@elisym/cli 0.31.0 → 0.32.0

package/dist/index.js

@@ -2,19 +2,19 @@
 import { ReadableStream } from 'node:stream/web';
 import { readFileSync, existsSync, readdirSync, statSync, renameSync, chmodSync, mkdirSync, writeFileSync, appendFileSync, unlinkSync, rmdirSync, realpathSync } from 'node:fs';
 import { dirname, join, resolve, basename, extname, relative, sep } from 'node:path';
-import { DEFAULTS, SolanaPaymentStrategy, validateAgentName, RELAYS, ElisymIdentity, splAssetsForNetwork, formatSol, formatAssetAmount, signerFromSecretKeyBase58, resolveUsdcAsset, ElisymClient, KIND_EXTERNAL_IDENTITIES, POLICY_D_TAG_PREFIX, KIND_LONG_FORM_ARTICLE, jobRequestKind, DEFAULT_KIND_OFFSET, toDTag, createBlossomTransport, generateSolanaWallet, verifyAgentIdentities, getProtocolConfig, getProtocolProgramId, calculateProtocolFee, LIMITS, makeCensor, DEFAULT_REDACT_PATHS, POLICY_T_TAG, SESSION_ID_REGEX, createSlidingWindowLimiter, utf8ByteLength, readAcceptedTransports, resolveDelegationAsset, MAX_PROOF_TTL_SECS, PROOF_CLOCK_SKEW_SECS, verifyDelegationAuthProof, deriveOwnerDelegationAta, getDelegation, buildDelegatedTransfer, buildSignedPull, sendConfirmToTerminal, parseDelegatedPayment, confirmPullToTerminal, isDefinitelyUnpaid, decodeJobPayload, BoundedSet, KIND_JOB_FEEDBACK, encodeSecretKeyBase58, GITHUB_USERNAME_REGEX, X_USERNAME_REGEX, normalizeNip05Identifier, splitNip05Identifier, NATIVE_SOL, GIST_ID_REGEX, TWEET_ID_REGEX } from '@elisym/sdk';
+import { DEFAULTS, SolanaPaymentStrategy, validateAgentName, RELAYS, ElisymIdentity, splAssetsForNetwork, formatSol, formatAssetAmount, signerFromSecretKeyBase58, resolveUsdcAsset, ElisymClient, KIND_EXTERNAL_IDENTITIES, POLICY_D_TAG_PREFIX, KIND_LONG_FORM_ARTICLE, deleteControlCharacters, jobRequestKind, DEFAULT_KIND_OFFSET, toDTag, createBlossomTransport, generateSolanaWallet, verifyAgentIdentities, getProtocolConfig, getProtocolProgramId, calculateProtocolFee, LIMITS, makeCensor, DEFAULT_REDACT_PATHS, flattenForComparison, POLICY_T_TAG, SESSION_ID_REGEX, createSlidingWindowLimiter, excerptUntrusted, isScriptBillingExhaustedError, excerptUntrustedTail, scriptOutput, isScriptExecutionError, utf8ByteLength, readAcceptedTransports, resolveDelegationAsset, MAX_PROOF_TTL_SECS, PROOF_CLOCK_SKEW_SECS, verifyDelegationAuthProof, deriveOwnerDelegationAta, getDelegation, buildDelegatedTransfer, buildSignedPull, sendConfirmToTerminal, parseDelegatedPayment, confirmPullToTerminal, isDefinitelyUnpaid, decodeJobPayload, isLlmHealthError, BoundedSet, KIND_JOB_FEEDBACK, encodeSecretKeyBase58, GITHUB_USERNAME_REGEX, X_USERNAME_REGEX, normalizeNip05Identifier, splitNip05Identifier, clipToCodeUnits, PROVIDER_REFUSED_PREFIX, PROVIDER_FAILED_MESSAGE, NATIVE_SOL, GIST_ID_REGEX, TWEET_ID_REGEX } from '@elisym/sdk';
 import { ElisymYamlSchema, resolveInHome, resolveInProject, createAgentDir, writeYamlInitial, writeExampleSkillTemplate, writeSecrets, listAgents, loadAgent, writeYaml, agentPaths, readMediaCache, loadPoliciesFromDir, ensureGitignoreHasIrohEntry, ensureGitignoreHasX402Entries, ensureGitignoreHasSessionsEntry, ensureGitignoreHasDelegationNoncesEntry, readAgentPublic, lookupCachedUrl, newCacheEntry, writeMediaCache } from '@elisym/sdk/agent-store';
 import { isAddress, createSolanaRpc, address, signature } from '@solana/kit';
 import { generateSecretKey, getPublicKey, nip19, verifyEvent } from 'nostr-tools';
 import YAML2 from 'yaml';
 import { Command } from 'commander';
-import { mkdir, writeFile, readFile, mkdtemp, rm, rename, stat } from 'node:fs/promises';
-import { parseSkillMd, validateSkillFrontmatter, DEFAULT_X402_MAX_INPUT_BYTES, resolveInsidePathReal, DEFAULT_SCRIPT_TIMEOUT_MS, OnchainCallSkill, DynamicScriptSkill as DynamicScriptSkill$1, StaticScriptSkill as StaticScriptSkill$1, StaticFileSkill as StaticFileSkill$1, ScriptSkill as ScriptSkill$1 } from '@elisym/sdk/skills';
+import { mkdir, writeFile, mkdtemp, rm, readFile, rename, stat } from 'node:fs/promises';
+import { parseSkillMd, validateSkillFrontmatter, isHostScratchError, isScriptRefusalError, startsWithRefusalHint, HostScratchError, DEFAULT_X402_MAX_INPUT_BYTES, resolveInsidePathReal, DEFAULT_SCRIPT_TIMEOUT_MS, OnchainCallSkill, DynamicScriptSkill as DynamicScriptSkill$1, StaticScriptSkill as StaticScriptSkill$1, StaticFileSkill as StaticFileSkill$1, ScriptSkill as ScriptSkill$1 } from '@elisym/sdk/skills';
 import chalk from 'chalk';
 import Decimal from 'decimal.js-light';
 import { decodePaymentRequiredHeader } from '@x402/core/http';
 import { createHash } from 'node:crypto';
-import { LlmHealthMonitor, startLlmRecovery, createFreeLlmLimiterSet, ScriptBillingExhaustedError, ScriptExecutionError, FREE_LLM_GLOBAL_KEY, freeLlmCustomerKey, LlmHealthError } from '@elisym/sdk/llm-health';
+import { LlmHealthMonitor, startLlmRecovery, createFreeLlmLimiterSet, FREE_LLM_GLOBAL_KEY, freeLlmCustomerKey } from '@elisym/sdk/llm-health';
 import { createIrohTransport } from '@elisym/sdk/node';
 import { lookup } from 'node:dns/promises';
 import { Socket } from 'node:net';
@@ -3804,9 +3804,6 @@ function resolveProviderApiKey(input) {
     error: `Provider "${provider}" needs an API key (required by skill(s): ${skillList}). Set secrets.llm_api_keys.${provider} via 'npx @elisym/cli profile <agent>' or export ${descriptor.envVar}.`
   };
 }
-function sanitizeForTerminal(value) {
-  return value.replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, "");
-}
 function resolveLevel(options) {
   if (options.level) {
     return options.level;
@@ -3845,7 +3842,7 @@ function createLogger(options = {}) {
     logger = pino(baseOptions, pino.destination(2));
   }
   function logWithIndent(line) {
-    process.stdout.write(`  ${sanitizeForTerminal(line)}
+    process.stdout.write(`  ${deleteControlCharacters(line)}
 `);
   }
   return {
@@ -5324,24 +5321,106 @@ function resolveJobAsset(tags, skills) {
   const skill = skills.route(tags);
   return skill?.asset ?? NATIVE_SOL;
 }
-var BILLING_BODY_MARKERS3 = ["credit balance", "billing", "insufficient", "insufficient_quota"];
 var SCRIPT_BILLING_INVALID_MARKERS = [
-  "credit balance",
-  "billing",
-  "insufficient",
-  "insufficient_quota",
-  "x-api-key",
-  "invalid api key",
-  "invalid_api_key",
-  "authentication_error",
-  "unauthorized",
-  "unauthenticated"
+  // Three questions, one row each, so an edit cannot land half-applied: does
+  // this phrase gate THIS pair at all, does it also take every model on the
+  // operator's key offline (`cascades`), and is it about money rather than
+  // credentials (`billing`, which picks the reason the operator is shown and
+  // the recovery probe reads).
+  //
+  // `cascades` is the expensive one. Gating ONE pair on a false positive costs
+  // the operator a capability until the recovery probe clears it; a cascade
+  // costs them every capability on that key. So it needs a phrase an unrelated
+  // failure does not produce: `insufficient` alone is a Solana builder saying
+  // "insufficient funds for rent" and `billing` alone is a form field, while
+  // nothing prints `invalid x-api-key` or `credit balance` except the provider
+  // whose key it is. The bare status words carry `cascades: false` for the same
+  // reason - `unauthorized` is what any proxy says when it did not like a
+  // request. The LLM path next door demands an HTTP 401/402 before cascading;
+  // this is the script path's version of that bar.
+  { phrase: "credit balance", cascades: true, billing: true },
+  { phrase: "billing", cascades: false, billing: true },
+  { phrase: "insufficient", cascades: false, billing: true },
+  { phrase: "insufficient_quota", cascades: true, billing: true },
+  // Gates this pair, never cascades: `x-api-key` is the name of a REQUEST
+  // HEADER, which `curl -v` and any client that prints its own headers emit on a
+  // perfectly ordinary failure. Taking every model on the key offline for that
+  // is the expensive direction; `invalid x-api-key` below is the provider
+  // actually rejecting it.
+  { phrase: "x-api-key", cascades: false, billing: false },
+  // The provider REJECTING the key, which no request header says.
+  { phrase: "invalid x-api-key", cascades: true, billing: false },
+  { phrase: "invalid api key", cascades: true, billing: false },
+  { phrase: "invalid_api_key", cascades: true, billing: false },
+  { phrase: "authentication_error", cascades: true, billing: false },
+  { phrase: "unauthorized", cascades: false, billing: false },
+  { phrase: "unauthenticated", cascades: false, billing: false }
 ];
-function scriptMessageLooksLikeBillingOrInvalid(message) {
-  const lower = message.toLowerCase();
-  return SCRIPT_BILLING_INVALID_MARKERS.some((marker) => lower.includes(marker));
+var BILLING_BODY_MARKERS3 = SCRIPT_BILLING_INVALID_MARKERS.filter((marker) => marker.billing).map(
+  (marker) => marker.phrase
+);
+function classifyScriptSignal(message) {
+  let looksBillingOrInvalid = false;
+  let billing = false;
+  let cascade = false;
+  let signalAt = -1;
+  for (const match of message.matchAll(ALL_MARKERS_RE)) {
+    const marker = MARKER_BY_PHRASE.get(match[0].toLowerCase());
+    looksBillingOrInvalid = true;
+    billing = billing || marker?.billing === true;
+    cascade = cascade || marker?.cascades === true;
+    if (signalAt === -1) {
+      signalAt = match.index;
+    }
+  }
+  return { looksBillingOrInvalid, reason: billing ? "billing" : "invalid", cascade, signalAt };
+}
+var HOST_DISK_CODES = /* @__PURE__ */ new Set(["ENOSPC", "EROFS", "EDQUOT", "EMFILE", "ENFILE", "EIO"]);
+function asHostScratchFailure(error) {
+  const code = error?.code;
+  if (code === void 0 || !HOST_DISK_CODES.has(code)) {
+    return void 0;
+  }
+  return new HostScratchError(error instanceof Error ? error.message : String(error));
+}
+var HEALTH_REASON_CHARS = 500;
+var SIGNAL_LEAD_UNITS = 80;
+function markerPattern(phrases, flags) {
+  const longestFirst = [...phrases].sort((left, right) => right.length - left.length);
+  return new RegExp(
+    longestFirst.map((phrase) => phrase.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"),
+    flags
+  );
+}
+var ALL_MARKERS_RE = markerPattern(
+  SCRIPT_BILLING_INVALID_MARKERS.map((marker) => marker.phrase),
+  "gi"
+);
+var MARKER_BY_PHRASE = new Map(
+  SCRIPT_BILLING_INVALID_MARKERS.map((marker) => [marker.phrase, marker])
+);
+function signalIndex(text) {
+  ALL_MARKERS_RE.lastIndex = 0;
+  const found = ALL_MARKERS_RE.exec(text)?.index ?? -1;
+  ALL_MARKERS_RE.lastIndex = 0;
+  return found;
+}
+function operatorReason(diagnostic, known, budget = HEALTH_REASON_CHARS) {
+  if (startsWithRefusalHint(diagnostic)) {
+    return excerptUntrusted(diagnostic, budget);
+  }
+  const signalAt = known ?? signalIndex(diagnostic);
+  if (signalAt === -1) {
+    return excerptUntrustedTail(diagnostic, budget);
+  }
+  const from = Math.max(0, signalAt - SIGNAL_LEAD_UNITS);
+  if (from === 0) {
+    return excerptUntrusted(diagnostic, budget);
+  }
+  return `\u2026${excerptUntrusted(diagnostic.slice(from, from + budget * 8), budget - 1)}`;
 }
 var AGENT_UNAVAILABLE_MESSAGE = "Agent temporarily unavailable";
+var OPERATOR_EXCERPT_CHARS = 1500;
 var AgentUnavailableError = class extends Error {
   constructor() {
     super(AGENT_UNAVAILABLE_MESSAGE);
@@ -5395,16 +5474,49 @@ function customerSafeMessage(error) {
   if (error instanceof AgentUnavailableError || error instanceof ExecutionBudgetExceededError || error instanceof SeedFailedError) {
     return error.message;
   }
-  if (error instanceof ScriptExecutionError) {
-    return error.message;
+  if (isScriptRefusalError(error)) {
+    return `${PROVIDER_REFUSED_PREFIX}${error.message}`;
   }
-  if (error instanceof ScriptBillingExhaustedError) {
+  if (isScriptExecutionError(error)) {
+    return PROVIDER_FAILED_MESSAGE;
+  }
+  if (isScriptBillingExhaustedError(error) || isHostScratchError(error) || error instanceof X402TransientError) {
     return AGENT_UNAVAILABLE_MESSAGE;
   }
   if (error instanceof Error && CUSTOMER_SAFE_MESSAGE_PREFIXES.some((prefix) => error.message.startsWith(prefix))) {
     return error.message;
   }
-  return "Internal processing error";
+  return PROVIDER_FAILED_MESSAGE;
+}
+function needsScratchSpace(mode, hasAttachment) {
+  if (hasAttachment) {
+    return true;
+  }
+  return mode !== void 0 && mode !== "llm" && mode !== "static-file" && mode !== "static-script";
+}
+function describeForOperator(error) {
+  if (isHostScratchError(error)) {
+    return `${error.message}: ${excerptUntrusted(error.detail, OPERATOR_EXCERPT_CHARS)}`;
+  }
+  if (isScriptBillingExhaustedError(error)) {
+    return `script signalled billing exhausted: ${excerptUntrustedTail(scriptOutput(error), OPERATOR_EXCERPT_CHARS)}`;
+  }
+  if (isScriptRefusalError(error)) {
+    return error.stderr === "" ? `refused: ${error.message}` : `refused: ${error.message} (stderr: ${error.stderr})`;
+  }
+  if (isScriptExecutionError(error)) {
+    return `${error.message}: ${excerptUntrustedTail(error.detail, OPERATOR_EXCERPT_CHARS)}`;
+  }
+  if (typeof error === "string") {
+    return excerptUntrusted(error, OPERATOR_EXCERPT_CHARS);
+  }
+  if (typeof error === "object" && error !== null && "message" in error) {
+    const message = error.message;
+    if (typeof message === "string" && message !== "") {
+      return excerptUntrusted(message, OPERATOR_EXCERPT_CHARS);
+    }
+  }
+  return "Unknown error";
 }
 function parseRawEventDelegated(rawEventJson) {
   if (rawEventJson === void 0) {
@@ -5691,12 +5803,51 @@ var AgentRuntime = class {
     }
     return ` (cascading to ${siblings} other model(s) for ${provider} sharing the same API key)`;
   }
+  /**
+   * Whether this agent can still make itself a scratch directory.
+   *
+   * A `HostScratchError` says the last job could not run because the temp
+   * directory refused it. That is not the operator's API key, so it must not
+   * gate the health pair - but SOMETHING has to stop the next customer paying
+   * into an agent that will fail them the same way, which is what the health
+   * gate used to do by accident. Probed before payment, and only once such a
+   * failure has been seen - a working host pays nothing for this, and a broken
+   * one is asked again on every job rather than after a timer: an agent whose
+   * jobs arrive minutes apart would otherwise let every customer through.
+   */
+  scratchFailed = false;
+  async scratchSpaceUsable() {
+    if (!this.scratchFailed) {
+      return true;
+    }
+    const probe = await mkdtemp(join(tmpdir(), "elisym-probe-")).catch(() => null);
+    if (probe === null) {
+      return false;
+    }
+    const wrote = await writeFile(join(probe, "probe"), "x").then(() => true).catch(() => false);
+    await rm(probe, { recursive: true, force: true }).catch(() => {
+    });
+    if (!wrote) {
+      return false;
+    }
+    this.scratchFailed = false;
+    return true;
+  }
   markHealthFromExecuteError(skill, err, log, jobId) {
     if (!this.healthMonitor) {
       return false;
     }
     const tag = `[${jobId.slice(0, 8)}]`;
-    if (err instanceof ScriptBillingExhaustedError) {
+    if (isHostScratchError(err)) {
+      log(
+        `${tag} Skill "${skill.name}" could not be given scratch space by THIS AGENT: ${excerptUntrusted(err.detail, 300)} Health state unchanged; the job stays paid for recovery.`
+      );
+      return false;
+    }
+    if (isScriptRefusalError(err)) {
+      return false;
+    }
+    if (isScriptBillingExhaustedError(err)) {
       const provider = skill.llmOverride?.provider;
       const model = skill.llmOverride?.model;
       if (!provider || !model) {
@@ -5708,7 +5859,12 @@ var AgentRuntime = class {
       log(
         `${tag} Script signaled billing-exhausted (exit ${err.exitCode}). Marking ${provider}/${model} unhealthy${this.cascadeSuffix(provider, model)}; future jobs against this pair will be refused until recovery probe succeeds.`
       );
-      this.healthMonitor.markUnhealthyFromJob(provider, model, "billing", err.message);
+      this.healthMonitor.markUnhealthyFromJob(
+        provider,
+        model,
+        "billing",
+        excerptUntrustedTail(scriptOutput(err), 200)
+      );
       return true;
     }
     if (skill.mode === "llm" && skill.resolvedTriple) {
@@ -5718,7 +5874,7 @@ var AgentRuntime = class {
         return false;
       }
       const status = Number(match[1]);
-      const body = (match[2] ?? "").slice(0, 200);
+      const body = excerptUntrusted(match[2] ?? "", 200);
       const isBillingStatus = status === 402;
       const isAuthStatus = status === 401 || status === 403;
       const isBilling400 = status === 400 && bodyLooksLikeBilling3(body);
@@ -5737,33 +5893,43 @@ var AgentRuntime = class {
     }
     if (skill.mode !== "llm") {
       let message;
-      if (err instanceof ScriptExecutionError) {
-        message = err.detail;
+      let scanned;
+      let diagnostic;
+      if (isScriptExecutionError(err)) {
+        message = err.stderr ?? err.detail;
+        diagnostic = startsWithRefusalHint(err.detail) || message.trim() === "" ? err.detail : message;
+        scanned = err.stderr === void 0 ? "the skill error" : "stderr";
       } else if (err instanceof Error) {
         message = err.message;
+        diagnostic = message;
+        scanned = "the skill error";
       } else {
         message = String(err);
+        diagnostic = message;
+        scanned = "the skill error";
       }
       const provider = skill.llmOverride?.provider;
       const model = skill.llmOverride?.model;
       if (!provider || !model) {
         log(
-          `${tag} Script "${skill.name}" failed ("${message.slice(0, 120)}") but did not declare provider/model in SKILL.md - cannot gate future jobs.`
+          `${tag} Script "${skill.name}" failed ("${operatorReason(diagnostic)}") but did not declare provider/model in SKILL.md - cannot gate future jobs.`
         );
         return false;
       }
-      const lower = message.toLowerCase();
-      const looksBillingOrInvalid = scriptMessageLooksLikeBillingOrInvalid(message);
-      const reason = looksBillingOrInvalid && (lower.includes("credit balance") || lower.includes("billing") || lower.includes("insufficient")) ? "billing" : "invalid";
-      const cascade = looksBillingOrInvalid;
+      const { looksBillingOrInvalid, reason, cascade, signalAt } = classifyScriptSignal(message);
       const cascadeNote = cascade ? this.cascadeSuffix(provider, model) : " (no cascade)";
-      const signalNote = looksBillingOrInvalid ? `${reason} signal in stderr` : `generic exit (no billing/invalid markers, classified as ${reason}, skill-local)`;
+      const signalNote = looksBillingOrInvalid ? `${reason} signal in ${scanned}` : `generic exit (no billing/invalid markers, classified as ${reason}, skill-local)`;
       log(
         `${tag} Script failure (${signalNote}). Marking ${provider}/${model} unhealthy${cascadeNote}; future jobs against this pair will be refused until recovery probe succeeds.`
       );
-      this.healthMonitor.markUnhealthyFromJob(provider, model, reason, message.slice(0, 200), {
-        cascade
-      });
+      this.healthMonitor.markUnhealthyFromJob(
+        provider,
+        model,
+        reason,
+        // The index only when the quote is of the same string the scan read.
+        operatorReason(diagnostic, diagnostic === message ? signalAt : void 0),
+        { cascade }
+      );
       return true;
     }
     return false;
@@ -5878,8 +6044,8 @@ var AgentRuntime = class {
       if (jobSession) {
         jobSession.store.admitLive(jobSession.customerId, jobSession.sessionId);
       }
-      this.limit(() => this.processJob(job)).catch((e) => {
-        this.callbacks.onJobError?.(job.jobId, e.message);
+      this.limit(() => this.processJob(job)).catch((err) => {
+        this.callbacks.onJobError?.(job.jobId, describeForOperator(err));
       }).finally(() => {
         this.inFlight.delete(job.jobId);
         this.pending--;
@@ -5964,18 +6130,31 @@ var AgentRuntime = class {
     this.jobAbortControllers.add(jobAbort);
     try {
       await this.executeJob(job, jobAbort.signal);
-    } catch (e) {
+    } catch (raw) {
+      const e = asHostScratchFailure(raw) ?? raw;
       const log = this.callbacks.onLog ?? console.log;
-      log(`[${job.jobId.slice(0, 8)}] Error: ${e.message}`);
+      const operatorMessage = describeForOperator(e);
+      log(`[${job.jobId.slice(0, 8)}] Error: ${operatorMessage}`);
+      if (isHostScratchError(e)) {
+        this.scratchFailed = true;
+      }
       const currentStatus = this.ledger.getStatus(job.jobId);
-      const keepPaidForRecovery = (e instanceof AgentUnavailableError || e instanceof SeedFailedError || e instanceof PaymentTimeoutError || e instanceof X402TransientError || e instanceof ExecutionBudgetExceededError && this.skills.route(job.tags)?.mode === "x402") && currentStatus === "paid";
+      const keepPaidForRecovery = (e instanceof AgentUnavailableError || // The exit-42 contract: the key is out of credits, not the job out of
+      // sense, so the job waits for the operator to top up. Reached when the
+      // gate did NOT flip - an agent with no health monitor, or a skill that
+      // declares no pair - where the customer is told "temporarily
+      // unavailable" and that has to stay true of their money.
+      isScriptBillingExhaustedError(e) || // The agent's own disk, not the job: a tmpdir that is full or
+      // read-only now may not be in five minutes, and the customer has
+      // already paid. Terminating here would keep their money for a failure
+      // that was never about their request.
+      isHostScratchError(e) || e instanceof SeedFailedError || e instanceof PaymentTimeoutError || e instanceof X402TransientError || e instanceof ExecutionBudgetExceededError && this.skills.route(job.tags)?.mode === "x402") && currentStatus === "paid";
       if (currentStatus !== "executed" && !keepPaidForRecovery) {
         this.ledger.markFailed(job.jobId);
       }
       if (keepPaidForRecovery) {
         log(`[${job.jobId.slice(0, 8)}] Keeping status=paid; recovery will retry (24h cutoff).`);
       }
-      const operatorMessage = e instanceof ScriptExecutionError ? `${e.message}: ${e.detail}` : e.message ?? "Unknown error";
       this.callbacks.onJobError?.(job.jobId, operatorMessage);
       const safeMessage = customerSafeMessage(e);
       await this.transport.sendFeedback(job, { type: "error", message: safeMessage }).catch(() => {
@@ -6007,6 +6186,14 @@ var AgentRuntime = class {
         return;
       }
     }
+    if (needsScratchSpace(matched?.mode, job.attachment !== void 0) && !await this.scratchSpaceUsable()) {
+      log(
+        `[${job.jobId.slice(0, 8)}] Refusing job before payment: this agent cannot create scratch space (check the temp directory).`
+      );
+      await this.transport.sendFeedback(job, { type: "error", message: AGENT_UNAVAILABLE_MESSAGE }).catch(() => {
+      });
+      return;
+    }
     if (matched?.mode === "x402" && job.attachment !== void 0) {
       const method = matched.x402?.method ?? "POST";
       const maxInputBytes = matched.x402?.maxInputBytes ?? 0;
@@ -6893,7 +7080,9 @@ var AgentRuntime = class {
           });
           return this.materializeBytesInput(bytes, attachment.mime);
         }
-        const dir = await mkdtemp(join(tmpdir(), "elisym-job-"));
+        const dir = await mkdtemp(join(tmpdir(), "elisym-job-")).catch((err) => {
+          throw new HostScratchError(err instanceof Error ? err.message : String(err));
+        });
         const filePath = join(dir, "input");
         try {
           await this.irohTransport.fetchToPath(irohMember.ticket, filePath, {
@@ -6945,14 +7134,16 @@ var AgentRuntime = class {
       return { inlineText: Buffer.from(bytes).toString("utf8"), cleanup: async () => {
       } };
     }
-    const dir = await mkdtemp(join(tmpdir(), "elisym-job-"));
+    const dir = await mkdtemp(join(tmpdir(), "elisym-job-")).catch((err) => {
+      throw new HostScratchError(err instanceof Error ? err.message : String(err));
+    });
     const filePath = join(dir, "input");
     try {
       await writeFile(filePath, bytes);
     } catch (error) {
       await rm(dir, { recursive: true, force: true }).catch(() => {
       });
-      throw error;
+      throw asHostScratchFailure(error) ?? error;
     }
     return {
       filePath,
@@ -7287,12 +7478,13 @@ var AgentRuntime = class {
       this.limit(async () => {
         try {
           await this.recoverSingleJob(entry, log);
-        } catch (e) {
-          log(`[${entry.job_id.slice(0, 8)}] Recovery: failed: ${e.message}`);
+        } catch (err) {
+          log(`[${entry.job_id.slice(0, 8)}] Recovery: failed: ${describeForOperator(err)}`);
         } finally {
           this.inFlight.delete(entry.job_id);
           this.pending--;
         }
+      }).catch(() => {
       });
     }
   }
@@ -7398,7 +7590,7 @@ var AgentRuntime = class {
           try {
             await this.healthMonitor.assertReady(healthPair.provider, healthPair.model);
           } catch (err) {
-            if (err instanceof LlmHealthError) {
+            if (isLlmHealthError(err)) {
               log(
                 `[${entry.job_id.slice(0, 8)}] Recovery: pair ${healthPair.provider}/${healthPair.model} still unhealthy (${err.reason}); waiting for recovery probe.`
               );
@@ -7442,7 +7634,15 @@ var AgentRuntime = class {
             entry.customer_id,
             recoveryAbort.signal
           );
-        } catch {
+        } catch (raw) {
+          const err = asHostScratchFailure(raw) ?? raw;
+          if (isHostScratchError(err)) {
+            this.scratchFailed = true;
+            log(
+              `[${entry.job_id.slice(0, 8)}] Recovery: no scratch space for the input file; leaving the job paid.`
+            );
+            return;
+          }
           log(`[${entry.job_id.slice(0, 8)}] Recovery: input file unavailable, marking failed`);
           await this.failRecoveredJob(entry, fakeJob, RECOVERY_INPUT_UNAVAILABLE_CUSTOMER_MESSAGE);
           return;
@@ -7453,6 +7653,7 @@ var AgentRuntime = class {
           skill
         );
         const runRecoveryExecution = async (history) => {
+          let budgetExceeded = false;
           let budgetTimer;
           try {
             const execPromise = skill.execute(
@@ -7474,6 +7675,7 @@ var AgentRuntime = class {
                 execPromise,
                 new Promise((_resolve, reject) => {
                   budgetTimer = setTimeout(() => {
+                    budgetExceeded = true;
                     recoveryAbort.abort();
                     reject(new ExecutionBudgetExceededError(recoveryBudgetMs));
                   }, recoveryBudgetMs);
@@ -7482,6 +7684,12 @@ var AgentRuntime = class {
             }
             return await execPromise;
           } catch (err) {
+            if (isHostScratchError(err)) {
+              this.scratchFailed = true;
+            }
+            if (budgetExceeded) {
+              throw new ExecutionBudgetExceededError(recoveryBudgetMs);
+            }
             this.markHealthFromExecuteError(skill, err, log, entry.job_id);
             throw err;
           } finally {
@@ -7494,18 +7702,28 @@ var AgentRuntime = class {
             }
           }
         };
-        const output = recoveryJobSession === null ? await runRecoveryExecution() : await this.runSessionExchange({
-          session: recoveryJobSession,
-          jobId: entry.job_id,
-          userRecord: buildUserRecord(
-            recoveryInputFile?.inlineText ?? entry.input,
-            recoveryInputFile?.filePath !== void 0 ? "attachment" : void 0
-          ),
-          signal: recoveryAbort.signal,
-          log,
-          execute: runRecoveryExecution,
-          excludeOwnTurns: true
-        });
+        let output;
+        try {
+          output = recoveryJobSession === null ? await runRecoveryExecution() : await this.runSessionExchange({
+            session: recoveryJobSession,
+            jobId: entry.job_id,
+            userRecord: buildUserRecord(
+              recoveryInputFile?.inlineText ?? entry.input,
+              recoveryInputFile?.filePath !== void 0 ? "attachment" : void 0
+            ),
+            signal: recoveryAbort.signal,
+            log,
+            execute: runRecoveryExecution,
+            excludeOwnTurns: true
+          });
+        } catch (error) {
+          if (!isScriptRefusalError(error)) {
+            throw error;
+          }
+          log(`[${entry.job_id.slice(0, 8)}] Recovery: ${describeForOperator(error)}`);
+          await this.failRecoveredJob(entry, fakeJob, customerSafeMessage(error));
+          return;
+        }
         const { attachments: resultAttachments, deliveredContent } = await this.buildResultAttachment(
           entry.job_id,
           output,
@@ -8731,21 +8949,17 @@ function withPaymentIdentifier(headerValue, declaration, jobId) {
     return headerValue;
   }
 }
-var UNICODE_FORMAT_MARKS = /\p{Cf}/gu;
-function flattenForOperator(text) {
-  return sanitizeForTerminal(text).replace(UNICODE_FORMAT_MARKS, "").replace(/\s+/g, " ").trim();
-}
 function printedPrefix(flattened) {
-  return flattened.length <= X402_ERROR_EXCERPT_CHARS ? flattened : flattened.slice(0, X402_ERROR_EXCERPT_CHARS).replace(/[\ud800-\udbff]$/, "");
+  return clipToCodeUnits(flattened, X402_ERROR_EXCERPT_CHARS);
 }
 function clipForOperator(flattened) {
   return flattened.length <= X402_ERROR_EXCERPT_CHARS ? flattened : `${printedPrefix(flattened)}...`;
 }
 function quoteUpstream(text) {
-  return clipForOperator(flattenForOperator(text));
+  return clipForOperator(flattenForComparison(text));
 }
 function quoteUpstreamWithInput(text, sentInput) {
-  return clipForOperator(maskCustomerInput(flattenForOperator(text), inputForms(sentInput)));
+  return clipForOperator(maskCustomerInput(flattenForComparison(text), inputForms(sentInput)));
 }
 function wireForm(sentInput) {
   return new TextDecoder().decode(new TextEncoder().encode(sentInput));
@@ -8767,7 +8981,7 @@ function endsInsideInput(text, forms) {
 }
 function inputForms(sentInput) {
   return [wireForm(sentInput), jsonEscapedForm(sentInput), ...urlEncodedForms(sentInput)].map(
-    flattenForOperator
+    flattenForComparison
   );
 }
 function maskCustomerInput(text, forms) {
@@ -8811,7 +9025,7 @@ var X402Driver = class {
   signerPromise = null;
   repriceHintLogged = /* @__PURE__ */ new Set();
   log(message) {
-    (this.options.log ?? console.log)(`[x402] ${flattenForOperator(message)}`);
+    (this.options.log ?? console.log)(`[x402] ${flattenForComparison(message)}`);
   }
   getSigner() {
     const secret = this.options.solanaSecretKeyBase58;
@@ -9015,7 +9229,7 @@ var X402Driver = class {
         this.options.errorBodyReadMs ?? X402_ERROR_BODY_READ_MS
       );
       const forms = inputForms(sentInput);
-      const quoted = maskCustomerInput(flattenForOperator(body.text), forms);
+      const quoted = maskCustomerInput(flattenForComparison(body.text), forms);
       if (quoted.length === 0) {
         return "";
       }
@@ -9667,7 +9881,7 @@ async function cmdStart(nameArg, options = {}) {
     }
     try {
       await client.policies.deletePolicy(identity2, type);
-      console.log(`  Removed stale policy: ${sanitizeForTerminal(type)}`);
+      console.log(`  Removed stale policy: ${deleteControlCharacters(type)}`);
     } catch {
     }
   }
@@ -9778,7 +9992,7 @@ async function cmdStart(nameArg, options = {}) {
         const card = JSON.parse(ev.content);
         if (card.name && toDTag(card.name) === dTag) {
           await client.discovery.deleteCapability(identity2, card.name);
-          console.log(`  Removed stale capability: ${sanitizeForTerminal(card.name)}`);
+          console.log(`  Removed stale capability: ${deleteControlCharacters(card.name)}`);
         }
       } catch {
       }
@@ -9871,7 +10085,7 @@ async function cmdStart(nameArg, options = {}) {
     ledger,
     {
       onJobReceived: (job) => {
-        const cap = sanitizeForTerminal(job.tags.find((t) => t !== "elisym") ?? "unknown");
+        const cap = deleteControlCharacters(job.tags.find((t) => t !== "elisym") ?? "unknown");
         process.stdout.write(`  [job] ${job.jobId.slice(0, 16)} | cap=${cap}
 `);
         logger.info({ event: "job_received", jobId: job.jobId, capability: cap });
@@ -9882,7 +10096,7 @@ async function cmdStart(nameArg, options = {}) {
         logger.info({ event: "job_delivered", jobId });
       },
       onJobError: (jobId, error) => {
-        const safeError = sanitizeForTerminal(error);
+        const safeError = deleteControlCharacters(error);
         process.stderr.write(`  [job] ${jobId.slice(0, 16)} | error: ${safeError}
 `);
         logger.error({ event: "job_error", jobId, error: safeError });