@meistrari/agent-core 0.2.0-experimental.0 → 0.2.0-experimental.2

package/src/protocol/agent-json.ts

@@ -13,14 +13,128 @@ export interface JsonObject { readonly [key: string]: JsonValue }
 export type JsonArray = readonly JsonValue[]
 export type JsonValue = JsonPrimitive | JsonObject | JsonArray
 
-export const jsonValueSchema: ZodType<JsonValue> = z.lazy(() => z.union([
-    jsonPrimitiveSchema,
-    z.array(jsonValueSchema),
-    z.record(z.string(), jsonValueSchema),
-]))
-
-export const jsonObjectSchema: ZodType<JsonObject> = z.record(z.string(), jsonValueSchema)
-export const jsonArraySchema: ZodType<JsonArray> = z.array(jsonValueSchema)
+const jsonWireValueSchema = z.json()
+type JsonWireValue = z.infer<typeof jsonWireValueSchema>
+const jsonWireObjectSchema = z.record(z.string(), jsonWireValueSchema)
+const jsonWireArraySchema = z.array(jsonWireValueSchema)
+
+export const jsonValueSchema: ZodType<JsonValue> = z
+    .preprocess(encodeJsonObjectKeys, jsonWireValueSchema)
+    .overwrite(decodeJsonObjectKeys)
+
+export const jsonObjectSchema: ZodType<JsonObject> = z
+    .preprocess(encodeJsonObjectKeys, jsonWireObjectSchema)
+    .overwrite(decodeJsonObject)
+
+export const jsonArraySchema: ZodType<JsonArray> = z
+    .preprocess(encodeJsonObjectKeys, jsonWireArraySchema)
+    .overwrite(values => values.map(decodeJsonObjectKeys))
+
+const JSON_VALIDATION_KEY_PREFIX = '$'
+const invalidJsonValue = Symbol('invalid canonical JSON value')
+
+function encodeJsonObjectKeys(value: unknown): unknown {
+    return encodeJsonValue(value, new WeakSet())
+}
+
+function encodeJsonValue(value: unknown, ancestors: WeakSet<object>): unknown {
+    if (Array.isArray(value))
+        return encodeJsonArray(value, ancestors)
+    if (typeof value !== 'object' || value === null)
+        return value
+    if (!isPlainObject(value))
+        return invalidJsonValue
+    return encodeJsonObject(value, ancestors)
+}
+
+function encodeJsonArray(value: unknown[], ancestors: WeakSet<object>): unknown {
+    if (ancestors.has(value))
+        return invalidJsonValue
+    ancestors.add(value)
+
+    try {
+        const encoded: unknown[] = []
+        for (let index = 0; index < value.length; index += 1) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, String(index))
+            if (!descriptor?.enumerable || !('value' in descriptor))
+                return invalidJsonValue
+            const entry = encodeJsonValue(descriptor.value, ancestors)
+            if (entry === invalidJsonValue)
+                return invalidJsonValue
+            encoded.push(entry)
+        }
+
+        for (const key of Reflect.ownKeys(value)) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key)
+            if (!descriptor || !descriptor.enumerable)
+                continue
+            if (typeof key !== 'string' || !isArrayIndex(key, value.length))
+                return invalidJsonValue
+        }
+        return encoded
+    }
+    finally {
+        ancestors.delete(value)
+    }
+}
+
+function encodeJsonObject(value: object, ancestors: WeakSet<object>): unknown {
+    if (ancestors.has(value))
+        return invalidJsonValue
+    ancestors.add(value)
+
+    try {
+        const entries: Array<[string, unknown]> = []
+        for (const key of Reflect.ownKeys(value)) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key)
+            if (!descriptor || !descriptor.enumerable)
+                continue
+            if (typeof key !== 'string' || !('value' in descriptor))
+                return invalidJsonValue
+            const entry = encodeJsonValue(descriptor.value, ancestors)
+            if (entry === invalidJsonValue)
+                return invalidJsonValue
+            entries.push([encodeJsonKey(key), entry])
+        }
+        return Object.fromEntries(entries)
+    }
+    finally {
+        ancestors.delete(value)
+    }
+}
+
+function decodeJsonObjectKeys(value: JsonWireValue): JsonWireValue {
+    if (Array.isArray(value))
+        return value.map(decodeJsonObjectKeys)
+    if (typeof value !== 'object' || value === null)
+        return value
+    return decodeJsonObject(value)
+}
+
+function decodeJsonObject(value: Record<string, JsonWireValue>): Record<string, JsonWireValue> {
+    const entries: Array<[string, JsonWireValue]> = []
+    for (const [key, entry] of Object.entries(value))
+        entries.push([decodeJsonKey(key), decodeJsonObjectKeys(entry)])
+    return Object.fromEntries(entries)
+}
+
+function isPlainObject(value: object): boolean {
+    const prototype = Object.getPrototypeOf(value)
+    return prototype === Object.prototype || prototype === null
+}
+
+function isArrayIndex(value: string, length: number): boolean {
+    const index = Number(value)
+    return Number.isInteger(index) && index >= 0 && index < length && String(index) === value
+}
+
+function encodeJsonKey(value: string): string {
+    return `${JSON_VALIDATION_KEY_PREFIX}${value}`
+}
+
+function decodeJsonKey(value: string): string {
+    return value.slice(JSON_VALIDATION_KEY_PREFIX.length)
+}
 
 const utf8Encoder = new TextEncoder()
 

package/src/protocol/agent-metadata.ts

@@ -12,13 +12,13 @@ export const codexAgentRunMetadataSchema = z.object({
     provider: z.literal('codex'),
     ...metadataShape,
     model: codexModelIdSchema.optional(),
-}).strict()
+})
 
 export const claudeAgentRunMetadataSchema = z.object({
     provider: z.literal('claude'),
     ...metadataShape,
     model: claudeModelIdSchema.optional(),
-}).strict()
+})
 
 export const agentRunMetadataSchema = z.discriminatedUnion('provider', [
     codexAgentRunMetadataSchema,

package/src/protocol/agent-model.ts

@@ -8,15 +8,27 @@ import z from 'zod'
  * schema that carries a model id accepts any non-empty string.
  */
 export const codexModelIds = [
+    'gpt-6-astra',
     'gpt-5.6-sol',
+    'gpt-5.6-terra',
+    'gpt-5.6-luna',
     'gpt-5.5',
     'gpt-5.4',
     'gpt-5.4-mini',
-    'gpt-5.3-codex',
     'gpt-5.2',
 ] as const
 
+/**
+ * Every Claude model id the wire accepts, including historical ids retained so stored
+ * `session.started` metadata keeps parsing. Add new ids; never remove one. The ids
+ * users can select live in `agent-catalog.ts`.
+ */
 export const claudeModelIds = [
+    'claude-opus-5-5',
+    'claude-sonnet-5',
+    'claude-fable-5-1',
+    'claude-opus-5',
+    'claude-fable-5',
     'sonnet',
     'claude-opus-4-8',
     'opus',

package/src/protocol/agent-notification.ts

@@ -0,0 +1,110 @@
+import type { JsonValue } from './agent-json'
+import z from 'zod'
+import { jsonValueSchema } from './agent-json'
+
+export const agentNotificationSchema = jsonValueSchema
+export const agentNotificationsSchema = z.array(agentNotificationSchema).min(1).max(20)
+export const agentNotificationInstructionSchema = z.string().trim().min(1).max(4_096)
+
+export const agentNotificationToolOutputMaxBytes = 64 * 1024
+
+const notificationTransportEnvelopeType = 'coding_agent.notification_command.v1'
+const textEncoder = new TextEncoder()
+
+export type AgentNotification = JsonValue
+export type AgentNotifications = z.infer<typeof agentNotificationsSchema>
+export type AgentNotificationInstruction = z.infer<typeof agentNotificationInstructionSchema>
+export interface AgentNotificationCommandPayload {
+    instruction: AgentNotificationInstruction | null
+    notifications: AgentNotifications
+}
+export type AgentNotificationToolOutput = AgentNotificationCommandPayload & {
+    commandId: string
+}
+
+interface AgentNotificationToolOutputInput {
+    commandId: string
+    instruction: AgentNotificationInstruction | null
+    notifications: readonly AgentNotification[]
+}
+
+// The supervisor wire command keeps its historical JSON-array shape so a newer control plane can
+// still deliver notifications to image-baked older sandboxes. The generated command id prevents an
+// observation value from masquerading as the trusted envelope before the command exists.
+const notificationTransportEnvelopeSchema = z.object({
+    type: z.literal(notificationTransportEnvelopeType),
+    commandId: z.string().min(1),
+    instruction: agentNotificationInstructionSchema.nullable(),
+    notifications: agentNotificationsSchema,
+})
+
+function notificationTransportEnvelope(input: AgentNotificationToolOutputInput) {
+    return {
+        type: notificationTransportEnvelopeType,
+        commandId: input.commandId,
+        instruction: input.instruction,
+        notifications: [...input.notifications],
+    } as const
+}
+
+export function encodeAgentNotificationCommandPayloadForTransport(
+    input: AgentNotificationToolOutputInput,
+): AgentNotifications {
+    return [notificationTransportEnvelopeSchema.parse(notificationTransportEnvelope(input))]
+}
+
+export function decodeAgentNotificationCommandPayloadFromTransport(input: {
+    commandId: string
+    notifications: AgentNotifications
+}): AgentNotificationCommandPayload {
+    if (input.notifications.length === 1) {
+        const envelope = notificationTransportEnvelopeSchema.safeParse(input.notifications[0])
+        if (envelope.success && envelope.data.commandId === input.commandId) {
+            return {
+                instruction: envelope.data.instruction,
+                notifications: envelope.data.notifications,
+            }
+        }
+    }
+
+    return {
+        instruction: null,
+        notifications: input.notifications,
+    }
+}
+
+export function isAgentNotificationPublicPayloadWithinSizeLimit(
+    input: Pick<AgentNotificationToolOutputInput, 'commandId' | 'notifications'>,
+): boolean {
+    return textEncoder.encode(JSON.stringify({
+        commandId: input.commandId,
+        notifications: input.notifications,
+    })).byteLength <= agentNotificationToolOutputMaxBytes
+}
+
+export function isAgentNotificationToolOutputWithinSizeLimit(input: AgentNotificationToolOutputInput): boolean {
+    const canonicalBytes = textEncoder.encode(JSON.stringify(input)).byteLength
+    const compatibilityBytes = textEncoder.encode(JSON.stringify({
+        commandId: input.commandId,
+        notifications: [notificationTransportEnvelope(input)],
+    })).byteLength
+    return Math.max(canonicalBytes, compatibilityBytes) <= agentNotificationToolOutputMaxBytes
+}
+
+export const agentNotificationToolOutputSchema: z.ZodType<AgentNotificationToolOutput> = z.object({
+    commandId: z.string().min(1),
+    instruction: agentNotificationInstructionSchema.nullable(),
+    notifications: agentNotificationsSchema,
+}).strict().superRefine((output, context) => {
+    if (isAgentNotificationToolOutputWithinSizeLimit(output))
+        return
+    context.addIssue({
+        code: 'custom',
+        path: ['notifications'],
+        message: `Serialized notification tool output exceeds ${agentNotificationToolOutputMaxBytes} bytes.`,
+    })
+})
+
+export function serializeAgentNotificationToolOutput(input: AgentNotificationToolOutput): string {
+    return JSON.stringify(agentNotificationToolOutputSchema.parse(input))
+}

package/src/protocol/agent-presentation.ts

@@ -1,3 +1,4 @@
+import type { SelectableClaudeModelId } from './agent-catalog'
 import type { AgentReasoningEffort } from './agent-command'
 import type { KnownCodexModelId } from './agent-model'
 
@@ -6,11 +7,13 @@ import type { KnownCodexModelId } from './agent-model'
  * or effort added to the wire unions cannot ship without its presentation: the
  * `Record` types below fail to compile until every identifier is covered.
  *
- * Copy and figures mirror the bundled Codex CLI catalog
- * (`codex-rs/models-manager/models.json` at the pinned `@openai/codex@0.145.0`).
- * Update this file together with the pinned CLI version. Upstream defines efforts
- * by description only — no per-effort reasoning-token budget exists, so none is
- * invented here.
+ * Labels, descriptions, and image support follow the non-hidden `model/list`
+ * catalog observed through Codex 0.153.4. Context windows use its model metadata's
+ * default `context_window`, not the opt-in `max_context_window`.
+ * Refresh alongside the model registry; the live catalog can change without a CLI
+ * upgrade. Relative cost weights are product-owned, not provider-reported prices.
+ * Upstream defines efforts by description only — no per-effort reasoning-token
+ * budget exists, so none is invented here.
  *
  * This is UI copy and relative sizing only. Billing, pricing, and cost estimation
  * stay out of protocol (docs/agents-protocol.md) — `relativeCost` is a 1–5 picker
@@ -29,43 +32,55 @@ export interface AgentModelPresentation {
 const CODEX_CONTEXT_WINDOW = 272_000
 
 export const codexModelPresentation: Record<KnownCodexModelId, AgentModelPresentation> = {
+    'gpt-6-astra': {
+        label: 'GPT 6.0 Astra',
+        description: 'Our most capable model for complex, demanding work.',
+        relativeCost: 5,
+        maxInputTokens: CODEX_CONTEXT_WINDOW,
+        isMultiModal: true,
+    },
     'gpt-5.6-sol': {
-        label: 'GPT-5.6-Sol',
-        description: 'Latest frontier agentic coding model.',
+        label: 'GPT 5.6 Sol',
+        description: 'Reliable agentic workhorse for everyday tasks.',
         relativeCost: 5,
         maxInputTokens: CODEX_CONTEXT_WINDOW,
         isMultiModal: true,
     },
+    'gpt-5.6-terra': {
+        label: 'GPT 5.6 Terra',
+        description: 'Balanced agentic coding model for everyday work.',
+        relativeCost: 3,
+        maxInputTokens: CODEX_CONTEXT_WINDOW,
+        isMultiModal: true,
+    },
+    'gpt-5.6-luna': {
+        label: 'GPT 5.6 Luna',
+        description: 'Fast and affordable agentic coding model.',
+        relativeCost: 2,
+        maxInputTokens: CODEX_CONTEXT_WINDOW,
+        isMultiModal: true,
+    },
     'gpt-5.5': {
-        label: 'GPT-5.5',
-        description: 'Frontier model for complex coding, research, and real-world work.',
+        label: 'GPT 5.5',
+        description: 'Proven previous-generation model for coding and general work.',
         relativeCost: 4,
         maxInputTokens: CODEX_CONTEXT_WINDOW,
         isMultiModal: true,
     },
     'gpt-5.4': {
-        label: 'GPT-5.4',
+        label: 'GPT 5.4',
         description: 'Strong model for everyday coding.',
         relativeCost: 3,
         maxInputTokens: CODEX_CONTEXT_WINDOW,
         isMultiModal: true,
     },
     'gpt-5.4-mini': {
-        label: 'GPT-5.4-Mini',
+        label: 'GPT 5.4 Mini',
         description: 'Small, fast, and cost-efficient model for simpler coding tasks.',
         relativeCost: 2,
         maxInputTokens: CODEX_CONTEXT_WINDOW,
         isMultiModal: true,
     },
-    /* Absent from the 0.145.0 upstream catalog; retained in our registry, so the
-       copy below is ours. */
-    'gpt-5.3-codex': {
-        label: 'GPT-5.3-Codex',
-        description: 'Code-tuned model for focused engineering tasks.',
-        relativeCost: 3,
-        maxInputTokens: CODEX_CONTEXT_WINDOW,
-        isMultiModal: true,
-    },
     'gpt-5.2': {
         label: 'GPT-5.2',
         description: 'Optimized for professional work and long-running agents.',
@@ -75,6 +90,42 @@ export const codexModelPresentation: Record<KnownCodexModelId, AgentModelPresent
     },
 }
 
+/*
+ * Claude presentation covers the selectable ids only (`agent-catalog.ts`); historical wire
+ * ids render through the unknown-model fallback. Labels, context windows, output limits,
+ * and image support follow the model catalog baked into Claude Code 2.1.280, the CLI the
+ * sandbox image pins. Relative cost follows that catalog's pricing tiers on the same
+ * product-owned 1–5 scale as Codex.
+ */
+const CLAUDE_CONTEXT_WINDOW = 1_000_000
+
+export const claudeModelPresentation: Record<SelectableClaudeModelId, AgentModelPresentation> = {
+    'claude-opus-5-5': {
+        label: 'Opus 5.5',
+        description: 'Best for everyday, complex tasks.',
+        relativeCost: 4,
+        maxInputTokens: CLAUDE_CONTEXT_WINDOW,
+        maxOutputTokens: 128_000,
+        isMultiModal: true,
+    },
+    'claude-sonnet-5': {
+        label: 'Sonnet 5',
+        description: 'Efficient for routine coding tasks.',
+        relativeCost: 2,
+        maxInputTokens: CLAUDE_CONTEXT_WINDOW,
+        maxOutputTokens: 64_000,
+        isMultiModal: true,
+    },
+    'claude-fable-5-1': {
+        label: 'Fable 5.1',
+        description: 'Most intelligent generally available Claude model.',
+        relativeCost: 5,
+        maxInputTokens: CLAUDE_CONTEXT_WINDOW,
+        maxOutputTokens: 64_000,
+        isMultiModal: true,
+    },
+}
+
 interface AgentReasoningEffortPresentation {
     label: string
     description: string

package/src/protocol/agent-tool.ts

@@ -1,32 +1,88 @@
 import z from 'zod'
 import { jsonObjectSchema, jsonValueSchema } from './agent-json'
+import { objectRejectingKeys } from './rejected-keys'
 
 export const agentToolDefinitionSchema = z.object({
     name: z.string().regex(/^[\w-]{1,128}$/),
     description: z.string().min(1),
     inputSchema: jsonObjectSchema,
-}).strict()
+})
 
-export const agentToolTextContentSchema = z.object({
+// Provider-private metadata containers are rejected, not stripped, at every content boundary.
+const privateMetadataKeys = ['_meta', 'metadata'] as const
+
+export const agentToolTextContentSchema = objectRejectingKeys({
     type: z.literal('text'),
     text: z.string(),
-}).strict()
+}, privateMetadataKeys)
 
-export const agentToolImageContentSchema = z.object({
+// An image is either embedded data or a URI reference, never both.
+export const agentToolImageContentSchema = objectRejectingKeys({
     type: z.literal('image'),
     data: z.string().min(1),
     mimeType: z.string().min(1),
-}).strict()
+}, ['uri', ...privateMetadataKeys])
+
+const observedContentMetadata = {
+    annotations: jsonObjectSchema.optional(),
+    extras: jsonObjectSchema.optional(),
+}
+
+const agentToolResourceLinkContentSchema = objectRejectingKeys({
+    type: z.literal('resource_link'),
+    name: z.string(),
+    uri: z.string(),
+    mimeType: z.string().optional(),
+    description: z.string().optional(),
+    title: z.string().optional(),
+    size: z.number().nonnegative().optional(),
+    ...observedContentMetadata,
+}, privateMetadataKeys)
+
+const resourceMetadata = {
+    uri: z.string(),
+    mimeType: z.string().optional(),
+    extras: jsonObjectSchema.optional(),
+}
+
+const agentToolResourceContentSchema = objectRejectingKeys({
+    type: z.literal('resource'),
+    // An embedded resource is either text or blob, never both.
+    resource: z.union([
+        objectRejectingKeys({ ...resourceMetadata, text: z.string() }, ['blob']),
+        objectRejectingKeys({ ...resourceMetadata, blob: z.string() }, ['text']),
+    ]),
+    ...observedContentMetadata,
+}, privateMetadataKeys)
+
+const agentToolAudioContentSchema = objectRejectingKeys({
+    type: z.literal('audio'),
+    data: z.string().min(1),
+    mimeType: z.string().min(1),
+    ...observedContentMetadata,
+}, privateMetadataKeys)
+
+const agentToolJsonContentSchema = objectRejectingKeys({
+    type: z.literal('json'),
+    value: jsonValueSchema,
+}, privateMetadataKeys)
 
-export const agentToolContentSchema = z.discriminatedUnion('type', [
-    agentToolTextContentSchema,
-    agentToolImageContentSchema,
+export const agentToolContentSchema = z.union([
+    agentToolTextContentSchema.extend(observedContentMetadata),
+    agentToolImageContentSchema.extend(observedContentMetadata),
+    objectRejectingKeys({ type: z.literal('image'), uri: z.string().min(1), ...observedContentMetadata }, ['data', ...privateMetadataKeys]),
+    agentToolAudioContentSchema,
+    agentToolResourceContentSchema,
+    agentToolResourceLinkContentSchema,
+    agentToolJsonContentSchema,
 ])
 
-export const agentToolResultSchema = z.object({
+export const agentToolResultSchema = objectRejectingKeys({
     success: z.boolean(),
     content: z.array(agentToolContentSchema),
-}).strict()
+    structuredContent: jsonValueSchema.optional(),
+    reportedSuccess: z.boolean().optional(),
+}, privateMetadataKeys)
 
 export const agentToolCallStatusSchema = z.enum(['completed', 'failed', 'cancelled'])
 

package/src/protocol/agent-usage.ts

@@ -9,7 +9,8 @@ export const agentUsageSchema = z.object({
     cacheWriteTokens: tokenCountSchema.optional(),
     reasoningOutputTokens: tokenCountSchema.optional(),
     totalTokens: tokenCountSchema.optional(),
-}).strict()
+    webSearchRequests: tokenCountSchema.optional(),
+})
 
 export type AgentUsage = z.infer<typeof agentUsageSchema>
 
@@ -26,3 +27,5 @@ export const agentUsageAccountingSchema = z.object({
     model: z.string().min(1).optional(),
     models: z.record(z.string(), agentUsageSchema).optional(),
 }).strict()
+
+export type AgentUsageAccounting = z.infer<typeof agentUsageAccountingSchema>

package/src/protocol/agent-user-input.ts

@@ -5,24 +5,24 @@ export const agentUserInputOptionSchema = z.object({
     value: z.string().min(1),
     label: z.string().min(1),
     description: z.string().min(1).optional(),
-}).strict()
+})
 
 const agentUserInputQuestionBaseSchema = z.object({
     id: z.string().min(1),
     label: z.string().min(1),
     description: z.string().min(1).optional(),
     required: z.boolean().optional(),
-}).strict()
+})
 
 export const agentUserInputTextQuestionSchema = agentUserInputQuestionBaseSchema.extend({
     type: z.literal('text'),
     placeholder: z.string().min(1).optional(),
-}).strict()
+})
 
 export const agentUserInputSingleSelectQuestionSchema = agentUserInputQuestionBaseSchema.extend({
     type: z.literal('single_select'),
     options: z.array(agentUserInputOptionSchema).min(1),
-}).strict()
+})
 
 export const agentUserInputQuestionSchema = z.discriminatedUnion('type', [
     agentUserInputTextQuestionSchema,

package/src/protocol/agent-work.ts

@@ -1,17 +1,19 @@
 import z from 'zod'
+import { objectRejectingKeys } from './rejected-keys'
 
 export const agentWorkStatusSchema = z.enum(['pending', 'in_progress', 'completed'])
 
-export const agentWorkItemSchema = z.object({
+// Provider-only fields (Claude `activeForm`/`explanation`, provider tags) are rejected, not stripped.
+export const agentWorkItemSchema = objectRejectingKeys({
     id: z.string().min(1),
     title: z.string().min(1),
     status: agentWorkStatusSchema,
-}).strict()
+}, ['activeForm'])
 
-const agentWorkSnapshotObservationSchema = z.object({
+const agentWorkSnapshotObservationSchema = objectRejectingKeys({
     kind: z.literal('snapshot'),
     items: z.array(agentWorkItemSchema),
-}).strict().superRefine(({ items }, context) => {
+}, ['explanation']).superRefine(({ items }, context) => {
     const seenIds = new Set<string>()
 
     for (const [index, item] of items.entries()) {
@@ -31,26 +33,26 @@ export const agentWorkObservationSchema = z.discriminatedUnion('kind', [
     z.object({
         kind: z.literal('item_observed'),
         item: agentWorkItemSchema,
-    }).strict(),
+    }),
     z.object({
         kind: z.literal('item_renamed'),
         itemId: z.string().min(1),
         title: z.string().min(1),
-    }).strict(),
+    }),
     z.object({
         kind: z.literal('item_status_changed'),
         itemId: z.string().min(1),
         status: agentWorkStatusSchema,
-    }).strict(),
+    }),
     z.object({
         kind: z.literal('item_removed'),
         itemId: z.string().min(1),
-    }).strict(),
+    }),
 ])
 
-export const agentWorkStateSchema = z.object({
+export const agentWorkStateSchema = objectRejectingKeys({
     items: z.array(agentWorkItemSchema),
-}).strict()
+}, ['provider'])
 
 export type AgentWorkStatus = z.infer<typeof agentWorkStatusSchema>
 export type AgentWorkItem = z.infer<typeof agentWorkItemSchema>

package/src/protocol/index.ts

@@ -1,3 +1,4 @@
+export * from './agent-catalog'
 export * from './agent-command'
 export * from './agent-content'
 export * from './agent-error'
@@ -5,6 +6,7 @@ export * from './agent-event'
 export * from './agent-json'
 export * from './agent-metadata'
 export * from './agent-model'
+export * from './agent-notification'
 export * from './agent-overflow'
 export * from './agent-presentation'
 export * from './agent-provider'

package/src/protocol/rejected-keys.ts

@@ -0,0 +1,11 @@
+import z from 'zod'
+
+// Builds a strip-on-read object schema that still rejects specific known-but-forbidden keys.
+// Additive unknown fields are stripped, but a key listed here is a semantic violation (for
+// example a turn id on a session-scoped event) and fails validation instead of being dropped.
+// The rejecting keys are runtime-only: a valid value can never contain them, so they are
+// intentionally absent from the inferred output type.
+export function objectRejectingKeys<TShape extends z.ZodRawShape>(shape: TShape, rejectedKeys: readonly string[]): z.ZodObject<TShape> {
+    const rejections: object = Object.fromEntries(rejectedKeys.map(key => [key, z.never().optional()]))
+    return z.object({ ...shape, ...rejections })
+}

package/src/provenance.gen.ts

@@ -1,6 +1,6 @@
 // Generated by scripts/write-provenance.ts. Do not edit by hand.
 export const generatedProvenance = {
-    version: "0.2.0-experimental.0",
-    sha: "da33c4f2db2875602c75e8ad3fde2d01d8ea7a94",
-    buildTime: "2026-09-22T18:15:52.470Z",
+    version: "0.2.0-experimental.2",
+    sha: "b808a0e0d307bcaa2cd0d47d2fd1e4112f70290c",
+    buildTime: "2026-09-25T17:58:45.916Z",
 } as const