@kitman-sh/cli 0.10.57 → 0.10.59

package/dist/{chunk-v43h8s08.js → chunk-88257wax.js}

@@ -32,9 +32,9 @@ import {
   toCodecJson,
   Json,
   encodePrettyJsonString
-} from "./chunk-61k67vxh.js";
-import"./chunk-4kssrezn.js";
-import"./chunk-7evwar6b.js";
+} from "./chunk-d3ksv8y1.js";
+import"./chunk-rrnee9mk.js";
+import"./chunk-v01c0k6j.js";
 import {
   SecureRandom,
   layerWebCrypto,
@@ -46,7 +46,7 @@ import {
   layer4,
   kitmanMcpServer,
   RunnerRpcProtocolVersion
-} from "./chunk-qhpyzn7c.js";
+} from "./chunk-sdpjvc1r.js";
 import {
   decodeText,
   mkString,
@@ -54,23 +54,23 @@ import {
   Path,
   withDefault,
   String2
-} from "./chunk-cy5fbrfm.js";
+} from "./chunk-0fdgam8v.js";
 import {
   Packument,
   tarballMatches
-} from "./chunk-a1yf46xt.js";
-import"./chunk-23vene3j.js";
+} from "./chunk-a4798jzf.js";
+import"./chunk-hxkk42cg.js";
 import {
   AgentDeclaration,
   KitDeclarations,
   describeFlag,
   Described
-} from "./chunk-wd0rvdt4.js";
+} from "./chunk-phmma642.js";
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-5tfxtw9z.js";
-import"./chunk-de4cfe40.js";
+} from "./chunk-eawcprsb.js";
+import"./chunk-e3tv8mv2.js";
 
 // packages/sdk/src/build/index.ts
 class DependencyInstallFailed extends TaggedError2()("DependencyInstallFailed", {

package/dist/{chunk-a1yf46xt.js → chunk-a4798jzf.js}

@@ -24,11 +24,11 @@ import {
   Record,
   Int,
   fromJsonString
-} from "./chunk-61k67vxh.js";
+} from "./chunk-d3ksv8y1.js";
 import {
   withDefault,
   String2
-} from "./chunk-cy5fbrfm.js";
+} from "./chunk-0fdgam8v.js";
 import {
   digestSha256,
   digestSha512,
@@ -38,7 +38,7 @@ import {
   get2,
   layer4,
   KitDigest
-} from "./chunk-qhpyzn7c.js";
+} from "./chunk-sdpjvc1r.js";
 
 // packages/core/src/npm-registry.ts
 var KitManifest = Struct({

package/dist/{chunk-61k67vxh.js → chunk-d3ksv8y1.js}

@@ -3631,7 +3631,7 @@ var asSome = (self) => map7(self, some);
 var andThen = /* @__PURE__ */ dual(2, (self, f) => new ContImpl(self, isEffect2(f) ? returnPayload : andThenCont, f));
 var tap = /* @__PURE__ */ dual(2, (self, f) => new ContImpl(self, isEffect2(f) ? tapEffectCont : tapCont, f));
 var asVoid2 = (self) => new ContImpl(self, returnPayload, exitVoid);
-var raceAllFirst = (all, options) => withFiber((parent) => {
+var raceAllFirst2 = (all, options) => withFiber((parent) => {
   const fibers = new Set;
   onExitUnsafe(parent, () => fibers.size === 0 ? undefined : fiberInterruptAll(fibers));
   return callback2((resume) => {
@@ -3659,7 +3659,7 @@ var raceAllFirst = (all, options) => withFiber((parent) => {
     }
   });
 });
-var raceFirst2 = /* @__PURE__ */ dual((args) => isEffect2(args[1]), (self, that, options) => raceAllFirst([self, that], options));
+var raceFirst2 = /* @__PURE__ */ dual((args) => isEffect2(args[1]), (self, that, options) => raceAllFirst2([self, that], options));
 var flatMap2 = /* @__PURE__ */ dual(2, (self, f) => new ContImpl(self, andThenCont, f));
 var effectIsExit = (effect) => effect[ExitTypeId] !== undefined;
 var flatMapEager2 = /* @__PURE__ */ dual(2, (self, f) => {
@@ -5648,6 +5648,7 @@ var timeoutOption = timeoutOption2;
 var timeoutOrElse = timeoutOrElse2;
 var delay = delay2;
 var sleep = sleep2;
+var raceAllFirst = raceAllFirst2;
 var raceFirst = raceFirst2;
 var filter2 = filter3;
 var filterOrFail = filterOrFail2;
@@ -10120,4 +10121,4 @@ var encodePrettyJsonString = encodeEffect(fromJsonString(Json, { space: 2 }));
 var decodeJsonStringSync = decodeUnknownSync(JsonFromString);
 var encodeUnknownJsonStringSync = encodeSync(fromJsonString(Unknown));
 
-export { pipeArguments, dual, identity, constant, constTrue, constFalse, constVoid, pipe, flow, memoize, isString2, isNumber2, isBoolean2, isBigInt2, isSymbol2, isFunction2, isUndefined2, isNotUndefined, isNotNull, isNullish, isObjectOrArray, isObject2, hasProperty, isTagged, isUint8Array, symbol, hash, combine, number, string, structure, array, symbol2, equals, asEquivalence, symbolRedactable, redact, currentFiberTypeId, format, NodeInspectSymbol, toJson, BaseProto, Class, getStackTraceLimit, setStackTraceLimit, assignProperty, args, evaluate, PipeInspectableProto, isExit, causeFail, makePrimitive, exitSucceed, exitFailCause, exitFail, withFiber, Done, Prototype, make14, strictEqual, Tuple, String3, Number2, mapInput, none, some, isNone, isSome, match, getOrElse, orElse, fromNullishOr, fromUndefinedOr, getOrUndefined, liftThrowable, map4, flatMap, toArray, Service2, makeUnsafe4, empty3, make15, add, getOrUndefined2, getOrUndefinedUnsafe, getUnsafe, get4, merge3, Reference, fromInputUnsafe, isFinite, zero, infinity, millis, seconds, minutes, toMillis, min, max, subtract, format2, normalize, succeed, fail3, try_, isResult, isFailure, isSuccess, map5, getOrElse2, getOrThrow, all2, allocate, fromIterable, isArrayNonEmpty, isReadonlyArrayNonEmpty, isCanonicalArrayIndex, getUnsafe2, sort, of, map6, makeEquivalence2, TaggedClass, Error2, TaggedError, encode, DisablePropagation, getCurrentFiber, fiberJoin, fiberInterrupt, succeed2, sync, suspend2, succeedNone, void_, callback2, asSome, andThen, flatMap2, map7, exitInterrupt, exitVoid, exitZipRight, scopeAddFinalizer, scope, onExitPrimitive, onExitUnsafe, uninterruptibleMask, fiberRunIn, makeLatchUnsafe, makeLatch, ClockRef, currentTimeMillis2, ConsoleRef, succeed3, failCause2, fail4, die, interrupt2, void_2, isSuccess2, isFailure2, hasInterrupts, asVoidAll, makeUnsafe5, make16, _await, fail5, interruptWith, isDone, isDoneUnsafe, succeed4, doneUnsafe, TracerTimingEnabled, Scope, makeUnsafe6, provide, addFinalizerExit, addFinalizer, forkUnsafe, close, build, buildWithScope, succeed5, effect, effectContext, effectDiscard, mergeAll, provide2, provideMerge, isCause, isFailReason, isDieReason, fromReasons, fail6, die2, makeFailReason, makeDieReason, hasInterruptsOnly, squash, findError, findErrorOption, hasInterrupts2, interruptors, pretty, isDone2, Done2, done, IllegalArgumentError, UnknownError, reasonAnnotations, Random, catchDone, isDoneCause, filterDone, doneExitFromCause, matchEffect, max2, during, min2, exponential, jittered, spaced, isEffect, all3, findFirst, forEach, whileLoop, promise, tryPromise, succeed6, suspend3, sync2, void_3, undefined_, callback3, never, gen, fail7, failSync, failCause3, die3, try_2, yieldNow, withFiber2, fromResult, fromNullishOr2, flatMap3, flatten, andThen2, tap2, result, option2, exit, map8, as, asSome2, asVoid, zipWith, catch_, catchTag, catchTags, catchReason, catchCause2, catchDefect, catchIf, catchCauseIf, mapError2, orDie, tapError2, tapCause, retry, retryOrElse, ignore, ignoreCause, orElseSucceed, timeout, timeoutOption, timeoutOrElse, delay, sleep, raceFirst, filter2, filterOrFail, when, matchCauseEffect, matchEffect2, context, contextWith, provide3, provideContext2, service, serviceOption, updateContext, updateService, provideService, scope2, scoped, scopedWith, acquireRelease, acquireUseRelease, addFinalizer2, ensuring2, onError, onExitPrimitive2, onExit, cached, interrupt3, interruptible, onInterrupt, uninterruptible, uninterruptibleMask2, forever, repeat, annotateCurrentSpan, makeSpanScoped, useSpan, withSpan, withParentSpan, forkChild, forkIn, forkScoped, forkDetach, runFork, runForkWith, runPromise, runPromiseWith, runSync, runSyncExitWith, fnUntraced, fn, clockWith, logWarning, logError, annotateLogs, effectify, mapEager, flatMapEager, catchEager, encode2, decode, Pointer, makeFormatterStandardSchemaV1, passthrough, transformEffect, Transformation, transform, defaultParseOptions, unknown, getIndexSignatureKeys, applyToSelfOrLastLinkEncoding, decodeTo, toEncoded, decodeUnknownEffect, omit, map9, declare, SchemaError, is, decodeUnknownEffect2, decodeEffect, decodeUnknownExit, decodeUnknownOption, decodeOption, decodeSync, encodeEffect, make17, isSchema, optionalKey, optional, toType, Literal, Never, Unknown, Null, String4, Boolean2, Void, Struct, Record, StructWithRest, ArraySchema, NonEmptyArray, Union, Literals, NullOr, UndefinedOr, suspend4, decodeTo2, withDecodingDefaultKey, tag, TaggedStruct, makeFilter, isPattern, Finite, isGreaterThanOrEqualTo, isLessThanOrEqualTo, Int, isMinLength, isMaxLength, isMinProperties, isMaxProperties, isUnique, Defect, Date2, fromJsonString, FiniteFromString, Cause, Exit, Class2, Error3, TaggedError2, toEquivalence, toCodecJson, toCodecStringTree, Json, JsonObject, decodeJsonString, decodeJsonStringOption, encodeJsonStringSync, encodePrettyJsonString, decodeJsonStringSync, encodeUnknownJsonStringSync };
+export { pipeArguments, dual, identity, constant, constTrue, constFalse, constVoid, pipe, flow, memoize, isString2, isNumber2, isBoolean2, isBigInt2, isSymbol2, isFunction2, isUndefined2, isNotUndefined, isNotNull, isNullish, isObjectOrArray, isObject2, hasProperty, isTagged, isUint8Array, symbol, hash, combine, number, string, structure, array, symbol2, equals, asEquivalence, symbolRedactable, redact, currentFiberTypeId, format, NodeInspectSymbol, toJson, BaseProto, Class, getStackTraceLimit, setStackTraceLimit, assignProperty, args, evaluate, PipeInspectableProto, isExit, causeFail, makePrimitive, exitSucceed, exitFailCause, exitFail, withFiber, Done, Prototype, make14, strictEqual, Tuple, String3, Number2, mapInput, none, some, isNone, isSome, match, getOrElse, orElse, fromNullishOr, fromUndefinedOr, getOrUndefined, liftThrowable, map4, flatMap, toArray, Service2, makeUnsafe4, empty3, make15, add, getOrUndefined2, getOrUndefinedUnsafe, getUnsafe, get4, merge3, Reference, fromInputUnsafe, isFinite, zero, infinity, millis, seconds, minutes, toMillis, min, max, subtract, format2, normalize, succeed, fail3, try_, isResult, isFailure, isSuccess, map5, getOrElse2, getOrThrow, all2, allocate, fromIterable, isArrayNonEmpty, isReadonlyArrayNonEmpty, isCanonicalArrayIndex, getUnsafe2, sort, of, map6, makeEquivalence2, TaggedClass, Error2, TaggedError, encode, DisablePropagation, getCurrentFiber, fiberJoin, fiberInterrupt, succeed2, sync, suspend2, succeedNone, void_, callback2, asSome, andThen, flatMap2, map7, exitInterrupt, exitVoid, exitZipRight, scopeAddFinalizer, scope, onExitPrimitive, onExitUnsafe, uninterruptibleMask, fiberRunIn, makeLatchUnsafe, makeLatch, ClockRef, currentTimeMillis2, ConsoleRef, succeed3, failCause2, fail4, die, interrupt2, void_2, isSuccess2, isFailure2, hasInterrupts, asVoidAll, makeUnsafe5, make16, _await, fail5, interruptWith, isDone, isDoneUnsafe, succeed4, doneUnsafe, TracerTimingEnabled, Scope, makeUnsafe6, provide, addFinalizerExit, addFinalizer, forkUnsafe, close, build, buildWithScope, succeed5, effect, effectContext, effectDiscard, mergeAll, provide2, provideMerge, isCause, isFailReason, isDieReason, fromReasons, fail6, die2, makeFailReason, makeDieReason, hasInterruptsOnly, squash, findError, findErrorOption, hasInterrupts2, interruptors, pretty, isDone2, Done2, done, IllegalArgumentError, UnknownError, reasonAnnotations, Random, catchDone, isDoneCause, filterDone, doneExitFromCause, matchEffect, max2, during, min2, exponential, jittered, spaced, isEffect, all3, findFirst, forEach, whileLoop, promise, tryPromise, succeed6, suspend3, sync2, void_3, undefined_, callback3, never, gen, fail7, failSync, failCause3, die3, try_2, yieldNow, withFiber2, fromResult, fromNullishOr2, flatMap3, flatten, andThen2, tap2, result, option2, exit, map8, as, asSome2, asVoid, zipWith, catch_, catchTag, catchTags, catchReason, catchCause2, catchDefect, catchIf, catchCauseIf, mapError2, orDie, tapError2, tapCause, retry, retryOrElse, ignore, ignoreCause, orElseSucceed, timeout, timeoutOption, timeoutOrElse, delay, sleep, raceAllFirst, raceFirst, filter2, filterOrFail, when, matchCauseEffect, matchEffect2, context, contextWith, provide3, provideContext2, service, serviceOption, updateContext, updateService, provideService, scope2, scoped, scopedWith, acquireRelease, acquireUseRelease, addFinalizer2, ensuring2, onError, onExitPrimitive2, onExit, cached, interrupt3, interruptible, onInterrupt, uninterruptible, uninterruptibleMask2, forever, repeat, annotateCurrentSpan, makeSpanScoped, useSpan, withSpan, withParentSpan, forkChild, forkIn, forkScoped, forkDetach, runFork, runForkWith, runPromise, runPromiseWith, runSync, runSyncExitWith, fnUntraced, fn, clockWith, logWarning, logError, annotateLogs, effectify, mapEager, flatMapEager, catchEager, encode2, decode, Pointer, makeFormatterStandardSchemaV1, passthrough, transformEffect, Transformation, transform, defaultParseOptions, unknown, getIndexSignatureKeys, applyToSelfOrLastLinkEncoding, decodeTo, toEncoded, decodeUnknownEffect, omit, map9, declare, SchemaError, is, decodeUnknownEffect2, decodeEffect, decodeUnknownExit, decodeUnknownOption, decodeOption, decodeSync, encodeEffect, make17, isSchema, optionalKey, optional, toType, Literal, Never, Unknown, Null, String4, Boolean2, Void, Struct, Record, StructWithRest, ArraySchema, NonEmptyArray, Union, Literals, NullOr, UndefinedOr, suspend4, decodeTo2, withDecodingDefaultKey, tag, TaggedStruct, makeFilter, isPattern, Finite, isGreaterThanOrEqualTo, isLessThanOrEqualTo, Int, isMinLength, isMaxLength, isMinProperties, isMaxProperties, isUnique, Defect, Date2, fromJsonString, FiniteFromString, Cause, Exit, Class2, Error3, TaggedError2, toEquivalence, toCodecJson, toCodecStringTree, Json, JsonObject, decodeJsonString, decodeJsonStringOption, encodeJsonStringSync, encodePrettyJsonString, decodeJsonStringSync, encodeUnknownJsonStringSync };

package/dist/{chunk-q5s64k8g.js → chunk-d8awdfdj.js}

@@ -5,7 +5,7 @@ import {
   isObject,
   isJsonObject,
   isString
-} from "./chunk-7evwar6b.js";
+} from "./chunk-v01c0k6j.js";
 import {
   pipeArguments,
   dual,
@@ -102,6 +102,7 @@ import {
   timeoutOption,
   timeoutOrElse,
   sleep,
+  raceAllFirst,
   raceFirst,
   filter2,
   matchEffect2,
@@ -155,12 +156,13 @@ import {
   encodePrettyJsonString,
   decodeJsonStringSync,
   encodeUnknownJsonStringSync
-} from "./chunk-61k67vxh.js";
+} from "./chunk-d3ksv8y1.js";
 import {
   Id,
   secretReference
-} from "./chunk-4kssrezn.js";
+} from "./chunk-rrnee9mk.js";
 import {
+  currentTimeMillis,
   SecureRandom,
   layerWebCrypto,
   layer,
@@ -223,9 +225,8 @@ import {
   installCommand,
   checkServicesFile,
   checkServices
-} from "./chunk-qhpyzn7c.js";
+} from "./chunk-sdpjvc1r.js";
 import {
-  currentTimeMillis,
   join,
   interrupt,
   unbounded,
@@ -263,7 +264,7 @@ import {
   writeSrtSettings2,
   srtStepArgv2,
   srtArgv2
-} from "./chunk-cy5fbrfm.js";
+} from "./chunk-0fdgam8v.js";
 import {
   writeAgentEnvironmentConfigFile2,
   readManifestSkillPaths2,
@@ -279,8 +280,8 @@ import {
   applyAgentEnvironmentMaterialization2,
   isPathWithin2,
   skillIdentity2
-} from "./chunk-hwd2gg2f.js";
-import"./chunk-a1yf46xt.js";
+} from "./chunk-z0z56a72.js";
+import"./chunk-a4798jzf.js";
 import {
   sliceBytes2,
   maxLineBytes2,
@@ -288,28 +289,28 @@ import {
   decodedOption2,
   decoded2,
   readOpencode2
-} from "./chunk-jc920h47.js";
+} from "./chunk-09jf8588.js";
 import {
   writeSecretRegistry,
   secretRefusalLog,
   parseSecretRefusals
-} from "./chunk-g53wn1q8.js";
+} from "./chunk-1w81w56v.js";
 import {
   uploadRunFile,
   programLease,
   rpcRunFiles,
   programHostsEnv,
   undeclaredHostsEnv
-} from "./chunk-wd0rvdt4.js";
-import"./chunk-23vene3j.js";
+} from "./chunk-phmma642.js";
+import"./chunk-hxkk42cg.js";
 import {
   nextInt
-} from "./chunk-gwcqz1bj.js";
+} from "./chunk-q3c7vmby.js";
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-5tfxtw9z.js";
-import"./chunk-de4cfe40.js";
+} from "./chunk-eawcprsb.js";
+import"./chunk-e3tv8mv2.js";
 
 // packages/core/src/sync-kit.ts
 import { createHash } from "crypto";
@@ -3080,20 +3081,24 @@ var removeRunnerTerminals = (connection, runnerId, teardownDelayMs = 250) => fla
 }));
 var until = (seen, done) => changes(seen).pipe(filter(done), runHead, flatMap3((head) => match(head, { onNone: () => never, onSome: succeed6 })));
 var stirredSince = (turn) => (last) => last.end !== undefined || last.status === "working" || last.status === "blocked" || last.turn > turn;
-var lastingBlock = (seen, graceMs) => gen(function* () {
+var lastingStatus = (seen, status, graceMs) => gen(function* () {
   while (true) {
-    const blocked = yield* until(seen, (last) => last.status === "blocked");
-    const left = yield* until(seen, (last) => last.status !== "blocked").pipe(timeoutOption(graceMs));
+    const entered = yield* until(seen, (last) => last.status === status);
+    const left = yield* until(seen, (last) => last.status !== status).pipe(timeoutOption(graceMs));
     if (isNone(left))
-      return blocked;
+      return entered;
   }
 });
 var lastingStop = (input) => gen(function* () {
   let reminders = idleReminders;
   let remindedTurn = -1;
   while (true) {
-    const stopped = yield* raceFirst(until(input.seen, (last) => last.end !== undefined || last.turn > input.promptTurn && last.status !== "blocked" && last.status !== "working"), lastingBlock(input.seen, input.blockedGraceMs));
-    if (stopped.end !== undefined || stopped.status === "blocked" || (yield* input.outputSubmitted))
+    const stopped = yield* raceAllFirst([
+      until(input.seen, (last) => last.end !== undefined || last.turn > input.promptTurn && !["blocked", "working", "error"].includes(last.status ?? "")),
+      lastingStatus(input.seen, "blocked", input.blockedGraceMs),
+      lastingStatus(input.seen, "error", input.idleGraceMs)
+    ]);
+    if (stopped.end !== undefined || stopped.status === "blocked" || stopped.status === "error" || (yield* input.outputSubmitted))
       return stopped;
     const stirred = stirredSince(stopped.turn);
     const waited = yield* until(input.seen, stirred).pipe(timeoutOption(input.idleGraceMs));
@@ -3328,10 +3333,14 @@ var runAttempt = (request, options) => gen(function* () {
       case "finished":
         return failed("output_missing", "The agent finished without submitting its Output.");
       case undefined: {
-        if (last.status !== "blocked")
+        if (last.status !== "blocked" && last.status !== "error")
           return failed("output_missing", "The agent finished without submitting its Output.");
         const screen = yield* option2(call((connection) => connection.read(address)));
         const shown = isSome(screen) ? redactCredentials(screen.value).trim() : "";
+        if (last.status === "error") {
+          yield* logWarning("agent_errored", { attempt: attempt.id, address, screen: shown });
+          return failed("harness_error", `The Harness stopped in its error state before it submitted its Output.${shown === "" ? "" : ` Its screen ended: ${shown.slice(-blockedScreenChars)}`}`);
+        }
         yield* logWarning("agent_blocked", { attempt: attempt.id, address, screen: shown });
         if (loginRefused(shown))
           return failed("harness_login_lost", `The Harness's login was refused before it submitted its Output. Its screen ended: ${shown.slice(-blockedScreenChars)}`);
@@ -4141,6 +4150,87 @@ var claudeOutOfQuota = (line) => {
   return { summary: bounded(text || "Usage limit reached"), ...resetTime(resetsAt) };
 };
 var claudeLoginLost = (line) => isJsonObject(line) && line.type === "assistant" && line.isApiErrorMessage === true && line.error === "authentication_failed" ? bounded((isJsonObject(line.message) ? textOf(line.message.content) : "") || "Authentication failed") : undefined;
+var quotaError = /usage limit|quota|insufficient_quota|resource_exhausted|credit balance|billing|(daily|weekly|monthly) limit/i;
+var loginError = /\b401\b|unauthori[sz]ed|authentication|invalid.{0,20}(api[ _-]?key|token|credentials)|no api key|(token|credentials?) (has |have )?(expired|been revoked)|(api[ _-]?key|token|credentials?) (is |are )?not valid|log ?in again|re-?authenticate/i;
+var rateLimitError = /rate.?limit|too many requests|\b429\b/i;
+var passingLimit = /per minute|retry in \d+(\.\d+)?\s*s/i;
+var claudeProviderRefusal = (line) => {
+  const spent = claudeOutOfQuota(line);
+  if (spent !== undefined)
+    return { ...spent, kind: "out_of_quota" };
+  if (!isJsonObject(line) || line.type !== "assistant" || line.isApiErrorMessage !== true)
+    return;
+  const said = bounded(isJsonObject(line.message) ? textOf(line.message.content) : "");
+  if (line.error === "rate_limit")
+    return { summary: said || "Rate limit reached", kind: "rate_limited" };
+  return line.error === "billing_error" ? { summary: said || "Billing error", kind: "out_of_quota" } : undefined;
+};
+var codexQuotaErrors = new Set([
+  "usage_limit_exceeded",
+  "organization_usage_limit_exceeded",
+  "organization_spend_limit_exceeded"
+]);
+var codexProviderRefusal = (line) => {
+  const event = isJsonObject(line) && line.type === "event_msg" ? line.payload : undefined;
+  const error = !isJsonObject(event) ? undefined : event.type === "task_complete" ? event.error : event.type === "error" ? event : undefined;
+  if (!isJsonObject(error))
+    return;
+  const info = error.codex_error_info;
+  const tag = isString(info) ? info : isJsonObject(info) ? Object.keys(info)[0] : undefined;
+  const detail = isJsonObject(info) && tag !== undefined ? info[tag] : undefined;
+  const status = isJsonObject(detail) ? detail.http_status_code : undefined;
+  const summary = bounded(isString(error.message) ? error.message : tag ?? "");
+  if (codexQuotaErrors.has(tag))
+    return { summary, kind: "out_of_quota" };
+  if (tag === "unauthorized" || status === 401)
+    return { summary, kind: "login_refused" };
+  return tag === "rate_limit_exceeded" || status === 429 ? { summary, kind: "rate_limited" } : undefined;
+};
+var opencodeQuotaErrors = /^provider\.(quota|free-limit|go-limit|budget-limit|model-budget-limit|chatgpt-limit)$/;
+var opencodeProviderRefusal = (error) => {
+  if (!isJsonObject(error))
+    return;
+  if (isString(error.type)) {
+    const summary = bounded(isString(error.message) ? error.message : error.type);
+    if (opencodeQuotaErrors.test(error.type))
+      return { summary, kind: "out_of_quota" };
+    if (error.type === "provider.auth")
+      return { summary, kind: "login_refused" };
+    return error.type === "provider.rate-limit" ? { summary, kind: "rate_limited" } : undefined;
+  }
+  const data = isJsonObject(error.data) ? error.data : {};
+  const said = isString(data.message) ? data.message : isString(error.name) ? error.name : "";
+  const summary = bounded(said);
+  if (error.name === "ProviderAuthError")
+    return { summary, kind: "login_refused" };
+  if (error.name !== "APIError")
+    return;
+  if (quotaError.test(said) || isString(data.responseBody) && quotaError.test(data.responseBody))
+    return { summary, kind: "out_of_quota" };
+  if (data.statusCode === 401)
+    return { summary, kind: "login_refused" };
+  return data.statusCode === 429 ? { summary, kind: "rate_limited" } : undefined;
+};
+var piProviderRefusal = (line) => {
+  const message = isJsonObject(line) && line.type === "message" ? line.message : undefined;
+  if (!isJsonObject(message) || message.role !== "assistant" || message.stopReason !== "error")
+    return;
+  const said = isString(message.errorMessage) ? message.errorMessage : "";
+  const summary = bounded(said);
+  if (passingLimit.test(said))
+    return { summary, kind: "rate_limited", retried: true };
+  if (quotaError.test(said))
+    return { summary, kind: "out_of_quota" };
+  if (loginError.test(said))
+    return { summary, kind: "login_refused" };
+  return rateLimitError.test(said) ? { summary, kind: "rate_limited", retried: true } : undefined;
+};
+var piReplied = (line) => isJsonObject(line) && line.type === "message" && isJsonObject(line.message) && line.message.role === "assistant";
+var sessionRefusals = new Map([
+  ["claude", claudeProviderRefusal],
+  ["codex", codexProviderRefusal],
+  ["pi", piProviderRefusal]
+]);
 var sessionNormalizer = (harness) => {
   const asks = new Set;
   const called = (fullCallId, name, args) => {
@@ -4323,8 +4413,13 @@ var transcriptRelay = (input) => {
   let progressAt;
   let lastSeen;
   const asking = new Set;
-  let outOfQuota;
   let loginLost;
+  let refusal;
+  let errorReadAt;
+  const heard = (said) => {
+    if (refusal === undefined || refusal.retried === true)
+      refusal = said;
+  };
   const backedUp = () => unsentChars >= maxUnsentChars;
   const sawSession = (extent) => gen(function* () {
     if (extent !== lastSeen)
@@ -4407,10 +4502,11 @@ var transcriptRelay = (input) => {
     while (queued.length > 0) {
       yield* suspend3(() => record(queued.splice(0, linesPerTurn2).flatMap((line) => {
         const value = decoded2(line);
-        if (input.harness === "claude") {
-          outOfQuota = claudeOutOfQuota(value) ?? outOfQuota;
+        if (input.harness === "claude")
           loginLost = claudeLoginLost(value) ?? loginLost;
-        }
+        const refused = sessionRefusals.get(input.harness)?.(value);
+        if (refused !== undefined || input.harness === "pi" && piReplied(value))
+          heard(refused);
         return normalize(value).slice(0, maxEventsPerLine);
       }))).pipe(uninterruptible);
       yield* yieldNow;
@@ -4526,15 +4622,19 @@ var transcriptRelay = (input) => {
     record,
     stalledFor: (millis) => map8(currentTimeMillis, (now) => asking.size === 0 && progressAt !== undefined && now - progressAt >= millis),
     asking: sync2(() => asking.size > 0),
-    outOfQuota: sync2(() => outOfQuota),
     loginLost: sync2(() => loginLost),
+    refusal: sync2(() => refusal),
     read: (source) => gen(function* () {
       if (source.kind === "opencode_v2") {
-        yield* sawSession(yield* readOpencode2(source, "extent", {}));
+        const extent = yield* readOpencode2(source, "extent", {});
+        yield* sawSession(extent);
         while (!backedUp() && (yield* takeMessages(source))) {
           yield* flush;
           yield* yieldNow;
         }
+        if (extent !== errorReadAt)
+          heard(opencodeProviderRefusal(yield* readOpencode2(source, "lastError", { v2: true })));
+        errorReadAt = extent;
         return;
       }
       if (source.kind === "opencode") {
@@ -4545,6 +4645,7 @@ var transcriptRelay = (input) => {
           yield* flush;
           yield* yieldNow;
         }
+        heard(opencodeProviderRefusal(yield* readOpencode2(source, "lastError", { v2: false })));
         return;
       }
       yield* drain;
@@ -5044,19 +5145,21 @@ var stepAttempt = (input, resending) => (work) => gen(function* () {
         };
     }
   });
-  const outOfQuota = relay === undefined ? never : gen(function* () {
+  const refusalHold = (refusal) => ({
+    reason: refusal.kind,
+    ...refusal.until === undefined ? undefined : { until: refusal.until },
+    ...backend === "docker" ? { scope: "step" } : undefined
+  });
+  const outputSubmitted = input.heartbeat(work).pipe(option2, map8((state) => isSome(state) && state.value.outputSubmitted === true));
+  const providerRefused = relay === undefined ? never : gen(function* () {
     for (;; ) {
       yield* sleep("1 second");
-      const spent = yield* relay.outOfQuota;
-      if (spent !== undefined)
-        return {
-          status: "failed",
-          summary: spent.summary,
-          harnessHold: {
-            reason: "out_of_quota",
-            ...spent.until === undefined ? undefined : { until: spent.until }
-          }
-        };
+      const refusal = yield* relay.refusal;
+      if (refusal === undefined || refusal.retried === true)
+        continue;
+      if (yield* outputSubmitted)
+        return { status: "finished" };
+      return { status: "failed", summary: refusal.summary, harnessHold: refusalHold(refusal) };
     }
   });
   const loginLost = relay === undefined ? never : gen(function* () {
@@ -5065,8 +5168,7 @@ var stepAttempt = (input, resending) => (work) => gen(function* () {
       const said = yield* relay.loginLost;
       if (said === undefined)
         continue;
-      const state = yield* input.heartbeat(work).pipe(option2);
-      if (isSome(state) && state.value.outputSubmitted === true)
+      if (yield* outputSubmitted)
         return { status: "finished" };
       return { status: "failed", summary: said, restart: { reason: "login_revoked" } };
     }
@@ -5090,7 +5192,7 @@ var stepAttempt = (input, resending) => (work) => gen(function* () {
       host: refusal.host.slice(0, 300),
       reason: refusal.reason.slice(0, 500)
     }
-  ])).pipe(raceFirst(stalled), raceFirst(parked), raceFirst(outOfQuota), raceFirst(loginLost), onExit((exit) => gen(function* () {
+  ])).pipe(raceFirst(stalled), raceFirst(parked), raceFirst(providerRefused), raceFirst(loginLost), onExit((exit) => gen(function* () {
     if (relay === undefined || relaying === undefined)
       return;
     yield* interrupt(relaying);
@@ -5106,8 +5208,22 @@ var stepAttempt = (input, resending) => (work) => gen(function* () {
     yield* interrupt(checkpointing);
   if (ran.status === "parked")
     return { status: "deferred" };
-  if (ran.status !== "finished") {
+  const refused = ran.status === "failed" && !("harnessHold" in ran) && relay !== undefined ? yield* relay.refusal : undefined;
+  const deliversOutput = refused !== undefined && (yield* outputSubmitted);
+  if (ran.status !== "finished" && !deliversOutput) {
     yield* uninterruptible(checkpoint).pipe(catch_((error) => logWarning("runner_last_checkpoint_failed", error.message)));
+    if (refused !== undefined)
+      return {
+        status: "failed",
+        failureSummary: refused.summary,
+        harnessHold: refusalHold(refused)
+      };
+    if (backend === "docker" && "restart" in ran && ran.restart !== undefined)
+      return {
+        status: "failed",
+        failureSummary: ran.summary,
+        harnessHold: refusalHold({ summary: ran.summary, kind: "login_refused" })
+      };
     return {
       status: ran.status,
       failureSummary: ran.summary,

package/dist/{chunk-de4cfe40.js → chunk-e3tv8mv2.js}

@@ -96,9 +96,8 @@ import {
   Defect,
   Exit,
   toCodecJson
-} from "./chunk-61k67vxh.js";
+} from "./chunk-d3ksv8y1.js";
 import {
-  Clock,
   interrupt,
   getCurrent,
   makeUnsafe2,
@@ -109,8 +108,9 @@ import {
   shutdownUnsafe,
   fromQueue,
   unwrap
-} from "./chunk-cy5fbrfm.js";
+} from "./chunk-0fdgam8v.js";
 import {
+  Clock,
   empty,
   fromInput,
   merge,
@@ -123,7 +123,7 @@ import {
   ParseOptions,
   RpcClientDefect,
   RpcClientError
-} from "./chunk-qhpyzn7c.js";
+} from "./chunk-sdpjvc1r.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/workers/Transferable.js
 class Collector extends (/* @__PURE__ */ Service2()("effect/workers/Transferable/Collector")) {

package/dist/{chunk-5tfxtw9z.js → chunk-eawcprsb.js}

@@ -22,7 +22,7 @@ import {
   map8,
   raceFirst,
   scoped
-} from "./chunk-61k67vxh.js";
+} from "./chunk-d3ksv8y1.js";
 import {
   unwrap,
   drainFork,
@@ -31,7 +31,7 @@ import {
   runCollect,
   runDrain,
   mkString
-} from "./chunk-cy5fbrfm.js";
+} from "./chunk-0fdgam8v.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/internal/redacted.js
 var redactedRegistry = /* @__PURE__ */ new WeakMap;

package/dist/{chunk-mjzvfh9d.js → chunk-hvev0dve.js}

@@ -12,30 +12,30 @@ import {
   orElseSucceed,
   decodeJsonString,
   encodePrettyJsonString
-} from "./chunk-61k67vxh.js";
-import"./chunk-4kssrezn.js";
+} from "./chunk-d3ksv8y1.js";
+import"./chunk-rrnee9mk.js";
 import {
   isJsonObject
-} from "./chunk-7evwar6b.js";
+} from "./chunk-v01c0k6j.js";
 import {
   FileSystem,
   Path
-} from "./chunk-cy5fbrfm.js";
+} from "./chunk-0fdgam8v.js";
 import {
   tomlTableHeader2,
   tomlKeyPath2,
   kitmanSkillEntry,
   isPathWithin2
-} from "./chunk-hwd2gg2f.js";
+} from "./chunk-z0z56a72.js";
 import {
   instructionsStart,
   instructionsEnd,
   renderMcpServer,
   materializeKitSetup,
   tomlInline
-} from "./chunk-qhpyzn7c.js";
-import"./chunk-a1yf46xt.js";
-import"./chunk-5tfxtw9z.js";
+} from "./chunk-sdpjvc1r.js";
+import"./chunk-a4798jzf.js";
+import"./chunk-eawcprsb.js";
 
 // packages/agent-runtime/src/kit-setup-sync.ts
 class KitSyncError extends TaggedError("KitSyncError") {

package/dist/{chunk-23vene3j.js → chunk-hxkk42cg.js}

@@ -6,10 +6,10 @@ import {
   gen,
   flatMap3,
   provideContext2
-} from "./chunk-61k67vxh.js";
+} from "./chunk-d3ksv8y1.js";
 import {
   runForEach
-} from "./chunk-cy5fbrfm.js";
+} from "./chunk-0fdgam8v.js";
 import {
   WebSocketConstructor,
   layerWebSocketConstructorGlobal,
@@ -19,13 +19,13 @@ import {
   RunnerReplicaRpcs,
   RunnerRunFileRpcs,
   ProgramRpcs
-} from "./chunk-qhpyzn7c.js";
+} from "./chunk-sdpjvc1r.js";
 import {
   layerJson,
   make4,
   withHeaders,
   layerProtocolSocket
-} from "./chunk-de4cfe40.js";
+} from "./chunk-e3tv8mv2.js";
 
 // packages/live/src/rpc/runner-client.ts
 var proxiedWebSocket = (proxy) => succeed5(WebSocketConstructor)((target) => {

package/dist/{chunk-wd0rvdt4.js → chunk-phmma642.js}

@@ -75,11 +75,12 @@ import {
   toEquivalence,
   toCodecJson,
   Json
-} from "./chunk-61k67vxh.js";
+} from "./chunk-d3ksv8y1.js";
 import {
   guard
-} from "./chunk-4kssrezn.js";
+} from "./chunk-rrnee9mk.js";
 import {
+  currentTimeMillis,
   WebCrypto,
   SafeJson,
   AgentSandboxNetwork,
@@ -104,12 +105,11 @@ import {
   KitDigest,
   KitSetup,
   RunnerRpcError
-} from "./chunk-qhpyzn7c.js";
+} from "./chunk-sdpjvc1r.js";
 import {
-  currentTimeMillis,
   runForEach,
   FileSystem
-} from "./chunk-cy5fbrfm.js";
+} from "./chunk-0fdgam8v.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/crypto/internal/webCrypto.js
 var subtleUnavailable = () => new Error("crypto.subtle is unavailable; browsers expose it only in secure contexts");

package/dist/{chunk-gwcqz1bj.js → chunk-q3c7vmby.js}

@@ -3,7 +3,7 @@ import {
   Random,
   succeed6,
   withFiber2
-} from "./chunk-61k67vxh.js";
+} from "./chunk-d3ksv8y1.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Random.js
 var Random2 = Random;