@claudexor/orchestrator 3.20.1 → 3.23.0

package/dist/inrun-continuity-types.d.ts

@@ -0,0 +1,105 @@
+/** Inputs shared by the in-run controller and its I/O helpers. */
+import type { AnswerAssembly, HarnessAdapter } from "@claudexor/core";
+import type { CredentialProfile, HarnessRunSpec, QuotaSnapshot, RunEventType, RunResumable } from "@claudexor/schema";
+import type { AttemptOutputMarkers } from "./attemptOutputMarkers.js";
+import type { AttemptTelemetry, TransientFailureObservation } from "./attemptTelemetry.js";
+import type { ModelGovernedRoute } from "./modelGovernance.js";
+import type { ProfilePolicy, rotateSpecOnTypedLimit } from "./credential-profile-rotation.js";
+import type { PreProgressRefusalSubject } from "./pre-progress-refusal.js";
+import type { TransientRetryPolicy } from "./runSupport.js";
+import type { ContinuedTry } from "./inrun-continuity-carrier.js";
+import type { PredecessorEvidenceSource } from "./continuation-evidence.js";
+type ContinuityEmit = (type: RunEventType, payload: Record<string, unknown>) => void;
+export interface InRunContinuityDeps {
+    adapter: HarnessAdapter;
+    runId: string;
+    attemptId: string;
+    /** The run dir (`paths.root`) — the evidence index reads `events.jsonl` there. */
+    runDir: string;
+    attemptDir: string;
+    /** Execution root the child runs in. */
+    cwd: string;
+    workspace: RunResumable["workspace"];
+    /** The caller's original prompt (the work order), for the evidence index. */
+    workOrder: string;
+    /** The first try's full prompt (engine constraints included) — the packet carrier resends it. */
+    firstPrompt: string;
+    registry: readonly CredentialProfile[];
+    policy: ProfilePolicy;
+    snapshots: readonly QuotaSnapshot[];
+    retryPolicy: TransientRetryPolicy;
+    pinned: boolean;
+    defaultRouteWasVendorNative: boolean;
+    requestedProfileId: string | null;
+    /** False when the lane has no RunInput: rotation never fired there, and still does not. */
+    rotationEnabled: boolean;
+    laneEnvFor: (profileId: string | null) => Record<string, string> | null;
+    probeReadyProfiles: (spec: HarnessRunSpec, tried: Set<string>) => Promise<ReadonlySet<string>>;
+    rotationObservations: (spec: HarnessRunSpec, transients: readonly TransientFailureObservation[], refusal: PreProgressRefusalSubject | null) => Pick<Parameters<typeof rotateSpecOnTypedLimit>[0], "probeCurrentSubject" | "liveUnusable" | "notePreProgressRefusal">;
+    emit: ContinuityEmit;
+    /** The model-governed route: an attested model is pinned only if it lists the id. */
+    route?: ModelGovernedRoute;
+    newSessionId: () => string;
+    /** First try of a continueFrom successor: predecessor progress and receipt. */
+    seed?: {
+        acted: boolean;
+        completed?: boolean;
+        continued: ContinuedTry;
+        evidenceSources?: readonly PredecessorEvidenceSource[];
+    } | null;
+    /** Thread facts for the moved-session disclosure (INV-137); null outside a thread. */
+    thread: {
+        threadId: string;
+        turnId: string | null;
+        onSessionObserved?: (harnessId: string, nativeSessionId: string, observedModel?: string | null, profileId?: string | null) => void;
+        onContinuityResolved?: (turnId: string, disclosure: {
+            kind: "native_resume" | "packet" | "fresh";
+            packetTurns: number;
+            summarized: boolean;
+            laneSwitchedFrom: {
+                harness: string;
+                profileId: string | null;
+            } | null;
+        }) => void;
+    } | null;
+}
+/** What the loop knows when a try has settled. */
+export interface TryFacts {
+    runSpec: HarnessRunSpec;
+    nativeTry: number;
+    harnessErrored: boolean;
+    aborted: boolean;
+    budgetStopped?: boolean;
+    requestRefused: boolean;
+    newTransients: readonly TransientFailureObservation[];
+    sawTypedLimit: boolean;
+    sawRetryable: boolean;
+    answer: AnswerAssembly;
+    /** Today's transient-gate fact (raw: workspace unchanged and no answer text). */
+    rawDeliverableEmpty: boolean;
+    /** Candidate lane: the workspace diff is non-empty (the read-only lane omits it). */
+    workspaceDiffNonEmpty?: boolean;
+    /** The current workspace diff when the lane has one (evidence index file list). */
+    currentDiff?: string;
+    markers: AttemptOutputMarkers;
+    lastLimit: {
+        retryDelayMs: number | null;
+        resetsAt: string | null;
+    } | null;
+    refusal: PreProgressRefusalSubject | null;
+    telemetry: AttemptTelemetry;
+}
+export type AfterTryVerdict = {
+    kind: "continue";
+    spec: HarnessRunSpec;
+    delayMs: number;
+}
+/** A typed terminal (pinned limit, pool spent): the loop records the error and stops. */
+ | {
+    kind: "terminal";
+    error: Error;
+} | {
+    kind: "break";
+};
+export {};
+//# sourceMappingURL=inrun-continuity-types.d.ts.map

package/dist/inrun-continuity-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inrun-continuity-types.d.ts","sourceRoot":"","sources":["../src/inrun-continuity-types.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,YAAY,EACZ,YAAY,EACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAE5E,KAAK,cAAc,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AAErF,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IACrC,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,WAAW,EAAE,oBAAoB,CAAC;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,2BAA2B,EAAE,OAAO,CAAC;IACrC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2FAA2F;IAC3F,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACxE,kBAAkB,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/F,oBAAoB,EAAE,CACpB,IAAI,EAAE,cAAc,EACpB,UAAU,EAAE,SAAS,2BAA2B,EAAE,EAClD,OAAO,EAAE,yBAAyB,GAAG,IAAI,KACtC,IAAI,CACP,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAC5C,qBAAqB,GAAG,cAAc,GAAG,wBAAwB,CAClE,CAAC;IACF,IAAI,EAAE,cAAc,CAAC;IACrB,qFAAqF;IACrF,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,YAAY,CAAC;QACxB,eAAe,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;KACxD,GAAG,IAAI,CAAC;IACT,sFAAsF;IACtF,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,KACtB,IAAI,CAAC;QACV,oBAAoB,CAAC,EAAE,CACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE;YACV,IAAI,EAAE,eAAe,GAAG,QAAQ,GAAG,OAAO,CAAC;YAC3C,WAAW,EAAE,MAAM,CAAC;YACpB,UAAU,EAAE,OAAO,CAAC;YACpB,gBAAgB,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;aAAE,GAAG,IAAI,CAAC;SACxE,KACE,IAAI,CAAC;KACX,GAAG,IAAI,CAAC;CACV;AAED,kDAAkD;AAClD,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,cAAc,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACtD,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,cAAc,CAAC;IACvB,iFAAiF;IACjF,mBAAmB,EAAE,OAAO,CAAC;IAC7B,qFAAqF;IACrF,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC1C,SAAS,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC7D,yFAAyF;GACvF;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC"}

package/dist/inrun-continuity-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=inrun-continuity-types.js.map

package/dist/inrun-continuity-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inrun-continuity-types.js","sourceRoot":"","sources":["../src/inrun-continuity-types.ts"],"names":[],"mappings":""}

package/dist/inrun-continuity.d.ts

@@ -0,0 +1,79 @@
+import { type HarnessEvent, type HarnessRunSpec, type ResumableCause, type RunResumable, type WorkState } from "@claudexor/schema";
+import type { AttemptOutputMarkers } from "./attemptOutputMarkers.js";
+import type { AfterTryVerdict, InRunContinuityDeps, TryFacts } from "./inrun-continuity-types.js";
+import type { ContinuityTerminalFacts } from "./continuity-terminal.js";
+export declare class InRunContinuity {
+    private readonly deps;
+    private capsule;
+    private acted;
+    private nativeRejected;
+    private readonly triedProfiles;
+    private sameAccountTries;
+    private lastCause;
+    private limit;
+    private terminalCode;
+    private tryIndex;
+    private tryAbort;
+    private tryStarted;
+    private expectedSessionId;
+    private tryModel;
+    private tryRequestedModel;
+    private tryIdentity;
+    private tryFirstInputTokens;
+    private continued;
+    private pending;
+    private packetSession;
+    private threadSwitch;
+    private readonly retainedOutput;
+    /** Carrier of the try that just settled (null = the first try or a fresh replay). */
+    private settledCarrier;
+    private unstartedInputs;
+    constructor(deps: InRunContinuityDeps);
+    /** The loop calls this before each try spawns; `abort` is THIS try's controller. */
+    beginTry(runSpec: HarnessRunSpec, nativeTry: number, abort: AbortController): void;
+    /**
+     * Observe one stream event. Returns the typed error that STOPS the try now
+     * (the resumed session is not the one requested — a mismatch caught before
+     * effects when no agent progress was seen yet; the child is aborted), else
+     * null.
+     */
+    observe(ev: HarnessEvent, runSpec: HarnessRunSpec, markers: AttemptOutputMarkers): string | null;
+    /** Both loops consult this only after the controller accepts the handshake. */
+    get mayPublishSession(): boolean;
+    /** Decide what the attempt does after a settled try. */
+    afterTry(facts: TryFacts): Promise<AfterTryVerdict>;
+    /** Receipts, capsule relocation and the terminal `resumable` block once the attempt ends. */
+    finish(input: {
+        runSpec: HarnessRunSpec;
+        errored: boolean;
+        nonSuccess?: boolean;
+        aborted: boolean;
+        cancelReason: string | null;
+        workState: WorkState | null | undefined;
+    }): Promise<RunResumable | null>;
+    /** Keep a snapshot for gates/review/arbitration that can fail after this try completed. */
+    terminalFacts(resumable: RunResumable | null): ContinuityTerminalFacts;
+    resumable(cause: ResumableCause): RunResumable;
+    private poolTerminal;
+    private breakWith;
+    /** Today's rules for an attempt that did not act: typed-limit / structural
+     * rotation onto a fresh session, then the same-profile transient gate. */
+    private legacy;
+    /** A typed vendor limit ended a try that acted: hop with the session (2A) or a packet (1B). */
+    private afterLimit;
+    /** The process died after progress: the same account resumes its session
+     * (bounded), or re-briefs once a typed fact rejected that session. With no
+     * session recorded at all (the harness never reported one) the same account
+     * continues on a new session re-briefed by the evidence index (owner 1B),
+     * under the same bound. */
+    private afterTransport;
+    private rotate;
+    private hopped;
+    private inLaneHome;
+    /** Plan and prepare the carrier for the next try, then compose its spec. */
+    private prepareContinuedTry;
+    private relocate;
+    /** The receipt of a continued try, emitted when the try settles (per-try model attestation). */
+    private emitReceipt;
+}
+//# sourceMappingURL=inrun-continuity.d.ts.map

package/dist/inrun-continuity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inrun-continuity.d.ts","sourceRoot":"","sources":["../src/inrun-continuity.ts"],"names":[],"mappings":"AA6BA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,cAAc,EAEnB,KAAK,YAAY,EAEjB,KAAK,SAAS,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAqBtE,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAElG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAMxE,qBAAa,eAAe;IA2Bd,OAAO,CAAC,QAAQ,CAAC,IAAI;IA1BjC,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,SAAS,CAA+B;IAChD,OAAO,CAAC,KAAK,CAAmC;IAChD,OAAO,CAAC,YAAY,CAAuB;IAE3C,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,QAAQ,CAAgC;IAChD,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,iBAAiB,CAAuB;IAChD,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,iBAAiB,CAAuB;IAChD,OAAO,CAAC,WAAW,CAA6C;IAChE,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAA8D;IAClF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+B;IAC9D,qFAAqF;IACrF,OAAO,CAAC,cAAc,CAAgD;IACtE,OAAO,CAAC,eAAe,CAAwB;IAE/C,YAA6B,IAAI,EAAE,mBAAmB,EAIrD;IAED,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAqBjF;IAED;;;;;OAKG;IACH,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAgE/F;IAED,+EAA+E;IAC/E,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAED,wDAAwD;IAClD,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAyCxD;IAED,6FAA6F;IACvF,MAAM,CAAC,KAAK,EAAE;QAClB,OAAO,EAAE,cAAc,CAAC;QACxB,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,SAAS,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;KACzC,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA0B/B;IAED,2FAA2F;IAC3F,aAAa,CAAC,SAAS,EAAE,YAAY,GAAG,IAAI,GAAG,uBAAuB,CAGrE;IAED,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,YAAY,CAW7C;IAED,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,SAAS;IAKjB;8EAC0E;YAC5D,MAAM;IAiCpB,+FAA+F;YACjF,UAAU;IAuCxB;;;;+BAI2B;YACb,cAAc;YAyCd,MAAM;IA2CpB,OAAO,CAAC,MAAM;IAKd,OAAO,CAAC,UAAU;IASlB,4EAA4E;YAC9D,mBAAmB;YA8BnB,QAAQ;IAItB,gGAAgG;IAChG,OAAO,CAAC,WAAW;CAoBpB"}

package/dist/inrun-continuity.js

@@ -0,0 +1,465 @@
+/**
+ * In-run continuation (the owner's "auto-rotation inside the work"): ONE
+ * per-attempt controller both the candidate loop and the read-only twin call,
+ * so the two lanes never re-derive the ladder (A8).
+ *
+ * Per try it OBSERVES the stream (the native session id → the capsule, the
+ * per-try attested model, the typed limit that ended the try, the identity of
+ * a resumed session, the adapter's typed rejection of carried state) and AFTER
+ * the try decides what the attempt does next:
+ *
+ *   - the attempt did NOT act → today's rules, byte for byte (typed-limit /
+ *     structural rotation onto a fresh session, same-profile transient retry);
+ *   - it acted and a typed vendor limit ended the try → hop to the next
+ *     eligible account with the session moved (`native_moved`) or, when the
+ *     session cannot be moved, re-briefed by the evidence index (`packet`,
+ *     owner 1B) — never a fresh replay of the original prompt;
+ *   - it acted and the process died (transport) → the same account resumes
+ *     its own session (`native`), or `packet` once a typed fact rejected the
+ *     native carrier, bounded by `transient_retry.max_retries` per account;
+ *   - pinned / `fail` / `ask` / pool spent → a typed terminal that still
+ *     carries the `resumable` facts (cause, reset, carriers).
+ *
+ * "Acted" is sticky for the whole attempt (any accepted answer text, any agent
+ * progress marker, any file change or workspace diff in ANY try): a silent
+ * resumed try never re-opens the `fresh` rung. Hops are bounded by
+ * `triedProfiles`; same-account continuations by `max_retries` (A2).
+ */
+import { CONTINUITY_IDENTITY_MISMATCH_CODE, acceptedTryOutput } from "@claudexor/core";
+import { readContinuationSources } from "@claudexor/workspace";
+import { HarnessRunSpec as HarnessRunSpecSchema, } from "@claudexor/schema";
+import { composeContinuedTry, continuityReceipt, relocateCapsule, resumableBlock, uncertainInputFor, } from "./inrun-continuity-carrier.js";
+import { effectiveLimitAction, limitSubjectRoute, rotateSpecOnTypedLimit, } from "./credential-profile-rotation.js";
+import { emitTransientRetryPlan } from "./laneStreamEvents.js";
+import { rotatedSpecInLaneHome } from "./orchestrator-credentials.js";
+import { transientRetryDelayMs } from "./runSupport.js";
+import { readSessionCapsule, writeSessionCapsule } from "./session-capsule.js";
+import { discloseContinuedTry } from "./inrun-continuity-thread.js";
+import { RetainedAttemptOutput } from "./inrun-retained-output.js";
+import { unconfirmedContinuationInputs } from "./continuation-input.js";
+const TYPED_REFUSALS = new Set(["auth_failed", "capability_refused", "config_error"]);
+export class InRunContinuity {
+    deps;
+    capsule;
+    acted = false;
+    nativeRejected = false;
+    triedProfiles = new Set();
+    sameAccountTries = 0;
+    lastCause = null;
+    limit = null;
+    terminalCode = null;
+    // Per-try state.
+    tryIndex = 0;
+    tryAbort = null;
+    tryStarted = false;
+    expectedSessionId = null;
+    tryModel = null;
+    tryRequestedModel = null;
+    tryIdentity = "not_applicable";
+    tryFirstInputTokens = null;
+    continued = null;
+    pending = null;
+    packetSession = false;
+    threadSwitch = null;
+    retainedOutput = new RetainedAttemptOutput();
+    /** Carrier of the try that just settled (null = the first try or a fresh replay). */
+    settledCarrier = null;
+    unstartedInputs = [];
+    constructor(deps) {
+        this.deps = deps;
+        this.capsule = readSessionCapsule(deps.attemptDir);
+        this.acted = deps.seed?.acted === true;
+        this.pending = deps.seed?.continued ?? null;
+    }
+    /** The loop calls this before each try spawns; `abort` is THIS try's controller. */
+    beginTry(runSpec, nativeTry, abort) {
+        this.limit = null;
+        this.terminalCode = null;
+        this.tryIndex = nativeTry;
+        this.tryAbort = abort;
+        this.tryStarted = false;
+        this.continued = this.pending;
+        this.pending = null;
+        if (this.continued) {
+            if (this.continued.fromProfileId !== this.continued.toProfileId)
+                this.threadSwitch ??= {
+                    harness: this.deps.adapter.id,
+                    profileId: this.continued.fromProfileId,
+                };
+            discloseContinuedTry(this.deps, this.continued, this.threadSwitch);
+        }
+        this.expectedSessionId = runSpec.resume_session_id ?? null;
+        this.tryModel = null;
+        this.tryRequestedModel = runSpec.model_hint ?? null;
+        this.tryIdentity = "not_applicable";
+        this.tryFirstInputTokens = null;
+    }
+    /**
+     * Observe one stream event. Returns the typed error that STOPS the try now
+     * (the resumed session is not the one requested — a mismatch caught before
+     * effects when no agent progress was seen yet; the child is aborted), else
+     * null.
+     */
+    observe(ev, runSpec, markers) {
+        if (ev.observed_model && this.tryModel === null)
+            this.tryModel = ev.observed_model;
+        if (ev.rate_limit) {
+            this.limit = {
+                resetsAt: ev.rate_limit.resets_at ?? null,
+                retryDelayMs: ev.rate_limit.retry_delay_ms ?? null,
+                constraintId: ev.rate_limit.constraint_id ?? null,
+            };
+        }
+        if (ev.type === "usage" && this.expectedSessionId && this.tryFirstInputTokens === null) {
+            const input = ev.usage?.input_token_usage?.total_tokens ?? ev.usage?.input_tokens ?? null;
+            if (input !== null)
+                this.tryFirstInputTokens = input;
+        }
+        if (ev.type === "error" &&
+            this.expectedSessionId &&
+            ev.payload?.["code"] === CONTINUITY_IDENTITY_MISMATCH_CODE) {
+            // The adapter compared the recovered handle at its earliest handshake,
+            // before any action (codex thread/resume precedes turn/start).
+            this.tryIdentity = "mismatch_before_effects";
+            this.nativeRejected = true;
+            this.tryAbort?.abort();
+            return ev.error ?? "recovered native session differs from the requested session";
+        }
+        if (this.expectedSessionId && this.deps.adapter.continuity?.rejectsCarriedState?.(ev)) {
+            this.nativeRejected = true;
+        }
+        if (ev.type !== "started")
+            return null;
+        this.tryStarted = true;
+        const nid = ev.payload?.["native_session_id"];
+        if (typeof nid !== "string" || nid.length === 0)
+            return null;
+        // Only an adapter with the `continuity` capability promises that a resume
+        // keeps the session id; on any other harness a new id after a resume is the
+        // vendor's own answer and is recorded as the session, as before.
+        if (this.expectedSessionId && nid !== this.expectedSessionId && this.deps.adapter.continuity) {
+            this.tryIdentity = markers.sawAgentProgress
+                ? "mismatch_after_possible_effects"
+                : "mismatch_before_effects";
+            this.nativeRejected = true;
+            this.tryAbort?.abort();
+            void this.deps.adapter.cancel?.(runSpec.session_id)?.catch(() => { });
+            return `resumed native session ${nid} is not the requested ${this.expectedSessionId}; the try was stopped${markers.sawAgentProgress ? " (effects may have occurred)" : " before any effect"}`;
+        }
+        if (this.expectedSessionId && nid === this.expectedSessionId)
+            this.tryIdentity = "matched_before_effects";
+        // Packet-born history lacks earlier thread turns, even on later native resumes.
+        this.packetSession =
+            this.continued?.carrier === "packet" ||
+                (this.packetSession && this.capsule?.nativeSessionId === nid);
+        // A new native session (or the resumed one) is the attempt's capsule now.
+        this.nativeRejected = false;
+        this.capsule = {
+            harness: this.deps.adapter.id,
+            nativeSessionId: nid,
+            holderProfileId: ev.credential_profile_id ?? runSpec.credential_profile?.profile_id ?? null,
+            file: this.capsule?.nativeSessionId === nid ? this.capsule.file : null,
+            mtimeMs: this.capsule?.nativeSessionId === nid ? this.capsule.mtimeMs : null,
+            sidecars: this.capsule?.nativeSessionId === nid ? this.capsule.sidecars : [],
+            cwd: runSpec.cwd,
+            requestedModel: runSpec.model_hint ?? null,
+        };
+        writeSessionCapsule(this.deps.attemptDir, this.capsule);
+        return null;
+    }
+    /** Both loops consult this only after the controller accepts the handshake. */
+    get mayPublishSession() {
+        return this.tryStarted && !this.tryIdentity.startsWith("mismatch") && !this.packetSession;
+    }
+    /** Decide what the attempt does after a settled try. */
+    async afterTry(facts) {
+        this.retainedOutput.add(facts.answer, facts.harnessErrored, this.tryIdentity);
+        const accepted = acceptedTryOutput(facts.answer, facts.harnessErrored);
+        this.acted ||=
+            accepted.length > 0 ||
+                facts.markers.sawAgentProgress ||
+                facts.markers.fileChanges > 0 ||
+                facts.workspaceDiffNonEmpty === true;
+        await this.relocate(facts.runSpec);
+        this.settledCarrier = this.continued?.carrier ?? null;
+        this.emitReceipt(facts.runSpec);
+        if (this.tryStarted)
+            this.unstartedInputs = [];
+        else if (this.tryIndex === 0) {
+            const { runDir, runId, workOrder } = this.deps;
+            const sources = readContinuationSources(runDir);
+            // A successor's workOrder is the whole joined chain. Keep the individual
+            // undelivered callers newest first, including this run's own correction.
+            // Further unstarted tries keep these references until a try starts.
+            this.unstartedInputs = sources.length
+                ? unconfirmedContinuationInputs([{ runDir, runId, state: "running" }, ...sources])
+                : [{ text: workOrder, runDir }];
+        }
+        if (facts.budgetStopped)
+            return this.breakWith("other");
+        if (!facts.harnessErrored || facts.aborted)
+            return { kind: "break" };
+        if (facts.requestRefused)
+            return this.breakWith("other");
+        if (facts.telemetry.contextExhausted)
+            return this.breakWith("context_exhausted");
+        if (!this.acted)
+            return this.legacy(facts);
+        const typedRefusal = facts.newTransients.some((t) => TYPED_REFUSALS.has(t.category));
+        if (typedRefusal)
+            return this.breakWith("other");
+        // A11: a bare backoff frame (a delay, no reset, no constraint) is transport —
+        // the same session is simply resumed — when a session exists to resume;
+        // without one the typed limit still hops (nothing to resume on this account).
+        const backoffOnly = this.limit !== null &&
+            !this.limit.resetsAt &&
+            !this.limit.constraintId &&
+            this.limit.retryDelayMs !== null;
+        if (facts.sawTypedLimit && (!backoffOnly || this.capsule === null)) {
+            return this.afterLimit(facts);
+        }
+        return this.afterTransport(facts);
+    }
+    /** Receipts, capsule relocation and the terminal `resumable` block once the attempt ends. */
+    async finish(input) {
+        // A continued try whose attempt ended on a loop exit that skipped
+        // `afterTry` (a request or processing refusal) still owes its receipt.
+        this.emitReceipt(input.runSpec);
+        await this.relocate(input.runSpec);
+        const vetoed = input.workState?.state === "needs_input" || input.workState?.state === "incomplete";
+        if (!input.errored &&
+            !input.aborted &&
+            !vetoed &&
+            (!input.nonSuccess || (!this.acted && !this.capsule)))
+            return null;
+        const cause = vetoed
+            ? input.workState?.state === "needs_input"
+                ? "input_required"
+                : "other"
+            : input.aborted
+                ? input.cancelReason === "wall_clock_exceeded"
+                    ? "wall_clock"
+                    : "cancelled"
+                : input.errored
+                    ? (this.lastCause ?? "other")
+                    : "other";
+        return this.resumable(cause);
+    }
+    /** Keep a snapshot for gates/review/arbitration that can fail after this try completed. */
+    terminalFacts(resumable) {
+        if (resumable)
+            return { resumable };
+        return this.acted || this.capsule ? { resumableOnFailure: this.resumable("other") } : {};
+    }
+    resumable(cause) {
+        return resumableBlock({
+            deps: this.deps,
+            cause,
+            capsule: this.capsule,
+            nativeRejected: this.nativeRejected,
+            acted: this.acted,
+            limit: this.limit,
+            terminalCode: this.terminalCode,
+            workspace: this.deps.workspace,
+        });
+    }
+    poolTerminal(error) {
+        this.lastCause = "pool_exhausted";
+        this.terminalCode = codeOf(error);
+        const resetsAt = error.resetsAt;
+        this.limit = {
+            resetsAt: typeof resetsAt === "string" ? resetsAt : null,
+            constraintId: this.limit?.constraintId ?? null,
+            retryDelayMs: this.limit?.retryDelayMs ?? null,
+        };
+        return { kind: "terminal", error };
+    }
+    breakWith(cause) {
+        this.lastCause = cause;
+        return { kind: "break" };
+    }
+    /** Today's rules for an attempt that did not act: typed-limit / structural
+     * rotation onto a fresh session, then the same-profile transient gate. */
+    async legacy(facts) {
+        const rotated = await this.rotate(facts, false);
+        if (rotated && "poolExhausted" in rotated) {
+            return this.poolTerminal(rotated.poolExhausted);
+        }
+        if (rotated) {
+            this.hopped(rotated);
+            return { kind: "continue", spec: this.inLaneHome(facts.runSpec, rotated), delayMs: 0 };
+        }
+        this.lastCause = facts.sawTypedLimit ? "vendor_limit" : "transport";
+        if (!facts.sawRetryable ||
+            !facts.rawDeliverableEmpty ||
+            facts.nativeTry >= this.deps.retryPolicy.maxRetries)
+            return { kind: "break" };
+        const delayMs = emitTransientRetryPlan((t, p) => this.deps.emit(t, p), this.deps.adapter.id, this.deps.attemptId, facts.telemetry, facts.nativeTry, this.deps.retryPolicy);
+        const spec = HarnessRunSpecSchema.parse({
+            ...facts.runSpec,
+            session_id: this.deps.newSessionId(),
+            resume_session_id: facts.runSpec.resume_session_id ?? null,
+            extra: { ...facts.runSpec.extra },
+        });
+        return { kind: "continue", spec, delayMs };
+    }
+    /** A typed vendor limit ended a try that acted: hop with the session (2A) or a packet (1B). */
+    async afterLimit(facts) {
+        const route = limitSubjectRoute(facts.runSpec.credential_profile ?? null, this.deps.defaultRouteWasVendorNative ? "local_session" : null);
+        if (this.deps.pinned) {
+            this.lastCause = "pinned_limit";
+            this.terminalCode = "subscription_window_exhausted";
+            return {
+                kind: "terminal",
+                error: Object.assign(new Error(`credential profile "${facts.runSpec.credential_profile?.profile_id ?? "default"}" (${this.deps.adapter.id}) hit a typed vendor limit after progress and a pinned account never rotates${this.limit?.resetsAt ? `; resets ${this.limit.resetsAt}` : ""}`), {
+                    code: "subscription_window_exhausted",
+                    category: "harness_unavailable",
+                    resetsAt: this.limit?.resetsAt ?? null,
+                }),
+            };
+        }
+        if (effectiveLimitAction(this.deps.policy, route) !== "rotate")
+            return this.breakWith("vendor_limit");
+        const rotated = await this.rotate(facts, true);
+        if (rotated && "poolExhausted" in rotated) {
+            return this.poolTerminal(rotated.poolExhausted);
+        }
+        if (!rotated)
+            return this.breakWith("vendor_limit");
+        this.hopped(rotated);
+        this.lastCause = "vendor_limit";
+        return this.prepareContinuedTry(facts, this.inLaneHome(facts.runSpec, rotated), "vendor_limit", 0);
+    }
+    /** The process died after progress: the same account resumes its session
+     * (bounded), or re-briefs once a typed fact rejected that session. With no
+     * session recorded at all (the harness never reported one) the same account
+     * continues on a new session re-briefed by the evidence index (owner 1B),
+     * under the same bound. */
+    async afterTransport(facts) {
+        this.lastCause = "transport";
+        // A packet try that died before doing anything replayed no effect: the
+        // structural branch hops it to the next account with the same packet
+        // (today's pre-progress failover, now on the packet carrier).
+        const packetDiedUnused = this.capsule === null &&
+            this.settledCarrier === "packet" &&
+            !facts.sawRetryable &&
+            !facts.markers.sawAgentProgress &&
+            facts.markers.fileChanges === 0;
+        if (packetDiedUnused) {
+            const rotated = await this.rotate(facts, true);
+            if (rotated && "poolExhausted" in rotated) {
+                return this.poolTerminal(rotated.poolExhausted);
+            }
+            if (!rotated)
+                return { kind: "break" };
+            this.hopped(rotated);
+            return this.prepareContinuedTry(facts, this.inLaneHome(facts.runSpec, rotated), "transport", 0);
+        }
+        if (this.sameAccountTries >= this.deps.retryPolicy.maxRetries)
+            return { kind: "break" };
+        const retryIndex = this.sameAccountTries;
+        this.sameAccountTries += 1;
+        const spec = HarnessRunSpecSchema.parse({
+            ...facts.runSpec,
+            session_id: this.deps.newSessionId(),
+            extra: { ...facts.runSpec.extra },
+        });
+        const delayMs = transientRetryDelayMs(facts.newTransients.at(-1)?.retryDelayMs ?? this.limit?.retryDelayMs ?? null, this.deps.retryPolicy, retryIndex);
+        return this.prepareContinuedTry(facts, spec, "transport", delayMs);
+    }
+    async rotate(facts, forceEligible) {
+        if (!this.deps.rotationEnabled)
+            return null;
+        const { runSpec } = facts;
+        const accepted = acceptedTryOutput(facts.answer, facts.harnessErrored);
+        return rotateSpecOnTypedLimit({
+            spec: runSpec,
+            harnessId: this.deps.adapter.id,
+            attemptId: this.deps.attemptId,
+            policy: this.deps.policy,
+            registry: this.deps.registry,
+            snapshots: this.deps.snapshots,
+            probeReadyProfiles: () => this.deps.probeReadyProfiles(runSpec, this.triedProfiles),
+            ...this.deps.rotationObservations(runSpec, facts.newTransients, facts.refusal),
+            triedProfiles: this.triedProfiles,
+            // After progress the predicate's no-deliverable/no-mutation fence scopes
+            // only the `fresh` carrier: the planner picks the carrier, rotation only
+            // picks the next account.
+            markers: forceEligible
+                ? {
+                    sawAgentProgress: false,
+                    fileChanges: 0,
+                    sawSessionStart: facts.markers.sawSessionStart,
+                }
+                : facts.markers,
+            requestRefused: facts.requestRefused,
+            sawTypedLimit: facts.sawTypedLimit,
+            sawRetryable: facts.sawRetryable,
+            attemptErrored: facts.harnessErrored,
+            deliverableEmpty: forceEligible
+                ? true
+                : facts.workspaceDiffNonEmpty !== true && accepted.length === 0,
+            workspaceDiffNonEmpty: forceEligible ? false : facts.workspaceDiffNonEmpty,
+            lastLimit: facts.lastLimit,
+            emit: this.deps.emit,
+            newSessionId: this.deps.newSessionId,
+            defaultRouteWasVendorNative: this.deps.defaultRouteWasVendorNative,
+            pinned: this.deps.pinned,
+        });
+    }
+    hopped(rotated) {
+        if (rotated.credential_profile)
+            this.triedProfiles.add(rotated.credential_profile.profile_id);
+        this.sameAccountTries = 0;
+    }
+    inLaneHome(previous, rotated) {
+        return rotatedSpecInLaneHome(previous, rotated, this.deps.laneEnvFor, this.deps.requestedProfileId);
+    }
+    /** Plan and prepare the carrier for the next try, then compose its spec. */
+    async prepareContinuedTry(facts, base, cause, delayMs) {
+        const composed = await composeContinuedTry({
+            deps: this.deps,
+            capsule: this.capsule,
+            acted: this.acted,
+            nativeRejected: this.nativeRejected,
+            tryIndex: this.tryIndex,
+            uncertainInput: uncertainInputFor(this.deps.runDir, this.unstartedInputs, this.deps.attemptId),
+            retainedOutput: this.retainedOutput.text(),
+        }, facts, base, cause, delayMs);
+        this.pending = composed.continued;
+        if (composed.capsule)
+            this.capsule = composed.capsule;
+        return composed.verdict;
+    }
+    async relocate(runSpec) {
+        if (this.capsule)
+            this.capsule = await relocateCapsule(this.deps, this.capsule, runSpec);
+    }
+    /** The receipt of a continued try, emitted when the try settles (per-try model attestation). */
+    emitReceipt(runSpec) {
+        const continued = this.continued;
+        if (!continued)
+            return;
+        this.continued = null;
+        this.deps.emit("run.continuity", {
+            harness_id: this.deps.adapter.id,
+            attempt_id: this.deps.attemptId,
+            session_id: runSpec.session_id,
+            receipt: continuityReceipt({
+                deps: this.deps,
+                continued,
+                tryIndex: this.tryIndex,
+                requestedModel: this.tryRequestedModel,
+                observedModel: this.tryModel,
+                nativeRejected: this.nativeRejected,
+                identity: this.tryIdentity,
+                reingestedTokens: this.tryFirstInputTokens,
+            }),
+        });
+    }
+}
+function codeOf(error) {
+    const code = error.code;
+    return typeof code === "string" ? code : null;
+}
+//# sourceMappingURL=inrun-continuity.js.map