@animalabs/agent-framework 0.23.0 → 0.23.2

package/dist/src/thinking-token-stamp.d.ts

@@ -4,4 +4,16 @@ import type { ContentBlock } from '@animalabs/membrane';
  * set, every other block is the same object.
  */
 export declare function stampThinkingTokenEstimates(blocks: ContentBlock[], outputTokens: number): ContentBlock[];
+/**
+ * A request's messages with no top-level block carrying `tokenEstimate`. Both
+ * of an agent's request builders call it on the compiled messages: a
+ * framework turn's (`Agent.assembleActivationRequest`) and the direct API's
+ * (`Agent.runInferenceWithInjections`). A block that carries the stamp is
+ * copied without it, and so is the message that holds it. Every other
+ * message and block is passed on as it is, and nothing is changed in place,
+ * so the stored block keeps its stamp.
+ */
+export declare function withoutTokenEstimates<T extends {
+    content: ContentBlock[];
+}>(messages: T[]): T[];
 //# sourceMappingURL=thinking-token-stamp.d.ts.map

package/dist/src/thinking-token-stamp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"thinking-token-stamp.d.ts","sourceRoot":"","sources":["../../src/thinking-token-stamp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAiExD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,YAAY,EAAE,CAyBxG"}
+{"version":3,"file":"thinking-token-stamp.d.ts","sourceRoot":"","sources":["../../src/thinking-token-stamp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAqExD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,YAAY,EAAE,CAyBxG;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,YAAY,EAAE,CAAA;CAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAY/F"}

package/dist/src/thinking-token-stamp.js

@@ -24,9 +24,13 @@
  * the hidden thinking is the bulk of the output, and this stamp is what makes
  * the compiled budget honest (see context-manager `SIGNATURE_CHARS_PER_TOKEN`).
  *
- * Wire safety: membrane's Anthropic formatter builds thinking blocks field
- * by field (`type`, `thinking`, `signature`), so the stamp never reaches the
- * provider; the signature itself is copied, never edited.
+ * Wire safety: the stamp is context-manager's pricing metadata, and no field
+ * a provider takes. The Messages API refuses a block that carries it
+ * ("Extra inputs are not permitted"), and membrane (0.5.87 and 0.6.0) sends a
+ * `redacted_thinking` block to Anthropic and Bedrock with every field it has.
+ * So an agent's request builders drop the stamp from the compiled messages
+ * (`withoutTokenEstimates`), and the stored block, which context-manager
+ * prices, keeps it. The signature itself is copied, never edited.
  */
 const PROSE_CHARS_PER_TOKEN = 2.9;
 const DENSE_CHARS_PER_TOKEN = 2.3;
@@ -100,4 +104,31 @@ export function stampThinkingTokenEstimates(blocks, outputTokens) {
         return { ...block, tokenEstimate };
     });
 }
+/**
+ * A request's messages with no top-level block carrying `tokenEstimate`. Both
+ * of an agent's request builders call it on the compiled messages: a
+ * framework turn's (`Agent.assembleActivationRequest`) and the direct API's
+ * (`Agent.runInferenceWithInjections`). A block that carries the stamp is
+ * copied without it, and so is the message that holds it. Every other
+ * message and block is passed on as it is, and nothing is changed in place,
+ * so the stored block keeps its stamp.
+ */
+export function withoutTokenEstimates(messages) {
+    return messages.map((message) => {
+        if (!message.content.some(isStamped))
+            return message;
+        return {
+            ...message,
+            content: message.content.map((block) => {
+                if (!isStamped(block))
+                    return block;
+                const { tokenEstimate: _stamp, ...unstamped } = block;
+                return unstamped;
+            }),
+        };
+    });
+}
+function isStamped(block) {
+    return typeof block === 'object' && block !== null && 'tokenEstimate' in block;
+}
 //# sourceMappingURL=thinking-token-stamp.js.map

package/dist/src/thinking-token-stamp.js.map

@@ -1 +1 @@
-{"version":3,"file":"thinking-token-stamp.js","sourceRoot":"","sources":["../../src/thinking-token-stamp.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,SAAS,aAAa,CAAC,KAAmB;IACxC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAI,KAAiC,CAAC,SAAS,CAAC;QACzD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB;IACxC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,qBAAqB,CAAC,CAAC;QACtE,KAAK,UAAU,EAAE,CAAC;YAChB,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,CAAC;gBAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,IAAI,GAAG,EAAE,CAAC;YAAC,CAAC;YACtE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,GAAG,EAAE,CAAC;QAC7D,CAAC;QACD,KAAK,UAAU;YACb,qEAAqE;YACrE,uDAAuD;YACvD,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,qBAAqB,CAAC,CAAC;QACzG;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAsB,EAAE,YAAoB;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAEvE,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAI,KAAqC,CAAC,aAAa,CAAC;QACrE,MAAM,CAAC,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,CAAC;YAAE,WAAW,IAAI,CAAC,CAAC;;YACvB,OAAO,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,OAAO,CAAC;IACtD,CAAC;IACD,IAAI,WAAW,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACpC,MAAM,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC;IACxC,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAEjC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,OAAO,GAAI,KAAqC,CAAC,aAAa,CAAC;QACrE,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAkB,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"thinking-token-stamp.js","sourceRoot":"","sources":["../../src/thinking-token-stamp.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,SAAS,aAAa,CAAC,KAAmB;IACxC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAI,KAAiC,CAAC,SAAS,CAAC;QACzD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB;IACxC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,qBAAqB,CAAC,CAAC;QACtE,KAAK,UAAU,EAAE,CAAC;YAChB,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,CAAC;gBAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,IAAI,GAAG,EAAE,CAAC;YAAC,CAAC;YACtE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,GAAG,EAAE,CAAC;QAC7D,CAAC;QACD,KAAK,UAAU;YACb,qEAAqE;YACrE,uDAAuD;YACvD,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,qBAAqB,CAAC,CAAC;QACzG;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAsB,EAAE,YAAoB;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAEvE,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAI,KAAqC,CAAC,aAAa,CAAC;QACrE,MAAM,CAAC,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,CAAC;YAAE,WAAW,IAAI,CAAC,CAAC;;YACvB,OAAO,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,OAAO,CAAC;IACtD,CAAC;IACD,IAAI,WAAW,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACpC,MAAM,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC;IACxC,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAEjC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,OAAO,GAAI,KAAqC,CAAC,aAAa,CAAC;QACrE,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAkB,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAwC,QAAa;IACxF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,OAAO,CAAC;QACrD,OAAO;YACL,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACrC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACpC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,GAAG,KAAmD,CAAC;gBACpG,OAAO,SAAyB,CAAC;YACnC,CAAC,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAmB;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,IAAI,KAAK,CAAC;AACjF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@animalabs/agent-framework",
-  "version": "0.23.0",
+  "version": "0.23.2",
   "description": "Multi-agent framework with pluggable modules, persistent state, and concurrent tool execution",
   "repository": {
     "type": "git",

package/src/agent.ts

@@ -3,6 +3,7 @@ import { isAbortedResponse } from '@animalabs/membrane';
 import { createHash } from 'node:crypto';
 import type { CacheWireReceipt, KvUnifiedRequestHooks } from './kv-unified-wire.js';
 import { ToolResultGuard } from './tool-result-guard.js';
+import { withoutTokenEstimates } from './thinking-token-stamp.js';
 import { assertBooleanSetting, holdsSettings } from './config-checks.js';
 import {
   CONTINUE_ROW,
@@ -1101,8 +1102,11 @@ export class Agent {
     // notice.
     let unguardedResults: ReturnType<Agent['buildToolResultMessages']> | undefined;
     const assemble = async (): Promise<NormalizedRequest> => {
-      const { messages, systemInjections } = await this.toolResultGuard.afterAnnotations(
+      const compiled = await this.toolResultGuard.afterAnnotations(
         () => this.compileWithInjections(budget, injections));
+      const { systemInjections } = compiled;
+      // The framework's own pricing stamp never goes out (thinking-token-stamp.ts).
+      const messages = withoutTokenEstimates(compiled.messages);
       // Read once, after the first compile, since results may have become
       // ready while it ran; the refusal retry, assembled while the agent is
       // inferring, sends the same ones.
@@ -1298,6 +1302,8 @@ export class Agent {
         ),
       }))
       .filter((m) => m.content.length > 0);
+    // The framework's own pricing stamp never goes out (thinking-token-stamp.ts).
+    messages = withoutTokenEstimates(messages);
 
     // Silent heartbeat ticks and replies to a [Continue] turn store no
     // prompt row. Render each request-only turn before its response's first

package/src/framework.ts

@@ -282,6 +282,28 @@ const silenceCauseOf = (calls: Array<{ name: string; input?: unknown }>): 'send'
   return calls.some(isSilencingCall) ? 'send' : null;
 };
 
+/**
+ * The keys of a stored message's metadata that only the host writes and that
+ * some reader takes on its own as what the message is: `system` and `kind`
+ * make it a host notice of that kind, `draftOwner` and `draftIds` one that
+ * names those drafts, `tuneOut` a message a tune-out holds from the
+ * residents, `coalescingSubject` (beside the occurrence's `eventId`) the
+ * delivery of a coalesced occurrence, `deferredWriteId` the landed copy of a
+ * deferred write, `external` a module's own row for an outside message, and
+ * `openaiResponsesItems` membrane's mark of an imported Responses history. A
+ * server's metadata, a channel message's `metadata` or a push event's
+ * `origin`, is stored without them, and the host writes its own after it:
+ * MCPL SPEC §16.6 makes metadata the producer's untrusted claims, which a
+ * host may disbelieve. Keys a server writes by protocol, such as `tags` and
+ * `mentioned`, stay. So do the keys a reader takes only beside one of these:
+ * a failed reply's `reason` and `detail` beside its `kind`, and the Discord
+ * module's `discordTextFirst` on a row it found by `external`.
+ */
+const HOST_METADATA_KEYS = [
+  'system', 'kind', 'draftOwner', 'draftIds', 'tuneOut', 'coalescingSubject', 'deferredWriteId',
+  'external', 'openaiResponsesItems',
+] as const;
+
 /**
  * True when an injected message is real conversational input — something the
  * agent might actually be replying to — rather than ambient machinery.
@@ -10852,9 +10874,9 @@ export class AgentFramework {
           // turn ends. The window stores them here, right after the
           // tool_result message, which is exactly where the membrane appends
           // them in the live conversation — same participant, same content
-          // blocks, same metadata, and compile() emits recent messages
-          // verbatim, so the next turn's compiled prefix byte-matches the
-          // live request (prompt-cache safe).
+          // blocks, and neither carries the row's metadata — and compile()
+          // emits recent messages verbatim, so the next turn's compiled prefix
+          // byte-matches the live request (prompt-cache safe).
           //
           // The queue is drained ONLY at the target agent's own boundary:
           // draining at another agent's boundary would store the messages
@@ -11109,10 +11131,14 @@ export class AgentFramework {
             // Streaming path: convert results and resume the stream.
             // Mid-turn messages collected above ride along as injected user
             // messages (membrane ≥0.5.72) — appended after the tool_result
-            // envelope so the next round of THIS turn hears them.
+            // envelope so the next round of THIS turn hears them. Each goes
+            // as its participant and content alone: a stored row's metadata
+            // is the host's record, not input for membrane.
             currentState.stream.provideToolResults(
               agent.toolResultGuard.submissionResults(membraneResults),
-              midTurnInjections.length > 0 ? { injectedMessages: midTurnInjections } : undefined,
+              midTurnInjections.length > 0
+                ? { injectedMessages: midTurnInjections.map(({ participant, content }) => ({ participant, content })) }
+                : undefined,
             );
             // RFC-006 §3.3: consumption is determined at assembly, and this
             // is assembly too when the stream carries the injected messages
@@ -11313,6 +11339,31 @@ export class AgentFramework {
   // Built-in MCPL event → context message conversion
   // ==========================================================================
 
+  /** The servers and keys whose drop withoutHostKeys has logged, each as
+   *  `${serverId}\u0000${key}`. */
+  private readonly hostKeysDropped = new Set<string>();
+
+  /**
+   * A server's metadata as it is stored: a copy without HOST_METADATA_KEYS.
+   * A server may use one of those names for something of its own, so the
+   * first drop of each key from each server is logged.
+   */
+  private withoutHostKeys(serverId: string, given: Record<string, unknown> | undefined): Record<string, unknown> {
+    const kept: Record<string, unknown> = { ...given };
+    for (const key of HOST_METADATA_KEYS) {
+      if (!Object.hasOwn(kept, key)) continue;
+      delete kept[key];
+      const logged = `${serverId}\u0000${key}`;
+      if (this.hostKeysDropped.has(logged)) continue;
+      this.hostKeysDropped.add(logged);
+      console.error(
+        `[mcpl] ${serverId}: dropped "${key}" from a message, since only the host writes that key ` +
+        `(logged once for each server and key)`,
+      );
+    }
+    return kept;
+  }
+
   /**
    * Convert an incoming MCPL channel message to a context message.
    * This replaces the old MCPLModule.onProcess() message conversion.
@@ -11349,7 +11400,7 @@ export class AgentFramework {
       return undefined;
     }
     const metadata: Record<string, unknown> = {
-      ...event.metadata,
+      ...this.withoutHostKeys(event.serverId, event.metadata),
       ...(event.eventId ? { eventId: event.eventId } : {}),
       ...(event.coalescingSubject ? { coalescingSubject: event.coalescingSubject } : {}),
       channelId: event.channelId,
@@ -12810,7 +12861,7 @@ export class AgentFramework {
     }
 
     const metadata: Record<string, unknown> = {
-      ...event.origin,
+      ...this.withoutHostKeys(event.serverId, event.origin),
       serverId: event.serverId,
       featureSet: event.featureSet,
       eventId: event.eventId,

package/src/thinking-token-stamp.ts

@@ -26,9 +26,13 @@ import type { ContentBlock } from '@animalabs/membrane';
  * the hidden thinking is the bulk of the output, and this stamp is what makes
  * the compiled budget honest (see context-manager `SIGNATURE_CHARS_PER_TOKEN`).
  *
- * Wire safety: membrane's Anthropic formatter builds thinking blocks field
- * by field (`type`, `thinking`, `signature`), so the stamp never reaches the
- * provider; the signature itself is copied, never edited.
+ * Wire safety: the stamp is context-manager's pricing metadata, and no field
+ * a provider takes. The Messages API refuses a block that carries it
+ * ("Extra inputs are not permitted"), and membrane (0.5.87 and 0.6.0) sends a
+ * `redacted_thinking` block to Anthropic and Bedrock with every field it has.
+ * So an agent's request builders drop the stamp from the compiled messages
+ * (`withoutTokenEstimates`), and the stored block, which context-manager
+ * prices, keeps it. The signature itself is copied, never edited.
  */
 const PROSE_CHARS_PER_TOKEN = 2.9;
 const DENSE_CHARS_PER_TOKEN = 2.3;
@@ -93,3 +97,30 @@ export function stampThinkingTokenEstimates(blocks: ContentBlock[], outputTokens
     return { ...block, tokenEstimate } as ContentBlock;
   });
 }
+
+/**
+ * A request's messages with no top-level block carrying `tokenEstimate`. Both
+ * of an agent's request builders call it on the compiled messages: a
+ * framework turn's (`Agent.assembleActivationRequest`) and the direct API's
+ * (`Agent.runInferenceWithInjections`). A block that carries the stamp is
+ * copied without it, and so is the message that holds it. Every other
+ * message and block is passed on as it is, and nothing is changed in place,
+ * so the stored block keeps its stamp.
+ */
+export function withoutTokenEstimates<T extends { content: ContentBlock[] }>(messages: T[]): T[] {
+  return messages.map((message) => {
+    if (!message.content.some(isStamped)) return message;
+    return {
+      ...message,
+      content: message.content.map((block) => {
+        if (!isStamped(block)) return block;
+        const { tokenEstimate: _stamp, ...unstamped } = block as ContentBlock & { tokenEstimate?: unknown };
+        return unstamped as ContentBlock;
+      }),
+    };
+  });
+}
+
+function isStamped(block: ContentBlock): boolean {
+  return typeof block === 'object' && block !== null && 'tokenEstimate' in block;
+}