@cursor/bdk 0.2.6 → 0.2.8

package/dist/internal/handleAgentServeTrigger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handleAgentServeTrigger.d.ts","sourceRoot":"","sources":["../../src/internal/handleAgentServeTrigger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAOxE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAwB,KAAK,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAE9F,MAAM,WAAW,6BAA6B;IAC5C,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,EAAE,oBAAoB,CAAC;IAC9B,uEAAuE;IACvE,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,QAAQ,CAAC;IACf,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACzC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;CACnD;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,oBAAoB,CAAC;IAC9B,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,QAAQ,CAAC;IACf,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACzC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;CACnD;AAED,MAAM,MAAM,sBAAsB,GAAG,4BAA4B,GAAG,4BAA4B,CAAC;AAEjG,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,6BAA6B,EAAE,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACpD,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,kBAAkB,CAAC;KAC7D,CAAC,CAAC;CACJ,GAAG,6BAA6B,EAAE,CAgBlC;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACpD,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,kBAAkB,CAAC;KAC7D,CAAC,CAAC;CACJ,GAAG,6BAA6B,EAAE,CAgBlC;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAWlC"}
+{"version":3,"file":"handleAgentServeTrigger.d.ts","sourceRoot":"","sources":["../../src/internal/handleAgentServeTrigger.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAOxE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAwB,KAAK,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAE9F,MAAM,WAAW,6BAA6B;IAC5C,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,EAAE,oBAAoB,CAAC;IAC9B,uEAAuE;IACvE,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,QAAQ,CAAC;IACf,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACzC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;CACnD;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,oBAAoB,CAAC;IAC9B,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,QAAQ,CAAC;IACf,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACzC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;CACnD;AAED,MAAM,MAAM,sBAAsB,GAAG,4BAA4B,GAAG,4BAA4B,CAAC;AAEjG,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,6BAA6B,EAAE,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACpD,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,kBAAkB,CAAC;KAC7D,CAAC,CAAC;CACJ,GAAG,6BAA6B,EAAE,CAgBlC;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACpD,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,kBAAkB,CAAC;KAC7D,CAAC,CAAC;CACJ,GAAG,6BAA6B,EAAE,CAgBlC;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAWlC"}

package/dist/internal/handleAgentServeTrigger.js

@@ -1,14 +1,11 @@
 /**
- * Unified entry for dispatching agent-serve triggers from an external ingress
- * (e.g. the Cursor backend GitHub webhook or Origin cursor-internal tap).
- * Mirrors Automations' `handleAutomationTrigger`.
+ * Dispatches authenticated GitHub and Origin events to matching agents.
  *
- * Callers must authenticate the delivery before invoking this (the backend
- * verifies GitHub HMAC at `/github_webhook` and Origin v1ed at the
- * cursor-internal app). This fan-out does not re-check signatures — same
- * trust model as Bugbot after `verifyGithubRequest`.
+ * Callers must authenticate the delivery before invoking this fan-out. It
+ * does not re-check provider signatures.
  *
- * Each agent's `onPullRequest` / `onComment` / … hooks decide whether to run.
+ * Each agent's `onPullRequest`, `onComment`, and related hooks decide whether
+ * to run.
  */
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }

package/dist/internal/host-files.js

@@ -203,11 +203,9 @@ function requireSession(sessionId) {
 }
 /**
  * Normalize an author path into key-relative form. Rejects traversal, NUL,
- * backslashes, trailing slashes, and the `.cursor*` prefix the Agent Store
- * reserves for Cursor-managed content — refusing here turns an opaque failure
- * deep in a sink (or a 400 from the hosted API, which accepts each path in
- * exactly one spelling) into one the author can act on, and keeps the rule
- * identical across sinks.
+ * backslashes, trailing slashes, and the `.cursor*` prefix reserved for
+ * managed content. Rejecting them here gives authors an actionable error and
+ * keeps path rules identical across sinks.
  */
 function normalizeRelPath(path, allowEmpty) {
     if (typeof path !== "string") {
@@ -224,14 +222,13 @@ function normalizeRelPath(path, allowEmpty) {
         throw new FilePathRejectedError(`host.files path is not allowed: ${path}`);
     }
     // A backslash is a separator on Windows and a literal on POSIX, so a key
-    // minted from one would name different objects on different hosts — and the
-    // hosted API refuses it. Same rule as `segment()` below.
+    // minted from one would name different objects on different hosts.
     if (trimmed.includes("\\")) {
         throw new FilePathRejectedError(`host.files path is not allowed: ${path}`);
     }
-    // On an object path, a trailing slash would mint a key ending in "/" — an
+    // On an object path, a trailing slash would mint a key ending in "/", an
     // empty "directory marker" object, never what an author writing a file
-    // meant, and refused by the hosted API. A listing prefix (`allowEmpty`) is
+    // meant. A listing prefix (`allowEmpty`) is
     // a different thing: there a trailing slash legitimately scopes to a
     // directory's contents.
     if (!allowEmpty && trimmed.endsWith("/")) {

package/dist/internal/host-platforms.js

@@ -89,7 +89,7 @@ export function warmupHostGitHubAuth(options) {
         var _a;
         const source = (_a = options.authSource) !== null && _a !== void 0 ? _a : (yield resolveHostGitHubAuthSource());
         if (source === "unavailable") {
-            options.logger("[agent-sdk] GitHub auth: unavailable (set GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY + GITHUB_APP_INSTALLATION_ID, or GITHUB_TOKEN / GH_TOKEN, or run `gh auth login`)");
+            options.logger("[bdk] GitHub auth: unavailable (set GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY + GITHUB_APP_INSTALLATION_ID, or GITHUB_TOKEN / GH_TOKEN, or run `gh auth login`)");
             return source;
         }
         let exportedGhToken = false;
@@ -98,7 +98,7 @@ export function warmupHostGitHubAuth(options) {
                 exportedGhToken = yield ensureGhCliTokenEnv();
             }
             catch (error) {
-                options.logger(`[agent-sdk] GitHub auth: failed to export GH_TOKEN for gh CLI: ${error instanceof Error ? error.message : String(error)}`);
+                options.logger(`[bdk] GitHub auth: failed to export GH_TOKEN for gh CLI: ${error instanceof Error ? error.message : String(error)}`);
             }
         }
         const label = source === "cursor-account"
@@ -111,15 +111,15 @@ export function warmupHostGitHubAuth(options) {
                     ? "GITHUB_TOKEN/GH_TOKEN"
                     : "gh auth token";
         if (options.github === undefined) {
-            options.logger(`[agent-sdk] GitHub auth: ${label}`);
+            options.logger(`[bdk] GitHub auth: ${label}`);
             return source;
         }
         try {
             yield options.github.getOctokit();
-            options.logger(`[agent-sdk] GitHub auth: ${label}`);
+            options.logger(`[bdk] GitHub auth: ${label}`);
         }
         catch (error) {
-            options.logger(`[agent-sdk] GitHub auth: ${label} resolved but Octokit warmup failed: ${error instanceof Error ? error.message : String(error)}`);
+            options.logger(`[bdk] GitHub auth: ${label} resolved but Octokit warmup failed: ${error instanceof Error ? error.message : String(error)}`);
         }
         return source;
     });

package/dist/internal/hosted-catch.d.ts

@@ -33,8 +33,9 @@ export declare function replayCatchRequest(input: {
 }): Promise<Response>;
 /**
  * Attach catch admission to an authored channel. Provider packs attach
- * their own adapter afterwards and replace this one; the control plane
- * never sends `http.request` to a pack kind in any case.
+ * their own adapter afterwards and replace this one. A pack that also
+ * declares `publicEndpoint()` must replay `http.request` itself —
+ * `githubChannel` does — because that catch is no longer this adapter.
  */
 export declare function attachCatchAdmission(definition: ChannelDefinition<unknown>, routes: readonly ChannelRoute[]): void;
 //# sourceMappingURL=hosted-catch.d.ts.map

package/dist/internal/hosted-catch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-catch.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-catch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAKpG,OAAO,EAGL,KAAK,oBAAoB,EAG1B,MAAM,4BAA4B,CAAC;AAIpC,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAIlE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAIhC,CAAC;AAIF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;CAChC,GAAG,OAAO,CAcV;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiFpB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,EACtC,MAAM,EAAE,SAAS,YAAY,EAAE,GAC9B,IAAI,CAgBN"}
+{"version":3,"file":"hosted-catch.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-catch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAMpG,OAAO,EAGL,KAAK,oBAAoB,EAG1B,MAAM,4BAA4B,CAAC;AAIpC,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAIlE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAIhC,CAAC;AAIF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,oBAAoB,CAAC;CAChC,GAAG,OAAO,CAcV;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiFpB;AAgBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,EACtC,MAAM,EAAE,SAAS,YAAY,EAAE,GAC9B,IAAI,CAgBN"}

package/dist/internal/hosted-catch.js

@@ -19,6 +19,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { acknowledgeTurn, dispatchOutcome, skipped, tagOutcome } from "./channel-dispatch.js";
+import { classifyHostedAdmissionRejection } from "./hosted-delivery-protocol.js";
 import { invokeChannelRoute } from "./channel-route-dispatch.js";
 import { DeferredChannelSessionError } from "./deferred-channel-session.js";
 import { attachHostedAdmissionAdapter } from "./hosted-admission-adapter.js";
@@ -109,21 +110,38 @@ export function replayCatchRequest(input) {
         // change the verdict, so report a cheap skip that lets the control plane
         // discard the compute instead of failing and retrying the activity.
         if (response.status >= 400 && response.status < 500) {
-            // Logged so a probed public route or a misconfigured provider secret is
-            // distinguishable from a benign "nothing to do" skip in the guest logs;
-            // the wire outcome to the control plane is still `skip`.
-            console.info(`[agent-sdk] catch replay rejected by handler deliveryId=${input.deliveryId} channelId=${input.channelId} route=${envelope.method} ${route.path} status=${String(response.status)}`);
-            return skipped(`handler rejected the request (${response.status})`, {
-                status: response.status,
-            });
+            // A handler 4xx (bad Hub signature, schema mismatch, unknown event) is a
+            // skip so the control plane does not retry it. The reason is what the
+            // control plane logs; this line is the guest copy. Neither includes the
+            // secret or the request body.
+            const reason = classifyHostedAdmissionRejection(yield handlerErrorCode(response));
+            console.info(`[bdk] catch replay rejected by handler deliveryId=${input.deliveryId} channelId=${input.channelId} route=${envelope.method} ${route.path} status=${String(response.status)} reason=${reason}`);
+            return skipped(reason, { status: response.status });
         }
         return response;
     });
 }
+/** Short handler error token, such as `missing_secret`. Never a secret or a body. */
+function handlerErrorCode(response) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const body = (yield response.clone().json());
+            if (typeof body !== "object" || body === null || Array.isArray(body)) {
+                return undefined;
+            }
+            const error = body.error;
+            return typeof error === "string" && /^[a-z0-9_]{1,64}$/.test(error) ? error : undefined;
+        }
+        catch (_a) {
+            return undefined;
+        }
+    });
+}
 /**
  * Attach catch admission to an authored channel. Provider packs attach
- * their own adapter afterwards and replace this one; the control plane
- * never sends `http.request` to a pack kind in any case.
+ * their own adapter afterwards and replace this one. A pack that also
+ * declares `publicEndpoint()` must replay `http.request` itself —
+ * `githubChannel` does — because that catch is no longer this adapter.
  */
 export function attachCatchAdmission(definition, routes) {
     var _a;

package/dist/internal/hosted-delivery-protocol.d.ts

@@ -1,9 +1,3 @@
-/**
- * Private control-plane/engine wire contract. Version 2 is unreleased and
- * intentionally strict: unknown fields and modes fail closed. After release,
- * any shape or semantic change must use a new version and a rolling
- * compatibility window. See `docs/agent-serve/hosted-delivery-protocol.md`.
- */
 export declare const HOSTED_DELIVERY_PROTOCOL_VERSION = 2;
 export declare const HOSTED_DELIVERY_HEADER = "x-agent-sdk-hosted-delivery";
 export declare const HOSTED_ADMISSION_PATH = "/v1/internal/hosted-admission";
@@ -19,7 +13,7 @@ export type HostedFailureClassification = {
     domain: HostedFailureDomain;
     source: HostedFailureSource;
 };
-export type HostedFailureCode = "agent_admission_threw" | "agent_dependency_failed" | "background_dispatch_failed" | "bound_secrets_not_consumed" | "channel_dispatch_failed" | "channel_kind_mismatch" | "channel_not_found" | "channel_outcome_missing" | "forbidden" | "guest_connect_stalled" | "guest_network_unavailable" | "hosted_admission_session_mismatch" | "hosted_admission_unavailable" | "hosted_deferred_session_unusable" | "hosted_local_send_rejected" | "hosted_send_limit_exceeded" | "internal_error" | "invalid_hosted_admission" | "invalid_hosted_execution" | "invalid_request" | "method_not_allowed" | "not_found" | "session_busy" | "turn_cancelled" | "turn_failed" | "unauthorized" | "unpaid_invoice" | "usage_limit" | "v2_identity_conflict";
+export type HostedFailureCode = "agent_admission_threw" | "agent_dependency_failed" | "background_dispatch_failed" | "bound_secrets_missing" | "bound_secrets_not_consumed" | "channel_dispatch_failed" | "channel_kind_mismatch" | "channel_not_found" | "channel_outcome_missing" | "forbidden" | "guest_connect_stalled" | "guest_network_unavailable" | "hosted_admission_session_mismatch" | "hosted_admission_unavailable" | "hosted_deferred_session_unusable" | "hosted_local_send_rejected" | "hosted_send_limit_exceeded" | "internal_error" | "invalid_hosted_admission" | "invalid_hosted_execution" | "invalid_request" | "method_not_allowed" | "not_found" | "session_busy" | "turn_cancelled" | "turn_failed" | "unauthorized" | "unpaid_invoice" | "usage_limit" | "v2_identity_conflict";
 export declare const HOSTED_FAILURE_CLASSIFICATIONS: Record<HostedFailureCode, Omit<HostedFailureClassification, "v">>;
 export declare function hostedFailureClassification(code: string): HostedFailureClassification;
 export declare function parseHostedFailureClassification(value: unknown): HostedFailureClassification | undefined;
@@ -32,6 +26,8 @@ export type HostedGuestError = {
     turnStatus?: string;
     /** Runner/SDK code (`unknown`, `canceled`, …). Not the human message. */
     errorCode?: string;
+    /** `@cursor/bdk` version of the process that produced this response. */
+    engineVersion?: string;
 };
 /**
  * Hosted delivery is the only HTTP surface whose failures drive Temporal
@@ -142,20 +138,47 @@ export type HostedAdmissionStatus = {
     deliveryId: string;
 };
 export type HostedAdmission = HostedAdmissionStart | HostedAdmissionStatus;
+/**
+ * Handler 4xx reasons an admission skip can carry. Benign skips (nothing to
+ * do) omit `rejection`. Engine HTTP failures use the hosted failure codes
+ * instead and are not skips.
+ */
+export declare const HOSTED_ADMISSION_REJECTION_REASONS: readonly ["missing_secret", "missing_signature", "signature_mismatch", "invalid_signature", "invalid_token", "invalid_json", "invalid_payload", "unbound_origin_app", "invalid_app", "invalid_installation", "handler_rejected"];
+export type HostedAdmissionRejectionReason = (typeof HOSTED_ADMISSION_REJECTION_REASONS)[number];
+export type HostedAdmissionHandlerRejection = {
+    reason: HostedAdmissionRejectionReason;
+    status: number;
+};
 export type HostedAdmissionOutcome = {
     ok: true;
     v: 2;
-    outcome: "skip" | "task";
+    outcome: "skip";
+    rejection?: HostedAdmissionHandlerRejection;
+    engineVersion?: string;
+} | {
+    ok: true;
+    v: 2;
+    outcome: "task";
+    engineVersion?: string;
 } | {
     ok: true;
     v: 2;
     outcome: "send";
     admissionToken: string;
+    engineVersion?: string;
 } | {
     ok: true;
     v: 2;
     outcome: "started" | "running";
+    engineVersion?: string;
 };
+/**
+ * Map a handler `error` token onto the closed admission-rejection set.
+ * GitHub's `mismatch` becomes `signature_mismatch`. Payload-specific names
+ * become `invalid_payload`. Anything else is `handler_rejected`.
+ */
+export declare function classifyHostedAdmissionRejection(error: string | undefined): HostedAdmissionRejectionReason;
+export declare function parseHostedAdmissionHandlerRejection(value: unknown): HostedAdmissionHandlerRejection | undefined;
 /**
  * Cap on delivery IDs an owner execute may report as consumed (primary +
  * accepted active-guest enqueues). Enqueue requests beyond this return

package/dist/internal/hosted-delivery-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-delivery-protocol.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-delivery-protocol.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAClD,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AACrE,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AACrE,eAAO,MAAM,4BAA4B,cAAc,CAAC;AACxD,eAAO,MAAM,2BAA2B,aAAa,CAAC;AAEtD,MAAM,MAAM,2BAA2B,GACnC,OAAO,4BAA4B,GACnC,OAAO,2BAA2B,CAAC;AAEvC,eAAO,MAAM,qCAAqC,IAAI,CAAC;AAEvD,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,UAAU,GACV,UAAU,GACV,OAAO,GACP,YAAY,GACZ,cAAc,GACd,SAAS,CAAC;AAEd,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEpF,MAAM,MAAM,2BAA2B,GAAG;IACxC,CAAC,EAAE,OAAO,qCAAqC,CAAC;IAChD,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,mBAAmB,CAAC;CAC7B,CAAC;AAmBF,MAAM,MAAM,iBAAiB,GACzB,uBAAuB,GACvB,yBAAyB,GACzB,4BAA4B,GAC5B,4BAA4B,GAC5B,yBAAyB,GACzB,uBAAuB,GACvB,mBAAmB,GACnB,yBAAyB,GACzB,WAAW,GACX,uBAAuB,GACvB,2BAA2B,GAC3B,mCAAmC,GACnC,8BAA8B,GAC9B,kCAAkC,GAClC,4BAA4B,GAC5B,4BAA4B,GAC5B,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,iBAAiB,GACjB,oBAAoB,GACpB,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,sBAAsB,CAAC;AAE3B,eAAO,MAAM,8BAA8B,EAAE,MAAM,CACjD,iBAAiB,EACjB,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,CA+BvC,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,2BAA2B,CAOrF;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,GACb,2BAA2B,GAAG,SAAS,CAezC;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,2BAA2B,CAAC;IACnC,cAAc,EAAE,2BAA2B,CAAC;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,2BAA2B,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,QAAQ,CAWX;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,uBAAuB,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,4BAA4B,CAAC;AAEpE,2EAA2E;AAC3E,MAAM,MAAM,yBAAyB,GAAG;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,mCAAmC,GAAG;IAChD,eAAe,EAAE,CAAC,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,YAAY,GAAG,iBAAiB,CAAC;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,CAAC,EAAE,CAAC,CAAC;IACL,gBAAgB,EAAE;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,KAAK,CAAC;KACjB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,CAAC,EAAE,CAAC,CAAC;IACL,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,OAAO,GAAG,cAAc,CAAC;IACtC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,gCAAgC,CAAC;IACrD,2EAA2E;IAC3E,eAAe,CAAC,EAAE,8BAA8B,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE5E,MAAM,MAAM,qBAAqB,GAAG;IAClC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;AAE3E,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEjE,MAAM,MAAM,eAAe,GAAG;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,IAAI,EAAE,mBAAmB,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,CAAC,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B,GACD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,SAAS,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,SAAS,CAAA;CAAE,CAAC;AAgB3C,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AACpG,eAAO,MAAM,qCAAqC,EAAE,WAAW,CAAC,MAAM,CAKpE,CAAC;AAoGH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CA8BhF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAkBhF;AAiBD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,GAAG,SAAS,CAoC9F;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAKjF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,GACb,yBAAyB,GAAG,SAAS,CAqBvC;AA2FD;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,KAAK,EAAE,OAAO,GACb,mCAAmC,GAAG,SAAS,CAyGjD;AAID,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,GAAG,SAAS,CAwB9F"}
+{"version":3,"file":"hosted-delivery-protocol.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-delivery-protocol.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAClD,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AACrE,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AACrE,eAAO,MAAM,4BAA4B,cAAc,CAAC;AACxD,eAAO,MAAM,2BAA2B,aAAa,CAAC;AAEtD,MAAM,MAAM,2BAA2B,GACnC,OAAO,4BAA4B,GACnC,OAAO,2BAA2B,CAAC;AAEvC,eAAO,MAAM,qCAAqC,IAAI,CAAC;AAEvD,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,UAAU,GACV,UAAU,GACV,OAAO,GACP,YAAY,GACZ,cAAc,GACd,SAAS,CAAC;AAEd,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEpF,MAAM,MAAM,2BAA2B,GAAG;IACxC,CAAC,EAAE,OAAO,qCAAqC,CAAC;IAChD,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,mBAAmB,CAAC;CAC7B,CAAC;AAmBF,MAAM,MAAM,iBAAiB,GACzB,uBAAuB,GACvB,yBAAyB,GACzB,4BAA4B,GAC5B,uBAAuB,GACvB,4BAA4B,GAC5B,yBAAyB,GACzB,uBAAuB,GACvB,mBAAmB,GACnB,yBAAyB,GACzB,WAAW,GACX,uBAAuB,GACvB,2BAA2B,GAC3B,mCAAmC,GACnC,8BAA8B,GAC9B,kCAAkC,GAClC,4BAA4B,GAC5B,4BAA4B,GAC5B,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,iBAAiB,GACjB,oBAAoB,GACpB,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,sBAAsB,CAAC;AAE3B,eAAO,MAAM,8BAA8B,EAAE,MAAM,CACjD,iBAAiB,EACjB,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAgCvC,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,2BAA2B,CAOrF;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,GACb,2BAA2B,GAAG,SAAS,CAezC;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,2BAA2B,CAAC;IACnC,cAAc,EAAE,2BAA2B,CAAC;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,2BAA2B,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,QAAQ,CAYX;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,uBAAuB,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,4BAA4B,CAAC;AAEpE,2EAA2E;AAC3E,MAAM,MAAM,yBAAyB,GAAG;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,mCAAmC,GAAG;IAChD,eAAe,EAAE,CAAC,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,YAAY,GAAG,iBAAiB,CAAC;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,CAAC,EAAE,CAAC,CAAC;IACL,gBAAgB,EAAE;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,KAAK,CAAC;KACjB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,CAAC,EAAE,CAAC,CAAC;IACL,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,OAAO,GAAG,cAAc,CAAC;IACtC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,gCAAgC,CAAC;IACrD,2EAA2E;IAC3E,eAAe,CAAC,EAAE,8BAA8B,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE5E,MAAM,MAAM,qBAAqB,GAAG;IAClC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,YAC7C,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,sBAAsB,EACtB,kBAAkB,CACV,CAAC;AAEX,MAAM,MAAM,8BAA8B,GAAG,CAAC,OAAO,kCAAkC,CAAC,CAAC,MAAM,CAAC,CAAC;AAuBjG,MAAM,MAAM,+BAA+B,GAAG;IAC5C,MAAM,EAAE,8BAA8B,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,CAAC,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,+BAA+B,CAAC;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACnF;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAI/E;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,8BAA8B,CAkBhC;AAED,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,GACb,+BAA+B,GAAG,SAAS,CAmB7C;AAED;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEjE,MAAM,MAAM,eAAe,GAAG;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,IAAI,EAAE,mBAAmB,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,CAAC,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B,GACD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,SAAS,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,SAAS,CAAA;CAAE,CAAC;AAgB3C,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AACpG,eAAO,MAAM,qCAAqC,EAAE,WAAW,CAAC,MAAM,CAKpE,CAAC;AAoGH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CA8BhF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAkBhF;AAiBD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,GAAG,SAAS,CAoC9F;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAKjF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,GACb,yBAAyB,GAAG,SAAS,CAqBvC;AA2FD;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,KAAK,EAAE,OAAO,GACb,mCAAmC,GAAG,SAAS,CAyGjD;AAWD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,GAAG,SAAS,CAqC9F"}

package/dist/internal/hosted-delivery-protocol.js

@@ -4,6 +4,7 @@
  * any shape or semantic change must use a new version and a rolling
  * compatibility window. See `docs/agent-serve/hosted-delivery-protocol.md`.
  */
+import { packageVersion } from "./distribution.js";
 export const HOSTED_DELIVERY_PROTOCOL_VERSION = 2;
 export const HOSTED_DELIVERY_HEADER = "x-agent-sdk-hosted-delivery";
 export const HOSTED_ADMISSION_PATH = "/v1/internal/hosted-admission";
@@ -31,6 +32,7 @@ export const HOSTED_FAILURE_CLASSIFICATIONS = {
     agent_admission_threw: { domain: "agent", source: "agent" },
     agent_dependency_failed: { domain: "dependency", source: "factory" },
     background_dispatch_failed: { domain: "agent", source: "agent" },
+    bound_secrets_missing: { domain: "platform", source: "engine" },
     bound_secrets_not_consumed: { domain: "platform", source: "engine" },
     channel_dispatch_failed: { domain: "agent", source: "agent" },
     channel_kind_mismatch: { domain: "configuration", source: "engine" },
@@ -95,6 +97,7 @@ export function hostedGuestErrorResponse(input) {
         message: input.message,
         turnStatus: input.turnStatus,
         errorCode: input.errorCode,
+        engineVersion: packageVersion(),
     };
     return Response.json(body, { status: input.status });
 }
@@ -116,6 +119,84 @@ export const HOSTED_REMINDER_CHANNEL_KIND = "agent-sdk:reminder";
  * Payload is {@link HostedReminderFirePayload}.
  */
 export const HOSTED_REMINDER_EVENT_TYPE = "agent-sdk.reminder/fire";
+/**
+ * Handler 4xx reasons an admission skip can carry. Benign skips (nothing to
+ * do) omit `rejection`. Engine HTTP failures use the hosted failure codes
+ * instead and are not skips.
+ */
+export const HOSTED_ADMISSION_REJECTION_REASONS = [
+    "missing_secret",
+    "missing_signature",
+    "signature_mismatch",
+    "invalid_signature",
+    "invalid_token",
+    "invalid_json",
+    "invalid_payload",
+    "unbound_origin_app",
+    "invalid_app",
+    "invalid_installation",
+    "handler_rejected",
+];
+const HOSTED_ADMISSION_REJECTION_REASON_SET = new Set(HOSTED_ADMISSION_REJECTION_REASONS);
+/** Handler `error` values that all mean the payload did not match the channel schema. */
+const HOSTED_ADMISSION_INVALID_PAYLOAD_ERRORS = new Set([
+    "invalid_pull_request_payload",
+    "invalid_issue_comment_payload",
+    "invalid_review_comment_payload",
+    "invalid_issues_payload",
+    "invalid_check_suite_payload",
+    "invalid_check_run_payload",
+    "invalid_workflow_run_payload",
+    "invalid_status_payload",
+    "invalid_gitlab_payload",
+    "invalid_origin_payload",
+    "invalid_origin_comment_payload",
+    "invalid_bitbucket_payload",
+    "invalid_deployment_event",
+]);
+const HOSTED_ADMISSION_REJECTION_KEYS = new Set(["reason", "status"]);
+/**
+ * Map a handler `error` token onto the closed admission-rejection set.
+ * GitHub's `mismatch` becomes `signature_mismatch`. Payload-specific names
+ * become `invalid_payload`. Anything else is `handler_rejected`.
+ */
+export function classifyHostedAdmissionRejection(error) {
+    switch (error) {
+        case "missing_secret":
+        case "missing_signature":
+        case "invalid_signature":
+        case "invalid_token":
+        case "invalid_json":
+        case "unbound_origin_app":
+        case "invalid_app":
+        case "invalid_installation":
+            return error;
+        case "mismatch":
+            return "signature_mismatch";
+        default:
+            return error !== undefined && HOSTED_ADMISSION_INVALID_PAYLOAD_ERRORS.has(error)
+                ? "invalid_payload"
+                : "handler_rejected";
+    }
+}
+export function parseHostedAdmissionHandlerRejection(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const body = value;
+    if (Object.keys(body).some(key => !HOSTED_ADMISSION_REJECTION_KEYS.has(key))) {
+        return undefined;
+    }
+    if (typeof body.reason !== "string" ||
+        !HOSTED_ADMISSION_REJECTION_REASON_SET.has(body.reason) ||
+        typeof body.status !== "number" ||
+        !Number.isInteger(body.status) ||
+        body.status < 400 ||
+        body.status > 499) {
+        return undefined;
+    }
+    return { reason: body.reason, status: body.status };
+}
 /**
  * Cap on delivery IDs an owner execute may report as consumed (primary +
  * accepted active-guest enqueues). Enqueue requests beyond this return
@@ -513,7 +594,14 @@ export function parseHostedReminderFireDescriptorPayload(value) {
     }
     return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ protocolVersion: 1, id: body.id, fireCount: body.fireCount, generation: body.generation, purpose: body.purpose, channelId: body.channelId, continuationToken: body.continuationToken }, (target === undefined ? {} : { target })), { scheduleKind: body.scheduleKind, scheduleValue: body.scheduleValue }), (body.intervalMs === undefined ? {} : { intervalMs: body.intervalMs })), (body.prompt === undefined ? {} : { prompt: body.prompt })), (body.handler === undefined ? {} : { handler: body.handler })), (args === undefined ? {} : { args })), { hasRunHandler: body.hasRunHandler, hasUntilFn: body.hasUntilFn }), (body.untilPrompt === undefined ? {} : { untilPrompt: body.untilPrompt })), { busyPolicy: body.busyPolicy, nextFireAtMs: body.nextFireAtMs, claimedAtMs: body.claimedAtMs });
 }
-const HOSTED_ADMISSION_OUTCOME_KEYS = new Set(["ok", "v", "outcome", "admissionToken"]);
+const HOSTED_ADMISSION_OUTCOME_KEYS = new Set([
+    "ok",
+    "v",
+    "outcome",
+    "admissionToken",
+    "rejection",
+    "engineVersion",
+]);
 export function parseHostedAdmissionOutcome(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
         return undefined;
@@ -535,5 +623,18 @@ export function parseHostedAdmissionOutcome(value) {
     if (body.outcome !== "send" && Object.hasOwn(body, "admissionToken")) {
         return undefined;
     }
+    if (Object.hasOwn(body, "rejection")) {
+        if (body.outcome !== "skip") {
+            return undefined;
+        }
+        const rejection = parseHostedAdmissionHandlerRejection(body.rejection);
+        if (rejection === undefined) {
+            return undefined;
+        }
+        body.rejection = rejection;
+    }
+    if (Object.hasOwn(body, "engineVersion") && !boundedString(body.engineVersion, 64)) {
+        return undefined;
+    }
     return body;
 }

package/dist/internal/hosted-delivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-delivery.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-delivery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAc,kBAAkB,EAAE,kBAAkB,EAAe,MAAM,aAAa,CAAC;AAEnG,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAKL,KAAK,sBAAsB,EAG5B,MAAM,oBAAoB,CAAC;AAS5B,OAAO,EAQL,KAAK,oBAAoB,EAGzB,KAAK,mCAAmC,EAQzC,MAAM,+BAA+B,CAAC;AAmBvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAIlD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAErE,KAAK,aAAa,GAAG;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AA8JF;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAU9F;AAmQD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAClF;;;;OAIG;IACH,YAAY,CAAC,CACX,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH;;;OAGG;IACH,yBAAyB,CAAC,CAAC,UAAU,EAAE,mCAAmC,GAAG,OAAO,CAAC;QACnF,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH;;;;;OAKG;IACH,sBAAsB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D;;;OAGG;IACH,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,8DAA8D;IAC9D,aAAa,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,wDAAwD;IACxD,YAAY,CAAC,IAAI,YAAY,EAAE,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;OAGG;IACH,mBAAmB,CAAC,IAAI,OAAO,CAAC,sBAAsB,GAAG,OAAO,CAAC,CAAC;IAClE;;;;OAIG;IACH,mBAAmB,CAAC,IAAI,wBAAwB,CAAC;CAClD,GAAG,IAAI,CA6nBP"}
+{"version":3,"file":"hosted-delivery.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-delivery.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAc,kBAAkB,EAAE,kBAAkB,EAAe,MAAM,aAAa,CAAC;AAEnG,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAKL,KAAK,sBAAsB,EAG5B,MAAM,oBAAoB,CAAC;AAS5B,OAAO,EAQL,KAAK,oBAAoB,EAIzB,KAAK,mCAAmC,EASzC,MAAM,+BAA+B,CAAC;AAoBvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAIlD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAErE,KAAK,aAAa,GAAG;IACnB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AA8JF;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAU9F;AA2RD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAClF;;;;OAIG;IACH,YAAY,CAAC,CACX,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH;;;OAGG;IACH,yBAAyB,CAAC,CAAC,UAAU,EAAE,mCAAmC,GAAG,OAAO,CAAC;QACnF,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH;;;;;OAKG;IACH,sBAAsB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D;;;OAGG;IACH,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,8DAA8D;IAC9D,aAAa,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,wDAAwD;IACxD,YAAY,CAAC,IAAI,YAAY,EAAE,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;OAGG;IACH,mBAAmB,CAAC,IAAI,OAAO,CAAC,sBAAsB,GAAG,OAAO,CAAC,CAAC;IAClE;;;;OAIG;IACH,mBAAmB,CAAC,IAAI,wBAAwB,CAAC;CAClD,GAAG,IAAI,CA+nBP"}

package/dist/internal/hosted-delivery.js

@@ -8,6 +8,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { randomBytes } from "node:crypto";
+import { packageVersion } from "./distribution.js";
 import { dispatchOutcome } from "./channel-dispatch.js";
 import { consumeHostedBoundSecrets, } from "./cursor/hosted-bound-secrets.js";
 import { createDeferredChannelSession, DeferredChannelSessionError, } from "./deferred-channel-session.js";
@@ -16,9 +17,9 @@ import { classifyExpectedDeliveryFailure } from "./expected-delivery-failure.js"
 import { formatGuestNetworkServerTiming, GUEST_CONNECT_STALLED, GUEST_NETWORK_UNAVAILABLE, GuestNetworkUnavailableError, waitForGuestNetworkReady, } from "./guest-network.js";
 import { getHostedAdmissionAdapter, } from "./hosted-admission-adapter.js";
 import { HostedAdmissionLocalSendError, runDuringHostedAdmission, } from "./hosted-admission-context.js";
-import { HOSTED_ADMISSION_PATH, HOSTED_DELIVERY_HEADER, HOSTED_DELIVERY_PROTOCOL_VERSION, HOSTED_EXECUTION_PATH, HOSTED_GUEST_RETRY_TERMINAL, HOSTED_GUEST_RETRY_TRANSIENT, HOSTED_MAX_CONSUMED_DELIVERY_IDS, hostedFailureClassification, hostedGuestErrorResponse, isHostedReminderAdmission, parseHostedAdmission, parseHostedExecution, parseHostedReminderFireDescriptorPayload, parseHostedReminderFirePayload, } from "./hosted-delivery-protocol.js";
+import { HOSTED_ADMISSION_PATH, HOSTED_DELIVERY_HEADER, HOSTED_DELIVERY_PROTOCOL_VERSION, HOSTED_EXECUTION_PATH, HOSTED_GUEST_RETRY_TERMINAL, HOSTED_GUEST_RETRY_TRANSIENT, HOSTED_MAX_CONSUMED_DELIVERY_IDS, hostedFailureClassification, hostedGuestErrorResponse, isHostedReminderAdmission, parseHostedAdmissionHandlerRejection, parseHostedAdmission, parseHostedExecution, parseHostedReminderFireDescriptorPayload, parseHostedReminderFirePayload, } from "./hosted-delivery-protocol.js";
 import { abortReasonFromTurnStatus, HOSTED_EXECUTION_DIAG_RUNNING_STATUS, hostedExecutionDiagId, } from "./hosted-execution-diag.js";
-import { flushHostedExecutionRecord, } from "./hosted-execution-flush.js";
+import { flushHostedExecutionRecord, refreshStartLogWhile, } from "./hosted-execution-flush.js";
 import { finalizeHostedExecutionLatency, formatHostedExecutionLatencyServerTiming, hostedExecutionNow, runWithHostedExecutionLatency, } from "./hosted-execution-latency.js";
 import { recordHostedManagedAutomation } from "./hosted-managed-automation.js";
 import { readJsonObject } from "./http-channel.js";
@@ -309,15 +310,34 @@ function runAdmission(input, adapter) {
                 response: terminalHostedError(502, "channel_outcome_missing"),
             };
         }
+        const rejection = outcome === "skip" ? yield handlerRejection(dispatched) : undefined;
         return {
-            response: Response.json({
-                ok: true,
-                v: HOSTED_DELIVERY_PROTOCOL_VERSION,
-                outcome,
-            }),
+            response: Response.json(Object.assign({ ok: true, v: HOSTED_DELIVERY_PROTOCOL_VERSION, outcome }, (rejection === undefined ? {} : { rejection, engineVersion: packageVersion() }))),
         };
     });
 }
+/** Handler 4xx on a skip. Benign skips (nothing to do) have no status. */
+function handlerRejection(response) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const body = (yield response.clone().json());
+            if (typeof body !== "object" || body === null || Array.isArray(body)) {
+                return undefined;
+            }
+            const record = body;
+            if (record.skipped !== true) {
+                return undefined;
+            }
+            return parseHostedAdmissionHandlerRejection({
+                reason: record.reason,
+                status: record.status,
+            });
+        }
+        catch (_a) {
+            return undefined;
+        }
+    });
+}
 function withServerTiming(response, durationMs, guestNetwork, latency) {
     const parts = [`agent_sdk;desc="hosted";dur=${Math.max(0, durationMs).toFixed(1)}`];
     if (guestNetwork !== undefined) {
@@ -368,7 +388,7 @@ function logGuestNetworkWait(phase, stats) {
     if (stats.outcome === "skipped") {
         return;
     }
-    console.info(`[agent-sdk] guest network ${stats.outcome} phase=${phase} waitMs=${String(stats.waitMs)} probes=${String(stats.probeAttempts)}`);
+    console.info(`[bdk] guest network ${stats.outcome} phase=${phase} waitMs=${String(stats.waitMs)} probes=${String(stats.probeAttempts)}`);
 }
 export function registerHostedDeliveryRoute(input) {
     var _a, _b;
@@ -502,7 +522,7 @@ export function registerHostedDeliveryRoute(input) {
                         !Array.isArray(rawAdmission)
                         ? Object.keys(rawAdmission)
                         : [];
-                    console.info(`[agent-sdk] hosted admission rejected: envelope failed to parse keys=${JSON.stringify(rawKeys)} hasManagedAutomation=${String(rawKeys.includes("managedAutomation"))}`);
+                    console.info(`[bdk] hosted admission rejected: envelope failed to parse keys=${JSON.stringify(rawKeys)} hasManagedAutomation=${String(rawKeys.includes("managedAutomation"))}`);
                     return finish(terminalHostedError(400, "invalid_hosted_admission", "Expected a supported Agent SDK hosted-admission envelope."));
                 }
                 pruneExpired();
@@ -533,7 +553,7 @@ export function registerHostedDeliveryRoute(input) {
                             : responseFromReply(existing.settledReply);
                     }
                 }
-                console.info(`[agent-sdk] hosted admission received deliveryId=${delivery.deliveryId} channelId=${delivery.channelId} channelKind=${delivery.channelKind} eventType=${delivery.eventType} sessionMode=${delivery.sessionMode} managedAutomation=${delivery.managedAutomation === undefined ? "<absent>" : `automationUuid=${delivery.managedAutomation.automationUuid} mcpServerNames=${String(delivery.managedAutomation.mcpServerNames.length)} slackChannels=${delivery.managedAutomation.slackChannels === undefined ? "<absent>" : JSON.stringify(delivery.managedAutomation.slackChannels)}`}`);
+                console.info(`[bdk] hosted admission received deliveryId=${delivery.deliveryId} channelId=${delivery.channelId} channelKind=${delivery.channelKind} eventType=${delivery.eventType} sessionMode=${delivery.sessionMode} managedAutomation=${delivery.managedAutomation === undefined ? "<absent>" : `automationUuid=${delivery.managedAutomation.automationUuid} mcpServerNames=${String(delivery.managedAutomation.mcpServerNames.length)} slackChannels=${delivery.managedAutomation.slackChannels === undefined ? "<absent>" : JSON.stringify(delivery.managedAutomation.slackChannels)}`}`);
                 recordHostedManagedAutomation(delivery);
                 const reminder = isHostedReminderAdmission(delivery);
                 const definition = reminder
@@ -693,7 +713,7 @@ export function registerHostedDeliveryRoute(input) {
                                 sessionId,
                                 turnStatus: HOSTED_EXECUTION_DIAG_RUNNING_STATUS,
                             });
-                            const outcome = yield session.waitForCompletion();
+                            const outcome = yield refreshStartLogWhile(sinks, execution.sessionPublicId, () => session.waitForCompletion());
                             completionAt = hostedExecutionNow();
                             // Status is the owner turn. waitForCompletion still waited
                             // for any drained successor so this process is not parked
@@ -856,7 +876,7 @@ function enqueueIntoActiveOwner(input) {
                 }
                 resolveResult({ outcome: "not_active" });
                 if (!(error instanceof HostedEnqueueNotActiveError)) {
-                    console.warn(`[agent-sdk] hosted enqueue inject failed deliveryId=${input.deliveryId}: ${error instanceof Error ? error.message : String(error)}`);
+                    console.warn(`[bdk] hosted enqueue inject failed deliveryId=${input.deliveryId}: ${error instanceof Error ? error.message : String(error)}`);
                 }
             }
         }))();

package/dist/internal/hosted-execution-diag.d.ts

@@ -1,31 +1,24 @@
 /**
- * Guest-local TAS diag (`hosted-execution.json`). Flushed with the durable
- * session-run document and the `start.log` tee by
- * `hosted-execution-flush.ts`.
+ * Local diagnostic record for one hosted execution. Flushed with durable
+ * execution history and process output.
  */
 import { type HostedFailureClassification } from "./hosted-delivery-protocol.js";
 export declare const HOSTED_EXECUTION_DIAG_VERSION = 1;
 /** Cap so a runaway message cannot fill the guest disk or the host log. */
 export declare const HOSTED_EXECUTION_DIAG_MAX_BYTES = 4096;
 /**
- * Correlate the on-disk record with the execution that produced it. One pod
- * serves many deliveries of a continuation session, and the file lives at a
- * single fixed path, so without this the host can read a *previous*
- * delivery's terminal record whenever July never reaches its own write —
- * the 9-minute host POST timeout, a 409 on an expired admission token, or a
- * replayed token that short-circuits on the memoized reply.
+ * Correlate the fixed-path record with the execution that produced it. An
+ * interrupted attempt can otherwise leave the previous execution's terminal
+ * record behind.
  *
- * Derived from the admission token (which both sides already hold) rather
- * than carried on the wire. The digest is one-way, so the token itself never
- * reaches the guest disk or the host logs.
+ * Derive the id from the admission token. The one-way digest prevents the
+ * token itself from reaching disk or logs.
  */
 export declare function hostedExecutionDiagId(admissionToken: string): string;
 export type HostedExecutionDiagAbortReason = "signal_abort" | "runner_cancelled" | "runner_error" | "execute_throw";
 /**
- * Bounded guest-side record of one hosted-execution attempt. No prompt,
- * tool content, or API key — the host copies known keys onto the Temporal
- * activity span for Datadog. `errorCode` and `message` are logged ungated;
- * `stack` stays behind the internal-diag gate.
+ * Bounded record of one hosted execution. It omits prompts, tool content, and
+ * credentials. Stack details remain behind the diagnostic gate.
  */
 export type HostedExecutionDiag = {
     v: typeof HOSTED_EXECUTION_DIAG_VERSION;
@@ -50,19 +43,15 @@ export type HostedExecutionDiag = {
 };
 /** Written before the turn starts so a stalled execution still has a record. */
 export declare const HOSTED_EXECUTION_DIAG_RUNNING_STATUS = "running";
-/** First line + frames; factory `last_error` is 1024 chars with a TAS prefix. */
+/** Bounds for a short error stack summary. */
 export declare const HOSTED_ERROR_STACK_LINE_COUNT = 5;
 export declare const HOSTED_ERROR_SNIPPET_MAX_CHARS = 700;
 /**
- * Bounded throw text for on-disk diag `stack` (and non-hosted 500 bodies).
- * Prefers `Error.stack` (message line + `at` frames). Hosted HTTP `message`
- * uses {@link hostedErrorMessageOnly} so customer Datadog stays frame-free.
+ * Bounded throw text for diagnostics and non-hosted 500 bodies. Prefers
+ * `Error.stack` with its message and first frames.
  */
 export declare function hostedErrorStackSnippet(error: unknown): string;
-/**
- * Guest throw text without `at` frames. Hosted 500 `message` is ungated on
- * TAS (`hostedGuestMessage` / `last_error`); stack frames stay on `stack`.
- */
+/** Hosted response text without stack frames. */
 export declare function hostedErrorMessageOnly(error: unknown): string;
 export declare function hostedExecutionDiagPath(stateRoot: string): string;
 export declare function abortReasonFromTurnStatus(status: string, cancellationReason: "signal" | "runner" | undefined): HostedExecutionDiagAbortReason | undefined;