@probelabs/probe 0.6.0-rc335 → 0.6.0-rc336

package/cjs/index.cjs

@@ -28791,7 +28791,7 @@ var init_dist5 = __esm({
         return combineHeaders(await resolve(this.config.headers), headers);
       }
       async doGenerate(options) {
-        var _a17, _b16, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o;
+        var _a17, _b16, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r;
         const {
           command: args,
           warnings,
@@ -28820,10 +28820,12 @@ var init_dist5 = __esm({
         let isJsonResponseFromTool = false;
         const jsonObjectTextExtractor = usesJsonInstruction ? new JsonObjectTextExtractor() : void 0;
         for (const part of response.output.message.content) {
-          if (part.text != null) {
+          const citationText = (_b16 = (_a17 = part.citationsContent) == null ? void 0 : _a17.content) == null ? void 0 : _b16.map((generatedContent) => generatedContent.text).filter((text2) => text2 != null).join("");
+          const text = (_c = part.text) != null ? _c : citationText ? citationText : void 0;
+          if (text != null) {
             content.push({
               type: "text",
-              text: (_a17 = jsonObjectTextExtractor == null ? void 0 : jsonObjectTextExtractor.process(part.text)) != null ? _a17 : part.text
+              text: (_d = jsonObjectTextExtractor == null ? void 0 : jsonObjectTextExtractor.process(text)) != null ? _d : text
             });
           }
           if (part.reasoningContent) {
@@ -28846,7 +28848,7 @@ var init_dist5 = __esm({
                 text: "",
                 providerMetadata: {
                   bedrock: {
-                    redactedData: (_b16 = part.reasoningContent.redactedReasoning.data) != null ? _b16 : ""
+                    redactedData: (_e = part.reasoningContent.redactedReasoning.data) != null ? _e : ""
                   }
                 }
               });
@@ -28872,17 +28874,17 @@ var init_dist5 = __esm({
               });
             } else {
               const isMistral = isMistralModel(this.modelId);
-              const rawToolCallId = (_d = (_c = part.toolUse) == null ? void 0 : _c.toolUseId) != null ? _d : this.config.generateId();
+              const rawToolCallId = (_g = (_f = part.toolUse) == null ? void 0 : _f.toolUseId) != null ? _g : this.config.generateId();
               content.push({
                 type: "tool-call",
                 toolCallId: normalizeToolCallId(rawToolCallId, isMistral),
-                toolName: (_f = (_e = part.toolUse) == null ? void 0 : _e.name) != null ? _f : `tool-${this.config.generateId()}`,
-                input: JSON.stringify((_h = (_g = part.toolUse) == null ? void 0 : _g.input) != null ? _h : {})
+                toolName: (_i = (_h = part.toolUse) == null ? void 0 : _h.name) != null ? _i : `tool-${this.config.generateId()}`,
+                input: JSON.stringify((_k = (_j = part.toolUse) == null ? void 0 : _j.input) != null ? _k : {})
               });
             }
           }
         }
-        const stopSequence = (_k = (_j = (_i = response.additionalModelResponseFields) == null ? void 0 : _i.delta) == null ? void 0 : _j.stop_sequence) != null ? _k : null;
+        const stopSequence = (_n = (_m = (_l = response.additionalModelResponseFields) == null ? void 0 : _l.delta) == null ? void 0 : _m.stop_sequence) != null ? _n : null;
         const providerMetadata = response.trace || response.usage || response.performanceConfig || response.serviceTier || isJsonResponseFromTool || stopSequence ? {
           bedrock: {
             ...response.trace && typeof response.trace === "object" ? { trace: response.trace } : {},
@@ -28892,7 +28894,7 @@ var init_dist5 = __esm({
             ...response.serviceTier && {
               serviceTier: response.serviceTier
             },
-            ...(((_l = response.usage) == null ? void 0 : _l.cacheWriteInputTokens) != null || ((_m = response.usage) == null ? void 0 : _m.cacheDetails) != null) && {
+            ...(((_o = response.usage) == null ? void 0 : _o.cacheWriteInputTokens) != null || ((_p = response.usage) == null ? void 0 : _p.cacheDetails) != null) && {
               usage: {
                 ...response.usage.cacheWriteInputTokens != null && {
                   cacheWriteInputTokens: response.usage.cacheWriteInputTokens
@@ -28913,11 +28915,11 @@ var init_dist5 = __esm({
               response.stopReason,
               isJsonResponseFromTool
             ),
-            raw: (_n = response.stopReason) != null ? _n : void 0
+            raw: (_q = response.stopReason) != null ? _q : void 0
           },
           usage: convertBedrockUsage(response.usage),
           response: {
-            id: (_o = responseHeaders == null ? void 0 : responseHeaders["x-amzn-requestid"]) != null ? _o : void 0,
+            id: (_r = responseHeaders == null ? void 0 : responseHeaders["x-amzn-requestid"]) != null ? _r : void 0,
             timestamp: (responseHeaders == null ? void 0 : responseHeaders["date"]) != null ? new Date(responseHeaders["date"]) : void 0,
             modelId: this.modelId,
             headers: responseHeaders
@@ -29358,6 +29360,13 @@ var init_dist5 = __esm({
           content: external_exports.array(
             external_exports.object({
               text: external_exports.string().nullish(),
+              citationsContent: external_exports.object({
+                content: external_exports.array(
+                  external_exports.object({
+                    text: external_exports.string().nullish()
+                  })
+                ).nullish()
+              }).nullish(),
               toolUse: BedrockToolUseSchema.nullish(),
               reasoningContent: external_exports.union([
                 external_exports.object({
@@ -29820,7 +29829,7 @@ var init_dist5 = __esm({
       details: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
       preview: external_exports.unknown().optional()
     });
-    VERSION3 = true ? "4.0.169" : "0.0.0-test";
+    VERSION3 = true ? "4.0.172" : "0.0.0-test";
     bedrockRerankingResponseSchema = lazySchema(
       () => zodSchema(
         external_exports.object({
@@ -90810,6 +90819,7 @@ var require_utils2 = __commonJS({
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv42 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isPort = RegExp.prototype.test.bind(/^\d*$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
     var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
@@ -91275,8 +91285,12 @@ var require_utils2 = __commonJS({
         uriTokens.push(host);
       }
       if (typeof component.port === "number" || typeof component.port === "string") {
+        const port = String(component.port);
+        if (!isPort(port)) {
+          throw new TypeError("URI port is malformed.");
+        }
         uriTokens.push(":");
-        uriTokens.push(String(component.port));
+        uriTokens.push(port);
       }
       return uriTokens.length ? uriTokens.join("") : void 0;
     }
@@ -91719,12 +91733,15 @@ var require_fast_uri = __commonJS({
       }
       return false;
     }
+    function isIPLiteral(host) {
+      return host[0] === "[" && host[host.length - 1] === "]";
+    }
     function hasMalformedComponentPercentEncoding(matches) {
       const host = matches[4];
-      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !(host[0] === "[" && host[host.length - 1] === "]") && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
     function canonicalizeHost(parsed, options, schemeHandler, isIP) {
-      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && parsed.host[0] !== "[" && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
         try {
           parsed.host = new URL("http://" + parsed.host).hostname;
         } catch (e) {
@@ -91811,10 +91828,11 @@ var require_fast_uri = __commonJS({
         if (parsed.host) {
           const ipv4result = isIPv42(parsed.host);
           if (ipv4result === false) {
-            const bracketedIPLiteral = parsed.host[0] === "[" && parsed.host[parsed.host.length - 1] === "]";
+            const bracketedIPLiteral = isIPLiteral(parsed.host);
+            const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
             const ipv6result = normalizeIPv6(parsed.host);
             isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
-            malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true;
+            malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
             parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
               parsed.error = parsed.error || "URI host is malformed.";
@@ -91837,7 +91855,9 @@ var require_fast_uri = __commonJS({
           parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-        malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+        if (!malformedIPLiteral) {
+          malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+        }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (uri.indexOf("%") !== -1) {
             if (parsed.host !== void 0 && !malformedIPLiteral) {
@@ -106808,7 +106828,7 @@ var init_governed_codex_profile = __esm({
 function governedAttestationPredicate(error40) {
   return error40 instanceof TypeError ? GOVERNED_ATTESTATION_ERROR_PREDICATES.get(error40.message) ?? null : null;
 }
-function governedAnswerFailure(stage, nativeEventFailureBoundary = null, nativeEventFailureSubreason = null, nativeEventFailureCorrelationOperand = null, nativeEventFailureAttestationPredicate = null, schemaResultValidationSubreason = null, schemaResultValidationKeyword = null) {
+function governedAnswerFailure(stage, nativeEventFailureBoundary = null, nativeEventFailureSubreason = null, nativeEventFailureCorrelationOperand = null, nativeEventFailureAttestationPredicate = null, schemaResultValidationSubreason = null, schemaResultValidationKeyword = null, providerEngineFailureBoundary = null) {
   return new GovernedAnswerFailure(
     stage,
     nativeEventFailureBoundary,
@@ -106816,21 +106836,23 @@ function governedAnswerFailure(stage, nativeEventFailureBoundary = null, nativeE
     nativeEventFailureCorrelationOperand,
     nativeEventFailureAttestationPredicate,
     schemaResultValidationSubreason,
-    schemaResultValidationKeyword
+    schemaResultValidationKeyword,
+    providerEngineFailureBoundary
   );
 }
-function normalizeGovernedAnswerFailure(error40, fallback = "unknown", nativeEventFailureBoundary = null, nativeEventFailureSubreason = null, nativeEventFailureCorrelationOperand = null, schemaResultValidationSubreason = null, schemaResultValidationKeyword = null) {
+function normalizeGovernedAnswerFailure(error40, fallback = "unknown", nativeEventFailureBoundary = null, nativeEventFailureSubreason = null, nativeEventFailureCorrelationOperand = null, schemaResultValidationSubreason = null, schemaResultValidationKeyword = null, providerEngineFailureBoundary = null, nativeEventFailureAttestationPredicate = null) {
   return error40 instanceof GovernedAnswerFailure ? error40 : governedAnswerFailure(
     fallback,
     nativeEventFailureBoundary,
     nativeEventFailureSubreason,
     nativeEventFailureCorrelationOperand,
-    fallback === "native_event_grammar" && nativeEventFailureBoundary === "live_envelope_session" && nativeEventFailureSubreason === "attestation" ? governedAttestationPredicate(error40) : null,
+    fallback === "native_event_grammar" && nativeEventFailureBoundary === "live_envelope_session" && nativeEventFailureSubreason === "attestation" ? nativeEventFailureAttestationPredicate ?? governedAttestationPredicate(error40) : null,
     schemaResultValidationSubreason,
-    schemaResultValidationKeyword
+    schemaResultValidationKeyword,
+    providerEngineFailureBoundary
   );
 }
-var GOVERNED_ANSWER_FAILURE_STAGES, GOVERNED_NATIVE_EVENT_FAILURE_BOUNDARIES, GOVERNED_NATIVE_EVENT_FAILURE_SUBREASONS, GOVERNED_NATIVE_EVENT_FAILURE_CORRELATION_OPERANDS, GOVERNED_NATIVE_EVENT_FAILURE_ATTESTATION_PREDICATES, GOVERNED_SCHEMA_RESULT_VALIDATION_SUBREASONS, GOVERNED_SCHEMA_RESULT_VALIDATION_KEYWORDS, GOVERNED_ATTESTATION_ERROR_PREDICATES, GovernedAnswerFailure;
+var GOVERNED_ANSWER_FAILURE_STAGES, GOVERNED_PROVIDER_ENGINE_FAILURE_BOUNDARIES, GOVERNED_NATIVE_EVENT_FAILURE_BOUNDARIES, GOVERNED_NATIVE_EVENT_FAILURE_SUBREASONS, GOVERNED_NATIVE_EVENT_FAILURE_CORRELATION_OPERANDS, GOVERNED_NATIVE_EVENT_FAILURE_ATTESTATION_PREDICATES, GOVERNED_SCHEMA_RESULT_VALIDATION_SUBREASONS, GOVERNED_SCHEMA_RESULT_VALIDATION_KEYWORDS, GOVERNED_ATTESTATION_ERROR_PREDICATES, GovernedAnswerFailure;
 var init_governed_answer_failure = __esm({
   "src/agent/engines/governed-answer-failure.js"() {
     "use strict";
@@ -106838,8 +106860,10 @@ var init_governed_answer_failure = __esm({
       "native_event_grammar",
       "provider_engine",
       "schema_result_validation",
+      "internal_contract",
       "unknown"
     ]);
+    GOVERNED_PROVIDER_ENGINE_FAILURE_BOUNDARIES = /* @__PURE__ */ new Set(["acquire", "query", "close"]);
     GOVERNED_NATIVE_EVENT_FAILURE_BOUNDARIES = /* @__PURE__ */ new Set([
       "raw_item_predicate",
       "live_envelope_session"
@@ -106883,7 +106907,9 @@ var init_governed_answer_failure = __esm({
       "value_shape",
       "kind",
       "native_tool_evidence",
-      "internal_contract"
+      "internal_contract",
+      "invocation_attestation",
+      "native_capability_aggregate"
     ]);
     GOVERNED_SCHEMA_RESULT_VALIDATION_SUBREASONS = /* @__PURE__ */ new Set([
       "response_json",
@@ -106966,7 +106992,7 @@ var init_governed_answer_failure = __esm({
       ["Invalid profile capability overlap", "internal_contract"]
     ]);
     GovernedAnswerFailure = class extends Error {
-      constructor(stage, nativeEventFailureBoundary = null, nativeEventFailureSubreason = null, nativeEventFailureCorrelationOperand = null, nativeEventFailureAttestationPredicate = null, schemaResultValidationSubreason = null, schemaResultValidationKeyword = null) {
+      constructor(stage, nativeEventFailureBoundary = null, nativeEventFailureSubreason = null, nativeEventFailureCorrelationOperand = null, nativeEventFailureAttestationPredicate = null, schemaResultValidationSubreason = null, schemaResultValidationKeyword = null, providerEngineFailureBoundary = null) {
         super();
         delete this.stack;
         const answerFailureStage = GOVERNED_ANSWER_FAILURE_STAGES.has(stage) ? stage : "unknown";
@@ -106975,6 +107001,10 @@ var init_governed_answer_failure = __esm({
           value: answerFailureStage,
           enumerable: true
         });
+        if (answerFailureStage === "provider_engine") Object.defineProperty(this, "providerEngineFailureBoundary", {
+          value: GOVERNED_PROVIDER_ENGINE_FAILURE_BOUNDARIES.has(providerEngineFailureBoundary) ? providerEngineFailureBoundary : null,
+          enumerable: true
+        });
         if (answerFailureStage === "native_event_grammar") Object.defineProperty(this, "nativeEventFailureBoundary", {
           value: GOVERNED_NATIVE_EVENT_FAILURE_BOUNDARIES.has(nativeEventFailureBoundary) ? nativeEventFailureBoundary : null,
           enumerable: true
@@ -107985,7 +108015,9 @@ async function createCodexEngine(options = {}) {
           }
         });
         if (opts.abortSignal) {
-          if (opts.abortSignal.aborted) throw new Error("Codex query cancelled");
+          if (opts.abortSignal.aborted) {
+            throw governedProfile ? governedAnswerFailure("provider_engine", null, null, null, null, null, null, "query") : new Error("Codex query cancelled");
+          }
           abortHandler = () => {
             void cleanup(new Error("Codex query cancelled")).catch(() => {
             });
@@ -108018,7 +108050,16 @@ async function createCodexEngine(options = {}) {
         try {
           result = await resultPromise;
         } catch (error40) {
-          throw governedProfile ? governedAnswerFailure(evidenceFailure ? "unknown" : "provider_engine") : error40;
+          throw governedProfile ? evidenceFailure || normalizeGovernedAnswerFailure(
+            error40,
+            "provider_engine",
+            null,
+            null,
+            null,
+            null,
+            null,
+            "query"
+          ) : error40;
         }
         eventHandlers.delete(reqId);
         governedEvidenceHandlers.delete(reqId);
@@ -108036,17 +108077,50 @@ async function createCodexEngine(options = {}) {
               profile: governedProfile,
               events: governedProfile.version === "probe.governed-codex-profile/v2" ? [collected.sessionEvent, collected.capabilities.nativeTools] : [collected.sessionEvent]
             });
+          } catch (error40) {
+            throw normalizeGovernedAnswerFailure(
+              error40,
+              "native_event_grammar",
+              "live_envelope_session",
+              "attestation"
+            );
+          }
+          try {
             probeMcpCallCount = governedProfile.version === "probe.governed-codex-profile/v2" ? governedProbeMcpCallCount(mcpServer?.getGovernedCallEvidence()) : 0;
           } catch (error40) {
-            throw normalizeGovernedAnswerFailure(error40, "native_event_grammar", "live_envelope_session", "attestation");
-          }
-          attestation = hasInvocationDigest ? externalBoundReceipt(internal, dispatch, invocationDigest, {
-            nativeCallCount: collected.capabilities.nativeTools.total,
-            probeMcpCallCount
-          }) : externalReceipt(internal, {
-            nativeCallCount: collected.capabilities.nativeTools.total,
-            probeMcpCallCount
-          });
+            throw normalizeGovernedAnswerFailure(
+              error40,
+              "native_event_grammar",
+              "live_envelope_session",
+              "attestation",
+              null,
+              null,
+              null,
+              null,
+              "native_capability_aggregate"
+            );
+          }
+          try {
+            attestation = hasInvocationDigest ? externalBoundReceipt(internal, dispatch, invocationDigest, {
+              nativeCallCount: collected.capabilities.nativeTools.total,
+              probeMcpCallCount
+            }) : externalReceipt(internal, {
+              nativeCallCount: collected.capabilities.nativeTools.total,
+              probeMcpCallCount
+            });
+          } catch (error40) {
+            throw normalizeGovernedAnswerFailure(
+              error40,
+              "native_event_grammar",
+              "live_envelope_session",
+              "attestation",
+              null,
+              null,
+              null,
+              null,
+              "invocation_attestation"
+            );
+          }
           session.setConversationId(collected.sessionEvent.params.msg.session_id);
         }
         if (result && result.content && Array.isArray(result.content)) {
@@ -108083,7 +108157,7 @@ async function createCodexEngine(options = {}) {
           }
         };
       } catch (error40) {
-        if (governedProfile) error40 = normalizeGovernedAnswerFailure(error40, "unknown");
+        if (governedProfile) error40 = normalizeGovernedAnswerFailure(error40, "internal_contract");
         queryError = error40;
         if (debug) {
           console.error("[DEBUG] Codex query error:", error40);
@@ -108098,7 +108172,16 @@ async function createCodexEngine(options = {}) {
           try {
             await cleanup();
           } catch (cleanupError) {
-            if (!queryError) throw cleanupError;
+            if (!queryError) throw normalizeGovernedAnswerFailure(
+              cleanupError,
+              "provider_engine",
+              null,
+              null,
+              null,
+              null,
+              null,
+              "close"
+            );
           }
         }
       }
@@ -110202,7 +110285,18 @@ var init_ProbeAgent = __esm({
             }
             return this.engine;
           } catch (error40) {
-            if (this.governedCodexProfile) throw error40;
+            if (this.governedCodexProfile) {
+              throw normalizeGovernedAnswerFailure(
+                error40,
+                "provider_engine",
+                null,
+                null,
+                null,
+                null,
+                null,
+                "acquire"
+              );
+            }
             console.warn("[WARNING] Failed to load Codex CLI engine:", error40.message);
             console.warn("[WARNING] Falling back to Vercel AI SDK");
             this.clientApiProvider = null;
@@ -111073,38 +111167,99 @@ You are working with a workspace. Available paths: ${workspaceDesc}
         try {
           try {
             engine = await this.getEngine();
-          } catch {
-            throw governedAnswerFailure("provider_engine");
+          } catch (error40) {
+            throw normalizeGovernedAnswerFailure(
+              error40,
+              "provider_engine",
+              null,
+              null,
+              null,
+              null,
+              null,
+              "acquire"
+            );
           }
-          if (!engine?.query) throw governedAnswerFailure("provider_engine");
+          if (!engine?.query) throw governedAnswerFailure("internal_contract");
           const candidateChunks = [];
           let runtimeAttestation;
           let attestationCount = 0;
           let nativeToolBatch;
           let nativeToolBatchCount = 0;
           const queryOptions = hasInvocationDigest ? { abortSignal: this._abortController.signal, invocationDigest } : { abortSignal: this._abortController.signal };
-          for await (const chunk of engine.query(prompt, queryOptions)) {
-            if (chunk.type === "text" && chunk.content) candidateChunks.push(chunk.content);
-            else if (chunk.type === "metadata" && chunk.data?.attestation) {
-              runtimeAttestation = chunk.data.attestation;
-              attestationCount++;
-            } else if (chunk.type === "toolBatch") {
-              nativeToolBatch = chunk;
-              nativeToolBatchCount++;
-            } else if (chunk.type === "error") throw normalizeGovernedAnswerFailure(chunk.error, "unknown");
+          try {
+            for await (const chunk of engine.query(prompt, queryOptions)) {
+              if (chunk.type === "text" && chunk.content) candidateChunks.push(chunk.content);
+              else if (chunk.type === "metadata" && chunk.data?.attestation) {
+                runtimeAttestation = chunk.data.attestation;
+                attestationCount++;
+              } else if (chunk.type === "toolBatch") {
+                nativeToolBatch = chunk;
+                nativeToolBatchCount++;
+              } else if (chunk.type === "error") {
+                throw normalizeGovernedAnswerFailure(
+                  chunk.error,
+                  "provider_engine",
+                  null,
+                  null,
+                  null,
+                  null,
+                  null,
+                  "query"
+                );
+              }
+            }
+          } catch (error40) {
+            throw normalizeGovernedAnswerFailure(
+              error40,
+              "provider_engine",
+              null,
+              null,
+              null,
+              null,
+              null,
+              "query"
+            );
           }
           if (hasInvocationDigest) {
             const expectedAttestation = this.governedCodexProfile?.version === "probe.governed-codex-profile/v2" ? "probe.governed-codex-attestation/v3" : "probe.governed-codex-attestation/v2";
             if (attestationCount !== 1 || runtimeAttestation?.version !== expectedAttestation || runtimeAttestation?.executionContext?.source !== "caller" || runtimeAttestation?.executionContext?.invocationDigest !== invocationDigest) {
-              throw new Error("Expected exactly one matching governed invocation attestation");
+              throw governedAnswerFailure(
+                "native_event_grammar",
+                "live_envelope_session",
+                "attestation",
+                null,
+                "invocation_attestation"
+              );
             }
-          } else if (attestationCount !== 1) throw new Error(`Expected exactly one governed runtime attestation; received ${attestationCount}`);
+          } else if (attestationCount !== 1) {
+            throw governedAnswerFailure(
+              "native_event_grammar",
+              "live_envelope_session",
+              "attestation",
+              null,
+              "invocation_attestation"
+            );
+          }
           if (this.governedCodexProfile?.version === "probe.governed-codex-profile/v2") {
             if (nativeToolBatchCount !== 1 || !Number.isSafeInteger(nativeToolBatch?.total) || !Array.isArray(nativeToolBatch?.tools) || nativeToolBatch.total !== runtimeAttestation?.observed?.nativeTools?.total || JSON.stringify(nativeToolBatch.tools) !== JSON.stringify(runtimeAttestation?.observed?.nativeTools?.tools)) {
-              throw new Error("Expected exactly one matching governed native capability aggregate");
+              throw governedAnswerFailure(
+                "native_event_grammar",
+                "live_envelope_session",
+                "attestation",
+                null,
+                "native_capability_aggregate"
+              );
             }
             for (const toolEvent of nativeToolBatch.tools) this.events.emit("toolCall", toolEvent);
-          } else if (nativeToolBatchCount !== 0) throw new Error("Unexpected governed native capability aggregate");
+          } else if (nativeToolBatchCount !== 0) {
+            throw governedAnswerFailure(
+              "native_event_grammar",
+              "live_envelope_session",
+              "attestation",
+              null,
+              "native_capability_aggregate"
+            );
+          }
           const validation = validateJsonResponse(candidateChunks.join(""), { debug: this.debug, schema });
           if (!validation.isValid) throw governedSchemaResultValidationFailure(validation);
           if (hasResultIdentity) {
@@ -111120,14 +111275,23 @@ You are working with a workspace. Available paths: ${workspaceDesc}
           }
           return { data: validation.parsed, runtimeAttestation };
         } catch (error40) {
-          answerFailure = normalizeGovernedAnswerFailure(error40, "unknown");
+          answerFailure = normalizeGovernedAnswerFailure(error40, "internal_contract");
           throw answerFailure;
         } finally {
           if (engine) {
             try {
               await engine.close();
-            } catch {
-              if (!answerFailure) throw governedAnswerFailure("unknown");
+            } catch (error40) {
+              if (!answerFailure) throw normalizeGovernedAnswerFailure(
+                error40,
+                "provider_engine",
+                null,
+                null,
+                null,
+                null,
+                null,
+                "close"
+              );
             }
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@probelabs/probe",
-  "version": "0.6.0-rc335",
+  "version": "0.6.0-rc336",
   "description": "Node.js wrapper for the probe code search tool",
   "main": "src/index.js",
   "module": "src/index.js",

package/src/agent/ProbeAgent.js

@@ -2503,7 +2503,10 @@ export class ProbeAgent {
         }
         return this.engine;
       } catch (error) {
-        if (this.governedCodexProfile) throw error;
+        if (this.governedCodexProfile) {
+          throw normalizeGovernedAnswerFailure(error, 'provider_engine', null, null, null,
+            null, null, 'acquire');
+        }
         console.warn('[WARNING] Failed to load Codex CLI engine:', error.message);
         console.warn('[WARNING] Falling back to Vercel AI SDK');
         this.clientApiProvider = null;
@@ -3530,8 +3533,11 @@ Follow these instructions carefully:
     let engine, answerFailure = null;
     try {
       try { engine = await this.getEngine(); }
-      catch { throw governedAnswerFailure('provider_engine'); }
-      if (!engine?.query) throw governedAnswerFailure('provider_engine');
+      catch (error) {
+        throw normalizeGovernedAnswerFailure(error, 'provider_engine', null, null, null,
+          null, null, 'acquire');
+      }
+      if (!engine?.query) throw governedAnswerFailure('internal_contract');
       const candidateChunks = [];
       let runtimeAttestation;
       let attestationCount = 0;
@@ -3540,31 +3546,47 @@ Follow these instructions carefully:
       const queryOptions = hasInvocationDigest
         ? { abortSignal: this._abortController.signal, invocationDigest: invocationDigest }
         : { abortSignal: this._abortController.signal };
-      for await (const chunk of engine.query(prompt, queryOptions)) {
-        if (chunk.type === 'text' && chunk.content) candidateChunks.push(chunk.content);
-        else if (chunk.type === 'metadata' && chunk.data?.attestation) {
-          runtimeAttestation = chunk.data.attestation;
-          attestationCount++;
-        } else if (chunk.type === 'toolBatch') {
-          nativeToolBatch = chunk;
-          nativeToolBatchCount++;
-        } else if (chunk.type === 'error') throw normalizeGovernedAnswerFailure(chunk.error, 'unknown');
+      try {
+        for await (const chunk of engine.query(prompt, queryOptions)) {
+          if (chunk.type === 'text' && chunk.content) candidateChunks.push(chunk.content);
+          else if (chunk.type === 'metadata' && chunk.data?.attestation) {
+            runtimeAttestation = chunk.data.attestation;
+            attestationCount++;
+          } else if (chunk.type === 'toolBatch') {
+            nativeToolBatch = chunk;
+            nativeToolBatchCount++;
+          } else if (chunk.type === 'error') {
+            throw normalizeGovernedAnswerFailure(chunk.error, 'provider_engine', null, null, null,
+              null, null, 'query');
+          }
+        }
+      } catch (error) {
+        throw normalizeGovernedAnswerFailure(error, 'provider_engine', null, null, null,
+          null, null, 'query');
       }
       if (hasInvocationDigest) {
         const expectedAttestation = this.governedCodexProfile?.version === 'probe.governed-codex-profile/v2'
           ? 'probe.governed-codex-attestation/v3' : 'probe.governed-codex-attestation/v2';
         if (attestationCount !== 1 || runtimeAttestation?.version !== expectedAttestation || runtimeAttestation?.executionContext?.source !== 'caller' || runtimeAttestation?.executionContext?.invocationDigest !== invocationDigest) {
-          throw new Error('Expected exactly one matching governed invocation attestation');
+          throw governedAnswerFailure('native_event_grammar', 'live_envelope_session', 'attestation', null,
+            'invocation_attestation');
         }
-      } else if (attestationCount !== 1) throw new Error(`Expected exactly one governed runtime attestation; received ${attestationCount}`);
+      } else if (attestationCount !== 1) {
+        throw governedAnswerFailure('native_event_grammar', 'live_envelope_session', 'attestation', null,
+          'invocation_attestation');
+      }
       if (this.governedCodexProfile?.version === 'probe.governed-codex-profile/v2') {
         if (nativeToolBatchCount !== 1 || !Number.isSafeInteger(nativeToolBatch?.total) ||
           !Array.isArray(nativeToolBatch?.tools) || nativeToolBatch.total !== runtimeAttestation?.observed?.nativeTools?.total ||
           JSON.stringify(nativeToolBatch.tools) !== JSON.stringify(runtimeAttestation?.observed?.nativeTools?.tools)) {
-          throw new Error('Expected exactly one matching governed native capability aggregate');
+          throw governedAnswerFailure('native_event_grammar', 'live_envelope_session', 'attestation', null,
+            'native_capability_aggregate');
         }
         for (const toolEvent of nativeToolBatch.tools) this.events.emit('toolCall', toolEvent);
-      } else if (nativeToolBatchCount !== 0) throw new Error('Unexpected governed native capability aggregate');
+      } else if (nativeToolBatchCount !== 0) {
+        throw governedAnswerFailure('native_event_grammar', 'live_envelope_session', 'attestation', null,
+          'native_capability_aggregate');
+      }
       const validation = validateJsonResponse(candidateChunks.join(''), {debug:this.debug,schema});
       if (!validation.isValid) throw governedSchemaResultValidationFailure(validation);
       if (hasResultIdentity) {
@@ -3577,12 +3599,15 @@ Follow these instructions carefully:
       }
       return { data: validation.parsed, runtimeAttestation };
     } catch (error) {
-      answerFailure = normalizeGovernedAnswerFailure(error, 'unknown');
+      answerFailure = normalizeGovernedAnswerFailure(error, 'internal_contract');
       throw answerFailure;
     } finally {
       if (engine) {
         try { await engine.close(); }
-        catch { if (!answerFailure) throw governedAnswerFailure('unknown'); }
+        catch (error) {
+          if (!answerFailure) throw normalizeGovernedAnswerFailure(error, 'provider_engine', null, null, null,
+            null, null, 'close');
+        }
       }
     }
   }