployCredentialEnv("BUILDER_PUBLIC_KEY")
+    : null;
+  if (!privateKey || !publicKey) return false;
+  return !(await getBuilderCredentialAuthFailure({ privateKey, publicKey }));
+}
+
 async function hasUsableEnvKeys(entry: AgentEngineEntry): Promise<boolean> {
   if (!isAgentEnginePackageInstalled(entry)) return false;
   if (entry.requiredEnvVars.length === 0) return false;
+  if (entry.name === "builder") return hasUsableBuilderEnvKeys();
   for (const key of entry.requiredEnvVars) {
-    if (!(await envKeyUsableForEntry(entry, key))) return false;
+    if (!(await envKeyUsableForEntry(key))) return false;
   }
   return true;
 }

package/corpus/core/src/agent/engine/translate-ai-sdk.ts

@@ -7,6 +7,10 @@
  * `ModelMessage` shapes.
  */
 
+import {
+  classifyProviderError,
+  describeErrorWithCauses,
+} from "./error-detail.js";
 import { backfillEngineMessagesToolResults } from "./translate-anthropic.js";
 import type {
   EngineTool,
@@ -294,11 +298,22 @@ export function aiSdkPartToEngineEvents(part: any): EngineEvent[] {
     case "error": {
       const errMsg =
         part.error instanceof Error
-          ? part.error.message
+          ? describeErrorWithCauses(part.error)
           : typeof part.error === "string"
             ? part.error
             : JSON.stringify(part.error);
-      events.push({ type: "stop", reason: "error", error: errMsg });
+      // `streamText` reports a failed provider request as a stream part rather
+      // than a throw, so this is the arrival path for most provider HTTP
+      // failures. It used to emit the message alone, discarding the
+      // APICallError's statusCode/isRetryable — which is why they all landed as
+      // `unknown` and were retried only if their prose happened to match a
+      // keyword. Same classifier as the thrown path in ai-sdk-engine.ts.
+      events.push({
+        type: "stop",
+        reason: "error",
+        error: errMsg,
+        ...classifyProviderError(part.error),
+      });
       break;
     }
 

package/corpus/core/src/agent/production-agent.ts

@@ -84,6 +84,7 @@ import {
   LLM_MISSING_CREDENTIALS_MESSAGE,
   userFacingLlmCredentialError,
 } from "./engine/credential-errors.js";
+import { isProviderConnectionErrorMessage } from "./engine/error-detail.js";
 import {
   resolveEngine,
   registerBuiltinEngines,
@@ -1312,7 +1313,7 @@ export function isRetryableError(err: unknown): boolean {
     msg.includes("gateway error") ||
     msg.includes("socket hang up") ||
     msg.includes("connection reset") ||
-    hasProviderConnectionErrorMessage(msg) ||
+    isProviderConnectionErrorMessage(msg) ||
     msg.includes("too many requests") ||
     msg.includes("timeout") ||
     msg.includes("gateway timeout") ||
@@ -1321,17 +1322,6 @@ export function isRetryableError(err: unknown): boolean {
   );
 }
 
-function hasProviderConnectionErrorMessage(message: string): boolean {
-  const normalized = message.toLowerCase();
-  // Anthropic's APIConnectionError uses "Connection error."; AI SDK wraps
-  // OpenAI TLS failures as "Cannot connect to API". Both can cross a worker
-  // boundary without their structured EngineError metadata.
-  return (
-    normalized.includes("connection error") ||
-    normalized.includes("cannot connect to api")
-  );
-}
-
 // ---------------------------------------------------------------------------
 // Context-window overflow recovery
 // ---------------------------------------------------------------------------
@@ -2264,7 +2254,7 @@ export function isResumableEngineError(err: unknown): boolean {
     text.includes("econnaborted") ||
     text.includes("fetch failed") ||
     text.includes("network error") ||
-    hasProviderConnectionErrorMessage(text) ||
+    isProviderConnectionErrorMessage(text) ||
     text.includes("connection reset") ||
     text.includes("connection closed") ||
     text.includes("stream closed") ||
@@ -6104,7 +6094,7 @@ function isRecoverableContinuationError(event: {
     code === "http_529" ||
     code === "run_timeout" ||
     message.includes("timeout") ||
-    hasProviderConnectionErrorMessage(message) ||
+    isProviderConnectionErrorMessage(message) ||
     message.includes("temporarily unavailable")
   );
 }
@@ -6432,7 +6422,7 @@ export async function runAgentLoopWithMainChatInternalContinuations(
       type: "error",
       error: RUN_BUDGET_EXHAUSTED_MESSAGE,
       errorCode: RUN_BUDGET_EXHAUSTED_ERROR_CODE,
-      recoverable: true,
+      recoverable: false,
     });
   }
   return usage;
@@ -6661,9 +6651,9 @@ export async function claimBackgroundWorkerRunEarly(opts: {
       .join(" "),
   ).catch(() => {});
 
-  // A failed durable abort read is fail-closed: never let a worker execute
-  // after cancellation just because the database was temporarily unreadable.
-  if (await turnAborted(threadId, turnId).catch(() => true)) {
+  // A failed durable abort read must surface as infrastructure failure. It is
+  // not evidence that the user stopped the turn.
+  if (await turnAborted(threadId, turnId)) {
     await abortRun(opts.runId, "user").catch(() => {});
     return { claimed: false, skipped: "turn-aborted" };
   }
@@ -6674,7 +6664,7 @@ export async function claimBackgroundWorkerRunEarly(opts: {
     }).catch(() => {});
   }
 
-  if (await turnAborted(threadId, turnId).catch(() => true)) {
+  if (await turnAborted(threadId, turnId)) {
     await abortRun(opts.runId, "user").catch(() => {});
     return { claimed: false, skipped: "turn-aborted" };
   }
@@ -6687,7 +6677,7 @@ export async function claimBackgroundWorkerRunEarly(opts: {
 
   await record(opts.runId, RUN_DIAG_STAGE.workerClaimed).catch(() => {});
   await heartbeat(opts.runId).catch(() => {});
-  if (await turnAborted(threadId, turnId).catch(() => true)) {
+  if (await turnAborted(threadId, turnId)) {
     await abortRun(opts.runId, "user").catch(() => {});
     return { claimed: false, skipped: "turn-aborted" };
   }
@@ -7143,11 +7133,7 @@ export async function chainServerDrivenContinuation(opts: {
   };
   delete continuationBody[AGENT_CHAT_BACKGROUND_RUN_FIELD];
   try {
-    if (
-      await d
-        .isTurnAborted(effectiveThreadId, effectiveTurnId)
-        .catch(() => true)
-    ) {
+    if (await d.isTurnAborted(effectiveThreadId, effectiveTurnId)) {
       await d.markRunAborted(runId, "user").catch(() => {});
       return;
     }
@@ -7196,11 +7182,7 @@ export async function chainServerDrivenContinuation(opts: {
         insertErr instanceof Error ? insertErr.message : insertErr,
       );
     }
-    if (
-      await d
-        .isTurnAborted(effectiveThreadId, effectiveTurnId)
-        .catch(() => true)
-    ) {
+    if (await d.isTurnAborted(effectiveThreadId, effectiveTurnId)) {
       if (nextRowInserted)
         await d.markRunAborted(nextRunId, "user").catch(() => {});
       await d.markRunAborted(runId, "user").catch(() => {});
@@ -8376,9 +8358,7 @@ export function createProductionAgentHandler(
           : runId;
     if (
       isBackgroundWorker &&
-      (await isTurnAborted(effectiveThreadId, effectiveTurnId).catch(
-        () => true,
-      ))
+      (await isTurnAborted(effectiveThreadId, effectiveTurnId))
     ) {
       await markRunAborted(runId, "user").catch(() => {});
       return { ok: true, stopped: true };

package/corpus/core/src/agent/run-loop-with-resume.ts

@@ -605,7 +605,7 @@ export async function runAgentLoopDirectWithSoftTimeout(
       type: "error",
       error: RUN_BUDGET_EXHAUSTED_MESSAGE,
       errorCode: RUN_BUDGET_EXHAUSTED_ERROR_CODE,
-      recoverable: true,
+      recoverable: false,
     });
     reportFinalOutcome({
       state: "failed",