@mono-agent/agent-runtime 0.18.1 → 0.18.3

package/src/ai/providers/pi-native/result-builder.js

@@ -323,6 +323,8 @@ export function buildDiagnostics(params) {
     lastToolName,
     structuredRetry,
     contextCompactionDiagnostics,
+    transportErrorCode,
+    transportErrorSource,
   } = params;
   return {
     provider_session_id: providerSessionId,
@@ -335,6 +337,15 @@ export function buildDiagnostics(params) {
     pi_max_retries: maxRetries,
     pi_transport_requested: piTransport,
     ...(lastToolName ? { last_tool_name: lastToolName } : {}),
+    // Present only when an opaque transport failure was resolved to a real
+    // reason. `provider_transport_error_source` says whether that came from the
+    // error's own cause chain (exact) or from process-wide correlation.
+    ...(transportErrorCode
+      ? {
+        provider_transport_error_code: transportErrorCode,
+        provider_transport_error_source: transportErrorSource,
+      }
+      : {}),
     ...structuredOutputRetryDiagnostics(
       structuredRetry.attempts,
       structuredRetry.reason,

package/src/ai/providers/pi-native.js

@@ -44,6 +44,7 @@ import {
 } from "./pi-messages.js";
 import { emitCaptured } from "./pi-events.js";
 import { normalizePiErrorMessage } from "./pi-errors.js";
+import { annotateProviderErrorMessage, installTransportErrorProbe } from "./transport-errors.js";
 import {
   runStructuredOutputFinalizationRetry,
   shouldRetryStructuredOutputFinalization,
@@ -252,6 +253,10 @@ function splitUserContent(content) {
 }
 
 export async function generatePiNativeResponse(systemPrompt, options = {}) {
+  // Idempotent; arms the undici diagnostics-channel probe so a transport
+  // failure during this run can be resolved back to a real reason even after
+  // an intermediate layer flattens the Error to its message.
+  installTransportErrorProbe();
   const resolved = options.model;
   const start = Date.now();
   const events = [];
@@ -682,7 +687,15 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
         : (stopReason === "error" || stopReason === "aborted"
           ? lastAssistant?.errorMessage || runError?.message || "Pi agent aborted before final output"
           : (runError ? runError.message || String(runError) : null));
-    const errorMessage = normalizePiErrorMessage(rawErrorMessage);
+    // pi-agent-core stores `error.message` on the failure assistant message and
+    // discards the cause, so `runError` is usually the only object still
+    // carrying one. When neither has a cause, fall back to the correlated
+    // transport probe rather than surfacing a bare "terminated".
+    const annotatedError = annotateProviderErrorMessage(
+      normalizePiErrorMessage(rawErrorMessage),
+      runError,
+    );
+    const errorMessage = annotatedError.message;
 
     const structuredRetry = {
       attempts: structuredOutputFinalizationRetryAttempts,
@@ -702,6 +715,8 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
       lastToolName: runState.lastToolName,
       structuredRetry,
       contextCompactionDiagnostics: runState.compaction.diagnostics,
+      transportErrorCode: annotatedError.causeCode,
+      transportErrorSource: annotatedError.causeSource,
     });
     const errorDetails = buildErrorDetails({
       errorMessage,
@@ -812,7 +827,12 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
     // leaf for host/runtime-side throws that landed after the harness already
     // mutated the live session (guards preserved in cleanupSessionOnThrow).
     await cleanupSessionOnThrow(runState, { durableRepo });
-    const errorMessage = normalizePiErrorMessage(err?.message || String(err));
+    // The throw path still holds the original Error, so its cause chain is the
+    // authoritative source here — no correlation guesswork needed.
+    const errorMessage = annotateProviderErrorMessage(
+      normalizePiErrorMessage(err?.message || String(err)),
+      err,
+    ).message;
     const isRetryable = retryableProviderFailureInfo({
       errorText: errorMessage,
       failureKind: "provider_unavailable",

package/src/ai/providers/transport-errors.js

@@ -0,0 +1,154 @@
+// Recover the real reason behind opaque provider transport failures.
+//
+// Node's fetch (undici) reports a cut response body as `TypeError: terminated`
+// with the actual reason — UND_ERR_BODY_TIMEOUT, ECONNRESET, "other side
+// closed" — only on `error.cause`. Several layers between the socket and us
+// flatten errors to `error.message`, most notably pi-agent-core's
+// `handleRunFailure`, which stores `error.message` and drops the cause before
+// any mono-agent code sees the Error object. The result is a run that fails
+// with the single uninformative word "terminated".
+//
+// Two recovery paths, in order of trustworthiness:
+//
+//   1. `describeErrorCause` walks the cause chain of an Error we still hold.
+//      Exact, but only available where the original object survives.
+//   2. `recentTransportErrorCode` reads a bounded ring of `undici:request:error`
+//      diagnostics-channel events. This sees the error before any library
+//      flattens it, at the cost of attribution: the channel is process-wide, so
+//      with concurrent requests in flight we cannot prove which run a given
+//      socket error belongs to. Correlation is reported as such, and a window
+//      containing conflicting codes reports ambiguity instead of guessing.
+
+import diagnosticsChannel from "node:diagnostics_channel";
+
+// Messages that carry no diagnostic content on their own. Annotating only these
+// keeps already-descriptive provider errors untouched.
+const OPAQUE_ERROR_RE = /^(?:terminated|fetch failed|connection error\.?|network error|socket hang up|premature close|other side closed)$/i;
+
+const MAX_RECORDED = 32;
+// A stream cut is observed on the socket within milliseconds of the rejection
+// surfacing. Anything older is a different request's failure.
+const DEFAULT_CORRELATION_WINDOW_MS = 5_000;
+const MAX_CAUSE_DEPTH = 5;
+
+/** @type {{code: string, at: number, origin: string|null}[]} */
+const recorded = [];
+let installed = false;
+
+function codeFromError(error) {
+  if (!error || typeof error !== "object") return null;
+  const code = error.code ?? error.errno;
+  if (typeof code === "string" && code.trim()) return code.trim();
+  // Undici's timeout errors expose a stable `name` even when `code` is absent.
+  const name = typeof error.name === "string" ? error.name.trim() : "";
+  if (name && name !== "Error" && name !== "TypeError") return name;
+  return null;
+}
+
+/**
+ * Walk an error's `cause` chain and return the first transport-level code found.
+ * Returns null when the chain carries no code (i.e. nothing worth appending).
+ * @param {unknown} error
+ * @returns {string|null}
+ */
+export function describeErrorCause(error) {
+  /** @type {any} */
+  let current = error;
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && current; depth += 1) {
+    // Skip the outermost error: its code (if any) is what the caller already
+    // has. We want the reason underneath it.
+    if (depth > 0) {
+      const code = codeFromError(current);
+      if (code) return code;
+    }
+    current = current?.cause;
+  }
+  return null;
+}
+
+/**
+ * Subscribe to undici's request-error channel. Idempotent and safe to call on
+ * every run; a Node build without the channel simply records nothing.
+ */
+export function installTransportErrorProbe() {
+  if (installed) return;
+  installed = true;
+  try {
+    diagnosticsChannel.subscribe("undici:request:error", (/** @type {any} */ message) => {
+      const error = message?.error;
+      const code = codeFromError(error) || describeErrorCause(error);
+      if (!code) return;
+      /** @type {string|null} */
+      let origin = null;
+      try {
+        const raw = message?.request?.origin;
+        origin = typeof raw === "string" ? raw : (raw?.origin ?? null);
+      } catch {
+        origin = null;
+      }
+      recorded.push({ code, at: Date.now(), origin });
+      if (recorded.length > MAX_RECORDED) recorded.splice(0, recorded.length - MAX_RECORDED);
+    });
+  } catch {
+    // Channel unavailable on this runtime: fall back to cause-chain walking only.
+    installed = false;
+  }
+}
+
+/**
+ * Most recent transport error code seen within the correlation window.
+ * `ambiguous` is true when the window holds more than one distinct code, in
+ * which case attribution to a specific run would be a guess.
+ * @param {{withinMs?: number, now?: number}} [opts]
+ * @returns {{code: string, ambiguous: boolean}|null}
+ */
+export function recentTransportErrorCode(opts = {}) {
+  const withinMs = Number.isFinite(Number(opts.withinMs))
+    ? Number(opts.withinMs)
+    : DEFAULT_CORRELATION_WINDOW_MS;
+  const now = Number.isFinite(Number(opts.now)) ? Number(opts.now) : Date.now();
+  const fresh = recorded.filter((entry) => now - entry.at <= withinMs);
+  if (fresh.length === 0) return null;
+  const distinct = new Set(fresh.map((entry) => entry.code));
+  return { code: fresh[fresh.length - 1].code, ambiguous: distinct.size > 1 };
+}
+
+/**
+ * Append the underlying transport reason to an otherwise contentless provider
+ * error. Descriptive messages, and messages that already name their cause, are
+ * returned unchanged.
+ *
+ * @param {string|null} message normalized provider error text
+ * @param {unknown} [error] the original Error, when it survived
+ * @returns {{message: string|null, causeCode: string|null, causeSource: "cause_chain"|"transport_probe"|null}}
+ */
+export function annotateProviderErrorMessage(message, error) {
+  const text = String(message || "").trim();
+  if (!text) return { message: message ?? null, causeCode: null, causeSource: null };
+  if (!OPAQUE_ERROR_RE.test(text)) return { message: text, causeCode: null, causeSource: null };
+
+  const fromChain = describeErrorCause(error);
+  if (fromChain) {
+    return { message: `${text} (${fromChain})`, causeCode: fromChain, causeSource: "cause_chain" };
+  }
+
+  const correlated = recentTransportErrorCode();
+  if (correlated && !correlated.ambiguous) {
+    return {
+      message: `${text} (${correlated.code}, correlated)`,
+      causeCode: correlated.code,
+      causeSource: "transport_probe",
+    };
+  }
+  return { message: text, causeCode: null, causeSource: null };
+}
+
+/** Test seam: drop recorded transport errors. */
+export function resetTransportErrorProbeForTests() {
+  recorded.length = 0;
+}
+
+/** Test seam: record a transport error without a real socket. */
+export function recordTransportErrorForTests(code, at = Date.now()) {
+  recorded.push({ code, at, origin: null });
+}

package/src/ai/runtime/router.js

@@ -85,6 +85,9 @@ import { instrumentLiveInputAppliedEvents } from "./live-input-events.js";
  * Returned options are never copied into router telemetry.
  * @property {AgentRuntimeInstance} [runtime]
  * @property {Object<string, *>} [options]
+ * @property {{allowedTools?: ReadonlyArray<string>, disallowedTools?: ReadonlyArray<string>, permissionMode?: string}} [policyOptions]
+ * Provider-specific projection of the logical tool policy. This deliberately
+ * cannot replace any other protected request field.
  * @property {() => (void|Promise<void>)} [cleanup]
  */
 
@@ -243,6 +246,7 @@ export function createRouterRuntime({ host = {}, chain = [], routeSafety = "unif
             attemptCleanup = resolution?.cleanup;
             if (resolveAttempt !== undefined) {
               callOptions = mergeAttemptOptions(callOptions, resolution?.options);
+              callOptions = mergeAttemptPolicyOptions(callOptions, resolution?.policyOptions);
             }
             if (routeSafety === "per-route-native") {
               callOptions = projectPerRouteNativeOptions(entry, callOptions);
@@ -804,6 +808,33 @@ function normalizeAttemptResolution(value) {
   if (value.cleanup !== undefined && typeof value.cleanup !== "function") {
     throw new Error("route attempt resolver cleanup must be a function");
   }
+  return {
+    ...value,
+    ...(value.policyOptions === undefined
+      ? {}
+      : { policyOptions: normalizeAttemptPolicyOptions(value.policyOptions) }),
+  };
+}
+
+const ATTEMPT_POLICY_OPTION_KEYS = new Set(["allowedTools", "disallowedTools", "permissionMode"]);
+
+function normalizeAttemptPolicyOptions(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("route attempt resolver policyOptions must be an object");
+  }
+  for (const key of Object.keys(value)) {
+    if (!ATTEMPT_POLICY_OPTION_KEYS.has(key)) {
+      throw new Error(`route attempt resolver policyOptions cannot override ${key}`);
+    }
+  }
+  for (const key of ["allowedTools", "disallowedTools"]) {
+    if (value[key] !== undefined && !Array.isArray(value[key])) {
+      throw new Error(`route attempt resolver policyOptions.${key} must be an array or undefined`);
+    }
+  }
+  if (value.permissionMode !== undefined && typeof value.permissionMode !== "string") {
+    throw new Error("route attempt resolver policyOptions.permissionMode must be a string or undefined");
+  }
   return value;
 }
 
@@ -826,6 +857,17 @@ function mergeAttemptOptions(base, resolved) {
   return merged;
 }
 
+function mergeAttemptPolicyOptions(base, policyOptions) {
+  if (policyOptions === undefined) return base;
+  const merged = { ...base };
+  for (const key of ATTEMPT_POLICY_OPTION_KEYS) {
+    if (!Object.hasOwn(policyOptions, key)) continue;
+    if (policyOptions[key] === undefined) delete merged[key];
+    else merged[key] = policyOptions[key];
+  }
+  return merged;
+}
+
 /**
  * @param {Object<string, *>} options
  * @returns {Object<string, *>}

package/src/ai/types.js

@@ -40,10 +40,80 @@
  */
 
 /**
- * @typedef {{type: string, [key: string]: *}} RuntimeEvent
- * Structured runtime/telemetry event. `type` is the only required field;
- * every event kind (tool_approval_pending, provider_failover_started,
- * context_compaction_applied, ...) adds its own extra fields.
+ * @typedef {Object} RuntimeNativeSubagentDefinition
+ * One caller-defined Claude native `Task` profile. Codex collaboration-agent
+ * definitions are owned by Codex and are not represented by this type.
+ * @property {string} name
+ * @property {string} [displayName]
+ * @property {string} [description]
+ * @property {string} [helperSystemPrompt]
+ * @property {string} [instructions]
+ * @property {ReadonlyArray<string>} [allowedTools]
+ * @property {ReadonlyArray<string>} [disallowedTools]
+ * @property {string | RuntimeModelRef} [modelRef]
+ * @property {RuntimeModelRef} [model]
+ * @property {string} [effort]
+ * @property {Object<string, Object>} [mcpServers]
+ */
+
+/**
+ * @typedef {Object} RuntimeNativeSubagentsOptions
+ * Caller-defined native profiles are supported only by the Claude bridges.
+ * Codex owns its collaboration agents; use `codexLoadProjectDocs` when those
+ * agents should receive repository instructions.
+ * @property {"claude"} provider
+ * @property {ReadonlyArray<RuntimeNativeSubagentDefinition>} teammates
+ */
+
+/**
+ * @typedef {Object} RuntimeSubagentIdentity
+ * Provider-neutral identity attached to every `subagent_activity` event.
+ * @property {string} id The canonical parent attachment key: the initiating
+ *   parent tool-use id when the provider exposes it, or a stable synthetic key
+ *   for an orphan lifecycle record. A provider-native task/thread id never replaces it.
+ * @property {string} [nativeId] Provider-native task or thread id, retained only
+ *   as diagnostic/correlation metadata.
+ * @property {string} name Provider-neutral profile/agent name.
+ * @property {number} callIndex Provider call-order ordinal; consumers must not
+ *   use it as an identity key.
+ * @property {string} [label] Short task label or description.
+ * @property {string} [agentPath] Provider-reported ancestry for a
+ *   nested native agent. Informational only; `id` remains the attachment key.
+ * @property {number} [costUsd] Priced delegation cost, when the runtime can
+ *   attribute it to this subagent.
+ */
+
+/**
+ * @typedef {"agent_started"|"started"|"completed"|"message"|"agent_completed"} RuntimeSubagentActivityPhase
+ * `agent_started`/`agent_completed` bracket the delegation; `started`/`completed`
+ * bracket one child tool call; `message` carries optional child-only prose or
+ * thinking and must never be treated as parent answer text or a completed tool.
+ */
+
+/**
+ * @typedef {Object} RuntimeSubagentActivityEvent
+ * One normalized native or in-process subagent activity event.
+ * @property {"subagent_activity"} type
+ * @property {RuntimeSubagentIdentity} subagent
+ * @property {RuntimeSubagentActivityPhase} phase
+ * @property {string} id Unique activity-row id, namespaced from the canonical
+ *   `subagent.id` for lifecycle and tool rows.
+ * @property {string} [name]
+ * @property {*} [arguments]
+ * @property {*} [content]
+ * @property {"text"|"thinking"|"status"|"warning"|"error"} [kind] Present on a
+ *   `message` phase when known.
+ * @property {"assistant"|"user"} [role] Present on a `message` phase when known.
+ * @property {boolean} [isError]
+ * @property {number} [executionMs]
+ * @property {number} [totalTokens]
+ */
+
+/**
+ * @typedef {RuntimeSubagentActivityEvent | {type: string, [key: string]: *}} RuntimeEvent
+ * Structured runtime/telemetry event. Subagent activity uses the normalized
+ * shape above; every other event kind (tool_approval_pending,
+ * provider_failover_started, context_compaction, ...) adds its own fields.
  */
 
 /** @typedef {"uniform"|"per-route-native"} RuntimeRouteSafetyMode */
@@ -171,7 +241,20 @@
  * @property {"sequential"|"safe-parallel"} [piToolExecutionMode] Pi built-in tool scheduling mode. Safe parallelism is the default.
  * @property {"one-at-a-time"|"all"} [piToolParallelismMode] DEPRECATED. Compatibility alias mapped to piToolExecutionMode.
  * @property {Object} [settings] DEPRECATED. Legacy flat settings bag; consumed only as a per-group FALLBACK when the corresponding typed object (`toolLimits` / `compaction`) is absent. Consuming any key emits one `deprecated_settings_option` runtime_warning per run. Migrate via resolveRuntimePolicies (@mono-agent/runtime-adapter).
- * @property {Object} [nativeSubagents] Same-runtime teammate helpers exposed through native provider subagent surfaces.
+ * @property {ReadonlyArray<"user" | "project" | "local">} [settingSources] Claude Agent SDK only. Filesystem
+ *   settings the SDK may load for this run. Omitted/empty disables user, project, and local sources, including their
+ *   CLAUDE.md, hooks, plugins, and on-disk agent profiles. Anthropic managed settings remain in force and may still
+ *   configure hooks or plugins; this option is not a managed-policy bypass. Each opted-in source may execute configured
+ *   hooks and plugins, so enable only trusted settings and avoid these sources in an untrusted checkout. Include
+ *   `"project"`/`"user"` to let the native `Task` tool discover `.claude/agents` definitions. Unrecognized entries are
+ *   dropped. The Claude Code CLI bridge does not take this option: that binary performs its own settings discovery and
+ *   mono-agent passes no `--setting-sources`, so a CLI run already reads the host config regardless of this value.
+ * @property {boolean} [codexLoadProjectDocs] Codex app-server only. Omitted/false starts the managed app-server with
+ *   `project_doc_max_bytes=0`, preventing automatic repository-instruction discovery. True restores Codex's native
+ *   project-doc loading defaults. An explicit `codexAppServerArgs` array wins over this convenience option.
+ * @property {RuntimeNativeSubagentsOptions} [nativeSubagents] Caller-defined Claude native `Task` profiles. Direct
+ *   Codex owns its collaboration agents and rejects configured teammate definitions; `codexLoadProjectDocs` controls
+ *   whether Codex loads repository instructions for its own agents.
  * @property {RuntimeSubagentsOptions} [subagents] In-process `Agent` built-in: profiles, caps, and the nested-run callback.
  * @property {Object} [diagnosticsSeed] Set by createRouterRuntime (ai/runtime/router.js) with a `resume_snapshot` when
  *   failing over mid-chain; a host-level coordinator may relay it forward (see agent/transcript.js), not read by any
@@ -222,11 +305,14 @@
 
 /**
  * @typedef {Object} RuntimeInlineSubagentsOptions
- * Policy for subagents the model authors at call time rather than picking from
- * `definitions`. Absent suppresses authoring entirely.
+ * Policy for the runtime-owned general-purpose helper and subagents the model
+ * authors at call time rather than picking from `definitions`. Absent
+ * suppresses authoring entirely and leaves general-purpose on its safe default.
  * @property {boolean} [enabled] Only `false` turns authoring off.
- * @property {ReadonlyArray<string>} [allowedTools] Ceiling on what an authored subagent may
- *   request. Absent means the safe read-only default set, never every built-in.
+ * @property {ReadonlyArray<string>} [allowedTools] Ceiling on general-purpose's
+ *   read-only tools and what an authored subagent may request. Configured
+ *   definitions keep their explicit contracts. Absent means the safe read-only
+ *   default set, never every built-in.
  */
 
 /**
@@ -282,7 +368,9 @@
  * @property {boolean} [supports_skills]
  * @property {boolean} [supports_builtin_tools]
  * @property {boolean} [supports_live_input]
- * @property {boolean} [supports_native_subagents]
+ * @property {boolean} [supports_native_subagents] Whether the bridge exposes provider-native subagent surfaces and
+ *   normalized activity. This does not imply it accepts caller-defined `nativeSubagents`: Codex owns its collaboration
+ *   agents, while only the Claude bridges project caller-defined profiles.
  * @property {boolean} [supports_request_tool_environment]
  * @property {boolean} [supports_fast_mode]
  * @property {"projected"|"allow_all_only"} [tool_policy] Whether the bridge can

package/types/agent/tools/web-controller.d.ts

@@ -1,6 +1,8 @@
 /**
  * One ephemeral web-tool controller for one model run. It owns in-memory
- * deduplication, result caches, anonymous browser namespaces, and cleanup.
+ * deduplication, the fetch result cache, anonymous browser namespaces, and
+ * cleanup. Search results are the exception: they live in the process-wide
+ * cache above so sibling subagents and later turns can reuse them.
  *
  * @param {{searchConfig?: any, fetchConfig?: any, sandboxPolicy?: any, sandboxEngine?: any, ctx?: any, fetchImpl?: typeof fetch, browserRenderer?: any}} [options]
  */
@@ -18,3 +20,5 @@ export function createWebToolController({ searchConfig, fetchConfig, sandboxPoli
     fetch(params: any, execution?: {}): Promise<any>;
     close(): Promise<void>;
 };
+/** Test hook: the shared cache is module state and would leak between cases. */
+export function __resetSharedSearchCacheForTests(): void;

package/types/agent/tools/web-search.d.ts

@@ -68,9 +68,22 @@ export function performWebSearch({ query, limit, alternate_queries, domains, exc
         truncated: boolean;
         resultCount: number;
         providerFailureCount: number;
+        rateLimited: boolean;
+        cooldownBackends: string[];
     };
     error: boolean;
 }>;
+/**
+ * Test hook: restores the shipped throttle values and clears cooldown/spacing
+ * state. Module-scoped state would otherwise leak between test cases.
+ *
+ * @param {{maxConcurrency?: number, minSpacingMs?: number, cooldownMs?: number}} [overrides]
+ */
+export function __resetWebSearchThrottleForTests(overrides?: {
+    maxConcurrency?: number;
+    minSpacingMs?: number;
+    cooldownMs?: number;
+}): void;
 export function parseDuckDuckGoResults(html: any): {
     title: string;
     url: string;

package/types/ai/providers/claude-subagent-activity.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Correlate Claude's live native-agent stream into provider-neutral
+ * `subagent_activity` events.
+ *
+ * `observe()` returns `consumed: true` for every event owned by a native
+ * subagent. Provider bridges must not additionally forward or interpret those
+ * records as parent events. Non-agent background tasks are consumed without
+ * creating activity.
+ */
+export function createClaudeSubagentActivityNormalizer(): {
+    observe: (raw: Record<string, any>) => {
+        consumed: boolean;
+        events: {
+            type: string;
+            subagent: {
+                label?: any;
+                nativeId?: any;
+                id: any;
+                name: any;
+                callIndex: any;
+            };
+        }[];
+        forwarded?: undefined;
+    } | {
+        consumed: boolean;
+        events: {
+            type: string;
+            subagent: {
+                label?: any;
+                nativeId?: any;
+                id: any;
+                name: any;
+                callIndex: any;
+            };
+        }[];
+        forwarded: {
+            message: any;
+        };
+    };
+    /** Close every still-open child and its tools exactly once. */
+    drain(reason?: string): {
+        type: string;
+        subagent: {
+            label?: any;
+            nativeId?: any;
+            id: any;
+            name: any;
+            callIndex: any;
+        };
+    }[];
+    subagentInvoked: () => boolean;
+    nativeSubagentsUsed: () => any[];
+};

package/types/ai/providers/transport-errors.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Walk an error's `cause` chain and return the first transport-level code found.
+ * Returns null when the chain carries no code (i.e. nothing worth appending).
+ * @param {unknown} error
+ * @returns {string|null}
+ */
+export function describeErrorCause(error: unknown): string | null;
+/**
+ * Subscribe to undici's request-error channel. Idempotent and safe to call on
+ * every run; a Node build without the channel simply records nothing.
+ */
+export function installTransportErrorProbe(): void;
+/**
+ * Most recent transport error code seen within the correlation window.
+ * `ambiguous` is true when the window holds more than one distinct code, in
+ * which case attribution to a specific run would be a guess.
+ * @param {{withinMs?: number, now?: number}} [opts]
+ * @returns {{code: string, ambiguous: boolean}|null}
+ */
+export function recentTransportErrorCode(opts?: {
+    withinMs?: number;
+    now?: number;
+}): {
+    code: string;
+    ambiguous: boolean;
+} | null;
+/**
+ * Append the underlying transport reason to an otherwise contentless provider
+ * error. Descriptive messages, and messages that already name their cause, are
+ * returned unchanged.
+ *
+ * @param {string|null} message normalized provider error text
+ * @param {unknown} [error] the original Error, when it survived
+ * @returns {{message: string|null, causeCode: string|null, causeSource: "cause_chain"|"transport_probe"|null}}
+ */
+export function annotateProviderErrorMessage(message: string | null, error?: unknown): {
+    message: string | null;
+    causeCode: string | null;
+    causeSource: "cause_chain" | "transport_probe" | null;
+};
+/** Test seam: drop recorded transport errors. */
+export function resetTransportErrorProbeForTests(): void;
+/** Test seam: record a transport error without a real socket. */
+export function recordTransportErrorForTests(code: any, at?: number): void;

package/types/ai/runtime/router.d.ts

@@ -73,5 +73,14 @@ export type RouterAttemptResolution = {
     options?: {
         [x: string]: any;
     };
+    /**
+     * Provider-specific projection of the logical tool policy. This deliberately
+     * cannot replace any other protected request field.
+     */
+    policyOptions?: {
+        allowedTools?: ReadonlyArray<string>;
+        disallowedTools?: ReadonlyArray<string>;
+        permissionMode?: string;
+    };
     cleanup?: () => (void | Promise<void>);
 };