@gajae-code/coding-agent 0.11.1 → 0.11.2

package/src/tools/browser/tab-supervisor.ts

@@ -5,6 +5,13 @@ import type { ToolSession } from "../../sdk";
 import { expandPath } from "../path-utils";
 import { ToolAbortError, ToolError } from "../tool-errors";
 import { pickElectronTarget } from "./attach";
+import {
+	consumeDeadTabRecovery,
+	discardDeadTabRecovery,
+	isDeadTabRecoveryLive,
+	peekDeadTabRecovery,
+	registerDeadTabRecovery,
+} from "./dead-tab-recovery";
 import { type BrowserHandle, type BrowserKindTag, holdBrowser, releaseBrowser } from "./registry";
 import type {
 	ReadyInfo,
@@ -55,6 +62,8 @@ export interface TabSession {
 	pending: Map<string, PendingRun>;
 	dialogPolicy?: DialogPolicy;
 	kindTag: BrowserKindTag;
+	/** Immutable inputs needed to recreate this worker after an unexpected exit. */
+	recoveryOpts: AcquireTabOptions;
 	/** Session that acquired this tab; used for session-scoped teardown (F13). */
 	ownerId?: string;
 	/** Unix-ms timestamp of the last acquire/run activity; drives GC idle + LRU ordering. */
@@ -73,6 +82,10 @@ export interface AcquireTabOptions {
 	dialogs?: DialogPolicy;
 	/** Owning session id so dispose can release only this session's tabs (F13). */
 	ownerId?: string;
+	/** Internal recovery-only target id; makes a headless replacement attach, not open a page. */
+	recoveryTargetId?: string;
+	/** Recovery fence: replacement must not overwrite a tab installed after dead teardown. */
+	requireVacantName?: boolean;
 }
 
 export interface AcquireTabResult {
@@ -98,8 +111,20 @@ export interface ReleaseTabOptions {
 }
 
 const tabs = new Map<string, TabSession>();
+const recoveringTabs = new Map<string, { ownerId: string | undefined; promise: Promise<TabSession> }>();
+let afterWorkerInitializationForTest: ((name: string) => void) | undefined;
+let workerFactoryForTest: (() => Promise<WorkerHandle>) | undefined;
+let workerInitializerForTest:
+	| ((worker: WorkerHandle, payload: WorkerInitPayload, timeoutMs: number) => Promise<ReadyInfo>)
+	| undefined;
 const GRACE_MS = 750;
 
+interface DeadTabDescriptor {
+	tab: TabSession;
+	browser: BrowserHandle;
+	opts: AcquireTabOptions;
+}
+
 /**
  * Remaining time (ms) until an absolute teardown deadline, or +Infinity when no deadline
  * is set (the GC / session-teardown callers). A non-positive result means the shared
@@ -156,6 +181,46 @@ function beginRelease(tab: TabSession): boolean {
 	return true;
 }
 
+async function withTemporaryBrowserHold<T>(browser: BrowserHandle, work: () => Promise<T>): Promise<T> {
+	holdBrowser(browser);
+	try {
+		return await work();
+	} finally {
+		await releaseBrowser(browser, { kill: false });
+	}
+}
+
+/** Test-only: exercise the same hold-transfer primitive used by replacement recovery. */
+export async function withTemporaryBrowserHoldForTest<T>(browser: BrowserHandle, work: () => Promise<T>): Promise<T> {
+	return await withTemporaryBrowserHold(browser, work);
+}
+
+/** Test-only: close exactly the target belonging to the supplied dead session. */
+export async function closeOrphanTargetForTest(tab: TabSession): Promise<void> {
+	await closeOrphanTarget(tab);
+}
+
+function recoveryPromiseForOwner(name: string, ownerId: string | undefined): Promise<TabSession> | undefined {
+	const existing = recoveringTabs.get(name);
+	if (!existing || existing.ownerId !== ownerId) return undefined;
+	return existing.promise;
+}
+
+/** Test-only: install an in-flight recovery and observe owner isolation. */
+export function __setRecoveringTabForTest(
+	name: string,
+	ownerId: string | undefined,
+	promise: Promise<TabSession>,
+): void {
+	recoveringTabs.set(name, { ownerId, promise });
+}
+
+export function recoveryPromiseForOwnerForTest(
+	name: string,
+	ownerId: string | undefined,
+): Promise<TabSession> | undefined {
+	return recoveryPromiseForOwner(name, ownerId);
+}
 /** Read-only, GC-facing projection of a live tab. Never exposes the mutable `tabs` map. */
 export interface TabGcSnapshot {
 	name: string;
@@ -193,14 +258,14 @@ export function listTabsForGc(): TabGcSnapshot[] {
  */
 export async function releaseTabIfGcEligible(name: string, policy: BrowserGcEligibilityPolicy): Promise<boolean> {
 	const tab = tabs.get(name);
-	if (!tab) return false;
-	if (tab.releasing) return false;
-	if (tab.state !== "alive") return false;
+	if (!tab || tab.releasing) return false;
+	if (tab.state === "dead") {
+		if (recoveringTabs.has(name) || isDeadTabRecoveryLive(name, policy.now())) return false;
+		return await releaseDeadTabForRecovery(name, tab, tab.ownerId);
+	}
 	if (tab.pending.size !== 0) return false;
 	if (tab.kindTag !== "headless" && tab.kindTag !== "spawned") return false;
 	if (policy.now() - tab.lastUsedAt <= policy.idleMs) return false;
-	// All predicates passed synchronously; releaseTab applies the shared begin-release guard
-	// on the same microtask, so no other code runs between the check and the state transition.
 	return await releaseTab(name, { kill: false });
 }
 
@@ -212,6 +277,36 @@ export function setTabForTest(tab: TabSession): void {
 /** Test-only: clear the tab registry between cases. */
 export function clearTabsForTest(): void {
 	tabs.clear();
+	recoveringTabs.clear();
+	afterWorkerInitializationForTest = undefined;
+	workerFactoryForTest = undefined;
+	workerInitializerForTest = undefined;
+}
+
+export function __setAfterWorkerInitializationForTest(callback: ((name: string) => void) | undefined): void {
+	afterWorkerInitializationForTest = callback;
+}
+export function __setAcquireTabWorkerDepsForTest(
+	factory: (() => Promise<WorkerHandle>) | undefined,
+	initializer:
+		| ((worker: WorkerHandle, payload: WorkerInitPayload, timeoutMs: number) => Promise<ReadyInfo>)
+		| undefined,
+): void {
+	workerFactoryForTest = factory;
+	workerInitializerForTest = initializer;
+}
+
+async function initializeAcquireWorker(
+	worker: WorkerHandle,
+	payload: WorkerInitPayload,
+	timeoutMs: number,
+): Promise<ReadyInfo> {
+	return await (workerInitializerForTest?.(worker, payload, timeoutMs) ??
+		initializeTabWorker(worker, payload, timeoutMs));
+}
+
+async function spawnAcquireWorker(): Promise<WorkerHandle> {
+	return await (workerFactoryForTest?.() ?? spawnTabWorker());
 }
 
 export async function acquireTab(
@@ -220,6 +315,9 @@ export async function acquireTab(
 	opts: AcquireTabOptions,
 ): Promise<AcquireTabResult> {
 	const existing = tabs.get(name);
+	if (opts.requireVacantName && existing)
+		throw new ToolError(`Tab ${JSON.stringify(name)} was replaced during recovery.`);
+	let replacementHold = false;
 	if (existing) {
 		if (existing.browser === browser && existing.state === "alive") {
 			if (opts.dialogs !== undefined && opts.dialogs !== existing.dialogPolicy) {
@@ -240,33 +338,50 @@ export async function acquireTab(
 				return { tab: tabs.get(name)!, created: false };
 			}
 		} else {
-			await releaseTab(name, { kill: false });
+			if (existing.browser === browser) {
+				holdBrowser(browser);
+				replacementHold = true;
+			}
+			try {
+				await releaseTab(name, { kill: false });
+			} catch (error) {
+				if (replacementHold) await releaseBrowser(browser, { kill: false });
+				throw error;
+			}
 		}
 	}
 
-	const initPayload = await buildInitPayload(browser, opts);
-	let worker = await spawnTabWorker();
+	let initPayload: WorkerInitPayload;
+	try {
+		initPayload = await buildInitPayload(browser, opts);
+	} catch (error) {
+		if (replacementHold) await releaseBrowser(browser, { kill: false });
+		throw error;
+	}
+	let worker = await spawnAcquireWorker();
 	let info: ReadyInfo;
 	try {
-		info = await initializeTabWorker(worker, initPayload, opts.timeoutMs + GRACE_MS);
+		info = await initializeAcquireWorker(worker, initPayload, opts.timeoutMs + GRACE_MS);
 	} catch (error) {
 		// `BuildMessage`-class failures arrive asynchronously via the worker's `error` event,
 		// after `spawnTabWorker`'s synchronous try/catch has already returned. Fall back to
 		// the inline worker here so module-resolution failures don't poison every tab open.
 		await worker.terminate().catch(() => undefined);
 		if (worker.mode === "inline") {
-			if (browser.refCount === 0) await releaseBrowser(browser, { kill: false });
+			if (replacementHold) await releaseBrowser(browser, { kill: false });
+			else if (browser.refCount === 0) await releaseBrowser(browser, { kill: false });
 			throw error;
 		}
 		logger.warn("Tab worker init failed; retrying with inline tab worker (no sync-loop guard)", {
 			error: error instanceof Error ? error.message : String(error),
 		});
-		worker = await spawnInlineWorker();
+		worker = await (workerFactoryForTest?.() ?? spawnInlineWorker());
 		try {
-			info = await initializeTabWorker(worker, initPayload, opts.timeoutMs + GRACE_MS);
+			info = await initializeAcquireWorker(worker, initPayload, opts.timeoutMs + GRACE_MS);
 		} catch (inlineError) {
 			await worker.terminate().catch(() => undefined);
-			if (browser.refCount === 0) await releaseBrowser(browser, { kill: false });
+			if (replacementHold) await releaseBrowser(browser, { kill: false });
+			else if (browser.refCount === 0) await releaseBrowser(browser, { kill: false });
 			const finalError = new ToolError(
 				`Failed to start browser tab worker (inline fallback also failed): ${inlineError instanceof Error ? inlineError.message : String(inlineError)}`,
 			);
@@ -275,7 +390,14 @@ export async function acquireTab(
 		}
 	}
 
+	afterWorkerInitializationForTest?.(name);
+	if (opts.requireVacantName && tabs.has(name)) {
+		await worker.terminate().catch(() => undefined);
+		if (replacementHold) await releaseBrowser(browser, { kill: false });
+		throw new ToolError(`Tab ${JSON.stringify(name)} was replaced during recovery.`);
+	}
 	holdBrowser(browser);
+	if (replacementHold) await releaseBrowser(browser, { kill: false });
 	const tab: TabSession = {
 		name,
 		browser,
@@ -288,8 +410,10 @@ export async function acquireTab(
 		kindTag: browser.kind.kind,
 		ownerId: opts.ownerId,
 		lastUsedAt: Date.now(),
+		recoveryOpts: freezeRecoveryOptions(opts),
 	};
 	worker.onMessage(msg => handleTabMessage(tab, msg));
+	worker.onError(error => markTabDead(tab, error));
 	tabs.set(name, tab);
 	return { tab, created: true };
 }
@@ -307,8 +431,9 @@ async function runInTabWithSnapshot(
 	opts: { code: string; timeoutMs: number; signal?: AbortSignal; session?: ToolSession },
 	snapshot: SessionSnapshot,
 ): Promise<RunResultOk> {
-	const tab = tabs.get(name);
-	if (!tab || tab.state === "dead") throw new ToolError(`Tab ${JSON.stringify(name)} is not alive. Reopen it.`);
+	let tab = tabs.get(name);
+	if (tab?.state === "dead") tab = await recoverDeadTab(name, opts.session);
+	if (tab?.state !== "alive") throw new ToolError(`Tab ${JSON.stringify(name)} is not alive. Reopen it.`);
 	if (tab.pending.size > 0) throw new ToolError(`Tab ${JSON.stringify(name)} is busy`);
 	tab.lastUsedAt = Date.now();
 	const id = Snowflake.next();
@@ -340,6 +465,82 @@ async function runInTabWithSnapshot(
 		tab.pending.delete(id);
 	}
 }
+function markTabDead(tab: TabSession, error: Error): void {
+	if (tabs.get(tab.name) !== tab || tab.state !== "alive" || tab.releasing) return;
+	tab.state = "dead";
+	const closeError = new ToolError(`Browser tab worker stopped: ${error.message}`);
+	for (const pending of tab.pending.values()) pending.reject(closeError);
+	tab.pending.clear();
+	registerDeadTabRecovery(tab.name, tab.ownerId, Object.freeze({ tab, browser: tab.browser, opts: tab.recoveryOpts }));
+}
+function freezeRecoveryOptions(opts: AcquireTabOptions): AcquireTabOptions {
+	return Object.freeze({
+		...opts,
+		signal: undefined,
+		viewport: opts.viewport ? Object.freeze({ ...opts.viewport }) : undefined,
+	});
+}
+
+async function recoverDeadTab(name: string, session: ToolSession | undefined): Promise<TabSession | undefined> {
+	const ownerId = session?.getSessionId?.() ?? undefined;
+	const existing = recoveryPromiseForOwner(name, ownerId);
+	if (existing) return await existing;
+	if (recoveringTabs.has(name)) return undefined;
+	const peeked = peekDeadTabRecovery<DeadTabDescriptor>(name, ownerId);
+	if (peeked.status !== "consumed" || !peeked.descriptor) return undefined;
+	const descriptor = peeked.descriptor;
+	const consumed = consumeDeadTabRecovery<DeadTabDescriptor>(name, ownerId);
+	if (consumed.status === "owner_mismatch") return undefined;
+	if (consumed.status === "expired_or_missing") {
+		await releaseDeadTabForRecovery(name, descriptor.tab, ownerId);
+		return undefined;
+	}
+	const recovery = withTemporaryBrowserHold(descriptor.browser, async (): Promise<TabSession> => {
+		if (!(await releaseDeadTabForRecovery(name, descriptor.tab, ownerId, true))) {
+			throw new ToolError(`Tab ${JSON.stringify(name)} is not alive. Reopen it.`);
+		}
+		try {
+			return (
+				await acquireTab(name, descriptor.browser, {
+					...descriptor.opts,
+					recoveryTargetId: descriptor.tab.targetId,
+					requireVacantName: true,
+				})
+			).tab;
+		} catch (error) {
+			if (descriptor.tab.kindTag === "headless") await closeOrphanTarget(descriptor.tab).catch(() => undefined);
+			throw error;
+		}
+	});
+	recoveringTabs.set(name, { ownerId, promise: recovery });
+	try {
+		return await recovery;
+	} finally {
+		if (recoveringTabs.get(name)?.promise === recovery) recoveringTabs.delete(name);
+	}
+}
+
+/**
+ * Claim and release exactly the dead tab that produced a recovery descriptor. Every
+ * predicate and the release election run synchronously before teardown can await.
+ */
+export async function releaseDeadTabForRecovery(
+	name: string,
+	expected: TabSession,
+	ownerId: string | undefined,
+	preserveHeadlessTarget = false,
+): Promise<boolean> {
+	if (
+		tabs.get(name) !== expected ||
+		expected.state !== "dead" ||
+		expected.ownerId !== ownerId ||
+		!beginRelease(expected)
+	) {
+		return false;
+	}
+	await releaseClaimedTab(expected, { kill: false }, false, preserveHeadlessTarget);
+	return true;
+}
 
 export async function releaseTab(name: string, opts: ReleaseTabOptions = {}): Promise<boolean> {
 	const tab = tabs.get(name);
@@ -351,9 +552,19 @@ export async function releaseTab(name: string, opts: ReleaseTabOptions = {}): Pr
 		logger.debug("releaseTab: already releasing", { name });
 		return false;
 	}
-	const wasAlive = tab.state === "alive";
+	await releaseClaimedTab(tab, opts, tab.state === "alive");
+	return true;
+}
+
+async function releaseClaimedTab(
+	tab: TabSession,
+	opts: ReleaseTabOptions,
+	wasAlive: boolean,
+	preserveHeadlessTarget = false,
+): Promise<void> {
 	tab.state = "dead";
-	const closeError = new ToolError(`Tab ${JSON.stringify(name)} was closed`);
+	discardDeadTabRecovery(tab.name);
+	const closeError = new ToolError(`Tab ${JSON.stringify(tab.name)} was closed`);
 	for (const [id, pending] of tab.pending) {
 		try {
 			tab.worker.send({ type: "abort", id });
@@ -371,19 +582,29 @@ export async function releaseTab(name: string, opts: ReleaseTabOptions = {}): Pr
 			forced = true;
 		}
 	}
-	await awaitWithinBudget(tab.worker.terminate(), remainingBudget(deadlineAt), "worker.terminate");
-	if (forced && tab.kindTag === "headless") {
-		await awaitWithinBudget(closeOrphanTarget(tab), remainingBudget(deadlineAt), "closeOrphanTarget");
+	try {
+		await awaitWithinBudget(
+			Promise.resolve().then(() => tab.worker.terminate()),
+			remainingBudget(deadlineAt),
+			"worker.terminate",
+		);
+		if (!preserveHeadlessTarget && (forced || !wasAlive) && tab.kindTag === "headless") {
+			await awaitWithinBudget(
+				Promise.resolve().then(() => closeOrphanTarget(tab)),
+				remainingBudget(deadlineAt),
+				"closeOrphanTarget",
+			);
+		}
+	} finally {
+		await awaitWithinBudget(
+			Promise.resolve().then(() => releaseBrowser(tab.browser, { kill: opts.kill ?? false })),
+			remainingBudget(deadlineAt),
+			"releaseBrowser",
+		);
+		// Only delete if the map still holds THIS tab: a same-name reacquire during our async
+		// teardown may have installed a fresh tab that we must not evict.
+		if (tabs.get(tab.name) === tab) tabs.delete(tab.name);
 	}
-	await awaitWithinBudget(
-		releaseBrowser(tab.browser, { kill: opts.kill ?? false }),
-		remainingBudget(deadlineAt),
-		"releaseBrowser",
-	);
-	// Only delete if the map still holds THIS tab: a same-name reacquire during our async
-	// teardown may have installed a fresh tab that we must not evict.
-	if (tabs.get(name) === tab) tabs.delete(name);
-	return true;
 }
 
 export async function releaseAllTabs(opts: ReleaseTabOptions = {}): Promise<number> {
@@ -404,14 +625,20 @@ export async function releaseTabsForOwner(
 	opts: ReleaseTabOptions = {},
 ): Promise<number> {
 	if (!ownerId) return 0;
-	const names = [...tabs.entries()].filter(([, tab]) => tab.ownerId === ownerId).map(([name]) => name);
+	const ownedTabs = [...tabs.values()].filter(tab => tab.ownerId === ownerId);
 	let count = 0;
-	for (const name of names) {
-		if (await releaseTab(name, opts)) count++;
+	for (const tab of ownedTabs) {
+		if (await releaseOwnedTab(tab, ownerId, opts)) count++;
 	}
 	return count;
 }
 
+async function releaseOwnedTab(expected: TabSession, ownerId: string, opts: ReleaseTabOptions): Promise<boolean> {
+	if (tabs.get(expected.name) !== expected || expected.ownerId !== ownerId || !beginRelease(expected)) return false;
+	await releaseClaimedTab(expected, opts, expected.state === "alive");
+	return true;
+}
+
 export async function dropHeadlessTabs(): Promise<void> {
 	const names = [...tabs.values()].filter(tab => tab.kindTag === "headless").map(tab => tab.name);
 	for (const name of names) await releaseTab(name);
@@ -421,6 +648,15 @@ async function buildInitPayload(browser: BrowserHandle, opts: AcquireTabOptions)
 	const safeDir = getPuppeteerDir();
 	const browserWSEndpoint = browser.browser.wsEndpoint();
 	if (!browserWSEndpoint) throw new ToolError("Browser websocket endpoint is unavailable");
+	if (opts.recoveryTargetId) {
+		return {
+			mode: "attach",
+			browserWSEndpoint,
+			safeDir,
+			targetId: opts.recoveryTargetId,
+			dialogs: opts.dialogs,
+		};
+	}
 	if (browser.kind.kind === "headless") {
 		return {
 			mode: "headless",
@@ -444,6 +680,12 @@ async function buildInitPayload(browser: BrowserHandle, opts: AcquireTabOptions)
 		dialogs: opts.dialogs,
 	};
 }
+export async function buildInitPayloadForTest(
+	browser: BrowserHandle,
+	opts: AcquireTabOptions,
+): Promise<WorkerInitPayload> {
+	return await buildInitPayload(browser, opts);
+}
 
 function handleTabMessage(tab: TabSession, msg: WorkerOutbound): void {
 	if (msg.type === "result") {
@@ -531,13 +773,17 @@ async function forceKillTab(name: string, reason: string): Promise<void> {
 	if (!tab) return;
 	if (!beginRelease(tab)) return;
 	tab.state = "dead";
+	discardDeadTabRecovery(name);
 	const error = new ToolError(reason);
 	for (const pending of tab.pending.values()) pending.reject(error);
 	tab.pending.clear();
-	await tab.worker.terminate().catch(() => undefined);
-	if (tab.kindTag === "headless") await closeOrphanTarget(tab);
-	await releaseBrowser(tab.browser, { kill: false });
-	if (tabs.get(name) === tab) tabs.delete(name);
+	try {
+		await tab.worker.terminate().catch(() => undefined);
+		if (tab.kindTag === "headless") await closeOrphanTarget(tab).catch(() => undefined);
+	} finally {
+		await releaseBrowser(tab.browser, { kill: false }).catch(() => undefined);
+		if (tabs.get(name) === tab) tabs.delete(name);
+	}
 }
 
 async function closeOrphanTarget(tab: TabSession): Promise<void> {

package/src/tools/computer.ts

@@ -6,7 +6,7 @@ import type { ImageContent } from "@gajae-code/ai";
 import { prompt } from "@gajae-code/utils";
 import * as z from "zod/v4";
 import computerDescription from "../prompts/tools/computer.md" with { type: "text" };
-import { resizeImage } from "../utils/image-resize";
+import { formatDimensionNote, resizeImage } from "../utils/image-resize";
 import { markScreenshotFallbackDirCreatedForGc } from "./computer-gc";
 import type { ToolSession } from "./index";
 import type { OutputMeta } from "./output-meta";
@@ -701,11 +701,16 @@ async function inlineImageContentFromNativeResult(
 	details: ComputerToolDetails,
 	session: ToolSession,
 ): Promise<ImageContent | undefined> {
+	// Anthropic rejects requests carrying more than 20 images when any image
+	// exceeds 2000px per dimension ("many-image requests"), so gating on bytes
+	// alone is not enough: an in-budget full-resolution capture can still brick
+	// the session once enough screenshots accumulate in history. Always route
+	// through resizeImage (its fast path returns already-small images
+	// untouched) and tell the model how to map coordinates back to the native
+	// screenshot frame when the inline image was scaled.
 	const image = fullResolutionImageContentFromNativeResult(value);
 	if (!image) return undefined;
 	const maxBytes = getInlineScreenshotMaxBytes(session);
-	const originalBytes = Buffer.byteLength(image.data, "base64");
-	if (originalBytes <= maxBytes) return image;
 
 	try {
 		const resized = await resizeImage(image, {
@@ -715,6 +720,8 @@ async function inlineImageContentFromNativeResult(
 			jpegQuality: COMPUTER_INLINE_SCREENSHOT_JPEG_QUALITY,
 		});
 		if (resized.buffer.length <= maxBytes) {
+			const note = formatDimensionNote(resized);
+			if (note) details.message = `${details.message} ${note}`;
 			return { type: "image", data: resized.data, mimeType: resized.mimeType };
 		}
 	} catch {

package/src/tools/cron.ts

@@ -58,6 +58,8 @@ export interface CronJobSnapshot {
 	createdAt: number;
 	expiresAt?: number;
 	nextFireAt?: number;
+	/** True while this owner-scoped schedule's delivery is in progress. */
+	firing?: boolean;
 	humanSchedule: string;
 	ownerId?: string;
 }
@@ -444,7 +446,7 @@ function formatCronFireContent(snapshot: CronJobSnapshot): string {
 	return `<task-notification>\nScheduled task ${snapshot.id} fired (${snapshot.humanSchedule}).\n\n${snapshot.prompt}\n</task-notification>`;
 }
 
-function deliverCronFire(record: CronScheduleRecord): void {
+function deliverCronFire(record: CronScheduleRecord): Promise<void> | undefined {
 	const content = formatCronFireContent(record.snapshot);
 	const details = {
 		id: record.snapshot.id,
@@ -455,16 +457,9 @@ function deliverCronFire(record: CronScheduleRecord): void {
 		{ customType: "cron-fire", content, display: false, attribution: "agent", details },
 		{ triggerTurn: true, deliverAs: "followUp" },
 	);
-	if (sendPromise) {
-		void sendPromise.catch(error => {
-			logger.warn("Cron fire delivery failed", {
-				id: record.snapshot.id,
-				error: error instanceof Error ? error.message : String(error),
-			});
-		});
-		return;
-	}
+	if (sendPromise) return sendPromise;
 	record.session.steer?.({ customType: "cron-fire", content, details });
+	return undefined;
 }
 
 function scheduleRecord(ownerId: string | undefined, state: OwnerScheduleState, record: CronScheduleRecord): void {
@@ -509,16 +504,35 @@ function fireRecord(ownerId: string | undefined, state: OwnerScheduleState, id:
 		deleteRecord(ownerId, id);
 		return;
 	}
+	record.snapshot.firing = true;
+	notifyCronChange();
+	const settle = () => {
+		if (record.disposed) return;
+		record.snapshot.firing = false;
+		notifyCronChange();
+		if (!record.snapshot.recurring) {
+			deleteRecord(ownerId, id);
+			return;
+		}
+		scheduleRecord(ownerId, state, record);
+	};
 	try {
-		deliverCronFire(record);
+		const delivery = deliverCronFire(record);
+		if (delivery) {
+			void delivery.then(settle, error => {
+				logger.warn("Cron fire delivery failed", {
+					id,
+					error: error instanceof Error ? error.message : String(error),
+				});
+				settle();
+			});
+		} else {
+			settle();
+		}
 	} catch (error) {
 		logger.warn("Cron fire delivery failed", { id, error: error instanceof Error ? error.message : String(error) });
+		settle();
 	}
-	if (!record.snapshot.recurring) {
-		deleteRecord(ownerId, id);
-		return;
-	}
-	scheduleRecord(ownerId, state, record);
 }
 
 const CRON_ID_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";

package/src/tools/eval.ts

@@ -183,8 +183,7 @@ function timeoutSecondsFromMs(timeoutMs: number): number {
 }
 
 async function resolveBackend(session: ToolSession, language: EvalLanguage): Promise<ResolvedBackend> {
-	const allowPy = (session.settings.get("eval.py") as boolean | undefined) ?? true;
-	const allowJs = (session.settings.get("eval.js") as boolean | undefined) ?? true;
+	const { python: allowPy, js: allowJs } = resolveEvalBackends(session);
 
 	if (language === "python") {
 		if (!allowPy) throw new ToolError("Python backend is disabled (eval.py = false).");

package/src/tools/fetch.ts

@@ -1292,20 +1292,20 @@ async function materializeReadUrlCacheEntry(
 	session: ToolSession,
 	entry: ReadUrlCacheEntry,
 ): Promise<ReadUrlCacheEntry | null> {
+	if (entry.output.length > 0) return entry;
 	if (entry.artifactId) {
 		const artifactOutput = await readArtifactOutput(session, entry.artifactId);
 		if (artifactOutput !== null) {
 			return { ...entry, output: artifactOutput };
 		}
 	}
-
-	return entry.output.length > 0 ? entry : null;
+	return null;
 }
 
 async function persistReadUrlArtifact(session: ToolSession, output: string): Promise<string | undefined> {
 	const { path: artifactPath, id } = (await session.allocateOutputArtifact?.("read")) ?? {};
 	if (!artifactPath) return undefined;
-	await Bun.write(artifactPath, output);
+	await Bun.write(artifactPath, wrapUntrustedContent(output));
 	return id;
 }
 
@@ -1379,6 +1379,13 @@ export async function loadReadUrlCacheEntry(
 	return fresh;
 }
 
+const UNTRUSTED_CONTENT_OPEN = "<untrusted-content>";
+const UNTRUSTED_CONTENT_CLOSE = "</untrusted-content>";
+
+export function wrapUntrustedContent(content: string): string {
+	return `${UNTRUSTED_CONTENT_OPEN}\n${content.replace(/<\/untrusted-content>/gi, "&lt;/untrusted-content>")}\n${UNTRUSTED_CONTENT_CLOSE}`;
+}
+
 function buildUrlReadOutput(result: FetchRenderResult, content: string): string {
 	let output = "";
 	output += `URL: ${result.finalUrl}\n`;
@@ -1413,7 +1420,7 @@ export async function executeReadUrl(
 		truncated: Boolean(cacheEntry.details.truncated || needsArtifact),
 	};
 
-	const contentBlocks: Array<TextContent | ImageContent> = [{ type: "text", text: output }];
+	const contentBlocks: Array<TextContent | ImageContent> = [{ type: "text", text: wrapUntrustedContent(output) }];
 	if (cacheEntry.image) {
 		contentBlocks.push({ type: "image", data: cacheEntry.image.data, mimeType: cacheEntry.image.mimeType });
 	}