@gajae-code/agent-core 0.11.10 → 0.12.0

package/CHANGELOG.md

@@ -2,7 +2,16 @@
 
 ## [Unreleased]
 
-## [0.11.10] - 2026-07-25
+## [0.12.0] - 2026-07-28
+
+## [0.11.11] - 2026-07-26
+
+### Fixed
+
+- Managed runs now release their logical-run ownership before terminal observers are notified, so terminal overflow recovery cannot leave a stale owner behind.
+- The OpenAI remote-compaction endpoint is now resolved from trusted environment sources only. `OPENAI_BASE_URL` was read through the merged view that includes the caller's `cwd/.env`, so a repository could redirect compaction requests that carry the OpenAI credential; it now uses the non-project resolver, leaving shell and user-level configuration unchanged.
+- Repeated malformed tool calls now get one tool-free recovery response, preventing argument-validation loops from ending without an answer while leaving ordinary execution-error retries unchanged. The recovery turn commits its assistant to the durable context, forces `toolChoice: "none"` alongside an empty tool list without consuming a queued tool choice, and never executes a tool call it did not advertise. Its recovery prompt is request-only, so append-only tool prefixes stay stable and the durable message log is unchanged.
+- Argument-validation loops now reach a deterministic terminal state. If a model keeps emitting only malformed tool calls after the one-shot recovery turn, the run stops with an explanatory error instead of calling the provider indefinitely. The bound counts consecutive all-malformed turns rather than repeated argument signatures, so a model rotating invalid argument shapes is bounded too; any healthy tool turn resets it.
 
 ## [0.11.8] - 2026-07-23
 

package/dist/types/compaction/openai.d.ts

@@ -39,6 +39,8 @@ export interface RemoteCompactionResponse {
     shortSummary?: string;
 }
 export declare function shouldUseOpenAiRemoteCompaction(model: Model): boolean;
+/** Test seam: the compaction endpoint as resolved from trusted env. */
+export declare function resolveOpenAiCompactEndpointForTest(model: Model, authCredentialType?: "api_key" | "oauth"): string;
 export declare function getPreservedOpenAiRemoteCompactionData(preserveData: Record<string, unknown> | undefined): OpenAiRemoteCompactionPreserveData | undefined;
 export declare function withOpenAiRemoteCompactionPreserveData(preserveData: Record<string, unknown> | undefined, remoteCompaction: OpenAiRemoteCompactionPreserveData | undefined): Record<string, unknown> | undefined;
 export declare function estimateOpenAiCompactInputTokens(input: Array<Record<string, unknown>>, instructions: string): number;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/agent-core",
-	"version": "0.11.10",
+	"version": "0.12.0",
 	"description": "General-purpose agent with transport abstraction, state management, and attachment support",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -32,9 +32,9 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@gajae-code/ai": "0.11.10",
-		"@gajae-code/natives": "0.11.10",
-		"@gajae-code/utils": "0.11.10",
+		"@gajae-code/ai": "0.12.0",
+		"@gajae-code/natives": "0.12.0",
+		"@gajae-code/utils": "0.12.0",
 		"@opentelemetry/api": "^1.9.0"
 	},
 	"devDependencies": {

package/src/agent-loop.ts

@@ -16,6 +16,7 @@ import {
 	type ToolResultMessage,
 	type TSchema,
 	transportFailureFacts,
+	type UserMessage,
 	validateToolArguments,
 	zodToWireSchema,
 } from "@gajae-code/ai";
@@ -32,6 +33,7 @@ import {
 	shouldMitigateHarmonyLeak,
 	signalListLabel,
 } from "./harmony-leak";
+import repeatedToolFailureRecoveryPrompt from "./prompts/repeated-tool-failure-recovery.md" with { type: "text" };
 import { type AgentRunCoverage, type AgentRunSummary, ToolCallBlockedError } from "./run-collector";
 import {
 	type AgentTelemetry,
@@ -100,6 +102,17 @@ class ManagedAttemptSnapshotError extends Error {
 const managedAttemptTextEncoder = new TextEncoder();
 
 const ABORTED: unique symbol = Symbol("agent-loop-aborted");
+
+/**
+ * Terminal bound for argument-validation loops: how many CONSECUTIVE turns may
+ * consist entirely of malformed tool calls before the run stops.
+ *
+ * The one-shot tools-free recovery turn fires first; this is the deterministic
+ * backstop for a model that keeps emitting unusable calls after it. Counted per
+ * turn rather than per argument signature so a model rotating invalid shapes is
+ * bounded too.
+ */
+const MAX_CONSECUTIVE_MALFORMED_TURNS = 5;
 function managedContextOverflow(message: AssistantMessage, config: AgentLoopConfig): boolean {
 	const transportFailure = managedTransportFailure(message);
 	// Managed empty-stop responses may be repaired by the managed shell below; only
@@ -1247,6 +1260,21 @@ async function runLoopBody(
 	// Fires at most one repaired resend per run for the poisoned-history
 	// `invalid_prompt` circuit breaker below.
 	let invalidPromptRepairAttempted = false;
+	let previousMalformedToolSignatures = new Set<string>();
+	const recoveryState: {
+		pending: boolean;
+		inserted: boolean;
+		syntheticMessage?: UserMessage;
+	} = { pending: false, inserted: false };
+	let malformedToolRecoveryAttempted = false;
+	// Deterministic terminal circuit breaker for argument-validation loops.
+	//
+	// Counts CONSECUTIVE turns whose tool calls were all malformed, regardless of
+	// whether the arguments repeat. Signature-based "repeated" detection alone is
+	// not a bound: a model that rotates invalid argument shapes never trips it, so
+	// the loop could run forever. Any turn that produces a non-malformed batch
+	// resets the counter, so healthy runs are unaffected.
+	let consecutiveMalformedTurns = 0;
 
 	// Outer loop: continues when queued follow-up messages arrive after agent would stop
 	while (true) {
@@ -1331,6 +1359,15 @@ async function runLoopBody(
 								attemptTransaction.stageAssistantMessageEvent(partial, event),
 						}
 					: config;
+				if (recoveryState.pending && !recoveryState.inserted) {
+					recoveryState.syntheticMessage = {
+						role: "user",
+						content: repeatedToolFailureRecoveryPrompt,
+						synthetic: true,
+						timestamp: Date.now(),
+					};
+					recoveryState.inserted = true;
+				}
 				message = await streamAssistantResponse(
 					currentContext,
 					attemptConfig,
@@ -1341,6 +1378,9 @@ async function runLoopBody(
 					stepCounter,
 					streamFn,
 					harmonyRetryAttempt,
+					recoveryState.pending && recoveryState.syntheticMessage
+						? { syntheticMessage: recoveryState.syntheticMessage }
+						: undefined,
 				);
 				const detection = detectHarmonyLeakInAssistantMessage(message);
 				if (detection && shouldMitigateHarmonyLeak(config.model, detection)) {
@@ -1493,6 +1533,7 @@ async function runLoopBody(
 			if (config.fallbackManaged && message.stopReason !== "error" && message.stopReason !== "aborted") {
 				await config.onManagedAttemptAccepted?.();
 			}
+			const wasRecoveryAttempt = recoveryState.pending;
 
 			if (message.stopReason === "error" || message.stopReason === "aborted") {
 				// Create placeholder tool results for any tool calls in the aborted message
@@ -1527,26 +1568,67 @@ async function runLoopBody(
 			hasMoreToolCalls = toolCalls.length > 0;
 
 			const toolResults: ToolResultMessage[] = [];
+			let repeatedMalformedToolCall = false;
 			if (hasMoreToolCalls) {
-				const executionResult = await executeToolCalls(
-					currentContext,
-					message,
-					loopSignal,
-					stream,
-					config,
-					telemetry,
-					invokeAgentSpan,
-				);
+				if (wasRecoveryAttempt) {
+					for (const toolCall of toolCalls) {
+						const result = createAbortedToolResult(
+							toolCall,
+							stream,
+							"error",
+							"Tool calls are disabled during repeated malformed tool-call recovery.",
+						);
+						currentContext.messages.push(result);
+						newMessages.push(result);
+						toolResults.push(result);
+						recordSkippedTool(telemetry, {
+							toolCallId: toolCall.id,
+							toolName: toolCall.name,
+							status: "skipped",
+						});
+					}
+				} else {
+					const executionResult = await executeToolCalls(
+						currentContext,
+						message,
+						loopSignal,
+						stream,
+						config,
+						telemetry,
+						invokeAgentSpan,
+					);
 
-				toolResults.push(...executionResult.toolResults);
-				steeringMessagesFromExecution = executionResult.steeringMessages;
+					toolResults.push(...executionResult.toolResults);
+					steeringMessagesFromExecution = executionResult.steeringMessages;
+
+					const malformedSignatures = executionResult.malformedToolCallSignatures;
+					const allToolCallsMalformed =
+						toolResults.length > 0 && malformedSignatures.length === toolResults.length;
+					if (allToolCallsMalformed) {
+						consecutiveMalformedTurns += 1;
+						const uniqueMalformedSignatures = new Set(malformedSignatures);
+						repeatedMalformedToolCall =
+							uniqueMalformedSignatures.size < malformedSignatures.length ||
+							[...uniqueMalformedSignatures].some(signature => previousMalformedToolSignatures.has(signature));
+						previousMalformedToolSignatures = uniqueMalformedSignatures;
+					} else {
+						consecutiveMalformedTurns = 0;
+						previousMalformedToolSignatures = new Set();
+					}
 
-				for (const result of toolResults) {
-					currentContext.messages.push(result);
-					newMessages.push(result);
+					for (const result of toolResults) {
+						currentContext.messages.push(result);
+						newMessages.push(result);
+					}
 				}
 			}
 
+			if (wasRecoveryAttempt) {
+				recoveryState.pending = false;
+				recoveryState.inserted = false;
+				recoveryState.syntheticMessage = undefined;
+			}
+
 			stream.push({ type: "turn_end", message, toolResults });
 
 			if (steeringMessagesFromExecution && steeringMessagesFromExecution.length > 0) {
@@ -1560,6 +1642,27 @@ async function runLoopBody(
 				stream.end(newMessages);
 				return;
 			}
+			if (repeatedMalformedToolCall && !malformedToolRecoveryAttempted) {
+				recoveryState.pending = true;
+				recoveryState.inserted = false;
+				recoveryState.syntheticMessage = undefined;
+				malformedToolRecoveryAttempted = true;
+			} else if (consecutiveMalformedTurns >= MAX_CONSECUTIVE_MALFORMED_TURNS) {
+				// Deterministic terminal circuit breaker. The one-shot recovery turn
+				// above already had its chance; if the model is still emitting only
+				// malformed tool calls after it, the run cannot make progress and must
+				// stop rather than burn the provider budget. Terminates on consecutive
+				// count, not argument signatures, so rotating invalid shapes are bounded
+				// too.
+				message.stopReason = "error";
+				const breakerMessage = `Stopping after ${consecutiveMalformedTurns} consecutive turns of malformed tool calls; the model did not produce a usable tool call or answer.`;
+				message.errorMessage = message.errorMessage
+					? `${message.errorMessage} | ${breakerMessage}`
+					: breakerMessage;
+				stream.push(buildAgentEndEvent(newMessages, telemetry, stepCounter.count));
+				stream.end(newMessages);
+				return;
+			}
 		}
 
 		// Agent would stop here. Check for follow-up messages.
@@ -1615,6 +1718,7 @@ async function streamAssistantResponse(
 	stepCounter: StepCounter,
 	streamFn?: StreamFn,
 	harmonyRetryAttempt = 0,
+	recoveryMode?: { syntheticMessage: UserMessage },
 ): Promise<AssistantMessage> {
 	// Apply context transform if configured (AgentMessage[] → AgentMessage[])
 	let messages = context.messages;
@@ -1639,7 +1743,24 @@ async function streamAssistantResponse(
 			tools: normalizeTools(context.tools, !!config.intentTracing),
 		};
 	}
-
+	if (recoveryMode) {
+		if (config.appendOnlyContext) {
+			const syntheticMessages = normalizeMessagesForProvider(
+				await config.convertToLlm([recoveryMode.syntheticMessage]),
+				config.model,
+			);
+			llmContext = { ...llmContext, messages: [...llmContext.messages, ...syntheticMessages], tools: [] };
+		} else {
+			llmContext = {
+				...llmContext,
+				messages: normalizeMessagesForProvider(
+					await config.convertToLlm([...messages, recoveryMode.syntheticMessage]),
+					config.model,
+				),
+				tools: [],
+			};
+		}
+	}
 	const streamFunction = streamFn || streamSimple;
 
 	// Resolve API key (important for expiring tokens) — do this before resolving
@@ -1654,7 +1775,7 @@ async function streamAssistantResponse(
 
 	const resolvedMetadata = config.metadataResolver ? config.metadataResolver(config.model.provider) : config.metadata;
 
-	const dynamicToolChoice = config.getToolChoice?.();
+	const dynamicToolChoice = recoveryMode ? undefined : config.getToolChoice?.();
 	const dynamicReasoning = config.getReasoning?.();
 	const harmonyMitigationEnabled = isHarmonyLeakMitigationTarget(config.model);
 	const harmonyAbortController = harmonyMitigationEnabled ? new AbortController() : undefined;
@@ -1665,7 +1786,7 @@ async function streamAssistantResponse(
 		: signal;
 	const effectiveTemperature =
 		harmonyRetryAttempt > 0 && config.temperature !== undefined ? config.temperature + 0.05 : config.temperature;
-	const effectiveToolChoice = dynamicToolChoice ?? config.toolChoice;
+	const effectiveToolChoice = recoveryMode ? "none" : (dynamicToolChoice ?? config.toolChoice);
 	const effectiveReasoning = dynamicReasoning ?? config.reasoning;
 
 	const chatStepNumber = stepCounter.count;
@@ -1910,7 +2031,11 @@ async function executeToolCalls(
 	config: AgentLoopConfig,
 	telemetry: AgentTelemetry | undefined,
 	invokeAgentSpan: Span | undefined,
-): Promise<{ toolResults: ToolResultMessage[]; steeringMessages?: AgentMessage[] }> {
+): Promise<{
+	toolResults: ToolResultMessage[];
+	steeringMessages?: AgentMessage[];
+	malformedToolCallSignatures: string[];
+}> {
 	const tools = currentContext.tools;
 	const {
 		getSteeringMessages,
@@ -1951,6 +2076,7 @@ async function executeToolCalls(
 		skipped: false,
 		toolResultMessage: undefined as ToolResultMessage | undefined,
 		resultEmitted: false,
+		argumentValidationFailed: false,
 	}));
 
 	const checkSteering = async (): Promise<void> => {
@@ -2070,6 +2196,7 @@ async function executeToolCalls(
 		await runInActiveSpan(toolSpan, async () => {
 			try {
 				if (toolCall.incompleteArguments) {
+					record.argumentValidationFailed = true;
 					// The provider flagged this call's argument JSON as truncated
 					// (the model hit its output-token limit mid-call). Executing the
 					// best-effort partial parse would run the tool on wrong input, so
@@ -2104,6 +2231,7 @@ async function executeToolCalls(
 					if (tool.lenientArgValidation) {
 						effectiveArgs = argsForExecution;
 					} else {
+						record.argumentValidationFailed = true;
 						throw validationError;
 					}
 				}
@@ -2255,7 +2383,12 @@ async function executeToolCalls(
 		}
 	}
 
-	return { toolResults: emittedToolResults, steeringMessages };
+	const malformedToolCallSignatures = records.flatMap(record =>
+		record.argumentValidationFailed && record.toolResultMessage?.isError
+			? [`${record.toolCall.name}:${JSON.stringify(record.toolCall.arguments)}`]
+			: [],
+	);
+	return { toolResults: emittedToolResults, steeringMessages, malformedToolCallSignatures };
 }
 
 /**

package/src/agent.ts

@@ -1196,6 +1196,9 @@ export class Agent {
 	 */
 	requestRunTerminal(logicalRunId: ManagedLogicalRunId, request: RunTerminalRequest): boolean {
 		if (this.#terminalizedLogicalRunIds.has(logicalRunId)) return false;
+		if (this.#managedLogicalRunOwner === logicalRunId) {
+			this.#managedLogicalRunOwner = undefined;
+		}
 		this.#finalizeRun(
 			logicalRunId,
 			{

package/src/compaction/openai.ts

@@ -28,7 +28,7 @@ import {
 	neutralizeResponsesInputControlTokens,
 	normalizeResponsesToolCallId,
 } from "@gajae-code/ai/utils";
-import { $env, logger } from "@gajae-code/utils";
+import { $credentialEnv, logger } from "@gajae-code/utils";
 
 const OPENAI_DEFAULT_BASE_URL = "https://api.openai.com/v1";
 
@@ -81,7 +81,8 @@ function resolveOpenAiCompactEndpoint(model: Model, authCredentialType?: "api_ke
 		return resolveOpenAiCodexCompactEndpoint(model.baseUrl);
 	}
 
-	const envBaseUrl = $env.OPENAI_BASE_URL?.trim();
+	// Trusted sources only: the compaction endpoint carries the OpenAI credential.
+	const envBaseUrl = $credentialEnv("OPENAI_BASE_URL");
 	const configuredBaseUrl = model.baseUrl?.trim();
 	const rawBase =
 		authCredentialType === "oauth"
@@ -94,6 +95,11 @@ function resolveOpenAiCompactEndpoint(model: Model, authCredentialType?: "api_ke
 	return `${normalizedBase}/v1/responses/compact`;
 }
 
+/** Test seam: the compaction endpoint as resolved from trusted env. */
+export function resolveOpenAiCompactEndpointForTest(model: Model, authCredentialType?: "api_key" | "oauth"): string {
+	return resolveOpenAiCompactEndpoint(model, authCredentialType);
+}
+
 function resolveOpenAiCodexCompactEndpoint(baseUrl: string | undefined): string {
 	const rawBase = baseUrl && baseUrl.length > 0 ? baseUrl : CODEX_BASE_URL;
 	const normalizedBase = rawBase.endsWith("/") ? rawBase.slice(0, -1) : rawBase;

package/src/prompts/repeated-tool-failure-recovery.md

@@ -0,0 +1 @@
+The immediately preceding tool calls failed because their arguments were malformed. Do not call any tools. Answer the original user request now using the conversation and any successful tool results already available. If the evidence is incomplete, state that limitation instead of returning an empty response.