@sema-agent/core 7.0.2 → 7.2.0

package/dist/core/types.d.ts

@@ -3539,6 +3539,16 @@ export interface TaskResult {
      * gate): a halt landing AFTER the abort signal already fired neither cut nor stopped anything —
      * that ending belongs to the abort, and this seat stays ABSENT rather than signing someone
      * else's stop with the halt caller's name. Absent everywhere else; never `false`.
+     *
+     * design/384 slice 2 (TRANSITIONAL narrowing): a `"suspended"` / `"needs_review"` terminal does
+     * NOT carry this seat even when a halt was accepted — those statuses mean a durable park WON its
+     * race with the halt (the row is committed and redeemable; the run is waiting to continue), and
+     * "stopped by the person" beside "waiting to resume" was a self-contradictory pair. The halt's
+     * own receipt (`{turnCut}`) and the `task.turn_interrupted` notice still stand — a seat WAS cut.
+     * Transitional: once halt-boundary source accounting lands (slice 3), the boundary-CONSUMED
+     * suspension arms flip to signing (a probe pinning today's suppressed shape goes red then, by
+     * design). The pass-through law is untouched for every OTHER terminal: a halt racing a real
+     * failure/limit — including one that outranks a committed park — still signs.
      */
     haltedByUser?: true;
     /**
@@ -3941,8 +3951,11 @@ export interface TaskEventIdentity {
 }
 /**
  * design/99 §E3/§E10 — a BRAIN-LAYER liveness phase, surfaced so a UI can show why a
- * turn is stalled (the brain otherwise absorbs these silently in its connect/retry loop). Provider-NEUTRAL:
- * carries only the graduated phase + a neutral hint, NEVER an HTTP status / provider taxonomy / stop_reason.
+ * turn is stalled (the brain otherwise absorbs these silently in its connect/retry loop). The PHASE
+ * itself is provider-NEUTRAL — a graduated bucket this engine mints, never a provider taxonomy or a
+ * `stop_reason`. The one provider-stated number that does cross this channel is the failing attempt's
+ * HTTP status, and it travels on its own named seat ({@link BrainStatus.errorStatus}) in the retry
+ * context only; the phase and the {@link BrainStatus.detail} hint stay free of it.
  * A CLOSED union (type-safe) covering the core brain layer; a deployment that surfaces its OWN states
  * (e.g. E25 token-refresh `authenticating`) does so on its own channel, not by widening this.
  */
@@ -3960,8 +3973,10 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  * WHY a retry wait is happening, as a closed, provider-NEUTRAL bucket — the companion to
  * {@link BrainStatusPhase}, which says what the brain is doing about it. A consumer rendering an
  * unattended progress line ("no answer for three minutes") needs the reason, and until this existed the
- * only carriers of it were the HTTP status and the syscall code, neither of which may cross this
- * channel. Values are about the SHAPE of the failure, never its provider taxonomy:
+ * only carriers of it were the HTTP status and the syscall code, neither of which crossed this channel
+ * at the time. (The status has since gained its own seat, {@link BrainStatus.errorStatus}; this bucket
+ * remains the reason a consumer RENDERS, and it is the only carrier for the transport classes, which
+ * have no status at all.) Values are about the SHAPE of the failure, never its provider taxonomy:
  *  - `connect_refused` — the attempt got a definite negative about the target itself (nothing accepts
  *    at that address, or the name has no address). This is the class the SHORT retry lane serves.
  *  - `transport`      — any other transport-level failure: a connect timeout, a reset, a mid-stream
@@ -3977,7 +3992,11 @@ export type BrainRetryErrClass = "connect_refused" | "transport" | "rate_limit"
 /** design/99 §E3/§E10 — the payload of a {@link TaskEvent} `status` event (and the brain→runner signal). */
 export interface BrainStatus {
     phase: BrainStatusPhase;
-    /** Optional neutral, human-readable hint (NO provider/HTTP detail). */
+    /** Optional neutral, human-readable hint. Stays free of provider/HTTP detail even now that
+     *  {@link errorStatus} exists: the machine-readable status has its own seat, and interpolating it
+     *  into the prose too would make one fact travel in two spellings a consumer has to reconcile.
+     *  (CC parity: its own retry banner renders a TRANSLATED sentence — "No response from API",
+     *  "Connection dropped" — while the raw status rides the structured key beside it.) */
     detail?: string;
     /** Seconds until the brain's next retry attempt (from the honored backoff / `Retry-After`), when known. */
     retryInSec?: number;
@@ -4015,6 +4034,41 @@ export interface BrainStatus {
      *  the engine classified; absent on frames that are not a retry wait (`recovered`/`gave_up`) and on a
      *  `circuit_open` fast-fail, which is a local verdict rather than an observed failure. */
     errClass?: BrainRetryErrClass;
+    /**
+     * #506 ㋑ — the HTTP status of the attempt that just failed, on the frame announcing the RETRY of it.
+     * The one provider-stated number this channel carries; everything else about the failure still
+     * crosses as the engine's own graduated buckets ({@link phase} / {@link errClass}).
+     *
+     * WHY IT IS HERE AT ALL, given the channel spent its life refusing it: a UI that must tell an
+     * operator whether to wait or to go fix something needs the status, and the two neutral buckets
+     * cannot supply it — `rate_limit` covers a 429 the provider will clear on its own AND a 429 that
+     * means the account is out of quota, and `server` covers a 500 alongside a 503 behind a load
+     * balancer. CC states the same number on the same occasion (`system/api_retry.error_status`, read
+     * off `APIError.status`), so a serving layer forwarding this frame no longer has to choose between
+     * matching CC's payload and honoring this channel's contract.
+     *
+     * PRESENCE — an api_retry context whose attempt got a response that NAMES the failure, and nothing
+     * else. Present on the connect-ladder retry wait (`rate_limited` / `retrying` / `reconnecting` when
+     * a response came back) and on the output-cap re-send (the provider's own 400). ABSENT — never
+     * zeroed, never null — for:
+     *   · a transport failure (`connect_refused` / `transport` at the connect leg): no response existed,
+     *     so no status was ever stated. This is the arm CC spells as an explicit `null`; here it is
+     *     absence, for the same reason every other seat on this interface uses absence, and the fact is
+     *     still TOTAL rather than guessable — {@link errClass} names those two classes by construction.
+     *   · a mid-stream tear (tiers B/C): its response's own status was a SUCCESS, and a status that
+     *     failed nothing must not be published as the cause of a retry.
+     *   · a `circuit_open` fast-fail: a local verdict, nothing was sent, nobody answered.
+     *   · the terminal `recovered` / `gave_up` frames: they announce no attempt.
+     * Same "only a status that names the failure travels" predicate as the assistant frame's
+     * {@link AssistantMessage.apiErrorStatus} (one helper, both sites) — a 2xx never travels here either,
+     * which is reachable on this path via a provider's own `x-should-retry` verdict on a success status.
+     *
+     * OPTIONAL, not CC's nullable-REQUIRED, and the difference is CC's own: CC dedicates a whole message
+     * (`system/api_retry`) to the retry occasion and can therefore require the key on it, while this
+     * interface is ONE shape shared by every phase — the same geometry as CC's shared
+     * `control_request_progress` frame, where CC itself makes the key optional.
+     */
+    errorStatus?: number;
 }
 /**
  * design/97 CORE-8 (③): one lightweight TOOL-ACTIVITY beat surfaced from a running task, for a per-agent live
@@ -4575,7 +4629,9 @@ export type TaskEvent = ({
      * silently (a 429 rate-limit / a 5xx or network retry / a reconnect / an open circuit breaker). Emitted
      * the moment the brain decides to wait/retry, carrying the graduated {@link BrainStatusPhase} + an
      * optional `retryInSec` so a UI can show "rate limited, retrying in Ns". EPHEMERAL — a pure liveness
-     * signal, never persisted or replayed on resume. Provider-neutral (no HTTP status / stop_reason).
+     * signal, never persisted or replayed on resume. The phase and the hint are provider-neutral (no
+     * provider taxonomy, no `stop_reason`); the failing attempt's HTTP status rides its own seat in the
+     * retry context only — see {@link BrainStatus.errorStatus}.
      * SCOPE: reflects THIS task's own (top-level) brain calls. A delegated sub-agent's brain liveness routes
      * to the SUB-AGENT's own stream (isolated, like every child event — §E2); a background internal brain
      * call (memory recall/consolidation) is intentionally not surfaced.
@@ -5092,6 +5148,15 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      * steer-family `steering.not_running` once the task has finished (teardown included); a halt
      * issued BEFORE the run's first prompt polls the same bounded birth window as {@link steer} and
      * then stops the run before its first model turn (an empty, cleanly-halted completed run).
+     *
+     * **Receipt tension, stated (design/384 slice 2):** `{turnCut:true}` and the
+     * `task.turn_interrupted` notice assert facts about the CUT — a seat was cut, no new model turn
+     * starts — and both stay true even when the gate's durable leg still collects to `suspended`:
+     * a park whose store commit was already in flight (or committed) when the cut landed WINS the
+     * fence race, the row is redeemable, and the result then reads `status:"suspended"` WITHOUT
+     * {@link TaskResult.haltedByUser} (the transitional narrowing documented on that seat). A cut
+     * observed BEFORE the commit makes the park concede instead — no row, no card, and the ordinary
+     * halted ending.
      */
     halt(): Promise<{
         turnCut: boolean;
@@ -5168,9 +5233,15 @@ export interface WorkflowGovernanceBaseline {
      * The allowed model NAMES an LLM-authored script may pick (design/98 §2.5 新洞2). A script gives a
      * `modelName` string (never a `Model` object — that carries `baseUrl`/`headers` = exfil); the engine
      * resolves it against this list to a deploy-configured `Model` (the script never sees the object).
-     * **FAIL-CLOSED**: `undefined`/empty ⇒ the script CANNOT pick a model (its `modelName` is rejected → the
-     * child falls back to the workflow's default role). NEVER fail-open to the whole `models` catalog for an
-     * LLM-authored workflow.
+     * **FAIL-CLOSED**: `undefined`/empty ⇒ the script CANNOT pick a model — a spec that names `modelName`
+     * THROWS `WorkflowModelNotAllowedError` and the child is never spawned. The refusal is loud, not a
+     * silent downgrade: the script asked for a model it may not have, so the agent call FAILS rather than
+     * quietly running on the workflow's default role (a script that wants the default must simply OMIT
+     * the field). The same throw covers a name that is off the list, and a listed name the `models`
+     * catalog does not hold — so the legal set is the INTERSECTION of this list and the catalog keys
+     * (note the catalog is the Runner's TIER-EXPANDED one, so on a deployment with `RunnerDeps.tiers`
+     * the tier words and CC aliases are catalog keys here too, still gated by this list).
+     * NEVER fail-open to the whole `models` catalog for an LLM-authored workflow.
      */
     workflowModelAllowlist?: string[];
 }
@@ -5739,6 +5810,10 @@ export interface EngineNotice {
      *        `detail: { cause: "user_halt", sessionId, runId, taskId? }` — no `inputId` and no
      *        `actorId`, because no text entered the model and the verb carries no caller identity. A
      *        consumer keying `detail.inputId` off this row must treat it as ABSENT on this lane.
+     *        Fence tension (design/384 slice 2): this notice asserts THE CUT only — when the cut
+     *        raced a durable park whose commit was already in flight, the gate's durable leg may
+     *        still collect to `suspended` (park wins, row redeemable, no `haltedByUser`); the notice
+     *        stands beside that terminal without contradiction, because a seat really was cut.
      *    In both lanes: one notice per REAL cut (a `now` that found nothing in flight or whose frame
      *    already rode the imminent boundary, and a halt with nothing in flight, announce nothing — no
      *    false interrupt claims); `runId` (#499) is the INVOCATION that was cut (the other two ids are
@@ -5749,6 +5824,32 @@ export interface EngineNotice {
      *    implemented, so the unhonored-knob disclosure it carried has no referent; consumers must
      *    judge ladder support by VERSION, never by that code's absence.
      *
+     *  - `"task.halt_unconsumed"` (design/384 slice 1) — the user's stop verb ({@link TaskStream.halt})
+     *    was ANSWERED (not refused) while the run's ending was already owned by its own abort: nothing
+     *    was cut and nothing was stopped by the halt, the run's own ending stands, and the result will
+     *    NOT carry `haltedByUser` for it (the attribution seat never signs someone else's stop). This
+     *    notice is the halt's only trace on that arm — without it the verb receipt (`{turnCut:false}`)
+     *    was the sole record and the caller could not tell "my stop did nothing because the run beat
+     *    me to ending" from "my stop is being honored at the next boundary". Minted once per such verb
+     *    call (each arrival is a distinct fact); `detail: { sessionId, runId, taskId? }` — `runId` is
+     *    the run whose ending the halt failed to claim. Audience `"user"` (the person who pressed
+     *    stop). A REFUSED halt (typed `steering.not_running` throw) mints nothing: the refusal itself
+     *    is the loud answer.
+     *
+     *  - `"task.late_approval"` (design/384 slice 1) — a synchronous ask approval was NOT CONSUMED:
+     *    a run or turn interrupt released the wait (the `resolveAsk` race arm detached the approver's
+     *    promise; an unconsumed resolve is the approver releasing its wait, never a verdict), so the
+     *    tool did NOT run and the approval was not honored. The notice asserts non-consumption ONLY —
+     *    never an arrival order: an approval and an abort settling close together read as the abort
+     *    (the resolver's documented one-directional residual — the engine never claims a person
+     *    decided something it cannot show they did, and it equally never claims which came first).
+     *    Minted only for a value that reads as an APPROVAL — an unconsumed
+     *    deny/refusal is an ordinary release and leaves no trace, and an unconsumed REJECTION goes to
+     *    `onError(phase:"hook")` instead (a failing callback, not an answer). One notice per
+     *    unconsumed approval; `detail: { toolName, toolCallId, sessionId, runId, taskId? }`. Audience `"user"`
+     *    (whoever answered the card is the one entitled to hear the answer ran nothing); a host may
+     *    forward it on its own wire.
+     *
      *  - `"steering.parked_input_blocked"` (design/373 §4.3) — a PARKED steer entry was withheld when
      *    a resume redelivered it (any resume kind that drains parked steers — wake included) by the
      *    deployment's `userPromptSubmit` screen (block verdict, or a fail-closed non-answer/crash):

package/dist/core/untrusted-text.js

@@ -196,7 +196,23 @@ export const ENGINE_ENVELOPES = Object.freeze([
         tag: "teammate-message",
         kind: "framing",
         mint: "agents/send-message-tool.ts (INTERPOLATED tag — invisible to the literal census)",
-        guard: "escapeEnvelopeTag(TEAMMATE_MESSAGE_TAG, …) on body/summary + escapeAttributeValue on attributes",
+        guard: "body through neutralizePeerBody (the authority family, ENGINE_AUTHORITY_ENVELOPE_TAGS) + escapeEnvelopeTag(TEAMMATE_MESSAGE_TAG, …); summary/teammate_id through escapeAttributeValue",
+        fenced: false,
+        disclosed: false,
+    },
+    {
+        tag: "agent-message",
+        kind: "framing",
+        mint: "core/task-notification.ts renderAgentMessageFrame (INTERPOLATED tag — invisible to the literal census; the child → parent uplink carrier)",
+        guard: "body through neutralizePeerBody (the authority family, ENGINE_AUTHORITY_ENVELOPE_TAGS — the one helper the three peer carriers share) + escapeEnvelopeTag(AGENT_MESSAGE_TAG, …); the from attribute through attrEscape",
+        fenced: false,
+        disclosed: false,
+    },
+    {
+        tag: "cross-session-message",
+        kind: "framing",
+        mint: "agents/cross-session-envelope.ts buildCrossSessionEnvelope / encodeCcPeerFrame (INTERPOLATED tag — invisible to the literal census)",
+        guard: "model-face body through neutralizePeerBody (the authority family, ENGINE_AUTHORITY_ENVELOPE_TAGS) + escapeEnvelopeTag(CROSS_SESSION_MESSAGE_TAG, …); every attribute value typed + under its own regex grammar at build, and the parser rebuilds-and-compares (round trip) before accepting any field. The CC wire codec carries bytes as-is (containment is applied at injection when the model face is re-minted)",
         fenced: false,
         disclosed: false,
     },

package/dist/engine/compaction/compaction.js

@@ -1,7 +1,7 @@
 import { resolveAgentCoreCompleteFn, } from "../loop/runtime-deps.js";
 import { asAgentMessage, convertToLlm, createCompactionSummaryMessage, createCustomMessage, } from "../harness/messages.js";
 import { buildSessionContext } from "../session/session.js";
-import { CompactionError, err, ok, } from "../harness/types.js";
+import { CompactionError, err, isSyntheticApiErrorMessage, ok, } from "../harness/types.js";
 import { budgetInvokedSkillsRetention, computeFileLists, createFileOps, extractFileOpsFromMessage, extractInvokedSkills, extractPersistedOutputRefs, formatFileOperations, formatPersistedOutputRefs, PERSISTED_OUTPUT_REFS_MAX_ENTRIES, readElidedMessages, readPersistedOutputRefs, readRetainedInvokedSkills, readUnsummarizedMessages, replaceInvokedSkillBodiesForSummary, serializeConversation, stripFileOperationsFooter, } from "./utils.js";
 import { ENGINE_AUTHORITY_ENVELOPE_TAGS, sanitizeUntrustedText } from "../../core/untrusted-text.js";
 import { sliceHeadSafe } from "../../core/surrogate-safe-slice.js";
@@ -223,9 +223,13 @@ function findValidCutPoints(entries, startIndex, endIndex) {
                     case "custom":
                     case "compactionSummary":
                     case "user":
-                    case "assistant":
                         cutPoints.push(i);
                         break;
+                    case "assistant":
+                        if (!isSyntheticApiErrorMessage(entry.message)) {
+                            cutPoints.push(i);
+                        }
+                        break;
                     case "toolResult":
                         break;
                 }

package/dist/engine/harness/agent-harness.d.ts

@@ -168,16 +168,17 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
      *  gated: its splice opens a NEW run (idle-park redelivery), and a halt belongs to the run that
      *  minted it. */
     engineInjectionsHeld?: () => boolean;
-    /** RB-30: shared recovery sweep — collects engine-note payloads from the given queues
-     *  in DELIVERY order (steer before followUp, each queue forward — the live loop serves steering
-     *  first, so the recovered redelivery must not present "later" frames ahead of "now/next"),
-     *  removes those entries, and hands the payloads to the runner sink. Called from BOTH terminal
-     *  paths: the natural agent_end AND abort() (which clears the queues before agent_end would see
-     *  them — the hard-abort race that round-1 shipped would have lost). */
     /** RB-30 R2 belt-and-braces: runner-callable idempotent recovery for exit paths that reach
      *  neither agent_end nor abort() (a pre-prompt throw after prepare). Swept entries are removed,
      *  so a double call is a no-op. */
     recoverUndrainedEngineNotes(): void;
+    /** RB-30: shared recovery sweep — collects engine-note payloads from the given queues
+     *  in DELIVERY order (steer before followUp, each queue forward — the live loop serves steering
+     *  first, so the recovered redelivery must not present "later" frames ahead of "now/next"),
+     *  removes those entries, and hands the payloads to the runner sink. Called from BOTH terminal
+     *  paths: the natural agent_end AND abort() — which does NOT clear the queues: #389 retired that
+     *  clearing, so they are LEFT STANDING (the durable-park migration reads them AFTER abort()
+     *  returns) and the abort-side pass is the belt for an exit that never reached agent_end. */
     private sweepUndrainedEngineNotes;
     /** backlog #259 — what remains in the steer/follow-up queues AFTER the engine-note sweep is USER
      *  input that was accepted ("queued") and will never be consumed: the run reached agent_end first.
@@ -261,6 +262,27 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     setStopGate(gate: (() => Promise<AgentMessage[]>) | undefined): void;
     private validateToolNames;
     private flushPendingSessionWrites;
+    /**
+     * #506 ㋐ — write the transcript's record of a TERMINAL provider failure (CC 2.1.250 parity, `Oo`/`CIt`).
+     *
+     * A SEPARATE object, never the live frame: `failure` is the engine's terminal error shell and every
+     * other consumer of it (the run result, failover, telemetry, usage accounting) reads its real
+     * `model`, so re-stamping that field in place would corrupt all of them. The record is minted here
+     * with the reserved {@link SYNTHETIC_MESSAGE_MODEL} instead, which is what makes it recognizable — and
+     * therefore droppable — at the request boundary and at the derived-state walks.
+     *
+     * Two CC fields are deliberately NOT copied, because this tree already states the same facts more
+     * honestly: CC writes `stop_reason: "stop_sequence"` on an entry that stopped for no such reason (its
+     * own consumers must read `isApiErrorMessage` to know better), and CC writes a zero `usage` with
+     * nothing marking it synthetic. Here the stop reason stays `"error"` and `usageMissing` says the zeros
+     * are a shell rather than a measurement — the same discipline the live frame already carries.
+     *
+     * BEST-EFFORT: a record of a failure must never become a second failure. The append can lose the
+     * session's optimistic lock (another writer moved the leaf) or hit a storage fault, and the run is
+     * already over — swallowing that leaves the pre-#506 behavior (no record) rather than converting a
+     * provider outage into a harness throw on the teardown path.
+     */
+    private recordApiFailure;
     private handleAgentEvent;
     private emitRunFailure;
     private executeTurn;

package/dist/engine/harness/agent-harness.js

@@ -4,7 +4,8 @@ import { resolveAgentCoreStreamFn } from "../loop/runtime-deps.js";
 import { normalizeEngineSegments } from "../../core/untrusted-text.js";
 import { AUTH_CARRIER_NAMES } from "../../brain/request-params.js";
 import { convertToLlm } from "./messages.js";
-import { AgentHarnessError, CompactionError, SessionError, toError, } from "./types.js";
+import { AgentHarnessError, CompactionError, SessionError, SYNTHETIC_MESSAGE_MODEL, toError, } from "./types.js";
+const API_FAILURE_RECORD_MAX_CHARS = 2000;
 function createUserMessage(text, images, provenance) {
     const content = text.length > 0 ? [{ type: "text", text }] : [];
     if (images) {
@@ -603,12 +604,13 @@ export class AgentHarness {
                     },
                 };
             },
-            beforeToolCall: async ({ toolCall, args }) => {
+            beforeToolCall: async ({ toolCall, args }, signal) => {
                 const result = await this.emitHook({
                     type: "tool_call",
                     toolCallId: toolCall.id,
                     toolName: toolCall.name,
                     input: args,
+                    ...(signal !== undefined ? { signal } : {}),
                 });
                 return result;
             },
@@ -726,6 +728,33 @@ export class AgentHarness {
             this.pendingSessionWrites.shift();
         }
     }
+    async recordApiFailure(failure) {
+        const raw = failure.errorMessage?.trim();
+        const detail = raw !== undefined && raw.length > API_FAILURE_RECORD_MAX_CHARS
+            ? `${raw.slice(0, API_FAILURE_RECORD_MAX_CHARS)}… (truncated)`
+            : raw;
+        const record = {
+            role: "assistant",
+            content: [{ type: "text", text: detail ? `API Error: ${detail}` : "API Error" }],
+            api: failure.api,
+            provider: failure.provider,
+            model: SYNTHETIC_MESSAGE_MODEL,
+            isApiErrorMessage: true,
+            ...(failure.apiErrorStatus !== undefined ? { apiErrorStatus: failure.apiErrorStatus } : {}),
+            ...(failure.requestId !== undefined ? { requestId: failure.requestId } : {}),
+            usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } },
+            usageMissing: true,
+            stopReason: "error",
+            ...(failure.errorMessage !== undefined ? { errorMessage: failure.errorMessage } : {}),
+            ...(failure.errorKind !== undefined ? { errorKind: failure.errorKind } : {}),
+            timestamp: failure.timestamp,
+        };
+        try {
+            await this.session.appendMessage(record);
+        }
+        catch {
+        }
+    }
     async handleAgentEvent(event, signal) {
         if (event.type === "message_end") {
             let entryId;
@@ -733,6 +762,9 @@ export class AgentHarness {
                 entryId = await this.session.appendMessage(event.message);
                 this.settleInjectedFrame(event.message);
             }
+            else if (event.message.isApiErrorMessage === true) {
+                await this.recordApiFailure(event.message);
+            }
             await this.emitAny(entryId !== undefined ? { ...event, entryId } : event, signal);
             return;
         }

package/dist/engine/harness/messages.js

@@ -1,3 +1,4 @@
+import { isSyntheticApiErrorMessage } from "./types.js";
 import { parseSessionTimestampMs, requireSessionTimestampMs } from "../session/timestamps.js";
 export function asAgentMessage(message) {
     return message;
@@ -155,6 +156,9 @@ export function convertToLlm(messages) {
             case "user":
             case "assistant":
             case "toolResult":
+                if (isSyntheticApiErrorMessage(message)) {
+                    return undefined;
+                }
                 return normalizeLlmMessageContent(message);
             default:
                 return undefined;

package/dist/engine/harness/types.d.ts

@@ -754,6 +754,37 @@ export declare function isValidModelChange(e: {
     provider?: unknown;
     modelId?: unknown;
 }): boolean;
+/**
+ * #506 ㋐ — the reserved `model` value on a transcript entry NO MODEL PRODUCED. CC-verbatim
+ * (`"<synthetic>"`, CC 2.1.250's own single-occurrence constant), and single-occurrence here for the
+ * same reason: the mint site and the recognition predicate must read the same literal or the entry
+ * becomes unrecognizable the first time one of them is retyped.
+ *
+ * It is deliberately a MODEL-SHAPED string (non-empty, bounded), so an entry carrying it survives this
+ * session's own import door and round-trips — a self-generated entry its own validator rejected would
+ * be the worse failure.
+ *
+ * ACCEPTED RESIDUAL, recorded rather than defended against: nothing RESERVES this id, because model ids
+ * are caller-supplied and `isModelIdentifier` admits any bounded non-empty string. A deployment that
+ * names a real model literally `<synthetic>` AND whose Brain stamps `isApiErrorMessage` on
+ * content-bearing output would have that output treated as a record. Both halves are required, the
+ * spelling is chosen to be one no catalog would use, and CC carries the same residual for the same
+ * reason — a reserved-word door here would refuse ids this engine has no business refusing.
+ */
+export declare const SYNTHETIC_MESSAGE_MODEL = "<synthetic>";
+/**
+ * #506 ㋐ — is this transcript entry the engine's own SYNTHETIC record of a terminal API failure?
+ *
+ * Such an entry is real transcript (a session that died on a provider failure must say so when it is
+ * re-read) but it is NOT model output, so it is dropped wherever transcript becomes model input, and
+ * it must not move any state derived from real turns. This predicate is the single gate for both.
+ *
+ * THREE keys, CC-anchored (`Hje`: `type==="assistant" && isApiErrorMessage===true && model===<synthetic>`),
+ * and the narrowness is the whole point. `isApiErrorMessage` alone would also match an assistant message
+ * a foreign Brain stamped while it carried REAL output — dropping that from the request view would
+ * silently delete the model's own words from its context. Only the engine's own mint sets all three.
+ */
+export declare function isSyntheticApiErrorMessage(m: unknown): boolean;
 /** RB-128: a `label` / `session_info.name` that is not a string reaches `.trim()` inside
  *  `BaseSessionStorage`'s CONSTRUCTOR — and the file backend validates BEFORE constructing any storage, so
  *  the contamination lands on disk and every later `open()` throws a raw `TypeError` (not even a `SessionError`).
@@ -1077,6 +1108,12 @@ export interface ToolCallEvent {
     toolCallId: string;
     toolName: string;
     input: Record<string, unknown>;
+    /** The per-call abort signal (additive, design/384 slice 1). Present iff the loop handed its
+     *  turn-scoped signal to `beforeToolCall` — the run-level abort is composed into that controller,
+     *  so this signal fires on a turn interrupt (bare halt / steer-now) AND on a run abort. Absent on
+     *  emits that carry no per-call signal; a subscriber gating a wait on it must then fall back to
+     *  whatever run-level signal it already holds (the historical shape, byte-identical). */
+    signal?: AbortSignal;
 }
 export interface ToolResultEvent {
     type: "tool_result";

package/dist/engine/harness/types.js

@@ -155,6 +155,11 @@ export function isValidThinkingLevelChange(e) {
 export function isValidModelChange(e) {
     return isModelIdentifier(e.provider) && isModelIdentifier(e.modelId);
 }
+export const SYNTHETIC_MESSAGE_MODEL = "<synthetic>";
+export function isSyntheticApiErrorMessage(m) {
+    const a = m;
+    return a?.role === "assistant" && a.isApiErrorMessage === true && a.model === SYNTHETIC_MESSAGE_MODEL;
+}
 export function isOptionalDisplayString(v, max = 4096) {
     return v === undefined || v === null || (typeof v === "string" && v.length <= max);
 }

package/dist/engine/session/session.js

@@ -1,5 +1,5 @@
 import { asAgentMessage, createCompactionSummaryMessage, createCustomMessage, } from "../harness/messages.js";
-import { SessionError, isValidModelChange, normalizeAnnouncedListing, normalizeCompactionStateCarrier, normalizeGitAnnouncement, normalizeReminderMark, normalizeWorkspaceState } from "../harness/types.js";
+import { SessionError, isSyntheticApiErrorMessage, isValidModelChange, normalizeAnnouncedListing, normalizeCompactionStateCarrier, normalizeGitAnnouncement, normalizeReminderMark, normalizeWorkspaceState } from "../harness/types.js";
 import { normalizePromptEpoch } from "../../prompt-assembly/epoch.js";
 import { budgetInvokedSkillsRetention, readElidedMessages, readRetainedInvokedSkills, readUnsummarizedMessages, renderInvokedSkillsRetention, } from "../compaction/utils.js";
 const RETENTION_CLAMP_DEFAULT_CHARS_PER_TOKEN = 3;
@@ -25,7 +25,8 @@ export function buildSessionContext(pathEntries, opts) {
             model = { provider: entry.provider, modelId: entry.modelId };
         }
         else if (entry.type === "message" && entry.message.role === "assistant") {
-            if (isValidModelChange({ provider: entry.message.provider, modelId: entry.message.model })) {
+            if (!isSyntheticApiErrorMessage(entry.message) &&
+                isValidModelChange({ provider: entry.message.provider, modelId: entry.message.model })) {
                 model = { provider: entry.message.provider, modelId: entry.message.model };
             }
         }

package/dist/index.d.ts

@@ -95,7 +95,7 @@ export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY
 export { deploymentReadFaceClampNotice, resolveReadFace, type ReadFace, type ReadFaceInputs } from "./tools/fs/index.js";
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
@@ -118,7 +118,7 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
@@ -166,7 +166,7 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { InMemorySessionRuleOverlay, type SessionRuleOverlay, type SessionRuleOverlayAdd, type SessionRuleOverlayApplyResult, } from "./core/permission-rule-session.js";
@@ -252,6 +252,9 @@ export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE,
 export { getSessionRetainLedger, releaseSessionRetainLedger, } from "./agents/retain-ledger.js";
 export { createSendMessageTool, createAgentContinuationVerb, SEND_MESSAGE_TOOL_NAME, type SendMessageToolOptions, type AgentContinuationReceipt } from "./agents/send-message-tool.js";
 export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerAdmissionConfig, PEER_ADMISSION_DEFAULTS, PEER_HOP_CHAIN_WINDOW, PEER_MESSAGE_NOTICE, createPeerSelfRef, createPeerInboundChainRef, peerAxisToken, appendHopToken, type PeerAdmission, type PeerAdmissionConfig, type PeerAdmissionOptions, type PeerAdmissionRequest, type PeerAdmissionVerdict, type PeerAdmissionRefusal, type PeerRefusalCode, type PeerAxisTag, type PeerIdentity, type PeerSelfRef, type PeerInboundChainRef, } from "./agents/peer-admission.js";
+export { CROSS_SESSION_MESSAGE_TAG, CROSS_SESSION_MESSAGE_NOTICE, PERMISSION_MODE_CLASSES, isPermissionModeClass, CrossSessionCodecError, PEER_HOP_TOKEN_HEX, PEER_HOP_CHAIN_CARRY_WINDOW, encodePeerAddress, isCanonicalPeerAddress, encodeScopeAttribute, decodeScopeAttribute, canonicalPeerDisplayName, buildCrossSessionEnvelope, parseCrossSessionEnvelope, clampHopChain, encodeCcPeerFrame, decodeCcPeerFrame, type PermissionModeClass, type CrossSessionEnvelopeFields, type CrossSessionEnvelopeParse, type CrossSessionEnvelopeRefusal, type CcPeerFrameFields, type CcPeerFrameParse, } from "./agents/cross-session-envelope.js";
+export { CROSS_SESSION_INBOUND_SETTINGS, isCrossSessionInboundSetting, resolveCrossSessionInboundSetting, CROSS_SESSION_HOLD_CAUSES, describeCrossSessionHoldCause, judgeCrossSessionInbound, foldPermissionModeClass, PEER_SEND_VERDICT_CODES, peerSendVerdictSeverity, type CrossSessionInboundSetting, type CrossSessionSettingSource, type CrossSessionInboundSettingLayers, type ResolvedCrossSessionInboundSetting, type CrossSessionHoldCause, type CrossSessionInboundVerdict, type CrossSessionInboundInput, type PeerSendVerdictCode, type PeerSendVerdict, } from "./agents/cross-session-judge.js";
+export { PEER_REF_MIN, PEER_REF_MAX, PEER_REF_RE, mintPeerRef, formatPeerNameRef, parsePeerNameRef, normalizePeerName, PEER_ADDRESS_PREFIXES, reservedPeerNameReason, type PeerRefEntry, } from "./agents/cross-session-ref.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, type AgentTranscriptToolOptions, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";
 export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_USE, EXPLORE_WHEN_TO_USE_LEAN, PLAN_WHEN_TO_USE, EXPLORE_SYSTEM_PROMPT, PLAN_SYSTEM_PROMPT, } from "./agents/builtin-agents.js";

package/dist/index.js

@@ -95,7 +95,7 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, } from "./core/park-selfcheck.js";
 export {} from "./core/checkpoint-store.js";
@@ -126,7 +126,7 @@ export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/au
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { InMemorySessionRuleOverlay, } from "./core/permission-rule-session.js";
@@ -209,6 +209,9 @@ export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE,
 export { getSessionRetainLedger, releaseSessionRetainLedger, } from "./agents/retain-ledger.js";
 export { createSendMessageTool, createAgentContinuationVerb, SEND_MESSAGE_TOOL_NAME } from "./agents/send-message-tool.js";
 export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerAdmissionConfig, PEER_ADMISSION_DEFAULTS, PEER_HOP_CHAIN_WINDOW, PEER_MESSAGE_NOTICE, createPeerSelfRef, createPeerInboundChainRef, peerAxisToken, appendHopToken, } from "./agents/peer-admission.js";
+export { CROSS_SESSION_MESSAGE_TAG, CROSS_SESSION_MESSAGE_NOTICE, PERMISSION_MODE_CLASSES, isPermissionModeClass, CrossSessionCodecError, PEER_HOP_TOKEN_HEX, PEER_HOP_CHAIN_CARRY_WINDOW, encodePeerAddress, isCanonicalPeerAddress, encodeScopeAttribute, decodeScopeAttribute, canonicalPeerDisplayName, buildCrossSessionEnvelope, parseCrossSessionEnvelope, clampHopChain, encodeCcPeerFrame, decodeCcPeerFrame, } from "./agents/cross-session-envelope.js";
+export { CROSS_SESSION_INBOUND_SETTINGS, isCrossSessionInboundSetting, resolveCrossSessionInboundSetting, CROSS_SESSION_HOLD_CAUSES, describeCrossSessionHoldCause, judgeCrossSessionInbound, foldPermissionModeClass, PEER_SEND_VERDICT_CODES, peerSendVerdictSeverity, } from "./agents/cross-session-judge.js";
+export { PEER_REF_MIN, PEER_REF_MAX, PEER_REF_RE, mintPeerRef, formatPeerNameRef, parsePeerNameRef, normalizePeerName, PEER_ADDRESS_PREFIXES, reservedPeerNameReason, } from "./agents/cross-session-ref.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";
 export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_USE, EXPLORE_WHEN_TO_USE_LEAN, PLAN_WHEN_TO_USE, EXPLORE_SYSTEM_PROMPT, PLAN_SYSTEM_PROMPT, } from "./agents/builtin-agents.js";

package/dist/internal/harness.d.ts

@@ -25,3 +25,4 @@ export { uuidv7 } from "../engine/session/uuid.js";
 export { SessionError } from "../engine/harness/types.js";
 export { normalizeGitAnnouncement } from "../engine/harness/types.js";
 export { gitFrameContextVisible } from "../engine/session/session.js";
+export { isSyntheticApiErrorMessage } from "../engine/harness/types.js";

package/dist/internal/harness.js

@@ -14,3 +14,4 @@ export { uuidv7 } from "../engine/session/uuid.js";
 export { SessionError } from "../engine/harness/types.js";
 export { normalizeGitAnnouncement } from "../engine/harness/types.js";
 export { gitFrameContextVisible } from "../engine/session/session.js";
+export { isSyntheticApiErrorMessage } from "../engine/harness/types.js";