@inflexa-ai/harness 0.22.0 → 0.23.0

package/dist/agents/report-session-agent.d.ts

@@ -38,7 +38,7 @@ import type { ThreadStore } from "../memory/thread-store.js";
 import type { ReferenceResolver } from "../report-model/reference-resolver.js";
 import type { ReportVersionStore } from "../state/report-versions.js";
 import type { ReportSessionStateGateway } from "../tools/report-authoring/authoring-tools.js";
-import { type ResolvePageAsset, type ResolvePageUrl, type SessionPagePublisher } from "../tools/report-session/index.js";
+import { type MakeSessionPagePublisher, type ResolvePageAsset, type ResolvePageUrl } from "../tools/report-session/index.js";
 /** Canonical agent id -- distinct from the id of the old templating agent. */
 export declare const REPORT_SESSION_AGENT_ID: "report-session";
 /**
@@ -99,15 +99,18 @@ export interface ReportSessionAgentDeps {
      */
     readonly resolvePageAsset?: ResolvePageAsset;
     /**
-     * Session-page publisher -- the hosted view of the rendered page. Bound, the preview
-     * tool mints one grant after the page lands and attaches the URL beside the path.
-     * Omitted, the result carries the page path alone.
+     * Session-page publisher factory -- the hosted view of the rendered page. The factory
+     * binds one analysis and the auth of the call, like `makeResolver`, thus the mint runs
+     * under the credential of the caller. Bound, the preview tool builds the publisher over
+     * the scope of the call, mints one grant after the page lands, and attaches the URL
+     * beside the path. Omitted, the result carries the page path alone.
      */
-    readonly sessionPages?: SessionPagePublisher;
+    readonly makeSessionPages?: MakeSessionPagePublisher;
     /**
      * Page-URL formation of the eyes -- the URL that one look opens. A composition whose
-     * browser cannot reach the workspace tree binds a resolver that names a served URL.
-     * Omitted, the eyes tool navigates through a `file://` URL of the page path.
+     * browser cannot reach the workspace tree binds a resolver that names a served URL, and
+     * the args carry the auth of the tool call beside the page identity. Omitted, the eyes
+     * tool navigates through a `file://` URL of the page path.
      */
     readonly resolvePageUrl?: ResolvePageUrl;
     /** Operational logging seam; omitted falls back to no-op. */

package/dist/agents/report-session-agent.js

@@ -39,7 +39,7 @@ const REPORT_SESSION_MAX_ITERATIONS = 75;
 /** Build the report `AgentDefinition` with every tool bound to its deps. */
 export function createReportSessionAgent(deps) {
     const { model, pool, embedding, workspaceFs, gateway, resolveWorkspaceRoot, store, threads, chrome, eyes, makeResolver, resolvePageAsset, logger } = deps;
-    const { derivations, sandboxClient, runAuthorizer, sessionPages, resolvePageUrl } = deps;
+    const { derivations, sandboxClient, runAuthorizer, makeSessionPages, resolvePageUrl } = deps;
     const authoring = createReportAuthoringTools(gateway);
     const tools = [
         // The read surface toward the analysis. It roams the tree read-only.
@@ -83,7 +83,7 @@ export function createReportSessionAgent(deps) {
             resolveWorkspaceRoot,
             ...(makeResolver ? { makeResolver } : {}),
             ...(resolvePageAsset ? { resolvePageAsset } : {}),
-            ...(sessionPages ? { sessionPages } : {}),
+            ...(makeSessionPages ? { makeSessionPages } : {}),
             ...(logger ? { logger } : {}),
         }),
         // The eyes tool. It opens the rendered page in headless Chrome.

package/dist/app/chat-turn.js

@@ -75,6 +75,7 @@ export async function prepareChatTurn(deps, params) {
         runActivityContext,
         history,
         workingMemory: createWorkingMemory(pool),
+        ...(deps.logger ? { logger: deps.logger } : {}),
     });
     return { kind: "ok", threadType, messages, userMessage };
 }

package/dist/app/message-assembly.d.ts

@@ -35,6 +35,7 @@
  * thread store.
  */
 import type { ModelMessage } from "ai";
+import type { Logger } from "../lib/logger.js";
 import type { LoopMessage } from "../loop/types.js";
 import type { ThreadHistory } from "../memory/thread-history.js";
 import type { ThreadType } from "../memory/thread-store.js";
@@ -64,6 +65,8 @@ export interface AssembleMessagesArgs {
     readonly workingMemory: WorkingMemoryStore;
     /** History-window token budget. Defaults to {@link DEFAULT_HISTORY_TOKEN_BUDGET}. */
     readonly tokenBudget?: number;
+    /** Diagnostic seam for the history repair record; omitted falls back to no-op. */
+    readonly logger?: Logger;
 }
 export interface AssembledMessages {
     /** The full message array for `runAgent`. */

package/dist/app/message-assembly.js

@@ -34,7 +34,9 @@
  * tail injections (ephemeral, re-derived each turn) are never written to the
  * thread store.
  */
+import { createNoopLogger } from "../lib/console-logger.js";
 import { unwrapOrThrow } from "../lib/result.js";
+import { stripUnansweredToolCalls } from "../memory/tool-call-integrity.js";
 import { normalizeUnicode, redactSecrets } from "../input-sanitization.js";
 /**
  * Token budget for the `loadRecent` history window. Sized to leave headroom
@@ -49,6 +51,21 @@ export const DEFAULT_HISTORY_TOKEN_BUDGET = 120_000;
 export async function assembleMessages(args) {
     const budget = args.tokenBudget ?? DEFAULT_HISTORY_TOKEN_BUDGET;
     const history = unwrapOrThrow(await args.history.loadRecent(args.threadId, budget, { keepFirstTurn: args.threadType === "report" }));
+    // Read-side safety net for the wire contract: every tool call carries a
+    // result. The loop upholds it at every exit, but the store outlives any one
+    // writer — a row an older build wrote, or a hand-edited database, can carry
+    // an unanswered call, and the provider boundary then refuses the WHOLE
+    // transcript on every turn: the thread is wedged forever. Stripping the
+    // orphan here degrades one message instead. The warning is the only account
+    // a reader gets that the stored thread and the assembled one differ.
+    const repaired = stripUnansweredToolCalls(history);
+    if (repaired.length > 0) {
+        (args.logger ?? createNoopLogger()).named("assembly").warn("unanswered tool calls stripped from thread history", {
+            threadId: args.threadId,
+            toolCallIds: repaired.map((d) => d.toolCallId),
+            tools: repaired.map((d) => d.toolName),
+        });
+    }
     // Sanitization — applied once, here, to the new user input only.
     const userMessage = {
         role: "user",

package/dist/contracts/chat-parts.d.ts

@@ -359,4 +359,20 @@ export interface DataPreviewFailedPart {
     /** Optional taxonomy of failure kinds. */
     errorKind?: "render" | "submit" | "build" | "timeout" | "internal";
 }
-export type CortexChatPart = PresentationPart | PlanPart | RunCardPart | FileReferencePart | AskPart | RunStartedPart | DagStatePart | StepActivityPart | StepFileTreePart | StepOutputPart | StepSummaryPart | StepUsagePart | StepBlockedPart | RunSynthesisPart | SynthesisProgressPart | RunCompletedPart | RunFailedPart | PreviewPart | DataPreviewFailedPart;
+/**
+ * The record that a turn started a report session. It rides the chat stream
+ * live, and it persists into the turn at the position of the spawn.
+ *
+ * The part is a placement record and a freshness signal only. The thread
+ * store is the authority for the session: its existence, its title, and its
+ * archived state. When the thread of the part is archived or absent, a
+ * consumer renders nothing for it.
+ */
+export interface ReportSessionStartedPart {
+    type: "data-report-session-started";
+    /** The id of the report thread that the spawn made. */
+    threadId: string;
+    /** The id of the conversation thread that spawned it. */
+    parentThreadId: string;
+}
+export type CortexChatPart = PresentationPart | PlanPart | RunCardPart | FileReferencePart | AskPart | RunStartedPart | DagStatePart | StepActivityPart | StepFileTreePart | StepOutputPart | StepSummaryPart | StepUsagePart | StepBlockedPart | RunSynthesisPart | SynthesisProgressPart | RunCompletedPart | RunFailedPart | PreviewPart | DataPreviewFailedPart | ReportSessionStartedPart;

package/dist/contracts/index.d.ts

@@ -2,7 +2,7 @@ export { ORGAN_SYSTEMS, OrganSystemSchema, ORGAN_SYSTEM_LABELS, organSystemLabel
 export type { OrganSystem } from "./organ-system.js";
 export { SEVERITIES, SeveritySchema } from "./severity.js";
 export type { Severity } from "./severity.js";
-export type { PlanStep, PresentationContent, PresentationPart, PlanPart, RunCardPart, FileReferenceEntry, FileReferencePart, AskPart, RunStartedPart, StepStatus, DagStepState, DagStatePart, StepPhase, StepActivityPart, FileTreeEntry, StepFileTreePart, StepOutputFile, StepOutputPart, StepSummaryPart, StepUsagePart, StepBlockedPart, SynthesizedFinding, BiologicalTheme, RunSynthesisPart, SynthesisPhase, SynthesisProgressPart, RunCompletedFinding, RunCompletedPart, RunFailedPart, PreviewPart, DataPreviewFailedPart, CortexChatPart, } from "./chat-parts.js";
+export type { PlanStep, PresentationContent, PresentationPart, PlanPart, RunCardPart, FileReferenceEntry, FileReferencePart, AskPart, RunStartedPart, StepStatus, DagStepState, DagStatePart, StepPhase, StepActivityPart, FileTreeEntry, StepFileTreePart, StepOutputFile, StepOutputPart, StepSummaryPart, StepUsagePart, StepBlockedPart, SynthesizedFinding, BiologicalTheme, RunSynthesisPart, SynthesisPhase, SynthesisProgressPart, RunCompletedFinding, RunCompletedPart, RunFailedPart, PreviewPart, DataPreviewFailedPart, ReportSessionStartedPart, CortexChatPart, } from "./chat-parts.js";
 export type { EventSource, TextDeltaEvent, ToolStartedEvent, ToolFinishedEvent, FinishEvent, ChatErrorEvent, CortexChatEvent } from "./chat-events.js";
 export type { TokenUsageRollup } from "./usage.js";
 export { DATA_PROFILE_RUN_LITERAL } from "./data-profile.js";

package/dist/contracts/part-registry.js

@@ -18,6 +18,7 @@ export const PART_REGISTRY = {
     "data-run-failed": { emitter: "workflow", consumer: "sidebar", transient: false, reconciling: false },
     "data-report-preview": { emitter: "conversation", consumer: "conversation", transient: false, reconciling: false },
     "data-report-preview-failed": { emitter: "conversation", consumer: "conversation", transient: false, reconciling: false },
+    "data-report-session-started": { emitter: "conversation", consumer: "conversation", transient: false, reconciling: false },
 };
 export function isTransient(type) {
     return PART_REGISTRY[type].transient;

package/dist/contracts/schemas/chat-parts.d.ts

@@ -467,6 +467,11 @@ export declare const DataPreviewFailedPartSchema: z.ZodObject<{
         internal: "internal";
     }>>;
 }, z.core.$strip>;
+export declare const ReportSessionStartedPartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"data-report-session-started">;
+    threadId: z.ZodString;
+    parentThreadId: z.ZodString;
+}, z.core.$strip>;
 export declare const CortexChatPartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"data-presentation">;
     id: z.ZodString;
@@ -763,4 +768,8 @@ export declare const CortexChatPartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<
         build: "build";
         internal: "internal";
     }>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"data-report-session-started">;
+    threadId: z.ZodString;
+    parentThreadId: z.ZodString;
 }, z.core.$strip>], "type">;

package/dist/contracts/schemas/chat-parts.js

@@ -294,6 +294,12 @@ export const DataPreviewFailedPartSchema = z.object({
     reason: z.string(),
     errorKind: z.enum(["render", "submit", "build", "timeout", "internal"]).optional(),
 });
+// ── Report Session Started ─────────────────────────────────────────
+export const ReportSessionStartedPartSchema = z.object({
+    type: z.literal("data-report-session-started"),
+    threadId: z.string(),
+    parentThreadId: z.string(),
+});
 // ── Union ───────────────────────────────────────────────────────────
 export const CortexChatPartSchema = z.discriminatedUnion("type", [
     PresentationPartSchema,
@@ -315,4 +321,5 @@ export const CortexChatPartSchema = z.discriminatedUnion("type", [
     RunFailedPartSchema,
     PreviewPartSchema,
     DataPreviewFailedPartSchema,
+    ReportSessionStartedPartSchema,
 ]);

package/dist/index.d.ts

@@ -36,7 +36,7 @@ export type { ProvenanceCollector } from "./provenance/collector.js";
 export { UnavailablePreviewPublisher } from "./tools/report/preview-publisher.js";
 export type { PreviewPublisher, PreviewMintResult } from "./tools/report/preview-publisher.js";
 export { UnavailableSessionPagePublisher } from "./tools/report-session/session-page-publisher.js";
-export type { SessionPagePublisher, SessionPageMintResult } from "./tools/report-session/session-page-publisher.js";
+export type { MakeSessionPagePublisher, SessionPagePublisher, SessionPageMintResult } from "./tools/report-session/session-page-publisher.js";
 export type { ResolvePageUrl, SessionPageAccess } from "./tools/report-session/index.js";
 export { createDbosRunLauncher } from "./execution/dbos-run-launcher.js";
 export type { RunLauncher, LaunchOptions } from "./execution/run-launcher.js";

package/dist/index.js

@@ -44,8 +44,10 @@ export { createNoopArtifactRegistry } from "./execution/noop-artifact-registry.j
 export { UnavailablePreviewPublisher } from "./tools/report/preview-publisher.js";
 // Seam: the hosted view of a report-session page. A managed host serves the URL space
 // `report-sessions/{analysisId}/{threadId}` and mints access through its own publisher,
-// thus the seam belongs on the front door. The URL seam of the eyes rides beside it: a
-// host whose browser cannot reach the workspace tree binds a served URL for the look.
+// thus the seam belongs on the front door. Both seams bind per call over the auth of the
+// tool call, thus a host mints under the credential of the caller and holds no ambient
+// state. The URL seam of the eyes rides beside the publisher factory: a host whose
+// browser cannot reach the workspace tree binds a served URL for the look.
 export { UnavailableSessionPagePublisher } from "./tools/report-session/session-page-publisher.js";
 // Run launching.
 export { createDbosRunLauncher } from "./execution/dbos-run-launcher.js";

package/dist/loop/run-agent.js

@@ -5,6 +5,7 @@ import { stripNulCharacters } from "../input-sanitization.js";
 import { createNoopLogger } from "../lib/console-logger.js";
 import { hintForZodIssue, repairToolInput } from "../lib/zod-issues.js";
 import { markInterruptedMessage, syntheticUserMessage } from "../memory/ai-sdk-message-storage.js";
+import { stripUnansweredToolCalls } from "../memory/tool-call-integrity.js";
 import { classifyProviderError } from "../providers/errors.js";
 import { DEFAULT_PROMPT_CACHE, promptCacheProviderOptions } from "../providers/prompt-cache.js";
 import { resultStep } from "./run-step.js";
@@ -91,6 +92,28 @@ export async function runAgent(agent, initial, session, opts) {
     const logFinish = (level, reason, cappedOut) => {
         log[level]("run finished", { iterations, reason, cappedOut, truncationRecoveries, toolCalls: toolCallCount, toolErrors: toolErrorCount, usage });
     };
+    /**
+     * Settle the transcript on the way out — called at every return. A reply can
+     * carry a complete tool call beside ANY finish reason, because the call
+     * streams before the stop reason arrives, and only the dispatching branches
+     * (`tool-calls`, a call-carrying `stop`, and `length`) run one. A call this
+     * run never dispatched is stripped
+     * rather than executed (a filtered or aborted reply must not act) or answered
+     * with an invented result (the model would read a fabrication as ground
+     * truth). Without the strip, the unanswered call violates the wire contract —
+     * every tool call carries a result — and the provider boundary then refuses
+     * the whole transcript on every later turn of the thread. Scoped past
+     * `initial`: the caller's prefix is not this run's to repair.
+     */
+    const settleTranscript = () => {
+        const droppedCalls = stripUnansweredToolCalls(messages, initial.length);
+        if (droppedCalls.length === 0)
+            return;
+        log.warn("undispatched tool calls stripped at run exit", {
+            toolCallIds: droppedCalls.map((d) => d.toolCallId),
+            tools: droppedCalls.map((d) => d.toolName),
+        });
+    };
     const usageRecorder = opts.usageRecorder ?? createNoopUsageRecorder();
     /**
      * Fold one completed call into both rollups and hand it to the recorder.
@@ -135,6 +158,7 @@ export async function runAgent(agent, initial, session, opts) {
     // lands in a dispatch round — after the concurrent siblings in that same round
     // have completed and been appended. Mirrors the clean-stop terminal path.
     const stopOnDenial = async (i) => {
+        settleTranscript();
         await emit({ type: "iteration", source, index: i, final: true });
         recordAgentRun({ agentId: agent.id, iterations, cappedOut: false, usage });
         logFinish("warn", "denied", false);
@@ -195,6 +219,7 @@ export async function runAgent(agent, initial, session, opts) {
         return errored;
     };
     const stopOnResolved = async (i) => {
+        settleTranscript();
         await emit({ type: "iteration", source, index: i, final: true });
         recordAgentRun({ agentId: agent.id, iterations, cappedOut: false, usage });
         return { messages, finish: { reason: "stop", cappedOut: false, truncationRecoveries } };
@@ -266,7 +291,19 @@ export async function runAgent(agent, initial, session, opts) {
                 return stopOnResolved(i);
             continue;
         }
-        if (reply.finishReason !== "tool-calls") {
+        // A local model behind an OpenAI-compatible server routinely labels a
+        // tool-calling reply `stop`. The calls are complete and the model waits
+        // on their results, thus the mislabeled round dispatches like a
+        // `tool-calls` one. Every other terminal keeps the strip: a filtered or
+        // aborted reply must not act.
+        const dispatchesRound = reply.finishReason === "tool-calls" || (reply.finishReason === "stop" && toolCalls.length > 0);
+        if (!dispatchesRound) {
+            settleTranscript();
+            // The settle can remove a call-only aborted partial whole; the
+            // interruption marker then rides the last assistant that survived,
+            // matching the no-output abort contract above.
+            if (reply.finishReason === "aborted")
+                markLastLoopAssistant(messages, initial.length);
             await emit({ type: "iteration", source, index: i, final: true });
             recordAgentRun({ agentId: agent.id, iterations, cappedOut: false, usage });
             logFinish("info", reply.finishReason, false);
@@ -307,6 +344,7 @@ export async function runAgent(agent, initial, session, opts) {
         // exhausted its iterations, while the reason carries the abort.
         if (assistantHasContent(wrapUp.message))
             messages.push(wrapUp.message);
+        settleTranscript();
         markLastLoopAssistant(messages, initial.length);
         await emit({ type: "iteration", source, index: agent.maxIterations, final: true });
         recordAgentRun({ agentId: agent.id, iterations, cappedOut: true, usage });
@@ -314,6 +352,7 @@ export async function runAgent(agent, initial, session, opts) {
         return { messages, finish: { reason: "aborted", cappedOut: true, truncationRecoveries, ...finishUsage() } };
     }
     messages.push(wrapUp.message);
+    settleTranscript();
     await emit({ type: "iteration", source, index: agent.maxIterations, final: true });
     recordAgentRun({ agentId: agent.id, iterations, cappedOut: true, usage });
     logFinish("warn", "max_iterations", true);

package/dist/memory/conversation-display-storage.d.ts

@@ -15,7 +15,7 @@
  * reconstruction.
  */
 import { type DataUIPart, type UIMessage } from "ai";
-import type { AskPart, FileReferencePart, PlanPart, PresentationPart, PreviewPart, DataPreviewFailedPart, RunCardPart } from "../contracts/chat-parts.js";
+import type { AskPart, FileReferencePart, PlanPart, PresentationPart, PreviewPart, DataPreviewFailedPart, ReportSessionStartedPart, RunCardPart } from "../contracts/chat-parts.js";
 import type { ToolCallOutcome } from "../contracts/chat-events.js";
 import type { CortexMessage, CortexPart, ToolCallPart } from "../contracts/message.js";
 export declare const SUPPORTED_DISPLAY_SCHEMA_VERSION = 1;
@@ -40,6 +40,7 @@ export type ConversationUIData = {
     ask: Payload<AskPart>;
     "report-preview": Payload<PreviewPart>;
     "report-preview-failed": Payload<DataPreviewFailedPart>;
+    "report-session-started": Payload<ReportSessionStartedPart>;
 };
 export interface ConversationDisplayMetadata {
     interrupted?: boolean;

package/dist/memory/conversation-display-storage.js

@@ -16,7 +16,7 @@
  */
 import { validateUIMessages } from "ai";
 import { z } from "zod";
-import { AskPartSchema, DataPreviewFailedPartSchema, FileReferencePartSchema, PlanPartSchema, PresentationPartSchema, PreviewPartSchema, RunCardPartSchema, } from "../contracts/schemas/chat-parts.js";
+import { AskPartSchema, DataPreviewFailedPartSchema, FileReferencePartSchema, PlanPartSchema, PresentationPartSchema, PreviewPartSchema, ReportSessionStartedPartSchema, RunCardPartSchema, } from "../contracts/schemas/chat-parts.js";
 import { ToolCallOutcomeSchema } from "../contracts/schemas/chat-events.js";
 export const SUPPORTED_DISPLAY_SCHEMA_VERSION = 1;
 const DisplayEnvelopeHeaderSchema = z.object({
@@ -56,6 +56,7 @@ const dataSchemas = {
     ask: AskPartSchema.omit({ type: true }).strict(),
     "report-preview": PreviewPartSchema.omit({ type: true }).strict(),
     "report-preview-failed": DataPreviewFailedPartSchema.omit({ type: true }).strict(),
+    "report-session-started": ReportSessionStartedPartSchema.omit({ type: true }).strict(),
 };
 export function envelopeDisplayMessages(messages) {
     if (messages.length === 0)

package/dist/memory/tool-call-integrity.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Transcript integrity for tool calls.
+ *
+ * The wire contract of every provider is that each tool call in an assistant
+ * message has a matching tool result. A transcript that violates it is refused
+ * WHOLE — the AI SDK throws at prompt conversion, and the Anthropic API answers
+ * 400 — so a single unanswered call makes a thread unable to take any further
+ * turn. An unanswered call is a reachable state, not a hypothetical: a reply
+ * can carry a complete tool call beside ANY finish reason, because the call
+ * streams before the stop reason arrives, and only a `tool-calls` (and, for its
+ * leading calls, a `length`) finish dispatches it.
+ *
+ * The repair is a STRIP, never an invented result. A call that was not
+ * dispatched did not happen, and a fabricated result would record an execution
+ * that did not occur — the model would read it as ground truth on the next
+ * turn. The prose of the message survives the strip; a message left with
+ * nothing the wire can render disappears entirely.
+ */
+import type { ModelMessage } from "ai";
+/** One tool call removed by {@link stripUnansweredToolCalls}, identified for the caller's diagnostic record. */
+export interface DroppedToolCall {
+    readonly toolCallId: string;
+    readonly toolName: string;
+}
+/**
+ * Remove, in place, every tool-call part at or past `fromIndex` that has no
+ * matching tool result anywhere in `messages`. Returns the removed calls in
+ * transcript order — empty on the healthy path — so the caller can log what
+ * a reader of the stored thread would otherwise never learn.
+ *
+ * Results are matched by id across the whole array, not by adjacency: the loop
+ * appends a round's results directly after its assistant message, but a
+ * deferred-image user message can ride between rounds, and the stored shape is
+ * not this function's to assume.
+ *
+ * A message that keeps a text or file part survives the strip — refusal prose
+ * is the one account the reader has of a filtered reply. A message left with
+ * no such part (a call-only message, or reasoning beside the removed call) is
+ * removed whole: reasoning without the output it preceded is not replayable,
+ * and an empty assistant message is itself a wire violation.
+ *
+ * `fromIndex` bounds the REPAIR, not the result scan. The loop passes its
+ * `initial.length` so it never rewrites the caller's prefix; the assembly
+ * repair passes nothing and covers the whole stored window.
+ */
+export declare function stripUnansweredToolCalls(messages: ModelMessage[], fromIndex?: number): DroppedToolCall[];

package/dist/memory/tool-call-integrity.js

@@ -0,0 +1,92 @@
+/**
+ * Transcript integrity for tool calls.
+ *
+ * The wire contract of every provider is that each tool call in an assistant
+ * message has a matching tool result. A transcript that violates it is refused
+ * WHOLE — the AI SDK throws at prompt conversion, and the Anthropic API answers
+ * 400 — so a single unanswered call makes a thread unable to take any further
+ * turn. An unanswered call is a reachable state, not a hypothetical: a reply
+ * can carry a complete tool call beside ANY finish reason, because the call
+ * streams before the stop reason arrives, and only a `tool-calls` (and, for its
+ * leading calls, a `length`) finish dispatches it.
+ *
+ * The repair is a STRIP, never an invented result. A call that was not
+ * dispatched did not happen, and a fabricated result would record an execution
+ * that did not occur — the model would read it as ground truth on the next
+ * turn. The prose of the message survives the strip; a message left with
+ * nothing the wire can render disappears entirely.
+ */
+/**
+ * Whether this tool call needs a client-supplied result. A provider-executed
+ * call is answered by the provider inside the same assistant message, so the
+ * wire contract makes no demand on the client for it — the AI SDK's own
+ * missing-result validation skips these, and so does the strip.
+ */
+function needsClientResult(part) {
+    return part.providerExecuted !== true;
+}
+/**
+ * Remove, in place, every tool-call part at or past `fromIndex` that has no
+ * matching tool result anywhere in `messages`. Returns the removed calls in
+ * transcript order — empty on the healthy path — so the caller can log what
+ * a reader of the stored thread would otherwise never learn.
+ *
+ * Results are matched by id across the whole array, not by adjacency: the loop
+ * appends a round's results directly after its assistant message, but a
+ * deferred-image user message can ride between rounds, and the stored shape is
+ * not this function's to assume.
+ *
+ * A message that keeps a text or file part survives the strip — refusal prose
+ * is the one account the reader has of a filtered reply. A message left with
+ * no such part (a call-only message, or reasoning beside the removed call) is
+ * removed whole: reasoning without the output it preceded is not replayable,
+ * and an empty assistant message is itself a wire violation.
+ *
+ * `fromIndex` bounds the REPAIR, not the result scan. The loop passes its
+ * `initial.length` so it never rewrites the caller's prefix; the assembly
+ * repair passes nothing and covers the whole stored window.
+ */
+export function stripUnansweredToolCalls(messages, fromIndex = 0) {
+    const resultIds = new Set();
+    for (const message of messages) {
+        if (message.role === "tool") {
+            for (const part of message.content) {
+                if (part.type === "tool-result")
+                    resultIds.add(part.toolCallId);
+            }
+        }
+        else if (message.role === "assistant" && typeof message.content !== "string") {
+            for (const part of message.content) {
+                if (part.type === "tool-result")
+                    resultIds.add(part.toolCallId);
+            }
+        }
+    }
+    const dropped = [];
+    // Backward, so a whole-message removal cannot shift an index this loop has
+    // yet to visit.
+    for (let idx = messages.length - 1; idx >= fromIndex; idx--) {
+        const message = messages[idx];
+        if (message.role !== "assistant" || typeof message.content === "string")
+            continue;
+        const removed = [];
+        for (const part of message.content) {
+            if (part.type === "tool-call" && needsClientResult(part) && !resultIds.has(part.toolCallId))
+                removed.push(part);
+        }
+        if (removed.length === 0)
+            continue;
+        // Prepended as a batch: the walk visits messages tail-first, but the
+        // caller's record reads in transcript order.
+        dropped.unshift(...removed.map((part) => ({ toolCallId: part.toolCallId, toolName: part.toolName })));
+        const removedParts = new Set(removed);
+        const kept = message.content.filter((part) => !removedParts.has(part));
+        if (kept.some((part) => part.type === "text" || part.type === "file" || part.type === "tool-call" || part.type === "tool-result")) {
+            messages[idx] = { ...message, content: kept };
+        }
+        else {
+            messages.splice(idx, 1);
+        }
+    }
+    return dropped;
+}

package/dist/runtime/assemble.d.ts

@@ -32,7 +32,7 @@ import { type CitationResolverConfig } from "../citations/resolve.js";
 import type { CitationResolver } from "../citations/types.js";
 import type { AuthContext } from "../auth/types.js";
 import type { ReferenceResolver } from "../report-model/reference-resolver.js";
-import type { ResolvePageAsset, ResolvePageUrl, SessionPagePublisher } from "../tools/report-session/index.js";
+import type { MakeSessionPagePublisher, ResolvePageAsset, ResolvePageUrl } from "../tools/report-session/index.js";
 /** Registered child sandbox-step callable the parent's child dispatch closes over. */
 export type SandboxStepCallable = (input: SandboxStepInput) => Promise<SandboxStepResult>;
 /**
@@ -134,15 +134,18 @@ export interface CoreRuntimeDeps {
     readonly resolveReportPageAsset?: ResolvePageAsset;
     /**
      * The hosted view of a report-session page. A managed host that serves the session URL
-     * space binds its publisher here, and the preview tool of the report agent then attaches
-     * the minted URL beside the page path. Absent, the tool attaches nothing and the page
-     * path stays the whole result, which is the whole local path.
+     * space binds its publisher factory here, and the preview tool of the report agent then
+     * attaches the minted URL beside the page path. The factory binds one analysis and the
+     * auth of the tool call, like `makeReportReferenceResolver`, thus a host that mints under
+     * the credential of the caller binds it with no ambient state. Absent, the tool attaches
+     * nothing and the page path stays the whole result, which is the whole local path.
      */
-    readonly sessionPagePublisher?: SessionPagePublisher;
+    readonly makeSessionPagePublisher?: MakeSessionPagePublisher;
     /**
      * The page-URL formation of the report-session eyes. A managed host whose browser cannot
-     * reach the workspace tree binds a resolver that names a served URL for the look. Absent,
-     * the eyes tool navigates through a `file://` URL of the page path.
+     * reach the workspace tree binds a resolver that names a served URL for the look, and the
+     * args carry the auth of the tool call beside the page identity. Absent, the eyes tool
+     * navigates through a `file://` URL of the page path.
      */
     readonly resolveReportPageUrl?: ResolvePageUrl;
     /**

package/dist/runtime/assemble.js

@@ -164,7 +164,7 @@ export function assembleCoreRuntime(deps) {
         makeResolver: makeReportResolver,
         ...(eyes ? { eyes } : {}),
         ...(deps.resolveReportPageAsset ? { resolvePageAsset: deps.resolveReportPageAsset } : {}),
-        ...(deps.sessionPagePublisher ? { sessionPages: deps.sessionPagePublisher } : {}),
+        ...(deps.makeSessionPagePublisher ? { makeSessionPages: deps.makeSessionPagePublisher } : {}),
         ...(deps.resolveReportPageUrl ? { resolvePageUrl: deps.resolveReportPageUrl } : {}),
         ...(conversation.logger ? { logger: conversation.logger } : {}),
     });

package/dist/tools/report-session/examine-page.d.ts

@@ -45,6 +45,7 @@
  * and no outcome would ever arrive.
  */
 import { z } from "zod";
+import type { AuthContext } from "../../auth/types.js";
 import { type ChromeConfig } from "../../lib/chrome.js";
 import { type AcquireEyes } from "../../lib/eyes.js";
 import { type Logger } from "../../lib/logger.js";
@@ -56,11 +57,14 @@ export type { CapturePage, FailedRequest, PageCapture };
 /**
  * The URL formation of one look. It maps the page of the thread onto the URL that the browser opens.
  * A composition whose browser cannot reach the workspace tree binds a resolver that names a served URL.
+ * The args carry the auth of the tool call beside the page identity, thus a realization mints the URL
+ * under the credential of the caller and holds no ambient state.
  */
 export type ResolvePageUrl = (args: {
     pagePath: string;
     analysisId: string;
     threadId: string;
+    auth: AuthContext;
 }) => Promise<string>;
 /** The empty input. The tool examines the current page of the thread, thus it needs no field. */
 declare const examinePageInput: z.ZodObject<{}, z.core.$strip>;

package/dist/tools/report-session/examine-page.js

@@ -276,7 +276,10 @@ export function createExaminePageTool(deps) {
             // becomes a typed outcome and the look never starts.
             let url;
             try {
-                url = deps.resolvePageUrl !== undefined ? await deps.resolvePageUrl({ pagePath, analysisId, threadId }) : pathToFileURL(pagePath).href;
+                url =
+                    deps.resolvePageUrl !== undefined
+                        ? await deps.resolvePageUrl({ pagePath, analysisId, threadId, auth: ctx.session.auth })
+                        : pathToFileURL(pagePath).href;
             }
             catch (cause) {
                 logger.warn("the page URL did not resolve", { threadId, analysisId, ...defaultErrorFields(cause) });

package/dist/tools/report-session/index.d.ts

@@ -7,7 +7,7 @@
  */
 export { createPreviewReportTool, type PreviewReportInput, type PreviewReportResult, type PreviewReportToolDeps, type ResolvePageAsset, type SessionPageAccess, } from "./preview-report.js";
 export { createExaminePageTool, type CapturePage, type ExaminePageInput, type ExaminePageResult, type ExaminePageToolDeps, type FailedRequest, type PageCapture, type ResolvePageUrl, } from "./examine-page.js";
-export { describeSessionPageMintFailure, UnavailableSessionPagePublisher, type SessionPageMintFailure, type SessionPageMintResult, type SessionPagePublisher, } from "./session-page-publisher.js";
+export { describeSessionPageMintFailure, UnavailableSessionPagePublisher, type MakeSessionPagePublisher, type SessionPageMintFailure, type SessionPageMintResult, type SessionPagePublisher, } from "./session-page-publisher.js";
 export { createRecordVersionTool, type RecordVersionInput, type RecordVersionResult, type RecordVersionToolDeps } from "./record-version.js";
 export { createDeriveTableTool, type DeriveTableInput, type DeriveTableResult, type DeriveTableToolDeps } from "./derive-table.js";
 export { createListPinnedArtifactsTool, type ListPinnedArtifactsInput, type ListPinnedArtifactsResult, type ListPinnedArtifactsToolDeps, type PinnedArtifact, type PinnedCitation, } from "./list-artifacts.js";

package/dist/tools/report-session/preview-report.d.ts

@@ -16,11 +16,12 @@
  * namespace belongs to this path alone, thus the tool never writes under the old `previews/` or `reports/`
  * trees. The result carries the absolute page path, thus a local host shows the page with no seam.
  *
- * A hosted view rides the same result. When the composition binds the session-page publisher, the tool
- * mints one grant after the page lands, and the `rendered` arm carries the URL of the URL space
- * `report-sessions/{analysisId}/{threadId}` (`contracts/content-url.ts`) beside the path. A refused mint
- * rides the arm as data, and the page path stays good — a broken grant surface never costs the render. An
- * unbound publisher changes nothing: the arm carries no access field, and a local host opens the file.
+ * A hosted view rides the same result. When the composition binds the session-page factory, the tool
+ * builds the publisher over the scope of the call, mints one grant after the page lands, and the
+ * `rendered` arm carries the URL of the URL space `report-sessions/{analysisId}/{threadId}`
+ * (`contracts/content-url.ts`) beside the path. A refused mint rides the arm as data, and the page path
+ * stays good — a broken grant surface never costs the render. An unbound factory changes nothing: the
+ * arm carries no access field, and a local host opens the file.
  *
  * Each degraded condition is a typed outcome in the ok channel: a session refusal, a gap list, a resolver
  * absence, an unresolvable root at resolver construction, an unresolved reference, a bridge mismatch, a
@@ -43,7 +44,7 @@ import { type BridgeMismatch } from "../../report-render/value-bridge.js";
 import type { RenderProblem } from "../../report-render/types.js";
 import { type Tool } from "../define-tool.js";
 import { type ReportSessionStateGateway, type SessionRefusal } from "../report-authoring/authoring-tools.js";
-import { type SessionPagePublisher } from "./session-page-publisher.js";
+import { type MakeSessionPagePublisher } from "./session-page-publisher.js";
 /** The empty input. The tool renders the current draft of the thread, thus it needs no field. */
 declare const previewReportInput: z.ZodObject<{}, z.core.$strip>;
 export type PreviewReportInput = z.infer<typeof previewReportInput>;
@@ -118,9 +119,11 @@ export type ResolvePageAsset = (specifier: string) => string;
  * harness. An embedder that ships the asset bytes packed, for example a compiled single-file binary with no
  * `node_modules` tree, materializes them to disk and binds its own lookup here.
  *
- * `sessionPages` is optional, because a local host opens the page path itself. Bound, the tool mints one
- * grant after the page lands and attaches the URL beside the path. A refused mint rides the `rendered` arm
- * as data, and it never fails the render.
+ * `makeSessionPages` is optional, because a local host opens the page path itself. It binds one analysis
+ * and the auth of the call, like `makeResolver`, thus a realization mints under the credential of the
+ * caller. Bound, the tool builds the publisher over the scope of the call, mints one grant after the page
+ * lands, and attaches the URL beside the path. A refused mint rides the `rendered` arm as data, and it
+ * never fails the render.
  */
 export interface PreviewReportToolDeps {
     readonly gateway: ReportSessionStateGateway;
@@ -130,7 +133,7 @@ export interface PreviewReportToolDeps {
     }) => ReferenceResolver;
     readonly resolveWorkspaceRoot: ResolveWorkspaceRoot;
     readonly resolvePageAsset?: ResolvePageAsset;
-    readonly sessionPages?: SessionPagePublisher;
+    readonly makeSessionPages?: MakeSessionPagePublisher;
     readonly logger?: Logger;
 }
 /**

package/dist/tools/report-session/preview-report.js

@@ -16,11 +16,12 @@
  * namespace belongs to this path alone, thus the tool never writes under the old `previews/` or `reports/`
  * trees. The result carries the absolute page path, thus a local host shows the page with no seam.
  *
- * A hosted view rides the same result. When the composition binds the session-page publisher, the tool
- * mints one grant after the page lands, and the `rendered` arm carries the URL of the URL space
- * `report-sessions/{analysisId}/{threadId}` (`contracts/content-url.ts`) beside the path. A refused mint
- * rides the arm as data, and the page path stays good — a broken grant surface never costs the render. An
- * unbound publisher changes nothing: the arm carries no access field, and a local host opens the file.
+ * A hosted view rides the same result. When the composition binds the session-page factory, the tool
+ * builds the publisher over the scope of the call, mints one grant after the page lands, and the
+ * `rendered` arm carries the URL of the URL space `report-sessions/{analysisId}/{threadId}`
+ * (`contracts/content-url.ts`) beside the path. A refused mint rides the arm as data, and the page path
+ * stays good — a broken grant surface never costs the render. An unbound factory changes nothing: the
+ * arm carries no access field, and a local host opens the file.
  *
  * Each degraded condition is a typed outcome in the ok channel: a session refusal, a gap list, a resolver
  * absence, an unresolvable root at resolver construction, an unresolved reference, a bridge mismatch, a
@@ -342,18 +343,20 @@ async function sweepAssets(assetsDir, staged, logger) {
 /**
  * Mint the hosted view of the page that landed.
  *
- * An absent publisher gives no grant, and the arm carries no access field — the page path stays the whole
- * local contract. A refusal and a thrown realization each become the not-granted arm, thus a broken grant
- * surface never costs the render. The URL spells through `buildReportSessionUrl`, thus the formula lives in
- * the contract and the seam gives the content-server base alone.
+ * An absent factory gives no grant, and the arm carries no access field — the page path stays the whole
+ * local contract. The tool builds the publisher over the scope of the call, thus the mint runs under the
+ * auth of the caller. A refusal, a thrown construction, and a thrown realization each become the
+ * not-granted arm, thus a broken grant surface never costs the render. The URL spells through
+ * `buildReportSessionUrl`, thus the formula lives in the contract and the seam gives the content-server
+ * base alone.
  */
-async function mintAccess(publisher, analysisId, threadId, logger) {
-    if (publisher === undefined) {
+async function mintAccess(makeSessionPages, analysisId, threadId, auth, logger) {
+    if (makeSessionPages === undefined) {
         return undefined;
     }
     let minted;
     try {
-        minted = await publisher.mintSessionPageAccess(analysisId, threadId);
+        minted = await makeSessionPages({ analysisId, auth }).mintSessionPageAccess(threadId);
     }
     catch (cause) {
         logger.warn("the session-page mint threw", { threadId, analysisId, ...defaultErrorFields(cause) });
@@ -472,7 +475,7 @@ export function createPreviewReportTool(deps) {
                 logger.warn("the rendered hash did not stamp", { threadId, analysisId, detail });
                 return ok({ outcome: "stamp-failed", pagePath: written.value, detail });
             }
-            const access = await mintAccess(deps.sessionPages, analysisId, threadId, logger);
+            const access = await mintAccess(deps.makeSessionPages, analysisId, threadId, ctx.session.auth, logger);
             return ok({ outcome: "rendered", pagePath: written.value, ...(access !== undefined ? { access } : {}) });
         },
     });

package/dist/tools/report-session/session-page-publisher.d.ts

@@ -7,10 +7,14 @@
  * `report-sessions/{analysisId}/{threadId}` (`contracts/content-url.ts`). That mint hides behind this
  * one method.
  *
- * The managed realization owns the grant mint and its client. The local default
- * (`UnavailableSessionPagePublisher`) returns not-ok, thus the preview tool attaches no URL and the
- * render still lands — the page path stays the whole local contract.
+ * The managed realization owns the grant mint and its client. A mint runs under the credential of the
+ * tool call, thus the composition binds a factory and the preview tool builds the publisher over the
+ * scope of the call — exactly as it builds the reference resolver. A boot-time singleton could not
+ * carry that credential, and a host that bans ambient state could not bind one at all. The local
+ * default (`UnavailableSessionPagePublisher`) returns not-ok, thus the preview tool attaches no URL
+ * and the render still lands — the page path stays the whole local contract.
  */
+import type { AuthContext } from "../../auth/types.js";
 export type SessionPageMintResult = {
     ok: true;
     data: {
@@ -40,16 +44,25 @@ export type SessionPageMintFailure = Extract<SessionPageMintResult, {
 export declare function describeSessionPageMintFailure(failure: SessionPageMintFailure): string;
 export interface SessionPagePublisher {
     /**
-     * Mint the access grant of one session page. `baseUrl` is the base URL of the content server, with
-     * no res path — the caller spells the whole URL through `buildReportSessionUrl`, thus the formula
-     * lives in the contract and never in a realization.
+     * Mint the access grant of one session page. The publisher binds the analysis, thus the mint takes
+     * the thread id alone. `baseUrl` is the base URL of the content server, with no res path — the
+     * caller spells the whole URL through `buildReportSessionUrl`, thus the formula lives in the
+     * contract and never in a realization.
      */
-    mintSessionPageAccess(analysisId: string, threadId: string): Promise<SessionPageMintResult>;
+    mintSessionPageAccess(threadId: string): Promise<SessionPageMintResult>;
 }
+/**
+ * The per-call construction of the publisher. The factory binds one analysis and the auth of the tool
+ * call, thus a realization mints under the credential of the caller and holds no ambient state.
+ */
+export type MakeSessionPagePublisher = (scope: {
+    analysisId: string;
+    auth: AuthContext;
+}) => SessionPagePublisher;
 /**
  * Local default — no hosted view of a session page. Returns not-ok, thus the preview tool carries the
  * refusal as data and the page path stays the whole result.
  */
 export declare class UnavailableSessionPagePublisher implements SessionPagePublisher {
-    mintSessionPageAccess(_analysisId: string, _threadId: string): Promise<SessionPageMintResult>;
+    mintSessionPageAccess(_threadId: string): Promise<SessionPageMintResult>;
 }

package/dist/tools/report-session/session-page-publisher.js

@@ -7,9 +7,12 @@
  * `report-sessions/{analysisId}/{threadId}` (`contracts/content-url.ts`). That mint hides behind this
  * one method.
  *
- * The managed realization owns the grant mint and its client. The local default
- * (`UnavailableSessionPagePublisher`) returns not-ok, thus the preview tool attaches no URL and the
- * render still lands — the page path stays the whole local contract.
+ * The managed realization owns the grant mint and its client. A mint runs under the credential of the
+ * tool call, thus the composition binds a factory and the preview tool builds the publisher over the
+ * scope of the call — exactly as it builds the reference resolver. A boot-time singleton could not
+ * carry that credential, and a host that bans ambient state could not bind one at all. The local
+ * default (`UnavailableSessionPagePublisher`) returns not-ok, thus the preview tool attaches no URL
+ * and the render still lands — the page path stays the whole local contract.
  */
 /**
  * Renders a failed mint as the line an agent reads back from the preview tool.
@@ -33,7 +36,7 @@ export function describeSessionPageMintFailure(failure) {
  * refusal as data and the page path stays the whole result.
  */
 export class UnavailableSessionPagePublisher {
-    async mintSessionPageAccess(_analysisId, _threadId) {
+    async mintSessionPageAccess(_threadId) {
         return {
             ok: false,
             error: { message: "the hosted view of a session page is unavailable in this environment" },

package/dist/tools/start-report-session.js

@@ -167,13 +167,23 @@ export function createStartReportSessionTool(deps) {
                 }
             }
             const spawned = await spawn.spawnReportSession(parentThreadId, brief);
-            return ok(spawned.match((child) => ({ outcome: "started", threadId: child.threadId, title: child.title }), (fault) => {
-                const outcome = toOutcome(fault);
-                if (outcome.outcome === "failed") {
-                    logger.warn("the report session did not start", { parentThreadId, reason: fault.type, ...logger.errorFields(causeOf(fault)) });
-                }
-                return outcome;
-            }));
+            if (spawned.isOk()) {
+                const child = spawned.value;
+                // The part rides the started arm only. The existing-session arm
+                // names a session that an earlier turn announced, thus a second
+                // part would put a second entry into the transcript.
+                await ctx.emit({
+                    type: "data-report-session-started",
+                    data: { threadId: child.threadId, parentThreadId },
+                });
+                return ok({ outcome: "started", threadId: child.threadId, title: child.title });
+            }
+            const fault = spawned.error;
+            const outcome = toOutcome(fault);
+            if (outcome.outcome === "failed") {
+                logger.warn("the report session did not start", { parentThreadId, reason: fault.type, ...logger.errorFields(causeOf(fault)) });
+            }
+            return ok(outcome);
         },
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@inflexa-ai/harness",
-    "version": "0.22.0",
+    "version": "0.23.0",
     "description": "Host-agnostic bioinformatics agent harness — hand-rolled agent loop, DBOS-durable workflows, sandboxed compute.",
     "license": "Apache-2.0",
     "type": "module",