@arnilo/prism 0.0.15 → 0.0.17

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## [0.0.17] - 2026-07-29
+
+### Added
+- Extension lifecycle: `ExtensionKernel.load()` returns `LoadedExtension[]` dispose handles; contribution/provider/model registries gain `unregister(...)`; a failed `setup` unwinds its partial registrations.
+- `MemoryCredentialStoreOptions.allowProviderFallback` for strict provider-scoped credential resolution; `createMemoryCheckpointStore` `maxRecords`/`maxValueBytes` bounds; `ShellToolOptions.envAllowlist` (coding-agent); `ErrorInfo.retryAfterMs` plus `retryAfterMs`-aware `createDefaultRetryPolicy` with `jitter`/`random` options; guardrail `steer_rejected` event; `httpStatusError` provider transport helper wired into anthropic, google, kimi, openai, opencode-go, and the shared OpenAI-compatible transport.
+
+### Changed
+- Durable runs: run-state load now bounds against the 1 MiB hard cap (states saved with a raised `maxStateBytes` resume correctly); agent fingerprint also covers instructions, system-prompt contributions, and skills; resume-after-interrupt is explicit implicit-approval.
+- Retry/backpressure: HTTP provider errors carry numeric codes and `Retry-After` hints; default retry policy applies ±25% jitter.
+- `input_assembly` middleware runs unconditionally (both plain and context-budget paths, any `InputBuilder`); memory session store rejects cross-session `expectedParentId`; context-budget eviction is O(n) instead of O(n²).
+- Guardrails: `interrupt` errors name the stage; `guardrail_failed` records carry the underlying error message in `metadata.error`; steer `block`/`tripwire` drops the message and emits `steer_rejected` instead of failing the run.
+- Default prompt builder omits the `Available tools:` text for tool-capable models (`capabilities.tools === true`).
+- Middleware registry throws on double `next()` and diagnoses conflicting `next(v)` + return; event multiplexer keeps sorted delivery while a consumer is parked; batched run-ledger dead counters removed.
+
+### Breaking (minor, pre-1.0)
+- CLI: `--config`, `--resource`, `--extension`, `--tool` are rejected (`<flag> is not supported in this build`); the dead `CliOptions.config/resources/extensions/tools` fields are removed.
+- `ExtensionKernel.load()` resolves to `LoadedExtension[]` instead of `void`.
+
+See [docs/migration.md](docs/migration.md) for the full 0.0.16 → 0.0.17 notes.
+
+## [0.0.16] - 2026-07-26
+
+### Added
+- Phase 11 simplification/readiness: new public export `resolveRedactor` from `@arnilo/prism` (single survivor of four private copies across evals/memory/rag/workflows) and a new internal `@arnilo/prism-session-store-codecs` package (shared SQLite/Postgres row codecs, not enrolled in any profile family), bringing the exact graph to **44 publishable manifests**.
+- Offline pre-publish release gates: `npm run release:gate` (API-surface `.d.ts` diff vs `scripts/compat-baseline/`, tarball deny-list, exact version ranges), wired into `npm run sdk:ready`.
+- Performance budgets in `scripts/budgets.json`, enforced by `scripts/budget-gate.test.mjs` (in `npm test`) and `scripts/benchmark-0.0.16.mjs`.
+
+### Changed
+- Dropped historical `docs/review-coverage-*.md` from the root tarball (11 files, ~283 KB): packed size 659,478 → ≈575,680 bytes, 281 → 270 files.
+- All six profiles (`prism-all`, `prism-base`, `prism-code`, `prism-compaction`, `prism-providers`, `prism-sdk`) retained on adoption evidence; zero retirements. No runtime behavior changes.
+
 ## [0.0.15] - 2026-07-26
 
 ### Added

package/dist/agent-definitions.js

@@ -1,5 +1,5 @@
 import { createAgent } from "./agents.js";
-import { resolveActiveSkills, createSkillRegistry } from "./skills.js";
+import { createSkillRegistry, resolveActiveSkills } from "./skills.js";
 import { createToolRegistry } from "./tools.js";
 /** Resolve an {@link AgentDefinition} into a runnable {@link Agent}.
  *
@@ -96,8 +96,7 @@ function hasList(value) {
     return typeof value === "object" && value !== null && "list" in value && typeof value.list === "function";
 }
 function resolveSkills(names, tools, context) {
-    const registry = context.skillsRegistry ??
-        (context.registries?.skills ? createSkillRegistry(context.registries.skills.list()) : undefined);
+    const registry = context.skillsRegistry ?? (context.registries?.skills ? createSkillRegistry(context.registries.skills.list()) : undefined);
     if (!names && !context.activateAllCapabilities)
         return undefined;
     if (!registry) {

package/dist/agent-loops.js

@@ -1,5 +1,5 @@
-import { inputMessages } from "./input.js";
 import { createId } from "./ids.js";
+import { inputMessages } from "./input.js";
 import { artifactStructuredOutputRequest, withoutStructuredOutput } from "./structured-output.js";
 function throwIfAborted(signal) {
     if (signal.aborted)
@@ -8,7 +8,10 @@ function throwIfAborted(signal) {
 function toolResultMessage(result) {
     return {
         role: "tool",
-        content: [{ type: "tool_result", toolCallId: result.toolCallId, name: result.name, result: result.value, error: result.error }, ...(result.content ?? [])],
+        content: [
+            { type: "tool_result", toolCallId: result.toolCallId, name: result.name, result: result.value, error: result.error },
+            ...(result.content ?? []),
+        ],
         metadata: result.metadata,
     };
 }
@@ -121,7 +124,11 @@ export function generateValidateReviseLoop(opts) {
                         continue;
                     }
                     if (toolRounds >= ctx.maxToolRounds) {
-                        const result = { ok: false, errors: [{ message: "maximum tool rounds exceeded" }], metadata: { reason: "tool_round_limit" } };
+                        const result = {
+                            ok: false,
+                            errors: [{ message: "maximum tool rounds exceeded" }],
+                            metadata: { reason: "tool_round_limit" },
+                        };
                         ctx.emit({ type: "artifact_failed", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt: attempts + 1, result });
                         return usage;
                     }
@@ -166,7 +173,7 @@ export function generateValidateReviseLoop(opts) {
                     : undefined;
                 const attempt = ++attempts;
                 ctx.emit({ type: "artifact_validation_started", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt });
-                const result = parseFailure ?? await opts.validator(parsed.value, artifactCtx);
+                const result = parseFailure ?? (await opts.validator(parsed.value, artifactCtx));
                 ctx.emit({ type: "artifact_validation_finished", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt, result });
                 if (result.ok) {
                     ctx.emit({ type: "artifact_finished", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt, result });
@@ -213,9 +220,7 @@ export async function dispatchToolCallsInOrder(calls, ctx) {
     if (calls.length === 0)
         return;
     ctx.chargeToolRound?.(calls);
-    const concurrency = calls.some((call) => ctx.isToolCallExclusive?.(call))
-        ? 1
-        : Math.max(1, Math.min(ctx.toolConcurrency, calls.length));
+    const concurrency = calls.some((call) => ctx.isToolCallExclusive?.(call)) ? 1 : Math.max(1, Math.min(ctx.toolConcurrency, calls.length));
     if (concurrency === 1) {
         for (const call of calls) {
             const result = await ctx.dispatchToolCall(call);

package/dist/agent-run-lifecycle.d.ts

@@ -1,5 +1,4 @@
-import type { Agent, AgentEvent, AgentRunRef, AgentRunResult, AgentRunResume, AgentRunStatusResult, OwnershipScope, SubscribeOptions } from "./contracts.js";
-import type { CheckpointStore } from "./contracts.js";
+import type { Agent, AgentEvent, AgentRunRef, AgentRunResult, AgentRunResume, AgentRunStatusResult, CheckpointStore, OwnershipScope, SubscribeOptions } from "./contracts.js";
 export interface AgentRunLifecycleAgent {
     readonly agent: Agent;
     /** Current host-authored revision; it must match the stored revision. */

package/dist/agent-run-lifecycle.js

@@ -1,6 +1,6 @@
-import { AgentRunStateError } from "./contracts.js";
 import { loadAgentRunState, publicState } from "./agent-run-state.js";
 import { resumeAgentRun, resumeAgentRunStream } from "./agents.js";
+import { AgentRunStateError } from "./contracts.js";
 function assertAgentId(actual, expected) {
     if (expected !== undefined && actual !== expected)
         throw new AgentRunStateError("Agent run capability mismatch");

package/dist/agent-run-state.js

@@ -9,19 +9,30 @@ const MAX_PROPERTIES = 256;
 export function agentFingerprint(agent, revision) {
     const config = agent.config;
     const tools = !config.tools ? [] : "list" in config.tools ? config.tools.list() : config.tools;
+    const skills = !config.skills ? [] : "list" in config.skills ? config.skills.list() : config.skills;
     const guardrails = [
         ...(config.guardrails?.input ?? []),
         ...(config.guardrails?.output ?? []),
         ...(config.guardrails?.toolInput ?? []),
         ...(config.guardrails?.toolOutput ?? []),
     ];
+    const systemPrompt = config.systemPrompt === false || config.systemPrompt === undefined
+        ? (config.systemPrompt ?? null)
+        : (Array.isArray(config.systemPrompt) ? config.systemPrompt : [config.systemPrompt]).map((c) => ({ id: c.id, text: c.text }));
     const value = JSON.stringify({
         id: config.id ?? config.name ?? "agent",
         revision,
         model: config.model,
+        // Instructions/prompt text shapes agent behavior as much as the tool set; a change
+        // without a definitionRevision bump must not resume stale durable runs silently.
+        instructions: config.instructions ?? null,
+        systemPrompt,
+        skills: skills.map((skill) => ({ name: skill.name, instructions: skill.instructions, toolNames: skill.toolNames })),
         tools: tools.map((tool) => ({ name: tool.name, parameters: tool.parameters, exclusive: tool.exclusive })),
         guardrails: guardrails.map((guardrail) => ({ name: guardrail.name, stage: guardrail.stage, revision: guardrail.revision })),
-        loop: typeof config.loop === "object" && config.loop && "strategy" in config.loop ? config.loop.strategy : config.loop?.name ?? "single-shot",
+        loop: typeof config.loop === "object" && config.loop && "strategy" in config.loop
+            ? config.loop.strategy
+            : (config.loop?.name ?? "single-shot"),
     });
     return createHash("sha256").update(value).digest("hex");
 }
@@ -43,7 +54,10 @@ export async function loadAgentRunState(checkpoints, ref, ownership) {
     const record = await checkpoints.loadCheckpoint({ namespace: AGENT_RUN_STATE_NAMESPACE, key: ref.runId, ...ownership });
     if (!record)
         throw new AgentRunStateError(`No durable agent run ${ref.runId}`);
-    if (ref.sessionId && record.value && typeof record.value === "object" && record.value.sessionId !== ref.sessionId) {
+    if (ref.sessionId &&
+        record.value &&
+        typeof record.value === "object" &&
+        record.value.sessionId !== ref.sessionId) {
         throw new AgentRunStateError("Agent run session mismatch");
     }
     return { record, state: parseAgentRunState(record.value, record.version) };
@@ -95,10 +109,21 @@ export function parseAgentRunState(value, version) {
     const state = value;
     if (state.schemaVersion !== AGENT_RUN_STATE_SCHEMA_VERSION)
         throw new AgentRunStateError(`Unsupported agent run state schemaVersion ${String(state.schemaVersion)}`);
-    if (!state.agentId || !state.definitionRevision || !state.fingerprint || !state.runId || !state.sessionId || !state.model || !state.status || !state.counters || !state.deadlineAt) {
+    if (!state.agentId ||
+        !state.definitionRevision ||
+        !state.fingerprint ||
+        !state.runId ||
+        !state.sessionId ||
+        !state.model ||
+        !state.status ||
+        !state.counters ||
+        !state.deadlineAt) {
         throw new AgentRunStateError("Malformed agent run state");
     }
-    return boundState({ ...state, version }, DEFAULT_MAX_AGENT_RUN_STATE_BYTES);
+    // Load bounds against the hard cap, not the default: the configured maxStateBytes is a
+    // save-side policy knob, while the load-side bound is only a DoS ceiling. States saved
+    // with a raised maxStateBytes must remain resumable.
+    return boundState({ ...state, version }, HARD_MAX_AGENT_RUN_STATE_BYTES);
 }
 function boundState(state, maxBytes) {
     checkShape(state, 0);

package/dist/agents.d.ts

@@ -1,4 +1,4 @@
-import type { Agent, AgentConfig, AgentEvent, AgentRunResult, AgentRunResume, AgentRunResumeOptions, AgentRunResumeStreamOptions, AgentRunRef, AgentSession, AgentSessionConfig } from "./contracts.js";
+import type { Agent, AgentConfig, AgentEvent, AgentRunRef, AgentRunResult, AgentRunResume, AgentRunResumeOptions, AgentRunResumeStreamOptions, AgentSession, AgentSessionConfig } from "./contracts.js";
 export declare function createAgent(config: AgentConfig): Agent;
 export declare function createAgentSession(config: AgentSessionConfig & {
     readonly agent: Agent;

package/dist/agents.js

@@ -1,23 +1,23 @@
-import { AgentRunError, AgentRunStateError, DEFAULT_MAX_PENDING_STEER_BYTES, DEFAULT_MAX_PENDING_STEERS, } from "./contracts.js";
 import { resolveLoop, resolveToolConcurrency } from "./agent-loops.js";
-import { createId } from "./ids.js";
-import { assertGuardrailsAllowed, GuardrailError, runGuardrails } from "./guardrails.js";
-import { createProviderTurnMetadata, readProviderHttpStatus } from "./observability.js";
+import { agentFingerprint, initialAgentRunState, loadAgentRunState, publicState, saveAgentRunState, validateRunStateOptions, } from "./agent-run-state.js";
 import { createDefaultCompactionStrategy, isCompactionEntryData } from "./compaction.js";
+import { AgentRunError, AgentRunStateError, DEFAULT_MAX_PENDING_STEER_BYTES, DEFAULT_MAX_PENDING_STEERS } from "./contracts.js";
+import { assertGuardrailsAllowed, GuardrailError, runGuardrails } from "./guardrails.js";
+import { identityTelemetryAttributes, ownershipFromIdentity, resolveRunIdentity } from "./identity.js";
+import { createId } from "./ids.js";
 import { assembleProviderInput } from "./input.js";
+import { createProviderTurnMetadata, readProviderHttpStatus } from "./observability.js";
 import { providerToolCallDeltaContent, reconstructToolCallDeltas } from "./provider-events.js";
 import { createProviderRequestPolicyChain, normalizeProviderRequestPolicyResult } from "./provider-request-policy.js";
-import { assertStructuredOutputRequestSupported, resolveRunProviderOptions } from "./structured-output.js";
-import { errorToErrorInfo, redactAgentEvent, redactProviderRequest, redactRunLedgerRecord, redactSecrets, redactSessionEntry } from "./redaction.js";
-import { composeSystemPrompt, mergeSystemPromptConfig } from "./system-prompts.js";
+import { errorToErrorInfo, redactAgentEvent, redactProviderRequest, redactRunLedgerRecord, redactSecrets, redactSessionEntry, } from "./redaction.js";
 import { createDefaultRetryPolicy, waitForRetry } from "./retry.js";
-import { createMemorySessionStore, createSessionEntry, getSessionBranchEntries, rebuildSessionContext } from "./session-stores.js";
 import { isFlushableRunLedger } from "./run-ledger.js";
-import { createToolRegistry, dispatchToolCall } from "./tools.js";
 import { RunLimitError, RunLimitTracker, resolveRunLimits } from "./run-limits.js";
-import { agentFingerprint, initialAgentRunState, loadAgentRunState, publicState, saveAgentRunState, validateRunStateOptions } from "./agent-run-state.js";
+import { createMemorySessionStore, createSessionEntry, getSessionBranchEntries, rebuildSessionContext, } from "./session-stores.js";
 import { resolveActiveSkills } from "./skills.js";
-import { identityTelemetryAttributes, ownershipFromIdentity, resolveRunIdentity, } from "./identity.js";
+import { assertStructuredOutputRequestSupported, resolveRunProviderOptions } from "./structured-output.js";
+import { composeSystemPrompt, mergeSystemPromptConfig } from "./system-prompts.js";
+import { createToolRegistry, dispatchToolCall } from "./tools.js";
 export function createAgent(config) {
     return {
         config,
@@ -39,7 +39,9 @@ export async function* resumeAgentRunStream(agent, ref, resume, options) {
     const prepared = await prepareAgentRunResume(agent, ref, resume, options, options.signal);
     const subscription = prepared.session.subscribe(options);
     let settled = false;
-    const runPromise = executePreparedAgentRunResume(prepared, options.signal).finally(() => { settled = true; });
+    const runPromise = executePreparedAgentRunResume(prepared, options.signal).finally(() => {
+        settled = true;
+    });
     try {
         for await (const event of subscription) {
             if ("runId" in event && event.runId !== ref.runId)
@@ -58,7 +60,9 @@ export async function* resumeAgentRunStream(agent, ref, resume, options) {
 async function prepareAgentRunResume(agent, ref, resume, options, signal) {
     throwIfAbortedSignal(signal);
     const { record, state } = await loadAgentRunState(options.checkpoints, ref, options.ownership);
-    if (state.definitionRevision !== options.definitionRevision || state.agentId !== (agent.config.id ?? agent.config.name) || state.fingerprint !== agentFingerprint(agent, options.definitionRevision)) {
+    if (state.definitionRevision !== options.definitionRevision ||
+        state.agentId !== (agent.config.id ?? agent.config.name) ||
+        state.fingerprint !== agentFingerprint(agent, options.definitionRevision)) {
         throw new AgentRunStateError("Agent definition revision or fingerprint mismatch on resume");
     }
     if (record.version !== resume.expectedVersion || state.status !== "suspended") {
@@ -211,7 +215,11 @@ class RuntimeAgentSession {
         }
     }
     async resumeDurable(state, runState, ownership, signal) {
-        return this.runInternal(state.input ?? [], { runState, ownership, signal }, state.runId, { options: runState, state, version: state.version });
+        return this.runInternal(state.input ?? [], { runState, ownership, signal }, state.runId, {
+            options: runState,
+            state,
+            version: state.version,
+        });
     }
     async recordDurableDenial(runId, interruption, version, ownership) {
         this.activeLedger = this.agent.config.runLedger;
@@ -229,7 +237,11 @@ class RuntimeAgentSession {
         }
     }
     async runInternal(input, options, runId, resumed) {
-        if (this.agent.config.secure && (options.redactor !== undefined || options.ownership !== undefined || options.validate !== undefined || options.runState !== undefined)) {
+        if (this.agent.config.secure &&
+            (options.redactor !== undefined ||
+                options.ownership !== undefined ||
+                options.validate !== undefined ||
+                options.runState !== undefined)) {
             throw new AgentRunStateError("Secure agent defaults cannot be replaced per run");
         }
         const requestedLimits = options.maxToolRounds === undefined
@@ -316,7 +328,14 @@ class RuntimeAgentSession {
             const { registry, tools } = activeTools(this.agent.config.tools);
             const activeSkills = this.resolveRunSkills(options, tools);
             if (options.model && JSON.stringify(options.model) !== JSON.stringify(this.agent.config.model)) {
-                await this.appendEntry(createSessionEntry({ sessionId: this.id, parentId: this.currentLeafId, runId, kind: "model_change", previousModel: this.agent.config.model, model: options.model }));
+                await this.appendEntry(createSessionEntry({
+                    sessionId: this.id,
+                    parentId: this.currentLeafId,
+                    runId,
+                    kind: "model_change",
+                    previousModel: this.agent.config.model,
+                    model: options.model,
+                }));
             }
             const inputMessages = inputToMessages(input).map((message) => this.redact(message));
             const inputGuardrails = await runGuardrails({
@@ -327,20 +346,24 @@ class RuntimeAgentSession {
                 redactor: this.activeRedactor,
                 emit: (event) => this.emit(event),
             });
-            if (inputGuardrails.terminal?.action === "interrupt" && this.activeDurable) {
-                if (!resumed) {
-                    const interruption = { kind: "input_guardrail", reason: inputGuardrails.terminal.reason ?? "Input requires approval" };
-                    throw new AgentRunSuspended(await this.suspendDurable({ runId, model, limits, interruption, messages: inputMessages }), interruption);
-                }
+            // Input-guardrail decision table:
+            // - interrupt + durable + fresh run  → suspend for approval.
+            // - interrupt + durable + resumed run → proceed: resuming IS the operator approval.
+            // - interrupt without durable, or block/tripwire → fail via assertGuardrailsAllowed.
+            const approvedByResume = resumed !== undefined && inputGuardrails.terminal?.action === "interrupt" && this.activeDurable !== undefined;
+            if (inputGuardrails.terminal?.action === "interrupt" && this.activeDurable && !approvedByResume) {
+                const interruption = { kind: "input_guardrail", reason: inputGuardrails.terminal.reason ?? "Input requires approval" };
+                throw new AgentRunSuspended(await this.suspendDurable({ runId, model, limits, interruption, messages: inputMessages }), interruption);
             }
-            else {
+            if (inputGuardrails.terminal && !approvedByResume)
                 assertGuardrailsAllowed(inputGuardrails);
-            }
             for (const message of inputMessages)
                 await this.appendMessage(message, runId);
             await this.autoCompact(runId, options, controller.signal, inputMessages);
             const maxToolRounds = resolvedLimits.maxToolRounds;
-            const systemInstructions = composeSystemPrompt(mergeSystemPromptConfig(this.agent.config.systemPrompt, options.systemPrompt), { base: this.agent.config.instructions });
+            const systemInstructions = composeSystemPrompt(mergeSystemPromptConfig(this.agent.config.systemPrompt, options.systemPrompt), {
+                base: this.agent.config.instructions,
+            });
             const contextProviders = [
                 ...(this.agent.config.context ?? []),
                 // ponytail: skill context after host context; no per-skill token budget yet.
@@ -429,7 +452,7 @@ class RuntimeAgentSession {
                         limits.charge("maxTurns");
                     assembledTurn = false;
                     const policyResult = await this.applyProviderRequestPolicies(request, runId, options, metadata, controller.signal);
-                    const middlewareRequest = await this.agent.config.middleware?.run("provider_request", policyResult.request) ?? policyResult.request;
+                    const middlewareRequest = (await this.agent.config.middleware?.run("provider_request", policyResult.request)) ?? policyResult.request;
                     try {
                         return await this.generateWithRetry(this.redactProviderRequest(middlewareRequest), runId, options, controller.signal, policyResult.secrets, this.activeLoopTurn, recordProviderUsage);
                     }
@@ -468,12 +491,22 @@ class RuntimeAgentSession {
                             return;
                         const pending = durable.state?.pending;
                         if (pending?.call.id === mediatedCall.id && pending.status === "ready") {
-                            await this.persistDurable({ ...durable.state, status: "running", pending: { ...pending, status: "dispatched" }, interruption: undefined });
+                            await this.persistDurable({
+                                ...durable.state,
+                                status: "running",
+                                pending: { ...pending, status: "dispatched" },
+                                interruption: undefined,
+                            });
                             return;
                         }
                         if (!durable.options.interruptBeforeTool)
                             return;
-                        const interruption = { kind: "tool_approval", reason: "Tool side effect requires approval", toolCallId: mediatedCall.id, toolName: mediatedCall.name };
+                        const interruption = {
+                            kind: "tool_approval",
+                            reason: "Tool side effect requires approval",
+                            toolCallId: mediatedCall.id,
+                            toolName: mediatedCall.name,
+                        };
                         throw new AgentRunSuspended(await this.suspendDurable({
                             runId,
                             model,
@@ -508,13 +541,19 @@ class RuntimeAgentSession {
                 const result = await ctx.dispatchToolCall(resumed.state.pending.call);
                 await ctx.appendMessage({
                     role: "tool",
-                    content: [{ type: "tool_result", toolCallId: result.toolCallId, name: result.name, result: result.value, error: result.error }, ...(result.content ?? [])],
+                    content: [
+                        { type: "tool_result", toolCallId: result.toolCallId, name: result.name, result: result.value, error: result.error },
+                        ...(result.content ?? []),
+                    ],
                     metadata: result.metadata,
                 });
             }
             const loopUsage = await loop.run(ctx);
             if (loop.name === "generate-validate-revise" && !artifactFinished) {
-                throw Object.assign(new Error(artifactFailedInfo?.message ?? "artifact loop ended without a validated artifact"), { name: "ArtifactFailed", code: artifactFailedInfo?.code ?? "artifact_failed" });
+                throw Object.assign(new Error(artifactFailedInfo?.message ?? "artifact loop ended without a validated artifact"), {
+                    name: "ArtifactFailed",
+                    code: artifactFailedInfo?.code ?? "artifact_failed",
+                });
             }
             usage = runUsage.value() ?? loopUsage;
             if (usage && this.activeLedger) {
@@ -661,21 +700,22 @@ class RuntimeAgentSession {
         const durable = this.activeDurable;
         if (!durable)
             throw new AgentRunStateError("Durable interruption is not configured");
-        const state = durable.state ?? initialAgentRunState({
-            agent: this.agent,
-            options: durable.options,
-            runId: input.runId,
-            sessionId: this.id,
-            leafId: this.currentLeafId,
-            model: input.model,
-            counters: input.limits.snapshot(),
-            deadlineAt: input.limits.deadlineAt,
-            status: "suspended",
-            interruption: input.interruption,
-            messages: input.messages,
-            pending: input.pending,
-            interruptBeforeTool: durable.options.interruptBeforeTool,
-        });
+        const state = durable.state ??
+            initialAgentRunState({
+                agent: this.agent,
+                options: durable.options,
+                runId: input.runId,
+                sessionId: this.id,
+                leafId: this.currentLeafId,
+                model: input.model,
+                counters: input.limits.snapshot(),
+                deadlineAt: input.limits.deadlineAt,
+                status: "suspended",
+                interruption: input.interruption,
+                messages: input.messages,
+                pending: input.pending,
+                interruptBeforeTool: durable.options.interruptBeforeTool,
+            });
         return this.persistDurable({
             ...state,
             leafId: this.currentLeafId,
@@ -723,7 +763,13 @@ class RuntimeAgentSession {
         await this.rebuildHistory();
     }
     fork(options = {}) {
-        return createAgentSession({ agent: this.agent, id: this.id, store: this.store, leafId: options.leafId ?? this.currentLeafId, metadata: this.metadata });
+        return createAgentSession({
+            agent: this.agent,
+            id: this.id,
+            store: this.store,
+            leafId: options.leafId ?? this.currentLeafId,
+            metadata: this.metadata,
+        });
     }
     async clone(options = {}) {
         const id = options.id ?? randomId("session");
@@ -739,7 +785,13 @@ class RuntimeAgentSession {
             const { id: _oldId, parentId: _oldParentId, sessionId: _oldSessionId, ...rest } = entry;
             await this.store.append({ ...rest, id: nextId, parentId: entry.parentId ? remap.get(entry.parentId) : undefined, sessionId: id });
         }
-        return createAgentSession({ agent: this.agent, id, store: this.store, leafId: branch.length ? remap.get(branch[branch.length - 1].id) : undefined, metadata: this.metadata });
+        return createAgentSession({
+            agent: this.agent,
+            id,
+            store: this.store,
+            leafId: branch.length ? remap.get(branch[branch.length - 1].id) : undefined,
+            metadata: this.metadata,
+        });
     }
     branchReader() {
         // ponytail: prefer the store's readBranchPath (one ancestor-chain query) when present so a
@@ -753,9 +805,7 @@ class RuntimeAgentSession {
         // the resolver entirely; otherwise `RunOptions.providerSource` overrides
         // `AgentConfig.providerSource` for this run. A miss on every source fails
         // closed with `Unknown provider: ${model.provider}` before any provider turn.
-        const provider = this.agent.config.provider ??
-            options.providerSource?.(model) ??
-            this.agent.config.providerSource?.(model);
+        const provider = this.agent.config.provider ?? options.providerSource?.(model) ?? this.agent.config.providerSource?.(model);
         if (!provider)
             throw new Error(`Unknown provider: ${model.provider}`);
         this.activeProvider = provider;
@@ -828,7 +878,10 @@ class RuntimeAgentSession {
                     throw errorFromInfo(info);
                 const context = { sessionId: this.id, runId, attempt, error: info, metadata: retry?.metadata, signal };
                 let decision = await policy.decide(context);
-                const payload = await this.agent.config.middleware?.run("retry", { context, decision }) ?? { context, decision };
+                const payload = (await this.agent.config.middleware?.run("retry", { context, decision })) ?? {
+                    context,
+                    decision,
+                };
                 decision = payload.decision;
                 if (!decision.retry)
                     throw errorFromInfo(info);
@@ -998,7 +1051,22 @@ class RuntimeAgentSession {
                 redactor: this.activeRedactor,
                 emit: (event) => this.emit(event),
             });
-            assertGuardrailsAllowed(inputGuardrails);
+            // Mid-run steer: a terminal decision drops the message (never enters history or
+            // the session store) and the run continues. Run-start input blocking still fails
+            // the run — only the blast radius of steered input is narrowed.
+            const terminal = inputGuardrails.terminal;
+            if (terminal) {
+                if (terminal.action === "interrupt")
+                    throw new GuardrailError(terminal);
+                this.emit({
+                    type: "steer_rejected",
+                    sessionId: this.id,
+                    runId,
+                    message: this.activeRedactor ? this.activeRedactor.redact(message) : message,
+                    record: terminal,
+                });
+                continue;
+            }
             this.history.push(message);
             await this.appendMessage(message, runId);
         }
@@ -1029,16 +1097,35 @@ class RuntimeAgentSession {
         throwIfAbortedSignal(signal);
         const entries = await this.entries();
         const secrets = options.secrets ?? [];
-        const strategy = options.strategy ?? createDefaultCompactionStrategy({ keepRecentEntries: options.keepRecentEntries, maxSummaryChars: options.maxSummaryChars, secrets });
-        const context = { sessionId: this.id, entries, keepRecentEntries: options.keepRecentEntries, trigger, secrets, metadata: options.metadata, signal };
+        const strategy = options.strategy ??
+            createDefaultCompactionStrategy({ keepRecentEntries: options.keepRecentEntries, maxSummaryChars: options.maxSummaryChars, secrets });
+        const context = {
+            sessionId: this.id,
+            entries,
+            keepRecentEntries: options.keepRecentEntries,
+            trigger,
+            secrets,
+            metadata: options.metadata,
+            signal,
+        };
         this.emit({ type: "compaction_started", sessionId: this.id, runId });
         let result = await strategy.compact(context);
         result = { ...result, summary: redactSecrets(result.summary, secrets) };
-        const payload = await this.agent.config.middleware?.run("compaction", { context, result }) ?? { context, result };
+        const payload = (await this.agent.config.middleware?.run("compaction", { context, result })) ?? {
+            context,
+            result,
+        };
         result = { ...payload.result, summary: redactSecrets(payload.result.summary, secrets) };
         const source = result.entries?.find((entry) => entry.kind === "compaction");
         const data = isCompactionEntryData(source?.data) ? source.data : undefined;
-        const entry = createSessionEntry({ sessionId: this.id, parentId: this.currentLeafId, runId, kind: "compaction", summary: result.summary, data });
+        const entry = createSessionEntry({
+            sessionId: this.id,
+            parentId: this.currentLeafId,
+            runId,
+            kind: "compaction",
+            summary: result.summary,
+            data,
+        });
         await this.appendEntry(entry);
         const finalResult = { ...result, entries: [entry] };
         this.emit({ type: "compaction_finished", sessionId: this.id, runId, summary: finalResult.summary });
@@ -1181,8 +1268,8 @@ class SteerSoftInterrupt extends Error {
     }
 }
 function isSteerSoftInterrupt(error) {
-    return error instanceof SteerSoftInterrupt
-        || (typeof error === "object" && error !== null && error.code === STEER_SOFT_INTERRUPT_CODE);
+    return (error instanceof SteerSoftInterrupt ||
+        (typeof error === "object" && error !== null && error.code === STEER_SOFT_INTERRUPT_CODE));
 }
 function finalAssistantMessage(history) {
     for (let index = history.length - 1; index >= 0; index -= 1) {
@@ -1254,11 +1341,25 @@ function withoutTrailingInput(messages, input) {
     const next = [...messages];
     for (let i = input.length - 1; i >= 0; i -= 1) {
         const last = next.at(-1);
-        if (last && JSON.stringify(last) === JSON.stringify(input[i]))
+        if (last && stableMessageKey(last) === stableMessageKey(input[i]))
             next.pop();
     }
     return next;
 }
+// Key-order-insensitive comparison: a redacted-then-reassembled message with reordered
+// keys must still dedupe against the trailing input, or auto-compaction duplicates it.
+function stableMessageKey(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableMessageKey).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${stableMessageKey(record[key])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
 function bridgeAbort(signal, controller) {
     if (!signal)
         return () => undefined;
@@ -1276,9 +1377,10 @@ function throwIfAbortedSignal(signal) {
     if (signal?.aborted)
         throw signal.reason instanceof Error ? signal.reason : new Error("Agent run aborted");
 }
+const jsonTextEncoder = new TextEncoder();
 function jsonBytes(value) {
     try {
-        return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+        return jsonTextEncoder.encode(JSON.stringify(value)).byteLength;
     }
     catch {
         throw new TypeError("Provider request or event must be JSON-serializable for run limits");
@@ -1295,8 +1397,8 @@ function createUsageAccumulator() {
                 if (value !== undefined)
                     sums.set(key, (sums.get(key) ?? 0) + value);
             }
-            const total = usage.totalTokens
-                ?? (usage.inputTokens !== undefined || usage.outputTokens !== undefined
+            const total = usage.totalTokens ??
+                (usage.inputTokens !== undefined || usage.outputTokens !== undefined
                     ? (usage.inputTokens ?? 0) + (usage.outputTokens ?? 0)
                     : undefined);
             if (total !== undefined)