@gajae-code/agent-core 0.16.7 → 0.17.1

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [0.17.1] - 2026-09-17
+
+## [0.17.0] - 2026-09-17
+
+### Added
+
+- Maintenance LLM calls (compaction, handoff, branch summaries) forward a `maintenanceCall: true` marker to the provider. Agent-level providers such as Devin over ACP use it to refuse work they cannot serve instead of forwarding a summarization prompt to a billed upstream agent.
+
+### Fixed
+
+- Lossless, managed, abort-path, and safety-stop assistant-message rebuilds now carry the in-process provider-resolved tool-call marker across the boundary. The marker is a symbol, so a deep snapshot silently dropped it, and the loop would then dispatch a provider-executed tool call to a local tool of the same display name — or, on an aborted turn, fabricate a failed tool result for it. This affected Cursor's exec-owned calls and the new Devin ACP provider alike. The marker is registered with `Symbol.for` and restoration is fail-closed on ambiguous identity.
+
+- Publish reasoning summaries, thinking, and tool-call updates during ordinary unmanaged streaming instead of holding them until text, response completion, or interruption. Tool execution still waits for terminal validation; already-published legacy guarded calls receive explicit rejection instead of silent resampling. Managed fallback attempts remain atomic.
+- Provisional streaming consumers can reject an escaped-non-ASCII tool-call turn after earlier updates without publishing its terminal message, allowing AgentSession to resample the turn without persisting defective provider metadata.
+
 ## [0.16.7] - 2026-09-13
 
 ## [0.16.6] - 2026-09-07

package/dist/types/agent.d.ts

@@ -378,7 +378,7 @@ export declare class Agent {
     setProviderResponseInterceptor(fn: SimpleStreamOptions["onResponse"] | undefined): void;
     setRawSseEventInterceptor(fn: SimpleStreamOptions["onSseEvent"] | undefined): void;
     setAssistantMessageEventInterceptor(fn: ((message: AssistantMessage, event: AssistantMessageEvent) => void) | undefined): void;
-    setProvisionalAssistantMessageEventInterceptor(fn: ((message: AssistantMessage, event: AssistantMessageEvent) => void) | undefined): void;
+    setProvisionalAssistantMessageEventInterceptor(fn: ((message: AssistantMessage, event: AssistantMessageEvent) => boolean | undefined) | undefined): void;
     setOnBeforeYield(fn: (() => Promise<void> | void) | undefined): void;
     setShouldPause(fn: AgentLoopConfig["shouldPause"] | undefined): void;
     /** The currently installed cooperative pause checkpoint, if any. */

package/dist/types/compaction/branch-summarization.d.ts

@@ -64,6 +64,12 @@ export interface GenerateBranchSummaryOptions {
     sessionId?: string;
     /** Opaque provider conversation identity; never derived from branch-summary content. */
     providerSessionId?: string;
+    /**
+     * Marks this as GJC maintenance work rather than an interactive user turn.
+     * Agent-level providers (e.g. `devin-acp`) refuse maintenance calls they
+     * cannot serve instead of forwarding them to a billed upstream agent.
+     */
+    maintenanceCall?: boolean;
     /** Shared provider state map so the branch summary call reuses session-scoped transport/session caches. */
     providerSessionState?: Map<string, ProviderSessionState>;
     /** Hint that websocket transport should be preferred when supported by the provider implementation. */

package/dist/types/compaction/compaction.d.ts

@@ -194,6 +194,12 @@ export interface SummaryOptions {
     remoteEndpoint?: string;
     remoteInstructions?: string;
     initiatorOverride?: MessageAttribution;
+    /**
+     * Marks this as GJC maintenance work rather than an interactive user turn.
+     * Agent-level providers (e.g. `devin-acp`) refuse maintenance calls they
+     * cannot serve instead of forwarding them to a billed upstream agent.
+     */
+    maintenanceCall?: boolean;
     metadata?: Record<string, unknown>;
     convertToLlm?: ConvertToLlm;
     /**
@@ -252,6 +258,12 @@ export interface HandoffOptions {
     promptExtension?: string;
     convertToLlm?: ConvertToLlm;
     initiatorOverride?: MessageAttribution;
+    /**
+     * Marks this as GJC maintenance work rather than an interactive user turn.
+     * Agent-level providers (e.g. `devin-acp`) refuse maintenance calls they
+     * cannot serve instead of forwarding them to a billed upstream agent.
+     */
+    maintenanceCall?: boolean;
     metadata?: Record<string, unknown>;
     /**
      * Optional telemetry handle. When provided, the handoff LLM call is

package/dist/types/types.d.ts

@@ -442,8 +442,8 @@ export interface AgentLoopConfig extends SimpleStreamOptions {
      * Callers may abort synchronously to stop consuming buffered provider events.
      */
     onAssistantMessageEvent?: (message: AssistantMessage, event: AssistantMessageEvent) => void;
-    /** Observe unmanaged provisional assistant deltas before public publication. */
-    onProvisionalAssistantMessageEvent?: (message: AssistantMessage, event: AssistantMessageEvent) => void;
+    /** Observe unmanaged provisional assistant deltas before public publication. Return false to reject the turn. */
+    onProvisionalAssistantMessageEvent?: (message: AssistantMessage, event: AssistantMessageEvent) => boolean | undefined;
     /** True when the host consumes provisional assistant events for live safety checks. */
     hasProvisionalAssistantMessageEventConsumer?: boolean;
     /** Called for non-content tool-choice incapability stream events. */

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/agent-core",
-	"version": "0.16.7",
+	"version": "0.17.1",
 	"description": "General-purpose agent with transport abstraction, state management, and attachment support",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -32,9 +32,9 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@gajae-code/ai": "0.16.7",
-		"@gajae-code/natives": "0.16.7",
-		"@gajae-code/utils": "0.16.7",
+		"@gajae-code/ai": "0.17.1",
+		"@gajae-code/natives": "0.17.1",
+		"@gajae-code/utils": "0.17.1",
 		"@opentelemetry/api": "^1.9.0"
 	},
 	"devDependencies": {

package/src/agent-loop.ts

@@ -34,7 +34,7 @@ import {
 	neutralizeReservedControlTokens,
 	stripUnusableReasoningItems,
 } from "@gajae-code/ai/utils";
-import { isCursorExecResolved } from "@gajae-code/ai/utils/block-symbols";
+import { copyProviderResolvedToolCall, isProviderResolvedToolCall } from "@gajae-code/ai/utils/block-symbols";
 import {
 	attachUnicodeEscapeEvidence,
 	type UnicodeEscapeEvidence,
@@ -815,7 +815,12 @@ function managedRetryableFailure(failure: unknown): boolean {
 	// caller is not authorized to make, and the credential-mutating consumers
 	// downstream would block healthy credentials on the way.
 	if (trigger.class === "auth") return trigger.authDisposition !== "forbidden";
-	return trigger.class === "rate_limit" || trigger.class === "quota" || trigger.class === "server";
+	return (
+		trigger.class === "rate_limit" ||
+		trigger.class === "quota" ||
+		trigger.class === "credential" ||
+		trigger.class === "server"
+	);
 }
 
 function promoteTypedEmptyResponseStop(message: AssistantMessage): void {
@@ -874,6 +879,7 @@ function sanitizeProviderSafetyStopProvenance(
 			return repaired;
 		}
 		restoreTransientUnicodeEscapeEvidence(rebuilt.content, message);
+		restoreProviderResolvedMarkers(rebuilt.content, message);
 		return rebuilt;
 	}
 	const rebuilt = managedAssistantShell(message, model);
@@ -2027,6 +2033,7 @@ function losslessDetachedClone<T>(value: T): T {
 						"providerCode",
 						"openaiErrorCode",
 						"anthropicErrorType",
+						"credentialModelUnavailable",
 						"retryAfterMs",
 						"headers",
 					] as const) {
@@ -2101,6 +2108,7 @@ function managedAssistantShell(
 	}
 	const content = rawArray === undefined ? [] : rawArray.flatMap(managedContentBlock);
 	restoreTransientUnicodeEscapeEvidence(content, value);
+	restoreProviderResolvedMarkers(content, value);
 	const usage = managedAssistantUsage(managedAttemptSnapshot(managedProperty(source, "usage")));
 	const api = managedProperty(source, "api");
 	const provider = managedProperty(source, "provider");
@@ -2175,6 +2183,52 @@ function managedContentBlock(block: unknown): AssistantMessage["content"] {
 	return normalized ? [normalized] : [];
 }
 
+/**
+ * Carry the in-process provider-resolved marker across a managed snapshot.
+ *
+ * A managed shell deep-snapshots content, and symbol keys do not survive that.
+ * Losing the marker would let the loop dispatch a tool call the provider already
+ * executed, so it is re-attached by tool-call identity (`id` plus `name`), the
+ * same way transient unicode-escape evidence is restored.
+ */
+function restoreProviderResolvedMarkers(destination: AssistantMessage["content"], source: unknown): void {
+	const sourceContent = managedProperty(source, "content");
+	if (!Array.isArray(sourceContent)) return;
+	const marked = sourceContent.filter(
+		(block): block is object => typeof block === "object" && block !== null && isProviderResolvedToolCall(block),
+	);
+	if (marked.length === 0) return;
+	for (const destinationBlock of destination) {
+		if (destinationBlock.type !== "toolCall") continue;
+		const matches = marked.filter(
+			candidate =>
+				managedProperty(candidate, "id") === destinationBlock.id &&
+				managedProperty(candidate, "name") === destinationBlock.name,
+		);
+		// Ambiguity suppresses every candidate rather than dispatching a call the
+		// provider may already have executed: this predicate is a safety gate.
+		for (const match of matches) copyProviderResolvedToolCall(destinationBlock, match as object);
+	}
+}
+
+/**
+ * Detach content the way `structuredClone` does, but keep the in-process
+ * provider-resolved marker. The abort path clamps partial content and then
+ * filters provider-resolved calls out of the synthesized aborted results, so a
+ * plain structured clone would fabricate a failed tool result for a call the
+ * provider already ran.
+ */
+function cloneContentPreservingProviderResolved(content: AssistantMessage["content"]): AssistantMessage["content"] {
+	const cloned = structuredClone(content) as AssistantMessage["content"];
+	for (let index = 0; index < content.length; index += 1) {
+		const source = content[index];
+		const target = cloned[index];
+		if (source?.type !== "toolCall" || target?.type !== "toolCall") continue;
+		copyProviderResolvedToolCall(target, source);
+	}
+	return cloned;
+}
+
 function managedUnicodeEscapeEvidence(value: unknown): UnicodeEscapeEvidence | undefined {
 	if (!isManagedPlainRecord(value)) return undefined;
 	const envelopeReads = Object.fromEntries(
@@ -2618,6 +2672,7 @@ class ManagedAttemptTransaction {
 	#lastStagedShape: { stagedEventCount: number; stagedBytes: number; contentBlockCount: number } | undefined;
 	#discarded = false;
 	#committed = false;
+	#rejected = false;
 	#degradedFieldDiagnostics = new Set<string>();
 
 	constructor(
@@ -2806,6 +2861,14 @@ class ManagedAttemptTransaction {
 		return this.#committed;
 	}
 
+	reject(): void {
+		this.#rejected = true;
+	}
+
+	get rejected(): boolean {
+		return this.#rejected;
+	}
+
 	acceptedAssistantSnapshot(message: AssistantMessage): AssistantMessage {
 		const sourceContent = Array.isArray(message.content) ? message.content : [];
 		const sourceMetadata: Array<EscapedToolCallMetadata | undefined> = [];
@@ -3167,6 +3230,7 @@ class ManagedAttemptTransaction {
 				managedProperty(snapshot, "content") as AssistantMessage["content"],
 				value,
 			);
+			restoreProviderResolvedMarkers(managedProperty(snapshot, "content") as AssistantMessage["content"], value);
 		}
 		return snapshot;
 	}
@@ -4042,7 +4106,7 @@ async function runLoopBody(
 				message.stopReason !== "error" &&
 				message.stopReason !== "aborted" &&
 				escapedNonAsciiResampleAttempt < MAX_ESCAPED_NONASCII_RESAMPLES &&
-				!escapedToolTransaction?.committed &&
+				(!escapedToolTransaction?.committed || escapedToolTransaction.rejected) &&
 				hasEscapedNonAsciiToolCall(message)
 			) {
 				escapedNonAsciiResampleAttempt++;
@@ -4199,7 +4263,7 @@ async function runLoopBody(
 				// This maintains the tool_use/tool_result pairing that the API requires
 				type ToolCallContent = Extract<AssistantMessage["content"][number], { type: "toolCall" }>;
 				const toolCalls = message.content.filter(
-					(c): c is ToolCallContent => c.type === "toolCall" && !isCursorExecResolved(c),
+					(c): c is ToolCallContent => c.type === "toolCall" && !isProviderResolvedToolCall(c),
 				);
 				const toolResults: ToolResultMessage[] = [];
 				for (const toolCall of toolCalls) {
@@ -4232,7 +4296,7 @@ async function runLoopBody(
 			// Check for tool calls
 			type ToolCallContent = Extract<AssistantMessage["content"][number], { type: "toolCall" }>;
 			const toolCalls = message.content.filter(
-				(c): c is ToolCallContent => c.type === "toolCall" && !isCursorExecResolved(c),
+				(c): c is ToolCallContent => c.type === "toolCall" && !isProviderResolvedToolCall(c),
 			);
 			hasMoreToolCalls = toolCalls.length > 0;
 
@@ -4813,17 +4877,20 @@ async function streamAssistantResponse(
 					const event = next.value;
 
 					switch (event.type) {
-						case "start":
+						case "start": {
 							partialMessage = config.fallbackManaged
 								? managedAssistantShell(event.partial, config.model, managedDegradedFieldDiagnostics)
 								: event.partial;
 							context.messages.push(partialMessage);
 							addedPartial = true;
+							let acceptedStart = true;
 							if (provisionalToolTransaction) {
-								config.onProvisionalAssistantMessageEvent?.(partialMessage, event);
+								acceptedStart = config.onProvisionalAssistantMessageEvent?.(partialMessage, event) !== false;
+								if (!acceptedStart) provisionalToolTransaction.reject();
 							}
-							stream.push({ type: "message_start", message: { ...partialMessage }, scope });
+							if (acceptedStart) stream.push({ type: "message_start", message: { ...partialMessage }, scope });
 							break;
+						}
 
 						case "toolChoiceIncapability":
 							config.onToolChoiceIncapability?.(event);
@@ -4856,26 +4923,28 @@ async function streamAssistantResponse(
 									? managedAssistantEventSnapshot(event, partialMessage, managedDegradedFieldDiagnostics)
 									: event;
 								context.messages[context.messages.length - 1] = partialMessage;
+								let acceptedUpdate = true;
 								if (provisionalToolTransaction) {
-									config.onProvisionalAssistantMessageEvent?.(partialMessage, partialEvent);
-									provisionalToolTransaction.stageAssistantMessageEvent(partialMessage, partialEvent);
+									acceptedUpdate =
+										config.onProvisionalAssistantMessageEvent?.(partialMessage, partialEvent) !== false;
+									if (!acceptedUpdate) provisionalToolTransaction.reject();
+									if (acceptedUpdate)
+										provisionalToolTransaction.stageAssistantMessageEvent(partialMessage, partialEvent);
 								} else {
 									config.onAssistantMessageEvent?.(partialMessage, partialEvent);
 								}
-								if (signal?.aborted) continue;
+								if (!acceptedUpdate || signal?.aborted) continue;
 								stream.push({
 									type: "message_update",
 									assistantMessageEvent: partialEvent,
 									message: { ...partialMessage },
 									scope,
 								});
-								// Preserve ordinary text streaming. Once visible text is
-								// published, this response can no longer be silently resampled;
-								// a later escaped tool call therefore falls through to the
-								// existing terminal per-call rejection instead.
-								if (event.type === "text_start" || event.type === "text_delta" || event.type === "text_end") {
-									provisionalToolTransaction?.commitCallbacksAndUpdates();
-								}
+								// Publish unmanaged content as it arrives, including reasoning and
+								// tool arguments. Publication does not accept or execute tools:
+								// terminal validation and the consumer drain still precede dispatch.
+								// A published escaped call is rejected rather than silently resampled.
+								provisionalToolTransaction?.commitCallbacksAndUpdates();
 							}
 							break;
 
@@ -4935,7 +5004,7 @@ function emitAbortedAssistantMessage(
 	const now = Date.now();
 	const abortedMessage: AssistantMessage = {
 		role: "assistant",
-		content: partialMessage ? structuredClone(partialMessage.content) : [],
+		content: partialMessage ? cloneContentPreservingProviderResolved(partialMessage.content) : [],
 		api: config.model.api,
 		provider: config.model.provider,
 		model: config.model.id,
@@ -5031,7 +5100,7 @@ async function executeToolCalls(
 	} = config;
 	type ToolCallContent = Extract<AssistantMessage["content"][number], { type: "toolCall" }>;
 	const toolCalls = assistantMessage.content.filter(
-		(c): c is ToolCallContent => c.type === "toolCall" && !isCursorExecResolved(c),
+		(c): c is ToolCallContent => c.type === "toolCall" && !isProviderResolvedToolCall(c),
 	);
 	const emittedToolResults: ToolResultMessage[] = [];
 	const toolCallInfos = toolCalls.map(call => ({ id: call.id, name: call.name }));

package/src/agent.ts

@@ -542,7 +542,10 @@ export class Agent {
 	#onResponse?: SimpleStreamOptions["onResponse"];
 	#onSseEvent?: SimpleStreamOptions["onSseEvent"];
 	#onAssistantMessageEvent?: (message: AssistantMessage, event: AssistantMessageEvent) => void;
-	#onProvisionalAssistantMessageEvent?: (message: AssistantMessage, event: AssistantMessageEvent) => void;
+	#onProvisionalAssistantMessageEvent?: (
+		message: AssistantMessage,
+		event: AssistantMessageEvent,
+	) => boolean | undefined;
 	#onToolChoiceIncapability?: AgentLoopConfig["onToolChoiceIncapability"];
 	#onHarmonyLeak?: (event: HarmonyAuditEvent) => void | Promise<void>;
 	#onBeforeYield?: () => Promise<void> | void;
@@ -928,7 +931,7 @@ export class Agent {
 	}
 
 	setProvisionalAssistantMessageEventInterceptor(
-		fn: ((message: AssistantMessage, event: AssistantMessageEvent) => void) | undefined,
+		fn: ((message: AssistantMessage, event: AssistantMessageEvent) => boolean | undefined) | undefined,
 	): void {
 		this.#onProvisionalAssistantMessageEvent = fn;
 	}
@@ -1030,81 +1033,145 @@ export class Agent {
 		// `this === undefined`, throwing "undefined is not an object (this.#optionsForCall)".
 		const read = source.read?.bind(source);
 		if (read) {
-			guarded.read = async args => {
+			guarded.read = async (args, signal, markNonAbortable) => {
 				this.#assertActiveRun(runId);
-				const result = await read(args);
+				const result = await read(args, signal, markNonAbortable);
 				this.#assertActiveRun(runId);
 				return result;
 			};
 		}
 		const ls = source.ls?.bind(source);
 		if (ls) {
-			guarded.ls = async args => {
+			guarded.ls = async (args, signal, markNonAbortable) => {
 				this.#assertActiveRun(runId);
-				const result = await ls(args);
+				const result = await ls(args, signal, markNonAbortable);
 				this.#assertActiveRun(runId);
 				return result;
 			};
 		}
 		const grep = source.grep?.bind(source);
 		if (grep) {
-			guarded.grep = async args => {
+			guarded.grep = async (args, signal) => {
 				this.#assertActiveRun(runId);
-				const result = await grep(args);
+				const result = await grep(args, signal);
 				this.#assertActiveRun(runId);
 				return result;
 			};
 		}
 		const write = source.write?.bind(source);
 		if (write) {
-			guarded.write = async args => {
+			guarded.write = async (args, signal, markNonAbortable) => {
 				this.#assertActiveRun(runId);
-				const result = await write(args);
+				const result = await write(args, signal, markNonAbortable);
 				this.#assertActiveRun(runId);
 				return result;
 			};
 		}
 		const deleteHandler = source.delete?.bind(source);
 		if (deleteHandler) {
-			guarded.delete = async args => {
+			guarded.delete = async (args, signal, markNonAbortable) => {
 				this.#assertActiveRun(runId);
-				const result = await deleteHandler(args);
+				const result = await deleteHandler(args, signal, markNonAbortable);
 				this.#assertActiveRun(runId);
 				return result;
 			};
 		}
 		const shell = source.shell?.bind(source);
 		if (shell) {
-			guarded.shell = async args => {
+			guarded.shell = async (args, signal, markNonAbortable) => {
 				this.#assertActiveRun(runId);
-				const result = await shell(args);
+				const result = await shell(args, signal, markNonAbortable);
 				this.#assertActiveRun(runId);
 				return result;
 			};
 		}
 		const shellStream = source.shellStream?.bind(source);
 		if (shellStream) {
-			guarded.shellStream = async (args, callbacks) => {
+			guarded.shellStream = async (args, callbacks, signal, markNonAbortable) => {
 				this.#assertActiveRun(runId);
-				const result = await shellStream(args, callbacks);
+				const result = await shellStream(args, callbacks, signal, markNonAbortable);
 				this.#assertActiveRun(runId);
 				return result;
 			};
 		}
 		const diagnostics = source.diagnostics?.bind(source);
 		if (diagnostics) {
-			guarded.diagnostics = async args => {
+			guarded.diagnostics = async (args, signal) => {
 				this.#assertActiveRun(runId);
-				const result = await diagnostics(args);
+				const result = await diagnostics(args, signal);
 				this.#assertActiveRun(runId);
 				return result;
 			};
 		}
 		const mcp = source.mcp?.bind(source);
 		if (mcp) {
-			guarded.mcp = async call => {
+			guarded.mcp = async (call, signal, markNonAbortable) => {
+				this.#assertActiveRun(runId);
+				const result = await mcp(call, signal, markNonAbortable);
+				this.#assertActiveRun(runId);
+				return result;
+			};
+		}
+		// Preserve Pi handlers end-to-end (probepark blocker): the production Agent guard previously dropped every pi* handler.
+		const piRead = source.piRead?.bind(source);
+		if (piRead) {
+			guarded.piRead = async call => {
+				this.#assertActiveRun(runId);
+				const result = await piRead(call);
+				this.#assertActiveRun(runId);
+				return result;
+			};
+		}
+		const piBash = source.piBash?.bind(source);
+		if (piBash) {
+			guarded.piBash = async call => {
+				this.#assertActiveRun(runId);
+				const result = await piBash(call);
+				this.#assertActiveRun(runId);
+				return result;
+			};
+		}
+		const piEdit = source.piEdit?.bind(source);
+		if (piEdit) {
+			guarded.piEdit = async call => {
+				this.#assertActiveRun(runId);
+				const result = await piEdit(call);
+				this.#assertActiveRun(runId);
+				return result;
+			};
+		}
+		const piWrite = source.piWrite?.bind(source);
+		if (piWrite) {
+			guarded.piWrite = async call => {
+				this.#assertActiveRun(runId);
+				const result = await piWrite(call);
+				this.#assertActiveRun(runId);
+				return result;
+			};
+		}
+		const piGrep = source.piGrep?.bind(source);
+		if (piGrep) {
+			guarded.piGrep = async call => {
 				this.#assertActiveRun(runId);
-				const result = await mcp(call);
+				const result = await piGrep(call);
+				this.#assertActiveRun(runId);
+				return result;
+			};
+		}
+		const piFind = source.piFind?.bind(source);
+		if (piFind) {
+			guarded.piFind = async call => {
+				this.#assertActiveRun(runId);
+				const result = await piFind(call);
+				this.#assertActiveRun(runId);
+				return result;
+			};
+		}
+		const piLs = source.piLs?.bind(source);
+		if (piLs) {
+			guarded.piLs = async call => {
+				this.#assertActiveRun(runId);
+				const result = await piLs(call);
 				this.#assertActiveRun(runId);
 				return result;
 			};
@@ -1984,9 +2051,9 @@ export class Agent {
 				this.#onAssistantMessageEvent?.(message, event);
 			},
 			onProvisionalAssistantMessageEvent: (message, event) => {
-				if (this.#activeRunId !== runId) return;
+				if (this.#activeRunId !== runId) return false;
 				this.#state.streamMessage = message;
-				this.#onProvisionalAssistantMessageEvent?.(message, event);
+				return this.#onProvisionalAssistantMessageEvent?.(message, event);
 			},
 			hasProvisionalAssistantMessageEventConsumer: this.#onProvisionalAssistantMessageEvent !== undefined,
 			onToolChoiceIncapability: this.#onToolChoiceIncapability

package/src/compaction/branch-summarization.ts

@@ -93,6 +93,12 @@ export interface GenerateBranchSummaryOptions {
 	sessionId?: string;
 	/** Opaque provider conversation identity; never derived from branch-summary content. */
 	providerSessionId?: string;
+	/**
+	 * Marks this as GJC maintenance work rather than an interactive user turn.
+	 * Agent-level providers (e.g. `devin-acp`) refuse maintenance calls they
+	 * cannot serve instead of forwarding them to a billed upstream agent.
+	 */
+	maintenanceCall?: boolean;
 	/** Shared provider state map so the branch summary call reuses session-scoped transport/session caches. */
 	providerSessionState?: Map<string, ProviderSessionState>;
 	/** Hint that websocket transport should be preferred when supported by the provider implementation. */
@@ -337,6 +343,7 @@ export async function generateBranchSummary(
 			sessionId,
 			providerSessionId,
 			providerSessionState,
+			maintenanceCall: options.maintenanceCall,
 			preferWebsockets,
 		},
 		{ telemetry: options.telemetry, oneshotKind: "branch_summary" },

package/src/compaction/compaction.ts

@@ -868,6 +868,12 @@ export interface SummaryOptions {
 	remoteEndpoint?: string;
 	remoteInstructions?: string;
 	initiatorOverride?: MessageAttribution;
+	/**
+	 * Marks this as GJC maintenance work rather than an interactive user turn.
+	 * Agent-level providers (e.g. `devin-acp`) refuse maintenance calls they
+	 * cannot serve instead of forwarding them to a billed upstream agent.
+	 */
+	maintenanceCall?: boolean;
 	metadata?: Record<string, unknown>;
 	convertToLlm?: ConvertToLlm;
 	/**
@@ -1026,6 +1032,7 @@ export async function generateSummary(
 			apiKey,
 			reasoning: maintenanceReasoning(model),
 			initiatorOverride: options?.initiatorOverride,
+			maintenanceCall: options?.maintenanceCall,
 			metadata: options?.metadata,
 			sessionId: options?.sessionId,
 			providerSessionId: options?.providerSessionId,
@@ -1065,6 +1072,12 @@ export interface HandoffOptions {
 	promptExtension?: string;
 	convertToLlm?: ConvertToLlm;
 	initiatorOverride?: MessageAttribution;
+	/**
+	 * Marks this as GJC maintenance work rather than an interactive user turn.
+	 * Agent-level providers (e.g. `devin-acp`) refuse maintenance calls they
+	 * cannot serve instead of forwarding them to a billed upstream agent.
+	 */
+	maintenanceCall?: boolean;
 	metadata?: Record<string, unknown>;
 	/**
 	 * Optional telemetry handle. When provided, the handoff LLM call is
@@ -1124,6 +1137,7 @@ export async function generateHandoff(
 			reasoning: maintenanceReasoning(model),
 			toolChoice: "none",
 			initiatorOverride: options.initiatorOverride,
+			maintenanceCall: options.maintenanceCall,
 			metadata: options.metadata,
 			sessionId: options.sessionId,
 			providerSessionId: options.providerSessionId,
@@ -1397,6 +1411,7 @@ export async function compact(
 		remoteEndpoint: settings.remoteEnabled === false ? undefined : settings.remoteEndpoint,
 		remoteInstructions: options?.remoteInstructions,
 		initiatorOverride: options?.initiatorOverride,
+		maintenanceCall: options?.maintenanceCall,
 		metadata: options?.metadata,
 		convertToLlm: options?.convertToLlm,
 		telemetry: options?.telemetry,
@@ -1574,6 +1589,7 @@ async function generateTurnPrefixSummary(
 			apiKey,
 			reasoning: maintenanceReasoning(model),
 			initiatorOverride: options?.initiatorOverride,
+			maintenanceCall: options?.maintenanceCall,
 			metadata: options?.metadata,
 			sessionId: options?.sessionId,
 			providerSessionId: options?.providerSessionId,

package/src/types.ts

@@ -485,8 +485,11 @@ export interface AgentLoopConfig extends SimpleStreamOptions {
 	 * Callers may abort synchronously to stop consuming buffered provider events.
 	 */
 	onAssistantMessageEvent?: (message: AssistantMessage, event: AssistantMessageEvent) => void;
-	/** Observe unmanaged provisional assistant deltas before public publication. */
-	onProvisionalAssistantMessageEvent?: (message: AssistantMessage, event: AssistantMessageEvent) => void;
+	/** Observe unmanaged provisional assistant deltas before public publication. Return false to reject the turn. */
+	onProvisionalAssistantMessageEvent?: (
+		message: AssistantMessage,
+		event: AssistantMessageEvent,
+	) => boolean | undefined;
 	/** True when the host consumes provisional assistant events for live safety checks. */
 	hasProvisionalAssistantMessageEventConsumer?: boolean;