@segmentstream/agent 0.25.5 → 0.25.7

package/README.md

@@ -717,12 +717,15 @@ See [migration and verification](../../docs/agent-chat-delivery-migration.md).
 
 If Eve's session lookup raises `RunKeyFetchError` with HTTP 404 and Vercel's
 `not_found` / `Deployment not found.` response, the Telegram adapter records the
-original diagnostic and uses a fresh continuation scoped to the serving deployment.
-The smart gate still decides whether to reply; observing a message creates no session
-and sends no failure notice. Independent requests and cold starts select the same
-replacement. Healthy sessions continue across deployments as before. Once an address
-needs recovery, later deployments start it fresh; archived conversation context remains
+original diagnostic and continues the address at a successor named by the address and
+the unreachable run. The smart gate still decides whether to reply; observing a message
+creates no session and sends no failure notice. Every deployment, independent request and
+cold start selects the same successor, and Eve hands it over between deployments like any
+healthy session. If the successor's own deployment is deleted later, the next successor
+follows the same rule, up to four in a row. Archived conversation context remains
 available, but the inaccessible session's model history and pending inputs cannot migrate.
+`segmentstream history squash` deletes earlier deployments and so ends the sessions
+they own; each affected address continues once at its successor.
 
 Recovery applies only to session reads. Dispatch failures are never retried because
 the inbox may already have accepted them. Other provider errors propagate to operator

package/dist/_chunks/{build-metadata-B_sSM5pA.mjs → build-metadata-Wt6SOKfE.mjs}

@@ -4,7 +4,7 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-var version = "0.25.5";
+var version = "0.25.7";
 function agentBuild(environment = process.env) {
 	return {
 		agent: version,

package/dist/extension/instructions.md

@@ -48,7 +48,8 @@ when it matters, tell the requester the action did not run and that they can ask
   the tool boundary's workspace-authored confirmation buttons. Call the action to start that flow; never ask for
   approval in prose or treat a text acknowledgement as approval. Wait for the button outcome.
   When the tool schema offers `_confirmation`, supply {question, confirm, cancel, done,
-  cancelled, failed, expired?, edit?} in the chat's language. Describe the action and key
+  cancelled, failed, expired?, edit?} in the chat's language; a call needing a card without
+  valid copy is refused before any card. Describe the action and key
   parameters in a plain single-line question (at most 300 characters); labels are at most
   24 characters. No IDs, tool names, snake_case, URLs, credentials, or markup. The platform
   adds trusted facts. Omit this argument on older tools without schema support.

package/dist/extension/lib/build-metadata.mjs

@@ -4,5 +4,5 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { t as agentBuild } from "../../_chunks/build-metadata-B_sSM5pA.mjs";
+import { t as agentBuild } from "../../_chunks/build-metadata-Wt6SOKfE.mjs";
 export { agentBuild };

package/dist/extension/lib/confirmations.d.ts

@@ -39,6 +39,11 @@ export declare const confirmations: StateHandle<Record<string, Confirmation>>;
 export declare function actionApproval(options: {
     readonly labels: (actor: OntologyActor, action: string, input: Readonly<Record<string, unknown>>) => Promise<ActionAnnotations>;
     readonly describe?: (actor: OntologyActor, action: string, input: Readonly<Record<string, unknown>>) => Promise<ConfirmationDescription>;
+    /**
+     * The call's `_confirmation` when the tool input does not carry it itself, such as a file-backed
+     * call whose arguments are snapshotted elsewhere. Defaults to the tool input's own field.
+     */
+    readonly copy?: (actor: OntologyActor, input: Readonly<Record<string, unknown>>) => unknown;
     readonly texts?: () => TelegramTexts;
     readonly state?: StateHandle<Record<string, Confirmation>>;
     readonly now?: () => number;

package/dist/extension/lib/confirmations.mjs

@@ -65,10 +65,13 @@ function actionApproval(options) {
 				console.warn("The ontology action permission check failed.", error);
 				return denied("The action is unavailable or the member no longer has permission.");
 			}
-			const copy = labels.confirmation === false ? void 0 : confirmationCopy(ctx.toolInput?._confirmation);
+			const offered = options.copy === void 0 ? ctx.toolInput?._confirmation : options.copy(member(memberId), ctx.toolInput ?? {});
+			const copy = labels.confirmation === false ? void 0 : confirmationCopy(offered);
 			const businessInput = Object.fromEntries(Object.entries(ctx.toolInput ?? {}).filter(([key]) => key !== "_confirmation"));
 			const posting = isChatPost(ctx.toolName);
 			let description;
+			const missingCopy = () => denied((offered === void 0 ? "This action needs a confirmation card and the call has no _confirmation. " : "The call's _confirmation is invalid. ") + "Make the call again with _confirmation (for a file call, in its arguments file) in the chat's language: a plain single-line question naming the action and its key records and amounts (at most 300 characters), and short confirm, cancel, done, cancelled and failed labels without emoji.");
+			if (posting && saved === void 0 && labels.confirmation === true && copy === void 0) return missingCopy();
 			if (posting) try {
 				description = await options.describe?.(member(memberId), ctx.toolName, businessInput);
 				const preview = description?.chatPost;
@@ -96,6 +99,7 @@ function actionApproval(options) {
 			}
 			if (saved !== void 0) return denied("The original call is waiting for its Confirm / Cancel buttons.");
 			if (!posting && !needsConfirmation(labels)) return "approved";
+			if (labels.confirmation === true && copy === void 0) return missingCopy();
 			try {
 				if (!posting) description = await options.describe?.(member(memberId), ctx.toolName, businessInput);
 				if (description === void 0) throw new Error("A trusted confirmation description is required.");

package/dist/extension/lib/ontology-file-call.mjs

@@ -48,7 +48,15 @@ function ontologyFileCall(texts) {
 		},
 		describe: async (actor, _action, input) => {
 			const saved = bound(input, ownerOf(actor));
-			return ontologyTools({ principal }).describe(actor, saved.name, saved.arguments);
+			const business = Object.fromEntries(Object.entries(saved.arguments).filter(([key]) => key !== "_confirmation"));
+			return ontologyTools({ principal }).describe(actor, saved.name, business);
+		},
+		copy: (actor, input) => {
+			try {
+				return bound(input, ownerOf(actor)).arguments._confirmation;
+			} catch {
+				return;
+			}
 		},
 		texts
 	});
@@ -70,7 +78,7 @@ function ontologyFileCall(texts) {
 	}
 	return defineTool({
 		deferred: true,
-		description: "Call an ontology tool with the complete JSON object computed in a sandbox file. Use for script-generated arguments, or set save_result to save a permitted read's exact JSON result in the isolated sandbox for scripts, without copying rows through the model. Find the real tool and its schema through Eve search first; ordinary inline calls use Eve. Chat posting is excluded. Saving a result never permits a write tool or expands query limits.",
+		description: "Call an ontology tool with the complete JSON object computed in a sandbox file. Use for script-generated arguments, or set save_result to save a permitted read's exact JSON result in the isolated sandbox for scripts, without copying rows through the model. Find the real tool and its schema through Eve search first; ordinary inline calls use Eve. Chat posting is excluded. Saving a result never permits a write tool or expands query limits. When the tool's schema offers _confirmation and the call needs a card, put it in the file.",
 		inputSchema: {
 			type: "object",
 			properties: {

package/dist/extension/lib/telegram/adapter.mjs

@@ -24,7 +24,7 @@ import { MAXIMUM_DOWNLOAD_BYTES, connectionProxy } from "../connection-proxy.mjs
 import { dispatchStructuredMessage, structuredMessage } from "./structured.mjs";
 import { scopedAddress, sessionPolicy } from "./sessions.mjs";
 import { handleWorkspaceCallback, isWorkspaceCallback } from "./callbacks.mjs";
-import { t as agentBuild } from "../../../_chunks/build-metadata-B_sSM5pA.mjs";
+import { t as agentBuild } from "../../../_chunks/build-metadata-Wt6SOKfE.mjs";
 import { attachmentLifecycle } from "./lifecycle.mjs";
 import { gatewayImageDescriber } from "./images.mjs";
 import { gatewayAttachmentDescriber } from "./attachment-description.mjs";
@@ -446,7 +446,7 @@ function segmentstreamTelegram(options) {
 	return {
 		...channel,
 		async receive(input, operations) {
-			operations = recoverableSessions(operations, environment.VERCEL_DEPLOYMENT_ID, readHistory);
+			operations = recoverableSessions(operations, readHistory);
 			const target = input.target;
 			if (target.confirmationSessionId !== void 0) {
 				const address = target.confirmationAddress;
@@ -516,7 +516,7 @@ function gatedRoute(input) {
 			if (options.settings() === null) return new Response("not found", { status: 404 });
 			args = {
 				...args,
-				...recoverableSessions(args, environment.VERCEL_DEPLOYMENT_ID, input.readHistory)
+				...recoverableSessions(args, input.readHistory)
 			};
 			let description;
 			const describe = () => description ??= args.describe();

package/dist/extension/lib/telegram/durable-typing.d.ts

@@ -11,6 +11,8 @@ export interface TelegramTypingSource {
 export interface TypingCursor {
     readonly index: number;
     readonly turnId: string | null;
+    /** When the monitor first ran, in epoch milliseconds; continuations carry it forward. */
+    readonly startedAt?: number;
 }
 interface TypingEvent {
     readonly type: string;
@@ -40,6 +42,8 @@ export interface TypingBlockResult {
     readonly reason: string;
     readonly sent: number;
 }
+/** The longest a turn shows typing; a longer turn keeps working without the indicator. */
+export declare const MAX_TYPING_MS: number;
 /** One bounded activity. Its durable parent continues independently of the webhook host. */
 export declare function runTypingBlock(source: TelegramTypingSource, cursor: TypingCursor, dependencies: TypingBlockDependencies): Promise<TypingBlockResult>;
 export declare function telegramTypingBlock(source: TelegramTypingSource, cursor: TypingCursor, sessionStatus: string): Promise<TypingBlockResult>;

package/dist/extension/lib/telegram/durable-typing.mjs

@@ -12,18 +12,22 @@ import { p as reportTelegramError } from "../../../_chunks/inbound-request-xmrm-
 import { connectionProxy } from "../connection-proxy.mjs";
 import { sessions } from "eve/server";
 const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const MAX_TYPING_MS = 18e5;
 async function runTypingBlock(source, cursor, dependencies) {
 	const deadline = dependencies.now() + 3e4;
+	const startedAt = cursor.startedAt ?? dependencies.now();
 	let index = cursor.index, turnId = cursor.turnId ?? source.turnId ?? null, sent = 0;
 	const result = (done, reason) => ({
 		cursor: {
 			index,
-			turnId
+			turnId,
+			startedAt
 		},
 		done,
 		reason,
 		sent
 	});
+	if (dependencies.now() - startedAt >= 18e5) return result(true, "typing_expired");
 	if ([
 		"completed",
 		"failed",
@@ -175,4 +179,4 @@ async function recordTelegramTypingStart(source, workflowRunId) {
 		});
 	}
 }
-export { recordTelegramTypingStart, runTypingBlock, telegramTypingBlock };
+export { MAX_TYPING_MS, recordTelegramTypingStart, runTypingBlock, telegramTypingBlock };

package/dist/extension/lib/telegram/health.mjs

@@ -5,7 +5,7 @@ const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { runtimeRequestFailure } from "./runtime-request.mjs";
-import { t as agentBuild } from "../../../_chunks/build-metadata-B_sSM5pA.mjs";
+import { t as agentBuild } from "../../../_chunks/build-metadata-Wt6SOKfE.mjs";
 import { GET } from "eve/channels";
 const HEALTH_ROUTE = "/eve/v1/telegram/health";
 function healthRoute(input) {

package/dist/extension/lib/telegram/lifecycle.mjs

@@ -10,7 +10,7 @@ import { n as currentInboundRequest, p as reportTelegramError } from "../../../_
 import { member } from "../actor.mjs";
 import { needsConfirmation } from "../confirmations.mjs";
 import { OntologyActionNotPermitted, actionToolName, ontologyTools } from "../ontology-tools.mjs";
-import { t as agentBuild } from "../../../_chunks/build-metadata-B_sSM5pA.mjs";
+import { t as agentBuild } from "../../../_chunks/build-metadata-Wt6SOKfE.mjs";
 var AttachmentLifecycleNotPermitted = class extends Error {
 	code = "attachment_lifecycle_not_permitted";
 };

package/dist/extension/lib/telegram/session-recovery.d.ts

@@ -2,9 +2,10 @@ import type { ChannelReceiveContext } from "eve/channels";
 import type { HistoryReader } from "./sessions.js";
 /**
  * A deleted deployment can make the Workflow metadata key unreadable before Eve can hand off a session.
- * Recover on a read, before dispatch: independent requests on this deployment use the same fresh
- * continuation. Healthy addresses keep their owner across deploys. An already broken address
- * gets a fresh owner on each deployment; the archive remains the source of routing context.
+ * Eve cannot reset that owner, so the address continues at a successor named by the address and the
+ * unreachable run. Every deployment derives the same successor, and Eve hands it over between
+ * deployments like any healthy session; if its own deployment is later deleted, the next successor
+ * follows the same rule. Recover on a read, before dispatch. Healthy addresses keep their owner.
  * No send is retried: a dispatch error can mean the durable inbox already accepted the message.
  */
-export declare function recoverableSessions<State>(operations: ChannelReceiveContext<State>, deploymentId: string | undefined, readHistory?: HistoryReader): ChannelReceiveContext<State>;
+export declare function recoverableSessions<State>(operations: ChannelReceiveContext<State>, readHistory?: HistoryReader): ChannelReceiveContext<State>;

package/dist/extension/lib/telegram/session-recovery.mjs

@@ -6,17 +6,18 @@ __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { p as reportTelegramError } from "../../../_chunks/inbound-request-xmrm-49O.mjs";
 import { createHash } from "node:crypto";
-function missingDeployment(error) {
-	if (!(error instanceof Error) || error.name !== "RunKeyFetchError" || !("status" in error) || error.status !== 404) return false;
-	const body = /^Failed to fetch run key for wrun_[\w-]+ \(deployment dpl_[\w-]+\): HTTP 404 [^\n]+? — (.+)$/u.exec(error.message)?.[1];
+function strandedRun(error) {
+	if (!(error instanceof Error) || error.name !== "RunKeyFetchError" || !("status" in error) || error.status !== 404) return;
+	const match = /^Failed to fetch run key for (wrun_[\w-]+) \(deployment dpl_[\w-]+\): HTTP 404 [^\n]+? — (.+)$/u.exec(error.message);
 	try {
-		const response = JSON.parse(body ?? "");
-		return response?.error?.code === "not_found" && response.error.message === "Deployment not found.";
+		const response = JSON.parse(match?.[2] ?? "");
+		return response?.error?.code === "not_found" && response.error.message === "Deployment not found." ? match?.[1] : void 0;
 	} catch {
-		return false;
+		return;
 	}
 }
-function recoverableSessions(operations, deploymentId, readHistory) {
+const MAX_SUCCESSORS = 4;
+function recoverableSessions(operations, readHistory) {
 	const replacements = new Map();
 	const readable = new Map();
 	const target = (address) => replacements.get(address) ?? address;
@@ -33,18 +34,21 @@ function recoverableSessions(operations, deploymentId, readHistory) {
 		return session;
 	}
 	async function resolveSession(address) {
-		try {
-			return await lookup(target(address));
+		let current = target(address);
+		for (let successors = 0;; successors += 1) try {
+			return await lookup(current);
 		} catch (error) {
-			if (!deploymentId || replacements.has(address) || !missingDeployment(error)) throw error;
-			const replacement = `${address}:recovery:${createHash("sha256").update(JSON.stringify([address, deploymentId])).digest("hex")}`;
+			const run = successors < MAX_SUCCESSORS ? strandedRun(error) : void 0;
+			if (run === void 0) throw error;
+			const digest = createHash("sha256").update(JSON.stringify([current, run])).digest("hex");
+			const replacement = `${current}:recovery:${digest}`;
 			reportTelegramError("session_resume_recovered", error, {
-				address,
+				address: current,
 				replacement,
-				deploymentId
+				strandedRun: run
 			});
 			replacements.set(address, replacement);
-			return lookup(replacement);
+			current = replacement;
 		}
 	}
 	async function source(address) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segmentstream/agent",
-  "version": "0.25.5",
+  "version": "0.25.7",
   "description": "Mount a SegmentStream workspace's agent on eve: the ontology as tools, acting as the member who writes, and Telegram through the workspace's connection.",
   "license": "Apache-2.0",
   "author": "SegmentStream",