@opengeni/worker-bundle 2.2.0 → 2.2.1-canary.36927100590001

package/dist/activities.d.ts

@@ -20,6 +20,21 @@ export declare function createActivityTestHarness(dependencies?: ActivityDepende
     } | null>;
     reconcileCodexCapacityWait: (input: import("./activities.js").ReconcileCodexCapacityWaitInput) => Promise<import("./activities.js").ReconcileCodexCapacityWaitResult>;
     maintainBrowserStateArtifacts: () => Promise<import("./activities/browser-state-artifact-reaper.js").MaintainBrowserStateArtifactsResult>;
+    listDueBrowserCheckpoints(): Promise<{
+        accountId: string;
+        workspaceId: string;
+        sandboxGroupId: string;
+        leaseId: string;
+        leaseEpoch: number;
+        instanceId: string;
+        browserSessionId: string;
+        controllerGeneration: string;
+    }[]>;
+    checkpointBrowserBeforeDeadline(target: import("@opengeni/db").BrowserDeadlineCheckpointTarget): Promise<{
+        status: "skipped";
+    } | {
+        status: "suspended";
+    }>;
     settleAutomationRunFailure: (input: import("./activities.js").DispatchAutomationRunInput) => Promise<void>;
     dispatchAutomationRun: (input: import("./activities.js").DispatchAutomationRunInput) => Promise<import("./activities.js").DispatchAutomationRunResult>;
     indexDocument: (input: import("./activities.js").IndexDocumentInput) => Promise<{
@@ -368,6 +383,21 @@ export declare const getCodexCapacityWait: (input: import("./activities.js").Get
 } | null>;
 export declare const reconcileCodexCapacityWait: (input: import("./activities.js").ReconcileCodexCapacityWaitInput) => Promise<import("./activities.js").ReconcileCodexCapacityWaitResult>;
 export declare const prepareSandboxLeaseSweep: () => Promise<import("./activities/sandbox-lease.js").SandboxLeaseSweepPlan>;
+export declare const listDueBrowserCheckpoints: () => Promise<{
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    leaseId: string;
+    leaseEpoch: number;
+    instanceId: string;
+    browserSessionId: string;
+    controllerGeneration: string;
+}[]>;
+export declare const checkpointBrowserBeforeDeadline: (target: import("@opengeni/db").BrowserDeadlineCheckpointTarget) => Promise<{
+    status: "skipped";
+} | {
+    status: "suspended";
+}>;
 export declare const drainSandboxLease: (input: import("./sandbox-reaper-contract.js").SandboxDrainActivityInput) => Promise<import("./activities/sandbox-lease.js").SandboxDrainActivityResult>;
 export declare const maintainSandboxLeaseSweep: (input: import("./sandbox-reaper-contract.js").SandboxLeaseSweepMaintenanceInput) => Promise<import("./activities/sandbox-lease.js").SandboxLeaseSweepMaintenanceResult>;
 export declare const reapSandboxLeases: () => Promise<import("./activities/sandbox-lease.js").ReapSandboxLeasesResult>;

package/dist/browser-deadline-checkpoint-contract.d.ts

@@ -0,0 +1,2 @@
+export declare const BROWSER_DEADLINE_CHECKPOINT_SWEEP_ID = "opengeni-browser-deadline-checkpoints-v1";
+export declare function browserDeadlineCheckpointTaskQueue(base: string): string;

package/dist/{chunk-RZAAGRFQ.js → chunk-4PJTUBWQ.js}

@@ -1,6 +1,6 @@
 import {
   observabilityEventBusOptions
-} from "./chunk-IJZU752L.js";
+} from "./chunk-YG27NEMX.js";
 
 // src/activity-services.ts
 import {
@@ -1242,7 +1242,8 @@ function createDocumentActivities(services, resolveDocumentServices) {
 // src/activities/goals.ts
 import {
   allowedFirstPartyMcpToolsForSession,
-  configuredStaticUsageLimits,
+  configuredStaticUsageLimits as configuredStaticUsageLimits2,
+  isModelAvailableForNewSelection,
   policyProviderIdForModel,
   resolveModelProvider,
   resolveTurnExecutionPolicyV1,
@@ -1253,24 +1254,106 @@ import {
 } from "@opengeni/config";
 import {
   evaluateWorkspaceModelPolicy,
-  mergeToolRefs
+  mergeToolRefs,
+  readTurnExecutionPolicyV1 as readTurnExecutionPolicyV12
 } from "@opengeni/contracts";
 import { isCodexBilledModel } from "@opengeni/codex";
 import {
   enqueueSessionWorkflowWakeIfRunnable,
-  getBillingBalance,
   getWorkspaceModelPolicy,
   getSessionGoal,
-  isCodexBilledTurn,
+  getSessionTurn,
   materializeGoalContinuation,
-  requireSession,
-  sumUsageQuantity
+  requireSession
 } from "@opengeni/db";
 import {
-  modelFundingForAdmission,
+  modelFundingForAdmission as modelFundingForAdmission2,
   resolveCatalogSettings as resolveCatalogSettings2,
   resolveWorkspaceCatalogSettings
 } from "@opengeni/core";
+
+// src/activities/agent-run-admission.ts
+import { configuredStaticUsageLimits } from "@opengeni/config";
+import { modelFundingForAdmission } from "@opengeni/core";
+import {
+  checkWorkspaceAllowance,
+  getBillingBalance,
+  isCodexBilledTurn,
+  sumUsageQuantity
+} from "@opengeni/db";
+async function agentRunAdmissionDenial(services, input) {
+  const codexBilled = await isCodexBilledTurn({
+    db: services.db,
+    settings: services.settings,
+    workspaceId: input.workspaceId,
+    model: input.model
+  });
+  const externallyBilled = modelFundingForAdmission(
+    services.settings,
+    input.model,
+    codexBilled
+  ).fundedWithoutCredits;
+  if (!externallyBilled && (services.settings.billingMode === "stripe" || services.settings.usageLimitsMode === "managed")) {
+    if (services.entitlements) {
+      const decision = await services.entitlements.admitRun({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        action: "agent_run:create",
+        quantity: input.requestedAgentRuns
+      });
+      if (!decision.allowed) return "insufficient_credits";
+    } else {
+      const balance = await getBillingBalance(services.db, input.accountId);
+      if (balance.balanceMicros <= 0) return "insufficient_credits";
+    }
+  }
+  if (!externallyBilled) {
+    const refusal = await checkWorkspaceAllowance(services.db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.initiatingHumanSubjectId ?? null
+    });
+    if (refusal) return refusal.code;
+  }
+  if (services.settings.usageLimitsMode !== "static" && services.settings.usageLimitsMode !== "managed") {
+    return null;
+  }
+  const limits = configuredStaticUsageLimits(services.settings);
+  if (!externallyBilled && limits.maxMonthlyCostMicrosPerAccount) {
+    const used = await sumUsageQuantity(services.db, {
+      accountId: input.accountId,
+      eventType: "model.cost",
+      since: startOfUtcMonth()
+    });
+    if (used >= limits.maxMonthlyCostMicrosPerAccount) {
+      return "monthly_model_cost_limit";
+    }
+  }
+  if (limits.maxMonthlyAgentRunsPerWorkspace) {
+    const used = await sumUsageQuantity(services.db, {
+      workspaceId: input.workspaceId,
+      eventType: "agent_run.created",
+      since: startOfUtcMonth()
+    });
+    if (used + input.requestedAgentRuns > limits.maxMonthlyAgentRunsPerWorkspace) {
+      return "monthly_agent_run_limit";
+    }
+  }
+  return null;
+}
+function startOfUtcMonth() {
+  const now = /* @__PURE__ */ new Date();
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+}
+
+// src/activities/agent-turn/credential-restriction.ts
+import { readTurnExecutionPolicyV1 } from "@opengeni/contracts";
+function turnCredentialRestriction(acceptedPolicy, initialSessionMetadata) {
+  const initialPolicy = readTurnExecutionPolicyV1(initialSessionMetadata);
+  return acceptedPolicy.credentialRestriction === "developer_setup" || initialPolicy.kind === "valid" && initialPolicy.policy.credentialRestriction === "developer_setup" ? "developer_setup" : void 0;
+}
+
+// src/activities/goals.ts
 function createGoalActivities(services) {
   async function enqueueGoalRetryWake(input) {
     const { db } = await services();
@@ -1293,8 +1376,11 @@ function createGoalActivities(services) {
     if (!existingGoal || existingGoal.status !== "active") {
       return { action: "none" };
     }
-    let settings = (await resolveCatalogSettings2(db, catalogSourceSettings)).settings;
     const session = await requireSession(db, input.workspaceId, input.sessionId);
+    if (session.status === "failed" || session.status === "cancelled") {
+      return { action: "none" };
+    }
+    let settings = (await resolveCatalogSettings2(db, catalogSourceSettings)).settings;
     const inheritedContinuationModel = session.model;
     let continuationModel = inheritedContinuationModel;
     const continuationReasoningEffort = session.reasoningEffort;
@@ -1317,25 +1403,7 @@ function createGoalActivities(services) {
     if (!modelPolicyBlocked && session.codexCompactionMode === "remote_v2" && !isCodexBilledModel(continuationModel)) {
       modelPolicyBlocked = `session is locked to Codex remote compaction v2; model "${continuationModel}" is not a Codex subscription model`;
     }
-    const isCodexRun = await isCodexBilledTurn({
-      db,
-      settings,
-      workspaceId: input.workspaceId,
-      model: continuationModel
-    });
-    const fundedWithoutCredits = goalContinuationFundedWithoutCredits(
-      settings,
-      continuationModel,
-      isCodexRun
-    );
-    const budgetBlocked = await goalRunBudgetBlocked(
-      settings,
-      db,
-      input.accountId,
-      input.workspaceId,
-      fundedWithoutCredits
-    );
-    const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
+    const turnExecutionPolicy = modelPolicyBlocked ? void 0 : resolveTurnExecutionPolicyV1(settings, {
       modelId: continuationModel,
       requestedModelId: null,
       modelSource: "continuation",
@@ -1344,6 +1412,14 @@ function createGoalActivities(services) {
       latencyMode: continuationLatencyMode,
       latencyModeSource: "continuation"
     });
+    const continuationPolicy = {
+      model: continuationModel,
+      reasoningEffort: continuationReasoningEffort,
+      latencyMode: continuationLatencyMode,
+      ...turnExecutionPolicy ? { turnExecutionPolicy } : {},
+      tools: withFirstPartyTools(settings, session.tools),
+      sandboxBackend: session.sandboxBackend
+    };
     const decision = await materializeGoalContinuation(db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
@@ -1359,15 +1435,34 @@ function createGoalActivities(services) {
       // A model-policy block takes precedence: it is deterministic (a budget
       // pause can clear on its own; a policy pause needs a model/policy change)
       // and rides the same visible-pause channel.
-      budgetBlocked: modelPolicyBlocked ?? budgetBlocked,
-      policy: {
-        model: continuationModel,
-        reasoningEffort: continuationReasoningEffort,
-        latencyMode: continuationLatencyMode,
-        turnExecutionPolicy,
-        tools: withFirstPartyTools(settings, session.tools),
-        sandboxBackend: session.sandboxBackend
+      admission: async (tx, causalTurn) => {
+        const sourceTurn = causalTurn ? await getSessionTurn(tx, input.workspaceId, causalTurn.id) : null;
+        if (causalTurn && (!sourceTurn || sourceTurn.sessionId !== input.sessionId)) {
+          throw new Error("Goal continuation source turn is unavailable");
+        }
+        const sourcePolicy = readTurnExecutionPolicyV12(sourceTurn?.metadata);
+        if (turnExecutionPolicy) {
+          const credentialRestriction = turnCredentialRestriction(
+            sourcePolicy.kind === "valid" ? sourcePolicy.policy : turnExecutionPolicy,
+            session.metadata
+          );
+          continuationPolicy.turnExecutionPolicy = credentialRestriction ? { ...turnExecutionPolicy, credentialRestriction } : turnExecutionPolicy;
+        }
+        const budgetBlocked = modelPolicyBlocked ? null : await goalRunBudgetBlocked(
+          { ...service, settings, db: tx },
+          {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            model: continuationModel,
+            initiatingHumanSubjectId: causalTurn?.initiatingHumanSubjectId ?? null
+          }
+        );
+        return {
+          budgetBlocked: modelPolicyBlocked ?? budgetBlocked?.message ?? null,
+          budgetPausedReason: modelPolicyBlocked ? "limits" : budgetBlocked?.pausedReason ?? "limits"
+        };
       },
+      policy: continuationPolicy,
       // Long-wait guidance is only given when `wait_for_input` is actually in this
       // session's effective first-party selection (the same source the worker
       // signs into the delegated token and the API uses to register tools), so
@@ -1403,23 +1498,26 @@ function goalContinuationModelDecision(input) {
     providerId: policyProviderIdForModel(catalogSettings, modelId),
     modelId
   }).allowed;
-  if (resolveModelProvider(catalogSettings, input.inheritedModel) && !policyBlocks(input.inheritedModel)) {
-    return { model: input.inheritedModel, blocked: null };
-  }
   if (!resolveModelProvider(catalogSettings, input.inheritedModel)) {
     return {
       model: input.inheritedModel,
       blocked: `model "${input.inheritedModel}" is no longer in the deployment or workspace catalog; choose an available model before resuming the goal`
     };
   }
+  if (!isModelAvailableForNewSelection(catalogSettings, input.inheritedModel)) {
+    return {
+      model: input.inheritedModel,
+      blocked: `model "${input.inheritedModel}" is retired from new selection; choose an available model before resuming the goal`
+    };
+  }
+  if (!policyBlocks(input.inheritedModel)) {
+    return { model: input.inheritedModel, blocked: null };
+  }
   return {
     model: input.inheritedModel,
     blocked: `workspace model policy blocks model "${input.inheritedModel}"; pick an allowed model or change the workspace model policy`
   };
 }
-function goalContinuationFundedWithoutCredits(settings, model, codexBilled) {
-  return modelFundingForAdmission(settings, model, codexBilled).fundedWithoutCredits;
-}
 function goalContinuationPrompt(_goal, _autoContinuation, _cap, options = {}) {
   const waitingGuidance = options.inputWaitAvailable ? [
     "Waiting on child sessions, background commands, or external events:",
@@ -1475,6 +1573,8 @@ function goalContinuationPrompt(_goal, _autoContinuation, _cap, options = {}) {
     "- For document report deliverables (a document the user asked for, or a large report meant to be kept or shared), follow the Documents Skill: create the durable native document first, inspect its relevant final head after the last edit, and provide the returned artifact reference. Declare report requirements through the available goal tools before authoring and satisfy every persisted report requirement with verified artifact delivery evidence before completion. Sandbox paths and raw file IDs do not prove report delivery. If artifact tooling or access is unavailable, keep that deliverable incomplete and state the blocker; never invent proof or silently substitute a local report. Ordinary chat answers, short progress updates, source-code links, and explicitly requested local-file work remain outside this report contract.",
     "",
     "Do not rely on intent, partial progress, memory of earlier work, or a plausible final answer as proof of completion. Call opengeni__goal_complete with concrete evidence only when the full objective is actually achieved and no required work remains.",
+    "Goal evidence is a short proof for the ledger, not the deliverable. After goal_complete succeeds, finish this same turn with the requested user-facing answer, or a concise summary and retained artifact link. Goal completion stops future automatic continuations; it does not send the answer or end this turn. Never compress a report into evidence or omit the final reply.",
+    "Goal progress notes are short human-readable milestone statuses, not raw transcripts or continuation instructions. Keep normal spaces and summarize detail instead of squeezing words into a ledger field. The text and successCriteria fields each allow 8192 UTF-8 bytes, progressNote allows 8192 UTF-8 bytes, rationale allows 2048 UTF-8 bytes, and evidence allows 8192 characters.",
     "",
     ...waitingGuidance,
     ...childNoticeGuidance,
@@ -1494,41 +1594,19 @@ function withFirstPartyTools(settings, tools) {
   }
   return mergeToolRefs(tools, [{ kind: "mcp", id: "opengeni" }]);
 }
-async function goalRunBudgetBlocked(settings, db, accountId, workspaceId, fundedWithoutCredits) {
-  if (!fundedWithoutCredits && (settings.billingMode === "stripe" || settings.usageLimitsMode === "managed")) {
-    const balance = await getBillingBalance(db, accountId);
-    if (balance.balanceMicros <= 0) {
-      return "insufficient OpenGeni credits";
-    }
-  }
-  if (settings.usageLimitsMode === "static" || settings.usageLimitsMode === "managed") {
-    const limits = configuredStaticUsageLimits(settings);
-    if (!fundedWithoutCredits && limits.maxMonthlyCostMicrosPerAccount) {
-      const used = await sumUsageQuantity(db, {
-        accountId,
-        eventType: "model.cost",
-        since: startOfUtcMonth()
-      });
-      if (used >= limits.maxMonthlyCostMicrosPerAccount) {
-        return `monthly model cost limit reached (${limits.maxMonthlyCostMicrosPerAccount} micros)`;
-      }
-    }
-    if (limits.maxMonthlyAgentRunsPerWorkspace) {
-      const used = await sumUsageQuantity(db, {
-        workspaceId,
-        eventType: "agent_run.created",
-        since: startOfUtcMonth()
-      });
-      if (used + 1 > limits.maxMonthlyAgentRunsPerWorkspace) {
-        return `monthly agent run limit reached (${limits.maxMonthlyAgentRunsPerWorkspace})`;
-      }
-    }
-  }
-  return null;
-}
-function startOfUtcMonth() {
-  const now = /* @__PURE__ */ new Date();
-  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+async function goalRunBudgetBlocked(services, input) {
+  const denial = await agentRunAdmissionDenial(services, { ...input, requestedAgentRuns: 1 });
+  if (denial === null) return null;
+  if (denial === "allowance_exhausted") {
+    return { pausedReason: "allowance", message: "OpenGeni usage allowance exhausted" };
+  }
+  const limits = configuredStaticUsageLimits2(services.settings);
+  const messages = {
+    insufficient_credits: "insufficient OpenGeni credits",
+    monthly_model_cost_limit: `monthly model cost limit reached (${limits.maxMonthlyCostMicrosPerAccount} micros)`,
+    monthly_agent_run_limit: `monthly agent run limit reached (${limits.maxMonthlyAgentRunsPerWorkspace})`
+  };
+  return { pausedReason: "limits", message: messages[denial] };
 }
 
 // src/activities/knowledge-source-sync.ts
@@ -5250,9 +5328,9 @@ var WARMING_POLL_INTERVAL_MS = 250;
 async function sleep(ms) {
   await new Promise((resolve) => setTimeout(resolve, ms));
 }
-async function waitForSandboxExecReadiness(established, timeoutMs = MODAL_EXEC_READINESS_TIMEOUT_MS, identity = {}) {
+async function waitForSandboxExecReadiness(established, timeoutMs = MODAL_EXEC_READINESS_TIMEOUT_MS, identity = {}, signal) {
   try {
-    await verifySandboxExecReadiness(established, timeoutMs);
+    await verifySandboxExecReadiness(established, timeoutMs, signal);
   } catch (error) {
     if (error instanceof SandboxExecReadinessError && error.code === "exec_probe_timeout") {
       throw new SandboxExecReadinessTimeoutError(established.backendId, timeoutMs, {
@@ -5830,11 +5908,12 @@ async function resumeBoxForTurnOnce(services, ids, kind, holderId) {
     },
     os,
     // IMAGE IS SHARED STATE (B3): thread the resolved image so the lease stamps it +
-    // conflicts on a live box already running a different image. A
+    // conflicts on a live box already running a different required image. A
     // SandboxImageConflictError propagates while another holder is active; a
     // solo change requests a capture-and-drain rotation and this attempt retries
     // after the cold successor can safely stamp the new image.
     ...ids.image ? { image: ids.image } : {},
+    ...ids.imagePolicy ? { imagePolicy: ids.imagePolicy } : {},
     // RIG IS SHARED STATE (M3): thread the frozen rig version so the lease stamps it
     // + conflicts on a live box under a different rig. A SandboxRigConflictError
     // propagates while another holder is active; a solo change uses the same
@@ -6236,9 +6315,14 @@ async function resumeBoxForTurnOnce(services, ids, kind, holderId) {
           sandboxGroupId: ids.sandboxGroupId
         });
       } else {
-        await waitForSandboxExecReadiness(established, MODAL_EXEC_READINESS_TIMEOUT_MS, {
-          sandboxGroupId: ids.sandboxGroupId
-        });
+        await waitForSandboxExecReadiness(
+          established,
+          MODAL_EXEC_READINESS_TIMEOUT_MS,
+          {
+            sandboxGroupId: ids.sandboxGroupId
+          },
+          cancellationSignal
+        );
       }
       await maybeRenewProviderExpiration(true);
       throwIfReleasedOrCancelled();
@@ -6364,9 +6448,14 @@ async function resumeBoxForTurnOnce(services, ids, kind, holderId) {
       if (services.verifyAttachedSandboxReadiness) {
         await services.verifyAttachedSandboxReadiness(established);
       } else {
-        await waitForSandboxExecReadiness(established, MODAL_EXEC_READINESS_TIMEOUT_MS, {
-          sandboxGroupId: ids.sandboxGroupId
-        });
+        await waitForSandboxExecReadiness(
+          established,
+          MODAL_EXEC_READINESS_TIMEOUT_MS,
+          {
+            sandboxGroupId: ids.sandboxGroupId
+          },
+          cancellationSignal
+        );
       }
       providerRenewalTarget = {
         backend: ids.backend,
@@ -6626,7 +6715,7 @@ function afterPersistableHomeMutation(services, ids, home) {
     if (!exactAdmission || typeof exactAdmission.id !== "string" || typeof exactAdmission.workspaceGeneration !== "number" || !("providerBinding" in boundAdmission)) {
       throw new Error("Persistable home mutation settlement lacked its bound admission");
     }
-    if (outcome === "resolved" && retainedProcess) {
+    if ((outcome === "resolved" || outcome === "outcome_unknown") && retainedProcess) {
       try {
         await retainWorkspaceProviderCommand(services.db, {
           accountId: fence.accountId,
@@ -6671,6 +6760,8 @@ function afterPersistableHomeMutation(services, ids, home) {
       }
       return;
     }
+    if (outcome === "outcome_unknown")
+      throw new Error("Outcome-unknown command settlement requires its exact retained invocation");
     await verifyWorkspaceMutationSettlement(services.db, {
       accountId: fence.accountId,
       workspaceId: ids.workspaceId,
@@ -8868,8 +8959,10 @@ import {
   isMcpRequestTimeoutError,
   isMcpTransportConnectivityError,
   isModalTaskExecStartPreDispatchUnavailableError,
+  isModalCommandStartOutcomeUnknownError,
   isRoutingMutationOutcomeUnknownError,
   RoutingWorkspaceRootChangedError,
+  ResponsesStreamingTerminalError,
   SandboxMaterializationVerificationError,
   materializationVerificationDiagnostic,
   PROVIDER_QUOTA_EXHAUSTED_CODE,
@@ -9834,6 +9927,7 @@ function shouldRecoverCompactionProviderFailure(error) {
   return agentRunFailurePayload(error).retryable === true;
 }
 function classifyContextWindowOverflowError(error) {
+  if (isProviderSafetyRefusal(error)) return null;
   const fields = collectErrorStrings(error);
   const matched = fields.find(
     (value) => /context[_\s-]*length[_\s-]*exceeded/i.test(value) || /exceeds?\s+(?:the\s+)?context\s+window/i.test(value) || /maximum\s+context\s+length/i.test(value) || /context\s+window[^.]*exceed/i.test(value)
@@ -9879,6 +9973,7 @@ function collectErrorStrings(value, seen = /* @__PURE__ */ new WeakSet()) {
   }
   seen.add(value);
   const out = [];
+  if (value instanceof ResponsesStreamingTerminalError) out.push(value.detail);
   const record = value;
   for (const key of ["message", "code", "type", "name", "param"]) {
     const field = record[key];
@@ -9896,6 +9991,9 @@ function isExactStatuslessUpstreamConnectivityMessage(message) {
   return message.trim().toLowerCase() === STATUSLESS_UPSTREAM_CONNECTIVITY_MESSAGE;
 }
 function providerSafetyRefusalDiagnostic(error) {
+  if (error instanceof ResponsesStreamingTerminalError) {
+    return error.category === "safety" ? error.detail : void 0;
+  }
   return collectErrorStrings(error).find(
     (value) => /^(?:content_policy_violation|content_filter|safety_violation|bio_policy|cyber_policy)$/.test(
       value
@@ -9906,6 +10004,9 @@ function isProviderSafetyRefusal(error) {
   return providerSafetyRefusalDiagnostic(error) !== void 0;
 }
 function isTransientProviderError(error) {
+  if (error instanceof ResponsesStreamingTerminalError) {
+    return error.category === "unavailable";
+  }
   if (isProviderSafetyRefusal(error)) return false;
   const status = typeof error === "object" && error !== null ? Number(
     error.status ?? error.statusCode
@@ -10021,6 +10122,28 @@ function baseAgentRunFailurePayload(error, options = {}) {
       detail: safetyRefusalDiagnostic
     };
   }
+  if (error instanceof ResponsesStreamingTerminalError) {
+    const quota2 = error.category === "unknown" || error.category === "rate_limit" ? classifyProviderQuotaExhaustionError({
+      code: error.code,
+      error: { code: error.code, type: error.type, message: error.detail },
+      retryAfterSeconds: error.retryAfterSeconds
+    }) : null;
+    if (quota2) {
+      return {
+        error: providerQuotaExhaustedMessage(quota2.scope),
+        code: PROVIDER_QUOTA_EXHAUSTED_CODE,
+        retryable: false,
+        quotaScope: quota2.scope,
+        detail: error.detail
+      };
+    }
+    return {
+      error: error.category === "rate_limit" ? "Model provider rate limit hit. Try again in a minute or lower the reasoning effort." : error.category === "unavailable" ? "The model provider is temporarily unavailable. The same turn will retry after a short delay." : "The model provider rejected the response. Automatic retries stopped.",
+      code: error.category === "rate_limit" ? "provider_rate_limited" : error.category === "unavailable" ? "provider_unavailable" : "provider_request_rejected",
+      retryable: error.category === "rate_limit" || error.category === "unavailable",
+      detail: error.detail
+    };
+  }
   const message = error instanceof Error ? error.message : String(error);
   const status = typeof error === "object" && error !== null ? Number(
     error.status ?? error.statusCode
@@ -10049,6 +10172,13 @@ function baseAgentRunFailurePayload(error, options = {}) {
       retryable: true
     };
   }
+  if (isModalCommandStartOutcomeUnknownError(error)) {
+    return {
+      error: "A managed sandbox command may have started, but its acknowledgement was lost. Automatic replay is disabled; inspect the sandbox state before retrying.",
+      code: "sandbox_command_start_outcome_unknown",
+      retryable: false
+    };
+  }
   if (!isRoutingMutationOutcomeUnknownError(error) && isModalTaskExecStartPreDispatchUnavailableError(error)) {
     return {
       error: "The managed sandbox command router was not ready before the command was sent. The same turn will retry after a short delay.",
@@ -10326,7 +10456,9 @@ export {
   signalPendingCodexCapacityWakeTargets,
   armAndReconcileCodexCapacityWait,
   createCodexCapacityActivities,
+  agentRunAdmissionDenial,
   createDocumentActivities,
+  turnCredentialRestriction,
   createGoalActivities,
   withFirstPartyTools,
   createKnowledgeSourceSyncActivities,
@@ -10428,4 +10560,4 @@ export {
   codexUsageLimitFailurePayload,
   CODEX_USAGE_LIMIT_MAX_RESUME_MS
 };
-//# sourceMappingURL=chunk-RZAAGRFQ.js.map
+//# sourceMappingURL=chunk-4PJTUBWQ.js.map