@namzu/sdk 49.0.0 → 50.0.0

package/src/types/harness/session.ts

@@ -0,0 +1,306 @@
+import type { ReviewMode } from '../../runtime/query/review-policy.js'
+import type { SessionLog } from '../../store/session-log/index.js'
+/**
+ * A session whose execution and tools belong to a host-composed external harness.
+ * SDK code contains no vendor import, process runner or credential discovery.
+ * Existing Namzu query/LLMProvider/tool execution is unchanged.
+ */
+import type {
+	MessageId,
+	ProjectId,
+	SessionId,
+	TenantId,
+	ToolUseId,
+	TopicId,
+	TurnId,
+} from '../ids/index.js'
+import type { Message } from '../message/index.js'
+import type { ReasoningEffort } from '../provider/index.js'
+import type { SessionEvent } from '../session/events.js'
+
+export type HarnessJson =
+	| null
+	| boolean
+	| number
+	| string
+	| readonly HarnessJson[]
+	| { readonly [key: string]: HarnessJson }
+
+/** Native IDs remain opaque strings and are NEVER parsed as Namzu UUIDs. */
+export interface HarnessBinding {
+	readonly v: 1
+	readonly engineId: string
+	/** Host-owned opaque identity for executable/state-home/account selection; no credentials. */
+	readonly profileRef: string
+	/** Exact native conversation/thread identifier, not a shared root or Namzu session ID. */
+	readonly nativeSessionId: string
+	/** Canonical absolute native execution directory, confirmed by the adapter. */
+	readonly cwd: string
+	/** Verified initial selection; later changes are captured per turn, never engine changes. */
+	readonly initialModel: string
+}
+
+export interface HarnessScope {
+	readonly sessionId: SessionId
+	readonly tenantId: TenantId
+	readonly projectId: ProjectId
+	readonly topicId: TopicId
+	readonly cwd: string
+}
+
+/** Values established from the installed engine/protocol, never copied from Namzu providers. */
+export interface HarnessCapabilities {
+	readonly persistentSessions: boolean
+	readonly history: 'snapshot' | 'unavailable'
+	readonly models: 'discover' | 'configured' | 'unavailable'
+	readonly permissions: 'interactive' | 'deny-only' | 'unavailable'
+	readonly interrupt: 'native-terminal' | 'process-stop' | 'unavailable'
+	readonly attachments: readonly ('image' | 'file')[]
+	readonly effortLevels?: readonly ReasoningEffort[]
+	/** Common UI may offer only modes actually mapped by this engine. */
+	readonly reviewModes: readonly ReviewMode[]
+}
+
+export interface HarnessModel {
+	readonly id: string
+	readonly label: string
+	readonly effortLevels?: readonly ReasoningEffort[]
+	readonly defaultEffort?: ReasoningEffort
+}
+
+export interface HarnessNativeTurn {
+	readonly nativeSessionId: string
+	readonly nativeTurnId: string
+	/** Explicit operation correlation when the engine exposes no native turn ID. */
+	readonly turnIdSource?: 'engine' | 'operation'
+}
+
+export interface HarnessNativeItem extends HarnessNativeTurn {
+	readonly nativeItemId: string
+}
+
+export interface HarnessPublicTextPart {
+	readonly id: string
+	readonly text: string
+	readonly phase?: 'commentary' | 'final_answer'
+}
+
+export type HarnessDecision =
+	| { readonly kind: 'approve-once'; readonly updatedInput?: HarnessJson }
+	| { readonly kind: 'reject'; readonly feedback?: string }
+	| { readonly kind: 'cancel' }
+
+export interface HarnessReviewRequest extends HarnessNativeTurn {
+	readonly requestId: string
+	readonly nativeItemId?: string
+	readonly kind: 'command' | 'file-change' | 'tool'
+	readonly title: string
+	/** Public proposed operation only. No raw RPC frame, credentials or private thinking. */
+	readonly input: HarnessJson
+	readonly decisions: readonly HarnessDecision['kind'][]
+}
+
+/** A NEW, namespaced port union. No new existing SessionEvent discriminants. */
+export type HarnessEvent =
+	| (HarnessNativeTurn & { readonly kind: 'turn-started'; readonly model?: string })
+	| (HarnessNativeItem & { readonly kind: 'message-started' })
+	| (HarnessNativeItem & {
+			readonly kind: 'text-delta'
+			readonly text: string
+			readonly part?: Pick<HarnessPublicTextPart, 'id' | 'phase'>
+	  })
+	| (HarnessNativeItem & {
+			readonly kind: 'message-completed'
+			readonly content: string
+			readonly parts?: readonly HarnessPublicTextPart[]
+			readonly stopReason: import('../session/stop-reason.js').MessageStopReason
+	  })
+	| (HarnessNativeItem & {
+			readonly kind: 'reasoning'
+			readonly blockId: string
+			readonly status: 'pending' | 'completed'
+			/** Only engine-documented public summary/thinking; never replay/signature material. */
+			readonly text?: string
+	  })
+	| (HarnessNativeItem & {
+			readonly kind: 'tool-started'
+			readonly name: string
+			readonly input: HarnessJson
+	  })
+	| (HarnessNativeItem & { readonly kind: 'tool-output'; readonly text: string })
+	| (HarnessNativeItem & {
+			readonly kind: 'tool-completed'
+			readonly name: string
+			readonly result: string
+			readonly status: 'completed' | 'failed' | 'declined' | 'cancelled'
+			readonly durationMs?: number
+	  })
+	| { readonly kind: 'review-requested'; readonly request: HarnessReviewRequest }
+	| (HarnessNativeTurn & { readonly kind: 'review-resolved'; readonly requestId: string })
+	| (HarnessNativeTurn & {
+			readonly kind: 'turn-completed'
+			readonly status: 'completed' | 'failed' | 'cancelled'
+			readonly finalItemId?: string
+			readonly result?: string
+			readonly error?: { readonly code: string; readonly message: string }
+	  })
+	| {
+			readonly kind: 'connection-lost'
+			readonly code: string
+			/** True never implies that native work stopped. */
+			readonly mayBeRunning: boolean
+	  }
+
+/** Resolve after validation/persistence/publication, never await a human answer here. */
+export type HarnessEventSink = (event: HarnessEvent) => Promise<void>
+
+export interface HarnessPrompt {
+	/** Actual host operation identity for this admitted prompt, persisted before send. */
+	readonly operationId: string
+	readonly prompt: string
+	readonly model: string
+	readonly effort?: ReasoningEffort
+	readonly permissionMode: ReviewMode
+	readonly signal?: AbortSignal
+}
+
+export interface HarnessHistorySnapshot {
+	readonly binding: HarnessBinding
+	readonly activeTurn?: HarnessNativeTurn
+	/** Authoritative lifecycle/items, not byte-for-byte replay of ephemeral deltas. */
+	readonly events: readonly Exclude<
+		HarnessEvent,
+		{ readonly kind: 'text-delta' | 'tool-output' | 'connection-lost' }
+	>[]
+	readonly pendingReviews: readonly HarnessReviewRequest[]
+	readonly complete: boolean
+}
+
+export interface HarnessConnection {
+	readonly binding: HarnessBinding
+	readonly capabilities: HarnessCapabilities
+	models(signal?: AbortSignal): Promise<readonly HarnessModel[]>
+	/** ACK may follow terminal event. It must not resurrect a finished turn. */
+	dispatch(input: HarnessPrompt): Promise<HarnessNativeTurn>
+	/** Receipt means requested only; SDK waits for correlated terminal/confirmed owned stop. */
+	interrupt(turn: HarnessNativeTurn): Promise<{ readonly requested: true }>
+	/** Validate exact current native request, then send one of that request's decisions. */
+	respond(
+		request: HarnessReviewRequest,
+		decision: HarnessDecision,
+	): Promise<{ readonly sent: true }>
+	/** Never resends a prompt. Absence/incomplete history leaves explicit reconciliation required. */
+	readHistory(signal?: AbortSignal): Promise<HarnessHistorySnapshot>
+	/** Success confirms own process/children stopped; rejection retains handle for retry. */
+	close(): Promise<{ readonly stopped: true }>
+}
+
+export interface HarnessAdapter {
+	readonly engineId: string
+	readonly profileRef: string
+	/** Subscribe BEFORE spawn/initialize/open/resume so early items/requests cannot be lost. */
+	open(
+		input: {
+			readonly cwd: string
+			readonly model?: string
+			readonly resume?: HarnessBinding
+			readonly signal?: AbortSignal
+		},
+		onEvent: HarnessEventSink,
+	): Promise<HarnessConnection>
+}
+
+export interface HarnessAdmissionRequest {
+	readonly kind: 'open' | 'run' | 'approval' | 'reconnect'
+	readonly scope: HarnessScope
+	readonly binding?: HarnessBinding
+	readonly nativeTurn?: HarnessNativeTurn
+	readonly review?: HarnessReviewRequest
+}
+
+export interface HarnessSessionOptions {
+	readonly scope: HarnessScope
+	readonly sessionLog: SessionLog
+	readonly adapter: HarnessAdapter
+	/** REQUIRED current trusted host boundary: canonical cwd/trust/user ownership, ordinary only. */
+	readonly assertAdmission: (
+		request: HarnessAdmissionRequest,
+		signal?: AbortSignal,
+	) => Promise<void>
+	readonly onEvent: (event: SessionEvent) => void | Promise<void>
+	readonly onReview: (request: HarnessReviewRequest) => void | Promise<void>
+}
+
+export interface HarnessTurnOutcome {
+	readonly turnId: TurnId
+	readonly nativeTurn: HarnessNativeTurn
+	readonly status: 'completed' | 'failed' | 'cancelled'
+	readonly messages: readonly Message[]
+}
+
+export interface HarnessSession {
+	readonly scope: HarnessScope
+	readonly binding: HarnessBinding | undefined
+	/** Exact admitted turn pointer for host cancellation; never a model-supplied ID. */
+	readonly currentTurnId: TurnId | undefined
+	readonly status:
+		| 'disconnected'
+		| 'idle'
+		| 'running'
+		| 'waiting'
+		| 'reconciliation-required'
+		| 'closed'
+	/** Public durable text only; no native process startup. */
+	history(): Promise<readonly Message[]>
+	/** Reject concurrent turn operations. CLI/desktop owns its visible queue. */
+	run(input: Omit<HarnessPrompt, 'operationId'>): Promise<HarnessTurnOutcome>
+	/** Exact expected turn pointer prevents a stale Stop from cancelling the next turn. */
+	cancel(expectedTurnId: TurnId): Promise<{ readonly stopped: true; readonly turnId: TurnId }>
+	/** SDK adds current writer generation/request digest internally; renderer cannot supply authority. */
+	respond(request: HarnessReviewRequest, decision: HarnessDecision): Promise<void>
+	reconnect(signal?: AbortSignal): Promise<void>
+	close(): Promise<void>
+}
+
+/** Typed journal receipts stored in the existing session_updated record. */
+export type HarnessJournalTransition =
+	| {
+			readonly kind: 'dispatch-prepared'
+			/** Actual admitted selection; engine binding remains immutable. */
+			readonly model?: string
+			readonly effort?: ReasoningEffort
+			readonly permissionMode?: ReviewMode
+			readonly operationId: string
+			readonly turnId: TurnId
+			readonly promptId: MessageId
+			readonly digest: string
+	  }
+	| {
+			readonly kind: 'dispatch-accepted'
+			readonly operationId: string
+			readonly turnId: TurnId
+			readonly nativeTurn: HarnessNativeTurn
+	  }
+	| {
+			readonly kind: 'item-bound'
+			readonly turnId: TurnId
+			readonly nativeItem: HarnessNativeItem
+			readonly messageId?: MessageId
+			readonly toolUseId?: ToolUseId
+	  }
+	| {
+			readonly kind: 'review-requested'
+			readonly turnId: TurnId
+			readonly request: HarnessReviewRequest
+			readonly digest: string
+	  }
+	| {
+			readonly kind: 'review-decided'
+			readonly turnId: TurnId
+			readonly requestId: string
+			readonly requestDigest: string
+			readonly decisionDigest: string
+			readonly decision: HarnessDecision
+	  }
+	| { readonly kind: 'review-resolved'; readonly turnId: TurnId; readonly requestId: string }
+	| { readonly kind: 'connection-lost'; readonly turnId?: TurnId; readonly code: string }

package/src/types/hitl/index.ts

@@ -3,6 +3,12 @@ import type { CheckpointId, PlanId, SessionId, TurnId } from '../ids/index.js'
 
 export type { CheckpointId }
 
+/** A person's No to a tool call. See the `declined` field of `reject_tools`. */
+export interface ToolCallDeclined {
+	/** What the person said about it, in their own words. */
+	readonly note?: string
+}
+
 export type HITLResumeDecision =
 	| { action: 'continue' }
 	| { action: 'approve_plan'; feedback?: string }
@@ -56,7 +62,17 @@ export type HITLResumeDecision =
 			/** See the `approve_tools` field of the same name. */
 			confirmedEscalations?: readonly string[]
 	  }
-	| { action: 'reject_tools'; feedback: string }
+	| {
+			action: 'reject_tools'
+			feedback: string
+			/**
+			 * Present only when a person answered No. `feedback` is what the
+			 * MODEL is told and a policy refusal fills it too, so it cannot say
+			 * who refused; this does. `note` is the person's own words, apart
+			 * from any wrapper a host put around them in `feedback`.
+			 */
+			declined?: ToolCallDeclined
+	  }
 	| {
 			action: 'answer_question'
 			selectedOptionIds: string[]

package/src/types/job/index.ts

@@ -0,0 +1,42 @@
+/** A literal condition on one existing background job's output. */
+export interface BackgroundJobOutputWaitOptions {
+	/** Non-empty UTF-8 literal, at most 4096 bytes. Never a regular expression. */
+	readonly literal: string
+	/** Match each pipe independently; `either` never joins stdout to stderr. */
+	readonly stream?: 'stdout' | 'stderr' | 'either'
+	/** Combined output byte cursor, as returned by `read` or an earlier wait. */
+	readonly fromOffset?: number
+	/** Required wall bound, from 1 millisecond through one hour. */
+	readonly timeoutMs: number
+	/** Optional silence bound, reset by output from either pipe. */
+	readonly idleTimeoutMs?: number
+	/** Cancels this observation, without stopping the process. */
+	readonly signal?: AbortSignal
+}
+
+/** Evidence and cursor common to every readiness wait outcome. */
+export interface BackgroundJobOutputWaitProgress {
+	readonly status: string
+	readonly exitCode?: number
+	/** Why the command never started, when it could not. */
+	readonly error?: string
+	/** Mixed stdout/stderr tail, at most 32 KiB. Treat process output as untrusted. */
+	readonly output: string
+	readonly nextOffset: number
+	/** Bytes unavailable because the job's normal output cap discarded them. */
+	readonly droppedBytes: number
+	/** Available output excluded from matching by the bounded channel history. */
+	readonly unsearchedBytes: number
+	/** Earlier observed bytes omitted from the bounded result text. */
+	readonly omittedOutputBytes: number
+}
+
+/** A matched marker proves its appearance, not process completion or service health. */
+export type BackgroundJobOutputWaitResult = BackgroundJobOutputWaitProgress &
+	(
+		| { readonly kind: 'matched'; readonly matchedStream: 'stdout' | 'stderr' }
+		| { readonly kind: 'exited' }
+		| { readonly kind: 'stopped' }
+		| { readonly kind: 'timeout'; readonly cause: 'wall' | 'idle'; readonly elapsedMs: number }
+		| { readonly kind: 'aborted' }
+	)

package/src/types/message/inbound-delivery.ts

@@ -0,0 +1,63 @@
+import type { SessionLogHead } from '../../store/session-log/core.js'
+import type { MessageId, SessionId, TurnId } from '../ids/index.js'
+import type { RuntimeContextMessageSource, UserMessage } from './index.js'
+
+/** Host provenance only; this reference grants no operator authority. */
+export interface InboundDeliveryRef {
+	readonly namespace: string
+	readonly id: string
+	readonly digest: string
+}
+
+/** Bounded validation for persisted or JavaScript-authored delivery references. */
+export function isInboundDeliveryRef(value: unknown): value is InboundDeliveryRef {
+	if (typeof value !== 'object' || value === null || Array.isArray(value)) return false
+	const candidate = value as Record<string, unknown>
+	return ['namespace', 'id', 'digest'].every((key) => {
+		const field = candidate[key]
+		return (
+			typeof field === 'string' &&
+			field.length > 0 &&
+			field.length <= 512 &&
+			[...field].every(
+				(character) => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127,
+			)
+		)
+	})
+}
+
+/** Durable delivery carries host context and cannot acquire operator authority. */
+export type DurableInboundMessage = UserMessage & {
+	readonly source: RuntimeContextMessageSource & {
+		readonly kind: Exclude<RuntimeContextMessageSource['kind'], 'steering'>
+		readonly deliveryRef: InboundDeliveryRef
+	}
+}
+
+export interface InboundDeliveryClaim {
+	readonly claimId: string
+	readonly ref: InboundDeliveryRef
+	readonly message: DurableInboundMessage
+}
+
+/** Exact ordinary session-log append, flushed before the host acknowledges it. */
+export interface InboundDeliveryReceipt {
+	readonly claimId: string
+	readonly ref: InboundDeliveryRef
+	readonly sessionId: SessionId
+	readonly turnId: TurnId
+	readonly messageId: MessageId
+	readonly through: SessionLogHead
+}
+
+/** Host-owned durable input. Claim, write and acknowledgement failures stop execution. */
+export interface DurableInboundSource {
+	claim(context: {
+		readonly sessionId: SessionId
+		readonly turnId: TurnId
+		readonly signal: AbortSignal
+	}): Promise<readonly InboundDeliveryClaim[]>
+	recorded(receipts: readonly InboundDeliveryReceipt[]): Promise<void>
+	/** Wake only. An aborted wait must remove its listener. */
+	wait?(signal: AbortSignal): Promise<void>
+}

package/src/types/message/index.ts

@@ -1,4 +1,5 @@
 import type { GoalId, MessageId } from '../ids/index.js'
+import { type InboundDeliveryRef, isInboundDeliveryRef } from './inbound-delivery.js'
 
 export type MessageRole = 'system' | 'user' | 'assistant' | 'tool'
 
@@ -350,6 +351,8 @@ export const RUNTIME_CONTEXT_MESSAGE_KINDS = [
 	'advisory',
 	'answer-review',
 	'auto-continuation',
+	'channel-message',
+	'host-observation',
 	'job-exit',
 	'limit-finalization',
 	'peer-message',
@@ -367,6 +370,8 @@ export type RuntimeContextMessageKind = (typeof RUNTIME_CONTEXT_MESSAGE_KINDS)[n
 export interface RuntimeContextMessageSource {
 	readonly type: 'runtime-context'
 	readonly kind: RuntimeContextMessageKind
+	/** Optional durable host delivery identity; it never grants operator authority. */
+	readonly deliveryRef?: InboundDeliveryRef
 }
 
 export type UserMessageSource =
@@ -422,11 +427,13 @@ export function isRuntimeContextMessageSource(
 	const candidate = value as {
 		readonly type?: unknown
 		readonly kind?: unknown
+		readonly deliveryRef?: unknown
 	}
 	return (
 		candidate.type === 'runtime-context' &&
 		typeof candidate.kind === 'string' &&
-		(RUNTIME_CONTEXT_MESSAGE_KINDS as readonly string[]).includes(candidate.kind)
+		(RUNTIME_CONTEXT_MESSAGE_KINDS as readonly string[]).includes(candidate.kind) &&
+		(candidate.deliveryRef === undefined || isInboundDeliveryRef(candidate.deliveryRef))
 	)
 }
 

package/src/types/sandbox/index.ts

@@ -226,6 +226,12 @@ export interface SandboxDetachedProcess {
 	readonly child: import('node:child_process').ChildProcess
 	/** Signal everything the sandbox started for this process, inside the boundary and out. */
 	kill(signal: NodeJS.Signals): void
+	/**
+	 * Stop and confirm the entire owned process tree ended. Remote wrappers
+	 * provide this when closing the host child alone cannot prove guest exit.
+	 * Reject on an unconfirmed stop; retain ownership so the caller can retry.
+	 */
+	terminate?(signal?: NodeJS.Signals): Promise<void>
 }
 
 export interface SandboxSpawnOptions {
@@ -233,6 +239,39 @@ export interface SandboxSpawnOptions {
 	readonly env?: Record<string, string>
 }
 
+/** Host-selected guest process options; never inherits the operator environment. */
+export interface SandboxStdioOptions extends SandboxSpawnOptions {
+	readonly signal?: AbortSignal
+	/** Rechecked at admission and before every write/operation, e.g. Pal writer/lifetime. */
+	readonly assertExecutionAllowed?: () => void | Promise<void>
+}
+
+export interface SandboxStdioEvent {
+	readonly stream: 'stdout' | 'stderr'
+	readonly data: Uint8Array
+}
+
+/** A trusted host's ownership barrier for one application request. */
+export interface SandboxStdioOperation {
+	/** Call only after an exact application reply, or before dispatch was attempted. */
+	complete(): void
+	/** Permanently fence this allocation until computer stop. Never replay the request. */
+	outcomeUnknown(): void
+}
+
+/** Interactive pipes for an allocation-owned guest process, not a host child. */
+export interface SandboxStdioChannel {
+	/** One bounded, backpressured consumer. Bytes preserve binary and UTF-8 boundaries. */
+	readonly events: AsyncIterable<SandboxStdioEvent>
+	write(data: string | Uint8Array, signal?: AbortSignal): Promise<void>
+	/** Idle services do not prevent takeover; each actual request must hold this barrier. */
+	beginOperation(signal?: AbortSignal): Promise<SandboxStdioOperation>
+	/** Confirm this server's process group stopped; does not quiesce external applications. */
+	close(): Promise<void>
+	/** Resolves only on confirmed process-group exit; rejects on lost confirmation. */
+	readonly closed: Promise<void>
+}
+
 /**
  * One host-side end of a TCP connection opened from inside the sandbox.
  *
@@ -310,6 +349,13 @@ export interface Sandbox {
 		opts?: SandboxSpawnOptions,
 	): SandboxDetachedProcess
 
+	/** Optional interactive guest stdio. Never falls back to a host subprocess. */
+	openStdio?(
+		command: string,
+		args?: readonly string[],
+		options?: SandboxStdioOptions,
+	): Promise<SandboxStdioChannel>
+
 	/**
 	 * Narrow or widen what this sandbox can reach, while it is running.
 	 *

package/src/types/session/checkpoint.ts

@@ -40,12 +40,14 @@ export interface Checkpoint {
 	/**
 	 * Review corrections already consumed at this checkpoint, independent of
 	 * compactable history: host structured-output review, prose-answer review
-	 * and native structured-output correction.
+	 * and tool/native structured-output correction.
 	 */
 	readonly review: {
 		readonly structuredAttempts: number
 		readonly answerAttempts: number
 		readonly nativeStructuredAttempts: number
+		/** Tool-output corrections; absent in older v1 checkpoints and restored as zero. */
+		readonly toolStructuredAttempts?: number
 	}
 	/** The turn's current operator/goal/steering message, independent of compaction. */
 	readonly latestUserMessageId?: MessageId
@@ -120,6 +122,7 @@ export const CheckpointSchema = z
 				structuredAttempts: count,
 				answerAttempts: count,
 				nativeStructuredAttempts: count,
+				toolStructuredAttempts: count.optional(),
 			})
 			.strict(),
 		latestUserMessageId: id<MessageId>('message').optional(),

package/src/types/session/events.ts

@@ -18,7 +18,7 @@ import type { Message } from '../message/index.js'
 import type { PlanStep } from '../plan/index.js'
 import type { PluginHookEvent, PluginHookResult } from '../plugin/index.js'
 import type { TaskStatus } from '../task/index.js'
-import type { ToolResultView } from '../tool/presentation.js'
+import type { ToolFacts, ToolResultView } from '../tool/presentation.js'
 import type { CancelCause } from './cancel-cause.js'
 import type { FencingToken } from './durable.js'
 import type { Lineage } from './lineage.js'
@@ -416,12 +416,30 @@ type CoreSessionEvent =
 			type: 'tool_completed'
 			/** Bounded result view; omitted when output was overridden or truncated. */
 			presentation?: ToolResultView
+			/**
+			 * What a saved conversation keeps of a call that has no diff: one
+			 * label line (or a command's first line), never the output. Live
+			 * hosts ignore it and draw the real result.
+			 */
+			savedPresentation?: ToolResultView
+			/**
+			 * What the call did, as typed fields for the person's view (see
+			 * `ToolResult.facts`). Absent when a post-tool hook replaced the
+			 * output, so a redaction is never undone by a structured copy.
+			 */
+			facts?: ToolFacts
 			sessionId: SessionId
 			turnId: TurnId
 			toolUseId: ToolUseId
 			toolName: string
 			result: string
 			isError: boolean
+			/** Executor-classified provider argument failure; absent for host policy, rewrites and cancellation. */
+			inputFailure?: 'invalid_json' | 'schema_validation' | 'input_truncated'
+			/** Execution was deliberately skipped by a pre-tool hook; a non-error receipt, not a produced output. */
+			skipped?: true
+			/** Opt-in successful structured_output JSON after screening and post-tool hooks, before preview capping. Not an accepted result. */
+			structuredResultJson?: string
 			/** See {@link tool_executing}'s `via`. Carried on both, so a
 			 * consumer can pair them without holding the start event. */
 			via?: {
@@ -939,6 +957,8 @@ type CoreSessionEvent =
 			 */
 			blockedBy?: readonly TaskId[]
 			owner?: string
+			/** The present-continuous form the model gave ("Running the tests"); absent when it gave none. */
+			activeForm?: string
 	  }
 	| {
 			type: 'task_updated'
@@ -950,6 +970,8 @@ type CoreSessionEvent =
 			owner?: string
 			/** See `task_created`. Carried on updates because an edge can be added later. */
 			blockedBy?: readonly TaskId[]
+			/** See `task_created`. */
+			activeForm?: string
 			/**
 			 * The task was removed from the list (`task_update` with status
 			 * `deleted`). `status` and `subject` are what it had when it went.