@cursor/july 0.1.95 → 0.1.97

package/src/internal/deploy-client.ts

@@ -260,6 +260,13 @@ export interface AgentkitDeployStatus {
   status: AgentkitCustomerStatus;
   progress: AgentkitDeployProgress;
   statusMessage: string | null;
+  /** Why the bake failed. Null/absent unless `status` is `failed`. */
+  lastError?: string | null;
+  /**
+   * `owner/name` scopes the deployment's GitHub/Origin channels watch.
+   * Absent on control planes that predate the field.
+   */
+  repositories?: string[];
 }
 
 export const TERMINAL_AGENTKIT_DEPLOY_STATUSES: ReadonlySet<AgentkitCustomerStatus> =
@@ -350,6 +357,8 @@ const agentkitDeployStatusSchema = z
       "stopped",
     ]),
     statusMessage: z.string().nullable(),
+    // Optional: backends that predate the v2 bake-failure column omit it.
+    lastError: z.string().nullable().optional(),
   })
   .passthrough();
 
@@ -598,6 +607,8 @@ export class AgentServeDeployClient {
     agentPath?: string;
     components?: AgentkitDeployComponent[];
     repositories?: string[];
+    /** Redeploy an existing Cursor-managed (multi-tenant) product. */
+    multiTenant?: boolean;
   }): Promise<AgentkitDeployAccepted> {
     const slugError = validateDeploymentSlug(args.slug);
     if (slugError !== undefined) {
@@ -626,6 +637,7 @@ export class AgentServeDeployClient {
           args.repositories !== undefined && args.repositories.length > 0
             ? args.repositories
             : undefined,
+        ...(args.multiTenant === true ? { multiTenant: true } : {}),
       },
       context: { verb: "deploy", slug: args.slug },
     });
@@ -890,6 +902,37 @@ export class AgentServeDeployClient {
   }
 }
 
+const MCP_GATEWAY_PATH =
+  /^\/internal\/agent-serve\/mcp\/(\d+)\/([^/]+)(?:\/tools)?\/?$/;
+
+/**
+ * Inverse of {@link AgentServeDeployClient.mcpGatewayUrl}. Also accepts
+ * the hosted `--cloud-tools-url` form (`…/tools`).
+ */
+export function parseAgentServeMcpGatewayUrl(
+  url: string
+): { teamId: number; slug: string } | undefined {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return undefined;
+  }
+  const match = MCP_GATEWAY_PATH.exec(parsed.pathname);
+  if (match === null) {
+    return undefined;
+  }
+  const teamId = Number.parseInt(match[1]!, 10);
+  if (!Number.isInteger(teamId) || teamId <= 0) {
+    return undefined;
+  }
+  const slug = decodeURIComponent(match[2]!);
+  if (validateDeploymentSlug(slug) !== undefined) {
+    return undefined;
+  }
+  return { teamId, slug };
+}
+
 // ============================================================================
 // Error mapping (HTTP → actionable human messages)
 // ============================================================================

package/src/internal/env-file.ts

@@ -0,0 +1,84 @@
+/**
+ * Shared `.env` / `.env.local` writers for CLI commands that mint tokens.
+ */
+
+import { chmod, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+function isErrnoException(error: unknown): error is NodeJS.ErrnoException {
+  return error instanceof Error && "code" in error;
+}
+
+async function readOptionalFile(path: string): Promise<string> {
+  try {
+    return await readFile(path, "utf8");
+  } catch (error) {
+    if (isErrnoException(error) && error.code === "ENOENT") {
+      return "";
+    }
+    throw error;
+  }
+}
+
+/**
+ * Append `KEY=value` lines to an env file, replacing every existing line
+ * for the same key instead of appending duplicates. Creates the file when
+ * missing.
+ */
+export async function upsertEnvFile(
+  path: string,
+  entries: Array<{ key: string; value: string }>
+): Promise<void> {
+  const existing = await readOptionalFile(path);
+  const lines =
+    existing === "" ? [] : existing.replace(/\r?\n$/, "").split(/\r?\n/);
+  // A stale `export KEY=…` line would shadow or duplicate the bare line
+  // under some loaders; treat both spellings as the same entry.
+  const matchesKey = (line: string, key: string): boolean =>
+    line.startsWith(`${key}=`) || line.startsWith(`export ${key}=`);
+  for (const { key, value } of entries) {
+    const next = `${key}=${value}`;
+    let replaced = false;
+    for (let i = 0; i < lines.length; ) {
+      if (!matchesKey(lines[i] ?? "", key)) {
+        i += 1;
+        continue;
+      }
+      if (replaced) {
+        lines.splice(i, 1);
+        continue;
+      }
+      lines[i] = next;
+      replaced = true;
+      i += 1;
+    }
+    if (!replaced) {
+      lines.push(next);
+    }
+  }
+  // writeFile's mode only applies on create; clamp pre-existing files too.
+  await writeFile(path, `${lines.join("\n")}\n`, { mode: 0o600 });
+  await chmod(path, 0o600);
+}
+
+/**
+ * Ensure the agent directory's .gitignore covers .env.local (create or
+ * append). A bare `.env` line does not count — that pattern matches only
+ * the file literally named .env.
+ */
+export async function ensureEnvLocalGitignored(dir: string): Promise<boolean> {
+  const path = join(dir, ".gitignore");
+  const existing = await readOptionalFile(path);
+  const covered = existing
+    .split(/\r?\n/)
+    .some((line) => /^\.env(\.local\*?|\.\*|\*)$/.test(line.trim()));
+  if (covered) {
+    return false;
+  }
+  const next =
+    existing === "" || existing.endsWith("\n")
+      ? `${existing}.env.local\n`
+      : `${existing}\n.env.local\n`;
+  await writeFile(path, next);
+  return true;
+}

package/src/internal/framework-file-storage.ts

@@ -0,0 +1,228 @@
+/**
+ * Framework-level file storage for v2 hosted engines.
+ *
+ * Hosted deployments carry two file stores with different audiences:
+ *
+ * - the **user-level** store (`AGENT_SERVE_STORE_SOURCE_ID`) holds
+ *   author-facing bytes — `ctx.host.files`, skills, memory, artifacts — and
+ *   is browsable from the dashboard and mountable on cloud-runtime VMs;
+ * - the **framework-level** store (`AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID`)
+ *   holds engine-owned session state — session records, event transcripts,
+ *   the continuation index, and the SDK conversation mirror — and is never
+ *   exposed to authors or models.
+ *
+ * This module puts framework session state on the framework store. The
+ * {@link storageKeys} scheme was designed for exactly this: keys are a
+ * stable versioned contract that sinks may route on, so
+ * {@link composeFrameworkStorage} splits one {@link StorageConfig} by key
+ * kind — `session` / `session-events` / `continuation` go to the framework
+ * file store (file-shaped; the store accepts values up to 64 MiB per
+ * object without chunking, versus the KV proxy's 1 MiB row cap), while
+ * author `kv`, eval runs, A/B samples, and conditional writes stay on the
+ * control-plane KV proxy (the dashboard reads them there, and CAS needs a
+ * database).
+ *
+ * v2 only, by construction: the composite is selected in
+ * framework-storage-selection.ts, which v1 never reaches with a
+ * platform-selected definition.
+ */
+
+import type { FileSink } from "../files.js";
+import type { StorageConfig, StorageEntry } from "../storage.js";
+import { STORAGE_KEY_ROOT } from "../storage-protocol.js";
+import type { JsonValue } from "../types.js";
+import { mapBounded } from "./bounded.js";
+
+/**
+ * Key kinds (`agentkit/v1/{agent}/{kind}/…`) that live on the framework
+ * file store. Everything else stays on the KV sink.
+ */
+const FRAMEWORK_FILE_KINDS: ReadonlySet<string> = new Set([
+  "session",
+  "session-events",
+  "continuation",
+]);
+
+/**
+ * Whether a framework-minted key (or list prefix) belongs on the framework
+ * file store. Prefixes used by the coordinator are always at least
+ * kind-scoped (`…/{agent}/session/`), so a prefix routes wholly to one side.
+ */
+export function isFrameworkFileKey(key: string): boolean {
+  if (!key.startsWith(`${STORAGE_KEY_ROOT}/`)) {
+    return false;
+  }
+  const rest = key.slice(STORAGE_KEY_ROOT.length + 1);
+  const agentEnd = rest.indexOf("/");
+  if (agentEnd === -1) {
+    return false;
+  }
+  const afterAgent = rest.slice(agentEnd + 1);
+  const kindEnd = afterAgent.indexOf("/");
+  const kind = kindEnd === -1 ? afterAgent : afterAgent.slice(0, kindEnd);
+  return FRAMEWORK_FILE_KINDS.has(kind);
+}
+
+/** The KV core over a {@link FileSink}: one JSON document per key. */
+export type FileSinkStorageCore = Required<
+  Pick<StorageConfig, "put" | "get" | "delete" | "list">
+>;
+
+/**
+ * Adapt a {@link FileSink} to the `defineStorage` KV core. Storage keys are
+ * framework-minted (URI-encoded, length-bounded segments — see
+ * {@link storageKeys}), so they are used as file keys verbatim; values are
+ * stored as JSON bytes. Parse failures throw: on the lazy-restore path a
+ * corrupt document must fail the follow-up rather than read as a miss, and
+ * the startup bulk restore already logs-and-skips a throwing `list`.
+ */
+/** Parallel per-key reads backing `list` (each is presign + object GET). */
+const LIST_READ_CONCURRENCY = 8;
+
+/**
+ * A storage key whose path the file store cannot represent (an empty, `.`,
+ * or `..` segment — possible only through caller-controlled segments such
+ * as continuation tokens or a caller-supplied session id). Such an object
+ * can never exist in the store, so reads are a definitive miss rather than
+ * a per-request 400 that the lazy-restore path would propagate forever.
+ */
+function isUnrepresentableFileKey(key: string): boolean {
+  return key
+    .split("/")
+    .some((segment) => segment === "" || segment === "." || segment === "..");
+}
+
+export function fileSinkStorageCore(sink: FileSink): FileSinkStorageCore {
+  return {
+    async put(key, value): Promise<void> {
+      if (isUnrepresentableFileKey(key)) {
+        // Loud rather than silent: the coordinator logs and drops failed
+        // mirror writes (at-most-once), and awaited callers must not
+        // believe an impossible write landed.
+        throw new Error(
+          `framework file storage: key "${key}" has a path segment the store cannot represent`
+        );
+      }
+      await sink.put(key, new TextEncoder().encode(JSON.stringify(value)));
+    },
+    async get(key): Promise<JsonValue | undefined> {
+      if (isUnrepresentableFileKey(key)) {
+        return undefined;
+      }
+      const body = await sink.get(key);
+      if (body === undefined) {
+        return undefined;
+      }
+      return decodeDocument(key, body instanceof Uint8Array ? body : body.body);
+    },
+    async delete(key): Promise<void> {
+      if (isUnrepresentableFileKey(key)) {
+        return;
+      }
+      await sink.delete(key);
+    },
+    async list(prefix): Promise<StorageEntry[]> {
+      const entries = await sink.list(prefix);
+      // FileSink.list returns metadata only, so each value is its own
+      // read; bound the fan-out — a bulk read here sits on restore paths.
+      const bodies = await mapBounded(entries, LIST_READ_CONCURRENCY, (entry) =>
+        sink.get(entry.key)
+      );
+      const out: StorageEntry[] = [];
+      for (let index = 0; index < entries.length; index += 1) {
+        const entry = entries[index];
+        const body = bodies[index];
+        if (entry === undefined || body === undefined) {
+          // Deleted between list and read; a miss is not corruption.
+          continue;
+        }
+        out.push({
+          key: entry.key,
+          value: decodeDocument(
+            entry.key,
+            body instanceof Uint8Array ? body : body.body
+          ),
+        });
+      }
+      return out;
+    },
+  };
+}
+
+function decodeDocument(key: string, bytes: Uint8Array): JsonValue {
+  try {
+    return JSON.parse(new TextDecoder().decode(bytes)) as JsonValue;
+  } catch (error) {
+    throw new Error(
+      `framework file storage: stored document at "${key}" is not JSON (${
+        error instanceof Error ? error.message : String(error)
+      })`
+    );
+  }
+}
+
+/**
+ * Split one storage core by key kind: framework session state to `files`,
+ * everything else to `kv`. Spread over the KV backend when building the
+ * full definition so its `evals` / `abs` groups (and the cursor-hosted
+ * marker) ride along untouched; wrap the KV `cas` group with
+ * {@link frameworkGuardedCas} rather than spreading it as-is.
+ */
+export function composeFrameworkStorage(input: {
+  kv: FileSinkStorageCore;
+  files: FileSinkStorageCore;
+}): FileSinkStorageCore & Pick<StorageConfig, "listNewest"> {
+  const route = (key: string): FileSinkStorageCore =>
+    isFrameworkFileKey(key) ? input.files : input.kv;
+  return {
+    put: (key, value, ctx) => route(key).put(key, value, ctx),
+    get: (key, ctx) => route(key).get(key, ctx),
+    delete: (key, ctx) => route(key).delete(key, ctx),
+    list: (prefix, ctx) => route(prefix).list(prefix, ctx),
+    // Session records — the only `listNewest` consumer — are framework file
+    // keys, and the file store has no write-time ordering. Spreading the KV
+    // backend's `listNewest` through would query rows that live elsewhere
+    // (stale KV leftovers, or nothing), so the composed core explicitly has
+    // none and the engine falls back to the routed `list`.
+    listNewest: undefined,
+  };
+}
+
+/**
+ * The KV backend's conditional writes, refusing framework-file keys.
+ *
+ * CAS runs on the KV proxy (a database row version); the plain core routes
+ * framework session state to the file store. A future coordination path
+ * that CASes a `session/` or `continuation/` key would otherwise read and
+ * write a different store than the plain path — silent split-brain. Fail
+ * loudly instead; nothing in the package CASes those kinds today.
+ */
+export function frameworkGuardedCas(
+  cas: NonNullable<StorageConfig["cas"]>
+): NonNullable<StorageConfig["cas"]> {
+  const refuse = (key: string): void => {
+    if (isFrameworkFileKey(key)) {
+      throw new Error(
+        `framework file storage: conditional writes are KV-only, but "${key}" routes to the framework file store`
+      );
+    }
+  };
+  return {
+    getWithVersion: (key, ctx) => {
+      refuse(key);
+      return cas.getWithVersion(key, ctx);
+    },
+    putIfAbsent: (key, value, ctx) => {
+      refuse(key);
+      return cas.putIfAbsent(key, value, ctx);
+    },
+    putIfVersion: (key, value, expectedVersion, ctx) => {
+      refuse(key);
+      return cas.putIfVersion(key, value, expectedVersion, ctx);
+    },
+    listKeys: (prefix, ctx) => {
+      refuse(prefix);
+      return cas.listKeys(prefix, ctx);
+    },
+  };
+}

package/src/internal/framework-storage-selection.ts

@@ -17,11 +17,17 @@
  *
  * - **Cursor-managed hosting** (the deployment-generation environment
  *   variable is set, same signal that registers `GET /v1/manifest`):
- *   the Cursor-hosted backend, so session records, event chunks, `host.kv`,
- *   eval runs, and A/B samples land in the control plane and survive pod
- *   replacement. The API key resolves through the full credential chain on
- *   every call because hosted freeze snapshots listen unsigned and the
- *   binder drops the key file after restore.
+ *   the Cursor-hosted backend. When the deployment carries a
+ *   **framework-level file store**
+ *   (`AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID`), session records, event
+ *   transcripts, and the continuation index live there — file-shaped state
+ *   on file storage, apart from the author-facing user store — while
+ *   `host.kv`, eval runs, A/B samples, and conditional writes stay on the
+ *   control-plane KV proxy (see framework-file-storage.ts). Without one
+ *   (a deploy predating framework-store provisioning), everything goes to
+ *   the KV proxy as before. The API key resolves through the full
+ *   credential chain on every call because hosted freeze snapshots listen
+ *   unsigned and the binder drops the key file after restore.
  * - **Self-hosted**: no mirror. `--state-root` is the durable copy, which
  *   is correct when the operator owns the disk.
  *
@@ -34,11 +40,20 @@
  * pod's filesystem.
  */
 
+import {
+  cursorFrameworkStoreSourceId,
+  cursorHostedFiles,
+} from "../files-backends/cursor-hosted.js";
 import { defineStorage, type StorageDefinition } from "../storage.js";
 import { cursorHostedStorage } from "../storage-backends/cursor-hosted.js";
 import type { AgentArchitecture } from "../types.js";
 import { resolveApiKeySync } from "./cursor/credentials.js";
 import { AGENT_SERVE_GENERATION_ENV_VAR } from "./cursor-relay-core.js";
+import {
+  composeFrameworkStorage,
+  fileSinkStorageCore,
+  frameworkGuardedCas,
+} from "./framework-file-storage.js";
 
 export interface FrameworkStorageSelectionInput {
   /** `agent/storage.ts`, when the author wrote one (v1 only: discovery rejects it on v2). */
@@ -75,13 +90,38 @@ export function selectFrameworkStorageDefinition(
     // Self-hosted v2: the state root is the durable copy.
     return undefined;
   }
+  // Hosted v2 pods wake per delivery: bulk-restoring up to the default
+  // 1000 sessions on every boot is waste (and against the file-store
+  // backend it is per-key HTTP round trips before the listener even
+  // comes up). Follow-ups restore lazily by continuation or session id;
+  // GET /v1/sessions lists from the sink either way.
+  const policy = { restore: "off" } as const;
+  // Full chain (env → key file → stored login): frozen engines listen
+  // unsigned and bind CURSOR_API_KEY_FILE at task time, after this
+  // definition is constructed.
+  const resolveApiKey = (): string | undefined => resolveApiKeySync()?.apiKey;
+  const kv = cursorHostedStorage({ resolveApiKey });
+  const frameworkStoreId = cursorFrameworkStoreSourceId(
+    env as NodeJS.ProcessEnv
+  );
+  if (frameworkStoreId === undefined) {
+    return defineStorage({ name: "cursor-hosted", policy, ...kv });
+  }
+  // Framework session state on the framework-level file store; author kv,
+  // evals, and A/B tables stay on the KV proxy (spread from `kv`, which
+  // also carries the cursor-hosted marker for GET /v1/sessions).
   return defineStorage({
-    name: "cursor-hosted",
-    ...cursorHostedStorage({
-      // Full chain (env → key file → stored login): frozen engines listen
-      // unsigned and bind CURSOR_API_KEY_FILE at task time, after this
-      // definition is constructed.
-      apiKey: () => resolveApiKeySync()?.apiKey,
+    name: "cursor-hosted (framework files)",
+    policy,
+    ...kv,
+    ...composeFrameworkStorage({
+      kv,
+      files: fileSinkStorageCore(
+        cursorHostedFiles({ storeSourceId: frameworkStoreId, resolveApiKey })
+      ),
     }),
+    // CAS stays on the KV proxy but must refuse framework-file keys, or a
+    // future coordination path would split-brain against the plain core.
+    cas: frameworkGuardedCas(kv.cas),
   });
 }

package/src/internal/hosted-delivery-protocol.ts

@@ -2,6 +2,13 @@ export const HOSTED_DELIVERY_PROTOCOL_VERSION = 2;
 export const HOSTED_DELIVERY_HEADER = "x-agent-sdk-hosted-delivery";
 export const HOSTED_ADMISSION_PATH = "/v1/internal/hosted-admission";
 export const HOSTED_EXECUTION_PATH = "/v1/internal/hosted-execution";
+/**
+ * Filename under the serve `--state-root` (not the per-slug SessionEngine
+ * dir). Hosted freeze uses `/workspace/.agent-serve`; the Temporal host
+ * reads this path after hosted-execution and logs it on the activity span.
+ * Must match `AGENT_SERVE_ENGINE_HOSTED_EXECUTION_DIAG_PATH` basename.
+ */
+export const HOSTED_EXECUTION_DIAG_FILENAME = "hosted-execution.json";
 
 export type HostedAdmissionManagedAutomation = {
   automationUuid: string;

package/src/internal/hosted-delivery.ts

@@ -27,6 +27,12 @@ import {
   parseHostedAdmission,
   parseHostedExecution,
 } from "./hosted-delivery-protocol.js";
+import {
+  abortReasonFromTurnStatus,
+  HOSTED_EXECUTION_DIAG_RUNNING_STATUS,
+  hostedExecutionDiagId,
+  writeHostedExecutionDiag,
+} from "./hosted-execution-diag.js";
 import { recordHostedManagedAutomation } from "./hosted-managed-automation.js";
 import { errorResponse, readJsonObject } from "./http-channel.js";
 import type { Router } from "./router.js";
@@ -245,6 +251,19 @@ export function registerHostedDeliveryRoute(input: {
     channelId: string,
     sessionPublicId?: string
   ): ChannelHandlerArgs;
+  /**
+   * Await the session's durable mirror (dispatch chain + storage queue)
+   * before the execution reply: the control plane may park the pod the
+   * moment the reply lands, and a shed session-record flush would strand
+   * the conversation on the next wake.
+   */
+  drainSessionDurability?(sessionId: string): Promise<void>;
+  /**
+   * Serve `--state-root` (not the per-slug SessionEngine dir). Hosted
+   * freeze is `/workspace/.agent-serve`; the Temporal host reads
+   * `hosted-execution.json` from that path after the POST returns.
+   */
+  stateRoot?: string;
 }): void {
   const pending = new Map<
     string,
@@ -376,36 +395,100 @@ export function registerHostedDeliveryRoute(input: {
       }
       admitted.sessionPublicId = execution.sessionPublicId;
       admitted.execution ??= (async (): Promise<ExecutionReply> => {
-        const args = input.buildHandlerArgs(
-          admitted.send.channelId,
-          execution.sessionPublicId
-        );
-        const session = await args.send(admitted.send.message, {
-          ...admitted.send.options,
-          mailboxContinuation: {
-            key: admitted.send.mailboxContinuationKey,
-          },
+        const startedAt = performance.now();
+        const executionId = hostedExecutionDiagId(execution.admissionToken);
+        const writeDiag = async (fields: {
+          sessionId: string;
+          turnStatus: string;
+          message?: string;
+          abortReason?:
+            | ReturnType<typeof abortReasonFromTurnStatus>
+            | "execute_throw";
+        }): Promise<void> => {
+          if (input.stateRoot === undefined) {
+            return;
+          }
+          const message =
+            fields.message === undefined
+              ? undefined
+              : boundedMessage(fields.message);
+          await writeHostedExecutionDiag(input.stateRoot, {
+            v: 1,
+            executionId,
+            writtenAt: new Date().toISOString(),
+            sessionPublicId: execution.sessionPublicId,
+            sessionId: fields.sessionId,
+            turnStatus: fields.turnStatus,
+            durationMs: Math.max(0, Math.round(performance.now() - startedAt)),
+            ...(message === undefined ? {} : { message }),
+            ...(message !== undefined && /abort/i.test(message)
+              ? { signalAborted: true }
+              : {}),
+            ...(fields.abortReason === undefined
+              ? {}
+              : { abortReason: fields.abortReason }),
+          });
+        };
+        // Claim the file before the turn runs. The host reads it after its
+        // own POST returns, which for a 9-minute timeout is while this turn
+        // is still going; without this marker that read would surface the
+        // PREVIOUS delivery's terminal record as if it were this one's.
+        await writeDiag({
+          sessionId: "",
+          turnStatus: HOSTED_EXECUTION_DIAG_RUNNING_STATUS,
         });
-        const outcome = await session.waitForCompletion();
-        if (outcome.status !== "finished") {
+        try {
+          const args = input.buildHandlerArgs(
+            admitted.send.channelId,
+            execution.sessionPublicId
+          );
+          const session = await args.send(admitted.send.message, {
+            ...admitted.send.options,
+            mailboxContinuation: {
+              key: admitted.send.mailboxContinuationKey,
+            },
+          });
+          const outcome = await session.waitForCompletion();
+          // Failed turns drain too: their record/continuation updates must
+          // survive the park just like a finished turn's.
+          await input.drainSessionDurability?.(session.id);
+          await writeDiag({
+            sessionId: session.id,
+            turnStatus: outcome.status,
+            message: outcome.errorMessage,
+            abortReason: abortReasonFromTurnStatus(
+              outcome.status,
+              outcome.errorMessage
+            ),
+          });
+          if (outcome.status !== "finished") {
+            return {
+              status: 503,
+              body: {
+                ok: false,
+                error: "turn_failed",
+                turnStatus: outcome.status,
+                message: outcome.errorMessage,
+              },
+            };
+          }
           return {
-            status: 503,
+            status: 200,
             body: {
-              ok: false,
-              error: "turn_failed",
-              turnStatus: outcome.status,
-              message: outcome.errorMessage,
+              ok: true,
+              v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+              outcome: "send",
             },
           };
+        } catch (error) {
+          await writeDiag({
+            sessionId: "",
+            turnStatus: "error",
+            message: error instanceof Error ? error.message : String(error),
+            abortReason: "execute_throw",
+          });
+          throw error;
         }
-        return {
-          status: 200,
-          body: {
-            ok: true,
-            v: HOSTED_DELIVERY_PROTOCOL_VERSION,
-            outcome: "send",
-          },
-        };
       })();
       const reply = await admitted.execution;
       return finish(Response.json(reply.body, { status: reply.status }));