@claudexor/schema 4.1.1 → 4.3.0

package/generated/ControlSettingsSnapshot.schema.json

@@ -202,10 +202,17 @@
               "description": "Wall-clock timeout for a reviewer run, in milliseconds."
             },
             "harnessInactivityTimeoutMs": {
-              "type": "integer",
-              "exclusiveMinimum": 0,
+              "anyOf": [
+                {
+                  "type": "integer",
+                  "exclusiveMinimum": 0
+                },
+                {
+                  "type": "null"
+                }
+              ],
               "default": 3600000,
-              "description": "Inactivity watchdog for harness streams, in milliseconds."
+              "description": "Inactivity watchdog in milliseconds; null disables inactivity timing, not cancellation or cleanup."
             },
             "concurrency": {
               "type": "object",

package/generated/ControlThreadTurnRequest.schema.json

@@ -395,7 +395,15 @@
           "type": "integer",
           "exclusiveMinimum": 0,
           "maximum": 604800,
-          "description": "Hard wall-clock deadline for the whole run (seconds, from scheduler start, max 7 days); on expiry the run is cancelled with reason wall_clock_exceeded and partial artifacts are kept."
+          "description": "Wall-clock limit for the whole run (seconds, max seven days). Omission disables the clock. Explicit limits cancel by default; soft mode warns and continues."
+        },
+        "timeLimitMode": {
+          "type": "string",
+          "enum": [
+            "soft",
+            "hard"
+          ],
+          "description": "Initial timer mode: soft warns and continues; hard cancels. Omission is hard with maxSeconds and soft without it."
         },
         "denyPaths": {
           "type": "array",

package/generated/DecisionRecord.schema.json

@@ -329,7 +329,14 @@
                 "null"
               ],
               "default": null,
-              "description": "Settled cash spend in USD (0 on native-subscription routes); null when unknown."
+              "description": "Settled cash spend in USD (0 on proven included routes); null when unknown, including an included subscription that reports no actual debit."
+            },
+            "controllable_cash_usd": {
+              "type": [
+                "number",
+                "null"
+              ],
+              "description": "Cash governed by the finite cap: settled amounts on routes Claudexor controls; null when that cash is unknown. spend_usd and cash_usd stay null when an included subscription reports no actual debit. Absent on legacy decisions."
             },
             "valuation_usd": {
               "type": [

package/generated/EnvelopeCustody.schema.json

@@ -25,6 +25,10 @@
           "minLength": 1,
           "description": "Absolute run directory of the holder."
         },
+        "continuation_eligible": {
+          "type": "boolean",
+          "description": "False for diagnostic source retention addressed by attempt, without a run continuation pointer. Absent retains the historical singleton continuation contract."
+        },
         "envelope": {
           "type": "object",
           "properties": {
@@ -142,6 +146,7 @@
                 "pool_exhausted",
                 "pinned_limit",
                 "transport",
+                "permission_denied",
                 "context_exhausted",
                 "wall_clock",
                 "cancelled",
@@ -149,7 +154,7 @@
                 "input_required",
                 "other"
               ],
-              "description": "Typed reason the previous process stopped: a vendor limit (next account eligible), the whole pool spent, a pinned account's limit, a transport death (crash, timeout, watchdog), context exhaustion, the wall-clock deadline, a cancel, a daemon/host restart, a model that asked for input, or another typed cause."
+              "description": "Typed reason the previous process stopped: a vendor limit (next account eligible), the whole pool spent, a pinned account's limit, a transport death (crash, timeout, watchdog), a confirmed native tool permission refusal, context exhaustion, the wall-clock deadline, a cancel, a daemon/host restart, a model that asked for input, or another typed cause."
             },
             {
               "type": "null"

package/generated/GlobalConfig.schema.json

@@ -233,10 +233,17 @@
               "description": "Wall-clock timeout for a reviewer run, in milliseconds."
             },
             "harness_inactivity_timeout_ms": {
-              "type": "integer",
-              "exclusiveMinimum": 0,
+              "anyOf": [
+                {
+                  "type": "integer",
+                  "exclusiveMinimum": 0
+                },
+                {
+                  "type": "null"
+                }
+              ],
               "default": 3600000,
-              "description": "Inactivity watchdog for harness streams: no events for this window aborts the stream and fails the attempt with a typed timeout."
+              "description": "Inactivity watchdog for harness streams: no events for this window aborts the stream; null disables inactivity timing without changing cancellation or cleanup."
             },
             "max_concurrent": {
               "anyOf": [

package/generated/HarnessEvent.schema.json

@@ -325,6 +325,11 @@
             },
             "source": {
               "$ref": "#/definitions/HarnessEvent/properties/effort_resolution/properties/requested/anyOf/0"
+            },
+            "debit": {
+              "type": "string",
+              "const": "unobserved",
+              "description": "The route reports no actual cash or purchased-credit debit. Included service still admits the work, but its cash stays unknown instead of zero and is outside the finite cap; absence keeps proven ordinary inclusion as zero cash."
             }
           },
           "required": [
@@ -606,6 +611,25 @@
           ],
           "description": "Typed refusal code for a rejected raw patch contract."
         },
+        "permission_denial": {
+          "type": "object",
+          "properties": {
+            "permission": {
+              "type": "string",
+              "minLength": 1
+            },
+            "source": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "required": [
+            "permission",
+            "source"
+          ],
+          "additionalProperties": false,
+          "description": "Adapter-attested native tool permission refusal, not a claim inferred from model prose or empty output. Does not grant broader access."
+        },
         "usage": {
           "type": "object",
           "properties": {

package/generated/HarnessManifest.schema.json

@@ -250,7 +250,7 @@
                     "tool_policy",
                     "none"
                   ],
-                  "description": "How workspace_write access is CONFINED for a harness: a filesystem/network sandbox (codex seatbelt), a tool-permission policy with no FS/network fence (claude — an allowed shell is unconfined), or none (write intent is advisory).",
+                  "description": "How workspace_write access is CONFINED for a harness: a filesystem/network base sandbox (codex seatbelt; the harness's native automatic reviewer may still admit individual actions outside it, so fs_sandbox does not mean every admitted action stays inside), a tool-permission policy with no FS/network fence (claude — an allowed shell is unconfined), or none (write intent is advisory).",
                   "default": "none"
                 }
               },

package/generated/HarnessStatusDto.schema.json

@@ -268,7 +268,7 @@
                             "tool_policy",
                             "none"
                           ],
-                          "description": "How workspace_write access is CONFINED for a harness: a filesystem/network sandbox (codex seatbelt), a tool-permission policy with no FS/network fence (claude — an allowed shell is unconfined), or none (write intent is advisory).",
+                          "description": "How workspace_write access is CONFINED for a harness: a filesystem/network base sandbox (codex seatbelt; the harness's native automatic reviewer may still admit individual actions outside it, so fs_sandbox does not mean every admitted action stays inside), a tool-permission policy with no FS/network fence (claude — an allowed shell is unconfined), or none (write intent is advisory).",
                           "default": "none"
                         }
                       },

package/generated/ImageCallResult.schema.json

@@ -236,6 +236,11 @@
                 },
                 "source": {
                   "$ref": "#/definitions/ImageCallResult/properties/appliedOptions/properties/size"
+                },
+                "debit": {
+                  "type": "string",
+                  "const": "unobserved",
+                  "description": "The route reports no actual cash or purchased-credit debit. Included service still admits the work, but its cash stays unknown instead of zero and is outside the finite cap; absence keeps proven ordinary inclusion as zero cash."
                 }
               },
               "required": [