@sema-agent/core 5.9.0 → 5.11.0

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # Changelog
 
+## 5.11.0 — 2026-08-04
+
+### BREAKING
+
+- **The restart-loop suspend cap counts CONSECUTIVE NO-PROGRESS suspends, not total approvals.** The cap's stated purpose is catching a restart-prone model re-issuing the same gated call forever — yet it counted distinct approved-and-executed gates identically, so under a doctrine that asks per call (`shellGate:"classify"` + out-of-root reads) a fully cooperating approver was killed on the 6th legitimate Yes (`suspend.loop`, default `maxSuspends: 5`). The chain base now resets the moment the resume leg starts EXECUTING the approved pending call (an execution that then errors still consumed the approval — it reset the chain); a park whose approved call never ran keeps accumulating. **Consumer flips**: checkpoint `suspendCount` restarts at 1 after each executed approval — probes pinning a monotonically increasing `suspendCount` across approve-execute cycles red; `maxSuspends` now bounds no-progress chains, never the total number of approvals a run may receive.
+- **`SubagentErrorKind` closed set gains a sixth member: `"governance"`.** A FAILED child whose `errorCode` carries the `usage.*` prefix (deployment usage window refused/exhausted) now classifies as `governance` with `retryable: false` — it is DEFERRED-retryable: re-issuing NOW gets the same refusal, but the refusal lifts at the card's `retryAfterMs`. Previously these folded into `logic` ("re-delegating unchanged won't help"), which told a scheduler to abandon a subtask that merely needed to wait. The transient retry set (`rate_limit`/`overloaded`/`timeout`/`network` → `retryable: true`) is untouched. **Consumer flips**: switches over the closed five-member kind set add a `governance` arm; the completed agent card now pairs `error_kind: "governance"` with `retryAfterMs` on window-exhausted children.
+
+- **Deferred-tool activation no longer rewrites the provider tools block — `toolMaterializeStrategy` defaults to `"static"`.** Tools serialize FIRST in the provider prompt-cache hierarchy, so the old activation swap (placeholder → full schema via setTools) invalidated the entire conversation cache — 29% of benchmarked trials paid an average ~31k tokens per break. Under the new default the placeholder bytes persist for the whole run; the full schema reaches the model through the ToolSearch result text (existing carrier) and engine-side validation against the REAL schema is unchanged. Ruled GO by a live A/B on the weakest BYOM model (15/15 argument instances correct, three scenario classes incl. nested/optional params). `"swap"` is the explicit opt-back (spec or `SEMA_TOOL_MATERIALIZE_STRATEGY`, invalid env value refused loudly as `config.tool_materialize_invalid`). **Consumer flips**: probes pinning the post-activation full schema in the tools block red — the activation announcement frames and genuine roster changes (MCP refresh) are unchanged.
+
+### Added
+
+- **A shell-gated ask persists the live shellGate doctrine on its risk descriptor.** Field forensics could not answer "was `classify` or `always` live when this gate fired" from any persisted artifact. The mint now stamps `RiskDescriptor.shellGateDoctrine` (`"classify" | "always"`, present only on shell-gated asks — `"off"` never mints) so the checkpoint row self-reports its provenance. Additive optional field.
+- **`TaskSpec.additionalReadDirectories` — a read-only fence widening.** Extra directories the READ faces admit and nothing else: the `shellGate:"classify"` read boundary (a provably read-only command like `head <dir>/settings.json` auto-allows instead of consulting the approver on every call — the interactive kill shape this exists for), plus read_file/grep/glob/repo_map and `bash_readonly` containment. The write faces (edit_file/write_file/notebook_edit) refuse these directories exactly as before — a read grant never silently becomes a write grant (`additionalDirectories` remains the read+write widening). Same canonicalization/fail-closed-skip rules as `additionalDirectories` (the skip trace gains an optional `field` discriminator); announced in `# Environment` as `Additional read-only directories:`; inherited down the delegation tree on the same seat as `additionalDirectories`. Additive — absent ⇒ byte-identical behavior.
+
+### Fixed
+
+- **WebFetch stops laundering emptiness into authority (grounding contract).** A shell page (tiny extracted text, or near-zero text ratio) now gets a TRUSTED grounding verdict outside the untrusted fence, the full extracted text appended for verification, and additive `details.grounding{level,textChars,bytes,textRatio}`; an incomplete body is called a retrieved prefix. The summarizer input budget derives from the summary model's window (flat 100k retired; trimmed input disclosed structurally and in the rendered head; NaN model metadata refused loudly). Recovery prose names Bash/curl only when reachable in THIS run. The summary prompt gains a grounding clause (report absence rather than infer; a filename is only evidence about naming) ahead of the byte-fixed CC guidelines tail.
+- **A truncated-tool-arguments disclosure names the request output cap when one was armed** (`request output cap in effect: N tokens`) on both brain lanes — a cut mid-arguments at the cap read as a generic provider error with no budget clue.
+- **agentStream's birth window is steerable**: an immediate `steer()` after `agentStream()` waits (bounded) for the loop's first prompt and lands on turn 1; a finished run keeps the honest refusal.
+- **A long-window zero-byte Bash timeout names its two honest readings** (stalled before producing output / holding it in a block buffer); short windows and abort arms stay bare.
+- **The background faces carry the governance wait hint.** A `usage.window_exhausted` background child's settle dropped `retryAfterMs` — every bg face (poll text, poll details, notification-adjacent durable row) said `retryable:false` with no way to know when the refusal lifts, while the sync report card carried the hint. The classification family gains its fourth seat end-to-end: settle mint → registry row → durable archival row → poll `details.retryAfterMs` → the poll text clause (`(error_kind: governance, retryable: false, retry_after_ms: N)`); a revive clears it with its three siblings. Additive on every face.
+- **The `suspend.loop` terminal diagnoses the every-approval-was-Yes kill.** When every recorded gate decision on the run was ALLOW, the message now names the shape (a gate that keeps asking × an approver that keeps approving consumed the suspend allowance on legitimate work) and the remedies (a live `onAsk` parks nothing; keep benign commands inside the read boundary; raise `maxSuspends` for approval-heavy tasks) instead of reporting a bare restart-loop mystery.
+
+## 5.10.0 — 2026-08-04
+
+### Added
+
+- **`TaskSpec.checkpointStore` is three-valued**: `null` explicitly gives THIS run no durable store, even on a deployment that wired one (`undefined` still inherits `RunnerDeps.checkpointStore`; a store still overrides). All four legs into `status:"suspended"` (approval park / resource-slice / platform `env_lifetime`·`usage_window` / `plan_review`) are gated on a store being present, so a store-null run cannot reach `suspended` by construction and can never leave a pending checkpoint nobody resumes — the machine-started-run form (notification redelivery, maintenance sweeps). Existing no-store semantics apply: asks resolve at a live `onAsk` or fail-closed deny; limits are loud terminals; the plan/question durable faces are not mounted. Delegated children inherit it (sync/bg/fork/workflow spawn lanes). New Runner-filled `ToolExecuteContext.checkpointStoreDisabledForChildren` tells custom delegation tools to copy it. **Consumer notes**: `preempt()` becomes a documented no-op on store-null runs (existing `preempt.ignored` trace — "preemptible" is now two-valued; schedulers keep runs preemptible by leaving the field unset); a resume config carrying `null` refuses loudly (`checkpoint.not_found`) instead of silently resuming against deps.
+
+### Fixed
+
+- **Eight `tool_end.structured` cards were minted and then dropped before the wire.** The projection allowlist (`details.type`) had never been reconciled against the tools that mint cards, so a host got nothing structured for: `ReportFindings` (worst case — its model face is deliberately compressed to `"N findings reported."`, so the findings reached *neither* the model *nor* the host), `ScheduleWakeup`, `SendMessage`, `AgentTranscript`, the A2A peer tools, the PDF `document` card (whose own 48K base64 budget was written against a size gate it never reached), the `bash_readonly` out-of-root refusal, and the **completed** delegation report — the one card `tool_end.structured`'s own contract names by name, while only the `async_launched` receipt could actually arrive. Registered words added: `report-findings`, `schedule-wakeup`, `send-message`, `agent-transcript`, `a2a`, `document`, `readonly_out_of_root`. Two mint sites gained the `type` discriminant they lacked (`ReportFindings`; the three `bash_readonly` refusal arms, following the `path_not_in_root` precedent) — `details.code` is untouched for existing readers. Model faces are byte-unchanged everywhere; this is purely the host face that was missing. **Consumer notes**: a shell that prose-matched any of these can now read fields; a probe asserting `structured === undefined` for them reds.
+
+- **An interrupted tool call's synthetic `tool_end` finally carries a body — and the wake/crash leg emits one at all.** Both reconcile legs closed orphan calls in the transcript with the full `[INTERRUPTED]` explanation the model reads, while the event stream got `isError: true` and nothing else: a consumer rendering tool output from frames showed an empty result for every interrupted call, and the two faces of one call disagreed. The frames now carry `output` (the exact persisted text, same projection as every live tool result) and `errorCode` (`interrupted_never_started` | `interrupted_outcome_unknown` — the persisted `details.errorKind`, so a consumer discriminates on a code instead of prose-matching), plus the tool's display `label` and the usual `eventId`/subagent attribution. Separately, the **wake/crash** leg (a previous PROCESS died holding the calls) used to repair the transcript and tell the stream *nothing*: no `tool_end`, no `message_committed`. It now replays the same pair at run open — the only channel through which that news can ever arrive, since the process that owned those calls is gone. `ReconcileReport.recovered` entries gained `text` and `errorKind` (new exported type `RecoveredOrphan`, `ReconciledErrorKind`). **Consumer flips**: a probe pinning "the interrupted `tool_end` has no `output`" reds; a resumed run on a crashed session now emits one `tool_end` + one `message_committed` per orphan before its first turn, so an exact event-count or first-event assertion on that path reds (there is deliberately no matching `tool_start` — the start belonged to the dead process's stream).
+
+- **The idle-park notification redelivery carries task identity.** A notification parked while the session sat idle is redelivered on the next run's stream as the same `task_notification` family — but that push shipped with no `eventId`, and for a subagent no `parentToolCallId`/`sourceTaskId`, so a consumer keying a child's frames by task silently attributed every redelivered frame to the wrong task. The cause was structural rather than a missing field: the identity minter was declared later in the run body than the redelivery drain, so the drain could not call it. It is now minted as soon as the prepared run exists. Live-lane frames are unchanged (they always had identity).
+
+- **Read-before-write state follows the SESSION, not just the task.** An ordinary continuation turn used to start with an empty read-state (the seed lane existed only for durable-checkpoint resume), so turn 2 paid a forced re-read for every file turn 1 had read whole. The prepare step now replays the session transcript on continuation turns: whole-file-provable Read/Write records seed entries whose hash comes from what the transcript recorded — never from disk — so staleness is unchanged by construction (a file changed between turns is still refused), and Edit/NotebookEdit records retract their path (a self-edit is never misread as a foreign change). Resume legs, first turns, and post-Edit paths are byte-identical to before. **Consumer flip**: a probe pinning "a continuation-turn edit is always refused as not-read" reds.
+
+- **Memory recall: an unknown write time is incomparable, not 1970.** A note whose `ts` failed to parse used to sort as epoch 0 — it lost every `[[name]]` collision (permanently unreachable through links) and rendered a fabricated age ("written 678 months ago"). `MemoryNoteHeader.timestampMissing` (new, optional) is minted at the single parse point; the one recency comparison treats missing as a tie (the incumbent keeps the name — an unknown-time note neither sinks nor poses as newest), and the render face says "write time unknown — verify it's still current". A literal 1970 timestamp string stays a real time (the numeric value is never the signal; negative pins lock this). Bonus: a wire row with NO `ts` key used to throw and kill the whole scope's manifest build. **Consumer flip**: a probe pinning the fabricated-age wording or the sink-to-bottom collision outcome reds.
+- **Three awaited rescue timers are REF'd + cleared-on-settle** (subagent observer drain, teacher abortFallback, WebFetch deadline): unref'd, the process could exit before the rescue fired when the wedged arm held no live handles — the settle never completed. The bg notify drain window keeps its unref by design (a background lane must not pin the process).
+- **A harness-side throw around ONE tool call becomes that call's disclosed error result — the batch survives.** Worker exceptions that are not cancellation (a rejected `tool_execution_update` delivery, a sink failure) used to reject the whole parallel batch, orphan the sibling calls, and on the worst path rewrite a COMMITTED side effect into `[tool execution harness failed: …]` — inviting the model to re-run an already-effective write. Progress deliveries now settle at one point; a delivery failure on an executed tool keeps `content`/`isError` untouched and rides `details.toolProgressDeliveryFailed` (total by construction: hostile accessors or exotic `details` decline the annotation, never the outcome; `afterToolCall` cannot erase it). Cancellation — including one wrapped in the harness's own `AgentHarnessError` (`cause`-chain walk) — stays a hard batch failure on every lane, and the in-stream lane closes admission immediately. The sequential lane shares the same disclosure band. **Consumer flips**: probes pinning the old `[tool execution harness failed]` rewrite or `isError:true` on a delivery-failed success red — re-pin on the new shape plus a retired-dialect tripwire.
+- **openai lane: an evidence-free `tool_calls` fragment no longer fabricates an unnamed-call disclosure.** The evidence gate sits at the finalize disclosure point (slot assignment also routes id-less continuations, so gating there corrupted two real calls); the stream's own verdict wins — `finish_reason:"tool_calls"` with zero survivors, or an empty slot beside real calls, discloses loudly; an isolated terminal fragment with `stop`/`length` stays silent.
+- **A throwing tool keeps its machine-readable marks on BOTH legs.** Two strip points, one class: the `defineTool` adapter rewrapped a ToolSpec throw as a bare `Error` (marks died even LIVE — a ToolSpec throw carrying `details.code` got no `errorCode` lift while a native tool's identical error did), and the durable-resume batch's catch stringified the message alone (breaking the live/resume frame-parity contract). Both carry `details`/`errorKind` through now; message text unchanged.
+- **Cache-break attribution: an aborted / usage-missing row is "unknown", not a cold cache.** Feeding it to the design/31 detector minted a false `server-or-ttl` finding and poisoned the warm baseline for the next real turn. Such rows are skipped; a genuine cacheRead collapse still fires.
+- **A usage-ledger charge that does not settle discloses loudly — and is never abandoned.** Both commit points (turn boundary, end-of-task flush) fire a single deployment-sink disclosure after 10s and keep awaiting (abandoning a sequential ledger write would double-charge on the next flush). A wedged ledger store still wedges what it always wedged, now visibly.
+- **The `abortResultDetails` seam is total.** A throwing host callback degrades to "no details" (the abort text is the contract; the marker is additive) instead of escalating a per-tool abort into an unpaired `tool_execution_start` plus an uncaught task-level rejection.
+
+### BREAKING
+
+- **The `tool_end.structured` card vocabulary is now a two-way contract — three words leave it, and `type:"agent"` gains a second shape.** Removed: `multiedit`, `memory-saved`, `memory-recall`. No tool in the tree has ever minted any of the three (a batch MultiEdit replay mints `type:"edit"` with an `edits[]` array; core mounts no memory tool at all), so they were a promise to consumers that nothing could keep — a host switching on the closed set had dead branches. Closed-set consumers: **drop those three arms**; a fixture that fabricates one of them to assert it passes the allowlist reds. Separately, `type:"agent"` used to imply "background launch receipt" because the completed delivery was silently dropped; it now carries **both** Agent shapes, told apart by `status` — `"async_launched"` is the receipt, any other value is the completed landing report (`result` / `stats` / `resolvedModel` / `toolStats` / kept `worktreePath` / failure attribution). **Branch on `status`, never on which keys are present.** The completed card is an explicit field whitelist over the child `TaskResult`, not a spread: `checkpointToken` (the resume capability) and `checkpointGate` never leave the process, and a future `TaskResult` field does not join the wire by default. A new test gate walks the tree in both directions (every minted card registered; every registered word produced), so neither direction can drift back.
+
+- **Brain lanes disclose an unnamed tool call instead of skipping it in silence.** A `tool_use` block / `tool_calls` slot / `function_call` item arriving with NO tool name now rides the same disclosure path as a call with truncated arguments on all three lanes (anthropic / openai / open-responses): a `[note: N tool call(s) arrived with no tool name …]` block in the assistant content, and — when the turn produced nothing else usable — `stopReason: "error"` with the cause named. Previously such a turn finalized as `[{type:"text",text:""}]` with `stopReason: "stop"` and no error code, so a run whose only action was dropped reported `completed` with an empty answer. **Consumer flips**: a probe pinning the silent empty-`completed` shape reds; a probe asserting assistant content exact-equality gains a note block; "dropped tool call" is now two-cause (`not valid JSON` truncation | `no tool name`) — judge by the named cause, never by the single historic wording; the two causes may be joined with `" | "` in one errorMessage.
+- **`StrategyStore` refuses non-honorable knobs instead of folding them to 0.** `find(scope, query, limit)` requires a non-negative integer or `Infinity` — `Infinity` now means "no cap" and returns everything (it used to return NOTHING); NaN/negative/fractional throw `config.strategy_find_limit_invalid`. `prune(scope, maxSize)` and the `InMemoryStrategyStore` constructor require a non-negative integer and refuse `Infinity` by name (a capacity cap can be widened, not turned off): `config.strategy_max_size_invalid`. A NaN capacity used to silently disable eviction (unbounded growth). Vocabulary additions (closed-set consumers admit two members): `config.strategy_find_limit_invalid`, `config.strategy_max_size_invalid`.
+
+- **The three stop clocks gained a crossing contract: `usage_window` > `env_lifetime` > stall.** When the governance window and the environment lifetime come due at the SAME turn boundary, the window wins (loud terminal `usage.window_exhausted` + `retryAfterMs`, or a `usage_window` checkpoint with its resume hint) — it is the only cause carrying an actionable wait; env-first reporting dropped it. With an enforceable env lifetime, the ledger READ races an absolute deadline (a stalled ledger stops the run for the env and disclosingly skips window enforcement for that boundary); the CHARGE is never raced. **Probes pinning "both due ⇒ `env.lifetime_expired`" red.**
+- **Durable-resume deferred siblings are fully paired: each `[DEFERRED]` `tool_end` is preceded by a synthetic `tool_start`** (same id/name/label, the model's real arguments recovered from the transcript, adjacent and unconditional; deliberately NOT in `startedToolCallIds` — the call never executed and interrupt-reconcile still reads it as safe-to-reissue). Exact event-count / first-frame probes on the resume leg red. Delegation tick counters count issued `tool_use` blocks (their declared semantics), so a deferred sibling's start now counts once as issued — the old shape UNDERcounted.
+- **Manual compaction gains two mooted disclosure frames** (`compaction_outcome{mooted, manual, cancelled}` on parked-caller cancel; `{mooted, manual, task_ending}` at run settle/teardown with a parked request), and `TaskStream.compact()` called in a failed run's teardown window returns `"mooted"` instead of hanging forever. "No compaction frame on this path" probes red.
+- **Delegation inheritance seats (one-way tighten, narrowings enumerable):** ① a read-only parent's delegated children carry NO write hands (`handsReadOnly` is a trusted ctx seat, one-way); ② a hard-headless parent's children no longer mount `AskUserQuestion` at all (the content-ask seat `onQuestion` is resolved once at prepare and handed down UNWRAPPED — parent and child share the SAME function object; identity questions read `AskQuestionRequest.sourceTaskId`/`principal`, never closure identity); ③ teacher helper/advisor legs inherit deployment auth/principal/clientContext/promptProfile plus the one-way clamps (a read-only/headless student's teacher legs lose write hands and questions); ④ the verify leg runs hard-headless always (`interactiveTools:false`) with principal + tool-face controls; ⑤ `oneShot` propagates true-ward. The child roster went from "never has AskUserQuestion" to "has it iff the parent face allows" — closed-set tool-roster probes on children red. Legs that OUTLIVE the spawning request (session-scoped/fork background, durable revival, SendMessage wake) never take turn-bound faces; resume rows take the union of clamps.
+- **Every limits door refuses unevaluable values (`config.limit_invalid`), fourth wave of the no-silent-folding rule:** `runTeamDiscussion`'s cumulative `maxTokens`/`maxCostUsd` (NaN silently disarmed the only cumulative stop; refused before any dispatch, 0 stays an honest exhausted window); workflow governance's TRUSTED half (a baseline/`WorkflowChildCaps` NaN/Infinity read as the 0/negative "no ceiling" sentinel and could silently drop an axis — refused loudly, sentinel semantics unchanged); `TaskSpec.resourceSuspend.{totalBudgetUsd,totalTokens,maxSlices,ttlMs}` + non-empty `scope` (NaN blinded even the validated per-slice window through `Math.min`) — refused at the RB-458 door as a failed result before any resource acquisition.
+- **Agent completed card vocabulary additions** (closed-set consumers admit members): `retryAfterMs` (machine-actionable pair of `errorCode` — `retryable` answers "re-issue as-is NOW?", `retryAfterMs` answers "when does the refusal lift"), `degraded` (reduced-quality attribution), and `modelFallback:"inherit_no_tier_binding"` (the requested model word did not bind — no roster / not on the roster — and the child ran on its inherited default; fallback behavior itself unchanged; also stamped on background roster rows). Workflow `agent_end` gains `modelResolved` (the served model, from `TaskResult.model`; `agent_start.model` stays the requested word verbatim — absent on replayed rows and model-less runs).
+- **Two runtime prose strings changed with the retired-scenario vocabulary sweep** (an A2A fence reason and two prompt lines); probes byte-pinning them red. CC-anchored verbatim material (loop sentinels, prompt sections) is exempt by an explicit per-file allowance in the new vocabulary ratchet gate.
+
 ## 5.9.0 (2026-08-04)
 
 ### Added

package/dist/agents/roster-store.d.ts

@@ -5,6 +5,7 @@ export interface RosterEntry {
     toolUseId?: string;
     rootSessionId?: string;
     model?: string;
+    modelFallback?: "inherit_no_tier_binding";
     owner: string;
     scope: string;
     sessionScoped?: boolean;

package/dist/agents/send-message-tool.js

@@ -528,6 +528,12 @@ export function createSendMessageTool(opts) {
                     ...(row.createdAt !== undefined ? { rowSpawnedAt: row.createdAt } : {}),
                     ...(opts.onNotifyError !== undefined ? { onNotifyError: opts.onNotifyError } : {}),
                     ...(opts.notify ? { currentParentNotify: opts.notify } : {}),
+                    ...(ctx.onQuestion !== undefined && row.sessionScoped !== true ? { currentOnQuestion: ctx.onQuestion } : {}),
+                    currentClamps: {
+                        ...(ctx.handsReadOnly === true ? { handsReadOnly: true } : {}),
+                        ...(ctx.interactiveTools === false ? { interactiveTools: false } : {}),
+                        ...(ctx.oneShot === true ? { oneShot: true } : {}),
+                    },
                 });
                 const fromPrefix = senderIsChild ? `(message from teammate "${senderLabel}")\n` : "";
                 try {

package/dist/agents/subagent.d.ts

@@ -34,7 +34,7 @@ export interface SubagentWorktreeIsolation {
 }
 export declare function createSubagentWorktreeHelper(baseEnv: ExecutionEnv, repoRoot: string): SubagentWorktreeIsolation;
 export declare const REPORT_FIELD_MAX = 300;
-export type SubagentErrorKind = "rate_limit" | "overloaded" | "timeout" | "network" | "logic";
+export type SubagentErrorKind = "rate_limit" | "overloaded" | "timeout" | "network" | "logic" | "governance";
 export declare function classifySubagentError(child: {
     status: string;
     errorCode?: string;
@@ -43,6 +43,30 @@ export declare function classifySubagentError(child: {
     errorKind: SubagentErrorKind;
     retryable: boolean;
 } | undefined;
+export declare function completedAgentCard(child: {
+    taskId: string;
+    sessionId: string;
+    status: string;
+    model?: string;
+    result: string;
+    salvagedOutput?: string;
+    blockedReason?: string;
+    errorMessage?: string;
+    errorCode?: string;
+    retryAfterMs?: number;
+    degraded?: unknown;
+    structuredOutput?: unknown;
+    stats: unknown;
+}, extras: {
+    subagentType?: string;
+    error?: {
+        errorKind: SubagentErrorKind;
+        retryable: boolean;
+    } | undefined;
+    worktreePath?: string;
+    toolStats?: SubagentToolStats;
+    modelFallback?: "inherit_no_tier_binding";
+}): Record<string, unknown>;
 export declare const SUBAGENT_SUSPENDED_AWAITING_APPROVAL = "suspended.awaiting_approval";
 export declare const SUBAGENT_SUSPENDED_NEEDS_REVIEW = "suspended.needs_review";
 export declare const SUBAGENT_SUSPENDED_CHECKPOINT_EXPIRED = "suspended.checkpoint_expired";
@@ -66,6 +90,12 @@ export declare function createSubagentResume(deps: {
     currentParentNotify?: (n: TaskNotificationPayload, opts?: {
         priority?: "now" | "next" | "later";
     }) => void;
+    currentOnQuestion?: import("../core/ask-question.js").OnQuestion;
+    currentClamps?: {
+        handsReadOnly?: true;
+        interactiveTools?: false;
+        oneShot?: true;
+    };
     taskId?: string;
     taskAccess?: import("../core/task-registry.js").TaskAccess;
     bgSink?: (event: import("../core/types.js").BackgroundChildEvent) => void;

package/dist/agents/subagent.js

@@ -229,8 +229,33 @@ export function classifySubagentError(child) {
                 ? "timeout"
                 : code === "network" || code === "server"
                     ? "network"
-                    : "logic";
-    return { errorKind, retryable: errorKind !== "logic" };
+                    : code !== undefined && code.startsWith("usage.")
+                        ? "governance"
+                        : "logic";
+    return { errorKind, retryable: errorKind !== "logic" && errorKind !== "governance" };
+}
+export function completedAgentCard(child, extras) {
+    return {
+        type: "agent",
+        ...(extras.subagentType !== undefined ? { subagent_type: extras.subagentType } : {}),
+        status: child.status,
+        taskId: child.taskId,
+        sessionId: child.sessionId,
+        result: child.result,
+        ...(child.salvagedOutput !== undefined ? { salvagedOutput: child.salvagedOutput } : {}),
+        ...(child.structuredOutput !== undefined ? { structuredOutput: child.structuredOutput } : {}),
+        ...(child.blockedReason !== undefined ? { blockedReason: child.blockedReason } : {}),
+        ...(child.errorMessage !== undefined ? { errorMessage: child.errorMessage } : {}),
+        ...(child.errorCode !== undefined ? { errorCode: child.errorCode } : {}),
+        ...(child.retryAfterMs !== undefined ? { retryAfterMs: child.retryAfterMs } : {}),
+        ...(child.degraded !== undefined ? { degraded: child.degraded } : {}),
+        ...(extras.error ? { error_kind: extras.error.errorKind, retryable: extras.error.retryable } : {}),
+        stats: child.stats,
+        ...(child.model !== undefined ? { model: child.model, resolvedModel: child.model } : {}),
+        ...(extras.modelFallback !== undefined ? { modelFallback: extras.modelFallback } : {}),
+        ...(extras.worktreePath !== undefined ? { worktreePath: extras.worktreePath } : {}),
+        ...(extras.toolStats !== undefined ? { toolStats: extras.toolStats } : {}),
+    };
 }
 export const SUBAGENT_SUSPENDED_AWAITING_APPROVAL = "suspended.awaiting_approval";
 export const SUBAGENT_SUSPENDED_NEEDS_REVIEW = "suspended.needs_review";
@@ -374,6 +399,10 @@ export function createSubagentResume(deps) {
                 objective: createResumePrompt(marker, content),
                 sessionId: entry.childSessionId,
                 requireExistingSession: true,
+                ...(deps.currentOnQuestion !== undefined ? { onQuestion: deps.currentOnQuestion } : {}),
+                ...(entry.specSnapshot.handsReadOnly === true || deps.currentClamps?.handsReadOnly === true ? { handsReadOnly: true } : {}),
+                ...(entry.specSnapshot.interactiveTools === false || deps.currentClamps?.interactiveTools === false ? { interactiveTools: false } : {}),
+                ...(entry.specSnapshot.oneShot === true || deps.currentClamps?.oneShot === true ? { oneShot: true } : {}),
                 signal: abort.signal,
             };
             if (deps.registry !== undefined && deps.taskId !== undefined && deps.taskAccess !== undefined) {
@@ -880,7 +909,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             `- Finding a known symbol/class/definition, or searching within 2-3 known files → use Grep/Glob/Read.\n` +
             `- A lookup where you already know what you want and roughly where it is → just do it. Delegate open-ended INVESTIGATIONS (you don't know where the answer is), not lookups.\n\n` +
             `Writing the 'prompt' — brief the agent like a smart colleague who just walked into the room — it hasn't seen this conversation, doesn't know what you've tried, doesn't understand why this task matters:\n` +
-            `- Make it fully self-contained and highly detailed: the sub-agent does the whole task autonomously in one shot — you can't course-correct mid-run.\n` +
+            `- Make it fully self-contained and highly detailed: the sub-agent does the whole task end-to-end in one shot — you can't course-correct mid-run.\n` +
             `- State exactly what it must RETURN (e.g. "report the file:line of each call site", not "look into the call sites").\n` +
             `- Say explicitly whether you want it to WRITE CODE or only RESEARCH/REPORT — otherwise it may guess wrong.\n` +
             `- Never delegate understanding. Don't write "based on your findings, fix the bug" or "based on the research, implement it." Those phrases push synthesis onto the agent instead of doing it yourself. Write prompts that prove you understood: include file paths, line numbers, what specifically to change.\n\n` +
@@ -1071,6 +1100,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     }
                 }
             }
+            const modelFallback = !wantsFork && requestedModel !== undefined && perCallModel === undefined ? "inherit_no_tier_binding" : undefined;
             let worktreeDir;
             if (reviveClaim === undefined && (a.isolation ?? def?.isolation) === "worktree") {
                 const iso = ctx.worktreeIsolation;
@@ -1333,11 +1363,17 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             };
             const drainAndReleaseObserver = async () => {
                 if (observerPairing) {
+                    let drainRescue;
                     const timeout = new Promise((resolve) => {
-                        const t = setTimeout(() => resolve("timeout"), 60_000);
-                        t.unref?.();
+                        drainRescue = setTimeout(() => resolve("timeout"), 60_000);
                     });
-                    const outcome = await Promise.race([observerPairing.drain().then(() => "drained"), timeout]);
+                    let outcome;
+                    try {
+                        outcome = await Promise.race([observerPairing.drain().then(() => "drained"), timeout]);
+                    }
+                    finally {
+                        clearTimeout(drainRescue);
+                    }
                     observerPairing.retire(outcome === "timeout" ? "stopped" : "retired");
                     if (outcome === "timeout")
                         noteObserverFailure(new Error("observer unresponsive at settle (delivery drain timed out)"));
@@ -1456,13 +1492,19 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ...(def?.memory ? { memory: def.memory } : {}),
                 ...(def?.skills?.length ? { skills: def.skills } : {}),
                 ...(ctx.principal !== undefined ? { principal: ctx.principal } : {}),
+                ...(ctx.checkpointStoreDisabledForChildren === true ? { checkpointStore: null } : {}),
                 ...(childOnAsk !== undefined ? { onAsk: childOnAsk } : {}),
+                ...(ctx.onQuestion !== undefined ? { onQuestion: ctx.onQuestion } : {}),
+                ...(ctx.interactiveTools === false ? { interactiveTools: false } : {}),
+                ...(ctx.handsReadOnly === true ? { handsReadOnly: true } : {}),
+                ...(ctx.oneShot === true ? { oneShot: true } : {}),
                 ...(ctx.clientContext !== undefined ? { clientContext: ctx.clientContext } : {}),
                 ...(ctx.excludeTools !== undefined ? { excludeTools: [...ctx.excludeTools] } : {}),
                 ...(ctx.deferTools !== undefined ? { deferTools: [...ctx.deferTools] } : {}),
                 ...(ctx.alwaysLoadTools !== undefined ? { alwaysLoadTools: [...ctx.alwaysLoadTools] } : {}),
                 ...(ctx.promptProfile !== undefined ? { promptProfile: ctx.promptProfile } : {}),
                 ...(ctx.additionalDirectories !== undefined ? { additionalDirectories: [...ctx.additionalDirectories] } : {}),
+                ...(ctx.additionalReadDirectories !== undefined ? { additionalReadDirectories: [...ctx.additionalReadDirectories] } : {}),
                 ...(ctx.envFacts !== undefined ? { envFacts: { ...ctx.envFacts } } : {}),
                 ...(ctx.getApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: ctx.getApiKeyAndHeaders } : {}),
                 enableBlockedReport: true,
@@ -1473,7 +1515,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 if (!ledger)
                     return undefined;
                 const childSessionId = preMintedSessionId ?? uuidv7();
-                const { signal: _spawnSignal, ...plainSpec } = buildChildSpec(undefined);
+                const { signal: _spawnSignal, onQuestion: _spawnTurnQuestionFace, ...plainSpec } = buildChildSpec(undefined);
                 let entry = ledger.register(ctx.toolCallId, {
                     childSessionId,
                     runner: opts.runner,
@@ -1553,7 +1595,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 if (ledger !== undefined && !ledger.disposed) {
                     if (opts.background)
                         ensureSessionReapHook(opts.background.registry);
-                    const { signal: _spawnSignal, ...plainSpec } = buildChildSpec(undefined);
+                    const { signal: _spawnSignal, onQuestion: _spawnTurnQuestionFace, ...plainSpec } = buildChildSpec(undefined);
                     const entry = ledger.register(ctx.toolCallId, {
                         childSessionId,
                         runner: opts.runner,
@@ -1671,6 +1713,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         else if (!sessionScopedBg)
                             ctx.signal.addEventListener("abort", onHostAbort, { once: true });
                     }
+                    const dropTurnBoundQuestionFace = sessionScopedBg ? { onQuestion: undefined } : {};
                     const shortDesc = `fork: ${(typeof a.description === "string" && a.description.trim() ? a.description.trim() : prompt).slice(0, 180)}`;
                     const bgOwner = sessionScopedBg ? ctx.sessionId : ctx.taskId ?? bg.owner;
                     const bgScope = treeScope;
@@ -1735,7 +1778,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         }, { priority: "later" }), "subagent.reapTerminalNotify");
                     });
                     if (agentName !== undefined) {
-                        recordRosterSpawn(ctx.roster, { name: agentName, agentId: taskId, sessionId: forkedId, toolUseId: ctx.toolCallId, owner: bgOwner, scope: bgScope, ...((typeof childModel === "string" ? resolveModelDisplayLabel(childModel) : childModel?.id) !== undefined ? { model: typeof childModel === "string" ? childModel : childModel?.id } : {}), ...((ctx.rootSessionId ?? ctx.sessionId) !== undefined ? { rootSessionId: ctx.rootSessionId ?? ctx.sessionId } : {}), ...(sessionScopedBg ? { sessionScoped: true } : {}), createdAt: Date.now() }, (err) => opts.onObserverError?.(err, { site: "roster.recordSpawn" }));
+                        recordRosterSpawn(ctx.roster, { name: agentName, agentId: taskId, sessionId: forkedId, toolUseId: ctx.toolCallId, owner: bgOwner, scope: bgScope, ...((typeof childModel === "string" ? resolveModelDisplayLabel(childModel) : childModel?.id) !== undefined ? { model: typeof childModel === "string" ? childModel : childModel?.id } : {}), ...(modelFallback !== undefined ? { modelFallback } : {}), ...((ctx.rootSessionId ?? ctx.sessionId) !== undefined ? { rootSessionId: ctx.rootSessionId ?? ctx.sessionId } : {}), ...(sessionScopedBg ? { sessionScoped: true } : {}), createdAt: Date.now() }, (err) => opts.onObserverError?.(err, { site: "roster.recordSpawn" }));
                     }
                     const bgSink = ctx.onBackgroundChildEvent;
                     const sinkEmit = (event) => {
@@ -1763,7 +1806,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         startedAt: Date.now(),
                     });
                     const forkBgStartedAt = Date.now();
-                    const bgForkSpec = { ...buildChildSpec(abort.signal), sessionId: forkedId, requireExistingSession: true, objective: forkObjective };
+                    const bgForkSpec = { ...buildChildSpec(abort.signal), sessionId: forkedId, requireExistingSession: true, objective: forkObjective, ...dropTurnBoundQuestionFace };
                     const s2ForkNotifyReady = (inject) => {
                         bg.registry.attachAgentNotify(taskId, inject);
                     };
@@ -2039,16 +2082,15 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ].filter(Boolean);
                 return {
                     content: forkLines.join("\n"),
-                    details: {
-                        ...forkChild,
-                        ...(forkErr ? { error_kind: forkErr.errorKind, retryable: forkErr.retryable } : {}),
+                    details: completedAgentCard(forkChild, {
+                        subagentType: FORK_SUBAGENT_TYPE,
+                        error: forkErr,
                         ...(worktreeKeptPath !== undefined ? { worktreePath: worktreeKeptPath } : {}),
-                        ...(forkChild.model !== undefined ? { resolvedModel: forkChild.model } : {}),
                         ...(() => {
                             const ts = toolStatsCounter.snapshot();
                             return ts !== undefined ? { toolStats: ts } : {};
                         })(),
-                    },
+                    }),
                 };
             }
             if (wantsBackground) {
@@ -2058,12 +2100,13 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 const reviveRow = reviveClaim?.row;
                 const parkedResume = reviveClaim?.parkedResume;
                 const sessionScopedBg = reviveRow !== undefined ? reviveRow.sessionScoped : ctx.backgroundScope === "session" && ctx.sessionId !== undefined;
+                const outlivesThisRequest = sessionScopedBg || reviveRow !== undefined;
                 const onHostAbort = () => abort.abort();
                 const dropHostAbortListener = () => ctx.signal?.removeEventListener("abort", onHostAbort);
                 if (ctx.signal) {
                     if (ctx.signal.aborted)
                         abort.abort();
-                    else if (!sessionScopedBg && reviveRow === undefined)
+                    else if (!outlivesThisRequest)
                         ctx.signal.addEventListener("abort", onHostAbort, { once: true });
                 }
                 const shortDesc = reviveRow?.description ?? String(a.description ?? "sub-agent").slice(0, 200);
@@ -2229,6 +2272,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     sessionId: bgChildSessionId,
                     ...(forwardDurableApproval ? { durableApproval: { ...ctx.durableApprovalForChildren } } : {}),
                     ...(reviveRow !== undefined ? { requireExistingSession: true } : {}),
+                    ...(outlivesThisRequest ? { onQuestion: undefined } : {}),
                 };
                 let reviveAttachedResolve;
                 const reviveAttached = reviveRow !== undefined ? new Promise((r) => (reviveAttachedResolve = r)) : undefined;
@@ -2526,6 +2570,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         ...(!ok ? { error: reaped ? (collateral ? BG_AGENT_COLLATERAL_REAP_REASON : BG_AGENT_REAP_STOP_ERROR) : unparkedPauseReason ?? child.errorMessage ?? String(child.status) } : {}),
                         ...(errCodeBg !== undefined ? { errorCode: errCodeBg } : {}),
                         ...(errClassBg !== undefined ? { retryable: errClassBg.retryable, errorKind: errClassBg.errorKind } : {}),
+                        ...(failedBg && child.retryAfterMs !== undefined ? { retryAfterMs: child.retryAfterMs } : {}),
                     }) ??
                         (abort.signal.aborted ? "killed" : ok ? "completed" : "failed");
                     if (!bgRetain && reviveRow === undefined && !(await bgRowConfirmed())) {
@@ -2729,6 +2774,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         sink: ctx.onSubagentSpawn,
                         ...(opts.background ? { registry: opts.background.registry } : {}),
                         ...(opts.onObserverError !== undefined ? { onNotifyError: (f) => opts.onObserverError?.(f.error, { site: f.site }) } : {}),
+                        ...(ctx.onQuestion !== undefined ? { currentOnQuestion: ctx.onQuestion } : {}),
                     });
                     notifier.notify(() => ctx.onSubagentSpawn?.(createSteerHandle(stream, ctx.toolCallId, childAgentName, settled, {
                         resume,
@@ -2854,16 +2900,16 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             ].filter(Boolean);
             return {
                 content: lines.join("\n"),
-                details: {
-                    ...child,
-                    ...(errClass ? { error_kind: errClass.errorKind, retryable: errClass.retryable } : {}),
+                details: completedAgentCard(child, {
+                    ...(def !== undefined ? { subagentType: def.name } : {}),
+                    error: errClass,
+                    ...(modelFallback !== undefined ? { modelFallback } : {}),
                     ...(worktreeKeptPath !== undefined ? { worktreePath: worktreeKeptPath } : {}),
-                    ...(child.model !== undefined ? { resolvedModel: child.model } : {}),
                     ...(() => {
                         const ts = toolStatsCounter.snapshot();
                         return ts !== undefined ? { toolStats: ts } : {};
                     })(),
-                },
+                }),
             };
         },
     };

package/dist/agents/teacher.js

@@ -174,9 +174,21 @@ async function runTeacherCore(runner, studentSpec, teacher) {
         };
     };
     const tools = studentSpec.tools?.map(wrap);
+    const inheritedDeploymentConfig = {
+        ...(studentSpec.getApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: studentSpec.getApiKeyAndHeaders } : {}),
+        ...(studentSpec.principal !== undefined ? { principal: studentSpec.principal } : {}),
+        ...(studentSpec.clientContext !== undefined ? { clientContext: studentSpec.clientContext } : {}),
+        ...(studentSpec.promptProfile !== undefined ? { promptProfile: studentSpec.promptProfile } : {}),
+        ...(studentSpec.handsReadOnly === true ? { handsReadOnly: true } : {}),
+        ...(studentSpec.interactiveTools === false ? { interactiveTools: false } : {}),
+        ...(studentSpec.excludeTools !== undefined ? { excludeTools: [...studentSpec.excludeTools] } : {}),
+        ...(studentSpec.deferTools !== undefined ? { deferTools: [...studentSpec.deferTools] } : {}),
+        ...(studentSpec.alwaysLoadTools !== undefined ? { alwaysLoadTools: [...studentSpec.alwaysLoadTools] } : {}),
+        ...(studentSpec.checkpointStore === null ? { checkpointStore: null } : {}),
+    };
     const helperBase = () => teacher.helperModel
-        ? { model: teacher.helperModel }
-        : { model: studentSpec.model, modelRole: studentSpec.modelRole, roles: studentSpec.roles };
+        ? { ...inheritedDeploymentConfig, model: teacher.helperModel }
+        : { ...inheritedDeploymentConfig, model: studentSpec.model, modelRole: studentSpec.modelRole, roles: studentSpec.roles };
     const teacherModelFields = () => {
         if (teacher.model) {
             return { model: teacher.model };
@@ -317,7 +329,6 @@ async function runTeacherCore(runner, studentSpec, teacher) {
         let timer;
         const promise = new Promise((res) => {
             timer = setTimeout(() => res(syntheticAborted(sid)), 10_000);
-            timer.unref?.();
         });
         return { promise, cancel: () => { if (timer)
                 clearTimeout(timer); } };
@@ -338,6 +349,7 @@ async function runTeacherCore(runner, studentSpec, teacher) {
     const askTeacher = async (trace) => {
         const r = await runner.runTask({
             objective: trace,
+            ...inheritedDeploymentConfig,
             ...teacherModelFields(),
             systemPrompt: teacher.prompts?.teacher ?? TEACHER_PROMPT,
             enableBlockedReport: false,

package/dist/agents/team.js

@@ -51,6 +51,16 @@ export async function runTeamDiscussion(opts) {
     let turns = 0;
     let costMicroUsd = 0;
     let failures = 0;
+    for (const key of ["maxTokens", "maxCostUsd"]) {
+        const value = opts.limits?.[key];
+        if (value === undefined)
+            continue;
+        if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+            const e = new Error(`TeamDiscussionOptions.limits.${key} must be a finite, non-negative number (got ${String(value)}) — the team's cumulative budget gate cannot evaluate it, and running without the gate would spend under a limit nobody chose.`);
+            e.code = "config.limit_invalid";
+            throw e;
+        }
+    }
     const budgetMaxTokens = opts.limits?.maxTokens;
     const budgetMaxCostMicroUsd = opts.limits?.maxCostUsd !== undefined ? Math.round(opts.limits.maxCostUsd * 1_000_000) : undefined;
     let budgetStop;

package/dist/agents/verify.js

@@ -99,10 +99,17 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             roles: specBase.roles,
             tools: verifierTools,
             handsReadOnly: config.verifierHandsReadOnly ?? true,
+            interactiveTools: false,
             outputSchema: VerdictSchema,
             enableBlockedReport: false,
             limits: { ...(specBase.limits?.maxWalltimeMs !== undefined ? { maxWalltimeMs: specBase.limits.maxWalltimeMs } : {}) },
             getApiKeyAndHeaders: specBase.getApiKeyAndHeaders,
+            ...(specBase.principal !== undefined ? { principal: specBase.principal } : {}),
+            ...(specBase.excludeTools !== undefined ? { excludeTools: [...specBase.excludeTools] } : {}),
+            ...(specBase.deferTools !== undefined ? { deferTools: [...specBase.deferTools] } : {}),
+            ...(specBase.alwaysLoadTools !== undefined ? { alwaysLoadTools: [...specBase.alwaysLoadTools] } : {}),
+            ...(specBase.clientContext !== undefined ? { clientContext: { ...specBase.clientContext } } : {}),
+            ...(specBase.promptProfile !== undefined ? { promptProfile: specBase.promptProfile } : {}),
             signal: specBase.signal,
         });
         try {

package/dist/brain/anthropic.js

@@ -516,6 +516,7 @@ export function createAnthropicBrain(config = {}) {
                         const finalContent = [];
                         const toolCalls = [];
                         const malformed = [];
+                        const unnamed = [];
                         let anyText = false;
                         let reasoningSeen = false;
                         for (const [, acc] of [...blocks.entries()].sort((a, b) => a[0] - b[0])) {
@@ -537,28 +538,44 @@ export function createAnthropicBrain(config = {}) {
                                         anyText = true;
                                 }
                             }
-                            else if (acc.type === "tool_use" && acc.toolName) {
-                                const tc = closeToolUseBlock(acc);
-                                if (tc) {
-                                    toolCalls.push(tc);
-                                    finalContent.push(tc);
+                            else if (acc.type === "tool_use") {
+                                if (!acc.toolName) {
+                                    unnamed.push(`id="${acc.toolId || "?"}"(${acc.toolJson.slice(0, 200)})`);
                                 }
                                 else {
-                                    malformed.push(`${acc.toolName}(${acc.toolJson.slice(0, 200)})`);
+                                    const tc = closeToolUseBlock(acc);
+                                    if (tc) {
+                                        toolCalls.push(tc);
+                                        finalContent.push(tc);
+                                    }
+                                    else {
+                                        malformed.push(`${acc.toolName}(${acc.toolJson.slice(0, 200)})`);
+                                    }
                                 }
                             }
                         }
                         const doneReason = mapStopReason(stopReason, toolCalls.length > 0);
                         const noUsableContent = toolCalls.length === 0 && !anyText;
-                        const toolError = malformed.length > 0
-                            ? `tool call argument(s) not valid JSON (likely truncated, stop_reason="${stopReason ?? "?"}"): ${malformed.join("; ")}`
-                            : undefined;
-                        if (toolError !== undefined) {
+                        const toolErrorParts = [];
+                        if (malformed.length > 0) {
+                            toolErrorParts.push(`tool call argument(s) not valid JSON (likely truncated, stop_reason="${stopReason ?? "?"}"${sentMaxTokens !== undefined ? `; request output cap in effect: ${sentMaxTokens} tokens — a cut mid-arguments commonly means the cap was hit` : ""}): ${malformed.join("; ")}`);
+                        }
+                        if (unnamed.length > 0) {
+                            toolErrorParts.push(`tool call(s) arrived with no tool name and cannot be executed (stop_reason="${stopReason ?? "?"}"): ${unnamed.join("; ")}`);
+                        }
+                        const toolError = toolErrorParts.length > 0 ? toolErrorParts.join(" | ") : undefined;
+                        if (malformed.length > 0) {
                             finalContent.push({
                                 type: "text",
                                 text: `\n[note: ${malformed.length} tool call(s) were truncated (stop_reason="${stopReason ?? "?"}") and dropped — re-issue them next turn: ${malformed.join("; ")}]`,
                             });
                         }
+                        if (unnamed.length > 0) {
+                            finalContent.push({
+                                type: "text",
+                                text: `\n[note: ${unnamed.length} tool call(s) arrived with no tool name and were dropped — re-issue them next turn with an explicit tool name: ${unnamed.join("; ")}]`,
+                            });
+                        }
                         if (malformedFrames > 0) {
                             finalContent.push({
                                 type: "text",

package/dist/brain/open-responses.js

@@ -599,6 +599,7 @@ export function createOpenResponsesBrain(config = {}) {
                         const finalContent = [];
                         const toolCalls = [];
                         const malformed = [];
+                        const unnamed = [];
                         let anyText = false;
                         let reasoningSeen = false;
                         for (const [, acc] of [...items.entries()].sort((a, b) => a[0] - b[0])) {
@@ -629,19 +630,33 @@ export function createOpenResponsesBrain(config = {}) {
                                 else if (acc.name) {
                                     malformed.push(`${acc.name}(${acc.args.slice(0, MALFORMED_ARGS_CHARS)})`);
                                 }
+                                else {
+                                    unnamed.push(`call_id="${acc.callId || "?"}"(${acc.args.slice(0, MALFORMED_ARGS_CHARS)})`);
+                                }
                             }
                         }
                         const noUsableContent = toolCalls.length === 0 && !anyText;
                         const terminalLabel = terminalStatus ?? "?";
-                        const toolError = malformed.length > 0
-                            ? `tool call argument(s) not valid JSON (likely truncated, status="${terminalLabel}"): ${malformed.join("; ")}`
-                            : undefined;
-                        if (toolError !== undefined) {
+                        const toolErrorParts = [];
+                        if (malformed.length > 0) {
+                            toolErrorParts.push(`tool call argument(s) not valid JSON (likely truncated, status="${terminalLabel}"): ${malformed.join("; ")}`);
+                        }
+                        if (unnamed.length > 0) {
+                            toolErrorParts.push(`tool call(s) arrived with no tool name and cannot be executed (status="${terminalLabel}"): ${unnamed.join("; ")}`);
+                        }
+                        const toolError = toolErrorParts.length > 0 ? toolErrorParts.join(" | ") : undefined;
+                        if (malformed.length > 0) {
                             finalContent.push({
                                 type: "text",
                                 text: `\n[note: ${malformed.length} tool call(s) were truncated (status="${terminalLabel}") and dropped — re-issue them next turn: ${malformed.join("; ")}]`,
                             });
                         }
+                        if (unnamed.length > 0) {
+                            finalContent.push({
+                                type: "text",
+                                text: `\n[note: ${unnamed.length} tool call(s) arrived with no tool name and were dropped — re-issue them next turn with an explicit tool name: ${unnamed.join("; ")}]`,
+                            });
+                        }
                         if (malformedFrames > 0) {
                             finalContent.push({
                                 type: "text",