@parall/parel-channel 1.39.0 → 1.40.0

package/dist/inbound.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbound.d.ts","sourceRoot":"","sources":["../src/inbound.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACf,MAAM,mBAAmB,CAAC;AAgD3B,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,eAAe,EAAE,CAAC,CAiB5B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAuDrF;AAkdD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA6C7B"}
+{"version":3,"file":"inbound.d.ts","sourceRoot":"","sources":["../src/inbound.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACf,MAAM,mBAAmB,CAAC;AAiD3B,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,eAAe,EAAE,CAAC,CAiB5B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAuDrF;AAkdD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAyD7B"}

package/dist/inbound.js

@@ -1,6 +1,6 @@
 import { buildChannelPrompt, buildChatPrompt } from './channel-prompt.js';
 import { parallApiUrl, parallOrgId, requireAgk } from './connect.js';
-import { createChannelInputStep, createInputStep, createTraceStep, ensureSession, invalidateSession, markDispatchReceived, patchSession, REQUEST_TIMEOUT_MS, TURN_ENVELOPE_KEY, } from './session.js';
+import { createChannelInputStep, createErrorStep, createInputStep, createTraceStep, ensureSession, invalidateSession, markDispatchReceived, patchSession, REQUEST_TIMEOUT_MS, TURN_ENVELOPE_KEY, } from './session.js';
 export async function handleParallFrame(frame, ctx) {
     let event;
     try {
@@ -525,10 +525,22 @@ export async function handleParallAgentEvent(event, ctx) {
             }
             const sessionId = await ensureSession(ctx);
             if (sessionId) {
+                // Error step BEFORE the idle patch so the panel orders failure →
+                // done; the step is what makes a failed turn visible at all (the
+                // reply never arrives — see createErrorStep).
+                let stale = false;
+                if (event.type === 'turn_failed') {
+                    const stepResult = await createErrorStep(ctx, sessionId, {
+                        subject: chatId,
+                        turnId: event.turnId,
+                        error: event.error,
+                    });
+                    stale = stepResult === 'stale';
+                }
                 const result = await patchSession(ctx, sessionId, { status: 'idle' });
                 // A closed session is already terminal (frontend shows done) — just
                 // drop the cache so the next dispatch resolves a fresh one.
-                if (result === 'stale')
+                if (stale || result === 'stale')
                     await invalidateSession(ctx);
             }
             return [];

package/dist/session.d.ts

@@ -87,6 +87,37 @@ export declare function createChannelInputStep(ctx: ConnectorContext, sessionId:
     text: string;
     sentAt?: string;
 }): Promise<ReportResult>;
+/**
+ * Credential redaction for runtime error strings that become user-visible
+ * step content. Two layers: every secret VALUE the connector actually holds
+ * (`ctx.secrets`) is replaced exactly — the strongest guarantee for the
+ * secrets in this connector's scope — then credential-shaped patterns are
+ * masked (parall key prefixes, common vendor prefixes, AWS access key ids,
+ * bearer tokens, and any long unbroken token as a fallback: credentials are
+ * long random strings, while prose and paths break on spaces and slashes
+ * first). Pattern matching can't catch every conceivable secret (e.g. a
+ * short password echoed by a foreign exception), which is the accepted
+ * trade-off for keeping the error text diagnosable — the audience is the
+ * org-internal session panel.
+ */
+export declare function redactSecrets(s: string, knownValues?: string[]): string;
+/**
+ * turn_failed → an error step in the session panel, following the
+ * cross-runtime error-step contract (text step + content.status:'error',
+ * same shape agent-core's dispatch-failure step uses — pinned by
+ * ts/protocol-vectors/agent-steps.json). Without this the turn's failure is
+ * invisible on the parall side: the 2026-07-05 parel regression was fully
+ * silent because this connector dropped event.error.
+ *
+ * The error string comes from parel's runtime (exception messages) — length
+ * is unbounded and it can echo credential-shaped values, so it is redacted
+ * (see redactSecrets) and truncated before leaving the connector.
+ */
+export declare function createErrorStep(ctx: ConnectorContext, sessionId: string, args: {
+    subject: string;
+    turnId: string;
+    error: string;
+}): Promise<ReportResult>;
 /**
  * E2 step-trace events → parall AgentSteps, shaped exactly like agent-core's
  * createRuntimeStep so the session panel renders them identically to CC's.

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAE/D;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,sBAAqC,CAAC;AAGpE;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,CAAC;AAMrD,2EAA2E;AAC3E,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AASD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,gBAAgB,EACrB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyBxB;AAED,qEAAqE;AACrE,wBAAsB,YAAY,CAChC,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,YAAY,CAAC,CAgBvB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3E,OAAO,CAAC,YAAY,CAAC,CA8BvB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IACJ,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,OAAO,CAAC,YAAY,CAAC,CAsCvB;AAOD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACpF;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACJ,OAAO,CAAC,YAAY,CAAC,CAiEvB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAcf"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAE/D;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,sBAAqC,CAAC;AAGpE;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,CAAC;AAMrD,2EAA2E;AAC3E,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AASD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,gBAAgB,EACrB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyBxB;AAED,qEAAqE;AACrE,wBAAsB,YAAY,CAChC,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,YAAY,CAAC,CAgBvB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3E,OAAO,CAAC,YAAY,CAAC,CA8BvB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IACJ,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,OAAO,CAAC,YAAY,CAAC,CAsCvB;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,GAAE,MAAM,EAAO,GAAG,MAAM,CAY3E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACvD,OAAO,CAAC,YAAY,CAAC,CA+BvB;AAOD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACpF;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACJ,OAAO,CAAC,YAAY,CAAC,CAiEvB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/session.js

@@ -194,6 +194,78 @@ export async function createChannelInputStep(ctx, sessionId, args) {
         return 'failed';
     }
 }
+const ERROR_TEXT_MAX = 500;
+/**
+ * Credential redaction for runtime error strings that become user-visible
+ * step content. Two layers: every secret VALUE the connector actually holds
+ * (`ctx.secrets`) is replaced exactly — the strongest guarantee for the
+ * secrets in this connector's scope — then credential-shaped patterns are
+ * masked (parall key prefixes, common vendor prefixes, AWS access key ids,
+ * bearer tokens, and any long unbroken token as a fallback: credentials are
+ * long random strings, while prose and paths break on spaces and slashes
+ * first). Pattern matching can't catch every conceivable secret (e.g. a
+ * short password echoed by a foreign exception), which is the accepted
+ * trade-off for keeping the error text diagnosable — the audience is the
+ * org-internal session panel.
+ */
+export function redactSecrets(s, knownValues = []) {
+    let out = s;
+    for (const v of knownValues) {
+        // Skip tiny values: replacing e.g. a 3-char string would shred prose.
+        if (typeof v === 'string' && v.length >= 6)
+            out = out.split(v).join('***');
+    }
+    return out
+        .replace(/\b(agk|mck|cpk)_[A-Za-z0-9_-]+/g, '$1_***')
+        .replace(/\b(sk|pk|rk)-[A-Za-z0-9_-]{8,}/g, '$1-***')
+        .replace(/\bAKIA[0-9A-Z]{16}\b/g, 'AKIA***')
+        .replace(/\b(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, '$1***')
+        .replace(/[A-Za-z0-9_-]{32,}/g, '***');
+}
+/**
+ * turn_failed → an error step in the session panel, following the
+ * cross-runtime error-step contract (text step + content.status:'error',
+ * same shape agent-core's dispatch-failure step uses — pinned by
+ * ts/protocol-vectors/agent-steps.json). Without this the turn's failure is
+ * invisible on the parall side: the 2026-07-05 parel regression was fully
+ * silent because this connector dropped event.error.
+ *
+ * The error string comes from parel's runtime (exception messages) — length
+ * is unbounded and it can echo credential-shaped values, so it is redacted
+ * (see redactSecrets) and truncated before leaving the connector.
+ */
+export async function createErrorStep(ctx, sessionId, args) {
+    const knownSecrets = Object.values((ctx.secrets ?? {})).filter((v) => typeof v === 'string');
+    const text = `Turn failed: ${redactSecrets(args.error, knownSecrets)}`.slice(0, ERROR_TEXT_MAX);
+    try {
+        const url = `${parallApiUrl(ctx)}/api/v1/orgs/${parallOrgId(ctx)}/agents/${parallAgentId(ctx)}/sessions/${sessionId}/steps`;
+        // Same subject-prefix line createTraceStep draws: chv_ turns must not
+        // target 'chat' or the broadcast lands on a channel no client watches.
+        const targetType = args.subject.startsWith('chv_') ? 'channel_conversation' : 'chat';
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: jsonHeaders(ctx),
+            body: JSON.stringify({
+                step_type: 'text',
+                target_type: targetType,
+                target_id: args.subject,
+                // At-most-once today (agent-event pushes are not replayed), but the
+                // turnId key makes a future retry path free of duplicate error rows.
+                idempotency_key: `error:${args.turnId}`,
+                content: { text, suppressed: false, status: 'error' },
+            }),
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+        if (res.ok)
+            return 'ok';
+        console.error(`[parel-channel] error step failed (${res.status})`);
+        return resultForStatus(res.status);
+    }
+    catch (err) {
+        console.error('[parel-channel] error step failed', err);
+        return 'failed';
+    }
+}
 // Subject-scoped: one connector serves many per-subject sessions, and
 // provider call ids are only unique within a turn — never let two subjects'
 // concurrent calls overwrite each other's parked name.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/parel-channel",
-  "version": "1.39.0",
+  "version": "1.40.0",
   "description": "Parall channel plugin for the parel runtime — lets a parel agent treat Parall as a managed_ws channel (receive dispatches, reply via the Parall API)",
   "license": "MIT",
   "repository": {

package/src/inbound.ts

@@ -9,6 +9,7 @@ import { buildChannelPrompt, buildChatPrompt } from './channel-prompt.js';
 import { parallApiUrl, parallOrgId, requireAgk } from './connect.js';
 import {
   createChannelInputStep,
+  createErrorStep,
   createInputStep,
   createTraceStep,
   ensureSession,
@@ -638,10 +639,22 @@ export async function handleParallAgentEvent(
       }
       const sessionId = await ensureSession(ctx);
       if (sessionId) {
+        // Error step BEFORE the idle patch so the panel orders failure →
+        // done; the step is what makes a failed turn visible at all (the
+        // reply never arrives — see createErrorStep).
+        let stale = false;
+        if (event.type === 'turn_failed') {
+          const stepResult = await createErrorStep(ctx, sessionId, {
+            subject: chatId,
+            turnId: event.turnId,
+            error: event.error,
+          });
+          stale = stepResult === 'stale';
+        }
         const result = await patchSession(ctx, sessionId, { status: 'idle' });
         // A closed session is already terminal (frontend shows done) — just
         // drop the cache so the next dispatch resolves a fresh one.
-        if (result === 'stale') await invalidateSession(ctx);
+        if (stale || result === 'stale') await invalidateSession(ctx);
       }
       return [];
     }

package/src/session.ts

@@ -230,6 +230,84 @@ export async function createChannelInputStep(
   }
 }
 
+const ERROR_TEXT_MAX = 500;
+
+/**
+ * Credential redaction for runtime error strings that become user-visible
+ * step content. Two layers: every secret VALUE the connector actually holds
+ * (`ctx.secrets`) is replaced exactly — the strongest guarantee for the
+ * secrets in this connector's scope — then credential-shaped patterns are
+ * masked (parall key prefixes, common vendor prefixes, AWS access key ids,
+ * bearer tokens, and any long unbroken token as a fallback: credentials are
+ * long random strings, while prose and paths break on spaces and slashes
+ * first). Pattern matching can't catch every conceivable secret (e.g. a
+ * short password echoed by a foreign exception), which is the accepted
+ * trade-off for keeping the error text diagnosable — the audience is the
+ * org-internal session panel.
+ */
+export function redactSecrets(s: string, knownValues: string[] = []): string {
+  let out = s;
+  for (const v of knownValues) {
+    // Skip tiny values: replacing e.g. a 3-char string would shred prose.
+    if (typeof v === 'string' && v.length >= 6) out = out.split(v).join('***');
+  }
+  return out
+    .replace(/\b(agk|mck|cpk)_[A-Za-z0-9_-]+/g, '$1_***')
+    .replace(/\b(sk|pk|rk)-[A-Za-z0-9_-]{8,}/g, '$1-***')
+    .replace(/\bAKIA[0-9A-Z]{16}\b/g, 'AKIA***')
+    .replace(/\b(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, '$1***')
+    .replace(/[A-Za-z0-9_-]{32,}/g, '***');
+}
+
+/**
+ * turn_failed → an error step in the session panel, following the
+ * cross-runtime error-step contract (text step + content.status:'error',
+ * same shape agent-core's dispatch-failure step uses — pinned by
+ * ts/protocol-vectors/agent-steps.json). Without this the turn's failure is
+ * invisible on the parall side: the 2026-07-05 parel regression was fully
+ * silent because this connector dropped event.error.
+ *
+ * The error string comes from parel's runtime (exception messages) — length
+ * is unbounded and it can echo credential-shaped values, so it is redacted
+ * (see redactSecrets) and truncated before leaving the connector.
+ */
+export async function createErrorStep(
+  ctx: ConnectorContext,
+  sessionId: string,
+  args: { subject: string; turnId: string; error: string },
+): Promise<ReportResult> {
+  const knownSecrets = Object.values((ctx.secrets ?? {}) as Record<string, unknown>).filter(
+    (v): v is string => typeof v === 'string',
+  );
+  const text = `Turn failed: ${redactSecrets(args.error, knownSecrets)}`.slice(0, ERROR_TEXT_MAX);
+  try {
+    const url = `${parallApiUrl(ctx)}/api/v1/orgs/${parallOrgId(ctx)}/agents/${parallAgentId(ctx)}/sessions/${sessionId}/steps`;
+    // Same subject-prefix line createTraceStep draws: chv_ turns must not
+    // target 'chat' or the broadcast lands on a channel no client watches.
+    const targetType = args.subject.startsWith('chv_') ? 'channel_conversation' : 'chat';
+    const res = await fetch(url, {
+      method: 'POST',
+      headers: jsonHeaders(ctx),
+      body: JSON.stringify({
+        step_type: 'text',
+        target_type: targetType,
+        target_id: args.subject,
+        // At-most-once today (agent-event pushes are not replayed), but the
+        // turnId key makes a future retry path free of duplicate error rows.
+        idempotency_key: `error:${args.turnId}`,
+        content: { text, suppressed: false, status: 'error' },
+      }),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    if (res.ok) return 'ok';
+    console.error(`[parel-channel] error step failed (${res.status})`);
+    return resultForStatus(res.status);
+  } catch (err) {
+    console.error('[parel-channel] error step failed', err);
+    return 'failed';
+  }
+}
+
 // Subject-scoped: one connector serves many per-subject sessions, and
 // provider call ids are only unique within a turn — never let two subjects'
 // concurrent calls overwrite each other's parked name.