@arnilo/prism 0.2.8 → 0.3.0

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+## [0.3.0] - 2026-08-20
+
+### Added
+- **Release 0.3.0 (plans 030, 031)** is the final lockstep cut and first independent-versioning line. The graph contains 57 publishable manifests; internal first-party ranges use `^0.3.0`, Decision B permits changed packages to patch/minor independently inside `<0.4.0`, and later publication uses `@arnilo/<package>@<version>` tags.
+- Optional `@arnilo/prism-antigravity-agent` delegates autonomous coding sessions to the official Google Antigravity CLI (`agy`) with per-run loopback HTTP MCP capability exposure, AG-UI timeline projection, secret redaction, and `--conversation` continuation. Host owns the official binary and `agy login` authentication state.
+- Optional `@arnilo/prism-computer-use-linux` wraps a host-owned Linux `computer-use-linux` MCP binary. DeviceAdapter admission is deny-by-default, setup tools are opt-in, mutating calls require approval/ExecutionPolicy, results are bounded and untrusted, input is serialized, and the package is omitted from umbrellas.
+- Coding/ACP closeouts: `read.findText`, visible fuzzy edit outcomes and nearby miss context, ACP editor-buffer filesystem operations, spawnable per-session coding registries, and delete/move result locations.
+
+### Changed
+- Release automation keeps explicit `--lockstep --version 0.3.0` for the final cut, then defaults to changed-package validation/publication and package tags. No Changesets or new core runtime dependency.
+- No persisted store migration. Live-service canaries and delegated Cursor adapter remain later demand-gated 0.3.x work.
+
+## [0.2.9] - 2026-08-19
+
+### Changed
+- **Release 0.2.9 (plan 029)** is the provider-adoption and behavior-packages cut. **Additive-only.** New packages: `@arnilo/prism-provider-deepseek`, `@arnilo/prism-provider-xai` (API key + SuperGrok RFC 8628 device-code), `@arnilo/prism-provider-clinepass`, `@arnilo/prism-impeccable`. `pollDeviceCodeToken` accepts `bodyEncoding: "form"` and `extraDeviceParams`. Ponytail peer `^4.9.0` (empty `/ponytail` reports status). Caveman registers extra `SKILL.md`. Graph **55** publishable manifests at exact **0.2.9**. Store-compatible with 0.2.8; no migration. **Publication remains the operator handoff** (`docs/release-and-install.md` `0.2.9 publish handoff` — signed `v0.2.9` tag + npm OIDC).
+
 ## [0.2.8] - 2026-08-18
 
 ### Changed

package/README.md

@@ -4,7 +4,9 @@
 bring their tools, providers, credentials, storage, and UI; Prism supplies the
 common contracts, registries, agent/session runtime, replaceable input/prompt
 and compaction strategies, CLI/RPC adapters, and first-party provider/compaction
-packages. Prism defines contracts, not apps.
+packages. The current 0.3.0 line contains 56 publishable manifests, including
+optional Linux desktop control and independent package versioning after the final
+lockstep cut. Prism defines contracts, not apps.
 
 ## Current scope
 
@@ -18,9 +20,10 @@ packages. Prism defines contracts, not apps.
   OpenAI/OpenRouter use best-effort explicit cache hints, NeuralWatt uses
   best-effort implicit prefix caching, and other providers have route/model-specific
   or no cache-control support; see [docs/provider-caching.md](docs/provider-caching.md).
-- **First-party packages**: fourteen provider adapters, two compaction strategies,
+- **First-party packages**: seventeen provider adapters, two compaction strategies,
   coding tools/security, JSON Schema validation, MCP, workflows, OpenTelemetry,
-  encrypted credentials, SQLite/PostgreSQL persistence, and manifest-only install profiles.
+  encrypted credentials, SQLite/PostgreSQL persistence, Linux desktop control,
+  and manifest-only install profiles.
 - **Tools, context, skills**: host-owned tool registry with allow/deny filtering
   and dispatch, context providers, and a skill registry with progressive
   disclosure.
@@ -56,7 +59,7 @@ npm install @arnilo/prism @arnilo/prism-provider-openai    # core + one provider
 npm install @arnilo/prism-base                              # core + compaction + validation
 npm install @arnilo/prism-code @arnilo/prism-provider-openai # coding-agent profile
 npm install @arnilo/prism-sdk @arnilo/prism-provider-openai  # application profile
-npm install @arnilo/prism-all                               # broad umbrella (21 direct / 44 transitive packages)
+npm install @arnilo/prism-all                               # broad umbrella (21 direct / 47 workspace packages)
 npm install @arnilo/prism-server @arnilo/prism-workflows    # optional Web API boundary
 npm install @arnilo/prism-supervisor                         # optional local delegation + A2A 1.0
 npm install @arnilo/prism-web-tools                          # optional bounded Brave/Exa/Firecrawl research
@@ -160,11 +163,16 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-provider-ollama` | Ollama Cloud / local provider with dynamic discovery and implicit-only caching |
 | `@arnilo/prism-provider-anthropic` | Anthropic Messages provider |
 | `@arnilo/prism-provider-google` | Google Gemini provider |
+| `@arnilo/prism-provider-deepseek` | DeepSeek Chat Completions provider |
+| `@arnilo/prism-provider-xai` | xAI Grok Completions + SuperGrok OAuth |
+| `@arnilo/prism-provider-clinepass` | ClinePass OpenAI-compatible gateway |
 | `@arnilo/prism-provider-azure` | Azure OpenAI provider |
 | `@arnilo/prism-provider-bedrock` | AWS Bedrock provider |
 | `@arnilo/prism-provider-vertex` | Google Vertex provider |
 | `@arnilo/prism-provider-ai-sdk` | AI SDK interoperability adapter |
 | `@arnilo/prism-browser` | optional host-wired Playwright browser automation (not core; not auto-activated) |
+| `@arnilo/prism-computer-use-linux` | optional Linux desktop-control tools over a host-owned `computer-use-linux` MCP binary |
+| `@arnilo/prism-antigravity-agent` | optional Antigravity CLI delegated agent adapter with per-run Prism MCP capability exposure |
 | `@arnilo/prism-compaction-llm` | provider-backed compaction strategy |
 | `@arnilo/prism-compaction-observational-memory` | source-backed memory + recall tool |
 | `@arnilo/prism-coding-agent` | bounded shell/read/write/edit tools |
@@ -178,12 +186,12 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-credentials-node` | encrypted-file and keychain credentials |
 | `@arnilo/prism-session-store-sqlite` | SQLite persistence/checkpoints/leases/owned run feedback |
 | `@arnilo/prism-session-store-postgres` | PostgreSQL persistence/checkpoints/leases/owned run feedback |
-| `@arnilo/prism-providers` | family: 11 of 14 first-party provider adapters (omits Azure, Bedrock, Vertex, which `prism-all` adds separately), including AI SDK interoperability |
+| `@arnilo/prism-providers` | family: 14 of 17 first-party provider adapters (omits Azure, Bedrock, Vertex, which `prism-all` adds separately), including AI SDK interoperability |
 | `@arnilo/prism-compaction` | family: both compaction strategies |
 | `@arnilo/prism-base` | profile: core + compaction + JSON Schema validation |
 | `@arnilo/prism-code` | profile: base + coding tools/security + MCP |
 | `@arnilo/prism-sdk` | profile: base + workflows + MCP + credentials + OpenTelemetry |
-| `@arnilo/prism-all` | broad umbrella: 21 first-party packages (44 transitive) across runtime, capability, provider, and persistence — omits document-reader, OpenAPI tools, NATS, Caveman, and Ponytail |
+| `@arnilo/prism-all` | broad umbrella: 21 first-party packages (47 transitive) across a 47-package workspace closure — omits document-reader, OpenAPI tools, NATS, Caveman, Ponytail, Impeccable, computer-use-linux, and antigravity-agent |
 
 ## Scripts
 

package/dist/contracts-protocol.d.ts

@@ -108,6 +108,36 @@ export interface ToolExecutionMetadata {
     readonly durationMs: number;
     readonly status: ToolCallStatus;
 }
+export type DelegatedAgentStepState = "active" | "done" | "error";
+export type DelegatedAgentStepKind = "assistant" | "tool" | "subagent" | "checkpoint" | "unknown";
+/** Token counters only; delegated adapters must never put thought text in this shape. */
+export interface DelegatedAgentStepUsage {
+    readonly inputTokens?: number;
+    readonly outputTokens?: number;
+    readonly thinkingTokens?: number;
+    readonly cacheReadTokens?: number;
+    readonly cacheWriteTokens?: number;
+    readonly totalTokens?: number;
+}
+/** Safe delegated timeline metadata. Raw arguments, results, paths, URIs, and event bodies are not fields. */
+export interface DelegatedAgentStep {
+    readonly type: "delegated_agent_step";
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly adapterId: string;
+    readonly externalConversationId: string;
+    readonly stepIndex: number;
+    readonly state: DelegatedAgentStepState;
+    readonly kind: DelegatedAgentStepKind;
+    readonly durationMs?: number;
+    readonly usage?: DelegatedAgentStepUsage;
+    readonly toolName?: string;
+    readonly subagentType?: string;
+    readonly detail?: {
+        readonly referenceId?: string;
+        readonly label?: string;
+    };
+}
 export type AgentFinishReason = "turn_limit" | "token_limit" | "refusal";
 export type AgentEvent = {
     readonly type: "agent_started";
@@ -176,7 +206,7 @@ export type AgentEvent = {
     readonly sessionId: string;
     readonly runId: string;
     readonly message: Message;
-} | {
+} | DelegatedAgentStep | {
     readonly type: "tool_execution_started";
     readonly sessionId: string;
     readonly runId: string;

package/dist/delegated-agent-step.d.ts

@@ -0,0 +1,20 @@
+import type { DelegatedAgentStep } from "./contracts-protocol.js";
+export declare const MAX_DELEGATED_AGENT_EVENT_BYTES: number;
+export declare const MAX_DELEGATED_AGENT_ID_BYTES = 512;
+export declare const MAX_DELEGATED_AGENT_NAME_BYTES = 256;
+export declare const MAX_DELEGATED_AGENT_STEP_INDEX = 1000000;
+export declare const MAX_DELEGATED_AGENT_DURATION_MS: number;
+export declare const MAX_DELEGATED_AGENT_TOKEN_COUNT = 1000000000000;
+export interface DelegatedAgentStepInput extends Omit<DelegatedAgentStep, "type" | "kind" | "state"> {
+    readonly kind: string;
+    readonly state: string;
+}
+export declare class DelegatedAgentStepError extends Error {
+    readonly code = "ERR_PRISM_DELEGATED_AGENT_STEP";
+    constructor(message: string);
+}
+/**
+ * Builds the only safe core shape for delegated timeline metadata. Unknown step
+ * kinds become `unknown`; unbounded or malformed identity/counter fields fail closed.
+ */
+export declare function createDelegatedAgentStep(input: DelegatedAgentStepInput): DelegatedAgentStep;

package/dist/delegated-agent-step.js

@@ -0,0 +1,99 @@
+export const MAX_DELEGATED_AGENT_EVENT_BYTES = 64 * 1024;
+export const MAX_DELEGATED_AGENT_ID_BYTES = 512;
+export const MAX_DELEGATED_AGENT_NAME_BYTES = 256;
+export const MAX_DELEGATED_AGENT_STEP_INDEX = 1_000_000;
+export const MAX_DELEGATED_AGENT_DURATION_MS = 24 * 60 * 60 * 1000;
+export const MAX_DELEGATED_AGENT_TOKEN_COUNT = 1_000_000_000_000;
+export class DelegatedAgentStepError extends Error {
+    code = "ERR_PRISM_DELEGATED_AGENT_STEP";
+    constructor(message) {
+        super(message);
+        this.name = "DelegatedAgentStepError";
+    }
+}
+/**
+ * Builds the only safe core shape for delegated timeline metadata. Unknown step
+ * kinds become `unknown`; unbounded or malformed identity/counter fields fail closed.
+ */
+export function createDelegatedAgentStep(input) {
+    if (!input || typeof input !== "object")
+        throw invalid("event");
+    const state = input.state;
+    if (state !== "active" && state !== "done" && state !== "error")
+        throw invalid("state");
+    const kind = normalizeKind(input.kind);
+    if (!Number.isSafeInteger(input.stepIndex) || input.stepIndex < 0 || input.stepIndex > MAX_DELEGATED_AGENT_STEP_INDEX) {
+        throw invalid("stepIndex");
+    }
+    const event = {
+        type: "delegated_agent_step",
+        sessionId: boundedText(input.sessionId, "sessionId", MAX_DELEGATED_AGENT_ID_BYTES),
+        runId: boundedText(input.runId, "runId", MAX_DELEGATED_AGENT_ID_BYTES),
+        adapterId: boundedText(input.adapterId, "adapterId", MAX_DELEGATED_AGENT_ID_BYTES),
+        externalConversationId: boundedText(input.externalConversationId, "externalConversationId", MAX_DELEGATED_AGENT_ID_BYTES),
+        stepIndex: input.stepIndex,
+        state,
+        kind,
+        ...(input.durationMs === undefined
+            ? {}
+            : { durationMs: boundedNumber(input.durationMs, "durationMs", MAX_DELEGATED_AGENT_DURATION_MS) }),
+        ...(input.usage === undefined ? {} : { usage: normalizeUsage(input.usage) }),
+        ...(input.toolName === undefined ? {} : { toolName: boundedText(input.toolName, "toolName", MAX_DELEGATED_AGENT_NAME_BYTES) }),
+        ...(input.subagentType === undefined
+            ? {}
+            : { subagentType: boundedText(input.subagentType, "subagentType", MAX_DELEGATED_AGENT_NAME_BYTES) }),
+        ...(input.detail === undefined ? {} : { detail: normalizeDetail(input.detail) }),
+    };
+    if (utf8Bytes(JSON.stringify(event)) > MAX_DELEGATED_AGENT_EVENT_BYTES)
+        throw invalid("event bytes");
+    return event;
+}
+function normalizeKind(value) {
+    return value === "assistant" || value === "tool" || value === "subagent" || value === "checkpoint" || value === "unknown"
+        ? value
+        : "unknown";
+}
+function normalizeUsage(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw invalid("usage");
+    const output = {};
+    for (const key of ["inputTokens", "outputTokens", "thinkingTokens", "cacheReadTokens", "cacheWriteTokens", "totalTokens"]) {
+        const amount = value[key];
+        if (amount === undefined)
+            continue;
+        output[key] = boundedNumber(amount, key, MAX_DELEGATED_AGENT_TOKEN_COUNT);
+    }
+    return output;
+}
+function normalizeDetail(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw invalid("detail");
+    const referenceId = value.referenceId === undefined ? undefined : boundedOpaque(value.referenceId, "detail.referenceId", MAX_DELEGATED_AGENT_ID_BYTES);
+    const label = value.label === undefined ? undefined : boundedText(value.label, "detail.label", MAX_DELEGATED_AGENT_NAME_BYTES);
+    return {
+        ...(referenceId === undefined ? {} : { referenceId }),
+        ...(label === undefined ? {} : { label }),
+    };
+}
+function boundedText(value, name, maxBytes) {
+    if (typeof value !== "string" || value.length === 0 || /[\0\r\n]/.test(value) || utf8Bytes(value) > maxBytes)
+        throw invalid(name);
+    return value;
+}
+function boundedOpaque(value, name, maxBytes) {
+    if (typeof value !== "string" || /[\\/:]/.test(value))
+        throw invalid(name);
+    return boundedText(value, name, maxBytes);
+}
+function boundedNumber(value, name, max) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > max)
+        throw invalid(name);
+    return value;
+}
+function utf8Bytes(value) {
+    return new TextEncoder().encode(value).byteLength;
+}
+function invalid(field) {
+    return new DelegatedAgentStepError(`Invalid delegated agent step ${field}`);
+}
+//# sourceMappingURL=delegated-agent-step.js.map

package/dist/index.d.ts

@@ -37,6 +37,8 @@ export type { DeviceAdapter, DeviceAdmitRequest, DeviceChunkResult, DeviceConfor
 export { acceptDeviceChunk, assertDeviceAdmit, DEFAULT_DEVICE_MAX_CHUNK_BYTES, DEFAULT_DEVICE_MAX_CONCURRENT_SESSIONS, DevicePolicyError, HARD_DEVICE_MAX_CHUNK_BYTES, HARD_DEVICE_MAX_CONCURRENT_SESSIONS, redactDeviceTelemetry, resolveDevicePolicy, runDevicePolicyConformance, } from "./devices.js";
 export type { EventMultiplexer, EventMultiplexerOptions, EventOverflowInfo, EventOverflowPolicy } from "./event-multiplexer.js";
 export { createEventMultiplexer, EVENT_MULTIPLEXER_SINGLE_CONSUMER_CODE, EventMultiplexerError } from "./event-multiplexer.js";
+export { createDelegatedAgentStep, DelegatedAgentStepError, MAX_DELEGATED_AGENT_DURATION_MS, MAX_DELEGATED_AGENT_EVENT_BYTES, MAX_DELEGATED_AGENT_ID_BYTES, MAX_DELEGATED_AGENT_NAME_BYTES, MAX_DELEGATED_AGENT_STEP_INDEX, MAX_DELEGATED_AGENT_TOKEN_COUNT, } from "./delegated-agent-step.js";
+export type { DelegatedAgentStepInput } from "./delegated-agent-step.js";
 export type { ExecutionAction, ExecutionDecision, ExecutionPolicy, ExecutionRisk } from "./execution-policy.js";
 export { applyExecutionDecision, assertExecutionAllowed, checkExecution, ExecutionDeniedError } from "./execution-policy.js";
 export type { ExtensionErrorPolicy, ExtensionEventBus, ExtensionEventHandler, ExtensionKernel, ExtensionKernelOptions, ExtensionLoadPolicy, LoadedExtension, } from "./extensions.js";
@@ -111,5 +113,5 @@ export { createToolParameterValidator, createToolRegistry, dispatchToolCall, fil
 export type { ResolvedUseCaseModel, ResolveUseCaseModelInput, UseCaseModelBinding, } from "./use-case-model.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export declare const name = "prism";
-export declare const version = "0.2.8";
+export declare const version = "0.3.0";
 export declare const description = "Agent harness for AI providers, agents, sessions, and tools.";

package/dist/index.js

@@ -19,6 +19,7 @@ export { CONVERSATION_METADATA_KEY, ConversationError, conversationMarkerMetadat
 export { createChainedCredentialResolver, createEnvCredentialResolver, createExplicitCredentialResolver, createMemoryCredentialStore, refreshOAuthCredential, resolveCredentialValue, revokeOAuthCredential, } from "./credentials.js";
 export { acceptDeviceChunk, assertDeviceAdmit, DEFAULT_DEVICE_MAX_CHUNK_BYTES, DEFAULT_DEVICE_MAX_CONCURRENT_SESSIONS, DevicePolicyError, HARD_DEVICE_MAX_CHUNK_BYTES, HARD_DEVICE_MAX_CONCURRENT_SESSIONS, redactDeviceTelemetry, resolveDevicePolicy, runDevicePolicyConformance, } from "./devices.js";
 export { createEventMultiplexer, EVENT_MULTIPLEXER_SINGLE_CONSUMER_CODE, EventMultiplexerError } from "./event-multiplexer.js";
+export { createDelegatedAgentStep, DelegatedAgentStepError, MAX_DELEGATED_AGENT_DURATION_MS, MAX_DELEGATED_AGENT_EVENT_BYTES, MAX_DELEGATED_AGENT_ID_BYTES, MAX_DELEGATED_AGENT_NAME_BYTES, MAX_DELEGATED_AGENT_STEP_INDEX, MAX_DELEGATED_AGENT_TOKEN_COUNT, } from "./delegated-agent-step.js";
 export { applyExecutionDecision, assertExecutionAllowed, checkExecution, ExecutionDeniedError } from "./execution-policy.js";
 export { createExtensionEventBus, createExtensionKernel } from "./extensions.js";
 export { createMemoryRunFeedbackStore, prepareRunFeedback, RunFeedbackError, requireRunFeedbackOwnership, runFeedbackPageLimit, } from "./feedback.js";
@@ -61,6 +62,6 @@ export { DEFAULT_TOOL_RESULT_FOLD_MAX_SUMMARY_BYTES, DEFAULT_TOOL_RESULT_FOLD_MI
 export { createToolParameterValidator, createToolRegistry, dispatchToolCall, filterTools } from "./tools.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export const name = "prism";
-export const version = "0.2.8";
+export const version = "0.3.0";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map

package/dist/oauth-device-code.d.ts

@@ -14,6 +14,7 @@ export interface OAuthDeviceCodePayload {
     readonly device_code: string;
     readonly user_code: string;
     readonly verification_uri: string;
+    readonly verification_uri_complete?: string;
     readonly expires_in?: number;
     readonly interval?: number;
 }
@@ -35,6 +36,10 @@ export interface PollDeviceCodeTokenOptions {
     readonly scope?: string;
     /** Extra token-request params merged into every poll body (e.g. client_secret, audience). Never logged. */
     readonly extraTokenParams?: Readonly<Record<string, string>>;
+    /** Extra device-code params merged into the device-code body only (e.g. referrer). Never logged. */
+    readonly extraDeviceParams?: Readonly<Record<string, string>>;
+    /** Wire encoding for device-code and token POSTs. Default `json` keeps Codex / M365 callers byte-compatible. */
+    readonly bodyEncoding?: "json" | "form";
     readonly callbacks?: Pick<OAuthLoginCallbacks, "onDeviceCode" | "signal">;
     /** Message prefix, e.g. "OpenAI" or the adapter id. */
     readonly errorPrefix: string;

package/dist/oauth-device-code.js

@@ -45,6 +45,22 @@ const isTokenSuccessPayload = (value) => {
         return false;
     return typeof value.access_token === "string";
 };
+const encodeOAuthBody = (encoding, params) => encoding === "form"
+    ? { contentType: "application/x-www-form-urlencoded", body: new URLSearchParams(params).toString() }
+    : { contentType: "application/json", body: JSON.stringify(params) };
+const requireHttpsVerificationUri = (value, label, errorPrefix, secrets) => {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw redactOAuthError(new Error(`${errorPrefix} ${label} must be https`), secrets);
+    }
+    if (parsed.protocol !== "https:") {
+        throw redactOAuthError(new Error(`${errorPrefix} ${label} must be https`), secrets);
+    }
+    return value;
+};
 /**
  * Request a device code, surface it through `onDeviceCode`, then poll the token
  * endpoint until success, expiry, a terminal OAuth error, or abort. All response
@@ -53,16 +69,19 @@ const isTokenSuccessPayload = (value) => {
  * bounded text parsed as JSON with a redacted-text fallback.
  */
 export async function pollDeviceCodeToken(options) {
-    const { fetchImpl, deviceCodeUrl, tokenUrl, clientId, scope, extraTokenParams, callbacks, errorPrefix, parseTokenCredentials } = options;
+    const { fetchImpl, deviceCodeUrl, tokenUrl, clientId, scope, extraTokenParams, extraDeviceParams, callbacks, errorPrefix, parseTokenCredentials, } = options;
+    const bodyEncoding = options.bodyEncoding === "form" ? "form" : "json";
     const now = options.now ?? Date.now;
     const sleep = options.sleep ?? abortableSleep;
-    const requestBody = { client_id: clientId };
-    if (scope)
-        requestBody.scope = scope;
+    const deviceBody = encodeOAuthBody(bodyEncoding, {
+        client_id: clientId,
+        ...(scope ? { scope } : {}),
+        ...extraDeviceParams,
+    });
     const response = await fetchImpl(deviceCodeUrl, {
         method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify(requestBody),
+        headers: { "content-type": deviceBody.contentType },
+        body: deviceBody.body,
         signal: callbacks?.signal,
     });
     if (!response.ok) {
@@ -71,10 +90,14 @@ export async function pollDeviceCodeToken(options) {
     }
     const json = await readBoundedResponseJson(response, { shape: isDeviceCodePayload });
     const secrets = [json.device_code, json.user_code];
+    requireHttpsVerificationUri(json.verification_uri, "verification_uri", errorPrefix, secrets);
+    const verificationUri = typeof json.verification_uri_complete === "string" && json.verification_uri_complete.length > 0
+        ? requireHttpsVerificationUri(json.verification_uri_complete, "verification_uri_complete", errorPrefix, secrets)
+        : json.verification_uri;
     const expiresAtMs = now() + (json.expires_in ?? 0) * 1_000;
     await callbacks?.onDeviceCode?.({
         userCode: json.user_code,
-        verificationUri: json.verification_uri,
+        verificationUri,
         expiresAt: json.expires_in ? new Date(expiresAtMs).toISOString() : undefined,
     });
     let intervalMs = Math.max(1, (json.interval ?? DEFAULT_DEVICE_POLL_INTERVAL_MS / 1_000) * 1_000);
@@ -82,15 +105,16 @@ export async function pollDeviceCodeToken(options) {
         throwIfAborted(callbacks?.signal);
         await sleep(intervalMs, callbacks?.signal);
         throwIfAborted(callbacks?.signal);
+        const tokenBody = encodeOAuthBody(bodyEncoding, {
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            client_id: clientId,
+            device_code: json.device_code,
+            ...extraTokenParams,
+        });
         const tokenResponse = await fetchImpl(tokenUrl, {
             method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({
-                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-                client_id: clientId,
-                device_code: json.device_code,
-                ...extraTokenParams,
-            }),
+            headers: { "content-type": tokenBody.contentType },
+            body: tokenBody.body,
             signal: callbacks?.signal,
         });
         if (tokenResponse.ok) {

package/docs/0.1.0-readiness.md

@@ -1,6 +1,6 @@
 # 0.1.0 / 1.0 Readiness Gates
 
-Status: **0.2.8** is the current release line (the 0.2.x review-remediation line: fail-closed runtime/sandbox security, provider completion and outbound trust boundaries, concurrent-state/durability integrity, build/coverage/release-evidence integrity, package/documentation/compatibility truth, maintainability and bounded performance, fully featured coding-agent readiness, enterprise ERP production readiness, ACP adoption fixes); **0.1.7** was the terminal 0.1.x baseline; **1.0** readiness remains operator-gated, not automatic.
+Status: **0.3.0** is the current release line (the final 0.3.x lockstep cut: Linux desktop wrapper, coding/ACP closeouts, and independent package versions with Decision B `^0.3.0` ranges); **0.1.7** was the terminal 0.1.x baseline; **1.0** readiness remains operator-gated, not automatic.
 
 This page distills runnable readiness gates into one command-per-gate table.
 The **Last evidence** column records the 0.1.0-tree snapshot (plan 012 Tasks
@@ -20,16 +20,16 @@ Historical release lines (0.0.16 floor → 0.0.27 Phase 10 ACP interop → 0.1.0
 keep their per-phase evidence in the pages above; this page records the 0.2.6
 snapshot (plan 026) with the 0.1.x tables below as the historical record.
 
-## Current line (0.2.8)
+## Current line (0.3.0)
 
 | Item | Status |
 |---|---|
-| Published graph | **51** publishable manifests at exact **0.2.8** (root + 50 workspace packages: 14 provider adapters + 9 `prism-*` family/profile + 27 capability; generated by `node scripts/package-truth.mjs` → `scripts/package-truth.json`) |
-| Current-line cut | The 0.2.x review-remediation line, additive-only vs the frozen 0.1.x contract: 0.2.0 fail-closed runtime/sandbox security, 0.2.1 provider completion + outbound trust boundaries, 0.2.2 concurrent-state/durability integrity, 0.2.3 build/coverage/release-evidence integrity, 0.2.4 package/documentation/compatibility truth, 0.2.5 maintainability and bounded performance, 0.2.6 fully featured coding-agent readiness, 0.2.7 enterprise ERP production readiness, 0.2.8 ACP adoption fixes (client-neutrality guard, truthful ACP wire, spawnable `@arnilo/prism-acp-agent`, thought/plan/title/image/command updates) |
-| Upgrade path | `docs/migration.md` `0.2.7 → 0.2.8` (additive; no store migration; rollback = restore 0.2.7 manifests/tag); store-compatible throughout 0.2.x |
-| Compat promise | Additive-only vs the frozen 0.1.x contract; `scripts/compat-baseline` regenerated at 0.2.8 (version literal + additive ACP/agent exports), zero breaking deltas |
-| Security policy | `npm audit --audit-level=moderate` 0 at 0.2.8; threat-suites legs (phase8–11 + phase20–26) green; protected Postgres recovery/workspace conformance, PTY, real coding journey, NATS/live-canary legs operator-gated |
-| Docs freeze | tripwires green including the canonical manifest-count tripwire (50/49/14/9/26), the plan 024 package-truth tests (generator reproducibility + artifact equality + closure asserts + derived docs truth), the plan 025 bounded-accumulation near-limit probe, and the plan 026 freeze tripwires (per-task markers, threat T1–T8 test mapping, exit gate green) |
+| Release graph | **56** publishable manifests at exact **0.3.0** (root + 55 workspace packages: 17 provider adapters + 10 `prism-*` family/profile + 28 capability; generated by `node scripts/package-truth.mjs` → `scripts/package-truth.json`; npm publication remains the operator handoff) |
+| Current-line cut | The 0.3.x line starts with the final lockstep cut: optional host-owned Linux desktop control, coding/ACP tool closeouts, and independent package publication after the cut; live canaries and delegated agents remain later demand-gated work |
+| Upgrade path | `docs/migration.md` `0.2.9 → 0.3.0` (additive; no store migration; rollback = restore 0.2.9 manifests/tag); internal first-party ranges become `^0.3.0` |
+| Compat promise | Additive-only vs the frozen 0.2.9 baseline; package peers use Decision B's `^0.3.0` caret window and `scripts/compat-baseline` remains the reviewed declaration gate |
+| Security policy | `npm audit --audit-level=moderate` 0 target at 0.3.0; desktop admission remains deny-by-default, mutators require approval + `ExecutionPolicy`, and package tags publish only changed packages |
+| Docs freeze | tripwires green including the 56-package truth graph, Decision B range policy, the plan 030 freeze/release tests, coding/ACP tool regressions, and the host-owned desktop wrapper's fail-closed package/docs gates |
 | 0.1.x line | **0.1.7** (plan 019) is the terminal 0.1.x baseline; the 0.1.1 table below keeps the plan 013 snapshot; the 0.1.0 table keeps the plan 012 snapshot; the **0.0.16** values remain the historical network-free floor |
 
 ## Previous line (0.1.1)

package/docs/acp.md

@@ -46,7 +46,7 @@ In-stream `SessionUpdate`s:
 | Assistant text | `agent_message_chunk` |
 | Assistant thinking | `agent_thought_chunk` (same `messageId` scheme as text; through the shared redactor and byte caps) |
 | Tool lifecycle | `tool_call` / `tool_call_update` (title/status/content) — `tool_call.kind` comes from the session's tool registry `kind` metadata when present (B4), else the name heuristic |
-| Tool result, projected | `tool_call_update` with `locations` (≤ `acpLocationsPerUpdate`) and/or a `diff` block (≤ `acpDiffBytes`) — only from `AgUiProjection.toolLocations`/`toolDiff` allow-lists, at `finish()`. `toolResult` may return a string (text content) or `{ type: "image", data, mimeType }` (F8) — the mapper wraps the image as `{ type: "content", content: { type: "image", data, mimeType } }` and drops payloads over `acpImageBytes` (never truncated). Opt-in turnkey: `createCodingToolProjection()` (F7) recognizes first-party `edit` (path + unified patch as `newText`, `firstChangedLine` location) and `write` (path location only — result has no file body) results; default remains deny-by-default. |
+| Tool result, projected | `tool_call_update` with `locations` (≤ `acpLocationsPerUpdate`) and/or a `diff` block (≤ `acpDiffBytes`) — only from `AgUiProjection.toolLocations`/`toolDiff` allow-lists, at `finish()`. `toolResult` may return a string (text content) or `{ type: "image", data, mimeType }` (F8) — the mapper wraps the image as `{ type: "content", content: { type: "image", data, mimeType } }` and drops payloads over `acpImageBytes` (never truncated). Opt-in turnkey: `createCodingToolProjection()` (F7) recognizes first-party `edit` (path + unified patch as `newText`, `firstChangedLine` location), `write` and `delete` (metadata path locations), and `move` (destination `metadata.to` location) results; moves never emit diffs, and default remains deny-by-default. |
 | Provider usage | `usage_update` (only when the `capabilities.usage.contextWindow` seam reports a valid window — absent/undefined/throw ⇒ the update is omitted, never `size = used`) |
 | Run-level failure | No transcript chunk — the `session/prompt` request rejects with `ERR_PRISM_ACP_RUN` (redacted, byte-capped message). Retryable provider-turn failures stay silent and may recover; only a terminal `error` event fails the request. |
 | Run stop reason | `session/prompt` returns the SDK `StopReason` (F4): `cancelled` when the run was aborted, `max_turn_requests` for the tool-round ceiling (`finishReason: "turn_limit"`), `max_tokens` for `"token_limit"`, `refusal` for `"refusal"`, else `end_turn`. The generic `finishReason` field is set on `agent_finished` by loop strategies (single-shot records `turn_limit` at the `maxToolRounds` ceiling); `token_limit`/`refusal` have no core producer yet — the mapping is ready. |
@@ -112,7 +112,8 @@ const agent = createPrismAcpAgent({
 
 - **Seam = capability.** Wiring `sessions.load` advertises `loadSession`; removing it withdraws the method. There is no separate capability flag to keep in sync — the freeze manifest's advertise-when matrix is enforced by construction and asserted by `scripts/phase10-conformance.test.mjs`.
 - **Transcript replay (F2).** When `sessions.transcript` is wired, `session/load` and `session/resume` replay `user_message_chunk`/`agent_message_chunk` text chunks (from `SessionEntry`s with `kind: "message"` and a user/assistant role, text blocks only) before returning `sessionState`. Each chunk passes the shared redactor and is truncated at `maxTextBytes`; replay stops at `maxReplayEvents` chunks and counts against the stream event/byte caps (an oversized transcript fails the load/resume request closed). Absent seam = no replay, behavior unchanged.
-- **Client fs/terminal are adapters, not a second implementation.** `AcpClientFilesystem` / `AcpClientTerminals` wrap the client's `fs/*` and `terminal/*` methods behind the Phase 9 `ProcessSession`-flavored interfaces; the agent pre-generates the session id so terminal requests can carry it. Host repo operations remain default when the client fs is absent.
+- **Client fs/terminal are adapters, not a second implementation.** `AcpClientFilesystem` / `AcpClientTerminals` wrap the client's `fs/*` and `terminal/*` methods behind the Phase 9 `ProcessSession`-flavored interfaces; the agent pre-generates the session id so terminal requests can carry it. `createAcpFilesystemOperations` from `@arnilo/prism-coding-agent` maps that filesystem seam onto the coding tools' `read`/`write`/`edit` operations. This editor-buffer mode is intentionally hybrid: `repo_list`, `repo_search`, `glob`, `delete`, and `move` remain disk-backed unless the host supplies separate operations; binary/image/document handling never falls back to local disk. Host repo operations remain default when the client fs is absent.
+- **Spawnable ACP coding registry (Task 6).** `@arnilo/prism-acp-agent` wires `createAcpClientFilesystem` and creates a separate coding tool registry per ACP session when the client advertises `fs/read_text_file` or `fs/write_text_file`. That session's `read`/`write`/`edit` operations use editor buffers; without fs advertisement, the existing disk registry is used. `shell`, repository search/list/glob, `delete`, and `move` remain disk-backed in this hybrid mode. Durable approvals resolve the same per-session agent, so one session cannot resume through another session's buffer adapter.
 - **Modes and config options are a pure host overlay.** The agent stores only a thin per-session registry; `apply`/`onChange` hooks narrow the host's own behavior. Mode switches can narrow or host-authorized widen — never a parallel policy evaluator, never a client-enabled tool.
 - **Lifecycle wiring.** Pass your `createCodingLifecycleEmitter()` as `coding.lifecycle`; `file_changed` etc. then flow to streaming sessions. `configuration_changed` broadcasts `config_option_update` (agent-message fallback if the SDK rejects the kind).
 - **Stream budgets.** Every lifecycle update counts against the same per-run stream event/byte budget as prompt updates; overflowing closes the update, never the run.
@@ -151,7 +152,7 @@ const agent = createPrismAcpAgent({
 - **Deny-closed by default.** Unknown mode ids, unadvertised methods, unprojected lifecycle events, oversize diffs/locations/media, thrown projection hooks, and failed elicitation all fail closed. Raw tool arguments/results are never sent unless a projection allow-list says otherwise.
 - **Slash commands (F9).** `commands.list` is a host-owned slash-command list (not derived from the tool registry). The agent emits `available_commands_update` on session start (`session/new`, `session/load`, `session/resume`). Mid-session refresh is not in this release — re-list by starting a session. Names, descriptions, and input hints pass the shared redactor; the list is sliced at `acpCommandsPerUpdate`. Absent seam or a thrown list ⇒ no update.
 - **Projected images (F8).** `AgUiProjection.toolResult` may return `{ type: "image", data, mimeType }` (return-type widening — existing string returns stay valid). The mapper emits `{ type: "content", content: { type: "image", data, mimeType } }` (SDK v1 `ToolCallContent` has no top-level image variant). `data` is the host-supplied base64; it is not redacted and not truncated — payloads over `acpImageBytes` are dropped. Default (no hook / non-image return) emits no image.
-- **Coding-tool projection (F7).** `createCodingToolProjection({ maxDiffBytes? })` is an opt-in `AgUiProjection` for first-party `@arnilo/prism-coding-agent` `edit`/`write` results: `edit` → `toolDiff` (`path` + unified `patch` as `newText`) and `toolLocations` (`path` + `firstChangedLine`); `write` → `toolLocations` (`path` only — write metadata has no file body, so no honest diff; use `file_changed` + `fileDiff` when bodies are needed). Pass as `projection: createCodingToolProjection()` on the agent/mapper. Mapper still redacts and enforces `acpDiffBytes` / `acpLocationsPerUpdate`; optional `maxDiffBytes` pre-truncates the patch so a slightly-oversize edit is shortened instead of dropped. Without the factory, behavior is unchanged (deny-by-default).
+- **Coding-tool projection (F7).** `createCodingToolProjection({ maxDiffBytes? })` is an opt-in `AgUiProjection` for first-party `@arnilo/prism-coding-agent` results: `edit` → `toolDiff` (`path` + unified `patch` as `newText`) and `toolLocations` (`path` + `firstChangedLine`); `write` and `delete` → `toolLocations` (`path` only); `move` → destination `toolLocations` (`metadata.to`, with `from` fallback). No delete/move diff is fabricated. Pass as `projection: createCodingToolProjection()` on the agent/mapper. Mapper still redacts and enforces `acpDiffBytes` / `acpLocationsPerUpdate`; optional `maxDiffBytes` pre-truncates the patch so a slightly-oversize edit is shortened instead of dropped. Without the factory, behavior is unchanged (deny-by-default).
 - **No secrets.** Updates carry no raw file bodies, terminal output is capped by the Phase 9 chunk budget, and the shared redactor is applied before anything leaves the host. `permission_denied` never includes raw args.
 - **Performance.** The adapter is O(1) per update with no unbounded buffering; p95 targets (fs round trip 250 ms, mode switch 250 ms, terminal chunk ack 1000 ms, prompt first update 2000 ms, prompt end 30 s) are recorded by `scripts/benchmark-0.0.27.mjs` and gated in `scripts/budgets.json` `phase10`.
 

package/docs/ag-ui.md

@@ -44,7 +44,9 @@ The handler accepts only `POST` JSON validated with official AG-UI `RunAgentInpu
 
 ## Outputs / response / events
 
-The handler returns `text/event-stream`, one `data: <AG-UI event>\n\n` frame per output. Mapper lifecycle is ordered: `RUN_*`, `STEP_*`, `TEXT_MESSAGE_*`, and `TOOL_CALL_*` are deterministic Prism mappings. Host projectors may additionally prove and emit `STATE_SNAPSHOT`/`STATE_DELTA`, `MESSAGES_SNAPSHOT`, `ACTIVITY_*`, current `REASONING_*`, `RAW`, and named `CUSTOM` values. All values revalidate against official `EventSchemas`; deprecated `THINKING_*` and convenience chunk events are not produced. Active message/tool/reasoning/step sequences close before error, interruption, or finish.
+The handler returns `text/event-stream`, one `data: <AG-UI event>\n\n` frame per output. Mapper lifecycle is ordered: `RUN_*`, `STEP_*`, `TEXT_MESSAGE_*`, and `TOOL_CALL_*` are deterministic Prism mappings. Host projectors may additionally prove and emit `STATE_SNAPSHOT`/`STATE_DELTA`, `MESSAGES_SNAPSHOT`, `ACTIVITY_*`, current `REASONING_*`, `RAW`, and named `CUSTOM` values.
+
+`delegated_agent_step` maps by default to bounded `ACTIVITY_SNAPSHOT` metadata with activity type `prism.delegated_agent_step`; `includeCustomEvents: true` also emits `CUSTOM prism.delegated_agent_step`. The safe payload contains adapter/conversation identifiers, step index/state/kind, duration, token counts, tool/subagent names, and opaque detail references only. Normal assistant text remains `TEXT_MESSAGE_*`; delegated events never duplicate transcript text. Raw event bodies, tool arguments/results, paths, URIs, logs, and hidden thought text remain absent unless a host explicitly supplies a projection. All values revalidate against official `EventSchemas`; deprecated `THINKING_*` and convenience chunk events are not produced. Active message/tool/reasoning/step sequences close before error, interruption, or finish.
 
 A Prism durable `agent_suspended` returns `RUN_FINISHED` with core interrupt id `${runId}:${version}` and a strict `{ decision: "approve" | "deny" }` schema. `projection.interrupt` may attach bounded expiry/metadata or additional host policy interrupts but must retain that core id. Without `interrupts.resume`, one exact entry is required; `cancelled` means deny. An aggregate policy may validate bounded multiple entries, then returns one current-version core decision. Payloads containing `editedArgs`/`args` always deny: Prism does not mutate persisted tool calls. The adapter checks host authorization, selected run, suspended status, and checkpoint version, then calls `AgentRunLifecycle.resumeStream()` once. Claimed/dispatched tools are never replayed.
 
@@ -122,7 +124,7 @@ See runnable network-free [`examples/ag-ui-server.ts`](../examples/ag-ui-server.
 
 All identity, authorization, session/thread mapping, durable checkpoint lookup, persistence selection, replay cursor persistence, transport adaptation, MCP bridge/card configuration, app sandbox DOM, remote A2A task correlation, and optional projection are host-owned. The adapter owns no listener, database, background reconnect loop, credential resolver, or UI state.
 
-`AgUiProjection` is an allow-list. Without a callback, raw tool arguments/results/progress, arbitrary state/patches/transcripts/activity/reasoning/raw events, paths, ACP locations/diffs/terminals/raw I/O, and frontend-supplied tools remain absent. Reasoning signatures do not become AG-UI encrypted values automatically: a host must explicitly provide an already client-encrypted opaque value. `input.project` is also an allow-list: do not merge client state/forwarded props into ownership, identity, tools, permissions, provider options, or media fetch policy.
+`AgUiProjection` is an allow-list. Without a callback, raw tool arguments/results/progress, arbitrary state/patches/transcripts/activity/reasoning/raw events, delegated raw event bodies, paths, ACP locations/diffs/terminals/raw I/O, and frontend-supplied tools remain absent. Reasoning signatures do not become AG-UI encrypted values automatically: a host must explicitly provide an already client-encrypted opaque value. `input.project` is also an allow-list: do not merge client state/forwarded props into ownership, identity, tools, permissions, provider options, or media fetch policy.
 
 ### Reasoning encrypted-value helper (FR-3)
 
@@ -222,4 +224,5 @@ Defaults / hard caps: request 64 KiB / 1 MiB; input 128 / 1024 messages, 32 / 25
 - [MCP bridge/server](mcp-tools.md): `mcpApps` negotiation, bounded resources, and remote tool trust.
 - [A2A interoperability](a2a.md): verified rich task client and remote task lifecycle.
 - [Host security guide](host-security.md): authorization, ownership, redaction, and credential boundaries.
+- [Antigravity delegated agent](antigravity-agent.md): delegated Antigravity CLI execution with timeline step projection.
 - [Work artifacts and review](work-artifacts-and-review.md): durable artifact service that produces the co-work approval/progress/download-link events projected here.

package/docs/agent-events.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-`AgentEvent` is the single observable stream every `AgentSession` run emits. Subscribers receive normalized, redacted, in-order events covering agent lifecycle, assistant message streaming, tool execution, queue updates, subscriber overflow, compaction, retry, artifact validation/refinement, and terminal errors. The stream is in-memory, live-only, and bounded per subscriber by `SubscribeOptions`; there is no durable queue, no background work, and no extra dependency.
+`AgentEvent` is the single observable stream every `AgentSession` run emits. Subscribers receive normalized, redacted, in-order events covering agent lifecycle, assistant message streaming, delegated-agent activity, tool execution, queue updates, subscriber overflow, compaction, retry, artifact validation/refinement, and terminal errors. The stream is in-memory, live-only, and bounded per subscriber by `SubscribeOptions`; there is no durable queue, no background work, and no extra dependency.
 
 Events are emitted by the runtime and by loops through `LoopContext.emit`, both of which route through `redactAgentEvent(event, activeRedactor)` so every payload is secret-redacted before subscribers observe it.
 
@@ -56,6 +56,7 @@ const subscription = session.subscribe({ maxQueuedEvents: 256, overflow: "close"
 for await (const event of subscription) {
   switch (event.type) {
     case "message_delta": // append event.content
+    case "delegated_agent_step": // render bounded external activity
     case "tool_execution_started": // …
     case "artifact_failed": // budget exhausted
       break;
@@ -71,6 +72,7 @@ The `AgentEvent` union (grouped by concern):
 | Turns | `turn_started`, `turn_finished` |
 | Provider turns | `provider_turn_started`, `provider_turn_finished` |
 | Assistant messages | `message_started`, `message_delta`, `message_finished` |
+| Delegated agents | `delegated_agent_step` |
 | Tool execution | `tool_execution_started`, `tool_execution_progress`, `tool_execution_finished`, `tool_execution_error`, `tool_execution_blocked` |
 | Guardrails | `guardrail_decision` |
 | Queue/subscribers | `queue_updated`, `event_subscriber_overflow`, `steer_rejected` |
@@ -95,6 +97,11 @@ Agent / turn / message events:
 | `turn_started` / `turn_finished` | `sessionId`, `runId`, `turn: number` |
 | `message_started` / `message_finished` | `sessionId`, `runId`, `message: Message` |
 | `message_delta` | `sessionId`, `runId`, `content: ContentBlock` (`tool_call_delta` fragments may appear here for live UI streaming; stored messages use final `tool_call` blocks) |
+| `delegated_agent_step` | `sessionId`, `runId`, `adapterId`, `externalConversationId` (≤512 UTF-8 bytes), `stepIndex`, `state`, `kind`, optional `durationMs`, token-only `usage`, `toolName`, `subagentType`, and opaque `detail` references |
+
+`delegated_agent_step` is a safe timeline event for an adapter-owned loop. `kind` is one of `assistant`, `tool`, `subagent`, `checkpoint`, or `unknown`; unknown external step kinds normalize to `unknown`. It never carries raw arguments, results, paths, URIs, logs, event bodies, or hidden thought text. `thinkingTokens` is a count only. The constructor and existing event-source default cap keep serialized events at 64 KiB.
+
+Adapters should call `createDelegatedAgentStep({ sessionId, runId, adapterId, externalConversationId, stepIndex, state, kind, usage })` rather than forwarding external JSON. The constructor allow-lists fields and fails closed on malformed or oversized identifiers/counters.
 
 `message_delta.content.type === "tool_call_delta"` carries `{ index, id?, name?, argumentsText? }`. Treat it as a streaming fragment. The runtime reconstructs and persists a final `tool_call` before executing tools. Deltas missing `id`/`name` at stream end fail the provider turn with `ErrorInfo.code: "incomplete_delta"` (typed `ProviderTransportError`); they never throw a bare `Error`. Malformed JSON with id+name present recovers as a blocked tool result (`invalid_json_arguments`) instead.