@gajae-code/agent-core 0.11.0 → 0.11.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.11.1] - 2026-07-16
+
+### Fixed
+
+- Added a bounded, neutralize-only `invalid_prompt` circuit breaker to the agent loop (#2282). A poisoned-history rejection (`Request blocked (code=invalid_prompt)`) is a deterministic content fault: re-sending the same history re-triggers it, so uncontrolled session auto-retry would burn its budget re-poisoning the model. On the first `invalid_prompt` of a run, leaked reserved control tokens are neutralized in place across history (no item is ever dropped). If that changes the outgoing bytes, the turn is resent exactly once with the repaired history; if neutralization cannot change anything, the run fails fast immediately with no resend. The repaired history is persisted for a clean resume, the breaker fires at most once per run (budget = one repaired resend), and it is scoped to the non-managed session path since managed fallback owns its own retry policy.
+
 ## [0.10.2] - 2026-07-14
 
 ### Fixed

package/dist/types/compaction/compaction.d.ts

@@ -38,6 +38,19 @@ export interface CompactionSettings {
     remoteEnabled?: boolean;
     remoteEndpoint?: string;
 }
+export type RemoteCompactionFallbackHealthEvent = {
+    kind: "success";
+    model: string;
+    provider: string;
+} | {
+    kind: "fallback";
+    model: string;
+    provider: string;
+    error: string;
+};
+export interface RemoteCompactionFallbackHealthHooks {
+    recordRemoteCompactionFallback(event: RemoteCompactionFallbackHealthEvent): void;
+}
 export declare const DEFAULT_COMPACTION_SETTINGS: CompactionSettings;
 /**
  * Calculate total context tokens from usage.
@@ -194,6 +207,8 @@ export interface SummaryOptions {
     providerSessionState?: Map<string, ProviderSessionState>;
     /** Hint that websocket transport should be preferred when supported by the provider implementation. */
     preferWebsockets?: boolean;
+    /** Session-owned health sink for remote-compaction fallback transition logging. */
+    remoteCompactionFallbackHealth?: RemoteCompactionFallbackHealthHooks;
 }
 /**
  * Cap the serialized conversation fed to a summarization request so the request

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/agent-core",
-	"version": "0.11.0",
+	"version": "0.11.1",
 	"description": "General-purpose agent with transport abstraction, state management, and attachment support",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -32,9 +32,9 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@gajae-code/ai": "0.11.0",
-		"@gajae-code/natives": "0.11.0",
-		"@gajae-code/utils": "0.11.0",
+		"@gajae-code/ai": "0.11.1",
+		"@gajae-code/natives": "0.11.1",
+		"@gajae-code/utils": "0.11.1",
 		"@opentelemetry/api": "^1.9.0"
 	},
 	"devDependencies": {

package/src/agent-loop.ts

@@ -17,6 +17,7 @@ import {
 	validateToolArguments,
 	zodToWireSchema,
 } from "@gajae-code/ai";
+import { isInvalidPromptError, neutralizeReservedControlTokens } from "@gajae-code/ai/utils";
 import { sanitizeText } from "@gajae-code/utils";
 import {
 	createHarmonyAuditEvent,
@@ -109,6 +110,39 @@ function managedRetryableFailure(failure: unknown): boolean {
 	);
 }
 
+/**
+ * Neutralize leaked reserved control tokens in-place across the outgoing
+ * history so a re-send no longer carries the poison that triggered
+ * `Request blocked (code=invalid_prompt)`. Only string text fields are
+ * rewritten; no history item is ever dropped or reordered. Returns whether any
+ * byte actually changed — the circuit breaker uses this to decide between a
+ * single repaired resend (changed) and immediate fail-fast (unchanged).
+ */
+function repairInvalidPromptHistory(messages: AgentMessage[]): boolean {
+	let changed = false;
+	const repairString = (value: string): string => {
+		const next = neutralizeReservedControlTokens(value);
+		if (next !== value) changed = true;
+		return next;
+	};
+	for (const message of messages) {
+		const content = (message as { content?: unknown }).content;
+		if (typeof content === "string") {
+			(message as { content: string }).content = repairString(content);
+		} else if (Array.isArray(content)) {
+			for (const block of content) {
+				if (!block || typeof block !== "object") continue;
+				const record = block as Record<string, unknown>;
+				for (const key of ["text", "thinking"]) {
+					const value = record[key];
+					if (typeof value === "string") record[key] = repairString(value);
+				}
+			}
+		}
+	}
+	return changed;
+}
+
 function managedFailureOutcome(message: AssistantMessage): ManagedAttemptOutcome {
 	return {
 		type: "retryable_discarded",
@@ -789,6 +823,9 @@ async function runLoopBody(
 	// first iteration is skipped to avoid duplicating/racing it.
 	let modelHasResponded = false;
 	let harmonyTruncateResumeCount = 0;
+	// Fires at most one repaired resend per run for the poisoned-history
+	// `invalid_prompt` circuit breaker below.
+	let invalidPromptRepairAttempted = false;
 
 	// Outer loop: continues when queued follow-up messages arrive after agent would stop
 	while (true) {
@@ -949,6 +986,29 @@ async function runLoopBody(
 					continue;
 				}
 			}
+			// Session-level invalid_prompt circuit breaker (bounded, neutralize-only).
+			// A poisoned-history rejection (`Request blocked (code=invalid_prompt)`) is
+			// a deterministic content fault: re-sending the same history re-triggers it,
+			// so naive session auto-retry would burn its whole budget re-poisoning the
+			// model. On the first invalid_prompt of this run, neutralize leaked control
+			// tokens in history IN PLACE (never dropping items). If that changed the
+			// outgoing bytes, resend exactly once with the repaired history; if
+			// neutralization cannot change anything (nothing left to repair), fall
+			// through to terminal handling and fail fast. Budget = one repaired resend.
+			// Runs before the response is committed so the resend is a clean retry;
+			// managed fallback owns its own retry policy, so this is scoped to the
+			// non-managed session path where uncontrolled auto-retry would recur.
+			if (
+				!config.fallbackManaged &&
+				message.stopReason === "error" &&
+				!invalidPromptRepairAttempted &&
+				isInvalidPromptError(message)
+			) {
+				invalidPromptRepairAttempted = true;
+				if (repairInvalidPromptHistory(currentContext.messages)) {
+					continue;
+				}
+			}
 			newMessages.push(message);
 			modelHasResponded = true;
 			let steeringMessagesFromExecution: AgentMessage[] | undefined;

package/src/compaction/compaction.ts

@@ -144,6 +144,18 @@ export interface CompactionSettings {
 	remoteEndpoint?: string;
 }
 
+export type RemoteCompactionFallbackHealthEvent =
+	| { kind: "success"; model: string; provider: string }
+	| { kind: "fallback"; model: string; provider: string; error: string };
+
+export interface RemoteCompactionFallbackHealthHooks {
+	recordRemoteCompactionFallback(event: RemoteCompactionFallbackHealthEvent): void;
+}
+
+function isAbortError(error: unknown): boolean {
+	return error instanceof Error && error.name === "AbortError";
+}
+
 export const DEFAULT_COMPACTION_SETTINGS: CompactionSettings = {
 	enabled: true,
 	strategy: "context-full",
@@ -799,6 +811,8 @@ export interface SummaryOptions {
 	providerSessionState?: Map<string, ProviderSessionState>;
 	/** Hint that websocket transport should be preferred when supported by the provider implementation. */
 	preferWebsockets?: boolean;
+	/** Session-owned health sink for remote-compaction fallback transition logging. */
+	remoteCompactionFallbackHealth?: RemoteCompactionFallbackHealthHooks;
 }
 
 /**
@@ -1305,6 +1319,7 @@ export async function compact(
 		sessionId: options?.sessionId,
 		providerSessionState: options?.providerSessionState,
 		preferWebsockets: options?.preferWebsockets,
+		remoteCompactionFallbackHealth: options?.remoteCompactionFallbackHealth,
 	};
 
 	let preserveData = withOpenAiRemoteCompactionPreserveData(previousPreserveData, undefined);
@@ -1331,12 +1346,28 @@ export async function compact(
 					{ authCredentialType: options?.authCredentialType },
 				);
 				preserveData = withOpenAiRemoteCompactionPreserveData(previousPreserveData, remote);
-			} catch (err) {
-				logger.warn("OpenAI remote compaction failed, falling back to local summarization", {
-					error: err instanceof Error ? err.message : String(err),
+				summaryOptions.remoteCompactionFallbackHealth?.recordRemoteCompactionFallback({
+					kind: "success",
 					model: model.id,
 					provider: model.provider,
 				});
+			} catch (err) {
+				if (signal?.aborted || isAbortError(err)) throw err;
+				const error = err instanceof Error ? err.message : String(err);
+				if (summaryOptions.remoteCompactionFallbackHealth) {
+					summaryOptions.remoteCompactionFallbackHealth.recordRemoteCompactionFallback({
+						kind: "fallback",
+						error,
+						model: model.id,
+						provider: model.provider,
+					});
+				} else {
+					logger.warn("OpenAI remote compaction failed, falling back to local summarization", {
+						error,
+						model: model.id,
+						provider: model.provider,
+					});
+				}
 			}
 		}
 	}

package/src/compaction/openai.ts

@@ -514,18 +514,14 @@ export async function requestOpenAiRemoteCompaction(
 	});
 
 	if (!response.ok) {
-		const errorText = await response.text().catch(() => "");
-		logger.warn("OpenAI remote compaction failed", {
-			endpoint,
-			status: response.status,
-			statusText: response.statusText,
-			errorText,
-		});
 		throw new Error(`Remote compaction failed (${response.status} ${response.statusText})`);
 	}
 
-	const data = (await response.json()) as { output?: unknown[] } | undefined;
-	const rawOutput = data?.output ?? [];
+	const data = (await response.json()) as { output?: unknown } | undefined;
+	if (!Array.isArray(data?.output)) {
+		throw new Error(`Remote compaction response malformed output (outputType=${typeof data?.output})`);
+	}
+	const rawOutput = data.output;
 	const replacementHistory = rawOutput.filter(
 		(item): item is Record<string, unknown> =>
 			!!item && typeof item === "object" && shouldKeepOpenAiCompactOutputItem(item as Record<string, unknown>),
@@ -539,15 +535,9 @@ export async function requestOpenAiRemoteCompaction(
 		const outputTypes = rawOutput.map(item =>
 			typeof item === "object" && item !== null ? (item as Record<string, unknown>).type : typeof item,
 		);
-		logger.warn("Remote compaction response missing compaction item", {
-			endpoint,
-			model: model.id,
-			provider: model.provider,
-			rawOutputLength: rawOutput.length,
-			outputTypes,
-			replacementHistoryLength: replacementHistory.length,
-		});
-		throw new Error("Remote compaction response missing compaction item");
+		throw new Error(
+			`Remote compaction response missing compaction item (rawOutputLength=${rawOutput.length}, outputTypes=${outputTypes.join(",")}, replacementHistoryLength=${replacementHistory.length})`,
+		);
 	}
 	return { provider: model.provider, replacementHistory, compactionItem };
 }
@@ -572,13 +562,6 @@ export async function requestRemoteCompaction(
 	});
 
 	if (!response.ok) {
-		const errorText = await response.text().catch(() => "");
-		logger.warn("Remote compaction failed", {
-			endpoint,
-			status: response.status,
-			statusText: response.statusText,
-			errorText,
-		});
 		throw new Error(`Remote compaction failed (${response.status} ${response.statusText})`);
 	}