@borgee/agents-host 0.2.29 → 0.2.32

package/dist/update/update-notice.js

@@ -0,0 +1,161 @@
+import { promises as fs } from 'node:fs';
+import { dirname } from 'node:path';
+import { HostLogger, resolveAgentsHostDebugMode } from '../debug.js';
+import { resolveUpdateCheckCachePath } from '../state-paths.js';
+import { classifyPackageInstallation, resolvePackageLocation, } from './package-installation.js';
+import { readConfiguredRegistry, readPublishedVersion } from './package-manager.js';
+import { isNewerSemanticVersion, isSemanticVersion } from './semantic-version.js';
+export const DISABLE_UPDATE_CHECK_ENV = 'AGENTS_HOST_DISABLE_UPDATE_CHECK';
+const UPDATE_CHECK_CACHE_TTL_MS = 6 * 60 * 60 * 1000;
+const UPDATE_CHECK_TIMEOUT_MS = 5000;
+/**
+ * Every failure under the update check is swallowed, so `AGENTS_HOST_DEBUG=1`
+ * is the only way an operator can find out why a notice never appeared.
+ */
+function createUpdateCheckLogger(env, deps) {
+    return new HostLogger({ debug: resolveAgentsHostDebugMode(false, env), logger: deps.logger });
+}
+async function readCacheFile(path) {
+    return fs.readFile(path, 'utf8');
+}
+async function writeCacheFile(path, contents) {
+    await fs.mkdir(dirname(path), { recursive: true });
+    // Write-then-rename: a concurrent start never observes a half-written entry,
+    // and a symlink planted at the cache path is replaced rather than followed.
+    const tempPath = `${path}.${process.pid}.tmp`;
+    try {
+        await fs.writeFile(tempPath, contents, { encoding: 'utf8', mode: 0o600 });
+        await fs.rename(tempPath, path);
+    }
+    catch (error) {
+        await fs.rm(tempPath, { force: true });
+        throw error;
+    }
+}
+function parseCacheEntry(contents) {
+    const parsed = JSON.parse(contents);
+    if (typeof parsed !== 'object' || parsed === null) {
+        throw new Error('Update check cache is not an object');
+    }
+    const { checkedAt, registry, latestVersion } = parsed;
+    if (typeof checkedAt !== 'number' || !Number.isFinite(checkedAt)) {
+        throw new Error('Update check cache carries no checkedAt timestamp');
+    }
+    if (typeof registry !== 'string' || registry.length === 0) {
+        throw new Error('Update check cache carries no registry');
+    }
+    if (latestVersion === null) {
+        return { checkedAt, registry, latestVersion: null };
+    }
+    if (typeof latestVersion !== 'string' || !isSemanticVersion(latestVersion)) {
+        throw new Error('Update check cache carries no semantic latestVersion');
+    }
+    return { checkedAt, registry, latestVersion };
+}
+export function isUpdateCheckDisabled(env) {
+    return env[DISABLE_UPDATE_CHECK_ENV]?.trim() === '1';
+}
+/**
+ * Resolves the newest published release for the running installation, or `null`
+ * when there is nothing worth telling the operator.
+ *
+ * Source checkouts never check: their version is whatever the working tree
+ * says, and `agents-host update` is the wrong advice for a git tree. That is
+ * settled from the path alone, so `pnpm dev` never spawns a package manager.
+ * Which manager owns a real install is only asked once there is a notice to
+ * word, so a start with nothing to report never pays for that either.
+ */
+export async function resolveAvailableUpdate(options = {}, deps = {}) {
+    const env = options.env ?? process.env;
+    if (isUpdateCheckDisabled(env)) {
+        return null;
+    }
+    const resolveLocation = deps.resolveLocation ?? (() => resolvePackageLocation());
+    const location = await resolveLocation();
+    if (location.nodeModulesOwnerDir === null) {
+        return null;
+    }
+    const latestVersion = await resolveLatestPublishedVersion(env, location, deps);
+    if (latestVersion === null || !isNewerSemanticVersion(latestVersion, location.version)) {
+        return null;
+    }
+    const classifyInstallation = deps.classifyInstallation ??
+        ((candidate) => classifyPackageInstallation(candidate));
+    return { installation: await classifyInstallation(location), latestVersion };
+}
+async function resolveLatestPublishedVersion(env, location, deps) {
+    const now = deps.now ?? Date.now;
+    const readCache = deps.readCache ?? readCacheFile;
+    const writeCache = deps.writeCache ?? writeCacheFile;
+    const readRegistry = deps.readRegistry ?? readConfiguredRegistry;
+    const readLatestVersion = deps.readLatestVersion ?? readPublishedVersion;
+    const logger = createUpdateCheckLogger(env, deps);
+    const cachePath = resolveUpdateCheckCachePath(env);
+    const [cached, registry] = await Promise.all([
+        readCache(cachePath)
+            .then(parseCacheEntry)
+            .catch((error) => {
+            // A missing or damaged advisory cache only costs one registry request.
+            logger.debugError('update check cache unreadable', error);
+            return null;
+        }),
+        readRegistry(UPDATE_CHECK_TIMEOUT_MS),
+    ]);
+    const checkedAt = now();
+    if (cached !== null && cached.registry === registry) {
+        // An entry stamped in the future — a clock that has since been corrected,
+        // or a poisoned cache — would otherwise stay "fresh" forever and pin the
+        // operator on a stale release, so only an age inside the window counts.
+        const age = checkedAt - cached.checkedAt;
+        if (age >= 0 && age < UPDATE_CHECK_CACHE_TTL_MS) {
+            return cached.latestVersion;
+        }
+    }
+    const persist = (latestVersion) => writeCache(cachePath, `${JSON.stringify({ checkedAt, registry, latestVersion })}\n`).catch((error) => {
+        logger.debugError('update check cache not persisted', error);
+    });
+    let latestVersion;
+    try {
+        latestVersion = await readLatestVersion(location.packageName, UPDATE_CHECK_TIMEOUT_MS);
+    }
+    catch (error) {
+        // Record the failed attempt: an unreachable registry must cost the deadline
+        // once per TTL, not on every single start.
+        await persist(null);
+        throw error;
+    }
+    await persist(latestVersion);
+    return latestVersion;
+}
+function renderUpdateNotice(update) {
+    const { installation, latestVersion } = update;
+    const headline = `update available: ${installation.version} -> ${latestVersion}`;
+    if (installation.kind === 'project') {
+        return [
+            headline,
+            `update ${installation.packageName} in ${installation.projectRootDir} to pick it up`,
+        ];
+    }
+    return [headline, 'run `agents-host update` to install it'];
+}
+/**
+ * Startup-path entry point. The notice is advisory, so every failure below it —
+ * offline machine, unreachable registry, unreadable cache — is logged in debug
+ * mode and then dropped: a registry outage must never keep an agent from
+ * starting. It writes to stderr so machine-readable stdout stays clean.
+ */
+export async function emitUpdateNotice(options = {}, deps = {}) {
+    const logger = createUpdateCheckLogger(options.env ?? process.env, deps);
+    try {
+        const update = await resolveAvailableUpdate(options, deps);
+        if (update === null) {
+            return;
+        }
+        for (const line of renderUpdateNotice(update)) {
+            logger.error(line);
+        }
+    }
+    catch (error) {
+        logger.debugError('update check failed', error);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@borgee/agents-host",
-  "version": "0.2.29",
+  "version": "0.2.32",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -22,11 +22,12 @@
   },
   "license": "MIT",
   "dependencies": {
+    "@agentclientprotocol/claude-agent-acp": "0.64.0",
     "@agentclientprotocol/codex-acp": "1.1.7",
     "@agentclientprotocol/sdk": "1.3.0",
     "cross-spawn": "^7.0.6",
     "yaml": "^2.8.1",
-    "@borgee/plugin-sdk": "0.2.4"
+    "@borgee/plugin-sdk": "0.2.5"
   },
   "devDependencies": {
     "@types/cross-spawn": "^6.0.6",
@@ -47,6 +48,8 @@
     "typecheck": "tsc --noEmit",
     "pretest": "pnpm --filter @borgee/plugin-sdk build",
     "test": "vitest run --testTimeout=10000",
+    "pretest:e2e": "pnpm --filter @borgee/plugin-sdk build",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts --testTimeout=120000",
     "pretypecheck": "pnpm --filter @borgee/plugin-sdk build"
   }
 }

package/skills/borgee-agent/SKILL.md

@@ -23,10 +23,12 @@ Use one of the packaged local CLIs to inspect the current channel bootstrap payl
 - Python auxiliary mention: `python3 ./borgee-agent.py --context /absolute/path/to/context.json --auth-path /absolute/path/to/.localhost-gateway-auth.json --turn-execution-id turn-id --send-mention user-id --body "Need review from <@user-id>"`
 - Python auxiliary reply: `python3 ./borgee-agent.py --context /absolute/path/to/context.json --auth-path /absolute/path/to/.localhost-gateway-auth.json --turn-execution-id turn-id --send-message --body "Following up here" --reply-to message-id`
 
-When the injected `context.json` includes `taskAssignmentContext.active: true`, the same CLIs also expose the task-thread compatibility surface:
+The same CLIs also expose the task commands. Which ones apply depends on where the turn runs, which the injected `context.json` reports through `taskAssignmentContext`:
 
-- In ordinary parent channels: `--create-task`, `--list-tasks`, `--get-task --task-id ...`, `--update-task --task-id ...`
-- In task-assignment threads: `--get-task` and `--update-task` may omit `--task-id` and resolve the current thread task through the persisted `currentTaskId` or an agents-host local fallback; `--create-task` and `--list-tasks` stay disabled there and must be run from the parent channel
+- Parent channel (no `taskAssignmentContext.active`): `--create-task --title ...`, `--list-tasks`, `--get-task --task-id ...`, `--update-task --task-id ...`, `--read-task-history --task-id ...`
+- Task-assignment thread (`taskAssignmentContext.active: true`): `--get-task` and `--update-task` may omit `--task-id` and resolve the current thread task through the persisted `currentTaskId` or an agents-host local fallback; `--read-task-history --task-id ...` still works for that thread's own task, while `--create-task` and `--list-tasks` stay disabled and must be run from the parent channel
+
+`--read-task-history` reads the messages inside a task's thread and always requires an explicit `--task-id`; inside that task's own thread `--read-history` already reads the same messages, so the turn prompt offers the command in the parent channel only. It accepts the same `--limit` / `--before` / `--after` window as `--read-history` and answers the same not-found error for a task outside the current channel as for a task that does not exist.
 
 The private draft snapshot is read-only, collaboration-scoped, and separate from ordinary public channel messages.
 Auxiliary sends are only for short targeted escalation, reply-thread nudges, or mentions. They must not be used for the main final answer body, which still belongs to AgentsHost.

package/skills/borgee-agent/borgee-agent.mjs

@@ -6,6 +6,11 @@ const TASK_THREAD_COLLECTION_COMMAND_ERROR
   = 'Task assignment threads only support --get-task and --update-task. Create/list tasks belong to the parent channel.';
 const TASK_THREAD_MISSING_TASK_ID_ERROR
   = 'Task assignment thread could not resolve the current task from persisted context or local fallback. Pass --task-id explicitly.';
+// A window value outside the IEEE-754 safe integer range does not survive this CLI: it parses
+// the value to a number and re-stringifies it into the query string, so `1000000000000000000000`
+// leaves as `1e+21` and the gateway's `Number.parseInt(value, 10)` reads it back as `1` — a
+// different page, silently. Both packaged CLIs accept exactly this grammar.
+const INTEGER_ARGUMENT_PATTERN = /^[+-]?[0-9]+$/;
 
 function parseArgs(argv) {
   let contextPath;
@@ -36,10 +41,13 @@ function parseArgs(argv) {
     if (value == null) {
       throw new Error(`Missing value after ${flag}`);
     }
-    const parsed = Number.parseInt(value, 10);
-    if (!Number.isFinite(parsed)) {
+    if (!INTEGER_ARGUMENT_PATTERN.test(value)) {
       throw new Error(`Invalid integer for ${flag}: ${value}`);
     }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+      throw new Error(`Integer out of range for ${flag}: ${value}`);
+    }
     return parsed;
   }
 
@@ -80,6 +88,10 @@ function parseArgs(argv) {
       setAction('read-history');
       continue;
     }
+    if (arg === '--read-task-history') {
+      setAction('read-task-history');
+      continue;
+    }
     if (arg === '--read-draft') {
       setAction('read-draft');
       continue;
@@ -215,16 +227,39 @@ function ensureVisibleMentions(body, participantIds) {
   );
 }
 
-function explicitTaskIdProvided(options) {
-  return typeof options.taskId === 'string' && options.taskId.trim().length > 0;
+function explicitTaskId(options) {
+  const taskId = typeof options.taskId === 'string' ? options.taskId.trim() : '';
+  return taskId.length > 0 ? taskId : null;
+}
+
+function missingTaskIdError(action) {
+  return new Error(`Missing required --task-id <value> for --${action}`);
+}
+
+function requireExplicitTaskId(action, options) {
+  const taskId = explicitTaskId(options);
+  if (taskId === null) {
+    throw missingTaskIdError(action);
+  }
+  return taskId;
+}
+
+function applyHistoryWindow(url, options) {
+  if (options.limit != null) {
+    url.searchParams.set('limit', String(options.limit));
+  }
+  if (options.before != null) {
+    url.searchParams.set('before', String(options.before));
+  }
+  if (options.after != null) {
+    url.searchParams.set('after', String(options.after));
+  }
 }
 
 function resolveTaskId(payload, action, options) {
-  const explicitTaskId = typeof options.taskId === 'string'
-    ? options.taskId.trim()
-    : '';
-  if (explicitTaskId) {
-    return explicitTaskId;
+  const taskId = explicitTaskId(options);
+  if (taskId !== null) {
+    return taskId;
   }
   if (payload.taskAssignmentContext?.active === true) {
     const persistedTaskId = typeof payload.taskAssignmentContext.currentTaskId === 'string'
@@ -235,7 +270,7 @@ function resolveTaskId(payload, action, options) {
     }
     return null;
   }
-  throw new Error(`Missing required --task-id <value> for --${action}`);
+  throw missingTaskIdError(action);
 }
 
 function resolveGatewayRequest(payload, action, options) {
@@ -256,15 +291,13 @@ function resolveGatewayRequest(payload, action, options) {
       return { url: new URL(`/v1/channels/${encodedChannelId}/me`, gateway.baseUrl), method: 'GET' };
     case 'read-history': {
       const url = new URL(`/v1/channels/${encodedChannelId}/history`, gateway.baseUrl);
-      if (options.limit != null) {
-        url.searchParams.set('limit', String(options.limit));
-      }
-      if (options.before != null) {
-        url.searchParams.set('before', String(options.before));
-      }
-      if (options.after != null) {
-        url.searchParams.set('after', String(options.after));
-      }
+      applyHistoryWindow(url, options);
+      return { url, method: 'GET' };
+    }
+    case 'read-task-history': {
+      const taskId = requireExplicitTaskId(action, options);
+      const url = new URL(`/v1/tasks/${encodeURIComponent(taskId)}/history`, gateway.baseUrl);
+      applyHistoryWindow(url, options);
       return { url, method: 'GET' };
     }
     case 'read-draft': {
@@ -298,7 +331,7 @@ function resolveGatewayRequest(payload, action, options) {
       return { url: new URL(`/v1/channels/${encodedChannelId}/tasks`, gateway.baseUrl), method: 'GET' };
     case 'get-task': {
       const taskId = resolveTaskId(payload, action, options);
-      if (payload.taskAssignmentContext?.active === true && !explicitTaskIdProvided(options)) {
+      if (payload.taskAssignmentContext?.active === true && explicitTaskId(options) === null) {
         return {
           url: new URL(`/v1/channels/${encodedChannelId}/current-task`, gateway.baseUrl),
           method: 'GET',
@@ -317,11 +350,12 @@ function resolveGatewayRequest(payload, action, options) {
         ...(options.status != null ? { status: options.status } : {}),
         ...(options.assigneeId != null ? { assigneeId: options.assigneeId } : {}),
         ...(options.title != null ? { title: options.title } : {}),
+        ...(options.description != null ? { description: options.description } : {}),
       };
       if (Object.keys(requestBody).length === 0) {
-        throw new Error('At least one of --status, --assignee-id, or --title is required for --update-task');
+        throw new Error('At least one of --status, --assignee-id, --title, or --description is required for --update-task');
       }
-      if (payload.taskAssignmentContext?.active === true && !explicitTaskIdProvided(options)) {
+      if (payload.taskAssignmentContext?.active === true && explicitTaskId(options) === null) {
         return {
           url: new URL(`/v1/channels/${encodedChannelId}/current-task`, gateway.baseUrl),
           method: 'PATCH',

package/skills/borgee-agent/borgee-agent.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import re
 import sys
 from pathlib import Path
 from urllib.error import HTTPError
@@ -17,15 +18,23 @@ TASK_THREAD_MISSING_TASK_ID_ERROR = (
     "Task assignment thread could not resolve the current task from persisted context "
     "or local fallback. Pass --task-id explicitly."
 )
+# Python ints are arbitrary precision, so nothing can be rounded on the way into the query
+# string; the bound is here only so both packaged CLIs accept and reject exactly the same
+# inputs. It is the Node CLI that needs it: there an out-of-range magnitude re-stringifies as
+# `1e+21`, which the gateway's `Number.parseInt(value, 10)` reads back as `1`.
+INTEGER_ARGUMENT_PATTERN = re.compile(r"[+-]?[0-9]+")
+MAX_SAFE_INTEGER = 2**53 - 1
 
 
 def parse_int(flag: str, value: str | None) -> int:
     if value is None:
         raise ValueError(f"Missing value after {flag}")
-    try:
-        return int(value)
-    except ValueError as exc:
-        raise ValueError(f"Invalid integer for {flag}: {value}") from exc
+    if not INTEGER_ARGUMENT_PATTERN.fullmatch(value):
+        raise ValueError(f"Invalid integer for {flag}: {value}")
+    parsed = int(value)
+    if abs(parsed) > MAX_SAFE_INTEGER:
+        raise ValueError(f"Integer out of range for {flag}: {value}")
+    return parsed
 
 
 def parse_args(argv: list[str]) -> dict[str, object]:
@@ -80,6 +89,8 @@ def parse_args(argv: list[str]) -> dict[str, object]:
             set_action("get-me")
         elif arg == "--read-history":
             set_action("read-history")
+        elif arg == "--read-task-history":
+            set_action("read-task-history")
         elif arg == "--read-draft":
             set_action("read-draft")
         elif arg == "--list-users":
@@ -185,22 +196,42 @@ def ensure_visible_mentions(body: str, participant_ids: list[str]) -> str:
     return next_body
 
 
-def explicit_task_id_provided(options: dict[str, object]) -> bool:
+def explicit_task_id(options: dict[str, object]) -> str | None:
     task_id = options.get("task_id")
-    return isinstance(task_id, str) and bool(task_id.strip())
+    trimmed = task_id.strip() if isinstance(task_id, str) else ""
+    return trimmed if trimmed else None
+
+
+def missing_task_id_error(action: str) -> ValueError:
+    return ValueError(f"Missing required --task-id <value> for --{action}")
+
+
+def require_explicit_task_id(action: str, options: dict[str, object]) -> str:
+    task_id = explicit_task_id(options)
+    if task_id is None:
+        raise missing_task_id_error(action)
+    return task_id
+
+
+def history_query_suffix(options: dict[str, object]) -> str:
+    query: dict[str, str] = {}
+    for key in ("limit", "before", "after"):
+        if options.get(key) is not None:
+            query[key] = str(options[key])
+    return f"?{urlencode(query)}" if query else ""
 
 
 def resolve_task_id(payload: dict[str, object], action: str, options: dict[str, object]) -> str | None:
-    task_id = options.get("task_id")
-    if isinstance(task_id, str) and task_id.strip():
-        return task_id.strip()
+    task_id = explicit_task_id(options)
+    if task_id is not None:
+        return task_id
     task_assignment_context = payload.get("taskAssignmentContext")
     if isinstance(task_assignment_context, dict) and task_assignment_context.get("active") is True:
         current_task_id = task_assignment_context.get("currentTaskId")
         if isinstance(current_task_id, str) and current_task_id.strip():
             return current_task_id.strip()
         return None
-    raise ValueError(f"Missing required --task-id <value> for --{action}")
+    raise missing_task_id_error(action)
 
 
 def resolve_gateway_request(
@@ -225,15 +256,10 @@ def resolve_gateway_request(
     if action == "get-me":
         return f"{base_url}/v1/channels/{channel_id}/me", "GET", None, False
     if action == "read-history":
-        query: dict[str, str] = {}
-        if options.get("limit") is not None:
-            query["limit"] = str(options["limit"])
-        if options.get("before") is not None:
-            query["before"] = str(options["before"])
-        if options.get("after") is not None:
-            query["after"] = str(options["after"])
-        suffix = f"?{urlencode(query)}" if query else ""
-        return f"{base_url}/v1/channels/{channel_id}/history{suffix}", "GET", None, False
+        return f"{base_url}/v1/channels/{channel_id}/history{history_query_suffix(options)}", "GET", None, False
+    if action == "read-task-history":
+        task_id = quote(require_explicit_task_id(action, options), safe="")
+        return f"{base_url}/v1/tasks/{task_id}/history{history_query_suffix(options)}", "GET", None, False
     if action == "read-draft":
         turn_execution_id = options.get("turn_execution_id")
         if not isinstance(turn_execution_id, str) or not turn_execution_id.strip():
@@ -258,7 +284,7 @@ def resolve_gateway_request(
         return f"{base_url}/v1/channels/{channel_id}/tasks", "GET", None, False
     if action == "get-task":
         task_id = resolve_task_id(payload, action, options)
-        if isinstance(task_assignment_context, dict) and task_assignment_context.get("active") is True and not explicit_task_id_provided(options):
+        if isinstance(task_assignment_context, dict) and task_assignment_context.get("active") is True and explicit_task_id(options) is None:
             return f"{base_url}/v1/channels/{channel_id}/current-task", "GET", None, True
         return f"{base_url}/v1/tasks/{quote(str(task_id), safe='')}", "GET", None, False
     if action == "update-task":
@@ -270,9 +296,11 @@ def resolve_gateway_request(
             request_body["assigneeId"] = options["assignee_id"]
         if options.get("title") is not None:
             request_body["title"] = options["title"]
+        if options.get("description") is not None:
+            request_body["description"] = options["description"]
         if not request_body:
-            raise ValueError("At least one of --status, --assignee-id, or --title is required for --update-task")
-        if isinstance(task_assignment_context, dict) and task_assignment_context.get("active") is True and not explicit_task_id_provided(options):
+            raise ValueError("At least one of --status, --assignee-id, --title, or --description is required for --update-task")
+        if isinstance(task_assignment_context, dict) and task_assignment_context.get("active") is True and explicit_task_id(options) is None:
             return f"{base_url}/v1/channels/{channel_id}/current-task", "PATCH", request_body, True
         return f"{base_url}/v1/tasks/{quote(str(task_id), safe='')}", "PATCH", request_body, False
     raise ValueError(f"Unsupported gateway action: {action}")
@@ -294,11 +322,11 @@ def read_gateway_auth(auth_path: Path | None, expected_channel_id: object) -> di
 
 
 def call_gateway(payload: dict[str, object], action: str, options: dict[str, object]) -> object:
+    url, method, request_body, uses_current_thread_fallback = resolve_gateway_request(payload, action, options)
     auth = read_gateway_auth(
         options.get("auth_path") if isinstance(options.get("auth_path"), Path) else None,
         payload.get("channelId"),
     )
-    url, method, request_body, uses_current_thread_fallback = resolve_gateway_request(payload, action, options)
 
     data = None
     headers = {"Authorization": f"Bearer {auth['token']}"}
@@ -339,11 +367,12 @@ def call_gateway(payload: dict[str, object], action: str, options: dict[str, obj
             response_body = response.read().decode("utf-8")
             return json.loads(response_body) if response_body else None
     except HTTPError as exc:
-        if uses_current_thread_fallback and exc.code == 404:
+        error_body = exc.read().decode("utf-8")
+        error_payload = json.loads(error_body) if error_body else None
+        if uses_current_thread_fallback and isinstance(error_payload, dict) and error_payload.get("error") == "not_found":
             raise RuntimeError(TASK_THREAD_MISSING_TASK_ID_ERROR) from exc
-        raise RuntimeError(f"Gateway request failed: {exc}") from exc
-    except Exception as exc:
-        raise RuntimeError(f"Gateway request failed: {exc}") from exc
+        reported_body = json.dumps(error_payload, separators=(",", ":"), ensure_ascii=False)
+        raise RuntimeError(f"Gateway request failed with {exc.code}: {reported_body}") from exc
 
 
 def redact_bootstrap(payload: dict[str, object], context_path: Path) -> dict[str, object]: